asn1_bit_string_length: 34| 290k| uint8_t *out_padding_bits) { 35| 290k| int len = str->length; 36| 290k| if (str->flags & ASN1_STRING_FLAG_BITS_LEFT) { ------------------ | | 497| 290k|#define ASN1_STRING_FLAG_BITS_LEFT 0x08 ------------------ | Branch (36:7): [True: 290k, False: 0] ------------------ 37| | // If the string is already empty, it cannot have padding bits. 38| 290k| *out_padding_bits = len == 0 ? 0 : str->flags & 0x07; ------------------ | Branch (38:25): [True: 7.92k, False: 282k] ------------------ 39| 290k| return len; 40| 290k| } 41| | 42| | // TODO(https://crbug.com/boringssl/447): If we move this logic to 43| | // |ASN1_BIT_STRING_set_bit|, can we remove this representation? 44| 0| while (len > 0 && str->data[len - 1] == 0) { ------------------ | Branch (44:10): [True: 0, False: 0] | Branch (44:21): [True: 0, False: 0] ------------------ 45| 0| len--; 46| 0| } 47| 0| uint8_t padding_bits = 0; 48| 0| if (len > 0) { ------------------ | Branch (48:7): [True: 0, False: 0] ------------------ 49| 0| uint8_t last = str->data[len - 1]; 50| 0| assert(last != 0); 51| 0| for (; padding_bits < 7; padding_bits++) { ------------------ | Branch (51:12): [True: 0, False: 0] ------------------ 52| 0| if (last & (1 << padding_bits)) { ------------------ | Branch (52:11): [True: 0, False: 0] ------------------ 53| 0| break; 54| 0| } 55| 0| } 56| 0| } 57| 0| *out_padding_bits = padding_bits; 58| 0| return len; 59| 0|} i2c_ASN1_BIT_STRING: 71| 290k|int i2c_ASN1_BIT_STRING(const ASN1_BIT_STRING *a, unsigned char **pp) { 72| 290k| if (a == NULL) { ------------------ | Branch (72:7): [True: 0, False: 290k] ------------------ 73| 0| return 0; 74| 0| } 75| | 76| 290k| uint8_t bits; 77| 290k| int len = asn1_bit_string_length(a, &bits); 78| 290k| if (len > INT_MAX - 1) { ------------------ | Branch (78:7): [True: 0, False: 290k] ------------------ 79| 0| OPENSSL_PUT_ERROR(ASN1, ERR_R_OVERFLOW); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 80| 0| return 0; 81| 0| } 82| 290k| int ret = 1 + len; 83| 290k| if (pp == NULL) { ------------------ | Branch (83:7): [True: 218k, False: 71.9k] ------------------ 84| 218k| return ret; 85| 218k| } 86| | 87| 71.9k| uint8_t *p = *pp; 88| 71.9k| *(p++) = bits; 89| 71.9k| OPENSSL_memcpy(p, a->data, len); 90| 71.9k| if (len > 0) { ------------------ | Branch (90:7): [True: 70.3k, False: 1.58k] ------------------ 91| 70.3k| p[len - 1] &= (0xff << bits); 92| 70.3k| } 93| 71.9k| p += len; 94| 71.9k| *pp = p; 95| 71.9k| return ret; 96| 290k|} asn1_marshal_bit_string: 99| 2| CBS_ASN1_TAG tag) { 100| 2| int len = i2c_ASN1_BIT_STRING(in, nullptr); 101| 2| if (len <= 0) { ------------------ | Branch (101:7): [True: 0, False: 2] ------------------ 102| 0| return 0; 103| 0| } 104| 2| tag = tag == 0 ? CBS_ASN1_BITSTRING : tag; ------------------ | | 217| 2|#define CBS_ASN1_BITSTRING 0x3u ------------------ | Branch (104:9): [True: 2, False: 0] ------------------ 105| 2| CBB child; 106| 2| uint8_t *ptr; 107| 2| return CBB_add_asn1(out, &child, tag) && // ------------------ | Branch (107:10): [True: 2, False: 0] ------------------ 108| 2| CBB_add_space(&child, &ptr, static_cast(len)) && // ------------------ | Branch (108:10): [True: 2, False: 0] ------------------ 109| 2| i2c_ASN1_BIT_STRING(in, &ptr) == len && // ------------------ | Branch (109:10): [True: 2, False: 0] ------------------ 110| 2| CBB_flush(out); ------------------ | Branch (110:10): [True: 2, False: 0] ------------------ 111| 2|} c2i_ASN1_BIT_STRING: 114| 143k| const unsigned char **pp, long len) { 115| 143k| ASN1_BIT_STRING *ret = NULL; 116| 143k| const unsigned char *p; 117| 143k| unsigned char *s; 118| 143k| int padding; 119| 143k| uint8_t padding_mask; 120| | 121| 143k| if (len < 1) { ------------------ | Branch (121:7): [True: 1, False: 143k] ------------------ 122| 1| OPENSSL_PUT_ERROR(ASN1, ASN1_R_STRING_TOO_SHORT); ------------------ | | 361| 1| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 123| 1| goto err; 124| 1| } 125| | 126| 143k| if (len > INT_MAX) { ------------------ | Branch (126:7): [True: 0, False: 143k] ------------------ 127| 0| OPENSSL_PUT_ERROR(ASN1, ASN1_R_STRING_TOO_LONG); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 128| 0| goto err; 129| 0| } 130| | 131| 143k| if ((a == NULL) || ((*a) == NULL)) { ------------------ | Branch (131:7): [True: 69.1k, False: 74.7k] | Branch (131:22): [True: 2.77k, False: 71.9k] ------------------ 132| 71.9k| if ((ret = ASN1_BIT_STRING_new()) == NULL) { ------------------ | Branch (132:9): [True: 0, False: 71.9k] ------------------ 133| 0| return NULL; 134| 0| } 135| 71.9k| } else { 136| 71.9k| ret = (*a); 137| 71.9k| } 138| | 139| 143k| p = *pp; 140| 143k| padding = *(p++); 141| 143k| len--; 142| 143k| if (padding > 7) { ------------------ | Branch (142:7): [True: 21, False: 143k] ------------------ 143| 21| OPENSSL_PUT_ERROR(ASN1, ASN1_R_INVALID_BIT_STRING_BITS_LEFT); ------------------ | | 361| 21| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 144| 21| goto err; 145| 21| } 146| | 147| | // Unused bits in a BIT STRING must be zero. 148| 143k| padding_mask = (1 << padding) - 1; 149| 143k| if (padding != 0 && (len < 1 || (p[len - 1] & padding_mask) != 0)) { ------------------ | Branch (149:7): [True: 4.28k, False: 139k] | Branch (149:24): [True: 2, False: 4.28k] | Branch (149:35): [True: 7, False: 4.27k] ------------------ 150| 9| OPENSSL_PUT_ERROR(ASN1, ASN1_R_INVALID_BIT_STRING_PADDING); ------------------ | | 361| 9| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 151| 9| goto err; 152| 9| } 153| | 154| | // We do this to preserve the settings. If we modify the settings, via 155| | // the _set_bit function, we will recalculate on output 156| 143k| ret->flags &= ~(ASN1_STRING_FLAG_BITS_LEFT | 0x07); // clear ------------------ | | 497| 143k|#define ASN1_STRING_FLAG_BITS_LEFT 0x08 ------------------ 157| 143k| ret->flags |= (ASN1_STRING_FLAG_BITS_LEFT | padding); // set ------------------ | | 497| 143k|#define ASN1_STRING_FLAG_BITS_LEFT 0x08 ------------------ 158| | 159| 143k| if (len > 0) { ------------------ | Branch (159:7): [True: 142k, False: 1.58k] ------------------ 160| 142k| s = reinterpret_cast(OPENSSL_memdup(p, len)); 161| 142k| if (s == NULL) { ------------------ | Branch (161:9): [True: 0, False: 142k] ------------------ 162| 0| goto err; 163| 0| } 164| 142k| p += len; 165| 142k| } else { 166| 1.58k| s = NULL; 167| 1.58k| } 168| | 169| 143k| ret->length = (int)len; 170| 143k| OPENSSL_free(ret->data); 171| 143k| ret->data = s; 172| 143k| ret->type = V_ASN1_BIT_STRING; ------------------ | | 88| 143k|#define V_ASN1_BIT_STRING 3 ------------------ 173| 143k| if (a != NULL) { ------------------ | Branch (173:7): [True: 74.7k, False: 69.1k] ------------------ 174| 74.7k| (*a) = ret; 175| 74.7k| } 176| 143k| *pp = p; 177| 143k| return ret; 178| 31|err: 179| 31| if ((ret != NULL) && ((a == NULL) || (*a != ret))) { ------------------ | Branch (179:7): [True: 30, False: 1] | Branch (179:25): [True: 17, False: 13] | Branch (179:40): [True: 7, False: 6] ------------------ 180| 24| ASN1_BIT_STRING_free(ret); 181| 24| } 182| 31| return NULL; 183| 143k|} i2c_ASN1_INTEGER: 90| 72.8k|int i2c_ASN1_INTEGER(const ASN1_INTEGER *in, unsigned char **outp) { 91| 72.8k| if (in == NULL) { ------------------ | Branch (91:7): [True: 0, False: 72.8k] ------------------ 92| 0| return 0; 93| 0| } 94| | 95| | // |ASN1_INTEGER|s should be represented minimally, but it is possible to 96| | // construct invalid ones. Skip leading zeros so this does not produce an 97| | // invalid encoding or break invariants. 98| 72.8k| CBS cbs; 99| 72.8k| CBS_init(&cbs, in->data, in->length); 100| 72.8k| while (CBS_len(&cbs) > 0 && CBS_data(&cbs)[0] == 0) { ------------------ | Branch (100:10): [True: 72.4k, False: 380] | Branch (100:31): [True: 0, False: 72.4k] ------------------ 101| 0| CBS_skip(&cbs, 1); 102| 0| } 103| | 104| 72.8k| int is_negative = (in->type & V_ASN1_NEG) != 0; ------------------ | | 116| 72.8k|#define V_ASN1_NEG 0x100 ------------------ 105| 72.8k| size_t pad; 106| 72.8k| CBS copy = cbs; 107| 72.8k| uint8_t msb; 108| 72.8k| if (!CBS_get_u8(©, &msb)) { ------------------ | Branch (108:7): [True: 380, False: 72.4k] ------------------ 109| | // Zero is represented as a single byte. 110| 380| is_negative = 0; 111| 380| pad = 1; 112| 72.4k| } else if (is_negative) { ------------------ | Branch (112:14): [True: 49.8k, False: 22.6k] ------------------ 113| | // 0x80...01 through 0xff...ff have a two's complement of 0x7f...ff 114| | // through 0x00...01 and need an extra byte to be negative. 115| | // 0x01...00 through 0x80...00 have a two's complement of 0xfe...ff 116| | // through 0x80...00 and can be negated as-is. 117| 49.8k| pad = msb > 0x80 || ------------------ | Branch (117:11): [True: 21.3k, False: 28.5k] ------------------ 118| 49.8k| (msb == 0x80 && !is_all_zeros(CBS_data(©), CBS_len(©))); ------------------ | Branch (118:12): [True: 130, False: 28.3k] | Branch (118:27): [True: 95, False: 35] ------------------ 119| 49.8k| } else { 120| | // If the high bit is set, the signed representation needs an extra 121| | // byte to be positive. 122| 22.6k| pad = (msb & 0x80) != 0; 123| 22.6k| } 124| | 125| 72.8k| if (CBS_len(&cbs) > INT_MAX - pad) { ------------------ | Branch (125:7): [True: 0, False: 72.8k] ------------------ 126| 0| OPENSSL_PUT_ERROR(ASN1, ERR_R_OVERFLOW); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 127| 0| return 0; 128| 0| } 129| 72.8k| int len = (int)(pad + CBS_len(&cbs)); 130| 72.8k| assert(len > 0); 131| 72.8k| if (outp == NULL) { ------------------ | Branch (131:7): [True: 58.2k, False: 14.5k] ------------------ 132| 58.2k| return len; 133| 58.2k| } 134| | 135| 14.5k| if (pad) { ------------------ | Branch (135:7): [True: 4.36k, False: 10.2k] ------------------ 136| 4.36k| (*outp)[0] = 0; 137| 4.36k| } 138| 14.5k| OPENSSL_memcpy(*outp + pad, CBS_data(&cbs), CBS_len(&cbs)); 139| 14.5k| if (is_negative) { ------------------ | Branch (139:7): [True: 9.96k, False: 4.60k] ------------------ 140| 9.96k| negate_twos_complement(*outp, len); 141| 9.96k| assert((*outp)[0] >= 0x80); 142| 9.96k| } else { 143| 4.60k| assert((*outp)[0] < 0x80); 144| 4.60k| } 145| 14.5k| *outp += len; 146| 14.5k| return len; 147| 14.5k|} c2i_ASN1_INTEGER: 150| 154k| long len) { 151| | // This function can handle lengths up to INT_MAX - 1, but the rest of the 152| | // legacy ASN.1 code mixes integer types, so avoid exposing it to 153| | // ASN1_INTEGERS with larger lengths. 154| 154k| if (len < 0 || len > INT_MAX / 2) { ------------------ | Branch (154:7): [True: 0, False: 154k] | Branch (154:18): [True: 0, False: 154k] ------------------ 155| 0| OPENSSL_PUT_ERROR(ASN1, ASN1_R_TOO_LONG); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 156| 0| return NULL; 157| 0| } 158| | 159| 154k| CBS cbs; 160| 154k| CBS_init(&cbs, *inp, (size_t)len); 161| 154k| int is_negative; 162| 154k| if (!CBS_is_valid_asn1_integer(&cbs, &is_negative)) { ------------------ | Branch (162:7): [True: 10, False: 154k] ------------------ 163| 10| OPENSSL_PUT_ERROR(ASN1, ASN1_R_INVALID_INTEGER); ------------------ | | 361| 10| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 164| 10| return NULL; 165| 10| } 166| | 167| 154k| ASN1_INTEGER *ret = NULL; 168| 154k| if (out == NULL || *out == NULL) { ------------------ | Branch (168:7): [True: 0, False: 154k] | Branch (168:22): [True: 71.6k, False: 82.8k] ------------------ 169| 71.6k| ret = ASN1_INTEGER_new(); 170| 71.6k| if (ret == NULL) { ------------------ | Branch (170:9): [True: 0, False: 71.6k] ------------------ 171| 0| return NULL; 172| 0| } 173| 82.8k| } else { 174| 82.8k| ret = *out; 175| 82.8k| } 176| | 177| | // Convert to |ASN1_INTEGER|'s sign-and-magnitude representation. First, 178| | // determine the size needed for a minimal result. 179| 154k| if (is_negative) { ------------------ | Branch (179:7): [True: 11.0k, False: 143k] ------------------ 180| | // 0xff00...01 through 0xff7f..ff have a two's complement of 0x00ff...ff 181| | // through 0x000100...001 and need one leading zero removed. 0x8000...00 182| | // through 0xff00...00 have a two's complement of 0x8000...00 through 183| | // 0x0100...00 and will be minimally-encoded as-is. 184| 11.0k| if (CBS_len(&cbs) > 0 && CBS_data(&cbs)[0] == 0xff && ------------------ | Branch (184:9): [True: 11.0k, False: 0] | Branch (184:30): [True: 4.36k, False: 6.70k] ------------------ 185| 11.0k| !is_all_zeros(CBS_data(&cbs) + 1, CBS_len(&cbs) - 1)) { ------------------ | Branch (185:9): [True: 4.33k, False: 28] ------------------ 186| 4.33k| CBS_skip(&cbs, 1); 187| 4.33k| } 188| 143k| } else { 189| | // Remove the leading zero byte, if any. 190| 143k| if (CBS_len(&cbs) > 0 && CBS_data(&cbs)[0] == 0x00) { ------------------ | Branch (190:9): [True: 143k, False: 0] | Branch (190:30): [True: 48.8k, False: 94.5k] ------------------ 191| 48.8k| CBS_skip(&cbs, 1); 192| 48.8k| } 193| 143k| } 194| | 195| 154k| if (!ASN1_STRING_set(ret, CBS_data(&cbs), CBS_len(&cbs))) { ------------------ | Branch (195:7): [True: 0, False: 154k] ------------------ 196| 0| goto err; 197| 0| } 198| | 199| 154k| if (is_negative) { ------------------ | Branch (199:7): [True: 11.0k, False: 143k] ------------------ 200| 11.0k| ret->type = V_ASN1_NEG_INTEGER; ------------------ | | 117| 11.0k|#define V_ASN1_NEG_INTEGER (V_ASN1_INTEGER | V_ASN1_NEG) | | ------------------ | | | | 87| 11.0k|#define V_ASN1_INTEGER 2 | | ------------------ | | #define V_ASN1_NEG_INTEGER (V_ASN1_INTEGER | V_ASN1_NEG) | | ------------------ | | | | 116| 11.0k|#define V_ASN1_NEG 0x100 | | ------------------ ------------------ 201| 11.0k| negate_twos_complement(ret->data, ret->length); 202| 143k| } else { 203| 143k| ret->type = V_ASN1_INTEGER; ------------------ | | 87| 143k|#define V_ASN1_INTEGER 2 ------------------ 204| 143k| } 205| | 206| | // The value should be minimally-encoded. 207| 154k| assert(ret->length == 0 || ret->data[0] != 0); 208| | // Zero is not negative. 209| 154k| assert(!is_negative || ret->length > 0); 210| | 211| 154k| *inp += len; 212| 154k| if (out != NULL) { ------------------ | Branch (212:7): [True: 154k, False: 0] ------------------ 213| 154k| *out = ret; 214| 154k| } 215| 154k| return ret; 216| | 217| 0|err: 218| 0| if (ret != NULL && (out == NULL || *out != ret)) { ------------------ | Branch (218:7): [True: 0, False: 0] | Branch (218:23): [True: 0, False: 0] | Branch (218:38): [True: 0, False: 0] ------------------ 219| 0| ASN1_INTEGER_free(ret); 220| 0| } 221| 0| return NULL; 222| 154k|} ASN1_INTEGER_get: 368| 69.1k|long ASN1_INTEGER_get(const ASN1_INTEGER *a) { 369| 69.1k| return asn1_string_get_long(a, V_ASN1_INTEGER); ------------------ | | 87| 69.1k|#define V_ASN1_INTEGER 2 ------------------ 370| 69.1k|} a_int.cc:_ZL12is_all_zerosPKhm: 67| 4.49k|static int is_all_zeros(const uint8_t *in, size_t len) { 68| 11.3k| for (size_t i = 0; i < len; i++) { ------------------ | Branch (68:22): [True: 11.2k, False: 63] ------------------ 69| 11.2k| if (in[i] != 0) { ------------------ | Branch (69:9): [True: 4.43k, False: 6.83k] ------------------ 70| 4.43k| return 0; 71| 4.43k| } 72| 11.2k| } 73| 63| return 1; 74| 4.49k|} a_int.cc:_ZL22negate_twos_complementPhm: 58| 21.0k|static void negate_twos_complement(uint8_t *buf, size_t len) { 59| 21.0k| uint8_t borrow = 0; 60| 297k| for (size_t i = len - 1; i < len; i--) { ------------------ | Branch (60:28): [True: 276k, False: 21.0k] ------------------ 61| 276k| uint8_t t = buf[i]; 62| 276k| buf[i] = 0u - borrow - t; 63| 276k| borrow |= t != 0; 64| 276k| } 65| 21.0k|} a_int.cc:_ZL26asn1_string_get_abs_uint64PmPK14asn1_string_sti: 286| 69.1k| int type) { 287| 69.1k| if ((a->type & ~V_ASN1_NEG) != type) { ------------------ | | 116| 69.1k|#define V_ASN1_NEG 0x100 ------------------ | Branch (287:7): [True: 0, False: 69.1k] ------------------ 288| 0| OPENSSL_PUT_ERROR(ASN1, ASN1_R_WRONG_INTEGER_TYPE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 289| 0| return 0; 290| 0| } 291| 69.1k| uint8_t buf[sizeof(uint64_t)] = {0}; 292| 69.1k| if (a->length > (int)sizeof(buf)) { ------------------ | Branch (292:7): [True: 0, False: 69.1k] ------------------ 293| 0| OPENSSL_PUT_ERROR(ASN1, ASN1_R_INVALID_INTEGER); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 294| 0| return 0; 295| 0| } 296| 69.1k| OPENSSL_memcpy(buf + sizeof(buf) - a->length, a->data, a->length); 297| 69.1k| *out = CRYPTO_load_u64_be(buf); 298| 69.1k| return 1; 299| 69.1k|} a_int.cc:_ZL21asn1_string_get_int64PlPK14asn1_string_sti: 321| 69.1k|static int asn1_string_get_int64(int64_t *out, const ASN1_STRING *a, int type) { 322| 69.1k| uint64_t v; 323| 69.1k| if (!asn1_string_get_abs_uint64(&v, a, type)) { ------------------ | Branch (323:7): [True: 0, False: 69.1k] ------------------ 324| 0| return 0; 325| 0| } 326| 69.1k| int64_t i64; 327| 69.1k| int fits_in_i64; 328| | // Check |v != 0| to handle manually-constructed negative zeros. 329| 69.1k| if ((a->type & V_ASN1_NEG) && v != 0) { ------------------ | | 116| 69.1k|#define V_ASN1_NEG 0x100 ------------------ | Branch (329:7): [True: 11, False: 69.1k] | Branch (329:33): [True: 11, False: 0] ------------------ 330| 11| i64 = (int64_t)(0u - v); 331| 11| fits_in_i64 = i64 < 0; 332| 69.1k| } else { 333| 69.1k| i64 = (int64_t)v; 334| 69.1k| fits_in_i64 = i64 >= 0; 335| 69.1k| } 336| 69.1k| if (!fits_in_i64) { ------------------ | Branch (336:7): [True: 0, False: 69.1k] ------------------ 337| 0| OPENSSL_PUT_ERROR(ASN1, ASN1_R_INVALID_INTEGER); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 338| 0| return 0; 339| 0| } 340| 69.1k| *out = i64; 341| 69.1k| return 1; 342| 69.1k|} a_int.cc:_ZL20asn1_string_get_longPK14asn1_string_sti: 352| 69.1k|static long asn1_string_get_long(const ASN1_STRING *a, int type) { 353| 69.1k| if (a == NULL) { ------------------ | Branch (353:7): [True: 0, False: 69.1k] ------------------ 354| 0| return 0; 355| 0| } 356| | 357| 69.1k| int64_t v; 358| 69.1k| if (!asn1_string_get_int64(&v, a, type) || // ------------------ | Branch (358:7): [True: 0, False: 69.1k] ------------------ 359| 69.1k| v < LONG_MIN || v > LONG_MAX) { ------------------ | Branch (359:7): [True: 0, False: 69.1k] | Branch (359:23): [True: 0, False: 69.1k] ------------------ 360| | // This function's return value does not distinguish overflow from -1. 361| 0| ERR_clear_error(); 362| 0| return -1; 363| 0| } 364| | 365| 69.1k| return (long)v; 366| 69.1k|} ASN1_mbstring_copy: 35| 326k| ossl_ssize_t len, int inform, unsigned long mask) { 36| 326k| return ASN1_mbstring_ncopy(out, in, len, inform, mask, /*minsize=*/0, 37| 326k| /*maxsize=*/0); 38| 326k|} ASN1_mbstring_ncopy: 46| 326k| ossl_ssize_t minsize, ossl_ssize_t maxsize) { 47| 326k| if (len == -1) { ------------------ | Branch (47:7): [True: 0, False: 326k] ------------------ 48| 0| len = strlen((const char *)in); 49| 0| } 50| 326k| if (!mask) { ------------------ | Branch (50:7): [True: 0, False: 326k] ------------------ 51| 0| mask = DIRSTRING_TYPE; ------------------ | | 684| 0| (B_ASN1_PRINTABLESTRING | B_ASN1_T61STRING | B_ASN1_BMPSTRING | \ | | ------------------ | | | | 122| 0|#define B_ASN1_PRINTABLESTRING 0x0002 | | ------------------ | | (B_ASN1_PRINTABLESTRING | B_ASN1_T61STRING | B_ASN1_BMPSTRING | \ | | ------------------ | | | | 123| 0|#define B_ASN1_T61STRING 0x0004 | | ------------------ | | (B_ASN1_PRINTABLESTRING | B_ASN1_T61STRING | B_ASN1_BMPSTRING | \ | | ------------------ | | | | 134| 0|#define B_ASN1_BMPSTRING 0x0800 | | ------------------ | | 685| 0| B_ASN1_UTF8STRING) | | ------------------ | | | | 135| 0|#define B_ASN1_UTF8STRING 0x2000 | | ------------------ ------------------ 52| 0| } 53| | 54| 326k| int (*decode_func)(CBS *, uint32_t *); 55| 326k| int error; 56| 326k| switch (inform) { 57| 481| case MBSTRING_BMP: ------------------ | | 679| 481|#define MBSTRING_BMP (MBSTRING_FLAG | 2) | | ------------------ | | | | 676| 481|#define MBSTRING_FLAG 0x1000 | | ------------------ ------------------ | Branch (57:5): [True: 481, False: 325k] ------------------ 58| 481| decode_func = CBS_get_ucs2_be; 59| 481| error = ASN1_R_INVALID_BMPSTRING; ------------------ | | 1940| 481|#define ASN1_R_INVALID_BMPSTRING 142 ------------------ 60| 481| break; 61| | 62| 39| case MBSTRING_UNIV: ------------------ | | 680| 39|#define MBSTRING_UNIV (MBSTRING_FLAG | 4) | | ------------------ | | | | 676| 39|#define MBSTRING_FLAG 0x1000 | | ------------------ ------------------ | Branch (62:5): [True: 39, False: 326k] ------------------ 63| 39| decode_func = CBS_get_utf32_be; 64| 39| error = ASN1_R_INVALID_UNIVERSALSTRING; ------------------ | | 1947| 39|#define ASN1_R_INVALID_UNIVERSALSTRING 149 ------------------ 65| 39| break; 66| | 67| 177k| case MBSTRING_UTF8: ------------------ | | 677| 177k|#define MBSTRING_UTF8 (MBSTRING_FLAG) | | ------------------ | | | | 676| 177k|#define MBSTRING_FLAG 0x1000 | | ------------------ ------------------ | Branch (67:5): [True: 177k, False: 149k] ------------------ 68| 177k| decode_func = CBS_get_utf8; 69| 177k| error = ASN1_R_INVALID_UTF8STRING; ------------------ | | 1948| 177k|#define ASN1_R_INVALID_UTF8STRING 150 ------------------ 70| 177k| break; 71| | 72| 148k| case MBSTRING_ASC: ------------------ | | 678| 148k|#define MBSTRING_ASC (MBSTRING_FLAG | 1) | | ------------------ | | | | 676| 148k|#define MBSTRING_FLAG 0x1000 | | ------------------ ------------------ | Branch (72:5): [True: 148k, False: 177k] ------------------ 73| 148k| decode_func = CBS_get_latin1; 74| 148k| error = ERR_R_INTERNAL_ERROR; // Latin-1 inputs are never invalid. ------------------ | | 307| 148k|#define ERR_R_INTERNAL_ERROR (4 | ERR_R_FATAL) | | ------------------ | | | | 303| 148k|#define ERR_R_FATAL 64 | | ------------------ ------------------ 75| 148k| break; 76| | 77| 0| default: ------------------ | Branch (77:5): [True: 0, False: 326k] ------------------ 78| 0| OPENSSL_PUT_ERROR(ASN1, ASN1_R_UNKNOWN_FORMAT); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 79| 0| return -1; 80| 326k| } 81| | 82| | // Check |minsize| and |maxsize| and work out the minimal type, if any. 83| 326k| CBS cbs; 84| 326k| CBS_init(&cbs, in, len); 85| 326k| size_t utf8_len = 0, nchar = 0; 86| 3.99M| while (CBS_len(&cbs) != 0) { ------------------ | Branch (86:10): [True: 3.66M, False: 326k] ------------------ 87| 3.66M| uint32_t c; 88| 3.66M| if (!decode_func(&cbs, &c)) { ------------------ | Branch (88:9): [True: 0, False: 3.66M] ------------------ 89| 0| OPENSSL_PUT_ERROR(ASN1, error); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 90| 0| return -1; 91| 0| } 92| 3.66M| if (nchar == 0 && (inform == MBSTRING_BMP || inform == MBSTRING_UNIV) && ------------------ | | 679| 652k|#define MBSTRING_BMP (MBSTRING_FLAG | 2) | | ------------------ | | | | 676| 326k|#define MBSTRING_FLAG 0x1000 | | ------------------ ------------------ if (nchar == 0 && (inform == MBSTRING_BMP || inform == MBSTRING_UNIV) && ------------------ | | 680| 325k|#define MBSTRING_UNIV (MBSTRING_FLAG | 4) | | ------------------ | | | | 676| 325k|#define MBSTRING_FLAG 0x1000 | | ------------------ ------------------ | Branch (92:9): [True: 326k, False: 3.34M] | Branch (92:24): [True: 481, False: 325k] | Branch (92:50): [True: 38, False: 325k] ------------------ 93| 3.66M| c == 0xfeff) { ------------------ | Branch (93:9): [True: 5, False: 514] ------------------ 94| | // Reject byte-order mark. We could drop it but that would mean 95| | // adding ambiguity around whether a BOM was included or not when 96| | // matching strings. 97| | // 98| | // For a little-endian UCS-2 string, the BOM will appear as 0xfffe 99| | // and will be rejected as noncharacter, below. 100| 5| OPENSSL_PUT_ERROR(ASN1, ASN1_R_ILLEGAL_CHARACTERS); ------------------ | | 361| 5| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 101| 5| return -1; 102| 5| } 103| | 104| | // Update which output formats are still possible. 105| 3.66M| if ((mask & B_ASN1_PRINTABLESTRING) && !asn1_is_printable(c)) { ------------------ | | 122| 3.66M|#define B_ASN1_PRINTABLESTRING 0x0002 ------------------ | Branch (105:9): [True: 0, False: 3.66M] | Branch (105:44): [True: 0, False: 0] ------------------ 106| 0| mask &= ~B_ASN1_PRINTABLESTRING; ------------------ | | 122| 0|#define B_ASN1_PRINTABLESTRING 0x0002 ------------------ 107| 0| } 108| 3.66M| if ((mask & B_ASN1_IA5STRING) && (c > 127)) { ------------------ | | 126| 3.66M|#define B_ASN1_IA5STRING 0x0010 ------------------ | Branch (108:9): [True: 0, False: 3.66M] | Branch (108:38): [True: 0, False: 0] ------------------ 109| 0| mask &= ~B_ASN1_IA5STRING; ------------------ | | 126| 0|#define B_ASN1_IA5STRING 0x0010 ------------------ 110| 0| } 111| 3.66M| if ((mask & B_ASN1_T61STRING) && (c > 0xff)) { ------------------ | | 123| 3.66M|#define B_ASN1_T61STRING 0x0004 ------------------ | Branch (111:9): [True: 0, False: 3.66M] | Branch (111:38): [True: 0, False: 0] ------------------ 112| 0| mask &= ~B_ASN1_T61STRING; ------------------ | | 123| 0|#define B_ASN1_T61STRING 0x0004 ------------------ 113| 0| } 114| 3.66M| if ((mask & B_ASN1_BMPSTRING) && (c > 0xffff)) { ------------------ | | 134| 3.66M|#define B_ASN1_BMPSTRING 0x0800 ------------------ | Branch (114:9): [True: 0, False: 3.66M] | Branch (114:38): [True: 0, False: 0] ------------------ 115| 0| mask &= ~B_ASN1_BMPSTRING; ------------------ | | 134| 0|#define B_ASN1_BMPSTRING 0x0800 ------------------ 116| 0| } 117| 3.66M| if (!mask) { ------------------ | Branch (117:9): [True: 0, False: 3.66M] ------------------ 118| 0| OPENSSL_PUT_ERROR(ASN1, ASN1_R_ILLEGAL_CHARACTERS); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 119| 0| return -1; 120| 0| } 121| | 122| 3.66M| nchar++; 123| 3.66M| utf8_len += CBB_get_utf8_len(c); 124| 3.66M| if (maxsize > 0 && nchar > (size_t)maxsize) { ------------------ | Branch (124:9): [True: 0, False: 3.66M] | Branch (124:24): [True: 0, False: 0] ------------------ 125| 0| OPENSSL_PUT_ERROR(ASN1, ASN1_R_STRING_TOO_LONG); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 126| 0| ERR_add_error_dataf("maxsize=%zu", (size_t)maxsize); 127| 0| return -1; 128| 0| } 129| 3.66M| } 130| | 131| 326k| if (minsize > 0 && nchar < (size_t)minsize) { ------------------ | Branch (131:7): [True: 0, False: 326k] | Branch (131:22): [True: 0, False: 0] ------------------ 132| 0| OPENSSL_PUT_ERROR(ASN1, ASN1_R_STRING_TOO_SHORT); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 133| 0| ERR_add_error_dataf("minsize=%zu", (size_t)minsize); 134| 0| return -1; 135| 0| } 136| | 137| | // Now work out output format and string type 138| 326k| int str_type; 139| 326k| int (*encode_func)(CBB *, uint32_t) = CBB_add_latin1; 140| 326k| size_t size_estimate = nchar; 141| 326k| int outform = MBSTRING_ASC; ------------------ | | 678| 326k|#define MBSTRING_ASC (MBSTRING_FLAG | 1) | | ------------------ | | | | 676| 326k|#define MBSTRING_FLAG 0x1000 | | ------------------ ------------------ 142| 326k| if (mask & B_ASN1_PRINTABLESTRING) { ------------------ | | 122| 326k|#define B_ASN1_PRINTABLESTRING 0x0002 ------------------ | Branch (142:7): [True: 0, False: 326k] ------------------ 143| 0| str_type = V_ASN1_PRINTABLESTRING; ------------------ | | 100| 0|#define V_ASN1_PRINTABLESTRING 19 ------------------ 144| 326k| } else if (mask & B_ASN1_IA5STRING) { ------------------ | | 126| 326k|#define B_ASN1_IA5STRING 0x0010 ------------------ | Branch (144:14): [True: 0, False: 326k] ------------------ 145| 0| str_type = V_ASN1_IA5STRING; ------------------ | | 104| 0|#define V_ASN1_IA5STRING 22 ------------------ 146| 326k| } else if (mask & B_ASN1_T61STRING) { ------------------ | | 123| 326k|#define B_ASN1_T61STRING 0x0004 ------------------ | Branch (146:14): [True: 0, False: 326k] ------------------ 147| 0| str_type = V_ASN1_T61STRING; ------------------ | | 101| 0|#define V_ASN1_T61STRING 20 ------------------ 148| 326k| } else if (mask & B_ASN1_BMPSTRING) { ------------------ | | 134| 326k|#define B_ASN1_BMPSTRING 0x0800 ------------------ | Branch (148:14): [True: 0, False: 326k] ------------------ 149| 0| str_type = V_ASN1_BMPSTRING; ------------------ | | 112| 0|#define V_ASN1_BMPSTRING 30 ------------------ 150| 0| outform = MBSTRING_BMP; ------------------ | | 679| 0|#define MBSTRING_BMP (MBSTRING_FLAG | 2) | | ------------------ | | | | 676| 0|#define MBSTRING_FLAG 0x1000 | | ------------------ ------------------ 151| 0| encode_func = CBB_add_ucs2_be; 152| 0| size_estimate = 2 * nchar; 153| 326k| } else if (mask & B_ASN1_UNIVERSALSTRING) { ------------------ | | 131| 326k|#define B_ASN1_UNIVERSALSTRING 0x0100 ------------------ | Branch (153:14): [True: 0, False: 326k] ------------------ 154| 0| str_type = V_ASN1_UNIVERSALSTRING; ------------------ | | 111| 0|#define V_ASN1_UNIVERSALSTRING 28 ------------------ 155| 0| encode_func = CBB_add_utf32_be; 156| 0| size_estimate = 4 * nchar; 157| 0| outform = MBSTRING_UNIV; ------------------ | | 680| 0|#define MBSTRING_UNIV (MBSTRING_FLAG | 4) | | ------------------ | | | | 676| 0|#define MBSTRING_FLAG 0x1000 | | ------------------ ------------------ 158| 326k| } else if (mask & B_ASN1_UTF8STRING) { ------------------ | | 135| 326k|#define B_ASN1_UTF8STRING 0x2000 ------------------ | Branch (158:14): [True: 326k, False: 0] ------------------ 159| 326k| str_type = V_ASN1_UTF8STRING; ------------------ | | 96| 326k|#define V_ASN1_UTF8STRING 12 ------------------ 160| 326k| outform = MBSTRING_UTF8; ------------------ | | 677| 326k|#define MBSTRING_UTF8 (MBSTRING_FLAG) | | ------------------ | | | | 676| 326k|#define MBSTRING_FLAG 0x1000 | | ------------------ ------------------ 161| 326k| encode_func = CBB_add_utf8; 162| 326k| size_estimate = utf8_len; 163| 326k| } else { 164| 0| OPENSSL_PUT_ERROR(ASN1, ASN1_R_ILLEGAL_CHARACTERS); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 165| 0| return -1; 166| 0| } 167| | 168| 326k| if (!out) { ------------------ | Branch (168:7): [True: 0, False: 326k] ------------------ 169| 0| return str_type; 170| 0| } 171| | 172| 326k| int free_dest = 0; 173| 326k| ASN1_STRING *dest; 174| 326k| if (*out) { ------------------ | Branch (174:7): [True: 326k, False: 0] ------------------ 175| 326k| dest = *out; 176| 326k| } else { 177| 0| free_dest = 1; 178| 0| dest = ASN1_STRING_type_new(str_type); 179| 0| if (!dest) { ------------------ | Branch (179:9): [True: 0, False: 0] ------------------ 180| 0| return -1; 181| 0| } 182| 0| } 183| | 184| 326k| CBB cbb; 185| 326k| CBB_zero(&cbb); 186| | // If both the same type just copy across 187| 326k| uint8_t *data = NULL; 188| 326k| size_t data_len = 0; 189| 326k| if (inform == outform) { ------------------ | Branch (189:7): [True: 177k, False: 149k] ------------------ 190| 177k| if (!ASN1_STRING_set(dest, in, len)) { ------------------ | Branch (190:9): [True: 0, False: 177k] ------------------ 191| 0| goto err; 192| 0| } 193| 177k| dest->type = str_type; 194| 177k| *out = dest; 195| 177k| return str_type; 196| 177k| } 197| 149k| if (!CBB_init(&cbb, size_estimate + 1)) { ------------------ | Branch (197:7): [True: 0, False: 149k] ------------------ 198| 0| goto err; 199| 0| } 200| 149k| CBS_init(&cbs, in, len); 201| 888k| while (CBS_len(&cbs) != 0) { ------------------ | Branch (201:10): [True: 739k, False: 149k] ------------------ 202| 739k| uint32_t c; 203| 739k| if (!decode_func(&cbs, &c) || !encode_func(&cbb, c)) { ------------------ | Branch (203:9): [True: 0, False: 739k] | Branch (203:35): [True: 0, False: 739k] ------------------ 204| 0| OPENSSL_PUT_ERROR(ASN1, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 205| 0| goto err; 206| 0| } 207| 739k| } 208| 149k| if (/* OpenSSL historically NUL-terminated this value with a single byte, 209| | * even for |MBSTRING_BMP| and |MBSTRING_UNIV|. */ 210| 149k| !CBB_add_u8(&cbb, 0) || // ------------------ | Branch (210:7): [True: 0, False: 149k] ------------------ 211| 149k| !CBB_finish(&cbb, &data, &data_len) || // ------------------ | Branch (211:7): [True: 0, False: 149k] ------------------ 212| 149k| data_len < 1 || // ------------------ | Branch (212:7): [True: 0, False: 149k] ------------------ 213| 149k| data_len > INT_MAX) { ------------------ | Branch (213:7): [True: 0, False: 149k] ------------------ 214| 0| OPENSSL_PUT_ERROR(ASN1, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 215| 0| OPENSSL_free(data); 216| 0| goto err; 217| 0| } 218| 149k| dest->type = str_type; 219| 149k| ASN1_STRING_set0(dest, data, (int)data_len - 1); 220| 149k| *out = dest; 221| 149k| return str_type; 222| | 223| 0|err: 224| 0| if (free_dest) { ------------------ | Branch (224:7): [True: 0, False: 0] ------------------ 225| 0| ASN1_STRING_free(dest); 226| 0| } 227| 0| CBB_cleanup(&cbb); 228| 0| return -1; 229| 149k|} c2i_ASN1_OBJECT: 115| 770k| long len) { 116| 770k| if (len < 0) { ------------------ | Branch (116:7): [True: 0, False: 770k] ------------------ 117| 0| OPENSSL_PUT_ERROR(ASN1, ASN1_R_INVALID_OBJECT_ENCODING); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 118| 0| return NULL; 119| 0| } 120| | 121| 770k| CBS cbs; 122| 770k| CBS_init(&cbs, *inp, (size_t)len); 123| 770k| if (!CBS_is_valid_asn1_oid(&cbs)) { ------------------ | Branch (123:7): [True: 23, False: 770k] ------------------ 124| 23| OPENSSL_PUT_ERROR(ASN1, ASN1_R_INVALID_OBJECT_ENCODING); ------------------ | | 361| 23| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 125| 23| return NULL; 126| 23| } 127| | 128| 770k| ASN1_OBJECT *ret = ASN1_OBJECT_create(NID_undef, *inp, (size_t)len, ------------------ | | 43| 770k|#define NID_undef 0 ------------------ 129| | /*sn=*/NULL, /*ln=*/NULL); 130| 770k| if (ret == NULL) { ------------------ | Branch (130:7): [True: 0, False: 770k] ------------------ 131| 0| return NULL; 132| 0| } 133| | 134| 770k| if (out != NULL) { ------------------ | Branch (134:7): [True: 770k, False: 0] ------------------ 135| 770k| ASN1_OBJECT_free(*out); 136| 770k| *out = ret; 137| 770k| } 138| 770k| *inp += len; // All bytes were consumed. 139| 770k| return ret; 140| 770k|} ASN1_OBJECT_new: 142| 1.11M|ASN1_OBJECT *ASN1_OBJECT_new(void) { 143| 1.11M| ASN1_OBJECT *ret; 144| | 145| 1.11M| ret = (ASN1_OBJECT *)OPENSSL_malloc(sizeof(ASN1_OBJECT)); 146| 1.11M| if (ret == NULL) { ------------------ | Branch (146:7): [True: 0, False: 1.11M] ------------------ 147| 0| return NULL; 148| 0| } 149| 1.11M| ret->length = 0; 150| 1.11M| ret->data = NULL; 151| 1.11M| ret->nid = 0; 152| 1.11M| ret->sn = NULL; 153| 1.11M| ret->ln = NULL; 154| 1.11M| ret->flags = ASN1_OBJECT_FLAG_DYNAMIC; ------------------ | | 55| 1.11M|#define ASN1_OBJECT_FLAG_DYNAMIC 0x01 // internal use ------------------ 155| 1.11M| return ret; 156| 1.11M|} ASN1_OBJECT_free: 158| 1.88M|void ASN1_OBJECT_free(ASN1_OBJECT *a) { 159| 1.88M| if (a == NULL) { ------------------ | Branch (159:7): [True: 17.6k, False: 1.86M] ------------------ 160| 17.6k| return; 161| 17.6k| } 162| 1.86M| if (a->flags & ASN1_OBJECT_FLAG_DYNAMIC_STRINGS) { ------------------ | | 56| 1.86M|#define ASN1_OBJECT_FLAG_DYNAMIC_STRINGS 0x04 // internal use ------------------ | Branch (162:7): [True: 1.11M, False: 753k] ------------------ 163| 1.11M| OPENSSL_free((void *)a->sn); 164| 1.11M| OPENSSL_free((void *)a->ln); 165| 1.11M| a->sn = a->ln = NULL; 166| 1.11M| } 167| 1.86M| if (a->flags & ASN1_OBJECT_FLAG_DYNAMIC_DATA) { ------------------ | | 57| 1.86M|#define ASN1_OBJECT_FLAG_DYNAMIC_DATA 0x08 // internal use ------------------ | Branch (167:7): [True: 1.11M, False: 753k] ------------------ 168| 1.11M| OPENSSL_free((void *)a->data); 169| 1.11M| a->data = NULL; 170| 1.11M| a->length = 0; 171| 1.11M| } 172| 1.86M| if (a->flags & ASN1_OBJECT_FLAG_DYNAMIC) { ------------------ | | 55| 1.86M|#define ASN1_OBJECT_FLAG_DYNAMIC 0x01 // internal use ------------------ | Branch (172:7): [True: 1.11M, False: 753k] ------------------ 173| 1.11M| OPENSSL_free(a); 174| 1.11M| } 175| 1.86M|} ASN1_OBJECT_create: 178| 770k| const char *sn, const char *ln) { 179| 770k| if (len > INT_MAX) { ------------------ | Branch (179:7): [True: 0, False: 770k] ------------------ 180| 0| OPENSSL_PUT_ERROR(ASN1, ASN1_R_STRING_TOO_LONG); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 181| 0| return NULL; 182| 0| } 183| | 184| 770k| ASN1_OBJECT o; 185| 770k| o.sn = sn; 186| 770k| o.ln = ln; 187| 770k| o.data = data; 188| 770k| o.nid = nid; 189| 770k| o.length = (int)len; 190| 770k| o.flags = ASN1_OBJECT_FLAG_DYNAMIC | ASN1_OBJECT_FLAG_DYNAMIC_STRINGS | ------------------ | | 55| 770k|#define ASN1_OBJECT_FLAG_DYNAMIC 0x01 // internal use ------------------ o.flags = ASN1_OBJECT_FLAG_DYNAMIC | ASN1_OBJECT_FLAG_DYNAMIC_STRINGS | ------------------ | | 56| 770k|#define ASN1_OBJECT_FLAG_DYNAMIC_STRINGS 0x04 // internal use ------------------ 191| 770k| ASN1_OBJECT_FLAG_DYNAMIC_DATA; ------------------ | | 57| 770k|#define ASN1_OBJECT_FLAG_DYNAMIC_DATA 0x08 // internal use ------------------ 192| 770k| return OBJ_dup(&o); 193| 770k|} ASN1_STRING_to_UTF8: 321| 326k|int ASN1_STRING_to_UTF8(unsigned char **out, const ASN1_STRING *in) { 322| 326k| if (!in) { ------------------ | Branch (322:7): [True: 0, False: 326k] ------------------ 323| 0| return -1; 324| 0| } 325| 326k| int mbflag = string_type_to_encoding(in->type); 326| 326k| if (mbflag == -1) { ------------------ | Branch (326:7): [True: 0, False: 326k] ------------------ 327| 0| OPENSSL_PUT_ERROR(ASN1, ASN1_R_UNKNOWN_TAG); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 328| 0| return -1; 329| 0| } 330| 326k| ASN1_STRING stmp, *str = &stmp; 331| 326k| stmp.data = NULL; 332| 326k| stmp.length = 0; 333| 326k| stmp.flags = 0; 334| 326k| int ret = 335| 326k| ASN1_mbstring_copy(&str, in->data, in->length, mbflag, B_ASN1_UTF8STRING); ------------------ | | 135| 326k|#define B_ASN1_UTF8STRING 0x2000 ------------------ 336| 326k| if (ret < 0) { ------------------ | Branch (336:7): [True: 5, False: 326k] ------------------ 337| 5| return ret; 338| 5| } 339| 326k| *out = stmp.data; 340| 326k| return stmp.length; 341| 326k|} a_strex.cc:_ZL23string_type_to_encodingi: 218| 326k|static int string_type_to_encoding(int type) { 219| | // This function is sometimes passed ASN.1 universal types and sometimes 220| | // passed |ASN1_STRING| type values 221| 326k| switch (type) { ------------------ | Branch (221:11): [True: 0, False: 326k] ------------------ 222| 177k| case V_ASN1_UTF8STRING: ------------------ | | 96| 177k|#define V_ASN1_UTF8STRING 12 ------------------ | Branch (222:5): [True: 177k, False: 149k] ------------------ 223| 177k| return MBSTRING_UTF8; ------------------ | | 677| 177k|#define MBSTRING_UTF8 (MBSTRING_FLAG) | | ------------------ | | | | 676| 177k|#define MBSTRING_FLAG 0x1000 | | ------------------ ------------------ 224| 0| case V_ASN1_NUMERICSTRING: ------------------ | | 99| 0|#define V_ASN1_NUMERICSTRING 18 ------------------ | Branch (224:5): [True: 0, False: 326k] ------------------ 225| 141k| case V_ASN1_PRINTABLESTRING: ------------------ | | 100| 141k|#define V_ASN1_PRINTABLESTRING 19 ------------------ | Branch (225:5): [True: 141k, False: 184k] ------------------ 226| 141k| case V_ASN1_T61STRING: ------------------ | | 101| 141k|#define V_ASN1_T61STRING 20 ------------------ | Branch (226:5): [True: 98, False: 326k] ------------------ 227| 148k| case V_ASN1_IA5STRING: ------------------ | | 104| 148k|#define V_ASN1_IA5STRING 22 ------------------ | Branch (227:5): [True: 7.26k, False: 319k] ------------------ 228| 148k| case V_ASN1_UTCTIME: ------------------ | | 105| 148k|#define V_ASN1_UTCTIME 23 ------------------ | Branch (228:5): [True: 0, False: 326k] ------------------ 229| 148k| case V_ASN1_GENERALIZEDTIME: ------------------ | | 106| 148k|#define V_ASN1_GENERALIZEDTIME 24 ------------------ | Branch (229:5): [True: 0, False: 326k] ------------------ 230| 148k| case V_ASN1_ISO64STRING: ------------------ | | 108| 148k|#define V_ASN1_ISO64STRING 26 ------------------ | Branch (230:5): [True: 8, False: 326k] ------------------ 231| | // |MBSTRING_ASC| refers to Latin-1, not ASCII. 232| 148k| return MBSTRING_ASC; ------------------ | | 678| 148k|#define MBSTRING_ASC (MBSTRING_FLAG | 1) | | ------------------ | | | | 676| 148k|#define MBSTRING_FLAG 0x1000 | | ------------------ ------------------ 233| 39| case V_ASN1_UNIVERSALSTRING: ------------------ | | 111| 39|#define V_ASN1_UNIVERSALSTRING 28 ------------------ | Branch (233:5): [True: 39, False: 326k] ------------------ 234| 39| return MBSTRING_UNIV; ------------------ | | 680| 39|#define MBSTRING_UNIV (MBSTRING_FLAG | 4) | | ------------------ | | | | 676| 39|#define MBSTRING_FLAG 0x1000 | | ------------------ ------------------ 235| 481| case V_ASN1_BMPSTRING: ------------------ | | 112| 481|#define V_ASN1_BMPSTRING 30 ------------------ | Branch (235:5): [True: 481, False: 325k] ------------------ 236| 481| return MBSTRING_BMP; ------------------ | | 679| 481|#define MBSTRING_BMP (MBSTRING_FLAG | 2) | | ------------------ | | | | 676| 481|#define MBSTRING_FLAG 0x1000 | | ------------------ ------------------ 237| 326k| } 238| 0| return -1; 239| 326k|} asn1_type_cleanup: 68| 323k|void asn1_type_cleanup(ASN1_TYPE *a) { 69| 323k| switch (a->type) { 70| 130k| case V_ASN1_NULL: ------------------ | | 90| 130k|#define V_ASN1_NULL 5 ------------------ | Branch (70:5): [True: 130k, False: 193k] ------------------ 71| 130k| a->value.ptr = NULL; 72| 130k| break; 73| 6| case V_ASN1_BOOLEAN: ------------------ | | 86| 6|#define V_ASN1_BOOLEAN 1 ------------------ | Branch (73:5): [True: 6, False: 323k] ------------------ 74| 6| a->value.boolean = ASN1_BOOLEAN_NONE; ------------------ | | 385| 6|#define ASN1_BOOLEAN_NONE (-1) ------------------ 75| 6| break; 76| 17.5k| case V_ASN1_OBJECT: ------------------ | | 91| 17.5k|#define V_ASN1_OBJECT 6 ------------------ | Branch (76:5): [True: 17.5k, False: 305k] ------------------ 77| 17.5k| ASN1_OBJECT_free(a->value.object); 78| 17.5k| a->value.object = NULL; 79| 17.5k| break; 80| 175k| default: ------------------ | Branch (80:5): [True: 175k, False: 148k] ------------------ 81| 175k| ASN1_STRING_free(a->value.asn1_string); 82| 175k| a->value.asn1_string = NULL; 83| 175k| break; 84| 323k| } 85| 323k|} ASN1_TYPE_set: 87| 161k|void ASN1_TYPE_set(ASN1_TYPE *a, int type, void *value) { 88| 161k| asn1_type_cleanup(a); 89| 161k| a->type = type; 90| 161k| switch (type) { 91| 130k| case V_ASN1_NULL: ------------------ | | 90| 130k|#define V_ASN1_NULL 5 ------------------ | Branch (91:5): [True: 130k, False: 31.2k] ------------------ 92| 130k| a->value.ptr = NULL; 93| 130k| break; 94| 6| case V_ASN1_BOOLEAN: ------------------ | | 86| 6|#define V_ASN1_BOOLEAN 1 ------------------ | Branch (94:5): [True: 6, False: 161k] ------------------ 95| 6| a->value.boolean = value ? ASN1_BOOLEAN_TRUE : ASN1_BOOLEAN_FALSE; ------------------ | | 380| 0|#define ASN1_BOOLEAN_TRUE 0xff ------------------ a->value.boolean = value ? ASN1_BOOLEAN_TRUE : ASN1_BOOLEAN_FALSE; ------------------ | | 376| 12|#define ASN1_BOOLEAN_FALSE 0 ------------------ | Branch (95:26): [True: 0, False: 6] ------------------ 96| 6| break; 97| 17.5k| case V_ASN1_OBJECT: ------------------ | | 91| 17.5k|#define V_ASN1_OBJECT 6 ------------------ | Branch (97:5): [True: 17.5k, False: 144k] ------------------ 98| 17.5k| a->value.object = reinterpret_cast(value); 99| 17.5k| break; 100| 13.7k| default: ------------------ | Branch (100:5): [True: 13.7k, False: 148k] ------------------ 101| 13.7k| a->value.asn1_string = reinterpret_cast(value); 102| 13.7k| break; 103| 161k| } 104| 161k|} ASN1_get_object: 75| 4.44M| int *out_class, long in_len) { 76| 4.44M| if (in_len < 0) { ------------------ | Branch (76:7): [True: 0, False: 4.44M] ------------------ 77| 0| OPENSSL_PUT_ERROR(ASN1, ASN1_R_HEADER_TOO_LONG); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 78| 0| return 0x80; 79| 0| } 80| | 81| 4.44M| CBS_ASN1_TAG tag; 82| 4.44M| CBS cbs, body; 83| 4.44M| CBS_init(&cbs, *inp, (size_t)in_len); 84| 4.44M| if (!CBS_get_any_asn1(&cbs, &body, &tag) || ------------------ | Branch (84:7): [True: 253, False: 4.44M] ------------------ 85| | // Bound the length to comfortably fit in an int. Lengths in this 86| | // module often switch between int and long without overflow checks. 87| 4.44M| CBS_len(&body) > INT_MAX / 2) { ------------------ | Branch (87:7): [True: 0, False: 4.44M] ------------------ 88| 253| OPENSSL_PUT_ERROR(ASN1, ASN1_R_HEADER_TOO_LONG); ------------------ | | 361| 253| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 89| 253| return 0x80; 90| 253| } 91| | 92| | // Convert between tag representations. 93| 4.44M| int tag_class = (tag & CBS_ASN1_CLASS_MASK) >> CBS_ASN1_TAG_SHIFT; ------------------ | | 208| 4.44M|#define CBS_ASN1_CLASS_MASK (0xc0u << CBS_ASN1_TAG_SHIFT) | | ------------------ | | | | 194| 4.44M|#define CBS_ASN1_TAG_SHIFT 24 | | ------------------ ------------------ int tag_class = (tag & CBS_ASN1_CLASS_MASK) >> CBS_ASN1_TAG_SHIFT; ------------------ | | 194| 4.44M|#define CBS_ASN1_TAG_SHIFT 24 ------------------ 94| 4.44M| int constructed = (tag & CBS_ASN1_CONSTRUCTED) >> CBS_ASN1_TAG_SHIFT; ------------------ | | 197| 4.44M|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | ------------------ | | | | 194| 4.44M|#define CBS_ASN1_TAG_SHIFT 24 | | ------------------ ------------------ int constructed = (tag & CBS_ASN1_CONSTRUCTED) >> CBS_ASN1_TAG_SHIFT; ------------------ | | 194| 4.44M|#define CBS_ASN1_TAG_SHIFT 24 ------------------ 95| 4.44M| int tag_number = tag & CBS_ASN1_TAG_NUMBER_MASK; ------------------ | | 211| 4.44M|#define CBS_ASN1_TAG_NUMBER_MASK ((1u << (5 + CBS_ASN1_TAG_SHIFT)) - 1) | | ------------------ | | | | 194| 4.44M|#define CBS_ASN1_TAG_SHIFT 24 | | ------------------ ------------------ 96| | 97| | // To avoid ambiguity with V_ASN1_NEG, impose a limit on universal tags. 98| 4.44M| if (tag_class == V_ASN1_UNIVERSAL && tag_number > V_ASN1_MAX_UNIVERSAL) { ------------------ | | 49| 8.88M|#define V_ASN1_UNIVERSAL 0x00 ------------------ if (tag_class == V_ASN1_UNIVERSAL && tag_number > V_ASN1_MAX_UNIVERSAL) { ------------------ | | 69| 4.15M|#define V_ASN1_MAX_UNIVERSAL 0xff ------------------ | Branch (98:7): [True: 4.15M, False: 286k] | Branch (98:40): [True: 23, False: 4.15M] ------------------ 99| 23| OPENSSL_PUT_ERROR(ASN1, ASN1_R_HEADER_TOO_LONG); ------------------ | | 361| 23| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 100| 23| return 0x80; 101| 23| } 102| | 103| 4.44M| *inp = CBS_data(&body); 104| 4.44M| *out_len = CBS_len(&body); 105| 4.44M| *out_tag = tag_number; 106| 4.44M| *out_class = tag_class; 107| 4.44M| return constructed; 108| 4.44M|} ASN1_put_object: 112| 1.71M| int xclass) { 113| 1.71M| unsigned char *p = *pp; 114| 1.71M| int i, ttag; 115| | 116| 1.71M| i = (constructed) ? V_ASN1_CONSTRUCTED : 0; ------------------ | | 56| 826k|#define V_ASN1_CONSTRUCTED 0x20 ------------------ | Branch (116:7): [True: 826k, False: 888k] ------------------ 117| 1.71M| i |= (xclass & V_ASN1_PRIVATE); ------------------ | | 52| 1.71M|#define V_ASN1_PRIVATE 0xc0 ------------------ 118| 1.71M| if (tag < 31) { ------------------ | Branch (118:7): [True: 1.71M, False: 0] ------------------ 119| 1.71M| *(p++) = i | (tag & V_ASN1_PRIMITIVE_TAG); ------------------ | | 63| 1.71M|#define V_ASN1_PRIMITIVE_TAG 0x1f ------------------ 120| 1.71M| } else { 121| 0| *(p++) = i | V_ASN1_PRIMITIVE_TAG; ------------------ | | 63| 0|#define V_ASN1_PRIMITIVE_TAG 0x1f ------------------ 122| 0| for (i = 0, ttag = tag; ttag > 0; i++) { ------------------ | Branch (122:29): [True: 0, False: 0] ------------------ 123| 0| ttag >>= 7; 124| 0| } 125| 0| ttag = i; 126| 0| while (i-- > 0) { ------------------ | Branch (126:12): [True: 0, False: 0] ------------------ 127| 0| p[i] = tag & 0x7f; 128| 0| if (i != (ttag - 1)) { ------------------ | Branch (128:11): [True: 0, False: 0] ------------------ 129| 0| p[i] |= 0x80; 130| 0| } 131| 0| tag >>= 7; 132| 0| } 133| 0| p += ttag; 134| 0| } 135| 1.71M| if (constructed == 2) { ------------------ | Branch (135:7): [True: 0, False: 1.71M] ------------------ 136| 0| *(p++) = 0x80; 137| 1.71M| } else { 138| 1.71M| asn1_put_length(&p, length); 139| 1.71M| } 140| 1.71M| *pp = p; 141| 1.71M|} ASN1_object_size: 174| 5.55M|int ASN1_object_size(int constructed, int length, int tag) { 175| 5.55M| int ret = 1; 176| 5.55M| if (length < 0) { ------------------ | Branch (176:7): [True: 0, False: 5.55M] ------------------ 177| 0| return -1; 178| 0| } 179| 5.55M| if (tag >= 31) { ------------------ | Branch (179:7): [True: 0, False: 5.55M] ------------------ 180| 0| while (tag > 0) { ------------------ | Branch (180:12): [True: 0, False: 0] ------------------ 181| 0| tag >>= 7; 182| 0| ret++; 183| 0| } 184| 0| } 185| 5.55M| if (constructed == 2) { ------------------ | Branch (185:7): [True: 0, False: 5.55M] ------------------ 186| 0| ret += 3; 187| 5.55M| } else { 188| 5.55M| ret++; 189| 5.55M| if (length > 127) { ------------------ | Branch (189:9): [True: 220k, False: 5.33M] ------------------ 190| 220k| int tmplen = length; 191| 481k| while (tmplen > 0) { ------------------ | Branch (191:14): [True: 260k, False: 220k] ------------------ 192| 260k| tmplen >>= 8; 193| 260k| ret++; 194| 260k| } 195| 220k| } 196| 5.55M| } 197| 5.55M| if (ret >= INT_MAX - length) { ------------------ | Branch (197:7): [True: 0, False: 5.55M] ------------------ 198| 0| return -1; 199| 0| } 200| 5.55M| return ret + length; 201| 5.55M|} ASN1_STRING_copy: 203| 18.5k|int ASN1_STRING_copy(ASN1_STRING *dst, const ASN1_STRING *str) { 204| 18.5k| if (str == NULL) { ------------------ | Branch (204:7): [True: 0, False: 18.5k] ------------------ 205| 0| return 0; 206| 0| } 207| 18.5k| if (!ASN1_STRING_set(dst, str->data, str->length)) { ------------------ | Branch (207:7): [True: 0, False: 18.5k] ------------------ 208| 0| return 0; 209| 0| } 210| 18.5k| dst->type = str->type; 211| 18.5k| dst->flags = str->flags; 212| 18.5k| return 1; 213| 18.5k|} ASN1_STRING_set: 231| 1.02M|int ASN1_STRING_set(ASN1_STRING *str, const void *_data, ossl_ssize_t len_s) { 232| 1.02M| const char *data = reinterpret_cast(_data); 233| 1.02M| size_t len; 234| 1.02M| if (len_s < 0) { ------------------ | Branch (234:7): [True: 0, False: 1.02M] ------------------ 235| 0| if (data == NULL) { ------------------ | Branch (235:9): [True: 0, False: 0] ------------------ 236| 0| return 0; 237| 0| } 238| 0| len = strlen(data); 239| 1.02M| } else { 240| 1.02M| len = (size_t)len_s; 241| 1.02M| } 242| | 243| 1.02M| static_assert(ASN1_STRING_MAX < INT_MAX, "len will not overflow int"); 244| 1.02M| if (len > ASN1_STRING_MAX) { ------------------ | | 70| 1.02M|#define ASN1_STRING_MAX (64 * 1024 * 1024) ------------------ | Branch (244:7): [True: 0, False: 1.02M] ------------------ 245| 0| OPENSSL_PUT_ERROR(ASN1, ERR_R_OVERFLOW); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 246| 0| return 0; 247| 0| } 248| | 249| 1.02M| if (str->length <= (int)len || str->data == NULL) { ------------------ | Branch (249:7): [True: 1.02M, False: 0] | Branch (249:34): [True: 0, False: 0] ------------------ 250| 1.02M| unsigned char *c = str->data; 251| 1.02M| if (c == NULL) { ------------------ | Branch (251:9): [True: 1.02M, False: 0] ------------------ 252| 1.02M| str->data = reinterpret_cast(OPENSSL_malloc(len + 1)); 253| 1.02M| } else { 254| 0| str->data = reinterpret_cast(OPENSSL_realloc(c, len + 1)); 255| 0| } 256| | 257| 1.02M| if (str->data == NULL) { ------------------ | Branch (257:9): [True: 0, False: 1.02M] ------------------ 258| 0| str->data = c; 259| 0| return 0; 260| 0| } 261| 1.02M| } 262| 1.02M| str->length = (int)len; 263| 1.02M| if (data != NULL) { ------------------ | Branch (263:7): [True: 1.02M, False: 1.58k] ------------------ 264| 1.02M| OPENSSL_memcpy(str->data, data, len); 265| | // Historically, OpenSSL would NUL-terminate most (but not all) 266| | // |ASN1_STRING|s, in case anyone accidentally passed |str->data| into a 267| | // function expecting a C string. We retain this behavior for compatibility, 268| | // but code must not rely on this. See CVE-2021-3712. 269| 1.02M| str->data[len] = '\0'; 270| 1.02M| } 271| 1.02M| return 1; 272| 1.02M|} ASN1_STRING_set0: 274| 149k|void ASN1_STRING_set0(ASN1_STRING *str, void *data, int len) { 275| 149k| OPENSSL_free(str->data); 276| 149k| str->data = reinterpret_cast(data); 277| 149k| str->length = len; 278| 149k|} ASN1_STRING_type_new: 284| 1.32M|ASN1_STRING *ASN1_STRING_type_new(int type) { 285| 1.32M| ASN1_STRING *ret; 286| | 287| 1.32M| ret = (ASN1_STRING *)OPENSSL_malloc(sizeof(ASN1_STRING)); 288| 1.32M| if (ret == NULL) { ------------------ | Branch (288:7): [True: 0, False: 1.32M] ------------------ 289| 0| return NULL; 290| 0| } 291| 1.32M| ret->length = 0; 292| 1.32M| ret->type = type; 293| 1.32M| ret->data = NULL; 294| 1.32M| ret->flags = 0; 295| 1.32M| return ret; 296| 1.32M|} ASN1_STRING_free: 298| 1.83M|void ASN1_STRING_free(ASN1_STRING *str) { 299| 1.83M| if (str == NULL) { ------------------ | Branch (299:7): [True: 510k, False: 1.32M] ------------------ 300| 510k| return; 301| 510k| } 302| 1.32M| OPENSSL_free(str->data); 303| 1.32M| OPENSSL_free(str); 304| 1.32M|} asn1_lib.cc:_ZL15asn1_put_lengthPPhi: 153| 1.71M|static void asn1_put_length(unsigned char **pp, int length) { 154| 1.71M| unsigned char *p = *pp; 155| 1.71M| int i, l; 156| 1.71M| if (length <= 127) { ------------------ | Branch (156:7): [True: 1.62M, False: 88.3k] ------------------ 157| 1.62M| *(p++) = (unsigned char)length; 158| 1.62M| } else { 159| 88.3k| l = length; 160| 192k| for (i = 0; l > 0; i++) { ------------------ | Branch (160:17): [True: 104k, False: 88.3k] ------------------ 161| 104k| l >>= 8; 162| 104k| } 163| 88.3k| *(p++) = i | 0x80; 164| 88.3k| l = i; 165| 192k| while (i-- > 0) { ------------------ | Branch (165:12): [True: 104k, False: 88.3k] ------------------ 166| 104k| p[i] = length & 0xff; 167| 104k| length >>= 8; 168| 104k| } 169| 88.3k| p += l; 170| 88.3k| } 171| 1.71M| *pp = p; 172| 1.71M|} ASN1_tag2bit: 55| 484k|unsigned long ASN1_tag2bit(int tag) { 56| 484k| switch (tag) { 57| 2.61k| case V_ASN1_BIT_STRING: ------------------ | | 88| 2.61k|#define V_ASN1_BIT_STRING 3 ------------------ | Branch (57:5): [True: 2.61k, False: 481k] ------------------ 58| 2.61k| return B_ASN1_BIT_STRING; ------------------ | | 133| 2.61k|#define B_ASN1_BIT_STRING 0x0400 ------------------ 59| 23| case V_ASN1_OCTET_STRING: ------------------ | | 89| 23|#define V_ASN1_OCTET_STRING 4 ------------------ | Branch (59:5): [True: 23, False: 483k] ------------------ 60| 23| return B_ASN1_OCTET_STRING; ------------------ | | 132| 23|#define B_ASN1_OCTET_STRING 0x0200 ------------------ 61| 177k| case V_ASN1_UTF8STRING: ------------------ | | 96| 177k|#define V_ASN1_UTF8STRING 12 ------------------ | Branch (61:5): [True: 177k, False: 306k] ------------------ 62| 177k| return B_ASN1_UTF8STRING; ------------------ | | 135| 177k|#define B_ASN1_UTF8STRING 0x2000 ------------------ 63| 2.66k| case V_ASN1_SEQUENCE: ------------------ | | 97| 2.66k|#define V_ASN1_SEQUENCE 16 ------------------ | Branch (63:5): [True: 2.66k, False: 481k] ------------------ 64| 2.66k| return B_ASN1_SEQUENCE; ------------------ | | 138| 2.66k|#define B_ASN1_SEQUENCE 0x10000 ------------------ 65| 81| case V_ASN1_NUMERICSTRING: ------------------ | | 99| 81|#define V_ASN1_NUMERICSTRING 18 ------------------ | Branch (65:5): [True: 81, False: 483k] ------------------ 66| 81| return B_ASN1_NUMERICSTRING; ------------------ | | 121| 81|#define B_ASN1_NUMERICSTRING 0x0001 ------------------ 67| 141k| case V_ASN1_PRINTABLESTRING: ------------------ | | 100| 141k|#define V_ASN1_PRINTABLESTRING 19 ------------------ | Branch (67:5): [True: 141k, False: 342k] ------------------ 68| 141k| return B_ASN1_PRINTABLESTRING; ------------------ | | 122| 141k|#define B_ASN1_PRINTABLESTRING 0x0002 ------------------ 69| 98| case V_ASN1_T61STRING: ------------------ | | 101| 98|#define V_ASN1_T61STRING 20 ------------------ | Branch (69:5): [True: 98, False: 483k] ------------------ 70| 98| return B_ASN1_T61STRING; ------------------ | | 123| 98|#define B_ASN1_T61STRING 0x0004 ------------------ 71| 10| case V_ASN1_VIDEOTEXSTRING: ------------------ | | 103| 10|#define V_ASN1_VIDEOTEXSTRING 21 ------------------ | Branch (71:5): [True: 10, False: 484k] ------------------ 72| 10| return B_ASN1_VIDEOTEXSTRING; ------------------ | | 125| 10|#define B_ASN1_VIDEOTEXSTRING 0x0008 ------------------ 73| 7.26k| case V_ASN1_IA5STRING: ------------------ | | 104| 7.26k|#define V_ASN1_IA5STRING 22 ------------------ | Branch (73:5): [True: 7.26k, False: 476k] ------------------ 74| 7.26k| return B_ASN1_IA5STRING; ------------------ | | 126| 7.26k|#define B_ASN1_IA5STRING 0x0010 ------------------ 75| 139k| case V_ASN1_UTCTIME: ------------------ | | 105| 139k|#define V_ASN1_UTCTIME 23 ------------------ | Branch (75:5): [True: 139k, False: 344k] ------------------ 76| 139k| return B_ASN1_UTCTIME; ------------------ | | 136| 139k|#define B_ASN1_UTCTIME 0x4000 ------------------ 77| 6| case V_ASN1_GENERALIZEDTIME: ------------------ | | 106| 6|#define V_ASN1_GENERALIZEDTIME 24 ------------------ | Branch (77:5): [True: 6, False: 484k] ------------------ 78| 6| return B_ASN1_GENERALIZEDTIME; ------------------ | | 137| 6|#define B_ASN1_GENERALIZEDTIME 0x8000 ------------------ 79| 5| case V_ASN1_GRAPHICSTRING: ------------------ | | 107| 5|#define V_ASN1_GRAPHICSTRING 25 ------------------ | Branch (79:5): [True: 5, False: 484k] ------------------ 80| 5| return B_ASN1_GRAPHICSTRING; ------------------ | | 127| 5|#define B_ASN1_GRAPHICSTRING 0x0020 ------------------ 81| 8| case V_ASN1_ISO64STRING: ------------------ | | 108| 8|#define V_ASN1_ISO64STRING 26 ------------------ | Branch (81:5): [True: 8, False: 484k] ------------------ 82| 8| return B_ASN1_ISO64STRING; ------------------ | | 128| 8|#define B_ASN1_ISO64STRING 0x0040 ------------------ 83| 18| case V_ASN1_GENERALSTRING: ------------------ | | 110| 18|#define V_ASN1_GENERALSTRING 27 ------------------ | Branch (83:5): [True: 18, False: 484k] ------------------ 84| 18| return B_ASN1_GENERALSTRING; ------------------ | | 130| 18|#define B_ASN1_GENERALSTRING 0x0080 ------------------ 85| 39| case V_ASN1_UNIVERSALSTRING: ------------------ | | 111| 39|#define V_ASN1_UNIVERSALSTRING 28 ------------------ | Branch (85:5): [True: 39, False: 483k] ------------------ 86| 39| return B_ASN1_UNIVERSALSTRING; ------------------ | | 131| 39|#define B_ASN1_UNIVERSALSTRING 0x0100 ------------------ 87| 481| case V_ASN1_BMPSTRING: ------------------ | | 112| 481|#define V_ASN1_BMPSTRING 30 ------------------ | Branch (87:5): [True: 481, False: 483k] ------------------ 88| 481| return B_ASN1_BMPSTRING; ------------------ | | 134| 481|#define B_ASN1_BMPSTRING 0x0800 ------------------ 89| 13.1k| default: ------------------ | Branch (89:5): [True: 13.1k, False: 470k] ------------------ 90| 13.1k| return 0; 91| 484k| } 92| 484k|} ASN1_item_d2i: 119| 69.1k| const ASN1_ITEM *it) { 120| 69.1k| ASN1_VALUE *ret = NULL; 121| 69.1k| if (asn1_item_ex_d2i(&ret, in, len, it, /*tag=*/-1, /*aclass=*/0, /*opt=*/0, ------------------ | Branch (121:7): [True: 23, False: 69.1k] ------------------ 122| 69.1k| /*buf=*/NULL, /*depth=*/0) <= 0) { 123| | // Clean up, in case the caller left a partial object. 124| | // 125| | // TODO(davidben): I don't think it can leave one, but the codepaths below 126| | // are a bit inconsistent. Revisit this when rewriting this function. 127| 23| ASN1_item_ex_free(&ret, it); 128| 23| } 129| | 130| | // If the caller supplied an output pointer, free the old one and replace it 131| | // with |ret|. This differs from OpenSSL slightly in that we don't support 132| | // object reuse. We run this on both success and failure. On failure, even 133| | // with object reuse, OpenSSL destroys the previous object. 134| 69.1k| if (pval != NULL) { ------------------ | Branch (134:7): [True: 0, False: 69.1k] ------------------ 135| 0| ASN1_item_ex_free(pval, it); 136| 0| *pval = ret; 137| 0| } 138| 69.1k| return ret; 139| 69.1k|} ASN1_item_ex_d2i: 449| 209k| CRYPTO_BUFFER *buf) { 450| 209k| return asn1_item_ex_d2i(pval, in, len, it, tag, aclass, opt, buf, 451| 209k| /*depth=*/0); 452| 209k|} tasn_dec.cc:_ZL16asn1_item_ex_d2iPP13ASN1_VALUE_stPPKhlPK12ASN1_ITEM_stiicP16crypto_buffer_sti: 152| 3.72M| char opt, CRYPTO_BUFFER *buf, int depth) { 153| 3.72M| const ASN1_TEMPLATE *tt, *errtt = NULL; 154| 3.72M| const unsigned char *p = NULL, *q; 155| 3.72M| unsigned char oclass; 156| 3.72M| char cst, isopt; 157| 3.72M| int i; 158| 3.72M| int otag; 159| 3.72M| int ret = 0; 160| 3.72M| ASN1_VALUE **pchptr; 161| 3.72M| if (!pval) { ------------------ | Branch (161:7): [True: 0, False: 3.72M] ------------------ 162| 0| return 0; 163| 0| } 164| | 165| 3.72M| if (buf != NULL) { ------------------ | Branch (165:7): [True: 2.02M, False: 1.70M] ------------------ 166| 2.02M| assert(CRYPTO_BUFFER_data(buf) <= *in && 167| 2.02M| *in + len <= CRYPTO_BUFFER_data(buf) + CRYPTO_BUFFER_len(buf)); 168| 2.02M| } 169| | 170| | // Bound |len| to comfortably fit in an int. Lengths in this module often 171| | // switch between int and long without overflow checks. 172| 3.72M| if (len > INT_MAX / 2) { ------------------ | Branch (172:7): [True: 0, False: 3.72M] ------------------ 173| 0| len = INT_MAX / 2; 174| 0| } 175| | 176| 3.72M| if (++depth > ASN1_MAX_CONSTRUCTED_NEST) { ------------------ | | 34| 3.72M|#define ASN1_MAX_CONSTRUCTED_NEST 30 ------------------ | Branch (176:7): [True: 0, False: 3.72M] ------------------ 177| 0| OPENSSL_PUT_ERROR(ASN1, ASN1_R_NESTED_TOO_DEEP); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 178| 0| goto err; 179| 0| } 180| | 181| 3.72M| switch (it->itype) { 182| 2.48M| case ASN1_ITYPE_PRIMITIVE: ------------------ | | 418| 2.48M|#define ASN1_ITYPE_PRIMITIVE 0x0 ------------------ | Branch (182:5): [True: 2.48M, False: 1.24M] ------------------ 183| 2.48M| if (it->templates) { ------------------ | Branch (183:11): [True: 483k, False: 2.00M] ------------------ 184| | // tagging or OPTIONAL is currently illegal on an item template 185| | // because the flags can't get passed down. In practice this 186| | // isn't a problem: we include the relevant flags from the item 187| | // template in the template itself. 188| 483k| if ((tag != -1) || opt) { ------------------ | Branch (188:13): [True: 0, False: 483k] | Branch (188:28): [True: 0, False: 483k] ------------------ 189| 0| OPENSSL_PUT_ERROR(ASN1, ASN1_R_ILLEGAL_OPTIONS_ON_ITEM_TEMPLATE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 190| 0| goto err; 191| 0| } 192| 483k| return asn1_template_ex_d2i(pval, in, len, it->templates, opt, buf, 193| 483k| depth); 194| 483k| } 195| 2.00M| return asn1_d2i_ex_primitive(pval, in, len, it, tag, aclass, opt); 196| 0| break; 197| | 198| 139k| case ASN1_ITYPE_MSTRING: ------------------ | | 426| 139k|#define ASN1_ITYPE_MSTRING 0x5 ------------------ | Branch (198:5): [True: 139k, False: 3.58M] ------------------ 199| | // It never makes sense for multi-strings to have implicit tagging, so 200| | // if tag != -1, then this looks like an error in the template. 201| 139k| if (tag != -1) { ------------------ | Branch (201:11): [True: 0, False: 139k] ------------------ 202| 0| OPENSSL_PUT_ERROR(ASN1, ASN1_R_BAD_TEMPLATE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 203| 0| goto err; 204| 0| } 205| | 206| 139k| p = *in; 207| | // Just read in tag and class 208| 139k| ret = asn1_check_tlen(NULL, &otag, &oclass, NULL, &p, len, -1, 0, 1); 209| 139k| if (!ret) { ------------------ | Branch (209:11): [True: 8, False: 139k] ------------------ 210| 8| OPENSSL_PUT_ERROR(ASN1, ASN1_R_NESTED_ASN1_ERROR); ------------------ | | 361| 8| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 211| 8| goto err; 212| 8| } 213| | 214| | // Must be UNIVERSAL class 215| 139k| if (oclass != V_ASN1_UNIVERSAL) { ------------------ | | 49| 139k|#define V_ASN1_UNIVERSAL 0x00 ------------------ | Branch (215:11): [True: 3, False: 139k] ------------------ 216| | // If OPTIONAL, assume this is OK 217| 3| if (opt) { ------------------ | Branch (217:13): [True: 0, False: 3] ------------------ 218| 0| return -1; 219| 0| } 220| 3| OPENSSL_PUT_ERROR(ASN1, ASN1_R_MSTRING_NOT_UNIVERSAL); ------------------ | | 361| 3| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 221| 3| goto err; 222| 3| } 223| | // Check tag matches bit map 224| 139k| if (!(ASN1_tag2bit(otag) & it->utype)) { ------------------ | Branch (224:11): [True: 6, False: 139k] ------------------ 225| | // If OPTIONAL, assume this is OK 226| 6| if (opt) { ------------------ | Branch (226:13): [True: 0, False: 6] ------------------ 227| 0| return -1; 228| 0| } 229| 6| OPENSSL_PUT_ERROR(ASN1, ASN1_R_MSTRING_WRONG_TAG); ------------------ | | 361| 6| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 230| 6| goto err; 231| 6| } 232| 139k| return asn1_d2i_ex_primitive(pval, in, len, it, otag, 0, 0); 233| | 234| 139k| case ASN1_ITYPE_EXTERN: { ------------------ | | 424| 139k|#define ASN1_ITYPE_EXTERN 0x4 ------------------ | Branch (234:5): [True: 139k, False: 3.58M] ------------------ 235| | // We don't support implicit tagging with external types. 236| 139k| if (tag != -1) { ------------------ | Branch (236:11): [True: 0, False: 139k] ------------------ 237| 0| OPENSSL_PUT_ERROR(ASN1, ASN1_R_BAD_TEMPLATE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 238| 0| goto err; 239| 0| } 240| 139k| const ASN1_EXTERN_FUNCS *ef = 241| 139k| reinterpret_cast(it->funcs); 242| 139k| return ef->asn1_ex_d2i(pval, in, len, it, opt, NULL); 243| 139k| } 244| | 245| 0| case ASN1_ITYPE_CHOICE: { ------------------ | | 422| 0|#define ASN1_ITYPE_CHOICE 0x2 ------------------ | Branch (245:5): [True: 0, False: 3.72M] ------------------ 246| | // It never makes sense for CHOICE types to have implicit tagging, so if 247| | // tag != -1, then this looks like an error in the template. 248| 0| if (tag != -1) { ------------------ | Branch (248:11): [True: 0, False: 0] ------------------ 249| 0| OPENSSL_PUT_ERROR(ASN1, ASN1_R_BAD_TEMPLATE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 250| 0| goto err; 251| 0| } 252| | 253| 0| const ASN1_AUX *aux = reinterpret_cast(it->funcs); 254| 0| ASN1_aux_cb *asn1_cb = aux != NULL ? aux->asn1_cb : NULL; ------------------ | Branch (254:30): [True: 0, False: 0] ------------------ 255| 0| if (asn1_cb && !asn1_cb(ASN1_OP_D2I_PRE, pval, it, NULL)) { ------------------ | | 472| 0|#define ASN1_OP_D2I_PRE 4 ------------------ | Branch (255:11): [True: 0, False: 0] | Branch (255:22): [True: 0, False: 0] ------------------ 256| 0| goto auxerr; 257| 0| } 258| | 259| 0| if (*pval) { ------------------ | Branch (259:11): [True: 0, False: 0] ------------------ 260| | // Free up and zero CHOICE value if initialised 261| 0| i = asn1_get_choice_selector(pval, it); 262| 0| if ((i >= 0) && (i < it->tcount)) { ------------------ | Branch (262:13): [True: 0, False: 0] | Branch (262:25): [True: 0, False: 0] ------------------ 263| 0| tt = it->templates + i; 264| 0| pchptr = asn1_get_field_ptr(pval, tt); 265| 0| ASN1_template_free(pchptr, tt); 266| 0| asn1_set_choice_selector(pval, -1, it); 267| 0| } 268| 0| } else if (!ASN1_item_ex_new(pval, it)) { ------------------ | Branch (268:18): [True: 0, False: 0] ------------------ 269| 0| OPENSSL_PUT_ERROR(ASN1, ASN1_R_NESTED_ASN1_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 270| 0| goto err; 271| 0| } 272| | // CHOICE type, try each possibility in turn 273| 0| p = *in; 274| 0| for (i = 0, tt = it->templates; i < it->tcount; i++, tt++) { ------------------ | Branch (274:39): [True: 0, False: 0] ------------------ 275| 0| pchptr = asn1_get_field_ptr(pval, tt); 276| | // We mark field as OPTIONAL so its absence can be recognised. 277| 0| ret = asn1_template_ex_d2i(pchptr, &p, len, tt, 1, buf, depth); 278| | // If field not present, try the next one 279| 0| if (ret == -1) { ------------------ | Branch (279:13): [True: 0, False: 0] ------------------ 280| 0| continue; 281| 0| } 282| | // If positive return, read OK, break loop 283| 0| if (ret > 0) { ------------------ | Branch (283:13): [True: 0, False: 0] ------------------ 284| 0| break; 285| 0| } 286| | // Otherwise must be an ASN1 parsing error 287| 0| errtt = tt; 288| 0| OPENSSL_PUT_ERROR(ASN1, ASN1_R_NESTED_ASN1_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 289| 0| goto err; 290| 0| } 291| | 292| | // Did we fall off the end without reading anything? 293| 0| if (i == it->tcount) { ------------------ | Branch (293:11): [True: 0, False: 0] ------------------ 294| | // If OPTIONAL, this is OK 295| 0| if (opt) { ------------------ | Branch (295:13): [True: 0, False: 0] ------------------ 296| | // Free and zero it 297| 0| ASN1_item_ex_free(pval, it); 298| 0| return -1; 299| 0| } 300| 0| OPENSSL_PUT_ERROR(ASN1, ASN1_R_NO_MATCHING_CHOICE_TYPE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 301| 0| goto err; 302| 0| } 303| | 304| 0| asn1_set_choice_selector(pval, i, it); 305| 0| if (asn1_cb && !asn1_cb(ASN1_OP_D2I_POST, pval, it, NULL)) { ------------------ | | 473| 0|#define ASN1_OP_D2I_POST 5 ------------------ | Branch (305:11): [True: 0, False: 0] | Branch (305:22): [True: 0, False: 0] ------------------ 306| 0| goto auxerr; 307| 0| } 308| 0| *in = p; 309| 0| return 1; 310| 0| } 311| | 312| 962k| case ASN1_ITYPE_SEQUENCE: { ------------------ | | 420| 962k|#define ASN1_ITYPE_SEQUENCE 0x1 ------------------ | Branch (312:5): [True: 962k, False: 2.76M] ------------------ 313| 962k| p = *in; 314| | 315| | // If no IMPLICIT tagging set to SEQUENCE, UNIVERSAL 316| 962k| if (tag == -1) { ------------------ | Branch (316:11): [True: 962k, False: 0] ------------------ 317| 962k| tag = V_ASN1_SEQUENCE; ------------------ | | 97| 962k|#define V_ASN1_SEQUENCE 16 ------------------ 318| 962k| aclass = V_ASN1_UNIVERSAL; ------------------ | | 49| 962k|#define V_ASN1_UNIVERSAL 0x00 ------------------ 319| 962k| } 320| | // Get SEQUENCE length and update len, p 321| 962k| ret = asn1_check_tlen(&len, NULL, NULL, &cst, &p, len, tag, aclass, opt); 322| 962k| if (!ret) { ------------------ | Branch (322:11): [True: 289, False: 962k] ------------------ 323| 289| OPENSSL_PUT_ERROR(ASN1, ASN1_R_NESTED_ASN1_ERROR); ------------------ | | 361| 289| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 324| 289| goto err; 325| 962k| } else if (ret == -1) { ------------------ | Branch (325:18): [True: 0, False: 962k] ------------------ 326| 0| return -1; 327| 0| } 328| 962k| if (!cst) { ------------------ | Branch (328:11): [True: 2, False: 962k] ------------------ 329| 2| OPENSSL_PUT_ERROR(ASN1, ASN1_R_SEQUENCE_NOT_CONSTRUCTED); ------------------ | | 361| 2| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 330| 2| goto err; 331| 2| } 332| | 333| 962k| if (!*pval && !ASN1_item_ex_new(pval, it)) { ------------------ | Branch (333:11): [True: 683k, False: 278k] | Branch (333:21): [True: 0, False: 683k] ------------------ 334| 0| OPENSSL_PUT_ERROR(ASN1, ASN1_R_NESTED_ASN1_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 335| 0| goto err; 336| 0| } 337| | 338| 962k| const ASN1_AUX *aux = reinterpret_cast(it->funcs); 339| 962k| ASN1_aux_cb *asn1_cb = aux != NULL ? aux->asn1_cb : NULL; ------------------ | Branch (339:30): [True: 139k, False: 822k] ------------------ 340| 962k| if (asn1_cb && !asn1_cb(ASN1_OP_D2I_PRE, pval, it, NULL)) { ------------------ | | 472| 69.3k|#define ASN1_OP_D2I_PRE 4 ------------------ | Branch (340:11): [True: 69.3k, False: 892k] | Branch (340:22): [True: 0, False: 69.3k] ------------------ 341| 0| goto auxerr; 342| 0| } 343| | 344| | // Free up and zero any ADB found 345| 3.64M| for (i = 0, tt = it->templates; i < it->tcount; i++, tt++) { ------------------ | Branch (345:39): [True: 2.68M, False: 962k] ------------------ 346| 2.68M| if (tt->flags & ASN1_TFLG_ADB_MASK) { ------------------ | | 365| 2.68M|#define ASN1_TFLG_ADB_MASK (0x3 << 8) ------------------ | Branch (346:13): [True: 0, False: 2.68M] ------------------ 347| 0| const ASN1_TEMPLATE *seqtt; 348| 0| ASN1_VALUE **pseqval; 349| 0| seqtt = asn1_do_adb(pval, tt, 0); 350| 0| if (seqtt == NULL) { ------------------ | Branch (350:15): [True: 0, False: 0] ------------------ 351| 0| continue; 352| 0| } 353| 0| pseqval = asn1_get_field_ptr(pval, seqtt); 354| 0| ASN1_template_free(pseqval, seqtt); 355| 0| } 356| 2.68M| } 357| | 358| | // Get each field entry 359| 3.59M| for (i = 0, tt = it->templates; i < it->tcount; i++, tt++) { ------------------ | Branch (359:39): [True: 2.67M, False: 912k] ------------------ 360| 2.67M| const ASN1_TEMPLATE *seqtt; 361| 2.67M| ASN1_VALUE **pseqval; 362| 2.67M| seqtt = asn1_do_adb(pval, tt, 1); 363| 2.67M| if (seqtt == NULL) { ------------------ | Branch (363:13): [True: 0, False: 2.67M] ------------------ 364| 0| goto err; 365| 0| } 366| 2.67M| pseqval = asn1_get_field_ptr(pval, seqtt); 367| | // Have we ran out of data? 368| 2.67M| if (!len) { ------------------ | Branch (368:13): [True: 48.1k, False: 2.63M] ------------------ 369| 48.1k| break; 370| 48.1k| } 371| 2.63M| q = p; 372| | // This determines the OPTIONAL flag value. The field cannot be 373| | // omitted if it is the last of a SEQUENCE and there is still 374| | // data to be read. This isn't strictly necessary but it 375| | // increases efficiency in some cases. 376| 2.63M| if (i == (it->tcount - 1)) { ------------------ | Branch (376:13): [True: 913k, False: 1.71M] ------------------ 377| 913k| isopt = 0; 378| 1.71M| } else { 379| 1.71M| isopt = (seqtt->flags & ASN1_TFLG_OPTIONAL) != 0; ------------------ | | 311| 1.71M|#define ASN1_TFLG_OPTIONAL (0x1) ------------------ 380| 1.71M| } 381| | // attempt to read in field, allowing each to be OPTIONAL 382| | 383| 2.63M| ret = asn1_template_ex_d2i(pseqval, &p, len, seqtt, isopt, buf, depth); 384| 2.63M| if (!ret) { ------------------ | Branch (384:13): [True: 1.44k, False: 2.62M] ------------------ 385| 1.44k| errtt = seqtt; 386| 1.44k| goto err; 387| 2.62M| } else if (ret == -1) { ------------------ | Branch (387:20): [True: 300k, False: 2.32M] ------------------ 388| | // OPTIONAL component absent. Free and zero the field. 389| 300k| ASN1_template_free(pseqval, seqtt); 390| 300k| continue; 391| 300k| } 392| | // Update length 393| 2.32M| len -= p - q; 394| 2.32M| } 395| | 396| | // Check all data read 397| 960k| if (len) { ------------------ | Branch (397:11): [True: 59, False: 960k] ------------------ 398| 59| OPENSSL_PUT_ERROR(ASN1, ASN1_R_SEQUENCE_LENGTH_MISMATCH); ------------------ | | 361| 59| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 399| 59| goto err; 400| 59| } 401| | 402| | // If we get here we've got no more data in the SEQUENCE, however we 403| | // may not have read all fields so check all remaining are OPTIONAL 404| | // and clear any that are. 405| 1.01M| for (; i < it->tcount; tt++, i++) { ------------------ | Branch (405:14): [True: 49.4k, False: 960k] ------------------ 406| 49.4k| const ASN1_TEMPLATE *seqtt; 407| 49.4k| seqtt = asn1_do_adb(pval, tt, 1); 408| 49.4k| if (seqtt == NULL) { ------------------ | Branch (408:13): [True: 0, False: 49.4k] ------------------ 409| 0| goto err; 410| 0| } 411| 49.4k| if (seqtt->flags & ASN1_TFLG_OPTIONAL) { ------------------ | | 311| 49.4k|#define ASN1_TFLG_OPTIONAL (0x1) ------------------ | Branch (411:13): [True: 49.4k, False: 5] ------------------ 412| 49.4k| ASN1_VALUE **pseqval; 413| 49.4k| pseqval = asn1_get_field_ptr(pval, seqtt); 414| 49.4k| ASN1_template_free(pseqval, seqtt); 415| 49.4k| } else { 416| 5| errtt = seqtt; 417| 5| OPENSSL_PUT_ERROR(ASN1, ASN1_R_FIELD_MISSING); ------------------ | | 361| 5| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 418| 5| goto err; 419| 5| } 420| 49.4k| } 421| | // Save encoding 422| 960k| if (!asn1_enc_save(pval, *in, p - *in, it, buf)) { ------------------ | Branch (422:11): [True: 0, False: 960k] ------------------ 423| 0| goto auxerr; 424| 0| } 425| 960k| if (asn1_cb && !asn1_cb(ASN1_OP_D2I_POST, pval, it, NULL)) { ------------------ | | 473| 69.3k|#define ASN1_OP_D2I_POST 5 ------------------ | Branch (425:11): [True: 69.3k, False: 891k] | Branch (425:22): [True: 0, False: 69.3k] ------------------ 426| 0| goto auxerr; 427| 0| } 428| 960k| *in = p; 429| 960k| return 1; 430| 960k| } 431| | 432| 0| default: ------------------ | Branch (432:5): [True: 0, False: 3.72M] ------------------ 433| 0| return 0; 434| 3.72M| } 435| 0|auxerr: 436| 0| OPENSSL_PUT_ERROR(ASN1, ASN1_R_AUX_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 437| 1.81k|err: 438| 1.81k| ASN1_item_ex_free(pval, it); 439| 1.81k| if (errtt) { ------------------ | Branch (439:7): [True: 1.45k, False: 367] ------------------ 440| 1.45k| ERR_add_error_data(4, "Field=", errtt->field_name, ", Type=", it->sname); 441| 1.45k| } else { 442| 367| ERR_add_error_data(2, "Type=", it->sname); 443| 367| } 444| 1.81k| return 0; 445| 0|} tasn_dec.cc:_ZL20asn1_template_ex_d2iPP13ASN1_VALUE_stPPKhlPK16ASN1_TEMPLATE_stcP16crypto_buffer_sti: 459| 3.11M| CRYPTO_BUFFER *buf, int depth) { 460| 3.11M| int aclass; 461| 3.11M| int ret; 462| 3.11M| long len; 463| 3.11M| const unsigned char *p, *q; 464| 3.11M| if (!val) { ------------------ | Branch (464:7): [True: 0, False: 3.11M] ------------------ 465| 0| return 0; 466| 0| } 467| 3.11M| uint32_t flags = tt->flags; 468| 3.11M| aclass = flags & ASN1_TFLG_TAG_CLASS; ------------------ | | 357| 3.11M|#define ASN1_TFLG_TAG_CLASS (0x3 << 6) ------------------ 469| | 470| 3.11M| p = *in; 471| | 472| | // Check if EXPLICIT tag expected 473| 3.11M| if (flags & ASN1_TFLG_EXPTAG) { ------------------ | | 332| 3.11M|#define ASN1_TFLG_EXPTAG (0x2 << 3) ------------------ | Branch (473:7): [True: 138k, False: 2.97M] ------------------ 474| 138k| char cst; 475| | // Need to work out amount of data available to the inner content and 476| | // where it starts: so read in EXPLICIT header to get the info. 477| 138k| ret = asn1_check_tlen(&len, NULL, NULL, &cst, &p, inlen, tt->tag, aclass, 478| 138k| opt); 479| 138k| q = p; 480| 138k| if (!ret) { ------------------ | Branch (480:9): [True: 32, False: 138k] ------------------ 481| 32| OPENSSL_PUT_ERROR(ASN1, ASN1_R_NESTED_ASN1_ERROR); ------------------ | | 361| 32| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 482| 32| return 0; 483| 138k| } else if (ret == -1) { ------------------ | Branch (483:16): [True: 439, False: 137k] ------------------ 484| 439| return -1; 485| 439| } 486| 137k| if (!cst) { ------------------ | Branch (486:9): [True: 1, False: 137k] ------------------ 487| 1| OPENSSL_PUT_ERROR(ASN1, ASN1_R_EXPLICIT_TAG_NOT_CONSTRUCTED); ------------------ | | 361| 1| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 488| 1| return 0; 489| 1| } 490| | // We've found the field so it can't be OPTIONAL now 491| 137k| ret = asn1_template_noexp_d2i(val, &p, len, tt, /*opt=*/0, buf, depth); 492| 137k| if (!ret) { ------------------ | Branch (492:9): [True: 157, False: 137k] ------------------ 493| 157| OPENSSL_PUT_ERROR(ASN1, ASN1_R_NESTED_ASN1_ERROR); ------------------ | | 361| 157| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 494| 157| return 0; 495| 157| } 496| | // We read the field in OK so update length 497| 137k| len -= p - q; 498| | // Check for trailing data. 499| 137k| if (len) { ------------------ | Branch (499:9): [True: 5, False: 137k] ------------------ 500| 5| OPENSSL_PUT_ERROR(ASN1, ASN1_R_EXPLICIT_LENGTH_MISMATCH); ------------------ | | 361| 5| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 501| 5| goto err; 502| 5| } 503| 2.97M| } else { 504| 2.97M| return asn1_template_noexp_d2i(val, in, inlen, tt, opt, buf, depth); 505| 2.97M| } 506| | 507| 137k| *in = p; 508| 137k| return 1; 509| | 510| 5|err: 511| 5| ASN1_template_free(val, tt); 512| 5| return 0; 513| 3.11M|} tasn_dec.cc:_ZL23asn1_template_noexp_d2iPP13ASN1_VALUE_stPPKhlPK16ASN1_TEMPLATE_stcP16crypto_buffer_sti: 517| 3.11M| CRYPTO_BUFFER *buf, int depth) { 518| 3.11M| int aclass; 519| 3.11M| int ret; 520| 3.11M| const unsigned char *p; 521| 3.11M| if (!val) { ------------------ | Branch (521:7): [True: 0, False: 3.11M] ------------------ 522| 0| return 0; 523| 0| } 524| 3.11M| uint32_t flags = tt->flags; 525| 3.11M| aclass = flags & ASN1_TFLG_TAG_CLASS; ------------------ | | 357| 3.11M|#define ASN1_TFLG_TAG_CLASS (0x3 << 6) ------------------ 526| | 527| 3.11M| p = *in; 528| | 529| 3.11M| if (flags & ASN1_TFLG_SK_MASK) { ------------------ | | 320| 3.11M|#define ASN1_TFLG_SK_MASK (0x3 << 1) ------------------ | Branch (529:7): [True: 551k, False: 2.56M] ------------------ 530| | // SET OF, SEQUENCE OF 531| 551k| int sktag, skaclass; 532| | // First work out expected inner tag value 533| 551k| if (flags & ASN1_TFLG_IMPTAG) { ------------------ | | 328| 551k|#define ASN1_TFLG_IMPTAG (0x1 << 3) ------------------ | Branch (533:9): [True: 0, False: 551k] ------------------ 534| 0| sktag = tt->tag; 535| 0| skaclass = aclass; 536| 551k| } else { 537| 551k| skaclass = V_ASN1_UNIVERSAL; ------------------ | | 49| 551k|#define V_ASN1_UNIVERSAL 0x00 ------------------ 538| 551k| if (flags & ASN1_TFLG_SET_OF) { ------------------ | | 314| 551k|#define ASN1_TFLG_SET_OF (0x1 << 1) ------------------ | Branch (538:11): [True: 343k, False: 207k] ------------------ 539| 343k| sktag = V_ASN1_SET; ------------------ | | 98| 343k|#define V_ASN1_SET 17 ------------------ 540| 343k| } else { 541| 207k| sktag = V_ASN1_SEQUENCE; ------------------ | | 97| 207k|#define V_ASN1_SEQUENCE 16 ------------------ 542| 207k| } 543| 551k| } 544| | // Get the tag 545| 551k| ret = 546| 551k| asn1_check_tlen(&len, NULL, NULL, NULL, &p, len, sktag, skaclass, opt); 547| 551k| if (!ret) { ------------------ | Branch (547:9): [True: 118, False: 551k] ------------------ 548| 118| OPENSSL_PUT_ERROR(ASN1, ASN1_R_NESTED_ASN1_ERROR); ------------------ | | 361| 118| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 549| 118| return 0; 550| 551k| } else if (ret == -1) { ------------------ | Branch (550:16): [True: 0, False: 551k] ------------------ 551| 0| return -1; 552| 0| } 553| 551k| if (!*val) { ------------------ | Branch (553:9): [True: 551k, False: 0] ------------------ 554| 551k| *val = (ASN1_VALUE *)sk_ASN1_VALUE_new_null(); 555| 551k| } else { 556| | // We've got a valid STACK: free up any items present 557| 0| STACK_OF(ASN1_VALUE) *sktmp = (STACK_OF(ASN1_VALUE) *)*val; ------------------ | | 39| 0|#define STACK_OF(type) struct stack_st_##type ------------------ 558| 0| ASN1_VALUE *vtmp; 559| 0| while (sk_ASN1_VALUE_num(sktmp) > 0) { ------------------ | Branch (559:14): [True: 0, False: 0] ------------------ 560| 0| vtmp = sk_ASN1_VALUE_pop(sktmp); 561| 0| ASN1_item_ex_free(&vtmp, ASN1_ITEM_ptr(tt->item)); ------------------ | | 241| 0|#define ASN1_ITEM_ptr(iptr) (iptr) ------------------ 562| 0| } 563| 0| } 564| | 565| 551k| if (!*val) { ------------------ | Branch (565:9): [True: 0, False: 551k] ------------------ 566| 0| goto err; 567| 0| } 568| | 569| | // Read as many items as we can 570| 1.43M| while (len > 0) { ------------------ | Branch (570:12): [True: 888k, False: 550k] ------------------ 571| 888k| ASN1_VALUE *skfield; 572| 888k| const unsigned char *q = p; 573| 888k| skfield = NULL; 574| 888k| if (!asn1_item_ex_d2i(&skfield, &p, len, ASN1_ITEM_ptr(tt->item), ------------------ | | 241| 888k|#define ASN1_ITEM_ptr(iptr) (iptr) ------------------ | Branch (574:11): [True: 409, False: 887k] ------------------ 575| 888k| /*tag=*/-1, /*aclass=*/0, /*opt=*/0, buf, depth)) { 576| 409| OPENSSL_PUT_ERROR(ASN1, ASN1_R_NESTED_ASN1_ERROR); ------------------ | | 361| 409| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 577| 409| goto err; 578| 409| } 579| 887k| len -= p - q; 580| 887k| if (!sk_ASN1_VALUE_push((STACK_OF(ASN1_VALUE) *)*val, skfield)) { ------------------ | Branch (580:11): [True: 0, False: 887k] ------------------ 581| 0| ASN1_item_ex_free(&skfield, ASN1_ITEM_ptr(tt->item)); ------------------ | | 241| 0|#define ASN1_ITEM_ptr(iptr) (iptr) ------------------ 582| 0| goto err; 583| 0| } 584| 887k| } 585| 2.56M| } else if (flags & ASN1_TFLG_IMPTAG) { ------------------ | | 328| 2.56M|#define ASN1_TFLG_IMPTAG (0x1 << 3) ------------------ | Branch (585:14): [True: 137k, False: 2.42M] ------------------ 586| | // IMPLICIT tagging 587| 137k| ret = asn1_item_ex_d2i(val, &p, len, ASN1_ITEM_ptr(tt->item), tt->tag, ------------------ | | 241| 137k|#define ASN1_ITEM_ptr(iptr) (iptr) ------------------ 588| 137k| aclass, opt, buf, depth); 589| 137k| if (!ret) { ------------------ | Branch (589:9): [True: 14, False: 137k] ------------------ 590| 14| OPENSSL_PUT_ERROR(ASN1, ASN1_R_NESTED_ASN1_ERROR); ------------------ | | 361| 14| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 591| 14| goto err; 592| 137k| } else if (ret == -1) { ------------------ | Branch (592:16): [True: 136k, False: 1.30k] ------------------ 593| 136k| return -1; 594| 136k| } 595| 2.42M| } else { 596| | // Nothing special 597| 2.42M| ret = asn1_item_ex_d2i(val, &p, len, ASN1_ITEM_ptr(tt->item), /*tag=*/-1, ------------------ | | 241| 2.42M|#define ASN1_ITEM_ptr(iptr) (iptr) ------------------ 598| 2.42M| /*aclass=*/0, opt, buf, depth); 599| 2.42M| if (!ret) { ------------------ | Branch (599:9): [True: 1.24k, False: 2.42M] ------------------ 600| 1.24k| OPENSSL_PUT_ERROR(ASN1, ASN1_R_NESTED_ASN1_ERROR); ------------------ | | 361| 1.24k| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 601| 1.24k| goto err; 602| 2.42M| } else if (ret == -1) { ------------------ | Branch (602:16): [True: 164k, False: 2.25M] ------------------ 603| 164k| return -1; 604| 164k| } 605| 2.42M| } 606| | 607| 2.81M| *in = p; 608| 2.81M| return 1; 609| | 610| 1.66k|err: 611| 1.66k| ASN1_template_free(val, tt); 612| 1.66k| return 0; 613| 3.11M|} tasn_dec.cc:_ZL21asn1_d2i_ex_primitivePP13ASN1_VALUE_stPPKhlPK12ASN1_ITEM_stiic: 617| 2.14M| int aclass, char opt) { 618| 2.14M| int ret = 0, utype; 619| 2.14M| long plen; 620| 2.14M| char cst; 621| 2.14M| const unsigned char *p; 622| 2.14M| const unsigned char *cont = NULL; 623| 2.14M| long len; 624| 2.14M| if (!pval) { ------------------ | Branch (624:7): [True: 0, False: 2.14M] ------------------ 625| 0| OPENSSL_PUT_ERROR(ASN1, ASN1_R_ILLEGAL_NULL); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 626| 0| return 0; // Should never happen 627| 0| } 628| | 629| 2.14M| assert(it->itype == ASN1_ITYPE_PRIMITIVE || it->itype == ASN1_ITYPE_MSTRING); 630| 2.14M| if (it->itype == ASN1_ITYPE_MSTRING) { ------------------ | | 426| 2.14M|#define ASN1_ITYPE_MSTRING 0x5 ------------------ | Branch (630:7): [True: 139k, False: 2.00M] ------------------ 631| 139k| utype = tag; 632| 139k| tag = -1; 633| 2.00M| } else { 634| 2.00M| utype = it->utype; 635| 2.00M| } 636| | 637| 2.14M| if (utype == V_ASN1_ANY || utype == V_ASN1_ANY_AS_STRING) { ------------------ | | 78| 4.28M|#define V_ASN1_ANY (-4) ------------------ if (utype == V_ASN1_ANY || utype == V_ASN1_ANY_AS_STRING) { ------------------ | | 82| 1.98M|#define V_ASN1_ANY_AS_STRING (-5) ------------------ | Branch (637:7): [True: 161k, False: 1.98M] | Branch (637:30): [True: 345k, False: 1.63M] ------------------ 638| | // If type is ANY need to figure out type from tag 639| 506k| unsigned char oclass; 640| 506k| if (tag >= 0) { ------------------ | Branch (640:9): [True: 0, False: 506k] ------------------ 641| 0| OPENSSL_PUT_ERROR(ASN1, ASN1_R_ILLEGAL_TAGGED_ANY); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 642| 0| return 0; 643| 0| } 644| 506k| if (opt) { ------------------ | Branch (644:9): [True: 0, False: 506k] ------------------ 645| 0| OPENSSL_PUT_ERROR(ASN1, ASN1_R_ILLEGAL_OPTIONAL_ANY); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 646| 0| return 0; 647| 0| } 648| 506k| const int is_string = utype == V_ASN1_ANY_AS_STRING; ------------------ | | 82| 506k|#define V_ASN1_ANY_AS_STRING (-5) ------------------ 649| 506k| p = *in; 650| 506k| ret = asn1_check_tlen(&plen, &utype, &oclass, &cst, &p, inlen, -1, 0, 0); 651| 506k| if (!ret) { ------------------ | Branch (651:9): [True: 28, False: 506k] ------------------ 652| 28| OPENSSL_PUT_ERROR(ASN1, ASN1_R_NESTED_ASN1_ERROR); ------------------ | | 361| 28| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 653| 28| return 0; 654| 28| } 655| 506k| if (!is_supported_universal_type(utype, oclass)) { ------------------ | Branch (655:9): [True: 6.02k, False: 500k] ------------------ 656| 6.02k| utype = V_ASN1_OTHER; ------------------ | | 75| 6.02k|#define V_ASN1_OTHER (-3) ------------------ 657| 6.02k| } 658| | // These three types are not represented as |ASN1_STRING|, so they must be 659| | // parsed separately and then treated as an opaque |V_ASN1_OTHER|. 660| 506k| if (is_string && (utype == V_ASN1_OBJECT || utype == V_ASN1_NULL || ------------------ | | 91| 690k|#define V_ASN1_OBJECT 6 ------------------ if (is_string && (utype == V_ASN1_OBJECT || utype == V_ASN1_NULL || ------------------ | | 90| 689k|#define V_ASN1_NULL 5 ------------------ | Branch (660:9): [True: 345k, False: 161k] | Branch (660:23): [True: 75, False: 344k] | Branch (660:49): [True: 4, False: 344k] ------------------ 661| 345k| utype == V_ASN1_BOOLEAN)) { ------------------ | | 86| 344k|#define V_ASN1_BOOLEAN 1 ------------------ | Branch (661:23): [True: 7, False: 344k] ------------------ 662| 86| if (cst) { ------------------ | Branch (662:11): [True: 1, False: 85] ------------------ 663| 1| OPENSSL_PUT_ERROR(ASN1, ASN1_R_TYPE_NOT_PRIMITIVE); ------------------ | | 361| 1| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 664| 1| return 0; 665| 1| } 666| 85| CBS cbs; 667| 85| CBS_init(&cbs, p, plen); 668| 85| if (utype == V_ASN1_OBJECT && !CBS_is_valid_asn1_oid(&cbs)) { ------------------ | | 91| 170|#define V_ASN1_OBJECT 6 ------------------ | Branch (668:11): [True: 75, False: 10] | Branch (668:37): [True: 2, False: 73] ------------------ 669| 2| OPENSSL_PUT_ERROR(ASN1, ASN1_R_INVALID_OBJECT_ENCODING); ------------------ | | 361| 2| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 670| 2| return 0; 671| 2| } 672| 83| if (utype == V_ASN1_NULL && CBS_len(&cbs) != 0) { ------------------ | | 90| 166|#define V_ASN1_NULL 5 ------------------ | Branch (672:11): [True: 4, False: 79] | Branch (672:35): [True: 2, False: 2] ------------------ 673| 2| OPENSSL_PUT_ERROR(ASN1, ASN1_R_NULL_IS_WRONG_LENGTH); ------------------ | | 361| 2| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 674| 2| return 0; 675| 2| } 676| 81| if (utype == V_ASN1_BOOLEAN) { ------------------ | | 86| 81|#define V_ASN1_BOOLEAN 1 ------------------ | Branch (676:11): [True: 6, False: 75] ------------------ 677| 6| if (CBS_len(&cbs) != 1) { ------------------ | Branch (677:13): [True: 3, False: 3] ------------------ 678| 3| OPENSSL_PUT_ERROR(ASN1, ASN1_R_BOOLEAN_IS_WRONG_LENGTH); ------------------ | | 361| 3| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 679| 3| return 0; 680| 3| } 681| 3| uint8_t v = CBS_data(&cbs)[0]; 682| 3| if (v != 0 && v != 0xff) { ------------------ | Branch (682:13): [True: 2, False: 1] | Branch (682:23): [True: 1, False: 1] ------------------ 683| 1| OPENSSL_PUT_ERROR(ASN1, ASN1_R_DECODE_ERROR); ------------------ | | 361| 1| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 684| 1| return 0; 685| 1| } 686| 3| } 687| 77| utype = V_ASN1_OTHER; ------------------ | | 75| 77|#define V_ASN1_OTHER (-3) ------------------ 688| 77| } 689| 506k| } 690| 2.14M| if (tag == -1) { ------------------ | Branch (690:7): [True: 2.00M, False: 137k] ------------------ 691| 2.00M| tag = utype; 692| 2.00M| aclass = V_ASN1_UNIVERSAL; ------------------ | | 49| 2.00M|#define V_ASN1_UNIVERSAL 0x00 ------------------ 693| 2.00M| } 694| 2.14M| p = *in; 695| | // Check header 696| 2.14M| ret = asn1_check_tlen(&plen, NULL, NULL, &cst, &p, inlen, tag, aclass, opt); 697| 2.14M| if (!ret) { ------------------ | Branch (697:7): [True: 144, False: 2.14M] ------------------ 698| 144| OPENSSL_PUT_ERROR(ASN1, ASN1_R_NESTED_ASN1_ERROR); ------------------ | | 361| 144| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 699| 144| return 0; 700| 2.14M| } else if (ret == -1) { ------------------ | Branch (700:14): [True: 300k, False: 1.84M] ------------------ 701| 300k| return -1; 702| 300k| } 703| 1.84M| ret = 0; 704| | // SEQUENCE, SET and "OTHER" are left in encoded form 705| 1.84M| if ((utype == V_ASN1_SEQUENCE) || (utype == V_ASN1_SET) || ------------------ | | 97| 1.84M|#define V_ASN1_SEQUENCE 16 ------------------ if ((utype == V_ASN1_SEQUENCE) || (utype == V_ASN1_SET) || ------------------ | | 98| 1.83M|#define V_ASN1_SET 17 ------------------ | Branch (705:7): [True: 3.99k, False: 1.83M] | Branch (705:37): [True: 1.29k, False: 1.83M] ------------------ 706| 1.84M| (utype == V_ASN1_OTHER)) { ------------------ | | 75| 1.83M|#define V_ASN1_OTHER (-3) ------------------ | Branch (706:7): [True: 6.10k, False: 1.83M] ------------------ 707| | // SEQUENCE and SET must be constructed 708| 11.3k| if (utype != V_ASN1_OTHER && !cst) { ------------------ | | 75| 22.7k|#define V_ASN1_OTHER (-3) ------------------ | Branch (708:9): [True: 5.29k, False: 6.10k] | Branch (708:34): [True: 2, False: 5.29k] ------------------ 709| 2| OPENSSL_PUT_ERROR(ASN1, ASN1_R_TYPE_NOT_CONSTRUCTED); ------------------ | | 361| 2| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 710| 2| return 0; 711| 2| } 712| | 713| 11.3k| cont = *in; 714| 11.3k| len = p - cont + plen; 715| 11.3k| p += plen; 716| 1.83M| } else if (cst) { ------------------ | Branch (716:14): [True: 4, False: 1.83M] ------------------ 717| | // This parser historically supported BER constructed strings. We no 718| | // longer do and will gradually tighten this parser into a DER 719| | // parser. BER types should use |CBS_asn1_ber_to_der|. 720| 4| OPENSSL_PUT_ERROR(ASN1, ASN1_R_TYPE_NOT_PRIMITIVE); ------------------ | | 361| 4| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 721| 4| return 0; 722| 1.83M| } else { 723| 1.83M| cont = p; 724| 1.83M| len = plen; 725| 1.83M| p += plen; 726| 1.83M| } 727| | 728| | // We now have content length and type: translate into a structure 729| 1.84M| if (!asn1_ex_c2i(pval, cont, len, utype, it)) { ------------------ | Branch (729:7): [True: 296, False: 1.84M] ------------------ 730| 296| goto err; 731| 296| } 732| | 733| 1.84M| *in = p; 734| 1.84M| ret = 1; 735| 1.84M|err: 736| 1.84M| return ret; 737| 1.84M|} tasn_dec.cc:_ZL27is_supported_universal_typeii: 94| 506k|static int is_supported_universal_type(int tag, int aclass) { 95| 506k| if (aclass != V_ASN1_UNIVERSAL) { ------------------ | | 49| 506k|#define V_ASN1_UNIVERSAL 0x00 ------------------ | Branch (95:7): [True: 5.47k, False: 501k] ------------------ 96| 5.47k| return 0; 97| 5.47k| } 98| 501k| return tag == V_ASN1_OBJECT || tag == V_ASN1_NULL || tag == V_ASN1_BOOLEAN || ------------------ | | 91| 1.00M|#define V_ASN1_OBJECT 6 ------------------ return tag == V_ASN1_OBJECT || tag == V_ASN1_NULL || tag == V_ASN1_BOOLEAN || ------------------ | | 90| 984k|#define V_ASN1_NULL 5 ------------------ return tag == V_ASN1_OBJECT || tag == V_ASN1_NULL || tag == V_ASN1_BOOLEAN || ------------------ | | 86| 854k|#define V_ASN1_BOOLEAN 1 ------------------ | Branch (98:10): [True: 17.6k, False: 483k] | Branch (98:34): [True: 130k, False: 353k] | Branch (98:56): [True: 13, False: 353k] ------------------ 99| 501k| tag == V_ASN1_BIT_STRING || tag == V_ASN1_INTEGER || ------------------ | | 88| 854k|#define V_ASN1_BIT_STRING 3 ------------------ tag == V_ASN1_BIT_STRING || tag == V_ASN1_INTEGER || ------------------ | | 87| 850k|#define V_ASN1_INTEGER 2 ------------------ | Branch (99:10): [True: 4.09k, False: 349k] | Branch (99:38): [True: 1.76k, False: 347k] ------------------ 100| 501k| tag == V_ASN1_ENUMERATED || tag == V_ASN1_OCTET_STRING || ------------------ | | 95| 848k|#define V_ASN1_ENUMERATED 10 ------------------ tag == V_ASN1_ENUMERATED || tag == V_ASN1_OCTET_STRING || ------------------ | | 89| 835k|#define V_ASN1_OCTET_STRING 4 ------------------ | Branch (100:10): [True: 12.9k, False: 334k] | Branch (100:38): [True: 1.12k, False: 333k] ------------------ 101| 501k| tag == V_ASN1_NUMERICSTRING || tag == V_ASN1_PRINTABLESTRING || ------------------ | | 99| 834k|#define V_ASN1_NUMERICSTRING 18 ------------------ tag == V_ASN1_NUMERICSTRING || tag == V_ASN1_PRINTABLESTRING || ------------------ | | 100| 834k|#define V_ASN1_PRINTABLESTRING 19 ------------------ | Branch (101:10): [True: 102, False: 333k] | Branch (101:41): [True: 141k, False: 191k] ------------------ 102| 501k| tag == V_ASN1_T61STRING || tag == V_ASN1_VIDEOTEXSTRING || ------------------ | | 101| 693k|#define V_ASN1_T61STRING 20 ------------------ tag == V_ASN1_T61STRING || tag == V_ASN1_VIDEOTEXSTRING || ------------------ | | 103| 692k|#define V_ASN1_VIDEOTEXSTRING 21 ------------------ | Branch (102:10): [True: 159, False: 191k] | Branch (102:37): [True: 468, False: 191k] ------------------ 103| 501k| tag == V_ASN1_IA5STRING || tag == V_ASN1_UTCTIME || ------------------ | | 104| 692k|#define V_ASN1_IA5STRING 22 ------------------ tag == V_ASN1_IA5STRING || tag == V_ASN1_UTCTIME || ------------------ | | 105| 685k|#define V_ASN1_UTCTIME 23 ------------------ | Branch (103:10): [True: 7.29k, False: 183k] | Branch (103:37): [True: 6, False: 183k] ------------------ 104| 501k| tag == V_ASN1_GENERALIZEDTIME || tag == V_ASN1_GRAPHICSTRING || ------------------ | | 106| 685k|#define V_ASN1_GENERALIZEDTIME 24 ------------------ tag == V_ASN1_GENERALIZEDTIME || tag == V_ASN1_GRAPHICSTRING || ------------------ | | 107| 685k|#define V_ASN1_GRAPHICSTRING 25 ------------------ | Branch (104:10): [True: 16, False: 183k] | Branch (104:43): [True: 10, False: 183k] ------------------ 105| 501k| tag == V_ASN1_VISIBLESTRING || tag == V_ASN1_GENERALSTRING || ------------------ | | 109| 685k|#define V_ASN1_VISIBLESTRING 26 ------------------ tag == V_ASN1_VISIBLESTRING || tag == V_ASN1_GENERALSTRING || ------------------ | | 110| 685k|#define V_ASN1_GENERALSTRING 27 ------------------ | Branch (105:10): [True: 34, False: 183k] | Branch (105:41): [True: 27, False: 183k] ------------------ 106| 501k| tag == V_ASN1_UNIVERSALSTRING || tag == V_ASN1_BMPSTRING || ------------------ | | 111| 684k|#define V_ASN1_UNIVERSALSTRING 28 ------------------ tag == V_ASN1_UNIVERSALSTRING || tag == V_ASN1_BMPSTRING || ------------------ | | 112| 684k|#define V_ASN1_BMPSTRING 30 ------------------ | Branch (106:10): [True: 99, False: 183k] | Branch (106:43): [True: 511, False: 183k] ------------------ 107| 501k| tag == V_ASN1_UTF8STRING || tag == V_ASN1_SET || ------------------ | | 96| 684k|#define V_ASN1_UTF8STRING 12 ------------------ tag == V_ASN1_UTF8STRING || tag == V_ASN1_SET || ------------------ | | 98| 507k|#define V_ASN1_SET 17 ------------------ | Branch (107:10): [True: 177k, False: 5.84k] | Branch (107:38): [True: 1.29k, False: 4.54k] ------------------ 108| 501k| tag == V_ASN1_SEQUENCE; ------------------ | | 97| 505k|#define V_ASN1_SEQUENCE 16 ------------------ | Branch (108:10): [True: 3.99k, False: 549] ------------------ 109| 506k|} tasn_dec.cc:_ZL11asn1_ex_c2iPP13ASN1_VALUE_stPKhliPK12ASN1_ITEM_st: 742| 1.84M| int utype, const ASN1_ITEM *it) { 743| 1.84M| ASN1_VALUE **opval = NULL; 744| 1.84M| ASN1_STRING *stmp; 745| 1.84M| ASN1_TYPE *typ = NULL; 746| 1.84M| int ret = 0; 747| 1.84M| ASN1_INTEGER **tint; 748| | 749| | // Historically, |it->funcs| for primitive types contained an 750| | // |ASN1_PRIMITIVE_FUNCS| table of callbacks. 751| 1.84M| assert(it->funcs == NULL); 752| | 753| | // If ANY type clear type and set pointer to internal value 754| 1.84M| if (it->utype == V_ASN1_ANY) { ------------------ | | 78| 1.84M|#define V_ASN1_ANY (-4) ------------------ | Branch (754:7): [True: 161k, False: 1.68M] ------------------ 755| 161k| if (!*pval) { ------------------ | Branch (755:9): [True: 161k, False: 0] ------------------ 756| 161k| typ = ASN1_TYPE_new(); 757| 161k| if (typ == NULL) { ------------------ | Branch (757:11): [True: 0, False: 161k] ------------------ 758| 0| goto err; 759| 0| } 760| 161k| *pval = (ASN1_VALUE *)typ; 761| 161k| } else { 762| 0| typ = (ASN1_TYPE *)*pval; 763| 0| } 764| | 765| 161k| if (utype != typ->type) { ------------------ | Branch (765:9): [True: 161k, False: 0] ------------------ 766| 161k| ASN1_TYPE_set(typ, utype, NULL); 767| 161k| } 768| 161k| opval = pval; 769| 161k| pval = &typ->value.asn1_value; 770| 161k| } 771| | 772| | // If implementing a type that is not represented in |ASN1_STRING|, the 773| | // |V_ASN1_ANY_AS_STRING| logic must be modified to redirect it to 774| | // |V_ASN1_OTHER|. 775| 1.84M| switch (utype) { 776| 770k| case V_ASN1_OBJECT: ------------------ | | 91| 770k|#define V_ASN1_OBJECT 6 ------------------ | Branch (776:5): [True: 770k, False: 1.07M] ------------------ 777| 770k| if (!c2i_ASN1_OBJECT((ASN1_OBJECT **)pval, &cont, len)) { ------------------ | Branch (777:11): [True: 23, False: 770k] ------------------ 778| 23| goto err; 779| 23| } 780| 770k| break; 781| | 782| 770k| case V_ASN1_NULL: ------------------ | | 90| 130k|#define V_ASN1_NULL 5 ------------------ | Branch (782:5): [True: 130k, False: 1.71M] ------------------ 783| 130k| if (len) { ------------------ | Branch (783:11): [True: 1, False: 130k] ------------------ 784| 1| OPENSSL_PUT_ERROR(ASN1, ASN1_R_NULL_IS_WRONG_LENGTH); ------------------ | | 361| 1| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 785| 1| goto err; 786| 1| } 787| 130k| *pval = (ASN1_VALUE *)1; 788| 130k| break; 789| | 790| 35.0k| case V_ASN1_BOOLEAN: ------------------ | | 86| 35.0k|#define V_ASN1_BOOLEAN 1 ------------------ | Branch (790:5): [True: 35.0k, False: 1.80M] ------------------ 791| 35.0k| if (len != 1) { ------------------ | Branch (791:11): [True: 2, False: 35.0k] ------------------ 792| 2| OPENSSL_PUT_ERROR(ASN1, ASN1_R_BOOLEAN_IS_WRONG_LENGTH); ------------------ | | 361| 2| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 793| 2| goto err; 794| 35.0k| } else { 795| 35.0k| ASN1_BOOLEAN *tbool; 796| 35.0k| tbool = (ASN1_BOOLEAN *)pval; 797| 35.0k| *tbool = *cont; 798| 35.0k| } 799| 35.0k| break; 800| | 801| 74.7k| case V_ASN1_BIT_STRING: ------------------ | | 88| 74.7k|#define V_ASN1_BIT_STRING 3 ------------------ | Branch (801:5): [True: 74.7k, False: 1.76M] ------------------ 802| 74.7k| if (!c2i_ASN1_BIT_STRING((ASN1_BIT_STRING **)pval, &cont, len)) { ------------------ | Branch (802:11): [True: 14, False: 74.7k] ------------------ 803| 14| goto err; 804| 14| } 805| 74.7k| break; 806| | 807| 141k| case V_ASN1_INTEGER: ------------------ | | 87| 141k|#define V_ASN1_INTEGER 2 ------------------ | Branch (807:5): [True: 141k, False: 1.70M] ------------------ 808| 154k| case V_ASN1_ENUMERATED: ------------------ | | 95| 154k|#define V_ASN1_ENUMERATED 10 ------------------ | Branch (808:5): [True: 12.9k, False: 1.83M] ------------------ 809| 154k| tint = (ASN1_INTEGER **)pval; 810| 154k| if (!c2i_ASN1_INTEGER(tint, &cont, len)) { ------------------ | Branch (810:11): [True: 10, False: 154k] ------------------ 811| 10| goto err; 812| 10| } 813| | // Fixup type to match the expected form 814| 154k| (*tint)->type = utype | ((*tint)->type & V_ASN1_NEG); ------------------ | | 116| 154k|#define V_ASN1_NEG 0x100 ------------------ 815| 154k| break; 816| | 817| 200k| case V_ASN1_OCTET_STRING: ------------------ | | 89| 200k|#define V_ASN1_OCTET_STRING 4 ------------------ | Branch (817:5): [True: 200k, False: 1.64M] ------------------ 818| 200k| case V_ASN1_NUMERICSTRING: ------------------ | | 99| 200k|#define V_ASN1_NUMERICSTRING 18 ------------------ | Branch (818:5): [True: 102, False: 1.84M] ------------------ 819| 341k| case V_ASN1_PRINTABLESTRING: ------------------ | | 100| 341k|#define V_ASN1_PRINTABLESTRING 19 ------------------ | Branch (819:5): [True: 141k, False: 1.70M] ------------------ 820| 342k| case V_ASN1_T61STRING: ------------------ | | 101| 342k|#define V_ASN1_T61STRING 20 ------------------ | Branch (820:5): [True: 159, False: 1.84M] ------------------ 821| 342k| case V_ASN1_VIDEOTEXSTRING: ------------------ | | 103| 342k|#define V_ASN1_VIDEOTEXSTRING 21 ------------------ | Branch (821:5): [True: 468, False: 1.84M] ------------------ 822| 349k| case V_ASN1_IA5STRING: ------------------ | | 104| 349k|#define V_ASN1_IA5STRING 22 ------------------ | Branch (822:5): [True: 7.29k, False: 1.83M] ------------------ 823| 489k| case V_ASN1_UTCTIME: ------------------ | | 105| 489k|#define V_ASN1_UTCTIME 23 ------------------ | Branch (823:5): [True: 139k, False: 1.70M] ------------------ 824| 489k| case V_ASN1_GENERALIZEDTIME: ------------------ | | 106| 489k|#define V_ASN1_GENERALIZEDTIME 24 ------------------ | Branch (824:5): [True: 22, False: 1.84M] ------------------ 825| 489k| case V_ASN1_GRAPHICSTRING: ------------------ | | 107| 489k|#define V_ASN1_GRAPHICSTRING 25 ------------------ | Branch (825:5): [True: 10, False: 1.84M] ------------------ 826| 489k| case V_ASN1_VISIBLESTRING: ------------------ | | 109| 489k|#define V_ASN1_VISIBLESTRING 26 ------------------ | Branch (826:5): [True: 34, False: 1.84M] ------------------ 827| 489k| case V_ASN1_GENERALSTRING: ------------------ | | 110| 489k|#define V_ASN1_GENERALSTRING 27 ------------------ | Branch (827:5): [True: 27, False: 1.84M] ------------------ 828| 489k| case V_ASN1_UNIVERSALSTRING: ------------------ | | 111| 489k|#define V_ASN1_UNIVERSALSTRING 28 ------------------ | Branch (828:5): [True: 99, False: 1.84M] ------------------ 829| 489k| case V_ASN1_BMPSTRING: ------------------ | | 112| 489k|#define V_ASN1_BMPSTRING 30 ------------------ | Branch (829:5): [True: 511, False: 1.84M] ------------------ 830| 666k| case V_ASN1_UTF8STRING: ------------------ | | 96| 666k|#define V_ASN1_UTF8STRING 12 ------------------ | Branch (830:5): [True: 177k, False: 1.66M] ------------------ 831| 673k| case V_ASN1_OTHER: ------------------ | | 75| 673k|#define V_ASN1_OTHER (-3) ------------------ | Branch (831:5): [True: 6.10k, False: 1.83M] ------------------ 832| 674k| case V_ASN1_SET: ------------------ | | 98| 674k|#define V_ASN1_SET 17 ------------------ | Branch (832:5): [True: 1.29k, False: 1.84M] ------------------ 833| 678k| case V_ASN1_SEQUENCE: { ------------------ | | 97| 678k|#define V_ASN1_SEQUENCE 16 ------------------ | Branch (833:5): [True: 3.99k, False: 1.83M] ------------------ 834| 678k| CBS cbs; 835| 678k| CBS_init(&cbs, cont, (size_t)len); 836| 678k| if (utype == V_ASN1_BMPSTRING) { ------------------ | | 112| 678k|#define V_ASN1_BMPSTRING 30 ------------------ | Branch (836:11): [True: 511, False: 677k] ------------------ 837| 5.68k| while (CBS_len(&cbs) != 0) { ------------------ | Branch (837:16): [True: 5.18k, False: 497] ------------------ 838| 5.18k| uint32_t c; 839| 5.18k| if (!CBS_get_ucs2_be(&cbs, &c)) { ------------------ | Branch (839:15): [True: 14, False: 5.17k] ------------------ 840| 14| OPENSSL_PUT_ERROR(ASN1, ASN1_R_INVALID_BMPSTRING); ------------------ | | 361| 14| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 841| 14| goto err; 842| 14| } 843| 5.18k| } 844| 511| } 845| 678k| if (utype == V_ASN1_UNIVERSALSTRING) { ------------------ | | 111| 678k|#define V_ASN1_UNIVERSALSTRING 28 ------------------ | Branch (845:11): [True: 99, False: 678k] ------------------ 846| 370| while (CBS_len(&cbs) != 0) { ------------------ | Branch (846:16): [True: 312, False: 58] ------------------ 847| 312| uint32_t c; 848| 312| if (!CBS_get_utf32_be(&cbs, &c)) { ------------------ | Branch (848:15): [True: 41, False: 271] ------------------ 849| 41| OPENSSL_PUT_ERROR(ASN1, ASN1_R_INVALID_UNIVERSALSTRING); ------------------ | | 361| 41| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 850| 41| goto err; 851| 41| } 852| 312| } 853| 99| } 854| 678k| if (utype == V_ASN1_UTF8STRING) { ------------------ | | 96| 678k|#define V_ASN1_UTF8STRING 12 ------------------ | Branch (854:11): [True: 177k, False: 501k] ------------------ 855| 3.10M| while (CBS_len(&cbs) != 0) { ------------------ | Branch (855:16): [True: 2.92M, False: 177k] ------------------ 856| 2.92M| uint32_t c; 857| 2.92M| if (!CBS_get_utf8(&cbs, &c)) { ------------------ | Branch (857:15): [True: 52, False: 2.92M] ------------------ 858| 52| OPENSSL_PUT_ERROR(ASN1, ASN1_R_INVALID_UTF8STRING); ------------------ | | 361| 52| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 859| 52| goto err; 860| 52| } 861| 2.92M| } 862| 177k| } 863| 678k| if (utype == V_ASN1_UTCTIME) { ------------------ | | 105| 678k|#define V_ASN1_UTCTIME 23 ------------------ | Branch (863:11): [True: 139k, False: 539k] ------------------ 864| 139k| if (!CBS_parse_utc_time(&cbs, NULL, /*allow_timezone_offset=*/1)) { ------------------ | Branch (864:13): [True: 119, False: 139k] ------------------ 865| 119| OPENSSL_PUT_ERROR(ASN1, ASN1_R_INVALID_TIME_FORMAT); ------------------ | | 361| 119| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 866| 119| goto err; 867| 119| } 868| 139k| } 869| 678k| if (utype == V_ASN1_GENERALIZEDTIME) { ------------------ | | 106| 678k|#define V_ASN1_GENERALIZEDTIME 24 ------------------ | Branch (869:11): [True: 22, False: 678k] ------------------ 870| 22| if (!CBS_parse_generalized_time(&cbs, NULL, ------------------ | Branch (870:13): [True: 20, False: 2] ------------------ 871| 22| /*allow_timezone_offset=*/0)) { 872| 20| OPENSSL_PUT_ERROR(ASN1, ASN1_R_INVALID_TIME_FORMAT); ------------------ | | 361| 20| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 873| 20| goto err; 874| 20| } 875| 22| } 876| | // TODO(https://crbug.com/boringssl/427): Check other string types. 877| | 878| | // All based on ASN1_STRING and handled the same 879| 678k| if (!*pval) { ------------------ | Branch (879:11): [True: 10.2k, False: 667k] ------------------ 880| 10.2k| stmp = ASN1_STRING_type_new(utype); 881| 10.2k| if (!stmp) { ------------------ | Branch (881:13): [True: 0, False: 10.2k] ------------------ 882| 0| goto err; 883| 0| } 884| 10.2k| *pval = (ASN1_VALUE *)stmp; 885| 667k| } else { 886| 667k| stmp = (ASN1_STRING *)*pval; 887| 667k| stmp->type = utype; 888| 667k| } 889| 678k| if (!ASN1_STRING_set(stmp, cont, len)) { ------------------ | Branch (889:11): [True: 0, False: 678k] ------------------ 890| 0| ASN1_STRING_free(stmp); 891| 0| *pval = NULL; 892| 0| goto err; 893| 0| } 894| 678k| break; 895| 678k| } 896| | 897| 678k| default: ------------------ | Branch (897:5): [True: 0, False: 1.84M] ------------------ 898| 0| OPENSSL_PUT_ERROR(ASN1, ASN1_R_BAD_TEMPLATE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 899| 0| goto err; 900| 1.84M| } 901| | // If ASN1_ANY and NULL type fix up value 902| 1.84M| if (typ && (utype == V_ASN1_NULL)) { ------------------ | | 90| 161k|#define V_ASN1_NULL 5 ------------------ | Branch (902:7): [True: 161k, False: 1.68M] | Branch (902:14): [True: 130k, False: 31.1k] ------------------ 903| 130k| typ->value.ptr = NULL; 904| 130k| } 905| | 906| 1.84M| ret = 1; 907| 1.84M|err: 908| 1.84M| if (!ret) { ------------------ | Branch (908:7): [True: 296, False: 1.84M] ------------------ 909| 296| ASN1_TYPE_free(typ); 910| 296| if (opval) { ------------------ | Branch (910:9): [True: 116, False: 180] ------------------ 911| 116| *opval = NULL; 912| 116| } 913| 296| } 914| 1.84M| return ret; 915| 1.84M|} tasn_dec.cc:_ZL15asn1_check_tlenPlPiPhPcPPKhliic: 922| 4.44M| int exptag, int expclass, char opt) { 923| 4.44M| int i; 924| 4.44M| int ptag, pclass; 925| 4.44M| long plen; 926| 4.44M| const unsigned char *p; 927| 4.44M| p = *in; 928| | 929| 4.44M| i = ASN1_get_object(&p, &plen, &ptag, &pclass, len); 930| 4.44M| if (i & 0x80) { ------------------ | Branch (930:7): [True: 276, False: 4.44M] ------------------ 931| 276| OPENSSL_PUT_ERROR(ASN1, ASN1_R_BAD_OBJECT_HEADER); ------------------ | | 361| 276| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 932| 276| return 0; 933| 276| } 934| 4.44M| if (exptag >= 0) { ------------------ | Branch (934:7): [True: 3.78M, False: 652k] ------------------ 935| 3.78M| if ((exptag != ptag) || (expclass != pclass)) { ------------------ | Branch (935:9): [True: 301k, False: 3.48M] | Branch (935:29): [True: 20, False: 3.48M] ------------------ 936| | // If type is OPTIONAL, not an error: indicate missing type. 937| 301k| if (opt) { ------------------ | Branch (937:11): [True: 300k, False: 343] ------------------ 938| 300k| return -1; 939| 300k| } 940| 343| OPENSSL_PUT_ERROR(ASN1, ASN1_R_WRONG_TAG); ------------------ | | 361| 343| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 941| 343| return 0; 942| 301k| } 943| 3.78M| } 944| | 945| 4.14M| if (cst) { ------------------ | Branch (945:7): [True: 3.45M, False: 690k] ------------------ 946| 3.45M| *cst = i & V_ASN1_CONSTRUCTED; ------------------ | | 56| 3.45M|#define V_ASN1_CONSTRUCTED 0x20 ------------------ 947| 3.45M| } 948| | 949| 4.14M| if (olen) { ------------------ | Branch (949:7): [True: 4.00M, False: 139k] ------------------ 950| 4.00M| *olen = plen; 951| 4.00M| } 952| | 953| 4.14M| if (oclass) { ------------------ | Branch (953:7): [True: 645k, False: 3.49M] ------------------ 954| 645k| *oclass = pclass; 955| 645k| } 956| | 957| 4.14M| if (otag) { ------------------ | Branch (957:7): [True: 645k, False: 3.49M] ------------------ 958| 645k| *otag = ptag; 959| 645k| } 960| | 961| 4.14M| *in = p; 962| 4.14M| return 1; 963| 4.44M|} ASN1_item_i2d: 44| 69.3k|int ASN1_item_i2d(ASN1_VALUE *val, unsigned char **out, const ASN1_ITEM *it) { 45| 69.3k| if (out && !*out) { ------------------ | Branch (45:7): [True: 69.3k, False: 4] | Branch (45:14): [True: 69.3k, False: 4] ------------------ 46| 69.3k| unsigned char *p, *buf; 47| 69.3k| int len = ASN1_item_ex_i2d(&val, NULL, it, /*tag=*/-1, /*aclass=*/0); 48| 69.3k| if (len <= 0) { ------------------ | Branch (48:9): [True: 0, False: 69.3k] ------------------ 49| 0| return len; 50| 0| } 51| 69.3k| buf = reinterpret_cast(OPENSSL_malloc(len)); 52| 69.3k| if (!buf) { ------------------ | Branch (52:9): [True: 0, False: 69.3k] ------------------ 53| 0| return -1; 54| 0| } 55| 69.3k| p = buf; 56| 69.3k| int len2 = ASN1_item_ex_i2d(&val, &p, it, /*tag=*/-1, /*aclass=*/0); 57| 69.3k| if (len2 <= 0) { ------------------ | Branch (57:9): [True: 0, False: 69.3k] ------------------ 58| 0| OPENSSL_free(buf); 59| 0| return len2; 60| 0| } 61| 69.3k| assert(len == len2); 62| 69.3k| *out = buf; 63| 69.3k| return len; 64| 69.3k| } 65| | 66| 8| return ASN1_item_ex_i2d(&val, out, it, /*tag=*/-1, /*aclass=*/0); 67| 69.3k|} ASN1_item_ex_i2d: 73| 1.85M| const ASN1_ITEM *it, int tag, int aclass) { 74| 1.85M| int ret = asn1_item_ex_i2d_opt(pval, out, it, tag, aclass, /*optional=*/0); 75| 1.85M| assert(ret != 0); 76| 1.85M| return ret; 77| 1.85M|} tasn_enc.cc:_ZL20asn1_item_ex_i2d_optPP13ASN1_VALUE_stPPhPK12ASN1_ITEM_stiii: 83| 5.58M| int optional) { 84| 5.58M| const ASN1_TEMPLATE *tt = NULL; 85| 5.58M| int i, seqcontlen, seqlen; 86| | 87| | // Historically, |aclass| was repurposed to pass additional flags into the 88| | // encoding process. 89| 5.58M| assert((aclass & ASN1_TFLG_TAG_CLASS) == aclass); 90| | // If not overridding the tag, |aclass| is ignored and should be zero. 91| 5.58M| assert(tag != -1 || aclass == 0); 92| | 93| | // All fields are pointers, except for boolean |ASN1_ITYPE_PRIMITIVE|s. 94| | // Optional primitives are handled later. 95| 5.58M| if ((it->itype != ASN1_ITYPE_PRIMITIVE) && !*pval) { ------------------ | | 418| 5.58M|#define ASN1_ITYPE_PRIMITIVE 0x0 ------------------ | Branch (95:7): [True: 1.38M, False: 4.20M] | Branch (95:46): [True: 0, False: 1.38M] ------------------ 96| 0| if (optional) { ------------------ | Branch (96:9): [True: 0, False: 0] ------------------ 97| 0| return 0; 98| 0| } 99| 0| OPENSSL_PUT_ERROR(ASN1, ASN1_R_MISSING_VALUE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 100| 0| return -1; 101| 0| } 102| | 103| 5.58M| switch (it->itype) { 104| 4.20M| case ASN1_ITYPE_PRIMITIVE: ------------------ | | 418| 4.20M|#define ASN1_ITYPE_PRIMITIVE 0x0 ------------------ | Branch (104:5): [True: 4.20M, False: 1.38M] ------------------ 105| 4.20M| if (it->templates) { ------------------ | Branch (105:11): [True: 686k, False: 3.52M] ------------------ 106| | // This is an |ASN1_ITEM_TEMPLATE|. 107| 686k| if (it->templates->flags & ASN1_TFLG_OPTIONAL) { ------------------ | | 311| 686k|#define ASN1_TFLG_OPTIONAL (0x1) ------------------ | Branch (107:13): [True: 0, False: 686k] ------------------ 108| 0| OPENSSL_PUT_ERROR(ASN1, ASN1_R_BAD_TEMPLATE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 109| 0| return -1; 110| 0| } 111| 686k| return asn1_template_ex_i2d(pval, out, it->templates, tag, aclass, 112| 686k| optional); 113| 686k| } 114| 3.52M| return asn1_i2d_ex_primitive(pval, out, it, tag, aclass, optional); 115| | 116| 0| case ASN1_ITYPE_MSTRING: ------------------ | | 426| 0|#define ASN1_ITYPE_MSTRING 0x5 ------------------ | Branch (116:5): [True: 0, False: 5.58M] ------------------ 117| | // It never makes sense for multi-strings to have implicit tagging, so 118| | // if tag != -1, then this looks like an error in the template. 119| 0| if (tag != -1) { ------------------ | Branch (119:11): [True: 0, False: 0] ------------------ 120| 0| OPENSSL_PUT_ERROR(ASN1, ASN1_R_BAD_TEMPLATE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 121| 0| return -1; 122| 0| } 123| 0| return asn1_i2d_ex_primitive(pval, out, it, -1, 0, optional); 124| | 125| 0| case ASN1_ITYPE_CHOICE: { ------------------ | | 422| 0|#define ASN1_ITYPE_CHOICE 0x2 ------------------ | Branch (125:5): [True: 0, False: 5.58M] ------------------ 126| | // It never makes sense for CHOICE types to have implicit tagging, so if 127| | // tag != -1, then this looks like an error in the template. 128| 0| if (tag != -1) { ------------------ | Branch (128:11): [True: 0, False: 0] ------------------ 129| 0| OPENSSL_PUT_ERROR(ASN1, ASN1_R_BAD_TEMPLATE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 130| 0| return -1; 131| 0| } 132| 0| i = asn1_get_choice_selector(pval, it); 133| 0| if (i < 0 || i >= it->tcount) { ------------------ | Branch (133:11): [True: 0, False: 0] | Branch (133:20): [True: 0, False: 0] ------------------ 134| 0| OPENSSL_PUT_ERROR(ASN1, ASN1_R_NO_MATCHING_CHOICE_TYPE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 135| 0| return -1; 136| 0| } 137| 0| const ASN1_TEMPLATE *chtt = it->templates + i; 138| 0| if (chtt->flags & ASN1_TFLG_OPTIONAL) { ------------------ | | 311| 0|#define ASN1_TFLG_OPTIONAL (0x1) ------------------ | Branch (138:11): [True: 0, False: 0] ------------------ 139| 0| OPENSSL_PUT_ERROR(ASN1, ASN1_R_BAD_TEMPLATE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 140| 0| return -1; 141| 0| } 142| 0| ASN1_VALUE **pchval = asn1_get_field_ptr(pval, chtt); 143| 0| return asn1_template_ex_i2d(pchval, out, chtt, -1, 0, /*optional=*/0); 144| 0| } 145| | 146| 0| case ASN1_ITYPE_EXTERN: { ------------------ | | 424| 0|#define ASN1_ITYPE_EXTERN 0x4 ------------------ | Branch (146:5): [True: 0, False: 5.58M] ------------------ 147| | // We don't support implicit tagging with external types. 148| 0| if (tag != -1) { ------------------ | Branch (148:11): [True: 0, False: 0] ------------------ 149| 0| OPENSSL_PUT_ERROR(ASN1, ASN1_R_BAD_TEMPLATE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 150| 0| return -1; 151| 0| } 152| 0| const ASN1_EXTERN_FUNCS *ef = 153| 0| reinterpret_cast(it->funcs); 154| 0| int ret = ef->asn1_ex_i2d(pval, out, it); 155| 0| if (ret == 0) { ------------------ | Branch (155:11): [True: 0, False: 0] ------------------ 156| | // |asn1_ex_i2d| should never return zero. We have already checked 157| | // for optional values generically, and |ASN1_ITYPE_EXTERN| fields 158| | // must be pointers. 159| 0| OPENSSL_PUT_ERROR(ASN1, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 160| 0| return -1; 161| 0| } 162| 0| return ret; 163| 0| } 164| | 165| 1.38M| case ASN1_ITYPE_SEQUENCE: { ------------------ | | 420| 1.38M|#define ASN1_ITYPE_SEQUENCE 0x1 ------------------ | Branch (165:5): [True: 1.38M, False: 4.20M] ------------------ 166| 1.38M| i = asn1_enc_restore(&seqcontlen, out, pval, it); 167| | // An error occurred 168| 1.38M| if (i < 0) { ------------------ | Branch (168:11): [True: 0, False: 1.38M] ------------------ 169| 0| return -1; 170| 0| } 171| | // We have a valid cached encoding... 172| 1.38M| if (i > 0) { ------------------ | Branch (172:11): [True: 4, False: 1.38M] ------------------ 173| 4| return seqcontlen; 174| 4| } 175| | // Otherwise carry on 176| 1.38M| seqcontlen = 0; 177| | // If no IMPLICIT tagging set to SEQUENCE, UNIVERSAL 178| 1.38M| if (tag == -1) { ------------------ | Branch (178:11): [True: 1.38M, False: 0] ------------------ 179| 1.38M| tag = V_ASN1_SEQUENCE; ------------------ | | 97| 1.38M|#define V_ASN1_SEQUENCE 16 ------------------ 180| 1.38M| aclass = V_ASN1_UNIVERSAL; ------------------ | | 49| 1.38M|#define V_ASN1_UNIVERSAL 0x00 ------------------ 181| 1.38M| } 182| | // First work out sequence content length 183| 4.14M| for (i = 0, tt = it->templates; i < it->tcount; tt++, i++) { ------------------ | Branch (183:39): [True: 2.76M, False: 1.38M] ------------------ 184| 2.76M| const ASN1_TEMPLATE *seqtt; 185| 2.76M| ASN1_VALUE **pseqval; 186| 2.76M| int tmplen; 187| 2.76M| seqtt = asn1_do_adb(pval, tt, 1); 188| 2.76M| if (!seqtt) { ------------------ | Branch (188:13): [True: 0, False: 2.76M] ------------------ 189| 0| return -1; 190| 0| } 191| 2.76M| pseqval = asn1_get_field_ptr(pval, seqtt); 192| 2.76M| tmplen = 193| 2.76M| asn1_template_ex_i2d(pseqval, NULL, seqtt, -1, 0, /*optional=*/0); 194| 2.76M| if (tmplen == -1 || (tmplen > INT_MAX - seqcontlen)) { ------------------ | Branch (194:13): [True: 0, False: 2.76M] | Branch (194:29): [True: 0, False: 2.76M] ------------------ 195| 0| return -1; 196| 0| } 197| 2.76M| seqcontlen += tmplen; 198| 2.76M| } 199| | 200| 1.38M| seqlen = ASN1_object_size(/*constructed=*/1, seqcontlen, tag); 201| 1.38M| if (!out || seqlen == -1) { ------------------ | Branch (201:11): [True: 897k, False: 483k] | Branch (201:19): [True: 0, False: 483k] ------------------ 202| 897k| return seqlen; 203| 897k| } 204| | // Output SEQUENCE header 205| 483k| ASN1_put_object(out, /*constructed=*/1, seqcontlen, tag, aclass); 206| 1.45M| for (i = 0, tt = it->templates; i < it->tcount; tt++, i++) { ------------------ | Branch (206:39): [True: 967k, False: 483k] ------------------ 207| 967k| const ASN1_TEMPLATE *seqtt; 208| 967k| ASN1_VALUE **pseqval; 209| 967k| seqtt = asn1_do_adb(pval, tt, 1); 210| 967k| if (!seqtt) { ------------------ | Branch (210:13): [True: 0, False: 967k] ------------------ 211| 0| return -1; 212| 0| } 213| 967k| pseqval = asn1_get_field_ptr(pval, seqtt); 214| 967k| if (asn1_template_ex_i2d(pseqval, out, seqtt, -1, 0, /*optional=*/0) < ------------------ | Branch (214:13): [True: 0, False: 967k] ------------------ 215| 967k| 0) { 216| 0| return -1; 217| 0| } 218| 967k| } 219| 483k| return seqlen; 220| 483k| } 221| | 222| 0| default: ------------------ | Branch (222:5): [True: 0, False: 5.58M] ------------------ 223| 0| OPENSSL_PUT_ERROR(ASN1, ASN1_R_BAD_TEMPLATE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 224| 0| return -1; 225| 5.58M| } 226| 5.58M|} tasn_enc.cc:_ZL20asn1_template_ex_i2dPP13ASN1_VALUE_stPPhPK16ASN1_TEMPLATE_stiii: 233| 4.41M| int optional) { 234| 4.41M| int i, ret, ttag, tclass; 235| 4.41M| size_t j; 236| 4.41M| uint32_t flags = tt->flags; 237| | 238| | // Historically, |iclass| was repurposed to pass additional flags into the 239| | // encoding process. 240| 4.41M| assert((iclass & ASN1_TFLG_TAG_CLASS) == iclass); 241| | // If not overridding the tag, |iclass| is ignored and should be zero. 242| 4.41M| assert(tag != -1 || iclass == 0); 243| | 244| | // Work out tag and class to use: tagging may come either from the 245| | // template or the arguments, not both because this would create 246| | // ambiguity. 247| 4.41M| if (flags & ASN1_TFLG_TAG_MASK) { ------------------ | | 334| 4.41M|#define ASN1_TFLG_TAG_MASK (0x3 << 3) ------------------ | Branch (247:7): [True: 0, False: 4.41M] ------------------ 248| | // Error if argument and template tagging 249| 0| if (tag != -1) { ------------------ | Branch (249:9): [True: 0, False: 0] ------------------ 250| 0| OPENSSL_PUT_ERROR(ASN1, ASN1_R_BAD_TEMPLATE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 251| 0| return -1; 252| 0| } 253| | // Get tagging from template 254| 0| ttag = tt->tag; 255| 0| tclass = flags & ASN1_TFLG_TAG_CLASS; ------------------ | | 357| 0|#define ASN1_TFLG_TAG_CLASS (0x3 << 6) ------------------ 256| 4.41M| } else if (tag != -1) { ------------------ | Branch (256:14): [True: 0, False: 4.41M] ------------------ 257| | // No template tagging, get from arguments 258| 0| ttag = tag; 259| 0| tclass = iclass & ASN1_TFLG_TAG_CLASS; ------------------ | | 357| 0|#define ASN1_TFLG_TAG_CLASS (0x3 << 6) ------------------ 260| 4.41M| } else { 261| 4.41M| ttag = -1; 262| 4.41M| tclass = 0; 263| 4.41M| } 264| | 265| | // The template may itself by marked as optional, or this may be the template 266| | // of an |ASN1_ITEM_TEMPLATE| type which was contained inside an outer 267| | // optional template. (They cannot both be true because the 268| | // |ASN1_ITEM_TEMPLATE| codepath rejects optional templates.) 269| 4.41M| assert(!optional || (flags & ASN1_TFLG_OPTIONAL) == 0); 270| 4.41M| optional = optional || (flags & ASN1_TFLG_OPTIONAL) != 0; ------------------ | | 311| 4.41M|#define ASN1_TFLG_OPTIONAL (0x1) ------------------ | Branch (270:14): [True: 0, False: 4.41M] | Branch (270:26): [True: 277k, False: 4.13M] ------------------ 271| | 272| | // At this point 'ttag' contains the outer tag to use, and 'tclass' is the 273| | // class. 274| | 275| 4.41M| if (flags & ASN1_TFLG_SK_MASK) { ------------------ | | 320| 4.41M|#define ASN1_TFLG_SK_MASK (0x3 << 1) ------------------ | Branch (275:7): [True: 686k, False: 3.72M] ------------------ 276| | // SET OF, SEQUENCE OF 277| 686k| STACK_OF(ASN1_VALUE) *sk = (STACK_OF(ASN1_VALUE) *)*pval; ------------------ | | 39| 686k|#define STACK_OF(type) struct stack_st_##type ------------------ 278| 686k| int isset, sktag, skaclass; 279| 686k| int skcontlen, sklen; 280| 686k| ASN1_VALUE *skitem; 281| | 282| 686k| if (!*pval) { ------------------ | Branch (282:9): [True: 0, False: 686k] ------------------ 283| 0| if (optional) { ------------------ | Branch (283:11): [True: 0, False: 0] ------------------ 284| 0| return 0; 285| 0| } 286| 0| OPENSSL_PUT_ERROR(ASN1, ASN1_R_MISSING_VALUE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 287| 0| return -1; 288| 0| } 289| | 290| 686k| if (flags & ASN1_TFLG_SET_OF) { ------------------ | | 314| 686k|#define ASN1_TFLG_SET_OF (0x1 << 1) ------------------ | Branch (290:9): [True: 686k, False: 0] ------------------ 291| 686k| isset = 1; 292| | // Historically, types with both bits set were mutated when 293| | // serialized to apply the sort. We no longer support this. 294| 686k| assert((flags & ASN1_TFLG_SEQUENCE_OF) == 0); 295| 686k| } else { 296| 0| isset = 0; 297| 0| } 298| | 299| | // Work out inner tag value: if EXPLICIT or no tagging use underlying 300| | // type. 301| 686k| if ((ttag != -1) && !(flags & ASN1_TFLG_EXPTAG)) { ------------------ | | 332| 0|#define ASN1_TFLG_EXPTAG (0x2 << 3) ------------------ | Branch (301:9): [True: 0, False: 686k] | Branch (301:25): [True: 0, False: 0] ------------------ 302| 0| sktag = ttag; 303| 0| skaclass = tclass; 304| 686k| } else { 305| 686k| skaclass = V_ASN1_UNIVERSAL; ------------------ | | 49| 686k|#define V_ASN1_UNIVERSAL 0x00 ------------------ 306| 686k| if (isset) { ------------------ | Branch (306:11): [True: 686k, False: 0] ------------------ 307| 686k| sktag = V_ASN1_SET; ------------------ | | 98| 686k|#define V_ASN1_SET 17 ------------------ 308| 686k| } else { 309| 0| sktag = V_ASN1_SEQUENCE; ------------------ | | 97| 0|#define V_ASN1_SEQUENCE 16 ------------------ 310| 0| } 311| 686k| } 312| | 313| | // Determine total length of items 314| 686k| skcontlen = 0; 315| 1.37M| for (j = 0; j < sk_ASN1_VALUE_num(sk); j++) { ------------------ | Branch (315:17): [True: 689k, False: 686k] ------------------ 316| 689k| int tmplen; 317| 689k| skitem = sk_ASN1_VALUE_value(sk, j); 318| 689k| tmplen = ASN1_item_ex_i2d(&skitem, NULL, ASN1_ITEM_ptr(tt->item), -1, 0); ------------------ | | 241| 689k|#define ASN1_ITEM_ptr(iptr) (iptr) ------------------ 319| 689k| if (tmplen == -1 || (skcontlen > INT_MAX - tmplen)) { ------------------ | Branch (319:11): [True: 0, False: 689k] | Branch (319:27): [True: 0, False: 689k] ------------------ 320| 0| return -1; 321| 0| } 322| 689k| skcontlen += tmplen; 323| 689k| } 324| 686k| sklen = ASN1_object_size(/*constructed=*/1, skcontlen, sktag); 325| 686k| if (sklen == -1) { ------------------ | Branch (325:9): [True: 0, False: 686k] ------------------ 326| 0| return -1; 327| 0| } 328| | // If EXPLICIT need length of surrounding tag 329| 686k| if (flags & ASN1_TFLG_EXPTAG) { ------------------ | | 332| 686k|#define ASN1_TFLG_EXPTAG (0x2 << 3) ------------------ | Branch (329:9): [True: 0, False: 686k] ------------------ 330| 0| ret = ASN1_object_size(/*constructed=*/1, sklen, ttag); 331| 686k| } else { 332| 686k| ret = sklen; 333| 686k| } 334| | 335| 686k| if (!out || ret == -1) { ------------------ | Branch (335:9): [True: 343k, False: 343k] | Branch (335:17): [True: 0, False: 343k] ------------------ 336| 343k| return ret; 337| 343k| } 338| | 339| | // Now encode this lot... 340| | // EXPLICIT tag 341| 343k| if (flags & ASN1_TFLG_EXPTAG) { ------------------ | | 332| 343k|#define ASN1_TFLG_EXPTAG (0x2 << 3) ------------------ | Branch (341:9): [True: 0, False: 343k] ------------------ 342| 0| ASN1_put_object(out, /*constructed=*/1, sklen, ttag, tclass); 343| 0| } 344| | // SET or SEQUENCE and IMPLICIT tag 345| 343k| ASN1_put_object(out, /*constructed=*/1, skcontlen, sktag, skaclass); 346| | // And the stuff itself 347| 343k| if (!asn1_set_seq_out(sk, out, skcontlen, ASN1_ITEM_ptr(tt->item), isset)) { ------------------ | | 241| 343k|#define ASN1_ITEM_ptr(iptr) (iptr) ------------------ | Branch (347:9): [True: 0, False: 343k] ------------------ 348| 0| return -1; 349| 0| } 350| 343k| return ret; 351| 343k| } 352| | 353| 3.72M| if (flags & ASN1_TFLG_EXPTAG) { ------------------ | | 332| 3.72M|#define ASN1_TFLG_EXPTAG (0x2 << 3) ------------------ | Branch (353:7): [True: 0, False: 3.72M] ------------------ 354| | // EXPLICIT tagging 355| | // Find length of tagged item 356| 0| i = asn1_item_ex_i2d_opt(pval, NULL, ASN1_ITEM_ptr(tt->item), -1, 0, ------------------ | | 241| 0|#define ASN1_ITEM_ptr(iptr) (iptr) ------------------ 357| 0| optional); 358| 0| if (i <= 0) { ------------------ | Branch (358:9): [True: 0, False: 0] ------------------ 359| 0| return i; 360| 0| } 361| | // Find length of EXPLICIT tag 362| 0| ret = ASN1_object_size(/*constructed=*/1, i, ttag); 363| 0| if (out && ret != -1) { ------------------ | Branch (363:9): [True: 0, False: 0] | Branch (363:16): [True: 0, False: 0] ------------------ 364| | // Output tag and item 365| 0| ASN1_put_object(out, /*constructed=*/1, i, ttag, tclass); 366| 0| if (ASN1_item_ex_i2d(pval, out, ASN1_ITEM_ptr(tt->item), -1, 0) < 0) { ------------------ | | 241| 0|#define ASN1_ITEM_ptr(iptr) (iptr) ------------------ | Branch (366:11): [True: 0, False: 0] ------------------ 367| 0| return -1; 368| 0| } 369| 0| } 370| 0| return ret; 371| 0| } 372| | 373| | // Either normal or IMPLICIT tagging 374| 3.72M| return asn1_item_ex_i2d_opt(pval, out, ASN1_ITEM_ptr(tt->item), ttag, tclass, ------------------ | | 241| 3.72M|#define ASN1_ITEM_ptr(iptr) (iptr) ------------------ 375| 3.72M| optional); 376| 3.72M|} tasn_enc.cc:_ZL16asn1_set_seq_outP19stack_st_ASN1_VALUEPPhiPK12ASN1_ITEM_sti: 403| 343k| int skcontlen, const ASN1_ITEM *item, int do_sort) { 404| | // No need to sort if there are fewer than two items. 405| 343k| if (!do_sort || sk_ASN1_VALUE_num(sk) < 2) { ------------------ | Branch (405:7): [True: 0, False: 343k] | Branch (405:19): [True: 341k, False: 1.53k] ------------------ 406| 683k| for (size_t i = 0; i < sk_ASN1_VALUE_num(sk); i++) { ------------------ | Branch (406:24): [True: 341k, False: 341k] ------------------ 407| 341k| ASN1_VALUE *skitem = sk_ASN1_VALUE_value(sk, i); 408| 341k| if (ASN1_item_ex_i2d(&skitem, out, item, -1, 0) < 0) { ------------------ | Branch (408:11): [True: 0, False: 341k] ------------------ 409| 0| return 0; 410| 0| } 411| 341k| } 412| 341k| return 1; 413| 341k| } 414| | 415| 1.53k| int ret = 0; 416| 1.53k| uint8_t *const buf = reinterpret_cast(OPENSSL_malloc(skcontlen)); 417| 1.53k| DER_ENC *encoded = reinterpret_cast( 418| 1.53k| OPENSSL_calloc(sk_ASN1_VALUE_num(sk), sizeof(*encoded))); 419| 1.53k| uint8_t *p = buf; 420| 1.53k| if (encoded == NULL || buf == NULL) { ------------------ | Branch (420:7): [True: 0, False: 1.53k] | Branch (420:26): [True: 0, False: 1.53k] ------------------ 421| 0| goto err; 422| 0| } 423| | 424| | // Encode all the elements into |buf| and populate |encoded|. 425| 4.61k| for (size_t i = 0; i < sk_ASN1_VALUE_num(sk); i++) { ------------------ | Branch (425:22): [True: 3.07k, False: 1.53k] ------------------ 426| 3.07k| ASN1_VALUE *skitem = sk_ASN1_VALUE_value(sk, i); 427| 3.07k| encoded[i].data = p; 428| 3.07k| encoded[i].length = ASN1_item_ex_i2d(&skitem, &p, item, -1, 0); 429| 3.07k| if (encoded[i].length < 0) { ------------------ | Branch (429:9): [True: 0, False: 3.07k] ------------------ 430| 0| goto err; 431| 0| } 432| 3.07k| assert(p - buf <= skcontlen); 433| 3.07k| } 434| | 435| 1.53k| qsort(encoded, sk_ASN1_VALUE_num(sk), sizeof(*encoded), der_cmp); 436| | 437| | // Output the elements in sorted order. 438| 1.53k| p = *out; 439| 4.61k| for (size_t i = 0; i < sk_ASN1_VALUE_num(sk); i++) { ------------------ | Branch (439:22): [True: 3.07k, False: 1.53k] ------------------ 440| 3.07k| OPENSSL_memcpy(p, encoded[i].data, encoded[i].length); 441| 3.07k| p += encoded[i].length; 442| 3.07k| } 443| 1.53k| *out = p; 444| | 445| 1.53k| ret = 1; 446| | 447| 1.53k|err: 448| 1.53k| OPENSSL_free(encoded); 449| 1.53k| OPENSSL_free(buf); 450| 1.53k| return ret; 451| 1.53k|} tasn_enc.cc:_ZL7der_cmpPKvS0_: 385| 1.53k|static int der_cmp(const void *a, const void *b) { 386| 1.53k| const DER_ENC *d1 = reinterpret_cast(a), 387| 1.53k| *d2 = reinterpret_cast(b); 388| 1.53k| int cmplen, i; 389| 1.53k| cmplen = (d1->length < d2->length) ? d1->length : d2->length; ------------------ | Branch (389:12): [True: 1.53k, False: 7] ------------------ 390| 1.53k| i = OPENSSL_memcmp(d1->data, d2->data, cmplen); 391| 1.53k| if (i) { ------------------ | Branch (391:7): [True: 1.53k, False: 3] ------------------ 392| 1.53k| return i; 393| 1.53k| } 394| 3| return d1->length - d2->length; 395| 1.53k|} tasn_enc.cc:_ZL21asn1_i2d_ex_primitivePP13ASN1_VALUE_stPPhPK12ASN1_ITEM_stiii: 457| 3.52M| int optional) { 458| | // Get length of content octets and maybe find out the underlying type. 459| 3.52M| int omit; 460| 3.52M| int utype = it->utype; 461| 3.52M| int len = asn1_ex_i2c(pval, NULL, &omit, &utype, it); 462| 3.52M| if (len < 0) { ------------------ | Branch (462:7): [True: 0, False: 3.52M] ------------------ 463| 0| return -1; 464| 0| } 465| 3.52M| if (omit) { ------------------ | Branch (465:7): [True: 1.05k, False: 3.52M] ------------------ 466| 1.05k| if (optional) { ------------------ | Branch (466:9): [True: 1.05k, False: 0] ------------------ 467| 1.05k| return 0; 468| 1.05k| } 469| 0| OPENSSL_PUT_ERROR(ASN1, ASN1_R_MISSING_VALUE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 470| 0| return -1; 471| 1.05k| } 472| | 473| | // If SEQUENCE, SET or OTHER then header is included in pseudo content 474| | // octets so don't include tag+length. We need to check here because the 475| | // call to asn1_ex_i2c() could change utype. 476| 3.52M| int usetag = 477| 3.52M| utype != V_ASN1_SEQUENCE && utype != V_ASN1_SET && utype != V_ASN1_OTHER; ------------------ | | 97| 7.04M|#define V_ASN1_SEQUENCE 16 ------------------ utype != V_ASN1_SEQUENCE && utype != V_ASN1_SET && utype != V_ASN1_OTHER; ------------------ | | 98| 7.02M|#define V_ASN1_SET 17 ------------------ utype != V_ASN1_SEQUENCE && utype != V_ASN1_SET && utype != V_ASN1_OTHER; ------------------ | | 75| 7.01M|#define V_ASN1_OTHER (-3) ------------------ | Branch (477:7): [True: 3.50M, False: 15.9k] | Branch (477:35): [True: 3.49M, False: 5.18k] | Branch (477:58): [True: 3.48M, False: 12.7k] ------------------ 478| | 479| | // If not implicitly tagged get tag from underlying type 480| 3.52M| if (tag == -1) { ------------------ | Branch (480:7): [True: 3.52M, False: 0] ------------------ 481| 3.52M| tag = utype; 482| 3.52M| } 483| | 484| | // Output tag+length followed by content octets 485| 3.52M| if (out) { ------------------ | Branch (485:7): [True: 897k, False: 2.62M] ------------------ 486| 897k| if (usetag) { ------------------ | Branch (486:9): [True: 888k, False: 8.47k] ------------------ 487| 888k| ASN1_put_object(out, /*constructed=*/0, len, tag, aclass); 488| 888k| } 489| 897k| int len2 = asn1_ex_i2c(pval, *out, &omit, &utype, it); 490| 897k| if (len2 < 0) { ------------------ | Branch (490:9): [True: 0, False: 897k] ------------------ 491| 0| return -1; 492| 0| } 493| 897k| assert(len == len2); 494| 897k| assert(!omit); 495| 897k| *out += len; 496| 897k| } 497| | 498| 3.52M| if (usetag) { ------------------ | Branch (498:7): [True: 3.48M, False: 33.8k] ------------------ 499| 3.48M| return ASN1_object_size(/*constructed=*/0, len, tag); 500| 3.48M| } 501| 33.8k| return len; 502| 3.52M|} tasn_enc.cc:_ZL11asn1_ex_i2cPP13ASN1_VALUE_stPhPiS3_PK12ASN1_ITEM_st: 521| 4.41M| int *putype, const ASN1_ITEM *it) { 522| 4.41M| ASN1_BOOLEAN *tbool = NULL; 523| 4.41M| ASN1_STRING *strtmp; 524| 4.41M| ASN1_OBJECT *otmp; 525| 4.41M| int utype; 526| 4.41M| const unsigned char *cont; 527| 4.41M| unsigned char c; 528| 4.41M| int len; 529| | 530| 4.41M| assert(it->itype == ASN1_ITYPE_PRIMITIVE || it->itype == ASN1_ITYPE_MSTRING); 531| | // Historically, |it->funcs| for primitive types contained an 532| | // |ASN1_PRIMITIVE_FUNCS| table of callbacks. 533| 4.41M| assert(it->funcs == NULL); 534| | 535| 4.41M| *out_omit = 0; 536| | 537| | // Handle omitted optional values for all but BOOLEAN, which uses a 538| | // non-pointer representation. 539| 4.41M| if (it->itype != ASN1_ITYPE_PRIMITIVE || it->utype != V_ASN1_BOOLEAN) { ------------------ | | 418| 8.83M|#define ASN1_ITYPE_PRIMITIVE 0x0 ------------------ if (it->itype != ASN1_ITYPE_PRIMITIVE || it->utype != V_ASN1_BOOLEAN) { ------------------ | | 86| 4.41M|#define V_ASN1_BOOLEAN 1 ------------------ | Branch (539:7): [True: 0, False: 4.41M] | Branch (539:44): [True: 4.41M, False: 0] ------------------ 540| 4.41M| if (!*pval) { ------------------ | Branch (540:9): [True: 1.05k, False: 4.41M] ------------------ 541| 1.05k| *out_omit = 1; 542| 1.05k| return 0; 543| 1.05k| } 544| 4.41M| } 545| | 546| 4.41M| if (it->itype == ASN1_ITYPE_MSTRING || it->utype == V_ASN1_ANY_AS_STRING) { ------------------ | | 426| 8.83M|#define ASN1_ITYPE_MSTRING 0x5 ------------------ if (it->itype == ASN1_ITYPE_MSTRING || it->utype == V_ASN1_ANY_AS_STRING) { ------------------ | | 82| 4.41M|#define V_ASN1_ANY_AS_STRING (-5) ------------------ | Branch (546:7): [True: 0, False: 4.41M] | Branch (546:42): [True: 1.72M, False: 2.69M] ------------------ 547| | // If MSTRING type set the underlying type 548| 1.72M| strtmp = (ASN1_STRING *)*pval; 549| 1.72M| utype = strtmp->type; 550| 1.72M| if (utype < 0 && utype != V_ASN1_OTHER) { ------------------ | | 75| 1.91k|#define V_ASN1_OTHER (-3) ------------------ | Branch (550:9): [True: 1.91k, False: 1.72M] | Branch (550:22): [True: 0, False: 1.91k] ------------------ 551| | // MSTRINGs can have type -1 when default-constructed. 552| 0| OPENSSL_PUT_ERROR(ASN1, ASN1_R_WRONG_TYPE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 553| 0| return -1; 554| 0| } 555| | // Negative INTEGER and ENUMERATED values use |ASN1_STRING| type values that 556| | // do not match their corresponding utype values. 557| 1.72M| if (utype == V_ASN1_NEG_INTEGER) { ------------------ | | 117| 1.72M|#define V_ASN1_NEG_INTEGER (V_ASN1_INTEGER | V_ASN1_NEG) | | ------------------ | | | | 87| 1.72M|#define V_ASN1_INTEGER 2 | | ------------------ | | #define V_ASN1_NEG_INTEGER (V_ASN1_INTEGER | V_ASN1_NEG) | | ------------------ | | | | 116| 1.72M|#define V_ASN1_NEG 0x100 | | ------------------ ------------------ | Branch (557:9): [True: 30, False: 1.72M] ------------------ 558| 30| utype = V_ASN1_INTEGER; ------------------ | | 87| 30|#define V_ASN1_INTEGER 2 ------------------ 559| 1.72M| } else if (utype == V_ASN1_NEG_ENUMERATED) { ------------------ | | 118| 1.72M|#define V_ASN1_NEG_ENUMERATED (V_ASN1_ENUMERATED | V_ASN1_NEG) | | ------------------ | | | | 95| 1.72M|#define V_ASN1_ENUMERATED 10 | | ------------------ | | #define V_ASN1_NEG_ENUMERATED (V_ASN1_ENUMERATED | V_ASN1_NEG) | | ------------------ | | | | 116| 1.72M|#define V_ASN1_NEG 0x100 | | ------------------ ------------------ | Branch (559:16): [True: 43.7k, False: 1.68M] ------------------ 560| 43.7k| utype = V_ASN1_ENUMERATED; ------------------ | | 95| 43.7k|#define V_ASN1_ENUMERATED 10 ------------------ 561| 43.7k| } 562| 1.72M| *putype = utype; 563| 2.69M| } else if (it->utype == V_ASN1_ANY) { ------------------ | | 78| 2.69M|#define V_ASN1_ANY (-4) ------------------ | Branch (563:14): [True: 345k, False: 2.34M] ------------------ 564| | // If ANY set type and pointer to value 565| 345k| ASN1_TYPE *typ; 566| 345k| typ = (ASN1_TYPE *)*pval; 567| 345k| utype = typ->type; 568| 345k| if (utype < 0 && utype != V_ASN1_OTHER) { ------------------ | | 75| 14.0k|#define V_ASN1_OTHER (-3) ------------------ | Branch (568:9): [True: 14.0k, False: 331k] | Branch (568:22): [True: 0, False: 14.0k] ------------------ 569| | // |ASN1_TYPE|s can have type -1 when default-constructed. 570| 0| OPENSSL_PUT_ERROR(ASN1, ASN1_R_WRONG_TYPE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 571| 0| return -1; 572| 0| } 573| 345k| *putype = utype; 574| 345k| pval = &typ->value.asn1_value; 575| 2.34M| } else { 576| 2.34M| utype = *putype; 577| 2.34M| } 578| | 579| 4.41M| switch (utype) { 580| 2.15M| case V_ASN1_OBJECT: ------------------ | | 91| 2.15M|#define V_ASN1_OBJECT 6 ------------------ | Branch (580:5): [True: 2.15M, False: 2.25M] ------------------ 581| 2.15M| otmp = (ASN1_OBJECT *)*pval; 582| 2.15M| cont = otmp->data; 583| 2.15M| len = otmp->length; 584| 2.15M| if (len == 0) { ------------------ | Branch (584:11): [True: 0, False: 2.15M] ------------------ 585| | // Some |ASN1_OBJECT|s do not have OIDs and cannot be serialized. 586| 0| OPENSSL_PUT_ERROR(ASN1, ASN1_R_ILLEGAL_OBJECT); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 587| 0| return -1; 588| 0| } 589| 2.15M| break; 590| | 591| 2.15M| case V_ASN1_NULL: ------------------ | | 90| 220k|#define V_ASN1_NULL 5 ------------------ | Branch (591:5): [True: 220k, False: 4.19M] ------------------ 592| 220k| cont = NULL; 593| 220k| len = 0; 594| 220k| break; 595| | 596| 15| case V_ASN1_BOOLEAN: ------------------ | | 86| 15|#define V_ASN1_BOOLEAN 1 ------------------ | Branch (596:5): [True: 15, False: 4.41M] ------------------ 597| 15| tbool = (ASN1_BOOLEAN *)pval; 598| 15| if (*tbool == ASN1_BOOLEAN_NONE) { ------------------ | | 385| 15|#define ASN1_BOOLEAN_NONE (-1) ------------------ | Branch (598:11): [True: 0, False: 15] ------------------ 599| 0| *out_omit = 1; 600| 0| return 0; 601| 0| } 602| 15| if (it->utype != V_ASN1_ANY) { ------------------ | | 78| 15|#define V_ASN1_ANY (-4) ------------------ | Branch (602:11): [True: 0, False: 15] ------------------ 603| | // Default handling if value == size field then omit 604| 0| if ((*tbool && (it->size > 0)) || (!*tbool && !it->size)) { ------------------ | Branch (604:14): [True: 0, False: 0] | Branch (604:24): [True: 0, False: 0] | Branch (604:44): [True: 0, False: 0] | Branch (604:55): [True: 0, False: 0] ------------------ 605| 0| *out_omit = 1; 606| 0| return 0; 607| 0| } 608| 0| } 609| 15| c = *tbool ? 0xff : 0x00; ------------------ | Branch (609:11): [True: 10, False: 5] ------------------ 610| 15| cont = &c; 611| 15| len = 1; 612| 15| break; 613| | 614| 290k| case V_ASN1_BIT_STRING: { ------------------ | | 88| 290k|#define V_ASN1_BIT_STRING 3 ------------------ | Branch (614:5): [True: 290k, False: 4.12M] ------------------ 615| 290k| int ret = 616| 290k| i2c_ASN1_BIT_STRING((ASN1_BIT_STRING *)*pval, cout ? &cout : NULL); ------------------ | Branch (616:57): [True: 71.9k, False: 218k] ------------------ 617| | // |i2c_ASN1_BIT_STRING| returns zero on error instead of -1. 618| 290k| return ret <= 0 ? -1 : ret; ------------------ | Branch (618:14): [True: 0, False: 290k] ------------------ 619| 15| } 620| | 621| 8.78k| case V_ASN1_INTEGER: ------------------ | | 87| 8.78k|#define V_ASN1_INTEGER 2 ------------------ | Branch (621:5): [True: 8.78k, False: 4.40M] ------------------ 622| 72.8k| case V_ASN1_ENUMERATED: { ------------------ | | 95| 72.8k|#define V_ASN1_ENUMERATED 10 ------------------ | Branch (622:5): [True: 64.0k, False: 4.35M] ------------------ 623| | // |i2c_ASN1_INTEGER| also handles ENUMERATED. 624| 72.8k| int ret = i2c_ASN1_INTEGER((ASN1_INTEGER *)*pval, cout ? &cout : NULL); ------------------ | Branch (624:57): [True: 14.5k, False: 58.2k] ------------------ 625| | // |i2c_ASN1_INTEGER| returns zero on error instead of -1. 626| 72.8k| return ret <= 0 ? -1 : ret; ------------------ | Branch (626:14): [True: 0, False: 72.8k] ------------------ 627| 8.78k| } 628| | 629| 740| case V_ASN1_OCTET_STRING: ------------------ | | 89| 740|#define V_ASN1_OCTET_STRING 4 ------------------ | Branch (629:5): [True: 740, False: 4.41M] ------------------ 630| 1.24k| case V_ASN1_NUMERICSTRING: ------------------ | | 99| 1.24k|#define V_ASN1_NUMERICSTRING 18 ------------------ | Branch (630:5): [True: 505, False: 4.41M] ------------------ 631| 1.62k| case V_ASN1_PRINTABLESTRING: ------------------ | | 100| 1.62k|#define V_ASN1_PRINTABLESTRING 19 ------------------ | Branch (631:5): [True: 380, False: 4.41M] ------------------ 632| 1.63k| case V_ASN1_T61STRING: ------------------ | | 101| 1.63k|#define V_ASN1_T61STRING 20 ------------------ | Branch (632:5): [True: 5, False: 4.41M] ------------------ 633| 1.68k| case V_ASN1_VIDEOTEXSTRING: ------------------ | | 103| 1.68k|#define V_ASN1_VIDEOTEXSTRING 21 ------------------ | Branch (633:5): [True: 50, False: 4.41M] ------------------ 634| 1.77k| case V_ASN1_IA5STRING: ------------------ | | 104| 1.77k|#define V_ASN1_IA5STRING 22 ------------------ | Branch (634:5): [True: 95, False: 4.41M] ------------------ 635| 1.78k| case V_ASN1_UTCTIME: ------------------ | | 105| 1.78k|#define V_ASN1_UTCTIME 23 ------------------ | Branch (635:5): [True: 5, False: 4.41M] ------------------ 636| 1.78k| case V_ASN1_GENERALIZEDTIME: ------------------ | | 106| 1.78k|#define V_ASN1_GENERALIZEDTIME 24 ------------------ | Branch (636:5): [True: 0, False: 4.41M] ------------------ 637| 1.80k| case V_ASN1_GRAPHICSTRING: ------------------ | | 107| 1.80k|#define V_ASN1_GRAPHICSTRING 25 ------------------ | Branch (637:5): [True: 25, False: 4.41M] ------------------ 638| 1.93k| case V_ASN1_VISIBLESTRING: ------------------ | | 109| 1.93k|#define V_ASN1_VISIBLESTRING 26 ------------------ | Branch (638:5): [True: 125, False: 4.41M] ------------------ 639| 2.02k| case V_ASN1_GENERALSTRING: ------------------ | | 110| 2.02k|#define V_ASN1_GENERALSTRING 27 ------------------ | Branch (639:5): [True: 90, False: 4.41M] ------------------ 640| 2.02k| case V_ASN1_UNIVERSALSTRING: ------------------ | | 111| 2.02k|#define V_ASN1_UNIVERSALSTRING 28 ------------------ | Branch (640:5): [True: 5, False: 4.41M] ------------------ 641| 2.09k| case V_ASN1_BMPSTRING: ------------------ | | 112| 2.09k|#define V_ASN1_BMPSTRING 30 ------------------ | Branch (641:5): [True: 70, False: 4.41M] ------------------ 642| 1.63M| case V_ASN1_UTF8STRING: ------------------ | | 96| 1.63M|#define V_ASN1_UTF8STRING 12 ------------------ | Branch (642:5): [True: 1.63M, False: 2.78M] ------------------ 643| 1.65M| case V_ASN1_SEQUENCE: ------------------ | | 97| 1.65M|#define V_ASN1_SEQUENCE 16 ------------------ | Branch (643:5): [True: 19.9k, False: 4.39M] ------------------ 644| 1.65M| case V_ASN1_SET: ------------------ | | 98| 1.65M|#define V_ASN1_SET 17 ------------------ | Branch (644:5): [True: 6.48k, False: 4.41M] ------------------ 645| | // This is not a valid |ASN1_ITEM| type, but it appears in |ASN1_TYPE|. 646| 1.67M| case V_ASN1_OTHER: ------------------ | | 75| 1.67M|#define V_ASN1_OTHER (-3) ------------------ | Branch (646:5): [True: 15.9k, False: 4.40M] ------------------ 647| | // All based on ASN1_STRING and handled the same 648| 1.67M| strtmp = (ASN1_STRING *)*pval; 649| 1.67M| cont = strtmp->data; 650| 1.67M| len = strtmp->length; 651| 1.67M| break; 652| | 653| 0| default: ------------------ | Branch (653:5): [True: 0, False: 4.41M] ------------------ 654| 0| OPENSSL_PUT_ERROR(ASN1, ASN1_R_BAD_TEMPLATE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 655| 0| return -1; 656| 4.41M| } 657| 4.05M| if (cout && len) { ------------------ | Branch (657:7): [True: 810k, False: 3.24M] | Branch (657:15): [True: 766k, False: 44.1k] ------------------ 658| 766k| OPENSSL_memcpy(cout, cont, len); 659| 766k| } 660| 4.05M| return len; 661| 4.41M|} ASN1_item_free: 26| 1.18M|void ASN1_item_free(ASN1_VALUE *val, const ASN1_ITEM *it) { 27| 1.18M| ASN1_item_ex_free(&val, it); 28| 1.18M|} ASN1_item_ex_free: 30| 5.04M|void ASN1_item_ex_free(ASN1_VALUE **pval, const ASN1_ITEM *it) { 31| 5.04M| if (!pval) { ------------------ | Branch (31:7): [True: 0, False: 5.04M] ------------------ 32| 0| return; 33| 0| } 34| 5.04M| if ((it->itype != ASN1_ITYPE_PRIMITIVE) && !*pval) { ------------------ | | 418| 5.04M|#define ASN1_ITYPE_PRIMITIVE 0x0 ------------------ | Branch (34:7): [True: 1.80M, False: 3.23M] | Branch (34:46): [True: 214k, False: 1.58M] ------------------ 35| 214k| return; 36| 214k| } 37| | 38| 4.82M| switch (it->itype) { ------------------ | Branch (38:11): [True: 0, False: 4.82M] ------------------ 39| 3.23M| case ASN1_ITYPE_PRIMITIVE: ------------------ | | 418| 3.23M|#define ASN1_ITYPE_PRIMITIVE 0x0 ------------------ | Branch (39:5): [True: 3.23M, False: 1.58M] ------------------ 40| 3.23M| if (it->templates) { ------------------ | Branch (40:11): [True: 140k, False: 3.09M] ------------------ 41| 140k| ASN1_template_free(pval, it->templates); 42| 3.09M| } else { 43| 3.09M| ASN1_primitive_free(pval, it); 44| 3.09M| } 45| 3.23M| break; 46| | 47| 140k| case ASN1_ITYPE_MSTRING: ------------------ | | 426| 140k|#define ASN1_ITYPE_MSTRING 0x5 ------------------ | Branch (47:5): [True: 140k, False: 4.68M] ------------------ 48| 140k| ASN1_primitive_free(pval, it); 49| 140k| break; 50| | 51| 0| case ASN1_ITYPE_CHOICE: { ------------------ | | 422| 0|#define ASN1_ITYPE_CHOICE 0x2 ------------------ | Branch (51:5): [True: 0, False: 4.82M] ------------------ 52| 0| const ASN1_AUX *aux = reinterpret_cast(it->funcs); 53| 0| ASN1_aux_cb *asn1_cb = aux != NULL ? aux->asn1_cb : NULL; ------------------ | Branch (53:30): [True: 0, False: 0] ------------------ 54| 0| if (asn1_cb) { ------------------ | Branch (54:11): [True: 0, False: 0] ------------------ 55| 0| if (asn1_cb(ASN1_OP_FREE_PRE, pval, it, NULL) == 2) { ------------------ | | 470| 0|#define ASN1_OP_FREE_PRE 2 ------------------ | Branch (55:13): [True: 0, False: 0] ------------------ 56| 0| return; 57| 0| } 58| 0| } 59| 0| int i = asn1_get_choice_selector(pval, it); 60| 0| if ((i >= 0) && (i < it->tcount)) { ------------------ | Branch (60:11): [True: 0, False: 0] | Branch (60:23): [True: 0, False: 0] ------------------ 61| 0| const ASN1_TEMPLATE *tt = it->templates + i; 62| 0| ASN1_VALUE **pchval = asn1_get_field_ptr(pval, tt); 63| 0| ASN1_template_free(pchval, tt); 64| 0| } 65| 0| if (asn1_cb) { ------------------ | Branch (65:11): [True: 0, False: 0] ------------------ 66| 0| asn1_cb(ASN1_OP_FREE_POST, pval, it, NULL); ------------------ | | 471| 0|#define ASN1_OP_FREE_POST 3 ------------------ 67| 0| } 68| 0| OPENSSL_free(*pval); 69| 0| *pval = NULL; 70| 0| break; 71| 0| } 72| | 73| 140k| case ASN1_ITYPE_EXTERN: { ------------------ | | 424| 140k|#define ASN1_ITYPE_EXTERN 0x4 ------------------ | Branch (73:5): [True: 140k, False: 4.68M] ------------------ 74| 140k| const ASN1_EXTERN_FUNCS *ef = 75| 140k| reinterpret_cast(it->funcs); 76| 140k| if (ef && ef->asn1_ex_free) { ------------------ | Branch (76:11): [True: 140k, False: 0] | Branch (76:17): [True: 140k, False: 0] ------------------ 77| 140k| ef->asn1_ex_free(pval, it); 78| 140k| } 79| 140k| break; 80| 0| } 81| | 82| 1.30M| case ASN1_ITYPE_SEQUENCE: { ------------------ | | 420| 1.30M|#define ASN1_ITYPE_SEQUENCE 0x1 ------------------ | Branch (82:5): [True: 1.30M, False: 3.51M] ------------------ 83| 1.30M| if (!asn1_refcount_dec_and_test_zero(pval, it)) { ------------------ | Branch (83:11): [True: 0, False: 1.30M] ------------------ 84| 0| return; 85| 0| } 86| 1.30M| const ASN1_AUX *aux = reinterpret_cast(it->funcs); 87| 1.30M| ASN1_aux_cb *asn1_cb = aux != NULL ? aux->asn1_cb : NULL; ------------------ | Branch (87:30): [True: 140k, False: 1.16M] ------------------ 88| 1.30M| if (asn1_cb) { ------------------ | Branch (88:11): [True: 70.1k, False: 1.23M] ------------------ 89| 70.1k| if (asn1_cb(ASN1_OP_FREE_PRE, pval, it, NULL) == 2) { ------------------ | | 470| 70.1k|#define ASN1_OP_FREE_PRE 2 ------------------ | Branch (89:13): [True: 0, False: 70.1k] ------------------ 90| 0| return; 91| 0| } 92| 70.1k| } 93| 1.30M| asn1_enc_free(pval, it); 94| | // If we free up as normal we will invalidate any ANY DEFINED BY 95| | // field and we wont be able to determine the type of the field it 96| | // defines. So free up in reverse order. 97| 4.68M| for (int i = it->tcount - 1; i >= 0; i--) { ------------------ | Branch (97:36): [True: 3.37M, False: 1.30M] ------------------ 98| 3.37M| const ASN1_TEMPLATE *seqtt = asn1_do_adb(pval, &it->templates[i], 0); 99| 3.37M| if (!seqtt) { ------------------ | Branch (99:13): [True: 0, False: 3.37M] ------------------ 100| 0| continue; 101| 0| } 102| 3.37M| ASN1_VALUE **pseqval = asn1_get_field_ptr(pval, seqtt); 103| 3.37M| ASN1_template_free(pseqval, seqtt); 104| 3.37M| } 105| 1.30M| if (asn1_cb) { ------------------ | Branch (105:11): [True: 70.1k, False: 1.23M] ------------------ 106| 70.1k| asn1_cb(ASN1_OP_FREE_POST, pval, it, NULL); ------------------ | | 471| 70.1k|#define ASN1_OP_FREE_POST 3 ------------------ 107| 70.1k| } 108| 1.30M| OPENSSL_free(*pval); 109| 1.30M| *pval = NULL; 110| 1.30M| break; 111| 1.30M| } 112| 4.82M| } 113| 4.82M|} ASN1_template_free: 115| 3.87M|void ASN1_template_free(ASN1_VALUE **pval, const ASN1_TEMPLATE *tt) { 116| 3.87M| if (tt->flags & ASN1_TFLG_SK_MASK) { ------------------ | | 320| 3.87M|#define ASN1_TFLG_SK_MASK (0x3 << 1) ------------------ | Branch (116:7): [True: 212k, False: 3.65M] ------------------ 117| 212k| STACK_OF(ASN1_VALUE) *sk = (STACK_OF(ASN1_VALUE) *)*pval; ------------------ | | 39| 212k|#define STACK_OF(type) struct stack_st_##type ------------------ 118| 412k| for (size_t i = 0; i < sk_ASN1_VALUE_num(sk); i++) { ------------------ | Branch (118:24): [True: 199k, False: 212k] ------------------ 119| 199k| ASN1_VALUE *vtmp = sk_ASN1_VALUE_value(sk, i); 120| 199k| ASN1_item_ex_free(&vtmp, ASN1_ITEM_ptr(tt->item)); ------------------ | | 241| 199k|#define ASN1_ITEM_ptr(iptr) (iptr) ------------------ 121| 199k| } 122| 212k| sk_ASN1_VALUE_free(sk); 123| 212k| *pval = NULL; 124| 3.65M| } else { 125| 3.65M| ASN1_item_ex_free(pval, ASN1_ITEM_ptr(tt->item)); ------------------ | | 241| 3.65M|#define ASN1_ITEM_ptr(iptr) (iptr) ------------------ 126| 3.65M| } 127| 3.87M|} ASN1_primitive_free: 129| 3.23M|void ASN1_primitive_free(ASN1_VALUE **pval, const ASN1_ITEM *it) { 130| | // Historically, |it->funcs| for primitive types contained an 131| | // |ASN1_PRIMITIVE_FUNCS| table of calbacks. 132| 3.23M| assert(it->funcs == NULL); 133| | 134| 3.23M| int utype = it->itype == ASN1_ITYPE_MSTRING ? -1 : it->utype; ------------------ | | 426| 3.23M|#define ASN1_ITYPE_MSTRING 0x5 ------------------ | Branch (134:15): [True: 140k, False: 3.09M] ------------------ 135| 3.23M| switch (utype) { 136| 1.09M| case V_ASN1_OBJECT: ------------------ | | 91| 1.09M|#define V_ASN1_OBJECT 6 ------------------ | Branch (136:5): [True: 1.09M, False: 2.13M] ------------------ 137| 1.09M| ASN1_OBJECT_free((ASN1_OBJECT *)*pval); 138| 1.09M| break; 139| | 140| 363k| case V_ASN1_BOOLEAN: ------------------ | | 86| 363k|#define V_ASN1_BOOLEAN 1 ------------------ | Branch (140:5): [True: 363k, False: 2.87M] ------------------ 141| 363k| if (it) { ------------------ | Branch (141:11): [True: 363k, False: 0] ------------------ 142| 363k| *(ASN1_BOOLEAN *)pval = (ASN1_BOOLEAN)it->size; 143| 363k| } else { 144| 0| *(ASN1_BOOLEAN *)pval = ASN1_BOOLEAN_NONE; ------------------ | | 385| 0|#define ASN1_BOOLEAN_NONE (-1) ------------------ 145| 0| } 146| 363k| return; 147| | 148| 0| case V_ASN1_NULL: ------------------ | | 90| 0|#define V_ASN1_NULL 5 ------------------ | Branch (148:5): [True: 0, False: 3.23M] ------------------ 149| 0| break; 150| | 151| 256k| case V_ASN1_ANY: ------------------ | | 78| 256k|#define V_ASN1_ANY (-4) ------------------ | Branch (151:5): [True: 256k, False: 2.98M] ------------------ 152| 256k| if (*pval != NULL) { ------------------ | Branch (152:11): [True: 161k, False: 95.0k] ------------------ 153| 161k| asn1_type_cleanup((ASN1_TYPE *)*pval); 154| 161k| OPENSSL_free(*pval); 155| 161k| } 156| 256k| break; 157| | 158| 1.51M| default: ------------------ | Branch (158:5): [True: 1.51M, False: 1.71M] ------------------ 159| 1.51M| ASN1_STRING_free((ASN1_STRING *)*pval); 160| 1.51M| *pval = NULL; 161| 1.51M| break; 162| 3.23M| } 163| 2.87M| *pval = NULL; 164| 2.87M|} ASN1_item_new: 34| 506k|ASN1_VALUE *ASN1_item_new(const ASN1_ITEM *it) { 35| 506k| ASN1_VALUE *ret = NULL; 36| 506k| if (ASN1_item_ex_new(&ret, it) > 0) { ------------------ | Branch (36:7): [True: 506k, False: 0] ------------------ 37| 506k| return ret; 38| 506k| } 39| 0| return NULL; 40| 506k|} ASN1_item_ex_new: 44| 3.87M|int ASN1_item_ex_new(ASN1_VALUE **pval, const ASN1_ITEM *it) { 45| 3.87M| const ASN1_TEMPLATE *tt = NULL; 46| 3.87M| const ASN1_EXTERN_FUNCS *ef; 47| 3.87M| ASN1_VALUE **pseqval; 48| 3.87M| int i; 49| | 50| 3.87M| switch (it->itype) { ------------------ | Branch (50:11): [True: 0, False: 3.87M] ------------------ 51| 140k| case ASN1_ITYPE_EXTERN: ------------------ | | 424| 140k|#define ASN1_ITYPE_EXTERN 0x4 ------------------ | Branch (51:5): [True: 140k, False: 3.73M] ------------------ 52| 140k| ef = reinterpret_cast(it->funcs); 53| 140k| if (ef && ef->asn1_ex_new) { ------------------ | Branch (53:11): [True: 140k, False: 0] | Branch (53:17): [True: 140k, False: 0] ------------------ 54| 140k| if (!ef->asn1_ex_new(pval, it)) { ------------------ | Branch (54:13): [True: 0, False: 140k] ------------------ 55| 0| goto memerr; 56| 0| } 57| 140k| } 58| 140k| break; 59| | 60| 2.28M| case ASN1_ITYPE_PRIMITIVE: ------------------ | | 418| 2.28M|#define ASN1_ITYPE_PRIMITIVE 0x0 ------------------ | Branch (60:5): [True: 2.28M, False: 1.58M] ------------------ 61| 2.28M| if (it->templates) { ------------------ | Branch (61:11): [True: 0, False: 2.28M] ------------------ 62| 0| if (!ASN1_template_new(pval, it->templates)) { ------------------ | Branch (62:13): [True: 0, False: 0] ------------------ 63| 0| goto memerr; 64| 0| } 65| 2.28M| } else if (!ASN1_primitive_new(pval, it)) { ------------------ | Branch (65:18): [True: 0, False: 2.28M] ------------------ 66| 0| goto memerr; 67| 0| } 68| 2.28M| break; 69| | 70| 2.28M| case ASN1_ITYPE_MSTRING: ------------------ | | 426| 140k|#define ASN1_ITYPE_MSTRING 0x5 ------------------ | Branch (70:5): [True: 140k, False: 3.73M] ------------------ 71| 140k| if (!ASN1_primitive_new(pval, it)) { ------------------ | Branch (71:11): [True: 0, False: 140k] ------------------ 72| 0| goto memerr; 73| 0| } 74| 140k| break; 75| | 76| 140k| case ASN1_ITYPE_CHOICE: { ------------------ | | 422| 0|#define ASN1_ITYPE_CHOICE 0x2 ------------------ | Branch (76:5): [True: 0, False: 3.87M] ------------------ 77| 0| const ASN1_AUX *aux = reinterpret_cast(it->funcs); 78| 0| ASN1_aux_cb *asn1_cb = aux != NULL ? aux->asn1_cb : NULL; ------------------ | Branch (78:30): [True: 0, False: 0] ------------------ 79| 0| if (asn1_cb) { ------------------ | Branch (79:11): [True: 0, False: 0] ------------------ 80| 0| i = asn1_cb(ASN1_OP_NEW_PRE, pval, it, NULL); ------------------ | | 468| 0|#define ASN1_OP_NEW_PRE 0 ------------------ 81| 0| if (!i) { ------------------ | Branch (81:13): [True: 0, False: 0] ------------------ 82| 0| goto auxerr; 83| 0| } 84| 0| if (i == 2) { ------------------ | Branch (84:13): [True: 0, False: 0] ------------------ 85| 0| return 1; 86| 0| } 87| 0| } 88| 0| *pval = reinterpret_cast(OPENSSL_zalloc(it->size)); 89| 0| if (!*pval) { ------------------ | Branch (89:11): [True: 0, False: 0] ------------------ 90| 0| goto memerr; 91| 0| } 92| 0| asn1_set_choice_selector(pval, -1, it); 93| 0| if (asn1_cb && !asn1_cb(ASN1_OP_NEW_POST, pval, it, NULL)) { ------------------ | | 469| 0|#define ASN1_OP_NEW_POST 1 ------------------ | Branch (93:11): [True: 0, False: 0] | Branch (93:22): [True: 0, False: 0] ------------------ 94| 0| goto auxerr2; 95| 0| } 96| 0| break; 97| 0| } 98| | 99| 1.30M| case ASN1_ITYPE_SEQUENCE: { ------------------ | | 420| 1.30M|#define ASN1_ITYPE_SEQUENCE 0x1 ------------------ | Branch (99:5): [True: 1.30M, False: 2.57M] ------------------ 100| 1.30M| const ASN1_AUX *aux = reinterpret_cast(it->funcs); 101| 1.30M| ASN1_aux_cb *asn1_cb = aux != NULL ? aux->asn1_cb : NULL; ------------------ | Branch (101:30): [True: 140k, False: 1.16M] ------------------ 102| 1.30M| if (asn1_cb) { ------------------ | Branch (102:11): [True: 70.1k, False: 1.23M] ------------------ 103| 70.1k| i = asn1_cb(ASN1_OP_NEW_PRE, pval, it, NULL); ------------------ | | 468| 70.1k|#define ASN1_OP_NEW_PRE 0 ------------------ 104| 70.1k| if (!i) { ------------------ | Branch (104:13): [True: 0, False: 70.1k] ------------------ 105| 0| goto auxerr; 106| 0| } 107| 70.1k| if (i == 2) { ------------------ | Branch (107:13): [True: 0, False: 70.1k] ------------------ 108| 0| return 1; 109| 0| } 110| 70.1k| } 111| 1.30M| *pval = reinterpret_cast(OPENSSL_zalloc(it->size)); 112| 1.30M| if (!*pval) { ------------------ | Branch (112:11): [True: 0, False: 1.30M] ------------------ 113| 0| goto memerr; 114| 0| } 115| 1.30M| asn1_refcount_set_one(pval, it); 116| 1.30M| asn1_enc_init(pval, it); 117| 4.68M| for (i = 0, tt = it->templates; i < it->tcount; tt++, i++) { ------------------ | Branch (117:39): [True: 3.37M, False: 1.30M] ------------------ 118| 3.37M| pseqval = asn1_get_field_ptr(pval, tt); 119| 3.37M| if (!ASN1_template_new(pseqval, tt)) { ------------------ | Branch (119:13): [True: 0, False: 3.37M] ------------------ 120| 0| goto memerr2; 121| 0| } 122| 3.37M| } 123| 1.30M| if (asn1_cb && !asn1_cb(ASN1_OP_NEW_POST, pval, it, NULL)) { ------------------ | | 469| 70.1k|#define ASN1_OP_NEW_POST 1 ------------------ | Branch (123:11): [True: 70.1k, False: 1.23M] | Branch (123:22): [True: 0, False: 70.1k] ------------------ 124| 0| goto auxerr2; 125| 0| } 126| 1.30M| break; 127| 1.30M| } 128| 3.87M| } 129| 3.87M| return 1; 130| | 131| 0|memerr2: 132| 0| ASN1_item_ex_free(pval, it); 133| 0|memerr: 134| 0| return 0; 135| | 136| 0|auxerr2: 137| 0| ASN1_item_ex_free(pval, it); 138| 0|auxerr: 139| 0| OPENSSL_PUT_ERROR(ASN1, ASN1_R_AUX_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 140| 0| return 0; 141| 0|} tasn_new.cc:_ZL17ASN1_template_newPP13ASN1_VALUE_stPK16ASN1_TEMPLATE_st: 168| 3.37M|static int ASN1_template_new(ASN1_VALUE **pval, const ASN1_TEMPLATE *tt) { 169| 3.37M| const ASN1_ITEM *it = ASN1_ITEM_ptr(tt->item); ------------------ | | 241| 3.37M|#define ASN1_ITEM_ptr(iptr) (iptr) ------------------ 170| 3.37M| int ret; 171| 3.37M| if (tt->flags & ASN1_TFLG_OPTIONAL) { ------------------ | | 311| 3.37M|#define ASN1_TFLG_OPTIONAL (0x1) ------------------ | Branch (171:7): [True: 689k, False: 2.68M] ------------------ 172| 689k| asn1_template_clear(pval, tt); 173| 689k| return 1; 174| 689k| } 175| | // If ANY DEFINED BY nothing to do 176| | 177| 2.68M| if (tt->flags & ASN1_TFLG_ADB_MASK) { ------------------ | | 365| 2.68M|#define ASN1_TFLG_ADB_MASK (0x3 << 8) ------------------ | Branch (177:7): [True: 0, False: 2.68M] ------------------ 178| 0| *pval = NULL; 179| 0| return 1; 180| 0| } 181| | // If SET OF or SEQUENCE OF, its a STACK 182| 2.68M| if (tt->flags & ASN1_TFLG_SK_MASK) { ------------------ | | 320| 2.68M|#define ASN1_TFLG_SK_MASK (0x3 << 1) ------------------ | Branch (182:7): [True: 0, False: 2.68M] ------------------ 183| 0| STACK_OF(ASN1_VALUE) *skval; ------------------ | | 39| 0|#define STACK_OF(type) struct stack_st_##type ------------------ 184| 0| skval = sk_ASN1_VALUE_new_null(); 185| 0| if (!skval) { ------------------ | Branch (185:9): [True: 0, False: 0] ------------------ 186| 0| ret = 0; 187| 0| goto done; 188| 0| } 189| 0| *pval = (ASN1_VALUE *)skval; 190| 0| ret = 1; 191| 0| goto done; 192| 0| } 193| | // Otherwise pass it back to the item routine 194| 2.68M| ret = ASN1_item_ex_new(pval, it); 195| 2.68M|done: 196| 2.68M| return ret; 197| 2.68M|} tasn_new.cc:_ZL19asn1_template_clearPP13ASN1_VALUE_stPK16ASN1_TEMPLATE_st: 199| 689k|static void asn1_template_clear(ASN1_VALUE **pval, const ASN1_TEMPLATE *tt) { 200| | // If ADB or STACK just NULL the field 201| 689k| if (tt->flags & (ASN1_TFLG_ADB_MASK | ASN1_TFLG_SK_MASK)) { ------------------ | | 365| 689k|#define ASN1_TFLG_ADB_MASK (0x3 << 8) ------------------ if (tt->flags & (ASN1_TFLG_ADB_MASK | ASN1_TFLG_SK_MASK)) { ------------------ | | 320| 689k|#define ASN1_TFLG_SK_MASK (0x3 << 1) ------------------ | Branch (201:7): [True: 70.1k, False: 619k] ------------------ 202| 70.1k| *pval = NULL; 203| 619k| } else { 204| 619k| asn1_item_clear(pval, ASN1_ITEM_ptr(tt->item)); ------------------ | | 241| 619k|#define ASN1_ITEM_ptr(iptr) (iptr) ------------------ 205| 619k| } 206| 689k|} tasn_new.cc:_ZL15asn1_item_clearPP13ASN1_VALUE_stPK12ASN1_ITEM_st: 143| 619k|static void asn1_item_clear(ASN1_VALUE **pval, const ASN1_ITEM *it) { 144| 619k| switch (it->itype) { ------------------ | Branch (144:11): [True: 0, False: 619k] ------------------ 145| 0| case ASN1_ITYPE_EXTERN: ------------------ | | 424| 0|#define ASN1_ITYPE_EXTERN 0x4 ------------------ | Branch (145:5): [True: 0, False: 619k] ------------------ 146| 0| *pval = NULL; 147| 0| break; 148| | 149| 619k| case ASN1_ITYPE_PRIMITIVE: ------------------ | | 418| 619k|#define ASN1_ITYPE_PRIMITIVE 0x0 ------------------ | Branch (149:5): [True: 619k, False: 0] ------------------ 150| 619k| if (it->templates) { ------------------ | Branch (150:11): [True: 0, False: 619k] ------------------ 151| 0| asn1_template_clear(pval, it->templates); 152| 619k| } else { 153| 619k| asn1_primitive_clear(pval, it); 154| 619k| } 155| 619k| break; 156| | 157| 0| case ASN1_ITYPE_MSTRING: ------------------ | | 426| 0|#define ASN1_ITYPE_MSTRING 0x5 ------------------ | Branch (157:5): [True: 0, False: 619k] ------------------ 158| 0| asn1_primitive_clear(pval, it); 159| 0| break; 160| | 161| 0| case ASN1_ITYPE_CHOICE: ------------------ | | 422| 0|#define ASN1_ITYPE_CHOICE 0x2 ------------------ | Branch (161:5): [True: 0, False: 619k] ------------------ 162| 0| case ASN1_ITYPE_SEQUENCE: ------------------ | | 420| 0|#define ASN1_ITYPE_SEQUENCE 0x1 ------------------ | Branch (162:5): [True: 0, False: 619k] ------------------ 163| 0| *pval = NULL; 164| 0| break; 165| 619k| } 166| 619k|} tasn_new.cc:_ZL20asn1_primitive_clearPP13ASN1_VALUE_stPK12ASN1_ITEM_st: 261| 619k|static void asn1_primitive_clear(ASN1_VALUE **pval, const ASN1_ITEM *it) { 262| 619k| int utype; 263| | // Historically, |it->funcs| for primitive types contained an 264| | // |ASN1_PRIMITIVE_FUNCS| table of calbacks. 265| 619k| assert(it == NULL || it->funcs == NULL); 266| 619k| if (!it || (it->itype == ASN1_ITYPE_MSTRING)) { ------------------ | | 426| 619k|#define ASN1_ITYPE_MSTRING 0x5 ------------------ | Branch (266:7): [True: 0, False: 619k] | Branch (266:14): [True: 0, False: 619k] ------------------ 267| 0| utype = -1; 268| 619k| } else { 269| 619k| utype = it->utype; 270| 619k| } 271| 619k| if (utype == V_ASN1_BOOLEAN) { ------------------ | | 86| 619k|#define V_ASN1_BOOLEAN 1 ------------------ | Branch (271:7): [True: 199k, False: 420k] ------------------ 272| 199k| *(ASN1_BOOLEAN *)pval = (ASN1_BOOLEAN)it->size; 273| 420k| } else { 274| 420k| *pval = NULL; 275| 420k| } 276| 619k|} tasn_new.cc:_ZL18ASN1_primitive_newPP13ASN1_VALUE_stPK12ASN1_ITEM_st: 211| 2.43M|static int ASN1_primitive_new(ASN1_VALUE **pval, const ASN1_ITEM *it) { 212| 2.43M| if (!it) { ------------------ | Branch (212:7): [True: 0, False: 2.43M] ------------------ 213| 0| return 0; 214| 0| } 215| | 216| | // Historically, |it->funcs| for primitive types contained an 217| | // |ASN1_PRIMITIVE_FUNCS| table of calbacks. 218| 2.43M| assert(it->funcs == NULL); 219| | 220| 2.43M| int utype; 221| 2.43M| if (it->itype == ASN1_ITYPE_MSTRING) { ------------------ | | 426| 2.43M|#define ASN1_ITYPE_MSTRING 0x5 ------------------ | Branch (221:7): [True: 140k, False: 2.28M] ------------------ 222| 140k| utype = -1; 223| 2.28M| } else { 224| 2.28M| utype = it->utype; 225| 2.28M| } 226| 2.43M| switch (utype) { 227| 1.09M| case V_ASN1_OBJECT: ------------------ | | 91| 1.09M|#define V_ASN1_OBJECT 6 ------------------ | Branch (227:5): [True: 1.09M, False: 1.33M] ------------------ 228| 1.09M| *pval = (ASN1_VALUE *)OBJ_get_undef(); 229| 1.09M| return 1; 230| | 231| 0| case V_ASN1_BOOLEAN: ------------------ | | 86| 0|#define V_ASN1_BOOLEAN 1 ------------------ | Branch (231:5): [True: 0, False: 2.43M] ------------------ 232| 0| *(ASN1_BOOLEAN *)pval = (ASN1_BOOLEAN)it->size; 233| 0| return 1; 234| | 235| 0| case V_ASN1_NULL: ------------------ | | 90| 0|#define V_ASN1_NULL 5 ------------------ | Branch (235:5): [True: 0, False: 2.43M] ------------------ 236| 0| *pval = (ASN1_VALUE *)1; 237| 0| return 1; 238| | 239| 161k| case V_ASN1_ANY: { ------------------ | | 78| 161k|#define V_ASN1_ANY (-4) ------------------ | Branch (239:5): [True: 161k, False: 2.26M] ------------------ 240| 161k| ASN1_TYPE *typ = 241| 161k| reinterpret_cast(OPENSSL_malloc(sizeof(ASN1_TYPE))); 242| 161k| if (!typ) { ------------------ | Branch (242:11): [True: 0, False: 161k] ------------------ 243| 0| return 0; 244| 0| } 245| 161k| typ->value.ptr = NULL; 246| 161k| typ->type = -1; 247| 161k| *pval = (ASN1_VALUE *)typ; 248| 161k| break; 249| 161k| } 250| | 251| 1.16M| default: ------------------ | Branch (251:5): [True: 1.16M, False: 1.26M] ------------------ 252| 1.16M| *pval = (ASN1_VALUE *)ASN1_STRING_type_new(utype); 253| 1.16M| break; 254| 2.43M| } 255| 1.33M| if (*pval) { ------------------ | Branch (255:7): [True: 1.33M, False: 0] ------------------ 256| 1.33M| return 1; 257| 1.33M| } 258| 0| return 0; 259| 1.33M|} ASN1_OCTET_STRING_free: 26| 70.1k| void sname##_free(sname *x) { ASN1_STRING_free(x); } ASN1_INTEGER_new: 25| 71.6k| sname *sname##_new(void) { return ASN1_STRING_type_new(V_##sname); } \ ASN1_BIT_STRING_new: 25| 71.9k| sname *sname##_new(void) { return ASN1_STRING_type_new(V_##sname); } \ ASN1_BIT_STRING_free: 26| 70.1k| void sname##_free(sname *x) { ASN1_STRING_free(x); } asn1_refcount_set_one: 64| 1.30M|void asn1_refcount_set_one(ASN1_VALUE **pval, const ASN1_ITEM *it) { 65| 1.30M| CRYPTO_refcount_t *references = asn1_get_references(pval, it); 66| 1.30M| if (references != NULL) { ------------------ | Branch (66:7): [True: 0, False: 1.30M] ------------------ 67| 0| *references = 1; 68| 0| } 69| 1.30M|} asn1_refcount_dec_and_test_zero: 71| 1.30M|int asn1_refcount_dec_and_test_zero(ASN1_VALUE **pval, const ASN1_ITEM *it) { 72| 1.30M| CRYPTO_refcount_t *references = asn1_get_references(pval, it); 73| 1.30M| if (references != NULL) { ------------------ | Branch (73:7): [True: 0, False: 1.30M] ------------------ 74| 0| return CRYPTO_refcount_dec_and_test_zero(references); 75| 0| } 76| 1.30M| return 1; 77| 1.30M|} asn1_enc_init: 92| 1.30M|void asn1_enc_init(ASN1_VALUE **pval, const ASN1_ITEM *it) { 93| 1.30M| ASN1_ENCODING *enc = asn1_get_enc_ptr(pval, it); 94| 1.30M| if (enc) { ------------------ | Branch (94:7): [True: 70.1k, False: 1.23M] ------------------ 95| 70.1k| enc->enc = NULL; 96| 70.1k| enc->len = 0; 97| 70.1k| enc->buf = NULL; 98| 70.1k| } 99| 1.30M|} asn1_enc_free: 101| 1.30M|void asn1_enc_free(ASN1_VALUE **pval, const ASN1_ITEM *it) { 102| 1.30M| ASN1_ENCODING *enc = asn1_get_enc_ptr(pval, it); 103| 1.30M| if (enc) { ------------------ | Branch (103:7): [True: 70.1k, False: 1.23M] ------------------ 104| 70.1k| asn1_encoding_clear(enc); 105| 70.1k| } 106| 1.30M|} asn1_enc_save: 109| 960k| const ASN1_ITEM *it, CRYPTO_BUFFER *buf) { 110| 960k| ASN1_ENCODING *enc; 111| 960k| enc = asn1_get_enc_ptr(pval, it); 112| 960k| if (!enc) { ------------------ | Branch (112:7): [True: 891k, False: 69.1k] ------------------ 113| 891k| return 1; 114| 891k| } 115| | 116| 69.1k| asn1_encoding_clear(enc); 117| 69.1k| if (buf != NULL) { ------------------ | Branch (117:7): [True: 69.1k, False: 2] ------------------ 118| 69.1k| assert(CRYPTO_BUFFER_data(buf) <= in && 119| 69.1k| in + in_len <= CRYPTO_BUFFER_data(buf) + CRYPTO_BUFFER_len(buf)); 120| 69.1k| CRYPTO_BUFFER_up_ref(buf); 121| 69.1k| enc->buf = buf; 122| 69.1k| enc->enc = (uint8_t *)in; 123| 69.1k| } else { 124| 2| enc->enc = reinterpret_cast(OPENSSL_memdup(in, in_len)); 125| 2| if (!enc->enc) { ------------------ | Branch (125:9): [True: 0, False: 2] ------------------ 126| 0| return 0; 127| 0| } 128| 2| } 129| | 130| 69.1k| enc->len = in_len; 131| 69.1k| return 1; 132| 69.1k|} asn1_encoding_clear: 134| 139k|void asn1_encoding_clear(ASN1_ENCODING *enc) { 135| 139k| if (enc->buf != NULL) { ------------------ | Branch (135:7): [True: 69.1k, False: 70.1k] ------------------ 136| 69.1k| CRYPTO_BUFFER_free(enc->buf); 137| 70.1k| } else { 138| 70.1k| OPENSSL_free(enc->enc); 139| 70.1k| } 140| 139k| enc->enc = NULL; 141| 139k| enc->len = 0; 142| 139k| enc->buf = NULL; 143| 139k|} asn1_enc_restore: 146| 1.38M| const ASN1_ITEM *it) { 147| 1.38M| ASN1_ENCODING *enc = asn1_get_enc_ptr(pval, it); 148| 1.38M| if (!enc || enc->len == 0) { ------------------ | Branch (148:7): [True: 1.38M, False: 4] | Branch (148:15): [True: 0, False: 4] ------------------ 149| 1.38M| return 0; 150| 1.38M| } 151| 4| if (out) { ------------------ | Branch (151:7): [True: 2, False: 2] ------------------ 152| 2| OPENSSL_memcpy(*out, enc->enc, enc->len); 153| 2| *out += enc->len; 154| 2| } 155| 4| if (len) { ------------------ | Branch (155:7): [True: 4, False: 0] ------------------ 156| 4| *len = enc->len; 157| 4| } 158| 4| return 1; 159| 1.38M|} asn1_get_field_ptr: 162| 13.2M|ASN1_VALUE **asn1_get_field_ptr(ASN1_VALUE **pval, const ASN1_TEMPLATE *tt) { 163| 13.2M| ASN1_VALUE **pvaltmp = 164| 13.2M| reinterpret_cast(offset2ptr(*pval, tt->offset)); ------------------ | | 33| 13.2M|#define offset2ptr(addr, offset) (void *)(((char *)(addr)) + (offset)) ------------------ 165| | // NOTE for BOOLEAN types the field is just a plain int so we can't return 166| | // int **, so settle for (int *). 167| 13.2M| return pvaltmp; 168| 13.2M|} asn1_do_adb: 173| 9.83M| int nullerr) { 174| 9.83M| const ASN1_ADB *adb; 175| 9.83M| const ASN1_ADB_TABLE *atbl; 176| 9.83M| ASN1_VALUE **sfld; 177| 9.83M| int i; 178| 9.83M| if (!(tt->flags & ASN1_TFLG_ADB_MASK)) { ------------------ | | 365| 9.83M|#define ASN1_TFLG_ADB_MASK (0x3 << 8) ------------------ | Branch (178:7): [True: 9.83M, False: 0] ------------------ 179| 9.83M| return tt; 180| 9.83M| } 181| | 182| | // Else ANY DEFINED BY ... get the table 183| 0| adb = ASN1_ADB_ptr(tt->item); ------------------ | | 37| 0|#define ASN1_ADB_ptr(iptr) ((const ASN1_ADB *)(iptr)) ------------------ 184| | 185| | // Get the selector field 186| 0| sfld = reinterpret_cast(offset2ptr(*pval, adb->offset)); ------------------ | | 33| 0|#define offset2ptr(addr, offset) (void *)(((char *)(addr)) + (offset)) ------------------ 187| | 188| | // Check if NULL 189| 0| int selector; 190| 0| if (*sfld == NULL) { ------------------ | Branch (190:7): [True: 0, False: 0] ------------------ 191| 0| if (!adb->null_tt) { ------------------ | Branch (191:9): [True: 0, False: 0] ------------------ 192| 0| goto err; 193| 0| } 194| 0| return adb->null_tt; 195| 0| } 196| | 197| | // Convert type to a NID: 198| | // NB: don't check for NID_undef here because it 199| | // might be a legitimate value in the table 200| 0| assert(tt->flags & ASN1_TFLG_ADB_OID); 201| 0| selector = OBJ_obj2nid((ASN1_OBJECT *)*sfld); 202| | 203| | // Try to find matching entry in table Maybe should check application types 204| | // first to allow application override? Might also be useful to have a flag 205| | // which indicates table is sorted and we can do a binary search. For now 206| | // stick to a linear search. 207| | 208| 0| for (atbl = adb->tbl, i = 0; i < adb->tblcount; i++, atbl++) { ------------------ | Branch (208:32): [True: 0, False: 0] ------------------ 209| 0| if (atbl->value == selector) { ------------------ | Branch (209:9): [True: 0, False: 0] ------------------ 210| 0| return &atbl->tt; 211| 0| } 212| 0| } 213| | 214| | // FIXME: need to search application table too 215| | 216| | // No match, return default type 217| 0| if (!adb->default_tt) { ------------------ | Branch (217:7): [True: 0, False: 0] ------------------ 218| 0| goto err; 219| 0| } 220| 0| return adb->default_tt; 221| | 222| 0|err: 223| | // FIXME: should log the value or OID of unsupported type 224| 0| if (nullerr) { ------------------ | Branch (224:7): [True: 0, False: 0] ------------------ 225| 0| OPENSSL_PUT_ERROR(ASN1, ASN1_R_UNSUPPORTED_ANY_DEFINED_BY_TYPE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 226| 0| } 227| 0| return NULL; 228| 0|} tasn_utl.cc:_ZL19asn1_get_referencesPP13ASN1_VALUE_stPK12ASN1_ITEM_st: 52| 2.61M| const ASN1_ITEM *it) { 53| 2.61M| if (it->itype != ASN1_ITYPE_SEQUENCE) { ------------------ | | 420| 2.61M|#define ASN1_ITYPE_SEQUENCE 0x1 ------------------ | Branch (53:7): [True: 0, False: 2.61M] ------------------ 54| 0| return NULL; 55| 0| } 56| 2.61M| const ASN1_AUX *aux = reinterpret_cast(it->funcs); 57| 2.61M| if (!aux || !(aux->flags & ASN1_AFLG_REFCOUNT)) { ------------------ | | 462| 280k|#define ASN1_AFLG_REFCOUNT 1 ------------------ | Branch (57:7): [True: 2.33M, False: 280k] | Branch (57:15): [True: 280k, False: 0] ------------------ 58| 2.61M| return NULL; 59| 2.61M| } 60| 0| return reinterpret_cast( 61| 0| offset2ptr(*pval, aux->ref_offset)); ------------------ | | 33| 0|#define offset2ptr(addr, offset) (void *)(((char *)(addr)) + (offset)) ------------------ 62| 2.61M|} tasn_utl.cc:_ZL16asn1_get_enc_ptrPP13ASN1_VALUE_stPK12ASN1_ITEM_st: 79| 4.96M|static ASN1_ENCODING *asn1_get_enc_ptr(ASN1_VALUE **pval, const ASN1_ITEM *it) { 80| 4.96M| assert(it->itype == ASN1_ITYPE_SEQUENCE); 81| 4.96M| const ASN1_AUX *aux; 82| 4.96M| if (!pval || !*pval) { ------------------ | Branch (82:7): [True: 0, False: 4.96M] | Branch (82:16): [True: 0, False: 4.96M] ------------------ 83| 0| return NULL; 84| 0| } 85| 4.96M| aux = reinterpret_cast(it->funcs); 86| 4.96M| if (!aux || !(aux->flags & ASN1_AFLG_ENCODING)) { ------------------ | | 464| 557k|#define ASN1_AFLG_ENCODING 2 ------------------ | Branch (86:7): [True: 4.40M, False: 557k] | Branch (86:15): [True: 348k, False: 209k] ------------------ 87| 4.75M| return NULL; 88| 4.75M| } 89| 209k| return reinterpret_cast(offset2ptr(*pval, aux->enc_offset)); ------------------ | | 33| 209k|#define offset2ptr(addr, offset) (void *)(((char *)(addr)) + (offset)) ------------------ 90| 4.96M|} BIO_new: 33| 10.3k|BIO *BIO_new(const BIO_METHOD *method) { 34| 10.3k| BIO *ret = reinterpret_cast(OPENSSL_zalloc(sizeof(BIO))); 35| 10.3k| if (ret == NULL) { ------------------ | Branch (35:7): [True: 0, False: 10.3k] ------------------ 36| 0| return NULL; 37| 0| } 38| | 39| 10.3k| ret->method = method; 40| 10.3k| ret->shutdown = 1; 41| 10.3k| ret->references = 1; 42| 10.3k| CRYPTO_new_ex_data(&ret->ex_data); 43| | 44| 10.3k| if (method->create != NULL && !method->create(ret)) { ------------------ | Branch (44:7): [True: 5.18k, False: 5.18k] | Branch (44:33): [True: 0, False: 5.18k] ------------------ 45| 0| OPENSSL_free(ret); 46| 0| return NULL; 47| 0| } 48| | 49| 10.3k| return ret; 50| 10.3k|} BIO_free: 52| 10.3k|int BIO_free(BIO *bio) { 53| 10.3k| BIO *next_bio; 54| | 55| 20.7k| for (; bio != NULL; bio = next_bio) { ------------------ | Branch (55:10): [True: 10.3k, False: 10.3k] ------------------ 56| 10.3k| if (!CRYPTO_refcount_dec_and_test_zero(&bio->references)) { ------------------ | Branch (56:9): [True: 0, False: 10.3k] ------------------ 57| 0| return 0; 58| 0| } 59| | 60| 10.3k| next_bio = BIO_pop(bio); 61| | 62| 10.3k| if (bio->method != NULL && bio->method->destroy != NULL) { ------------------ | Branch (62:9): [True: 10.3k, False: 0] | Branch (62:32): [True: 10.3k, False: 0] ------------------ 63| 10.3k| bio->method->destroy(bio); 64| 10.3k| } 65| | 66| 10.3k| CRYPTO_free_ex_data(&g_ex_data_class, &bio->ex_data); 67| 10.3k| OPENSSL_free(bio); 68| 10.3k| } 69| 10.3k| return 1; 70| 10.3k|} BIO_read: 81| 954k|int BIO_read(BIO *bio, void *buf, int len) { 82| 954k| if (bio == NULL || bio->method == NULL || bio->method->bread == NULL) { ------------------ | Branch (82:7): [True: 0, False: 954k] | Branch (82:22): [True: 0, False: 954k] | Branch (82:45): [True: 0, False: 954k] ------------------ 83| 0| OPENSSL_PUT_ERROR(BIO, BIO_R_UNSUPPORTED_METHOD); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 84| 0| return -2; 85| 0| } 86| 954k| if (!bio->init) { ------------------ | Branch (86:7): [True: 0, False: 954k] ------------------ 87| 0| OPENSSL_PUT_ERROR(BIO, BIO_R_UNINITIALIZED); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 88| 0| return -2; 89| 0| } 90| 954k| if (len <= 0) { ------------------ | Branch (90:7): [True: 0, False: 954k] ------------------ 91| 0| return 0; 92| 0| } 93| 954k| int ret = bio->method->bread(bio, reinterpret_cast(buf), len); 94| 954k| if (ret > 0) { ------------------ | Branch (94:7): [True: 952k, False: 2.30k] ------------------ 95| 952k| bio->num_read += ret; 96| 952k| } 97| 954k| return ret; 98| 954k|} BIO_write: 119| 111k|int BIO_write(BIO *bio, const void *in, int inl) { 120| 111k| if (bio == NULL || bio->method == NULL || bio->method->bwrite == NULL) { ------------------ | Branch (120:7): [True: 0, False: 111k] | Branch (120:22): [True: 0, False: 111k] | Branch (120:45): [True: 0, False: 111k] ------------------ 121| 0| OPENSSL_PUT_ERROR(BIO, BIO_R_UNSUPPORTED_METHOD); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 122| 0| return -2; 123| 0| } 124| 111k| if (!bio->init) { ------------------ | Branch (124:7): [True: 0, False: 111k] ------------------ 125| 0| OPENSSL_PUT_ERROR(BIO, BIO_R_UNINITIALIZED); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 126| 0| return -2; 127| 0| } 128| 111k| if (inl <= 0) { ------------------ | Branch (128:7): [True: 0, False: 111k] ------------------ 129| 0| return 0; 130| 0| } 131| 111k| int ret = bio->method->bwrite(bio, reinterpret_cast(in), inl); 132| 111k| if (ret > 0) { ------------------ | Branch (132:7): [True: 111k, False: 0] ------------------ 133| 111k| bio->num_write += ret; 134| 111k| } 135| 111k| return ret; 136| 111k|} BIO_flush: 161| 111k|int BIO_flush(BIO *bio) { return (int)BIO_ctrl(bio, BIO_CTRL_FLUSH, 0, NULL); } ------------------ | | 743| 111k|#define BIO_CTRL_FLUSH 11 ------------------ BIO_ctrl: 163| 111k|long BIO_ctrl(BIO *bio, int cmd, long larg, void *parg) { 164| 111k| if (bio == NULL) { ------------------ | Branch (164:7): [True: 0, False: 111k] ------------------ 165| 0| return 0; 166| 0| } 167| | 168| 111k| if (bio->method == NULL || bio->method->ctrl == NULL) { ------------------ | Branch (168:7): [True: 0, False: 111k] | Branch (168:30): [True: 0, False: 111k] ------------------ 169| 0| OPENSSL_PUT_ERROR(BIO, BIO_R_UNSUPPORTED_METHOD); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 170| 0| return -2; 171| 0| } 172| | 173| 111k| return bio->method->ctrl(bio, cmd, larg, parg); 174| 111k|} BIO_clear_retry_flags: 234| 111k|void BIO_clear_retry_flags(BIO *bio) { 235| 111k| bio->flags &= ~kRetryFlags; 236| 111k| bio->retry_reason = 0; 237| 111k|} BIO_pop: 310| 10.3k|BIO *BIO_pop(BIO *bio) { 311| 10.3k| BIO *ret; 312| | 313| 10.3k| if (bio == NULL) { ------------------ | Branch (313:7): [True: 0, False: 10.3k] ------------------ 314| 0| return NULL; 315| 0| } 316| 10.3k| ret = bio->next_bio; 317| 10.3k| bio->next_bio = NULL; 318| 10.3k| return ret; 319| 10.3k|} BIO_meth_new: 581| 1|BIO_METHOD *BIO_meth_new(int type, const char *name) { 582| 1| BIO_METHOD *method = 583| 1| reinterpret_cast(OPENSSL_zalloc(sizeof(BIO_METHOD))); 584| 1| if (method == NULL) { ------------------ | Branch (584:7): [True: 0, False: 1] ------------------ 585| 0| return NULL; 586| 0| } 587| 1| method->type = type; 588| 1| method->name = name; 589| 1| return method; 590| 1|} BIO_meth_set_destroy: 599| 1|int BIO_meth_set_destroy(BIO_METHOD *method, int (*destroy_func)(BIO *)) { 600| 1| method->destroy = destroy_func; 601| 1| return 1; 602| 1|} BIO_meth_set_read: 611| 1| int (*read_func)(BIO *, char *, int)) { 612| 1| method->bread = read_func; 613| 1| return 1; 614| 1|} BIO_set_data: 635| 5.18k|void BIO_set_data(BIO *bio, void *ptr) { bio->ptr = ptr; } BIO_get_data: 637| 959k|void *BIO_get_data(BIO *bio) { return bio->ptr; } BIO_set_init: 639| 5.18k|void BIO_set_init(BIO *bio, int init) { bio->init = init; } BIO_s_mem: 229| 5.18k|const BIO_METHOD *BIO_s_mem(void) { return &mem_method; } bio_mem.cc:_ZL9mem_writeP6bio_stPKci: 120| 111k|static int mem_write(BIO *bio, const char *in, int inl) { 121| 111k| BIO_clear_retry_flags(bio); 122| 111k| if (inl <= 0) { ------------------ | Branch (122:7): [True: 0, False: 111k] ------------------ 123| 0| return 0; // Successfully write zero bytes. 124| 0| } 125| | 126| 111k| if (bio->flags & BIO_FLAGS_MEM_RDONLY) { ------------------ | | 861| 111k|#define BIO_FLAGS_MEM_RDONLY 0x200 ------------------ | Branch (126:7): [True: 0, False: 111k] ------------------ 127| 0| OPENSSL_PUT_ERROR(BIO, BIO_R_WRITE_TO_READ_ONLY_BIO); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 128| 0| return -1; 129| 0| } 130| | 131| 111k| BUF_MEM *b = reinterpret_cast(bio->ptr); 132| 111k| if (!BUF_MEM_append(b, in, inl)) { ------------------ | Branch (132:7): [True: 0, False: 111k] ------------------ 133| 0| return -1; 134| 0| } 135| | 136| 111k| return inl; 137| 111k|} bio_mem.cc:_ZL8mem_ctrlP6bio_stilPv: 167| 111k|static long mem_ctrl(BIO *bio, int cmd, long num, void *ptr) { 168| 111k| BUF_MEM *b = static_cast(bio->ptr); 169| 111k| switch (cmd) { 170| 0| case BIO_CTRL_RESET: ------------------ | | 721| 0|#define BIO_CTRL_RESET 1 ------------------ | Branch (170:5): [True: 0, False: 111k] ------------------ 171| 0| if (b->data != NULL) { ------------------ | Branch (171:11): [True: 0, False: 0] ------------------ 172| | // For read only case reset to the start again 173| 0| if (bio->flags & BIO_FLAGS_MEM_RDONLY) { ------------------ | | 861| 0|#define BIO_FLAGS_MEM_RDONLY 0x200 ------------------ | Branch (173:13): [True: 0, False: 0] ------------------ 174| 0| b->data -= b->max - b->length; 175| 0| b->length = b->max; 176| 0| } else { 177| 0| OPENSSL_memset(b->data, 0, b->max); 178| 0| b->length = 0; 179| 0| } 180| 0| } 181| 0| return 1; 182| 0| case BIO_CTRL_EOF: ------------------ | | 724| 0|#define BIO_CTRL_EOF 2 ------------------ | Branch (182:5): [True: 0, False: 111k] ------------------ 183| 0| return b->length == 0; 184| 0| case BIO_C_SET_BUF_MEM_EOF_RETURN: ------------------ | | 923| 0|#define BIO_C_SET_BUF_MEM_EOF_RETURN 130 // return end of input value ------------------ | Branch (184:5): [True: 0, False: 111k] ------------------ 185| 0| bio->num = static_cast(num); 186| 0| return 1; 187| 0| case BIO_CTRL_INFO: ------------------ | | 729| 0|#define BIO_CTRL_INFO 3 ------------------ | Branch (187:5): [True: 0, False: 111k] ------------------ 188| 0| if (ptr != nullptr) { ------------------ | Branch (188:11): [True: 0, False: 0] ------------------ 189| 0| char **out = reinterpret_cast(ptr); 190| 0| *out = b->data; 191| 0| } 192| | // This API can overflow on 64-bit Windows, where |long| is smaller than 193| | // |ptrdiff_t|. |BIO_mem_contents| is the overflow-safe API. 194| 0| return static_cast(b->length); 195| 0| case BIO_C_SET_BUF_MEM: ------------------ | | 911| 0|#define BIO_C_SET_BUF_MEM 114 ------------------ | Branch (195:5): [True: 0, False: 111k] ------------------ 196| 0| mem_free(bio); 197| 0| bio->shutdown = static_cast(num); 198| 0| bio->ptr = ptr; 199| 0| return 1; 200| 0| case BIO_C_GET_BUF_MEM_PTR: ------------------ | | 912| 0|#define BIO_C_GET_BUF_MEM_PTR 115 ------------------ | Branch (200:5): [True: 0, False: 111k] ------------------ 201| 0| if (ptr != NULL) { ------------------ | Branch (201:11): [True: 0, False: 0] ------------------ 202| 0| BUF_MEM **out = reinterpret_cast(ptr); 203| 0| *out = b; 204| 0| } 205| 0| return 1; 206| 0| case BIO_CTRL_GET_CLOSE: ------------------ | | 733| 0|#define BIO_CTRL_GET_CLOSE 8 ------------------ | Branch (206:5): [True: 0, False: 111k] ------------------ 207| 0| return bio->shutdown; 208| 0| case BIO_CTRL_SET_CLOSE: ------------------ | | 737| 0|#define BIO_CTRL_SET_CLOSE 9 ------------------ | Branch (208:5): [True: 0, False: 111k] ------------------ 209| 0| bio->shutdown = static_cast(num); 210| 0| return 1; 211| 0| case BIO_CTRL_WPENDING: ------------------ | | 746| 0|#define BIO_CTRL_WPENDING 13 ------------------ | Branch (211:5): [True: 0, False: 111k] ------------------ 212| 0| return 0; 213| 0| case BIO_CTRL_PENDING: ------------------ | | 740| 0|#define BIO_CTRL_PENDING 10 ------------------ | Branch (213:5): [True: 0, False: 111k] ------------------ 214| | // TODO(crbug.com/412584975): This can overflow on 64-bit Windows. 215| 0| return static_cast(b->length); 216| 111k| case BIO_CTRL_FLUSH: ------------------ | | 743| 111k|#define BIO_CTRL_FLUSH 11 ------------------ | Branch (216:5): [True: 111k, False: 0] ------------------ 217| 111k| return 1; 218| 0| default: ------------------ | Branch (218:5): [True: 0, False: 111k] ------------------ 219| 0| return 0; 220| 111k| } 221| 111k|} bio_mem.cc:_ZL7mem_newP6bio_st: 59| 5.18k|static int mem_new(BIO *bio) { 60| 5.18k| BUF_MEM *b; 61| | 62| 5.18k| b = BUF_MEM_new(); 63| 5.18k| if (b == NULL) { ------------------ | Branch (63:7): [True: 0, False: 5.18k] ------------------ 64| 0| return 0; 65| 0| } 66| | 67| | // |shutdown| is used to store the close flag: whether the BIO has ownership 68| | // of the BUF_MEM. 69| 5.18k| bio->shutdown = 1; 70| 5.18k| bio->init = 1; 71| 5.18k| bio->num = -1; 72| 5.18k| bio->ptr = (char *)b; 73| | 74| 5.18k| return 1; 75| 5.18k|} bio_mem.cc:_ZL8mem_freeP6bio_st: 77| 5.18k|static int mem_free(BIO *bio) { 78| 5.18k| if (!bio->shutdown || !bio->init || bio->ptr == NULL) { ------------------ | Branch (78:7): [True: 0, False: 5.18k] | Branch (78:25): [True: 0, False: 5.18k] | Branch (78:39): [True: 0, False: 5.18k] ------------------ 79| 0| return 1; 80| 0| } 81| | 82| 5.18k| BUF_MEM *b = (BUF_MEM *)bio->ptr; 83| 5.18k| if (bio->flags & BIO_FLAGS_MEM_RDONLY) { ------------------ | | 861| 5.18k|#define BIO_FLAGS_MEM_RDONLY 0x200 ------------------ | Branch (83:7): [True: 0, False: 5.18k] ------------------ 84| 0| b->data = NULL; 85| 0| } 86| 5.18k| BUF_MEM_free(b); 87| 5.18k| bio->ptr = NULL; 88| 5.18k| return 1; 89| 5.18k|} BN_parse_asn1_unsigned: 21| 185k|int BN_parse_asn1_unsigned(CBS *cbs, BIGNUM *ret) { 22| 185k| CBS child; 23| 185k| int is_negative; 24| 185k| if (!CBS_get_asn1(cbs, &child, CBS_ASN1_INTEGER) || ------------------ | | 216| 185k|#define CBS_ASN1_INTEGER 0x2u ------------------ | Branch (24:7): [True: 5.48k, False: 179k] ------------------ 25| 185k| !CBS_is_valid_asn1_integer(&child, &is_negative)) { ------------------ | Branch (25:7): [True: 1.94k, False: 177k] ------------------ 26| 7.43k| OPENSSL_PUT_ERROR(BN, BN_R_BAD_ENCODING); ------------------ | | 361| 7.43k| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 27| 7.43k| return 0; 28| 7.43k| } 29| | 30| 177k| if (is_negative) { ------------------ | Branch (30:7): [True: 39, False: 177k] ------------------ 31| 39| OPENSSL_PUT_ERROR(BN, BN_R_NEGATIVE_NUMBER); ------------------ | | 361| 39| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 32| 39| return 0; 33| 39| } 34| | 35| 177k| return BN_bin2bn(CBS_data(&child), CBS_len(&child), ret) != NULL; 36| 177k|} BN_marshal_asn1: 38| 13.7k|int BN_marshal_asn1(CBB *cbb, const BIGNUM *bn) { 39| | // Negative numbers are unsupported. 40| 13.7k| if (BN_is_negative(bn)) { ------------------ | Branch (40:7): [True: 0, False: 13.7k] ------------------ 41| 0| OPENSSL_PUT_ERROR(BN, BN_R_NEGATIVE_NUMBER); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 42| 0| return 0; 43| 0| } 44| | 45| 13.7k| CBB child; 46| 13.7k| if (!CBB_add_asn1(cbb, &child, CBS_ASN1_INTEGER) || ------------------ | | 216| 13.7k|#define CBS_ASN1_INTEGER 0x2u ------------------ | Branch (46:7): [True: 0, False: 13.7k] ------------------ 47| | // The number must be padded with a leading zero if the high bit would 48| | // otherwise be set or if |bn| is zero. 49| 13.7k| (BN_num_bits(bn) % 8 == 0 && !CBB_add_u8(&child, 0x00)) || ------------------ | Branch (49:8): [True: 10.9k, False: 2.77k] | Branch (49:36): [True: 0, False: 10.9k] ------------------ 50| 13.7k| !BN_bn2cbb_padded(&child, BN_num_bytes(bn), bn) || ------------------ | Branch (50:7): [True: 0, False: 13.7k] ------------------ 51| 13.7k| !CBB_flush(cbb)) { ------------------ | Branch (51:7): [True: 0, False: 13.7k] ------------------ 52| 0| OPENSSL_PUT_ERROR(BN, BN_R_ENCODE_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 53| 0| return 0; 54| 0| } 55| | 56| 13.7k| return 1; 57| 13.7k|} BN_bn2cbb_padded: 32| 14.1k|int BN_bn2cbb_padded(CBB *out, size_t len, const BIGNUM *in) { 33| 14.1k| uint8_t *ptr; 34| 14.1k| return CBB_add_space(out, &ptr, len) && BN_bn2bin_padded(ptr, len, in); ------------------ | Branch (34:10): [True: 14.1k, False: 0] | Branch (34:43): [True: 14.1k, False: 0] ------------------ 35| 14.1k|} BUF_MEM_new: 25| 676k|BUF_MEM *BUF_MEM_new(void) { 26| 676k| return reinterpret_cast(OPENSSL_zalloc(sizeof(BUF_MEM))); 27| 676k|} BUF_MEM_free: 29| 676k|void BUF_MEM_free(BUF_MEM *buf) { 30| 676k| if (buf == nullptr) { ------------------ | Branch (30:7): [True: 0, False: 676k] ------------------ 31| 0| return; 32| 0| } 33| 676k| OPENSSL_free(buf->data); 34| 676k| OPENSSL_free(buf); 35| 676k|} BUF_MEM_reserve: 37| 1.44M|int BUF_MEM_reserve(BUF_MEM *buf, size_t cap) { 38| 1.44M| if (buf->max >= cap) { ------------------ | Branch (38:7): [True: 678k, False: 768k] ------------------ 39| 678k| return 1; 40| 678k| } 41| | 42| 768k| size_t n = cap + 3; 43| 768k| if (n < cap) { ------------------ | Branch (43:7): [True: 0, False: 768k] ------------------ 44| 0| OPENSSL_PUT_ERROR(BUF, ERR_R_OVERFLOW); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 45| 0| return 0; 46| 0| } 47| 768k| n = n / 3; 48| 768k| size_t alloc_size = n * 4; 49| 768k| if (alloc_size / 4 != n) { ------------------ | Branch (49:7): [True: 0, False: 768k] ------------------ 50| 0| OPENSSL_PUT_ERROR(BUF, ERR_R_OVERFLOW); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 51| 0| return 0; 52| 0| } 53| | 54| 768k| char *new_buf = 55| 768k| reinterpret_cast(OPENSSL_realloc(buf->data, alloc_size)); 56| 768k| if (new_buf == NULL) { ------------------ | Branch (56:7): [True: 0, False: 768k] ------------------ 57| 0| return 0; 58| 0| } 59| | 60| 768k| buf->data = new_buf; 61| 768k| buf->max = alloc_size; 62| 768k| return 1; 63| 768k|} BUF_MEM_grow: 65| 139k|size_t BUF_MEM_grow(BUF_MEM *buf, size_t len) { 66| 139k| if (!BUF_MEM_reserve(buf, len)) { ------------------ | Branch (66:7): [True: 0, False: 139k] ------------------ 67| 0| return 0; 68| 0| } 69| 139k| if (buf->length < len) { ------------------ | Branch (69:7): [True: 139k, False: 0] ------------------ 70| 139k| OPENSSL_memset(&buf->data[buf->length], 0, len - buf->length); 71| 139k| } 72| 139k| buf->length = len; 73| 139k| return len; 74| 139k|} BUF_MEM_append: 80| 1.10M|int BUF_MEM_append(BUF_MEM *buf, const void *in, size_t len) { 81| | // Work around a C language bug. See https://crbug.com/1019588. 82| 1.10M| if (len == 0) { ------------------ | Branch (82:7): [True: 7.85k, False: 1.09M] ------------------ 83| 7.85k| return 1; 84| 7.85k| } 85| 1.09M| size_t new_len = buf->length + len; 86| 1.09M| if (new_len < len) { ------------------ | Branch (86:7): [True: 0, False: 1.09M] ------------------ 87| 0| OPENSSL_PUT_ERROR(BUF, ERR_R_OVERFLOW); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 88| 0| return 0; 89| 0| } 90| 1.09M| if (!BUF_MEM_reserve(buf, new_len)) { ------------------ | Branch (90:7): [True: 0, False: 1.09M] ------------------ 91| 0| return 0; 92| 0| } 93| 1.09M| OPENSSL_memcpy(buf->data + buf->length, in, len); 94| 1.09M| buf->length = new_len; 95| 1.09M| return 1; 96| 1.09M|} CBB_finish_i2d: 28| 2|int CBB_finish_i2d(CBB *cbb, uint8_t **outp) { 29| 2| assert(!cbb->is_child); 30| 2| assert(cbb->u.base.can_resize); 31| | 32| 2| uint8_t *der; 33| 2| size_t der_len; 34| 2| if (!CBB_finish(cbb, &der, &der_len)) { ------------------ | Branch (34:7): [True: 0, False: 2] ------------------ 35| 0| CBB_cleanup(cbb); 36| 0| return -1; 37| 0| } 38| 2| if (der_len > INT_MAX) { ------------------ | Branch (38:7): [True: 0, False: 2] ------------------ 39| 0| OPENSSL_free(der); 40| 0| return -1; 41| 0| } 42| 2| if (outp != NULL) { ------------------ | Branch (42:7): [True: 2, False: 0] ------------------ 43| 2| if (*outp == NULL) { ------------------ | Branch (43:9): [True: 2, False: 0] ------------------ 44| 2| *outp = der; 45| 2| der = NULL; 46| 2| } else { 47| 0| OPENSSL_memcpy(*outp, der, der_len); 48| 0| *outp += der_len; 49| 0| } 50| 2| } 51| 2| OPENSSL_free(der); 52| 2| return (int)der_len; 53| 2|} CBB_zero: 27| 2.95M|void CBB_zero(CBB *cbb) { OPENSSL_memset(cbb, 0, sizeof(CBB)); } CBB_init: 39| 485k|int CBB_init(CBB *cbb, size_t initial_capacity) { 40| 485k| CBB_zero(cbb); 41| | 42| 485k| uint8_t *buf = reinterpret_cast(OPENSSL_malloc(initial_capacity)); 43| 485k| if (initial_capacity > 0 && buf == NULL) { ------------------ | Branch (43:7): [True: 478k, False: 6.87k] | Branch (43:31): [True: 0, False: 478k] ------------------ 44| 0| return 0; 45| 0| } 46| | 47| 485k| cbb_init(cbb, buf, initial_capacity, /*can_resize=*/1); 48| 485k| return 1; 49| 485k|} CBB_init_fixed: 51| 56.3k|int CBB_init_fixed(CBB *cbb, uint8_t *buf, size_t len) { 52| 56.3k| CBB_zero(cbb); 53| 56.3k| cbb_init(cbb, buf, len, /*can_resize=*/0); 54| 56.3k| return 1; 55| 56.3k|} CBB_cleanup: 57| 810k|void CBB_cleanup(CBB *cbb) { 58| | // Child |CBB|s are non-owning. They are implicitly discarded and should not 59| | // be used with |CBB_cleanup| or |ScopedCBB|. 60| 810k| assert(!cbb->is_child); 61| 810k| if (cbb->is_child) { ------------------ | Branch (61:7): [True: 0, False: 810k] ------------------ 62| 0| return; 63| 0| } 64| | 65| 810k| if (cbb->u.base.can_resize) { ------------------ | Branch (65:7): [True: 810k, False: 0] ------------------ 66| 810k| OPENSSL_free(cbb->u.base.buf); 67| 810k| } 68| 810k|} CBB_finish: 124| 485k|int CBB_finish(CBB *cbb, uint8_t **out_data, size_t *out_len) { 125| 485k| if (cbb->is_child) { ------------------ | Branch (125:7): [True: 0, False: 485k] ------------------ 126| 0| OPENSSL_PUT_ERROR(CRYPTO, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 127| 0| return 0; 128| 0| } 129| | 130| 485k| if (!CBB_flush(cbb)) { ------------------ | Branch (130:7): [True: 0, False: 485k] ------------------ 131| 0| return 0; 132| 0| } 133| | 134| 485k| if (cbb->u.base.can_resize && (out_data == NULL || out_len == NULL)) { ------------------ | Branch (134:7): [True: 485k, False: 0] | Branch (134:34): [True: 0, False: 485k] | Branch (134:54): [True: 0, False: 485k] ------------------ 135| | // |out_data| and |out_len| can only be NULL if the CBB is fixed. 136| 0| return 0; 137| 0| } 138| | 139| 485k| if (out_data != NULL) { ------------------ | Branch (139:7): [True: 485k, False: 0] ------------------ 140| 485k| *out_data = cbb->u.base.buf; 141| 485k| } 142| 485k| if (out_len != NULL) { ------------------ | Branch (142:7): [True: 485k, False: 0] ------------------ 143| 485k| *out_len = cbb->u.base.len; 144| 485k| } 145| 485k| cbb->u.base.buf = NULL; 146| 485k| CBB_cleanup(cbb); 147| 485k| return 1; 148| 485k|} CBB_flush: 183| 10.4M|int CBB_flush(CBB *cbb) { 184| | // If |base| has hit an error, the buffer is in an undefined state, so 185| | // fail all following calls. In particular, |cbb->child| may point to invalid 186| | // memory. 187| 10.4M| struct cbb_buffer_st *base = cbb_get_base(cbb); 188| 10.4M| if (base == NULL || base->error) { ------------------ | Branch (188:7): [True: 0, False: 10.4M] | Branch (188:23): [True: 0, False: 10.4M] ------------------ 189| 0| return 0; 190| 0| } 191| | 192| 10.4M| if (cbb->child == NULL) { ------------------ | Branch (192:7): [True: 8.75M, False: 1.74M] ------------------ 193| | // Nothing to flush. 194| 8.75M| return 1; 195| 8.75M| } 196| | 197| 1.74M| assert(cbb->child->is_child); 198| 1.74M| struct cbb_child_st *child = &cbb->child->u.child; 199| 1.74M| assert(child->base == base); 200| 1.74M| size_t child_start = child->offset + child->pending_len_len; 201| | 202| 1.74M| size_t len; 203| 1.74M| if (!CBB_flush(cbb->child) || child_start < child->offset || ------------------ | Branch (203:7): [True: 0, False: 1.74M] | Branch (203:33): [True: 0, False: 1.74M] ------------------ 204| 1.74M| base->len < child_start) { ------------------ | Branch (204:7): [True: 0, False: 1.74M] ------------------ 205| 0| goto err; 206| 0| } 207| | 208| 1.74M| len = base->len - child_start; 209| | 210| 1.74M| if (child->pending_is_asn1) { ------------------ | Branch (210:7): [True: 20.6k, False: 1.72M] ------------------ 211| | // For ASN.1 we assume that we'll only need a single byte for the length. 212| | // If that turned out to be incorrect, we have to move the contents along 213| | // in order to make space. 214| 20.6k| uint8_t len_len; 215| 20.6k| uint8_t initial_length_byte; 216| | 217| 20.6k| assert(child->pending_len_len == 1); 218| | 219| 20.6k| if (len > 0xfffffffe) { ------------------ | Branch (219:9): [True: 0, False: 20.6k] ------------------ 220| 0| OPENSSL_PUT_ERROR(CRYPTO, ERR_R_OVERFLOW); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 221| | // Too large. 222| 0| goto err; 223| 20.6k| } else if (len > 0xffffff) { ------------------ | Branch (223:16): [True: 0, False: 20.6k] ------------------ 224| 0| len_len = 5; 225| 0| initial_length_byte = 0x80 | 4; 226| 20.6k| } else if (len > 0xffff) { ------------------ | Branch (226:16): [True: 0, False: 20.6k] ------------------ 227| 0| len_len = 4; 228| 0| initial_length_byte = 0x80 | 3; 229| 20.6k| } else if (len > 0xff) { ------------------ | Branch (229:16): [True: 44, False: 20.6k] ------------------ 230| 44| len_len = 3; 231| 44| initial_length_byte = 0x80 | 2; 232| 20.6k| } else if (len > 0x7f) { ------------------ | Branch (232:16): [True: 7, False: 20.6k] ------------------ 233| 7| len_len = 2; 234| 7| initial_length_byte = 0x80 | 1; 235| 20.6k| } else { 236| 20.6k| len_len = 1; 237| 20.6k| initial_length_byte = (uint8_t)len; 238| 20.6k| len = 0; 239| 20.6k| } 240| | 241| 20.6k| if (len_len != 1) { ------------------ | Branch (241:9): [True: 51, False: 20.6k] ------------------ 242| | // We need to move the contents along in order to make space. 243| 51| size_t extra_bytes = len_len - 1; 244| 51| if (!cbb_buffer_add(base, NULL, extra_bytes)) { ------------------ | Branch (244:11): [True: 0, False: 51] ------------------ 245| 0| goto err; 246| 0| } 247| 51| OPENSSL_memmove(base->buf + child_start + extra_bytes, 248| 51| base->buf + child_start, len); 249| 51| } 250| 20.6k| base->buf[child->offset++] = initial_length_byte; 251| 20.6k| child->pending_len_len = len_len - 1; 252| 20.6k| } 253| | 254| 5.13M| for (size_t i = child->pending_len_len - 1; i < child->pending_len_len; i--) { ------------------ | Branch (254:47): [True: 3.38M, False: 1.74M] ------------------ 255| 3.38M| base->buf[child->offset + i] = (uint8_t)len; 256| 3.38M| len >>= 8; 257| 3.38M| } 258| 1.74M| if (len != 0) { ------------------ | Branch (258:7): [True: 0, False: 1.74M] ------------------ 259| 0| OPENSSL_PUT_ERROR(CRYPTO, ERR_R_OVERFLOW); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 260| 0| goto err; 261| 0| } 262| | 263| 1.74M| child->base = NULL; 264| 1.74M| cbb->child = NULL; 265| | 266| 1.74M| return 1; 267| | 268| 0|err: 269| 0| cbb_on_error(cbb); 270| 0| return 0; 271| 1.74M|} CBB_len: 282| 3.44M|size_t CBB_len(const CBB *cbb) { 283| 3.44M| assert(cbb->child == NULL); 284| 3.44M| if (cbb->is_child) { ------------------ | Branch (284:7): [True: 3.44M, False: 0] ------------------ 285| 3.44M| assert(cbb->u.child.offset + cbb->u.child.pending_len_len <= 286| 3.44M| cbb->u.child.base->len); 287| 3.44M| return cbb->u.child.base->len - cbb->u.child.offset - 288| 3.44M| cbb->u.child.pending_len_len; 289| 3.44M| } 290| 0| return cbb->u.base.len; 291| 3.44M|} CBB_add_u8_length_prefixed: 326| 341k|int CBB_add_u8_length_prefixed(CBB *cbb, CBB *out_contents) { 327| 341k| return cbb_add_length_prefixed(cbb, out_contents, 1); 328| 341k|} CBB_add_u16_length_prefixed: 330| 1.11M|int CBB_add_u16_length_prefixed(CBB *cbb, CBB *out_contents) { 331| 1.11M| return cbb_add_length_prefixed(cbb, out_contents, 2); 332| 1.11M|} CBB_add_u24_length_prefixed: 334| 273k|int CBB_add_u24_length_prefixed(CBB *cbb, CBB *out_contents) { 335| 273k| return cbb_add_length_prefixed(cbb, out_contents, 3); 336| 273k|} CBB_add_asn1: 364| 20.6k|int CBB_add_asn1(CBB *cbb, CBB *out_contents, CBS_ASN1_TAG tag) { 365| 20.6k| if (!CBB_flush(cbb)) { ------------------ | Branch (365:7): [True: 0, False: 20.6k] ------------------ 366| 0| return 0; 367| 0| } 368| | 369| | // Split the tag into leading bits and tag number. 370| 20.6k| uint8_t tag_bits = (tag >> CBS_ASN1_TAG_SHIFT) & 0xe0; ------------------ | | 194| 20.6k|#define CBS_ASN1_TAG_SHIFT 24 ------------------ 371| 20.6k| CBS_ASN1_TAG tag_number = tag & CBS_ASN1_TAG_NUMBER_MASK; ------------------ | | 211| 20.6k|#define CBS_ASN1_TAG_NUMBER_MASK ((1u << (5 + CBS_ASN1_TAG_SHIFT)) - 1) | | ------------------ | | | | 194| 20.6k|#define CBS_ASN1_TAG_SHIFT 24 | | ------------------ ------------------ 372| 20.6k| if (tag_number >= 0x1f) { ------------------ | Branch (372:7): [True: 0, False: 20.6k] ------------------ 373| | // Set all the bits in the tag number to signal high tag number form. 374| 0| if (!CBB_add_u8(cbb, tag_bits | 0x1f) || ------------------ | Branch (374:9): [True: 0, False: 0] ------------------ 375| 0| !add_base128_integer(cbb, tag_number)) { ------------------ | Branch (375:9): [True: 0, False: 0] ------------------ 376| 0| return 0; 377| 0| } 378| 20.6k| } else if (!CBB_add_u8(cbb, tag_bits | tag_number)) { ------------------ | Branch (378:14): [True: 0, False: 20.6k] ------------------ 379| 0| return 0; 380| 0| } 381| | 382| | // Reserve one byte of length prefix. |CBB_flush| will finish it later. 383| 20.6k| return cbb_add_child(cbb, out_contents, /*len_len=*/1, /*is_asn1=*/1); 384| 20.6k|} CBB_add_bytes: 386| 787k|int CBB_add_bytes(CBB *cbb, const uint8_t *data, size_t len) { 387| 787k| uint8_t *out; 388| 787k| if (!CBB_add_space(cbb, &out, len)) { ------------------ | Branch (388:7): [True: 0, False: 787k] ------------------ 389| 0| return 0; 390| 0| } 391| 787k| OPENSSL_memcpy(out, data, len); 392| 787k| return 1; 393| 787k|} CBB_add_zeros: 395| 47|int CBB_add_zeros(CBB *cbb, size_t len) { 396| 47| uint8_t *out; 397| 47| if (!CBB_add_space(cbb, &out, len)) { ------------------ | Branch (397:7): [True: 0, False: 47] ------------------ 398| 0| return 0; 399| 0| } 400| 47| OPENSSL_memset(out, 0, len); 401| 47| return 1; 402| 47|} CBB_add_space: 404| 5.73M|int CBB_add_space(CBB *cbb, uint8_t **out_data, size_t len) { 405| 5.73M| if (!CBB_flush(cbb) || !cbb_buffer_add(cbb_get_base(cbb), out_data, len)) { ------------------ | Branch (405:7): [True: 0, False: 5.73M] | Branch (405:26): [True: 0, False: 5.73M] ------------------ 406| 0| return 0; 407| 0| } 408| 5.73M| return 1; 409| 5.73M|} CBB_reserve: 411| 29.7k|int CBB_reserve(CBB *cbb, uint8_t **out_data, size_t len) { 412| 29.7k| if (!CBB_flush(cbb) || ------------------ | Branch (412:7): [True: 0, False: 29.7k] ------------------ 413| 29.7k| !cbb_buffer_reserve(cbb_get_base(cbb), out_data, len)) { ------------------ | Branch (413:7): [True: 0, False: 29.7k] ------------------ 414| 0| return 0; 415| 0| } 416| 29.7k| return 1; 417| 29.7k|} CBB_did_write: 419| 29.7k|int CBB_did_write(CBB *cbb, size_t len) { 420| 29.7k| struct cbb_buffer_st *base = cbb_get_base(cbb); 421| 29.7k| size_t newlen = base->len + len; 422| 29.7k| if (cbb->child != NULL || newlen < base->len || newlen > base->cap) { ------------------ | Branch (422:7): [True: 0, False: 29.7k] | Branch (422:29): [True: 0, False: 29.7k] | Branch (422:51): [True: 0, False: 29.7k] ------------------ 423| 0| return 0; 424| 0| } 425| 29.7k| base->len = newlen; 426| 29.7k| return 1; 427| 29.7k|} CBB_add_u8: 449| 1.52M|int CBB_add_u8(CBB *cbb, uint8_t value) { return cbb_add_u(cbb, value, 1); } CBB_add_u16: 451| 3.32M|int CBB_add_u16(CBB *cbb, uint16_t value) { return cbb_add_u(cbb, value, 2); } CBB_add_u32: 459| 47|int CBB_add_u32(CBB *cbb, uint32_t value) { return cbb_add_u(cbb, value, 4); } CBB_add_asn1_element: 492| 10| size_t data_len) { 493| 10| CBB child; 494| 10| if (!CBB_add_asn1(cbb, &child, tag) || ------------------ | Branch (494:7): [True: 0, False: 10] ------------------ 495| 10| !CBB_add_bytes(&child, data, data_len) || // ------------------ | Branch (495:7): [True: 0, False: 10] ------------------ 496| 10| !CBB_flush(cbb)) { ------------------ | Branch (496:7): [True: 0, False: 10] ------------------ 497| 0| cbb_on_error(cbb); 498| 0| return 0; 499| 0| } 500| | 501| 10| return 1; 502| 10|} cbb.cc:_ZL8cbb_initP6cbb_stPhmi: 29| 542k|static void cbb_init(CBB *cbb, uint8_t *buf, size_t cap, int can_resize) { 30| 542k| cbb->is_child = 0; 31| 542k| cbb->child = NULL; 32| 542k| cbb->u.base.buf = buf; 33| 542k| cbb->u.base.len = 0; 34| 542k| cbb->u.base.cap = cap; 35| 542k| cbb->u.base.can_resize = can_resize; 36| 542k| cbb->u.base.error = 0; 37| 542k|} cbb.cc:_ZL12cbb_get_baseP6cbb_st: 150| 18.0M|static struct cbb_buffer_st *cbb_get_base(CBB *cbb) { 151| 18.0M| if (cbb->is_child) { ------------------ | Branch (151:7): [True: 13.7M, False: 4.27M] ------------------ 152| 13.7M| return cbb->u.child.base; 153| 13.7M| } 154| 4.27M| return &cbb->u.base; 155| 18.0M|} cbb.cc:_ZL14cbb_buffer_addP13cbb_buffer_stPPhm: 115| 7.48M| size_t len) { 116| 7.48M| if (!cbb_buffer_reserve(base, out, len)) { ------------------ | Branch (116:7): [True: 0, False: 7.48M] ------------------ 117| 0| return 0; 118| 0| } 119| | // This will not overflow or |cbb_buffer_reserve| would have failed. 120| 7.48M| base->len += len; 121| 7.48M| return 1; 122| 7.48M|} cbb.cc:_ZL23cbb_add_length_prefixedP6cbb_stS0_h: 318| 1.72M| uint8_t len_len) { 319| 1.72M| if (!CBB_flush(cbb)) { ------------------ | Branch (319:7): [True: 0, False: 1.72M] ------------------ 320| 0| return 0; 321| 0| } 322| | 323| 1.72M| return cbb_add_child(cbb, out_contents, len_len, /*is_asn1=*/0); 324| 1.72M|} cbb.cc:_ZL13cbb_add_childP6cbb_stS0_hi: 294| 1.74M| int is_asn1) { 295| 1.74M| assert(cbb->child == NULL); 296| 1.74M| assert(!is_asn1 || len_len == 1); 297| 1.74M| struct cbb_buffer_st *base = cbb_get_base(cbb); 298| 1.74M| size_t offset = base->len; 299| | 300| | // Reserve space for the length prefix. 301| 1.74M| uint8_t *prefix_bytes; 302| 1.74M| if (!cbb_buffer_add(base, &prefix_bytes, len_len)) { ------------------ | Branch (302:7): [True: 0, False: 1.74M] ------------------ 303| 0| return 0; 304| 0| } 305| 1.74M| OPENSSL_memset(prefix_bytes, 0, len_len); 306| | 307| 1.74M| CBB_zero(out_child); 308| 1.74M| out_child->is_child = 1; 309| 1.74M| out_child->u.child.base = base; 310| 1.74M| out_child->u.child.offset = offset; 311| 1.74M| out_child->u.child.pending_len_len = len_len; 312| 1.74M| out_child->u.child.pending_is_asn1 = is_asn1; 313| 1.74M| cbb->child = out_child; 314| 1.74M| return 1; 315| 1.74M|} cbb.cc:_ZL18cbb_buffer_reserveP13cbb_buffer_stPPhm: 71| 7.50M| size_t len) { 72| 7.50M| if (base == NULL) { ------------------ | Branch (72:7): [True: 0, False: 7.50M] ------------------ 73| 0| return 0; 74| 0| } 75| | 76| 7.50M| size_t newlen = base->len + len; 77| 7.50M| if (newlen < base->len) { ------------------ | Branch (77:7): [True: 0, False: 7.50M] ------------------ 78| | // Overflow 79| 0| OPENSSL_PUT_ERROR(CRYPTO, ERR_R_OVERFLOW); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 80| 0| goto err; 81| 0| } 82| | 83| 7.50M| if (newlen > base->cap) { ------------------ | Branch (83:7): [True: 467k, False: 7.04M] ------------------ 84| 467k| if (!base->can_resize) { ------------------ | Branch (84:9): [True: 0, False: 467k] ------------------ 85| 0| OPENSSL_PUT_ERROR(CRYPTO, ERR_R_OVERFLOW); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 86| 0| goto err; 87| 0| } 88| | 89| 467k| size_t newcap = base->cap * 2; 90| 467k| if (newcap < base->cap || newcap < newlen) { ------------------ | Branch (90:9): [True: 0, False: 467k] | Branch (90:31): [True: 184k, False: 282k] ------------------ 91| 184k| newcap = newlen; 92| 184k| } 93| 467k| uint8_t *newbuf = 94| 467k| reinterpret_cast(OPENSSL_realloc(base->buf, newcap)); 95| 467k| if (newbuf == NULL) { ------------------ | Branch (95:9): [True: 0, False: 467k] ------------------ 96| 0| goto err; 97| 0| } 98| | 99| 467k| base->buf = newbuf; 100| 467k| base->cap = newcap; 101| 467k| } 102| | 103| 7.50M| if (out) { ------------------ | Branch (103:7): [True: 7.50M, False: 51] ------------------ 104| 7.50M| *out = base->buf + base->len; 105| 7.50M| } 106| | 107| 7.50M| return 1; 108| | 109| 0|err: 110| 0| base->error = 1; 111| 0| return 0; 112| 7.50M|} cbb.cc:_ZL9cbb_add_uP6cbb_stmm: 429| 4.84M|static int cbb_add_u(CBB *cbb, uint64_t v, size_t len_len) { 430| 4.84M| uint8_t *buf; 431| 4.84M| if (!CBB_add_space(cbb, &buf, len_len)) { ------------------ | Branch (431:7): [True: 0, False: 4.84M] ------------------ 432| 0| return 0; 433| 0| } 434| | 435| 13.0M| for (size_t i = len_len - 1; i < len_len; i--) { ------------------ | Branch (435:32): [True: 8.16M, False: 4.84M] ------------------ 436| 8.16M| buf[i] = v; 437| 8.16M| v >>= 8; 438| 8.16M| } 439| | 440| | // |v| must fit in |len_len| bytes. 441| 4.84M| if (v != 0) { ------------------ | Branch (441:7): [True: 0, False: 4.84M] ------------------ 442| 0| cbb_on_error(cbb); 443| 0| return 0; 444| 0| } 445| | 446| 4.84M| return 1; 447| 4.84M|} CBS_skip: 40| 8.44M|int CBS_skip(CBS *cbs, size_t len) { 41| 8.44M| const uint8_t *dummy; 42| 8.44M| return cbs_get(cbs, &dummy, len); 43| 8.44M|} CBS_strdup: 61| 861|int CBS_strdup(const CBS *cbs, char **out_ptr) { 62| 861| if (*out_ptr != NULL) { ------------------ | Branch (62:7): [True: 0, False: 861] ------------------ 63| 0| OPENSSL_free(*out_ptr); 64| 0| } 65| 861| *out_ptr = OPENSSL_strndup((const char *)cbs->data, cbs->len); 66| 861| return (*out_ptr != NULL); 67| 861|} CBS_contains_zero_byte: 69| 862|int CBS_contains_zero_byte(const CBS *cbs) { 70| 862| return OPENSSL_memchr(cbs->data, 0, cbs->len) != NULL; 71| 862|} CBS_mem_equal: 73| 137k|int CBS_mem_equal(const CBS *cbs, const uint8_t *data, size_t len) { 74| 137k| if (len != cbs->len) { ------------------ | Branch (74:7): [True: 32.3k, False: 104k] ------------------ 75| 32.3k| return 0; 76| 32.3k| } 77| 104k| return CRYPTO_memcmp(cbs->data, data, len) == 0; 78| 137k|} CBS_get_u8: 95| 34.9M|int CBS_get_u8(CBS *cbs, uint8_t *out) { 96| 34.9M| const uint8_t *v; 97| 34.9M| if (!cbs_get(cbs, &v, 1)) { ------------------ | Branch (97:7): [True: 3.19M, False: 31.7M] ------------------ 98| 3.19M| return 0; 99| 3.19M| } 100| 31.7M| *out = *v; 101| 31.7M| return 1; 102| 34.9M|} CBS_get_u16: 104| 2.90M|int CBS_get_u16(CBS *cbs, uint16_t *out) { 105| 2.90M| uint64_t v; 106| 2.90M| if (!cbs_get_u(cbs, &v, 2)) { ------------------ | Branch (106:7): [True: 1.82k, False: 2.90M] ------------------ 107| 1.82k| return 0; 108| 1.82k| } 109| 2.90M| *out = v; 110| 2.90M| return 1; 111| 2.90M|} CBS_get_u24: 121| 1.00M|int CBS_get_u24(CBS *cbs, uint32_t *out) { 122| 1.00M| uint64_t v; 123| 1.00M| if (!cbs_get_u(cbs, &v, 3)) { ------------------ | Branch (123:7): [True: 5.18k, False: 1.00M] ------------------ 124| 5.18k| return 0; 125| 5.18k| } 126| 1.00M| *out = (uint32_t)v; 127| 1.00M| return 1; 128| 1.00M|} CBS_get_u32: 130| 57.4k|int CBS_get_u32(CBS *cbs, uint32_t *out) { 131| 57.4k| uint64_t v; 132| 57.4k| if (!cbs_get_u(cbs, &v, 4)) { ------------------ | Branch (132:7): [True: 9, False: 57.4k] ------------------ 133| 9| return 0; 134| 9| } 135| 57.4k| *out = (uint32_t)v; 136| 57.4k| return 1; 137| 57.4k|} CBS_get_last_u8: 157| 5|int CBS_get_last_u8(CBS *cbs, uint8_t *out) { 158| 5| if (cbs->len == 0) { ------------------ | Branch (158:7): [True: 0, False: 5] ------------------ 159| 0| return 0; 160| 0| } 161| 5| *out = cbs->data[cbs->len - 1]; 162| 5| cbs->len--; 163| 5| return 1; 164| 5|} CBS_get_bytes: 166| 10.8M|int CBS_get_bytes(CBS *cbs, CBS *out, size_t len) { 167| 10.8M| const uint8_t *v; 168| 10.8M| if (!cbs_get(cbs, &v, len)) { ------------------ | Branch (168:7): [True: 533k, False: 10.2M] ------------------ 169| 533k| return 0; 170| 533k| } 171| 10.2M| CBS_init(out, v, len); 172| 10.2M| return 1; 173| 10.8M|} CBS_get_u8_length_prefixed: 195| 155k|int CBS_get_u8_length_prefixed(CBS *cbs, CBS *out) { 196| 155k| return cbs_get_length_prefixed(cbs, out, 1); 197| 155k|} CBS_get_u16_length_prefixed: 199| 871k|int CBS_get_u16_length_prefixed(CBS *cbs, CBS *out) { 200| 871k| return cbs_get_length_prefixed(cbs, out, 2); 201| 871k|} CBS_get_u24_length_prefixed: 203| 149k|int CBS_get_u24_length_prefixed(CBS *cbs, CBS *out) { 204| 149k| return cbs_get_length_prefixed(cbs, out, 3); 205| 149k|} CBS_get_any_asn1: 407| 4.44M|int CBS_get_any_asn1(CBS *cbs, CBS *out, CBS_ASN1_TAG *out_tag) { 408| 4.44M| size_t header_len; 409| 4.44M| if (!CBS_get_any_asn1_element(cbs, out, out_tag, &header_len)) { ------------------ | Branch (409:7): [True: 253, False: 4.44M] ------------------ 410| 253| return 0; 411| 253| } 412| | 413| 4.44M| if (out && !CBS_skip(out, header_len)) { ------------------ | Branch (413:7): [True: 4.44M, False: 0] | Branch (413:14): [True: 0, False: 4.44M] ------------------ 414| 0| assert(0); 415| 0| return 0; 416| 0| } 417| | 418| 4.44M| return 1; 419| 4.44M|} CBS_get_any_asn1_element: 422| 7.53M| size_t *out_header_len) { 423| 7.53M| return cbs_get_any_asn1_element(cbs, out, out_tag, out_header_len, NULL, NULL, 424| 7.53M| /*ber_ok=*/0); 425| 7.53M|} CBS_get_any_ber_asn1_element: 429| 70.2k| int *out_indefinite) { 430| 70.2k| int ber_found_temp; 431| 70.2k| return cbs_get_any_asn1_element( 432| 70.2k| cbs, out, out_tag, out_header_len, 433| 70.2k| out_ber_found ? out_ber_found : &ber_found_temp, out_indefinite, ------------------ | Branch (433:7): [True: 0, False: 70.2k] ------------------ 434| 70.2k| /*ber_ok=*/1); 435| 70.2k|} CBS_get_asn1: 460| 2.94M|int CBS_get_asn1(CBS *cbs, CBS *out, CBS_ASN1_TAG tag_value) { 461| 2.94M| return cbs_get_asn1(cbs, out, tag_value, 1 /* skip header */); 462| 2.94M|} CBS_get_asn1_element: 464| 140k|int CBS_get_asn1_element(CBS *cbs, CBS *out, CBS_ASN1_TAG tag_value) { 465| 140k| return cbs_get_asn1(cbs, out, tag_value, 0 /* include header */); 466| 140k|} CBS_peek_asn1_tag: 468| 1.02M|int CBS_peek_asn1_tag(const CBS *cbs, CBS_ASN1_TAG tag_value) { 469| 1.02M| CBS copy = *cbs; 470| 1.02M| CBS_ASN1_TAG actual_tag; 471| 1.02M| return parse_asn1_tag(©, &actual_tag) && tag_value == actual_tag; ------------------ | Branch (471:10): [True: 758k, False: 266k] | Branch (471:48): [True: 319k, False: 438k] ------------------ 472| 1.02M|} CBS_get_asn1_uint64: 474| 118k|int CBS_get_asn1_uint64(CBS *cbs, uint64_t *out) { 475| 118k| return CBS_get_asn1_uint64_with_tag(cbs, out, CBS_ASN1_INTEGER); ------------------ | | 216| 118k|#define CBS_ASN1_INTEGER 0x2u ------------------ 476| 118k|} CBS_get_asn1_uint64_with_tag: 478| 118k|int CBS_get_asn1_uint64_with_tag(CBS *cbs, uint64_t *out, CBS_ASN1_TAG tag) { 479| 118k| CBS bytes; 480| 118k| if (!CBS_get_asn1(cbs, &bytes, tag) || ------------------ | Branch (480:7): [True: 961, False: 117k] ------------------ 481| 118k| !CBS_is_unsigned_asn1_integer(&bytes)) { ------------------ | Branch (481:7): [True: 743, False: 116k] ------------------ 482| 1.70k| return 0; 483| 1.70k| } 484| | 485| 116k| *out = 0; 486| 116k| const uint8_t *data = CBS_data(&bytes); 487| 116k| size_t len = CBS_len(&bytes); 488| 333k| for (size_t i = 0; i < len; i++) { ------------------ | Branch (488:22): [True: 216k, False: 116k] ------------------ 489| 216k| if ((*out >> 56) != 0) { ------------------ | Branch (489:9): [True: 106, False: 216k] ------------------ 490| | // Too large to represent as a uint64_t. 491| 106| return 0; 492| 106| } 493| 216k| *out <<= 8; 494| 216k| *out |= data[i]; 495| 216k| } 496| | 497| 116k| return 1; 498| 116k|} CBS_get_optional_asn1: 539| 807k| CBS_ASN1_TAG tag) { 540| 807k| int present = 0; 541| | 542| 807k| if (CBS_peek_asn1_tag(cbs, tag)) { ------------------ | Branch (542:7): [True: 287k, False: 519k] ------------------ 543| 287k| if (!CBS_get_asn1(cbs, out, tag)) { ------------------ | Branch (543:9): [True: 2.46k, False: 285k] ------------------ 544| 2.46k| return 0; 545| 2.46k| } 546| 285k| present = 1; 547| 285k| } 548| | 549| 804k| if (out_present != NULL) { ------------------ | Branch (549:7): [True: 573k, False: 231k] ------------------ 550| 573k| *out_present = present; 551| 573k| } 552| | 553| 804k| return 1; 554| 807k|} CBS_get_optional_asn1_octet_string: 557| 178k| CBS_ASN1_TAG tag) { 558| 178k| CBS child; 559| 178k| int present; 560| 178k| if (!CBS_get_optional_asn1(cbs, &child, &present, tag)) { ------------------ | Branch (560:7): [True: 10, False: 178k] ------------------ 561| 10| return 0; 562| 10| } 563| 178k| if (present) { ------------------ | Branch (563:7): [True: 42.3k, False: 136k] ------------------ 564| 42.3k| assert(out); 565| 42.3k| if (!CBS_get_asn1(&child, out, CBS_ASN1_OCTETSTRING) || ------------------ | | 218| 42.3k|#define CBS_ASN1_OCTETSTRING 0x4u ------------------ | Branch (565:9): [True: 30, False: 42.3k] ------------------ 566| 42.3k| CBS_len(&child) != 0) { ------------------ | Branch (566:9): [True: 3, False: 42.3k] ------------------ 567| 33| return 0; 568| 33| } 569| 136k| } else { 570| 136k| CBS_init(out, NULL, 0); 571| 136k| } 572| 178k| if (out_present) { ------------------ | Branch (572:7): [True: 79.3k, False: 99.5k] ------------------ 573| 79.3k| *out_present = present; 574| 79.3k| } 575| 178k| return 1; 576| 178k|} CBS_get_optional_asn1_uint64: 579| 119k| uint64_t default_value) { 580| 119k| CBS child; 581| 119k| int present; 582| 119k| if (!CBS_get_optional_asn1(cbs, &child, &present, tag)) { ------------------ | Branch (582:7): [True: 10, False: 119k] ------------------ 583| 10| return 0; 584| 10| } 585| 119k| if (present) { ------------------ | Branch (585:7): [True: 31.2k, False: 88.2k] ------------------ 586| 31.2k| if (!CBS_get_asn1_uint64(&child, out) || CBS_len(&child) != 0) { ------------------ | Branch (586:9): [True: 3, False: 31.2k] | Branch (586:46): [True: 2, False: 31.2k] ------------------ 587| 5| return 0; 588| 5| } 589| 88.2k| } else { 590| 88.2k| *out = default_value; 591| 88.2k| } 592| 119k| return 1; 593| 119k|} CBS_get_optional_asn1_bool: 596| 79.3k| int default_value) { 597| 79.3k| CBS child, child2; 598| 79.3k| int present; 599| 79.3k| if (!CBS_get_optional_asn1(cbs, &child, &present, tag)) { ------------------ | Branch (599:7): [True: 4, False: 79.3k] ------------------ 600| 4| return 0; 601| 4| } 602| 79.3k| if (present) { ------------------ | Branch (602:7): [True: 26.3k, False: 52.9k] ------------------ 603| 26.3k| uint8_t boolean; 604| | 605| 26.3k| if (!CBS_get_asn1(&child, &child2, CBS_ASN1_BOOLEAN) || ------------------ | | 215| 26.3k|#define CBS_ASN1_BOOLEAN 0x1u ------------------ | Branch (605:9): [True: 47, False: 26.3k] ------------------ 606| 26.3k| CBS_len(&child2) != 1 || CBS_len(&child) != 0) { ------------------ | Branch (606:9): [True: 11, False: 26.3k] | Branch (606:34): [True: 1, False: 26.3k] ------------------ 607| 59| return 0; 608| 59| } 609| | 610| 26.3k| boolean = CBS_data(&child2)[0]; 611| 26.3k| if (boolean == 0) { ------------------ | Branch (611:9): [True: 10.1k, False: 16.1k] ------------------ 612| 10.1k| *out = 0; 613| 16.1k| } else if (boolean == 0xff) { ------------------ | Branch (613:16): [True: 16.1k, False: 10] ------------------ 614| 16.1k| *out = 1; 615| 16.1k| } else { 616| 10| return 0; 617| 10| } 618| 52.9k| } else { 619| 52.9k| *out = default_value; 620| 52.9k| } 621| 79.2k| return 1; 622| 79.3k|} CBS_is_valid_asn1_bitstring: 624| 9|int CBS_is_valid_asn1_bitstring(const CBS *cbs) { 625| 9| CBS in = *cbs; 626| 9| uint8_t num_unused_bits; 627| 9| if (!CBS_get_u8(&in, &num_unused_bits) || num_unused_bits > 7) { ------------------ | Branch (627:7): [True: 1, False: 8] | Branch (627:45): [True: 1, False: 7] ------------------ 628| 2| return 0; 629| 2| } 630| | 631| 7| if (num_unused_bits == 0) { ------------------ | Branch (631:7): [True: 2, False: 5] ------------------ 632| 2| return 1; 633| 2| } 634| | 635| | // All num_unused_bits bits must exist and be zeros. 636| 5| uint8_t last; 637| 5| if (!CBS_get_last_u8(&in, &last) || ------------------ | Branch (637:7): [True: 0, False: 5] ------------------ 638| 5| (last & ((1 << num_unused_bits) - 1)) != 0) { ------------------ | Branch (638:7): [True: 1, False: 4] ------------------ 639| 1| return 0; 640| 1| } 641| | 642| 4| return 1; 643| 5|} CBS_asn1_bitstring_has_bit: 645| 3|int CBS_asn1_bitstring_has_bit(const CBS *cbs, unsigned bit) { 646| 3| if (!CBS_is_valid_asn1_bitstring(cbs)) { ------------------ | Branch (646:7): [True: 0, False: 3] ------------------ 647| 0| return 0; 648| 0| } 649| | 650| 3| const unsigned byte_num = (bit >> 3) + 1; 651| 3| const unsigned bit_num = 7 - (bit & 7); 652| | 653| | // Unused bits are zero, and this function does not distinguish between 654| | // missing and unset bits. Thus it is sufficient to do a byte-level length 655| | // check. 656| 3| return byte_num < CBS_len(cbs) && ------------------ | Branch (656:10): [True: 3, False: 0] ------------------ 657| 3| (CBS_data(cbs)[byte_num] & (1 << bit_num)) != 0; ------------------ | Branch (657:10): [True: 2, False: 1] ------------------ 658| 3|} CBS_is_valid_asn1_integer: 660| 451k|int CBS_is_valid_asn1_integer(const CBS *cbs, int *out_is_negative) { 661| 451k| CBS copy = *cbs; 662| 451k| uint8_t first_byte, second_byte; 663| 451k| if (!CBS_get_u8(©, &first_byte)) { ------------------ | Branch (663:7): [True: 1.66k, False: 450k] ------------------ 664| 1.66k| return 0; // INTEGERs may not be empty. 665| 1.66k| } 666| 450k| if (out_is_negative != NULL) { ------------------ | Branch (666:7): [True: 450k, False: 0] ------------------ 667| 450k| *out_is_negative = (first_byte & 0x80) != 0; 668| 450k| } 669| 450k| if (!CBS_get_u8(©, &second_byte)) { ------------------ | Branch (669:7): [True: 110k, False: 339k] ------------------ 670| 110k| return 1; // One byte INTEGERs are always minimal. 671| 110k| } 672| 339k| if ((first_byte == 0x00 && (second_byte & 0x80) == 0) || ------------------ | Branch (672:8): [True: 153k, False: 186k] | Branch (672:30): [True: 573, False: 153k] ------------------ 673| 339k| (first_byte == 0xff && (second_byte & 0x80) != 0)) { ------------------ | Branch (673:8): [True: 4.79k, False: 334k] | Branch (673:30): [True: 373, False: 4.42k] ------------------ 674| 946| return 0; // The value is minimal iff the first 9 bits are not all equal. 675| 946| } 676| 338k| return 1; 677| 339k|} CBS_is_unsigned_asn1_integer: 679| 117k|int CBS_is_unsigned_asn1_integer(const CBS *cbs) { 680| 117k| int is_negative; 681| 117k| return CBS_is_valid_asn1_integer(cbs, &is_negative) && !is_negative; ------------------ | Branch (681:10): [True: 116k, False: 655] | Branch (681:58): [True: 116k, False: 88] ------------------ 682| 117k|} CBS_is_valid_asn1_oid: 690| 770k|int CBS_is_valid_asn1_oid(const CBS *cbs) { 691| 770k| if (CBS_len(cbs) == 0) { ------------------ | Branch (691:7): [True: 2, False: 770k] ------------------ 692| 2| return 0; // OID encodings cannot be empty. 693| 2| } 694| | 695| 770k| CBS copy = *cbs; 696| 770k| uint8_t v, prev = 0; 697| 4.28M| while (CBS_get_u8(©, &v)) { ------------------ | Branch (697:10): [True: 3.51M, False: 770k] ------------------ 698| | // OID encodings are a sequence of minimally-encoded base-128 integers (see 699| | // |parse_base128_integer|). If |prev|'s MSB was clear, it was the last byte 700| | // of an integer (or |v| is the first byte). |v| is then the first byte of 701| | // the next integer. If first byte of an integer is 0x80, it is not 702| | // minimally-encoded. 703| 3.51M| if ((prev & 0x80) == 0 && v == 0x80) { ------------------ | Branch (703:9): [True: 2.92M, False: 591k] | Branch (703:31): [True: 5, False: 2.92M] ------------------ 704| 5| return 0; 705| 5| } 706| 3.51M| prev = v; 707| 3.51M| } 708| | 709| | // The last byte should must end an integer encoding. 710| 770k| return (prev & 0x80) == 0; 711| 770k|} CBS_parse_generalized_time: 905| 22| int allow_timezone_offset) { 906| 22| return CBS_parse_rfc5280_time_internal(cbs, 1, allow_timezone_offset, out_tm); 907| 22|} CBS_parse_utc_time: 910| 139k| int allow_timezone_offset) { 911| 139k| return CBS_parse_rfc5280_time_internal(cbs, 0, allow_timezone_offset, out_tm); 912| 139k|} cbs.cc:_ZL7cbs_getP6cbs_stPPKhm: 29| 60.3M|static int cbs_get(CBS *cbs, const uint8_t **p, size_t n) { 30| 60.3M| if (cbs->len < n) { ------------------ | Branch (30:7): [True: 3.73M, False: 56.5M] ------------------ 31| 3.73M| return 0; 32| 3.73M| } 33| | 34| 56.5M| *p = cbs->data; 35| 56.5M| cbs->data += n; 36| 56.5M| cbs->len -= n; 37| 56.5M| return 1; 38| 60.3M|} cbs.cc:_ZL9cbs_get_uP6cbs_stPmm: 80| 6.15M|static int cbs_get_u(CBS *cbs, uint64_t *out, size_t len) { 81| 6.15M| uint64_t result = 0; 82| 6.15M| const uint8_t *data; 83| | 84| 6.15M| if (!cbs_get(cbs, &data, len)) { ------------------ | Branch (84:7): [True: 7.15k, False: 6.14M] ------------------ 85| 7.15k| return 0; 86| 7.15k| } 87| 19.0M| for (size_t i = 0; i < len; i++) { ------------------ | Branch (87:22): [True: 12.8M, False: 6.14M] ------------------ 88| 12.8M| result <<= 8; 89| 12.8M| result |= data[i]; 90| 12.8M| } 91| 6.14M| *out = result; 92| 6.14M| return 1; 93| 6.15M|} cbs.cc:_ZL23cbs_get_length_prefixedP6cbs_stS0_m: 184| 1.17M|static int cbs_get_length_prefixed(CBS *cbs, CBS *out, size_t len_len) { 185| 1.17M| uint64_t len; 186| 1.17M| if (!cbs_get_u(cbs, &len, len_len)) { ------------------ | Branch (186:7): [True: 67, False: 1.17M] ------------------ 187| 67| return 0; 188| 67| } 189| | // If |len_len| <= 3 then we know that |len| will fit into a |size_t|, even on 190| | // 32-bit systems. 191| 1.17M| assert(len_len <= 3); 192| 1.17M| return CBS_get_bytes(cbs, out, len); 193| 1.17M|} cbs.cc:_ZL24cbs_get_any_asn1_elementP6cbs_stS0_PjPmPiS3_i: 308| 7.60M| int *out_indefinite, int ber_ok) { 309| 7.60M| CBS header = *cbs; 310| 7.60M| CBS throwaway; 311| | 312| 7.60M| if (out == NULL) { ------------------ | Branch (312:7): [True: 0, False: 7.60M] ------------------ 313| 0| out = &throwaway; 314| 0| } 315| 7.60M| if (ber_ok) { ------------------ | Branch (315:7): [True: 70.2k, False: 7.53M] ------------------ 316| 70.2k| *out_ber_found = 0; 317| 70.2k| *out_indefinite = 0; 318| 7.53M| } else { 319| 7.53M| assert(out_ber_found == NULL); 320| 7.53M| assert(out_indefinite == NULL); 321| 7.53M| } 322| | 323| 7.60M| CBS_ASN1_TAG tag; 324| 7.60M| if (!parse_asn1_tag(&header, &tag)) { ------------------ | Branch (324:7): [True: 4.00k, False: 7.60M] ------------------ 325| 4.00k| return 0; 326| 4.00k| } 327| 7.60M| if (out_tag != NULL) { ------------------ | Branch (327:7): [True: 7.59M, False: 5.03k] ------------------ 328| 7.59M| *out_tag = tag; 329| 7.59M| } 330| | 331| 7.60M| uint8_t length_byte; 332| 7.60M| if (!CBS_get_u8(&header, &length_byte)) { ------------------ | Branch (332:7): [True: 2.66k, False: 7.59M] ------------------ 333| 2.66k| return 0; 334| 2.66k| } 335| | 336| 7.59M| size_t header_len = CBS_len(cbs) - CBS_len(&header); 337| | 338| 7.59M| size_t len; 339| | // The format for the length encoding is specified in ITU-T X.690 section 340| | // 8.1.3. 341| 7.59M| if ((length_byte & 0x80) == 0) { ------------------ | Branch (341:7): [True: 6.58M, False: 1.00M] ------------------ 342| | // Short form length. 343| 6.58M| len = ((size_t)length_byte) + header_len; 344| 6.58M| if (out_header_len != NULL) { ------------------ | Branch (344:9): [True: 6.58M, False: 2.69k] ------------------ 345| 6.58M| *out_header_len = header_len; 346| 6.58M| } 347| 6.58M| } else { 348| | // The high bit indicate that this is the long form, while the next 7 bits 349| | // encode the number of subsequent octets used to encode the length (ITU-T 350| | // X.690 clause 8.1.3.5.b). 351| 1.00M| const size_t num_bytes = length_byte & 0x7f; 352| 1.00M| uint64_t len64; 353| | 354| 1.00M| if (ber_ok && (tag & CBS_ASN1_CONSTRUCTED) != 0 && num_bytes == 0) { ------------------ | | 197| 44.2k|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | ------------------ | | | | 194| 44.2k|#define CBS_ASN1_TAG_SHIFT 24 | | ------------------ ------------------ | Branch (354:9): [True: 44.2k, False: 963k] | Branch (354:19): [True: 30, False: 44.2k] | Branch (354:56): [True: 21, False: 9] ------------------ 355| | // indefinite length 356| 21| if (out_header_len != NULL) { ------------------ | Branch (356:11): [True: 21, False: 0] ------------------ 357| 21| *out_header_len = header_len; 358| 21| } 359| 21| *out_ber_found = 1; 360| 21| *out_indefinite = 1; 361| 21| return CBS_get_bytes(cbs, out, header_len); 362| 21| } 363| | 364| | // ITU-T X.690 clause 8.1.3.5.c specifies that the value 0xff shall not be 365| | // used as the first byte of the length. If this parser encounters that 366| | // value, num_bytes will be parsed as 127, which will fail this check. 367| 1.00M| if (num_bytes == 0 || num_bytes > 4) { ------------------ | Branch (367:9): [True: 200, False: 1.00M] | Branch (367:27): [True: 5.09k, False: 1.00M] ------------------ 368| 5.29k| return 0; 369| 5.29k| } 370| 1.00M| if (!cbs_get_u(&header, &len64, num_bytes)) { ------------------ | Branch (370:9): [True: 71, False: 1.00M] ------------------ 371| 71| return 0; 372| 71| } 373| | // ITU-T X.690 section 10.1 (DER length forms) requires encoding the 374| | // length with the minimum number of octets. BER could, technically, have 375| | // 125 superfluous zero bytes. We do not attempt to handle that and still 376| | // require that the length fit in a |uint32_t| for BER. 377| 1.00M| if (len64 < 128) { ------------------ | Branch (377:9): [True: 278, False: 1.00M] ------------------ 378| | // Length should have used short-form encoding. 379| 278| if (ber_ok) { ------------------ | Branch (379:11): [True: 6, False: 272] ------------------ 380| 6| *out_ber_found = 1; 381| 272| } else { 382| 272| return 0; 383| 272| } 384| 278| } 385| 1.00M| if ((len64 >> ((num_bytes - 1) * 8)) == 0) { ------------------ | Branch (385:9): [True: 321, False: 1.00M] ------------------ 386| | // Length should have been at least one byte shorter. 387| 321| if (ber_ok) { ------------------ | Branch (387:11): [True: 1, False: 320] ------------------ 388| 1| *out_ber_found = 1; 389| 320| } else { 390| 320| return 0; 391| 320| } 392| 321| } 393| 1.00M| len = len64; 394| 1.00M| if (len + header_len + num_bytes < len) { ------------------ | Branch (394:9): [True: 0, False: 1.00M] ------------------ 395| | // Overflow. 396| 0| return 0; 397| 0| } 398| 1.00M| len += header_len + num_bytes; 399| 1.00M| if (out_header_len != NULL) { ------------------ | Branch (399:9): [True: 999k, False: 2.33k] ------------------ 400| 999k| *out_header_len = header_len + num_bytes; 401| 999k| } 402| 1.00M| } 403| | 404| 7.59M| return CBS_get_bytes(cbs, out, len); 405| 7.59M|} cbs.cc:_ZL12cbs_get_asn1P6cbs_stS0_ji: 438| 3.08M| int skip_header) { 439| 3.08M| size_t header_len; 440| 3.08M| CBS_ASN1_TAG tag; 441| 3.08M| CBS throwaway; 442| | 443| 3.08M| if (out == NULL) { ------------------ | Branch (443:7): [True: 720k, False: 2.36M] ------------------ 444| 720k| out = &throwaway; 445| 720k| } 446| | 447| 3.08M| if (!CBS_get_any_asn1_element(cbs, out, &tag, &header_len) || ------------------ | Branch (447:7): [True: 14.0k, False: 3.07M] ------------------ 448| 3.08M| tag != tag_value) { ------------------ | Branch (448:7): [True: 9.40k, False: 3.06M] ------------------ 449| 23.4k| return 0; 450| 23.4k| } 451| | 452| 3.06M| if (skip_header && !CBS_skip(out, header_len)) { ------------------ | Branch (452:7): [True: 2.92M, False: 140k] | Branch (452:22): [True: 0, False: 2.92M] ------------------ 453| 0| assert(0); 454| 0| return 0; 455| 0| } 456| | 457| 3.06M| return 1; 458| 3.06M|} cbs.cc:_ZL14parse_asn1_tagP6cbs_stPj: 267| 8.62M|static int parse_asn1_tag(CBS *cbs, CBS_ASN1_TAG *out) { 268| 8.62M| uint8_t tag_byte; 269| 8.62M| if (!CBS_get_u8(cbs, &tag_byte)) { ------------------ | Branch (269:7): [True: 259k, False: 8.36M] ------------------ 270| 259k| return 0; 271| 259k| } 272| | 273| | // ITU-T X.690 section 8.1.2.3 specifies the format for identifiers with a tag 274| | // number no greater than 30. 275| | // 276| | // If the number portion is 31 (0x1f, the largest value that fits in the 277| | // allotted bits), then the tag is more than one byte long and the 278| | // continuation bytes contain the tag number. 279| 8.36M| CBS_ASN1_TAG tag = ((CBS_ASN1_TAG)tag_byte & 0xe0) << CBS_ASN1_TAG_SHIFT; ------------------ | | 194| 8.36M|#define CBS_ASN1_TAG_SHIFT 24 ------------------ 280| 8.36M| CBS_ASN1_TAG tag_number = tag_byte & 0x1f; 281| 8.36M| if (tag_number == 0x1f) { ------------------ | Branch (281:7): [True: 15.8k, False: 8.35M] ------------------ 282| 15.8k| uint64_t v; 283| 15.8k| if (!parse_base128_integer(cbs, &v) || ------------------ | Branch (283:9): [True: 2.63k, False: 13.2k] ------------------ 284| | // Check the tag number is within our supported bounds. 285| 15.8k| v > CBS_ASN1_TAG_NUMBER_MASK || ------------------ | | 211| 29.0k|#define CBS_ASN1_TAG_NUMBER_MASK ((1u << (5 + CBS_ASN1_TAG_SHIFT)) - 1) | | ------------------ | | | | 194| 13.2k|#define CBS_ASN1_TAG_SHIFT 24 | | ------------------ ------------------ | Branch (285:9): [True: 2.51k, False: 10.7k] ------------------ 286| | // Small tag numbers should have used low tag number form, even in BER. 287| 15.8k| v < 0x1f) { ------------------ | Branch (287:9): [True: 3.41k, False: 7.28k] ------------------ 288| 8.57k| return 0; 289| 8.57k| } 290| 7.28k| tag_number = (CBS_ASN1_TAG)v; 291| 7.28k| } 292| | 293| 8.36M| tag |= tag_number; 294| | 295| | // Tag [UNIVERSAL 0] is reserved for use by the encoding. Reject it here to 296| | // avoid some ambiguity around ANY values and BER indefinite-length EOCs. See 297| | // https://crbug.com/boringssl/455. 298| 8.36M| if ((tag & ~CBS_ASN1_CONSTRUCTED) == 0) { ------------------ | | 197| 8.36M|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | ------------------ | | | | 194| 8.36M|#define CBS_ASN1_TAG_SHIFT 24 | | ------------------ ------------------ | Branch (298:7): [True: 1.93k, False: 8.35M] ------------------ 299| 1.93k| return 0; 300| 1.93k| } 301| | 302| 8.35M| *out = tag; 303| 8.35M| return 1; 304| 8.36M|} cbs.cc:_ZL21parse_base128_integerP6cbs_stPm: 243| 15.8k|static int parse_base128_integer(CBS *cbs, uint64_t *out) { 244| 15.8k| uint64_t v = 0; 245| 15.8k| uint8_t b; 246| 57.0k| do { 247| 57.0k| if (!CBS_get_u8(cbs, &b)) { ------------------ | Branch (247:9): [True: 2.03k, False: 55.0k] ------------------ 248| 2.03k| return 0; 249| 2.03k| } 250| 55.0k| if ((v >> (64 - 7)) != 0) { ------------------ | Branch (250:9): [True: 136, False: 54.9k] ------------------ 251| | // The value is too large. 252| 136| return 0; 253| 136| } 254| 54.9k| if (v == 0 && b == 0x80) { ------------------ | Branch (254:9): [True: 15.5k, False: 39.3k] | Branch (254:19): [True: 463, False: 15.0k] ------------------ 255| | // The value must be minimally encoded. 256| 463| return 0; 257| 463| } 258| 54.4k| v = (v << 7) | (b & 0x7f); 259| | 260| | // Values end at an octet with the high bit cleared. 261| 54.4k| } while (b & 0x80); ------------------ | Branch (261:12): [True: 41.2k, False: 13.2k] ------------------ 262| | 263| 13.2k| *out = v; 264| 13.2k| return 1; 265| 15.8k|} cbs.cc:_ZL31CBS_parse_rfc5280_time_internalPK6cbs_stiiP2tm: 805| 139k| struct tm *out_tm) { 806| 139k| int year, month, day, hour, min, sec, tmp; 807| 139k| CBS copy = *cbs; 808| 139k| uint8_t tz; 809| | 810| 139k| if (is_gentime) { ------------------ | Branch (810:7): [True: 22, False: 139k] ------------------ 811| 22| if (!cbs_get_two_digits(©, &tmp)) { ------------------ | Branch (811:9): [True: 6, False: 16] ------------------ 812| 6| return 0; 813| 6| } 814| 16| year = tmp * 100; 815| 16| if (!cbs_get_two_digits(©, &tmp)) { ------------------ | Branch (815:9): [True: 6, False: 10] ------------------ 816| 6| return 0; 817| 6| } 818| 10| year += tmp; 819| 139k| } else { 820| 139k| year = 1900; 821| 139k| if (!cbs_get_two_digits(©, &tmp)) { ------------------ | Branch (821:9): [True: 12, False: 139k] ------------------ 822| 12| return 0; 823| 12| } 824| 139k| year += tmp; 825| 139k| if (year < 1950) { ------------------ | Branch (825:9): [True: 136k, False: 2.29k] ------------------ 826| 136k| year += 100; 827| 136k| } 828| 139k| if (year >= 2050) { ------------------ | Branch (828:9): [True: 0, False: 139k] ------------------ 829| 0| return 0; // A Generalized time must be used. 830| 0| } 831| 139k| } 832| 139k| if (!cbs_get_two_digits(©, &month) || month < 1 || ------------------ | Branch (832:7): [True: 10, False: 139k] | Branch (832:45): [True: 1, False: 139k] ------------------ 833| 139k| month > 12 || // Reject invalid months. ------------------ | Branch (833:7): [True: 9, False: 139k] ------------------ 834| 139k| !cbs_get_two_digits(©, &day) || ------------------ | Branch (834:7): [True: 10, False: 139k] ------------------ 835| 139k| !is_valid_day(year, month, day) || // Reject invalid days. ------------------ | Branch (835:7): [True: 13, False: 139k] ------------------ 836| 139k| !cbs_get_two_digits(©, &hour) || ------------------ | Branch (836:7): [True: 16, False: 139k] ------------------ 837| 139k| hour > 23 || // Reject invalid hours. ------------------ | Branch (837:7): [True: 9, False: 139k] ------------------ 838| 139k| !cbs_get_two_digits(©, &min) || ------------------ | Branch (838:7): [True: 10, False: 139k] ------------------ 839| 139k| min > 59 || // Reject invalid minutes. ------------------ | Branch (839:7): [True: 5, False: 139k] ------------------ 840| 139k| !cbs_get_two_digits(©, &sec) || sec > 59 || !CBS_get_u8(©, &tz)) { ------------------ | Branch (840:7): [True: 9, False: 139k] | Branch (840:43): [True: 3, False: 139k] | Branch (840:55): [True: 2, False: 139k] ------------------ 841| 97| return 0; 842| 97| } 843| | 844| 139k| int offset_sign = 0; 845| 139k| switch (tz) { 846| 139k| case 'Z': ------------------ | Branch (846:5): [True: 139k, False: 14] ------------------ 847| 139k| break; // We correctly have 'Z' on the end as per spec. 848| 2| case '+': ------------------ | Branch (848:5): [True: 2, False: 139k] ------------------ 849| 2| offset_sign = 1; 850| 2| break; // Should not be allowed per RFC 5280. 851| 8| case '-': ------------------ | Branch (851:5): [True: 8, False: 139k] ------------------ 852| 8| offset_sign = -1; 853| 8| break; // Should not be allowed per RFC 5280. 854| 4| default: ------------------ | Branch (854:5): [True: 4, False: 139k] ------------------ 855| 4| return 0; // Reject anything else after the time. 856| 139k| } 857| | 858| | // If allow_timezone_offset is non-zero, allow for a four digit timezone 859| | // offset to be specified even though this is not allowed by RFC 5280. We are 860| | // permissive of this for UTCTimes due to the unfortunate existence of 861| | // artisinally rolled long lived certificates that were baked into places that 862| | // are now difficult to change. These certificates were generated with the 863| | // 'openssl' command that permissively allowed the creation of certificates 864| | // with notBefore and notAfter times specified as strings for direct 865| | // certificate inclusion on the command line. For context see cl/237068815. 866| | // 867| | // TODO(bbe): This has been expunged from public web-pki as the ecosystem has 868| | // managed to encourage CA compliance with standards. We should find a way to 869| | // get rid of this or make it off by default. 870| 139k| int offset_seconds = 0; 871| 139k| if (offset_sign != 0) { ------------------ | Branch (871:7): [True: 10, False: 139k] ------------------ 872| 10| if (!allow_timezone_offset) { ------------------ | Branch (872:9): [True: 1, False: 9] ------------------ 873| 1| return 0; 874| 1| } 875| 9| int offset_hours, offset_minutes; 876| 9| if (!cbs_get_two_digits(©, &offset_hours) || ------------------ | Branch (876:9): [True: 1, False: 8] ------------------ 877| 9| offset_hours > 23 || // Reject invalid hours. ------------------ | Branch (877:9): [True: 3, False: 5] ------------------ 878| 9| !cbs_get_two_digits(©, &offset_minutes) || ------------------ | Branch (878:9): [True: 1, False: 4] ------------------ 879| 9| offset_minutes > 59) { // Reject invalid minutes. ------------------ | Branch (879:9): [True: 1, False: 3] ------------------ 880| 6| return 0; 881| 6| } 882| 3| offset_seconds = offset_sign * (offset_hours * 3600 + offset_minutes * 60); 883| 3| } 884| | 885| 139k| if (CBS_len(©) != 0) { ------------------ | Branch (885:7): [True: 7, False: 139k] ------------------ 886| 7| return 0; // Reject invalid lengths. 887| 7| } 888| | 889| 139k| if (out_tm != NULL) { ------------------ | Branch (889:7): [True: 0, False: 139k] ------------------ 890| | // Fill in the tm fields corresponding to what we validated. 891| 0| out_tm->tm_year = year - 1900; 892| 0| out_tm->tm_mon = month - 1; 893| 0| out_tm->tm_mday = day; 894| 0| out_tm->tm_hour = hour; 895| 0| out_tm->tm_min = min; 896| 0| out_tm->tm_sec = sec; 897| 0| if (offset_seconds && !OPENSSL_gmtime_adj(out_tm, 0, offset_seconds)) { ------------------ | Branch (897:9): [True: 0, False: 0] | Branch (897:27): [True: 0, False: 0] ------------------ 898| 0| return 0; 899| 0| } 900| 0| } 901| 139k| return 1; 902| 139k|} cbs.cc:_ZL18cbs_get_two_digitsP6cbs_stPi: 756| 835k|static int cbs_get_two_digits(CBS *cbs, int *out) { 757| 835k| uint8_t first_digit, second_digit; 758| 835k| if (!CBS_get_u8(cbs, &first_digit)) { ------------------ | Branch (758:7): [True: 7, False: 835k] ------------------ 759| 7| return 0; 760| 7| } 761| 835k| if (!OPENSSL_isdigit(first_digit)) { ------------------ | Branch (761:7): [True: 31, False: 835k] ------------------ 762| 31| return 0; 763| 31| } 764| 835k| if (!CBS_get_u8(cbs, &second_digit)) { ------------------ | Branch (764:7): [True: 14, False: 835k] ------------------ 765| 14| return 0; 766| 14| } 767| 835k| if (!OPENSSL_isdigit(second_digit)) { ------------------ | Branch (767:7): [True: 29, False: 834k] ------------------ 768| 29| return 0; 769| 29| } 770| 834k| *out = (first_digit - '0') * 10 + (second_digit - '0'); 771| 834k| return 1; 772| 835k|} cbs.cc:_ZL12is_valid_dayiii: 774| 139k|static int is_valid_day(int year, int month, int day) { 775| 139k| if (day < 1) { ------------------ | Branch (775:7): [True: 1, False: 139k] ------------------ 776| 1| return 0; 777| 1| } 778| 139k| switch (month) { 779| 71| case 1: ------------------ | Branch (779:5): [True: 71, False: 139k] ------------------ 780| 166| case 3: ------------------ | Branch (780:5): [True: 95, False: 139k] ------------------ 781| 10.4k| case 5: ------------------ | Branch (781:5): [True: 10.2k, False: 128k] ------------------ 782| 13.9k| case 7: ------------------ | Branch (782:5): [True: 3.53k, False: 135k] ------------------ 783| 17.4k| case 8: ------------------ | Branch (783:5): [True: 3.44k, False: 135k] ------------------ 784| 17.7k| case 10: ------------------ | Branch (784:5): [True: 286, False: 138k] ------------------ 785| 46.0k| case 12: ------------------ | Branch (785:5): [True: 28.3k, False: 110k] ------------------ 786| 46.0k| return day <= 31; 787| 83.0k| case 4: ------------------ | Branch (787:5): [True: 83.0k, False: 56.0k] ------------------ 788| 83.1k| case 6: ------------------ | Branch (788:5): [True: 60, False: 139k] ------------------ 789| 83.1k| case 9: ------------------ | Branch (789:5): [True: 17, False: 139k] ------------------ 790| 83.3k| case 11: ------------------ | Branch (790:5): [True: 206, False: 138k] ------------------ 791| 83.3k| return day <= 30; 792| 9.76k| case 2: ------------------ | Branch (792:5): [True: 9.76k, False: 129k] ------------------ 793| 9.76k| if ((year % 4 == 0 && year % 100 != 0) || year % 400 == 0) { ------------------ | Branch (793:12): [True: 4.72k, False: 5.03k] | Branch (793:29): [True: 4.71k, False: 15] | Branch (793:49): [True: 14, False: 5.04k] ------------------ 794| 4.72k| return day <= 29; 795| 5.04k| } else { 796| 5.04k| return day <= 28; 797| 5.04k| } 798| 0| default: ------------------ | Branch (798:5): [True: 0, False: 139k] ------------------ 799| 0| return 0; 800| 139k| } 801| 139k|} CBS_get_utf8: 42| 5.85M|int CBS_get_utf8(CBS *cbs, uint32_t *out) { 43| 5.85M| uint8_t c; 44| 5.85M| if (!CBS_get_u8(cbs, &c)) { ------------------ | Branch (44:7): [True: 0, False: 5.85M] ------------------ 45| 0| return 0; 46| 0| } 47| 5.85M| if (c <= 0x7f) { ------------------ | Branch (47:7): [True: 5.84M, False: 5.77k] ------------------ 48| 5.84M| *out = c; 49| 5.84M| return 1; 50| 5.84M| } 51| 5.77k| uint32_t v, lower_bound; 52| 5.77k| size_t len; 53| 5.77k| if ((c & TOP_BITS(3)) == TOP_BITS(2)) { ------------------ | | 40| 5.77k|#define TOP_BITS(n) ((uint8_t)~BOTTOM_BITS(8 - (n))) | | ------------------ | | | | 37| 5.77k|#define BOTTOM_BITS(n) (uint8_t)((1u << (n)) - 1) | | ------------------ ------------------ if ((c & TOP_BITS(3)) == TOP_BITS(2)) { ------------------ | | 40| 5.77k|#define TOP_BITS(n) ((uint8_t)~BOTTOM_BITS(8 - (n))) | | ------------------ | | | | 37| 5.77k|#define BOTTOM_BITS(n) (uint8_t)((1u << (n)) - 1) | | ------------------ ------------------ | Branch (53:7): [True: 5.61k, False: 165] ------------------ 54| 5.61k| v = c & BOTTOM_BITS(5); ------------------ | | 37| 5.61k|#define BOTTOM_BITS(n) (uint8_t)((1u << (n)) - 1) ------------------ 55| 5.61k| len = 1; 56| 5.61k| lower_bound = 0x80; 57| 5.61k| } else if ((c & TOP_BITS(4)) == TOP_BITS(3)) { ------------------ | | 40| 165|#define TOP_BITS(n) ((uint8_t)~BOTTOM_BITS(8 - (n))) | | ------------------ | | | | 37| 165|#define BOTTOM_BITS(n) (uint8_t)((1u << (n)) - 1) | | ------------------ ------------------ } else if ((c & TOP_BITS(4)) == TOP_BITS(3)) { ------------------ | | 40| 165|#define TOP_BITS(n) ((uint8_t)~BOTTOM_BITS(8 - (n))) | | ------------------ | | | | 37| 165|#define BOTTOM_BITS(n) (uint8_t)((1u << (n)) - 1) | | ------------------ ------------------ | Branch (57:14): [True: 84, False: 81] ------------------ 58| 84| v = c & BOTTOM_BITS(4); ------------------ | | 37| 84|#define BOTTOM_BITS(n) (uint8_t)((1u << (n)) - 1) ------------------ 59| 84| len = 2; 60| 84| lower_bound = 0x800; 61| 84| } else if ((c & TOP_BITS(5)) == TOP_BITS(4)) { ------------------ | | 40| 81|#define TOP_BITS(n) ((uint8_t)~BOTTOM_BITS(8 - (n))) | | ------------------ | | | | 37| 81|#define BOTTOM_BITS(n) (uint8_t)((1u << (n)) - 1) | | ------------------ ------------------ } else if ((c & TOP_BITS(5)) == TOP_BITS(4)) { ------------------ | | 40| 81|#define TOP_BITS(n) ((uint8_t)~BOTTOM_BITS(8 - (n))) | | ------------------ | | | | 37| 81|#define BOTTOM_BITS(n) (uint8_t)((1u << (n)) - 1) | | ------------------ ------------------ | Branch (61:14): [True: 60, False: 21] ------------------ 62| 60| v = c & BOTTOM_BITS(3); ------------------ | | 37| 60|#define BOTTOM_BITS(n) (uint8_t)((1u << (n)) - 1) ------------------ 63| 60| len = 3; 64| 60| lower_bound = 0x10000; 65| 60| } else { 66| 21| return 0; 67| 21| } 68| 11.6k| for (size_t i = 0; i < len; i++) { ------------------ | Branch (68:22): [True: 5.94k, False: 5.73k] ------------------ 69| 5.94k| if (!CBS_get_u8(cbs, &c) || ------------------ | Branch (69:9): [True: 4, False: 5.93k] ------------------ 70| 5.94k| (c & TOP_BITS(2)) != TOP_BITS(1)) { ------------------ | | 40| 5.93k|#define TOP_BITS(n) ((uint8_t)~BOTTOM_BITS(8 - (n))) | | ------------------ | | | | 37| 5.93k|#define BOTTOM_BITS(n) (uint8_t)((1u << (n)) - 1) | | ------------------ ------------------ (c & TOP_BITS(2)) != TOP_BITS(1)) { ------------------ | | 40| 5.93k|#define TOP_BITS(n) ((uint8_t)~BOTTOM_BITS(8 - (n))) | | ------------------ | | | | 37| 5.93k|#define BOTTOM_BITS(n) (uint8_t)((1u << (n)) - 1) | | ------------------ ------------------ | Branch (70:9): [True: 12, False: 5.92k] ------------------ 71| 16| return 0; 72| 16| } 73| 5.92k| v <<= 6; 74| 5.92k| v |= c & BOTTOM_BITS(6); ------------------ | | 37| 5.92k|#define BOTTOM_BITS(n) (uint8_t)((1u << (n)) - 1) ------------------ 75| 5.92k| } 76| 5.73k| if (!is_valid_code_point(v) || ------------------ | Branch (76:7): [True: 14, False: 5.72k] ------------------ 77| 5.73k| v < lower_bound) { ------------------ | Branch (77:7): [True: 1, False: 5.72k] ------------------ 78| 15| return 0; 79| 15| } 80| 5.72k| *out = v; 81| 5.72k| return 1; 82| 5.73k|} CBS_get_latin1: 84| 1.46M|int CBS_get_latin1(CBS *cbs, uint32_t *out) { 85| 1.46M| uint8_t c; 86| 1.46M| if (!CBS_get_u8(cbs, &c)) { ------------------ | Branch (86:7): [True: 0, False: 1.46M] ------------------ 87| 0| return 0; 88| 0| } 89| 1.46M| *out = c; 90| 1.46M| return 1; 91| 1.46M|} CBS_get_ucs2_be: 93| 15.0k|int CBS_get_ucs2_be(CBS *cbs, uint32_t *out) { 94| | // Note UCS-2 (used by BMPString) does not support surrogates. 95| 15.0k| uint16_t c; 96| 15.0k| if (!CBS_get_u16(cbs, &c) || ------------------ | Branch (96:7): [True: 3, False: 15.0k] ------------------ 97| 15.0k| !is_valid_code_point(c)) { ------------------ | Branch (97:7): [True: 11, False: 15.0k] ------------------ 98| 14| return 0; 99| 14| } 100| 15.0k| *out = c; 101| 15.0k| return 1; 102| 15.0k|} CBS_get_utf32_be: 104| 542|int CBS_get_utf32_be(CBS *cbs, uint32_t *out) { 105| 542| return CBS_get_u32(cbs, out) && is_valid_code_point(*out); ------------------ | Branch (105:10): [True: 538, False: 4] | Branch (105:35): [True: 501, False: 37] ------------------ 106| 542|} CBB_get_utf8_len: 108| 3.66M|size_t CBB_get_utf8_len(uint32_t u) { 109| 3.66M| if (u <= 0x7f) { ------------------ | Branch (109:7): [True: 3.62M, False: 36.5k] ------------------ 110| 3.62M| return 1; 111| 3.62M| } 112| 36.5k| if (u <= 0x7ff) { ------------------ | Branch (112:7): [True: 32.3k, False: 4.27k] ------------------ 113| 32.3k| return 2; 114| 32.3k| } 115| 4.27k| if (u <= 0xffff) { ------------------ | Branch (115:7): [True: 4.18k, False: 87] ------------------ 116| 4.18k| return 3; 117| 4.18k| } 118| 87| return 4; 119| 4.27k|} CBB_add_utf8: 121| 739k|int CBB_add_utf8(CBB *cbb, uint32_t u) { 122| 739k| if (!is_valid_code_point(u)) { ------------------ | Branch (122:7): [True: 0, False: 739k] ------------------ 123| 0| return 0; 124| 0| } 125| 739k| if (u <= 0x7f) { ------------------ | Branch (125:7): [True: 705k, False: 33.7k] ------------------ 126| 705k| return CBB_add_u8(cbb, (uint8_t)u); 127| 705k| } 128| 33.7k| if (u <= 0x7ff) { ------------------ | Branch (128:7): [True: 29.5k, False: 4.25k] ------------------ 129| 29.5k| return CBB_add_u8(cbb, TOP_BITS(2) | (u >> 6)) && ------------------ | | 40| 29.5k|#define TOP_BITS(n) ((uint8_t)~BOTTOM_BITS(8 - (n))) | | ------------------ | | | | 37| 29.5k|#define BOTTOM_BITS(n) (uint8_t)((1u << (n)) - 1) | | ------------------ ------------------ | Branch (129:12): [True: 29.5k, False: 0] ------------------ 130| 29.5k| CBB_add_u8(cbb, TOP_BITS(1) | (u & BOTTOM_BITS(6))); ------------------ | | 40| 29.5k|#define TOP_BITS(n) ((uint8_t)~BOTTOM_BITS(8 - (n))) | | ------------------ | | | | 37| 29.5k|#define BOTTOM_BITS(n) (uint8_t)((1u << (n)) - 1) | | ------------------ ------------------ CBB_add_u8(cbb, TOP_BITS(1) | (u & BOTTOM_BITS(6))); ------------------ | | 37| 29.5k|#define BOTTOM_BITS(n) (uint8_t)((1u << (n)) - 1) ------------------ | Branch (130:12): [True: 29.5k, False: 0] ------------------ 131| 29.5k| } 132| 4.25k| if (u <= 0xffff) { ------------------ | Branch (132:7): [True: 4.17k, False: 80] ------------------ 133| 4.17k| return CBB_add_u8(cbb, TOP_BITS(3) | (u >> 12)) && ------------------ | | 40| 4.17k|#define TOP_BITS(n) ((uint8_t)~BOTTOM_BITS(8 - (n))) | | ------------------ | | | | 37| 4.17k|#define BOTTOM_BITS(n) (uint8_t)((1u << (n)) - 1) | | ------------------ ------------------ | Branch (133:12): [True: 4.17k, False: 0] ------------------ 134| 4.17k| CBB_add_u8(cbb, TOP_BITS(1) | ((u >> 6) & BOTTOM_BITS(6))) && ------------------ | | 40| 4.17k|#define TOP_BITS(n) ((uint8_t)~BOTTOM_BITS(8 - (n))) | | ------------------ | | | | 37| 4.17k|#define BOTTOM_BITS(n) (uint8_t)((1u << (n)) - 1) | | ------------------ ------------------ CBB_add_u8(cbb, TOP_BITS(1) | ((u >> 6) & BOTTOM_BITS(6))) && ------------------ | | 37| 4.17k|#define BOTTOM_BITS(n) (uint8_t)((1u << (n)) - 1) ------------------ | Branch (134:12): [True: 4.17k, False: 0] ------------------ 135| 4.17k| CBB_add_u8(cbb, TOP_BITS(1) | (u & BOTTOM_BITS(6))); ------------------ | | 40| 4.17k|#define TOP_BITS(n) ((uint8_t)~BOTTOM_BITS(8 - (n))) | | ------------------ | | | | 37| 4.17k|#define BOTTOM_BITS(n) (uint8_t)((1u << (n)) - 1) | | ------------------ ------------------ CBB_add_u8(cbb, TOP_BITS(1) | (u & BOTTOM_BITS(6))); ------------------ | | 37| 4.17k|#define BOTTOM_BITS(n) (uint8_t)((1u << (n)) - 1) ------------------ | Branch (135:12): [True: 4.17k, False: 0] ------------------ 136| 4.17k| } 137| 80| if (u <= 0x10ffff) { ------------------ | Branch (137:7): [True: 80, False: 0] ------------------ 138| 80| return CBB_add_u8(cbb, TOP_BITS(4) | (u >> 18)) && ------------------ | | 40| 80|#define TOP_BITS(n) ((uint8_t)~BOTTOM_BITS(8 - (n))) | | ------------------ | | | | 37| 80|#define BOTTOM_BITS(n) (uint8_t)((1u << (n)) - 1) | | ------------------ ------------------ | Branch (138:12): [True: 80, False: 0] ------------------ 139| 80| CBB_add_u8(cbb, TOP_BITS(1) | ((u >> 12) & BOTTOM_BITS(6))) && ------------------ | | 40| 80|#define TOP_BITS(n) ((uint8_t)~BOTTOM_BITS(8 - (n))) | | ------------------ | | | | 37| 80|#define BOTTOM_BITS(n) (uint8_t)((1u << (n)) - 1) | | ------------------ ------------------ CBB_add_u8(cbb, TOP_BITS(1) | ((u >> 12) & BOTTOM_BITS(6))) && ------------------ | | 37| 80|#define BOTTOM_BITS(n) (uint8_t)((1u << (n)) - 1) ------------------ | Branch (139:12): [True: 80, False: 0] ------------------ 140| 80| CBB_add_u8(cbb, TOP_BITS(1) | ((u >> 6) & BOTTOM_BITS(6))) && ------------------ | | 40| 80|#define TOP_BITS(n) ((uint8_t)~BOTTOM_BITS(8 - (n))) | | ------------------ | | | | 37| 80|#define BOTTOM_BITS(n) (uint8_t)((1u << (n)) - 1) | | ------------------ ------------------ CBB_add_u8(cbb, TOP_BITS(1) | ((u >> 6) & BOTTOM_BITS(6))) && ------------------ | | 37| 80|#define BOTTOM_BITS(n) (uint8_t)((1u << (n)) - 1) ------------------ | Branch (140:12): [True: 80, False: 0] ------------------ 141| 80| CBB_add_u8(cbb, TOP_BITS(1) | (u & BOTTOM_BITS(6))); ------------------ | | 40| 80|#define TOP_BITS(n) ((uint8_t)~BOTTOM_BITS(8 - (n))) | | ------------------ | | | | 37| 80|#define BOTTOM_BITS(n) (uint8_t)((1u << (n)) - 1) | | ------------------ ------------------ CBB_add_u8(cbb, TOP_BITS(1) | (u & BOTTOM_BITS(6))); ------------------ | | 37| 80|#define BOTTOM_BITS(n) (uint8_t)((1u << (n)) - 1) ------------------ | Branch (141:12): [True: 80, False: 0] ------------------ 142| 80| } 143| 0| return 0; 144| 80|} unicode.cc:_ZL19is_valid_code_pointj: 20| 760k|static int is_valid_code_point(uint32_t v) { 21| | // References in the following are to Unicode 15.0.0. 22| 760k| if (// The Unicode space runs from zero to 0x10ffff (3.4 D9). 23| 760k| v > 0x10ffff || ------------------ | Branch (23:7): [True: 25, False: 760k] ------------------ 24| | // Values 0x...fffe, 0x...ffff, and 0xfdd0-0xfdef are permanently reserved 25| | // as noncharacters (3.4 D14). See also 23.7. As our APIs are intended for 26| | // "open interchange", such as ASN.1, we reject them. 27| 760k| (v & 0xfffe) == 0xfffe || ------------------ | Branch (27:7): [True: 4, False: 760k] ------------------ 28| 760k| (v >= 0xfdd0 && v <= 0xfdef) || ------------------ | Branch (28:8): [True: 922, False: 760k] | Branch (28:23): [True: 9, False: 913] ------------------ 29| | // Surrogate code points are invalid (3.2 C1). 30| 760k| (v >= 0xd800 && v <= 0xdfff)) { ------------------ | Branch (30:8): [True: 1.86k, False: 759k] | Branch (30:23): [True: 24, False: 1.83k] ------------------ 31| 62| return 0; 32| 62| } 33| 760k| return 1; 34| 760k|} CRYPTO_chacha_20: 100| 107| uint32_t counter) { 101| 107| assert(!buffers_alias(out, in_len, in, in_len) || in == out); 102| | 103| 107| uint32_t counter_nonce[4]; 104| 107| counter_nonce[0] = counter; 105| 107| counter_nonce[1] = CRYPTO_load_u32_le(nonce + 0); 106| 107| counter_nonce[2] = CRYPTO_load_u32_le(nonce + 4); 107| 107| counter_nonce[3] = CRYPTO_load_u32_le(nonce + 8); 108| | 109| 107| const uint32_t *key_ptr = (const uint32_t *)key; 110| |#if !defined(OPENSSL_X86) && !defined(OPENSSL_X86_64) 111| | // The assembly expects the key to be four-byte aligned. 112| | uint32_t key_u32[8]; 113| | if ((((uintptr_t)key) & 3) != 0) { 114| | key_u32[0] = CRYPTO_load_u32_le(key + 0); 115| | key_u32[1] = CRYPTO_load_u32_le(key + 4); 116| | key_u32[2] = CRYPTO_load_u32_le(key + 8); 117| | key_u32[3] = CRYPTO_load_u32_le(key + 12); 118| | key_u32[4] = CRYPTO_load_u32_le(key + 16); 119| | key_u32[5] = CRYPTO_load_u32_le(key + 20); 120| | key_u32[6] = CRYPTO_load_u32_le(key + 24); 121| | key_u32[7] = CRYPTO_load_u32_le(key + 28); 122| | 123| | key_ptr = key_u32; 124| | } 125| |#endif 126| | 127| 214| while (in_len > 0) { ------------------ | Branch (127:10): [True: 107, False: 107] ------------------ 128| | // The assembly functions do not have defined overflow behavior. While 129| | // overflow is almost always a bug in the caller, we prefer our functions to 130| | // behave the same across platforms, so divide into multiple calls to avoid 131| | // this case. 132| 107| uint64_t todo = 64 * ((UINT64_C(1) << 32) - counter_nonce[0]); 133| 107| if (todo > in_len) { ------------------ | Branch (133:9): [True: 107, False: 0] ------------------ 134| 107| todo = in_len; 135| 107| } 136| | 137| 107| ChaCha20_ctr32(out, in, (size_t)todo, key_ptr, counter_nonce); 138| 107| in += todo; 139| 107| out += todo; 140| 107| in_len -= todo; 141| | 142| | // We're either done and will next break out of the loop, or we stopped at 143| | // the wraparound point and the counter should continue at zero. 144| 107| counter_nonce[0] = 0; 145| 107| } 146| 107|} chacha.cc:_ZL14ChaCha20_ctr32PhPKhmPKjS3_: 65| 107| const uint32_t key[8], const uint32_t counter[4]) { 66| |#if defined(CHACHA20_ASM_NEON) 67| | if (ChaCha20_ctr32_neon_capable(in_len)) { 68| | ChaCha20_ctr32_neon(out, in, in_len, key, counter); 69| | return; 70| | } 71| |#endif 72| 107|#if defined(CHACHA20_ASM_AVX2) 73| 107| if (ChaCha20_ctr32_avx2_capable(in_len)) { ------------------ | Branch (73:7): [True: 0, False: 107] ------------------ 74| 0| ChaCha20_ctr32_avx2(out, in, in_len, key, counter); 75| 0| return; 76| 0| } 77| 107|#endif 78| 107|#if defined(CHACHA20_ASM_SSSE3_4X) 79| 107| if (ChaCha20_ctr32_ssse3_4x_capable(in_len)) { ------------------ | Branch (79:7): [True: 0, False: 107] ------------------ 80| 0| ChaCha20_ctr32_ssse3_4x(out, in, in_len, key, counter); 81| 0| return; 82| 0| } 83| 107|#endif 84| 107|#if defined(CHACHA20_ASM_SSSE3) 85| 107| if (ChaCha20_ctr32_ssse3_capable(in_len)) { ------------------ | Branch (85:7): [True: 0, False: 107] ------------------ 86| 0| ChaCha20_ctr32_ssse3(out, in, in_len, key, counter); 87| 0| return; 88| 0| } 89| 107|#endif 90| 107| if (in_len > 0) { ------------------ | Branch (90:7): [True: 107, False: 0] ------------------ 91| 107| ChaCha20_ctr32_nohw(out, in, in_len, key, counter); 92| 107| } 93| 107|} ChaCha20_ctr32_avx2_capable: 60| 107|inline int ChaCha20_ctr32_avx2_capable(size_t len) { 61| 107| return len > 128 && CRYPTO_is_AVX2_capable(); ------------------ | Branch (61:10): [True: 0, False: 107] | Branch (61:23): [True: 0, False: 0] ------------------ 62| 107|} ChaCha20_ctr32_ssse3_4x_capable: 67| 107|inline int ChaCha20_ctr32_ssse3_4x_capable(size_t len) { 68| 107| int capable = len > 128 && CRYPTO_is_SSSE3_capable(); ------------------ | Branch (68:17): [True: 0, False: 107] | Branch (68:30): [True: 0, False: 0] ------------------ 69| 107| int faster = len > 192 || !CRYPTO_cpu_perf_is_like_silvermont(); ------------------ | Branch (69:16): [True: 0, False: 107] | Branch (69:29): [True: 107, False: 0] ------------------ 70| 107| return capable && faster; ------------------ | Branch (70:10): [True: 0, False: 107] | Branch (70:21): [True: 0, False: 0] ------------------ 71| 107|} ChaCha20_ctr32_ssse3_capable: 76| 107|inline int ChaCha20_ctr32_ssse3_capable(size_t len) { 77| 107| return len > 128 && CRYPTO_is_SSSE3_capable(); ------------------ | Branch (77:10): [True: 0, False: 107] | Branch (77:23): [True: 0, False: 0] ------------------ 78| 107|} EVP_aead_chacha20_poly1305: 335| 28|const EVP_AEAD *EVP_aead_chacha20_poly1305(void) { 336| 28| return &aead_chacha20_poly1305; 337| 28|} e_chacha20poly1305.cc:_ZL27aead_chacha20_poly1305_initP15evp_aead_ctx_stPKhmm: 43| 14| size_t key_len, size_t tag_len) { 44| 14| struct aead_chacha20_poly1305_ctx *c20_ctx = 45| 14| (struct aead_chacha20_poly1305_ctx *)&ctx->state; 46| | 47| 14| if (tag_len == 0) { ------------------ | Branch (47:7): [True: 14, False: 0] ------------------ 48| 14| tag_len = POLY1305_TAG_LEN; ------------------ | | 103| 14|#define POLY1305_TAG_LEN 16 ------------------ 49| 14| } 50| | 51| 14| if (tag_len > POLY1305_TAG_LEN) { ------------------ | | 103| 14|#define POLY1305_TAG_LEN 16 ------------------ | Branch (51:7): [True: 0, False: 14] ------------------ 52| 0| OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_TOO_LARGE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 53| 0| return 0; 54| 0| } 55| | 56| 14| if (key_len != sizeof(c20_ctx->key)) { ------------------ | Branch (56:7): [True: 0, False: 14] ------------------ 57| 0| return 0; // internal error - EVP_AEAD_CTX_init should catch this. 58| 0| } 59| | 60| 14| OPENSSL_memcpy(c20_ctx->key, key, key_len); 61| 14| ctx->tag_len = tag_len; 62| | 63| 14| return 1; 64| 14|} e_chacha20poly1305.cc:_ZL30aead_chacha20_poly1305_cleanupP15evp_aead_ctx_st: 66| 14|static void aead_chacha20_poly1305_cleanup(EVP_AEAD_CTX *ctx) {} EVP_des_ede3_cbc: 126| 3.01k|const EVP_CIPHER *EVP_des_ede3_cbc(void) { return &evp_des_ede3_cbc; } e_des.cc:_ZL17des_ede3_init_keyP17evp_cipher_ctx_stPKhS2_i: 97| 3.01k| const uint8_t *iv, int enc) { 98| 3.01k| DES_EDE_KEY *dat = (DES_EDE_KEY *)ctx->cipher_data; 99| 3.01k| DES_set_key_ex(key, &dat->ks.ks[0]); 100| 3.01k| DES_set_key_ex(key + 8, &dat->ks.ks[1]); 101| 3.01k| DES_set_key_ex(key + 16, &dat->ks.ks[2]); 102| 3.01k| return 1; 103| 3.01k|} EVP_aead_aes_128_cbc_sha1_tls: 577| 6.55k|const EVP_AEAD *EVP_aead_aes_128_cbc_sha1_tls(void) { 578| 6.55k| return &aead_aes_128_cbc_sha1_tls; 579| 6.55k|} EVP_aead_aes_128_cbc_sha1_tls_implicit_iv: 581| 202|const EVP_AEAD *EVP_aead_aes_128_cbc_sha1_tls_implicit_iv(void) { 582| 202| return &aead_aes_128_cbc_sha1_tls_implicit_iv; 583| 202|} EVP_aead_aes_256_cbc_sha1_tls: 589| 111k|const EVP_AEAD *EVP_aead_aes_256_cbc_sha1_tls(void) { 590| 111k| return &aead_aes_256_cbc_sha1_tls; 591| 111k|} EVP_aead_aes_256_cbc_sha1_tls_implicit_iv: 593| 3.49k|const EVP_AEAD *EVP_aead_aes_256_cbc_sha1_tls_implicit_iv(void) { 594| 3.49k| return &aead_aes_256_cbc_sha1_tls_implicit_iv; 595| 3.49k|} EVP_aead_des_ede3_cbc_sha1_tls: 597| 5.98k|const EVP_AEAD *EVP_aead_des_ede3_cbc_sha1_tls(void) { 598| 5.98k| return &aead_des_ede3_cbc_sha1_tls; 599| 5.98k|} EVP_aead_des_ede3_cbc_sha1_tls_implicit_iv: 601| 34|const EVP_AEAD *EVP_aead_des_ede3_cbc_sha1_tls_implicit_iv(void) { 602| 34| return &aead_des_ede3_cbc_sha1_tls_implicit_iv; 603| 34|} e_tls.cc:_ZL30aead_aes_128_cbc_sha1_tls_initP15evp_aead_ctx_stPKhmm20evp_aead_direction_t: 395| 3.27k| enum evp_aead_direction_t dir) { 396| 3.27k| return aead_tls_init(ctx, key, key_len, tag_len, dir, EVP_aes_128_cbc(), 397| 3.27k| EVP_sha1(), 0); 398| 3.27k|} e_tls.cc:_ZL13aead_tls_initP15evp_aead_ctx_stPKhmm20evp_aead_direction_tPK13evp_cipher_stPK9env_md_stc: 60| 64.0k| char implicit_iv) { 61| 64.0k| if (tag_len != EVP_AEAD_DEFAULT_TAG_LENGTH && tag_len != EVP_MD_size(md)) { ------------------ | | 252| 128k|#define EVP_AEAD_DEFAULT_TAG_LENGTH 0 ------------------ | Branch (61:7): [True: 0, False: 64.0k] | Branch (61:49): [True: 0, False: 0] ------------------ 62| 0| OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_UNSUPPORTED_TAG_SIZE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 63| 0| return 0; 64| 0| } 65| | 66| 64.0k| if (key_len != EVP_AEAD_key_length(ctx->aead)) { ------------------ | Branch (66:7): [True: 0, False: 64.0k] ------------------ 67| 0| OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_KEY_LENGTH); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 68| 0| return 0; 69| 0| } 70| | 71| 64.0k| size_t mac_key_len = EVP_MD_size(md); 72| 64.0k| size_t enc_key_len = EVP_CIPHER_key_length(cipher); 73| 64.0k| assert(mac_key_len + enc_key_len + 74| 64.0k| (implicit_iv ? EVP_CIPHER_iv_length(cipher) : 0) == 75| 64.0k| key_len); 76| | 77| 64.0k| AEAD_TLS_CTX *tls_ctx = (AEAD_TLS_CTX *)&ctx->state; 78| 64.0k| tls_ctx->hmac_ctx = HMAC_CTX_new(); 79| 64.0k| if (!tls_ctx->hmac_ctx) { ------------------ | Branch (79:7): [True: 0, False: 64.0k] ------------------ 80| 0| return 0; 81| 0| } 82| 64.0k| EVP_CIPHER_CTX_init(&tls_ctx->cipher_ctx); 83| 64.0k| assert(mac_key_len <= EVP_MAX_MD_SIZE); 84| 64.0k| OPENSSL_memcpy(tls_ctx->mac_key, key, mac_key_len); 85| 64.0k| tls_ctx->mac_key_len = (uint8_t)mac_key_len; 86| 64.0k| tls_ctx->implicit_iv = implicit_iv; 87| | 88| 64.0k| if (!EVP_CipherInit_ex(&tls_ctx->cipher_ctx, cipher, NULL, &key[mac_key_len], ------------------ | Branch (88:7): [True: 0, False: 64.0k] ------------------ 89| 64.0k| implicit_iv ? &key[mac_key_len + enc_key_len] : NULL, ------------------ | Branch (89:26): [True: 1.86k, False: 62.2k] ------------------ 90| 64.0k| dir == evp_aead_seal) || 91| 64.0k| !HMAC_Init_ex(tls_ctx->hmac_ctx, key, mac_key_len, md, NULL)) { ------------------ | Branch (91:7): [True: 0, False: 64.0k] ------------------ 92| 0| aead_tls_cleanup(ctx); 93| 0| return 0; 94| 0| } 95| 64.0k| EVP_CIPHER_CTX_set_padding(&tls_ctx->cipher_ctx, 0); 96| | 97| 64.0k| return 1; 98| 64.0k|} e_tls.cc:_ZL16aead_tls_cleanupP15evp_aead_ctx_st: 51| 64.0k|static void aead_tls_cleanup(EVP_AEAD_CTX *ctx) { 52| 64.0k| AEAD_TLS_CTX *tls_ctx = (AEAD_TLS_CTX *)&ctx->state; 53| 64.0k| EVP_CIPHER_CTX_cleanup(&tls_ctx->cipher_ctx); 54| 64.0k| HMAC_CTX_free(tls_ctx->hmac_ctx); 55| 64.0k|} e_tls.cc:_ZL42aead_aes_128_cbc_sha1_tls_implicit_iv_initP15evp_aead_ctx_stPKhmm20evp_aead_direction_t: 402| 101| enum evp_aead_direction_t dir) { 403| 101| return aead_tls_init(ctx, key, key_len, tag_len, dir, EVP_aes_128_cbc(), 404| 101| EVP_sha1(), 1); 405| 101|} e_tls.cc:_ZL30aead_aes_256_cbc_sha1_tls_initP15evp_aead_ctx_stPKhmm20evp_aead_direction_t: 417| 55.9k| enum evp_aead_direction_t dir) { 418| 55.9k| return aead_tls_init(ctx, key, key_len, tag_len, dir, EVP_aes_256_cbc(), 419| 55.9k| EVP_sha1(), 0); 420| 55.9k|} e_tls.cc:_ZL42aead_aes_256_cbc_sha1_tls_implicit_iv_initP15evp_aead_ctx_stPKhmm20evp_aead_direction_t: 424| 1.74k| enum evp_aead_direction_t dir) { 425| 1.74k| return aead_tls_init(ctx, key, key_len, tag_len, dir, EVP_aes_256_cbc(), 426| 1.74k| EVP_sha1(), 1); 427| 1.74k|} e_tls.cc:_ZL31aead_des_ede3_cbc_sha1_tls_initP15evp_aead_ctx_stPKhmm20evp_aead_direction_t: 432| 2.99k| enum evp_aead_direction_t dir) { 433| 2.99k| return aead_tls_init(ctx, key, key_len, tag_len, dir, EVP_des_ede3_cbc(), 434| 2.99k| EVP_sha1(), 0); 435| 2.99k|} e_tls.cc:_ZL43aead_des_ede3_cbc_sha1_tls_implicit_iv_initP15evp_aead_ctx_stPKhmm20evp_aead_direction_t: 439| 17| enum evp_aead_direction_t dir) { 440| 17| return aead_tls_init(ctx, key, key_len, tag_len, dir, EVP_des_ede3_cbc(), 441| 17| EVP_sha1(), 1); 442| 17|} OPENSSL_cpuid_setup: 149| 2|void OPENSSL_cpuid_setup(void) { 150| | // Determine the vendor and maximum input value. 151| 2| uint32_t eax, ebx, ecx, edx; 152| 2| OPENSSL_cpuid(&eax, &ebx, &ecx, &edx, 0); 153| | 154| 2| uint32_t num_ids = eax; 155| | 156| 2| int is_intel = ebx == 0x756e6547 /* Genu */ && // ------------------ | Branch (156:18): [True: 0, False: 2] ------------------ 157| 2| edx == 0x49656e69 /* ineI */ && // ------------------ | Branch (157:18): [True: 0, False: 0] ------------------ 158| 2| ecx == 0x6c65746e /* ntel */; ------------------ | Branch (158:18): [True: 0, False: 0] ------------------ 159| 2| int is_amd = ebx == 0x68747541 /* Auth */ && // ------------------ | Branch (159:16): [True: 2, False: 0] ------------------ 160| 2| edx == 0x69746e65 /* enti */ && // ------------------ | Branch (160:16): [True: 2, False: 0] ------------------ 161| 2| ecx == 0x444d4163 /* cAMD */; ------------------ | Branch (161:16): [True: 2, False: 0] ------------------ 162| | 163| 2| uint32_t extended_features[2] = {0}; 164| 2| if (num_ids >= 7) { ------------------ | Branch (164:7): [True: 2, False: 0] ------------------ 165| 2| OPENSSL_cpuid(&eax, &ebx, &ecx, &edx, 7); 166| 2| extended_features[0] = ebx; 167| 2| extended_features[1] = ecx; 168| 2| } 169| | 170| 2| OPENSSL_cpuid(&eax, &ebx, &ecx, &edx, 1); 171| | 172| 2| const uint32_t base_family = (eax >> 8) & 15; 173| 2| const uint32_t base_model = (eax >> 4) & 15; 174| | 175| 2| uint32_t family = base_family; 176| 2| uint32_t model = base_model; 177| 2| if (base_family == 15) { ------------------ | Branch (177:7): [True: 2, False: 0] ------------------ 178| 2| const uint32_t ext_family = (eax >> 20) & 255; 179| 2| family += ext_family; 180| 2| } 181| 2| if (base_family == 6 || base_family == 15) { ------------------ | Branch (181:7): [True: 0, False: 2] | Branch (181:27): [True: 2, False: 0] ------------------ 182| 2| const uint32_t ext_model = (eax >> 16) & 15; 183| 2| model |= ext_model << 4; 184| 2| } 185| | 186| 2| if (is_amd) { ------------------ | Branch (186:7): [True: 2, False: 0] ------------------ 187| 2| if (family < 0x17 || (family == 0x17 && 0x70 <= model && model <= 0x7f)) { ------------------ | Branch (187:9): [True: 0, False: 2] | Branch (187:27): [True: 2, False: 0] | Branch (187:45): [True: 0, False: 2] | Branch (187:62): [True: 0, False: 0] ------------------ 188| | // Disable RDRAND on AMD families before 0x17 (Zen) due to reported 189| | // failures after suspend. 190| | // https://bugzilla.redhat.com/show_bug.cgi?id=1150286 191| | // Also disable for family 0x17, models 0x70–0x7f, due to possible RDRAND 192| | // failures there too. 193| 0| ecx &= ~(1u << 30); 194| 0| } 195| 2| } 196| | 197| | // Reserved bit #30 is repurposed to signal an Intel CPU. 198| 2| if (is_intel) { ------------------ | Branch (198:7): [True: 0, False: 2] ------------------ 199| 0| edx |= (1u << 30); 200| 2| } else { 201| 2| edx &= ~(1u << 30); 202| 2| } 203| | 204| 2| uint64_t xcr0 = 0; 205| 2| if (ecx & (1u << 27)) { ------------------ | Branch (205:7): [True: 2, False: 0] ------------------ 206| | // XCR0 may only be queried if the OSXSAVE bit is set. 207| 2| xcr0 = OPENSSL_xgetbv(0); 208| 2| } 209| | // See Intel manual, volume 1, section 14.3. 210| 2| if ((xcr0 & 6) != 6) { ------------------ | Branch (210:7): [True: 0, False: 2] ------------------ 211| | // YMM registers cannot be used. 212| 0| ecx &= ~(1u << 28); // AVX 213| 0| ecx &= ~(1u << 12); // FMA 214| 0| ecx &= ~(1u << 11); // AMD XOP 215| 0| extended_features[0] &= ~(1u << 5); // AVX2 216| 0| extended_features[1] &= ~(1u << 9); // VAES 217| 0| extended_features[1] &= ~(1u << 10); // VPCLMULQDQ 218| 0| } 219| | // See Intel manual, volume 1, sections 15.2 ("Detection of AVX-512 Foundation 220| | // Instructions") through 15.4 ("Detection of Intel AVX-512 Instruction Groups 221| | // Operating at 256 and 128-bit Vector Lengths"). 222| 2| if (!os_supports_avx512(xcr0)) { ------------------ | Branch (222:7): [True: 2, False: 0] ------------------ 223| | // Without XCR0.111xx11x, no AVX512 feature can be used. This includes ZMM 224| | // registers, masking, SIMD registers 16-31 (even if accessed as YMM or 225| | // XMM), and EVEX-coded instructions (even on YMM or XMM). Even if only 226| | // XCR0.ZMM_Hi256 is missing, it isn't valid to use AVX512 features on 227| | // shorter vectors, since AVX512 ties everything to the availability of 228| | // 512-bit vectors. See the above-mentioned sections of the Intel manual, 229| | // which say that *all* these XCR0 bits must be checked even when just using 230| | // 128-bit or 256-bit vectors, and also volume 2a section 2.7.11 ("#UD 231| | // Equations for EVEX") which says that all EVEX-coded instructions raise an 232| | // undefined-instruction exception if any of these XCR0 bits is zero. 233| 2| extended_features[0] &= ~(1u << 16); // AVX512F 234| 2| extended_features[0] &= ~(1u << 17); // AVX512DQ 235| 2| extended_features[0] &= ~(1u << 21); // AVX512IFMA 236| 2| extended_features[0] &= ~(1u << 26); // AVX512PF 237| 2| extended_features[0] &= ~(1u << 27); // AVX512ER 238| 2| extended_features[0] &= ~(1u << 28); // AVX512CD 239| 2| extended_features[0] &= ~(1u << 30); // AVX512BW 240| 2| extended_features[0] &= ~(1u << 31); // AVX512VL 241| 2| extended_features[1] &= ~(1u << 1); // AVX512VBMI 242| 2| extended_features[1] &= ~(1u << 6); // AVX512VBMI2 243| 2| extended_features[1] &= ~(1u << 11); // AVX512VNNI 244| 2| extended_features[1] &= ~(1u << 12); // AVX512BITALG 245| 2| extended_features[1] &= ~(1u << 14); // AVX512VPOPCNTDQ 246| 2| } 247| | 248| | // Repurpose the bit for the removed MPX feature to indicate when using zmm 249| | // registers should be avoided even when they are supported. (When set, AVX512 250| | // features can still be used, but only using ymm or xmm registers.) Skylake 251| | // suffered from severe downclocking when zmm registers were used, which 252| | // affected unrelated code running on the system, making zmm registers not too 253| | // useful outside of benchmarks. The situation improved significantly by Ice 254| | // Lake, but a small amount of downclocking remained. (See 255| | // https://lore.kernel.org/linux-crypto/e8ce1146-3952-6977-1d0e-a22758e58914@intel.com/) 256| | // We take a conservative approach of not allowing zmm registers until after 257| | // Ice Lake and Tiger Lake, i.e. until Sapphire Rapids on the server side. 258| | // 259| | // AMD CPUs, which support AVX512 starting with Zen 4, have not been reported 260| | // to have any downclocking problem when zmm registers are used. 261| 2| if (is_intel && family == 6 && ------------------ | Branch (261:7): [True: 0, False: 2] | Branch (261:19): [True: 0, False: 0] ------------------ 262| 2| (model == 85 || // Skylake, Cascade Lake, Cooper Lake (server) ------------------ | Branch (262:8): [True: 0, False: 0] ------------------ 263| 0| model == 106 || // Ice Lake (server) ------------------ | Branch (263:8): [True: 0, False: 0] ------------------ 264| 0| model == 108 || // Ice Lake (micro server) ------------------ | Branch (264:8): [True: 0, False: 0] ------------------ 265| 0| model == 125 || // Ice Lake (client) ------------------ | Branch (265:8): [True: 0, False: 0] ------------------ 266| 0| model == 126 || // Ice Lake (mobile) ------------------ | Branch (266:8): [True: 0, False: 0] ------------------ 267| 0| model == 140 || // Tiger Lake (mobile) ------------------ | Branch (267:8): [True: 0, False: 0] ------------------ 268| 0| model == 141)) { // Tiger Lake (client) ------------------ | Branch (268:8): [True: 0, False: 0] ------------------ 269| 0| extended_features[0] |= 1u << 14; 270| 2| } else { 271| 2| extended_features[0] &= ~(1u << 14); 272| 2| } 273| | 274| 2| OPENSSL_ia32cap_P[0] = edx; 275| 2| OPENSSL_ia32cap_P[1] = ecx; 276| 2| OPENSSL_ia32cap_P[2] = extended_features[0]; 277| 2| OPENSSL_ia32cap_P[3] = extended_features[1]; 278| | 279| 2| const char *env = getenv("OPENSSL_ia32cap"); 280| 2| if (env != nullptr) { ------------------ | Branch (280:7): [True: 0, False: 2] ------------------ 281| 0| OPENSSL_adjust_ia32cap(OPENSSL_ia32cap_P, env); 282| 0| } 283| 2|} cpu_intel.cc:_ZL13OPENSSL_cpuidPjS_S_S_j: 38| 6| uint32_t *out_ecx, uint32_t *out_edx, uint32_t leaf) { 39| |#if defined(_MSC_VER) 40| | int tmp[4]; 41| | __cpuid(tmp, (int)leaf); 42| | *out_eax = (uint32_t)tmp[0]; 43| | *out_ebx = (uint32_t)tmp[1]; 44| | *out_ecx = (uint32_t)tmp[2]; 45| | *out_edx = (uint32_t)tmp[3]; 46| |#elif defined(__pic__) && defined(OPENSSL_32_BIT) 47| | // Inline assembly may not clobber the PIC register. For 32-bit, this is EBX. 48| | // See https://gcc.gnu.org/bugzilla/show_bug.cgi?id=47602. 49| | __asm__ volatile( 50| | "xor %%ecx, %%ecx\n" 51| | "mov %%ebx, %%edi\n" 52| | "cpuid\n" 53| | "xchg %%edi, %%ebx\n" 54| | : "=a"(*out_eax), "=D"(*out_ebx), "=c"(*out_ecx), "=d"(*out_edx) 55| | : "a"(leaf)); 56| |#else 57| 6| __asm__ volatile( 58| 6| "xor %%ecx, %%ecx\n" 59| 6| "cpuid\n" 60| 6| : "=a"(*out_eax), "=b"(*out_ebx), "=c"(*out_ecx), "=d"(*out_edx) 61| 6| : "a"(leaf)); 62| 6|#endif 63| 6|} cpu_intel.cc:_ZL14OPENSSL_xgetbvj: 67| 2|static uint64_t OPENSSL_xgetbv(uint32_t xcr) { 68| |#if defined(_MSC_VER) 69| | return (uint64_t)_xgetbv(xcr); 70| |#else 71| 2| uint32_t eax, edx; 72| 2| __asm__ volatile("xgetbv" : "=a"(eax), "=d"(edx) : "c"(xcr)); 73| 2| return (((uint64_t)edx) << 32) | eax; 74| 2|#endif 75| 2|} cpu_intel.cc:_ZL18os_supports_avx512m: 77| 2|static bool os_supports_avx512(uint64_t xcr0) { 78| |#if defined(__APPLE__) 79| | // The Darwin kernel had a bug where it could corrupt the opmask registers. 80| | // See 81| | // https://community.intel.com/t5/Software-Tuning-Performance/MacOS-Darwin-kernel-bug-clobbers-AVX-512-opmask-register-state/m-p/1327259 82| | // Darwin also does not initially set the XCR0 bits for AVX512, but they are 83| | // set if the thread tries to use AVX512 anyway. Thus, to safely and 84| | // consistently use AVX512 on macOS we'd need to check the kernel version as 85| | // well as detect AVX512 support using a macOS-specific method. We don't 86| | // bother with this, especially given Apple's transition to arm64. 87| | return false; 88| |#else 89| 2| return (xcr0 & 0xe6) == 0xe6; 90| 2|#endif 91| 2|} OPENSSL_get_ia32cap: 65| 24.8M|uint32_t OPENSSL_get_ia32cap(int idx) { 66| 24.8M| OPENSSL_init_cpuid(); 67| 24.8M| return OPENSSL_ia32cap_P[idx]; 68| 24.8M|} OPENSSL_init_cpuid: 87| 24.8M|void OPENSSL_init_cpuid(void) { CRYPTO_once(&once, OPENSSL_cpuid_setup); } x25519_ge_scalarmult_base: 794| 133k|void x25519_ge_scalarmult_base(ge_p3 *h, const uint8_t a[32]) { 795| 133k|#if defined(BORINGSSL_FE25519_ADX) 796| 133k| if (CRYPTO_is_BMI1_capable() && CRYPTO_is_BMI2_capable() && ------------------ | Branch (796:7): [True: 133k, False: 0] | Branch (796:35): [True: 133k, False: 0] ------------------ 797| 133k| CRYPTO_is_ADX_capable()) { ------------------ | Branch (797:7): [True: 133k, False: 0] ------------------ 798| 133k| uint8_t t[4][32]; 799| 133k| x25519_ge_scalarmult_base_adx(t, a); 800| 133k| fiat_25519_from_bytes(h->X.v, t[0]); 801| 133k| fiat_25519_from_bytes(h->Y.v, t[1]); 802| 133k| fiat_25519_from_bytes(h->Z.v, t[2]); 803| 133k| fiat_25519_from_bytes(h->T.v, t[3]); 804| 133k| return; 805| 133k| } 806| 0|#endif 807| 0| signed char e[64]; 808| 0| signed char carry; 809| 0| ge_p1p1 r; 810| 0| ge_p2 s; 811| 0| ge_precomp t; 812| 0| int i; 813| | 814| 0| for (i = 0; i < 32; ++i) { ------------------ | Branch (814:15): [True: 0, False: 0] ------------------ 815| 0| e[2 * i + 0] = (a[i] >> 0) & 15; 816| 0| e[2 * i + 1] = (a[i] >> 4) & 15; 817| 0| } 818| | // each e[i] is between 0 and 15 819| | // e[63] is between 0 and 7 820| | 821| 0| carry = 0; 822| 0| for (i = 0; i < 63; ++i) { ------------------ | Branch (822:15): [True: 0, False: 0] ------------------ 823| 0| e[i] += carry; 824| 0| carry = e[i] + 8; 825| 0| carry >>= 4; 826| 0| e[i] -= carry << 4; 827| 0| } 828| 0| e[63] += carry; 829| | // each e[i] is between -8 and 8 830| | 831| 0| ge_p3_0(h); 832| 0| for (i = 1; i < 64; i += 2) { ------------------ | Branch (832:15): [True: 0, False: 0] ------------------ 833| 0| table_select(&t, i / 2, e[i]); 834| 0| ge_madd(&r, h, &t); 835| 0| x25519_ge_p1p1_to_p3(h, &r); 836| 0| } 837| | 838| 0| ge_p3_dbl(&r, h); 839| 0| x25519_ge_p1p1_to_p2(&s, &r); 840| 0| ge_p2_dbl(&r, &s); 841| 0| x25519_ge_p1p1_to_p2(&s, &r); 842| 0| ge_p2_dbl(&r, &s); 843| 0| x25519_ge_p1p1_to_p2(&s, &r); 844| 0| ge_p2_dbl(&r, &s); 845| 0| x25519_ge_p1p1_to_p3(h, &r); 846| | 847| 0| for (i = 0; i < 64; i += 2) { ------------------ | Branch (847:15): [True: 0, False: 0] ------------------ 848| 0| table_select(&t, i / 2, e[i]); 849| 0| ge_madd(&r, h, &t); 850| 0| x25519_ge_p1p1_to_p3(h, &r); 851| 0| } 852| 0|} X25519_keypair: 2093| 133k|void X25519_keypair(uint8_t out_public_value[32], uint8_t out_private_key[32]) { 2094| 133k| RAND_bytes(out_private_key, 32); 2095| | 2096| | // All X25519 implementations should decode scalars correctly (see 2097| | // https://tools.ietf.org/html/rfc7748#section-5). However, if an 2098| | // implementation doesn't then it might interoperate with random keys a 2099| | // fraction of the time because they'll, randomly, happen to be correctly 2100| | // formed. 2101| | // 2102| | // Thus we do the opposite of the masking here to make sure that our private 2103| | // keys are never correctly masked and so, hopefully, any incorrect 2104| | // implementations are deterministically broken. 2105| | // 2106| | // This does not affect security because, although we're throwing away 2107| | // entropy, a valid implementation of scalarmult should throw away the exact 2108| | // same bits anyway. 2109| 133k| out_private_key[0] |= ~248; 2110| 133k| out_private_key[31] &= ~64; 2111| 133k| out_private_key[31] |= ~127; 2112| | 2113| 133k| X25519_public_from_private(out_public_value, out_private_key); 2114| 133k|} X25519: 2117| 21.0k| const uint8_t peer_public_value[32]) { 2118| 21.0k| static const uint8_t kZeros[32] = {0}; 2119| 21.0k| x25519_scalar_mult(out_shared_key, private_key, peer_public_value); 2120| | // The all-zero output results when the input is a point of small order. 2121| 21.0k| return constant_time_declassify_int( 2122| 21.0k| CRYPTO_memcmp(kZeros, out_shared_key, 32)) != 0; 2123| 21.0k|} X25519_public_from_private: 2126| 133k| const uint8_t private_key[32]) { 2127| |#if defined(BORINGSSL_X25519_NEON) 2128| | if (CRYPTO_is_NEON_capable()) { 2129| | static const uint8_t kMongomeryBasePoint[32] = {9}; 2130| | x25519_NEON(out_public_value, private_key, kMongomeryBasePoint); 2131| | return; 2132| | } 2133| |#endif 2134| | 2135| 133k| uint8_t e[32]; 2136| 133k| OPENSSL_memcpy(e, private_key, 32); 2137| 133k| e[0] &= 248; 2138| 133k| e[31] &= 127; 2139| 133k| e[31] |= 64; 2140| | 2141| 133k| ge_p3 A; 2142| 133k| x25519_ge_scalarmult_base(&A, e); 2143| | 2144| | // We only need the u-coordinate of the curve25519 point. The map is 2145| | // u=(y+1)/(1-y). Since y=Y/Z, this gives u=(Z+Y)/(Z-Y). 2146| 133k| fe_loose zplusy, zminusy; 2147| 133k| fe zminusy_inv; 2148| 133k| fe_add(&zplusy, &A.Z, &A.Y); 2149| 133k| fe_sub(&zminusy, &A.Z, &A.Y); 2150| 133k| fe_loose_invert(&zminusy_inv, &zminusy); 2151| 133k| fe_mul_tlt(&zminusy_inv, &zplusy, &zminusy_inv); 2152| 133k| fe_tobytes(out_public_value, &zminusy_inv); 2153| 133k| CONSTTIME_DECLASSIFY(out_public_value, 32); 2154| 133k|} curve25519.cc:_ZL10fe_mul_tttP2fePKS_S2_: 227| 1.33M|static void fe_mul_ttt(fe *h, const fe *f, const fe *g) { 228| 1.33M| fe_mul_impl(h->v, f->v, g->v); 229| 1.33M|} curve25519.cc:_ZL11fe_mul_implPmPKmS1_: 212| 1.60M| const fe_limb_t in2[FE_NUM_LIMBS]) { 213| 1.60M| assert_fe_loose(in1); ------------------ | | 99| 1.60M| do { \ | | 100| 9.61M| for (unsigned _assert_fe_i = 0; _assert_fe_i < 5; _assert_fe_i++) { \ | | ------------------ | | | Branch (100:37): [True: 8.00M, False: 1.60M] | | ------------------ | | 101| 8.00M| declassify_assert(f[_assert_fe_i] <= UINT64_C(0x1a666666666664)); \ | | ------------------ | | | | 493| 8.00M|#define declassify_assert(expr) assert(constant_time_declassify_int(expr)) | | ------------------ | | 102| 8.00M| } \ | | 103| 1.60M| } while (0) | | ------------------ | | | Branch (103:12): [Folded - Ignored] | | ------------------ ------------------ 214| 1.60M| assert_fe_loose(in2); ------------------ | | 99| 1.60M| do { \ | | 100| 9.61M| for (unsigned _assert_fe_i = 0; _assert_fe_i < 5; _assert_fe_i++) { \ | | ------------------ | | | Branch (100:37): [True: 8.00M, False: 1.60M] | | ------------------ | | 101| 8.00M| declassify_assert(f[_assert_fe_i] <= UINT64_C(0x1a666666666664)); \ | | ------------------ | | | | 493| 8.00M|#define declassify_assert(expr) assert(constant_time_declassify_int(expr)) | | ------------------ | | 102| 8.00M| } \ | | 103| 1.60M| } while (0) | | ------------------ | | | Branch (103:12): [Folded - Ignored] | | ------------------ ------------------ 215| 1.60M| fiat_25519_carry_mul(out, in1, in2); 216| 1.60M| assert_fe(out); ------------------ | | 82| 1.60M| do { \ | | 83| 9.61M| for (unsigned _assert_fe_i = 0; _assert_fe_i < 5; _assert_fe_i++) { \ | | ------------------ | | | Branch (83:37): [True: 8.00M, False: 1.60M] | | ------------------ | | 84| 8.00M| declassify_assert(f[_assert_fe_i] <= UINT64_C(0x8cccccccccccc)); \ | | ------------------ | | | | 493| 8.00M|#define declassify_assert(expr) assert(constant_time_declassify_int(expr)) | | ------------------ | | 85| 8.00M| } \ | | 86| 1.60M| } while (0) | | ------------------ | | | Branch (86:12): [Folded - Ignored] | | ------------------ ------------------ 217| 1.60M|} curve25519.cc:_ZL10fe_tobytesPhPK2fe: 165| 133k|static void fe_tobytes(uint8_t s[32], const fe *f) { 166| 133k| assert_fe(f->v); ------------------ | | 82| 133k| do { \ | | 83| 800k| for (unsigned _assert_fe_i = 0; _assert_fe_i < 5; _assert_fe_i++) { \ | | ------------------ | | | Branch (83:37): [True: 667k, False: 133k] | | ------------------ | | 84| 667k| declassify_assert(f[_assert_fe_i] <= UINT64_C(0x8cccccccccccc)); \ | | ------------------ | | | | 493| 667k|#define declassify_assert(expr) assert(constant_time_declassify_int(expr)) | | ------------------ | | 85| 667k| } \ | | 86| 133k| } while (0) | | ------------------ | | | Branch (86:12): [Folded - Ignored] | | ------------------ ------------------ 167| 133k| fiat_25519_to_bytes(s, f->v); 168| 133k|} curve25519.cc:_ZL8fe_sq_ttP2fePKS_: 249| 33.7M|static void fe_sq_tt(fe *h, const fe *f) { 250| 33.7M| assert_fe_loose(f->v); ------------------ | | 99| 33.7M| do { \ | | 100| 202M| for (unsigned _assert_fe_i = 0; _assert_fe_i < 5; _assert_fe_i++) { \ | | ------------------ | | | Branch (100:37): [True: 168M, False: 33.7M] | | ------------------ | | 101| 168M| declassify_assert(f[_assert_fe_i] <= UINT64_C(0x1a666666666664)); \ | | ------------------ | | | | 493| 168M|#define declassify_assert(expr) assert(constant_time_declassify_int(expr)) | | ------------------ | | 102| 168M| } \ | | 103| 33.7M| } while (0) | | ------------------ | | | Branch (103:12): [Folded - Ignored] | | ------------------ ------------------ 251| 33.7M| fiat_25519_carry_square(h->v, f->v); 252| 33.7M| assert_fe(h->v); ------------------ | | 82| 33.7M| do { \ | | 83| 202M| for (unsigned _assert_fe_i = 0; _assert_fe_i < 5; _assert_fe_i++) { \ | | ------------------ | | | Branch (83:37): [True: 168M, False: 33.7M] | | ------------------ | | 84| 168M| declassify_assert(f[_assert_fe_i] <= UINT64_C(0x8cccccccccccc)); \ | | ------------------ | | | | 493| 168M|#define declassify_assert(expr) assert(constant_time_declassify_int(expr)) | | ------------------ | | 85| 168M| } \ | | 86| 33.7M| } while (0) | | ------------------ | | | Branch (86:12): [Folded - Ignored] | | ------------------ ------------------ 253| 33.7M|} curve25519.cc:_ZL6fe_subP8fe_loosePK2feS3_: 197| 133k|static void fe_sub(fe_loose *h, const fe *f, const fe *g) { 198| 133k| assert_fe(f->v); ------------------ | | 82| 133k| do { \ | | 83| 800k| for (unsigned _assert_fe_i = 0; _assert_fe_i < 5; _assert_fe_i++) { \ | | ------------------ | | | Branch (83:37): [True: 667k, False: 133k] | | ------------------ | | 84| 667k| declassify_assert(f[_assert_fe_i] <= UINT64_C(0x8cccccccccccc)); \ | | ------------------ | | | | 493| 667k|#define declassify_assert(expr) assert(constant_time_declassify_int(expr)) | | ------------------ | | 85| 667k| } \ | | 86| 133k| } while (0) | | ------------------ | | | Branch (86:12): [Folded - Ignored] | | ------------------ ------------------ 199| 133k| assert_fe(g->v); ------------------ | | 82| 133k| do { \ | | 83| 800k| for (unsigned _assert_fe_i = 0; _assert_fe_i < 5; _assert_fe_i++) { \ | | ------------------ | | | Branch (83:37): [True: 667k, False: 133k] | | ------------------ | | 84| 667k| declassify_assert(f[_assert_fe_i] <= UINT64_C(0x8cccccccccccc)); \ | | ------------------ | | | | 493| 667k|#define declassify_assert(expr) assert(constant_time_declassify_int(expr)) | | ------------------ | | 85| 667k| } \ | | 86| 133k| } while (0) | | ------------------ | | | Branch (86:12): [Folded - Ignored] | | ------------------ ------------------ 200| 133k| fiat_25519_sub(h->v, f->v, g->v); 201| 133k| assert_fe_loose(h->v); ------------------ | | 99| 133k| do { \ | | 100| 800k| for (unsigned _assert_fe_i = 0; _assert_fe_i < 5; _assert_fe_i++) { \ | | ------------------ | | | Branch (100:37): [True: 667k, False: 133k] | | ------------------ | | 101| 667k| declassify_assert(f[_assert_fe_i] <= UINT64_C(0x1a666666666664)); \ | | ------------------ | | | | 493| 667k|#define declassify_assert(expr) assert(constant_time_declassify_int(expr)) | | ------------------ | | 102| 667k| } \ | | 103| 133k| } while (0) | | ------------------ | | | Branch (103:12): [Folded - Ignored] | | ------------------ ------------------ 202| 133k|} curve25519.cc:_ZL6fe_addP8fe_loosePK2feS3_: 188| 133k|static void fe_add(fe_loose *h, const fe *f, const fe *g) { 189| 133k| assert_fe(f->v); ------------------ | | 82| 133k| do { \ | | 83| 800k| for (unsigned _assert_fe_i = 0; _assert_fe_i < 5; _assert_fe_i++) { \ | | ------------------ | | | Branch (83:37): [True: 667k, False: 133k] | | ------------------ | | 84| 667k| declassify_assert(f[_assert_fe_i] <= UINT64_C(0x8cccccccccccc)); \ | | ------------------ | | | | 493| 667k|#define declassify_assert(expr) assert(constant_time_declassify_int(expr)) | | ------------------ | | 85| 667k| } \ | | 86| 133k| } while (0) | | ------------------ | | | Branch (86:12): [Folded - Ignored] | | ------------------ ------------------ 190| 133k| assert_fe(g->v); ------------------ | | 82| 133k| do { \ | | 83| 800k| for (unsigned _assert_fe_i = 0; _assert_fe_i < 5; _assert_fe_i++) { \ | | ------------------ | | | Branch (83:37): [True: 667k, False: 133k] | | ------------------ | | 84| 667k| declassify_assert(f[_assert_fe_i] <= UINT64_C(0x8cccccccccccc)); \ | | ------------------ | | | | 493| 667k|#define declassify_assert(expr) assert(constant_time_declassify_int(expr)) | | ------------------ | | 85| 667k| } \ | | 86| 133k| } while (0) | | ------------------ | | | Branch (86:12): [Folded - Ignored] | | ------------------ ------------------ 191| 133k| fiat_25519_add(h->v, f->v, g->v); 192| 133k| assert_fe_loose(h->v); ------------------ | | 99| 133k| do { \ | | 100| 800k| for (unsigned _assert_fe_i = 0; _assert_fe_i < 5; _assert_fe_i++) { \ | | ------------------ | | | Branch (100:37): [True: 667k, False: 133k] | | ------------------ | | 101| 667k| declassify_assert(f[_assert_fe_i] <= UINT64_C(0x1a666666666664)); \ | | ------------------ | | | | 493| 667k|#define declassify_assert(expr) assert(constant_time_declassify_int(expr)) | | ------------------ | | 102| 667k| } \ | | 103| 133k| } while (0) | | ------------------ | | | Branch (103:12): [Folded - Ignored] | | ------------------ ------------------ 193| 133k|} curve25519.cc:_ZL10fe_mul_tltP2fePK8fe_loosePKS_: 231| 266k|static void fe_mul_tlt(fe *h, const fe_loose *f, const fe *g) { 232| 266k| fe_mul_impl(h->v, f->v, g->v); 233| 266k|} curve25519.cc:_ZL8fe_sq_tlP2fePK8fe_loose: 243| 133k|static void fe_sq_tl(fe *h, const fe_loose *f) { 244| 133k| assert_fe_loose(f->v); ------------------ | | 99| 133k| do { \ | | 100| 800k| for (unsigned _assert_fe_i = 0; _assert_fe_i < 5; _assert_fe_i++) { \ | | ------------------ | | | Branch (100:37): [True: 667k, False: 133k] | | ------------------ | | 101| 667k| declassify_assert(f[_assert_fe_i] <= UINT64_C(0x1a666666666664)); \ | | ------------------ | | | | 493| 667k|#define declassify_assert(expr) assert(constant_time_declassify_int(expr)) | | ------------------ | | 102| 667k| } \ | | 103| 133k| } while (0) | | ------------------ | | | Branch (103:12): [Folded - Ignored] | | ------------------ ------------------ 245| 133k| fiat_25519_carry_square(h->v, f->v); 246| 133k| assert_fe(h->v); ------------------ | | 82| 133k| do { \ | | 83| 800k| for (unsigned _assert_fe_i = 0; _assert_fe_i < 5; _assert_fe_i++) { \ | | ------------------ | | | Branch (83:37): [True: 667k, False: 133k] | | ------------------ | | 84| 667k| declassify_assert(f[_assert_fe_i] <= UINT64_C(0x8cccccccccccc)); \ | | ------------------ | | | | 493| 667k|#define declassify_assert(expr) assert(constant_time_declassify_int(expr)) | | ------------------ | | 85| 667k| } \ | | 86| 133k| } while (0) | | ------------------ | | | Branch (86:12): [Folded - Ignored] | | ------------------ ------------------ 247| 133k|} curve25519.cc:_ZL18x25519_scalar_multPhPKhS1_: 2076| 21.0k| const uint8_t point[32]) { 2077| |#if defined(BORINGSSL_X25519_NEON) 2078| | if (CRYPTO_is_NEON_capable()) { 2079| | x25519_NEON(out, scalar, point); 2080| | return; 2081| | } 2082| |#elif defined(BORINGSSL_FE25519_ADX) 2083| 21.0k| if (CRYPTO_is_BMI1_capable() && CRYPTO_is_BMI2_capable() && ------------------ | Branch (2083:7): [True: 21.0k, False: 0] | Branch (2083:35): [True: 21.0k, False: 0] ------------------ 2084| 21.0k| CRYPTO_is_ADX_capable()) { ------------------ | Branch (2084:7): [True: 21.0k, False: 0] ------------------ 2085| 21.0k| x25519_scalar_mult_adx(out, scalar, point); 2086| 21.0k| return; 2087| 21.0k| } 2088| 0|#endif 2089| | 2090| 0| x25519_scalar_mult_generic(out, scalar, point); 2091| 0|} curve25519.cc:_ZL15fe_loose_invertP2fePK8fe_loose: 309| 133k|static void fe_loose_invert(fe *out, const fe_loose *z) { 310| 133k| fe t0; 311| 133k| fe t1; 312| 133k| fe t2; 313| 133k| fe t3; 314| 133k| int i; 315| | 316| 133k| fe_sq_tl(&t0, z); 317| 133k| fe_sq_tt(&t1, &t0); 318| 266k| for (i = 1; i < 2; ++i) { ------------------ | Branch (318:15): [True: 133k, False: 133k] ------------------ 319| 133k| fe_sq_tt(&t1, &t1); 320| 133k| } 321| 133k| fe_mul_tlt(&t1, z, &t1); 322| 133k| fe_mul_ttt(&t0, &t0, &t1); 323| 133k| fe_sq_tt(&t2, &t0); 324| 133k| fe_mul_ttt(&t1, &t1, &t2); 325| 133k| fe_sq_tt(&t2, &t1); 326| 667k| for (i = 1; i < 5; ++i) { ------------------ | Branch (326:15): [True: 533k, False: 133k] ------------------ 327| 533k| fe_sq_tt(&t2, &t2); 328| 533k| } 329| 133k| fe_mul_ttt(&t1, &t2, &t1); 330| 133k| fe_sq_tt(&t2, &t1); 331| 1.33M| for (i = 1; i < 10; ++i) { ------------------ | Branch (331:15): [True: 1.20M, False: 133k] ------------------ 332| 1.20M| fe_sq_tt(&t2, &t2); 333| 1.20M| } 334| 133k| fe_mul_ttt(&t2, &t2, &t1); 335| 133k| fe_sq_tt(&t3, &t2); 336| 2.66M| for (i = 1; i < 20; ++i) { ------------------ | Branch (336:15): [True: 2.53M, False: 133k] ------------------ 337| 2.53M| fe_sq_tt(&t3, &t3); 338| 2.53M| } 339| 133k| fe_mul_ttt(&t2, &t3, &t2); 340| 133k| fe_sq_tt(&t2, &t2); 341| 1.33M| for (i = 1; i < 10; ++i) { ------------------ | Branch (341:15): [True: 1.20M, False: 133k] ------------------ 342| 1.20M| fe_sq_tt(&t2, &t2); 343| 1.20M| } 344| 133k| fe_mul_ttt(&t1, &t2, &t1); 345| 133k| fe_sq_tt(&t2, &t1); 346| 6.67M| for (i = 1; i < 50; ++i) { ------------------ | Branch (346:15): [True: 6.54M, False: 133k] ------------------ 347| 6.54M| fe_sq_tt(&t2, &t2); 348| 6.54M| } 349| 133k| fe_mul_ttt(&t2, &t2, &t1); 350| 133k| fe_sq_tt(&t3, &t2); 351| 13.3M| for (i = 1; i < 100; ++i) { ------------------ | Branch (351:15): [True: 13.2M, False: 133k] ------------------ 352| 13.2M| fe_sq_tt(&t3, &t3); 353| 13.2M| } 354| 133k| fe_mul_ttt(&t2, &t3, &t2); 355| 133k| fe_sq_tt(&t2, &t2); 356| 6.67M| for (i = 1; i < 50; ++i) { ------------------ | Branch (356:15): [True: 6.54M, False: 133k] ------------------ 357| 6.54M| fe_sq_tt(&t2, &t2); 358| 6.54M| } 359| 133k| fe_mul_ttt(&t1, &t2, &t1); 360| 133k| fe_sq_tt(&t1, &t1); 361| 667k| for (i = 1; i < 5; ++i) { ------------------ | Branch (361:15): [True: 533k, False: 133k] ------------------ 362| 533k| fe_sq_tt(&t1, &t1); 363| 533k| } 364| 133k| fe_mul_ttt(out, &t1, &t0); 365| 133k|} DES_set_key_ex: 343| 9.03k|void DES_set_key_ex(const uint8_t key[8], DES_key_schedule *schedule) { 344| 9.03k| static const int shifts2[16] = {0, 0, 1, 1, 1, 1, 1, 1, 345| 9.03k| 0, 1, 1, 1, 1, 1, 1, 0}; 346| 9.03k| uint32_t c, d, t, s, t2; 347| 9.03k| const uint8_t *in; 348| 9.03k| int i; 349| | 350| 9.03k| in = key; 351| | 352| 9.03k| c2l(in, c); ------------------ | | 32| 9.03k| do { \ | | 33| 9.03k| (l) = ((uint32_t)(*((c)++))); \ | | 34| 9.03k| (l) |= ((uint32_t)(*((c)++))) << 8L; \ | | 35| 9.03k| (l) |= ((uint32_t)(*((c)++))) << 16L; \ | | 36| 9.03k| (l) |= ((uint32_t)(*((c)++))) << 24L; \ | | 37| 9.03k| } while (0) | | ------------------ | | | Branch (37:12): [Folded - Ignored] | | ------------------ ------------------ 353| 9.03k| c2l(in, d); ------------------ | | 32| 9.03k| do { \ | | 33| 9.03k| (l) = ((uint32_t)(*((c)++))); \ | | 34| 9.03k| (l) |= ((uint32_t)(*((c)++))) << 8L; \ | | 35| 9.03k| (l) |= ((uint32_t)(*((c)++))) << 16L; \ | | 36| 9.03k| (l) |= ((uint32_t)(*((c)++))) << 24L; \ | | 37| 9.03k| } while (0) | | ------------------ | | | Branch (37:12): [Folded - Ignored] | | ------------------ ------------------ 354| | 355| | // do PC1 in 47 simple operations :-) 356| | // Thanks to John Fletcher (john_fletcher@lccmail.ocf.llnl.gov) 357| | // for the inspiration. :-) 358| 9.03k| PERM_OP(d, c, t, 4, 0x0f0f0f0f); ------------------ | | 60| 9.03k| do { \ | | 61| 9.03k| (t) = ((((a) >> (n)) ^ (b)) & (m)); \ | | 62| 9.03k| (b) ^= (t); \ | | 63| 9.03k| (a) ^= ((t) << (n)); \ | | 64| 9.03k| } while (0) | | ------------------ | | | Branch (64:12): [Folded - Ignored] | | ------------------ ------------------ 359| 9.03k| HPERM_OP(c, t, -2, 0xcccc0000); ------------------ | | 336| 9.03k| ((t) = ((((a) << (16 - (n))) ^ (a)) & (m)), \ | | 337| 9.03k| (a) = (a) ^ (t) ^ ((t) >> (16 - (n)))) ------------------ 360| 9.03k| HPERM_OP(d, t, -2, 0xcccc0000); ------------------ | | 336| 9.03k| ((t) = ((((a) << (16 - (n))) ^ (a)) & (m)), \ | | 337| 9.03k| (a) = (a) ^ (t) ^ ((t) >> (16 - (n)))) ------------------ 361| 9.03k| PERM_OP(d, c, t, 1, 0x55555555); ------------------ | | 60| 9.03k| do { \ | | 61| 9.03k| (t) = ((((a) >> (n)) ^ (b)) & (m)); \ | | 62| 9.03k| (b) ^= (t); \ | | 63| 9.03k| (a) ^= ((t) << (n)); \ | | 64| 9.03k| } while (0) | | ------------------ | | | Branch (64:12): [Folded - Ignored] | | ------------------ ------------------ 362| 9.03k| PERM_OP(c, d, t, 8, 0x00ff00ff); ------------------ | | 60| 9.03k| do { \ | | 61| 9.03k| (t) = ((((a) >> (n)) ^ (b)) & (m)); \ | | 62| 9.03k| (b) ^= (t); \ | | 63| 9.03k| (a) ^= ((t) << (n)); \ | | 64| 9.03k| } while (0) | | ------------------ | | | Branch (64:12): [Folded - Ignored] | | ------------------ ------------------ 363| 9.03k| PERM_OP(d, c, t, 1, 0x55555555); ------------------ | | 60| 9.03k| do { \ | | 61| 9.03k| (t) = ((((a) >> (n)) ^ (b)) & (m)); \ | | 62| 9.03k| (b) ^= (t); \ | | 63| 9.03k| (a) ^= ((t) << (n)); \ | | 64| 9.03k| } while (0) | | ------------------ | | | Branch (64:12): [Folded - Ignored] | | ------------------ ------------------ 364| 9.03k| d = (((d & 0x000000ff) << 16) | (d & 0x0000ff00) | 365| 9.03k| ((d & 0x00ff0000) >> 16) | ((c & 0xf0000000) >> 4)); 366| 9.03k| c &= 0x0fffffff; 367| | 368| 153k| for (i = 0; i < ITERATIONS; i++) { ------------------ | | 104| 153k|#define ITERATIONS 16 ------------------ | Branch (368:15): [True: 144k, False: 9.03k] ------------------ 369| 144k| if (shifts2[i]) { ------------------ | Branch (369:9): [True: 108k, False: 36.1k] ------------------ 370| 108k| c = ((c >> 2) | (c << 26)); 371| 108k| d = ((d >> 2) | (d << 26)); 372| 108k| } else { 373| 36.1k| c = ((c >> 1) | (c << 27)); 374| 36.1k| d = ((d >> 1) | (d << 27)); 375| 36.1k| } 376| 144k| c &= 0x0fffffff; 377| 144k| d &= 0x0fffffff; 378| | // could be a few less shifts but I am to lazy at this 379| | // point in time to investigate 380| 144k| s = des_skb[0][(c) & 0x3f] | 381| 144k| des_skb[1][((c >> 6) & 0x03) | ((c >> 7) & 0x3c)] | 382| 144k| des_skb[2][((c >> 13) & 0x0f) | ((c >> 14) & 0x30)] | 383| 144k| des_skb[3][((c >> 20) & 0x01) | ((c >> 21) & 0x06) | 384| 144k| ((c >> 22) & 0x38)]; 385| 144k| t = des_skb[4][(d) & 0x3f] | 386| 144k| des_skb[5][((d >> 7) & 0x03) | ((d >> 8) & 0x3c)] | 387| 144k| des_skb[6][(d >> 15) & 0x3f] | 388| 144k| des_skb[7][((d >> 21) & 0x0f) | ((d >> 22) & 0x30)]; 389| | 390| | // table contained 0213 4657 391| 144k| t2 = ((t << 16) | (s & 0x0000ffff)) & 0xffffffff; 392| 144k| schedule->subkeys[i][0] = CRYPTO_rotr_u32(t2, 30); 393| | 394| 144k| t2 = ((s >> 16) | (t & 0xffff0000)); 395| 144k| schedule->subkeys[i][1] = CRYPTO_rotr_u32(t2, 26); 396| 144k| } 397| 9.03k|} EVP_md5: 283| 3.80k|const EVP_MD *EVP_md5(void) { return &evp_md_md5; } EVP_md5_sha1: 322| 211k|const EVP_MD *EVP_md5_sha1(void) { return &evp_md_md5_sha1; } digest_extra.cc:_ZL8md5_initP13env_md_ctx_st: 265| 7.61k|static void md5_init(EVP_MD_CTX *ctx) { 266| 7.61k| BSSL_CHECK(MD5_Init(reinterpret_cast(ctx->md_data))); ------------------ | | 384| 7.61k| do { \ | | 385| 7.61k| if (!(condition)) { \ | | ------------------ | | | Branch (385:9): [True: 0, False: 7.61k] | | ------------------ | | 386| 0| abort(); \ | | 387| 0| } \ | | 388| 7.61k| } while (0); | | ------------------ | | | Branch (388:12): [Folded - Ignored] | | ------------------ ------------------ 267| 7.61k|} digest_extra.cc:_ZL10md5_updateP13env_md_ctx_stPKvm: 269| 99.3k|static void md5_update(EVP_MD_CTX *ctx, const void *data, size_t count) { 270| 99.3k| BSSL_CHECK( ------------------ | | 384| 99.3k| do { \ | | 385| 99.3k| if (!(condition)) { \ | | ------------------ | | | Branch (385:9): [True: 0, False: 99.3k] | | ------------------ | | 386| 0| abort(); \ | | 387| 0| } \ | | 388| 99.3k| } while (0); | | ------------------ | | | Branch (388:12): [Folded - Ignored] | | ------------------ ------------------ 271| 99.3k| MD5_Update(reinterpret_cast(ctx->md_data), data, count)); 272| 99.3k|} digest_extra.cc:_ZL9md5_finalP13env_md_ctx_stPh: 274| 53.5k|static void md5_final(EVP_MD_CTX *ctx, uint8_t *out) { 275| 53.5k| BSSL_CHECK(MD5_Final(out, reinterpret_cast(ctx->md_data))); ------------------ | | 384| 53.5k| do { \ | | 385| 53.5k| if (!(condition)) { \ | | ------------------ | | | Branch (385:9): [True: 0, False: 53.5k] | | ------------------ | | 386| 0| abort(); \ | | 387| 0| } \ | | 388| 53.5k| } while (0); | | ------------------ | | | Branch (388:12): [Folded - Ignored] | | ------------------ ------------------ 276| 53.5k|} digest_extra.cc:_ZL13md5_sha1_initP13env_md_ctx_st: 293| 2.11k|static void md5_sha1_init(EVP_MD_CTX *md_ctx) { 294| 2.11k| MD5_SHA1_CTX *ctx = reinterpret_cast(md_ctx->md_data); 295| 2.11k| BSSL_CHECK(MD5_Init(&ctx->md5) && SHA1_Init(&ctx->sha1)); ------------------ | | 384| 2.11k| do { \ | | 385| 4.23k| if (!(condition)) { \ | | ------------------ | | | Branch (385:11): [True: 2.11k, False: 0] | | | Branch (385:11): [True: 2.11k, False: 0] | | ------------------ | | 386| 0| abort(); \ | | 387| 0| } \ | | 388| 2.11k| } while (0); | | ------------------ | | | Branch (388:12): [Folded - Ignored] | | ------------------ ------------------ 296| 2.11k|} digest_extra.cc:_ZL15md5_sha1_updateP13env_md_ctx_stPKvm: 299| 10.0k| size_t count) { 300| 10.0k| MD5_SHA1_CTX *ctx = reinterpret_cast(md_ctx->md_data); 301| 10.0k| BSSL_CHECK(MD5_Update(&ctx->md5, data, count) && ------------------ | | 384| 10.0k| do { \ | | 385| 20.1k| if (!(condition)) { \ | | ------------------ | | | Branch (385:11): [True: 10.0k, False: 0] | | | Branch (385:11): [True: 10.0k, False: 0] | | ------------------ | | 386| 0| abort(); \ | | 387| 0| } \ | | 388| 10.0k| } while (0); | | ------------------ | | | Branch (388:12): [Folded - Ignored] | | ------------------ ------------------ 302| 10.0k| SHA1_Update(&ctx->sha1, data, count)); 303| 10.0k|} digest_extra.cc:_ZL14md5_sha1_finalP13env_md_ctx_stPh: 305| 4.74k|static void md5_sha1_final(EVP_MD_CTX *md_ctx, uint8_t *out) { 306| 4.74k| MD5_SHA1_CTX *ctx = reinterpret_cast(md_ctx->md_data); 307| 4.74k| BSSL_CHECK(MD5_Final(out, &ctx->md5) && ------------------ | | 384| 4.74k| do { \ | | 385| 9.49k| if (!(condition)) { \ | | ------------------ | | | Branch (385:11): [True: 4.74k, False: 0] | | | Branch (385:11): [True: 4.74k, False: 0] | | ------------------ | | 386| 0| abort(); \ | | 387| 0| } \ | | 388| 4.74k| } while (0); | | ------------------ | | | Branch (388:12): [Folded - Ignored] | | ------------------ ------------------ 308| 4.74k| SHA1_Final(out + MD5_DIGEST_LENGTH, &ctx->sha1)); 309| 4.74k|} DSA_new: 48| 280|DSA *DSA_new(void) { 49| 280| DSA *dsa = reinterpret_cast(OPENSSL_zalloc(sizeof(DSA))); 50| 280| if (dsa == NULL) { ------------------ | Branch (50:7): [True: 0, False: 280] ------------------ 51| 0| return NULL; 52| 0| } 53| | 54| 280| dsa->references = 1; 55| 280| CRYPTO_MUTEX_init(&dsa->method_mont_lock); 56| 280| CRYPTO_new_ex_data(&dsa->ex_data); 57| 280| return dsa; 58| 280|} DSA_free: 60| 560|void DSA_free(DSA *dsa) { 61| 560| if (dsa == NULL) { ------------------ | Branch (61:7): [True: 280, False: 280] ------------------ 62| 280| return; 63| 280| } 64| | 65| 280| if (!CRYPTO_refcount_dec_and_test_zero(&dsa->references)) { ------------------ | Branch (65:7): [True: 0, False: 280] ------------------ 66| 0| return; 67| 0| } 68| | 69| 280| CRYPTO_free_ex_data(&g_ex_data_class, &dsa->ex_data); 70| | 71| 280| BN_clear_free(dsa->p); 72| 280| BN_clear_free(dsa->q); 73| 280| BN_clear_free(dsa->g); 74| 280| BN_clear_free(dsa->pub_key); 75| 280| BN_clear_free(dsa->priv_key); 76| 280| BN_MONT_CTX_free(dsa->method_mont_p); 77| 280| BN_MONT_CTX_free(dsa->method_mont_q); 78| 280| CRYPTO_MUTEX_cleanup(&dsa->method_mont_lock); 79| 280| OPENSSL_free(dsa); 80| 280|} DSA_parse_parameters: 173| 280|DSA *DSA_parse_parameters(CBS *cbs) { 174| 280| bssl::UniquePtr ret(DSA_new()); 175| 280| if (ret == nullptr) { ------------------ | Branch (175:7): [True: 0, False: 280] ------------------ 176| 0| return nullptr; 177| 0| } 178| 280| CBS child; 179| 280| if (!CBS_get_asn1(cbs, &child, CBS_ASN1_SEQUENCE) || ------------------ | | 223| 280|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED) | | ------------------ | | | | 197| 280|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | | | ------------------ | | | | | | 194| 280|#define CBS_ASN1_TAG_SHIFT 24 | | | | ------------------ | | ------------------ ------------------ | Branch (179:7): [True: 241, False: 39] ------------------ 180| 280| !parse_integer(&child, &ret->p) || ------------------ | Branch (180:7): [True: 36, False: 3] ------------------ 181| 280| !parse_integer(&child, &ret->q) || ------------------ | Branch (181:7): [True: 2, False: 1] ------------------ 182| 280| !parse_integer(&child, &ret->g) || ------------------ | Branch (182:7): [True: 1, False: 0] ------------------ 183| 280| CBS_len(&child) != 0) { ------------------ | Branch (183:7): [True: 0, False: 0] ------------------ 184| 280| OPENSSL_PUT_ERROR(DSA, DSA_R_DECODE_ERROR); ------------------ | | 361| 280| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 185| 280| return nullptr; 186| 280| } 187| 0| if (!dsa_check_key(ret.get())) { ------------------ | Branch (187:7): [True: 0, False: 0] ------------------ 188| 0| return nullptr; 189| 0| } 190| 0| return ret.release(); 191| 0|} dsa_asn1.cc:_ZL13parse_integerP6cbs_stPP9bignum_st: 91| 43|static int parse_integer(CBS *cbs, BIGNUM **out) { 92| 43| assert(*out == NULL); 93| 43| *out = BN_new(); 94| 43| if (*out == NULL) { ------------------ | Branch (94:7): [True: 0, False: 43] ------------------ 95| 0| return 0; 96| 0| } 97| 43| return BN_parse_asn1_unsigned(cbs, *out); 98| 43|} EC_KEY_parse_private_key: 47| 2|EC_KEY *EC_KEY_parse_private_key(CBS *cbs, const EC_GROUP *group) { 48| 2| CBS ec_private_key, private_key; 49| 2| uint64_t version; 50| 2| if (!CBS_get_asn1(cbs, &ec_private_key, CBS_ASN1_SEQUENCE) || ------------------ | | 223| 2|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED) | | ------------------ | | | | 197| 2|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | | | ------------------ | | | | | | 194| 2|#define CBS_ASN1_TAG_SHIFT 24 | | | | ------------------ | | ------------------ ------------------ | Branch (50:7): [True: 0, False: 2] ------------------ 51| 2| !CBS_get_asn1_uint64(&ec_private_key, &version) || // ------------------ | Branch (51:7): [True: 0, False: 2] ------------------ 52| 2| version != 1 || ------------------ | Branch (52:7): [True: 0, False: 2] ------------------ 53| 2| !CBS_get_asn1(&ec_private_key, &private_key, CBS_ASN1_OCTETSTRING)) { ------------------ | | 218| 2|#define CBS_ASN1_OCTETSTRING 0x4u ------------------ | Branch (53:7): [True: 0, False: 2] ------------------ 54| 0| OPENSSL_PUT_ERROR(EC, EC_R_DECODE_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 55| 0| return nullptr; 56| 0| } 57| | 58| | // Parse the optional parameters field. 59| 2| if (CBS_peek_asn1_tag(&ec_private_key, kParametersTag)) { ------------------ | Branch (59:7): [True: 0, False: 2] ------------------ 60| | // Per SEC 1, as an alternative to omitting it, one is allowed to specify 61| | // this field and put in a NULL to mean inheriting this value. This was 62| | // omitted in a previous version of this logic without problems, so leave it 63| | // unimplemented. 64| 0| CBS child; 65| 0| if (!CBS_get_asn1(&ec_private_key, &child, kParametersTag)) { ------------------ | Branch (65:9): [True: 0, False: 0] ------------------ 66| 0| OPENSSL_PUT_ERROR(EC, EC_R_DECODE_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 67| 0| return nullptr; 68| 0| } 69| 0| const EC_GROUP *inner_group = EC_KEY_parse_parameters(&child); 70| 0| if (inner_group == nullptr) { ------------------ | Branch (70:9): [True: 0, False: 0] ------------------ 71| 0| return nullptr; 72| 0| } 73| 0| if (group == nullptr) { ------------------ | Branch (73:9): [True: 0, False: 0] ------------------ 74| 0| group = inner_group; 75| 0| } else if (EC_GROUP_cmp(group, inner_group, nullptr) != 0) { ------------------ | Branch (75:16): [True: 0, False: 0] ------------------ 76| | // If a group was supplied externally, it must match. 77| 0| OPENSSL_PUT_ERROR(EC, EC_R_GROUP_MISMATCH); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 78| 0| return nullptr; 79| 0| } 80| 0| if (CBS_len(&child) != 0) { ------------------ | Branch (80:9): [True: 0, False: 0] ------------------ 81| 0| OPENSSL_PUT_ERROR(EC, EC_R_DECODE_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 82| 0| return nullptr; 83| 0| } 84| 0| } 85| | 86| 2| if (group == nullptr) { ------------------ | Branch (86:7): [True: 0, False: 2] ------------------ 87| 0| OPENSSL_PUT_ERROR(EC, EC_R_MISSING_PARAMETERS); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 88| 0| return nullptr; 89| 0| } 90| | 91| 2| bssl::UniquePtr ret(EC_KEY_new()); 92| 2| if (ret == nullptr || !EC_KEY_set_group(ret.get(), group)) { ------------------ | Branch (92:7): [True: 0, False: 2] | Branch (92:25): [True: 0, False: 2] ------------------ 93| 0| return nullptr; 94| 0| } 95| | 96| | // Although RFC 5915 specifies the length of the key, OpenSSL historically 97| | // got this wrong, so accept any length. See upstream's 98| | // 30cd4ff294252c4b6a4b69cbef6a5b4117705d22. 99| 2| bssl::UniquePtr priv_key( 100| 2| BN_bin2bn(CBS_data(&private_key), CBS_len(&private_key), nullptr)); 101| 2| ret->pub_key = EC_POINT_new(group); 102| 2| if (priv_key == nullptr || ret->pub_key == nullptr || ------------------ | Branch (102:7): [True: 0, False: 2] | Branch (102:30): [True: 0, False: 2] ------------------ 103| 2| !EC_KEY_set_private_key(ret.get(), priv_key.get())) { ------------------ | Branch (103:7): [True: 0, False: 2] ------------------ 104| 0| return nullptr; 105| 0| } 106| | 107| 2| if (CBS_peek_asn1_tag(&ec_private_key, kPublicKeyTag)) { ------------------ | Branch (107:7): [True: 2, False: 0] ------------------ 108| 2| CBS child, public_key; 109| 2| uint8_t padding; 110| 2| if (!CBS_get_asn1(&ec_private_key, &child, kPublicKeyTag) || ------------------ | Branch (110:9): [True: 0, False: 2] ------------------ 111| 2| !CBS_get_asn1(&child, &public_key, CBS_ASN1_BITSTRING) || ------------------ | | 217| 2|#define CBS_ASN1_BITSTRING 0x3u ------------------ | Branch (111:9): [True: 0, False: 2] ------------------ 112| | // As in a SubjectPublicKeyInfo, the byte-encoded public key is then 113| | // encoded as a BIT STRING with bits ordered as in the DER encoding. 114| 2| !CBS_get_u8(&public_key, &padding) || // ------------------ | Branch (114:9): [True: 0, False: 2] ------------------ 115| 2| padding != 0 || ------------------ | Branch (115:9): [True: 0, False: 2] ------------------ 116| | // Explicitly check |public_key| is non-empty to save the conversion 117| | // form later. 118| 2| CBS_len(&public_key) == 0 || ------------------ | Branch (118:9): [True: 0, False: 2] ------------------ 119| 2| !EC_POINT_oct2point(group, ret->pub_key, CBS_data(&public_key), ------------------ | Branch (119:9): [True: 0, False: 2] ------------------ 120| 2| CBS_len(&public_key), nullptr) || 121| 2| CBS_len(&child) != 0) { ------------------ | Branch (121:9): [True: 0, False: 2] ------------------ 122| 0| OPENSSL_PUT_ERROR(EC, EC_R_DECODE_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 123| 0| return nullptr; 124| 0| } 125| | 126| | // Save the point conversion form. 127| | // TODO(davidben): Consider removing this. 128| 2| ret->conv_form = 129| 2| (point_conversion_form_t)(CBS_data(&public_key)[0] & ~0x01); 130| 2| } else { 131| | // Compute the public key instead. 132| 0| if (!ec_point_mul_scalar_base(group, &ret->pub_key->raw, ------------------ | Branch (132:9): [True: 0, False: 0] ------------------ 133| 0| &ret->priv_key->scalar)) { 134| 0| return nullptr; 135| 0| } 136| | // Remember the original private-key-only encoding. 137| | // TODO(davidben): Consider removing this. 138| 0| ret->enc_flag |= EC_PKEY_NO_PUBKEY; ------------------ | | 94| 0|#define EC_PKEY_NO_PUBKEY 0x002 ------------------ 139| 0| } 140| | 141| 2| if (CBS_len(&ec_private_key) != 0) { ------------------ | Branch (141:7): [True: 0, False: 2] ------------------ 142| 0| OPENSSL_PUT_ERROR(EC, EC_R_DECODE_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 143| 0| return nullptr; 144| 0| } 145| | 146| | // Ensure the resulting key is valid. 147| 2| if (!EC_KEY_check_key(ret.get())) { ------------------ | Branch (147:7): [True: 0, False: 2] ------------------ 148| 0| return nullptr; 149| 0| } 150| | 151| 2| return ret.release(); 152| 2|} EC_KEY_parse_curve_name: 299| 36.0k|EC_GROUP *EC_KEY_parse_curve_name(CBS *cbs) { 300| 36.0k| CBS named_curve; 301| 36.0k| if (!CBS_get_asn1(cbs, &named_curve, CBS_ASN1_OBJECT)) { ------------------ | | 220| 36.0k|#define CBS_ASN1_OBJECT 0x6u ------------------ | Branch (301:7): [True: 4.19k, False: 31.8k] ------------------ 302| 4.19k| OPENSSL_PUT_ERROR(EC, EC_R_DECODE_ERROR); ------------------ | | 361| 4.19k| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 303| 4.19k| return NULL; 304| 4.19k| } 305| | 306| | // Look for a matching curve. 307| 65.6k| for (size_t i = 0; i < OPENSSL_ARRAY_SIZE(kAllGroups); i++) { ------------------ | | 103| 65.6k|#define OPENSSL_ARRAY_SIZE(array) (sizeof(array) / sizeof((array)[0])) ------------------ | Branch (307:22): [True: 65.4k, False: 241] ------------------ 308| 65.4k| const EC_GROUP *group = kAllGroups[i](); 309| 65.4k| if (CBS_mem_equal(&named_curve, group->oid, group->oid_len)) { ------------------ | Branch (309:9): [True: 31.6k, False: 33.8k] ------------------ 310| 31.6k| return (EC_GROUP *)group; 311| 31.6k| } 312| 65.4k| } 313| | 314| 241| OPENSSL_PUT_ERROR(EC, EC_R_UNKNOWN_GROUP); ------------------ | | 361| 241| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 315| 241| return NULL; 316| 31.8k|} EC_KEY_parse_parameters: 327| 2|EC_GROUP *EC_KEY_parse_parameters(CBS *cbs) { 328| 2| if (!CBS_peek_asn1_tag(cbs, CBS_ASN1_SEQUENCE)) { ------------------ | | 223| 2|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED) | | ------------------ | | | | 197| 2|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | | | ------------------ | | | | | | 194| 2|#define CBS_ASN1_TAG_SHIFT 24 | | | | ------------------ | | ------------------ ------------------ | Branch (328:7): [True: 2, False: 0] ------------------ 329| 2| return EC_KEY_parse_curve_name(cbs); 330| 2| } 331| | 332| | // OpenSSL sometimes produces ECPrivateKeys with explicitly-encoded versions 333| | // of named curves. 334| | // 335| | // TODO(davidben): Remove support for this. 336| 0| struct explicit_prime_curve curve; 337| 0| if (!parse_explicit_prime_curve(cbs, &curve)) { ------------------ | Branch (337:7): [True: 0, False: 0] ------------------ 338| 0| return nullptr; 339| 0| } 340| | 341| 0| bssl::UniquePtr p(BN_new()); 342| 0| bssl::UniquePtr a(BN_new()); 343| 0| bssl::UniquePtr b(BN_new()); 344| 0| bssl::UniquePtr x(BN_new()); 345| 0| bssl::UniquePtr y(BN_new()); 346| 0| if (p == nullptr || a == nullptr || b == nullptr || x == nullptr || ------------------ | Branch (346:7): [True: 0, False: 0] | Branch (346:23): [True: 0, False: 0] | Branch (346:39): [True: 0, False: 0] | Branch (346:55): [True: 0, False: 0] ------------------ 347| 0| y == nullptr) { ------------------ | Branch (347:7): [True: 0, False: 0] ------------------ 348| 0| return nullptr; 349| 0| } 350| | 351| 0| for (size_t i = 0; i < OPENSSL_ARRAY_SIZE(kAllGroups); i++) { ------------------ | | 103| 0|#define OPENSSL_ARRAY_SIZE(array) (sizeof(array) / sizeof((array)[0])) ------------------ | Branch (351:22): [True: 0, False: 0] ------------------ 352| 0| const EC_GROUP *group = kAllGroups[i](); 353| 0| if (!integers_equal(&curve.order, EC_GROUP_get0_order(group))) { ------------------ | Branch (353:9): [True: 0, False: 0] ------------------ 354| 0| continue; 355| 0| } 356| | 357| | // The order alone uniquely identifies the group, but we check the other 358| | // parameters to avoid misinterpreting the group. 359| 0| if (!EC_GROUP_get_curve_GFp(group, p.get(), a.get(), b.get(), nullptr)) { ------------------ | Branch (359:9): [True: 0, False: 0] ------------------ 360| 0| return nullptr; 361| 0| } 362| 0| if (!integers_equal(&curve.prime, p.get()) || ------------------ | Branch (362:9): [True: 0, False: 0] ------------------ 363| 0| !integers_equal(&curve.a, a.get()) || ------------------ | Branch (363:9): [True: 0, False: 0] ------------------ 364| 0| !integers_equal(&curve.b, b.get())) { ------------------ | Branch (364:9): [True: 0, False: 0] ------------------ 365| 0| break; 366| 0| } 367| 0| if (!EC_POINT_get_affine_coordinates_GFp( ------------------ | Branch (367:9): [True: 0, False: 0] ------------------ 368| 0| group, EC_GROUP_get0_generator(group), x.get(), y.get(), nullptr)) { 369| 0| return nullptr; 370| 0| } 371| 0| if (!integers_equal(&curve.base_x, x.get()) || ------------------ | Branch (371:9): [True: 0, False: 0] ------------------ 372| 0| !integers_equal(&curve.base_y, y.get())) { ------------------ | Branch (372:9): [True: 0, False: 0] ------------------ 373| 0| break; 374| 0| } 375| 0| return const_cast(group); 376| 0| } 377| | 378| 0| OPENSSL_PUT_ERROR(EC, EC_R_UNKNOWN_GROUP); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 379| 0| return nullptr; 380| 0|} EC_POINT_point2cbb: 383| 29.7k| point_conversion_form_t form, BN_CTX *ctx) { 384| 29.7k| size_t len = EC_POINT_point2oct(group, point, form, NULL, 0, ctx); 385| 29.7k| if (len == 0) { ------------------ | Branch (385:7): [True: 0, False: 29.7k] ------------------ 386| 0| return 0; 387| 0| } 388| 29.7k| uint8_t *p; 389| 29.7k| return CBB_add_space(out, &p, len) && ------------------ | Branch (389:10): [True: 29.7k, False: 0] ------------------ 390| 29.7k| EC_POINT_point2oct(group, point, form, p, len, ctx) == len; ------------------ | Branch (390:10): [True: 29.7k, False: 0] ------------------ 391| 29.7k|} ECDSA_verify: 108| 14.2k| const uint8_t *sig, size_t sig_len, const EC_KEY *eckey) { 109| | // Decode the ECDSA signature. 110| | // 111| | // TODO(davidben): We can actually do better and go straight from the DER 112| | // format to the fixed-width format without a malloc. 113| 14.2k| int ret = 0; 114| 14.2k| uint8_t *der = nullptr; 115| 14.2k| bssl::UniquePtr s(ECDSA_SIG_from_bytes(sig, sig_len)); 116| 14.2k| if (s == nullptr) { ------------------ | Branch (116:7): [True: 7.36k, False: 6.87k] ------------------ 117| 7.36k| goto err; 118| 7.36k| } 119| | 120| | // Defend against potential laxness in the DER parser. 121| 6.87k| size_t der_len; 122| 6.87k| if (!ECDSA_SIG_to_bytes(&der, &der_len, s.get()) || der_len != sig_len || ------------------ | Branch (122:7): [True: 0, False: 6.87k] | Branch (122:55): [True: 0, False: 6.87k] ------------------ 123| 6.87k| OPENSSL_memcmp(sig, der, sig_len) != 0) { ------------------ | Branch (123:7): [True: 0, False: 6.87k] ------------------ 124| | // This should never happen. crypto/bytestring is strictly DER. 125| 0| OPENSSL_PUT_ERROR(ECDSA, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 126| 0| goto err; 127| 0| } 128| | 129| 6.87k| uint8_t fixed[ECDSA_MAX_FIXED_LEN]; 130| 6.87k| size_t fixed_len; 131| 6.87k| ret = ecdsa_sig_to_fixed(eckey, fixed, &fixed_len, sizeof(fixed), s.get()) && ------------------ | Branch (131:9): [True: 4.93k, False: 1.93k] ------------------ 132| 6.87k| ecdsa_verify_fixed(digest, digest_len, fixed, fixed_len, eckey); ------------------ | Branch (132:9): [True: 0, False: 4.93k] ------------------ 133| | 134| 14.2k|err: 135| 14.2k| OPENSSL_free(der); 136| 14.2k| return ret; 137| 6.87k|} ECDSA_SIG_new: 154| 14.3k|ECDSA_SIG *ECDSA_SIG_new(void) { 155| 14.3k| ECDSA_SIG *sig = 156| 14.3k| reinterpret_cast(OPENSSL_malloc(sizeof(ECDSA_SIG))); 157| 14.3k| if (sig == NULL) { ------------------ | Branch (157:7): [True: 0, False: 14.3k] ------------------ 158| 0| return NULL; 159| 0| } 160| 14.3k| sig->r = BN_new(); 161| 14.3k| sig->s = BN_new(); 162| 14.3k| if (sig->r == NULL || sig->s == NULL) { ------------------ | Branch (162:7): [True: 0, False: 14.3k] | Branch (162:25): [True: 0, False: 14.3k] ------------------ 163| 0| ECDSA_SIG_free(sig); 164| 0| return NULL; 165| 0| } 166| 14.3k| return sig; 167| 14.3k|} ECDSA_SIG_free: 169| 21.6k|void ECDSA_SIG_free(ECDSA_SIG *sig) { 170| 21.6k| if (sig == NULL) { ------------------ | Branch (170:7): [True: 7.35k, False: 14.3k] ------------------ 171| 7.35k| return; 172| 7.35k| } 173| | 174| 14.3k| BN_free(sig->r); 175| 14.3k| BN_free(sig->s); 176| 14.3k| OPENSSL_free(sig); 177| 14.3k|} ECDSA_do_sign: 229| 107| const EC_KEY *eckey) { 230| 107| uint8_t sig[ECDSA_MAX_FIXED_LEN]; 231| 107| size_t sig_len; 232| 107| if (!ecdsa_sign_fixed(digest, digest_len, sig, &sig_len, sizeof(sig), ------------------ | Branch (232:7): [True: 0, False: 107] ------------------ 233| 107| eckey)) { 234| 0| return NULL; 235| 0| } 236| | 237| 107| return ecdsa_sig_from_fixed(eckey, sig, sig_len); 238| 107|} ECDSA_SIG_parse: 240| 14.2k|ECDSA_SIG *ECDSA_SIG_parse(CBS *cbs) { 241| 14.2k| ECDSA_SIG *ret = ECDSA_SIG_new(); 242| 14.2k| if (ret == NULL) { ------------------ | Branch (242:7): [True: 0, False: 14.2k] ------------------ 243| 0| return NULL; 244| 0| } 245| 14.2k| CBS child; 246| 14.2k| if (!CBS_get_asn1(cbs, &child, CBS_ASN1_SEQUENCE) || ------------------ | | 223| 14.2k|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED) | | ------------------ | | | | 197| 14.2k|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | | | ------------------ | | | | | | 194| 14.2k|#define CBS_ASN1_TAG_SHIFT 24 | | | | ------------------ | | ------------------ ------------------ | Branch (246:7): [True: 2.93k, False: 11.2k] ------------------ 247| 14.2k| !BN_parse_asn1_unsigned(&child, ret->r) || ------------------ | Branch (247:7): [True: 160, False: 11.1k] ------------------ 248| 14.2k| !BN_parse_asn1_unsigned(&child, ret->s) || CBS_len(&child) != 0) { ------------------ | Branch (248:7): [True: 4.23k, False: 6.90k] | Branch (248:50): [True: 30, False: 6.87k] ------------------ 249| 7.35k| OPENSSL_PUT_ERROR(ECDSA, ECDSA_R_BAD_SIGNATURE); ------------------ | | 361| 7.35k| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 250| 7.35k| ECDSA_SIG_free(ret); 251| 7.35k| return NULL; 252| 7.35k| } 253| 6.87k| return ret; 254| 14.2k|} ECDSA_SIG_from_bytes: 256| 14.2k|ECDSA_SIG *ECDSA_SIG_from_bytes(const uint8_t *in, size_t in_len) { 257| 14.2k| CBS cbs; 258| 14.2k| CBS_init(&cbs, in, in_len); 259| 14.2k| ECDSA_SIG *ret = ECDSA_SIG_parse(&cbs); 260| 14.2k| if (ret == NULL || CBS_len(&cbs) != 0) { ------------------ | Branch (260:7): [True: 7.35k, False: 6.87k] | Branch (260:22): [True: 1, False: 6.87k] ------------------ 261| 7.36k| OPENSSL_PUT_ERROR(ECDSA, ECDSA_R_BAD_SIGNATURE); ------------------ | | 361| 7.36k| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 262| 7.36k| ECDSA_SIG_free(ret); 263| 7.36k| return NULL; 264| 7.36k| } 265| 6.87k| return ret; 266| 14.2k|} ECDSA_SIG_marshal: 268| 6.87k|int ECDSA_SIG_marshal(CBB *cbb, const ECDSA_SIG *sig) { 269| 6.87k| CBB child; 270| 6.87k| if (!CBB_add_asn1(cbb, &child, CBS_ASN1_SEQUENCE) || ------------------ | | 223| 6.87k|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED) | | ------------------ | | | | 197| 6.87k|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | | | ------------------ | | | | | | 194| 6.87k|#define CBS_ASN1_TAG_SHIFT 24 | | | | ------------------ | | ------------------ ------------------ | Branch (270:7): [True: 0, False: 6.87k] ------------------ 271| 6.87k| !BN_marshal_asn1(&child, sig->r) || !BN_marshal_asn1(&child, sig->s) || ------------------ | Branch (271:7): [True: 0, False: 6.87k] | Branch (271:43): [True: 0, False: 6.87k] ------------------ 272| 6.87k| !CBB_flush(cbb)) { ------------------ | Branch (272:7): [True: 0, False: 6.87k] ------------------ 273| 0| OPENSSL_PUT_ERROR(ECDSA, ECDSA_R_ENCODE_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 274| 0| return 0; 275| 0| } 276| 6.87k| return 1; 277| 6.87k|} ECDSA_SIG_to_bytes: 280| 6.87k| const ECDSA_SIG *sig) { 281| 6.87k| CBB cbb; 282| 6.87k| CBB_zero(&cbb); 283| 6.87k| if (!CBB_init(&cbb, 0) || !ECDSA_SIG_marshal(&cbb, sig) || ------------------ | Branch (283:7): [True: 0, False: 6.87k] | Branch (283:29): [True: 0, False: 6.87k] ------------------ 284| 6.87k| !CBB_finish(&cbb, out_bytes, out_len)) { ------------------ | Branch (284:7): [True: 0, False: 6.87k] ------------------ 285| 0| OPENSSL_PUT_ERROR(ECDSA, ECDSA_R_ENCODE_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 286| 0| CBB_cleanup(&cbb); 287| 0| return 0; 288| 0| } 289| 6.87k| return 1; 290| 6.87k|} ecdsa_asn1.cc:_ZL20ecdsa_sig_from_fixedPK9ec_key_stPKhm: 32| 107| size_t len) { 33| 107| const EC_GROUP *group = EC_KEY_get0_group(key); 34| 107| if (group == NULL) { ------------------ | Branch (34:7): [True: 0, False: 107] ------------------ 35| 0| OPENSSL_PUT_ERROR(ECDSA, ERR_R_PASSED_NULL_PARAMETER); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 36| 0| return NULL; 37| 0| } 38| 107| size_t scalar_len = BN_num_bytes(EC_GROUP_get0_order(group)); 39| 107| if (len != 2 * scalar_len) { ------------------ | Branch (39:7): [True: 0, False: 107] ------------------ 40| 0| OPENSSL_PUT_ERROR(ECDSA, ECDSA_R_BAD_SIGNATURE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 41| 0| return NULL; 42| 0| } 43| 107| ECDSA_SIG *ret = ECDSA_SIG_new(); 44| 107| if (ret == NULL || !BN_bin2bn(in, scalar_len, ret->r) || ------------------ | Branch (44:7): [True: 0, False: 107] | Branch (44:22): [True: 0, False: 107] ------------------ 45| 107| !BN_bin2bn(in + scalar_len, scalar_len, ret->s)) { ------------------ | Branch (45:7): [True: 0, False: 107] ------------------ 46| 0| ECDSA_SIG_free(ret); 47| 0| return NULL; 48| 0| } 49| 107| return ret; 50| 107|} ecdsa_asn1.cc:_ZL18ecdsa_sig_to_fixedPK9ec_key_stPhPmmPK12ecdsa_sig_st: 53| 6.87k| size_t max_out, const ECDSA_SIG *sig) { 54| 6.87k| const EC_GROUP *group = EC_KEY_get0_group(key); 55| 6.87k| if (group == NULL) { ------------------ | Branch (55:7): [True: 0, False: 6.87k] ------------------ 56| 0| OPENSSL_PUT_ERROR(ECDSA, ERR_R_PASSED_NULL_PARAMETER); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 57| 0| return 0; 58| 0| } 59| 6.87k| size_t scalar_len = BN_num_bytes(EC_GROUP_get0_order(group)); 60| 6.87k| if (max_out < 2 * scalar_len) { ------------------ | Branch (60:7): [True: 0, False: 6.87k] ------------------ 61| 0| OPENSSL_PUT_ERROR(EC, EC_R_BUFFER_TOO_SMALL); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 62| 0| return 0; 63| 0| } 64| 6.87k| if (BN_is_negative(sig->r) || !BN_bn2bin_padded(out, scalar_len, sig->r) || ------------------ | Branch (64:7): [True: 0, False: 6.87k] | Branch (64:33): [True: 110, False: 6.76k] ------------------ 65| 6.87k| BN_is_negative(sig->s) || ------------------ | Branch (65:7): [True: 0, False: 6.76k] ------------------ 66| 6.87k| !BN_bn2bin_padded(out + scalar_len, scalar_len, sig->s)) { ------------------ | Branch (66:7): [True: 1.82k, False: 4.93k] ------------------ 67| 1.93k| OPENSSL_PUT_ERROR(ECDSA, ECDSA_R_BAD_SIGNATURE); ------------------ | | 361| 1.93k| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 68| 1.93k| return 0; 69| 1.93k| } 70| 4.93k| *out_len = 2 * scalar_len; 71| 4.93k| return 1; 72| 6.87k|} METHOD_ref: 80| 83.2k|void METHOD_ref(void *method_in) { 81| 83.2k| assert(((struct openssl_method_common_st *)method_in)->is_static); 82| 83.2k|} METHOD_unref: 84| 83.2k|void METHOD_unref(void *method_in) { 85| 83.2k| struct openssl_method_common_st *method = 86| 83.2k| reinterpret_cast(method_in); 87| | 88| 83.2k| if (method == NULL) { ------------------ | Branch (88:7): [True: 0, False: 83.2k] ------------------ 89| 0| return; 90| 0| } 91| 83.2k| assert(method->is_static); 92| 83.2k|} ERR_peek_error: 226| 4.10k|uint32_t ERR_peek_error(void) { 227| 4.10k| return get_error_values(0 /* peek */, 0 /* bottom */, NULL, NULL, NULL, NULL); 228| 4.10k|} ERR_clear_error: 253| 217k|void ERR_clear_error(void) { 254| 217k| ERR_STATE *const state = err_get_state(); 255| 217k| unsigned i; 256| | 257| 217k| if (state == NULL) { ------------------ | Branch (257:7): [True: 0, False: 217k] ------------------ 258| 0| return; 259| 0| } 260| | 261| 3.70M| for (i = 0; i < ERR_NUM_ERRORS; i++) { ------------------ | | 397| 3.70M|#define ERR_NUM_ERRORS 16 ------------------ | Branch (261:15): [True: 3.48M, False: 217k] ------------------ 262| 3.48M| err_clear(&state->errors[i]); 263| 3.48M| } 264| 217k| free(state->to_free); 265| 217k| state->to_free = NULL; 266| | 267| 217k| state->top = state->bottom = 0; 268| 217k|} ERR_clear_system_error: 291| 60.2k|void ERR_clear_system_error(void) { errno = 0; } ERR_put_error: 583| 116k| unsigned line) { 584| 116k| ERR_STATE *const state = err_get_state(); 585| 116k| struct err_error_st *error; 586| | 587| 116k| if (state == NULL) { ------------------ | Branch (587:7): [True: 0, False: 116k] ------------------ 588| 0| return; 589| 0| } 590| | 591| 116k| if (library == ERR_LIB_SYS && reason == 0) { ------------------ | Branch (591:7): [True: 0, False: 116k] | Branch (591:33): [True: 0, False: 0] ------------------ 592| |#if defined(OPENSSL_WINDOWS) 593| | reason = GetLastError(); 594| |#else 595| 0| reason = errno; 596| 0|#endif 597| 0| } 598| | 599| 116k| state->top = (state->top + 1) % ERR_NUM_ERRORS; ------------------ | | 397| 116k|#define ERR_NUM_ERRORS 16 ------------------ 600| 116k| if (state->top == state->bottom) { ------------------ | Branch (600:7): [True: 13.7k, False: 102k] ------------------ 601| 13.7k| state->bottom = (state->bottom + 1) % ERR_NUM_ERRORS; ------------------ | | 397| 13.7k|#define ERR_NUM_ERRORS 16 ------------------ 602| 13.7k| } 603| | 604| 116k| error = &state->errors[state->top]; 605| 116k| err_clear(error); 606| 116k| error->file = file; 607| 116k| error->line = line; 608| 116k| error->packed = ERR_PACK(library, reason); ------------------ | | 400| 116k| (((((uint32_t)(lib)) & 0xff) << 24) | ((((uint32_t)(reason)) & 0xfff))) ------------------ 609| 116k|} ERR_add_error_data: 653| 1.81k|void ERR_add_error_data(unsigned count, ...) { 654| 1.81k| va_list args; 655| 1.81k| va_start(args, count); 656| 1.81k| err_add_error_vdata(count, args); 657| 1.81k| va_end(args); 658| 1.81k|} ERR_add_error_dataf: 660| 231|void ERR_add_error_dataf(const char *format, ...) { 661| 231| char *buf = NULL; 662| 231| va_list ap; 663| | 664| 231| va_start(ap, format); 665| 231| if (OPENSSL_vasprintf_internal(&buf, format, ap, /*system_malloc=*/1) == -1) { ------------------ | Branch (665:7): [True: 0, False: 231] ------------------ 666| 0| return; 667| 0| } 668| 231| va_end(ap); 669| | 670| 231| err_set_error_data(buf); 671| 231|} ERR_SAVE_STATE_free: 743| 5.48k|void ERR_SAVE_STATE_free(ERR_SAVE_STATE *state) { 744| 5.48k| if (state == NULL) { ------------------ | Branch (744:7): [True: 0, False: 5.48k] ------------------ 745| 0| return; 746| 0| } 747| 15.1k| for (size_t i = 0; i < state->num_errors; i++) { ------------------ | Branch (747:22): [True: 9.68k, False: 5.48k] ------------------ 748| 9.68k| err_clear(&state->errors[i]); 749| 9.68k| } 750| 5.48k| free(state->errors); 751| 5.48k| free(state); 752| 5.48k|} ERR_save_state: 754| 5.69k|ERR_SAVE_STATE *ERR_save_state(void) { 755| 5.69k| ERR_STATE *const state = err_get_state(); 756| 5.69k| if (state == NULL || state->top == state->bottom) { ------------------ | Branch (756:7): [True: 0, False: 5.69k] | Branch (756:24): [True: 203, False: 5.48k] ------------------ 757| 203| return NULL; 758| 203| } 759| | 760| 5.48k| ERR_SAVE_STATE *ret = 761| 5.48k| reinterpret_cast(malloc(sizeof(ERR_SAVE_STATE))); 762| 5.48k| if (ret == NULL) { ------------------ | Branch (762:7): [True: 0, False: 5.48k] ------------------ 763| 0| return NULL; 764| 0| } 765| | 766| | // Errors are stored in the range (bottom, top]. 767| 5.48k| size_t num_errors = state->top >= state->bottom ------------------ | Branch (767:23): [True: 3.68k, False: 1.80k] ------------------ 768| 5.48k| ? state->top - state->bottom 769| 5.48k| : ERR_NUM_ERRORS + state->top - state->bottom; ------------------ | | 397| 1.80k|#define ERR_NUM_ERRORS 16 ------------------ 770| 5.48k| assert(num_errors < ERR_NUM_ERRORS); 771| 5.48k| ret->errors = reinterpret_cast( 772| 5.48k| malloc(num_errors * sizeof(struct err_error_st))); 773| 5.48k| if (ret->errors == NULL) { ------------------ | Branch (773:7): [True: 0, False: 5.48k] ------------------ 774| 0| free(ret); 775| 0| return NULL; 776| 0| } 777| 5.48k| OPENSSL_memset(ret->errors, 0, num_errors * sizeof(struct err_error_st)); 778| 5.48k| ret->num_errors = num_errors; 779| | 780| 15.1k| for (size_t i = 0; i < num_errors; i++) { ------------------ | Branch (780:22): [True: 9.68k, False: 5.48k] ------------------ 781| 9.68k| size_t j = (state->bottom + i + 1) % ERR_NUM_ERRORS; ------------------ | | 397| 9.68k|#define ERR_NUM_ERRORS 16 ------------------ 782| 9.68k| err_copy(&ret->errors[i], &state->errors[j]); 783| 9.68k| } 784| 5.48k| return ret; 785| 5.48k|} ERR_restore_state: 787| 2.83k|void ERR_restore_state(const ERR_SAVE_STATE *state) { 788| 2.83k| if (state == NULL || state->num_errors == 0) { ------------------ | Branch (788:7): [True: 200, False: 2.63k] | Branch (788:24): [True: 0, False: 2.63k] ------------------ 789| 200| ERR_clear_error(); 790| 200| return; 791| 200| } 792| | 793| 2.63k| if (state->num_errors >= ERR_NUM_ERRORS) { ------------------ | | 397| 2.63k|#define ERR_NUM_ERRORS 16 ------------------ | Branch (793:7): [True: 0, False: 2.63k] ------------------ 794| 0| abort(); 795| 0| } 796| | 797| 2.63k| ERR_STATE *const dst = err_get_state(); 798| 2.63k| if (dst == NULL) { ------------------ | Branch (798:7): [True: 0, False: 2.63k] ------------------ 799| 0| return; 800| 0| } 801| | 802| 7.29k| for (size_t i = 0; i < state->num_errors; i++) { ------------------ | Branch (802:22): [True: 4.65k, False: 2.63k] ------------------ 803| 4.65k| err_copy(&dst->errors[i], &state->errors[i]); 804| 4.65k| } 805| 2.63k| dst->top = (unsigned)(state->num_errors - 1); 806| 2.63k| dst->bottom = ERR_NUM_ERRORS - 1; ------------------ | | 397| 2.63k|#define ERR_NUM_ERRORS 16 ------------------ 807| 2.63k|} err.cc:_ZL16get_error_valuesiiPPKcPiS1_S2_: 143| 4.10k| const char **data, int *flags) { 144| 4.10k| unsigned i = 0; 145| 4.10k| ERR_STATE *state; 146| 4.10k| struct err_error_st *error; 147| 4.10k| uint32_t ret; 148| | 149| 4.10k| state = err_get_state(); 150| 4.10k| if (state == NULL || state->bottom == state->top) { ------------------ | Branch (150:7): [True: 0, False: 4.10k] | Branch (150:24): [True: 6, False: 4.10k] ------------------ 151| 6| return 0; 152| 6| } 153| | 154| 4.10k| if (top) { ------------------ | Branch (154:7): [True: 0, False: 4.10k] ------------------ 155| 0| assert(!inc); 156| | // last error 157| 0| i = state->top; 158| 4.10k| } else { 159| 4.10k| i = (state->bottom + 1) % ERR_NUM_ERRORS; ------------------ | | 397| 4.10k|#define ERR_NUM_ERRORS 16 ------------------ 160| 4.10k| } 161| | 162| 4.10k| error = &state->errors[i]; 163| 4.10k| ret = error->packed; 164| | 165| 4.10k| if (file != NULL && line != NULL) { ------------------ | Branch (165:7): [True: 0, False: 4.10k] | Branch (165:23): [True: 0, False: 0] ------------------ 166| 0| if (error->file == NULL) { ------------------ | Branch (166:9): [True: 0, False: 0] ------------------ 167| 0| *file = "NA"; 168| 0| *line = 0; 169| 0| } else { 170| 0| *file = error->file; 171| 0| *line = error->line; 172| 0| } 173| 0| } 174| | 175| 4.10k| if (data != NULL) { ------------------ | Branch (175:7): [True: 0, False: 4.10k] ------------------ 176| 0| if (error->data == NULL) { ------------------ | Branch (176:9): [True: 0, False: 0] ------------------ 177| 0| *data = ""; 178| 0| if (flags != NULL) { ------------------ | Branch (178:11): [True: 0, False: 0] ------------------ 179| 0| *flags = 0; 180| 0| } 181| 0| } else { 182| 0| *data = error->data; 183| 0| if (flags != NULL) { ------------------ | Branch (183:11): [True: 0, False: 0] ------------------ 184| | // Without |ERR_FLAG_MALLOCED|, rust-openssl assumes the string has a 185| | // static lifetime. In both cases, we retain ownership of the string, 186| | // and the caller is not expected to free it. 187| 0| *flags = ERR_FLAG_STRING | ERR_FLAG_MALLOCED; ------------------ | | 94| 0|#define ERR_FLAG_STRING 1 ------------------ *flags = ERR_FLAG_STRING | ERR_FLAG_MALLOCED; ------------------ | | 103| 0|#define ERR_FLAG_MALLOCED 2 ------------------ 188| 0| } 189| | // If this error is being removed, take ownership of data from 190| | // the error. The semantics are such that the caller doesn't 191| | // take ownership either. Instead the error system takes 192| | // ownership and retains it until the next call that affects the 193| | // error queue. 194| 0| if (inc) { ------------------ | Branch (194:11): [True: 0, False: 0] ------------------ 195| 0| if (error->data != NULL) { ------------------ | Branch (195:13): [True: 0, False: 0] ------------------ 196| 0| free(state->to_free); 197| 0| state->to_free = error->data; 198| 0| } 199| 0| error->data = NULL; 200| 0| } 201| 0| } 202| 0| } 203| | 204| 4.10k| if (inc) { ------------------ | Branch (204:7): [True: 0, False: 4.10k] ------------------ 205| 0| assert(!top); 206| 0| err_clear(error); 207| 0| state->bottom = i; 208| 0| } 209| | 210| 4.10k| return ret; 211| 4.10k|} err.cc:_ZL13err_get_statev: 124| 348k|static ERR_STATE *err_get_state(void) { 125| 348k| ERR_STATE *state = reinterpret_cast( 126| 348k| CRYPTO_get_thread_local(OPENSSL_THREAD_LOCAL_ERR)); 127| 348k| if (state == NULL) { ------------------ | Branch (127:7): [True: 2, False: 348k] ------------------ 128| 2| state = reinterpret_cast(malloc(sizeof(ERR_STATE))); 129| 2| if (state == NULL) { ------------------ | Branch (129:9): [True: 0, False: 2] ------------------ 130| 0| return NULL; 131| 0| } 132| 2| OPENSSL_memset(state, 0, sizeof(ERR_STATE)); 133| 2| if (!CRYPTO_set_thread_local(OPENSSL_THREAD_LOCAL_ERR, state, ------------------ | Branch (133:9): [True: 0, False: 2] ------------------ 134| 2| err_state_free)) { 135| 0| return NULL; 136| 0| } 137| 2| } 138| | 139| 348k| return state; 140| 348k|} err.cc:_ZL9err_clearPN12_GLOBAL__N_112err_error_stE: 84| 3.62M|static void err_clear(struct err_error_st *error) { 85| 3.62M| free(error->data); 86| 3.62M| OPENSSL_memset(error, 0, sizeof(struct err_error_st)); 87| 3.62M|} err.cc:_ZL19err_add_error_vdatajP13__va_list_tag: 614| 1.81k|static void err_add_error_vdata(unsigned num, va_list args) { 615| 1.81k| size_t total_size = 0; 616| 1.81k| const char *substr; 617| 1.81k| char *buf; 618| | 619| 1.81k| va_list args_copy; 620| 1.81k| va_copy(args_copy, args); 621| 8.35k| for (size_t i = 0; i < num; i++) { ------------------ | Branch (621:22): [True: 6.53k, False: 1.81k] ------------------ 622| 6.53k| substr = va_arg(args_copy, const char *); 623| 6.53k| if (substr == NULL) { ------------------ | Branch (623:9): [True: 0, False: 6.53k] ------------------ 624| 0| continue; 625| 0| } 626| 6.53k| size_t substr_len = strlen(substr); 627| 6.53k| if (SIZE_MAX - total_size < substr_len) { ------------------ | Branch (627:9): [True: 0, False: 6.53k] ------------------ 628| 0| return; // Would overflow. 629| 0| } 630| 6.53k| total_size += substr_len; 631| 6.53k| } 632| 1.81k| va_end(args_copy); 633| 1.81k| if (total_size == SIZE_MAX) { ------------------ | Branch (633:7): [True: 0, False: 1.81k] ------------------ 634| 0| return; // Would overflow. 635| 0| } 636| 1.81k| total_size += 1; // NUL terminator. 637| 1.81k| if ((buf = reinterpret_cast(malloc(total_size))) == NULL) { ------------------ | Branch (637:7): [True: 0, False: 1.81k] ------------------ 638| 0| return; 639| 0| } 640| 1.81k| buf[0] = '\0'; 641| 8.35k| for (size_t i = 0; i < num; i++) { ------------------ | Branch (641:22): [True: 6.53k, False: 1.81k] ------------------ 642| 6.53k| substr = va_arg(args, const char *); 643| 6.53k| if (substr == NULL) { ------------------ | Branch (643:9): [True: 0, False: 6.53k] ------------------ 644| 0| continue; 645| 0| } 646| 6.53k| if (OPENSSL_strlcat(buf, substr, total_size) >= total_size) { ------------------ | Branch (646:9): [True: 0, False: 6.53k] ------------------ 647| 0| assert(0); // should not be possible. 648| 0| } 649| 6.53k| } 650| 1.81k| err_set_error_data(buf); 651| 1.81k|} err.cc:_ZL18err_set_error_dataPc: 567| 2.04k|static void err_set_error_data(char *data) { 568| 2.04k| ERR_STATE *const state = err_get_state(); 569| 2.04k| struct err_error_st *error; 570| | 571| 2.04k| if (state == NULL || state->top == state->bottom) { ------------------ | Branch (571:7): [True: 0, False: 2.04k] | Branch (571:24): [True: 0, False: 2.04k] ------------------ 572| 0| free(data); 573| 0| return; 574| 0| } 575| | 576| 2.04k| error = &state->errors[state->top]; 577| | 578| 2.04k| free(error->data); 579| 2.04k| error->data = data; 580| 2.04k|} err.cc:_ZL18strdup_libc_mallocPKc: 72| 1.83k|static char *strdup_libc_malloc(const char *str) { 73| | // |strdup| is not in C until C23, so MSVC triggers deprecation warnings, and 74| | // glibc and musl gate it on a feature macro. Reimplementing it is easier. 75| 1.83k| size_t len = strlen(str); 76| 1.83k| char *ret = reinterpret_cast(malloc(len + 1)); 77| 1.83k| if (ret != NULL) { ------------------ | Branch (77:7): [True: 1.83k, False: 0] ------------------ 78| 1.83k| memcpy(ret, str, len + 1); 79| 1.83k| } 80| 1.83k| return ret; 81| 1.83k|} err.cc:_ZL8err_copyPN12_GLOBAL__N_112err_error_stEPKS0_: 89| 14.3k|static void err_copy(struct err_error_st *dst, const struct err_error_st *src) { 90| 14.3k| err_clear(dst); 91| 14.3k| dst->file = src->file; 92| 14.3k| if (src->data != NULL) { ------------------ | Branch (92:7): [True: 1.83k, False: 12.5k] ------------------ 93| | // We can't use OPENSSL_strdup because we don't want to call OPENSSL_malloc, 94| | // which can affect the error stack. 95| 1.83k| dst->data = strdup_libc_malloc(src->data); 96| 1.83k| } 97| 14.3k| dst->packed = src->packed; 98| 14.3k| dst->line = src->line; 99| 14.3k|} EVP_PKEY_new: 37| 119k|EVP_PKEY *EVP_PKEY_new(void) { 38| 119k| EVP_PKEY *ret = 39| 119k| reinterpret_cast(OPENSSL_zalloc(sizeof(EVP_PKEY))); 40| 119k| if (ret == NULL) { ------------------ | Branch (40:7): [True: 0, False: 119k] ------------------ 41| 0| return NULL; 42| 0| } 43| | 44| 119k| ret->type = EVP_PKEY_NONE; ------------------ | | 132| 119k|#define EVP_PKEY_NONE NID_undef | | ------------------ | | | | 43| 119k|#define NID_undef 0 | | ------------------ ------------------ 45| 119k| ret->references = 1; 46| 119k| return ret; 47| 119k|} EVP_PKEY_free: 57| 437k|void EVP_PKEY_free(EVP_PKEY *pkey) { 58| 437k| if (pkey == NULL) { ------------------ | Branch (58:7): [True: 99.2k, False: 338k] ------------------ 59| 99.2k| return; 60| 99.2k| } 61| | 62| 338k| if (!CRYPTO_refcount_dec_and_test_zero(&pkey->references)) { ------------------ | Branch (62:7): [True: 218k, False: 119k] ------------------ 63| 218k| return; 64| 218k| } 65| | 66| 119k| free_it(pkey); 67| 119k| OPENSSL_free(pkey); 68| 119k|} EVP_PKEY_up_ref: 70| 218k|int EVP_PKEY_up_ref(EVP_PKEY *pkey) { 71| 218k| CRYPTO_refcount_inc(&pkey->references); 72| 218k| return 1; 73| 218k|} EVP_PKEY_is_opaque: 75| 2|int EVP_PKEY_is_opaque(const EVP_PKEY *pkey) { 76| 2| if (pkey->ameth && pkey->ameth->pkey_opaque) { ------------------ | Branch (76:7): [True: 2, False: 0] | Branch (76:22): [True: 2, False: 0] ------------------ 77| 2| return pkey->ameth->pkey_opaque(pkey); 78| 2| } 79| 0| return 0; 80| 2|} EVP_PKEY_cmp: 82| 2|int EVP_PKEY_cmp(const EVP_PKEY *a, const EVP_PKEY *b) { 83| 2| if (a->type != b->type) { ------------------ | Branch (83:7): [True: 0, False: 2] ------------------ 84| 0| return -1; 85| 0| } 86| | 87| 2| if (a->ameth) { ------------------ | Branch (87:7): [True: 2, False: 0] ------------------ 88| 2| int ret; 89| | // Compare parameters if the algorithm has them 90| 2| if (a->ameth->param_cmp) { ------------------ | Branch (90:9): [True: 0, False: 2] ------------------ 91| 0| ret = a->ameth->param_cmp(a, b); 92| 0| if (ret <= 0) { ------------------ | Branch (92:11): [True: 0, False: 0] ------------------ 93| 0| return ret; 94| 0| } 95| 0| } 96| | 97| 2| if (a->ameth->pub_cmp) { ------------------ | Branch (97:9): [True: 2, False: 0] ------------------ 98| 2| return a->ameth->pub_cmp(a, b); 99| 2| } 100| 2| } 101| | 102| 0| return -2; 103| 2|} EVP_PKEY_size: 143| 143k|int EVP_PKEY_size(const EVP_PKEY *pkey) { 144| 143k| if (pkey && pkey->ameth && pkey->ameth->pkey_size) { ------------------ | Branch (144:7): [True: 143k, False: 0] | Branch (144:15): [True: 143k, False: 0] | Branch (144:30): [True: 143k, False: 0] ------------------ 145| 143k| return pkey->ameth->pkey_size(pkey); 146| 143k| } 147| 0| return 0; 148| 143k|} EVP_PKEY_id: 157| 437k|int EVP_PKEY_id(const EVP_PKEY *pkey) { return pkey->type; } evp_pkey_set_method: 179| 228k|void evp_pkey_set_method(EVP_PKEY *pkey, const EVP_PKEY_ASN1_METHOD *method) { 180| 228k| free_it(pkey); 181| 228k| pkey->ameth = method; 182| 228k| pkey->type = pkey->ameth->pkey_id; 183| 228k|} EVP_PKEY_CTX_set_signature_md: 325| 79.5k|int EVP_PKEY_CTX_set_signature_md(EVP_PKEY_CTX *ctx, const EVP_MD *md) { 326| 79.5k| return EVP_PKEY_CTX_ctrl(ctx, -1, EVP_PKEY_OP_TYPE_SIG, EVP_PKEY_CTRL_MD, 0, ------------------ | | 120| 79.5k| (EVP_PKEY_OP_SIGN | EVP_PKEY_OP_VERIFY | EVP_PKEY_OP_VERIFYRECOVER) | | ------------------ | | | | 111| 79.5k|#define EVP_PKEY_OP_SIGN (1 << 3) | | ------------------ | | (EVP_PKEY_OP_SIGN | EVP_PKEY_OP_VERIFY | EVP_PKEY_OP_VERIFYRECOVER) | | ------------------ | | | | 112| 79.5k|#define EVP_PKEY_OP_VERIFY (1 << 4) | | ------------------ | | (EVP_PKEY_OP_SIGN | EVP_PKEY_OP_VERIFY | EVP_PKEY_OP_VERIFYRECOVER) | | ------------------ | | | | 113| 79.5k|#define EVP_PKEY_OP_VERIFYRECOVER (1 << 5) | | ------------------ ------------------ return EVP_PKEY_CTX_ctrl(ctx, -1, EVP_PKEY_OP_TYPE_SIG, EVP_PKEY_CTRL_MD, 0, ------------------ | | 140| 79.5k|#define EVP_PKEY_CTRL_MD 1 ------------------ 327| 79.5k| (void *)md); 328| 79.5k|} evp.cc:_ZL7free_itP11evp_pkey_st: 49| 348k|static void free_it(EVP_PKEY *pkey) { 50| 348k| if (pkey->ameth && pkey->ameth->pkey_free) { ------------------ | Branch (50:7): [True: 228k, False: 119k] | Branch (50:22): [True: 228k, False: 0] ------------------ 51| 228k| pkey->ameth->pkey_free(pkey); 52| 228k| pkey->pkey = NULL; 53| 228k| pkey->type = EVP_PKEY_NONE; ------------------ | | 132| 228k|#define EVP_PKEY_NONE NID_undef | | ------------------ | | | | 43| 228k|#define NID_undef 0 | | ------------------ ------------------ 54| 228k| } 55| 348k|} EVP_parse_public_key: 56| 123k|EVP_PKEY *EVP_parse_public_key(CBS *cbs) { 57| | // Parse the SubjectPublicKeyInfo. 58| 123k| CBS spki, algorithm, key; 59| 123k| uint8_t padding; 60| 123k| if (!CBS_get_asn1(cbs, &spki, CBS_ASN1_SEQUENCE) || ------------------ | | 223| 123k|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED) | | ------------------ | | | | 197| 123k|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | | | ------------------ | | | | | | 194| 123k|#define CBS_ASN1_TAG_SHIFT 24 | | | | ------------------ | | ------------------ ------------------ | Branch (60:7): [True: 12, False: 123k] ------------------ 61| 123k| !CBS_get_asn1(&spki, &algorithm, CBS_ASN1_SEQUENCE) || ------------------ | | 223| 123k|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED) | | ------------------ | | | | 197| 123k|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | | | ------------------ | | | | | | 194| 123k|#define CBS_ASN1_TAG_SHIFT 24 | | | | ------------------ | | ------------------ ------------------ | Branch (61:7): [True: 3, False: 123k] ------------------ 62| 123k| !CBS_get_asn1(&spki, &key, CBS_ASN1_BITSTRING) || ------------------ | | 217| 123k|#define CBS_ASN1_BITSTRING 0x3u ------------------ | Branch (62:7): [True: 6, False: 123k] ------------------ 63| 123k| CBS_len(&spki) != 0) { ------------------ | Branch (63:7): [True: 1, False: 123k] ------------------ 64| 22| OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR); ------------------ | | 361| 22| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 65| 22| return nullptr; 66| 22| } 67| 123k| const EVP_PKEY_ASN1_METHOD *method = parse_key_type(&algorithm); 68| 123k| if (method == nullptr) { ------------------ | Branch (68:7): [True: 3.96k, False: 119k] ------------------ 69| 3.96k| OPENSSL_PUT_ERROR(EVP, EVP_R_UNSUPPORTED_ALGORITHM); ------------------ | | 361| 3.96k| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 70| 3.96k| return nullptr; 71| 3.96k| } 72| 119k| if (// Every key type defined encodes the key as a byte string with the same 73| | // conversion to BIT STRING. 74| 119k| !CBS_get_u8(&key, &padding) || ------------------ | Branch (74:7): [True: 1, False: 119k] ------------------ 75| 119k| padding != 0) { ------------------ | Branch (75:7): [True: 3, False: 119k] ------------------ 76| 4| OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR); ------------------ | | 361| 4| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 77| 4| return nullptr; 78| 4| } 79| | 80| | // Set up an |EVP_PKEY| of the appropriate type. 81| 119k| bssl::UniquePtr ret(EVP_PKEY_new()); 82| 119k| if (ret == nullptr) { ------------------ | Branch (82:7): [True: 0, False: 119k] ------------------ 83| 0| return nullptr; 84| 0| } 85| 119k| evp_pkey_set_method(ret.get(), method); 86| | 87| | // Call into the type-specific SPKI decoding function. 88| 119k| if (ret->ameth->pub_decode == nullptr) { ------------------ | Branch (88:7): [True: 0, False: 119k] ------------------ 89| 0| OPENSSL_PUT_ERROR(EVP, EVP_R_UNSUPPORTED_ALGORITHM); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 90| 0| return nullptr; 91| 0| } 92| 119k| if (!ret->ameth->pub_decode(ret.get(), &algorithm, &key)) { ------------------ | Branch (92:7): [True: 10.8k, False: 108k] ------------------ 93| 10.8k| return nullptr; 94| 10.8k| } 95| | 96| 108k| return ret.release(); 97| 119k|} EVP_marshal_public_key: 99| 10|int EVP_marshal_public_key(CBB *cbb, const EVP_PKEY *key) { 100| 10| if (key->ameth == NULL || key->ameth->pub_encode == NULL) { ------------------ | Branch (100:7): [True: 0, False: 10] | Branch (100:29): [True: 0, False: 10] ------------------ 101| 0| OPENSSL_PUT_ERROR(EVP, EVP_R_UNSUPPORTED_ALGORITHM); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 102| 0| return 0; 103| 0| } 104| | 105| 10| return key->ameth->pub_encode(cbb, key); 106| 10|} EVP_parse_private_key: 108| 2|EVP_PKEY *EVP_parse_private_key(CBS *cbs) { 109| | // Parse the PrivateKeyInfo. 110| 2| CBS pkcs8, algorithm, key; 111| 2| uint64_t version; 112| 2| if (!CBS_get_asn1(cbs, &pkcs8, CBS_ASN1_SEQUENCE) || ------------------ | | 223| 2|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED) | | ------------------ | | | | 197| 2|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | | | ------------------ | | | | | | 194| 2|#define CBS_ASN1_TAG_SHIFT 24 | | | | ------------------ | | ------------------ ------------------ | Branch (112:7): [True: 0, False: 2] ------------------ 113| 2| !CBS_get_asn1_uint64(&pkcs8, &version) || ------------------ | Branch (113:7): [True: 0, False: 2] ------------------ 114| 2| version != 0 || ------------------ | Branch (114:7): [True: 0, False: 2] ------------------ 115| 2| !CBS_get_asn1(&pkcs8, &algorithm, CBS_ASN1_SEQUENCE) || ------------------ | | 223| 2|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED) | | ------------------ | | | | 197| 2|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | | | ------------------ | | | | | | 194| 2|#define CBS_ASN1_TAG_SHIFT 24 | | | | ------------------ | | ------------------ ------------------ | Branch (115:7): [True: 0, False: 2] ------------------ 116| 2| !CBS_get_asn1(&pkcs8, &key, CBS_ASN1_OCTETSTRING)) { ------------------ | | 218| 2|#define CBS_ASN1_OCTETSTRING 0x4u ------------------ | Branch (116:7): [True: 0, False: 2] ------------------ 117| 0| OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 118| 0| return nullptr; 119| 0| } 120| 2| const EVP_PKEY_ASN1_METHOD *method = parse_key_type(&algorithm); 121| 2| if (method == nullptr) { ------------------ | Branch (121:7): [True: 0, False: 2] ------------------ 122| 0| OPENSSL_PUT_ERROR(EVP, EVP_R_UNSUPPORTED_ALGORITHM); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 123| 0| return nullptr; 124| 0| } 125| | 126| | // A PrivateKeyInfo ends with a SET of Attributes which we ignore. 127| | 128| | // Set up an |EVP_PKEY| of the appropriate type. 129| 2| bssl::UniquePtr ret(EVP_PKEY_new()); 130| 2| if (ret == nullptr) { ------------------ | Branch (130:7): [True: 0, False: 2] ------------------ 131| 0| return nullptr; 132| 0| } 133| 2| evp_pkey_set_method(ret.get(), method); 134| | 135| | // Call into the type-specific PrivateKeyInfo decoding function. 136| 2| if (ret->ameth->priv_decode == nullptr) { ------------------ | Branch (136:7): [True: 0, False: 2] ------------------ 137| 0| OPENSSL_PUT_ERROR(EVP, EVP_R_UNSUPPORTED_ALGORITHM); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 138| 0| return nullptr; 139| 0| } 140| 2| if (!ret->ameth->priv_decode(ret.get(), &algorithm, &key)) { ------------------ | Branch (140:7): [True: 0, False: 2] ------------------ 141| 0| return nullptr; 142| 0| } 143| | 144| 2| return ret.release(); 145| 2|} evp_asn1.cc:_ZL14parse_key_typeP6cbs_st: 39| 123k|static const EVP_PKEY_ASN1_METHOD *parse_key_type(CBS *cbs) { 40| 123k| CBS oid; 41| 123k| if (!CBS_get_asn1(cbs, &oid, CBS_ASN1_OBJECT)) { ------------------ | | 220| 123k|#define CBS_ASN1_OBJECT 0x6u ------------------ | Branch (41:7): [True: 1, False: 123k] ------------------ 42| 1| return NULL; 43| 1| } 44| | 45| 180k| for (unsigned i = 0; i < OPENSSL_ARRAY_SIZE(kASN1Methods); i++) { ------------------ | | 103| 180k|#define OPENSSL_ARRAY_SIZE(array) (sizeof(array) / sizeof((array)[0])) ------------------ | Branch (45:24): [True: 176k, False: 3.96k] ------------------ 46| 176k| const EVP_PKEY_ASN1_METHOD *method = kASN1Methods[i]; 47| 176k| if (CBS_len(&oid) == method->oid_len && ------------------ | Branch (47:9): [True: 127k, False: 49.2k] ------------------ 48| 176k| OPENSSL_memcmp(CBS_data(&oid), method->oid, method->oid_len) == 0) { ------------------ | Branch (48:9): [True: 119k, False: 7.35k] ------------------ 49| 119k| return method; 50| 119k| } 51| 176k| } 52| | 53| 3.96k| return NULL; 54| 123k|} EVP_PKEY_CTX_new: 63| 79.5k|EVP_PKEY_CTX *EVP_PKEY_CTX_new(EVP_PKEY *pkey, ENGINE *e) { 64| 79.5k| if (pkey == NULL || pkey->ameth == NULL) { ------------------ | Branch (64:7): [True: 0, False: 79.5k] | Branch (64:23): [True: 0, False: 79.5k] ------------------ 65| 0| OPENSSL_PUT_ERROR(EVP, ERR_R_PASSED_NULL_PARAMETER); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 66| 0| return NULL; 67| 0| } 68| | 69| 79.5k| const EVP_PKEY_METHOD *pkey_method = pkey->ameth->pkey_method; 70| 79.5k| if (pkey_method == NULL) { ------------------ | Branch (70:7): [True: 0, False: 79.5k] ------------------ 71| 0| OPENSSL_PUT_ERROR(EVP, EVP_R_UNSUPPORTED_ALGORITHM); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 72| 0| ERR_add_error_dataf("algorithm %d", pkey->ameth->pkey_id); 73| 0| return NULL; 74| 0| } 75| | 76| 79.5k| return evp_pkey_ctx_new(pkey, e, pkey_method); 77| 79.5k|} _ZN15evp_pkey_ctx_stD2Ev: 90| 159k|evp_pkey_ctx_st::~evp_pkey_ctx_st() { 91| 159k| if (pmeth && pmeth->cleanup) { ------------------ | Branch (91:7): [True: 159k, False: 0] | Branch (91:16): [True: 159k, False: 0] ------------------ 92| 159k| pmeth->cleanup(this); 93| 159k| } 94| 159k|} EVP_PKEY_CTX_free: 96| 159k|void EVP_PKEY_CTX_free(EVP_PKEY_CTX *ctx) { bssl::Delete(ctx); } EVP_PKEY_CTX_dup: 98| 79.5k|EVP_PKEY_CTX *EVP_PKEY_CTX_dup(EVP_PKEY_CTX *ctx) { 99| 79.5k| if (!ctx->pmeth || !ctx->pmeth->copy) { ------------------ | Branch (99:7): [True: 0, False: 79.5k] | Branch (99:22): [True: 0, False: 79.5k] ------------------ 100| 0| return nullptr; 101| 0| } 102| | 103| 79.5k| bssl::UniquePtr ret = bssl::MakeUnique(); 104| 79.5k| if (!ret) { ------------------ | Branch (104:7): [True: 0, False: 79.5k] ------------------ 105| 0| return nullptr; 106| 0| } 107| | 108| 79.5k| ret->pmeth = ctx->pmeth; 109| 79.5k| ret->engine = ctx->engine; 110| 79.5k| ret->operation = ctx->operation; 111| 79.5k| ret->pkey = bssl::UpRef(ctx->pkey); 112| 79.5k| ret->peerkey = bssl::UpRef(ctx->peerkey); 113| 79.5k| if (ctx->pmeth->copy(ret.get(), ctx) <= 0) { ------------------ | Branch (113:7): [True: 0, False: 79.5k] ------------------ 114| 0| ret->pmeth = nullptr; // Don't call |pmeth->cleanup|. 115| 0| OPENSSL_PUT_ERROR(EVP, ERR_LIB_EVP); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 116| 0| return nullptr; 117| 0| } 118| | 119| 79.5k| return ret.release(); 120| 79.5k|} EVP_PKEY_CTX_ctrl: 125| 137k| int p1, void *p2) { 126| 137k| if (!ctx || !ctx->pmeth || !ctx->pmeth->ctrl) { ------------------ | Branch (126:7): [True: 0, False: 137k] | Branch (126:15): [True: 0, False: 137k] | Branch (126:30): [True: 0, False: 137k] ------------------ 127| 0| OPENSSL_PUT_ERROR(EVP, EVP_R_COMMAND_NOT_SUPPORTED); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 128| 0| return 0; 129| 0| } 130| 137k| if (keytype != -1 && ctx->pmeth->pkey_id != keytype) { ------------------ | Branch (130:7): [True: 58.3k, False: 79.5k] | Branch (130:24): [True: 0, False: 58.3k] ------------------ 131| 0| OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 132| 0| return 0; 133| 0| } 134| | 135| 137k| if (ctx->operation == EVP_PKEY_OP_UNDEFINED) { ------------------ | | 109| 137k|#define EVP_PKEY_OP_UNDEFINED 0 ------------------ | Branch (135:7): [True: 0, False: 137k] ------------------ 136| 0| OPENSSL_PUT_ERROR(EVP, EVP_R_NO_OPERATION_SET); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 137| 0| return 0; 138| 0| } 139| | 140| 137k| if (optype != -1 && !(ctx->operation & optype)) { ------------------ | Branch (140:7): [True: 108k, False: 29.1k] | Branch (140:23): [True: 0, False: 108k] ------------------ 141| 0| OPENSSL_PUT_ERROR(EVP, EVP_R_INVALID_OPERATION); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 142| 0| return 0; 143| 0| } 144| | 145| 137k| return ctx->pmeth->ctrl(ctx, cmd, p1, p2); 146| 137k|} EVP_PKEY_sign_init: 148| 28.0k|int EVP_PKEY_sign_init(EVP_PKEY_CTX *ctx) { 149| 28.0k| if (ctx == NULL || ctx->pmeth == NULL || ------------------ | Branch (149:7): [True: 0, False: 28.0k] | Branch (149:22): [True: 0, False: 28.0k] ------------------ 150| 28.0k| (ctx->pmeth->sign == NULL && ctx->pmeth->sign_message == NULL)) { ------------------ | Branch (150:8): [True: 0, False: 28.0k] | Branch (150:36): [True: 0, False: 0] ------------------ 151| 0| OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 152| 0| return 0; 153| 0| } 154| | 155| 28.0k| ctx->operation = EVP_PKEY_OP_SIGN; ------------------ | | 111| 28.0k|#define EVP_PKEY_OP_SIGN (1 << 3) ------------------ 156| 28.0k| return 1; 157| 28.0k|} EVP_PKEY_sign: 160| 28.0k| const uint8_t *digest, size_t digest_len) { 161| 28.0k| if (!ctx || !ctx->pmeth || !ctx->pmeth->sign) { ------------------ | Branch (161:7): [True: 0, False: 28.0k] | Branch (161:15): [True: 0, False: 28.0k] | Branch (161:30): [True: 0, False: 28.0k] ------------------ 162| 0| OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 163| 0| return 0; 164| 0| } 165| 28.0k| if (ctx->operation != EVP_PKEY_OP_SIGN) { ------------------ | | 111| 28.0k|#define EVP_PKEY_OP_SIGN (1 << 3) ------------------ | Branch (165:7): [True: 0, False: 28.0k] ------------------ 166| 0| OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATON_NOT_INITIALIZED); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 167| 0| return 0; 168| 0| } 169| 28.0k| return ctx->pmeth->sign(ctx, sig, sig_len, digest, digest_len); 170| 28.0k|} EVP_PKEY_verify_init: 172| 51.5k|int EVP_PKEY_verify_init(EVP_PKEY_CTX *ctx) { 173| 51.5k| if (ctx == NULL || ctx->pmeth == NULL || ------------------ | Branch (173:7): [True: 0, False: 51.5k] | Branch (173:22): [True: 0, False: 51.5k] ------------------ 174| 51.5k| (ctx->pmeth->verify == NULL && ctx->pmeth->verify_message == NULL)) { ------------------ | Branch (174:8): [True: 0, False: 51.5k] | Branch (174:38): [True: 0, False: 0] ------------------ 175| 0| OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 176| 0| return 0; 177| 0| } 178| 51.5k| ctx->operation = EVP_PKEY_OP_VERIFY; ------------------ | | 112| 51.5k|#define EVP_PKEY_OP_VERIFY (1 << 4) ------------------ 179| 51.5k| return 1; 180| 51.5k|} EVP_PKEY_verify: 183| 51.5k| const uint8_t *digest, size_t digest_len) { 184| 51.5k| if (!ctx || !ctx->pmeth || !ctx->pmeth->verify) { ------------------ | Branch (184:7): [True: 0, False: 51.5k] | Branch (184:15): [True: 0, False: 51.5k] | Branch (184:30): [True: 0, False: 51.5k] ------------------ 185| 0| OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 186| 0| return 0; 187| 0| } 188| 51.5k| if (ctx->operation != EVP_PKEY_OP_VERIFY) { ------------------ | | 112| 51.5k|#define EVP_PKEY_OP_VERIFY (1 << 4) ------------------ | Branch (188:7): [True: 0, False: 51.5k] ------------------ 189| 0| OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATON_NOT_INITIALIZED); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 190| 0| return 0; 191| 0| } 192| 51.5k| return ctx->pmeth->verify(ctx, sig, sig_len, digest, digest_len); 193| 51.5k|} evp_ctx.cc:_ZL16evp_pkey_ctx_newP11evp_pkey_stP9engine_stPK18evp_pkey_method_st: 44| 79.5k| const EVP_PKEY_METHOD *pmeth) { 45| 79.5k| bssl::UniquePtr ret = bssl::MakeUnique(); 46| 79.5k| if (!ret) { ------------------ | Branch (46:7): [True: 0, False: 79.5k] ------------------ 47| 0| return nullptr; 48| 0| } 49| | 50| 79.5k| ret->engine = e; 51| 79.5k| ret->pmeth = pmeth; 52| 79.5k| ret->operation = EVP_PKEY_OP_UNDEFINED; ------------------ | | 109| 79.5k|#define EVP_PKEY_OP_UNDEFINED 0 ------------------ 53| 79.5k| ret->pkey = bssl::UpRef(pkey); 54| | 55| 79.5k| if (pmeth->init && pmeth->init(ret.get()) <= 0) { ------------------ | Branch (55:7): [True: 79.5k, False: 0] | Branch (55:22): [True: 0, False: 79.5k] ------------------ 56| 0| ret->pmeth = nullptr; // Don't call |pmeth->cleanup|. 57| 0| return nullptr; 58| 0| } 59| | 60| 79.5k| return ret.release(); 61| 79.5k|} p_dsa_asn1.cc:_ZL14dsa_pub_decodeP11evp_pkey_stP6cbs_stS2_: 27| 280|static int dsa_pub_decode(EVP_PKEY *out, CBS *params, CBS *key) { 28| | // See RFC 3279, section 2.3.2. 29| | 30| | // Parameters may or may not be present. 31| 280| bssl::UniquePtr dsa; 32| 280| if (CBS_len(params) == 0) { ------------------ | Branch (32:7): [True: 0, False: 280] ------------------ 33| 0| dsa.reset(DSA_new()); 34| 0| if (dsa == nullptr) { ------------------ | Branch (34:9): [True: 0, False: 0] ------------------ 35| 0| return 0; 36| 0| } 37| 280| } else { 38| 280| dsa.reset(DSA_parse_parameters(params)); 39| 280| if (dsa == nullptr || CBS_len(params) != 0) { ------------------ | Branch (39:9): [True: 280, False: 0] | Branch (39:27): [True: 0, False: 0] ------------------ 40| 280| OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR); ------------------ | | 361| 280| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 41| 280| return 0; 42| 280| } 43| 280| } 44| | 45| 0| dsa->pub_key = BN_new(); 46| 0| if (dsa->pub_key == nullptr) { ------------------ | Branch (46:7): [True: 0, False: 0] ------------------ 47| 0| return 0; 48| 0| } 49| | 50| 0| if (!BN_parse_asn1_unsigned(key, dsa->pub_key) || CBS_len(key) != 0) { ------------------ | Branch (50:7): [True: 0, False: 0] | Branch (50:53): [True: 0, False: 0] ------------------ 51| 0| OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 52| 0| return 0; 53| 0| } 54| | 55| 0| EVP_PKEY_assign_DSA(out, dsa.release()); 56| 0| return 1; 57| 0|} p_dsa_asn1.cc:_ZL12int_dsa_freeP11evp_pkey_st: 200| 280|static void int_dsa_free(EVP_PKEY *pkey) { 201| 280| DSA_free(reinterpret_cast(pkey->pkey)); 202| 280| pkey->pkey = nullptr; 203| 280|} p_ec.cc:_ZL12pkey_ec_initP15evp_pkey_ctx_st: 41| 28.4k|static int pkey_ec_init(EVP_PKEY_CTX *ctx) { 42| 28.4k| EC_PKEY_CTX *dctx = 43| 28.4k| reinterpret_cast(OPENSSL_zalloc(sizeof(EC_PKEY_CTX))); 44| 28.4k| if (!dctx) { ------------------ | Branch (44:7): [True: 0, False: 28.4k] ------------------ 45| 0| return 0; 46| 0| } 47| | 48| 28.4k| ctx->data = dctx; 49| 28.4k| return 1; 50| 28.4k|} p_ec.cc:_ZL12pkey_ec_copyP15evp_pkey_ctx_stS0_: 52| 14.2k|static int pkey_ec_copy(EVP_PKEY_CTX *dst, EVP_PKEY_CTX *src) { 53| 14.2k| if (!pkey_ec_init(dst)) { ------------------ | Branch (53:7): [True: 0, False: 14.2k] ------------------ 54| 0| return 0; 55| 0| } 56| | 57| 14.2k| const EC_PKEY_CTX *sctx = reinterpret_cast(src->data); 58| 14.2k| EC_PKEY_CTX *dctx = reinterpret_cast(dst->data); 59| 14.2k| dctx->md = sctx->md; 60| 14.2k| dctx->gen_group = sctx->gen_group; 61| 14.2k| return 1; 62| 14.2k|} p_ec.cc:_ZL15pkey_ec_cleanupP15evp_pkey_ctx_st: 64| 28.4k|static void pkey_ec_cleanup(EVP_PKEY_CTX *ctx) { 65| 28.4k| EC_PKEY_CTX *dctx = reinterpret_cast(ctx->data); 66| 28.4k| if (!dctx) { ------------------ | Branch (66:7): [True: 0, False: 28.4k] ------------------ 67| 0| return; 68| 0| } 69| | 70| 28.4k| OPENSSL_free(dctx); 71| 28.4k|} p_ec.cc:_ZL14pkey_ec_verifyP15evp_pkey_ctx_stPKhmS2_m: 93| 14.2k| const uint8_t *tbs, size_t tbslen) { 94| 14.2k| const EC_KEY *ec_key = reinterpret_cast(ctx->pkey->pkey); 95| 14.2k| return ECDSA_verify(0, tbs, tbslen, sig, siglen, ec_key); 96| 14.2k|} p_ec.cc:_ZL12pkey_ec_ctrlP15evp_pkey_ctx_stiiPv: 126| 14.2k|static int pkey_ec_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2) { 127| 14.2k| EC_PKEY_CTX *dctx = reinterpret_cast(ctx->data); 128| | 129| 14.2k| switch (type) { 130| 14.2k| case EVP_PKEY_CTRL_MD: { ------------------ | | 140| 14.2k|#define EVP_PKEY_CTRL_MD 1 ------------------ | Branch (130:5): [True: 14.2k, False: 0] ------------------ 131| 14.2k| const EVP_MD *md = reinterpret_cast(p2); 132| 14.2k| int md_type = EVP_MD_type(md); 133| 14.2k| if (md_type != NID_sha1 && md_type != NID_sha224 && ------------------ | | 330| 28.4k|#define NID_sha1 64 ------------------ if (md_type != NID_sha1 && md_type != NID_sha224 && ------------------ | | 2966| 28.4k|#define NID_sha224 675 ------------------ | Branch (133:11): [True: 14.2k, False: 14] | Branch (133:34): [True: 14.2k, False: 0] ------------------ 134| 14.2k| md_type != NID_sha256 && md_type != NID_sha384 && ------------------ | | 2951| 28.4k|#define NID_sha256 672 ------------------ md_type != NID_sha256 && md_type != NID_sha384 && ------------------ | | 2956| 28.2k|#define NID_sha384 673 ------------------ | Branch (134:11): [True: 14.0k, False: 193] | Branch (134:36): [True: 0, False: 14.0k] ------------------ 135| 14.2k| md_type != NID_sha512) { ------------------ | | 2961| 0|#define NID_sha512 674 ------------------ | Branch (135:11): [True: 0, False: 0] ------------------ 136| 0| OPENSSL_PUT_ERROR(EVP, EVP_R_INVALID_DIGEST_TYPE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 137| 0| return 0; 138| 0| } 139| 14.2k| dctx->md = md; 140| 14.2k| return 1; 141| 14.2k| } 142| | 143| 0| case EVP_PKEY_CTRL_GET_MD: ------------------ | | 141| 0|#define EVP_PKEY_CTRL_GET_MD 2 ------------------ | Branch (143:5): [True: 0, False: 14.2k] ------------------ 144| 0| *(const EVP_MD **)p2 = dctx->md; 145| 0| return 1; 146| | 147| 0| case EVP_PKEY_CTRL_PEER_KEY: ------------------ | | 152| 0|#define EVP_PKEY_CTRL_PEER_KEY 3 ------------------ | Branch (147:5): [True: 0, False: 14.2k] ------------------ 148| | // Default behaviour is OK 149| 0| return 1; 150| | 151| 0| case EVP_PKEY_CTRL_EC_PARAMGEN_CURVE_NID: { ------------------ | | 170| 0|#define EVP_PKEY_CTRL_EC_PARAMGEN_CURVE_NID (EVP_PKEY_ALG_CTRL + 13) | | ------------------ | | | | 156| 0|#define EVP_PKEY_ALG_CTRL 0x1000 | | ------------------ ------------------ | Branch (151:5): [True: 0, False: 14.2k] ------------------ 152| 0| const EC_GROUP *group = EC_GROUP_new_by_curve_name(p1); 153| 0| if (group == NULL) { ------------------ | Branch (153:11): [True: 0, False: 0] ------------------ 154| 0| return 0; 155| 0| } 156| 0| dctx->gen_group = group; 157| 0| return 1; 158| 0| } 159| | 160| 0| default: ------------------ | Branch (160:5): [True: 0, False: 14.2k] ------------------ 161| 0| OPENSSL_PUT_ERROR(EVP, EVP_R_COMMAND_NOT_SUPPORTED); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 162| 0| return 0; 163| 14.2k| } 164| 14.2k|} EVP_PKEY_assign_EC_KEY: 266| 29.1k|int EVP_PKEY_assign_EC_KEY(EVP_PKEY *pkey, EC_KEY *key) { 267| 29.1k| evp_pkey_set_method(pkey, &ec_asn1_meth); 268| 29.1k| pkey->pkey = key; 269| 29.1k| return key != NULL; 270| 29.1k|} EVP_PKEY_get0_EC_KEY: 272| 14.5k|EC_KEY *EVP_PKEY_get0_EC_KEY(const EVP_PKEY *pkey) { 273| 14.5k| if (pkey->type != EVP_PKEY_EC) { ------------------ | | 136| 14.5k|#define EVP_PKEY_EC NID_X9_62_id_ecPublicKey | | ------------------ | | | | 1844| 14.5k|#define NID_X9_62_id_ecPublicKey 408 | | ------------------ ------------------ | Branch (273:7): [True: 0, False: 14.5k] ------------------ 274| 0| OPENSSL_PUT_ERROR(EVP, EVP_R_EXPECTING_AN_EC_KEY_KEY); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 275| 0| return NULL; 276| 0| } 277| 14.5k| return reinterpret_cast(pkey->pkey); 278| 14.5k|} p_ec_asn1.cc:_ZL16eckey_pub_decodeP11evp_pkey_stP6cbs_stS2_: 51| 36.0k|static int eckey_pub_decode(EVP_PKEY *out, CBS *params, CBS *key) { 52| | // See RFC 5480, section 2. 53| | 54| | // The parameters are a named curve. 55| 36.0k| const EC_GROUP *group = EC_KEY_parse_curve_name(params); 56| 36.0k| if (group == NULL || CBS_len(params) != 0) { ------------------ | Branch (56:7): [True: 4.43k, False: 31.6k] | Branch (56:24): [True: 1, False: 31.6k] ------------------ 57| 4.43k| OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR); ------------------ | | 361| 4.43k| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 58| 4.43k| return 0; 59| 4.43k| } 60| | 61| 31.6k| bssl::UniquePtr eckey(EC_KEY_new()); 62| 31.6k| if (eckey == nullptr || // ------------------ | Branch (62:7): [True: 0, False: 31.6k] ------------------ 63| 31.6k| !EC_KEY_set_group(eckey.get(), group) || ------------------ | Branch (63:7): [True: 0, False: 31.6k] ------------------ 64| 31.6k| !EC_KEY_oct2key(eckey.get(), CBS_data(key), CBS_len(key), nullptr)) { ------------------ | Branch (64:7): [True: 2.49k, False: 29.1k] ------------------ 65| 2.49k| return 0; 66| 2.49k| } 67| | 68| 29.1k| EVP_PKEY_assign_EC_KEY(out, eckey.release()); 69| 29.1k| return 1; 70| 31.6k|} p_ec_asn1.cc:_ZL17eckey_priv_decodeP11evp_pkey_stP6cbs_stS2_: 88| 2|static int eckey_priv_decode(EVP_PKEY *out, CBS *params, CBS *key) { 89| | // See RFC 5915. 90| 2| const EC_GROUP *group = EC_KEY_parse_parameters(params); 91| 2| if (group == NULL || CBS_len(params) != 0) { ------------------ | Branch (91:7): [True: 0, False: 2] | Branch (91:24): [True: 0, False: 2] ------------------ 92| 0| OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 93| 0| return 0; 94| 0| } 95| | 96| 2| EC_KEY *ec_key = EC_KEY_parse_private_key(key, group); 97| 2| if (ec_key == NULL || CBS_len(key) != 0) { ------------------ | Branch (97:7): [True: 0, False: 2] | Branch (97:25): [True: 0, False: 2] ------------------ 98| 0| OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 99| 0| EC_KEY_free(ec_key); 100| 0| return 0; 101| 0| } 102| | 103| 2| EVP_PKEY_assign_EC_KEY(out, ec_key); 104| 2| return 1; 105| 2|} p_ec_asn1.cc:_ZL11int_ec_freeP11evp_pkey_st: 214| 65.1k|static void int_ec_free(EVP_PKEY *pkey) { 215| 65.1k| EC_KEY_free(reinterpret_cast(pkey->pkey)); 216| 65.1k| pkey->pkey = NULL; 217| 65.1k|} p_ed25519_asn1.cc:_ZL18ed25519_pub_decodeP11evp_pkey_stP6cbs_stS2_: 116| 47|static int ed25519_pub_decode(EVP_PKEY *out, CBS *params, CBS *key) { 117| | // See RFC 8410, section 4. 118| | 119| | // The parameters must be omitted. Public keys have length 32. 120| 47| if (CBS_len(params) != 0) { ------------------ | Branch (120:7): [True: 1, False: 46] ------------------ 121| 1| OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR); ------------------ | | 361| 1| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 122| 1| return 0; 123| 1| } 124| | 125| 46| return ed25519_set_pub_raw(out, CBS_data(key), CBS_len(key)); 126| 47|} p_ed25519_asn1.cc:_ZL19ed25519_set_pub_rawP11evp_pkey_stPKhm: 54| 46|static int ed25519_set_pub_raw(EVP_PKEY *pkey, const uint8_t *in, size_t len) { 55| 46| if (len != 32) { ------------------ | Branch (55:7): [True: 1, False: 45] ------------------ 56| 1| OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR); ------------------ | | 361| 1| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 57| 1| return 0; 58| 1| } 59| | 60| 45| ED25519_KEY *key = 61| 45| reinterpret_cast(OPENSSL_malloc(sizeof(ED25519_KEY))); 62| 45| if (key == NULL) { ------------------ | Branch (62:7): [True: 0, False: 45] ------------------ 63| 0| return 0; 64| 0| } 65| | 66| 45| OPENSSL_memcpy(key->key + ED25519_PUBLIC_KEY_OFFSET, in, 32); ------------------ | | 241| 45|#define ED25519_PUBLIC_KEY_OFFSET 32 ------------------ 67| 45| key->has_private = 0; 68| | 69| 45| ed25519_free(pkey); 70| 45| pkey->pkey = key; 71| 45| return 1; 72| 45|} p_ed25519_asn1.cc:_ZL12ed25519_freeP11evp_pkey_st: 26| 92|static void ed25519_free(EVP_PKEY *pkey) { 27| 92| OPENSSL_free(pkey->pkey); 28| 92| pkey->pkey = NULL; 29| 92|} EVP_PKEY_CTX_set_rsa_padding: 522| 29.1k|int EVP_PKEY_CTX_set_rsa_padding(EVP_PKEY_CTX *ctx, int padding) { 523| 29.1k| return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA, -1, EVP_PKEY_CTRL_RSA_PADDING, ------------------ | | 133| 29.1k|#define EVP_PKEY_RSA NID_rsaEncryption | | ------------------ | | | | 72| 29.1k|#define NID_rsaEncryption 6 | | ------------------ ------------------ return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA, -1, EVP_PKEY_CTRL_RSA_PADDING, ------------------ | | 158| 29.1k|#define EVP_PKEY_CTRL_RSA_PADDING (EVP_PKEY_ALG_CTRL + 1) | | ------------------ | | | | 156| 29.1k|#define EVP_PKEY_ALG_CTRL 0x1000 | | ------------------ ------------------ 524| 29.1k| padding, NULL); 525| 29.1k|} EVP_PKEY_CTX_set_rsa_pss_saltlen: 545| 29.1k|int EVP_PKEY_CTX_set_rsa_pss_saltlen(EVP_PKEY_CTX *ctx, int salt_len) { 546| 29.1k| return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA, ------------------ | | 133| 29.1k|#define EVP_PKEY_RSA NID_rsaEncryption | | ------------------ | | | | 72| 29.1k|#define NID_rsaEncryption 6 | | ------------------ ------------------ 547| 29.1k| (EVP_PKEY_OP_SIGN | EVP_PKEY_OP_VERIFY), ------------------ | | 111| 29.1k|#define EVP_PKEY_OP_SIGN (1 << 3) ------------------ (EVP_PKEY_OP_SIGN | EVP_PKEY_OP_VERIFY), ------------------ | | 112| 29.1k|#define EVP_PKEY_OP_VERIFY (1 << 4) ------------------ 548| 29.1k| EVP_PKEY_CTRL_RSA_PSS_SALTLEN, salt_len, NULL); ------------------ | | 160| 29.1k|#define EVP_PKEY_CTRL_RSA_PSS_SALTLEN (EVP_PKEY_ALG_CTRL + 3) | | ------------------ | | | | 156| 29.1k|#define EVP_PKEY_ALG_CTRL 0x1000 | | ------------------ ------------------ 549| 29.1k|} p_rsa.cc:_ZL13pkey_rsa_initP15evp_pkey_ctx_st: 58| 130k|static int pkey_rsa_init(EVP_PKEY_CTX *ctx) { 59| 130k| RSA_PKEY_CTX *rctx = 60| 130k| reinterpret_cast(OPENSSL_zalloc(sizeof(RSA_PKEY_CTX))); 61| 130k| if (!rctx) { ------------------ | Branch (61:7): [True: 0, False: 130k] ------------------ 62| 0| return 0; 63| 0| } 64| | 65| 130k| rctx->nbits = 2048; 66| 130k| rctx->pad_mode = RSA_PKCS1_PADDING; ------------------ | | 208| 130k|#define RSA_PKCS1_PADDING 1 ------------------ 67| 130k| rctx->saltlen = -2; 68| | 69| 130k| ctx->data = rctx; 70| | 71| 130k| return 1; 72| 130k|} p_rsa.cc:_ZL13pkey_rsa_copyP15evp_pkey_ctx_stS0_: 74| 65.3k|static int pkey_rsa_copy(EVP_PKEY_CTX *dst, EVP_PKEY_CTX *src) { 75| 65.3k| RSA_PKEY_CTX *dctx, *sctx; 76| 65.3k| if (!pkey_rsa_init(dst)) { ------------------ | Branch (76:7): [True: 0, False: 65.3k] ------------------ 77| 0| return 0; 78| 0| } 79| 65.3k| sctx = reinterpret_cast(src->data); 80| 65.3k| dctx = reinterpret_cast(dst->data); 81| 65.3k| dctx->nbits = sctx->nbits; 82| 65.3k| if (sctx->pub_exp) { ------------------ | Branch (82:7): [True: 0, False: 65.3k] ------------------ 83| 0| dctx->pub_exp = BN_dup(sctx->pub_exp); 84| 0| if (!dctx->pub_exp) { ------------------ | Branch (84:9): [True: 0, False: 0] ------------------ 85| 0| return 0; 86| 0| } 87| 0| } 88| | 89| 65.3k| dctx->pad_mode = sctx->pad_mode; 90| 65.3k| dctx->md = sctx->md; 91| 65.3k| dctx->mgf1md = sctx->mgf1md; 92| 65.3k| dctx->saltlen = sctx->saltlen; 93| 65.3k| if (sctx->oaep_label) { ------------------ | Branch (93:7): [True: 0, False: 65.3k] ------------------ 94| 0| OPENSSL_free(dctx->oaep_label); 95| 0| dctx->oaep_label = reinterpret_cast( 96| 0| OPENSSL_memdup(sctx->oaep_label, sctx->oaep_labellen)); 97| 0| if (!dctx->oaep_label) { ------------------ | Branch (97:9): [True: 0, False: 0] ------------------ 98| 0| return 0; 99| 0| } 100| 0| dctx->oaep_labellen = sctx->oaep_labellen; 101| 0| } 102| | 103| 65.3k| return 1; 104| 65.3k|} p_rsa.cc:_ZL16pkey_rsa_cleanupP15evp_pkey_ctx_st: 106| 130k|static void pkey_rsa_cleanup(EVP_PKEY_CTX *ctx) { 107| 130k| RSA_PKEY_CTX *rctx = reinterpret_cast(ctx->data); 108| | 109| 130k| if (rctx == NULL) { ------------------ | Branch (109:7): [True: 0, False: 130k] ------------------ 110| 0| return; 111| 0| } 112| | 113| 130k| BN_free(rctx->pub_exp); 114| 130k| OPENSSL_free(rctx->tbuf); 115| 130k| OPENSSL_free(rctx->oaep_label); 116| 130k| OPENSSL_free(rctx); 117| 130k|} p_rsa.cc:_ZL13pkey_rsa_signP15evp_pkey_ctx_stPhPmPKhm: 132| 28.0k| const uint8_t *tbs, size_t tbslen) { 133| 28.0k| RSA_PKEY_CTX *rctx = reinterpret_cast(ctx->data); 134| 28.0k| RSA *rsa = reinterpret_cast(ctx->pkey->pkey); 135| 28.0k| const size_t key_len = EVP_PKEY_size(ctx->pkey.get()); 136| | 137| 28.0k| if (!sig) { ------------------ | Branch (137:7): [True: 0, False: 28.0k] ------------------ 138| 0| *siglen = key_len; 139| 0| return 1; 140| 0| } 141| | 142| 28.0k| if (*siglen < key_len) { ------------------ | Branch (142:7): [True: 0, False: 28.0k] ------------------ 143| 0| OPENSSL_PUT_ERROR(EVP, EVP_R_BUFFER_TOO_SMALL); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 144| 0| return 0; 145| 0| } 146| | 147| 28.0k| if (rctx->md) { ------------------ | Branch (147:7): [True: 28.0k, False: 0] ------------------ 148| 28.0k| unsigned out_len; 149| 28.0k| switch (rctx->pad_mode) { 150| 379| case RSA_PKCS1_PADDING: ------------------ | | 208| 379|#define RSA_PKCS1_PADDING 1 ------------------ | Branch (150:7): [True: 379, False: 27.6k] ------------------ 151| 379| if (!RSA_sign(EVP_MD_type(rctx->md), tbs, tbslen, sig, &out_len, rsa)) { ------------------ | Branch (151:13): [True: 0, False: 379] ------------------ 152| 0| return 0; 153| 0| } 154| 379| *siglen = out_len; 155| 379| return 1; 156| | 157| 27.6k| case RSA_PKCS1_PSS_PADDING: ------------------ | | 219| 27.6k|#define RSA_PKCS1_PSS_PADDING 6 ------------------ | Branch (157:7): [True: 27.6k, False: 379] ------------------ 158| 27.6k| return RSA_sign_pss_mgf1(rsa, siglen, sig, *siglen, tbs, tbslen, 159| 27.6k| rctx->md, rctx->mgf1md, rctx->saltlen); 160| | 161| 0| default: ------------------ | Branch (161:7): [True: 0, False: 28.0k] ------------------ 162| 0| return 0; 163| 28.0k| } 164| 28.0k| } 165| | 166| 0| return RSA_sign_raw(rsa, siglen, sig, *siglen, tbs, tbslen, rctx->pad_mode); 167| 28.0k|} p_rsa.cc:_ZL15pkey_rsa_verifyP15evp_pkey_ctx_stPKhmS2_m: 170| 37.3k| const uint8_t *tbs, size_t tbslen) { 171| 37.3k| RSA_PKEY_CTX *rctx = reinterpret_cast(ctx->data); 172| 37.3k| RSA *rsa = reinterpret_cast(ctx->pkey->pkey); 173| | 174| 37.3k| if (rctx->md) { ------------------ | Branch (174:7): [True: 37.3k, False: 0] ------------------ 175| 37.3k| switch (rctx->pad_mode) { 176| 35.8k| case RSA_PKCS1_PADDING: ------------------ | | 208| 35.8k|#define RSA_PKCS1_PADDING 1 ------------------ | Branch (176:7): [True: 35.8k, False: 1.52k] ------------------ 177| 35.8k| return RSA_verify(EVP_MD_type(rctx->md), tbs, tbslen, sig, siglen, rsa); 178| | 179| 1.52k| case RSA_PKCS1_PSS_PADDING: ------------------ | | 219| 1.52k|#define RSA_PKCS1_PSS_PADDING 6 ------------------ | Branch (179:7): [True: 1.52k, False: 35.8k] ------------------ 180| 1.52k| return RSA_verify_pss_mgf1(rsa, tbs, tbslen, rctx->md, rctx->mgf1md, 181| 1.52k| rctx->saltlen, sig, siglen); 182| | 183| 0| default: ------------------ | Branch (183:7): [True: 0, False: 37.3k] ------------------ 184| 0| return 0; 185| 37.3k| } 186| 37.3k| } 187| | 188| 0| size_t rslen; 189| 0| const size_t key_len = EVP_PKEY_size(ctx->pkey.get()); 190| 0| if (!setup_tbuf(rctx, ctx) || ------------------ | Branch (190:7): [True: 0, False: 0] ------------------ 191| 0| !RSA_verify_raw(rsa, &rslen, rctx->tbuf, key_len, sig, siglen, ------------------ | Branch (191:7): [True: 0, False: 0] ------------------ 192| 0| rctx->pad_mode)) { 193| 0| return 0; 194| 0| } 195| 0| if (rslen != tbslen || CRYPTO_memcmp(tbs, rctx->tbuf, rslen) != 0) { ------------------ | Branch (195:7): [True: 0, False: 0] | Branch (195:26): [True: 0, False: 0] ------------------ 196| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_SIGNATURE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 197| 0| return 0; 198| 0| } 199| | 200| 0| return 1; 201| 0|} p_rsa.cc:_ZL13pkey_rsa_ctrlP15evp_pkey_ctx_stiiPv: 356| 123k|static int pkey_rsa_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2) { 357| 123k| RSA_PKEY_CTX *rctx = reinterpret_cast(ctx->data); 358| 123k| switch (type) { 359| 29.1k| case EVP_PKEY_CTRL_RSA_PADDING: ------------------ | | 158| 29.1k|#define EVP_PKEY_CTRL_RSA_PADDING (EVP_PKEY_ALG_CTRL + 1) | | ------------------ | | | | 156| 29.1k|#define EVP_PKEY_ALG_CTRL 0x1000 | | ------------------ ------------------ | Branch (359:5): [True: 29.1k, False: 94.5k] ------------------ 360| 29.1k| if (!is_known_padding(p1) || !check_padding_md(rctx->md, p1) || ------------------ | Branch (360:11): [True: 0, False: 29.1k] | Branch (360:36): [True: 0, False: 29.1k] ------------------ 361| 29.1k| (p1 == RSA_PKCS1_PSS_PADDING && ------------------ | | 219| 58.3k|#define RSA_PKCS1_PSS_PADDING 6 ------------------ | Branch (361:12): [True: 29.1k, False: 0] ------------------ 362| 29.1k| 0 == (ctx->operation & (EVP_PKEY_OP_SIGN | EVP_PKEY_OP_VERIFY))) || ------------------ | | 111| 29.1k|#define EVP_PKEY_OP_SIGN (1 << 3) ------------------ 0 == (ctx->operation & (EVP_PKEY_OP_SIGN | EVP_PKEY_OP_VERIFY))) || ------------------ | | 112| 29.1k|#define EVP_PKEY_OP_VERIFY (1 << 4) ------------------ | Branch (362:12): [True: 0, False: 29.1k] ------------------ 363| 29.1k| (p1 == RSA_PKCS1_OAEP_PADDING && ------------------ | | 214| 58.3k|#define RSA_PKCS1_OAEP_PADDING 4 ------------------ | Branch (363:12): [True: 0, False: 29.1k] ------------------ 364| 29.1k| 0 == (ctx->operation & EVP_PKEY_OP_TYPE_CRYPT))) { ------------------ | | 122| 0|#define EVP_PKEY_OP_TYPE_CRYPT (EVP_PKEY_OP_ENCRYPT | EVP_PKEY_OP_DECRYPT) | | ------------------ | | | | 114| 0|#define EVP_PKEY_OP_ENCRYPT (1 << 6) | | ------------------ | | #define EVP_PKEY_OP_TYPE_CRYPT (EVP_PKEY_OP_ENCRYPT | EVP_PKEY_OP_DECRYPT) | | ------------------ | | | | 115| 0|#define EVP_PKEY_OP_DECRYPT (1 << 7) | | ------------------ ------------------ | Branch (364:12): [True: 0, False: 0] ------------------ 365| 0| OPENSSL_PUT_ERROR(EVP, EVP_R_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 366| 0| return 0; 367| 0| } 368| 29.1k| if ((p1 == RSA_PKCS1_PSS_PADDING || p1 == RSA_PKCS1_OAEP_PADDING) && ------------------ | | 219| 58.3k|#define RSA_PKCS1_PSS_PADDING 6 ------------------ if ((p1 == RSA_PKCS1_PSS_PADDING || p1 == RSA_PKCS1_OAEP_PADDING) && ------------------ | | 214| 0|#define RSA_PKCS1_OAEP_PADDING 4 ------------------ | Branch (368:12): [True: 29.1k, False: 0] | Branch (368:43): [True: 0, False: 0] ------------------ 369| 29.1k| rctx->md == NULL) { ------------------ | Branch (369:11): [True: 0, False: 29.1k] ------------------ 370| 0| rctx->md = EVP_sha1(); 371| 0| } 372| 29.1k| rctx->pad_mode = p1; 373| 29.1k| return 1; 374| | 375| 0| case EVP_PKEY_CTRL_GET_RSA_PADDING: ------------------ | | 159| 0|#define EVP_PKEY_CTRL_GET_RSA_PADDING (EVP_PKEY_ALG_CTRL + 2) | | ------------------ | | | | 156| 0|#define EVP_PKEY_ALG_CTRL 0x1000 | | ------------------ ------------------ | Branch (375:5): [True: 0, False: 123k] ------------------ 376| 0| *(int *)p2 = rctx->pad_mode; 377| 0| return 1; 378| | 379| 29.1k| case EVP_PKEY_CTRL_RSA_PSS_SALTLEN: ------------------ | | 160| 29.1k|#define EVP_PKEY_CTRL_RSA_PSS_SALTLEN (EVP_PKEY_ALG_CTRL + 3) | | ------------------ | | | | 156| 29.1k|#define EVP_PKEY_ALG_CTRL 0x1000 | | ------------------ ------------------ | Branch (379:5): [True: 29.1k, False: 94.5k] ------------------ 380| 29.1k| case EVP_PKEY_CTRL_GET_RSA_PSS_SALTLEN: ------------------ | | 161| 29.1k|#define EVP_PKEY_CTRL_GET_RSA_PSS_SALTLEN (EVP_PKEY_ALG_CTRL + 4) | | ------------------ | | | | 156| 29.1k|#define EVP_PKEY_ALG_CTRL 0x1000 | | ------------------ ------------------ | Branch (380:5): [True: 0, False: 123k] ------------------ 381| 29.1k| if (rctx->pad_mode != RSA_PKCS1_PSS_PADDING) { ------------------ | | 219| 29.1k|#define RSA_PKCS1_PSS_PADDING 6 ------------------ | Branch (381:11): [True: 0, False: 29.1k] ------------------ 382| 0| OPENSSL_PUT_ERROR(EVP, EVP_R_INVALID_PSS_SALTLEN); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 383| 0| return 0; 384| 0| } 385| 29.1k| if (type == EVP_PKEY_CTRL_GET_RSA_PSS_SALTLEN) { ------------------ | | 161| 29.1k|#define EVP_PKEY_CTRL_GET_RSA_PSS_SALTLEN (EVP_PKEY_ALG_CTRL + 4) | | ------------------ | | | | 156| 29.1k|#define EVP_PKEY_ALG_CTRL 0x1000 | | ------------------ ------------------ | Branch (385:11): [True: 0, False: 29.1k] ------------------ 386| 0| *(int *)p2 = rctx->saltlen; 387| 29.1k| } else { 388| 29.1k| if (p1 < -2) { ------------------ | Branch (388:13): [True: 0, False: 29.1k] ------------------ 389| 0| return 0; 390| 0| } 391| 29.1k| rctx->saltlen = p1; 392| 29.1k| } 393| 29.1k| return 1; 394| | 395| 0| case EVP_PKEY_CTRL_RSA_KEYGEN_BITS: ------------------ | | 162| 0|#define EVP_PKEY_CTRL_RSA_KEYGEN_BITS (EVP_PKEY_ALG_CTRL + 5) | | ------------------ | | | | 156| 0|#define EVP_PKEY_ALG_CTRL 0x1000 | | ------------------ ------------------ | Branch (395:5): [True: 0, False: 123k] ------------------ 396| 0| if (p1 < 256) { ------------------ | Branch (396:11): [True: 0, False: 0] ------------------ 397| 0| OPENSSL_PUT_ERROR(EVP, EVP_R_INVALID_KEYBITS); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 398| 0| return 0; 399| 0| } 400| 0| rctx->nbits = p1; 401| 0| return 1; 402| | 403| 0| case EVP_PKEY_CTRL_RSA_KEYGEN_PUBEXP: ------------------ | | 163| 0|#define EVP_PKEY_CTRL_RSA_KEYGEN_PUBEXP (EVP_PKEY_ALG_CTRL + 6) | | ------------------ | | | | 156| 0|#define EVP_PKEY_ALG_CTRL 0x1000 | | ------------------ ------------------ | Branch (403:5): [True: 0, False: 123k] ------------------ 404| 0| if (!p2) { ------------------ | Branch (404:11): [True: 0, False: 0] ------------------ 405| 0| return 0; 406| 0| } 407| 0| BN_free(rctx->pub_exp); 408| 0| rctx->pub_exp = reinterpret_cast(p2); 409| 0| return 1; 410| | 411| 0| case EVP_PKEY_CTRL_RSA_OAEP_MD: ------------------ | | 164| 0|#define EVP_PKEY_CTRL_RSA_OAEP_MD (EVP_PKEY_ALG_CTRL + 7) | | ------------------ | | | | 156| 0|#define EVP_PKEY_ALG_CTRL 0x1000 | | ------------------ ------------------ | Branch (411:5): [True: 0, False: 123k] ------------------ 412| 0| case EVP_PKEY_CTRL_GET_RSA_OAEP_MD: ------------------ | | 165| 0|#define EVP_PKEY_CTRL_GET_RSA_OAEP_MD (EVP_PKEY_ALG_CTRL + 8) | | ------------------ | | | | 156| 0|#define EVP_PKEY_ALG_CTRL 0x1000 | | ------------------ ------------------ | Branch (412:5): [True: 0, False: 123k] ------------------ 413| 0| if (rctx->pad_mode != RSA_PKCS1_OAEP_PADDING) { ------------------ | | 214| 0|#define RSA_PKCS1_OAEP_PADDING 4 ------------------ | Branch (413:11): [True: 0, False: 0] ------------------ 414| 0| OPENSSL_PUT_ERROR(EVP, EVP_R_INVALID_PADDING_MODE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 415| 0| return 0; 416| 0| } 417| 0| if (type == EVP_PKEY_CTRL_GET_RSA_OAEP_MD) { ------------------ | | 165| 0|#define EVP_PKEY_CTRL_GET_RSA_OAEP_MD (EVP_PKEY_ALG_CTRL + 8) | | ------------------ | | | | 156| 0|#define EVP_PKEY_ALG_CTRL 0x1000 | | ------------------ ------------------ | Branch (417:11): [True: 0, False: 0] ------------------ 418| 0| *(const EVP_MD **)p2 = rctx->md; 419| 0| } else { 420| 0| rctx->md = reinterpret_cast(p2); 421| 0| } 422| 0| return 1; 423| | 424| 65.3k| case EVP_PKEY_CTRL_MD: ------------------ | | 140| 65.3k|#define EVP_PKEY_CTRL_MD 1 ------------------ | Branch (424:5): [True: 65.3k, False: 58.3k] ------------------ 425| 65.3k| if (!check_padding_md(reinterpret_cast(p2), rctx->pad_mode)) { ------------------ | Branch (425:11): [True: 0, False: 65.3k] ------------------ 426| 0| return 0; 427| 0| } 428| 65.3k| rctx->md = reinterpret_cast(p2); 429| 65.3k| return 1; 430| | 431| 0| case EVP_PKEY_CTRL_GET_MD: ------------------ | | 141| 0|#define EVP_PKEY_CTRL_GET_MD 2 ------------------ | Branch (431:5): [True: 0, False: 123k] ------------------ 432| 0| *(const EVP_MD **)p2 = rctx->md; 433| 0| return 1; 434| | 435| 0| case EVP_PKEY_CTRL_RSA_MGF1_MD: ------------------ | | 166| 0|#define EVP_PKEY_CTRL_RSA_MGF1_MD (EVP_PKEY_ALG_CTRL + 9) | | ------------------ | | | | 156| 0|#define EVP_PKEY_ALG_CTRL 0x1000 | | ------------------ ------------------ | Branch (435:5): [True: 0, False: 123k] ------------------ 436| 0| case EVP_PKEY_CTRL_GET_RSA_MGF1_MD: ------------------ | | 167| 0|#define EVP_PKEY_CTRL_GET_RSA_MGF1_MD (EVP_PKEY_ALG_CTRL + 10) | | ------------------ | | | | 156| 0|#define EVP_PKEY_ALG_CTRL 0x1000 | | ------------------ ------------------ | Branch (436:5): [True: 0, False: 123k] ------------------ 437| 0| if (rctx->pad_mode != RSA_PKCS1_PSS_PADDING && ------------------ | | 219| 0|#define RSA_PKCS1_PSS_PADDING 6 ------------------ | Branch (437:11): [True: 0, False: 0] ------------------ 438| 0| rctx->pad_mode != RSA_PKCS1_OAEP_PADDING) { ------------------ | | 214| 0|#define RSA_PKCS1_OAEP_PADDING 4 ------------------ | Branch (438:11): [True: 0, False: 0] ------------------ 439| 0| OPENSSL_PUT_ERROR(EVP, EVP_R_INVALID_MGF1_MD); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 440| 0| return 0; 441| 0| } 442| 0| if (type == EVP_PKEY_CTRL_GET_RSA_MGF1_MD) { ------------------ | | 167| 0|#define EVP_PKEY_CTRL_GET_RSA_MGF1_MD (EVP_PKEY_ALG_CTRL + 10) | | ------------------ | | | | 156| 0|#define EVP_PKEY_ALG_CTRL 0x1000 | | ------------------ ------------------ | Branch (442:11): [True: 0, False: 0] ------------------ 443| 0| if (rctx->mgf1md) { ------------------ | Branch (443:13): [True: 0, False: 0] ------------------ 444| 0| *(const EVP_MD **)p2 = rctx->mgf1md; 445| 0| } else { 446| 0| *(const EVP_MD **)p2 = rctx->md; 447| 0| } 448| 0| } else { 449| 0| rctx->mgf1md = reinterpret_cast(p2); 450| 0| } 451| 0| return 1; 452| | 453| 0| case EVP_PKEY_CTRL_RSA_OAEP_LABEL: { ------------------ | | 168| 0|#define EVP_PKEY_CTRL_RSA_OAEP_LABEL (EVP_PKEY_ALG_CTRL + 11) | | ------------------ | | | | 156| 0|#define EVP_PKEY_ALG_CTRL 0x1000 | | ------------------ ------------------ | Branch (453:5): [True: 0, False: 123k] ------------------ 454| 0| if (rctx->pad_mode != RSA_PKCS1_OAEP_PADDING) { ------------------ | | 214| 0|#define RSA_PKCS1_OAEP_PADDING 4 ------------------ | Branch (454:11): [True: 0, False: 0] ------------------ 455| 0| OPENSSL_PUT_ERROR(EVP, EVP_R_INVALID_PADDING_MODE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 456| 0| return 0; 457| 0| } 458| 0| OPENSSL_free(rctx->oaep_label); 459| 0| RSA_OAEP_LABEL_PARAMS *params = 460| 0| reinterpret_cast(p2); 461| 0| rctx->oaep_label = params->data; 462| 0| rctx->oaep_labellen = params->len; 463| 0| return 1; 464| 0| } 465| | 466| 0| case EVP_PKEY_CTRL_GET_RSA_OAEP_LABEL: ------------------ | | 169| 0|#define EVP_PKEY_CTRL_GET_RSA_OAEP_LABEL (EVP_PKEY_ALG_CTRL + 12) | | ------------------ | | | | 156| 0|#define EVP_PKEY_ALG_CTRL 0x1000 | | ------------------ ------------------ | Branch (466:5): [True: 0, False: 123k] ------------------ 467| 0| if (rctx->pad_mode != RSA_PKCS1_OAEP_PADDING) { ------------------ | | 214| 0|#define RSA_PKCS1_OAEP_PADDING 4 ------------------ | Branch (467:11): [True: 0, False: 0] ------------------ 468| 0| OPENSSL_PUT_ERROR(EVP, EVP_R_INVALID_PADDING_MODE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 469| 0| return 0; 470| 0| } 471| 0| CBS_init((CBS *)p2, rctx->oaep_label, rctx->oaep_labellen); 472| 0| return 1; 473| | 474| 0| default: ------------------ | Branch (474:5): [True: 0, False: 123k] ------------------ 475| 0| OPENSSL_PUT_ERROR(EVP, EVP_R_COMMAND_NOT_SUPPORTED); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 476| 0| return 0; 477| 123k| } 478| 123k|} p_rsa.cc:_ZL16is_known_paddingi: 344| 29.1k|static int is_known_padding(int padding_mode) { 345| 29.1k| switch (padding_mode) { 346| 0| case RSA_PKCS1_PADDING: ------------------ | | 208| 0|#define RSA_PKCS1_PADDING 1 ------------------ | Branch (346:5): [True: 0, False: 29.1k] ------------------ 347| 0| case RSA_NO_PADDING: ------------------ | | 211| 0|#define RSA_NO_PADDING 3 ------------------ | Branch (347:5): [True: 0, False: 29.1k] ------------------ 348| 0| case RSA_PKCS1_OAEP_PADDING: ------------------ | | 214| 0|#define RSA_PKCS1_OAEP_PADDING 4 ------------------ | Branch (348:5): [True: 0, False: 29.1k] ------------------ 349| 29.1k| case RSA_PKCS1_PSS_PADDING: ------------------ | | 219| 29.1k|#define RSA_PKCS1_PSS_PADDING 6 ------------------ | Branch (349:5): [True: 29.1k, False: 0] ------------------ 350| 29.1k| return 1; 351| 0| default: ------------------ | Branch (351:5): [True: 0, False: 29.1k] ------------------ 352| 0| return 0; 353| 29.1k| } 354| 29.1k|} p_rsa.cc:_ZL16check_padding_mdPK9env_md_sti: 331| 94.5k|static int check_padding_md(const EVP_MD *md, int padding) { 332| 94.5k| if (!md) { ------------------ | Branch (332:7): [True: 0, False: 94.5k] ------------------ 333| 0| return 1; 334| 0| } 335| | 336| 94.5k| if (padding == RSA_NO_PADDING) { ------------------ | | 211| 94.5k|#define RSA_NO_PADDING 3 ------------------ | Branch (336:7): [True: 0, False: 94.5k] ------------------ 337| 0| OPENSSL_PUT_ERROR(EVP, EVP_R_INVALID_PADDING_MODE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 338| 0| return 0; 339| 0| } 340| | 341| 94.5k| return 1; 342| 94.5k|} EVP_PKEY_set1_RSA: 170| 2|int EVP_PKEY_set1_RSA(EVP_PKEY *pkey, RSA *key) { 171| 2| if (EVP_PKEY_assign_RSA(pkey, key)) { ------------------ | Branch (171:7): [True: 2, False: 0] ------------------ 172| 2| RSA_up_ref(key); 173| 2| return 1; 174| 2| } 175| 0| return 0; 176| 2|} EVP_PKEY_assign_RSA: 178| 79.7k|int EVP_PKEY_assign_RSA(EVP_PKEY *pkey, RSA *key) { 179| 79.7k| evp_pkey_set_method(pkey, &rsa_asn1_meth); 180| 79.7k| pkey->pkey = key; 181| 79.7k| return key != NULL; 182| 79.7k|} EVP_PKEY_get0_RSA: 184| 1.73k|RSA *EVP_PKEY_get0_RSA(const EVP_PKEY *pkey) { 185| 1.73k| if (pkey->type != EVP_PKEY_RSA) { ------------------ | | 133| 1.73k|#define EVP_PKEY_RSA NID_rsaEncryption | | ------------------ | | | | 72| 1.73k|#define NID_rsaEncryption 6 | | ------------------ ------------------ | Branch (185:7): [True: 0, False: 1.73k] ------------------ 186| 0| OPENSSL_PUT_ERROR(EVP, EVP_R_EXPECTING_AN_RSA_KEY); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 187| 0| return NULL; 188| 0| } 189| 1.73k| return reinterpret_cast(pkey->pkey); 190| 1.73k|} p_rsa_asn1.cc:_ZL14rsa_pub_decodeP11evp_pkey_stP6cbs_stS2_: 48| 83.3k|static int rsa_pub_decode(EVP_PKEY *out, CBS *params, CBS *key) { 49| | // See RFC 3279, section 2.3.1. 50| | 51| | // The parameters must be NULL. 52| 83.3k| CBS null; 53| 83.3k| if (!CBS_get_asn1(params, &null, CBS_ASN1_NULL) || CBS_len(&null) != 0 || ------------------ | | 219| 83.3k|#define CBS_ASN1_NULL 0x5u ------------------ | Branch (53:7): [True: 145, False: 83.2k] | Branch (53:54): [True: 1, False: 83.2k] ------------------ 54| 83.3k| CBS_len(params) != 0) { ------------------ | Branch (54:7): [True: 1, False: 83.2k] ------------------ 55| 147| OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR); ------------------ | | 361| 147| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 56| 147| return 0; 57| 147| } 58| | 59| 83.2k| RSA *rsa = RSA_parse_public_key(key); 60| 83.2k| if (rsa == NULL || CBS_len(key) != 0) { ------------------ | Branch (60:7): [True: 3.52k, False: 79.7k] | Branch (60:22): [True: 3, False: 79.7k] ------------------ 61| 3.53k| OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR); ------------------ | | 361| 3.53k| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 62| 3.53k| RSA_free(rsa); 63| 3.53k| return 0; 64| 3.53k| } 65| | 66| 79.7k| EVP_PKEY_assign_RSA(out, rsa); 67| 79.7k| return 1; 68| 83.2k|} p_rsa_asn1.cc:_ZL14rsa_pub_encodeP6cbb_stPK11evp_pkey_st: 28| 10|static int rsa_pub_encode(CBB *out, const EVP_PKEY *key) { 29| | // See RFC 3279, section 2.3.1. 30| 10| const RSA *rsa = reinterpret_cast(key->pkey); 31| 10| CBB spki, algorithm, null, key_bitstring; 32| 10| if (!CBB_add_asn1(out, &spki, CBS_ASN1_SEQUENCE) || ------------------ | | 223| 10|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED) | | ------------------ | | | | 197| 10|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | | | ------------------ | | | | | | 194| 10|#define CBS_ASN1_TAG_SHIFT 24 | | | | ------------------ | | ------------------ ------------------ | Branch (32:7): [True: 0, False: 10] ------------------ 33| 10| !CBB_add_asn1(&spki, &algorithm, CBS_ASN1_SEQUENCE) || ------------------ | | 223| 10|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED) | | ------------------ | | | | 197| 10|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | | | ------------------ | | | | | | 194| 10|#define CBS_ASN1_TAG_SHIFT 24 | | | | ------------------ | | ------------------ ------------------ | Branch (33:7): [True: 0, False: 10] ------------------ 34| 10| !CBB_add_asn1_element(&algorithm, CBS_ASN1_OBJECT, rsa_asn1_meth.oid, ------------------ | | 220| 10|#define CBS_ASN1_OBJECT 0x6u ------------------ | Branch (34:7): [True: 0, False: 10] ------------------ 35| 10| rsa_asn1_meth.oid_len) || 36| 10| !CBB_add_asn1(&algorithm, &null, CBS_ASN1_NULL) || ------------------ | | 219| 10|#define CBS_ASN1_NULL 0x5u ------------------ | Branch (36:7): [True: 0, False: 10] ------------------ 37| 10| !CBB_add_asn1(&spki, &key_bitstring, CBS_ASN1_BITSTRING) || ------------------ | | 217| 10|#define CBS_ASN1_BITSTRING 0x3u ------------------ | Branch (37:7): [True: 0, False: 10] ------------------ 38| 10| !CBB_add_u8(&key_bitstring, 0 /* padding */) || ------------------ | Branch (38:7): [True: 0, False: 10] ------------------ 39| 10| !RSA_marshal_public_key(&key_bitstring, rsa) || // ------------------ | Branch (39:7): [True: 0, False: 10] ------------------ 40| 10| !CBB_flush(out)) { ------------------ | Branch (40:7): [True: 0, False: 10] ------------------ 41| 0| OPENSSL_PUT_ERROR(EVP, EVP_R_ENCODE_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 42| 0| return 0; 43| 0| } 44| | 45| 10| return 1; 46| 10|} p_rsa_asn1.cc:_ZL11rsa_pub_cmpPK11evp_pkey_stS1_: 70| 2|static int rsa_pub_cmp(const EVP_PKEY *a, const EVP_PKEY *b) { 71| 2| const RSA *a_rsa = reinterpret_cast(a->pkey); 72| 2| const RSA *b_rsa = reinterpret_cast(b->pkey); 73| 2| return BN_cmp(RSA_get0_n(b_rsa), RSA_get0_n(a_rsa)) == 0 && ------------------ | Branch (73:10): [True: 2, False: 0] ------------------ 74| 2| BN_cmp(RSA_get0_e(b_rsa), RSA_get0_e(a_rsa)) == 0; ------------------ | Branch (74:10): [True: 2, False: 0] ------------------ 75| 2|} p_rsa_asn1.cc:_ZL10rsa_opaquePK11evp_pkey_st: 116| 2|static int rsa_opaque(const EVP_PKEY *pkey) { 117| 2| const RSA *rsa = reinterpret_cast(pkey->pkey); 118| 2| return RSA_is_opaque(rsa); 119| 2|} p_rsa_asn1.cc:_ZL12int_rsa_sizePK11evp_pkey_st: 121| 143k|static int int_rsa_size(const EVP_PKEY *pkey) { 122| 143k| const RSA *rsa = reinterpret_cast(pkey->pkey); 123| 143k| return RSA_size(rsa); 124| 143k|} p_rsa_asn1.cc:_ZL12int_rsa_freeP11evp_pkey_st: 131| 163k|static void int_rsa_free(EVP_PKEY *pkey) { 132| 163k| RSA_free(reinterpret_cast(pkey->pkey)); 133| 163k| pkey->pkey = NULL; 134| 163k|} p_x25519_asn1.cc:_ZL17x25519_pub_decodeP11evp_pkey_stP6cbs_stS2_: 130| 17|static int x25519_pub_decode(EVP_PKEY *out, CBS *params, CBS *key) { 131| | // See RFC 8410, section 4. 132| | 133| | // The parameters must be omitted. Public keys have length 32. 134| 17| if (CBS_len(params) != 0) { ------------------ | Branch (134:7): [True: 1, False: 16] ------------------ 135| 1| OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR); ------------------ | | 361| 1| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 136| 1| return 0; 137| 1| } 138| | 139| 16| return x25519_set_pub_raw(out, CBS_data(key), CBS_len(key)); 140| 17|} p_x25519_asn1.cc:_ZL18x25519_set_pub_rawP11evp_pkey_stPKhm: 52| 16|static int x25519_set_pub_raw(EVP_PKEY *pkey, const uint8_t *in, size_t len) { 53| 16| if (len != 32) { ------------------ | Branch (53:7): [True: 1, False: 15] ------------------ 54| 1| OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR); ------------------ | | 361| 1| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 55| 1| return 0; 56| 1| } 57| | 58| 15| X25519_KEY *key = 59| 15| reinterpret_cast(OPENSSL_malloc(sizeof(X25519_KEY))); 60| 15| if (key == NULL) { ------------------ | Branch (60:7): [True: 0, False: 15] ------------------ 61| 0| return 0; 62| 0| } 63| | 64| 15| OPENSSL_memcpy(key->pub, in, 32); 65| 15| key->has_private = 0; 66| | 67| 15| x25519_free(pkey); 68| 15| pkey->pkey = key; 69| 15| return 1; 70| 15|} p_x25519_asn1.cc:_ZL11x25519_freeP11evp_pkey_st: 26| 32|static void x25519_free(EVP_PKEY *pkey) { 27| 32| OPENSSL_free(pkey->pkey); 28| 32| pkey->pkey = NULL; 29| 32|} CRYPTO_set_ex_data: 76| 2.99k|int CRYPTO_set_ex_data(CRYPTO_EX_DATA *ad, int index, void *val) { 77| 2.99k| if (index < 0) { ------------------ | Branch (77:7): [True: 0, False: 2.99k] ------------------ 78| | // A caller that can accidentally pass in an invalid index into this 79| | // function will hit an memory error if |index| happened to be valid, and 80| | // expected |val| to be of a different type. 81| 0| abort(); 82| 0| } 83| | 84| 2.99k| if (ad->sk == NULL) { ------------------ | Branch (84:7): [True: 2.99k, False: 0] ------------------ 85| 2.99k| ad->sk = sk_void_new_null(); 86| 2.99k| if (ad->sk == NULL) { ------------------ | Branch (86:9): [True: 0, False: 2.99k] ------------------ 87| 0| return 0; 88| 0| } 89| 2.99k| } 90| | 91| | // Add NULL values until the stack is long enough. 92| 5.99k| for (size_t i = sk_void_num(ad->sk); i <= (size_t)index; i++) { ------------------ | Branch (92:40): [True: 2.99k, False: 2.99k] ------------------ 93| 2.99k| if (!sk_void_push(ad->sk, NULL)) { ------------------ | Branch (93:9): [True: 0, False: 2.99k] ------------------ 94| 0| return 0; 95| 0| } 96| 2.99k| } 97| | 98| 2.99k| sk_void_set(ad->sk, (size_t)index, val); 99| 2.99k| return 1; 100| 2.99k|} CRYPTO_new_ex_data: 109| 386k|void CRYPTO_new_ex_data(CRYPTO_EX_DATA *ad) { ad->sk = NULL; } CRYPTO_free_ex_data: 112| 389k| CRYPTO_EX_DATA *ad) { 113| 389k| if (ad->sk == NULL) { ------------------ | Branch (113:7): [True: 386k, False: 2.99k] ------------------ 114| | // Nothing to do. 115| 386k| return; 116| 386k| } 117| | 118| 2.99k| uint32_t num_funcs = CRYPTO_atomic_load_u32(&ex_data_class->num_funcs); 119| | // |CRYPTO_get_ex_new_index_ex| will not allocate indices beyond |INT_MAX|. 120| 2.99k| assert(num_funcs <= (size_t)(INT_MAX - ex_data_class->num_reserved)); 121| | 122| | // Defer dereferencing |ex_data_class->funcs| and |funcs->next|. It must come 123| | // after the |num_funcs| comparison to be correctly synchronized. 124| 2.99k| CRYPTO_EX_DATA_FUNCS *const *funcs = &ex_data_class->funcs; 125| 2.99k| for (uint32_t i = 0; i < num_funcs; i++) { ------------------ | Branch (125:24): [True: 0, False: 2.99k] ------------------ 126| 0| if ((*funcs)->free_func != NULL) { ------------------ | Branch (126:9): [True: 0, False: 0] ------------------ 127| 0| int index = (int)i + ex_data_class->num_reserved; 128| 0| void *ptr = CRYPTO_get_ex_data(ad, index); 129| 0| (*funcs)->free_func(/*parent=*/nullptr, ptr, /*ad*/ nullptr, index, 130| 0| (*funcs)->argl, (*funcs)->argp); 131| 0| } 132| 0| funcs = &(*funcs)->next; 133| 0| } 134| | 135| 2.99k| sk_void_free(ad->sk); 136| 2.99k| ad->sk = NULL; 137| 2.99k|} aes_hw_set_decrypt_key: 88| 30.4k|int aes_hw_set_decrypt_key(const uint8_t *user_key, int bits, AES_KEY *key) { 89| 30.4k| int ret = aes_hw_set_encrypt_key(user_key, bits, key); 90| 30.4k| if (ret == 0) { ------------------ | Branch (90:7): [True: 30.4k, False: 0] ------------------ 91| 30.4k| aes_hw_encrypt_key_to_decrypt_key(key); 92| 30.4k| } 93| 30.4k| return ret; 94| 30.4k|} aes_hw_set_encrypt_key: 96| 976k|int aes_hw_set_encrypt_key(const uint8_t *user_key, int bits, AES_KEY *key) { 97| 976k| if (aes_hw_set_encrypt_key_alt_preferred()) { ------------------ | Branch (97:7): [True: 976k, False: 0] ------------------ 98| 976k| return aes_hw_set_encrypt_key_alt(user_key, bits, key); 99| 976k| } else { 100| 0| return aes_hw_set_encrypt_key_base(user_key, bits, key); 101| 0| } 102| 976k|} aes_ctr_set_key: 164| 915k| size_t key_bytes) { 165| | // This function assumes the key length was previously validated. 166| 915k| assert(key_bytes == 128 / 8 || key_bytes == 192 / 8 || key_bytes == 256 / 8); 167| 915k| if (hwaes_capable()) { ------------------ | Branch (167:7): [True: 915k, False: 0] ------------------ 168| 915k| aes_hw_set_encrypt_key(key, (int)key_bytes * 8, aes_key); 169| 915k| if (out_is_hwaes) { ------------------ | Branch (169:9): [True: 40.3k, False: 874k] ------------------ 170| 40.3k| *out_is_hwaes = 1; 171| 40.3k| } 172| 915k| if (out_block) { ------------------ | Branch (172:9): [True: 915k, False: 0] ------------------ 173| 915k| *out_block = aes_hw_encrypt; 174| 915k| } 175| 915k| return aes_hw_ctr32_encrypt_blocks; 176| 915k| } 177| | 178| 0| if (vpaes_capable()) { ------------------ | Branch (178:7): [True: 0, False: 0] ------------------ 179| 0| vpaes_set_encrypt_key(key, (int)key_bytes * 8, aes_key); 180| 0| if (out_block) { ------------------ | Branch (180:9): [True: 0, False: 0] ------------------ 181| 0| *out_block = vpaes_encrypt; 182| 0| } 183| 0| if (out_is_hwaes) { ------------------ | Branch (183:9): [True: 0, False: 0] ------------------ 184| 0| *out_is_hwaes = 0; 185| 0| } 186| |#if defined(BSAES) 187| | assert(bsaes_capable()); 188| | return vpaes_ctr32_encrypt_blocks_with_bsaes; 189| |#else 190| 0| return vpaes_ctr32_encrypt_blocks; 191| 0|#endif 192| 0| } 193| | 194| 0| aes_nohw_set_encrypt_key(key, (int)key_bytes * 8, aes_key); 195| 0| if (out_is_hwaes) { ------------------ | Branch (195:7): [True: 0, False: 0] ------------------ 196| 0| *out_is_hwaes = 0; 197| 0| } 198| 0| if (out_block) { ------------------ | Branch (198:7): [True: 0, False: 0] ------------------ 199| 0| *out_block = aes_nohw_encrypt; 200| 0| } 201| 0| return aes_nohw_ctr32_encrypt_blocks; 202| 0|} CRYPTO_ghash_init: 172| 40.3k| u128 out_table[16], const uint8_t gcm_key[16]) { 173| | // H is passed to |gcm_init_*| as a pair of byte-swapped, 64-bit values. 174| 40.3k| uint64_t H[2] = {CRYPTO_load_u64_be(gcm_key), 175| 40.3k| CRYPTO_load_u64_be(gcm_key + 8)}; 176| | 177| 40.3k|#if defined(GHASH_ASM_X86_64) 178| 40.3k| if (crypto_gcm_clmul_enabled()) { ------------------ | Branch (178:7): [True: 40.3k, False: 0] ------------------ 179| 40.3k| if (CRYPTO_is_VPCLMULQDQ_capable() && CRYPTO_is_AVX2_capable()) { ------------------ | Branch (179:9): [True: 0, False: 40.3k] | Branch (179:43): [True: 0, False: 0] ------------------ 180| 0| if (CRYPTO_is_AVX512BW_capable() && CRYPTO_is_AVX512VL_capable() && ------------------ | Branch (180:11): [True: 0, False: 0] | Branch (180:43): [True: 0, False: 0] ------------------ 181| 0| CRYPTO_is_BMI2_capable() && !CRYPTO_cpu_avoid_zmm_registers()) { ------------------ | Branch (181:11): [True: 0, False: 0] | Branch (181:39): [True: 0, False: 0] ------------------ 182| 0| gcm_init_vpclmulqdq_avx512(out_table, H); 183| 0| *out_mult = gcm_gmult_vpclmulqdq_avx512; 184| 0| *out_hash = gcm_ghash_vpclmulqdq_avx512; 185| 0| return; 186| 0| } 187| 0| gcm_init_vpclmulqdq_avx2(out_table, H); 188| 0| *out_mult = gcm_gmult_vpclmulqdq_avx2; 189| 0| *out_hash = gcm_ghash_vpclmulqdq_avx2; 190| 0| return; 191| 0| } 192| 40.3k| if (CRYPTO_is_AVX_capable() && CRYPTO_is_MOVBE_capable()) { ------------------ | Branch (192:9): [True: 40.3k, False: 0] | Branch (192:36): [True: 40.3k, False: 0] ------------------ 193| 40.3k| gcm_init_avx(out_table, H); 194| 40.3k| *out_mult = gcm_gmult_avx; 195| 40.3k| *out_hash = gcm_ghash_avx; 196| 40.3k| return; 197| 40.3k| } 198| 0| gcm_init_clmul(out_table, H); 199| 0| *out_mult = gcm_gmult_clmul; 200| 0| *out_hash = gcm_ghash_clmul; 201| 0| return; 202| 40.3k| } 203| 0| if (CRYPTO_is_SSSE3_capable()) { ------------------ | Branch (203:7): [True: 0, False: 0] ------------------ 204| 0| gcm_init_ssse3(out_table, H); 205| 0| *out_mult = gcm_gmult_ssse3; 206| 0| *out_hash = gcm_ghash_ssse3; 207| 0| return; 208| 0| } 209| |#elif defined(GHASH_ASM_X86) 210| | if (crypto_gcm_clmul_enabled()) { 211| | gcm_init_clmul(out_table, H); 212| | *out_mult = gcm_gmult_clmul; 213| | *out_hash = gcm_ghash_clmul; 214| | return; 215| | } 216| | if (CRYPTO_is_SSSE3_capable()) { 217| | gcm_init_ssse3(out_table, H); 218| | *out_mult = gcm_gmult_ssse3; 219| | *out_hash = gcm_ghash_ssse3; 220| | return; 221| | } 222| |#elif defined(GHASH_ASM_ARM) 223| | if (gcm_pmull_capable()) { 224| | gcm_init_v8(out_table, H); 225| | *out_mult = gcm_gmult_v8; 226| | *out_hash = gcm_ghash_v8; 227| | return; 228| | } 229| | 230| | if (gcm_neon_capable()) { 231| | gcm_init_neon(out_table, H); 232| | *out_mult = gcm_gmult_neon; 233| | *out_hash = gcm_ghash_neon; 234| | return; 235| | } 236| |#endif 237| | 238| 0| gcm_init_nohw(out_table, H); 239| 0| *out_mult = gcm_gmult_nohw; 240| 0| *out_hash = gcm_ghash_nohw; 241| 0|} CRYPTO_gcm128_init_aes_key: 244| 40.3k| size_t key_bytes) { 245| 40.3k| switch (key_bytes) { ------------------ | Branch (245:11): [True: 0, False: 40.3k] ------------------ 246| 30.2k| case 16: ------------------ | Branch (246:5): [True: 30.2k, False: 10.0k] ------------------ 247| 30.2k| boringssl_fips_inc_counter(fips_counter_evp_aes_128_gcm); 248| 30.2k| break; 249| | 250| 10.0k| case 32: ------------------ | Branch (250:5): [True: 10.0k, False: 30.2k] ------------------ 251| 10.0k| boringssl_fips_inc_counter(fips_counter_evp_aes_256_gcm); 252| 10.0k| break; 253| 40.3k| } 254| | 255| 40.3k| OPENSSL_memset(gcm_key, 0, sizeof(*gcm_key)); 256| 40.3k| int is_hwaes; 257| 40.3k| gcm_key->ctr = aes_ctr_set_key(&gcm_key->aes, &is_hwaes, &gcm_key->block, key, 258| 40.3k| key_bytes); 259| | 260| 40.3k| uint8_t ghash_key[16]; 261| 40.3k| OPENSSL_memset(ghash_key, 0, sizeof(ghash_key)); 262| 40.3k| gcm_key->block(ghash_key, ghash_key, &gcm_key->aes); 263| | 264| 40.3k| CRYPTO_ghash_init(&gcm_key->gmult, &gcm_key->ghash, gcm_key->Htable, 265| 40.3k| ghash_key); 266| | 267| 40.3k|#if !defined(OPENSSL_NO_ASM) 268| 40.3k|#if defined(OPENSSL_X86_64) 269| 40.3k| if (gcm_key->ghash == gcm_ghash_vpclmulqdq_avx512 && ------------------ | Branch (269:7): [True: 0, False: 40.3k] ------------------ 270| 40.3k| CRYPTO_is_VAES_capable()) { ------------------ | Branch (270:7): [True: 0, False: 0] ------------------ 271| 0| gcm_key->impl = gcm_x86_vaes_avx512; 272| 40.3k| } else if (gcm_key->ghash == gcm_ghash_vpclmulqdq_avx2 && ------------------ | Branch (272:14): [True: 0, False: 40.3k] ------------------ 273| 40.3k| CRYPTO_is_VAES_capable()) { ------------------ | Branch (273:14): [True: 0, False: 0] ------------------ 274| 0| gcm_key->impl = gcm_x86_vaes_avx2; 275| 40.3k| } else if (gcm_key->ghash == gcm_ghash_avx && is_hwaes) { ------------------ | Branch (275:14): [True: 40.3k, False: 0] | Branch (275:49): [True: 40.3k, False: 0] ------------------ 276| 40.3k| gcm_key->impl = gcm_x86_aesni; 277| 40.3k| } 278| |#elif defined(OPENSSL_AARCH64) 279| | if (gcm_pmull_capable() && is_hwaes) { 280| | gcm_key->impl = gcm_arm64_aes; 281| | } 282| |#endif 283| 40.3k|#endif 284| 40.3k|} crypto_gcm_clmul_enabled: 597| 96.7k|int crypto_gcm_clmul_enabled(void) { 598| 96.7k|#if defined(GHASH_ASM_X86) || defined(GHASH_ASM_X86_64) 599| 96.7k| return CRYPTO_is_PCLMUL_capable() && CRYPTO_is_SSSE3_capable(); ------------------ | Branch (599:10): [True: 96.7k, False: 0] | Branch (599:40): [True: 96.7k, False: 0] ------------------ 600| |#else 601| | return 0; 602| |#endif 603| 96.7k|} hwaes_capable: 60| 2.00M|inline int hwaes_capable(void) { return CRYPTO_is_AESNI_capable(); } aes_hw_set_encrypt_key_alt_preferred: 118| 976k|inline int aes_hw_set_encrypt_key_alt_preferred(void) { 119| 976k| return hwaes_capable() && CRYPTO_is_AVX_capable(); ------------------ | Branch (119:10): [True: 976k, False: 0] | Branch (119:29): [True: 976k, False: 0] ------------------ 120| 976k|} bcm_success: 53| 56.3k|inline int bcm_success(bcm_status status) { 54| 56.3k| return status == bcm_status::approved || status == bcm_status::not_approved; ------------------ | Branch (54:10): [True: 56.3k, False: 0] | Branch (54:44): [True: 0, False: 0] ------------------ 55| 56.3k|} bn_uadd_consttime: 62| 2.56M|int bn_uadd_consttime(BIGNUM *r, const BIGNUM *a, const BIGNUM *b) { 63| | // Widths are public, so we normalize to make |a| the larger one. 64| 2.56M| if (a->width < b->width) { ------------------ | Branch (64:7): [True: 95.6k, False: 2.46M] ------------------ 65| 95.6k| const BIGNUM *tmp = a; 66| 95.6k| a = b; 67| 95.6k| b = tmp; 68| 95.6k| } 69| | 70| 2.56M| int max = a->width; 71| 2.56M| int min = b->width; 72| 2.56M| if (!bn_wexpand(r, max + 1)) { ------------------ | Branch (72:7): [True: 0, False: 2.56M] ------------------ 73| 0| return 0; 74| 0| } 75| 2.56M| r->width = max + 1; 76| | 77| 2.56M| BN_ULONG carry = bn_add_words(r->d, a->d, b->d, min); 78| 3.92M| for (int i = min; i < max; i++) { ------------------ | Branch (78:21): [True: 1.35M, False: 2.56M] ------------------ 79| 1.35M| r->d[i] = CRYPTO_addc_w(a->d[i], 0, carry, &carry); ------------------ | | 1562| 1.35M|#define CRYPTO_addc_w CRYPTO_addc_u64 ------------------ 80| 1.35M| } 81| | 82| 2.56M| r->d[max] = carry; 83| 2.56M| return 1; 84| 2.56M|} BN_uadd: 86| 2.53M|int BN_uadd(BIGNUM *r, const BIGNUM *a, const BIGNUM *b) { 87| 2.53M| if (!bn_uadd_consttime(r, a, b)) { ------------------ | Branch (87:7): [True: 0, False: 2.53M] ------------------ 88| 0| return 0; 89| 0| } 90| 2.53M| bn_set_minimal_width(r); 91| 2.53M| return 1; 92| 2.53M|} BN_sub: 134| 876|int BN_sub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b) { 135| 876| int add = 0, neg = 0; 136| 876| const BIGNUM *tmp; 137| | 138| | // a - b a-b 139| | // a - -b a+b 140| | // -a - b -(a+b) 141| | // -a - -b b-a 142| 876| if (a->neg) { ------------------ | Branch (142:7): [True: 0, False: 876] ------------------ 143| 0| if (b->neg) { ------------------ | Branch (143:9): [True: 0, False: 0] ------------------ 144| 0| tmp = a; 145| 0| a = b; 146| 0| b = tmp; 147| 0| } else { 148| 0| add = 1; 149| 0| neg = 1; 150| 0| } 151| 876| } else { 152| 876| if (b->neg) { ------------------ | Branch (152:9): [True: 0, False: 876] ------------------ 153| 0| add = 1; 154| 0| neg = 0; 155| 0| } 156| 876| } 157| | 158| 876| if (add) { ------------------ | Branch (158:7): [True: 0, False: 876] ------------------ 159| 0| if (!BN_uadd(r, a, b)) { ------------------ | Branch (159:9): [True: 0, False: 0] ------------------ 160| 0| return 0; 161| 0| } 162| | 163| 0| r->neg = neg; 164| 0| return 1; 165| 0| } 166| | 167| 876| if (BN_ucmp(a, b) < 0) { ------------------ | Branch (167:7): [True: 336, False: 540] ------------------ 168| 336| if (!BN_usub(r, b, a)) { ------------------ | Branch (168:9): [True: 0, False: 336] ------------------ 169| 0| return 0; 170| 0| } 171| 336| r->neg = 1; 172| 540| } else { 173| 540| if (!BN_usub(r, a, b)) { ------------------ | Branch (173:9): [True: 0, False: 540] ------------------ 174| 0| return 0; 175| 0| } 176| 540| r->neg = 0; 177| 540| } 178| | 179| 876| return 1; 180| 876|} bn_usub_consttime: 182| 1.26M|int bn_usub_consttime(BIGNUM *r, const BIGNUM *a, const BIGNUM *b) { 183| | // |b| may have more words than |a| given non-minimal inputs, but all words 184| | // beyond |a->width| must then be zero. 185| 1.26M| int b_width = b->width; 186| 1.26M| if (b_width > a->width) { ------------------ | Branch (186:7): [True: 0, False: 1.26M] ------------------ 187| 0| if (!bn_fits_in_words(b, a->width)) { ------------------ | Branch (187:9): [True: 0, False: 0] ------------------ 188| 0| OPENSSL_PUT_ERROR(BN, BN_R_ARG2_LT_ARG3); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 189| 0| return 0; 190| 0| } 191| 0| b_width = a->width; 192| 0| } 193| | 194| 1.26M| if (!bn_wexpand(r, a->width)) { ------------------ | Branch (194:7): [True: 0, False: 1.26M] ------------------ 195| 0| return 0; 196| 0| } 197| | 198| 1.26M| BN_ULONG borrow = bn_sub_words(r->d, a->d, b->d, b_width); 199| 1.31M| for (int i = b_width; i < a->width; i++) { ------------------ | Branch (199:25): [True: 48.0k, False: 1.26M] ------------------ 200| 48.0k| r->d[i] = CRYPTO_subc_w(a->d[i], 0, borrow, &borrow); ------------------ | | 1563| 48.0k|#define CRYPTO_subc_w CRYPTO_subc_u64 ------------------ 201| 48.0k| } 202| | 203| 1.26M| if (borrow) { ------------------ | Branch (203:7): [True: 0, False: 1.26M] ------------------ 204| 0| OPENSSL_PUT_ERROR(BN, BN_R_ARG2_LT_ARG3); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 205| 0| return 0; 206| 0| } 207| | 208| 1.26M| r->width = a->width; 209| 1.26M| r->neg = 0; 210| 1.26M| return 1; 211| 1.26M|} BN_usub: 213| 1.26M|int BN_usub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b) { 214| 1.26M| if (!bn_usub_consttime(r, a, b)) { ------------------ | Branch (214:7): [True: 0, False: 1.26M] ------------------ 215| 0| return 0; 216| 0| } 217| 1.26M| bn_set_minimal_width(r); 218| 1.26M| return 1; 219| 1.26M|} bn_mul_add_words: 125| 4.35M| BN_ULONG w) { 126| 4.35M| BN_ULONG c1 = 0; 127| | 128| 4.35M| if (num == 0) { ------------------ | Branch (128:7): [True: 0, False: 4.35M] ------------------ 129| 0| return (c1); 130| 0| } 131| | 132| 24.3M| while (num & ~3) { ------------------ | Branch (132:10): [True: 19.9M, False: 4.35M] ------------------ 133| 19.9M| mul_add(rp[0], ap[0], w, c1); ------------------ | | 80| 19.9M| do { \ | | 81| 19.9M| BN_ULONG high, low; \ | | 82| 19.9M| __asm__("mulq %3" : "=a"(low), "=d"(high) : "a"(word), "m"(a) : "cc"); \ | | 83| 19.9M| __asm__("addq %2,%0; adcq $0,%1" \ | | 84| 19.9M| : "+r"(carry), "+d"(high) \ | | 85| 19.9M| : "a"(low) \ | | 86| 19.9M| : "cc"); \ | | 87| 19.9M| __asm__("addq %2,%0; adcq $0,%1" \ | | 88| 19.9M| : "+m"(r), "+d"(high) \ | | 89| 19.9M| : "r"(carry) \ | | 90| 19.9M| : "cc"); \ | | 91| 19.9M| (carry) = high; \ | | 92| 19.9M| } while (0) | | ------------------ | | | Branch (92:12): [Folded - Ignored] | | ------------------ ------------------ 134| 19.9M| mul_add(rp[1], ap[1], w, c1); ------------------ | | 80| 19.9M| do { \ | | 81| 19.9M| BN_ULONG high, low; \ | | 82| 19.9M| __asm__("mulq %3" : "=a"(low), "=d"(high) : "a"(word), "m"(a) : "cc"); \ | | 83| 19.9M| __asm__("addq %2,%0; adcq $0,%1" \ | | 84| 19.9M| : "+r"(carry), "+d"(high) \ | | 85| 19.9M| : "a"(low) \ | | 86| 19.9M| : "cc"); \ | | 87| 19.9M| __asm__("addq %2,%0; adcq $0,%1" \ | | 88| 19.9M| : "+m"(r), "+d"(high) \ | | 89| 19.9M| : "r"(carry) \ | | 90| 19.9M| : "cc"); \ | | 91| 19.9M| (carry) = high; \ | | 92| 19.9M| } while (0) | | ------------------ | | | Branch (92:12): [Folded - Ignored] | | ------------------ ------------------ 135| 19.9M| mul_add(rp[2], ap[2], w, c1); ------------------ | | 80| 19.9M| do { \ | | 81| 19.9M| BN_ULONG high, low; \ | | 82| 19.9M| __asm__("mulq %3" : "=a"(low), "=d"(high) : "a"(word), "m"(a) : "cc"); \ | | 83| 19.9M| __asm__("addq %2,%0; adcq $0,%1" \ | | 84| 19.9M| : "+r"(carry), "+d"(high) \ | | 85| 19.9M| : "a"(low) \ | | 86| 19.9M| : "cc"); \ | | 87| 19.9M| __asm__("addq %2,%0; adcq $0,%1" \ | | 88| 19.9M| : "+m"(r), "+d"(high) \ | | 89| 19.9M| : "r"(carry) \ | | 90| 19.9M| : "cc"); \ | | 91| 19.9M| (carry) = high; \ | | 92| 19.9M| } while (0) | | ------------------ | | | Branch (92:12): [Folded - Ignored] | | ------------------ ------------------ 136| 19.9M| mul_add(rp[3], ap[3], w, c1); ------------------ | | 80| 19.9M| do { \ | | 81| 19.9M| BN_ULONG high, low; \ | | 82| 19.9M| __asm__("mulq %3" : "=a"(low), "=d"(high) : "a"(word), "m"(a) : "cc"); \ | | 83| 19.9M| __asm__("addq %2,%0; adcq $0,%1" \ | | 84| 19.9M| : "+r"(carry), "+d"(high) \ | | 85| 19.9M| : "a"(low) \ | | 86| 19.9M| : "cc"); \ | | 87| 19.9M| __asm__("addq %2,%0; adcq $0,%1" \ | | 88| 19.9M| : "+m"(r), "+d"(high) \ | | 89| 19.9M| : "r"(carry) \ | | 90| 19.9M| : "cc"); \ | | 91| 19.9M| (carry) = high; \ | | 92| 19.9M| } while (0) | | ------------------ | | | Branch (92:12): [Folded - Ignored] | | ------------------ ------------------ 137| 19.9M| ap += 4; 138| 19.9M| rp += 4; 139| 19.9M| num -= 4; 140| 19.9M| } 141| 4.35M| if (num) { ------------------ | Branch (141:7): [True: 592k, False: 3.76M] ------------------ 142| 592k| mul_add(rp[0], ap[0], w, c1); ------------------ | | 80| 592k| do { \ | | 81| 592k| BN_ULONG high, low; \ | | 82| 592k| __asm__("mulq %3" : "=a"(low), "=d"(high) : "a"(word), "m"(a) : "cc"); \ | | 83| 592k| __asm__("addq %2,%0; adcq $0,%1" \ | | 84| 592k| : "+r"(carry), "+d"(high) \ | | 85| 592k| : "a"(low) \ | | 86| 592k| : "cc"); \ | | 87| 592k| __asm__("addq %2,%0; adcq $0,%1" \ | | 88| 592k| : "+m"(r), "+d"(high) \ | | 89| 592k| : "r"(carry) \ | | 90| 592k| : "cc"); \ | | 91| 592k| (carry) = high; \ | | 92| 592k| } while (0) | | ------------------ | | | Branch (92:12): [Folded - Ignored] | | ------------------ ------------------ 143| 592k| if (--num == 0) { ------------------ | Branch (143:9): [True: 51.9k, False: 540k] ------------------ 144| 51.9k| return c1; 145| 51.9k| } 146| 540k| mul_add(rp[1], ap[1], w, c1); ------------------ | | 80| 540k| do { \ | | 81| 540k| BN_ULONG high, low; \ | | 82| 540k| __asm__("mulq %3" : "=a"(low), "=d"(high) : "a"(word), "m"(a) : "cc"); \ | | 83| 540k| __asm__("addq %2,%0; adcq $0,%1" \ | | 84| 540k| : "+r"(carry), "+d"(high) \ | | 85| 540k| : "a"(low) \ | | 86| 540k| : "cc"); \ | | 87| 540k| __asm__("addq %2,%0; adcq $0,%1" \ | | 88| 540k| : "+m"(r), "+d"(high) \ | | 89| 540k| : "r"(carry) \ | | 90| 540k| : "cc"); \ | | 91| 540k| (carry) = high; \ | | 92| 540k| } while (0) | | ------------------ | | | Branch (92:12): [Folded - Ignored] | | ------------------ ------------------ 147| 540k| if (--num == 0) { ------------------ | Branch (147:9): [True: 540k, False: 0] ------------------ 148| 540k| return c1; 149| 540k| } 150| 0| mul_add(rp[2], ap[2], w, c1); ------------------ | | 80| 0| do { \ | | 81| 0| BN_ULONG high, low; \ | | 82| 0| __asm__("mulq %3" : "=a"(low), "=d"(high) : "a"(word), "m"(a) : "cc"); \ | | 83| 0| __asm__("addq %2,%0; adcq $0,%1" \ | | 84| 0| : "+r"(carry), "+d"(high) \ | | 85| 0| : "a"(low) \ | | 86| 0| : "cc"); \ | | 87| 0| __asm__("addq %2,%0; adcq $0,%1" \ | | 88| 0| : "+m"(r), "+d"(high) \ | | 89| 0| : "r"(carry) \ | | 90| 0| : "cc"); \ | | 91| 0| (carry) = high; \ | | 92| 0| } while (0) | | ------------------ | | | Branch (92:12): [Folded - Ignored] | | ------------------ ------------------ 151| 0| return c1; 152| 540k| } 153| | 154| 3.76M| return c1; 155| 4.35M|} bn_mul_words: 158| 245k| BN_ULONG w) { 159| 245k| BN_ULONG c1 = 0; 160| | 161| 245k| if (num == 0) { ------------------ | Branch (161:7): [True: 0, False: 245k] ------------------ 162| 0| return c1; 163| 0| } 164| | 165| 1.62M| while (num & ~3) { ------------------ | Branch (165:10): [True: 1.38M, False: 245k] ------------------ 166| 1.38M| mul(rp[0], ap[0], w, c1); ------------------ | | 95| 1.38M| do { \ | | 96| 1.38M| BN_ULONG high, low; \ | | 97| 1.38M| __asm__("mulq %3" : "=a"(low), "=d"(high) : "a"(word), "g"(a) : "cc"); \ | | 98| 1.38M| __asm__("addq %2,%0; adcq $0,%1" \ | | 99| 1.38M| : "+r"(carry), "+d"(high) \ | | 100| 1.38M| : "a"(low) \ | | 101| 1.38M| : "cc"); \ | | 102| 1.38M| (r) = (carry); \ | | 103| 1.38M| (carry) = high; \ | | 104| 1.38M| } while (0) | | ------------------ | | | Branch (104:12): [Folded - Ignored] | | ------------------ ------------------ 167| 1.38M| mul(rp[1], ap[1], w, c1); ------------------ | | 95| 1.38M| do { \ | | 96| 1.38M| BN_ULONG high, low; \ | | 97| 1.38M| __asm__("mulq %3" : "=a"(low), "=d"(high) : "a"(word), "g"(a) : "cc"); \ | | 98| 1.38M| __asm__("addq %2,%0; adcq $0,%1" \ | | 99| 1.38M| : "+r"(carry), "+d"(high) \ | | 100| 1.38M| : "a"(low) \ | | 101| 1.38M| : "cc"); \ | | 102| 1.38M| (r) = (carry); \ | | 103| 1.38M| (carry) = high; \ | | 104| 1.38M| } while (0) | | ------------------ | | | Branch (104:12): [Folded - Ignored] | | ------------------ ------------------ 168| 1.38M| mul(rp[2], ap[2], w, c1); ------------------ | | 95| 1.38M| do { \ | | 96| 1.38M| BN_ULONG high, low; \ | | 97| 1.38M| __asm__("mulq %3" : "=a"(low), "=d"(high) : "a"(word), "g"(a) : "cc"); \ | | 98| 1.38M| __asm__("addq %2,%0; adcq $0,%1" \ | | 99| 1.38M| : "+r"(carry), "+d"(high) \ | | 100| 1.38M| : "a"(low) \ | | 101| 1.38M| : "cc"); \ | | 102| 1.38M| (r) = (carry); \ | | 103| 1.38M| (carry) = high; \ | | 104| 1.38M| } while (0) | | ------------------ | | | Branch (104:12): [Folded - Ignored] | | ------------------ ------------------ 169| 1.38M| mul(rp[3], ap[3], w, c1); ------------------ | | 95| 1.38M| do { \ | | 96| 1.38M| BN_ULONG high, low; \ | | 97| 1.38M| __asm__("mulq %3" : "=a"(low), "=d"(high) : "a"(word), "g"(a) : "cc"); \ | | 98| 1.38M| __asm__("addq %2,%0; adcq $0,%1" \ | | 99| 1.38M| : "+r"(carry), "+d"(high) \ | | 100| 1.38M| : "a"(low) \ | | 101| 1.38M| : "cc"); \ | | 102| 1.38M| (r) = (carry); \ | | 103| 1.38M| (carry) = high; \ | | 104| 1.38M| } while (0) | | ------------------ | | | Branch (104:12): [Folded - Ignored] | | ------------------ ------------------ 170| 1.38M| ap += 4; 171| 1.38M| rp += 4; 172| 1.38M| num -= 4; 173| 1.38M| } 174| 245k| if (num) { ------------------ | Branch (174:7): [True: 217k, False: 28.0k] ------------------ 175| 217k| mul(rp[0], ap[0], w, c1); ------------------ | | 95| 217k| do { \ | | 96| 217k| BN_ULONG high, low; \ | | 97| 217k| __asm__("mulq %3" : "=a"(low), "=d"(high) : "a"(word), "g"(a) : "cc"); \ | | 98| 217k| __asm__("addq %2,%0; adcq $0,%1" \ | | 99| 217k| : "+r"(carry), "+d"(high) \ | | 100| 217k| : "a"(low) \ | | 101| 217k| : "cc"); \ | | 102| 217k| (r) = (carry); \ | | 103| 217k| (carry) = high; \ | | 104| 217k| } while (0) | | ------------------ | | | Branch (104:12): [Folded - Ignored] | | ------------------ ------------------ 176| 217k| if (--num == 0) { ------------------ | Branch (176:9): [True: 217k, False: 0] ------------------ 177| 217k| return c1; 178| 217k| } 179| 0| mul(rp[1], ap[1], w, c1); ------------------ | | 95| 0| do { \ | | 96| 0| BN_ULONG high, low; \ | | 97| 0| __asm__("mulq %3" : "=a"(low), "=d"(high) : "a"(word), "g"(a) : "cc"); \ | | 98| 0| __asm__("addq %2,%0; adcq $0,%1" \ | | 99| 0| : "+r"(carry), "+d"(high) \ | | 100| 0| : "a"(low) \ | | 101| 0| : "cc"); \ | | 102| 0| (r) = (carry); \ | | 103| 0| (carry) = high; \ | | 104| 0| } while (0) | | ------------------ | | | Branch (104:12): [Folded - Ignored] | | ------------------ ------------------ 180| 0| if (--num == 0) { ------------------ | Branch (180:9): [True: 0, False: 0] ------------------ 181| 0| return c1; 182| 0| } 183| 0| mul(rp[2], ap[2], w, c1); ------------------ | | 95| 0| do { \ | | 96| 0| BN_ULONG high, low; \ | | 97| 0| __asm__("mulq %3" : "=a"(low), "=d"(high) : "a"(word), "g"(a) : "cc"); \ | | 98| 0| __asm__("addq %2,%0; adcq $0,%1" \ | | 99| 0| : "+r"(carry), "+d"(high) \ | | 100| 0| : "a"(low) \ | | 101| 0| : "cc"); \ | | 102| 0| (r) = (carry); \ | | 103| 0| (carry) = high; \ | | 104| 0| } while (0) | | ------------------ | | | Branch (104:12): [Folded - Ignored] | | ------------------ ------------------ 184| 0| } 185| 28.0k| return c1; 186| 245k|} bn_add_words: 217| 428M| size_t n) { 218| 428M| BN_ULONG ret; 219| 428M| size_t i = 0; 220| | 221| 428M| if (n == 0) { ------------------ | Branch (221:7): [True: 876, False: 428M] ------------------ 222| 876| return 0; 223| 876| } 224| | 225| 428M| __asm__ volatile( 226| 428M| " subq %0,%0 \n" // clear carry 227| 428M| " jmp 1f \n" 228| 428M| ".p2align 4 \n" 229| 428M| "1:" 230| 428M| " movq (%4,%2,8),%0 \n" 231| 428M| " adcq (%5,%2,8),%0 \n" 232| 428M| " movq %0,(%3,%2,8) \n" 233| 428M| " lea 1(%2),%2 \n" 234| 428M| " dec %1 \n" 235| 428M| " jnz 1b \n" 236| 428M| " sbbq %0,%0 \n" 237| 428M| : "=&r"(ret), "+&c"(n), "+&r"(i) 238| 428M| : "r"(rp), "r"(ap), "r"(bp) 239| 428M| : "cc", "memory"); 240| | 241| 428M| return ret & 1; 242| 428M|} bn_sub_words: 245| 427M| size_t n) { 246| 427M| BN_ULONG ret; 247| 427M| size_t i = 0; 248| | 249| 427M| if (n == 0) { ------------------ | Branch (249:7): [True: 0, False: 427M] ------------------ 250| 0| return 0; 251| 0| } 252| | 253| 427M| __asm__ volatile( 254| 427M| " subq %0,%0 \n" // clear borrow 255| 427M| " jmp 1f \n" 256| 427M| ".p2align 4 \n" 257| 427M| "1:" 258| 427M| " movq (%4,%2,8),%0 \n" 259| 427M| " sbbq (%5,%2,8),%0 \n" 260| 427M| " movq %0,(%3,%2,8) \n" 261| 427M| " lea 1(%2),%2 \n" 262| 427M| " dec %1 \n" 263| 427M| " jnz 1b \n" 264| 427M| " sbbq %0,%0 \n" 265| 427M| : "=&r"(ret), "+&c"(n), "+&r"(i) 266| 427M| : "r"(rp), "r"(ap), "r"(bp) 267| 427M| : "cc", "memory"); 268| | 269| 427M| return ret & 1; 270| 427M|} BN_new: 33| 478k|BIGNUM *BN_new(void) { 34| 478k| BIGNUM *bn = reinterpret_cast(OPENSSL_malloc(sizeof(BIGNUM))); 35| | 36| 478k| if (bn == NULL) { ------------------ | Branch (36:7): [True: 0, False: 478k] ------------------ 37| 0| return NULL; 38| 0| } 39| | 40| 478k| OPENSSL_memset(bn, 0, sizeof(BIGNUM)); 41| 478k| bn->flags = BN_FLG_MALLOCED; ------------------ | | 932| 478k|#define BN_FLG_MALLOCED 0x01 ------------------ 42| | 43| 478k| return bn; 44| 478k|} BN_init: 48| 18.7k|void BN_init(BIGNUM *bn) { OPENSSL_memset(bn, 0, sizeof(BIGNUM)); } BN_free: 50| 1.46M|void BN_free(BIGNUM *bn) { 51| 1.46M| if (bn == NULL) { ------------------ | Branch (51:7): [True: 967k, False: 496k] ------------------ 52| 967k| return; 53| 967k| } 54| | 55| 496k| if ((bn->flags & BN_FLG_STATIC_DATA) == 0) { ------------------ | | 933| 496k|#define BN_FLG_STATIC_DATA 0x02 ------------------ | Branch (55:7): [True: 496k, False: 0] ------------------ 56| 496k| OPENSSL_free(bn->d); 57| 496k| } 58| | 59| 496k| if (bn->flags & BN_FLG_MALLOCED) { ------------------ | | 932| 496k|#define BN_FLG_MALLOCED 0x01 ------------------ | Branch (59:7): [True: 478k, False: 18.7k] ------------------ 60| 478k| OPENSSL_free(bn); 61| 478k| } else { 62| 18.7k| bn->d = NULL; 63| 18.7k| } 64| 496k|} BN_clear_free: 66| 1.40k|void BN_clear_free(BIGNUM *bn) { BN_free(bn); } BN_dup: 68| 3|BIGNUM *BN_dup(const BIGNUM *src) { 69| 3| BIGNUM *copy; 70| | 71| 3| if (src == NULL) { ------------------ | Branch (71:7): [True: 0, False: 3] ------------------ 72| 0| return NULL; 73| 0| } 74| | 75| 3| copy = BN_new(); 76| 3| if (copy == NULL) { ------------------ | Branch (76:7): [True: 0, False: 3] ------------------ 77| 0| return NULL; 78| 0| } 79| | 80| 3| if (!BN_copy(copy, src)) { ------------------ | Branch (80:7): [True: 0, False: 3] ------------------ 81| 0| BN_free(copy); 82| 0| return NULL; 83| 0| } 84| | 85| 3| return copy; 86| 3|} BN_copy: 88| 257k|BIGNUM *BN_copy(BIGNUM *dest, const BIGNUM *src) { 89| 257k| if (src == dest) { ------------------ | Branch (89:7): [True: 4, False: 257k] ------------------ 90| 4| return dest; 91| 4| } 92| | 93| 257k| if (!bn_wexpand(dest, src->width)) { ------------------ | Branch (93:7): [True: 0, False: 257k] ------------------ 94| 0| return NULL; 95| 0| } 96| | 97| 257k| OPENSSL_memcpy(dest->d, src->d, sizeof(src->d[0]) * src->width); 98| | 99| 257k| dest->width = src->width; 100| 257k| dest->neg = src->neg; 101| 257k| return dest; 102| 257k|} BN_num_bits_word: 124| 1.33M|unsigned BN_num_bits_word(BN_ULONG l) { 125| | // |BN_num_bits| is often called on RSA prime factors. These have public bit 126| | // lengths, but all bits beyond the high bit are secret, so count bits in 127| | // constant time. 128| 1.33M| BN_ULONG x, mask; 129| 1.33M| int bits = (l != 0); 130| | 131| 1.33M|#if BN_BITS2 > 32 132| | // Look at the upper half of |x|. |x| is at most 64 bits long. 133| 1.33M| x = l >> 32; 134| | // Set |mask| to all ones if |x| (the top 32 bits of |l|) is non-zero and all 135| | // all zeros otherwise. 136| 1.33M| mask = 0u - x; 137| 1.33M| mask = (0u - (mask >> (BN_BITS2 - 1))); ------------------ | | 42| 1.33M|#define BN_BITS2 64 ------------------ 138| | // If |x| is non-zero, the lower half is included in the bit count in full, 139| | // and we count the upper half. Otherwise, we count the lower half. 140| 1.33M| bits += 32 & mask; 141| 1.33M| l ^= (x ^ l) & mask; // |l| is |x| if |mask| and remains |l| otherwise. 142| 1.33M|#endif 143| | 144| | // The remaining blocks are analogous iterations at lower powers of two. 145| 1.33M| x = l >> 16; 146| 1.33M| mask = 0u - x; 147| 1.33M| mask = (0u - (mask >> (BN_BITS2 - 1))); ------------------ | | 42| 1.33M|#define BN_BITS2 64 ------------------ 148| 1.33M| bits += 16 & mask; 149| 1.33M| l ^= (x ^ l) & mask; 150| | 151| 1.33M| x = l >> 8; 152| 1.33M| mask = 0u - x; 153| 1.33M| mask = (0u - (mask >> (BN_BITS2 - 1))); ------------------ | | 42| 1.33M|#define BN_BITS2 64 ------------------ 154| 1.33M| bits += 8 & mask; 155| 1.33M| l ^= (x ^ l) & mask; 156| | 157| 1.33M| x = l >> 4; 158| 1.33M| mask = 0u - x; 159| 1.33M| mask = (0u - (mask >> (BN_BITS2 - 1))); ------------------ | | 42| 1.33M|#define BN_BITS2 64 ------------------ 160| 1.33M| bits += 4 & mask; 161| 1.33M| l ^= (x ^ l) & mask; 162| | 163| 1.33M| x = l >> 2; 164| 1.33M| mask = 0u - x; 165| 1.33M| mask = (0u - (mask >> (BN_BITS2 - 1))); ------------------ | | 42| 1.33M|#define BN_BITS2 64 ------------------ 166| 1.33M| bits += 2 & mask; 167| 1.33M| l ^= (x ^ l) & mask; 168| | 169| 1.33M| x = l >> 1; 170| 1.33M| mask = 0u - x; 171| 1.33M| mask = (0u - (mask >> (BN_BITS2 - 1))); ------------------ | | 42| 1.33M|#define BN_BITS2 64 ------------------ 172| 1.33M| bits += 1 & mask; 173| | 174| 1.33M| return bits; 175| 1.33M|} BN_num_bits: 177| 1.27M|unsigned BN_num_bits(const BIGNUM *bn) { 178| 1.27M| const int width = bn_minimal_width(bn); 179| 1.27M| if (width == 0) { ------------------ | Branch (179:7): [True: 30, False: 1.27M] ------------------ 180| 30| return 0; 181| 30| } 182| | 183| 1.27M| return (width - 1) * BN_BITS2 + BN_num_bits_word(bn->d[width - 1]); ------------------ | | 42| 1.27M|#define BN_BITS2 64 ------------------ 184| 1.27M|} BN_num_bytes: 186| 794k|unsigned BN_num_bytes(const BIGNUM *bn) { return (BN_num_bits(bn) + 7) / 8; } BN_zero: 188| 523k|void BN_zero(BIGNUM *bn) { bn->width = bn->neg = 0; } BN_one: 190| 876|int BN_one(BIGNUM *bn) { return BN_set_word(bn, 1); } BN_set_word: 192| 876|int BN_set_word(BIGNUM *bn, BN_ULONG value) { 193| 876| if (value == 0) { ------------------ | Branch (193:7): [True: 0, False: 876] ------------------ 194| 0| BN_zero(bn); 195| 0| return 1; 196| 0| } 197| | 198| 876| if (!bn_wexpand(bn, 1)) { ------------------ | Branch (198:7): [True: 0, False: 876] ------------------ 199| 0| return 0; 200| 0| } 201| | 202| 876| bn->neg = 0; 203| 876| bn->d[0] = value; 204| 876| bn->width = 1; 205| 876| return 1; 206| 876|} bn_set_static_words: 241| 24|void bn_set_static_words(BIGNUM *bn, const BN_ULONG *words, size_t num) { 242| 24| if ((bn->flags & BN_FLG_STATIC_DATA) == 0) { ------------------ | | 933| 24|#define BN_FLG_STATIC_DATA 0x02 ------------------ | Branch (242:7): [True: 24, False: 0] ------------------ 243| 24| OPENSSL_free(bn->d); 244| 24| } 245| 24| bn->d = (BN_ULONG *)words; 246| | 247| 24| assert(num <= BN_MAX_WORDS); 248| 24| bn->width = (int)num; 249| 24| bn->dmax = (int)num; 250| 24| bn->neg = 0; 251| 24| bn->flags |= BN_FLG_STATIC_DATA; ------------------ | | 933| 24|#define BN_FLG_STATIC_DATA 0x02 ------------------ 252| 24|} bn_fits_in_words: 254| 1.55M|int bn_fits_in_words(const BIGNUM *bn, size_t num) { 255| | // All words beyond |num| must be zero. 256| 1.55M| BN_ULONG mask = 0; 257| 24.0M| for (size_t i = num; i < (size_t)bn->width; i++) { ------------------ | Branch (257:24): [True: 22.5M, False: 1.55M] ------------------ 258| 22.5M| mask |= bn->d[i]; 259| 22.5M| } 260| 1.55M| return mask == 0; 261| 1.55M|} bn_copy_words: 263| 59.3k|int bn_copy_words(BN_ULONG *out, size_t num, const BIGNUM *bn) { 264| 59.3k| if (bn->neg) { ------------------ | Branch (264:7): [True: 0, False: 59.3k] ------------------ 265| 0| OPENSSL_PUT_ERROR(BN, BN_R_NEGATIVE_NUMBER); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 266| 0| return 0; 267| 0| } 268| | 269| 59.3k| size_t width = (size_t)bn->width; 270| 59.3k| if (width > num) { ------------------ | Branch (270:7): [True: 0, False: 59.3k] ------------------ 271| 0| if (!bn_fits_in_words(bn, num)) { ------------------ | Branch (271:9): [True: 0, False: 0] ------------------ 272| 0| OPENSSL_PUT_ERROR(BN, BN_R_BIGNUM_TOO_LONG); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 273| 0| return 0; 274| 0| } 275| 0| width = num; 276| 0| } 277| | 278| 59.3k| OPENSSL_memset(out, 0, sizeof(BN_ULONG) * num); 279| 59.3k| OPENSSL_memcpy(out, bn->d, sizeof(BN_ULONG) * width); 280| 59.3k| return 1; 281| 59.3k|} BN_is_negative: 283| 425k|int BN_is_negative(const BIGNUM *bn) { return bn->neg != 0; } bn_wexpand: 293| 9.85M|int bn_wexpand(BIGNUM *bn, size_t words) { 294| 9.85M| BN_ULONG *a; 295| | 296| 9.85M| if (words <= (size_t)bn->dmax) { ------------------ | Branch (296:7): [True: 9.21M, False: 635k] ------------------ 297| 9.21M| return 1; 298| 9.21M| } 299| | 300| 635k| if (words > BN_MAX_WORDS) { ------------------ | | 31| 635k|#define BN_MAX_WORDS (INT_MAX / (4 * BN_BITS2)) | | ------------------ | | | | 42| 635k|#define BN_BITS2 64 | | ------------------ ------------------ | Branch (300:7): [True: 0, False: 635k] ------------------ 301| 0| OPENSSL_PUT_ERROR(BN, BN_R_BIGNUM_TOO_LONG); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 302| 0| return 0; 303| 0| } 304| | 305| 635k| if (bn->flags & BN_FLG_STATIC_DATA) { ------------------ | | 933| 635k|#define BN_FLG_STATIC_DATA 0x02 ------------------ | Branch (305:7): [True: 0, False: 635k] ------------------ 306| 0| OPENSSL_PUT_ERROR(BN, BN_R_EXPAND_ON_STATIC_BIGNUM_DATA); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 307| 0| return 0; 308| 0| } 309| | 310| 635k| a = reinterpret_cast(OPENSSL_calloc(words, sizeof(BN_ULONG))); 311| 635k| if (a == NULL) { ------------------ | Branch (311:7): [True: 0, False: 635k] ------------------ 312| 0| return 0; 313| 0| } 314| | 315| 635k| OPENSSL_memcpy(a, bn->d, sizeof(BN_ULONG) * bn->width); 316| | 317| 635k| OPENSSL_free(bn->d); 318| 635k| bn->d = a; 319| 635k| bn->dmax = (int)words; 320| | 321| 635k| return 1; 322| 635k|} bn_resize_words: 332| 338k|int bn_resize_words(BIGNUM *bn, size_t words) { 333| 338k| if ((size_t)bn->width <= words) { ------------------ | Branch (333:7): [True: 310k, False: 28.0k] ------------------ 334| 310k| if (!bn_wexpand(bn, words)) { ------------------ | Branch (334:9): [True: 0, False: 310k] ------------------ 335| 0| return 0; 336| 0| } 337| 310k| OPENSSL_memset(bn->d + bn->width, 0, 338| 310k| (words - bn->width) * sizeof(BN_ULONG)); 339| 310k| bn->width = (int)words; 340| 310k| return 1; 341| 310k| } 342| | 343| | // All words beyond the new width must be zero. 344| 28.0k| if (!bn_fits_in_words(bn, words)) { ------------------ | Branch (344:7): [True: 0, False: 28.0k] ------------------ 345| 0| OPENSSL_PUT_ERROR(BN, BN_R_BIGNUM_TOO_LONG); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 346| 0| return 0; 347| 0| } 348| 28.0k| bn->width = (int)words; 349| 28.0k| return 1; 350| 28.0k|} bn_select_words: 353| 897M| const BN_ULONG *b, size_t num) { 354| 6.28G| for (size_t i = 0; i < num; i++) { ------------------ | Branch (354:22): [True: 5.38G, False: 897M] ------------------ 355| 5.38G| static_assert(sizeof(BN_ULONG) <= sizeof(crypto_word_t), 356| 5.38G| "crypto_word_t is too small"); 357| 5.38G| r[i] = constant_time_select_w(mask, a[i], b[i]); 358| 5.38G| } 359| 897M|} bn_minimal_width: 361| 8.95M|int bn_minimal_width(const BIGNUM *bn) { 362| 8.95M| int ret = bn->width; 363| 12.3M| while (ret > 0 && bn->d[ret - 1] == 0) { ------------------ | Branch (363:10): [True: 12.3M, False: 1.23k] | Branch (363:21): [True: 3.44M, False: 8.95M] ------------------ 364| 3.44M| ret--; 365| 3.44M| } 366| 8.95M| return ret; 367| 8.95M|} bn_set_minimal_width: 369| 7.67M|void bn_set_minimal_width(BIGNUM *bn) { 370| 7.67M| bn->width = bn_minimal_width(bn); 371| 7.67M| if (bn->width == 0) { ------------------ | Branch (371:7): [True: 1.20k, False: 7.67M] ------------------ 372| 1.20k| bn->neg = 0; 373| 1.20k| } 374| 7.67M|} bcm.cc:_ZL20BN_value_one_do_initP9bignum_st: 113| 2|DEFINE_METHOD_FUNCTION(BIGNUM, BN_value_one) { 114| 2| static const BN_ULONG kOneLimbs[1] = {1}; 115| 2| out->d = (BN_ULONG *)kOneLimbs; 116| 2| out->width = 1; 117| 2| out->dmax = 1; 118| 2| out->neg = 0; 119| 2| out->flags = BN_FLG_STATIC_DATA; ------------------ | | 933| 2|#define BN_FLG_STATIC_DATA 0x02 ------------------ 120| 2|} bn_big_endian_to_words: 23| 382k| size_t in_len) { 24| | // The caller should have sized |out| to fit |in| without truncating. This 25| | // condition ensures we do not overflow |out|, so use a runtime check. 26| 382k| BSSL_CHECK(in_len <= out_len * sizeof(BN_ULONG)); ------------------ | | 384| 382k| do { \ | | 385| 382k| if (!(condition)) { \ | | ------------------ | | | Branch (385:9): [True: 0, False: 382k] | | ------------------ | | 386| 0| abort(); \ | | 387| 0| } \ | | 388| 382k| } while (0); | | ------------------ | | | Branch (388:12): [Folded - Ignored] | | ------------------ ------------------ 27| | 28| | // Load whole words. 29| 3.80M| while (in_len >= sizeof(BN_ULONG)) { ------------------ | Branch (29:10): [True: 3.42M, False: 382k] ------------------ 30| 3.42M| in_len -= sizeof(BN_ULONG); 31| 3.42M| out[0] = CRYPTO_load_word_be(in + in_len); 32| 3.42M| out++; 33| 3.42M| out_len--; 34| 3.42M| } 35| | 36| | // Load the last partial word. 37| 382k| if (in_len != 0) { ------------------ | Branch (37:7): [True: 179k, False: 202k] ------------------ 38| 179k| BN_ULONG word = 0; 39| 519k| for (size_t i = 0; i < in_len; i++) { ------------------ | Branch (39:24): [True: 340k, False: 179k] ------------------ 40| 340k| word = (word << 8) | in[i]; 41| 340k| } 42| 179k| out[0] = word; 43| 179k| out++; 44| 179k| out_len--; 45| 179k| } 46| | 47| | // Fill the remainder with zeros. 48| 382k| OPENSSL_memset(out, 0, out_len * sizeof(BN_ULONG)); 49| 382k|} BN_bin2bn: 51| 245k|BIGNUM *BN_bin2bn(const uint8_t *in, size_t len, BIGNUM *ret) { 52| 245k| BIGNUM *bn = NULL; 53| 245k| if (ret == NULL) { ------------------ | Branch (53:7): [True: 2, False: 245k] ------------------ 54| 2| bn = BN_new(); 55| 2| if (bn == NULL) { ------------------ | Branch (55:9): [True: 0, False: 2] ------------------ 56| 0| return NULL; 57| 0| } 58| 2| ret = bn; 59| 2| } 60| | 61| 245k| if (len == 0) { ------------------ | Branch (61:7): [True: 0, False: 245k] ------------------ 62| 0| ret->width = 0; 63| 0| return ret; 64| 0| } 65| | 66| 245k| size_t num_words = ((len - 1) / BN_BYTES) + 1; ------------------ | | 44| 245k|#define BN_BYTES 8 ------------------ 67| 245k| if (!bn_wexpand(ret, num_words)) { ------------------ | Branch (67:7): [True: 0, False: 245k] ------------------ 68| 0| BN_free(bn); 69| 0| return NULL; 70| 0| } 71| | 72| | // |bn_wexpand| must check bounds on |num_words| to write it into 73| | // |ret->dmax|. 74| 245k| assert(num_words <= INT_MAX); 75| 245k| ret->width = (int)num_words; 76| 245k| ret->neg = 0; 77| | 78| 245k| bn_big_endian_to_words(ret->d, ret->width, in, len); 79| 245k| return ret; 80| 245k|} bn_assert_fits_in_bytes: 132| 56.0k|void bn_assert_fits_in_bytes(const BIGNUM *bn, size_t num) { 133| 56.0k| const uint8_t *bytes = (const uint8_t *)bn->d; 134| 56.0k| size_t tot_bytes = bn->width * sizeof(BN_ULONG); 135| 56.0k| if (tot_bytes > num) { ------------------ | Branch (135:7): [True: 28.0k, False: 28.0k] ------------------ 136| 28.0k| CONSTTIME_DECLASSIFY(bytes + num, tot_bytes - num); 137| 252k| for (size_t i = num; i < tot_bytes; i++) { ------------------ | Branch (137:26): [True: 224k, False: 28.0k] ------------------ 138| 224k| assert(bytes[i] == 0); 139| 224k| } 140| 28.0k| (void)bytes; 141| 28.0k| } 142| 56.0k|} bn_words_to_big_endian: 145| 182k| size_t in_len) { 146| | // The caller should have selected an output length without truncation. 147| 182k| declassify_assert(fits_in_bytes(in, in_len, out_len)); ------------------ | | 493| 182k|#define declassify_assert(expr) assert(constant_time_declassify_int(expr)) ------------------ 148| | 149| | // We only support little-endian platforms, so the internal representation is 150| | // also little-endian as bytes. We can simply copy it in reverse. 151| 182k| const uint8_t *bytes = (const uint8_t *)in; 152| 182k| size_t num_bytes = in_len * sizeof(BN_ULONG); 153| 182k| if (out_len < num_bytes) { ------------------ | Branch (153:7): [True: 25.7k, False: 156k] ------------------ 154| 25.7k| num_bytes = out_len; 155| 25.7k| } 156| | 157| 15.4M| for (size_t i = 0; i < num_bytes; i++) { ------------------ | Branch (157:22): [True: 15.2M, False: 182k] ------------------ 158| 15.2M| out[out_len - i - 1] = bytes[i]; 159| 15.2M| } 160| | // Pad out the rest of the buffer with zeroes. 161| 182k| OPENSSL_memset(out, 0, out_len - num_bytes); 162| 182k|} BN_bn2bin_padded: 189| 94.7k|int BN_bn2bin_padded(uint8_t *out, size_t len, const BIGNUM *in) { 190| 94.7k| if (!fits_in_bytes(in->d, in->width, len)) { ------------------ | Branch (190:7): [True: 1.93k, False: 92.8k] ------------------ 191| 1.93k| return 0; 192| 1.93k| } 193| | 194| 92.8k| bn_words_to_big_endian(out, len, in->d, in->width); 195| 92.8k| return 1; 196| 94.7k|} bcm.cc:_ZL13fits_in_bytesPKmmm: 122| 277k| size_t num_bytes) { 123| 277k| const uint8_t *bytes = (const uint8_t *)words; 124| 277k| size_t tot_bytes = num_words * sizeof(BN_ULONG); 125| 277k| uint8_t mask = 0; 126| 695k| for (size_t i = num_bytes; i < tot_bytes; i++) { ------------------ | Branch (126:30): [True: 418k, False: 277k] ------------------ 127| 418k| mask |= bytes[i]; 128| 418k| } 129| 277k| return mask == 0; 130| 277k|} BN_ucmp: 57| 1.63M|int BN_ucmp(const BIGNUM *a, const BIGNUM *b) { 58| 1.63M| return bn_cmp_words_consttime(a->d, a->width, b->d, b->width); 59| 1.63M|} BN_cmp: 61| 29.7k|int BN_cmp(const BIGNUM *a, const BIGNUM *b) { 62| 29.7k| if ((a == NULL) || (b == NULL)) { ------------------ | Branch (62:7): [True: 0, False: 29.7k] | Branch (62:22): [True: 0, False: 29.7k] ------------------ 63| 0| if (a != NULL) { ------------------ | Branch (63:9): [True: 0, False: 0] ------------------ 64| 0| return -1; 65| 0| } else if (b != NULL) { ------------------ | Branch (65:16): [True: 0, False: 0] ------------------ 66| 0| return 1; 67| 0| } else { 68| 0| return 0; 69| 0| } 70| 0| } 71| | 72| | // We do not attempt to process the sign bit in constant time. Negative 73| | // |BIGNUM|s should never occur in crypto, only calculators. 74| 29.7k| if (a->neg != b->neg) { ------------------ | Branch (74:7): [True: 0, False: 29.7k] ------------------ 75| 0| if (a->neg) { ------------------ | Branch (75:9): [True: 0, False: 0] ------------------ 76| 0| return -1; 77| 0| } 78| 0| return 1; 79| 0| } 80| | 81| 29.7k| int ret = BN_ucmp(a, b); 82| 29.7k| return a->neg ? -ret : ret; ------------------ | Branch (82:10): [True: 0, False: 29.7k] ------------------ 83| 29.7k|} bn_less_than_words: 85| 223k|int bn_less_than_words(const BN_ULONG *a, const BN_ULONG *b, size_t len) { 86| 223k| return bn_cmp_words_consttime(a, len, b, len) < 0; 87| 223k|} BN_abs_is_word: 89| 886|int BN_abs_is_word(const BIGNUM *bn, BN_ULONG w) { 90| 886| if (bn->width == 0) { ------------------ | Branch (90:7): [True: 0, False: 886] ------------------ 91| 0| return w == 0; 92| 0| } 93| 886| BN_ULONG mask = bn->d[0] ^ w; 94| 1.04k| for (int i = 1; i < bn->width; i++) { ------------------ | Branch (94:19): [True: 160, False: 886] ------------------ 95| 160| mask |= bn->d[i]; 96| 160| } 97| 886| return mask == 0; 98| 886|} BN_is_zero: 111| 1.32M|int BN_is_zero(const BIGNUM *bn) { 112| 1.32M| return bn_fits_in_words(bn, 0); 113| 1.32M|} BN_is_one: 115| 886|int BN_is_one(const BIGNUM *bn) { 116| 886| return bn->neg == 0 && BN_abs_is_word(bn, 1); ------------------ | Branch (116:10): [True: 886, False: 0] | Branch (116:26): [True: 886, False: 0] ------------------ 117| 886|} BN_is_odd: 123| 2.94M|int BN_is_odd(const BIGNUM *bn) { 124| 2.94M| return bn->width > 0 && (bn->d[0] & 1) == 1; ------------------ | Branch (124:10): [True: 2.94M, False: 0] | Branch (124:27): [True: 1.67M, False: 1.26M] ------------------ 125| 2.94M|} BN_equal_consttime: 142| 28.0k|int BN_equal_consttime(const BIGNUM *a, const BIGNUM *b) { 143| 28.0k| BN_ULONG mask = 0; 144| | // If |a| or |b| has more words than the other, all those words must be zero. 145| 28.0k| for (int i = a->width; i < b->width; i++) { ------------------ | Branch (145:26): [True: 0, False: 28.0k] ------------------ 146| 0| mask |= b->d[i]; 147| 0| } 148| 28.0k| for (int i = b->width; i < a->width; i++) { ------------------ | Branch (148:26): [True: 0, False: 28.0k] ------------------ 149| 0| mask |= a->d[i]; 150| 0| } 151| | // Common words must match. 152| 28.0k| int min = a->width < b->width ? a->width : b->width; ------------------ | Branch (152:13): [True: 0, False: 28.0k] ------------------ 153| 924k| for (int i = 0; i < min; i++) { ------------------ | Branch (153:19): [True: 896k, False: 28.0k] ------------------ 154| 896k| mask |= (a->d[i] ^ b->d[i]); 155| 896k| } 156| | // The sign bit must match. 157| 28.0k| mask |= (a->neg ^ b->neg); 158| 28.0k| return mask == 0; 159| 28.0k|} bcm.cc:_ZL22bn_cmp_words_consttimePKmmS0_m: 26| 1.85M| const BN_ULONG *b, size_t b_len) { 27| 1.85M| static_assert(sizeof(BN_ULONG) <= sizeof(crypto_word_t), 28| 1.85M| "crypto_word_t is too small"); 29| 1.85M| int ret = 0; 30| | // Process the common words in little-endian order. 31| 1.85M| size_t min = a_len < b_len ? a_len : b_len; ------------------ | Branch (31:16): [True: 87.8k, False: 1.76M] ------------------ 32| 30.0M| for (size_t i = 0; i < min; i++) { ------------------ | Branch (32:22): [True: 28.1M, False: 1.85M] ------------------ 33| 28.1M| crypto_word_t eq = constant_time_eq_w(a[i], b[i]); 34| 28.1M| crypto_word_t lt = constant_time_lt_w(a[i], b[i]); 35| 28.1M| ret = 36| 28.1M| constant_time_select_int(eq, ret, constant_time_select_int(lt, -1, 1)); 37| 28.1M| } 38| | 39| | // If |a| or |b| has non-zero words beyond |min|, they take precedence. 40| 1.85M| if (a_len < b_len) { ------------------ | Branch (40:7): [True: 87.8k, False: 1.76M] ------------------ 41| 87.8k| crypto_word_t mask = 0; 42| 175k| for (size_t i = a_len; i < b_len; i++) { ------------------ | Branch (42:28): [True: 87.8k, False: 87.8k] ------------------ 43| 87.8k| mask |= b[i]; 44| 87.8k| } 45| 87.8k| ret = constant_time_select_int(constant_time_is_zero_w(mask), ret, -1); 46| 1.76M| } else if (b_len < a_len) { ------------------ | Branch (46:14): [True: 170k, False: 1.59M] ------------------ 47| 170k| crypto_word_t mask = 0; 48| 2.28M| for (size_t i = b_len; i < a_len; i++) { ------------------ | Branch (48:28): [True: 2.11M, False: 170k] ------------------ 49| 2.11M| mask |= a[i]; 50| 2.11M| } 51| 170k| ret = constant_time_select_int(constant_time_is_zero_w(mask), ret, 1); 52| 170k| } 53| | 54| 1.85M| return ret; 55| 1.85M|} BN_CTX_new: 52| 96.7k|BN_CTX *BN_CTX_new(void) { return bssl::New(); } BN_CTX_free: 54| 106k|void BN_CTX_free(BN_CTX *ctx) { bssl::Delete(ctx); } BN_CTX_start: 56| 349k|void BN_CTX_start(BN_CTX *ctx) { 57| 349k| if (ctx->error_) { ------------------ | Branch (57:7): [True: 0, False: 349k] ------------------ 58| | // Once an operation has failed, |ctx->stack| no longer matches the number 59| | // of |BN_CTX_end| calls to come. Do nothing. 60| 0| return; 61| 0| } 62| | 63| 349k| if (!ctx->stack_.Push(ctx->used_)) { ------------------ | Branch (63:7): [True: 0, False: 349k] ------------------ 64| 0| ctx->error_ = true; 65| | // |BN_CTX_start| cannot fail, so defer the error to |BN_CTX_get|. 66| 0| ctx->defer_error_ = true; 67| 0| ERR_clear_error(); 68| 0| } 69| 349k|} BN_CTX_get: 71| 513k|BIGNUM *BN_CTX_get(BN_CTX *ctx) { 72| | // Once any operation has failed, they all do. 73| 513k| if (ctx->error_) { ------------------ | Branch (73:7): [True: 0, False: 513k] ------------------ 74| 0| if (ctx->defer_error_) { ------------------ | Branch (74:9): [True: 0, False: 0] ------------------ 75| 0| OPENSSL_PUT_ERROR(BN, BN_R_TOO_MANY_TEMPORARY_VARIABLES); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 76| 0| ctx->defer_error_ = false; 77| 0| } 78| 0| return nullptr; 79| 0| } 80| | 81| 513k| if (ctx->used_ == ctx->bignums_.size()) { ------------------ | Branch (81:7): [True: 225k, False: 287k] ------------------ 82| 225k| bssl::UniquePtr bn(BN_new()); 83| 225k| if (bn == nullptr || !ctx->bignums_.Push(std::move(bn))) { ------------------ | Branch (83:9): [True: 0, False: 225k] | Branch (83:9): [True: 0, False: 225k] | Branch (83:26): [True: 0, False: 225k] ------------------ 84| 0| OPENSSL_PUT_ERROR(BN, BN_R_TOO_MANY_TEMPORARY_VARIABLES); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 85| 0| ctx->error_ = true; 86| 0| return nullptr; 87| 0| } 88| 225k| } 89| | 90| 513k| BIGNUM *ret = ctx->bignums_[ctx->used_].get(); 91| 513k| BN_zero(ret); 92| | // This is bounded by |ctx->bignums_.size()|, so it cannot overflow. 93| 513k| ctx->used_++; 94| 513k| return ret; 95| 513k|} BN_CTX_end: 97| 349k|void BN_CTX_end(BN_CTX *ctx) { 98| 349k| if (ctx->error_) { ------------------ | Branch (98:7): [True: 0, False: 349k] ------------------ 99| | // Once an operation has failed, |ctx->stack_| no longer matches the number 100| | // of |BN_CTX_end| calls to come. Do nothing. 101| 0| return; 102| 0| } 103| | 104| 349k| assert(!ctx->stack_.empty()); 105| 349k| ctx->used_ = ctx->stack_.back(); 106| 349k| ctx->stack_.pop_back(); 107| 349k|} _ZN10bignum_ctxD2Ev: 29| 96.7k| ~bignum_ctx() { 30| | // All |BN_CTX_start| calls must be matched with |BN_CTX_end|, otherwise the 31| | // function may use more memory than expected, potentially without bound if 32| | // done in a loop. Assert that all |BIGNUM|s have been released. 33| 96.7k| assert(used_ == 0 || error_); 34| 96.7k| } BN_div: 155| 9.72k| const BIGNUM *divisor, BN_CTX *ctx) { 156| | // This function implements long division, per Knuth, The Art of Computer 157| | // Programming, Volume 2, Chapter 4.3.1, Algorithm D. This algorithm only 158| | // divides non-negative integers, but we round towards zero, so we divide 159| | // absolute values and adjust the signs separately. 160| | // 161| | // Inputs to this function are assumed public and may be leaked by timing and 162| | // cache side channels. Division with secret inputs should use other 163| | // implementation strategies such as Montgomery reduction. 164| 9.72k| if (BN_is_zero(divisor)) { ------------------ | Branch (164:7): [True: 0, False: 9.72k] ------------------ 165| 0| OPENSSL_PUT_ERROR(BN, BN_R_DIV_BY_ZERO); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 166| 0| return 0; 167| 0| } 168| | 169| 9.72k| bssl::BN_CTXScope scope(ctx); 170| 9.72k| BIGNUM *tmp = BN_CTX_get(ctx); 171| 9.72k| BIGNUM *snum = BN_CTX_get(ctx); 172| 9.72k| BIGNUM *sdiv = BN_CTX_get(ctx); 173| 9.72k| BIGNUM *res = quotient == NULL ? BN_CTX_get(ctx) : quotient; ------------------ | Branch (173:17): [True: 9.72k, False: 0] ------------------ 174| 9.72k| int norm_shift, num_n, loop, div_n; 175| 9.72k| BN_ULONG d0, d1; 176| 9.72k| if (tmp == NULL || snum == NULL || sdiv == NULL || res == NULL) { ------------------ | Branch (176:7): [True: 0, False: 9.72k] | Branch (176:22): [True: 0, False: 9.72k] | Branch (176:38): [True: 0, False: 9.72k] | Branch (176:54): [True: 0, False: 9.72k] ------------------ 177| 0| return 0; 178| 0| } 179| | 180| | // Knuth step D1: Normalise the numbers such that the divisor's MSB is set. 181| | // This ensures, in Knuth's terminology, that v1 >= b/2, needed for the 182| | // quotient estimation step. 183| 9.72k| norm_shift = BN_BITS2 - (BN_num_bits(divisor) % BN_BITS2); ------------------ | | 42| 9.72k|#define BN_BITS2 64 ------------------ norm_shift = BN_BITS2 - (BN_num_bits(divisor) % BN_BITS2); ------------------ | | 42| 9.72k|#define BN_BITS2 64 ------------------ 184| 9.72k| if (!BN_lshift(sdiv, divisor, norm_shift) || ------------------ | Branch (184:7): [True: 0, False: 9.72k] ------------------ 185| 9.72k| !BN_lshift(snum, numerator, norm_shift)) { ------------------ | Branch (185:7): [True: 0, False: 9.72k] ------------------ 186| 0| return 0; 187| 0| } 188| | 189| | // This algorithm relies on |sdiv| being minimal width. We do not use this 190| | // function on secret inputs, so leaking this is fine. Also minimize |snum| to 191| | // avoid looping on leading zeros, as we're not trying to be leak-free. 192| 9.72k| bn_set_minimal_width(sdiv); 193| 9.72k| bn_set_minimal_width(snum); 194| 9.72k| div_n = sdiv->width; 195| 9.72k| d0 = sdiv->d[div_n - 1]; 196| 9.72k| d1 = (div_n == 1) ? 0 : sdiv->d[div_n - 2]; ------------------ | Branch (196:8): [True: 0, False: 9.72k] ------------------ 197| 9.72k| assert(d0 & (((BN_ULONG)1) << (BN_BITS2 - 1))); 198| | 199| | // Extend |snum| with zeros to satisfy the long division invariants: 200| | // - |snum| must have at least |div_n| + 1 words. 201| | // - |snum|'s most significant word must be zero to guarantee the first loop 202| | // iteration works with a prefix greater than |sdiv|. (This is the extra u0 203| | // digit in Knuth step D1.) 204| 9.72k| num_n = snum->width <= div_n ? div_n + 1 : snum->width + 1; ------------------ | Branch (204:11): [True: 332, False: 9.39k] ------------------ 205| 9.72k| if (!bn_resize_words(snum, num_n)) { ------------------ | Branch (205:7): [True: 0, False: 9.72k] ------------------ 206| 0| return 0; 207| 0| } 208| | 209| | // Knuth step D2: The quotient's width is the difference between numerator and 210| | // denominator. Also set up its sign and size a temporary for the loop. 211| 9.72k| loop = num_n - div_n; 212| 9.72k| res->neg = snum->neg ^ sdiv->neg; 213| 9.72k| if (!bn_wexpand(res, loop) || // ------------------ | Branch (213:7): [True: 0, False: 9.72k] ------------------ 214| 9.72k| !bn_wexpand(tmp, div_n + 1)) { ------------------ | Branch (214:7): [True: 0, False: 9.72k] ------------------ 215| 0| return 0; 216| 0| } 217| 9.72k| res->width = loop; 218| | 219| | // Knuth steps D2 through D7: Compute the quotient with a word-by-word long 220| | // division. Note that Knuth indexes words from most to least significant, so 221| | // our index is reversed. Each loop iteration computes res->d[i] of the 222| | // quotient and updates snum with the running remainder. Before each loop 223| | // iteration, the div_n words beginning at snum->d[i+1] must be less than 224| | // snum. 225| 227k| for (int i = loop - 1; i >= 0; i--) { ------------------ | Branch (225:26): [True: 217k, False: 9.72k] ------------------ 226| | // The next word of the quotient, q, is floor(wnum / sdiv), where wnum is 227| | // the div_n + 1 words beginning at snum->d[i]. i starts at 228| | // num_n - div_n - 1, so there are at least div_n + 1 words available. 229| | // 230| | // Knuth step D3: Compute q', an estimate of q by looking at the top words 231| | // of wnum and sdiv. We must estimate such that q' = q or q' = q + 1. 232| 217k| BN_ULONG q, rm = 0; 233| 217k| BN_ULONG *wnum = snum->d + i; 234| 217k| BN_ULONG n0 = wnum[div_n]; 235| 217k| BN_ULONG n1 = wnum[div_n - 1]; 236| 217k| if (n0 == d0) { ------------------ | Branch (236:9): [True: 151, False: 217k] ------------------ 237| | // Estimate q' = b - 1, where b is the base. 238| 151| q = BN_MASK2; ------------------ | | 46| 151|#define BN_MASK2 (0xffffffffffffffffUL) ------------------ 239| | // Knuth also runs the fixup routine in this case, but this would require 240| | // computing rm and is unnecessary. q' is already close enough. That is, 241| | // the true quotient, q is either b - 1 or b - 2. 242| | // 243| | // By the loop invariant, q <= b - 1, so we must show that q >= b - 2. We 244| | // do this by showing wnum / sdiv >= b - 2. Suppose wnum / sdiv < b - 2. 245| | // wnum and sdiv have the same most significant word, so: 246| | // 247| | // wnum >= n0 * b^div_n 248| | // sdiv < (n0 + 1) * b^(d_div - 1) 249| | // 250| | // Thus: 251| | // 252| | // b - 2 > wnum / sdiv 253| | // > (n0 * b^div_n) / (n0 + 1) * b^(div_n - 1) 254| | // = (n0 * b) / (n0 + 1) 255| | // 256| | // (n0 + 1) * (b - 2) > n0 * b 257| | // n0 * b + b - 2 * n0 - 2 > n0 * b 258| | // b - 2 > 2 * n0 259| | // b/2 - 1 > n0 260| | // 261| | // This contradicts the normalization condition, so q >= b - 2 and our 262| | // estimate is close enough. 263| 217k| } else { 264| | // Estimate q' = floor(n0n1 / d0). Per Theorem B, q' - 2 <= q <= q', which 265| | // is slightly outside of our bounds. 266| 217k| assert(n0 < d0); 267| 217k| bn_div_rem_words(&q, &rm, n0, n1, d0); 268| | 269| | // Fix the estimate by examining one more word and adjusting q' as needed. 270| | // This is the second half of step D3 and is sufficient per exercises 19, 271| | // 20, and 21. Although only one iteration is needed to correct q + 2 to 272| | // q + 1, Knuth uses a loop. A loop will often also correct q + 1 to q, 273| | // saving the slightly more expensive underflow handling below. 274| 217k| if (div_n > 1) { ------------------ | Branch (274:11): [True: 217k, False: 0] ------------------ 275| 217k| BN_ULONG n2 = wnum[div_n - 2]; 276| 217k|#ifdef BN_ULLONG 277| 217k| BN_ULLONG t2 = (BN_ULLONG)d1 * q; ------------------ | | 36| 217k|#define BN_ULLONG uint128_t ------------------ 278| 241k| for (;;) { 279| 241k| if (t2 <= ((((BN_ULLONG)rm) << BN_BITS2) | n2)) { ------------------ | | 42| 241k|#define BN_BITS2 64 ------------------ | Branch (279:15): [True: 200k, False: 40.2k] ------------------ 280| 200k| break; 281| 200k| } 282| 40.2k| q--; 283| 40.2k| rm += d0; 284| 40.2k| if (rm < d0) { ------------------ | Branch (284:15): [True: 16.3k, False: 23.8k] ------------------ 285| | // If rm overflows, the true value exceeds BN_ULONG and the next 286| | // t2 comparison should exit the loop. 287| 16.3k| break; 288| 16.3k| } 289| 23.8k| t2 -= d1; 290| 23.8k| } 291| |#else // !BN_ULLONG 292| | BN_ULONG t2l, t2h; 293| | BN_UMULT_LOHI(t2l, t2h, d1, q); 294| | for (;;) { 295| | if (t2h < rm || (t2h == rm && t2l <= n2)) { 296| | break; 297| | } 298| | q--; 299| | rm += d0; 300| | if (rm < d0) { 301| | // If rm overflows, the true value exceeds BN_ULONG and the next 302| | // t2 comparison should exit the loop. 303| | break; 304| | } 305| | if (t2l < d1) { 306| | t2h--; 307| | } 308| | t2l -= d1; 309| | } 310| |#endif // !BN_ULLONG 311| 217k| } 312| 217k| } 313| | 314| | // Knuth step D4 through D6: Now q' = q or q' = q + 1, and 315| | // -sdiv < wnum - sdiv * q < sdiv. If q' = q + 1, the subtraction will 316| | // underflow, and we fix it up below. 317| 217k| tmp->d[div_n] = bn_mul_words(tmp->d, sdiv->d, div_n, q); 318| 217k| if (bn_sub_words(wnum, wnum, tmp->d, div_n + 1)) { ------------------ | Branch (318:9): [True: 66, False: 217k] ------------------ 319| 66| q--; 320| | // The final addition is expected to overflow, canceling the underflow. 321| 66| wnum[div_n] += bn_add_words(wnum, wnum, sdiv->d, div_n); 322| 66| } 323| | 324| | // q is now correct, and wnum has been updated to the running remainder. 325| 217k| res->d[i] = q; 326| 217k| } 327| | 328| | // Trim leading zeros and correct any negative zeros. 329| 9.72k| bn_set_minimal_width(snum); 330| 9.72k| bn_set_minimal_width(res); 331| | 332| | // Knuth step D8: Unnormalize. snum now contains the remainder. 333| 9.72k| if (rem != NULL && !BN_rshift(rem, snum, norm_shift)) { ------------------ | Branch (333:7): [True: 9.72k, False: 0] | Branch (333:22): [True: 0, False: 9.72k] ------------------ 334| 0| return 0; 335| 0| } 336| | 337| 9.72k| return 1; 338| 9.72k|} BN_nnmod: 340| 336|int BN_nnmod(BIGNUM *r, const BIGNUM *m, const BIGNUM *d, BN_CTX *ctx) { 341| 336| if (!(BN_mod(r, m, d, ctx))) { ------------------ | | 444| 336| BN_div(NULL, (rem), (numerator), (divisor), (ctx)) ------------------ | Branch (341:7): [True: 0, False: 336] ------------------ 342| 0| return 0; 343| 0| } 344| 336| if (!r->neg) { ------------------ | Branch (344:7): [True: 0, False: 336] ------------------ 345| 0| return 1; 346| 0| } 347| | 348| | // now -d < r < 0, so we have to set r := r + d. Ignoring the sign bits, this 349| | // is r = d - r. 350| 336| return BN_usub(r, d, r); 351| 336|} bn_reduce_once: 354| 270k| const BN_ULONG *m, size_t num) { 355| 270k| assert(r != a); 356| | // |r| = |a| - |m|. |bn_sub_words| performs the bulk of the subtraction, and 357| | // then we apply the borrow to |carry|. 358| 270k| carry -= bn_sub_words(r, a, m, num); 359| | // We know 0 <= |a| < 2*|m|, so -|m| <= |r| < |m|. 360| | // 361| | // If 0 <= |r| < |m|, |r| fits in |num| words and |carry| is zero. We then 362| | // wish to select |r| as the answer. Otherwise -m <= r < 0 and we wish to 363| | // return |r| + |m|, or |a|. |carry| must then be -1 or all ones. In both 364| | // cases, |carry| is a suitable input to |bn_select_words|. 365| | // 366| | // Although |carry| may be one if it was one on input and |bn_sub_words| 367| | // returns zero, this would give |r| > |m|, violating our input assumptions. 368| 270k| declassify_assert(carry + 1 <= 1); ------------------ | | 493| 270k|#define declassify_assert(expr) assert(constant_time_declassify_int(expr)) ------------------ 369| 270k| bn_select_words(r, carry, a /* r < 0 */, r /* r >= 0 */, num); 370| 270k| return carry; 371| 270k|} bn_reduce_once_in_place: 374| 253M| BN_ULONG *tmp, size_t num) { 375| | // See |bn_reduce_once| for why this logic works. 376| 253M| carry -= bn_sub_words(tmp, r, m, num); 377| 253M| declassify_assert(carry + 1 <= 1); ------------------ | | 493| 253M|#define declassify_assert(expr) assert(constant_time_declassify_int(expr)) ------------------ 378| 253M| bn_select_words(r, carry, r /* tmp < 0 */, tmp /* tmp >= 0 */, num); 379| 253M| return carry; 380| 253M|} bn_mod_sub_words: 383| 173M| const BN_ULONG *m, BN_ULONG *tmp, size_t num) { 384| | // r = a - b 385| 173M| BN_ULONG borrow = bn_sub_words(r, a, b, num); 386| | // tmp = a - b + m 387| 173M| bn_add_words(tmp, r, m, num); 388| 173M| bn_select_words(r, 0 - borrow, tmp /* r < 0 */, r /* r >= 0 */, num); 389| 173M|} bn_mod_add_words: 392| 253M| const BN_ULONG *m, BN_ULONG *tmp, size_t num) { 393| 253M| BN_ULONG carry = bn_add_words(r, a, b, num); 394| 253M| bn_reduce_once_in_place(r, carry, m, tmp, num); 395| 253M|} bn_div_consttime: 399| 10| unsigned divisor_min_bits, BN_CTX *ctx) { 400| 10| if (BN_is_negative(numerator) || BN_is_negative(divisor)) { ------------------ | Branch (400:7): [True: 0, False: 10] | Branch (400:36): [True: 0, False: 10] ------------------ 401| 0| OPENSSL_PUT_ERROR(BN, BN_R_NEGATIVE_NUMBER); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 402| 0| return 0; 403| 0| } 404| 10| if (BN_is_zero(divisor)) { ------------------ | Branch (404:7): [True: 0, False: 10] ------------------ 405| 0| OPENSSL_PUT_ERROR(BN, BN_R_DIV_BY_ZERO); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 406| 0| return 0; 407| 0| } 408| | 409| | // This function implements long division in binary. It is not very efficient, 410| | // but it is simple, easy to make constant-time, and performant enough for RSA 411| | // key generation. 412| | 413| 10| bssl::BN_CTXScope scope(ctx); 414| 10| BIGNUM *q = quotient, *r = remainder; 415| 10| if (quotient == NULL || quotient == numerator || quotient == divisor) { ------------------ | Branch (415:7): [True: 10, False: 0] | Branch (415:27): [True: 0, False: 0] | Branch (415:52): [True: 0, False: 0] ------------------ 416| 10| q = BN_CTX_get(ctx); 417| 10| } 418| 10| if (remainder == NULL || remainder == numerator || remainder == divisor) { ------------------ | Branch (418:7): [True: 0, False: 10] | Branch (418:28): [True: 8, False: 2] | Branch (418:54): [True: 0, False: 2] ------------------ 419| 8| r = BN_CTX_get(ctx); 420| 8| } 421| 10| BIGNUM *tmp = BN_CTX_get(ctx); 422| 10| int initial_words; 423| 10| if (q == NULL || r == NULL || tmp == NULL || ------------------ | Branch (423:7): [True: 0, False: 10] | Branch (423:20): [True: 0, False: 10] | Branch (423:33): [True: 0, False: 10] ------------------ 424| 10| !bn_wexpand(q, numerator->width) || !bn_wexpand(r, divisor->width) || ------------------ | Branch (424:7): [True: 0, False: 10] | Branch (424:43): [True: 0, False: 10] ------------------ 425| 10| !bn_wexpand(tmp, divisor->width)) { ------------------ | Branch (425:7): [True: 0, False: 10] ------------------ 426| 0| return 0; 427| 0| } 428| | 429| 10| OPENSSL_memset(q->d, 0, numerator->width * sizeof(BN_ULONG)); 430| 10| q->width = numerator->width; 431| 10| q->neg = 0; 432| | 433| 10| OPENSSL_memset(r->d, 0, divisor->width * sizeof(BN_ULONG)); 434| 10| r->width = divisor->width; 435| 10| r->neg = 0; 436| | 437| | // Incorporate |numerator| into |r|, one bit at a time, reducing after each 438| | // step. We maintain the invariant that |0 <= r < divisor| and 439| | // |q * divisor + r = n| where |n| is the portion of |numerator| incorporated 440| | // so far. 441| | // 442| | // First, we short-circuit the loop: if we know |divisor| has at least 443| | // |divisor_min_bits| bits, the top |divisor_min_bits - 1| can be incorporated 444| | // without reductions. This significantly speeds up |RSA_check_key|. For 445| | // simplicity, we round down to a whole number of words. 446| 10| declassify_assert(divisor_min_bits <= BN_num_bits(divisor)); ------------------ | | 493| 10|#define declassify_assert(expr) assert(constant_time_declassify_int(expr)) ------------------ 447| 10| initial_words = 0; 448| 10| if (divisor_min_bits > 0) { ------------------ | Branch (448:7): [True: 10, False: 0] ------------------ 449| 10| initial_words = (divisor_min_bits - 1) / BN_BITS2; ------------------ | | 42| 10|#define BN_BITS2 64 ------------------ 450| 10| if (initial_words > numerator->width) { ------------------ | Branch (450:9): [True: 0, False: 10] ------------------ 451| 0| initial_words = numerator->width; 452| 0| } 453| 10| OPENSSL_memcpy(r->d, numerator->d + numerator->width - initial_words, 454| 10| initial_words * sizeof(BN_ULONG)); 455| 10| } 456| | 457| 134| for (int i = numerator->width - initial_words - 1; i >= 0; i--) { ------------------ | Branch (457:54): [True: 124, False: 10] ------------------ 458| 8.06k| for (int bit = BN_BITS2 - 1; bit >= 0; bit--) { ------------------ | | 42| 124|#define BN_BITS2 64 ------------------ | Branch (458:34): [True: 7.93k, False: 124] ------------------ 459| | // Incorporate the next bit of the numerator, by computing 460| | // r = 2*r or 2*r + 1. Note the result fits in one more word. We store the 461| | // extra word in |carry|. 462| 7.93k| BN_ULONG carry = bn_add_words(r->d, r->d, r->d, divisor->width); 463| 7.93k| r->d[0] |= (numerator->d[i] >> bit) & 1; 464| | // |r| was previously fully-reduced, so we know: 465| | // 2*0 <= r <= 2*(divisor-1) + 1 466| | // 0 <= r <= 2*divisor - 1 < 2*divisor. 467| | // Thus |r| satisfies the preconditions for |bn_reduce_once_in_place|. 468| 7.93k| BN_ULONG subtracted = bn_reduce_once_in_place(r->d, carry, divisor->d, 469| 7.93k| tmp->d, divisor->width); 470| | // The corresponding bit of the quotient is set iff we needed to subtract. 471| 7.93k| q->d[i] |= (~subtracted & 1) << bit; 472| 7.93k| } 473| 124| } 474| | 475| 10| if ((quotient != NULL && !BN_copy(quotient, q)) || ------------------ | Branch (475:8): [True: 0, False: 10] | Branch (475:28): [True: 0, False: 0] ------------------ 476| 10| (remainder != NULL && !BN_copy(remainder, r))) { ------------------ | Branch (476:8): [True: 10, False: 0] | Branch (476:29): [True: 0, False: 10] ------------------ 477| 0| return 0; 478| 0| } 479| | 480| 10| return 1; 481| 10|} bn_mod_sub_consttime: 551| 28.0k| const BIGNUM *m, BN_CTX *ctx) { 552| 28.0k| bssl::BN_CTXScope scope(ctx); 553| 28.0k| a = bn_resized_from_ctx(a, m->width, ctx); 554| 28.0k| b = bn_resized_from_ctx(b, m->width, ctx); 555| 28.0k| BIGNUM *tmp = bn_scratch_space_from_ctx(m->width, ctx); 556| 28.0k| if (a == nullptr || b == nullptr || tmp == nullptr || ------------------ | Branch (556:7): [True: 0, False: 28.0k] | Branch (556:23): [True: 0, False: 28.0k] | Branch (556:39): [True: 0, False: 28.0k] ------------------ 557| 28.0k| !bn_wexpand(r, m->width)) { ------------------ | Branch (557:7): [True: 0, False: 28.0k] ------------------ 558| 0| return 0; 559| 0| } 560| 28.0k| bn_mod_sub_words(r->d, a->d, b->d, m->d, tmp->d, m->width); 561| 28.0k| r->width = m->width; 562| 28.0k| r->neg = 0; 563| 28.0k| return 1; 564| 28.0k|} bn_mod_lshift_consttime: 625| 2| BN_CTX *ctx) { 626| 2| if (!BN_copy(r, a) || !bn_resize_words(r, m->width)) { ------------------ | Branch (626:7): [True: 0, False: 2] | Branch (626:25): [True: 0, False: 2] ------------------ 627| 0| return 0; 628| 0| } 629| | 630| 2| bssl::BN_CTXScope scope(ctx); 631| 2| BIGNUM *tmp = bn_scratch_space_from_ctx(m->width, ctx); 632| 2| if (tmp == nullptr) { ------------------ | Branch (632:7): [True: 0, False: 2] ------------------ 633| 0| return 0; 634| 0| } 635| 36| for (int i = 0; i < n; i++) { ------------------ | Branch (635:19): [True: 34, False: 2] ------------------ 636| 34| bn_mod_add_words(r->d, r->d, r->d, m->d, tmp->d, m->width); 637| 34| } 638| 2| r->neg = 0; 639| 2| return 1; 640| 2|} bcm.cc:_ZL16bn_div_rem_wordsPmS_mmm: 113| 217k| BN_ULONG nh, BN_ULONG nl, BN_ULONG d) { 114| 217k| assert(nh < d); 115| | // This operation is the x86 and x86_64 DIV instruction, but it is difficult 116| | // for the compiler to emit it. Dividing a |BN_ULLONG| by a |BN_ULONG| does 117| | // not work because, a priori, the quotient may not fit in |BN_ULONG| and DIV 118| | // will trap on overflow, not truncate. The compiler will instead emit a call 119| | // to a more expensive support function (e.g. |__udivdi3|). Thus we use inline 120| | // assembly or intrinsics to get the instruction. 121| | // 122| | // These is specific to x86 and x86_64; Arm and RISC-V do not have double-wide 123| | // division instructions. 124| |#if defined(BN_CAN_USE_INLINE_ASM) && defined(OPENSSL_X86) 125| | __asm__ volatile("divl %4" 126| | : "=a"(*quotient_out), "=d"(*rem_out) 127| | : "a"(nl), "d"(nh), "rm"(d) 128| | : "cc"); 129| |#elif defined(BN_CAN_USE_INLINE_ASM) && defined(OPENSSL_X86_64) 130| 217k| __asm__ volatile("divq %4" 131| 217k| : "=a"(*quotient_out), "=d"(*rem_out) 132| 217k| : "a"(nl), "d"(nh), "rm"(d) 133| 217k| : "cc"); 134| |#elif defined(HAVE_MSVC_DIV_INTRINSICS) && defined(OPENSSL_X86) 135| | BN_ULLONG n = (((BN_ULLONG)nh) << BN_BITS2) | nl; 136| | unsigned rem; 137| | *quotient_out = _udiv64(n, d, &rem); 138| | *rem_out = rem; 139| |#elif defined(HAVE_MSVC_DIV_INTRINSICS) && defined(OPENSSL_X86_64) 140| | unsigned __int64 rem; 141| | *quotient_out = _udiv128(nh, nl, d, &rem); 142| | *rem_out = rem; 143| |#else 144| |#if defined(BN_CAN_DIVIDE_ULLONG) 145| | BN_ULLONG n = (((BN_ULLONG)nh) << BN_BITS2) | nl; 146| | *quotient_out = (BN_ULONG)(n / d); 147| |#else 148| | *quotient_out = bn_div_words(nh, nl, d); 149| |#endif // BN_CAN_DIVIDE_ULLONG 150| | *rem_out = nl - (*quotient_out * d); 151| |#endif 152| 217k|} bcm.cc:_ZL19bn_resized_from_ctxPK9bignum_stmP10bignum_ctx: 499| 56.0k| BN_CTX *ctx) { 500| 56.0k| if ((size_t)bn->width >= width) { ------------------ | Branch (500:7): [True: 56.0k, False: 0] ------------------ 501| | // Any excess words must be zero. 502| 56.0k| assert(bn_fits_in_words(bn, width)); 503| 56.0k| return bn; 504| 56.0k| } 505| 0| BIGNUM *ret = bn_scratch_space_from_ctx(width, ctx); 506| 0| if (ret == NULL || !BN_copy(ret, bn) || !bn_resize_words(ret, width)) { ------------------ | Branch (506:7): [True: 0, False: 0] | Branch (506:22): [True: 0, False: 0] | Branch (506:43): [True: 0, False: 0] ------------------ 507| 0| return NULL; 508| 0| } 509| 0| return ret; 510| 0|} bcm.cc:_ZL25bn_scratch_space_from_ctxmP10bignum_ctx: 483| 28.0k|static BIGNUM *bn_scratch_space_from_ctx(size_t width, BN_CTX *ctx) { 484| 28.0k| BIGNUM *ret = BN_CTX_get(ctx); 485| 28.0k| if (ret == NULL || !bn_wexpand(ret, width)) { ------------------ | Branch (485:7): [True: 0, False: 28.0k] | Branch (485:22): [True: 0, False: 28.0k] ------------------ 486| 0| return NULL; 487| 0| } 488| 28.0k| ret->neg = 0; 489| 28.0k| ret->width = (int)width; 490| 28.0k| return ret; 491| 28.0k|} BN_mod_exp_mont: 127| 38.2k| const BIGNUM *m, BN_CTX *ctx, const BN_MONT_CTX *mont) { 128| 38.2k| if (!BN_is_odd(m)) { ------------------ | Branch (128:7): [True: 0, False: 38.2k] ------------------ 129| 0| OPENSSL_PUT_ERROR(BN, BN_R_CALLED_WITH_EVEN_MODULUS); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 130| 0| return 0; 131| 0| } 132| 38.2k| if (m->neg) { ------------------ | Branch (132:7): [True: 0, False: 38.2k] ------------------ 133| 0| OPENSSL_PUT_ERROR(BN, BN_R_NEGATIVE_NUMBER); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 134| 0| return 0; 135| 0| } 136| | // |a| is secret, but |a < m| is not. 137| 38.2k| if (a->neg || constant_time_declassify_int(BN_ucmp(a, m)) >= 0) { ------------------ | Branch (137:7): [True: 0, False: 38.2k] | Branch (137:17): [True: 0, False: 38.2k] ------------------ 138| 0| OPENSSL_PUT_ERROR(BN, BN_R_INPUT_NOT_REDUCED); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 139| 0| return 0; 140| 0| } 141| | 142| 38.2k| int bits = BN_num_bits(p); 143| 38.2k| if (bits == 0) { ------------------ | Branch (143:7): [True: 0, False: 38.2k] ------------------ 144| | // x**0 mod 1 is still zero. 145| 0| if (BN_abs_is_word(m, 1)) { ------------------ | Branch (145:9): [True: 0, False: 0] ------------------ 146| 0| BN_zero(rr); 147| 0| return 1; 148| 0| } 149| 0| return BN_one(rr); 150| 0| } 151| | 152| 38.2k| BIGNUM *val[TABLE_SIZE]; 153| | 154| 38.2k| bssl::BN_CTXScope scope(ctx); 155| 38.2k| BIGNUM *r = BN_CTX_get(ctx); 156| 38.2k| val[0] = BN_CTX_get(ctx); 157| 38.2k| if (r == NULL || val[0] == NULL) { ------------------ | Branch (157:7): [True: 0, False: 38.2k] | Branch (157:20): [True: 0, False: 38.2k] ------------------ 158| 0| return 0; 159| 0| } 160| | 161| | // Allocate a montgomery context if it was not supplied by the caller. 162| 38.2k| bssl::UniquePtr new_mont; 163| 38.2k| if (mont == nullptr) { ------------------ | Branch (163:7): [True: 0, False: 38.2k] ------------------ 164| 0| new_mont.reset(BN_MONT_CTX_new_consttime(m, ctx)); 165| 0| if (new_mont == nullptr) { ------------------ | Branch (165:9): [True: 0, False: 0] ------------------ 166| 0| return 0; 167| 0| } 168| 0| mont = new_mont.get(); 169| 0| } 170| | 171| | // We exponentiate by looking at sliding windows of the exponent and 172| | // precomputing powers of |a|. Windows may be shifted so they always end on a 173| | // set bit, so only precompute odd powers. We compute val[i] = a^(2*i + 1) 174| | // for i = 0 to 2^(window-1), all in Montgomery form. 175| 38.2k| int window = BN_window_bits_for_exponent_size(bits); 176| 38.2k| if (!BN_to_montgomery(val[0], a, mont, ctx)) { ------------------ | Branch (176:7): [True: 0, False: 38.2k] ------------------ 177| 0| return 0; 178| 0| } 179| 38.2k| if (window > 1) { ------------------ | Branch (179:7): [True: 0, False: 38.2k] ------------------ 180| 0| BIGNUM *d = BN_CTX_get(ctx); 181| 0| if (d == NULL || !BN_mod_mul_montgomery(d, val[0], val[0], mont, ctx)) { ------------------ | Branch (181:9): [True: 0, False: 0] | Branch (181:22): [True: 0, False: 0] ------------------ 182| 0| return 0; 183| 0| } 184| 0| for (int i = 1; i < 1 << (window - 1); i++) { ------------------ | Branch (184:21): [True: 0, False: 0] ------------------ 185| 0| val[i] = BN_CTX_get(ctx); 186| 0| if (val[i] == NULL || ------------------ | Branch (186:11): [True: 0, False: 0] ------------------ 187| 0| !BN_mod_mul_montgomery(val[i], val[i - 1], d, mont, ctx)) { ------------------ | Branch (187:11): [True: 0, False: 0] ------------------ 188| 0| return 0; 189| 0| } 190| 0| } 191| 0| } 192| | 193| | // |p| is non-zero, so at least one window is non-zero. To save some 194| | // multiplications, defer initializing |r| until then. 195| 38.2k| int r_is_one = 1; 196| 38.2k| int wstart = bits - 1; // The top bit of the window. 197| 656k| for (;;) { 198| 656k| if (!BN_is_bit_set(p, wstart)) { ------------------ | Branch (198:9): [True: 552k, False: 103k] ------------------ 199| 552k| if (!r_is_one && !BN_mod_mul_montgomery(r, r, r, mont, ctx)) { ------------------ | Branch (199:11): [True: 552k, False: 0] | Branch (199:24): [True: 0, False: 552k] ------------------ 200| 0| return 0; 201| 0| } 202| 552k| if (wstart == 0) { ------------------ | Branch (202:11): [True: 0, False: 552k] ------------------ 203| 0| break; 204| 0| } 205| 552k| wstart--; 206| 552k| continue; 207| 552k| } 208| | 209| | // We now have wstart on a set bit. Find the largest window we can use. 210| 103k| int wvalue = 1; 211| 103k| int wsize = 0; 212| 103k| for (int i = 1; i < window && i <= wstart; i++) { ------------------ | Branch (212:21): [True: 0, False: 103k] | Branch (212:35): [True: 0, False: 0] ------------------ 213| 0| if (BN_is_bit_set(p, wstart - i)) { ------------------ | Branch (213:11): [True: 0, False: 0] ------------------ 214| 0| wvalue <<= (i - wsize); 215| 0| wvalue |= 1; 216| 0| wsize = i; 217| 0| } 218| 0| } 219| | 220| | // Shift |r| to the end of the window. 221| 103k| if (!r_is_one) { ------------------ | Branch (221:9): [True: 65.1k, False: 38.2k] ------------------ 222| 130k| for (int i = 0; i < wsize + 1; i++) { ------------------ | Branch (222:23): [True: 65.1k, False: 65.1k] ------------------ 223| 65.1k| if (!BN_mod_mul_montgomery(r, r, r, mont, ctx)) { ------------------ | Branch (223:13): [True: 0, False: 65.1k] ------------------ 224| 0| return 0; 225| 0| } 226| 65.1k| } 227| 65.1k| } 228| | 229| 103k| assert(wvalue & 1); 230| 103k| assert(wvalue < (1 << window)); 231| 103k| if (r_is_one) { ------------------ | Branch (231:9): [True: 38.2k, False: 65.1k] ------------------ 232| 38.2k| if (!BN_copy(r, val[wvalue >> 1])) { ------------------ | Branch (232:11): [True: 0, False: 38.2k] ------------------ 233| 0| return 0; 234| 0| } 235| 65.1k| } else if (!BN_mod_mul_montgomery(r, r, val[wvalue >> 1], mont, ctx)) { ------------------ | Branch (235:16): [True: 0, False: 65.1k] ------------------ 236| 0| return 0; 237| 0| } 238| | 239| 103k| r_is_one = 0; 240| 103k| if (wstart == wsize) { ------------------ | Branch (240:9): [True: 38.2k, False: 65.1k] ------------------ 241| 38.2k| break; 242| 38.2k| } 243| 65.1k| wstart -= wsize + 1; 244| 65.1k| } 245| | 246| | // |p| is non-zero, so |r_is_one| must be cleared at some point. 247| 38.2k| assert(!r_is_one); 248| | 249| 38.2k| return BN_from_montgomery(rr, r, mont, ctx); 250| 38.2k|} bn_mod_exp_mont_small: 254| 59.8k| const BN_MONT_CTX *mont) { 255| 59.8k| if (num != (size_t)mont->N.width || num > BN_SMALL_MAX_WORDS || ------------------ | | 642| 119k|#define BN_SMALL_MAX_WORDS 9 ------------------ | Branch (255:7): [True: 0, False: 59.8k] | Branch (255:39): [True: 0, False: 59.8k] ------------------ 256| 59.8k| num_p > SIZE_MAX / BN_BITS2) { ------------------ | | 42| 59.8k|#define BN_BITS2 64 ------------------ | Branch (256:7): [True: 0, False: 59.8k] ------------------ 257| 0| abort(); 258| 0| } 259| 59.8k| assert(BN_is_odd(&mont->N)); 260| | 261| | // Count the number of bits in |p|, skipping leading zeros. Note this function 262| | // treats |p| as public. 263| 59.8k| while (num_p != 0 && p[num_p - 1] == 0) { ------------------ | Branch (263:10): [True: 59.8k, False: 0] | Branch (263:24): [True: 0, False: 59.8k] ------------------ 264| 0| num_p--; 265| 0| } 266| 59.8k| if (num_p == 0) { ------------------ | Branch (266:7): [True: 0, False: 59.8k] ------------------ 267| 0| bn_from_montgomery_small(r, num, mont->RR.d, num, mont); 268| 0| return; 269| 0| } 270| 59.8k| size_t bits = BN_num_bits_word(p[num_p - 1]) + (num_p - 1) * BN_BITS2; ------------------ | | 42| 59.8k|#define BN_BITS2 64 ------------------ 271| 59.8k| assert(bits != 0); 272| | 273| | // We exponentiate by looking at sliding windows of the exponent and 274| | // precomputing powers of |a|. Windows may be shifted so they always end on a 275| | // set bit, so only precompute odd powers. We compute val[i] = a^(2*i + 1) for 276| | // i = 0 to 2^(window-1), all in Montgomery form. 277| 59.8k| unsigned window = BN_window_bits_for_exponent_size(bits); 278| 59.8k| if (window > TABLE_BITS_SMALL) { ------------------ | | 120| 59.8k|#define TABLE_BITS_SMALL 5 ------------------ | Branch (278:7): [True: 0, False: 59.8k] ------------------ 279| 0| window = TABLE_BITS_SMALL; // Tolerate excessively large |p|. ------------------ | | 120| 0|#define TABLE_BITS_SMALL 5 ------------------ 280| 0| } 281| 59.8k| BN_ULONG val[TABLE_SIZE_SMALL][BN_SMALL_MAX_WORDS]; 282| 59.8k| OPENSSL_memcpy(val[0], a, num * sizeof(BN_ULONG)); 283| 59.8k| if (window > 1) { ------------------ | Branch (283:7): [True: 59.8k, False: 0] ------------------ 284| 59.8k| BN_ULONG d[BN_SMALL_MAX_WORDS]; 285| 59.8k| bn_mod_mul_montgomery_small(d, val[0], val[0], num, mont); 286| 957k| for (unsigned i = 1; i < 1u << (window - 1); i++) { ------------------ | Branch (286:26): [True: 897k, False: 59.8k] ------------------ 287| 897k| bn_mod_mul_montgomery_small(val[i], val[i - 1], d, num, mont); 288| 897k| } 289| 59.8k| } 290| | 291| | // |p| is non-zero, so at least one window is non-zero. To save some 292| | // multiplications, defer initializing |r| until then. 293| 59.8k| int r_is_one = 1; 294| 59.8k| size_t wstart = bits - 1; // The top bit of the window. 295| 7.83M| for (;;) { 296| 7.83M| if (!bn_is_bit_set_words(p, num_p, wstart)) { ------------------ | Branch (296:9): [True: 3.94M, False: 3.89M] ------------------ 297| 3.94M| if (!r_is_one) { ------------------ | Branch (297:11): [True: 3.94M, False: 0] ------------------ 298| 3.94M| bn_mod_mul_montgomery_small(r, r, r, num, mont); 299| 3.94M| } 300| 3.94M| if (wstart == 0) { ------------------ | Branch (300:11): [True: 0, False: 3.94M] ------------------ 301| 0| break; 302| 0| } 303| 3.94M| wstart--; 304| 3.94M| continue; 305| 3.94M| } 306| | 307| | // We now have wstart on a set bit. Find the largest window we can use. 308| 3.89M| unsigned wvalue = 1; 309| 3.89M| unsigned wsize = 0; 310| 19.2M| for (unsigned i = 1; i < window && i <= wstart; i++) { ------------------ | Branch (310:26): [True: 15.3M, False: 3.83M] | Branch (310:40): [True: 15.3M, False: 59.8k] ------------------ 311| 15.3M| if (bn_is_bit_set_words(p, num_p, wstart - i)) { ------------------ | Branch (311:11): [True: 15.1M, False: 214k] ------------------ 312| 15.1M| wvalue <<= (i - wsize); 313| 15.1M| wvalue |= 1; 314| 15.1M| wsize = i; 315| 15.1M| } 316| 15.3M| } 317| | 318| | // Shift |r| to the end of the window. 319| 3.89M| if (!r_is_one) { ------------------ | Branch (319:9): [True: 3.83M, False: 59.8k] ------------------ 320| 22.5M| for (unsigned i = 0; i < wsize + 1; i++) { ------------------ | Branch (320:28): [True: 18.7M, False: 3.83M] ------------------ 321| 18.7M| bn_mod_mul_montgomery_small(r, r, r, num, mont); 322| 18.7M| } 323| 3.83M| } 324| | 325| 3.89M| assert(wvalue & 1); 326| 3.89M| assert(wvalue < (1u << window)); 327| 3.89M| if (r_is_one) { ------------------ | Branch (327:9): [True: 59.8k, False: 3.83M] ------------------ 328| 59.8k| OPENSSL_memcpy(r, val[wvalue >> 1], num * sizeof(BN_ULONG)); 329| 3.83M| } else { 330| 3.83M| bn_mod_mul_montgomery_small(r, r, val[wvalue >> 1], num, mont); 331| 3.83M| } 332| 3.89M| r_is_one = 0; 333| 3.89M| if (wstart == wsize) { ------------------ | Branch (333:9): [True: 59.8k, False: 3.83M] ------------------ 334| 59.8k| break; 335| 59.8k| } 336| 3.83M| wstart -= wsize + 1; 337| 3.83M| } 338| | 339| | // |p| is non-zero, so |r_is_one| must be cleared at some point. 340| 59.8k| assert(!r_is_one); 341| 59.8k| OPENSSL_cleanse(val, sizeof(val)); 342| 59.8k|} bn_mod_inverse0_prime_mont_small: 345| 59.8k| size_t num, const BN_MONT_CTX *mont) { 346| 59.8k| if (num != (size_t)mont->N.width || num > BN_SMALL_MAX_WORDS) { ------------------ | | 642| 59.8k|#define BN_SMALL_MAX_WORDS 9 ------------------ | Branch (346:7): [True: 0, False: 59.8k] | Branch (346:39): [True: 0, False: 59.8k] ------------------ 347| 0| abort(); 348| 0| } 349| | 350| | // Per Fermat's Little Theorem, a^-1 = a^(p-2) (mod p) for p prime. 351| 59.8k| BN_ULONG p_minus_two[BN_SMALL_MAX_WORDS]; 352| 59.8k| const BN_ULONG *p = mont->N.d; 353| 59.8k| OPENSSL_memcpy(p_minus_two, p, num * sizeof(BN_ULONG)); 354| 59.8k| if (p_minus_two[0] >= 2) { ------------------ | Branch (354:7): [True: 59.8k, False: 0] ------------------ 355| 59.8k| p_minus_two[0] -= 2; 356| 59.8k| } else { 357| 0| p_minus_two[0] -= 2; 358| 0| for (size_t i = 1; i < num; i++) { ------------------ | Branch (358:24): [True: 0, False: 0] ------------------ 359| 0| if (p_minus_two[i]-- != 0) { ------------------ | Branch (359:11): [True: 0, False: 0] ------------------ 360| 0| break; 361| 0| } 362| 0| } 363| 0| } 364| | 365| 59.8k| bn_mod_exp_mont_small(r, a, num, p_minus_two, num, mont); 366| 59.8k|} BN_mod_exp_mont_consttime: 414| 56.0k| const BN_MONT_CTX *mont) { 415| 56.0k| int i, ret = 0, wvalue; 416| | 417| 56.0k| void *powerbuf_free = NULL; 418| 56.0k| size_t powerbuf_len = 0; 419| 56.0k| BN_ULONG *powerbuf = NULL; 420| | 421| 56.0k| if (!BN_is_odd(m)) { ------------------ | Branch (421:7): [True: 0, False: 56.0k] ------------------ 422| 0| OPENSSL_PUT_ERROR(BN, BN_R_CALLED_WITH_EVEN_MODULUS); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 423| 0| return 0; 424| 0| } 425| 56.0k| if (m->neg) { ------------------ | Branch (425:7): [True: 0, False: 56.0k] ------------------ 426| 0| OPENSSL_PUT_ERROR(BN, BN_R_NEGATIVE_NUMBER); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 427| 0| return 0; 428| 0| } 429| | // |a| is secret, but it is required to be in range, so these comparisons may 430| | // be leaked. 431| 56.0k| if (a->neg || constant_time_declassify_int(BN_ucmp(a, m) >= 0)) { ------------------ | Branch (431:7): [True: 0, False: 56.0k] | Branch (431:17): [True: 0, False: 56.0k] ------------------ 432| 0| OPENSSL_PUT_ERROR(BN, BN_R_INPUT_NOT_REDUCED); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 433| 0| return 0; 434| 0| } 435| | 436| | // Use all bits stored in |p|, rather than |BN_num_bits|, so we do not leak 437| | // whether the top bits are zero. 438| 56.0k| int max_bits = p->width * BN_BITS2; ------------------ | | 42| 56.0k|#define BN_BITS2 64 ------------------ 439| 56.0k| int bits = max_bits; 440| 56.0k| if (bits == 0) { ------------------ | Branch (440:7): [True: 0, False: 56.0k] ------------------ 441| | // x**0 mod 1 is still zero. 442| 0| if (BN_abs_is_word(m, 1)) { ------------------ | Branch (442:9): [True: 0, False: 0] ------------------ 443| 0| BN_zero(rr); 444| 0| return 1; 445| 0| } 446| 0| return BN_one(rr); 447| 0| } 448| | 449| | // Allocate a montgomery context if it was not supplied by the caller. 450| 56.0k| int top, num_powers, window; 451| 56.0k| bssl::UniquePtr new_mont; 452| 56.0k| if (mont == nullptr) { ------------------ | Branch (452:7): [True: 0, False: 56.0k] ------------------ 453| 0| new_mont.reset(BN_MONT_CTX_new_consttime(m, ctx)); 454| 0| if (new_mont == nullptr) { ------------------ | Branch (454:9): [True: 0, False: 0] ------------------ 455| 0| goto err; 456| 0| } 457| 0| mont = new_mont.get(); 458| 0| } 459| | 460| | // Use the width in |mont->N|, rather than the copy in |m|. The assembly 461| | // implementation assumes it can use |top| to size R. 462| 56.0k| top = mont->N.width; 463| | 464| 56.0k|#if defined(OPENSSL_BN_ASM_MONT5) || defined(RSAZ_ENABLED) 465| | // Share one large stack-allocated buffer between the RSAZ and non-RSAZ code 466| | // paths. If we were to use separate static buffers for each then there is 467| | // some chance that both large buffers would be allocated on the stack, 468| | // causing the stack space requirement to be truly huge (~10KB). 469| 56.0k| alignas(MOD_EXP_CTIME_ALIGN) BN_ULONG storage[MOD_EXP_CTIME_STORAGE_LEN]; 470| 56.0k|#endif 471| 56.0k|#if defined(RSAZ_ENABLED) 472| | // If the size of the operands allow it, perform the optimized RSAZ 473| | // exponentiation. For further information see crypto/fipsmodule/bn/rsaz_exp.c 474| | // and accompanying assembly modules. 475| 56.0k| if (a->width == 16 && p->width == 16 && BN_num_bits(m) == 1024 && ------------------ | Branch (475:7): [True: 56.0k, False: 0] | Branch (475:25): [True: 56.0k, False: 0] | Branch (475:43): [True: 56.0k, False: 0] ------------------ 476| 56.0k| rsaz_avx2_preferred()) { ------------------ | Branch (476:7): [True: 0, False: 56.0k] ------------------ 477| 0| if (!bn_wexpand(rr, 16)) { ------------------ | Branch (477:9): [True: 0, False: 0] ------------------ 478| 0| goto err; 479| 0| } 480| 0| RSAZ_1024_mod_exp_avx2(rr->d, a->d, p->d, m->d, mont->RR.d, mont->n0[0], 481| 0| storage); 482| 0| rr->width = 16; 483| 0| rr->neg = 0; 484| 0| ret = 1; 485| 0| goto err; 486| 0| } 487| 56.0k|#endif 488| | 489| | // Get the window size to use with size of p. 490| 56.0k| window = BN_window_bits_for_ctime_exponent_size(bits); ------------------ | | 405| 56.0k| ((b) > 937 ? 6 : (b) > 306 ? 5 : (b) > 89 ? 4 : (b) > 22 ? 3 : 1) | | ------------------ | | | Branch (405:4): [True: 56.0k, False: 0] | | | Branch (405:20): [True: 0, False: 0] | | | Branch (405:36): [True: 0, False: 0] | | | Branch (405:51): [True: 0, False: 0] | | ------------------ ------------------ 491| 56.0k| assert(window <= BN_MAX_MOD_EXP_CTIME_WINDOW); 492| | 493| | // Calculating |powerbuf_len| below cannot overflow because of the bound on 494| | // Montgomery reduction. 495| 56.0k| assert((size_t)top <= BN_MONTGOMERY_MAX_WORDS); 496| 56.0k| static_assert( 497| 56.0k| BN_MONTGOMERY_MAX_WORDS <= 498| 56.0k| INT_MAX / sizeof(BN_ULONG) / ((1 << BN_MAX_MOD_EXP_CTIME_WINDOW) + 3), 499| 56.0k| "powerbuf_len may overflow"); 500| | 501| 56.0k|#if defined(OPENSSL_BN_ASM_MONT5) 502| 56.0k| if (window >= 5) { ------------------ | Branch (502:7): [True: 56.0k, False: 0] ------------------ 503| 56.0k| window = 5; // ~5% improvement for RSA2048 sign, and even for RSA4096 504| | // Reserve space for the |mont->N| copy. 505| 56.0k| powerbuf_len += top * sizeof(mont->N.d[0]); 506| 56.0k| } 507| 56.0k|#endif 508| | 509| | // Allocate a buffer large enough to hold all of the pre-computed 510| | // powers of |am|, |am| itself, and |tmp|. 511| 56.0k| num_powers = 1 << window; 512| 56.0k| powerbuf_len += sizeof(m->d[0]) * top * (num_powers + 2); 513| | 514| 56.0k|#if defined(OPENSSL_BN_ASM_MONT5) 515| 56.0k| if (powerbuf_len <= sizeof(storage)) { ------------------ | Branch (515:7): [True: 56.0k, False: 0] ------------------ 516| 56.0k| powerbuf = storage; 517| 56.0k| } 518| | // |storage| is more than large enough to handle 1024-bit inputs. 519| 56.0k| assert(powerbuf != NULL || top * BN_BITS2 > 1024); 520| 56.0k|#endif 521| 56.0k| if (powerbuf == NULL) { ------------------ | Branch (521:7): [True: 0, False: 56.0k] ------------------ 522| 0| powerbuf_free = OPENSSL_malloc(powerbuf_len + MOD_EXP_CTIME_ALIGN); ------------------ | | 93| 0|#define MOD_EXP_CTIME_ALIGN 64 ------------------ 523| 0| if (powerbuf_free == NULL) { ------------------ | Branch (523:9): [True: 0, False: 0] ------------------ 524| 0| goto err; 525| 0| } 526| 0| powerbuf = reinterpret_cast( 527| 0| align_pointer(powerbuf_free, MOD_EXP_CTIME_ALIGN)); ------------------ | | 93| 0|#define MOD_EXP_CTIME_ALIGN 64 ------------------ 528| 0| } 529| 56.0k| OPENSSL_memset(powerbuf, 0, powerbuf_len); 530| | 531| | // Place |tmp| and |am| right after powers table. 532| 56.0k| BIGNUM tmp, am; 533| 56.0k| tmp.d = powerbuf + top * num_powers; 534| 56.0k| am.d = tmp.d + top; 535| 56.0k| tmp.width = am.width = 0; 536| 56.0k| tmp.dmax = am.dmax = top; 537| 56.0k| tmp.neg = am.neg = 0; 538| 56.0k| tmp.flags = am.flags = BN_FLG_STATIC_DATA; ------------------ | | 933| 56.0k|#define BN_FLG_STATIC_DATA 0x02 ------------------ 539| | 540| 56.0k| if (!bn_one_to_montgomery(&tmp, mont, ctx) || !bn_resize_words(&tmp, top)) { ------------------ | Branch (540:7): [True: 0, False: 56.0k] | Branch (540:49): [True: 0, False: 56.0k] ------------------ 541| 0| goto err; 542| 0| } 543| | 544| | // Prepare a^1 in the Montgomery domain. 545| 56.0k| assert(!a->neg); 546| 56.0k| declassify_assert(BN_ucmp(a, m) < 0); ------------------ | | 493| 56.0k|#define declassify_assert(expr) assert(constant_time_declassify_int(expr)) ------------------ 547| 56.0k| if (!BN_to_montgomery(&am, a, mont, ctx) || !bn_resize_words(&am, top)) { ------------------ | Branch (547:7): [True: 0, False: 56.0k] | Branch (547:47): [True: 0, False: 56.0k] ------------------ 548| 0| goto err; 549| 0| } 550| | 551| 56.0k|#if defined(OPENSSL_BN_ASM_MONT5) 552| | // This optimization uses ideas from https://eprint.iacr.org/2011/239, 553| | // specifically optimization of cache-timing attack countermeasures, 554| | // pre-computation optimization, and Almost Montgomery Multiplication. 555| | // 556| | // The paper discusses a 4-bit window to optimize 512-bit modular 557| | // exponentiation, used in RSA-1024 with CRT, but RSA-1024 is no longer 558| | // important. 559| | // 560| | // |bn_mul_mont_gather5| and |bn_power5| implement the "almost" reduction 561| | // variant, so the values here may not be fully reduced. They are bounded by R 562| | // (i.e. they fit in |top| words), not |m|. Additionally, we pass these 563| | // "almost" reduced inputs into |bn_mul_mont|, which implements the normal 564| | // reduction variant. Given those inputs, |bn_mul_mont| may not give reduced 565| | // output, but it will still produce "almost" reduced output. 566| | // 567| | // TODO(davidben): Using "almost" reduction complicates analysis of this code, 568| | // and its interaction with other parts of the project. Determine whether this 569| | // is actually necessary for performance. 570| 56.0k| if (window == 5 && top > 1) { ------------------ | Branch (570:7): [True: 56.0k, False: 0] | Branch (570:22): [True: 56.0k, False: 0] ------------------ 571| | // Copy |mont->N| to improve cache locality. 572| 56.0k| BN_ULONG *np = am.d + top; 573| 952k| for (i = 0; i < top; i++) { ------------------ | Branch (573:17): [True: 896k, False: 56.0k] ------------------ 574| 896k| np[i] = mont->N.d[i]; 575| 896k| } 576| | 577| | // Fill |powerbuf| with the first 32 powers of |am|. 578| 56.0k| const BN_ULONG *n0 = mont->n0; 579| 56.0k| bn_scatter5(tmp.d, top, powerbuf, 0); 580| 56.0k| bn_scatter5(am.d, am.width, powerbuf, 1); 581| 56.0k| bn_mul_mont(tmp.d, am.d, am.d, np, n0, top); 582| 56.0k| bn_scatter5(tmp.d, top, powerbuf, 2); 583| | 584| | // Square to compute powers of two. 585| 224k| for (i = 4; i < 32; i *= 2) { ------------------ | Branch (585:17): [True: 168k, False: 56.0k] ------------------ 586| 168k| bn_mul_mont(tmp.d, tmp.d, tmp.d, np, n0, top); 587| 168k| bn_scatter5(tmp.d, top, powerbuf, i); 588| 168k| } 589| | // Compute odd powers |i| based on |i - 1|, then all powers |i * 2^j|. 590| 896k| for (i = 3; i < 32; i += 2) { ------------------ | Branch (590:17): [True: 840k, False: 56.0k] ------------------ 591| 840k| bn_mul_mont_gather5(tmp.d, am.d, powerbuf, np, n0, top, i - 1); 592| 840k| bn_scatter5(tmp.d, top, powerbuf, i); 593| 1.45M| for (int j = 2 * i; j < 32; j *= 2) { ------------------ | Branch (593:27): [True: 616k, False: 840k] ------------------ 594| 616k| bn_mul_mont(tmp.d, tmp.d, tmp.d, np, n0, top); 595| 616k| bn_scatter5(tmp.d, top, powerbuf, j); 596| 616k| } 597| 840k| } 598| | 599| 56.0k| bits--; 600| 280k| for (wvalue = 0, i = bits % 5; i >= 0; i--, bits--) { ------------------ | Branch (600:36): [True: 224k, False: 56.0k] ------------------ 601| 224k| wvalue = (wvalue << 1) + BN_is_bit_set(p, bits); 602| 224k| } 603| 56.0k| bn_gather5(tmp.d, top, powerbuf, wvalue); 604| | 605| | // At this point |bits| is 4 mod 5 and at least -1. (|bits| is the first bit 606| | // that has not been read yet.) 607| 56.0k| assert(bits >= -1 && (bits == -1 || bits % 5 == 4)); 608| | 609| | // Scan the exponent one window at a time starting from the most 610| | // significant bits. 611| 56.0k| if (!bn_power5_capable(top)) { ------------------ | Branch (611:9): [True: 0, False: 56.0k] ------------------ 612| 0| while (bits >= 0) { ------------------ | Branch (612:14): [True: 0, False: 0] ------------------ 613| 0| for (wvalue = 0, i = 0; i < 5; i++, bits--) { ------------------ | Branch (613:33): [True: 0, False: 0] ------------------ 614| 0| wvalue = (wvalue << 1) + BN_is_bit_set(p, bits); 615| 0| } 616| | 617| 0| bn_mul_mont(tmp.d, tmp.d, tmp.d, np, n0, top); 618| 0| bn_mul_mont(tmp.d, tmp.d, tmp.d, np, n0, top); 619| 0| bn_mul_mont(tmp.d, tmp.d, tmp.d, np, n0, top); 620| 0| bn_mul_mont(tmp.d, tmp.d, tmp.d, np, n0, top); 621| 0| bn_mul_mont(tmp.d, tmp.d, tmp.d, np, n0, top); 622| 0| bn_mul_mont_gather5(tmp.d, tmp.d, powerbuf, np, n0, top, wvalue); 623| 0| } 624| 56.0k| } else { 625| 56.0k| const uint8_t *p_bytes = (const uint8_t *)p->d; 626| 56.0k| assert(bits < max_bits); 627| | // |p = 0| has been handled as a special case, so |max_bits| is at least 628| | // one word. 629| 56.0k| assert(max_bits >= 64); 630| | 631| | // If the first bit to be read lands in the last byte, unroll the first 632| | // iteration to avoid reading past the bounds of |p->d|. (After the first 633| | // iteration, we are guaranteed to be past the last byte.) Note |bits| 634| | // here is the top bit, inclusive. 635| 56.0k| if (bits - 4 >= max_bits - 8) { ------------------ | Branch (635:11): [True: 0, False: 56.0k] ------------------ 636| | // Read five bits from |bits-4| through |bits|, inclusive. 637| 0| wvalue = p_bytes[p->width * BN_BYTES - 1]; ------------------ | | 44| 0|#define BN_BYTES 8 ------------------ 638| 0| wvalue >>= (bits - 4) & 7; 639| 0| wvalue &= 0x1f; 640| 0| bits -= 5; 641| 0| bn_power5(tmp.d, tmp.d, powerbuf, np, n0, top, wvalue); 642| 0| } 643| 11.4M| while (bits >= 0) { ------------------ | Branch (643:14): [True: 11.4M, False: 56.0k] ------------------ 644| | // Read five bits from |bits-4| through |bits|, inclusive. 645| 11.4M| int first_bit = bits - 4; 646| 11.4M| uint16_t val; 647| 11.4M| OPENSSL_memcpy(&val, p_bytes + (first_bit >> 3), sizeof(val)); 648| 11.4M| val >>= first_bit & 7; 649| 11.4M| val &= 0x1f; 650| 11.4M| bits -= 5; 651| 11.4M| bn_power5(tmp.d, tmp.d, powerbuf, np, n0, top, val); 652| 11.4M| } 653| 56.0k| } 654| | // The result is now in |tmp| in Montgomery form, but it may not be fully 655| | // reduced. This is within bounds for |BN_from_montgomery| (tmp < R <= m*R) 656| | // so it will, when converting from Montgomery form, produce a fully reduced 657| | // result. 658| | // 659| | // This differs from Figure 2 of the paper, which uses AMM(h, 1) to convert 660| | // from Montgomery form with unreduced output, followed by an extra 661| | // reduction step. In the paper's terminology, we replace steps 9 and 10 662| | // with MM(h, 1). 663| 56.0k| } else 664| 0|#endif 665| 0| { 666| 0| copy_to_prebuf(&tmp, top, powerbuf, 0, window); 667| 0| copy_to_prebuf(&am, top, powerbuf, 1, window); 668| | 669| | // If the window size is greater than 1, then calculate 670| | // val[i=2..2^winsize-1]. Powers are computed as a*a^(i-1) 671| | // (even powers could instead be computed as (a^(i/2))^2 672| | // to use the slight performance advantage of sqr over mul). 673| 0| if (window > 1) { ------------------ | Branch (673:9): [True: 0, False: 0] ------------------ 674| 0| if (!BN_mod_mul_montgomery(&tmp, &am, &am, mont, ctx)) { ------------------ | Branch (674:11): [True: 0, False: 0] ------------------ 675| 0| goto err; 676| 0| } 677| | 678| 0| copy_to_prebuf(&tmp, top, powerbuf, 2, window); 679| | 680| 0| for (i = 3; i < num_powers; i++) { ------------------ | Branch (680:19): [True: 0, False: 0] ------------------ 681| | // Calculate a^i = a^(i-1) * a 682| 0| if (!BN_mod_mul_montgomery(&tmp, &am, &tmp, mont, ctx)) { ------------------ | Branch (682:13): [True: 0, False: 0] ------------------ 683| 0| goto err; 684| 0| } 685| | 686| 0| copy_to_prebuf(&tmp, top, powerbuf, i, window); 687| 0| } 688| 0| } 689| | 690| 0| bits--; 691| 0| for (wvalue = 0, i = bits % window; i >= 0; i--, bits--) { ------------------ | Branch (691:41): [True: 0, False: 0] ------------------ 692| 0| wvalue = (wvalue << 1) + BN_is_bit_set(p, bits); 693| 0| } 694| 0| if (!copy_from_prebuf(&tmp, top, powerbuf, wvalue, window)) { ------------------ | Branch (694:9): [True: 0, False: 0] ------------------ 695| 0| goto err; 696| 0| } 697| | 698| | // Scan the exponent one window at a time starting from the most 699| | // significant bits. 700| 0| while (bits >= 0) { ------------------ | Branch (700:12): [True: 0, False: 0] ------------------ 701| 0| wvalue = 0; // The 'value' of the window 702| | 703| | // Scan the window, squaring the result as we go 704| 0| for (i = 0; i < window; i++, bits--) { ------------------ | Branch (704:19): [True: 0, False: 0] ------------------ 705| 0| if (!BN_mod_mul_montgomery(&tmp, &tmp, &tmp, mont, ctx)) { ------------------ | Branch (705:13): [True: 0, False: 0] ------------------ 706| 0| goto err; 707| 0| } 708| 0| wvalue = (wvalue << 1) + BN_is_bit_set(p, bits); 709| 0| } 710| | 711| | // Fetch the appropriate pre-computed value from the pre-buf 712| 0| if (!copy_from_prebuf(&am, top, powerbuf, wvalue, window)) { ------------------ | Branch (712:11): [True: 0, False: 0] ------------------ 713| 0| goto err; 714| 0| } 715| | 716| | // Multiply the result into the intermediate result 717| 0| if (!BN_mod_mul_montgomery(&tmp, &tmp, &am, mont, ctx)) { ------------------ | Branch (717:11): [True: 0, False: 0] ------------------ 718| 0| goto err; 719| 0| } 720| 0| } 721| 0| } 722| | 723| | // Convert the final result from Montgomery to standard format. If we used the 724| | // |OPENSSL_BN_ASM_MONT5| codepath, |tmp| may not be fully reduced. It is only 725| | // bounded by R rather than |m|. However, that is still within bounds for 726| | // |BN_from_montgomery|, which implements full Montgomery reduction, not 727| | // "almost" Montgomery reduction. 728| 56.0k| if (!BN_from_montgomery(rr, &tmp, mont, ctx)) { ------------------ | Branch (728:7): [True: 0, False: 56.0k] ------------------ 729| 0| goto err; 730| 0| } 731| 56.0k| ret = 1; 732| | 733| 56.0k|err: 734| 56.0k| if (powerbuf != NULL && powerbuf_free == NULL) { ------------------ | Branch (734:7): [True: 56.0k, False: 0] | Branch (734:27): [True: 56.0k, False: 0] ------------------ 735| 56.0k| OPENSSL_cleanse(powerbuf, powerbuf_len); 736| 56.0k| } 737| 56.0k| OPENSSL_free(powerbuf_free); 738| 56.0k| return ret; 739| 56.0k|} bcm.cc:_ZL32BN_window_bits_for_exponent_sizem: 96| 98.1k|static int BN_window_bits_for_exponent_size(size_t b) { 97| 98.1k| if (b > 671) { ------------------ | Branch (97:7): [True: 0, False: 98.1k] ------------------ 98| 0| return 6; 99| 0| } 100| 98.1k| if (b > 239) { ------------------ | Branch (100:7): [True: 59.8k, False: 38.2k] ------------------ 101| 59.8k| return 5; 102| 59.8k| } 103| 38.2k| if (b > 79) { ------------------ | Branch (103:7): [True: 0, False: 38.2k] ------------------ 104| 0| return 4; 105| 0| } 106| 38.2k| if (b > 23) { ------------------ | Branch (106:7): [True: 0, False: 38.2k] ------------------ 107| 0| return 3; 108| 0| } 109| 38.2k| return 1; 110| 38.2k|} bcm.cc:_ZL19bn_mul_mont_gather5PmPKmS1_S1_S1_ii: 41| 840k| const BN_ULONG *n0, int num, int power) { 42| 840k| if (bn_mulx4x_mont_gather5_capable(num)) { ------------------ | Branch (42:7): [True: 840k, False: 0] ------------------ 43| 840k| bn_mulx4x_mont_gather5(rp, ap, table, np, n0, num, power); 44| 840k| } else if (bn_mul4x_mont_gather5_capable(num)) { ------------------ | Branch (44:14): [True: 0, False: 0] ------------------ 45| 0| bn_mul4x_mont_gather5(rp, ap, table, np, n0, num, power); 46| 0| } else { 47| 0| bn_mul_mont_gather5_nohw(rp, ap, table, np, n0, num, power); 48| 0| } 49| 840k|} bcm.cc:_ZL9bn_power5PmPKmS1_S1_S1_ii: 62| 11.4M| int power) { 63| 11.4M| assert(bn_power5_capable(num)); 64| 11.4M| if (bn_powerx5_capable(num)) { ------------------ | Branch (64:7): [True: 11.4M, False: 0] ------------------ 65| 11.4M| bn_powerx5(rp, ap, table, np, n0, num, power); 66| 11.4M| } else { 67| 0| bn_power5_nohw(rp, ap, table, np, n0, num, power); 68| 0| } 69| 11.4M|} BN_mod_inverse_odd: 23| 876| const BIGNUM *n, BN_CTX *ctx) { 24| 876| *out_no_inverse = 0; 25| | 26| 876| if (!BN_is_odd(n)) { ------------------ | Branch (26:7): [True: 0, False: 876] ------------------ 27| 0| OPENSSL_PUT_ERROR(BN, BN_R_CALLED_WITH_EVEN_MODULUS); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 28| 0| return 0; 29| 0| } 30| | 31| 876| if (BN_is_negative(a) || BN_cmp(a, n) >= 0) { ------------------ | Branch (31:7): [True: 0, False: 876] | Branch (31:28): [True: 0, False: 876] ------------------ 32| 0| OPENSSL_PUT_ERROR(BN, BN_R_INPUT_NOT_REDUCED); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 33| 0| return 0; 34| 0| } 35| | 36| 876| int sign; 37| 876| bssl::BN_CTXScope scope(ctx); 38| 876| BIGNUM *A = BN_CTX_get(ctx); 39| 876| BIGNUM *B = BN_CTX_get(ctx); 40| 876| BIGNUM *X = BN_CTX_get(ctx); 41| 876| BIGNUM *Y = BN_CTX_get(ctx); 42| 876| BIGNUM *R = out; 43| 876| if (Y == NULL) { ------------------ | Branch (43:7): [True: 0, False: 876] ------------------ 44| 0| return 0; 45| 0| } 46| | 47| 876| BN_zero(Y); 48| 876| if (!BN_one(X) || BN_copy(B, a) == NULL || BN_copy(A, n) == NULL) { ------------------ | Branch (48:7): [True: 0, False: 876] | Branch (48:21): [True: 0, False: 876] | Branch (48:46): [True: 0, False: 876] ------------------ 49| 0| return 0; 50| 0| } 51| 876| A->neg = 0; 52| 876| sign = -1; 53| | // From B = a mod |n|, A = |n| it follows that 54| | // 55| | // 0 <= B < A, 56| | // -sign*X*a == B (mod |n|), 57| | // sign*Y*a == A (mod |n|). 58| | 59| | // Binary inversion algorithm; requires odd modulus. This is faster than the 60| | // general algorithm if the modulus is sufficiently small (about 400 .. 500 61| | // bits on 32-bit systems, but much more on 64-bit systems) 62| 876| int shift; 63| | 64| 1.26M| while (!BN_is_zero(B)) { ------------------ | Branch (64:10): [True: 1.26M, False: 876] ------------------ 65| | // 0 < B < |n|, 66| | // 0 < A <= |n|, 67| | // (1) -sign*X*a == B (mod |n|), 68| | // (2) sign*Y*a == A (mod |n|) 69| | 70| | // Now divide B by the maximum possible power of two in the integers, 71| | // and divide X by the same value mod |n|. 72| | // When we're done, (1) still holds. 73| 1.26M| shift = 0; 74| 2.53M| while (!BN_is_bit_set(B, shift)) { ------------------ | Branch (74:12): [True: 1.26M, False: 1.26M] ------------------ 75| | // note that 0 < B 76| 1.26M| shift++; 77| | 78| 1.26M| if (BN_is_odd(X)) { ------------------ | Branch (78:11): [True: 632k, False: 631k] ------------------ 79| 632k| if (!BN_uadd(X, X, n)) { ------------------ | Branch (79:13): [True: 0, False: 632k] ------------------ 80| 0| return 0; 81| 0| } 82| 632k| } 83| | // now X is even, so we can easily divide it by two 84| 1.26M| if (!BN_rshift1(X, X)) { ------------------ | Branch (84:11): [True: 0, False: 1.26M] ------------------ 85| 0| return 0; 86| 0| } 87| 1.26M| } 88| 1.26M| if (shift > 0) { ------------------ | Branch (88:9): [True: 632k, False: 634k] ------------------ 89| 632k| if (!BN_rshift(B, B, shift)) { ------------------ | Branch (89:11): [True: 0, False: 632k] ------------------ 90| 0| return 0; 91| 0| } 92| 632k| } 93| | 94| | // Same for A and Y. Afterwards, (2) still holds. 95| 1.26M| shift = 0; 96| 2.53M| while (!BN_is_bit_set(A, shift)) { ------------------ | Branch (96:12): [True: 1.26M, False: 1.26M] ------------------ 97| | // note that 0 < A 98| 1.26M| shift++; 99| | 100| 1.26M| if (BN_is_odd(Y)) { ------------------ | Branch (100:11): [True: 633k, False: 633k] ------------------ 101| 633k| if (!BN_uadd(Y, Y, n)) { ------------------ | Branch (101:13): [True: 0, False: 633k] ------------------ 102| 0| return 0; 103| 0| } 104| 633k| } 105| | // now Y is even 106| 1.26M| if (!BN_rshift1(Y, Y)) { ------------------ | Branch (106:11): [True: 0, False: 1.26M] ------------------ 107| 0| return 0; 108| 0| } 109| 1.26M| } 110| 1.26M| if (shift > 0) { ------------------ | Branch (110:9): [True: 634k, False: 633k] ------------------ 111| 634k| if (!BN_rshift(A, A, shift)) { ------------------ | Branch (111:11): [True: 0, False: 634k] ------------------ 112| 0| return 0; 113| 0| } 114| 634k| } 115| | 116| | // We still have (1) and (2). 117| | // Both A and B are odd. 118| | // The following computations ensure that 119| | // 120| | // 0 <= B < |n|, 121| | // 0 < A < |n|, 122| | // (1) -sign*X*a == B (mod |n|), 123| | // (2) sign*Y*a == A (mod |n|), 124| | // 125| | // and that either A or B is even in the next iteration. 126| 1.26M| if (BN_ucmp(B, A) >= 0) { ------------------ | Branch (126:9): [True: 633k, False: 634k] ------------------ 127| | // -sign*(X + Y)*a == B - A (mod |n|) 128| 633k| if (!BN_uadd(X, X, Y)) { ------------------ | Branch (128:11): [True: 0, False: 633k] ------------------ 129| 0| return 0; 130| 0| } 131| | // NB: we could use BN_mod_add_quick(X, X, Y, n), but that 132| | // actually makes the algorithm slower 133| 633k| if (!BN_usub(B, B, A)) { ------------------ | Branch (133:11): [True: 0, False: 633k] ------------------ 134| 0| return 0; 135| 0| } 136| 634k| } else { 137| | // sign*(X + Y)*a == A - B (mod |n|) 138| 634k| if (!BN_uadd(Y, Y, X)) { ------------------ | Branch (138:11): [True: 0, False: 634k] ------------------ 139| 0| return 0; 140| 0| } 141| | // as above, BN_mod_add_quick(Y, Y, X, n) would slow things down 142| 634k| if (!BN_usub(A, A, B)) { ------------------ | Branch (142:11): [True: 0, False: 634k] ------------------ 143| 0| return 0; 144| 0| } 145| 634k| } 146| 1.26M| } 147| | 148| 876| if (!BN_is_one(A)) { ------------------ | Branch (148:7): [True: 0, False: 876] ------------------ 149| 0| *out_no_inverse = 1; 150| 0| OPENSSL_PUT_ERROR(BN, BN_R_NO_INVERSE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 151| 0| return 0; 152| 0| } 153| | 154| | // The while loop (Euclid's algorithm) ends when 155| | // A == gcd(a,n); 156| | // we have 157| | // sign*Y*a == A (mod |n|), 158| | // where Y is non-negative. 159| | 160| 876| if (sign < 0) { ------------------ | Branch (160:7): [True: 876, False: 0] ------------------ 161| 876| if (!BN_sub(Y, n, Y)) { ------------------ | Branch (161:9): [True: 0, False: 876] ------------------ 162| 0| return 0; 163| 0| } 164| 876| } 165| | // Now Y*a == A (mod |n|). 166| | 167| | // Y*a == 1 (mod |n|) 168| 876| if (Y->neg || BN_ucmp(Y, n) >= 0) { ------------------ | Branch (168:7): [True: 336, False: 540] | Branch (168:17): [True: 0, False: 540] ------------------ 169| 336| if (!BN_nnmod(Y, Y, n, ctx)) { ------------------ | Branch (169:9): [True: 0, False: 336] ------------------ 170| 0| return 0; 171| 0| } 172| 336| } 173| 876| if (!BN_copy(R, Y)) { ------------------ | Branch (173:7): [True: 0, False: 876] ------------------ 174| 0| return 0; 175| 0| } 176| | 177| 876| return 1; 178| 876|} BN_mod_inverse_blinded: 217| 876| const BN_MONT_CTX *mont, BN_CTX *ctx) { 218| 876| *out_no_inverse = 0; 219| | 220| | // |a| is secret, but it is required to be in range, so these comparisons may 221| | // be leaked. 222| 876| if (BN_is_negative(a) || ------------------ | Branch (222:7): [True: 0, False: 876] ------------------ 223| 876| constant_time_declassify_int(BN_cmp(a, &mont->N) >= 0)) { ------------------ | Branch (223:7): [True: 0, False: 876] ------------------ 224| 0| OPENSSL_PUT_ERROR(BN, BN_R_INPUT_NOT_REDUCED); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 225| 0| return 0; 226| 0| } 227| | 228| 876| bssl::UniquePtr blinding_factor(BN_new()); 229| 876| if (blinding_factor == nullptr) { ------------------ | Branch (229:7): [True: 0, False: 876] ------------------ 230| 0| return 0; 231| 0| } 232| | 233| | // |BN_mod_inverse_odd| is leaky, so generate a secret blinding factor and 234| | // blind |a|. This works because (ar)^-1 * r = a^-1, supposing r is 235| | // invertible. If r is not invertible, this function will fail. However, we 236| | // only use this in RSA, where stumbling on an uninvertible element means 237| | // stumbling on the key's factorization. That is, if this function fails, the 238| | // RSA key was not actually a product of two large primes. 239| | // 240| | // TODO(crbug.com/boringssl/677): When the PRNG output is marked secret by 241| | // default, the explicit |bn_secret| call can be removed. 242| 876| if (!BN_rand_range_ex(blinding_factor.get(), 1, &mont->N)) { ------------------ | Branch (242:7): [True: 0, False: 876] ------------------ 243| 0| return 0; 244| 0| } 245| 876| bn_secret(blinding_factor.get()); 246| 876| if (!BN_mod_mul_montgomery(out, blinding_factor.get(), a, mont, ctx)) { ------------------ | Branch (246:7): [True: 0, False: 876] ------------------ 247| 0| return 0; 248| 0| } 249| | 250| | // Once blinded, |out| is no longer secret, so it may be passed to a leaky 251| | // mod inverse function. Note |blinding_factor| is secret, so |out| will be 252| | // secret again after multiplying. 253| 876| bn_declassify(out); 254| 876| if (!BN_mod_inverse_odd(out, out_no_inverse, out, &mont->N, ctx) || ------------------ | Branch (254:7): [True: 0, False: 876] ------------------ 255| 876| !BN_mod_mul_montgomery(out, blinding_factor.get(), out, mont, ctx)) { ------------------ | Branch (255:7): [True: 0, False: 876] ------------------ 256| 0| return 0; 257| 0| } 258| | 259| 876| return 1; 260| 876|} bn_secret: 167| 880|inline void bn_secret(BIGNUM *bn) { 168| 880| CONSTTIME_SECRET(bn->d, bn->width * sizeof(BN_ULONG)); 169| 880|} bn_declassify: 173| 876|inline void bn_declassify(BIGNUM *bn) { 174| 876| CONSTTIME_DECLASSIFY(bn->d, bn->width * sizeof(BN_ULONG)); 175| 876|} bn_mulx_adx_capable: 302| 1.78M|inline int bn_mulx_adx_capable(void) { 303| | // MULX is in BMI2. 304| 1.78M| return CRYPTO_is_BMI2_capable() && CRYPTO_is_ADX_capable(); ------------------ | Branch (304:10): [True: 1.78M, False: 0] | Branch (304:38): [True: 1.78M, False: 0] ------------------ 305| 1.78M|} bn_mul4x_mont_capable: 308| 610M|inline int bn_mul4x_mont_capable(size_t num) { 309| 610M| return num >= 8 && (num & 3) == 0; ------------------ | Branch (309:10): [True: 1.13M, False: 609M] | Branch (309:22): [True: 301k, False: 835k] ------------------ 310| 610M|} bn_mulx4x_mont_capable: 313| 305M|inline int bn_mulx4x_mont_capable(size_t num) { 314| 305M| return bn_mul4x_mont_capable(num) && bn_mulx_adx_capable(); ------------------ | Branch (314:10): [True: 301k, False: 305M] | Branch (314:40): [True: 301k, False: 0] ------------------ 315| 305M|} bn_sqr8x_mont_capable: 318| 170M|inline int bn_sqr8x_mont_capable(size_t num) { 319| 170M| return num >= 8 && (num & 7) == 0; ------------------ | Branch (319:10): [True: 1.71M, False: 168M] | Branch (319:22): [True: 1.48M, False: 228k] ------------------ 320| 170M|} bn_mul4x_mont_gather5_capable: 340| 840k|inline int bn_mul4x_mont_gather5_capable(int num) { return (num & 7) == 0; } bn_mulx4x_mont_gather5_capable: 345| 840k|inline int bn_mulx4x_mont_gather5_capable(int num) { 346| 840k| return bn_mul4x_mont_gather5_capable(num) && CRYPTO_is_ADX_capable() && ------------------ | Branch (346:10): [True: 840k, False: 0] | Branch (346:48): [True: 840k, False: 0] ------------------ 347| 840k| CRYPTO_is_BMI1_capable() && CRYPTO_is_BMI2_capable(); ------------------ | Branch (347:10): [True: 840k, False: 0] | Branch (347:38): [True: 840k, False: 0] ------------------ 348| 840k|} bn_power5_capable: 373| 22.9M|inline int bn_power5_capable(int num) { return (num & 7) == 0; } bn_powerx5_capable: 375| 11.4M|inline int bn_powerx5_capable(int num) { 376| 11.4M| return bn_power5_capable(num) && CRYPTO_is_ADX_capable() && ------------------ | Branch (376:10): [True: 11.4M, False: 0] | Branch (376:36): [True: 11.4M, False: 0] ------------------ 377| 11.4M| CRYPTO_is_BMI1_capable() && CRYPTO_is_BMI2_capable(); ------------------ | Branch (377:10): [True: 11.4M, False: 0] | Branch (377:38): [True: 11.4M, False: 0] ------------------ 378| 11.4M|} bn_mont_ctx_init: 29| 9.39k|void bn_mont_ctx_init(BN_MONT_CTX *mont) { 30| 9.39k| OPENSSL_memset(mont, 0, sizeof(BN_MONT_CTX)); 31| 9.39k| BN_init(&mont->RR); 32| 9.39k| BN_init(&mont->N); 33| 9.39k|} bn_mont_ctx_cleanup: 35| 9.38k|void bn_mont_ctx_cleanup(BN_MONT_CTX *mont) { 36| 9.38k| BN_free(&mont->RR); 37| 9.38k| BN_free(&mont->N); 38| 9.38k|} BN_MONT_CTX_new: 40| 9.39k|BN_MONT_CTX *BN_MONT_CTX_new(void) { 41| 9.39k| BN_MONT_CTX *ret = 42| 9.39k| reinterpret_cast(OPENSSL_malloc(sizeof(BN_MONT_CTX))); 43| 9.39k| if (ret == NULL) { ------------------ | Branch (43:7): [True: 0, False: 9.39k] ------------------ 44| 0| return NULL; 45| 0| } 46| | 47| 9.39k| bn_mont_ctx_init(ret); 48| 9.39k| return ret; 49| 9.39k|} BN_MONT_CTX_free: 51| 250k|void BN_MONT_CTX_free(BN_MONT_CTX *mont) { 52| 250k| if (mont == nullptr) { ------------------ | Branch (52:7): [True: 240k, False: 9.38k] ------------------ 53| 240k| return; 54| 240k| } 55| 9.38k| bn_mont_ctx_cleanup(mont); 56| 9.38k| OPENSSL_free(mont); 57| 9.38k|} BN_MONT_CTX_set: 120| 9.39k|int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *mod, BN_CTX *ctx) { 121| 9.39k| if (!bn_mont_ctx_set_N_and_n0(mont, mod)) { ------------------ | Branch (121:7): [True: 0, False: 9.39k] ------------------ 122| 0| return 0; 123| 0| } 124| | 125| 9.39k| BN_CTX *new_ctx = NULL; 126| 9.39k| if (ctx == NULL) { ------------------ | Branch (126:7): [True: 0, False: 9.39k] ------------------ 127| 0| new_ctx = BN_CTX_new(); 128| 0| if (new_ctx == NULL) { ------------------ | Branch (128:9): [True: 0, False: 0] ------------------ 129| 0| return 0; 130| 0| } 131| 0| ctx = new_ctx; 132| 0| } 133| | 134| | // Save RR = R**2 (mod N). R is the smallest power of 2**BN_BITS2 such that R 135| | // > mod. Even though the assembly on some 32-bit platforms works with 64-bit 136| | // values, using |BN_BITS2| here, rather than |BN_MONT_CTX_N0_LIMBS * 137| | // BN_BITS2|, is correct because R**2 will still be a multiple of the latter 138| | // as |BN_MONT_CTX_N0_LIMBS| is either one or two. 139| 9.39k| unsigned lgBigR = mont->N.width * BN_BITS2; ------------------ | | 42| 9.39k|#define BN_BITS2 64 ------------------ 140| 9.39k| BN_zero(&mont->RR); 141| 9.39k| int ok = BN_set_bit(&mont->RR, lgBigR * 2) && ------------------ | Branch (141:12): [True: 9.39k, False: 0] ------------------ 142| 9.39k| BN_mod(&mont->RR, &mont->RR, &mont->N, ctx) && ------------------ | | 444| 18.7k| BN_div(NULL, (rem), (numerator), (divisor), (ctx)) | | ------------------ | | | Branch (444:3): [True: 9.39k, False: 0] | | ------------------ ------------------ 143| 9.39k| bn_resize_words(&mont->RR, mont->N.width); ------------------ | Branch (143:12): [True: 9.39k, False: 0] ------------------ 144| 9.39k| BN_CTX_free(new_ctx); 145| 9.39k| return ok; 146| 9.39k|} BN_MONT_CTX_new_for_modulus: 148| 9.39k|BN_MONT_CTX *BN_MONT_CTX_new_for_modulus(const BIGNUM *mod, BN_CTX *ctx) { 149| 9.39k| BN_MONT_CTX *mont = BN_MONT_CTX_new(); 150| 9.39k| if (mont == NULL || !BN_MONT_CTX_set(mont, mod, ctx)) { ------------------ | Branch (150:7): [True: 0, False: 9.39k] | Branch (150:23): [True: 0, False: 9.39k] ------------------ 151| 0| BN_MONT_CTX_free(mont); 152| 0| return NULL; 153| 0| } 154| 9.39k| return mont; 155| 9.39k|} BN_MONT_CTX_new_consttime: 157| 2|BN_MONT_CTX *BN_MONT_CTX_new_consttime(const BIGNUM *mod, BN_CTX *ctx) { 158| 2| BN_MONT_CTX *mont = BN_MONT_CTX_new(); 159| 2| if (mont == NULL || !bn_mont_ctx_set_N_and_n0(mont, mod) || ------------------ | Branch (159:7): [True: 0, False: 2] | Branch (159:23): [True: 0, False: 2] ------------------ 160| 2| !bn_mont_ctx_set_RR_consttime(mont, ctx)) { ------------------ | Branch (160:7): [True: 0, False: 2] ------------------ 161| 0| BN_MONT_CTX_free(mont); 162| 0| return NULL; 163| 0| } 164| 2| return mont; 165| 2|} BN_MONT_CTX_set_locked: 168| 9.38k| const BIGNUM *mod, BN_CTX *bn_ctx) { 169| 9.38k| CRYPTO_MUTEX_lock_read(lock); 170| 9.38k| BN_MONT_CTX *ctx = *pmont; 171| 9.38k| CRYPTO_MUTEX_unlock_read(lock); 172| | 173| 9.38k| if (ctx) { ------------------ | Branch (173:7): [True: 0, False: 9.38k] ------------------ 174| 0| return 1; 175| 0| } 176| | 177| 9.38k| CRYPTO_MUTEX_lock_write(lock); 178| 9.38k| if (*pmont == NULL) { ------------------ | Branch (178:7): [True: 9.38k, False: 0] ------------------ 179| 9.38k| *pmont = BN_MONT_CTX_new_for_modulus(mod, bn_ctx); 180| 9.38k| } 181| 9.38k| const int ok = *pmont != NULL; 182| 9.38k| CRYPTO_MUTEX_unlock_write(lock); 183| 9.38k| return ok; 184| 9.38k|} BN_to_montgomery: 187| 179k| BN_CTX *ctx) { 188| 179k| return BN_mod_mul_montgomery(ret, a, &mont->RR, mont, ctx); 189| 179k|} BN_from_montgomery: 246| 179k| BN_CTX *ctx) { 247| 179k| bssl::BN_CTXScope scope(ctx); 248| 179k| BIGNUM *t = BN_CTX_get(ctx); 249| 179k| if (t == NULL || !BN_copy(t, a)) { ------------------ | Branch (249:7): [True: 0, False: 179k] | Branch (249:20): [True: 0, False: 179k] ------------------ 250| 0| return 0; 251| 0| } 252| | 253| 179k| return BN_from_montgomery_word(r, t, mont); 254| 179k|} bn_one_to_montgomery: 256| 56.0k|int bn_one_to_montgomery(BIGNUM *r, const BN_MONT_CTX *mont, BN_CTX *ctx) { 257| | // If the high bit of |n| is set, R = 2^(width*BN_BITS2) < 2 * |n|, so we 258| | // compute R - |n| rather than perform Montgomery reduction. 259| 56.0k| const BIGNUM *n = &mont->N; 260| 56.0k| if (n->width > 0 && (n->d[n->width - 1] >> (BN_BITS2 - 1)) != 0) { ------------------ | | 42| 56.0k|#define BN_BITS2 64 ------------------ | Branch (260:7): [True: 56.0k, False: 0] | Branch (260:23): [True: 56.0k, False: 0] ------------------ 261| 56.0k| if (!bn_wexpand(r, n->width)) { ------------------ | Branch (261:9): [True: 0, False: 56.0k] ------------------ 262| 0| return 0; 263| 0| } 264| 56.0k| r->d[0] = 0 - n->d[0]; 265| 896k| for (int i = 1; i < n->width; i++) { ------------------ | Branch (265:21): [True: 840k, False: 56.0k] ------------------ 266| 840k| r->d[i] = ~n->d[i]; 267| 840k| } 268| 56.0k| r->width = n->width; 269| 56.0k| r->neg = 0; 270| 56.0k| return 1; 271| 56.0k| } 272| | 273| 0| return BN_from_montgomery(r, &mont->RR, mont, ctx); 274| 56.0k|} BN_mod_mul_montgomery: 305| 1.00M| const BN_MONT_CTX *mont, BN_CTX *ctx) { 306| 1.00M| if (a->neg || b->neg) { ------------------ | Branch (306:7): [True: 0, False: 1.00M] | Branch (306:17): [True: 0, False: 1.00M] ------------------ 307| 0| OPENSSL_PUT_ERROR(BN, BN_R_NEGATIVE_NUMBER); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 308| 0| return 0; 309| 0| } 310| | 311| 1.00M|#if defined(OPENSSL_BN_ASM_MONT) 312| | // |bn_mul_mont| requires at least 128 bits of limbs. 313| 1.00M| int num = mont->N.width; 314| 1.00M| if (num >= (128 / BN_BITS2) && a->width == num && b->width == num) { ------------------ | | 42| 1.00M|#define BN_BITS2 64 ------------------ | Branch (314:7): [True: 1.00M, False: 0] | Branch (314:34): [True: 1.00M, False: 0] | Branch (314:53): [True: 1.00M, False: 0] ------------------ 315| 1.00M| if (!bn_wexpand(r, num)) { ------------------ | Branch (315:9): [True: 0, False: 1.00M] ------------------ 316| 0| return 0; 317| 0| } 318| | // This bound is implied by |bn_mont_ctx_set_N_and_n0|. |bn_mul_mont| 319| | // allocates |num| words on the stack, so |num| cannot be too large. 320| 1.00M| assert((size_t)num <= BN_MONTGOMERY_MAX_WORDS); 321| 1.00M| bn_mul_mont(r->d, a->d, b->d, mont->N.d, mont->n0, num); 322| 1.00M| r->neg = 0; 323| 1.00M| r->width = num; 324| 1.00M| return 1; 325| 1.00M| } 326| 0|#endif 327| | 328| 0| return bn_mod_mul_montgomery_fallback(r, a, b, mont, ctx); 329| 1.00M|} bn_less_than_montgomery_R: 331| 140k|int bn_less_than_montgomery_R(const BIGNUM *bn, const BN_MONT_CTX *mont) { 332| 140k| return !BN_is_negative(bn) && bn_fits_in_words(bn, mont->N.width); ------------------ | Branch (332:10): [True: 140k, False: 0] | Branch (332:33): [True: 140k, False: 0] ------------------ 333| 140k|} bn_to_montgomery_small: 336| 126k| const BN_MONT_CTX *mont) { 337| 126k| bn_mod_mul_montgomery_small(r, a, mont->RR.d, num, mont); 338| 126k|} bn_from_montgomery_small: 341| 90.7k| size_t num_a, const BN_MONT_CTX *mont) { 342| 90.7k| if (num_r != (size_t)mont->N.width || num_r > BN_SMALL_MAX_WORDS || ------------------ | | 642| 181k|#define BN_SMALL_MAX_WORDS 9 ------------------ | Branch (342:7): [True: 0, False: 90.7k] | Branch (342:41): [True: 0, False: 90.7k] ------------------ 343| 90.7k| num_a > 2 * num_r) { ------------------ | Branch (343:7): [True: 0, False: 90.7k] ------------------ 344| 0| abort(); 345| 0| } 346| 90.7k| BN_ULONG tmp[BN_SMALL_MAX_WORDS * 2] = {0}; 347| 90.7k| OPENSSL_memcpy(tmp, a, num_a * sizeof(BN_ULONG)); 348| 90.7k| if (!bn_from_montgomery_in_place(r, num_r, tmp, 2 * num_r, mont)) { ------------------ | Branch (348:7): [True: 0, False: 90.7k] ------------------ 349| 0| abort(); 350| 0| } 351| 90.7k| OPENSSL_cleanse(tmp, 2 * num_r * sizeof(BN_ULONG)); 352| 90.7k|} bn_mod_mul_montgomery_small: 356| 305M| const BN_MONT_CTX *mont) { 357| 305M| if (num != (size_t)mont->N.width || num > BN_SMALL_MAX_WORDS) { ------------------ | | 642| 305M|#define BN_SMALL_MAX_WORDS 9 ------------------ | Branch (357:7): [True: 0, False: 305M] | Branch (357:39): [True: 0, False: 305M] ------------------ 358| 0| abort(); 359| 0| } 360| | 361| 305M|#if defined(OPENSSL_BN_ASM_MONT) 362| | // |bn_mul_mont| requires at least 128 bits of limbs. 363| 305M| if (num >= (128 / BN_BITS2)) { ------------------ | | 42| 305M|#define BN_BITS2 64 ------------------ | Branch (363:7): [True: 305M, False: 0] ------------------ 364| 305M| bn_mul_mont(r, a, b, mont->N.d, mont->n0, num); 365| 305M| return; 366| 305M| } 367| 0|#endif 368| | 369| | // Compute the product. 370| 0| BN_ULONG tmp[2 * BN_SMALL_MAX_WORDS]; 371| 0| if (a == b) { ------------------ | Branch (371:7): [True: 0, False: 0] ------------------ 372| 0| bn_sqr_small(tmp, 2 * num, a, num); 373| 0| } else { 374| 0| bn_mul_small(tmp, 2 * num, a, num, b, num); 375| 0| } 376| | 377| | // Reduce. 378| 0| if (!bn_from_montgomery_in_place(r, num, tmp, 2 * num, mont)) { ------------------ | Branch (378:7): [True: 0, False: 0] ------------------ 379| 0| abort(); 380| 0| } 381| 0| OPENSSL_cleanse(tmp, 2 * num * sizeof(BN_ULONG)); 382| 0|} bn_mul_mont: 386| 306M| const BN_ULONG *np, const BN_ULONG *n0, size_t num) { 387| 306M| if (ap == bp && bn_sqr8x_mont_capable(num)) { ------------------ | Branch (387:7): [True: 170M, False: 136M] | Branch (387:19): [True: 1.48M, False: 168M] ------------------ 388| 1.48M| bn_sqr8x_mont(rp, ap, bn_mulx_adx_capable(), np, n0, num); 389| 305M| } else if (bn_mulx4x_mont_capable(num)) { ------------------ | Branch (389:14): [True: 301k, False: 305M] ------------------ 390| 301k| bn_mulx4x_mont(rp, ap, bp, np, n0, num); 391| 305M| } else if (bn_mul4x_mont_capable(num)) { ------------------ | Branch (391:14): [True: 0, False: 305M] ------------------ 392| 0| bn_mul4x_mont(rp, ap, bp, np, n0, num); 393| 305M| } else { 394| 305M| bn_mul_mont_nohw(rp, ap, bp, np, n0, num); 395| 305M| } 396| 306M|} bcm.cc:_ZL24bn_mont_ctx_set_N_and_n0P14bn_mont_ctx_stPK9bignum_st: 72| 9.39k|static int bn_mont_ctx_set_N_and_n0(BN_MONT_CTX *mont, const BIGNUM *mod) { 73| 9.39k| if (BN_is_zero(mod)) { ------------------ | Branch (73:7): [True: 0, False: 9.39k] ------------------ 74| 0| OPENSSL_PUT_ERROR(BN, BN_R_DIV_BY_ZERO); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 75| 0| return 0; 76| 0| } 77| 9.39k| if (!BN_is_odd(mod)) { ------------------ | Branch (77:7): [True: 0, False: 9.39k] ------------------ 78| 0| OPENSSL_PUT_ERROR(BN, BN_R_CALLED_WITH_EVEN_MODULUS); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 79| 0| return 0; 80| 0| } 81| 9.39k| if (BN_is_negative(mod)) { ------------------ | Branch (81:7): [True: 0, False: 9.39k] ------------------ 82| 0| OPENSSL_PUT_ERROR(BN, BN_R_NEGATIVE_NUMBER); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 83| 0| return 0; 84| 0| } 85| 9.39k| if (!bn_fits_in_words(mod, BN_MONTGOMERY_MAX_WORDS)) { ------------------ | | 274| 9.39k|#define BN_MONTGOMERY_MAX_WORDS (16384 / BN_BITS2) | | ------------------ | | | | 42| 9.39k|#define BN_BITS2 64 | | ------------------ ------------------ | Branch (85:7): [True: 0, False: 9.39k] ------------------ 86| 0| OPENSSL_PUT_ERROR(BN, BN_R_BIGNUM_TOO_LONG); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 87| 0| return 0; 88| 0| } 89| | 90| | // Save the modulus. 91| 9.39k| if (!BN_copy(&mont->N, mod)) { ------------------ | Branch (91:7): [True: 0, False: 9.39k] ------------------ 92| 0| OPENSSL_PUT_ERROR(BN, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 93| 0| return 0; 94| 0| } 95| | // |mont->N| is always stored minimally. Computing RR efficiently leaks the 96| | // size of the modulus. While the modulus may be private in RSA (one of the 97| | // primes), their sizes are public, so this is fine. 98| 9.39k| bn_set_minimal_width(&mont->N); 99| | 100| | // Find n0 such that n0 * N == -1 (mod r). 101| | // 102| | // Only certain BN_BITS2<=32 platforms actually make use of n0[1]. For the 103| | // others, we could use a shorter R value and use faster |BN_ULONG|-based 104| | // math instead of |uint64_t|-based math, which would be double-precision. 105| | // However, currently only the assembler files know which is which. 106| 9.39k| static_assert(BN_MONT_CTX_N0_LIMBS == 1 || BN_MONT_CTX_N0_LIMBS == 2, 107| 9.39k| "BN_MONT_CTX_N0_LIMBS value is invalid"); 108| 9.39k| static_assert(sizeof(BN_ULONG) * BN_MONT_CTX_N0_LIMBS == sizeof(uint64_t), 109| 9.39k| "uint64_t is insufficient precision for n0"); 110| 9.39k| uint64_t n0 = bn_mont_n0(&mont->N); 111| 9.39k| mont->n0[0] = (BN_ULONG)n0; 112| |#if BN_MONT_CTX_N0_LIMBS == 2 113| | mont->n0[1] = (BN_ULONG)(n0 >> BN_BITS2); 114| |#else 115| 9.39k| mont->n0[1] = 0; 116| 9.39k|#endif 117| 9.39k| return 1; 118| 9.39k|} bcm.cc:_ZL23BN_from_montgomery_wordP9bignum_stS0_PK14bn_mont_ctx_st: 223| 179k| const BN_MONT_CTX *mont) { 224| 179k| if (r->neg) { ------------------ | Branch (224:7): [True: 0, False: 179k] ------------------ 225| 0| OPENSSL_PUT_ERROR(BN, BN_R_NEGATIVE_NUMBER); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 226| 0| return 0; 227| 0| } 228| | 229| 179k| const BIGNUM *n = &mont->N; 230| 179k| if (n->width == 0) { ------------------ | Branch (230:7): [True: 0, False: 179k] ------------------ 231| 0| ret->width = 0; 232| 0| return 1; 233| 0| } 234| | 235| 179k| int max = 2 * n->width; // carry is stored separately 236| 179k| if (!bn_resize_words(r, max) || !bn_wexpand(ret, n->width)) { ------------------ | Branch (236:7): [True: 0, False: 179k] | Branch (236:35): [True: 0, False: 179k] ------------------ 237| 0| return 0; 238| 0| } 239| | 240| 179k| ret->width = n->width; 241| 179k| ret->neg = 0; 242| 179k| return bn_from_montgomery_in_place(ret->d, ret->width, r->d, r->width, mont); 243| 179k|} bcm.cc:_ZL27bn_from_montgomery_in_placePmmS_mPK14bn_mont_ctx_st: 192| 269k| size_t num_a, const BN_MONT_CTX *mont) { 193| 269k| const BN_ULONG *n = mont->N.d; 194| 269k| size_t num_n = mont->N.width; 195| 269k| if (num_r != num_n || num_a != 2 * num_n) { ------------------ | Branch (195:7): [True: 0, False: 269k] | Branch (195:25): [True: 0, False: 269k] ------------------ 196| 0| OPENSSL_PUT_ERROR(BN, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 197| 0| return 0; 198| 0| } 199| | 200| | // Add multiples of |n| to |r| until R = 2^(nl * BN_BITS2) divides it. On 201| | // input, we had |r| < |n| * R, so now |r| < 2 * |n| * R. Note that |r| 202| | // includes |carry| which is stored separately. 203| 269k| BN_ULONG n0 = mont->n0[0]; 204| 269k| BN_ULONG carry = 0; 205| 4.20M| for (size_t i = 0; i < num_n; i++) { ------------------ | Branch (205:22): [True: 3.93M, False: 269k] ------------------ 206| 3.93M| BN_ULONG v = bn_mul_add_words(a + i, n, num_n, a[i] * n0); 207| 3.93M| v += carry + a[i + num_n]; 208| 3.93M| carry |= (v != a[i + num_n]); 209| 3.93M| carry &= (v <= a[i + num_n]); 210| 3.93M| a[i + num_n] = v; 211| 3.93M| } 212| | 213| | // Shift |num_n| words to divide by R. We have |a| < 2 * |n|. Note that |a| 214| | // includes |carry| which is stored separately. 215| 269k| a += num_n; 216| | 217| | // |a| thus requires at most one additional subtraction |n| to be reduced. 218| 269k| bn_reduce_once(r, a, carry, n, num_n); 219| 269k| return 1; 220| 269k|} bn_mont_n0: 33| 9.39k|uint64_t bn_mont_n0(const BIGNUM *n) { 34| | // These conditions are checked by the caller, |BN_MONT_CTX_set| or 35| | // |BN_MONT_CTX_new_consttime|. 36| 9.39k| assert(!BN_is_zero(n)); 37| 9.39k| assert(!BN_is_negative(n)); 38| 9.39k| assert(BN_is_odd(n)); 39| | 40| | // r == 2**(BN_MONT_CTX_N0_LIMBS * BN_BITS2) and LG_LITTLE_R == lg(r). This 41| | // ensures that we can do integer division by |r| by simply ignoring 42| | // |BN_MONT_CTX_N0_LIMBS| limbs. Similarly, we can calculate values modulo 43| | // |r| by just looking at the lowest |BN_MONT_CTX_N0_LIMBS| limbs. This is 44| | // what makes Montgomery multiplication efficient. 45| | // 46| | // As shown in Algorithm 1 of "Fast Prime Field Elliptic Curve Cryptography 47| | // with 256 Bit Primes" by Shay Gueron and Vlad Krasnov, in the loop of a 48| | // multi-limb Montgomery multiplication of |a * b (mod n)|, given the 49| | // unreduced product |t == a * b|, we repeatedly calculate: 50| | // 51| | // t1 := t % r |t1| is |t|'s lowest limb (see previous paragraph). 52| | // t2 := t1*n0*n 53| | // t3 := t + t2 54| | // t := t3 / r copy all limbs of |t3| except the lowest to |t|. 55| | // 56| | // In the last step, it would only make sense to ignore the lowest limb of 57| | // |t3| if it were zero. The middle steps ensure that this is the case: 58| | // 59| | // t3 == 0 (mod r) 60| | // t + t2 == 0 (mod r) 61| | // t + t1*n0*n == 0 (mod r) 62| | // t1*n0*n == -t (mod r) 63| | // t*n0*n == -t (mod r) 64| | // n0*n == -1 (mod r) 65| | // n0 == -1/n (mod r) 66| | // 67| | // Thus, in each iteration of the loop, we multiply by the constant factor 68| | // |n0|, the negative inverse of n (mod r). 69| | 70| | // n_mod_r = n % r. As explained above, this is done by taking the lowest 71| | // |BN_MONT_CTX_N0_LIMBS| limbs of |n|. 72| 9.39k| uint64_t n_mod_r = n->d[0]; 73| |#if BN_MONT_CTX_N0_LIMBS == 2 74| | if (n->width > 1) { 75| | n_mod_r |= (uint64_t)n->d[1] << BN_BITS2; 76| | } 77| |#endif 78| | 79| 9.39k| return bn_neg_inv_mod_r_u64(n_mod_r); 80| 9.39k|} bn_mont_ctx_set_RR_consttime: 162| 2|int bn_mont_ctx_set_RR_consttime(BN_MONT_CTX *mont, BN_CTX *ctx) { 163| 2| assert(!BN_is_zero(&mont->N)); 164| 2| assert(!BN_is_negative(&mont->N)); 165| 2| assert(BN_is_odd(&mont->N)); 166| 2| assert(bn_minimal_width(&mont->N) == mont->N.width); 167| | 168| 2| unsigned n_bits = BN_num_bits(&mont->N); 169| 2| assert(n_bits != 0); 170| 2| if (n_bits == 1) { ------------------ | Branch (170:7): [True: 0, False: 2] ------------------ 171| 0| BN_zero(&mont->RR); 172| 0| return bn_resize_words(&mont->RR, mont->N.width); 173| 0| } 174| | 175| 2| unsigned lgBigR = mont->N.width * BN_BITS2; ------------------ | | 42| 2|#define BN_BITS2 64 ------------------ 176| 2| assert(lgBigR >= n_bits); 177| | 178| | // RR is R, or 2^lgBigR, in the Montgomery domain. We can compute 2 in the 179| | // Montgomery domain, 2R or 2^(lgBigR+1), and then use Montgomery 180| | // square-and-multiply to exponentiate. 181| | // 182| | // The square steps take 2^n R to (2^n)*(2^n) R = 2^2n R. This is the same as 183| | // doubling 2^n R, n times (doubling any x, n times, computes 2^n * x). When n 184| | // is below some threshold, doubling is faster; when above, squaring is 185| | // faster. From benchmarking various 32-bit and 64-bit architectures, the word 186| | // count seems to work well as a threshold. (Doubling scales linearly and 187| | // Montgomery reduction scales quadratically, so the threshold should scale 188| | // roughly linearly.) 189| | // 190| | // The multiply steps take 2^n R to 2*2^n R = 2^(n+1) R. It is faster to 191| | // double the value instead, so the square-and-multiply exponentiation would 192| | // become square-and-double. However, when using the word count as the 193| | // threshold, it turns out that no multiply/double steps will be needed at 194| | // all, because squaring any x, i times, computes x^(2^i): 195| | // 196| | // (2^threshold)^(2^BN_BITS2_LG) R 197| | // (2^mont->N.width)^BN_BITS2 R 198| | // = 2^(mont->N.width*BN_BITS2) R 199| | // = 2^lgBigR R 200| | // = RR 201| 2| int threshold = mont->N.width; 202| | 203| | // Calculate 2^threshold R = 2^(threshold + lgBigR) by doubling. The 204| | // first n_bits - 1 doubles can be skipped because we don't need to reduce. 205| 2| if (!BN_set_bit(&mont->RR, n_bits - 1) || ------------------ | Branch (205:7): [True: 0, False: 2] ------------------ 206| 2| !bn_mod_lshift_consttime(&mont->RR, &mont->RR, ------------------ | Branch (206:7): [True: 0, False: 2] ------------------ 207| 2| threshold + (lgBigR - (n_bits - 1)), 208| 2| &mont->N, ctx)) { 209| 0| return 0; 210| 0| } 211| | 212| | // The above steps are the same regardless of the threshold. The steps below 213| | // need to be modified if the threshold changes. 214| 2| assert(threshold == mont->N.width); 215| 14| for (unsigned i = 0; i < BN_BITS2_LG; i++) { ------------------ | | 43| 14|#define BN_BITS2_LG 6 ------------------ | Branch (215:24): [True: 12, False: 2] ------------------ 216| 12| if (!BN_mod_mul_montgomery(&mont->RR, &mont->RR, &mont->RR, mont, ctx)) { ------------------ | Branch (216:9): [True: 0, False: 12] ------------------ 217| 0| return 0; 218| 0| } 219| 12| } 220| | 221| 2| return bn_resize_words(&mont->RR, mont->N.width); 222| 2|} bcm.cc:_ZL20bn_neg_inv_mod_r_u64m: 104| 9.39k|static uint64_t bn_neg_inv_mod_r_u64(uint64_t n) { 105| 9.39k| assert(n % 2 == 1); 106| | 107| | // alpha == 2**(lg r - 1) == r / 2. 108| 9.39k| static const uint64_t alpha = UINT64_C(1) << (LG_LITTLE_R - 1); ------------------ | | 31| 9.39k|#define LG_LITTLE_R (BN_MONT_CTX_N0_LIMBS * BN_BITS2) | | ------------------ | | | | 50| 9.39k|#define BN_MONT_CTX_N0_LIMBS 1 | | ------------------ | | #define LG_LITTLE_R (BN_MONT_CTX_N0_LIMBS * BN_BITS2) | | ------------------ | | | | 42| 9.39k|#define BN_BITS2 64 | | ------------------ ------------------ 109| | 110| 9.39k| const uint64_t beta = n; 111| | 112| 9.39k| uint64_t u = 1; 113| 9.39k| uint64_t v = 0; 114| | 115| | // The invariant maintained from here on is: 116| | // 2**(lg r - i) == u*2*alpha - v*beta. 117| 610k| for (size_t i = 0; i < LG_LITTLE_R; ++i) { ------------------ | | 31| 610k|#define LG_LITTLE_R (BN_MONT_CTX_N0_LIMBS * BN_BITS2) | | ------------------ | | | | 50| 610k|#define BN_MONT_CTX_N0_LIMBS 1 | | ------------------ | | #define LG_LITTLE_R (BN_MONT_CTX_N0_LIMBS * BN_BITS2) | | ------------------ | | | | 42| 610k|#define BN_BITS2 64 | | ------------------ ------------------ | Branch (117:22): [True: 601k, False: 9.39k] ------------------ 118| 601k|#if BN_BITS2 == 64 && defined(BN_ULLONG) 119| 601k| assert((BN_ULLONG)(1) << (LG_LITTLE_R - i) == 120| 601k| ((BN_ULLONG)u * 2 * alpha) - ((BN_ULLONG)v * beta)); 121| 601k|#endif 122| | 123| | // Delete a common factor of 2 in u and v if |u| is even. Otherwise, set 124| | // |u = (u + beta) / 2| and |v = (v / 2) + alpha|. 125| | 126| 601k| uint64_t u_is_odd = UINT64_C(0) - (u & 1); // Either 0xff..ff or 0. 127| | 128| | // The addition can overflow, so use Dietz's method for it. 129| | // 130| | // Dietz calculates (x+y)/2 by (x⊕y)>>1 + x&y. This is valid for all 131| | // (unsigned) x and y, even when x+y overflows. Evidence for 32-bit values 132| | // (embedded in 64 bits to so that overflow can be ignored): 133| | // 134| | // (declare-fun x () (_ BitVec 64)) 135| | // (declare-fun y () (_ BitVec 64)) 136| | // (assert (let ( 137| | // (one (_ bv1 64)) 138| | // (thirtyTwo (_ bv32 64))) 139| | // (and 140| | // (bvult x (bvshl one thirtyTwo)) 141| | // (bvult y (bvshl one thirtyTwo)) 142| | // (not (= 143| | // (bvadd (bvlshr (bvxor x y) one) (bvand x y)) 144| | // (bvlshr (bvadd x y) one))) 145| | // ))) 146| | // (check-sat) 147| 601k| uint64_t beta_if_u_is_odd = beta & u_is_odd; // Either |beta| or 0. 148| 601k| u = ((u ^ beta_if_u_is_odd) >> 1) + (u & beta_if_u_is_odd); 149| | 150| 601k| uint64_t alpha_if_u_is_odd = alpha & u_is_odd; // Either |alpha| or 0. 151| 601k| v = (v >> 1) + alpha_if_u_is_odd; 152| 601k| } 153| | 154| | // The invariant now shows that u*r - v*n == 1 since r == 2 * alpha. 155| 9.39k|#if BN_BITS2 == 64 && defined(BN_ULLONG) 156| 9.39k| declassify_assert(1 == ((BN_ULLONG)u * 2 * alpha) - ((BN_ULLONG)v * beta)); ------------------ | | 493| 9.39k|#define declassify_assert(expr) assert(constant_time_declassify_int(expr)) ------------------ 157| 9.39k|#endif 158| | 159| 9.39k| return v; 160| 9.39k|} bn_mul_consttime: 205| 28.0k|int bn_mul_consttime(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx) { 206| | // Prevent negative zeros. 207| 28.0k| if (a->neg || b->neg) { ------------------ | Branch (207:7): [True: 0, False: 28.0k] | Branch (207:17): [True: 0, False: 28.0k] ------------------ 208| 0| OPENSSL_PUT_ERROR(BN, BN_R_NEGATIVE_NUMBER); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 209| 0| return 0; 210| 0| } 211| | 212| 28.0k| return bn_mul_impl(r, a, b, ctx); 213| 28.0k|} bcm.cc:_ZL11bn_mul_implP9bignum_stPKS_S2_P10bignum_ctx: 148| 28.0k| BN_CTX *ctx) { 149| 28.0k| int al = a->width; 150| 28.0k| int bl = b->width; 151| 28.0k| if (al == 0 || bl == 0) { ------------------ | Branch (151:7): [True: 0, False: 28.0k] | Branch (151:18): [True: 0, False: 28.0k] ------------------ 152| 0| BN_zero(r); 153| 0| return 1; 154| 0| } 155| | 156| 28.0k| int i, top; 157| 28.0k| BIGNUM *rr; 158| 28.0k| bssl::BN_CTXScope scope(ctx); 159| 28.0k| if (r == a || r == b) { ------------------ | Branch (159:7): [True: 28.0k, False: 10] | Branch (159:17): [True: 0, False: 10] ------------------ 160| 28.0k| rr = BN_CTX_get(ctx); 161| 28.0k| if (rr == NULL) { ------------------ | Branch (161:9): [True: 0, False: 28.0k] ------------------ 162| 0| return 0; 163| 0| } 164| 28.0k| } else { 165| 10| rr = r; 166| 10| } 167| 28.0k| rr->neg = a->neg ^ b->neg; 168| | 169| 28.0k| i = al - bl; 170| 28.0k| if (i == 0) { ------------------ | Branch (170:7): [True: 28.0k, False: 8] ------------------ 171| 28.0k| if (al == 8) { ------------------ | Branch (171:9): [True: 0, False: 28.0k] ------------------ 172| 0| if (!bn_wexpand(rr, 16)) { ------------------ | Branch (172:11): [True: 0, False: 0] ------------------ 173| 0| return 0; 174| 0| } 175| 0| rr->width = 16; 176| 0| bn_mul_comba8(rr->d, a->d, b->d); 177| 0| goto end; 178| 0| } 179| 28.0k| } 180| | 181| 28.0k| top = al + bl; 182| 28.0k| if (!bn_wexpand(rr, top)) { ------------------ | Branch (182:7): [True: 0, False: 28.0k] ------------------ 183| 0| return 0; 184| 0| } 185| 28.0k| rr->width = top; 186| 28.0k| bn_mul_normal(rr->d, a->d, al, b->d, bl); 187| | 188| 28.0k|end: 189| 28.0k| if (r != rr && !BN_copy(r, rr)) { ------------------ | Branch (189:7): [True: 28.0k, False: 10] | Branch (189:18): [True: 0, False: 28.0k] ------------------ 190| 0| return 0; 191| 0| } 192| 28.0k| return 1; 193| 28.0k|} bcm.cc:_ZL13bn_mul_normalPmPKmmS1_m: 29| 28.0k| const BN_ULONG *b, size_t nb) { 30| 28.0k| if (na < nb) { ------------------ | Branch (30:7): [True: 4, False: 28.0k] ------------------ 31| 4| size_t itmp = na; 32| 4| na = nb; 33| 4| nb = itmp; 34| 4| const BN_ULONG *ltmp = a; 35| 4| a = b; 36| 4| b = ltmp; 37| 4| } 38| 28.0k| BN_ULONG *rr = &(r[na]); 39| 28.0k| if (nb == 0) { ------------------ | Branch (39:7): [True: 0, False: 28.0k] ------------------ 40| 0| OPENSSL_memset(r, 0, na * sizeof(BN_ULONG)); 41| 0| return; 42| 0| } 43| 28.0k| rr[0] = bn_mul_words(r, a, na, b[0]); 44| | 45| 112k| for (;;) { 46| 112k| if (--nb == 0) { ------------------ | Branch (46:9): [True: 8, False: 112k] ------------------ 47| 8| return; 48| 8| } 49| 112k| rr[1] = bn_mul_add_words(&(r[1]), a, na, b[1]); 50| 112k| if (--nb == 0) { ------------------ | Branch (50:9): [True: 0, False: 112k] ------------------ 51| 0| return; 52| 0| } 53| 112k| rr[2] = bn_mul_add_words(&(r[2]), a, na, b[2]); 54| 112k| if (--nb == 0) { ------------------ | Branch (54:9): [True: 0, False: 112k] ------------------ 55| 0| return; 56| 0| } 57| 112k| rr[3] = bn_mul_add_words(&(r[3]), a, na, b[3]); 58| 112k| if (--nb == 0) { ------------------ | Branch (58:9): [True: 28.0k, False: 84.0k] ------------------ 59| 28.0k| return; 60| 28.0k| } 61| 84.0k| rr[4] = bn_mul_add_words(&(r[4]), a, na, b[4]); 62| 84.0k| rr += 4; 63| 84.0k| r += 4; 64| 84.0k| b += 4; 65| 84.0k| } 66| 28.0k|} bn_in_range_words: 120| 32.0k| const BN_ULONG *max_exclusive, size_t len) { 121| 32.0k| crypto_word_t mask = ~bn_less_than_word_mask(a, len, min_inclusive); 122| 32.0k| return mask & bn_less_than_words(a, max_exclusive, len); 123| 32.0k|} bn_rand_range_words: 155| 31.6k| const uint8_t additional_data[32]) { 156| | // This function implements the equivalent of steps 4 through 7 of FIPS 186-4 157| | // appendices B.4.2 and B.5.2. When called in those contexts, |max_exclusive| 158| | // is n and |min_inclusive| is one. 159| | 160| | // Compute the bit length of |max_exclusive| (step 1), in terms of a number of 161| | // |words| worth of entropy to fill and a mask of bits to clear in the top 162| | // word. 163| 31.6k| size_t words; 164| 31.6k| BN_ULONG mask; 165| 31.6k| if (!bn_range_to_mask(&words, &mask, min_inclusive, max_exclusive, len)) { ------------------ | Branch (165:7): [True: 0, False: 31.6k] ------------------ 166| 0| return 0; 167| 0| } 168| | 169| | // Fill any unused words with zero. 170| 31.6k| OPENSSL_memset(out + words, 0, (len - words) * sizeof(BN_ULONG)); 171| | 172| 31.6k| unsigned count = 100; 173| 32.0k| do { 174| 32.0k| if (!--count) { ------------------ | Branch (174:9): [True: 0, False: 32.0k] ------------------ 175| 0| OPENSSL_PUT_ERROR(BN, BN_R_TOO_MANY_ITERATIONS); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 176| 0| return 0; 177| 0| } 178| | 179| | // Steps 4 and 5. Use |words| and |mask| together to obtain a string of N 180| | // bits, where N is the bit length of |max_exclusive|. 181| 32.0k| FIPS_service_indicator_lock_state(); 182| 32.0k| BCM_rand_bytes_with_additional_data( 183| 32.0k| (uint8_t *)out, words * sizeof(BN_ULONG), additional_data); 184| 32.0k| FIPS_service_indicator_unlock_state(); 185| 32.0k| out[words - 1] &= mask; 186| | 187| | // If out >= max_exclusive or out < min_inclusive, retry. This implements 188| | // the equivalent of steps 6 and 7 without leaking the value of |out|. The 189| | // result of this comparison may be treated as public. It only reveals how 190| | // many attempts were needed before we found a value in range. This is 191| | // independent of the final secret output, and has a distribution that 192| | // depends only on |min_inclusive| and |max_exclusive|, both of which are 193| | // public. 194| 32.0k| } while (!constant_time_declassify_int( ------------------ | Branch (194:12): [True: 406, False: 31.6k] ------------------ 195| 32.0k| bn_in_range_words(out, min_inclusive, max_exclusive, words))); 196| 31.6k| return 1; 197| 31.6k|} BN_rand_range_ex: 200| 31.5k| const BIGNUM *max_exclusive) { 201| 31.5k| static const uint8_t kDefaultAdditionalData[32] = {0}; 202| 31.5k| if (!bn_wexpand(r, max_exclusive->width) || ------------------ | Branch (202:7): [True: 0, False: 31.5k] ------------------ 203| 31.5k| !bn_rand_range_words(r->d, min_inclusive, max_exclusive->d, ------------------ | Branch (203:7): [True: 0, False: 31.5k] ------------------ 204| 31.5k| max_exclusive->width, kDefaultAdditionalData)) { 205| 0| return 0; 206| 0| } 207| | 208| 31.5k| r->neg = 0; 209| 31.5k| r->width = max_exclusive->width; 210| 31.5k| return 1; 211| 31.5k|} bcm.cc:_ZL22bn_less_than_word_maskPKmmm: 98| 32.0k| BN_ULONG b) { 99| 32.0k| if (b == 0) { ------------------ | Branch (99:7): [True: 0, False: 32.0k] ------------------ 100| 0| return CONSTTIME_FALSE_W; ------------------ | | 228| 0|#define CONSTTIME_FALSE_W ((crypto_word_t)0) ------------------ 101| 0| } 102| 32.0k| if (len == 0) { ------------------ | Branch (102:7): [True: 0, False: 32.0k] ------------------ 103| 0| return CONSTTIME_TRUE_W; ------------------ | | 227| 0|#define CONSTTIME_TRUE_W ~((crypto_word_t)0) ------------------ 104| 0| } 105| | 106| | // |a| < |b| iff a[1..len-1] are all zero and a[0] < b. 107| 32.0k| static_assert(sizeof(BN_ULONG) <= sizeof(crypto_word_t), 108| 32.0k| "crypto_word_t is too small"); 109| 32.0k| crypto_word_t mask = 0; 110| 248k| for (size_t i = 1; i < len; i++) { ------------------ | Branch (110:22): [True: 216k, False: 32.0k] ------------------ 111| 216k| mask |= a[i]; 112| 216k| } 113| | // |mask| is now zero iff a[1..len-1] are all zero. 114| 32.0k| mask = constant_time_is_zero_w(mask); 115| 32.0k| mask &= constant_time_lt_w(a[0], b); 116| 32.0k| return mask; 117| 32.0k|} bcm.cc:_ZL16bn_range_to_maskPmS_mPKmm: 127| 31.6k| size_t len) { 128| | // The magnitude of |max_exclusive| is assumed public. 129| 31.6k| size_t words = len; 130| 31.6k| while (words > 0 && max_exclusive[words - 1] == 0) { ------------------ | Branch (130:10): [True: 31.6k, False: 0] | Branch (130:23): [True: 0, False: 31.6k] ------------------ 131| 0| words--; 132| 0| } 133| 31.6k| if (words == 0 || (words == 1 && max_exclusive[0] <= min_inclusive)) { ------------------ | Branch (133:7): [True: 0, False: 31.6k] | Branch (133:22): [True: 0, False: 31.6k] | Branch (133:36): [True: 0, False: 0] ------------------ 134| 0| OPENSSL_PUT_ERROR(BN, BN_R_INVALID_RANGE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 135| 0| return 0; 136| 0| } 137| 31.6k| BN_ULONG mask = max_exclusive[words - 1]; 138| | // This sets all bits in |mask| below the most significant bit. 139| 31.6k| mask |= mask >> 1; 140| 31.6k| mask |= mask >> 2; 141| 31.6k| mask |= mask >> 4; 142| 31.6k| mask |= mask >> 8; 143| 31.6k| mask |= mask >> 16; 144| 31.6k|#if defined(OPENSSL_64_BIT) 145| 31.6k| mask |= mask >> 32; 146| 31.6k|#endif 147| | 148| 31.6k| *out_words = words; 149| 31.6k| *out_mask = mask; 150| 31.6k| return 1; 151| 31.6k|} rsaz_avx2_preferred: 49| 56.0k|inline int rsaz_avx2_preferred(void) { 50| 56.0k| if (CRYPTO_is_BMI1_capable() && CRYPTO_is_BMI2_capable() && ------------------ | Branch (50:7): [True: 56.0k, False: 0] | Branch (50:35): [True: 56.0k, False: 0] ------------------ 51| 56.0k| CRYPTO_is_ADX_capable()) { ------------------ | Branch (51:7): [True: 56.0k, False: 0] ------------------ 52| | // If BMI1, BMI2, and ADX are available, x86_64-mont5.pl is faster. See the 53| | // .Lmulx4x_enter and .Lpowerx5_enter branches. 54| 56.0k| return 0; 55| 56.0k| } 56| 0| return CRYPTO_is_AVX2_capable(); 57| 56.0k|} BN_lshift: 25| 19.4k|int BN_lshift(BIGNUM *r, const BIGNUM *a, int n) { 26| 19.4k| int i, nw, lb, rb; 27| 19.4k| BN_ULONG *t, *f; 28| 19.4k| BN_ULONG l; 29| | 30| 19.4k| if (n < 0) { ------------------ | Branch (30:7): [True: 0, False: 19.4k] ------------------ 31| 0| OPENSSL_PUT_ERROR(BN, BN_R_NEGATIVE_NUMBER); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 32| 0| return 0; 33| 0| } 34| | 35| 19.4k| r->neg = a->neg; 36| 19.4k| nw = n / BN_BITS2; ------------------ | | 42| 19.4k|#define BN_BITS2 64 ------------------ 37| 19.4k| if (!bn_wexpand(r, a->width + nw + 1)) { ------------------ | Branch (37:7): [True: 0, False: 19.4k] ------------------ 38| 0| return 0; 39| 0| } 40| 19.4k| lb = n % BN_BITS2; ------------------ | | 42| 19.4k|#define BN_BITS2 64 ------------------ 41| 19.4k| rb = BN_BITS2 - lb; ------------------ | | 42| 19.4k|#define BN_BITS2 64 ------------------ 42| 19.4k| f = a->d; 43| 19.4k| t = r->d; 44| 19.4k| t[a->width + nw] = 0; 45| 19.4k| if (lb == 0) { ------------------ | Branch (45:7): [True: 16.2k, False: 3.24k] ------------------ 46| 487k| for (i = a->width - 1; i >= 0; i--) { ------------------ | Branch (46:28): [True: 471k, False: 16.2k] ------------------ 47| 471k| t[nw + i] = f[i]; 48| 471k| } 49| 16.2k| } else { 50| 157k| for (i = a->width - 1; i >= 0; i--) { ------------------ | Branch (50:28): [True: 154k, False: 3.24k] ------------------ 51| 154k| l = f[i]; 52| 154k| t[nw + i + 1] |= l >> rb; 53| 154k| t[nw + i] = l << lb; 54| 154k| } 55| 3.24k| } 56| 19.4k| OPENSSL_memset(t, 0, nw * sizeof(t[0])); 57| 19.4k| r->width = a->width + nw + 1; 58| 19.4k| bn_set_minimal_width(r); 59| | 60| 19.4k| return 1; 61| 19.4k|} bn_rshift_words: 95| 1.27M| size_t num) { 96| 1.27M| unsigned shift_bits = shift % BN_BITS2; ------------------ | | 42| 1.27M|#define BN_BITS2 64 ------------------ 97| 1.27M| size_t shift_words = shift / BN_BITS2; ------------------ | | 42| 1.27M|#define BN_BITS2 64 ------------------ 98| 1.27M| if (shift_words >= num) { ------------------ | Branch (98:7): [True: 0, False: 1.27M] ------------------ 99| 0| OPENSSL_memset(r, 0, num * sizeof(BN_ULONG)); 100| 0| return; 101| 0| } 102| 1.27M| if (shift_bits == 0) { ------------------ | Branch (102:7): [True: 8.10k, False: 1.26M] ------------------ 103| 8.10k| OPENSSL_memmove(r, a + shift_words, (num - shift_words) * sizeof(BN_ULONG)); 104| 1.26M| } else { 105| 20.9M| for (size_t i = shift_words; i < num - 1; i++) { ------------------ | Branch (105:34): [True: 19.7M, False: 1.26M] ------------------ 106| 19.7M| r[i - shift_words] = 107| 19.7M| (a[i] >> shift_bits) | (a[i + 1] << (BN_BITS2 - shift_bits)); ------------------ | | 42| 19.7M|#define BN_BITS2 64 ------------------ 108| 19.7M| } 109| 1.26M| r[num - 1 - shift_words] = a[num - 1] >> shift_bits; 110| 1.26M| } 111| 1.27M| OPENSSL_memset(r + num - shift_words, 0, shift_words * sizeof(BN_ULONG)); 112| 1.27M|} BN_rshift: 114| 1.27M|int BN_rshift(BIGNUM *r, const BIGNUM *a, int n) { 115| 1.27M| if (n < 0) { ------------------ | Branch (115:7): [True: 0, False: 1.27M] ------------------ 116| 0| OPENSSL_PUT_ERROR(BN, BN_R_NEGATIVE_NUMBER); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 117| 0| return 0; 118| 0| } 119| | 120| 1.27M| if (!bn_wexpand(r, a->width)) { ------------------ | Branch (120:7): [True: 0, False: 1.27M] ------------------ 121| 0| return 0; 122| 0| } 123| 1.27M| bn_rshift_words(r->d, a->d, n, a->width); 124| 1.27M| r->neg = a->neg; 125| 1.27M| r->width = a->width; 126| 1.27M| bn_set_minimal_width(r); 127| 1.27M| return 1; 128| 1.27M|} bn_rshift1_words: 152| 2.53M|void bn_rshift1_words(BN_ULONG *r, const BN_ULONG *a, size_t num) { 153| 2.53M| if (num == 0) { ------------------ | Branch (153:7): [True: 0, False: 2.53M] ------------------ 154| 0| return; 155| 0| } 156| 82.8M| for (size_t i = 0; i < num - 1; i++) { ------------------ | Branch (156:22): [True: 80.2M, False: 2.53M] ------------------ 157| 80.2M| r[i] = (a[i] >> 1) | (a[i + 1] << (BN_BITS2 - 1)); ------------------ | | 42| 80.2M|#define BN_BITS2 64 ------------------ 158| 80.2M| } 159| 2.53M| r[num - 1] = a[num - 1] >> 1; 160| 2.53M|} BN_rshift1: 162| 2.53M|int BN_rshift1(BIGNUM *r, const BIGNUM *a) { 163| 2.53M| if (!bn_wexpand(r, a->width)) { ------------------ | Branch (163:7): [True: 0, False: 2.53M] ------------------ 164| 0| return 0; 165| 0| } 166| 2.53M| bn_rshift1_words(r->d, a->d, a->width); 167| 2.53M| r->width = a->width; 168| 2.53M| r->neg = a->neg; 169| 2.53M| bn_set_minimal_width(r); 170| 2.53M| return 1; 171| 2.53M|} BN_set_bit: 173| 9.39k|int BN_set_bit(BIGNUM *a, int n) { 174| 9.39k| if (n < 0) { ------------------ | Branch (174:7): [True: 0, False: 9.39k] ------------------ 175| 0| return 0; 176| 0| } 177| | 178| 9.39k| int i = n / BN_BITS2; ------------------ | | 42| 9.39k|#define BN_BITS2 64 ------------------ 179| 9.39k| int j = n % BN_BITS2; ------------------ | | 42| 9.39k|#define BN_BITS2 64 ------------------ 180| 9.39k| if (a->width <= i) { ------------------ | Branch (180:7): [True: 9.39k, False: 0] ------------------ 181| 9.39k| if (!bn_wexpand(a, i + 1)) { ------------------ | Branch (181:9): [True: 0, False: 9.39k] ------------------ 182| 0| return 0; 183| 0| } 184| 415k| for (int k = a->width; k < i + 1; k++) { ------------------ | Branch (184:28): [True: 406k, False: 9.39k] ------------------ 185| 406k| a->d[k] = 0; 186| 406k| } 187| 9.39k| a->width = i + 1; 188| 9.39k| } 189| | 190| 9.39k| a->d[i] |= (((BN_ULONG)1) << j); 191| | 192| 9.39k| return 1; 193| 9.39k|} bn_is_bit_set_words: 213| 52.3M|int bn_is_bit_set_words(const BN_ULONG *a, size_t num, size_t bit) { 214| 52.3M| size_t i = bit / BN_BITS2; ------------------ | | 42| 52.3M|#define BN_BITS2 64 ------------------ 215| 52.3M| size_t j = bit % BN_BITS2; ------------------ | | 42| 52.3M|#define BN_BITS2 64 ------------------ 216| 52.3M| if (i >= num) { ------------------ | Branch (216:7): [True: 66.2k, False: 52.3M] ------------------ 217| 66.2k| return 0; 218| 66.2k| } 219| 52.3M| return (a[i] >> j) & 1; 220| 52.3M|} BN_is_bit_set: 222| 5.94M|int BN_is_bit_set(const BIGNUM *a, int n) { 223| 5.94M| if (n < 0) { ------------------ | Branch (223:7): [True: 0, False: 5.94M] ------------------ 224| 0| return 0; 225| 0| } 226| 5.94M| return bn_is_bit_set_words(a->d, a->width, n); 227| 5.94M|} EVP_AEAD_key_length: 28| 168k|size_t EVP_AEAD_key_length(const EVP_AEAD *aead) { return aead->key_len; } EVP_AEAD_nonce_length: 30| 210k|size_t EVP_AEAD_nonce_length(const EVP_AEAD *aead) { return aead->nonce_len; } EVP_AEAD_CTX_zero: 36| 215k|void EVP_AEAD_CTX_zero(EVP_AEAD_CTX *ctx) { 37| 215k| OPENSSL_memset(ctx, 0, sizeof(EVP_AEAD_CTX)); 38| 215k|} EVP_AEAD_CTX_init_with_direction: 80| 104k| enum evp_aead_direction_t dir) { 81| 104k| if (key_len != aead->key_len) { ------------------ | Branch (81:7): [True: 0, False: 104k] ------------------ 82| 0| OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_UNSUPPORTED_KEY_SIZE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 83| 0| ctx->aead = NULL; 84| 0| return 0; 85| 0| } 86| | 87| 104k| ctx->aead = aead; 88| | 89| 104k| int ok; 90| 104k| if (aead->init) { ------------------ | Branch (90:7): [True: 40.3k, False: 64.0k] ------------------ 91| 40.3k| ok = aead->init(ctx, key, key_len, tag_len); 92| 64.0k| } else { 93| 64.0k| ok = aead->init_with_direction(ctx, key, key_len, tag_len, dir); 94| 64.0k| } 95| | 96| 104k| if (!ok) { ------------------ | Branch (96:7): [True: 0, False: 104k] ------------------ 97| 0| ctx->aead = NULL; 98| 0| } 99| | 100| 104k| return ok; 101| 104k|} EVP_AEAD_CTX_cleanup: 103| 215k|void EVP_AEAD_CTX_cleanup(EVP_AEAD_CTX *ctx) { 104| 215k| if (ctx->aead == NULL) { ------------------ | Branch (104:7): [True: 110k, False: 104k] ------------------ 105| 110k| return; 106| 110k| } 107| 104k| ctx->aead->cleanup(ctx); 108| 104k| ctx->aead = NULL; 109| 104k|} EVP_CIPHER_CTX_init: 30| 64.0k|void EVP_CIPHER_CTX_init(EVP_CIPHER_CTX *ctx) { 31| 64.0k| OPENSSL_memset(ctx, 0, sizeof(EVP_CIPHER_CTX)); 32| 64.0k|} EVP_CIPHER_CTX_cleanup: 43| 64.0k|int EVP_CIPHER_CTX_cleanup(EVP_CIPHER_CTX *c) { 44| 64.0k| if (c->cipher != NULL && c->cipher->cleanup) { ------------------ | Branch (44:7): [True: 64.0k, False: 0] | Branch (44:28): [True: 0, False: 64.0k] ------------------ 45| 0| c->cipher->cleanup(c); 46| 0| } 47| 64.0k| OPENSSL_free(c->cipher_data); 48| | 49| 64.0k| OPENSSL_memset(c, 0, sizeof(EVP_CIPHER_CTX)); 50| 64.0k| return 1; 51| 64.0k|} EVP_CipherInit_ex: 100| 64.0k| int enc) { 101| 64.0k| if (enc == -1) { ------------------ | Branch (101:7): [True: 0, False: 64.0k] ------------------ 102| 0| enc = ctx->encrypt; 103| 64.0k| } else { 104| 64.0k| if (enc) { ------------------ | Branch (104:9): [True: 32.2k, False: 31.8k] ------------------ 105| 32.2k| enc = 1; 106| 32.2k| } 107| 64.0k| ctx->encrypt = enc; 108| 64.0k| } 109| | 110| 64.0k| if (cipher) { ------------------ | Branch (110:7): [True: 64.0k, False: 0] ------------------ 111| | // Ensure a context left from last time is cleared (the previous check 112| | // attempted to avoid this if the same ENGINE and EVP_CIPHER could be 113| | // used). 114| 64.0k| if (ctx->cipher) { ------------------ | Branch (114:9): [True: 0, False: 64.0k] ------------------ 115| 0| EVP_CIPHER_CTX_cleanup(ctx); 116| | // Restore encrypt and flags 117| 0| ctx->encrypt = enc; 118| 0| } 119| | 120| 64.0k| ctx->cipher = cipher; 121| 64.0k| if (ctx->cipher->ctx_size) { ------------------ | Branch (121:9): [True: 64.0k, False: 0] ------------------ 122| 64.0k| ctx->cipher_data = OPENSSL_malloc(ctx->cipher->ctx_size); 123| 64.0k| if (!ctx->cipher_data) { ------------------ | Branch (123:11): [True: 0, False: 64.0k] ------------------ 124| 0| ctx->cipher = NULL; 125| 0| return 0; 126| 0| } 127| 64.0k| } else { 128| 0| ctx->cipher_data = NULL; 129| 0| } 130| | 131| 64.0k| ctx->key_len = cipher->key_len; 132| 64.0k| ctx->flags = 0; 133| | 134| 64.0k| if (ctx->cipher->flags & EVP_CIPH_CTRL_INIT) { ------------------ | | 340| 64.0k|#define EVP_CIPH_CTRL_INIT 0x200 ------------------ | Branch (134:9): [True: 0, False: 64.0k] ------------------ 135| 0| if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_INIT, 0, NULL)) { ------------------ | | 500| 0|#define EVP_CTRL_INIT 0x0 ------------------ | Branch (135:11): [True: 0, False: 0] ------------------ 136| 0| ctx->cipher = NULL; 137| 0| OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_INITIALIZATION_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 138| 0| return 0; 139| 0| } 140| 0| } 141| 64.0k| } else if (!ctx->cipher) { ------------------ | Branch (141:14): [True: 0, False: 0] ------------------ 142| 0| OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_NO_CIPHER_SET); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 143| 0| return 0; 144| 0| } 145| | 146| | // we assume block size is a power of 2 in *cryptUpdate 147| 64.0k| assert(ctx->cipher->block_size == 1 || ctx->cipher->block_size == 8 || 148| 64.0k| ctx->cipher->block_size == 16); 149| | 150| 64.0k| if (!(EVP_CIPHER_CTX_flags(ctx) & EVP_CIPH_CUSTOM_IV)) { ------------------ | | 336| 64.0k|#define EVP_CIPH_CUSTOM_IV 0x100 ------------------ | Branch (150:7): [True: 64.0k, False: 0] ------------------ 151| 64.0k| switch (EVP_CIPHER_CTX_mode(ctx)) { 152| 0| case EVP_CIPH_STREAM_CIPHER: ------------------ | | 307| 0|#define EVP_CIPH_STREAM_CIPHER 0x0 ------------------ | Branch (152:7): [True: 0, False: 64.0k] ------------------ 153| 0| case EVP_CIPH_ECB_MODE: ------------------ | | 308| 0|#define EVP_CIPH_ECB_MODE 0x1 ------------------ | Branch (153:7): [True: 0, False: 64.0k] ------------------ 154| 0| break; 155| | 156| 0| case EVP_CIPH_CFB_MODE: ------------------ | | 310| 0|#define EVP_CIPH_CFB_MODE 0x3 ------------------ | Branch (156:7): [True: 0, False: 64.0k] ------------------ 157| 0| ctx->num = 0; 158| 0| [[fallthrough]]; 159| | 160| 64.0k| case EVP_CIPH_CBC_MODE: ------------------ | | 309| 64.0k|#define EVP_CIPH_CBC_MODE 0x2 ------------------ | Branch (160:7): [True: 64.0k, False: 0] ------------------ 161| 64.0k| assert(EVP_CIPHER_CTX_iv_length(ctx) <= sizeof(ctx->iv)); 162| 64.0k| if (iv) { ------------------ | Branch (162:13): [True: 1.86k, False: 62.2k] ------------------ 163| 1.86k| OPENSSL_memcpy(ctx->oiv, iv, EVP_CIPHER_CTX_iv_length(ctx)); 164| 1.86k| } 165| 64.0k| OPENSSL_memcpy(ctx->iv, ctx->oiv, EVP_CIPHER_CTX_iv_length(ctx)); 166| 64.0k| break; 167| | 168| 0| case EVP_CIPH_CTR_MODE: ------------------ | | 312| 0|#define EVP_CIPH_CTR_MODE 0x5 ------------------ | Branch (168:7): [True: 0, False: 64.0k] ------------------ 169| 0| case EVP_CIPH_OFB_MODE: ------------------ | | 311| 0|#define EVP_CIPH_OFB_MODE 0x4 ------------------ | Branch (169:7): [True: 0, False: 64.0k] ------------------ 170| 0| ctx->num = 0; 171| | // Don't reuse IV for CTR mode 172| 0| if (iv) { ------------------ | Branch (172:13): [True: 0, False: 0] ------------------ 173| 0| OPENSSL_memcpy(ctx->iv, iv, EVP_CIPHER_CTX_iv_length(ctx)); 174| 0| } 175| 0| break; 176| | 177| 0| default: ------------------ | Branch (177:7): [True: 0, False: 64.0k] ------------------ 178| 0| return 0; 179| 64.0k| } 180| 64.0k| } 181| | 182| 64.0k| if (key || (ctx->cipher->flags & EVP_CIPH_ALWAYS_CALL_INIT)) { ------------------ | | 332| 0|#define EVP_CIPH_ALWAYS_CALL_INIT 0x80 ------------------ | Branch (182:7): [True: 64.0k, False: 0] | Branch (182:14): [True: 0, False: 0] ------------------ 183| 64.0k| if (!ctx->cipher->init(ctx, key, iv, enc)) { ------------------ | Branch (183:9): [True: 0, False: 64.0k] ------------------ 184| 0| return 0; 185| 0| } 186| 64.0k| } 187| | 188| 64.0k| ctx->buf_len = 0; 189| 64.0k| ctx->final_used = 0; 190| | // Clear the poisoned flag to permit re-use of a CTX that previously had a 191| | // failed operation. 192| 64.0k| ctx->poisoned = 0; 193| 64.0k| return 1; 194| 64.0k|} EVP_CIPHER_CTX_iv_length: 544| 130k|unsigned EVP_CIPHER_CTX_iv_length(const EVP_CIPHER_CTX *ctx) { 545| 130k| if (EVP_CIPHER_mode(ctx->cipher) == EVP_CIPH_GCM_MODE) { ------------------ | | 313| 130k|#define EVP_CIPH_GCM_MODE 0x6 ------------------ | Branch (545:7): [True: 0, False: 130k] ------------------ 546| 0| int length; 547| 0| int res = EVP_CIPHER_CTX_ctrl((EVP_CIPHER_CTX *)ctx, EVP_CTRL_GET_IVLEN, 0, ------------------ | | 517| 0|#define EVP_CTRL_GET_IVLEN 0x19 ------------------ 548| 0| &length); 549| | // EVP_CIPHER_CTX_ctrl returning an error should be impossible under this 550| | // circumstance. If it somehow did, fallback to the static cipher iv_len. 551| 0| if (res == 1) { ------------------ | Branch (551:9): [True: 0, False: 0] ------------------ 552| 0| return length; 553| 0| } 554| 0| } 555| 130k| return ctx->cipher->iv_len; 556| 130k|} EVP_CIPHER_CTX_flags: 566| 64.0k|uint32_t EVP_CIPHER_CTX_flags(const EVP_CIPHER_CTX *ctx) { 567| 64.0k| return ctx->cipher->flags & ~EVP_CIPH_MODE_MASK; ------------------ | | 32| 64.0k|#define EVP_CIPH_MODE_MASK 0x3f ------------------ 568| 64.0k|} EVP_CIPHER_CTX_mode: 570| 64.0k|uint32_t EVP_CIPHER_CTX_mode(const EVP_CIPHER_CTX *ctx) { 571| 64.0k| return ctx->cipher->flags & EVP_CIPH_MODE_MASK; ------------------ | | 32| 64.0k|#define EVP_CIPH_MODE_MASK 0x3f ------------------ 572| 64.0k|} EVP_CIPHER_CTX_set_padding: 595| 64.0k|int EVP_CIPHER_CTX_set_padding(EVP_CIPHER_CTX *ctx, int pad) { 596| 64.0k| if (pad) { ------------------ | Branch (596:7): [True: 0, False: 64.0k] ------------------ 597| 0| ctx->flags &= ~EVP_CIPH_NO_PADDING; ------------------ | | 497| 0|#define EVP_CIPH_NO_PADDING 0x800 ------------------ 598| 64.0k| } else { 599| 64.0k| ctx->flags |= EVP_CIPH_NO_PADDING; ------------------ | | 497| 64.0k|#define EVP_CIPH_NO_PADDING 0x800 ------------------ 600| 64.0k| } 601| 64.0k| return 1; 602| 64.0k|} EVP_CIPHER_key_length: 624| 64.0k|unsigned EVP_CIPHER_key_length(const EVP_CIPHER *cipher) { 625| 64.0k| return cipher->key_len; 626| 64.0k|} EVP_CIPHER_iv_length: 628| 1.86k|unsigned EVP_CIPHER_iv_length(const EVP_CIPHER *cipher) { 629| 1.86k| return cipher->iv_len; 630| 1.86k|} EVP_CIPHER_mode: 636| 130k|uint32_t EVP_CIPHER_mode(const EVP_CIPHER *cipher) { 637| 130k| return cipher->flags & EVP_CIPH_MODE_MASK; ------------------ | | 32| 130k|#define EVP_CIPH_MODE_MASK 0x3f ------------------ 638| 130k|} EVP_has_aes_hardware: 1227| 56.4k|int EVP_has_aes_hardware(void) { 1228| 56.4k|#if defined(OPENSSL_X86) || defined(OPENSSL_X86_64) 1229| 56.4k| return hwaes_capable() && crypto_gcm_clmul_enabled(); ------------------ | Branch (1229:10): [True: 56.4k, False: 0] | Branch (1229:29): [True: 56.4k, False: 0] ------------------ 1230| |#elif defined(OPENSSL_ARM) || defined(OPENSSL_AARCH64) 1231| | return hwaes_capable() && CRYPTO_is_ARMv8_PMULL_capable(); 1232| |#else 1233| | return 0; 1234| |#endif 1235| 56.4k|} bcm.cc:_ZL23EVP_aes_128_cbc_do_initP13evp_cipher_st: 421| 1|DEFINE_METHOD_FUNCTION(EVP_CIPHER, EVP_aes_128_cbc) { 422| 1| memset(out, 0, sizeof(EVP_CIPHER)); 423| | 424| 1| out->nid = NID_aes_128_cbc; ------------------ | | 1891| 1|#define NID_aes_128_cbc 419 ------------------ 425| 1| out->block_size = 16; 426| 1| out->key_len = 16; 427| 1| out->iv_len = 16; 428| 1| out->ctx_size = sizeof(EVP_AES_KEY); 429| 1| out->flags = EVP_CIPH_CBC_MODE; ------------------ | | 309| 1|#define EVP_CIPH_CBC_MODE 0x2 ------------------ 430| 1| out->init = aes_init_key; 431| 1| out->cipher = aes_cbc_cipher; 432| 1|} bcm.cc:_ZL12aes_init_keyP17evp_cipher_ctx_stPKhS2_i: 61| 61.0k| const uint8_t *iv, int enc) { 62| 61.0k| int ret; 63| 61.0k| EVP_AES_KEY *dat = (EVP_AES_KEY *)ctx->cipher_data; 64| 61.0k| const int mode = ctx->cipher->flags & EVP_CIPH_MODE_MASK; ------------------ | | 32| 61.0k|#define EVP_CIPH_MODE_MASK 0x3f ------------------ 65| | 66| 61.0k| if (mode == EVP_CIPH_CTR_MODE) { ------------------ | | 312| 61.0k|#define EVP_CIPH_CTR_MODE 0x5 ------------------ | Branch (66:7): [True: 0, False: 61.0k] ------------------ 67| 0| switch (ctx->key_len) { ------------------ | Branch (67:13): [True: 0, False: 0] ------------------ 68| 0| case 16: ------------------ | Branch (68:7): [True: 0, False: 0] ------------------ 69| 0| boringssl_fips_inc_counter(fips_counter_evp_aes_128_ctr); 70| 0| break; 71| | 72| 0| case 32: ------------------ | Branch (72:7): [True: 0, False: 0] ------------------ 73| 0| boringssl_fips_inc_counter(fips_counter_evp_aes_256_ctr); 74| 0| break; 75| 0| } 76| 0| } 77| | 78| 61.0k| if ((mode == EVP_CIPH_ECB_MODE || mode == EVP_CIPH_CBC_MODE) && !enc) { ------------------ | | 308| 122k|#define EVP_CIPH_ECB_MODE 0x1 ------------------ if ((mode == EVP_CIPH_ECB_MODE || mode == EVP_CIPH_CBC_MODE) && !enc) { ------------------ | | 309| 61.0k|#define EVP_CIPH_CBC_MODE 0x2 ------------------ | Branch (78:8): [True: 0, False: 61.0k] | Branch (78:37): [True: 61.0k, False: 0] | Branch (78:67): [True: 30.4k, False: 30.6k] ------------------ 79| 30.4k| if (hwaes_capable()) { ------------------ | Branch (79:9): [True: 30.4k, False: 0] ------------------ 80| 30.4k| ret = aes_hw_set_decrypt_key(key, ctx->key_len * 8, &dat->ks.ks); 81| 30.4k| dat->block = aes_hw_decrypt; 82| 30.4k| dat->stream.cbc = NULL; 83| 30.4k| if (mode == EVP_CIPH_CBC_MODE) { ------------------ | | 309| 30.4k|#define EVP_CIPH_CBC_MODE 0x2 ------------------ | Branch (83:11): [True: 30.4k, False: 0] ------------------ 84| 30.4k| dat->stream.cbc = aes_hw_cbc_encrypt; 85| 30.4k| } 86| 30.4k| } else if (bsaes_capable() && mode == EVP_CIPH_CBC_MODE) { ------------------ | | 309| 0|#define EVP_CIPH_CBC_MODE 0x2 ------------------ | Branch (86:16): [True: 0, False: 0] | Branch (86:35): [True: 0, False: 0] ------------------ 87| 0| assert(vpaes_capable()); 88| 0| ret = vpaes_set_decrypt_key(key, ctx->key_len * 8, &dat->ks.ks); 89| 0| if (ret == 0) { ------------------ | Branch (89:11): [True: 0, False: 0] ------------------ 90| 0| vpaes_decrypt_key_to_bsaes(&dat->ks.ks, &dat->ks.ks); 91| 0| } 92| | // If |dat->stream.cbc| is provided, |dat->block| is never used. 93| 0| dat->block = NULL; 94| 0| dat->stream.cbc = bsaes_cbc_encrypt; 95| 0| } else if (vpaes_capable()) { ------------------ | Branch (95:16): [True: 0, False: 0] ------------------ 96| 0| ret = vpaes_set_decrypt_key(key, ctx->key_len * 8, &dat->ks.ks); 97| 0| dat->block = vpaes_decrypt; 98| 0| dat->stream.cbc = NULL; 99| 0|#if defined(VPAES_CBC) 100| 0| if (mode == EVP_CIPH_CBC_MODE) { ------------------ | | 309| 0|#define EVP_CIPH_CBC_MODE 0x2 ------------------ | Branch (100:11): [True: 0, False: 0] ------------------ 101| 0| dat->stream.cbc = vpaes_cbc_encrypt; 102| 0| } 103| 0|#endif 104| 0| } else { 105| 0| ret = aes_nohw_set_decrypt_key(key, ctx->key_len * 8, &dat->ks.ks); 106| 0| dat->block = aes_nohw_decrypt; 107| 0| dat->stream.cbc = NULL; 108| 0| if (mode == EVP_CIPH_CBC_MODE) { ------------------ | | 309| 0|#define EVP_CIPH_CBC_MODE 0x2 ------------------ | Branch (108:11): [True: 0, False: 0] ------------------ 109| 0| dat->stream.cbc = aes_nohw_cbc_encrypt; 110| 0| } 111| 0| } 112| 30.6k| } else if (hwaes_capable()) { ------------------ | Branch (112:14): [True: 30.6k, False: 0] ------------------ 113| 30.6k| ret = aes_hw_set_encrypt_key(key, ctx->key_len * 8, &dat->ks.ks); 114| 30.6k| dat->block = aes_hw_encrypt; 115| 30.6k| dat->stream.cbc = NULL; 116| 30.6k| if (mode == EVP_CIPH_CBC_MODE) { ------------------ | | 309| 30.6k|#define EVP_CIPH_CBC_MODE 0x2 ------------------ | Branch (116:9): [True: 30.6k, False: 0] ------------------ 117| 30.6k| dat->stream.cbc = aes_hw_cbc_encrypt; 118| 30.6k| } else if (mode == EVP_CIPH_CTR_MODE) { ------------------ | | 312| 0|#define EVP_CIPH_CTR_MODE 0x5 ------------------ | Branch (118:16): [True: 0, False: 0] ------------------ 119| 0| dat->stream.ctr = aes_hw_ctr32_encrypt_blocks; 120| 0| } 121| 30.6k| } else if (vpaes_capable()) { ------------------ | Branch (121:14): [True: 0, False: 0] ------------------ 122| 0| ret = vpaes_set_encrypt_key(key, ctx->key_len * 8, &dat->ks.ks); 123| 0| dat->block = vpaes_encrypt; 124| 0| dat->stream.cbc = NULL; 125| 0|#if defined(VPAES_CBC) 126| 0| if (mode == EVP_CIPH_CBC_MODE) { ------------------ | | 309| 0|#define EVP_CIPH_CBC_MODE 0x2 ------------------ | Branch (126:9): [True: 0, False: 0] ------------------ 127| 0| dat->stream.cbc = vpaes_cbc_encrypt; 128| 0| } 129| 0|#endif 130| 0| if (mode == EVP_CIPH_CTR_MODE) { ------------------ | | 312| 0|#define EVP_CIPH_CTR_MODE 0x5 ------------------ | Branch (130:9): [True: 0, False: 0] ------------------ 131| |#if defined(BSAES) 132| | assert(bsaes_capable()); 133| | dat->stream.ctr = vpaes_ctr32_encrypt_blocks_with_bsaes; 134| |#else 135| 0| dat->stream.ctr = vpaes_ctr32_encrypt_blocks; 136| 0|#endif 137| 0| } 138| 0| } else { 139| 0| ret = aes_nohw_set_encrypt_key(key, ctx->key_len * 8, &dat->ks.ks); 140| 0| dat->block = aes_nohw_encrypt; 141| 0| dat->stream.cbc = NULL; 142| 0| if (mode == EVP_CIPH_CBC_MODE) { ------------------ | | 309| 0|#define EVP_CIPH_CBC_MODE 0x2 ------------------ | Branch (142:9): [True: 0, False: 0] ------------------ 143| 0| dat->stream.cbc = aes_nohw_cbc_encrypt; 144| 0| } else if (mode == EVP_CIPH_CTR_MODE) { ------------------ | | 312| 0|#define EVP_CIPH_CTR_MODE 0x5 ------------------ | Branch (144:16): [True: 0, False: 0] ------------------ 145| 0| dat->stream.ctr = aes_nohw_ctr32_encrypt_blocks; 146| 0| } 147| 0| } 148| | 149| 61.0k| if (ret < 0) { ------------------ | Branch (149:7): [True: 0, False: 61.0k] ------------------ 150| 0| OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_AES_KEY_SETUP_FAILED); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 151| 0| return 0; 152| 0| } 153| | 154| 61.0k| return 1; 155| 61.0k|} bcm.cc:_ZL23EVP_aes_256_cbc_do_initP13evp_cipher_st: 557| 1|DEFINE_METHOD_FUNCTION(EVP_CIPHER, EVP_aes_256_cbc) { 558| 1| memset(out, 0, sizeof(EVP_CIPHER)); 559| | 560| 1| out->nid = NID_aes_256_cbc; ------------------ | | 1931| 1|#define NID_aes_256_cbc 427 ------------------ 561| 1| out->block_size = 16; 562| 1| out->key_len = 32; 563| 1| out->iv_len = 16; 564| 1| out->ctx_size = sizeof(EVP_AES_KEY); 565| 1| out->flags = EVP_CIPH_CBC_MODE; ------------------ | | 309| 1|#define EVP_CIPH_CBC_MODE 0x2 ------------------ 566| 1| out->init = aes_init_key; 567| 1| out->cipher = aes_cbc_cipher; 568| 1|} bcm.cc:_ZL22aead_aes_gcm_init_implPN12_GLOBAL__N_116aead_aes_gcm_ctxEPmPKhmm: 710| 40.3k| size_t key_len, size_t tag_len) { 711| 40.3k| const size_t key_bits = key_len * 8; 712| 40.3k| if (key_bits != 128 && key_bits != 192 && key_bits != 256) { ------------------ | Branch (712:7): [True: 10.0k, False: 30.2k] | Branch (712:26): [True: 10.0k, False: 0] | Branch (712:45): [True: 0, False: 10.0k] ------------------ 713| 0| OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_KEY_LENGTH); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 714| 0| return 0; // EVP_AEAD_CTX_init should catch this. 715| 0| } 716| | 717| 40.3k| if (tag_len == EVP_AEAD_DEFAULT_TAG_LENGTH) { ------------------ | | 252| 40.3k|#define EVP_AEAD_DEFAULT_TAG_LENGTH 0 ------------------ | Branch (717:7): [True: 40.3k, False: 0] ------------------ 718| 40.3k| tag_len = EVP_AEAD_AES_GCM_TAG_LEN; ------------------ | | 700| 40.3k|#define EVP_AEAD_AES_GCM_TAG_LEN 16 ------------------ 719| 40.3k| } 720| | 721| 40.3k| if (tag_len > EVP_AEAD_AES_GCM_TAG_LEN) { ------------------ | | 700| 40.3k|#define EVP_AEAD_AES_GCM_TAG_LEN 16 ------------------ | Branch (721:7): [True: 0, False: 40.3k] ------------------ 722| 0| OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_TAG_TOO_LARGE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 723| 0| return 0; 724| 0| } 725| | 726| 40.3k| CRYPTO_gcm128_init_aes_key(&gcm_ctx->key, key, key_len); 727| 40.3k| *out_tag_len = tag_len; 728| 40.3k| return 1; 729| 40.3k|} bcm.cc:_ZL20aead_aes_gcm_cleanupP15evp_aead_ctx_st: 752| 40.3k|static void aead_aes_gcm_cleanup(EVP_AEAD_CTX *ctx) {} bcm.cc:_ZL34EVP_aead_aes_128_gcm_tls12_do_initP11evp_aead_st: 1091| 1|DEFINE_METHOD_FUNCTION(EVP_AEAD, EVP_aead_aes_128_gcm_tls12) { 1092| 1| memset(out, 0, sizeof(EVP_AEAD)); 1093| | 1094| 1| out->key_len = 16; 1095| 1| out->nonce_len = AES_GCM_NONCE_LENGTH; ------------------ | | 34| 1|#define AES_GCM_NONCE_LENGTH 12 ------------------ 1096| 1| out->overhead = EVP_AEAD_AES_GCM_TAG_LEN; ------------------ | | 700| 1|#define EVP_AEAD_AES_GCM_TAG_LEN 16 ------------------ 1097| 1| out->max_tag_len = EVP_AEAD_AES_GCM_TAG_LEN; ------------------ | | 700| 1|#define EVP_AEAD_AES_GCM_TAG_LEN 16 ------------------ 1098| 1| out->seal_scatter_supports_extra_in = 1; 1099| | 1100| 1| out->init = aead_aes_gcm_tls12_init; 1101| 1| out->cleanup = aead_aes_gcm_cleanup; 1102| 1| out->seal_scatter = aead_aes_gcm_tls12_seal_scatter; 1103| 1| out->open_gather = aead_aes_gcm_open_gather; 1104| 1|} bcm.cc:_ZL23aead_aes_gcm_tls12_initP15evp_aead_ctx_stPKhmm: 1042| 39.6k| size_t key_len, size_t requested_tag_len) { 1043| 39.6k| struct aead_aes_gcm_tls12_ctx *gcm_ctx = 1044| 39.6k| (struct aead_aes_gcm_tls12_ctx *)&ctx->state; 1045| | 1046| 39.6k| gcm_ctx->min_next_nonce = 0; 1047| | 1048| 39.6k| size_t actual_tag_len; 1049| 39.6k| if (!aead_aes_gcm_init_impl(&gcm_ctx->gcm_ctx, &actual_tag_len, key, key_len, ------------------ | Branch (1049:7): [True: 0, False: 39.6k] ------------------ 1050| 39.6k| requested_tag_len)) { 1051| 0| return 0; 1052| 0| } 1053| | 1054| 39.6k| ctx->tag_len = actual_tag_len; 1055| 39.6k| return 1; 1056| 39.6k|} bcm.cc:_ZL34EVP_aead_aes_256_gcm_tls12_do_initP11evp_aead_st: 1106| 1|DEFINE_METHOD_FUNCTION(EVP_AEAD, EVP_aead_aes_256_gcm_tls12) { 1107| 1| memset(out, 0, sizeof(EVP_AEAD)); 1108| | 1109| 1| out->key_len = 32; 1110| 1| out->nonce_len = AES_GCM_NONCE_LENGTH; ------------------ | | 34| 1|#define AES_GCM_NONCE_LENGTH 12 ------------------ 1111| 1| out->overhead = EVP_AEAD_AES_GCM_TAG_LEN; ------------------ | | 700| 1|#define EVP_AEAD_AES_GCM_TAG_LEN 16 ------------------ 1112| 1| out->max_tag_len = EVP_AEAD_AES_GCM_TAG_LEN; ------------------ | | 700| 1|#define EVP_AEAD_AES_GCM_TAG_LEN 16 ------------------ 1113| 1| out->seal_scatter_supports_extra_in = 1; 1114| | 1115| 1| out->init = aead_aes_gcm_tls12_init; 1116| 1| out->cleanup = aead_aes_gcm_cleanup; 1117| 1| out->seal_scatter = aead_aes_gcm_tls12_seal_scatter; 1118| 1| out->open_gather = aead_aes_gcm_open_gather; 1119| 1|} bcm.cc:_ZL34EVP_aead_aes_128_gcm_tls13_do_initP11evp_aead_st: 1197| 1|DEFINE_METHOD_FUNCTION(EVP_AEAD, EVP_aead_aes_128_gcm_tls13) { 1198| 1| memset(out, 0, sizeof(EVP_AEAD)); 1199| | 1200| 1| out->key_len = 16; 1201| 1| out->nonce_len = AES_GCM_NONCE_LENGTH; ------------------ | | 34| 1|#define AES_GCM_NONCE_LENGTH 12 ------------------ 1202| 1| out->overhead = EVP_AEAD_AES_GCM_TAG_LEN; ------------------ | | 700| 1|#define EVP_AEAD_AES_GCM_TAG_LEN 16 ------------------ 1203| 1| out->max_tag_len = EVP_AEAD_AES_GCM_TAG_LEN; ------------------ | | 700| 1|#define EVP_AEAD_AES_GCM_TAG_LEN 16 ------------------ 1204| 1| out->seal_scatter_supports_extra_in = 1; 1205| | 1206| 1| out->init = aead_aes_gcm_tls13_init; 1207| 1| out->cleanup = aead_aes_gcm_cleanup; 1208| 1| out->seal_scatter = aead_aes_gcm_tls13_seal_scatter; 1209| 1| out->open_gather = aead_aes_gcm_open_gather; 1210| 1|} bcm.cc:_ZL23aead_aes_gcm_tls13_initP15evp_aead_ctx_stPKhmm: 1137| 694| size_t key_len, size_t requested_tag_len) { 1138| 694| struct aead_aes_gcm_tls13_ctx *gcm_ctx = 1139| 694| (struct aead_aes_gcm_tls13_ctx *)&ctx->state; 1140| | 1141| 694| gcm_ctx->min_next_nonce = 0; 1142| | 1143| 694| size_t actual_tag_len; 1144| 694| if (!aead_aes_gcm_init_impl(&gcm_ctx->gcm_ctx, &actual_tag_len, key, key_len, ------------------ | Branch (1144:7): [True: 0, False: 694] ------------------ 1145| 694| requested_tag_len)) { 1146| 0| return 0; 1147| 0| } 1148| | 1149| 694| ctx->tag_len = actual_tag_len; 1150| 694| return 1; 1151| 694|} bcm.cc:_ZL34EVP_aead_aes_256_gcm_tls13_do_initP11evp_aead_st: 1212| 1|DEFINE_METHOD_FUNCTION(EVP_AEAD, EVP_aead_aes_256_gcm_tls13) { 1213| 1| memset(out, 0, sizeof(EVP_AEAD)); 1214| | 1215| 1| out->key_len = 32; 1216| 1| out->nonce_len = AES_GCM_NONCE_LENGTH; ------------------ | | 34| 1|#define AES_GCM_NONCE_LENGTH 12 ------------------ 1217| 1| out->overhead = EVP_AEAD_AES_GCM_TAG_LEN; ------------------ | | 700| 1|#define EVP_AEAD_AES_GCM_TAG_LEN 16 ------------------ 1218| 1| out->max_tag_len = EVP_AEAD_AES_GCM_TAG_LEN; ------------------ | | 700| 1|#define EVP_AEAD_AES_GCM_TAG_LEN 16 ------------------ 1219| 1| out->seal_scatter_supports_extra_in = 1; 1220| | 1221| 1| out->init = aead_aes_gcm_tls13_init; 1222| 1| out->cleanup = aead_aes_gcm_cleanup; 1223| 1| out->seal_scatter = aead_aes_gcm_tls13_seal_scatter; 1224| 1| out->open_gather = aead_aes_gcm_open_gather; 1225| 1|} BN_value_one: 66| 4| accessor_decorations type *name(void) { \ 67| 4| CRYPTO_once(name##_once_bss_get(), name##_init); \ 68| 4| /* See http://c-faq.com/ansi/constmismatch.html for why the following \ 69| 4| * cast is needed. */ \ 70| 4| return (const type *)name##_storage_bss_get(); \ 71| 4| } \ EVP_aes_128_cbc: 66| 3.37k| accessor_decorations type *name(void) { \ 67| 3.37k| CRYPTO_once(name##_once_bss_get(), name##_init); \ 68| 3.37k| /* See http://c-faq.com/ansi/constmismatch.html for why the following \ 69| 3.37k| * cast is needed. */ \ 70| 3.37k| return (const type *)name##_storage_bss_get(); \ 71| 3.37k| } \ EVP_aes_256_cbc: 66| 57.7k| accessor_decorations type *name(void) { \ 67| 57.7k| CRYPTO_once(name##_once_bss_get(), name##_init); \ 68| 57.7k| /* See http://c-faq.com/ansi/constmismatch.html for why the following \ 69| 57.7k| * cast is needed. */ \ 70| 57.7k| return (const type *)name##_storage_bss_get(); \ 71| 57.7k| } \ EVP_aead_aes_128_gcm_tls12: 66| 59.3k| accessor_decorations type *name(void) { \ 67| 59.3k| CRYPTO_once(name##_once_bss_get(), name##_init); \ 68| 59.3k| /* See http://c-faq.com/ansi/constmismatch.html for why the following \ 69| 59.3k| * cast is needed. */ \ 70| 59.3k| return (const type *)name##_storage_bss_get(); \ 71| 59.3k| } \ EVP_aead_aes_256_gcm_tls12: 66| 19.9k| accessor_decorations type *name(void) { \ 67| 19.9k| CRYPTO_once(name##_once_bss_get(), name##_init); \ 68| 19.9k| /* See http://c-faq.com/ansi/constmismatch.html for why the following \ 69| 19.9k| * cast is needed. */ \ 70| 19.9k| return (const type *)name##_storage_bss_get(); \ 71| 19.9k| } \ EVP_aead_aes_128_gcm_tls13: 66| 1.22k| accessor_decorations type *name(void) { \ 67| 1.22k| CRYPTO_once(name##_once_bss_get(), name##_init); \ 68| 1.22k| /* See http://c-faq.com/ansi/constmismatch.html for why the following \ 69| 1.22k| * cast is needed. */ \ 70| 1.22k| return (const type *)name##_storage_bss_get(); \ 71| 1.22k| } \ EVP_aead_aes_256_gcm_tls13: 66| 166| accessor_decorations type *name(void) { \ 67| 166| CRYPTO_once(name##_once_bss_get(), name##_init); \ 68| 166| /* See http://c-faq.com/ansi/constmismatch.html for why the following \ 69| 166| * cast is needed. */ \ 70| 166| return (const type *)name##_storage_bss_get(); \ 71| 166| } \ EVP_sha1: 66| 70.7k| accessor_decorations type *name(void) { \ 67| 70.7k| CRYPTO_once(name##_once_bss_get(), name##_init); \ 68| 70.7k| /* See http://c-faq.com/ansi/constmismatch.html for why the following \ 69| 70.7k| * cast is needed. */ \ 70| 70.7k| return (const type *)name##_storage_bss_get(); \ 71| 70.7k| } \ EVP_sha256: 66| 159k| accessor_decorations type *name(void) { \ 67| 159k| CRYPTO_once(name##_once_bss_get(), name##_init); \ 68| 159k| /* See http://c-faq.com/ansi/constmismatch.html for why the following \ 69| 159k| * cast is needed. */ \ 70| 159k| return (const type *)name##_storage_bss_get(); \ 71| 159k| } \ EVP_sha384: 66| 107k| accessor_decorations type *name(void) { \ 67| 107k| CRYPTO_once(name##_once_bss_get(), name##_init); \ 68| 107k| /* See http://c-faq.com/ansi/constmismatch.html for why the following \ 69| 107k| * cast is needed. */ \ 70| 107k| return (const type *)name##_storage_bss_get(); \ 71| 107k| } \ EVP_sha512: 66| 4.37k| accessor_decorations type *name(void) { \ 67| 4.37k| CRYPTO_once(name##_once_bss_get(), name##_init); \ 68| 4.37k| /* See http://c-faq.com/ansi/constmismatch.html for why the following \ 69| 4.37k| * cast is needed. */ \ 70| 4.37k| return (const type *)name##_storage_bss_get(); \ 71| 4.37k| } \ EC_group_p224: 66| 31.8k| accessor_decorations type *name(void) { \ 67| 31.8k| CRYPTO_once(name##_once_bss_get(), name##_init); \ 68| 31.8k| /* See http://c-faq.com/ansi/constmismatch.html for why the following \ 69| 31.8k| * cast is needed. */ \ 70| 31.8k| return (const type *)name##_storage_bss_get(); \ 71| 31.8k| } \ EC_group_p256: 66| 31.8k| accessor_decorations type *name(void) { \ 67| 31.8k| CRYPTO_once(name##_once_bss_get(), name##_init); \ 68| 31.8k| /* See http://c-faq.com/ansi/constmismatch.html for why the following \ 69| 31.8k| * cast is needed. */ \ 70| 31.8k| return (const type *)name##_storage_bss_get(); \ 71| 31.8k| } \ EC_group_p384: 66| 31.1k| accessor_decorations type *name(void) { \ 67| 31.1k| CRYPTO_once(name##_once_bss_get(), name##_init); \ 68| 31.1k| /* See http://c-faq.com/ansi/constmismatch.html for why the following \ 69| 31.1k| * cast is needed. */ \ 70| 31.1k| return (const type *)name##_storage_bss_get(); \ 71| 31.1k| } \ EC_group_p521: 66| 309| accessor_decorations type *name(void) { \ 67| 309| CRYPTO_once(name##_once_bss_get(), name##_init); \ 68| 309| /* See http://c-faq.com/ansi/constmismatch.html for why the following \ 69| 309| * cast is needed. */ \ 70| 309| return (const type *)name##_storage_bss_get(); \ 71| 309| } \ EC_GFp_mont_method: 66| 2| accessor_decorations type *name(void) { \ 67| 2| CRYPTO_once(name##_once_bss_get(), name##_init); \ 68| 2| /* See http://c-faq.com/ansi/constmismatch.html for why the following \ 69| 2| * cast is needed. */ \ 70| 2| return (const type *)name##_storage_bss_get(); \ 71| 2| } \ EC_GFp_nistp224_method: 66| 2| accessor_decorations type *name(void) { \ 67| 2| CRYPTO_once(name##_once_bss_get(), name##_init); \ 68| 2| /* See http://c-faq.com/ansi/constmismatch.html for why the following \ 69| 2| * cast is needed. */ \ 70| 2| return (const type *)name##_storage_bss_get(); \ 71| 2| } \ EC_GFp_nistz256_method: 66| 2| accessor_decorations type *name(void) { \ 67| 2| CRYPTO_once(name##_once_bss_get(), name##_init); \ 68| 2| /* See http://c-faq.com/ansi/constmismatch.html for why the following \ 69| 2| * cast is needed. */ \ 70| 2| return (const type *)name##_storage_bss_get(); \ 71| 2| } \ RSA_default_method: 66| 83.2k| accessor_decorations type *name(void) { \ 67| 83.2k| CRYPTO_once(name##_once_bss_get(), name##_init); \ 68| 83.2k| /* See http://c-faq.com/ansi/constmismatch.html for why the following \ 69| 83.2k| * cast is needed. */ \ 70| 83.2k| return (const type *)name##_storage_bss_get(); \ 71| 83.2k| } \ bcm.cc:_ZL25BN_value_one_once_bss_getv: 52| 4| static CRYPTO_once_t *name##_bss_get(void) { return &name; } bcm.cc:_ZL17BN_value_one_initv: 65| 2| static void name##_init(void) { name##_do_init(name##_storage_bss_get()); } \ bcm.cc:_ZL28BN_value_one_storage_bss_getv: 49| 6| static type *name##_bss_get(void) { return &name; } bcm.cc:_ZL28EVP_aes_128_cbc_once_bss_getv: 52| 3.37k| static CRYPTO_once_t *name##_bss_get(void) { return &name; } bcm.cc:_ZL20EVP_aes_128_cbc_initv: 65| 1| static void name##_init(void) { name##_do_init(name##_storage_bss_get()); } \ bcm.cc:_ZL31EVP_aes_128_cbc_storage_bss_getv: 49| 3.37k| static type *name##_bss_get(void) { return &name; } bcm.cc:_ZL28EVP_aes_256_cbc_once_bss_getv: 52| 57.7k| static CRYPTO_once_t *name##_bss_get(void) { return &name; } bcm.cc:_ZL20EVP_aes_256_cbc_initv: 65| 1| static void name##_init(void) { name##_do_init(name##_storage_bss_get()); } \ bcm.cc:_ZL31EVP_aes_256_cbc_storage_bss_getv: 49| 57.7k| static type *name##_bss_get(void) { return &name; } bcm.cc:_ZL39EVP_aead_aes_128_gcm_tls12_once_bss_getv: 52| 59.3k| static CRYPTO_once_t *name##_bss_get(void) { return &name; } bcm.cc:_ZL31EVP_aead_aes_128_gcm_tls12_initv: 65| 1| static void name##_init(void) { name##_do_init(name##_storage_bss_get()); } \ bcm.cc:_ZL42EVP_aead_aes_128_gcm_tls12_storage_bss_getv: 49| 59.3k| static type *name##_bss_get(void) { return &name; } bcm.cc:_ZL39EVP_aead_aes_256_gcm_tls12_once_bss_getv: 52| 19.9k| static CRYPTO_once_t *name##_bss_get(void) { return &name; } bcm.cc:_ZL31EVP_aead_aes_256_gcm_tls12_initv: 65| 1| static void name##_init(void) { name##_do_init(name##_storage_bss_get()); } \ bcm.cc:_ZL42EVP_aead_aes_256_gcm_tls12_storage_bss_getv: 49| 19.9k| static type *name##_bss_get(void) { return &name; } bcm.cc:_ZL39EVP_aead_aes_128_gcm_tls13_once_bss_getv: 52| 1.22k| static CRYPTO_once_t *name##_bss_get(void) { return &name; } bcm.cc:_ZL31EVP_aead_aes_128_gcm_tls13_initv: 65| 1| static void name##_init(void) { name##_do_init(name##_storage_bss_get()); } \ bcm.cc:_ZL42EVP_aead_aes_128_gcm_tls13_storage_bss_getv: 49| 1.22k| static type *name##_bss_get(void) { return &name; } bcm.cc:_ZL39EVP_aead_aes_256_gcm_tls13_once_bss_getv: 52| 166| static CRYPTO_once_t *name##_bss_get(void) { return &name; } bcm.cc:_ZL31EVP_aead_aes_256_gcm_tls13_initv: 65| 1| static void name##_init(void) { name##_do_init(name##_storage_bss_get()); } \ bcm.cc:_ZL42EVP_aead_aes_256_gcm_tls13_storage_bss_getv: 49| 167| static type *name##_bss_get(void) { return &name; } bcm.cc:_ZL21EVP_sha1_once_bss_getv: 52| 70.7k| static CRYPTO_once_t *name##_bss_get(void) { return &name; } bcm.cc:_ZL13EVP_sha1_initv: 65| 1| static void name##_init(void) { name##_do_init(name##_storage_bss_get()); } \ bcm.cc:_ZL24EVP_sha1_storage_bss_getv: 49| 70.7k| static type *name##_bss_get(void) { return &name; } bcm.cc:_ZL23EVP_sha256_once_bss_getv: 52| 159k| static CRYPTO_once_t *name##_bss_get(void) { return &name; } bcm.cc:_ZL15EVP_sha256_initv: 65| 1| static void name##_init(void) { name##_do_init(name##_storage_bss_get()); } \ bcm.cc:_ZL26EVP_sha256_storage_bss_getv: 49| 159k| static type *name##_bss_get(void) { return &name; } bcm.cc:_ZL23EVP_sha384_once_bss_getv: 52| 107k| static CRYPTO_once_t *name##_bss_get(void) { return &name; } bcm.cc:_ZL15EVP_sha384_initv: 65| 1| static void name##_init(void) { name##_do_init(name##_storage_bss_get()); } \ bcm.cc:_ZL26EVP_sha384_storage_bss_getv: 49| 107k| static type *name##_bss_get(void) { return &name; } bcm.cc:_ZL23EVP_sha512_once_bss_getv: 52| 4.37k| static CRYPTO_once_t *name##_bss_get(void) { return &name; } bcm.cc:_ZL15EVP_sha512_initv: 65| 1| static void name##_init(void) { name##_do_init(name##_storage_bss_get()); } \ bcm.cc:_ZL26EVP_sha512_storage_bss_getv: 49| 4.37k| static type *name##_bss_get(void) { return &name; } bcm.cc:_ZL11md_pctx_opsv: 66| 79.5k| accessor_decorations type *name(void) { \ 67| 79.5k| CRYPTO_once(name##_once_bss_get(), name##_init); \ 68| 79.5k| /* See http://c-faq.com/ansi/constmismatch.html for why the following \ 69| 79.5k| * cast is needed. */ \ 70| 79.5k| return (const type *)name##_storage_bss_get(); \ 71| 79.5k| } \ bcm.cc:_ZL24md_pctx_ops_once_bss_getv: 52| 79.5k| static CRYPTO_once_t *name##_bss_get(void) { return &name; } bcm.cc:_ZL16md_pctx_ops_initv: 65| 1| static void name##_init(void) { name##_do_init(name##_storage_bss_get()); } \ bcm.cc:_ZL27md_pctx_ops_storage_bss_getv: 49| 79.5k| static type *name##_bss_get(void) { return &name; } bcm.cc:_ZL26EC_group_p224_once_bss_getv: 52| 31.8k| static CRYPTO_once_t *name##_bss_get(void) { return &name; } bcm.cc:_ZL18EC_group_p224_initv: 65| 2| static void name##_init(void) { name##_do_init(name##_storage_bss_get()); } \ bcm.cc:_ZL29EC_group_p224_storage_bss_getv: 49| 31.8k| static type *name##_bss_get(void) { return &name; } bcm.cc:_ZL26EC_group_p256_once_bss_getv: 52| 31.8k| static CRYPTO_once_t *name##_bss_get(void) { return &name; } bcm.cc:_ZL18EC_group_p256_initv: 65| 2| static void name##_init(void) { name##_do_init(name##_storage_bss_get()); } \ bcm.cc:_ZL29EC_group_p256_storage_bss_getv: 49| 31.8k| static type *name##_bss_get(void) { return &name; } bcm.cc:_ZL26EC_group_p384_once_bss_getv: 52| 31.1k| static CRYPTO_once_t *name##_bss_get(void) { return &name; } bcm.cc:_ZL18EC_group_p384_initv: 65| 1| static void name##_init(void) { name##_do_init(name##_storage_bss_get()); } \ bcm.cc:_ZL29EC_group_p384_storage_bss_getv: 49| 31.1k| static type *name##_bss_get(void) { return &name; } bcm.cc:_ZL26EC_group_p521_once_bss_getv: 52| 309| static CRYPTO_once_t *name##_bss_get(void) { return &name; } bcm.cc:_ZL18EC_group_p521_initv: 65| 1| static void name##_init(void) { name##_do_init(name##_storage_bss_get()); } \ bcm.cc:_ZL29EC_group_p521_storage_bss_getv: 49| 310| static type *name##_bss_get(void) { return &name; } bcm.cc:_ZL26g_ec_ex_data_class_bss_getv: 58| 31.6k| static CRYPTO_EX_DATA_CLASS *name##_bss_get(void) { return &name; } bcm.cc:_ZL31EC_GFp_mont_method_once_bss_getv: 52| 2| static CRYPTO_once_t *name##_bss_get(void) { return &name; } bcm.cc:_ZL23EC_GFp_mont_method_initv: 65| 1| static void name##_init(void) { name##_do_init(name##_storage_bss_get()); } \ bcm.cc:_ZL34EC_GFp_mont_method_storage_bss_getv: 49| 3| static type *name##_bss_get(void) { return &name; } bcm.cc:_ZL35EC_GFp_nistp224_method_once_bss_getv: 52| 2| static CRYPTO_once_t *name##_bss_get(void) { return &name; } bcm.cc:_ZL27EC_GFp_nistp224_method_initv: 65| 2| static void name##_init(void) { name##_do_init(name##_storage_bss_get()); } \ bcm.cc:_ZL38EC_GFp_nistp224_method_storage_bss_getv: 49| 4| static type *name##_bss_get(void) { return &name; } bcm.cc:_ZL35EC_GFp_nistz256_method_once_bss_getv: 52| 2| static CRYPTO_once_t *name##_bss_get(void) { return &name; } bcm.cc:_ZL27EC_GFp_nistz256_method_initv: 65| 2| static void name##_init(void) { name##_do_init(name##_storage_bss_get()); } \ bcm.cc:_ZL38EC_GFp_nistz256_method_storage_bss_getv: 49| 4| static type *name##_bss_get(void) { return &name; } bcm.cc:_ZL27g_rsa_ex_data_class_bss_getv: 58| 83.2k| static CRYPTO_EX_DATA_CLASS *name##_bss_get(void) { return &name; } bcm.cc:_ZL31RSA_default_method_once_bss_getv: 52| 83.2k| static CRYPTO_once_t *name##_bss_get(void) { return &name; } bcm.cc:_ZL23RSA_default_method_initv: 65| 2| static void name##_init(void) { name##_do_init(name##_storage_bss_get()); } \ bcm.cc:_ZL34RSA_default_method_storage_bss_getv: 49| 83.2k| static type *name##_bss_get(void) { return &name; } EVP_MD_type: 27| 50.4k|int EVP_MD_type(const EVP_MD *md) { return md->type; } EVP_MD_size: 33| 792k|size_t EVP_MD_size(const EVP_MD *md) { return md->md_size; } EVP_MD_block_size: 35| 281k|size_t EVP_MD_block_size(const EVP_MD *md) { return md->block_size; } EVP_MD_CTX_init: 38| 9.17M|void EVP_MD_CTX_init(EVP_MD_CTX *ctx) { 39| 9.17M| ctx->digest = nullptr; 40| 9.17M| ctx->pctx = nullptr; 41| 9.17M| ctx->pctx_ops = nullptr; 42| 9.17M|} EVP_MD_CTX_cleanup: 57| 6.41M|int EVP_MD_CTX_cleanup(EVP_MD_CTX *ctx) { 58| 6.41M| assert(ctx->pctx == NULL || ctx->pctx_ops != NULL); 59| 6.41M| if (ctx->pctx_ops) { ------------------ | Branch (59:7): [True: 159k, False: 6.25M] ------------------ 60| 159k| ctx->pctx_ops->free(ctx->pctx); 61| 159k| } 62| | 63| 6.41M| EVP_MD_CTX_init(ctx); 64| | 65| 6.41M| return 1; 66| 6.41M|} EVP_MD_CTX_copy_ex: 93| 3.66M|int EVP_MD_CTX_copy_ex(EVP_MD_CTX *out, const EVP_MD_CTX *in) { 94| | // |in->digest| may be NULL if this is a signing |EVP_MD_CTX| for, e.g., 95| | // Ed25519 which does not hash with |EVP_MD_CTX|. 96| 3.66M| if (in == NULL || (in->pctx == NULL && in->digest == NULL)) { ------------------ | Branch (96:7): [True: 0, False: 3.66M] | Branch (96:22): [True: 3.58M, False: 79.5k] | Branch (96:42): [True: 0, False: 3.58M] ------------------ 97| 0| OPENSSL_PUT_ERROR(DIGEST, DIGEST_R_INPUT_NOT_INITIALIZED); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 98| 0| return 0; 99| 0| } 100| 3.66M| if (out == in) { ------------------ | Branch (100:7): [True: 0, False: 3.66M] ------------------ 101| 0| OPENSSL_PUT_ERROR(DIGEST, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 102| 0| return 0; 103| 0| } 104| | 105| 3.66M| EVP_PKEY_CTX *pctx = NULL; 106| 3.66M| assert(in->pctx == NULL || in->pctx_ops != NULL); 107| 3.66M| if (in->pctx) { ------------------ | Branch (107:7): [True: 79.5k, False: 3.58M] ------------------ 108| 79.5k| pctx = in->pctx_ops->dup(in->pctx); 109| 79.5k| if (!pctx) { ------------------ | Branch (109:9): [True: 0, False: 79.5k] ------------------ 110| 0| return 0; 111| 0| } 112| 79.5k| } 113| | 114| 3.66M| EVP_MD_CTX_cleanup(out); 115| | 116| 3.66M| out->digest = in->digest; 117| 3.66M| if (in->digest != NULL) { ------------------ | Branch (117:7): [True: 3.66M, False: 0] ------------------ 118| 3.66M| OPENSSL_memcpy(out->md_data, in->md_data, in->digest->ctx_size); 119| 3.66M| } 120| 3.66M| out->pctx = pctx; 121| 3.66M| out->pctx_ops = in->pctx_ops; 122| 3.66M| assert(out->pctx == NULL || out->pctx_ops != NULL); 123| | 124| 3.66M| return 1; 125| 3.66M|} EVP_DigestInit_ex: 149| 867k|int EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type, ENGINE *engine) { 150| 867k| if (ctx->digest != type) { ------------------ | Branch (150:7): [True: 754k, False: 113k] ------------------ 151| 754k| assert(type->ctx_size != 0); 152| 754k| assert(type->ctx_size <= sizeof(ctx->md_data)); 153| 754k| ctx->digest = type; 154| 754k| } 155| | 156| 867k| assert(ctx->pctx == NULL || ctx->pctx_ops != NULL); 157| | 158| 867k| ctx->digest->init(ctx); 159| 867k| return 1; 160| 867k|} EVP_DigestUpdate: 167| 4.53M|int EVP_DigestUpdate(EVP_MD_CTX *ctx, const void *data, size_t len) { 168| 4.53M| ctx->digest->update(ctx, data, len); 169| 4.53M| return 1; 170| 4.53M|} EVP_DigestFinal_ex: 172| 2.01M|int EVP_DigestFinal_ex(EVP_MD_CTX *ctx, uint8_t *md_out, unsigned int *size) { 173| 2.01M| assert(ctx->digest->md_size <= EVP_MAX_MD_SIZE); 174| 2.01M| ctx->digest->final(ctx, md_out); 175| 2.01M| if (size != NULL) { ------------------ | Branch (175:7): [True: 1.83M, False: 174k] ------------------ 176| 1.83M| *size = ctx->digest->md_size; 177| 1.83M| } 178| 2.01M| OPENSSL_cleanse(ctx->md_data, ctx->digest->ctx_size); 179| 2.01M| return 1; 180| 2.01M|} EVP_Digest: 189| 396| unsigned int *out_size, const EVP_MD *type, ENGINE *impl) { 190| 396| bssl::ScopedEVP_MD_CTX ctx; 191| 396| return EVP_DigestInit_ex(ctx.get(), type, impl) && ------------------ | Branch (191:10): [True: 396, False: 0] ------------------ 192| 396| EVP_DigestUpdate(ctx.get(), data, count) && ------------------ | Branch (192:10): [True: 396, False: 0] ------------------ 193| 396| EVP_DigestFinal_ex(ctx.get(), out_md, out_size); ------------------ | Branch (193:10): [True: 396, False: 0] ------------------ 194| 396|} EVP_MD_CTX_get0_md: 196| 830k|const EVP_MD *EVP_MD_CTX_get0_md(const EVP_MD_CTX *ctx) { 197| 830k| if (ctx == NULL) { ------------------ | Branch (197:7): [True: 0, False: 830k] ------------------ 198| 0| return NULL; 199| 0| } 200| 830k| return ctx->digest; 201| 830k|} EVP_MD_CTX_md: 203| 563k|const EVP_MD *EVP_MD_CTX_md(const EVP_MD_CTX *ctx) { 204| 563k| return EVP_MD_CTX_get0_md(ctx); 205| 563k|} bcm.cc:_ZL16EVP_sha1_do_initP9env_md_st: 46| 1|DEFINE_METHOD_FUNCTION(EVP_MD, EVP_sha1) { 47| 1| out->type = NID_sha1; ------------------ | | 330| 1|#define NID_sha1 64 ------------------ 48| 1| out->md_size = BCM_SHA_DIGEST_LENGTH; ------------------ | | 101| 1|#define BCM_SHA_DIGEST_LENGTH 20 ------------------ 49| 1| out->flags = 0; 50| 1| out->init = sha1_init; 51| 1| out->update = sha1_update; 52| 1| out->final = sha1_final; 53| 1| out->block_size = 64; 54| 1| out->ctx_size = sizeof(SHA_CTX); 55| 1|} bcm.cc:_ZL9sha1_initP13env_md_ctx_st: 34| 138k|static void sha1_init(EVP_MD_CTX *ctx) { 35| 138k| BCM_sha1_init(reinterpret_cast(ctx->md_data)); 36| 138k|} bcm.cc:_ZL11sha1_updateP13env_md_ctx_stPKvm: 38| 219k|static void sha1_update(EVP_MD_CTX *ctx, const void *data, size_t count) { 39| 219k| BCM_sha1_update(reinterpret_cast(ctx->md_data), data, count); 40| 219k|} bcm.cc:_ZL10sha1_finalP13env_md_ctx_stPh: 42| 48.9k|static void sha1_final(EVP_MD_CTX *ctx, uint8_t *md) { 43| 48.9k| BCM_sha1_final(md, reinterpret_cast(ctx->md_data)); 44| 48.9k|} bcm.cc:_ZL18EVP_sha256_do_initP9env_md_st: 97| 1|DEFINE_METHOD_FUNCTION(EVP_MD, EVP_sha256) { 98| 1| out->type = NID_sha256; ------------------ | | 2951| 1|#define NID_sha256 672 ------------------ 99| 1| out->md_size = BCM_SHA256_DIGEST_LENGTH; ------------------ | | 158| 1|#define BCM_SHA256_DIGEST_LENGTH 32 ------------------ 100| 1| out->flags = 0; 101| 1| out->init = sha256_init; 102| 1| out->update = sha256_update; 103| 1| out->final = sha256_final; 104| 1| out->block_size = 64; 105| 1| out->ctx_size = sizeof(SHA256_CTX); 106| 1|} bcm.cc:_ZL11sha256_initP13env_md_ctx_st: 85| 462k|static void sha256_init(EVP_MD_CTX *ctx) { 86| 462k| BCM_sha256_init(reinterpret_cast(ctx->md_data)); 87| 462k|} bcm.cc:_ZL13sha256_updateP13env_md_ctx_stPKvm: 89| 3.50M|static void sha256_update(EVP_MD_CTX *ctx, const void *data, size_t count) { 90| 3.50M| BCM_sha256_update(reinterpret_cast(ctx->md_data), data, count); 91| 3.50M|} bcm.cc:_ZL12sha256_finalP13env_md_ctx_stPh: 93| 1.57M|static void sha256_final(EVP_MD_CTX *ctx, uint8_t *md) { 94| 1.57M| BCM_sha256_final(md, reinterpret_cast(ctx->md_data)); 95| 1.57M|} bcm.cc:_ZL18EVP_sha384_do_initP9env_md_st: 121| 1|DEFINE_METHOD_FUNCTION(EVP_MD, EVP_sha384) { 122| 1| out->type = NID_sha384; ------------------ | | 2956| 1|#define NID_sha384 673 ------------------ 123| 1| out->md_size = BCM_SHA384_DIGEST_LENGTH; ------------------ | | 189| 1|#define BCM_SHA384_DIGEST_LENGTH 48 ------------------ 124| 1| out->flags = 0; 125| 1| out->init = sha384_init; 126| 1| out->update = sha384_update; 127| 1| out->final = sha384_final; 128| 1| out->block_size = 128; 129| 1| out->ctx_size = sizeof(SHA512_CTX); 130| 1|} bcm.cc:_ZL11sha384_initP13env_md_ctx_st: 109| 252k|static void sha384_init(EVP_MD_CTX *ctx) { 110| 252k| BCM_sha384_init(reinterpret_cast(ctx->md_data)); 111| 252k|} bcm.cc:_ZL13sha384_updateP13env_md_ctx_stPKvm: 113| 697k|static void sha384_update(EVP_MD_CTX *ctx, const void *data, size_t count) { 114| 697k| BCM_sha384_update(reinterpret_cast(ctx->md_data), data, count); 115| 697k|} bcm.cc:_ZL12sha384_finalP13env_md_ctx_stPh: 117| 326k|static void sha384_final(EVP_MD_CTX *ctx, uint8_t *md) { 118| 326k| BCM_sha384_final(md, reinterpret_cast(ctx->md_data)); 119| 326k|} bcm.cc:_ZL18EVP_sha512_do_initP9env_md_st: 146| 1|DEFINE_METHOD_FUNCTION(EVP_MD, EVP_sha512) { 147| 1| out->type = NID_sha512; ------------------ | | 2961| 1|#define NID_sha512 674 ------------------ 148| 1| out->md_size = BCM_SHA512_DIGEST_LENGTH; ------------------ | | 207| 1|#define BCM_SHA512_DIGEST_LENGTH 64 ------------------ 149| 1| out->flags = 0; 150| 1| out->init = sha512_init; 151| 1| out->update = sha512_update; 152| 1| out->final = sha512_final; 153| 1| out->block_size = 128; 154| 1| out->ctx_size = sizeof(SHA512_CTX); 155| 1|} bcm.cc:_ZL11sha512_initP13env_md_ctx_st: 134| 4.72k|static void sha512_init(EVP_MD_CTX *ctx) { 135| 4.72k| BCM_sha512_init(reinterpret_cast(ctx->md_data)); 136| 4.72k|} bcm.cc:_ZL13sha512_updateP13env_md_ctx_stPKvm: 138| 6.75k|static void sha512_update(EVP_MD_CTX *ctx, const void *data, size_t count) { 139| 6.75k| BCM_sha512_update(reinterpret_cast(ctx->md_data), data, count); 140| 6.75k|} bcm.cc:_ZL12sha512_finalP13env_md_ctx_stPh: 142| 4.72k|static void sha512_final(EVP_MD_CTX *ctx, uint8_t *md) { 143| 4.72k| BCM_sha512_final(md, reinterpret_cast(ctx->md_data)); 144| 4.72k|} bcm.cc:_ZN4bssl17crypto_md32_finalIN12_GLOBAL__N_112SHA256TraitsEEEvPNT_11HashContextE: 133| 1.62M|inline void crypto_md32_final(typename Traits::HashContext *ctx) { 134| 1.62M| static_assert(Traits::kBlockSize == sizeof(ctx->data), "block size is wrong"); 135| | // |data| always has room for at least one byte. A full block would have 136| | // been consumed. 137| 1.62M| size_t n = ctx->num; 138| 1.62M| assert(n < Traits::kBlockSize); 139| 1.62M| ctx->data[n] = 0x80; 140| 1.62M| n++; 141| | 142| | // Fill the block with zeros if there isn't room for a 64-bit length. 143| 1.62M| if (n > Traits::kBlockSize - 8) { ------------------ | Branch (143:7): [True: 5.01k, False: 1.62M] ------------------ 144| 5.01k| OPENSSL_memset(ctx->data + n, 0, Traits::kBlockSize - n); 145| 5.01k| n = 0; 146| 5.01k| Traits::HashBlocks(ctx->h, ctx->data, 1); 147| 5.01k| } 148| 1.62M| OPENSSL_memset(ctx->data + n, 0, Traits::kBlockSize - 8 - n); 149| | 150| | // Append a 64-bit length to the block and process it. 151| 1.62M| if constexpr (Traits::kLengthIsBigEndian) { 152| 1.62M| CRYPTO_store_u32_be(ctx->data + Traits::kBlockSize - 8, ctx->Nh); 153| 1.62M| CRYPTO_store_u32_be(ctx->data + Traits::kBlockSize - 4, ctx->Nl); 154| | } else { 155| | CRYPTO_store_u32_le(ctx->data + Traits::kBlockSize - 8, ctx->Nl); 156| | CRYPTO_store_u32_le(ctx->data + Traits::kBlockSize - 4, ctx->Nh); 157| | } 158| 1.62M| Traits::HashBlocks(ctx->h, ctx->data, 1); 159| 1.62M| ctx->num = 0; 160| 1.62M| OPENSSL_memset(ctx->data, 0, Traits::kBlockSize); 161| 1.62M|} bcm.cc:_ZN4bssl18crypto_md32_updateIN12_GLOBAL__N_110SHA1TraitsEEEvPNT_11HashContextENS_4SpanIKhEE: 79| 229k| Span in) { 80| 229k| static_assert(Traits::kBlockSize == sizeof(ctx->data), "block size is wrong"); 81| 229k| if (in.empty()) { ------------------ | Branch (81:7): [True: 7.49k, False: 221k] ------------------ 82| 7.49k| return; 83| 7.49k| } 84| | 85| 221k| uint32_t l = ctx->Nl + ((static_cast(in.size())) << 3); 86| 221k| if (l < ctx->Nl) { ------------------ | Branch (86:7): [True: 0, False: 221k] ------------------ 87| | // Handle carries. 88| 0| ctx->Nh++; 89| 0| } 90| 221k| ctx->Nh += static_cast(in.size() >> 29); 91| 221k| ctx->Nl = l; 92| | 93| 221k| size_t n = ctx->num; 94| 221k| if (n != 0) { ------------------ | Branch (94:7): [True: 42.6k, False: 179k] ------------------ 95| 42.6k| if (in.size() >= Traits::kBlockSize || ------------------ | Branch (95:9): [True: 3.90k, False: 38.7k] ------------------ 96| 42.6k| in.size() + n >= Traits::kBlockSize) { ------------------ | Branch (96:9): [True: 13.7k, False: 25.0k] ------------------ 97| 17.6k| OPENSSL_memcpy(ctx->data + n, in.data(), Traits::kBlockSize - n); 98| 17.6k| Traits::HashBlocks(ctx->h, ctx->data, 1); 99| 17.6k| in = in.subspan(Traits::kBlockSize - n); 100| 17.6k| ctx->num = 0; 101| | // Keep |data| zeroed when unused. 102| 17.6k| OPENSSL_memset(ctx->data, 0, Traits::kBlockSize); 103| 25.0k| } else { 104| 25.0k| OPENSSL_memcpy(ctx->data + n, in.data(), in.size()); 105| 25.0k| ctx->num += static_cast(in.size()); 106| 25.0k| return; 107| 25.0k| } 108| 42.6k| } 109| | 110| 196k| n = in.size() / Traits::kBlockSize; 111| 196k| if (n > 0) { ------------------ | Branch (111:7): [True: 144k, False: 52.1k] ------------------ 112| 144k| Traits::HashBlocks(ctx->h, in.data(), n); 113| 144k| in = in.subspan(n * Traits::kBlockSize); 114| 144k| } 115| | 116| 196k| if (!in.empty()) { ------------------ | Branch (116:7): [True: 60.9k, False: 135k] ------------------ 117| 60.9k| ctx->num = static_cast(in.size()); 118| 60.9k| OPENSSL_memcpy(ctx->data, in.data(), in.size()); 119| 60.9k| } 120| 196k|} bcm.cc:_ZN4bssl17crypto_md32_finalIN12_GLOBAL__N_110SHA1TraitsEEEvPNT_11HashContextE: 133| 53.6k|inline void crypto_md32_final(typename Traits::HashContext *ctx) { 134| 53.6k| static_assert(Traits::kBlockSize == sizeof(ctx->data), "block size is wrong"); 135| | // |data| always has room for at least one byte. A full block would have 136| | // been consumed. 137| 53.6k| size_t n = ctx->num; 138| 53.6k| assert(n < Traits::kBlockSize); 139| 53.6k| ctx->data[n] = 0x80; 140| 53.6k| n++; 141| | 142| | // Fill the block with zeros if there isn't room for a 64-bit length. 143| 53.6k| if (n > Traits::kBlockSize - 8) { ------------------ | Branch (143:7): [True: 992, False: 52.6k] ------------------ 144| 992| OPENSSL_memset(ctx->data + n, 0, Traits::kBlockSize - n); 145| 992| n = 0; 146| 992| Traits::HashBlocks(ctx->h, ctx->data, 1); 147| 992| } 148| 53.6k| OPENSSL_memset(ctx->data + n, 0, Traits::kBlockSize - 8 - n); 149| | 150| | // Append a 64-bit length to the block and process it. 151| 53.6k| if constexpr (Traits::kLengthIsBigEndian) { 152| 53.6k| CRYPTO_store_u32_be(ctx->data + Traits::kBlockSize - 8, ctx->Nh); 153| 53.6k| CRYPTO_store_u32_be(ctx->data + Traits::kBlockSize - 4, ctx->Nl); 154| | } else { 155| | CRYPTO_store_u32_le(ctx->data + Traits::kBlockSize - 8, ctx->Nl); 156| | CRYPTO_store_u32_le(ctx->data + Traits::kBlockSize - 4, ctx->Nh); 157| | } 158| 53.6k| Traits::HashBlocks(ctx->h, ctx->data, 1); 159| 53.6k| ctx->num = 0; 160| 53.6k| OPENSSL_memset(ctx->data, 0, Traits::kBlockSize); 161| 53.6k|} bcm.cc:_ZN4bssl18crypto_md32_updateIN12_GLOBAL__N_112SHA256TraitsEEEvPNT_11HashContextENS_4SpanIKhEE: 79| 3.55M| Span in) { 80| 3.55M| static_assert(Traits::kBlockSize == sizeof(ctx->data), "block size is wrong"); 81| 3.55M| if (in.empty()) { ------------------ | Branch (81:7): [True: 321k, False: 3.23M] ------------------ 82| 321k| return; 83| 321k| } 84| | 85| 3.23M| uint32_t l = ctx->Nl + ((static_cast(in.size())) << 3); 86| 3.23M| if (l < ctx->Nl) { ------------------ | Branch (86:7): [True: 0, False: 3.23M] ------------------ 87| | // Handle carries. 88| 0| ctx->Nh++; 89| 0| } 90| 3.23M| ctx->Nh += static_cast(in.size() >> 29); 91| 3.23M| ctx->Nl = l; 92| | 93| 3.23M| size_t n = ctx->num; 94| 3.23M| if (n != 0) { ------------------ | Branch (94:7): [True: 1.52M, False: 1.71M] ------------------ 95| 1.52M| if (in.size() >= Traits::kBlockSize || ------------------ | Branch (95:9): [True: 240k, False: 1.27M] ------------------ 96| 1.52M| in.size() + n >= Traits::kBlockSize) { ------------------ | Branch (96:9): [True: 434k, False: 845k] ------------------ 97| 675k| OPENSSL_memcpy(ctx->data + n, in.data(), Traits::kBlockSize - n); 98| 675k| Traits::HashBlocks(ctx->h, ctx->data, 1); 99| 675k| in = in.subspan(Traits::kBlockSize - n); 100| 675k| ctx->num = 0; 101| | // Keep |data| zeroed when unused. 102| 675k| OPENSSL_memset(ctx->data, 0, Traits::kBlockSize); 103| 845k| } else { 104| 845k| OPENSSL_memcpy(ctx->data + n, in.data(), in.size()); 105| 845k| ctx->num += static_cast(in.size()); 106| 845k| return; 107| 845k| } 108| 1.52M| } 109| | 110| 2.39M| n = in.size() / Traits::kBlockSize; 111| 2.39M| if (n > 0) { ------------------ | Branch (111:7): [True: 735k, False: 1.65M] ------------------ 112| 735k| Traits::HashBlocks(ctx->h, in.data(), n); 113| 735k| in = in.subspan(n * Traits::kBlockSize); 114| 735k| } 115| | 116| 2.39M| if (!in.empty()) { ------------------ | Branch (116:7): [True: 2.01M, False: 377k] ------------------ 117| 2.01M| ctx->num = static_cast(in.size()); 118| 2.01M| OPENSSL_memcpy(ctx->data, in.data(), in.size()); 119| 2.01M| } 120| 2.39M|} md5.cc:_ZN4bssl18crypto_md32_updateIN12_GLOBAL__N_19MD5TraitsEEEvPNT_11HashContextENS_4SpanIKhEE: 79| 109k| Span in) { 80| 109k| static_assert(Traits::kBlockSize == sizeof(ctx->data), "block size is wrong"); 81| 109k| if (in.empty()) { ------------------ | Branch (81:7): [True: 7.49k, False: 101k] ------------------ 82| 7.49k| return; 83| 7.49k| } 84| | 85| 101k| uint32_t l = ctx->Nl + ((static_cast(in.size())) << 3); 86| 101k| if (l < ctx->Nl) { ------------------ | Branch (86:7): [True: 0, False: 101k] ------------------ 87| | // Handle carries. 88| 0| ctx->Nh++; 89| 0| } 90| 101k| ctx->Nh += static_cast(in.size() >> 29); 91| 101k| ctx->Nl = l; 92| | 93| 101k| size_t n = ctx->num; 94| 101k| if (n != 0) { ------------------ | Branch (94:7): [True: 48.2k, False: 53.6k] ------------------ 95| 48.2k| if (in.size() >= Traits::kBlockSize || ------------------ | Branch (95:9): [True: 3.90k, False: 44.3k] ------------------ 96| 48.2k| in.size() + n >= Traits::kBlockSize) { ------------------ | Branch (96:9): [True: 15.5k, False: 28.7k] ------------------ 97| 19.4k| OPENSSL_memcpy(ctx->data + n, in.data(), Traits::kBlockSize - n); 98| 19.4k| Traits::HashBlocks(ctx->h, ctx->data, 1); 99| 19.4k| in = in.subspan(Traits::kBlockSize - n); 100| 19.4k| ctx->num = 0; 101| | // Keep |data| zeroed when unused. 102| 19.4k| OPENSSL_memset(ctx->data, 0, Traits::kBlockSize); 103| 28.7k| } else { 104| 28.7k| OPENSSL_memcpy(ctx->data + n, in.data(), in.size()); 105| 28.7k| ctx->num += static_cast(in.size()); 106| 28.7k| return; 107| 28.7k| } 108| 48.2k| } 109| | 110| 73.1k| n = in.size() / Traits::kBlockSize; 111| 73.1k| if (n > 0) { ------------------ | Branch (111:7): [True: 13.6k, False: 59.5k] ------------------ 112| 13.6k| Traits::HashBlocks(ctx->h, in.data(), n); 113| 13.6k| in = in.subspan(n * Traits::kBlockSize); 114| 13.6k| } 115| | 116| 73.1k| if (!in.empty()) { ------------------ | Branch (116:7): [True: 65.5k, False: 7.62k] ------------------ 117| 65.5k| ctx->num = static_cast(in.size()); 118| 65.5k| OPENSSL_memcpy(ctx->data, in.data(), in.size()); 119| 65.5k| } 120| 73.1k|} md5.cc:_ZN4bssl17crypto_md32_finalIN12_GLOBAL__N_19MD5TraitsEEEvPNT_11HashContextE: 133| 58.2k|inline void crypto_md32_final(typename Traits::HashContext *ctx) { 134| 58.2k| static_assert(Traits::kBlockSize == sizeof(ctx->data), "block size is wrong"); 135| | // |data| always has room for at least one byte. A full block would have 136| | // been consumed. 137| 58.2k| size_t n = ctx->num; 138| 58.2k| assert(n < Traits::kBlockSize); 139| 58.2k| ctx->data[n] = 0x80; 140| 58.2k| n++; 141| | 142| | // Fill the block with zeros if there isn't room for a 64-bit length. 143| 58.2k| if (n > Traits::kBlockSize - 8) { ------------------ | Branch (143:7): [True: 964, False: 57.3k] ------------------ 144| 964| OPENSSL_memset(ctx->data + n, 0, Traits::kBlockSize - n); 145| 964| n = 0; 146| 964| Traits::HashBlocks(ctx->h, ctx->data, 1); 147| 964| } 148| 58.2k| OPENSSL_memset(ctx->data + n, 0, Traits::kBlockSize - 8 - n); 149| | 150| | // Append a 64-bit length to the block and process it. 151| | if constexpr (Traits::kLengthIsBigEndian) { 152| | CRYPTO_store_u32_be(ctx->data + Traits::kBlockSize - 8, ctx->Nh); 153| | CRYPTO_store_u32_be(ctx->data + Traits::kBlockSize - 4, ctx->Nl); 154| 58.2k| } else { 155| 58.2k| CRYPTO_store_u32_le(ctx->data + Traits::kBlockSize - 8, ctx->Nl); 156| 58.2k| CRYPTO_store_u32_le(ctx->data + Traits::kBlockSize - 4, ctx->Nh); 157| 58.2k| } 158| 58.2k| Traits::HashBlocks(ctx->h, ctx->data, 1); 159| 58.2k| ctx->num = 0; 160| 58.2k| OPENSSL_memset(ctx->data, 0, Traits::kBlockSize); 161| 58.2k|} EVP_DigestSignInit: 83| 28.0k| ENGINE *e, EVP_PKEY *pkey) { 84| 28.0k| return do_sigver_init(ctx, pctx, type, e, pkey, evp_sign); 85| 28.0k|} EVP_DigestVerifyInit: 88| 51.5k| const EVP_MD *type, ENGINE *e, EVP_PKEY *pkey) { 89| 51.5k| return do_sigver_init(ctx, pctx, type, e, pkey, evp_verify); 90| 51.5k|} EVP_DigestSignUpdate: 92| 28.0k|int EVP_DigestSignUpdate(EVP_MD_CTX *ctx, const void *data, size_t len) { 93| 28.0k| if (!uses_prehash(ctx, evp_sign)) { ------------------ | Branch (93:7): [True: 0, False: 28.0k] ------------------ 94| 0| OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 95| 0| return 0; 96| 0| } 97| | 98| 28.0k| return EVP_DigestUpdate(ctx, data, len); 99| 28.0k|} EVP_DigestVerifyUpdate: 101| 51.5k|int EVP_DigestVerifyUpdate(EVP_MD_CTX *ctx, const void *data, size_t len) { 102| 51.5k| if (!uses_prehash(ctx, evp_verify)) { ------------------ | Branch (102:7): [True: 0, False: 51.5k] ------------------ 103| 0| OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 104| 0| return 0; 105| 0| } 106| | 107| 51.5k| return EVP_DigestUpdate(ctx, data, len); 108| 51.5k|} EVP_DigestSignFinal: 111| 28.0k| size_t *out_sig_len) { 112| 28.0k| if (!uses_prehash(ctx, evp_sign)) { ------------------ | Branch (112:7): [True: 0, False: 28.0k] ------------------ 113| 0| OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 114| 0| return 0; 115| 0| } 116| | 117| 28.0k| if (out_sig) { ------------------ | Branch (117:7): [True: 28.0k, False: 0] ------------------ 118| 28.0k| EVP_MD_CTX tmp_ctx; 119| 28.0k| int ret; 120| 28.0k| uint8_t md[EVP_MAX_MD_SIZE]; 121| 28.0k| unsigned int mdlen; 122| | 123| 28.0k| FIPS_service_indicator_lock_state(); 124| 28.0k| EVP_MD_CTX_init(&tmp_ctx); 125| 28.0k| ret = EVP_MD_CTX_copy_ex(&tmp_ctx, ctx) && ------------------ | Branch (125:11): [True: 28.0k, False: 0] ------------------ 126| 28.0k| EVP_DigestFinal_ex(&tmp_ctx, md, &mdlen) && ------------------ | Branch (126:11): [True: 28.0k, False: 0] ------------------ 127| 28.0k| EVP_PKEY_sign(ctx->pctx, out_sig, out_sig_len, md, mdlen); ------------------ | Branch (127:11): [True: 28.0k, False: 0] ------------------ 128| 28.0k| EVP_MD_CTX_cleanup(&tmp_ctx); 129| 28.0k| FIPS_service_indicator_unlock_state(); 130| | 131| 28.0k| if (ret) { ------------------ | Branch (131:9): [True: 28.0k, False: 0] ------------------ 132| 28.0k| EVP_DigestSign_verify_service_indicator(ctx); 133| 28.0k| } 134| | 135| 28.0k| return ret; 136| 28.0k| } else { 137| 0| size_t s = EVP_MD_size(ctx->digest); 138| 0| return EVP_PKEY_sign(ctx->pctx, out_sig, out_sig_len, NULL, s); 139| 0| } 140| 28.0k|} EVP_DigestVerifyFinal: 143| 51.5k| size_t sig_len) { 144| 51.5k| if (!uses_prehash(ctx, evp_verify)) { ------------------ | Branch (144:7): [True: 0, False: 51.5k] ------------------ 145| 0| OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 146| 0| return 0; 147| 0| } 148| | 149| 51.5k| EVP_MD_CTX tmp_ctx; 150| 51.5k| int ret; 151| 51.5k| uint8_t md[EVP_MAX_MD_SIZE]; 152| 51.5k| unsigned int mdlen; 153| | 154| 51.5k| FIPS_service_indicator_lock_state(); 155| 51.5k| EVP_MD_CTX_init(&tmp_ctx); 156| 51.5k| ret = EVP_MD_CTX_copy_ex(&tmp_ctx, ctx) && ------------------ | Branch (156:9): [True: 51.5k, False: 0] ------------------ 157| 51.5k| EVP_DigestFinal_ex(&tmp_ctx, md, &mdlen) && ------------------ | Branch (157:9): [True: 51.5k, False: 0] ------------------ 158| 51.5k| EVP_PKEY_verify(ctx->pctx, sig, sig_len, md, mdlen); ------------------ | Branch (158:9): [True: 0, False: 51.5k] ------------------ 159| 51.5k| FIPS_service_indicator_unlock_state(); 160| 51.5k| EVP_MD_CTX_cleanup(&tmp_ctx); 161| | 162| 51.5k| if (ret) { ------------------ | Branch (162:7): [True: 0, False: 51.5k] ------------------ 163| 0| EVP_DigestVerify_verify_service_indicator(ctx); 164| 0| } 165| | 166| 51.5k| return ret; 167| 51.5k|} EVP_DigestSign: 170| 28.0k| const uint8_t *data, size_t data_len) { 171| 28.0k| FIPS_service_indicator_lock_state(); 172| 28.0k| int ret = 0; 173| | 174| 28.0k| if (uses_prehash(ctx, evp_sign)) { ------------------ | Branch (174:7): [True: 28.0k, False: 0] ------------------ 175| | // If |out_sig| is NULL, the caller is only querying the maximum output 176| | // length. |data| should only be incorporated in the final call. 177| 28.0k| if (out_sig != NULL && ------------------ | Branch (177:9): [True: 28.0k, False: 0] ------------------ 178| 28.0k| !EVP_DigestSignUpdate(ctx, data, data_len)) { ------------------ | Branch (178:9): [True: 0, False: 28.0k] ------------------ 179| 0| goto end; 180| 0| } 181| | 182| 28.0k| ret = EVP_DigestSignFinal(ctx, out_sig, out_sig_len); 183| 28.0k| goto end; 184| 28.0k| } 185| | 186| 0| if (ctx->pctx->pmeth->sign_message == NULL) { ------------------ | Branch (186:7): [True: 0, False: 0] ------------------ 187| 0| OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 188| 0| goto end; 189| 0| } 190| | 191| 0| ret = ctx->pctx->pmeth->sign_message(ctx->pctx, out_sig, out_sig_len, data, 192| 0| data_len); 193| | 194| 28.0k|end: 195| 28.0k| FIPS_service_indicator_unlock_state(); 196| 28.0k| if (ret) { ------------------ | Branch (196:7): [True: 28.0k, False: 0] ------------------ 197| 28.0k| EVP_DigestSign_verify_service_indicator(ctx); 198| 28.0k| } 199| 28.0k| return ret; 200| 0|} EVP_DigestVerify: 203| 51.5k| const uint8_t *data, size_t len) { 204| 51.5k| FIPS_service_indicator_lock_state(); 205| 51.5k| int ret = 0; 206| | 207| 51.5k| if (uses_prehash(ctx, evp_verify)) { ------------------ | Branch (207:7): [True: 51.5k, False: 0] ------------------ 208| 51.5k| ret = EVP_DigestVerifyUpdate(ctx, data, len) && ------------------ | Branch (208:11): [True: 51.5k, False: 0] ------------------ 209| 51.5k| EVP_DigestVerifyFinal(ctx, sig, sig_len); ------------------ | Branch (209:11): [True: 0, False: 51.5k] ------------------ 210| 51.5k| goto end; 211| 51.5k| } 212| | 213| 0| if (ctx->pctx->pmeth->verify_message == NULL) { ------------------ | Branch (213:7): [True: 0, False: 0] ------------------ 214| 0| OPENSSL_PUT_ERROR(EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 215| 0| goto end; 216| 0| } 217| | 218| 0| ret = ctx->pctx->pmeth->verify_message(ctx->pctx, sig, sig_len, data, len); 219| | 220| 51.5k|end: 221| 51.5k| FIPS_service_indicator_unlock_state(); 222| 51.5k| if (ret) { ------------------ | Branch (222:7): [True: 0, False: 51.5k] ------------------ 223| 0| EVP_DigestVerify_verify_service_indicator(ctx); 224| 0| } 225| 51.5k| return ret; 226| 0|} bcm.cc:_ZL14do_sigver_initP13env_md_ctx_stPP15evp_pkey_ctx_stPK9env_md_stP9engine_stP11evp_pkey_st17evp_sign_verify_t: 42| 79.5k| enum evp_sign_verify_t op) { 43| 79.5k| if (ctx->pctx == NULL) { ------------------ | Branch (43:7): [True: 79.5k, False: 0] ------------------ 44| 79.5k| ctx->pctx = EVP_PKEY_CTX_new(pkey, e); 45| 79.5k| } 46| 79.5k| if (ctx->pctx == NULL) { ------------------ | Branch (46:7): [True: 0, False: 79.5k] ------------------ 47| 0| return 0; 48| 0| } 49| 79.5k| ctx->pctx_ops = md_pctx_ops(); 50| | 51| 79.5k| if (op == evp_verify) { ------------------ | Branch (51:7): [True: 51.5k, False: 28.0k] ------------------ 52| 51.5k| if (!EVP_PKEY_verify_init(ctx->pctx)) { ------------------ | Branch (52:9): [True: 0, False: 51.5k] ------------------ 53| 0| return 0; 54| 0| } 55| 51.5k| } else { 56| 28.0k| if (!EVP_PKEY_sign_init(ctx->pctx)) { ------------------ | Branch (56:9): [True: 0, False: 28.0k] ------------------ 57| 0| return 0; 58| 0| } 59| 28.0k| } 60| | 61| 79.5k| if (type != NULL && ------------------ | Branch (61:7): [True: 79.5k, False: 0] ------------------ 62| 79.5k| !EVP_PKEY_CTX_set_signature_md(ctx->pctx, type)) { ------------------ | Branch (62:7): [True: 0, False: 79.5k] ------------------ 63| 0| return 0; 64| 0| } 65| | 66| 79.5k| if (uses_prehash(ctx, op)) { ------------------ | Branch (66:7): [True: 79.5k, False: 0] ------------------ 67| 79.5k| if (type == NULL) { ------------------ | Branch (67:9): [True: 0, False: 79.5k] ------------------ 68| 0| OPENSSL_PUT_ERROR(EVP, EVP_R_NO_DEFAULT_DIGEST); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 69| 0| return 0; 70| 0| } 71| 79.5k| if (!EVP_DigestInit_ex(ctx, type, e)) { ------------------ | Branch (71:9): [True: 0, False: 79.5k] ------------------ 72| 0| return 0; 73| 0| } 74| 79.5k| } 75| | 76| 79.5k| if (pctx) { ------------------ | Branch (76:7): [True: 79.5k, False: 0] ------------------ 77| 79.5k| *pctx = ctx->pctx; 78| 79.5k| } 79| 79.5k| return 1; 80| 79.5k|} bcm.cc:_ZL19md_pctx_ops_do_initP15evp_md_pctx_ops: 30| 1|DEFINE_LOCAL_DATA(struct evp_md_pctx_ops, md_pctx_ops) { 31| 1| out->free = EVP_PKEY_CTX_free; 32| 1| out->dup = EVP_PKEY_CTX_dup; 33| 1|} bcm.cc:_ZL12uses_prehashP13env_md_ctx_st17evp_sign_verify_t: 35| 318k|static int uses_prehash(EVP_MD_CTX *ctx, enum evp_sign_verify_t op) { 36| 318k| return (op == evp_sign) ? (ctx->pctx->pmeth->sign != NULL) ------------------ | Branch (36:10): [True: 112k, False: 206k] ------------------ 37| 318k| : (ctx->pctx->pmeth->verify != NULL); 38| 318k|} EC_GROUP_free: 285| 213k|void EC_GROUP_free(EC_GROUP *group) { 286| 213k| if (group == NULL || ------------------ | Branch (286:7): [True: 31.6k, False: 181k] ------------------ 287| | // Built-in curves are static. 288| 213k| group->curve_name != NID_undef || ------------------ | | 43| 394k|#define NID_undef 0 ------------------ | Branch (288:7): [True: 181k, False: 0] ------------------ 289| 213k| !CRYPTO_refcount_dec_and_test_zero(&group->references)) { ------------------ | Branch (289:7): [True: 0, False: 0] ------------------ 290| 213k| return; 291| 213k| } 292| | 293| 0| bn_mont_ctx_cleanup(&group->order); 294| 0| bn_mont_ctx_cleanup(&group->field); 295| 0| OPENSSL_free(group); 296| 0|} EC_GROUP_dup: 298| 181k|EC_GROUP *EC_GROUP_dup(const EC_GROUP *a) { 299| 181k| if (a == NULL || ------------------ | Branch (299:7): [True: 0, False: 181k] ------------------ 300| | // Built-in curves are static. 301| 181k| a->curve_name != NID_undef) { ------------------ | | 43| 181k|#define NID_undef 0 ------------------ | Branch (301:7): [True: 181k, False: 0] ------------------ 302| 181k| return (EC_GROUP *)a; 303| 181k| } 304| | 305| | // Groups are logically immutable (but for |EC_GROUP_set_generator| which must 306| | // be called early on), so we simply take a reference. 307| 0| EC_GROUP *group = (EC_GROUP *)a; 308| 0| CRYPTO_refcount_inc(&group->references); 309| 0| return group; 310| 181k|} EC_GROUP_cmp: 312| 297k|int EC_GROUP_cmp(const EC_GROUP *a, const EC_GROUP *b, BN_CTX *ignored) { 313| | // Note this function returns 0 if equal and non-zero otherwise. 314| 297k| if (a == b) { ------------------ | Branch (314:7): [True: 297k, False: 0] ------------------ 315| 297k| return 0; 316| 297k| } 317| 0| if (a->curve_name != b->curve_name) { ------------------ | Branch (317:7): [True: 0, False: 0] ------------------ 318| 0| return 1; 319| 0| } 320| 0| if (a->curve_name != NID_undef) { ------------------ | | 43| 0|#define NID_undef 0 ------------------ | Branch (320:7): [True: 0, False: 0] ------------------ 321| | // Built-in curves may be compared by curve name alone. 322| 0| return 0; 323| 0| } 324| | 325| | // |a| and |b| are both custom curves. We compare the entire curve 326| | // structure. If |a| or |b| is incomplete (due to legacy OpenSSL mistakes, 327| | // custom curve construction is sadly done in two parts) but otherwise not the 328| | // same object, we consider them always unequal. 329| 0| return a->meth != b->meth || // ------------------ | Branch (329:10): [True: 0, False: 0] ------------------ 330| 0| !a->has_order || !b->has_order || ------------------ | Branch (330:10): [True: 0, False: 0] | Branch (330:27): [True: 0, False: 0] ------------------ 331| 0| BN_cmp(&a->order.N, &b->order.N) != 0 || ------------------ | Branch (331:10): [True: 0, False: 0] ------------------ 332| 0| BN_cmp(&a->field.N, &b->field.N) != 0 || ------------------ | Branch (332:10): [True: 0, False: 0] ------------------ 333| 0| !ec_felem_equal(a, &a->a, &b->a) || // ------------------ | Branch (333:10): [True: 0, False: 0] ------------------ 334| 0| !ec_felem_equal(a, &a->b, &b->b) || ------------------ | Branch (334:10): [True: 0, False: 0] ------------------ 335| 0| !ec_GFp_simple_points_equal(a, &a->generator.raw, &b->generator.raw); ------------------ | Branch (335:10): [True: 0, False: 0] ------------------ 336| 0|} EC_GROUP_get0_order: 342| 46.9k|const BIGNUM *EC_GROUP_get0_order(const EC_GROUP *group) { 343| 46.9k| assert(group->has_order); 344| 46.9k| return &group->order.N; 345| 46.9k|} EC_GROUP_order_bits: 354| 59.8k|int EC_GROUP_order_bits(const EC_GROUP *group) { 355| 59.8k| return BN_num_bits(&group->order.N); 356| 59.8k|} EC_GROUP_get_curve_name: 369| 14.4k|int EC_GROUP_get_curve_name(const EC_GROUP *group) { return group->curve_name; } EC_GROUP_get_degree: 371| 29.5k|unsigned EC_GROUP_get_degree(const EC_GROUP *group) { 372| 29.5k| return BN_num_bits(&group->field.N); 373| 29.5k|} EC_POINT_new: 405| 149k|EC_POINT *EC_POINT_new(const EC_GROUP *group) { 406| 149k| if (group == NULL) { ------------------ | Branch (406:7): [True: 0, False: 149k] ------------------ 407| 0| OPENSSL_PUT_ERROR(EC, ERR_R_PASSED_NULL_PARAMETER); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 408| 0| return NULL; 409| 0| } 410| | 411| 149k| EC_POINT *ret = reinterpret_cast(OPENSSL_malloc(sizeof *ret)); 412| 149k| if (ret == NULL) { ------------------ | Branch (412:7): [True: 0, False: 149k] ------------------ 413| 0| return NULL; 414| 0| } 415| | 416| 149k| ret->group = EC_GROUP_dup(group); 417| 149k| ec_GFp_simple_point_init(&ret->raw); 418| 149k| return ret; 419| 149k|} EC_POINT_free: 431| 181k|void EC_POINT_free(EC_POINT *point) { 432| 181k| ec_point_free(point, 1 /* free group */); 433| 181k|} EC_POINT_copy: 437| 29.1k|int EC_POINT_copy(EC_POINT *dest, const EC_POINT *src) { 438| 29.1k| if (EC_GROUP_cmp(dest->group, src->group, NULL) != 0) { ------------------ | Branch (438:7): [True: 0, False: 29.1k] ------------------ 439| 0| OPENSSL_PUT_ERROR(EC, EC_R_INCOMPATIBLE_OBJECTS); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 440| 0| return 0; 441| 0| } 442| 29.1k| if (dest == src) { ------------------ | Branch (442:7): [True: 0, False: 29.1k] ------------------ 443| 0| return 1; 444| 0| } 445| 29.1k| ec_GFp_simple_point_copy(&dest->raw, &src->raw); 446| 29.1k| return 1; 447| 29.1k|} EC_POINT_dup: 449| 29.1k|EC_POINT *EC_POINT_dup(const EC_POINT *a, const EC_GROUP *group) { 450| 29.1k| if (a == NULL) { ------------------ | Branch (450:7): [True: 0, False: 29.1k] ------------------ 451| 0| return NULL; 452| 0| } 453| | 454| 29.1k| EC_POINT *ret = EC_POINT_new(group); 455| 29.1k| if (ret == NULL || !EC_POINT_copy(ret, a)) { ------------------ | Branch (455:7): [True: 0, False: 29.1k] | Branch (455:22): [True: 0, False: 29.1k] ------------------ 456| 0| EC_POINT_free(ret); 457| 0| return NULL; 458| 0| } 459| | 460| 29.1k| return ret; 461| 29.1k|} EC_POINT_is_at_infinity: 472| 2|int EC_POINT_is_at_infinity(const EC_GROUP *group, const EC_POINT *point) { 473| 2| if (EC_GROUP_cmp(group, point->group, NULL) != 0) { ------------------ | Branch (473:7): [True: 0, False: 2] ------------------ 474| 0| OPENSSL_PUT_ERROR(EC, EC_R_INCOMPATIBLE_OBJECTS); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 475| 0| return 0; 476| 0| } 477| 2| return ec_GFp_simple_is_at_infinity(group, &point->raw); 478| 2|} EC_POINT_is_on_curve: 481| 2| BN_CTX *ctx) { 482| 2| if (EC_GROUP_cmp(group, point->group, NULL) != 0) { ------------------ | Branch (482:7): [True: 0, False: 2] ------------------ 483| 0| OPENSSL_PUT_ERROR(EC, EC_R_INCOMPATIBLE_OBJECTS); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 484| 0| return 0; 485| 0| } 486| 2| return ec_GFp_simple_is_on_curve(group, &point->raw); 487| 2|} EC_POINT_get_affine_coordinates_GFp: 503| 29.6k| BIGNUM *y, BN_CTX *ctx) { 504| 29.6k| if (group->meth->point_get_affine_coordinates == 0) { ------------------ | Branch (504:7): [True: 0, False: 29.6k] ------------------ 505| 0| OPENSSL_PUT_ERROR(EC, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 506| 0| return 0; 507| 0| } 508| 29.6k| if (EC_GROUP_cmp(group, point->group, NULL) != 0) { ------------------ | Branch (508:7): [True: 0, False: 29.6k] ------------------ 509| 0| OPENSSL_PUT_ERROR(EC, EC_R_INCOMPATIBLE_OBJECTS); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 510| 0| return 0; 511| 0| } 512| 29.6k| EC_FELEM x_felem, y_felem; 513| 29.6k| if (!group->meth->point_get_affine_coordinates(group, &point->raw, ------------------ | Branch (513:7): [True: 0, False: 29.6k] ------------------ 514| 29.6k| x == NULL ? NULL : &x_felem, ------------------ | Branch (514:50): [True: 0, False: 29.6k] ------------------ 515| 29.6k| y == NULL ? NULL : &y_felem) || ------------------ | Branch (515:50): [True: 29.5k, False: 107] ------------------ 516| 29.6k| (x != NULL && !ec_felem_to_bignum(group, x, &x_felem)) || ------------------ | Branch (516:8): [True: 29.6k, False: 0] | Branch (516:21): [True: 0, False: 29.6k] ------------------ 517| 29.6k| (y != NULL && !ec_felem_to_bignum(group, y, &y_felem))) { ------------------ | Branch (517:8): [True: 107, False: 29.5k] | Branch (517:21): [True: 0, False: 107] ------------------ 518| 0| return 0; 519| 0| } 520| 29.6k| return 1; 521| 29.6k|} ec_affine_to_jacobian: 530| 58.6k| const EC_AFFINE *p) { 531| 58.6k| out->X = p->X; 532| 58.6k| out->Y = p->Y; 533| 58.6k| out->Z = *ec_felem_one(group); 534| 58.6k|} ec_jacobian_to_affine: 537| 29.7k| const EC_JACOBIAN *p) { 538| 29.7k| return group->meth->point_get_affine_coordinates(group, p, &out->X, &out->Y); 539| 29.7k|} ec_point_set_affine_coordinates: 551| 61.0k| const EC_FELEM *x, const EC_FELEM *y) { 552| 61.0k| void (*const felem_mul)(const EC_GROUP *, EC_FELEM *r, const EC_FELEM *a, 553| 61.0k| const EC_FELEM *b) = group->meth->felem_mul; 554| 61.0k| void (*const felem_sqr)(const EC_GROUP *, EC_FELEM *r, const EC_FELEM *a) = 555| 61.0k| group->meth->felem_sqr; 556| | 557| | // Check if the point is on the curve. 558| 61.0k| EC_FELEM lhs, rhs; 559| 61.0k| felem_sqr(group, &lhs, y); // lhs = y^2 560| 61.0k| felem_sqr(group, &rhs, x); // rhs = x^2 561| 61.0k| ec_felem_add(group, &rhs, &rhs, &group->a); // rhs = x^2 + a 562| 61.0k| felem_mul(group, &rhs, &rhs, x); // rhs = x^3 + ax 563| 61.0k| ec_felem_add(group, &rhs, &rhs, &group->b); // rhs = x^3 + ax + b 564| 61.0k| if (!ec_felem_equal(group, &lhs, &rhs)) { ------------------ | Branch (564:7): [True: 2.40k, False: 58.6k] ------------------ 565| 2.40k| OPENSSL_PUT_ERROR(EC, EC_R_POINT_IS_NOT_ON_CURVE); ------------------ | | 361| 2.40k| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 566| | // In the event of an error, defend against the caller not checking the 567| | // return value by setting a known safe value. Note this may not be possible 568| | // if the caller is in the process of constructing an arbitrary group and 569| | // the generator is missing. 570| 2.40k| if (group->has_order) { ------------------ | Branch (570:9): [True: 2.40k, False: 0] ------------------ 571| 2.40k| out->X = group->generator.raw.X; 572| 2.40k| out->Y = group->generator.raw.Y; 573| 2.40k| } 574| 2.40k| return 0; 575| 2.40k| } 576| | 577| 58.6k| out->X = *x; 578| 58.6k| out->Y = *y; 579| 58.6k| return 1; 580| 61.0k|} ec_point_mul_no_self_test: 666| 59.3k| const BIGNUM *p_scalar, BN_CTX *ctx) { 667| | // Previously, this function set |r| to the point at infinity if there was 668| | // nothing to multiply. But, nobody should be calling this function with 669| | // nothing to multiply in the first place. 670| 59.3k| if ((g_scalar == NULL && p_scalar == NULL) || ------------------ | Branch (670:8): [True: 29.5k, False: 29.7k] | Branch (670:28): [True: 0, False: 29.5k] ------------------ 671| 59.3k| (p == NULL) != (p_scalar == NULL)) { ------------------ | Branch (671:7): [True: 0, False: 59.3k] ------------------ 672| 0| OPENSSL_PUT_ERROR(EC, ERR_R_PASSED_NULL_PARAMETER); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 673| 0| return 0; 674| 0| } 675| | 676| 59.3k| if (EC_GROUP_cmp(group, r->group, NULL) != 0 || ------------------ | Branch (676:7): [True: 0, False: 59.3k] ------------------ 677| 59.3k| (p != NULL && EC_GROUP_cmp(group, p->group, NULL) != 0)) { ------------------ | Branch (677:8): [True: 29.5k, False: 29.7k] | Branch (677:21): [True: 0, False: 29.5k] ------------------ 678| 0| OPENSSL_PUT_ERROR(EC, EC_R_INCOMPATIBLE_OBJECTS); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 679| 0| return 0; 680| 0| } 681| | 682| 59.3k| bssl::UniquePtr new_ctx; 683| 59.3k| if (ctx == NULL) { ------------------ | Branch (683:7): [True: 59.3k, False: 0] ------------------ 684| 59.3k| new_ctx.reset(BN_CTX_new()); 685| 59.3k| if (new_ctx == NULL) { ------------------ | Branch (685:9): [True: 0, False: 59.3k] ------------------ 686| 0| return 0; 687| 0| } 688| 59.3k| ctx = new_ctx.get(); 689| 59.3k| } 690| | 691| | // If both |g_scalar| and |p_scalar| are non-NULL, 692| | // |ec_point_mul_scalar_public| would share the doublings between the two 693| | // products, which would be more efficient. However, we conservatively assume 694| | // the caller needs a constant-time operation. (ECDSA verification does not 695| | // use this function.) 696| | // 697| | // Previously, the low-level constant-time multiplication function aligned 698| | // with this function's calling convention, but this was misleading. Curves 699| | // which combined the two multiplications did not avoid the doubling case 700| | // in the incomplete addition formula and were not constant-time. 701| | 702| 59.3k| if (g_scalar != NULL) { ------------------ | Branch (702:7): [True: 29.7k, False: 29.5k] ------------------ 703| 29.7k| EC_SCALAR scalar; 704| 29.7k| if (!arbitrary_bignum_to_scalar(group, &scalar, g_scalar, ctx) || ------------------ | Branch (704:9): [True: 0, False: 29.7k] ------------------ 705| 29.7k| !ec_point_mul_scalar_base(group, &r->raw, &scalar)) { ------------------ | Branch (705:9): [True: 0, False: 29.7k] ------------------ 706| 0| return 0; 707| 0| } 708| 29.7k| } 709| | 710| 59.3k| if (p_scalar != NULL) { ------------------ | Branch (710:7): [True: 29.5k, False: 29.7k] ------------------ 711| 29.5k| EC_SCALAR scalar; 712| 29.5k| EC_JACOBIAN tmp; 713| 29.5k| if (!arbitrary_bignum_to_scalar(group, &scalar, p_scalar, ctx) || ------------------ | Branch (713:9): [True: 0, False: 29.5k] ------------------ 714| 29.5k| !ec_point_mul_scalar(group, &tmp, &p->raw, &scalar)) { ------------------ | Branch (714:9): [True: 0, False: 29.5k] ------------------ 715| 0| return 0; 716| 0| } 717| 29.5k| if (g_scalar == NULL) { ------------------ | Branch (717:9): [True: 29.5k, False: 0] ------------------ 718| 29.5k| OPENSSL_memcpy(&r->raw, &tmp, sizeof(EC_JACOBIAN)); 719| 29.5k| } else { 720| 0| group->meth->add(group, &r->raw, &r->raw, &tmp); 721| 0| } 722| 29.5k| } 723| | 724| 59.3k| return 1; 725| 59.3k|} EC_POINT_mul: 728| 59.3k| const EC_POINT *p, const BIGNUM *p_scalar, BN_CTX *ctx) { 729| 59.3k| boringssl_ensure_ecc_self_test(); 730| | 731| 59.3k| return ec_point_mul_no_self_test(group, r, g_scalar, p, p_scalar, ctx); 732| 59.3k|} ec_point_mul_scalar_public: 736| 4.82k| const EC_SCALAR *p_scalar) { 737| 4.82k| if (g_scalar == NULL || p_scalar == NULL || p == NULL) { ------------------ | Branch (737:7): [True: 0, False: 4.82k] | Branch (737:27): [True: 0, False: 4.82k] | Branch (737:47): [True: 0, False: 4.82k] ------------------ 738| 0| OPENSSL_PUT_ERROR(EC, ERR_R_PASSED_NULL_PARAMETER); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 739| 0| return 0; 740| 0| } 741| | 742| 4.82k| if (group->meth->mul_public == NULL) { ------------------ | Branch (742:7): [True: 592, False: 4.22k] ------------------ 743| 592| return group->meth->mul_public_batch(group, r, g_scalar, p, p_scalar, 1); 744| 592| } 745| | 746| 4.22k| group->meth->mul_public(group, r, g_scalar, p, p_scalar); 747| 4.22k| return 1; 748| 4.82k|} ec_point_mul_scalar: 764| 29.5k| const EC_JACOBIAN *p, const EC_SCALAR *scalar) { 765| 29.5k| if (p == NULL || scalar == NULL) { ------------------ | Branch (765:7): [True: 0, False: 29.5k] | Branch (765:20): [True: 0, False: 29.5k] ------------------ 766| 0| OPENSSL_PUT_ERROR(EC, ERR_R_PASSED_NULL_PARAMETER); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 767| 0| return 0; 768| 0| } 769| | 770| 29.5k| group->meth->mul(group, r, p, scalar); 771| | 772| | // Check the result is on the curve to defend against fault attacks or bugs. 773| | // This has negligible cost compared to the multiplication. 774| 29.5k| if (!ec_GFp_simple_is_on_curve(group, r)) { ------------------ | Branch (774:7): [True: 0, False: 29.5k] ------------------ 775| 0| OPENSSL_PUT_ERROR(EC, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 776| 0| return 0; 777| 0| } 778| | 779| 29.5k| return 1; 780| 29.5k|} ec_point_mul_scalar_base: 783| 29.8k| const EC_SCALAR *scalar) { 784| 29.8k| if (scalar == NULL) { ------------------ | Branch (784:7): [True: 0, False: 29.8k] ------------------ 785| 0| OPENSSL_PUT_ERROR(EC, ERR_R_PASSED_NULL_PARAMETER); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 786| 0| return 0; 787| 0| } 788| | 789| 29.8k| group->meth->mul_base(group, r, scalar); 790| | 791| | // Check the result is on the curve to defend against fault attacks or bugs. 792| | // This has negligible cost compared to the multiplication. This can only 793| | // happen on bug or CPU fault, so it okay to leak this. The alternative would 794| | // be to proceed with bad data. 795| 29.8k| if (!constant_time_declassify_int(ec_GFp_simple_is_on_curve(group, r))) { ------------------ | Branch (795:7): [True: 0, False: 29.8k] ------------------ 796| 0| OPENSSL_PUT_ERROR(EC, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 797| 0| return 0; 798| 0| } 799| | 800| 29.8k| return 1; 801| 29.8k|} ec_point_select: 857| 146M| const EC_JACOBIAN *a, const EC_JACOBIAN *b) { 858| 146M| ec_felem_select(group, &out->X, mask, &a->X, &b->X); 859| 146M| ec_felem_select(group, &out->Y, mask, &a->Y, &b->Y); 860| 146M| ec_felem_select(group, &out->Z, mask, &a->Z, &b->Z); 861| 146M|} ec_cmp_x_coordinate: 879| 4.82k| const EC_SCALAR *r) { 880| 4.82k| return group->meth->cmp_x_coordinate(group, p, r); 881| 4.82k|} ec_get_x_coordinate_as_scalar: 884| 107| const EC_JACOBIAN *p) { 885| 107| uint8_t bytes[EC_MAX_BYTES]; 886| 107| size_t len; 887| 107| if (!ec_get_x_coordinate_as_bytes(group, bytes, &len, sizeof(bytes), p)) { ------------------ | Branch (887:7): [True: 0, False: 107] ------------------ 888| 0| return 0; 889| 0| } 890| | 891| | // The x-coordinate is bounded by p, but we need a scalar, bounded by the 892| | // order. These may not have the same size. However, we must have p < 2×order, 893| | // assuming p is not tiny (p >= 17). 894| | // 895| | // Thus |bytes| will fit in |order.width + 1| words, and we can reduce by 896| | // performing at most one subtraction. 897| | // 898| | // Proof: We only work with prime order curves, so the number of points on 899| | // the curve is the order. Thus Hasse's theorem gives: 900| | // 901| | // |order - (p + 1)| <= 2×sqrt(p) 902| | // p + 1 - order <= 2×sqrt(p) 903| | // p + 1 - 2×sqrt(p) <= order 904| | // p + 1 - 2×(p/4) < order (p/4 > sqrt(p) for p >= 17) 905| | // p/2 < p/2 + 1 < order 906| | // p < 2×order 907| | // 908| | // Additionally, one can manually check this property for built-in curves. It 909| | // is enforced for legacy custom curves in |EC_GROUP_set_generator|. 910| 107| const BIGNUM *order = EC_GROUP_get0_order(group); 911| 107| BN_ULONG words[EC_MAX_WORDS + 1] = {0}; 912| 107| bn_big_endian_to_words(words, order->width + 1, bytes, len); 913| 107| bn_reduce_once(out->words, words, /*carry=*/words[order->width], order->d, 914| 107| order->width); 915| 107| return 1; 916| 107|} ec_get_x_coordinate_as_bytes: 920| 107| const EC_JACOBIAN *p) { 921| 107| size_t len = BN_num_bytes(&group->field.N); 922| 107| assert(len <= EC_MAX_BYTES); 923| 107| if (max_out < len) { ------------------ | Branch (923:7): [True: 0, False: 107] ------------------ 924| 0| OPENSSL_PUT_ERROR(EC, EC_R_BUFFER_TOO_SMALL); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 925| 0| return 0; 926| 0| } 927| | 928| 107| EC_FELEM x; 929| 107| if (!group->meth->point_get_affine_coordinates(group, p, &x, NULL)) { ------------------ | Branch (929:7): [True: 0, False: 107] ------------------ 930| 0| return 0; 931| 0| } 932| | 933| 107| ec_felem_to_bytes(group, out, out_len, &x); 934| 107| *out_len = len; 935| 107| return 1; 936| 107|} ec_set_to_safe_point: 938| 2.46k|void ec_set_to_safe_point(const EC_GROUP *group, EC_JACOBIAN *out) { 939| 2.46k| if (group->has_order) { ------------------ | Branch (939:7): [True: 2.46k, False: 0] ------------------ 940| 2.46k| ec_GFp_simple_point_copy(out, &group->generator.raw); 941| 2.46k| } else { 942| | // The generator can be missing if the caller is in the process of 943| | // constructing an arbitrary group. In this case, we give up and use the 944| | // point at infinity. 945| 0| ec_GFp_simple_point_set_to_infinity(group, out); 946| 0| } 947| 2.46k|} bcm.cc:_ZL21EC_group_p224_do_initP11ec_group_st: 59| 2|DEFINE_METHOD_FUNCTION(EC_GROUP, EC_group_p224) { 60| 2| out->curve_name = NID_secp224r1; ------------------ | | 3118| 2|#define NID_secp224r1 713 ------------------ 61| 2| out->comment = "NIST P-224"; 62| | // 1.3.132.0.33 63| 2| static const uint8_t kOIDP224[] = {0x2b, 0x81, 0x04, 0x00, 0x21}; 64| 2| OPENSSL_memcpy(out->oid, kOIDP224, sizeof(kOIDP224)); 65| 2| out->oid_len = sizeof(kOIDP224); 66| | 67| 2| ec_group_init_static_mont(&out->field, OPENSSL_ARRAY_SIZE(kP224Field), ------------------ | | 103| 2|#define OPENSSL_ARRAY_SIZE(array) (sizeof(array) / sizeof((array)[0])) ------------------ 68| 2| kP224Field, kP224FieldRR, kP224FieldN0); 69| 2| ec_group_init_static_mont(&out->order, OPENSSL_ARRAY_SIZE(kP224Order), ------------------ | | 103| 2|#define OPENSSL_ARRAY_SIZE(array) (sizeof(array) / sizeof((array)[0])) ------------------ 70| 2| kP224Order, kP224OrderRR, kP224OrderN0); 71| | 72| 2|#if defined(BORINGSSL_HAS_UINT128) && !defined(OPENSSL_SMALL) 73| 2| out->meth = EC_GFp_nistp224_method(); 74| 2| OPENSSL_memcpy(out->generator.raw.X.words, kP224GX, sizeof(kP224GX)); 75| 2| OPENSSL_memcpy(out->generator.raw.Y.words, kP224GY, sizeof(kP224GY)); 76| 2| out->generator.raw.Z.words[0] = 1; 77| 2| OPENSSL_memcpy(out->b.words, kP224B, sizeof(kP224B)); 78| |#else 79| | out->meth = EC_GFp_mont_method(); 80| | OPENSSL_memcpy(out->generator.raw.X.words, kP224MontGX, sizeof(kP224MontGX)); 81| | OPENSSL_memcpy(out->generator.raw.Y.words, kP224MontGY, sizeof(kP224MontGY)); 82| | OPENSSL_memcpy(out->generator.raw.Z.words, kP224FieldR, sizeof(kP224FieldR)); 83| | OPENSSL_memcpy(out->b.words, kP224MontB, sizeof(kP224MontB)); 84| |#endif 85| 2| out->generator.group = out; 86| | 87| 2| ec_group_set_a_minus3(out); 88| 2| out->has_order = 1; 89| 2| out->field_greater_than_order = 1; 90| 2|} bcm.cc:_ZL25ec_group_init_static_montP14bn_mont_ctx_stmPKmS2_m: 38| 12| const BN_ULONG *rr, uint64_t n0) { 39| 12| bn_set_static_words(&mont->N, modulus, num_words); 40| 12| bn_set_static_words(&mont->RR, rr, num_words); 41| 12|#if defined(OPENSSL_64_BIT) 42| 12| mont->n0[0] = n0; 43| |#elif defined(OPENSSL_32_BIT) 44| | mont->n0[0] = (uint32_t)n0; 45| | mont->n0[1] = (uint32_t)(n0 >> 32); 46| |#else 47| |#error "unknown word length" 48| |#endif 49| 12|} bcm.cc:_ZL21ec_group_set_a_minus3P11ec_group_st: 51| 6|static void ec_group_set_a_minus3(EC_GROUP *group) { 52| 6| const EC_FELEM *one = ec_felem_one(group); 53| 6| group->a_is_minus3 = 1; 54| 6| ec_felem_neg(group, &group->a, one); 55| 6| ec_felem_sub(group, &group->a, &group->a, one); 56| 6| ec_felem_sub(group, &group->a, &group->a, one); 57| 6|} bcm.cc:_ZL21EC_group_p256_do_initP11ec_group_st: 92| 2|DEFINE_METHOD_FUNCTION(EC_GROUP, EC_group_p256) { 93| 2| out->curve_name = NID_X9_62_prime256v1; ------------------ | | 1872| 2|#define NID_X9_62_prime256v1 415 ------------------ 94| 2| out->comment = "NIST P-256"; 95| | // 1.2.840.10045.3.1.7 96| 2| static const uint8_t kOIDP256[] = {0x2a, 0x86, 0x48, 0xce, 97| 2| 0x3d, 0x03, 0x01, 0x07}; 98| 2| OPENSSL_memcpy(out->oid, kOIDP256, sizeof(kOIDP256)); 99| 2| out->oid_len = sizeof(kOIDP256); 100| | 101| 2| ec_group_init_static_mont(&out->field, OPENSSL_ARRAY_SIZE(kP256Field), ------------------ | | 103| 2|#define OPENSSL_ARRAY_SIZE(array) (sizeof(array) / sizeof((array)[0])) ------------------ 102| 2| kP256Field, kP256FieldRR, kP256FieldN0); 103| 2| ec_group_init_static_mont(&out->order, OPENSSL_ARRAY_SIZE(kP256Order), ------------------ | | 103| 2|#define OPENSSL_ARRAY_SIZE(array) (sizeof(array) / sizeof((array)[0])) ------------------ 104| 2| kP256Order, kP256OrderRR, kP256OrderN0); 105| | 106| 2|#if !defined(OPENSSL_NO_ASM) && \ 107| 2| (defined(OPENSSL_X86_64) || defined(OPENSSL_AARCH64)) && \ 108| 2| !defined(OPENSSL_SMALL) 109| 2| out->meth = EC_GFp_nistz256_method(); 110| |#else 111| | out->meth = EC_GFp_nistp256_method(); 112| |#endif 113| 2| out->generator.group = out; 114| 2| OPENSSL_memcpy(out->generator.raw.X.words, kP256MontGX, sizeof(kP256MontGX)); 115| 2| OPENSSL_memcpy(out->generator.raw.Y.words, kP256MontGY, sizeof(kP256MontGY)); 116| 2| OPENSSL_memcpy(out->generator.raw.Z.words, kP256FieldR, sizeof(kP256FieldR)); 117| 2| OPENSSL_memcpy(out->b.words, kP256MontB, sizeof(kP256MontB)); 118| | 119| 2| ec_group_set_a_minus3(out); 120| 2| out->has_order = 1; 121| 2| out->field_greater_than_order = 1; 122| 2|} bcm.cc:_ZL21EC_group_p384_do_initP11ec_group_st: 124| 1|DEFINE_METHOD_FUNCTION(EC_GROUP, EC_group_p384) { 125| 1| out->curve_name = NID_secp384r1; ------------------ | | 3126| 1|#define NID_secp384r1 715 ------------------ 126| 1| out->comment = "NIST P-384"; 127| | // 1.3.132.0.34 128| 1| static const uint8_t kOIDP384[] = {0x2b, 0x81, 0x04, 0x00, 0x22}; 129| 1| OPENSSL_memcpy(out->oid, kOIDP384, sizeof(kOIDP384)); 130| 1| out->oid_len = sizeof(kOIDP384); 131| | 132| 1| ec_group_init_static_mont(&out->field, OPENSSL_ARRAY_SIZE(kP384Field), ------------------ | | 103| 1|#define OPENSSL_ARRAY_SIZE(array) (sizeof(array) / sizeof((array)[0])) ------------------ 133| 1| kP384Field, kP384FieldRR, kP384FieldN0); 134| 1| ec_group_init_static_mont(&out->order, OPENSSL_ARRAY_SIZE(kP384Order), ------------------ | | 103| 1|#define OPENSSL_ARRAY_SIZE(array) (sizeof(array) / sizeof((array)[0])) ------------------ 135| 1| kP384Order, kP384OrderRR, kP384OrderN0); 136| | 137| 1| out->meth = EC_GFp_mont_method(); 138| 1| out->generator.group = out; 139| 1| OPENSSL_memcpy(out->generator.raw.X.words, kP384MontGX, sizeof(kP384MontGX)); 140| 1| OPENSSL_memcpy(out->generator.raw.Y.words, kP384MontGY, sizeof(kP384MontGY)); 141| 1| OPENSSL_memcpy(out->generator.raw.Z.words, kP384FieldR, sizeof(kP384FieldR)); 142| 1| OPENSSL_memcpy(out->b.words, kP384MontB, sizeof(kP384MontB)); 143| | 144| 1| ec_group_set_a_minus3(out); 145| 1| out->has_order = 1; 146| 1| out->field_greater_than_order = 1; 147| 1|} bcm.cc:_ZL21EC_group_p521_do_initP11ec_group_st: 149| 1|DEFINE_METHOD_FUNCTION(EC_GROUP, EC_group_p521) { 150| 1| out->curve_name = NID_secp521r1; ------------------ | | 3130| 1|#define NID_secp521r1 716 ------------------ 151| 1| out->comment = "NIST P-521"; 152| | // 1.3.132.0.35 153| 1| static const uint8_t kOIDP521[] = {0x2b, 0x81, 0x04, 0x00, 0x23}; 154| 1| OPENSSL_memcpy(out->oid, kOIDP521, sizeof(kOIDP521)); 155| 1| out->oid_len = sizeof(kOIDP521); 156| | 157| 1| ec_group_init_static_mont(&out->field, OPENSSL_ARRAY_SIZE(kP521Field), ------------------ | | 103| 1|#define OPENSSL_ARRAY_SIZE(array) (sizeof(array) / sizeof((array)[0])) ------------------ 158| 1| kP521Field, kP521FieldRR, kP521FieldN0); 159| 1| ec_group_init_static_mont(&out->order, OPENSSL_ARRAY_SIZE(kP521Order), ------------------ | | 103| 1|#define OPENSSL_ARRAY_SIZE(array) (sizeof(array) / sizeof((array)[0])) ------------------ 160| 1| kP521Order, kP521OrderRR, kP521OrderN0); 161| | 162| 1| out->meth = EC_GFp_mont_method(); 163| 1| out->generator.group = out; 164| 1| OPENSSL_memcpy(out->generator.raw.X.words, kP521MontGX, sizeof(kP521MontGX)); 165| 1| OPENSSL_memcpy(out->generator.raw.Y.words, kP521MontGY, sizeof(kP521MontGY)); 166| 1| OPENSSL_memcpy(out->generator.raw.Z.words, kP521FieldR, sizeof(kP521FieldR)); 167| 1| OPENSSL_memcpy(out->b.words, kP521MontB, sizeof(kP521MontB)); 168| | 169| 1| ec_group_set_a_minus3(out); 170| 1| out->has_order = 1; 171| 1| out->field_greater_than_order = 1; 172| 1|} bcm.cc:_ZL13ec_point_freeP11ec_point_sti: 421| 181k|static void ec_point_free(EC_POINT *point, int free_group) { 422| 181k| if (!point) { ------------------ | Branch (422:7): [True: 31.6k, False: 149k] ------------------ 423| 31.6k| return; 424| 31.6k| } 425| 149k| if (free_group) { ------------------ | Branch (425:7): [True: 149k, False: 0] ------------------ 426| 149k| EC_GROUP_free(point->group); 427| 149k| } 428| 149k| OPENSSL_free(point); 429| 149k|} bcm.cc:_ZL26arbitrary_bignum_to_scalarPK11ec_group_stP9EC_SCALARPK9bignum_stP10bignum_ctx: 650| 59.3k| const BIGNUM *in, BN_CTX *ctx) { 651| 59.3k| if (ec_bignum_to_scalar(group, out, in)) { ------------------ | Branch (651:7): [True: 59.3k, False: 0] ------------------ 652| 59.3k| return 1; 653| 59.3k| } 654| | 655| 0| ERR_clear_error(); 656| | 657| | // This is an unusual input, so we do not guarantee constant-time processing. 658| 0| bssl::BN_CTXScope scope(ctx); 659| 0| BIGNUM *tmp = BN_CTX_get(ctx); 660| 0| return tmp != nullptr && BN_nnmod(tmp, in, EC_GROUP_get0_order(group), ctx) && ------------------ | Branch (660:10): [True: 0, False: 0] | Branch (660:28): [True: 0, False: 0] ------------------ 661| 0| ec_bignum_to_scalar(group, out, tmp); ------------------ | Branch (661:10): [True: 0, False: 0] ------------------ 662| 59.3k|} EC_KEY_new: 55| 31.6k|EC_KEY *EC_KEY_new(void) { return EC_KEY_new_method(NULL); } EC_KEY_new_method: 57| 31.6k|EC_KEY *EC_KEY_new_method(const ENGINE *engine) { 58| 31.6k| EC_KEY *ret = reinterpret_cast(OPENSSL_zalloc(sizeof(EC_KEY))); 59| 31.6k| if (ret == NULL) { ------------------ | Branch (59:7): [True: 0, False: 31.6k] ------------------ 60| 0| return NULL; 61| 0| } 62| | 63| 31.6k| if (engine) { ------------------ | Branch (63:7): [True: 0, False: 31.6k] ------------------ 64| 0| ret->ecdsa_meth = ENGINE_get_ECDSA_method(engine); 65| 0| } 66| 31.6k| if (ret->ecdsa_meth) { ------------------ | Branch (66:7): [True: 0, False: 31.6k] ------------------ 67| 0| METHOD_ref(ret->ecdsa_meth); 68| 0| } 69| | 70| 31.6k| ret->conv_form = POINT_CONVERSION_UNCOMPRESSED; 71| 31.6k| ret->references = 1; 72| | 73| 31.6k| CRYPTO_new_ex_data(&ret->ex_data); 74| | 75| 31.6k| if (ret->ecdsa_meth && ret->ecdsa_meth->init && !ret->ecdsa_meth->init(ret)) { ------------------ | Branch (75:7): [True: 0, False: 31.6k] | Branch (75:26): [True: 0, False: 0] | Branch (75:51): [True: 0, False: 0] ------------------ 76| 0| CRYPTO_free_ex_data(g_ec_ex_data_class_bss_get(), &ret->ex_data); 77| 0| if (ret->ecdsa_meth) { ------------------ | Branch (77:9): [True: 0, False: 0] ------------------ 78| 0| METHOD_unref(ret->ecdsa_meth); 79| 0| } 80| 0| OPENSSL_free(ret); 81| 0| return NULL; 82| 0| } 83| | 84| 31.6k| return ret; 85| 31.6k|} EC_KEY_free: 100| 67.6k|void EC_KEY_free(EC_KEY *r) { 101| 67.6k| if (r == NULL) { ------------------ | Branch (101:7): [True: 36.0k, False: 31.6k] ------------------ 102| 36.0k| return; 103| 36.0k| } 104| | 105| 31.6k| if (!CRYPTO_refcount_dec_and_test_zero(&r->references)) { ------------------ | Branch (105:7): [True: 0, False: 31.6k] ------------------ 106| 0| return; 107| 0| } 108| | 109| 31.6k| if (r->ecdsa_meth) { ------------------ | Branch (109:7): [True: 0, False: 31.6k] ------------------ 110| 0| if (r->ecdsa_meth->finish) { ------------------ | Branch (110:9): [True: 0, False: 0] ------------------ 111| 0| r->ecdsa_meth->finish(r); 112| 0| } 113| 0| METHOD_unref(r->ecdsa_meth); 114| 0| } 115| | 116| 31.6k| CRYPTO_free_ex_data(g_ec_ex_data_class_bss_get(), &r->ex_data); 117| | 118| 31.6k| EC_GROUP_free(r->group); 119| 31.6k| EC_POINT_free(r->pub_key); 120| 31.6k| ec_wrapped_scalar_free(r->priv_key); 121| | 122| 31.6k| OPENSSL_free(r); 123| 31.6k|} EC_KEY_get0_group: 158| 26.5k|const EC_GROUP *EC_KEY_get0_group(const EC_KEY *key) { return key->group; } EC_KEY_set_group: 160| 31.6k|int EC_KEY_set_group(EC_KEY *key, const EC_GROUP *group) { 161| | // If |key| already has a group, it is an error to switch to another one. 162| 31.6k| if (key->group != NULL) { ------------------ | Branch (162:7): [True: 0, False: 31.6k] ------------------ 163| 0| if (EC_GROUP_cmp(key->group, group, NULL) != 0) { ------------------ | Branch (163:9): [True: 0, False: 0] ------------------ 164| 0| OPENSSL_PUT_ERROR(EC, EC_R_GROUP_MISMATCH); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 165| 0| return 0; 166| 0| } 167| 0| return 1; 168| 0| } 169| | 170| 31.6k| assert(key->priv_key == NULL); 171| 31.6k| assert(key->pub_key == NULL); 172| | 173| 31.6k| EC_GROUP_free(key->group); 174| 31.6k| key->group = EC_GROUP_dup(group); 175| 31.6k| return key->group != NULL; 176| 31.6k|} EC_KEY_set_private_key: 182| 2|int EC_KEY_set_private_key(EC_KEY *key, const BIGNUM *priv_key) { 183| 2| if (key->group == NULL) { ------------------ | Branch (183:7): [True: 0, False: 2] ------------------ 184| 0| OPENSSL_PUT_ERROR(EC, EC_R_MISSING_PARAMETERS); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 185| 0| return 0; 186| 0| } 187| | 188| 2| EC_WRAPPED_SCALAR *scalar = ec_wrapped_scalar_new(key->group); 189| 2| if (scalar == NULL) { ------------------ | Branch (189:7): [True: 0, False: 2] ------------------ 190| 0| return 0; 191| 0| } 192| 2| if (!ec_bignum_to_scalar(key->group, &scalar->scalar, priv_key) || ------------------ | Branch (192:7): [True: 0, False: 2] ------------------ 193| | // Zero is not a valid private key, so it is safe to leak the result of 194| | // this comparison. 195| 2| constant_time_declassify_int( ------------------ | Branch (195:7): [True: 0, False: 2] ------------------ 196| 2| ec_scalar_is_zero(key->group, &scalar->scalar))) { 197| 0| OPENSSL_PUT_ERROR(EC, EC_R_INVALID_PRIVATE_KEY); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 198| 0| ec_wrapped_scalar_free(scalar); 199| 0| return 0; 200| 0| } 201| 2| ec_wrapped_scalar_free(key->priv_key); 202| 2| key->priv_key = scalar; 203| 2| return 1; 204| 2|} EC_KEY_get0_public_key: 206| 5.04k|const EC_POINT *EC_KEY_get0_public_key(const EC_KEY *key) { 207| 5.04k| return key->pub_key; 208| 5.04k|} EC_KEY_set_public_key: 210| 29.1k|int EC_KEY_set_public_key(EC_KEY *key, const EC_POINT *pub_key) { 211| 29.1k| if (key->group == NULL) { ------------------ | Branch (211:7): [True: 0, False: 29.1k] ------------------ 212| 0| OPENSSL_PUT_ERROR(EC, EC_R_MISSING_PARAMETERS); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 213| 0| return 0; 214| 0| } 215| | 216| 29.1k| if (pub_key != NULL && EC_GROUP_cmp(key->group, pub_key->group, NULL) != 0) { ------------------ | Branch (216:7): [True: 29.1k, False: 0] | Branch (216:26): [True: 0, False: 29.1k] ------------------ 217| 0| OPENSSL_PUT_ERROR(EC, EC_R_GROUP_MISMATCH); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 218| 0| return 0; 219| 0| } 220| | 221| 29.1k| EC_POINT_free(key->pub_key); 222| 29.1k| key->pub_key = EC_POINT_dup(pub_key, key->group); 223| 29.1k| return (key->pub_key == NULL) ? 0 : 1; ------------------ | Branch (223:10): [True: 0, False: 29.1k] ------------------ 224| 29.1k|} EC_KEY_get_conv_form: 232| 14.4k|point_conversion_form_t EC_KEY_get_conv_form(const EC_KEY *key) { 233| 14.4k| return key->conv_form; 234| 14.4k|} EC_KEY_check_key: 240| 2|int EC_KEY_check_key(const EC_KEY *eckey) { 241| 2| if (!eckey || !eckey->group || !eckey->pub_key) { ------------------ | Branch (241:7): [True: 0, False: 2] | Branch (241:17): [True: 0, False: 2] | Branch (241:34): [True: 0, False: 2] ------------------ 242| 0| OPENSSL_PUT_ERROR(EC, ERR_R_PASSED_NULL_PARAMETER); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 243| 0| return 0; 244| 0| } 245| | 246| 2| if (EC_POINT_is_at_infinity(eckey->group, eckey->pub_key)) { ------------------ | Branch (246:7): [True: 0, False: 2] ------------------ 247| 0| OPENSSL_PUT_ERROR(EC, EC_R_POINT_AT_INFINITY); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 248| 0| return 0; 249| 0| } 250| | 251| | // Test whether the public key is on the elliptic curve. 252| 2| if (!EC_POINT_is_on_curve(eckey->group, eckey->pub_key, NULL)) { ------------------ | Branch (252:7): [True: 0, False: 2] ------------------ 253| 0| OPENSSL_PUT_ERROR(EC, EC_R_POINT_IS_NOT_ON_CURVE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 254| 0| return 0; 255| 0| } 256| | 257| | // Check the public and private keys match. 258| | // 259| | // NOTE: this is a FIPS pair-wise consistency check for the ECDH case. See SP 260| | // 800-56Ar3, page 36. 261| 2| if (eckey->priv_key != NULL) { ------------------ | Branch (261:7): [True: 2, False: 0] ------------------ 262| 2| EC_JACOBIAN point; 263| 2| if (!ec_point_mul_scalar_base(eckey->group, &point, ------------------ | Branch (263:9): [True: 0, False: 2] ------------------ 264| 2| &eckey->priv_key->scalar)) { 265| 0| OPENSSL_PUT_ERROR(EC, ERR_R_EC_LIB); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 266| 0| return 0; 267| 0| } 268| | // Leaking this comparison only leaks whether |eckey|'s public key was 269| | // correct. 270| 2| if (!constant_time_declassify_int(ec_GFp_simple_points_equal( ------------------ | Branch (270:9): [True: 0, False: 2] ------------------ 271| 2| eckey->group, &point, &eckey->pub_key->raw))) { 272| 0| OPENSSL_PUT_ERROR(EC, EC_R_INVALID_PRIVATE_KEY); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 273| 0| return 0; 274| 0| } 275| 2| } 276| | 277| 2| return 1; 278| 2|} EC_KEY_oct2key: 335| 31.6k|int EC_KEY_oct2key(EC_KEY *key, const uint8_t *in, size_t len, BN_CTX *ctx) { 336| 31.6k| if (key->group == nullptr) { ------------------ | Branch (336:7): [True: 0, False: 31.6k] ------------------ 337| 0| OPENSSL_PUT_ERROR(EC, EC_R_MISSING_PARAMETERS); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 338| 0| return 0; 339| 0| } 340| | 341| 31.6k| bssl::UniquePtr point(EC_POINT_new(key->group)); 342| 31.6k| return point != nullptr && ------------------ | Branch (342:10): [True: 31.6k, False: 0] ------------------ 343| 31.6k| EC_POINT_oct2point(key->group, point.get(), in, len, ctx) && ------------------ | Branch (343:10): [True: 29.1k, False: 2.49k] ------------------ 344| 31.6k| EC_KEY_set_public_key(key, point.get()); ------------------ | Branch (344:10): [True: 29.1k, False: 0] ------------------ 345| 31.6k|} bcm.cc:_ZL22ec_wrapped_scalar_freeP17EC_WRAPPED_SCALAR: 51| 31.6k|static void ec_wrapped_scalar_free(EC_WRAPPED_SCALAR *scalar) { 52| 31.6k| OPENSSL_free(scalar); 53| 31.6k|} bcm.cc:_ZL21ec_wrapped_scalar_newPK11ec_group_st: 37| 2|static EC_WRAPPED_SCALAR *ec_wrapped_scalar_new(const EC_GROUP *group) { 38| 2| EC_WRAPPED_SCALAR *wrapped = reinterpret_cast( 39| 2| OPENSSL_zalloc(sizeof(EC_WRAPPED_SCALAR))); 40| 2| if (wrapped == NULL) { ------------------ | Branch (40:7): [True: 0, False: 2] ------------------ 41| 0| return NULL; 42| 0| } 43| | 44| 2| wrapped->bignum.d = wrapped->scalar.words; 45| 2| wrapped->bignum.width = group->order.N.width; 46| 2| wrapped->bignum.dmax = group->order.N.width; 47| 2| wrapped->bignum.flags = BN_FLG_STATIC_DATA; ------------------ | | 933| 2|#define BN_FLG_STATIC_DATA 0x02 ------------------ 48| 2| return wrapped; 49| 2|} ec_GFp_mont_felem_mul: 47| 131M| const EC_FELEM *a, const EC_FELEM *b) { 48| 131M| bn_mod_mul_montgomery_small(r->words, a->words, b->words, 49| 131M| group->field.N.width, &group->field); 50| 131M|} ec_GFp_mont_felem_sqr: 53| 145M| const EC_FELEM *a) { 54| 145M| bn_mod_mul_montgomery_small(r->words, a->words, a->words, 55| 145M| group->field.N.width, &group->field); 56| 145M|} ec_GFp_mont_felem_to_bytes: 59| 89.4k| size_t *out_len, const EC_FELEM *in) { 60| 89.4k| EC_FELEM tmp; 61| 89.4k| ec_GFp_mont_felem_from_montgomery(group, &tmp, in); 62| 89.4k| ec_GFp_simple_felem_to_bytes(group, out, out_len, &tmp); 63| 89.4k|} ec_GFp_mont_felem_from_bytes: 66| 122k| const uint8_t *in, size_t len) { 67| 122k| if (!ec_GFp_simple_felem_from_bytes(group, out, in, len)) { ------------------ | Branch (67:7): [True: 33, False: 122k] ------------------ 68| 33| return 0; 69| 33| } 70| | 71| 122k| ec_GFp_mont_felem_to_montgomery(group, out, out); 72| 122k| return 1; 73| 122k|} ec_GFp_mont_add: 167| 5.47M| const EC_JACOBIAN *a, const EC_JACOBIAN *b) { 168| 5.47M| if (a == b) { ------------------ | Branch (168:7): [True: 0, False: 5.47M] ------------------ 169| 0| ec_GFp_mont_dbl(group, out, a); 170| 0| return; 171| 0| } 172| | 173| | // The method is taken from: 174| | // http://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian.html#addition-add-2007-bl 175| | // 176| | // Coq transcription and correctness proof: 177| | // 178| | // 179| 5.47M| EC_FELEM x_out, y_out, z_out; 180| 5.47M| BN_ULONG z1nz = ec_felem_non_zero_mask(group, &a->Z); 181| 5.47M| BN_ULONG z2nz = ec_felem_non_zero_mask(group, &b->Z); 182| | 183| | // z1z1 = z1z1 = z1**2 184| 5.47M| EC_FELEM z1z1; 185| 5.47M| ec_GFp_mont_felem_sqr(group, &z1z1, &a->Z); 186| | 187| | // z2z2 = z2**2 188| 5.47M| EC_FELEM z2z2; 189| 5.47M| ec_GFp_mont_felem_sqr(group, &z2z2, &b->Z); 190| | 191| | // u1 = x1*z2z2 192| 5.47M| EC_FELEM u1; 193| 5.47M| ec_GFp_mont_felem_mul(group, &u1, &a->X, &z2z2); 194| | 195| | // two_z1z2 = (z1 + z2)**2 - (z1z1 + z2z2) = 2z1z2 196| 5.47M| EC_FELEM two_z1z2; 197| 5.47M| ec_felem_add(group, &two_z1z2, &a->Z, &b->Z); 198| 5.47M| ec_GFp_mont_felem_sqr(group, &two_z1z2, &two_z1z2); 199| 5.47M| ec_felem_sub(group, &two_z1z2, &two_z1z2, &z1z1); 200| 5.47M| ec_felem_sub(group, &two_z1z2, &two_z1z2, &z2z2); 201| | 202| | // s1 = y1 * z2**3 203| 5.47M| EC_FELEM s1; 204| 5.47M| ec_GFp_mont_felem_mul(group, &s1, &b->Z, &z2z2); 205| 5.47M| ec_GFp_mont_felem_mul(group, &s1, &s1, &a->Y); 206| | 207| | // u2 = x2*z1z1 208| 5.47M| EC_FELEM u2; 209| 5.47M| ec_GFp_mont_felem_mul(group, &u2, &b->X, &z1z1); 210| | 211| | // h = u2 - u1 212| 5.47M| EC_FELEM h; 213| 5.47M| ec_felem_sub(group, &h, &u2, &u1); 214| | 215| 5.47M| BN_ULONG xneq = ec_felem_non_zero_mask(group, &h); 216| | 217| | // z_out = two_z1z2 * h 218| 5.47M| ec_GFp_mont_felem_mul(group, &z_out, &h, &two_z1z2); 219| | 220| | // z1z1z1 = z1 * z1z1 221| 5.47M| EC_FELEM z1z1z1; 222| 5.47M| ec_GFp_mont_felem_mul(group, &z1z1z1, &a->Z, &z1z1); 223| | 224| | // s2 = y2 * z1**3 225| 5.47M| EC_FELEM s2; 226| 5.47M| ec_GFp_mont_felem_mul(group, &s2, &b->Y, &z1z1z1); 227| | 228| | // r = (s2 - s1)*2 229| 5.47M| EC_FELEM r; 230| 5.47M| ec_felem_sub(group, &r, &s2, &s1); 231| 5.47M| ec_felem_add(group, &r, &r, &r); 232| | 233| 5.47M| BN_ULONG yneq = ec_felem_non_zero_mask(group, &r); 234| | 235| | // This case will never occur in the constant-time |ec_GFp_mont_mul|. 236| 5.47M| BN_ULONG is_nontrivial_double = ~xneq & ~yneq & z1nz & z2nz; 237| 5.47M| if (constant_time_declassify_w(is_nontrivial_double)) { ------------------ | Branch (237:7): [True: 0, False: 5.47M] ------------------ 238| 0| ec_GFp_mont_dbl(group, out, a); 239| 0| return; 240| 0| } 241| | 242| | // I = (2h)**2 243| 5.47M| EC_FELEM i; 244| 5.47M| ec_felem_add(group, &i, &h, &h); 245| 5.47M| ec_GFp_mont_felem_sqr(group, &i, &i); 246| | 247| | // J = h * I 248| 5.47M| EC_FELEM j; 249| 5.47M| ec_GFp_mont_felem_mul(group, &j, &h, &i); 250| | 251| | // V = U1 * I 252| 5.47M| EC_FELEM v; 253| 5.47M| ec_GFp_mont_felem_mul(group, &v, &u1, &i); 254| | 255| | // x_out = r**2 - J - 2V 256| 5.47M| ec_GFp_mont_felem_sqr(group, &x_out, &r); 257| 5.47M| ec_felem_sub(group, &x_out, &x_out, &j); 258| 5.47M| ec_felem_sub(group, &x_out, &x_out, &v); 259| 5.47M| ec_felem_sub(group, &x_out, &x_out, &v); 260| | 261| | // y_out = r(V-x_out) - 2 * s1 * J 262| 5.47M| ec_felem_sub(group, &y_out, &v, &x_out); 263| 5.47M| ec_GFp_mont_felem_mul(group, &y_out, &y_out, &r); 264| 5.47M| EC_FELEM s1j; 265| 5.47M| ec_GFp_mont_felem_mul(group, &s1j, &s1, &j); 266| 5.47M| ec_felem_sub(group, &y_out, &y_out, &s1j); 267| 5.47M| ec_felem_sub(group, &y_out, &y_out, &s1j); 268| | 269| 5.47M| ec_felem_select(group, &x_out, z1nz, &x_out, &b->X); 270| 5.47M| ec_felem_select(group, &out->X, z2nz, &x_out, &a->X); 271| 5.47M| ec_felem_select(group, &y_out, z1nz, &y_out, &b->Y); 272| 5.47M| ec_felem_select(group, &out->Y, z2nz, &y_out, &a->Y); 273| 5.47M| ec_felem_select(group, &z_out, z1nz, &z_out, &b->Z); 274| 5.47M| ec_felem_select(group, &out->Z, z2nz, &z_out, &a->Z); 275| 5.47M|} ec_GFp_mont_dbl: 278| 23.6M| const EC_JACOBIAN *a) { 279| 23.6M| if (group->a_is_minus3) { ------------------ | Branch (279:7): [True: 23.6M, False: 0] ------------------ 280| | // The method is taken from: 281| | // http://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#doubling-dbl-2001-b 282| | // 283| | // Coq transcription and correctness proof: 284| | // 285| | // 286| 23.6M| EC_FELEM delta, gamma, beta, ftmp, ftmp2, tmptmp, alpha, fourbeta; 287| | // delta = z^2 288| 23.6M| ec_GFp_mont_felem_sqr(group, &delta, &a->Z); 289| | // gamma = y^2 290| 23.6M| ec_GFp_mont_felem_sqr(group, &gamma, &a->Y); 291| | // beta = x*gamma 292| 23.6M| ec_GFp_mont_felem_mul(group, &beta, &a->X, &gamma); 293| | 294| | // alpha = 3*(x-delta)*(x+delta) 295| 23.6M| ec_felem_sub(group, &ftmp, &a->X, &delta); 296| 23.6M| ec_felem_add(group, &ftmp2, &a->X, &delta); 297| | 298| 23.6M| ec_felem_add(group, &tmptmp, &ftmp2, &ftmp2); 299| 23.6M| ec_felem_add(group, &ftmp2, &ftmp2, &tmptmp); 300| 23.6M| ec_GFp_mont_felem_mul(group, &alpha, &ftmp, &ftmp2); 301| | 302| | // x' = alpha^2 - 8*beta 303| 23.6M| ec_GFp_mont_felem_sqr(group, &r->X, &alpha); 304| 23.6M| ec_felem_add(group, &fourbeta, &beta, &beta); 305| 23.6M| ec_felem_add(group, &fourbeta, &fourbeta, &fourbeta); 306| 23.6M| ec_felem_add(group, &tmptmp, &fourbeta, &fourbeta); 307| 23.6M| ec_felem_sub(group, &r->X, &r->X, &tmptmp); 308| | 309| | // z' = (y + z)^2 - gamma - delta 310| 23.6M| ec_felem_add(group, &delta, &gamma, &delta); 311| 23.6M| ec_felem_add(group, &ftmp, &a->Y, &a->Z); 312| 23.6M| ec_GFp_mont_felem_sqr(group, &r->Z, &ftmp); 313| 23.6M| ec_felem_sub(group, &r->Z, &r->Z, &delta); 314| | 315| | // y' = alpha*(4*beta - x') - 8*gamma^2 316| 23.6M| ec_felem_sub(group, &r->Y, &fourbeta, &r->X); 317| 23.6M| ec_felem_add(group, &gamma, &gamma, &gamma); 318| 23.6M| ec_GFp_mont_felem_sqr(group, &gamma, &gamma); 319| 23.6M| ec_GFp_mont_felem_mul(group, &r->Y, &alpha, &r->Y); 320| 23.6M| ec_felem_add(group, &gamma, &gamma, &gamma); 321| 23.6M| ec_felem_sub(group, &r->Y, &r->Y, &gamma); 322| 23.6M| } else { 323| | // The method is taken from: 324| | // http://www.hyperelliptic.org/EFD/g1p/auto-shortw-jacobian.html#doubling-dbl-2007-bl 325| | // 326| | // Coq transcription and correctness proof: 327| | // 328| | // 329| 0| EC_FELEM xx, yy, yyyy, zz; 330| 0| ec_GFp_mont_felem_sqr(group, &xx, &a->X); 331| 0| ec_GFp_mont_felem_sqr(group, &yy, &a->Y); 332| 0| ec_GFp_mont_felem_sqr(group, &yyyy, &yy); 333| 0| ec_GFp_mont_felem_sqr(group, &zz, &a->Z); 334| | 335| | // s = 2*((x_in + yy)^2 - xx - yyyy) 336| 0| EC_FELEM s; 337| 0| ec_felem_add(group, &s, &a->X, &yy); 338| 0| ec_GFp_mont_felem_sqr(group, &s, &s); 339| 0| ec_felem_sub(group, &s, &s, &xx); 340| 0| ec_felem_sub(group, &s, &s, &yyyy); 341| 0| ec_felem_add(group, &s, &s, &s); 342| | 343| | // m = 3*xx + a*zz^2 344| 0| EC_FELEM m; 345| 0| ec_GFp_mont_felem_sqr(group, &m, &zz); 346| 0| ec_GFp_mont_felem_mul(group, &m, &group->a, &m); 347| 0| ec_felem_add(group, &m, &m, &xx); 348| 0| ec_felem_add(group, &m, &m, &xx); 349| 0| ec_felem_add(group, &m, &m, &xx); 350| | 351| | // x_out = m^2 - 2*s 352| 0| ec_GFp_mont_felem_sqr(group, &r->X, &m); 353| 0| ec_felem_sub(group, &r->X, &r->X, &s); 354| 0| ec_felem_sub(group, &r->X, &r->X, &s); 355| | 356| | // z_out = (y_in + z_in)^2 - yy - zz 357| 0| ec_felem_add(group, &r->Z, &a->Y, &a->Z); 358| 0| ec_GFp_mont_felem_sqr(group, &r->Z, &r->Z); 359| 0| ec_felem_sub(group, &r->Z, &r->Z, &yy); 360| 0| ec_felem_sub(group, &r->Z, &r->Z, &zz); 361| | 362| | // y_out = m*(s-x_out) - 8*yyyy 363| 0| ec_felem_add(group, &yyyy, &yyyy, &yyyy); 364| 0| ec_felem_add(group, &yyyy, &yyyy, &yyyy); 365| 0| ec_felem_add(group, &yyyy, &yyyy, &yyyy); 366| 0| ec_felem_sub(group, &r->Y, &s, &r->X); 367| 0| ec_GFp_mont_felem_mul(group, &r->Y, &r->Y, &m); 368| 0| ec_felem_sub(group, &r->Y, &r->Y, &yyyy); 369| 0| } 370| 23.6M|} bcm.cc:_ZL33ec_GFp_mont_felem_from_montgomeryPK11ec_group_stP8EC_FELEMPKS2_: 35| 90.0k| const EC_FELEM *in) { 36| 90.0k| bn_from_montgomery_small(out->words, group->field.N.width, in->words, 37| 90.0k| group->field.N.width, &group->field); 38| 90.0k|} bcm.cc:_ZL31ec_GFp_mont_felem_to_montgomeryPK11ec_group_stP8EC_FELEMPKS2_: 28| 122k| EC_FELEM *out, const EC_FELEM *in) { 29| 122k| bn_to_montgomery_small(out->words, in->words, group->field.N.width, 30| 122k| &group->field); 31| 122k|} bcm.cc:_ZL26EC_GFp_mont_method_do_initP12ec_method_st: 418| 1|DEFINE_METHOD_FUNCTION(EC_METHOD, EC_GFp_mont_method) { 419| 1| out->point_get_affine_coordinates = ec_GFp_mont_point_get_affine_coordinates; 420| 1| out->jacobian_to_affine_batch = ec_GFp_mont_jacobian_to_affine_batch; 421| 1| out->add = ec_GFp_mont_add; 422| 1| out->dbl = ec_GFp_mont_dbl; 423| 1| out->mul = ec_GFp_mont_mul; 424| 1| out->mul_base = ec_GFp_mont_mul_base; 425| 1| out->mul_batch = ec_GFp_mont_mul_batch; 426| 1| out->mul_public_batch = ec_GFp_mont_mul_public_batch; 427| 1| out->init_precomp = ec_GFp_mont_init_precomp; 428| 1| out->mul_precomp = ec_GFp_mont_mul_precomp; 429| 1| out->felem_mul = ec_GFp_mont_felem_mul; 430| 1| out->felem_sqr = ec_GFp_mont_felem_sqr; 431| 1| out->felem_to_bytes = ec_GFp_mont_felem_to_bytes; 432| 1| out->felem_from_bytes = ec_GFp_mont_felem_from_bytes; 433| 1| out->felem_reduce = ec_GFp_mont_felem_reduce; 434| 1| out->felem_exp = ec_GFp_mont_felem_exp; 435| 1| out->scalar_inv0_montgomery = ec_simple_scalar_inv0_montgomery; 436| 1| out->scalar_to_montgomery_inv_vartime = 437| 1| ec_simple_scalar_to_montgomery_inv_vartime; 438| 1| out->cmp_x_coordinate = ec_GFp_mont_cmp_x_coordinate; 439| 1|} bcm.cc:_ZL40ec_GFp_mont_point_get_affine_coordinatesPK11ec_group_stPK11EC_JACOBIANP8EC_FELEMS6_: 95| 59.2k| EC_FELEM *x, EC_FELEM *y) { 96| 59.2k| if (constant_time_declassify_int( ------------------ | Branch (96:7): [True: 0, False: 59.2k] ------------------ 97| 59.2k| ec_GFp_simple_is_at_infinity(group, point))) { 98| 0| OPENSSL_PUT_ERROR(EC, EC_R_POINT_AT_INFINITY); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 99| 0| return 0; 100| 0| } 101| | 102| | // Transform (X, Y, Z) into (x, y) := (X/Z^2, Y/Z^3). Note the check above 103| | // ensures |point->Z| is non-zero, so the inverse always exists. 104| 59.2k| EC_FELEM z1, z2; 105| 59.2k| ec_GFp_mont_felem_inv0(group, &z2, &point->Z); 106| 59.2k| ec_GFp_mont_felem_sqr(group, &z1, &z2); 107| | 108| 59.2k| if (x != NULL) { ------------------ | Branch (108:7): [True: 59.2k, False: 0] ------------------ 109| 59.2k| ec_GFp_mont_felem_mul(group, x, &point->X, &z1); 110| 59.2k| } 111| | 112| 59.2k| if (y != NULL) { ------------------ | Branch (112:7): [True: 29.6k, False: 29.5k] ------------------ 113| 29.6k| ec_GFp_mont_felem_mul(group, &z1, &z1, &z2); 114| 29.6k| ec_GFp_mont_felem_mul(group, y, &point->Y, &z1); 115| 29.6k| } 116| | 117| 59.2k| return 1; 118| 59.2k|} bcm.cc:_ZL22ec_GFp_mont_felem_inv0PK11ec_group_stP8EC_FELEMPKS2_: 41| 59.2k| const EC_FELEM *a) { 42| 59.2k| bn_mod_inverse0_prime_mont_small(out->words, a->words, group->field.N.width, 43| 59.2k| &group->field); 44| 59.2k|} bcm.cc:_ZL28ec_GFp_mont_cmp_x_coordinatePK11ec_group_stPK11EC_JACOBIANPK9EC_SCALAR: 374| 592| const EC_SCALAR *r) { 375| 592| if (!group->field_greater_than_order || ------------------ | Branch (375:7): [True: 0, False: 592] ------------------ 376| 592| group->field.N.width != group->order.N.width) { ------------------ | Branch (376:7): [True: 0, False: 592] ------------------ 377| | // Do not bother optimizing this case. p > order in all commonly-used 378| | // curves. 379| 0| return ec_GFp_simple_cmp_x_coordinate(group, p, r); 380| 0| } 381| | 382| 592| if (ec_GFp_simple_is_at_infinity(group, p)) { ------------------ | Branch (382:7): [True: 0, False: 592] ------------------ 383| 0| return 0; 384| 0| } 385| | 386| | // We wish to compare X/Z^2 with r. This is equivalent to comparing X with 387| | // r*Z^2. Note that X and Z are represented in Montgomery form, while r is 388| | // not. 389| 592| EC_FELEM r_Z2, Z2_mont, X; 390| 592| ec_GFp_mont_felem_mul(group, &Z2_mont, &p->Z, &p->Z); 391| | // r < order < p, so this is valid. 392| 592| OPENSSL_memcpy(r_Z2.words, r->words, group->field.N.width * sizeof(BN_ULONG)); 393| 592| ec_GFp_mont_felem_mul(group, &r_Z2, &r_Z2, &Z2_mont); 394| 592| ec_GFp_mont_felem_from_montgomery(group, &X, &p->X); 395| | 396| 592| if (ec_felem_equal(group, &r_Z2, &X)) { ------------------ | Branch (396:7): [True: 0, False: 592] ------------------ 397| 0| return 1; 398| 0| } 399| | 400| | // During signing the x coefficient is reduced modulo the group order. 401| | // Therefore there is a small possibility, less than 1/2^128, that group_order 402| | // < p.x < P. in that case we need not only to compare against |r| but also to 403| | // compare against r+group_order. 404| 592| BN_ULONG carry = bn_add_words(r_Z2.words, r->words, group->order.N.d, 405| 592| group->field.N.width); 406| 592| if (carry == 0 && ------------------ | Branch (406:7): [True: 16, False: 576] ------------------ 407| 592| bn_less_than_words(r_Z2.words, group->field.N.d, group->field.N.width)) { ------------------ | Branch (407:7): [True: 11, False: 5] ------------------ 408| | // r + group_order < p, so compare (r + group_order) * Z^2 against X. 409| 11| ec_GFp_mont_felem_mul(group, &r_Z2, &r_Z2, &Z2_mont); 410| 11| if (ec_felem_equal(group, &r_Z2, &X)) { ------------------ | Branch (410:9): [True: 0, False: 11] ------------------ 411| 0| return 1; 412| 0| } 413| 11| } 414| | 415| 592| return 0; 416| 592|} ec_felem_one: 26| 58.6k|const EC_FELEM *ec_felem_one(const EC_GROUP *group) { 27| | // We reuse generator.Z as a cache for 1 in the field. 28| 58.6k| return &group->generator.raw.Z; 29| 58.6k|} ec_felem_to_bignum: 44| 29.7k|int ec_felem_to_bignum(const EC_GROUP *group, BIGNUM *out, const EC_FELEM *in) { 45| 29.7k| uint8_t bytes[EC_MAX_BYTES]; 46| 29.7k| size_t len; 47| 29.7k| ec_felem_to_bytes(group, bytes, &len, in); 48| 29.7k| return BN_bin2bn(bytes, len, out) != NULL; 49| 29.7k|} ec_felem_to_bytes: 52| 89.4k| const EC_FELEM *in) { 53| 89.4k| group->meth->felem_to_bytes(group, out, out_len, in); 54| 89.4k|} ec_felem_from_bytes: 57| 122k| size_t len) { 58| 122k| return group->meth->felem_from_bytes(group, out, in, len); 59| 122k|} ec_felem_neg: 61| 37.3k|void ec_felem_neg(const EC_GROUP *group, EC_FELEM *out, const EC_FELEM *a) { 62| | // -a is zero if a is zero and p-a otherwise. 63| 37.3k| BN_ULONG mask = ec_felem_non_zero_mask(group, a); 64| 37.3k| BN_ULONG borrow = bn_sub_words(out->words, group->field.N.d, a->words, 65| 37.3k| group->field.N.width); 66| 37.3k| assert(borrow == 0); 67| 37.3k| (void)borrow; 68| 262k| for (int i = 0; i < group->field.N.width; i++) { ------------------ | Branch (68:19): [True: 225k, False: 37.3k] ------------------ 69| 225k| out->words[i] &= mask; 70| 225k| } 71| 37.3k|} ec_felem_add: 74| 253M| const EC_FELEM *b) { 75| 253M| EC_FELEM tmp; 76| 253M| bn_mod_add_words(out->words, a->words, b->words, group->field.N.d, tmp.words, 77| 253M| group->field.N.width); 78| 253M|} ec_felem_sub: 81| 173M| const EC_FELEM *b) { 82| 173M| EC_FELEM tmp; 83| 173M| bn_mod_sub_words(out->words, a->words, b->words, group->field.N.d, tmp.words, 84| 173M| group->field.N.width); 85| 173M|} ec_felem_non_zero_mask: 87| 22.1M|BN_ULONG ec_felem_non_zero_mask(const EC_GROUP *group, const EC_FELEM *a) { 88| 22.1M| BN_ULONG mask = 0; 89| 155M| for (int i = 0; i < group->field.N.width; i++) { ------------------ | Branch (89:19): [True: 132M, False: 22.1M] ------------------ 90| 132M| mask |= a->words[i]; 91| 132M| } 92| 22.1M| return ~constant_time_is_zero_w(mask); 93| 22.1M|} ec_felem_select: 96| 470M| const EC_FELEM *a, const EC_FELEM *b) { 97| 470M| bn_select_words(out->words, mask, a->words, b->words, group->field.N.width); 98| 470M|} ec_felem_equal: 101| 61.6k| const EC_FELEM *b) { 102| 61.6k| return CRYPTO_memcmp(a->words, b->words, 103| 61.6k| group->field.N.width * sizeof(BN_ULONG)) == 0; 104| 61.6k|} ec_point_byte_len: 24| 59.5k|size_t ec_point_byte_len(const EC_GROUP *group, point_conversion_form_t form) { 25| 59.5k| if (form != POINT_CONVERSION_COMPRESSED && ------------------ | Branch (25:7): [True: 59.5k, False: 0] ------------------ 26| 59.5k| form != POINT_CONVERSION_UNCOMPRESSED) { ------------------ | Branch (26:7): [True: 0, False: 59.5k] ------------------ 27| 0| OPENSSL_PUT_ERROR(EC, EC_R_INVALID_FORM); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 28| 0| return 0; 29| 0| } 30| | 31| 59.5k| const size_t field_len = BN_num_bytes(&group->field.N); 32| 59.5k| size_t output_len = 1 /* type byte */ + field_len; 33| 59.5k| if (form == POINT_CONVERSION_UNCOMPRESSED) { ------------------ | Branch (33:7): [True: 59.5k, False: 0] ------------------ 34| | // Uncompressed points have a second coordinate. 35| 59.5k| output_len += field_len; 36| 59.5k| } 37| 59.5k| return output_len; 38| 59.5k|} ec_point_to_bytes: 42| 29.7k| size_t max_out) { 43| 29.7k| size_t output_len = ec_point_byte_len(group, form); 44| 29.7k| if (max_out < output_len) { ------------------ | Branch (44:7): [True: 0, False: 29.7k] ------------------ 45| 0| OPENSSL_PUT_ERROR(EC, EC_R_BUFFER_TOO_SMALL); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 46| 0| return 0; 47| 0| } 48| | 49| 29.7k| size_t field_len; 50| 29.7k| ec_felem_to_bytes(group, buf + 1, &field_len, &point->X); 51| 29.7k| assert(field_len == BN_num_bytes(&group->field.N)); 52| | 53| 29.7k| if (form == POINT_CONVERSION_UNCOMPRESSED) { ------------------ | Branch (53:7): [True: 29.7k, False: 0] ------------------ 54| 29.7k| ec_felem_to_bytes(group, buf + 1 + field_len, &field_len, &point->Y); 55| 29.7k| assert(field_len == BN_num_bytes(&group->field.N)); 56| 29.7k| buf[0] = form; 57| 29.7k| } else { 58| 0| uint8_t y_buf[EC_MAX_BYTES]; 59| 0| ec_felem_to_bytes(group, y_buf, &field_len, &point->Y); 60| 0| buf[0] = form + (y_buf[field_len - 1] & 1); 61| 0| } 62| | 63| 29.7k| return output_len; 64| 29.7k|} ec_point_from_uncompressed: 67| 61.1k| const uint8_t *in, size_t len) { 68| 61.1k| const size_t field_len = BN_num_bytes(&group->field.N); 69| 61.1k| if (len != 1 + 2 * field_len || in[0] != POINT_CONVERSION_UNCOMPRESSED) { ------------------ | Branch (69:7): [True: 24, False: 61.1k] | Branch (69:35): [True: 0, False: 61.1k] ------------------ 70| 24| OPENSSL_PUT_ERROR(EC, EC_R_INVALID_ENCODING); ------------------ | | 361| 24| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 71| 24| return 0; 72| 24| } 73| | 74| 61.1k| EC_FELEM x, y; 75| 61.1k| if (!ec_felem_from_bytes(group, &x, in + 1, field_len) || ------------------ | Branch (75:7): [True: 22, False: 61.0k] ------------------ 76| 61.1k| !ec_felem_from_bytes(group, &y, in + 1 + field_len, field_len) || ------------------ | Branch (76:7): [True: 12, False: 61.0k] ------------------ 77| 61.1k| !ec_point_set_affine_coordinates(group, out, &x, &y)) { ------------------ | Branch (77:7): [True: 2.40k, False: 58.6k] ------------------ 78| 2.44k| return 0; 79| 2.44k| } 80| | 81| 58.6k| return 1; 82| 61.1k|} EC_POINT_oct2point: 146| 61.2k| const uint8_t *buf, size_t len, BN_CTX *ctx) { 147| 61.2k| if (EC_GROUP_cmp(group, point->group, NULL) != 0) { ------------------ | Branch (147:7): [True: 0, False: 61.2k] ------------------ 148| 0| OPENSSL_PUT_ERROR(EC, EC_R_INCOMPATIBLE_OBJECTS); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 149| 0| return 0; 150| 0| } 151| 61.2k| return ec_GFp_simple_oct2point(group, point, buf, len, ctx); 152| 61.2k|} EC_POINT_point2oct: 156| 59.5k| size_t max_out, BN_CTX *ctx) { 157| 59.5k| if (EC_GROUP_cmp(group, point->group, NULL) != 0) { ------------------ | Branch (157:7): [True: 0, False: 59.5k] ------------------ 158| 0| OPENSSL_PUT_ERROR(EC, EC_R_INCOMPATIBLE_OBJECTS); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 159| 0| return 0; 160| 0| } 161| 59.5k| if (buf == NULL) { ------------------ | Branch (161:7): [True: 29.7k, False: 29.7k] ------------------ 162| | // When |buf| is NULL, just return the number of bytes that would be 163| | // written, without doing an expensive Jacobian-to-affine conversion. 164| 29.7k| if (ec_GFp_simple_is_at_infinity(group, &point->raw)) { ------------------ | Branch (164:9): [True: 0, False: 29.7k] ------------------ 165| 0| OPENSSL_PUT_ERROR(EC, EC_R_POINT_AT_INFINITY); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 166| 0| return 0; 167| 0| } 168| 29.7k| return ec_point_byte_len(group, form); 169| 29.7k| } 170| 29.7k| EC_AFFINE affine; 171| 29.7k| if (!ec_jacobian_to_affine(group, &affine, &point->raw)) { ------------------ | Branch (171:7): [True: 0, False: 29.7k] ------------------ 172| 0| return 0; 173| 0| } 174| 29.7k| return ec_point_to_bytes(group, &affine, form, buf, max_out); 175| 29.7k|} bcm.cc:_ZL23ec_GFp_simple_oct2pointPK11ec_group_stP11ec_point_stPKhmP10bignum_ctx: 86| 61.2k| BN_CTX *ctx) { 87| 61.2k| if (len == 0) { ------------------ | Branch (87:7): [True: 0, False: 61.2k] ------------------ 88| 0| OPENSSL_PUT_ERROR(EC, EC_R_BUFFER_TOO_SMALL); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 89| 0| return 0; 90| 0| } 91| | 92| 61.2k| uint8_t form = buf[0]; 93| 61.2k| if (form == static_cast(POINT_CONVERSION_UNCOMPRESSED)) { ------------------ | Branch (93:7): [True: 61.1k, False: 113] ------------------ 94| 61.1k| EC_AFFINE affine; 95| 61.1k| if (!ec_point_from_uncompressed(group, &affine, buf, len)) { ------------------ | Branch (95:9): [True: 2.46k, False: 58.6k] ------------------ 96| | // In the event of an error, defend against the caller not checking the 97| | // return value by setting a known safe value. 98| 2.46k| ec_set_to_safe_point(group, &point->raw); 99| 2.46k| return 0; 100| 2.46k| } 101| 58.6k| ec_affine_to_jacobian(group, &point->raw, &affine); 102| 58.6k| return 1; 103| 61.1k| } 104| | 105| 113| const int y_bit = form & 1; 106| 113| const size_t field_len = BN_num_bytes(&group->field.N); 107| 113| form = form & ~1u; 108| 113| if (form != static_cast(POINT_CONVERSION_COMPRESSED) || ------------------ | Branch (108:7): [True: 94, False: 19] ------------------ 109| 113| len != 1 /* type byte */ + field_len) { ------------------ | Branch (109:7): [True: 19, False: 0] ------------------ 110| 113| OPENSSL_PUT_ERROR(EC, EC_R_INVALID_ENCODING); ------------------ | | 361| 113| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 111| 113| return 0; 112| 113| } 113| | 114| | // TODO(davidben): Integrate compressed coordinates with the lower-level EC 115| | // abstractions. This requires a way to compute square roots, which is tricky 116| | // for primes which are not 3 (mod 4), namely P-224 and custom curves. P-224's 117| | // prime is particularly inconvenient for compressed coordinates. See 118| | // https://cr.yp.to/papers/sqroot.pdf 119| 0| bssl::UniquePtr new_ctx; 120| 0| if (ctx == nullptr) { ------------------ | Branch (120:7): [True: 0, False: 0] ------------------ 121| 0| new_ctx.reset(BN_CTX_new()); 122| 0| if (new_ctx == nullptr) { ------------------ | Branch (122:9): [True: 0, False: 0] ------------------ 123| 0| return 0; 124| 0| } 125| 0| ctx = new_ctx.get(); 126| 0| } 127| | 128| 0| bssl::BN_CTXScope scope(ctx); 129| 0| BIGNUM *x = BN_CTX_get(ctx); 130| 0| if (x == nullptr || !BN_bin2bn(buf + 1, field_len, x)) { ------------------ | Branch (130:7): [True: 0, False: 0] | Branch (130:23): [True: 0, False: 0] ------------------ 131| 0| return 0; 132| 0| } 133| 0| if (BN_ucmp(x, &group->field.N) >= 0) { ------------------ | Branch (133:7): [True: 0, False: 0] ------------------ 134| 0| OPENSSL_PUT_ERROR(EC, EC_R_INVALID_ENCODING); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 135| 0| return 0; 136| 0| } 137| | 138| 0| if (!EC_POINT_set_compressed_coordinates_GFp(group, point, x, y_bit, ctx)) { ------------------ | Branch (138:7): [True: 0, False: 0] ------------------ 139| 0| return 0; 140| 0| } 141| | 142| 0| return 1; 143| 0|} bcm.cc:_ZL30EC_GFp_nistp224_method_do_initP12ec_method_st: 1145| 2|DEFINE_METHOD_FUNCTION(EC_METHOD, EC_GFp_nistp224_method) { 1146| 2| out->point_get_affine_coordinates = 1147| 2| ec_GFp_nistp224_point_get_affine_coordinates; 1148| 2| out->add = ec_GFp_nistp224_add; 1149| 2| out->dbl = ec_GFp_nistp224_dbl; 1150| 2| out->mul = ec_GFp_nistp224_point_mul; 1151| 2| out->mul_base = ec_GFp_nistp224_point_mul_base; 1152| 2| out->mul_public = ec_GFp_nistp224_point_mul_public; 1153| 2| out->felem_mul = ec_GFp_nistp224_felem_mul; 1154| 2| out->felem_sqr = ec_GFp_nistp224_felem_sqr; 1155| 2| out->felem_to_bytes = ec_GFp_simple_felem_to_bytes; 1156| 2| out->felem_from_bytes = ec_GFp_simple_felem_from_bytes; 1157| 2| out->scalar_inv0_montgomery = ec_simple_scalar_inv0_montgomery; 1158| 2| out->scalar_to_montgomery_inv_vartime = 1159| 2| ec_simple_scalar_to_montgomery_inv_vartime; 1160| 2| out->cmp_x_coordinate = ec_GFp_simple_cmp_x_coordinate; 1161| 2|} bcm.cc:_ZL21p224_generic_to_felemPmPK8EC_FELEM: 182| 240|static void p224_generic_to_felem(p224_felem out, const EC_FELEM *in) { 183| | // |p224_felem|'s minimal representation uses four 56-bit words. |EC_FELEM| 184| | // uses four 64-bit words. (The top-most word only has 32 bits.) 185| 240| out[0] = in->words[0] & 0x00ffffffffffffff; 186| 240| out[1] = ((in->words[0] >> 56) | (in->words[1] << 8)) & 0x00ffffffffffffff; 187| 240| out[2] = ((in->words[1] >> 48) | (in->words[2] << 16)) & 0x00ffffffffffffff; 188| 240| out[3] = ((in->words[2] >> 40) | (in->words[3] << 24)) & 0x00ffffffffffffff; 189| 240|} bcm.cc:_ZL17p224_felem_squarePoPKm: 365| 120|static void p224_felem_square(p224_widefelem out, const p224_felem in) { 366| 120| p224_limb tmp0, tmp1, tmp2; 367| 120| tmp0 = 2 * in[0]; 368| 120| tmp1 = 2 * in[1]; 369| 120| tmp2 = 2 * in[2]; 370| 120| out[0] = ((p224_widelimb)in[0]) * in[0]; 371| 120| out[1] = ((p224_widelimb)in[0]) * tmp1; 372| 120| out[2] = ((p224_widelimb)in[0]) * tmp2 + ((p224_widelimb)in[1]) * in[1]; 373| 120| out[3] = ((p224_widelimb)in[3]) * tmp0 + ((p224_widelimb)in[1]) * tmp2; 374| 120| out[4] = ((p224_widelimb)in[3]) * tmp1 + ((p224_widelimb)in[2]) * in[2]; 375| 120| out[5] = ((p224_widelimb)in[3]) * tmp2; 376| 120| out[6] = ((p224_widelimb)in[3]) * in[3]; 377| 120|} bcm.cc:_ZL17p224_felem_reducePmPKo: 397| 180|static void p224_felem_reduce(p224_felem out, const p224_widefelem in) { 398| 180| static const p224_widelimb two127p15 = 399| 180| (((p224_widelimb)1) << 127) + (((p224_widelimb)1) << 15); 400| 180| static const p224_widelimb two127m71 = 401| 180| (((p224_widelimb)1) << 127) - (((p224_widelimb)1) << 71); 402| 180| static const p224_widelimb two127m71m55 = (((p224_widelimb)1) << 127) - 403| 180| (((p224_widelimb)1) << 71) - 404| 180| (((p224_widelimb)1) << 55); 405| 180| p224_widelimb output[5]; 406| | 407| | // Add 0 mod 2^224-2^96+1 to ensure all differences are positive 408| 180| output[0] = in[0] + two127p15; 409| 180| output[1] = in[1] + two127m71m55; 410| 180| output[2] = in[2] + two127m71; 411| 180| output[3] = in[3]; 412| 180| output[4] = in[4]; 413| | 414| | // Eliminate in[4], in[5], in[6] 415| 180| output[4] += in[6] >> 16; 416| 180| output[3] += (in[6] & 0xffff) << 40; 417| 180| output[2] -= in[6]; 418| | 419| 180| output[3] += in[5] >> 16; 420| 180| output[2] += (in[5] & 0xffff) << 40; 421| 180| output[1] -= in[5]; 422| | 423| 180| output[2] += output[4] >> 16; 424| 180| output[1] += (output[4] & 0xffff) << 40; 425| 180| output[0] -= output[4]; 426| | 427| | // Carry 2 -> 3 -> 4 428| 180| output[3] += output[2] >> 56; 429| 180| output[2] &= 0x00ffffffffffffff; 430| | 431| 180| output[4] = output[3] >> 56; 432| 180| output[3] &= 0x00ffffffffffffff; 433| | 434| | // Now output[2] < 2^56, output[3] < 2^56, output[4] < 2^72 435| | 436| | // Eliminate output[4] 437| 180| output[2] += output[4] >> 16; 438| | // output[2] < 2^56 + 2^56 = 2^57 439| 180| output[1] += (output[4] & 0xffff) << 40; 440| 180| output[0] -= output[4]; 441| | 442| | // Carry 0 -> 1 -> 2 -> 3 443| 180| output[1] += output[0] >> 56; 444| 180| out[0] = output[0] & 0x00ffffffffffffff; 445| | 446| 180| output[2] += output[1] >> 56; 447| | // output[2] < 2^57 + 2^72 448| 180| out[1] = output[1] & 0x00ffffffffffffff; 449| 180| output[3] += output[2] >> 56; 450| | // output[3] <= 2^56 + 2^16 451| 180| out[2] = output[2] & 0x00ffffffffffffff; 452| | 453| | // out[0] < 2^56, out[1] < 2^56, out[2] < 2^56, 454| | // out[3] <= 2^56 + 2^16 (due to final carry), 455| | // so out < 2*p 456| 180| out[3] = output[3]; 457| 180|} bcm.cc:_ZL14p224_felem_mulPoPKmS1_: 381| 60| const p224_felem in2) { 382| 60| out[0] = ((p224_widelimb)in1[0]) * in2[0]; 383| 60| out[1] = ((p224_widelimb)in1[0]) * in2[1] + ((p224_widelimb)in1[1]) * in2[0]; 384| 60| out[2] = ((p224_widelimb)in1[0]) * in2[2] + ((p224_widelimb)in1[1]) * in2[1] + 385| 60| ((p224_widelimb)in1[2]) * in2[0]; 386| 60| out[3] = ((p224_widelimb)in1[0]) * in2[3] + ((p224_widelimb)in1[1]) * in2[2] + 387| 60| ((p224_widelimb)in1[2]) * in2[1] + ((p224_widelimb)in1[3]) * in2[0]; 388| 60| out[4] = ((p224_widelimb)in1[1]) * in2[3] + ((p224_widelimb)in1[2]) * in2[2] + 389| 60| ((p224_widelimb)in1[3]) * in2[1]; 390| 60| out[5] = ((p224_widelimb)in1[2]) * in2[3] + ((p224_widelimb)in1[3]) * in2[2]; 391| 60| out[6] = ((p224_widelimb)in1[3]) * in2[3]; 392| 60|} bcm.cc:_ZL21p224_felem_to_genericP8EC_FELEMPKm: 192| 180|static void p224_felem_to_generic(EC_FELEM *out, const p224_felem in) { 193| | // Reduce to unique minimal representation. 194| 180| static const int64_t two56 = ((p224_limb)1) << 56; 195| | // 0 <= in < 2*p, p = 2^224 - 2^96 + 1 196| | // if in > p , reduce in = in - 2^224 + 2^96 - 1 197| 180| int64_t tmp[4], a; 198| 180| tmp[0] = in[0]; 199| 180| tmp[1] = in[1]; 200| 180| tmp[2] = in[2]; 201| 180| tmp[3] = in[3]; 202| | // Case 1: a = 1 iff in >= 2^224 203| 180| a = (in[3] >> 56); 204| 180| tmp[0] -= a; 205| 180| tmp[1] += a << 40; 206| 180| tmp[3] &= 0x00ffffffffffffff; 207| | // Case 2: a = 0 iff p <= in < 2^224, i.e., the high 128 bits are all 1 and 208| | // the lower part is non-zero 209| 180| a = ((in[3] & in[2] & (in[1] | 0x000000ffffffffff)) + 1) | 210| 180| (((int64_t)(in[0] + (in[1] & 0x000000ffffffffff)) - 1) >> 63); 211| 180| a &= 0x00ffffffffffffff; 212| | // turn a into an all-one mask (if a = 0) or an all-zero mask 213| 180| a = (a - 1) >> 63; 214| | // subtract 2^224 - 2^96 + 1 if a is all-one 215| 180| tmp[3] &= a ^ 0xffffffffffffffff; 216| 180| tmp[2] &= a ^ 0xffffffffffffffff; 217| 180| tmp[1] &= (a ^ 0xffffffffffffffff) | 0x000000ffffffffff; 218| 180| tmp[0] -= 1 & a; 219| | 220| | // eliminate negative coefficients: if tmp[0] is negative, tmp[1] must 221| | // be non-zero, so we only need one step 222| 180| a = tmp[0] >> 63; 223| 180| tmp[0] += two56 & a; 224| 180| tmp[1] -= 1 & a; 225| | 226| | // carry 1 -> 2 -> 3 227| 180| tmp[2] += tmp[1] >> 56; 228| 180| tmp[1] &= 0x00ffffffffffffff; 229| | 230| 180| tmp[3] += tmp[2] >> 56; 231| 180| tmp[2] &= 0x00ffffffffffffff; 232| | 233| | // Now 0 <= tmp < p 234| 180| p224_felem tmp2; 235| 180| tmp2[0] = tmp[0]; 236| 180| tmp2[1] = tmp[1]; 237| 180| tmp2[2] = tmp[2]; 238| 180| tmp2[3] = tmp[3]; 239| | 240| | // |p224_felem|'s minimal representation uses four 56-bit words. |EC_FELEM| 241| | // uses four 64-bit words. (The top-most word only has 32 bits.) 242| 180| out->words[0] = tmp2[0] | (tmp2[1] << 56); 243| 180| out->words[1] = (tmp2[1] >> 8) | (tmp2[2] << 48); 244| 180| out->words[2] = (tmp2[2] >> 16) | (tmp2[3] << 40); 245| 180| out->words[3] = tmp2[3] >> 24; 246| 180|} bcm.cc:_ZL25ec_GFp_nistp224_felem_mulPK11ec_group_stP8EC_FELEMPKS2_S5_: 1125| 60| const EC_FELEM *a, const EC_FELEM *b) { 1126| 60| p224_felem felem1, felem2; 1127| 60| p224_widefelem wide; 1128| 60| p224_generic_to_felem(felem1, a); 1129| 60| p224_generic_to_felem(felem2, b); 1130| 60| p224_felem_mul(wide, felem1, felem2); 1131| 60| p224_felem_reduce(felem1, wide); 1132| 60| p224_felem_to_generic(r, felem1); 1133| 60|} bcm.cc:_ZL25ec_GFp_nistp224_felem_sqrPK11ec_group_stP8EC_FELEMPKS2_: 1136| 120| const EC_FELEM *a) { 1137| 120| p224_felem felem; 1138| 120| p224_generic_to_felem(felem, a); 1139| 120| p224_widefelem wide; 1140| 120| p224_felem_square(wide, felem); 1141| 120| p224_felem_reduce(felem, wide); 1142| 120| p224_felem_to_generic(r, felem); 1143| 120|} bcm.cc:_ZL30EC_GFp_nistz256_method_do_initP12ec_method_st: 718| 2|DEFINE_METHOD_FUNCTION(EC_METHOD, EC_GFp_nistz256_method) { 719| 2| out->point_get_affine_coordinates = ecp_nistz256_get_affine; 720| 2| out->add = ecp_nistz256_add; 721| 2| out->dbl = ecp_nistz256_dbl; 722| 2| out->mul = ecp_nistz256_point_mul; 723| 2| out->mul_base = ecp_nistz256_point_mul_base; 724| 2| out->mul_public = ecp_nistz256_points_mul_public; 725| 2| out->felem_mul = ec_GFp_mont_felem_mul; 726| 2| out->felem_sqr = ec_GFp_mont_felem_sqr; 727| 2| out->felem_to_bytes = ec_GFp_mont_felem_to_bytes; 728| 2| out->felem_from_bytes = ec_GFp_mont_felem_from_bytes; 729| 2| out->felem_reduce = ec_GFp_mont_felem_reduce; 730| | // TODO(davidben): This should use the specialized field arithmetic 731| | // implementation, rather than the generic one. 732| 2| out->felem_exp = ec_GFp_mont_felem_exp; 733| 2| out->scalar_inv0_montgomery = ecp_nistz256_inv0_mod_ord; 734| 2| out->scalar_to_montgomery_inv_vartime = 735| 2| ecp_nistz256_scalar_to_montgomery_inv_vartime; 736| 2| out->cmp_x_coordinate = ecp_nistz256_cmp_x_coordinate; 737| 2|} bcm.cc:_ZL23ecp_nistz256_get_affinePK11ec_group_stPK11EC_JACOBIANP8EC_FELEMS6_: 528| 312| EC_FELEM *y) { 529| 312| if (constant_time_declassify_int( ------------------ | Branch (529:7): [True: 0, False: 312] ------------------ 530| 312| ec_GFp_simple_is_at_infinity(group, point))) { 531| 0| OPENSSL_PUT_ERROR(EC, EC_R_POINT_AT_INFINITY); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 532| 0| return 0; 533| 0| } 534| | 535| 312| BN_ULONG z_inv2[P256_LIMBS]; 536| 312| assert(group->field.N.width == P256_LIMBS); 537| 312| ecp_nistz256_mod_inverse_sqr_mont(z_inv2, point->Z.words); 538| | 539| 312| if (x != NULL) { ------------------ | Branch (539:7): [True: 312, False: 0] ------------------ 540| 312| ecp_nistz256_mul_mont(x->words, z_inv2, point->X.words); 541| 312| } 542| | 543| 312| if (y != NULL) { ------------------ | Branch (543:7): [True: 203, False: 109] ------------------ 544| 203| ecp_nistz256_sqr_mont(z_inv2, z_inv2); // z^-4 545| 203| ecp_nistz256_mul_mont(y->words, point->Y.words, point->Z.words); // y * z 546| 203| ecp_nistz256_mul_mont(y->words, y->words, z_inv2); // y * z^-3 547| 203| } 548| | 549| 312| return 1; 550| 312|} bcm.cc:_ZL33ecp_nistz256_mod_inverse_sqr_montPmPKm: 227| 312| const BN_ULONG in[P256_LIMBS]) { 228| | // This implements the addition chain described in 229| | // https://briansmith.org/ecc-inversion-addition-chains-01#p256_field_inversion 230| 312| BN_ULONG x2[P256_LIMBS], x3[P256_LIMBS], x6[P256_LIMBS], x12[P256_LIMBS], 231| 312| x15[P256_LIMBS], x30[P256_LIMBS], x32[P256_LIMBS]; 232| 312| ecp_nistz256_sqr_mont(x2, in); // 2^2 - 2^1 233| 312| ecp_nistz256_mul_mont(x2, x2, in); // 2^2 - 2^0 234| | 235| 312| ecp_nistz256_sqr_mont(x3, x2); // 2^3 - 2^1 236| 312| ecp_nistz256_mul_mont(x3, x3, in); // 2^3 - 2^0 237| | 238| 312| ecp_nistz256_sqr_mont(x6, x3); 239| 936| for (int i = 1; i < 3; i++) { ------------------ | Branch (239:19): [True: 624, False: 312] ------------------ 240| 624| ecp_nistz256_sqr_mont(x6, x6); 241| 624| } // 2^6 - 2^3 242| 312| ecp_nistz256_mul_mont(x6, x6, x3); // 2^6 - 2^0 243| | 244| 312| ecp_nistz256_sqr_mont(x12, x6); 245| 1.87k| for (int i = 1; i < 6; i++) { ------------------ | Branch (245:19): [True: 1.56k, False: 312] ------------------ 246| 1.56k| ecp_nistz256_sqr_mont(x12, x12); 247| 1.56k| } // 2^12 - 2^6 248| 312| ecp_nistz256_mul_mont(x12, x12, x6); // 2^12 - 2^0 249| | 250| 312| ecp_nistz256_sqr_mont(x15, x12); 251| 936| for (int i = 1; i < 3; i++) { ------------------ | Branch (251:19): [True: 624, False: 312] ------------------ 252| 624| ecp_nistz256_sqr_mont(x15, x15); 253| 624| } // 2^15 - 2^3 254| 312| ecp_nistz256_mul_mont(x15, x15, x3); // 2^15 - 2^0 255| | 256| 312| ecp_nistz256_sqr_mont(x30, x15); 257| 4.68k| for (int i = 1; i < 15; i++) { ------------------ | Branch (257:19): [True: 4.36k, False: 312] ------------------ 258| 4.36k| ecp_nistz256_sqr_mont(x30, x30); 259| 4.36k| } // 2^30 - 2^15 260| 312| ecp_nistz256_mul_mont(x30, x30, x15); // 2^30 - 2^0 261| | 262| 312| ecp_nistz256_sqr_mont(x32, x30); 263| 312| ecp_nistz256_sqr_mont(x32, x32); // 2^32 - 2^2 264| 312| ecp_nistz256_mul_mont(x32, x32, x2); // 2^32 - 2^0 265| | 266| 312| BN_ULONG ret[P256_LIMBS]; 267| 312| ecp_nistz256_sqr_mont(ret, x32); 268| 9.98k| for (int i = 1; i < 31 + 1; i++) { ------------------ | Branch (268:19): [True: 9.67k, False: 312] ------------------ 269| 9.67k| ecp_nistz256_sqr_mont(ret, ret); 270| 9.67k| } // 2^64 - 2^32 271| 312| ecp_nistz256_mul_mont(ret, ret, in); // 2^64 - 2^32 + 2^0 272| | 273| 40.2k| for (int i = 0; i < 96 + 32; i++) { ------------------ | Branch (273:19): [True: 39.9k, False: 312] ------------------ 274| 39.9k| ecp_nistz256_sqr_mont(ret, ret); 275| 39.9k| } // 2^192 - 2^160 + 2^128 276| 312| ecp_nistz256_mul_mont(ret, ret, x32); // 2^192 - 2^160 + 2^128 + 2^32 - 2^0 277| | 278| 10.2k| for (int i = 0; i < 32; i++) { ------------------ | Branch (278:19): [True: 9.98k, False: 312] ------------------ 279| 9.98k| ecp_nistz256_sqr_mont(ret, ret); 280| 9.98k| } // 2^224 - 2^192 + 2^160 + 2^64 - 2^32 281| 312| ecp_nistz256_mul_mont(ret, ret, x32); // 2^224 - 2^192 + 2^160 + 2^64 - 2^0 282| | 283| 9.67k| for (int i = 0; i < 30; i++) { ------------------ | Branch (283:19): [True: 9.36k, False: 312] ------------------ 284| 9.36k| ecp_nistz256_sqr_mont(ret, ret); 285| 9.36k| } // 2^254 - 2^222 + 2^190 + 2^94 - 2^30 286| 312| ecp_nistz256_mul_mont(ret, ret, x30); // 2^254 - 2^222 + 2^190 + 2^94 - 2^0 287| | 288| 312| ecp_nistz256_sqr_mont(ret, ret); 289| 312| ecp_nistz256_sqr_mont(r, ret); // 2^256 - 2^224 + 2^192 + 2^96 - 2^2 290| 312|} bcm.cc:_ZL21ecp_nistz256_mul_montPmPKmS1_: 132| 16.9k| const BN_ULONG b[P256_LIMBS]) { 133| 16.9k| if (CRYPTO_is_BMI2_capable() && CRYPTO_is_ADX_capable()) { ------------------ | Branch (133:7): [True: 16.9k, False: 0] | Branch (133:35): [True: 16.9k, False: 0] ------------------ 134| 16.9k| ecp_nistz256_mul_mont_adx(res, a, b); 135| 16.9k| } else { 136| 0| ecp_nistz256_mul_mont_nohw(res, a, b); 137| 0| } 138| 16.9k|} bcm.cc:_ZL21ecp_nistz256_sqr_montPmPKm: 141| 79.7k| const BN_ULONG a[P256_LIMBS]) { 142| 79.7k| if (CRYPTO_is_BMI2_capable() && CRYPTO_is_ADX_capable()) { ------------------ | Branch (142:7): [True: 79.7k, False: 0] | Branch (142:35): [True: 79.7k, False: 0] ------------------ 143| 79.7k| ecp_nistz256_sqr_mont_adx(res, a); 144| 79.7k| } else { 145| 0| ecp_nistz256_sqr_mont_nohw(res, a); 146| 0| } 147| 79.7k|} bcm.cc:_ZL22ecp_nistz256_point_addP10P256_POINTPKS_S2_: 197| 249k| const P256_POINT *b) { 198| 249k| if (CRYPTO_is_BMI2_capable() && CRYPTO_is_ADX_capable()) { ------------------ | Branch (198:7): [True: 249k, False: 0] | Branch (198:35): [True: 249k, False: 0] ------------------ 199| 249k| ecp_nistz256_point_add_adx(r, a, b); 200| 249k| } else { 201| 0| ecp_nistz256_point_add_nohw(r, a, b); 202| 0| } 203| 249k|} bcm.cc:_ZL25ecp_nistz256_point_doubleP10P256_POINTPKS_: 188| 1.11M|static void ecp_nistz256_point_double(P256_POINT *r, const P256_POINT *a) { 189| 1.11M| if (CRYPTO_is_BMI2_capable() && CRYPTO_is_ADX_capable()) { ------------------ | Branch (189:7): [True: 1.11M, False: 0] | Branch (189:35): [True: 1.11M, False: 0] ------------------ 190| 1.11M| ecp_nistz256_point_double_adx(r, a); 191| 1.11M| } else { 192| 0| ecp_nistz256_point_double_nohw(r, a); 193| 0| } 194| 1.11M|} bcm.cc:_ZL22ecp_nistz256_point_mulPK11ec_group_stP11EC_JACOBIANPKS2_PK9EC_SCALAR: 408| 2| const EC_SCALAR *scalar) { 409| 2| alignas(32) P256_POINT out; 410| 2| ecp_nistz256_windowed_mul(group, &out, p, scalar); 411| | 412| 2| assert(group->field.N.width == P256_LIMBS); 413| 2| OPENSSL_memcpy(r->X.words, out.X, P256_LIMBS * sizeof(BN_ULONG)); ------------------ | | 50| 2|#define P256_LIMBS (256 / BN_BITS2) | | ------------------ | | | | 42| 2|#define BN_BITS2 64 | | ------------------ ------------------ 414| 2| OPENSSL_memcpy(r->Y.words, out.Y, P256_LIMBS * sizeof(BN_ULONG)); ------------------ | | 50| 2|#define P256_LIMBS (256 / BN_BITS2) | | ------------------ | | | | 42| 2|#define BN_BITS2 64 | | ------------------ ------------------ 415| 2| OPENSSL_memcpy(r->Z.words, out.Z, P256_LIMBS * sizeof(BN_ULONG)); ------------------ | | 50| 2|#define P256_LIMBS (256 / BN_BITS2) | | ------------------ | | | | 42| 2|#define BN_BITS2 64 | | ------------------ ------------------ 416| 2|} bcm.cc:_ZL25ecp_nistz256_windowed_mulPK11ec_group_stP10P256_POINTPK11EC_JACOBIANPK9EC_SCALAR: 295| 4.23k| const EC_SCALAR *p_scalar) { 296| 4.23k| assert(p != NULL); 297| 4.23k| assert(p_scalar != NULL); 298| 4.23k| assert(group->field.N.width == P256_LIMBS); 299| | 300| 4.23k| static const size_t kWindowSize = 5; 301| 4.23k| static const crypto_word_t kMask = (1 << (5 /* kWindowSize */ + 1)) - 1; 302| | 303| | // A |P256_POINT| is (3 * 32) = 96 bytes, and the 64-byte alignment should 304| | // add no more than 63 bytes of overhead. Thus, |table| should require 305| | // ~1599 ((96 * 16) + 63) bytes of stack space. 306| 4.23k| alignas(64) P256_POINT table[16]; 307| 4.23k| uint8_t p_str[33]; 308| 4.23k| OPENSSL_memcpy(p_str, p_scalar->words, 32); 309| 4.23k| p_str[32] = 0; 310| | 311| | // table[0] is implicitly (0,0,0) (the point at infinity), therefore it is 312| | // not stored. All other values are actually stored with an offset of -1 in 313| | // table. 314| 4.23k| P256_POINT *row = table; 315| 4.23k| assert(group->field.N.width == P256_LIMBS); 316| 4.23k| OPENSSL_memcpy(row[1 - 1].X, p->X.words, P256_LIMBS * sizeof(BN_ULONG)); ------------------ | | 50| 4.23k|#define P256_LIMBS (256 / BN_BITS2) | | ------------------ | | | | 42| 4.23k|#define BN_BITS2 64 | | ------------------ ------------------ 317| 4.23k| OPENSSL_memcpy(row[1 - 1].Y, p->Y.words, P256_LIMBS * sizeof(BN_ULONG)); ------------------ | | 50| 4.23k|#define P256_LIMBS (256 / BN_BITS2) | | ------------------ | | | | 42| 4.23k|#define BN_BITS2 64 | | ------------------ ------------------ 318| 4.23k| OPENSSL_memcpy(row[1 - 1].Z, p->Z.words, P256_LIMBS * sizeof(BN_ULONG)); ------------------ | | 50| 4.23k|#define P256_LIMBS (256 / BN_BITS2) | | ------------------ | | | | 42| 4.23k|#define BN_BITS2 64 | | ------------------ ------------------ 319| | 320| 4.23k| ecp_nistz256_point_double(&row[2 - 1], &row[1 - 1]); 321| 4.23k| ecp_nistz256_point_add(&row[3 - 1], &row[2 - 1], &row[1 - 1]); 322| 4.23k| ecp_nistz256_point_double(&row[4 - 1], &row[2 - 1]); 323| 4.23k| ecp_nistz256_point_double(&row[6 - 1], &row[3 - 1]); 324| 4.23k| ecp_nistz256_point_double(&row[8 - 1], &row[4 - 1]); 325| 4.23k| ecp_nistz256_point_double(&row[12 - 1], &row[6 - 1]); 326| 4.23k| ecp_nistz256_point_add(&row[5 - 1], &row[4 - 1], &row[1 - 1]); 327| 4.23k| ecp_nistz256_point_add(&row[7 - 1], &row[6 - 1], &row[1 - 1]); 328| 4.23k| ecp_nistz256_point_add(&row[9 - 1], &row[8 - 1], &row[1 - 1]); 329| 4.23k| ecp_nistz256_point_add(&row[13 - 1], &row[12 - 1], &row[1 - 1]); 330| 4.23k| ecp_nistz256_point_double(&row[14 - 1], &row[7 - 1]); 331| 4.23k| ecp_nistz256_point_double(&row[10 - 1], &row[5 - 1]); 332| 4.23k| ecp_nistz256_point_add(&row[15 - 1], &row[14 - 1], &row[1 - 1]); 333| 4.23k| ecp_nistz256_point_add(&row[11 - 1], &row[10 - 1], &row[1 - 1]); 334| 4.23k| ecp_nistz256_point_double(&row[16 - 1], &row[8 - 1]); 335| | 336| 4.23k| BN_ULONG tmp[P256_LIMBS]; 337| 4.23k| alignas(32) P256_POINT h; 338| 4.23k| size_t index = 255; 339| 4.23k| crypto_word_t wvalue = p_str[(index - 1) / 8]; 340| 4.23k| wvalue = (wvalue >> ((index - 1) % 8)) & kMask; 341| | 342| 4.23k| ecp_nistz256_select_w5(r, table, booth_recode_w5(wvalue) >> 1); 343| | 344| 220k| while (index >= 5) { ------------------ | Branch (344:10): [True: 215k, False: 4.23k] ------------------ 345| 215k| if (index != 255) { ------------------ | Branch (345:9): [True: 211k, False: 4.23k] ------------------ 346| 211k| size_t off = (index - 1) / 8; 347| | 348| 211k| wvalue = (crypto_word_t)p_str[off] | (crypto_word_t)p_str[off + 1] << 8; 349| 211k| wvalue = (wvalue >> ((index - 1) % 8)) & kMask; 350| | 351| 211k| wvalue = booth_recode_w5(wvalue); 352| | 353| 211k| ecp_nistz256_select_w5(&h, table, wvalue >> 1); 354| | 355| 211k| ecp_nistz256_neg(tmp, h.Y); 356| 211k| copy_conditional(h.Y, tmp, (wvalue & 1)); 357| | 358| 211k| ecp_nistz256_point_add(r, r, &h); 359| 211k| } 360| | 361| 215k| index -= kWindowSize; 362| | 363| 215k| ecp_nistz256_point_double(r, r); 364| 215k| ecp_nistz256_point_double(r, r); 365| 215k| ecp_nistz256_point_double(r, r); 366| 215k| ecp_nistz256_point_double(r, r); 367| 215k| ecp_nistz256_point_double(r, r); 368| 215k| } 369| | 370| | // Final window 371| 4.23k| wvalue = p_str[0]; 372| 4.23k| wvalue = (wvalue << 1) & kMask; 373| | 374| 4.23k| wvalue = booth_recode_w5(wvalue); 375| | 376| 4.23k| ecp_nistz256_select_w5(&h, table, wvalue >> 1); 377| | 378| 4.23k| ecp_nistz256_neg(tmp, h.Y); 379| 4.23k| copy_conditional(h.Y, tmp, wvalue & 1); 380| | 381| 4.23k| ecp_nistz256_point_add(r, r, &h); 382| 4.23k|} bcm.cc:_ZL22ecp_nistz256_select_w5P10P256_POINTPKS_i: 170| 220k| int index) { 171| 220k| if (CRYPTO_is_AVX2_capable()) { ------------------ | Branch (171:7): [True: 220k, False: 0] ------------------ 172| 220k| ecp_nistz256_select_w5_avx2(val, in_t, index); 173| 220k| } else { 174| 0| ecp_nistz256_select_w5_nohw(val, in_t, index); 175| 0| } 176| 220k|} bcm.cc:_ZL15booth_recode_w5m: 59| 220k|static crypto_word_t booth_recode_w5(crypto_word_t in) { 60| 220k| crypto_word_t s, d; 61| | 62| 220k| s = ~((in >> 5) - 1); 63| 220k| d = (1 << 6) - in - 1; 64| 220k| d = (d & s) | (in & ~s); 65| 220k| d = (d >> 1) + (d & 1); 66| | 67| 220k| return (d << 1) + (s & 1); 68| 220k|} bcm.cc:_ZL16copy_conditionalPmPKmm: 87| 223k| const BN_ULONG src[P256_LIMBS], BN_ULONG move) { 88| 223k| BN_ULONG mask1 = ((BN_ULONG)0) - move; 89| 223k| BN_ULONG mask2 = ~mask1; 90| | 91| 223k| dst[0] = (src[0] & mask1) ^ (dst[0] & mask2); 92| 223k| dst[1] = (src[1] & mask1) ^ (dst[1] & mask2); 93| 223k| dst[2] = (src[2] & mask1) ^ (dst[2] & mask2); 94| 223k| dst[3] = (src[3] & mask1) ^ (dst[3] & mask2); 95| 223k| if (P256_LIMBS == 8) { ------------------ | | 50| 223k|#define P256_LIMBS (256 / BN_BITS2) | | ------------------ | | | | 42| 223k|#define BN_BITS2 64 | | ------------------ ------------------ | Branch (95:7): [Folded - Ignored] ------------------ 96| 0| dst[4] = (src[4] & mask1) ^ (dst[4] & mask2); 97| 0| dst[5] = (src[5] & mask1) ^ (dst[5] & mask2); 98| 0| dst[6] = (src[6] & mask1) ^ (dst[6] & mask2); 99| 0| dst[7] = (src[7] & mask1) ^ (dst[7] & mask2); 100| 0| } 101| 223k|} bcm.cc:_ZL27ecp_nistz256_point_mul_basePK11ec_group_stP11EC_JACOBIANPK9EC_SCALAR: 419| 205| const EC_SCALAR *scalar) { 420| 205| uint8_t p_str[33]; 421| 205| OPENSSL_memcpy(p_str, scalar->words, 32); 422| 205| p_str[32] = 0; 423| | 424| | // First window 425| 205| size_t index = 0; 426| 205| crypto_word_t wvalue = calc_first_wvalue(&index, p_str); 427| | 428| 205| alignas(32) P256_POINT_AFFINE t; 429| 205| alignas(32) P256_POINT p; 430| 205| ecp_nistz256_select_w7(&t, ecp_nistz256_precomputed[0], wvalue >> 1); 431| 205| ecp_nistz256_neg(p.Z, t.Y); 432| 205| copy_conditional(t.Y, p.Z, wvalue & 1); 433| | 434| | // Convert |t| from affine to Jacobian coordinates. We set Z to zero if |t| 435| | // is infinity and |ONE_MONT| otherwise. |t| was computed from the table, so 436| | // it is infinity iff |wvalue >> 1| is zero. 437| 205| OPENSSL_memcpy(p.X, t.X, sizeof(p.X)); 438| 205| OPENSSL_memcpy(p.Y, t.Y, sizeof(p.Y)); 439| 205| OPENSSL_memset(p.Z, 0, sizeof(p.Z)); 440| 205| copy_conditional(p.Z, ONE_MONT, is_not_zero(wvalue >> 1)); 441| | 442| 7.58k| for (int i = 1; i < 37; i++) { ------------------ | Branch (442:19): [True: 7.38k, False: 205] ------------------ 443| 7.38k| wvalue = calc_wvalue(&index, p_str); 444| | 445| 7.38k| ecp_nistz256_select_w7(&t, ecp_nistz256_precomputed[i], wvalue >> 1); 446| | 447| 7.38k| alignas(32) BN_ULONG neg_Y[P256_LIMBS]; 448| 7.38k| ecp_nistz256_neg(neg_Y, t.Y); 449| 7.38k| copy_conditional(t.Y, neg_Y, wvalue & 1); 450| | 451| | // Note |ecp_nistz256_point_add_affine| does not work if |p| and |t| are the 452| | // same non-infinity point. 453| 7.38k| ecp_nistz256_point_add_affine(&p, &p, &t); 454| 7.38k| } 455| | 456| 205| assert(group->field.N.width == P256_LIMBS); 457| 205| OPENSSL_memcpy(r->X.words, p.X, P256_LIMBS * sizeof(BN_ULONG)); ------------------ | | 50| 205|#define P256_LIMBS (256 / BN_BITS2) | | ------------------ | | | | 42| 205|#define BN_BITS2 64 | | ------------------ ------------------ 458| 205| OPENSSL_memcpy(r->Y.words, p.Y, P256_LIMBS * sizeof(BN_ULONG)); ------------------ | | 50| 205|#define P256_LIMBS (256 / BN_BITS2) | | ------------------ | | | | 42| 205|#define BN_BITS2 64 | | ------------------ ------------------ 459| 205| OPENSSL_memcpy(r->Z.words, p.Z, P256_LIMBS * sizeof(BN_ULONG)); ------------------ | | 50| 205|#define P256_LIMBS (256 / BN_BITS2) | | ------------------ | | | | 42| 205|#define BN_BITS2 64 | | ------------------ ------------------ 460| 205|} bcm.cc:_ZL17calc_first_wvaluePmPKh: 384| 4.43k|static crypto_word_t calc_first_wvalue(size_t *index, const uint8_t p_str[33]) { 385| 4.43k| static const size_t kWindowSize = 7; 386| 4.43k| static const crypto_word_t kMask = (1 << (7 /* kWindowSize */ + 1)) - 1; 387| 4.43k| *index = kWindowSize; 388| | 389| 4.43k| crypto_word_t wvalue = (p_str[0] << 1) & kMask; 390| 4.43k| return booth_recode_w7(wvalue); 391| 4.43k|} bcm.cc:_ZL15booth_recode_w7m: 70| 164k|static crypto_word_t booth_recode_w7(crypto_word_t in) { 71| 164k| crypto_word_t s, d; 72| | 73| 164k| s = ~((in >> 7) - 1); 74| 164k| d = (1 << 8) - in - 1; 75| 164k| d = (d & s) | (in & ~s); 76| 164k| d = (d >> 1) + (d & 1); 77| | 78| 164k| return (d << 1) + (s & 1); 79| 164k|} bcm.cc:_ZL22ecp_nistz256_select_w7P17P256_POINT_AFFINEPKS_i: 180| 7.58k| int index) { 181| 7.58k| if (CRYPTO_is_AVX2_capable()) { ------------------ | Branch (181:7): [True: 7.58k, False: 0] ------------------ 182| 7.58k| ecp_nistz256_select_w7_avx2(val, in_t, index); 183| 7.58k| } else { 184| 0| ecp_nistz256_select_w7_nohw(val, in_t, index); 185| 0| } 186| 7.58k|} bcm.cc:_ZL11is_not_zerom: 120| 205|static BN_ULONG is_not_zero(BN_ULONG in) { 121| 205| in |= (0 - in); 122| 205| in >>= BN_BITS2 - 1; ------------------ | | 42| 205|#define BN_BITS2 64 ------------------ 123| 205| return in; 124| 205|} bcm.cc:_ZL11calc_wvaluePmPKh: 393| 159k|static crypto_word_t calc_wvalue(size_t *index, const uint8_t p_str[33]) { 394| 159k| static const size_t kWindowSize = 7; 395| 159k| static const crypto_word_t kMask = (1 << (7 /* kWindowSize */ + 1)) - 1; 396| | 397| 159k| const size_t off = (*index - 1) / 8; 398| 159k| crypto_word_t wvalue = 399| 159k| (crypto_word_t)p_str[off] | (crypto_word_t)p_str[off + 1] << 8; 400| 159k| wvalue = (wvalue >> ((*index - 1) % 8)) & kMask; 401| 159k| *index += kWindowSize; 402| | 403| 159k| return booth_recode_w7(wvalue); 404| 159k|} bcm.cc:_ZL29ecp_nistz256_point_add_affineP10P256_POINTPKS_PK17P256_POINT_AFFINE: 206| 158k| const P256_POINT_AFFINE *b) { 207| 158k| if (CRYPTO_is_BMI2_capable() && CRYPTO_is_ADX_capable()) { ------------------ | Branch (207:7): [True: 158k, False: 0] | Branch (207:35): [True: 158k, False: 0] ------------------ 208| 158k| ecp_nistz256_point_add_affine_adx(r, a, b); 209| 158k| } else { 210| 0| ecp_nistz256_point_add_affine_nohw(r, a, b); 211| 0| } 212| 158k|} bcm.cc:_ZL30ecp_nistz256_points_mul_publicPK11ec_group_stP11EC_JACOBIANPK9EC_SCALARPKS2_S6_: 466| 4.22k| const EC_SCALAR *p_scalar) { 467| 4.22k| assert(p_ != NULL && p_scalar != NULL && g_scalar != NULL); 468| | 469| 4.22k| alignas(32) P256_POINT p; 470| 4.22k| uint8_t p_str[33]; 471| 4.22k| OPENSSL_memcpy(p_str, g_scalar->words, 32); 472| 4.22k| p_str[32] = 0; 473| | 474| | // First window 475| 4.22k| size_t index = 0; 476| 4.22k| size_t wvalue = calc_first_wvalue(&index, p_str); 477| | 478| | // Convert |p| from affine to Jacobian coordinates. We set Z to zero if |p| 479| | // is infinity and |ONE_MONT| otherwise. |p| was computed from the table, so 480| | // it is infinity iff |wvalue >> 1| is zero. 481| 4.22k| if ((wvalue >> 1) != 0) { ------------------ | Branch (481:7): [True: 4.20k, False: 27] ------------------ 482| 4.20k| OPENSSL_memcpy(p.X, &ecp_nistz256_precomputed[0][(wvalue >> 1) - 1].X, 483| 4.20k| sizeof(p.X)); 484| 4.20k| OPENSSL_memcpy(p.Y, &ecp_nistz256_precomputed[0][(wvalue >> 1) - 1].Y, 485| 4.20k| sizeof(p.Y)); 486| 4.20k| OPENSSL_memcpy(p.Z, ONE_MONT, sizeof(p.Z)); 487| 4.20k| } else { 488| 27| OPENSSL_memset(p.X, 0, sizeof(p.X)); 489| 27| OPENSSL_memset(p.Y, 0, sizeof(p.Y)); 490| 27| OPENSSL_memset(p.Z, 0, sizeof(p.Z)); 491| 27| } 492| | 493| 4.22k| if ((wvalue & 1) == 1) { ------------------ | Branch (493:7): [True: 2.15k, False: 2.07k] ------------------ 494| 2.15k| ecp_nistz256_neg(p.Y, p.Y); 495| 2.15k| } 496| | 497| 156k| for (int i = 1; i < 37; i++) { ------------------ | Branch (497:19): [True: 152k, False: 4.22k] ------------------ 498| 152k| wvalue = calc_wvalue(&index, p_str); 499| 152k| if ((wvalue >> 1) == 0) { ------------------ | Branch (499:9): [True: 1.26k, False: 150k] ------------------ 500| 1.26k| continue; 501| 1.26k| } 502| | 503| 150k| alignas(32) P256_POINT_AFFINE t; 504| 150k| OPENSSL_memcpy(&t, &ecp_nistz256_precomputed[i][(wvalue >> 1) - 1], 505| 150k| sizeof(t)); 506| 150k| if ((wvalue & 1) == 1) { ------------------ | Branch (506:9): [True: 73.3k, False: 77.6k] ------------------ 507| 73.3k| ecp_nistz256_neg(t.Y, t.Y); 508| 73.3k| } 509| | 510| | // Note |ecp_nistz256_point_add_affine| does not work if |p| and |t| are 511| | // the same non-infinity point, so it is important that we compute the 512| | // |g_scalar| term before the |p_scalar| term. 513| 150k| ecp_nistz256_point_add_affine(&p, &p, &t); 514| 150k| } 515| | 516| 4.22k| alignas(32) P256_POINT tmp; 517| 4.22k| ecp_nistz256_windowed_mul(group, &tmp, p_, p_scalar); 518| 4.22k| ecp_nistz256_point_add(&p, &p, &tmp); 519| | 520| 4.22k| assert(group->field.N.width == P256_LIMBS); 521| 4.22k| OPENSSL_memcpy(r->X.words, p.X, P256_LIMBS * sizeof(BN_ULONG)); ------------------ | | 50| 4.22k|#define P256_LIMBS (256 / BN_BITS2) | | ------------------ | | | | 42| 4.22k|#define BN_BITS2 64 | | ------------------ ------------------ 522| 4.22k| OPENSSL_memcpy(r->Y.words, p.Y, P256_LIMBS * sizeof(BN_ULONG)); ------------------ | | 50| 4.22k|#define P256_LIMBS (256 / BN_BITS2) | | ------------------ | | | | 42| 4.22k|#define BN_BITS2 64 | | ------------------ ------------------ 523| 4.22k| OPENSSL_memcpy(r->Z.words, p.Z, P256_LIMBS * sizeof(BN_ULONG)); ------------------ | | 50| 4.22k|#define P256_LIMBS (256 / BN_BITS2) | | ------------------ | | | | 42| 4.22k|#define BN_BITS2 64 | | ------------------ ------------------ 524| 4.22k|} bcm.cc:_ZL25ecp_nistz256_inv0_mod_ordPK11ec_group_stP9EC_SCALARPKS2_: 580| 107| const EC_SCALAR *in) { 581| | // table[i] stores a power of |in| corresponding to the matching enum value. 582| 107| enum { 583| | // The following indices specify the power in binary. 584| 107| i_1 = 0, 585| 107| i_10, 586| 107| i_11, 587| 107| i_101, 588| 107| i_111, 589| 107| i_1010, 590| 107| i_1111, 591| 107| i_10101, 592| 107| i_101010, 593| 107| i_101111, 594| | // The following indices specify 2^N-1, or N ones in a row. 595| 107| i_x6, 596| 107| i_x8, 597| 107| i_x16, 598| 107| i_x32 599| 107| }; 600| 107| BN_ULONG table[15][P256_LIMBS]; 601| | 602| | // https://briansmith.org/ecc-inversion-addition-chains-01#p256_scalar_inversion 603| | // 604| | // Even though this code path spares 12 squarings, 4.5%, and 13 605| | // multiplications, 25%, the overall sign operation is not that much faster, 606| | // not more that 2%. Most of the performance of this function comes from the 607| | // scalar operations. 608| | 609| | // Pre-calculate powers. 610| 107| OPENSSL_memcpy(table[i_1], in->words, P256_LIMBS * sizeof(BN_ULONG)); ------------------ | | 50| 107|#define P256_LIMBS (256 / BN_BITS2) | | ------------------ | | | | 42| 107|#define BN_BITS2 64 | | ------------------ ------------------ 611| | 612| 107| ecp_nistz256_ord_sqr_mont(table[i_10], table[i_1], 1); 613| | 614| 107| ecp_nistz256_ord_mul_mont(table[i_11], table[i_1], table[i_10]); 615| | 616| 107| ecp_nistz256_ord_mul_mont(table[i_101], table[i_11], table[i_10]); 617| | 618| 107| ecp_nistz256_ord_mul_mont(table[i_111], table[i_101], table[i_10]); 619| | 620| 107| ecp_nistz256_ord_sqr_mont(table[i_1010], table[i_101], 1); 621| | 622| 107| ecp_nistz256_ord_mul_mont(table[i_1111], table[i_1010], table[i_101]); 623| | 624| 107| ecp_nistz256_ord_sqr_mont(table[i_10101], table[i_1010], 1); 625| 107| ecp_nistz256_ord_mul_mont(table[i_10101], table[i_10101], table[i_1]); 626| | 627| 107| ecp_nistz256_ord_sqr_mont(table[i_101010], table[i_10101], 1); 628| | 629| 107| ecp_nistz256_ord_mul_mont(table[i_101111], table[i_101010], table[i_101]); 630| | 631| 107| ecp_nistz256_ord_mul_mont(table[i_x6], table[i_101010], table[i_10101]); 632| | 633| 107| ecp_nistz256_ord_sqr_mont(table[i_x8], table[i_x6], 2); 634| 107| ecp_nistz256_ord_mul_mont(table[i_x8], table[i_x8], table[i_11]); 635| | 636| 107| ecp_nistz256_ord_sqr_mont(table[i_x16], table[i_x8], 8); 637| 107| ecp_nistz256_ord_mul_mont(table[i_x16], table[i_x16], table[i_x8]); 638| | 639| 107| ecp_nistz256_ord_sqr_mont(table[i_x32], table[i_x16], 16); 640| 107| ecp_nistz256_ord_mul_mont(table[i_x32], table[i_x32], table[i_x16]); 641| | 642| | // Compute |in| raised to the order-2. 643| 107| ecp_nistz256_ord_sqr_mont(out->words, table[i_x32], 64); 644| 107| ecp_nistz256_ord_mul_mont(out->words, out->words, table[i_x32]); 645| 107| static const struct { 646| 107| uint8_t p, i; 647| 107| } kChain[27] = {{32, i_x32}, {6, i_101111}, {5, i_111}, {4, i_11}, 648| 107| {5, i_1111}, {5, i_10101}, {4, i_101}, {3, i_101}, 649| 107| {3, i_101}, {5, i_111}, {9, i_101111}, {6, i_1111}, 650| 107| {2, i_1}, {5, i_1}, {6, i_1111}, {5, i_111}, 651| 107| {4, i_111}, {5, i_111}, {5, i_101}, {3, i_11}, 652| 107| {10, i_101111}, {2, i_11}, {5, i_11}, {5, i_11}, 653| 107| {3, i_1}, {7, i_10101}, {6, i_1111}}; 654| 2.99k| for (size_t i = 0; i < OPENSSL_ARRAY_SIZE(kChain); i++) { ------------------ | | 103| 2.99k|#define OPENSSL_ARRAY_SIZE(array) (sizeof(array) / sizeof((array)[0])) ------------------ | Branch (654:22): [True: 2.88k, False: 107] ------------------ 655| 2.88k| ecp_nistz256_ord_sqr_mont(out->words, out->words, kChain[i].p); 656| 2.88k| ecp_nistz256_ord_mul_mont(out->words, out->words, table[kChain[i].i]); 657| 2.88k| } 658| 107|} bcm.cc:_ZL25ecp_nistz256_ord_sqr_montPmPKmm: 161| 3.74k| BN_ULONG rep) { 162| 3.74k| if (CRYPTO_is_BMI2_capable() && CRYPTO_is_ADX_capable()) { ------------------ | Branch (162:7): [True: 3.74k, False: 0] | Branch (162:35): [True: 3.74k, False: 0] ------------------ 163| 3.74k| ecp_nistz256_ord_sqr_mont_adx(res, a, rep); 164| 3.74k| } else { 165| 0| ecp_nistz256_ord_sqr_mont_nohw(res, a, rep); 166| 0| } 167| 3.74k|} bcm.cc:_ZL25ecp_nistz256_ord_mul_montPmPKmS1_: 151| 4.06k| const BN_ULONG b[P256_LIMBS]) { 152| 4.06k| if (CRYPTO_is_BMI2_capable() && CRYPTO_is_ADX_capable()) { ------------------ | Branch (152:7): [True: 4.06k, False: 0] | Branch (152:35): [True: 4.06k, False: 0] ------------------ 153| 4.06k| ecp_nistz256_ord_mul_mont_adx(res, a, b); 154| 4.06k| } else { 155| 0| ecp_nistz256_ord_mul_mont_nohw(res, a, b); 156| 0| } 157| 4.06k|} bcm.cc:_ZL45ecp_nistz256_scalar_to_montgomery_inv_vartimePK11ec_group_stP9EC_SCALARPKS2_: 662| 4.22k| const EC_SCALAR *in) { 663| 4.22k|#if defined(OPENSSL_X86_64) 664| 4.22k| if (!CRYPTO_is_AVX_capable()) { ------------------ | Branch (664:7): [True: 0, False: 4.22k] ------------------ 665| | // No AVX support; fallback to generic code. 666| 0| return ec_simple_scalar_to_montgomery_inv_vartime(group, out, in); 667| 0| } 668| 4.22k|#endif 669| | 670| 4.22k| assert(group->order.N.width == P256_LIMBS); 671| 4.22k| if (!beeu_mod_inverse_vartime(out->words, in->words, group->order.N.d)) { ------------------ | Branch (671:7): [True: 0, False: 4.22k] ------------------ 672| 0| return 0; 673| 0| } 674| | 675| | // The result should be returned in the Montgomery domain. 676| 4.22k| ec_scalar_to_montgomery(group, out, out); 677| 4.22k| return 1; 678| 4.22k|} bcm.cc:_ZL29ecp_nistz256_cmp_x_coordinatePK11ec_group_stPK11EC_JACOBIANPK9EC_SCALAR: 682| 4.22k| const EC_SCALAR *r) { 683| 4.22k| if (ec_GFp_simple_is_at_infinity(group, p)) { ------------------ | Branch (683:7): [True: 0, False: 4.22k] ------------------ 684| 0| return 0; 685| 0| } 686| | 687| 4.22k| assert(group->order.N.width == P256_LIMBS); 688| 4.22k| assert(group->field.N.width == P256_LIMBS); 689| | 690| | // We wish to compare X/Z^2 with r. This is equivalent to comparing X with 691| | // r*Z^2. Note that X and Z are represented in Montgomery form, while r is 692| | // not. 693| 4.22k| BN_ULONG r_Z2[P256_LIMBS], Z2_mont[P256_LIMBS], X[P256_LIMBS]; 694| 4.22k| ecp_nistz256_mul_mont(Z2_mont, p->Z.words, p->Z.words); 695| 4.22k| ecp_nistz256_mul_mont(r_Z2, r->words, Z2_mont); 696| 4.22k| ecp_nistz256_from_mont(X, p->X.words); 697| | 698| 4.22k| if (OPENSSL_memcmp(r_Z2, X, sizeof(r_Z2)) == 0) { ------------------ | Branch (698:7): [True: 0, False: 4.22k] ------------------ 699| 0| return 1; 700| 0| } 701| | 702| | // During signing the x coefficient is reduced modulo the group order. 703| | // Therefore there is a small possibility, less than 1/2^128, that group_order 704| | // < p.x < P. in that case we need not only to compare against |r| but also to 705| | // compare against r+group_order. 706| 4.22k| BN_ULONG carry = bn_add_words(r_Z2, r->words, group->order.N.d, P256_LIMBS); ------------------ | | 50| 4.22k|#define P256_LIMBS (256 / BN_BITS2) | | ------------------ | | | | 42| 4.22k|#define BN_BITS2 64 | | ------------------ ------------------ 707| 4.22k| if (carry == 0 && bn_less_than_words(r_Z2, group->field.N.d, P256_LIMBS)) { ------------------ | | 50| 65|#define P256_LIMBS (256 / BN_BITS2) | | ------------------ | | | | 42| 65|#define BN_BITS2 64 | | ------------------ ------------------ | Branch (707:7): [True: 65, False: 4.16k] | Branch (707:21): [True: 65, False: 0] ------------------ 708| | // r + group_order < p, so compare (r + group_order) * Z^2 against X. 709| 65| ecp_nistz256_mul_mont(r_Z2, r_Z2, Z2_mont); 710| 65| if (OPENSSL_memcmp(r_Z2, X, sizeof(r_Z2)) == 0) { ------------------ | Branch (710:9): [True: 0, False: 65] ------------------ 711| 0| return 1; 712| 0| } 713| 65| } 714| | 715| 4.22k| return 0; 716| 4.22k|} bcm.cc:_ZL22ecp_nistz256_from_montPmPKm: 218| 4.22k| const BN_ULONG in[P256_LIMBS]) { 219| 4.22k| static const BN_ULONG ONE[P256_LIMBS] = {1}; 220| 4.22k| ecp_nistz256_mul_mont(res, in, ONE); 221| 4.22k|} ec_bignum_to_scalar: 25| 59.3k| const BIGNUM *in) { 26| | // Scalars, which are often secret, must be reduced modulo the order. Those 27| | // that are not will be discarded, so leaking the result of the comparison is 28| | // safe. 29| 59.3k| if (!bn_copy_words(out->words, group->order.N.width, in) || ------------------ | Branch (29:7): [True: 0, False: 59.3k] ------------------ 30| 59.3k| !constant_time_declassify_int(bn_less_than_words( ------------------ | Branch (30:7): [True: 0, False: 59.3k] ------------------ 31| 59.3k| out->words, group->order.N.d, group->order.N.width))) { 32| 0| OPENSSL_PUT_ERROR(EC, EC_R_INVALID_SCALAR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 33| 0| return 0; 34| 0| } 35| 59.3k| return 1; 36| 59.3k|} ec_scalar_is_zero: 44| 10.5k|int ec_scalar_is_zero(const EC_GROUP *group, const EC_SCALAR *a) { 45| 10.5k| BN_ULONG mask = 0; 46| 56.2k| for (int i = 0; i < group->order.N.width; i++) { ------------------ | Branch (46:19): [True: 45.7k, False: 10.5k] ------------------ 47| 45.7k| mask |= a->words[i]; 48| 45.7k| } 49| 10.5k| return mask == 0; 50| 10.5k|} ec_random_nonzero_scalar: 59| 107| const uint8_t additional_data[32]) { 60| 107| return bn_rand_range_words(out->words, 1, group->order.N.d, 61| 107| group->order.N.width, additional_data); 62| 107|} ec_scalar_to_bytes: 65| 214| const EC_SCALAR *in) { 66| 214| size_t len = BN_num_bytes(&group->order.N); 67| 214| bn_words_to_big_endian(out, len, in->words, group->order.N.width); 68| 214| *out_len = len; 69| 214|} ec_scalar_from_bytes: 72| 9.83k| const uint8_t *in, size_t len) { 73| 9.83k| if (len != BN_num_bytes(&group->order.N)) { ------------------ | Branch (73:7): [True: 0, False: 9.83k] ------------------ 74| 0| OPENSSL_PUT_ERROR(EC, EC_R_INVALID_SCALAR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 75| 0| return 0; 76| 0| } 77| | 78| 9.83k| bn_big_endian_to_words(out->words, group->order.N.width, in, len); 79| | 80| 9.83k| if (!bn_less_than_words(out->words, group->order.N.d, group->order.N.width)) { ------------------ | Branch (80:7): [True: 110, False: 9.72k] ------------------ 81| 110| OPENSSL_PUT_ERROR(EC, EC_R_INVALID_SCALAR); ------------------ | | 361| 110| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 82| 110| return 0; 83| 110| } 84| | 85| 9.72k| return 1; 86| 9.83k|} ec_scalar_add: 98| 107| const EC_SCALAR *b) { 99| 107| const BIGNUM *order = &group->order.N; 100| 107| BN_ULONG tmp[EC_MAX_WORDS]; 101| 107| bn_mod_add_words(r->words, a->words, b->words, order->d, tmp, order->width); 102| 107| OPENSSL_cleanse(tmp, sizeof(tmp)); 103| 107|} ec_scalar_to_montgomery: 126| 4.33k| const EC_SCALAR *a) { 127| 4.33k| const BIGNUM *order = &group->order.N; 128| 4.33k| bn_to_montgomery_small(r->words, a->words, order->width, &group->order); 129| 4.33k|} ec_scalar_from_montgomery: 132| 699| const EC_SCALAR *a) { 133| 699| const BIGNUM *order = &group->order.N; 134| 699| bn_from_montgomery_small(r->words, order->width, a->words, order->width, 135| 699| &group->order); 136| 699|} ec_scalar_mul_montgomery: 139| 9.85k| const EC_SCALAR *a, const EC_SCALAR *b) { 140| 9.85k| const BIGNUM *order = &group->order.N; 141| 9.85k| bn_mod_mul_montgomery_small(r->words, a->words, b->words, order->width, 142| 9.85k| &group->order); 143| 9.85k|} ec_simple_scalar_inv0_montgomery: 146| 592| const EC_SCALAR *a) { 147| 592| const BIGNUM *order = &group->order.N; 148| 592| bn_mod_inverse0_prime_mont_small(r->words, a->words, order->width, 149| 592| &group->order); 150| 592|} ec_simple_scalar_to_montgomery_inv_vartime: 154| 592| const EC_SCALAR *a) { 155| 592| if (ec_scalar_is_zero(group, a)) { ------------------ | Branch (155:7): [True: 0, False: 592] ------------------ 156| 0| return 0; 157| 0| } 158| | 159| | // This implementation (in fact) runs in constant time, 160| | // even though for this interface it is not mandatory. 161| | 162| | // r = a^-1 in the Montgomery domain. This is 163| | // |ec_scalar_to_montgomery| followed by |ec_scalar_inv0_montgomery|, but 164| | // |ec_scalar_inv0_montgomery| followed by |ec_scalar_from_montgomery| is 165| | // equivalent and slightly more efficient. 166| 592| ec_scalar_inv0_montgomery(group, r, a); 167| 592| ec_scalar_from_montgomery(group, r, r); 168| 592| return 1; 169| 592|} ec_scalar_inv0_montgomery: 172| 699| const EC_SCALAR *a) { 173| 699| group->meth->scalar_inv0_montgomery(group, r, a); 174| 699|} ec_scalar_to_montgomery_inv_vartime: 177| 4.82k| const EC_SCALAR *a) { 178| 4.82k| return group->meth->scalar_to_montgomery_inv_vartime(group, r, a); 179| 4.82k|} ec_GFp_simple_point_init: 82| 209k|void ec_GFp_simple_point_init(EC_JACOBIAN *point) { 83| 209k| OPENSSL_memset(&point->X, 0, sizeof(EC_FELEM)); 84| 209k| OPENSSL_memset(&point->Y, 0, sizeof(EC_FELEM)); 85| 209k| OPENSSL_memset(&point->Z, 0, sizeof(EC_FELEM)); 86| 209k|} ec_GFp_simple_point_copy: 88| 227k|void ec_GFp_simple_point_copy(EC_JACOBIAN *dest, const EC_JACOBIAN *src) { 89| 227k| OPENSSL_memcpy(&dest->X, &src->X, sizeof(EC_FELEM)); 90| 227k| OPENSSL_memcpy(&dest->Y, &src->Y, sizeof(EC_FELEM)); 91| 227k| OPENSSL_memcpy(&dest->Z, &src->Z, sizeof(EC_FELEM)); 92| 227k|} ec_GFp_simple_point_set_to_infinity: 95| 59.2k| EC_JACOBIAN *point) { 96| | // Although it is strictly only necessary to zero Z, we zero the entire point 97| | // in case |point| was stack-allocated and yet to be initialized. 98| 59.2k| ec_GFp_simple_point_init(point); 99| 59.2k|} ec_GFp_simple_invert: 101| 37.3k|void ec_GFp_simple_invert(const EC_GROUP *group, EC_JACOBIAN *point) { 102| 37.3k| ec_felem_neg(group, &point->Y, &point->Y); 103| 37.3k|} ec_GFp_simple_is_at_infinity: 106| 94.1k| const EC_JACOBIAN *point) { 107| 94.1k| return ec_felem_non_zero_mask(group, &point->Z) == 0; 108| 94.1k|} ec_GFp_simple_is_on_curve: 111| 59.4k| const EC_JACOBIAN *point) { 112| | // We have a curve defined by a Weierstrass equation 113| | // y^2 = x^3 + a*x + b. 114| | // The point to consider is given in Jacobian projective coordinates 115| | // where (X, Y, Z) represents (x, y) = (X/Z^2, Y/Z^3). 116| | // Substituting this and multiplying by Z^6 transforms the above equation 117| | // into 118| | // Y^2 = X^3 + a*X*Z^4 + b*Z^6. 119| | // To test this, we add up the right-hand side in 'rh'. 120| | // 121| | // This function may be used when double-checking the secret result of a point 122| | // multiplication, so we proceed in constant-time. 123| | 124| 59.4k| void (*const felem_mul)(const EC_GROUP *, EC_FELEM *r, const EC_FELEM *a, 125| 59.4k| const EC_FELEM *b) = group->meth->felem_mul; 126| 59.4k| void (*const felem_sqr)(const EC_GROUP *, EC_FELEM *r, const EC_FELEM *a) = 127| 59.4k| group->meth->felem_sqr; 128| | 129| | // rh := X^2 130| 59.4k| EC_FELEM rh; 131| 59.4k| felem_sqr(group, &rh, &point->X); 132| | 133| 59.4k| EC_FELEM tmp, Z4, Z6; 134| 59.4k| felem_sqr(group, &tmp, &point->Z); 135| 59.4k| felem_sqr(group, &Z4, &tmp); 136| 59.4k| felem_mul(group, &Z6, &Z4, &tmp); 137| | 138| | // rh := rh + a*Z^4 139| 59.4k| if (group->a_is_minus3) { ------------------ | Branch (139:7): [True: 59.4k, False: 0] ------------------ 140| 59.4k| ec_felem_add(group, &tmp, &Z4, &Z4); 141| 59.4k| ec_felem_add(group, &tmp, &tmp, &Z4); 142| 59.4k| ec_felem_sub(group, &rh, &rh, &tmp); 143| 59.4k| } else { 144| 0| felem_mul(group, &tmp, &Z4, &group->a); 145| 0| ec_felem_add(group, &rh, &rh, &tmp); 146| 0| } 147| | 148| | // rh := (rh + a*Z^4)*X 149| 59.4k| felem_mul(group, &rh, &rh, &point->X); 150| | 151| | // rh := rh + b*Z^6 152| 59.4k| felem_mul(group, &tmp, &group->b, &Z6); 153| 59.4k| ec_felem_add(group, &rh, &rh, &tmp); 154| | 155| | // 'lh' := Y^2 156| 59.4k| felem_sqr(group, &tmp, &point->Y); 157| | 158| 59.4k| ec_felem_sub(group, &tmp, &tmp, &rh); 159| 59.4k| BN_ULONG not_equal = ec_felem_non_zero_mask(group, &tmp); 160| | 161| | // If Z = 0, the point is infinity, which is always on the curve. 162| 59.4k| BN_ULONG not_infinity = ec_felem_non_zero_mask(group, &point->Z); 163| | 164| 59.4k| return 1 & ~(not_infinity & not_equal); 165| 59.4k|} ec_GFp_simple_points_equal: 168| 2| const EC_JACOBIAN *b) { 169| | // This function is implemented in constant-time for two reasons. First, 170| | // although EC points are usually public, their Jacobian Z coordinates may be 171| | // secret, or at least are not obviously public. Second, more complex 172| | // protocols will sometimes manipulate secret points. 173| | // 174| | // This does mean that we pay a 6M+2S Jacobian comparison when comparing two 175| | // publicly affine points costs no field operations at all. If needed, we can 176| | // restore this optimization by keeping better track of affine vs. Jacobian 177| | // forms. See https://crbug.com/boringssl/326. 178| | 179| | // If neither |a| or |b| is infinity, we have to decide whether 180| | // (X_a/Z_a^2, Y_a/Z_a^3) = (X_b/Z_b^2, Y_b/Z_b^3), 181| | // or equivalently, whether 182| | // (X_a*Z_b^2, Y_a*Z_b^3) = (X_b*Z_a^2, Y_b*Z_a^3). 183| | 184| 2| void (*const felem_mul)(const EC_GROUP *, EC_FELEM *r, const EC_FELEM *a, 185| 2| const EC_FELEM *b) = group->meth->felem_mul; 186| 2| void (*const felem_sqr)(const EC_GROUP *, EC_FELEM *r, const EC_FELEM *a) = 187| 2| group->meth->felem_sqr; 188| | 189| 2| EC_FELEM tmp1, tmp2, Za23, Zb23; 190| 2| felem_sqr(group, &Zb23, &b->Z); // Zb23 = Z_b^2 191| 2| felem_mul(group, &tmp1, &a->X, &Zb23); // tmp1 = X_a * Z_b^2 192| 2| felem_sqr(group, &Za23, &a->Z); // Za23 = Z_a^2 193| 2| felem_mul(group, &tmp2, &b->X, &Za23); // tmp2 = X_b * Z_a^2 194| 2| ec_felem_sub(group, &tmp1, &tmp1, &tmp2); 195| 2| const BN_ULONG x_not_equal = ec_felem_non_zero_mask(group, &tmp1); 196| | 197| 2| felem_mul(group, &Zb23, &Zb23, &b->Z); // Zb23 = Z_b^3 198| 2| felem_mul(group, &tmp1, &a->Y, &Zb23); // tmp1 = Y_a * Z_b^3 199| 2| felem_mul(group, &Za23, &Za23, &a->Z); // Za23 = Z_a^3 200| 2| felem_mul(group, &tmp2, &b->Y, &Za23); // tmp2 = Y_b * Z_a^3 201| 2| ec_felem_sub(group, &tmp1, &tmp1, &tmp2); 202| 2| const BN_ULONG y_not_equal = ec_felem_non_zero_mask(group, &tmp1); 203| 2| const BN_ULONG x_and_y_equal = ~(x_not_equal | y_not_equal); 204| | 205| 2| const BN_ULONG a_not_infinity = ec_felem_non_zero_mask(group, &a->Z); 206| 2| const BN_ULONG b_not_infinity = ec_felem_non_zero_mask(group, &b->Z); 207| 2| const BN_ULONG a_and_b_infinity = ~(a_not_infinity | b_not_infinity); 208| | 209| 2| const BN_ULONG equal = 210| 2| a_and_b_infinity | (a_not_infinity & b_not_infinity & x_and_y_equal); 211| 2| return equal & 1; 212| 2|} ec_GFp_simple_felem_to_bytes: 258| 89.4k| size_t *out_len, const EC_FELEM *in) { 259| 89.4k| size_t len = BN_num_bytes(&group->field.N); 260| 89.4k| bn_words_to_big_endian(out, len, in->words, group->field.N.width); 261| 89.4k| *out_len = len; 262| 89.4k|} ec_GFp_simple_felem_from_bytes: 265| 122k| const uint8_t *in, size_t len) { 266| 122k| if (len != BN_num_bytes(&group->field.N)) { ------------------ | Branch (266:7): [True: 0, False: 122k] ------------------ 267| 0| OPENSSL_PUT_ERROR(EC, EC_R_DECODE_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 268| 0| return 0; 269| 0| } 270| | 271| 122k| bn_big_endian_to_words(out->words, group->field.N.width, in, len); 272| | 273| 122k| if (!bn_less_than_words(out->words, group->field.N.d, group->field.N.width)) { ------------------ | Branch (273:7): [True: 34, False: 122k] ------------------ 274| 34| OPENSSL_PUT_ERROR(EC, EC_R_DECODE_ERROR); ------------------ | | 361| 34| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 275| 34| return 0; 276| 34| } 277| | 278| 122k| return 1; 279| 122k|} ec_GFp_mont_mul: 25| 59.2k| const EC_JACOBIAN *p, const EC_SCALAR *scalar) { 26| | // This is a generic implementation for uncommon curves that not do not 27| | // warrant a tuned one. It uses unsigned digits so that the doubling case in 28| | // |ec_GFp_mont_add| is always unreachable, erring on safety and simplicity. 29| | 30| | // Compute a table of the first 32 multiples of |p| (including infinity). 31| 59.2k| EC_JACOBIAN precomp[32]; 32| 59.2k| ec_GFp_simple_point_set_to_infinity(group, &precomp[0]); 33| 59.2k| ec_GFp_simple_point_copy(&precomp[1], p); 34| 1.83M| for (size_t j = 2; j < OPENSSL_ARRAY_SIZE(precomp); j++) { ------------------ | | 103| 1.83M|#define OPENSSL_ARRAY_SIZE(array) (sizeof(array) / sizeof((array)[0])) ------------------ | Branch (34:22): [True: 1.77M, False: 59.2k] ------------------ 35| 1.77M| if (j & 1) { ------------------ | Branch (35:9): [True: 888k, False: 888k] ------------------ 36| 888k| ec_GFp_mont_add(group, &precomp[j], &precomp[1], &precomp[j - 1]); 37| 888k| } else { 38| 888k| ec_GFp_mont_dbl(group, &precomp[j], &precomp[j / 2]); 39| 888k| } 40| 1.77M| } 41| | 42| | // Divide bits in |scalar| into windows. 43| 59.2k| unsigned bits = EC_GROUP_order_bits(group); 44| 59.2k| int r_is_at_infinity = 1; 45| 22.8M| for (unsigned i = bits - 1; i < bits; i--) { ------------------ | Branch (45:31): [True: 22.7M, False: 59.2k] ------------------ 46| 22.7M| if (!r_is_at_infinity) { ------------------ | Branch (46:9): [True: 22.5M, False: 236k] ------------------ 47| 22.5M| ec_GFp_mont_dbl(group, r, r); 48| 22.5M| } 49| 22.7M| if (i % 5 == 0) { ------------------ | Branch (49:9): [True: 4.56M, False: 18.1M] ------------------ 50| | // Compute the next window value. 51| 4.56M| const size_t width = group->order.N.width; 52| 4.56M| uint8_t window = bn_is_bit_set_words(scalar->words, width, i + 4) << 4; 53| 4.56M| window |= bn_is_bit_set_words(scalar->words, width, i + 3) << 3; 54| 4.56M| window |= bn_is_bit_set_words(scalar->words, width, i + 2) << 2; 55| 4.56M| window |= bn_is_bit_set_words(scalar->words, width, i + 1) << 1; 56| 4.56M| window |= bn_is_bit_set_words(scalar->words, width, i); 57| | 58| | // Select the entry in constant-time. 59| 4.56M| EC_JACOBIAN tmp; 60| 4.56M| OPENSSL_memset(&tmp, 0, sizeof(EC_JACOBIAN)); 61| 150M| for (size_t j = 0; j < OPENSSL_ARRAY_SIZE(precomp); j++) { ------------------ | | 103| 150M|#define OPENSSL_ARRAY_SIZE(array) (sizeof(array) / sizeof((array)[0])) ------------------ | Branch (61:26): [True: 146M, False: 4.56M] ------------------ 62| 146M| BN_ULONG mask = constant_time_eq_w(j, window); 63| 146M| ec_point_select(group, &tmp, mask, &precomp[j], &tmp); 64| 146M| } 65| | 66| 4.56M| if (r_is_at_infinity) { ------------------ | Branch (66:11): [True: 59.2k, False: 4.50M] ------------------ 67| 59.2k| ec_GFp_simple_point_copy(r, &tmp); 68| 59.2k| r_is_at_infinity = 0; 69| 4.50M| } else { 70| 4.50M| ec_GFp_mont_add(group, r, r, &tmp); 71| 4.50M| } 72| 4.56M| } 73| 22.7M| } 74| 59.2k| if (r_is_at_infinity) { ------------------ | Branch (74:7): [True: 0, False: 59.2k] ------------------ 75| 0| ec_GFp_simple_point_set_to_infinity(group, r); 76| 0| } 77| 59.2k|} ec_GFp_mont_mul_base: 80| 29.6k| const EC_SCALAR *scalar) { 81| 29.6k| ec_GFp_mont_mul(group, r, &group->generator.raw, scalar); 82| 29.6k|} ec_compute_wNAF: 36| 1.18k| const EC_SCALAR *scalar, size_t bits, int w) { 37| | // 'int8_t' can represent integers with absolute values less than 2^7. 38| 1.18k| assert(0 < w && w <= 7); 39| 1.18k| assert(bits != 0); 40| 1.18k| int bit = 1 << w; // 2^w, at most 128 41| 1.18k| int next_bit = bit << 1; // 2^(w+1), at most 256 42| 1.18k| int mask = next_bit - 1; // at most 255 43| | 44| 1.18k| int window_val = scalar->words[0] & mask; 45| 458k| for (size_t j = 0; j < bits + 1; j++) { ------------------ | Branch (45:22): [True: 457k, False: 1.18k] ------------------ 46| 457k| assert(0 <= window_val && window_val <= next_bit); 47| 457k| int digit = 0; 48| 457k| if (window_val & 1) { ------------------ | Branch (48:9): [True: 75.9k, False: 381k] ------------------ 49| 75.9k| assert(0 < window_val && window_val < next_bit); 50| 75.9k| if (window_val & bit) { ------------------ | Branch (50:11): [True: 37.5k, False: 38.4k] ------------------ 51| 37.5k| digit = window_val - next_bit; 52| | // We know -next_bit < digit < 0 and window_val - digit = next_bit. 53| | 54| | // modified wNAF 55| 37.5k| if (j + w + 1 >= bits) { ------------------ | Branch (55:13): [True: 149, False: 37.3k] ------------------ 56| | // special case for generating modified wNAFs: 57| | // no new bits will be added into window_val, 58| | // so using a positive digit here will decrease 59| | // the total length of the representation 60| | 61| 149| digit = window_val & (mask >> 1); 62| | // We know 0 < digit < bit and window_val - digit = bit. 63| 149| } 64| 38.4k| } else { 65| 38.4k| digit = window_val; 66| | // We know 0 < digit < bit and window_val - digit = 0. 67| 38.4k| } 68| | 69| 75.9k| window_val -= digit; 70| | 71| | // Now window_val is 0 or 2^(w+1) in standard wNAF generation. 72| | // For modified window NAFs, it may also be 2^w. 73| | // 74| | // See the comments above for the derivation of each of these bounds. 75| 75.9k| assert(window_val == 0 || window_val == next_bit || window_val == bit); 76| 75.9k| assert(-bit < digit && digit < bit); 77| | 78| | // window_val was odd, so digit is also odd. 79| 75.9k| assert(digit & 1); 80| 75.9k| } 81| | 82| 457k| out[j] = digit; 83| | 84| | // Incorporate the next bit. Previously, |window_val| <= |next_bit|, so if 85| | // we shift and add at most one copy of |bit|, this will continue to hold 86| | // afterwards. 87| 457k| window_val >>= 1; 88| 457k| window_val += bit * bn_is_bit_set_words(scalar->words, group->order.N.width, 89| 457k| j + w + 1); 90| 457k| assert(window_val <= next_bit); 91| 457k| } 92| | 93| | // bits + 1 entries should be sufficient to consume all bits. 94| 1.18k| assert(window_val == 0); 95| 1.18k|} ec_GFp_mont_mul_public_batch: 132| 592| const EC_SCALAR *scalars, size_t num) { 133| 592| size_t bits = EC_GROUP_order_bits(group); 134| 592| size_t wNAF_len = bits + 1; 135| | 136| | // Stack-allocated space, which will be used if the task is small enough. 137| 592| int8_t wNAF_stack[EC_WNAF_STACK][EC_MAX_BYTES * 8 + 1]; 138| 592| EC_JACOBIAN precomp_stack[EC_WNAF_STACK][EC_WNAF_TABLE_SIZE]; 139| | 140| | // Allocated pointers, which will remain NULL unless needed. 141| 592| EC_JACOBIAN(*precomp_alloc)[EC_WNAF_TABLE_SIZE] = NULL; 142| 592| int8_t(*wNAF_alloc)[EC_MAX_BYTES * 8 + 1] = NULL; 143| | 144| | // These fields point either to the stack or heap buffers of the same name. 145| 592| int8_t(*wNAF)[EC_MAX_BYTES * 8 + 1]; 146| 592| EC_JACOBIAN(*precomp)[EC_WNAF_TABLE_SIZE]; 147| | 148| 592| if (num <= EC_WNAF_STACK) { ------------------ | | 127| 592|#define EC_WNAF_STACK 3 ------------------ | Branch (148:7): [True: 592, False: 0] ------------------ 149| 592| wNAF = wNAF_stack; 150| 592| precomp = precomp_stack; 151| 592| } else { 152| 0| wNAF_alloc = reinterpret_cast( 153| 0| OPENSSL_calloc(num, sizeof(wNAF_alloc[0]))); 154| 0| if (wNAF_alloc == NULL) { ------------------ | Branch (154:9): [True: 0, False: 0] ------------------ 155| 0| return 0; 156| 0| } 157| 0| precomp_alloc = reinterpret_cast( 158| 0| OPENSSL_calloc(num, sizeof(precomp_alloc[0]))); 159| 0| if (precomp_alloc == NULL) { ------------------ | Branch (159:9): [True: 0, False: 0] ------------------ 160| 0| OPENSSL_free(wNAF_alloc); 161| 0| return 0; 162| 0| } 163| | 164| 0| wNAF = wNAF_alloc; 165| 0| precomp = precomp_alloc; 166| 0| } 167| | 168| 592| int8_t g_wNAF[EC_MAX_BYTES * 8 + 1]; 169| 592| EC_JACOBIAN g_precomp[EC_WNAF_TABLE_SIZE]; 170| 592| assert(wNAF_len <= OPENSSL_ARRAY_SIZE(g_wNAF)); 171| 592| const EC_JACOBIAN *g = &group->generator.raw; 172| 592| if (g_scalar != NULL) { ------------------ | Branch (172:7): [True: 592, False: 0] ------------------ 173| 592| ec_compute_wNAF(group, g_wNAF, g_scalar, bits, EC_WNAF_WINDOW_BITS); ------------------ | | 120| 592|#define EC_WNAF_WINDOW_BITS 4 ------------------ 174| 592| compute_precomp(group, g_precomp, g, EC_WNAF_TABLE_SIZE); ------------------ | | 123| 592|#define EC_WNAF_TABLE_SIZE (1 << (EC_WNAF_WINDOW_BITS - 1)) | | ------------------ | | | | 120| 592|#define EC_WNAF_WINDOW_BITS 4 | | ------------------ ------------------ 175| 592| } 176| | 177| 1.18k| for (size_t i = 0; i < num; i++) { ------------------ | Branch (177:22): [True: 592, False: 592] ------------------ 178| 592| assert(wNAF_len <= OPENSSL_ARRAY_SIZE(wNAF[i])); 179| 592| ec_compute_wNAF(group, wNAF[i], &scalars[i], bits, EC_WNAF_WINDOW_BITS); ------------------ | | 120| 592|#define EC_WNAF_WINDOW_BITS 4 ------------------ 180| 592| compute_precomp(group, precomp[i], &points[i], EC_WNAF_TABLE_SIZE); ------------------ | | 123| 592|#define EC_WNAF_TABLE_SIZE (1 << (EC_WNAF_WINDOW_BITS - 1)) | | ------------------ | | | | 120| 592|#define EC_WNAF_WINDOW_BITS 4 | | ------------------ ------------------ 181| 592| } 182| | 183| 592| EC_JACOBIAN tmp; 184| 592| int r_is_at_infinity = 1; 185| 229k| for (size_t k = wNAF_len - 1; k < wNAF_len; k--) { ------------------ | Branch (185:33): [True: 228k, False: 592] ------------------ 186| 228k| if (!r_is_at_infinity) { ------------------ | Branch (186:9): [True: 226k, False: 2.14k] ------------------ 187| 226k| ec_GFp_mont_dbl(group, r, r); 188| 226k| } 189| | 190| 228k| if (g_scalar != NULL && g_wNAF[k] != 0) { ------------------ | Branch (190:9): [True: 228k, False: 0] | Branch (190:29): [True: 38.1k, False: 190k] ------------------ 191| 38.1k| lookup_precomp(group, &tmp, g_precomp, g_wNAF[k]); 192| 38.1k| if (r_is_at_infinity) { ------------------ | Branch (192:11): [True: 381, False: 37.7k] ------------------ 193| 381| ec_GFp_simple_point_copy(r, &tmp); 194| 381| r_is_at_infinity = 0; 195| 37.7k| } else { 196| 37.7k| ec_GFp_mont_add(group, r, r, &tmp); 197| 37.7k| } 198| 38.1k| } 199| | 200| 457k| for (size_t i = 0; i < num; i++) { ------------------ | Branch (200:24): [True: 228k, False: 228k] ------------------ 201| 228k| if (wNAF[i][k] != 0) { ------------------ | Branch (201:11): [True: 37.7k, False: 190k] ------------------ 202| 37.7k| lookup_precomp(group, &tmp, precomp[i], wNAF[i][k]); 203| 37.7k| if (r_is_at_infinity) { ------------------ | Branch (203:13): [True: 211, False: 37.5k] ------------------ 204| 211| ec_GFp_simple_point_copy(r, &tmp); 205| 211| r_is_at_infinity = 0; 206| 37.5k| } else { 207| 37.5k| ec_GFp_mont_add(group, r, r, &tmp); 208| 37.5k| } 209| 37.7k| } 210| 228k| } 211| 228k| } 212| | 213| 592| if (r_is_at_infinity) { ------------------ | Branch (213:7): [True: 0, False: 592] ------------------ 214| 0| ec_GFp_simple_point_set_to_infinity(group, r); 215| 0| } 216| | 217| 592| OPENSSL_free(wNAF_alloc); 218| 592| OPENSSL_free(precomp_alloc); 219| 592| return 1; 220| 592|} bcm.cc:_ZL15compute_precompPK11ec_group_stP11EC_JACOBIANPKS2_m: 99| 1.18k| const EC_JACOBIAN *p, size_t len) { 100| 1.18k| ec_GFp_simple_point_copy(&out[0], p); 101| 1.18k| EC_JACOBIAN two_p; 102| 1.18k| ec_GFp_mont_dbl(group, &two_p, p); 103| 9.47k| for (size_t i = 1; i < len; i++) { ------------------ | Branch (103:22): [True: 8.28k, False: 1.18k] ------------------ 104| 8.28k| ec_GFp_mont_add(group, &out[i], &out[i - 1], &two_p); 105| 8.28k| } 106| 1.18k|} bcm.cc:_ZL14lookup_precompPK11ec_group_stP11EC_JACOBIANPKS2_i: 109| 75.9k| const EC_JACOBIAN *precomp, int digit) { 110| 75.9k| if (digit < 0) { ------------------ | Branch (110:7): [True: 37.3k, False: 38.5k] ------------------ 111| 37.3k| digit = -digit; 112| 37.3k| ec_GFp_simple_point_copy(out, &precomp[digit >> 1]); 113| 37.3k| ec_GFp_simple_invert(group, out); 114| 38.5k| } else { 115| 38.5k| ec_GFp_simple_point_copy(out, &precomp[digit >> 1]); 116| 38.5k| } 117| 75.9k|} ecdsa_verify_fixed_no_self_test: 61| 4.93k| const EC_KEY *eckey) { 62| 4.93k| const EC_GROUP *group = EC_KEY_get0_group(eckey); 63| 4.93k| const EC_POINT *pub_key = EC_KEY_get0_public_key(eckey); 64| 4.93k| if (group == NULL || pub_key == NULL || sig == NULL) { ------------------ | Branch (64:7): [True: 0, False: 4.93k] | Branch (64:24): [True: 0, False: 4.93k] | Branch (64:43): [True: 0, False: 4.93k] ------------------ 65| 0| OPENSSL_PUT_ERROR(ECDSA, ECDSA_R_MISSING_PARAMETERS); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 66| 0| return 0; 67| 0| } 68| | 69| 4.93k| size_t scalar_len = BN_num_bytes(EC_GROUP_get0_order(group)); 70| 4.93k| EC_SCALAR r, s, u1, u2, s_inv_mont, m; 71| 4.93k| if (sig_len != 2 * scalar_len || ------------------ | Branch (71:7): [True: 0, False: 4.93k] ------------------ 72| 4.93k| !ec_scalar_from_bytes(group, &r, sig, scalar_len) || ------------------ | Branch (72:7): [True: 34, False: 4.90k] ------------------ 73| 4.93k| ec_scalar_is_zero(group, &r) || ------------------ | Branch (73:7): [True: 3, False: 4.89k] ------------------ 74| 4.93k| !ec_scalar_from_bytes(group, &s, sig + scalar_len, scalar_len) || ------------------ | Branch (74:7): [True: 76, False: 4.82k] ------------------ 75| 4.93k| ec_scalar_is_zero(group, &s)) { ------------------ | Branch (75:7): [True: 2, False: 4.82k] ------------------ 76| 115| OPENSSL_PUT_ERROR(ECDSA, ECDSA_R_BAD_SIGNATURE); ------------------ | | 361| 115| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 77| 115| return 0; 78| 115| } 79| | 80| | // s_inv_mont = s^-1 in the Montgomery domain. 81| 4.82k| if (!ec_scalar_to_montgomery_inv_vartime(group, &s_inv_mont, &s)) { ------------------ | Branch (81:7): [True: 0, False: 4.82k] ------------------ 82| 0| OPENSSL_PUT_ERROR(ECDSA, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 83| 0| return 0; 84| 0| } 85| | 86| | // u1 = m * s^-1 mod order 87| | // u2 = r * s^-1 mod order 88| | // 89| | // |s_inv_mont| is in Montgomery form while |m| and |r| are not, so |u1| and 90| | // |u2| will be taken out of Montgomery form, as desired. 91| 4.82k| digest_to_scalar(group, &m, digest, digest_len); 92| 4.82k| ec_scalar_mul_montgomery(group, &u1, &m, &s_inv_mont); 93| 4.82k| ec_scalar_mul_montgomery(group, &u2, &r, &s_inv_mont); 94| | 95| 4.82k| EC_JACOBIAN point; 96| 4.82k| if (!ec_point_mul_scalar_public(group, &point, &u1, &pub_key->raw, &u2)) { ------------------ | Branch (96:7): [True: 0, False: 4.82k] ------------------ 97| 0| OPENSSL_PUT_ERROR(ECDSA, ERR_R_EC_LIB); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 98| 0| return 0; 99| 0| } 100| | 101| 4.82k| if (!ec_cmp_x_coordinate(group, &point, &r)) { ------------------ | Branch (101:7): [True: 4.82k, False: 0] ------------------ 102| 4.82k| OPENSSL_PUT_ERROR(ECDSA, ECDSA_R_BAD_SIGNATURE); ------------------ | | 361| 4.82k| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 103| 4.82k| return 0; 104| 4.82k| } 105| | 106| 0| return 1; 107| 4.82k|} ecdsa_verify_fixed: 110| 4.93k| const uint8_t *sig, size_t sig_len, const EC_KEY *key) { 111| 4.93k| boringssl_ensure_ecc_self_test(); 112| | 113| 4.93k| return ecdsa_verify_fixed_no_self_test(digest, digest_len, sig, sig_len, key); 114| 4.93k|} ecdsa_sign_fixed: 214| 107| const EC_KEY *eckey) { 215| 107| boringssl_ensure_ecc_self_test(); 216| | 217| 107| if (eckey->ecdsa_meth && eckey->ecdsa_meth->sign) { ------------------ | Branch (217:7): [True: 0, False: 107] | Branch (217:28): [True: 0, False: 0] ------------------ 218| 0| OPENSSL_PUT_ERROR(ECDSA, ECDSA_R_NOT_IMPLEMENTED); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 219| 0| return 0; 220| 0| } 221| | 222| 107| const EC_GROUP *group = EC_KEY_get0_group(eckey); 223| 107| if (group == NULL || eckey->priv_key == NULL) { ------------------ | Branch (223:7): [True: 0, False: 107] | Branch (223:24): [True: 0, False: 107] ------------------ 224| 0| OPENSSL_PUT_ERROR(ECDSA, ERR_R_PASSED_NULL_PARAMETER); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 225| 0| return 0; 226| 0| } 227| 107| const BIGNUM *order = EC_GROUP_get0_order(group); 228| 107| const EC_SCALAR *priv_key = &eckey->priv_key->scalar; 229| | 230| | // Pass a SHA512 hash of the private key and digest as additional data 231| | // into the RBG. This is a hardening measure against entropy failure. 232| 107| static_assert(BCM_SHA512_DIGEST_LENGTH >= 32, 233| 107| "additional_data is too large for SHA-512"); 234| | 235| 107| FIPS_service_indicator_lock_state(); 236| | 237| 107| SHA512_CTX sha; 238| 107| uint8_t additional_data[BCM_SHA512_DIGEST_LENGTH]; 239| 107| BCM_sha512_init(&sha); 240| 107| BCM_sha512_update(&sha, priv_key->words, order->width * sizeof(BN_ULONG)); 241| 107| BCM_sha512_update(&sha, digest, digest_len); 242| 107| BCM_sha512_final(additional_data, &sha); 243| | 244| | // Cap iterations so callers who supply invalid values as custom groups do not 245| | // infinite loop. This does not impact valid parameters (e.g. those covered by 246| | // FIPS) because the probability of requiring even one retry is negligible, 247| | // let alone 32. 248| 107| static const int kMaxIterations = 32; 249| 107| int ret = 0; 250| 107| int iters = 0; 251| 107| for (;;) { 252| 107| EC_SCALAR k; 253| 107| if (!ec_random_nonzero_scalar(group, &k, additional_data)) { ------------------ | Branch (253:9): [True: 0, False: 107] ------------------ 254| 0| goto out; 255| 0| } 256| | 257| | // TODO(davidben): Move this inside |ec_random_nonzero_scalar| or lower, so 258| | // that all scalars we generate are, by default, secret. 259| 107| CONSTTIME_SECRET(k.words, sizeof(k.words)); 260| | 261| 107| int retry; 262| 107| ret = ecdsa_sign_impl(group, &retry, sig, out_sig_len, max_sig_len, 263| 107| priv_key, &k, digest, digest_len); 264| 107| if (ret || !retry) { ------------------ | Branch (264:9): [True: 107, False: 0] | Branch (264:16): [True: 0, False: 0] ------------------ 265| 107| goto out; 266| 107| } 267| | 268| 0| iters++; 269| 0| if (iters > kMaxIterations) { ------------------ | Branch (269:9): [True: 0, False: 0] ------------------ 270| 0| OPENSSL_PUT_ERROR(ECDSA, ECDSA_R_TOO_MANY_ITERATIONS); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 271| 0| goto out; 272| 0| } 273| 0| } 274| | 275| 107|out: 276| 107| FIPS_service_indicator_unlock_state(); 277| 107| return ret; 278| 107|} bcm.cc:_ZL16digest_to_scalarPK11ec_group_stP9EC_SCALARPKhm: 34| 4.92k| const uint8_t *digest, size_t digest_len) { 35| 4.92k| const BIGNUM *order = EC_GROUP_get0_order(group); 36| 4.92k| size_t num_bits = BN_num_bits(order); 37| | // Need to truncate digest if it is too long: first truncate whole bytes. 38| 4.92k| size_t num_bytes = (num_bits + 7) / 8; 39| 4.92k| if (digest_len > num_bytes) { ------------------ | Branch (39:7): [True: 4.13k, False: 795] ------------------ 40| 4.13k| digest_len = num_bytes; 41| 4.13k| } 42| 4.92k| bn_big_endian_to_words(out->words, order->width, digest, digest_len); 43| | 44| | // If it is still too long, truncate remaining bits with a shift. 45| 4.92k| if (8 * digest_len > num_bits) { ------------------ | Branch (45:7): [True: 0, False: 4.92k] ------------------ 46| 0| bn_rshift_words(out->words, out->words, 8 - (num_bits & 0x7), order->width); 47| 0| } 48| | 49| | // |out| now has the same bit width as |order|, but this only bounds by 50| | // 2*|order|. Subtract the order if out of range. 51| | // 52| | // Montgomery multiplication accepts the looser bounds, so this isn't strictly 53| | // necessary, but it is a cleaner abstraction and has no performance impact. 54| 4.92k| BN_ULONG tmp[EC_MAX_WORDS]; 55| 4.92k| bn_reduce_once_in_place(out->words, 0 /* no carry */, order->d, tmp, 56| 4.92k| order->width); 57| 4.92k|} bcm.cc:_ZL15ecdsa_sign_implPK11ec_group_stPiPhPmmPK9EC_SCALARS7_PKhm: 119| 107| const uint8_t *digest, size_t digest_len) { 120| 107| *out_retry = 0; 121| | 122| | // Check that the size of the group order is FIPS compliant (FIPS 186-4 123| | // B.5.2). 124| 107| const BIGNUM *order = EC_GROUP_get0_order(group); 125| 107| if (BN_num_bits(order) < 160) { ------------------ | Branch (125:7): [True: 0, False: 107] ------------------ 126| 0| OPENSSL_PUT_ERROR(EC, EC_R_INVALID_GROUP_ORDER); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 127| 0| return 0; 128| 0| } 129| | 130| 107| size_t sig_len = 2 * BN_num_bytes(order); 131| 107| if (sig_len > max_sig_len) { ------------------ | Branch (131:7): [True: 0, False: 107] ------------------ 132| 0| OPENSSL_PUT_ERROR(EC, EC_R_BUFFER_TOO_SMALL); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 133| 0| return 0; 134| 0| } 135| | 136| | // Compute r, the x-coordinate of k * generator. 137| 107| EC_JACOBIAN tmp_point; 138| 107| EC_SCALAR r; 139| 107| if (!ec_point_mul_scalar_base(group, &tmp_point, k) || ------------------ | Branch (139:7): [True: 0, False: 107] ------------------ 140| 107| !ec_get_x_coordinate_as_scalar(group, &r, &tmp_point)) { ------------------ | Branch (140:7): [True: 0, False: 107] ------------------ 141| 0| return 0; 142| 0| } 143| | 144| 107| if (constant_time_declassify_int(ec_scalar_is_zero(group, &r))) { ------------------ | Branch (144:7): [True: 0, False: 107] ------------------ 145| 0| *out_retry = 1; 146| 0| return 0; 147| 0| } 148| | 149| | // s = priv_key * r. Note if only one parameter is in the Montgomery domain, 150| | // |ec_scalar_mod_mul_montgomery| will compute the answer in the normal 151| | // domain. 152| 107| EC_SCALAR s; 153| 107| ec_scalar_to_montgomery(group, &s, &r); 154| 107| ec_scalar_mul_montgomery(group, &s, priv_key, &s); 155| | 156| | // s = m + priv_key * r. 157| 107| EC_SCALAR tmp; 158| 107| digest_to_scalar(group, &tmp, digest, digest_len); 159| 107| ec_scalar_add(group, &s, &s, &tmp); 160| | 161| | // s = k^-1 * (m + priv_key * r). First, we compute k^-1 in the Montgomery 162| | // domain. This is |ec_scalar_to_montgomery| followed by 163| | // |ec_scalar_inv0_montgomery|, but |ec_scalar_inv0_montgomery| followed by 164| | // |ec_scalar_from_montgomery| is equivalent and slightly more efficient. 165| | // Then, as above, only one parameter is in the Montgomery domain, so the 166| | // result is in the normal domain. Finally, note k is non-zero (or computing r 167| | // would fail), so the inverse must exist. 168| 107| ec_scalar_inv0_montgomery(group, &tmp, k); // tmp = k^-1 R^2 169| 107| ec_scalar_from_montgomery(group, &tmp, &tmp); // tmp = k^-1 R 170| 107| ec_scalar_mul_montgomery(group, &s, &s, &tmp); 171| 107| if (constant_time_declassify_int(ec_scalar_is_zero(group, &s))) { ------------------ | Branch (171:7): [True: 0, False: 107] ------------------ 172| 0| *out_retry = 1; 173| 0| return 0; 174| 0| } 175| | 176| 107| CONSTTIME_DECLASSIFY(r.words, sizeof(r.words)); 177| 107| CONSTTIME_DECLASSIFY(s.words, sizeof(r.words)); 178| 107| size_t len; 179| 107| ec_scalar_to_bytes(group, sig, &len, &r); 180| 107| assert(len == sig_len / 2); 181| 107| ec_scalar_to_bytes(group, sig + len, &len, &s); 182| 107| assert(len == sig_len / 2); 183| 107| *out_sig_len = sig_len; 184| 107| return 1; 185| 107|} HKDF_extract: 44| 657| size_t salt_len) { 45| | // https://tools.ietf.org/html/rfc5869#section-2.2 46| | 47| | // If salt is not given, HashLength zeros are used. However, HMAC does that 48| | // internally already so we can ignore it. 49| 657| unsigned len; 50| 657| if (HMAC(digest, salt, salt_len, secret, secret_len, out_key, &len) == NULL) { ------------------ | Branch (50:7): [True: 0, False: 657] ------------------ 51| 0| OPENSSL_PUT_ERROR(HKDF, ERR_R_HMAC_LIB); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 52| 0| return 0; 53| 0| } 54| 657| *out_len = len; 55| 657| assert(*out_len == EVP_MD_size(digest)); 56| 657| return 1; 57| 657|} HKDF_expand: 61| 4.48k| size_t info_len) { 62| | // https://tools.ietf.org/html/rfc5869#section-2.3 63| 4.48k| const size_t digest_len = EVP_MD_size(digest); 64| 4.48k| uint8_t previous[EVP_MAX_MD_SIZE]; 65| 4.48k| size_t n, done = 0; 66| 4.48k| unsigned i; 67| 4.48k| int ret = 0; 68| 4.48k| HMAC_CTX hmac; 69| | 70| | // Expand key material to desired length. 71| 4.48k| n = (out_len + digest_len - 1) / digest_len; 72| 4.48k| if (out_len + digest_len < out_len || n > 255) { ------------------ | Branch (72:7): [True: 0, False: 4.48k] | Branch (72:41): [True: 0, False: 4.48k] ------------------ 73| 0| OPENSSL_PUT_ERROR(HKDF, HKDF_R_OUTPUT_TOO_LARGE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 74| 0| return 0; 75| 0| } 76| | 77| 4.48k| HMAC_CTX_init(&hmac); 78| 4.48k| if (!HMAC_Init_ex(&hmac, prk, prk_len, digest, NULL)) { ------------------ | Branch (78:7): [True: 0, False: 4.48k] ------------------ 79| 0| goto out; 80| 0| } 81| | 82| 8.97k| for (i = 0; i < n; i++) { ------------------ | Branch (82:15): [True: 4.48k, False: 4.48k] ------------------ 83| 4.48k| uint8_t ctr = i + 1; 84| 4.48k| size_t todo; 85| | 86| 4.48k| if (i != 0 && (!HMAC_Init_ex(&hmac, NULL, 0, NULL, NULL) || ------------------ | Branch (86:9): [True: 1, False: 4.48k] | Branch (86:20): [True: 0, False: 1] ------------------ 87| 1| !HMAC_Update(&hmac, previous, digest_len))) { ------------------ | Branch (87:20): [True: 0, False: 1] ------------------ 88| 0| goto out; 89| 0| } 90| 4.48k| if (!HMAC_Update(&hmac, info, info_len) || ------------------ | Branch (90:9): [True: 0, False: 4.48k] ------------------ 91| 4.48k| !HMAC_Update(&hmac, &ctr, 1) || ------------------ | Branch (91:9): [True: 0, False: 4.48k] ------------------ 92| 4.48k| !HMAC_Final(&hmac, previous, NULL)) { ------------------ | Branch (92:9): [True: 0, False: 4.48k] ------------------ 93| 0| goto out; 94| 0| } 95| | 96| 4.48k| todo = digest_len; 97| 4.48k| if (todo > out_len - done) { ------------------ | Branch (97:9): [True: 1.39k, False: 3.08k] ------------------ 98| 1.39k| todo = out_len - done; 99| 1.39k| } 100| 4.48k| OPENSSL_memcpy(out_key + done, previous, todo); 101| 4.48k| done += todo; 102| 4.48k| } 103| | 104| 4.48k| ret = 1; 105| | 106| 4.48k|out: 107| 4.48k| HMAC_CTX_cleanup(&hmac); 108| 4.48k| if (ret != 1) { ------------------ | Branch (108:7): [True: 0, False: 4.48k] ------------------ 109| 0| OPENSSL_PUT_ERROR(HKDF, ERR_R_HMAC_LIB); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 110| 0| } 111| 4.48k| return ret; 112| 4.48k|} HMAC: 29| 933| unsigned int *out_len) { 30| 933| HMAC_CTX ctx; 31| 933| HMAC_CTX_init(&ctx); 32| | 33| | // The underlying hash functions should not set the FIPS service indicator 34| | // until all operations have completed. 35| 933| FIPS_service_indicator_lock_state(); 36| 933| const int ok = HMAC_Init_ex(&ctx, key, key_len, evp_md, NULL) && ------------------ | Branch (36:18): [True: 933, False: 0] ------------------ 37| 933| HMAC_Update(&ctx, data, data_len) && ------------------ | Branch (37:18): [True: 933, False: 0] ------------------ 38| 933| HMAC_Final(&ctx, out, out_len); ------------------ | Branch (38:18): [True: 933, False: 0] ------------------ 39| 933| FIPS_service_indicator_unlock_state(); 40| | 41| 933| HMAC_CTX_cleanup(&ctx); 42| | 43| 933| if (!ok) { ------------------ | Branch (43:7): [True: 0, False: 933] ------------------ 44| 0| return NULL; 45| 0| } 46| | 47| 933| HMAC_verify_service_indicator(evp_md); 48| 933| return out; 49| 933|} HMAC_CTX_init: 51| 705k|void HMAC_CTX_init(HMAC_CTX *ctx) { 52| 705k| ctx->md = NULL; 53| 705k| EVP_MD_CTX_init(&ctx->i_ctx); 54| 705k| EVP_MD_CTX_init(&ctx->o_ctx); 55| 705k| EVP_MD_CTX_init(&ctx->md_ctx); 56| 705k|} HMAC_CTX_new: 58| 64.0k|HMAC_CTX *HMAC_CTX_new(void) { 59| 64.0k| HMAC_CTX *ctx = 60| 64.0k| reinterpret_cast(OPENSSL_malloc(sizeof(HMAC_CTX))); 61| 64.0k| if (ctx != NULL) { ------------------ | Branch (61:7): [True: 64.0k, False: 0] ------------------ 62| 64.0k| HMAC_CTX_init(ctx); 63| 64.0k| } 64| 64.0k| return ctx; 65| 64.0k|} HMAC_CTX_cleanup: 67| 705k|void HMAC_CTX_cleanup(HMAC_CTX *ctx) { 68| 705k| EVP_MD_CTX_cleanup(&ctx->i_ctx); 69| 705k| EVP_MD_CTX_cleanup(&ctx->o_ctx); 70| 705k| EVP_MD_CTX_cleanup(&ctx->md_ctx); 71| 705k| OPENSSL_cleanse(ctx, sizeof(HMAC_CTX)); 72| 705k|} HMAC_CTX_free: 81| 64.0k|void HMAC_CTX_free(HMAC_CTX *ctx) { 82| 64.0k| if (ctx == NULL) { ------------------ | Branch (82:7): [True: 0, False: 64.0k] ------------------ 83| 0| return; 84| 0| } 85| | 86| 64.0k| HMAC_CTX_cleanup(ctx); 87| 64.0k| OPENSSL_free(ctx); 88| 64.0k|} HMAC_Init_ex: 91| 281k| const EVP_MD *md, ENGINE *impl) { 92| 281k| int ret = 0; 93| 281k| FIPS_service_indicator_lock_state(); 94| | 95| 281k| if (md == NULL) { ------------------ | Branch (95:7): [True: 1, False: 281k] ------------------ 96| 1| md = ctx->md; 97| 1| } 98| | 99| | // If either |key| is non-NULL or |md| has changed, initialize with a new key 100| | // rather than rewinding the previous one. 101| | // 102| | // TODO(davidben,eroman): Passing the previous |md| with a NULL |key| is 103| | // ambiguous between using the empty key and reusing the previous key. There 104| | // exist callers which intend the latter, but the former is an awkward edge 105| | // case. Fix to API to avoid this. 106| 281k| if (md != ctx->md || key != NULL) { ------------------ | Branch (106:7): [True: 281k, False: 1] | Branch (106:24): [True: 0, False: 1] ------------------ 107| 281k| uint8_t pad[EVP_MAX_MD_BLOCK_SIZE]; 108| 281k| uint8_t key_block[EVP_MAX_MD_BLOCK_SIZE]; 109| 281k| unsigned key_block_len; 110| | 111| 281k| size_t block_size = EVP_MD_block_size(md); 112| 281k| assert(block_size <= sizeof(key_block)); 113| 281k| assert(EVP_MD_size(md) <= block_size); 114| 281k| if (block_size < key_len) { ------------------ | Branch (114:9): [True: 2, False: 281k] ------------------ 115| | // Long keys are hashed. 116| 2| if (!EVP_DigestInit_ex(&ctx->md_ctx, md, impl) || ------------------ | Branch (116:11): [True: 0, False: 2] ------------------ 117| 2| !EVP_DigestUpdate(&ctx->md_ctx, key, key_len) || ------------------ | Branch (117:11): [True: 0, False: 2] ------------------ 118| 2| !EVP_DigestFinal_ex(&ctx->md_ctx, key_block, &key_block_len)) { ------------------ | Branch (118:11): [True: 0, False: 2] ------------------ 119| 0| goto out; 120| 0| } 121| 281k| } else { 122| 281k| assert(key_len <= sizeof(key_block)); 123| 281k| OPENSSL_memcpy(key_block, key, key_len); 124| 281k| key_block_len = (unsigned)key_len; 125| 281k| } 126| | // Keys are then padded with zeros. 127| 281k| OPENSSL_memset(key_block + key_block_len, 0, block_size - key_block_len); 128| | 129| 19.6M| for (size_t i = 0; i < block_size; i++) { ------------------ | Branch (129:24): [True: 19.3M, False: 281k] ------------------ 130| 19.3M| pad[i] = 0x36 ^ key_block[i]; 131| 19.3M| } 132| 281k| if (!EVP_DigestInit_ex(&ctx->i_ctx, md, impl) || ------------------ | Branch (132:9): [True: 0, False: 281k] ------------------ 133| 281k| !EVP_DigestUpdate(&ctx->i_ctx, pad, block_size)) { ------------------ | Branch (133:9): [True: 0, False: 281k] ------------------ 134| 0| goto out; 135| 0| } 136| | 137| 19.6M| for (size_t i = 0; i < block_size; i++) { ------------------ | Branch (137:24): [True: 19.3M, False: 281k] ------------------ 138| 19.3M| pad[i] = 0x5c ^ key_block[i]; 139| 19.3M| } 140| 281k| if (!EVP_DigestInit_ex(&ctx->o_ctx, md, impl) || ------------------ | Branch (140:9): [True: 0, False: 281k] ------------------ 141| 281k| !EVP_DigestUpdate(&ctx->o_ctx, pad, block_size)) { ------------------ | Branch (141:9): [True: 0, False: 281k] ------------------ 142| 0| goto out; 143| 0| } 144| | 145| 281k| ctx->md = md; 146| 281k| } 147| | 148| 281k| ret = EVP_MD_CTX_copy_ex(&ctx->md_ctx, &ctx->i_ctx); 149| | 150| 281k|out: 151| 281k| FIPS_service_indicator_unlock_state(); 152| 281k| return ret; 153| 281k|} HMAC_Update: 155| 2.18M|int HMAC_Update(HMAC_CTX *ctx, const uint8_t *data, size_t data_len) { 156| 2.18M| return EVP_DigestUpdate(&ctx->md_ctx, data, data_len); 157| 2.18M|} HMAC_Final: 159| 777k|int HMAC_Final(HMAC_CTX *ctx, uint8_t *out, unsigned int *out_len) { 160| 777k| int ret = 0; 161| 777k| unsigned int i; 162| 777k| uint8_t buf[EVP_MAX_MD_SIZE]; 163| | 164| 777k| FIPS_service_indicator_lock_state(); 165| | // TODO(davidben): The only thing that can officially fail here is 166| | // |EVP_MD_CTX_copy_ex|, but even that should be impossible in this case. 167| 777k| if (!EVP_DigestFinal_ex(&ctx->md_ctx, buf, &i) || ------------------ | Branch (167:7): [True: 0, False: 777k] ------------------ 168| 777k| !EVP_MD_CTX_copy_ex(&ctx->md_ctx, &ctx->o_ctx) || ------------------ | Branch (168:7): [True: 0, False: 777k] ------------------ 169| 777k| !EVP_DigestUpdate(&ctx->md_ctx, buf, i) || ------------------ | Branch (169:7): [True: 0, False: 777k] ------------------ 170| 777k| !EVP_DigestFinal_ex(&ctx->md_ctx, out, out_len)) { ------------------ | Branch (170:7): [True: 0, False: 777k] ------------------ 171| 0| *out_len = 0; 172| 0| goto out; 173| 0| } 174| | 175| 777k| ret = 1; 176| | 177| 777k|out: 178| 777k| FIPS_service_indicator_unlock_state(); 179| 777k| if (ret) { ------------------ | Branch (179:7): [True: 777k, False: 0] ------------------ 180| 777k| HMAC_verify_service_indicator(ctx->md); 181| 777k| } 182| 777k| return ret; 183| 777k|} HMAC_CTX_copy_ex: 189| 771k|int HMAC_CTX_copy_ex(HMAC_CTX *dest, const HMAC_CTX *src) { 190| 771k| if (!EVP_MD_CTX_copy_ex(&dest->i_ctx, &src->i_ctx) || ------------------ | Branch (190:7): [True: 0, False: 771k] ------------------ 191| 771k| !EVP_MD_CTX_copy_ex(&dest->o_ctx, &src->o_ctx) || ------------------ | Branch (191:7): [True: 0, False: 771k] ------------------ 192| 771k| !EVP_MD_CTX_copy_ex(&dest->md_ctx, &src->md_ctx)) { ------------------ | Branch (192:7): [True: 0, False: 771k] ------------------ 193| 0| return 0; 194| 0| } 195| | 196| 771k| dest->md = src->md; 197| 771k| return 1; 198| 771k|} BORINGSSL_keccak: 162| 450k| size_t in_len, enum boringssl_keccak_config_t config) { 163| 450k| struct BORINGSSL_keccak_st ctx; 164| 450k| keccak_init(&ctx, config); 165| 450k| if (ctx.required_out_len != 0 && out_len != ctx.required_out_len) { ------------------ | Branch (165:7): [True: 112k, False: 338k] | Branch (165:36): [True: 0, False: 112k] ------------------ 166| 0| abort(); 167| 0| } 168| 450k| BORINGSSL_keccak_absorb(&ctx, in, in_len); 169| 450k| BORINGSSL_keccak_squeeze(&ctx, out, out_len); 170| 450k|} BORINGSSL_keccak_init: 173| 507k| enum boringssl_keccak_config_t config) { 174| 507k| keccak_init(ctx, config); 175| 507k|} BORINGSSL_keccak_absorb: 178| 958k| size_t in_len) { 179| 958k| if (ctx->phase == boringssl_keccak_phase_squeeze) { ------------------ | Branch (179:7): [True: 0, False: 958k] ------------------ 180| | // It's illegal to call absorb() again after calling squeeze(). 181| 0| abort(); 182| 0| } 183| | 184| 958k| const size_t rate_words = ctx->rate_bytes / 8; 185| | // XOR the input. Accessing |ctx->state| as a |uint8_t*| is allowed by strict 186| | // aliasing because we require |uint8_t| to be a character type. 187| 958k| uint8_t *state_bytes = (uint8_t *)ctx->state; 188| | 189| | // Absorb partial block. 190| 958k| if (ctx->absorb_offset != 0) { ------------------ | Branch (190:7): [True: 0, False: 958k] ------------------ 191| 0| assert(ctx->absorb_offset < ctx->rate_bytes); 192| 0| size_t first_block_len = ctx->rate_bytes - ctx->absorb_offset; 193| 0| for (size_t i = 0; i < first_block_len && i < in_len; i++) { ------------------ | Branch (193:24): [True: 0, False: 0] | Branch (193:47): [True: 0, False: 0] ------------------ 194| 0| state_bytes[ctx->absorb_offset + i] ^= in[i]; 195| 0| } 196| | 197| | // This input didn't fill the block. 198| 0| if (first_block_len > in_len) { ------------------ | Branch (198:9): [True: 0, False: 0] ------------------ 199| 0| ctx->absorb_offset += in_len; 200| 0| return; 201| 0| } 202| | 203| 0| keccak_f(ctx->state); 204| 0| in += first_block_len; 205| 0| in_len -= first_block_len; 206| 0| } 207| | 208| | // Absorb full blocks. 209| 1.40M| while (in_len >= ctx->rate_bytes) { ------------------ | Branch (209:10): [True: 450k, False: 958k] ------------------ 210| 8.11M| for (size_t i = 0; i < rate_words; i++) { ------------------ | Branch (210:24): [True: 7.66M, False: 450k] ------------------ 211| 7.66M| ctx->state[i] ^= CRYPTO_load_u64_le(in + 8 * i); 212| 7.66M| } 213| 450k| keccak_f(ctx->state); 214| 450k| in += ctx->rate_bytes; 215| 450k| in_len -= ctx->rate_bytes; 216| 450k| } 217| | 218| | // Absorb partial block. 219| 958k| assert(in_len < ctx->rate_bytes); 220| 36.6M| for (size_t i = 0; i < in_len; i++) { ------------------ | Branch (220:22): [True: 35.6M, False: 958k] ------------------ 221| 35.6M| state_bytes[i] ^= in[i]; 222| 35.6M| } 223| 958k| ctx->absorb_offset = in_len; 224| 958k|} BORINGSSL_keccak_squeeze: 250| 1.97M| size_t out_len) { 251| 1.97M| if (ctx->required_out_len != 0 && ------------------ | Branch (251:7): [True: 112k, False: 1.86M] ------------------ 252| 1.97M| (ctx->phase == boringssl_keccak_phase_squeeze || ------------------ | Branch (252:8): [True: 0, False: 112k] ------------------ 253| 112k| out_len != ctx->required_out_len)) { ------------------ | Branch (253:8): [True: 0, False: 112k] ------------------ 254| | // The SHA-3 variants must be squeezed in a single call, to confirm that the 255| | // output length is correct. 256| 0| abort(); 257| 0| } 258| | 259| 1.97M| if (ctx->phase == boringssl_keccak_phase_absorb) { ------------------ | Branch (259:7): [True: 958k, False: 1.01M] ------------------ 260| 958k| keccak_finalize(ctx); 261| 958k| ctx->phase = boringssl_keccak_phase_squeeze; 262| 958k| } 263| | 264| | // Accessing |ctx->state| as a |uint8_t*| is allowed by strict aliasing 265| | // because we require |uint8_t| to be a character type. 266| 1.97M| const uint8_t *state_bytes = (const uint8_t *)ctx->state; 267| 3.95M| while (out_len) { ------------------ | Branch (267:10): [True: 1.97M, False: 1.97M] ------------------ 268| 1.97M| if (ctx->squeeze_offset == ctx->rate_bytes) { ------------------ | Branch (268:9): [True: 1.01M, False: 958k] ------------------ 269| 1.01M| keccak_f(ctx->state); 270| 1.01M| ctx->squeeze_offset = 0; 271| 1.01M| } 272| | 273| 1.97M| size_t remaining = ctx->rate_bytes - ctx->squeeze_offset; 274| 1.97M| size_t todo = out_len; 275| 1.97M| if (todo > remaining) { ------------------ | Branch (275:9): [True: 0, False: 1.97M] ------------------ 276| 0| todo = remaining; 277| 0| } 278| 1.97M| OPENSSL_memcpy(out, &state_bytes[ctx->squeeze_offset], todo); 279| 1.97M| out += todo; 280| 1.97M| out_len -= todo; 281| 1.97M| ctx->squeeze_offset += todo; 282| 1.97M| } 283| 1.97M|} bcm.cc:_ZL11keccak_initP19BORINGSSL_keccak_st25boringssl_keccak_config_t: 129| 958k| enum boringssl_keccak_config_t config) { 130| 958k| size_t required_out_len; 131| 958k| size_t capacity_bytes; 132| 958k| switch (config) { 133| 56.3k| case boringssl_sha3_256: ------------------ | Branch (133:5): [True: 56.3k, False: 901k] ------------------ 134| 56.3k| capacity_bytes = 512 / 8; 135| 56.3k| required_out_len = 32; 136| 56.3k| break; 137| 56.3k| case boringssl_sha3_512: ------------------ | Branch (137:5): [True: 56.3k, False: 901k] ------------------ 138| 56.3k| capacity_bytes = 1024 / 8; 139| 56.3k| required_out_len = 64; 140| 56.3k| break; 141| 507k| case boringssl_shake128: ------------------ | Branch (141:5): [True: 507k, False: 450k] ------------------ 142| 507k| capacity_bytes = 256 / 8; 143| 507k| required_out_len = 0; 144| 507k| break; 145| 338k| case boringssl_shake256: ------------------ | Branch (145:5): [True: 338k, False: 619k] ------------------ 146| 338k| capacity_bytes = 512 / 8; 147| 338k| required_out_len = 0; 148| 338k| break; 149| 0| default: ------------------ | Branch (149:5): [True: 0, False: 958k] ------------------ 150| 0| abort(); 151| 958k| } 152| | 153| 958k| OPENSSL_memset(ctx, 0, sizeof(*ctx)); 154| 958k| ctx->config = config; 155| 958k| ctx->phase = boringssl_keccak_phase_absorb; 156| 958k| ctx->required_out_len = required_out_len; 157| 958k| ctx->rate_bytes = 200 - capacity_bytes; 158| 958k| assert(ctx->rate_bytes % 8 == 0); 159| 958k|} bcm.cc:_ZL8keccak_fPm: 27| 2.42M|static void keccak_f(uint64_t state[25]) { 28| 2.42M| static const int kNumRounds = 24; 29| 60.6M| for (int round = 0; round < kNumRounds; round++) { ------------------ | Branch (29:23): [True: 58.2M, False: 2.42M] ------------------ 30| | // θ step 31| 58.2M| uint64_t c[5]; 32| 349M| for (int x = 0; x < 5; x++) { ------------------ | Branch (32:21): [True: 291M, False: 58.2M] ------------------ 33| 291M| c[x] = state[x] ^ state[x + 5] ^ state[x + 10] ^ state[x + 15] ^ 34| 291M| state[x + 20]; 35| 291M| } 36| | 37| 349M| for (int x = 0; x < 5; x++) { ------------------ | Branch (37:21): [True: 291M, False: 58.2M] ------------------ 38| 291M| const uint64_t d = c[(x + 4) % 5] ^ CRYPTO_rotl_u64(c[(x + 1) % 5], 1); 39| 1.74G| for (int y = 0; y < 5; y++) { ------------------ | Branch (39:23): [True: 1.45G, False: 291M] ------------------ 40| 1.45G| state[y * 5 + x] ^= d; 41| 1.45G| } 42| 291M| } 43| | 44| | // ρ and π steps. 45| | // 46| | // These steps involve a mapping of the state matrix. Each input point, 47| | // (x,y), is rotated and written to the point (y, 2x + 3y). In the Keccak 48| | // pseudo-code a separate array is used because an in-place operation would 49| | // overwrite some values that are subsequently needed. However, the mapping 50| | // forms a trail through 24 of the 25 values so we can do it in place with 51| | // only a single temporary variable. 52| | // 53| | // Start with (1, 0). The value here will be mapped and end up at (0, 2). 54| | // That value will end up at (2, 1), then (1, 2), and so on. After 24 55| | // steps, 24 of the 25 values have been hit (as this mapping is injective) 56| | // and the sequence will repeat. All that remains is to handle the element 57| | // at (0, 0), but the rotation for that element is zero, and it goes to (0, 58| | // 0), so we can ignore it. 59| 58.2M| uint64_t prev_value = state[1]; 60| 58.2M|#define PI_RHO_STEP(index, rotation) \ 61| 58.2M| do { \ 62| 58.2M| const uint64_t value = CRYPTO_rotl_u64(prev_value, rotation); \ 63| 58.2M| prev_value = state[index]; \ 64| 58.2M| state[index] = value; \ 65| 58.2M| } while (0) 66| | 67| 58.2M| PI_RHO_STEP(10, 1); ------------------ | | 61| 58.2M| do { \ | | 62| 58.2M| const uint64_t value = CRYPTO_rotl_u64(prev_value, rotation); \ | | 63| 58.2M| prev_value = state[index]; \ | | 64| 58.2M| state[index] = value; \ | | 65| 58.2M| } while (0) | | ------------------ | | | Branch (65:12): [Folded - Ignored] | | ------------------ ------------------ 68| 58.2M| PI_RHO_STEP(7, 3); ------------------ | | 61| 58.2M| do { \ | | 62| 58.2M| const uint64_t value = CRYPTO_rotl_u64(prev_value, rotation); \ | | 63| 58.2M| prev_value = state[index]; \ | | 64| 58.2M| state[index] = value; \ | | 65| 58.2M| } while (0) | | ------------------ | | | Branch (65:12): [Folded - Ignored] | | ------------------ ------------------ 69| 58.2M| PI_RHO_STEP(11, 6); ------------------ | | 61| 58.2M| do { \ | | 62| 58.2M| const uint64_t value = CRYPTO_rotl_u64(prev_value, rotation); \ | | 63| 58.2M| prev_value = state[index]; \ | | 64| 58.2M| state[index] = value; \ | | 65| 58.2M| } while (0) | | ------------------ | | | Branch (65:12): [Folded - Ignored] | | ------------------ ------------------ 70| 58.2M| PI_RHO_STEP(17, 10); ------------------ | | 61| 58.2M| do { \ | | 62| 58.2M| const uint64_t value = CRYPTO_rotl_u64(prev_value, rotation); \ | | 63| 58.2M| prev_value = state[index]; \ | | 64| 58.2M| state[index] = value; \ | | 65| 58.2M| } while (0) | | ------------------ | | | Branch (65:12): [Folded - Ignored] | | ------------------ ------------------ 71| 58.2M| PI_RHO_STEP(18, 15); ------------------ | | 61| 58.2M| do { \ | | 62| 58.2M| const uint64_t value = CRYPTO_rotl_u64(prev_value, rotation); \ | | 63| 58.2M| prev_value = state[index]; \ | | 64| 58.2M| state[index] = value; \ | | 65| 58.2M| } while (0) | | ------------------ | | | Branch (65:12): [Folded - Ignored] | | ------------------ ------------------ 72| 58.2M| PI_RHO_STEP(3, 21); ------------------ | | 61| 58.2M| do { \ | | 62| 58.2M| const uint64_t value = CRYPTO_rotl_u64(prev_value, rotation); \ | | 63| 58.2M| prev_value = state[index]; \ | | 64| 58.2M| state[index] = value; \ | | 65| 58.2M| } while (0) | | ------------------ | | | Branch (65:12): [Folded - Ignored] | | ------------------ ------------------ 73| 58.2M| PI_RHO_STEP(5, 28); ------------------ | | 61| 58.2M| do { \ | | 62| 58.2M| const uint64_t value = CRYPTO_rotl_u64(prev_value, rotation); \ | | 63| 58.2M| prev_value = state[index]; \ | | 64| 58.2M| state[index] = value; \ | | 65| 58.2M| } while (0) | | ------------------ | | | Branch (65:12): [Folded - Ignored] | | ------------------ ------------------ 74| 58.2M| PI_RHO_STEP(16, 36); ------------------ | | 61| 58.2M| do { \ | | 62| 58.2M| const uint64_t value = CRYPTO_rotl_u64(prev_value, rotation); \ | | 63| 58.2M| prev_value = state[index]; \ | | 64| 58.2M| state[index] = value; \ | | 65| 58.2M| } while (0) | | ------------------ | | | Branch (65:12): [Folded - Ignored] | | ------------------ ------------------ 75| 58.2M| PI_RHO_STEP(8, 45); ------------------ | | 61| 58.2M| do { \ | | 62| 58.2M| const uint64_t value = CRYPTO_rotl_u64(prev_value, rotation); \ | | 63| 58.2M| prev_value = state[index]; \ | | 64| 58.2M| state[index] = value; \ | | 65| 58.2M| } while (0) | | ------------------ | | | Branch (65:12): [Folded - Ignored] | | ------------------ ------------------ 76| 58.2M| PI_RHO_STEP(21, 55); ------------------ | | 61| 58.2M| do { \ | | 62| 58.2M| const uint64_t value = CRYPTO_rotl_u64(prev_value, rotation); \ | | 63| 58.2M| prev_value = state[index]; \ | | 64| 58.2M| state[index] = value; \ | | 65| 58.2M| } while (0) | | ------------------ | | | Branch (65:12): [Folded - Ignored] | | ------------------ ------------------ 77| 58.2M| PI_RHO_STEP(24, 2); ------------------ | | 61| 58.2M| do { \ | | 62| 58.2M| const uint64_t value = CRYPTO_rotl_u64(prev_value, rotation); \ | | 63| 58.2M| prev_value = state[index]; \ | | 64| 58.2M| state[index] = value; \ | | 65| 58.2M| } while (0) | | ------------------ | | | Branch (65:12): [Folded - Ignored] | | ------------------ ------------------ 78| 58.2M| PI_RHO_STEP(4, 14); ------------------ | | 61| 58.2M| do { \ | | 62| 58.2M| const uint64_t value = CRYPTO_rotl_u64(prev_value, rotation); \ | | 63| 58.2M| prev_value = state[index]; \ | | 64| 58.2M| state[index] = value; \ | | 65| 58.2M| } while (0) | | ------------------ | | | Branch (65:12): [Folded - Ignored] | | ------------------ ------------------ 79| 58.2M| PI_RHO_STEP(15, 27); ------------------ | | 61| 58.2M| do { \ | | 62| 58.2M| const uint64_t value = CRYPTO_rotl_u64(prev_value, rotation); \ | | 63| 58.2M| prev_value = state[index]; \ | | 64| 58.2M| state[index] = value; \ | | 65| 58.2M| } while (0) | | ------------------ | | | Branch (65:12): [Folded - Ignored] | | ------------------ ------------------ 80| 58.2M| PI_RHO_STEP(23, 41); ------------------ | | 61| 58.2M| do { \ | | 62| 58.2M| const uint64_t value = CRYPTO_rotl_u64(prev_value, rotation); \ | | 63| 58.2M| prev_value = state[index]; \ | | 64| 58.2M| state[index] = value; \ | | 65| 58.2M| } while (0) | | ------------------ | | | Branch (65:12): [Folded - Ignored] | | ------------------ ------------------ 81| 58.2M| PI_RHO_STEP(19, 56); ------------------ | | 61| 58.2M| do { \ | | 62| 58.2M| const uint64_t value = CRYPTO_rotl_u64(prev_value, rotation); \ | | 63| 58.2M| prev_value = state[index]; \ | | 64| 58.2M| state[index] = value; \ | | 65| 58.2M| } while (0) | | ------------------ | | | Branch (65:12): [Folded - Ignored] | | ------------------ ------------------ 82| 58.2M| PI_RHO_STEP(13, 8); ------------------ | | 61| 58.2M| do { \ | | 62| 58.2M| const uint64_t value = CRYPTO_rotl_u64(prev_value, rotation); \ | | 63| 58.2M| prev_value = state[index]; \ | | 64| 58.2M| state[index] = value; \ | | 65| 58.2M| } while (0) | | ------------------ | | | Branch (65:12): [Folded - Ignored] | | ------------------ ------------------ 83| 58.2M| PI_RHO_STEP(12, 25); ------------------ | | 61| 58.2M| do { \ | | 62| 58.2M| const uint64_t value = CRYPTO_rotl_u64(prev_value, rotation); \ | | 63| 58.2M| prev_value = state[index]; \ | | 64| 58.2M| state[index] = value; \ | | 65| 58.2M| } while (0) | | ------------------ | | | Branch (65:12): [Folded - Ignored] | | ------------------ ------------------ 84| 58.2M| PI_RHO_STEP(2, 43); ------------------ | | 61| 58.2M| do { \ | | 62| 58.2M| const uint64_t value = CRYPTO_rotl_u64(prev_value, rotation); \ | | 63| 58.2M| prev_value = state[index]; \ | | 64| 58.2M| state[index] = value; \ | | 65| 58.2M| } while (0) | | ------------------ | | | Branch (65:12): [Folded - Ignored] | | ------------------ ------------------ 85| 58.2M| PI_RHO_STEP(20, 62); ------------------ | | 61| 58.2M| do { \ | | 62| 58.2M| const uint64_t value = CRYPTO_rotl_u64(prev_value, rotation); \ | | 63| 58.2M| prev_value = state[index]; \ | | 64| 58.2M| state[index] = value; \ | | 65| 58.2M| } while (0) | | ------------------ | | | Branch (65:12): [Folded - Ignored] | | ------------------ ------------------ 86| 58.2M| PI_RHO_STEP(14, 18); ------------------ | | 61| 58.2M| do { \ | | 62| 58.2M| const uint64_t value = CRYPTO_rotl_u64(prev_value, rotation); \ | | 63| 58.2M| prev_value = state[index]; \ | | 64| 58.2M| state[index] = value; \ | | 65| 58.2M| } while (0) | | ------------------ | | | Branch (65:12): [Folded - Ignored] | | ------------------ ------------------ 87| 58.2M| PI_RHO_STEP(22, 39); ------------------ | | 61| 58.2M| do { \ | | 62| 58.2M| const uint64_t value = CRYPTO_rotl_u64(prev_value, rotation); \ | | 63| 58.2M| prev_value = state[index]; \ | | 64| 58.2M| state[index] = value; \ | | 65| 58.2M| } while (0) | | ------------------ | | | Branch (65:12): [Folded - Ignored] | | ------------------ ------------------ 88| 58.2M| PI_RHO_STEP(9, 61); ------------------ | | 61| 58.2M| do { \ | | 62| 58.2M| const uint64_t value = CRYPTO_rotl_u64(prev_value, rotation); \ | | 63| 58.2M| prev_value = state[index]; \ | | 64| 58.2M| state[index] = value; \ | | 65| 58.2M| } while (0) | | ------------------ | | | Branch (65:12): [Folded - Ignored] | | ------------------ ------------------ 89| 58.2M| PI_RHO_STEP(6, 20); ------------------ | | 61| 58.2M| do { \ | | 62| 58.2M| const uint64_t value = CRYPTO_rotl_u64(prev_value, rotation); \ | | 63| 58.2M| prev_value = state[index]; \ | | 64| 58.2M| state[index] = value; \ | | 65| 58.2M| } while (0) | | ------------------ | | | Branch (65:12): [Folded - Ignored] | | ------------------ ------------------ 90| 58.2M| PI_RHO_STEP(1, 44); ------------------ | | 61| 58.2M| do { \ | | 62| 58.2M| const uint64_t value = CRYPTO_rotl_u64(prev_value, rotation); \ | | 63| 58.2M| prev_value = state[index]; \ | | 64| 58.2M| state[index] = value; \ | | 65| 58.2M| } while (0) | | ------------------ | | | Branch (65:12): [Folded - Ignored] | | ------------------ ------------------ 91| | 92| 58.2M|#undef PI_RHO_STEP 93| | 94| | // χ step 95| 349M| for (int y = 0; y < 5; y++) { ------------------ | Branch (95:21): [True: 291M, False: 58.2M] ------------------ 96| 291M| const int row_index = 5 * y; 97| 291M| const uint64_t orig_x0 = state[row_index]; 98| 291M| const uint64_t orig_x1 = state[row_index + 1]; 99| 291M| state[row_index] ^= ~orig_x1 & state[row_index + 2]; 100| 291M| state[row_index + 1] ^= ~state[row_index + 2] & state[row_index + 3]; 101| 291M| state[row_index + 2] ^= ~state[row_index + 3] & state[row_index + 4]; 102| 291M| state[row_index + 3] ^= ~state[row_index + 4] & orig_x0; 103| 291M| state[row_index + 4] ^= ~orig_x0 & orig_x1; 104| 291M| } 105| | 106| | // ι step 107| | // 108| | // From https://keccak.team/files/Keccak-reference-3.0.pdf, section 109| | // 1.2, the round constants are based on the output of a LFSR. Thus, as 110| | // suggested in the appendix of of 111| | // https://keccak.team/keccak_specs_summary.html, the values are 112| | // simply encoded here. 113| 58.2M| static const uint64_t kRoundConstants[24] = { 114| 58.2M| 0x0000000000000001, 0x0000000000008082, 0x800000000000808a, 115| 58.2M| 0x8000000080008000, 0x000000000000808b, 0x0000000080000001, 116| 58.2M| 0x8000000080008081, 0x8000000000008009, 0x000000000000008a, 117| 58.2M| 0x0000000000000088, 0x0000000080008009, 0x000000008000000a, 118| 58.2M| 0x000000008000808b, 0x800000000000008b, 0x8000000000008089, 119| 58.2M| 0x8000000000008003, 0x8000000000008002, 0x8000000000000080, 120| 58.2M| 0x000000000000800a, 0x800000008000000a, 0x8000000080008081, 121| 58.2M| 0x8000000000008080, 0x0000000080000001, 0x8000000080008008, 122| 58.2M| }; 123| | 124| 58.2M| state[0] ^= kRoundConstants[round]; 125| 58.2M| } 126| 2.42M|} bcm.cc:_ZL15keccak_finalizeP19BORINGSSL_keccak_st: 226| 958k|static void keccak_finalize(struct BORINGSSL_keccak_st *ctx) { 227| 958k| uint8_t terminator; 228| 958k| switch (ctx->config) { 229| 56.3k| case boringssl_sha3_256: ------------------ | Branch (229:5): [True: 56.3k, False: 901k] ------------------ 230| 112k| case boringssl_sha3_512: ------------------ | Branch (230:5): [True: 56.3k, False: 901k] ------------------ 231| 112k| terminator = 0x06; 232| 112k| break; 233| 507k| case boringssl_shake128: ------------------ | Branch (233:5): [True: 507k, False: 450k] ------------------ 234| 845k| case boringssl_shake256: ------------------ | Branch (234:5): [True: 338k, False: 619k] ------------------ 235| 845k| terminator = 0x1f; 236| 845k| break; 237| 0| default: ------------------ | Branch (237:5): [True: 0, False: 958k] ------------------ 238| 0| abort(); 239| 958k| } 240| | 241| | // XOR the terminator. Accessing |ctx->state| as a |uint8_t*| is allowed by 242| | // strict aliasing because we require |uint8_t| to be a character type. 243| 958k| uint8_t *state_bytes = (uint8_t *)ctx->state; 244| 958k| state_bytes[ctx->absorb_offset] ^= terminator; 245| 958k| state_bytes[ctx->rate_bytes - 1] ^= 0x80; 246| 958k| keccak_f(ctx->state); 247| 958k|} BCM_mlkem768_generate_key: 1115| 56.3k| struct BCM_mlkem768_private_key *out_private_key) { 1116| 56.3k| uint8_t seed[BCM_MLKEM_SEED_BYTES]; 1117| 56.3k| BCM_rand_bytes(seed, sizeof(seed)); 1118| 56.3k| CONSTTIME_SECRET(seed, sizeof(seed)); 1119| 56.3k| if (optional_out_seed) { ------------------ | Branch (1119:7): [True: 0, False: 56.3k] ------------------ 1120| 0| OPENSSL_memcpy(optional_out_seed, seed, sizeof(seed)); 1121| 0| } 1122| 56.3k| BCM_mlkem768_generate_key_external_seed(out_encoded_public_key, 1123| 56.3k| out_private_key, seed); 1124| 56.3k| return bcm_infallible::not_approved; 1125| 56.3k|} BCM_mlkem768_generate_key_external_seed: 1206| 56.3k| const uint8_t seed[BCM_MLKEM_SEED_BYTES]) { 1207| 56.3k| mlkem::private_key *priv = 1208| 56.3k| mlkem::private_key_768_from_external(out_private_key); 1209| 56.3k| mlkem_generate_key_external_seed(out_encoded_public_key, priv, seed); 1210| 56.3k| return bcm_infallible::approved; 1211| 56.3k|} bcm.cc:_ZN5mlkem12_GLOBAL__N_129private_key_768_from_externalEPK24BCM_mlkem768_private_key: 901| 56.3k| const struct BCM_mlkem768_private_key *external) { 902| 56.3k| static_assert(sizeof(struct BCM_mlkem768_private_key) >= 903| 56.3k| sizeof(struct private_key), 904| 56.3k| "MLKEM private key too small"); 905| 56.3k| static_assert(alignof(struct BCM_mlkem768_private_key) >= 906| 56.3k| alignof(struct private_key), 907| 56.3k| "MLKEM private key alignment incorrect"); 908| 56.3k| return (struct private_key *)external; 909| 56.3k|} bcm.cc:_ZN5mlkem12_GLOBAL__N_145mlkem_generate_key_external_seed_no_self_testILi3EEEvPhPNS0_11private_keyIXT_EEEPKh: 701| 56.3k| const uint8_t seed[BCM_MLKEM_SEED_BYTES]) { 702| 56.3k| uint8_t augmented_seed[33]; 703| 56.3k| OPENSSL_memcpy(augmented_seed, seed, 32); 704| 56.3k| augmented_seed[32] = RANK; 705| | 706| 56.3k| uint8_t hashed[64]; 707| 56.3k| hash_g(hashed, augmented_seed, sizeof(augmented_seed)); 708| 56.3k| const uint8_t *const rho = hashed; 709| 56.3k| const uint8_t *const sigma = hashed + 32; 710| | // rho is public. 711| 56.3k| CONSTTIME_DECLASSIFY(rho, 32); 712| 56.3k| OPENSSL_memcpy(priv->pub.rho, hashed, sizeof(priv->pub.rho)); 713| 56.3k| matrix_expand(&priv->pub.m, rho); 714| 56.3k| uint8_t counter = 0; 715| 56.3k| vector_generate_secret_eta_2(&priv->s, &counter, sigma); 716| 56.3k| vector_ntt(&priv->s); 717| 56.3k| vector error; 718| 56.3k| vector_generate_secret_eta_2(&error, &counter, sigma); 719| 56.3k| vector_ntt(&error); 720| 56.3k| matrix_mult_transpose(&priv->pub.t, &priv->pub.m, &priv->s); 721| 56.3k| vector_add(&priv->pub.t, &error); 722| | // t is part of the public key and thus is public. 723| 56.3k| CONSTTIME_DECLASSIFY(&priv->pub.t, sizeof(priv->pub.t)); 724| | 725| 56.3k| CBB cbb; 726| 56.3k| CBB_init_fixed(&cbb, out_encoded_public_key, encoded_public_key_size(RANK)); 727| 56.3k| if (!bcm_success(mlkem_marshal_public_key(&cbb, &priv->pub))) { ------------------ | Branch (727:7): [True: 0, False: 56.3k] ------------------ 728| 0| abort(); 729| 0| } 730| | 731| 56.3k| hash_h(priv->pub.public_key_hash, out_encoded_public_key, 732| 56.3k| encoded_public_key_size(RANK)); 733| 56.3k| OPENSSL_memcpy(priv->fo_failure_secret, seed + 32, 32); 734| 56.3k|} bcm.cc:_ZN5mlkem12_GLOBAL__N_16hash_gEPhPKhm: 54| 56.3k|void hash_g(uint8_t out[64], const uint8_t *in, size_t len) { 55| 56.3k| BORINGSSL_keccak(out, 64, in, len, boringssl_sha3_512); 56| 56.3k|} bcm.cc:_ZN5mlkem12_GLOBAL__N_113matrix_expandILi3EEEvPNS0_6matrixIXT_EEEPKh: 441| 56.3k|void matrix_expand(matrix *out, const uint8_t rho[32]) { 442| 56.3k| uint8_t input[34]; 443| 56.3k| OPENSSL_memcpy(input, rho, 32); 444| 225k| for (int i = 0; i < RANK; i++) { ------------------ | Branch (444:19): [True: 169k, False: 56.3k] ------------------ 445| 676k| for (int j = 0; j < RANK; j++) { ------------------ | Branch (445:21): [True: 507k, False: 169k] ------------------ 446| 507k| input[32] = i; 447| 507k| input[33] = j; 448| 507k| struct BORINGSSL_keccak_st keccak_ctx; 449| 507k| BORINGSSL_keccak_init(&keccak_ctx, boringssl_shake128); 450| 507k| BORINGSSL_keccak_absorb(&keccak_ctx, input, sizeof(input)); 451| 507k| scalar_from_keccak_vartime(&out->v[i][j], &keccak_ctx); 452| 507k| } 453| 169k| } 454| 56.3k|} bcm.cc:_ZN5mlkem12_GLOBAL__N_126scalar_from_keccak_vartimeEPNS0_6scalarEP19BORINGSSL_keccak_st: 370| 507k| struct BORINGSSL_keccak_st *keccak_ctx) { 371| 507k| assert(keccak_ctx->squeeze_offset == 0); 372| 507k| assert(keccak_ctx->rate_bytes == 168); 373| 507k| static_assert(168 % 3 == 0, "block and coefficient boundaries do not align"); 374| | 375| 507k| int done = 0; 376| 2.03M| while (done < DEGREE) { ------------------ | | 70| 2.03M|#define DEGREE 256 ------------------ | Branch (376:10): [True: 1.52M, False: 507k] ------------------ 377| 1.52M| uint8_t block[168]; 378| 1.52M| BORINGSSL_keccak_squeeze(keccak_ctx, block, sizeof(block)); 379| 81.5M| for (size_t i = 0; i < sizeof(block) && done < DEGREE; i += 3) { ------------------ | | 70| 80.4M|#define DEGREE 256 ------------------ | Branch (379:24): [True: 80.4M, False: 1.02M] | Branch (379:45): [True: 79.9M, False: 503k] ------------------ 380| 79.9M| uint16_t d1 = block[i] + 256 * (block[i + 1] % 16); 381| 79.9M| uint16_t d2 = block[i + 1] / 16 + 16 * block[i + 2]; 382| 79.9M| if (d1 < kPrime) { ------------------ | Branch (382:11): [True: 64.9M, False: 14.9M] ------------------ 383| 64.9M| out->c[done++] = d1; 384| 64.9M| } 385| 79.9M| if (d2 < kPrime && done < DEGREE) { ------------------ | | 70| 65.0M|#define DEGREE 256 ------------------ | Branch (385:11): [True: 65.0M, False: 14.9M] | Branch (385:26): [True: 64.7M, False: 205k] ------------------ 386| 64.7M| out->c[done++] = d2; 387| 64.7M| } 388| 79.9M| } 389| 1.52M| } 390| 507k|} bcm.cc:_ZN5mlkem12_GLOBAL__N_128vector_generate_secret_eta_2ILi3EEEvPNS0_6vectorIXT_EEEPhPKh: 430| 112k| const uint8_t seed[32]) { 431| 112k| uint8_t input[33]; 432| 112k| OPENSSL_memcpy(input, seed, 32); 433| 450k| for (int i = 0; i < RANK; i++) { ------------------ | Branch (433:19): [True: 338k, False: 112k] ------------------ 434| 338k| input[32] = (*counter)++; 435| 338k| scalar_centered_binomial_distribution_eta_2_with_prf(&out->v[i], input); 436| 338k| } 437| 112k|} bcm.cc:_ZN5mlkem12_GLOBAL__N_152scalar_centered_binomial_distribution_eta_2_with_prfEPNS0_6scalarEPKh: 399| 338k| scalar *out, const uint8_t input[33]) { 400| 338k| uint8_t entropy[128]; 401| 338k| static_assert(sizeof(entropy) == 2 * /*kEta=*/2 * DEGREE / 8); 402| 338k| prf(entropy, sizeof(entropy), input); 403| | 404| 43.6M| for (int i = 0; i < DEGREE; i += 2) { ------------------ | | 70| 43.6M|#define DEGREE 256 ------------------ | Branch (404:19): [True: 43.2M, False: 338k] ------------------ 405| 43.2M| uint8_t byte = entropy[i / 2]; 406| | 407| 43.2M| uint16_t value = (byte & 1) + ((byte >> 1) & 1); 408| 43.2M| value -= ((byte >> 2) & 1) + ((byte >> 3) & 1); 409| | // Add |kPrime| if |value| underflowed. See |reduce_once| for a discussion 410| | // on why the value barrier is omitted. While this could have been written 411| | // reduce_once(value + kPrime), this is one extra addition and small range 412| | // of |value| tempts some versions of Clang to emit a branch. 413| 43.2M| uint16_t mask = 0u - (value >> 15); 414| 43.2M| out->c[i] = ((value + kPrime) & mask) | (value & ~mask); 415| | 416| 43.2M| byte >>= 4; 417| 43.2M| value = (byte & 1) + ((byte >> 1) & 1); 418| 43.2M| value -= ((byte >> 2) & 1) + ((byte >> 3) & 1); 419| | // See above. 420| 43.2M| mask = 0u - (value >> 15); 421| 43.2M| out->c[i + 1] = ((value + kPrime) & mask) | (value & ~mask); 422| 43.2M| } 423| 338k|} bcm.cc:_ZN5mlkem12_GLOBAL__N_13prfEPhmPKh: 45| 338k|static void prf(uint8_t *out, size_t out_len, const uint8_t in[33]) { 46| 338k| BORINGSSL_keccak(out, out_len, in, 33, boringssl_shake256); 47| 338k|} bcm.cc:_ZN5mlkem12_GLOBAL__N_110vector_nttILi3EEEvPNS0_6vectorIXT_EEE: 249| 112k|static void vector_ntt(vector *a) { 250| 450k| for (int i = 0; i < RANK; i++) { ------------------ | Branch (250:19): [True: 338k, False: 112k] ------------------ 251| 338k| scalar_ntt(&a->v[i]); 252| 338k| } 253| 112k|} bcm.cc:_ZN5mlkem12_GLOBAL__N_110scalar_nttEPNS0_6scalarE: 228| 338k|static void scalar_ntt(scalar *s) { 229| 338k| int offset = DEGREE; ------------------ | | 70| 338k|#define DEGREE 256 ------------------ 230| | // `int` is used here because using `size_t` throughout caused a ~5% slowdown 231| | // with Clang 14 on Aarch64. 232| 2.70M| for (int step = 1; step < DEGREE / 2; step <<= 1) { ------------------ | | 70| 2.70M|#define DEGREE 256 ------------------ | Branch (232:22): [True: 2.36M, False: 338k] ------------------ 233| 2.36M| offset >>= 1; 234| 2.36M| int k = 0; 235| 45.2M| for (int i = 0; i < step; i++) { ------------------ | Branch (235:21): [True: 42.9M, False: 2.36M] ------------------ 236| 42.9M| const uint32_t step_root = kNTTRoots[i + step]; 237| 345M| for (int j = k; j < k + offset; j++) { ------------------ | Branch (237:23): [True: 302M, False: 42.9M] ------------------ 238| 302M| uint16_t odd = reduce(step_root * s->c[j + offset]); 239| 302M| uint16_t even = s->c[j]; 240| 302M| s->c[j] = reduce_once(odd + even); 241| 302M| s->c[j + offset] = reduce_once(even - odd + kPrime); 242| 302M| } 243| 42.9M| k += 2 * offset; 244| 42.9M| } 245| 2.36M| } 246| 338k|} bcm.cc:_ZN5mlkem12_GLOBAL__N_16reduceEj: 207| 497M|static uint16_t reduce(uint32_t x) { 208| 497M| declassify_assert(x < kPrime + 2u * kPrime * kPrime); ------------------ | | 493| 497M|#define declassify_assert(expr) assert(constant_time_declassify_int(expr)) ------------------ 209| 497M| uint64_t product = (uint64_t)x * kBarrettMultiplier; 210| 497M| uint32_t quotient = (uint32_t)(product >> kBarrettShift); 211| 497M| uint32_t remainder = x - quotient * kPrime; 212| 497M| return reduce_once(remainder); 213| 497M|} bcm.cc:_ZN5mlkem12_GLOBAL__N_111reduce_onceEt: 189| 1.27G|uint16_t reduce_once(uint16_t x) { 190| 1.27G| declassify_assert(x < 2 * kPrime); ------------------ | | 493| 1.27G|#define declassify_assert(expr) assert(constant_time_declassify_int(expr)) ------------------ 191| 1.27G| const uint16_t subtracted = x - kPrime; 192| 1.27G| uint16_t mask = 0u - (subtracted >> 15); 193| | // Although this is a constant-time select, we omit a value barrier here. 194| | // Value barriers impede auto-vectorization (likely because it forces the 195| | // value to transit through a general-purpose register). On AArch64, this is a 196| | // difference of 2x. 197| | // 198| | // We usually add value barriers to selects because Clang turns consecutive 199| | // selects with the same condition into a branch instead of CMOV/CSEL. This 200| | // condition does not occur in ML-KEM, so omitting it seems to be safe so far, 201| | // but see |scalar_centered_binomial_distribution_eta_2_with_prf|. 202| 1.27G| return (mask & x) | (~mask & subtracted); 203| 1.27G|} bcm.cc:_ZN5mlkem12_GLOBAL__N_121matrix_mult_transposeILi3EEEvPNS0_6vectorIXT_EEEPKNS0_6matrixIXT_EEEPKS3_: 344| 56.3k| const vector *a) { 345| 56.3k| vector_zero(out); 346| 225k| for (int i = 0; i < RANK; i++) { ------------------ | Branch (346:19): [True: 169k, False: 56.3k] ------------------ 347| 676k| for (int j = 0; j < RANK; j++) { ------------------ | Branch (347:21): [True: 507k, False: 169k] ------------------ 348| 507k| scalar product; 349| 507k| scalar_mult(&product, &m->v[j][i], &a->v[j]); 350| 507k| scalar_add(&out->v[i], &product); 351| 507k| } 352| 169k| } 353| 56.3k|} bcm.cc:_ZN5mlkem12_GLOBAL__N_111vector_zeroILi3EEEvPNS0_6vectorIXT_EEE: 218| 56.3k|void vector_zero(vector *out) { 219| 56.3k| OPENSSL_memset(out->v, 0, sizeof(scalar) * RANK); 220| 56.3k|} bcm.cc:_ZN5mlkem12_GLOBAL__N_111scalar_multEPNS0_6scalarEPKS1_S4_: 310| 507k|void scalar_mult(scalar *out, const scalar *lhs, const scalar *rhs) { 311| 65.4M| for (int i = 0; i < DEGREE / 2; i++) { ------------------ | | 70| 65.4M|#define DEGREE 256 ------------------ | Branch (311:19): [True: 64.8M, False: 507k] ------------------ 312| 64.8M| uint32_t real_real = (uint32_t)lhs->c[2 * i] * rhs->c[2 * i]; 313| 64.8M| uint32_t img_img = (uint32_t)lhs->c[2 * i + 1] * rhs->c[2 * i + 1]; 314| 64.8M| uint32_t real_img = (uint32_t)lhs->c[2 * i] * rhs->c[2 * i + 1]; 315| 64.8M| uint32_t img_real = (uint32_t)lhs->c[2 * i + 1] * rhs->c[2 * i]; 316| 64.8M| out->c[2 * i] = 317| 64.8M| reduce(real_real + (uint32_t)reduce(img_img) * kModRoots[i]); 318| 64.8M| out->c[2 * i + 1] = reduce(img_real + real_img); 319| 64.8M| } 320| 507k|} bcm.cc:_ZN5mlkem12_GLOBAL__N_110scalar_addEPNS0_6scalarEPKS1_: 290| 676k|void scalar_add(scalar *lhs, const scalar *rhs) { 291| 173M| for (int i = 0; i < DEGREE; i++) { ------------------ | | 70| 173M|#define DEGREE 256 ------------------ | Branch (291:19): [True: 173M, False: 676k] ------------------ 292| 173M| lhs->c[i] = reduce_once(lhs->c[i] + rhs->c[i]); 293| 173M| } 294| 676k|} bcm.cc:_ZN5mlkem12_GLOBAL__N_110vector_addILi3EEEvPNS0_6vectorIXT_EEEPKS3_: 323| 56.3k|void vector_add(vector *lhs, const vector *rhs) { 324| 225k| for (int i = 0; i < RANK; i++) { ------------------ | Branch (324:19): [True: 169k, False: 56.3k] ------------------ 325| 169k| scalar_add(&lhs->v[i], &rhs->v[i]); 326| 169k| } 327| 56.3k|} bcm.cc:_ZN5mlkem12_GLOBAL__N_123encoded_public_key_sizeEi: 92| 112k|constexpr size_t encoded_public_key_size(int rank) { 93| 112k| return encoded_vector_size(rank) + /*sizeof(rho)=*/32; 94| 112k|} bcm.cc:_ZN5mlkem12_GLOBAL__N_119encoded_vector_sizeEi: 88| 169k|constexpr size_t encoded_vector_size(int rank) { 89| 169k| return (kLog2Prime * DEGREE / 8) * static_cast(rank); ------------------ | | 70| 169k|#define DEGREE 256 ------------------ 90| 169k|} bcm.cc:_ZN5mlkem12_GLOBAL__N_16hash_hEPhPKhm: 50| 56.3k|void hash_h(uint8_t out[32], const uint8_t *in, size_t len) { 51| 56.3k| BORINGSSL_keccak(out, 32, in, len, boringssl_sha3_256); 52| 56.3k|} bcm.cc:_ZN5mlkem12_GLOBAL__N_113vector_encodeILi3EEEvPhPKNS0_6vectorIXT_EEEi: 509| 56.3k|void vector_encode(uint8_t *out, const vector *a, int bits) { 510| 225k| for (int i = 0; i < RANK; i++) { ------------------ | Branch (510:19): [True: 169k, False: 56.3k] ------------------ 511| 169k| scalar_encode(out + i * bits * DEGREE / 8, &a->v[i], bits); ------------------ | | 70| 169k|#define DEGREE 256 ------------------ 512| 169k| } 513| 56.3k|} bcm.cc:_ZN5mlkem12_GLOBAL__N_113scalar_encodeEPhPKNS0_6scalarEi: 458| 169k|void scalar_encode(uint8_t *out, const scalar *s, int bits) { 459| 169k| assert(bits <= (int)sizeof(*s->c) * 8 && bits != 1); 460| | 461| 169k| uint8_t out_byte = 0; 462| 169k| int out_byte_bits = 0; 463| | 464| 43.4M| for (int i = 0; i < DEGREE; i++) { ------------------ | | 70| 43.4M|#define DEGREE 256 ------------------ | Branch (464:19): [True: 43.2M, False: 169k] ------------------ 465| 43.2M| uint16_t element = s->c[i]; 466| 43.2M| int element_bits_done = 0; 467| | 468| 129M| while (element_bits_done < bits) { ------------------ | Branch (468:12): [True: 86.5M, False: 43.2M] ------------------ 469| 86.5M| int chunk_bits = bits - element_bits_done; 470| 86.5M| int out_bits_remaining = 8 - out_byte_bits; 471| 86.5M| if (chunk_bits >= out_bits_remaining) { ------------------ | Branch (471:11): [True: 64.8M, False: 21.6M] ------------------ 472| 64.8M| chunk_bits = out_bits_remaining; 473| 64.8M| out_byte |= (element & kMasks[chunk_bits - 1]) << out_byte_bits; 474| 64.8M| *out = out_byte; 475| 64.8M| out++; 476| 64.8M| out_byte_bits = 0; 477| 64.8M| out_byte = 0; 478| 64.8M| } else { 479| 21.6M| out_byte |= (element & kMasks[chunk_bits - 1]) << out_byte_bits; 480| 21.6M| out_byte_bits += chunk_bits; 481| 21.6M| } 482| | 483| 86.5M| element_bits_done += chunk_bits; 484| 86.5M| element >>= chunk_bits; 485| 86.5M| } 486| 43.2M| } 487| | 488| 169k| if (out_byte_bits > 0) { ------------------ | Branch (488:7): [True: 0, False: 169k] ------------------ 489| 0| *out = out_byte; 490| 0| } 491| 169k|} bcm.cc:_ZN5mlkem12_GLOBAL__N_132mlkem_generate_key_external_seedILi3EEEvPhPNS0_11private_keyIXT_EEEPKh: 739| 56.3k| const uint8_t seed[BCM_MLKEM_SEED_BYTES]) { 740| 56.3k| fips::ensure_keygen_self_test(); 741| 56.3k| mlkem_generate_key_external_seed_no_self_test(out_encoded_public_key, priv, 742| 56.3k| seed); 743| 56.3k|} bcm.cc:_ZN5mlkem12_GLOBAL__N_14fips23ensure_keygen_self_testEv: 1066| 56.3k|void ensure_keygen_self_test(void) {} bcm.cc:_ZN5mlkem12_GLOBAL__N_124mlkem_marshal_public_keyILi3EEE12bcm_status_tP6cbb_stPKNS0_10public_keyIXT_EEE: 686| 56.3k| const struct public_key *pub) { 687| 56.3k| uint8_t *vector_output; 688| 56.3k| if (!CBB_add_space(out, &vector_output, encoded_vector_size(RANK))) { ------------------ | Branch (688:7): [True: 0, False: 56.3k] ------------------ 689| 0| return bcm_status::failure; 690| 0| } 691| 56.3k| vector_encode(vector_output, &pub->t, kLog2Prime); 692| 56.3k| if (!CBB_add_bytes(out, pub->rho, sizeof(pub->rho))) { ------------------ | Branch (692:7): [True: 0, False: 56.3k] ------------------ 693| 0| return bcm_status::failure; 694| 0| } 695| 56.3k| return bcm_status::approved; 696| 56.3k|} CTR_DRBG_init: 50| 1| const uint8_t *personalization, size_t personalization_len) { 51| | // Section 10.2.1.3.1 52| 1| if (personalization_len > CTR_DRBG_ENTROPY_LEN) { ------------------ | | 36| 1|#define CTR_DRBG_ENTROPY_LEN 48 ------------------ | Branch (52:7): [True: 0, False: 1] ------------------ 53| 0| return 0; 54| 0| } 55| | 56| 1| uint8_t seed_material[CTR_DRBG_ENTROPY_LEN]; 57| 1| OPENSSL_memcpy(seed_material, entropy, CTR_DRBG_ENTROPY_LEN); ------------------ | | 36| 1|#define CTR_DRBG_ENTROPY_LEN 48 ------------------ 58| | 59| 1| for (size_t i = 0; i < personalization_len; i++) { ------------------ | Branch (59:22): [True: 0, False: 1] ------------------ 60| 0| seed_material[i] ^= personalization[i]; 61| 0| } 62| | 63| | // Section 10.2.1.2 64| | 65| | // kInitMask is the result of encrypting blocks with big-endian value 1, 2 66| | // and 3 with the all-zero AES-256 key. 67| 1| static const uint8_t kInitMask[CTR_DRBG_ENTROPY_LEN] = { 68| 1| 0x53, 0x0f, 0x8a, 0xfb, 0xc7, 0x45, 0x36, 0xb9, 0xa9, 0x63, 0xb4, 0xf1, 69| 1| 0xc4, 0xcb, 0x73, 0x8b, 0xce, 0xa7, 0x40, 0x3d, 0x4d, 0x60, 0x6b, 0x6e, 70| 1| 0x07, 0x4e, 0xc5, 0xd3, 0xba, 0xf3, 0x9d, 0x18, 0x72, 0x60, 0x03, 0xca, 71| 1| 0x37, 0xa6, 0x2a, 0x74, 0xd1, 0xa2, 0xf5, 0x8e, 0x75, 0x06, 0x35, 0x8e, 72| 1| }; 73| | 74| 49| for (size_t i = 0; i < sizeof(kInitMask); i++) { ------------------ | Branch (74:22): [True: 48, False: 1] ------------------ 75| 48| seed_material[i] ^= kInitMask[i]; 76| 48| } 77| | 78| 1| drbg->ctr = aes_ctr_set_key(&drbg->ks, NULL, &drbg->block, seed_material, 32); 79| 1| OPENSSL_memcpy(drbg->counter, seed_material + 32, 16); 80| 1| drbg->reseed_counter = 1; 81| | 82| 1| return 1; 83| 1|} CTR_DRBG_reseed: 123| 106| size_t additional_data_len) { 124| | // Section 10.2.1.4 125| 106| uint8_t entropy_copy[CTR_DRBG_ENTROPY_LEN]; 126| | 127| 106| if (additional_data_len > 0) { ------------------ | Branch (127:7): [True: 0, False: 106] ------------------ 128| 0| if (additional_data_len > CTR_DRBG_ENTROPY_LEN) { ------------------ | | 36| 0|#define CTR_DRBG_ENTROPY_LEN 48 ------------------ | Branch (128:9): [True: 0, False: 0] ------------------ 129| 0| return 0; 130| 0| } 131| | 132| 0| OPENSSL_memcpy(entropy_copy, entropy, CTR_DRBG_ENTROPY_LEN); ------------------ | | 36| 0|#define CTR_DRBG_ENTROPY_LEN 48 ------------------ 133| 0| for (size_t i = 0; i < additional_data_len; i++) { ------------------ | Branch (133:24): [True: 0, False: 0] ------------------ 134| 0| entropy_copy[i] ^= additional_data[i]; 135| 0| } 136| | 137| 0| entropy = entropy_copy; 138| 0| } 139| | 140| 106| if (!ctr_drbg_update(drbg, entropy, CTR_DRBG_ENTROPY_LEN)) { ------------------ | | 36| 106|#define CTR_DRBG_ENTROPY_LEN 48 ------------------ | Branch (140:7): [True: 0, False: 106] ------------------ 141| 0| return 0; 142| 0| } 143| | 144| 106| drbg->reseed_counter = 1; 145| | 146| 106| return 1; 147| 106|} CTR_DRBG_generate: 151| 437k| size_t additional_data_len) { 152| | // See 9.3.1 153| 437k| if (out_len > CTR_DRBG_MAX_GENERATE_LENGTH) { ------------------ | | 40| 437k|#define CTR_DRBG_MAX_GENERATE_LENGTH 65536 ------------------ | Branch (153:7): [True: 0, False: 437k] ------------------ 154| 0| return 0; 155| 0| } 156| | 157| | // See 10.2.1.5.1 158| 437k| if (drbg->reseed_counter > kMaxReseedCount) { ------------------ | Branch (158:7): [True: 0, False: 437k] ------------------ 159| 0| return 0; 160| 0| } 161| | 162| 437k| if (additional_data_len != 0 && ------------------ | Branch (162:7): [True: 437k, False: 0] ------------------ 163| 437k| !ctr_drbg_update(drbg, additional_data, additional_data_len)) { ------------------ | Branch (163:7): [True: 0, False: 437k] ------------------ 164| 0| return 0; 165| 0| } 166| | 167| | // kChunkSize is used to interact better with the cache. Since the AES-CTR 168| | // code assumes that it's encrypting rather than just writing keystream, the 169| | // buffer has to be zeroed first. Without chunking, large reads would zero 170| | // the whole buffer, flushing the L1 cache, and then do another pass (missing 171| | // the cache every time) to “encrypt” it. The code can avoid this by 172| | // chunking. 173| 437k| static const size_t kChunkSize = 8 * 1024; 174| | 175| 802k| while (out_len >= AES_BLOCK_SIZE) { ------------------ | | 34| 802k|#define AES_BLOCK_SIZE 16 ------------------ | Branch (175:10): [True: 364k, False: 437k] ------------------ 176| 364k| size_t todo = kChunkSize; 177| 364k| if (todo > out_len) { ------------------ | Branch (177:9): [True: 364k, False: 0] ------------------ 178| 364k| todo = out_len; 179| 364k| } 180| | 181| 364k| todo &= ~(AES_BLOCK_SIZE - 1); ------------------ | | 34| 364k|#define AES_BLOCK_SIZE 16 ------------------ 182| 364k| const size_t num_blocks = todo / AES_BLOCK_SIZE; ------------------ | | 34| 364k|#define AES_BLOCK_SIZE 16 ------------------ 183| | 184| 364k| OPENSSL_memset(out, 0, todo); 185| 364k| ctr32_add(drbg, 1); 186| 364k| drbg->ctr(out, out, num_blocks, &drbg->ks, drbg->counter); 187| 364k| ctr32_add(drbg, (uint32_t)(num_blocks - 1)); 188| | 189| 364k| out += todo; 190| 364k| out_len -= todo; 191| 364k| } 192| | 193| 437k| if (out_len > 0) { ------------------ | Branch (193:7): [True: 75.8k, False: 361k] ------------------ 194| 75.8k| uint8_t block[AES_BLOCK_SIZE]; 195| 75.8k| ctr32_add(drbg, 1); 196| 75.8k| drbg->block(drbg->counter, block, &drbg->ks); 197| | 198| 75.8k| OPENSSL_memcpy(out, block, out_len); 199| 75.8k| } 200| | 201| | // Right-padding |additional_data| in step 2.2 is handled implicitly by 202| | // |ctr_drbg_update|, to save a copy. 203| 437k| if (!ctr_drbg_update(drbg, additional_data, additional_data_len)) { ------------------ | Branch (203:7): [True: 0, False: 437k] ------------------ 204| 0| return 0; 205| 0| } 206| | 207| 437k| drbg->reseed_counter++; 208| 437k| FIPS_service_indicator_update_state(); 209| 437k| return 1; 210| 437k|} bcm.cc:_ZL15ctr_drbg_updateP17ctr_drbg_state_stPKhm: 96| 874k| size_t data_len) { 97| | // Per section 10.2.1.2, |data_len| must be |CTR_DRBG_ENTROPY_LEN|. Here, we 98| | // allow shorter inputs and right-pad them with zeros. This is equivalent to 99| | // the specified algorithm but saves a copy in |CTR_DRBG_generate|. 100| 874k| if (data_len > CTR_DRBG_ENTROPY_LEN) { ------------------ | | 36| 874k|#define CTR_DRBG_ENTROPY_LEN 48 ------------------ | Branch (100:7): [True: 0, False: 874k] ------------------ 101| 0| return 0; 102| 0| } 103| | 104| 874k| uint8_t temp[CTR_DRBG_ENTROPY_LEN]; 105| 3.49M| for (size_t i = 0; i < CTR_DRBG_ENTROPY_LEN; i += AES_BLOCK_SIZE) { ------------------ | | 36| 3.49M|#define CTR_DRBG_ENTROPY_LEN 48 ------------------ for (size_t i = 0; i < CTR_DRBG_ENTROPY_LEN; i += AES_BLOCK_SIZE) { ------------------ | | 34| 2.62M|#define AES_BLOCK_SIZE 16 ------------------ | Branch (105:22): [True: 2.62M, False: 874k] ------------------ 106| 2.62M| ctr32_add(drbg, 1); 107| 2.62M| drbg->block(drbg->counter, temp + i, &drbg->ks); 108| 2.62M| } 109| | 110| 28.8M| for (size_t i = 0; i < data_len; i++) { ------------------ | Branch (110:22): [True: 27.9M, False: 874k] ------------------ 111| 27.9M| temp[i] ^= data[i]; 112| 27.9M| } 113| | 114| 874k| drbg->ctr = aes_ctr_set_key(&drbg->ks, NULL, &drbg->block, temp, 32); 115| 874k| OPENSSL_memcpy(drbg->counter, temp + 32, 16); 116| | 117| 874k| return 1; 118| 874k|} bcm.cc:_ZL9ctr32_addP17ctr_drbg_state_stj: 90| 3.42M|static void ctr32_add(CTR_DRBG_STATE *drbg, uint32_t n) { 91| 3.42M| uint32_t ctr = CRYPTO_load_u32_be(drbg->counter + 12); 92| 3.42M| CRYPTO_store_u32_be(drbg->counter + 12, ctr + n); 93| 3.42M|} have_fast_rdrand: 58| 437k|inline int have_fast_rdrand(void) { 59| 437k| return CRYPTO_is_RDRAND_capable() && CRYPTO_is_intel_cpu(); ------------------ | Branch (59:10): [True: 437k, False: 0] | Branch (59:40): [True: 0, False: 437k] ------------------ 60| 437k|} BCM_rand_bytes_with_additional_data: 333| 437k| uint8_t *out, size_t out_len, const uint8_t user_additional_data[32]) { 334| 437k| if (out_len == 0) { ------------------ | Branch (334:7): [True: 0, False: 437k] ------------------ 335| 0| return bcm_infallible::approved; 336| 0| } 337| | 338| 437k| const uint64_t fork_generation = CRYPTO_get_fork_generation(); 339| 437k| const int fork_unsafe_buffering = rand_fork_unsafe_buffering_enabled(); 340| | 341| | // Additional data is mixed into every CTR-DRBG call to protect, as best we 342| | // can, against forks & VM clones. We do not over-read this information and 343| | // don't reseed with it so, from the point of view of FIPS, this doesn't 344| | // provide “prediction resistance”. But, in practice, it does. 345| 437k| uint8_t additional_data[32]; 346| | // Intel chips have fast RDRAND instructions while, in other cases, RDRAND can 347| | // be _slower_ than a system call. 348| 437k| if (!have_fast_rdrand() || ------------------ | Branch (348:7): [True: 437k, False: 0] ------------------ 349| 437k| !rdrand(additional_data, sizeof(additional_data))) { ------------------ | Branch (349:7): [True: 0, False: 0] ------------------ 350| | // Without a hardware RNG to save us from address-space duplication, the OS 351| | // entropy is used. This can be expensive (one read per |RAND_bytes| call) 352| | // and so is disabled when we have fork detection, or if the application has 353| | // promised not to fork. 354| 437k| if (fork_generation != 0 || fork_unsafe_buffering) { ------------------ | Branch (354:9): [True: 437k, False: 0] | Branch (354:33): [True: 0, False: 0] ------------------ 355| 437k| OPENSSL_memset(additional_data, 0, sizeof(additional_data)); 356| 437k| } else if (!have_rdrand()) { ------------------ | Branch (356:16): [True: 0, False: 0] ------------------ 357| | // No alternative so block for OS entropy. 358| 0| CRYPTO_sysrand(additional_data, sizeof(additional_data)); 359| 0| } else if (!CRYPTO_sysrand_if_available(additional_data, ------------------ | Branch (359:16): [True: 0, False: 0] ------------------ 360| 0| sizeof(additional_data)) && 361| 0| !rdrand(additional_data, sizeof(additional_data))) { ------------------ | Branch (361:16): [True: 0, False: 0] ------------------ 362| | // RDRAND failed: block for OS entropy. 363| 0| CRYPTO_sysrand(additional_data, sizeof(additional_data)); 364| 0| } 365| 437k| } 366| | 367| 14.4M| for (size_t i = 0; i < sizeof(additional_data); i++) { ------------------ | Branch (367:22): [True: 13.9M, False: 437k] ------------------ 368| 13.9M| additional_data[i] ^= user_additional_data[i]; 369| 13.9M| } 370| | 371| 437k| struct rand_thread_state stack_state; 372| 437k| struct rand_thread_state *state = reinterpret_cast( 373| 437k| CRYPTO_get_thread_local(OPENSSL_THREAD_LOCAL_RAND)); 374| | 375| 437k| if (state == NULL) { ------------------ | Branch (375:7): [True: 1, False: 437k] ------------------ 376| 1| state = reinterpret_cast( 377| 1| OPENSSL_zalloc(sizeof(struct rand_thread_state))); 378| 1| if (state == NULL || ------------------ | Branch (378:9): [True: 0, False: 1] ------------------ 379| 1| !CRYPTO_set_thread_local(OPENSSL_THREAD_LOCAL_RAND, state, ------------------ | Branch (379:9): [True: 0, False: 1] ------------------ 380| 1| rand_thread_state_free)) { 381| | // If the system is out of memory, use an ephemeral state on the 382| | // stack. 383| 0| state = &stack_state; 384| 0| } 385| | 386| 1| state->last_block_valid = 0; 387| 1| uint8_t seed[CTR_DRBG_ENTROPY_LEN]; 388| 1| uint8_t personalization[CTR_DRBG_ENTROPY_LEN] = {0}; 389| 1| size_t personalization_len = 0; 390| 1| rand_get_seed(state, seed, personalization, &personalization_len); 391| | 392| 1| if (!CTR_DRBG_init(&state->drbg, seed, personalization, ------------------ | Branch (392:9): [True: 0, False: 1] ------------------ 393| 1| personalization_len)) { 394| 0| abort(); 395| 0| } 396| 1| state->calls = 0; 397| 1| state->fork_generation = fork_generation; 398| 1| state->fork_unsafe_buffering = fork_unsafe_buffering; 399| | 400| |#if defined(BORINGSSL_FIPS) 401| | CRYPTO_MUTEX_init(&state->clear_drbg_lock); 402| | if (state != &stack_state) { 403| | CRYPTO_MUTEX_lock_write(thread_states_list_lock_bss_get()); 404| | struct rand_thread_state **states_list = thread_states_list_bss_get(); 405| | state->next = *states_list; 406| | if (state->next != NULL) { 407| | state->next->prev = state; 408| | } 409| | state->prev = NULL; 410| | *states_list = state; 411| | CRYPTO_MUTEX_unlock_write(thread_states_list_lock_bss_get()); 412| | } 413| |#endif 414| 1| } 415| | 416| 437k| if (state->calls >= kReseedInterval || ------------------ | Branch (416:7): [True: 106, False: 437k] ------------------ 417| | // If we've forked since |state| was last seeded, reseed. 418| 437k| state->fork_generation != fork_generation || ------------------ | Branch (418:7): [True: 0, False: 437k] ------------------ 419| | // If |state| was seeded from a state with different fork-safety 420| | // preferences, reseed. Suppose |state| was fork-safe, then forked into 421| | // two children, but each of the children never fork and disable fork 422| | // safety. The children must reseed to avoid working from the same PRNG 423| | // state. 424| 437k| state->fork_unsafe_buffering != fork_unsafe_buffering) { ------------------ | Branch (424:7): [True: 0, False: 437k] ------------------ 425| 106| uint8_t seed[CTR_DRBG_ENTROPY_LEN]; 426| 106| uint8_t reseed_additional_data[CTR_DRBG_ENTROPY_LEN] = {0}; 427| 106| size_t reseed_additional_data_len = 0; 428| 106| rand_get_seed(state, seed, reseed_additional_data, 429| 106| &reseed_additional_data_len); 430| |#if defined(BORINGSSL_FIPS) 431| | // Take a read lock around accesses to |state->drbg|. This is needed to 432| | // avoid returning bad entropy if we race with 433| | // |rand_thread_state_clear_all|. 434| | CRYPTO_MUTEX_lock_read(&state->clear_drbg_lock); 435| |#endif 436| 106| if (!CTR_DRBG_reseed(&state->drbg, seed, reseed_additional_data, ------------------ | Branch (436:9): [True: 0, False: 106] ------------------ 437| 106| reseed_additional_data_len)) { 438| 0| abort(); 439| 0| } 440| 106| state->calls = 0; 441| 106| state->fork_generation = fork_generation; 442| 106| state->fork_unsafe_buffering = fork_unsafe_buffering; 443| 437k| } else { 444| |#if defined(BORINGSSL_FIPS) 445| | CRYPTO_MUTEX_lock_read(&state->clear_drbg_lock); 446| |#endif 447| 437k| } 448| | 449| 437k| int first_call = 1; 450| 874k| while (out_len > 0) { ------------------ | Branch (450:10): [True: 437k, False: 437k] ------------------ 451| 437k| size_t todo = out_len; 452| 437k| if (todo > CTR_DRBG_MAX_GENERATE_LENGTH) { ------------------ | | 40| 437k|#define CTR_DRBG_MAX_GENERATE_LENGTH 65536 ------------------ | Branch (452:9): [True: 0, False: 437k] ------------------ 453| 0| todo = CTR_DRBG_MAX_GENERATE_LENGTH; ------------------ | | 40| 0|#define CTR_DRBG_MAX_GENERATE_LENGTH 65536 ------------------ 454| 0| } 455| | 456| 437k| if (!CTR_DRBG_generate(&state->drbg, out, todo, additional_data, ------------------ | Branch (456:9): [True: 0, False: 437k] ------------------ 457| 437k| first_call ? sizeof(additional_data) : 0)) { ------------------ | Branch (457:28): [True: 437k, False: 0] ------------------ 458| 0| abort(); 459| 0| } 460| | 461| 437k| out += todo; 462| 437k| out_len -= todo; 463| | // Though we only check before entering the loop, this cannot add enough to 464| | // overflow a |size_t|. 465| 437k| state->calls++; 466| 437k| first_call = 0; 467| 437k| } 468| | 469| 437k| if (state == &stack_state) { ------------------ | Branch (469:7): [True: 0, False: 437k] ------------------ 470| 0| CTR_DRBG_clear(&state->drbg); 471| 0| } 472| | 473| |#if defined(BORINGSSL_FIPS) 474| | CRYPTO_MUTEX_unlock_read(&state->clear_drbg_lock); 475| |#endif 476| 437k| return bcm_infallible::approved; 477| 437k|} BCM_rand_bytes: 479| 405k|bcm_infallible BCM_rand_bytes(uint8_t *out, size_t out_len) { 480| 405k| static const uint8_t kZeroAdditionalData[32] = {0}; 481| 405k| BCM_rand_bytes_with_additional_data(out, out_len, kZeroAdditionalData); 482| 405k| return bcm_infallible::approved; 483| 405k|} bcm.cc:_ZL13rand_get_seedPN12_GLOBAL__N_117rand_thread_stateEPhS2_Pm: 323| 107| size_t *out_additional_input_len) { 324| | // If not in FIPS mode, we don't overread from the system entropy source and 325| | // we don't depend only on the hardware RDRAND. 326| 107| CRYPTO_sysrand_for_seed(seed, CTR_DRBG_ENTROPY_LEN); ------------------ | | 36| 107|#define CTR_DRBG_ENTROPY_LEN 48 ------------------ 327| 107| *out_additional_input_len = 0; 328| 107|} BN_BLINDING_new: 38| 1|BN_BLINDING *BN_BLINDING_new(void) { 39| 1| BN_BLINDING *ret = 40| 1| reinterpret_cast(OPENSSL_zalloc(sizeof(BN_BLINDING))); 41| 1| if (ret == NULL) { ------------------ | Branch (41:7): [True: 0, False: 1] ------------------ 42| 0| return NULL; 43| 0| } 44| | 45| 1| ret->A = BN_new(); 46| 1| if (ret->A == NULL) { ------------------ | Branch (46:7): [True: 0, False: 1] ------------------ 47| 0| goto err; 48| 0| } 49| | 50| 1| ret->Ai = BN_new(); 51| 1| if (ret->Ai == NULL) { ------------------ | Branch (51:7): [True: 0, False: 1] ------------------ 52| 0| goto err; 53| 0| } 54| | 55| | // The blinding values need to be created before this blinding can be used. 56| 1| ret->counter = BN_BLINDING_COUNTER - 1; ------------------ | | 27| 1|#define BN_BLINDING_COUNTER 32 ------------------ 57| | 58| 1| return ret; 59| | 60| 0|err: 61| 0| BN_BLINDING_free(ret); 62| 0| return NULL; 63| 1|} BN_BLINDING_convert: 106| 28.0k| const BN_MONT_CTX *mont, BN_CTX *ctx) { 107| | // |n| is not Montgomery-encoded and |b->A| is. |BN_mod_mul_montgomery| 108| | // cancels one Montgomery factor, so the resulting value of |n| is unencoded. 109| 28.0k| if (!bn_blinding_update(b, e, mont, ctx) || ------------------ | Branch (109:7): [True: 0, False: 28.0k] ------------------ 110| 28.0k| !BN_mod_mul_montgomery(n, n, b->A, mont, ctx)) { ------------------ | Branch (110:7): [True: 0, False: 28.0k] ------------------ 111| 0| return 0; 112| 0| } 113| | 114| 28.0k| return 1; 115| 28.0k|} BN_BLINDING_invert: 118| 28.0k| BN_CTX *ctx) { 119| | // |n| is not Montgomery-encoded and |b->A| is. |BN_mod_mul_montgomery| 120| | // cancels one Montgomery factor, so the resulting value of |n| is unencoded. 121| 28.0k| return BN_mod_mul_montgomery(n, n, b->Ai, mont, ctx); 122| 28.0k|} bcm.cc:_ZL18bn_blinding_updateP14bn_blinding_stPK9bignum_stPK14bn_mont_ctx_stP10bignum_ctx: 79| 28.0k| const BN_MONT_CTX *mont, BN_CTX *ctx) { 80| 28.0k| if (++b->counter == BN_BLINDING_COUNTER) { ------------------ | | 27| 28.0k|#define BN_BLINDING_COUNTER 32 ------------------ | Branch (80:7): [True: 876, False: 27.1k] ------------------ 81| | // re-create blinding parameters 82| 876| if (!bn_blinding_create_param(b, e, mont, ctx)) { ------------------ | Branch (82:9): [True: 0, False: 876] ------------------ 83| 0| goto err; 84| 0| } 85| 876| b->counter = 0; 86| 27.1k| } else { 87| 27.1k| if (!BN_mod_mul_montgomery(b->A, b->A, b->A, mont, ctx) || ------------------ | Branch (87:9): [True: 0, False: 27.1k] ------------------ 88| 27.1k| !BN_mod_mul_montgomery(b->Ai, b->Ai, b->Ai, mont, ctx)) { ------------------ | Branch (88:9): [True: 0, False: 27.1k] ------------------ 89| 0| goto err; 90| 0| } 91| 27.1k| } 92| | 93| 28.0k| return 1; 94| | 95| 0|err: 96| | // |A| and |Ai| may be in an inconsistent state so they both need to be 97| | // replaced the next time this blinding is used. Note that this is only 98| | // sufficient because support for |BN_BLINDING_NO_UPDATE| and 99| | // |BN_BLINDING_NO_RECREATE| was previously dropped. 100| 0| b->counter = BN_BLINDING_COUNTER - 1; ------------------ | | 27| 0|#define BN_BLINDING_COUNTER 32 ------------------ 101| | 102| 0| return 0; 103| 28.0k|} bcm.cc:_ZL24bn_blinding_create_paramP14bn_blinding_stPK9bignum_stPK14bn_mont_ctx_stP10bignum_ctx: 125| 876| const BN_MONT_CTX *mont, BN_CTX *ctx) { 126| 876| int no_inverse; 127| 876| if (!BN_rand_range_ex(b->A, 1, &mont->N) || ------------------ | Branch (127:7): [True: 0, False: 876] ------------------ 128| | // Compute |b->A|^-1 in Montgomery form. Note |BN_from_montgomery| + 129| | // |BN_mod_inverse_blinded| is equivalent to, but more efficient than, 130| | // |BN_mod_inverse_blinded| + |BN_to_montgomery|. 131| | // 132| | // We do not retry if |b->A| has no inverse. Finding a non-invertible 133| | // value of |b->A| is equivalent to factoring |mont->N|. There is 134| | // negligible probability of stumbling on one at random. 135| 876| !BN_from_montgomery(b->Ai, b->A, mont, ctx) || ------------------ | Branch (135:7): [True: 0, False: 876] ------------------ 136| 876| !BN_mod_inverse_blinded(b->Ai, &no_inverse, b->Ai, mont, ctx) || ------------------ | Branch (136:7): [True: 0, False: 876] ------------------ 137| | // TODO(davidben): |BN_mod_exp_mont| internally computes the result in 138| | // Montgomery form. Save a pair of Montgomery reductions and a 139| | // multiplication by returning that value directly. 140| 876| !BN_mod_exp_mont(b->A, b->A, e, &mont->N, ctx, mont) || ------------------ | Branch (140:7): [True: 0, False: 876] ------------------ 141| 876| !BN_to_montgomery(b->A, b->A, mont, ctx)) { ------------------ | Branch (141:7): [True: 0, False: 876] ------------------ 142| 0| OPENSSL_PUT_ERROR(RSA, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 143| 0| return 0; 144| 0| } 145| | 146| 876| return 1; 147| 876|} RSA_padding_add_PKCS1_type_1: 33| 379| const uint8_t *from, size_t from_len) { 34| | // See RFC 8017, section 9.2. 35| 379| if (to_len < RSA_PKCS1_PADDING_SIZE) { ------------------ | | 84| 379|#define RSA_PKCS1_PADDING_SIZE 11 ------------------ | Branch (35:7): [True: 0, False: 379] ------------------ 36| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_KEY_SIZE_TOO_SMALL); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 37| 0| return 0; 38| 0| } 39| | 40| 379| if (from_len > to_len - RSA_PKCS1_PADDING_SIZE) { ------------------ | | 84| 379|#define RSA_PKCS1_PADDING_SIZE 11 ------------------ | Branch (40:7): [True: 0, False: 379] ------------------ 41| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_DIGEST_TOO_BIG_FOR_RSA_KEY); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 42| 0| return 0; 43| 0| } 44| | 45| 379| to[0] = 0; 46| 379| to[1] = 1; 47| 379| OPENSSL_memset(to + 2, 0xff, to_len - 3 - from_len); 48| 379| to[to_len - from_len - 1] = 0; 49| 379| OPENSSL_memcpy(to + to_len - from_len, from, from_len); 50| 379| return 1; 51| 379|} RSA_padding_check_PKCS1_type_1: 55| 6.14k| size_t from_len) { 56| | // See RFC 8017, section 9.2. This is part of signature verification and thus 57| | // does not need to run in constant-time. 58| 6.14k| if (from_len < 2) { ------------------ | Branch (58:7): [True: 0, False: 6.14k] ------------------ 59| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_DATA_TOO_SMALL); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 60| 0| return 0; 61| 0| } 62| | 63| | // Check the header. 64| 6.14k| if (from[0] != 0 || from[1] != 1) { ------------------ | Branch (64:7): [True: 2.29k, False: 3.84k] | Branch (64:23): [True: 68, False: 3.77k] ------------------ 65| 2.36k| OPENSSL_PUT_ERROR(RSA, RSA_R_BLOCK_TYPE_IS_NOT_01); ------------------ | | 361| 2.36k| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 66| 2.36k| return 0; 67| 2.36k| } 68| | 69| | // Scan over padded data, looking for the 00. 70| 3.77k| size_t pad; 71| 294k| for (pad = 2 /* header */; pad < from_len; pad++) { ------------------ | Branch (71:30): [True: 294k, False: 0] ------------------ 72| 294k| if (from[pad] == 0x00) { ------------------ | Branch (72:9): [True: 3.74k, False: 291k] ------------------ 73| 3.74k| break; 74| 3.74k| } 75| | 76| 291k| if (from[pad] != 0xff) { ------------------ | Branch (76:9): [True: 27, False: 290k] ------------------ 77| 27| OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_FIXED_HEADER_DECRYPT); ------------------ | | 361| 27| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 78| 27| return 0; 79| 27| } 80| 291k| } 81| | 82| 3.74k| if (pad == from_len) { ------------------ | Branch (82:7): [True: 0, False: 3.74k] ------------------ 83| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_NULL_BEFORE_BLOCK_MISSING); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 84| 0| return 0; 85| 0| } 86| | 87| 3.74k| if (pad < 2 /* header */ + 8) { ------------------ | Branch (87:7): [True: 1, False: 3.74k] ------------------ 88| 1| OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_PAD_BYTE_COUNT); ------------------ | | 361| 1| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 89| 1| return 0; 90| 1| } 91| | 92| | // Skip over the 00. 93| 3.74k| pad++; 94| | 95| 3.74k| if (from_len - pad > max_out) { ------------------ | Branch (95:7): [True: 0, False: 3.74k] ------------------ 96| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_DATA_TOO_LARGE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 97| 0| return 0; 98| 0| } 99| | 100| 3.74k| OPENSSL_memcpy(out, from + pad, from_len - pad); 101| 3.74k| *out_len = from_len - pad; 102| 3.74k| return 1; 103| 3.74k|} RSA_padding_add_none: 106| 27.6k| size_t from_len) { 107| 27.6k| if (from_len > to_len) { ------------------ | Branch (107:7): [True: 0, False: 27.6k] ------------------ 108| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 109| 0| return 0; 110| 0| } 111| | 112| 27.6k| if (from_len < to_len) { ------------------ | Branch (112:7): [True: 0, False: 27.6k] ------------------ 113| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_DATA_TOO_SMALL); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 114| 0| return 0; 115| 0| } 116| | 117| 27.6k| OPENSSL_memcpy(to, from, from_len); 118| 27.6k| return 1; 119| 27.6k|} PKCS1_MGF1: 122| 28.3k| const EVP_MD *md) { 123| 28.3k| int ret = 0; 124| 28.3k| bssl::ScopedEVP_MD_CTX ctx; 125| 28.3k| FIPS_service_indicator_lock_state(); 126| | 127| 28.3k| size_t md_len = EVP_MD_size(md); 128| | 129| 169k| for (uint32_t i = 0; len > 0; i++) { ------------------ | Branch (129:24): [True: 141k, False: 28.3k] ------------------ 130| 141k| uint8_t counter[4]; 131| 141k| counter[0] = (uint8_t)(i >> 24); 132| 141k| counter[1] = (uint8_t)(i >> 16); 133| 141k| counter[2] = (uint8_t)(i >> 8); 134| 141k| counter[3] = (uint8_t)i; 135| 141k| if (!EVP_DigestInit_ex(ctx.get(), md, nullptr) || ------------------ | Branch (135:9): [True: 0, False: 141k] ------------------ 136| 141k| !EVP_DigestUpdate(ctx.get(), seed, seed_len) || ------------------ | Branch (136:9): [True: 0, False: 141k] ------------------ 137| 141k| !EVP_DigestUpdate(ctx.get(), counter, sizeof(counter))) { ------------------ | Branch (137:9): [True: 0, False: 141k] ------------------ 138| 0| goto err; 139| 0| } 140| | 141| 141k| if (md_len <= len) { ------------------ | Branch (141:9): [True: 113k, False: 28.3k] ------------------ 142| 113k| if (!EVP_DigestFinal_ex(ctx.get(), out, nullptr)) { ------------------ | Branch (142:11): [True: 0, False: 113k] ------------------ 143| 0| goto err; 144| 0| } 145| 113k| out += md_len; 146| 113k| len -= md_len; 147| 113k| } else { 148| 28.3k| uint8_t digest[EVP_MAX_MD_SIZE]; 149| 28.3k| if (!EVP_DigestFinal_ex(ctx.get(), digest, nullptr)) { ------------------ | Branch (149:11): [True: 0, False: 28.3k] ------------------ 150| 0| goto err; 151| 0| } 152| 28.3k| OPENSSL_memcpy(out, digest, len); 153| 28.3k| len = 0; 154| 28.3k| } 155| 141k| } 156| | 157| 28.3k| ret = 1; 158| | 159| 28.3k|err: 160| 28.3k| FIPS_service_indicator_unlock_state(); 161| 28.3k| return ret; 162| 28.3k|} RSA_verify_PKCS1_PSS_mgf1: 168| 1.50k| const uint8_t *EM, int sLen) { 169| 1.50k| if (mgf1Hash == NULL) { ------------------ | Branch (169:7): [True: 1.50k, False: 0] ------------------ 170| 1.50k| mgf1Hash = Hash; 171| 1.50k| } 172| | 173| 1.50k| int ret = 0; 174| 1.50k| uint8_t *DB = NULL; 175| 1.50k| const uint8_t *H; 176| 1.50k| bssl::ScopedEVP_MD_CTX ctx; 177| 1.50k| unsigned MSBits; 178| 1.50k| size_t emLen, maskedDBLen, salt_start; 179| 1.50k| FIPS_service_indicator_lock_state(); 180| | 181| | // Negative sLen has special meanings: 182| | // -1 sLen == hLen 183| | // -2 salt length is autorecovered from signature 184| | // -N reserved 185| 1.50k| size_t hLen = EVP_MD_size(Hash); 186| 1.50k| if (sLen == -1) { ------------------ | Branch (186:7): [True: 1.50k, False: 0] ------------------ 187| 1.50k| sLen = (int)hLen; 188| 1.50k| } else if (sLen == -2) { ------------------ | Branch (188:14): [True: 0, False: 0] ------------------ 189| 0| sLen = -2; 190| 0| } else if (sLen < -2) { ------------------ | Branch (190:14): [True: 0, False: 0] ------------------ 191| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_SLEN_CHECK_FAILED); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 192| 0| goto err; 193| 0| } 194| | 195| 1.50k| MSBits = (BN_num_bits(rsa->n) - 1) & 0x7; 196| 1.50k| emLen = RSA_size(rsa); 197| 1.50k| if (EM[0] & (0xFF << MSBits)) { ------------------ | Branch (197:7): [True: 350, False: 1.15k] ------------------ 198| 350| OPENSSL_PUT_ERROR(RSA, RSA_R_FIRST_OCTET_INVALID); ------------------ | | 361| 350| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 199| 350| goto err; 200| 350| } 201| 1.15k| if (MSBits == 0) { ------------------ | Branch (201:7): [True: 0, False: 1.15k] ------------------ 202| 0| EM++; 203| 0| emLen--; 204| 0| } 205| | // |sLen| may be -2 for the non-standard salt length recovery mode. 206| 1.15k| if (emLen < hLen + 2 || (sLen >= 0 && emLen < hLen + (size_t)sLen + 2)) { ------------------ | Branch (206:7): [True: 0, False: 1.15k] | Branch (206:28): [True: 1.15k, False: 0] | Branch (206:41): [True: 0, False: 1.15k] ------------------ 207| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_DATA_TOO_LARGE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 208| 0| goto err; 209| 0| } 210| 1.15k| if (EM[emLen - 1] != 0xbc) { ------------------ | Branch (210:7): [True: 500, False: 659] ------------------ 211| 500| OPENSSL_PUT_ERROR(RSA, RSA_R_LAST_OCTET_INVALID); ------------------ | | 361| 500| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 212| 500| goto err; 213| 500| } 214| 659| maskedDBLen = emLen - hLen - 1; 215| 659| H = EM + maskedDBLen; 216| 659| DB = reinterpret_cast(OPENSSL_malloc(maskedDBLen)); 217| 659| if (!DB) { ------------------ | Branch (217:7): [True: 0, False: 659] ------------------ 218| 0| goto err; 219| 0| } 220| 659| if (!PKCS1_MGF1(DB, maskedDBLen, H, hLen, mgf1Hash)) { ------------------ | Branch (220:7): [True: 0, False: 659] ------------------ 221| 0| goto err; 222| 0| } 223| 140k| for (size_t i = 0; i < maskedDBLen; i++) { ------------------ | Branch (223:22): [True: 139k, False: 659] ------------------ 224| 139k| DB[i] ^= EM[i]; 225| 139k| } 226| 659| if (MSBits) { ------------------ | Branch (226:7): [True: 659, False: 0] ------------------ 227| 659| DB[0] &= 0xFF >> (8 - MSBits); 228| 659| } 229| | // This step differs slightly from EMSA-PSS-VERIFY (RFC 8017) step 10 because 230| | // it accepts a non-standard salt recovery flow. DB should be some number of 231| | // zeros, a one, then the salt. 232| 86.4k| for (salt_start = 0; DB[salt_start] == 0 && salt_start < maskedDBLen - 1; ------------------ | Branch (232:24): [True: 85.7k, False: 659] | Branch (232:47): [True: 85.7k, False: 0] ------------------ 233| 85.7k| salt_start++) { 234| 85.7k| ; 235| 85.7k| } 236| 659| if (DB[salt_start] != 0x1) { ------------------ | Branch (236:7): [True: 196, False: 463] ------------------ 237| 196| OPENSSL_PUT_ERROR(RSA, RSA_R_SLEN_RECOVERY_FAILED); ------------------ | | 361| 196| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 238| 196| goto err; 239| 196| } 240| 463| salt_start++; 241| | // If a salt length was specified, check it matches. 242| 463| if (sLen >= 0 && maskedDBLen - salt_start != (size_t)sLen) { ------------------ | Branch (242:7): [True: 463, False: 0] | Branch (242:20): [True: 11, False: 452] ------------------ 243| 11| OPENSSL_PUT_ERROR(RSA, RSA_R_SLEN_CHECK_FAILED); ------------------ | | 361| 11| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 244| 11| goto err; 245| 11| } 246| 452| uint8_t H_[EVP_MAX_MD_SIZE]; 247| 452| if (!EVP_DigestInit_ex(ctx.get(), Hash, NULL) || ------------------ | Branch (247:7): [True: 0, False: 452] ------------------ 248| 452| !EVP_DigestUpdate(ctx.get(), kPSSZeroes, sizeof(kPSSZeroes)) || ------------------ | Branch (248:7): [True: 0, False: 452] ------------------ 249| 452| !EVP_DigestUpdate(ctx.get(), mHash, hLen) || ------------------ | Branch (249:7): [True: 0, False: 452] ------------------ 250| 452| !EVP_DigestUpdate(ctx.get(), DB + salt_start, maskedDBLen - salt_start) || ------------------ | Branch (250:7): [True: 0, False: 452] ------------------ 251| 452| !EVP_DigestFinal_ex(ctx.get(), H_, NULL)) { ------------------ | Branch (251:7): [True: 0, False: 452] ------------------ 252| 0| goto err; 253| 0| } 254| 452| if (OPENSSL_memcmp(H_, H, hLen) != 0) { ------------------ | Branch (254:7): [True: 452, False: 0] ------------------ 255| 452| OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_SIGNATURE); ------------------ | | 361| 452| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 256| 452| goto err; 257| 452| } 258| | 259| 0| ret = 1; 260| | 261| 1.50k|err: 262| 1.50k| OPENSSL_free(DB); 263| 1.50k| FIPS_service_indicator_unlock_state(); 264| 1.50k| return ret; 265| 0|} RSA_padding_add_PKCS1_PSS_mgf1: 270| 27.6k| int sLenRequested) { 271| 27.6k| int ret = 0; 272| 27.6k| bssl::ScopedEVP_MD_CTX ctx; 273| 27.6k| size_t maskedDBLen, MSBits, emLen; 274| 27.6k| size_t hLen; 275| 27.6k| unsigned char *H, *salt = NULL, *p; 276| | 277| 27.6k| if (mgf1Hash == NULL) { ------------------ | Branch (277:7): [True: 27.6k, False: 0] ------------------ 278| 27.6k| mgf1Hash = Hash; 279| 27.6k| } 280| | 281| 27.6k| FIPS_service_indicator_lock_state(); 282| 27.6k| hLen = EVP_MD_size(Hash); 283| | 284| 27.6k| if (BN_is_zero(rsa->n)) { ------------------ | Branch (284:7): [True: 0, False: 27.6k] ------------------ 285| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_EMPTY_PUBLIC_KEY); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 286| 0| goto err; 287| 0| } 288| | 289| 27.6k| MSBits = (BN_num_bits(rsa->n) - 1) & 0x7; 290| 27.6k| emLen = RSA_size(rsa); 291| 27.6k| if (MSBits == 0) { ------------------ | Branch (291:7): [True: 0, False: 27.6k] ------------------ 292| 0| assert(emLen >= 1); 293| 0| *EM++ = 0; 294| 0| emLen--; 295| 0| } 296| | 297| 27.6k| if (emLen < hLen + 2) { ------------------ | Branch (297:7): [True: 0, False: 27.6k] ------------------ 298| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 299| 0| goto err; 300| 0| } 301| | 302| | // Negative sLenRequested has special meanings: 303| | // -1 sLen == hLen 304| | // -2 salt length is maximized 305| | // -N reserved 306| 27.6k| size_t sLen; 307| 27.6k| if (sLenRequested == -1) { ------------------ | Branch (307:7): [True: 27.6k, False: 0] ------------------ 308| 27.6k| sLen = hLen; 309| 27.6k| } else if (sLenRequested == -2) { ------------------ | Branch (309:14): [True: 0, False: 0] ------------------ 310| 0| sLen = emLen - hLen - 2; 311| 0| } else if (sLenRequested < 0) { ------------------ | Branch (311:14): [True: 0, False: 0] ------------------ 312| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_SLEN_CHECK_FAILED); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 313| 0| goto err; 314| 0| } else { 315| 0| sLen = (size_t)sLenRequested; 316| 0| } 317| | 318| 27.6k| if (emLen - hLen - 2 < sLen) { ------------------ | Branch (318:7): [True: 0, False: 27.6k] ------------------ 319| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 320| 0| goto err; 321| 0| } 322| | 323| 27.6k| if (sLen > 0) { ------------------ | Branch (323:7): [True: 27.6k, False: 0] ------------------ 324| 27.6k| salt = reinterpret_cast(OPENSSL_malloc(sLen)); 325| 27.6k| if (!salt) { ------------------ | Branch (325:9): [True: 0, False: 27.6k] ------------------ 326| 0| goto err; 327| 0| } 328| 27.6k| BCM_rand_bytes(salt, sLen); 329| 27.6k| } 330| 27.6k| maskedDBLen = emLen - hLen - 1; 331| 27.6k| H = EM + maskedDBLen; 332| | 333| 27.6k| if (!EVP_DigestInit_ex(ctx.get(), Hash, NULL) || ------------------ | Branch (333:7): [True: 0, False: 27.6k] ------------------ 334| 27.6k| !EVP_DigestUpdate(ctx.get(), kPSSZeroes, sizeof(kPSSZeroes)) || ------------------ | Branch (334:7): [True: 0, False: 27.6k] ------------------ 335| 27.6k| !EVP_DigestUpdate(ctx.get(), mHash, hLen) || ------------------ | Branch (335:7): [True: 0, False: 27.6k] ------------------ 336| 27.6k| !EVP_DigestUpdate(ctx.get(), salt, sLen) || ------------------ | Branch (336:7): [True: 0, False: 27.6k] ------------------ 337| 27.6k| !EVP_DigestFinal_ex(ctx.get(), H, NULL)) { ------------------ | Branch (337:7): [True: 0, False: 27.6k] ------------------ 338| 0| goto err; 339| 0| } 340| | 341| | // Generate dbMask in place then perform XOR on it 342| 27.6k| if (!PKCS1_MGF1(EM, maskedDBLen, H, hLen, mgf1Hash)) { ------------------ | Branch (342:7): [True: 0, False: 27.6k] ------------------ 343| 0| goto err; 344| 0| } 345| | 346| 27.6k| p = EM; 347| | // Initial PS XORs with all zeroes which is a NOP so just update 348| | // pointer. Note from a test above this value is guaranteed to 349| | // be non-negative. 350| 27.6k| p += emLen - sLen - hLen - 2; 351| 27.6k| *p++ ^= 0x1; 352| 27.6k| if (sLen > 0) { ------------------ | Branch (352:7): [True: 27.6k, False: 0] ------------------ 353| 1.35M| for (size_t i = 0; i < sLen; i++) { ------------------ | Branch (353:24): [True: 1.33M, False: 27.6k] ------------------ 354| 1.33M| *p++ ^= salt[i]; 355| 1.33M| } 356| 27.6k| } 357| 27.6k| if (MSBits) { ------------------ | Branch (357:7): [True: 27.6k, False: 0] ------------------ 358| 27.6k| EM[0] &= 0xFF >> (8 - MSBits); 359| 27.6k| } 360| | 361| | // H is already in place so just set final 0xbc 362| | 363| 27.6k| EM[emLen - 1] = 0xbc; 364| | 365| 27.6k| ret = 1; 366| | 367| 27.6k|err: 368| 27.6k| OPENSSL_free(salt); 369| 27.6k| FIPS_service_indicator_unlock_state(); 370| | 371| 27.6k| return ret; 372| 27.6k|} RSA_new: 163| 83.2k|RSA *RSA_new(void) { return RSA_new_method(NULL); } RSA_new_method: 165| 83.2k|RSA *RSA_new_method(const ENGINE *engine) { 166| 83.2k| RSA *rsa = reinterpret_cast(OPENSSL_zalloc(sizeof(RSA))); 167| 83.2k| if (rsa == NULL) { ------------------ | Branch (167:7): [True: 0, False: 83.2k] ------------------ 168| 0| return NULL; 169| 0| } 170| | 171| 83.2k| if (engine) { ------------------ | Branch (171:7): [True: 0, False: 83.2k] ------------------ 172| 0| rsa->meth = ENGINE_get_RSA_method(engine); 173| 0| } 174| | 175| 83.2k| if (rsa->meth == NULL) { ------------------ | Branch (175:7): [True: 83.2k, False: 0] ------------------ 176| 83.2k| rsa->meth = (RSA_METHOD *)RSA_default_method(); 177| 83.2k| } 178| 83.2k| METHOD_ref(rsa->meth); 179| | 180| 83.2k| rsa->references = 1; 181| 83.2k| rsa->flags = rsa->meth->flags; 182| 83.2k| CRYPTO_MUTEX_init(&rsa->lock); 183| 83.2k| CRYPTO_new_ex_data(&rsa->ex_data); 184| | 185| 83.2k| if (rsa->meth->init && !rsa->meth->init(rsa)) { ------------------ | Branch (185:7): [True: 0, False: 83.2k] | Branch (185:26): [True: 0, False: 0] ------------------ 186| 0| rsa->meth = nullptr; 187| 0| RSA_free(rsa); 188| 0| return NULL; 189| 0| } 190| | 191| 83.2k| return rsa; 192| 83.2k|} RSA_free: 204| 170k|void RSA_free(RSA *rsa) { 205| 170k| if (rsa == NULL) { ------------------ | Branch (205:7): [True: 86.9k, False: 83.2k] ------------------ 206| 86.9k| return; 207| 86.9k| } 208| | 209| 83.2k| if (!CRYPTO_refcount_dec_and_test_zero(&rsa->references)) { ------------------ | Branch (209:7): [True: 2, False: 83.2k] ------------------ 210| 2| return; 211| 2| } 212| | 213| 83.2k| if (rsa->meth != nullptr && rsa->meth->finish != nullptr) { ------------------ | Branch (213:7): [True: 83.2k, False: 0] | Branch (213:31): [True: 0, False: 83.2k] ------------------ 214| 0| rsa->meth->finish(rsa); 215| 0| } 216| 83.2k| METHOD_unref(rsa->meth); 217| | 218| 83.2k| CRYPTO_free_ex_data(g_rsa_ex_data_class_bss_get(), &rsa->ex_data); 219| | 220| 83.2k| BN_free(rsa->n); 221| 83.2k| BN_free(rsa->e); 222| 83.2k| BN_free(rsa->d); 223| 83.2k| BN_free(rsa->p); 224| 83.2k| BN_free(rsa->q); 225| 83.2k| BN_free(rsa->dmp1); 226| 83.2k| BN_free(rsa->dmq1); 227| 83.2k| BN_free(rsa->iqmp); 228| 83.2k| rsa_invalidate_key(rsa); 229| 83.2k| CRYPTO_MUTEX_cleanup(&rsa->lock); 230| 83.2k| OPENSSL_free(rsa); 231| 83.2k|} RSA_up_ref: 233| 2|int RSA_up_ref(RSA *rsa) { 234| 2| CRYPTO_refcount_inc(&rsa->references); 235| 2| return 1; 236| 2|} RSA_get0_n: 240| 4|const BIGNUM *RSA_get0_n(const RSA *rsa) { return rsa->n; } RSA_get0_e: 242| 4|const BIGNUM *RSA_get0_e(const RSA *rsa) { return rsa->e; } RSA_sign_raw: 373| 27.6k| const uint8_t *in, size_t in_len, int padding) { 374| 27.6k| boringssl_ensure_rsa_self_test(); 375| 27.6k| return rsa_sign_raw_no_self_test(rsa, out_len, out, max_out, in, in_len, 376| 27.6k| padding); 377| 27.6k|} RSA_size: 379| 310k|unsigned RSA_size(const RSA *rsa) { return BN_num_bytes(rsa->n); } RSA_is_opaque: 381| 2|int RSA_is_opaque(const RSA *rsa) { 382| 2| return rsa->meth && (rsa->meth->flags & RSA_FLAG_OPAQUE); ------------------ | | 632| 2|#define RSA_FLAG_OPAQUE 1 ------------------ | Branch (382:10): [True: 2, False: 0] | Branch (382:23): [True: 0, False: 2] ------------------ 383| 2|} RSA_add_pkcs1_prefix: 495| 4.12k| size_t digest_len) { 496| 4.12k| if (!rsa_check_digest_size(hash_nid, digest_len)) { ------------------ | Branch (496:7): [True: 0, False: 4.12k] ------------------ 497| 0| return 0; 498| 0| } 499| | 500| 4.12k| if (hash_nid == NID_md5_sha1) { ------------------ | | 561| 4.12k|#define NID_md5_sha1 114 ------------------ | Branch (500:7): [True: 797, False: 3.33k] ------------------ 501| | // The length should already have been checked. 502| 797| assert(digest_len == SSL_SIG_LENGTH); 503| 797| *out_msg = (uint8_t *)digest; 504| 797| *out_msg_len = digest_len; 505| 797| *is_alloced = 0; 506| 797| return 1; 507| 797| } 508| | 509| 16.1k| for (size_t i = 0; kPKCS1SigPrefixes[i].nid != NID_undef; i++) { ------------------ | | 43| 16.1k|#define NID_undef 0 ------------------ | Branch (509:22): [True: 16.1k, False: 0] ------------------ 510| 16.1k| const struct pkcs1_sig_prefix *sig_prefix = &kPKCS1SigPrefixes[i]; 511| 16.1k| if (sig_prefix->nid != hash_nid) { ------------------ | Branch (511:9): [True: 12.8k, False: 3.33k] ------------------ 512| 12.8k| continue; 513| 12.8k| } 514| | 515| | // The length should already have been checked. 516| 3.33k| assert(digest_len == sig_prefix->hash_len); 517| 3.33k| const uint8_t *prefix = sig_prefix->bytes; 518| 3.33k| size_t prefix_len = sig_prefix->len; 519| 3.33k| size_t signed_msg_len = prefix_len + digest_len; 520| 3.33k| if (signed_msg_len < prefix_len) { ------------------ | Branch (520:9): [True: 0, False: 3.33k] ------------------ 521| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_TOO_LONG); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 522| 0| return 0; 523| 0| } 524| | 525| 3.33k| uint8_t *signed_msg = 526| 3.33k| reinterpret_cast(OPENSSL_malloc(signed_msg_len)); 527| 3.33k| if (!signed_msg) { ------------------ | Branch (527:9): [True: 0, False: 3.33k] ------------------ 528| 0| return 0; 529| 0| } 530| | 531| 3.33k| OPENSSL_memcpy(signed_msg, prefix, prefix_len); 532| 3.33k| OPENSSL_memcpy(signed_msg + prefix_len, digest, digest_len); 533| | 534| 3.33k| *out_msg = signed_msg; 535| 3.33k| *out_msg_len = signed_msg_len; 536| 3.33k| *is_alloced = 1; 537| | 538| 3.33k| return 1; 539| 3.33k| } 540| | 541| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_UNKNOWN_ALGORITHM_TYPE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 542| 0| return 0; 543| 3.33k|} rsa_sign_no_self_test: 547| 379| RSA *rsa) { 548| 379| if (rsa->meth->sign) { ------------------ | Branch (548:7): [True: 0, False: 379] ------------------ 549| 0| if (!rsa_check_digest_size(hash_nid, digest_len)) { ------------------ | Branch (549:9): [True: 0, False: 0] ------------------ 550| 0| return 0; 551| 0| } 552| | // All supported digest lengths fit in |unsigned|. 553| 0| assert(digest_len <= EVP_MAX_MD_SIZE); 554| 0| static_assert(EVP_MAX_MD_SIZE <= UINT_MAX, "digest too long"); 555| 0| return rsa->meth->sign(hash_nid, digest, (unsigned)digest_len, out, out_len, 556| 0| rsa); 557| 0| } 558| | 559| 379| const unsigned rsa_size = RSA_size(rsa); 560| 379| int ret = 0; 561| 379| uint8_t *signed_msg = NULL; 562| 379| size_t signed_msg_len = 0; 563| 379| int signed_msg_is_alloced = 0; 564| 379| size_t size_t_out_len; 565| 379| if (!RSA_add_pkcs1_prefix(&signed_msg, &signed_msg_len, ------------------ | Branch (565:7): [True: 0, False: 379] ------------------ 566| 379| &signed_msg_is_alloced, hash_nid, digest, 567| 379| digest_len) || 568| 379| !rsa_sign_raw_no_self_test(rsa, &size_t_out_len, out, rsa_size, ------------------ | Branch (568:7): [True: 0, False: 379] ------------------ 569| 379| signed_msg, signed_msg_len, 570| 379| RSA_PKCS1_PADDING)) { ------------------ | | 208| 379|#define RSA_PKCS1_PADDING 1 ------------------ 571| 0| goto err; 572| 0| } 573| | 574| 379| if (size_t_out_len > UINT_MAX) { ------------------ | Branch (574:7): [True: 0, False: 379] ------------------ 575| 0| OPENSSL_PUT_ERROR(RSA, ERR_R_OVERFLOW); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 576| 0| goto err; 577| 0| } 578| | 579| 379| *out_len = (unsigned)size_t_out_len; 580| 379| ret = 1; 581| | 582| 379|err: 583| 379| if (signed_msg_is_alloced) { ------------------ | Branch (583:7): [True: 372, False: 7] ------------------ 584| 372| OPENSSL_free(signed_msg); 585| 372| } 586| 379| return ret; 587| 379|} RSA_sign: 590| 379| uint8_t *out, unsigned *out_len, RSA *rsa) { 591| 379| boringssl_ensure_rsa_self_test(); 592| | 593| 379| return rsa_sign_no_self_test(hash_nid, digest, digest_len, out, out_len, rsa); 594| 379|} RSA_sign_pss_mgf1: 598| 27.6k| const EVP_MD *md, const EVP_MD *mgf1_md, int salt_len) { 599| 27.6k| if (digest_len != EVP_MD_size(md)) { ------------------ | Branch (599:7): [True: 0, False: 27.6k] ------------------ 600| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_INVALID_MESSAGE_LENGTH); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 601| 0| return 0; 602| 0| } 603| | 604| 27.6k| size_t padded_len = RSA_size(rsa); 605| 27.6k| uint8_t *padded = reinterpret_cast(OPENSSL_malloc(padded_len)); 606| 27.6k| if (padded == NULL) { ------------------ | Branch (606:7): [True: 0, False: 27.6k] ------------------ 607| 0| return 0; 608| 0| } 609| | 610| 27.6k| int ret = RSA_padding_add_PKCS1_PSS_mgf1(rsa, padded, digest, md, mgf1_md, ------------------ | Branch (610:13): [True: 27.6k, False: 0] ------------------ 611| 27.6k| salt_len) && 612| 27.6k| RSA_sign_raw(rsa, out_len, out, max_out, padded, padded_len, ------------------ | Branch (612:13): [True: 27.6k, False: 0] ------------------ 613| 27.6k| RSA_NO_PADDING); ------------------ | | 211| 27.6k|#define RSA_NO_PADDING 3 ------------------ 614| 27.6k| OPENSSL_free(padded); 615| 27.6k| return ret; 616| 27.6k|} rsa_verify_no_self_test: 620| 35.8k| size_t sig_len, RSA *rsa) { 621| 35.8k| if (rsa->n == NULL || rsa->e == NULL) { ------------------ | Branch (621:7): [True: 0, False: 35.8k] | Branch (621:25): [True: 0, False: 35.8k] ------------------ 622| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_VALUE_MISSING); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 623| 0| return 0; 624| 0| } 625| | 626| 35.8k| const size_t rsa_size = RSA_size(rsa); 627| 35.8k| uint8_t *buf = NULL; 628| 35.8k| int ret = 0; 629| 35.8k| uint8_t *signed_msg = NULL; 630| 35.8k| size_t signed_msg_len = 0, len; 631| 35.8k| int signed_msg_is_alloced = 0; 632| | 633| 35.8k| if (hash_nid == NID_md5_sha1 && digest_len != SSL_SIG_LENGTH) { ------------------ | | 561| 71.6k|#define NID_md5_sha1 114 ------------------ | Branch (633:7): [True: 964, False: 34.8k] | Branch (633:35): [True: 0, False: 964] ------------------ 634| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_INVALID_MESSAGE_LENGTH); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 635| 0| return 0; 636| 0| } 637| | 638| 35.8k| buf = reinterpret_cast(OPENSSL_malloc(rsa_size)); 639| 35.8k| if (!buf) { ------------------ | Branch (639:7): [True: 0, False: 35.8k] ------------------ 640| 0| return 0; 641| 0| } 642| | 643| 35.8k| if (!rsa_verify_raw_no_self_test(rsa, &len, buf, rsa_size, sig, sig_len, ------------------ | Branch (643:7): [True: 32.0k, False: 3.74k] ------------------ 644| 35.8k| RSA_PKCS1_PADDING) || ------------------ | | 208| 35.8k|#define RSA_PKCS1_PADDING 1 ------------------ 645| 35.8k| !RSA_add_pkcs1_prefix(&signed_msg, &signed_msg_len, ------------------ | Branch (645:7): [True: 0, False: 3.74k] ------------------ 646| 3.74k| &signed_msg_is_alloced, hash_nid, digest, 647| 32.0k| digest_len)) { 648| 32.0k| goto out; 649| 32.0k| } 650| | 651| | // Check that no other information follows the hash value (FIPS 186-4 Section 652| | // 5.5) and it matches the expected hash. 653| 3.74k| if (len != signed_msg_len || OPENSSL_memcmp(buf, signed_msg, len) != 0) { ------------------ | Branch (653:7): [True: 1.88k, False: 1.86k] | Branch (653:32): [True: 1.86k, False: 0] ------------------ 654| 3.74k| OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_SIGNATURE); ------------------ | | 361| 3.74k| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 655| 3.74k| goto out; 656| 3.74k| } 657| | 658| 0| ret = 1; 659| | 660| 35.8k|out: 661| 35.8k| OPENSSL_free(buf); 662| 35.8k| if (signed_msg_is_alloced) { ------------------ | Branch (662:7): [True: 2.95k, False: 32.8k] ------------------ 663| 2.95k| OPENSSL_free(signed_msg); 664| 2.95k| } 665| 35.8k| return ret; 666| 0|} RSA_verify: 669| 35.8k| const uint8_t *sig, size_t sig_len, RSA *rsa) { 670| 35.8k| boringssl_ensure_rsa_self_test(); 671| 35.8k| return rsa_verify_no_self_test(hash_nid, digest, digest_len, sig, sig_len, 672| 35.8k| rsa); 673| 35.8k|} RSA_verify_pss_mgf1: 677| 1.52k| const uint8_t *sig, size_t sig_len) { 678| 1.52k| if (digest_len != EVP_MD_size(md)) { ------------------ | Branch (678:7): [True: 0, False: 1.52k] ------------------ 679| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_INVALID_MESSAGE_LENGTH); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 680| 0| return 0; 681| 0| } 682| | 683| 1.52k| size_t em_len = RSA_size(rsa); 684| 1.52k| uint8_t *em = reinterpret_cast(OPENSSL_malloc(em_len)); 685| 1.52k| if (em == NULL) { ------------------ | Branch (685:7): [True: 0, False: 1.52k] ------------------ 686| 0| return 0; 687| 0| } 688| | 689| 1.52k| int ret = 0; 690| 1.52k| if (!RSA_verify_raw(rsa, &em_len, em, em_len, sig, sig_len, RSA_NO_PADDING)) { ------------------ | | 211| 1.52k|#define RSA_NO_PADDING 3 ------------------ | Branch (690:7): [True: 18, False: 1.50k] ------------------ 691| 18| goto err; 692| 18| } 693| | 694| 1.50k| if (em_len != RSA_size(rsa)) { ------------------ | Branch (694:7): [True: 0, False: 1.50k] ------------------ 695| 0| OPENSSL_PUT_ERROR(RSA, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 696| 0| goto err; 697| 0| } 698| | 699| 1.50k| ret = RSA_verify_PKCS1_PSS_mgf1(rsa, digest, md, mgf1_md, em, salt_len); 700| | 701| 1.52k|err: 702| 1.52k| OPENSSL_free(em); 703| 1.52k| return ret; 704| 1.50k|} RSA_check_key: 729| 79.8k|int RSA_check_key(const RSA *key) { 730| | // TODO(davidben): RSA key initialization is spread across 731| | // |rsa_check_public_key|, |RSA_check_key|, |freeze_private_key|, and 732| | // |BN_MONT_CTX_set_locked| as a result of API issues. See 733| | // https://crbug.com/boringssl/316. As a result, we inconsistently check RSA 734| | // invariants. We should fix this and integrate that logic. 735| | 736| 79.8k| if (!rsa_check_public_key(key)) { ------------------ | Branch (736:7): [True: 142, False: 79.7k] ------------------ 737| 142| return 0; 738| 142| } 739| | 740| 79.7k| if ((key->p != NULL) != (key->q != NULL)) { ------------------ | Branch (740:7): [True: 0, False: 79.7k] ------------------ 741| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_ONLY_ONE_OF_P_Q_GIVEN); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 742| 0| return 0; 743| 0| } 744| | 745| | // |key->d| must be bounded by |key->n|. This ensures bounds on |RSA_bits| 746| | // translate to bounds on the running time of private key operations. 747| 79.7k| if (key->d != NULL && ------------------ | Branch (747:7): [True: 2, False: 79.7k] ------------------ 748| 79.7k| (BN_is_negative(key->d) || BN_cmp(key->d, key->n) >= 0)) { ------------------ | Branch (748:8): [True: 0, False: 2] | Branch (748:34): [True: 0, False: 2] ------------------ 749| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_D_OUT_OF_RANGE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 750| 0| return 0; 751| 0| } 752| | 753| 79.7k| if (key->d == NULL || key->p == NULL) { ------------------ | Branch (753:7): [True: 79.7k, False: 2] | Branch (753:25): [True: 0, False: 2] ------------------ 754| | // For a public key, or without p and q, there's nothing that can be 755| | // checked. 756| 79.7k| return 1; 757| 79.7k| } 758| | 759| 2| BN_CTX *ctx = BN_CTX_new(); 760| 2| if (ctx == NULL) { ------------------ | Branch (760:7): [True: 0, False: 2] ------------------ 761| 0| return 0; 762| 0| } 763| | 764| 2| BIGNUM tmp, de, pm1, qm1, dmp1, dmq1; 765| 2| int ok = 0, has_crt_values; 766| 2| unsigned pm1_bits, qm1_bits; 767| 2| BN_init(&tmp); 768| 2| BN_init(&de); 769| 2| BN_init(&pm1); 770| 2| BN_init(&qm1); 771| 2| BN_init(&dmp1); 772| 2| BN_init(&dmq1); 773| | 774| | // Check that p * q == n. Before we multiply, we check that p and q are in 775| | // bounds, to avoid a DoS vector in |bn_mul_consttime| below. Note that 776| | // n was bound by |rsa_check_public_key|. This also implicitly checks p and q 777| | // are odd, which is a necessary condition for Montgomery reduction. 778| 2| if (BN_is_negative(key->p) || ------------------ | Branch (778:7): [True: 0, False: 2] ------------------ 779| 2| constant_time_declassify_int(BN_cmp(key->p, key->n) >= 0) || ------------------ | Branch (779:7): [True: 0, False: 2] ------------------ 780| 2| BN_is_negative(key->q) || ------------------ | Branch (780:7): [True: 0, False: 2] ------------------ 781| 2| constant_time_declassify_int(BN_cmp(key->q, key->n) >= 0)) { ------------------ | Branch (781:7): [True: 0, False: 2] ------------------ 782| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_N_NOT_EQUAL_P_Q); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 783| 0| goto out; 784| 0| } 785| 2| if (!bn_mul_consttime(&tmp, key->p, key->q, ctx)) { ------------------ | Branch (785:7): [True: 0, False: 2] ------------------ 786| 0| OPENSSL_PUT_ERROR(RSA, ERR_LIB_BN); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 787| 0| goto out; 788| 0| } 789| 2| if (BN_cmp(&tmp, key->n) != 0) { ------------------ | Branch (789:7): [True: 0, False: 2] ------------------ 790| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_N_NOT_EQUAL_P_Q); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 791| 0| goto out; 792| 0| } 793| | 794| | // d must be an inverse of e mod the Carmichael totient, lcm(p-1, q-1), but it 795| | // may be unreduced because other implementations use the Euler totient. We 796| | // simply check that d * e is one mod p-1 and mod q-1. Note d and e were bound 797| | // by earlier checks in this function. 798| 2| if (!bn_usub_consttime(&pm1, key->p, BN_value_one()) || ------------------ | Branch (798:7): [True: 0, False: 2] ------------------ 799| 2| !bn_usub_consttime(&qm1, key->q, BN_value_one())) { ------------------ | Branch (799:7): [True: 0, False: 2] ------------------ 800| 0| OPENSSL_PUT_ERROR(RSA, ERR_LIB_BN); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 801| 0| goto out; 802| 0| } 803| 2| pm1_bits = BN_num_bits(&pm1); 804| 2| qm1_bits = BN_num_bits(&qm1); 805| 2| if (!bn_mul_consttime(&de, key->d, key->e, ctx) || ------------------ | Branch (805:7): [True: 0, False: 2] ------------------ 806| 2| !bn_div_consttime(NULL, &tmp, &de, &pm1, pm1_bits, ctx) || ------------------ | Branch (806:7): [True: 0, False: 2] ------------------ 807| 2| !bn_div_consttime(NULL, &de, &de, &qm1, qm1_bits, ctx)) { ------------------ | Branch (807:7): [True: 0, False: 2] ------------------ 808| 0| OPENSSL_PUT_ERROR(RSA, ERR_LIB_BN); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 809| 0| goto out; 810| 0| } 811| | 812| 2| if (constant_time_declassify_int(!BN_is_one(&tmp)) || ------------------ | Branch (812:7): [True: 0, False: 2] ------------------ 813| 2| constant_time_declassify_int(!BN_is_one(&de))) { ------------------ | Branch (813:7): [True: 0, False: 2] ------------------ 814| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_D_E_NOT_CONGRUENT_TO_1); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 815| 0| goto out; 816| 0| } 817| | 818| 2| has_crt_values = key->dmp1 != NULL; 819| 2| if (has_crt_values != (key->dmq1 != NULL) || ------------------ | Branch (819:7): [True: 0, False: 2] ------------------ 820| 2| has_crt_values != (key->iqmp != NULL)) { ------------------ | Branch (820:7): [True: 0, False: 2] ------------------ 821| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_INCONSISTENT_SET_OF_CRT_VALUES); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 822| 0| goto out; 823| 0| } 824| | 825| 2| if (has_crt_values) { ------------------ | Branch (825:7): [True: 2, False: 0] ------------------ 826| 2| int dmp1_ok, dmq1_ok, iqmp_ok; 827| 2| if (!check_mod_inverse(&dmp1_ok, key->e, key->dmp1, &pm1, pm1_bits, ctx) || ------------------ | Branch (827:9): [True: 0, False: 2] ------------------ 828| 2| !check_mod_inverse(&dmq1_ok, key->e, key->dmq1, &qm1, qm1_bits, ctx) || ------------------ | Branch (828:9): [True: 0, False: 2] ------------------ 829| | // |p| is odd, so |pm1| and |p| have the same bit width. If they didn't, 830| | // we only need a lower bound anyway. 831| 2| !check_mod_inverse(&iqmp_ok, key->q, key->iqmp, key->p, pm1_bits, ------------------ | Branch (831:9): [True: 0, False: 2] ------------------ 832| 2| ctx)) { 833| 0| OPENSSL_PUT_ERROR(RSA, ERR_LIB_BN); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 834| 0| goto out; 835| 0| } 836| | 837| 2| if (!dmp1_ok || !dmq1_ok || !iqmp_ok) { ------------------ | Branch (837:9): [True: 0, False: 2] | Branch (837:21): [True: 0, False: 2] | Branch (837:33): [True: 0, False: 2] ------------------ 838| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_CRT_VALUES_INCORRECT); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 839| 0| goto out; 840| 0| } 841| 2| } 842| | 843| 2| ok = 1; 844| | 845| 2|out: 846| 2| BN_free(&tmp); 847| 2| BN_free(&de); 848| 2| BN_free(&pm1); 849| 2| BN_free(&qm1); 850| 2| BN_free(&dmp1); 851| 2| BN_free(&dmq1); 852| 2| BN_CTX_free(ctx); 853| | 854| 2| return ok; 855| 2|} rsa_private_transform_no_self_test: 964| 28.0k| const uint8_t *in, size_t len) { 965| 28.0k| if (rsa->meth->private_transform) { ------------------ | Branch (965:7): [True: 0, False: 28.0k] ------------------ 966| 0| return rsa->meth->private_transform(rsa, out, in, len); 967| 0| } 968| | 969| 28.0k| return rsa_default_private_transform(rsa, out, in, len); 970| 28.0k|} bcm.cc:_ZL25rsa_sign_raw_no_self_testP6rsa_stPmPhmPKhmi: 364| 28.0k| size_t in_len, int padding) { 365| 28.0k| if (rsa->meth->sign_raw) { ------------------ | Branch (365:7): [True: 0, False: 28.0k] ------------------ 366| 0| return rsa->meth->sign_raw(rsa, out_len, out, max_out, in, in_len, padding); 367| 0| } 368| | 369| 28.0k| return rsa_default_sign_raw(rsa, out_len, out, max_out, in, in_len, padding); 370| 28.0k|} bcm.cc:_ZL21rsa_check_digest_sizeim: 469| 4.12k|static int rsa_check_digest_size(int hash_nid, size_t digest_len) { 470| 4.12k| if (hash_nid == NID_md5_sha1) { ------------------ | | 561| 4.12k|#define NID_md5_sha1 114 ------------------ | Branch (470:7): [True: 797, False: 3.33k] ------------------ 471| 797| if (digest_len != SSL_SIG_LENGTH) { ------------------ | Branch (471:9): [True: 0, False: 797] ------------------ 472| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_INVALID_MESSAGE_LENGTH); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 473| 0| return 0; 474| 0| } 475| 797| return 1; 476| 797| } 477| | 478| 16.1k| for (size_t i = 0; kPKCS1SigPrefixes[i].nid != NID_undef; i++) { ------------------ | | 43| 16.1k|#define NID_undef 0 ------------------ | Branch (478:22): [True: 16.1k, False: 0] ------------------ 479| 16.1k| const struct pkcs1_sig_prefix *sig_prefix = &kPKCS1SigPrefixes[i]; 480| 16.1k| if (sig_prefix->nid == hash_nid) { ------------------ | Branch (480:9): [True: 3.33k, False: 12.8k] ------------------ 481| 3.33k| if (digest_len != sig_prefix->hash_len) { ------------------ | Branch (481:11): [True: 0, False: 3.33k] ------------------ 482| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_INVALID_MESSAGE_LENGTH); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 483| 0| return 0; 484| 0| } 485| 3.33k| return 1; 486| 3.33k| } 487| 16.1k| } 488| | 489| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_UNKNOWN_ALGORITHM_TYPE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 490| 0| return 0; 491| 3.33k|} bcm.cc:_ZL17check_mod_inversePiPK9bignum_stS2_S2_jP10bignum_ctx: 708| 6| BN_CTX *ctx) { 709| 6| if (BN_is_negative(ainv) || ------------------ | Branch (709:7): [True: 0, False: 6] ------------------ 710| 6| constant_time_declassify_int(BN_cmp(ainv, m) >= 0)) { ------------------ | Branch (710:7): [True: 0, False: 6] ------------------ 711| 0| *out_ok = 0; 712| 0| return 1; 713| 0| } 714| | 715| | // Note |bn_mul_consttime| and |bn_div_consttime| do not scale linearly, but 716| | // checking |ainv| is in range bounds the running time, assuming |m|'s bounds 717| | // were checked by the caller. 718| 6| bssl::BN_CTXScope scope(ctx); 719| 6| BIGNUM *tmp = BN_CTX_get(ctx); 720| 6| if (tmp == nullptr || // ------------------ | Branch (720:7): [True: 0, False: 6] ------------------ 721| 6| !bn_mul_consttime(tmp, a, ainv, ctx) || ------------------ | Branch (721:7): [True: 0, False: 6] ------------------ 722| 6| !bn_div_consttime(NULL, tmp, tmp, m, m_min_bits, ctx)) { ------------------ | Branch (722:7): [True: 0, False: 6] ------------------ 723| 0| return 0; 724| 0| } 725| 6| *out_ok = constant_time_declassify_int(BN_is_one(tmp)); 726| 6| return 1; 727| 6|} rsa_check_public_key: 37| 118k|int rsa_check_public_key(const RSA *rsa) { 38| 118k| if (rsa->n == NULL) { ------------------ | Branch (38:7): [True: 0, False: 118k] ------------------ 39| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_VALUE_MISSING); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 40| 0| return 0; 41| 0| } 42| | 43| 118k| unsigned n_bits = BN_num_bits(rsa->n); 44| 118k| if (n_bits > OPENSSL_RSA_MAX_MODULUS_BITS) { ------------------ | | 74| 118k|#define OPENSSL_RSA_MAX_MODULUS_BITS 16384 ------------------ | Branch (44:7): [True: 0, False: 118k] ------------------ 45| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_MODULUS_TOO_LARGE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 46| 0| return 0; 47| 0| } 48| | 49| | // TODO(crbug.com/boringssl/607): Raise this limit. 512-bit RSA was factored 50| | // in 1999. 51| 118k| if (n_bits < 512) { ------------------ | Branch (51:7): [True: 1, False: 118k] ------------------ 52| 1| OPENSSL_PUT_ERROR(RSA, RSA_R_KEY_SIZE_TOO_SMALL); ------------------ | | 361| 1| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 53| 1| return 0; 54| 1| } 55| | 56| | // RSA moduli must be positive and odd. In addition to being necessary for RSA 57| | // in general, we cannot setup Montgomery reduction with even moduli. 58| 118k| if (!BN_is_odd(rsa->n) || BN_is_negative(rsa->n)) { ------------------ | Branch (58:7): [True: 14, False: 118k] | Branch (58:29): [True: 0, False: 118k] ------------------ 59| 14| OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_RSA_PARAMETERS); ------------------ | | 361| 14| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 60| 14| return 0; 61| 14| } 62| | 63| 118k| static const unsigned kMaxExponentBits = 33; 64| 118k| if (rsa->e != NULL) { ------------------ | Branch (64:7): [True: 118k, False: 0] ------------------ 65| | // Reject e = 1, negative e, and even e. e must be odd to be relatively 66| | // prime with phi(n). 67| 118k| unsigned e_bits = BN_num_bits(rsa->e); 68| 118k| if (e_bits < 2 || BN_is_negative(rsa->e) || !BN_is_odd(rsa->e)) { ------------------ | Branch (68:9): [True: 14, False: 118k] | Branch (68:23): [True: 0, False: 118k] | Branch (68:49): [True: 86, False: 118k] ------------------ 69| 100| OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_E_VALUE); ------------------ | | 361| 100| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 70| 100| return 0; 71| 100| } 72| 118k| if (rsa->flags & RSA_FLAG_LARGE_PUBLIC_EXPONENT) { ------------------ | | 651| 118k|#define RSA_FLAG_LARGE_PUBLIC_EXPONENT 0x80 ------------------ | Branch (72:9): [True: 0, False: 118k] ------------------ 73| | // The caller has requested disabling DoS protections. Still, e must be 74| | // less than n. 75| 0| if (BN_ucmp(rsa->n, rsa->e) <= 0) { ------------------ | Branch (75:11): [True: 0, False: 0] ------------------ 76| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_E_VALUE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 77| 0| return 0; 78| 0| } 79| 118k| } else { 80| | // Mitigate DoS attacks by limiting the exponent size. 33 bits was chosen 81| | // as the limit based on the recommendations in [1] and [2]. Windows 82| | // CryptoAPI doesn't support values larger than 32 bits [3], so it is 83| | // unlikely that exponents larger than 32 bits are being used for anything 84| | // Windows commonly does. 85| | // 86| | // [1] https://www.imperialviolet.org/2012/03/16/rsae.html 87| | // [2] https://www.imperialviolet.org/2012/03/17/rsados.html 88| | // [3] https://msdn.microsoft.com/en-us/library/aa387685(VS.85).aspx 89| 118k| if (e_bits > kMaxExponentBits) { ------------------ | Branch (89:11): [True: 27, False: 118k] ------------------ 90| 27| OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_E_VALUE); ------------------ | | 361| 27| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 91| 27| return 0; 92| 27| } 93| | 94| | // The upper bound on |e_bits| and lower bound on |n_bits| imply e is 95| | // bounded by n. 96| 118k| assert(BN_ucmp(rsa->n, rsa->e) > 0); 97| 118k| } 98| 118k| } else if (!(rsa->flags & RSA_FLAG_NO_PUBLIC_EXPONENT)) { ------------------ | | 645| 0|#define RSA_FLAG_NO_PUBLIC_EXPONENT 0x40 ------------------ | Branch (98:14): [True: 0, False: 0] ------------------ 99| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_VALUE_MISSING); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 100| 0| return 0; 101| 0| } 102| | 103| 118k| return 1; 104| 118k|} rsa_invalidate_key: 222| 83.2k|void rsa_invalidate_key(RSA *rsa) { 223| 83.2k| rsa->private_key_frozen = 0; 224| | 225| 83.2k| BN_MONT_CTX_free(rsa->mont_n); 226| 83.2k| rsa->mont_n = NULL; 227| 83.2k| BN_MONT_CTX_free(rsa->mont_p); 228| 83.2k| rsa->mont_p = NULL; 229| 83.2k| BN_MONT_CTX_free(rsa->mont_q); 230| 83.2k| rsa->mont_q = NULL; 231| | 232| 83.2k| BN_free(rsa->d_fixed); 233| 83.2k| rsa->d_fixed = NULL; 234| 83.2k| BN_free(rsa->dmp1_fixed); 235| 83.2k| rsa->dmp1_fixed = NULL; 236| 83.2k| BN_free(rsa->dmq1_fixed); 237| 83.2k| rsa->dmq1_fixed = NULL; 238| 83.2k| BN_free(rsa->iqmp_mont); 239| 83.2k| rsa->iqmp_mont = NULL; 240| | 241| 83.2k| for (size_t i = 0; i < rsa->num_blindings; i++) { ------------------ | Branch (241:22): [True: 0, False: 83.2k] ------------------ 242| 0| BN_BLINDING_free(rsa->blindings[i]); 243| 0| } 244| 83.2k| OPENSSL_free(rsa->blindings); 245| 83.2k| rsa->blindings = NULL; 246| 83.2k| rsa->num_blindings = 0; 247| 83.2k| OPENSSL_free(rsa->blindings_inuse); 248| 83.2k| rsa->blindings_inuse = NULL; 249| 83.2k| rsa->blinding_fork_generation = 0; 250| 83.2k|} rsa_default_sign_raw: 387| 28.0k| int padding) { 388| 28.0k| const unsigned rsa_size = RSA_size(rsa); 389| 28.0k| uint8_t *buf = NULL; 390| 28.0k| int i, ret = 0; 391| | 392| 28.0k| if (max_out < rsa_size) { ------------------ | Branch (392:7): [True: 0, False: 28.0k] ------------------ 393| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_OUTPUT_BUFFER_TOO_SMALL); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 394| 0| return 0; 395| 0| } 396| | 397| 28.0k| buf = reinterpret_cast(OPENSSL_malloc(rsa_size)); 398| 28.0k| if (buf == NULL) { ------------------ | Branch (398:7): [True: 0, False: 28.0k] ------------------ 399| 0| goto err; 400| 0| } 401| | 402| 28.0k| switch (padding) { 403| 379| case RSA_PKCS1_PADDING: ------------------ | | 208| 379|#define RSA_PKCS1_PADDING 1 ------------------ | Branch (403:5): [True: 379, False: 27.6k] ------------------ 404| 379| i = RSA_padding_add_PKCS1_type_1(buf, rsa_size, in, in_len); 405| 379| break; 406| 27.6k| case RSA_NO_PADDING: ------------------ | | 211| 27.6k|#define RSA_NO_PADDING 3 ------------------ | Branch (406:5): [True: 27.6k, False: 379] ------------------ 407| 27.6k| i = RSA_padding_add_none(buf, rsa_size, in, in_len); 408| 27.6k| break; 409| 0| default: ------------------ | Branch (409:5): [True: 0, False: 28.0k] ------------------ 410| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_UNKNOWN_PADDING_TYPE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 411| 0| goto err; 412| 28.0k| } 413| | 414| 28.0k| if (i <= 0) { ------------------ | Branch (414:7): [True: 0, False: 28.0k] ------------------ 415| 0| goto err; 416| 0| } 417| | 418| 28.0k| if (!rsa_private_transform_no_self_test(rsa, out, buf, rsa_size)) { ------------------ | Branch (418:7): [True: 0, False: 28.0k] ------------------ 419| 0| goto err; 420| 0| } 421| | 422| 28.0k| CONSTTIME_DECLASSIFY(out, rsa_size); 423| 28.0k| *out_len = rsa_size; 424| 28.0k| ret = 1; 425| | 426| 28.0k|err: 427| 28.0k| OPENSSL_free(buf); 428| | 429| 28.0k| return ret; 430| 28.0k|} rsa_verify_raw_no_self_test: 437| 37.3k| size_t in_len, int padding) { 438| 37.3k| if (rsa->n == NULL || rsa->e == NULL) { ------------------ | Branch (438:7): [True: 0, False: 37.3k] | Branch (438:25): [True: 0, False: 37.3k] ------------------ 439| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_VALUE_MISSING); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 440| 0| return 0; 441| 0| } 442| | 443| 37.3k| if (!rsa_check_public_key(rsa)) { ------------------ | Branch (443:7): [True: 0, False: 37.3k] ------------------ 444| 0| return 0; 445| 0| } 446| | 447| 37.3k| const unsigned rsa_size = RSA_size(rsa); 448| 37.3k| if (max_out < rsa_size) { ------------------ | Branch (448:7): [True: 0, False: 37.3k] ------------------ 449| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_OUTPUT_BUFFER_TOO_SMALL); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 450| 0| return 0; 451| 0| } 452| | 453| 37.3k| if (in_len != rsa_size) { ------------------ | Branch (453:7): [True: 29.6k, False: 7.66k] ------------------ 454| 29.6k| OPENSSL_PUT_ERROR(RSA, RSA_R_DATA_LEN_NOT_EQUAL_TO_MOD_LEN); ------------------ | | 361| 29.6k| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 455| 29.6k| return 0; 456| 29.6k| } 457| | 458| 7.66k| bssl::UniquePtr ctx(BN_CTX_new()); 459| 7.66k| if (ctx == nullptr) { ------------------ | Branch (459:7): [True: 0, False: 7.66k] ------------------ 460| 0| return 0; 461| 0| } 462| | 463| 7.66k| int ret = 0; 464| 7.66k| uint8_t *buf = nullptr; 465| 7.66k| bssl::BN_CTXScope scope(ctx.get()); 466| 7.66k| BIGNUM *f = BN_CTX_get(ctx.get()); 467| 7.66k| BIGNUM *result = BN_CTX_get(ctx.get()); 468| 7.66k| if (f == nullptr || result == nullptr) { ------------------ | Branch (468:7): [True: 0, False: 7.66k] | Branch (468:23): [True: 0, False: 7.66k] ------------------ 469| 0| goto err; 470| 0| } 471| | 472| 7.66k| if (padding == RSA_NO_PADDING) { ------------------ | | 211| 7.66k|#define RSA_NO_PADDING 3 ------------------ | Branch (472:7): [True: 1.52k, False: 6.14k] ------------------ 473| 1.52k| buf = out; 474| 6.14k| } else { 475| | // Allocate a temporary buffer to hold the padded plaintext. 476| 6.14k| buf = reinterpret_cast(OPENSSL_malloc(rsa_size)); 477| 6.14k| if (buf == nullptr) { ------------------ | Branch (477:9): [True: 0, False: 6.14k] ------------------ 478| 0| goto err; 479| 0| } 480| 6.14k| } 481| | 482| 7.66k| if (BN_bin2bn(in, in_len, f) == nullptr) { ------------------ | Branch (482:7): [True: 0, False: 7.66k] ------------------ 483| 0| goto err; 484| 0| } 485| | 486| 7.66k| if (BN_ucmp(f, rsa->n) >= 0) { ------------------ | Branch (486:7): [True: 14, False: 7.65k] ------------------ 487| 14| OPENSSL_PUT_ERROR(RSA, RSA_R_DATA_TOO_LARGE_FOR_MODULUS); ------------------ | | 361| 14| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 488| 14| goto err; 489| 14| } 490| | 491| 7.65k| if (!BN_MONT_CTX_set_locked(&rsa->mont_n, &rsa->lock, rsa->n, ctx.get()) || ------------------ | Branch (491:7): [True: 0, False: 7.65k] ------------------ 492| 7.65k| !BN_mod_exp_mont(result, f, rsa->e, &rsa->mont_n->N, ctx.get(), ------------------ | Branch (492:7): [True: 0, False: 7.65k] ------------------ 493| 7.65k| rsa->mont_n)) { 494| 0| goto err; 495| 0| } 496| | 497| 7.65k| if (!BN_bn2bin_padded(buf, rsa_size, result)) { ------------------ | Branch (497:7): [True: 0, False: 7.65k] ------------------ 498| 0| OPENSSL_PUT_ERROR(RSA, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 499| 0| goto err; 500| 0| } 501| | 502| 7.65k| switch (padding) { 503| 6.14k| case RSA_PKCS1_PADDING: ------------------ | | 208| 6.14k|#define RSA_PKCS1_PADDING 1 ------------------ | Branch (503:5): [True: 6.14k, False: 1.50k] ------------------ 504| 6.14k| ret = 505| 6.14k| RSA_padding_check_PKCS1_type_1(out, out_len, rsa_size, buf, rsa_size); 506| 6.14k| break; 507| 1.50k| case RSA_NO_PADDING: ------------------ | | 211| 1.50k|#define RSA_NO_PADDING 3 ------------------ | Branch (507:5): [True: 1.50k, False: 6.14k] ------------------ 508| 1.50k| ret = 1; 509| 1.50k| *out_len = rsa_size; 510| 1.50k| break; 511| 0| default: ------------------ | Branch (511:5): [True: 0, False: 7.65k] ------------------ 512| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_UNKNOWN_PADDING_TYPE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 513| 0| goto err; 514| 7.65k| } 515| | 516| 7.65k| if (!ret) { ------------------ | Branch (516:7): [True: 2.39k, False: 5.25k] ------------------ 517| 2.39k| OPENSSL_PUT_ERROR(RSA, RSA_R_PADDING_CHECK_FAILED); ------------------ | | 361| 2.39k| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 518| 2.39k| goto err; 519| 2.39k| } 520| | 521| 7.66k|err: 522| 7.66k| if (buf != out) { ------------------ | Branch (522:7): [True: 6.14k, False: 1.52k] ------------------ 523| 6.14k| OPENSSL_free(buf); 524| 6.14k| } 525| 7.66k| return ret; 526| 7.65k|} RSA_verify_raw: 529| 1.52k| const uint8_t *in, size_t in_len, int padding) { 530| 1.52k| boringssl_ensure_rsa_self_test(); 531| 1.52k| return rsa_verify_raw_no_self_test(rsa, out_len, out, max_out, in, in_len, 532| 1.52k| padding); 533| 1.52k|} rsa_default_private_transform: 536| 28.0k| size_t len) { 537| 28.0k| if (rsa->n == nullptr || rsa->d == nullptr) { ------------------ | Branch (537:7): [True: 0, False: 28.0k] | Branch (537:28): [True: 0, False: 28.0k] ------------------ 538| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_VALUE_MISSING); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 539| 0| return 0; 540| 0| } 541| | 542| 28.0k| bssl::UniquePtr ctx(BN_CTX_new()); 543| 28.0k| if (ctx == nullptr) { ------------------ | Branch (543:7): [True: 0, False: 28.0k] ------------------ 544| 0| return 0; 545| 0| } 546| 28.0k| size_t blinding_index = 0; 547| 28.0k| BN_BLINDING *blinding = nullptr; 548| 28.0k| int ret = 0, do_blinding; 549| 28.0k| bssl::BN_CTXScope scope(ctx.get()); 550| 28.0k| BIGNUM *f = BN_CTX_get(ctx.get()); 551| 28.0k| BIGNUM *result = BN_CTX_get(ctx.get()); 552| 28.0k| if (f == nullptr || result == nullptr) { ------------------ | Branch (552:7): [True: 0, False: 28.0k] | Branch (552:23): [True: 0, False: 28.0k] ------------------ 553| 0| goto err; 554| 0| } 555| | 556| | // The caller should have ensured this. 557| 28.0k| assert(len == BN_num_bytes(rsa->n)); 558| 28.0k| if (BN_bin2bn(in, len, f) == nullptr) { ------------------ | Branch (558:7): [True: 0, False: 28.0k] ------------------ 559| 0| goto err; 560| 0| } 561| | 562| | // The input to the RSA private transform may be secret, but padding is 563| | // expected to construct a value within range, so we can leak this comparison. 564| 28.0k| if (constant_time_declassify_int(BN_ucmp(f, rsa->n) >= 0)) { ------------------ | Branch (564:7): [True: 0, False: 28.0k] ------------------ 565| | // Usually the padding functions would catch this. 566| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_DATA_TOO_LARGE_FOR_MODULUS); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 567| 0| goto err; 568| 0| } 569| | 570| 28.0k| if (!freeze_private_key(rsa, ctx.get())) { ------------------ | Branch (570:7): [True: 0, False: 28.0k] ------------------ 571| 0| OPENSSL_PUT_ERROR(RSA, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 572| 0| goto err; 573| 0| } 574| | 575| 28.0k| do_blinding = 576| 28.0k| (rsa->flags & (RSA_FLAG_NO_BLINDING | RSA_FLAG_NO_PUBLIC_EXPONENT)) == 0; ------------------ | | 637| 28.0k|#define RSA_FLAG_NO_BLINDING 8 ------------------ (rsa->flags & (RSA_FLAG_NO_BLINDING | RSA_FLAG_NO_PUBLIC_EXPONENT)) == 0; ------------------ | | 645| 28.0k|#define RSA_FLAG_NO_PUBLIC_EXPONENT 0x40 ------------------ 577| | 578| 28.0k| if (rsa->e == nullptr && do_blinding) { ------------------ | Branch (578:7): [True: 0, False: 28.0k] | Branch (578:28): [True: 0, False: 0] ------------------ 579| | // We cannot do blinding or verification without |e|, and continuing without 580| | // those countermeasures is dangerous. However, the Java/Android RSA API 581| | // requires support for keys where only |d| and |n| (and not |e|) are known. 582| | // The callers that require that bad behavior must set 583| | // |RSA_FLAG_NO_BLINDING| or use |RSA_new_private_key_no_e|. 584| | // 585| | // TODO(davidben): Update this comment when Conscrypt is updated to use 586| | // |RSA_new_private_key_no_e|. 587| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_NO_PUBLIC_EXPONENT); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 588| 0| goto err; 589| 0| } 590| | 591| 28.0k| if (do_blinding) { ------------------ | Branch (591:7): [True: 28.0k, False: 0] ------------------ 592| 28.0k| blinding = rsa_blinding_get(rsa, &blinding_index, ctx.get()); 593| 28.0k| if (blinding == nullptr) { ------------------ | Branch (593:9): [True: 0, False: 28.0k] ------------------ 594| 0| OPENSSL_PUT_ERROR(RSA, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 595| 0| goto err; 596| 0| } 597| 28.0k| if (!BN_BLINDING_convert(f, blinding, rsa->e, rsa->mont_n, ctx.get())) { ------------------ | Branch (597:9): [True: 0, False: 28.0k] ------------------ 598| 0| goto err; 599| 0| } 600| 28.0k| } 601| | 602| 28.0k| if (rsa->p != nullptr && rsa->q != nullptr && rsa->e != nullptr && ------------------ | Branch (602:7): [True: 28.0k, False: 0] | Branch (602:28): [True: 28.0k, False: 0] | Branch (602:49): [True: 28.0k, False: 0] ------------------ 603| 28.0k| rsa->dmp1 != nullptr && rsa->dmq1 != nullptr && rsa->iqmp != nullptr && ------------------ | Branch (603:7): [True: 28.0k, False: 0] | Branch (603:31): [True: 28.0k, False: 0] | Branch (603:55): [True: 28.0k, False: 0] ------------------ 604| | // Require that we can reduce |f| by |rsa->p| and |rsa->q| in constant 605| | // time, which requires primes be the same size, rounded to the Montgomery 606| | // coefficient. (See |mod_montgomery|.) This is not required by RFC 8017, 607| | // but it is true for keys generated by us and all common implementations. 608| 28.0k| bn_less_than_montgomery_R(rsa->q, rsa->mont_p) && ------------------ | Branch (608:7): [True: 28.0k, False: 0] ------------------ 609| 28.0k| bn_less_than_montgomery_R(rsa->p, rsa->mont_q)) { ------------------ | Branch (609:7): [True: 28.0k, False: 0] ------------------ 610| 28.0k| if (!rsa_mod_exp_crt(result, f, rsa, ctx.get())) { ------------------ | Branch (610:9): [True: 0, False: 28.0k] ------------------ 611| 0| goto err; 612| 0| } 613| 28.0k| } else if (!BN_mod_exp_mont_consttime(result, f, rsa->d_fixed, rsa->n, ------------------ | Branch (613:14): [True: 0, False: 0] ------------------ 614| 0| ctx.get(), rsa->mont_n)) { 615| 0| goto err; 616| 0| } 617| | 618| | // Verify the result to protect against fault attacks as described in the 619| | // 1997 paper "On the Importance of Checking Cryptographic Protocols for 620| | // Faults" by Dan Boneh, Richard A. DeMillo, and Richard J. Lipton. Some 621| | // implementations do this only when the CRT is used, but we do it in all 622| | // cases. Section 6 of the aforementioned paper describes an attack that 623| | // works when the CRT isn't used. That attack is much less likely to succeed 624| | // than the CRT attack, but there have likely been improvements since 1997. 625| | // 626| | // This check is cheap assuming |e| is small, which we require in 627| | // |rsa_check_public_key|. 628| 28.0k| if (rsa->e != nullptr) { ------------------ | Branch (628:7): [True: 28.0k, False: 0] ------------------ 629| 28.0k| BIGNUM *vrfy = BN_CTX_get(ctx.get()); 630| 28.0k| if (vrfy == nullptr || ------------------ | Branch (630:9): [True: 0, False: 28.0k] ------------------ 631| 28.0k| !BN_mod_exp_mont(vrfy, result, rsa->e, rsa->n, ctx.get(), ------------------ | Branch (631:9): [True: 0, False: 28.0k] ------------------ 632| 28.0k| rsa->mont_n) || 633| 28.0k| !constant_time_declassify_int(BN_equal_consttime(vrfy, f))) { ------------------ | Branch (633:9): [True: 0, False: 28.0k] ------------------ 634| 0| OPENSSL_PUT_ERROR(RSA, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 635| 0| goto err; 636| 0| } 637| 28.0k| } 638| | 639| 28.0k| if (do_blinding && ------------------ | Branch (639:7): [True: 28.0k, False: 0] ------------------ 640| 28.0k| !BN_BLINDING_invert(result, blinding, rsa->mont_n, ctx.get())) { ------------------ | Branch (640:7): [True: 0, False: 28.0k] ------------------ 641| 0| goto err; 642| 0| } 643| | 644| | // The computation should have left |result| as a maximally-wide number, so 645| | // that it and serializing does not leak information about the magnitude of 646| | // the result. 647| | // 648| | // See Falko Strenzke, "Manger's Attack revisited", ICICS 2010. 649| 28.0k| assert(result->width == rsa->mont_n->N.width); 650| 28.0k| bn_assert_fits_in_bytes(result, len); 651| 28.0k| if (!BN_bn2bin_padded(out, len, result)) { ------------------ | Branch (651:7): [True: 0, False: 28.0k] ------------------ 652| 0| OPENSSL_PUT_ERROR(RSA, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 653| 0| goto err; 654| 0| } 655| | 656| 28.0k| ret = 1; 657| | 658| 28.0k|err: 659| 28.0k| if (blinding != nullptr) { ------------------ | Branch (659:7): [True: 28.0k, False: 0] ------------------ 660| 28.0k| rsa_blinding_release(rsa, blinding, blinding_index); 661| 28.0k| } 662| | 663| 28.0k| return ret; 664| 28.0k|} bcm.cc:_ZL18freeze_private_keyP6rsa_stP10bignum_ctx: 125| 28.0k|static int freeze_private_key(RSA *rsa, BN_CTX *ctx) { 126| 28.0k| CRYPTO_MUTEX_lock_read(&rsa->lock); 127| 28.0k| int frozen = rsa->private_key_frozen; 128| 28.0k| CRYPTO_MUTEX_unlock_read(&rsa->lock); 129| 28.0k| if (frozen) { ------------------ | Branch (129:7): [True: 28.0k, False: 1] ------------------ 130| 28.0k| return 1; 131| 28.0k| } 132| | 133| 1| int ret = 0; 134| 1| const BIGNUM *n_fixed; 135| 1| CRYPTO_MUTEX_lock_write(&rsa->lock); 136| 1| if (rsa->private_key_frozen) { ------------------ | Branch (136:7): [True: 0, False: 1] ------------------ 137| 0| ret = 1; 138| 0| goto err; 139| 0| } 140| | 141| | // Check the public components are within DoS bounds. 142| 1| if (!rsa_check_public_key(rsa)) { ------------------ | Branch (142:7): [True: 0, False: 1] ------------------ 143| 0| goto err; 144| 0| } 145| | 146| | // Pre-compute various intermediate values, as well as copies of private 147| | // exponents with correct widths. Note that other threads may concurrently 148| | // read from |rsa->n|, |rsa->e|, etc., so any fixes must be in separate 149| | // copies. We use |mont_n->N|, |mont_p->N|, and |mont_q->N| as copies of |n|, 150| | // |p|, and |q| with the correct minimal widths. 151| | 152| 1| if (rsa->mont_n == NULL) { ------------------ | Branch (152:7): [True: 1, False: 0] ------------------ 153| 1| rsa->mont_n = BN_MONT_CTX_new_for_modulus(rsa->n, ctx); 154| 1| if (rsa->mont_n == NULL) { ------------------ | Branch (154:9): [True: 0, False: 1] ------------------ 155| 0| goto err; 156| 0| } 157| 1| } 158| 1| n_fixed = &rsa->mont_n->N; 159| | 160| | // The only public upper-bound of |rsa->d| is the bit length of |rsa->n|. The 161| | // ASN.1 serialization of RSA private keys unfortunately leaks the byte length 162| | // of |rsa->d|, but normalize it so we only leak it once, rather than per 163| | // operation. 164| 1| if (rsa->d != NULL && ------------------ | Branch (164:7): [True: 1, False: 0] ------------------ 165| 1| !ensure_fixed_copy(&rsa->d_fixed, rsa->d, n_fixed->width)) { ------------------ | Branch (165:7): [True: 0, False: 1] ------------------ 166| 0| goto err; 167| 0| } 168| | 169| 1| if (rsa->e != NULL && rsa->p != NULL && rsa->q != NULL) { ------------------ | Branch (169:7): [True: 1, False: 0] | Branch (169:25): [True: 1, False: 0] | Branch (169:43): [True: 1, False: 0] ------------------ 170| | // TODO: p and q are also CONSTTIME_SECRET but not yet marked as such 171| | // because the Montgomery code does things like test whether or not values 172| | // are zero. So the secret marking probably needs to happen inside that 173| | // code. 174| | 175| 1| if (rsa->mont_p == NULL) { ------------------ | Branch (175:9): [True: 1, False: 0] ------------------ 176| 1| rsa->mont_p = BN_MONT_CTX_new_consttime(rsa->p, ctx); 177| 1| if (rsa->mont_p == NULL) { ------------------ | Branch (177:11): [True: 0, False: 1] ------------------ 178| 0| goto err; 179| 0| } 180| 1| } 181| | 182| 1| if (rsa->mont_q == NULL) { ------------------ | Branch (182:9): [True: 1, False: 0] ------------------ 183| 1| rsa->mont_q = BN_MONT_CTX_new_consttime(rsa->q, ctx); 184| 1| if (rsa->mont_q == NULL) { ------------------ | Branch (184:11): [True: 0, False: 1] ------------------ 185| 0| goto err; 186| 0| } 187| 1| } 188| | 189| 1| if (rsa->dmp1 != NULL && rsa->dmq1 != NULL && rsa->iqmp != NULL) { ------------------ | Branch (189:9): [True: 1, False: 0] | Branch (189:30): [True: 1, False: 0] | Branch (189:51): [True: 1, False: 0] ------------------ 190| | // CRT components are only publicly bounded by their corresponding 191| | // moduli's bit lengths. 192| 1| const BIGNUM *p_fixed = &rsa->mont_p->N; 193| 1| const BIGNUM *q_fixed = &rsa->mont_q->N; 194| 1| if (!ensure_fixed_copy(&rsa->dmp1_fixed, rsa->dmp1, p_fixed->width) || ------------------ | Branch (194:11): [True: 0, False: 1] ------------------ 195| 1| !ensure_fixed_copy(&rsa->dmq1_fixed, rsa->dmq1, q_fixed->width)) { ------------------ | Branch (195:11): [True: 0, False: 1] ------------------ 196| 0| goto err; 197| 0| } 198| | 199| | // Compute |iqmp_mont|, which is |iqmp| in Montgomery form and with the 200| | // correct bit width. 201| 1| if (rsa->iqmp_mont == NULL) { ------------------ | Branch (201:11): [True: 1, False: 0] ------------------ 202| 1| BIGNUM *iqmp_mont = BN_new(); 203| 1| if (iqmp_mont == NULL || ------------------ | Branch (203:13): [True: 0, False: 1] ------------------ 204| 1| !BN_to_montgomery(iqmp_mont, rsa->iqmp, rsa->mont_p, ctx)) { ------------------ | Branch (204:13): [True: 0, False: 1] ------------------ 205| 0| BN_free(iqmp_mont); 206| 0| goto err; 207| 0| } 208| 1| rsa->iqmp_mont = iqmp_mont; 209| 1| bn_secret(rsa->iqmp_mont); 210| 1| } 211| 1| } 212| 1| } 213| | 214| 1| rsa->private_key_frozen = 1; 215| 1| ret = 1; 216| | 217| 1|err: 218| 1| CRYPTO_MUTEX_unlock_write(&rsa->lock); 219| 1| return ret; 220| 1|} bcm.cc:_ZL17ensure_fixed_copyPP9bignum_stPKS_i: 106| 3|static int ensure_fixed_copy(BIGNUM **out, const BIGNUM *in, int width) { 107| 3| if (*out != NULL) { ------------------ | Branch (107:7): [True: 0, False: 3] ------------------ 108| 0| return 1; 109| 0| } 110| 3| BIGNUM *copy = BN_dup(in); 111| 3| if (copy == NULL || !bn_resize_words(copy, width)) { ------------------ | Branch (111:7): [True: 0, False: 3] | Branch (111:23): [True: 0, False: 3] ------------------ 112| 0| BN_free(copy); 113| 0| return 0; 114| 0| } 115| 3| *out = copy; 116| 3| bn_secret(copy); 117| | 118| 3| return 1; 119| 3|} bcm.cc:_ZL16rsa_blinding_getP6rsa_stPmP10bignum_ctx: 270| 28.0k| BN_CTX *ctx) { 271| 28.0k| assert(ctx != NULL); 272| 28.0k| assert(rsa->mont_n != NULL); 273| | 274| 28.0k| BN_BLINDING *ret = NULL; 275| 28.0k| const uint64_t fork_generation = CRYPTO_get_fork_generation(); 276| 28.0k| CRYPTO_MUTEX_lock_write(&rsa->lock); 277| | 278| | // Wipe the blinding cache on |fork|. 279| 28.0k| if (rsa->blinding_fork_generation != fork_generation) { ------------------ | Branch (279:7): [True: 1, False: 28.0k] ------------------ 280| 1| for (size_t i = 0; i < rsa->num_blindings; i++) { ------------------ | Branch (280:24): [True: 0, False: 1] ------------------ 281| | // The inuse flag must be zero unless we were forked from a 282| | // multi-threaded process, in which case calling back into BoringSSL is 283| | // forbidden. 284| 0| assert(rsa->blindings_inuse[i] == 0); 285| 0| BN_BLINDING_invalidate(rsa->blindings[i]); 286| 0| } 287| 1| rsa->blinding_fork_generation = fork_generation; 288| 1| } 289| | 290| 28.0k| uint8_t *const free_inuse_flag = reinterpret_cast( 291| 28.0k| OPENSSL_memchr(rsa->blindings_inuse, 0, rsa->num_blindings)); 292| 28.0k| size_t new_num_blindings; 293| 28.0k| BN_BLINDING **new_blindings; 294| 28.0k| uint8_t *new_blindings_inuse; 295| 28.0k| if (free_inuse_flag != NULL) { ------------------ | Branch (295:7): [True: 28.0k, False: 1] ------------------ 296| 28.0k| *free_inuse_flag = 1; 297| 28.0k| *index_used = free_inuse_flag - rsa->blindings_inuse; 298| 28.0k| ret = rsa->blindings[*index_used]; 299| 28.0k| goto out; 300| 28.0k| } 301| | 302| 1| if (rsa->num_blindings >= MAX_BLINDINGS_PER_RSA) { ------------------ | | 259| 1|#define MAX_BLINDINGS_PER_RSA 1024 ------------------ | Branch (302:7): [True: 0, False: 1] ------------------ 303| | // No |BN_BLINDING| is free and nor can the cache be extended. This index 304| | // value is magic and indicates to |rsa_blinding_release| that a 305| | // |BN_BLINDING| was not inserted into the array. 306| 0| *index_used = MAX_BLINDINGS_PER_RSA; ------------------ | | 259| 0|#define MAX_BLINDINGS_PER_RSA 1024 ------------------ 307| 0| ret = BN_BLINDING_new(); 308| 0| goto out; 309| 0| } 310| | 311| | // Double the length of the cache. 312| 1| static_assert(MAX_BLINDINGS_PER_RSA < UINT_MAX / 2, 313| 1| "MAX_BLINDINGS_PER_RSA too large"); 314| 1| new_num_blindings = rsa->num_blindings * 2; 315| 1| if (new_num_blindings == 0) { ------------------ | Branch (315:7): [True: 1, False: 0] ------------------ 316| 1| new_num_blindings = 1; 317| 1| } 318| 1| if (new_num_blindings > MAX_BLINDINGS_PER_RSA) { ------------------ | | 259| 1|#define MAX_BLINDINGS_PER_RSA 1024 ------------------ | Branch (318:7): [True: 0, False: 1] ------------------ 319| 0| new_num_blindings = MAX_BLINDINGS_PER_RSA; ------------------ | | 259| 0|#define MAX_BLINDINGS_PER_RSA 1024 ------------------ 320| 0| } 321| 1| assert(new_num_blindings > rsa->num_blindings); 322| | 323| 1| new_blindings = reinterpret_cast( 324| 1| OPENSSL_calloc(new_num_blindings, sizeof(BN_BLINDING *))); 325| 1| new_blindings_inuse = 326| 1| reinterpret_cast(OPENSSL_malloc(new_num_blindings)); 327| 1| if (new_blindings == NULL || new_blindings_inuse == NULL) { ------------------ | Branch (327:7): [True: 0, False: 1] | Branch (327:32): [True: 0, False: 1] ------------------ 328| 0| goto err; 329| 0| } 330| | 331| 1| OPENSSL_memcpy(new_blindings, rsa->blindings, 332| 1| sizeof(BN_BLINDING *) * rsa->num_blindings); 333| 1| OPENSSL_memcpy(new_blindings_inuse, rsa->blindings_inuse, rsa->num_blindings); 334| | 335| 2| for (size_t i = rsa->num_blindings; i < new_num_blindings; i++) { ------------------ | Branch (335:39): [True: 1, False: 1] ------------------ 336| 1| new_blindings[i] = BN_BLINDING_new(); 337| 1| if (new_blindings[i] == NULL) { ------------------ | Branch (337:9): [True: 0, False: 1] ------------------ 338| 0| for (size_t j = rsa->num_blindings; j < i; j++) { ------------------ | Branch (338:43): [True: 0, False: 0] ------------------ 339| 0| BN_BLINDING_free(new_blindings[j]); 340| 0| } 341| 0| goto err; 342| 0| } 343| 1| } 344| 1| memset(&new_blindings_inuse[rsa->num_blindings], 0, 345| 1| new_num_blindings - rsa->num_blindings); 346| | 347| 1| new_blindings_inuse[rsa->num_blindings] = 1; 348| 1| *index_used = rsa->num_blindings; 349| 1| assert(*index_used != MAX_BLINDINGS_PER_RSA); 350| 1| ret = new_blindings[rsa->num_blindings]; 351| | 352| 1| OPENSSL_free(rsa->blindings); 353| 1| rsa->blindings = new_blindings; 354| 1| OPENSSL_free(rsa->blindings_inuse); 355| 1| rsa->blindings_inuse = new_blindings_inuse; 356| 1| rsa->num_blindings = new_num_blindings; 357| | 358| 1| goto out; 359| | 360| 0|err: 361| 0| OPENSSL_free(new_blindings_inuse); 362| 0| OPENSSL_free(new_blindings); 363| | 364| 28.0k|out: 365| 28.0k| CRYPTO_MUTEX_unlock_write(&rsa->lock); 366| 28.0k| return ret; 367| 0|} bcm.cc:_ZL20rsa_blinding_releaseP6rsa_stP14bn_blinding_stm: 372| 28.0k| size_t blinding_index) { 373| 28.0k| if (blinding_index == MAX_BLINDINGS_PER_RSA) { ------------------ | | 259| 28.0k|#define MAX_BLINDINGS_PER_RSA 1024 ------------------ | Branch (373:7): [True: 0, False: 28.0k] ------------------ 374| | // This blinding wasn't cached. 375| 0| BN_BLINDING_free(blinding); 376| 0| return; 377| 0| } 378| | 379| 28.0k| CRYPTO_MUTEX_lock_write(&rsa->lock); 380| 28.0k| rsa->blindings_inuse[blinding_index] = 0; 381| 28.0k| CRYPTO_MUTEX_unlock_write(&rsa->lock); 382| 28.0k|} bcm.cc:_ZL15rsa_mod_exp_crtP9bignum_stPKS_P6rsa_stP10bignum_ctx: 697| 28.0k|static int rsa_mod_exp_crt(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx) { 698| 28.0k| assert(ctx != NULL); 699| | 700| 28.0k| assert(rsa->n != NULL); 701| 28.0k| assert(rsa->e != NULL); 702| 28.0k| assert(rsa->d != NULL); 703| 28.0k| assert(rsa->p != NULL); 704| 28.0k| assert(rsa->q != NULL); 705| 28.0k| assert(rsa->dmp1 != NULL); 706| 28.0k| assert(rsa->dmq1 != NULL); 707| 28.0k| assert(rsa->iqmp != NULL); 708| | 709| 28.0k| bssl::BN_CTXScope scope(ctx); 710| 28.0k| BIGNUM *r1 = BN_CTX_get(ctx); 711| 28.0k| BIGNUM *m1 = BN_CTX_get(ctx); 712| 28.0k| if (r1 == NULL || m1 == NULL) { ------------------ | Branch (712:7): [True: 0, False: 28.0k] | Branch (712:21): [True: 0, False: 28.0k] ------------------ 713| 0| return 0; 714| 0| } 715| | 716| | // Use the minimal-width versions of |n|, |p|, and |q|. Either works, but if 717| | // someone gives us non-minimal values, these will be slightly more efficient 718| | // on the non-Montgomery operations. 719| 28.0k| BIGNUM *n = &rsa->mont_n->N; 720| 28.0k| BIGNUM *p = &rsa->mont_p->N; 721| 28.0k| BIGNUM *q = &rsa->mont_q->N; 722| | 723| | // This is a pre-condition for |mod_montgomery|. It was already checked by the 724| | // caller. 725| 28.0k| declassify_assert(BN_ucmp(I, n) < 0); ------------------ | | 493| 28.0k|#define declassify_assert(expr) assert(constant_time_declassify_int(expr)) ------------------ 726| | 727| 28.0k| if ( // |m1| is the result modulo |q|. 728| 28.0k| !mod_montgomery(r1, I, q, rsa->mont_q, p, ctx) || ------------------ | Branch (728:7): [True: 0, False: 28.0k] ------------------ 729| 28.0k| !BN_mod_exp_mont_consttime(m1, r1, rsa->dmq1_fixed, q, ctx, ------------------ | Branch (729:7): [True: 0, False: 28.0k] ------------------ 730| 28.0k| rsa->mont_q) || 731| | // |r0| is the result modulo |p|. 732| 28.0k| !mod_montgomery(r1, I, p, rsa->mont_p, q, ctx) || ------------------ | Branch (732:7): [True: 0, False: 28.0k] ------------------ 733| 28.0k| !BN_mod_exp_mont_consttime(r0, r1, rsa->dmp1_fixed, p, ctx, ------------------ | Branch (733:7): [True: 0, False: 28.0k] ------------------ 734| 28.0k| rsa->mont_p) || 735| | // Compute r0 = r0 - m1 mod p. |m1| is reduced mod |q|, not |p|, so we 736| | // just run |mod_montgomery| again for simplicity. This could be more 737| | // efficient with more cases: if |p > q|, |m1| is already reduced. If 738| | // |p < q| but they have the same bit width, |bn_reduce_once| suffices. 739| | // However, compared to over 2048 Montgomery multiplications above, this 740| | // difference is not measurable. 741| 28.0k| !mod_montgomery(r1, m1, p, rsa->mont_p, q, ctx) || ------------------ | Branch (741:7): [True: 0, False: 28.0k] ------------------ 742| 28.0k| !bn_mod_sub_consttime(r0, r0, r1, p, ctx) || ------------------ | Branch (742:7): [True: 0, False: 28.0k] ------------------ 743| | // r0 = r0 * iqmp mod p. We use Montgomery multiplication to compute this 744| | // in constant time. |iqmp_mont| is in Montgomery form and r0 is not, so 745| | // the result is taken out of Montgomery form. 746| 28.0k| !BN_mod_mul_montgomery(r0, r0, rsa->iqmp_mont, rsa->mont_p, ctx) || ------------------ | Branch (746:7): [True: 0, False: 28.0k] ------------------ 747| | // r0 = r0 * q + m1 gives the final result. Reducing modulo q gives m1, so 748| | // it is correct mod p. Reducing modulo p gives (r0-m1)*iqmp*q + m1 = r0, 749| | // so it is correct mod q. Finally, the result is bounded by [m1, n + m1), 750| | // and the result is at least |m1|, so this must be the unique answer in 751| | // [0, n). 752| 28.0k| !bn_mul_consttime(r0, r0, q, ctx) || // ------------------ | Branch (752:7): [True: 0, False: 28.0k] ------------------ 753| 28.0k| !bn_uadd_consttime(r0, r0, m1)) { ------------------ | Branch (753:7): [True: 0, False: 28.0k] ------------------ 754| 0| return 0; 755| 0| } 756| | 757| | // The result should be bounded by |n|, but fixed-width operations may 758| | // bound the width slightly higher, so fix it. This trips constant-time checks 759| | // because a naive data flow analysis does not realize the excess words are 760| | // publicly zero. 761| 28.0k| declassify_assert(BN_cmp(r0, n) < 0); ------------------ | | 493| 28.0k|#define declassify_assert(expr) assert(constant_time_declassify_int(expr)) ------------------ 762| 28.0k| bn_assert_fits_in_bytes(r0, BN_num_bytes(n)); 763| 28.0k| if (!bn_resize_words(r0, n->width)) { ------------------ | Branch (763:7): [True: 0, False: 28.0k] ------------------ 764| 0| return 0; 765| 0| } 766| | 767| 28.0k| return 1; 768| 28.0k|} bcm.cc:_ZL14mod_montgomeryP9bignum_stPKS_S2_PK14bn_mont_ctx_stS2_P10bignum_ctx: 670| 84.0k| BN_CTX *ctx) { 671| | // Reducing in constant-time with Montgomery reduction requires I <= p * R. We 672| | // have I < p * q, so this follows if q < R. The caller should have checked 673| | // this already. 674| 84.0k| if (!bn_less_than_montgomery_R(q, mont_p)) { ------------------ | Branch (674:7): [True: 0, False: 84.0k] ------------------ 675| 0| OPENSSL_PUT_ERROR(RSA, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 676| 0| return 0; 677| 0| } 678| | 679| 84.0k| if ( // Reduce mod p with Montgomery reduction. This computes I * R^-1 mod p. 680| 84.0k| !BN_from_montgomery(r, I, mont_p, ctx) || ------------------ | Branch (680:7): [True: 0, False: 84.0k] ------------------ 681| | // Multiply by R^2 and do another Montgomery reduction to compute 682| | // I * R^-1 * R^2 * R^-1 = I mod p. 683| 84.0k| !BN_to_montgomery(r, r, mont_p, ctx)) { ------------------ | Branch (683:7): [True: 0, False: 84.0k] ------------------ 684| 0| return 0; 685| 0| } 686| | 687| | // By precomputing R^3 mod p (normally |BN_MONT_CTX| only uses R^2 mod p) and 688| | // adjusting the API for |BN_mod_exp_mont_consttime|, we could instead compute 689| | // I * R mod p here and save a reduction per prime. But this would require 690| | // changing the RSAZ code and may not be worth it. Note that the RSAZ code 691| | // uses a different radix, so it uses R' = 2^1044. There we'd actually want 692| | // R^2 * R', and would futher benefit from a precomputed R'^2. It currently 693| | // converts |mont_p->RR| to R'^2. 694| 84.0k| return 1; 695| 84.0k|} bcm.cc:_ZL26RSA_default_method_do_initP11rsa_meth_st: 1272| 2|DEFINE_METHOD_FUNCTION(RSA_METHOD, RSA_default_method) { 1273| | // All of the methods are NULL to make it easier for the compiler/linker to 1274| | // drop unused functions. The wrapper functions will select the appropriate 1275| | // |rsa_default_*| implementation. 1276| 2| OPENSSL_memset(out, 0, sizeof(RSA_METHOD)); 1277| 2| out->common.is_static = 1; 1278| 2|} _Z35FIPS_service_indicator_update_statev: 75| 2.45M|inline void FIPS_service_indicator_update_state(void) {} _Z33FIPS_service_indicator_lock_statev: 76| 1.52M|inline void FIPS_service_indicator_lock_state(void) {} _Z35FIPS_service_indicator_unlock_statev: 77| 1.52M|inline void FIPS_service_indicator_unlock_state(void) {} _Z39EVP_DigestSign_verify_service_indicatorPK13env_md_ctx_st: 95| 56.0k| [[maybe_unused]] const EVP_MD_CTX *ctx) {} _Z29HMAC_verify_service_indicatorPK9env_md_st: 101| 778k| [[maybe_unused]] const EVP_MD *evp_md) {} _Z31TLSKDF_verify_service_indicatorPK9env_md_st: 104| 212k| [[maybe_unused]] const EVP_MD *dgst) {} sha1_hw_capable: 123| 216k|inline int sha1_hw_capable(void) { 124| 216k| return CRYPTO_is_x86_SHA_capable() && CRYPTO_is_SSSE3_capable(); ------------------ | Branch (124:10): [True: 216k, False: 0] | Branch (124:41): [True: 216k, False: 0] ------------------ 125| 216k|} sha256_hw_capable: 150| 3.04M|inline int sha256_hw_capable(void) { 151| | // Note that the original assembly did not check SSSE3. 152| 3.04M| return CRYPTO_is_x86_SHA_capable() && CRYPTO_is_SSSE3_capable(); ------------------ | Branch (152:10): [True: 3.04M, False: 0] | Branch (152:41): [True: 3.04M, False: 0] ------------------ 153| 3.04M|} sha512_avx_capable: 170| 450k|inline int sha512_avx_capable(void) { 171| | // AMD CPUs have slow SHLD/SHRD. See also the discussion in sha1-586.pl. 172| | // 173| | // TODO(crbug.com/42290564): Fixing and enabling the AVX2 implementation would 174| | // mitigate this on newer AMD CPUs. 175| 450k| return CRYPTO_is_AVX_capable() && CRYPTO_is_intel_cpu(); ------------------ | Branch (175:10): [True: 450k, False: 0] | Branch (175:37): [True: 0, False: 450k] ------------------ 176| 450k|} BCM_sha1_init: 27| 140k|bcm_infallible BCM_sha1_init(SHA_CTX *sha) { 28| 140k| OPENSSL_memset(sha, 0, sizeof(SHA_CTX)); 29| 140k| sha->h[0] = 0x67452301UL; 30| 140k| sha->h[1] = 0xefcdab89UL; 31| 140k| sha->h[2] = 0x98badcfeUL; 32| 140k| sha->h[3] = 0x10325476UL; 33| 140k| sha->h[4] = 0xc3d2e1f0UL; 34| 140k| return bcm_infallible::approved; 35| 140k|} BCM_sha1_update: 59| 229k|bcm_infallible BCM_sha1_update(SHA_CTX *c, const void *data, size_t len) { 60| 229k| bssl::crypto_md32_update( 61| 229k| c, bssl::Span(static_cast(data), len)); 62| 229k| return bcm_infallible::approved; 63| 229k|} BCM_sha1_final: 74| 53.6k|bcm_infallible BCM_sha1_final(uint8_t out[SHA_DIGEST_LENGTH], SHA_CTX *c) { 75| 53.6k| bssl::crypto_md32_final(c); 76| 53.6k| sha1_output_state(out, c); 77| 53.6k| FIPS_service_indicator_update_state(); 78| 53.6k| return bcm_infallible::approved; 79| 53.6k|} bcm.cc:_ZL17sha1_output_statePhPK12sha_state_st: 66| 53.6k| const SHA_CTX *ctx) { 67| 53.6k| CRYPTO_store_u32_be(out, ctx->h[0]); 68| 53.6k| CRYPTO_store_u32_be(out + 4, ctx->h[1]); 69| 53.6k| CRYPTO_store_u32_be(out + 8, ctx->h[2]); 70| 53.6k| CRYPTO_store_u32_be(out + 12, ctx->h[3]); 71| 53.6k| CRYPTO_store_u32_be(out + 16, ctx->h[4]); 72| 53.6k|} bcm.cc:_ZL21sha1_block_data_orderPjPKhm: 349| 216k| size_t num) { 350| 216k|#if defined(SHA1_ASM_HW) 351| 216k| if (sha1_hw_capable()) { ------------------ | Branch (351:7): [True: 216k, False: 0] ------------------ 352| 216k| sha1_block_data_order_hw(state, data, num); 353| 216k| return; 354| 216k| } 355| 0|#endif 356| 0|#if defined(SHA1_ASM_AVX2) 357| 0| if (sha1_avx2_capable()) { ------------------ | Branch (357:7): [True: 0, False: 0] ------------------ 358| 0| sha1_block_data_order_avx2(state, data, num); 359| 0| return; 360| 0| } 361| 0|#endif 362| 0|#if defined(SHA1_ASM_AVX) 363| 0| if (sha1_avx_capable()) { ------------------ | Branch (363:7): [True: 0, False: 0] ------------------ 364| 0| sha1_block_data_order_avx(state, data, num); 365| 0| return; 366| 0| } 367| 0|#endif 368| 0|#if defined(SHA1_ASM_SSSE3) 369| 0| if (sha1_ssse3_capable()) { ------------------ | Branch (369:7): [True: 0, False: 0] ------------------ 370| 0| sha1_block_data_order_ssse3(state, data, num); 371| 0| return; 372| 0| } 373| 0|#endif 374| |#if defined(SHA1_ASM_NEON) 375| | if (CRYPTO_is_NEON_capable()) { 376| | sha1_block_data_order_neon(state, data, num); 377| | return; 378| | } 379| |#endif 380| 0| sha1_block_data_order_nohw(state, data, num); 381| 0|} bcm.cc:_ZN12_GLOBAL__N_110SHA1Traits10HashBlocksEPjPKhm: 53| 216k| size_t num_blocks) { 54| 216k| sha1_block_data_order(state, data, num_blocks); 55| 216k| } BCM_sha256_init: 41| 515k|bcm_infallible BCM_sha256_init(SHA256_CTX *sha) { 42| 515k| OPENSSL_memset(sha, 0, sizeof(SHA256_CTX)); 43| 515k| sha->h[0] = 0x6a09e667UL; 44| 515k| sha->h[1] = 0xbb67ae85UL; 45| 515k| sha->h[2] = 0x3c6ef372UL; 46| 515k| sha->h[3] = 0xa54ff53aUL; 47| 515k| sha->h[4] = 0x510e527fUL; 48| 515k| sha->h[5] = 0x9b05688cUL; 49| 515k| sha->h[6] = 0x1f83d9abUL; 50| 515k| sha->h[7] = 0x5be0cd19UL; 51| 515k| sha->md_len = BCM_SHA256_DIGEST_LENGTH; ------------------ | | 158| 515k|#define BCM_SHA256_DIGEST_LENGTH 32 ------------------ 52| 515k| return bcm_infallible::approved; 53| 515k|} BCM_sha256_update: 78| 3.55M|bcm_infallible BCM_sha256_update(SHA256_CTX *c, const void *data, size_t len) { 79| 3.55M| bssl::crypto_md32_update( 80| 3.55M| c, bssl::Span(static_cast(data), len)); 81| 3.55M| return bcm_infallible::approved; 82| 3.55M|} BCM_sha256_final: 105| 1.62M| SHA256_CTX *c) { 106| | // Ideally we would assert |sha->md_len| is |BCM_SHA256_DIGEST_LENGTH| to 107| | // match the size hint, but calling code often pairs |SHA224_Init| with 108| | // |SHA256_Final| and expects |sha->md_len| to carry the size over. 109| | // 110| | // TODO(davidben): Add an assert and fix code to match them up. 111| 1.62M| sha256_final_impl(out, c->md_len, c); 112| 1.62M| return bcm_infallible::approved; 113| 1.62M|} bcm.cc:_ZL17sha256_final_implPhmP15sha256_state_st: 89| 1.62M|static void sha256_final_impl(uint8_t *out, size_t md_len, SHA256_CTX *c) { 90| 1.62M| bssl::crypto_md32_final(c); 91| | 92| 1.62M| BSSL_CHECK(md_len <= BCM_SHA256_DIGEST_LENGTH); ------------------ | | 384| 1.62M| do { \ | | 385| 1.62M| if (!(condition)) { \ | | ------------------ | | | Branch (385:9): [True: 0, False: 1.62M] | | ------------------ | | 386| 0| abort(); \ | | 387| 0| } \ | | 388| 1.62M| } while (0); | | ------------------ | | | Branch (388:12): [Folded - Ignored] | | ------------------ ------------------ 93| | 94| 1.62M| assert(md_len % 4 == 0); 95| 1.62M| const size_t out_words = md_len / 4; 96| 14.6M| for (size_t i = 0; i < out_words; i++) { ------------------ | Branch (96:22): [True: 13.0M, False: 1.62M] ------------------ 97| 13.0M| CRYPTO_store_u32_be(out, c->h[i]); 98| 13.0M| out += 4; 99| 13.0M| } 100| | 101| 1.62M| FIPS_service_indicator_update_state(); 102| 1.62M|} bcm.cc:_ZN12_GLOBAL__N_112SHA256Traits10HashBlocksEPjPKhm: 72| 3.04M| size_t num_blocks) { 73| 3.04M| sha256_block_data_order(state, data, num_blocks); 74| 3.04M| } bcm.cc:_ZL23sha256_block_data_orderPjPKhm: 265| 3.04M| size_t num) { 266| 3.04M|#if defined(SHA256_ASM_HW) 267| 3.04M| if (sha256_hw_capable()) { ------------------ | Branch (267:7): [True: 3.04M, False: 0] ------------------ 268| 3.04M| sha256_block_data_order_hw(state, data, num); 269| 3.04M| return; 270| 3.04M| } 271| 0|#endif 272| 0|#if defined(SHA256_ASM_AVX) 273| 0| if (sha256_avx_capable()) { ------------------ | Branch (273:7): [True: 0, False: 0] ------------------ 274| 0| sha256_block_data_order_avx(state, data, num); 275| 0| return; 276| 0| } 277| 0|#endif 278| 0|#if defined(SHA256_ASM_SSSE3) 279| 0| if (sha256_ssse3_capable()) { ------------------ | Branch (279:7): [True: 0, False: 0] ------------------ 280| 0| sha256_block_data_order_ssse3(state, data, num); 281| 0| return; 282| 0| } 283| 0|#endif 284| |#if defined(SHA256_ASM_NEON) 285| | if (CRYPTO_is_NEON_capable()) { 286| | sha256_block_data_order_neon(state, data, num); 287| | return; 288| | } 289| |#endif 290| 0| sha256_block_data_order_nohw(state, data, num); 291| 0|} BCM_sha384_init: 33| 252k|bcm_infallible BCM_sha384_init(SHA512_CTX *sha) { 34| 252k| sha->h[0] = UINT64_C(0xcbbb9d5dc1059ed8); 35| 252k| sha->h[1] = UINT64_C(0x629a292a367cd507); 36| 252k| sha->h[2] = UINT64_C(0x9159015a3070dd17); 37| 252k| sha->h[3] = UINT64_C(0x152fecd8f70e5939); 38| 252k| sha->h[4] = UINT64_C(0x67332667ffc00b31); 39| 252k| sha->h[5] = UINT64_C(0x8eb44a8768581511); 40| 252k| sha->h[6] = UINT64_C(0xdb0c2e0d64f98fa7); 41| 252k| sha->h[7] = UINT64_C(0x47b5481dbefa4fa4); 42| | 43| 252k| sha->bytes_so_far_low = 0; 44| 252k| sha->bytes_so_far_high = 0; 45| 252k| sha->num = 0; 46| 252k| sha->md_len = BCM_SHA384_DIGEST_LENGTH; ------------------ | | 189| 252k|#define BCM_SHA384_DIGEST_LENGTH 48 ------------------ 47| 252k| return bcm_infallible::approved; 48| 252k|} BCM_sha512_init: 51| 4.83k|bcm_infallible BCM_sha512_init(SHA512_CTX *sha) { 52| 4.83k| sha->h[0] = UINT64_C(0x6a09e667f3bcc908); 53| 4.83k| sha->h[1] = UINT64_C(0xbb67ae8584caa73b); 54| 4.83k| sha->h[2] = UINT64_C(0x3c6ef372fe94f82b); 55| 4.83k| sha->h[3] = UINT64_C(0xa54ff53a5f1d36f1); 56| 4.83k| sha->h[4] = UINT64_C(0x510e527fade682d1); 57| 4.83k| sha->h[5] = UINT64_C(0x9b05688c2b3e6c1f); 58| 4.83k| sha->h[6] = UINT64_C(0x1f83d9abfb41bd6b); 59| 4.83k| sha->h[7] = UINT64_C(0x5be0cd19137e2179); 60| | 61| 4.83k| sha->bytes_so_far_low = 0; 62| 4.83k| sha->bytes_so_far_high = 0; 63| 4.83k| sha->num = 0; 64| 4.83k| sha->md_len = BCM_SHA512_DIGEST_LENGTH; ------------------ | | 207| 4.83k|#define BCM_SHA512_DIGEST_LENGTH 64 ------------------ 65| 4.83k| return bcm_infallible::approved; 66| 4.83k|} BCM_sha384_final: 92| 326k| SHA512_CTX *sha) { 93| | // This function must be paired with |BCM_sha384_init|, which sets 94| | // |sha->md_len| to |BCM_SHA384_DIGEST_LENGTH|. 95| 326k| assert(sha->md_len == BCM_SHA384_DIGEST_LENGTH); 96| 326k| sha512_final_impl(out, BCM_SHA384_DIGEST_LENGTH, sha); ------------------ | | 189| 326k|#define BCM_SHA384_DIGEST_LENGTH 48 ------------------ 97| 326k| return bcm_infallible::approved; 98| 326k|} BCM_sha384_update: 101| 697k| size_t len) { 102| 697k| return BCM_sha512_update(sha, data, len); 103| 697k|} BCM_sha512_update: 126| 704k| size_t len) { 127| 704k| uint8_t *p = c->p; 128| 704k| const uint8_t *data = reinterpret_cast(in_data); 129| | 130| 704k| if (len == 0) { ------------------ | Branch (130:7): [True: 29.9k, False: 674k] ------------------ 131| 29.9k| return bcm_infallible::approved; 132| 29.9k| } 133| | 134| 674k| c->bytes_so_far_low += len; 135| 674k| if (c->bytes_so_far_low < len) { ------------------ | Branch (135:7): [True: 0, False: 674k] ------------------ 136| 0| c->bytes_so_far_high++; 137| 0| } 138| | 139| 674k| if (c->num != 0) { ------------------ | Branch (139:7): [True: 320k, False: 353k] ------------------ 140| 320k| size_t n = sizeof(c->p) - c->num; 141| | 142| 320k| if (len < n) { ------------------ | Branch (142:9): [True: 303k, False: 17.1k] ------------------ 143| 303k| OPENSSL_memcpy(p + c->num, data, len); 144| 303k| c->num += (unsigned int)len; 145| 303k| return bcm_infallible::approved; 146| 303k| } else { 147| 17.1k| OPENSSL_memcpy(p + c->num, data, n), c->num = 0; 148| 17.1k| len -= n; 149| 17.1k| data += n; 150| 17.1k| sha512_block_data_order(c->h, p, 1); 151| 17.1k| } 152| 320k| } 153| | 154| 370k| if (len >= sizeof(c->p)) { ------------------ | Branch (154:7): [True: 86.1k, False: 284k] ------------------ 155| 86.1k| sha512_block_data_order(c->h, data, len / sizeof(c->p)); 156| 86.1k| data += len; 157| 86.1k| len %= sizeof(c->p); 158| 86.1k| data -= len; 159| 86.1k| } 160| | 161| 370k| if (len != 0) { ------------------ | Branch (161:7): [True: 329k, False: 41.4k] ------------------ 162| 329k| OPENSSL_memcpy(p, data, len); 163| 329k| c->num = (int)len; 164| 329k| } 165| | 166| 370k| return bcm_infallible::approved; 167| 674k|} BCM_sha512_final: 170| 4.83k| SHA512_CTX *sha) { 171| | // Ideally we would assert |sha->md_len| is |BCM_SHA512_DIGEST_LENGTH| to 172| | // match the size hint, but calling code often pairs |BCM_sha384_init| with 173| | // |BCM_sha512_final| and expects |sha->md_len| to carry the size over. 174| | // 175| | // TODO(davidben): Add an assert and fix code to match them up. 176| 4.83k| sha512_final_impl(out, sha->md_len, sha); 177| 4.83k| return bcm_infallible::approved; 178| 4.83k|} bcm.cc:_ZL17sha512_final_implPhmP15sha512_state_st: 180| 331k|static void sha512_final_impl(uint8_t *out, size_t md_len, SHA512_CTX *sha) { 181| 331k| uint8_t *p = sha->p; 182| 331k| size_t n = sha->num; 183| | 184| 331k| p[n] = 0x80; // There always is a room for one 185| 331k| n++; 186| 331k| if (n > (sizeof(sha->p) - 16)) { ------------------ | Branch (186:7): [True: 15.0k, False: 316k] ------------------ 187| 15.0k| OPENSSL_memset(p + n, 0, sizeof(sha->p) - n); 188| 15.0k| n = 0; 189| 15.0k| sha512_block_data_order(sha->h, p, 1); 190| 15.0k| } 191| | 192| 331k| OPENSSL_memset(p + n, 0, sizeof(sha->p) - 16 - n); 193| 331k| const uint64_t Nh = (uint64_t{sha->bytes_so_far_high} << 3) | 194| 331k| (sha->bytes_so_far_low >> (64 - 3)); 195| 331k| const uint64_t Nl = sha->bytes_so_far_low << 3; 196| 331k| CRYPTO_store_u64_be(p + sizeof(sha->p) - 16, Nh); 197| 331k| CRYPTO_store_u64_be(p + sizeof(sha->p) - 8, Nl); 198| | 199| 331k| sha512_block_data_order(sha->h, p, 1); 200| | 201| 331k| assert(md_len % 8 == 0); 202| 331k| const size_t out_words = md_len / 8; 203| 2.33M| for (size_t i = 0; i < out_words; i++) { ------------------ | Branch (203:22): [True: 2.00M, False: 331k] ------------------ 204| 2.00M| CRYPTO_store_u64_be(out, sha->h[i]); 205| 2.00M| out += 8; 206| 2.00M| } 207| | 208| 331k| FIPS_service_indicator_update_state(); 209| 331k|} bcm.cc:_ZL23sha512_block_data_orderPmPKhm: 434| 450k| size_t num) { 435| |#if defined(SHA512_ASM_HW) 436| | if (sha512_hw_capable()) { 437| | sha512_block_data_order_hw(state, data, num); 438| | return; 439| | } 440| |#endif 441| 450k|#if defined(SHA512_ASM_AVX) 442| 450k| if (sha512_avx_capable()) { ------------------ | Branch (442:7): [True: 0, False: 450k] ------------------ 443| 0| sha512_block_data_order_avx(state, data, num); 444| 0| return; 445| 0| } 446| 450k|#endif 447| |#if defined(SHA512_ASM_SSSE3) 448| | if (sha512_ssse3_capable()) { 449| | sha512_block_data_order_ssse3(state, data, num); 450| | return; 451| | } 452| |#endif 453| |#if defined(SHA512_ASM_NEON) 454| | if (CRYPTO_is_NEON_capable()) { 455| | sha512_block_data_order_neon(state, data, num); 456| | return; 457| | } 458| |#endif 459| 450k| sha512_block_data_order_nohw(state, data, num); 460| 450k|} CRYPTO_tls1_prf: 108| 208k| const uint8_t *seed2, size_t seed2_len) { 109| 208k| if (out_len == 0) { ------------------ | Branch (109:7): [True: 0, False: 208k] ------------------ 110| 0| return 1; 111| 0| } 112| | 113| 208k| OPENSSL_memset(out, 0, out_len); 114| | 115| 208k| const EVP_MD *const original_digest = digest; 116| 208k| FIPS_service_indicator_lock_state(); 117| 208k| int ret = 0; 118| | 119| 208k| if (digest == EVP_md5_sha1()) { ------------------ | Branch (119:7): [True: 3.80k, False: 204k] ------------------ 120| | // If using the MD5/SHA1 PRF, |secret| is partitioned between MD5 and SHA-1. 121| 3.80k| size_t secret_half = secret_len - (secret_len / 2); 122| 3.80k| if (!tls1_P_hash(out, out_len, EVP_md5(), secret, secret_half, label, ------------------ | Branch (122:9): [True: 0, False: 3.80k] ------------------ 123| 3.80k| label_len, seed1, seed1_len, seed2, seed2_len)) { 124| 0| goto end; 125| 0| } 126| | 127| | // Note that, if |secret_len| is odd, the two halves share a byte. 128| 3.80k| secret += secret_len - secret_half; 129| 3.80k| secret_len = secret_half; 130| 3.80k| digest = EVP_sha1(); 131| 3.80k| } 132| | 133| 208k| ret = tls1_P_hash(out, out_len, digest, secret, secret_len, label, label_len, 134| 208k| seed1, seed1_len, seed2, seed2_len); 135| | 136| 208k|end: 137| 208k| FIPS_service_indicator_unlock_state(); 138| 208k| if (ret) { ------------------ | Branch (138:7): [True: 208k, False: 0] ------------------ 139| 208k| TLSKDF_verify_service_indicator(original_digest); 140| 208k| } 141| 208k| return ret; 142| 208k|} CRYPTO_tls13_hkdf_expand_label: 148| 4.48k| const uint8_t *hash, size_t hash_len) { 149| 4.48k| static const uint8_t kProtocolLabel[] = "tls13 "; 150| 4.48k| CBB cbb, child; 151| 4.48k| uint8_t *hkdf_label = NULL; 152| 4.48k| size_t hkdf_label_len; 153| | 154| 4.48k| FIPS_service_indicator_lock_state(); 155| 4.48k| CBB_zero(&cbb); 156| 4.48k| if (!CBB_init(&cbb, 2 + 1 + sizeof(kProtocolLabel) - 1 + label_len + 1 + ------------------ | Branch (156:7): [True: 0, False: 4.48k] ------------------ 157| 4.48k| hash_len) || 158| 4.48k| !CBB_add_u16(&cbb, out_len) || ------------------ | Branch (158:7): [True: 0, False: 4.48k] ------------------ 159| 4.48k| !CBB_add_u8_length_prefixed(&cbb, &child) || ------------------ | Branch (159:7): [True: 0, False: 4.48k] ------------------ 160| 4.48k| !CBB_add_bytes(&child, kProtocolLabel, sizeof(kProtocolLabel) - 1) || ------------------ | Branch (160:7): [True: 0, False: 4.48k] ------------------ 161| 4.48k| !CBB_add_bytes(&child, label, label_len) || ------------------ | Branch (161:7): [True: 0, False: 4.48k] ------------------ 162| 4.48k| !CBB_add_u8_length_prefixed(&cbb, &child) || ------------------ | Branch (162:7): [True: 0, False: 4.48k] ------------------ 163| 4.48k| !CBB_add_bytes(&child, hash, hash_len) || ------------------ | Branch (163:7): [True: 0, False: 4.48k] ------------------ 164| 4.48k| !CBB_finish(&cbb, &hkdf_label, &hkdf_label_len)) { ------------------ | Branch (164:7): [True: 0, False: 4.48k] ------------------ 165| 0| CBB_cleanup(&cbb); 166| 0| FIPS_service_indicator_unlock_state(); 167| 0| return 0; 168| 0| } 169| | 170| 4.48k| const int ret = HKDF_expand(out, out_len, digest, secret, secret_len, 171| 4.48k| hkdf_label, hkdf_label_len); 172| 4.48k| OPENSSL_free(hkdf_label); 173| | 174| 4.48k| FIPS_service_indicator_unlock_state(); 175| 4.48k| if (ret) { ------------------ | Branch (175:7): [True: 4.48k, False: 0] ------------------ 176| 4.48k| TLSKDF_verify_service_indicator(digest); 177| 4.48k| } 178| 4.48k| return ret; 179| 4.48k|} bcm.cc:_ZL11tls1_P_hashPhmPK9env_md_stPKhmPKcmS4_mS4_m: 37| 211k| const uint8_t *seed2, size_t seed2_len) { 38| 211k| HMAC_CTX ctx, ctx_tmp, ctx_init; 39| 211k| uint8_t A1[EVP_MAX_MD_SIZE]; 40| 211k| unsigned A1_len; 41| 211k| int ret = 0; 42| | 43| 211k| const size_t chunk = EVP_MD_size(md); 44| 211k| HMAC_CTX_init(&ctx); 45| 211k| HMAC_CTX_init(&ctx_tmp); 46| 211k| HMAC_CTX_init(&ctx_init); 47| | 48| 211k| if (!HMAC_Init_ex(&ctx_init, secret, secret_len, md, NULL) || ------------------ | Branch (48:7): [True: 0, False: 211k] ------------------ 49| 211k| !HMAC_CTX_copy_ex(&ctx, &ctx_init) || ------------------ | Branch (49:7): [True: 0, False: 211k] ------------------ 50| 211k| !HMAC_Update(&ctx, (const uint8_t *) label, label_len) || ------------------ | Branch (50:7): [True: 0, False: 211k] ------------------ 51| 211k| !HMAC_Update(&ctx, seed1, seed1_len) || ------------------ | Branch (51:7): [True: 0, False: 211k] ------------------ 52| 211k| !HMAC_Update(&ctx, seed2, seed2_len) || ------------------ | Branch (52:7): [True: 0, False: 211k] ------------------ 53| 211k| !HMAC_Final(&ctx, A1, &A1_len)) { ------------------ | Branch (53:7): [True: 0, False: 211k] ------------------ 54| 0| goto err; 55| 0| } 56| | 57| 385k| for (;;) { 58| 385k| unsigned len_u; 59| 385k| uint8_t hmac[EVP_MAX_MD_SIZE]; 60| 385k| if (!HMAC_CTX_copy_ex(&ctx, &ctx_init) || ------------------ | Branch (60:9): [True: 0, False: 385k] ------------------ 61| 385k| !HMAC_Update(&ctx, A1, A1_len) || ------------------ | Branch (61:9): [True: 0, False: 385k] ------------------ 62| | // Save a copy of |ctx| to compute the next A1 value below. 63| 385k| (out_len > chunk && !HMAC_CTX_copy_ex(&ctx_tmp, &ctx)) || ------------------ | Branch (63:10): [True: 174k, False: 211k] | Branch (63:29): [True: 0, False: 174k] ------------------ 64| 385k| !HMAC_Update(&ctx, (const uint8_t *) label, label_len) || ------------------ | Branch (64:9): [True: 0, False: 385k] ------------------ 65| 385k| !HMAC_Update(&ctx, seed1, seed1_len) || ------------------ | Branch (65:9): [True: 0, False: 385k] ------------------ 66| 385k| !HMAC_Update(&ctx, seed2, seed2_len) || ------------------ | Branch (66:9): [True: 0, False: 385k] ------------------ 67| 385k| !HMAC_Final(&ctx, hmac, &len_u)) { ------------------ | Branch (67:9): [True: 0, False: 385k] ------------------ 68| 0| goto err; 69| 0| } 70| 385k| size_t len = len_u; 71| 385k| assert(len == chunk); 72| | 73| | // XOR the result into |out|. 74| 385k| if (len > out_len) { ------------------ | Branch (74:9): [True: 205k, False: 180k] ------------------ 75| 205k| len = out_len; 76| 205k| } 77| 8.59M| for (size_t i = 0; i < len; i++) { ------------------ | Branch (77:24): [True: 8.21M, False: 385k] ------------------ 78| 8.21M| out[i] ^= hmac[i]; 79| 8.21M| } 80| 385k| out += len; 81| 385k| out_len -= len; 82| | 83| 385k| if (out_len == 0) { ------------------ | Branch (83:9): [True: 211k, False: 174k] ------------------ 84| 211k| break; 85| 211k| } 86| | 87| | // Calculate the next A1 value. 88| 174k| if (!HMAC_Final(&ctx_tmp, A1, &A1_len)) { ------------------ | Branch (88:9): [True: 0, False: 174k] ------------------ 89| 0| goto err; 90| 0| } 91| 174k| } 92| | 93| 211k| ret = 1; 94| | 95| 211k|err: 96| 211k| OPENSSL_cleanse(A1, sizeof(A1)); 97| 211k| HMAC_CTX_cleanup(&ctx); 98| 211k| HMAC_CTX_cleanup(&ctx_tmp); 99| 211k| HMAC_CTX_cleanup(&ctx_init); 100| 211k| return ret; 101| 211k|} CRYPTO_fuzzer_mode_enabled: 23| 3.10M|int CRYPTO_fuzzer_mode_enabled(void) { 24| 3.10M| return CRYPTO_atomic_load_u32(&fuzzer_mode_enabled); 25| 3.10M|} CRYPTO_set_fuzzer_mode: 27| 2|void CRYPTO_set_fuzzer_mode(int enabled) { 28| 2| CRYPTO_atomic_store_u32(&fuzzer_mode_enabled, !!enabled); 29| 2|} EVP_HPKE_CTX_zero: 842| 71.0k|void EVP_HPKE_CTX_zero(EVP_HPKE_CTX *ctx) { 843| 71.0k| OPENSSL_memset(ctx, 0, sizeof(EVP_HPKE_CTX)); 844| 71.0k| EVP_AEAD_CTX_zero(&ctx->aead_ctx); 845| 71.0k|} EVP_HPKE_CTX_cleanup: 847| 71.0k|void EVP_HPKE_CTX_cleanup(EVP_HPKE_CTX *ctx) { 848| 71.0k| EVP_AEAD_CTX_cleanup(&ctx->aead_ctx); 849| 71.0k|} CRYPTO_atomic_load_u32: 532| 5.91M|inline uint32_t CRYPTO_atomic_load_u32(const CRYPTO_atomic_u32 *val) { 533| 5.91M| return val->load(std::memory_order_seq_cst); 534| 5.91M|} CRYPTO_atomic_compare_exchange_weak_u32: 538| 1.90M| uint32_t desired) { 539| 1.90M| return val->compare_exchange_weak( 540| 1.90M| *expected, desired, std::memory_order_seq_cst, std::memory_order_seq_cst); 541| 1.90M|} CRYPTO_atomic_store_u32: 543| 3|inline void CRYPTO_atomic_store_u32(CRYPTO_atomic_u32 *val, uint32_t desired) { 544| 3| val->store(desired, std::memory_order_seq_cst); 545| 3|} boringssl_ensure_rsa_self_test: 1037| 65.3k|inline void boringssl_ensure_rsa_self_test(void) {} boringssl_ensure_ecc_self_test: 1038| 64.3k|inline void boringssl_ensure_ecc_self_test(void) {} boringssl_fips_inc_counter: 1070| 40.3k|inline void boringssl_fips_inc_counter(enum fips_counter_t counter) {} CRYPTO_is_intel_cpu: 1120| 887k|inline int CRYPTO_is_intel_cpu(void) { 1121| | // The reserved bit 30 is used to indicate an Intel CPU. 1122| 887k| return (OPENSSL_get_ia32cap(0) & (1u << 30)) != 0; 1123| 887k|} CRYPTO_is_PCLMUL_capable: 1127| 96.7k|inline int CRYPTO_is_PCLMUL_capable(void) { 1128| |#if defined(__PCLMUL__) 1129| | return 1; 1130| |#else 1131| 96.7k| return (OPENSSL_get_ia32cap(1) & (1u << 1)) != 0; 1132| 96.7k|#endif 1133| 96.7k|} CRYPTO_is_SSSE3_capable: 1135| 3.35M|inline int CRYPTO_is_SSSE3_capable(void) { 1136| |#if defined(__SSSE3__) 1137| | return 1; 1138| |#else 1139| 3.35M| return (OPENSSL_get_ia32cap(1) & (1u << 9)) != 0; 1140| 3.35M|#endif 1141| 3.35M|} CRYPTO_is_MOVBE_capable: 1151| 40.3k|inline int CRYPTO_is_MOVBE_capable(void) { 1152| |#if defined(__MOVBE__) 1153| | return 1; 1154| |#else 1155| 40.3k| return (OPENSSL_get_ia32cap(1) & (1u << 22)) != 0; 1156| 40.3k|#endif 1157| 40.3k|} CRYPTO_is_AESNI_capable: 1159| 2.00M|inline int CRYPTO_is_AESNI_capable(void) { 1160| |#if defined(__AES__) 1161| | return 1; 1162| |#else 1163| 2.00M| return (OPENSSL_get_ia32cap(1) & (1u << 25)) != 0; 1164| 2.00M|#endif 1165| 2.00M|} CRYPTO_is_AVX_capable: 1170| 1.47M|inline int CRYPTO_is_AVX_capable(void) { 1171| |#if defined(__AVX__) 1172| | return 1; 1173| |#else 1174| 1.47M| return (OPENSSL_get_ia32cap(1) & (1u << 28)) != 0; 1175| 1.47M|#endif 1176| 1.47M|} CRYPTO_is_RDRAND_capable: 1178| 437k|inline int CRYPTO_is_RDRAND_capable(void) { 1179| | // We intentionally do not check |__RDRND__| here. On some AMD processors, we 1180| | // will act as if the hardware is RDRAND-incapable, even it actually supports 1181| | // it. See cpu_intel.c. 1182| 437k| return (OPENSSL_get_ia32cap(1) & (1u << 30)) != 0; 1183| 437k|} CRYPTO_is_BMI1_capable: 1187| 12.4M|inline int CRYPTO_is_BMI1_capable(void) { 1188| |#if defined(__BMI__) 1189| | return 1; 1190| |#else 1191| 12.4M| return (OPENSSL_get_ia32cap(2) & (1u << 3)) != 0; 1192| 12.4M|#endif 1193| 12.4M|} CRYPTO_is_AVX2_capable: 1195| 227k|inline int CRYPTO_is_AVX2_capable(void) { 1196| |#if defined(__AVX2__) 1197| | return 1; 1198| |#else 1199| 227k| return (OPENSSL_get_ia32cap(2) & (1u << 5)) != 0; 1200| 227k|#endif 1201| 227k|} CRYPTO_is_BMI2_capable: 1203| 15.8M|inline int CRYPTO_is_BMI2_capable(void) { 1204| |#if defined(__BMI2__) 1205| | return 1; 1206| |#else 1207| 15.8M| return (OPENSSL_get_ia32cap(2) & (1u << 8)) != 0; 1208| 15.8M|#endif 1209| 15.8M|} CRYPTO_is_ADX_capable: 1211| 15.8M|inline int CRYPTO_is_ADX_capable(void) { 1212| |#if defined(__ADX__) 1213| | return 1; 1214| |#else 1215| 15.8M| return (OPENSSL_get_ia32cap(2) & (1u << 19)) != 0; 1216| 15.8M|#endif 1217| 15.8M|} CRYPTO_is_x86_SHA_capable: 1220| 3.26M|inline int CRYPTO_is_x86_SHA_capable(void) { 1221| |#if defined(__SHA__) 1222| | return 1; 1223| |#else 1224| 3.26M| return (OPENSSL_get_ia32cap(2) & (1u << 29)) != 0; 1225| 3.26M|#endif 1226| 3.26M|} CRYPTO_cpu_perf_is_like_silvermont: 1238| 107|inline int CRYPTO_cpu_perf_is_like_silvermont(void) { 1239| | // WARNING: This MUST NOT be used to guard the execution of the XSAVE 1240| | // instruction. This is the "hardware supports XSAVE" bit, not the OSXSAVE bit 1241| | // that indicates whether we can safely execute XSAVE. This bit may be set 1242| | // even when XSAVE is disabled (by the operating system). See how the users of 1243| | // this bit use it. 1244| | // 1245| | // Historically, the XSAVE bit was artificially cleared on Knights Landing 1246| | // and Knights Mill chips, but as Intel has removed all support from GCC, 1247| | // LLVM, and SDE, we assume they are no longer worth special-casing. 1248| 107| int hardware_supports_xsave = (OPENSSL_get_ia32cap(1) & (1u << 26)) != 0; 1249| 107| return !hardware_supports_xsave && CRYPTO_is_MOVBE_capable(); ------------------ | Branch (1249:10): [True: 0, False: 107] | Branch (1249:38): [True: 0, False: 0] ------------------ 1250| 107|} CRYPTO_is_VPCLMULQDQ_capable: 1284| 40.3k|inline int CRYPTO_is_VPCLMULQDQ_capable(void) { 1285| |#if defined(__VPCLMULQDQ__) 1286| | return 1; 1287| |#else 1288| 40.3k| return (OPENSSL_get_ia32cap(3) & (1u << 10)) != 0; 1289| 40.3k|#endif 1290| 40.3k|} _Z16CRYPTO_addc_implmmmPm: 1457| 1.35M| unsigned long *out_carry) { 1458| 1.35M| return __builtin_addcl(x, y, carry, out_carry); 1459| 1.35M|} _Z15CRYPTO_addc_u64mmmPm: 1474| 1.35M| uint64_t *out_carry) { 1475| 1.35M| return CRYPTO_addc_impl(x, y, carry, out_carry); 1476| 1.35M|} _Z16CRYPTO_subc_implmmmPm: 1521| 48.0k| unsigned long *out_borrow) { 1522| 48.0k| return __builtin_subcl(x, y, borrow, out_borrow); 1523| 48.0k|} _Z15CRYPTO_subc_u64mmmPm: 1538| 48.0k| uint64_t *out_borrow) { 1539| 48.0k| return CRYPTO_subc_impl(x, y, borrow, out_borrow); 1540| 48.0k|} _ZN4bssl8internal13MutexLockBaseIXadL_Z23CRYPTO_MUTEX_lock_writeEEXadL_Z25CRYPTO_MUTEX_unlock_writeEEEC2EP16pthread_rwlock_t: 650| 9.52k| explicit MutexLockBase(CRYPTO_MUTEX *mu) : mu_(mu) { 651| 9.52k| assert(mu_ != nullptr); 652| 9.52k| LockFunc(mu_); 653| 9.52k| } _ZN4bssl8internal13MutexLockBaseIXadL_Z23CRYPTO_MUTEX_lock_writeEEXadL_Z25CRYPTO_MUTEX_unlock_writeEEED2Ev: 654| 9.52k| ~MutexLockBase() { ReleaseFunc(mu_); } extensions.cc:_ZL14OPENSSL_memchrPKvim: 821| 34|static inline const void *OPENSSL_memchr(const void *s, int c, size_t n) { 822| 34| if (n == 0) { ------------------ | Branch (822:7): [True: 1, False: 33] ------------------ 823| 1| return NULL; 824| 1| } 825| | 826| 33| return memchr(s, c, n); 827| 34|} handshake_client.cc:_ZL14OPENSSL_memcpyPvPKvm: 858| 55.0k|static inline void *OPENSSL_memcpy(void *dst, const void *src, size_t n) { 859| 55.0k| if (n == 0) { ------------------ | Branch (859:7): [True: 0, False: 55.0k] ------------------ 860| 0| return dst; 861| 0| } 862| | 863| 55.0k| return memcpy(dst, src, n); 864| 55.0k|} s3_both.cc:_ZL15OPENSSL_memmovePvPKvm: 866| 397k|static inline void *OPENSSL_memmove(void *dst, const void *src, size_t n) { 867| 397k| if (n == 0) { ------------------ | Branch (867:7): [True: 397k, False: 200] ------------------ 868| 397k| return dst; 869| 397k| } 870| | 871| 200| return memmove(dst, src, n); 872| 397k|} s3_pkt.cc:_ZL14OPENSSL_memcpyPvPKvm: 858| 267|static inline void *OPENSSL_memcpy(void *dst, const void *src, size_t n) { 859| 267| if (n == 0) { ------------------ | Branch (859:7): [True: 0, False: 267] ------------------ 860| 0| return dst; 861| 0| } 862| | 863| 267| return memcpy(dst, src, n); 864| 267|} ssl_aead_ctx.cc:_ZL14OPENSSL_memcpyPvPKvm: 858| 192k|static inline void *OPENSSL_memcpy(void *dst, const void *src, size_t n) { 859| 192k| if (n == 0) { ------------------ | Branch (859:7): [True: 62.2k, False: 130k] ------------------ 860| 62.2k| return dst; 861| 62.2k| } 862| | 863| 130k| return memcpy(dst, src, n); 864| 192k|} ssl_aead_ctx.cc:_ZL13buffers_aliasPKvmS0_m: 168| 652k| size_t b_bytes) { 169| | // Cast |a| and |b| to integers. In C, pointer comparisons between unrelated 170| | // objects are undefined whereas pointer to integer conversions are merely 171| | // implementation-defined. We assume the implementation defined it in a sane 172| | // way. 173| 652k| uintptr_t a_u = (uintptr_t)a; 174| 652k| uintptr_t b_u = (uintptr_t)b; 175| 652k| return a_u + a_bytes > b_u && b_u + b_bytes > a_u; ------------------ | Branch (175:10): [True: 204k, False: 447k] | Branch (175:33): [True: 0, False: 204k] ------------------ 176| 652k|} ssl_aead_ctx.cc:_ZL15OPENSSL_memmovePvPKvm: 866| 434k|static inline void *OPENSSL_memmove(void *dst, const void *src, size_t n) { 867| 434k| if (n == 0) { ------------------ | Branch (867:7): [True: 217k, False: 217k] ------------------ 868| 217k| return dst; 869| 217k| } 870| | 871| 217k| return memmove(dst, src, n); 872| 434k|} ssl_asn1.cc:_ZL14OPENSSL_memcpyPvPKvm: 858| 232|static inline void *OPENSSL_memcpy(void *dst, const void *src, size_t n) { 859| 232| if (n == 0) { ------------------ | Branch (859:7): [True: 0, False: 232] ------------------ 860| 0| return dst; 861| 0| } 862| | 863| 232| return memcpy(dst, src, n); 864| 232|} ssl_buffer.cc:_ZL15OPENSSL_memmovePvPKvm: 866| 956k|static inline void *OPENSSL_memmove(void *dst, const void *src, size_t n) { 867| 956k| if (n == 0) { ------------------ | Branch (867:7): [True: 485k, False: 470k] ------------------ 868| 485k| return dst; 869| 485k| } 870| | 871| 470k| return memmove(dst, src, n); 872| 956k|} ssl_cert.cc:_ZL14OPENSSL_memcmpPKvS0_m: 850| 157k|static inline int OPENSSL_memcmp(const void *s1, const void *s2, size_t n) { 851| 157k| if (n == 0) { ------------------ | Branch (851:7): [True: 0, False: 157k] ------------------ 852| 0| return 0; 853| 0| } 854| | 855| 157k| return memcmp(s1, s2, n); 856| 157k|} ssl_lib.cc:_ZL14OPENSSL_memcpyPvPKvm: 858| 2.20k|static inline void *OPENSSL_memcpy(void *dst, const void *src, size_t n) { 859| 2.20k| if (n == 0) { ------------------ | Branch (859:7): [True: 0, False: 2.20k] ------------------ 860| 0| return dst; 861| 0| } 862| | 863| 2.20k| return memcpy(dst, src, n); 864| 2.20k|} ssl_session.cc:_ZL14OPENSSL_memcpyPvPKvm: 858| 52.8k|static inline void *OPENSSL_memcpy(void *dst, const void *src, size_t n) { 859| 52.8k| if (n == 0) { ------------------ | Branch (859:7): [True: 0, False: 52.8k] ------------------ 860| 0| return dst; 861| 0| } 862| | 863| 52.8k| return memcpy(dst, src, n); 864| 52.8k|} tls13_client.cc:_ZL14OPENSSL_memcpyPvPKvm: 858| 289|static inline void *OPENSSL_memcpy(void *dst, const void *src, size_t n) { 859| 289| if (n == 0) { ------------------ | Branch (859:7): [True: 0, False: 289] ------------------ 860| 0| return dst; 861| 0| } 862| | 863| 289| return memcpy(dst, src, n); 864| 289|} tls13_enc.cc:_ZL14OPENSSL_memcpyPvPKvm: 858| 47|static inline void *OPENSSL_memcpy(void *dst, const void *src, size_t n) { 859| 47| if (n == 0) { ------------------ | Branch (859:7): [True: 0, False: 47] ------------------ 860| 0| return dst; 861| 0| } 862| | 863| 47| return memcpy(dst, src, n); 864| 47|} tls_record.cc:_ZL13buffers_aliasPKvmS0_m: 168| 869k| size_t b_bytes) { 169| | // Cast |a| and |b| to integers. In C, pointer comparisons between unrelated 170| | // objects are undefined whereas pointer to integer conversions are merely 171| | // implementation-defined. We assume the implementation defined it in a sane 172| | // way. 173| 869k| uintptr_t a_u = (uintptr_t)a; 174| 869k| uintptr_t b_u = (uintptr_t)b; 175| 869k| return a_u + a_bytes > b_u && b_u + b_bytes > a_u; ------------------ | Branch (175:10): [True: 272k, False: 597k] | Branch (175:33): [True: 0, False: 272k] ------------------ 176| 869k|} bcm.cc:_ZL18CRYPTO_load_u32_bePKv: 910| 3.42M|static inline uint32_t CRYPTO_load_u32_be(const void *in) { 911| 3.42M| uint32_t v; 912| 3.42M| OPENSSL_memcpy(&v, in, sizeof(v)); 913| 3.42M| return CRYPTO_bswap4(v); 914| 3.42M|} bcm.cc:_ZL13CRYPTO_bswap4j: 775| 23.5M|static inline uint32_t CRYPTO_bswap4(uint32_t x) { 776| 23.5M| return __builtin_bswap32(x); 777| 23.5M|} bcm.cc:_ZL19CRYPTO_store_u32_bePvj: 916| 20.0M|static inline void CRYPTO_store_u32_be(void *out, uint32_t v) { 917| 20.0M| v = CRYPTO_bswap4(v); 918| 20.0M| OPENSSL_memcpy(out, &v, sizeof(v)); 919| 20.0M|} bcm.cc:_ZL14OPENSSL_memcpyPvPKvm: 858| 62.5M|static inline void *OPENSSL_memcpy(void *dst, const void *src, size_t n) { 859| 62.5M| if (n == 0) { ------------------ | Branch (859:7): [True: 538k, False: 62.0M] ------------------ 860| 538k| return dst; 861| 538k| } 862| | 863| 62.0M| return memcpy(dst, src, n); 864| 62.5M|} bcm.cc:_ZL14OPENSSL_memsetPvim: 874| 15.8M|static inline void *OPENSSL_memset(void *dst, int c, size_t n) { 875| 15.8M| if (n == 0) { ------------------ | Branch (875:7): [True: 2.05M, False: 13.7M] ------------------ 876| 2.05M| return dst; 877| 2.05M| } 878| | 879| 13.7M| return memset(dst, c, n); 880| 15.8M|} bcm.cc:_ZL18CRYPTO_load_u64_bePKv: 931| 80.6k|static inline uint64_t CRYPTO_load_u64_be(const void *ptr) { 932| 80.6k| uint64_t ret; 933| 80.6k| OPENSSL_memcpy(&ret, ptr, sizeof(ret)); 934| 80.6k| return CRYPTO_bswap8(ret); 935| 80.6k|} bcm.cc:_ZL13CRYPTO_bswap8m: 779| 6.16M|static inline uint64_t CRYPTO_bswap8(uint64_t x) { 780| 6.16M| return __builtin_bswap64(x); 781| 6.16M|} bcm.cc:_ZL19CRYPTO_store_u64_bePvm: 937| 2.66M|static inline void CRYPTO_store_u64_be(void *out, uint64_t v) { 938| 2.66M| v = CRYPTO_bswap8(v); 939| 2.66M| OPENSSL_memcpy(out, &v, sizeof(v)); 940| 2.66M|} bcm.cc:_ZL15OPENSSL_memmovePvPKvm: 866| 8.10k|static inline void *OPENSSL_memmove(void *dst, const void *src, size_t n) { 867| 8.10k| if (n == 0) { ------------------ | Branch (867:7): [True: 0, False: 8.10k] ------------------ 868| 0| return dst; 869| 0| } 870| | 871| 8.10k| return memmove(dst, src, n); 872| 8.10k|} bcm.cc:_ZL23constant_time_is_zero_wm: 326| 196M|static inline crypto_word_t constant_time_is_zero_w(crypto_word_t a) { 327| | // Here is an SMT-LIB verification of this formula: 328| | // 329| | // (define-fun is_zero ((a (_ BitVec 32))) (_ BitVec 32) 330| | // (bvand (bvnot a) (bvsub a #x00000001)) 331| | // ) 332| | // 333| | // (declare-fun a () (_ BitVec 32)) 334| | // 335| | // (assert (not (= (= #x00000001 (bvlshr (is_zero a) #x0000001f)) (= a 336| | // #x00000000)))) (check-sat) (get-model) 337| 196M| return constant_time_msb_w(~a & (a - 1)); 338| 196M|} bcm.cc:_ZL19constant_time_msb_wm: 267| 224M|static inline crypto_word_t constant_time_msb_w(crypto_word_t a) { 268| 224M| return 0u - (a >> (sizeof(a) * 8 - 1)); 269| 224M|} bcm.cc:_ZL18constant_time_eq_wmm: 348| 174M| crypto_word_t b) { 349| 174M| return constant_time_is_zero_w(a ^ b); 350| 174M|} bcm.cc:_ZL22constant_time_select_wmmm: 375| 5.44G| crypto_word_t b) { 376| | // Clang recognizes this pattern as a select. While it usually transforms it 377| | // to a cmov, it sometimes further transforms it into a branch, which we do 378| | // not want. 379| | // 380| | // Hiding the value of the mask from the compiler evades this transformation. 381| 5.44G| mask = value_barrier_w(mask); 382| 5.44G| return (mask & a) | (~mask & b); 383| 5.44G|} bcm.cc:_ZL15value_barrier_wm: 239| 5.45G|static inline crypto_word_t value_barrier_w(crypto_word_t a) { 240| 5.45G|#if defined(__GNUC__) || defined(__clang__) 241| 5.45G| __asm__("" : "+r"(a) : /* no inputs */); 242| 5.45G|#endif 243| 5.45G| return a; 244| 5.45G|} bcm.cc:_ZL19CRYPTO_load_word_bePKv: 952| 3.42M|static inline crypto_word_t CRYPTO_load_word_be(const void *in) { 953| 3.42M| crypto_word_t v; 954| 3.42M| OPENSSL_memcpy(&v, in, sizeof(v)); 955| 3.42M|#if defined(OPENSSL_64_BIT) 956| 3.42M| static_assert(sizeof(v) == 8, "crypto_word_t has unexpected size"); 957| 3.42M| return CRYPTO_bswap8(v); 958| |#else 959| | static_assert(sizeof(v) == 4, "crypto_word_t has unexpected size"); 960| | return CRYPTO_bswap4(v); 961| |#endif 962| 3.42M|} bcm.cc:_ZL28constant_time_declassify_inti: 481| 2.02G|static inline int constant_time_declassify_int(int v) { 482| 2.02G| static_assert(sizeof(uint32_t) == sizeof(int), 483| 2.02G| "int is not the same size as uint32_t"); 484| | // See comment above. 485| 2.02G| CONSTTIME_DECLASSIFY(&v, sizeof(v)); 486| 2.02G| return value_barrier_u32(v); 487| 2.02G|} bcm.cc:_ZL17value_barrier_u32j: 247| 2.02G|static inline uint32_t value_barrier_u32(uint32_t a) { 248| 2.02G|#if defined(__GNUC__) || defined(__clang__) 249| 2.02G| __asm__("" : "+r"(a) : /* no inputs */); 250| 2.02G|#endif 251| 2.02G| return a; 252| 2.02G|} bcm.cc:_ZL24constant_time_select_intmii: 401| 56.5M|static inline int constant_time_select_int(crypto_word_t mask, int a, int b) { 402| 56.5M| return (int)(constant_time_select_w(mask, (crypto_word_t)(a), 403| 56.5M| (crypto_word_t)(b))); 404| 56.5M|} bcm.cc:_ZL26constant_time_declassify_wm: 465| 5.47M|static inline crypto_word_t constant_time_declassify_w(crypto_word_t v) { 466| | // Return |v| through a value barrier to be safe. Valgrind-based constant-time 467| | // validation is partly to check the compiler has not undone any constant-time 468| | // work. Any place |BORINGSSL_CONSTANT_TIME_VALIDATION| influences 469| | // optimizations, this validation is inaccurate. 470| | // 471| | // However, by sending pointers through valgrind, we likely inhibit escape 472| | // analysis. On local variables, particularly booleans, we likely 473| | // significantly impact optimizations. 474| | // 475| | // Thus, to be safe, stick a value barrier, in hopes of comparably inhibiting 476| | // compiler analysis. 477| 5.47M| CONSTTIME_DECLASSIFY(&v, sizeof(v)); 478| 5.47M| return value_barrier_w(v); 479| 5.47M|} bcm.cc:_ZL18constant_time_lt_wmm: 273| 28.1M| crypto_word_t b) { 274| | // Consider the two cases of the problem: 275| | // msb(a) == msb(b): a < b iff the MSB of a - b is set. 276| | // msb(a) != msb(b): a < b iff the MSB of b is set. 277| | // 278| | // If msb(a) == msb(b) then the following evaluates as: 279| | // msb(a^((a^b)|((a-b)^a))) == 280| | // msb(a^((a-b) ^ a)) == (because msb(a^b) == 0) 281| | // msb(a^a^(a-b)) == (rearranging) 282| | // msb(a-b) (because ∀x. x^x == 0) 283| | // 284| | // Else, if msb(a) != msb(b) then the following evaluates as: 285| | // msb(a^((a^b)|((a-b)^a))) == 286| | // msb(a^(𝟙 | ((a-b)^a))) == (because msb(a^b) == 1 and 𝟙 287| | // represents a value s.t. msb(𝟙) = 1) 288| | // msb(a^𝟙) == (because ORing with 1 results in 1) 289| | // msb(b) 290| | // 291| | // 292| | // Here is an SMT-LIB verification of this formula: 293| | // 294| | // (define-fun lt ((a (_ BitVec 32)) (b (_ BitVec 32))) (_ BitVec 32) 295| | // (bvxor a (bvor (bvxor a b) (bvxor (bvsub a b) a))) 296| | // ) 297| | // 298| | // (declare-fun a () (_ BitVec 32)) 299| | // (declare-fun b () (_ BitVec 32)) 300| | // 301| | // (assert (not (= (= #x00000001 (bvlshr (lt a b) #x0000001f)) (bvult a b)))) 302| | // (check-sat) 303| | // (get-model) 304| 28.1M| return constant_time_msb_w(a ^ ((a ^ b) | ((a - b) ^ a))); 305| 28.1M|} bcm.cc:_ZL14OPENSSL_memcmpPKvS0_m: 850| 6.61k|static inline int OPENSSL_memcmp(const void *s1, const void *s2, size_t n) { 851| 6.61k| if (n == 0) { ------------------ | Branch (851:7): [True: 0, False: 6.61k] ------------------ 852| 0| return 0; 853| 0| } 854| | 855| 6.61k| return memcmp(s1, s2, n); 856| 6.61k|} bcm.cc:_ZL15CRYPTO_rotl_u64mi: 987| 1.68G|static inline uint64_t CRYPTO_rotl_u64(uint64_t value, int shift) { 988| |#if defined(_MSC_VER) 989| | return _rotl64(value, shift); 990| |#else 991| 1.68G| return (value << shift) | (value >> ((-shift) & 63)); 992| 1.68G|#endif 993| 1.68G|} bcm.cc:_ZL18CRYPTO_load_u64_lePKv: 921| 7.66M|static inline uint64_t CRYPTO_load_u64_le(const void *in) { 922| 7.66M| uint64_t v; 923| 7.66M| OPENSSL_memcpy(&v, in, sizeof(v)); 924| 7.66M| return v; 925| 7.66M|} bcm.cc:_ZL14OPENSSL_memchrPvim: 829| 28.0k|static inline void *OPENSSL_memchr(void *s, int c, size_t n) { 830| 28.0k| if (n == 0) { ------------------ | Branch (830:7): [True: 1, False: 28.0k] ------------------ 831| 1| return NULL; 832| 1| } 833| | 834| 28.0k| return memchr(s, c, n); 835| 28.0k|} buf.cc:_ZL14OPENSSL_memsetPvim: 874| 139k|static inline void *OPENSSL_memset(void *dst, int c, size_t n) { 875| 139k| if (n == 0) { ------------------ | Branch (875:7): [True: 0, False: 139k] ------------------ 876| 0| return dst; 877| 0| } 878| | 879| 139k| return memset(dst, c, n); 880| 139k|} buf.cc:_ZL14OPENSSL_memcpyPvPKvm: 858| 1.09M|static inline void *OPENSSL_memcpy(void *dst, const void *src, size_t n) { 859| 1.09M| if (n == 0) { ------------------ | Branch (859:7): [True: 0, False: 1.09M] ------------------ 860| 0| return dst; 861| 0| } 862| | 863| 1.09M| return memcpy(dst, src, n); 864| 1.09M|} cbb.cc:_ZL14OPENSSL_memsetPvim: 874| 4.70M|static inline void *OPENSSL_memset(void *dst, int c, size_t n) { 875| 4.70M| if (n == 0) { ------------------ | Branch (875:7): [True: 0, False: 4.70M] ------------------ 876| 0| return dst; 877| 0| } 878| | 879| 4.70M| return memset(dst, c, n); 880| 4.70M|} cbb.cc:_ZL15OPENSSL_memmovePvPKvm: 866| 51|static inline void *OPENSSL_memmove(void *dst, const void *src, size_t n) { 867| 51| if (n == 0) { ------------------ | Branch (867:7): [True: 0, False: 51] ------------------ 868| 0| return dst; 869| 0| } 870| | 871| 51| return memmove(dst, src, n); 872| 51|} cbb.cc:_ZL14OPENSSL_memcpyPvPKvm: 858| 787k|static inline void *OPENSSL_memcpy(void *dst, const void *src, size_t n) { 859| 787k| if (n == 0) { ------------------ | Branch (859:7): [True: 63.3k, False: 724k] ------------------ 860| 63.3k| return dst; 861| 63.3k| } 862| | 863| 724k| return memcpy(dst, src, n); 864| 787k|} cbs.cc:_ZL14OPENSSL_memchrPKvim: 821| 862|static inline const void *OPENSSL_memchr(const void *s, int c, size_t n) { 822| 862| if (n == 0) { ------------------ | Branch (822:7): [True: 541, False: 321] ------------------ 823| 541| return NULL; 824| 541| } 825| | 826| 321| return memchr(s, c, n); 827| 862|} chacha.cc:_ZL14OPENSSL_memcpyPvPKvm: 858| 321|static inline void *OPENSSL_memcpy(void *dst, const void *src, size_t n) { 859| 321| if (n == 0) { ------------------ | Branch (859:7): [True: 0, False: 321] ------------------ 860| 0| return dst; 861| 0| } 862| | 863| 321| return memcpy(dst, src, n); 864| 321|} chacha.cc:_ZL13buffers_aliasPKvmS0_m: 168| 107| size_t b_bytes) { 169| | // Cast |a| and |b| to integers. In C, pointer comparisons between unrelated 170| | // objects are undefined whereas pointer to integer conversions are merely 171| | // implementation-defined. We assume the implementation defined it in a sane 172| | // way. 173| 107| uintptr_t a_u = (uintptr_t)a; 174| 107| uintptr_t b_u = (uintptr_t)b; 175| 107| return a_u + a_bytes > b_u && b_u + b_bytes > a_u; ------------------ | Branch (175:10): [True: 107, False: 0] | Branch (175:33): [True: 107, False: 0] ------------------ 176| 107|} chacha.cc:_ZL18CRYPTO_load_u32_lePKv: 900| 321|static inline uint32_t CRYPTO_load_u32_le(const void *in) { 901| 321| uint32_t v; 902| 321| OPENSSL_memcpy(&v, in, sizeof(v)); 903| 321| return v; 904| 321|} e_chacha20poly1305.cc:_ZL14OPENSSL_memcpyPvPKvm: 858| 14|static inline void *OPENSSL_memcpy(void *dst, const void *src, size_t n) { 859| 14| if (n == 0) { ------------------ | Branch (859:7): [True: 0, False: 14] ------------------ 860| 0| return dst; 861| 0| } 862| | 863| 14| return memcpy(dst, src, n); 864| 14|} e_tls.cc:_ZL14OPENSSL_memcpyPvPKvm: 858| 64.0k|static inline void *OPENSSL_memcpy(void *dst, const void *src, size_t n) { 859| 64.0k| if (n == 0) { ------------------ | Branch (859:7): [True: 0, False: 64.0k] ------------------ 860| 0| return dst; 861| 0| } 862| | 863| 64.0k| return memcpy(dst, src, n); 864| 64.0k|} curve25519.cc:_ZL14OPENSSL_memcpyPvPKvm: 858| 133k|static inline void *OPENSSL_memcpy(void *dst, const void *src, size_t n) { 859| 133k| if (n == 0) { ------------------ | Branch (859:7): [True: 0, False: 133k] ------------------ 860| 0| return dst; 861| 0| } 862| | 863| 133k| return memcpy(dst, src, n); 864| 133k|} curve25519.cc:_ZL28constant_time_declassify_inti: 481| 367M|static inline int constant_time_declassify_int(int v) { 482| 367M| static_assert(sizeof(uint32_t) == sizeof(int), 483| 367M| "int is not the same size as uint32_t"); 484| | // See comment above. 485| 367M| CONSTTIME_DECLASSIFY(&v, sizeof(v)); 486| 367M| return value_barrier_u32(v); 487| 367M|} curve25519.cc:_ZL17value_barrier_u32j: 247| 367M|static inline uint32_t value_barrier_u32(uint32_t a) { 248| 367M|#if defined(__GNUC__) || defined(__clang__) 249| 367M| __asm__("" : "+r"(a) : /* no inputs */); 250| 367M|#endif 251| 367M| return a; 252| 367M|} curve25519_64_adx.cc:_ZL14OPENSSL_memcpyPvPKvm: 858| 8.76M|static inline void *OPENSSL_memcpy(void *dst, const void *src, size_t n) { 859| 8.76M| if (n == 0) { ------------------ | Branch (859:7): [True: 0, False: 8.76M] ------------------ 860| 0| return dst; 861| 0| } 862| | 863| 8.76M| return memcpy(dst, src, n); 864| 8.76M|} curve25519_64_adx.cc:_ZL19constant_time_msb_wm: 267| 93.9M|static inline crypto_word_t constant_time_msb_w(crypto_word_t a) { 268| 93.9M| return 0u - (a >> (sizeof(a) * 8 - 1)); 269| 93.9M|} curve25519_64_adx.cc:_ZL23constant_time_is_zero_wm: 326| 85.4M|static inline crypto_word_t constant_time_is_zero_w(crypto_word_t a) { 327| | // Here is an SMT-LIB verification of this formula: 328| | // 329| | // (define-fun is_zero ((a (_ BitVec 32))) (_ BitVec 32) 330| | // (bvand (bvnot a) (bvsub a #x00000001)) 331| | // ) 332| | // 333| | // (declare-fun a () (_ BitVec 32)) 334| | // 335| | // (assert (not (= (= #x00000001 (bvlshr (is_zero a) #x0000001f)) (= a 336| | // #x00000000)))) (check-sat) (get-model) 337| 85.4M| return constant_time_msb_w(~a & (a - 1)); 338| 85.4M|} curve25519_64_adx.cc:_ZL32constant_time_conditional_memxorPvPKvmm: 425| 68.3M| const crypto_word_t mask) { 426| 68.3M| assert(!buffers_alias(dst, n, src, n)); 427| 68.3M| uint8_t *out = (uint8_t *)dst; 428| 68.3M| const uint8_t *in = (const uint8_t *)src; 429| |#if defined(__GNUC__) && !defined(__clang__) 430| | // gcc 13.2.0 doesn't automatically vectorize this loop regardless of barrier 431| | typedef uint8_t v32u8 __attribute__((vector_size(32), aligned(1), may_alias)); 432| | size_t n_vec = n & ~(size_t)31; 433| | v32u8 masks = ((uint8_t)mask - (v32u8){}); // broadcast 434| | for (size_t i = 0; i < n_vec; i += 32) { 435| | *(v32u8 *)&out[i] ^= masks & *(v32u8 *)&in[i]; 436| | } 437| | out += n_vec; 438| | n -= n_vec; 439| |#endif 440| 6.62G| for (size_t i = 0; i < n; i++) { ------------------ | Branch (440:22): [True: 6.56G, False: 68.3M] ------------------ 441| 6.56G| out[i] ^= value_barrier_w(mask) & in[i]; 442| 6.56G| } 443| 68.3M|} curve25519_64_adx.cc:_ZL13buffers_aliasPKvmS0_m: 168| 93.9M| size_t b_bytes) { 169| | // Cast |a| and |b| to integers. In C, pointer comparisons between unrelated 170| | // objects are undefined whereas pointer to integer conversions are merely 171| | // implementation-defined. We assume the implementation defined it in a sane 172| | // way. 173| 93.9M| uintptr_t a_u = (uintptr_t)a; 174| 93.9M| uintptr_t b_u = (uintptr_t)b; 175| 93.9M| return a_u + a_bytes > b_u && b_u + b_bytes > a_u; ------------------ | Branch (175:10): [True: 68.3M, False: 25.6M] | Branch (175:33): [True: 0, False: 68.3M] ------------------ 176| 93.9M|} curve25519_64_adx.cc:_ZL15value_barrier_wm: 239| 7.38G|static inline crypto_word_t value_barrier_w(crypto_word_t a) { 240| 7.38G|#if defined(__GNUC__) || defined(__clang__) 241| 7.38G| __asm__("" : "+r"(a) : /* no inputs */); 242| 7.38G|#endif 243| 7.38G| return a; 244| 7.38G|} curve25519_64_adx.cc:_ZL18constant_time_eq_wmm: 348| 68.3M| crypto_word_t b) { 349| 68.3M| return constant_time_is_zero_w(a ^ b); 350| 68.3M|} curve25519_64_adx.cc:_ZL32constant_time_conditional_memcpyPvPKvmm: 411| 25.6M| const crypto_word_t mask) { 412| 25.6M| assert(!buffers_alias(dst, n, src, n)); 413| 25.6M| uint8_t *out = (uint8_t *)dst; 414| 25.6M| const uint8_t *in = (const uint8_t *)src; 415| 845M| for (size_t i = 0; i < n; i++) { ------------------ | Branch (415:22): [True: 820M, False: 25.6M] ------------------ 416| 820M| out[i] = constant_time_select_8(mask, in[i], out[i]); 417| 820M| } 418| 25.6M|} curve25519_64_adx.cc:_ZL22constant_time_select_8mhh: 388| 820M| uint8_t b) { 389| | // |mask| is a word instead of |uint8_t| to avoid materializing 0x000..0MM 390| | // Making both |mask| and its value barrier |uint8_t| would allow the compiler 391| | // to materialize 0x????..?MM instead, but only clang is that clever. 392| | // However, vectorization of bitwise operations seems to work better on 393| | // |uint8_t| than a mix of |uint64_t| and |uint8_t|, so |m| is cast to 394| | // |uint8_t| after the value barrier but before the bitwise operations. 395| 820M| uint8_t m = value_barrier_w(mask); 396| 820M| return (m & a) | (~m & b); 397| 820M|} ecdsa_asn1.cc:_ZL14OPENSSL_memcmpPKvS0_m: 850| 6.87k|static inline int OPENSSL_memcmp(const void *s1, const void *s2, size_t n) { 851| 6.87k| if (n == 0) { ------------------ | Branch (851:7): [True: 0, False: 6.87k] ------------------ 852| 0| return 0; 853| 0| } 854| | 855| 6.87k| return memcmp(s1, s2, n); 856| 6.87k|} err.cc:_ZL14OPENSSL_memsetPvim: 874| 3.62M|static inline void *OPENSSL_memset(void *dst, int c, size_t n) { 875| 3.62M| if (n == 0) { ------------------ | Branch (875:7): [True: 0, False: 3.62M] ------------------ 876| 0| return dst; 877| 0| } 878| | 879| 3.62M| return memset(dst, c, n); 880| 3.62M|} evp_asn1.cc:_ZL14OPENSSL_memcmpPKvS0_m: 850| 127k|static inline int OPENSSL_memcmp(const void *s1, const void *s2, size_t n) { 851| 127k| if (n == 0) { ------------------ | Branch (851:7): [True: 0, False: 127k] ------------------ 852| 0| return 0; 853| 0| } 854| | 855| 127k| return memcmp(s1, s2, n); 856| 127k|} p_ed25519_asn1.cc:_ZL14OPENSSL_memcpyPvPKvm: 858| 45|static inline void *OPENSSL_memcpy(void *dst, const void *src, size_t n) { 859| 45| if (n == 0) { ------------------ | Branch (859:7): [True: 0, False: 45] ------------------ 860| 0| return dst; 861| 0| } 862| | 863| 45| return memcpy(dst, src, n); 864| 45|} p_x25519_asn1.cc:_ZL14OPENSSL_memcpyPvPKvm: 858| 15|static inline void *OPENSSL_memcpy(void *dst, const void *src, size_t n) { 859| 15| if (n == 0) { ------------------ | Branch (859:7): [True: 0, False: 15] ------------------ 860| 0| return dst; 861| 0| } 862| | 863| 15| return memcpy(dst, src, n); 864| 15|} hpke.cc:_ZL14OPENSSL_memsetPvim: 874| 71.0k|static inline void *OPENSSL_memset(void *dst, int c, size_t n) { 875| 71.0k| if (n == 0) { ------------------ | Branch (875:7): [True: 0, False: 71.0k] ------------------ 876| 0| return dst; 877| 0| } 878| | 879| 71.0k| return memset(dst, c, n); 880| 71.0k|} kyber.cc:_ZL14OPENSSL_memcpyPvPKvm: 858| 140|static inline void *OPENSSL_memcpy(void *dst, const void *src, size_t n) { 859| 140| if (n == 0) { ------------------ | Branch (859:7): [True: 0, False: 140] ------------------ 860| 0| return dst; 861| 0| } 862| | 863| 140| return memcpy(dst, src, n); 864| 140|} kyber.cc:_ZL28constant_time_declassify_inti: 481| 881k|static inline int constant_time_declassify_int(int v) { 482| 881k| static_assert(sizeof(uint32_t) == sizeof(int), 483| 881k| "int is not the same size as uint32_t"); 484| | // See comment above. 485| 881k| CONSTTIME_DECLASSIFY(&v, sizeof(v)); 486| 881k| return value_barrier_u32(v); 487| 881k|} kyber.cc:_ZL17value_barrier_u32j: 247| 881k|static inline uint32_t value_barrier_u32(uint32_t a) { 248| 881k|#if defined(__GNUC__) || defined(__clang__) 249| 881k| __asm__("" : "+r"(a) : /* no inputs */); 250| 881k|#endif 251| 881k| return a; 252| 881k|} kyber.cc:_ZL14OPENSSL_memsetPvim: 874| 28|static inline void *OPENSSL_memset(void *dst, int c, size_t n) { 875| 28| if (n == 0) { ------------------ | Branch (875:7): [True: 0, False: 28] ------------------ 876| 0| return dst; 877| 0| } 878| | 879| 28| return memset(dst, c, n); 880| 28|} md5.cc:_ZL14OPENSSL_memsetPvim: 874| 146k|static inline void *OPENSSL_memset(void *dst, int c, size_t n) { 875| 146k| if (n == 0) { ------------------ | Branch (875:7): [True: 9, False: 146k] ------------------ 876| 9| return dst; 877| 9| } 878| | 879| 146k| return memset(dst, c, n); 880| 146k|} md5.cc:_ZL19CRYPTO_store_u32_lePvj: 906| 349k|static inline void CRYPTO_store_u32_le(void *out, uint32_t v) { 907| 349k| OPENSSL_memcpy(out, &v, sizeof(v)); 908| 349k|} md5.cc:_ZL14OPENSSL_memcpyPvPKvm: 858| 463k|static inline void *OPENSSL_memcpy(void *dst, const void *src, size_t n) { 859| 463k| if (n == 0) { ------------------ | Branch (859:7): [True: 0, False: 463k] ------------------ 860| 0| return dst; 861| 0| } 862| | 863| 463k| return memcpy(dst, src, n); 864| 463k|} mem.cc:_ZL14OPENSSL_memsetPvim: 874| 25.4M|static inline void *OPENSSL_memset(void *dst, int c, size_t n) { 875| 25.4M| if (n == 0) { ------------------ | Branch (875:7): [True: 0, False: 25.4M] ------------------ 876| 0| return dst; 877| 0| } 878| | 879| 25.4M| return memset(dst, c, n); 880| 25.4M|} mem.cc:_ZL14OPENSSL_memcpyPvPKvm: 858| 1.48M|static inline void *OPENSSL_memcpy(void *dst, const void *src, size_t n) { 859| 1.48M| if (n == 0) { ------------------ | Branch (859:7): [True: 541, False: 1.48M] ------------------ 860| 541| return dst; 861| 541| } 862| | 863| 1.48M| return memcpy(dst, src, n); 864| 1.48M|} deterministic.cc:_ZL14OPENSSL_memsetPvim: 874| 214|static inline void *OPENSSL_memset(void *dst, int c, size_t n) { 875| 214| if (n == 0) { ------------------ | Branch (875:7): [True: 0, False: 214] ------------------ 876| 0| return dst; 877| 0| } 878| | 879| 214| return memset(dst, c, n); 880| 214|} deterministic.cc:_ZL14OPENSSL_memcpyPvPKvm: 858| 107|static inline void *OPENSSL_memcpy(void *dst, const void *src, size_t n) { 859| 107| if (n == 0) { ------------------ | Branch (859:7): [True: 0, False: 107] ------------------ 860| 0| return dst; 861| 0| } 862| | 863| 107| return memcpy(dst, src, n); 864| 107|} rsa_crypt.cc:_ZL14OPENSSL_memcpyPvPKvm: 858| 1.73k|static inline void *OPENSSL_memcpy(void *dst, const void *src, size_t n) { 859| 1.73k| if (n == 0) { ------------------ | Branch (859:7): [True: 0, False: 1.73k] ------------------ 860| 0| return dst; 861| 0| } 862| | 863| 1.73k| return memcpy(dst, src, n); 864| 1.73k|} rsa_crypt.cc:_ZL28constant_time_declassify_inti: 481| 324k|static inline int constant_time_declassify_int(int v) { 482| 324k| static_assert(sizeof(uint32_t) == sizeof(int), 483| 324k| "int is not the same size as uint32_t"); 484| | // See comment above. 485| 324k| CONSTTIME_DECLASSIFY(&v, sizeof(v)); 486| 324k| return value_barrier_u32(v); 487| 324k|} rsa_crypt.cc:_ZL17value_barrier_u32j: 247| 324k|static inline uint32_t value_barrier_u32(uint32_t a) { 248| 324k|#if defined(__GNUC__) || defined(__clang__) 249| 324k| __asm__("" : "+r"(a) : /* no inputs */); 250| 324k|#endif 251| 324k| return a; 252| 324k|} thread_pthread.cc:_ZL14OPENSSL_memsetPvim: 874| 2|static inline void *OPENSSL_memset(void *dst, int c, size_t n) { 875| 2| if (n == 0) { ------------------ | Branch (875:7): [True: 0, False: 2] ------------------ 876| 0| return dst; 877| 0| } 878| | 879| 2| return memset(dst, c, n); 880| 2|} x509_vfy.cc:_ZL14OPENSSL_memsetPvim: 874| 5.99k|static inline void *OPENSSL_memset(void *dst, int c, size_t n) { 875| 5.99k| if (n == 0) { ------------------ | Branch (875:7): [True: 0, False: 5.99k] ------------------ 876| 0| return dst; 877| 0| } 878| | 879| 5.99k| return memset(dst, c, n); 880| 5.99k|} x_name.cc:_ZL14OPENSSL_memcpyPvPKvm: 858| 139k|static inline void *OPENSSL_memcpy(void *dst, const void *src, size_t n) { 859| 139k| if (n == 0) { ------------------ | Branch (859:7): [True: 0, False: 139k] ------------------ 860| 0| return dst; 861| 0| } 862| | 863| 139k| return memcpy(dst, src, n); 864| 139k|} a_bitstr.cc:_ZL14OPENSSL_memcpyPvPKvm: 858| 71.9k|static inline void *OPENSSL_memcpy(void *dst, const void *src, size_t n) { 859| 71.9k| if (n == 0) { ------------------ | Branch (859:7): [True: 1.58k, False: 70.3k] ------------------ 860| 1.58k| return dst; 861| 1.58k| } 862| | 863| 70.3k| return memcpy(dst, src, n); 864| 71.9k|} a_int.cc:_ZL14OPENSSL_memcpyPvPKvm: 858| 152k|static inline void *OPENSSL_memcpy(void *dst, const void *src, size_t n) { 859| 152k| if (n == 0) { ------------------ | Branch (859:7): [True: 81, False: 152k] ------------------ 860| 81| return dst; 861| 81| } 862| | 863| 152k| return memcpy(dst, src, n); 864| 152k|} a_int.cc:_ZL13CRYPTO_bswap8m: 779| 69.1k|static inline uint64_t CRYPTO_bswap8(uint64_t x) { 780| 69.1k| return __builtin_bswap64(x); 781| 69.1k|} a_int.cc:_ZL18CRYPTO_load_u64_bePKv: 931| 69.1k|static inline uint64_t CRYPTO_load_u64_be(const void *ptr) { 932| 69.1k| uint64_t ret; 933| 69.1k| OPENSSL_memcpy(&ret, ptr, sizeof(ret)); 934| 69.1k| return CRYPTO_bswap8(ret); 935| 69.1k|} asn1_lib.cc:_ZL14OPENSSL_memcpyPvPKvm: 858| 1.02M|static inline void *OPENSSL_memcpy(void *dst, const void *src, size_t n) { 859| 1.02M| if (n == 0) { ------------------ | Branch (859:7): [True: 1.84k, False: 1.02M] ------------------ 860| 1.84k| return dst; 861| 1.84k| } 862| | 863| 1.02M| return memcpy(dst, src, n); 864| 1.02M|} tasn_enc.cc:_ZL14OPENSSL_memcmpPKvS0_m: 850| 1.53k|static inline int OPENSSL_memcmp(const void *s1, const void *s2, size_t n) { 851| 1.53k| if (n == 0) { ------------------ | Branch (851:7): [True: 0, False: 1.53k] ------------------ 852| 0| return 0; 853| 0| } 854| | 855| 1.53k| return memcmp(s1, s2, n); 856| 1.53k|} tasn_enc.cc:_ZL14OPENSSL_memcpyPvPKvm: 858| 769k|static inline void *OPENSSL_memcpy(void *dst, const void *src, size_t n) { 859| 769k| if (n == 0) { ------------------ | Branch (859:7): [True: 0, False: 769k] ------------------ 860| 0| return dst; 861| 0| } 862| | 863| 769k| return memcpy(dst, src, n); 864| 769k|} tasn_utl.cc:_ZL14OPENSSL_memcpyPvPKvm: 858| 2|static inline void *OPENSSL_memcpy(void *dst, const void *src, size_t n) { 859| 2| if (n == 0) { ------------------ | Branch (859:7): [True: 0, False: 2] ------------------ 860| 0| return dst; 861| 0| } 862| | 863| 2| return memcpy(dst, src, n); 864| 2|} des.cc:_ZL15CRYPTO_rotr_u32ji: 979| 288k|static inline uint32_t CRYPTO_rotr_u32(uint32_t value, int shift) { 980| |#if defined(_MSC_VER) 981| | return _rotr(value, shift); 982| |#else 983| 288k| return (value >> shift) | (value << ((-shift) & 31)); 984| 288k|#endif 985| 288k|} KYBER_generate_key: 619| 28| struct KYBER_private_key *out_private_key) { 620| 28| uint8_t entropy[KYBER_GENERATE_KEY_ENTROPY]; 621| 28| RAND_bytes(entropy, sizeof(entropy)); 622| 28| CONSTTIME_SECRET(entropy, sizeof(entropy)); 623| 28| KYBER_generate_key_external_entropy(out_encoded_public_key, out_private_key, 624| 28| entropy); 625| 28|} KYBER_generate_key_external_entropy: 645| 28| const uint8_t entropy[KYBER_GENERATE_KEY_ENTROPY]) { 646| 28| struct private_key *priv = private_key_from_external(out_private_key); 647| 28| uint8_t hashed[64]; 648| 28| hash_g(hashed, entropy, 32); 649| 28| const uint8_t *const rho = hashed; 650| 28| const uint8_t *const sigma = hashed + 32; 651| | // rho is public. 652| 28| CONSTTIME_DECLASSIFY(rho, 32); 653| 28| OPENSSL_memcpy(priv->pub.rho, hashed, sizeof(priv->pub.rho)); 654| 28| matrix_expand(&priv->pub.m, rho); 655| 28| uint8_t counter = 0; 656| 28| vector_generate_secret_eta_2(&priv->s, &counter, sigma); 657| 28| vector_ntt(&priv->s); 658| 28| vector error; 659| 28| vector_generate_secret_eta_2(&error, &counter, sigma); 660| 28| vector_ntt(&error); 661| 28| matrix_mult_transpose(&priv->pub.t, &priv->pub.m, &priv->s); 662| 28| vector_add(&priv->pub.t, &error); 663| | // t is part of the public key and thus is public. 664| 28| CONSTTIME_DECLASSIFY(&priv->pub.t, sizeof(priv->pub.t)); 665| | 666| 28| CBB cbb; 667| 28| CBB_init_fixed(&cbb, out_encoded_public_key, KYBER_PUBLIC_KEY_BYTES); ------------------ | | 59| 28|#define KYBER_PUBLIC_KEY_BYTES 1184 ------------------ 668| 28| if (!kyber_marshal_public_key(&cbb, &priv->pub)) { ------------------ | Branch (668:7): [True: 0, False: 28] ------------------ 669| 0| abort(); 670| 0| } 671| | 672| 28| hash_h(priv->pub.public_key_hash, out_encoded_public_key, 673| 28| KYBER_PUBLIC_KEY_BYTES); ------------------ | | 59| 28|#define KYBER_PUBLIC_KEY_BYTES 1184 ------------------ 674| 28| OPENSSL_memcpy(priv->fo_failure_secret, entropy + 32, 32); 675| 28|} kyber.cc:_ZN12_GLOBAL__N_125private_key_from_externalEPK17KYBER_private_key: 605| 28| const struct KYBER_private_key *external) { 606| 28| static_assert(sizeof(struct KYBER_private_key) >= sizeof(struct private_key), 607| 28| "Kyber private key too small"); 608| 28| static_assert( 609| 28| alignof(struct KYBER_private_key) >= alignof(struct private_key), 610| 28| "Kyber private key align incorrect"); 611| 28| return (struct private_key *)external; 612| 28|} kyber.cc:_ZL6hash_gPhPKhm: 40| 28|static void hash_g(uint8_t out[64], const uint8_t *in, size_t len) { 41| 28| BORINGSSL_keccak(out, 64, in, len, boringssl_sha3_512); 42| 28|} kyber.cc:_ZL13matrix_expandP6matrixPKh: 377| 28|static void matrix_expand(matrix *out, const uint8_t rho[32]) { 378| 28| uint8_t input[34]; 379| 28| OPENSSL_memcpy(input, rho, 32); 380| 112| for (int i = 0; i < RANK; i++) { ------------------ | | 49| 112|#define RANK 3 ------------------ | Branch (380:19): [True: 84, False: 28] ------------------ 381| 336| for (int j = 0; j < RANK; j++) { ------------------ | | 49| 336|#define RANK 3 ------------------ | Branch (381:21): [True: 252, False: 84] ------------------ 382| 252| input[32] = i; 383| 252| input[33] = j; 384| 252| struct BORINGSSL_keccak_st keccak_ctx; 385| 252| BORINGSSL_keccak_init(&keccak_ctx, boringssl_shake128); 386| 252| BORINGSSL_keccak_absorb(&keccak_ctx, input, sizeof(input)); 387| 252| scalar_from_keccak_vartime(&out->v[i][j], &keccak_ctx); 388| 252| } 389| 84| } 390| 28|} kyber.cc:_ZL26scalar_from_keccak_vartimeP6scalarP19BORINGSSL_keccak_st: 308| 252| struct BORINGSSL_keccak_st *keccak_ctx) { 309| 252| assert(keccak_ctx->squeeze_offset == 0); 310| 252| assert(keccak_ctx->rate_bytes == 168); 311| 252| static_assert(168 % 3 == 0, "block and coefficient boundaries do not align"); 312| | 313| 252| int done = 0; 314| 1.00k| while (done < DEGREE) { ------------------ | | 48| 1.00k|#define DEGREE 256 ------------------ | Branch (314:10): [True: 757, False: 252] ------------------ 315| 757| uint8_t block[168]; 316| 757| BORINGSSL_keccak_squeeze(keccak_ctx, block, sizeof(block)); 317| 40.4k| for (size_t i = 0; i < sizeof(block) && done < DEGREE; i += 3) { ------------------ | | 48| 39.9k|#define DEGREE 256 ------------------ | Branch (317:24): [True: 39.9k, False: 505] | Branch (317:45): [True: 39.7k, False: 252] ------------------ 318| 39.7k| uint16_t d1 = block[i] + 256 * (block[i + 1] % 16); 319| 39.7k| uint16_t d2 = block[i + 1] / 16 + 16 * block[i + 2]; 320| 39.7k| if (d1 < kPrime) { ------------------ | Branch (320:11): [True: 32.3k, False: 7.43k] ------------------ 321| 32.3k| out->c[done++] = d1; 322| 32.3k| } 323| 39.7k| if (d2 < kPrime && done < DEGREE) { ------------------ | | 48| 32.3k|#define DEGREE 256 ------------------ | Branch (323:11): [True: 32.3k, False: 7.42k] | Branch (323:26): [True: 32.2k, False: 107] ------------------ 324| 32.2k| out->c[done++] = d2; 325| 32.2k| } 326| 39.7k| } 327| 757| } 328| 252|} kyber.cc:_ZL28vector_generate_secret_eta_2P6vectorPhPKh: 367| 56| const uint8_t seed[32]) { 368| 56| uint8_t input[33]; 369| 56| OPENSSL_memcpy(input, seed, 32); 370| 224| for (int i = 0; i < RANK; i++) { ------------------ | | 49| 224|#define RANK 3 ------------------ | Branch (370:19): [True: 168, False: 56] ------------------ 371| 168| input[32] = (*counter)++; 372| 168| scalar_centered_binomial_distribution_eta_2_with_prf(&out->v[i], input); 373| 168| } 374| 56|} kyber.cc:_ZL52scalar_centered_binomial_distribution_eta_2_with_prfP6scalarPKh: 337| 168| scalar *out, const uint8_t input[33]) { 338| 168| uint8_t entropy[128]; 339| 168| static_assert(sizeof(entropy) == 2 * /*kEta=*/2 * DEGREE / 8); 340| 168| prf(entropy, sizeof(entropy), input); 341| | 342| 21.6k| for (int i = 0; i < DEGREE; i += 2) { ------------------ | | 48| 21.6k|#define DEGREE 256 ------------------ | Branch (342:19): [True: 21.5k, False: 168] ------------------ 343| 21.5k| uint8_t byte = entropy[i / 2]; 344| | 345| 21.5k| uint16_t value = (byte & 1) + ((byte >> 1) & 1); 346| 21.5k| value -= ((byte >> 2) & 1) + ((byte >> 3) & 1); 347| | // Add |kPrime| if |value| underflowed. See |reduce_once| for a discussion 348| | // on why the value barrier is omitted. While this could have been written 349| | // reduce_once(value + kPrime), this is one extra addition and small range 350| | // of |value| tempts some versions of Clang to emit a branch. 351| 21.5k| uint16_t mask = 0u - (value >> 15); 352| 21.5k| out->c[i] = value + (kPrime & mask); 353| | 354| 21.5k| byte >>= 4; 355| 21.5k| value = (byte & 1) + ((byte >> 1) & 1); 356| 21.5k| value -= ((byte >> 2) & 1) + ((byte >> 3) & 1); 357| | // See above. 358| 21.5k| mask = 0u - (value >> 15); 359| 21.5k| out->c[i + 1] = value + (kPrime & mask); 360| 21.5k| } 361| 168|} kyber.cc:_ZL3prfPhmPKh: 32| 168|static void prf(uint8_t *out, size_t out_len, const uint8_t in[33]) { 33| 168| BORINGSSL_keccak(out, out_len, in, 33, boringssl_shake256); 34| 168|} kyber.cc:_ZL10vector_nttP6vector: 193| 56|static void vector_ntt(vector *a) { 194| 224| for (int i = 0; i < RANK; i++) { ------------------ | | 49| 224|#define RANK 3 ------------------ | Branch (194:19): [True: 168, False: 56] ------------------ 195| 168| scalar_ntt(&a->v[i]); 196| 168| } 197| 56|} kyber.cc:_ZL10scalar_nttP6scalar: 173| 168|static void scalar_ntt(scalar *s) { 174| 168| int offset = DEGREE; ------------------ | | 48| 168|#define DEGREE 256 ------------------ 175| | // `int` is used here because using `size_t` throughout caused a ~5% slowdown 176| | // with Clang 14 on Aarch64. 177| 1.34k| for (int step = 1; step < DEGREE / 2; step <<= 1) { ------------------ | | 48| 1.34k|#define DEGREE 256 ------------------ | Branch (177:22): [True: 1.17k, False: 168] ------------------ 178| 1.17k| offset >>= 1; 179| 1.17k| int k = 0; 180| 22.5k| for (int i = 0; i < step; i++) { ------------------ | Branch (180:21): [True: 21.3k, False: 1.17k] ------------------ 181| 21.3k| const uint32_t step_root = kNTTRoots[i + step]; 182| 171k| for (int j = k; j < k + offset; j++) { ------------------ | Branch (182:23): [True: 150k, False: 21.3k] ------------------ 183| 150k| uint16_t odd = reduce(step_root * s->c[j + offset]); 184| 150k| uint16_t even = s->c[j]; 185| 150k| s->c[j] = reduce_once(odd + even); 186| 150k| s->c[j + offset] = reduce_once(even - odd + kPrime); 187| 150k| } 188| 21.3k| k += 2 * offset; 189| 21.3k| } 190| 1.17k| } 191| 168|} kyber.cc:_ZL6reducej: 155| 247k|static uint16_t reduce(uint32_t x) { 156| 247k| declassify_assert(x < kPrime + 2u * kPrime * kPrime); ------------------ | | 493| 247k|#define declassify_assert(expr) assert(constant_time_declassify_int(expr)) ------------------ 157| 247k| uint64_t product = (uint64_t)x * kBarrettMultiplier; 158| 247k| uint32_t quotient = (uint32_t)(product >> kBarrettShift); 159| 247k| uint32_t remainder = x - quotient * kPrime; 160| 247k| return reduce_once(remainder); 161| 247k|} kyber.cc:_ZL11reduce_oncet: 137| 634k|static uint16_t reduce_once(uint16_t x) { 138| 634k| declassify_assert(x < 2 * kPrime); ------------------ | | 493| 634k|#define declassify_assert(expr) assert(constant_time_declassify_int(expr)) ------------------ 139| 634k| const uint16_t subtracted = x - kPrime; 140| 634k| uint16_t mask = 0u - (subtracted >> 15); 141| | // Although this is a constant-time select, we omit a value barrier here. 142| | // Value barriers impede auto-vectorization (likely because it forces the 143| | // value to transit through a general-purpose register). On AArch64, this is a 144| | // difference of 2x. 145| | // 146| | // We usually add value barriers to selects because Clang turns consecutive 147| | // selects with the same condition into a branch instead of CMOV/CSEL. This 148| | // condition does not occur in Kyber, so omitting it seems to be safe so far, 149| | // but see |scalar_centered_binomial_distribution_eta_2_with_prf|. 150| 634k| return (mask & x) | (~mask & subtracted); 151| 634k|} kyber.cc:_ZL21matrix_mult_transposeP6vectorPK6matrixPKS_: 283| 28| const vector *a) { 284| 28| vector_zero(out); 285| 112| for (int i = 0; i < RANK; i++) { ------------------ | | 49| 112|#define RANK 3 ------------------ | Branch (285:19): [True: 84, False: 28] ------------------ 286| 336| for (int j = 0; j < RANK; j++) { ------------------ | | 49| 336|#define RANK 3 ------------------ | Branch (286:21): [True: 252, False: 84] ------------------ 287| 252| scalar product; 288| 252| scalar_mult(&product, &m->v[j][i], &a->v[j]); 289| 252| scalar_add(&out->v[i], &product); 290| 252| } 291| 84| } 292| 28|} kyber.cc:_ZL11vector_zeroP6vector: 165| 28|static void vector_zero(vector *out) { OPENSSL_memset(out, 0, sizeof(*out)); } kyber.cc:_ZL11scalar_multP6scalarPKS_S2_: 253| 252|static void scalar_mult(scalar *out, const scalar *lhs, const scalar *rhs) { 254| 32.5k| for (int i = 0; i < DEGREE / 2; i++) { ------------------ | | 48| 32.5k|#define DEGREE 256 ------------------ | Branch (254:19): [True: 32.2k, False: 252] ------------------ 255| 32.2k| uint32_t real_real = (uint32_t)lhs->c[2 * i] * rhs->c[2 * i]; 256| 32.2k| uint32_t img_img = (uint32_t)lhs->c[2 * i + 1] * rhs->c[2 * i + 1]; 257| 32.2k| uint32_t real_img = (uint32_t)lhs->c[2 * i] * rhs->c[2 * i + 1]; 258| 32.2k| uint32_t img_real = (uint32_t)lhs->c[2 * i + 1] * rhs->c[2 * i]; 259| 32.2k| out->c[2 * i] = 260| 32.2k| reduce(real_real + (uint32_t)reduce(img_img) * kModRoots[i]); 261| 32.2k| out->c[2 * i + 1] = reduce(img_real + real_img); 262| 32.2k| } 263| 252|} kyber.cc:_ZL10scalar_addP6scalarPKS_: 233| 336|static void scalar_add(scalar *lhs, const scalar *rhs) { 234| 86.3k| for (int i = 0; i < DEGREE; i++) { ------------------ | | 48| 86.3k|#define DEGREE 256 ------------------ | Branch (234:19): [True: 86.0k, False: 336] ------------------ 235| 86.0k| lhs->c[i] = reduce_once(lhs->c[i] + rhs->c[i]); 236| 86.0k| } 237| 336|} kyber.cc:_ZL10vector_addP6vectorPKS_: 265| 28|static void vector_add(vector *lhs, const vector *rhs) { 266| 112| for (int i = 0; i < RANK; i++) { ------------------ | | 49| 112|#define RANK 3 ------------------ | Branch (266:19): [True: 84, False: 28] ------------------ 267| 84| scalar_add(&lhs->v[i], &rhs->v[i]); 268| 84| } 269| 28|} kyber.cc:_ZL24kyber_marshal_public_keyP6cbb_stPKN12_GLOBAL__N_110public_keyE: 627| 28|static int kyber_marshal_public_key(CBB *out, const struct public_key *pub) { 628| 28| uint8_t *vector_output; 629| 28| if (!CBB_add_space(out, &vector_output, kEncodedVectorSize)) { ------------------ | Branch (629:7): [True: 0, False: 28] ------------------ 630| 0| return 0; 631| 0| } 632| 28| vector_encode(vector_output, &pub->t, kLog2Prime); 633| 28| if (!CBB_add_bytes(out, pub->rho, sizeof(pub->rho))) { ------------------ | Branch (633:7): [True: 0, False: 28] ------------------ 634| 0| return 0; 635| 0| } 636| 28| return 1; 637| 28|} kyber.cc:_ZL6hash_hPhPKhm: 36| 28|static void hash_h(uint8_t out[32], const uint8_t *in, size_t len) { 37| 28| BORINGSSL_keccak(out, 32, in, len, boringssl_sha3_256); 38| 28|} kyber.cc:_ZL13scalar_encodePhPK6scalari: 395| 84|static void scalar_encode(uint8_t *out, const scalar *s, int bits) { 396| 84| assert(bits <= (int)sizeof(*s->c) * 8 && bits != 1); 397| | 398| 84| uint8_t out_byte = 0; 399| 84| int out_byte_bits = 0; 400| | 401| 21.5k| for (int i = 0; i < DEGREE; i++) { ------------------ | | 48| 21.5k|#define DEGREE 256 ------------------ | Branch (401:19): [True: 21.5k, False: 84] ------------------ 402| 21.5k| uint16_t element = s->c[i]; 403| 21.5k| int element_bits_done = 0; 404| | 405| 64.5k| while (element_bits_done < bits) { ------------------ | Branch (405:12): [True: 43.0k, False: 21.5k] ------------------ 406| 43.0k| int chunk_bits = bits - element_bits_done; 407| 43.0k| int out_bits_remaining = 8 - out_byte_bits; 408| 43.0k| if (chunk_bits >= out_bits_remaining) { ------------------ | Branch (408:11): [True: 32.2k, False: 10.7k] ------------------ 409| 32.2k| chunk_bits = out_bits_remaining; 410| 32.2k| out_byte |= (element & kMasks[chunk_bits - 1]) << out_byte_bits; 411| 32.2k| *out = out_byte; 412| 32.2k| out++; 413| 32.2k| out_byte_bits = 0; 414| 32.2k| out_byte = 0; 415| 32.2k| } else { 416| 10.7k| out_byte |= (element & kMasks[chunk_bits - 1]) << out_byte_bits; 417| 10.7k| out_byte_bits += chunk_bits; 418| 10.7k| } 419| | 420| 43.0k| element_bits_done += chunk_bits; 421| 43.0k| element >>= chunk_bits; 422| 43.0k| } 423| 21.5k| } 424| | 425| 84| if (out_byte_bits > 0) { ------------------ | Branch (425:7): [True: 0, False: 84] ------------------ 426| 0| *out = out_byte; 427| 0| } 428| 84|} kyber.cc:_ZL13vector_encodePhPK6vectori: 445| 28|static void vector_encode(uint8_t *out, const vector *a, int bits) { 446| 112| for (int i = 0; i < RANK; i++) { ------------------ | | 49| 112|#define RANK 3 ------------------ | Branch (446:19): [True: 84, False: 28] ------------------ 447| 84| scalar_encode(out + i * bits * DEGREE / 8, &a->v[i], bits); ------------------ | | 48| 84|#define DEGREE 256 ------------------ 448| 84| } 449| 28|} _Z18lh_SSL_SESSION_newPFjPK14ssl_session_stEPFiS1_S1_E: 150| 2| lhash_##type##_cmp_func comp) { \ 151| 2| return (LHASH_OF(type) *)OPENSSL_lh_new((lhash_hash_func)hash, \ 152| 2| (lhash_cmp_func)comp); \ 153| 2| } \ _Z24lh_SSL_SESSION_doall_argP20lhash_st_SSL_SESSIONPFvP14ssl_session_stPvES3_: 215| 9.52k| void (*func)(type *, void *), void *arg) { \ 216| 9.52k| LHASH_DOALL_##type cb = {func, arg}; \ 217| 9.52k| OPENSSL_lh_doall_arg((_LHASH *)lh, lh_##type##_call_doall_arg, &cb); \ 218| 9.52k| } \ OPENSSL_lh_new: 62| 2|_LHASH *OPENSSL_lh_new(lhash_hash_func hash, lhash_cmp_func comp) { 63| 2| _LHASH *ret = reinterpret_cast<_LHASH *>(OPENSSL_zalloc(sizeof(_LHASH))); 64| 2| if (ret == NULL) { ------------------ | Branch (64:7): [True: 0, False: 2] ------------------ 65| 0| return NULL; 66| 0| } 67| | 68| 2| ret->num_buckets = kMinNumBuckets; 69| 2| ret->buckets = reinterpret_cast( 70| 2| OPENSSL_calloc(ret->num_buckets, sizeof(LHASH_ITEM *))); 71| 2| if (ret->buckets == NULL) { ------------------ | Branch (71:7): [True: 0, False: 2] ------------------ 72| 0| OPENSSL_free(ret); 73| 0| return NULL; 74| 0| } 75| | 76| 2| ret->comp = comp; 77| 2| ret->hash = hash; 78| 2| return ret; 79| 2|} OPENSSL_lh_doall_arg: 281| 9.52k|void OPENSSL_lh_doall_arg(_LHASH *lh, void (*func)(void *, void *), void *arg) { 282| 9.52k| if (lh == NULL) { ------------------ | Branch (282:7): [True: 0, False: 9.52k] ------------------ 283| 0| return; 284| 0| } 285| | 286| 9.52k| if (lh->callback_depth < UINT_MAX) { ------------------ | Branch (286:7): [True: 9.52k, False: 0] ------------------ 287| | // |callback_depth| is a saturating counter. 288| 9.52k| lh->callback_depth++; 289| 9.52k| } 290| | 291| 161k| for (size_t i = 0; i < lh->num_buckets; i++) { ------------------ | Branch (291:22): [True: 152k, False: 9.52k] ------------------ 292| 152k| LHASH_ITEM *next; 293| 152k| for (LHASH_ITEM *cur = lh->buckets[i]; cur != NULL; cur = next) { ------------------ | Branch (293:44): [True: 0, False: 152k] ------------------ 294| 0| next = cur->next; 295| 0| func(cur->data, arg); 296| 0| } 297| 152k| } 298| | 299| 9.52k| if (lh->callback_depth < UINT_MAX) { ------------------ | Branch (299:7): [True: 9.52k, False: 0] ------------------ 300| 9.52k| lh->callback_depth--; 301| 9.52k| } 302| | 303| | // The callback may have added or removed elements and the non-zero value of 304| | // |callback_depth| will have suppressed any resizing. Thus any needed 305| | // resizing is done here. 306| 9.52k| lh_maybe_resize(lh); 307| 9.52k|} lhash.cc:_ZL15lh_maybe_resizeP8lhash_st: 193| 9.52k|static void lh_maybe_resize(_LHASH *lh) { 194| 9.52k| size_t avg_chain_length; 195| | 196| 9.52k| if (lh->callback_depth > 0) { ------------------ | Branch (196:7): [True: 0, False: 9.52k] ------------------ 197| | // Don't resize the hash if we are currently iterating over it. 198| 0| return; 199| 0| } 200| | 201| 9.52k| assert(lh->num_buckets >= kMinNumBuckets); 202| 9.52k| avg_chain_length = lh->num_items / lh->num_buckets; 203| | 204| 9.52k| if (avg_chain_length > kMaxAverageChainLength) { ------------------ | Branch (204:7): [True: 0, False: 9.52k] ------------------ 205| 0| const size_t new_num_buckets = lh->num_buckets * 2; 206| | 207| 0| if (new_num_buckets > lh->num_buckets) { ------------------ | Branch (207:9): [True: 0, False: 0] ------------------ 208| 0| lh_rebucket(lh, new_num_buckets); 209| 0| } 210| 9.52k| } else if (avg_chain_length < kMinAverageChainLength && ------------------ | Branch (210:14): [True: 9.52k, False: 0] ------------------ 211| 9.52k| lh->num_buckets > kMinNumBuckets) { ------------------ | Branch (211:14): [True: 0, False: 9.52k] ------------------ 212| 0| size_t new_num_buckets = lh->num_buckets / 2; 213| | 214| 0| if (new_num_buckets < kMinNumBuckets) { ------------------ | Branch (214:9): [True: 0, False: 0] ------------------ 215| 0| new_num_buckets = kMinNumBuckets; 216| 0| } 217| | 218| 0| lh_rebucket(lh, new_num_buckets); 219| 0| } 220| 9.52k|} MD5_Init: 36| 9.73k|int MD5_Init(MD5_CTX *md5) { 37| 9.73k| OPENSSL_memset(md5, 0, sizeof(MD5_CTX)); 38| 9.73k| md5->h[0] = 0x67452301UL; 39| 9.73k| md5->h[1] = 0xefcdab89UL; 40| 9.73k| md5->h[2] = 0x98badcfeUL; 41| 9.73k| md5->h[3] = 0x10325476UL; 42| 9.73k| return 1; 43| 9.73k|} MD5_Update: 68| 109k|int MD5_Update(MD5_CTX *c, const void *data, size_t len) { 69| 109k| bssl::crypto_md32_update( 70| 109k| c, bssl::Span(static_cast(data), len)); 71| 109k| return 1; 72| 109k|} MD5_Final: 74| 58.2k|int MD5_Final(uint8_t out[MD5_DIGEST_LENGTH], MD5_CTX *c) { 75| 58.2k| bssl::crypto_md32_final(c); 76| 58.2k| CRYPTO_store_u32_le(out, c->h[0]); 77| 58.2k| CRYPTO_store_u32_le(out + 4, c->h[1]); 78| 58.2k| CRYPTO_store_u32_le(out + 8, c->h[2]); 79| 58.2k| CRYPTO_store_u32_le(out + 12, c->h[3]); 80| 58.2k| return 1; 81| 58.2k|} md5.cc:_ZN12_GLOBAL__N_19MD5Traits10HashBlocksEPjPKhm: 62| 92.3k| size_t num_blocks) { 63| 92.3k| md5_block_data_order(state, data, num_blocks); ------------------ | | 46| 92.3k|#define md5_block_data_order md5_block_asm_data_order ------------------ 64| 92.3k| } OPENSSL_malloc: 185| 15.9M|void *OPENSSL_malloc(size_t size) { 186| 15.9M| void *ptr = nullptr; 187| 15.9M| if (should_fail_allocation()) { ------------------ | Branch (187:7): [True: 0, False: 15.9M] ------------------ 188| 0| goto err; 189| 0| } 190| | 191| 15.9M| if (OPENSSL_memory_alloc != NULL) { ------------------ | Branch (191:7): [True: 0, False: 15.9M] ------------------ 192| 0| assert(OPENSSL_memory_free != NULL); 193| 0| assert(OPENSSL_memory_get_size != NULL); 194| 0| void *ptr2 = OPENSSL_memory_alloc(size); 195| 0| if (ptr2 == NULL && size != 0) { ------------------ | Branch (195:9): [True: 0, False: 0] | Branch (195:25): [True: 0, False: 0] ------------------ 196| 0| goto err; 197| 0| } 198| 0| return ptr2; 199| 0| } 200| | 201| 15.9M| if (size + OPENSSL_MALLOC_PREFIX < size) { ------------------ | | 39| 15.9M|#define OPENSSL_MALLOC_PREFIX 8 ------------------ | Branch (201:7): [True: 0, False: 15.9M] ------------------ 202| 0| goto err; 203| 0| } 204| | 205| 15.9M| ptr = malloc(size + OPENSSL_MALLOC_PREFIX); ------------------ | | 39| 15.9M|#define OPENSSL_MALLOC_PREFIX 8 ------------------ 206| 15.9M| if (ptr == NULL) { ------------------ | Branch (206:7): [True: 0, False: 15.9M] ------------------ 207| 0| goto err; 208| 0| } 209| | 210| 15.9M| *(size_t *)ptr = size; 211| | 212| 15.9M| __asan_poison_memory_region(ptr, OPENSSL_MALLOC_PREFIX); ------------------ | | 39| 15.9M|#define OPENSSL_MALLOC_PREFIX 8 ------------------ 213| 15.9M| return ((uint8_t *)ptr) + OPENSSL_MALLOC_PREFIX; ------------------ | | 39| 15.9M|#define OPENSSL_MALLOC_PREFIX 8 ------------------ 214| | 215| 0|err: 216| | // This only works because ERR does not call OPENSSL_malloc. 217| 0| OPENSSL_PUT_ERROR(CRYPTO, ERR_R_MALLOC_FAILURE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 218| 0| return NULL; 219| 15.9M|} OPENSSL_zalloc: 221| 6.31M|void *OPENSSL_zalloc(size_t size) { 222| 6.31M| void *ret = OPENSSL_malloc(size); 223| 6.31M| if (ret != NULL) { ------------------ | Branch (223:7): [True: 6.31M, False: 0] ------------------ 224| 6.31M| OPENSSL_memset(ret, 0, size); 225| 6.31M| } 226| 6.31M| return ret; 227| 6.31M|} OPENSSL_calloc: 229| 2.12M|void *OPENSSL_calloc(size_t num, size_t size) { 230| 2.12M| if (size != 0 && num > SIZE_MAX / size) { ------------------ | Branch (230:7): [True: 2.12M, False: 0] | Branch (230:20): [True: 0, False: 2.12M] ------------------ 231| 0| OPENSSL_PUT_ERROR(CRYPTO, ERR_R_OVERFLOW); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 232| 0| return NULL; 233| 0| } 234| | 235| 2.12M| return OPENSSL_zalloc(num * size); 236| 2.12M|} OPENSSL_free: 238| 25.1M|void OPENSSL_free(void *orig_ptr) { 239| 25.1M| if (orig_ptr == NULL) { ------------------ | Branch (239:7): [True: 9.15M, False: 15.9M] ------------------ 240| 9.15M| return; 241| 9.15M| } 242| | 243| 15.9M| if (OPENSSL_memory_free != NULL) { ------------------ | Branch (243:7): [True: 0, False: 15.9M] ------------------ 244| 0| OPENSSL_memory_free(orig_ptr); 245| 0| return; 246| 0| } 247| | 248| 15.9M| void *ptr = ((uint8_t *)orig_ptr) - OPENSSL_MALLOC_PREFIX; ------------------ | | 39| 15.9M|#define OPENSSL_MALLOC_PREFIX 8 ------------------ 249| 15.9M| __asan_unpoison_memory_region(ptr, OPENSSL_MALLOC_PREFIX); ------------------ | | 39| 15.9M|#define OPENSSL_MALLOC_PREFIX 8 ------------------ 250| | 251| 15.9M| size_t size = *(size_t *)ptr; 252| 15.9M| OPENSSL_cleanse(ptr, size + OPENSSL_MALLOC_PREFIX); ------------------ | | 39| 15.9M|#define OPENSSL_MALLOC_PREFIX 8 ------------------ 253| | 254| |// ASan knows to intercept malloc and free, but not sdallocx. 255| |#if defined(OPENSSL_ASAN) 256| | (void)sdallocx; 257| | free(ptr); 258| |#else 259| 15.9M| if (sdallocx) { ------------------ | Branch (259:7): [Folded - Ignored] ------------------ 260| 0| sdallocx(ptr, size + OPENSSL_MALLOC_PREFIX, 0 /* flags */); ------------------ | | 39| 0|#define OPENSSL_MALLOC_PREFIX 8 ------------------ 261| 15.9M| } else { 262| 15.9M| free(ptr); 263| 15.9M| } 264| 15.9M|#endif 265| 15.9M|} OPENSSL_realloc: 267| 1.24M|void *OPENSSL_realloc(void *orig_ptr, size_t new_size) { 268| 1.24M| if (orig_ptr == NULL) { ------------------ | Branch (268:7): [True: 521k, False: 719k] ------------------ 269| 521k| return OPENSSL_malloc(new_size); 270| 521k| } 271| | 272| 719k| size_t old_size; 273| 719k| if (OPENSSL_memory_get_size != NULL) { ------------------ | Branch (273:7): [True: 0, False: 719k] ------------------ 274| 0| old_size = OPENSSL_memory_get_size(orig_ptr); 275| 719k| } else { 276| 719k| void *ptr = ((uint8_t *)orig_ptr) - OPENSSL_MALLOC_PREFIX; ------------------ | | 39| 719k|#define OPENSSL_MALLOC_PREFIX 8 ------------------ 277| 719k| __asan_unpoison_memory_region(ptr, OPENSSL_MALLOC_PREFIX); ------------------ | | 39| 719k|#define OPENSSL_MALLOC_PREFIX 8 ------------------ 278| 719k| old_size = *(size_t *)ptr; 279| 719k| __asan_poison_memory_region(ptr, OPENSSL_MALLOC_PREFIX); ------------------ | | 39| 719k|#define OPENSSL_MALLOC_PREFIX 8 ------------------ 280| 719k| } 281| | 282| 719k| void *ret = OPENSSL_malloc(new_size); 283| 719k| if (ret == NULL) { ------------------ | Branch (283:7): [True: 0, False: 719k] ------------------ 284| 0| return NULL; 285| 0| } 286| | 287| 719k| size_t to_copy = new_size; 288| 719k| if (old_size < to_copy) { ------------------ | Branch (288:7): [True: 719k, False: 0] ------------------ 289| 719k| to_copy = old_size; 290| 719k| } 291| | 292| 719k| memcpy(ret, orig_ptr, to_copy); 293| 719k| OPENSSL_free(orig_ptr); 294| | 295| 719k| return ret; 296| 719k|} OPENSSL_cleanse: 298| 19.1M|void OPENSSL_cleanse(void *ptr, size_t len) { 299| |#if defined(OPENSSL_WINDOWS) 300| | SecureZeroMemory(ptr, len); 301| |#else 302| 19.1M| OPENSSL_memset(ptr, 0, len); 303| | 304| 19.1M|#if !defined(OPENSSL_NO_ASM) 305| | /* As best as we can tell, this is sufficient to break any optimisations that 306| | might try to eliminate "superfluous" memsets. If there's an easy way to 307| | detect memset_s, it would be better to use that. */ 308| 19.1M| __asm__ __volatile__("" : : "r"(ptr) : "memory"); 309| 19.1M|#endif 310| 19.1M|#endif // !OPENSSL_NO_ASM 311| 19.1M|} CRYPTO_memcmp: 327| 187k|int CRYPTO_memcmp(const void *in_a, const void *in_b, size_t len) { 328| 187k| const uint8_t *a = reinterpret_cast(in_a); 329| 187k| const uint8_t *b = reinterpret_cast(in_b); 330| 187k| uint8_t x = 0; 331| | 332| 4.40M| for (size_t i = 0; i < len; i++) { ------------------ | Branch (332:22): [True: 4.21M, False: 187k] ------------------ 333| 4.21M| x |= a[i] ^ b[i]; 334| 4.21M| } 335| | 336| 187k| return x; 337| 187k|} OPENSSL_strnlen: 357| 861|size_t OPENSSL_strnlen(const char *s, size_t len) { 358| 4.54k| for (size_t i = 0; i < len; i++) { ------------------ | Branch (358:22): [True: 3.68k, False: 861] ------------------ 359| 3.68k| if (s[i] == 0) { ------------------ | Branch (359:9): [True: 0, False: 3.68k] ------------------ 360| 0| return i; 361| 0| } 362| 3.68k| } 363| | 364| 861| return len; 365| 861|} OPENSSL_strdup: 367| 5.18k|char *OPENSSL_strdup(const char *s) { 368| 5.18k| if (s == NULL) { ------------------ | Branch (368:7): [True: 0, False: 5.18k] ------------------ 369| 0| return NULL; 370| 0| } 371| | // Copy the NUL terminator. 372| 5.18k| return reinterpret_cast(OPENSSL_memdup(s, strlen(s) + 1)); 373| 5.18k|} OPENSSL_isalpha: 375| 26|int OPENSSL_isalpha(int c) { 376| 26| return (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z'); ------------------ | Branch (376:11): [True: 0, False: 26] | Branch (376:23): [True: 0, False: 0] | Branch (376:37): [True: 18, False: 8] | Branch (376:49): [True: 18, False: 0] ------------------ 377| 26|} OPENSSL_isdigit: 379| 1.67M|int OPENSSL_isdigit(int c) { return c >= '0' && c <= '9'; } ------------------ | Branch (379:37): [True: 1.67M, False: 30] | Branch (379:49): [True: 1.67M, False: 36] ------------------ OPENSSL_isalnum: 401| 26|int OPENSSL_isalnum(int c) { return OPENSSL_isalpha(c) || OPENSSL_isdigit(c); } ------------------ | Branch (401:37): [True: 18, False: 8] | Branch (401:59): [True: 2, False: 6] ------------------ OPENSSL_tolower: 403| 3.40M|int OPENSSL_tolower(int c) { 404| 3.40M| if (c >= 'A' && c <= 'Z') { ------------------ | Branch (404:7): [True: 3.17M, False: 227k] | Branch (404:19): [True: 810k, False: 2.36M] ------------------ 405| 810k| return c + ('a' - 'A'); 406| 810k| } 407| 2.58M| return c; 408| 3.40M|} OPENSSL_isspace: 410| 4.66M|int OPENSSL_isspace(int c) { 411| 4.66M| return c == '\t' || c == '\n' || c == '\v' || c == '\f' || c == '\r' || ------------------ | Branch (411:10): [True: 4.68k, False: 4.65M] | Branch (411:23): [True: 1.80k, False: 4.65M] | Branch (411:36): [True: 1.38k, False: 4.65M] | Branch (411:49): [True: 2.76k, False: 4.65M] | Branch (411:62): [True: 334, False: 4.65M] ------------------ 412| 4.66M| c == ' '; ------------------ | Branch (412:10): [True: 296k, False: 4.35M] ------------------ 413| 4.66M|} OPENSSL_vasprintf_internal: 460| 231| int system_malloc) { 461| 231| void *(*allocate)(size_t) = system_malloc ? malloc : OPENSSL_malloc; ------------------ | Branch (461:31): [True: 231, False: 0] ------------------ 462| 231| void (*deallocate)(void *) = system_malloc ? free : OPENSSL_free; ------------------ | Branch (462:32): [True: 231, False: 0] ------------------ 463| 231| void *(*reallocate)(void *, size_t) = 464| 231| system_malloc ? realloc : OPENSSL_realloc; ------------------ | Branch (464:7): [True: 231, False: 0] ------------------ 465| 231| char *candidate = NULL; 466| 231| size_t candidate_len = 64; // TODO(bbe) what's the best initial size? 467| 231| int ret; 468| | 469| 231| if ((candidate = reinterpret_cast(allocate(candidate_len))) == NULL) { ------------------ | Branch (469:7): [True: 0, False: 231] ------------------ 470| 0| goto err; 471| 0| } 472| 231| va_list args_copy; 473| 231| va_copy(args_copy, args); 474| 231| ret = vsnprintf(candidate, candidate_len, format, args_copy); 475| 231| va_end(args_copy); 476| 231| if (ret < 0) { ------------------ | Branch (476:7): [True: 0, False: 231] ------------------ 477| 0| goto err; 478| 0| } 479| 231| if ((size_t)ret >= candidate_len) { ------------------ | Branch (479:7): [True: 0, False: 231] ------------------ 480| | // Too big to fit in allocation. 481| 0| char *tmp; 482| | 483| 0| candidate_len = (size_t)ret + 1; 484| 0| if ((tmp = reinterpret_cast( ------------------ | Branch (484:9): [True: 0, False: 0] ------------------ 485| 0| reallocate(candidate, candidate_len))) == NULL) { 486| 0| goto err; 487| 0| } 488| 0| candidate = tmp; 489| 0| ret = vsnprintf(candidate, candidate_len, format, args); 490| 0| } 491| | // At this point this should not happen unless vsnprintf is insane. 492| 231| if (ret < 0 || (size_t)ret >= candidate_len) { ------------------ | Branch (492:7): [True: 0, False: 231] | Branch (492:18): [True: 0, False: 231] ------------------ 493| 0| goto err; 494| 0| } 495| 231| *str = candidate; 496| 231| return ret; 497| | 498| 0|err: 499| 0| deallocate(candidate); 500| 0| *str = NULL; 501| 0| errno = ENOMEM; 502| 0| return -1; 503| 231|} OPENSSL_strndup: 517| 861|char *OPENSSL_strndup(const char *str, size_t size) { 518| 861| size = OPENSSL_strnlen(str, size); 519| | 520| 861| size_t alloc_size = size + 1; 521| 861| if (alloc_size < size) { ------------------ | Branch (521:7): [True: 0, False: 861] ------------------ 522| | // overflow 523| 0| OPENSSL_PUT_ERROR(CRYPTO, ERR_R_MALLOC_FAILURE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 524| 0| return NULL; 525| 0| } 526| 861| char *ret = reinterpret_cast(OPENSSL_malloc(alloc_size)); 527| 861| if (ret == NULL) { ------------------ | Branch (527:7): [True: 0, False: 861] ------------------ 528| 0| return NULL; 529| 0| } 530| | 531| 861| OPENSSL_memcpy(ret, str, size); 532| 861| ret[size] = '\0'; 533| 861| return ret; 534| 861|} OPENSSL_strlcpy: 536| 6.53k|size_t OPENSSL_strlcpy(char *dst, const char *src, size_t dst_size) { 537| 6.53k| size_t l = 0; 538| | 539| 56.5k| for (; dst_size > 1 && *src; dst_size--) { ------------------ | Branch (539:10): [True: 54.7k, False: 1.81k] | Branch (539:26): [True: 50.0k, False: 4.71k] ------------------ 540| 50.0k| *dst++ = *src++; 541| 50.0k| l++; 542| 50.0k| } 543| | 544| 6.53k| if (dst_size) { ------------------ | Branch (544:7): [True: 6.53k, False: 0] ------------------ 545| 6.53k| *dst = 0; 546| 6.53k| } 547| | 548| 6.53k| return l + strlen(src); 549| 6.53k|} OPENSSL_strlcat: 551| 6.53k|size_t OPENSSL_strlcat(char *dst, const char *src, size_t dst_size) { 552| 6.53k| size_t l = 0; 553| 67.7k| for (; dst_size > 0 && *dst; dst_size--, dst++) { ------------------ | Branch (553:10): [True: 67.7k, False: 0] | Branch (553:26): [True: 61.2k, False: 6.53k] ------------------ 554| 61.2k| l++; 555| 61.2k| } 556| 6.53k| return l + OPENSSL_strlcpy(dst, src, dst_size); 557| 6.53k|} OPENSSL_memdup: 559| 1.48M|void *OPENSSL_memdup(const void *data, size_t size) { 560| 1.48M| if (size == 0) { ------------------ | Branch (560:7): [True: 278, False: 1.48M] ------------------ 561| 278| return NULL; 562| 278| } 563| | 564| 1.48M| void *ret = OPENSSL_malloc(size); 565| 1.48M| if (ret == NULL) { ------------------ | Branch (565:7): [True: 0, False: 1.48M] ------------------ 566| 0| return NULL; 567| 0| } 568| | 569| 1.48M| OPENSSL_memcpy(ret, data, size); 570| 1.48M| return ret; 571| 1.48M|} mem.cc:_ZL22should_fail_allocationv: 182| 15.9M|static int should_fail_allocation(void) { return 0; } mem.cc:_ZL27__asan_poison_memory_regionPKvm: 48| 16.6M|static void __asan_poison_memory_region(const void *addr, size_t size) {} mem.cc:_ZL29__asan_unpoison_memory_regionPKvm: 49| 16.6M|static void __asan_unpoison_memory_region(const void *addr, size_t size) {} _ZN4bssl13InplaceVectorIhLm48EEC2Ev: 380| 814k| InplaceVector() = default; _ZN4bssl8internal11DeleterImplINS_14SSLAEADContextEvE4FreeEPS2_: 71| 144k| static void Free(T *t) { Delete(t); } _ZN4bssl6DeleteINS_14SSLAEADContextEEEvPT_: 59| 144k|void Delete(T *t) { 60| 144k| if (t != nullptr) { ------------------ | Branch (60:7): [True: 144k, False: 0] ------------------ 61| 144k| t->~T(); 62| 144k| OPENSSL_free(t); 63| 144k| } 64| 144k|} _ZN4bssl13InplaceVectorIhLm48EE8CopyFromENS_4SpanIKhEE: 512| 106k| void CopyFrom(Span in) { BSSL_CHECK(TryCopyFrom(in)); } ------------------ | | 384| 106k| do { \ | | 385| 106k| if (!(condition)) { \ | | ------------------ | | | Branch (385:9): [True: 0, False: 106k] | | ------------------ | | 386| 0| abort(); \ | | 387| 0| } \ | | 388| 106k| } while (0); | | ------------------ | | | Branch (388:12): [Folded - Ignored] | | ------------------ ------------------ _ZN4bssl13InplaceVectorIhLm48EE11TryCopyFromENS_4SpanIKhEE: 484| 146k| [[nodiscard]] bool TryCopyFrom(Span in) { 485| 146k| if (in.size() > capacity()) { ------------------ | Branch (485:9): [True: 3, False: 146k] ------------------ 486| 3| return false; 487| 3| } 488| 146k| clear(); 489| 146k| std::uninitialized_copy(in.begin(), in.end(), data()); 490| 146k| size_ = in.size(); 491| 146k| return true; 492| 146k| } _ZN4bssl13InplaceVectorIhLm48EE8capacityEv: 400| 251k| static constexpr size_t capacity() { return N; } _ZN4bssl13InplaceVectorIhLm48EE5clearEv: 434| 960k| void clear() { Shrink(0); } _ZN4bssl13InplaceVectorIhLm48EE6ShrinkEm: 444| 960k| void Shrink(size_t new_size) { 445| 960k| BSSL_CHECK(new_size <= size_); ------------------ | | 384| 960k| do { \ | | 385| 960k| if (!(condition)) { \ | | ------------------ | | | Branch (385:9): [True: 0, False: 960k] | | ------------------ | | 386| 0| abort(); \ | | 387| 0| } \ | | 388| 960k| } while (0); | | ------------------ | | | Branch (388:12): [Folded - Ignored] | | ------------------ ------------------ 446| 960k| std::destroy_n(data() + new_size, size_ - new_size); 447| 960k| size_ = static_cast>(new_size); 448| 960k| } _ZN4bssl13InplaceVectorIhLm48EE4dataEv: 398| 1.32M| T *data() { return reinterpret_cast(storage_); } _ZNK4bssl13InplaceVectorIhLm48EE4sizeEv: 399| 427k| size_t size() const { return size_; } _ZN4bssl13InplaceVectorIhLm48EED2Ev: 383| 814k| ~InplaceVector() { clear(); } _ZNK4bssl5ArrayIhE5emptyEv: 106| 2.31M| bool empty() const { return size_ == 0; } _ZN4bssl5ArrayIhE4dataEv: 104| 109k| T *data() { return data_; } _ZNK4bssl5ArrayIhE4sizeEv: 105| 1.44M| size_t size() const { return size_; } _ZNK4bssl5ArrayIhE4dataEv: 103| 1.24M| const T *data() const { return data_; } _ZN4bssl5ArrayIhE5ResetEv: 139| 4.14M| void Reset() { Reset(nullptr, 0); } _ZN4bssl5ArrayIhE5ResetEPhm: 143| 4.46M| void Reset(T *new_data, size_t new_size) { 144| 4.46M| std::destroy_n(data_, size_); 145| 4.46M| OPENSSL_free(data_); 146| 4.46M| data_ = new_data; 147| 4.46M| size_ = new_size; 148| 4.46M| } _ZN4bssl5ArrayIhEC2Ev: 90| 2.65M| Array() {} _ZN4bssl5ArrayIhED2Ev: 94| 2.86M| ~Array() { Reset(); } _ZN4bssl5ArrayIhE8CopyFromENS_4SpanIKhEE: 184| 519k| [[nodiscard]] bool CopyFrom(Span in) { 185| 519k| if (!InitUninitialized(in.size())) { ------------------ | Branch (185:9): [True: 0, False: 519k] ------------------ 186| 0| return false; 187| 0| } 188| 519k| std::uninitialized_copy(in.begin(), in.end(), data_); 189| 519k| return true; 190| 519k| } _ZN4bssl5ArrayIhE17InitUninitializedEm: 206| 623k| bool InitUninitialized(size_t new_size) { 207| 623k| Reset(); 208| 623k| if (new_size == 0) { ------------------ | Branch (208:9): [True: 301k, False: 322k] ------------------ 209| 301k| return true; 210| 301k| } 211| | 212| 322k| if (new_size > SIZE_MAX / sizeof(T)) { ------------------ | Branch (212:9): [True: 0, False: 322k] ------------------ 213| 0| OPENSSL_PUT_ERROR(CRYPTO, ERR_R_OVERFLOW); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 214| 0| return false; 215| 0| } 216| 322k| data_ = reinterpret_cast(OPENSSL_malloc(new_size * sizeof(T))); 217| 322k| if (data_ == nullptr) { ------------------ | Branch (217:9): [True: 0, False: 322k] ------------------ 218| 0| return false; 219| 0| } 220| 322k| size_ = new_size; 221| 322k| return true; 222| 322k| } _ZN4bssl5ArrayIhE16InitForOverwriteEm: 174| 104k| [[nodiscard]] bool InitForOverwrite(size_t new_size) { 175| 104k| if (!InitUninitialized(new_size)) { ------------------ | Branch (175:9): [True: 0, False: 104k] ------------------ 176| 0| return false; 177| 0| } 178| 104k| std::uninitialized_default_construct_n(data_, size_); 179| 104k| return true; 180| 104k| } _ZN4bssl5ArrayIhEC2EOS1_: 92| 217k| Array(Array &&other) { *this = std::move(other); } _ZN4bssl5ArrayIhEaSEOS1_: 97| 267k| Array &operator=(Array &&other) { 98| 267k| Reset(); 99| 267k| other.Release(&data_, &size_); 100| 267k| return *this; 101| 267k| } _ZN4bssl5ArrayIhE7ReleaseEPPhPm: 152| 267k| void Release(T **out, size_t *out_size) { 153| 267k| *out = data_; 154| 267k| *out_size = size_; 155| 267k| data_ = nullptr; 156| 267k| size_ = 0; 157| 267k| } _ZN4bssl5ArrayItEC2Ev: 90| 375k| Array() {} _ZN4bssl5ArrayItE16InitForOverwriteEm: 174| 82.8k| [[nodiscard]] bool InitForOverwrite(size_t new_size) { 175| 82.8k| if (!InitUninitialized(new_size)) { ------------------ | Branch (175:9): [True: 0, False: 82.8k] ------------------ 176| 0| return false; 177| 0| } 178| 82.8k| std::uninitialized_default_construct_n(data_, size_); 179| 82.8k| return true; 180| 82.8k| } _ZN4bssl5ArrayItE17InitUninitializedEm: 206| 142k| bool InitUninitialized(size_t new_size) { 207| 142k| Reset(); 208| 142k| if (new_size == 0) { ------------------ | Branch (208:9): [True: 39.8k, False: 102k] ------------------ 209| 39.8k| return true; 210| 39.8k| } 211| | 212| 102k| if (new_size > SIZE_MAX / sizeof(T)) { ------------------ | Branch (212:9): [True: 0, False: 102k] ------------------ 213| 0| OPENSSL_PUT_ERROR(CRYPTO, ERR_R_OVERFLOW); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 214| 0| return false; 215| 0| } 216| 102k| data_ = reinterpret_cast(OPENSSL_malloc(new_size * sizeof(T))); 217| 102k| if (data_ == nullptr) { ------------------ | Branch (217:9): [True: 0, False: 102k] ------------------ 218| 0| return false; 219| 0| } 220| 102k| size_ = new_size; 221| 102k| return true; 222| 102k| } _ZN4bssl5ArrayItE5ResetEv: 139| 546k| void Reset() { Reset(nullptr, 0); } _ZN4bssl5ArrayItE5ResetEPtm: 143| 546k| void Reset(T *new_data, size_t new_size) { 144| 546k| std::destroy_n(data_, size_); 145| 546k| OPENSSL_free(data_); 146| 546k| data_ = new_data; 147| 546k| size_ = new_size; 148| 546k| } _ZNK4bssl5ArrayItE4sizeEv: 105| 590k| size_t size() const { return size_; } _ZN4bssl5ArrayItEixEm: 112| 443k| T &operator[](size_t i) { 113| 443k| BSSL_CHECK(i < size_); ------------------ | | 384| 443k| do { \ | | 385| 443k| if (!(condition)) { \ | | ------------------ | | | Branch (385:9): [True: 0, False: 443k] | | ------------------ | | 386| 0| abort(); \ | | 387| 0| } \ | | 388| 443k| } while (0); | | ------------------ | | | Branch (388:12): [Folded - Ignored] | | ------------------ ------------------ 114| 443k| return data_[i]; 115| 443k| } _ZN4bssl5ArrayItE5beginEv: 134| 54.7k| T *begin() { return data_; } _ZN4bssl5ArrayItE3endEv: 136| 54.7k| T *end() { return data_ + size_; } _ZN4bssl5ArrayItED2Ev: 94| 375k| ~Array() { Reset(); } _ZNK4bssl5ArrayItE4dataEv: 103| 266k| const T *data() const { return data_; } _ZNK4bssl13InplaceVectorIhLm12EE5emptyEv: 401| 74.2k| bool empty() const { return size_ == 0; } _ZN4bssl13InplaceVectorIhLm12EE4dataEv: 398| 548k| T *data() { return reinterpret_cast(storage_); } _ZNK4bssl13InplaceVectorIhLm12EE4sizeEv: 399| 147k| size_t size() const { return size_; } _ZN4bssl6VectorINS_18CertCompressionAlgEE5beginEv: 277| 56.4k| T *begin() { return data_; } _ZN4bssl6VectorINS_18CertCompressionAlgEE3endEv: 279| 56.4k| T *end() { return data_ + size_; } _ZNK4bssl6VectorINS_10ALPSConfigEE5emptyEv: 249| 112k| bool empty() const { return size_ == 0; } _ZN4bssl6VectorINSt3__110unique_ptrI17ssl_credential_stNS_8internal7DeleterEEEE5beginEv: 277| 19.9k| T *begin() { return data_; } _ZN4bssl6VectorINSt3__110unique_ptrI17ssl_credential_stNS_8internal7DeleterEEEE3endEv: 279| 19.9k| T *end() { return data_ + size_; } _ZN4bssl5ArrayItEaSEOS1_: 97| 28.1k| Array &operator=(Array &&other) { 98| 28.1k| Reset(); 99| 28.1k| other.Release(&data_, &size_); 100| 28.1k| return *this; 101| 28.1k| } _ZN4bssl5ArrayItE7ReleaseEPPtPm: 152| 28.1k| void Release(T **out, size_t *out_size) { 153| 28.1k| *out = data_; 154| 28.1k| *out_size = size_; 155| 28.1k| data_ = nullptr; 156| 28.1k| size_ = 0; 157| 28.1k| } _ZNK4bssl5ArrayItE5emptyEv: 106| 313k| bool empty() const { return size_ == 0; } _ZN4bssl8internal11DeleterImplINS_11SSLKeyShareEvE4FreeEPS2_: 71| 163k| static void Free(T *t) { Delete(t); } _ZN4bssl6DeleteINS_11SSLKeyShareEEEvPT_: 59| 163k|void Delete(T *t) { 60| 163k| if (t != nullptr) { ------------------ | Branch (60:7): [True: 163k, False: 0] ------------------ 61| 163k| t->~T(); 62| 163k| OPENSSL_free(t); 63| 163k| } 64| 163k|} _ZNK4bssl6VectorINSt3__110unique_ptrI17ssl_credential_stNS_8internal7DeleterEEEE5beginEv: 278| 56.3k| const T *begin() const { return data_; } _ZNK4bssl6VectorINSt3__110unique_ptrI17ssl_credential_stNS_8internal7DeleterEEEE3endEv: 280| 56.3k| const T *end() const { return data_ + size_; } _ZNK4bssl6VectorINSt3__110unique_ptrI17ssl_credential_stNS_8internal7DeleterEEEE4sizeEv: 248| 56.1k| size_t size() const { return size_; } _ZN4bssl5ArrayIhEixEm: 112| 5.21k| T &operator[](size_t i) { 113| 5.21k| BSSL_CHECK(i < size_); ------------------ | | 384| 5.21k| do { \ | | 385| 5.21k| if (!(condition)) { \ | | ------------------ | | | Branch (385:9): [True: 0, False: 5.21k] | | ------------------ | | 386| 0| abort(); \ | | 387| 0| } \ | | 388| 5.21k| } while (0); | | ------------------ | | | Branch (388:12): [Folded - Ignored] | | ------------------ ------------------ 114| 5.21k| return data_[i]; 115| 5.21k| } _ZN4bssl13InplaceVectorIhLm32EE18ResizeForOverwriteEm: 509| 108k| void ResizeForOverwrite(size_t size) { 510| 108k| BSSL_CHECK(TryResizeForOverwrite(size)); ------------------ | | 384| 108k| do { \ | | 385| 108k| if (!(condition)) { \ | | ------------------ | | | Branch (385:9): [True: 0, False: 108k] | | ------------------ | | 386| 0| abort(); \ | | 387| 0| } \ | | 388| 108k| } while (0); | | ------------------ | | | Branch (388:12): [Folded - Ignored] | | ------------------ ------------------ 511| 108k| } _ZN4bssl13InplaceVectorIhLm32EE21TryResizeForOverwriteEm: 469| 108k| [[nodiscard]] bool TryResizeForOverwrite(size_t new_size) { 470| 108k| if (new_size <= size_) { ------------------ | Branch (470:9): [True: 0, False: 108k] ------------------ 471| 0| Shrink(new_size); 472| 0| return true; 473| 0| } 474| 108k| if (new_size > capacity()) { ------------------ | Branch (474:9): [True: 0, False: 108k] ------------------ 475| 0| return false; 476| 0| } 477| 108k| std::uninitialized_default_construct_n(data() + size_, new_size - size_); 478| 108k| size_ = static_cast>(new_size); 479| 108k| return true; 480| 108k| } _ZN4bssl13InplaceVectorIhLm32EE6ShrinkEm: 444| 624k| void Shrink(size_t new_size) { 445| 624k| BSSL_CHECK(new_size <= size_); ------------------ | | 384| 624k| do { \ | | 385| 624k| if (!(condition)) { \ | | ------------------ | | | Branch (385:9): [True: 0, False: 624k] | | ------------------ | | 386| 0| abort(); \ | | 387| 0| } \ | | 388| 624k| } while (0); | | ------------------ | | | Branch (388:12): [Folded - Ignored] | | ------------------ ------------------ 446| 624k| std::destroy_n(data() + new_size, size_ - new_size); 447| 624k| size_ = static_cast>(new_size); 448| 624k| } _ZN4bssl13InplaceVectorIhLm32EE8capacityEv: 400| 384k| static constexpr size_t capacity() { return N; } _ZN4bssl13InplaceVectorIhLm32EE4dataEv: 398| 1.11M| T *data() { return reinterpret_cast(storage_); } _ZN4bssl13InplaceVectorIhLm48EE18ResizeForOverwriteEm: 509| 105k| void ResizeForOverwrite(size_t size) { 510| 105k| BSSL_CHECK(TryResizeForOverwrite(size)); ------------------ | | 384| 105k| do { \ | | 385| 105k| if (!(condition)) { \ | | ------------------ | | | Branch (385:9): [True: 0, False: 105k] | | ------------------ | | 386| 0| abort(); \ | | 387| 0| } \ | | 388| 105k| } while (0); | | ------------------ | | | Branch (388:12): [Folded - Ignored] | | ------------------ ------------------ 511| 105k| } _ZN4bssl13InplaceVectorIhLm48EE21TryResizeForOverwriteEm: 469| 105k| [[nodiscard]] bool TryResizeForOverwrite(size_t new_size) { 470| 105k| if (new_size <= size_) { ------------------ | Branch (470:9): [True: 0, False: 105k] ------------------ 471| 0| Shrink(new_size); 472| 0| return true; 473| 0| } 474| 105k| if (new_size > capacity()) { ------------------ | Branch (474:9): [True: 0, False: 105k] ------------------ 475| 0| return false; 476| 0| } 477| 105k| std::uninitialized_default_construct_n(data() + size_, new_size - size_); 478| 105k| size_ = static_cast>(new_size); 479| 105k| return true; 480| 105k| } _ZN4bssl10MakeUniqueINS_23SSLCipherPreferenceListEJEEENSt3__110unique_ptrIT_NS_8internal7DeleterEEEDpOT0_: 78| 4|UniquePtr MakeUnique(Args &&...args) { 79| 4| return UniquePtr(New(std::forward(args)...)); 80| 4|} _ZN4bssl3NewINS_23SSLCipherPreferenceListEJEEEPT_DpOT0_: 47| 4|T *New(Args &&...args) { 48| 4| void *t = OPENSSL_malloc(sizeof(T)); 49| 4| if (t == nullptr) { ------------------ | Branch (49:7): [True: 0, False: 4] ------------------ 50| 0| return nullptr; 51| 0| } 52| 4| return new (t) T(std::forward(args)...); 53| 4|} _ZN4bssl8internal11DeleterImplINS_23SSLCipherPreferenceListEvE4FreeEPS2_: 71| 2| static void Free(T *t) { Delete(t); } _ZN4bssl6DeleteINS_23SSLCipherPreferenceListEEEvPT_: 59| 2|void Delete(T *t) { 60| 2| if (t != nullptr) { ------------------ | Branch (60:7): [True: 2, False: 0] ------------------ 61| 2| t->~T(); 62| 2| OPENSSL_free(t); 63| 2| } 64| 2|} _ZN4bssl6VectorINS_10ALPSConfigEE5clearEv: 282| 19.9k| void clear() { 283| 19.9k| std::destroy_n(data_, size_); 284| 19.9k| OPENSSL_free(data_); 285| 19.9k| data_ = nullptr; 286| 19.9k| size_ = 0; 287| 19.9k| capacity_ = 0; 288| 19.9k| } _ZNK4bssl13InplaceVectorIhLm48EE4dataEv: 397| 318k| const T *data() const { return reinterpret_cast(storage_); } _ZN4bssl8internal11DeleterImplINS_13SSL_HANDSHAKEEvE4FreeEPS2_: 71| 71.0k| static void Free(T *t) { Delete(t); } _ZN4bssl6DeleteINS_13SSL_HANDSHAKEEEEvPT_: 59| 71.0k|void Delete(T *t) { 60| 71.0k| if (t != nullptr) { ------------------ | Branch (60:7): [True: 71.0k, False: 0] ------------------ 61| 71.0k| t->~T(); 62| 71.0k| OPENSSL_free(t); 63| 71.0k| } 64| 71.0k|} _ZN4bssl10MakeUniqueINS_19SSL_HANDSHAKE_HINTSEJEEENSt3__110unique_ptrIT_NS_8internal7DeleterEEEDpOT0_: 78| 15.1k|UniquePtr MakeUnique(Args &&...args) { 79| 15.1k| return UniquePtr(New(std::forward(args)...)); 80| 15.1k|} _ZN4bssl3NewINS_19SSL_HANDSHAKE_HINTSEJEEEPT_DpOT0_: 47| 15.1k|T *New(Args &&...args) { 48| 15.1k| void *t = OPENSSL_malloc(sizeof(T)); 49| 15.1k| if (t == nullptr) { ------------------ | Branch (49:7): [True: 0, False: 15.1k] ------------------ 50| 0| return nullptr; 51| 0| } 52| 15.1k| return new (t) T(std::forward(args)...); 53| 15.1k|} _ZN4bssl8internal11DeleterImplINS_19SSL_HANDSHAKE_HINTSEvE4FreeEPS2_: 71| 15.1k| static void Free(T *t) { Delete(t); } _ZN4bssl6DeleteINS_19SSL_HANDSHAKE_HINTSEEEvPT_: 59| 15.1k|void Delete(T *t) { 60| 15.1k| if (t != nullptr) { ------------------ | Branch (60:7): [True: 15.1k, False: 0] ------------------ 61| 15.1k| t->~T(); 62| 15.1k| OPENSSL_free(t); 63| 15.1k| } 64| 15.1k|} _ZN4bssl13InplaceVectorIhLm32EEC2Ev: 380| 348k| InplaceVector() = default; _ZN4bssl13InplaceVectorIhLm12EE8capacityEv: 400| 246k| static constexpr size_t capacity() { return N; } _ZN4bssl13InplaceVectorIhLm32EED2Ev: 383| 348k| ~InplaceVector() { clear(); } _ZN4bssl13InplaceVectorIhLm32EE5clearEv: 434| 624k| void clear() { Shrink(0); } _ZN4bssl10MakeUniqueINS_13SSL_HANDSHAKEEJRP6ssl_stEEENSt3__110unique_ptrIT_NS_8internal7DeleterEEEDpOT0_: 78| 71.0k|UniquePtr MakeUnique(Args &&...args) { 79| 71.0k| return UniquePtr(New(std::forward(args)...)); 80| 71.0k|} _ZN4bssl3NewINS_13SSL_HANDSHAKEEJRP6ssl_stEEEPT_DpOT0_: 47| 71.0k|T *New(Args &&...args) { 48| 71.0k| void *t = OPENSSL_malloc(sizeof(T)); 49| 71.0k| if (t == nullptr) { ------------------ | Branch (49:7): [True: 0, False: 71.0k] ------------------ 50| 0| return nullptr; 51| 0| } 52| 71.0k| return new (t) T(std::forward(args)...); 53| 71.0k|} _ZN4bssl13InplaceVectorIhLm12EE8CopyFromENS_4SpanIKhEE: 512| 91.7k| void CopyFrom(Span in) { BSSL_CHECK(TryCopyFrom(in)); } ------------------ | | 384| 91.7k| do { \ | | 385| 91.7k| if (!(condition)) { \ | | ------------------ | | | Branch (385:9): [True: 0, False: 91.7k] | | ------------------ | | 386| 0| abort(); \ | | 387| 0| } \ | | 388| 91.7k| } while (0); | | ------------------ | | | Branch (388:12): [Folded - Ignored] | | ------------------ ------------------ _ZN4bssl13InplaceVectorIhLm12EE11TryCopyFromENS_4SpanIKhEE: 484| 143k| [[nodiscard]] bool TryCopyFrom(Span in) { 485| 143k| if (in.size() > capacity()) { ------------------ | Branch (485:9): [True: 0, False: 143k] ------------------ 486| 0| return false; 487| 0| } 488| 143k| clear(); 489| 143k| std::uninitialized_copy(in.begin(), in.end(), data()); 490| 143k| size_ = in.size(); 491| 143k| return true; 492| 143k| } _ZN4bssl13InplaceVectorIhLm12EE5clearEv: 434| 328k| void clear() { Shrink(0); } _ZN4bssl13InplaceVectorIhLm12EE6ShrinkEm: 444| 328k| void Shrink(size_t new_size) { 445| 328k| BSSL_CHECK(new_size <= size_); ------------------ | | 384| 328k| do { \ | | 385| 328k| if (!(condition)) { \ | | ------------------ | | | Branch (385:9): [True: 0, False: 328k] | | ------------------ | | 386| 0| abort(); \ | | 387| 0| } \ | | 388| 328k| } while (0); | | ------------------ | | | Branch (388:12): [Folded - Ignored] | | ------------------ ------------------ 446| 328k| std::destroy_n(data() + new_size, size_ - new_size); 447| 328k| size_ = static_cast>(new_size); 448| 328k| } _ZN4bssl13InplaceVectorIhLm32EEaSERKS1_: 384| 126k| InplaceVector &operator=(const InplaceVector &other) { 385| 126k| if (this != &other) { ------------------ | Branch (385:9): [True: 126k, False: 0] ------------------ 386| 126k| CopyFrom(other); 387| 126k| } 388| 126k| return *this; 389| 126k| } _ZN4bssl13InplaceVectorIhLm32EE8CopyFromENS_4SpanIKhEE: 512| 181k| void CopyFrom(Span in) { BSSL_CHECK(TryCopyFrom(in)); } ------------------ | | 384| 181k| do { \ | | 385| 181k| if (!(condition)) { \ | | ------------------ | | | Branch (385:9): [True: 0, False: 181k] | | ------------------ | | 386| 0| abort(); \ | | 387| 0| } \ | | 388| 181k| } while (0); | | ------------------ | | | Branch (388:12): [Folded - Ignored] | | ------------------ ------------------ _ZN4bssl13InplaceVectorIhLm32EE11TryCopyFromENS_4SpanIKhEE: 484| 276k| [[nodiscard]] bool TryCopyFrom(Span in) { 485| 276k| if (in.size() > capacity()) { ------------------ | Branch (485:9): [True: 3, False: 276k] ------------------ 486| 3| return false; 487| 3| } 488| 276k| clear(); 489| 276k| std::uninitialized_copy(in.begin(), in.end(), data()); 490| 276k| size_ = in.size(); 491| 276k| return true; 492| 276k| } _ZNK4bssl13InplaceVectorIhLm32EE5emptyEv: 401| 58.5k| bool empty() const { return size_ == 0; } _ZN4bssl5ArrayIP17ssl_credential_stEC2Ev: 90| 28.0k| Array() {} _ZNK4bssl5ArrayIP17ssl_credential_stE5emptyEv: 106| 28.0k| bool empty() const { return size_ == 0; } _ZN4bssl5ArrayIP17ssl_credential_stE5beginEv: 134| 28.0k| T *begin() { return data_; } _ZN4bssl5ArrayIP17ssl_credential_stE3endEv: 136| 28.0k| T *end() { return data_ + size_; } _ZN4bssl5ArrayIhE5beginEv: 134| 28.0k| T *begin() { return data_; } _ZN4bssl5ArrayIhE3endEv: 136| 56.1k| T *end() { return data_ + size_; } _ZN4bssl5ArrayIP17ssl_credential_stED2Ev: 94| 28.0k| ~Array() { Reset(); } _ZN4bssl5ArrayIP17ssl_credential_stE5ResetEv: 139| 56.1k| void Reset() { Reset(nullptr, 0); } _ZN4bssl5ArrayIP17ssl_credential_stE5ResetEPS2_m: 143| 56.1k| void Reset(T *new_data, size_t new_size) { 144| 56.1k| std::destroy_n(data_, size_); 145| 56.1k| OPENSSL_free(data_); 146| 56.1k| data_ = new_data; 147| 56.1k| size_ = new_size; 148| 56.1k| } _ZNK4bssl13InplaceVectorIhLm32EE4dataEv: 397| 242k| const T *data() const { return reinterpret_cast(storage_); } _ZNK4bssl13InplaceVectorIhLm32EE4sizeEv: 399| 298k| size_t size() const { return size_; } _ZN4bssl13InplaceVectorIhLm12EEC2Ev: 380| 184k| InplaceVector() = default; _ZN4bssl13InplaceVectorIhLm12EED2Ev: 383| 184k| ~InplaceVector() { clear(); } _ZN4bssl10MakeUniqueINS_14SSLAEADContextEJDnEEENSt3__110unique_ptrIT_NS_8internal7DeleterEEEDpOT0_: 78| 39.8k|UniquePtr MakeUnique(Args &&...args) { 79| 39.8k| return UniquePtr(New(std::forward(args)...)); 80| 39.8k|} _ZN4bssl3NewINS_14SSLAEADContextEJDnEEEPT_DpOT0_: 47| 39.8k|T *New(Args &&...args) { 48| 39.8k| void *t = OPENSSL_malloc(sizeof(T)); 49| 39.8k| if (t == nullptr) { ------------------ | Branch (49:7): [True: 0, False: 39.8k] ------------------ 50| 0| return nullptr; 51| 0| } 52| 39.8k| return new (t) T(std::forward(args)...); 53| 39.8k|} _ZN4bssl10MakeUniqueINS_14SSLAEADContextEJRPK13ssl_cipher_stEEENSt3__110unique_ptrIT_NS_8internal7DeleterEEEDpOT0_: 78| 104k|UniquePtr MakeUnique(Args &&...args) { 79| 104k| return UniquePtr(New(std::forward(args)...)); 80| 104k|} _ZN4bssl3NewINS_14SSLAEADContextEJRPK13ssl_cipher_stEEEPT_DpOT0_: 47| 104k|T *New(Args &&...args) { 48| 104k| void *t = OPENSSL_malloc(sizeof(T)); 49| 104k| if (t == nullptr) { ------------------ | Branch (49:7): [True: 0, False: 104k] ------------------ 50| 0| return nullptr; 51| 0| } 52| 104k| return new (t) T(std::forward(args)...); 53| 104k|} _ZN4bssl6VectorINSt3__110unique_ptrI17ssl_credential_stNS_8internal7DeleterEEEEC2Ev: 232| 19.9k| Vector() = default; _ZN4bssl10MakeUniqueI17ssl_credential_stJNS_17SSLCredentialTypeEEEENSt3__110unique_ptrIT_NS_8internal7DeleterEEEDpOT0_: 78| 19.9k|UniquePtr MakeUnique(Args &&...args) { 79| 19.9k| return UniquePtr(New(std::forward(args)...)); 80| 19.9k|} _ZN4bssl3NewI17ssl_credential_stJNS_17SSLCredentialTypeEEEEPT_DpOT0_: 47| 19.9k|T *New(Args &&...args) { 48| 19.9k| void *t = OPENSSL_malloc(sizeof(T)); 49| 19.9k| if (t == nullptr) { ------------------ | Branch (49:7): [True: 0, False: 19.9k] ------------------ 50| 0| return nullptr; 51| 0| } 52| 19.9k| return new (t) T(std::forward(args)...); 53| 19.9k|} _ZN4bssl6VectorINSt3__110unique_ptrI17ssl_credential_stNS_8internal7DeleterEEEED2Ev: 235| 19.9k| ~Vector() { clear(); } _ZN4bssl10MakeUniqueINS_4CERTEJRPKNS_15SSL_X509_METHODEEEENSt3__110unique_ptrIT_NS_8internal7DeleterEEEDpOT0_: 78| 19.9k|UniquePtr MakeUnique(Args &&...args) { 79| 19.9k| return UniquePtr(New(std::forward(args)...)); 80| 19.9k|} _ZN4bssl3NewINS_4CERTEJRPKNS_15SSL_X509_METHODEEEEPT_DpOT0_: 47| 19.9k|T *New(Args &&...args) { 48| 19.9k| void *t = OPENSSL_malloc(sizeof(T)); 49| 19.9k| if (t == nullptr) { ------------------ | Branch (49:7): [True: 0, False: 19.9k] ------------------ 50| 0| return nullptr; 51| 0| } 52| 19.9k| return new (t) T(std::forward(args)...); 53| 19.9k|} _ZN4bssl8internal11DeleterImplINS_4CERTEvE4FreeEPS2_: 71| 19.9k| static void Free(T *t) { Delete(t); } _ZN4bssl6DeleteINS_4CERTEEEvPT_: 59| 19.9k|void Delete(T *t) { 60| 19.9k| if (t != nullptr) { ------------------ | Branch (60:7): [True: 19.9k, False: 0] ------------------ 61| 19.9k| t->~T(); 62| 19.9k| OPENSSL_free(t); 63| 19.9k| } 64| 19.9k|} _ZN4bssl6VectorINSt3__110unique_ptrI17ssl_credential_stNS_8internal7DeleterEEEE5clearEv: 282| 19.9k| void clear() { 283| 19.9k| std::destroy_n(data_, size_); 284| 19.9k| OPENSSL_free(data_); 285| 19.9k| data_ = nullptr; 286| 19.9k| size_ = 0; 287| 19.9k| capacity_ = 0; 288| 19.9k| } _ZNK4bssl5ArrayIbE4dataEv: 103| 4| const T *data() const { return data_; } _ZNK4bssl5ArrayIbE4sizeEv: 105| 4| size_t size() const { return size_; } _ZN4bssl5ArrayIbEC2Ev: 90| 8| Array() {} _ZN4bssl5ArrayIbED2Ev: 94| 8| ~Array() { Reset(); } _ZN4bssl5ArrayIbE5ResetEv: 139| 16| void Reset() { Reset(nullptr, 0); } _ZN4bssl5ArrayIbE5ResetEPbm: 143| 16| void Reset(T *new_data, size_t new_size) { 144| 16| std::destroy_n(data_, size_); 145| 16| OPENSSL_free(data_); 146| 16| data_ = new_data; 147| 16| size_ = new_size; 148| 16| } _ZN4bssl5ArrayIbE8CopyFromENS_4SpanIKbEE: 184| 4| [[nodiscard]] bool CopyFrom(Span in) { 185| 4| if (!InitUninitialized(in.size())) { ------------------ | Branch (185:9): [True: 0, False: 4] ------------------ 186| 0| return false; 187| 0| } 188| 4| std::uninitialized_copy(in.begin(), in.end(), data_); 189| 4| return true; 190| 4| } _ZN4bssl5ArrayIbE17InitUninitializedEm: 206| 8| bool InitUninitialized(size_t new_size) { 207| 8| Reset(); 208| 8| if (new_size == 0) { ------------------ | Branch (208:9): [True: 0, False: 8] ------------------ 209| 0| return true; 210| 0| } 211| | 212| 8| if (new_size > SIZE_MAX / sizeof(T)) { ------------------ | Branch (212:9): [True: 0, False: 8] ------------------ 213| 0| OPENSSL_PUT_ERROR(CRYPTO, ERR_R_OVERFLOW); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 214| 0| return false; 215| 0| } 216| 8| data_ = reinterpret_cast(OPENSSL_malloc(new_size * sizeof(T))); 217| 8| if (data_ == nullptr) { ------------------ | Branch (217:9): [True: 0, False: 8] ------------------ 218| 0| return false; 219| 0| } 220| 8| size_ = new_size; 221| 8| return true; 222| 8| } _ZN4bssl5ArrayIbE7ReleaseEPPbPm: 152| 4| void Release(T **out, size_t *out_size) { 153| 4| *out = data_; 154| 4| *out_size = size_; 155| 4| data_ = nullptr; 156| 4| size_ = 0; 157| 4| } _ZN4bssl5ArrayIbE16InitForOverwriteEm: 174| 4| [[nodiscard]] bool InitForOverwrite(size_t new_size) { 175| 4| if (!InitUninitialized(new_size)) { ------------------ | Branch (175:9): [True: 0, False: 4] ------------------ 176| 0| return false; 177| 0| } 178| 4| std::uninitialized_default_construct_n(data_, size_); 179| 4| return true; 180| 4| } _ZN4bssl5ArrayIbEixEm: 112| 78| T &operator[](size_t i) { 113| 78| BSSL_CHECK(i < size_); ------------------ | | 384| 78| do { \ | | 385| 78| if (!(condition)) { \ | | ------------------ | | | Branch (385:9): [True: 0, False: 78] | | ------------------ | | 386| 0| abort(); \ | | 387| 0| } \ | | 388| 78| } while (0); | | ------------------ | | | Branch (388:12): [Folded - Ignored] | | ------------------ ------------------ 114| 78| return data_[i]; 115| 78| } _ZN4bssl5ArrayIbE6ShrinkEm: 194| 4| void Shrink(size_t new_size) { 195| 4| if (new_size > size_) { ------------------ | Branch (195:9): [True: 0, False: 4] ------------------ 196| 0| abort(); 197| 0| } 198| 4| std::destroy_n(data_ + new_size, size_ - new_size); 199| 4| size_ = new_size; 200| 4| } _ZN4bssl5ArrayIP17ssl_credential_stE16InitForOverwriteEm: 174| 28.0k| [[nodiscard]] bool InitForOverwrite(size_t new_size) { 175| 28.0k| if (!InitUninitialized(new_size)) { ------------------ | Branch (175:9): [True: 0, False: 28.0k] ------------------ 176| 0| return false; 177| 0| } 178| 28.0k| std::uninitialized_default_construct_n(data_, size_); 179| 28.0k| return true; 180| 28.0k| } _ZN4bssl5ArrayIP17ssl_credential_stE17InitUninitializedEm: 206| 28.0k| bool InitUninitialized(size_t new_size) { 207| 28.0k| Reset(); 208| 28.0k| if (new_size == 0) { ------------------ | Branch (208:9): [True: 0, False: 28.0k] ------------------ 209| 0| return true; 210| 0| } 211| | 212| 28.0k| if (new_size > SIZE_MAX / sizeof(T)) { ------------------ | Branch (212:9): [True: 0, False: 28.0k] ------------------ 213| 0| OPENSSL_PUT_ERROR(CRYPTO, ERR_R_OVERFLOW); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 214| 0| return false; 215| 0| } 216| 28.0k| data_ = reinterpret_cast(OPENSSL_malloc(new_size * sizeof(T))); 217| 28.0k| if (data_ == nullptr) { ------------------ | Branch (217:9): [True: 0, False: 28.0k] ------------------ 218| 0| return false; 219| 0| } 220| 28.0k| size_ = new_size; 221| 28.0k| return true; 222| 28.0k| } _ZN4bssl5ArrayIP17ssl_credential_stEixEm: 112| 28.0k| T &operator[](size_t i) { 113| 28.0k| BSSL_CHECK(i < size_); ------------------ | | 384| 28.0k| do { \ | | 385| 28.0k| if (!(condition)) { \ | | ------------------ | | | Branch (385:9): [True: 0, False: 28.0k] | | ------------------ | | 386| 0| abort(); \ | | 387| 0| } \ | | 388| 28.0k| } while (0); | | ------------------ | | | Branch (388:12): [Folded - Ignored] | | ------------------ ------------------ 114| 28.0k| return data_[i]; 115| 28.0k| } _ZN4bssl10MakeUniqueI17ssl_credential_stJRKNS_17SSLCredentialTypeEEEENSt3__110unique_ptrIT_NS_8internal7DeleterEEEDpOT0_: 78| 19.9k|UniquePtr MakeUnique(Args &&...args) { 79| 19.9k| return UniquePtr(New(std::forward(args)...)); 80| 19.9k|} _ZN4bssl3NewI17ssl_credential_stJRKNS_17SSLCredentialTypeEEEEPT_DpOT0_: 47| 19.9k|T *New(Args &&...args) { 48| 19.9k| void *t = OPENSSL_malloc(sizeof(T)); 49| 19.9k| if (t == nullptr) { ------------------ | Branch (49:7): [True: 0, False: 19.9k] ------------------ 50| 0| return nullptr; 51| 0| } 52| 19.9k| return new (t) T(std::forward(args)...); 53| 19.9k|} _ZN4bssl5ArrayItE8CopyFromENS_4SpanIKtEE: 184| 59.7k| [[nodiscard]] bool CopyFrom(Span in) { 185| 59.7k| if (!InitUninitialized(in.size())) { ------------------ | Branch (185:9): [True: 0, False: 59.7k] ------------------ 186| 0| return false; 187| 0| } 188| 59.7k| std::uninitialized_copy(in.begin(), in.end(), data_); 189| 59.7k| return true; 190| 59.7k| } ssl_key_share.cc:_ZN4bssl10MakeUniqueINS_12_GLOBAL__N_110ECKeyShareEJPK11ec_group_stiEEENSt3__110unique_ptrIT_NS_8internal7DeleterEEEDpOT0_: 78| 29.7k|UniquePtr MakeUnique(Args &&...args) { 79| 29.7k| return UniquePtr(New(std::forward(args)...)); 80| 29.7k|} ssl_key_share.cc:_ZN4bssl3NewINS_12_GLOBAL__N_110ECKeyShareEJPK11ec_group_stiEEEPT_DpOT0_: 47| 29.7k|T *New(Args &&...args) { 48| 29.7k| void *t = OPENSSL_malloc(sizeof(T)); 49| 29.7k| if (t == nullptr) { ------------------ | Branch (49:7): [True: 0, False: 29.7k] ------------------ 50| 0| return nullptr; 51| 0| } 52| 29.7k| return new (t) T(std::forward(args)...); 53| 29.7k|} ssl_key_share.cc:_ZN4bssl10MakeUniqueINS_12_GLOBAL__N_114X25519KeyShareEJEEENSt3__110unique_ptrIT_NS_8internal7DeleterEEEDpOT0_: 78| 77.1k|UniquePtr MakeUnique(Args &&...args) { 79| 77.1k| return UniquePtr(New(std::forward(args)...)); 80| 77.1k|} ssl_key_share.cc:_ZN4bssl3NewINS_12_GLOBAL__N_114X25519KeyShareEJEEEPT_DpOT0_: 47| 77.1k|T *New(Args &&...args) { 48| 77.1k| void *t = OPENSSL_malloc(sizeof(T)); 49| 77.1k| if (t == nullptr) { ------------------ | Branch (49:7): [True: 0, False: 77.1k] ------------------ 50| 0| return nullptr; 51| 0| } 52| 77.1k| return new (t) T(std::forward(args)...); 53| 77.1k|} ssl_key_share.cc:_ZN4bssl10MakeUniqueINS_12_GLOBAL__N_122X25519Kyber768KeyShareEJEEENSt3__110unique_ptrIT_NS_8internal7DeleterEEEDpOT0_: 78| 28|UniquePtr MakeUnique(Args &&...args) { 79| 28| return UniquePtr(New(std::forward(args)...)); 80| 28|} ssl_key_share.cc:_ZN4bssl3NewINS_12_GLOBAL__N_122X25519Kyber768KeyShareEJEEEPT_DpOT0_: 47| 28|T *New(Args &&...args) { 48| 28| void *t = OPENSSL_malloc(sizeof(T)); 49| 28| if (t == nullptr) { ------------------ | Branch (49:7): [True: 0, False: 28] ------------------ 50| 0| return nullptr; 51| 0| } 52| 28| return new (t) T(std::forward(args)...); 53| 28|} ssl_key_share.cc:_ZN4bssl10MakeUniqueINS_12_GLOBAL__N_122X25519MLKEM768KeyShareEJEEENSt3__110unique_ptrIT_NS_8internal7DeleterEEEDpOT0_: 78| 56.3k|UniquePtr MakeUnique(Args &&...args) { 79| 56.3k| return UniquePtr(New(std::forward(args)...)); 80| 56.3k|} ssl_key_share.cc:_ZN4bssl3NewINS_12_GLOBAL__N_122X25519MLKEM768KeyShareEJEEEPT_DpOT0_: 47| 56.3k|T *New(Args &&...args) { 48| 56.3k| void *t = OPENSSL_malloc(sizeof(T)); 49| 56.3k| if (t == nullptr) { ------------------ | Branch (49:7): [True: 0, False: 56.3k] ------------------ 50| 0| return nullptr; 51| 0| } 52| 56.3k| return new (t) T(std::forward(args)...); 53| 56.3k|} _ZN4bssl6VectorINS_18CertCompressionAlgEEC2Ev: 232| 2| Vector() = default; _ZN4bssl6VectorINS_10ALPSConfigEEC2Ev: 232| 19.9k| Vector() = default; _ZN4bssl8internal11DeleterImplINS_10SSL_CONFIGEvE4FreeEPS2_: 71| 19.9k| static void Free(T *t) { Delete(t); } _ZN4bssl6DeleteINS_10SSL_CONFIGEEEvPT_: 59| 19.9k|void Delete(T *t) { 60| 19.9k| if (t != nullptr) { ------------------ | Branch (60:7): [True: 19.9k, False: 0] ------------------ 61| 19.9k| t->~T(); 62| 19.9k| OPENSSL_free(t); 63| 19.9k| } 64| 19.9k|} _ZN4bssl10MakeUniqueI10ssl_ctx_stJRPK13ssl_method_stEEENSt3__110unique_ptrIT_NS_8internal7DeleterEEEDpOT0_: 78| 2|UniquePtr MakeUnique(Args &&...args) { 79| 2| return UniquePtr(New(std::forward(args)...)); 80| 2|} _ZN4bssl3NewI10ssl_ctx_stJRPK13ssl_method_stEEEPT_DpOT0_: 47| 2|T *New(Args &&...args) { 48| 2| void *t = OPENSSL_malloc(sizeof(T)); 49| 2| if (t == nullptr) { ------------------ | Branch (49:7): [True: 0, False: 2] ------------------ 50| 0| return nullptr; 51| 0| } 52| 2| return new (t) T(std::forward(args)...); 53| 2|} _ZN4bssl10MakeUniqueINS_4CERTEJRKPKNS_15SSL_X509_METHODEEEENSt3__110unique_ptrIT_NS_8internal7DeleterEEEDpOT0_: 78| 2|UniquePtr MakeUnique(Args &&...args) { 79| 2| return UniquePtr(New(std::forward(args)...)); 80| 2|} _ZN4bssl3NewINS_4CERTEJRKPKNS_15SSL_X509_METHODEEEEPT_DpOT0_: 47| 2|T *New(Args &&...args) { 48| 2| void *t = OPENSSL_malloc(sizeof(T)); 49| 2| if (t == nullptr) { ------------------ | Branch (49:7): [True: 0, False: 2] ------------------ 50| 0| return nullptr; 51| 0| } 52| 2| return new (t) T(std::forward(args)...); 53| 2|} _ZN4bssl10MakeUniqueI6ssl_stJRP10ssl_ctx_stEEENSt3__110unique_ptrIT_NS_8internal7DeleterEEEDpOT0_: 78| 19.9k|UniquePtr MakeUnique(Args &&...args) { 79| 19.9k| return UniquePtr(New(std::forward(args)...)); 80| 19.9k|} _ZN4bssl3NewI6ssl_stJRP10ssl_ctx_stEEEPT_DpOT0_: 47| 19.9k|T *New(Args &&...args) { 48| 19.9k| void *t = OPENSSL_malloc(sizeof(T)); 49| 19.9k| if (t == nullptr) { ------------------ | Branch (49:7): [True: 0, False: 19.9k] ------------------ 50| 0| return nullptr; 51| 0| } 52| 19.9k| return new (t) T(std::forward(args)...); 53| 19.9k|} _ZN4bssl10MakeUniqueINS_10SSL_CONFIGEJP6ssl_stEEENSt3__110unique_ptrIT_NS_8internal7DeleterEEEDpOT0_: 78| 19.9k|UniquePtr MakeUnique(Args &&...args) { 79| 19.9k| return UniquePtr(New(std::forward(args)...)); 80| 19.9k|} _ZN4bssl3NewINS_10SSL_CONFIGEJP6ssl_stEEEPT_DpOT0_: 47| 19.9k|T *New(Args &&...args) { 48| 19.9k| void *t = OPENSSL_malloc(sizeof(T)); 49| 19.9k| if (t == nullptr) { ------------------ | Branch (49:7): [True: 0, False: 19.9k] ------------------ 50| 0| return nullptr; 51| 0| } 52| 19.9k| return new (t) T(std::forward(args)...); 53| 19.9k|} _ZN4bssl6VectorINS_10ALPSConfigEED2Ev: 235| 19.9k| ~Vector() { clear(); } _ZN4bssl6DeleteI6ssl_stEEvPT_: 59| 19.9k|void Delete(T *t) { 60| 19.9k| if (t != nullptr) { ------------------ | Branch (60:7): [True: 19.9k, False: 0] ------------------ 61| 19.9k| t->~T(); 62| 19.9k| OPENSSL_free(t); 63| 19.9k| } 64| 19.9k|} _ZN4bssl10MakeUniqueI14ssl_session_stJRPKNS_15SSL_X509_METHODEEEENSt3__110unique_ptrIT_NS_8internal7DeleterEEEDpOT0_: 78| 128k|UniquePtr MakeUnique(Args &&...args) { 79| 128k| return UniquePtr(New(std::forward(args)...)); 80| 128k|} _ZN4bssl3NewI14ssl_session_stJRPKNS_15SSL_X509_METHODEEEEPT_DpOT0_: 47| 128k|T *New(Args &&...args) { 48| 128k| void *t = OPENSSL_malloc(sizeof(T)); 49| 128k| if (t == nullptr) { ------------------ | Branch (49:7): [True: 0, False: 128k] ------------------ 50| 0| return nullptr; 51| 0| } 52| 128k| return new (t) T(std::forward(args)...); 53| 128k|} _ZN4bssl13InplaceVectorIhLm48EEaSERKS1_: 384| 105k| InplaceVector &operator=(const InplaceVector &other) { 385| 105k| if (this != &other) { ------------------ | Branch (385:9): [True: 105k, False: 0] ------------------ 386| 105k| CopyFrom(other); 387| 105k| } 388| 105k| return *this; 389| 105k| } _ZN4bssl13InplaceVectorIhLm48EE6ResizeEm: 508| 261| void Resize(size_t size) { BSSL_CHECK(TryResize(size)); } ------------------ | | 384| 261| do { \ | | 385| 261| if (!(condition)) { \ | | ------------------ | | | Branch (385:9): [True: 0, False: 261] | | ------------------ | | 386| 0| abort(); \ | | 387| 0| } \ | | 388| 261| } while (0); | | ------------------ | | | Branch (388:12): [Folded - Ignored] | | ------------------ ------------------ _ZN4bssl13InplaceVectorIhLm48EE9TryResizeEm: 453| 261| [[nodiscard]] bool TryResize(size_t new_size) { 454| 261| if (new_size <= size_) { ------------------ | Branch (454:9): [True: 0, False: 261] ------------------ 455| 0| Shrink(new_size); 456| 0| return true; 457| 0| } 458| 261| if (new_size > capacity()) { ------------------ | Branch (458:9): [True: 0, False: 261] ------------------ 459| 0| return false; 460| 0| } 461| 261| std::uninitialized_value_construct_n(data() + size_, new_size - size_); 462| 261| size_ = static_cast>(new_size); 463| 261| return true; 464| 261| } _ZN4bssl10MakeUniqueINS_10SSL3_STATEEJEEENSt3__110unique_ptrIT_NS_8internal7DeleterEEEDpOT0_: 78| 19.9k|UniquePtr MakeUnique(Args &&...args) { 79| 19.9k| return UniquePtr(New(std::forward(args)...)); 80| 19.9k|} _ZN4bssl3NewINS_10SSL3_STATEEJEEEPT_DpOT0_: 47| 19.9k|T *New(Args &&...args) { 48| 19.9k| void *t = OPENSSL_malloc(sizeof(T)); 49| 19.9k| if (t == nullptr) { ------------------ | Branch (49:7): [True: 0, False: 19.9k] ------------------ 50| 0| return nullptr; 51| 0| } 52| 19.9k| return new (t) T(std::forward(args)...); 53| 19.9k|} _ZN4bssl6DeleteINS_10SSL3_STATEEEEvPT_: 59| 19.9k|void Delete(T *t) { 60| 19.9k| if (t != nullptr) { ------------------ | Branch (60:7): [True: 19.9k, False: 0] ------------------ 61| 19.9k| t->~T(); 62| 19.9k| OPENSSL_free(t); 63| 19.9k| } 64| 19.9k|} _ZN4bssl3NewI10bignum_ctxJEEEPT_DpOT0_: 47| 96.7k|T *New(Args &&...args) { 48| 96.7k| void *t = OPENSSL_malloc(sizeof(T)); 49| 96.7k| if (t == nullptr) { ------------------ | Branch (49:7): [True: 0, False: 96.7k] ------------------ 50| 0| return nullptr; 51| 0| } 52| 96.7k| return new (t) T(std::forward(args)...); 53| 96.7k|} _ZN4bssl6VectorINSt3__110unique_ptrI9bignum_stNS_8internal7DeleterEEEEC2Ev: 232| 96.7k| Vector() = default; _ZN4bssl6VectorImEC2Ev: 232| 96.7k| Vector() = default; _ZN4bssl6DeleteI10bignum_ctxEEvPT_: 59| 106k|void Delete(T *t) { 60| 106k| if (t != nullptr) { ------------------ | Branch (60:7): [True: 96.7k, False: 9.39k] ------------------ 61| 96.7k| t->~T(); 62| 96.7k| OPENSSL_free(t); 63| 96.7k| } 64| 106k|} _ZN4bssl6VectorImED2Ev: 235| 96.7k| ~Vector() { clear(); } _ZN4bssl6VectorImE5clearEv: 282| 134k| void clear() { 283| 134k| std::destroy_n(data_, size_); 284| 134k| OPENSSL_free(data_); 285| 134k| data_ = nullptr; 286| 134k| size_ = 0; 287| 134k| capacity_ = 0; 288| 134k| } _ZN4bssl6VectorINSt3__110unique_ptrI9bignum_stNS_8internal7DeleterEEEED2Ev: 235| 96.7k| ~Vector() { clear(); } _ZN4bssl6VectorINSt3__110unique_ptrI9bignum_stNS_8internal7DeleterEEEE5clearEv: 282| 134k| void clear() { 283| 134k| std::destroy_n(data_, size_); 284| 134k| OPENSSL_free(data_); 285| 134k| data_ = nullptr; 286| 134k| size_ = 0; 287| 134k| capacity_ = 0; 288| 134k| } _ZN4bssl6VectorImE4PushEm: 298| 349k| [[nodiscard]] bool Push(T elem) { 299| 349k| if (!MaybeGrow()) { ------------------ | Branch (299:9): [True: 0, False: 349k] ------------------ 300| 0| return false; 301| 0| } 302| 349k| new (&data_[size_]) T(std::move(elem)); 303| 349k| size_++; 304| 349k| return true; 305| 349k| } _ZN4bssl6VectorImE9MaybeGrowEv: 324| 349k| bool MaybeGrow() { 325| | // No need to grow if we have room for one more T. 326| 349k| if (size_ < capacity_) { ------------------ | Branch (326:9): [True: 312k, False: 37.4k] ------------------ 327| 312k| return true; 328| 312k| } 329| 37.4k| size_t new_capacity = kDefaultSize; 330| 37.4k| if (capacity_ > 0) { ------------------ | Branch (330:9): [True: 0, False: 37.4k] ------------------ 331| | // Double the array's size if it's safe to do so. 332| 0| if (capacity_ > SIZE_MAX / 2) { ------------------ | Branch (332:11): [True: 0, False: 0] ------------------ 333| 0| OPENSSL_PUT_ERROR(CRYPTO, ERR_R_OVERFLOW); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 334| 0| return false; 335| 0| } 336| 0| new_capacity = capacity_ * 2; 337| 0| } 338| 37.4k| if (new_capacity > SIZE_MAX / sizeof(T)) { ------------------ | Branch (338:9): [True: 0, False: 37.4k] ------------------ 339| 0| OPENSSL_PUT_ERROR(CRYPTO, ERR_R_OVERFLOW); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 340| 0| return false; 341| 0| } 342| 37.4k| T *new_data = 343| 37.4k| reinterpret_cast(OPENSSL_malloc(new_capacity * sizeof(T))); 344| 37.4k| if (new_data == nullptr) { ------------------ | Branch (344:9): [True: 0, False: 37.4k] ------------------ 345| 0| return false; 346| 0| } 347| 37.4k| size_t new_size = size_; 348| 37.4k| std::uninitialized_move(begin(), end(), new_data); 349| 37.4k| clear(); 350| 37.4k| data_ = new_data; 351| 37.4k| size_ = new_size; 352| 37.4k| capacity_ = new_capacity; 353| 37.4k| return true; 354| 37.4k| } _ZN4bssl6VectorImE5beginEv: 277| 37.4k| T *begin() { return data_; } _ZN4bssl6VectorImE3endEv: 279| 37.4k| T *end() { return data_ + size_; } _ZNK4bssl6VectorINSt3__110unique_ptrI9bignum_stNS_8internal7DeleterEEEE4sizeEv: 248| 513k| size_t size() const { return size_; } _ZN4bssl6VectorINSt3__110unique_ptrI9bignum_stNS_8internal7DeleterEEEE4PushES6_: 298| 225k| [[nodiscard]] bool Push(T elem) { 299| 225k| if (!MaybeGrow()) { ------------------ | Branch (299:9): [True: 0, False: 225k] ------------------ 300| 0| return false; 301| 0| } 302| 225k| new (&data_[size_]) T(std::move(elem)); 303| 225k| size_++; 304| 225k| return true; 305| 225k| } _ZN4bssl6VectorINSt3__110unique_ptrI9bignum_stNS_8internal7DeleterEEEE9MaybeGrowEv: 324| 225k| bool MaybeGrow() { 325| | // No need to grow if we have room for one more T. 326| 225k| if (size_ < capacity_) { ------------------ | Branch (326:9): [True: 188k, False: 37.4k] ------------------ 327| 188k| return true; 328| 188k| } 329| 37.4k| size_t new_capacity = kDefaultSize; 330| 37.4k| if (capacity_ > 0) { ------------------ | Branch (330:9): [True: 0, False: 37.4k] ------------------ 331| | // Double the array's size if it's safe to do so. 332| 0| if (capacity_ > SIZE_MAX / 2) { ------------------ | Branch (332:11): [True: 0, False: 0] ------------------ 333| 0| OPENSSL_PUT_ERROR(CRYPTO, ERR_R_OVERFLOW); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 334| 0| return false; 335| 0| } 336| 0| new_capacity = capacity_ * 2; 337| 0| } 338| 37.4k| if (new_capacity > SIZE_MAX / sizeof(T)) { ------------------ | Branch (338:9): [True: 0, False: 37.4k] ------------------ 339| 0| OPENSSL_PUT_ERROR(CRYPTO, ERR_R_OVERFLOW); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 340| 0| return false; 341| 0| } 342| 37.4k| T *new_data = 343| 37.4k| reinterpret_cast(OPENSSL_malloc(new_capacity * sizeof(T))); 344| 37.4k| if (new_data == nullptr) { ------------------ | Branch (344:9): [True: 0, False: 37.4k] ------------------ 345| 0| return false; 346| 0| } 347| 37.4k| size_t new_size = size_; 348| 37.4k| std::uninitialized_move(begin(), end(), new_data); 349| 37.4k| clear(); 350| 37.4k| data_ = new_data; 351| 37.4k| size_ = new_size; 352| 37.4k| capacity_ = new_capacity; 353| 37.4k| return true; 354| 37.4k| } _ZN4bssl6VectorINSt3__110unique_ptrI9bignum_stNS_8internal7DeleterEEEE5beginEv: 277| 37.4k| T *begin() { return data_; } _ZN4bssl6VectorINSt3__110unique_ptrI9bignum_stNS_8internal7DeleterEEEE3endEv: 279| 37.4k| T *end() { return data_ + size_; } _ZN4bssl6VectorINSt3__110unique_ptrI9bignum_stNS_8internal7DeleterEEEEixEm: 255| 513k| T &operator[](size_t i) { 256| 513k| BSSL_CHECK(i < size_); ------------------ | | 384| 513k| do { \ | | 385| 513k| if (!(condition)) { \ | | ------------------ | | | Branch (385:9): [True: 0, False: 513k] | | ------------------ | | 386| 0| abort(); \ | | 387| 0| } \ | | 388| 513k| } while (0); | | ------------------ | | | Branch (388:12): [Folded - Ignored] | | ------------------ ------------------ 257| 513k| return data_[i]; 258| 513k| } _ZNK4bssl6VectorImE5emptyEv: 249| 349k| bool empty() const { return size_ == 0; } _ZN4bssl6VectorImE4backEv: 268| 349k| T &back() { 269| 349k| BSSL_CHECK(size_ != 0); ------------------ | | 384| 349k| do { \ | | 385| 349k| if (!(condition)) { \ | | ------------------ | | | Branch (385:9): [True: 0, False: 349k] | | ------------------ | | 386| 0| abort(); \ | | 387| 0| } \ | | 388| 349k| } while (0); | | ------------------ | | | Branch (388:12): [Folded - Ignored] | | ------------------ ------------------ 270| 349k| return data_[size_ - 1]; 271| 349k| } _ZN4bssl6VectorImE8pop_backEv: 290| 349k| void pop_back() { 291| 349k| BSSL_CHECK(size_ != 0); ------------------ | | 384| 349k| do { \ | | 385| 349k| if (!(condition)) { \ | | ------------------ | | | Branch (385:9): [True: 0, False: 349k] | | ------------------ | | 386| 0| abort(); \ | | 387| 0| } \ | | 388| 349k| } while (0); | | ------------------ | | | Branch (388:12): [Folded - Ignored] | | ------------------ ------------------ 292| 349k| std::destroy_at(&data_[size_ - 1]); 293| 349k| size_--; 294| 349k| } _ZN4bssl10MakeUniqueI15evp_pkey_ctx_stJEEENSt3__110unique_ptrIT_NS_8internal7DeleterEEEDpOT0_: 78| 159k|UniquePtr MakeUnique(Args &&...args) { 79| 159k| return UniquePtr(New(std::forward(args)...)); 80| 159k|} _ZN4bssl3NewI15evp_pkey_ctx_stJEEEPT_DpOT0_: 47| 159k|T *New(Args &&...args) { 48| 159k| void *t = OPENSSL_malloc(sizeof(T)); 49| 159k| if (t == nullptr) { ------------------ | Branch (49:7): [True: 0, False: 159k] ------------------ 50| 0| return nullptr; 51| 0| } 52| 159k| return new (t) T(std::forward(args)...); 53| 159k|} _ZN4bssl6DeleteI15evp_pkey_ctx_stEEvPT_: 59| 159k|void Delete(T *t) { 60| 159k| if (t != nullptr) { ------------------ | Branch (60:7): [True: 159k, False: 0] ------------------ 61| 159k| t->~T(); 62| 159k| OPENSSL_free(t); 63| 159k| } 64| 159k|} MLKEM768_generate_key: 35| 56.3k| struct MLKEM768_private_key *out_private_key) { 36| 56.3k| BCM_mlkem768_generate_key( 37| 56.3k| out_encoded_public_key, optional_out_seed, 38| 56.3k| reinterpret_cast(out_private_key)); 39| 56.3k|} OBJ_dup: 53| 1.11M|ASN1_OBJECT *OBJ_dup(const ASN1_OBJECT *o) { 54| 1.11M| ASN1_OBJECT *r; 55| 1.11M| unsigned char *data = NULL; 56| 1.11M| char *sn = NULL, *ln = NULL; 57| | 58| 1.11M| if (o == NULL) { ------------------ | Branch (58:7): [True: 0, False: 1.11M] ------------------ 59| 0| return NULL; 60| 0| } 61| | 62| 1.11M| if (!(o->flags & ASN1_OBJECT_FLAG_DYNAMIC)) { ------------------ | | 55| 1.11M|#define ASN1_OBJECT_FLAG_DYNAMIC 0x01 // internal use ------------------ | Branch (62:7): [True: 0, False: 1.11M] ------------------ 63| | // TODO(fork): this is a little dangerous. 64| 0| return (ASN1_OBJECT *)o; 65| 0| } 66| | 67| 1.11M| r = ASN1_OBJECT_new(); 68| 1.11M| if (r == NULL) { ------------------ | Branch (68:7): [True: 0, False: 1.11M] ------------------ 69| 0| OPENSSL_PUT_ERROR(OBJ, ERR_R_ASN1_LIB); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 70| 0| return NULL; 71| 0| } 72| 1.11M| r->ln = r->sn = NULL; 73| | 74| | // once data is attached to an object, it remains const 75| 1.11M| r->data = reinterpret_cast(OPENSSL_memdup(o->data, o->length)); 76| 1.11M| if (o->length != 0 && r->data == NULL) { ------------------ | Branch (76:7): [True: 1.11M, False: 0] | Branch (76:25): [True: 0, False: 1.11M] ------------------ 77| 0| goto err; 78| 0| } 79| | 80| 1.11M| r->length = o->length; 81| 1.11M| r->nid = o->nid; 82| | 83| 1.11M| if (o->ln != NULL) { ------------------ | Branch (83:7): [True: 0, False: 1.11M] ------------------ 84| 0| ln = OPENSSL_strdup(o->ln); 85| 0| if (ln == NULL) { ------------------ | Branch (85:9): [True: 0, False: 0] ------------------ 86| 0| goto err; 87| 0| } 88| 0| } 89| | 90| 1.11M| if (o->sn != NULL) { ------------------ | Branch (90:7): [True: 0, False: 1.11M] ------------------ 91| 0| sn = OPENSSL_strdup(o->sn); 92| 0| if (sn == NULL) { ------------------ | Branch (92:9): [True: 0, False: 0] ------------------ 93| 0| goto err; 94| 0| } 95| 0| } 96| | 97| 1.11M| r->sn = sn; 98| 1.11M| r->ln = ln; 99| | 100| 1.11M| r->flags = 101| 1.11M| o->flags | (ASN1_OBJECT_FLAG_DYNAMIC | ASN1_OBJECT_FLAG_DYNAMIC_STRINGS | ------------------ | | 55| 1.11M|#define ASN1_OBJECT_FLAG_DYNAMIC 0x01 // internal use ------------------ o->flags | (ASN1_OBJECT_FLAG_DYNAMIC | ASN1_OBJECT_FLAG_DYNAMIC_STRINGS | ------------------ | | 56| 1.11M|#define ASN1_OBJECT_FLAG_DYNAMIC_STRINGS 0x04 // internal use ------------------ 102| 1.11M| ASN1_OBJECT_FLAG_DYNAMIC_DATA); ------------------ | | 57| 1.11M|#define ASN1_OBJECT_FLAG_DYNAMIC_DATA 0x08 // internal use ------------------ 103| 1.11M| return r; 104| | 105| 0|err: 106| 0| OPENSSL_free(ln); 107| 0| OPENSSL_free(sn); 108| 0| OPENSSL_free(data); 109| 0| OPENSSL_free(r); 110| 0| return NULL; 111| 1.11M|} OBJ_get_undef: 283| 1.09M|const ASN1_OBJECT *OBJ_get_undef(void) { 284| 1.09M| static const ASN1_OBJECT kUndef = { 285| 1.09M| /*sn=*/SN_undef, ------------------ | | 41| 1.09M|#define SN_undef "UNDEF" ------------------ 286| 1.09M| /*ln=*/LN_undef, ------------------ | | 42| 1.09M|#define LN_undef "undefined" ------------------ 287| 1.09M| /*nid=*/NID_undef, ------------------ | | 43| 1.09M|#define NID_undef 0 ------------------ 288| 1.09M| /*length=*/0, 289| | /*data=*/NULL, 290| 1.09M| /*flags=*/0, 291| 1.09M| }; 292| 1.09M| return &kUndef; 293| 1.09M|} CRYPTO_BUFFER_new: 167| 93.7k| CRYPTO_BUFFER_POOL *pool) { 168| 93.7k| return crypto_buffer_new(data, len, /*data_is_static=*/0, pool); 169| 93.7k|} CRYPTO_BUFFER_new_from_CBS: 191| 93.7k| CRYPTO_BUFFER_POOL *pool) { 192| 93.7k| return CRYPTO_BUFFER_new(CBS_data(cbs), CBS_len(cbs), pool); 193| 93.7k|} CRYPTO_BUFFER_free: 200| 279k|void CRYPTO_BUFFER_free(CRYPTO_BUFFER *buf) { 201| 279k| if (buf == NULL) { ------------------ | Branch (201:7): [True: 2, False: 279k] ------------------ 202| 2| return; 203| 2| } 204| | 205| 279k| CRYPTO_BUFFER_POOL *const pool = buf->pool; 206| 279k| if (pool == NULL) { ------------------ | Branch (206:7): [True: 279k, False: 0] ------------------ 207| 279k| if (CRYPTO_refcount_dec_and_test_zero(&buf->references)) { ------------------ | Branch (207:9): [True: 93.7k, False: 185k] ------------------ 208| | // If a reference count of zero is observed, there cannot be a reference 209| | // from any pool to this buffer and thus we are able to free this 210| | // buffer. 211| 93.7k| crypto_buffer_free_object(buf); 212| 93.7k| } 213| | 214| 279k| return; 215| 279k| } 216| | 217| 0| CRYPTO_MUTEX_lock_write(&pool->lock); 218| 0| if (!CRYPTO_refcount_dec_and_test_zero(&buf->references)) { ------------------ | Branch (218:7): [True: 0, False: 0] ------------------ 219| 0| CRYPTO_MUTEX_unlock_write(&buf->pool->lock); 220| 0| return; 221| 0| } 222| | 223| | // We have an exclusive lock on the pool, therefore no concurrent lookups can 224| | // find this buffer and increment the reference count. Thus, if the count is 225| | // zero there are and can never be any more references and thus we can free 226| | // this buffer. 227| | // 228| | // Note it is possible |buf| is no longer in the pool, if it was replaced by a 229| | // static version. If that static version was since removed, it is even 230| | // possible for |found| to be NULL. 231| 0| CRYPTO_BUFFER *found = lh_CRYPTO_BUFFER_retrieve(pool->bufs, buf); 232| 0| if (found == buf) { ------------------ | Branch (232:7): [True: 0, False: 0] ------------------ 233| 0| found = lh_CRYPTO_BUFFER_delete(pool->bufs, buf); 234| 0| assert(found == buf); 235| 0| (void)found; 236| 0| } 237| | 238| 0| CRYPTO_MUTEX_unlock_write(&buf->pool->lock); 239| 0| crypto_buffer_free_object(buf); 240| 0|} CRYPTO_BUFFER_up_ref: 242| 185k|int CRYPTO_BUFFER_up_ref(CRYPTO_BUFFER *buf) { 243| | // This is safe in the case that |buf->pool| is NULL because it's just 244| | // standard reference counting in that case. 245| | // 246| | // This is also safe if |buf->pool| is non-NULL because, if it were racing 247| | // with |CRYPTO_BUFFER_free| then the two callers must have independent 248| | // references already and so the reference count will never hit zero. 249| 185k| CRYPTO_refcount_inc(&buf->references); 250| 185k| return 1; 251| 185k|} CRYPTO_BUFFER_data: 253| 4.38M|const uint8_t *CRYPTO_BUFFER_data(const CRYPTO_BUFFER *buf) { 254| 4.38M| return buf->data; 255| 4.38M|} CRYPTO_BUFFER_len: 257| 2.29M|size_t CRYPTO_BUFFER_len(const CRYPTO_BUFFER *buf) { return buf->len; } CRYPTO_BUFFER_init_CBS: 259| 52.2k|void CRYPTO_BUFFER_init_CBS(const CRYPTO_BUFFER *buf, CBS *out) { 260| 52.2k| CBS_init(out, buf->data, buf->len); 261| 52.2k|} pool.cc:_ZL17crypto_buffer_newPKhmiP21crypto_buffer_pool_st: 87| 93.7k| CRYPTO_BUFFER_POOL *pool) { 88| 93.7k| if (pool != NULL) { ------------------ | Branch (88:7): [True: 0, False: 93.7k] ------------------ 89| 0| CRYPTO_BUFFER tmp; 90| 0| tmp.data = (uint8_t *)data; 91| 0| tmp.len = len; 92| 0| tmp.pool = pool; 93| | 94| 0| CRYPTO_MUTEX_lock_read(&pool->lock); 95| 0| CRYPTO_BUFFER *duplicate = lh_CRYPTO_BUFFER_retrieve(pool->bufs, &tmp); 96| 0| if (data_is_static && duplicate != NULL && !duplicate->data_is_static) { ------------------ | Branch (96:9): [True: 0, False: 0] | Branch (96:27): [True: 0, False: 0] | Branch (96:48): [True: 0, False: 0] ------------------ 97| | // If the new |CRYPTO_BUFFER| would have static data, but the duplicate 98| | // does not, we replace the old one with the new static version. 99| 0| duplicate = NULL; 100| 0| } 101| 0| if (duplicate != NULL) { ------------------ | Branch (101:9): [True: 0, False: 0] ------------------ 102| 0| CRYPTO_refcount_inc(&duplicate->references); 103| 0| } 104| 0| CRYPTO_MUTEX_unlock_read(&pool->lock); 105| | 106| 0| if (duplicate != NULL) { ------------------ | Branch (106:9): [True: 0, False: 0] ------------------ 107| 0| return duplicate; 108| 0| } 109| 0| } 110| | 111| 93.7k| CRYPTO_BUFFER *const buf = 112| 93.7k| reinterpret_cast(OPENSSL_zalloc(sizeof(CRYPTO_BUFFER))); 113| 93.7k| if (buf == NULL) { ------------------ | Branch (113:7): [True: 0, False: 93.7k] ------------------ 114| 0| return NULL; 115| 0| } 116| | 117| 93.7k| if (data_is_static) { ------------------ | Branch (117:7): [True: 0, False: 93.7k] ------------------ 118| 0| buf->data = (uint8_t *)data; 119| 0| buf->data_is_static = 1; 120| 93.7k| } else { 121| 93.7k| buf->data = reinterpret_cast(OPENSSL_memdup(data, len)); 122| 93.7k| if (len != 0 && buf->data == NULL) { ------------------ | Branch (122:9): [True: 93.4k, False: 278] | Branch (122:21): [True: 0, False: 93.4k] ------------------ 123| 0| OPENSSL_free(buf); 124| 0| return NULL; 125| 0| } 126| 93.7k| } 127| | 128| 93.7k| buf->len = len; 129| 93.7k| buf->references = 1; 130| | 131| 93.7k| if (pool == NULL) { ------------------ | Branch (131:7): [True: 93.7k, False: 0] ------------------ 132| 93.7k| return buf; 133| 93.7k| } 134| | 135| 0| buf->pool = pool; 136| | 137| 0| CRYPTO_MUTEX_lock_write(&pool->lock); 138| 0| CRYPTO_BUFFER *duplicate = lh_CRYPTO_BUFFER_retrieve(pool->bufs, buf); 139| 0| if (data_is_static && duplicate != NULL && !duplicate->data_is_static) { ------------------ | Branch (139:7): [True: 0, False: 0] | Branch (139:25): [True: 0, False: 0] | Branch (139:46): [True: 0, False: 0] ------------------ 140| | // If the new |CRYPTO_BUFFER| would have static data, but the duplicate does 141| | // not, we replace the old one with the new static version. 142| 0| duplicate = NULL; 143| 0| } 144| 0| int inserted = 0; 145| 0| if (duplicate == NULL) { ------------------ | Branch (145:7): [True: 0, False: 0] ------------------ 146| 0| CRYPTO_BUFFER *old = NULL; 147| 0| inserted = lh_CRYPTO_BUFFER_insert(pool->bufs, &old, buf); 148| | // |old| may be non-NULL if a match was found but ignored. |pool->bufs| does 149| | // not increment refcounts, so there is no need to clean up after the 150| | // replacement. 151| 0| } else { 152| 0| CRYPTO_refcount_inc(&duplicate->references); 153| 0| } 154| 0| CRYPTO_MUTEX_unlock_write(&pool->lock); 155| | 156| 0| if (!inserted) { ------------------ | Branch (156:7): [True: 0, False: 0] ------------------ 157| | // We raced to insert |buf| into the pool and lost, or else there was an 158| | // error inserting. 159| 0| crypto_buffer_free_object(buf); 160| 0| return duplicate; 161| 0| } 162| | 163| 0| return buf; 164| 0|} pool.cc:_ZL25crypto_buffer_free_objectP16crypto_buffer_st: 78| 93.7k|static void crypto_buffer_free_object(CRYPTO_BUFFER *buf) { 79| 93.7k| if (!buf->data_is_static) { ------------------ | Branch (79:7): [True: 93.7k, False: 0] ------------------ 80| 93.7k| OPENSSL_free(buf->data); 81| 93.7k| } 82| 93.7k| OPENSSL_free(buf); 83| 93.7k|} RAND_reset_for_fuzzing: 37| 9.52k|void RAND_reset_for_fuzzing(void) { g_num_calls = 0; } CRYPTO_sysrand: 41| 107|void CRYPTO_sysrand(uint8_t *out, size_t requested) { 42| 107| static const uint8_t kZeroKey[32] = {0}; 43| | 44| 107| CRYPTO_MUTEX_lock_write(&g_num_calls_lock); 45| 107| uint64_t num_calls = g_num_calls++; 46| 107| CRYPTO_MUTEX_unlock_write(&g_num_calls_lock); 47| | 48| 107| uint8_t nonce[12]; 49| 107| OPENSSL_memset(nonce, 0, sizeof(nonce)); 50| 107| OPENSSL_memcpy(nonce, &num_calls, sizeof(num_calls)); 51| | 52| 107| OPENSSL_memset(out, 0, requested); 53| 107| CRYPTO_chacha_20(out, out, requested, kZeroKey, nonce, 0); 54| 107|} CRYPTO_sysrand_for_seed: 61| 107|void CRYPTO_sysrand_for_seed(uint8_t *out, size_t requested) { 62| 107| CRYPTO_sysrand(out, requested); 63| 107|} CRYPTO_get_fork_generation: 80| 465k|uint64_t CRYPTO_get_fork_generation(void) { 81| 465k| CRYPTO_once(&g_fork_detect_once, init_fork_detect); 82| | 83| | // In a single-threaded process, there are obviously no races because there's 84| | // only a single mutator in the address space. 85| | // 86| | // In a multi-threaded environment, |CRYPTO_once| ensures that the flag byte 87| | // is initialised atomically, even if multiple threads enter this function 88| | // concurrently. 89| | // 90| | // Additionally, while the kernel will only clear WIPEONFORK at a point when a 91| | // child process is single-threaded, the child may become multi-threaded 92| | // before it observes this. Therefore, we must synchronize the logic below. 93| | 94| 465k| CRYPTO_atomic_u32 *const flag_ptr = g_fork_detect_addr; 95| 465k| if (flag_ptr == NULL) { ------------------ | Branch (95:7): [True: 0, False: 465k] ------------------ 96| | // Our kernel is too old to support |MADV_WIPEONFORK| or 97| | // |g_force_madv_wipeonfork| is set. 98| 0| if (g_force_madv_wipeonfork && g_force_madv_wipeonfork_enabled) { ------------------ | Branch (98:9): [True: 0, False: 0] | Branch (98:36): [True: 0, False: 0] ------------------ 99| | // A constant generation number to simulate support, even if the kernel 100| | // doesn't support it. 101| 0| return 42; 102| 0| } 103| | // With Linux and clone(), we do not believe that pthread_atfork() is 104| | // sufficient for detecting all forms of address space duplication. At this 105| | // point we have a kernel that does not support MADV_WIPEONFORK. We could 106| | // return the generation number from pthread_atfork() here and it would 107| | // probably be safe in almost any situation, but to ensure safety we return 108| | // 0 and force an entropy draw on every call. 109| 0| return 0; 110| 0| } 111| | 112| | // In the common case, try to observe the flag without taking a lock. This 113| | // avoids cacheline contention in the PRNG. 114| 465k| uint64_t *const generation_ptr = &g_fork_generation; 115| 465k| if (CRYPTO_atomic_load_u32(flag_ptr) != 0) { ------------------ | Branch (115:7): [True: 465k, False: 0] ------------------ 116| | // If we observe a non-zero flag, it is safe to read |generation_ptr| 117| | // without a lock. The flag and generation number are fixed for this copy of 118| | // the address space. 119| 465k| return *generation_ptr; 120| 465k| } 121| | 122| | // The flag was zero. The generation number must be incremented, but other 123| | // threads may have concurrently observed the zero, so take a lock before 124| | // incrementing. 125| 0| CRYPTO_MUTEX *const lock = &g_fork_detect_lock; 126| 0| CRYPTO_MUTEX_lock_write(lock); 127| 0| uint64_t current_generation = *generation_ptr; 128| 0| if (CRYPTO_atomic_load_u32(flag_ptr) == 0) { ------------------ | Branch (128:7): [True: 0, False: 0] ------------------ 129| | // A fork has occurred. 130| 0| current_generation++; 131| 0| if (current_generation == 0) { ------------------ | Branch (131:9): [True: 0, False: 0] ------------------ 132| | // Zero means fork detection isn't supported, so skip that value. 133| 0| current_generation = 1; 134| 0| } 135| | 136| | // We must update |generation_ptr| before |flag_ptr|. Other threads may 137| | // observe |flag_ptr| without taking a lock. 138| 0| *generation_ptr = current_generation; 139| 0| CRYPTO_atomic_store_u32(flag_ptr, 1); 140| 0| } 141| 0| CRYPTO_MUTEX_unlock_write(lock); 142| | 143| 0| return current_generation; 144| 465k|} fork_detect.cc:_ZL16init_fork_detectv: 47| 1|static void init_fork_detect(void) { 48| 1| if (g_force_madv_wipeonfork) { ------------------ | Branch (48:7): [True: 0, False: 1] ------------------ 49| 0| return; 50| 0| } 51| | 52| 1| long page_size = sysconf(_SC_PAGESIZE); 53| 1| if (page_size <= 0) { ------------------ | Branch (53:7): [True: 0, False: 1] ------------------ 54| 0| return; 55| 0| } 56| | 57| 1| void *addr = mmap(NULL, (size_t)page_size, PROT_READ | PROT_WRITE, 58| 1| MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); 59| 1| if (addr == MAP_FAILED) { ------------------ | Branch (59:7): [True: 0, False: 1] ------------------ 60| 0| return; 61| 0| } 62| | 63| | // Some versions of qemu (up to at least 5.0.0-rc4, see linux-user/syscall.c) 64| | // ignore |madvise| calls and just return zero (i.e. success). But we need to 65| | // know whether MADV_WIPEONFORK actually took effect. Therefore try an invalid 66| | // call to check that the implementation of |madvise| is actually rejecting 67| | // unknown |advice| values. 68| 1| if (madvise(addr, (size_t)page_size, -1) == 0 || ------------------ | Branch (68:7): [True: 0, False: 1] ------------------ 69| 1| madvise(addr, (size_t)page_size, MADV_WIPEONFORK) != 0) { ------------------ | Branch (69:7): [True: 0, False: 1] ------------------ 70| 0| munmap(addr, (size_t)page_size); 71| 0| return; 72| 0| } 73| | 74| 1| CRYPTO_atomic_u32 *const atomic = reinterpret_cast(addr); 75| 1| CRYPTO_atomic_store_u32(atomic, 1); 76| 1| g_fork_detect_addr = atomic; 77| 1| g_fork_generation = 1; 78| 1|} rand_fork_unsafe_buffering_enabled: 42| 437k|int rand_fork_unsafe_buffering_enabled(void) { 43| 437k| return CRYPTO_atomic_load_u32(&g_buffering_enabled) != 0; 44| 437k|} RAND_bytes: 23| 321k|int RAND_bytes(uint8_t *buf, size_t len) { 24| 321k| BCM_rand_bytes(buf, len); 25| 321k| return 1; 26| 321k|} CRYPTO_refcount_inc: 21| 664k|void CRYPTO_refcount_inc(CRYPTO_refcount_t *count) { 22| 664k| uint32_t expected = CRYPTO_atomic_load_u32(count); 23| | 24| 664k| while (expected != CRYPTO_REFCOUNT_MAX) { ------------------ | | 580| 664k|#define CRYPTO_REFCOUNT_MAX 0xffffffff ------------------ | Branch (24:10): [True: 664k, False: 0] ------------------ 25| 664k| uint32_t new_value = expected + 1; 26| 664k| if (CRYPTO_atomic_compare_exchange_weak_u32(count, &expected, new_value)) { ------------------ | Branch (26:9): [True: 664k, False: 0] ------------------ 27| 664k| break; 28| 664k| } 29| 664k| } 30| 664k|} CRYPTO_refcount_dec_and_test_zero: 32| 1.24M|int CRYPTO_refcount_dec_and_test_zero(CRYPTO_refcount_t *count) { 33| 1.24M| uint32_t expected = CRYPTO_atomic_load_u32(count); 34| | 35| 1.24M| for (;;) { 36| 1.24M| if (expected == 0) { ------------------ | Branch (36:9): [True: 0, False: 1.24M] ------------------ 37| 0| abort(); 38| 1.24M| } else if (expected == CRYPTO_REFCOUNT_MAX) { ------------------ | | 580| 1.24M|#define CRYPTO_REFCOUNT_MAX 0xffffffff ------------------ | Branch (38:16): [True: 0, False: 1.24M] ------------------ 39| 0| return 0; 40| 1.24M| } else { 41| 1.24M| const uint32_t new_value = expected - 1; 42| 1.24M| if (CRYPTO_atomic_compare_exchange_weak_u32(count, &expected, ------------------ | Branch (42:11): [True: 1.24M, False: 0] ------------------ 43| 1.24M| new_value)) { 44| 1.24M| return new_value == 0; 45| 1.24M| } 46| 1.24M| } 47| 1.24M| } 48| 1.24M|} RSA_parse_public_key: 49| 83.2k|RSA *RSA_parse_public_key(CBS *cbs) { 50| 83.2k| RSA *ret = RSA_new(); 51| 83.2k| if (ret == NULL) { ------------------ | Branch (51:7): [True: 0, False: 83.2k] ------------------ 52| 0| return NULL; 53| 0| } 54| 83.2k| CBS child; 55| 83.2k| if (!CBS_get_asn1(cbs, &child, CBS_ASN1_SEQUENCE) || ------------------ | | 223| 83.2k|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED) | | ------------------ | | | | 197| 83.2k|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | | | ------------------ | | | | | | 194| 83.2k|#define CBS_ASN1_TAG_SHIFT 24 | | | | ------------------ | | ------------------ ------------------ | Branch (55:7): [True: 314, False: 82.9k] ------------------ 56| 83.2k| !parse_integer(&child, &ret->n) || ------------------ | Branch (56:7): [True: 2.89k, False: 80.0k] ------------------ 57| 83.2k| !parse_integer(&child, &ret->e) || ------------------ | Branch (57:7): [True: 144, False: 79.8k] ------------------ 58| 83.2k| CBS_len(&child) != 0) { ------------------ | Branch (58:7): [True: 32, False: 79.8k] ------------------ 59| 3.38k| OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_ENCODING); ------------------ | | 361| 3.38k| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 60| 3.38k| RSA_free(ret); 61| 3.38k| return NULL; 62| 3.38k| } 63| | 64| 79.8k| if (!RSA_check_key(ret)) { ------------------ | Branch (64:7): [True: 142, False: 79.7k] ------------------ 65| 142| OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_RSA_PARAMETERS); ------------------ | | 361| 142| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 66| 142| RSA_free(ret); 67| 142| return NULL; 68| 142| } 69| | 70| 79.7k| return ret; 71| 79.8k|} RSA_marshal_public_key: 85| 10|int RSA_marshal_public_key(CBB *cbb, const RSA *rsa) { 86| 10| CBB child; 87| 10| if (!CBB_add_asn1(cbb, &child, CBS_ASN1_SEQUENCE) || ------------------ | | 223| 10|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED) | | ------------------ | | | | 197| 10|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | | | ------------------ | | | | | | 194| 10|#define CBS_ASN1_TAG_SHIFT 24 | | | | ------------------ | | ------------------ ------------------ | Branch (87:7): [True: 0, False: 10] ------------------ 88| 10| !marshal_integer(&child, rsa->n) || ------------------ | Branch (88:7): [True: 0, False: 10] ------------------ 89| 10| !marshal_integer(&child, rsa->e) || ------------------ | Branch (89:7): [True: 0, False: 10] ------------------ 90| 10| !CBB_flush(cbb)) { ------------------ | Branch (90:7): [True: 0, False: 10] ------------------ 91| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_ENCODE_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 92| 0| return 0; 93| 0| } 94| 10| return 1; 95| 10|} RSA_parse_private_key: 115| 2|RSA *RSA_parse_private_key(CBS *cbs) { 116| 2| RSA *ret = RSA_new(); 117| 2| if (ret == NULL) { ------------------ | Branch (117:7): [True: 0, False: 2] ------------------ 118| 0| return NULL; 119| 0| } 120| | 121| 2| CBS child; 122| 2| uint64_t version; 123| 2| if (!CBS_get_asn1(cbs, &child, CBS_ASN1_SEQUENCE) || ------------------ | | 223| 2|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED) | | ------------------ | | | | 197| 2|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | | | ------------------ | | | | | | 194| 2|#define CBS_ASN1_TAG_SHIFT 24 | | | | ------------------ | | ------------------ ------------------ | Branch (123:7): [True: 0, False: 2] ------------------ 124| 2| !CBS_get_asn1_uint64(&child, &version)) { ------------------ | Branch (124:7): [True: 0, False: 2] ------------------ 125| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_ENCODING); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 126| 0| goto err; 127| 0| } 128| | 129| 2| if (version != kVersionTwoPrime) { ------------------ | Branch (129:7): [True: 0, False: 2] ------------------ 130| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_VERSION); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 131| 0| goto err; 132| 0| } 133| | 134| 2| if (!parse_integer(&child, &ret->n) || ------------------ | Branch (134:7): [True: 0, False: 2] ------------------ 135| 2| !parse_integer(&child, &ret->e) || ------------------ | Branch (135:7): [True: 0, False: 2] ------------------ 136| 2| !parse_integer(&child, &ret->d) || ------------------ | Branch (136:7): [True: 0, False: 2] ------------------ 137| 2| !parse_integer(&child, &ret->p) || ------------------ | Branch (137:7): [True: 0, False: 2] ------------------ 138| 2| !parse_integer(&child, &ret->q) || ------------------ | Branch (138:7): [True: 0, False: 2] ------------------ 139| 2| !parse_integer(&child, &ret->dmp1) || ------------------ | Branch (139:7): [True: 0, False: 2] ------------------ 140| 2| !parse_integer(&child, &ret->dmq1) || ------------------ | Branch (140:7): [True: 0, False: 2] ------------------ 141| 2| !parse_integer(&child, &ret->iqmp)) { ------------------ | Branch (141:7): [True: 0, False: 2] ------------------ 142| 0| goto err; 143| 0| } 144| | 145| 2| if (CBS_len(&child) != 0) { ------------------ | Branch (145:7): [True: 0, False: 2] ------------------ 146| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_ENCODING); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 147| 0| goto err; 148| 0| } 149| | 150| 2| if (!RSA_check_key(ret)) { ------------------ | Branch (150:7): [True: 0, False: 2] ------------------ 151| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_RSA_PARAMETERS); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 152| 0| goto err; 153| 0| } 154| | 155| 2| return ret; 156| | 157| 0|err: 158| 0| RSA_free(ret); 159| 0| return NULL; 160| 2|} RSA_private_key_from_bytes: 162| 2|RSA *RSA_private_key_from_bytes(const uint8_t *in, size_t in_len) { 163| 2| CBS cbs; 164| 2| CBS_init(&cbs, in, in_len); 165| 2| RSA *ret = RSA_parse_private_key(&cbs); 166| 2| if (ret == NULL || CBS_len(&cbs) != 0) { ------------------ | Branch (166:7): [True: 0, False: 2] | Branch (166:22): [True: 0, False: 2] ------------------ 167| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_ENCODING); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 168| 0| RSA_free(ret); 169| 0| return NULL; 170| 0| } 171| 2| return ret; 172| 2|} rsa_asn1.cc:_ZL13parse_integerP6cbs_stPP9bignum_st: 31| 162k|static int parse_integer(CBS *cbs, BIGNUM **out) { 32| 162k| assert(*out == NULL); 33| 162k| *out = BN_new(); 34| 162k| if (*out == NULL) { ------------------ | Branch (34:7): [True: 0, False: 162k] ------------------ 35| 0| return 0; 36| 0| } 37| 162k| return BN_parse_asn1_unsigned(cbs, *out); 38| 162k|} rsa_asn1.cc:_ZL15marshal_integerP6cbb_stP9bignum_st: 40| 20|static int marshal_integer(CBB *cbb, BIGNUM *bn) { 41| 20| if (bn == NULL) { ------------------ | Branch (41:7): [True: 0, False: 20] ------------------ 42| | // An RSA object may be missing some components. 43| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_VALUE_MISSING); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 44| 0| return 0; 45| 0| } 46| 20| return BN_marshal_asn1(cbb, bn); 47| 20|} RSA_encrypt: 341| 1.73k| const uint8_t *in, size_t in_len, int padding) { 342| 1.73k| if (rsa->n == NULL || rsa->e == NULL) { ------------------ | Branch (342:7): [True: 0, False: 1.73k] | Branch (342:25): [True: 0, False: 1.73k] ------------------ 343| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_VALUE_MISSING); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 344| 0| return 0; 345| 0| } 346| | 347| 1.73k| if (!rsa_check_public_key(rsa)) { ------------------ | Branch (347:7): [True: 0, False: 1.73k] ------------------ 348| 0| return 0; 349| 0| } 350| | 351| 1.73k| const unsigned rsa_size = RSA_size(rsa); 352| 1.73k| if (max_out < rsa_size) { ------------------ | Branch (352:7): [True: 0, False: 1.73k] ------------------ 353| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_OUTPUT_BUFFER_TOO_SMALL); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 354| 0| return 0; 355| 0| } 356| | 357| 1.73k| bssl::UniquePtr ctx(BN_CTX_new()); 358| 1.73k| if (ctx == nullptr) { ------------------ | Branch (358:7): [True: 0, False: 1.73k] ------------------ 359| 0| return 0; 360| 0| } 361| | 362| 1.73k| bssl::BN_CTXScope scope(ctx.get()); 363| 1.73k| BIGNUM *f = BN_CTX_get(ctx.get()); 364| 1.73k| BIGNUM *result = BN_CTX_get(ctx.get()); 365| 1.73k| uint8_t *buf = reinterpret_cast(OPENSSL_malloc(rsa_size)); 366| 1.73k| int i, ret = 0; 367| 1.73k| if (!f || !result || !buf) { ------------------ | Branch (367:7): [True: 0, False: 1.73k] | Branch (367:13): [True: 0, False: 1.73k] | Branch (367:24): [True: 0, False: 1.73k] ------------------ 368| 0| goto err; 369| 0| } 370| | 371| 1.73k| switch (padding) { 372| 1.73k| case RSA_PKCS1_PADDING: ------------------ | | 208| 1.73k|#define RSA_PKCS1_PADDING 1 ------------------ | Branch (372:5): [True: 1.73k, False: 0] ------------------ 373| 1.73k| i = rsa_padding_add_PKCS1_type_2(buf, rsa_size, in, in_len); 374| 1.73k| break; 375| 0| case RSA_PKCS1_OAEP_PADDING: ------------------ | | 214| 0|#define RSA_PKCS1_OAEP_PADDING 4 ------------------ | Branch (375:5): [True: 0, False: 1.73k] ------------------ 376| | // Use the default parameters: SHA-1 for both hashes and no label. 377| 0| i = RSA_padding_add_PKCS1_OAEP_mgf1(buf, rsa_size, in, in_len, nullptr, 0, 378| 0| nullptr, nullptr); 379| 0| break; 380| 0| case RSA_NO_PADDING: ------------------ | | 211| 0|#define RSA_NO_PADDING 3 ------------------ | Branch (380:5): [True: 0, False: 1.73k] ------------------ 381| 0| i = RSA_padding_add_none(buf, rsa_size, in, in_len); 382| 0| break; 383| 0| default: ------------------ | Branch (383:5): [True: 0, False: 1.73k] ------------------ 384| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_UNKNOWN_PADDING_TYPE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 385| 0| goto err; 386| 1.73k| } 387| | 388| 1.73k| if (i <= 0) { ------------------ | Branch (388:7): [True: 0, False: 1.73k] ------------------ 389| 0| goto err; 390| 0| } 391| | 392| 1.73k| if (BN_bin2bn(buf, rsa_size, f) == nullptr) { ------------------ | Branch (392:7): [True: 0, False: 1.73k] ------------------ 393| 0| goto err; 394| 0| } 395| | 396| 1.73k| if (BN_ucmp(f, rsa->n) >= 0) { ------------------ | Branch (396:7): [True: 0, False: 1.73k] ------------------ 397| | // usually the padding functions would catch this 398| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_DATA_TOO_LARGE_FOR_MODULUS); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 399| 0| goto err; 400| 0| } 401| | 402| 1.73k| if (!BN_MONT_CTX_set_locked(&rsa->mont_n, &rsa->lock, rsa->n, ctx.get()) || ------------------ | Branch (402:7): [True: 0, False: 1.73k] ------------------ 403| 1.73k| !BN_mod_exp_mont(result, f, rsa->e, &rsa->mont_n->N, ctx.get(), ------------------ | Branch (403:7): [True: 0, False: 1.73k] ------------------ 404| 1.73k| rsa->mont_n)) { 405| 0| goto err; 406| 0| } 407| | 408| | // put in leading 0 bytes if the number is less than the length of the 409| | // modulus 410| 1.73k| if (!BN_bn2bin_padded(out, rsa_size, result)) { ------------------ | Branch (410:7): [True: 0, False: 1.73k] ------------------ 411| 0| OPENSSL_PUT_ERROR(RSA, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 412| 0| goto err; 413| 0| } 414| | 415| 1.73k| *out_len = rsa_size; 416| 1.73k| ret = 1; 417| | 418| 1.73k|err: 419| 1.73k| OPENSSL_free(buf); 420| 1.73k| return ret; 421| 1.73k|} rsa_crypt.cc:_ZL28rsa_padding_add_PKCS1_type_2PhmPKhm: 221| 1.73k| const uint8_t *from, size_t from_len) { 222| | // See RFC 8017, section 7.2.1. 223| 1.73k| if (to_len < RSA_PKCS1_PADDING_SIZE) { ------------------ | | 84| 1.73k|#define RSA_PKCS1_PADDING_SIZE 11 ------------------ | Branch (223:7): [True: 0, False: 1.73k] ------------------ 224| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_KEY_SIZE_TOO_SMALL); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 225| 0| return 0; 226| 0| } 227| | 228| 1.73k| if (from_len > to_len - RSA_PKCS1_PADDING_SIZE) { ------------------ | | 84| 1.73k|#define RSA_PKCS1_PADDING_SIZE 11 ------------------ | Branch (228:7): [True: 0, False: 1.73k] ------------------ 229| 0| OPENSSL_PUT_ERROR(RSA, RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 230| 0| return 0; 231| 0| } 232| | 233| 1.73k| to[0] = 0; 234| 1.73k| to[1] = 2; 235| | 236| 1.73k| size_t padding_len = to_len - 3 - from_len; 237| 1.73k| rand_nonzero(to + 2, padding_len); 238| 1.73k| to[2 + padding_len] = 0; 239| 1.73k| OPENSSL_memcpy(to + to_len - from_len, from, from_len); 240| 1.73k| return 1; 241| 1.73k|} rsa_crypt.cc:_ZL12rand_nonzeroPhm: 32| 1.73k|static void rand_nonzero(uint8_t *out, size_t len) { 33| 1.73k| RAND_bytes(out, len); 34| | 35| 324k| for (size_t i = 0; i < len; i++) { ------------------ | Branch (35:22): [True: 323k, False: 1.73k] ------------------ 36| | // Zero values are replaced, and the distribution of zero and non-zero bytes 37| | // is public, so leaking this is safe. 38| 324k| while (constant_time_declassify_int(out[i] == 0)) { ------------------ | Branch (38:12): [True: 1.27k, False: 323k] ------------------ 39| 1.27k| RAND_bytes(out + i, 1); 40| 1.27k| } 41| 323k| } 42| 1.73k|} SHA1_Init: 21| 2.11k|int SHA1_Init(SHA_CTX *sha) { 22| 2.11k| BCM_sha1_init(sha); 23| 2.11k| return 1; 24| 2.11k|} SHA1_Update: 26| 10.0k|int SHA1_Update(SHA_CTX *sha, const void *data, size_t len) { 27| 10.0k| BCM_sha1_update(sha, data, len); 28| 10.0k| return 1; 29| 10.0k|} SHA1_Final: 31| 4.74k|int SHA1_Final(uint8_t out[SHA_DIGEST_LENGTH], SHA_CTX *sha) { 32| 4.74k| BCM_sha1_final(out, sha); 33| 4.74k| return 1; 34| 4.74k|} SHA256_Init: 47| 107|int SHA256_Init(SHA256_CTX *sha) { 48| 107| BCM_sha256_init(sha); 49| 107| return 1; 50| 107|} SHA256_Update: 52| 214|int SHA256_Update(SHA256_CTX *sha, const void *data, size_t len) { 53| 214| BCM_sha256_update(sha, data, len); 54| 214| return 1; 55| 214|} SHA256_Final: 57| 107|int SHA256_Final(uint8_t out[SHA256_DIGEST_LENGTH], SHA256_CTX *sha) { 58| | // TODO(bbe): This overflow check one of the few places a low-level hash 59| | // 'final' function can fail. SHA-512 does not have a corresponding check. 60| | // The BCM function is infallible and will abort if this is done incorrectly. 61| | // we should verify nothing crashes with this removed and eliminate the 0 62| | // return. 63| 107| if (sha->md_len > SHA256_DIGEST_LENGTH) { ------------------ | | 110| 107|#define SHA256_DIGEST_LENGTH 32 ------------------ | Branch (63:7): [True: 0, False: 107] ------------------ 64| 0| return 0; 65| 0| } 66| 107| BCM_sha256_final(out, sha); 67| 107| return 1; 68| 107|} SHA256: 71| 52.8k| uint8_t out[SHA256_DIGEST_LENGTH]) { 72| 52.8k| SHA256_CTX ctx; 73| 52.8k| BCM_sha256_init(&ctx); 74| 52.8k| BCM_sha256_update(&ctx, data, len); 75| 52.8k| BCM_sha256_final(out, &ctx); 76| 52.8k| OPENSSL_cleanse(&ctx, sizeof(ctx)); 77| 52.8k| return out; 78| 52.8k|} OPENSSL_sk_new: 44| 1.48M|OPENSSL_STACK *OPENSSL_sk_new(OPENSSL_sk_cmp_func comp) { 45| 1.48M| OPENSSL_STACK *ret = 46| 1.48M| reinterpret_cast(OPENSSL_zalloc(sizeof(OPENSSL_STACK))); 47| 1.48M| if (ret == NULL) { ------------------ | Branch (47:7): [True: 0, False: 1.48M] ------------------ 48| 0| return NULL; 49| 0| } 50| | 51| 1.48M| ret->data = 52| 1.48M| reinterpret_cast(OPENSSL_calloc(kMinSize, sizeof(void *))); 53| 1.48M| if (ret->data == NULL) { ------------------ | Branch (53:7): [True: 0, False: 1.48M] ------------------ 54| 0| goto err; 55| 0| } 56| | 57| 1.48M| ret->comp = comp; 58| 1.48M| ret->num_alloc = kMinSize; 59| | 60| 1.48M| return ret; 61| | 62| 0|err: 63| 0| OPENSSL_free(ret); 64| 0| return NULL; 65| 1.48M|} OPENSSL_sk_new_null: 67| 1.48M|OPENSSL_STACK *OPENSSL_sk_new_null(void) { return OPENSSL_sk_new(NULL); } OPENSSL_sk_num: 69| 6.38M|size_t OPENSSL_sk_num(const OPENSSL_STACK *sk) { 70| 6.38M| if (sk == NULL) { ------------------ | Branch (70:7): [True: 154k, False: 6.22M] ------------------ 71| 154k| return 0; 72| 154k| } 73| 6.22M| return sk->num; 74| 6.38M|} OPENSSL_sk_value: 85| 4.47M|void *OPENSSL_sk_value(const OPENSSL_STACK *sk, size_t i) { 86| 4.47M| if (!sk || i >= sk->num) { ------------------ | Branch (86:7): [True: 0, False: 4.47M] | Branch (86:14): [True: 0, False: 4.47M] ------------------ 87| 0| return NULL; 88| 0| } 89| 4.47M| return sk->data[i]; 90| 4.47M|} OPENSSL_sk_set: 92| 347k|void *OPENSSL_sk_set(OPENSSL_STACK *sk, size_t i, void *value) { 93| 347k| if (!sk || i >= sk->num) { ------------------ | Branch (93:7): [True: 0, False: 347k] | Branch (93:14): [True: 0, False: 347k] ------------------ 94| 0| return NULL; 95| 0| } 96| 347k| return sk->data[i] = value; 97| 347k|} OPENSSL_sk_free: 99| 1.75M|void OPENSSL_sk_free(OPENSSL_STACK *sk) { 100| 1.75M| if (sk == NULL) { ------------------ | Branch (100:7): [True: 143k, False: 1.61M] ------------------ 101| 143k| return; 102| 143k| } 103| 1.61M| OPENSSL_free(sk->data); 104| 1.61M| OPENSSL_free(sk); 105| 1.61M|} OPENSSL_sk_pop_free_ex: 109| 1.66M| OPENSSL_sk_free_func free_func) { 110| 1.66M| if (sk == NULL) { ------------------ | Branch (110:7): [True: 468k, False: 1.19M] ------------------ 111| 468k| return; 112| 468k| } 113| | 114| 2.84M| for (size_t i = 0; i < sk->num; i++) { ------------------ | Branch (114:22): [True: 1.64M, False: 1.19M] ------------------ 115| 1.64M| if (sk->data[i] != NULL) { ------------------ | Branch (115:9): [True: 1.64M, False: 14] ------------------ 116| 1.64M| call_free_func(free_func, sk->data[i]); 117| 1.64M| } 118| 1.64M| } 119| 1.19M| OPENSSL_sk_free(sk); 120| 1.19M|} OPENSSL_sk_insert: 133| 2.06M|size_t OPENSSL_sk_insert(OPENSSL_STACK *sk, void *p, size_t where) { 134| 2.06M| if (sk == NULL) { ------------------ | Branch (134:7): [True: 0, False: 2.06M] ------------------ 135| 0| return 0; 136| 0| } 137| | 138| 2.06M| if (sk->num >= INT_MAX) { ------------------ | Branch (138:7): [True: 0, False: 2.06M] ------------------ 139| 0| OPENSSL_PUT_ERROR(CRYPTO, ERR_R_OVERFLOW); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 140| 0| return 0; 141| 0| } 142| | 143| 2.06M| if (sk->num_alloc <= sk->num + 1) { ------------------ | Branch (143:7): [True: 4.15k, False: 2.06M] ------------------ 144| | // Attempt to double the size of the array. 145| 4.15k| size_t new_alloc = sk->num_alloc << 1; 146| 4.15k| size_t alloc_size = new_alloc * sizeof(void *); 147| 4.15k| void **data; 148| | 149| | // If the doubling overflowed, try to increment. 150| 4.15k| if (new_alloc < sk->num_alloc || alloc_size / sizeof(void *) != new_alloc) { ------------------ | Branch (150:9): [True: 0, False: 4.15k] | Branch (150:38): [True: 0, False: 4.15k] ------------------ 151| 0| new_alloc = sk->num_alloc + 1; 152| 0| alloc_size = new_alloc * sizeof(void *); 153| 0| } 154| | 155| | // If the increment also overflowed, fail. 156| 4.15k| if (new_alloc < sk->num_alloc || alloc_size / sizeof(void *) != new_alloc) { ------------------ | Branch (156:9): [True: 0, False: 4.15k] | Branch (156:38): [True: 0, False: 4.15k] ------------------ 157| 0| return 0; 158| 0| } 159| | 160| 4.15k| data = reinterpret_cast(OPENSSL_realloc(sk->data, alloc_size)); 161| 4.15k| if (data == NULL) { ------------------ | Branch (161:9): [True: 0, False: 4.15k] ------------------ 162| 0| return 0; 163| 0| } 164| | 165| 4.15k| sk->data = data; 166| 4.15k| sk->num_alloc = new_alloc; 167| 4.15k| } 168| | 169| 2.06M| if (where >= sk->num) { ------------------ | Branch (169:7): [True: 2.06M, False: 0] ------------------ 170| 2.06M| sk->data[sk->num] = p; 171| 2.06M| } else { 172| 0| OPENSSL_memmove(&sk->data[where + 1], &sk->data[where], 173| 0| sizeof(void *) * (sk->num - where)); 174| 0| sk->data[where] = p; 175| 0| } 176| | 177| 2.06M| sk->num++; 178| 2.06M| sk->sorted = 0; 179| | 180| 2.06M| return sk->num; 181| 2.06M|} OPENSSL_sk_find: 233| 55.0k| OPENSSL_sk_call_cmp_func call_cmp_func) { 234| 55.0k| if (sk == NULL) { ------------------ | Branch (234:7): [True: 0, False: 55.0k] ------------------ 235| 0| return 0; 236| 0| } 237| | 238| 55.0k| if (sk->comp == NULL) { ------------------ | Branch (238:7): [True: 55.0k, False: 0] ------------------ 239| | // Use pointer equality when no comparison function has been set. 240| 448k| for (size_t i = 0; i < sk->num; i++) { ------------------ | Branch (240:24): [True: 448k, False: 1] ------------------ 241| 448k| if (sk->data[i] == p) { ------------------ | Branch (241:11): [True: 55.0k, False: 393k] ------------------ 242| 55.0k| if (out_index) { ------------------ | Branch (242:13): [True: 0, False: 55.0k] ------------------ 243| 0| *out_index = i; 244| 0| } 245| 55.0k| return 1; 246| 55.0k| } 247| 448k| } 248| 1| return 0; 249| 55.0k| } 250| | 251| 0| if (p == NULL) { ------------------ | Branch (251:7): [True: 0, False: 0] ------------------ 252| 0| return 0; 253| 0| } 254| | 255| 0| if (!OPENSSL_sk_is_sorted(sk)) { ------------------ | Branch (255:7): [True: 0, False: 0] ------------------ 256| 0| for (size_t i = 0; i < sk->num; i++) { ------------------ | Branch (256:24): [True: 0, False: 0] ------------------ 257| 0| if (call_cmp_func(sk->comp, p, sk->data[i]) == 0) { ------------------ | Branch (257:11): [True: 0, False: 0] ------------------ 258| 0| if (out_index) { ------------------ | Branch (258:13): [True: 0, False: 0] ------------------ 259| 0| *out_index = i; 260| 0| } 261| 0| return 1; 262| 0| } 263| 0| } 264| 0| return 0; 265| 0| } 266| | 267| | // The stack is sorted, so binary search to find the element. 268| | // 269| | // |lo| and |hi| maintain a half-open interval of where the answer may be. All 270| | // indices such that |lo <= idx < hi| are candidates. 271| 0| size_t lo = 0, hi = sk->num; 272| 0| while (lo < hi) { ------------------ | Branch (272:10): [True: 0, False: 0] ------------------ 273| | // Bias |mid| towards |lo|. See the |r == 0| case below. 274| 0| size_t mid = lo + (hi - lo - 1) / 2; 275| 0| assert(lo <= mid && mid < hi); 276| 0| int r = call_cmp_func(sk->comp, p, sk->data[mid]); 277| 0| if (r > 0) { ------------------ | Branch (277:9): [True: 0, False: 0] ------------------ 278| 0| lo = mid + 1; // |mid| is too low. 279| 0| } else if (r < 0) { ------------------ | Branch (279:16): [True: 0, False: 0] ------------------ 280| 0| hi = mid; // |mid| is too high. 281| 0| } else { 282| | // |mid| matches. However, this function returns the earliest match, so we 283| | // can only return if the range has size one. 284| 0| if (hi - lo == 1) { ------------------ | Branch (284:11): [True: 0, False: 0] ------------------ 285| 0| if (out_index != NULL) { ------------------ | Branch (285:13): [True: 0, False: 0] ------------------ 286| 0| *out_index = mid; 287| 0| } 288| 0| return 1; 289| 0| } 290| | // The sample is biased towards |lo|. |mid| can only be |hi - 1| if 291| | // |hi - lo| was one, so this makes forward progress. 292| 0| assert(mid + 1 < hi); 293| 0| hi = mid + 1; 294| 0| } 295| 0| } 296| | 297| 0| assert(lo == hi); 298| 0| return 0; // Not found. 299| 0|} OPENSSL_sk_push: 311| 2.06M|size_t OPENSSL_sk_push(OPENSSL_STACK *sk, void *p) { 312| 2.06M| return OPENSSL_sk_insert(sk, p, sk->num); 313| 2.06M|} OPENSSL_sk_dup: 325| 125k|OPENSSL_STACK *OPENSSL_sk_dup(const OPENSSL_STACK *sk) { 326| 125k| if (sk == NULL) { ------------------ | Branch (326:7): [True: 0, False: 125k] ------------------ 327| 0| return NULL; 328| 0| } 329| | 330| 125k| OPENSSL_STACK *ret = 331| 125k| reinterpret_cast(OPENSSL_zalloc(sizeof(OPENSSL_STACK))); 332| 125k| if (ret == NULL) { ------------------ | Branch (332:7): [True: 0, False: 125k] ------------------ 333| 0| return NULL; 334| 0| } 335| | 336| 125k| ret->data = reinterpret_cast( 337| 125k| OPENSSL_memdup(sk->data, sizeof(void *) * sk->num_alloc)); 338| 125k| if (ret->data == NULL) { ------------------ | Branch (338:7): [True: 0, False: 125k] ------------------ 339| 0| goto err; 340| 0| } 341| | 342| 125k| ret->num = sk->num; 343| 125k| ret->sorted = sk->sorted; 344| 125k| ret->num_alloc = sk->num_alloc; 345| 125k| ret->comp = sk->comp; 346| 125k| return ret; 347| | 348| 0|err: 349| 0| OPENSSL_sk_free(ret); 350| 0| return NULL; 351| 125k|} OPENSSL_sk_deep_copy: 454| 72.7k| OPENSSL_sk_free_func free_func) { 455| 72.7k| OPENSSL_STACK *ret = OPENSSL_sk_dup(sk); 456| 72.7k| if (ret == NULL) { ------------------ | Branch (456:7): [True: 0, False: 72.7k] ------------------ 457| 0| return NULL; 458| 0| } 459| | 460| 145k| for (size_t i = 0; i < ret->num; i++) { ------------------ | Branch (460:22): [True: 72.7k, False: 72.7k] ------------------ 461| 72.7k| if (ret->data[i] == NULL) { ------------------ | Branch (461:9): [True: 0, False: 72.7k] ------------------ 462| 0| continue; 463| 0| } 464| 72.7k| ret->data[i] = call_copy_func(copy_func, ret->data[i]); 465| 72.7k| if (ret->data[i] == NULL) { ------------------ | Branch (465:9): [True: 0, False: 72.7k] ------------------ 466| 0| for (size_t j = 0; j < i; j++) { ------------------ | Branch (466:26): [True: 0, False: 0] ------------------ 467| 0| if (ret->data[j] != NULL) { ------------------ | Branch (467:13): [True: 0, False: 0] ------------------ 468| 0| call_free_func(free_func, ret->data[j]); 469| 0| } 470| 0| } 471| 0| OPENSSL_sk_free(ret); 472| 0| return NULL; 473| 0| } 474| 72.7k| } 475| | 476| 72.7k| return ret; 477| 72.7k|} CRYPTO_MUTEX_init: 26| 153k|void CRYPTO_MUTEX_init(CRYPTO_MUTEX *lock) { 27| 153k| if (pthread_rwlock_init(lock, NULL) != 0) { ------------------ | Branch (27:7): [True: 0, False: 153k] ------------------ 28| 0| abort(); 29| 0| } 30| 153k|} CRYPTO_MUTEX_lock_read: 32| 37.4k|void CRYPTO_MUTEX_lock_read(CRYPTO_MUTEX *lock) { 33| 37.4k| if (pthread_rwlock_rdlock(lock) != 0) { ------------------ | Branch (33:7): [True: 0, False: 37.4k] ------------------ 34| 0| abort(); 35| 0| } 36| 37.4k|} CRYPTO_MUTEX_lock_write: 38| 75.0k|void CRYPTO_MUTEX_lock_write(CRYPTO_MUTEX *lock) { 39| 75.0k| if (pthread_rwlock_wrlock(lock) != 0) { ------------------ | Branch (39:7): [True: 0, False: 75.0k] ------------------ 40| 0| abort(); 41| 0| } 42| 75.0k|} CRYPTO_MUTEX_unlock_read: 44| 37.4k|void CRYPTO_MUTEX_unlock_read(CRYPTO_MUTEX *lock) { 45| 37.4k| if (pthread_rwlock_unlock(lock) != 0) { ------------------ | Branch (45:7): [True: 0, False: 37.4k] ------------------ 46| 0| abort(); 47| 0| } 48| 37.4k|} CRYPTO_MUTEX_unlock_write: 50| 75.0k|void CRYPTO_MUTEX_unlock_write(CRYPTO_MUTEX *lock) { 51| 75.0k| if (pthread_rwlock_unlock(lock) != 0) { ------------------ | Branch (51:7): [True: 0, False: 75.0k] ------------------ 52| 0| abort(); 53| 0| } 54| 75.0k|} CRYPTO_MUTEX_cleanup: 56| 153k|void CRYPTO_MUTEX_cleanup(CRYPTO_MUTEX *lock) { pthread_rwlock_destroy(lock); } CRYPTO_once: 58| 26.8M|void CRYPTO_once(CRYPTO_once_t *once, void (*init)(void)) { 59| 26.8M| if (pthread_once(once, init) != 0) { ------------------ | Branch (59:7): [True: 0, False: 26.8M] ------------------ 60| 0| abort(); 61| 0| } 62| 26.8M|} CRYPTO_get_thread_local: 101| 785k|void *CRYPTO_get_thread_local(thread_local_data_t index) { 102| 785k| CRYPTO_once(&g_thread_local_init_once, thread_local_init); 103| 785k| if (!g_thread_local_key_created) { ------------------ | Branch (103:7): [True: 0, False: 785k] ------------------ 104| 0| return NULL; 105| 0| } 106| | 107| 785k| void **pointers = 108| 785k| reinterpret_cast(pthread_getspecific(g_thread_local_key)); 109| 785k| if (pointers == NULL) { ------------------ | Branch (109:7): [True: 2, False: 785k] ------------------ 110| 2| return NULL; 111| 2| } 112| 785k| return pointers[index]; 113| 785k|} CRYPTO_set_thread_local: 116| 3| thread_local_destructor_t destructor) { 117| 3| CRYPTO_once(&g_thread_local_init_once, thread_local_init); 118| 3| if (!g_thread_local_key_created) { ------------------ | Branch (118:7): [True: 0, False: 3] ------------------ 119| 0| destructor(value); 120| 0| return 0; 121| 0| } 122| | 123| 3| void **pointers = 124| 3| reinterpret_cast(pthread_getspecific(g_thread_local_key)); 125| 3| if (pointers == NULL) { ------------------ | Branch (125:7): [True: 2, False: 1] ------------------ 126| 2| pointers = reinterpret_cast( 127| 2| malloc(sizeof(void *) * NUM_OPENSSL_THREAD_LOCALS)); 128| 2| if (pointers == NULL) { ------------------ | Branch (128:9): [True: 0, False: 2] ------------------ 129| 0| destructor(value); 130| 0| return 0; 131| 0| } 132| 2| OPENSSL_memset(pointers, 0, sizeof(void *) * NUM_OPENSSL_THREAD_LOCALS); 133| 2| if (pthread_setspecific(g_thread_local_key, pointers) != 0) { ------------------ | Branch (133:9): [True: 0, False: 2] ------------------ 134| 0| free(pointers); 135| 0| destructor(value); 136| 0| return 0; 137| 0| } 138| 2| } 139| | 140| 3| if (pthread_mutex_lock(&g_destructors_lock) != 0) { ------------------ | Branch (140:7): [True: 0, False: 3] ------------------ 141| 0| destructor(value); 142| 0| return 0; 143| 0| } 144| 3| g_destructors[index] = destructor; 145| 3| pthread_mutex_unlock(&g_destructors_lock); 146| | 147| 3| pointers[index] = value; 148| 3| return 1; 149| 3|} thread_pthread.cc:_ZL17thread_local_initv: 96| 2|static void thread_local_init(void) { 97| 2| g_thread_local_key_created = 98| 2| pthread_key_create(&g_thread_local_key, thread_local_destructor) == 0; 99| 2|} X509_chain_up_ref: 229| 52.8k|STACK_OF(X509) *X509_chain_up_ref(STACK_OF(X509) *chain) { 230| 52.8k| STACK_OF(X509) *ret = sk_X509_dup(chain); ------------------ | | 39| 52.8k|#define STACK_OF(type) struct stack_st_##type ------------------ 231| 52.8k| if (ret == NULL) { ------------------ | Branch (231:7): [True: 0, False: 52.8k] ------------------ 232| 0| return NULL; 233| 0| } 234| 105k| for (size_t i = 0; i < sk_X509_num(ret); i++) { ------------------ | Branch (234:22): [True: 52.8k, False: 52.8k] ------------------ 235| 52.8k| X509_up_ref(sk_X509_value(ret, i)); 236| 52.8k| } 237| 52.8k| return ret; 238| 52.8k|} X509_STORE_new: 110| 2|X509_STORE *X509_STORE_new(void) { 111| 2| X509_STORE *ret = 112| 2| reinterpret_cast(OPENSSL_zalloc(sizeof(X509_STORE))); 113| 2| if (ret == NULL) { ------------------ | Branch (113:7): [True: 0, False: 2] ------------------ 114| 0| return NULL; 115| 0| } 116| | 117| 2| ret->references = 1; 118| 2| CRYPTO_MUTEX_init(&ret->objs_lock); 119| 2| ret->objs = sk_X509_OBJECT_new(x509_object_cmp_sk); 120| 2| ret->get_cert_methods = sk_X509_LOOKUP_new_null(); 121| 2| ret->param = X509_VERIFY_PARAM_new(); 122| 2| if (ret->objs == NULL || ret->get_cert_methods == NULL || ------------------ | Branch (122:7): [True: 0, False: 2] | Branch (122:28): [True: 0, False: 2] ------------------ 123| 2| ret->param == NULL) { ------------------ | Branch (123:7): [True: 0, False: 2] ------------------ 124| 0| X509_STORE_free(ret); 125| 0| return NULL; 126| 0| } 127| | 128| 2| return ret; 129| 2|} X509_STORE_free: 136| 19.9k|void X509_STORE_free(X509_STORE *vfy) { 137| 19.9k| if (vfy == nullptr || !CRYPTO_refcount_dec_and_test_zero(&vfy->references)) { ------------------ | Branch (137:7): [True: 19.9k, False: 0] | Branch (137:25): [True: 0, False: 0] ------------------ 138| 19.9k| return; 139| 19.9k| } 140| | 141| 0| CRYPTO_MUTEX_cleanup(&vfy->objs_lock); 142| 0| sk_X509_LOOKUP_pop_free(vfy->get_cert_methods, X509_LOOKUP_free); 143| 0| sk_X509_OBJECT_pop_free(vfy->objs, X509_OBJECT_free); 144| 0| X509_VERIFY_PARAM_free(vfy->param); 145| 0| OPENSSL_free(vfy); 146| 0|} X509_STORE_CTX_set_ex_data: 1384| 2.99k|int X509_STORE_CTX_set_ex_data(X509_STORE_CTX *ctx, int idx, void *data) { 1385| 2.99k| return CRYPTO_set_ex_data(&ctx->ex_data, idx, data); 1386| 2.99k|} X509_STORE_CTX_get_error: 1392| 2.99k|int X509_STORE_CTX_get_error(const X509_STORE_CTX *ctx) { return ctx->error; } X509_STORE_CTX_new: 1484| 2.99k|X509_STORE_CTX *X509_STORE_CTX_new(void) { 1485| 2.99k| return reinterpret_cast( 1486| 2.99k| OPENSSL_zalloc(sizeof(X509_STORE_CTX))); 1487| 2.99k|} X509_STORE_CTX_free: 1489| 2.99k|void X509_STORE_CTX_free(X509_STORE_CTX *ctx) { 1490| 2.99k| if (ctx == NULL) { ------------------ | Branch (1490:7): [True: 0, False: 2.99k] ------------------ 1491| 0| return; 1492| 0| } 1493| 2.99k| X509_STORE_CTX_cleanup(ctx); 1494| 2.99k| OPENSSL_free(ctx); 1495| 2.99k|} X509_STORE_CTX_init: 1498| 2.99k| STACK_OF(X509) *chain) { 1499| 2.99k| X509_STORE_CTX_cleanup(ctx); 1500| | 1501| 2.99k| ctx->ctx = store; 1502| 2.99k| ctx->cert = x509; 1503| 2.99k| ctx->untrusted = chain; 1504| | 1505| 2.99k| CRYPTO_new_ex_data(&ctx->ex_data); 1506| | 1507| 2.99k| if (store == NULL) { ------------------ | Branch (1507:7): [True: 0, False: 2.99k] ------------------ 1508| 0| OPENSSL_PUT_ERROR(X509, ERR_R_PASSED_NULL_PARAMETER); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1509| 0| goto err; 1510| 0| } 1511| | 1512| 2.99k| ctx->param = X509_VERIFY_PARAM_new(); 1513| 2.99k| if (!ctx->param) { ------------------ | Branch (1513:7): [True: 0, False: 2.99k] ------------------ 1514| 0| goto err; 1515| 0| } 1516| | 1517| | // Inherit callbacks and flags from X509_STORE. 1518| | 1519| 2.99k| ctx->verify_cb = store->verify_cb; 1520| | 1521| 2.99k| if (!X509_VERIFY_PARAM_inherit(ctx->param, store->param) || ------------------ | Branch (1521:7): [True: 0, False: 2.99k] ------------------ 1522| 2.99k| !X509_VERIFY_PARAM_inherit(ctx->param, ------------------ | Branch (1522:7): [True: 0, False: 2.99k] ------------------ 1523| 2.99k| X509_VERIFY_PARAM_lookup("default"))) { 1524| 0| goto err; 1525| 0| } 1526| | 1527| 2.99k| if (store->verify_cb) { ------------------ | Branch (1527:7): [True: 0, False: 2.99k] ------------------ 1528| 0| ctx->verify_cb = store->verify_cb; 1529| 2.99k| } else { 1530| 2.99k| ctx->verify_cb = null_callback; 1531| 2.99k| } 1532| | 1533| 2.99k| return 1; 1534| | 1535| 0|err: 1536| 0| X509_STORE_CTX_cleanup(ctx); 1537| 0| return 0; 1538| 2.99k|} X509_STORE_CTX_cleanup: 1552| 5.99k|void X509_STORE_CTX_cleanup(X509_STORE_CTX *ctx) { 1553| 5.99k| CRYPTO_free_ex_data(&g_ex_data_class, &ctx->ex_data); 1554| 5.99k| X509_VERIFY_PARAM_free(ctx->param); 1555| 5.99k| sk_X509_pop_free(ctx->chain, X509_free); 1556| 5.99k| OPENSSL_memset(ctx, 0, sizeof(X509_STORE_CTX)); 1557| 5.99k|} X509_STORE_CTX_set_default: 1584| 2.99k|int X509_STORE_CTX_set_default(X509_STORE_CTX *ctx, const char *name) { 1585| 2.99k| const X509_VERIFY_PARAM *param = X509_VERIFY_PARAM_lookup(name); 1586| 2.99k| if (!param) { ------------------ | Branch (1586:7): [True: 0, False: 2.99k] ------------------ 1587| 0| return 0; 1588| 0| } 1589| 2.99k| return X509_VERIFY_PARAM_inherit(ctx->param, param); 1590| 2.99k|} X509_STORE_CTX_get0_param: 1592| 2.99k|X509_VERIFY_PARAM *X509_STORE_CTX_get0_param(X509_STORE_CTX *ctx) { 1593| 2.99k| return ctx->param; 1594| 2.99k|} X509_VERIFY_PARAM_new: 76| 22.9k|X509_VERIFY_PARAM *X509_VERIFY_PARAM_new(void) { 77| 22.9k| X509_VERIFY_PARAM *param = reinterpret_cast( 78| 22.9k| OPENSSL_zalloc(sizeof(X509_VERIFY_PARAM))); 79| 22.9k| if (!param) { ------------------ | Branch (79:7): [True: 0, False: 22.9k] ------------------ 80| 0| return NULL; 81| 0| } 82| 22.9k| param->depth = -1; 83| 22.9k| return param; 84| 22.9k|} X509_VERIFY_PARAM_free: 86| 25.8k|void X509_VERIFY_PARAM_free(X509_VERIFY_PARAM *param) { 87| 25.8k| if (param == NULL) { ------------------ | Branch (87:7): [True: 2.99k, False: 22.8k] ------------------ 88| 2.99k| return; 89| 2.99k| } 90| 22.8k| sk_ASN1_OBJECT_pop_free(param->policies, ASN1_OBJECT_free); 91| 22.8k| sk_OPENSSL_STRING_pop_free(param->hosts, str_free); 92| 22.8k| OPENSSL_free(param->email); 93| 22.8k| OPENSSL_free(param->ip); 94| 22.8k| OPENSSL_free(param); 95| 22.8k|} X509_VERIFY_PARAM_inherit: 178| 28.8k| const X509_VERIFY_PARAM *src) { 179| | // Prefer the destination. That is, this function only changes unset 180| | // parameters in |dest|. 181| 28.8k| return x509_verify_param_copy(dest, src, /*prefer_src=*/0); 182| 28.8k|} X509_VERIFY_PARAM_set1: 185| 2.99k| const X509_VERIFY_PARAM *from) { 186| | // Prefer the source. That is, values in |to| are only preserved if they were 187| | // unset in |from|. 188| 2.99k| return x509_verify_param_copy(to, from, /*prefer_src=*/1); 189| 2.99k|} X509_VERIFY_PARAM_lookup: 422| 5.99k|const X509_VERIFY_PARAM *X509_VERIFY_PARAM_lookup(const char *name) { 423| 5.99k| if (strcmp(name, "default") == 0) { ------------------ | Branch (423:7): [True: 2.99k, False: 2.99k] ------------------ 424| 2.99k| return &kDefaultParam; 425| 2.99k| } 426| 2.99k| if (strcmp(name, "pkcs7") == 0) { ------------------ | Branch (426:7): [True: 0, False: 2.99k] ------------------ 427| | // PKCS#7 and S/MIME signing use the same defaults. 428| 0| return &kSMIMESignParam; 429| 0| } 430| 2.99k| if (strcmp(name, "smime_sign") == 0) { ------------------ | Branch (430:7): [True: 0, False: 2.99k] ------------------ 431| 0| return &kSMIMESignParam; 432| 0| } 433| 2.99k| if (strcmp(name, "ssl_client") == 0) { ------------------ | Branch (433:7): [True: 0, False: 2.99k] ------------------ 434| 0| return &kSSLClientParam; 435| 0| } 436| 2.99k| if (strcmp(name, "ssl_server") == 0) { ------------------ | Branch (436:7): [True: 2.99k, False: 0] ------------------ 437| 2.99k| return &kSSLServerParam; 438| 2.99k| } 439| 0| return NULL; 440| 2.99k|} x509_vpm.cc:_ZL22x509_verify_param_copyP20X509_VERIFY_PARAM_stPKS_i: 119| 31.8k| int prefer_src) { 120| 31.8k| if (src == NULL) { ------------------ | Branch (120:7): [True: 0, False: 31.8k] ------------------ 121| 0| return 1; 122| 0| } 123| | 124| 31.8k| copy_int_param(&dest->purpose, &src->purpose, /*default_val=*/0, prefer_src); 125| 31.8k| copy_int_param(&dest->trust, &src->trust, /*default_val=*/0, prefer_src); 126| 31.8k| copy_int_param(&dest->depth, &src->depth, /*default_val=*/-1, prefer_src); 127| | 128| | // |check_time|, unlike all other parameters, does not honor |prefer_src|. 129| | // This means |X509_VERIFY_PARAM_set1| will not overwrite it. This behavior 130| | // comes from OpenSSL but may have been a bug. 131| 31.8k| if (!(dest->flags & X509_V_FLAG_USE_CHECK_TIME)) { ------------------ | | 3276| 31.8k|#define X509_V_FLAG_USE_CHECK_TIME 0x2 ------------------ | Branch (131:7): [True: 31.8k, False: 0] ------------------ 132| 31.8k| dest->check_time = src->check_time; 133| | // The source |X509_V_FLAG_USE_CHECK_TIME| flag, if set, is copied below. 134| 31.8k| } 135| | 136| 31.8k| dest->flags |= src->flags; 137| | 138| 31.8k| if (should_copy(dest->policies != NULL, src->policies != NULL, prefer_src)) { ------------------ | Branch (138:7): [True: 0, False: 31.8k] ------------------ 139| 0| if (!X509_VERIFY_PARAM_set1_policies(dest, src->policies)) { ------------------ | Branch (139:9): [True: 0, False: 0] ------------------ 140| 0| return 0; 141| 0| } 142| 0| } 143| | 144| 31.8k| if (should_copy(dest->hosts != NULL, src->hosts != NULL, prefer_src)) { ------------------ | Branch (144:7): [True: 0, False: 31.8k] ------------------ 145| 0| sk_OPENSSL_STRING_pop_free(dest->hosts, str_free); 146| 0| dest->hosts = NULL; 147| 0| if (src->hosts) { ------------------ | Branch (147:9): [True: 0, False: 0] ------------------ 148| 0| dest->hosts = 149| 0| sk_OPENSSL_STRING_deep_copy(src->hosts, OPENSSL_strdup, str_free); 150| 0| if (dest->hosts == NULL) { ------------------ | Branch (150:11): [True: 0, False: 0] ------------------ 151| 0| return 0; 152| 0| } 153| | // Copy the host flags if and only if we're copying the host list. Note 154| | // this means mechanisms like |X509_STORE_CTX_set_default| cannot be used 155| | // to set host flags. E.g. we cannot change the defaults using 156| | // |kDefaultParam| below. 157| 0| dest->hostflags = src->hostflags; 158| 0| } 159| 0| } 160| | 161| 31.8k| if (should_copy(dest->email != NULL, src->email != NULL, prefer_src)) { ------------------ | Branch (161:7): [True: 0, False: 31.8k] ------------------ 162| 0| if (!X509_VERIFY_PARAM_set1_email(dest, src->email, src->emaillen)) { ------------------ | Branch (162:9): [True: 0, False: 0] ------------------ 163| 0| return 0; 164| 0| } 165| 0| } 166| | 167| 31.8k| if (should_copy(dest->ip != NULL, src->ip != NULL, prefer_src)) { ------------------ | Branch (167:7): [True: 0, False: 31.8k] ------------------ 168| 0| if (!X509_VERIFY_PARAM_set1_ip(dest, src->ip, src->iplen)) { ------------------ | Branch (168:9): [True: 0, False: 0] ------------------ 169| 0| return 0; 170| 0| } 171| 0| } 172| | 173| 31.8k| dest->poison = src->poison; 174| 31.8k| return 1; 175| 31.8k|} x509_vpm.cc:_ZL14copy_int_paramPiPKiii: 108| 95.6k| int prefer_src) { 109| 95.6k| if (should_copy(*dest != default_val, *src != default_val, prefer_src)) { ------------------ | Branch (109:7): [True: 8.98k, False: 86.6k] ------------------ 110| 8.98k| *dest = *src; 111| 8.98k| } 112| 95.6k|} x509_vpm.cc:_ZL11should_copyiii: 97| 223k|static int should_copy(int dest_is_set, int src_is_set, int prefer_src) { 98| 223k| if (prefer_src) { ------------------ | Branch (98:7): [True: 20.9k, False: 202k] ------------------ 99| | // We prefer the source, so as long as there is a value to copy, copy it. 100| 20.9k| return src_is_set; 101| 20.9k| } 102| | 103| | // We prefer the destination, so only copy if the destination is unset. 104| 202k| return src_is_set && !dest_is_set; ------------------ | Branch (104:10): [True: 8.98k, False: 193k] | Branch (104:24): [True: 8.98k, False: 0] ------------------ 105| 223k|} x509_marshal_algorithm: 110| 2|int x509_marshal_algorithm(CBB *out, const X509_ALGOR *in) { 111| 2| uint8_t *ptr; 112| 2| int len = i2d_X509_ALGOR(in, NULL); 113| 2| return len > 0 && // ------------------ | Branch (113:10): [True: 2, False: 0] ------------------ 114| 2| CBB_add_space(out, &ptr, static_cast(len)) && ------------------ | Branch (114:10): [True: 2, False: 0] ------------------ 115| 2| i2d_X509_ALGOR(in, &ptr) == len; ------------------ | Branch (115:10): [True: 2, False: 0] ------------------ 116| 2|} x_name.cc:_ZL16x509_name_ex_newPP13ASN1_VALUE_stPK12ASN1_ITEM_st: 94| 279k|static int x509_name_ex_new(ASN1_VALUE **val, const ASN1_ITEM *it) { 95| 279k| X509_NAME *ret = NULL; 96| 279k| ret = reinterpret_cast(OPENSSL_malloc(sizeof(X509_NAME))); 97| 279k| if (!ret) { ------------------ | Branch (97:7): [True: 0, False: 279k] ------------------ 98| 0| goto memerr; 99| 0| } 100| 279k| if ((ret->entries = sk_X509_NAME_ENTRY_new_null()) == NULL) { ------------------ | Branch (100:7): [True: 0, False: 279k] ------------------ 101| 0| goto memerr; 102| 0| } 103| 279k| if ((ret->bytes = BUF_MEM_new()) == NULL) { ------------------ | Branch (103:7): [True: 0, False: 279k] ------------------ 104| 0| goto memerr; 105| 0| } 106| 279k| ret->canon_enc = NULL; 107| 279k| ret->canon_enclen = 0; 108| 279k| ret->modified = 1; 109| 279k| *val = (ASN1_VALUE *)ret; 110| 279k| return 1; 111| | 112| 0|memerr: 113| 0| if (ret) { ------------------ | Branch (113:7): [True: 0, False: 0] ------------------ 114| 0| if (ret->entries) { ------------------ | Branch (114:9): [True: 0, False: 0] ------------------ 115| 0| sk_X509_NAME_ENTRY_free(ret->entries); 116| 0| } 117| 0| OPENSSL_free(ret); 118| 0| } 119| 0| return 0; 120| 279k|} x_name.cc:_ZL17x509_name_ex_freePP13ASN1_VALUE_stPK12ASN1_ITEM_st: 122| 279k|static void x509_name_ex_free(ASN1_VALUE **pval, const ASN1_ITEM *it) { 123| 279k| X509_NAME *a; 124| 279k| if (!pval || !*pval) { ------------------ | Branch (124:7): [True: 0, False: 279k] | Branch (124:16): [True: 0, False: 279k] ------------------ 125| 0| return; 126| 0| } 127| 279k| a = (X509_NAME *)*pval; 128| | 129| 279k| BUF_MEM_free(a->bytes); 130| 279k| sk_X509_NAME_ENTRY_pop_free(a->entries, X509_NAME_ENTRY_free); 131| 279k| if (a->canon_enc) { ------------------ | Branch (131:7): [True: 139k, False: 140k] ------------------ 132| 139k| OPENSSL_free(a->canon_enc); 133| 139k| } 134| 279k| OPENSSL_free(a); 135| 279k| *pval = NULL; 136| 279k|} x_name.cc:_ZL16x509_name_ex_d2iPP13ASN1_VALUE_stPPKhlPK12ASN1_ITEM_stiP11ASN1_TLC_st: 148| 139k| ASN1_TLC *ctx) { 149| 139k| const unsigned char *p = *in, *q; 150| 139k| STACK_OF(STACK_OF_X509_NAME_ENTRY) *intname = NULL; ------------------ | | 39| 139k|#define STACK_OF(type) struct stack_st_##type ------------------ 151| 139k| X509_NAME *nm = NULL; 152| 139k| size_t i, j; 153| 139k| int ret; 154| 139k| STACK_OF(X509_NAME_ENTRY) *entries; ------------------ | | 39| 139k|#define STACK_OF(type) struct stack_st_##type ------------------ 155| 139k| X509_NAME_ENTRY *entry; 156| | // Bound the size of an X509_NAME we are willing to parse. 157| 139k| if (len > X509_NAME_MAX) { ------------------ | | 39| 139k|#define X509_NAME_MAX (1024 * 1024) ------------------ | Branch (157:7): [True: 0, False: 139k] ------------------ 158| 0| len = X509_NAME_MAX; ------------------ | | 39| 0|#define X509_NAME_MAX (1024 * 1024) ------------------ 159| 0| } 160| 139k| q = p; 161| | 162| | // Get internal representation of Name 163| 139k| ASN1_VALUE *intname_val = NULL; 164| 139k| ret = ASN1_item_ex_d2i(&intname_val, &p, len, 165| 139k| ASN1_ITEM_rptr(X509_NAME_INTERNAL), /*tag=*/-1, ------------------ | | 227| 139k|#define ASN1_ITEM_rptr(name) (&(name##_it)) ------------------ 166| 139k| /*aclass=*/0, opt, /*buf=*/NULL); 167| 139k| if (ret <= 0) { ------------------ | Branch (167:7): [True: 200, False: 139k] ------------------ 168| 200| return ret; 169| 200| } 170| 139k| intname = (STACK_OF(STACK_OF_X509_NAME_ENTRY) *)intname_val; 171| | 172| 139k| if (*val) { ------------------ | Branch (172:7): [True: 139k, False: 22] ------------------ 173| 139k| x509_name_ex_free(val, NULL); 174| 139k| } 175| 139k| ASN1_VALUE *nm_val = NULL; 176| 139k| if (!x509_name_ex_new(&nm_val, NULL)) { ------------------ | Branch (176:7): [True: 0, False: 139k] ------------------ 177| 0| goto err; 178| 0| } 179| 139k| nm = (X509_NAME *)nm_val; 180| | // We've decoded it: now cache encoding 181| 139k| if (!BUF_MEM_grow(nm->bytes, p - q)) { ------------------ | Branch (181:7): [True: 0, False: 139k] ------------------ 182| 0| goto err; 183| 0| } 184| 139k| OPENSSL_memcpy(nm->bytes->data, q, p - q); 185| | 186| | // Convert internal representation to X509_NAME structure 187| 482k| for (i = 0; i < sk_STACK_OF_X509_NAME_ENTRY_num(intname); i++) { ------------------ | Branch (187:15): [True: 343k, False: 139k] ------------------ 188| 343k| entries = sk_STACK_OF_X509_NAME_ENTRY_value(intname, i); 189| 688k| for (j = 0; j < sk_X509_NAME_ENTRY_num(entries); j++) { ------------------ | Branch (189:17): [True: 344k, False: 343k] ------------------ 190| 344k| entry = sk_X509_NAME_ENTRY_value(entries, j); 191| 344k| entry->set = (int)i; 192| 344k| if (!sk_X509_NAME_ENTRY_push(nm->entries, entry)) { ------------------ | Branch (192:11): [True: 0, False: 344k] ------------------ 193| 0| goto err; 194| 0| } 195| 344k| (void)sk_X509_NAME_ENTRY_set(entries, j, NULL); 196| 344k| } 197| 343k| } 198| 139k| ret = x509_name_canon(nm); 199| 139k| if (!ret) { ------------------ | Branch (199:7): [True: 5, False: 139k] ------------------ 200| 5| goto err; 201| 5| } 202| 139k| sk_STACK_OF_X509_NAME_ENTRY_pop_free(intname, local_sk_X509_NAME_ENTRY_free); 203| 139k| nm->modified = 0; 204| 139k| *val = (ASN1_VALUE *)nm; 205| 139k| *in = p; 206| 139k| return ret; 207| 5|err: 208| 5| X509_NAME_free(nm); 209| 5| sk_STACK_OF_X509_NAME_ENTRY_pop_free(intname, 210| 5| local_sk_X509_NAME_ENTRY_pop_free); 211| 5| OPENSSL_PUT_ERROR(X509, ERR_R_ASN1_LIB); ------------------ | | 361| 5| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 212| 5| return 0; 213| 139k|} x_name.cc:_ZL15x509_name_canonP12X509_name_st: 295| 139k|static int x509_name_canon(X509_NAME *a) { 296| 139k| unsigned char *p; 297| 139k| STACK_OF(STACK_OF_X509_NAME_ENTRY) *intname = NULL; ------------------ | | 39| 139k|#define STACK_OF(type) struct stack_st_##type ------------------ 298| 139k| STACK_OF(X509_NAME_ENTRY) *entries = NULL; ------------------ | | 39| 139k|#define STACK_OF(type) struct stack_st_##type ------------------ 299| 139k| X509_NAME_ENTRY *entry, *tmpentry = NULL; 300| 139k| int set = -1, ret = 0, len; 301| 139k| size_t i; 302| | 303| 139k| if (a->canon_enc) { ------------------ | Branch (303:7): [True: 0, False: 139k] ------------------ 304| 0| OPENSSL_free(a->canon_enc); 305| 0| a->canon_enc = NULL; 306| 0| } 307| | // Special case: empty X509_NAME => null encoding 308| 139k| if (sk_X509_NAME_ENTRY_num(a->entries) == 0) { ------------------ | Branch (308:7): [True: 14, False: 139k] ------------------ 309| 14| a->canon_enclen = 0; 310| 14| return 1; 311| 14| } 312| 139k| intname = sk_STACK_OF_X509_NAME_ENTRY_new_null(); 313| 139k| if (!intname) { ------------------ | Branch (313:7): [True: 0, False: 139k] ------------------ 314| 0| goto err; 315| 0| } 316| 484k| for (i = 0; i < sk_X509_NAME_ENTRY_num(a->entries); i++) { ------------------ | Branch (316:15): [True: 344k, False: 139k] ------------------ 317| 344k| entry = sk_X509_NAME_ENTRY_value(a->entries, i); 318| 344k| if (entry->set != set) { ------------------ | Branch (318:9): [True: 343k, False: 1.53k] ------------------ 319| 343k| entries = sk_X509_NAME_ENTRY_new_null(); 320| 343k| if (!entries) { ------------------ | Branch (320:11): [True: 0, False: 343k] ------------------ 321| 0| goto err; 322| 0| } 323| 343k| if (!sk_STACK_OF_X509_NAME_ENTRY_push(intname, entries)) { ------------------ | Branch (323:11): [True: 0, False: 343k] ------------------ 324| 0| sk_X509_NAME_ENTRY_free(entries); 325| 0| goto err; 326| 0| } 327| 343k| set = entry->set; 328| 343k| } 329| 344k| tmpentry = X509_NAME_ENTRY_new(); 330| 344k| if (tmpentry == NULL) { ------------------ | Branch (330:9): [True: 0, False: 344k] ------------------ 331| 0| goto err; 332| 0| } 333| 344k| tmpentry->object = OBJ_dup(entry->object); 334| 344k| if (!asn1_string_canon(tmpentry->value, entry->value)) { ------------------ | Branch (334:9): [True: 5, False: 344k] ------------------ 335| 5| goto err; 336| 5| } 337| 344k| if (!sk_X509_NAME_ENTRY_push(entries, tmpentry)) { ------------------ | Branch (337:9): [True: 0, False: 344k] ------------------ 338| 0| goto err; 339| 0| } 340| 344k| tmpentry = NULL; 341| 344k| } 342| | 343| | // Finally generate encoding 344| | 345| 139k| len = i2d_name_canon(intname, NULL); 346| 139k| if (len < 0) { ------------------ | Branch (346:7): [True: 0, False: 139k] ------------------ 347| 0| goto err; 348| 0| } 349| 139k| a->canon_enclen = len; 350| | 351| 139k| p = reinterpret_cast(OPENSSL_malloc(a->canon_enclen)); 352| | 353| 139k| if (!p) { ------------------ | Branch (353:7): [True: 0, False: 139k] ------------------ 354| 0| goto err; 355| 0| } 356| | 357| 139k| a->canon_enc = p; 358| | 359| 139k| i2d_name_canon(intname, &p); 360| | 361| 139k| ret = 1; 362| | 363| 139k|err: 364| | 365| 139k| if (tmpentry) { ------------------ | Branch (365:7): [True: 5, False: 139k] ------------------ 366| 5| X509_NAME_ENTRY_free(tmpentry); 367| 5| } 368| 139k| if (intname) { ------------------ | Branch (368:7): [True: 139k, False: 0] ------------------ 369| 139k| sk_STACK_OF_X509_NAME_ENTRY_pop_free(intname, 370| 139k| local_sk_X509_NAME_ENTRY_pop_free); 371| 139k| } 372| 139k| return ret; 373| 139k|} x_name.cc:_ZL17asn1_string_canonP14asn1_string_stS0_: 382| 344k|static int asn1_string_canon(ASN1_STRING *out, ASN1_STRING *in) { 383| 344k| unsigned char *to, *from; 384| 344k| int len, i; 385| | 386| | // If type not in bitmask just copy string across 387| 344k| if (!(ASN1_tag2bit(in->type) & ASN1_MASK_CANON)) { ------------------ | | 378| 344k| (B_ASN1_UTF8STRING | B_ASN1_BMPSTRING | B_ASN1_UNIVERSALSTRING | \ | | ------------------ | | | | 135| 344k|#define B_ASN1_UTF8STRING 0x2000 | | ------------------ | | (B_ASN1_UTF8STRING | B_ASN1_BMPSTRING | B_ASN1_UNIVERSALSTRING | \ | | ------------------ | | | | 134| 344k|#define B_ASN1_BMPSTRING 0x0800 | | ------------------ | | (B_ASN1_UTF8STRING | B_ASN1_BMPSTRING | B_ASN1_UNIVERSALSTRING | \ | | ------------------ | | | | 131| 344k|#define B_ASN1_UNIVERSALSTRING 0x0100 | | ------------------ | | 379| 344k| B_ASN1_PRINTABLESTRING | B_ASN1_T61STRING | B_ASN1_IA5STRING | \ | | ------------------ | | | | 122| 344k|#define B_ASN1_PRINTABLESTRING 0x0002 | | ------------------ | | B_ASN1_PRINTABLESTRING | B_ASN1_T61STRING | B_ASN1_IA5STRING | \ | | ------------------ | | | | 123| 344k|#define B_ASN1_T61STRING 0x0004 | | ------------------ | | B_ASN1_PRINTABLESTRING | B_ASN1_T61STRING | B_ASN1_IA5STRING | \ | | ------------------ | | | | 126| 344k|#define B_ASN1_IA5STRING 0x0010 | | ------------------ | | 380| 344k| B_ASN1_VISIBLESTRING) | | ------------------ | | | | 129| 344k|#define B_ASN1_VISIBLESTRING 0x0040 | | ------------------ ------------------ | Branch (387:7): [True: 18.5k, False: 326k] ------------------ 388| 18.5k| if (!ASN1_STRING_copy(out, in)) { ------------------ | Branch (388:9): [True: 0, False: 18.5k] ------------------ 389| 0| return 0; 390| 0| } 391| 18.5k| return 1; 392| 18.5k| } 393| | 394| 326k| out->type = V_ASN1_UTF8STRING; ------------------ | | 96| 326k|#define V_ASN1_UTF8STRING 12 ------------------ 395| 326k| out->length = ASN1_STRING_to_UTF8(&out->data, in); 396| 326k| if (out->length == -1) { ------------------ | Branch (396:7): [True: 5, False: 326k] ------------------ 397| 5| return 0; 398| 5| } 399| | 400| 326k| to = out->data; 401| 326k| from = to; 402| | 403| 326k| len = out->length; 404| | 405| | // Convert string in place to canonical form. 406| | 407| | // Ignore leading spaces 408| 328k| while ((len > 0) && OPENSSL_isspace(*from)) { ------------------ | Branch (408:10): [True: 328k, False: 14] | Branch (408:23): [True: 2.04k, False: 326k] ------------------ 409| 2.04k| from++; 410| 2.04k| len--; 411| 2.04k| } 412| | 413| 326k| to = from + len; 414| | 415| | // Ignore trailing spaces 416| 326k| while ((len > 0) && OPENSSL_isspace(to[-1])) { ------------------ | Branch (416:10): [True: 326k, False: 14] | Branch (416:23): [True: 478, False: 326k] ------------------ 417| 478| to--; 418| 478| len--; 419| 478| } 420| | 421| 326k| to = out->data; 422| | 423| 326k| i = 0; 424| 4.03M| while (i < len) { ------------------ | Branch (424:10): [True: 3.70M, False: 326k] ------------------ 425| | // Collapse multiple spaces 426| 3.70M| if (OPENSSL_isspace(*from)) { ------------------ | Branch (426:9): [True: 304k, False: 3.40M] ------------------ 427| | // Copy one space across 428| 304k| *to++ = ' '; 429| | // Ignore subsequent spaces. Note: don't need to check len here 430| | // because we know the last character is a non-space so we can't 431| | // overflow. 432| 304k| do { 433| 304k| from++; 434| 304k| i++; 435| 304k| } while (OPENSSL_isspace(*from)); ------------------ | Branch (435:16): [True: 550, False: 304k] ------------------ 436| 3.40M| } else { 437| 3.40M| *to++ = OPENSSL_tolower(*from); 438| 3.40M| from++; 439| 3.40M| i++; 440| 3.40M| } 441| 3.70M| } 442| | 443| 326k| out->length = to - out->data; 444| | 445| 326k| return 1; 446| 326k|} x_name.cc:_ZL14i2d_name_canonP33stack_st_STACK_OF_X509_NAME_ENTRYPPh: 449| 278k| unsigned char **in) { 450| 278k| int len, ltmp; 451| 278k| size_t i; 452| 278k| ASN1_VALUE *v; 453| 278k| STACK_OF(ASN1_VALUE) *intname = (STACK_OF(ASN1_VALUE) *)_intname; ------------------ | | 39| 278k|#define STACK_OF(type) struct stack_st_##type ------------------ 454| | 455| 278k| len = 0; 456| 964k| for (i = 0; i < sk_ASN1_VALUE_num(intname); i++) { ------------------ | Branch (456:15): [True: 686k, False: 278k] ------------------ 457| 686k| v = sk_ASN1_VALUE_value(intname, i); 458| 686k| ltmp = ASN1_item_ex_i2d(&v, in, ASN1_ITEM_rptr(X509_NAME_ENTRIES), ------------------ | | 227| 686k|#define ASN1_ITEM_rptr(name) (&(name##_it)) ------------------ 459| 686k| /*tag=*/-1, /*aclass=*/0); 460| 686k| if (ltmp < 0) { ------------------ | Branch (460:9): [True: 0, False: 686k] ------------------ 461| 0| return ltmp; 462| 0| } 463| 686k| len += ltmp; 464| 686k| } 465| 278k| return len; 466| 278k|} x_name.cc:_ZL29local_sk_X509_NAME_ENTRY_freeP24stack_st_X509_NAME_ENTRY: 138| 343k|static void local_sk_X509_NAME_ENTRY_free(STACK_OF(X509_NAME_ENTRY) *ne) { 139| 343k| sk_X509_NAME_ENTRY_free(ne); 140| 343k|} x_name.cc:_ZL33local_sk_X509_NAME_ENTRY_pop_freeP24stack_st_X509_NAME_ENTRY: 142| 343k|static void local_sk_X509_NAME_ENTRY_pop_free(STACK_OF(X509_NAME_ENTRY) *ne) { 143| 343k| sk_X509_NAME_ENTRY_pop_free(ne, X509_NAME_ENTRY_free); 144| 343k|} x_pubkey.cc:_ZL9pubkey_cbiPP13ASN1_VALUE_stPK12ASN1_ITEM_stPv: 61| 419k| void *exarg) { 62| 419k| X509_PUBKEY *pubkey = (X509_PUBKEY *)*pval; 63| 419k| if (operation == ASN1_OP_FREE_POST) { ------------------ | | 471| 419k|#define ASN1_OP_FREE_POST 3 ------------------ | Branch (63:7): [True: 70.1k, False: 349k] ------------------ 64| 70.1k| EVP_PKEY_free(pubkey->pkey); 65| 349k| } else if (operation == ASN1_OP_D2I_POST) { ------------------ | | 473| 349k|#define ASN1_OP_D2I_POST 5 ------------------ | Branch (65:14): [True: 69.3k, False: 279k] ------------------ 66| 69.3k| x509_pubkey_changed(pubkey); 67| 69.3k| } 68| 419k| return 1; 69| 419k|} x_pubkey.cc:_ZL19x509_pubkey_changedP14X509_pubkey_st: 31| 69.3k|static void x509_pubkey_changed(X509_PUBKEY *pub) { 32| 69.3k| EVP_PKEY_free(pub->pkey); 33| 69.3k| pub->pkey = NULL; 34| | 35| | // Re-encode the |X509_PUBKEY| to DER and parse it with EVP's APIs. 36| 69.3k| uint8_t *spki = NULL; 37| 69.3k| int spki_len = i2d_X509_PUBKEY(pub, &spki); 38| 69.3k| EVP_PKEY *pkey; 39| 69.3k| if (spki_len < 0) { ------------------ | Branch (39:7): [True: 0, False: 69.3k] ------------------ 40| 0| goto err; 41| 0| } 42| | 43| 69.3k| CBS cbs; 44| 69.3k| CBS_init(&cbs, spki, (size_t)spki_len); 45| 69.3k| pkey = EVP_parse_public_key(&cbs); 46| 69.3k| if (pkey == NULL || CBS_len(&cbs) != 0) { ------------------ | Branch (46:7): [True: 14.5k, False: 54.8k] | Branch (46:23): [True: 0, False: 54.8k] ------------------ 47| 14.5k| EVP_PKEY_free(pkey); 48| 14.5k| goto err; 49| 14.5k| } 50| | 51| 54.8k| pub->pkey = pkey; 52| | 53| 69.3k|err: 54| 69.3k| OPENSSL_free(spki); 55| | // If the operation failed, clear errors. An |X509_PUBKEY| whose key we cannot 56| | // parse is still a valid SPKI. It just cannot be converted to an |EVP_PKEY|. 57| 69.3k| ERR_clear_error(); 58| 69.3k|} X509_free: 83| 365k|void X509_free(X509 *x509) { 84| 365k| if (x509 == NULL || !CRYPTO_refcount_dec_and_test_zero(&x509->references)) { ------------------ | Branch (84:7): [True: 122k, False: 243k] | Branch (84:23): [True: 173k, False: 70.1k] ------------------ 85| 295k| return; 86| 295k| } 87| | 88| 70.1k| CRYPTO_free_ex_data(&g_ex_data_class, &x509->ex_data); 89| | 90| 70.1k| X509_CINF_free(x509->cert_info); 91| 70.1k| X509_ALGOR_free(x509->sig_alg); 92| 70.1k| ASN1_BIT_STRING_free(x509->signature); 93| 70.1k| ASN1_OCTET_STRING_free(x509->skid); 94| 70.1k| AUTHORITY_KEYID_free(x509->akid); 95| 70.1k| CRL_DIST_POINTS_free(x509->crldp); 96| 70.1k| GENERAL_NAMES_free(x509->altname); 97| 70.1k| NAME_CONSTRAINTS_free(x509->nc); 98| 70.1k| X509_CERT_AUX_free(x509->aux); 99| 70.1k| CRYPTO_MUTEX_cleanup(&x509->lock); 100| | 101| 70.1k| OPENSSL_free(x509); 102| 70.1k|} d2i_X509: 191| 2|X509 *d2i_X509(X509 **out, const uint8_t **inp, long len) { 192| 2| X509 *ret = NULL; 193| 2| if (len < 0) { ------------------ | Branch (193:7): [True: 0, False: 2] ------------------ 194| 0| OPENSSL_PUT_ERROR(ASN1, ASN1_R_BUFFER_TOO_SMALL); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 195| 0| goto err; 196| 0| } 197| | 198| 2| CBS cbs; 199| 2| CBS_init(&cbs, *inp, (size_t)len); 200| 2| ret = x509_parse(&cbs, NULL); 201| 2| if (ret == NULL) { ------------------ | Branch (201:7): [True: 0, False: 2] ------------------ 202| 0| goto err; 203| 0| } 204| | 205| 2| *inp = CBS_data(&cbs); 206| | 207| 2|err: 208| 2| if (out != NULL) { ------------------ | Branch (208:7): [True: 0, False: 2] ------------------ 209| 0| X509_free(*out); 210| 0| *out = ret; 211| 0| } 212| 2| return ret; 213| 2|} i2d_X509: 215| 2|int i2d_X509(X509 *x509, uint8_t **outp) { 216| 2| if (x509 == NULL) { ------------------ | Branch (216:7): [True: 0, False: 2] ------------------ 217| 0| OPENSSL_PUT_ERROR(ASN1, ASN1_R_MISSING_VALUE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 218| 0| return -1; 219| 0| } 220| | 221| 2| bssl::ScopedCBB cbb; 222| 2| CBB cert; 223| 2| if (!CBB_init(cbb.get(), 64) || // ------------------ | Branch (223:7): [True: 0, False: 2] ------------------ 224| 2| !CBB_add_asn1(cbb.get(), &cert, CBS_ASN1_SEQUENCE)) { ------------------ | | 223| 2|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED) | | ------------------ | | | | 197| 2|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | | | ------------------ | | | | | | 194| 2|#define CBS_ASN1_TAG_SHIFT 24 | | | | ------------------ | | ------------------ ------------------ | Branch (224:7): [True: 0, False: 2] ------------------ 225| 0| return -1; 226| 0| } 227| | 228| | // TODO(crbug.com/boringssl/443): When the rest of the library is decoupled 229| | // from the tasn_*.c implementation, replace this with |CBS|-based functions. 230| 2| uint8_t *out; 231| 2| int len = i2d_X509_CINF(x509->cert_info, NULL); 232| 2| if (len < 0 || // ------------------ | Branch (232:7): [True: 0, False: 2] ------------------ 233| 2| !CBB_add_space(&cert, &out, static_cast(len)) || ------------------ | Branch (233:7): [True: 0, False: 2] ------------------ 234| 2| i2d_X509_CINF(x509->cert_info, &out) != len || ------------------ | Branch (234:7): [True: 0, False: 2] ------------------ 235| 2| !x509_marshal_algorithm(&cert, x509->sig_alg) || ------------------ | Branch (235:7): [True: 0, False: 2] ------------------ 236| 2| !asn1_marshal_bit_string(&cert, x509->signature, /*tag=*/0)) { ------------------ | Branch (236:7): [True: 0, False: 2] ------------------ 237| 0| return -1; 238| 0| } 239| | 240| 2| return CBB_finish_i2d(cbb.get(), outp); 241| 2|} X509_parse_from_buffer: 304| 70.4k|X509 *X509_parse_from_buffer(CRYPTO_BUFFER *buf) { 305| 70.4k| CBS cbs; 306| 70.4k| CBS_init(&cbs, CRYPTO_BUFFER_data(buf), CRYPTO_BUFFER_len(buf)); 307| 70.4k| X509 *ret = x509_parse(&cbs, buf); 308| 70.4k| if (ret == NULL || CBS_len(&cbs) != 0) { ------------------ | Branch (308:7): [True: 1.29k, False: 69.1k] | Branch (308:22): [True: 2, False: 69.1k] ------------------ 309| 1.29k| X509_free(ret); 310| 1.29k| return NULL; 311| 1.29k| } 312| | 313| 69.1k| return ret; 314| 70.4k|} X509_up_ref: 316| 173k|int X509_up_ref(X509 *x) { 317| 173k| CRYPTO_refcount_inc(&x->references); 318| 173k| return 1; 319| 173k|} x_x509.cc:_ZL13x509_new_nullv: 52| 70.1k|static X509 *x509_new_null(void) { 53| 70.1k| X509 *ret = reinterpret_cast(OPENSSL_zalloc(sizeof(X509))); 54| 70.1k| if (ret == NULL) { ------------------ | Branch (54:7): [True: 0, False: 70.1k] ------------------ 55| 0| return NULL; 56| 0| } 57| | 58| 70.1k| ret->references = 1; 59| 70.1k| ret->ex_pathlen = -1; 60| 70.1k| CRYPTO_new_ex_data(&ret->ex_data); 61| 70.1k| CRYPTO_MUTEX_init(&ret->lock); 62| 70.1k| return ret; 63| 70.1k|} x_x509.cc:_ZL10x509_parseP6cbs_stP16crypto_buffer_st: 104| 70.4k|static X509 *x509_parse(CBS *cbs, CRYPTO_BUFFER *buf) { 105| 70.4k| CBS cert, tbs, sigalg, sig; 106| 70.4k| if (!CBS_get_asn1(cbs, &cert, CBS_ASN1_SEQUENCE) || ------------------ | | 223| 70.4k|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED) | | ------------------ | | | | 197| 70.4k|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | | | ------------------ | | | | | | 194| 70.4k|#define CBS_ASN1_TAG_SHIFT 24 | | | | ------------------ | | ------------------ ------------------ | Branch (106:7): [True: 25, False: 70.3k] ------------------ 107| | // Bound the length to comfortably fit in an int. Lengths in this 108| | // module often omit overflow checks. 109| 70.4k| CBS_len(&cert) > INT_MAX / 2 || ------------------ | Branch (109:7): [True: 0, False: 70.3k] ------------------ 110| 70.4k| !CBS_get_asn1_element(&cert, &tbs, CBS_ASN1_SEQUENCE) || ------------------ | | 223| 70.3k|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED) | | ------------------ | | | | 197| 70.3k|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | | | ------------------ | | | | | | 194| 70.3k|#define CBS_ASN1_TAG_SHIFT 24 | | | | ------------------ | | ------------------ ------------------ | Branch (110:7): [True: 18, False: 70.3k] ------------------ 111| 70.4k| !CBS_get_asn1_element(&cert, &sigalg, CBS_ASN1_SEQUENCE)) { ------------------ | | 223| 70.3k|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED) | | ------------------ | | | | 197| 70.3k|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | | | ------------------ | | | | | | 194| 70.3k|#define CBS_ASN1_TAG_SHIFT 24 | | | | ------------------ | | ------------------ ------------------ | Branch (111:7): [True: 115, False: 70.2k] ------------------ 112| 158| OPENSSL_PUT_ERROR(ASN1, ASN1_R_DECODE_ERROR); ------------------ | | 361| 158| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 113| 158| return nullptr; 114| 158| } 115| | 116| | // For just the signature field, we accept non-minimal BER lengths, though not 117| | // indefinite-length encoding. See b/18228011. 118| | // 119| | // TODO(crbug.com/boringssl/354): Switch the affected callers to convert the 120| | // certificate before parsing and then remove this workaround. 121| 70.2k| CBS_ASN1_TAG tag; 122| 70.2k| size_t header_len; 123| 70.2k| int indefinite; 124| 70.2k| if (!CBS_get_any_ber_asn1_element(&cert, &sig, &tag, &header_len, ------------------ | Branch (124:7): [True: 13, False: 70.2k] ------------------ 125| 70.2k| /*out_ber_found=*/nullptr, 126| 70.2k| &indefinite) || 127| 70.2k| tag != CBS_ASN1_BITSTRING || indefinite || // ------------------ | | 217| 140k|#define CBS_ASN1_BITSTRING 0x3u ------------------ | Branch (127:7): [True: 59, False: 70.1k] | Branch (127:36): [True: 0, False: 70.1k] ------------------ 128| 70.2k| !CBS_skip(&sig, header_len) || // ------------------ | Branch (128:7): [True: 0, False: 70.1k] ------------------ 129| 70.2k| CBS_len(&cert) != 0) { ------------------ | Branch (129:7): [True: 10, False: 70.1k] ------------------ 130| 82| OPENSSL_PUT_ERROR(ASN1, ASN1_R_DECODE_ERROR); ------------------ | | 361| 82| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 131| 82| return nullptr; 132| 82| } 133| | 134| 70.1k| bssl::UniquePtr ret(x509_new_null()); 135| 70.1k| if (ret == nullptr) { ------------------ | Branch (135:7): [True: 0, False: 70.1k] ------------------ 136| 0| return nullptr; 137| 0| } 138| | 139| | // TODO(crbug.com/boringssl/443): When the rest of the library is decoupled 140| | // from the tasn_*.c implementation, replace this with |CBS|-based 141| | // functions. 142| 70.1k| const uint8_t *inp = CBS_data(&tbs); 143| 70.1k| if (ASN1_item_ex_d2i((ASN1_VALUE **)&ret->cert_info, &inp, CBS_len(&tbs), ------------------ | Branch (143:7): [True: 993, False: 69.1k] ------------------ 144| 70.1k| ASN1_ITEM_rptr(X509_CINF), /*tag=*/-1, ------------------ | | 227| 70.1k|#define ASN1_ITEM_rptr(name) (&(name##_it)) ------------------ 145| 70.1k| /*aclass=*/0, /*opt=*/0, buf) <= 0 || 146| 70.1k| inp != CBS_data(&tbs) + CBS_len(&tbs)) { ------------------ | Branch (146:7): [True: 0, False: 69.1k] ------------------ 147| 993| return nullptr; 148| 993| } 149| | 150| 69.1k| inp = CBS_data(&sigalg); 151| 69.1k| ret->sig_alg = d2i_X509_ALGOR(nullptr, &inp, CBS_len(&sigalg)); 152| 69.1k| if (ret->sig_alg == nullptr || inp != CBS_data(&sigalg) + CBS_len(&sigalg)) { ------------------ | Branch (152:7): [True: 20, False: 69.1k] | Branch (152:34): [True: 0, False: 69.1k] ------------------ 153| 20| return nullptr; 154| 20| } 155| | 156| 69.1k| inp = CBS_data(&sig); 157| 69.1k| ret->signature = c2i_ASN1_BIT_STRING(nullptr, &inp, CBS_len(&sig)); 158| 69.1k| if (ret->signature == nullptr || inp != CBS_data(&sig) + CBS_len(&sig)) { ------------------ | Branch (158:7): [True: 17, False: 69.1k] | Branch (158:36): [True: 0, False: 69.1k] ------------------ 159| 17| return nullptr; 160| 17| } 161| | 162| | // The version must be one of v1(0), v2(1), or v3(2). 163| 69.1k| long version = X509_VERSION_1; ------------------ | | 120| 69.1k|#define X509_VERSION_1 0 ------------------ 164| 69.1k| if (ret->cert_info->version != nullptr) { ------------------ | Branch (164:7): [True: 69.1k, False: 1] ------------------ 165| 69.1k| version = ASN1_INTEGER_get(ret->cert_info->version); 166| | // TODO(https://crbug.com/boringssl/364): |X509_VERSION_1| should 167| | // also be rejected here. This means an explicitly-encoded X.509v1 168| | // version. v1 is DEFAULT, so DER requires it be omitted. 169| 69.1k| if (version < X509_VERSION_1 || version > X509_VERSION_3) { ------------------ | | 120| 138k|#define X509_VERSION_1 0 ------------------ if (version < X509_VERSION_1 || version > X509_VERSION_3) { ------------------ | | 122| 69.1k|#define X509_VERSION_3 2 ------------------ | Branch (169:9): [True: 11, False: 69.1k] | Branch (169:37): [True: 8, False: 69.1k] ------------------ 170| 19| OPENSSL_PUT_ERROR(X509, X509_R_INVALID_VERSION); ------------------ | | 361| 19| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 171| 19| return nullptr; 172| 19| } 173| 69.1k| } 174| | 175| | // Per RFC 5280, section 4.1.2.8, these fields require v2 or v3. 176| 69.1k| if (version == X509_VERSION_1 && (ret->cert_info->issuerUID != nullptr || ------------------ | | 120| 138k|#define X509_VERSION_1 0 ------------------ | Branch (176:7): [True: 6, False: 69.1k] | Branch (176:37): [True: 1, False: 5] ------------------ 177| 6| ret->cert_info->subjectUID != nullptr)) { ------------------ | Branch (177:37): [True: 1, False: 4] ------------------ 178| 2| OPENSSL_PUT_ERROR(X509, X509_R_INVALID_FIELD_FOR_VERSION); ------------------ | | 361| 2| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 179| 2| return nullptr; 180| 2| } 181| | 182| | // Per RFC 5280, section 4.1.2.9, extensions require v3. 183| 69.1k| if (version != X509_VERSION_3 && ret->cert_info->extensions != nullptr) { ------------------ | | 122| 138k|#define X509_VERSION_3 2 ------------------ | Branch (183:7): [True: 1.30k, False: 67.8k] | Branch (183:36): [True: 4, False: 1.29k] ------------------ 184| 4| OPENSSL_PUT_ERROR(X509, X509_R_INVALID_FIELD_FOR_VERSION); ------------------ | | 361| 4| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 185| 4| return nullptr; 186| 4| } 187| | 188| 69.1k| return ret.release(); 189| 69.1k|} LLVMFuzzerTestOneInput: 21| 9.52k|extern "C" int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t len) { 22| 9.52k| return g_fuzzer.TestOneInput(buf, len); 23| 9.52k|} d2i_X509_ALGOR: 548| 69.1k| stname *d2i_##fname(stname **a, const unsigned char **in, long len) { \ 549| 69.1k| return (stname *)ASN1_item_d2i((ASN1_VALUE **)a, in, len, \ 550| 69.1k| ASN1_ITEM_rptr(itname)); \ ------------------ | | 227| 69.1k|#define ASN1_ITEM_rptr(name) (&(name##_it)) ------------------ 551| 69.1k| } \ i2d_X509_ALGOR: 552| 4| int i2d_##fname(const stname *a, unsigned char **out) { \ 553| 4| return ASN1_item_i2d((ASN1_VALUE *)a, out, ASN1_ITEM_rptr(itname)); \ ------------------ | | 227| 4|#define ASN1_ITEM_rptr(name) (&(name##_it)) ------------------ 554| 4| } X509_ALGOR_free: 527| 70.1k| void fname##_free(stname *a) { \ 528| 70.1k| ASN1_item_free((ASN1_VALUE *)a, ASN1_ITEM_rptr(itname)); \ ------------------ | | 227| 70.1k|#define ASN1_ITEM_rptr(name) (&(name##_it)) ------------------ 529| 70.1k| } X509_NAME_ENTRY_new: 524| 344k| stname *fname##_new(void) { \ 525| 344k| return (stname *)ASN1_item_new(ASN1_ITEM_rptr(itname)); \ ------------------ | | 227| 344k|#define ASN1_ITEM_rptr(name) (&(name##_it)) ------------------ 526| 344k| } \ X509_NAME_ENTRY_free: 527| 689k| void fname##_free(stname *a) { \ 528| 689k| ASN1_item_free((ASN1_VALUE *)a, ASN1_ITEM_rptr(itname)); \ ------------------ | | 227| 689k|#define ASN1_ITEM_rptr(name) (&(name##_it)) ------------------ 529| 689k| } d2i_X509_NAME: 536| 25| stname *d2i_##fname(stname **a, const unsigned char **in, long len) { \ 537| 25| return (stname *)ASN1_item_d2i((ASN1_VALUE **)a, in, len, \ 538| 25| ASN1_ITEM_rptr(itname)); \ ------------------ | | 227| 25|#define ASN1_ITEM_rptr(name) (&(name##_it)) ------------------ 539| 25| } \ X509_NAME_free: 527| 27| void fname##_free(stname *a) { \ 528| 27| ASN1_item_free((ASN1_VALUE *)a, ASN1_ITEM_rptr(itname)); \ ------------------ | | 227| 27|#define ASN1_ITEM_rptr(name) (&(name##_it)) ------------------ 529| 27| } i2d_X509_PUBKEY: 552| 69.3k| int i2d_##fname(const stname *a, unsigned char **out) { \ 553| 69.3k| return ASN1_item_i2d((ASN1_VALUE *)a, out, ASN1_ITEM_rptr(itname)); \ ------------------ | | 227| 69.3k|#define ASN1_ITEM_rptr(name) (&(name##_it)) ------------------ 554| 69.3k| } i2d_X509_CINF: 540| 4| int i2d_##fname(stname *a, unsigned char **out) { \ 541| 4| return ASN1_item_i2d((ASN1_VALUE *)a, out, ASN1_ITEM_rptr(itname)); \ ------------------ | | 227| 4|#define ASN1_ITEM_rptr(name) (&(name##_it)) ------------------ 542| 4| } X509_CINF_free: 527| 70.1k| void fname##_free(stname *a) { \ 528| 70.1k| ASN1_item_free((ASN1_VALUE *)a, ASN1_ITEM_rptr(itname)); \ ------------------ | | 227| 70.1k|#define ASN1_ITEM_rptr(name) (&(name##_it)) ------------------ 529| 70.1k| } X509_CERT_AUX_free: 527| 70.1k| void fname##_free(stname *a) { \ 528| 70.1k| ASN1_item_free((ASN1_VALUE *)a, ASN1_ITEM_rptr(itname)); \ ------------------ | | 227| 70.1k|#define ASN1_ITEM_rptr(name) (&(name##_it)) ------------------ 529| 70.1k| } ASN1_TYPE_new: 524| 161k| stname *fname##_new(void) { \ 525| 161k| return (stname *)ASN1_item_new(ASN1_ITEM_rptr(itname)); \ ------------------ | | 227| 161k|#define ASN1_ITEM_rptr(name) (&(name##_it)) ------------------ 526| 161k| } \ ASN1_TYPE_free: 527| 296| void fname##_free(stname *a) { \ 528| 296| ASN1_item_free((ASN1_VALUE *)a, ASN1_ITEM_rptr(itname)); \ ------------------ | | 227| 296|#define ASN1_ITEM_rptr(name) (&(name##_it)) ------------------ 529| 296| } AUTHORITY_KEYID_free: 527| 70.1k| void fname##_free(stname *a) { \ 528| 70.1k| ASN1_item_free((ASN1_VALUE *)a, ASN1_ITEM_rptr(itname)); \ ------------------ | | 227| 70.1k|#define ASN1_ITEM_rptr(name) (&(name##_it)) ------------------ 529| 70.1k| } CRL_DIST_POINTS_free: 527| 70.1k| void fname##_free(stname *a) { \ 528| 70.1k| ASN1_item_free((ASN1_VALUE *)a, ASN1_ITEM_rptr(itname)); \ ------------------ | | 227| 70.1k|#define ASN1_ITEM_rptr(name) (&(name##_it)) ------------------ 529| 70.1k| } GENERAL_NAMES_free: 527| 70.1k| void fname##_free(stname *a) { \ 528| 70.1k| ASN1_item_free((ASN1_VALUE *)a, ASN1_ITEM_rptr(itname)); \ ------------------ | | 227| 70.1k|#define ASN1_ITEM_rptr(name) (&(name##_it)) ------------------ 529| 70.1k| } NAME_CONSTRAINTS_free: 527| 70.1k| void fname##_free(stname *a) { \ 528| 70.1k| ASN1_item_free((ASN1_VALUE *)a, ASN1_ITEM_rptr(itname)); \ ------------------ | | 227| 70.1k|#define ASN1_ITEM_rptr(name) (&(name##_it)) ------------------ 529| 70.1k| } _ZN4bssl8internal7DeleterclI10ssl_ctx_stEEvPT_: 449| 39.8k| void operator()(T *ptr) { 450| | // Rather than specialize Deleter for each type, we specialize 451| | // DeleterImpl. This allows bssl::UniquePtr to be used while only 452| | // including base.h as long as the destructor is not emitted. This matches 453| | // std::unique_ptr's behavior on forward-declared types. 454| | // 455| | // DeleterImpl itself is specialized in the corresponding module's header 456| | // and must be included to release an object. If not included, the compiler 457| | // will error that DeleterImpl does not have a method Free. 458| 39.8k| DeleterImpl::Free(ptr); 459| 39.8k| } _ZN4bssl8internal11DeleterImplI10ssl_ctx_stvE4FreeEPS2_: 524| 39.8k| static void Free(type *ptr) { deleter(ptr); } \ _ZN4bssl8internal7DeleterclI11evp_pkey_stEEvPT_: 449| 283k| void operator()(T *ptr) { 450| | // Rather than specialize Deleter for each type, we specialize 451| | // DeleterImpl. This allows bssl::UniquePtr to be used while only 452| | // including base.h as long as the destructor is not emitted. This matches 453| | // std::unique_ptr's behavior on forward-declared types. 454| | // 455| | // DeleterImpl itself is specialized in the corresponding module's header 456| | // and must be included to release an object. If not included, the compiler 457| | // will error that DeleterImpl does not have a method Free. 458| 283k| DeleterImpl::Free(ptr); 459| 283k| } _ZN4bssl8internal11DeleterImplI11evp_pkey_stvE4FreeEPS2_: 524| 283k| static void Free(type *ptr) { deleter(ptr); } \ _ZN4bssl8internal7DeleterclI7x509_stEEvPT_: 449| 1.10k| void operator()(T *ptr) { 450| | // Rather than specialize Deleter for each type, we specialize 451| | // DeleterImpl. This allows bssl::UniquePtr to be used while only 452| | // including base.h as long as the destructor is not emitted. This matches 453| | // std::unique_ptr's behavior on forward-declared types. 454| | // 455| | // DeleterImpl itself is specialized in the corresponding module's header 456| | // and must be included to release an object. If not included, the compiler 457| | // will error that DeleterImpl does not have a method Free. 458| 1.10k| DeleterImpl::Free(ptr); 459| 1.10k| } _ZN4bssl8internal11DeleterImplI7x509_stvE4FreeEPS2_: 524| 1.15k| static void Free(type *ptr) { deleter(ptr); } \ _ZN4bssl8internal7DeleterclI6rsa_stEEvPT_: 449| 2| void operator()(T *ptr) { 450| | // Rather than specialize Deleter for each type, we specialize 451| | // DeleterImpl. This allows bssl::UniquePtr to be used while only 452| | // including base.h as long as the destructor is not emitted. This matches 453| | // std::unique_ptr's behavior on forward-declared types. 454| | // 455| | // DeleterImpl itself is specialized in the corresponding module's header 456| | // and must be included to release an object. If not included, the compiler 457| | // will error that DeleterImpl does not have a method Free. 458| 2| DeleterImpl::Free(ptr); 459| 2| } _ZN4bssl8internal11DeleterImplI6rsa_stvE4FreeEPS2_: 524| 2| static void Free(type *ptr) { deleter(ptr); } \ _ZN4bssl8internal7DeleterclI14ssl_session_stEEvPT_: 449| 147k| void operator()(T *ptr) { 450| | // Rather than specialize Deleter for each type, we specialize 451| | // DeleterImpl. This allows bssl::UniquePtr to be used while only 452| | // including base.h as long as the destructor is not emitted. This matches 453| | // std::unique_ptr's behavior on forward-declared types. 454| | // 455| | // DeleterImpl itself is specialized in the corresponding module's header 456| | // and must be included to release an object. If not included, the compiler 457| | // will error that DeleterImpl does not have a method Free. 458| 147k| DeleterImpl::Free(ptr); 459| 147k| } _ZN4bssl8internal11DeleterImplI14ssl_session_stvE4FreeEPS2_: 524| 147k| static void Free(type *ptr) { deleter(ptr); } \ _ZN4bssl8internal7DeleterclI6bio_stEEvPT_: 449| 10.3k| void operator()(T *ptr) { 450| | // Rather than specialize Deleter for each type, we specialize 451| | // DeleterImpl. This allows bssl::UniquePtr to be used while only 452| | // including base.h as long as the destructor is not emitted. This matches 453| | // std::unique_ptr's behavior on forward-declared types. 454| | // 455| | // DeleterImpl itself is specialized in the corresponding module's header 456| | // and must be included to release an object. If not included, the compiler 457| | // will error that DeleterImpl does not have a method Free. 458| 10.3k| DeleterImpl::Free(ptr); 459| 10.3k| } _ZN4bssl8internal11DeleterImplI6bio_stvE4FreeEPS2_: 524| 10.3k| static void Free(type *ptr) { deleter(ptr); } \ _ZN4bssl8internal7DeleterclI6ssl_stEEvPT_: 449| 19.9k| void operator()(T *ptr) { 450| | // Rather than specialize Deleter for each type, we specialize 451| | // DeleterImpl. This allows bssl::UniquePtr to be used while only 452| | // including base.h as long as the destructor is not emitted. This matches 453| | // std::unique_ptr's behavior on forward-declared types. 454| | // 455| | // DeleterImpl itself is specialized in the corresponding module's header 456| | // and must be included to release an object. If not included, the compiler 457| | // will error that DeleterImpl does not have a method Free. 458| 19.9k| DeleterImpl::Free(ptr); 459| 19.9k| } _ZN4bssl8internal11DeleterImplI6ssl_stvE4FreeEPS2_: 524| 19.9k| static void Free(type *ptr) { deleter(ptr); } \ _ZN4bssl8internal11DeleterImplI10buf_mem_stvE4FreeEPS2_: 524| 391k| static void Free(type *ptr) { deleter(ptr); } \ _ZN4bssl8internal11DeleterImplIcvE4FreeEPc: 524| 6.04k| static void Free(type *ptr) { deleter(ptr); } \ _ZN4bssl5UpRefEP11evp_pkey_st: 535| 298k| inline UniquePtr UpRef(type *v) { \ 536| 298k| if (v != nullptr) { \ ------------------ | Branch (536:9): [True: 218k, False: 79.5k] ------------------ 537| 218k| up_ref_func(v); \ 538| 218k| } \ 539| 298k| return UniquePtr(v); \ 540| 298k| } \ _ZN4bssl5UpRefERKNSt3__110unique_ptrI11evp_pkey_stNS_8internal7DeleterEEE: 542| 218k| inline UniquePtr UpRef(const UniquePtr &ptr) { \ 543| 218k| return UpRef(ptr.get()); \ 544| 218k| } _ZN4bssl8internal11DeleterImplI9bignum_stvE4FreeEPS2_: 524| 286k| static void Free(type *ptr) { deleter(ptr); } \ _ZN4bssl8internal11DeleterImplI10bignum_ctxvE4FreeEPS2_: 524| 96.7k| static void Free(type *ptr) { deleter(ptr); } \ _ZN4bssl8internal11DeleterImplI6dsa_stvE4FreeEPS2_: 524| 280| static void Free(type *ptr) { deleter(ptr); } \ _ZN4bssl8internal11DeleterImplI9ec_key_stvE4FreeEPS2_: 524| 2.49k| static void Free(type *ptr) { deleter(ptr); } \ _ZN4bssl8internal11DeleterImplI11ec_point_stvE4FreeEPS2_: 524| 120k| static void Free(type *ptr) { deleter(ptr); } \ _ZN4bssl8internal11DeleterImplI12ecdsa_sig_stvE4FreeEPS2_: 524| 6.97k| static void Free(type *ptr) { deleter(ptr); } \ _ZN4bssl8internal11DeleterImplI16crypto_buffer_stvE4FreeEPS2_: 524| 210k| static void Free(type *ptr) { deleter(ptr); } \ _ZN4bssl5UpRefEP16crypto_buffer_st: 535| 266k| inline UniquePtr UpRef(type *v) { \ 536| 266k| if (v != nullptr) { \ ------------------ | Branch (536:9): [True: 43.5k, False: 222k] ------------------ 537| 43.5k| up_ref_func(v); \ 538| 43.5k| } \ 539| 266k| return UniquePtr(v); \ 540| 266k| } \ _ZN4bssl5UpRefERKNSt3__110unique_ptrI16crypto_buffer_stNS_8internal7DeleterEEE: 542| 266k| inline UniquePtr UpRef(const UniquePtr &ptr) { \ 543| 266k| return UpRef(ptr.get()); \ 544| 266k| } _ZN4bssl8internal11DeleterImplI12X509_name_stvE4FreeEPS2_: 524| 22| static void Free(type *ptr) { deleter(ptr); } \ _ZN4bssl8internal11DeleterImplI17x509_store_ctx_stvE4FreeEPS2_: 524| 2.99k| static void Free(type *ptr) { deleter(ptr); } \ _ZN4bssl5UpRefEP7x509_st: 535| 120k| inline UniquePtr UpRef(type *v) { \ 536| 120k| if (v != nullptr) { \ ------------------ | Branch (536:9): [True: 120k, False: 0] ------------------ 537| 120k| up_ref_func(v); \ 538| 120k| } \ 539| 120k| return UniquePtr(v); \ 540| 120k| } \ _ZN4bssl5UpRefERKNSt3__110unique_ptrI7x509_stNS_8internal7DeleterEEE: 542| 67.9k| inline UniquePtr UpRef(const UniquePtr &ptr) { \ 543| 67.9k| return UpRef(ptr.get()); \ 544| 67.9k| } _ZN4bssl8internal11DeleterImplI17ssl_credential_stvE4FreeEPS2_: 524| 67.8k| static void Free(type *ptr) { deleter(ptr); } \ _ZN4bssl5UpRefEP17ssl_credential_st: 535| 28.0k| inline UniquePtr UpRef(type *v) { \ 536| 28.0k| if (v != nullptr) { \ ------------------ | Branch (536:9): [True: 28.0k, False: 0] ------------------ 537| 28.0k| up_ref_func(v); \ 538| 28.0k| } \ 539| 28.0k| return UniquePtr(v); \ 540| 28.0k| } \ _ZN4bssl5UpRefEP10ssl_ctx_st: 535| 39.8k| inline UniquePtr UpRef(type *v) { \ 536| 39.8k| if (v != nullptr) { \ ------------------ | Branch (536:9): [True: 39.8k, False: 0] ------------------ 537| 39.8k| up_ref_func(v); \ 538| 39.8k| } \ 539| 39.8k| return UniquePtr(v); \ 540| 39.8k| } \ _ZN4bssl5UpRefEP14ssl_session_st: 535| 19.2k| inline UniquePtr UpRef(type *v) { \ 536| 19.2k| if (v != nullptr) { \ ------------------ | Branch (536:9): [True: 18.6k, False: 567] ------------------ 537| 18.6k| up_ref_func(v); \ 538| 18.6k| } \ 539| 19.2k| return UniquePtr(v); \ 540| 19.2k| } \ _ZN4bssl5UpRefERKNSt3__110unique_ptrI14ssl_session_stNS_8internal7DeleterEEE: 542| 177| inline UniquePtr UpRef(const UniquePtr &ptr) { \ 543| 177| return UpRef(ptr.get()); \ 544| 177| } _ZN4bssl8internal7DeleterclI6dsa_stEEvPT_: 449| 280| void operator()(T *ptr) { 450| | // Rather than specialize Deleter for each type, we specialize 451| | // DeleterImpl. This allows bssl::UniquePtr to be used while only 452| | // including base.h as long as the destructor is not emitted. This matches 453| | // std::unique_ptr's behavior on forward-declared types. 454| | // 455| | // DeleterImpl itself is specialized in the corresponding module's header 456| | // and must be included to release an object. If not included, the compiler 457| | // will error that DeleterImpl does not have a method Free. 458| 280| DeleterImpl::Free(ptr); 459| 280| } _ZN4bssl8internal7DeleterclI9ec_key_stEEvPT_: 449| 2.49k| void operator()(T *ptr) { 450| | // Rather than specialize Deleter for each type, we specialize 451| | // DeleterImpl. This allows bssl::UniquePtr to be used while only 452| | // including base.h as long as the destructor is not emitted. This matches 453| | // std::unique_ptr's behavior on forward-declared types. 454| | // 455| | // DeleterImpl itself is specialized in the corresponding module's header 456| | // and must be included to release an object. If not included, the compiler 457| | // will error that DeleterImpl does not have a method Free. 458| 2.49k| DeleterImpl::Free(ptr); 459| 2.49k| } _ZN4bssl8internal7DeleterclI16crypto_buffer_stEEvPT_: 449| 63.9k| void operator()(T *ptr) { 450| | // Rather than specialize Deleter for each type, we specialize 451| | // DeleterImpl. This allows bssl::UniquePtr to be used while only 452| | // including base.h as long as the destructor is not emitted. This matches 453| | // std::unique_ptr's behavior on forward-declared types. 454| | // 455| | // DeleterImpl itself is specialized in the corresponding module's header 456| | // and must be included to release an object. If not included, the compiler 457| | // will error that DeleterImpl does not have a method Free. 458| 63.9k| DeleterImpl::Free(ptr); 459| 63.9k| } _ZN4bssl8internal7DeleterclI17ssl_credential_stEEvPT_: 449| 67.8k| void operator()(T *ptr) { 450| | // Rather than specialize Deleter for each type, we specialize 451| | // DeleterImpl. This allows bssl::UniquePtr to be used while only 452| | // including base.h as long as the destructor is not emitted. This matches 453| | // std::unique_ptr's behavior on forward-declared types. 454| | // 455| | // DeleterImpl itself is specialized in the corresponding module's header 456| | // and must be included to release an object. If not included, the compiler 457| | // will error that DeleterImpl does not have a method Free. 458| 67.8k| DeleterImpl::Free(ptr); 459| 67.8k| } _ZN4bssl8internal7DeleterclINS_14SSLAEADContextEEEvPT_: 449| 144k| void operator()(T *ptr) { 450| | // Rather than specialize Deleter for each type, we specialize 451| | // DeleterImpl. This allows bssl::UniquePtr to be used while only 452| | // including base.h as long as the destructor is not emitted. This matches 453| | // std::unique_ptr's behavior on forward-declared types. 454| | // 455| | // DeleterImpl itself is specialized in the corresponding module's header 456| | // and must be included to release an object. If not included, the compiler 457| | // will error that DeleterImpl does not have a method Free. 458| 144k| DeleterImpl::Free(ptr); 459| 144k| } _ZN4bssl8internal11DeleterImplI17err_save_state_stvE4FreeEPS2_: 524| 5.48k| static void Free(type *ptr) { deleter(ptr); } \ _ZN4bssl8internal14StackAllocatedI6cbb_stvXadL_Z8CBB_zeroEEXadL_Z11CBB_cleanupEEEC2Ev: 466| 325k| StackAllocated() { init(&ctx_); } _ZN4bssl8internal14StackAllocatedI6cbb_stvXadL_Z8CBB_zeroEEXadL_Z11CBB_cleanupEEED2Ev: 467| 325k| ~StackAllocated() { cleanup(&ctx_); } _ZN4bssl8internal14StackAllocatedI6cbb_stvXadL_Z8CBB_zeroEEXadL_Z11CBB_cleanupEEE3getEv: 472| 1.03M| T *get() { return &ctx_; } _ZN4bssl8internal7DeleterclI22stack_st_CRYPTO_BUFFEREEvPT_: 449| 169k| void operator()(T *ptr) { 450| | // Rather than specialize Deleter for each type, we specialize 451| | // DeleterImpl. This allows bssl::UniquePtr to be used while only 452| | // including base.h as long as the destructor is not emitted. This matches 453| | // std::unique_ptr's behavior on forward-declared types. 454| | // 455| | // DeleterImpl itself is specialized in the corresponding module's header 456| | // and must be included to release an object. If not included, the compiler 457| | // will error that DeleterImpl does not have a method Free. 458| 169k| DeleterImpl::Free(ptr); 459| 169k| } _ZN4bssl8internal7DeleterclINS_11SSLKeyShareEEEvPT_: 449| 163k| void operator()(T *ptr) { 450| | // Rather than specialize Deleter for each type, we specialize 451| | // DeleterImpl. This allows bssl::UniquePtr to be used while only 452| | // including base.h as long as the destructor is not emitted. This matches 453| | // std::unique_ptr's behavior on forward-declared types. 454| | // 455| | // DeleterImpl itself is specialized in the corresponding module's header 456| | // and must be included to release an object. If not included, the compiler 457| | // will error that DeleterImpl does not have a method Free. 458| 163k| DeleterImpl::Free(ptr); 459| 163k| } _ZN4bssl8internal7DeleterclI12ecdsa_sig_stEEvPT_: 449| 6.97k| void operator()(T *ptr) { 450| | // Rather than specialize Deleter for each type, we specialize 451| | // DeleterImpl. This allows bssl::UniquePtr to be used while only 452| | // including base.h as long as the destructor is not emitted. This matches 453| | // std::unique_ptr's behavior on forward-declared types. 454| | // 455| | // DeleterImpl itself is specialized in the corresponding module's header 456| | // and must be included to release an object. If not included, the compiler 457| | // will error that DeleterImpl does not have a method Free. 458| 6.97k| DeleterImpl::Free(ptr); 459| 6.97k| } _ZN4bssl8internal7DeleterclI9bignum_stEEvPT_: 449| 286k| void operator()(T *ptr) { 450| | // Rather than specialize Deleter for each type, we specialize 451| | // DeleterImpl. This allows bssl::UniquePtr to be used while only 452| | // including base.h as long as the destructor is not emitted. This matches 453| | // std::unique_ptr's behavior on forward-declared types. 454| | // 455| | // DeleterImpl itself is specialized in the corresponding module's header 456| | // and must be included to release an object. If not included, the compiler 457| | // will error that DeleterImpl does not have a method Free. 458| 286k| DeleterImpl::Free(ptr); 459| 286k| } _ZN4bssl8internal7DeleterclI11ec_point_stEEvPT_: 449| 120k| void operator()(T *ptr) { 450| | // Rather than specialize Deleter for each type, we specialize 451| | // DeleterImpl. This allows bssl::UniquePtr to be used while only 452| | // including base.h as long as the destructor is not emitted. This matches 453| | // std::unique_ptr's behavior on forward-declared types. 454| | // 455| | // DeleterImpl itself is specialized in the corresponding module's header 456| | // and must be included to release an object. If not included, the compiler 457| | // will error that DeleterImpl does not have a method Free. 458| 120k| DeleterImpl::Free(ptr); 459| 120k| } _ZN4bssl8internal7DeleterclINS_23SSLCipherPreferenceListEEEvPT_: 449| 2| void operator()(T *ptr) { 450| | // Rather than specialize Deleter for each type, we specialize 451| | // DeleterImpl. This allows bssl::UniquePtr to be used while only 452| | // including base.h as long as the destructor is not emitted. This matches 453| | // std::unique_ptr's behavior on forward-declared types. 454| | // 455| | // DeleterImpl itself is specialized in the corresponding module's header 456| | // and must be included to release an object. If not included, the compiler 457| | // will error that DeleterImpl does not have a method Free. 458| 2| DeleterImpl::Free(ptr); 459| 2| } _ZN4bssl8internal7DeleterclI19stack_st_SSL_CIPHEREEvPT_: 449| 2| void operator()(T *ptr) { 450| | // Rather than specialize Deleter for each type, we specialize 451| | // DeleterImpl. This allows bssl::UniquePtr to be used while only 452| | // including base.h as long as the destructor is not emitted. This matches 453| | // std::unique_ptr's behavior on forward-declared types. 454| | // 455| | // DeleterImpl itself is specialized in the corresponding module's header 456| | // and must be included to release an object. If not included, the compiler 457| | // will error that DeleterImpl does not have a method Free. 458| 2| DeleterImpl::Free(ptr); 459| 2| } _ZN4bssl8internal7DeleterclI10buf_mem_stEEvPT_: 449| 391k| void operator()(T *ptr) { 450| | // Rather than specialize Deleter for each type, we specialize 451| | // DeleterImpl. This allows bssl::UniquePtr to be used while only 452| | // including base.h as long as the destructor is not emitted. This matches 453| | // std::unique_ptr's behavior on forward-declared types. 454| | // 455| | // DeleterImpl itself is specialized in the corresponding module's header 456| | // and must be included to release an object. If not included, the compiler 457| | // will error that DeleterImpl does not have a method Free. 458| 391k| DeleterImpl::Free(ptr); 459| 391k| } _ZN4bssl8internal7DeleterclINS_13SSL_HANDSHAKEEEEvPT_: 449| 71.0k| void operator()(T *ptr) { 450| | // Rather than specialize Deleter for each type, we specialize 451| | // DeleterImpl. This allows bssl::UniquePtr to be used while only 452| | // including base.h as long as the destructor is not emitted. This matches 453| | // std::unique_ptr's behavior on forward-declared types. 454| | // 455| | // DeleterImpl itself is specialized in the corresponding module's header 456| | // and must be included to release an object. If not included, the compiler 457| | // will error that DeleterImpl does not have a method Free. 458| 71.0k| DeleterImpl::Free(ptr); 459| 71.0k| } _ZN4bssl8internal7DeleterclIcEEvPT_: 449| 6.04k| void operator()(T *ptr) { 450| | // Rather than specialize Deleter for each type, we specialize 451| | // DeleterImpl. This allows bssl::UniquePtr to be used while only 452| | // including base.h as long as the destructor is not emitted. This matches 453| | // std::unique_ptr's behavior on forward-declared types. 454| | // 455| | // DeleterImpl itself is specialized in the corresponding module's header 456| | // and must be included to release an object. If not included, the compiler 457| | // will error that DeleterImpl does not have a method Free. 458| 6.04k| DeleterImpl::Free(ptr); 459| 6.04k| } _ZN4bssl8internal7DeleterclINS_19SSL_HANDSHAKE_HINTSEEEvPT_: 449| 15.1k| void operator()(T *ptr) { 450| | // Rather than specialize Deleter for each type, we specialize 451| | // DeleterImpl. This allows bssl::UniquePtr to be used while only 452| | // including base.h as long as the destructor is not emitted. This matches 453| | // std::unique_ptr's behavior on forward-declared types. 454| | // 455| | // DeleterImpl itself is specialized in the corresponding module's header 456| | // and must be included to release an object. If not included, the compiler 457| | // will error that DeleterImpl does not have a method Free. 458| 15.1k| DeleterImpl::Free(ptr); 459| 15.1k| } _ZN4bssl8internal14StackAllocatedI15evp_hpke_ctx_stvXadL_Z17EVP_HPKE_CTX_zeroEEXadL_Z20EVP_HPKE_CTX_cleanupEEEC2Ev: 466| 71.0k| StackAllocated() { init(&ctx_); } _ZN4bssl8internal14StackAllocatedI15evp_hpke_ctx_stvXadL_Z17EVP_HPKE_CTX_zeroEEXadL_Z20EVP_HPKE_CTX_cleanupEEED2Ev: 467| 71.0k| ~StackAllocated() { cleanup(&ctx_); } _ZN4bssl8internal7DeleterclI17err_save_state_stEEvPT_: 449| 5.48k| void operator()(T *ptr) { 450| | // Rather than specialize Deleter for each type, we specialize 451| | // DeleterImpl. This allows bssl::UniquePtr to be used while only 452| | // including base.h as long as the destructor is not emitted. This matches 453| | // std::unique_ptr's behavior on forward-declared types. 454| | // 455| | // DeleterImpl itself is specialized in the corresponding module's header 456| | // and must be included to release an object. If not included, the compiler 457| | // will error that DeleterImpl does not have a method Free. 458| 5.48k| DeleterImpl::Free(ptr); 459| 5.48k| } _ZN4bssl8internal14StackAllocatedI15evp_aead_ctx_stvXadL_Z17EVP_AEAD_CTX_zeroEEXadL_Z20EVP_AEAD_CTX_cleanupEEEC2Ev: 466| 144k| StackAllocated() { init(&ctx_); } _ZN4bssl8internal14StackAllocatedI15evp_aead_ctx_stvXadL_Z17EVP_AEAD_CTX_zeroEEXadL_Z20EVP_AEAD_CTX_cleanupEEED2Ev: 467| 144k| ~StackAllocated() { cleanup(&ctx_); } _ZN4bssl8internal14StackAllocatedI15evp_aead_ctx_stvXadL_Z17EVP_AEAD_CTX_zeroEEXadL_Z20EVP_AEAD_CTX_cleanupEEE3getEv: 472| 104k| T *get() { return &ctx_; } _ZN4bssl8internal7DeleterclINS_4CERTEEEvPT_: 449| 19.9k| void operator()(T *ptr) { 450| | // Rather than specialize Deleter for each type, we specialize 451| | // DeleterImpl. This allows bssl::UniquePtr to be used while only 452| | // including base.h as long as the destructor is not emitted. This matches 453| | // std::unique_ptr's behavior on forward-declared types. 454| | // 455| | // DeleterImpl itself is specialized in the corresponding module's header 456| | // and must be included to release an object. If not included, the compiler 457| | // will error that DeleterImpl does not have a method Free. 458| 19.9k| DeleterImpl::Free(ptr); 459| 19.9k| } _ZN4bssl8internal7DeleterclINS_10SSL_CONFIGEEEvPT_: 449| 19.9k| void operator()(T *ptr) { 450| | // Rather than specialize Deleter for each type, we specialize 451| | // DeleterImpl. This allows bssl::UniquePtr to be used while only 452| | // including base.h as long as the destructor is not emitted. This matches 453| | // std::unique_ptr's behavior on forward-declared types. 454| | // 455| | // DeleterImpl itself is specialized in the corresponding module's header 456| | // and must be included to release an object. If not included, the compiler 457| | // will error that DeleterImpl does not have a method Free. 458| 19.9k| DeleterImpl::Free(ptr); 459| 19.9k| } _ZN4bssl8internal21StackAllocatedMovableI13env_md_ctx_stiXadL_Z15EVP_MD_CTX_initEEXadL_Z18EVP_MD_CTX_cleanupEEXadL_Z15EVP_MD_CTX_moveEEEC2Ev: 491| 488k| StackAllocatedMovable() { init(&ctx_); } _ZN4bssl8internal21StackAllocatedMovableI13env_md_ctx_stiXadL_Z15EVP_MD_CTX_initEEXadL_Z18EVP_MD_CTX_cleanupEEXadL_Z15EVP_MD_CTX_moveEEED2Ev: 492| 488k| ~StackAllocatedMovable() { cleanup(&ctx_); } _ZN4bssl8internal21StackAllocatedMovableI13env_md_ctx_stiXadL_Z15EVP_MD_CTX_initEEXadL_Z18EVP_MD_CTX_cleanupEEXadL_Z15EVP_MD_CTX_moveEEE3getEv: 503| 2.41M| T *get() { return &ctx_; } _ZN4bssl8internal21StackAllocatedMovableI13env_md_ctx_stiXadL_Z15EVP_MD_CTX_initEEXadL_Z18EVP_MD_CTX_cleanupEEXadL_Z15EVP_MD_CTX_moveEEE5ResetEv: 509| 71.0k| void Reset() { 510| 71.0k| cleanup(&ctx_); 511| 71.0k| init(&ctx_); 512| 71.0k| } _ZNK4bssl8internal21StackAllocatedMovableI13env_md_ctx_stiXadL_Z15EVP_MD_CTX_initEEXadL_Z18EVP_MD_CTX_cleanupEEXadL_Z15EVP_MD_CTX_moveEEE3getEv: 504| 476k| const T *get() const { return &ctx_; } _ZN4bssl8internal7DeleterclI12X509_name_stEEvPT_: 449| 22| void operator()(T *ptr) { 450| | // Rather than specialize Deleter for each type, we specialize 451| | // DeleterImpl. This allows bssl::UniquePtr to be used while only 452| | // including base.h as long as the destructor is not emitted. This matches 453| | // std::unique_ptr's behavior on forward-declared types. 454| | // 455| | // DeleterImpl itself is specialized in the corresponding module's header 456| | // and must be included to release an object. If not included, the compiler 457| | // will error that DeleterImpl does not have a method Free. 458| 22| DeleterImpl::Free(ptr); 459| 22| } _ZN4bssl8internal7DeleterclI13stack_st_X509EEvPT_: 449| 1.95k| void operator()(T *ptr) { 450| | // Rather than specialize Deleter for each type, we specialize 451| | // DeleterImpl. This allows bssl::UniquePtr to be used while only 452| | // including base.h as long as the destructor is not emitted. This matches 453| | // std::unique_ptr's behavior on forward-declared types. 454| | // 455| | // DeleterImpl itself is specialized in the corresponding module's header 456| | // and must be included to release an object. If not included, the compiler 457| | // will error that DeleterImpl does not have a method Free. 458| 1.95k| DeleterImpl::Free(ptr); 459| 1.95k| } _ZN4bssl8internal7DeleterclI17x509_store_ctx_stEEvPT_: 449| 2.99k| void operator()(T *ptr) { 450| | // Rather than specialize Deleter for each type, we specialize 451| | // DeleterImpl. This allows bssl::UniquePtr to be used while only 452| | // including base.h as long as the destructor is not emitted. This matches 453| | // std::unique_ptr's behavior on forward-declared types. 454| | // 455| | // DeleterImpl itself is specialized in the corresponding module's header 456| | // and must be included to release an object. If not included, the compiler 457| | // will error that DeleterImpl does not have a method Free. 458| 2.99k| DeleterImpl::Free(ptr); 459| 2.99k| } _ZN4bssl8internal7DeleterclI10bignum_ctxEEvPT_: 449| 96.7k| void operator()(T *ptr) { 450| | // Rather than specialize Deleter for each type, we specialize 451| | // DeleterImpl. This allows bssl::UniquePtr to be used while only 452| | // including base.h as long as the destructor is not emitted. This matches 453| | // std::unique_ptr's behavior on forward-declared types. 454| | // 455| | // DeleterImpl itself is specialized in the corresponding module's header 456| | // and must be included to release an object. If not included, the compiler 457| | // will error that DeleterImpl does not have a method Free. 458| 96.7k| DeleterImpl::Free(ptr); 459| 96.7k| } _ZN4bssl11BN_CTXScopeC2EP10bignum_ctx: 955| 349k| BN_CTXScope(BN_CTX *ctx) : ctx_(ctx) { BN_CTX_start(ctx_); } _ZN4bssl11BN_CTXScopeD2Ev: 956| 349k| ~BN_CTXScope() { BN_CTX_end(ctx_); } CBS_init: 59| 21.0M|OPENSSL_INLINE void CBS_init(CBS *cbs, const uint8_t *data, size_t len) { 60| 21.0M| cbs->data = data; 61| 21.0M| cbs->len = len; 62| 21.0M|} CBS_data: 69| 7.68M|OPENSSL_INLINE const uint8_t *CBS_data(const CBS *cbs) { return cbs->data; } CBS_len: 72| 41.8M|OPENSSL_INLINE size_t CBS_len(const CBS *cbs) { return cbs->len; } _ZN6cbs_stC2EN4bssl4SpanIKhEE: 47| 1.43M| : data(span.data()), len(span.size()) {} _ZNK6cbs_stcvN4bssl4SpanIKhEEEv: 48| 1.22M| operator bssl::Span() const { return bssl::Span(data, len); } ERR_GET_LIB: 72| 4.09k|OPENSSL_INLINE int ERR_GET_LIB(uint32_t packed_error) { 73| 4.09k| return (int)((packed_error >> 24) & 0xff); 74| 4.09k|} ERR_GET_REASON: 79| 244|OPENSSL_INLINE int ERR_GET_REASON(uint32_t packed_error) { 80| 244| return (int)(packed_error & 0xfff); 81| 244|} _ZN4bssl13MakeConstSpanIKhEENS_4SpanIKT_EEPS3_m: 232| 56.4k|constexpr Span MakeConstSpan(T *ptr, size_t size) { 233| 56.4k| return Span(ptr, size); 234| 56.4k|} _ZNK4bssl4SpanIKhE4dataEv: 142| 9.02M| constexpr T *data() const { return data_; } _ZNK4bssl4SpanIKhE4sizeEv: 143| 26.3M| constexpr size_t size() const { return size_; } _ZN4bssl13StringAsBytesENSt3__117basic_string_viewIcNS0_11char_traitsIcEEEE: 247| 56.4k|inline Span StringAsBytes(std::string_view s) { 248| 56.4k| return MakeConstSpan(reinterpret_cast(s.data()), s.size()); 249| 56.4k|} _ZNK4bssl4SpanIKhE5beginEv: 146| 1.32M| constexpr iterator begin() const { return data_; } _ZNK4bssl4SpanIKhE3endEv: 148| 1.32M| constexpr iterator end() const { return data_ + size_; } _ZNK4bssl4SpanIhE7subspanEmm: 172| 485k| constexpr Span subspan(size_t pos = 0, size_t len = npos) const { 173| 485k| if (pos > size_) { ------------------ | Branch (173:9): [True: 0, False: 485k] ------------------ 174| | // absl::Span throws an exception here. Note std::span and Chromium 175| | // base::span additionally forbid pos + len being out of range, with a 176| | // special case at npos/dynamic_extent, while absl::Span::subspan clips 177| | // the span. For now, we align with absl::Span in case we switch to it in 178| | // the future. 179| 0| abort(); 180| 0| } 181| 485k| return Span(data_ + pos, std::min(size_ - pos, len)); 182| 485k| } _ZNK4bssl4SpanIKhE7subspanEmm: 172| 2.35M| constexpr Span subspan(size_t pos = 0, size_t len = npos) const { 173| 2.35M| if (pos > size_) { ------------------ | Branch (173:9): [True: 0, False: 2.35M] ------------------ 174| | // absl::Span throws an exception here. Note std::span and Chromium 175| | // base::span additionally forbid pos + len being out of range, with a 176| | // special case at npos/dynamic_extent, while absl::Span::subspan clips 177| | // the span. For now, we align with absl::Span in case we switch to it in 178| | // the future. 179| 0| abort(); 180| 0| } 181| 2.35M| return Span(data_ + pos, std::min(size_ - pos, len)); 182| 2.35M| } _ZN4bssl4SpanIKhEC2EPS1_m: 127| 8.86M| constexpr Span(T *ptr, size_t len) : data_(ptr), size_(len) {} _ZN4bssl4SpanIhEC2INS_5ArrayIhEEvS4_EERT_: 140| 52.3k| : data_(container.data()), size_(container.size()) {} _ZNK4bssl4SpanIhE4dataEv: 142| 3.27M| constexpr T *data() const { return data_; } _ZNK4bssl4SpanIhE4sizeEv: 143| 4.33M| constexpr size_t size() const { return size_; } _ZN4bssl4SpanIKhEC2ILm1EEERAT__S1_: 130| 105k| constexpr Span(T (&array)[N]) : Span(array, N) {} _ZN4bssl4SpanIKhEC2INS_5ArrayIhEEvS5_EERKT_: 135| 1.19M| : data_(container.data()), size_(container.size()) {} _ZNK4bssl4SpanIKhE5emptyEv: 144| 7.45M| constexpr bool empty() const { return size_ == 0; } _ZN4bssl4SpanIKhEC2Ev: 126| 812k| constexpr Span() : Span(nullptr, 0) {} _ZNK4bssl4SpanIKhEixEm: 164| 34.8k| constexpr T &operator[](size_t i) const { 165| 34.8k| if (i >= size_) { ------------------ | Branch (165:9): [True: 0, False: 34.8k] ------------------ 166| 0| abort(); 167| 0| } 168| 34.8k| return data_[i]; 169| 34.8k| } _ZN4bssl4SpanIhEC2EPhm: 127| 4.63M| constexpr Span(T *ptr, size_t len) : data_(ptr), size_(len) {} _ZN4bssl4SpanIKhEC2INS0_IhEEvS4_EERKT_: 135| 3.00M| : data_(container.data()), size_(container.size()) {} _ZNK4bssl4SpanIhE4lastEm: 191| 4.18k| constexpr Span last(size_t len) const { 192| 4.18k| if (len > size_) { ------------------ | Branch (192:9): [True: 0, False: 4.18k] ------------------ 193| 0| abort(); 194| 0| } 195| 4.18k| return Span(data_ + size_ - len, len); 196| 4.18k| } _ZN4bssl8internaleqENS_4SpanIKhEES3_: 63| 120k| friend bool operator==(Span lhs, Span rhs) { 64| 120k| return std::equal(lhs.begin(), lhs.end(), rhs.begin(), rhs.end()); 65| 120k| } _ZN4bssl8internalneENS_4SpanIKhEES3_: 67| 51.3k| friend bool operator!=(Span lhs, Span rhs) { return !(lhs == rhs); } _ZN4bssl4SpanIKtEC2INS_5ArrayItEEvS5_EERKT_: 135| 266k| : data_(container.data()), size_(container.size()) {} _ZN4bssl4SpanIKtEC2ILm3EEERAT__S1_: 130| 56.4k| constexpr Span(T (&array)[N]) : Span(array, N) {} _ZN4bssl4SpanIKtEC2EPS1_m: 127| 558k| constexpr Span(T *ptr, size_t len) : data_(ptr), size_(len) {} _ZN4bssl4SpanIKtEC2Ev: 126| 28.0k| constexpr Span() : Span(nullptr, 0) {} _ZNK4bssl4SpanIKtE5beginEv: 146| 798k| constexpr iterator begin() const { return data_; } _ZNK4bssl4SpanIKtE3endEv: 148| 934k| constexpr iterator end() const { return data_ + size_; } _ZN4bssl4SpanIKtEC2ILm9EEERAT__S1_: 130| 107k| constexpr Span(T (&array)[N]) : Span(array, N) {} _ZNK4bssl4SpanIKtE5emptyEv: 144| 84.4k| constexpr bool empty() const { return size_ == 0; } _ZNK4bssl4SpanIKtEixEm: 164| 225k| constexpr T &operator[](size_t i) const { 165| 225k| if (i >= size_) { ------------------ | Branch (165:9): [True: 0, False: 225k] ------------------ 166| 0| abort(); 167| 0| } 168| 225k| return data_[i]; 169| 225k| } _ZNK4bssl4SpanIKtE4sizeEv: 143| 228k| constexpr size_t size() const { return size_; } _ZN4bssl4SpanIhEC2ILm65EEERAT__h: 130| 56.3k| constexpr Span(T (&array)[N]) : Span(array, N) {} _ZN4bssl4SpanIhEC2ILm32EEERAT__h: 130| 4.13k| constexpr Span(T (&array)[N]) : Span(array, N) {} _ZN4bssl4SpanIKhEC2ILm32EEERAT__S1_: 130| 106k| constexpr Span(T (&array)[N]) : Span(array, N) {} _ZN4bssl4SpanIKtEC2ILm12EEERAT__S1_: 130| 28.0k| constexpr Span(T (&array)[N]) : Span(array, N) {} _ZN4bssl4SpanIKhEC2INS_13InplaceVectorIhLm48EEEvS5_EERKT_: 135| 318k| : data_(container.data()), size_(container.size()) {} _ZN4bssl4SpanIKhEC2INS_13InplaceVectorIhLm32EEEvS5_EERKT_: 135| 237k| : data_(container.data()), size_(container.size()) {} _ZN4bssl4SpanIKhEC2ILm8EEERAT__S1_: 130| 12.4k| constexpr Span(T (&array)[N]) : Span(array, N) {} _ZN4bssl4SpanIhEC2INS_13InplaceVectorIhLm48EEEvS4_EERT_: 140| 54.8k| : data_(container.data()), size_(container.size()) {} _ZN4bssl4SpanIKhEC2ILm4EEERAT__S1_: 130| 115| constexpr Span(T (&array)[N]) : Span(array, N) {} _ZNK4bssl4SpanIhEixEm: 164| 51.4k| constexpr T &operator[](size_t i) const { 165| 51.4k| if (i >= size_) { ------------------ | Branch (165:9): [True: 0, False: 51.4k] ------------------ 166| 0| abort(); 167| 0| } 168| 51.4k| return data_[i]; 169| 51.4k| } _ZN4bssl4SpanIhEC2Ev: 126| 1.45M| constexpr Span() : Span(nullptr, 0) {} _ZNK4bssl4SpanIhE5emptyEv: 144| 719k| constexpr bool empty() const { return size_ == 0; } _ZN4bssl4SpanIKhEC2ILm2EEERAT__S1_: 130| 5.66k| constexpr Span(T (&array)[N]) : Span(array, N) {} _ZNK4bssl4SpanIKbE4sizeEv: 143| 8| constexpr size_t size() const { return size_; } _ZN4bssl4SpanIKbEC2INS_5ArrayIbEEvS5_EERKT_: 135| 4| : data_(container.data()), size_(container.size()) {} _ZNK4bssl4SpanIKbE5beginEv: 146| 4| constexpr iterator begin() const { return data_; } _ZNK4bssl4SpanIKbE3endEv: 148| 4| constexpr iterator end() const { return data_ + size_; } _ZN4bssl4SpanIKtEC2ILm4EEERAT__S1_: 130| 338k| constexpr Span(T (&array)[N]) : Span(array, N) {} _ZN4bssl4SpanIKcEC2Ev: 126| 123| constexpr Span() : Span(nullptr, 0) {} _ZN4bssl4SpanIKcEC2EPS1_m: 127| 246| constexpr Span(T *ptr, size_t len) : data_(ptr), size_(len) {} _ZN4bssl4SpanIKcEC2ILm34EEERAT__S1_: 130| 123| constexpr Span(T (&array)[N]) : Span(array, N) {} _ZNK4bssl4SpanIKcE4dataEv: 142| 123| constexpr T *data() const { return data_; } _ZNK4bssl4SpanIKcE4sizeEv: 143| 123| constexpr size_t size() const { return size_; } _ZN4bssl4SpanIhEC2ILm80EEERAT__h: 130| 704| constexpr Span(T (&array)[N]) : Span(array, N) {} _ZNK4bssl4SpanIhE5firstEm: 184| 1.40k| constexpr Span first(size_t len) const { 185| 1.40k| if (len > size_) { ------------------ | Branch (185:9): [True: 0, False: 1.40k] ------------------ 186| 0| abort(); 187| 0| } 188| 1.40k| return Span(data_, len); 189| 1.40k| } _ZN4bssl4SpanIhEC2ILm24EEERAT__h: 130| 704| constexpr Span(T (&array)[N]) : Span(array, N) {} _ZNK4bssl4SpanIhE4backEv: 157| 2.82k| constexpr T &back() const { 158| 2.82k| if (size_ == 0) { ------------------ | Branch (158:9): [True: 0, False: 2.82k] ------------------ 159| 0| abort(); 160| 0| } 161| 2.82k| return data_[size_ - 1]; 162| 2.82k| } sk_void_new_null: 408| 2.99k| OPENSSL_INLINE STACK_OF(name) *sk_##name##_new_null(void) { \ 409| 2.99k| return (STACK_OF(name) *)OPENSSL_sk_new_null(); \ 410| 2.99k| } \ sk_void_num: 412| 2.99k| OPENSSL_INLINE size_t sk_##name##_num(const STACK_OF(name) *sk) { \ 413| 2.99k| return OPENSSL_sk_num((const OPENSSL_STACK *)sk); \ 414| 2.99k| } \ sk_void_set: 426| 2.99k| ptrtype p) { \ 427| 2.99k| return (ptrtype)OPENSSL_sk_set((OPENSSL_STACK *)sk, i, (void *)p); \ 428| 2.99k| } \ sk_void_free: 430| 2.99k| OPENSSL_INLINE void sk_##name##_free(STACK_OF(name) *sk) { \ 431| 2.99k| OPENSSL_sk_free((OPENSSL_STACK *)sk); \ 432| 2.99k| } \ sk_void_push: 472| 2.99k| OPENSSL_INLINE size_t sk_##name##_push(STACK_OF(name) *sk, ptrtype p) { \ 473| 2.99k| return OPENSSL_sk_push((OPENSSL_STACK *)sk, (void *)p); \ 474| 2.99k| } \ sk_OPENSSL_STRING_pop_free: 435| 22.8k| sk_##name##_free_func free_func) { \ 436| 22.8k| OPENSSL_sk_pop_free_ex((OPENSSL_STACK *)sk, sk_##name##_call_free_func, \ 437| 22.8k| (OPENSSL_sk_free_func)free_func); \ 438| 22.8k| } \ sk_ASN1_OBJECT_pop_free: 435| 22.8k| sk_##name##_free_func free_func) { \ 436| 22.8k| OPENSSL_sk_pop_free_ex((OPENSSL_STACK *)sk, sk_##name##_call_free_func, \ 437| 22.8k| (OPENSSL_sk_free_func)free_func); \ 438| 22.8k| } \ sk_CRYPTO_BUFFER_call_copy_func: 387| 72.7k| OPENSSL_sk_copy_func copy_func, const void *ptr) { \ 388| 72.7k| return (void *)((sk_##name##_copy_func)copy_func)((constptrtype)ptr); \ 389| 72.7k| } \ sk_CRYPTO_BUFFER_new_null: 408| 96.6k| OPENSSL_INLINE STACK_OF(name) *sk_##name##_new_null(void) { \ 409| 96.6k| return (STACK_OF(name) *)OPENSSL_sk_new_null(); \ 410| 96.6k| } \ sk_CRYPTO_BUFFER_num: 412| 525k| OPENSSL_INLINE size_t sk_##name##_num(const STACK_OF(name) *sk) { \ 413| 525k| return OPENSSL_sk_num((const OPENSSL_STACK *)sk); \ 414| 525k| } \ sk_CRYPTO_BUFFER_value: 421| 263k| size_t i) { \ 422| 263k| return (ptrtype)OPENSSL_sk_value((const OPENSSL_STACK *)sk, i); \ 423| 263k| } \ sk_CRYPTO_BUFFER_set: 426| 2| ptrtype p) { \ 427| 2| return (ptrtype)OPENSSL_sk_set((OPENSSL_STACK *)sk, i, (void *)p); \ 428| 2| } \ sk_CRYPTO_BUFFER_push: 472| 2| OPENSSL_INLINE size_t sk_##name##_push(STACK_OF(name) *sk, ptrtype p) { \ 473| 2| return OPENSSL_sk_push((OPENSSL_STACK *)sk, (void *)p); \ 474| 2| } \ sk_CRYPTO_BUFFER_deep_copy: 500| 72.7k| sk_##name##_free_func free_func) { \ 501| 72.7k| return (STACK_OF(name) *)OPENSSL_sk_deep_copy( \ 502| 72.7k| (const OPENSSL_STACK *)sk, sk_##name##_call_copy_func, \ 503| 72.7k| (OPENSSL_sk_copy_func)copy_func, sk_##name##_call_free_func, \ 504| 72.7k| (OPENSSL_sk_free_func)free_func); \ 505| 72.7k| } \ sk_X509_call_free_func: 382| 122k| OPENSSL_sk_free_func free_func, void *ptr) { \ 383| 122k| ((sk_##name##_free_func)free_func)((ptrtype)ptr); \ 384| 122k| } \ sk_X509_new_null: 408| 73.0k| OPENSSL_INLINE STACK_OF(name) *sk_##name##_new_null(void) { \ 409| 73.0k| return (STACK_OF(name) *)OPENSSL_sk_new_null(); \ 410| 73.0k| } \ sk_X509_num: 412| 108k| OPENSSL_INLINE size_t sk_##name##_num(const STACK_OF(name) *sk) { \ 413| 108k| return OPENSSL_sk_num((const OPENSSL_STACK *)sk); \ 414| 108k| } \ sk_X509_value: 421| 55.8k| size_t i) { \ 422| 55.8k| return (ptrtype)OPENSSL_sk_value((const OPENSSL_STACK *)sk, i); \ 423| 55.8k| } \ sk_X509_pop_free: 435| 427k| sk_##name##_free_func free_func) { \ 436| 427k| OPENSSL_sk_pop_free_ex((OPENSSL_STACK *)sk, sk_##name##_call_free_func, \ 437| 427k| (OPENSSL_sk_free_func)free_func); \ 438| 427k| } \ sk_X509_dup: 480| 52.8k| OPENSSL_INLINE STACK_OF(name) *sk_##name##_dup(const STACK_OF(name) *sk) { \ 481| 52.8k| return (STACK_OF(name) *)OPENSSL_sk_dup((const OPENSSL_STACK *)sk); \ 482| 52.8k| } \ sk_X509_NAME_ENTRY_call_free_func: 382| 689k| OPENSSL_sk_free_func free_func, void *ptr) { \ 383| 689k| ((sk_##name##_free_func)free_func)((ptrtype)ptr); \ 384| 689k| } \ sk_X509_NAME_ENTRY_new_null: 408| 622k| OPENSSL_INLINE STACK_OF(name) *sk_##name##_new_null(void) { \ 409| 622k| return (STACK_OF(name) *)OPENSSL_sk_new_null(); \ 410| 622k| } \ sk_X509_NAME_ENTRY_num: 412| 1.31M| OPENSSL_INLINE size_t sk_##name##_num(const STACK_OF(name) *sk) { \ 413| 1.31M| return OPENSSL_sk_num((const OPENSSL_STACK *)sk); \ 414| 1.31M| } \ sk_X509_NAME_ENTRY_value: 421| 689k| size_t i) { \ 422| 689k| return (ptrtype)OPENSSL_sk_value((const OPENSSL_STACK *)sk, i); \ 423| 689k| } \ sk_X509_NAME_ENTRY_set: 426| 344k| ptrtype p) { \ 427| 344k| return (ptrtype)OPENSSL_sk_set((OPENSSL_STACK *)sk, i, (void *)p); \ 428| 344k| } \ sk_X509_NAME_ENTRY_free: 430| 343k| OPENSSL_INLINE void sk_##name##_free(STACK_OF(name) *sk) { \ 431| 343k| OPENSSL_sk_free((OPENSSL_STACK *)sk); \ 432| 343k| } \ sk_X509_NAME_ENTRY_pop_free: 435| 622k| sk_##name##_free_func free_func) { \ 436| 622k| OPENSSL_sk_pop_free_ex((OPENSSL_STACK *)sk, sk_##name##_call_free_func, \ 437| 622k| (OPENSSL_sk_free_func)free_func); \ 438| 622k| } \ sk_X509_NAME_ENTRY_push: 472| 689k| OPENSSL_INLINE size_t sk_##name##_push(STACK_OF(name) *sk, ptrtype p) { \ 473| 689k| return OPENSSL_sk_push((OPENSSL_STACK *)sk, (void *)p); \ 474| 689k| } \ sk_X509_NAME_pop_free: 435| 119k| sk_##name##_free_func free_func) { \ 436| 119k| OPENSSL_sk_pop_free_ex((OPENSSL_STACK *)sk, sk_##name##_call_free_func, \ 437| 119k| (OPENSSL_sk_free_func)free_func); \ 438| 119k| } \ sk_X509_OBJECT_new: 404| 2| OPENSSL_INLINE STACK_OF(name) *sk_##name##_new(sk_##name##_cmp_func comp) { \ 405| 2| return (STACK_OF(name) *)OPENSSL_sk_new((OPENSSL_sk_cmp_func)comp); \ 406| 2| } \ sk_SSL_CIPHER_new_null: 408| 4| OPENSSL_INLINE STACK_OF(name) *sk_##name##_new_null(void) { \ 409| 4| return (STACK_OF(name) *)OPENSSL_sk_new_null(); \ 410| 4| } \ sk_SSL_CIPHER_num: 412| 8| OPENSSL_INLINE size_t sk_##name##_num(const STACK_OF(name) *sk) { \ 413| 8| return OPENSSL_sk_num((const OPENSSL_STACK *)sk); \ 414| 8| } \ sk_SSL_CIPHER_find: 463| 55.0k| size_t *out_index, constptrtype p) { \ 464| 55.0k| return OPENSSL_sk_find((const OPENSSL_STACK *)sk, out_index, \ 465| 55.0k| (const void *)p, sk_##name##_call_cmp_func); \ 466| 55.0k| } \ sk_SSL_CIPHER_push: 472| 78| OPENSSL_INLINE size_t sk_##name##_push(STACK_OF(name) *sk, ptrtype p) { \ 473| 78| return OPENSSL_sk_push((OPENSSL_STACK *)sk, (void *)p); \ 474| 78| } \ _ZN4bssl8internal11DeleterImplI22stack_st_CRYPTO_BUFFERvE4FreeEPS2_: 544| 169k| static void Free(Stack *sk) { 545| | // sk_FOO_pop_free is defined by macros and bound by name, so we cannot 546| | // access it from C++ here. 547| 169k| using Type = typename StackTraits::Type; 548| 169k| OPENSSL_sk_pop_free_ex( 549| 169k| reinterpret_cast(sk), 550| 169k| [](OPENSSL_sk_free_func /* unused */, void *ptr) { 551| 169k| DeleterImpl::Free(reinterpret_cast(ptr)); 552| 169k| }, 553| 169k| nullptr); 554| 169k| } _ZZN4bssl8internal11DeleterImplI22stack_st_CRYPTO_BUFFERvE4FreeEPS2_ENKUlPFvPvES5_E_clES7_S5_: 550| 146k| [](OPENSSL_sk_free_func /* unused */, void *ptr) { 551| 146k| DeleterImpl::Free(reinterpret_cast(ptr)); 552| 146k| }, _Z5beginI19stack_st_SSL_CIPHERENSt3__19enable_ifIXsr11StackTraitsIT_EE8kIsStackEN4bssl8internal17StackIteratorImplIS3_EEE4typeEPKS3_: 617| 56.4k|inline bssl::internal::StackIterator begin(const Stack *sk) { 618| 56.4k| return bssl::internal::StackIterator(sk, 0); 619| 56.4k|} _ZN4bssl8internal17StackIteratorImplI19stack_st_SSL_CIPHEREC2EPKS2_m: 563| 112k| StackIteratorImpl(const Stack *sk, size_t idx) : sk_(sk), idx_(idx) {} _Z3endI19stack_st_SSL_CIPHERENSt3__19enable_ifIXsr11StackTraitsIT_EE8kIsStackEN4bssl8internal17StackIteratorImplIS3_EEE4typeEPKS3_: 622| 56.4k|inline bssl::internal::StackIterator end(const Stack *sk) { 623| 56.4k| return bssl::internal::StackIterator( 624| 56.4k| sk, OPENSSL_sk_num(reinterpret_cast(sk))); 625| 56.4k|} _ZNK4bssl8internal17StackIteratorImplI19stack_st_SSL_CIPHEREneES3_: 568| 1.18M| bool operator!=(StackIteratorImpl other) const { 569| 1.18M| return !(*this == other); 570| 1.18M| } _ZNK4bssl8internal17StackIteratorImplI19stack_st_SSL_CIPHEREeqES3_: 565| 1.18M| bool operator==(StackIteratorImpl other) const { 566| 1.18M| return sk_ == other.sk_ && idx_ == other.idx_; ------------------ | Branch (566:12): [True: 1.18M, False: 0] | Branch (566:32): [True: 56.4k, False: 1.12M] ------------------ 567| 1.18M| } _ZNK4bssl8internal17StackIteratorImplI19stack_st_SSL_CIPHEREdeEv: 572| 1.12M| Type *operator*() const { 573| 1.12M| return reinterpret_cast( 574| 1.12M| OPENSSL_sk_value(reinterpret_cast(sk_), idx_)); 575| 1.12M| } _ZN4bssl8internal17StackIteratorImplI19stack_st_SSL_CIPHEREppEv: 577| 1.12M| StackIteratorImpl &operator++(/* prefix */) { 578| 1.12M| idx_++; 579| 1.12M| return *this; 580| 1.12M| } _ZN4bssl8internal11DeleterImplI19stack_st_SSL_CIPHERvE4FreeEPS2_: 535| 2| static void Free(Stack *sk) { 536| 2| OPENSSL_sk_free(reinterpret_cast(sk)); 537| 2| } _ZN4bssl11PushToStackI22stack_st_CRYPTO_BUFFEREENSt3__19enable_ifIXntsr8internal11StackTraitsIT_EE8kIsConstEbE4typeEPS4_NS2_10unique_ptrINS_8internal11StackTraitsIS4_E4TypeENS9_7DeleterEEE: 604| 73.3k| UniquePtr::Type> elem) { 605| 73.3k| if (!OPENSSL_sk_push(reinterpret_cast(sk), elem.get())) { ------------------ | Branch (605:7): [True: 0, False: 73.3k] ------------------ 606| 0| return false; 607| 0| } 608| | // OPENSSL_sk_push takes ownership on success. 609| 73.3k| elem.release(); 610| 73.3k| return true; 611| 73.3k|} _Z5beginI22stack_st_CRYPTO_BUFFERENSt3__19enable_ifIXsr11StackTraitsIT_EE8kIsStackEN4bssl8internal17StackIteratorImplIS3_EEE4typeEPKS3_: 617| 101k|inline bssl::internal::StackIterator begin(const Stack *sk) { 618| 101k| return bssl::internal::StackIterator(sk, 0); 619| 101k|} _ZN4bssl8internal17StackIteratorImplI22stack_st_CRYPTO_BUFFEREC2EPKS2_m: 563| 203k| StackIteratorImpl(const Stack *sk, size_t idx) : sk_(sk), idx_(idx) {} _Z3endI22stack_st_CRYPTO_BUFFERENSt3__19enable_ifIXsr11StackTraitsIT_EE8kIsStackEN4bssl8internal17StackIteratorImplIS3_EEE4typeEPKS3_: 622| 101k|inline bssl::internal::StackIterator end(const Stack *sk) { 623| 101k| return bssl::internal::StackIterator( 624| 101k| sk, OPENSSL_sk_num(reinterpret_cast(sk))); 625| 101k|} _ZNK4bssl8internal17StackIteratorImplI22stack_st_CRYPTO_BUFFEREneES3_: 568| 170k| bool operator!=(StackIteratorImpl other) const { 569| 170k| return !(*this == other); 570| 170k| } _ZNK4bssl8internal17StackIteratorImplI22stack_st_CRYPTO_BUFFEREeqES3_: 565| 170k| bool operator==(StackIteratorImpl other) const { 566| 170k| return sk_ == other.sk_ && idx_ == other.idx_; ------------------ | Branch (566:12): [True: 170k, False: 0] | Branch (566:32): [True: 100k, False: 70.4k] ------------------ 567| 170k| } _ZNK4bssl8internal17StackIteratorImplI22stack_st_CRYPTO_BUFFEREdeEv: 572| 70.4k| Type *operator*() const { 573| 70.4k| return reinterpret_cast( 574| 70.4k| OPENSSL_sk_value(reinterpret_cast(sk_), idx_)); 575| 70.4k| } _ZN4bssl8internal17StackIteratorImplI22stack_st_CRYPTO_BUFFEREppEv: 577| 69.1k| StackIteratorImpl &operator++(/* prefix */) { 578| 69.1k| idx_++; 579| 69.1k| return *this; 580| 69.1k| } _ZN4bssl8internal11DeleterImplI13stack_st_X509vE4FreeEPS2_: 544| 1.95k| static void Free(Stack *sk) { 545| | // sk_FOO_pop_free is defined by macros and bound by name, so we cannot 546| | // access it from C++ here. 547| 1.95k| using Type = typename StackTraits::Type; 548| 1.95k| OPENSSL_sk_pop_free_ex( 549| 1.95k| reinterpret_cast(sk), 550| 1.95k| [](OPENSSL_sk_free_func /* unused */, void *ptr) { 551| 1.95k| DeleterImpl::Free(reinterpret_cast(ptr)); 552| 1.95k| }, 553| 1.95k| nullptr); 554| 1.95k| } _ZZN4bssl8internal11DeleterImplI13stack_st_X509vE4FreeEPS2_ENKUlPFvPvES5_E_clES7_S5_: 550| 53| [](OPENSSL_sk_free_func /* unused */, void *ptr) { 551| 53| DeleterImpl::Free(reinterpret_cast(ptr)); 552| 53| }, _ZN4bssl11PushToStackI13stack_st_X509EENSt3__19enable_ifIXntsr8internal11StackTraitsIT_EE8kIsConstEbE4typeEPS4_NS2_10unique_ptrINS_8internal11StackTraitsIS4_E4TypeENS9_7DeleterEEE: 604| 70.2k| UniquePtr::Type> elem) { 605| 70.2k| if (!OPENSSL_sk_push(reinterpret_cast(sk), elem.get())) { ------------------ | Branch (605:7): [True: 0, False: 70.2k] ------------------ 606| 0| return false; 607| 0| } 608| | // OPENSSL_sk_push takes ownership on success. 609| 70.2k| elem.release(); 610| 70.2k| return true; 611| 70.2k|} sk_ASN1_VALUE_new_null: 408| 551k| OPENSSL_INLINE STACK_OF(name) *sk_##name##_new_null(void) { \ 409| 551k| return (STACK_OF(name) *)OPENSSL_sk_new_null(); \ 410| 551k| } \ sk_ASN1_VALUE_num: 412| 3.79M| OPENSSL_INLINE size_t sk_##name##_num(const STACK_OF(name) *sk) { \ 413| 3.79M| return OPENSSL_sk_num((const OPENSSL_STACK *)sk); \ 414| 3.79M| } \ sk_ASN1_VALUE_value: 421| 1.92M| size_t i) { \ 422| 1.92M| return (ptrtype)OPENSSL_sk_value((const OPENSSL_STACK *)sk, i); \ 423| 1.92M| } \ sk_ASN1_VALUE_free: 430| 212k| OPENSSL_INLINE void sk_##name##_free(STACK_OF(name) *sk) { \ 431| 212k| OPENSSL_sk_free((OPENSSL_STACK *)sk); \ 432| 212k| } \ sk_ASN1_VALUE_push: 472| 887k| OPENSSL_INLINE size_t sk_##name##_push(STACK_OF(name) *sk, ptrtype p) { \ 473| 887k| return OPENSSL_sk_push((OPENSSL_STACK *)sk, (void *)p); \ 474| 887k| } \ sk_X509_LOOKUP_new_null: 408| 2| OPENSSL_INLINE STACK_OF(name) *sk_##name##_new_null(void) { \ 409| 2| return (STACK_OF(name) *)OPENSSL_sk_new_null(); \ 410| 2| } \ _Z31sk_STACK_OF_X509_NAME_ENTRY_numPK33stack_st_STACK_OF_X509_NAME_ENTRY: 412| 482k| OPENSSL_INLINE size_t sk_##name##_num(const STACK_OF(name) *sk) { \ 413| 482k| return OPENSSL_sk_num((const OPENSSL_STACK *)sk); \ 414| 482k| } \ _Z33sk_STACK_OF_X509_NAME_ENTRY_valuePK33stack_st_STACK_OF_X509_NAME_ENTRYm: 421| 343k| size_t i) { \ 422| 343k| return (ptrtype)OPENSSL_sk_value((const OPENSSL_STACK *)sk, i); \ 423| 343k| } \ _Z36sk_STACK_OF_X509_NAME_ENTRY_new_nullv: 408| 139k| OPENSSL_INLINE STACK_OF(name) *sk_##name##_new_null(void) { \ 409| 139k| return (STACK_OF(name) *)OPENSSL_sk_new_null(); \ 410| 139k| } \ _Z32sk_STACK_OF_X509_NAME_ENTRY_pushP33stack_st_STACK_OF_X509_NAME_ENTRYP24stack_st_X509_NAME_ENTRY: 472| 343k| OPENSSL_INLINE size_t sk_##name##_push(STACK_OF(name) *sk, ptrtype p) { \ 473| 343k| return OPENSSL_sk_push((OPENSSL_STACK *)sk, (void *)p); \ 474| 343k| } \ _Z36sk_STACK_OF_X509_NAME_ENTRY_pop_freeP33stack_st_STACK_OF_X509_NAME_ENTRYPFvP24stack_st_X509_NAME_ENTRYE: 435| 278k| sk_##name##_free_func free_func) { \ 436| 278k| OPENSSL_sk_pop_free_ex((OPENSSL_STACK *)sk, sk_##name##_call_free_func, \ 437| 278k| (OPENSSL_sk_free_func)free_func); \ 438| 278k| } \ _Z42sk_STACK_OF_X509_NAME_ENTRY_call_free_funcPFvPvES_: 382| 686k| OPENSSL_sk_free_func free_func, void *ptr) { \ 383| 686k| ((sk_##name##_free_func)free_func)((ptrtype)ptr); \ 384| 686k| } \ SSL_get_srtp_profiles: 99| 56.4k|const STACK_OF(SRTP_PROTECTION_PROFILE) *SSL_get_srtp_profiles(const SSL *ssl) { 100| 56.4k| if (ssl == nullptr) { ------------------ | Branch (100:7): [True: 0, False: 56.4k] ------------------ 101| 0| return nullptr; 102| 0| } 103| | 104| 56.4k| if (ssl->config == nullptr) { ------------------ | Branch (104:7): [True: 0, False: 56.4k] ------------------ 105| 0| assert(0); 106| 0| return nullptr; 107| 0| } 108| | 109| 56.4k| return ssl->config->srtp_profiles != nullptr ------------------ | Branch (109:10): [True: 0, False: 56.4k] ------------------ 110| 56.4k| ? ssl->config->srtp_profiles.get() 111| 56.4k| : ssl->ctx->srtp_profiles.get(); 112| 56.4k|} _ZN4bssl21ssl_select_ech_configEPNS_13SSL_HANDSHAKEENS_4SpanIhEEPm: 645| 56.3k| size_t *out_enc_len) { 646| 56.3k| *out_enc_len = 0; 647| 56.3k| if (hs->max_version < TLS1_3_VERSION) { ------------------ | | 545| 56.3k|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (647:7): [True: 0, False: 56.3k] ------------------ 648| | // ECH requires TLS 1.3. 649| 0| return true; 650| 0| } 651| | 652| 56.3k| if (!hs->config->client_ech_config_list.empty()) { ------------------ | Branch (652:7): [True: 0, False: 56.3k] ------------------ 653| 0| CBS cbs = CBS(hs->config->client_ech_config_list); 654| 0| CBS child; 655| 0| if (!CBS_get_u16_length_prefixed(&cbs, &child) || // ------------------ | Branch (655:9): [True: 0, False: 0] ------------------ 656| 0| CBS_len(&child) == 0 || // ------------------ | Branch (656:9): [True: 0, False: 0] ------------------ 657| 0| CBS_len(&cbs) > 0) { ------------------ | Branch (657:9): [True: 0, False: 0] ------------------ 658| 0| return false; 659| 0| } 660| | // Look for the first ECHConfig with supported parameters. 661| 0| while (CBS_len(&child) > 0) { ------------------ | Branch (661:12): [True: 0, False: 0] ------------------ 662| 0| ECHConfig ech_config; 663| 0| bool supported; 664| 0| if (!parse_ech_config(&child, &ech_config, &supported, ------------------ | Branch (664:11): [True: 0, False: 0] ------------------ 665| 0| /*all_extensions_mandatory=*/false)) { 666| 0| return false; 667| 0| } 668| 0| const EVP_HPKE_KEM *kem = EVP_hpke_x25519_hkdf_sha256(); 669| 0| const EVP_HPKE_KDF *kdf; 670| 0| const EVP_HPKE_AEAD *aead; 671| 0| if (supported && // ------------------ | Branch (671:11): [True: 0, False: 0] ------------------ 672| 0| ech_config.kem_id == EVP_HPKE_DHKEM_X25519_HKDF_SHA256 && ------------------ | | 44| 0|#define EVP_HPKE_DHKEM_X25519_HKDF_SHA256 0x0020 ------------------ | Branch (672:11): [True: 0, False: 0] ------------------ 673| 0| select_ech_cipher_suite(&kdf, &aead, ech_config.cipher_suites, ------------------ | Branch (673:11): [True: 0, False: 0] ------------------ 674| 0| hs->ssl->config->aes_hw_override ------------------ | Branch (674:35): [True: 0, False: 0] ------------------ 675| 0| ? hs->ssl->config->aes_hw_override_value 676| 0| : EVP_has_aes_hardware())) { 677| 0| ScopedCBB info; 678| 0| static const uint8_t kInfoLabel[] = "tls ech"; // includes trailing NUL 679| 0| if (!CBB_init(info.get(), sizeof(kInfoLabel) + ech_config.raw.size()) || ------------------ | Branch (679:13): [True: 0, False: 0] ------------------ 680| 0| !CBB_add_bytes(info.get(), kInfoLabel, sizeof(kInfoLabel)) || ------------------ | Branch (680:13): [True: 0, False: 0] ------------------ 681| 0| !CBB_add_bytes(info.get(), ech_config.raw.data(), ------------------ | Branch (681:13): [True: 0, False: 0] ------------------ 682| 0| ech_config.raw.size())) { 683| 0| return false; 684| 0| } 685| | 686| 0| if (!EVP_HPKE_CTX_setup_sender( ------------------ | Branch (686:13): [True: 0, False: 0] ------------------ 687| 0| hs->ech_hpke_ctx.get(), out_enc.data(), out_enc_len, 688| 0| out_enc.size(), kem, kdf, aead, ech_config.public_key.data(), 689| 0| ech_config.public_key.size(), CBB_data(info.get()), 690| 0| CBB_len(info.get())) || 691| 0| !hs->inner_transcript.Init()) { ------------------ | Branch (691:13): [True: 0, False: 0] ------------------ 692| 0| return false; 693| 0| } 694| | 695| 0| hs->selected_ech_config = MakeUnique(std::move(ech_config)); 696| 0| return hs->selected_ech_config != nullptr; 697| 0| } 698| 0| } 699| 0| } 700| | 701| 56.3k| return true; 702| 56.3k|} _ZN4bssl24ssl_encrypt_client_helloEPNS_13SSL_HANDSHAKEENS_4SpanIKhEE: 776| 56.3k|bool ssl_encrypt_client_hello(SSL_HANDSHAKE *hs, Span enc) { 777| 56.3k| SSL *const ssl = hs->ssl; 778| 56.3k| if (!hs->selected_ech_config) { ------------------ | Branch (778:7): [True: 56.3k, False: 0] ------------------ 779| 56.3k| return setup_ech_grease(hs); 780| 56.3k| } 781| | 782| | // Construct ClientHelloInner and EncodedClientHelloInner. See 783| | // draft-ietf-tls-esni-13, sections 5.1 and 6.1. 784| 0| ScopedCBB cbb, encoded_cbb; 785| 0| CBB body; 786| 0| bool needs_psk_binder; 787| 0| Array hello_inner; 788| 0| if (!ssl->method->init_message(ssl, cbb.get(), &body, SSL3_MT_CLIENT_HELLO) || ------------------ | | 195| 0|#define SSL3_MT_CLIENT_HELLO 1 ------------------ | Branch (788:7): [True: 0, False: 0] ------------------ 789| 0| !CBB_init(encoded_cbb.get(), 256) || ------------------ | Branch (789:7): [True: 0, False: 0] ------------------ 790| 0| !ssl_write_client_hello_without_extensions(hs, &body, ------------------ | Branch (790:7): [True: 0, False: 0] ------------------ 791| 0| ssl_client_hello_inner, 792| 0| /*empty_session_id=*/false) || 793| 0| !ssl_write_client_hello_without_extensions(hs, encoded_cbb.get(), ------------------ | Branch (793:7): [True: 0, False: 0] ------------------ 794| 0| ssl_client_hello_inner, 795| 0| /*empty_session_id=*/true) || 796| 0| !ssl_add_clienthello_tlsext(hs, &body, encoded_cbb.get(), ------------------ | Branch (796:7): [True: 0, False: 0] ------------------ 797| 0| &needs_psk_binder, ssl_client_hello_inner, 798| 0| CBB_len(&body)) || 799| 0| !ssl->method->finish_message(ssl, cbb.get(), &hello_inner)) { ------------------ | Branch (799:7): [True: 0, False: 0] ------------------ 800| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 801| 0| return false; 802| 0| } 803| | 804| 0| if (needs_psk_binder) { ------------------ | Branch (804:7): [True: 0, False: 0] ------------------ 805| 0| size_t binder_len; 806| 0| if (!tls13_write_psk_binder(hs, hs->inner_transcript, Span(hello_inner), ------------------ | Branch (806:9): [True: 0, False: 0] ------------------ 807| 0| &binder_len)) { 808| 0| return false; 809| 0| } 810| | // Also update the EncodedClientHelloInner. 811| 0| auto encoded_binder = 812| 0| Span(const_cast(CBB_data(encoded_cbb.get())), 813| 0| CBB_len(encoded_cbb.get())) 814| 0| .last(binder_len); 815| 0| auto hello_inner_binder = Span(hello_inner).last(binder_len); 816| 0| OPENSSL_memcpy(encoded_binder.data(), hello_inner_binder.data(), 817| 0| binder_len); 818| 0| } 819| | 820| 0| ssl_do_msg_callback(ssl, /*is_write=*/1, SSL3_RT_CLIENT_HELLO_INNER, ------------------ | | 173| 0|#define SSL3_RT_CLIENT_HELLO_INNER 0x101 ------------------ 821| 0| hello_inner); 822| 0| if (!hs->inner_transcript.Update(hello_inner)) { ------------------ | Branch (822:7): [True: 0, False: 0] ------------------ 823| 0| return false; 824| 0| } 825| | 826| | // Pad the EncodedClientHelloInner. See draft-ietf-tls-esni-13, section 6.1.3. 827| 0| size_t padding_len = 0; 828| 0| size_t maximum_name_length = hs->selected_ech_config->maximum_name_length; 829| 0| if (ssl->hostname) { ------------------ | Branch (829:7): [True: 0, False: 0] ------------------ 830| 0| size_t hostname_len = strlen(ssl->hostname.get()); 831| 0| if (hostname_len <= maximum_name_length) { ------------------ | Branch (831:9): [True: 0, False: 0] ------------------ 832| 0| padding_len = maximum_name_length - hostname_len; 833| 0| } 834| 0| } else { 835| | // No SNI. Pad up to |maximum_name_length|, including server_name extension 836| | // overhead. 837| 0| padding_len = 9 + maximum_name_length; 838| 0| } 839| | // Pad the whole thing to a multiple of 32 bytes. 840| 0| padding_len += 31 - ((CBB_len(encoded_cbb.get()) + padding_len - 1) % 32); 841| 0| Array encoded; 842| 0| if (!CBB_add_zeros(encoded_cbb.get(), padding_len) || ------------------ | Branch (842:7): [True: 0, False: 0] ------------------ 843| 0| !CBBFinishArray(encoded_cbb.get(), &encoded)) { ------------------ | Branch (843:7): [True: 0, False: 0] ------------------ 844| 0| return false; 845| 0| } 846| | 847| | // Encrypt |encoded|. See draft-ietf-tls-esni-13, section 6.1.1. First, 848| | // assemble the extension with a placeholder value for ClientHelloOuterAAD. 849| | // See draft-ietf-tls-esni-13, section 5.2. 850| 0| const EVP_HPKE_KDF *kdf = EVP_HPKE_CTX_kdf(hs->ech_hpke_ctx.get()); 851| 0| const EVP_HPKE_AEAD *aead = EVP_HPKE_CTX_aead(hs->ech_hpke_ctx.get()); 852| 0| size_t payload_len = encoded.size() + aead_overhead(aead); 853| 0| CBB enc_cbb, payload_cbb; 854| 0| if (!CBB_init(cbb.get(), 256) || ------------------ | Branch (854:7): [True: 0, False: 0] ------------------ 855| 0| !CBB_add_u16(cbb.get(), EVP_HPKE_KDF_id(kdf)) || ------------------ | Branch (855:7): [True: 0, False: 0] ------------------ 856| 0| !CBB_add_u16(cbb.get(), EVP_HPKE_AEAD_id(aead)) || ------------------ | Branch (856:7): [True: 0, False: 0] ------------------ 857| 0| !CBB_add_u8(cbb.get(), hs->selected_ech_config->config_id) || ------------------ | Branch (857:7): [True: 0, False: 0] ------------------ 858| 0| !CBB_add_u16_length_prefixed(cbb.get(), &enc_cbb) || ------------------ | Branch (858:7): [True: 0, False: 0] ------------------ 859| 0| !CBB_add_bytes(&enc_cbb, enc.data(), enc.size()) || ------------------ | Branch (859:7): [True: 0, False: 0] ------------------ 860| 0| !CBB_add_u16_length_prefixed(cbb.get(), &payload_cbb) || ------------------ | Branch (860:7): [True: 0, False: 0] ------------------ 861| 0| !CBB_add_zeros(&payload_cbb, payload_len) || ------------------ | Branch (861:7): [True: 0, False: 0] ------------------ 862| 0| !CBBFinishArray(cbb.get(), &hs->ech_client_outer)) { ------------------ | Branch (862:7): [True: 0, False: 0] ------------------ 863| 0| return false; 864| 0| } 865| | 866| | // Construct ClientHelloOuterAAD. 867| | // TODO(https://crbug.com/boringssl/275): This ends up constructing the 868| | // ClientHelloOuter twice. Instead, reuse |aad| for the ClientHello, now that 869| | // draft-12 made the length prefixes match. 870| 0| bssl::ScopedCBB aad; 871| 0| if (!CBB_init(aad.get(), 256) || ------------------ | Branch (871:7): [True: 0, False: 0] ------------------ 872| 0| !ssl_write_client_hello_without_extensions(hs, aad.get(), ------------------ | Branch (872:7): [True: 0, False: 0] ------------------ 873| 0| ssl_client_hello_outer, 874| 0| /*empty_session_id=*/false) || 875| 0| !ssl_add_clienthello_tlsext(hs, aad.get(), /*out_encoded=*/nullptr, ------------------ | Branch (875:7): [True: 0, False: 0] ------------------ 876| 0| &needs_psk_binder, ssl_client_hello_outer, 877| 0| CBB_len(aad.get()))) { 878| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 879| 0| return false; 880| 0| } 881| | 882| | // ClientHelloOuter may not require a PSK binder. Otherwise, we have a 883| | // circular dependency. 884| 0| assert(!needs_psk_binder); 885| | 886| | // Replace the payload in |hs->ech_client_outer| with the encrypted value. 887| 0| auto payload_span = Span(hs->ech_client_outer).last(payload_len); 888| 0| if (CRYPTO_fuzzer_mode_enabled()) { ------------------ | Branch (888:7): [True: 0, False: 0] ------------------ 889| | // In fuzzer mode, the server expects a cleartext payload. 890| 0| assert(payload_span.size() == encoded.size()); 891| 0| OPENSSL_memcpy(payload_span.data(), encoded.data(), encoded.size()); 892| 0| } else { 893| 0| if (!EVP_HPKE_CTX_seal(hs->ech_hpke_ctx.get(), payload_span.data(), ------------------ | Branch (893:9): [True: 0, False: 0] ------------------ 894| 0| &payload_len, payload_span.size(), encoded.data(), 895| 0| encoded.size(), CBB_data(aad.get()), 896| 0| CBB_len(aad.get())) || 897| 0| payload_len != payload_span.size()) { ------------------ | Branch (897:9): [True: 0, False: 0] ------------------ 898| 0| return false; 899| 0| } 900| 0| } 901| | 902| 0| return true; 903| 0|} SSL_get0_ech_name_override: 931| 2.99k| size_t *out_name_len) { 932| | // When ECH is rejected, we use the public name. Note that, if 933| | // |SSL_CTX_set_reverify_on_resume| is enabled, we reverify the certificate 934| | // before the 0-RTT point. If also offering ECH, we verify as if 935| | // ClientHelloInner was accepted and do not override. This works because, at 936| | // this point, |ech_status| will be |ssl_ech_none|. See the 937| | // ECH-Client-Reject-EarlyDataReject-OverrideNameOnRetry tests in runner.go. 938| 2.99k| const SSL_HANDSHAKE *hs = ssl->s3->hs.get(); 939| 2.99k| if (!ssl->server && hs && ssl->s3->ech_status == ssl_ech_rejected) { ------------------ | Branch (939:7): [True: 2.99k, False: 0] | Branch (939:23): [True: 2.99k, False: 0] | Branch (939:29): [True: 0, False: 2.99k] ------------------ 940| 0| *out_name = reinterpret_cast( 941| 0| hs->selected_ech_config->public_name.data()); 942| 0| *out_name_len = hs->selected_ech_config->public_name.size(); 943| 2.99k| } else { 944| 2.99k| *out_name = nullptr; 945| 2.99k| *out_name_len = 0; 946| 2.99k| } 947| 2.99k|} encrypted_client_hello.cc:_ZN4bsslL16setup_ech_greaseEPNS_13SSL_HANDSHAKEE: 722| 56.3k|static bool setup_ech_grease(SSL_HANDSHAKE *hs) { 723| 56.3k| assert(!hs->selected_ech_config); 724| 56.3k| if (hs->max_version < TLS1_3_VERSION || !hs->config->ech_grease_enabled) { ------------------ | | 545| 112k|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (724:7): [True: 0, False: 56.3k] | Branch (724:43): [True: 56.3k, False: 0] ------------------ 725| 56.3k| return true; 726| 56.3k| } 727| | 728| 0| const uint16_t kdf_id = EVP_HPKE_HKDF_SHA256; ------------------ | | 81| 0|#define EVP_HPKE_HKDF_SHA256 0x0001 ------------------ 729| 0| const bool has_aes_hw = hs->ssl->config->aes_hw_override ------------------ | Branch (729:27): [True: 0, False: 0] ------------------ 730| 0| ? hs->ssl->config->aes_hw_override_value 731| 0| : EVP_has_aes_hardware(); 732| 0| const EVP_HPKE_AEAD *aead = 733| 0| has_aes_hw ? EVP_hpke_aes_128_gcm() : EVP_hpke_chacha20_poly1305(); ------------------ | Branch (733:7): [True: 0, False: 0] ------------------ 734| 0| static_assert(ssl_grease_ech_config_id < sizeof(hs->grease_seed), 735| 0| "hs->grease_seed is too small"); 736| 0| uint8_t config_id = hs->grease_seed[ssl_grease_ech_config_id]; 737| | 738| 0| uint8_t enc[X25519_PUBLIC_VALUE_LEN]; 739| 0| uint8_t private_key_unused[X25519_PRIVATE_KEY_LEN]; 740| 0| X25519_keypair(enc, private_key_unused); 741| | 742| | // To determine a plausible length for the payload, we estimate the size of a 743| | // typical EncodedClientHelloInner without resumption: 744| | // 745| | // 2+32+1+2 version, random, legacy_session_id, legacy_compression_methods 746| | // 2+4*2 cipher_suites (three TLS 1.3 ciphers, GREASE) 747| | // 2 extensions prefix 748| | // 5 inner encrypted_client_hello 749| | // 4+1+2*2 supported_versions (TLS 1.3, GREASE) 750| | // 4+1+10*2 outer_extensions (key_share, sigalgs, sct, alpn, 751| | // supported_groups, status_request, psk_key_exchange_modes, 752| | // compress_certificate, GREASE x2) 753| | // 754| | // The server_name extension has an overhead of 9 bytes. For now, arbitrarily 755| | // estimate maximum_name_length to be between 32 and 100 bytes. Then round up 756| | // to a multiple of 32, to match draft-ietf-tls-esni-13, section 6.1.3. 757| 0| const size_t payload_len = 758| 0| 32 * random_size(128 / 32, 224 / 32) + aead_overhead(aead); 759| 0| bssl::ScopedCBB cbb; 760| 0| CBB enc_cbb, payload_cbb; 761| 0| uint8_t *payload; 762| 0| if (!CBB_init(cbb.get(), 256) || !CBB_add_u16(cbb.get(), kdf_id) || ------------------ | Branch (762:7): [True: 0, False: 0] | Branch (762:36): [True: 0, False: 0] ------------------ 763| 0| !CBB_add_u16(cbb.get(), EVP_HPKE_AEAD_id(aead)) || ------------------ | Branch (763:7): [True: 0, False: 0] ------------------ 764| 0| !CBB_add_u8(cbb.get(), config_id) || ------------------ | Branch (764:7): [True: 0, False: 0] ------------------ 765| 0| !CBB_add_u16_length_prefixed(cbb.get(), &enc_cbb) || ------------------ | Branch (765:7): [True: 0, False: 0] ------------------ 766| 0| !CBB_add_bytes(&enc_cbb, enc, sizeof(enc)) || ------------------ | Branch (766:7): [True: 0, False: 0] ------------------ 767| 0| !CBB_add_u16_length_prefixed(cbb.get(), &payload_cbb) || ------------------ | Branch (767:7): [True: 0, False: 0] ------------------ 768| 0| !CBB_add_space(&payload_cbb, &payload, payload_len) || ------------------ | Branch (768:7): [True: 0, False: 0] ------------------ 769| 0| !RAND_bytes(payload, payload_len) || ------------------ | Branch (769:7): [True: 0, False: 0] ------------------ 770| 0| !CBBFinishArray(cbb.get(), &hs->ech_client_outer)) { ------------------ | Branch (770:7): [True: 0, False: 0] ------------------ 771| 0| return false; 772| 0| } 773| 0| return true; 774| 0|} _ZN4bssl18tls1_get_grouplistEPKNS_13SSL_HANDSHAKEE: 208| 178k|Span tls1_get_grouplist(const SSL_HANDSHAKE *hs) { 209| 178k| if (!hs->config->supported_group_list.empty()) { ------------------ | Branch (209:7): [True: 178k, False: 0] ------------------ 210| 178k| return hs->config->supported_group_list; 211| 178k| } 212| 0| return Span(kDefaultGroups); 213| 178k|} _ZN4bssl19tls1_check_group_idEPKNS_13SSL_HANDSHAKEEt: 254| 66.0k|bool tls1_check_group_id(const SSL_HANDSHAKE *hs, uint16_t group_id) { 255| 66.0k| if (is_post_quantum_group(group_id) && ------------------ | Branch (255:7): [True: 29, False: 65.9k] ------------------ 256| 66.0k| ssl_protocol_version(hs->ssl) < TLS1_3_VERSION) { ------------------ | | 545| 29|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (256:7): [True: 1, False: 28] ------------------ 257| | // Post-quantum "groups" require TLS 1.3. 258| 1| return false; 259| 1| } 260| | 261| | // We internally assume zero is never allocated as a group ID. 262| 66.0k| if (group_id == 0) { ------------------ | Branch (262:7): [True: 2, False: 66.0k] ------------------ 263| 2| return false; 264| 2| } 265| | 266| 272k| for (uint16_t supported : tls1_get_grouplist(hs)) { ------------------ | Branch (266:27): [True: 272k, False: 27] ------------------ 267| 272k| if (supported == group_id) { ------------------ | Branch (267:9): [True: 65.9k, False: 206k] ------------------ 268| 65.9k| return true; 269| 65.9k| } 270| 272k| } 271| | 272| 27| return false; 273| 66.0k|} _ZN4bssl24tls12_add_verify_sigalgsEPKNS_13SSL_HANDSHAKEEP6cbb_st: 327| 56.4k|bool tls12_add_verify_sigalgs(const SSL_HANDSHAKE *hs, CBB *out) { 328| 507k| for (uint16_t sigalg : tls12_get_verify_sigalgs(hs)) { ------------------ | Branch (328:24): [True: 507k, False: 56.4k] ------------------ 329| 507k| if (!CBB_add_u16(out, sigalg)) { ------------------ | Branch (329:9): [True: 0, False: 507k] ------------------ 330| 0| return false; 331| 0| } 332| 507k| } 333| 56.4k| return true; 334| 56.4k|} _ZN4bssl23tls12_check_peer_sigalgEPKNS_13SSL_HANDSHAKEEPhtP11evp_pkey_st: 337| 50.6k| uint16_t sigalg, EVP_PKEY *pkey) { 338| | // The peer must have selected an algorithm that is consistent with its public 339| | // key, the TLS version, and what we advertised. 340| 50.6k| Span sigalgs = tls12_get_verify_sigalgs(hs); 341| 50.6k| if (std::find(sigalgs.begin(), sigalgs.end(), sigalg) == sigalgs.end() || ------------------ | Branch (341:7): [True: 22, False: 50.6k] ------------------ 342| 50.6k| !ssl_pkey_supports_algorithm(hs->ssl, pkey, sigalg, /*is_verify=*/true)) { ------------------ | Branch (342:7): [True: 7, False: 50.5k] ------------------ 343| 29| OPENSSL_PUT_ERROR(SSL, SSL_R_WRONG_SIGNATURE_TYPE); ------------------ | | 361| 29| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 344| 29| *out_alert = SSL_AD_ILLEGAL_PARAMETER; ------------------ | | 4379| 29|#define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER | | ------------------ | | | | 189| 29|#define SSL3_AD_ILLEGAL_PARAMETER 47 // fatal | | ------------------ ------------------ 345| 29| return false; 346| 29| } 347| | 348| 50.5k| return true; 349| 50.6k|} _ZN4bssl22ssl_is_valid_alpn_listENS_4SpanIKhEE: 1421| 2|bool ssl_is_valid_alpn_list(Span in) { 1422| 2| CBS protocol_name_list = in; 1423| 2| if (CBS_len(&protocol_name_list) == 0) { ------------------ | Branch (1423:7): [True: 0, False: 2] ------------------ 1424| 0| return false; 1425| 0| } 1426| 8| while (CBS_len(&protocol_name_list) > 0) { ------------------ | Branch (1426:10): [True: 6, False: 2] ------------------ 1427| 6| CBS protocol_name; 1428| 6| if (!CBS_get_u8_length_prefixed(&protocol_name_list, &protocol_name) || ------------------ | Branch (1428:9): [True: 0, False: 6] ------------------ 1429| | // Empty protocol names are forbidden. 1430| 6| CBS_len(&protocol_name) == 0) { ------------------ | Branch (1430:9): [True: 0, False: 6] ------------------ 1431| 0| return false; 1432| 0| } 1433| 6| } 1434| 2| return true; 1435| 2|} _ZN4bssl28ssl_is_alpn_protocol_allowedEPKNS_13SSL_HANDSHAKEENS_4SpanIKhEE: 1438| 33| Span protocol) { 1439| 33| if (hs->config->alpn_client_proto_list.empty()) { ------------------ | Branch (1439:7): [True: 0, False: 33] ------------------ 1440| 0| return false; 1441| 0| } 1442| | 1443| 33| if (hs->ssl->ctx->allow_unknown_alpn_protos) { ------------------ | Branch (1443:7): [True: 0, False: 33] ------------------ 1444| 0| return true; 1445| 0| } 1446| | 1447| | // Check that the protocol name is one of the ones we advertised. 1448| 33| return ssl_alpn_list_contains_protocol(hs->config->alpn_client_proto_list, 1449| 33| protocol); 1450| 33|} _ZN4bssl31ssl_alpn_list_contains_protocolENS_4SpanIKhEES2_: 1453| 33| Span protocol) { 1454| 33| CBS cbs = list, candidate; 1455| 128| while (CBS_len(&cbs) > 0) { ------------------ | Branch (1455:10): [True: 97, False: 31] ------------------ 1456| 97| if (!CBS_get_u8_length_prefixed(&cbs, &candidate)) { ------------------ | Branch (1456:9): [True: 0, False: 97] ------------------ 1457| 0| return false; 1458| 0| } 1459| | 1460| 97| if (candidate == protocol) { ------------------ | Branch (1460:9): [True: 2, False: 95] ------------------ 1461| 2| return true; 1462| 2| } 1463| 97| } 1464| | 1465| 31| return false; 1466| 33|} _ZN4bssl20ssl_setup_key_sharesEPNS_13SSL_HANDSHAKEEt: 2199| 56.4k|bool ssl_setup_key_shares(SSL_HANDSHAKE *hs, uint16_t override_group_id) { 2200| 56.4k| SSL *const ssl = hs->ssl; 2201| 56.4k| hs->key_shares[0].reset(); 2202| 56.4k| hs->key_shares[1].reset(); 2203| 56.4k| hs->key_share_bytes.Reset(); 2204| | 2205| | // If offering a PAKE, do not set up key shares. We do not currently support 2206| | // clients offering both PAKE and non-PAKE modes, including resumption. 2207| 56.4k| if (hs->max_version < TLS1_3_VERSION || hs->pake_prover) { ------------------ | | 545| 112k|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (2207:7): [True: 0, False: 56.4k] | Branch (2207:43): [True: 0, False: 56.4k] ------------------ 2208| 0| return true; 2209| 0| } 2210| | 2211| 56.4k| bssl::ScopedCBB cbb; 2212| 56.4k| if (!CBB_init(cbb.get(), 64)) { ------------------ | Branch (2212:7): [True: 0, False: 56.4k] ------------------ 2213| 0| return false; 2214| 0| } 2215| | 2216| 56.4k| if (override_group_id == 0 && ssl->ctx->grease_enabled) { ------------------ | Branch (2216:7): [True: 56.3k, False: 104] | Branch (2216:33): [True: 0, False: 56.3k] ------------------ 2217| | // Add a fake group. See RFC 8701. 2218| 0| if (!CBB_add_u16(cbb.get(), ssl_get_grease_value(hs, ssl_grease_group)) || ------------------ | Branch (2218:9): [True: 0, False: 0] ------------------ 2219| 0| !CBB_add_u16(cbb.get(), 1 /* length */) || ------------------ | Branch (2219:9): [True: 0, False: 0] ------------------ 2220| 0| !CBB_add_u8(cbb.get(), 0 /* one byte key share */)) { ------------------ | Branch (2220:9): [True: 0, False: 0] ------------------ 2221| 0| return false; 2222| 0| } 2223| 0| } 2224| | 2225| 56.4k| uint16_t group_id = override_group_id; 2226| 56.4k| uint16_t second_group_id = 0; 2227| 56.4k| if (override_group_id == 0) { ------------------ | Branch (2227:7): [True: 56.3k, False: 104] ------------------ 2228| | // Predict the most preferred group. 2229| 56.3k| Span groups = tls1_get_grouplist(hs); 2230| 56.3k| if (groups.empty()) { ------------------ | Branch (2230:9): [True: 0, False: 56.3k] ------------------ 2231| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_NO_GROUPS_SPECIFIED); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 2232| 0| return false; 2233| 0| } 2234| | 2235| 56.3k| group_id = groups[0]; 2236| | 2237| | // We'll try to include one post-quantum and one classical initial key 2238| | // share. 2239| 169k| for (size_t i = 1; i < groups.size() && second_group_id == 0; i++) { ------------------ | Branch (2239:24): [True: 169k, False: 0] | Branch (2239:45): [True: 112k, False: 56.3k] ------------------ 2240| 112k| if (is_post_quantum_group(group_id) != is_post_quantum_group(groups[i])) { ------------------ | Branch (2240:11): [True: 56.3k, False: 56.3k] ------------------ 2241| 56.3k| second_group_id = groups[i]; 2242| 56.3k| assert(second_group_id != group_id); 2243| 56.3k| } 2244| 112k| } 2245| 56.3k| } 2246| | 2247| 56.4k| CBB key_exchange; 2248| 56.4k| hs->key_shares[0] = SSLKeyShare::Create(group_id); 2249| 56.4k| if (!hs->key_shares[0] || // ------------------ | Branch (2249:7): [True: 0, False: 56.4k] ------------------ 2250| 56.4k| !CBB_add_u16(cbb.get(), group_id) || ------------------ | Branch (2250:7): [True: 0, False: 56.4k] ------------------ 2251| 56.4k| !CBB_add_u16_length_prefixed(cbb.get(), &key_exchange) || ------------------ | Branch (2251:7): [True: 0, False: 56.4k] ------------------ 2252| 56.4k| !hs->key_shares[0]->Generate(&key_exchange)) { ------------------ | Branch (2252:7): [True: 0, False: 56.4k] ------------------ 2253| 0| return false; 2254| 0| } 2255| | 2256| 56.4k| if (second_group_id != 0) { ------------------ | Branch (2256:7): [True: 56.3k, False: 104] ------------------ 2257| 56.3k| hs->key_shares[1] = SSLKeyShare::Create(second_group_id); 2258| 56.3k| if (!hs->key_shares[1] || // ------------------ | Branch (2258:9): [True: 0, False: 56.3k] ------------------ 2259| 56.3k| !CBB_add_u16(cbb.get(), second_group_id) || ------------------ | Branch (2259:9): [True: 0, False: 56.3k] ------------------ 2260| 56.3k| !CBB_add_u16_length_prefixed(cbb.get(), &key_exchange) || ------------------ | Branch (2260:9): [True: 0, False: 56.3k] ------------------ 2261| 56.3k| !hs->key_shares[1]->Generate(&key_exchange)) { ------------------ | Branch (2261:9): [True: 0, False: 56.3k] ------------------ 2262| 0| return false; 2263| 0| } 2264| 56.3k| } 2265| | 2266| 56.4k| return CBBFinishArray(cbb.get(), &hs->key_share_bytes); 2267| 56.4k|} _ZN4bssl35ssl_ext_key_share_parse_serverhelloEPNS_13SSL_HANDSHAKEEPNS_5ArrayIhEEPhP6cbs_st: 2294| 255| uint8_t *out_alert, CBS *contents) { 2295| 255| if (hs->key_shares[0] == nullptr) { ------------------ | Branch (2295:7): [True: 0, False: 255] ------------------ 2296| | // If we did not offer key shares, the extension should have been rejected 2297| | // as unsolicited. 2298| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 2299| 0| *out_alert = SSL_AD_INTERNAL_ERROR; ------------------ | | 4387| 0|#define SSL_AD_INTERNAL_ERROR TLS1_AD_INTERNAL_ERROR | | ------------------ | | | | 37| 0|#define TLS1_AD_INTERNAL_ERROR 80 | | ------------------ ------------------ 2300| 0| return false; 2301| 0| } 2302| | 2303| 255| CBS ciphertext; 2304| 255| uint16_t group_id; 2305| 255| if (!CBS_get_u16(contents, &group_id) || ------------------ | Branch (2305:7): [True: 0, False: 255] ------------------ 2306| 255| !CBS_get_u16_length_prefixed(contents, &ciphertext) || ------------------ | Branch (2306:7): [True: 10, False: 245] ------------------ 2307| 255| CBS_len(contents) != 0) { ------------------ | Branch (2307:7): [True: 1, False: 244] ------------------ 2308| 11| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); ------------------ | | 361| 11| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 2309| 11| *out_alert = SSL_AD_DECODE_ERROR; ------------------ | | 4382| 11|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 11|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 2310| 11| return false; 2311| 11| } 2312| | 2313| 244| SSLKeyShare *key_share = hs->key_shares[0].get(); 2314| 244| if (key_share->GroupID() != group_id) { ------------------ | Branch (2314:7): [True: 243, False: 1] ------------------ 2315| 243| if (!hs->key_shares[1] || hs->key_shares[1]->GroupID() != group_id) { ------------------ | Branch (2315:9): [True: 3, False: 240] | Branch (2315:31): [True: 6, False: 234] ------------------ 2316| 9| *out_alert = SSL_AD_ILLEGAL_PARAMETER; ------------------ | | 4379| 9|#define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER | | ------------------ | | | | 189| 9|#define SSL3_AD_ILLEGAL_PARAMETER 47 // fatal | | ------------------ ------------------ 2317| 9| OPENSSL_PUT_ERROR(SSL, SSL_R_WRONG_CURVE); ------------------ | | 361| 9| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 2318| 9| return false; 2319| 9| } 2320| 234| key_share = hs->key_shares[1].get(); 2321| 234| } 2322| | 2323| 235| if (!key_share->Decap(out_secret, out_alert, ciphertext)) { ------------------ | Branch (2323:7): [True: 1, False: 234] ------------------ 2324| 1| *out_alert = SSL_AD_INTERNAL_ERROR; ------------------ | | 4387| 1|#define SSL_AD_INTERNAL_ERROR TLS1_AD_INTERNAL_ERROR | | ------------------ | | | | 37| 1|#define TLS1_AD_INTERNAL_ERROR 80 | | ------------------ ------------------ 2325| 1| return false; 2326| 1| } 2327| | 2328| 234| hs->new_session->group_id = group_id; 2329| 234| hs->key_shares[0].reset(); 2330| 234| hs->key_shares[1].reset(); 2331| 234| return true; 2332| 235|} _ZN4bssl21ssl_setup_pake_sharesEPNS_13SSL_HANDSHAKEE: 3084| 56.3k|bool ssl_setup_pake_shares(SSL_HANDSHAKE *hs) { 3085| 56.3k| hs->pake_share_bytes.Reset(); 3086| 56.3k| if (hs->max_version < TLS1_3_VERSION) { ------------------ | | 545| 56.3k|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (3086:7): [True: 0, False: 56.3k] ------------------ 3087| 0| return true; 3088| 0| } 3089| | 3090| 56.3k| const auto &creds = hs->config->cert->credentials; 3091| 56.3k| if (std::none_of(creds.begin(), creds.end(), [](const auto &cred) { ------------------ | Branch (3091:7): [True: 56.3k, False: 0] ------------------ 3092| 56.3k| return cred->type == SSLCredentialType::kSPAKE2PlusV1Client; 3093| 56.3k| })) { 3094| | // If there were no configured PAKE credentials, proceed without filling 3095| | // in the PAKE extension. 3096| 56.3k| return true; 3097| 56.3k| } 3098| | 3099| | // We currently do not support multiple PAKE credentials, or a mix of PAKE and 3100| | // non-PAKE credentials. 3101| 0| if (creds.size() != 1u) { ------------------ | Branch (3101:7): [True: 0, False: 0] ------------------ 3102| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_UNSUPPORTED_CREDENTIAL_LIST); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 3103| 0| return false; 3104| 0| } 3105| 0| SSL_CREDENTIAL *cred = creds[0].get(); 3106| 0| assert(cred->type == SSLCredentialType::kSPAKE2PlusV1Client); 3107| | 3108| 0| hs->pake_prover = MakeUnique(); 3109| 0| uint8_t prover_share[spake2plus::kShareSize]; 3110| 0| if (hs->pake_prover == nullptr || ------------------ | Branch (3110:7): [True: 0, False: 0] ------------------ 3111| 0| !hs->pake_prover->Init(cred->pake_context, cred->client_identity, ------------------ | Branch (3111:7): [True: 0, False: 0] ------------------ 3112| 0| cred->server_identity, cred->password_verifier_w0, 3113| 0| cred->password_verifier_w1) || 3114| 0| !hs->pake_prover->GenerateShare(prover_share)) { ------------------ | Branch (3114:7): [True: 0, False: 0] ------------------ 3115| 0| return false; 3116| 0| } 3117| | 3118| 0| hs->credential = UpRef(cred); 3119| | 3120| 0| bssl::ScopedCBB cbb; 3121| 0| CBB shares, client_identity, server_identity, pake_message; 3122| 0| if (!CBB_init(cbb.get(), 64) || ------------------ | Branch (3122:7): [True: 0, False: 0] ------------------ 3123| 0| !CBB_add_u16_length_prefixed(cbb.get(), &client_identity) || ------------------ | Branch (3123:7): [True: 0, False: 0] ------------------ 3124| 0| !CBB_add_bytes(&client_identity, cred->client_identity.data(), ------------------ | Branch (3124:7): [True: 0, False: 0] ------------------ 3125| 0| cred->client_identity.size()) || 3126| 0| !CBB_add_u16_length_prefixed(cbb.get(), &server_identity) || ------------------ | Branch (3126:7): [True: 0, False: 0] ------------------ 3127| 0| !CBB_add_bytes(&server_identity, cred->server_identity.data(), ------------------ | Branch (3127:7): [True: 0, False: 0] ------------------ 3128| 0| cred->server_identity.size()) || 3129| 0| !CBB_add_u16_length_prefixed(cbb.get(), &shares) || ------------------ | Branch (3129:7): [True: 0, False: 0] ------------------ 3130| 0| !CBB_add_u16(&shares, SSL_PAKE_SPAKE2PLUSV1) || ------------------ | | 3704| 0|#define SSL_PAKE_SPAKE2PLUSV1 0x7d96 ------------------ | Branch (3130:7): [True: 0, False: 0] ------------------ 3131| 0| !CBB_add_u16_length_prefixed(&shares, &pake_message) || ------------------ | Branch (3131:7): [True: 0, False: 0] ------------------ 3132| 0| !CBB_add_bytes(&pake_message, prover_share, sizeof(prover_share))) { ------------------ | Branch (3132:7): [True: 0, False: 0] ------------------ 3133| 0| return false; 3134| 0| } 3135| | 3136| 0| return CBBFinishArray(cbb.get(), &hs->pake_share_bytes); 3137| 0|} _ZN4bssl31ssl_setup_extension_permutationEPNS_13SSL_HANDSHAKEE: 3719| 56.3k|bool ssl_setup_extension_permutation(SSL_HANDSHAKE *hs) { 3720| 56.3k| if (!hs->config->permute_extensions) { ------------------ | Branch (3720:7): [True: 56.3k, False: 0] ------------------ 3721| 56.3k| return true; 3722| 56.3k| } 3723| | 3724| 0| static_assert(kNumExtensions <= UINT8_MAX, 3725| 0| "extensions_permutation type is too small"); 3726| 0| uint32_t seeds[kNumExtensions - 1]; 3727| 0| Array permutation; 3728| 0| if (!RAND_bytes(reinterpret_cast(seeds), sizeof(seeds)) || ------------------ | Branch (3728:7): [True: 0, False: 0] ------------------ 3729| 0| !permutation.InitForOverwrite(kNumExtensions)) { ------------------ | | 3710| 0|#define kNumExtensions (sizeof(kExtensions) / sizeof(struct tls_extension)) ------------------ | Branch (3729:7): [True: 0, False: 0] ------------------ 3730| 0| return false; 3731| 0| } 3732| 0| for (size_t i = 0; i < kNumExtensions; i++) { ------------------ | | 3710| 0|#define kNumExtensions (sizeof(kExtensions) / sizeof(struct tls_extension)) ------------------ | Branch (3732:22): [True: 0, False: 0] ------------------ 3733| 0| permutation[i] = i; 3734| 0| } 3735| 0| for (size_t i = kNumExtensions - 1; i > 0; i--) { ------------------ | | 3710| 0|#define kNumExtensions (sizeof(kExtensions) / sizeof(struct tls_extension)) ------------------ | Branch (3735:39): [True: 0, False: 0] ------------------ 3736| | // Set element |i| to a randomly-selected element 0 <= j <= i. 3737| 0| std::swap(permutation[i], permutation[seeds[i - 1] % (i + 1)]); 3738| 0| } 3739| 0| hs->extension_permutation = std::move(permutation); 3740| 0| return true; 3741| 0|} _ZN4bssl26ssl_add_clienthello_tlsextEPNS_13SSL_HANDSHAKEEP6cbb_stS3_PbNS_23ssl_client_hello_type_tEm: 3878| 56.4k| size_t header_len) { 3879| 56.4k| *out_needs_psk_binder = false; 3880| | 3881| 56.4k| if (type == ssl_client_hello_inner) { ------------------ | Branch (3881:7): [True: 0, False: 56.4k] ------------------ 3882| 0| return ssl_add_clienthello_tlsext_inner(hs, out, out_encoded, 3883| 0| out_needs_psk_binder); 3884| 0| } 3885| | 3886| 56.4k| assert(out_encoded == nullptr); // Only ClientHelloInner needs two outputs. 3887| 56.4k| SSL *const ssl = hs->ssl; 3888| 56.4k| CBB extensions; 3889| 56.4k| if (!CBB_add_u16_length_prefixed(out, &extensions)) { ------------------ | Branch (3889:7): [True: 0, False: 56.4k] ------------------ 3890| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 3891| 0| return false; 3892| 0| } 3893| | 3894| | // Note we may send multiple ClientHellos for DTLS HelloVerifyRequest and TLS 3895| | // 1.3 HelloRetryRequest. For the latter, the extensions may change, so it is 3896| | // important to reset this value. 3897| 56.4k| hs->extensions.sent = 0; 3898| | 3899| | // Add a fake empty extension. See RFC 8701. 3900| 56.4k| if (ssl->ctx->grease_enabled && ------------------ | Branch (3900:7): [True: 0, False: 56.4k] ------------------ 3901| 56.4k| !add_padding_extension( ------------------ | Branch (3901:7): [True: 0, False: 0] ------------------ 3902| 0| &extensions, ssl_get_grease_value(hs, ssl_grease_extension1), 0)) { 3903| 0| return false; 3904| 0| } 3905| | 3906| 56.4k| bool last_was_empty = false; 3907| 1.63M| for (size_t unpermuted = 0; unpermuted < kNumExtensions; unpermuted++) { ------------------ | | 3710| 1.63M|#define kNumExtensions (sizeof(kExtensions) / sizeof(struct tls_extension)) ------------------ | Branch (3907:31): [True: 1.58M, False: 56.4k] ------------------ 3908| 1.58M| size_t i = hs->extension_permutation.empty() ------------------ | Branch (3908:16): [True: 1.58M, False: 0] ------------------ 3909| 1.58M| ? unpermuted 3910| 1.58M| : hs->extension_permutation[unpermuted]; 3911| 1.58M| const size_t len_before = CBB_len(&extensions); 3912| 1.58M| if (!kExtensions[i].add_clienthello(hs, &extensions, &extensions, type)) { ------------------ | Branch (3912:9): [True: 0, False: 1.58M] ------------------ 3913| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_ERROR_ADDING_EXTENSION); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 3914| 0| ERR_add_error_dataf("extension %u", (unsigned)kExtensions[i].value); 3915| 0| return false; 3916| 0| } 3917| | 3918| 1.58M| const size_t bytes_written = CBB_len(&extensions) - len_before; 3919| 1.58M| if (bytes_written != 0) { ------------------ | Branch (3919:9): [True: 744k, False: 835k] ------------------ 3920| 744k| hs->extensions.sent |= (1u << i); 3921| 744k| } 3922| | // If the difference in lengths is only four bytes then the extension had 3923| | // an empty body. 3924| 1.58M| last_was_empty = (bytes_written == 4); 3925| 1.58M| } 3926| | 3927| 56.4k| if (ssl->ctx->grease_enabled) { ------------------ | Branch (3927:7): [True: 0, False: 56.4k] ------------------ 3928| | // Add a fake non-empty extension. See RFC 8701. 3929| 0| if (!add_padding_extension( ------------------ | Branch (3929:9): [True: 0, False: 0] ------------------ 3930| 0| &extensions, ssl_get_grease_value(hs, ssl_grease_extension2), 1)) { 3931| 0| return false; 3932| 0| } 3933| 0| last_was_empty = false; 3934| 0| } 3935| | 3936| | // In cleartext ClientHellos, we add the padding extension to work around 3937| | // bugs. We also apply this padding to ClientHelloOuter, to keep the wire 3938| | // images aligned. 3939| 56.4k| size_t psk_extension_len = ext_pre_shared_key_clienthello_length(hs, type); 3940| 56.4k| if (!SSL_is_dtls(ssl) && !SSL_is_quic(ssl) && ------------------ | Branch (3940:7): [True: 56.4k, False: 0] | Branch (3940:28): [True: 56.4k, False: 0] ------------------ 3941| 56.4k| !ssl->s3->used_hello_retry_request) { ------------------ | Branch (3941:7): [True: 56.3k, False: 96] ------------------ 3942| 56.3k| header_len += 3943| 56.3k| SSL3_HM_HEADER_LENGTH + 2 + CBB_len(&extensions) + psk_extension_len; ------------------ | | 106| 56.3k|#define SSL3_HM_HEADER_LENGTH 4 ------------------ 3944| 56.3k| size_t padding_len = 0; 3945| | 3946| | // The final extension must be non-empty. WebSphere Application 3947| | // Server 7.0 is intolerant to the last extension being zero-length. See 3948| | // https://crbug.com/363583. 3949| 56.3k| if (last_was_empty && psk_extension_len == 0) { ------------------ | Branch (3949:9): [True: 0, False: 56.3k] | Branch (3949:27): [True: 0, False: 0] ------------------ 3950| 0| padding_len = 1; 3951| | // The addition of the padding extension may push us into the F5 bug. 3952| 0| header_len += 4 + padding_len; 3953| 0| } 3954| | 3955| | // Add padding to workaround bugs in F5 terminators. See RFC 7685. 3956| | // 3957| | // NB: because this code works out the length of all existing extensions 3958| | // it MUST always appear last (save for any PSK extension). 3959| 56.3k| if (header_len > 0xff && header_len < 0x200) { ------------------ | Branch (3959:9): [True: 56.3k, False: 0] | Branch (3959:30): [True: 0, False: 56.3k] ------------------ 3960| | // If our calculations already included a padding extension, remove that 3961| | // factor because we're about to change its length. 3962| 0| if (padding_len != 0) { ------------------ | Branch (3962:11): [True: 0, False: 0] ------------------ 3963| 0| header_len -= 4 + padding_len; 3964| 0| } 3965| 0| padding_len = 0x200 - header_len; 3966| | // Extensions take at least four bytes to encode. Always include at least 3967| | // one byte of data if including the extension. WebSphere Application 3968| | // Server 7.0 is intolerant to the last extension being zero-length. See 3969| | // https://crbug.com/363583. 3970| 0| if (padding_len >= 4 + 1) { ------------------ | Branch (3970:11): [True: 0, False: 0] ------------------ 3971| 0| padding_len -= 4; 3972| 0| } else { 3973| 0| padding_len = 1; 3974| 0| } 3975| 0| } 3976| | 3977| 56.3k| if (padding_len != 0 && ------------------ | Branch (3977:9): [True: 0, False: 56.3k] ------------------ 3978| 56.3k| !add_padding_extension(&extensions, TLSEXT_TYPE_padding, padding_len)) { ------------------ | | 68| 0|#define TLSEXT_TYPE_padding 21 ------------------ | Branch (3978:9): [True: 0, False: 0] ------------------ 3979| 0| return false; 3980| 0| } 3981| 56.3k| } 3982| | 3983| | // The PSK extension must be last, including after the padding. 3984| 56.4k| const size_t len_before = CBB_len(&extensions); 3985| 56.4k| if (!ext_pre_shared_key_add_clienthello(hs, &extensions, out_needs_psk_binder, ------------------ | Branch (3985:7): [True: 0, False: 56.4k] ------------------ 3986| 56.4k| type)) { 3987| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 3988| 0| return false; 3989| 0| } 3990| 56.4k| assert(psk_extension_len == CBB_len(&extensions) - len_before); 3991| 56.4k| (void)len_before; // |assert| is omitted in release builds. 3992| | 3993| | // Discard empty extensions blocks. 3994| 56.4k| if (CBB_len(&extensions) == 0) { ------------------ | Branch (3994:7): [True: 0, False: 56.4k] ------------------ 3995| 0| CBB_discard_child(out); 3996| 0| } 3997| | 3998| 56.4k| return CBB_flush(out); 3999| 56.4k|} _ZN4bssl28ssl_parse_serverhello_tlsextEPNS_13SSL_HANDSHAKEEPK6cbs_st: 4243| 55.2k|bool ssl_parse_serverhello_tlsext(SSL_HANDSHAKE *hs, const CBS *cbs) { 4244| 55.2k| SSL *const ssl = hs->ssl; 4245| 55.2k| int alert = SSL_AD_DECODE_ERROR; ------------------ | | 4382| 55.2k|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 55.2k|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 4246| 55.2k| if (!ssl_scan_serverhello_tlsext(hs, cbs, &alert)) { ------------------ | Branch (4246:7): [True: 168, False: 55.0k] ------------------ 4247| 168| ssl_send_alert(ssl, SSL3_AL_FATAL, alert); ------------------ | | 176| 168|#define SSL3_AL_FATAL 2 ------------------ 4248| 168| return false; 4249| 168| } 4250| | 4251| 55.0k| if (!ssl_check_serverhello_tlsext(hs)) { ------------------ | Branch (4251:7): [True: 0, False: 55.0k] ------------------ 4252| 0| return false; 4253| 0| } 4254| | 4255| 55.0k| return true; 4256| 55.0k|} _ZN4bssl23tls1_parse_peer_sigalgsEPNS_13SSL_HANDSHAKEEPK6cbs_st: 4499| 28.1k|bool tls1_parse_peer_sigalgs(SSL_HANDSHAKE *hs, const CBS *in_sigalgs) { 4500| | // Extension ignored for inappropriate versions 4501| 28.1k| if (ssl_protocol_version(hs->ssl) < TLS1_2_VERSION) { ------------------ | | 544| 28.1k|#define TLS1_2_VERSION 0x0303 ------------------ | Branch (4501:7): [True: 0, False: 28.1k] ------------------ 4502| 0| return true; 4503| 0| } 4504| | 4505| | // In all contexts, the signature algorithms list may not be empty. (It may be 4506| | // omitted by clients in TLS 1.2, but then the entire extension is omitted.) 4507| 28.1k| return CBS_len(in_sigalgs) != 0 && ------------------ | Branch (4507:10): [True: 28.1k, False: 3] ------------------ 4508| 28.1k| parse_u16_array(in_sigalgs, &hs->peer_sigalgs); ------------------ | Branch (4508:10): [True: 28.1k, False: 2] ------------------ 4509| 28.1k|} _ZN4bssl35tls1_get_legacy_signature_algorithmEPtPK11evp_pkey_st: 4511| 991|bool tls1_get_legacy_signature_algorithm(uint16_t *out, const EVP_PKEY *pkey) { 4512| 991| switch (EVP_PKEY_id(pkey)) { 4513| 974| case EVP_PKEY_RSA: ------------------ | | 133| 974|#define EVP_PKEY_RSA NID_rsaEncryption | | ------------------ | | | | 72| 974|#define NID_rsaEncryption 6 | | ------------------ ------------------ | Branch (4513:5): [True: 974, False: 17] ------------------ 4514| 974| *out = SSL_SIGN_RSA_PKCS1_MD5_SHA1; ------------------ | | 1151| 974|#define SSL_SIGN_RSA_PKCS1_MD5_SHA1 0xff01 ------------------ 4515| 974| return true; 4516| 15| case EVP_PKEY_EC: ------------------ | | 136| 15|#define EVP_PKEY_EC NID_X9_62_id_ecPublicKey | | ------------------ | | | | 1844| 15|#define NID_X9_62_id_ecPublicKey 408 | | ------------------ ------------------ | Branch (4516:5): [True: 15, False: 976] ------------------ 4517| 15| *out = SSL_SIGN_ECDSA_SHA1; ------------------ | | 1134| 15|#define SSL_SIGN_ECDSA_SHA1 0x0203 ------------------ 4518| 15| return true; 4519| 2| default: ------------------ | Branch (4519:5): [True: 2, False: 989] ------------------ 4520| 2| return false; 4521| 991| } 4522| 991|} _ZN4bssl31tls1_choose_signature_algorithmEPNS_13SSL_HANDSHAKEEPK17ssl_credential_stPt: 4526| 28.0k| uint16_t *out) { 4527| 28.0k| SSL *const ssl = hs->ssl; 4528| 28.0k| if (!cred->UsesPrivateKey()) { ------------------ | Branch (4528:7): [True: 0, False: 28.0k] ------------------ 4529| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_UNKNOWN_CERTIFICATE_TYPE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 4530| 0| return false; 4531| 0| } 4532| | 4533| | // Before TLS 1.2, the signature algorithm isn't negotiated as part of the 4534| | // handshake. 4535| 28.0k| uint16_t version = ssl_protocol_version(ssl); 4536| 28.0k| if (version < TLS1_2_VERSION) { ------------------ | | 544| 28.0k|#define TLS1_2_VERSION 0x0303 ------------------ | Branch (4536:7): [True: 8, False: 28.0k] ------------------ 4537| 8| if (!tls1_get_legacy_signature_algorithm(out, cred->pubkey.get())) { ------------------ | Branch (4537:9): [True: 0, False: 8] ------------------ 4538| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_NO_COMMON_SIGNATURE_ALGORITHMS); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 4539| 0| return false; 4540| 0| } 4541| 8| return true; 4542| 8| } 4543| | 4544| 28.0k| Span peer_sigalgs; 4545| 28.0k| if (cred->type == SSLCredentialType::kDelegated) { ------------------ | Branch (4545:7): [True: 0, False: 28.0k] ------------------ 4546| 0| peer_sigalgs = hs->peer_delegated_credential_sigalgs; 4547| 28.0k| } else { 4548| 28.0k| peer_sigalgs = hs->peer_sigalgs; 4549| 28.0k| if (peer_sigalgs.empty() && version == TLS1_2_VERSION) { ------------------ | | 544| 0|#define TLS1_2_VERSION 0x0303 ------------------ | Branch (4549:9): [True: 0, False: 28.0k] | Branch (4549:33): [True: 0, False: 0] ------------------ 4550| | // If the client didn't specify any signature_algorithms extension, it is 4551| | // interpreted as SHA-1. See 4552| | // http://tools.ietf.org/html/rfc5246#section-7.4.1.4.1 4553| 0| static const uint16_t kTLS12Default[] = {SSL_SIGN_RSA_PKCS1_SHA1, ------------------ | | 1130| 0|#define SSL_SIGN_RSA_PKCS1_SHA1 0x0201 ------------------ 4554| 0| SSL_SIGN_ECDSA_SHA1}; ------------------ | | 1134| 0|#define SSL_SIGN_ECDSA_SHA1 0x0203 ------------------ 4555| 0| peer_sigalgs = kTLS12Default; 4556| 0| } 4557| 28.0k| } 4558| | 4559| 28.0k| Span sigalgs = 4560| 28.0k| cred->sigalgs.empty() ? Span(kSignSignatureAlgorithms) : cred->sigalgs; ------------------ | Branch (4560:7): [True: 28.0k, False: 0] ------------------ 4561| 170k| for (uint16_t sigalg : sigalgs) { ------------------ | Branch (4561:24): [True: 170k, False: 2] ------------------ 4562| 170k| if (!ssl_pkey_supports_algorithm(ssl, cred->pubkey.get(), sigalg, ------------------ | Branch (4562:9): [True: 84.9k, False: 85.9k] ------------------ 4563| 170k| /*is_verify=*/false)) { 4564| 84.9k| continue; 4565| 84.9k| } 4566| | 4567| 85.9k| if (std::find(peer_sigalgs.begin(), peer_sigalgs.end(), sigalg) != ------------------ | Branch (4567:9): [True: 28.0k, False: 57.9k] ------------------ 4568| 85.9k| peer_sigalgs.end()) { 4569| 28.0k| *out = sigalg; 4570| 28.0k| return true; 4571| 28.0k| } 4572| 85.9k| } 4573| | 4574| 2| OPENSSL_PUT_ERROR(SSL, SSL_R_NO_COMMON_SIGNATURE_ALGORITHMS); ------------------ | | 361| 2| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 4575| 2| return false; 4576| 28.0k|} _ZN4bssl21tls1_write_channel_idEPNS_13SSL_HANDSHAKEEP6cbb_st: 4641| 107|bool tls1_write_channel_id(SSL_HANDSHAKE *hs, CBB *cbb) { 4642| 107| uint8_t digest[EVP_MAX_MD_SIZE]; 4643| 107| size_t digest_len; 4644| 107| if (!tls1_channel_id_hash(hs, digest, &digest_len)) { ------------------ | Branch (4644:7): [True: 0, False: 107] ------------------ 4645| 0| return false; 4646| 0| } 4647| | 4648| 107| EC_KEY *ec_key = EVP_PKEY_get0_EC_KEY(hs->config->channel_id_private.get()); 4649| 107| if (ec_key == nullptr) { ------------------ | Branch (4649:7): [True: 0, False: 107] ------------------ 4650| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 4651| 0| return false; 4652| 0| } 4653| | 4654| 107| UniquePtr x(BN_new()), y(BN_new()); 4655| 107| if (!x || !y || ------------------ | Branch (4655:7): [True: 0, False: 107] | Branch (4655:13): [True: 0, False: 107] ------------------ 4656| 107| !EC_POINT_get_affine_coordinates_GFp(EC_KEY_get0_group(ec_key), ------------------ | Branch (4656:7): [True: 0, False: 107] ------------------ 4657| 107| EC_KEY_get0_public_key(ec_key), 4658| 107| x.get(), y.get(), nullptr)) { 4659| 0| return false; 4660| 0| } 4661| | 4662| 107| UniquePtr sig(ECDSA_do_sign(digest, digest_len, ec_key)); 4663| 107| if (!sig) { ------------------ | Branch (4663:7): [True: 0, False: 107] ------------------ 4664| 0| return false; 4665| 0| } 4666| | 4667| 107| CBB child; 4668| 107| if (!CBB_add_u16(cbb, TLSEXT_TYPE_channel_id) || // ------------------ | | 133| 107|#define TLSEXT_TYPE_channel_id 30032 ------------------ | Branch (4668:7): [True: 0, False: 107] ------------------ 4669| 107| !CBB_add_u16_length_prefixed(cbb, &child) || // ------------------ | Branch (4669:7): [True: 0, False: 107] ------------------ 4670| 107| !BN_bn2cbb_padded(&child, 32, x.get()) || // ------------------ | Branch (4670:7): [True: 0, False: 107] ------------------ 4671| 107| !BN_bn2cbb_padded(&child, 32, y.get()) || // ------------------ | Branch (4671:7): [True: 0, False: 107] ------------------ 4672| 107| !BN_bn2cbb_padded(&child, 32, sig->r) || // ------------------ | Branch (4672:7): [True: 0, False: 107] ------------------ 4673| 107| !BN_bn2cbb_padded(&child, 32, sig->s) || // ------------------ | Branch (4673:7): [True: 0, False: 107] ------------------ 4674| 107| !CBB_flush(cbb)) { ------------------ | Branch (4674:7): [True: 0, False: 107] ------------------ 4675| 0| return false; 4676| 0| } 4677| | 4678| 107| return true; 4679| 107|} _ZN4bssl20tls1_channel_id_hashEPNS_13SSL_HANDSHAKEEPhPm: 4681| 107|bool tls1_channel_id_hash(SSL_HANDSHAKE *hs, uint8_t *out, size_t *out_len) { 4682| 107| SSL *const ssl = hs->ssl; 4683| 107| if (ssl_protocol_version(ssl) >= TLS1_3_VERSION) { ------------------ | | 545| 107|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (4683:7): [True: 0, False: 107] ------------------ 4684| 0| Array msg; 4685| 0| if (!tls13_get_cert_verify_signature_input(hs, &msg, ------------------ | Branch (4685:9): [True: 0, False: 0] ------------------ 4686| 0| ssl_cert_verify_channel_id)) { 4687| 0| return false; 4688| 0| } 4689| 0| SHA256(msg.data(), msg.size(), out); 4690| 0| *out_len = SHA256_DIGEST_LENGTH; ------------------ | | 110| 0|#define SHA256_DIGEST_LENGTH 32 ------------------ 4691| 0| return true; 4692| 0| } 4693| | 4694| 107| SHA256_CTX ctx; 4695| | 4696| 107| SHA256_Init(&ctx); 4697| 107| static const char kClientIDMagic[] = "TLS Channel ID signature"; 4698| 107| SHA256_Update(&ctx, kClientIDMagic, sizeof(kClientIDMagic)); 4699| | 4700| 107| if (ssl->session != NULL) { ------------------ | Branch (4700:7): [True: 0, False: 107] ------------------ 4701| 0| static const char kResumptionMagic[] = "Resumption"; 4702| 0| SHA256_Update(&ctx, kResumptionMagic, sizeof(kResumptionMagic)); 4703| 0| if (ssl->session->original_handshake_hash.empty()) { ------------------ | Branch (4703:9): [True: 0, False: 0] ------------------ 4704| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 4705| 0| return false; 4706| 0| } 4707| 0| SHA256_Update(&ctx, ssl->session->original_handshake_hash.data(), 4708| 0| ssl->session->original_handshake_hash.size()); 4709| 0| } 4710| | 4711| 107| uint8_t hs_hash[EVP_MAX_MD_SIZE]; 4712| 107| size_t hs_hash_len; 4713| 107| if (!hs->transcript.GetHash(hs_hash, &hs_hash_len)) { ------------------ | Branch (4713:7): [True: 0, False: 107] ------------------ 4714| 0| return false; 4715| 0| } 4716| 107| SHA256_Update(&ctx, hs_hash, (size_t)hs_hash_len); 4717| 107| SHA256_Final(out, &ctx); 4718| 107| *out_len = SHA256_DIGEST_LENGTH; ------------------ | | 110| 107|#define SHA256_DIGEST_LENGTH 32 ------------------ 4719| 107| return true; 4720| 107|} _ZN4bssl43tls1_record_handshake_hashes_for_channel_idEPNS_13SSL_HANDSHAKEE: 4722| 52.0k|bool tls1_record_handshake_hashes_for_channel_id(SSL_HANDSHAKE *hs) { 4723| 52.0k| SSL *const ssl = hs->ssl; 4724| | // This function should never be called for a resumed session because the 4725| | // handshake hashes that we wish to record are for the original, full 4726| | // handshake. 4727| 52.0k| if (ssl->session != NULL) { ------------------ | Branch (4727:7): [True: 0, False: 52.0k] ------------------ 4728| 0| return false; 4729| 0| } 4730| | 4731| 52.0k| size_t digest_len; 4732| 52.0k| hs->new_session->original_handshake_hash.ResizeForOverwrite( 4733| 52.0k| hs->transcript.DigestLen()); 4734| 52.0k| if (!hs->transcript.GetHash(hs->new_session->original_handshake_hash.data(), ------------------ | Branch (4734:7): [True: 0, False: 52.0k] ------------------ 4735| 52.0k| &digest_len)) { 4736| 0| return false; 4737| 0| } 4738| 52.0k| assert(digest_len == hs->new_session->original_handshake_hash.size()); 4739| 52.0k| return true; 4740| 52.0k|} _ZN4bssl21ssl_is_sct_list_validEPK6cbs_st: 4742| 14.2k|bool ssl_is_sct_list_valid(const CBS *contents) { 4743| | // Shallow parse the SCT list for sanity. By the RFC 4744| | // (https://tools.ietf.org/html/rfc6962#section-3.3) neither the list nor any 4745| | // of the SCTs may be empty. 4746| 14.2k| CBS copy = *contents; 4747| 14.2k| CBS sct_list; 4748| 14.2k| if (!CBS_get_u16_length_prefixed(©, &sct_list) || CBS_len(©) != 0 || ------------------ | Branch (4748:7): [True: 9, False: 14.2k] | Branch (4748:57): [True: 1, False: 14.2k] ------------------ 4749| 14.2k| CBS_len(&sct_list) == 0) { ------------------ | Branch (4749:7): [True: 1, False: 14.2k] ------------------ 4750| 11| return false; 4751| 11| } 4752| | 4753| 28.5k| while (CBS_len(&sct_list) > 0) { ------------------ | Branch (4753:10): [True: 14.2k, False: 14.2k] ------------------ 4754| 14.2k| CBS sct; 4755| 14.2k| if (!CBS_get_u16_length_prefixed(&sct_list, &sct) || CBS_len(&sct) == 0) { ------------------ | Branch (4755:9): [True: 3, False: 14.2k] | Branch (4755:58): [True: 2, False: 14.2k] ------------------ 4756| 5| return false; 4757| 5| } 4758| 14.2k| } 4759| | 4760| 14.2k| return true; 4761| 14.2k|} extensions.cc:_ZN4bsslL31tls1_check_duplicate_extensionsEPK6cbs_st: 52| 55.2k|static bool tls1_check_duplicate_extensions(const CBS *cbs) { 53| | // First pass: count the extensions. 54| 55.2k| size_t num_extensions = 0; 55| 55.2k| CBS extensions = *cbs; 56| 211k| while (CBS_len(&extensions) > 0) { ------------------ | Branch (56:10): [True: 156k, False: 55.1k] ------------------ 57| 156k| uint16_t type; 58| 156k| CBS extension; 59| | 60| 156k| if (!CBS_get_u16(&extensions, &type) || ------------------ | Branch (60:9): [True: 2, False: 156k] ------------------ 61| 156k| !CBS_get_u16_length_prefixed(&extensions, &extension)) { ------------------ | Branch (61:9): [True: 18, False: 156k] ------------------ 62| 20| return false; 63| 20| } 64| | 65| 156k| num_extensions++; 66| 156k| } 67| | 68| 55.1k| if (num_extensions == 0) { ------------------ | Branch (68:7): [True: 477, False: 54.7k] ------------------ 69| 477| return true; 70| 477| } 71| | 72| 54.7k| Array extension_types; 73| 54.7k| if (!extension_types.InitForOverwrite(num_extensions)) { ------------------ | Branch (73:7): [True: 0, False: 54.7k] ------------------ 74| 0| return false; 75| 0| } 76| | 77| | // Second pass: gather the extension types. 78| 54.7k| extensions = *cbs; 79| 211k| for (size_t i = 0; i < extension_types.size(); i++) { ------------------ | Branch (79:22): [True: 156k, False: 54.7k] ------------------ 80| 156k| CBS extension; 81| | 82| 156k| if (!CBS_get_u16(&extensions, &extension_types[i]) || ------------------ | Branch (82:9): [True: 0, False: 156k] ------------------ 83| 156k| !CBS_get_u16_length_prefixed(&extensions, &extension)) { ------------------ | Branch (83:9): [True: 0, False: 156k] ------------------ 84| | // This should not happen. 85| 0| return false; 86| 0| } 87| 156k| } 88| 54.7k| assert(CBS_len(&extensions) == 0); 89| | 90| | // Sort the extensions and make sure there are no duplicates. 91| 54.7k| std::sort(extension_types.begin(), extension_types.end()); 92| 156k| for (size_t i = 1; i < num_extensions; i++) { ------------------ | Branch (92:22): [True: 101k, False: 54.6k] ------------------ 93| 101k| if (extension_types[i - 1] == extension_types[i]) { ------------------ | Branch (93:9): [True: 8, False: 101k] ------------------ 94| 8| return false; 95| 8| } 96| 101k| } 97| | 98| 54.6k| return true; 99| 54.7k|} extensions.cc:_ZN4bsslL21is_post_quantum_groupEt: 101| 629k|static bool is_post_quantum_group(uint16_t id) { 102| 629k| switch (id) { 103| 112k| case SSL_GROUP_X25519_KYBER768_DRAFT00: ------------------ | | 2530| 112k|#define SSL_GROUP_X25519_KYBER768_DRAFT00 0x6399 ------------------ | Branch (103:5): [True: 112k, False: 517k] ------------------ 104| 281k| case SSL_GROUP_X25519_MLKEM768: ------------------ | | 2529| 281k|#define SSL_GROUP_X25519_MLKEM768 0x11ec ------------------ | Branch (104:5): [True: 169k, False: 460k] ------------------ 105| 281k| return true; 106| 348k| default: ------------------ | Branch (106:5): [True: 348k, False: 281k] ------------------ 107| 348k| return false; 108| 629k| } 109| 629k|} extensions.cc:_ZN4bsslL24tls12_get_verify_sigalgsEPKNS_13SSL_HANDSHAKEE: 320| 107k|static Span tls12_get_verify_sigalgs(const SSL_HANDSHAKE *hs) { 321| 107k| if (hs->config->verify_sigalgs.empty()) { ------------------ | Branch (321:7): [True: 107k, False: 0] ------------------ 322| 107k| return Span(kVerifySignatureAlgorithms); 323| 107k| } 324| 0| return hs->config->verify_sigalgs; 325| 107k|} extensions.cc:_ZN4bsslL23ext_sni_add_clienthelloEPKNS_13SSL_HANDSHAKEEP6cbb_stS4_NS_23ssl_client_hello_type_tE: 506| 56.4k| ssl_client_hello_type_t type) { 507| 56.4k| const SSL *const ssl = hs->ssl; 508| | // If offering ECH, send the public name instead of the configured name. 509| 56.4k| Span hostname; 510| 56.4k| if (type == ssl_client_hello_outer) { ------------------ | Branch (510:7): [True: 0, False: 56.4k] ------------------ 511| 0| hostname = hs->selected_ech_config->public_name; 512| 56.4k| } else { 513| 56.4k| if (ssl->hostname == nullptr) { ------------------ | Branch (513:9): [True: 0, False: 56.4k] ------------------ 514| 0| return true; 515| 0| } 516| 56.4k| hostname = StringAsBytes(ssl->hostname.get()); 517| 56.4k| } 518| | 519| 56.4k| CBB contents, server_name_list, name; 520| 56.4k| if (!CBB_add_u16(out, TLSEXT_TYPE_server_name) || ------------------ | | 52| 56.4k|#define TLSEXT_TYPE_server_name 0 ------------------ | Branch (520:7): [True: 0, False: 56.4k] ------------------ 521| 56.4k| !CBB_add_u16_length_prefixed(out, &contents) || ------------------ | Branch (521:7): [True: 0, False: 56.4k] ------------------ 522| 56.4k| !CBB_add_u16_length_prefixed(&contents, &server_name_list) || ------------------ | Branch (522:7): [True: 0, False: 56.4k] ------------------ 523| 56.4k| !CBB_add_u8(&server_name_list, TLSEXT_NAMETYPE_host_name) || ------------------ | | 3135| 56.4k|#define TLSEXT_NAMETYPE_host_name 0 ------------------ | Branch (523:7): [True: 0, False: 56.4k] ------------------ 524| 56.4k| !CBB_add_u16_length_prefixed(&server_name_list, &name) || ------------------ | Branch (524:7): [True: 0, False: 56.4k] ------------------ 525| 56.4k| !CBB_add_bytes(&name, hostname.data(), hostname.size()) || ------------------ | Branch (525:7): [True: 0, False: 56.4k] ------------------ 526| 56.4k| !CBB_flush(out)) { ------------------ | Branch (526:7): [True: 0, False: 56.4k] ------------------ 527| 0| return false; 528| 0| } 529| | 530| 56.4k| return true; 531| 56.4k|} extensions.cc:_ZN4bsslL25ext_sni_parse_serverhelloEPNS_13SSL_HANDSHAKEEPhP6cbs_st: 534| 55.0k| CBS *contents) { 535| | // The server may acknowledge SNI with an empty extension. We check the syntax 536| | // but otherwise ignore this signal. 537| 55.0k| return contents == NULL || CBS_len(contents) == 0; ------------------ | Branch (537:10): [True: 54.3k, False: 664] | Branch (537:30): [True: 662, False: 2] ------------------ 538| 55.0k|} extensions.cc:_ZN4bsslL23ext_ech_add_clienthelloEPKNS_13SSL_HANDSHAKEEP6cbb_stS4_NS_23ssl_client_hello_type_tE: 567| 56.4k| ssl_client_hello_type_t type) { 568| 56.4k| if (type == ssl_client_hello_inner) { ------------------ | Branch (568:7): [True: 0, False: 56.4k] ------------------ 569| 0| if (!CBB_add_u16(out, TLSEXT_TYPE_encrypted_client_hello) || ------------------ | | 119| 0|#define TLSEXT_TYPE_encrypted_client_hello 0xfe0d ------------------ | Branch (569:9): [True: 0, False: 0] ------------------ 570| 0| !CBB_add_u16(out, /* length */ 1) || ------------------ | Branch (570:9): [True: 0, False: 0] ------------------ 571| 0| !CBB_add_u8(out, ECH_CLIENT_INNER)) { ------------------ | | 1313| 0|#define ECH_CLIENT_INNER 1 ------------------ | Branch (571:9): [True: 0, False: 0] ------------------ 572| 0| return false; 573| 0| } 574| 0| return true; 575| 0| } 576| | 577| 56.4k| if (hs->ech_client_outer.empty()) { ------------------ | Branch (577:7): [True: 56.4k, False: 0] ------------------ 578| 56.4k| return true; 579| 56.4k| } 580| | 581| 0| CBB ech_body; 582| 0| if (!CBB_add_u16(out, TLSEXT_TYPE_encrypted_client_hello) || ------------------ | | 119| 0|#define TLSEXT_TYPE_encrypted_client_hello 0xfe0d ------------------ | Branch (582:7): [True: 0, False: 0] ------------------ 583| 0| !CBB_add_u16_length_prefixed(out, &ech_body) || ------------------ | Branch (583:7): [True: 0, False: 0] ------------------ 584| 0| !CBB_add_u8(&ech_body, ECH_CLIENT_OUTER) || ------------------ | | 1312| 0|#define ECH_CLIENT_OUTER 0 ------------------ | Branch (584:7): [True: 0, False: 0] ------------------ 585| 0| !CBB_add_bytes(&ech_body, hs->ech_client_outer.data(), ------------------ | Branch (585:7): [True: 0, False: 0] ------------------ 586| 0| hs->ech_client_outer.size()) || 587| 0| !CBB_flush(out)) { ------------------ | Branch (587:7): [True: 0, False: 0] ------------------ 588| 0| return false; 589| 0| } 590| 0| return true; 591| 0|} extensions.cc:_ZN4bsslL25ext_ech_parse_serverhelloEPNS_13SSL_HANDSHAKEEPhP6cbs_st: 594| 55.0k| CBS *contents) { 595| 55.0k| SSL *const ssl = hs->ssl; 596| 55.0k| if (contents == NULL) { ------------------ | Branch (596:7): [True: 55.0k, False: 0] ------------------ 597| 55.0k| return true; 598| 55.0k| } 599| | 600| | // The ECH extension may not be sent in TLS 1.2 ServerHello, only TLS 1.3 601| | // EncryptedExtensions. It also may not be sent in response to an inner ECH 602| | // extension. 603| 0| if (ssl_protocol_version(ssl) < TLS1_3_VERSION || ------------------ | | 545| 0|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (603:7): [True: 0, False: 0] ------------------ 604| 0| ssl->s3->ech_status == ssl_ech_accepted) { ------------------ | Branch (604:7): [True: 0, False: 0] ------------------ 605| 0| *out_alert = SSL_AD_UNSUPPORTED_EXTENSION; ------------------ | | 4392| 0|#define SSL_AD_UNSUPPORTED_EXTENSION TLS1_AD_UNSUPPORTED_EXTENSION | | ------------------ | | | | 41| 0|#define TLS1_AD_UNSUPPORTED_EXTENSION 110 | | ------------------ ------------------ 606| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_EXTENSION); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 607| 0| return false; 608| 0| } 609| | 610| 0| if (!ssl_is_valid_ech_config_list(*contents)) { ------------------ | Branch (610:7): [True: 0, False: 0] ------------------ 611| 0| *out_alert = SSL_AD_DECODE_ERROR; ------------------ | | 4382| 0|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 0|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 612| 0| return false; 613| 0| } 614| | 615| 0| if (ssl->s3->ech_status == ssl_ech_rejected && ------------------ | Branch (615:7): [True: 0, False: 0] ------------------ 616| 0| !hs->ech_retry_configs.CopyFrom(*contents)) { ------------------ | Branch (616:7): [True: 0, False: 0] ------------------ 617| 0| *out_alert = SSL_AD_INTERNAL_ERROR; ------------------ | | 4387| 0|#define SSL_AD_INTERNAL_ERROR TLS1_AD_INTERNAL_ERROR | | ------------------ | | | | 37| 0|#define TLS1_AD_INTERNAL_ERROR 80 | | ------------------ ------------------ 618| 0| return false; 619| 0| } 620| | 621| 0| return true; 622| 0|} extensions.cc:_ZN4bsslL23ext_ems_add_clienthelloEPKNS_13SSL_HANDSHAKEEP6cbb_stS4_NS_23ssl_client_hello_type_tE: 839| 56.4k| ssl_client_hello_type_t type) { 840| | // Extended master secret is not necessary in TLS 1.3. 841| 56.4k| if (hs->min_version >= TLS1_3_VERSION || type == ssl_client_hello_inner) { ------------------ | | 545| 112k|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (841:7): [True: 0, False: 56.4k] | Branch (841:44): [True: 0, False: 56.4k] ------------------ 842| 0| return true; 843| 0| } 844| | 845| 56.4k| if (!CBB_add_u16(out, TLSEXT_TYPE_extended_master_secret) || ------------------ | | 71| 56.4k|#define TLSEXT_TYPE_extended_master_secret 23 ------------------ | Branch (845:7): [True: 0, False: 56.4k] ------------------ 846| 56.4k| !CBB_add_u16(out, 0 /* length */)) { ------------------ | Branch (846:7): [True: 0, False: 56.4k] ------------------ 847| 0| return false; 848| 0| } 849| | 850| 56.4k| return true; 851| 56.4k|} extensions.cc:_ZN4bsslL25ext_ems_parse_serverhelloEPNS_13SSL_HANDSHAKEEPhP6cbs_st: 854| 55.0k| CBS *contents) { 855| 55.0k| SSL *const ssl = hs->ssl; 856| | 857| 55.0k| if (contents != NULL) { ------------------ | Branch (857:7): [True: 53.9k, False: 1.07k] ------------------ 858| 53.9k| if (ssl_protocol_version(ssl) >= TLS1_3_VERSION || // ------------------ | | 545| 107k|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (858:9): [True: 1, False: 53.9k] ------------------ 859| 53.9k| CBS_len(contents) != 0) { ------------------ | Branch (859:9): [True: 1, False: 53.9k] ------------------ 860| 2| return false; 861| 2| } 862| | 863| 53.9k| hs->extended_master_secret = true; 864| 53.9k| } 865| | 866| | // Whether EMS is negotiated may not change on renegotiation. 867| 55.0k| if (ssl->s3->established_session != nullptr && ------------------ | Branch (867:7): [True: 50.9k, False: 4.11k] ------------------ 868| 55.0k| hs->extended_master_secret != ------------------ | Branch (868:7): [True: 5, False: 50.9k] ------------------ 869| 50.9k| !!ssl->s3->established_session->extended_master_secret) { 870| 5| OPENSSL_PUT_ERROR(SSL, SSL_R_RENEGOTIATION_EMS_MISMATCH); ------------------ | | 361| 5| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 871| 5| *out_alert = SSL_AD_ILLEGAL_PARAMETER; ------------------ | | 4379| 5|#define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER | | ------------------ | | | | 189| 5|#define SSL3_AD_ILLEGAL_PARAMETER 47 // fatal | | ------------------ ------------------ 872| 5| return false; 873| 5| } 874| | 875| 55.0k| return true; 876| 55.0k|} extensions.cc:_ZN4bsslL22ext_ri_add_clienthelloEPKNS_13SSL_HANDSHAKEEP6cbb_stS4_NS_23ssl_client_hello_type_tE: 681| 56.4k| ssl_client_hello_type_t type) { 682| 56.4k| const SSL *const ssl = hs->ssl; 683| | // Renegotiation indication is not necessary in TLS 1.3. 684| 56.4k| if (hs->min_version >= TLS1_3_VERSION || // ------------------ | | 545| 112k|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (684:7): [True: 0, False: 56.4k] ------------------ 685| 56.4k| type == ssl_client_hello_inner) { ------------------ | Branch (685:7): [True: 0, False: 56.4k] ------------------ 686| 0| return true; 687| 0| } 688| | 689| 56.4k| assert(ssl->s3->initial_handshake_complete == 690| 56.4k| !ssl->s3->previous_client_finished.empty()); 691| | 692| 56.4k| CBB contents, prev_finished; 693| 56.4k| if (!CBB_add_u16(out, TLSEXT_TYPE_renegotiate) || ------------------ | | 107| 56.4k|#define TLSEXT_TYPE_renegotiate 0xff01 ------------------ | Branch (693:7): [True: 0, False: 56.4k] ------------------ 694| 56.4k| !CBB_add_u16_length_prefixed(out, &contents) || ------------------ | Branch (694:7): [True: 0, False: 56.4k] ------------------ 695| 56.4k| !CBB_add_u8_length_prefixed(&contents, &prev_finished) || ------------------ | Branch (695:7): [True: 0, False: 56.4k] ------------------ 696| 56.4k| !CBB_add_bytes(&prev_finished, ssl->s3->previous_client_finished.data(), ------------------ | Branch (696:7): [True: 0, False: 56.4k] ------------------ 697| 56.4k| ssl->s3->previous_client_finished.size()) || 698| 56.4k| !CBB_flush(out)) { ------------------ | Branch (698:7): [True: 0, False: 56.4k] ------------------ 699| 0| return false; 700| 0| } 701| | 702| 56.4k| return true; 703| 56.4k|} extensions.cc:_ZN4bsslL24ext_ri_parse_serverhelloEPNS_13SSL_HANDSHAKEEPhP6cbs_st: 706| 55.0k| CBS *contents) { 707| 55.0k| SSL *const ssl = hs->ssl; 708| 55.0k| if (contents != NULL && ssl_protocol_version(ssl) >= TLS1_3_VERSION) { ------------------ | | 545| 17.8k|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (708:7): [True: 17.8k, False: 37.2k] | Branch (708:27): [True: 0, False: 17.8k] ------------------ 709| 0| *out_alert = SSL_AD_ILLEGAL_PARAMETER; ------------------ | | 4379| 0|#define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER | | ------------------ | | | | 189| 0|#define SSL3_AD_ILLEGAL_PARAMETER 47 // fatal | | ------------------ ------------------ 710| 0| return false; 711| 0| } 712| | 713| | // Servers may not switch between omitting the extension and supporting it. 714| | // See RFC 5746, sections 3.5 and 4.2. 715| 55.0k| if (ssl->s3->initial_handshake_complete && ------------------ | Branch (715:7): [True: 50.9k, False: 4.15k] ------------------ 716| 55.0k| (contents != NULL) != ssl->s3->send_connection_binding) { ------------------ | Branch (716:7): [True: 9, False: 50.9k] ------------------ 717| 9| *out_alert = SSL_AD_HANDSHAKE_FAILURE; ------------------ | | 4372| 9|#define SSL_AD_HANDSHAKE_FAILURE SSL3_AD_HANDSHAKE_FAILURE | | ------------------ | | | | 182| 9|#define SSL3_AD_HANDSHAKE_FAILURE 40 // fatal | | ------------------ ------------------ 718| 9| OPENSSL_PUT_ERROR(SSL, SSL_R_RENEGOTIATION_MISMATCH); ------------------ | | 361| 9| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 719| 9| return false; 720| 9| } 721| | 722| 55.0k| if (contents == NULL) { ------------------ | Branch (722:7): [True: 37.2k, False: 17.8k] ------------------ 723| | // Strictly speaking, if we want to avoid an attack we should *always* see 724| | // RI even on initial ServerHello because the client doesn't see any 725| | // renegotiation during an attack. However this would mean we could not 726| | // connect to any server which doesn't support RI. 727| | // 728| | // OpenSSL has |SSL_OP_LEGACY_SERVER_CONNECT| to control this, but in 729| | // practical terms every client sets it so it's just assumed here. 730| 37.2k| return true; 731| 37.2k| } 732| | 733| | // Check for logic errors. 734| 17.8k| assert(ssl->s3->previous_client_finished.size() == 735| 17.8k| ssl->s3->previous_server_finished.size()); 736| 17.8k| assert(ssl->s3->initial_handshake_complete == 737| 17.8k| !ssl->s3->previous_client_finished.empty()); 738| | 739| | // Parse out the extension contents. 740| 17.8k| CBS renegotiated_connection; 741| 17.8k| if (!CBS_get_u8_length_prefixed(contents, &renegotiated_connection) || ------------------ | Branch (741:7): [True: 2, False: 17.8k] ------------------ 742| 17.8k| CBS_len(contents) != 0) { ------------------ | Branch (742:7): [True: 1, False: 17.8k] ------------------ 743| 3| OPENSSL_PUT_ERROR(SSL, SSL_R_RENEGOTIATION_ENCODING_ERR); ------------------ | | 361| 3| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 744| 3| *out_alert = SSL_AD_ILLEGAL_PARAMETER; ------------------ | | 4379| 3|#define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER | | ------------------ | | | | 189| 3|#define SSL3_AD_ILLEGAL_PARAMETER 47 // fatal | | ------------------ ------------------ 745| 3| return false; 746| 3| } 747| | 748| | // Check that the extension matches. 749| 17.8k| CBS client_verify, server_verify; 750| 17.8k| if (!CBS_get_bytes(&renegotiated_connection, &client_verify, ------------------ | Branch (750:7): [True: 4, False: 17.7k] ------------------ 751| 17.8k| ssl->s3->previous_client_finished.size()) || 752| 17.8k| !CBS_get_bytes(&renegotiated_connection, &server_verify, ------------------ | Branch (752:7): [True: 2, False: 17.7k] ------------------ 753| 17.7k| ssl->s3->previous_server_finished.size()) || 754| 17.8k| CBS_len(&renegotiated_connection) != 0) { ------------------ | Branch (754:7): [True: 1, False: 17.7k] ------------------ 755| 7| OPENSSL_PUT_ERROR(SSL, SSL_R_RENEGOTIATION_MISMATCH); ------------------ | | 361| 7| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 756| 7| *out_alert = SSL_AD_HANDSHAKE_FAILURE; ------------------ | | 4372| 7|#define SSL_AD_HANDSHAKE_FAILURE SSL3_AD_HANDSHAKE_FAILURE | | ------------------ | | | | 182| 7|#define SSL3_AD_HANDSHAKE_FAILURE 40 // fatal | | ------------------ ------------------ 757| 7| return false; 758| 7| } 759| | 760| 17.7k| bool ok = 761| 17.7k| CBS_mem_equal(&client_verify, ssl->s3->previous_client_finished.data(), ------------------ | Branch (761:7): [True: 2.41k, False: 15.3k] ------------------ 762| 17.7k| ssl->s3->previous_client_finished.size()) && 763| 17.7k| CBS_mem_equal(&server_verify, ssl->s3->previous_server_finished.data(), ------------------ | Branch (763:7): [True: 2.41k, False: 0] ------------------ 764| 2.41k| ssl->s3->previous_server_finished.size()); 765| 17.7k| if (CRYPTO_fuzzer_mode_enabled()) { ------------------ | Branch (765:7): [True: 17.7k, False: 0] ------------------ 766| 17.7k| ok = true; 767| 17.7k| } 768| 17.7k| if (!ok) { ------------------ | Branch (768:7): [True: 0, False: 17.7k] ------------------ 769| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_RENEGOTIATION_MISMATCH); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 770| 0| *out_alert = SSL_AD_HANDSHAKE_FAILURE; ------------------ | | 4372| 0|#define SSL_AD_HANDSHAKE_FAILURE SSL3_AD_HANDSHAKE_FAILURE | | ------------------ | | | | 182| 0|#define SSL3_AD_HANDSHAKE_FAILURE 40 // fatal | | ------------------ ------------------ 771| 0| return false; 772| 0| } 773| | 774| 17.7k| ssl->s3->send_connection_binding = true; 775| 17.7k| return true; 776| 17.7k|} extensions.cc:_ZN4bsslL36ext_supported_groups_add_clienthelloEPKNS_13SSL_HANDSHAKEEP6cbb_stS4_NS_23ssl_client_hello_type_tE: 2501| 56.4k| ssl_client_hello_type_t type) { 2502| 56.4k| const SSL *const ssl = hs->ssl; 2503| | // In PAKE mode, supported_groups and key_share are not used. 2504| 56.4k| if (hs->pake_prover != nullptr) { ------------------ | Branch (2504:7): [True: 0, False: 56.4k] ------------------ 2505| 0| return true; 2506| 0| } 2507| | 2508| 56.4k| CBB contents, groups_bytes; 2509| 56.4k| if (!CBB_add_u16(out_compressible, TLSEXT_TYPE_supported_groups) || ------------------ | | 96| 56.4k|#define TLSEXT_TYPE_supported_groups 10 ------------------ | Branch (2509:7): [True: 0, False: 56.4k] ------------------ 2510| 56.4k| !CBB_add_u16_length_prefixed(out_compressible, &contents) || ------------------ | Branch (2510:7): [True: 0, False: 56.4k] ------------------ 2511| 56.4k| !CBB_add_u16_length_prefixed(&contents, &groups_bytes)) { ------------------ | Branch (2511:7): [True: 0, False: 56.4k] ------------------ 2512| 0| return false; 2513| 0| } 2514| | 2515| | // Add a fake group. See RFC 8701. 2516| 56.4k| if (ssl->ctx->grease_enabled && ------------------ | Branch (2516:7): [True: 0, False: 56.4k] ------------------ 2517| 56.4k| !CBB_add_u16(&groups_bytes, ssl_get_grease_value(hs, ssl_grease_group))) { ------------------ | Branch (2517:7): [True: 0, False: 0] ------------------ 2518| 0| return false; 2519| 0| } 2520| | 2521| 338k| for (uint16_t group : tls1_get_grouplist(hs)) { ------------------ | Branch (2521:23): [True: 338k, False: 56.4k] ------------------ 2522| 338k| if (is_post_quantum_group(group) && hs->max_version < TLS1_3_VERSION) { ------------------ | | 545| 112k|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (2522:9): [True: 112k, False: 225k] | Branch (2522:41): [True: 0, False: 112k] ------------------ 2523| 0| continue; 2524| 0| } 2525| 338k| if (!CBB_add_u16(&groups_bytes, group)) { ------------------ | Branch (2525:9): [True: 0, False: 338k] ------------------ 2526| 0| return false; 2527| 0| } 2528| 338k| } 2529| | 2530| 56.4k| return CBB_flush(out_compressible); 2531| 56.4k|} extensions.cc:_ZN4bsslL38ext_supported_groups_parse_serverhelloEPNS_13SSL_HANDSHAKEEPhP6cbs_st: 2535| 55.0k| CBS *contents) { 2536| | // This extension is not expected to be echoed by servers in TLS 1.2, but some 2537| | // BigIP servers send it nonetheless, so do not enforce this. 2538| 55.0k| return true; 2539| 55.0k|} extensions.cc:_ZN4bsslL28ext_ec_point_add_clienthelloEPKNS_13SSL_HANDSHAKEEP6cbb_stS4_NS_23ssl_client_hello_type_tE: 1799| 56.4k| ssl_client_hello_type_t type) { 1800| | // The point format extension is unnecessary in TLS 1.3. 1801| 56.4k| if (hs->min_version >= TLS1_3_VERSION || type == ssl_client_hello_inner) { ------------------ | | 545| 112k|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (1801:7): [True: 0, False: 56.4k] | Branch (1801:44): [True: 0, False: 56.4k] ------------------ 1802| 0| return true; 1803| 0| } 1804| | 1805| 56.4k| return ext_ec_point_add_extension(hs, out); 1806| 56.4k|} extensions.cc:_ZN4bsslL26ext_ec_point_add_extensionEPKNS_13SSL_HANDSHAKEEP6cbb_st: 1784| 56.4k|static bool ext_ec_point_add_extension(const SSL_HANDSHAKE *hs, CBB *out) { 1785| 56.4k| CBB contents, formats; 1786| 56.4k| if (!CBB_add_u16(out, TLSEXT_TYPE_ec_point_formats) || ------------------ | | 56| 56.4k|#define TLSEXT_TYPE_ec_point_formats 11 ------------------ | Branch (1786:7): [True: 0, False: 56.4k] ------------------ 1787| 56.4k| !CBB_add_u16_length_prefixed(out, &contents) || ------------------ | Branch (1787:7): [True: 0, False: 56.4k] ------------------ 1788| 56.4k| !CBB_add_u8_length_prefixed(&contents, &formats) || ------------------ | Branch (1788:7): [True: 0, False: 56.4k] ------------------ 1789| 56.4k| !CBB_add_u8(&formats, TLSEXT_ECPOINTFORMAT_uncompressed) || ------------------ | | 148| 56.4k|#define TLSEXT_ECPOINTFORMAT_uncompressed 0 ------------------ | Branch (1789:7): [True: 0, False: 56.4k] ------------------ 1790| 56.4k| !CBB_flush(out)) { ------------------ | Branch (1790:7): [True: 0, False: 56.4k] ------------------ 1791| 0| return false; 1792| 0| } 1793| | 1794| 56.4k| return true; 1795| 56.4k|} extensions.cc:_ZN4bsslL30ext_ec_point_parse_serverhelloEPNS_13SSL_HANDSHAKEEPhP6cbs_st: 1809| 55.0k| uint8_t *out_alert, CBS *contents) { 1810| 55.0k| if (contents == NULL) { ------------------ | Branch (1810:7): [True: 55.0k, False: 39] ------------------ 1811| 55.0k| return true; 1812| 55.0k| } 1813| | 1814| 39| if (ssl_protocol_version(hs->ssl) >= TLS1_3_VERSION) { ------------------ | | 545| 39|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (1814:7): [True: 0, False: 39] ------------------ 1815| 0| return false; 1816| 0| } 1817| | 1818| 39| CBS ec_point_format_list; 1819| 39| if (!CBS_get_u8_length_prefixed(contents, &ec_point_format_list) || ------------------ | Branch (1819:7): [True: 2, False: 37] ------------------ 1820| 39| CBS_len(contents) != 0) { ------------------ | Branch (1820:7): [True: 3, False: 34] ------------------ 1821| 5| return false; 1822| 5| } 1823| | 1824| | // Per RFC 4492, section 5.1.2, implementations MUST support the uncompressed 1825| | // point format. 1826| 34| if (OPENSSL_memchr(CBS_data(&ec_point_format_list), ------------------ | Branch (1826:7): [True: 3, False: 31] ------------------ 1827| 34| TLSEXT_ECPOINTFORMAT_uncompressed, ------------------ | | 148| 34|#define TLSEXT_ECPOINTFORMAT_uncompressed 0 ------------------ 1828| 34| CBS_len(&ec_point_format_list)) == NULL) { 1829| 3| *out_alert = SSL_AD_ILLEGAL_PARAMETER; ------------------ | | 4379| 3|#define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER | | ------------------ | | | | 189| 3|#define SSL3_AD_ILLEGAL_PARAMETER 47 // fatal | | ------------------ ------------------ 1830| 3| return false; 1831| 3| } 1832| | 1833| 31| return true; 1834| 34|} extensions.cc:_ZN4bsslL26ext_ticket_add_clienthelloEPKNS_13SSL_HANDSHAKEEP6cbb_stS4_NS_23ssl_client_hello_type_tE: 916| 56.4k| ssl_client_hello_type_t type) { 917| 56.4k| const SSL *const ssl = hs->ssl; 918| | // TLS 1.3 uses a different ticket extension. 919| 56.4k| if (hs->min_version >= TLS1_3_VERSION || type == ssl_client_hello_inner || ------------------ | | 545| 112k|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (919:7): [True: 0, False: 56.4k] | Branch (919:44): [True: 0, False: 56.4k] ------------------ 920| 56.4k| SSL_get_options(ssl) & SSL_OP_NO_TICKET) { ------------------ | | 6111| 56.4k|#define SSL_get_options SSL_get_options ------------------ SSL_get_options(ssl) & SSL_OP_NO_TICKET) { ------------------ | | 602| 56.4k|#define SSL_OP_NO_TICKET 0x00004000L ------------------ | Branch (920:7): [True: 0, False: 56.4k] ------------------ 921| 0| return true; 922| 0| } 923| | 924| | // Renegotiation does not participate in session resumption. However, still 925| | // advertise the extension to avoid potentially breaking servers which carry 926| | // over the state from the previous handshake, such as OpenSSL servers 927| | // without upstream's 3c3f0259238594d77264a78944d409f2127642c4. 928| 56.4k| Span ticket; 929| 56.4k| if (!ssl->s3->initial_handshake_complete && // ------------------ | Branch (929:7): [True: 5.28k, False: 51.1k] ------------------ 930| 56.4k| ssl->session != nullptr && ------------------ | Branch (930:7): [True: 894, False: 4.38k] ------------------ 931| 56.4k| ssl_session_get_type(ssl->session.get()) == SSLSessionType::kTicket) { ------------------ | Branch (931:7): [True: 25, False: 869] ------------------ 932| 25| ticket = ssl->session->ticket; 933| 25| } 934| | 935| 56.4k| CBB ticket_cbb; 936| 56.4k| if (!CBB_add_u16(out, TLSEXT_TYPE_session_ticket) || ------------------ | | 93| 56.4k|#define TLSEXT_TYPE_session_ticket 35 ------------------ | Branch (936:7): [True: 0, False: 56.4k] ------------------ 937| 56.4k| !CBB_add_u16_length_prefixed(out, &ticket_cbb) || ------------------ | Branch (937:7): [True: 0, False: 56.4k] ------------------ 938| 56.4k| !CBB_add_bytes(&ticket_cbb, ticket.data(), ticket.size()) || ------------------ | Branch (938:7): [True: 0, False: 56.4k] ------------------ 939| 56.4k| !CBB_flush(out)) { ------------------ | Branch (939:7): [True: 0, False: 56.4k] ------------------ 940| 0| return false; 941| 0| } 942| | 943| 56.4k| return true; 944| 56.4k|} extensions.cc:_ZN4bsslL28ext_ticket_parse_serverhelloEPNS_13SSL_HANDSHAKEEPhP6cbs_st: 947| 55.1k| CBS *contents) { 948| 55.1k| SSL *const ssl = hs->ssl; 949| 55.1k| if (contents == NULL) { ------------------ | Branch (949:7): [True: 521, False: 54.5k] ------------------ 950| 521| return true; 951| 521| } 952| | 953| 54.5k| if (ssl_protocol_version(ssl) >= TLS1_3_VERSION) { ------------------ | | 545| 54.5k|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (953:7): [True: 0, False: 54.5k] ------------------ 954| 0| return false; 955| 0| } 956| | 957| | // If |SSL_OP_NO_TICKET| is set then no extension will have been sent and 958| | // this function should never be called, even if the server tries to send the 959| | // extension. 960| 54.5k| assert((SSL_get_options(ssl) & SSL_OP_NO_TICKET) == 0); 961| | 962| 54.5k| if (CBS_len(contents) != 0) { ------------------ | Branch (962:7): [True: 3, False: 54.5k] ------------------ 963| 3| return false; 964| 3| } 965| | 966| 54.5k| hs->ticket_expected = true; 967| 54.5k| return true; 968| 54.5k|} extensions.cc:_ZN4bsslL24ext_alpn_add_clienthelloEPKNS_13SSL_HANDSHAKEEP6cbb_stS4_NS_23ssl_client_hello_type_tE: 1345| 56.4k| ssl_client_hello_type_t type) { 1346| 56.4k| const SSL *const ssl = hs->ssl; 1347| 56.4k| if (hs->config->alpn_client_proto_list.empty() && SSL_is_quic(ssl)) { ------------------ | Branch (1347:7): [True: 0, False: 56.4k] | Branch (1347:53): [True: 0, False: 0] ------------------ 1348| | // ALPN MUST be used with QUIC. 1349| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_NO_APPLICATION_PROTOCOL); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1350| 0| return false; 1351| 0| } 1352| | 1353| 56.4k| if (hs->config->alpn_client_proto_list.empty() || ------------------ | Branch (1353:7): [True: 0, False: 56.4k] ------------------ 1354| 56.4k| ssl->s3->initial_handshake_complete) { ------------------ | Branch (1354:7): [True: 51.1k, False: 5.28k] ------------------ 1355| 51.1k| return true; 1356| 51.1k| } 1357| | 1358| 5.28k| CBB contents, proto_list; 1359| 5.28k| if (!CBB_add_u16(out_compressible, ------------------ | Branch (1359:7): [True: 0, False: 5.28k] ------------------ 1360| 5.28k| TLSEXT_TYPE_application_layer_protocol_negotiation) || ------------------ | | 65| 5.28k|#define TLSEXT_TYPE_application_layer_protocol_negotiation 16 ------------------ 1361| 5.28k| !CBB_add_u16_length_prefixed(out_compressible, &contents) || ------------------ | Branch (1361:7): [True: 0, False: 5.28k] ------------------ 1362| 5.28k| !CBB_add_u16_length_prefixed(&contents, &proto_list) || ------------------ | Branch (1362:7): [True: 0, False: 5.28k] ------------------ 1363| 5.28k| !CBB_add_bytes(&proto_list, hs->config->alpn_client_proto_list.data(), ------------------ | Branch (1363:7): [True: 0, False: 5.28k] ------------------ 1364| 5.28k| hs->config->alpn_client_proto_list.size()) || 1365| 5.28k| !CBB_flush(out_compressible)) { ------------------ | Branch (1365:7): [True: 0, False: 5.28k] ------------------ 1366| 0| return false; 1367| 0| } 1368| | 1369| 5.28k| return true; 1370| 5.28k|} extensions.cc:_ZN4bsslL26ext_alpn_parse_serverhelloEPNS_13SSL_HANDSHAKEEPhP6cbs_st: 1373| 55.0k| CBS *contents) { 1374| 55.0k| SSL *const ssl = hs->ssl; 1375| 55.0k| if (contents == NULL) { ------------------ | Branch (1375:7): [True: 55.0k, False: 37] ------------------ 1376| 55.0k| if (SSL_is_quic(ssl)) { ------------------ | Branch (1376:9): [True: 0, False: 55.0k] ------------------ 1377| | // ALPN is required when QUIC is used. 1378| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_NO_APPLICATION_PROTOCOL); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1379| 0| *out_alert = SSL_AD_NO_APPLICATION_PROTOCOL; ------------------ | | 4400| 0|#define SSL_AD_NO_APPLICATION_PROTOCOL TLS1_AD_NO_APPLICATION_PROTOCOL | | ------------------ | | | | 48| 0|#define TLS1_AD_NO_APPLICATION_PROTOCOL 120 | | ------------------ ------------------ 1380| 0| return false; 1381| 0| } 1382| 55.0k| return true; 1383| 55.0k| } 1384| | 1385| 37| assert(!ssl->s3->initial_handshake_complete); 1386| 37| assert(!hs->config->alpn_client_proto_list.empty()); 1387| | 1388| 37| if (hs->next_proto_neg_seen) { ------------------ | Branch (1388:7): [True: 1, False: 36] ------------------ 1389| | // NPN and ALPN may not be negotiated in the same connection. 1390| 1| *out_alert = SSL_AD_ILLEGAL_PARAMETER; ------------------ | | 4379| 1|#define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER | | ------------------ | | | | 189| 1|#define SSL3_AD_ILLEGAL_PARAMETER 47 // fatal | | ------------------ ------------------ 1391| 1| OPENSSL_PUT_ERROR(SSL, SSL_R_NEGOTIATED_BOTH_NPN_AND_ALPN); ------------------ | | 361| 1| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1392| 1| return false; 1393| 1| } 1394| | 1395| | // The extension data consists of a ProtocolNameList which must have 1396| | // exactly one ProtocolName. Each of these is length-prefixed. 1397| 36| CBS protocol_name_list, protocol_name; 1398| 36| if (!CBS_get_u16_length_prefixed(contents, &protocol_name_list) || // ------------------ | Branch (1398:7): [True: 2, False: 34] ------------------ 1399| 36| CBS_len(contents) != 0 || // ------------------ | Branch (1399:7): [True: 1, False: 33] ------------------ 1400| 36| !CBS_get_u8_length_prefixed(&protocol_name_list, &protocol_name) || // ------------------ | Branch (1400:7): [True: 1, False: 32] ------------------ 1401| | // Empty protocol names are forbidden. 1402| 36| CBS_len(&protocol_name) == 0 || // ------------------ | Branch (1402:7): [True: 1, False: 31] ------------------ 1403| 36| CBS_len(&protocol_name_list) != 0) { ------------------ | Branch (1403:7): [True: 1, False: 30] ------------------ 1404| 6| return false; 1405| 6| } 1406| | 1407| 30| if (!ssl_is_alpn_protocol_allowed(hs, protocol_name)) { ------------------ | Branch (1407:7): [True: 28, False: 2] ------------------ 1408| 28| OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_ALPN_PROTOCOL); ------------------ | | 361| 28| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1409| 28| *out_alert = SSL_AD_ILLEGAL_PARAMETER; ------------------ | | 4379| 28|#define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER | | ------------------ | | | | 189| 28|#define SSL3_AD_ILLEGAL_PARAMETER 47 // fatal | | ------------------ ------------------ 1410| 28| return false; 1411| 28| } 1412| | 1413| 2| if (!ssl->s3->alpn_selected.CopyFrom(protocol_name)) { ------------------ | Branch (1413:7): [True: 0, False: 2] ------------------ 1414| 0| *out_alert = SSL_AD_INTERNAL_ERROR; ------------------ | | 4387| 0|#define SSL_AD_INTERNAL_ERROR TLS1_AD_INTERNAL_ERROR | | ------------------ | | | | 37| 0|#define TLS1_AD_INTERNAL_ERROR 80 | | ------------------ ------------------ 1415| 0| return false; 1416| 0| } 1417| | 1418| 2| return true; 1419| 2|} extensions.cc:_ZN4bsslL24ext_ocsp_add_clienthelloEPKNS_13SSL_HANDSHAKEEP6cbb_stS4_NS_23ssl_client_hello_type_tE: 1038| 56.4k| ssl_client_hello_type_t type) { 1039| 56.4k| if (!hs->config->ocsp_stapling_enabled) { ------------------ | Branch (1039:7): [True: 0, False: 56.4k] ------------------ 1040| 0| return true; 1041| 0| } 1042| | 1043| 56.4k| CBB contents; 1044| 56.4k| if (!CBB_add_u16(out_compressible, TLSEXT_TYPE_status_request) || ------------------ | | 53| 56.4k|#define TLSEXT_TYPE_status_request 5 ------------------ | Branch (1044:7): [True: 0, False: 56.4k] ------------------ 1045| 56.4k| !CBB_add_u16_length_prefixed(out_compressible, &contents) || ------------------ | Branch (1045:7): [True: 0, False: 56.4k] ------------------ 1046| 56.4k| !CBB_add_u8(&contents, TLSEXT_STATUSTYPE_ocsp) || ------------------ | | 145| 56.4k|#define TLSEXT_STATUSTYPE_ocsp 1 ------------------ | Branch (1046:7): [True: 0, False: 56.4k] ------------------ 1047| 56.4k| !CBB_add_u16(&contents, 0 /* empty responder ID list */) || ------------------ | Branch (1047:7): [True: 0, False: 56.4k] ------------------ 1048| 56.4k| !CBB_add_u16(&contents, 0 /* empty request extensions */) || ------------------ | Branch (1048:7): [True: 0, False: 56.4k] ------------------ 1049| 56.4k| !CBB_flush(out_compressible)) { ------------------ | Branch (1049:7): [True: 0, False: 56.4k] ------------------ 1050| 0| return false; 1051| 0| } 1052| | 1053| 56.4k| return true; 1054| 56.4k|} extensions.cc:_ZN4bsslL26ext_ocsp_parse_serverhelloEPNS_13SSL_HANDSHAKEEPhP6cbs_st: 1057| 55.0k| CBS *contents) { 1058| 55.0k| SSL *const ssl = hs->ssl; 1059| 55.0k| if (contents == NULL) { ------------------ | Branch (1059:7): [True: 40.8k, False: 14.2k] ------------------ 1060| 40.8k| return true; 1061| 40.8k| } 1062| | 1063| | // TLS 1.3 OCSP responses are included in the Certificate extensions. 1064| 14.2k| if (ssl_protocol_version(ssl) >= TLS1_3_VERSION) { ------------------ | | 545| 14.2k|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (1064:7): [True: 1, False: 14.2k] ------------------ 1065| 1| return false; 1066| 1| } 1067| | 1068| | // OCSP stapling is forbidden on non-certificate ciphers. 1069| 14.2k| if (CBS_len(contents) != 0 || ------------------ | Branch (1069:7): [True: 1, False: 14.2k] ------------------ 1070| 14.2k| !ssl_cipher_uses_certificate_auth(hs->new_cipher)) { ------------------ | Branch (1070:7): [True: 0, False: 14.2k] ------------------ 1071| 1| return false; 1072| 1| } 1073| | 1074| | // Note this does not check for resumption in TLS 1.2. Sending 1075| | // status_request here does not make sense, but OpenSSL does so and the 1076| | // specification does not say anything. Tolerate it but ignore it. 1077| | 1078| 14.2k| hs->certificate_status_expected = true; 1079| 14.2k| return true; 1080| 14.2k|} extensions.cc:_ZN4bsslL27ext_sigalgs_add_clienthelloEPKNS_13SSL_HANDSHAKEEP6cbb_stS4_NS_23ssl_client_hello_type_tE: 993| 56.4k| ssl_client_hello_type_t type) { 994| 56.4k| if (hs->max_version < TLS1_2_VERSION) { ------------------ | | 544| 56.4k|#define TLS1_2_VERSION 0x0303 ------------------ | Branch (994:7): [True: 0, False: 56.4k] ------------------ 995| 0| return true; 996| 0| } 997| | // In PAKE mode, signature_algorithms is not used. 998| 56.4k| if (hs->pake_prover != nullptr) { ------------------ | Branch (998:7): [True: 0, False: 56.4k] ------------------ 999| 0| return true; 1000| 0| } 1001| | 1002| 56.4k| CBB contents, sigalgs_cbb; 1003| 56.4k| if (!CBB_add_u16(out_compressible, TLSEXT_TYPE_signature_algorithms) || ------------------ | | 59| 56.4k|#define TLSEXT_TYPE_signature_algorithms 13 ------------------ | Branch (1003:7): [True: 0, False: 56.4k] ------------------ 1004| 56.4k| !CBB_add_u16_length_prefixed(out_compressible, &contents) || ------------------ | Branch (1004:7): [True: 0, False: 56.4k] ------------------ 1005| 56.4k| !CBB_add_u16_length_prefixed(&contents, &sigalgs_cbb) || ------------------ | Branch (1005:7): [True: 0, False: 56.4k] ------------------ 1006| 56.4k| !tls12_add_verify_sigalgs(hs, &sigalgs_cbb) || ------------------ | Branch (1006:7): [True: 0, False: 56.4k] ------------------ 1007| 56.4k| !CBB_flush(out_compressible)) { ------------------ | Branch (1007:7): [True: 0, False: 56.4k] ------------------ 1008| 0| return false; 1009| 0| } 1010| | 1011| 56.4k| return true; 1012| 56.4k|} extensions.cc:_ZN4bsslL24forbid_parse_serverhelloEPNS_13SSL_HANDSHAKEEPhP6cbs_st: 481| 440k| CBS *contents) { 482| 440k| if (contents != NULL) { ------------------ | Branch (482:7): [True: 2, False: 440k] ------------------ 483| | // Servers MUST NOT send this extension. 484| 2| *out_alert = SSL_AD_UNSUPPORTED_EXTENSION; ------------------ | | 4392| 2|#define SSL_AD_UNSUPPORTED_EXTENSION TLS1_AD_UNSUPPORTED_EXTENSION | | ------------------ | | | | 41| 2|#define TLS1_AD_UNSUPPORTED_EXTENSION 110 | | ------------------ ------------------ 485| 2| OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_EXTENSION); ------------------ | | 361| 2| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 486| 2| return false; 487| 2| } 488| | 489| 440k| return true; 490| 440k|} extensions.cc:_ZN4bsslL23ext_npn_add_clienthelloEPKNS_13SSL_HANDSHAKEEP6cbb_stS4_NS_23ssl_client_hello_type_tE: 1122| 56.4k| ssl_client_hello_type_t type) { 1123| 56.4k| const SSL *const ssl = hs->ssl; 1124| 56.4k| if (ssl->ctx->next_proto_select_cb == NULL || ------------------ | Branch (1124:7): [True: 0, False: 56.4k] ------------------ 1125| | // Do not allow NPN to change on renegotiation. 1126| 56.4k| ssl->s3->initial_handshake_complete || ------------------ | Branch (1126:7): [True: 51.1k, False: 5.28k] ------------------ 1127| | // NPN is not defined in DTLS or TLS 1.3. 1128| 56.4k| SSL_is_dtls(ssl) || hs->min_version >= TLS1_3_VERSION || ------------------ | | 545| 61.7k|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (1128:7): [True: 0, False: 5.28k] | Branch (1128:27): [True: 0, False: 5.28k] ------------------ 1129| 56.4k| type == ssl_client_hello_inner) { ------------------ | Branch (1129:7): [True: 0, False: 5.28k] ------------------ 1130| 51.1k| return true; 1131| 51.1k| } 1132| | 1133| 5.28k| if (!CBB_add_u16(out, TLSEXT_TYPE_next_proto_neg) || ------------------ | | 130| 5.28k|#define TLSEXT_TYPE_next_proto_neg 13172 ------------------ | Branch (1133:7): [True: 0, False: 5.28k] ------------------ 1134| 5.28k| !CBB_add_u16(out, 0 /* length */)) { ------------------ | Branch (1134:7): [True: 0, False: 5.28k] ------------------ 1135| 0| return false; 1136| 0| } 1137| | 1138| 5.28k| return true; 1139| 5.28k|} extensions.cc:_ZN4bsslL25ext_npn_parse_serverhelloEPNS_13SSL_HANDSHAKEEPhP6cbs_st: 1142| 55.0k| CBS *contents) { 1143| 55.0k| SSL *const ssl = hs->ssl; 1144| 55.0k| if (contents == NULL) { ------------------ | Branch (1144:7): [True: 55.0k, False: 15] ------------------ 1145| 55.0k| return true; 1146| 55.0k| } 1147| | 1148| 15| if (ssl_protocol_version(ssl) >= TLS1_3_VERSION) { ------------------ | | 545| 15|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (1148:7): [True: 0, False: 15] ------------------ 1149| 0| return false; 1150| 0| } 1151| | 1152| | // If any of these are false then we should never have sent the NPN 1153| | // extension in the ClientHello and thus this function should never have been 1154| | // called. 1155| 15| assert(!ssl->s3->initial_handshake_complete); 1156| 15| assert(!SSL_is_dtls(ssl)); 1157| 15| assert(ssl->ctx->next_proto_select_cb != NULL); 1158| | 1159| 15| if (!ssl->s3->alpn_selected.empty()) { ------------------ | Branch (1159:7): [True: 1, False: 14] ------------------ 1160| | // NPN and ALPN may not be negotiated in the same connection. 1161| 1| *out_alert = SSL_AD_ILLEGAL_PARAMETER; ------------------ | | 4379| 1|#define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER | | ------------------ | | | | 189| 1|#define SSL3_AD_ILLEGAL_PARAMETER 47 // fatal | | ------------------ ------------------ 1162| 1| OPENSSL_PUT_ERROR(SSL, SSL_R_NEGOTIATED_BOTH_NPN_AND_ALPN); ------------------ | | 361| 1| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1163| 1| return false; 1164| 1| } 1165| | 1166| 14| const uint8_t *const orig_contents = CBS_data(contents); 1167| 14| const size_t orig_len = CBS_len(contents); 1168| | 1169| 57| while (CBS_len(contents) != 0) { ------------------ | Branch (1169:10): [True: 51, False: 6] ------------------ 1170| 51| CBS proto; 1171| 51| if (!CBS_get_u8_length_prefixed(contents, &proto) || // ------------------ | Branch (1171:9): [True: 6, False: 45] ------------------ 1172| 51| CBS_len(&proto) == 0) { ------------------ | Branch (1172:9): [True: 2, False: 43] ------------------ 1173| 8| return false; 1174| 8| } 1175| 51| } 1176| | 1177| | // |orig_len| fits in |unsigned| because TLS extensions use 16-bit lengths. 1178| 6| uint8_t *selected; 1179| 6| uint8_t selected_len; 1180| 6| if (ssl->ctx->next_proto_select_cb( ------------------ | Branch (1180:7): [True: 0, False: 6] | Branch (1180:7): [True: 0, False: 6] ------------------ 1181| 6| ssl, &selected, &selected_len, orig_contents, 1182| 6| static_cast(orig_len), 1183| 6| ssl->ctx->next_proto_select_cb_arg) != SSL_TLSEXT_ERR_OK || ------------------ | | 3169| 12|#define SSL_TLSEXT_ERR_OK 0 ------------------ 1184| 6| !ssl->s3->next_proto_negotiated.CopyFrom(Span(selected, selected_len))) { ------------------ | Branch (1184:7): [True: 0, False: 6] ------------------ 1185| 0| *out_alert = SSL_AD_INTERNAL_ERROR; ------------------ | | 4387| 0|#define SSL_AD_INTERNAL_ERROR TLS1_AD_INTERNAL_ERROR | | ------------------ | | | | 37| 0|#define TLS1_AD_INTERNAL_ERROR 80 | | ------------------ ------------------ 1186| 0| return false; 1187| 0| } 1188| | 1189| 6| hs->next_proto_neg_seen = true; 1190| 6| return true; 1191| 6|} extensions.cc:_ZN4bsslL23ext_sct_add_clienthelloEPKNS_13SSL_HANDSHAKEEP6cbb_stS4_NS_23ssl_client_hello_type_tE: 1251| 56.4k| ssl_client_hello_type_t type) { 1252| 56.4k| if (!hs->config->signed_cert_timestamps_enabled) { ------------------ | Branch (1252:7): [True: 0, False: 56.4k] ------------------ 1253| 0| return true; 1254| 0| } 1255| | 1256| 56.4k| if (!CBB_add_u16(out_compressible, TLSEXT_TYPE_certificate_timestamp) || ------------------ | | 127| 56.4k|#define TLSEXT_TYPE_certificate_timestamp 18 ------------------ | Branch (1256:7): [True: 0, False: 56.4k] ------------------ 1257| 56.4k| !CBB_add_u16(out_compressible, 0 /* length */)) { ------------------ | Branch (1257:7): [True: 0, False: 56.4k] ------------------ 1258| 0| return false; 1259| 0| } 1260| | 1261| 56.4k| return true; 1262| 56.4k|} extensions.cc:_ZN4bsslL25ext_sct_parse_serverhelloEPNS_13SSL_HANDSHAKEEPhP6cbs_st: 1265| 55.0k| CBS *contents) { 1266| 55.0k| SSL *const ssl = hs->ssl; 1267| 55.0k| if (contents == NULL) { ------------------ | Branch (1267:7): [True: 40.7k, False: 14.2k] ------------------ 1268| 40.7k| return true; 1269| 40.7k| } 1270| | 1271| | // TLS 1.3 SCTs are included in the Certificate extensions. 1272| 14.2k| if (ssl_protocol_version(ssl) >= TLS1_3_VERSION) { ------------------ | | 545| 14.2k|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (1272:7): [True: 1, False: 14.2k] ------------------ 1273| 1| *out_alert = SSL_AD_DECODE_ERROR; ------------------ | | 4382| 1|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 1|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 1274| 1| return false; 1275| 1| } 1276| | 1277| | // If this is false then we should never have sent the SCT extension in the 1278| | // ClientHello and thus this function should never have been called. 1279| 14.2k| assert(hs->config->signed_cert_timestamps_enabled); 1280| | 1281| 14.2k| if (!ssl_is_sct_list_valid(contents)) { ------------------ | Branch (1281:7): [True: 16, False: 14.2k] ------------------ 1282| 16| *out_alert = SSL_AD_DECODE_ERROR; ------------------ | | 4382| 16|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 16|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 1283| 16| return false; 1284| 16| } 1285| | 1286| | // Session resumption uses the original session information. The extension 1287| | // should not be sent on resumption, but RFC 6962 did not make it a 1288| | // requirement, so tolerate this. 1289| | // 1290| | // TODO(davidben): Enforce this anyway. 1291| 14.2k| if (!ssl->s3->session_reused) { ------------------ | Branch (1291:7): [True: 14.2k, False: 0] ------------------ 1292| 14.2k| hs->new_session->signed_cert_timestamp_list.reset( 1293| 14.2k| CRYPTO_BUFFER_new_from_CBS(contents, ssl->ctx->pool)); 1294| 14.2k| if (hs->new_session->signed_cert_timestamp_list == nullptr) { ------------------ | Branch (1294:9): [True: 0, False: 14.2k] ------------------ 1295| 0| *out_alert = SSL_AD_INTERNAL_ERROR; ------------------ | | 4387| 0|#define SSL_AD_INTERNAL_ERROR TLS1_AD_INTERNAL_ERROR | | ------------------ | | | | 37| 0|#define TLS1_AD_INTERNAL_ERROR 80 | | ------------------ ------------------ 1296| 0| return false; 1297| 0| } 1298| 14.2k| } 1299| | 1300| 14.2k| return true; 1301| 14.2k|} extensions.cc:_ZN4bsslL30ext_channel_id_add_clienthelloEPKNS_13SSL_HANDSHAKEEP6cbb_stS4_NS_23ssl_client_hello_type_tE: 1567| 56.4k| ssl_client_hello_type_t type) { 1568| 56.4k| const SSL *const ssl = hs->ssl; 1569| 56.4k| if (!hs->config->channel_id_private || SSL_is_dtls(ssl) || ------------------ | Branch (1569:7): [True: 0, False: 56.4k] | Branch (1569:42): [True: 0, False: 56.4k] ------------------ 1570| | // Don't offer Channel ID in ClientHelloOuter. ClientHelloOuter handshakes 1571| | // are not authenticated for the name that can learn the Channel ID. 1572| | // 1573| | // We could alternatively offer the extension but sign with a random key. 1574| | // For other extensions, we try to align |ssl_client_hello_outer| and 1575| | // |ssl_client_hello_unencrypted|, to improve the effectiveness of ECH 1576| | // GREASE. However, Channel ID is deprecated and unlikely to be used with 1577| | // ECH, so do the simplest thing. 1578| 56.4k| type == ssl_client_hello_outer) { ------------------ | Branch (1578:7): [True: 0, False: 56.4k] ------------------ 1579| 0| return true; 1580| 0| } 1581| | 1582| 56.4k| if (!CBB_add_u16(out, TLSEXT_TYPE_channel_id) || ------------------ | | 133| 56.4k|#define TLSEXT_TYPE_channel_id 30032 ------------------ | Branch (1582:7): [True: 0, False: 56.4k] ------------------ 1583| 56.4k| !CBB_add_u16(out, 0 /* length */)) { ------------------ | Branch (1583:7): [True: 0, False: 56.4k] ------------------ 1584| 0| return false; 1585| 0| } 1586| | 1587| 56.4k| return true; 1588| 56.4k|} extensions.cc:_ZN4bsslL32ext_channel_id_parse_serverhelloEPNS_13SSL_HANDSHAKEEPhP6cbs_st: 1592| 55.0k| CBS *contents) { 1593| 55.0k| if (contents == NULL) { ------------------ | Branch (1593:7): [True: 54.8k, False: 158] ------------------ 1594| 54.8k| return true; 1595| 54.8k| } 1596| | 1597| 158| assert(!SSL_is_dtls(hs->ssl)); 1598| 158| assert(hs->config->channel_id_private); 1599| | 1600| 158| if (CBS_len(contents) != 0) { ------------------ | Branch (1600:7): [True: 2, False: 156] ------------------ 1601| 2| return false; 1602| 2| } 1603| | 1604| 156| hs->channel_id_negotiated = true; 1605| 156| return true; 1606| 158|} extensions.cc:_ZN4bsslL24ext_srtp_add_clienthelloEPKNS_13SSL_HANDSHAKEEP6cbb_stS4_NS_23ssl_client_hello_type_tE: 1644| 56.4k| ssl_client_hello_type_t type) { 1645| 56.4k| const SSL *const ssl = hs->ssl; 1646| 56.4k| const STACK_OF(SRTP_PROTECTION_PROFILE) *profiles = 1647| 56.4k| SSL_get_srtp_profiles(ssl); 1648| 56.4k| if (profiles == NULL || // ------------------ | Branch (1648:7): [True: 56.4k, False: 0] ------------------ 1649| 56.4k| sk_SRTP_PROTECTION_PROFILE_num(profiles) == 0 || // ------------------ | Branch (1649:7): [True: 0, False: 0] ------------------ 1650| 56.4k| !SSL_is_dtls(ssl)) { ------------------ | Branch (1650:7): [True: 0, False: 0] ------------------ 1651| 56.4k| return true; 1652| 56.4k| } 1653| | 1654| 0| CBB contents, profile_ids; 1655| 0| if (!CBB_add_u16(out_compressible, TLSEXT_TYPE_srtp) || ------------------ | | 62| 0|#define TLSEXT_TYPE_srtp 14 ------------------ | Branch (1655:7): [True: 0, False: 0] ------------------ 1656| 0| !CBB_add_u16_length_prefixed(out_compressible, &contents) || ------------------ | Branch (1656:7): [True: 0, False: 0] ------------------ 1657| 0| !CBB_add_u16_length_prefixed(&contents, &profile_ids)) { ------------------ | Branch (1657:7): [True: 0, False: 0] ------------------ 1658| 0| return false; 1659| 0| } 1660| | 1661| 0| for (const SRTP_PROTECTION_PROFILE *profile : profiles) { ------------------ | Branch (1661:47): [True: 0, False: 0] ------------------ 1662| 0| if (!CBB_add_u16(&profile_ids, profile->id)) { ------------------ | Branch (1662:9): [True: 0, False: 0] ------------------ 1663| 0| return false; 1664| 0| } 1665| 0| } 1666| | 1667| 0| if (!CBB_add_u8(&contents, 0 /* empty use_mki value */) || ------------------ | Branch (1667:7): [True: 0, False: 0] ------------------ 1668| 0| !CBB_flush(out_compressible)) { ------------------ | Branch (1668:7): [True: 0, False: 0] ------------------ 1669| 0| return false; 1670| 0| } 1671| | 1672| 0| return true; 1673| 0|} extensions.cc:_ZN4bsslL26ext_srtp_parse_serverhelloEPNS_13SSL_HANDSHAKEEPhP6cbs_st: 1676| 55.0k| CBS *contents) { 1677| 55.0k| SSL *const ssl = hs->ssl; 1678| 55.0k| if (contents == NULL) { ------------------ | Branch (1678:7): [True: 55.0k, False: 0] ------------------ 1679| 55.0k| return true; 1680| 55.0k| } 1681| | 1682| | // The extension consists of a u16-prefixed profile ID list containing a 1683| | // single uint16_t profile ID, then followed by a u8-prefixed srtp_mki field. 1684| | // 1685| | // See https://tools.ietf.org/html/rfc5764#section-4.1.1 1686| 0| assert(SSL_is_dtls(ssl)); 1687| 0| CBS profile_ids, srtp_mki; 1688| 0| uint16_t profile_id; 1689| 0| if (!CBS_get_u16_length_prefixed(contents, &profile_ids) || // ------------------ | Branch (1689:7): [True: 0, False: 0] ------------------ 1690| 0| !CBS_get_u16(&profile_ids, &profile_id) || // ------------------ | Branch (1690:7): [True: 0, False: 0] ------------------ 1691| 0| CBS_len(&profile_ids) != 0 || // ------------------ | Branch (1691:7): [True: 0, False: 0] ------------------ 1692| 0| !CBS_get_u8_length_prefixed(contents, &srtp_mki) || // ------------------ | Branch (1692:7): [True: 0, False: 0] ------------------ 1693| 0| CBS_len(contents) != 0) { ------------------ | Branch (1693:7): [True: 0, False: 0] ------------------ 1694| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1695| 0| return false; 1696| 0| } 1697| | 1698| 0| if (CBS_len(&srtp_mki) != 0) { ------------------ | Branch (1698:7): [True: 0, False: 0] ------------------ 1699| | // Must be no MKI, since we never offer one. 1700| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_SRTP_MKI_VALUE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1701| 0| *out_alert = SSL_AD_ILLEGAL_PARAMETER; ------------------ | | 4379| 0|#define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER | | ------------------ | | | | 189| 0|#define SSL3_AD_ILLEGAL_PARAMETER 47 // fatal | | ------------------ ------------------ 1702| 0| return false; 1703| 0| } 1704| | 1705| | // Check to see if the server gave us something we support and offered. 1706| 0| for (const SRTP_PROTECTION_PROFILE *profile : SSL_get_srtp_profiles(ssl)) { ------------------ | Branch (1706:47): [True: 0, False: 0] ------------------ 1707| 0| if (profile->id == profile_id) { ------------------ | Branch (1707:9): [True: 0, False: 0] ------------------ 1708| 0| ssl->s3->srtp_profile = profile; 1709| 0| return true; 1710| 0| } 1711| 0| } 1712| | 1713| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1714| 0| *out_alert = SSL_AD_ILLEGAL_PARAMETER; ------------------ | | 4379| 0|#define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER | | ------------------ | | | | 189| 0|#define SSL3_AD_ILLEGAL_PARAMETER 47 // fatal | | ------------------ ------------------ 1715| 0| return false; 1716| 0|} extensions.cc:_ZN4bsslL29ext_key_share_add_clienthelloEPKNS_13SSL_HANDSHAKEEP6cbb_stS4_NS_23ssl_client_hello_type_tE: 2271| 56.4k| ssl_client_hello_type_t type) { 2272| | // If offering a PAKE, do not set up key shares. We do not currently support 2273| | // clients offering both PAKE and non-PAKE modes, including resumption. 2274| 56.4k| if (hs->max_version < TLS1_3_VERSION || hs->pake_prover) { ------------------ | | 545| 112k|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (2274:7): [True: 0, False: 56.4k] | Branch (2274:43): [True: 0, False: 56.4k] ------------------ 2275| 0| return true; 2276| 0| } 2277| | 2278| 56.4k| assert(!hs->key_share_bytes.empty()); 2279| 56.4k| CBB contents, kse_bytes; 2280| 56.4k| if (!CBB_add_u16(out_compressible, TLSEXT_TYPE_key_share) || ------------------ | | 104| 56.4k|#define TLSEXT_TYPE_key_share 51 ------------------ | Branch (2280:7): [True: 0, False: 56.4k] ------------------ 2281| 56.4k| !CBB_add_u16_length_prefixed(out_compressible, &contents) || ------------------ | Branch (2281:7): [True: 0, False: 56.4k] ------------------ 2282| 56.4k| !CBB_add_u16_length_prefixed(&contents, &kse_bytes) || ------------------ | Branch (2282:7): [True: 0, False: 56.4k] ------------------ 2283| 56.4k| !CBB_add_bytes(&kse_bytes, hs->key_share_bytes.data(), ------------------ | Branch (2283:7): [True: 0, False: 56.4k] ------------------ 2284| 56.4k| hs->key_share_bytes.size()) || 2285| 56.4k| !CBB_flush(out_compressible)) { ------------------ | Branch (2285:7): [True: 0, False: 56.4k] ------------------ 2286| 0| return false; 2287| 0| } 2288| | 2289| 56.4k| return true; 2290| 56.4k|} extensions.cc:_ZN4bsslL42ext_psk_key_exchange_modes_add_clienthelloEPKNS_13SSL_HANDSHAKEEP6cbb_stS4_NS_23ssl_client_hello_type_tE: 2049| 56.4k| ssl_client_hello_type_t type) { 2050| 56.4k| if (hs->max_version < TLS1_3_VERSION) { ------------------ | | 545| 56.4k|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (2050:7): [True: 0, False: 56.4k] ------------------ 2051| 0| return true; 2052| 0| } 2053| | // We do not support resumption with PAKEs, so do not offer any PSK key 2054| | // exchange modes, to signal the server not to send a ticket. 2055| 56.4k| if (hs->pake_prover != nullptr) { ------------------ | Branch (2055:7): [True: 0, False: 56.4k] ------------------ 2056| 0| return true; 2057| 0| } 2058| | 2059| 56.4k| CBB contents, ke_modes; 2060| 56.4k| if (!CBB_add_u16(out_compressible, TLSEXT_TYPE_psk_key_exchange_modes) || ------------------ | | 101| 56.4k|#define TLSEXT_TYPE_psk_key_exchange_modes 45 ------------------ | Branch (2060:7): [True: 0, False: 56.4k] ------------------ 2061| 56.4k| !CBB_add_u16_length_prefixed(out_compressible, &contents) || ------------------ | Branch (2061:7): [True: 0, False: 56.4k] ------------------ 2062| 56.4k| !CBB_add_u8_length_prefixed(&contents, &ke_modes) || ------------------ | Branch (2062:7): [True: 0, False: 56.4k] ------------------ 2063| 56.4k| !CBB_add_u8(&ke_modes, SSL_PSK_DHE_KE)) { ------------------ | | 3362| 56.4k|#define SSL_PSK_DHE_KE 0x1 ------------------ | Branch (2063:7): [True: 0, False: 56.4k] ------------------ 2064| 0| return false; 2065| 0| } 2066| | 2067| 56.4k| return CBB_flush(out_compressible); 2068| 56.4k|} extensions.cc:_ZN4bsslL30ext_early_data_add_clienthelloEPKNS_13SSL_HANDSHAKEEP6cbb_stS4_NS_23ssl_client_hello_type_tE: 2099| 56.4k| ssl_client_hello_type_t type) { 2100| 56.4k| const SSL *const ssl = hs->ssl; 2101| | // The second ClientHello never offers early data, and we must have already 2102| | // filled in |early_data_reason| by this point. 2103| 56.4k| if (ssl->s3->used_hello_retry_request) { ------------------ | Branch (2103:7): [True: 96, False: 56.3k] ------------------ 2104| 96| assert(ssl->s3->early_data_reason != ssl_early_data_unknown); 2105| 96| return true; 2106| 96| } 2107| | 2108| 56.3k| if (!hs->early_data_offered) { ------------------ | Branch (2108:7): [True: 56.3k, False: 6] ------------------ 2109| 56.3k| return true; 2110| 56.3k| } 2111| | 2112| | // If offering ECH, the extension only applies to ClientHelloInner, but we 2113| | // send the extension in both ClientHellos. This ensures that, if the server 2114| | // handshakes with ClientHelloOuter, it can skip past early data. See 2115| | // draft-ietf-tls-esni-13, section 6.1. 2116| 6| if (!CBB_add_u16(out_compressible, TLSEXT_TYPE_early_data) || // ------------------ | | 98| 6|#define TLSEXT_TYPE_early_data 42 ------------------ | Branch (2116:7): [True: 0, False: 6] ------------------ 2117| 6| !CBB_add_u16(out_compressible, 0) || // ------------------ | Branch (2117:7): [True: 0, False: 6] ------------------ 2118| 6| !CBB_flush(out_compressible)) { ------------------ | Branch (2118:7): [True: 0, False: 6] ------------------ 2119| 0| return false; 2120| 0| } 2121| | 2122| 6| return true; 2123| 6|} extensions.cc:_ZN4bsslL32ext_early_data_parse_serverhelloEPNS_13SSL_HANDSHAKEEPhP6cbs_st: 2127| 55.0k| CBS *contents) { 2128| 55.0k| SSL *const ssl = hs->ssl; 2129| 55.0k| if (contents == NULL) { ------------------ | Branch (2129:7): [True: 55.0k, False: 0] ------------------ 2130| 55.0k| if (hs->early_data_offered && !ssl->s3->used_hello_retry_request) { ------------------ | Branch (2130:9): [True: 0, False: 55.0k] | Branch (2130:35): [True: 0, False: 0] ------------------ 2131| 0| ssl->s3->early_data_reason = ssl->s3->session_reused ------------------ | Branch (2131:36): [True: 0, False: 0] ------------------ 2132| 0| ? ssl_early_data_peer_declined 2133| 0| : ssl_early_data_session_not_resumed; 2134| 55.0k| } else { 2135| | // We already filled in |early_data_reason| when declining to offer 0-RTT 2136| | // or handling the implicit HelloRetryRequest reject. 2137| 55.0k| assert(ssl->s3->early_data_reason != ssl_early_data_unknown); 2138| 55.0k| } 2139| 55.0k| return true; 2140| 55.0k| } 2141| | 2142| | // If we received an HRR, the second ClientHello never offers early data, so 2143| | // the extensions logic will automatically reject early data extensions as 2144| | // unsolicited. This covered by the ServerAcceptsEarlyDataOnHRR test. 2145| 0| assert(!ssl->s3->used_hello_retry_request); 2146| | 2147| 0| if (CBS_len(contents) != 0) { ------------------ | Branch (2147:7): [True: 0, False: 0] ------------------ 2148| 0| *out_alert = SSL_AD_DECODE_ERROR; ------------------ | | 4382| 0|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 0|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 2149| 0| return false; 2150| 0| } 2151| | 2152| 0| if (!ssl->s3->session_reused) { ------------------ | Branch (2152:7): [True: 0, False: 0] ------------------ 2153| 0| *out_alert = SSL_AD_UNSUPPORTED_EXTENSION; ------------------ | | 4392| 0|#define SSL_AD_UNSUPPORTED_EXTENSION TLS1_AD_UNSUPPORTED_EXTENSION | | ------------------ | | | | 41| 0|#define TLS1_AD_UNSUPPORTED_EXTENSION 110 | | ------------------ ------------------ 2154| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_EXTENSION); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 2155| 0| return false; 2156| 0| } 2157| | 2158| 0| ssl->s3->early_data_reason = ssl_early_data_accepted; 2159| 0| ssl->s3->early_data_accepted = true; 2160| 0| return true; 2161| 0|} extensions.cc:_ZN4bsslL38ext_supported_versions_add_clienthelloEPKNS_13SSL_HANDSHAKEEP6cbb_stS4_NS_23ssl_client_hello_type_tE: 2432| 56.4k| ssl_client_hello_type_t type) { 2433| 56.4k| const SSL *const ssl = hs->ssl; 2434| 56.4k| if (hs->max_version <= TLS1_2_VERSION) { ------------------ | | 544| 56.4k|#define TLS1_2_VERSION 0x0303 ------------------ | Branch (2434:7): [True: 0, False: 56.4k] ------------------ 2435| 0| return true; 2436| 0| } 2437| | 2438| | // supported_versions is compressible in ECH if ClientHelloOuter already 2439| | // requires TLS 1.3. Otherwise the extensions differ in the older versions. 2440| 56.4k| if (hs->min_version >= TLS1_3_VERSION) { ------------------ | | 545| 56.4k|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (2440:7): [True: 0, False: 56.4k] ------------------ 2441| 0| out = out_compressible; 2442| 0| } 2443| | 2444| 56.4k| CBB contents, versions; 2445| 56.4k| if (!CBB_add_u16(out, TLSEXT_TYPE_supported_versions) || ------------------ | | 99| 56.4k|#define TLSEXT_TYPE_supported_versions 43 ------------------ | Branch (2445:7): [True: 0, False: 56.4k] ------------------ 2446| 56.4k| !CBB_add_u16_length_prefixed(out, &contents) || ------------------ | Branch (2446:7): [True: 0, False: 56.4k] ------------------ 2447| 56.4k| !CBB_add_u8_length_prefixed(&contents, &versions)) { ------------------ | Branch (2447:7): [True: 0, False: 56.4k] ------------------ 2448| 0| return false; 2449| 0| } 2450| | 2451| | // Add a fake version. See RFC 8701. 2452| 56.4k| if (ssl->ctx->grease_enabled && ------------------ | Branch (2452:7): [True: 0, False: 56.4k] ------------------ 2453| 56.4k| !CBB_add_u16(&versions, ssl_get_grease_value(hs, ssl_grease_version))) { ------------------ | Branch (2453:7): [True: 0, False: 0] ------------------ 2454| 0| return false; 2455| 0| } 2456| | 2457| | // Encrypted ClientHellos requires TLS 1.3 or later. 2458| 56.4k| uint16_t extra_min_version = 2459| 56.4k| type == ssl_client_hello_inner ? TLS1_3_VERSION : 0; ------------------ | | 545| 0|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (2459:7): [True: 0, False: 56.4k] ------------------ 2460| 56.4k| if (!ssl_add_supported_versions(hs, &versions, extra_min_version) || ------------------ | Branch (2460:7): [True: 0, False: 56.4k] ------------------ 2461| 56.4k| !CBB_flush(out)) { ------------------ | Branch (2461:7): [True: 0, False: 56.4k] ------------------ 2462| 0| return false; 2463| 0| } 2464| | 2465| 56.4k| return true; 2466| 56.4k|} extensions.cc:_ZN4bsslL26ext_cookie_add_clienthelloEPKNS_13SSL_HANDSHAKEEP6cbb_stS4_NS_23ssl_client_hello_type_tE: 2475| 56.4k| ssl_client_hello_type_t type) { 2476| 56.4k| if (hs->cookie.empty()) { ------------------ | Branch (2476:7): [True: 56.4k, False: 1] ------------------ 2477| 56.4k| return true; 2478| 56.4k| } 2479| | 2480| 1| CBB contents, cookie; 2481| 1| if (!CBB_add_u16(out_compressible, TLSEXT_TYPE_cookie) || ------------------ | | 100| 1|#define TLSEXT_TYPE_cookie 44 ------------------ | Branch (2481:7): [True: 0, False: 1] ------------------ 2482| 1| !CBB_add_u16_length_prefixed(out_compressible, &contents) || ------------------ | Branch (2482:7): [True: 0, False: 1] ------------------ 2483| 1| !CBB_add_u16_length_prefixed(&contents, &cookie) || ------------------ | Branch (2483:7): [True: 0, False: 1] ------------------ 2484| 1| !CBB_add_bytes(&cookie, hs->cookie.data(), hs->cookie.size()) || ------------------ | Branch (2484:7): [True: 0, False: 1] ------------------ 2485| 1| !CBB_flush(out_compressible)) { ------------------ | Branch (2485:7): [True: 0, False: 1] ------------------ 2486| 0| return false; 2487| 0| } 2488| | 2489| 1| return true; 2490| 1|} extensions.cc:_ZN4bsslL41ext_quic_transport_params_add_clienthelloEPKNS_13SSL_HANDSHAKEEP6cbb_stS4_NS_23ssl_client_hello_type_tE: 2792| 56.4k| ssl_client_hello_type_t type) { 2793| 56.4k| return ext_quic_transport_params_add_clienthello_impl( 2794| 56.4k| hs, out_compressible, /*use_legacy_codepoint=*/false); 2795| 56.4k|} extensions.cc:_ZN4bsslL46ext_quic_transport_params_add_clienthello_implEPKNS_13SSL_HANDSHAKEEP6cbb_stb: 2757| 112k| const SSL_HANDSHAKE *hs, CBB *out, bool use_legacy_codepoint) { 2758| 112k| if (hs->config->quic_transport_params.empty() && !SSL_is_quic(hs->ssl)) { ------------------ | Branch (2758:7): [True: 112k, False: 0] | Branch (2758:52): [True: 112k, False: 0] ------------------ 2759| 112k| return true; 2760| 112k| } 2761| 0| if (hs->config->quic_transport_params.empty() || !SSL_is_quic(hs->ssl)) { ------------------ | Branch (2761:7): [True: 0, False: 0] | Branch (2761:52): [True: 0, False: 0] ------------------ 2762| | // QUIC Transport Parameters must be sent over QUIC, and they must not be 2763| | // sent over non-QUIC transports. If transport params are set, then 2764| | // SSL(_CTX)_set_quic_method must also be called. 2765| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_QUIC_TRANSPORT_PARAMETERS_MISCONFIGURED); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 2766| 0| return false; 2767| 0| } 2768| 0| assert(hs->min_version > TLS1_2_VERSION); 2769| 0| if (use_legacy_codepoint != hs->config->quic_use_legacy_codepoint) { ------------------ | Branch (2769:7): [True: 0, False: 0] ------------------ 2770| | // Do nothing, we'll send the other codepoint. 2771| 0| return true; 2772| 0| } 2773| | 2774| 0| uint16_t extension_type = TLSEXT_TYPE_quic_transport_parameters; ------------------ | | 81| 0|#define TLSEXT_TYPE_quic_transport_parameters 57 ------------------ 2775| 0| if (hs->config->quic_use_legacy_codepoint) { ------------------ | Branch (2775:7): [True: 0, False: 0] ------------------ 2776| 0| extension_type = TLSEXT_TYPE_quic_transport_parameters_legacy; ------------------ | | 78| 0|#define TLSEXT_TYPE_quic_transport_parameters_legacy 0xffa5 ------------------ 2777| 0| } 2778| | 2779| 0| CBB contents; 2780| 0| if (!CBB_add_u16(out, extension_type) || ------------------ | Branch (2780:7): [True: 0, False: 0] ------------------ 2781| 0| !CBB_add_u16_length_prefixed(out, &contents) || ------------------ | Branch (2781:7): [True: 0, False: 0] ------------------ 2782| 0| !CBB_add_bytes(&contents, hs->config->quic_transport_params.data(), ------------------ | Branch (2782:7): [True: 0, False: 0] ------------------ 2783| 0| hs->config->quic_transport_params.size()) || 2784| 0| !CBB_flush(out)) { ------------------ | Branch (2784:7): [True: 0, False: 0] ------------------ 2785| 0| return false; 2786| 0| } 2787| 0| return true; 2788| 0|} extensions.cc:_ZN4bsslL43ext_quic_transport_params_parse_serverhelloEPNS_13SSL_HANDSHAKEEPhP6cbs_st: 2829| 55.0k| CBS *contents) { 2830| 55.0k| return ext_quic_transport_params_parse_serverhello_impl( 2831| 55.0k| hs, out_alert, contents, /*used_legacy_codepoint=*/false); 2832| 55.0k|} extensions.cc:_ZN4bsslL48ext_quic_transport_params_parse_serverhello_implEPNS_13SSL_HANDSHAKEEPhP6cbs_stb: 2806| 110k| bool used_legacy_codepoint) { 2807| 110k| SSL *const ssl = hs->ssl; 2808| 110k| if (contents == nullptr) { ------------------ | Branch (2808:7): [True: 110k, False: 0] ------------------ 2809| 110k| if (used_legacy_codepoint != hs->config->quic_use_legacy_codepoint) { ------------------ | Branch (2809:9): [True: 55.0k, False: 55.0k] ------------------ 2810| | // Silently ignore because we expect the other QUIC codepoint. 2811| 55.0k| return true; 2812| 55.0k| } 2813| 55.0k| if (!SSL_is_quic(ssl)) { ------------------ | Branch (2813:9): [True: 55.0k, False: 0] ------------------ 2814| 55.0k| return true; 2815| 55.0k| } 2816| 0| *out_alert = SSL_AD_MISSING_EXTENSION; ------------------ | | 4391| 0|#define SSL_AD_MISSING_EXTENSION TLS1_AD_MISSING_EXTENSION | | ------------------ | | | | 40| 0|#define TLS1_AD_MISSING_EXTENSION 109 | | ------------------ ------------------ 2817| 0| return false; 2818| 55.0k| } 2819| | // The extensions parser will check for unsolicited extensions before 2820| | // calling the callback. 2821| 0| assert(SSL_is_quic(ssl)); 2822| 0| assert(ssl_protocol_version(ssl) == TLS1_3_VERSION); 2823| 0| assert(used_legacy_codepoint == hs->config->quic_use_legacy_codepoint); 2824| 0| return ssl->s3->peer_quic_transport_params.CopyFrom(*contents); 2825| 0|} extensions.cc:_ZN4bsslL48ext_quic_transport_params_add_clienthello_legacyEPKNS_13SSL_HANDSHAKEEP6cbb_stS4_NS_23ssl_client_hello_type_tE: 2799| 56.4k| ssl_client_hello_type_t type) { 2800| 56.4k| return ext_quic_transport_params_add_clienthello_impl( 2801| 56.4k| hs, out_compressible, /*use_legacy_codepoint=*/true); 2802| 56.4k|} extensions.cc:_ZN4bsslL50ext_quic_transport_params_parse_serverhello_legacyEPNS_13SSL_HANDSHAKEEPhP6cbs_st: 2835| 55.0k| SSL_HANDSHAKE *hs, uint8_t *out_alert, CBS *contents) { 2836| 55.0k| return ext_quic_transport_params_parse_serverhello_impl( 2837| 55.0k| hs, out_alert, contents, /*used_legacy_codepoint=*/true); 2838| 55.0k|} extensions.cc:_ZN4bsslL32cert_compression_add_clienthelloEPKNS_13SSL_HANDSHAKEEP6cbb_stS4_NS_23ssl_client_hello_type_tE: 2977| 56.4k| ssl_client_hello_type_t type) { 2978| 56.4k| bool first = true; 2979| 56.4k| CBB contents, algs; 2980| | 2981| 56.4k| for (const auto &alg : hs->ssl->ctx->cert_compression_algs) { ------------------ | Branch (2981:24): [True: 0, False: 56.4k] ------------------ 2982| 0| if (alg.decompress == nullptr) { ------------------ | Branch (2982:9): [True: 0, False: 0] ------------------ 2983| 0| continue; 2984| 0| } 2985| | 2986| 0| if (first && ------------------ | Branch (2986:9): [True: 0, False: 0] ------------------ 2987| 0| (!CBB_add_u16(out_compressible, TLSEXT_TYPE_cert_compression) || ------------------ | | 90| 0|#define TLSEXT_TYPE_cert_compression 27 ------------------ | Branch (2987:10): [True: 0, False: 0] ------------------ 2988| 0| !CBB_add_u16_length_prefixed(out_compressible, &contents) || ------------------ | Branch (2988:10): [True: 0, False: 0] ------------------ 2989| 0| !CBB_add_u8_length_prefixed(&contents, &algs))) { ------------------ | Branch (2989:10): [True: 0, False: 0] ------------------ 2990| 0| return false; 2991| 0| } 2992| 0| first = false; 2993| 0| if (!CBB_add_u16(&algs, alg.alg_id)) { ------------------ | Branch (2993:9): [True: 0, False: 0] ------------------ 2994| 0| return false; 2995| 0| } 2996| 0| } 2997| | 2998| 56.4k| return first || CBB_flush(out_compressible); ------------------ | Branch (2998:10): [True: 56.4k, False: 0] | Branch (2998:19): [True: 0, False: 0] ------------------ 2999| 56.4k|} extensions.cc:_ZN4bsslL34cert_compression_parse_serverhelloEPNS_13SSL_HANDSHAKEEPhP6cbs_st: 3003| 55.0k| CBS *contents) { 3004| 55.0k| if (contents == nullptr) { ------------------ | Branch (3004:7): [True: 55.0k, False: 0] ------------------ 3005| 55.0k| return true; 3006| 55.0k| } 3007| | 3008| | // The server may not echo this extension. Any server to client negotiation is 3009| | // advertised in the CertificateRequest message. 3010| 0| return false; 3011| 55.0k|} extensions.cc:_ZN4bsslL40ext_delegated_credential_add_clienthelloEPKNS_13SSL_HANDSHAKEEP6cbb_stS4_NS_23ssl_client_hello_type_tE: 2947| 56.4k| ssl_client_hello_type_t type) { 2948| 56.4k| return true; 2949| 56.4k|} extensions.cc:_ZN4bsslL24ext_alps_add_clienthelloEPKNS_13SSL_HANDSHAKEEP6cbb_stS4_NS_23ssl_client_hello_type_tE: 3351| 56.4k| ssl_client_hello_type_t type) { 3352| 56.4k| return ext_alps_add_clienthello_impl(hs, out, out_compressible, type, 3353| 56.4k| /*use_new_codepoint=*/true); 3354| 56.4k|} extensions.cc:_ZN4bsslL29ext_alps_add_clienthello_implEPKNS_13SSL_HANDSHAKEEP6cbb_stS4_NS_23ssl_client_hello_type_tEb: 3308| 112k| bool use_new_codepoint) { 3309| 112k| const SSL *const ssl = hs->ssl; 3310| 112k| if ( // ALPS requires TLS 1.3. 3311| 112k| hs->max_version < TLS1_3_VERSION || ------------------ | | 545| 225k|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (3311:7): [True: 0, False: 112k] ------------------ 3312| | // Do not offer ALPS without ALPN. 3313| 112k| hs->config->alpn_client_proto_list.empty() || ------------------ | Branch (3313:7): [True: 0, False: 112k] ------------------ 3314| | // Do not offer ALPS if not configured. 3315| 112k| hs->config->alps_configs.empty() || ------------------ | Branch (3315:7): [True: 112k, False: 0] ------------------ 3316| | // Do not offer ALPS on renegotiation handshakes. 3317| 112k| ssl->s3->initial_handshake_complete) { ------------------ | Branch (3317:7): [True: 0, False: 0] ------------------ 3318| 112k| return true; 3319| 112k| } 3320| | 3321| 0| if (use_new_codepoint != hs->config->alps_use_new_codepoint) { ------------------ | Branch (3321:7): [True: 0, False: 0] ------------------ 3322| | // Do nothing, we'll send the other codepoint. 3323| 0| return true; 3324| 0| } 3325| | 3326| 0| uint16_t extension_type = TLSEXT_TYPE_application_settings_old; ------------------ | | 114| 0|#define TLSEXT_TYPE_application_settings_old 17513 ------------------ 3327| 0| if (hs->config->alps_use_new_codepoint) { ------------------ | Branch (3327:7): [True: 0, False: 0] ------------------ 3328| 0| extension_type = TLSEXT_TYPE_application_settings; ------------------ | | 115| 0|#define TLSEXT_TYPE_application_settings 17613 ------------------ 3329| 0| } 3330| | 3331| 0| CBB contents, proto_list, proto; 3332| 0| if (!CBB_add_u16(out_compressible, extension_type) || ------------------ | Branch (3332:7): [True: 0, False: 0] ------------------ 3333| 0| !CBB_add_u16_length_prefixed(out_compressible, &contents) || ------------------ | Branch (3333:7): [True: 0, False: 0] ------------------ 3334| 0| !CBB_add_u16_length_prefixed(&contents, &proto_list)) { ------------------ | Branch (3334:7): [True: 0, False: 0] ------------------ 3335| 0| return false; 3336| 0| } 3337| | 3338| 0| for (const ALPSConfig &config : hs->config->alps_configs) { ------------------ | Branch (3338:33): [True: 0, False: 0] ------------------ 3339| 0| if (!CBB_add_u8_length_prefixed(&proto_list, &proto) || ------------------ | Branch (3339:9): [True: 0, False: 0] ------------------ 3340| 0| !CBB_add_bytes(&proto, config.protocol.data(), ------------------ | Branch (3340:9): [True: 0, False: 0] ------------------ 3341| 0| config.protocol.size())) { 3342| 0| return false; 3343| 0| } 3344| 0| } 3345| | 3346| 0| return CBB_flush(out_compressible); 3347| 0|} extensions.cc:_ZN4bsslL26ext_alps_parse_serverhelloEPNS_13SSL_HANDSHAKEEPhP6cbs_st: 3395| 55.0k| CBS *contents) { 3396| 55.0k| return ext_alps_parse_serverhello_impl(hs, out_alert, contents, 3397| 55.0k| /*use_new_codepoint=*/true); 3398| 55.0k|} extensions.cc:_ZN4bsslL31ext_alps_parse_serverhello_implEPNS_13SSL_HANDSHAKEEPhP6cbs_stb: 3365| 110k| bool use_new_codepoint) { 3366| 110k| SSL *const ssl = hs->ssl; 3367| 110k| if (contents == nullptr) { ------------------ | Branch (3367:7): [True: 110k, False: 0] ------------------ 3368| 110k| return true; 3369| 110k| } 3370| | 3371| 0| assert(!ssl->s3->initial_handshake_complete); 3372| 0| assert(!hs->config->alpn_client_proto_list.empty()); 3373| 0| assert(!hs->config->alps_configs.empty()); 3374| 0| assert(use_new_codepoint == hs->config->alps_use_new_codepoint); 3375| | 3376| | // ALPS requires TLS 1.3. 3377| 0| if (ssl_protocol_version(ssl) < TLS1_3_VERSION) { ------------------ | | 545| 0|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (3377:7): [True: 0, False: 0] ------------------ 3378| 0| *out_alert = SSL_AD_UNSUPPORTED_EXTENSION; ------------------ | | 4392| 0|#define SSL_AD_UNSUPPORTED_EXTENSION TLS1_AD_UNSUPPORTED_EXTENSION | | ------------------ | | | | 41| 0|#define TLS1_AD_UNSUPPORTED_EXTENSION 110 | | ------------------ ------------------ 3379| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_EXTENSION); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 3380| 0| return false; 3381| 0| } 3382| | 3383| | // Note extension callbacks may run in any order, so we defer checking 3384| | // consistency with ALPN to |ssl_check_serverhello_tlsext|. 3385| 0| if (!hs->new_session->peer_application_settings.CopyFrom(*contents)) { ------------------ | Branch (3385:7): [True: 0, False: 0] ------------------ 3386| 0| *out_alert = SSL_AD_INTERNAL_ERROR; ------------------ | | 4387| 0|#define SSL_AD_INTERNAL_ERROR TLS1_AD_INTERNAL_ERROR | | ------------------ | | | | 37| 0|#define TLS1_AD_INTERNAL_ERROR 80 | | ------------------ ------------------ 3387| 0| return false; 3388| 0| } 3389| | 3390| 0| hs->new_session->has_application_settings = true; 3391| 0| return true; 3392| 0|} extensions.cc:_ZN4bsslL28ext_alps_add_clienthello_oldEPKNS_13SSL_HANDSHAKEEP6cbb_stS4_NS_23ssl_client_hello_type_tE: 3358| 56.4k| ssl_client_hello_type_t type) { 3359| 56.4k| return ext_alps_add_clienthello_impl(hs, out, out_compressible, type, 3360| 56.4k| /*use_new_codepoint=*/false); 3361| 56.4k|} extensions.cc:_ZN4bsslL30ext_alps_parse_serverhello_oldEPNS_13SSL_HANDSHAKEEPhP6cbs_st: 3401| 55.0k| uint8_t *out_alert, CBS *contents) { 3402| 55.0k| return ext_alps_parse_serverhello_impl(hs, out_alert, contents, 3403| 55.0k| /*use_new_codepoint=*/false); 3404| 55.0k|} extensions.cc:_ZN4bsslL43ext_certificate_authorities_add_clienthelloEPKNS_13SSL_HANDSHAKEEP6cbb_stS4_NS_23ssl_client_hello_type_tE: 2589| 56.4k| ssl_client_hello_type_t type) { 2590| | // TODO(crbug.com/398275713): What should this send in ClientHelloOuter? 2591| 56.4k| if (ssl_has_CA_names(hs->config)) { ------------------ | Branch (2591:7): [True: 0, False: 56.4k] ------------------ 2592| 0| CBB ca_contents; 2593| 0| if (!CBB_add_u16(out_compressible, ------------------ | Branch (2593:9): [True: 0, False: 0] ------------------ 2594| 0| TLSEXT_TYPE_certificate_authorities) || // ------------------ | | 102| 0|#define TLSEXT_TYPE_certificate_authorities 47 ------------------ 2595| 0| !CBB_add_u16_length_prefixed(out_compressible, &ca_contents) || // ------------------ | Branch (2595:9): [True: 0, False: 0] ------------------ 2596| 0| !ssl_add_CA_names(hs, &ca_contents) || // ------------------ | Branch (2596:9): [True: 0, False: 0] ------------------ 2597| 0| !CBB_flush(out_compressible)) { ------------------ | Branch (2597:9): [True: 0, False: 0] ------------------ 2598| 0| return false; 2599| 0| } 2600| 0| } 2601| 56.4k| return true; 2602| 56.4k|} extensions.cc:_ZN4bsslL24ext_pake_add_clienthelloEPKNS_13SSL_HANDSHAKEEP6cbb_stS4_NS_23ssl_client_hello_type_tE: 3141| 56.4k| ssl_client_hello_type_t type) { 3142| 56.4k| if (hs->pake_share_bytes.empty()) { ------------------ | Branch (3142:7): [True: 56.4k, False: 0] ------------------ 3143| 56.4k| return true; 3144| 56.4k| } 3145| | 3146| 0| CBB pake_share_bytes; 3147| 0| if (!CBB_add_u16(out_compressible, TLSEXT_TYPE_pake) || ------------------ | | 124| 0|#define TLSEXT_TYPE_pake 0x8a3b ------------------ | Branch (3147:7): [True: 0, False: 0] ------------------ 3148| 0| !CBB_add_u16_length_prefixed(out_compressible, &pake_share_bytes) || ------------------ | Branch (3148:7): [True: 0, False: 0] ------------------ 3149| 0| !CBB_add_bytes(&pake_share_bytes, hs->pake_share_bytes.data(), ------------------ | Branch (3149:7): [True: 0, False: 0] ------------------ 3150| 0| hs->pake_share_bytes.size()) || 3151| 0| !CBB_flush(out_compressible)) { ------------------ | Branch (3151:7): [True: 0, False: 0] ------------------ 3152| 0| return false; 3153| 0| } 3154| | 3155| 0| return true; 3156| 0|} extensions.cc:_ZN4bsslL33ext_trust_anchors_add_clienthelloEPKNS_13SSL_HANDSHAKEEP6cbb_stS4_NS_23ssl_client_hello_type_tE: 2642| 56.4k| ssl_client_hello_type_t type) { 2643| 56.4k| if (!hs->config->requested_trust_anchors.has_value()) { ------------------ | Branch (2643:7): [True: 56.4k, False: 0] ------------------ 2644| 56.4k| return true; 2645| 56.4k| } 2646| | // TODO(crbug.com/398275713): What should this send in ClientHelloOuter? 2647| 0| CBB contents, list; 2648| 0| if (!CBB_add_u16(out_compressible, TLSEXT_TYPE_trust_anchors) || // ------------------ | | 138| 0|#define TLSEXT_TYPE_trust_anchors 0xca34 ------------------ | Branch (2648:7): [True: 0, False: 0] ------------------ 2649| 0| !CBB_add_u16_length_prefixed(out_compressible, &contents) || // ------------------ | Branch (2649:7): [True: 0, False: 0] ------------------ 2650| 0| !CBB_add_u16_length_prefixed(&contents, &list) || // ------------------ | Branch (2650:7): [True: 0, False: 0] ------------------ 2651| 0| !CBB_add_bytes(&list, hs->config->requested_trust_anchors->data(), ------------------ | Branch (2651:7): [True: 0, False: 0] ------------------ 2652| 0| hs->config->requested_trust_anchors->size()) || 2653| 0| !CBB_flush(out_compressible)) { ------------------ | Branch (2653:7): [True: 0, False: 0] ------------------ 2654| 0| return false; 2655| 0| } 2656| 0| return true; 2657| 0|} extensions.cc:_ZN4bsslL35ext_trust_anchors_parse_serverhelloEPNS_13SSL_HANDSHAKEEPhP6cbs_st: 2726| 55.0k| CBS *contents) { 2727| 55.0k| if (contents == nullptr) { ------------------ | Branch (2727:7): [True: 55.0k, False: 0] ------------------ 2728| 55.0k| return true; 2729| 55.0k| } 2730| | 2731| 0| if (ssl_protocol_version(hs->ssl) < TLS1_3_VERSION) { ------------------ | | 545| 0|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (2731:7): [True: 0, False: 0] ------------------ 2732| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_EXTENSION); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 2733| 0| *out_alert = SSL_AD_UNSUPPORTED_EXTENSION; ------------------ | | 4392| 0|#define SSL_AD_UNSUPPORTED_EXTENSION TLS1_AD_UNSUPPORTED_EXTENSION | | ------------------ | | | | 41| 0|#define TLS1_AD_UNSUPPORTED_EXTENSION 110 | | ------------------ ------------------ 2734| 0| return false; 2735| 0| } 2736| | 2737| 0| CBS child; 2738| 0| if (!CBS_get_u16_length_prefixed(contents, &child) || ------------------ | Branch (2738:7): [True: 0, False: 0] ------------------ 2739| | // The list of available trust anchors may not be empty. 2740| 0| CBS_len(&child) == 0 || // ------------------ | Branch (2740:7): [True: 0, False: 0] ------------------ 2741| 0| !ssl_is_valid_trust_anchor_list(child)) { ------------------ | Branch (2741:7): [True: 0, False: 0] ------------------ 2742| 0| *out_alert = SSL_AD_DECODE_ERROR; ------------------ | | 4382| 0|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 0|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 2743| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 2744| 0| return false; 2745| 0| } 2746| | 2747| 0| if (!hs->peer_available_trust_anchors.CopyFrom(child)) { ------------------ | Branch (2747:7): [True: 0, False: 0] ------------------ 2748| 0| *out_alert = SSL_AD_INTERNAL_ERROR; ------------------ | | 4387| 0|#define SSL_AD_INTERNAL_ERROR TLS1_AD_INTERNAL_ERROR | | ------------------ | | | | 37| 0|#define TLS1_AD_INTERNAL_ERROR 80 | | ------------------ ------------------ 2749| 0| return false; 2750| 0| } 2751| 0| return true; 2752| 0|} extensions.cc:_ZN4bsslL37ext_pre_shared_key_clienthello_lengthEPKNS_13SSL_HANDSHAKEENS_23ssl_client_hello_type_tE: 1893| 56.4k| const SSL_HANDSHAKE *hs, ssl_client_hello_type_t type) { 1894| 56.4k| const SSL *const ssl = hs->ssl; 1895| 56.4k| if (!should_offer_psk(hs, type)) { ------------------ | Branch (1895:7): [True: 56.3k, False: 47] ------------------ 1896| 56.3k| return 0; 1897| 56.3k| } 1898| | 1899| 47| size_t binder_len = EVP_MD_size(ssl_session_get_digest(ssl->session.get())); 1900| 47| return 15 + ssl->session->ticket.size() + binder_len; 1901| 56.4k|} extensions.cc:_ZN4bsslL16should_offer_pskEPKNS_13SSL_HANDSHAKEENS_23ssl_client_hello_type_tE: 1868| 112k| ssl_client_hello_type_t type) { 1869| 112k| const SSL *const ssl = hs->ssl; 1870| 112k| if (hs->max_version < TLS1_3_VERSION || ssl->session == nullptr || ------------------ | | 545| 225k|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (1870:7): [True: 0, False: 112k] | Branch (1870:43): [True: 111k, False: 1.78k] ------------------ 1871| 112k| ssl_session_get_type(ssl->session.get()) != ------------------ | Branch (1871:7): [True: 1.69k, False: 94] ------------------ 1872| 1.78k| SSLSessionType::kPreSharedKey || 1873| | // TODO(https://crbug.com/boringssl/275): Should we synthesize a 1874| | // placeholder PSK, at least when we offer early data? Otherwise 1875| | // ClientHelloOuter will contain an early_data extension without a 1876| | // pre_shared_key extension and potentially break the recovery flow. 1877| 112k| type == ssl_client_hello_outer) { ------------------ | Branch (1877:7): [True: 0, False: 94] ------------------ 1878| 112k| return false; 1879| 112k| } 1880| | 1881| | // Per RFC 8446 section 4.1.4, skip offering the session if the selected 1882| | // cipher in HelloRetryRequest does not match. This avoids performing the 1883| | // transcript hash transformation for multiple hashes. 1884| 94| if (ssl->s3->used_hello_retry_request && ------------------ | Branch (1884:7): [True: 0, False: 94] ------------------ 1885| 94| ssl->session->cipher->algorithm_prf != hs->new_cipher->algorithm_prf) { ------------------ | Branch (1885:7): [True: 0, False: 0] ------------------ 1886| 0| return false; 1887| 0| } 1888| | 1889| 94| return true; 1890| 94|} extensions.cc:_ZN4bsslL34ext_pre_shared_key_add_clienthelloEPKNS_13SSL_HANDSHAKEEP6cbb_stPbNS_23ssl_client_hello_type_tE: 1905| 56.4k| ssl_client_hello_type_t type) { 1906| 56.4k| const SSL *const ssl = hs->ssl; 1907| 56.4k| *out_needs_binder = false; 1908| 56.4k| if (!should_offer_psk(hs, type)) { ------------------ | Branch (1908:7): [True: 56.3k, False: 47] ------------------ 1909| 56.3k| return true; 1910| 56.3k| } 1911| | 1912| 47| OPENSSL_timeval now = ssl_ctx_get_current_time(ssl->ctx.get()); 1913| 47| uint32_t ticket_age = 1000 * (now.tv_sec - ssl->session->time); 1914| 47| uint32_t obfuscated_ticket_age = ticket_age + ssl->session->ticket_age_add; 1915| | 1916| | // Fill in a placeholder zero binder of the appropriate length. It will be 1917| | // computed and filled in later after length prefixes are computed. 1918| 47| size_t binder_len = EVP_MD_size(ssl_session_get_digest(ssl->session.get())); 1919| | 1920| 47| CBB contents, identity, ticket, binders, binder; 1921| 47| if (!CBB_add_u16(out, TLSEXT_TYPE_pre_shared_key) || ------------------ | | 97| 47|#define TLSEXT_TYPE_pre_shared_key 41 ------------------ | Branch (1921:7): [True: 0, False: 47] ------------------ 1922| 47| !CBB_add_u16_length_prefixed(out, &contents) || ------------------ | Branch (1922:7): [True: 0, False: 47] ------------------ 1923| 47| !CBB_add_u16_length_prefixed(&contents, &identity) || ------------------ | Branch (1923:7): [True: 0, False: 47] ------------------ 1924| 47| !CBB_add_u16_length_prefixed(&identity, &ticket) || ------------------ | Branch (1924:7): [True: 0, False: 47] ------------------ 1925| 47| !CBB_add_bytes(&ticket, ssl->session->ticket.data(), ------------------ | Branch (1925:7): [True: 0, False: 47] ------------------ 1926| 47| ssl->session->ticket.size()) || 1927| 47| !CBB_add_u32(&identity, obfuscated_ticket_age) || ------------------ | Branch (1927:7): [True: 0, False: 47] ------------------ 1928| 47| !CBB_add_u16_length_prefixed(&contents, &binders) || ------------------ | Branch (1928:7): [True: 0, False: 47] ------------------ 1929| 47| !CBB_add_u8_length_prefixed(&binders, &binder) || ------------------ | Branch (1929:7): [True: 0, False: 47] ------------------ 1930| 47| !CBB_add_zeros(&binder, binder_len)) { ------------------ | Branch (1930:7): [True: 0, False: 47] ------------------ 1931| 0| return false; 1932| 0| } 1933| | 1934| 47| *out_needs_binder = true; 1935| 47| return CBB_flush(out); 1936| 47|} extensions.cc:_ZN4bsslL18tls_extension_findEPjt: 3744| 155k| uint16_t value) { 3745| 155k| unsigned i; 3746| 919k| for (i = 0; i < kNumExtensions; i++) { ------------------ | | 3710| 919k|#define kNumExtensions (sizeof(kExtensions) / sizeof(struct tls_extension)) ------------------ | Branch (3746:15): [True: 919k, False: 28] ------------------ 3747| 919k| if (kExtensions[i].value == value) { ------------------ | Branch (3747:9): [True: 155k, False: 763k] ------------------ 3748| 155k| *out_index = i; 3749| 155k| return &kExtensions[i]; 3750| 155k| } 3751| 919k| } 3752| | 3753| 28| return NULL; 3754| 155k|} extensions.cc:_ZN4bsslL27ssl_scan_serverhello_tlsextEPNS_13SSL_HANDSHAKEEPK6cbs_stPi: 4118| 55.2k| int *out_alert) { 4119| 55.2k| CBS extensions = *cbs; 4120| 55.2k| if (!tls1_check_duplicate_extensions(&extensions)) { ------------------ | Branch (4120:7): [True: 28, False: 55.1k] ------------------ 4121| 28| *out_alert = SSL_AD_DECODE_ERROR; ------------------ | | 4382| 28|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 28|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 4122| 28| return false; 4123| 28| } 4124| | 4125| 55.1k| uint32_t received = 0; 4126| 210k| while (CBS_len(&extensions) != 0) { ------------------ | Branch (4126:10): [True: 155k, False: 55.0k] ------------------ 4127| 155k| uint16_t type; 4128| 155k| CBS extension; 4129| | 4130| | // Decode the next extension. 4131| 155k| if (!CBS_get_u16(&extensions, &type) || ------------------ | Branch (4131:9): [True: 0, False: 155k] ------------------ 4132| 155k| !CBS_get_u16_length_prefixed(&extensions, &extension)) { ------------------ | Branch (4132:9): [True: 0, False: 155k] ------------------ 4133| 0| *out_alert = SSL_AD_DECODE_ERROR; ------------------ | | 4382| 0|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 0|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 4134| 0| return false; 4135| 0| } 4136| | 4137| 155k| unsigned ext_index; 4138| 155k| const struct tls_extension *const ext = 4139| 155k| tls_extension_find(&ext_index, type); 4140| | 4141| 155k| if (ext == NULL) { ------------------ | Branch (4141:9): [True: 28, False: 155k] ------------------ 4142| 28| OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_EXTENSION); ------------------ | | 361| 28| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 4143| 28| ERR_add_error_dataf("extension %u", (unsigned)type); 4144| 28| *out_alert = SSL_AD_UNSUPPORTED_EXTENSION; ------------------ | | 4392| 28|#define SSL_AD_UNSUPPORTED_EXTENSION TLS1_AD_UNSUPPORTED_EXTENSION | | ------------------ | | | | 41| 28|#define TLS1_AD_UNSUPPORTED_EXTENSION 110 | | ------------------ ------------------ 4145| 28| return false; 4146| 28| } 4147| | 4148| 155k| static_assert(kNumExtensions <= sizeof(hs->extensions.sent) * 8, 4149| 155k| "too many bits"); 4150| | 4151| 155k| if (!(hs->extensions.sent & (1u << ext_index))) { ------------------ | Branch (4151:9): [True: 6, False: 155k] ------------------ 4152| | // If the extension was never sent then it is illegal. 4153| 6| OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_EXTENSION); ------------------ | | 361| 6| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 4154| 6| ERR_add_error_dataf("extension %u", (unsigned)type); 4155| 6| *out_alert = SSL_AD_UNSUPPORTED_EXTENSION; ------------------ | | 4392| 6|#define SSL_AD_UNSUPPORTED_EXTENSION TLS1_AD_UNSUPPORTED_EXTENSION | | ------------------ | | | | 41| 6|#define TLS1_AD_UNSUPPORTED_EXTENSION 110 | | ------------------ ------------------ 4156| 6| return false; 4157| 6| } 4158| | 4159| 155k| received |= (1u << ext_index); 4160| | 4161| 155k| uint8_t alert = SSL_AD_DECODE_ERROR; ------------------ | | 4382| 155k|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 155k|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 4162| 155k| if (!ext->parse_serverhello(hs, &alert, &extension)) { ------------------ | Branch (4162:9): [True: 96, False: 155k] ------------------ 4163| 96| OPENSSL_PUT_ERROR(SSL, SSL_R_ERROR_PARSING_EXTENSION); ------------------ | | 361| 96| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 4164| 96| ERR_add_error_dataf("extension %u", (unsigned)type); 4165| 96| *out_alert = alert; 4166| 96| return false; 4167| 96| } 4168| 155k| } 4169| | 4170| 1.59M| for (size_t i = 0; i < kNumExtensions; i++) { ------------------ | | 3710| 1.59M|#define kNumExtensions (sizeof(kExtensions) / sizeof(struct tls_extension)) ------------------ | Branch (4170:22): [True: 1.54M, False: 55.0k] ------------------ 4171| 1.54M| if (!(received & (1u << i))) { ------------------ | Branch (4171:9): [True: 1.38M, False: 155k] ------------------ 4172| | // Extension wasn't observed so call the callback with a NULL 4173| | // parameter. 4174| 1.38M| uint8_t alert = SSL_AD_DECODE_ERROR; ------------------ | | 4382| 1.38M|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 1.38M|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 4175| 1.38M| if (!kExtensions[i].parse_serverhello(hs, &alert, NULL)) { ------------------ | Branch (4175:11): [True: 10, False: 1.38M] ------------------ 4176| 10| OPENSSL_PUT_ERROR(SSL, SSL_R_MISSING_EXTENSION); ------------------ | | 361| 10| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 4177| 10| ERR_add_error_dataf("extension %u", (unsigned)kExtensions[i].value); 4178| 10| *out_alert = alert; 4179| 10| return false; 4180| 10| } 4181| 1.38M| } 4182| 1.54M| } 4183| | 4184| 55.0k| return true; 4185| 55.0k|} extensions.cc:_ZN4bsslL28ssl_check_serverhello_tlsextEPNS_13SSL_HANDSHAKEE: 4213| 55.0k|static bool ssl_check_serverhello_tlsext(SSL_HANDSHAKE *hs) { 4214| 55.0k| SSL *const ssl = hs->ssl; 4215| | // ALPS and ALPN have a dependency between each other, so we defer checking 4216| | // consistency to after the callbacks run. 4217| 55.0k| if (hs->new_session != nullptr && hs->new_session->has_application_settings) { ------------------ | Branch (4217:7): [True: 54.8k, False: 231] | Branch (4217:37): [True: 0, False: 54.8k] ------------------ 4218| | // ALPN must be negotiated. 4219| 0| if (ssl->s3->alpn_selected.empty()) { ------------------ | Branch (4219:9): [True: 0, False: 0] ------------------ 4220| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_NEGOTIATED_ALPS_WITHOUT_ALPN); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 4221| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 4379| 0|#define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER | | ------------------ | | | | 189| 0|#define SSL3_AD_ILLEGAL_PARAMETER 47 // fatal | | ------------------ ------------------ 4222| 0| return false; 4223| 0| } 4224| | 4225| | // The negotiated protocol must be one of the ones we advertised for ALPS. 4226| 0| Span settings; 4227| 0| if (!ssl_get_local_application_settings(hs, &settings, ------------------ | Branch (4227:9): [True: 0, False: 0] ------------------ 4228| 0| ssl->s3->alpn_selected)) { 4229| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_ALPN_PROTOCOL); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 4230| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 4379| 0|#define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER | | ------------------ | | | | 189| 0|#define SSL3_AD_ILLEGAL_PARAMETER 47 // fatal | | ------------------ ------------------ 4231| 0| return false; 4232| 0| } 4233| | 4234| 0| if (!hs->new_session->local_application_settings.CopyFrom(settings)) { ------------------ | Branch (4234:9): [True: 0, False: 0] ------------------ 4235| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); ------------------ | | 4387| 0|#define SSL_AD_INTERNAL_ERROR TLS1_AD_INTERNAL_ERROR | | ------------------ | | | | 37| 0|#define TLS1_AD_INTERNAL_ERROR 80 | | ------------------ ------------------ 4236| 0| return false; 4237| 0| } 4238| 0| } 4239| | 4240| 55.0k| return true; 4241| 55.0k|} extensions.cc:_ZN4bsslL15parse_u16_arrayEPK6cbs_stPNS_5ArrayItEE: 2541| 28.1k|static bool parse_u16_array(const CBS *cbs, Array *out) { 2542| 28.1k| CBS copy = *cbs; 2543| 28.1k| if ((CBS_len(©) & 1) != 0) { ------------------ | Branch (2543:7): [True: 2, False: 28.1k] ------------------ 2544| 2| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); ------------------ | | 361| 2| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 2545| 2| return false; 2546| 2| } 2547| | 2548| 28.1k| Array ret; 2549| 28.1k| if (!ret.InitForOverwrite(CBS_len(©) / 2)) { ------------------ | Branch (2549:7): [True: 0, False: 28.1k] ------------------ 2550| 0| return false; 2551| 0| } 2552| 112k| for (size_t i = 0; i < ret.size(); i++) { ------------------ | Branch (2552:22): [True: 84.6k, False: 28.1k] ------------------ 2553| 84.6k| if (!CBS_get_u16(©, &ret[i])) { ------------------ | Branch (2553:9): [True: 0, False: 84.6k] ------------------ 2554| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 2555| 0| return false; 2556| 0| } 2557| 84.6k| } 2558| | 2559| 28.1k| assert(CBS_len(©) == 0); 2560| 28.1k| *out = std::move(ret); 2561| 28.1k| return true; 2562| 28.1k|} SSL_set_handshake_hints: 1027| 15.1k|int SSL_set_handshake_hints(SSL *ssl, const uint8_t *hints, size_t hints_len) { 1028| 15.1k| if (SSL_is_dtls(ssl)) { ------------------ | Branch (1028:7): [True: 0, False: 15.1k] ------------------ 1029| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1030| 0| return 0; 1031| 0| } 1032| | 1033| 15.1k| UniquePtr hints_obj = MakeUnique(); 1034| 15.1k| if (hints_obj == nullptr) { ------------------ | Branch (1034:7): [True: 0, False: 15.1k] ------------------ 1035| 0| return 0; 1036| 0| } 1037| | 1038| 15.1k| CBS cbs, seq, server_random_tls13, key_share, signature_hint, psk, 1039| 15.1k| cert_compression, server_random_tls12, ecdhe, ticket; 1040| 15.1k| int has_server_random_tls13, has_key_share, has_signature_hint, has_psk, 1041| 15.1k| has_cert_compression, has_server_random_tls12, has_ecdhe, has_ticket; 1042| 15.1k| CBS_init(&cbs, hints, hints_len); 1043| 15.1k| if (!CBS_get_asn1(&cbs, &seq, CBS_ASN1_SEQUENCE) || ------------------ | | 223| 15.1k|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED) | | ------------------ | | | | 197| 15.1k|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | | | ------------------ | | | | | | 194| 15.1k|#define CBS_ASN1_TAG_SHIFT 24 | | | | ------------------ | | ------------------ ------------------ | Branch (1043:7): [True: 4.35k, False: 10.8k] ------------------ 1044| 15.1k| !CBS_get_optional_asn1(&seq, &server_random_tls13, ------------------ | Branch (1044:7): [True: 195, False: 10.6k] ------------------ 1045| 10.8k| &has_server_random_tls13, kServerRandomTLS13Tag) || 1046| 15.1k| !CBS_get_optional_asn1(&seq, &key_share, &has_key_share, ------------------ | Branch (1046:7): [True: 195, False: 10.4k] ------------------ 1047| 10.6k| kKeyShareHintTag) || 1048| 15.1k| !CBS_get_optional_asn1(&seq, &signature_hint, &has_signature_hint, ------------------ | Branch (1048:7): [True: 384, False: 10.0k] ------------------ 1049| 10.4k| kSignatureHintTag) || 1050| 15.1k| !CBS_get_optional_asn1(&seq, &psk, &has_psk, kDecryptedPSKTag) || ------------------ | Branch (1050:7): [True: 67, False: 9.96k] ------------------ 1051| 15.1k| !get_optional_implicit_null(&seq, &hints_obj->ignore_psk, ------------------ | Branch (1051:7): [True: 447, False: 9.52k] ------------------ 1052| 9.96k| kIgnorePSKTag) || 1053| 15.1k| !CBS_get_optional_asn1(&seq, &cert_compression, &has_cert_compression, ------------------ | Branch (1053:7): [True: 233, False: 9.28k] ------------------ 1054| 9.52k| kCompressCertificateTag) || 1055| 15.1k| !CBS_get_optional_asn1(&seq, &server_random_tls12, ------------------ | Branch (1055:7): [True: 282, False: 9.00k] ------------------ 1056| 9.28k| &has_server_random_tls12, kServerRandomTLS12Tag) || 1057| 15.1k| !CBS_get_optional_asn1(&seq, &ecdhe, &has_ecdhe, kECDHEHintTag) || ------------------ | Branch (1057:7): [True: 198, False: 8.80k] ------------------ 1058| 15.1k| !CBS_get_optional_asn1(&seq, &ticket, &has_ticket, kDecryptedTicketTag) || ------------------ | Branch (1058:7): [True: 198, False: 8.61k] ------------------ 1059| 15.1k| !get_optional_implicit_null(&seq, &hints_obj->renew_ticket, ------------------ | Branch (1059:7): [True: 234, False: 8.37k] ------------------ 1060| 8.61k| kRenewTicketTag) || 1061| 15.1k| !get_optional_implicit_null(&seq, &hints_obj->ignore_ticket, ------------------ | Branch (1061:7): [True: 301, False: 8.07k] ------------------ 1062| 8.37k| kIgnoreTicketTag)) { 1063| 7.08k| OPENSSL_PUT_ERROR(SSL, SSL_R_COULD_NOT_PARSE_HINTS); ------------------ | | 361| 7.08k| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1064| 7.08k| return 0; 1065| 7.08k| } 1066| | 1067| 8.07k| if (has_server_random_tls13 && ------------------ | Branch (1067:7): [True: 148, False: 7.92k] ------------------ 1068| 8.07k| !hints_obj->server_random_tls13.CopyFrom(server_random_tls13)) { ------------------ | Branch (1068:7): [True: 0, False: 148] ------------------ 1069| 0| return 0; 1070| 0| } 1071| | 1072| 8.07k| if (has_key_share) { ------------------ | Branch (1072:7): [True: 1.44k, False: 6.62k] ------------------ 1073| 1.44k| uint64_t group_id; 1074| 1.44k| CBS ciphertext, secret; 1075| 1.44k| if (!CBS_get_asn1_uint64(&key_share, &group_id) || // ------------------ | Branch (1075:9): [True: 521, False: 928] ------------------ 1076| 1.44k| group_id == 0 || group_id > 0xffff || ------------------ | Branch (1076:9): [True: 66, False: 862] | Branch (1076:26): [True: 314, False: 548] ------------------ 1077| 1.44k| !CBS_get_asn1(&key_share, &ciphertext, CBS_ASN1_OCTETSTRING) || ------------------ | | 218| 548|#define CBS_ASN1_OCTETSTRING 0x4u ------------------ | Branch (1077:9): [True: 287, False: 261] ------------------ 1078| 1.44k| !hints_obj->key_share_ciphertext.CopyFrom(ciphertext) || ------------------ | Branch (1078:9): [True: 0, False: 261] ------------------ 1079| 1.44k| !CBS_get_asn1(&key_share, &secret, CBS_ASN1_OCTETSTRING) || ------------------ | | 218| 261|#define CBS_ASN1_OCTETSTRING 0x4u ------------------ | Branch (1079:9): [True: 195, False: 66] ------------------ 1080| 1.44k| !hints_obj->key_share_secret.CopyFrom(secret)) { ------------------ | Branch (1080:9): [True: 0, False: 66] ------------------ 1081| 1.38k| OPENSSL_PUT_ERROR(SSL, SSL_R_COULD_NOT_PARSE_HINTS); ------------------ | | 361| 1.38k| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1082| 1.38k| return 0; 1083| 1.38k| } 1084| 66| hints_obj->key_share_group_id = static_cast(group_id); 1085| 66| } 1086| | 1087| 6.69k| if (has_signature_hint) { ------------------ | Branch (1087:7): [True: 1.54k, False: 5.14k] ------------------ 1088| 1.54k| uint64_t sig_alg; 1089| 1.54k| CBS input, spki, signature; 1090| 1.54k| if (!CBS_get_asn1_uint64(&signature_hint, &sig_alg) || // ------------------ | Branch (1090:9): [True: 613, False: 935] ------------------ 1091| 1.54k| sig_alg == 0 || sig_alg > 0xffff || ------------------ | Branch (1091:9): [True: 195, False: 740] | Branch (1091:25): [True: 172, False: 568] ------------------ 1092| 1.54k| !CBS_get_asn1(&signature_hint, &input, CBS_ASN1_OCTETSTRING) || ------------------ | | 218| 568|#define CBS_ASN1_OCTETSTRING 0x4u ------------------ | Branch (1092:9): [True: 83, False: 485] ------------------ 1093| 1.54k| !hints_obj->signature_input.CopyFrom(input) || ------------------ | Branch (1093:9): [True: 0, False: 485] ------------------ 1094| 1.54k| !CBS_get_asn1(&signature_hint, &spki, CBS_ASN1_OCTETSTRING) || ------------------ | | 218| 485|#define CBS_ASN1_OCTETSTRING 0x4u ------------------ | Branch (1094:9): [True: 71, False: 414] ------------------ 1095| 1.54k| !hints_obj->signature_spki.CopyFrom(spki) || ------------------ | Branch (1095:9): [True: 0, False: 414] ------------------ 1096| 1.54k| !CBS_get_asn1(&signature_hint, &signature, CBS_ASN1_OCTETSTRING) || ------------------ | | 218| 414|#define CBS_ASN1_OCTETSTRING 0x4u ------------------ | Branch (1096:9): [True: 324, False: 90] ------------------ 1097| 1.54k| !hints_obj->signature.CopyFrom(signature)) { ------------------ | Branch (1097:9): [True: 0, False: 90] ------------------ 1098| 1.45k| OPENSSL_PUT_ERROR(SSL, SSL_R_COULD_NOT_PARSE_HINTS); ------------------ | | 361| 1.45k| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1099| 1.45k| return 0; 1100| 1.45k| } 1101| 90| hints_obj->signature_algorithm = static_cast(sig_alg); 1102| 90| } 1103| | 1104| 5.23k| if (has_psk && !hints_obj->decrypted_psk.CopyFrom(psk)) { ------------------ | Branch (1104:7): [True: 679, False: 4.55k] | Branch (1104:18): [True: 0, False: 679] ------------------ 1105| 0| return 0; 1106| 0| } 1107| 5.23k| if (has_psk && hints_obj->ignore_psk) { ------------------ | Branch (1107:7): [True: 679, False: 4.55k] | Branch (1107:18): [True: 318, False: 361] ------------------ 1108| 318| OPENSSL_PUT_ERROR(SSL, SSL_R_COULD_NOT_PARSE_HINTS); ------------------ | | 361| 318| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1109| 318| return 0; 1110| 318| } 1111| | 1112| 4.91k| if (has_cert_compression) { ------------------ | Branch (1112:7): [True: 1.72k, False: 3.18k] ------------------ 1113| 1.72k| uint64_t alg; 1114| 1.72k| CBS input, output; 1115| 1.72k| if (!CBS_get_asn1_uint64(&cert_compression, &alg) || // ------------------ | Branch (1115:9): [True: 262, False: 1.46k] ------------------ 1116| 1.72k| alg == 0 || alg > 0xffff || ------------------ | Branch (1116:9): [True: 200, False: 1.26k] | Branch (1116:21): [True: 306, False: 959] ------------------ 1117| 1.72k| !CBS_get_asn1(&cert_compression, &input, CBS_ASN1_OCTETSTRING) || ------------------ | | 218| 959|#define CBS_ASN1_OCTETSTRING 0x4u ------------------ | Branch (1117:9): [True: 223, False: 736] ------------------ 1118| 1.72k| !hints_obj->cert_compression_input.CopyFrom(input) || ------------------ | Branch (1118:9): [True: 0, False: 736] ------------------ 1119| 1.72k| !CBS_get_asn1(&cert_compression, &output, CBS_ASN1_OCTETSTRING) || ------------------ | | 218| 736|#define CBS_ASN1_OCTETSTRING 0x4u ------------------ | Branch (1119:9): [True: 224, False: 512] ------------------ 1120| 1.72k| !hints_obj->cert_compression_output.CopyFrom(output)) { ------------------ | Branch (1120:9): [True: 0, False: 512] ------------------ 1121| 1.21k| OPENSSL_PUT_ERROR(SSL, SSL_R_COULD_NOT_PARSE_HINTS); ------------------ | | 361| 1.21k| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1122| 1.21k| return 0; 1123| 1.21k| } 1124| 512| hints_obj->cert_compression_alg_id = static_cast(alg); 1125| 512| } 1126| | 1127| 3.70k| if (has_server_random_tls12 && ------------------ | Branch (1127:7): [True: 436, False: 3.26k] ------------------ 1128| 3.70k| !hints_obj->server_random_tls12.CopyFrom(server_random_tls12)) { ------------------ | Branch (1128:7): [True: 0, False: 436] ------------------ 1129| 0| return 0; 1130| 0| } 1131| | 1132| 3.70k| if (has_ecdhe) { ------------------ | Branch (1132:7): [True: 1.26k, False: 2.43k] ------------------ 1133| 1.26k| uint64_t group_id; 1134| 1.26k| CBS public_key, private_key; 1135| 1.26k| if (!CBS_get_asn1_uint64(&ecdhe, &group_id) || // ------------------ | Branch (1135:9): [True: 316, False: 951] ------------------ 1136| 1.26k| group_id == 0 || group_id > 0xffff || ------------------ | Branch (1136:9): [True: 66, False: 885] | Branch (1136:26): [True: 200, False: 685] ------------------ 1137| 1.26k| !CBS_get_asn1(&ecdhe, &public_key, CBS_ASN1_OCTETSTRING) || ------------------ | | 218| 685|#define CBS_ASN1_OCTETSTRING 0x4u ------------------ | Branch (1137:9): [True: 225, False: 460] ------------------ 1138| 1.26k| !hints_obj->ecdhe_public_key.CopyFrom(public_key) || ------------------ | Branch (1138:9): [True: 0, False: 460] ------------------ 1139| 1.26k| !CBS_get_asn1(&ecdhe, &private_key, CBS_ASN1_OCTETSTRING) || ------------------ | | 218| 460|#define CBS_ASN1_OCTETSTRING 0x4u ------------------ | Branch (1139:9): [True: 203, False: 257] ------------------ 1140| 1.26k| !hints_obj->ecdhe_private_key.CopyFrom(private_key)) { ------------------ | Branch (1140:9): [True: 0, False: 257] ------------------ 1141| 1.01k| OPENSSL_PUT_ERROR(SSL, SSL_R_COULD_NOT_PARSE_HINTS); ------------------ | | 361| 1.01k| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1142| 1.01k| return 0; 1143| 1.01k| } 1144| 257| hints_obj->ecdhe_group_id = static_cast(group_id); 1145| 257| } 1146| | 1147| 2.69k| if (has_ticket && !hints_obj->decrypted_ticket.CopyFrom(ticket)) { ------------------ | Branch (1147:7): [True: 540, False: 2.15k] | Branch (1147:21): [True: 0, False: 540] ------------------ 1148| 0| return 0; 1149| 0| } 1150| 2.69k| if (has_ticket && hints_obj->ignore_ticket) { ------------------ | Branch (1150:7): [True: 540, False: 2.15k] | Branch (1150:21): [True: 269, False: 271] ------------------ 1151| 269| OPENSSL_PUT_ERROR(SSL, SSL_R_COULD_NOT_PARSE_HINTS); ------------------ | | 361| 269| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1152| 269| return 0; 1153| 269| } 1154| 2.42k| if (!has_ticket && hints_obj->renew_ticket) { ------------------ | Branch (1154:7): [True: 2.15k, False: 271] | Branch (1154:22): [True: 210, False: 1.94k] ------------------ 1155| 210| OPENSSL_PUT_ERROR(SSL, SSL_R_COULD_NOT_PARSE_HINTS); ------------------ | | 361| 210| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1156| 210| return 0; 1157| 210| } 1158| | 1159| 2.21k| ssl->s3->hs->hints = std::move(hints_obj); 1160| 2.21k| return 1; 1161| 2.42k|} handoff.cc:_ZL26get_optional_implicit_nullP6cbs_stPbj: 1016| 26.9k| CBS_ASN1_TAG tag) { 1017| 26.9k| CBS value; 1018| 26.9k| int present; 1019| 26.9k| if (!CBS_get_optional_asn1(cbs, &value, &present, tag) || ------------------ | Branch (1019:7): [True: 679, False: 26.2k] ------------------ 1020| 26.9k| (present && CBS_len(&value) != 0)) { ------------------ | Branch (1020:8): [True: 1.43k, False: 24.8k] | Branch (1020:19): [True: 303, False: 1.13k] ------------------ 1021| 982| return false; 1022| 982| } 1023| 25.9k| *out_present = present; 1024| 25.9k| return true; 1025| 26.9k|} _ZN4bssl13SSL_HANDSHAKEC2EP6ssl_st: 32| 71.0k| : ssl(ssl_arg), 33| 71.0k| transcript(SSL_is_dtls(ssl_arg)), 34| 71.0k| inner_transcript(SSL_is_dtls(ssl_arg)), 35| 71.0k| ech_is_inner(false), 36| 71.0k| ech_authenticated_reject(false), 37| 71.0k| scts_requested(false), 38| 71.0k| handshake_finalized(false), 39| 71.0k| accept_psk_mode(false), 40| 71.0k| cert_request(false), 41| 71.0k| certificate_status_expected(false), 42| 71.0k| ocsp_stapling_requested(false), 43| 71.0k| should_ack_sni(false), 44| 71.0k| in_false_start(false), 45| 71.0k| in_early_data(false), 46| 71.0k| early_data_offered(false), 47| 71.0k| can_early_read(false), 48| 71.0k| can_early_write(false), 49| 71.0k| is_early_version(false), 50| 71.0k| next_proto_neg_seen(false), 51| 71.0k| ticket_expected(false), 52| 71.0k| extended_master_secret(false), 53| 71.0k| pending_private_key_op(false), 54| 71.0k| handback(false), 55| 71.0k| hints_requested(false), 56| 71.0k| cert_compression_negotiated(false), 57| 71.0k| apply_jdk11_workaround(false), 58| 71.0k| can_release_private_key(false), 59| 71.0k| channel_id_negotiated(false), 60| 71.0k| received_hello_verify_request(false), 61| 71.0k| matched_peer_trust_anchor(false), 62| 71.0k| peer_matched_trust_anchor(false) { 63| 71.0k| assert(ssl); 64| | 65| | // Draw entropy for all GREASE values at once. This avoids calling 66| | // |RAND_bytes| repeatedly and makes the values consistent within a 67| | // connection. The latter is so the second ClientHello matches after 68| | // HelloRetryRequest and so supported_groups and key_shares are consistent. 69| 71.0k| RAND_bytes(grease_seed, sizeof(grease_seed)); 70| 71.0k|} _ZN4bssl13SSL_HANDSHAKED2Ev: 72| 71.0k|SSL_HANDSHAKE::~SSL_HANDSHAKE() { 73| 71.0k| ssl->ctx->x509_method->hs_flush_cached_ca_names(this); 74| 71.0k|} _ZN4bssl17ssl_handshake_newEP6ssl_st: 100| 71.0k|UniquePtr ssl_handshake_new(SSL *ssl) { 101| 71.0k| UniquePtr hs = MakeUnique(ssl); 102| 71.0k| if (!hs || !hs->transcript.Init()) { ------------------ | Branch (102:7): [True: 0, False: 71.0k] | Branch (102:14): [True: 0, False: 71.0k] ------------------ 103| 0| return nullptr; 104| 0| } 105| 71.0k| hs->config = ssl->config.get(); 106| 71.0k| if (!hs->config) { ------------------ | Branch (106:7): [True: 0, False: 71.0k] ------------------ 107| 0| assert(hs->config); 108| 0| return nullptr; 109| 0| } 110| 71.0k| return hs; 111| 71.0k|} _ZN4bssl22ssl_check_message_typeEP6ssl_stRKNS_10SSLMessageEi: 113| 238k|bool ssl_check_message_type(SSL *ssl, const SSLMessage &msg, int type) { 114| 238k| if (msg.type != type) { ------------------ | Branch (114:7): [True: 40, False: 238k] ------------------ 115| 40| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE); ------------------ | | 176| 40|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE); ------------------ | | 4367| 40|#define SSL_AD_UNEXPECTED_MESSAGE SSL3_AD_UNEXPECTED_MESSAGE | | ------------------ | | | | 179| 40|#define SSL3_AD_UNEXPECTED_MESSAGE 10 // fatal | | ------------------ ------------------ 116| 40| OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_MESSAGE); ------------------ | | 361| 40| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 117| 40| ERR_add_error_dataf("got type %d, wanted type %d", msg.type, type); 118| 40| return false; 119| 40| } 120| | 121| 238k| return true; 122| 238k|} _ZN4bssl19ssl_add_message_cbbEP6ssl_stP6cbb_st: 124| 160k|bool ssl_add_message_cbb(SSL *ssl, CBB *cbb) { 125| 160k| Array msg; 126| 160k| if (!ssl->method->finish_message(ssl, cbb, &msg) || ------------------ | Branch (126:7): [True: 0, False: 160k] | Branch (126:7): [True: 0, False: 160k] ------------------ 127| 160k| !ssl->method->add_message(ssl, std::move(msg))) { ------------------ | Branch (127:7): [True: 0, False: 160k] ------------------ 128| 0| return false; 129| 0| } 130| | 131| 160k| return true; 132| 160k|} _ZN4bssl29ssl_max_handshake_message_lenEPK6ssl_st: 134| 1.43M|size_t ssl_max_handshake_message_len(const SSL *ssl) { 135| | // kMaxMessageLen is the default maximum message size for handshakes which do 136| | // not accept peer certificate chains. 137| 1.43M| static const size_t kMaxMessageLen = 16384; 138| | 139| 1.43M| if (SSL_in_init(ssl)) { ------------------ | Branch (139:7): [True: 1.26M, False: 172k] ------------------ 140| 1.26M| SSL_CONFIG *config = ssl->config.get(); // SSL_in_init() implies not NULL. 141| 1.26M| if ((!ssl->server || (config->verify_mode & SSL_VERIFY_PEER)) && ------------------ | | 2635| 0|#define SSL_VERIFY_PEER 0x01 ------------------ | Branch (141:10): [True: 1.26M, False: 0] | Branch (141:26): [True: 0, False: 0] ------------------ 142| 1.26M| kMaxMessageLen < ssl->max_cert_list) { ------------------ | Branch (142:9): [True: 1.26M, False: 0] ------------------ 143| 1.26M| return ssl->max_cert_list; 144| 1.26M| } 145| 0| return kMaxMessageLen; 146| 1.26M| } 147| | 148| 172k| if (ssl_protocol_version(ssl) < TLS1_3_VERSION) { ------------------ | | 545| 172k|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (148:7): [True: 167k, False: 4.72k] ------------------ 149| | // In TLS 1.2 and below, the largest acceptable post-handshake message is 150| | // a HelloRequest. 151| 167k| return 0; 152| 167k| } 153| | 154| 4.72k| if (ssl->server) { ------------------ | Branch (154:7): [True: 0, False: 4.72k] ------------------ 155| | // The largest acceptable post-handshake message for a server is a 156| | // KeyUpdate. We will never initiate post-handshake auth. 157| 0| return 1; 158| 0| } 159| | 160| | // Clients must accept NewSessionTicket, so allow the default size or 161| | // max_cert_list, whichever is greater. 162| 4.72k| return std::max(kMaxMessageLen, size_t{ssl->max_cert_list}); 163| 4.72k|} _ZN4bssl16ssl_hash_messageEPNS_13SSL_HANDSHAKEERKNS_10SSLMessageE: 165| 345k|bool ssl_hash_message(SSL_HANDSHAKE *hs, const SSLMessage &msg) { 166| | // V2ClientHello messages are pre-hashed. 167| 345k| if (msg.is_v2_hello) { ------------------ | Branch (167:7): [True: 0, False: 345k] ------------------ 168| 0| return true; 169| 0| } 170| | 171| 345k| return hs->transcript.Update(msg.raw); 172| 345k|} _ZN4bssl20ssl_parse_extensionsEPK6cbs_stPhSt16initializer_listIPNS_12SSLExtensionEEb: 176| 56.5k| bool ignore_unknown) { 177| | // Reset everything. 178| 59.4k| for (SSLExtension *ext : extensions) { ------------------ | Branch (178:26): [True: 59.4k, False: 56.5k] ------------------ 179| 59.4k| ext->present = false; 180| 59.4k| CBS_init(&ext->data, nullptr, 0); 181| 59.4k| if (!ext->allowed) { ------------------ | Branch (181:9): [True: 831, False: 58.6k] ------------------ 182| 831| assert(!ignore_unknown); 183| 831| } 184| 59.4k| } 185| | 186| 56.5k| CBS copy = *cbs; 187| 211k| while (CBS_len(©) != 0) { ------------------ | Branch (187:10): [True: 155k, False: 56.4k] ------------------ 188| 155k| uint16_t type; 189| 155k| CBS data; 190| 155k| if (!CBS_get_u16(©, &type) || ------------------ | Branch (190:9): [True: 5, False: 155k] ------------------ 191| 155k| !CBS_get_u16_length_prefixed(©, &data)) { ------------------ | Branch (191:9): [True: 19, False: 155k] ------------------ 192| 24| OPENSSL_PUT_ERROR(SSL, SSL_R_PARSE_TLSEXT); ------------------ | | 361| 24| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 193| 24| *out_alert = SSL_AD_DECODE_ERROR; ------------------ | | 4382| 24|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 24|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 194| 24| return false; 195| 24| } 196| | 197| 155k| SSLExtension *found = nullptr; 198| 156k| for (SSLExtension *ext : extensions) { ------------------ | Branch (198:28): [True: 156k, False: 154k] ------------------ 199| 156k| if (type == ext->type && ext->allowed) { ------------------ | Branch (199:11): [True: 1.23k, False: 155k] | Branch (199:32): [True: 1.23k, False: 1] ------------------ 200| 1.23k| found = ext; 201| 1.23k| break; 202| 1.23k| } 203| 156k| } 204| | 205| 155k| if (found == nullptr) { ------------------ | Branch (205:9): [True: 154k, False: 1.23k] ------------------ 206| 154k| if (ignore_unknown) { ------------------ | Branch (206:11): [True: 154k, False: 26] ------------------ 207| 154k| continue; 208| 154k| } 209| 26| OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_EXTENSION); ------------------ | | 361| 26| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 210| 26| ERR_add_error_dataf("extension %u", unsigned{type}); 211| 26| *out_alert = SSL_AD_UNSUPPORTED_EXTENSION; ------------------ | | 4392| 26|#define SSL_AD_UNSUPPORTED_EXTENSION TLS1_AD_UNSUPPORTED_EXTENSION | | ------------------ | | | | 41| 26|#define TLS1_AD_UNSUPPORTED_EXTENSION 110 | | ------------------ ------------------ 212| 26| return false; 213| 154k| } 214| | 215| | // Duplicate ext_types are forbidden. 216| 1.23k| if (found->present) { ------------------ | Branch (216:9): [True: 1, False: 1.23k] ------------------ 217| 1| OPENSSL_PUT_ERROR(SSL, SSL_R_DUPLICATE_EXTENSION); ------------------ | | 361| 1| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 218| 1| *out_alert = SSL_AD_ILLEGAL_PARAMETER; ------------------ | | 4379| 1|#define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER | | ------------------ | | | | 189| 1|#define SSL3_AD_ILLEGAL_PARAMETER 47 // fatal | | ------------------ ------------------ 219| 1| return false; 220| 1| } 221| | 222| 1.23k| found->present = true; 223| 1.23k| found->data = data; 224| 1.23k| } 225| | 226| 56.4k| return true; 227| 56.5k|} _ZN4bssl20ssl_verify_peer_certEPNS_13SSL_HANDSHAKEE: 229| 53.5k|enum ssl_verify_result_t ssl_verify_peer_cert(SSL_HANDSHAKE *hs) { 230| 53.5k| SSL *const ssl = hs->ssl; 231| 53.5k| const SSL_SESSION *prev_session = ssl->s3->established_session.get(); 232| 53.5k| if (prev_session != NULL) { ------------------ | Branch (232:7): [True: 50.5k, False: 2.99k] ------------------ 233| | // If renegotiating, the server must not change the server certificate. See 234| | // https://mitls.org/pages/attacks/3SHAKE. We never resume on renegotiation, 235| | // so this check is sufficient to ensure the reported peer certificate never 236| | // changes on renegotiation. 237| 50.5k| assert(!ssl->server); 238| 50.5k| if (sk_CRYPTO_BUFFER_num(prev_session->certs.get()) != ------------------ | Branch (238:9): [True: 1, False: 50.5k] ------------------ 239| 50.5k| sk_CRYPTO_BUFFER_num(hs->new_session->certs.get())) { 240| 1| OPENSSL_PUT_ERROR(SSL, SSL_R_SERVER_CERT_CHANGED); ------------------ | | 361| 1| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 241| 1| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 176| 1|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 4379| 1|#define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER | | ------------------ | | | | 189| 1|#define SSL3_AD_ILLEGAL_PARAMETER 47 // fatal | | ------------------ ------------------ 242| 1| return ssl_verify_invalid; 243| 1| } 244| | 245| 101k| for (size_t i = 0; i < sk_CRYPTO_BUFFER_num(hs->new_session->certs.get()); ------------------ | Branch (245:24): [True: 50.5k, False: 50.4k] ------------------ 246| 50.5k| i++) { 247| 50.5k| const CRYPTO_BUFFER *old_cert = 248| 50.5k| sk_CRYPTO_BUFFER_value(prev_session->certs.get(), i); 249| 50.5k| const CRYPTO_BUFFER *new_cert = 250| 50.5k| sk_CRYPTO_BUFFER_value(hs->new_session->certs.get(), i); 251| 50.5k| if (Span(CRYPTO_BUFFER_data(old_cert), CRYPTO_BUFFER_len(old_cert)) != ------------------ | Branch (251:11): [True: 99, False: 50.4k] ------------------ 252| 50.5k| Span(CRYPTO_BUFFER_data(new_cert), CRYPTO_BUFFER_len(new_cert))) { 253| 99| OPENSSL_PUT_ERROR(SSL, SSL_R_SERVER_CERT_CHANGED); ------------------ | | 361| 99| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 254| 99| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 176| 99|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 4379| 99|#define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER | | ------------------ | | | | 189| 99|#define SSL3_AD_ILLEGAL_PARAMETER 47 // fatal | | ------------------ ------------------ 255| 99| return ssl_verify_invalid; 256| 99| } 257| 50.5k| } 258| | 259| | // The certificate is identical, so we may skip re-verifying the 260| | // certificate. Since we only authenticated the previous one, copy other 261| | // authentication from the established session and ignore what was newly 262| | // received. 263| 50.4k| hs->new_session->ocsp_response = UpRef(prev_session->ocsp_response); 264| 50.4k| hs->new_session->signed_cert_timestamp_list = 265| 50.4k| UpRef(prev_session->signed_cert_timestamp_list); 266| 50.4k| hs->new_session->verify_result = prev_session->verify_result; 267| 50.4k| return ssl_verify_ok; 268| 50.5k| } 269| | 270| 2.99k| uint8_t alert = SSL_AD_CERTIFICATE_UNKNOWN; ------------------ | | 4378| 2.99k|#define SSL_AD_CERTIFICATE_UNKNOWN SSL3_AD_CERTIFICATE_UNKNOWN | | ------------------ | | | | 188| 2.99k|#define SSL3_AD_CERTIFICATE_UNKNOWN 46 | | ------------------ ------------------ 271| 2.99k| enum ssl_verify_result_t ret; 272| 2.99k| if (hs->config->custom_verify_callback != nullptr) { ------------------ | Branch (272:7): [True: 0, False: 2.99k] ------------------ 273| 0| ret = hs->config->custom_verify_callback(ssl, &alert); 274| 0| switch (ret) { ------------------ | Branch (274:13): [True: 0, False: 0] ------------------ 275| 0| case ssl_verify_ok: ------------------ | Branch (275:7): [True: 0, False: 0] ------------------ 276| 0| hs->new_session->verify_result = X509_V_OK; ------------------ | | 3013| 0|#define X509_V_OK 0 ------------------ 277| 0| break; 278| 0| case ssl_verify_invalid: ------------------ | Branch (278:7): [True: 0, False: 0] ------------------ 279| | // If |SSL_VERIFY_NONE|, the error is non-fatal, but we keep the result. 280| 0| if (hs->config->verify_mode == SSL_VERIFY_NONE) { ------------------ | | 2629| 0|#define SSL_VERIFY_NONE 0x00 ------------------ | Branch (280:13): [True: 0, False: 0] ------------------ 281| 0| ERR_clear_error(); 282| 0| ret = ssl_verify_ok; 283| 0| } 284| 0| hs->new_session->verify_result = X509_V_ERR_APPLICATION_VERIFICATION; ------------------ | | 3063| 0|#define X509_V_ERR_APPLICATION_VERIFICATION 50 ------------------ 285| 0| break; 286| 0| case ssl_verify_retry: ------------------ | Branch (286:7): [True: 0, False: 0] ------------------ 287| 0| break; 288| 0| } 289| 2.99k| } else { 290| 2.99k| ret = ssl->ctx->x509_method->session_verify_cert_chain( ------------------ | Branch (290:11): [True: 2.99k, False: 0] ------------------ 291| 2.99k| hs->new_session.get(), hs, &alert) 292| 2.99k| ? ssl_verify_ok 293| 2.99k| : ssl_verify_invalid; 294| 2.99k| } 295| | 296| 2.99k| if (ret == ssl_verify_invalid) { ------------------ | Branch (296:7): [True: 0, False: 2.99k] ------------------ 297| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_CERTIFICATE_VERIFY_FAILED); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 298| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, alert); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ 299| 0| } 300| | 301| | // Emulate OpenSSL's client OCSP callback. OpenSSL verifies certificates 302| | // before it receives the OCSP, so it needs a second callback for OCSP. 303| 2.99k| if (ret == ssl_verify_ok && !ssl->server && ------------------ | Branch (303:7): [True: 2.99k, False: 0] | Branch (303:31): [True: 2.99k, False: 0] ------------------ 304| 2.99k| hs->config->ocsp_stapling_enabled && ------------------ | Branch (304:7): [True: 2.99k, False: 0] ------------------ 305| 2.99k| ssl->ctx->legacy_ocsp_callback != nullptr) { ------------------ | Branch (305:7): [True: 0, False: 2.99k] ------------------ 306| 0| int cb_ret = 307| 0| ssl->ctx->legacy_ocsp_callback(ssl, ssl->ctx->legacy_ocsp_callback_arg); 308| 0| if (cb_ret <= 0) { ------------------ | Branch (308:9): [True: 0, False: 0] ------------------ 309| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_OCSP_CB_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 310| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ 311| 0| cb_ret == 0 ? SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE ------------------ | | 4396| 0| TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE | | ------------------ | | | | 44| 0|#define TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE 113 | | ------------------ ------------------ | Branch (311:22): [True: 0, False: 0] ------------------ 312| 0| : SSL_AD_INTERNAL_ERROR); ------------------ | | 4387| 0|#define SSL_AD_INTERNAL_ERROR TLS1_AD_INTERNAL_ERROR | | ------------------ | | | | 37| 0|#define TLS1_AD_INTERNAL_ERROR 80 | | ------------------ ------------------ 313| 0| ret = ssl_verify_invalid; 314| 0| } 315| 0| } 316| | 317| 2.99k| return ret; 318| 2.99k|} _ZN4bssl16ssl_get_finishedEPNS_13SSL_HANDSHAKEE: 371| 103k|enum ssl_hs_wait_t ssl_get_finished(SSL_HANDSHAKE *hs) { 372| 103k| SSL *const ssl = hs->ssl; 373| 103k| SSLMessage msg; 374| 103k| if (!ssl->method->get_message(ssl, &msg)) { ------------------ | Branch (374:7): [True: 51.8k, False: 51.4k] ------------------ 375| 51.8k| return ssl_hs_read_message; 376| 51.8k| } 377| | 378| 51.4k| if (!ssl_check_message_type(ssl, msg, SSL3_MT_FINISHED)) { ------------------ | | 206| 51.4k|#define SSL3_MT_FINISHED 20 ------------------ | Branch (378:7): [True: 9, False: 51.3k] ------------------ 379| 9| return ssl_hs_error; 380| 9| } 381| | 382| | // Snapshot the finished hash before incorporating the new message. 383| 51.3k| uint8_t finished[EVP_MAX_MD_SIZE]; 384| 51.3k| size_t finished_len; 385| 51.3k| if (!hs->transcript.GetFinishedMAC(finished, &finished_len, ------------------ | Branch (385:7): [True: 0, False: 51.3k] ------------------ 386| 51.3k| ssl_handshake_session(hs), !ssl->server) || 387| 51.3k| !ssl_hash_message(hs, msg)) { ------------------ | Branch (387:7): [True: 0, False: 51.3k] ------------------ 388| 0| return ssl_hs_error; 389| 0| } 390| | 391| 51.3k| bool finished_ok = CBS_mem_equal(&msg.body, finished, finished_len); 392| 51.3k| if (CRYPTO_fuzzer_mode_enabled()) { ------------------ | Branch (392:7): [True: 51.3k, False: 0] ------------------ 393| 51.3k| finished_ok = true; 394| 51.3k| } 395| 51.3k| if (!finished_ok) { ------------------ | Branch (395:7): [True: 0, False: 51.3k] ------------------ 396| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECRYPT_ERROR); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECRYPT_ERROR); ------------------ | | 4383| 0|#define SSL_AD_DECRYPT_ERROR TLS1_AD_DECRYPT_ERROR | | ------------------ | | | | 33| 0|#define TLS1_AD_DECRYPT_ERROR 51 | | ------------------ ------------------ 397| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_DIGEST_CHECK_FAILED); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 398| 0| return ssl_hs_error; 399| 0| } 400| | 401| | // Copy the Finished so we can use it for renegotiation checks. 402| 51.3k| if (finished_len > ssl->s3->previous_client_finished.capacity() || ------------------ | Branch (402:7): [True: 0, False: 51.3k] ------------------ 403| 51.3k| finished_len > ssl->s3->previous_server_finished.capacity()) { ------------------ | Branch (403:7): [True: 0, False: 51.3k] ------------------ 404| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 405| 0| return ssl_hs_error; 406| 0| } 407| | 408| 51.3k| if (ssl->server) { ------------------ | Branch (408:7): [True: 0, False: 51.3k] ------------------ 409| 0| ssl->s3->previous_client_finished.CopyFrom(Span(finished, finished_len)); 410| 51.3k| } else { 411| 51.3k| ssl->s3->previous_server_finished.CopyFrom(Span(finished, finished_len)); 412| 51.3k| } 413| | 414| | // The Finished message should be the end of a flight. 415| 51.3k| if (ssl->method->has_unprocessed_handshake_data(ssl)) { ------------------ | Branch (415:7): [True: 10, False: 51.3k] ------------------ 416| 10| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE); ------------------ | | 176| 10|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE); ------------------ | | 4367| 10|#define SSL_AD_UNEXPECTED_MESSAGE SSL3_AD_UNEXPECTED_MESSAGE | | ------------------ | | | | 179| 10|#define SSL3_AD_UNEXPECTED_MESSAGE 10 // fatal | | ------------------ ------------------ 417| 10| OPENSSL_PUT_ERROR(SSL, SSL_R_EXCESS_HANDSHAKE_DATA); ------------------ | | 361| 10| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 418| 10| return ssl_hs_error; 419| 10| } 420| | 421| 51.3k| ssl->method->next_message(ssl); 422| 51.3k| return ssl_hs_ok; 423| 51.3k|} _ZN4bssl17ssl_send_finishedEPNS_13SSL_HANDSHAKEE: 425| 52.2k|bool ssl_send_finished(SSL_HANDSHAKE *hs) { 426| 52.2k| SSL *const ssl = hs->ssl; 427| 52.2k| const SSL_SESSION *session = ssl_handshake_session(hs); 428| | 429| 52.2k| uint8_t finished_buf[EVP_MAX_MD_SIZE]; 430| 52.2k| size_t finished_len; 431| 52.2k| if (!hs->transcript.GetFinishedMAC(finished_buf, &finished_len, session, ------------------ | Branch (431:7): [True: 0, False: 52.2k] ------------------ 432| 52.2k| ssl->server)) { 433| 0| return false; 434| 0| } 435| 52.2k| auto finished = Span(finished_buf, finished_len); 436| | 437| | // Log the master secret, if logging is enabled. 438| 52.2k| if (!ssl_log_secret(ssl, "CLIENT_RANDOM", session->secret)) { ------------------ | Branch (438:7): [True: 0, False: 52.2k] ------------------ 439| 0| return false; 440| 0| } 441| | 442| | // Copy the Finished so we can use it for renegotiation checks. 443| 52.2k| bool ok = ssl->server ------------------ | Branch (443:13): [True: 0, False: 52.2k] ------------------ 444| 52.2k| ? ssl->s3->previous_server_finished.TryCopyFrom(finished) 445| 52.2k| : ssl->s3->previous_client_finished.TryCopyFrom(finished); 446| 52.2k| if (!ok) { ------------------ | Branch (446:7): [True: 0, False: 52.2k] ------------------ 447| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 448| 0| return ssl_hs_error; 449| 0| } 450| | 451| 52.2k| ScopedCBB cbb; 452| 52.2k| CBB body; 453| 52.2k| if (!ssl->method->init_message(ssl, cbb.get(), &body, SSL3_MT_FINISHED) || ------------------ | | 206| 52.2k|#define SSL3_MT_FINISHED 20 ------------------ | Branch (453:7): [True: 0, False: 52.2k] ------------------ 454| 52.2k| !CBB_add_bytes(&body, finished.data(), finished.size()) || ------------------ | Branch (454:7): [True: 0, False: 52.2k] ------------------ 455| 52.2k| !ssl_add_message_cbb(ssl, cbb.get())) { ------------------ | Branch (455:7): [True: 0, False: 52.2k] ------------------ 456| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 457| 0| return false; 458| 0| } 459| | 460| 52.2k| return true; 461| 52.2k|} _ZN4bssl26ssl_send_tls12_certificateEPNS_13SSL_HANDSHAKEE: 463| 28.0k|bool ssl_send_tls12_certificate(SSL_HANDSHAKE *hs) { 464| 28.0k| ScopedCBB cbb; 465| 28.0k| CBB body, certs, cert; 466| 28.0k| if (!hs->ssl->method->init_message(hs->ssl, cbb.get(), &body, ------------------ | Branch (466:7): [True: 0, False: 28.0k] ------------------ 467| 28.0k| SSL3_MT_CERTIFICATE) || ------------------ | | 200| 28.0k|#define SSL3_MT_CERTIFICATE 11 ------------------ 468| 28.0k| !CBB_add_u24_length_prefixed(&body, &certs)) { ------------------ | Branch (468:7): [True: 0, False: 28.0k] ------------------ 469| 0| return false; 470| 0| } 471| | 472| 28.0k| if (hs->credential != nullptr) { ------------------ | Branch (472:7): [True: 28.0k, False: 0] ------------------ 473| 28.0k| assert(hs->credential->type == SSLCredentialType::kX509); 474| 28.0k| STACK_OF(CRYPTO_BUFFER) *chain = hs->credential->chain.get(); ------------------ | | 39| 28.0k|#define STACK_OF(type) struct stack_st_##type ------------------ 475| 56.1k| for (size_t i = 0; i < sk_CRYPTO_BUFFER_num(chain); i++) { ------------------ | Branch (475:24): [True: 28.0k, False: 28.0k] ------------------ 476| 28.0k| CRYPTO_BUFFER *buffer = sk_CRYPTO_BUFFER_value(chain, i); 477| 28.0k| if (!CBB_add_u24_length_prefixed(&certs, &cert) || ------------------ | Branch (477:11): [True: 0, False: 28.0k] ------------------ 478| 28.0k| !CBB_add_bytes(&cert, CRYPTO_BUFFER_data(buffer), ------------------ | Branch (478:11): [True: 0, False: 28.0k] ------------------ 479| 28.0k| CRYPTO_BUFFER_len(buffer))) { 480| 0| return false; 481| 0| } 482| 28.0k| } 483| 28.0k| } 484| | 485| 28.0k| return ssl_add_message_cbb(hs->ssl, cbb.get()); 486| 28.0k|} _ZN4bssl21ssl_handshake_sessionEPKNS_13SSL_HANDSHAKEE: 488| 207k|const SSL_SESSION *ssl_handshake_session(const SSL_HANDSHAKE *hs) { 489| 207k| if (hs->new_session) { ------------------ | Branch (489:7): [True: 206k, False: 729] ------------------ 490| 206k| return hs->new_session.get(); 491| 206k| } 492| 729| return hs->ssl->session.get(); 493| 207k|} _ZN4bssl17ssl_run_handshakeEPNS_13SSL_HANDSHAKEEPb: 495| 56.3k|int ssl_run_handshake(SSL_HANDSHAKE *hs, bool *out_early_return) { 496| 56.3k| SSL *const ssl = hs->ssl; 497| 1.42M| for (;;) { 498| | // If a timeout during the handshake triggered a DTLS ACK or retransmit, we 499| | // resolve that first. E.g., if |ssl_hs_private_key_operation| is slow, the 500| | // ACK timer may fire. 501| 1.42M| if (hs->wait != ssl_hs_error && SSL_is_dtls(ssl)) { ------------------ | Branch (501:9): [True: 1.42M, False: 0] | Branch (501:37): [True: 0, False: 1.42M] ------------------ 502| 0| int ret = ssl->method->flush(ssl); 503| 0| if (ret <= 0) { ------------------ | Branch (503:11): [True: 0, False: 0] ------------------ 504| 0| return ret; 505| 0| } 506| 0| } 507| | 508| | // Resolve the operation the handshake was waiting on. Each condition may 509| | // halt the handshake by returning, or continue executing if the handshake 510| | // may immediately proceed. Cases which halt the handshake can clear 511| | // |hs->wait| to re-enter the state machine on the next iteration, or leave 512| | // it set to keep the condition sticky. 513| 1.42M| switch (hs->wait) { ------------------ | Branch (513:13): [True: 0, False: 1.42M] ------------------ 514| 0| case ssl_hs_error: ------------------ | Branch (514:7): [True: 0, False: 1.42M] ------------------ 515| 0| ERR_restore_state(hs->error.get()); 516| 0| return -1; 517| | 518| 108k| case ssl_hs_flush: { ------------------ | Branch (518:7): [True: 108k, False: 1.31M] ------------------ 519| 108k| int ret = ssl->method->flush(ssl); 520| 108k| if (ret <= 0) { ------------------ | Branch (520:13): [True: 0, False: 108k] ------------------ 521| 0| return ret; 522| 0| } 523| 108k| break; 524| 108k| } 525| | 526| 185k| case ssl_hs_read_server_hello: ------------------ | Branch (526:7): [True: 185k, False: 1.24M] ------------------ 527| 1.10M| case ssl_hs_read_message: ------------------ | Branch (527:7): [True: 922k, False: 505k] ------------------ 528| 1.26M| case ssl_hs_read_change_cipher_spec: { ------------------ | Branch (528:7): [True: 154k, False: 1.27M] ------------------ 529| 1.26M| if (SSL_is_quic(ssl)) { ------------------ | Branch (529:13): [True: 0, False: 1.26M] ------------------ 530| | // QUIC has no ChangeCipherSpec messages. 531| 0| assert(hs->wait != ssl_hs_read_change_cipher_spec); 532| | // The caller should call |SSL_provide_quic_data|. Clear |hs->wait| so 533| | // the handshake can check if there is sufficient data next iteration. 534| 0| ssl->s3->rwstate = SSL_ERROR_WANT_READ; ------------------ | | 381| 0|#define SSL_ERROR_WANT_READ 2 ------------------ 535| 0| hs->wait = ssl_hs_ok; 536| 0| return -1; 537| 0| } 538| | 539| 1.26M| uint8_t alert = SSL_AD_DECODE_ERROR; ------------------ | | 4382| 1.26M|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 1.26M|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 540| 1.26M| size_t consumed = 0; 541| 1.26M| ssl_open_record_t ret; 542| 1.26M| if (hs->wait == ssl_hs_read_change_cipher_spec) { ------------------ | Branch (542:13): [True: 154k, False: 1.10M] ------------------ 543| 154k| ret = ssl_open_change_cipher_spec(ssl, &consumed, &alert, 544| 154k| ssl->s3->read_buffer.span()); 545| 1.10M| } else { 546| 1.10M| ret = ssl_open_handshake(ssl, &consumed, &alert, 547| 1.10M| ssl->s3->read_buffer.span()); 548| 1.10M| } 549| 1.26M| if (ret == ssl_open_record_error && ------------------ | Branch (549:13): [True: 757, False: 1.26M] ------------------ 550| 1.26M| hs->wait == ssl_hs_read_server_hello) { ------------------ | Branch (550:13): [True: 244, False: 513] ------------------ 551| 244| uint32_t err = ERR_peek_error(); 552| 244| if (ERR_GET_LIB(err) == ERR_LIB_SSL && ------------------ | Branch (552:15): [True: 244, False: 0] ------------------ 553| 244| ERR_GET_REASON(err) == SSL_R_SSLV3_ALERT_HANDSHAKE_FAILURE) { ------------------ | | 6477| 244|#define SSL_R_SSLV3_ALERT_HANDSHAKE_FAILURE 1040 ------------------ | Branch (553:15): [True: 2, False: 242] ------------------ 554| | // Add a dedicated error code to the queue for a handshake_failure 555| | // alert in response to ClientHello. This matches NSS's client 556| | // behavior and gives a better error on a (probable) failure to 557| | // negotiate initial parameters. Note: this error code comes after 558| | // the original one. 559| | // 560| | // See https://crbug.com/446505. 561| 2| OPENSSL_PUT_ERROR(SSL, SSL_R_HANDSHAKE_FAILURE_ON_CLIENT_HELLO); ------------------ | | 361| 2| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 562| 2| } 563| 244| } 564| 1.26M| bool retry; 565| 1.26M| int bio_ret = ssl_handle_open_record(ssl, &retry, ret, consumed, alert); 566| 1.26M| if (bio_ret <= 0) { ------------------ | Branch (566:13): [True: 2.85k, False: 1.25M] ------------------ 567| 2.85k| return bio_ret; 568| 2.85k| } 569| 1.25M| if (retry) { ------------------ | Branch (569:13): [True: 839k, False: 419k] ------------------ 570| 839k| continue; 571| 839k| } 572| 419k| ssl->s3->read_buffer.DiscardConsumed(); 573| 419k| break; 574| 1.25M| } 575| | 576| 0| case ssl_hs_read_end_of_early_data: { ------------------ | Branch (576:7): [True: 0, False: 1.42M] ------------------ 577| 0| if (ssl->s3->hs->can_early_read) { ------------------ | Branch (577:13): [True: 0, False: 0] ------------------ 578| | // While we are processing early data, the handshake returns early. 579| 0| *out_early_return = true; 580| 0| return 1; 581| 0| } 582| 0| hs->wait = ssl_hs_ok; 583| 0| break; 584| 0| } 585| | 586| 0| case ssl_hs_certificate_selection_pending: ------------------ | Branch (586:7): [True: 0, False: 1.42M] ------------------ 587| 0| ssl->s3->rwstate = SSL_ERROR_PENDING_CERTIFICATE; ------------------ | | 437| 0|#define SSL_ERROR_PENDING_CERTIFICATE 12 ------------------ 588| 0| hs->wait = ssl_hs_ok; 589| 0| return -1; 590| | 591| 0| case ssl_hs_handoff: ------------------ | Branch (591:7): [True: 0, False: 1.42M] ------------------ 592| 0| ssl->s3->rwstate = SSL_ERROR_HANDOFF; ------------------ | | 466| 0|#define SSL_ERROR_HANDOFF 17 ------------------ 593| 0| hs->wait = ssl_hs_ok; 594| 0| return -1; 595| | 596| 0| case ssl_hs_handback: { ------------------ | Branch (596:7): [True: 0, False: 1.42M] ------------------ 597| 0| int ret = ssl->method->flush(ssl); 598| 0| if (ret <= 0) { ------------------ | Branch (598:13): [True: 0, False: 0] ------------------ 599| 0| return ret; 600| 0| } 601| 0| ssl->s3->rwstate = SSL_ERROR_HANDBACK; ------------------ | | 467| 0|#define SSL_ERROR_HANDBACK 18 ------------------ 602| 0| hs->wait = ssl_hs_handback; 603| 0| return -1; 604| 0| } 605| | 606| | // The following cases are associated with callback APIs which expect to 607| | // be called each time the state machine runs. Thus they set |hs->wait| 608| | // to |ssl_hs_ok| so that, next time, we re-enter the state machine and 609| | // call the callback again. 610| 0| case ssl_hs_x509_lookup: ------------------ | Branch (610:7): [True: 0, False: 1.42M] ------------------ 611| 0| ssl->s3->rwstate = SSL_ERROR_WANT_X509_LOOKUP; ------------------ | | 394| 0|#define SSL_ERROR_WANT_X509_LOOKUP 4 ------------------ 612| 0| hs->wait = ssl_hs_ok; 613| 0| return -1; 614| 0| case ssl_hs_private_key_operation: ------------------ | Branch (614:7): [True: 0, False: 1.42M] ------------------ 615| 0| ssl->s3->rwstate = SSL_ERROR_WANT_PRIVATE_KEY_OPERATION; ------------------ | | 445| 0|#define SSL_ERROR_WANT_PRIVATE_KEY_OPERATION 13 ------------------ 616| 0| hs->wait = ssl_hs_ok; 617| 0| return -1; 618| 0| case ssl_hs_pending_session: ------------------ | Branch (618:7): [True: 0, False: 1.42M] ------------------ 619| 0| ssl->s3->rwstate = SSL_ERROR_PENDING_SESSION; ------------------ | | 430| 0|#define SSL_ERROR_PENDING_SESSION 11 ------------------ 620| 0| hs->wait = ssl_hs_ok; 621| 0| return -1; 622| 0| case ssl_hs_pending_ticket: ------------------ | Branch (622:7): [True: 0, False: 1.42M] ------------------ 623| 0| ssl->s3->rwstate = SSL_ERROR_PENDING_TICKET; ------------------ | | 451| 0|#define SSL_ERROR_PENDING_TICKET 14 ------------------ 624| 0| hs->wait = ssl_hs_ok; 625| 0| return -1; 626| 0| case ssl_hs_certificate_verify: ------------------ | Branch (626:7): [True: 0, False: 1.42M] ------------------ 627| 0| ssl->s3->rwstate = SSL_ERROR_WANT_CERTIFICATE_VERIFY; ------------------ | | 464| 0|#define SSL_ERROR_WANT_CERTIFICATE_VERIFY 16 ------------------ 628| 0| hs->wait = ssl_hs_ok; 629| 0| return -1; 630| | 631| 0| case ssl_hs_early_data_rejected: ------------------ | Branch (631:7): [True: 0, False: 1.42M] ------------------ 632| 0| assert(ssl->s3->early_data_reason != ssl_early_data_unknown); 633| 0| assert(!hs->can_early_write); 634| 0| ssl->s3->rwstate = SSL_ERROR_EARLY_DATA_REJECTED; ------------------ | | 457| 0|#define SSL_ERROR_EARLY_DATA_REJECTED 15 ------------------ 635| 0| return -1; 636| | 637| 5| case ssl_hs_early_return: ------------------ | Branch (637:7): [True: 5, False: 1.42M] ------------------ 638| 5| if (!ssl->server) { ------------------ | Branch (638:13): [True: 5, False: 0] ------------------ 639| | // On ECH reject, the handshake should never complete. 640| 5| assert(ssl->s3->ech_status != ssl_ech_rejected); 641| 5| } 642| 5| *out_early_return = true; 643| 5| hs->wait = ssl_hs_ok; 644| 5| return 1; 645| | 646| 0| case ssl_hs_hints_ready: ------------------ | Branch (646:7): [True: 0, False: 1.42M] ------------------ 647| 0| ssl->s3->rwstate = SSL_ERROR_HANDSHAKE_HINTS_READY; ------------------ | | 479| 0|#define SSL_ERROR_HANDSHAKE_HINTS_READY 20 ------------------ 648| 0| return -1; 649| | 650| 56.3k| case ssl_hs_ok: ------------------ | Branch (650:7): [True: 56.3k, False: 1.37M] ------------------ 651| 56.3k| break; 652| 1.42M| } 653| | 654| | // Run the state machine again. 655| 585k| hs->wait = ssl->do_handshake(hs); 656| 585k| if (hs->wait == ssl_hs_error) { ------------------ | Branch (656:9): [True: 1.98k, False: 583k] ------------------ 657| 1.98k| hs->error.reset(ERR_save_state()); 658| 1.98k| return -1; 659| 1.98k| } 660| 583k| if (hs->wait == ssl_hs_ok) { ------------------ | Branch (660:9): [True: 51.4k, False: 531k] ------------------ 661| 51.4k| if (!ssl->server) { ------------------ | Branch (661:11): [True: 51.4k, False: 0] ------------------ 662| | // On ECH reject, the handshake should never complete. 663| 51.4k| assert(ssl->s3->ech_status != ssl_ech_rejected); 664| 51.4k| } 665| | // The handshake has completed. 666| 51.4k| *out_early_return = false; 667| 51.4k| return 1; 668| 51.4k| } 669| | // If the handshake returns |ssl_hs_flush|, implicitly finish the flight. 670| | // This is a convenience so we do not need to manually insert this 671| | // throughout the handshake. 672| 531k| if (hs->wait == ssl_hs_flush) { ------------------ | Branch (672:9): [True: 108k, False: 422k] ------------------ 673| 108k| ssl->method->finish_flight(ssl); 674| 108k| } 675| | 676| | // Loop to the beginning and resolve what was blocking the handshake. 677| 531k| } 678| 56.3k|} _ZN4bssl41ssl_write_client_hello_without_extensionsEPKNS_13SSL_HANDSHAKEEP6cbb_stNS_23ssl_client_hello_type_tEb: 183| 56.4k| bool empty_session_id) { 184| 56.4k| const SSL *const ssl = hs->ssl; 185| 56.4k| CBB child; 186| 56.4k| if (!CBB_add_u16(cbb, hs->client_version) || ------------------ | Branch (186:7): [True: 0, False: 56.4k] ------------------ 187| 56.4k| !CBB_add_bytes(cbb, ------------------ | Branch (187:7): [True: 0, False: 56.4k] ------------------ 188| 56.4k| type == ssl_client_hello_inner ? hs->inner_client_random ------------------ | Branch (188:22): [True: 0, False: 56.4k] ------------------ 189| 56.4k| : ssl->s3->client_random, 190| 56.4k| SSL3_RANDOM_SIZE) || ------------------ | | 102| 56.4k|#define SSL3_RANDOM_SIZE 32 ------------------ 191| 56.4k| !CBB_add_u8_length_prefixed(cbb, &child)) { ------------------ | Branch (191:7): [True: 0, False: 56.4k] ------------------ 192| 0| return false; 193| 0| } 194| | 195| | // Do not send a session ID on renegotiation. 196| 56.4k| if (!ssl->s3->initial_handshake_complete && // ------------------ | Branch (196:7): [True: 5.28k, False: 51.1k] ------------------ 197| 56.4k| !empty_session_id && // ------------------ | Branch (197:7): [True: 5.28k, False: 0] ------------------ 198| 56.4k| !CBB_add_bytes(&child, hs->session_id.data(), hs->session_id.size())) { ------------------ | Branch (198:7): [True: 0, False: 5.28k] ------------------ 199| 0| return false; 200| 0| } 201| | 202| 56.4k| if (SSL_is_dtls(ssl)) { ------------------ | Branch (202:7): [True: 0, False: 56.4k] ------------------ 203| 0| if (!CBB_add_u8_length_prefixed(cbb, &child) || ------------------ | Branch (203:9): [True: 0, False: 0] ------------------ 204| 0| !CBB_add_bytes(&child, hs->dtls_cookie.data(), ------------------ | Branch (204:9): [True: 0, False: 0] ------------------ 205| 0| hs->dtls_cookie.size())) { 206| 0| return false; 207| 0| } 208| 0| } 209| | 210| 56.4k| if (!ssl_write_client_cipher_list(hs, cbb, type) || ------------------ | Branch (210:7): [True: 0, False: 56.4k] ------------------ 211| 56.4k| !CBB_add_u8(cbb, 1 /* one compression method */) || ------------------ | Branch (211:7): [True: 0, False: 56.4k] ------------------ 212| 56.4k| !CBB_add_u8(cbb, 0 /* null compression */)) { ------------------ | Branch (212:7): [True: 0, False: 56.4k] ------------------ 213| 0| return false; 214| 0| } 215| 56.4k| return true; 216| 56.4k|} _ZN4bssl20ssl_add_client_helloEPNS_13SSL_HANDSHAKEE: 218| 56.4k|bool ssl_add_client_hello(SSL_HANDSHAKE *hs) { 219| 56.4k| SSL *const ssl = hs->ssl; 220| 56.4k| ScopedCBB cbb; 221| 56.4k| CBB body; 222| 56.4k| ssl_client_hello_type_t type = hs->selected_ech_config ------------------ | Branch (222:34): [True: 0, False: 56.4k] ------------------ 223| 56.4k| ? ssl_client_hello_outer 224| 56.4k| : ssl_client_hello_unencrypted; 225| 56.4k| bool needs_psk_binder; 226| 56.4k| Array msg; 227| 56.4k| if (!ssl->method->init_message(ssl, cbb.get(), &body, SSL3_MT_CLIENT_HELLO) || ------------------ | | 195| 56.4k|#define SSL3_MT_CLIENT_HELLO 1 ------------------ | Branch (227:7): [True: 0, False: 56.4k] ------------------ 228| 56.4k| !ssl_write_client_hello_without_extensions(hs, &body, type, ------------------ | Branch (228:7): [True: 0, False: 56.4k] ------------------ 229| 56.4k| /*empty_session_id=*/false) || 230| 56.4k| !ssl_add_clienthello_tlsext(hs, &body, /*out_encoded=*/nullptr, ------------------ | Branch (230:7): [True: 0, False: 56.4k] ------------------ 231| 56.4k| &needs_psk_binder, type, CBB_len(&body)) || 232| 56.4k| !ssl->method->finish_message(ssl, cbb.get(), &msg)) { ------------------ | Branch (232:7): [True: 0, False: 56.4k] ------------------ 233| 0| return false; 234| 0| } 235| | 236| | // Now that the length prefixes have been computed, fill in the placeholder 237| | // PSK binder. 238| 56.4k| if (needs_psk_binder) { ------------------ | Branch (238:7): [True: 47, False: 56.3k] ------------------ 239| | // ClientHelloOuter cannot have a PSK binder. Otherwise the 240| | // ClientHellOuterAAD computation would break. 241| 47| assert(type != ssl_client_hello_outer); 242| 47| if (!tls13_write_psk_binder(hs, hs->transcript, Span(msg), ------------------ | Branch (242:9): [True: 0, False: 47] ------------------ 243| 47| /*out_binder_len=*/0)) { 244| 0| return false; 245| 0| } 246| 47| } 247| | 248| 56.4k| return ssl->method->add_message(ssl, std::move(msg)); 249| 56.4k|} _ZN4bssl29ssl_done_writing_client_helloEPNS_13SSL_HANDSHAKEE: 336| 55.1k|void ssl_done_writing_client_hello(SSL_HANDSHAKE *hs) { 337| 55.1k| hs->ech_client_outer.Reset(); 338| 55.1k| hs->cookie.Reset(); 339| 55.1k| hs->key_share_bytes.Reset(); 340| 55.1k| hs->pake_share_bytes.Reset(); 341| 55.1k|} _ZN4bssl22ssl_parse_server_helloEPNS_17ParsedServerHelloEPhRKNS_10SSLMessageE: 539| 56.4k| const SSLMessage &msg) { 540| 56.4k| if (msg.type != SSL3_MT_SERVER_HELLO) { ------------------ | | 196| 56.4k|#define SSL3_MT_SERVER_HELLO 2 ------------------ | Branch (540:7): [True: 27, False: 56.4k] ------------------ 541| 27| OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_MESSAGE); ------------------ | | 361| 27| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 542| 27| *out_alert = SSL_AD_UNEXPECTED_MESSAGE; ------------------ | | 4367| 27|#define SSL_AD_UNEXPECTED_MESSAGE SSL3_AD_UNEXPECTED_MESSAGE | | ------------------ | | | | 179| 27|#define SSL3_AD_UNEXPECTED_MESSAGE 10 // fatal | | ------------------ ------------------ 543| 27| return false; 544| 27| } 545| 56.4k| out->raw = msg.raw; 546| 56.4k| CBS body = msg.body; 547| 56.4k| if (!CBS_get_u16(&body, &out->legacy_version) || ------------------ | Branch (547:7): [True: 4, False: 56.4k] ------------------ 548| 56.4k| !CBS_get_bytes(&body, &out->random, SSL3_RANDOM_SIZE) || ------------------ | | 102| 56.4k|#define SSL3_RANDOM_SIZE 32 ------------------ | Branch (548:7): [True: 2, False: 56.4k] ------------------ 549| 56.4k| !CBS_get_u8_length_prefixed(&body, &out->session_id) || ------------------ | Branch (549:7): [True: 32, False: 56.3k] ------------------ 550| 56.4k| CBS_len(&out->session_id) > SSL3_SESSION_ID_SIZE || ------------------ | | 103| 112k|#define SSL3_SESSION_ID_SIZE 32 ------------------ | Branch (550:7): [True: 8, False: 56.3k] ------------------ 551| 56.4k| !CBS_get_u16(&body, &out->cipher_suite) || ------------------ | Branch (551:7): [True: 4, False: 56.3k] ------------------ 552| 56.4k| !CBS_get_u8(&body, &out->compression_method)) { ------------------ | Branch (552:7): [True: 1, False: 56.3k] ------------------ 553| 51| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); ------------------ | | 361| 51| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 554| 51| *out_alert = SSL_AD_DECODE_ERROR; ------------------ | | 4382| 51|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 51|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 555| 51| return false; 556| 51| } 557| | // In TLS 1.2 and below, empty extensions blocks may be omitted. In TLS 1.3, 558| | // ServerHellos always have extensions, so this can be applied generically. 559| 56.3k| CBS_init(&out->extensions, nullptr, 0); 560| 56.3k| if ((CBS_len(&body) != 0 && ------------------ | Branch (560:8): [True: 55.9k, False: 395] ------------------ 561| 56.3k| !CBS_get_u16_length_prefixed(&body, &out->extensions)) || ------------------ | Branch (561:8): [True: 20, False: 55.9k] ------------------ 562| 56.3k| CBS_len(&body) != 0) { ------------------ | Branch (562:7): [True: 17, False: 56.3k] ------------------ 563| 37| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); ------------------ | | 361| 37| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 564| 37| *out_alert = SSL_AD_DECODE_ERROR; ------------------ | | 4382| 37|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 37|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 565| 37| return false; 566| 37| } 567| 56.3k| return true; 568| 56.3k|} _ZN4bssl20ssl_client_handshakeEPNS_13SSL_HANDSHAKEE: 1817| 585k|enum ssl_hs_wait_t ssl_client_handshake(SSL_HANDSHAKE *hs) { 1818| 1.37M| while (hs->state != state_done) { ------------------ | Branch (1818:10): [True: 1.32M, False: 51.4k] ------------------ 1819| 1.32M| enum ssl_hs_wait_t ret = ssl_hs_error; 1820| 1.32M| enum ssl_client_hs_state_t state = 1821| 1.32M| static_cast(hs->state); 1822| 1.32M| switch (state) { ------------------ | Branch (1822:13): [True: 0, False: 1.32M] ------------------ 1823| 56.3k| case state_start_connect: ------------------ | Branch (1823:7): [True: 56.3k, False: 1.26M] ------------------ 1824| 56.3k| ret = do_start_connect(hs); 1825| 56.3k| break; 1826| 56.3k| case state_enter_early_data: ------------------ | Branch (1826:7): [True: 56.3k, False: 1.26M] ------------------ 1827| 56.3k| ret = do_enter_early_data(hs); 1828| 56.3k| break; 1829| 6| case state_early_reverify_server_certificate: ------------------ | Branch (1829:7): [True: 6, False: 1.32M] ------------------ 1830| 6| ret = do_early_reverify_server_certificate(hs); 1831| 6| break; 1832| 117k| case state_read_server_hello: ------------------ | Branch (1832:7): [True: 117k, False: 1.20M] ------------------ 1833| 117k| ret = do_read_server_hello(hs); 1834| 117k| break; 1835| 2.81k| case state_tls13: ------------------ | Branch (1835:7): [True: 2.81k, False: 1.32M] ------------------ 1836| 2.81k| ret = do_tls13(hs); 1837| 2.81k| break; 1838| 121k| case state_read_server_certificate: ------------------ | Branch (1838:7): [True: 121k, False: 1.20M] ------------------ 1839| 121k| ret = do_read_server_certificate(hs); 1840| 121k| break; 1841| 67.6k| case state_read_certificate_status: ------------------ | Branch (1841:7): [True: 67.6k, False: 1.25M] ------------------ 1842| 67.6k| ret = do_read_certificate_status(hs); 1843| 67.6k| break; 1844| 53.4k| case state_verify_server_certificate: ------------------ | Branch (1844:7): [True: 53.4k, False: 1.27M] ------------------ 1845| 53.4k| ret = do_verify_server_certificate(hs); 1846| 53.4k| break; 1847| 0| case state_reverify_server_certificate: ------------------ | Branch (1847:7): [True: 0, False: 1.32M] ------------------ 1848| 0| ret = do_reverify_server_certificate(hs); 1849| 0| break; 1850| 94.1k| case state_read_server_key_exchange: ------------------ | Branch (1850:7): [True: 94.1k, False: 1.23M] ------------------ 1851| 94.1k| ret = do_read_server_key_exchange(hs); 1852| 94.1k| break; 1853| 103k| case state_read_certificate_request: ------------------ | Branch (1853:7): [True: 103k, False: 1.22M] ------------------ 1854| 103k| ret = do_read_certificate_request(hs); 1855| 103k| break; 1856| 80.5k| case state_read_server_hello_done: ------------------ | Branch (1856:7): [True: 80.5k, False: 1.24M] ------------------ 1857| 80.5k| ret = do_read_server_hello_done(hs); 1858| 80.5k| break; 1859| 52.2k| case state_send_client_certificate: ------------------ | Branch (1859:7): [True: 52.2k, False: 1.27M] ------------------ 1860| 52.2k| ret = do_send_client_certificate(hs); 1861| 52.2k| break; 1862| 52.2k| case state_send_client_key_exchange: ------------------ | Branch (1862:7): [True: 52.2k, False: 1.27M] ------------------ 1863| 52.2k| ret = do_send_client_key_exchange(hs); 1864| 52.2k| break; 1865| 52.0k| case state_send_client_certificate_verify: ------------------ | Branch (1865:7): [True: 52.0k, False: 1.27M] ------------------ 1866| 52.0k| ret = do_send_client_certificate_verify(hs); 1867| 52.0k| break; 1868| 52.2k| case state_send_client_finished: ------------------ | Branch (1868:7): [True: 52.2k, False: 1.27M] ------------------ 1869| 52.2k| ret = do_send_client_finished(hs); 1870| 52.2k| break; 1871| 52.2k| case state_finish_flight: ------------------ | Branch (1871:7): [True: 52.2k, False: 1.27M] ------------------ 1872| 52.2k| ret = do_finish_flight(hs); 1873| 52.2k| break; 1874| 104k| case state_read_session_ticket: ------------------ | Branch (1874:7): [True: 104k, False: 1.22M] ------------------ 1875| 104k| ret = do_read_session_ticket(hs); 1876| 104k| break; 1877| 51.4k| case state_process_change_cipher_spec: ------------------ | Branch (1877:7): [True: 51.4k, False: 1.27M] ------------------ 1878| 51.4k| ret = do_process_change_cipher_spec(hs); 1879| 51.4k| break; 1880| 103k| case state_read_server_finished: ------------------ | Branch (1880:7): [True: 103k, False: 1.22M] ------------------ 1881| 103k| ret = do_read_server_finished(hs); 1882| 103k| break; 1883| 51.4k| case state_finish_client_handshake: ------------------ | Branch (1883:7): [True: 51.4k, False: 1.27M] ------------------ 1884| 51.4k| ret = do_finish_client_handshake(hs); 1885| 51.4k| break; 1886| 0| case state_done: ------------------ | Branch (1886:7): [True: 0, False: 1.32M] ------------------ 1887| 0| ret = ssl_hs_ok; 1888| 0| break; 1889| 1.32M| } 1890| | 1891| 1.32M| if (hs->state != state) { ------------------ | Branch (1891:9): [True: 953k, False: 373k] ------------------ 1892| 953k| ssl_do_info_callback(hs->ssl, SSL_CB_CONNECT_LOOP, 1); ------------------ | | 5029| 953k|#define SSL_CB_CONNECT_LOOP (SSL_ST_CONNECT | SSL_CB_LOOP) | | ------------------ | | | | 5006| 953k|#define SSL_ST_CONNECT 0x1000 | | ------------------ | | #define SSL_CB_CONNECT_LOOP (SSL_ST_CONNECT | SSL_CB_LOOP) | | ------------------ | | | | 5020| 953k|#define SSL_CB_LOOP 0x01 | | ------------------ ------------------ 1893| 953k| } 1894| | 1895| 1.32M| if (ret != ssl_hs_ok) { ------------------ | Branch (1895:9): [True: 533k, False: 792k] ------------------ 1896| 533k| return ret; 1897| 533k| } 1898| 1.32M| } 1899| | 1900| 51.4k| ssl_do_info_callback(hs->ssl, SSL_CB_HANDSHAKE_DONE, 1); ------------------ | | 5032| 51.4k|#define SSL_CB_HANDSHAKE_DONE 0x20 ------------------ 1901| 51.4k| return ssl_hs_ok; 1902| 585k|} handshake_client.cc:_ZN4bsslL28ssl_write_client_cipher_listEPKNS_13SSL_HANDSHAKEEP6cbb_stNS_23ssl_client_hello_type_tE: 94| 56.4k| ssl_client_hello_type_t type) { 95| 56.4k| const SSL *const ssl = hs->ssl; 96| 56.4k| uint32_t mask_a, mask_k; 97| 56.4k| ssl_get_client_disabled(hs, &mask_a, &mask_k); 98| | 99| 56.4k| CBB child; 100| 56.4k| if (!CBB_add_u16_length_prefixed(out, &child)) { ------------------ | Branch (100:7): [True: 0, False: 56.4k] ------------------ 101| 0| return false; 102| 0| } 103| | 104| | // Add a fake cipher suite. See RFC 8701. 105| 56.4k| if (ssl->ctx->grease_enabled && ------------------ | Branch (105:7): [True: 0, False: 56.4k] ------------------ 106| 56.4k| !CBB_add_u16(&child, ssl_get_grease_value(hs, ssl_grease_cipher))) { ------------------ | Branch (106:7): [True: 0, False: 0] ------------------ 107| 0| return false; 108| 0| } 109| | 110| | // Add TLS 1.3 ciphers. Order ChaCha20-Poly1305 relative to AES-GCM based on 111| | // hardware support. 112| 56.4k| if (hs->max_version >= TLS1_3_VERSION) { ------------------ | | 545| 56.4k|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (112:7): [True: 56.4k, False: 0] ------------------ 113| 56.4k| static const uint16_t kCiphersNoAESHardware[] = { 114| 56.4k| TLS1_3_CK_CHACHA20_POLY1305_SHA256 & 0xffff, ------------------ | | 339| 56.4k|#define TLS1_3_CK_CHACHA20_POLY1305_SHA256 0x03001303 ------------------ 115| 56.4k| TLS1_3_CK_AES_128_GCM_SHA256 & 0xffff, ------------------ | | 337| 56.4k|#define TLS1_3_CK_AES_128_GCM_SHA256 0x03001301 ------------------ 116| 56.4k| TLS1_3_CK_AES_256_GCM_SHA384 & 0xffff, ------------------ | | 338| 56.4k|#define TLS1_3_CK_AES_256_GCM_SHA384 0x03001302 ------------------ 117| 56.4k| }; 118| 56.4k| static const uint16_t kCiphersAESHardware[] = { 119| 56.4k| TLS1_3_CK_AES_128_GCM_SHA256 & 0xffff, ------------------ | | 337| 56.4k|#define TLS1_3_CK_AES_128_GCM_SHA256 0x03001301 ------------------ 120| 56.4k| TLS1_3_CK_AES_256_GCM_SHA384 & 0xffff, ------------------ | | 338| 56.4k|#define TLS1_3_CK_AES_256_GCM_SHA384 0x03001302 ------------------ 121| 56.4k| TLS1_3_CK_CHACHA20_POLY1305_SHA256 & 0xffff, ------------------ | | 339| 56.4k|#define TLS1_3_CK_CHACHA20_POLY1305_SHA256 0x03001303 ------------------ 122| 56.4k| }; 123| 56.4k| static const uint16_t kCiphersCNSA[] = { 124| 56.4k| TLS1_3_CK_AES_256_GCM_SHA384 & 0xffff, ------------------ | | 338| 56.4k|#define TLS1_3_CK_AES_256_GCM_SHA384 0x03001302 ------------------ 125| 56.4k| TLS1_3_CK_AES_128_GCM_SHA256 & 0xffff, ------------------ | | 337| 56.4k|#define TLS1_3_CK_AES_128_GCM_SHA256 0x03001301 ------------------ 126| 56.4k| TLS1_3_CK_CHACHA20_POLY1305_SHA256 & 0xffff, ------------------ | | 339| 56.4k|#define TLS1_3_CK_CHACHA20_POLY1305_SHA256 0x03001303 ------------------ 127| 56.4k| }; 128| | 129| 56.4k| const bool has_aes_hw = ssl->config->aes_hw_override ------------------ | Branch (129:29): [True: 0, False: 56.4k] ------------------ 130| 56.4k| ? ssl->config->aes_hw_override_value 131| 56.4k| : EVP_has_aes_hardware(); 132| 56.4k| const bssl::Span ciphers = 133| 56.4k| ssl->config->compliance_policy == ssl_compliance_policy_cnsa_202407 ------------------ | Branch (133:9): [True: 0, False: 56.4k] ------------------ 134| 56.4k| ? bssl::Span(kCiphersCNSA) 135| 56.4k| : (has_aes_hw ? bssl::Span(kCiphersAESHardware) ------------------ | Branch (135:16): [True: 56.4k, False: 0] ------------------ 136| 56.4k| : bssl::Span(kCiphersNoAESHardware)); 137| | 138| 169k| for (auto cipher : ciphers) { ------------------ | Branch (138:22): [True: 169k, False: 56.4k] ------------------ 139| 169k| if (!ssl_add_tls13_cipher(&child, cipher, ------------------ | Branch (139:11): [True: 0, False: 169k] ------------------ 140| 169k| ssl->config->compliance_policy)) { 141| 0| return false; 142| 0| } 143| 169k| } 144| 56.4k| } 145| | 146| 56.4k| if (hs->min_version < TLS1_3_VERSION && type != ssl_client_hello_inner) { ------------------ | | 545| 112k|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (146:7): [True: 56.4k, False: 0] | Branch (146:43): [True: 56.4k, False: 0] ------------------ 147| 56.4k| bool any_enabled = false; 148| 1.12M| for (const SSL_CIPHER *cipher : SSL_get_ciphers(ssl)) { ------------------ | Branch (148:35): [True: 1.12M, False: 56.4k] ------------------ 149| | // Skip disabled ciphers 150| 1.12M| if ((cipher->algorithm_mkey & mask_k) || ------------------ | Branch (150:11): [True: 112k, False: 1.01M] ------------------ 151| 1.12M| (cipher->algorithm_auth & mask_a)) { ------------------ | Branch (151:11): [True: 169k, False: 846k] ------------------ 152| 282k| continue; 153| 282k| } 154| 846k| if (SSL_CIPHER_get_min_version(cipher) > hs->max_version || ------------------ | Branch (154:11): [True: 0, False: 846k] ------------------ 155| 846k| SSL_CIPHER_get_max_version(cipher) < hs->min_version) { ------------------ | Branch (155:11): [True: 0, False: 846k] ------------------ 156| 0| continue; 157| 0| } 158| 846k| any_enabled = true; 159| 846k| if (!CBB_add_u16(&child, SSL_CIPHER_get_protocol_id(cipher))) { ------------------ | Branch (159:11): [True: 0, False: 846k] ------------------ 160| 0| return false; 161| 0| } 162| 846k| } 163| | 164| | // If all ciphers were disabled, return the error to the caller. 165| 56.4k| if (!any_enabled && hs->max_version < TLS1_3_VERSION) { ------------------ | | 545| 0|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (165:9): [True: 0, False: 56.4k] | Branch (165:25): [True: 0, False: 0] ------------------ 166| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_NO_CIPHERS_AVAILABLE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 167| 0| return false; 168| 0| } 169| 56.4k| } 170| | 171| 56.4k| if (ssl->mode & SSL_MODE_SEND_FALLBACK_SCSV) { ------------------ | | 699| 56.4k|#define SSL_MODE_SEND_FALLBACK_SCSV 0x00000400L ------------------ | Branch (171:7): [True: 0, False: 56.4k] ------------------ 172| 0| if (!CBB_add_u16(&child, SSL3_CK_FALLBACK_SCSV & 0xffff)) { ------------------ | | 34| 0|#define SSL3_CK_FALLBACK_SCSV 0x03005600 ------------------ | Branch (172:9): [True: 0, False: 0] ------------------ 173| 0| return false; 174| 0| } 175| 0| } 176| | 177| 56.4k| return CBB_flush(out); 178| 56.4k|} handshake_client.cc:_ZN4bsslL23ssl_get_client_disabledEPKNS_13SSL_HANDSHAKEEPjS3_: 74| 111k| uint32_t *out_mask_k) { 75| 111k| *out_mask_a = 0; 76| 111k| *out_mask_k = 0; 77| | 78| | // PSK requires a client callback. 79| 111k| if (hs->config->psk_client_callback == NULL) { ------------------ | Branch (79:7): [True: 111k, False: 0] ------------------ 80| 111k| *out_mask_a |= SSL_aPSK; ------------------ | | 270| 111k|#define SSL_aPSK 0x00000008u ------------------ 81| 111k| *out_mask_k |= SSL_kPSK; ------------------ | | 262| 111k|#define SSL_kPSK 0x00000004u ------------------ 82| 111k| } 83| 111k|} handshake_client.cc:_ZN4bsslL20ssl_add_tls13_cipherEP6cbb_stt23ssl_compliance_policy_t: 86| 169k| ssl_compliance_policy_t policy) { 87| 169k| if (ssl_tls13_cipher_meets_policy(cipher_id, policy)) { ------------------ | Branch (87:7): [True: 169k, False: 0] ------------------ 88| 169k| return CBB_add_u16(cbb, cipher_id); 89| 169k| } 90| 0| return true; 91| 169k|} handshake_client.cc:_ZN4bsslL16do_start_connectEPNS_13SSL_HANDSHAKEE: 343| 56.3k|static enum ssl_hs_wait_t do_start_connect(SSL_HANDSHAKE *hs) { 344| 56.3k| SSL *const ssl = hs->ssl; 345| | 346| 56.3k| ssl_do_info_callback(ssl, SSL_CB_HANDSHAKE_START, 1); ------------------ | | 5031| 56.3k|#define SSL_CB_HANDSHAKE_START 0x10 ------------------ 347| | // |session_reused| must be reset in case this is a renegotiation. 348| 56.3k| ssl->s3->session_reused = false; 349| | 350| | // Freeze the version range. 351| 56.3k| if (!ssl_get_version_range(hs, &hs->min_version, &hs->max_version)) { ------------------ | Branch (351:7): [True: 0, False: 56.3k] ------------------ 352| 0| return ssl_hs_error; 353| 0| } 354| | 355| 56.3k| uint8_t ech_enc[EVP_HPKE_MAX_ENC_LENGTH]; 356| 56.3k| size_t ech_enc_len; 357| 56.3k| if (!ssl_select_ech_config(hs, ech_enc, &ech_enc_len)) { ------------------ | Branch (357:7): [True: 0, False: 56.3k] ------------------ 358| 0| return ssl_hs_error; 359| 0| } 360| | 361| | // Always advertise the ClientHello version from the original maximum version, 362| | // even on renegotiation. The static RSA key exchange uses this field, and 363| | // some servers fail when it changes across handshakes. 364| 56.3k| if (SSL_is_dtls(hs->ssl)) { ------------------ | Branch (364:7): [True: 0, False: 56.3k] ------------------ 365| 0| hs->client_version = 366| 0| hs->max_version >= TLS1_2_VERSION ? DTLS1_2_VERSION : DTLS1_VERSION; ------------------ | | 544| 0|#define TLS1_2_VERSION 0x0303 ------------------ hs->max_version >= TLS1_2_VERSION ? DTLS1_2_VERSION : DTLS1_VERSION; ------------------ | | 548| 0|#define DTLS1_2_VERSION 0xfefd ------------------ hs->max_version >= TLS1_2_VERSION ? DTLS1_2_VERSION : DTLS1_VERSION; ------------------ | | 547| 0|#define DTLS1_VERSION 0xfeff ------------------ | Branch (366:9): [True: 0, False: 0] ------------------ 367| 56.3k| } else { 368| 56.3k| hs->client_version = 369| 56.3k| hs->max_version >= TLS1_2_VERSION ? TLS1_2_VERSION : hs->max_version; ------------------ | | 544| 56.3k|#define TLS1_2_VERSION 0x0303 ------------------ hs->max_version >= TLS1_2_VERSION ? TLS1_2_VERSION : hs->max_version; ------------------ | | 544| 56.3k|#define TLS1_2_VERSION 0x0303 ------------------ | Branch (369:9): [True: 56.3k, False: 0] ------------------ 370| 56.3k| } 371| | 372| 56.3k| if (!ssl_setup_pake_shares(hs)) { ------------------ | Branch (372:7): [True: 0, False: 56.3k] ------------------ 373| 0| return ssl_hs_error; 374| 0| } 375| | 376| | // If the configured session has expired or is not usable, drop it. We also do 377| | // not offer sessions on renegotiation. 378| 56.3k| SSLSessionType session_type = SSLSessionType::kNotResumable; 379| 56.3k| if (ssl->session != nullptr) { ------------------ | Branch (379:7): [True: 1.00k, False: 55.3k] ------------------ 380| 1.00k| session_type = ssl_session_get_type(ssl->session.get()); 381| 1.00k| if (ssl->session->is_server || ------------------ | Branch (381:9): [True: 75, False: 925] ------------------ 382| 1.00k| !ssl_supports_version(hs, ssl->session->ssl_version) || ------------------ | Branch (382:9): [True: 55, False: 870] ------------------ 383| | // Do not offer TLS 1.2 sessions with ECH. ClientHelloInner does not 384| | // offer TLS 1.2, and the cleartext session ID may leak the server 385| | // identity. 386| 1.00k| (hs->selected_ech_config && ------------------ | Branch (386:10): [True: 0, False: 870] ------------------ 387| 870| ssl_session_protocol_version(ssl->session.get()) < TLS1_3_VERSION) || ------------------ | | 545| 0|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (387:10): [True: 0, False: 0] ------------------ 388| 1.00k| session_type == SSLSessionType::kNotResumable || ------------------ | Branch (388:9): [True: 42, False: 828] ------------------ 389| | // Don't offer TLS 1.2 tickets if disabled. 390| 1.00k| (session_type == SSLSessionType::kTicket && ------------------ | Branch (390:10): [True: 25, False: 803] ------------------ 391| 828| (SSL_get_options(ssl) & SSL_OP_NO_TICKET)) || ------------------ | | 6111| 25|#define SSL_get_options SSL_get_options ------------------ (SSL_get_options(ssl) & SSL_OP_NO_TICKET)) || ------------------ | | 602| 25|#define SSL_OP_NO_TICKET 0x00004000L ------------------ | Branch (391:10): [True: 0, False: 25] ------------------ 392| | // Don't offer sessions and PAKEs at the same time. We do not currently 393| | // support resumption with PAKEs. (Offering both together would need 394| | // more logic to conditionally send the key_share extension.) 395| 1.00k| hs->pake_prover != nullptr || ------------------ | Branch (395:9): [True: 0, False: 828] ------------------ 396| 1.00k| !ssl_session_is_time_valid(ssl, ssl->session.get()) || ------------------ | Branch (396:9): [True: 15, False: 813] ------------------ 397| 1.00k| SSL_is_quic(ssl) != int{ssl->session->is_quic} || ------------------ | Branch (397:9): [True: 0, False: 813] ------------------ 398| 1.00k| ssl->s3->initial_handshake_complete) { ------------------ | Branch (398:9): [True: 15, False: 798] ------------------ 399| 202| ssl_set_session(ssl, nullptr); 400| 202| session_type = SSLSessionType::kNotResumable; 401| 202| } 402| 1.00k| } 403| | 404| 56.3k| if (!RAND_bytes(ssl->s3->client_random, sizeof(ssl->s3->client_random))) { ------------------ | Branch (404:7): [True: 0, False: 56.3k] ------------------ 405| 0| return ssl_hs_error; 406| 0| } 407| 56.3k| if (hs->selected_ech_config && ------------------ | Branch (407:7): [True: 0, False: 56.3k] ------------------ 408| 56.3k| !RAND_bytes(hs->inner_client_random, sizeof(hs->inner_client_random))) { ------------------ | Branch (408:7): [True: 0, False: 0] ------------------ 409| 0| return ssl_hs_error; 410| 0| } 411| | 412| | // Compatibility mode sends a random session ID. Compatibility mode is 413| | // enabled for TLS 1.3, but not when it's run over QUIC or DTLS. 414| 56.3k| const bool enable_compatibility_mode = hs->max_version >= TLS1_3_VERSION && ------------------ | | 545| 112k|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (414:42): [True: 56.3k, False: 0] ------------------ 415| 56.3k| !SSL_is_quic(ssl) && !SSL_is_dtls(ssl); ------------------ | Branch (415:42): [True: 56.3k, False: 0] | Branch (415:63): [True: 56.3k, False: 0] ------------------ 416| 56.3k| if (session_type == SSLSessionType::kID) { ------------------ | Branch (416:7): [True: 726, False: 55.6k] ------------------ 417| 726| hs->session_id = ssl->session->session_id; 418| 55.6k| } else if (session_type == SSLSessionType::kTicket || ------------------ | Branch (418:14): [True: 25, False: 55.5k] ------------------ 419| 55.6k| enable_compatibility_mode) { ------------------ | Branch (419:14): [True: 55.5k, False: 0] ------------------ 420| | // TLS 1.2 session tickets require a placeholder value to signal resumption. 421| 55.6k| hs->session_id.ResizeForOverwrite(SSL_MAX_SSL_SESSION_ID_LENGTH); ------------------ | | 1904| 55.6k|#define SSL_MAX_SSL_SESSION_ID_LENGTH 32 ------------------ 422| 55.6k| if (!RAND_bytes(hs->session_id.data(), hs->session_id.size())) { ------------------ | Branch (422:9): [True: 0, False: 55.6k] ------------------ 423| 0| return ssl_hs_error; 424| 0| } 425| 55.6k| } 426| | 427| 56.3k| ssl_early_data_reason_t reason = should_offer_early_data(hs); 428| 56.3k| if (reason != ssl_early_data_accepted) { ------------------ | Branch (428:7): [True: 56.3k, False: 6] ------------------ 429| 56.3k| ssl->s3->early_data_reason = reason; 430| 56.3k| } else { 431| 6| hs->early_data_offered = true; 432| 6| } 433| | 434| 56.3k| if (!ssl_setup_key_shares(hs, /*override_group_id=*/0) || ------------------ | Branch (434:7): [True: 0, False: 56.3k] | Branch (434:7): [True: 0, False: 56.3k] ------------------ 435| 56.3k| !ssl_setup_extension_permutation(hs) || ------------------ | Branch (435:7): [True: 0, False: 56.3k] ------------------ 436| 56.3k| !ssl_encrypt_client_hello(hs, Span(ech_enc, ech_enc_len)) || ------------------ | Branch (436:7): [True: 0, False: 56.3k] ------------------ 437| 56.3k| !ssl_add_client_hello(hs)) { ------------------ | Branch (437:7): [True: 0, False: 56.3k] ------------------ 438| 0| return ssl_hs_error; 439| 0| } 440| | 441| 56.3k| hs->state = state_enter_early_data; 442| 56.3k| return ssl_hs_flush; 443| 56.3k|} handshake_client.cc:_ZN4bsslL23should_offer_early_dataEPKNS_13SSL_HANDSHAKEE: 289| 56.3k| const SSL_HANDSHAKE *hs) { 290| 56.3k| const SSL *const ssl = hs->ssl; 291| 56.3k| assert(!ssl->server); 292| 56.3k| if (!ssl->enable_early_data) { ------------------ | Branch (292:7): [True: 0, False: 56.3k] ------------------ 293| 0| return ssl_early_data_disabled; 294| 0| } 295| | 296| 56.3k| if (hs->max_version < TLS1_3_VERSION || SSL_is_dtls(ssl)) { ------------------ | | 545| 112k|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (296:7): [True: 0, False: 56.3k] | Branch (296:43): [True: 0, False: 56.3k] ------------------ 297| | // We discard inapplicable sessions, so this is redundant with the session 298| | // checks below, but reporting that TLS 1.3 was disabled is more useful. 299| | // 300| | // TODO(crbug.com/381113363): Support early data in DTLS 1.3. 301| 0| return ssl_early_data_protocol_version; 302| 0| } 303| | 304| 56.3k| if (ssl->session == nullptr) { ------------------ | Branch (304:7): [True: 55.5k, False: 798] ------------------ 305| 55.5k| return ssl_early_data_no_session_offered; 306| 55.5k| } 307| | 308| 798| if (ssl_session_protocol_version(ssl->session.get()) < TLS1_3_VERSION || ------------------ | | 545| 1.59k|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (308:7): [True: 751, False: 47] ------------------ 309| 798| ssl->session->ticket_max_early_data == 0) { ------------------ | Branch (309:7): [True: 38, False: 9] ------------------ 310| 789| return ssl_early_data_unsupported_for_session; 311| 789| } 312| | 313| 9| if (!ssl->session->early_alpn.empty()) { ------------------ | Branch (313:7): [True: 3, False: 6] ------------------ 314| 3| if (!ssl_is_alpn_protocol_allowed(hs, ssl->session->early_alpn)) { ------------------ | Branch (314:9): [True: 3, False: 0] ------------------ 315| | // Avoid reporting a confusing value in |SSL_get0_alpn_selected|. 316| 3| return ssl_early_data_alpn_mismatch; 317| 3| } 318| | 319| | // If the previous connection negotiated ALPS, only offer 0-RTT when the 320| | // local are settings are consistent with what we'd offer for this 321| | // connection. 322| 0| if (ssl->session->has_application_settings) { ------------------ | Branch (322:9): [True: 0, False: 0] ------------------ 323| 0| Span settings; 324| 0| if (!ssl_get_local_application_settings(hs, &settings, ------------------ | Branch (324:11): [True: 0, False: 0] ------------------ 325| 0| ssl->session->early_alpn) || 326| 0| settings != ssl->session->local_application_settings) { ------------------ | Branch (326:11): [True: 0, False: 0] ------------------ 327| 0| return ssl_early_data_alps_mismatch; 328| 0| } 329| 0| } 330| 0| } 331| | 332| | // Early data has not yet been accepted, but we use it as a success code. 333| 6| return ssl_early_data_accepted; 334| 9|} handshake_client.cc:_ZN4bsslL19do_enter_early_dataEPNS_13SSL_HANDSHAKEE: 445| 56.3k|static enum ssl_hs_wait_t do_enter_early_data(SSL_HANDSHAKE *hs) { 446| 56.3k| SSL *const ssl = hs->ssl; 447| 56.3k| if (!hs->early_data_offered) { ------------------ | Branch (447:7): [True: 56.3k, False: 6] ------------------ 448| 56.3k| hs->state = state_read_server_hello; 449| 56.3k| return ssl_hs_ok; 450| 56.3k| } 451| | 452| | // Stash the early data session and activate the early version. This must 453| | // happen before |do_early_reverify_server_certificate|, so early connection 454| | // properties are available to the callback. Note the early version may be 455| | // overwritten later by the final version. 456| 6| hs->early_session = UpRef(ssl->session); 457| 6| ssl->s3->version = hs->early_session->ssl_version; 458| 6| hs->is_early_version = true; 459| 6| hs->state = state_early_reverify_server_certificate; 460| 6| return ssl_hs_ok; 461| 56.3k|} handshake_client.cc:_ZN4bsslL36do_early_reverify_server_certificateEPNS_13SSL_HANDSHAKEE: 464| 6| SSL_HANDSHAKE *hs) { 465| 6| SSL *const ssl = hs->ssl; 466| 6| if (ssl->ctx->reverify_on_resume) { ------------------ | Branch (466:7): [True: 0, False: 6] ------------------ 467| | // Don't send an alert on error. The alert would be in the clear, which the 468| | // server is not expecting anyway. Alerts in between ClientHello and 469| | // ServerHello cannot usefully be delivered in TLS 1.3. 470| | // 471| | // TODO(davidben): The client behavior should be to verify the certificate 472| | // before deciding whether to offer the session and, if invalid, decline to 473| | // send the session. 474| 0| switch (ssl_reverify_peer_cert(hs, /*send_alert=*/false)) { ------------------ | Branch (474:13): [True: 0, False: 0] ------------------ 475| 0| case ssl_verify_ok: ------------------ | Branch (475:7): [True: 0, False: 0] ------------------ 476| 0| break; 477| 0| case ssl_verify_invalid: ------------------ | Branch (477:7): [True: 0, False: 0] ------------------ 478| 0| return ssl_hs_error; 479| 0| case ssl_verify_retry: ------------------ | Branch (479:7): [True: 0, False: 0] ------------------ 480| 0| hs->state = state_early_reverify_server_certificate; 481| 0| return ssl_hs_certificate_verify; 482| 0| } 483| 0| } 484| | 485| 6| if (!ssl->method->add_change_cipher_spec(ssl)) { ------------------ | Branch (485:7): [True: 0, False: 6] ------------------ 486| 0| return ssl_hs_error; 487| 0| } 488| | 489| | // Defer releasing the 0-RTT key to after certificate reverification, so the 490| | // QUIC implementation does not accidentally write data too early. 491| 6| if (!tls13_init_early_key_schedule(hs, hs->early_session.get()) || ------------------ | Branch (491:7): [True: 0, False: 6] ------------------ 492| 6| !tls13_derive_early_secret(hs) || ------------------ | Branch (492:7): [True: 0, False: 6] ------------------ 493| 6| !tls13_set_traffic_key(hs->ssl, ssl_encryption_early_data, evp_aead_seal, ------------------ | Branch (493:7): [True: 1, False: 5] ------------------ 494| 6| hs->early_session.get(), 495| 6| hs->early_traffic_secret)) { 496| 1| return ssl_hs_error; 497| 1| } 498| | 499| 5| hs->in_early_data = true; 500| 5| hs->can_early_write = true; 501| 5| hs->state = state_read_server_hello; 502| 5| return ssl_hs_early_return; 503| 6|} handshake_client.cc:_ZN4bsslL20do_read_server_helloEPNS_13SSL_HANDSHAKEE: 570| 117k|static enum ssl_hs_wait_t do_read_server_hello(SSL_HANDSHAKE *hs) { 571| 117k| SSL *const ssl = hs->ssl; 572| 117k| SSLMessage msg; 573| 117k| if (!ssl->method->get_message(ssl, &msg)) { ------------------ | Branch (573:7): [True: 61.4k, False: 55.7k] ------------------ 574| 61.4k| return ssl_hs_read_server_hello; 575| 61.4k| } 576| | 577| 55.7k| if (SSL_is_dtls(ssl) && !hs->received_hello_verify_request && ------------------ | Branch (577:7): [True: 0, False: 55.7k] | Branch (577:27): [True: 0, False: 0] ------------------ 578| 55.7k| msg.type == DTLS1_MT_HELLO_VERIFY_REQUEST) { ------------------ | | 214| 0|#define DTLS1_MT_HELLO_VERIFY_REQUEST 3 ------------------ | Branch (578:7): [True: 0, False: 0] ------------------ 579| 0| if (!handle_hello_verify_request(hs, msg)) { ------------------ | Branch (579:9): [True: 0, False: 0] ------------------ 580| 0| return ssl_hs_error; 581| 0| } 582| 0| hs->received_hello_verify_request = true; 583| 0| hs->state = state_read_server_hello; 584| 0| return ssl_hs_flush; 585| 0| } 586| | 587| 55.7k| ParsedServerHello server_hello; 588| 55.7k| uint16_t server_version; 589| 55.7k| uint8_t alert = SSL_AD_DECODE_ERROR; ------------------ | | 4382| 55.7k|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 55.7k|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 590| 55.7k| if (!ssl_parse_server_hello(&server_hello, &alert, msg) || ------------------ | Branch (590:7): [True: 113, False: 55.5k] ------------------ 591| 55.7k| !parse_server_version(hs, &server_version, &alert, server_hello)) { ------------------ | Branch (591:7): [True: 25, False: 55.5k] ------------------ 592| 138| ssl_send_alert(ssl, SSL3_AL_FATAL, alert); ------------------ | | 176| 138|#define SSL3_AL_FATAL 2 ------------------ 593| 138| return ssl_hs_error; 594| 138| } 595| | 596| 55.5k| if (!ssl_supports_version(hs, server_version)) { ------------------ | Branch (596:7): [True: 22, False: 55.5k] ------------------ 597| 22| OPENSSL_PUT_ERROR(SSL, SSL_R_UNSUPPORTED_PROTOCOL); ------------------ | | 361| 22| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 598| 22| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_PROTOCOL_VERSION); ------------------ | | 176| 22|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_PROTOCOL_VERSION); ------------------ | | 4385| 22|#define SSL_AD_PROTOCOL_VERSION TLS1_AD_PROTOCOL_VERSION | | ------------------ | | | | 35| 22|#define TLS1_AD_PROTOCOL_VERSION 70 | | ------------------ ------------------ 599| 22| return ssl_hs_error; 600| 22| } 601| | 602| 55.5k| if (!ssl->s3->initial_handshake_complete) { ------------------ | Branch (602:7): [True: 4.58k, False: 50.9k] ------------------ 603| | // |ssl->s3->version| may be set due to 0-RTT. If it was to a different 604| | // value, the check below will fire. 605| 4.58k| assert(ssl->s3->version == 0 || 606| 4.58k| (hs->is_early_version && 607| 4.58k| ssl->s3->version == hs->early_session->ssl_version)); 608| 4.58k| ssl->s3->version = server_version; 609| 4.58k| hs->is_early_version = false; 610| 50.9k| } else if (server_version != ssl->s3->version) { ------------------ | Branch (610:14): [True: 1, False: 50.9k] ------------------ 611| 1| OPENSSL_PUT_ERROR(SSL, SSL_R_WRONG_SSL_VERSION); ------------------ | | 361| 1| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 612| 1| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_PROTOCOL_VERSION); ------------------ | | 176| 1|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_PROTOCOL_VERSION); ------------------ | | 4385| 1|#define SSL_AD_PROTOCOL_VERSION TLS1_AD_PROTOCOL_VERSION | | ------------------ | | | | 35| 1|#define TLS1_AD_PROTOCOL_VERSION 70 | | ------------------ ------------------ 613| 1| return ssl_hs_error; 614| 1| } 615| | 616| | // If the version did not match, stop sending 0-RTT data. 617| 55.5k| if (hs->early_data_offered && ------------------ | Branch (617:7): [True: 2, False: 55.5k] ------------------ 618| 55.5k| ssl->s3->version != hs->early_session->ssl_version) { ------------------ | Branch (618:7): [True: 1, False: 1] ------------------ 619| | // This is currently only possible by reading a TLS 1.2 (or earlier) 620| | // ServerHello in response to TLS 1.3. If there is ever a TLS 1.4, or 621| | // another variant of TLS 1.3, the fatal error below will need to be a clean 622| | // 0-RTT reject. 623| 1| assert(ssl_protocol_version(ssl) < TLS1_3_VERSION); 624| 1| assert(ssl_session_protocol_version(hs->early_session.get()) >= 625| 1| TLS1_3_VERSION); 626| | 627| | // A TLS 1.2 server would not know to skip the early data we offered, so 628| | // there is no point in continuing the handshake. Report an error code as 629| | // soon as we detect this. The caller may use this error code to implement 630| | // the fallback described in RFC 8446 appendix D.3. 631| | // 632| | // Disconnect early writes. This ensures subsequent |SSL_write| calls query 633| | // the handshake which, in turn, will replay the error code rather than fail 634| | // at the |write_shutdown| check. See https://crbug.com/1078515. 635| | // TODO(davidben): Should all handshake errors do this? What about record 636| | // decryption failures? 637| | // 638| | // TODO(crbug.com/381113363): Although missing from the spec, a DTLS 1.2 639| | // server will already naturally skip 0-RTT data. If we implement DTLS 1.3 640| | // 0-RTT, we may want a clean reject. 641| 1| assert(!SSL_is_dtls(ssl)); 642| 1| hs->can_early_write = false; 643| 1| OPENSSL_PUT_ERROR(SSL, SSL_R_WRONG_VERSION_ON_EARLY_DATA); ------------------ | | 361| 1| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 644| 1| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_PROTOCOL_VERSION); ------------------ | | 176| 1|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_PROTOCOL_VERSION); ------------------ | | 4385| 1|#define SSL_AD_PROTOCOL_VERSION TLS1_AD_PROTOCOL_VERSION | | ------------------ | | | | 35| 1|#define TLS1_AD_PROTOCOL_VERSION 70 | | ------------------ ------------------ 645| 1| return ssl_hs_error; 646| 1| } 647| | 648| 55.5k| if (ssl_protocol_version(ssl) >= TLS1_3_VERSION) { ------------------ | | 545| 55.5k|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (648:7): [True: 444, False: 55.0k] ------------------ 649| 444| if (hs->received_hello_verify_request) { ------------------ | Branch (649:9): [True: 0, False: 444] ------------------ 650| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_MESSAGE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 651| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_PROTOCOL_VERSION); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_PROTOCOL_VERSION); ------------------ | | 4385| 0|#define SSL_AD_PROTOCOL_VERSION TLS1_AD_PROTOCOL_VERSION | | ------------------ | | | | 35| 0|#define TLS1_AD_PROTOCOL_VERSION 70 | | ------------------ ------------------ 652| 0| return ssl_hs_error; 653| 0| } 654| | 655| 444| hs->state = state_tls13; 656| 444| return ssl_hs_ok; 657| 444| } 658| | 659| | // If this client is configured to use a PAKE, then the server must support 660| | // TLS 1.3. 661| 55.0k| if (hs->pake_prover) { ------------------ | Branch (661:7): [True: 0, False: 55.0k] ------------------ 662| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_UNSUPPORTED_PROTOCOL); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 663| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_PROTOCOL_VERSION); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_PROTOCOL_VERSION); ------------------ | | 4385| 0|#define SSL_AD_PROTOCOL_VERSION TLS1_AD_PROTOCOL_VERSION | | ------------------ | | | | 35| 0|#define TLS1_AD_PROTOCOL_VERSION 70 | | ------------------ ------------------ 664| 0| return ssl_hs_error; 665| 0| } 666| | 667| | // Clear some TLS 1.3 state that no longer needs to be retained. 668| 55.0k| hs->key_shares[0].reset(); 669| 55.0k| hs->key_shares[1].reset(); 670| 55.0k| ssl_done_writing_client_hello(hs); 671| | 672| | // TLS 1.2 handshakes cannot accept ECH. 673| 55.0k| if (hs->selected_ech_config) { ------------------ | Branch (673:7): [True: 0, False: 55.0k] ------------------ 674| 0| ssl->s3->ech_status = ssl_ech_rejected; 675| 0| } 676| | 677| | // Copy over the server random. 678| 55.0k| OPENSSL_memcpy(ssl->s3->server_random, CBS_data(&server_hello.random), 679| 55.0k| SSL3_RANDOM_SIZE); ------------------ | | 102| 55.0k|#define SSL3_RANDOM_SIZE 32 ------------------ 680| | 681| | // Enforce the TLS 1.3 anti-downgrade feature. 682| 55.0k| if (!ssl->s3->initial_handshake_complete && ------------------ | Branch (682:7): [True: 4.13k, False: 50.9k] ------------------ 683| 55.0k| hs->max_version >= TLS1_3_VERSION) { ------------------ | | 545| 4.13k|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (683:7): [True: 4.13k, False: 0] ------------------ 684| 4.13k| static_assert( 685| 4.13k| sizeof(kTLS12DowngradeRandom) == sizeof(kTLS13DowngradeRandom), 686| 4.13k| "downgrade signals have different size"); 687| 4.13k| static_assert( 688| 4.13k| sizeof(kJDK11DowngradeRandom) == sizeof(kTLS13DowngradeRandom), 689| 4.13k| "downgrade signals have different size"); 690| 4.13k| auto suffix = 691| 4.13k| Span(ssl->s3->server_random).last(sizeof(kTLS13DowngradeRandom)); 692| 4.13k| if (suffix == kTLS12DowngradeRandom || suffix == kTLS13DowngradeRandom || ------------------ | Branch (692:9): [True: 1, False: 4.13k] | Branch (692:44): [True: 1, False: 4.13k] ------------------ 693| 4.13k| suffix == kJDK11DowngradeRandom) { ------------------ | Branch (693:9): [True: 1, False: 4.13k] ------------------ 694| 3| OPENSSL_PUT_ERROR(SSL, SSL_R_TLS13_DOWNGRADE); ------------------ | | 361| 3| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 695| 3| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 176| 3|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 4379| 3|#define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER | | ------------------ | | | | 189| 3|#define SSL3_AD_ILLEGAL_PARAMETER 47 // fatal | | ------------------ ------------------ 696| 3| return ssl_hs_error; 697| 3| } 698| 4.13k| } 699| | 700| | // The cipher must be allowed in the selected version and enabled. 701| 55.0k| const SSL_CIPHER *cipher = SSL_get_cipher_by_value(server_hello.cipher_suite); 702| 55.0k| uint32_t mask_a, mask_k; 703| 55.0k| ssl_get_client_disabled(hs, &mask_a, &mask_k); 704| 55.0k| if (cipher == nullptr || // ------------------ | Branch (704:7): [True: 49, False: 55.0k] ------------------ 705| 55.0k| (cipher->algorithm_mkey & mask_k) || // ------------------ | Branch (705:7): [True: 18, False: 55.0k] ------------------ 706| 55.0k| (cipher->algorithm_auth & mask_a) || // ------------------ | Branch (706:7): [True: 1, False: 55.0k] ------------------ 707| 55.0k| SSL_CIPHER_get_min_version(cipher) > ssl_protocol_version(ssl) || // ------------------ | Branch (707:7): [True: 3, False: 55.0k] ------------------ 708| 55.0k| SSL_CIPHER_get_max_version(cipher) < ssl_protocol_version(ssl) || // ------------------ | Branch (708:7): [True: 0, False: 55.0k] ------------------ 709| 55.0k| !sk_SSL_CIPHER_find(SSL_get_ciphers(ssl), nullptr, cipher)) { ------------------ | Branch (709:7): [True: 1, False: 55.0k] ------------------ 710| 72| OPENSSL_PUT_ERROR(SSL, SSL_R_WRONG_CIPHER_RETURNED); ------------------ | | 361| 72| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 711| 72| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 176| 72|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 4379| 72|#define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER | | ------------------ | | | | 189| 72|#define SSL3_AD_ILLEGAL_PARAMETER 47 // fatal | | ------------------ ------------------ 712| 72| return ssl_hs_error; 713| 72| } 714| | 715| 55.0k| hs->new_cipher = cipher; 716| | 717| 55.0k| if (!hs->session_id.empty() && ------------------ | Branch (717:7): [True: 55.0k, False: 0] ------------------ 718| 55.0k| Span(server_hello.session_id) == hs->session_id) { ------------------ | Branch (718:7): [True: 235, False: 54.7k] ------------------ 719| | // Echoing the ClientHello session ID in TLS 1.2, whether from the session 720| | // or a synthetic one, indicates resumption. If there was no session (or if 721| | // the session was only offered in ECH ClientHelloInner), this was the 722| | // TLS 1.3 compatibility mode session ID. As we know this is not a session 723| | // the server knows about, any server resuming it is in error. Reject the 724| | // first connection deterministicly, rather than installing an invalid 725| | // session into the session cache. https://crbug.com/796910 726| 235| if (ssl->session == nullptr || ssl->s3->ech_status == ssl_ech_rejected) { ------------------ | Branch (726:9): [True: 0, False: 235] | Branch (726:36): [True: 0, False: 235] ------------------ 727| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_SERVER_ECHOED_INVALID_SESSION_ID); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 728| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 4379| 0|#define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER | | ------------------ | | | | 189| 0|#define SSL3_AD_ILLEGAL_PARAMETER 47 // fatal | | ------------------ ------------------ 729| 0| return ssl_hs_error; 730| 0| } 731| 235| if (ssl->session->ssl_version != ssl->s3->version) { ------------------ | Branch (731:9): [True: 3, False: 232] ------------------ 732| 3| OPENSSL_PUT_ERROR(SSL, SSL_R_OLD_SESSION_VERSION_NOT_RETURNED); ------------------ | | 361| 3| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 733| 3| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 176| 3|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 4379| 3|#define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER | | ------------------ | | | | 189| 3|#define SSL3_AD_ILLEGAL_PARAMETER 47 // fatal | | ------------------ ------------------ 734| 3| return ssl_hs_error; 735| 3| } 736| 232| if (ssl->session->cipher != hs->new_cipher) { ------------------ | Branch (736:9): [True: 1, False: 231] ------------------ 737| 1| OPENSSL_PUT_ERROR(SSL, SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED); ------------------ | | 361| 1| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 738| 1| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 176| 1|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 4379| 1|#define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER | | ------------------ | | | | 189| 1|#define SSL3_AD_ILLEGAL_PARAMETER 47 // fatal | | ------------------ ------------------ 739| 1| return ssl_hs_error; 740| 1| } 741| 231| if (!ssl_session_is_context_valid(hs, ssl->session.get())) { ------------------ | Branch (741:9): [True: 0, False: 231] ------------------ 742| | // This is actually a client application bug. 743| 0| OPENSSL_PUT_ERROR(SSL, ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 744| 0| SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT); 745| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 4379| 0|#define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER | | ------------------ | | | | 189| 0|#define SSL3_AD_ILLEGAL_PARAMETER 47 // fatal | | ------------------ ------------------ 746| 0| return ssl_hs_error; 747| 0| } 748| | // We never offer sessions on renegotiation. 749| 231| assert(!ssl->s3->initial_handshake_complete); 750| 231| ssl->s3->session_reused = true; 751| 54.7k| } else { 752| | // The session wasn't resumed. Create a fresh SSL_SESSION to fill out. 753| 54.7k| ssl_set_session(ssl, NULL); 754| 54.7k| if (!ssl_get_new_session(hs)) { ------------------ | Branch (754:9): [True: 0, False: 54.7k] ------------------ 755| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); ------------------ | | 4387| 0|#define SSL_AD_INTERNAL_ERROR TLS1_AD_INTERNAL_ERROR | | ------------------ | | | | 37| 0|#define TLS1_AD_INTERNAL_ERROR 80 | | ------------------ ------------------ 756| 0| return ssl_hs_error; 757| 0| } 758| | 759| | // Save the session ID from the server. This may be empty if the session 760| | // isn't resumable, or if we'll receive a session ticket later. The 761| | // ServerHello parser ensures |server_hello.session_id| is within bounds. 762| 54.7k| hs->new_session->session_id.CopyFrom(server_hello.session_id); 763| 54.7k| hs->new_session->cipher = hs->new_cipher; 764| 54.7k| } 765| | 766| | // Now that the cipher is known, initialize the handshake hash and hash the 767| | // ServerHello. 768| 55.0k| if (!hs->transcript.InitHash(ssl_protocol_version(ssl), hs->new_cipher) || ------------------ | Branch (768:7): [True: 0, False: 55.0k] ------------------ 769| 55.0k| !ssl_hash_message(hs, msg)) { ------------------ | Branch (769:7): [True: 0, False: 55.0k] ------------------ 770| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); ------------------ | | 4387| 0|#define SSL_AD_INTERNAL_ERROR TLS1_AD_INTERNAL_ERROR | | ------------------ | | | | 37| 0|#define TLS1_AD_INTERNAL_ERROR 80 | | ------------------ ------------------ 771| 0| return ssl_hs_error; 772| 0| } 773| | 774| | // If doing a full handshake, the server may request a client certificate 775| | // which requires hashing the handshake transcript. Otherwise, the handshake 776| | // buffer may be released. 777| 55.0k| if (ssl->session != NULL || ------------------ | Branch (777:7): [True: 231, False: 54.7k] ------------------ 778| 55.0k| !ssl_cipher_uses_certificate_auth(hs->new_cipher)) { ------------------ | Branch (778:7): [True: 0, False: 54.7k] ------------------ 779| 231| hs->transcript.FreeBuffer(); 780| 231| } 781| | 782| | // Only the NULL compression algorithm is supported. 783| 55.0k| if (server_hello.compression_method != 0) { ------------------ | Branch (783:7): [True: 33, False: 54.9k] ------------------ 784| 33| OPENSSL_PUT_ERROR(SSL, SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM); ------------------ | | 361| 33| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 785| 33| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 176| 33|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 4379| 33|#define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER | | ------------------ | | | | 189| 33|#define SSL3_AD_ILLEGAL_PARAMETER 47 // fatal | | ------------------ ------------------ 786| 33| return ssl_hs_error; 787| 33| } 788| | 789| 54.9k| if (!ssl_parse_serverhello_tlsext(hs, &server_hello.extensions)) { ------------------ | Branch (789:7): [True: 164, False: 54.8k] ------------------ 790| 164| OPENSSL_PUT_ERROR(SSL, SSL_R_PARSE_TLSEXT); ------------------ | | 361| 164| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 791| 164| return ssl_hs_error; 792| 164| } 793| | 794| 54.8k| if (ssl->session != NULL && ------------------ | Branch (794:7): [True: 231, False: 54.5k] ------------------ 795| 54.8k| hs->extended_master_secret != ssl->session->extended_master_secret) { ------------------ | Branch (795:7): [True: 1, False: 230] ------------------ 796| 1| if (ssl->session->extended_master_secret) { ------------------ | Branch (796:9): [True: 1, False: 0] ------------------ 797| 1| OPENSSL_PUT_ERROR(SSL, SSL_R_RESUMED_EMS_SESSION_WITHOUT_EMS_EXTENSION); ------------------ | | 361| 1| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 798| 1| } else { 799| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_RESUMED_NON_EMS_SESSION_WITH_EMS_EXTENSION); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 800| 0| } 801| 1| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE); ------------------ | | 176| 1|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE); ------------------ | | 4372| 1|#define SSL_AD_HANDSHAKE_FAILURE SSL3_AD_HANDSHAKE_FAILURE | | ------------------ | | | | 182| 1|#define SSL3_AD_HANDSHAKE_FAILURE 40 // fatal | | ------------------ ------------------ 802| 1| return ssl_hs_error; 803| 1| } 804| | 805| 54.8k| ssl->method->next_message(ssl); 806| | 807| 54.8k| if (ssl->session != NULL) { ------------------ | Branch (807:7): [True: 230, False: 54.5k] ------------------ 808| 230| if (ssl->ctx->reverify_on_resume && ------------------ | Branch (808:9): [True: 0, False: 230] ------------------ 809| 230| ssl_cipher_uses_certificate_auth(hs->new_cipher)) { ------------------ | Branch (809:9): [True: 0, False: 0] ------------------ 810| 0| hs->state = state_reverify_server_certificate; 811| 230| } else { 812| 230| hs->state = state_read_session_ticket; 813| 230| } 814| 230| return ssl_hs_ok; 815| 230| } 816| | 817| 54.5k| hs->state = state_read_server_certificate; 818| 54.5k| return ssl_hs_ok; 819| 54.8k|} handshake_client.cc:_ZN4bsslL20parse_server_versionEPKNS_13SSL_HANDSHAKEEPtPhRKNS_17ParsedServerHelloE: 253| 55.5k| const ParsedServerHello &server_hello) { 254| 55.5k| uint16_t legacy_version = TLS1_2_VERSION; ------------------ | | 544| 55.5k|#define TLS1_2_VERSION 0x0303 ------------------ 255| 55.5k| if (SSL_is_dtls(hs->ssl)) { ------------------ | Branch (255:7): [True: 0, False: 55.5k] ------------------ 256| 0| legacy_version = DTLS1_2_VERSION; ------------------ | | 548| 0|#define DTLS1_2_VERSION 0xfefd ------------------ 257| 0| } 258| | // If the outer version is not TLS 1.2, use it. 259| | // TODO(davidben): This function doesn't quite match the RFC8446 formulation. 260| 55.5k| if (server_hello.legacy_version != legacy_version) { ------------------ | Branch (260:7): [True: 1.20k, False: 54.3k] ------------------ 261| 1.20k| *out_version = server_hello.legacy_version; 262| 1.20k| return true; 263| 1.20k| } 264| | 265| 54.3k| SSLExtension supported_versions(TLSEXT_TYPE_supported_versions); ------------------ | | 99| 54.3k|#define TLSEXT_TYPE_supported_versions 43 ------------------ 266| 54.3k| CBS extensions = server_hello.extensions; 267| 54.3k| if (!ssl_parse_extensions(&extensions, out_alert, {&supported_versions}, ------------------ | Branch (267:7): [True: 22, False: 54.3k] ------------------ 268| 54.3k| /*ignore_unknown=*/true)) { 269| 22| return false; 270| 22| } 271| | 272| 54.3k| if (!supported_versions.present) { ------------------ | Branch (272:7): [True: 53.9k, False: 442] ------------------ 273| 53.9k| *out_version = server_hello.legacy_version; 274| 53.9k| return true; 275| 53.9k| } 276| | 277| 442| if (!CBS_get_u16(&supported_versions.data, out_version) || // ------------------ | Branch (277:7): [True: 1, False: 441] ------------------ 278| 442| CBS_len(&supported_versions.data) != 0) { ------------------ | Branch (278:7): [True: 2, False: 439] ------------------ 279| 3| *out_alert = SSL_AD_DECODE_ERROR; ------------------ | | 4382| 3|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 3|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 280| 3| return false; 281| 3| } 282| | 283| 439| return true; 284| 442|} handshake_client.cc:_ZN4bsslL8do_tls13EPNS_13SSL_HANDSHAKEE: 821| 2.81k|static enum ssl_hs_wait_t do_tls13(SSL_HANDSHAKE *hs) { 822| 2.81k| enum ssl_hs_wait_t wait = tls13_client_handshake(hs); 823| 2.81k| if (wait == ssl_hs_ok) { ------------------ | Branch (823:7): [True: 114, False: 2.69k] ------------------ 824| 114| hs->state = state_finish_client_handshake; 825| 114| return ssl_hs_ok; 826| 114| } 827| | 828| 2.69k| return wait; 829| 2.81k|} handshake_client.cc:_ZN4bsslL26do_read_server_certificateEPNS_13SSL_HANDSHAKEE: 831| 121k|static enum ssl_hs_wait_t do_read_server_certificate(SSL_HANDSHAKE *hs) { 832| 121k| SSL *const ssl = hs->ssl; 833| | 834| 121k| if (!ssl_cipher_uses_certificate_auth(hs->new_cipher)) { ------------------ | Branch (834:7): [True: 0, False: 121k] ------------------ 835| 0| hs->state = state_read_certificate_status; 836| 0| return ssl_hs_ok; 837| 0| } 838| | 839| 121k| SSLMessage msg; 840| 121k| if (!ssl->method->get_message(ssl, &msg)) { ------------------ | Branch (840:7): [True: 67.4k, False: 54.3k] ------------------ 841| 67.4k| return ssl_hs_read_message; 842| 67.4k| } 843| | 844| 54.3k| if (!ssl_check_message_type(ssl, msg, SSL3_MT_CERTIFICATE) || ------------------ | | 200| 54.3k|#define SSL3_MT_CERTIFICATE 11 ------------------ | Branch (844:7): [True: 15, False: 54.3k] ------------------ 845| 54.3k| !ssl_hash_message(hs, msg)) { ------------------ | Branch (845:7): [True: 0, False: 54.3k] ------------------ 846| 15| return ssl_hs_error; 847| 15| } 848| | 849| 54.3k| CBS body = msg.body; 850| 54.3k| uint8_t alert = SSL_AD_DECODE_ERROR; ------------------ | | 4382| 54.3k|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 54.3k|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 851| 54.3k| if (!ssl_parse_cert_chain(&alert, &hs->new_session->certs, &hs->peer_pubkey, ------------------ | Branch (851:7): [True: 435, False: 53.9k] ------------------ 852| 54.3k| NULL, &body, ssl->ctx->pool)) { 853| 435| ssl_send_alert(ssl, SSL3_AL_FATAL, alert); ------------------ | | 176| 435|#define SSL3_AL_FATAL 2 ------------------ 854| 435| return ssl_hs_error; 855| 435| } 856| | 857| 53.9k| if (sk_CRYPTO_BUFFER_num(hs->new_session->certs.get()) == 0 || ------------------ | Branch (857:7): [True: 4, False: 53.9k] ------------------ 858| 53.9k| CBS_len(&body) != 0 || ------------------ | Branch (858:7): [True: 3, False: 53.9k] ------------------ 859| 53.9k| !ssl->ctx->x509_method->session_cache_objects(hs->new_session.get())) { ------------------ | Branch (859:7): [True: 399, False: 53.5k] ------------------ 860| 406| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); ------------------ | | 361| 406| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 861| 406| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 176| 406|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 4382| 406|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 406|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 862| 406| return ssl_hs_error; 863| 406| } 864| | 865| 53.5k| if (!ssl_check_leaf_certificate( ------------------ | Branch (865:7): [True: 6, False: 53.4k] ------------------ 866| 53.5k| hs, hs->peer_pubkey.get(), 867| 53.5k| sk_CRYPTO_BUFFER_value(hs->new_session->certs.get(), 0))) { 868| 6| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 176| 6|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 4379| 6|#define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER | | ------------------ | | | | 189| 6|#define SSL3_AD_ILLEGAL_PARAMETER 47 // fatal | | ------------------ ------------------ 869| 6| return ssl_hs_error; 870| 6| } 871| | 872| 53.4k| ssl->method->next_message(ssl); 873| | 874| 53.4k| hs->state = state_read_certificate_status; 875| 53.4k| return ssl_hs_ok; 876| 53.5k|} handshake_client.cc:_ZN4bsslL26do_read_certificate_statusEPNS_13SSL_HANDSHAKEE: 878| 67.6k|static enum ssl_hs_wait_t do_read_certificate_status(SSL_HANDSHAKE *hs) { 879| 67.6k| SSL *const ssl = hs->ssl; 880| | 881| 67.6k| if (!hs->certificate_status_expected) { ------------------ | Branch (881:7): [True: 39.4k, False: 28.2k] ------------------ 882| 39.4k| hs->state = state_verify_server_certificate; 883| 39.4k| return ssl_hs_ok; 884| 39.4k| } 885| | 886| 28.2k| SSLMessage msg; 887| 28.2k| if (!ssl->method->get_message(ssl, &msg)) { ------------------ | Branch (887:7): [True: 14.2k, False: 14.0k] ------------------ 888| 14.2k| return ssl_hs_read_message; 889| 14.2k| } 890| | 891| 14.0k| if (msg.type != SSL3_MT_CERTIFICATE_STATUS) { ------------------ | | 207| 14.0k|#define SSL3_MT_CERTIFICATE_STATUS 22 ------------------ | Branch (891:7): [True: 13.0k, False: 983] ------------------ 892| | // A server may send status_request in ServerHello and then change its mind 893| | // about sending CertificateStatus. 894| 13.0k| hs->state = state_verify_server_certificate; 895| 13.0k| return ssl_hs_ok; 896| 13.0k| } 897| | 898| 983| if (!ssl_hash_message(hs, msg)) { ------------------ | Branch (898:7): [True: 0, False: 983] ------------------ 899| 0| return ssl_hs_error; 900| 0| } 901| | 902| 983| CBS certificate_status = msg.body, ocsp_response; 903| 983| uint8_t status_type; 904| 983| if (!CBS_get_u8(&certificate_status, &status_type) || // ------------------ | Branch (904:7): [True: 2, False: 981] ------------------ 905| 983| status_type != TLSEXT_STATUSTYPE_ocsp || // ------------------ | | 145| 1.96k|#define TLSEXT_STATUSTYPE_ocsp 1 ------------------ | Branch (905:7): [True: 1, False: 980] ------------------ 906| 983| !CBS_get_u24_length_prefixed(&certificate_status, &ocsp_response) || // ------------------ | Branch (906:7): [True: 1, False: 979] ------------------ 907| 983| CBS_len(&ocsp_response) == 0 || // ------------------ | Branch (907:7): [True: 1, False: 978] ------------------ 908| 983| CBS_len(&certificate_status) != 0) { ------------------ | Branch (908:7): [True: 1, False: 977] ------------------ 909| 6| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); ------------------ | | 361| 6| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 910| 6| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 176| 6|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 4382| 6|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 6|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 911| 6| return ssl_hs_error; 912| 6| } 913| | 914| 977| hs->new_session->ocsp_response.reset( 915| 977| CRYPTO_BUFFER_new_from_CBS(&ocsp_response, ssl->ctx->pool)); 916| 977| if (hs->new_session->ocsp_response == nullptr) { ------------------ | Branch (916:7): [True: 0, False: 977] ------------------ 917| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); ------------------ | | 4387| 0|#define SSL_AD_INTERNAL_ERROR TLS1_AD_INTERNAL_ERROR | | ------------------ | | | | 37| 0|#define TLS1_AD_INTERNAL_ERROR 80 | | ------------------ ------------------ 918| 0| return ssl_hs_error; 919| 0| } 920| | 921| 977| ssl->method->next_message(ssl); 922| | 923| 977| hs->state = state_verify_server_certificate; 924| 977| return ssl_hs_ok; 925| 977|} handshake_client.cc:_ZN4bsslL28do_verify_server_certificateEPNS_13SSL_HANDSHAKEE: 927| 53.4k|static enum ssl_hs_wait_t do_verify_server_certificate(SSL_HANDSHAKE *hs) { 928| 53.4k| if (!ssl_cipher_uses_certificate_auth(hs->new_cipher)) { ------------------ | Branch (928:7): [True: 0, False: 53.4k] ------------------ 929| 0| hs->state = state_read_server_key_exchange; 930| 0| return ssl_hs_ok; 931| 0| } 932| | 933| 53.4k| switch (ssl_verify_peer_cert(hs)) { ------------------ | Branch (933:11): [True: 0, False: 53.4k] ------------------ 934| 53.3k| case ssl_verify_ok: ------------------ | Branch (934:5): [True: 53.3k, False: 100] ------------------ 935| 53.3k| break; 936| 100| case ssl_verify_invalid: ------------------ | Branch (936:5): [True: 100, False: 53.3k] ------------------ 937| 100| return ssl_hs_error; 938| 0| case ssl_verify_retry: ------------------ | Branch (938:5): [True: 0, False: 53.4k] ------------------ 939| 0| hs->state = state_verify_server_certificate; 940| 0| return ssl_hs_certificate_verify; 941| 53.4k| } 942| | 943| 53.3k| hs->state = state_read_server_key_exchange; 944| 53.3k| return ssl_hs_ok; 945| 53.4k|} handshake_client.cc:_ZN4bsslL27do_read_server_key_exchangeEPNS_13SSL_HANDSHAKEE: 964| 94.1k|static enum ssl_hs_wait_t do_read_server_key_exchange(SSL_HANDSHAKE *hs) { 965| 94.1k| SSL *const ssl = hs->ssl; 966| 94.1k| SSLMessage msg; 967| 94.1k| if (!ssl->method->get_message(ssl, &msg)) { ------------------ | Branch (967:7): [True: 40.8k, False: 53.2k] ------------------ 968| 40.8k| return ssl_hs_read_message; 969| 40.8k| } 970| | 971| 53.2k| if (msg.type != SSL3_MT_SERVER_KEY_EXCHANGE) { ------------------ | | 201| 53.2k|#define SSL3_MT_SERVER_KEY_EXCHANGE 12 ------------------ | Branch (971:7): [True: 1.75k, False: 51.5k] ------------------ 972| | // Some ciphers (pure PSK) have an optional ServerKeyExchange message. 973| 1.75k| if (ssl_cipher_requires_server_key_exchange(hs->new_cipher)) { ------------------ | Branch (973:9): [True: 9, False: 1.74k] ------------------ 974| 9| OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_MESSAGE); ------------------ | | 361| 9| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 975| 9| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE); ------------------ | | 176| 9|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE); ------------------ | | 4367| 9|#define SSL_AD_UNEXPECTED_MESSAGE SSL3_AD_UNEXPECTED_MESSAGE | | ------------------ | | | | 179| 9|#define SSL3_AD_UNEXPECTED_MESSAGE 10 // fatal | | ------------------ ------------------ 976| 9| return ssl_hs_error; 977| 9| } 978| | 979| 1.74k| hs->state = state_read_certificate_request; 980| 1.74k| return ssl_hs_ok; 981| 1.75k| } 982| | 983| 51.5k| if (!ssl_hash_message(hs, msg)) { ------------------ | Branch (983:7): [True: 0, False: 51.5k] ------------------ 984| 0| return ssl_hs_error; 985| 0| } 986| | 987| 51.5k| uint32_t alg_k = hs->new_cipher->algorithm_mkey; 988| 51.5k| uint32_t alg_a = hs->new_cipher->algorithm_auth; 989| 51.5k| CBS server_key_exchange = msg.body; 990| 51.5k| if (alg_a & SSL_aPSK) { ------------------ | | 270| 51.5k|#define SSL_aPSK 0x00000008u ------------------ | Branch (990:7): [True: 0, False: 51.5k] ------------------ 991| 0| CBS psk_identity_hint; 992| | 993| | // Each of the PSK key exchanges begins with a psk_identity_hint. 994| 0| if (!CBS_get_u16_length_prefixed(&server_key_exchange, ------------------ | Branch (994:9): [True: 0, False: 0] ------------------ 995| 0| &psk_identity_hint)) { 996| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 997| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 4382| 0|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 0|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 998| 0| return ssl_hs_error; 999| 0| } 1000| | 1001| | // Store the PSK identity hint for the ClientKeyExchange. Assume that the 1002| | // maximum length of a PSK identity hint can be as long as the maximum 1003| | // length of a PSK identity. Also do not allow NULL characters; identities 1004| | // are saved as C strings. 1005| | // 1006| | // TODO(davidben): Should invalid hints be ignored? It's a hint rather than 1007| | // a specific identity. 1008| 0| if (CBS_len(&psk_identity_hint) > PSK_MAX_IDENTITY_LEN || ------------------ | | 3573| 0|#define PSK_MAX_IDENTITY_LEN 128 ------------------ | Branch (1008:9): [True: 0, False: 0] ------------------ 1009| 0| CBS_contains_zero_byte(&psk_identity_hint)) { ------------------ | Branch (1009:9): [True: 0, False: 0] ------------------ 1010| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_DATA_LENGTH_TOO_LONG); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1011| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE); ------------------ | | 4372| 0|#define SSL_AD_HANDSHAKE_FAILURE SSL3_AD_HANDSHAKE_FAILURE | | ------------------ | | | | 182| 0|#define SSL3_AD_HANDSHAKE_FAILURE 40 // fatal | | ------------------ ------------------ 1012| 0| return ssl_hs_error; 1013| 0| } 1014| | 1015| | // Save non-empty identity hints as a C string. Empty identity hints we 1016| | // treat as missing. Plain PSK makes it possible to send either no hint 1017| | // (omit ServerKeyExchange) or an empty hint, while ECDHE_PSK can only spell 1018| | // empty hint. Having different capabilities is odd, so we interpret empty 1019| | // and missing as identical. 1020| 0| char *raw = nullptr; 1021| 0| if (CBS_len(&psk_identity_hint) != 0 && ------------------ | Branch (1021:9): [True: 0, False: 0] ------------------ 1022| 0| !CBS_strdup(&psk_identity_hint, &raw)) { ------------------ | Branch (1022:9): [True: 0, False: 0] ------------------ 1023| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); ------------------ | | 4387| 0|#define SSL_AD_INTERNAL_ERROR TLS1_AD_INTERNAL_ERROR | | ------------------ | | | | 37| 0|#define TLS1_AD_INTERNAL_ERROR 80 | | ------------------ ------------------ 1024| 0| return ssl_hs_error; 1025| 0| } 1026| 0| hs->peer_psk_identity_hint.reset(raw); 1027| 0| } 1028| | 1029| 51.5k| if (alg_k & SSL_kECDHE) { ------------------ | | 260| 51.5k|#define SSL_kECDHE 0x00000002u ------------------ | Branch (1029:7): [True: 51.5k, False: 1] ------------------ 1030| | // Parse the server parameters. 1031| 51.5k| uint8_t group_type; 1032| 51.5k| uint16_t group_id; 1033| 51.5k| CBS point; 1034| 51.5k| if (!CBS_get_u8(&server_key_exchange, &group_type) || ------------------ | Branch (1034:9): [True: 2, False: 51.5k] ------------------ 1035| 51.5k| group_type != NAMED_CURVE_TYPE || ------------------ | | 2383| 103k|#define NAMED_CURVE_TYPE 3 ------------------ | Branch (1035:9): [True: 2, False: 51.5k] ------------------ 1036| 51.5k| !CBS_get_u16(&server_key_exchange, &group_id) || ------------------ | Branch (1036:9): [True: 1, False: 51.5k] ------------------ 1037| 51.5k| !CBS_get_u8_length_prefixed(&server_key_exchange, &point)) { ------------------ | Branch (1037:9): [True: 1, False: 51.5k] ------------------ 1038| 6| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); ------------------ | | 361| 6| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1039| 6| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 176| 6|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 4382| 6|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 6|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 1040| 6| return ssl_hs_error; 1041| 6| } 1042| | 1043| | // Ensure the group is consistent with preferences. 1044| 51.5k| if (!tls1_check_group_id(hs, group_id)) { ------------------ | Branch (1044:9): [True: 26, False: 51.4k] ------------------ 1045| 26| OPENSSL_PUT_ERROR(SSL, SSL_R_WRONG_CURVE); ------------------ | | 361| 26| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1046| 26| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 176| 26|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 4379| 26|#define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER | | ------------------ | | | | 189| 26|#define SSL3_AD_ILLEGAL_PARAMETER 47 // fatal | | ------------------ ------------------ 1047| 26| return ssl_hs_error; 1048| 26| } 1049| | 1050| | // Save the group and peer public key for later. 1051| 51.4k| hs->new_session->group_id = group_id; 1052| 51.4k| if (!hs->peer_key.CopyFrom(point)) { ------------------ | Branch (1052:9): [True: 0, False: 51.4k] ------------------ 1053| 0| return ssl_hs_error; 1054| 0| } 1055| 51.4k| } else if (!(alg_k & SSL_kPSK)) { ------------------ | | 262| 1|#define SSL_kPSK 0x00000004u ------------------ | Branch (1055:14): [True: 1, False: 0] ------------------ 1056| 1| OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_MESSAGE); ------------------ | | 361| 1| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1057| 1| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE); ------------------ | | 176| 1|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE); ------------------ | | 4367| 1|#define SSL_AD_UNEXPECTED_MESSAGE SSL3_AD_UNEXPECTED_MESSAGE | | ------------------ | | | | 179| 1|#define SSL3_AD_UNEXPECTED_MESSAGE 10 // fatal | | ------------------ ------------------ 1058| 1| return ssl_hs_error; 1059| 1| } 1060| | 1061| | // At this point, |server_key_exchange| contains the signature, if any, while 1062| | // |msg.body| contains the entire message. From that, derive a CBS containing 1063| | // just the parameter. 1064| 51.4k| CBS parameter; 1065| 51.4k| CBS_init(¶meter, CBS_data(&msg.body), 1066| 51.4k| CBS_len(&msg.body) - CBS_len(&server_key_exchange)); 1067| | 1068| | // ServerKeyExchange should be signed by the server's public key. 1069| 51.4k| if (ssl_cipher_uses_certificate_auth(hs->new_cipher)) { ------------------ | Branch (1069:7): [True: 51.4k, False: 0] ------------------ 1070| 51.4k| uint16_t signature_algorithm = 0; 1071| 51.4k| if (ssl_protocol_version(ssl) >= TLS1_2_VERSION) { ------------------ | | 544| 51.4k|#define TLS1_2_VERSION 0x0303 ------------------ | Branch (1071:9): [True: 50.5k, False: 983] ------------------ 1072| 50.5k| if (!CBS_get_u16(&server_key_exchange, &signature_algorithm)) { ------------------ | Branch (1072:11): [True: 1, False: 50.5k] ------------------ 1073| 1| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); ------------------ | | 361| 1| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1074| 1| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 176| 1|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 4382| 1|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 1|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 1075| 1| return ssl_hs_error; 1076| 1| } 1077| 50.5k| uint8_t alert = SSL_AD_DECODE_ERROR; ------------------ | | 4382| 50.5k|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 50.5k|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 1078| 50.5k| if (!tls12_check_peer_sigalg(hs, &alert, signature_algorithm, ------------------ | Branch (1078:11): [True: 27, False: 50.4k] ------------------ 1079| 50.5k| hs->peer_pubkey.get())) { 1080| 27| ssl_send_alert(ssl, SSL3_AL_FATAL, alert); ------------------ | | 176| 27|#define SSL3_AL_FATAL 2 ------------------ 1081| 27| return ssl_hs_error; 1082| 27| } 1083| 50.4k| hs->new_session->peer_signature_algorithm = signature_algorithm; 1084| 50.4k| } else if (!tls1_get_legacy_signature_algorithm(&signature_algorithm, ------------------ | Branch (1084:16): [True: 2, False: 981] ------------------ 1085| 983| hs->peer_pubkey.get())) { 1086| 2| OPENSSL_PUT_ERROR(SSL, SSL_R_PEER_ERROR_UNSUPPORTED_CERTIFICATE_TYPE); ------------------ | | 361| 2| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1087| 2| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_UNSUPPORTED_CERTIFICATE); ------------------ | | 176| 2|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_UNSUPPORTED_CERTIFICATE); ------------------ | | 4375| 2|#define SSL_AD_UNSUPPORTED_CERTIFICATE SSL3_AD_UNSUPPORTED_CERTIFICATE | | ------------------ | | | | 185| 2|#define SSL3_AD_UNSUPPORTED_CERTIFICATE 43 | | ------------------ ------------------ 1088| 2| return ssl_hs_error; 1089| 2| } 1090| | 1091| | // The last field in |server_key_exchange| is the signature. 1092| 51.4k| CBS signature; 1093| 51.4k| if (!CBS_get_u16_length_prefixed(&server_key_exchange, &signature) || ------------------ | Branch (1093:9): [True: 4, False: 51.4k] ------------------ 1094| 51.4k| CBS_len(&server_key_exchange) != 0) { ------------------ | Branch (1094:9): [True: 7, False: 51.4k] ------------------ 1095| 11| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); ------------------ | | 361| 11| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1096| 11| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 176| 11|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 4382| 11|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 11|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 1097| 11| return ssl_hs_error; 1098| 11| } 1099| | 1100| 51.4k| ScopedCBB transcript; 1101| 51.4k| Array transcript_data; 1102| 51.4k| if (!CBB_init(transcript.get(), ------------------ | Branch (1102:9): [True: 0, False: 51.4k] ------------------ 1103| 51.4k| 2 * SSL3_RANDOM_SIZE + CBS_len(¶meter)) || ------------------ | | 102| 51.4k|#define SSL3_RANDOM_SIZE 32 ------------------ 1104| 51.4k| !CBB_add_bytes(transcript.get(), ssl->s3->client_random, ------------------ | Branch (1104:9): [True: 0, False: 51.4k] ------------------ 1105| 51.4k| SSL3_RANDOM_SIZE) || ------------------ | | 102| 51.4k|#define SSL3_RANDOM_SIZE 32 ------------------ 1106| 51.4k| !CBB_add_bytes(transcript.get(), ssl->s3->server_random, ------------------ | Branch (1106:9): [True: 0, False: 51.4k] ------------------ 1107| 51.4k| SSL3_RANDOM_SIZE) || ------------------ | | 102| 51.4k|#define SSL3_RANDOM_SIZE 32 ------------------ 1108| 51.4k| !CBB_add_bytes(transcript.get(), CBS_data(¶meter), ------------------ | Branch (1108:9): [True: 0, False: 51.4k] ------------------ 1109| 51.4k| CBS_len(¶meter)) || 1110| 51.4k| !CBBFinishArray(transcript.get(), &transcript_data)) { ------------------ | Branch (1110:9): [True: 0, False: 51.4k] ------------------ 1111| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1112| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); ------------------ | | 4387| 0|#define SSL_AD_INTERNAL_ERROR TLS1_AD_INTERNAL_ERROR | | ------------------ | | | | 37| 0|#define TLS1_AD_INTERNAL_ERROR 80 | | ------------------ ------------------ 1113| 0| return ssl_hs_error; 1114| 0| } 1115| | 1116| 51.4k| if (!ssl_public_key_verify(ssl, signature, signature_algorithm, ------------------ | Branch (1116:9): [True: 0, False: 51.4k] ------------------ 1117| 51.4k| hs->peer_pubkey.get(), transcript_data)) { 1118| | // bad signature 1119| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_SIGNATURE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1120| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECRYPT_ERROR); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECRYPT_ERROR); ------------------ | | 4383| 0|#define SSL_AD_DECRYPT_ERROR TLS1_AD_DECRYPT_ERROR | | ------------------ | | | | 33| 0|#define TLS1_AD_DECRYPT_ERROR 51 | | ------------------ ------------------ 1121| 0| return ssl_hs_error; 1122| 0| } 1123| 51.4k| } else { 1124| | // PSK ciphers are the only supported certificate-less ciphers. 1125| 0| assert(alg_a == SSL_aPSK); 1126| | 1127| 0| if (CBS_len(&server_key_exchange) > 0) { ------------------ | Branch (1127:9): [True: 0, False: 0] ------------------ 1128| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_EXTRA_DATA_IN_MESSAGE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1129| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 4382| 0|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 0|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 1130| 0| return ssl_hs_error; 1131| 0| } 1132| 0| } 1133| | 1134| 51.4k| ssl->method->next_message(ssl); 1135| 51.4k| hs->state = state_read_certificate_request; 1136| 51.4k| return ssl_hs_ok; 1137| 51.4k|} handshake_client.cc:_ZN4bsslL27do_read_certificate_requestEPNS_13SSL_HANDSHAKEE: 1139| 103k|static enum ssl_hs_wait_t do_read_certificate_request(SSL_HANDSHAKE *hs) { 1140| 103k| SSL *const ssl = hs->ssl; 1141| | 1142| 103k| if (!ssl_cipher_uses_certificate_auth(hs->new_cipher)) { ------------------ | Branch (1142:7): [True: 0, False: 103k] ------------------ 1143| 0| hs->state = state_read_server_hello_done; 1144| 0| return ssl_hs_ok; 1145| 0| } 1146| | 1147| 103k| SSLMessage msg; 1148| 103k| if (!ssl->method->get_message(ssl, &msg)) { ------------------ | Branch (1148:7): [True: 51.6k, False: 52.3k] ------------------ 1149| 51.6k| return ssl_hs_read_message; 1150| 51.6k| } 1151| | 1152| 52.3k| if (msg.type == SSL3_MT_SERVER_HELLO_DONE) { ------------------ | | 203| 52.3k|#define SSL3_MT_SERVER_HELLO_DONE 14 ------------------ | Branch (1152:7): [True: 24.1k, False: 28.1k] ------------------ 1153| | // If we get here we don't need the handshake buffer as we won't be doing 1154| | // client auth. 1155| 24.1k| hs->transcript.FreeBuffer(); 1156| 24.1k| hs->state = state_read_server_hello_done; 1157| 24.1k| return ssl_hs_ok; 1158| 24.1k| } 1159| | 1160| 28.1k| if (!ssl_check_message_type(ssl, msg, SSL3_MT_CERTIFICATE_REQUEST) || ------------------ | | 202| 28.1k|#define SSL3_MT_CERTIFICATE_REQUEST 13 ------------------ | Branch (1160:7): [True: 2, False: 28.1k] ------------------ 1161| 28.1k| !ssl_hash_message(hs, msg)) { ------------------ | Branch (1161:7): [True: 0, False: 28.1k] ------------------ 1162| 2| return ssl_hs_error; 1163| 2| } 1164| | 1165| | // Get the certificate types. 1166| 28.1k| CBS body = msg.body, certificate_types; 1167| 28.1k| if (!CBS_get_u8_length_prefixed(&body, &certificate_types)) { ------------------ | Branch (1167:7): [True: 2, False: 28.1k] ------------------ 1168| 2| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 176| 2|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 4382| 2|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 2|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 1169| 2| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); ------------------ | | 361| 2| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1170| 2| return ssl_hs_error; 1171| 2| } 1172| | 1173| 28.1k| if (!hs->certificate_types.CopyFrom(certificate_types)) { ------------------ | Branch (1173:7): [True: 0, False: 28.1k] ------------------ 1174| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); ------------------ | | 4387| 0|#define SSL_AD_INTERNAL_ERROR TLS1_AD_INTERNAL_ERROR | | ------------------ | | | | 37| 0|#define TLS1_AD_INTERNAL_ERROR 80 | | ------------------ ------------------ 1175| 0| return ssl_hs_error; 1176| 0| } 1177| | 1178| 28.1k| if (ssl_protocol_version(ssl) >= TLS1_2_VERSION) { ------------------ | | 544| 28.1k|#define TLS1_2_VERSION 0x0303 ------------------ | Branch (1178:7): [True: 28.1k, False: 22] ------------------ 1179| 28.1k| CBS supported_signature_algorithms; 1180| 28.1k| if (!CBS_get_u16_length_prefixed(&body, &supported_signature_algorithms) || ------------------ | Branch (1180:9): [True: 6, False: 28.1k] ------------------ 1181| 28.1k| !tls1_parse_peer_sigalgs(hs, &supported_signature_algorithms)) { ------------------ | Branch (1181:9): [True: 5, False: 28.1k] ------------------ 1182| 11| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 176| 11|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 4382| 11|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 11|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 1183| 11| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); ------------------ | | 361| 11| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1184| 11| return ssl_hs_error; 1185| 11| } 1186| 28.1k| } 1187| | 1188| 28.1k| uint8_t alert = SSL_AD_DECODE_ERROR; ------------------ | | 4382| 28.1k|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 28.1k|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 1189| 28.1k| UniquePtr ca_names = 1190| 28.1k| SSL_parse_CA_list(ssl, &alert, &body); 1191| 28.1k| if (!ca_names) { ------------------ | Branch (1191:7): [True: 21, False: 28.1k] ------------------ 1192| 21| ssl_send_alert(ssl, SSL3_AL_FATAL, alert); ------------------ | | 176| 21|#define SSL3_AL_FATAL 2 ------------------ 1193| 21| return ssl_hs_error; 1194| 21| } 1195| | 1196| 28.1k| if (CBS_len(&body) != 0) { ------------------ | Branch (1196:7): [True: 1, False: 28.1k] ------------------ 1197| 1| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 176| 1|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 4382| 1|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 1|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 1198| 1| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); ------------------ | | 361| 1| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1199| 1| return ssl_hs_error; 1200| 1| } 1201| | 1202| 28.1k| hs->cert_request = true; 1203| 28.1k| hs->ca_names = std::move(ca_names); 1204| 28.1k| ssl->ctx->x509_method->hs_flush_cached_ca_names(hs); 1205| | 1206| 28.1k| ssl->method->next_message(ssl); 1207| 28.1k| hs->state = state_read_server_hello_done; 1208| 28.1k| return ssl_hs_ok; 1209| 28.1k|} handshake_client.cc:_ZN4bsslL25do_read_server_hello_doneEPNS_13SSL_HANDSHAKEE: 1211| 80.5k|static enum ssl_hs_wait_t do_read_server_hello_done(SSL_HANDSHAKE *hs) { 1212| 80.5k| SSL *const ssl = hs->ssl; 1213| 80.5k| SSLMessage msg; 1214| 80.5k| if (!ssl->method->get_message(ssl, &msg)) { ------------------ | Branch (1214:7): [True: 28.2k, False: 52.2k] ------------------ 1215| 28.2k| return ssl_hs_read_message; 1216| 28.2k| } 1217| | 1218| 52.2k| if (!ssl_check_message_type(ssl, msg, SSL3_MT_SERVER_HELLO_DONE) || ------------------ | | 203| 52.2k|#define SSL3_MT_SERVER_HELLO_DONE 14 ------------------ | Branch (1218:7): [True: 1, False: 52.2k] ------------------ 1219| 52.2k| !ssl_hash_message(hs, msg)) { ------------------ | Branch (1219:7): [True: 0, False: 52.2k] ------------------ 1220| 1| return ssl_hs_error; 1221| 1| } 1222| | 1223| | // ServerHelloDone is empty. 1224| 52.2k| if (CBS_len(&msg.body) != 0) { ------------------ | Branch (1224:7): [True: 6, False: 52.2k] ------------------ 1225| 6| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 176| 6|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 4382| 6|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 6|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 1226| 6| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); ------------------ | | 361| 6| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1227| 6| return ssl_hs_error; 1228| 6| } 1229| | 1230| | // ServerHelloDone should be the end of the flight. 1231| 52.2k| if (ssl->method->has_unprocessed_handshake_data(ssl)) { ------------------ | Branch (1231:7): [True: 4, False: 52.2k] ------------------ 1232| 4| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE); ------------------ | | 176| 4|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE); ------------------ | | 4367| 4|#define SSL_AD_UNEXPECTED_MESSAGE SSL3_AD_UNEXPECTED_MESSAGE | | ------------------ | | | | 179| 4|#define SSL3_AD_UNEXPECTED_MESSAGE 10 // fatal | | ------------------ ------------------ 1233| 4| OPENSSL_PUT_ERROR(SSL, SSL_R_EXCESS_HANDSHAKE_DATA); ------------------ | | 361| 4| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1234| 4| return ssl_hs_error; 1235| 4| } 1236| | 1237| 52.2k| ssl->method->next_message(ssl); 1238| 52.2k| hs->state = state_send_client_certificate; 1239| 52.2k| return ssl_hs_ok; 1240| 52.2k|} handshake_client.cc:_ZN4bsslL26do_send_client_certificateEPNS_13SSL_HANDSHAKEE: 1277| 52.2k|static enum ssl_hs_wait_t do_send_client_certificate(SSL_HANDSHAKE *hs) { 1278| 52.2k| SSL *const ssl = hs->ssl; 1279| | 1280| | // The peer didn't request a certificate. 1281| 52.2k| if (!hs->cert_request) { ------------------ | Branch (1281:7): [True: 24.1k, False: 28.0k] ------------------ 1282| 24.1k| hs->state = state_send_client_key_exchange; 1283| 24.1k| return ssl_hs_ok; 1284| 24.1k| } 1285| | 1286| 28.0k| if (ssl->s3->ech_status == ssl_ech_rejected) { ------------------ | Branch (1286:7): [True: 0, False: 28.0k] ------------------ 1287| | // Do not send client certificates on ECH reject. We have not authenticated 1288| | // the server for the name that can learn the certificate. 1289| 0| SSL_certs_clear(ssl); 1290| 28.0k| } else if (hs->config->cert->cert_cb != nullptr) { ------------------ | Branch (1290:14): [True: 0, False: 28.0k] ------------------ 1291| | // Call cert_cb to update the certificate. 1292| 0| int rv = hs->config->cert->cert_cb(ssl, hs->config->cert->cert_cb_arg); 1293| 0| if (rv == 0) { ------------------ | Branch (1293:9): [True: 0, False: 0] ------------------ 1294| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); ------------------ | | 4387| 0|#define SSL_AD_INTERNAL_ERROR TLS1_AD_INTERNAL_ERROR | | ------------------ | | | | 37| 0|#define TLS1_AD_INTERNAL_ERROR 80 | | ------------------ ------------------ 1295| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_CERT_CB_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1296| 0| return ssl_hs_error; 1297| 0| } 1298| 0| if (rv < 0) { ------------------ | Branch (1298:9): [True: 0, False: 0] ------------------ 1299| 0| hs->state = state_send_client_certificate; 1300| 0| return ssl_hs_x509_lookup; 1301| 0| } 1302| 0| } 1303| | 1304| 28.0k| Array creds; 1305| 28.0k| if (!ssl_get_full_credential_list(hs, &creds)) { ------------------ | Branch (1305:7): [True: 0, False: 28.0k] ------------------ 1306| 0| return ssl_hs_error; 1307| 0| } 1308| | 1309| 28.0k| if (creds.empty()) { ------------------ | Branch (1309:7): [True: 0, False: 28.0k] ------------------ 1310| | // If there were no credentials, proceed without a client certificate. In 1311| | // this case, the handshake buffer may be released early. 1312| 0| hs->transcript.FreeBuffer(); 1313| 28.0k| } else { 1314| | // Select the credential to use. 1315| 28.0k| for (SSL_CREDENTIAL *cred : creds) { ------------------ | Branch (1315:31): [True: 28.0k, False: 4] ------------------ 1316| 28.0k| ERR_clear_error(); 1317| 28.0k| uint16_t sigalg; 1318| 28.0k| if (check_credential(hs, cred, &sigalg)) { ------------------ | Branch (1318:11): [True: 28.0k, False: 4] ------------------ 1319| 28.0k| hs->credential = UpRef(cred); 1320| 28.0k| hs->signature_algorithm = sigalg; 1321| 28.0k| break; 1322| 28.0k| } 1323| 28.0k| } 1324| 28.0k| if (hs->credential == nullptr) { ------------------ | Branch (1324:9): [True: 4, False: 28.0k] ------------------ 1325| | // The error from the last attempt is in the error queue. 1326| 4| assert(ERR_peek_error() != 0); 1327| 4| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE); ------------------ | | 176| 4|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE); ------------------ | | 4372| 4|#define SSL_AD_HANDSHAKE_FAILURE SSL3_AD_HANDSHAKE_FAILURE | | ------------------ | | | | 182| 4|#define SSL3_AD_HANDSHAKE_FAILURE 40 // fatal | | ------------------ ------------------ 1328| 4| return ssl_hs_error; 1329| 4| } 1330| 28.0k| } 1331| | 1332| 28.0k| if (!ssl_send_tls12_certificate(hs)) { ------------------ | Branch (1332:7): [True: 0, False: 28.0k] ------------------ 1333| 0| return ssl_hs_error; 1334| 0| } 1335| | 1336| 28.0k| hs->state = state_send_client_key_exchange; 1337| 28.0k| return ssl_hs_ok; 1338| 28.0k|} handshake_client.cc:_ZN4bsslL16check_credentialEPNS_13SSL_HANDSHAKEEPK17ssl_credential_stPt: 1243| 28.0k| uint16_t *out_sigalg) { 1244| 28.0k| if (cred->type != SSLCredentialType::kX509) { ------------------ | Branch (1244:7): [True: 0, False: 28.0k] ------------------ 1245| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_UNKNOWN_CERTIFICATE_TYPE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1246| 0| return false; 1247| 0| } 1248| | 1249| | // Check the certificate types advertised by the peer. 1250| 28.0k| uint8_t cert_type; 1251| 28.0k| switch (EVP_PKEY_id(cred->pubkey.get())) { 1252| 28.0k| case EVP_PKEY_RSA: ------------------ | | 133| 28.0k|#define EVP_PKEY_RSA NID_rsaEncryption | | ------------------ | | | | 72| 28.0k|#define NID_rsaEncryption 6 | | ------------------ ------------------ | Branch (1252:5): [True: 28.0k, False: 0] ------------------ 1253| 28.0k| cert_type = SSL3_CT_RSA_SIGN; ------------------ | | 192| 28.0k|#define SSL3_CT_RSA_SIGN 1 ------------------ 1254| 28.0k| break; 1255| 0| case EVP_PKEY_EC: ------------------ | | 136| 0|#define EVP_PKEY_EC NID_X9_62_id_ecPublicKey | | ------------------ | | | | 1844| 0|#define NID_X9_62_id_ecPublicKey 408 | | ------------------ ------------------ | Branch (1255:5): [True: 0, False: 28.0k] ------------------ 1256| 0| case EVP_PKEY_ED25519: ------------------ | | 137| 0|#define EVP_PKEY_ED25519 NID_ED25519 | | ------------------ | | | | 4157| 0|#define NID_ED25519 949 | | ------------------ ------------------ | Branch (1256:5): [True: 0, False: 28.0k] ------------------ 1257| 0| cert_type = TLS_CT_ECDSA_SIGN; ------------------ | | 531| 0|#define TLS_CT_ECDSA_SIGN 64 ------------------ 1258| 0| break; 1259| 0| default: ------------------ | Branch (1259:5): [True: 0, False: 28.0k] ------------------ 1260| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_UNKNOWN_CERTIFICATE_TYPE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1261| 0| return false; 1262| 28.0k| } 1263| 28.0k| if (std::find(hs->certificate_types.begin(), hs->certificate_types.end(), ------------------ | Branch (1263:7): [True: 2, False: 28.0k] ------------------ 1264| 28.0k| cert_type) == hs->certificate_types.end()) { 1265| 2| OPENSSL_PUT_ERROR(SSL, SSL_R_UNKNOWN_CERTIFICATE_TYPE); ------------------ | | 361| 2| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1266| 2| return false; 1267| 2| } 1268| | 1269| | // All currently supported credentials require a signature. Note this does not 1270| | // check the ECDSA curve. Prior to TLS 1.3, there is no way to determine which 1271| | // ECDSA curves are supported by the peer, so we must assume all curves are 1272| | // supported. 1273| 28.0k| return tls1_choose_signature_algorithm(hs, cred, out_sigalg) && ------------------ | Branch (1273:10): [True: 28.0k, False: 2] ------------------ 1274| 28.0k| ssl_credential_matches_requested_issuers(hs, cred); ------------------ | Branch (1274:10): [True: 28.0k, False: 0] ------------------ 1275| 28.0k|} handshake_client.cc:_ZN4bsslL27do_send_client_key_exchangeEPNS_13SSL_HANDSHAKEE: 1343| 52.2k|static enum ssl_hs_wait_t do_send_client_key_exchange(SSL_HANDSHAKE *hs) { 1344| 52.2k| SSL *const ssl = hs->ssl; 1345| 52.2k| ScopedCBB cbb; 1346| 52.2k| CBB body; 1347| 52.2k| if (!ssl->method->init_message(ssl, cbb.get(), &body, ------------------ | Branch (1347:7): [True: 0, False: 52.2k] ------------------ 1348| 52.2k| SSL3_MT_CLIENT_KEY_EXCHANGE)) { ------------------ | | 205| 52.2k|#define SSL3_MT_CLIENT_KEY_EXCHANGE 16 ------------------ 1349| 0| return ssl_hs_error; 1350| 0| } 1351| | 1352| 52.2k| Array pms; 1353| 52.2k| uint32_t alg_k = hs->new_cipher->algorithm_mkey; 1354| 52.2k| uint32_t alg_a = hs->new_cipher->algorithm_auth; 1355| 52.2k| if (ssl_cipher_uses_certificate_auth(hs->new_cipher)) { ------------------ | Branch (1355:7): [True: 52.2k, False: 0] ------------------ 1356| 52.2k| const CRYPTO_BUFFER *leaf = 1357| 52.2k| sk_CRYPTO_BUFFER_value(hs->new_session->certs.get(), 0); 1358| 52.2k| CBS leaf_cbs; 1359| 52.2k| CRYPTO_BUFFER_init_CBS(leaf, &leaf_cbs); 1360| | 1361| | // Check the key usage matches the cipher suite. We do this unconditionally 1362| | // for non-RSA certificates. In particular, it's needed to distinguish ECDH 1363| | // certificates, which we do not support, from ECDSA certificates. 1364| | // Historically, we have not checked RSA key usages, so it is controlled by 1365| | // a flag for now. See https://crbug.com/795089. 1366| 52.2k| ssl_key_usage_t intended_use = (alg_k & SSL_kRSA) ------------------ | | 259| 52.2k|#define SSL_kRSA 0x00000001u ------------------ | Branch (1366:36): [True: 1.73k, False: 50.5k] ------------------ 1367| 52.2k| ? key_usage_encipherment 1368| 52.2k| : key_usage_digital_signature; 1369| 52.2k| if (!ssl_cert_check_key_usage(&leaf_cbs, intended_use)) { ------------------ | Branch (1369:9): [True: 11, False: 52.2k] ------------------ 1370| 11| if (hs->config->enforce_rsa_key_usage || ------------------ | Branch (1370:11): [True: 11, False: 0] ------------------ 1371| 11| EVP_PKEY_id(hs->peer_pubkey.get()) != EVP_PKEY_RSA) { ------------------ | | 133| 0|#define EVP_PKEY_RSA NID_rsaEncryption | | ------------------ | | | | 72| 0|#define NID_rsaEncryption 6 | | ------------------ ------------------ | Branch (1371:11): [True: 0, False: 0] ------------------ 1372| 11| return ssl_hs_error; 1373| 11| } 1374| 0| ERR_clear_error(); 1375| 0| ssl->s3->was_key_usage_invalid = true; 1376| 0| } 1377| 52.2k| } 1378| | 1379| | // If using a PSK key exchange, prepare the pre-shared key. 1380| 52.2k| unsigned psk_len = 0; 1381| 52.2k| uint8_t psk[PSK_MAX_PSK_LEN]; 1382| 52.2k| if (alg_a & SSL_aPSK) { ------------------ | | 270| 52.2k|#define SSL_aPSK 0x00000008u ------------------ | Branch (1382:7): [True: 0, False: 52.2k] ------------------ 1383| 0| if (hs->config->psk_client_callback == NULL) { ------------------ | Branch (1383:9): [True: 0, False: 0] ------------------ 1384| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_PSK_NO_CLIENT_CB); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1385| 0| return ssl_hs_error; 1386| 0| } 1387| | 1388| 0| char identity[PSK_MAX_IDENTITY_LEN + 1]; 1389| 0| OPENSSL_memset(identity, 0, sizeof(identity)); 1390| 0| psk_len = hs->config->psk_client_callback( 1391| 0| ssl, hs->peer_psk_identity_hint.get(), identity, sizeof(identity), psk, 1392| 0| sizeof(psk)); 1393| 0| if (psk_len == 0) { ------------------ | Branch (1393:9): [True: 0, False: 0] ------------------ 1394| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_PSK_IDENTITY_NOT_FOUND); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1395| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE); ------------------ | | 4372| 0|#define SSL_AD_HANDSHAKE_FAILURE SSL3_AD_HANDSHAKE_FAILURE | | ------------------ | | | | 182| 0|#define SSL3_AD_HANDSHAKE_FAILURE 40 // fatal | | ------------------ ------------------ 1396| 0| return ssl_hs_error; 1397| 0| } 1398| 0| assert(psk_len <= PSK_MAX_PSK_LEN); 1399| | 1400| 0| hs->new_session->psk_identity.reset(OPENSSL_strdup(identity)); 1401| 0| if (hs->new_session->psk_identity == nullptr) { ------------------ | Branch (1401:9): [True: 0, False: 0] ------------------ 1402| 0| return ssl_hs_error; 1403| 0| } 1404| | 1405| | // Write out psk_identity. 1406| 0| CBB child; 1407| 0| if (!CBB_add_u16_length_prefixed(&body, &child) || ------------------ | Branch (1407:9): [True: 0, False: 0] ------------------ 1408| 0| !CBB_add_bytes(&child, (const uint8_t *)identity, ------------------ | Branch (1408:9): [True: 0, False: 0] ------------------ 1409| 0| OPENSSL_strnlen(identity, sizeof(identity))) || 1410| 0| !CBB_flush(&body)) { ------------------ | Branch (1410:9): [True: 0, False: 0] ------------------ 1411| 0| return ssl_hs_error; 1412| 0| } 1413| 0| } 1414| | 1415| | // Depending on the key exchange method, compute |pms|. 1416| 52.2k| if (alg_k & SSL_kRSA) { ------------------ | | 259| 52.2k|#define SSL_kRSA 0x00000001u ------------------ | Branch (1416:7): [True: 1.73k, False: 50.5k] ------------------ 1417| 1.73k| RSA *rsa = EVP_PKEY_get0_RSA(hs->peer_pubkey.get()); 1418| 1.73k| if (rsa == NULL) { ------------------ | Branch (1418:9): [True: 0, False: 1.73k] ------------------ 1419| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1420| 0| return ssl_hs_error; 1421| 0| } 1422| | 1423| 1.73k| if (!pms.InitForOverwrite(SSL_MAX_MASTER_KEY_LENGTH)) { ------------------ | | 1971| 1.73k|#define SSL_MAX_MASTER_KEY_LENGTH 48 ------------------ | Branch (1423:9): [True: 0, False: 1.73k] ------------------ 1424| 0| return ssl_hs_error; 1425| 0| } 1426| 1.73k| pms[0] = hs->client_version >> 8; 1427| 1.73k| pms[1] = hs->client_version & 0xff; 1428| 1.73k| if (!RAND_bytes(&pms[2], SSL_MAX_MASTER_KEY_LENGTH - 2)) { ------------------ | | 1971| 1.73k|#define SSL_MAX_MASTER_KEY_LENGTH 48 ------------------ | Branch (1428:9): [True: 0, False: 1.73k] ------------------ 1429| 0| return ssl_hs_error; 1430| 0| } 1431| | 1432| 1.73k| CBB enc_pms; 1433| 1.73k| uint8_t *ptr; 1434| 1.73k| size_t enc_pms_len; 1435| 1.73k| if (!CBB_add_u16_length_prefixed(&body, &enc_pms) || // ------------------ | Branch (1435:9): [True: 0, False: 1.73k] ------------------ 1436| 1.73k| !CBB_reserve(&enc_pms, &ptr, RSA_size(rsa)) || // ------------------ | Branch (1436:9): [True: 0, False: 1.73k] ------------------ 1437| 1.73k| !RSA_encrypt(rsa, &enc_pms_len, ptr, RSA_size(rsa), pms.data(), ------------------ | Branch (1437:9): [True: 0, False: 1.73k] ------------------ 1438| 1.73k| pms.size(), RSA_PKCS1_PADDING) || // ------------------ | | 208| 1.73k|#define RSA_PKCS1_PADDING 1 ------------------ 1439| 1.73k| !CBB_did_write(&enc_pms, enc_pms_len) || // ------------------ | Branch (1439:9): [True: 0, False: 1.73k] ------------------ 1440| 1.73k| !CBB_flush(&body)) { ------------------ | Branch (1440:9): [True: 0, False: 1.73k] ------------------ 1441| 0| return ssl_hs_error; 1442| 0| } 1443| 50.5k| } else if (alg_k & SSL_kECDHE) { ------------------ | | 260| 50.5k|#define SSL_kECDHE 0x00000002u ------------------ | Branch (1443:14): [True: 50.5k, False: 0] ------------------ 1444| 50.5k| CBB child; 1445| 50.5k| if (!CBB_add_u8_length_prefixed(&body, &child)) { ------------------ | Branch (1445:9): [True: 0, False: 50.5k] ------------------ 1446| 0| return ssl_hs_error; 1447| 0| } 1448| | 1449| | // Generate a premaster secret and encapsulate it. 1450| 50.5k| bssl::UniquePtr kem = 1451| 50.5k| SSLKeyShare::Create(hs->new_session->group_id); 1452| 50.5k| uint8_t alert = SSL_AD_DECODE_ERROR; ------------------ | | 4382| 50.5k|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 50.5k|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 1453| 50.5k| if (!kem || !kem->Encap(&child, &pms, &alert, hs->peer_key)) { ------------------ | Branch (1453:9): [True: 0, False: 50.5k] | Branch (1453:17): [True: 164, False: 50.3k] ------------------ 1454| 164| ssl_send_alert(ssl, SSL3_AL_FATAL, alert); ------------------ | | 176| 164|#define SSL3_AL_FATAL 2 ------------------ 1455| 164| return ssl_hs_error; 1456| 164| } 1457| 50.3k| if (!CBB_flush(&body)) { ------------------ | Branch (1457:9): [True: 0, False: 50.3k] ------------------ 1458| 0| return ssl_hs_error; 1459| 0| } 1460| | 1461| | // The peer key can now be discarded. 1462| 50.3k| hs->peer_key.Reset(); 1463| 50.3k| } else if (alg_k & SSL_kPSK) { ------------------ | | 262| 0|#define SSL_kPSK 0x00000004u ------------------ | Branch (1463:14): [True: 0, False: 0] ------------------ 1464| | // For plain PSK, other_secret is a block of 0s with the same length as 1465| | // the pre-shared key. 1466| 0| if (!pms.Init(psk_len)) { ------------------ | Branch (1466:9): [True: 0, False: 0] ------------------ 1467| 0| return ssl_hs_error; 1468| 0| } 1469| 0| } else { 1470| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE); ------------------ | | 4372| 0|#define SSL_AD_HANDSHAKE_FAILURE SSL3_AD_HANDSHAKE_FAILURE | | ------------------ | | | | 182| 0|#define SSL3_AD_HANDSHAKE_FAILURE 40 // fatal | | ------------------ ------------------ 1471| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1472| 0| return ssl_hs_error; 1473| 0| } 1474| | 1475| | // For a PSK cipher suite, other_secret is combined with the pre-shared 1476| | // key. 1477| 52.0k| if (alg_a & SSL_aPSK) { ------------------ | | 270| 52.0k|#define SSL_aPSK 0x00000008u ------------------ | Branch (1477:7): [True: 0, False: 52.0k] ------------------ 1478| 0| ScopedCBB pms_cbb; 1479| 0| CBB child; 1480| 0| if (!CBB_init(pms_cbb.get(), 2 + psk_len + 2 + pms.size()) || ------------------ | Branch (1480:9): [True: 0, False: 0] ------------------ 1481| 0| !CBB_add_u16_length_prefixed(pms_cbb.get(), &child) || ------------------ | Branch (1481:9): [True: 0, False: 0] ------------------ 1482| 0| !CBB_add_bytes(&child, pms.data(), pms.size()) || ------------------ | Branch (1482:9): [True: 0, False: 0] ------------------ 1483| 0| !CBB_add_u16_length_prefixed(pms_cbb.get(), &child) || ------------------ | Branch (1483:9): [True: 0, False: 0] ------------------ 1484| 0| !CBB_add_bytes(&child, psk, psk_len) || ------------------ | Branch (1484:9): [True: 0, False: 0] ------------------ 1485| 0| !CBBFinishArray(pms_cbb.get(), &pms)) { ------------------ | Branch (1485:9): [True: 0, False: 0] ------------------ 1486| 0| return ssl_hs_error; 1487| 0| } 1488| 0| } 1489| | 1490| | // The message must be added to the finished hash before calculating the 1491| | // master secret. 1492| 52.0k| if (!ssl_add_message_cbb(ssl, cbb.get())) { ------------------ | Branch (1492:7): [True: 0, False: 52.0k] ------------------ 1493| 0| return ssl_hs_error; 1494| 0| } 1495| | 1496| 52.0k| hs->new_session->secret.ResizeForOverwrite(SSL3_MASTER_SECRET_SIZE); ------------------ | | 101| 52.0k|#define SSL3_MASTER_SECRET_SIZE 48 ------------------ 1497| 52.0k| if (!tls1_generate_master_secret(hs, Span(hs->new_session->secret), pms)) { ------------------ | Branch (1497:7): [True: 0, False: 52.0k] ------------------ 1498| 0| return ssl_hs_error; 1499| 0| } 1500| | 1501| 52.0k| hs->new_session->extended_master_secret = hs->extended_master_secret; 1502| 52.0k| hs->state = state_send_client_certificate_verify; 1503| 52.0k| return ssl_hs_ok; 1504| 52.0k|} handshake_client.cc:_ZN4bsslL33do_send_client_certificate_verifyEPNS_13SSL_HANDSHAKEE: 1506| 52.0k|static enum ssl_hs_wait_t do_send_client_certificate_verify(SSL_HANDSHAKE *hs) { 1507| 52.0k| SSL *const ssl = hs->ssl; 1508| | 1509| 52.0k| if (!hs->cert_request || hs->credential == nullptr) { ------------------ | Branch (1509:7): [True: 24.0k, False: 28.0k] | Branch (1509:28): [True: 0, False: 28.0k] ------------------ 1510| 24.0k| hs->state = state_send_client_finished; 1511| 24.0k| return ssl_hs_ok; 1512| 24.0k| } 1513| | 1514| 28.0k| ScopedCBB cbb; 1515| 28.0k| CBB body, child; 1516| 28.0k| if (!ssl->method->init_message(ssl, cbb.get(), &body, ------------------ | Branch (1516:7): [True: 0, False: 28.0k] ------------------ 1517| 28.0k| SSL3_MT_CERTIFICATE_VERIFY)) { ------------------ | | 204| 28.0k|#define SSL3_MT_CERTIFICATE_VERIFY 15 ------------------ 1518| 0| return ssl_hs_error; 1519| 0| } 1520| | 1521| 28.0k| assert(hs->signature_algorithm != 0); 1522| 28.0k| if (ssl_protocol_version(ssl) >= TLS1_2_VERSION) { ------------------ | | 544| 28.0k|#define TLS1_2_VERSION 0x0303 ------------------ | Branch (1522:7): [True: 28.0k, False: 7] ------------------ 1523| | // Write out the digest type in TLS 1.2. 1524| 28.0k| if (!CBB_add_u16(&body, hs->signature_algorithm)) { ------------------ | Branch (1524:9): [True: 0, False: 28.0k] ------------------ 1525| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1526| 0| return ssl_hs_error; 1527| 0| } 1528| 28.0k| } 1529| | 1530| | // Set aside space for the signature. 1531| 28.0k| const size_t max_sig_len = EVP_PKEY_size(hs->credential->pubkey.get()); 1532| 28.0k| uint8_t *ptr; 1533| 28.0k| if (!CBB_add_u16_length_prefixed(&body, &child) || ------------------ | Branch (1533:7): [True: 0, False: 28.0k] ------------------ 1534| 28.0k| !CBB_reserve(&child, &ptr, max_sig_len)) { ------------------ | Branch (1534:7): [True: 0, False: 28.0k] ------------------ 1535| 0| return ssl_hs_error; 1536| 0| } 1537| | 1538| 28.0k| size_t sig_len = max_sig_len; 1539| 28.0k| switch (ssl_private_key_sign(hs, ptr, &sig_len, max_sig_len, ------------------ | Branch (1539:11): [True: 0, False: 28.0k] ------------------ 1540| 28.0k| hs->signature_algorithm, 1541| 28.0k| hs->transcript.buffer())) { 1542| 28.0k| case ssl_private_key_success: ------------------ | Branch (1542:5): [True: 28.0k, False: 0] ------------------ 1543| 28.0k| break; 1544| 0| case ssl_private_key_failure: ------------------ | Branch (1544:5): [True: 0, False: 28.0k] ------------------ 1545| 0| return ssl_hs_error; 1546| 0| case ssl_private_key_retry: ------------------ | Branch (1546:5): [True: 0, False: 28.0k] ------------------ 1547| 0| hs->state = state_send_client_certificate_verify; 1548| 0| return ssl_hs_private_key_operation; 1549| 28.0k| } 1550| | 1551| 28.0k| if (!CBB_did_write(&child, sig_len) || // ------------------ | Branch (1551:7): [True: 0, False: 28.0k] ------------------ 1552| 28.0k| !ssl_add_message_cbb(ssl, cbb.get())) { ------------------ | Branch (1552:7): [True: 0, False: 28.0k] ------------------ 1553| 0| return ssl_hs_error; 1554| 0| } 1555| | 1556| | // The handshake buffer is no longer necessary. 1557| 28.0k| hs->transcript.FreeBuffer(); 1558| | 1559| 28.0k| hs->state = state_send_client_finished; 1560| 28.0k| return ssl_hs_ok; 1561| 28.0k|} handshake_client.cc:_ZN4bsslL23do_send_client_finishedEPNS_13SSL_HANDSHAKEE: 1563| 52.2k|static enum ssl_hs_wait_t do_send_client_finished(SSL_HANDSHAKE *hs) { 1564| 52.2k| SSL *const ssl = hs->ssl; 1565| 52.2k| hs->can_release_private_key = true; 1566| 52.2k| if (!ssl->method->add_change_cipher_spec(ssl) || ------------------ | Branch (1566:7): [True: 0, False: 52.2k] ------------------ 1567| 52.2k| !tls1_change_cipher_state(hs, evp_aead_seal)) { ------------------ | Branch (1567:7): [True: 0, False: 52.2k] ------------------ 1568| 0| return ssl_hs_error; 1569| 0| } 1570| | 1571| 52.2k| if (hs->next_proto_neg_seen) { ------------------ | Branch (1571:7): [True: 2, False: 52.2k] ------------------ 1572| 2| static const uint8_t kZero[32] = {0}; 1573| 2| size_t padding_len = 1574| 2| 32 - ((ssl->s3->next_proto_negotiated.size() + 2) % 32); 1575| | 1576| 2| ScopedCBB cbb; 1577| 2| CBB body, child; 1578| 2| if (!ssl->method->init_message(ssl, cbb.get(), &body, SSL3_MT_NEXT_PROTO) || ------------------ | | 211| 2|#define SSL3_MT_NEXT_PROTO 67 ------------------ | Branch (1578:9): [True: 0, False: 2] ------------------ 1579| 2| !CBB_add_u8_length_prefixed(&body, &child) || ------------------ | Branch (1579:9): [True: 0, False: 2] ------------------ 1580| 2| !CBB_add_bytes(&child, ssl->s3->next_proto_negotiated.data(), ------------------ | Branch (1580:9): [True: 0, False: 2] ------------------ 1581| 2| ssl->s3->next_proto_negotiated.size()) || 1582| 2| !CBB_add_u8_length_prefixed(&body, &child) || ------------------ | Branch (1582:9): [True: 0, False: 2] ------------------ 1583| 2| !CBB_add_bytes(&child, kZero, padding_len) || ------------------ | Branch (1583:9): [True: 0, False: 2] ------------------ 1584| 2| !ssl_add_message_cbb(ssl, cbb.get())) { ------------------ | Branch (1584:9): [True: 0, False: 2] ------------------ 1585| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1586| 0| return ssl_hs_error; 1587| 0| } 1588| 2| } 1589| | 1590| 52.2k| if (hs->channel_id_negotiated) { ------------------ | Branch (1590:7): [True: 107, False: 52.1k] ------------------ 1591| 107| ScopedCBB cbb; 1592| 107| CBB body; 1593| 107| if (!ssl->method->init_message(ssl, cbb.get(), &body, SSL3_MT_CHANNEL_ID) || ------------------ | | 212| 107|#define SSL3_MT_CHANNEL_ID 203 ------------------ | Branch (1593:9): [True: 0, False: 107] ------------------ 1594| 107| !tls1_write_channel_id(hs, &body) || ------------------ | Branch (1594:9): [True: 0, False: 107] ------------------ 1595| 107| !ssl_add_message_cbb(ssl, cbb.get())) { ------------------ | Branch (1595:9): [True: 0, False: 107] ------------------ 1596| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1597| 0| return ssl_hs_error; 1598| 0| } 1599| 107| } 1600| | 1601| 52.2k| if (!ssl_send_finished(hs)) { ------------------ | Branch (1601:7): [True: 0, False: 52.2k] ------------------ 1602| 0| return ssl_hs_error; 1603| 0| } 1604| | 1605| 52.2k| hs->state = state_finish_flight; 1606| 52.2k| return ssl_hs_flush; 1607| 52.2k|} handshake_client.cc:_ZN4bsslL16do_finish_flightEPNS_13SSL_HANDSHAKEE: 1648| 52.2k|static enum ssl_hs_wait_t do_finish_flight(SSL_HANDSHAKE *hs) { 1649| 52.2k| SSL *const ssl = hs->ssl; 1650| 52.2k| if (ssl->session != NULL) { ------------------ | Branch (1650:7): [True: 171, False: 52.0k] ------------------ 1651| 171| hs->state = state_finish_client_handshake; 1652| 171| return ssl_hs_ok; 1653| 171| } 1654| | 1655| | // This is a full handshake. If it involves ChannelID, then record the 1656| | // handshake hashes at this point in the session so that any resumption of 1657| | // this session with ChannelID can sign those hashes. 1658| 52.0k| if (!tls1_record_handshake_hashes_for_channel_id(hs)) { ------------------ | Branch (1658:7): [True: 0, False: 52.0k] ------------------ 1659| 0| return ssl_hs_error; 1660| 0| } 1661| | 1662| 52.0k| hs->state = state_read_session_ticket; 1663| | 1664| 52.0k| if ((SSL_get_mode(ssl) & SSL_MODE_ENABLE_FALSE_START) && ------------------ | | 6109| 52.0k|#define SSL_get_mode SSL_get_mode ------------------ if ((SSL_get_mode(ssl) & SSL_MODE_ENABLE_FALSE_START) && ------------------ | | 680| 52.0k|#define SSL_MODE_ENABLE_FALSE_START 0x00000080L ------------------ | Branch (1664:7): [True: 0, False: 52.0k] ------------------ 1665| 52.0k| can_false_start(hs) && ------------------ | Branch (1665:7): [True: 0, False: 0] ------------------ 1666| | // No False Start on renegotiation (would complicate the state machine). 1667| 52.0k| !ssl->s3->initial_handshake_complete) { ------------------ | Branch (1667:7): [True: 0, False: 0] ------------------ 1668| 0| hs->in_false_start = true; 1669| 0| hs->can_early_write = true; 1670| 0| return ssl_hs_early_return; 1671| 0| } 1672| | 1673| 52.0k| return ssl_hs_ok; 1674| 52.0k|} handshake_client.cc:_ZN4bsslL22do_read_session_ticketEPNS_13SSL_HANDSHAKEE: 1676| 104k|static enum ssl_hs_wait_t do_read_session_ticket(SSL_HANDSHAKE *hs) { 1677| 104k| SSL *const ssl = hs->ssl; 1678| | 1679| 104k| if (!hs->ticket_expected) { ------------------ | Branch (1679:7): [True: 233, False: 104k] ------------------ 1680| 233| hs->state = state_process_change_cipher_spec; 1681| 233| return ssl_hs_read_change_cipher_spec; 1682| 233| } 1683| | 1684| 104k| SSLMessage msg; 1685| 104k| if (!ssl->method->get_message(ssl, &msg)) { ------------------ | Branch (1685:7): [True: 53.0k, False: 51.3k] ------------------ 1686| 53.0k| return ssl_hs_read_message; 1687| 53.0k| } 1688| | 1689| 51.3k| if (!ssl_check_message_type(ssl, msg, SSL3_MT_NEW_SESSION_TICKET) || ------------------ | | 197| 51.3k|#define SSL3_MT_NEW_SESSION_TICKET 4 ------------------ | Branch (1689:7): [True: 9, False: 51.3k] ------------------ 1690| 51.3k| !ssl_hash_message(hs, msg)) { ------------------ | Branch (1690:7): [True: 0, False: 51.3k] ------------------ 1691| 9| return ssl_hs_error; 1692| 9| } 1693| | 1694| 51.3k| CBS new_session_ticket = msg.body, ticket; 1695| 51.3k| uint32_t ticket_lifetime_hint; 1696| 51.3k| if (!CBS_get_u32(&new_session_ticket, &ticket_lifetime_hint) || ------------------ | Branch (1696:7): [True: 1, False: 51.3k] ------------------ 1697| 51.3k| !CBS_get_u16_length_prefixed(&new_session_ticket, &ticket) || ------------------ | Branch (1697:7): [True: 4, False: 51.3k] ------------------ 1698| 51.3k| CBS_len(&new_session_ticket) != 0) { ------------------ | Branch (1698:7): [True: 5, False: 51.3k] ------------------ 1699| 10| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 176| 10|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 4382| 10|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 10|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 1700| 10| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); ------------------ | | 361| 10| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1701| 10| return ssl_hs_error; 1702| 10| } 1703| | 1704| 51.3k| if (CBS_len(&ticket) == 0) { ------------------ | Branch (1704:7): [True: 1, False: 51.3k] ------------------ 1705| | // RFC 5077 allows a server to change its mind and send no ticket after 1706| | // negotiating the extension. The value of |ticket_expected| is checked in 1707| | // |ssl_update_cache| so is cleared here to avoid an unnecessary update. 1708| 1| hs->ticket_expected = false; 1709| 1| ssl->method->next_message(ssl); 1710| 1| hs->state = state_process_change_cipher_spec; 1711| 1| return ssl_hs_read_change_cipher_spec; 1712| 1| } 1713| | 1714| 51.3k| if (ssl->session != nullptr) { ------------------ | Branch (1714:7): [True: 0, False: 51.3k] ------------------ 1715| | // The server is sending a new ticket for an existing session. Sessions are 1716| | // immutable once established, so duplicate all but the ticket of the 1717| | // existing session. 1718| 0| assert(!hs->new_session); 1719| 0| hs->new_session = 1720| 0| SSL_SESSION_dup(ssl->session.get(), SSL_SESSION_INCLUDE_NONAUTH); ------------------ | | 3457| 0|#define SSL_SESSION_INCLUDE_NONAUTH 0x2 ------------------ 1721| 0| if (!hs->new_session) { ------------------ | Branch (1721:9): [True: 0, False: 0] ------------------ 1722| 0| return ssl_hs_error; 1723| 0| } 1724| 0| } 1725| | 1726| | // |ticket_lifetime_hint| is measured from when the ticket was issued. 1727| 51.3k| ssl_session_rebase_time(ssl, hs->new_session.get()); 1728| | 1729| 51.3k| if (!hs->new_session->ticket.CopyFrom(ticket)) { ------------------ | Branch (1729:7): [True: 0, False: 51.3k] ------------------ 1730| 0| return ssl_hs_error; 1731| 0| } 1732| 51.3k| hs->new_session->ticket_lifetime_hint = ticket_lifetime_hint; 1733| | 1734| | // Historically, OpenSSL filled in fake session IDs for ticket-based sessions. 1735| | // TODO(davidben): Are external callers relying on this? Try removing this. 1736| 51.3k| hs->new_session->session_id.ResizeForOverwrite(SHA256_DIGEST_LENGTH); ------------------ | | 110| 51.3k|#define SHA256_DIGEST_LENGTH 32 ------------------ 1737| 51.3k| SHA256(CBS_data(&ticket), CBS_len(&ticket), 1738| 51.3k| hs->new_session->session_id.data()); 1739| | 1740| 51.3k| ssl->method->next_message(ssl); 1741| 51.3k| hs->state = state_process_change_cipher_spec; 1742| 51.3k| return ssl_hs_read_change_cipher_spec; 1743| 51.3k|} handshake_client.cc:_ZN4bsslL29do_process_change_cipher_specEPNS_13SSL_HANDSHAKEE: 1745| 51.4k|static enum ssl_hs_wait_t do_process_change_cipher_spec(SSL_HANDSHAKE *hs) { 1746| 51.4k| if (!tls1_change_cipher_state(hs, evp_aead_open)) { ------------------ | Branch (1746:7): [True: 0, False: 51.4k] ------------------ 1747| 0| return ssl_hs_error; 1748| 0| } 1749| | 1750| 51.4k| hs->state = state_read_server_finished; 1751| 51.4k| return ssl_hs_ok; 1752| 51.4k|} handshake_client.cc:_ZN4bsslL23do_read_server_finishedEPNS_13SSL_HANDSHAKEE: 1754| 103k|static enum ssl_hs_wait_t do_read_server_finished(SSL_HANDSHAKE *hs) { 1755| 103k| SSL *const ssl = hs->ssl; 1756| 103k| enum ssl_hs_wait_t wait = ssl_get_finished(hs); 1757| 103k| if (wait != ssl_hs_ok) { ------------------ | Branch (1757:7): [True: 51.8k, False: 51.3k] ------------------ 1758| 51.8k| return wait; 1759| 51.8k| } 1760| | 1761| 51.3k| if (ssl->session != NULL) { ------------------ | Branch (1761:7): [True: 171, False: 51.2k] ------------------ 1762| 171| hs->state = state_send_client_finished; 1763| 171| return ssl_hs_ok; 1764| 171| } 1765| | 1766| 51.2k| hs->state = state_finish_client_handshake; 1767| 51.2k| return ssl_hs_ok; 1768| 51.3k|} handshake_client.cc:_ZN4bsslL26do_finish_client_handshakeEPNS_13SSL_HANDSHAKEE: 1770| 51.4k|static enum ssl_hs_wait_t do_finish_client_handshake(SSL_HANDSHAKE *hs) { 1771| 51.4k| SSL *const ssl = hs->ssl; 1772| 51.4k| if (ssl->s3->ech_status == ssl_ech_rejected) { ------------------ | Branch (1772:7): [True: 0, False: 51.4k] ------------------ 1773| | // Release the retry configs. 1774| 0| hs->ech_authenticated_reject = true; 1775| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ECH_REQUIRED); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ECH_REQUIRED); ------------------ | | 4401| 0|#define SSL_AD_ECH_REQUIRED TLS1_AD_ECH_REQUIRED | | ------------------ | | | | 49| 0|#define TLS1_AD_ECH_REQUIRED 121 // draft-ietf-tls-esni-13 | | ------------------ ------------------ 1776| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_ECH_REJECTED); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1777| 0| return ssl_hs_error; 1778| 0| } 1779| | 1780| 51.4k| ssl->method->on_handshake_complete(ssl); 1781| | 1782| | // Note TLS 1.2 resumptions with ticket renewal have both |ssl->session| (the 1783| | // resumed session) and |hs->new_session| (the session with the new ticket). 1784| 51.4k| bool has_new_session = hs->new_session != nullptr; 1785| 51.4k| if (has_new_session) { ------------------ | Branch (1785:7): [True: 51.3k, False: 171] ------------------ 1786| | // When False Start is enabled, the handshake reports completion early. The 1787| | // caller may then have passed the (then unresuable) |hs->new_session| to 1788| | // another thread via |SSL_get0_session| for resumption. To avoid potential 1789| | // race conditions in such callers, we duplicate the session before 1790| | // clearing |not_resumable|. 1791| 51.3k| ssl->s3->established_session = 1792| 51.3k| SSL_SESSION_dup(hs->new_session.get(), SSL_SESSION_DUP_ALL); ------------------ | | 3459| 51.3k| (SSL_SESSION_INCLUDE_TICKET | SSL_SESSION_INCLUDE_NONAUTH) | | ------------------ | | | | 3456| 51.3k|#define SSL_SESSION_INCLUDE_TICKET 0x1 | | ------------------ | | (SSL_SESSION_INCLUDE_TICKET | SSL_SESSION_INCLUDE_NONAUTH) | | ------------------ | | | | 3457| 51.3k|#define SSL_SESSION_INCLUDE_NONAUTH 0x2 | | ------------------ ------------------ 1793| 51.3k| if (!ssl->s3->established_session) { ------------------ | Branch (1793:9): [True: 0, False: 51.3k] ------------------ 1794| 0| return ssl_hs_error; 1795| 0| } 1796| | // Renegotiations do not participate in session resumption. 1797| 51.3k| if (!ssl->s3->initial_handshake_complete) { ------------------ | Branch (1797:9): [True: 1.56k, False: 49.7k] ------------------ 1798| 1.56k| ssl->s3->established_session->not_resumable = false; 1799| 1.56k| } 1800| | 1801| 51.3k| hs->new_session.reset(); 1802| 51.3k| } else { 1803| 171| assert(ssl->session != nullptr); 1804| 171| ssl->s3->established_session = UpRef(ssl->session); 1805| 171| } 1806| | 1807| 51.4k| hs->handshake_finalized = true; 1808| 51.4k| ssl->s3->initial_handshake_complete = true; 1809| 51.4k| if (has_new_session) { ------------------ | Branch (1809:7): [True: 51.3k, False: 171] ------------------ 1810| 51.3k| ssl_update_cache(ssl); 1811| 51.3k| } 1812| | 1813| 51.4k| hs->state = state_done; 1814| 51.4k| return ssl_hs_ok; 1815| 51.4k|} _ZNK4bssl13SSLTranscript6bufferEv: 447| 28.0k| Span buffer() const { 448| 28.0k| return Span(reinterpret_cast(buffer_->data), 449| 28.0k| buffer_->length); 450| 28.0k| } _ZNK4bssl14SSLAEADContext14is_null_cipherEv: 542| 4.25M| bool is_null_cipher() const { return !cipher_; } _ZN4bssl11SSLKeyShareD2Ev: 906| 163k| virtual ~SSLKeyShare() {} _ZN4bssl9SSLBufferC2Ev: 1033| 39.8k| SSLBuffer() {} _ZN4bssl9SSLBufferD2Ev: 1034| 39.8k| ~SSLBuffer() { Clear(); } _ZN4bssl9SSLBuffer4dataEv: 1039| 2.39M| uint8_t *data() { return buf_ + offset_; } _ZNK4bssl9SSLBuffer4sizeEv: 1040| 6.22M| size_t size() const { return size_; } _ZNK4bssl9SSLBuffer5emptyEv: 1041| 171k| bool empty() const { return size_ == 0; } _ZNK4bssl9SSLBuffer3capEv: 1042| 1.91M| size_t cap() const { return cap_; } _ZN4bssl9SSLBuffer4spanEv: 1044| 1.43M| Span span() { return Span(data(), size()); } _ZN4bssl9SSLBuffer9remainingEv: 1046| 5.93k| Span remaining() { return Span(data() + size(), cap() - size()); } _ZN4bssl12SSLExtensionC2Etb: 2235| 59.5k| : type(type_arg), allowed(allowed_arg), present(false) { 2236| 59.5k| CBS_init(&data, nullptr, 0); 2237| 59.5k| } _ZNK4bssl4CERT8is_validEv: 2391| 2| bool is_valid() const { return legacy_credential != nullptr; } _ZN4bssl23SSLCipherPreferenceListC2Ev: 332| 4| SSLCipherPreferenceList() = default; _ZN4bssl10RefCountedI17ssl_credential_stEC2ENS2_13CheckSubClassE: 168| 39.8k| RefCounted(CheckSubClass) { 169| 39.8k| static_assert(std::is_base_of::value, 170| 39.8k| "Derived must subclass RefCounted"); 171| 39.8k| } _ZN4bssl10RefCountedI17ssl_credential_stE13UpRefInternalEv: 150| 28.0k| void UpRefInternal() { CRYPTO_refcount_inc(&references_); } _ZN4bssl10RefCountedI17ssl_credential_stE14DecRefInternalEv: 151| 67.8k| void DecRefInternal() { 152| 67.8k| if (CRYPTO_refcount_dec_and_test_zero(&references_)) { ------------------ | Branch (152:9): [True: 39.8k, False: 28.0k] ------------------ 153| 39.8k| Derived *d = static_cast(this); 154| 39.8k| d->~Derived(); 155| 39.8k| OPENSSL_free(d); 156| 39.8k| } 157| 67.8k| } _ZN4bssl10RefCountedI10ssl_ctx_stEC2ENS2_13CheckSubClassE: 168| 2| RefCounted(CheckSubClass) { 169| 2| static_assert(std::is_base_of::value, 170| 2| "Derived must subclass RefCounted"); 171| 2| } _ZN4bssl10RefCountedI10ssl_ctx_stE13UpRefInternalEv: 150| 39.8k| void UpRefInternal() { CRYPTO_refcount_inc(&references_); } _ZN4bssl10RefCountedI10ssl_ctx_stE14DecRefInternalEv: 151| 39.8k| void DecRefInternal() { 152| 39.8k| if (CRYPTO_refcount_dec_and_test_zero(&references_)) { ------------------ | Branch (152:9): [True: 0, False: 39.8k] ------------------ 153| 0| Derived *d = static_cast(this); 154| 0| d->~Derived(); 155| 0| OPENSSL_free(d); 156| 0| } 157| 39.8k| } _ZN4bssl10RefCountedI14ssl_session_stEC2ENS2_13CheckSubClassE: 168| 128k| RefCounted(CheckSubClass) { 169| 128k| static_assert(std::is_base_of::value, 170| 128k| "Derived must subclass RefCounted"); 171| 128k| } _ZN4bssl10RefCountedI14ssl_session_stE13UpRefInternalEv: 150| 18.6k| void UpRefInternal() { CRYPTO_refcount_inc(&references_); } _ZN4bssl10RefCountedI14ssl_session_stE14DecRefInternalEv: 151| 147k| void DecRefInternal() { 152| 147k| if (CRYPTO_refcount_dec_and_test_zero(&references_)) { ------------------ | Branch (152:9): [True: 128k, False: 18.6k] ------------------ 153| 128k| Derived *d = static_cast(this); 154| 128k| d->~Derived(); 155| 128k| OPENSSL_free(d); 156| 128k| } 157| 147k| } _ZN4bssl16tls_init_messageEPK6ssl_stP6cbb_stS4_h: 74| 217k|bool tls_init_message(const SSL *ssl, CBB *cbb, CBB *body, uint8_t type) { 75| | // Pick a modest size hint to save most of the |realloc| calls. 76| 217k| if (!CBB_init(cbb, 64) || // ------------------ | Branch (76:7): [True: 0, False: 217k] ------------------ 77| 217k| !CBB_add_u8(cbb, type) || // ------------------ | Branch (77:7): [True: 0, False: 217k] ------------------ 78| 217k| !CBB_add_u24_length_prefixed(cbb, body)) { ------------------ | Branch (78:7): [True: 0, False: 217k] ------------------ 79| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 80| 0| CBB_cleanup(cbb); 81| 0| return false; 82| 0| } 83| | 84| 217k| return true; 85| 217k|} _ZN4bssl18tls_finish_messageEPK6ssl_stP6cbb_stPNS_5ArrayIhEE: 87| 217k|bool tls_finish_message(const SSL *ssl, CBB *cbb, Array *out_msg) { 88| 217k| return CBBFinishArray(cbb, out_msg); 89| 217k|} _ZN4bssl15tls_add_messageEP6ssl_stNS_5ArrayIhEE: 91| 217k|bool tls_add_message(SSL *ssl, Array msg) { 92| | // Pack handshake data into the minimal number of records. This avoids 93| | // unnecessary encryption overhead, notably in TLS 1.3 where we send several 94| | // encrypted messages in a row. For now, we do not do this for the null 95| | // cipher. The benefit is smaller and there is a risk of breaking buggy 96| | // implementations. 97| | // 98| | // TODO(crbug.com/374991962): See if we can do this uniformly. 99| 217k| Span rest = msg; 100| 217k| if (!SSL_is_quic(ssl) && ssl->s3->aead_write_ctx->is_null_cipher()) { ------------------ | Branch (100:7): [True: 217k, False: 0] | Branch (100:28): [True: 8.23k, False: 208k] ------------------ 101| 16.4k| while (!rest.empty()) { ------------------ | Branch (101:12): [True: 8.23k, False: 8.23k] ------------------ 102| 8.23k| Span chunk = rest.subspan(0, ssl->max_send_fragment); 103| 8.23k| rest = rest.subspan(chunk.size()); 104| | 105| 8.23k| if (!add_record_to_flight(ssl, SSL3_RT_HANDSHAKE, chunk)) { ------------------ | | 167| 8.23k|#define SSL3_RT_HANDSHAKE 22 ------------------ | Branch (105:11): [True: 0, False: 8.23k] ------------------ 106| 0| return false; 107| 0| } 108| 8.23k| } 109| 208k| } else { 110| 417k| while (!rest.empty()) { ------------------ | Branch (110:12): [True: 208k, False: 208k] ------------------ 111| | // Flush if |pending_hs_data| is full. 112| 208k| if (ssl->s3->pending_hs_data && ------------------ | Branch (112:11): [True: 55.1k, False: 153k] ------------------ 113| 208k| ssl->s3->pending_hs_data->length >= ssl->max_send_fragment && ------------------ | Branch (113:11): [True: 0, False: 55.1k] ------------------ 114| 208k| !tls_flush_pending_hs_data(ssl)) { ------------------ | Branch (114:11): [True: 0, False: 0] ------------------ 115| 0| return false; 116| 0| } 117| | 118| 208k| size_t pending_len = 119| 208k| ssl->s3->pending_hs_data ? ssl->s3->pending_hs_data->length : 0; ------------------ | Branch (119:11): [True: 55.1k, False: 153k] ------------------ 120| 208k| Span chunk = 121| 208k| rest.subspan(0, ssl->max_send_fragment - pending_len); 122| 208k| assert(!chunk.empty()); 123| 208k| rest = rest.subspan(chunk.size()); 124| | 125| 208k| if (!ssl->s3->pending_hs_data) { ------------------ | Branch (125:11): [True: 153k, False: 55.1k] ------------------ 126| 153k| ssl->s3->pending_hs_data.reset(BUF_MEM_new()); 127| 153k| } 128| 208k| if (!ssl->s3->pending_hs_data || ------------------ | Branch (128:11): [True: 0, False: 208k] ------------------ 129| 208k| !BUF_MEM_append(ssl->s3->pending_hs_data.get(), chunk.data(), ------------------ | Branch (129:11): [True: 0, False: 208k] ------------------ 130| 208k| chunk.size())) { 131| 0| return false; 132| 0| } 133| 208k| } 134| 208k| } 135| | 136| 217k| ssl_do_msg_callback(ssl, 1 /* write */, SSL3_RT_HANDSHAKE, msg); ------------------ | | 167| 217k|#define SSL3_RT_HANDSHAKE 22 ------------------ 137| | // TODO(svaldez): Move this up a layer to fix abstraction for SSLTranscript on 138| | // hs. 139| 217k| if (ssl->s3->hs != NULL && // ------------------ | Branch (139:7): [True: 217k, False: 0] ------------------ 140| 217k| !ssl->s3->hs->transcript.Update(msg)) { ------------------ | Branch (140:7): [True: 0, False: 217k] ------------------ 141| 0| return false; 142| 0| } 143| 217k| return true; 144| 217k|} _ZN4bssl25tls_flush_pending_hs_dataEP6ssl_st: 146| 216k|bool tls_flush_pending_hs_data(SSL *ssl) { 147| 216k| if (!ssl->s3->pending_hs_data || ssl->s3->pending_hs_data->length == 0) { ------------------ | Branch (147:7): [True: 63.2k, False: 153k] | Branch (147:36): [True: 0, False: 153k] ------------------ 148| 63.2k| return true; 149| 63.2k| } 150| | 151| 153k| UniquePtr pending_hs_data = std::move(ssl->s3->pending_hs_data); 152| 153k| auto data = Span(reinterpret_cast(pending_hs_data->data), 153| 153k| pending_hs_data->length); 154| 153k| if (SSL_is_quic(ssl)) { ------------------ | Branch (154:7): [True: 0, False: 153k] ------------------ 155| 0| if ((ssl->s3->hs == nullptr || !ssl->s3->hs->hints_requested) && ------------------ | Branch (155:10): [True: 0, False: 0] | Branch (155:36): [True: 0, False: 0] ------------------ 156| 0| !ssl->quic_method->add_handshake_data(ssl, ssl->s3->quic_write_level, ------------------ | Branch (156:9): [True: 0, False: 0] ------------------ 157| 0| data.data(), data.size())) { 158| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_QUIC_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 159| 0| return false; 160| 0| } 161| 0| return true; 162| 0| } 163| | 164| 153k| return add_record_to_flight(ssl, SSL3_RT_HANDSHAKE, data); ------------------ | | 167| 153k|#define SSL3_RT_HANDSHAKE 22 ------------------ 165| 153k|} _ZN4bssl26tls_add_change_cipher_specEP6ssl_st: 167| 52.7k|bool tls_add_change_cipher_spec(SSL *ssl) { 168| 52.7k| if (SSL_is_quic(ssl)) { ------------------ | Branch (168:7): [True: 0, False: 52.7k] ------------------ 169| 0| return true; 170| 0| } 171| | 172| 52.7k| static const uint8_t kChangeCipherSpec[1] = {SSL3_MT_CCS}; ------------------ | | 222| 52.7k|#define SSL3_MT_CCS 1 ------------------ 173| 52.7k| if (!tls_flush_pending_hs_data(ssl) || ------------------ | Branch (173:7): [True: 0, False: 52.7k] ------------------ 174| 52.7k| !add_record_to_flight(ssl, SSL3_RT_CHANGE_CIPHER_SPEC, ------------------ | | 165| 52.7k|#define SSL3_RT_CHANGE_CIPHER_SPEC 20 ------------------ | Branch (174:7): [True: 0, False: 52.7k] ------------------ 175| 52.7k| kChangeCipherSpec)) { 176| 0| return false; 177| 0| } 178| | 179| 52.7k| ssl_do_msg_callback(ssl, 1 /* write */, SSL3_RT_CHANGE_CIPHER_SPEC, ------------------ | | 165| 52.7k|#define SSL3_RT_CHANGE_CIPHER_SPEC 20 ------------------ 180| 52.7k| kChangeCipherSpec); 181| 52.7k| return true; 182| 52.7k|} _ZN4bssl9tls_flushEP6ssl_st: 184| 108k|int tls_flush(SSL *ssl) { 185| 108k| if (!tls_flush_pending_hs_data(ssl)) { ------------------ | Branch (185:7): [True: 0, False: 108k] ------------------ 186| 0| return -1; 187| 0| } 188| | 189| 108k| if (SSL_is_quic(ssl)) { ------------------ | Branch (189:7): [True: 0, False: 108k] ------------------ 190| 0| if (ssl->s3->write_shutdown != ssl_shutdown_none) { ------------------ | Branch (190:9): [True: 0, False: 0] ------------------ 191| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_PROTOCOL_IS_SHUTDOWN); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 192| 0| return -1; 193| 0| } 194| | 195| 0| if (!ssl->quic_method->flush_flight(ssl)) { ------------------ | Branch (195:9): [True: 0, False: 0] ------------------ 196| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_QUIC_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 197| 0| return -1; 198| 0| } 199| 0| } 200| | 201| 108k| if (ssl->s3->pending_flight == nullptr) { ------------------ | Branch (201:7): [True: 0, False: 108k] ------------------ 202| 0| return 1; 203| 0| } 204| | 205| 108k| if (ssl->s3->write_shutdown != ssl_shutdown_none) { ------------------ | Branch (205:7): [True: 0, False: 108k] ------------------ 206| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_PROTOCOL_IS_SHUTDOWN); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 207| 0| return -1; 208| 0| } 209| | 210| 108k| static_assert(INT_MAX <= 0xffffffff, "int is larger than 32 bits"); 211| 108k| if (ssl->s3->pending_flight->length > INT_MAX) { ------------------ | Branch (211:7): [True: 0, False: 108k] ------------------ 212| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 213| 0| return -1; 214| 0| } 215| | 216| | // If there is pending data in the write buffer, it must be flushed out before 217| | // any new data in pending_flight. 218| 108k| if (!ssl->s3->write_buffer.empty()) { ------------------ | Branch (218:7): [True: 0, False: 108k] ------------------ 219| 0| int ret = ssl_write_buffer_flush(ssl); 220| 0| if (ret <= 0) { ------------------ | Branch (220:9): [True: 0, False: 0] ------------------ 221| 0| ssl->s3->rwstate = SSL_ERROR_WANT_WRITE; ------------------ | | 386| 0|#define SSL_ERROR_WANT_WRITE 3 ------------------ 222| 0| return ret; 223| 0| } 224| 0| } 225| | 226| 108k| if (ssl->wbio == nullptr) { ------------------ | Branch (226:7): [True: 0, False: 108k] ------------------ 227| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_BIO_NOT_SET); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 228| 0| return -1; 229| 0| } 230| | 231| | // Write the pending flight. 232| 217k| while (ssl->s3->pending_flight_offset < ssl->s3->pending_flight->length) { ------------------ | Branch (232:10): [True: 108k, False: 108k] ------------------ 233| 108k| int ret = BIO_write( 234| 108k| ssl->wbio.get(), 235| 108k| ssl->s3->pending_flight->data + ssl->s3->pending_flight_offset, 236| 108k| ssl->s3->pending_flight->length - ssl->s3->pending_flight_offset); 237| 108k| if (ret <= 0) { ------------------ | Branch (237:9): [True: 0, False: 108k] ------------------ 238| 0| ssl->s3->rwstate = SSL_ERROR_WANT_WRITE; ------------------ | | 386| 0|#define SSL_ERROR_WANT_WRITE 3 ------------------ 239| 0| return ret; 240| 0| } 241| | 242| 108k| ssl->s3->pending_flight_offset += ret; 243| 108k| } 244| | 245| 108k| if (BIO_flush(ssl->wbio.get()) <= 0) { ------------------ | Branch (245:7): [True: 0, False: 108k] ------------------ 246| 0| ssl->s3->rwstate = SSL_ERROR_WANT_WRITE; ------------------ | | 386| 0|#define SSL_ERROR_WANT_WRITE 3 ------------------ 247| 0| return -1; 248| 0| } 249| | 250| 108k| ssl->s3->pending_flight.reset(); 251| 108k| ssl->s3->pending_flight_offset = 0; 252| 108k| return 1; 253| 108k|} _ZN4bssl15tls_get_messageEPK6ssl_stPNS_10SSLMessageE: 404| 1.37M|bool tls_get_message(const SSL *ssl, SSLMessage *out) { 405| 1.37M| size_t unused; 406| 1.37M| if (!parse_message(ssl, out, &unused)) { ------------------ | Branch (406:7): [True: 543k, False: 836k] ------------------ 407| 543k| return false; 408| 543k| } 409| 836k| if (!ssl->s3->has_message) { ------------------ | Branch (409:7): [True: 399k, False: 437k] ------------------ 410| 399k| if (!out->is_v2_hello) { ------------------ | Branch (410:9): [True: 399k, False: 0] ------------------ 411| 399k| ssl_do_msg_callback(ssl, 0 /* read */, SSL3_RT_HANDSHAKE, out->raw); ------------------ | | 167| 399k|#define SSL3_RT_HANDSHAKE 22 ------------------ 412| 399k| } 413| 399k| ssl->s3->has_message = true; 414| 399k| } 415| 836k| return true; 416| 1.37M|} _ZN4bssl29tls_can_accept_handshake_dataEPK6ssl_stPh: 418| 1.43M|bool tls_can_accept_handshake_data(const SSL *ssl, uint8_t *out_alert) { 419| | // If there is a complete message, the caller must have consumed it first. 420| 1.43M| SSLMessage msg; 421| 1.43M| size_t bytes_needed; 422| 1.43M| if (parse_message(ssl, &msg, &bytes_needed)) { ------------------ | Branch (422:7): [True: 1, False: 1.43M] ------------------ 423| 1| OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 1| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 424| 1| *out_alert = SSL_AD_INTERNAL_ERROR; ------------------ | | 4387| 1|#define SSL_AD_INTERNAL_ERROR TLS1_AD_INTERNAL_ERROR | | ------------------ | | | | 37| 1|#define TLS1_AD_INTERNAL_ERROR 80 | | ------------------ ------------------ 425| 1| return false; 426| 1| } 427| | 428| | // Enforce the limit so the peer cannot force us to buffer 16MB. 429| 1.43M| if (bytes_needed > 4 + ssl_max_handshake_message_len(ssl)) { ------------------ | Branch (429:7): [True: 106, False: 1.43M] ------------------ 430| 106| OPENSSL_PUT_ERROR(SSL, SSL_R_EXCESSIVE_MESSAGE_SIZE); ------------------ | | 361| 106| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 431| 106| *out_alert = SSL_AD_ILLEGAL_PARAMETER; ------------------ | | 4379| 106|#define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER | | ------------------ | | | | 189| 106|#define SSL3_AD_ILLEGAL_PARAMETER 47 // fatal | | ------------------ ------------------ 432| 106| return false; 433| 106| } 434| | 435| 1.43M| return true; 436| 1.43M|} _ZN4bssl34tls_has_unprocessed_handshake_dataEPK6ssl_st: 438| 211k|bool tls_has_unprocessed_handshake_data(const SSL *ssl) { 439| 211k| size_t msg_len = 0; 440| 211k| if (ssl->s3->has_message) { ------------------ | Branch (440:7): [True: 104k, False: 107k] ------------------ 441| 104k| SSLMessage msg; 442| 104k| size_t unused; 443| 104k| if (parse_message(ssl, &msg, &unused)) { ------------------ | Branch (443:9): [True: 104k, False: 0] ------------------ 444| 104k| msg_len = CBS_len(&msg.raw); 445| 104k| } 446| 104k| } 447| | 448| 211k| return ssl->s3->hs_buf && ssl->s3->hs_buf->length > msg_len; ------------------ | Branch (448:10): [True: 208k, False: 2.76k] | Branch (448:29): [True: 51, False: 208k] ------------------ 449| 211k|} _ZN4bssl25tls_append_handshake_dataEP6ssl_stNS_4SpanIKhEE: 451| 421k|bool tls_append_handshake_data(SSL *ssl, Span data) { 452| | // Re-create the handshake buffer if needed. 453| 421k| if (!ssl->s3->hs_buf) { ------------------ | Branch (453:7): [True: 57.5k, False: 364k] ------------------ 454| 57.5k| ssl->s3->hs_buf.reset(BUF_MEM_new()); 455| 57.5k| } 456| 421k| return ssl->s3->hs_buf && ------------------ | Branch (456:10): [True: 421k, False: 0] ------------------ 457| 421k| BUF_MEM_append(ssl->s3->hs_buf.get(), data.data(), data.size()); ------------------ | Branch (457:10): [True: 421k, False: 0] ------------------ 458| 421k|} _ZN4bssl18tls_open_handshakeEP6ssl_stPmPhNS_4SpanIhEE: 461| 1.10M| uint8_t *out_alert, Span in) { 462| 1.10M| *out_consumed = 0; 463| | // Bypass the record layer for the first message to handle V2ClientHello. 464| 1.10M| if (ssl->server && !ssl->s3->v2_hello_done) { ------------------ | Branch (464:7): [True: 0, False: 1.10M] | Branch (464:22): [True: 0, False: 0] ------------------ 465| | // Ask for the first 5 bytes, the size of the TLS record header. This is 466| | // sufficient to detect a V2ClientHello and ensures that we never read 467| | // beyond the first record. 468| 0| if (in.size() < SSL3_RT_HEADER_LENGTH) { ------------------ | | 104| 0|#define SSL3_RT_HEADER_LENGTH 5 ------------------ | Branch (468:9): [True: 0, False: 0] ------------------ 469| 0| *out_consumed = SSL3_RT_HEADER_LENGTH; ------------------ | | 104| 0|#define SSL3_RT_HEADER_LENGTH 5 ------------------ 470| 0| return ssl_open_record_partial; 471| 0| } 472| | 473| | // Some dedicated error codes for protocol mixups should the application 474| | // wish to interpret them differently. (These do not overlap with 475| | // ClientHello or V2ClientHello.) 476| 0| auto str = bssl::BytesAsStringView(in); 477| 0| if (str.substr(0, 4) == "GET " || // ------------------ | Branch (477:9): [True: 0, False: 0] ------------------ 478| 0| str.substr(0, 5) == "POST " || // ------------------ | Branch (478:9): [True: 0, False: 0] ------------------ 479| 0| str.substr(0, 5) == "HEAD " || // ------------------ | Branch (479:9): [True: 0, False: 0] ------------------ 480| 0| str.substr(0, 4) == "PUT ") { ------------------ | Branch (480:9): [True: 0, False: 0] ------------------ 481| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_HTTP_REQUEST); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 482| 0| *out_alert = 0; 483| 0| return ssl_open_record_error; 484| 0| } 485| 0| if (str.substr(0, 5) == "CONNE") { ------------------ | Branch (485:9): [True: 0, False: 0] ------------------ 486| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_HTTPS_PROXY_REQUEST); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 487| 0| *out_alert = 0; 488| 0| return ssl_open_record_error; 489| 0| } 490| | 491| | // Check for a V2ClientHello. 492| 0| if ((in[0] & 0x80) != 0 && in[2] == SSL2_MT_CLIENT_HELLO && ------------------ | | 28| 0|#define SSL2_MT_CLIENT_HELLO 1 ------------------ | Branch (492:9): [True: 0, False: 0] | Branch (492:32): [True: 0, False: 0] ------------------ 493| 0| in[3] == SSL3_VERSION_MAJOR) { ------------------ | | 539| 0|#define SSL3_VERSION_MAJOR 0x03 ------------------ | Branch (493:9): [True: 0, False: 0] ------------------ 494| 0| auto ret = read_v2_client_hello(ssl, out_consumed, in); 495| 0| if (ret == ssl_open_record_error) { ------------------ | Branch (495:11): [True: 0, False: 0] ------------------ 496| 0| *out_alert = 0; 497| 0| } else if (ret == ssl_open_record_success) { ------------------ | Branch (497:18): [True: 0, False: 0] ------------------ 498| 0| ssl->s3->v2_hello_done = true; 499| 0| } 500| 0| return ret; 501| 0| } 502| | 503| 0| ssl->s3->v2_hello_done = true; 504| 0| } 505| | 506| 1.10M| uint8_t type; 507| 1.10M| Span body; 508| 1.10M| auto ret = tls_open_record(ssl, &type, &body, out_consumed, out_alert, in); 509| 1.10M| if (ret != ssl_open_record_success) { ------------------ | Branch (509:7): [True: 739k, False: 368k] ------------------ 510| 739k| return ret; 511| 739k| } 512| | 513| 368k| if (type != SSL3_RT_HANDSHAKE) { ------------------ | | 167| 368k|#define SSL3_RT_HANDSHAKE 22 ------------------ | Branch (513:7): [True: 46, False: 368k] ------------------ 514| 46| OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_RECORD); ------------------ | | 361| 46| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 515| 46| *out_alert = SSL_AD_UNEXPECTED_MESSAGE; ------------------ | | 4367| 46|#define SSL_AD_UNEXPECTED_MESSAGE SSL3_AD_UNEXPECTED_MESSAGE | | ------------------ | | | | 179| 46|#define SSL3_AD_UNEXPECTED_MESSAGE 10 // fatal | | ------------------ ------------------ 516| 46| return ssl_open_record_error; 517| 46| } 518| | 519| | // Append the entire handshake record to the buffer. 520| 368k| if (!tls_append_handshake_data(ssl, body)) { ------------------ | Branch (520:7): [True: 0, False: 368k] ------------------ 521| 0| *out_alert = SSL_AD_INTERNAL_ERROR; ------------------ | | 4387| 0|#define SSL_AD_INTERNAL_ERROR TLS1_AD_INTERNAL_ERROR | | ------------------ | | | | 37| 0|#define TLS1_AD_INTERNAL_ERROR 80 | | ------------------ ------------------ 522| 0| return ssl_open_record_error; 523| 0| } 524| | 525| 368k| return ssl_open_record_success; 526| 368k|} _ZN4bssl16tls_next_messageEP6ssl_st: 528| 397k|void tls_next_message(SSL *ssl) { 529| 397k| SSLMessage msg; 530| 397k| if (!tls_get_message(ssl, &msg) || // ------------------ | Branch (530:7): [True: 0, False: 397k] ------------------ 531| 397k| !ssl->s3->hs_buf || // ------------------ | Branch (531:7): [True: 0, False: 397k] ------------------ 532| 397k| ssl->s3->hs_buf->length < CBS_len(&msg.raw)) { ------------------ | Branch (532:7): [True: 0, False: 397k] ------------------ 533| 0| assert(0); 534| 0| return; 535| 0| } 536| | 537| 397k| OPENSSL_memmove(ssl->s3->hs_buf->data, 538| 397k| ssl->s3->hs_buf->data + CBS_len(&msg.raw), 539| 397k| ssl->s3->hs_buf->length - CBS_len(&msg.raw)); 540| 397k| ssl->s3->hs_buf->length -= CBS_len(&msg.raw); 541| 397k| ssl->s3->is_v2_hello = false; 542| 397k| ssl->s3->has_message = false; 543| | 544| | // Post-handshake messages are rare, so release the buffer after every 545| | // message. During the handshake, |on_handshake_complete| will release it. 546| 397k| if (!SSL_in_init(ssl) && ssl->s3->hs_buf->length == 0) { ------------------ | Branch (546:7): [True: 1.47k, False: 395k] | Branch (546:28): [True: 1.46k, False: 1] ------------------ 547| 1.46k| ssl->s3->hs_buf.reset(); 548| 1.46k| } 549| 397k|} _ZN4bssl29ssl_tls13_cipher_meets_policyEt23ssl_compliance_policy_t: 601| 169k| enum ssl_compliance_policy_t policy) { 602| 169k| switch (policy) { ------------------ | Branch (602:11): [True: 0, False: 169k] ------------------ 603| 169k| case ssl_compliance_policy_none: ------------------ | Branch (603:5): [True: 169k, False: 0] ------------------ 604| 169k| case ssl_compliance_policy_cnsa_202407: ------------------ | Branch (604:5): [True: 0, False: 169k] ------------------ 605| 169k| return true; 606| | 607| 0| case ssl_compliance_policy_fips_202205: ------------------ | Branch (607:5): [True: 0, False: 169k] ------------------ 608| 0| switch (cipher_id) { 609| 0| case TLS1_3_CK_AES_128_GCM_SHA256 & 0xffff: ------------------ | | 337| 0|#define TLS1_3_CK_AES_128_GCM_SHA256 0x03001301 ------------------ | Branch (609:9): [True: 0, False: 0] ------------------ 610| 0| case TLS1_3_CK_AES_256_GCM_SHA384 & 0xffff: ------------------ | | 338| 0|#define TLS1_3_CK_AES_256_GCM_SHA384 0x03001302 ------------------ | Branch (610:9): [True: 0, False: 0] ------------------ 611| 0| return true; 612| 0| case TLS1_3_CK_CHACHA20_POLY1305_SHA256 & 0xffff: ------------------ | | 339| 0|#define TLS1_3_CK_CHACHA20_POLY1305_SHA256 0x03001303 ------------------ | Branch (612:9): [True: 0, False: 0] ------------------ 613| 0| return false; 614| 0| default: ------------------ | Branch (614:9): [True: 0, False: 0] ------------------ 615| 0| assert(false); 616| 0| return false; 617| 0| } 618| | 619| 0| case ssl_compliance_policy_wpa3_192_202304: ------------------ | Branch (619:5): [True: 0, False: 169k] ------------------ 620| 0| switch (cipher_id) { 621| 0| case TLS1_3_CK_AES_256_GCM_SHA384 & 0xffff: ------------------ | | 338| 0|#define TLS1_3_CK_AES_256_GCM_SHA384 0x03001302 ------------------ | Branch (621:9): [True: 0, False: 0] ------------------ 622| 0| return true; 623| 0| case TLS1_3_CK_AES_128_GCM_SHA256 & 0xffff: ------------------ | | 337| 0|#define TLS1_3_CK_AES_128_GCM_SHA256 0x03001301 ------------------ | Branch (623:9): [True: 0, False: 0] ------------------ 624| 0| case TLS1_3_CK_CHACHA20_POLY1305_SHA256 & 0xffff: ------------------ | | 339| 0|#define TLS1_3_CK_CHACHA20_POLY1305_SHA256 0x03001303 ------------------ | Branch (624:9): [True: 0, False: 0] ------------------ 625| 0| return false; 626| 0| default: ------------------ | Branch (626:9): [True: 0, False: 0] ------------------ 627| 0| assert(false); 628| 0| return false; 629| 0| } 630| 169k| } 631| | 632| 0| assert(false); 633| 0| return false; 634| 0|} s3_both.cc:_ZN4bsslL20add_record_to_flightEP6ssl_sthNS_4SpanIKhEE: 41| 214k| Span in) { 42| | // The caller should have flushed |pending_hs_data| first. 43| 214k| assert(!ssl->s3->pending_hs_data); 44| | // We'll never add a flight while in the process of writing it out. 45| 214k| assert(ssl->s3->pending_flight_offset == 0); 46| | 47| 214k| if (ssl->s3->pending_flight == nullptr) { ------------------ | Branch (47:7): [True: 109k, False: 105k] ------------------ 48| 109k| ssl->s3->pending_flight.reset(BUF_MEM_new()); 49| 109k| if (ssl->s3->pending_flight == nullptr) { ------------------ | Branch (49:9): [True: 0, False: 109k] ------------------ 50| 0| return false; 51| 0| } 52| 109k| } 53| | 54| 214k| size_t max_out = in.size() + SSL_max_seal_overhead(ssl); 55| 214k| size_t new_cap = ssl->s3->pending_flight->length + max_out; 56| 214k| if (max_out < in.size() || new_cap < max_out) { ------------------ | Branch (56:7): [True: 0, False: 214k] | Branch (56:30): [True: 0, False: 214k] ------------------ 57| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_OVERFLOW); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 58| 0| return false; 59| 0| } 60| | 61| 214k| size_t len; 62| 214k| if (!BUF_MEM_reserve(ssl->s3->pending_flight.get(), new_cap) || ------------------ | Branch (62:7): [True: 0, False: 214k] ------------------ 63| 214k| !tls_seal_record(ssl, ------------------ | Branch (63:7): [True: 0, False: 214k] ------------------ 64| 214k| (uint8_t *)ssl->s3->pending_flight->data + 65| 214k| ssl->s3->pending_flight->length, 66| 214k| &len, max_out, type, in.data(), in.size())) { 67| 0| return false; 68| 0| } 69| | 70| 214k| ssl->s3->pending_flight->length += len; 71| 214k| return true; 72| 214k|} s3_both.cc:_ZN4bsslL13parse_messageEPK6ssl_stPNS_10SSLMessageEPm: 377| 2.91M| size_t *out_bytes_needed) { 378| 2.91M| if (!ssl->s3->hs_buf) { ------------------ | Branch (378:7): [True: 351k, False: 2.56M] ------------------ 379| 351k| *out_bytes_needed = 4; 380| 351k| return false; 381| 351k| } 382| | 383| 2.56M| CBS cbs; 384| 2.56M| uint32_t len; 385| 2.56M| CBS_init(&cbs, reinterpret_cast(ssl->s3->hs_buf->data), 386| 2.56M| ssl->s3->hs_buf->length); 387| 2.56M| if (!CBS_get_u8(&cbs, &out->type) || // ------------------ | Branch (387:7): [True: 1.56M, False: 1.00M] ------------------ 388| 2.56M| !CBS_get_u24(&cbs, &len)) { ------------------ | Branch (388:7): [True: 5.18k, False: 1.00M] ------------------ 389| 1.56M| *out_bytes_needed = 4; 390| 1.56M| return false; 391| 1.56M| } 392| | 393| 1.00M| if (!CBS_get_bytes(&cbs, &out->body, len)) { ------------------ | Branch (393:7): [True: 60.7k, False: 940k] ------------------ 394| 60.7k| *out_bytes_needed = 4 + len; 395| 60.7k| return false; 396| 60.7k| } 397| | 398| 940k| CBS_init(&out->raw, reinterpret_cast(ssl->s3->hs_buf->data), 399| 940k| 4 + len); 400| 940k| out->is_v2_hello = ssl->s3->is_v2_hello; 401| 940k| return true; 402| 1.00M|} _ZN4bssl10SSL3_STATEC2Ev: 35| 19.9k| : skip_early_data(false), 36| 19.9k| v2_hello_done(false), 37| 19.9k| is_v2_hello(false), 38| 19.9k| has_message(false), 39| 19.9k| initial_handshake_complete(false), 40| 19.9k| session_reused(false), 41| 19.9k| send_connection_binding(false), 42| 19.9k| channel_id_valid(false), 43| 19.9k| key_update_pending(false), 44| 19.9k| early_data_accepted(false), 45| 19.9k| alert_dispatch(false), 46| 19.9k| renegotiate_pending(false), 47| 19.9k| used_hello_retry_request(false), 48| 19.9k| was_key_usage_invalid(false) {} _ZN4bssl10SSL3_STATED2Ev: 50| 19.9k|SSL3_STATE::~SSL3_STATE() {} _ZN4bssl7tls_newEP6ssl_st: 52| 19.9k|bool tls_new(SSL *ssl) { 53| 19.9k| UniquePtr s3 = MakeUnique(); 54| 19.9k| if (!s3) { ------------------ | Branch (54:7): [True: 0, False: 19.9k] ------------------ 55| 0| return false; 56| 0| } 57| | 58| | // TODO(crbug.com/368805255): Fields that aren't used in DTLS should not be 59| | // allocated at all. 60| | // TODO(crbug.com/371998381): Don't create these in QUIC either, once the 61| | // placeholder QUIC ones for subsequent epochs are removed. 62| 19.9k| if (!SSL_is_dtls(ssl)) { ------------------ | Branch (62:7): [True: 19.9k, False: 0] ------------------ 63| 19.9k| s3->aead_read_ctx = SSLAEADContext::CreateNullCipher(); 64| 19.9k| s3->aead_write_ctx = SSLAEADContext::CreateNullCipher(); 65| 19.9k| if (!s3->aead_read_ctx || !s3->aead_write_ctx) { ------------------ | Branch (65:9): [True: 0, False: 19.9k] | Branch (65:31): [True: 0, False: 19.9k] ------------------ 66| 0| return false; 67| 0| } 68| 19.9k| } 69| | 70| 19.9k| s3->hs = ssl_handshake_new(ssl); 71| 19.9k| if (!s3->hs) { ------------------ | Branch (71:7): [True: 0, False: 19.9k] ------------------ 72| 0| return false; 73| 0| } 74| | 75| 19.9k| ssl->s3 = s3.release(); 76| 19.9k| return true; 77| 19.9k|} _ZN4bssl8tls_freeEP6ssl_st: 79| 19.9k|void tls_free(SSL *ssl) { 80| 19.9k| if (ssl->s3 == NULL) { ------------------ | Branch (80:7): [True: 0, False: 19.9k] ------------------ 81| 0| return; 82| 0| } 83| | 84| 19.9k| Delete(ssl->s3); 85| 19.9k| ssl->s3 = NULL; 86| 19.9k|} _ZN4bssl17tls_open_app_dataEP6ssl_stPNS_4SpanIhEEPmPhS3_: 238| 172k| Span in) { 239| 172k| assert(ssl_can_read(ssl)); 240| 172k| assert(!ssl->s3->aead_read_ctx->is_null_cipher()); 241| | 242| 172k| uint8_t type; 243| 172k| Span body; 244| 172k| auto ret = tls_open_record(ssl, &type, &body, out_consumed, out_alert, in); 245| 172k| if (ret != ssl_open_record_success) { ------------------ | Branch (245:7): [True: 114k, False: 57.2k] ------------------ 246| 114k| return ret; 247| 114k| } 248| | 249| 57.2k| const bool is_early_data_read = ssl->server && SSL_in_early_data(ssl); ------------------ | Branch (249:35): [True: 0, False: 57.2k] | Branch (249:50): [True: 0, False: 0] ------------------ 250| | 251| 57.2k| if (type == SSL3_RT_HANDSHAKE) { ------------------ | | 167| 57.2k|#define SSL3_RT_HANDSHAKE 22 ------------------ | Branch (251:7): [True: 53.2k, False: 4.03k] ------------------ 252| | // Post-handshake data prior to TLS 1.3 is always renegotiation, which we 253| | // never accept as a server. Otherwise |tls_get_message| will send 254| | // |SSL_R_EXCESSIVE_MESSAGE_SIZE|. 255| 53.2k| if (ssl->server && ssl_protocol_version(ssl) < TLS1_3_VERSION) { ------------------ | | 545| 0|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (255:9): [True: 0, False: 53.2k] | Branch (255:24): [True: 0, False: 0] ------------------ 256| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_NO_RENEGOTIATION); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 257| 0| *out_alert = SSL_AD_NO_RENEGOTIATION; ------------------ | | 4390| 0|#define SSL_AD_NO_RENEGOTIATION TLS1_AD_NO_RENEGOTIATION | | ------------------ | | | | 39| 0|#define TLS1_AD_NO_RENEGOTIATION 100 | | ------------------ ------------------ 258| 0| return ssl_open_record_error; 259| 0| } 260| | 261| 53.2k| if (!tls_append_handshake_data(ssl, body)) { ------------------ | Branch (261:9): [True: 0, False: 53.2k] ------------------ 262| 0| *out_alert = SSL_AD_INTERNAL_ERROR; ------------------ | | 4387| 0|#define SSL_AD_INTERNAL_ERROR TLS1_AD_INTERNAL_ERROR | | ------------------ | | | | 37| 0|#define TLS1_AD_INTERNAL_ERROR 80 | | ------------------ ------------------ 263| 0| return ssl_open_record_error; 264| 0| } 265| 53.2k| return ssl_open_record_discard; 266| 53.2k| } 267| | 268| 4.03k| if (type != SSL3_RT_APPLICATION_DATA) { ------------------ | | 168| 4.03k|#define SSL3_RT_APPLICATION_DATA 23 ------------------ | Branch (268:7): [True: 19, False: 4.01k] ------------------ 269| 19| OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_RECORD); ------------------ | | 361| 19| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 270| 19| *out_alert = SSL_AD_UNEXPECTED_MESSAGE; ------------------ | | 4367| 19|#define SSL_AD_UNEXPECTED_MESSAGE SSL3_AD_UNEXPECTED_MESSAGE | | ------------------ | | | | 179| 19|#define SSL3_AD_UNEXPECTED_MESSAGE 10 // fatal | | ------------------ ------------------ 271| 19| return ssl_open_record_error; 272| 19| } 273| | 274| 4.01k| if (is_early_data_read) { ------------------ | Branch (274:7): [True: 0, False: 4.01k] ------------------ 275| 0| if (body.size() > kMaxEarlyDataAccepted - ssl->s3->hs->early_data_read) { ------------------ | Branch (275:9): [True: 0, False: 0] ------------------ 276| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_TOO_MUCH_READ_EARLY_DATA); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 277| 0| *out_alert = SSL3_AD_UNEXPECTED_MESSAGE; ------------------ | | 179| 0|#define SSL3_AD_UNEXPECTED_MESSAGE 10 // fatal ------------------ 278| 0| return ssl_open_record_error; 279| 0| } 280| | 281| 0| ssl->s3->hs->early_data_read += body.size(); 282| 0| } 283| | 284| 4.01k| if (body.empty()) { ------------------ | Branch (284:7): [True: 1.94k, False: 2.07k] ------------------ 285| 1.94k| return ssl_open_record_discard; 286| 1.94k| } 287| | 288| 2.07k| *out = body; 289| 2.07k| return ssl_open_record_success; 290| 4.01k|} _ZN4bssl27tls_open_change_cipher_specEP6ssl_stPmPhNS_4SpanIhEE: 294| 154k| Span in) { 295| 154k| uint8_t type; 296| 154k| Span body; 297| 154k| auto ret = tls_open_record(ssl, &type, &body, out_consumed, out_alert, in); 298| 154k| if (ret != ssl_open_record_success) { ------------------ | Branch (298:7): [True: 103k, False: 51.4k] ------------------ 299| 103k| return ret; 300| 103k| } 301| | 302| 51.4k| if (type != SSL3_RT_CHANGE_CIPHER_SPEC) { ------------------ | | 165| 51.4k|#define SSL3_RT_CHANGE_CIPHER_SPEC 20 ------------------ | Branch (302:7): [True: 4, False: 51.4k] ------------------ 303| 4| OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_RECORD); ------------------ | | 361| 4| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 304| 4| *out_alert = SSL_AD_UNEXPECTED_MESSAGE; ------------------ | | 4367| 4|#define SSL_AD_UNEXPECTED_MESSAGE SSL3_AD_UNEXPECTED_MESSAGE | | ------------------ | | | | 179| 4|#define SSL3_AD_UNEXPECTED_MESSAGE 10 // fatal | | ------------------ ------------------ 305| 4| return ssl_open_record_error; 306| 4| } 307| | 308| 51.4k| if (body.size() != 1 || body[0] != SSL3_MT_CCS) { ------------------ | | 222| 51.4k|#define SSL3_MT_CCS 1 ------------------ | Branch (308:7): [True: 5, False: 51.4k] | Branch (308:27): [True: 3, False: 51.4k] ------------------ 309| 8| OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_CHANGE_CIPHER_SPEC); ------------------ | | 361| 8| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 310| 8| *out_alert = SSL_AD_ILLEGAL_PARAMETER; ------------------ | | 4379| 8|#define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER | | ------------------ | | | | 189| 8|#define SSL3_AD_ILLEGAL_PARAMETER 47 // fatal | | ------------------ ------------------ 311| 8| return ssl_open_record_error; 312| 8| } 313| | 314| 51.4k| ssl_do_msg_callback(ssl, 0 /* read */, SSL3_RT_CHANGE_CIPHER_SPEC, body); ------------------ | | 165| 51.4k|#define SSL3_RT_CHANGE_CIPHER_SPEC 20 ------------------ 315| 51.4k| return ssl_open_record_success; 316| 51.4k|} _ZN4bssl14ssl_send_alertEP6ssl_stii: 318| 2.83k|void ssl_send_alert(SSL *ssl, int level, int desc) { 319| | // This function is called in response to a fatal error from the peer. Ignore 320| | // any failures writing the alert and report only the original error. In 321| | // particular, if the transport uses |SSL_write|, our existing error will be 322| | // clobbered so we must save and restore the error queue. See 323| | // https://crbug.com/959305. 324| | // 325| | // TODO(davidben): Return the alert out of the handshake, rather than calling 326| | // this function internally everywhere. 327| | // 328| | // TODO(davidben): This does not allow retrying if the alert hit EAGAIN. See 329| | // https://crbug.com/boringssl/130. 330| 2.83k| UniquePtr err_state(ERR_save_state()); 331| 2.83k| ssl_send_alert_impl(ssl, level, desc); 332| 2.83k| ERR_restore_state(err_state.get()); 333| 2.83k|} _ZN4bssl19ssl_send_alert_implEP6ssl_stii: 335| 2.83k|int ssl_send_alert_impl(SSL *ssl, int level, int desc) { 336| | // It is illegal to send an alert when we've already sent a closing one. 337| 2.83k| if (ssl->s3->write_shutdown != ssl_shutdown_none) { ------------------ | Branch (337:7): [True: 0, False: 2.83k] ------------------ 338| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_PROTOCOL_IS_SHUTDOWN); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 339| 0| return -1; 340| 0| } 341| | 342| 2.83k| if (level == SSL3_AL_WARNING && desc == SSL_AD_CLOSE_NOTIFY) { ------------------ | | 175| 5.66k|#define SSL3_AL_WARNING 1 ------------------ if (level == SSL3_AL_WARNING && desc == SSL_AD_CLOSE_NOTIFY) { ------------------ | | 4366| 0|#define SSL_AD_CLOSE_NOTIFY SSL3_AD_CLOSE_NOTIFY | | ------------------ | | | | 178| 0|#define SSL3_AD_CLOSE_NOTIFY 0 | | ------------------ ------------------ | Branch (342:7): [True: 0, False: 2.83k] | Branch (342:35): [True: 0, False: 0] ------------------ 343| 0| ssl->s3->write_shutdown = ssl_shutdown_close_notify; 344| 2.83k| } else { 345| 2.83k| assert(level == SSL3_AL_FATAL); 346| 2.83k| assert(desc != SSL_AD_CLOSE_NOTIFY); 347| 2.83k| ssl->s3->write_shutdown = ssl_shutdown_error; 348| 2.83k| } 349| | 350| 2.83k| ssl->s3->alert_dispatch = true; 351| 2.83k| ssl->s3->send_alert[0] = level; 352| 2.83k| ssl->s3->send_alert[1] = desc; 353| 2.83k| if (ssl->s3->write_buffer.empty()) { ------------------ | Branch (353:7): [True: 2.83k, False: 0] ------------------ 354| | // Nothing is being written out, so the alert may be dispatched 355| | // immediately. 356| 2.83k| return ssl->method->dispatch_alert(ssl); 357| 2.83k| } 358| | 359| | // The alert will be dispatched later. 360| 0| return -1; 361| 2.83k|} _ZN4bssl18tls_dispatch_alertEP6ssl_st: 363| 2.83k|int tls_dispatch_alert(SSL *ssl) { 364| 2.83k| if (SSL_is_quic(ssl)) { ------------------ | Branch (364:7): [True: 0, False: 2.83k] ------------------ 365| 0| if (!ssl->quic_method->send_alert(ssl, ssl->s3->quic_write_level, ------------------ | Branch (365:9): [True: 0, False: 0] ------------------ 366| 0| ssl->s3->send_alert[1])) { 367| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_QUIC_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 368| 0| return 0; 369| 0| } 370| 2.83k| } else { 371| 2.83k| size_t bytes_written; 372| 2.83k| int ret = 373| 2.83k| do_tls_write(ssl, &bytes_written, SSL3_RT_ALERT, ssl->s3->send_alert); ------------------ | | 166| 2.83k|#define SSL3_RT_ALERT 21 ------------------ 374| 2.83k| if (ret <= 0) { ------------------ | Branch (374:9): [True: 0, False: 2.83k] ------------------ 375| 0| return ret; 376| 0| } 377| 2.83k| assert(bytes_written == 2); 378| 2.83k| } 379| | 380| 2.83k| ssl->s3->alert_dispatch = false; 381| | 382| | // If the alert is fatal, flush the BIO now. 383| 2.83k| if (ssl->s3->send_alert[0] == SSL3_AL_FATAL) { ------------------ | | 176| 2.83k|#define SSL3_AL_FATAL 2 ------------------ | Branch (383:7): [True: 2.83k, False: 0] ------------------ 384| 2.83k| BIO_flush(ssl->wbio.get()); 385| 2.83k| } 386| | 387| 2.83k| ssl_do_msg_callback(ssl, 1 /* write */, SSL3_RT_ALERT, ssl->s3->send_alert); ------------------ | | 166| 2.83k|#define SSL3_RT_ALERT 21 ------------------ 388| | 389| 2.83k| int alert = (ssl->s3->send_alert[0] << 8) | ssl->s3->send_alert[1]; 390| 2.83k| ssl_do_info_callback(ssl, SSL_CB_WRITE_ALERT, alert); ------------------ | | 5026| 2.83k|#define SSL_CB_WRITE_ALERT (SSL_CB_ALERT | SSL_CB_WRITE) | | ------------------ | | | | 5024| 2.83k|#define SSL_CB_ALERT 0x4000 | | ------------------ | | #define SSL_CB_WRITE_ALERT (SSL_CB_ALERT | SSL_CB_WRITE) | | ------------------ | | | | 5023| 2.83k|#define SSL_CB_WRITE 0x08 | | ------------------ ------------------ 391| | 392| 2.83k| return 1; 393| 2.83k|} s3_pkt.cc:_ZN4bsslL12do_tls_writeEP6ssl_stPmhNS_4SpanIKhEE: 131| 2.83k| Span in) { 132| | // If there is a pending write, the retry must be consistent. 133| 2.83k| if (!ssl->s3->pending_write.empty() && ------------------ | Branch (133:7): [True: 0, False: 2.83k] ------------------ 134| 2.83k| (ssl->s3->pending_write.size() > in.size() || ------------------ | Branch (134:8): [True: 0, False: 0] ------------------ 135| 0| (!(ssl->mode & SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER) && ------------------ | | 662| 0|#define SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER 0x00000002L ------------------ | Branch (135:9): [True: 0, False: 0] ------------------ 136| 0| ssl->s3->pending_write.data() != in.data()) || ------------------ | Branch (136:9): [True: 0, False: 0] ------------------ 137| 0| ssl->s3->pending_write_type != type)) { ------------------ | Branch (137:8): [True: 0, False: 0] ------------------ 138| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_WRITE_RETRY); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 139| 0| return -1; 140| 0| } 141| | 142| | // Flush any unwritten data to the transport. There may be data to flush even 143| | // if |wpend_tot| is zero. 144| 2.83k| int ret = ssl_write_buffer_flush(ssl); 145| 2.83k| if (ret <= 0) { ------------------ | Branch (145:7): [True: 0, False: 2.83k] ------------------ 146| 0| return ret; 147| 0| } 148| | 149| | // If there is a pending write, we just completed it. Report it to the caller. 150| 2.83k| if (!ssl->s3->pending_write.empty()) { ------------------ | Branch (150:7): [True: 0, False: 2.83k] ------------------ 151| 0| *out_bytes_written = ssl->s3->pending_write.size(); 152| 0| ssl->s3->pending_write = {}; 153| 0| return 1; 154| 0| } 155| | 156| 2.83k| SSLBuffer *buf = &ssl->s3->write_buffer; 157| 2.83k| if (in.size() > SSL3_RT_MAX_PLAIN_LENGTH || buf->size() > 0) { ------------------ | | 133| 5.66k|#define SSL3_RT_MAX_PLAIN_LENGTH 16384 ------------------ | Branch (157:7): [True: 0, False: 2.83k] | Branch (157:47): [True: 0, False: 2.83k] ------------------ 158| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 159| 0| return -1; 160| 0| } 161| | 162| 2.83k| if (!tls_flush_pending_hs_data(ssl)) { ------------------ | Branch (162:7): [True: 0, False: 2.83k] ------------------ 163| 0| return -1; 164| 0| } 165| | 166| | // We may have unflushed handshake data that must be written before |in|. This 167| | // may be a KeyUpdate acknowledgment, 0-RTT key change messages, or a 168| | // NewSessionTicket. 169| 2.83k| Span pending_flight; 170| 2.83k| if (ssl->s3->pending_flight != nullptr) { ------------------ | Branch (170:7): [True: 267, False: 2.56k] ------------------ 171| 267| pending_flight = 172| 267| Span(reinterpret_cast(ssl->s3->pending_flight->data), 173| 267| ssl->s3->pending_flight->length); 174| 267| pending_flight = pending_flight.subspan(ssl->s3->pending_flight_offset); 175| 267| } 176| | 177| 2.83k| size_t max_out = pending_flight.size(); 178| 2.83k| if (!in.empty()) { ------------------ | Branch (178:7): [True: 2.83k, False: 0] ------------------ 179| 2.83k| const size_t max_ciphertext_len = in.size() + SSL_max_seal_overhead(ssl); 180| 2.83k| if (max_ciphertext_len < in.size() || ------------------ | Branch (180:9): [True: 0, False: 2.83k] ------------------ 181| 2.83k| max_out + max_ciphertext_len < max_out) { ------------------ | Branch (181:9): [True: 0, False: 2.83k] ------------------ 182| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_OVERFLOW); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 183| 0| return -1; 184| 0| } 185| 2.83k| max_out += max_ciphertext_len; 186| 2.83k| } 187| | 188| 2.83k| if (max_out == 0) { ------------------ | Branch (188:7): [True: 0, False: 2.83k] ------------------ 189| | // Nothing to write. 190| 0| *out_bytes_written = 0; 191| 0| return 1; 192| 0| } 193| | 194| 2.83k| if (!buf->EnsureCap(pending_flight.size() + tls_seal_align_prefix_len(ssl), ------------------ | Branch (194:7): [True: 0, False: 2.83k] ------------------ 195| 2.83k| max_out)) { 196| 0| return -1; 197| 0| } 198| | 199| | // Copy |pending_flight| to the output. 200| 2.83k| if (!pending_flight.empty()) { ------------------ | Branch (200:7): [True: 267, False: 2.56k] ------------------ 201| 267| OPENSSL_memcpy(buf->remaining().data(), pending_flight.data(), 202| 267| pending_flight.size()); 203| 267| ssl->s3->pending_flight.reset(); 204| 267| ssl->s3->pending_flight_offset = 0; 205| 267| buf->DidWrite(pending_flight.size()); 206| 267| } 207| | 208| 2.83k| if (!in.empty()) { ------------------ | Branch (208:7): [True: 2.83k, False: 0] ------------------ 209| 2.83k| size_t ciphertext_len; 210| 2.83k| if (!tls_seal_record(ssl, buf->remaining().data(), &ciphertext_len, ------------------ | Branch (210:9): [True: 0, False: 2.83k] ------------------ 211| 2.83k| buf->remaining().size(), type, in.data(), in.size())) { 212| 0| return -1; 213| 0| } 214| 2.83k| buf->DidWrite(ciphertext_len); 215| 2.83k| } 216| | 217| | // Now that we've made progress on the connection, uncork KeyUpdate 218| | // acknowledgments. 219| 2.83k| ssl->s3->key_update_pending = false; 220| | 221| | // Flush the write buffer. 222| 2.83k| ret = ssl_write_buffer_flush(ssl); 223| 2.83k| if (ret <= 0) { ------------------ | Branch (223:7): [True: 0, False: 2.83k] ------------------ 224| | // Track the unfinished write. 225| 0| if (!in.empty()) { ------------------ | Branch (225:9): [True: 0, False: 0] ------------------ 226| 0| ssl->s3->pending_write = in; 227| 0| ssl->s3->pending_write_type = type; 228| 0| } 229| 0| return ret; 230| 0| } 231| | 232| 2.83k| *out_bytes_written = in.size(); 233| 2.83k| return 1; 234| 2.83k|} s3_pkt.cc:_ZN4bsslL25tls_seal_align_prefix_lenEPK6ssl_st: 117| 2.83k|static size_t tls_seal_align_prefix_len(const SSL *ssl) { 118| 2.83k| size_t ret = 119| 2.83k| SSL3_RT_HEADER_LENGTH + ssl->s3->aead_write_ctx->ExplicitNonceLen(); ------------------ | | 104| 2.83k|#define SSL3_RT_HEADER_LENGTH 5 ------------------ 120| 2.83k| if (ssl_needs_record_splitting(ssl)) { ------------------ | Branch (120:7): [True: 0, False: 2.83k] ------------------ 121| 0| ret += SSL3_RT_HEADER_LENGTH; ------------------ | | 104| 0|#define SSL3_RT_HEADER_LENGTH 5 ------------------ 122| 0| ret += ssl_cipher_get_record_split_len(ssl->s3->aead_write_ctx->cipher()); 123| 0| } 124| 2.83k| return ret; 125| 2.83k|} _ZN4bssl14SSLAEADContextC2EPK13ssl_cipher_st: 31| 144k| : cipher_(cipher_arg), 32| 144k| variable_nonce_included_in_record_(false), 33| 144k| random_variable_nonce_(false), 34| 144k| xor_fixed_nonce_(false), 35| 144k| omit_length_in_ad_(false), 36| 144k| ad_is_header_(false) {} _ZN4bssl14SSLAEADContextD2Ev: 38| 144k|SSLAEADContext::~SSLAEADContext() {} _ZN4bssl14SSLAEADContext16CreateNullCipherEv: 40| 39.8k|UniquePtr SSLAEADContext::CreateNullCipher() { 41| 39.8k| return MakeUnique(/*cipher=*/nullptr); 42| 39.8k|} _ZN4bssl14SSLAEADContext6CreateE20evp_aead_direction_ttPK13ssl_cipher_stNS_4SpanIKhEES7_S7_: 47| 104k| Span mac_key, Span fixed_iv) { 48| 104k| const EVP_AEAD *aead; 49| 104k| uint16_t protocol_version; 50| 104k| size_t expected_mac_key_len, expected_fixed_iv_len; 51| 104k| if (!ssl_protocol_version_from_wire(&protocol_version, version) || ------------------ | Branch (51:7): [True: 0, False: 104k] ------------------ 52| 104k| !ssl_cipher_get_evp_aead(&aead, &expected_mac_key_len, ------------------ | Branch (52:7): [True: 0, False: 104k] ------------------ 53| 104k| &expected_fixed_iv_len, cipher, 54| 104k| protocol_version) || 55| | // Ensure the caller returned correct key sizes. 56| 104k| expected_fixed_iv_len != fixed_iv.size() || ------------------ | Branch (56:7): [True: 1, False: 104k] ------------------ 57| 104k| expected_mac_key_len != mac_key.size()) { ------------------ | Branch (57:7): [True: 0, False: 104k] ------------------ 58| 1| OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 1| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 59| 1| return nullptr; 60| 1| } 61| | 62| 104k| UniquePtr aead_ctx = MakeUnique(cipher); 63| 104k| if (!aead_ctx) { ------------------ | Branch (63:7): [True: 0, False: 104k] ------------------ 64| 0| return nullptr; 65| 0| } 66| | 67| 104k| uint8_t merged_key[EVP_AEAD_MAX_KEY_LENGTH]; 68| 104k| assert(EVP_AEAD_nonce_length(aead) <= EVP_AEAD_MAX_NONCE_LENGTH); 69| 104k| static_assert(EVP_AEAD_MAX_NONCE_LENGTH < 256, 70| 104k| "variable_nonce_len doesn't fit in uint8_t"); 71| 104k| aead_ctx->variable_nonce_len_ = (uint8_t)EVP_AEAD_nonce_length(aead); 72| 104k| if (mac_key.empty()) { ------------------ | Branch (72:7): [True: 40.3k, False: 64.0k] ------------------ 73| | // This is an actual AEAD. 74| 40.3k| aead_ctx->fixed_nonce_.CopyFrom(fixed_iv); 75| | 76| 40.3k| if (protocol_version >= TLS1_3_VERSION || ------------------ | | 545| 80.6k|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (76:9): [True: 703, False: 39.6k] ------------------ 77| 40.3k| cipher->algorithm_enc & SSL_CHACHA20POLY1305) { ------------------ | | 281| 39.6k|#define SSL_CHACHA20POLY1305 0x00000020u ------------------ | Branch (77:9): [True: 5, False: 39.6k] ------------------ 78| | // TLS 1.3, and TLS 1.2 ChaCha20-Poly1305, XOR the fixed IV with the 79| | // sequence number to form the nonce. 80| 708| aead_ctx->xor_fixed_nonce_ = true; 81| 708| aead_ctx->variable_nonce_len_ = 8; 82| 708| assert(fixed_iv.size() >= aead_ctx->variable_nonce_len_); 83| 39.6k| } else { 84| | // TLS 1.2 AES-GCM prepends the fixed IV to an explicit nonce. 85| 39.6k| assert(fixed_iv.size() <= aead_ctx->variable_nonce_len_); 86| 39.6k| assert(cipher->algorithm_enc & (SSL_AES128GCM | SSL_AES256GCM)); 87| 39.6k| aead_ctx->variable_nonce_len_ -= fixed_iv.size(); 88| 39.6k| aead_ctx->variable_nonce_included_in_record_ = true; 89| 39.6k| } 90| | 91| | // Starting TLS 1.3, the AAD is the whole record header. 92| 40.3k| if (protocol_version >= TLS1_3_VERSION) { ------------------ | | 545| 40.3k|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (92:9): [True: 703, False: 39.6k] ------------------ 93| 703| aead_ctx->ad_is_header_ = true; 94| 703| } 95| 64.0k| } else { 96| | // This is a CBC cipher suite that implements the |EVP_AEAD| interface. The 97| | // |EVP_AEAD| takes the MAC key, encryption key, and fixed IV concatenated 98| | // as its input key. 99| 64.0k| assert(protocol_version < TLS1_3_VERSION); 100| 64.0k| BSSL_CHECK(mac_key.size() + enc_key.size() + fixed_iv.size() <= ------------------ | | 384| 64.0k| do { \ | | 385| 64.0k| if (!(condition)) { \ | | ------------------ | | | Branch (385:9): [True: 0, False: 64.0k] | | ------------------ | | 386| 0| abort(); \ | | 387| 0| } \ | | 388| 64.0k| } while (0); | | ------------------ | | | Branch (388:12): [Folded - Ignored] | | ------------------ ------------------ 101| 64.0k| sizeof(merged_key)); 102| 64.0k| OPENSSL_memcpy(merged_key, mac_key.data(), mac_key.size()); 103| 64.0k| OPENSSL_memcpy(merged_key + mac_key.size(), enc_key.data(), enc_key.size()); 104| 64.0k| OPENSSL_memcpy(merged_key + mac_key.size() + enc_key.size(), 105| 64.0k| fixed_iv.data(), fixed_iv.size()); 106| 64.0k| enc_key = 107| 64.0k| Span(merged_key, enc_key.size() + mac_key.size() + fixed_iv.size()); 108| | 109| | // The |EVP_AEAD|'s per-encryption nonce, if any, is actually the CBC IV. It 110| | // must be generated randomly and prepended to the record. 111| 64.0k| aead_ctx->variable_nonce_included_in_record_ = true; 112| 64.0k| aead_ctx->random_variable_nonce_ = true; 113| 64.0k| aead_ctx->omit_length_in_ad_ = true; 114| 64.0k| } 115| | 116| 104k| if (!EVP_AEAD_CTX_init_with_direction( ------------------ | Branch (116:7): [True: 0, False: 104k] ------------------ 117| 104k| aead_ctx->ctx_.get(), aead, enc_key.data(), enc_key.size(), 118| 104k| EVP_AEAD_DEFAULT_TAG_LENGTH, direction)) { ------------------ | | 252| 104k|#define EVP_AEAD_DEFAULT_TAG_LENGTH 0 ------------------ 119| 0| return nullptr; 120| 0| } 121| | 122| 104k| return aead_ctx; 123| 104k|} _ZNK4bssl14SSLAEADContext16ExplicitNonceLenEv: 130| 1.09M|size_t SSLAEADContext::ExplicitNonceLen() const { 131| 1.09M| if (!CRYPTO_fuzzer_mode_enabled() && variable_nonce_included_in_record_) { ------------------ | Branch (131:7): [True: 0, False: 1.09M] | Branch (131:40): [True: 0, False: 0] ------------------ 132| 0| return variable_nonce_len_; 133| 0| } 134| 1.09M| return 0; 135| 1.09M|} _ZNK4bssl14SSLAEADContext9SuffixLenEPmmm: 138| 869k| const size_t extra_in_len) const { 139| 869k| if (is_null_cipher() || CRYPTO_fuzzer_mode_enabled()) { ------------------ | Branch (139:7): [True: 50.2k, False: 819k] | Branch (139:27): [True: 819k, False: 0] ------------------ 140| 869k| *out_suffix_len = extra_in_len; 141| 869k| return true; 142| 869k| } 143| 0| return !!EVP_AEAD_CTX_tag_len(ctx_.get(), out_suffix_len, in_len, 144| 0| extra_in_len); 145| 869k|} _ZNK4bssl14SSLAEADContext13CiphertextLenEPmmm: 148| 217k| const size_t extra_in_len) const { 149| 217k| size_t len; 150| 217k| if (!SuffixLen(&len, in_len, extra_in_len)) { ------------------ | Branch (150:7): [True: 0, False: 217k] ------------------ 151| 0| return false; 152| 0| } 153| 217k| len += ExplicitNonceLen(); 154| 217k| len += in_len; 155| 217k| if (len < in_len || len >= 0xffff) { ------------------ | Branch (155:7): [True: 0, False: 217k] | Branch (155:23): [True: 0, False: 217k] ------------------ 156| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_OVERFLOW); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 157| 0| return false; 158| 0| } 159| 217k| *out_len = len; 160| 217k| return true; 161| 217k|} _ZNK4bssl14SSLAEADContext11MaxOverheadEv: 163| 217k|size_t SSLAEADContext::MaxOverhead() const { 164| 217k| return ExplicitNonceLen() + 165| 217k| (is_null_cipher() || CRYPTO_fuzzer_mode_enabled() ------------------ | Branch (165:11): [True: 12.5k, False: 204k] | Branch (165:31): [True: 204k, False: 0] ------------------ 166| 217k| ? 0 167| 217k| : EVP_AEAD_max_overhead(EVP_AEAD_CTX_aead(ctx_.get()))); 168| 217k|} _ZN4bssl14SSLAEADContext4OpenEPNS_4SpanIhEEhtmNS1_IKhEES2_: 228| 479k| Span header, Span in) { 229| 479k| if (is_null_cipher() || CRYPTO_fuzzer_mode_enabled()) { ------------------ | Branch (229:7): [True: 35.6k, False: 444k] | Branch (229:27): [True: 444k, False: 0] ------------------ 230| | // Handle the initial NULL cipher. 231| 479k| *out = in; 232| 479k| return true; 233| 479k| } 234| | 235| | // TLS 1.2 AEADs include the length in the AD and are assumed to have fixed 236| | // overhead. Otherwise the parameter is unused. 237| 0| size_t plaintext_len = 0; 238| 0| if (!omit_length_in_ad_) { ------------------ | Branch (238:7): [True: 0, False: 0] ------------------ 239| 0| size_t overhead = MaxOverhead(); 240| 0| if (in.size() < overhead) { ------------------ | Branch (240:9): [True: 0, False: 0] ------------------ 241| | // Publicly invalid. 242| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_PACKET_LENGTH); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 243| 0| return false; 244| 0| } 245| 0| plaintext_len = in.size() - overhead; 246| 0| } 247| | 248| 0| uint8_t ad_storage[13]; 249| 0| Span ad = GetAdditionalData(ad_storage, type, record_version, 250| 0| seqnum, plaintext_len, header); 251| | 252| | // Assemble the nonce. 253| 0| uint8_t nonce[EVP_AEAD_MAX_NONCE_LENGTH]; 254| 0| size_t nonce_len = 0; 255| | 256| | // Prepend the fixed nonce, or left-pad with zeros if XORing. 257| 0| if (xor_fixed_nonce_) { ------------------ | Branch (257:7): [True: 0, False: 0] ------------------ 258| 0| nonce_len = fixed_nonce_.size() - variable_nonce_len_; 259| 0| OPENSSL_memset(nonce, 0, nonce_len); 260| 0| } else { 261| 0| OPENSSL_memcpy(nonce, fixed_nonce_.data(), fixed_nonce_.size()); 262| 0| nonce_len += fixed_nonce_.size(); 263| 0| } 264| | 265| | // Add the variable nonce. 266| 0| if (variable_nonce_included_in_record_) { ------------------ | Branch (266:7): [True: 0, False: 0] ------------------ 267| 0| if (in.size() < variable_nonce_len_) { ------------------ | Branch (267:9): [True: 0, False: 0] ------------------ 268| | // Publicly invalid. 269| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_PACKET_LENGTH); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 270| 0| return false; 271| 0| } 272| 0| OPENSSL_memcpy(nonce + nonce_len, in.data(), variable_nonce_len_); 273| 0| in = in.subspan(variable_nonce_len_); 274| 0| } else { 275| 0| assert(variable_nonce_len_ == 8); 276| 0| CRYPTO_store_u64_be(nonce + nonce_len, seqnum); 277| 0| } 278| 0| nonce_len += variable_nonce_len_; 279| | 280| | // XOR the fixed nonce, if necessary. 281| 0| if (xor_fixed_nonce_) { ------------------ | Branch (281:7): [True: 0, False: 0] ------------------ 282| 0| assert(nonce_len == fixed_nonce_.size()); 283| 0| for (size_t i = 0; i < fixed_nonce_.size(); i++) { ------------------ | Branch (283:24): [True: 0, False: 0] ------------------ 284| 0| nonce[i] ^= fixed_nonce_[i]; 285| 0| } 286| 0| } 287| | 288| | // Decrypt in-place. 289| 0| size_t len; 290| 0| if (!EVP_AEAD_CTX_open(ctx_.get(), in.data(), &len, in.size(), nonce, ------------------ | Branch (290:7): [True: 0, False: 0] ------------------ 291| 0| nonce_len, in.data(), in.size(), ad.data(), 292| 0| ad.size())) { 293| 0| return false; 294| 0| } 295| 0| *out = in.subspan(0, len); 296| 0| return true; 297| 0|} _ZN4bssl14SSLAEADContext11SealScatterEPhS1_S1_htmNS_4SpanIKhEEPS3_mS5_m: 304| 217k| size_t extra_in_len) { 305| 217k| const size_t prefix_len = ExplicitNonceLen(); 306| 217k| size_t suffix_len; 307| 217k| if (!SuffixLen(&suffix_len, in_len, extra_in_len)) { ------------------ | Branch (307:7): [True: 0, False: 217k] ------------------ 308| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_RECORD_TOO_LARGE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 309| 0| return false; 310| 0| } 311| 217k| if ((in != out && buffers_alias(in, in_len, out, in_len)) || ------------------ | Branch (311:8): [True: 217k, False: 0] | Branch (311:21): [True: 0, False: 217k] ------------------ 312| 217k| buffers_alias(in, in_len, out_prefix, prefix_len) || ------------------ | Branch (312:7): [True: 0, False: 217k] ------------------ 313| 217k| buffers_alias(in, in_len, out_suffix, suffix_len)) { ------------------ | Branch (313:7): [True: 0, False: 217k] ------------------ 314| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_OUTPUT_ALIASES_INPUT); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 315| 0| return false; 316| 0| } 317| | 318| 217k| if (is_null_cipher() || CRYPTO_fuzzer_mode_enabled()) { ------------------ | Branch (318:7): [True: 12.5k, False: 204k] | Branch (318:27): [True: 204k, False: 0] ------------------ 319| | // Handle the initial NULL cipher. 320| 217k| OPENSSL_memmove(out, in, in_len); 321| 217k| OPENSSL_memmove(out_suffix, extra_in, extra_in_len); 322| 217k| return true; 323| 217k| } 324| | 325| 0| uint8_t ad_storage[13]; 326| 0| Span ad = GetAdditionalData(ad_storage, type, record_version, 327| 0| seqnum, in_len, header); 328| | 329| | // Assemble the nonce. 330| 0| uint8_t nonce[EVP_AEAD_MAX_NONCE_LENGTH]; 331| 0| size_t nonce_len = 0; 332| | 333| | // Prepend the fixed nonce, or left-pad with zeros if XORing. 334| 0| if (xor_fixed_nonce_) { ------------------ | Branch (334:7): [True: 0, False: 0] ------------------ 335| 0| nonce_len = fixed_nonce_.size() - variable_nonce_len_; 336| 0| OPENSSL_memset(nonce, 0, nonce_len); 337| 0| } else { 338| 0| OPENSSL_memcpy(nonce, fixed_nonce_.data(), fixed_nonce_.size()); 339| 0| nonce_len += fixed_nonce_.size(); 340| 0| } 341| | 342| | // Select the variable nonce. 343| 0| if (random_variable_nonce_) { ------------------ | Branch (343:7): [True: 0, False: 0] ------------------ 344| 0| assert(variable_nonce_included_in_record_); 345| 0| if (!RAND_bytes(nonce + nonce_len, variable_nonce_len_)) { ------------------ | Branch (345:9): [True: 0, False: 0] ------------------ 346| 0| return false; 347| 0| } 348| 0| } else { 349| | // When sending we use the sequence number as the variable part of the 350| | // nonce. 351| 0| assert(variable_nonce_len_ == 8); 352| 0| CRYPTO_store_u64_be(nonce + nonce_len, seqnum); 353| 0| } 354| 0| nonce_len += variable_nonce_len_; 355| | 356| | // Emit the variable nonce if included in the record. 357| 0| if (variable_nonce_included_in_record_) { ------------------ | Branch (357:7): [True: 0, False: 0] ------------------ 358| 0| assert(!xor_fixed_nonce_); 359| 0| if (buffers_alias(in, in_len, out_prefix, variable_nonce_len_)) { ------------------ | Branch (359:9): [True: 0, False: 0] ------------------ 360| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_OUTPUT_ALIASES_INPUT); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 361| 0| return false; 362| 0| } 363| 0| OPENSSL_memcpy(out_prefix, nonce + fixed_nonce_.size(), 364| 0| variable_nonce_len_); 365| 0| } 366| | 367| | // XOR the fixed nonce, if necessary. 368| 0| if (xor_fixed_nonce_) { ------------------ | Branch (368:7): [True: 0, False: 0] ------------------ 369| 0| assert(nonce_len == fixed_nonce_.size()); 370| 0| for (size_t i = 0; i < fixed_nonce_.size(); i++) { ------------------ | Branch (370:24): [True: 0, False: 0] ------------------ 371| 0| nonce[i] ^= fixed_nonce_[i]; 372| 0| } 373| 0| } 374| | 375| 0| size_t written_suffix_len; 376| 0| bool result = !!EVP_AEAD_CTX_seal_scatter( 377| 0| ctx_.get(), out, out_suffix, &written_suffix_len, suffix_len, nonce, 378| 0| nonce_len, in, in_len, extra_in, extra_in_len, ad.data(), ad.size()); 379| 0| assert(!result || written_suffix_len == suffix_len); 380| 0| return result; 381| 0|} _ZN4bssl17SSL_SESSION_parseEP6cbs_stPKNS_15SSL_X509_METHODEP21crypto_buffer_pool_st: 462| 20.7k| CRYPTO_BUFFER_POOL *pool) { 463| 20.7k| UniquePtr ret = ssl_session_new(x509_method); 464| 20.7k| if (!ret) { ------------------ | Branch (464:7): [True: 0, False: 20.7k] ------------------ 465| 0| return nullptr; 466| 0| } 467| | 468| 20.7k| CBS session; 469| 20.7k| uint64_t version, ssl_version; 470| 20.7k| uint16_t unused; 471| 20.7k| if (!CBS_get_asn1(cbs, &session, CBS_ASN1_SEQUENCE) || // ------------------ | | 223| 20.7k|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED) | | ------------------ | | | | 197| 20.7k|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | | | ------------------ | | | | | | 194| 20.7k|#define CBS_ASN1_TAG_SHIFT 24 | | | | ------------------ | | ------------------ ------------------ | Branch (471:7): [True: 182, False: 20.5k] ------------------ 472| 20.7k| !CBS_get_asn1_uint64(&session, &version) || // ------------------ | Branch (472:7): [True: 80, False: 20.4k] ------------------ 473| 20.7k| version != kVersion || // ------------------ | Branch (473:7): [True: 117, False: 20.3k] ------------------ 474| 20.7k| !CBS_get_asn1_uint64(&session, &ssl_version) || // ------------------ | Branch (474:7): [True: 10, False: 20.3k] ------------------ 475| | // Require sessions have versions valid in either TLS or DTLS. The session 476| | // will not be used by the handshake if not applicable, but, for 477| | // simplicity, never parse a session that does not pass 478| | // |ssl_protocol_version_from_wire|. 479| 20.7k| ssl_version > UINT16_MAX || // ------------------ | Branch (479:7): [True: 76, False: 20.2k] ------------------ 480| 20.7k| !ssl_protocol_version_from_wire(&unused, ssl_version)) { ------------------ | Branch (480:7): [True: 52, False: 20.2k] ------------------ 481| 517| OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_SSL_SESSION); ------------------ | | 361| 517| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 482| 517| return nullptr; 483| 517| } 484| 20.2k| ret->ssl_version = ssl_version; 485| | 486| 20.2k| CBS cipher; 487| 20.2k| uint16_t cipher_value; 488| 20.2k| if (!CBS_get_asn1(&session, &cipher, CBS_ASN1_OCTETSTRING) || // ------------------ | | 218| 20.2k|#define CBS_ASN1_OCTETSTRING 0x4u ------------------ | Branch (488:7): [True: 8, False: 20.1k] ------------------ 489| 20.2k| !CBS_get_u16(&cipher, &cipher_value) || // ------------------ | Branch (489:7): [True: 1, False: 20.1k] ------------------ 490| 20.2k| CBS_len(&cipher) != 0) { ------------------ | Branch (490:7): [True: 1, False: 20.1k] ------------------ 491| 10| OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_SSL_SESSION); ------------------ | | 361| 10| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 492| 10| return nullptr; 493| 10| } 494| 20.1k| ret->cipher = SSL_get_cipher_by_value(cipher_value); 495| 20.1k| if (ret->cipher == NULL) { ------------------ | Branch (495:7): [True: 17, False: 20.1k] ------------------ 496| 17| OPENSSL_PUT_ERROR(SSL, SSL_R_UNSUPPORTED_CIPHER); ------------------ | | 361| 17| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 497| 17| return nullptr; 498| 17| } 499| | 500| 20.1k| CBS session_id, secret, child; 501| 20.1k| uint64_t timeout; 502| 20.1k| if (!CBS_get_asn1(&session, &session_id, CBS_ASN1_OCTETSTRING) || ------------------ | | 218| 20.1k|#define CBS_ASN1_OCTETSTRING 0x4u ------------------ | Branch (502:7): [True: 3, False: 20.1k] ------------------ 503| 20.1k| !ret->session_id.TryCopyFrom(session_id) || ------------------ | Branch (503:7): [True: 2, False: 20.1k] ------------------ 504| 20.1k| !CBS_get_asn1(&session, &secret, CBS_ASN1_OCTETSTRING) || ------------------ | | 218| 20.1k|#define CBS_ASN1_OCTETSTRING 0x4u ------------------ | Branch (504:7): [True: 17, False: 20.1k] ------------------ 505| 20.1k| !ret->secret.TryCopyFrom(secret) || ------------------ | Branch (505:7): [True: 2, False: 20.1k] ------------------ 506| 20.1k| !CBS_get_asn1(&session, &child, kTimeTag) || ------------------ | Branch (506:7): [True: 13, False: 20.1k] ------------------ 507| 20.1k| !CBS_get_asn1_uint64(&child, &ret->time) || ------------------ | Branch (507:7): [True: 4, False: 20.1k] ------------------ 508| 20.1k| !CBS_get_asn1(&session, &child, kTimeoutTag) || ------------------ | Branch (508:7): [True: 2, False: 20.1k] ------------------ 509| 20.1k| !CBS_get_asn1_uint64(&child, &timeout) || // ------------------ | Branch (509:7): [True: 1, False: 20.1k] ------------------ 510| 20.1k| timeout > UINT32_MAX) { ------------------ | Branch (510:7): [True: 49, False: 20.0k] ------------------ 511| 93| OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_SSL_SESSION); ------------------ | | 361| 93| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 512| 93| return nullptr; 513| 93| } 514| | 515| 20.0k| ret->timeout = (uint32_t)timeout; 516| | 517| 20.0k| CBS peer; 518| 20.0k| int has_peer; 519| 20.0k| if (!CBS_get_optional_asn1(&session, &peer, &has_peer, kPeerTag) || ------------------ | Branch (519:7): [True: 1, False: 20.0k] ------------------ 520| 20.0k| (has_peer && CBS_len(&peer) == 0)) { ------------------ | Branch (520:8): [True: 14.0k, False: 5.99k] | Branch (520:20): [True: 1, False: 14.0k] ------------------ 521| 2| OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_SSL_SESSION); ------------------ | | 361| 2| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 522| 2| return nullptr; 523| 2| } 524| | // |peer| is processed with the certificate chain. 525| | 526| 20.0k| CBS sid_ctx; 527| 20.0k| if (!CBS_get_optional_asn1_octet_string( ------------------ | Branch (527:7): [True: 2, False: 20.0k] ------------------ 528| 20.0k| &session, &sid_ctx, /*out_present=*/nullptr, kSessionIDContextTag) || 529| 20.0k| !ret->sid_ctx.TryCopyFrom(sid_ctx) || ------------------ | Branch (529:7): [True: 1, False: 20.0k] ------------------ 530| 20.0k| !SSL_SESSION_parse_long(&session, &ret->verify_result, kVerifyResultTag, ------------------ | Branch (530:7): [True: 57, False: 20.0k] ------------------ 531| 20.0k| X509_V_OK)) { ------------------ | | 3013| 20.0k|#define X509_V_OK 0 ------------------ 532| 60| return nullptr; 533| 60| } 534| | 535| | // Skip the historical hostName field. 536| 20.0k| CBS unused_hostname; 537| 20.0k| if (!CBS_get_optional_asn1(&session, &unused_hostname, nullptr, ------------------ | Branch (537:7): [True: 1, False: 20.0k] ------------------ 538| 20.0k| kHostNameTag)) { 539| 1| OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_SSL_SESSION); ------------------ | | 361| 1| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 540| 1| return nullptr; 541| 1| } 542| | 543| 20.0k| if (!SSL_SESSION_parse_string(&session, &ret->psk_identity, ------------------ | Branch (543:7): [True: 3, False: 20.0k] ------------------ 544| 20.0k| kPSKIdentityTag) || 545| 20.0k| !SSL_SESSION_parse_u32(&session, &ret->ticket_lifetime_hint, ------------------ | Branch (545:7): [True: 6, False: 20.0k] ------------------ 546| 20.0k| kTicketLifetimeHintTag, 0) || 547| 20.0k| !SSL_SESSION_parse_octet_string(&session, &ret->ticket, kTicketTag)) { ------------------ | Branch (547:7): [True: 2, False: 20.0k] ------------------ 548| 11| return nullptr; 549| 11| } 550| | 551| 20.0k| if (CBS_peek_asn1_tag(&session, kPeerSHA256Tag)) { ------------------ | Branch (551:7): [True: 237, False: 19.7k] ------------------ 552| 237| CBS peer_sha256; 553| 237| if (!CBS_get_asn1(&session, &child, kPeerSHA256Tag) || ------------------ | Branch (553:9): [True: 2, False: 235] ------------------ 554| 237| !CBS_get_asn1(&child, &peer_sha256, CBS_ASN1_OCTETSTRING) || ------------------ | | 218| 235|#define CBS_ASN1_OCTETSTRING 0x4u ------------------ | Branch (554:9): [True: 1, False: 234] ------------------ 555| 237| CBS_len(&peer_sha256) != sizeof(ret->peer_sha256) || ------------------ | Branch (555:9): [True: 1, False: 233] ------------------ 556| 237| CBS_len(&child) != 0) { ------------------ | Branch (556:9): [True: 1, False: 232] ------------------ 557| 5| OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_SSL_SESSION); ------------------ | | 361| 5| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 558| 5| return nullptr; 559| 5| } 560| 232| OPENSSL_memcpy(ret->peer_sha256, CBS_data(&peer_sha256), 561| 232| sizeof(ret->peer_sha256)); 562| 232| ret->peer_sha256_valid = true; 563| 19.7k| } else { 564| 19.7k| ret->peer_sha256_valid = false; 565| 19.7k| } 566| | 567| 20.0k| CBS original_handshake_hash; 568| 20.0k| if (!CBS_get_optional_asn1_octet_string(&session, &original_handshake_hash, ------------------ | Branch (568:7): [True: 5, False: 20.0k] ------------------ 569| 20.0k| /*out_present=*/nullptr, 570| 20.0k| kOriginalHandshakeHashTag) || 571| 20.0k| !ret->original_handshake_hash.TryCopyFrom(original_handshake_hash) || ------------------ | Branch (571:7): [True: 1, False: 20.0k] ------------------ 572| 20.0k| !SSL_SESSION_parse_crypto_buffer(&session, ------------------ | Branch (572:7): [True: 5, False: 19.9k] ------------------ 573| 20.0k| &ret->signed_cert_timestamp_list, 574| 20.0k| kSignedCertTimestampListTag, pool) || 575| 20.0k| !SSL_SESSION_parse_crypto_buffer(&session, &ret->ocsp_response, ------------------ | Branch (575:7): [True: 1, False: 19.9k] ------------------ 576| 19.9k| kOCSPResponseTag, pool)) { 577| 12| return nullptr; 578| 12| } 579| | 580| 19.9k| int extended_master_secret; 581| 19.9k| if (!CBS_get_optional_asn1_bool(&session, &extended_master_secret, ------------------ | Branch (581:7): [True: 9, False: 19.9k] ------------------ 582| 19.9k| kExtendedMasterSecretTag, 583| 19.9k| 0 /* default to false */)) { 584| 9| OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_SSL_SESSION); ------------------ | | 361| 9| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 585| 9| return nullptr; 586| 9| } 587| 19.9k| ret->extended_master_secret = !!extended_master_secret; 588| | 589| 19.9k| if (!SSL_SESSION_parse_u16(&session, &ret->group_id, kGroupIDTag, 0)) { ------------------ | Branch (589:7): [True: 81, False: 19.9k] ------------------ 590| 81| OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_SSL_SESSION); ------------------ | | 361| 81| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 591| 81| return nullptr; 592| 81| } 593| | 594| 19.9k| CBS cert_chain; 595| 19.9k| CBS_init(&cert_chain, NULL, 0); 596| 19.9k| int has_cert_chain; 597| 19.9k| if (!CBS_get_optional_asn1(&session, &cert_chain, &has_cert_chain, ------------------ | Branch (597:7): [True: 1, False: 19.9k] ------------------ 598| 19.9k| kCertChainTag) || 599| 19.9k| (has_cert_chain && CBS_len(&cert_chain) == 0)) { ------------------ | Branch (599:8): [True: 2.36k, False: 17.5k] | Branch (599:26): [True: 1, False: 2.36k] ------------------ 600| 2| OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_SSL_SESSION); ------------------ | | 361| 2| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 601| 2| return nullptr; 602| 2| } 603| 19.9k| if (has_cert_chain && !has_peer) { ------------------ | Branch (603:7): [True: 2.36k, False: 17.5k] | Branch (603:25): [True: 5, False: 2.36k] ------------------ 604| 5| OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_SSL_SESSION); ------------------ | | 361| 5| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 605| 5| return nullptr; 606| 5| } 607| 19.8k| if (has_peer || has_cert_chain) { ------------------ | Branch (607:7): [True: 14.0k, False: 5.81k] | Branch (607:19): [True: 0, False: 5.81k] ------------------ 608| 14.0k| ret->certs.reset(sk_CRYPTO_BUFFER_new_null()); 609| 14.0k| if (ret->certs == nullptr) { ------------------ | Branch (609:9): [True: 0, False: 14.0k] ------------------ 610| 0| return nullptr; 611| 0| } 612| | 613| 14.0k| if (has_peer) { ------------------ | Branch (613:9): [True: 14.0k, False: 0] ------------------ 614| 14.0k| UniquePtr buffer(CRYPTO_BUFFER_new_from_CBS(&peer, pool)); 615| 14.0k| if (!buffer || // ------------------ | Branch (615:11): [True: 0, False: 14.0k] | Branch (615:11): [True: 0, False: 14.0k] ------------------ 616| 14.0k| !PushToStack(ret->certs.get(), std::move(buffer))) { ------------------ | Branch (616:11): [True: 0, False: 14.0k] ------------------ 617| 0| return nullptr; 618| 0| } 619| 14.0k| } 620| | 621| 19.1k| while (CBS_len(&cert_chain) > 0) { ------------------ | Branch (621:12): [True: 5.04k, False: 14.0k] ------------------ 622| 5.04k| CBS cert; 623| 5.04k| if (!CBS_get_any_asn1_element(&cert_chain, &cert, NULL, NULL) || ------------------ | Branch (623:11): [True: 18, False: 5.02k] ------------------ 624| 5.04k| CBS_len(&cert) == 0) { ------------------ | Branch (624:11): [True: 0, False: 5.02k] ------------------ 625| 18| OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_SSL_SESSION); ------------------ | | 361| 18| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 626| 18| return nullptr; 627| 18| } 628| | 629| 5.02k| UniquePtr buffer(CRYPTO_BUFFER_new_from_CBS(&cert, pool)); 630| 5.02k| if (buffer == nullptr || ------------------ | Branch (630:11): [True: 0, False: 5.02k] | Branch (630:11): [True: 0, False: 5.02k] ------------------ 631| 5.02k| !PushToStack(ret->certs.get(), std::move(buffer))) { ------------------ | Branch (631:11): [True: 0, False: 5.02k] ------------------ 632| 0| return nullptr; 633| 0| } 634| 5.02k| } 635| 14.0k| } 636| | 637| 19.8k| CBS age_add; 638| 19.8k| int age_add_present; 639| 19.8k| if (!CBS_get_optional_asn1_octet_string(&session, &age_add, &age_add_present, ------------------ | Branch (639:7): [True: 3, False: 19.8k] ------------------ 640| 19.8k| kTicketAgeAddTag) || 641| 19.8k| (age_add_present && // ------------------ | Branch (641:8): [True: 2.57k, False: 17.3k] ------------------ 642| 19.8k| !CBS_get_u32(&age_add, &ret->ticket_age_add)) || // ------------------ | Branch (642:8): [True: 2, False: 2.57k] ------------------ 643| 19.8k| CBS_len(&age_add) != 0) { ------------------ | Branch (643:7): [True: 1, False: 19.8k] ------------------ 644| 6| return nullptr; 645| 6| } 646| 19.8k| ret->ticket_age_add_valid = age_add_present != 0; 647| | 648| 19.8k| int is_server; 649| 19.8k| if (!CBS_get_optional_asn1_bool(&session, &is_server, kIsServerTag, ------------------ | Branch (649:7): [True: 50, False: 19.8k] ------------------ 650| 19.8k| 1 /* default to true */)) { 651| 50| OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_SSL_SESSION); ------------------ | | 361| 50| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 652| 50| return nullptr; 653| 50| } 654| | /* TODO: in time we can include |is_server| for servers too, then we can 655| | enforce that client and server sessions are never mixed up. */ 656| | 657| 19.8k| ret->is_server = is_server; 658| | 659| 19.8k| int is_quic; 660| 19.8k| if (!SSL_SESSION_parse_u16(&session, &ret->peer_signature_algorithm, ------------------ | Branch (660:7): [True: 12, False: 19.8k] ------------------ 661| 19.8k| kPeerSignatureAlgorithmTag, 0) || 662| 19.8k| !SSL_SESSION_parse_u32(&session, &ret->ticket_max_early_data, ------------------ | Branch (662:7): [True: 26, False: 19.7k] ------------------ 663| 19.8k| kTicketMaxEarlyDataTag, 0) || 664| 19.8k| !SSL_SESSION_parse_u32(&session, &ret->auth_timeout, kAuthTimeoutTag, ------------------ | Branch (664:7): [True: 29, False: 19.7k] ------------------ 665| 19.7k| ret->timeout) || 666| 19.8k| !SSL_SESSION_parse_octet_string(&session, &ret->early_alpn, ------------------ | Branch (666:7): [True: 2, False: 19.7k] ------------------ 667| 19.7k| kEarlyALPNTag) || 668| 19.8k| !CBS_get_optional_asn1_bool(&session, &is_quic, kIsQuicTag, ------------------ | Branch (668:7): [True: 13, False: 19.7k] ------------------ 669| 19.7k| /*default_value=*/false) || 670| 19.8k| !SSL_SESSION_parse_octet_string(&session, &ret->quic_early_data_context, ------------------ | Branch (670:7): [True: 9, False: 19.7k] ------------------ 671| 19.7k| kQuicEarlyDataContextTag)) { 672| 91| OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_SSL_SESSION); ------------------ | | 361| 91| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 673| 91| return nullptr; 674| 91| } 675| | 676| 19.7k| CBS settings; 677| 19.7k| int has_local_alps, has_peer_alps, is_resumable_across_names; 678| 19.7k| if (!CBS_get_optional_asn1_octet_string(&session, &settings, &has_local_alps, ------------------ | Branch (678:7): [True: 1, False: 19.7k] ------------------ 679| 19.7k| kLocalALPSTag) || 680| 19.7k| !ret->local_application_settings.CopyFrom(settings) || ------------------ | Branch (680:7): [True: 0, False: 19.7k] ------------------ 681| 19.7k| !CBS_get_optional_asn1_octet_string(&session, &settings, &has_peer_alps, ------------------ | Branch (681:7): [True: 17, False: 19.7k] ------------------ 682| 19.7k| kPeerALPSTag) || 683| 19.7k| !ret->peer_application_settings.CopyFrom(settings) || ------------------ | Branch (683:7): [True: 0, False: 19.7k] ------------------ 684| 19.7k| !CBS_get_optional_asn1_bool(&session, &is_resumable_across_names, ------------------ | Branch (684:7): [True: 1, False: 19.7k] ------------------ 685| 19.7k| kResumableAcrossNamesTag, 686| 19.7k| /*default_value=*/false) || 687| 19.7k| CBS_len(&session) != 0) { ------------------ | Branch (687:7): [True: 290, False: 19.4k] ------------------ 688| 309| OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_SSL_SESSION); ------------------ | | 361| 309| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 689| 309| return nullptr; 690| 309| } 691| 19.4k| ret->is_quic = is_quic; 692| 19.4k| ret->is_resumable_across_names = is_resumable_across_names; 693| | 694| | // The two ALPS values and ALPN must be consistent. 695| 19.4k| if (has_local_alps != has_peer_alps || ------------------ | Branch (695:7): [True: 1, False: 19.4k] ------------------ 696| 19.4k| (has_local_alps && ret->early_alpn.empty())) { ------------------ | Branch (696:8): [True: 4, False: 19.4k] | Branch (696:26): [True: 1, False: 3] ------------------ 697| 2| OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_SSL_SESSION); ------------------ | | 361| 2| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 698| 2| return nullptr; 699| 2| } 700| 19.4k| ret->has_application_settings = has_local_alps; 701| | 702| 19.4k| if (!x509_method->session_cache_objects(ret.get())) { ------------------ | Branch (702:7): [True: 896, False: 18.5k] ------------------ 703| 896| OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_SSL_SESSION); ------------------ | | 361| 896| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 704| 896| return nullptr; 705| 896| } 706| | 707| 18.5k| return ret; 708| 19.4k|} SSL_SESSION_from_bytes: 782| 20.7k| const SSL_CTX *ctx) { 783| 20.7k| CBS cbs; 784| 20.7k| CBS_init(&cbs, in, in_len); 785| 20.7k| UniquePtr ret = 786| 20.7k| SSL_SESSION_parse(&cbs, ctx->x509_method, ctx->pool); 787| 20.7k| if (!ret) { ------------------ | Branch (787:7): [True: 2.19k, False: 18.5k] ------------------ 788| 2.19k| return NULL; 789| 2.19k| } 790| 18.5k| if (CBS_len(&cbs) != 0) { ------------------ | Branch (790:7): [True: 6, False: 18.5k] ------------------ 791| 6| OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_SSL_SESSION); ------------------ | | 361| 6| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 792| 6| return NULL; 793| 6| } 794| 18.5k| return ret.release(); 795| 18.5k|} ssl_asn1.cc:_ZN4bsslL22SSL_SESSION_parse_longEP6cbs_stPljl: 422| 20.0k| long default_value) { 423| 20.0k| uint64_t value; 424| 20.0k| if (!CBS_get_optional_asn1_uint64(cbs, &value, tag, ------------------ | Branch (424:7): [True: 1, False: 20.0k] ------------------ 425| 20.0k| (uint64_t)default_value) || 426| 20.0k| value > LONG_MAX) { ------------------ | Branch (426:7): [True: 56, False: 20.0k] ------------------ 427| 57| OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_SSL_SESSION); ------------------ | | 361| 57| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 428| 57| return 0; 429| 57| } 430| 20.0k| *out = (long)value; 431| 20.0k| return 1; 432| 20.0k|} ssl_asn1.cc:_ZN4bsslL24SSL_SESSION_parse_stringEP6cbs_stPNSt3__110unique_ptrIcNS_8internal7DeleterEEEj: 363| 20.0k| CBS_ASN1_TAG tag) { 364| 20.0k| CBS value; 365| 20.0k| int present; 366| 20.0k| if (!CBS_get_optional_asn1_octet_string(cbs, &value, &present, tag)) { ------------------ | Branch (366:7): [True: 2, False: 20.0k] ------------------ 367| 2| OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_SSL_SESSION); ------------------ | | 361| 2| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 368| 2| return 0; 369| 2| } 370| 20.0k| if (present) { ------------------ | Branch (370:7): [True: 862, False: 19.1k] ------------------ 371| 862| if (CBS_contains_zero_byte(&value)) { ------------------ | Branch (371:9): [True: 1, False: 861] ------------------ 372| 1| OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_SSL_SESSION); ------------------ | | 361| 1| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 373| 1| return 0; 374| 1| } 375| 861| char *raw = nullptr; 376| 861| if (!CBS_strdup(&value, &raw)) { ------------------ | Branch (376:9): [True: 0, False: 861] ------------------ 377| 0| return 0; 378| 0| } 379| 861| out->reset(raw); 380| 19.1k| } else { 381| 19.1k| out->reset(); 382| 19.1k| } 383| 20.0k| return 1; 384| 20.0k|} ssl_asn1.cc:_ZN4bsslL21SSL_SESSION_parse_u32EP6cbs_stPjjj: 435| 59.6k| uint32_t default_value) { 436| 59.6k| uint64_t value; 437| 59.6k| if (!CBS_get_optional_asn1_uint64(cbs, &value, tag, ------------------ | Branch (437:7): [True: 9, False: 59.6k] ------------------ 438| 59.6k| (uint64_t)default_value) || 439| 59.6k| value > 0xffffffff) { ------------------ | Branch (439:7): [True: 52, False: 59.5k] ------------------ 440| 61| OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_SSL_SESSION); ------------------ | | 361| 61| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 441| 61| return 0; 442| 61| } 443| 59.5k| *out = (uint32_t)value; 444| 59.5k| return 1; 445| 59.6k|} ssl_asn1.cc:_ZN4bsslL30SSL_SESSION_parse_octet_stringEP6cbs_stPNS_5ArrayIhEEj: 390| 59.5k| CBS_ASN1_TAG tag) { 391| 59.5k| CBS value; 392| 59.5k| if (!CBS_get_optional_asn1_octet_string(cbs, &value, NULL, tag)) { ------------------ | Branch (392:7): [True: 13, False: 59.4k] ------------------ 393| 13| OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_SSL_SESSION); ------------------ | | 361| 13| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 394| 13| return false; 395| 13| } 396| 59.4k| return out->CopyFrom(value); 397| 59.5k|} ssl_asn1.cc:_ZN4bsslL31SSL_SESSION_parse_crypto_bufferEP6cbs_stPNSt3__110unique_ptrI16crypto_buffer_stNS_8internal7DeleterEEEjP21crypto_buffer_pool_st: 402| 39.9k| CRYPTO_BUFFER_POOL *pool) { 403| 39.9k| if (!CBS_peek_asn1_tag(cbs, tag)) { ------------------ | Branch (403:7): [True: 34.7k, False: 5.20k] ------------------ 404| 34.7k| return 1; 405| 34.7k| } 406| | 407| 5.20k| CBS child, value; 408| 5.20k| if (!CBS_get_asn1(cbs, &child, tag) || ------------------ | Branch (408:7): [True: 4, False: 5.20k] ------------------ 409| 5.20k| !CBS_get_asn1(&child, &value, CBS_ASN1_OCTETSTRING) || ------------------ | | 218| 5.20k|#define CBS_ASN1_OCTETSTRING 0x4u ------------------ | Branch (409:7): [True: 1, False: 5.20k] ------------------ 410| 5.20k| CBS_len(&child) != 0) { ------------------ | Branch (410:7): [True: 1, False: 5.20k] ------------------ 411| 6| OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_SSL_SESSION); ------------------ | | 361| 6| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 412| 6| return 0; 413| 6| } 414| 5.20k| out->reset(CRYPTO_BUFFER_new_from_CBS(&value, pool)); 415| 5.20k| if (*out == nullptr) { ------------------ | Branch (415:7): [True: 0, False: 5.20k] ------------------ 416| 0| return 0; 417| 0| } 418| 5.20k| return 1; 419| 5.20k|} ssl_asn1.cc:_ZN4bsslL21SSL_SESSION_parse_u16EP6cbs_stPtjt: 448| 39.8k| uint16_t default_value) { 449| 39.8k| uint64_t value; 450| 39.8k| if (!CBS_get_optional_asn1_uint64(cbs, &value, tag, ------------------ | Branch (450:7): [True: 5, False: 39.8k] ------------------ 451| 39.8k| (uint64_t)default_value) || 452| 39.8k| value > 0xffff) { ------------------ | Branch (452:7): [True: 88, False: 39.7k] ------------------ 453| 93| OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_SSL_SESSION); ------------------ | | 361| 93| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 454| 93| return 0; 455| 93| } 456| 39.7k| *out = (uint16_t)value; 457| 39.7k| return 1; 458| 39.8k|} _ZN4bssl9SSLBuffer5ClearEv: 39| 1.49M|void SSLBuffer::Clear() { 40| 1.49M| if (buf_ != inline_buf_) { ------------------ | Branch (40:7): [True: 1.48M, False: 12.2k] ------------------ 41| 1.48M| free(buf_); // Allocated with malloc(). 42| 1.48M| } 43| 1.49M| buf_ = nullptr; 44| 1.49M| offset_ = 0; 45| 1.49M| size_ = 0; 46| 1.49M| cap_ = 0; 47| 1.49M|} _ZN4bssl9SSLBuffer9EnsureCapEmm: 49| 956k|bool SSLBuffer::EnsureCap(size_t header_len, size_t new_cap) { 50| 956k| if (new_cap > 0xffff) { ------------------ | Branch (50:7): [True: 0, False: 956k] ------------------ 51| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 52| 0| return false; 53| 0| } 54| | 55| 956k| if (cap_ >= new_cap) { ------------------ | Branch (55:7): [True: 0, False: 956k] ------------------ 56| 0| return true; 57| 0| } 58| | 59| 956k| uint8_t *new_buf; 60| 956k| size_t new_offset; 61| 956k| if (new_cap <= sizeof(inline_buf_)) { ------------------ | Branch (61:7): [True: 483k, False: 473k] ------------------ 62| | // This function is called twice per TLS record, first for the five-byte 63| | // header. To avoid allocating twice, use an inline buffer for short inputs. 64| 483k| new_buf = inline_buf_; 65| 483k| new_offset = 0; 66| 483k| } else { 67| | // Add up to |SSL3_ALIGN_PAYLOAD| - 1 bytes of slack for alignment. 68| | // 69| | // Since this buffer gets allocated quite frequently and doesn't contain any 70| | // sensitive data, we allocate with malloc rather than |OPENSSL_malloc| and 71| | // avoid zeroing on free. 72| 473k| new_buf = (uint8_t *)malloc(new_cap + SSL3_ALIGN_PAYLOAD - 1); ------------------ | | 114| 473k|#define SSL3_ALIGN_PAYLOAD 8 ------------------ 73| 473k| if (new_buf == NULL) { ------------------ | Branch (73:9): [True: 0, False: 473k] ------------------ 74| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 75| 0| return false; 76| 0| } 77| | 78| | // Offset the buffer such that the record body is aligned. 79| 473k| new_offset = 80| 473k| (0 - header_len - (uintptr_t)new_buf) & (SSL3_ALIGN_PAYLOAD - 1); ------------------ | | 114| 473k|#define SSL3_ALIGN_PAYLOAD 8 ------------------ 81| 473k| } 82| | 83| | // Note if the both old and new buffer are inline, the source and destination 84| | // may alias. 85| 956k| OPENSSL_memmove(new_buf + new_offset, buf_ + offset_, size_); 86| | 87| 956k| if (buf_ != inline_buf_) { ------------------ | Branch (87:7): [True: 485k, False: 470k] ------------------ 88| 485k| free(buf_); // Allocated with malloc(). 89| 485k| } 90| | 91| 956k| buf_ = new_buf; 92| 956k| offset_ = new_offset; 93| 956k| cap_ = new_cap; 94| 956k| return true; 95| 956k|} _ZN4bssl9SSLBuffer8DidWriteEm: 97| 955k|void SSLBuffer::DidWrite(size_t new_size) { 98| 955k| if (new_size > cap() - size()) { ------------------ | Branch (98:7): [True: 0, False: 955k] ------------------ 99| 0| abort(); 100| 0| } 101| 955k| size_ += new_size; 102| 955k|} _ZN4bssl9SSLBuffer7ConsumeEm: 104| 483k|void SSLBuffer::Consume(size_t len) { 105| 483k| if (len > size_) { ------------------ | Branch (105:7): [True: 0, False: 483k] ------------------ 106| 0| abort(); 107| 0| } 108| 483k| offset_ += (uint16_t)len; 109| 483k| size_ -= (uint16_t)len; 110| 483k| cap_ -= (uint16_t)len; 111| 483k|} _ZN4bssl9SSLBuffer15DiscardConsumedEv: 113| 2.39M|void SSLBuffer::DiscardConsumed() { 114| 2.39M| if (size_ == 0) { ------------------ | Branch (114:7): [True: 1.44M, False: 943k] ------------------ 115| 1.44M| Clear(); 116| 1.44M| } 117| 2.39M|} _ZN4bssl25ssl_read_buffer_extend_toEP6ssl_stm: 164| 953k|int ssl_read_buffer_extend_to(SSL *ssl, size_t len) { 165| | // |ssl_read_buffer_extend_to| implicitly discards any consumed data. 166| 953k| ssl->s3->read_buffer.DiscardConsumed(); 167| | 168| 953k| if (SSL_is_dtls(ssl)) { ------------------ | Branch (168:7): [True: 0, False: 953k] ------------------ 169| 0| static_assert( 170| 0| DTLS1_RT_MAX_HEADER_LENGTH + SSL3_RT_MAX_ENCRYPTED_LENGTH <= 0xffff, 171| 0| "DTLS read buffer is too large"); 172| | 173| | // The |len| parameter is ignored in DTLS. 174| 0| len = DTLS1_RT_MAX_HEADER_LENGTH + SSL3_RT_MAX_ENCRYPTED_LENGTH; ------------------ | | 2870| 0|#define DTLS1_RT_MAX_HEADER_LENGTH 13 ------------------ len = DTLS1_RT_MAX_HEADER_LENGTH + SSL3_RT_MAX_ENCRYPTED_LENGTH; ------------------ | | 158| 0| (SSL3_RT_MAX_ENCRYPTED_OVERHEAD + SSL3_RT_MAX_COMPRESSED_LENGTH) | | ------------------ | | | | 144| 0|#define SSL3_RT_MAX_ENCRYPTED_OVERHEAD (256 + SSL3_RT_MAX_MD_SIZE) | | | | ------------------ | | | | | | 126| 0|#define SSL3_RT_MAX_MD_SIZE 64 | | | | ------------------ | | ------------------ | | (SSL3_RT_MAX_ENCRYPTED_OVERHEAD + SSL3_RT_MAX_COMPRESSED_LENGTH) | | ------------------ | | | | 155| 0|#define SSL3_RT_MAX_COMPRESSED_LENGTH SSL3_RT_MAX_PLAIN_LENGTH | | | | ------------------ | | | | | | 133| 0|#define SSL3_RT_MAX_PLAIN_LENGTH 16384 | | | | ------------------ | | ------------------ ------------------ 175| 0| } 176| | 177| | // The DTLS record header can have a variable length, so the |header_len| 178| | // value provided for buffer alignment only works if the header is the maximum 179| | // length. 180| 953k| if (!ssl->s3->read_buffer.EnsureCap(DTLS1_RT_MAX_HEADER_LENGTH, len)) { ------------------ | | 2870| 953k|#define DTLS1_RT_MAX_HEADER_LENGTH 13 ------------------ | Branch (180:7): [True: 0, False: 953k] ------------------ 181| 0| return -1; 182| 0| } 183| | 184| 953k| if (ssl->rbio == nullptr) { ------------------ | Branch (184:7): [True: 0, False: 953k] ------------------ 185| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_BIO_NOT_SET); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 186| 0| return -1; 187| 0| } 188| | 189| 953k| int ret; 190| 953k| if (SSL_is_dtls(ssl)) { ------------------ | Branch (190:7): [True: 0, False: 953k] ------------------ 191| | // |len| is ignored for a datagram transport. 192| 0| ret = dtls_read_buffer_next_packet(ssl); 193| 953k| } else { 194| 953k| ret = tls_read_buffer_extend_to(ssl, len); 195| 953k| } 196| | 197| 953k| if (ret <= 0) { ------------------ | Branch (197:7): [True: 2.30k, False: 951k] ------------------ 198| | // If the buffer was empty originally and remained empty after attempting to 199| | // extend it, release the buffer until the next attempt. 200| 2.30k| ssl->s3->read_buffer.DiscardConsumed(); 201| 2.30k| } 202| 953k| return ret; 203| 953k|} _ZN4bssl22ssl_handle_open_recordEP6ssl_stPbNS_17ssl_open_record_tEmh: 206| 1.43M| size_t consumed, uint8_t alert) { 207| 1.43M| *out_retry = false; 208| 1.43M| if (ret != ssl_open_record_partial) { ------------------ | Branch (208:7): [True: 480k, False: 953k] ------------------ 209| 480k| ssl->s3->read_buffer.Consume(consumed); 210| 480k| } 211| 1.43M| if (ret != ssl_open_record_success) { ------------------ | Branch (211:7): [True: 1.01M, False: 421k] ------------------ 212| | // Nothing was returned to the caller, so discard anything marked consumed. 213| 1.01M| ssl->s3->read_buffer.DiscardConsumed(); 214| 1.01M| } 215| 1.43M| switch (ret) { ------------------ | Branch (215:11): [True: 0, False: 1.43M] ------------------ 216| 421k| case ssl_open_record_success: ------------------ | Branch (216:5): [True: 421k, False: 1.01M] ------------------ 217| 421k| return 1; 218| | 219| 953k| case ssl_open_record_partial: { ------------------ | Branch (219:5): [True: 953k, False: 480k] ------------------ 220| 953k| int read_ret = ssl_read_buffer_extend_to(ssl, consumed); 221| 953k| if (read_ret <= 0) { ------------------ | Branch (221:11): [True: 2.30k, False: 951k] ------------------ 222| 2.30k| return read_ret; 223| 2.30k| } 224| 951k| *out_retry = true; 225| 951k| return 1; 226| 953k| } 227| | 228| 58.0k| case ssl_open_record_discard: ------------------ | Branch (228:5): [True: 58.0k, False: 1.37M] ------------------ 229| 58.0k| *out_retry = true; 230| 58.0k| return 1; 231| | 232| 25| case ssl_open_record_close_notify: ------------------ | Branch (232:5): [True: 25, False: 1.43M] ------------------ 233| 25| ssl->s3->rwstate = SSL_ERROR_ZERO_RETURN; ------------------ | | 405| 25|#define SSL_ERROR_ZERO_RETURN 6 ------------------ 234| 25| return 0; 235| | 236| 838| case ssl_open_record_error: ------------------ | Branch (236:5): [True: 838, False: 1.43M] ------------------ 237| 838| if (alert != 0) { ------------------ | Branch (237:11): [True: 826, False: 12] ------------------ 238| 826| ssl_send_alert(ssl, SSL3_AL_FATAL, alert); ------------------ | | 176| 826|#define SSL3_AL_FATAL 2 ------------------ 239| 826| } 240| 838| return -1; 241| 1.43M| } 242| 0| assert(0); 243| 0| return -1; 244| 0|} _ZN4bssl22ssl_write_buffer_flushEP6ssl_st: 292| 5.66k|int ssl_write_buffer_flush(SSL *ssl) { 293| 5.66k| if (ssl->wbio == nullptr) { ------------------ | Branch (293:7): [True: 0, False: 5.66k] ------------------ 294| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_BIO_NOT_SET); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 295| 0| return -1; 296| 0| } 297| | 298| 5.66k| if (SSL_is_dtls(ssl)) { ------------------ | Branch (298:7): [True: 0, False: 5.66k] ------------------ 299| 0| return dtls_write_buffer_flush(ssl); 300| 5.66k| } else { 301| 5.66k| return tls_write_buffer_flush(ssl); 302| 5.66k| } 303| 5.66k|} ssl_buffer.cc:_ZN4bsslL25tls_read_buffer_extend_toEP6ssl_stm: 140| 953k|static int tls_read_buffer_extend_to(SSL *ssl, size_t len) { 141| 953k| SSLBuffer *buf = &ssl->s3->read_buffer; 142| | 143| 953k| if (len > buf->cap()) { ------------------ | Branch (143:7): [True: 0, False: 953k] ------------------ 144| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_BUFFER_TOO_SMALL); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 145| 0| return -1; 146| 0| } 147| | 148| | // Read until the target length is reached. 149| 1.90M| while (buf->size() < len) { ------------------ | Branch (149:10): [True: 954k, False: 951k] ------------------ 150| | // The amount of data to read is bounded by |buf->cap|, which must fit in an 151| | // int. 152| 954k| int ret = BIO_read(ssl->rbio.get(), buf->data() + buf->size(), 153| 954k| static_cast(len - buf->size())); 154| 954k| if (ret <= 0) { ------------------ | Branch (154:9): [True: 2.30k, False: 952k] ------------------ 155| 2.30k| ssl->s3->rwstate = SSL_ERROR_WANT_READ; ------------------ | | 381| 2.30k|#define SSL_ERROR_WANT_READ 2 ------------------ 156| 2.30k| return ret; 157| 2.30k| } 158| 952k| buf->DidWrite(static_cast(ret)); 159| 952k| } 160| | 161| 951k| return 1; 162| 953k|} ssl_buffer.cc:_ZN4bsslL22tls_write_buffer_flushEP6ssl_st: 258| 5.66k|static int tls_write_buffer_flush(SSL *ssl) { 259| 5.66k| SSLBuffer *buf = &ssl->s3->write_buffer; 260| | 261| 8.50k| while (!buf->empty()) { ------------------ | Branch (261:10): [True: 2.83k, False: 5.66k] ------------------ 262| 2.83k| int ret = BIO_write(ssl->wbio.get(), buf->data(), buf->size()); 263| 2.83k| if (ret <= 0) { ------------------ | Branch (263:9): [True: 0, False: 2.83k] ------------------ 264| 0| ssl->s3->rwstate = SSL_ERROR_WANT_WRITE; ------------------ | | 386| 0|#define SSL_ERROR_WANT_WRITE 3 ------------------ 265| 0| return ret; 266| 0| } 267| 2.83k| buf->Consume(static_cast(ret)); 268| 2.83k| } 269| 5.66k| buf->Clear(); 270| 5.66k| return 1; 271| 5.66k|} _ZN4bssl4CERTC2EPKNS_15SSL_X509_METHODE: 39| 19.9k| : legacy_credential(MakeUnique(SSLCredentialType::kX509)), 40| 19.9k| x509_method(x509_method_arg) {} _ZN4bssl4CERTD2Ev: 42| 19.9k|CERT::~CERT() { x509_method->cert_free(this); } _ZN4bssl12ssl_cert_dupEPNS_4CERTE: 44| 19.9k|UniquePtr ssl_cert_dup(CERT *cert) { 45| 19.9k| UniquePtr ret = MakeUnique(cert->x509_method); 46| 19.9k| if (!ret) { ------------------ | Branch (46:7): [True: 0, False: 19.9k] ------------------ 47| 0| return nullptr; 48| 0| } 49| | 50| | // TODO(crbug.com/boringssl/431): This should just be |CopyFrom|. 51| 19.9k| for (const auto &cred : cert->credentials) { ------------------ | Branch (51:25): [True: 0, False: 19.9k] ------------------ 52| 0| if (!ret->credentials.Push(UpRef(cred))) { ------------------ | Branch (52:9): [True: 0, False: 0] ------------------ 53| 0| return nullptr; 54| 0| } 55| 0| } 56| | 57| | // |legacy_credential| is mutable, so it must be copied. We cannot simply 58| | // bump the reference count. 59| 19.9k| ret->legacy_credential = cert->legacy_credential->Dup(); 60| 19.9k| if (ret->legacy_credential == nullptr) { ------------------ | Branch (60:7): [True: 0, False: 19.9k] ------------------ 61| 0| return nullptr; 62| 0| } 63| | 64| 19.9k| ret->cert_cb = cert->cert_cb; 65| 19.9k| ret->cert_cb_arg = cert->cert_cb_arg; 66| | 67| 19.9k| ret->x509_method->cert_dup(ret.get(), cert); 68| | 69| 19.9k| ret->sid_ctx = cert->sid_ctx; 70| 19.9k| return ret; 71| 19.9k|} _ZN4bssl12ssl_set_certEPNS_4CERTENSt3__110unique_ptrI16crypto_buffer_stNS_8internal7DeleterEEE: 109| 2|bool ssl_set_cert(CERT *cert, UniquePtr buffer) { 110| | // Don't fail for a cert/key mismatch, just free the current private key. 111| | // (When switching to a different keypair, the caller should switch the 112| | // certificate, then the key.) 113| 2| if (!cert->legacy_credential->SetLeafCert(std::move(buffer), ------------------ | Branch (113:7): [True: 0, False: 2] ------------------ 114| 2| /*discard_key_on_mismatch=*/true)) { 115| 0| return false; 116| 0| } 117| | 118| 2| cert->x509_method->cert_flush_cached_leaf(cert); 119| 2| return true; 120| 2|} _ZN4bssl20ssl_parse_cert_chainEPhPNSt3__110unique_ptrI22stack_st_CRYPTO_BUFFERNS_8internal7DeleterEEEPNS2_I11evp_pkey_stS5_EES0_P6cbs_stP21crypto_buffer_pool_st: 126| 54.3k| CRYPTO_BUFFER_POOL *pool) { 127| 54.3k| out_chain->reset(); 128| 54.3k| out_pubkey->reset(); 129| | 130| 54.3k| CBS certificate_list; 131| 54.3k| if (!CBS_get_u24_length_prefixed(cbs, &certificate_list)) { ------------------ | Branch (131:7): [True: 26, False: 54.3k] ------------------ 132| 26| *out_alert = SSL_AD_DECODE_ERROR; ------------------ | | 4382| 26|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 26|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 133| 26| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); ------------------ | | 361| 26| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 134| 26| return false; 135| 26| } 136| | 137| 54.3k| if (CBS_len(&certificate_list) == 0) { ------------------ | Branch (137:7): [True: 4, False: 54.3k] ------------------ 138| 4| return true; 139| 4| } 140| | 141| 54.3k| UniquePtr chain(sk_CRYPTO_BUFFER_new_null()); 142| 54.3k| if (!chain) { ------------------ | Branch (142:7): [True: 0, False: 54.3k] ------------------ 143| 0| *out_alert = SSL_AD_INTERNAL_ERROR; ------------------ | | 4387| 0|#define SSL_AD_INTERNAL_ERROR TLS1_AD_INTERNAL_ERROR | | ------------------ | | | | 37| 0|#define TLS1_AD_INTERNAL_ERROR 80 | | ------------------ ------------------ 144| 0| return false; 145| 0| } 146| | 147| 54.3k| UniquePtr pubkey; 148| 108k| while (CBS_len(&certificate_list) > 0) { ------------------ | Branch (148:10): [True: 54.3k, False: 53.9k] ------------------ 149| 54.3k| CBS certificate; 150| 54.3k| if (!CBS_get_u24_length_prefixed(&certificate_list, &certificate) || ------------------ | Branch (150:9): [True: 10, False: 54.3k] ------------------ 151| 54.3k| CBS_len(&certificate) == 0) { ------------------ | Branch (151:9): [True: 2, False: 54.3k] ------------------ 152| 12| *out_alert = SSL_AD_DECODE_ERROR; ------------------ | | 4382| 12|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 12|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 153| 12| OPENSSL_PUT_ERROR(SSL, SSL_R_CERT_LENGTH_MISMATCH); ------------------ | | 361| 12| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 154| 12| return false; 155| 12| } 156| | 157| 54.3k| if (sk_CRYPTO_BUFFER_num(chain.get()) == 0) { ------------------ | Branch (157:9): [True: 54.3k, False: 42] ------------------ 158| 54.3k| pubkey = ssl_cert_parse_pubkey(&certificate); 159| 54.3k| if (!pubkey) { ------------------ | Branch (159:11): [True: 397, False: 53.9k] ------------------ 160| 397| *out_alert = SSL_AD_DECODE_ERROR; ------------------ | | 4382| 397|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 397|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 161| 397| return false; 162| 397| } 163| | 164| | // Retain the hash of the leaf certificate if requested. 165| 53.9k| if (out_leaf_sha256 != NULL) { ------------------ | Branch (165:11): [True: 0, False: 53.9k] ------------------ 166| 0| SHA256(CBS_data(&certificate), CBS_len(&certificate), out_leaf_sha256); 167| 0| } 168| 53.9k| } 169| | 170| 53.9k| UniquePtr buf( 171| 53.9k| CRYPTO_BUFFER_new_from_CBS(&certificate, pool)); 172| 53.9k| if (!buf || // ------------------ | Branch (172:9): [True: 0, False: 53.9k] | Branch (172:9): [True: 0, False: 53.9k] ------------------ 173| 53.9k| !PushToStack(chain.get(), std::move(buf))) { ------------------ | Branch (173:9): [True: 0, False: 53.9k] ------------------ 174| 0| *out_alert = SSL_AD_INTERNAL_ERROR; ------------------ | | 4387| 0|#define SSL_AD_INTERNAL_ERROR TLS1_AD_INTERNAL_ERROR | | ------------------ | | | | 37| 0|#define TLS1_AD_INTERNAL_ERROR 80 | | ------------------ ------------------ 175| 0| return false; 176| 0| } 177| 53.9k| } 178| | 179| 53.9k| *out_chain = std::move(chain); 180| 53.9k| *out_pubkey = std::move(pubkey); 181| 53.9k| return true; 182| 54.3k|} _ZN4bssl21ssl_cert_parse_pubkeyEPK6cbs_st: 262| 54.4k|UniquePtr ssl_cert_parse_pubkey(const CBS *in) { 263| 54.4k| CBS buf = *in, tbs_cert; 264| 54.4k| if (!ssl_cert_skip_to_spki(&buf, &tbs_cert)) { ------------------ | Branch (264:7): [True: 66, False: 54.3k] ------------------ 265| 66| OPENSSL_PUT_ERROR(SSL, SSL_R_CANNOT_PARSE_LEAF_CERT); ------------------ | | 361| 66| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 266| 66| return nullptr; 267| 66| } 268| | 269| 54.3k| return UniquePtr(EVP_parse_public_key(&tbs_cert)); 270| 54.4k|} _ZN4bssl34ssl_compare_public_and_private_keyEPK11evp_pkey_stS2_: 273| 2| const EVP_PKEY *privkey) { 274| 2| if (EVP_PKEY_is_opaque(privkey)) { ------------------ | Branch (274:7): [True: 0, False: 2] ------------------ 275| | // We cannot check an opaque private key and have to trust that it 276| | // matches. 277| 0| return true; 278| 0| } 279| | 280| 2| switch (EVP_PKEY_cmp(pubkey, privkey)) { ------------------ | Branch (280:11): [True: 0, False: 2] ------------------ 281| 2| case 1: ------------------ | Branch (281:5): [True: 2, False: 0] ------------------ 282| 2| return true; 283| 0| case 0: ------------------ | Branch (283:5): [True: 0, False: 2] ------------------ 284| 0| OPENSSL_PUT_ERROR(X509, X509_R_KEY_VALUES_MISMATCH); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 285| 0| return false; 286| 0| case -1: ------------------ | Branch (286:5): [True: 0, False: 2] ------------------ 287| 0| OPENSSL_PUT_ERROR(X509, X509_R_KEY_TYPE_MISMATCH); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 288| 0| return false; 289| 0| case -2: ------------------ | Branch (289:5): [True: 0, False: 2] ------------------ 290| 0| OPENSSL_PUT_ERROR(X509, X509_R_UNKNOWN_KEY_TYPE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 291| 0| return false; 292| 2| } 293| | 294| 0| assert(0); 295| 0| return false; 296| 0|} _ZN4bssl24ssl_cert_check_key_usageEPK6cbs_stNS_15ssl_key_usage_tE: 298| 52.4k|bool ssl_cert_check_key_usage(const CBS *in, enum ssl_key_usage_t bit) { 299| 52.4k| CBS buf = *in; 300| | 301| 52.4k| CBS tbs_cert, outer_extensions; 302| 52.4k| int has_extensions; 303| 52.4k| if (!ssl_cert_skip_to_spki(&buf, &tbs_cert) || ------------------ | Branch (303:7): [True: 0, False: 52.4k] ------------------ 304| | // subjectPublicKeyInfo 305| 52.4k| !CBS_get_asn1(&tbs_cert, NULL, CBS_ASN1_SEQUENCE) || ------------------ | | 223| 52.4k|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED) | | ------------------ | | | | 197| 52.4k|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | | | ------------------ | | | | | | 194| 52.4k|#define CBS_ASN1_TAG_SHIFT 24 | | | | ------------------ | | ------------------ ------------------ | Branch (305:7): [True: 0, False: 52.4k] ------------------ 306| | // issuerUniqueID 307| 52.4k| !CBS_get_optional_asn1(&tbs_cert, NULL, NULL, ------------------ | Branch (307:7): [True: 1, False: 52.4k] ------------------ 308| 52.4k| CBS_ASN1_CONTEXT_SPECIFIC | 1) || ------------------ | | 203| 52.4k|#define CBS_ASN1_CONTEXT_SPECIFIC (0x80u << CBS_ASN1_TAG_SHIFT) | | ------------------ | | | | 194| 52.4k|#define CBS_ASN1_TAG_SHIFT 24 | | ------------------ ------------------ 309| | // subjectUniqueID 310| 52.4k| !CBS_get_optional_asn1(&tbs_cert, NULL, NULL, ------------------ | Branch (310:7): [True: 1, False: 52.4k] ------------------ 311| 52.4k| CBS_ASN1_CONTEXT_SPECIFIC | 2) || ------------------ | | 203| 52.4k|#define CBS_ASN1_CONTEXT_SPECIFIC (0x80u << CBS_ASN1_TAG_SHIFT) | | ------------------ | | | | 194| 52.4k|#define CBS_ASN1_TAG_SHIFT 24 | | ------------------ ------------------ 312| 52.4k| !CBS_get_optional_asn1( ------------------ | Branch (312:7): [True: 1, False: 52.4k] ------------------ 313| 52.4k| &tbs_cert, &outer_extensions, &has_extensions, 314| 52.4k| CBS_ASN1_CONSTRUCTED | CBS_ASN1_CONTEXT_SPECIFIC | 3)) { ------------------ | | 197| 52.4k|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | ------------------ | | | | 194| 52.4k|#define CBS_ASN1_TAG_SHIFT 24 | | ------------------ ------------------ CBS_ASN1_CONSTRUCTED | CBS_ASN1_CONTEXT_SPECIFIC | 3)) { ------------------ | | 203| 52.4k|#define CBS_ASN1_CONTEXT_SPECIFIC (0x80u << CBS_ASN1_TAG_SHIFT) | | ------------------ | | | | 194| 52.4k|#define CBS_ASN1_TAG_SHIFT 24 | | ------------------ ------------------ 315| 3| OPENSSL_PUT_ERROR(SSL, SSL_R_CANNOT_PARSE_LEAF_CERT); ------------------ | | 361| 3| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 316| 3| return false; 317| 3| } 318| | 319| 52.4k| if (!has_extensions) { ------------------ | Branch (319:7): [True: 2, False: 52.4k] ------------------ 320| 2| return true; 321| 2| } 322| | 323| 52.4k| CBS extensions; 324| 52.4k| if (!CBS_get_asn1(&outer_extensions, &extensions, CBS_ASN1_SEQUENCE)) { ------------------ | | 223| 52.4k|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED) | | ------------------ | | | | 197| 52.4k|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | | | ------------------ | | | | | | 194| 52.4k|#define CBS_ASN1_TAG_SHIFT 24 | | | | ------------------ | | ------------------ ------------------ | Branch (324:7): [True: 1, False: 52.4k] ------------------ 325| 1| OPENSSL_PUT_ERROR(SSL, SSL_R_CANNOT_PARSE_LEAF_CERT); ------------------ | | 361| 1| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 326| 1| return false; 327| 1| } 328| | 329| 209k| while (CBS_len(&extensions) > 0) { ------------------ | Branch (329:10): [True: 157k, False: 52.3k] ------------------ 330| 157k| CBS extension, oid, contents; 331| 157k| if (!CBS_get_asn1(&extensions, &extension, CBS_ASN1_SEQUENCE) || ------------------ | | 223| 157k|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED) | | ------------------ | | | | 197| 157k|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | | | ------------------ | | | | | | 194| 157k|#define CBS_ASN1_TAG_SHIFT 24 | | | | ------------------ | | ------------------ ------------------ | Branch (331:9): [True: 3, False: 157k] ------------------ 332| 157k| !CBS_get_asn1(&extension, &oid, CBS_ASN1_OBJECT) || ------------------ | | 220| 157k|#define CBS_ASN1_OBJECT 0x6u ------------------ | Branch (332:9): [True: 1, False: 157k] ------------------ 333| 157k| (CBS_peek_asn1_tag(&extension, CBS_ASN1_BOOLEAN) && ------------------ | | 215| 157k|#define CBS_ASN1_BOOLEAN 0x1u ------------------ | Branch (333:10): [True: 26.7k, False: 130k] ------------------ 334| 157k| !CBS_get_asn1(&extension, NULL, CBS_ASN1_BOOLEAN)) || ------------------ | | 215| 26.7k|#define CBS_ASN1_BOOLEAN 0x1u ------------------ | Branch (334:10): [True: 1, False: 26.7k] ------------------ 335| 157k| !CBS_get_asn1(&extension, &contents, CBS_ASN1_OCTETSTRING) || ------------------ | | 218| 157k|#define CBS_ASN1_OCTETSTRING 0x4u ------------------ | Branch (335:9): [True: 1, False: 157k] ------------------ 336| 157k| CBS_len(&extension) != 0) { ------------------ | Branch (336:9): [True: 1, False: 157k] ------------------ 337| 7| OPENSSL_PUT_ERROR(SSL, SSL_R_CANNOT_PARSE_LEAF_CERT); ------------------ | | 361| 7| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 338| 7| return false; 339| 7| } 340| | 341| 157k| static const uint8_t kKeyUsageOID[3] = {0x55, 0x1d, 0x0f}; 342| 157k| if (CBS_len(&oid) != sizeof(kKeyUsageOID) || ------------------ | Branch (342:9): [True: 36, False: 157k] ------------------ 343| 157k| OPENSSL_memcmp(CBS_data(&oid), kKeyUsageOID, sizeof(kKeyUsageOID)) != ------------------ | Branch (343:9): [True: 157k, False: 12] ------------------ 344| 157k| 0) { 345| 157k| continue; 346| 157k| } 347| | 348| 12| CBS bit_string; 349| 12| if (!CBS_get_asn1(&contents, &bit_string, CBS_ASN1_BITSTRING) || ------------------ | | 217| 12|#define CBS_ASN1_BITSTRING 0x3u ------------------ | Branch (349:9): [True: 5, False: 7] ------------------ 350| 12| CBS_len(&contents) != 0) { ------------------ | Branch (350:9): [True: 1, False: 6] ------------------ 351| 6| OPENSSL_PUT_ERROR(SSL, SSL_R_CANNOT_PARSE_LEAF_CERT); ------------------ | | 361| 6| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 352| 6| return false; 353| 6| } 354| | 355| | // This is the KeyUsage extension. See 356| | // https://tools.ietf.org/html/rfc5280#section-4.2.1.3 357| 6| if (!CBS_is_valid_asn1_bitstring(&bit_string)) { ------------------ | Branch (357:9): [True: 3, False: 3] ------------------ 358| 3| OPENSSL_PUT_ERROR(SSL, SSL_R_CANNOT_PARSE_LEAF_CERT); ------------------ | | 361| 3| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 359| 3| return false; 360| 3| } 361| | 362| 3| if (!CBS_asn1_bitstring_has_bit(&bit_string, bit)) { ------------------ | Branch (362:9): [True: 1, False: 2] ------------------ 363| 1| OPENSSL_PUT_ERROR(SSL, SSL_R_KEY_USAGE_BIT_INCORRECT); ------------------ | | 361| 1| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 364| 1| return false; 365| 1| } 366| | 367| 2| return true; 368| 3| } 369| | 370| | // No KeyUsage extension found. 371| 52.3k| return true; 372| 52.4k|} _ZN4bssl17SSL_parse_CA_listEP6ssl_stPhP6cbs_st: 376| 28.1k| CBS *cbs) { 377| 28.1k| CRYPTO_BUFFER_POOL *const pool = ssl->ctx->pool; 378| | 379| 28.1k| UniquePtr ret(sk_CRYPTO_BUFFER_new_null()); 380| 28.1k| if (!ret) { ------------------ | Branch (380:7): [True: 0, False: 28.1k] ------------------ 381| 0| *out_alert = SSL_AD_INTERNAL_ERROR; ------------------ | | 4387| 0|#define SSL_AD_INTERNAL_ERROR TLS1_AD_INTERNAL_ERROR | | ------------------ | | | | 37| 0|#define TLS1_AD_INTERNAL_ERROR 80 | | ------------------ ------------------ 382| 0| return nullptr; 383| 0| } 384| | 385| 28.1k| CBS child; 386| 28.1k| if (!CBS_get_u16_length_prefixed(cbs, &child)) { ------------------ | Branch (386:7): [True: 10, False: 28.1k] ------------------ 387| 10| *out_alert = SSL_AD_DECODE_ERROR; ------------------ | | 4382| 10|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 10|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 388| 10| OPENSSL_PUT_ERROR(SSL, SSL_R_LENGTH_MISMATCH); ------------------ | | 361| 10| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 389| 10| return nullptr; 390| 10| } 391| | 392| 28.2k| while (CBS_len(&child) > 0) { ------------------ | Branch (392:10): [True: 113, False: 28.1k] ------------------ 393| 113| CBS distinguished_name; 394| 113| if (!CBS_get_u16_length_prefixed(&child, &distinguished_name)) { ------------------ | Branch (394:9): [True: 8, False: 105] ------------------ 395| 8| *out_alert = SSL_AD_DECODE_ERROR; ------------------ | | 4382| 8|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 8|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 396| 8| OPENSSL_PUT_ERROR(SSL, SSL_R_CA_DN_TOO_LONG); ------------------ | | 361| 8| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 397| 8| return nullptr; 398| 8| } 399| | 400| 105| UniquePtr buffer( 401| 105| CRYPTO_BUFFER_new_from_CBS(&distinguished_name, pool)); 402| 105| if (!buffer || // ------------------ | Branch (402:9): [True: 0, False: 105] | Branch (402:9): [True: 0, False: 105] ------------------ 403| 105| !PushToStack(ret.get(), std::move(buffer))) { ------------------ | Branch (403:9): [True: 0, False: 105] ------------------ 404| 0| *out_alert = SSL_AD_INTERNAL_ERROR; ------------------ | | 4387| 0|#define SSL_AD_INTERNAL_ERROR TLS1_AD_INTERNAL_ERROR | | ------------------ | | | | 37| 0|#define TLS1_AD_INTERNAL_ERROR 80 | | ------------------ ------------------ 405| 0| return nullptr; 406| 0| } 407| 105| } 408| | 409| 28.1k| if (!ssl->ctx->x509_method->check_CA_list(ret.get())) { ------------------ | Branch (409:7): [True: 4, False: 28.1k] ------------------ 410| 4| *out_alert = SSL_AD_DECODE_ERROR; ------------------ | | 4382| 4|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 4|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 411| 4| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); ------------------ | | 361| 4| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 412| 4| return nullptr; 413| 4| } 414| | 415| 28.1k| return ret; 416| 28.1k|} _ZN4bssl16ssl_has_CA_namesEPKNS_10SSL_CONFIGE: 461| 56.4k|bool ssl_has_CA_names(const SSL_CONFIG *cfg) { 462| 56.4k| return CA_names_non_empty(cfg->CA_names.get(), cfg->ssl->ctx->CA_names.get()); 463| 56.4k|} _ZN4bssl26ssl_check_leaf_certificateEPNS_13SSL_HANDSHAKEEP11evp_pkey_stPK16crypto_buffer_st: 476| 53.5k| const CRYPTO_BUFFER *leaf) { 477| 53.5k| assert(ssl_protocol_version(hs->ssl) < TLS1_3_VERSION); 478| | 479| | // Check the certificate's type matches the cipher. This does not check key 480| | // usage restrictions, which are handled separately. 481| | // 482| | // TODO(davidben): Put the key type and key usage checks in one place. 483| 53.5k| if (!(hs->new_cipher->algorithm_auth & ------------------ | Branch (483:7): [True: 5, False: 53.4k] ------------------ 484| 53.5k| ssl_cipher_auth_mask_for_key(pkey, /*sign_ok=*/true))) { 485| 5| OPENSSL_PUT_ERROR(SSL, SSL_R_WRONG_CERTIFICATE_TYPE); ------------------ | | 361| 5| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 486| 5| return false; 487| 5| } 488| | 489| 53.4k| if (EVP_PKEY_id(pkey) == EVP_PKEY_EC) { ------------------ | | 136| 53.4k|#define EVP_PKEY_EC NID_X9_62_id_ecPublicKey | | ------------------ | | | | 1844| 53.4k|#define NID_X9_62_id_ecPublicKey 408 | | ------------------ ------------------ | Branch (489:7): [True: 14.4k, False: 39.0k] ------------------ 490| | // Check the key's group and point format are acceptable. 491| 14.4k| EC_KEY *ec_key = EVP_PKEY_get0_EC_KEY(pkey); 492| 14.4k| uint16_t group_id; 493| 14.4k| if (!ssl_nid_to_group_id( ------------------ | Branch (493:9): [True: 1, False: 14.4k] ------------------ 494| 14.4k| &group_id, EC_GROUP_get_curve_name(EC_KEY_get0_group(ec_key))) || 495| 14.4k| !tls1_check_group_id(hs, group_id) || ------------------ | Branch (495:9): [True: 0, False: 14.4k] ------------------ 496| 14.4k| EC_KEY_get_conv_form(ec_key) != POINT_CONVERSION_UNCOMPRESSED) { ------------------ | Branch (496:9): [True: 0, False: 14.4k] ------------------ 497| 1| OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_ECC_CERT); ------------------ | | 361| 1| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 498| 1| return false; 499| 1| } 500| 14.4k| } 501| | 502| 53.4k| return true; 503| 53.4k|} SSL_CTX_set_signed_cert_timestamp_list: 596| 2| size_t list_len) { 597| 2| UniquePtr buf(CRYPTO_BUFFER_new(list, list_len, nullptr)); 598| 2| return buf != nullptr && SSL_CREDENTIAL_set1_signed_cert_timestamp_list( ------------------ | Branch (598:10): [True: 2, False: 0] | Branch (598:28): [True: 2, False: 0] ------------------ 599| 2| ctx->cert->legacy_credential.get(), buf.get()); 600| 2|} SSL_CTX_set_ocsp_response: 614| 2| size_t response_len) { 615| 2| UniquePtr buf( 616| 2| CRYPTO_BUFFER_new(response, response_len, nullptr)); 617| 2| return buf != nullptr && SSL_CREDENTIAL_set1_ocsp_response( ------------------ | Branch (617:10): [True: 2, False: 0] | Branch (617:28): [True: 2, False: 0] ------------------ 618| 2| ctx->cert->legacy_credential.get(), buf.get()); 619| 2|} ssl_cert.cc:_ZN4bsslL21ssl_cert_skip_to_spkiEPK6cbs_stPS0_: 187| 106k|static bool ssl_cert_skip_to_spki(const CBS *in, CBS *out_tbs_cert) { 188| | /* From RFC 5280, section 4.1 189| | * Certificate ::= SEQUENCE { 190| | * tbsCertificate TBSCertificate, 191| | * signatureAlgorithm AlgorithmIdentifier, 192| | * signatureValue BIT STRING } 193| | 194| | * TBSCertificate ::= SEQUENCE { 195| | * version [0] EXPLICIT Version DEFAULT v1, 196| | * serialNumber CertificateSerialNumber, 197| | * signature AlgorithmIdentifier, 198| | * issuer Name, 199| | * validity Validity, 200| | * subject Name, 201| | * subjectPublicKeyInfo SubjectPublicKeyInfo, 202| | * ... } */ 203| 106k| CBS buf = *in; 204| | 205| 106k| CBS toplevel; 206| 106k| if (!CBS_get_asn1(&buf, &toplevel, CBS_ASN1_SEQUENCE) || // ------------------ | | 223| 106k|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED) | | ------------------ | | | | 197| 106k|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | | | ------------------ | | | | | | 194| 106k|#define CBS_ASN1_TAG_SHIFT 24 | | | | ------------------ | | ------------------ ------------------ | Branch (206:7): [True: 7, False: 106k] ------------------ 207| 106k| CBS_len(&buf) != 0 || // ------------------ | Branch (207:7): [True: 1, False: 106k] ------------------ 208| 106k| !CBS_get_asn1(&toplevel, out_tbs_cert, CBS_ASN1_SEQUENCE) || // ------------------ | | 223| 106k|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED) | | ------------------ | | | | 197| 106k|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | | | ------------------ | | | | | | 194| 106k|#define CBS_ASN1_TAG_SHIFT 24 | | | | ------------------ | | ------------------ ------------------ | Branch (208:7): [True: 2, False: 106k] ------------------ 209| | // version 210| 106k| !CBS_get_optional_asn1( ------------------ | Branch (210:7): [True: 1, False: 106k] ------------------ 211| 106k| out_tbs_cert, NULL, NULL, 212| 106k| CBS_ASN1_CONSTRUCTED | CBS_ASN1_CONTEXT_SPECIFIC | 0) || // ------------------ | | 197| 106k|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | ------------------ | | | | 194| 106k|#define CBS_ASN1_TAG_SHIFT 24 | | ------------------ ------------------ CBS_ASN1_CONSTRUCTED | CBS_ASN1_CONTEXT_SPECIFIC | 0) || // ------------------ | | 203| 106k|#define CBS_ASN1_CONTEXT_SPECIFIC (0x80u << CBS_ASN1_TAG_SHIFT) | | ------------------ | | | | 194| 106k|#define CBS_ASN1_TAG_SHIFT 24 | | ------------------ ------------------ 213| | 214| | // serialNumber 215| 106k| !CBS_get_asn1(out_tbs_cert, NULL, CBS_ASN1_INTEGER) || ------------------ | | 216| 106k|#define CBS_ASN1_INTEGER 0x2u ------------------ | Branch (215:7): [True: 7, False: 106k] ------------------ 216| | // signature algorithm 217| 106k| !CBS_get_asn1(out_tbs_cert, NULL, CBS_ASN1_SEQUENCE) || ------------------ | | 223| 106k|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED) | | ------------------ | | | | 197| 106k|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | | | ------------------ | | | | | | 194| 106k|#define CBS_ASN1_TAG_SHIFT 24 | | | | ------------------ | | ------------------ ------------------ | Branch (217:7): [True: 5, False: 106k] ------------------ 218| | // issuer 219| 106k| !CBS_get_asn1(out_tbs_cert, NULL, CBS_ASN1_SEQUENCE) || ------------------ | | 223| 106k|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED) | | ------------------ | | | | 197| 106k|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | | | ------------------ | | | | | | 194| 106k|#define CBS_ASN1_TAG_SHIFT 24 | | | | ------------------ | | ------------------ ------------------ | Branch (219:7): [True: 7, False: 106k] ------------------ 220| | // validity 221| 106k| !CBS_get_asn1(out_tbs_cert, NULL, CBS_ASN1_SEQUENCE) || ------------------ | | 223| 106k|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED) | | ------------------ | | | | 197| 106k|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | | | ------------------ | | | | | | 194| 106k|#define CBS_ASN1_TAG_SHIFT 24 | | | | ------------------ | | ------------------ ------------------ | Branch (221:7): [True: 18, False: 106k] ------------------ 222| | // subject 223| 106k| !CBS_get_asn1(out_tbs_cert, NULL, CBS_ASN1_SEQUENCE)) { ------------------ | | 223| 106k|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED) | | ------------------ | | | | 197| 106k|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT) | | | | ------------------ | | | | | | 194| 106k|#define CBS_ASN1_TAG_SHIFT 24 | | | | ------------------ | | ------------------ ------------------ | Branch (223:7): [True: 18, False: 106k] ------------------ 224| 66| return false; 225| 66| } 226| | 227| 106k| return true; 228| 106k|} ssl_cert.cc:_ZN4bsslL18CA_names_non_emptyEPK22stack_st_CRYPTO_BUFFERS2_: 419| 56.4k| const STACK_OF(CRYPTO_BUFFER) *ctx_names) { 420| 56.4k| if (config_names != nullptr) { ------------------ | Branch (420:7): [True: 0, False: 56.4k] ------------------ 421| 0| return sk_CRYPTO_BUFFER_num(config_names) > 0; 422| 0| } 423| 56.4k| if (ctx_names != nullptr) { ------------------ | Branch (423:7): [True: 56.4k, False: 0] ------------------ 424| 56.4k| return sk_CRYPTO_BUFFER_num(ctx_names) > 0; 425| 56.4k| } 426| 0| return false; 427| 56.4k|} _ZN4bssl23ssl_cipher_get_evp_aeadEPPK11evp_aead_stPmS4_PK13ssl_cipher_stt: 453| 208k| uint16_t version) { 454| 208k| *out_aead = NULL; 455| 208k| *out_mac_secret_len = 0; 456| 208k| *out_fixed_iv_len = 0; 457| | 458| 208k| if (cipher->algorithm_mac == SSL_AEAD) { ------------------ | | 289| 208k|#define SSL_AEAD 0x00000004u ------------------ | Branch (458:7): [True: 80.6k, False: 128k] ------------------ 459| 80.6k| if (cipher->algorithm_enc == SSL_AES128GCM) { ------------------ | | 279| 80.6k|#define SSL_AES128GCM 0x00000008u ------------------ | Branch (459:9): [True: 60.5k, False: 20.1k] ------------------ 460| 60.5k| if (version < TLS1_3_VERSION) { ------------------ | | 545| 60.5k|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (460:11): [True: 59.3k, False: 1.22k] ------------------ 461| 59.3k| *out_aead = EVP_aead_aes_128_gcm_tls12(); 462| 59.3k| } else { 463| 1.22k| *out_aead = EVP_aead_aes_128_gcm_tls13(); 464| 1.22k| } 465| 60.5k| *out_fixed_iv_len = 4; 466| 60.5k| } else if (cipher->algorithm_enc == SSL_AES256GCM) { ------------------ | | 280| 20.1k|#define SSL_AES256GCM 0x00000010u ------------------ | Branch (466:16): [True: 20.0k, False: 28] ------------------ 467| 20.0k| if (version < TLS1_3_VERSION) { ------------------ | | 545| 20.0k|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (467:11): [True: 19.9k, False: 166] ------------------ 468| 19.9k| *out_aead = EVP_aead_aes_256_gcm_tls12(); 469| 19.9k| } else { 470| 166| *out_aead = EVP_aead_aes_256_gcm_tls13(); 471| 166| } 472| 20.0k| *out_fixed_iv_len = 4; 473| 20.0k| } else if (cipher->algorithm_enc == SSL_CHACHA20POLY1305) { ------------------ | | 281| 28|#define SSL_CHACHA20POLY1305 0x00000020u ------------------ | Branch (473:16): [True: 28, False: 0] ------------------ 474| 28| *out_aead = EVP_aead_chacha20_poly1305(); 475| 28| *out_fixed_iv_len = 12; 476| 28| } else { 477| 0| return false; 478| 0| } 479| | 480| | // In TLS 1.3, the iv_len is equal to the AEAD nonce length whereas the code 481| | // above computes the TLS 1.2 construction. 482| 80.6k| if (version >= TLS1_3_VERSION) { ------------------ | | 545| 80.6k|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (482:9): [True: 1.40k, False: 79.2k] ------------------ 483| 1.40k| *out_fixed_iv_len = EVP_AEAD_nonce_length(*out_aead); 484| 1.40k| } 485| 128k| } else if (cipher->algorithm_mac == SSL_SHA1) { ------------------ | | 286| 128k|#define SSL_SHA1 0x00000001u ------------------ | Branch (485:14): [True: 128k, False: 0] ------------------ 486| 128k| if (cipher->algorithm_enc == SSL_3DES) { ------------------ | | 276| 128k|#define SSL_3DES 0x00000001u ------------------ | Branch (486:9): [True: 6.02k, False: 122k] ------------------ 487| 6.02k| if (version == TLS1_VERSION) { ------------------ | | 542| 6.02k|#define TLS1_VERSION 0x0301 ------------------ | Branch (487:11): [True: 34, False: 5.98k] ------------------ 488| 34| *out_aead = EVP_aead_des_ede3_cbc_sha1_tls_implicit_iv(); 489| 34| *out_fixed_iv_len = 8; 490| 5.98k| } else { 491| 5.98k| *out_aead = EVP_aead_des_ede3_cbc_sha1_tls(); 492| 5.98k| } 493| 122k| } else if (cipher->algorithm_enc == SSL_AES128) { ------------------ | | 277| 122k|#define SSL_AES128 0x00000002u ------------------ | Branch (493:16): [True: 6.75k, False: 115k] ------------------ 494| 6.75k| if (version == TLS1_VERSION) { ------------------ | | 542| 6.75k|#define TLS1_VERSION 0x0301 ------------------ | Branch (494:11): [True: 202, False: 6.55k] ------------------ 495| 202| *out_aead = EVP_aead_aes_128_cbc_sha1_tls_implicit_iv(); 496| 202| *out_fixed_iv_len = 16; 497| 6.55k| } else { 498| 6.55k| *out_aead = EVP_aead_aes_128_cbc_sha1_tls(); 499| 6.55k| } 500| 115k| } else if (cipher->algorithm_enc == SSL_AES256) { ------------------ | | 278| 115k|#define SSL_AES256 0x00000004u ------------------ | Branch (500:16): [True: 115k, False: 0] ------------------ 501| 115k| if (version == TLS1_VERSION) { ------------------ | | 542| 115k|#define TLS1_VERSION 0x0301 ------------------ | Branch (501:11): [True: 3.49k, False: 111k] ------------------ 502| 3.49k| *out_aead = EVP_aead_aes_256_cbc_sha1_tls_implicit_iv(); 503| 3.49k| *out_fixed_iv_len = 16; 504| 111k| } else { 505| 111k| *out_aead = EVP_aead_aes_256_cbc_sha1_tls(); 506| 111k| } 507| 115k| } else { 508| 0| return false; 509| 0| } 510| | 511| 128k| *out_mac_secret_len = SHA_DIGEST_LENGTH; ------------------ | | 35| 128k|#define SHA_DIGEST_LENGTH 20 ------------------ 512| 128k| } else if (cipher->algorithm_mac == SSL_SHA256) { ------------------ | | 287| 0|#define SSL_SHA256 0x00000002u ------------------ | Branch (512:14): [True: 0, False: 0] ------------------ 513| 0| if (cipher->algorithm_enc == SSL_AES128) { ------------------ | | 277| 0|#define SSL_AES128 0x00000002u ------------------ | Branch (513:9): [True: 0, False: 0] ------------------ 514| 0| *out_aead = EVP_aead_aes_128_cbc_sha256_tls(); 515| 0| } else { 516| 0| return false; 517| 0| } 518| | 519| 0| *out_mac_secret_len = SHA256_DIGEST_LENGTH; ------------------ | | 110| 0|#define SHA256_DIGEST_LENGTH 32 ------------------ 520| 0| } else { 521| 0| return false; 522| 0| } 523| | 524| 208k| return true; 525| 208k|} _ZN4bssl24ssl_get_handshake_digestEtPK13ssl_cipher_st: 528| 110k| const SSL_CIPHER *cipher) { 529| 110k| switch (cipher->algorithm_prf) { 530| 65.5k| case SSL_HANDSHAKE_MAC_DEFAULT: ------------------ | | 292| 65.5k|#define SSL_HANDSHAKE_MAC_DEFAULT 0x1 ------------------ | Branch (530:5): [True: 65.5k, False: 45.0k] ------------------ 531| 65.5k| return version >= TLS1_2_VERSION ? EVP_sha256() : EVP_md5_sha1(); ------------------ | | 544| 65.5k|#define TLS1_2_VERSION 0x0303 ------------------ | Branch (531:14): [True: 63.4k, False: 2.12k] ------------------ 532| 33.9k| case SSL_HANDSHAKE_MAC_SHA256: ------------------ | | 293| 33.9k|#define SSL_HANDSHAKE_MAC_SHA256 0x2 ------------------ | Branch (532:5): [True: 33.9k, False: 76.6k] ------------------ 533| 33.9k| return EVP_sha256(); 534| 11.0k| case SSL_HANDSHAKE_MAC_SHA384: ------------------ | | 294| 11.0k|#define SSL_HANDSHAKE_MAC_SHA384 0x4 ------------------ | Branch (534:5): [True: 11.0k, False: 99.4k] ------------------ 535| 11.0k| return EVP_sha384(); 536| 0| default: ------------------ | Branch (536:5): [True: 0, False: 110k] ------------------ 537| 0| assert(0); 538| 0| return NULL; 539| 110k| } 540| 110k|} _ZN4bssl23SSLCipherPreferenceListD2Ev: 596| 2|SSLCipherPreferenceList::~SSLCipherPreferenceList() { 597| 2| OPENSSL_free(in_group_flags); 598| 2|} _ZN4bssl23SSLCipherPreferenceList4InitENSt3__110unique_ptrI19stack_st_SSL_CIPHERNS_8internal7DeleterEEENS_4SpanIKbEE: 601| 4| Span in_group_flags_arg) { 602| 4| if (sk_SSL_CIPHER_num(ciphers_arg.get()) != in_group_flags_arg.size()) { ------------------ | Branch (602:7): [True: 0, False: 4] ------------------ 603| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 604| 0| return false; 605| 0| } 606| | 607| 4| Array copy; 608| 4| if (!copy.CopyFrom(in_group_flags_arg)) { ------------------ | Branch (608:7): [True: 0, False: 4] ------------------ 609| 0| return false; 610| 0| } 611| 4| ciphers = std::move(ciphers_arg); 612| 4| size_t unused_len; 613| 4| copy.Release(&in_group_flags, &unused_len); 614| 4| return true; 615| 4|} _ZN4bssl24ssl_cipher_is_deprecatedEPK13ssl_cipher_st: 642| 84|bool ssl_cipher_is_deprecated(const SSL_CIPHER *cipher) { 643| 84| return cipher->id == TLS1_CK_ECDHE_RSA_WITH_AES_128_CBC_SHA256 || ------------------ | | 291| 168|#define TLS1_CK_ECDHE_RSA_WITH_AES_128_CBC_SHA256 0x0300C027 ------------------ | Branch (643:10): [True: 4, False: 80] ------------------ 644| 84| cipher->algorithm_enc == SSL_3DES; ------------------ | | 276| 80|#define SSL_3DES 0x00000001u ------------------ | Branch (644:10): [True: 4, False: 76] ------------------ 645| 84|} _ZN4bssl22ssl_create_cipher_listEPNSt3__110unique_ptrINS_23SSLCipherPreferenceListENS_8internal7DeleterEEEbPKcb: 1002| 4| bool strict) { 1003| | // Return with error if nothing to do. 1004| 4| if (rule_str == NULL || out_cipher_list == NULL) { ------------------ | Branch (1004:7): [True: 0, False: 4] | Branch (1004:27): [True: 0, False: 4] ------------------ 1005| 0| return false; 1006| 0| } 1007| | 1008| | // We prefer ECDHE ciphers over non-PFS ciphers. Then we prefer AEAD over 1009| | // non-AEAD. The constants are masked by 0xffff to remove the vestigial 0x03 1010| | // byte from SSL 2.0. 1011| 4| static const uint16_t kAESCiphers[] = { 1012| 4| TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 & 0xffff, ------------------ | | 322| 4|#define TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 0x0300C02B ------------------ 1013| 4| TLS1_CK_ECDHE_RSA_WITH_AES_128_GCM_SHA256 & 0xffff, ------------------ | | 326| 4|#define TLS1_CK_ECDHE_RSA_WITH_AES_128_GCM_SHA256 0x0300C02F ------------------ 1014| 4| TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 & 0xffff, ------------------ | | 323| 4|#define TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 0x0300C02C ------------------ 1015| 4| TLS1_CK_ECDHE_RSA_WITH_AES_256_GCM_SHA384 & 0xffff, ------------------ | | 327| 4|#define TLS1_CK_ECDHE_RSA_WITH_AES_256_GCM_SHA384 0x0300C030 ------------------ 1016| 4| }; 1017| 4| static const uint16_t kChaChaCiphers[] = { 1018| 4| TLS1_CK_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 & 0xffff, ------------------ | | 333| 4|#define TLS1_CK_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 0x0300CCA9 ------------------ 1019| 4| TLS1_CK_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 & 0xffff, ------------------ | | 332| 4|#define TLS1_CK_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 0x0300CCA8 ------------------ 1020| 4| TLS1_CK_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256 & 0xffff, ------------------ | | 334| 4|#define TLS1_CK_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256 0x0300CCAC ------------------ 1021| 4| }; 1022| 4| static const uint16_t kLegacyCiphers[] = { 1023| 4| TLS1_CK_ECDHE_ECDSA_WITH_AES_128_CBC_SHA & 0xffff, ------------------ | | 276| 4|#define TLS1_CK_ECDHE_ECDSA_WITH_AES_128_CBC_SHA 0x0300C009 ------------------ 1024| 4| TLS1_CK_ECDHE_RSA_WITH_AES_128_CBC_SHA & 0xffff, ------------------ | | 288| 4|#define TLS1_CK_ECDHE_RSA_WITH_AES_128_CBC_SHA 0x0300C013 ------------------ 1025| 4| TLS1_CK_ECDHE_PSK_WITH_AES_128_CBC_SHA & 0xffff, ------------------ | | 179| 4|#define TLS1_CK_ECDHE_PSK_WITH_AES_128_CBC_SHA 0x0300C035 ------------------ 1026| 4| TLS1_CK_ECDHE_ECDSA_WITH_AES_256_CBC_SHA & 0xffff, ------------------ | | 277| 4|#define TLS1_CK_ECDHE_ECDSA_WITH_AES_256_CBC_SHA 0x0300C00A ------------------ 1027| 4| TLS1_CK_ECDHE_RSA_WITH_AES_256_CBC_SHA & 0xffff, ------------------ | | 289| 4|#define TLS1_CK_ECDHE_RSA_WITH_AES_256_CBC_SHA 0x0300C014 ------------------ 1028| 4| TLS1_CK_ECDHE_PSK_WITH_AES_256_CBC_SHA & 0xffff, ------------------ | | 180| 4|#define TLS1_CK_ECDHE_PSK_WITH_AES_256_CBC_SHA 0x0300C036 ------------------ 1029| 4| TLS1_CK_ECDHE_RSA_WITH_AES_128_CBC_SHA256 & 0xffff, ------------------ | | 291| 4|#define TLS1_CK_ECDHE_RSA_WITH_AES_128_CBC_SHA256 0x0300C027 ------------------ 1030| 4| TLS1_CK_RSA_WITH_AES_128_GCM_SHA256 & 0xffff, ------------------ | | 253| 4|#define TLS1_CK_RSA_WITH_AES_128_GCM_SHA256 0x0300009C ------------------ 1031| 4| TLS1_CK_RSA_WITH_AES_256_GCM_SHA384 & 0xffff, ------------------ | | 254| 4|#define TLS1_CK_RSA_WITH_AES_256_GCM_SHA384 0x0300009D ------------------ 1032| 4| TLS1_CK_RSA_WITH_AES_128_SHA & 0xffff, ------------------ | | 197| 4|#define TLS1_CK_RSA_WITH_AES_128_SHA 0x0300002F ------------------ 1033| 4| TLS1_CK_PSK_WITH_AES_128_CBC_SHA & 0xffff, ------------------ | | 175| 4|#define TLS1_CK_PSK_WITH_AES_128_CBC_SHA 0x0300008C ------------------ 1034| 4| TLS1_CK_RSA_WITH_AES_256_SHA & 0xffff, ------------------ | | 204| 4|#define TLS1_CK_RSA_WITH_AES_256_SHA 0x03000035 ------------------ 1035| 4| TLS1_CK_PSK_WITH_AES_256_CBC_SHA & 0xffff, ------------------ | | 176| 4|#define TLS1_CK_PSK_WITH_AES_256_CBC_SHA 0x0300008D ------------------ 1036| 4| SSL3_CK_RSA_DES_192_CBC3_SHA & 0xffff, ------------------ | | 45| 4|#define SSL3_CK_RSA_DES_192_CBC3_SHA 0x0300000A ------------------ 1037| 4| }; 1038| | 1039| | // Set up a linked list of ciphers. 1040| 4| CIPHER_ORDER co_list[OPENSSL_ARRAY_SIZE(kAESCiphers) + 1041| 4| OPENSSL_ARRAY_SIZE(kChaChaCiphers) + 1042| 4| OPENSSL_ARRAY_SIZE(kLegacyCiphers)]; 1043| 88| for (size_t i = 0; i < OPENSSL_ARRAY_SIZE(co_list); i++) { ------------------ | | 103| 88|#define OPENSSL_ARRAY_SIZE(array) (sizeof(array) / sizeof((array)[0])) ------------------ | Branch (1043:22): [True: 84, False: 4] ------------------ 1044| 84| co_list[i].next = 1045| 84| i + 1 < OPENSSL_ARRAY_SIZE(co_list) ? &co_list[i + 1] : nullptr; ------------------ | | 103| 84|#define OPENSSL_ARRAY_SIZE(array) (sizeof(array) / sizeof((array)[0])) ------------------ | Branch (1045:9): [True: 80, False: 4] ------------------ 1046| 84| co_list[i].prev = i == 0 ? nullptr : &co_list[i - 1]; ------------------ | Branch (1046:23): [True: 4, False: 80] ------------------ 1047| 84| co_list[i].active = false; 1048| 84| co_list[i].in_group = false; 1049| 84| } 1050| 4| CIPHER_ORDER *head = &co_list[0]; 1051| 4| CIPHER_ORDER *tail = &co_list[OPENSSL_ARRAY_SIZE(co_list) - 1]; ------------------ | | 103| 4|#define OPENSSL_ARRAY_SIZE(array) (sizeof(array) / sizeof((array)[0])) ------------------ 1052| | 1053| | // Order AES ciphers vs ChaCha ciphers based on whether we have AES hardware. 1054| | // 1055| | // TODO(crbug.com/boringssl/29): We should also set up equipreference groups 1056| | // as a server. 1057| 4| size_t num = 0; 1058| 4| if (has_aes_hw) { ------------------ | Branch (1058:7): [True: 4, False: 0] ------------------ 1059| 16| for (uint16_t id : kAESCiphers) { ------------------ | Branch (1059:22): [True: 16, False: 4] ------------------ 1060| 16| co_list[num++].cipher = SSL_get_cipher_by_value(id); 1061| 16| assert(co_list[num - 1].cipher != nullptr); 1062| 16| } 1063| 4| } 1064| 12| for (uint16_t id : kChaChaCiphers) { ------------------ | Branch (1064:20): [True: 12, False: 4] ------------------ 1065| 12| co_list[num++].cipher = SSL_get_cipher_by_value(id); 1066| 12| assert(co_list[num - 1].cipher != nullptr); 1067| 12| } 1068| 4| if (!has_aes_hw) { ------------------ | Branch (1068:7): [True: 0, False: 4] ------------------ 1069| 0| for (uint16_t id : kAESCiphers) { ------------------ | Branch (1069:22): [True: 0, False: 0] ------------------ 1070| 0| co_list[num++].cipher = SSL_get_cipher_by_value(id); 1071| 0| assert(co_list[num - 1].cipher != nullptr); 1072| 0| } 1073| 0| } 1074| 56| for (uint16_t id : kLegacyCiphers) { ------------------ | Branch (1074:20): [True: 56, False: 4] ------------------ 1075| 56| co_list[num++].cipher = SSL_get_cipher_by_value(id); 1076| 56| assert(co_list[num - 1].cipher != nullptr); 1077| 56| } 1078| 4| assert(num == OPENSSL_ARRAY_SIZE(co_list)); 1079| 4| static_assert(OPENSSL_ARRAY_SIZE(co_list) + NumTLS13Ciphers() == 1080| 4| OPENSSL_ARRAY_SIZE(kCiphers), 1081| 4| "Not all ciphers are included in the cipher order"); 1082| | 1083| | // If the rule_string begins with DEFAULT, apply the default rule before 1084| | // using the (possibly available) additional rules. 1085| 4| const char *rule_p = rule_str; 1086| 4| if (strncmp(rule_str, "DEFAULT", 7) == 0) { ------------------ | Branch (1086:7): [True: 0, False: 4] ------------------ 1087| 0| if (!ssl_cipher_process_rulestr(SSL_DEFAULT_CIPHER_LIST, &head, &tail, ------------------ | | 1669| 0|#define SSL_DEFAULT_CIPHER_LIST "ALL" ------------------ | Branch (1087:9): [True: 0, False: 0] ------------------ 1088| 0| strict)) { 1089| 0| return false; 1090| 0| } 1091| 0| rule_p += 7; 1092| 0| if (*rule_p == ':') { ------------------ | Branch (1092:9): [True: 0, False: 0] ------------------ 1093| 0| rule_p++; 1094| 0| } 1095| 0| } 1096| | 1097| 4| if (*rule_p != '\0' && ------------------ | Branch (1097:7): [True: 4, False: 0] ------------------ 1098| 4| !ssl_cipher_process_rulestr(rule_p, &head, &tail, strict)) { ------------------ | Branch (1098:7): [True: 0, False: 4] ------------------ 1099| 0| return false; 1100| 0| } 1101| | 1102| | // Allocate new "cipherstack" for the result, return with error 1103| | // if we cannot get one. 1104| 4| UniquePtr cipherstack(sk_SSL_CIPHER_new_null()); 1105| 4| Array in_group_flags; 1106| 4| if (cipherstack == nullptr || ------------------ | Branch (1106:7): [True: 0, False: 4] ------------------ 1107| 4| !in_group_flags.InitForOverwrite(OPENSSL_ARRAY_SIZE(kCiphers))) { ------------------ | | 103| 4|#define OPENSSL_ARRAY_SIZE(array) (sizeof(array) / sizeof((array)[0])) ------------------ | Branch (1107:7): [True: 0, False: 4] ------------------ 1108| 0| return false; 1109| 0| } 1110| | 1111| | // The cipher selection for the list is done. The ciphers are added 1112| | // to the resulting precedence to the STACK_OF(SSL_CIPHER). 1113| 4| size_t num_in_group_flags = 0; 1114| 88| for (CIPHER_ORDER *curr = head; curr != NULL; curr = curr->next) { ------------------ | Branch (1114:35): [True: 84, False: 4] ------------------ 1115| 84| if (curr->active) { ------------------ | Branch (1115:9): [True: 78, False: 6] ------------------ 1116| 78| if (!sk_SSL_CIPHER_push(cipherstack.get(), curr->cipher)) { ------------------ | Branch (1116:11): [True: 0, False: 78] ------------------ 1117| 0| return false; 1118| 0| } 1119| 78| in_group_flags[num_in_group_flags++] = curr->in_group; 1120| 78| } 1121| 84| } 1122| 4| in_group_flags.Shrink(num_in_group_flags); 1123| | 1124| 4| UniquePtr pref_list = 1125| 4| MakeUnique(); 1126| 4| if (!pref_list || !pref_list->Init(std::move(cipherstack), in_group_flags)) { ------------------ | Branch (1126:7): [True: 0, False: 4] | Branch (1126:7): [True: 0, False: 4] | Branch (1126:21): [True: 0, False: 4] ------------------ 1127| 0| return false; 1128| 0| } 1129| | 1130| 4| *out_cipher_list = std::move(pref_list); 1131| | 1132| | // Configuring an empty cipher list is an error but still updates the 1133| | // output. 1134| 4| if (sk_SSL_CIPHER_num((*out_cipher_list)->ciphers.get()) == 0) { ------------------ | Branch (1134:7): [True: 0, False: 4] ------------------ 1135| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_NO_CIPHER_MATCH); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1136| 0| return false; 1137| 0| } 1138| | 1139| 4| return true; 1140| 4|} _ZN4bssl28ssl_cipher_auth_mask_for_keyEPK11evp_pkey_stb: 1142| 53.5k|uint32_t ssl_cipher_auth_mask_for_key(const EVP_PKEY *key, bool sign_ok) { 1143| 53.5k| switch (EVP_PKEY_id(key)) { 1144| 39.0k| case EVP_PKEY_RSA: ------------------ | | 133| 39.0k|#define EVP_PKEY_RSA NID_rsaEncryption | | ------------------ | | | | 72| 39.0k|#define NID_rsaEncryption 6 | | ------------------ ------------------ | Branch (1144:5): [True: 39.0k, False: 14.4k] ------------------ 1145| 39.0k| return sign_ok ? (SSL_aRSA_SIGN | SSL_aRSA_DECRYPT) : SSL_aRSA_DECRYPT; ------------------ | | 266| 39.0k|#define SSL_aRSA_SIGN 0x00000001u ------------------ return sign_ok ? (SSL_aRSA_SIGN | SSL_aRSA_DECRYPT) : SSL_aRSA_DECRYPT; ------------------ | | 267| 39.0k|#define SSL_aRSA_DECRYPT 0x00000002u ------------------ return sign_ok ? (SSL_aRSA_SIGN | SSL_aRSA_DECRYPT) : SSL_aRSA_DECRYPT; ------------------ | | 267| 0|#define SSL_aRSA_DECRYPT 0x00000002u ------------------ | Branch (1145:14): [True: 39.0k, False: 0] ------------------ 1146| 14.4k| case EVP_PKEY_EC: ------------------ | | 136| 14.4k|#define EVP_PKEY_EC NID_X9_62_id_ecPublicKey | | ------------------ | | | | 1844| 14.4k|#define NID_X9_62_id_ecPublicKey 408 | | ------------------ ------------------ | Branch (1146:5): [True: 14.4k, False: 39.0k] ------------------ 1147| 14.4k| case EVP_PKEY_ED25519: ------------------ | | 137| 14.4k|#define EVP_PKEY_ED25519 NID_ED25519 | | ------------------ | | | | 4157| 14.4k|#define NID_ED25519 949 | | ------------------ ------------------ | Branch (1147:5): [True: 6, False: 53.4k] ------------------ 1148| | // Ed25519 keys in TLS 1.2 repurpose the ECDSA ciphers. 1149| 14.4k| return sign_ok ? SSL_aECDSA : 0; ------------------ | | 268| 14.4k|#define SSL_aECDSA 0x00000004u ------------------ | Branch (1149:14): [True: 14.4k, False: 0] ------------------ 1150| 1| default: ------------------ | Branch (1150:5): [True: 1, False: 53.5k] ------------------ 1151| 1| return 0; 1152| 53.5k| } 1153| 53.5k|} _ZN4bssl32ssl_cipher_uses_certificate_authEPK13ssl_cipher_st: 1155| 452k|bool ssl_cipher_uses_certificate_auth(const SSL_CIPHER *cipher) { 1156| 452k| return (cipher->algorithm_auth & SSL_aCERT) != 0; ------------------ | | 273| 452k|#define SSL_aCERT (SSL_aRSA_SIGN | SSL_aRSA_DECRYPT | SSL_aECDSA) | | ------------------ | | | | 266| 452k|#define SSL_aRSA_SIGN 0x00000001u | | ------------------ | | #define SSL_aCERT (SSL_aRSA_SIGN | SSL_aRSA_DECRYPT | SSL_aECDSA) | | ------------------ | | | | 267| 452k|#define SSL_aRSA_DECRYPT 0x00000002u | | ------------------ | | #define SSL_aCERT (SSL_aRSA_SIGN | SSL_aRSA_DECRYPT | SSL_aECDSA) | | ------------------ | | | | 268| 452k|#define SSL_aECDSA 0x00000004u | | ------------------ ------------------ 1157| 452k|} _ZN4bssl39ssl_cipher_requires_server_key_exchangeEPK13ssl_cipher_st: 1159| 1.75k|bool ssl_cipher_requires_server_key_exchange(const SSL_CIPHER *cipher) { 1160| | // Ephemeral Diffie-Hellman key exchanges require a ServerKeyExchange. It is 1161| | // optional or omitted in all others. 1162| 1.75k| return (cipher->algorithm_mkey & SSL_kECDHE) != 0; ------------------ | | 260| 1.75k|#define SSL_kECDHE 0x00000002u ------------------ 1163| 1.75k|} SSL_get_cipher_by_value: 1219| 75.7k|const SSL_CIPHER *SSL_get_cipher_by_value(uint16_t value) { 1220| 75.7k| SSL_CIPHER c; 1221| | 1222| 75.7k| c.id = 0x03000000L | value; 1223| 75.7k| return reinterpret_cast( 1224| 75.7k| bsearch(&c, kCiphers, OPENSSL_ARRAY_SIZE(kCiphers), sizeof(SSL_CIPHER), ------------------ | | 103| 75.7k|#define OPENSSL_ARRAY_SIZE(array) (sizeof(array) / sizeof((array)[0])) ------------------ 1225| 75.7k| ssl_cipher_id_cmp_void)); 1226| 75.7k|} SSL_CIPHER_get_protocol_id: 1230| 847k|uint16_t SSL_CIPHER_get_protocol_id(const SSL_CIPHER *cipher) { 1231| | // All OpenSSL cipher IDs are prefaced with 0x03. Historically this referred 1232| | // to SSLv2 vs SSLv3. 1233| 847k| assert((cipher->id & 0xff000000) == 0x03000000); 1234| 847k| return static_cast(cipher->id); 1235| 847k|} SSL_CIPHER_get_min_version: 1329| 901k|uint16_t SSL_CIPHER_get_min_version(const SSL_CIPHER *cipher) { 1330| 901k| if (cipher->algorithm_mkey == SSL_kGENERIC || ------------------ | | 263| 1.80M|#define SSL_kGENERIC 0x00000008u ------------------ | Branch (1330:7): [True: 390, False: 901k] ------------------ 1331| 901k| cipher->algorithm_auth == SSL_aGENERIC) { ------------------ | | 271| 901k|#define SSL_aGENERIC 0x00000010u ------------------ | Branch (1331:7): [True: 0, False: 901k] ------------------ 1332| 390| return TLS1_3_VERSION; ------------------ | | 545| 390|#define TLS1_3_VERSION 0x0304 ------------------ 1333| 390| } 1334| | 1335| 901k| if (cipher->algorithm_prf != SSL_HANDSHAKE_MAC_DEFAULT) { ------------------ | | 292| 901k|#define SSL_HANDSHAKE_MAC_DEFAULT 0x1 ------------------ | Branch (1335:7): [True: 473k, False: 428k] ------------------ 1336| | // Cipher suites before TLS 1.2 use the default PRF, while all those added 1337| | // afterwards specify a particular hash. 1338| 473k| return TLS1_2_VERSION; ------------------ | | 544| 473k|#define TLS1_2_VERSION 0x0303 ------------------ 1339| 473k| } 1340| 428k| return SSL3_VERSION; ------------------ | | 541| 428k|#define SSL3_VERSION 0x0300 ------------------ 1341| 901k|} SSL_CIPHER_get_max_version: 1343| 901k|uint16_t SSL_CIPHER_get_max_version(const SSL_CIPHER *cipher) { 1344| 901k| if (cipher->algorithm_mkey == SSL_kGENERIC || ------------------ | | 263| 1.80M|#define SSL_kGENERIC 0x00000008u ------------------ | Branch (1344:7): [True: 389, False: 901k] ------------------ 1345| 901k| cipher->algorithm_auth == SSL_aGENERIC) { ------------------ | | 271| 901k|#define SSL_aGENERIC 0x00000010u ------------------ | Branch (1345:7): [True: 0, False: 901k] ------------------ 1346| 389| return TLS1_3_VERSION; ------------------ | | 545| 389|#define TLS1_3_VERSION 0x0304 ------------------ 1347| 389| } 1348| 901k| return TLS1_2_VERSION; ------------------ | | 544| 901k|#define TLS1_2_VERSION 0x0303 ------------------ 1349| 901k|} ssl_cipher.cc:_ZN4bsslL26ssl_cipher_process_rulestrEPKcPPNS_15cipher_order_stES4_b: 819| 4| CIPHER_ORDER **tail_p, bool strict) { 820| 4| const char *l, *buf; 821| 4| bool in_group = false, has_group = false; 822| 4| size_t j, buf_len; 823| 4| char ch; 824| | 825| 4| l = rule_str; 826| 12| for (;;) { 827| 12| ch = *l; 828| | 829| 12| if (ch == '\0') { ------------------ | Branch (829:9): [True: 4, False: 8] ------------------ 830| 4| break; // done 831| 4| } 832| | 833| 8| int rule; 834| 8| if (in_group) { ------------------ | Branch (834:9): [True: 0, False: 8] ------------------ 835| 0| if (ch == ']') { ------------------ | Branch (835:11): [True: 0, False: 0] ------------------ 836| 0| if (*tail_p) { ------------------ | Branch (836:13): [True: 0, False: 0] ------------------ 837| 0| (*tail_p)->in_group = false; 838| 0| } 839| 0| in_group = false; 840| 0| l++; 841| 0| continue; 842| 0| } 843| | 844| 0| if (ch == '|') { ------------------ | Branch (844:11): [True: 0, False: 0] ------------------ 845| 0| rule = CIPHER_ADD; ------------------ | | 354| 0|#define CIPHER_ADD 1 ------------------ 846| 0| l++; 847| 0| continue; 848| 0| } else if (!OPENSSL_isalnum(ch)) { ------------------ | Branch (848:18): [True: 0, False: 0] ------------------ 849| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_OPERATOR_IN_GROUP); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 850| 0| return false; 851| 0| } else { 852| 0| rule = CIPHER_ADD; ------------------ | | 354| 0|#define CIPHER_ADD 1 ------------------ 853| 0| } 854| 8| } else if (ch == '-') { ------------------ | Branch (854:16): [True: 0, False: 8] ------------------ 855| 0| rule = CIPHER_DEL; ------------------ | | 356| 0|#define CIPHER_DEL 3 ------------------ 856| 0| l++; 857| 8| } else if (ch == '+') { ------------------ | Branch (857:16): [True: 0, False: 8] ------------------ 858| 0| rule = CIPHER_ORD; ------------------ | | 357| 0|#define CIPHER_ORD 4 ------------------ 859| 0| l++; 860| 8| } else if (ch == '!') { ------------------ | Branch (860:16): [True: 0, False: 8] ------------------ 861| 0| rule = CIPHER_KILL; ------------------ | | 355| 0|#define CIPHER_KILL 2 ------------------ 862| 0| l++; 863| 8| } else if (ch == '@') { ------------------ | Branch (863:16): [True: 0, False: 8] ------------------ 864| 0| rule = CIPHER_SPECIAL; ------------------ | | 358| 0|#define CIPHER_SPECIAL 5 ------------------ 865| 0| l++; 866| 8| } else if (ch == '[') { ------------------ | Branch (866:16): [True: 0, False: 8] ------------------ 867| 0| assert(!in_group); 868| 0| in_group = true; 869| 0| has_group = true; 870| 0| l++; 871| 0| continue; 872| 8| } else { 873| 8| rule = CIPHER_ADD; ------------------ | | 354| 8|#define CIPHER_ADD 1 ------------------ 874| 8| } 875| | 876| | // If preference groups are enabled, the only legal operator is +. 877| | // Otherwise the in_group bits will get mixed up. 878| 8| if (has_group && rule != CIPHER_ADD) { ------------------ | | 354| 0|#define CIPHER_ADD 1 ------------------ | Branch (878:9): [True: 0, False: 8] | Branch (878:22): [True: 0, False: 0] ------------------ 879| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_MIXED_SPECIAL_OPERATOR_WITH_GROUPS); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 880| 0| return false; 881| 0| } 882| | 883| 8| if (is_cipher_list_separator(ch, strict)) { ------------------ | Branch (883:9): [True: 2, False: 6] ------------------ 884| 2| l++; 885| 2| continue; 886| 2| } 887| | 888| 6| bool multi = false; 889| 6| uint32_t cipher_id = 0; 890| 6| CIPHER_ALIAS alias; 891| 6| bool skip_rule = false; 892| | 893| | // When adding, exclude deprecated ciphers by default. 894| 6| alias.include_deprecated = rule != CIPHER_ADD; ------------------ | | 354| 6|#define CIPHER_ADD 1 ------------------ 895| | 896| 6| for (;;) { 897| 6| ch = *l; 898| 6| buf = l; 899| 6| buf_len = 0; 900| 26| while (OPENSSL_isalnum(ch) || ch == '-' || ch == '.' || ch == '_') { ------------------ | Branch (900:14): [True: 20, False: 6] | Branch (900:37): [True: 0, False: 6] | Branch (900:50): [True: 0, False: 6] | Branch (900:63): [True: 0, False: 6] ------------------ 901| 20| ch = *(++l); 902| 20| buf_len++; 903| 20| } 904| | 905| 6| if (buf_len == 0) { ------------------ | Branch (905:11): [True: 0, False: 6] ------------------ 906| | // We hit something we cannot deal with, it is no command or separator 907| | // nor alphanumeric, so we call this an error. 908| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_COMMAND); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 909| 0| return false; 910| 0| } 911| | 912| 6| if (rule == CIPHER_SPECIAL) { ------------------ | | 358| 6|#define CIPHER_SPECIAL 5 ------------------ | Branch (912:11): [True: 0, False: 6] ------------------ 913| 0| break; 914| 0| } 915| | 916| | // Look for a matching exact cipher. These aren't allowed in multipart 917| | // rules. 918| 6| if (!multi && ch != '+') { ------------------ | Branch (918:11): [True: 6, False: 0] | Branch (918:21): [True: 6, False: 0] ------------------ 919| 150| for (j = 0; j < OPENSSL_ARRAY_SIZE(kCiphers); j++) { ------------------ | | 103| 150|#define OPENSSL_ARRAY_SIZE(array) (sizeof(array) / sizeof((array)[0])) ------------------ | Branch (919:21): [True: 144, False: 6] ------------------ 920| 144| const SSL_CIPHER *cipher = &kCiphers[j]; 921| 144| if (rule_equals(cipher->name, buf, buf_len) || ------------------ | Branch (921:15): [True: 0, False: 144] ------------------ 922| 144| rule_equals(cipher->standard_name, buf, buf_len)) { ------------------ | Branch (922:15): [True: 0, False: 144] ------------------ 923| 0| cipher_id = cipher->id; 924| 0| break; 925| 0| } 926| 144| } 927| 6| } 928| 6| if (cipher_id == 0) { ------------------ | Branch (928:11): [True: 6, False: 0] ------------------ 929| | // If not an exact cipher, look for a matching cipher alias. 930| 34| for (j = 0; j < kCipherAliasesLen; j++) { ------------------ | Branch (930:21): [True: 34, False: 0] ------------------ 931| 34| if (rule_equals(kCipherAliases[j].name, buf, buf_len)) { ------------------ | Branch (931:15): [True: 6, False: 28] ------------------ 932| 6| alias.algorithm_mkey &= kCipherAliases[j].algorithm_mkey; 933| 6| alias.algorithm_auth &= kCipherAliases[j].algorithm_auth; 934| 6| alias.algorithm_enc &= kCipherAliases[j].algorithm_enc; 935| 6| alias.algorithm_mac &= kCipherAliases[j].algorithm_mac; 936| | 937| | // When specifying a combination of aliases, if any aliases 938| | // enables deprecated ciphers, deprecated ciphers are included. This 939| | // is slightly different from the bitmasks in that adding aliases 940| | // can increase the set of matched ciphers. This is so that an alias 941| | // like "RSA" will only specifiy AES-based RSA ciphers, but 942| | // "RSA+3DES" will still specify 3DES. 943| 6| alias.include_deprecated |= kCipherAliases[j].include_deprecated; 944| | 945| 6| if (alias.min_version != 0 && ------------------ | Branch (945:17): [True: 0, False: 6] ------------------ 946| 6| alias.min_version != kCipherAliases[j].min_version) { ------------------ | Branch (946:17): [True: 0, False: 0] ------------------ 947| 0| skip_rule = true; 948| 6| } else { 949| 6| alias.min_version = kCipherAliases[j].min_version; 950| 6| } 951| 6| break; 952| 6| } 953| 34| } 954| 6| if (j == kCipherAliasesLen) { ------------------ | Branch (954:13): [True: 0, False: 6] ------------------ 955| 0| skip_rule = true; 956| 0| if (strict) { ------------------ | Branch (956:15): [True: 0, False: 0] ------------------ 957| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_COMMAND); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 958| 0| return false; 959| 0| } 960| 0| } 961| 6| } 962| | 963| | // Check for a multipart rule. 964| 6| if (ch != '+') { ------------------ | Branch (964:11): [True: 6, False: 0] ------------------ 965| 6| break; 966| 6| } 967| 0| l++; 968| 0| multi = true; 969| 0| } 970| | 971| | // Ok, we have the rule, now apply it. 972| 6| if (rule == CIPHER_SPECIAL) { ------------------ | | 358| 6|#define CIPHER_SPECIAL 5 ------------------ | Branch (972:9): [True: 0, False: 6] ------------------ 973| 0| if (buf_len != 8 || strncmp(buf, "STRENGTH", 8) != 0) { ------------------ | Branch (973:11): [True: 0, False: 0] | Branch (973:27): [True: 0, False: 0] ------------------ 974| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_COMMAND); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 975| 0| return false; 976| 0| } 977| 0| if (!ssl_cipher_strength_sort(head_p, tail_p)) { ------------------ | Branch (977:11): [True: 0, False: 0] ------------------ 978| 0| return false; 979| 0| } 980| | 981| | // We do not support any "multi" options together with "@", so throw away 982| | // the rest of the command, if any left, until end or ':' is found. 983| 0| while (*l != '\0' && !is_cipher_list_separator(*l, strict)) { ------------------ | Branch (983:14): [True: 0, False: 0] | Branch (983:28): [True: 0, False: 0] ------------------ 984| 0| l++; 985| 0| } 986| 6| } else if (!skip_rule) { ------------------ | Branch (986:16): [True: 6, False: 0] ------------------ 987| 6| ssl_cipher_apply_rule(cipher_id, &alias, rule, -1, in_group, head_p, 988| 6| tail_p); 989| 6| } 990| 6| } 991| | 992| 4| if (in_group) { ------------------ | Branch (992:7): [True: 0, False: 4] ------------------ 993| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_COMMAND); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 994| 0| return false; 995| 0| } 996| | 997| 4| return true; 998| 4|} ssl_cipher.cc:_ZN4bsslL24is_cipher_list_separatorEcb: 542| 8|static bool is_cipher_list_separator(char c, bool is_strict) { 543| 8| if (c == ':') { ------------------ | Branch (543:7): [True: 2, False: 6] ------------------ 544| 2| return true; 545| 2| } 546| 6| return !is_strict && (c == ' ' || c == ';' || c == ','); ------------------ | Branch (546:10): [True: 0, False: 6] | Branch (546:25): [True: 0, False: 0] | Branch (546:37): [True: 0, False: 0] | Branch (546:49): [True: 0, False: 0] ------------------ 547| 8|} ssl_cipher.cc:_ZN4bsslL11rule_equalsEPKcS1_m: 551| 322|static bool rule_equals(const char *rule, const char *buf, size_t buf_len) { 552| | // |strncmp| alone only checks that |buf| is a prefix of |rule|. 553| 322| return strncmp(rule, buf, buf_len) == 0 && rule[buf_len] == '\0'; ------------------ | Branch (553:10): [True: 6, False: 316] | Branch (553:46): [True: 6, False: 0] ------------------ 554| 322|} ssl_cipher.cc:_ZN4bsslL21ssl_cipher_apply_ruleEjPKNS_15cipher_alias_stEiibPPNS_15cipher_order_stES5_: 659| 6| CIPHER_ORDER **tail_p) { 660| 6| CIPHER_ORDER *head, *tail, *curr, *next, *last; 661| 6| const SSL_CIPHER *cp; 662| 6| bool reverse = false; 663| | 664| 6| if (cipher_id == 0 && strength_bits == -1 && alias->min_version == 0 && ------------------ | Branch (664:7): [True: 6, False: 0] | Branch (664:25): [True: 6, False: 0] | Branch (664:48): [True: 6, False: 0] ------------------ 665| 6| (alias->algorithm_mkey == 0 || alias->algorithm_auth == 0 || ------------------ | Branch (665:8): [True: 0, False: 6] | Branch (665:38): [True: 0, False: 6] ------------------ 666| 6| alias->algorithm_enc == 0 || alias->algorithm_mac == 0)) { ------------------ | Branch (666:8): [True: 0, False: 6] | Branch (666:37): [True: 0, False: 6] ------------------ 667| | // The rule matches nothing, so bail early. 668| 0| return; 669| 0| } 670| | 671| 6| if (rule == CIPHER_DEL) { ------------------ | | 356| 6|#define CIPHER_DEL 3 ------------------ | Branch (671:7): [True: 0, False: 6] ------------------ 672| | // needed to maintain sorting between currently deleted ciphers 673| 0| reverse = true; 674| 0| } 675| | 676| 6| head = *head_p; 677| 6| tail = *tail_p; 678| | 679| 6| if (reverse) { ------------------ | Branch (679:7): [True: 0, False: 6] ------------------ 680| 0| next = tail; 681| 0| last = head; 682| 6| } else { 683| 6| next = head; 684| 6| last = tail; 685| 6| } 686| | 687| 6| curr = NULL; 688| 132| for (;;) { 689| 132| if (curr == last) { ------------------ | Branch (689:9): [True: 6, False: 126] ------------------ 690| 6| break; 691| 6| } 692| | 693| 126| curr = next; 694| 126| if (curr == NULL) { ------------------ | Branch (694:9): [True: 0, False: 126] ------------------ 695| 0| break; 696| 0| } 697| | 698| 126| next = reverse ? curr->prev : curr->next; ------------------ | Branch (698:12): [True: 0, False: 126] ------------------ 699| 126| cp = curr->cipher; 700| | 701| | // Selection criteria is either a specific cipher, the value of 702| | // |strength_bits|, or the algorithms used. 703| 126| if (cipher_id != 0) { ------------------ | Branch (703:9): [True: 0, False: 126] ------------------ 704| 0| if (cipher_id != cp->id) { ------------------ | Branch (704:11): [True: 0, False: 0] ------------------ 705| 0| continue; 706| 0| } 707| 126| } else if (strength_bits >= 0) { ------------------ | Branch (707:16): [True: 0, False: 126] ------------------ 708| 0| if (strength_bits != SSL_CIPHER_get_bits(cp, NULL)) { ------------------ | Branch (708:11): [True: 0, False: 0] ------------------ 709| 0| continue; 710| 0| } 711| 126| } else { 712| 126| if (!(alias->algorithm_mkey & cp->algorithm_mkey) || ------------------ | Branch (712:11): [True: 0, False: 126] ------------------ 713| 126| !(alias->algorithm_auth & cp->algorithm_auth) || ------------------ | Branch (713:11): [True: 0, False: 126] ------------------ 714| 126| !(alias->algorithm_enc & cp->algorithm_enc) || ------------------ | Branch (714:11): [True: 40, False: 86] ------------------ 715| 126| !(alias->algorithm_mac & cp->algorithm_mac) || ------------------ | Branch (715:11): [True: 0, False: 86] ------------------ 716| 126| (alias->min_version != 0 && ------------------ | Branch (716:12): [True: 0, False: 86] ------------------ 717| 86| SSL_CIPHER_get_min_version(cp) != alias->min_version) || ------------------ | Branch (717:12): [True: 0, False: 0] ------------------ 718| 126| (!alias->include_deprecated && ssl_cipher_is_deprecated(cp))) { ------------------ | Branch (718:12): [True: 84, False: 2] | Branch (718:42): [True: 8, False: 76] ------------------ 719| 48| continue; 720| 48| } 721| 126| } 722| | 723| | // add the cipher if it has not been added yet. 724| 78| if (rule == CIPHER_ADD) { ------------------ | | 354| 78|#define CIPHER_ADD 1 ------------------ | Branch (724:9): [True: 78, False: 0] ------------------ 725| | // reverse == false 726| 78| if (!curr->active) { ------------------ | Branch (726:11): [True: 78, False: 0] ------------------ 727| 78| ll_append_tail(&head, curr, &tail); 728| 78| curr->active = true; 729| 78| curr->in_group = in_group; 730| 78| } 731| 78| } 732| | 733| | // Move the added cipher to this location 734| 0| else if (rule == CIPHER_ORD) { ------------------ | | 357| 0|#define CIPHER_ORD 4 ------------------ | Branch (734:14): [True: 0, False: 0] ------------------ 735| | // reverse == false 736| 0| if (curr->active) { ------------------ | Branch (736:11): [True: 0, False: 0] ------------------ 737| 0| ll_append_tail(&head, curr, &tail); 738| 0| curr->in_group = false; 739| 0| } 740| 0| } else if (rule == CIPHER_DEL) { ------------------ | | 356| 0|#define CIPHER_DEL 3 ------------------ | Branch (740:16): [True: 0, False: 0] ------------------ 741| | // reverse == true 742| 0| if (curr->active) { ------------------ | Branch (742:11): [True: 0, False: 0] ------------------ 743| | // most recently deleted ciphersuites get best positions 744| | // for any future CIPHER_ADD (note that the CIPHER_DEL loop 745| | // works in reverse to maintain the order) 746| 0| ll_append_head(&head, curr, &tail); 747| 0| curr->active = false; 748| 0| curr->in_group = false; 749| 0| } 750| 0| } else if (rule == CIPHER_KILL) { ------------------ | | 355| 0|#define CIPHER_KILL 2 ------------------ | Branch (750:16): [True: 0, False: 0] ------------------ 751| | // reverse == false 752| 0| if (head == curr) { ------------------ | Branch (752:11): [True: 0, False: 0] ------------------ 753| 0| head = curr->next; 754| 0| } else { 755| 0| curr->prev->next = curr->next; 756| 0| } 757| | 758| 0| if (tail == curr) { ------------------ | Branch (758:11): [True: 0, False: 0] ------------------ 759| 0| tail = curr->prev; 760| 0| } 761| 0| curr->active = false; 762| 0| if (curr->next != NULL) { ------------------ | Branch (762:11): [True: 0, False: 0] ------------------ 763| 0| curr->next->prev = curr->prev; 764| 0| } 765| 0| if (curr->prev != NULL) { ------------------ | Branch (765:11): [True: 0, False: 0] ------------------ 766| 0| curr->prev->next = curr->next; 767| 0| } 768| 0| curr->next = NULL; 769| 0| curr->prev = NULL; 770| 0| } 771| 78| } 772| | 773| 6| *head_p = head; 774| 6| *tail_p = tail; 775| 6|} ssl_cipher.cc:_ZN4bsslL14ll_append_tailEPPNS_15cipher_order_stES1_S2_: 557| 78| CIPHER_ORDER **tail) { 558| 78| if (curr == *tail) { ------------------ | Branch (558:7): [True: 0, False: 78] ------------------ 559| 0| return; 560| 0| } 561| 78| if (curr == *head) { ------------------ | Branch (561:7): [True: 52, False: 26] ------------------ 562| 52| *head = curr->next; 563| 52| } 564| 78| if (curr->prev != NULL) { ------------------ | Branch (564:7): [True: 26, False: 52] ------------------ 565| 26| curr->prev->next = curr->next; 566| 26| } 567| 78| if (curr->next != NULL) { ------------------ | Branch (567:7): [True: 78, False: 0] ------------------ 568| 78| curr->next->prev = curr->prev; 569| 78| } 570| 78| (*tail)->next = curr; 571| 78| curr->prev = *tail; 572| 78| curr->next = NULL; 573| 78| *tail = curr; 574| 78|} ssl_cipher.cc:_ZL22ssl_cipher_id_cmp_voidPKvS0_: 1201| 309k|static int ssl_cipher_id_cmp_void(const void *in_a, const void *in_b) { 1202| 309k| return ssl_cipher_id_cmp(reinterpret_cast(in_a), 1203| 309k| reinterpret_cast(in_b)); 1204| 309k|} ssl_cipher.cc:_ZL17ssl_cipher_id_cmpPK13ssl_cipher_stS1_: 1191| 309k| const SSL_CIPHER *b) { 1192| 309k| if (a->id > b->id) { ------------------ | Branch (1192:7): [True: 82.6k, False: 226k] ------------------ 1193| 82.6k| return 1; 1194| 82.6k| } 1195| 226k| if (a->id < b->id) { ------------------ | Branch (1195:7): [True: 150k, False: 75.6k] ------------------ 1196| 150k| return -1; 1197| 150k| } 1198| 75.6k| return 0; 1199| 226k|} _ZN4bssl28ssl_get_full_credential_listEPNS_13SSL_HANDSHAKEEPNS_5ArrayIP17ssl_credential_stEE: 39| 28.0k| Array *out) { 40| 28.0k| CERT *cert = hs->config->cert.get(); 41| | // Finish filling in the legacy credential if needed. 42| 28.0k| if (!cert->x509_method->ssl_auto_chain_if_needed(hs)) { ------------------ | Branch (42:7): [True: 0, False: 28.0k] ------------------ 43| 0| return false; 44| 0| } 45| | 46| 28.0k| size_t num_creds = cert->credentials.size(); 47| 28.0k| bool include_legacy = cert->legacy_credential->IsComplete(); 48| 28.0k| if (include_legacy) { ------------------ | Branch (48:7): [True: 28.0k, False: 0] ------------------ 49| 28.0k| num_creds++; 50| 28.0k| } 51| | 52| 28.0k| if (!out->InitForOverwrite(num_creds)) { ------------------ | Branch (52:7): [True: 0, False: 28.0k] ------------------ 53| 0| return false; 54| 0| } 55| | 56| 28.0k| for (size_t i = 0; i < cert->credentials.size(); i++) { ------------------ | Branch (56:22): [True: 0, False: 28.0k] ------------------ 57| 0| (*out)[i] = cert->credentials[i].get(); 58| 0| } 59| 28.0k| if (include_legacy) { ------------------ | Branch (59:7): [True: 28.0k, False: 0] ------------------ 60| 28.0k| (*out)[num_creds - 1] = cert->legacy_credential.get(); 61| 28.0k| } 62| 28.0k| return true; 63| 28.0k|} _ZN4bssl40ssl_credential_matches_requested_issuersEPNS_13SSL_HANDSHAKEEPK17ssl_credential_st: 66| 28.0k| const SSL_CREDENTIAL *cred) { 67| 28.0k| if (!cred->must_match_issuer) { ------------------ | Branch (67:7): [True: 28.0k, False: 0] ------------------ 68| | // This credential does not need to match a requested issuer, so 69| | // it is good to use without a match. 70| 28.0k| return true; 71| 28.0k| } 72| | 73| | // If we have names sent by the CA extension, and this 74| | // credential matches it, it is good. 75| 0| if (hs->ca_names != nullptr) { ------------------ | Branch (75:7): [True: 0, False: 0] ------------------ 76| 0| for (const CRYPTO_BUFFER *ca_name : hs->ca_names.get()) { ------------------ | Branch (76:39): [True: 0, False: 0] ------------------ 77| 0| if (cred->ChainContainsIssuer( ------------------ | Branch (77:11): [True: 0, False: 0] ------------------ 78| 0| Span(CRYPTO_BUFFER_data(ca_name), CRYPTO_BUFFER_len(ca_name)))) { 79| 0| return true; 80| 0| } 81| 0| } 82| 0| } 83| | // If the credential has a trust anchor ID and it matches one sent by the 84| | // peer, it is good. 85| 0| if (!cred->trust_anchor_id.empty() && hs->peer_requested_trust_anchors) { ------------------ | Branch (85:7): [True: 0, False: 0] | Branch (85:41): [True: 0, False: 0] ------------------ 86| 0| CBS cbs = CBS(*hs->peer_requested_trust_anchors), candidate; 87| 0| while (CBS_len(&cbs) > 0) { ------------------ | Branch (87:12): [True: 0, False: 0] ------------------ 88| 0| if (!CBS_get_u8_length_prefixed(&cbs, &candidate) || ------------------ | Branch (88:11): [True: 0, False: 0] ------------------ 89| 0| CBS_len(&candidate) == 0) { ------------------ | Branch (89:11): [True: 0, False: 0] ------------------ 90| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 91| 0| return false; 92| 0| } 93| 0| if (candidate == Span(cred->trust_anchor_id)) { ------------------ | Branch (93:11): [True: 0, False: 0] ------------------ 94| 0| hs->matched_peer_trust_anchor = true; 95| 0| return true; 96| 0| } 97| 0| } 98| 0| } 99| | 100| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_NO_MATCHING_ISSUER); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 101| 0| return false; 102| 0|} _ZN17ssl_credential_stC2EN4bssl17SSLCredentialTypeE: 111| 39.8k| : RefCounted(CheckSubClass()), type(type_arg) { 112| 39.8k| CRYPTO_new_ex_data(&ex_data); 113| 39.8k|} _ZN17ssl_credential_stD2Ev: 115| 39.8k|ssl_credential_st::~ssl_credential_st() { 116| 39.8k| CRYPTO_free_ex_data(&g_ex_data_class, &ex_data); 117| 39.8k|} _ZNK17ssl_credential_st3DupEv: 124| 19.9k|UniquePtr ssl_credential_st::Dup() const { 125| 19.9k| assert(type == SSLCredentialType::kX509); 126| 19.9k| UniquePtr ret = MakeUnique(type); 127| 19.9k| if (ret == nullptr) { ------------------ | Branch (127:7): [True: 0, False: 19.9k] ------------------ 128| 0| return nullptr; 129| 0| } 130| | 131| 19.9k| ret->pubkey = UpRef(pubkey); 132| 19.9k| ret->privkey = UpRef(privkey); 133| 19.9k| ret->key_method = key_method; 134| 19.9k| if (!ret->sigalgs.CopyFrom(sigalgs)) { ------------------ | Branch (134:7): [True: 0, False: 19.9k] ------------------ 135| 0| return nullptr; 136| 0| } 137| | 138| 19.9k| if (chain) { ------------------ | Branch (138:7): [True: 19.9k, False: 0] ------------------ 139| 19.9k| ret->chain.reset(sk_CRYPTO_BUFFER_deep_copy(chain.get(), buffer_up_ref, 140| 19.9k| CRYPTO_BUFFER_free)); 141| 19.9k| if (!ret->chain) { ------------------ | Branch (141:9): [True: 0, False: 19.9k] ------------------ 142| 0| return nullptr; 143| 0| } 144| 19.9k| } 145| | 146| 19.9k| ret->dc = UpRef(dc); 147| 19.9k| ret->signed_cert_timestamp_list = UpRef(signed_cert_timestamp_list); 148| 19.9k| ret->ocsp_response = UpRef(ocsp_response); 149| 19.9k| ret->dc_algorithm = dc_algorithm; 150| 19.9k| return ret; 151| 19.9k|} _ZNK17ssl_credential_st8UsesX509Ev: 160| 28.0k|bool ssl_credential_st::UsesX509() const { 161| 28.0k| switch (type) { ------------------ | Branch (161:11): [True: 0, False: 28.0k] ------------------ 162| 28.0k| case SSLCredentialType::kX509: ------------------ | Branch (162:5): [True: 28.0k, False: 0] ------------------ 163| 28.0k| case SSLCredentialType::kDelegated: ------------------ | Branch (163:5): [True: 0, False: 28.0k] ------------------ 164| 28.0k| return true; 165| 0| case SSLCredentialType::kSPAKE2PlusV1Client: ------------------ | Branch (165:5): [True: 0, False: 28.0k] ------------------ 166| 0| case SSLCredentialType::kSPAKE2PlusV1Server: ------------------ | Branch (166:5): [True: 0, False: 28.0k] ------------------ 167| 0| return false; 168| 28.0k| } 169| 0| abort(); 170| 28.0k|} _ZNK17ssl_credential_st14UsesPrivateKeyEv: 172| 84.2k|bool ssl_credential_st::UsesPrivateKey() const { 173| 84.2k| switch (type) { ------------------ | Branch (173:11): [True: 0, False: 84.2k] ------------------ 174| 84.2k| case SSLCredentialType::kX509: ------------------ | Branch (174:5): [True: 84.2k, False: 0] ------------------ 175| 84.2k| case SSLCredentialType::kDelegated: ------------------ | Branch (175:5): [True: 0, False: 84.2k] ------------------ 176| 84.2k| return true; 177| 0| case SSLCredentialType::kSPAKE2PlusV1Client: ------------------ | Branch (177:5): [True: 0, False: 84.2k] ------------------ 178| 0| case SSLCredentialType::kSPAKE2PlusV1Server: ------------------ | Branch (178:5): [True: 0, False: 84.2k] ------------------ 179| 0| return false; 180| 84.2k| } 181| 0| abort(); 182| 84.2k|} _ZNK17ssl_credential_st10IsCompleteEv: 184| 28.0k|bool ssl_credential_st::IsComplete() const { 185| | // APIs like |SSL_use_certificate| and |SSL_set1_chain| configure the leaf and 186| | // other certificates separately. It is possible for |chain| have a null leaf. 187| 28.0k| if (UsesX509() && (sk_CRYPTO_BUFFER_num(chain.get()) == 0 || ------------------ | Branch (187:7): [True: 28.0k, False: 0] | Branch (187:22): [True: 0, False: 28.0k] ------------------ 188| 28.0k| sk_CRYPTO_BUFFER_value(chain.get(), 0) == nullptr)) { ------------------ | Branch (188:22): [True: 0, False: 28.0k] ------------------ 189| 0| return false; 190| 0| } 191| | // We must have successfully extracted a public key from the certificate, 192| | // delegated credential, etc. 193| 28.0k| if (UsesPrivateKey() && pubkey == nullptr) { ------------------ | Branch (193:7): [True: 28.0k, False: 0] | Branch (193:27): [True: 0, False: 28.0k] ------------------ 194| 0| return false; 195| 0| } 196| 28.0k| if (UsesPrivateKey() && privkey == nullptr && key_method == nullptr) { ------------------ | Branch (196:7): [True: 28.0k, False: 0] | Branch (196:27): [True: 0, False: 28.0k] | Branch (196:49): [True: 0, False: 0] ------------------ 197| 0| return false; 198| 0| } 199| 28.0k| if (type == SSLCredentialType::kDelegated && dc == nullptr) { ------------------ | Branch (199:7): [True: 0, False: 28.0k] | Branch (199:48): [True: 0, False: 0] ------------------ 200| 0| return false; 201| 0| } 202| 28.0k| return true; 203| 28.0k|} _ZN17ssl_credential_st11SetLeafCertENSt3__110unique_ptrI16crypto_buffer_stN4bssl8internal7DeleterEEEb: 206| 2| bool discard_key_on_mismatch) { 207| 2| if (!UsesX509()) { ------------------ | Branch (207:7): [True: 0, False: 2] ------------------ 208| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 209| 0| return false; 210| 0| } 211| | 212| 2| const bool private_key_matches_leaf = type != SSLCredentialType::kDelegated; 213| | 214| 2| CBS cbs; 215| 2| CRYPTO_BUFFER_init_CBS(leaf.get(), &cbs); 216| 2| UniquePtr new_pubkey = ssl_cert_parse_pubkey(&cbs); 217| 2| if (new_pubkey == nullptr) { ------------------ | Branch (217:7): [True: 0, False: 2] ------------------ 218| 0| return false; 219| 0| } 220| | 221| 2| if (!ssl_is_key_type_supported(EVP_PKEY_id(new_pubkey.get()))) { ------------------ | Branch (221:7): [True: 0, False: 2] ------------------ 222| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_UNKNOWN_CERTIFICATE_TYPE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 223| 0| return false; 224| 0| } 225| | 226| | // An ECC certificate may be usable for ECDH or ECDSA. We only support ECDSA 227| | // certificates, so sanity-check the key usage extension. 228| 2| if (EVP_PKEY_id(new_pubkey.get()) == EVP_PKEY_EC && ------------------ | | 136| 2|#define EVP_PKEY_EC NID_X9_62_id_ecPublicKey | | ------------------ | | | | 1844| 4|#define NID_X9_62_id_ecPublicKey 408 | | ------------------ ------------------ | Branch (228:7): [True: 0, False: 2] ------------------ 229| 2| !ssl_cert_check_key_usage(&cbs, key_usage_digital_signature)) { ------------------ | Branch (229:7): [True: 0, False: 0] ------------------ 230| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_UNKNOWN_CERTIFICATE_TYPE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 231| 0| return false; 232| 0| } 233| | 234| 2| if (private_key_matches_leaf && privkey != nullptr && ------------------ | Branch (234:7): [True: 2, False: 0] | Branch (234:35): [True: 2, False: 0] ------------------ 235| 2| !ssl_compare_public_and_private_key(new_pubkey.get(), privkey.get())) { ------------------ | Branch (235:7): [True: 0, False: 2] ------------------ 236| 0| if (!discard_key_on_mismatch) { ------------------ | Branch (236:9): [True: 0, False: 0] ------------------ 237| 0| return false; 238| 0| } 239| 0| ERR_clear_error(); 240| 0| privkey = nullptr; 241| 0| } 242| | 243| 2| if (chain == nullptr) { ------------------ | Branch (243:7): [True: 2, False: 0] ------------------ 244| 2| chain = new_leafless_chain(); 245| 2| if (chain == nullptr) { ------------------ | Branch (245:9): [True: 0, False: 2] ------------------ 246| 0| return false; 247| 0| } 248| 2| } 249| | 250| 2| CRYPTO_BUFFER_free(sk_CRYPTO_BUFFER_value(chain.get(), 0)); 251| 2| sk_CRYPTO_BUFFER_set(chain.get(), 0, leaf.release()); 252| 2| if (private_key_matches_leaf) { ------------------ | Branch (252:7): [True: 2, False: 0] ------------------ 253| 2| pubkey = std::move(new_pubkey); 254| 2| } 255| 2| return true; 256| 2|} SSL_CREDENTIAL_up_ref: 338| 28.0k|void SSL_CREDENTIAL_up_ref(SSL_CREDENTIAL *cred) { cred->UpRefInternal(); } SSL_CREDENTIAL_free: 340| 67.8k|void SSL_CREDENTIAL_free(SSL_CREDENTIAL *cred) { 341| 67.8k| if (cred != nullptr) { ------------------ | Branch (341:7): [True: 67.8k, False: 0] ------------------ 342| 67.8k| cred->DecRefInternal(); 343| 67.8k| } 344| 67.8k|} SSL_CREDENTIAL_set1_private_key: 346| 2|int SSL_CREDENTIAL_set1_private_key(SSL_CREDENTIAL *cred, EVP_PKEY *key) { 347| 2| if (!cred->UsesPrivateKey()) { ------------------ | Branch (347:7): [True: 0, False: 2] ------------------ 348| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 349| 0| return 0; 350| 0| } 351| | 352| | // If the public half has been configured, check |key| matches. |pubkey| will 353| | // have been extracted from the certificate, delegated credential, etc. 354| 2| if (cred->pubkey != nullptr && ------------------ | Branch (354:7): [True: 0, False: 2] ------------------ 355| 2| !ssl_compare_public_and_private_key(cred->pubkey.get(), key)) { ------------------ | Branch (355:7): [True: 0, False: 0] ------------------ 356| 0| return false; 357| 0| } 358| | 359| 2| cred->privkey = UpRef(key); 360| 2| cred->key_method = nullptr; 361| 2| return 1; 362| 2|} SSL_CREDENTIAL_set1_ocsp_response: 453| 2| CRYPTO_BUFFER *ocsp) { 454| 2| if (!cred->UsesX509()) { ------------------ | Branch (454:7): [True: 0, False: 2] ------------------ 455| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 456| 0| return 0; 457| 0| } 458| | 459| 2| cred->ocsp_response = UpRef(ocsp); 460| 2| return 1; 461| 2|} SSL_CREDENTIAL_set1_signed_cert_timestamp_list: 464| 2| CRYPTO_BUFFER *sct_list) { 465| 2| if (!cred->UsesX509()) { ------------------ | Branch (465:7): [True: 0, False: 2] ------------------ 466| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 467| 0| return 0; 468| 0| } 469| | 470| 2| CBS cbs; 471| 2| CRYPTO_BUFFER_init_CBS(sct_list, &cbs); 472| 2| if (!ssl_is_sct_list_valid(&cbs)) { ------------------ | Branch (472:7): [True: 0, False: 2] ------------------ 473| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_SCT_LIST); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 474| 0| return 0; 475| 0| } 476| | 477| 2| cred->signed_cert_timestamp_list = UpRef(sct_list); 478| 2| return 1; 479| 2|} ssl_credential.cc:_ZL13buffer_up_refPK16crypto_buffer_st: 119| 19.9k|static CRYPTO_BUFFER *buffer_up_ref(const CRYPTO_BUFFER *buffer) { 120| 19.9k| CRYPTO_BUFFER_up_ref(const_cast(buffer)); 121| 19.9k| return const_cast(buffer); 122| 19.9k|} ssl_credential.cc:_ZN4bsslL18new_leafless_chainEv: 29| 2|static UniquePtr new_leafless_chain(void) { 30| 2| UniquePtr chain(sk_CRYPTO_BUFFER_new_null()); 31| 2| if (!chain || !sk_CRYPTO_BUFFER_push(chain.get(), nullptr)) { ------------------ | Branch (31:7): [True: 0, False: 2] | Branch (31:17): [True: 0, False: 2] ------------------ 32| 0| return nullptr; 33| 0| } 34| | 35| 2| return chain; 36| 2|} _ZN4bssl11SSLKeyShare6CreateEt: 392| 163k|UniquePtr SSLKeyShare::Create(uint16_t group_id) { 393| 163k| switch (group_id) { 394| 96| case SSL_GROUP_SECP256R1: ------------------ | | 2525| 96|#define SSL_GROUP_SECP256R1 23 ------------------ | Branch (394:5): [True: 96, False: 163k] ------------------ 395| 96| return MakeUnique(EC_group_p256(), SSL_GROUP_SECP256R1); ------------------ | | 2525| 96|#define SSL_GROUP_SECP256R1 23 ------------------ 396| 29.6k| case SSL_GROUP_SECP384R1: ------------------ | | 2526| 29.6k|#define SSL_GROUP_SECP384R1 24 ------------------ | Branch (396:5): [True: 29.6k, False: 133k] ------------------ 397| 29.6k| return MakeUnique(EC_group_p384(), SSL_GROUP_SECP384R1); ------------------ | | 2526| 29.6k|#define SSL_GROUP_SECP384R1 24 ------------------ 398| 43| case SSL_GROUP_SECP521R1: ------------------ | | 2527| 43|#define SSL_GROUP_SECP521R1 25 ------------------ | Branch (398:5): [True: 43, False: 163k] ------------------ 399| 43| return MakeUnique(EC_group_p521(), SSL_GROUP_SECP521R1); ------------------ | | 2527| 43|#define SSL_GROUP_SECP521R1 25 ------------------ 400| 77.1k| case SSL_GROUP_X25519: ------------------ | | 2528| 77.1k|#define SSL_GROUP_X25519 29 ------------------ | Branch (400:5): [True: 77.1k, False: 86.1k] ------------------ 401| 77.1k| return MakeUnique(); 402| 28| case SSL_GROUP_X25519_KYBER768_DRAFT00: ------------------ | | 2530| 28|#define SSL_GROUP_X25519_KYBER768_DRAFT00 0x6399 ------------------ | Branch (402:5): [True: 28, False: 163k] ------------------ 403| 28| return MakeUnique(); 404| 56.3k| case SSL_GROUP_X25519_MLKEM768: ------------------ | | 2529| 56.3k|#define SSL_GROUP_X25519_MLKEM768 0x11ec ------------------ | Branch (404:5): [True: 56.3k, False: 106k] ------------------ 405| 56.3k| return MakeUnique(); 406| 0| default: ------------------ | Branch (406:5): [True: 0, False: 163k] ------------------ 407| 0| return nullptr; 408| 163k| } 409| 163k|} _ZN4bssl19ssl_nid_to_group_idEPti: 411| 14.4k|bool ssl_nid_to_group_id(uint16_t *out_group_id, int nid) { 412| 15.0k| for (const auto &group : kNamedGroups) { ------------------ | Branch (412:26): [True: 15.0k, False: 1] ------------------ 413| 15.0k| if (group.nid == nid) { ------------------ | Branch (413:9): [True: 14.4k, False: 647] ------------------ 414| 14.4k| *out_group_id = group.group_id; 415| 14.4k| return true; 416| 14.4k| } 417| 15.0k| } 418| 1| return false; 419| 14.4k|} _ZN4bssl19ssl_group_id_to_nidEt: 438| 12|int ssl_group_id_to_nid(uint16_t group_id) { 439| 42| for (const auto &group : kNamedGroups) { ------------------ | Branch (439:26): [True: 42, False: 0] ------------------ 440| 42| if (group.group_id == group_id) { ------------------ | Branch (440:9): [True: 12, False: 30] ------------------ 441| 12| return group.nid; 442| 12| } 443| 42| } 444| 0| return NID_undef; ------------------ | | 43| 0|#define NID_undef 0 ------------------ 445| 12|} ssl_key_share.cc:_ZN4bssl12_GLOBAL__N_110ECKeyShareC2EPK11ec_group_stt: 46| 29.7k| : group_(group), group_id_(group_id) {} ssl_key_share.cc:_ZNK4bssl12_GLOBAL__N_110ECKeyShare7GroupIDEv: 48| 4| uint16_t GroupID() const override { return group_id_; } ssl_key_share.cc:_ZN4bssl12_GLOBAL__N_110ECKeyShare8GenerateEP6cbb_st: 50| 29.7k| bool Generate(CBB *out) override { 51| 29.7k| assert(!private_key_); 52| | // Generate a private key. 53| 29.7k| private_key_.reset(BN_new()); 54| 29.7k| if (!private_key_ || ------------------ | Branch (54:9): [True: 0, False: 29.7k] ------------------ 55| 29.7k| !BN_rand_range_ex(private_key_.get(), 1, EC_GROUP_get0_order(group_))) { ------------------ | Branch (55:9): [True: 0, False: 29.7k] ------------------ 56| 0| return false; 57| 0| } 58| | 59| | // Compute the corresponding public key and serialize it. 60| 29.7k| UniquePtr public_key(EC_POINT_new(group_)); 61| 29.7k| if (!public_key || ------------------ | Branch (61:9): [True: 0, False: 29.7k] ------------------ 62| 29.7k| !EC_POINT_mul(group_, public_key.get(), private_key_.get(), nullptr, ------------------ | Branch (62:9): [True: 0, False: 29.7k] ------------------ 63| 29.7k| nullptr, /*ctx=*/nullptr) || 64| 29.7k| !EC_POINT_point2cbb(out, group_, public_key.get(), ------------------ | Branch (64:9): [True: 0, False: 29.7k] ------------------ 65| 29.7k| POINT_CONVERSION_UNCOMPRESSED, /*ctx=*/nullptr)) { 66| 0| return false; 67| 0| } 68| | 69| 29.7k| return true; 70| 29.7k| } ssl_key_share.cc:_ZN4bssl12_GLOBAL__N_110ECKeyShare5EncapEP6cbb_stPNS_5ArrayIhEEPhNS_4SpanIKhEE: 73| 29.7k| uint8_t *out_alert, Span peer_key) override { 74| | // ECDH may be fit into a KEM-like abstraction by using a second keypair's 75| | // public key as the ciphertext. 76| 29.7k| *out_alert = SSL_AD_INTERNAL_ERROR; ------------------ | | 4387| 29.7k|#define SSL_AD_INTERNAL_ERROR TLS1_AD_INTERNAL_ERROR | | ------------------ | | | | 37| 29.7k|#define TLS1_AD_INTERNAL_ERROR 80 | | ------------------ ------------------ 77| 29.7k| return Generate(out_ciphertext) && Decap(out_secret, out_alert, peer_key); ------------------ | Branch (77:12): [True: 29.7k, False: 0] | Branch (77:40): [True: 29.5k, False: 161] ------------------ 78| 29.7k| } ssl_key_share.cc:_ZN4bssl12_GLOBAL__N_110ECKeyShare5DecapEPNS_5ArrayIhEEPhNS_4SpanIKhEE: 81| 29.7k| Span ciphertext) override { 82| 29.7k| assert(group_); 83| 29.7k| assert(private_key_); 84| 29.7k| *out_alert = SSL_AD_INTERNAL_ERROR; ------------------ | | 4387| 29.7k|#define SSL_AD_INTERNAL_ERROR TLS1_AD_INTERNAL_ERROR | | ------------------ | | | | 37| 29.7k|#define TLS1_AD_INTERNAL_ERROR 80 | | ------------------ ------------------ 85| | 86| 29.7k| UniquePtr peer_point(EC_POINT_new(group_)); 87| 29.7k| UniquePtr result(EC_POINT_new(group_)); 88| 29.7k| UniquePtr x(BN_new()); 89| 29.7k| if (!peer_point || !result || !x) { ------------------ | Branch (89:9): [True: 0, False: 29.7k] | Branch (89:24): [True: 0, False: 29.7k] | Branch (89:35): [True: 0, False: 29.7k] ------------------ 90| 0| return false; 91| 0| } 92| | 93| 29.7k| if (ciphertext.empty() || ciphertext[0] != POINT_CONVERSION_UNCOMPRESSED || ------------------ | Branch (93:9): [True: 0, False: 29.7k] | Branch (93:31): [True: 77, False: 29.6k] ------------------ 94| 29.7k| !EC_POINT_oct2point(group_, peer_point.get(), ciphertext.data(), ------------------ | Branch (94:9): [True: 85, False: 29.5k] ------------------ 95| 29.6k| ciphertext.size(), /*ctx=*/nullptr)) { 96| 162| OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_ECPOINT); ------------------ | | 361| 162| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 97| 162| *out_alert = SSL_AD_ILLEGAL_PARAMETER; ------------------ | | 4379| 162|#define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER | | ------------------ | | | | 189| 162|#define SSL3_AD_ILLEGAL_PARAMETER 47 // fatal | | ------------------ ------------------ 98| 162| return false; 99| 162| } 100| | 101| | // Compute the x-coordinate of |peer_key| * |private_key_|. 102| 29.5k| if (!EC_POINT_mul(group_, result.get(), nullptr, peer_point.get(), ------------------ | Branch (102:9): [True: 0, False: 29.5k] ------------------ 103| 29.5k| private_key_.get(), /*ctx=*/nullptr) || 104| 29.5k| !EC_POINT_get_affine_coordinates_GFp(group_, result.get(), x.get(), ------------------ | Branch (104:9): [True: 0, False: 29.5k] ------------------ 105| 29.5k| nullptr, /*ctx=*/nullptr)) { 106| 0| return false; 107| 0| } 108| | 109| | // Encode the x-coordinate left-padded with zeros. 110| 29.5k| Array secret; 111| 29.5k| if (!secret.InitForOverwrite((EC_GROUP_get_degree(group_) + 7) / 8) || ------------------ | Branch (111:9): [True: 0, False: 29.5k] ------------------ 112| 29.5k| !BN_bn2bin_padded(secret.data(), secret.size(), x.get())) { ------------------ | Branch (112:9): [True: 0, False: 29.5k] ------------------ 113| 0| return false; 114| 0| } 115| | 116| 29.5k| *out_secret = std::move(secret); 117| 29.5k| return true; 118| 29.5k| } ssl_key_share.cc:_ZN4bssl12_GLOBAL__N_114X25519KeyShareC2Ev: 142| 77.1k| X25519KeyShare() {} ssl_key_share.cc:_ZNK4bssl12_GLOBAL__N_114X25519KeyShare7GroupIDEv: 144| 345| uint16_t GroupID() const override { return SSL_GROUP_X25519; } ------------------ | | 2528| 345|#define SSL_GROUP_X25519 29 ------------------ ssl_key_share.cc:_ZN4bssl12_GLOBAL__N_114X25519KeyShare8GenerateEP6cbb_st: 146| 77.1k| bool Generate(CBB *out) override { 147| 77.1k| uint8_t public_key[32]; 148| 77.1k| X25519_keypair(public_key, private_key_); 149| 77.1k| return !!CBB_add_bytes(out, public_key, sizeof(public_key)); 150| 77.1k| } ssl_key_share.cc:_ZN4bssl12_GLOBAL__N_114X25519KeyShare5EncapEP6cbb_stPNS_5ArrayIhEEPhNS_4SpanIKhEE: 153| 20.8k| uint8_t *out_alert, Span peer_key) override { 154| | // X25519 may be fit into a KEM-like abstraction by using a second keypair's 155| | // public key as the ciphertext. 156| 20.8k| *out_alert = SSL_AD_INTERNAL_ERROR; ------------------ | | 4387| 20.8k|#define SSL_AD_INTERNAL_ERROR TLS1_AD_INTERNAL_ERROR | | ------------------ | | | | 37| 20.8k|#define TLS1_AD_INTERNAL_ERROR 80 | | ------------------ ------------------ 157| 20.8k| return Generate(out_ciphertext) && Decap(out_secret, out_alert, peer_key); ------------------ | Branch (157:12): [True: 20.8k, False: 0] | Branch (157:40): [True: 20.7k, False: 3] ------------------ 158| 20.8k| } ssl_key_share.cc:_ZN4bssl12_GLOBAL__N_114X25519KeyShare5DecapEPNS_5ArrayIhEEPhNS_4SpanIKhEE: 161| 21.0k| Span ciphertext) override { 162| 21.0k| *out_alert = SSL_AD_INTERNAL_ERROR; ------------------ | | 4387| 21.0k|#define SSL_AD_INTERNAL_ERROR TLS1_AD_INTERNAL_ERROR | | ------------------ | | | | 37| 21.0k|#define TLS1_AD_INTERNAL_ERROR 80 | | ------------------ ------------------ 163| | 164| 21.0k| Array secret; 165| 21.0k| if (!secret.InitForOverwrite(32)) { ------------------ | Branch (165:9): [True: 0, False: 21.0k] ------------------ 166| 0| return false; 167| 0| } 168| | 169| 21.0k| if (ciphertext.size() != 32 || // ------------------ | Branch (169:9): [True: 1, False: 21.0k] ------------------ 170| 21.0k| !X25519(secret.data(), private_key_, ciphertext.data())) { ------------------ | Branch (170:9): [True: 2, False: 21.0k] ------------------ 171| 3| *out_alert = SSL_AD_ILLEGAL_PARAMETER; ------------------ | | 4379| 3|#define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER | | ------------------ | | | | 189| 3|#define SSL3_AD_ILLEGAL_PARAMETER 47 // fatal | | ------------------ ------------------ 172| 3| OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_ECPOINT); ------------------ | | 361| 3| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 173| 3| return false; 174| 3| } 175| | 176| 21.0k| *out_secret = std::move(secret); 177| 21.0k| return true; 178| 21.0k| } ssl_key_share.cc:_ZN4bssl12_GLOBAL__N_122X25519Kyber768KeyShareC2Ev: 199| 28| X25519Kyber768KeyShare() {} ssl_key_share.cc:_ZN4bssl12_GLOBAL__N_122X25519Kyber768KeyShare8GenerateEP6cbb_st: 205| 28| bool Generate(CBB *out) override { 206| 28| uint8_t x25519_public_key[32]; 207| 28| X25519_keypair(x25519_public_key, x25519_private_key_); 208| | 209| 28| uint8_t kyber_public_key[KYBER_PUBLIC_KEY_BYTES]; 210| 28| KYBER_generate_key(kyber_public_key, &kyber_private_key_); 211| | 212| 28| if (!CBB_add_bytes(out, x25519_public_key, sizeof(x25519_public_key)) || ------------------ | Branch (212:9): [True: 0, False: 28] ------------------ 213| 28| !CBB_add_bytes(out, kyber_public_key, sizeof(kyber_public_key))) { ------------------ | Branch (213:9): [True: 0, False: 28] ------------------ 214| 0| return false; 215| 0| } 216| | 217| 28| return true; 218| 28| } ssl_key_share.cc:_ZN4bssl12_GLOBAL__N_122X25519MLKEM768KeyShareC2Ev: 288| 56.3k| X25519MLKEM768KeyShare() {} ssl_key_share.cc:_ZNK4bssl12_GLOBAL__N_122X25519MLKEM768KeyShare7GroupIDEv: 290| 345| uint16_t GroupID() const override { return SSL_GROUP_X25519_MLKEM768; } ------------------ | | 2529| 345|#define SSL_GROUP_X25519_MLKEM768 0x11ec ------------------ ssl_key_share.cc:_ZN4bssl12_GLOBAL__N_122X25519MLKEM768KeyShare8GenerateEP6cbb_st: 292| 56.3k| bool Generate(CBB *out) override { 293| 56.3k| uint8_t mlkem_public_key[MLKEM768_PUBLIC_KEY_BYTES]; 294| 56.3k| MLKEM768_generate_key(mlkem_public_key, /*optional_out_seed=*/nullptr, 295| 56.3k| &mlkem_private_key_); 296| | 297| 56.3k| uint8_t x25519_public_key[X25519_PUBLIC_VALUE_LEN]; 298| 56.3k| X25519_keypair(x25519_public_key, x25519_private_key_); 299| | 300| 56.3k| if (!CBB_add_bytes(out, mlkem_public_key, sizeof(mlkem_public_key)) || ------------------ | Branch (300:9): [True: 0, False: 56.3k] ------------------ 301| 56.3k| !CBB_add_bytes(out, x25519_public_key, sizeof(x25519_public_key))) { ------------------ | Branch (301:9): [True: 0, False: 56.3k] ------------------ 302| 0| return false; 303| 0| } 304| | 305| 56.3k| return true; 306| 56.3k| } _ZN4bssl14CBBFinishArrayEP6cbb_stPNS_5ArrayIhEE: 72| 325k|bool CBBFinishArray(CBB *cbb, Array *out) { 73| 325k| uint8_t *ptr; 74| 325k| size_t len; 75| 325k| if (!CBB_finish(cbb, &ptr, &len)) { ------------------ | Branch (75:7): [True: 0, False: 325k] ------------------ 76| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 77| 0| return false; 78| 0| } 79| 325k| out->Reset(ptr, len); 80| 325k| return true; 81| 325k|} _ZN4bssl21ssl_reset_error_stateEP6ssl_st: 83| 60.2k|void ssl_reset_error_state(SSL *ssl) { 84| | // Functions which use |SSL_get_error| must reset I/O and error state on 85| | // entry. 86| 60.2k| ssl->s3->rwstate = SSL_ERROR_NONE; ------------------ | | 372| 60.2k|#define SSL_ERROR_NONE 0 ------------------ 87| 60.2k| ERR_clear_error(); 88| 60.2k| ERR_clear_system_error(); 89| 60.2k|} _ZN4bssl18ssl_set_read_errorEP6ssl_st: 91| 874|void ssl_set_read_error(SSL *ssl) { 92| 874| ssl->s3->read_shutdown = ssl_shutdown_error; 93| 874| ssl->s3->read_error.reset(ERR_save_state()); 94| 874|} _ZN4bssl12ssl_can_readEPK6ssl_st: 108| 447k|bool ssl_can_read(const SSL *ssl) { 109| 447k| return !SSL_in_init(ssl) || ssl->s3->hs->can_early_read; ------------------ | Branch (109:10): [True: 396k, False: 51.1k] | Branch (109:31): [True: 0, False: 51.1k] ------------------ 110| 447k|} _ZN4bssl18ssl_open_handshakeEP6ssl_stPmPhNS_4SpanIhEE: 113| 1.10M| uint8_t *out_alert, Span in) { 114| 1.10M| *out_consumed = 0; 115| 1.10M| if (!check_read_error(ssl)) { ------------------ | Branch (115:7): [True: 0, False: 1.10M] ------------------ 116| 0| *out_alert = 0; 117| 0| return ssl_open_record_error; 118| 0| } 119| 1.10M| auto ret = ssl->method->open_handshake(ssl, out_consumed, out_alert, in); 120| 1.10M| if (ret == ssl_open_record_error) { ------------------ | Branch (120:7): [True: 650, False: 1.10M] ------------------ 121| 650| ssl_set_read_error(ssl); 122| 650| } 123| 1.10M| return ret; 124| 1.10M|} _ZN4bssl27ssl_open_change_cipher_specEP6ssl_stPmPhNS_4SpanIhEE: 128| 154k| Span in) { 129| 154k| *out_consumed = 0; 130| 154k| if (!check_read_error(ssl)) { ------------------ | Branch (130:7): [True: 0, False: 154k] ------------------ 131| 0| *out_alert = 0; 132| 0| return ssl_open_record_error; 133| 0| } 134| 154k| auto ret = 135| 154k| ssl->method->open_change_cipher_spec(ssl, out_consumed, out_alert, in); 136| 154k| if (ret == ssl_open_record_error) { ------------------ | Branch (136:7): [True: 107, False: 154k] ------------------ 137| 107| ssl_set_read_error(ssl); 138| 107| } 139| 154k| return ret; 140| 154k|} _ZN4bssl17ssl_open_app_dataEP6ssl_stPNS_4SpanIhEEPmPhS3_: 144| 172k| Span in) { 145| 172k| *out_consumed = 0; 146| 172k| if (!check_read_error(ssl)) { ------------------ | Branch (146:7): [True: 0, False: 172k] ------------------ 147| 0| *out_alert = 0; 148| 0| return ssl_open_record_error; 149| 0| } 150| 172k| auto ret = ssl->method->open_app_data(ssl, out, out_consumed, out_alert, in); 151| 172k| if (ret == ssl_open_record_error) { ------------------ | Branch (151:7): [True: 81, False: 171k] ------------------ 152| 81| ssl_set_read_error(ssl); 153| 81| } 154| 172k| return ret; 155| 172k|} _ZN4bssl14ssl_log_secretEPK6ssl_stPKcNS_4SpanIKhEE: 178| 53.0k| Span secret) { 179| 53.0k| if (ssl->ctx->keylog_callback == NULL) { ------------------ | Branch (179:7): [True: 53.0k, False: 0] ------------------ 180| 53.0k| return true; 181| 53.0k| } 182| | 183| 0| ScopedCBB cbb; 184| 0| Array line; 185| 0| auto label_bytes = bssl::StringAsBytes(label); 186| 0| if (!CBB_init(cbb.get(), strlen(label) + 1 + SSL3_RANDOM_SIZE * 2 + 1 + ------------------ | | 102| 0|#define SSL3_RANDOM_SIZE 32 ------------------ | Branch (186:7): [True: 0, False: 0] ------------------ 187| 0| secret.size() * 2 + 1) || 188| 0| !CBB_add_bytes(cbb.get(), label_bytes.data(), label_bytes.size()) || ------------------ | Branch (188:7): [True: 0, False: 0] ------------------ 189| 0| !CBB_add_u8(cbb.get(), ' ') || ------------------ | Branch (189:7): [True: 0, False: 0] ------------------ 190| 0| !cbb_add_hex_consttime(cbb.get(), ssl->s3->client_random) || ------------------ | Branch (190:7): [True: 0, False: 0] ------------------ 191| 0| !CBB_add_u8(cbb.get(), ' ') || ------------------ | Branch (191:7): [True: 0, False: 0] ------------------ 192| | // Convert to hex in constant time to avoid leaking |secret|. If the 193| | // callback discards the data, we should not introduce side channels. 194| 0| !cbb_add_hex_consttime(cbb.get(), secret) || ------------------ | Branch (194:7): [True: 0, False: 0] ------------------ 195| 0| !CBB_add_u8(cbb.get(), 0 /* NUL */) || ------------------ | Branch (195:7): [True: 0, False: 0] ------------------ 196| 0| !CBBFinishArray(cbb.get(), &line)) { ------------------ | Branch (196:7): [True: 0, False: 0] ------------------ 197| 0| return false; 198| 0| } 199| | 200| 0| ssl->ctx->keylog_callback(ssl, reinterpret_cast(line.data())); 201| 0| return true; 202| 0|} _ZN4bssl20ssl_do_info_callbackEPK6ssl_stii: 204| 1.12M|void ssl_do_info_callback(const SSL *ssl, int type, int value) { 205| 1.12M| void (*cb)(const SSL *ssl, int type, int value) = NULL; 206| 1.12M| if (ssl->info_callback != NULL) { ------------------ | Branch (206:7): [True: 0, False: 1.12M] ------------------ 207| 0| cb = ssl->info_callback; 208| 1.12M| } else if (ssl->ctx->info_callback != NULL) { ------------------ | Branch (208:14): [True: 0, False: 1.12M] ------------------ 209| 0| cb = ssl->ctx->info_callback; 210| 0| } 211| | 212| 1.12M| if (cb != NULL) { ------------------ | Branch (212:7): [True: 0, False: 1.12M] ------------------ 213| 0| cb(ssl, type, value); 214| 0| } 215| 1.12M|} _ZN4bssl19ssl_do_msg_callbackEPK6ssl_stiiNS_4SpanIKhEE: 218| 1.42M| Span in) { 219| 1.42M| if (ssl->msg_callback == NULL) { ------------------ | Branch (219:7): [True: 1.42M, False: 0] ------------------ 220| 1.42M| return; 221| 1.42M| } 222| | 223| | // |version| is zero when calling for |SSL3_RT_HEADER| and |SSL2_VERSION| for 224| | // a V2ClientHello. 225| 0| int version; 226| 0| switch (content_type) { 227| 0| case 0: ------------------ | Branch (227:5): [True: 0, False: 0] ------------------ 228| | // V2ClientHello 229| 0| version = SSL2_VERSION; ------------------ | | 29| 0|#define SSL2_VERSION 0x0002 ------------------ 230| 0| break; 231| 0| case SSL3_RT_HEADER: ------------------ | | 172| 0|#define SSL3_RT_HEADER 0x100 ------------------ | Branch (231:5): [True: 0, False: 0] ------------------ 232| 0| version = 0; 233| 0| break; 234| 0| default: ------------------ | Branch (234:5): [True: 0, False: 0] ------------------ 235| 0| version = SSL_version(ssl); 236| 0| } 237| | 238| 0| ssl->msg_callback(is_write, version, content_type, in.data(), in.size(), 239| 0| const_cast(ssl), ssl->msg_callback_arg); 240| 0|} _ZN4bssl24ssl_ctx_get_current_timeEPK10ssl_ctx_st: 242| 108k|OPENSSL_timeval ssl_ctx_get_current_time(const SSL_CTX *ctx) { 243| 108k| if (ctx->current_time_cb != NULL) { ------------------ | Branch (243:7): [True: 108k, False: 0] ------------------ 244| | // TODO(davidben): Update current_time_cb to use OPENSSL_timeval. See 245| | // https://crbug.com/boringssl/155. 246| 108k| struct timeval clock; 247| 108k| ctx->current_time_cb(nullptr /* ssl */, &clock); 248| 108k| if (clock.tv_sec < 0) { ------------------ | Branch (248:9): [True: 0, False: 108k] ------------------ 249| 0| assert(0); 250| 0| return {0, 0}; 251| 108k| } else { 252| 108k| return {static_cast(clock.tv_sec), 253| 108k| static_cast(clock.tv_usec)}; 254| 108k| } 255| 108k| } 256| | 257| |#if defined(OPENSSL_WINDOWS) 258| | struct _timeb time; 259| | _ftime(&time); 260| | if (time.time < 0) { 261| | assert(0); 262| | return {0, 0}; 263| | } else { 264| | return {static_cast(time.time), 265| | static_cast(time.millitm * 1000)}; 266| | } 267| |#else 268| 0| struct timeval clock; 269| 0| gettimeofday(&clock, NULL); 270| 0| if (clock.tv_sec < 0) { ------------------ | Branch (270:7): [True: 0, False: 0] ------------------ 271| 0| assert(0); 272| 0| return {0, 0}; 273| 0| } else { 274| 0| return {static_cast(clock.tv_sec), 275| 0| static_cast(clock.tv_usec)}; 276| 0| } 277| 0|#endif 278| 0|} _ZN4bssl20SSL_set_handoff_modeEP6ssl_stb: 324| 2.98k|void SSL_set_handoff_mode(SSL *ssl, bool on) { 325| 2.98k| if (!ssl->config) { ------------------ | Branch (325:7): [True: 0, False: 2.98k] ------------------ 326| 0| return; 327| 0| } 328| 2.98k| ssl->config->handoff = on; 329| 2.98k|} _ZN10ssl_ctx_stC2EPK13ssl_method_st: 387| 2| : RefCounted(CheckSubClass()), 388| 2| method(ssl_method->method), 389| 2| x509_method(ssl_method->x509_method), 390| 2| retain_only_sha256_of_client_certs(false), 391| 2| quiet_shutdown(false), 392| 2| ocsp_stapling_enabled(false), 393| 2| signed_cert_timestamps_enabled(false), 394| 2| channel_id_enabled(false), 395| 2| grease_enabled(false), 396| 2| permute_extensions(false), 397| 2| allow_unknown_alpn_protos(false), 398| 2| false_start_allowed_without_alpn(false), 399| 2| handoff(false), 400| 2| enable_early_data(false), 401| 2| aes_hw_override(false), 402| 2| aes_hw_override_value(false), 403| 2| resumption_across_names_enabled(false) { 404| 2| CRYPTO_MUTEX_init(&lock); 405| 2| CRYPTO_new_ex_data(&ex_data); 406| 2|} SSL_CTX_new: 421| 2|SSL_CTX *SSL_CTX_new(const SSL_METHOD *method) { 422| 2| if (method == NULL) { ------------------ | Branch (422:7): [True: 0, False: 2] ------------------ 423| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_NULL_SSL_METHOD_PASSED); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 424| 0| return nullptr; 425| 0| } 426| | 427| 2| UniquePtr ret = MakeUnique(method); 428| 2| if (!ret) { ------------------ | Branch (428:7): [True: 0, False: 2] ------------------ 429| 0| return nullptr; 430| 0| } 431| | 432| 2| ret->cert = MakeUnique(method->x509_method); 433| 2| ret->sessions = lh_SSL_SESSION_new(ssl_session_hash, ssl_session_cmp); 434| 2| ret->client_CA.reset(sk_CRYPTO_BUFFER_new_null()); 435| 2| ret->CA_names.reset(sk_CRYPTO_BUFFER_new_null()); 436| 2| if (ret->cert == nullptr || // ------------------ | Branch (436:7): [True: 0, False: 2] ------------------ 437| 2| !ret->cert->is_valid() || // ------------------ | Branch (437:7): [True: 0, False: 2] ------------------ 438| 2| ret->sessions == nullptr || // ------------------ | Branch (438:7): [True: 0, False: 2] ------------------ 439| 2| ret->client_CA == nullptr || // ------------------ | Branch (439:7): [True: 0, False: 2] ------------------ 440| 2| ret->CA_names == nullptr || // ------------------ | Branch (440:7): [True: 0, False: 2] ------------------ 441| 2| !ret->x509_method->ssl_ctx_new(ret.get())) { ------------------ | Branch (441:7): [True: 0, False: 2] ------------------ 442| 0| return nullptr; 443| 0| } 444| | 445| 2| if (!SSL_CTX_set_strict_cipher_list(ret.get(), SSL_DEFAULT_CIPHER_LIST) || ------------------ | | 1669| 2|#define SSL_DEFAULT_CIPHER_LIST "ALL" ------------------ | Branch (445:7): [True: 0, False: 2] ------------------ 446| | // Lock the SSL_CTX to the specified version, for compatibility with 447| | // legacy uses of SSL_METHOD. 448| 2| !SSL_CTX_set_max_proto_version(ret.get(), method->version) || ------------------ | Branch (448:7): [True: 0, False: 2] ------------------ 449| 2| !SSL_CTX_set_min_proto_version(ret.get(), method->version)) { ------------------ | Branch (449:7): [True: 0, False: 2] ------------------ 450| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 451| 0| return nullptr; 452| 0| } 453| | 454| 2| return ret.release(); 455| 2|} SSL_CTX_up_ref: 457| 39.8k|int SSL_CTX_up_ref(SSL_CTX *ctx) { 458| 39.8k| ctx->UpRefInternal(); 459| 39.8k| return 1; 460| 39.8k|} SSL_CTX_free: 462| 39.8k|void SSL_CTX_free(SSL_CTX *ctx) { 463| 39.8k| if (ctx != nullptr) { ------------------ | Branch (463:7): [True: 39.8k, False: 0] ------------------ 464| 39.8k| ctx->DecRefInternal(); 465| 39.8k| } 466| 39.8k|} _ZN6ssl_stC2EP10ssl_ctx_st: 469| 19.9k| : method(ctx_arg->method), 470| 19.9k| max_send_fragment(ctx_arg->max_send_fragment), 471| 19.9k| msg_callback(ctx_arg->msg_callback), 472| 19.9k| msg_callback_arg(ctx_arg->msg_callback_arg), 473| 19.9k| ctx(UpRef(ctx_arg)), 474| 19.9k| session_ctx(UpRef(ctx_arg)), 475| 19.9k| options(ctx->options), 476| 19.9k| mode(ctx->mode), 477| 19.9k| max_cert_list(ctx->max_cert_list), 478| 19.9k| server(false), 479| 19.9k| quiet_shutdown(ctx->quiet_shutdown), 480| 19.9k| enable_early_data(ctx->enable_early_data), 481| 19.9k| resumption_across_names_enabled(ctx->resumption_across_names_enabled) { 482| 19.9k| CRYPTO_new_ex_data(&ex_data); 483| 19.9k|} _ZN6ssl_stD2Ev: 485| 19.9k|ssl_st::~ssl_st() { 486| 19.9k| CRYPTO_free_ex_data(&g_ex_data_class_ssl, &ex_data); 487| | // |config| refers to |this|, so we must release it earlier. 488| 19.9k| config.reset(); 489| 19.9k| if (method != NULL) { ------------------ | Branch (489:7): [True: 19.9k, False: 0] ------------------ 490| 19.9k| method->ssl_free(this); 491| 19.9k| } 492| 19.9k|} SSL_new: 494| 19.9k|SSL *SSL_new(SSL_CTX *ctx) { 495| 19.9k| if (ctx == nullptr) { ------------------ | Branch (495:7): [True: 0, False: 19.9k] ------------------ 496| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_NULL_SSL_CTX); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 497| 0| return nullptr; 498| 0| } 499| | 500| 19.9k| UniquePtr ssl = MakeUnique(ctx); 501| 19.9k| if (ssl == nullptr) { ------------------ | Branch (501:7): [True: 0, False: 19.9k] ------------------ 502| 0| return nullptr; 503| 0| } 504| | 505| 19.9k| ssl->config = MakeUnique(ssl.get()); 506| 19.9k| if (ssl->config == nullptr) { ------------------ | Branch (506:7): [True: 0, False: 19.9k] ------------------ 507| 0| return nullptr; 508| 0| } 509| 19.9k| ssl->config->conf_min_version = ctx->conf_min_version; 510| 19.9k| ssl->config->conf_max_version = ctx->conf_max_version; 511| | 512| 19.9k| ssl->config->cert = ssl_cert_dup(ctx->cert.get()); 513| 19.9k| if (ssl->config->cert == nullptr) { ------------------ | Branch (513:7): [True: 0, False: 19.9k] ------------------ 514| 0| return nullptr; 515| 0| } 516| | 517| 19.9k| ssl->config->verify_mode = ctx->verify_mode; 518| 19.9k| ssl->config->verify_callback = ctx->default_verify_callback; 519| 19.9k| ssl->config->custom_verify_callback = ctx->custom_verify_callback; 520| 19.9k| ssl->config->retain_only_sha256_of_client_certs = 521| 19.9k| ctx->retain_only_sha256_of_client_certs; 522| 19.9k| ssl->config->permute_extensions = ctx->permute_extensions; 523| 19.9k| ssl->config->aes_hw_override = ctx->aes_hw_override; 524| 19.9k| ssl->config->aes_hw_override_value = ctx->aes_hw_override_value; 525| 19.9k| ssl->config->compliance_policy = ctx->compliance_policy; 526| | 527| 19.9k| if (!ssl->config->supported_group_list.CopyFrom(ctx->supported_group_list) || ------------------ | Branch (527:7): [True: 0, False: 19.9k] ------------------ 528| 19.9k| !ssl->config->alpn_client_proto_list.CopyFrom( ------------------ | Branch (528:7): [True: 0, False: 19.9k] ------------------ 529| 19.9k| ctx->alpn_client_proto_list) || 530| 19.9k| !ssl->config->verify_sigalgs.CopyFrom(ctx->verify_sigalgs)) { ------------------ | Branch (530:7): [True: 0, False: 19.9k] ------------------ 531| 0| return nullptr; 532| 0| } 533| | 534| 19.9k| if (ctx->requested_trust_anchors) { ------------------ | Branch (534:7): [True: 0, False: 19.9k] ------------------ 535| 0| ssl->config->requested_trust_anchors.emplace(); 536| 0| if (!ssl->config->requested_trust_anchors->CopyFrom( ------------------ | Branch (536:9): [True: 0, False: 0] ------------------ 537| 0| *ctx->requested_trust_anchors)) { 538| 0| return nullptr; 539| 0| } 540| 0| } 541| | 542| 19.9k| if (ctx->psk_identity_hint) { ------------------ | Branch (542:7): [True: 0, False: 19.9k] ------------------ 543| 0| ssl->config->psk_identity_hint.reset( 544| 0| OPENSSL_strdup(ctx->psk_identity_hint.get())); 545| 0| if (ssl->config->psk_identity_hint == nullptr) { ------------------ | Branch (545:9): [True: 0, False: 0] ------------------ 546| 0| return nullptr; 547| 0| } 548| 0| } 549| 19.9k| ssl->config->psk_client_callback = ctx->psk_client_callback; 550| 19.9k| ssl->config->psk_server_callback = ctx->psk_server_callback; 551| | 552| 19.9k| ssl->config->channel_id_enabled = ctx->channel_id_enabled; 553| 19.9k| ssl->config->channel_id_private = UpRef(ctx->channel_id_private); 554| | 555| 19.9k| ssl->config->signed_cert_timestamps_enabled = 556| 19.9k| ctx->signed_cert_timestamps_enabled; 557| 19.9k| ssl->config->ocsp_stapling_enabled = ctx->ocsp_stapling_enabled; 558| 19.9k| ssl->config->handoff = ctx->handoff; 559| 19.9k| ssl->quic_method = ctx->quic_method; 560| | 561| 19.9k| if (!ssl->method->ssl_new(ssl.get()) || ------------------ | Branch (561:7): [True: 0, False: 19.9k] ------------------ 562| 19.9k| !ssl->ctx->x509_method->ssl_new(ssl->s3->hs.get())) { ------------------ | Branch (562:7): [True: 0, False: 19.9k] ------------------ 563| 0| return nullptr; 564| 0| } 565| | 566| 19.9k| return ssl.release(); 567| 19.9k|} _ZN4bssl10SSL_CONFIGC2EP6ssl_st: 570| 19.9k| : ssl(ssl_arg), 571| 19.9k| ech_grease_enabled(false), 572| 19.9k| signed_cert_timestamps_enabled(false), 573| 19.9k| ocsp_stapling_enabled(false), 574| 19.9k| channel_id_enabled(false), 575| 19.9k| enforce_rsa_key_usage(true), 576| 19.9k| retain_only_sha256_of_client_certs(false), 577| 19.9k| handoff(false), 578| 19.9k| shed_handshake_config(false), 579| 19.9k| jdk11_workaround(false), 580| 19.9k| quic_use_legacy_codepoint(false), 581| 19.9k| permute_extensions(false), 582| 19.9k| alps_use_new_codepoint(true) { 583| 19.9k| assert(ssl); 584| 19.9k|} _ZN4bssl10SSL_CONFIGD2Ev: 586| 19.9k|SSL_CONFIG::~SSL_CONFIG() { 587| 19.9k| if (ssl->ctx != nullptr) { ------------------ | Branch (587:7): [True: 19.9k, False: 0] ------------------ 588| 19.9k| ssl->ctx->x509_method->ssl_config_free(this); 589| 19.9k| } 590| 19.9k|} SSL_free: 592| 19.9k|void SSL_free(SSL *ssl) { Delete(ssl); } SSL_set_connect_state: 594| 9.52k|void SSL_set_connect_state(SSL *ssl) { 595| 9.52k| ssl->server = false; 596| 9.52k| ssl->do_handshake = ssl_client_handshake; 597| 9.52k|} SSL_set_accept_state: 599| 5.18k|void SSL_set_accept_state(SSL *ssl) { 600| 5.18k| ssl->server = true; 601| 5.18k| ssl->do_handshake = ssl_server_handshake; 602| 5.18k|} SSL_set0_rbio: 604| 5.18k|void SSL_set0_rbio(SSL *ssl, BIO *rbio) { ssl->rbio.reset(rbio); } SSL_set0_wbio: 606| 5.18k|void SSL_set0_wbio(SSL *ssl, BIO *wbio) { ssl->wbio.reset(wbio); } SSL_do_handshake: 716| 56.3k|int SSL_do_handshake(SSL *ssl) { 717| 56.3k| ssl_reset_error_state(ssl); 718| | 719| 56.3k| if (ssl->do_handshake == NULL) { ------------------ | Branch (719:7): [True: 0, False: 56.3k] ------------------ 720| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_CONNECTION_TYPE_NOT_SET); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 721| 0| return -1; 722| 0| } 723| | 724| 56.3k| if (!SSL_in_init(ssl)) { ------------------ | Branch (724:7): [True: 0, False: 56.3k] ------------------ 725| 0| return 1; 726| 0| } 727| | 728| | // Run the handshake. 729| 56.3k| SSL_HANDSHAKE *hs = ssl->s3->hs.get(); 730| | 731| 56.3k| bool early_return = false; 732| 56.3k| int ret = ssl_run_handshake(hs, &early_return); 733| 56.3k| ssl_do_info_callback( 734| 56.3k| ssl, ssl->server ? SSL_CB_ACCEPT_EXIT : SSL_CB_CONNECT_EXIT, ret); ------------------ | | 5028| 0|#define SSL_CB_ACCEPT_EXIT (SSL_ST_ACCEPT | SSL_CB_EXIT) | | ------------------ | | | | 5007| 0|#define SSL_ST_ACCEPT 0x2000 | | ------------------ | | #define SSL_CB_ACCEPT_EXIT (SSL_ST_ACCEPT | SSL_CB_EXIT) | | ------------------ | | | | 5021| 0|#define SSL_CB_EXIT 0x02 | | ------------------ ------------------ ssl, ssl->server ? SSL_CB_ACCEPT_EXIT : SSL_CB_CONNECT_EXIT, ret); ------------------ | | 5030| 56.3k|#define SSL_CB_CONNECT_EXIT (SSL_ST_CONNECT | SSL_CB_EXIT) | | ------------------ | | | | 5006| 56.3k|#define SSL_ST_CONNECT 0x1000 | | ------------------ | | #define SSL_CB_CONNECT_EXIT (SSL_ST_CONNECT | SSL_CB_EXIT) | | ------------------ | | | | 5021| 56.3k|#define SSL_CB_EXIT 0x02 | | ------------------ ------------------ | Branch (734:12): [True: 0, False: 56.3k] ------------------ 735| 56.3k| if (ret <= 0) { ------------------ | Branch (735:7): [True: 4.83k, False: 51.5k] ------------------ 736| 4.83k| return ret; 737| 4.83k| } 738| | 739| | // Destroy the handshake object if the handshake has completely finished. 740| 51.5k| if (!early_return) { ------------------ | Branch (740:7): [True: 51.4k, False: 5] ------------------ 741| 51.4k| ssl->s3->hs.reset(); 742| 51.4k| ssl_maybe_shed_handshake_config(ssl); 743| 51.4k| } 744| | 745| 51.5k| return 1; 746| 56.3k|} SSL_read: 908| 3.94k|int SSL_read(SSL *ssl, void *buf, int num) { 909| 3.94k| int ret = SSL_peek(ssl, buf, num); 910| 3.94k| if (ret <= 0) { ------------------ | Branch (910:7): [True: 1.74k, False: 2.20k] ------------------ 911| 1.74k| return ret; 912| 1.74k| } 913| | // TODO(davidben): In DTLS, should the rest of the record be discarded? DTLS 914| | // is not a stream. See https://crbug.com/boringssl/65. 915| 2.20k| ssl->s3->pending_app_data = 916| 2.20k| ssl->s3->pending_app_data.subspan(static_cast(ret)); 917| 2.20k| if (ssl->s3->pending_app_data.empty()) { ------------------ | Branch (917:7): [True: 2.07k, False: 134] ------------------ 918| 2.07k| ssl->s3->read_buffer.DiscardConsumed(); 919| 2.07k| } 920| 2.20k| return ret; 921| 3.94k|} SSL_peek: 923| 3.94k|int SSL_peek(SSL *ssl, void *buf, int num) { 924| 3.94k| if (SSL_is_quic(ssl)) { ------------------ | Branch (924:7): [True: 0, False: 3.94k] ------------------ 925| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 926| 0| return -1; 927| 0| } 928| | 929| 3.94k| int ret = ssl_read_impl(ssl); 930| 3.94k| if (ret <= 0) { ------------------ | Branch (930:7): [True: 1.74k, False: 2.20k] ------------------ 931| 1.74k| return ret; 932| 1.74k| } 933| 2.20k| if (num <= 0) { ------------------ | Branch (933:7): [True: 0, False: 2.20k] ------------------ 934| 0| return num; 935| 0| } 936| 2.20k| size_t todo = 937| 2.20k| std::min(ssl->s3->pending_app_data.size(), static_cast(num)); 938| 2.20k| OPENSSL_memcpy(buf, ssl->s3->pending_app_data.data(), todo); 939| 2.20k| return static_cast(todo); 940| 2.20k|} SSL_CTX_set_early_data_enabled: 1105| 2|void SSL_CTX_set_early_data_enabled(SSL_CTX *ctx, int enabled) { 1106| 2| ctx->enable_early_data = !!enabled; 1107| 2|} SSL_get_error: 1191| 3.85k|int SSL_get_error(const SSL *ssl, int ret_code) { 1192| 3.85k| if (ret_code > 0) { ------------------ | Branch (1192:7): [True: 0, False: 3.85k] ------------------ 1193| 0| return SSL_ERROR_NONE; ------------------ | | 372| 0|#define SSL_ERROR_NONE 0 ------------------ 1194| 0| } 1195| | 1196| | // Make things return SSL_ERROR_SYSCALL when doing SSL_do_handshake etc, 1197| | // where we do encode the error 1198| 3.85k| uint32_t err = ERR_peek_error(); 1199| 3.85k| if (err != 0) { ------------------ | Branch (1199:7): [True: 3.85k, False: 6] ------------------ 1200| 3.85k| if (ERR_GET_LIB(err) == ERR_LIB_SYS) { ------------------ | Branch (1200:9): [True: 0, False: 3.85k] ------------------ 1201| 0| return SSL_ERROR_SYSCALL; ------------------ | | 401| 0|#define SSL_ERROR_SYSCALL 5 ------------------ 1202| 0| } 1203| 3.85k| return SSL_ERROR_SSL; ------------------ | | 376| 3.85k|#define SSL_ERROR_SSL 1 ------------------ 1204| 3.85k| } 1205| | 1206| 6| if (ret_code == 0) { ------------------ | Branch (1206:7): [True: 0, False: 6] ------------------ 1207| 0| if (ssl->s3->rwstate == SSL_ERROR_ZERO_RETURN) { ------------------ | | 405| 0|#define SSL_ERROR_ZERO_RETURN 6 ------------------ | Branch (1207:9): [True: 0, False: 0] ------------------ 1208| 0| return SSL_ERROR_ZERO_RETURN; ------------------ | | 405| 0|#define SSL_ERROR_ZERO_RETURN 6 ------------------ 1209| 0| } 1210| | // An EOF was observed which violates the protocol, and the underlying 1211| | // transport does not participate in the error queue. Bubble up to the 1212| | // caller. 1213| 0| return SSL_ERROR_SYSCALL; ------------------ | | 401| 0|#define SSL_ERROR_SYSCALL 5 ------------------ 1214| 0| } 1215| | 1216| 6| switch (ssl->s3->rwstate) { ------------------ | Branch (1216:11): [True: 6, False: 0] ------------------ 1217| 0| case SSL_ERROR_PENDING_SESSION: ------------------ | | 430| 0|#define SSL_ERROR_PENDING_SESSION 11 ------------------ | Branch (1217:5): [True: 0, False: 6] ------------------ 1218| 0| case SSL_ERROR_PENDING_CERTIFICATE: ------------------ | | 437| 0|#define SSL_ERROR_PENDING_CERTIFICATE 12 ------------------ | Branch (1218:5): [True: 0, False: 6] ------------------ 1219| 0| case SSL_ERROR_HANDOFF: ------------------ | | 466| 0|#define SSL_ERROR_HANDOFF 17 ------------------ | Branch (1219:5): [True: 0, False: 6] ------------------ 1220| 0| case SSL_ERROR_HANDBACK: ------------------ | | 467| 0|#define SSL_ERROR_HANDBACK 18 ------------------ | Branch (1220:5): [True: 0, False: 6] ------------------ 1221| 0| case SSL_ERROR_WANT_X509_LOOKUP: ------------------ | | 394| 0|#define SSL_ERROR_WANT_X509_LOOKUP 4 ------------------ | Branch (1221:5): [True: 0, False: 6] ------------------ 1222| 0| case SSL_ERROR_WANT_PRIVATE_KEY_OPERATION: ------------------ | | 445| 0|#define SSL_ERROR_WANT_PRIVATE_KEY_OPERATION 13 ------------------ | Branch (1222:5): [True: 0, False: 6] ------------------ 1223| 0| case SSL_ERROR_PENDING_TICKET: ------------------ | | 451| 0|#define SSL_ERROR_PENDING_TICKET 14 ------------------ | Branch (1223:5): [True: 0, False: 6] ------------------ 1224| 0| case SSL_ERROR_EARLY_DATA_REJECTED: ------------------ | | 457| 0|#define SSL_ERROR_EARLY_DATA_REJECTED 15 ------------------ | Branch (1224:5): [True: 0, False: 6] ------------------ 1225| 0| case SSL_ERROR_WANT_CERTIFICATE_VERIFY: ------------------ | | 464| 0|#define SSL_ERROR_WANT_CERTIFICATE_VERIFY 16 ------------------ | Branch (1225:5): [True: 0, False: 6] ------------------ 1226| 0| case SSL_ERROR_WANT_RENEGOTIATE: ------------------ | | 474| 0|#define SSL_ERROR_WANT_RENEGOTIATE 19 ------------------ | Branch (1226:5): [True: 0, False: 6] ------------------ 1227| 0| case SSL_ERROR_HANDSHAKE_HINTS_READY: ------------------ | | 479| 0|#define SSL_ERROR_HANDSHAKE_HINTS_READY 20 ------------------ | Branch (1227:5): [True: 0, False: 6] ------------------ 1228| 0| return ssl->s3->rwstate; 1229| | 1230| 0| case SSL_ERROR_WANT_READ: { ------------------ | | 381| 0|#define SSL_ERROR_WANT_READ 2 ------------------ | Branch (1230:5): [True: 0, False: 6] ------------------ 1231| 0| if (SSL_is_quic(ssl)) { ------------------ | Branch (1231:11): [True: 0, False: 0] ------------------ 1232| 0| return SSL_ERROR_WANT_READ; ------------------ | | 381| 0|#define SSL_ERROR_WANT_READ 2 ------------------ 1233| 0| } 1234| 0| BIO *bio = SSL_get_rbio(ssl); 1235| 0| if (BIO_should_read(bio)) { ------------------ | Branch (1235:11): [True: 0, False: 0] ------------------ 1236| 0| return SSL_ERROR_WANT_READ; ------------------ | | 381| 0|#define SSL_ERROR_WANT_READ 2 ------------------ 1237| 0| } 1238| | 1239| 0| if (BIO_should_write(bio)) { ------------------ | Branch (1239:11): [True: 0, False: 0] ------------------ 1240| | // TODO(davidben): OpenSSL historically checked for writes on the read 1241| | // BIO. Can this be removed? 1242| 0| return SSL_ERROR_WANT_WRITE; ------------------ | | 386| 0|#define SSL_ERROR_WANT_WRITE 3 ------------------ 1243| 0| } 1244| | 1245| 0| if (BIO_should_io_special(bio)) { ------------------ | Branch (1245:11): [True: 0, False: 0] ------------------ 1246| 0| return bio_retry_reason_to_error(BIO_get_retry_reason(bio)); 1247| 0| } 1248| | 1249| 0| break; 1250| 0| } 1251| | 1252| 0| case SSL_ERROR_WANT_WRITE: { ------------------ | | 386| 0|#define SSL_ERROR_WANT_WRITE 3 ------------------ | Branch (1252:5): [True: 0, False: 6] ------------------ 1253| 0| BIO *bio = SSL_get_wbio(ssl); 1254| 0| if (BIO_should_write(bio)) { ------------------ | Branch (1254:11): [True: 0, False: 0] ------------------ 1255| 0| return SSL_ERROR_WANT_WRITE; ------------------ | | 386| 0|#define SSL_ERROR_WANT_WRITE 3 ------------------ 1256| 0| } 1257| | 1258| 0| if (BIO_should_read(bio)) { ------------------ | Branch (1258:11): [True: 0, False: 0] ------------------ 1259| | // TODO(davidben): OpenSSL historically checked for reads on the write 1260| | // BIO. Can this be removed? 1261| 0| return SSL_ERROR_WANT_READ; ------------------ | | 381| 0|#define SSL_ERROR_WANT_READ 2 ------------------ 1262| 0| } 1263| | 1264| 0| if (BIO_should_io_special(bio)) { ------------------ | Branch (1264:11): [True: 0, False: 0] ------------------ 1265| 0| return bio_retry_reason_to_error(BIO_get_retry_reason(bio)); 1266| 0| } 1267| | 1268| 0| break; 1269| 0| } 1270| 6| } 1271| | 1272| 6| return SSL_ERROR_SYSCALL; ------------------ | | 401| 6|#define SSL_ERROR_SYSCALL 5 ------------------ 1273| 6|} SSL_get_options: 1342| 111k|uint32_t SSL_get_options(const SSL *ssl) { return ssl->options; } SSL_get_mode: 1366| 52.0k|uint32_t SSL_get_mode(const SSL *ssl) { return ssl->mode; } SSL_renegotiate: 1626| 51.1k|int SSL_renegotiate(SSL *ssl) { 1627| | // Caller-initiated renegotiation is not supported. 1628| 51.1k| if (!ssl->s3->renegotiate_pending) { ------------------ | Branch (1628:7): [True: 0, False: 51.1k] ------------------ 1629| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1630| 0| return 0; 1631| 0| } 1632| | 1633| 51.1k| if (!ssl_can_renegotiate(ssl)) { ------------------ | Branch (1633:7): [True: 0, False: 51.1k] ------------------ 1634| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_NO_RENEGOTIATION); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1635| 0| return 0; 1636| 0| } 1637| | 1638| | // We should not have told the caller to release the private key. 1639| 51.1k| assert(!SSL_can_release_private_key(ssl)); 1640| | 1641| | // Renegotiation is only supported at quiescent points in the application 1642| | // protocol, namely in HTTPS, just before reading the HTTP response. 1643| | // Require the record-layer be idle and avoid complexities of sending a 1644| | // handshake record while an application_data record is being written. 1645| 51.1k| if (!ssl->s3->write_buffer.empty() || ------------------ | Branch (1645:7): [True: 0, False: 51.1k] ------------------ 1646| 51.1k| ssl->s3->write_shutdown != ssl_shutdown_none) { ------------------ | Branch (1646:7): [True: 0, False: 51.1k] ------------------ 1647| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_NO_RENEGOTIATION); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1648| 0| return 0; 1649| 0| } 1650| | 1651| | // Begin a new handshake. 1652| 51.1k| if (ssl->s3->hs != nullptr) { ------------------ | Branch (1652:7): [True: 0, False: 51.1k] ------------------ 1653| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1654| 0| return 0; 1655| 0| } 1656| 51.1k| ssl->s3->hs = ssl_handshake_new(ssl); 1657| 51.1k| if (ssl->s3->hs == nullptr) { ------------------ | Branch (1657:7): [True: 0, False: 51.1k] ------------------ 1658| 0| return 0; 1659| 0| } 1660| | 1661| 51.1k| ssl->s3->renegotiate_pending = false; 1662| 51.1k| ssl->s3->total_renegotiations++; 1663| 51.1k| return 1; 1664| 51.1k|} SSL_CTX_set1_group_ids: 1826| 2| size_t num_group_ids) { 1827| 2| auto span = Span(group_ids, num_group_ids); 1828| 2| return check_group_ids(span) && ctx->supported_group_list.CopyFrom(span); ------------------ | Branch (1828:10): [True: 2, False: 0] | Branch (1828:35): [True: 2, False: 0] ------------------ 1829| 2|} SSL_get_ciphers: 1952| 111k|STACK_OF(SSL_CIPHER) *SSL_get_ciphers(const SSL *ssl) { 1953| 111k| if (ssl == NULL) { ------------------ | Branch (1953:7): [True: 0, False: 111k] ------------------ 1954| 0| return NULL; 1955| 0| } 1956| 111k| if (ssl->config == NULL) { ------------------ | Branch (1956:7): [True: 0, False: 111k] ------------------ 1957| 0| assert(ssl->config); 1958| 0| return NULL; 1959| 0| } 1960| | 1961| 111k| return ssl->config->cipher_list ? ssl->config->cipher_list->ciphers.get() ------------------ | Branch (1961:10): [True: 0, False: 111k] ------------------ 1962| 111k| : ssl->ctx->cipher_list->ciphers.get(); 1963| 111k|} SSL_CTX_set_strict_cipher_list: 1990| 4|int SSL_CTX_set_strict_cipher_list(SSL_CTX *ctx, const char *str) { 1991| 4| const bool has_aes_hw = ctx->aes_hw_override ? ctx->aes_hw_override_value ------------------ | Branch (1991:27): [True: 0, False: 4] ------------------ 1992| 4| : EVP_has_aes_hardware(); 1993| 4| return ssl_create_cipher_list(&ctx->cipher_list, has_aes_hw, str, 1994| 4| true /* strict */); 1995| 4|} SSL_CTX_enable_signed_cert_timestamps: 2057| 2|void SSL_CTX_enable_signed_cert_timestamps(SSL_CTX *ctx) { 2058| 2| ctx->signed_cert_timestamps_enabled = true; 2059| 2|} SSL_CTX_enable_ocsp_stapling: 2068| 2|void SSL_CTX_enable_ocsp_stapling(SSL_CTX *ctx) { 2069| 2| ctx->ocsp_stapling_enabled = true; 2070| 2|} SSL_set_tlsext_host_name: 2105| 5.18k|int SSL_set_tlsext_host_name(SSL *ssl, const char *name) { 2106| 5.18k| ssl->hostname.reset(); 2107| 5.18k| if (name == nullptr) { ------------------ | Branch (2107:7): [True: 0, False: 5.18k] ------------------ 2108| 0| return 1; 2109| 0| } 2110| | 2111| 5.18k| size_t len = strlen(name); 2112| 5.18k| if (len == 0 || len > TLSEXT_MAXLEN_host_name) { ------------------ | | 170| 5.18k|#define TLSEXT_MAXLEN_host_name 255 ------------------ | Branch (2112:7): [True: 0, False: 5.18k] | Branch (2112:19): [True: 0, False: 5.18k] ------------------ 2113| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_SSL3_EXT_INVALID_SERVERNAME); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 2114| 0| return 0; 2115| 0| } 2116| 5.18k| ssl->hostname.reset(OPENSSL_strdup(name)); 2117| 5.18k| if (ssl->hostname == nullptr) { ------------------ | Branch (2117:7): [True: 0, False: 5.18k] ------------------ 2118| 0| return 0; 2119| 0| } 2120| 5.18k| return 1; 2121| 5.18k|} SSL_CTX_set_next_protos_advertised_cb: 2193| 2| void *arg) { 2194| 2| ctx->next_protos_advertised_cb = cb; 2195| 2| ctx->next_protos_advertised_cb_arg = arg; 2196| 2|} SSL_CTX_set_next_proto_select_cb: 2203| 2| void *arg) { 2204| 2| ctx->next_proto_select_cb = cb; 2205| 2| ctx->next_proto_select_cb_arg = arg; 2206| 2|} SSL_CTX_set_alpn_protos: 2209| 2| size_t protos_len) { 2210| | // Note this function's return value is backwards. 2211| 2| auto span = Span(protos, protos_len); 2212| 2| if (!span.empty() && !ssl_is_valid_alpn_list(span)) { ------------------ | Branch (2212:7): [True: 2, False: 0] | Branch (2212:24): [True: 0, False: 2] ------------------ 2213| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_ALPN_PROTOCOL_LIST); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 2214| 0| return 1; 2215| 0| } 2216| 2| return ctx->alpn_client_proto_list.CopyFrom(span) ? 0 : 1; ------------------ | Branch (2216:10): [True: 2, False: 0] ------------------ 2217| 2|} SSL_CTX_set_alpn_select_cb: 2236| 2| void *arg) { 2237| 2| ctx->alpn_select_cb = cb; 2238| 2| ctx->alpn_select_cb_arg = arg; 2239| 2|} SSL_CTX_set_tls_channel_id_enabled: 2314| 2|void SSL_CTX_set_tls_channel_id_enabled(SSL_CTX *ctx, int enabled) { 2315| 2| ctx->channel_id_enabled = !!enabled; 2316| 2|} SSL_CTX_set1_tls_channel_id: 2341| 2|int SSL_CTX_set1_tls_channel_id(SSL_CTX *ctx, EVP_PKEY *private_key) { 2342| 2| if (!is_p256_key(private_key)) { ------------------ | Branch (2342:7): [True: 0, False: 2] ------------------ 2343| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_CHANNEL_ID_NOT_P256); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 2344| 0| return 0; 2345| 0| } 2346| | 2347| 2| ctx->channel_id_private = UpRef(private_key); 2348| 2| return 1; 2349| 2|} SSL_CTX_set_current_time_cb: 2720| 2| struct timeval *out_clock)) { 2721| 2| ctx->current_time_cb = cb; 2722| 2|} SSL_can_release_private_key: 2724| 51.1k|int SSL_can_release_private_key(const SSL *ssl) { 2725| 51.1k| if (ssl_can_renegotiate(ssl)) { ------------------ | Branch (2725:7): [True: 51.1k, False: 0] ------------------ 2726| | // If the connection can renegotiate (client only), the private key may be 2727| | // used in a future handshake. 2728| 51.1k| return 0; 2729| 51.1k| } 2730| | 2731| | // Otherwise, this is determined by the current handshake. 2732| 0| return !ssl->s3->hs || ssl->s3->hs->can_release_private_key; ------------------ | Branch (2732:10): [True: 0, False: 0] | Branch (2732:26): [True: 0, False: 0] ------------------ 2733| 51.1k|} SSL_in_init: 2737| 2.39M|int SSL_in_init(const SSL *ssl) { 2738| | // This returns false once all the handshake state has been finalized, to 2739| | // allow callbacks and getters based on SSL_in_init to return the correct 2740| | // values. 2741| 2.39M| SSL_HANDSHAKE *hs = ssl->s3->hs.get(); 2742| 2.39M| return hs != nullptr && !hs->handshake_finalized; ------------------ | Branch (2742:10): [True: 1.76M, False: 624k] | Branch (2742:27): [True: 1.76M, False: 0] ------------------ 2743| 2.39M|} SSL_is_server: 2754| 51.3k|int SSL_is_server(const SSL *ssl) { return ssl->server; } SSL_is_dtls: 2756| 4.79M|int SSL_is_dtls(const SSL *ssl) { return ssl->method->is_dtls; } SSL_is_quic: 2758| 2.35M|int SSL_is_quic(const SSL *ssl) { return ssl->quic_method != nullptr; } SSL_set_renegotiate_mode: 2786| 5.18k|void SSL_set_renegotiate_mode(SSL *ssl, enum ssl_renegotiate_mode_t mode) { 2787| 5.18k| ssl->renegotiate_mode = mode; 2788| | 2789| | // Check if |ssl_can_renegotiate| has changed and the configuration may now be 2790| | // shed. HTTP clients may initially allow renegotiation for HTTP/1.1, and then 2791| | // disable after the handshake once the ALPN protocol is known to be HTTP/2. 2792| 5.18k| ssl_maybe_shed_handshake_config(ssl); 2793| 5.18k|} ssl_lib.cc:_ZN4bsslL16check_read_errorEPK6ssl_st: 96| 1.43M|static bool check_read_error(const SSL *ssl) { 97| 1.43M| if (ssl->s3->read_shutdown == ssl_shutdown_error) { ------------------ | Branch (97:7): [True: 0, False: 1.43M] ------------------ 98| 0| ERR_restore_state(ssl->s3->read_error.get()); 99| 0| return false; 100| 0| } 101| 1.43M| return true; 102| 1.43M|} ssl_lib.cc:_ZN4bsslL31ssl_maybe_shed_handshake_configEP6ssl_st: 313| 56.6k|static void ssl_maybe_shed_handshake_config(SSL *ssl) { 314| 56.6k| if (ssl->s3->hs != nullptr || // ------------------ | Branch (314:7): [True: 5.18k, False: 51.4k] ------------------ 315| 56.6k| ssl->config == nullptr || // ------------------ | Branch (315:7): [True: 0, False: 51.4k] ------------------ 316| 56.6k| !ssl->config->shed_handshake_config || // ------------------ | Branch (316:7): [True: 51.4k, False: 0] ------------------ 317| 56.6k| ssl_can_renegotiate(ssl)) { ------------------ | Branch (317:7): [True: 0, False: 0] ------------------ 318| 56.6k| return; 319| 56.6k| } 320| | 321| 0| ssl->config.reset(); 322| 0|} ssl_lib.cc:_ZL21ssl_do_post_handshakeP6ssl_stRKN4bssl10SSLMessageE: 766| 52.6k|static int ssl_do_post_handshake(SSL *ssl, const SSLMessage &msg) { 767| 52.6k| if (ssl_protocol_version(ssl) >= TLS1_3_VERSION) { ------------------ | | 545| 52.6k|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (767:7): [True: 1.49k, False: 51.1k] ------------------ 768| 1.49k| return tls13_post_handshake(ssl, msg); 769| 1.49k| } 770| | 771| | // Check for renegotiation on the server before parsing to use the correct 772| | // error. Renegotiation is triggered by a different message for servers. 773| 51.1k| if (ssl->server) { ------------------ | Branch (773:7): [True: 0, False: 51.1k] ------------------ 774| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_NO_RENEGOTIATION); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 775| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_NO_RENEGOTIATION); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_NO_RENEGOTIATION); ------------------ | | 4390| 0|#define SSL_AD_NO_RENEGOTIATION TLS1_AD_NO_RENEGOTIATION | | ------------------ | | | | 39| 0|#define TLS1_AD_NO_RENEGOTIATION 100 | | ------------------ ------------------ 776| 0| return 0; 777| 0| } 778| | 779| 51.1k| if (msg.type != SSL3_MT_HELLO_REQUEST || CBS_len(&msg.body) != 0) { ------------------ | | 194| 102k|#define SSL3_MT_HELLO_REQUEST 0 ------------------ | Branch (779:7): [True: 8, False: 51.1k] | Branch (779:44): [True: 4, False: 51.1k] ------------------ 780| 12| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 176| 12|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 4382| 12|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 12|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 781| 12| OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_HELLO_REQUEST); ------------------ | | 361| 12| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 782| 12| return 0; 783| 12| } 784| | 785| 51.1k| if (ssl->renegotiate_mode == ssl_renegotiate_ignore) { ------------------ | Branch (785:7): [True: 0, False: 51.1k] ------------------ 786| 0| return 1; // Ignore the HelloRequest. 787| 0| } 788| | 789| 51.1k| ssl->s3->renegotiate_pending = true; 790| 51.1k| if (ssl->renegotiate_mode == ssl_renegotiate_explicit) { ------------------ | Branch (790:7): [True: 0, False: 51.1k] ------------------ 791| 0| return 1; // Handle it later. 792| 0| } 793| | 794| 51.1k| if (!SSL_renegotiate(ssl)) { ------------------ | Branch (794:7): [True: 0, False: 51.1k] ------------------ 795| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_NO_RENEGOTIATION); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_NO_RENEGOTIATION); ------------------ | | 4390| 0|#define SSL_AD_NO_RENEGOTIATION TLS1_AD_NO_RENEGOTIATION | | ------------------ | | | | 39| 0|#define TLS1_AD_NO_RENEGOTIATION 100 | | ------------------ ------------------ 796| 0| return 0; 797| 0| } 798| | 799| 51.1k| return 1; 800| 51.1k|} ssl_lib.cc:_ZL13ssl_read_implP6ssl_st: 829| 3.94k|static int ssl_read_impl(SSL *ssl) { 830| 3.94k| ssl_reset_error_state(ssl); 831| | 832| 3.94k| if (ssl->do_handshake == NULL) { ------------------ | Branch (832:7): [True: 0, False: 3.94k] ------------------ 833| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_UNINITIALIZED); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 834| 0| return -1; 835| 0| } 836| | 837| | // Replay post-handshake message errors. 838| 3.94k| if (!check_read_error(ssl)) { ------------------ | Branch (838:7): [True: 0, False: 3.94k] ------------------ 839| 0| return -1; 840| 0| } 841| | 842| 228k| while (ssl->s3->pending_app_data.empty()) { ------------------ | Branch (842:10): [True: 226k, False: 2.20k] ------------------ 843| 226k| if (ssl->s3->renegotiate_pending) { ------------------ | Branch (843:9): [True: 0, False: 226k] ------------------ 844| 0| ssl->s3->rwstate = SSL_ERROR_WANT_RENEGOTIATE; ------------------ | | 474| 0|#define SSL_ERROR_WANT_RENEGOTIATE 19 ------------------ 845| 0| return -1; 846| 0| } 847| | 848| | // If a read triggered a DTLS ACK or retransmit, resolve that before reading 849| | // more. 850| 226k| if (SSL_is_dtls(ssl)) { ------------------ | Branch (850:9): [True: 0, False: 226k] ------------------ 851| 0| int ret = ssl->method->flush(ssl); 852| 0| if (ret <= 0) { ------------------ | Branch (852:11): [True: 0, False: 0] ------------------ 853| 0| return ret; 854| 0| } 855| 0| } 856| | 857| | // Complete the current handshake, if any. False Start will cause 858| | // |SSL_do_handshake| to return mid-handshake, so this may require multiple 859| | // iterations. 860| 275k| while (!ssl_can_read(ssl)) { ------------------ | Branch (860:12): [True: 51.1k, False: 224k] ------------------ 861| 51.1k| int ret = SSL_do_handshake(ssl); 862| 51.1k| if (ret < 0) { ------------------ | Branch (862:11): [True: 812, False: 50.3k] ------------------ 863| 812| return ret; 864| 812| } 865| 50.3k| if (ret == 0) { ------------------ | Branch (865:11): [True: 579, False: 49.7k] ------------------ 866| 579| OPENSSL_PUT_ERROR(SSL, SSL_R_SSL_HANDSHAKE_FAILURE); ------------------ | | 361| 579| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 867| 579| return -1; 868| 579| } 869| 50.3k| } 870| | 871| | // Process any buffered post-handshake messages. 872| 224k| SSLMessage msg; 873| 224k| if (ssl->method->get_message(ssl, &msg)) { ------------------ | Branch (873:9): [True: 52.6k, False: 172k] ------------------ 874| | // If we received an interrupt in early read (EndOfEarlyData), loop again 875| | // for the handshake to process it. 876| 52.6k| if (SSL_in_init(ssl)) { ------------------ | Branch (876:11): [True: 0, False: 52.6k] ------------------ 877| 0| ssl->s3->hs->can_early_read = false; 878| 0| continue; 879| 0| } 880| | 881| | // Handle the post-handshake message and try again. 882| 52.6k| if (!ssl_do_post_handshake(ssl, msg)) { ------------------ | Branch (882:11): [True: 36, False: 52.6k] ------------------ 883| 36| ssl_set_read_error(ssl); 884| 36| return -1; 885| 36| } 886| 52.6k| ssl->method->next_message(ssl); 887| 52.6k| continue; // Loop again. We may have begun a new handshake. 888| 52.6k| } 889| | 890| 172k| uint8_t alert = SSL_AD_DECODE_ERROR; ------------------ | | 4382| 172k|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 172k|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 891| 172k| size_t consumed = 0; 892| 172k| auto ret = ssl_open_app_data(ssl, &ssl->s3->pending_app_data, &consumed, 893| 172k| &alert, ssl->s3->read_buffer.span()); 894| 172k| bool retry; 895| 172k| int bio_ret = ssl_handle_open_record(ssl, &retry, ret, consumed, alert); 896| 172k| if (bio_ret <= 0) { ------------------ | Branch (896:9): [True: 313, False: 171k] ------------------ 897| 313| return bio_ret; 898| 313| } 899| 171k| if (!retry) { ------------------ | Branch (899:9): [True: 2.07k, False: 169k] ------------------ 900| 2.07k| assert(!ssl->s3->pending_app_data.empty()); 901| 2.07k| ssl->s3->key_update_count = 0; 902| 2.07k| } 903| 171k| } 904| | 905| 2.20k| return 1; 906| 3.94k|} ssl_lib.cc:_ZN4bsslL19ssl_can_renegotiateEPK6ssl_st: 282| 102k|static bool ssl_can_renegotiate(const SSL *ssl) { 283| 102k| if (ssl->server || SSL_is_dtls(ssl)) { ------------------ | Branch (283:7): [True: 0, False: 102k] | Branch (283:22): [True: 0, False: 102k] ------------------ 284| 0| return false; 285| 0| } 286| | 287| 102k| if (ssl->s3->version != 0 // ------------------ | Branch (287:7): [True: 102k, False: 0] ------------------ 288| 102k| && ssl_protocol_version(ssl) >= TLS1_3_VERSION) { ------------------ | | 545| 102k|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (288:10): [True: 0, False: 102k] ------------------ 289| 0| return false; 290| 0| } 291| | 292| | // The config has already been shed. 293| 102k| if (!ssl->config) { ------------------ | Branch (293:7): [True: 0, False: 102k] ------------------ 294| 0| return false; 295| 0| } 296| | 297| 102k| switch (ssl->renegotiate_mode) { ------------------ | Branch (297:11): [True: 0, False: 102k] ------------------ 298| 0| case ssl_renegotiate_ignore: ------------------ | Branch (298:5): [True: 0, False: 102k] ------------------ 299| 0| case ssl_renegotiate_never: ------------------ | Branch (299:5): [True: 0, False: 102k] ------------------ 300| 0| return false; 301| | 302| 102k| case ssl_renegotiate_freely: ------------------ | Branch (302:5): [True: 102k, False: 0] ------------------ 303| 102k| case ssl_renegotiate_explicit: ------------------ | Branch (303:5): [True: 0, False: 102k] ------------------ 304| 102k| return true; 305| 0| case ssl_renegotiate_once: ------------------ | Branch (305:5): [True: 0, False: 102k] ------------------ 306| 0| return ssl->s3->total_renegotiations == 0; 307| 102k| } 308| | 309| 0| assert(0); 310| 0| return false; 311| 0|} ssl_lib.cc:_ZL15check_group_idsN4bssl4SpanIKtEE: 1815| 2|static bool check_group_ids(Span group_ids) { 1816| 12| for (uint16_t group_id : group_ids) { ------------------ | Branch (1816:26): [True: 12, False: 2] ------------------ 1817| 12| if (ssl_group_id_to_nid(group_id) == NID_undef) { ------------------ | | 43| 12|#define NID_undef 0 ------------------ | Branch (1817:9): [True: 0, False: 12] ------------------ 1818| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_UNSUPPORTED_ELLIPTIC_CURVE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1819| 0| return false; 1820| 0| } 1821| 12| } 1822| 2| return true; 1823| 2|} ssl_lib.cc:_ZL11is_p256_keyP11evp_pkey_st: 2335| 2|static int is_p256_key(EVP_PKEY *private_key) { 2336| 2| const EC_KEY *ec_key = EVP_PKEY_get0_EC_KEY(private_key); 2337| 2| return ec_key != NULL && EC_GROUP_get_curve_name(EC_KEY_get0_group(ec_key)) == ------------------ | Branch (2337:10): [True: 2, False: 0] | Branch (2337:28): [True: 2, False: 0] ------------------ 2338| 2| NID_X9_62_prime256v1; ------------------ | | 1872| 4|#define NID_X9_62_prime256v1 415 ------------------ 2339| 2|} _ZN4bssl25ssl_is_key_type_supportedEi: 35| 2|bool ssl_is_key_type_supported(int key_type) { 36| 2| return key_type == EVP_PKEY_RSA || key_type == EVP_PKEY_EC || ------------------ | | 133| 2|#define EVP_PKEY_RSA NID_rsaEncryption | | ------------------ | | | | 72| 4|#define NID_rsaEncryption 6 | | ------------------ ------------------ return key_type == EVP_PKEY_RSA || key_type == EVP_PKEY_EC || ------------------ | | 136| 0|#define EVP_PKEY_EC NID_X9_62_id_ecPublicKey | | ------------------ | | | | 1844| 2|#define NID_X9_62_id_ecPublicKey 408 | | ------------------ ------------------ | Branch (36:10): [True: 2, False: 0] | Branch (36:38): [True: 0, False: 0] ------------------ 37| 2| key_type == EVP_PKEY_ED25519; ------------------ | | 137| 0|#define EVP_PKEY_ED25519 NID_ED25519 | | ------------------ | | | | 4157| 0|#define NID_ED25519 949 | | ------------------ ------------------ | Branch (37:10): [True: 0, False: 0] ------------------ 38| 2|} _ZN4bssl27ssl_pkey_supports_algorithmEPK6ssl_stP11evp_pkey_sttb: 113| 301k| uint16_t sigalg, bool is_verify) { 114| 301k| const SSL_SIGNATURE_ALGORITHM *alg = get_signature_algorithm(sigalg); 115| 301k| if (alg == NULL || EVP_PKEY_id(pkey) != alg->pkey_type) { ------------------ | Branch (115:7): [True: 0, False: 301k] | Branch (115:22): [True: 84.9k, False: 216k] ------------------ 116| 84.9k| return false; 117| 84.9k| } 118| | 119| | // Ensure the RSA key is large enough for the hash. RSASSA-PSS requires that 120| | // emLen be at least hLen + sLen + 2. Both hLen and sLen are the size of the 121| | // hash in TLS. Reasonable RSA key sizes are large enough for the largest 122| | // defined RSASSA-PSS algorithm, but 1024-bit RSA is slightly too small for 123| | // SHA-512. 1024-bit RSA is sometimes used for test credentials, so check the 124| | // size so that we can fall back to another algorithm in that case. 125| 216k| if (alg->is_rsa_pss && ------------------ | Branch (125:7): [True: 87.4k, False: 128k] ------------------ 126| 216k| (size_t)EVP_PKEY_size(pkey) < 2 * EVP_MD_size(alg->digest_func()) + 2) { ------------------ | Branch (126:7): [True: 1, False: 87.4k] ------------------ 127| 1| return false; 128| 1| } 129| | 130| 216k| if (ssl_protocol_version(ssl) < TLS1_2_VERSION) { ------------------ | | 544| 216k|#define TLS1_2_VERSION 0x0303 ------------------ | Branch (130:7): [True: 985, False: 215k] ------------------ 131| | // TLS 1.0 and 1.1 do not negotiate algorithms and always sign one of two 132| | // hardcoded algorithms. 133| 985| return sigalg == SSL_SIGN_RSA_PKCS1_MD5_SHA1 || ------------------ | | 1151| 1.97k|#define SSL_SIGN_RSA_PKCS1_MD5_SHA1 0xff01 ------------------ | Branch (133:12): [True: 971, False: 14] ------------------ 134| 985| sigalg == SSL_SIGN_ECDSA_SHA1; ------------------ | | 1134| 14|#define SSL_SIGN_ECDSA_SHA1 0x0203 ------------------ | Branch (134:12): [True: 14, False: 0] ------------------ 135| 985| } 136| | 137| | // |SSL_SIGN_RSA_PKCS1_MD5_SHA1| is not a real SignatureScheme for TLS 1.2 and 138| | // higher. It is an internal value we use to represent TLS 1.0/1.1's MD5/SHA1 139| | // concatenation. 140| 215k| if (sigalg == SSL_SIGN_RSA_PKCS1_MD5_SHA1) { ------------------ | | 1151| 215k|#define SSL_SIGN_RSA_PKCS1_MD5_SHA1 0xff01 ------------------ | Branch (140:7): [True: 0, False: 215k] ------------------ 141| 0| return false; 142| 0| } 143| | 144| 215k| if (ssl_protocol_version(ssl) >= TLS1_3_VERSION) { ------------------ | | 545| 215k|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (144:7): [True: 247, False: 214k] ------------------ 145| 247| if (!alg->tls13_ok) { ------------------ | Branch (145:9): [True: 1, False: 246] ------------------ 146| 1| return false; 147| 1| } 148| | 149| 246| bool is_client_sign = ssl->server == is_verify; 150| 246| if (alg->client_only && !is_client_sign) { ------------------ | Branch (150:9): [True: 0, False: 246] | Branch (150:29): [True: 0, False: 0] ------------------ 151| 0| return false; 152| 0| } 153| | 154| | // EC keys have a curve requirement. 155| 246| if (alg->pkey_type == EVP_PKEY_EC && ------------------ | | 136| 246|#define EVP_PKEY_EC NID_X9_62_id_ecPublicKey | | ------------------ | | | | 1844| 492|#define NID_X9_62_id_ecPublicKey 408 | | ------------------ ------------------ | Branch (155:9): [True: 0, False: 246] ------------------ 156| 246| (alg->curve == NID_undef || ------------------ | | 43| 0|#define NID_undef 0 ------------------ | Branch (156:10): [True: 0, False: 0] ------------------ 157| 0| EC_GROUP_get_curve_name( ------------------ | Branch (157:10): [True: 0, False: 0] ------------------ 158| 0| EC_KEY_get0_group(EVP_PKEY_get0_EC_KEY(pkey))) != alg->curve)) { 159| 0| return false; 160| 0| } 161| 214k| } else if (!alg->tls12_ok) { ------------------ | Branch (161:14): [True: 0, False: 214k] ------------------ 162| 0| return false; 163| 0| } 164| | 165| 215k| return true; 166| 215k|} _ZN4bssl20ssl_private_key_signEPNS_13SSL_HANDSHAKEEPhPmmtNS_4SpanIKhEE: 198| 28.0k| uint16_t sigalg, Span in) { 199| 28.0k| SSL *const ssl = hs->ssl; 200| 28.0k| const SSL_CREDENTIAL *const cred = hs->credential.get(); 201| 28.0k| SSL_HANDSHAKE_HINTS *const hints = hs->hints.get(); 202| 28.0k| Array spki; 203| 28.0k| if (hints) { ------------------ | Branch (203:7): [True: 10, False: 28.0k] ------------------ 204| 10| ScopedCBB spki_cbb; 205| 10| if (!CBB_init(spki_cbb.get(), 64) || ------------------ | Branch (205:9): [True: 0, False: 10] ------------------ 206| 10| !EVP_marshal_public_key(spki_cbb.get(), cred->pubkey.get()) || ------------------ | Branch (206:9): [True: 0, False: 10] ------------------ 207| 10| !CBBFinishArray(spki_cbb.get(), &spki)) { ------------------ | Branch (207:9): [True: 0, False: 10] ------------------ 208| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); ------------------ | | 4387| 0|#define SSL_AD_INTERNAL_ERROR TLS1_AD_INTERNAL_ERROR | | ------------------ | | | | 37| 0|#define TLS1_AD_INTERNAL_ERROR 80 | | ------------------ ------------------ 209| 0| return ssl_private_key_failure; 210| 0| } 211| 10| } 212| | 213| | // Replay the signature from handshake hints if available. 214| 28.0k| if (hints && !hs->hints_requested && // ------------------ | Branch (214:7): [True: 10, False: 28.0k] | Branch (214:7): [True: 0, False: 28.0k] | Branch (214:16): [True: 10, False: 0] ------------------ 215| 28.0k| sigalg == hints->signature_algorithm && // ------------------ | Branch (215:7): [True: 0, False: 10] ------------------ 216| 28.0k| in == hints->signature_input && // ------------------ | Branch (216:7): [True: 0, False: 0] ------------------ 217| 28.0k| Span(spki) == hints->signature_spki && // ------------------ | Branch (217:7): [True: 0, False: 0] ------------------ 218| 28.0k| !hints->signature.empty() && // ------------------ | Branch (218:7): [True: 0, False: 0] ------------------ 219| 28.0k| hints->signature.size() <= max_out) { ------------------ | Branch (219:7): [True: 0, False: 0] ------------------ 220| | // Signature algorithm and input both match. Reuse the signature from hints. 221| 0| *out_len = hints->signature.size(); 222| 0| OPENSSL_memcpy(out, hints->signature.data(), hints->signature.size()); 223| 0| return ssl_private_key_success; 224| 0| } 225| | 226| 28.0k| const SSL_PRIVATE_KEY_METHOD *key_method = cred->key_method; 227| 28.0k| EVP_PKEY *privkey = cred->privkey.get(); 228| 28.0k| assert(!hs->can_release_private_key); 229| | 230| 28.0k| if (key_method != NULL) { ------------------ | Branch (230:7): [True: 0, False: 28.0k] ------------------ 231| 0| enum ssl_private_key_result_t ret; 232| 0| if (hs->pending_private_key_op) { ------------------ | Branch (232:9): [True: 0, False: 0] ------------------ 233| 0| ret = key_method->complete(ssl, out, out_len, max_out); 234| 0| } else { 235| 0| ret = key_method->sign(ssl, out, out_len, max_out, sigalg, in.data(), 236| 0| in.size()); 237| 0| } 238| 0| if (ret == ssl_private_key_failure) { ------------------ | Branch (238:9): [True: 0, False: 0] ------------------ 239| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_PRIVATE_KEY_OPERATION_FAILED); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 240| 0| } 241| 0| hs->pending_private_key_op = ret == ssl_private_key_retry; 242| 0| if (ret != ssl_private_key_success) { ------------------ | Branch (242:9): [True: 0, False: 0] ------------------ 243| 0| return ret; 244| 0| } 245| 28.0k| } else { 246| 28.0k| *out_len = max_out; 247| 28.0k| ScopedEVP_MD_CTX ctx; 248| 28.0k| if (!setup_ctx(ssl, ctx.get(), privkey, sigalg, false /* sign */) || ------------------ | Branch (248:9): [True: 0, False: 28.0k] ------------------ 249| 28.0k| !EVP_DigestSign(ctx.get(), out, out_len, in.data(), in.size())) { ------------------ | Branch (249:9): [True: 0, False: 28.0k] ------------------ 250| 0| return ssl_private_key_failure; 251| 0| } 252| 28.0k| } 253| | 254| | // Save the hint if applicable. 255| 28.0k| if (hints && hs->hints_requested) { ------------------ | Branch (255:7): [True: 10, False: 28.0k] | Branch (255:16): [True: 0, False: 10] ------------------ 256| 0| hints->signature_algorithm = sigalg; 257| 0| hints->signature_spki = std::move(spki); 258| 0| if (!hints->signature_input.CopyFrom(in) || ------------------ | Branch (258:9): [True: 0, False: 0] | Branch (258:9): [True: 0, False: 0] ------------------ 259| 0| !hints->signature.CopyFrom(Span(out, *out_len))) { ------------------ | Branch (259:9): [True: 0, False: 0] ------------------ 260| 0| return ssl_private_key_failure; 261| 0| } 262| 0| } 263| 28.0k| return ssl_private_key_success; 264| 28.0k|} _ZN4bssl21ssl_public_key_verifyEP6ssl_stNS_4SpanIKhEEtP11evp_pkey_stS4_: 268| 51.5k| Span in) { 269| 51.5k| ScopedEVP_MD_CTX ctx; 270| 51.5k| if (!setup_ctx(ssl, ctx.get(), pkey, sigalg, true /* verify */)) { ------------------ | Branch (270:7): [True: 0, False: 51.5k] ------------------ 271| 0| return false; 272| 0| } 273| 51.5k| bool ok = EVP_DigestVerify(ctx.get(), signature.data(), signature.size(), 274| 51.5k| in.data(), in.size()); 275| 51.5k| if (CRYPTO_fuzzer_mode_enabled()) { ------------------ | Branch (275:7): [True: 51.5k, False: 0] ------------------ 276| 51.5k| ok = true; 277| 51.5k| ERR_clear_error(); 278| 51.5k| } 279| 51.5k| return ok; 280| 51.5k|} SSL_CTX_use_PrivateKey: 404| 2|int SSL_CTX_use_PrivateKey(SSL_CTX *ctx, EVP_PKEY *pkey) { 405| 2| if (pkey == NULL) { ------------------ | Branch (405:7): [True: 0, False: 2] ------------------ 406| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_PASSED_NULL_PARAMETER); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 407| 0| return 0; 408| 0| } 409| | 410| 2| return SSL_CREDENTIAL_set1_private_key(ctx->cert->legacy_credential.get(), 411| 2| pkey); 412| 2|} ssl_privkey.cc:_ZN4bsslL23get_signature_algorithmEt: 103| 380k|static const SSL_SIGNATURE_ALGORITHM *get_signature_algorithm(uint16_t sigalg) { 104| 2.87M| for (size_t i = 0; i < OPENSSL_ARRAY_SIZE(kSignatureAlgorithms); i++) { ------------------ | | 103| 2.87M|#define OPENSSL_ARRAY_SIZE(array) (sizeof(array) / sizeof((array)[0])) ------------------ | Branch (104:22): [True: 2.87M, False: 0] ------------------ 105| 2.87M| if (kSignatureAlgorithms[i].sigalg == sigalg) { ------------------ | Branch (105:9): [True: 380k, False: 2.49M] ------------------ 106| 380k| return &kSignatureAlgorithms[i]; 107| 380k| } 108| 2.87M| } 109| 0| return NULL; 110| 380k|} ssl_privkey.cc:_ZN4bsslL9setup_ctxEP6ssl_stP13env_md_ctx_stP11evp_pkey_sttb: 169| 79.5k| uint16_t sigalg, bool is_verify) { 170| 79.5k| if (!ssl_pkey_supports_algorithm(ssl, pkey, sigalg, is_verify)) { ------------------ | Branch (170:7): [True: 0, False: 79.5k] ------------------ 171| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_WRONG_SIGNATURE_TYPE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 172| 0| return false; 173| 0| } 174| | 175| 79.5k| const SSL_SIGNATURE_ALGORITHM *alg = get_signature_algorithm(sigalg); 176| 79.5k| const EVP_MD *digest = alg->digest_func != NULL ? alg->digest_func() : NULL; ------------------ | Branch (176:26): [True: 79.5k, False: 0] ------------------ 177| 79.5k| EVP_PKEY_CTX *pctx; 178| 79.5k| if (is_verify) { ------------------ | Branch (178:7): [True: 51.5k, False: 28.0k] ------------------ 179| 51.5k| if (!EVP_DigestVerifyInit(ctx, &pctx, digest, NULL, pkey)) { ------------------ | Branch (179:9): [True: 0, False: 51.5k] ------------------ 180| 0| return false; 181| 0| } 182| 51.5k| } else if (!EVP_DigestSignInit(ctx, &pctx, digest, NULL, pkey)) { ------------------ | Branch (182:14): [True: 0, False: 28.0k] ------------------ 183| 0| return false; 184| 0| } 185| | 186| 79.5k| if (alg->is_rsa_pss) { ------------------ | Branch (186:7): [True: 29.1k, False: 50.4k] ------------------ 187| 29.1k| if (!EVP_PKEY_CTX_set_rsa_padding(pctx, RSA_PKCS1_PSS_PADDING) || ------------------ | | 219| 29.1k|#define RSA_PKCS1_PSS_PADDING 6 ------------------ | Branch (187:9): [True: 0, False: 29.1k] ------------------ 188| 29.1k| !EVP_PKEY_CTX_set_rsa_pss_saltlen(pctx, -1 /* salt len = hash len */)) { ------------------ | Branch (188:9): [True: 0, False: 29.1k] ------------------ 189| 0| return false; 190| 0| } 191| 29.1k| } 192| | 193| 79.5k| return true; 194| 79.5k|} _ZN4bssl15ssl_session_newEPKNS_15SSL_X509_METHODE: 46| 128k|UniquePtr ssl_session_new(const SSL_X509_METHOD *x509_method) { 47| 128k| return MakeUnique(x509_method); 48| 128k|} _ZN4bssl15SSL_SESSION_dupEP14ssl_session_sti: 68| 52.8k|UniquePtr SSL_SESSION_dup(SSL_SESSION *session, int dup_flags) { 69| 52.8k| UniquePtr new_session = ssl_session_new(session->x509_method); 70| 52.8k| if (!new_session) { ------------------ | Branch (70:7): [True: 0, False: 52.8k] ------------------ 71| 0| return nullptr; 72| 0| } 73| | 74| 52.8k| new_session->is_server = session->is_server; 75| 52.8k| new_session->ssl_version = session->ssl_version; 76| 52.8k| new_session->is_quic = session->is_quic; 77| 52.8k| new_session->sid_ctx = session->sid_ctx; 78| | 79| | // Copy the key material. 80| 52.8k| new_session->secret = session->secret; 81| 52.8k| new_session->cipher = session->cipher; 82| | 83| | // Copy authentication state. 84| 52.8k| if (session->psk_identity != nullptr) { ------------------ | Branch (84:7): [True: 0, False: 52.8k] ------------------ 85| 0| new_session->psk_identity.reset( 86| 0| OPENSSL_strdup(session->psk_identity.get())); 87| 0| if (new_session->psk_identity == nullptr) { ------------------ | Branch (87:9): [True: 0, False: 0] ------------------ 88| 0| return nullptr; 89| 0| } 90| 0| } 91| 52.8k| if (session->certs != nullptr) { ------------------ | Branch (91:7): [True: 52.8k, False: 0] ------------------ 92| 52.8k| auto buf_up_ref = [](const CRYPTO_BUFFER *buf) { 93| 52.8k| CRYPTO_BUFFER_up_ref(const_cast(buf)); 94| 52.8k| return const_cast(buf); 95| 52.8k| }; 96| 52.8k| new_session->certs.reset(sk_CRYPTO_BUFFER_deep_copy( 97| 52.8k| session->certs.get(), buf_up_ref, CRYPTO_BUFFER_free)); 98| 52.8k| if (new_session->certs == nullptr) { ------------------ | Branch (98:9): [True: 0, False: 52.8k] ------------------ 99| 0| return nullptr; 100| 0| } 101| 52.8k| } 102| | 103| 52.8k| if (!session->x509_method->session_dup(new_session.get(), session)) { ------------------ | Branch (103:7): [True: 0, False: 52.8k] ------------------ 104| 0| return nullptr; 105| 0| } 106| | 107| 52.8k| new_session->verify_result = session->verify_result; 108| | 109| 52.8k| new_session->ocsp_response = UpRef(session->ocsp_response); 110| 52.8k| new_session->signed_cert_timestamp_list = 111| 52.8k| UpRef(session->signed_cert_timestamp_list); 112| | 113| 52.8k| OPENSSL_memcpy(new_session->peer_sha256, session->peer_sha256, 114| 52.8k| SHA256_DIGEST_LENGTH); ------------------ | | 110| 52.8k|#define SHA256_DIGEST_LENGTH 32 ------------------ 115| 52.8k| new_session->peer_sha256_valid = session->peer_sha256_valid; 116| | 117| 52.8k| new_session->peer_signature_algorithm = session->peer_signature_algorithm; 118| | 119| 52.8k| new_session->timeout = session->timeout; 120| 52.8k| new_session->auth_timeout = session->auth_timeout; 121| 52.8k| new_session->time = session->time; 122| | 123| | // Copy non-authentication connection properties. 124| 52.8k| if (dup_flags & SSL_SESSION_INCLUDE_NONAUTH) { ------------------ | | 3457| 52.8k|#define SSL_SESSION_INCLUDE_NONAUTH 0x2 ------------------ | Branch (124:7): [True: 52.8k, False: 0] ------------------ 125| 52.8k| new_session->session_id = session->session_id; 126| 52.8k| new_session->group_id = session->group_id; 127| 52.8k| new_session->original_handshake_hash = session->original_handshake_hash; 128| 52.8k| new_session->ticket_lifetime_hint = session->ticket_lifetime_hint; 129| 52.8k| new_session->ticket_age_add = session->ticket_age_add; 130| 52.8k| new_session->ticket_max_early_data = session->ticket_max_early_data; 131| 52.8k| new_session->extended_master_secret = session->extended_master_secret; 132| 52.8k| new_session->has_application_settings = session->has_application_settings; 133| | 134| 52.8k| if (!new_session->early_alpn.CopyFrom(session->early_alpn) || ------------------ | Branch (134:9): [True: 0, False: 52.8k] ------------------ 135| 52.8k| !new_session->quic_early_data_context.CopyFrom( ------------------ | Branch (135:9): [True: 0, False: 52.8k] ------------------ 136| 52.8k| session->quic_early_data_context) || 137| 52.8k| !new_session->local_application_settings.CopyFrom( ------------------ | Branch (137:9): [True: 0, False: 52.8k] ------------------ 138| 52.8k| session->local_application_settings) || 139| 52.8k| !new_session->peer_application_settings.CopyFrom( ------------------ | Branch (139:9): [True: 0, False: 52.8k] ------------------ 140| 52.8k| session->peer_application_settings)) { 141| 0| return nullptr; 142| 0| } 143| 52.8k| } 144| | 145| | // Copy the ticket. 146| 52.8k| if (dup_flags & SSL_SESSION_INCLUDE_TICKET && ------------------ | | 3456| 105k|#define SSL_SESSION_INCLUDE_TICKET 0x1 ------------------ | Branch (146:7): [True: 51.3k, False: 1.48k] ------------------ 147| 52.8k| !new_session->ticket.CopyFrom(session->ticket)) { ------------------ | Branch (147:7): [True: 0, False: 51.3k] ------------------ 148| 0| return nullptr; 149| 0| } 150| | 151| | // The new_session does not get a copy of the ex_data. 152| | 153| 52.8k| new_session->not_resumable = true; 154| 52.8k| return new_session; 155| 52.8k|} _ZN4bssl23ssl_session_rebase_timeEP6ssl_stP14ssl_session_st: 157| 52.8k|void ssl_session_rebase_time(SSL *ssl, SSL_SESSION *session) { 158| 52.8k| OPENSSL_timeval now = ssl_ctx_get_current_time(ssl->ctx.get()); 159| | 160| | // To avoid overflows and underflows, if we've gone back in time, update the 161| | // time, but mark the session expired. 162| 52.8k| if (session->time > now.tv_sec) { ------------------ | Branch (162:7): [True: 0, False: 52.8k] ------------------ 163| 0| session->time = now.tv_sec; 164| 0| session->timeout = 0; 165| 0| session->auth_timeout = 0; 166| 0| return; 167| 0| } 168| | 169| | // Adjust the session time and timeouts. If the session has already expired, 170| | // clamp the timeouts at zero. 171| 52.8k| uint64_t delta = now.tv_sec - session->time; 172| 52.8k| session->time = now.tv_sec; 173| 52.8k| if (session->timeout < delta) { ------------------ | Branch (173:7): [True: 0, False: 52.8k] ------------------ 174| 0| session->timeout = 0; 175| 52.8k| } else { 176| 52.8k| session->timeout -= delta; 177| 52.8k| } 178| 52.8k| if (session->auth_timeout < delta) { ------------------ | Branch (178:7): [True: 0, False: 52.8k] ------------------ 179| 0| session->auth_timeout = 0; 180| 52.8k| } else { 181| 52.8k| session->auth_timeout -= delta; 182| 52.8k| } 183| 52.8k|} _ZN4bssl28ssl_session_protocol_versionEPK14ssl_session_st: 201| 61.7k|uint16_t ssl_session_protocol_version(const SSL_SESSION *session) { 202| 61.7k| uint16_t ret; 203| 61.7k| if (!ssl_protocol_version_from_wire(&ret, session->ssl_version)) { ------------------ | Branch (203:7): [True: 0, False: 61.7k] ------------------ 204| | // An |SSL_SESSION| will never have an invalid version. This is enforced by 205| | // the parser. 206| 0| assert(0); 207| 0| return 0; 208| 0| } 209| | 210| 61.7k| return ret; 211| 61.7k|} _ZN4bssl22ssl_session_get_digestEPK14ssl_session_st: 213| 54.6k|const EVP_MD *ssl_session_get_digest(const SSL_SESSION *session) { 214| 54.6k| return ssl_get_handshake_digest(ssl_session_protocol_version(session), 215| 54.6k| session->cipher); 216| 54.6k|} _ZN4bssl19ssl_get_new_sessionEPNS_13SSL_HANDSHAKEE: 218| 55.0k|bool ssl_get_new_session(SSL_HANDSHAKE *hs) { 219| 55.0k| SSL *const ssl = hs->ssl; 220| 55.0k| if (ssl->mode & SSL_MODE_NO_SESSION_CREATION) { ------------------ | | 691| 55.0k|#define SSL_MODE_NO_SESSION_CREATION 0x00000200L ------------------ | Branch (220:7): [True: 0, False: 55.0k] ------------------ 221| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_SESSION_MAY_NOT_BE_CREATED); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 222| 0| return false; 223| 0| } 224| | 225| 55.0k| UniquePtr session = ssl_session_new(ssl->ctx->x509_method); 226| 55.0k| if (session == NULL) { ------------------ | Branch (226:7): [True: 0, False: 55.0k] ------------------ 227| 0| return false; 228| 0| } 229| | 230| 55.0k| session->is_server = ssl->server; 231| 55.0k| session->ssl_version = ssl->s3->version; 232| 55.0k| session->is_quic = SSL_is_quic(ssl); 233| | 234| | // Fill in the time from the |SSL_CTX|'s clock. 235| 55.0k| OPENSSL_timeval now = ssl_ctx_get_current_time(ssl->ctx.get()); 236| 55.0k| session->time = now.tv_sec; 237| | 238| 55.0k| uint16_t version = ssl_protocol_version(ssl); 239| 55.0k| if (version >= TLS1_3_VERSION) { ------------------ | | 545| 55.0k|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (239:7): [True: 255, False: 54.7k] ------------------ 240| | // TLS 1.3 uses tickets as authenticators, so we are willing to use them for 241| | // longer. 242| 255| session->timeout = ssl->session_ctx->session_psk_dhe_timeout; 243| 255| session->auth_timeout = SSL_DEFAULT_SESSION_AUTH_TIMEOUT; ------------------ | | 2176| 255|#define SSL_DEFAULT_SESSION_AUTH_TIMEOUT (7 * 24 * 60 * 60) ------------------ 244| 54.7k| } else { 245| | // TLS 1.2 resumption does not incorporate new key material, so we use a 246| | // much shorter timeout. 247| 54.7k| session->timeout = ssl->session_ctx->session_timeout; 248| 54.7k| session->auth_timeout = ssl->session_ctx->session_timeout; 249| 54.7k| } 250| | 251| 55.0k| if (!session->sid_ctx.TryCopyFrom(hs->config->cert->sid_ctx)) { ------------------ | Branch (251:7): [True: 0, False: 55.0k] ------------------ 252| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 253| 0| return false; 254| 0| } 255| | 256| | // The session is marked not resumable until it is completely filled in. 257| 55.0k| session->not_resumable = true; 258| 55.0k| session->verify_result = X509_V_ERR_INVALID_CALL; ------------------ | | 3071| 55.0k|#define X509_V_ERR_INVALID_CALL 65 ------------------ 259| | 260| 55.0k| hs->new_session = std::move(session); 261| 55.0k| ssl_set_session(ssl, NULL); 262| 55.0k| return true; 263| 55.0k|} _ZN4bssl20ssl_session_get_typeEPK14ssl_session_st: 444| 55.2k|SSLSessionType ssl_session_get_type(const SSL_SESSION *session) { 445| 55.2k| if (session->not_resumable) { ------------------ | Branch (445:7): [True: 49.7k, False: 5.53k] ------------------ 446| 49.7k| return SSLSessionType::kNotResumable; 447| 49.7k| } 448| 5.53k| if (ssl_session_protocol_version(session) >= TLS1_3_VERSION) { ------------------ | | 545| 5.53k|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (448:7): [True: 351, False: 5.18k] ------------------ 449| 351| return session->ticket.empty() ? SSLSessionType::kNotResumable ------------------ | Branch (449:12): [True: 161, False: 190] ------------------ 450| 351| : SSLSessionType::kPreSharedKey; 451| 351| } 452| 5.18k| if (!session->ticket.empty()) { ------------------ | Branch (452:7): [True: 1.63k, False: 3.54k] ------------------ 453| 1.63k| return SSLSessionType::kTicket; 454| 1.63k| } 455| 3.54k| if (!session->session_id.empty()) { ------------------ | Branch (455:7): [True: 3.54k, False: 6] ------------------ 456| 3.54k| return SSLSessionType::kID; 457| 3.54k| } 458| 6| return SSLSessionType::kNotResumable; 459| 3.54k|} _ZN4bssl28ssl_session_is_context_validEPKNS_13SSL_HANDSHAKEEPK14ssl_session_st: 462| 231| const SSL_SESSION *session) { 463| 231| return session != nullptr && ------------------ | Branch (463:10): [True: 231, False: 0] ------------------ 464| 231| Span(session->sid_ctx) == hs->config->cert->sid_ctx; ------------------ | Branch (464:10): [True: 231, False: 0] ------------------ 465| 231|} _ZN4bssl25ssl_session_is_time_validEPK6ssl_stPK14ssl_session_st: 467| 828|bool ssl_session_is_time_valid(const SSL *ssl, const SSL_SESSION *session) { 468| 828| if (session == NULL) { ------------------ | Branch (468:7): [True: 0, False: 828] ------------------ 469| 0| return false; 470| 0| } 471| | 472| 828| OPENSSL_timeval now = ssl_ctx_get_current_time(ssl->ctx.get()); 473| | 474| | // Reject tickets from the future to avoid underflow. 475| 828| if (now.tv_sec < session->time) { ------------------ | Branch (475:7): [True: 3, False: 825] ------------------ 476| 3| return false; 477| 3| } 478| | 479| 825| return session->timeout > now.tv_sec - session->time; 480| 828|} _ZN4bssl15ssl_set_sessionEP6ssl_stP14ssl_session_st: 658| 128k|void ssl_set_session(SSL *ssl, SSL_SESSION *session) { 659| 128k| if (ssl->session.get() == session) { ------------------ | Branch (659:7): [True: 109k, False: 19.0k] ------------------ 660| 109k| return; 661| 109k| } 662| | 663| 19.0k| ssl->session = UpRef(session); 664| 19.0k|} _ZN4bssl16ssl_update_cacheEP6ssl_st: 758| 51.3k|void ssl_update_cache(SSL *ssl) { 759| 51.3k| SSL_CTX *ctx = ssl->session_ctx.get(); 760| 51.3k| SSL_SESSION *session = ssl->s3->established_session.get(); 761| 51.3k| int mode = SSL_is_server(ssl) ? SSL_SESS_CACHE_SERVER : SSL_SESS_CACHE_CLIENT; ------------------ | | 2122| 0|#define SSL_SESS_CACHE_SERVER 0x0002 ------------------ int mode = SSL_is_server(ssl) ? SSL_SESS_CACHE_SERVER : SSL_SESS_CACHE_CLIENT; ------------------ | | 2119| 51.3k|#define SSL_SESS_CACHE_CLIENT 0x0001 ------------------ | Branch (761:14): [True: 0, False: 51.3k] ------------------ 762| 51.3k| if (!SSL_SESSION_is_resumable(session) || ------------------ | Branch (762:7): [True: 49.8k, False: 1.44k] ------------------ 763| 51.3k| (ctx->session_cache_mode & mode) != mode) { ------------------ | Branch (763:7): [True: 1.44k, False: 0] ------------------ 764| 51.3k| return; 765| 51.3k| } 766| | 767| | // Clients never use the internal session cache. 768| 0| if (ssl->server && ------------------ | Branch (768:7): [True: 0, False: 0] ------------------ 769| 0| !(ctx->session_cache_mode & SSL_SESS_CACHE_NO_INTERNAL_STORE)) { ------------------ | | 2137| 0|#define SSL_SESS_CACHE_NO_INTERNAL_STORE 0x0200 ------------------ | Branch (769:7): [True: 0, False: 0] ------------------ 770| 0| UniquePtr ref = UpRef(session); 771| 0| bool remove_expired_sessions = false; 772| 0| { 773| 0| MutexWriteLock lock(&ctx->lock); 774| 0| add_session_locked(ctx, std::move(ref)); 775| | 776| 0| if (!(ctx->session_cache_mode & SSL_SESS_CACHE_NO_AUTO_CLEAR)) { ------------------ | | 2129| 0|#define SSL_SESS_CACHE_NO_AUTO_CLEAR 0x0080 ------------------ | Branch (776:11): [True: 0, False: 0] ------------------ 777| | // Automatically flush the internal session cache every 255 connections. 778| 0| ctx->handshakes_since_cache_flush++; 779| 0| if (ctx->handshakes_since_cache_flush >= 255) { ------------------ | Branch (779:13): [True: 0, False: 0] ------------------ 780| 0| remove_expired_sessions = true; 781| 0| ctx->handshakes_since_cache_flush = 0; 782| 0| } 783| 0| } 784| 0| } 785| | 786| 0| if (remove_expired_sessions) { ------------------ | Branch (786:9): [True: 0, False: 0] ------------------ 787| | // |SSL_CTX_flush_sessions| takes the lock we just released. We could 788| | // merge the critical sections, but we'd then call user code under a 789| | // lock, or compute |now| earlier, even when not flushing. 790| 0| OPENSSL_timeval now = ssl_ctx_get_current_time(ssl->ctx.get()); 791| 0| SSL_CTX_flush_sessions(ctx, now.tv_sec); 792| 0| } 793| 0| } 794| | 795| 0| if (ctx->new_session_cb != nullptr) { ------------------ | Branch (795:7): [True: 0, False: 0] ------------------ 796| 0| UniquePtr ref = UpRef(session); 797| 0| if (ctx->new_session_cb(ssl, ref.get())) { ------------------ | Branch (797:9): [True: 0, False: 0] ------------------ 798| | // |new_session_cb|'s return value signals whether it took ownership. 799| 0| ref.release(); 800| 0| } 801| 0| } 802| 0|} _ZN14ssl_session_stC2EPKN4bssl15SSL_X509_METHODE: 809| 128k| : RefCounted(CheckSubClass()), 810| 128k| x509_method(method), 811| 128k| extended_master_secret(false), 812| 128k| peer_sha256_valid(false), 813| 128k| not_resumable(false), 814| 128k| ticket_age_add_valid(false), 815| 128k| is_server(false), 816| 128k| is_quic(false), 817| 128k| has_application_settings(false), 818| 128k| is_resumable_across_names(false) { 819| 128k| CRYPTO_new_ex_data(&ex_data); 820| 128k| time = ::time(nullptr); 821| 128k|} _ZN14ssl_session_stD2Ev: 823| 128k|ssl_session_st::~ssl_session_st() { 824| 128k| CRYPTO_free_ex_data(&g_ex_data_class, &ex_data); 825| 128k| x509_method->session_clear(this); 826| 128k|} SSL_SESSION_up_ref: 832| 18.6k|int SSL_SESSION_up_ref(SSL_SESSION *session) { 833| 18.6k| session->UpRefInternal(); 834| 18.6k| return 1; 835| 18.6k|} SSL_SESSION_free: 837| 147k|void SSL_SESSION_free(SSL_SESSION *session) { 838| 147k| if (session == nullptr) { ------------------ | Branch (838:7): [True: 0, False: 147k] ------------------ 839| 0| return; 840| 0| } 841| 147k| session->DecRefInternal(); 842| 147k|} SSL_SESSION_is_resumable: 959| 51.3k|int SSL_SESSION_is_resumable(const SSL_SESSION *session) { 960| 51.3k| return ssl_session_get_type(session) != SSLSessionType::kNotResumable; 961| 51.3k|} SSL_get_session: 1034| 2|SSL_SESSION *SSL_get_session(const SSL *ssl) { 1035| | // Once the initially handshake completes, we return the most recently 1036| | // established session. In particular, if there is a pending renegotiation, we 1037| | // do not return information about it until it completes. 1038| | // 1039| | // Code in the handshake must either use |hs->new_session| (if updating a 1040| | // partial session) or |ssl_handshake_session| (if trying to query properties 1041| | // consistently across TLS 1.2 resumption and other handshakes). 1042| 2| if (ssl->s3->established_session != nullptr) { ------------------ | Branch (1042:7): [True: 2, False: 0] ------------------ 1043| 2| return ssl->s3->established_session.get(); 1044| 2| } 1045| | 1046| | // Otherwise, we must be in the initial handshake. 1047| 0| SSL_HANDSHAKE *hs = ssl->s3->hs.get(); 1048| 0| assert(hs != nullptr); 1049| 0| assert(!ssl->s3->initial_handshake_complete); 1050| | 1051| | // Return the 0-RTT session, if in the 0-RTT state. While the handshake has 1052| | // not actually completed, the public accessors all report properties as if 1053| | // it has. 1054| 0| if (hs->early_session) { ------------------ | Branch (1054:7): [True: 0, False: 0] ------------------ 1055| 0| return hs->early_session.get(); 1056| 0| } 1057| | 1058| | // Otherwise, return the partial session. 1059| 0| return (SSL_SESSION *)ssl_handshake_session(hs); 1060| 0|} SSL_set_session: 1095| 18.5k|int SSL_set_session(SSL *ssl, SSL_SESSION *session) { 1096| | // SSL_set_session may only be called before the handshake has started. 1097| 18.5k| if (ssl->s3->initial_handshake_complete || // ------------------ | Branch (1097:7): [True: 0, False: 18.5k] ------------------ 1098| 18.5k| ssl->s3->hs == NULL || // ------------------ | Branch (1098:7): [True: 0, False: 18.5k] ------------------ 1099| 18.5k| ssl->s3->hs->state != 0) { ------------------ | Branch (1099:7): [True: 0, False: 18.5k] ------------------ 1100| 0| abort(); 1101| 0| } 1102| | 1103| 18.5k| ssl_set_session(ssl, session); 1104| 18.5k| return 1; 1105| 18.5k|} SSL_CTX_flush_sessions: 1158| 9.52k|void SSL_CTX_flush_sessions(SSL_CTX *ctx, uint64_t time) { 1159| 9.52k| TIMEOUT_PARAM tp; 1160| | 1161| 9.52k| tp.ctx = ctx; 1162| 9.52k| tp.cache = ctx->sessions; 1163| 9.52k| if (tp.cache == NULL) { ------------------ | Branch (1163:7): [True: 0, False: 9.52k] ------------------ 1164| 0| return; 1165| 0| } 1166| 9.52k| tp.time = time; 1167| 9.52k| MutexWriteLock lock(&ctx->lock); 1168| 9.52k| lh_SSL_SESSION_doall_arg(tp.cache, timeout_doall_arg, &tp); 1169| 9.52k|} ssl_session.cc:_ZZN4bssl15SSL_SESSION_dupEP14ssl_session_stiENK3$_0clEPK16crypto_buffer_st: 92| 52.8k| auto buf_up_ref = [](const CRYPTO_BUFFER *buf) { 93| 52.8k| CRYPTO_BUFFER_up_ref(const_cast(buf)); 94| 52.8k| return const_cast(buf); 95| 52.8k| }; _ZN4bssl13SSLTranscriptC2Eb: 29| 142k|SSLTranscript::SSLTranscript(bool is_dtls) : is_dtls_(is_dtls) {} _ZN4bssl13SSLTranscriptD2Ev: 31| 142k|SSLTranscript::~SSLTranscript() {} _ZN4bssl13SSLTranscript4InitEv: 33| 71.0k|bool SSLTranscript::Init() { 34| 71.0k| buffer_.reset(BUF_MEM_new()); 35| 71.0k| if (!buffer_) { ------------------ | Branch (35:7): [True: 0, False: 71.0k] ------------------ 36| 0| return false; 37| 0| } 38| | 39| 71.0k| hash_.Reset(); 40| 71.0k| return true; 41| 71.0k|} _ZN4bssl13SSLTranscript8InitHashEtPK13ssl_cipher_st: 43| 55.6k|bool SSLTranscript::InitHash(uint16_t version, const SSL_CIPHER *cipher) { 44| 55.6k| version_ = version; 45| 55.6k| const EVP_MD *md = ssl_get_handshake_digest(version, cipher); 46| 55.6k| if (Digest() == md) { ------------------ | Branch (46:7): [True: 255, False: 55.4k] ------------------ 47| | // No need to re-hash the buffer. 48| 255| return true; 49| 255| } 50| 55.4k| if (!HashBuffer(hash_.get(), md)) { ------------------ | Branch (50:7): [True: 0, False: 55.4k] ------------------ 51| 0| return false; 52| 0| } 53| 55.4k| if (is_dtls_ && version_ >= TLS1_3_VERSION) { ------------------ | | 545| 0|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (53:7): [True: 0, False: 55.4k] | Branch (53:19): [True: 0, False: 0] ------------------ 54| | // In DTLS 1.3, prior to the call to InitHash, the message (if present) in 55| | // the buffer has the DTLS 1.2 header. After the call to InitHash, the TLS 56| | // 1.3 header is written by SSLTranscript::Update. If the buffer isn't freed 57| | // here, it would have a mix of different header formats and using it would 58| | // yield wrong results. However, there's no need for the buffer once the 59| | // version and the digest for the cipher suite are known, so the buffer is 60| | // freed here to avoid potential misuse of the SSLTranscript object. 61| 0| FreeBuffer(); 62| 0| } 63| 55.4k| return true; 64| 55.4k|} _ZNK4bssl13SSLTranscript10HashBufferEP13env_md_ctx_stPK9env_md_st: 66| 55.4k|bool SSLTranscript::HashBuffer(EVP_MD_CTX *ctx, const EVP_MD *digest) const { 67| 55.4k| if (!EVP_DigestInit_ex(ctx, digest, nullptr)) { ------------------ | Branch (67:7): [True: 0, False: 55.4k] ------------------ 68| 0| return false; 69| 0| } 70| 55.4k| if (!is_dtls_ || version_ < TLS1_3_VERSION) { ------------------ | | 545| 0|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (70:7): [True: 55.4k, False: 0] | Branch (70:20): [True: 0, False: 0] ------------------ 71| 55.4k| return EVP_DigestUpdate(ctx, buffer_->data, buffer_->length); 72| 55.4k| } 73| | 74| | // If the version is DTLS 1.3 and we still have a buffer, then there should be 75| | // at most a single DTLSHandshake message in the buffer, for the ClientHello. 76| | // On the server side, the version (DTLS 1.3) and cipher suite are chosen in 77| | // response to the first ClientHello, and InitHash is called before that 78| | // ClientHello is added to the SSLTranscript, so the buffer is empty if this 79| | // SSLTranscript is on the server. 80| 0| if (buffer_->length == 0) { ------------------ | Branch (80:7): [True: 0, False: 0] ------------------ 81| 0| return true; 82| 0| } 83| | 84| | // On the client side, we can receive either a ServerHello or 85| | // HelloRetryRequest in response to the ClientHello. Regardless of which 86| | // message we receive, the client code calls InitHash before updating the 87| | // transcript with that message, so the ClientHello is the only message in the 88| | // buffer. In DTLS 1.3, we need to skip the message_seq, fragment_offset, and 89| | // fragment_length fields from the DTLSHandshake message in the buffer. The 90| | // structure of a DTLSHandshake message is as follows (RFC 9147, section 5.2): 91| | // 92| | // struct { 93| | // HandshakeType msg_type; /* handshake type */ 94| | // uint24 length; /* bytes in message */ 95| | // uint16 message_seq; /* DTLS-required field */ 96| | // uint24 fragment_offset; /* DTLS-required field */ 97| | // uint24 fragment_length; /* DTLS-required field */ 98| | // select (msg_type) { 99| | // /* omitted for brevity */ 100| | // } body; 101| | // } DTLSHandshake; 102| 0| CBS buf, header; 103| 0| CBS_init(&buf, reinterpret_cast(buffer_->data), buffer_->length); 104| 0| if (!CBS_get_bytes(&buf, &header, 4) || // ------------------ | Branch (104:7): [True: 0, False: 0] ------------------ 105| 0| !CBS_skip(&buf, 8) || // ------------------ | Branch (105:7): [True: 0, False: 0] ------------------ 106| 0| !EVP_DigestUpdate(ctx, CBS_data(&header), CBS_len(&header)) || // ------------------ | Branch (106:7): [True: 0, False: 0] ------------------ 107| 0| !EVP_DigestUpdate(ctx, CBS_data(&buf), CBS_len(&buf))) { ------------------ | Branch (107:7): [True: 0, False: 0] ------------------ 108| 0| return false; 109| 0| } 110| 0| return true; 111| 0|} _ZN4bssl13SSLTranscript10FreeBufferEv: 113| 52.6k|void SSLTranscript::FreeBuffer() { buffer_.reset(); } _ZNK4bssl13SSLTranscript9DigestLenEv: 115| 53.3k|size_t SSLTranscript::DigestLen() const { return EVP_MD_size(Digest()); } _ZNK4bssl13SSLTranscript6DigestEv: 117| 267k|const EVP_MD *SSLTranscript::Digest() const { 118| 267k| return EVP_MD_CTX_get0_md(hash_.get()); 119| 267k|} _ZN4bssl13SSLTranscript26UpdateForHelloRetryRequestEv: 121| 115|bool SSLTranscript::UpdateForHelloRetryRequest() { 122| 115| if (buffer_) { ------------------ | Branch (122:7): [True: 115, False: 0] ------------------ 123| 115| buffer_->length = 0; 124| 115| } 125| | 126| 115| uint8_t old_hash[EVP_MAX_MD_SIZE]; 127| 115| size_t hash_len; 128| 115| if (!GetHash(old_hash, &hash_len)) { ------------------ | Branch (128:7): [True: 0, False: 115] ------------------ 129| 0| return false; 130| 0| } 131| 115| const uint8_t header[4] = {SSL3_MT_MESSAGE_HASH, 0, 0, ------------------ | | 213| 115|#define SSL3_MT_MESSAGE_HASH 254 ------------------ 132| 115| static_cast(hash_len)}; 133| 115| if (!EVP_DigestInit_ex(hash_.get(), Digest(), nullptr) || ------------------ | Branch (133:7): [True: 0, False: 115] | Branch (133:7): [True: 0, False: 115] ------------------ 134| 115| !AddToBufferOrHash(header) || ------------------ | Branch (134:7): [True: 0, False: 115] ------------------ 135| 115| !AddToBufferOrHash(Span(old_hash, hash_len))) { ------------------ | Branch (135:7): [True: 0, False: 115] ------------------ 136| 0| return false; 137| 0| } 138| 115| return true; 139| 115|} _ZNK4bssl13SSLTranscript17CopyToHashContextEP13env_md_ctx_stPK9env_md_st: 142| 47| const EVP_MD *digest) const { 143| 47| const EVP_MD *transcript_digest = Digest(); 144| 47| if (transcript_digest != nullptr && ------------------ | Branch (144:7): [True: 0, False: 47] ------------------ 145| 47| EVP_MD_type(transcript_digest) == EVP_MD_type(digest)) { ------------------ | Branch (145:7): [True: 0, False: 0] ------------------ 146| 0| return EVP_MD_CTX_copy_ex(ctx, hash_.get()); 147| 0| } 148| | 149| 47| if (buffer_) { ------------------ | Branch (149:7): [True: 47, False: 0] ------------------ 150| 47| return HashBuffer(ctx, digest); 151| 47| } 152| | 153| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 154| 0| return false; 155| 47|} _ZN4bssl13SSLTranscript6UpdateENS_4SpanIKhEE: 157| 563k|bool SSLTranscript::Update(Span in) { 158| 563k| if (!is_dtls_ || version_ < TLS1_3_VERSION) { ------------------ | | 545| 0|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (158:7): [True: 563k, False: 0] | Branch (158:20): [True: 0, False: 0] ------------------ 159| 563k| return AddToBufferOrHash(in); 160| 563k| } 161| 0| if (in.size() < DTLS1_HM_HEADER_LENGTH) { ------------------ | | 2888| 0|#define DTLS1_HM_HEADER_LENGTH 12 ------------------ | Branch (161:7): [True: 0, False: 0] ------------------ 162| 0| return false; 163| 0| } 164| | // The message passed into Update is the whole Handshake or DTLSHandshake 165| | // message, including the msg_type and length. In DTLS, the DTLSHandshake 166| | // message also has message_seq, fragment_offset, and fragment_length 167| | // fields. In DTLS 1.3, those fields are omitted so that the same 168| | // transcript format as TLS 1.3 is used. This means we write the 1-byte 169| | // msg_type, 3-byte length, then skip 2+3+3 bytes for the DTLS-specific 170| | // fields that get omitted. 171| 0| if (!AddToBufferOrHash(in.subspan(0, 4)) || ------------------ | Branch (171:7): [True: 0, False: 0] ------------------ 172| 0| !AddToBufferOrHash(in.subspan(12))) { ------------------ | Branch (172:7): [True: 0, False: 0] ------------------ 173| 0| return false; 174| 0| } 175| 0| return true; 176| 0|} _ZN4bssl13SSLTranscript17AddToBufferOrHashENS_4SpanIKhEE: 178| 563k|bool SSLTranscript::AddToBufferOrHash(Span in) { 179| | // Depending on the state of the handshake, either the handshake buffer may be 180| | // active, the rolling hash, or both. 181| 563k| if (buffer_ && // ------------------ | Branch (181:7): [True: 358k, False: 204k] ------------------ 182| 563k| !BUF_MEM_append(buffer_.get(), in.data(), in.size())) { ------------------ | Branch (182:7): [True: 0, False: 358k] ------------------ 183| 0| return false; 184| 0| } 185| | 186| 563k| if (EVP_MD_CTX_md(hash_.get()) != NULL) { ------------------ | Branch (186:7): [True: 506k, False: 56.3k] ------------------ 187| 506k| EVP_DigestUpdate(hash_.get(), in.data(), in.size()); 188| 506k| } 189| | 190| 563k| return true; 191| 563k|} _ZNK4bssl13SSLTranscript7GetHashEPhPm: 193| 209k|bool SSLTranscript::GetHash(uint8_t *out, size_t *out_len) const { 194| 209k| ScopedEVP_MD_CTX ctx; 195| 209k| unsigned len; 196| 209k| if (!EVP_MD_CTX_copy_ex(ctx.get(), hash_.get()) || ------------------ | Branch (196:7): [True: 0, False: 209k] ------------------ 197| 209k| !EVP_DigestFinal_ex(ctx.get(), out, &len)) { ------------------ | Branch (197:7): [True: 0, False: 209k] ------------------ 198| 0| return false; 199| 0| } 200| 209k| *out_len = len; 201| 209k| return true; 202| 209k|} _ZNK4bssl13SSLTranscript14GetFinishedMACEPhPmPK14ssl_session_stb: 206| 103k| bool from_server) const { 207| 103k| uint8_t digest[EVP_MAX_MD_SIZE]; 208| 103k| size_t digest_len; 209| 103k| if (!GetHash(digest, &digest_len)) { ------------------ | Branch (209:7): [True: 0, False: 103k] ------------------ 210| 0| return false; 211| 0| } 212| | 213| 103k| std::string_view label = from_server ? "server finished" : "client finished"; ------------------ | Branch (213:28): [True: 51.3k, False: 52.2k] ------------------ 214| 103k| static const size_t kFinishedLen = 12; 215| 103k| if (!tls1_prf(Digest(), Span(out, kFinishedLen), session->secret, label, ------------------ | Branch (215:7): [True: 0, False: 103k] ------------------ 216| 103k| Span(digest, digest_len), {})) { 217| 0| return false; 218| 0| } 219| | 220| 103k| *out_len = kFinishedLen; 221| 103k| return true; 222| 103k|} _ZN4bssl30ssl_protocol_version_from_wireEPtt: 31| 4.94M|bool ssl_protocol_version_from_wire(uint16_t *out, uint16_t version) { 32| 4.94M| switch (version) { 33| 235k| case TLS1_VERSION: ------------------ | | 542| 235k|#define TLS1_VERSION 0x0301 ------------------ | Branch (33:5): [True: 235k, False: 4.70M] ------------------ 34| 352k| case TLS1_1_VERSION: ------------------ | | 543| 352k|#define TLS1_1_VERSION 0x0302 ------------------ | Branch (34:5): [True: 116k, False: 4.82M] ------------------ 35| 4.73M| case TLS1_2_VERSION: ------------------ | | 544| 4.73M|#define TLS1_2_VERSION 0x0303 ------------------ | Branch (35:5): [True: 4.37M, False: 563k] ------------------ 36| 4.93M| case TLS1_3_VERSION: ------------------ | | 545| 4.93M|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (36:5): [True: 199k, False: 4.74M] ------------------ 37| 4.93M| *out = version; 38| 4.93M| return true; 39| | 40| 511| case DTLS1_VERSION: ------------------ | | 547| 511|#define DTLS1_VERSION 0xfeff ------------------ | Branch (40:5): [True: 511, False: 4.94M] ------------------ 41| | // DTLS 1.0 is analogous to TLS 1.1, not TLS 1.0. 42| 511| *out = TLS1_1_VERSION; ------------------ | | 543| 511|#define TLS1_1_VERSION 0x0302 ------------------ 43| 511| return true; 44| | 45| 10.8k| case DTLS1_2_VERSION: ------------------ | | 548| 10.8k|#define DTLS1_2_VERSION 0xfefd ------------------ | Branch (45:5): [True: 10.8k, False: 4.93M] ------------------ 46| 10.8k| *out = TLS1_2_VERSION; ------------------ | | 544| 10.8k|#define TLS1_2_VERSION 0x0303 ------------------ 47| 10.8k| return true; 48| | 49| 15| case DTLS1_3_VERSION: ------------------ | | 549| 15|#define DTLS1_3_VERSION 0xfefc ------------------ | Branch (49:5): [True: 15, False: 4.94M] ------------------ 50| 15| *out = TLS1_3_VERSION; ------------------ | | 545| 15|#define TLS1_3_VERSION 0x0304 ------------------ 51| 15| return true; 52| | 53| 52| default: ------------------ | Branch (53:5): [True: 52, False: 4.94M] ------------------ 54| 52| return false; 55| 4.94M| } 56| 4.94M|} _ZN4bssl27ssl_method_supports_versionEPKNS_19SSL_PROTOCOL_METHODEt: 81| 282k| uint16_t version) { 82| 679k| for (uint16_t supported : get_method_versions(method)) { ------------------ | Branch (82:27): [True: 679k, False: 77] ------------------ 83| 679k| if (supported == version) { ------------------ | Branch (83:9): [True: 282k, False: 397k] ------------------ 84| 282k| return true; 85| 282k| } 86| 679k| } 87| 77| return false; 88| 282k|} _ZN4bssl21ssl_get_version_rangeEPKNS_13SSL_HANDSHAKEEPtS3_: 180| 56.3k| uint16_t *out_max_version) { 181| | // For historical reasons, |SSL_OP_NO_DTLSv1| aliases |SSL_OP_NO_TLSv1|, but 182| | // DTLS 1.0 should be mapped to TLS 1.1. 183| 56.3k| uint32_t options = hs->ssl->options; 184| 56.3k| if (SSL_is_dtls(hs->ssl)) { ------------------ | Branch (184:7): [True: 0, False: 56.3k] ------------------ 185| 0| options &= ~SSL_OP_NO_TLSv1_1; ------------------ | | 614| 0|#define SSL_OP_NO_TLSv1_1 0x10000000L ------------------ 186| 0| if (options & SSL_OP_NO_DTLSv1) { ------------------ | | 616| 0|#define SSL_OP_NO_DTLSv1 SSL_OP_NO_TLSv1 | | ------------------ | | | | 612| 0|#define SSL_OP_NO_TLSv1 0x04000000L | | ------------------ ------------------ | Branch (186:9): [True: 0, False: 0] ------------------ 187| 0| options |= SSL_OP_NO_TLSv1_1; ------------------ | | 614| 0|#define SSL_OP_NO_TLSv1_1 0x10000000L ------------------ 188| 0| } 189| 0| } 190| | 191| 56.3k| uint16_t min_version, max_version; 192| 56.3k| if (!ssl_protocol_version_from_wire(&min_version, ------------------ | Branch (192:7): [True: 0, False: 56.3k] ------------------ 193| 56.3k| hs->config->conf_min_version) || 194| 56.3k| !ssl_protocol_version_from_wire(&max_version, ------------------ | Branch (194:7): [True: 0, False: 56.3k] ------------------ 195| 56.3k| hs->config->conf_max_version)) { 196| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 197| 0| return false; 198| 0| } 199| | 200| | // QUIC requires TLS 1.3. 201| 56.3k| if (SSL_is_quic(hs->ssl) && min_version < TLS1_3_VERSION) { ------------------ | | 545| 0|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (201:7): [True: 0, False: 56.3k] | Branch (201:31): [True: 0, False: 0] ------------------ 202| 0| min_version = TLS1_3_VERSION; ------------------ | | 545| 0|#define TLS1_3_VERSION 0x0304 ------------------ 203| 0| } 204| | 205| | // The |SSL_OP_NO_*| flags disable individual protocols. This has two 206| | // problems. First, prior to TLS 1.3, the protocol can only express a 207| | // contiguous range of versions. Second, a library consumer trying to set a 208| | // maximum version cannot disable protocol versions that get added in a future 209| | // version of the library. 210| | // 211| | // To account for both of these, OpenSSL interprets the client-side bitmask 212| | // as a min/max range by picking the lowest contiguous non-empty range of 213| | // enabled protocols. Note that this means it is impossible to set a maximum 214| | // version of the higest supported TLS version in a future-proof way. 215| 56.3k| bool any_enabled = false; 216| 281k| for (size_t i = 0; i < OPENSSL_ARRAY_SIZE(kProtocolVersions); i++) { ------------------ | | 103| 281k|#define OPENSSL_ARRAY_SIZE(array) (sizeof(array) / sizeof((array)[0])) ------------------ | Branch (216:22): [True: 225k, False: 56.3k] ------------------ 217| | // Only look at the versions already enabled. 218| 225k| if (min_version > kProtocolVersions[i].version) { ------------------ | Branch (218:9): [True: 0, False: 225k] ------------------ 219| 0| continue; 220| 0| } 221| 225k| if (max_version < kProtocolVersions[i].version) { ------------------ | Branch (221:9): [True: 0, False: 225k] ------------------ 222| 0| break; 223| 0| } 224| | 225| 225k| if (!(options & kProtocolVersions[i].flag)) { ------------------ | Branch (225:9): [True: 225k, False: 0] ------------------ 226| | // The minimum version is the first enabled version. 227| 225k| if (!any_enabled) { ------------------ | Branch (227:11): [True: 56.3k, False: 169k] ------------------ 228| 56.3k| any_enabled = true; 229| 56.3k| min_version = kProtocolVersions[i].version; 230| 56.3k| } 231| 225k| continue; 232| 225k| } 233| | 234| | // If there is a disabled version after the first enabled one, all versions 235| | // after it are implicitly disabled. 236| 0| if (any_enabled) { ------------------ | Branch (236:9): [True: 0, False: 0] ------------------ 237| 0| max_version = kProtocolVersions[i - 1].version; 238| 0| break; 239| 0| } 240| 0| } 241| | 242| 56.3k| if (!any_enabled) { ------------------ | Branch (242:7): [True: 0, False: 56.3k] ------------------ 243| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_NO_SUPPORTED_VERSIONS_ENABLED); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 244| 0| return false; 245| 0| } 246| | 247| 56.3k| *out_min_version = min_version; 248| 56.3k| *out_max_version = max_version; 249| 56.3k| return true; 250| 56.3k|} _ZN4bssl21ssl_has_final_versionEPK6ssl_st: 269| 482k|bool ssl_has_final_version(const SSL *ssl) { 270| 482k| return ssl->s3->version != 0 && ------------------ | Branch (270:10): [True: 470k, False: 12.6k] ------------------ 271| 482k| (ssl->s3->hs == nullptr || !ssl->s3->hs->is_early_version); ------------------ | Branch (271:11): [True: 58.8k, False: 411k] | Branch (271:37): [True: 411k, False: 2] ------------------ 272| 482k|} _ZN4bssl20ssl_protocol_versionEPK6ssl_st: 274| 4.13M|uint16_t ssl_protocol_version(const SSL *ssl) { 275| 4.13M| assert(ssl->s3->version != 0); 276| 4.13M| uint16_t version; 277| 4.13M| if (!ssl_protocol_version_from_wire(&version, ssl->s3->version)) { ------------------ | Branch (277:7): [True: 0, False: 4.13M] ------------------ 278| | // |ssl->s3->version| will always be set to a valid version. 279| 0| assert(0); 280| 0| return 0; 281| 0| } 282| | 283| 4.13M| return version; 284| 4.13M|} _ZN4bssl20ssl_supports_versionEPKNS_13SSL_HANDSHAKEEt: 286| 282k|bool ssl_supports_version(const SSL_HANDSHAKE *hs, uint16_t version) { 287| 282k| const SSL *const ssl = hs->ssl; 288| 282k| uint16_t protocol_version; 289| 282k| if (!ssl_method_supports_version(ssl->method, version) || ------------------ | Branch (289:7): [True: 77, False: 282k] ------------------ 290| 282k| !ssl_protocol_version_from_wire(&protocol_version, version) || ------------------ | Branch (290:7): [True: 0, False: 282k] ------------------ 291| 282k| hs->min_version > protocol_version || ------------------ | Branch (291:7): [True: 0, False: 282k] ------------------ 292| 282k| protocol_version > hs->max_version) { ------------------ | Branch (292:7): [True: 0, False: 282k] ------------------ 293| 77| return false; 294| 77| } 295| | 296| 282k| return true; 297| 282k|} _ZN4bssl26ssl_add_supported_versionsEPKNS_13SSL_HANDSHAKEEP6cbb_stt: 300| 56.4k| uint16_t extra_min_version) { 301| 225k| for (uint16_t version : get_method_versions(hs->ssl->method)) { ------------------ | Branch (301:25): [True: 225k, False: 56.4k] ------------------ 302| 225k| uint16_t protocol_version; 303| 225k| if (ssl_supports_version(hs, version) && ------------------ | Branch (303:9): [True: 225k, False: 0] ------------------ 304| 225k| ssl_protocol_version_from_wire(&protocol_version, version) && ------------------ | Branch (304:9): [True: 225k, False: 0] ------------------ 305| 225k| protocol_version >= extra_min_version && // ------------------ | Branch (305:9): [True: 225k, False: 0] ------------------ 306| 225k| !CBB_add_u16(cbb, version)) { ------------------ | Branch (306:9): [True: 0, False: 225k] ------------------ 307| 0| return false; 308| 0| } 309| 225k| } 310| 56.4k| return true; 311| 56.4k|} SSL_CTX_set_min_proto_version: 357| 4|int SSL_CTX_set_min_proto_version(SSL_CTX *ctx, uint16_t version) { 358| 4| return set_min_version(ctx->method, &ctx->conf_min_version, version); 359| 4|} SSL_CTX_set_max_proto_version: 361| 4|int SSL_CTX_set_max_proto_version(SSL_CTX *ctx, uint16_t version) { 362| 4| return set_max_version(ctx->method, &ctx->conf_max_version, version); 363| 4|} ssl_versions.cc:_ZN4bsslL19get_method_versionsEPKNS_19SSL_PROTOCOL_METHODE: 75| 338k| const SSL_PROTOCOL_METHOD *method) { 76| 338k| return method->is_dtls ? Span(kDTLSVersions) ------------------ | Branch (76:10): [True: 0, False: 338k] ------------------ 77| 338k| : Span(kTLSVersions); 78| 338k|} ssl_versions.cc:_ZN4bsslL15set_min_versionEPKNS_19SSL_PROTOCOL_METHODEPtt: 146| 4| uint16_t version) { 147| | // Zero is interpreted as the default minimum version. 148| 4| if (version == 0) { ------------------ | Branch (148:7): [True: 2, False: 2] ------------------ 149| 2| *out = method->is_dtls ? DTLS1_2_VERSION : TLS1_2_VERSION; ------------------ | | 548| 0|#define DTLS1_2_VERSION 0xfefd ------------------ *out = method->is_dtls ? DTLS1_2_VERSION : TLS1_2_VERSION; ------------------ | | 544| 4|#define TLS1_2_VERSION 0x0303 ------------------ | Branch (149:12): [True: 0, False: 2] ------------------ 150| 2| return true; 151| 2| } 152| | 153| 2| return set_version_bound(method, out, version); 154| 4|} ssl_versions.cc:_ZN4bsslL17set_version_boundEPKNS_19SSL_PROTOCOL_METHODEPtt: 134| 4| uint16_t version) { 135| 4| if (!api_version_to_wire(&version, version) || ------------------ | Branch (135:7): [True: 0, False: 4] ------------------ 136| 4| !ssl_method_supports_version(method, version)) { ------------------ | Branch (136:7): [True: 0, False: 4] ------------------ 137| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_UNKNOWN_SSL_VERSION); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 138| 0| return false; 139| 0| } 140| | 141| 4| *out = version; 142| 4| return true; 143| 4|} ssl_versions.cc:_ZN4bsslL15set_max_versionEPKNS_19SSL_PROTOCOL_METHODEPtt: 157| 4| uint16_t version) { 158| | // Zero is interpreted as the default maximum version. 159| | // TODO(crbug.com/42290594): Enable DTLS 1.3 by default, after it's 160| | // successfully shipped in WebRTC. 161| 4| if (version == 0) { ------------------ | Branch (161:7): [True: 2, False: 2] ------------------ 162| 2| *out = method->is_dtls ? DTLS1_2_VERSION : TLS1_3_VERSION; ------------------ | | 548| 0|#define DTLS1_2_VERSION 0xfefd ------------------ *out = method->is_dtls ? DTLS1_2_VERSION : TLS1_3_VERSION; ------------------ | | 545| 4|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (162:12): [True: 0, False: 2] ------------------ 163| 2| return true; 164| 2| } 165| | 166| 2| return set_version_bound(method, out, version); 167| 4|} ssl_versions.cc:_ZN4bsslL19api_version_to_wireEPtt: 122| 4|static bool api_version_to_wire(uint16_t *out, uint16_t version) { 123| | // Check it is a real protocol version. 124| 4| uint16_t unused; 125| 4| if (!ssl_protocol_version_from_wire(&unused, version)) { ------------------ | Branch (125:7): [True: 0, False: 4] ------------------ 126| 0| return false; 127| 0| } 128| | 129| 4| *out = version; 130| 4| return true; 131| 4|} SSL_CTX_set_cert_verify_callback: 517| 2| SSL_CTX *ctx, int (*cb)(X509_STORE_CTX *store_ctx, void *arg), void *arg) { 518| 2| check_ssl_ctx_x509_method(ctx); 519| 2| ctx->app_verify_callback = cb; 520| 2| ctx->app_verify_arg = arg; 521| 2|} SSL_CTX_use_certificate: 588| 2|int SSL_CTX_use_certificate(SSL_CTX *ctx, X509 *x) { 589| 2| check_ssl_ctx_x509_method(ctx); 590| 2| return ssl_use_certificate(ctx->cert.get(), x); 591| 2|} SSL_get_ex_data_X509_STORE_CTX_idx: 1074| 2.99k|int SSL_get_ex_data_X509_STORE_CTX_idx(void) { 1075| | // The ex_data index to go from |X509_STORE_CTX| to |SSL| always uses the 1076| | // reserved app_data slot. Before ex_data was introduced, app_data was used. 1077| | // Avoid breaking any software which assumes |X509_STORE_CTX_get_app_data| 1078| | // works. 1079| 2.99k| return 0; 1080| 2.99k|} ssl_x509.cc:_ZN4bsslL36ssl_crypto_x509_check_client_CA_listEP22stack_st_CRYPTO_BUFFER: 91| 28.1k| STACK_OF(CRYPTO_BUFFER) *names) { 92| 28.1k| for (const CRYPTO_BUFFER *buffer : names) { ------------------ | Branch (92:36): [True: 25, False: 28.1k] ------------------ 93| 25| const uint8_t *inp = CRYPTO_BUFFER_data(buffer); 94| 25| UniquePtr name( 95| 25| d2i_X509_NAME(nullptr, &inp, CRYPTO_BUFFER_len(buffer))); 96| 25| if (name == nullptr || ------------------ | Branch (96:9): [True: 3, False: 22] ------------------ 97| 25| inp != CRYPTO_BUFFER_data(buffer) + CRYPTO_BUFFER_len(buffer)) { ------------------ | Branch (97:9): [True: 1, False: 21] ------------------ 98| 4| return false; 99| 4| } 100| 25| } 101| | 102| 28.1k| return true; 103| 28.1k|} ssl_x509.cc:_ZN4bsslL26ssl_crypto_x509_cert_clearEPNS_4CERTE: 105| 19.9k|static void ssl_crypto_x509_cert_clear(CERT *cert) { 106| 19.9k| ssl_crypto_x509_cert_flush_cached_leaf(cert); 107| 19.9k| ssl_crypto_x509_cert_flush_cached_chain(cert); 108| | 109| 19.9k| X509_free(cert->x509_stash); 110| 19.9k| cert->x509_stash = nullptr; 111| 19.9k|} ssl_x509.cc:_ZN4bsslL25ssl_crypto_x509_cert_freeEPNS_4CERTE: 113| 19.9k|static void ssl_crypto_x509_cert_free(CERT *cert) { 114| 19.9k| ssl_crypto_x509_cert_clear(cert); 115| 19.9k| X509_STORE_free(cert->verify_store); 116| 19.9k|} ssl_x509.cc:_ZN4bsslL24ssl_crypto_x509_cert_dupEPNS_4CERTEPKS0_: 118| 19.9k|static void ssl_crypto_x509_cert_dup(CERT *new_cert, const CERT *cert) { 119| 19.9k| if (cert->verify_store != nullptr) { ------------------ | Branch (119:7): [True: 0, False: 19.9k] ------------------ 120| 0| X509_STORE_up_ref(cert->verify_store); 121| 0| new_cert->verify_store = cert->verify_store; 122| 0| } 123| 19.9k|} ssl_x509.cc:_ZN4bsslL39ssl_crypto_x509_cert_flush_cached_chainEPNS_4CERTE: 67| 19.9k|static void ssl_crypto_x509_cert_flush_cached_chain(CERT *cert) { 68| 19.9k| sk_X509_pop_free(cert->x509_chain, X509_free); 69| 19.9k| cert->x509_chain = nullptr; 70| 19.9k|} ssl_x509.cc:_ZN4bsslL38ssl_crypto_x509_cert_flush_cached_leafEPNS_4CERTE: 62| 19.9k|static void ssl_crypto_x509_cert_flush_cached_leaf(CERT *cert) { 63| 19.9k| X509_free(cert->x509_leaf); 64| 19.9k| cert->x509_leaf = nullptr; 65| 19.9k|} ssl_x509.cc:_ZN4bsslL37ssl_crypto_x509_session_cache_objectsEP14ssl_session_st: 125| 73.4k|static bool ssl_crypto_x509_session_cache_objects(SSL_SESSION *sess) { 126| 73.4k| bssl::UniquePtr chain, chain_without_leaf; 127| 73.4k| if (sk_CRYPTO_BUFFER_num(sess->certs.get()) > 0) { ------------------ | Branch (127:7): [True: 68.0k, False: 5.39k] ------------------ 128| 68.0k| chain.reset(sk_X509_new_null()); 129| 68.0k| if (!chain) { ------------------ | Branch (129:9): [True: 0, False: 68.0k] ------------------ 130| 0| return false; 131| 0| } 132| 68.0k| if (sess->is_server) { ------------------ | Branch (132:9): [True: 4.95k, False: 63.1k] ------------------ 133| | // chain_without_leaf is only needed for server sessions. See 134| | // |SSL_get_peer_cert_chain|. 135| 4.95k| chain_without_leaf.reset(sk_X509_new_null()); 136| 4.95k| if (!chain_without_leaf) { ------------------ | Branch (136:11): [True: 0, False: 4.95k] ------------------ 137| 0| return false; 138| 0| } 139| 4.95k| } 140| 68.0k| } 141| | 142| 73.4k| bssl::UniquePtr leaf; 143| 73.4k| for (CRYPTO_BUFFER *cert : sess->certs.get()) { ------------------ | Branch (143:28): [True: 70.4k, False: 72.1k] ------------------ 144| 70.4k| UniquePtr x509(X509_parse_from_buffer(cert)); 145| 70.4k| if (!x509) { ------------------ | Branch (145:9): [True: 1.29k, False: 69.1k] ------------------ 146| 1.29k| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); ------------------ | | 361| 1.29k| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 147| 1.29k| return false; 148| 1.29k| } 149| 69.1k| if (leaf == nullptr) { ------------------ | Branch (149:9): [True: 66.8k, False: 2.29k] ------------------ 150| 66.8k| leaf = UpRef(x509); 151| 66.8k| } else if (chain_without_leaf && ------------------ | Branch (151:16): [True: 1.12k, False: 1.17k] | Branch (151:16): [True: 0, False: 2.29k] ------------------ 152| 2.29k| !PushToStack(chain_without_leaf.get(), UpRef(x509))) { ------------------ | Branch (152:16): [True: 0, False: 1.12k] ------------------ 153| 0| return false; 154| 0| } 155| 69.1k| if (!PushToStack(chain.get(), std::move(x509))) { ------------------ | Branch (155:9): [True: 0, False: 69.1k] ------------------ 156| 0| return false; 157| 0| } 158| 69.1k| } 159| | 160| 72.1k| sk_X509_pop_free(sess->x509_chain, X509_free); 161| 72.1k| sess->x509_chain = chain.release(); 162| | 163| 72.1k| sk_X509_pop_free(sess->x509_chain_without_leaf, X509_free); 164| 72.1k| sess->x509_chain_without_leaf = chain_without_leaf.release(); 165| | 166| 72.1k| X509_free(sess->x509_peer); 167| 72.1k| sess->x509_peer = leaf.release(); 168| 72.1k| return true; 169| 73.4k|} ssl_x509.cc:_ZN4bsslL27ssl_crypto_x509_session_dupEP14ssl_session_stPKS0_: 172| 52.8k| const SSL_SESSION *session) { 173| 52.8k| new_session->x509_peer = UpRef(session->x509_peer).release(); 174| 52.8k| if (session->x509_chain != nullptr) { ------------------ | Branch (174:7): [True: 52.8k, False: 0] ------------------ 175| 52.8k| new_session->x509_chain = X509_chain_up_ref(session->x509_chain); 176| 52.8k| if (new_session->x509_chain == nullptr) { ------------------ | Branch (176:9): [True: 0, False: 52.8k] ------------------ 177| 0| return false; 178| 0| } 179| 52.8k| } 180| 52.8k| if (session->x509_chain_without_leaf != nullptr) { ------------------ | Branch (180:7): [True: 0, False: 52.8k] ------------------ 181| 0| new_session->x509_chain_without_leaf = 182| 0| X509_chain_up_ref(session->x509_chain_without_leaf); 183| 0| if (new_session->x509_chain_without_leaf == nullptr) { ------------------ | Branch (183:9): [True: 0, False: 0] ------------------ 184| 0| return false; 185| 0| } 186| 0| } 187| | 188| 52.8k| return true; 189| 52.8k|} ssl_x509.cc:_ZN4bsslL29ssl_crypto_x509_session_clearEP14ssl_session_st: 191| 128k|static void ssl_crypto_x509_session_clear(SSL_SESSION *session) { 192| 128k| X509_free(session->x509_peer); 193| 128k| session->x509_peer = nullptr; 194| 128k| sk_X509_pop_free(session->x509_chain, X509_free); 195| 128k| session->x509_chain = nullptr; 196| 128k| sk_X509_pop_free(session->x509_chain_without_leaf, X509_free); 197| 128k| session->x509_chain_without_leaf = nullptr; 198| 128k|} ssl_x509.cc:_ZN4bsslL41ssl_crypto_x509_session_verify_cert_chainEP14ssl_session_stPNS_13SSL_HANDSHAKEEPh: 202| 2.99k| uint8_t *out_alert) { 203| 2.99k| *out_alert = SSL_AD_INTERNAL_ERROR; ------------------ | | 4387| 2.99k|#define SSL_AD_INTERNAL_ERROR TLS1_AD_INTERNAL_ERROR | | ------------------ | | | | 37| 2.99k|#define TLS1_AD_INTERNAL_ERROR 80 | | ------------------ ------------------ 204| 2.99k| STACK_OF(X509) *const cert_chain = session->x509_chain; ------------------ | | 39| 2.99k|#define STACK_OF(type) struct stack_st_##type ------------------ 205| 2.99k| if (cert_chain == nullptr || sk_X509_num(cert_chain) == 0) { ------------------ | Branch (205:7): [True: 0, False: 2.99k] | Branch (205:32): [True: 0, False: 2.99k] ------------------ 206| 0| return false; 207| 0| } 208| | 209| 2.99k| SSL *const ssl = hs->ssl; 210| 2.99k| SSL_CTX *ssl_ctx = ssl->ctx.get(); 211| 2.99k| X509_STORE *verify_store = ssl_ctx->cert_store; 212| 2.99k| if (hs->config->cert->verify_store != nullptr) { ------------------ | Branch (212:7): [True: 0, False: 2.99k] ------------------ 213| 0| verify_store = hs->config->cert->verify_store; 214| 0| } 215| | 216| 2.99k| X509 *leaf = sk_X509_value(cert_chain, 0); 217| 2.99k| const char *name; 218| 2.99k| size_t name_len; 219| 2.99k| SSL_get0_ech_name_override(ssl, &name, &name_len); 220| 2.99k| UniquePtr ctx(X509_STORE_CTX_new()); 221| 2.99k| if (!ctx || // ------------------ | Branch (221:7): [True: 0, False: 2.99k] ------------------ 222| 2.99k| !X509_STORE_CTX_init(ctx.get(), verify_store, leaf, cert_chain) || // ------------------ | Branch (222:7): [True: 0, False: 2.99k] ------------------ 223| 2.99k| !X509_STORE_CTX_set_ex_data( ------------------ | Branch (223:7): [True: 0, False: 2.99k] ------------------ 224| 2.99k| ctx.get(), SSL_get_ex_data_X509_STORE_CTX_idx(), ssl) || // 225| | // We need to inherit the verify parameters. These can be determined by 226| | // the context: if its a server it will verify SSL client certificates or 227| | // vice versa. 228| 2.99k| !X509_STORE_CTX_set_default( ------------------ | Branch (228:7): [True: 0, False: 2.99k] ------------------ 229| 2.99k| ctx.get(), 230| 2.99k| ssl->server ? "ssl_client" : "ssl_server") || // ------------------ | Branch (230:11): [True: 0, False: 2.99k] ------------------ 231| | // Anything non-default in "param" should overwrite anything in the ctx. 232| 2.99k| !X509_VERIFY_PARAM_set1(X509_STORE_CTX_get0_param(ctx.get()), ------------------ | Branch (232:7): [True: 0, False: 2.99k] ------------------ 233| 2.99k| hs->config->param) || // 234| | // ClientHelloOuter connections use a different name. 235| 2.99k| (name_len != 0 && // ------------------ | Branch (235:8): [True: 0, False: 2.99k] ------------------ 236| 2.99k| !X509_VERIFY_PARAM_set1_host(X509_STORE_CTX_get0_param(ctx.get()), name, ------------------ | Branch (236:8): [True: 0, False: 0] ------------------ 237| 0| name_len))) { 238| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_X509_LIB); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 239| 0| return false; 240| 0| } 241| | 242| 2.99k| if (hs->config->verify_callback) { ------------------ | Branch (242:7): [True: 0, False: 2.99k] ------------------ 243| 0| X509_STORE_CTX_set_verify_cb(ctx.get(), hs->config->verify_callback); 244| 0| } 245| | 246| 2.99k| int verify_ret; 247| 2.99k| if (ssl_ctx->app_verify_callback != nullptr) { ------------------ | Branch (247:7): [True: 2.99k, False: 0] ------------------ 248| 2.99k| verify_ret = 249| 2.99k| ssl_ctx->app_verify_callback(ctx.get(), ssl_ctx->app_verify_arg); 250| 2.99k| } else { 251| 0| verify_ret = X509_verify_cert(ctx.get()); 252| 0| } 253| | 254| 2.99k| session->verify_result = X509_STORE_CTX_get_error(ctx.get()); 255| | 256| | // If |SSL_VERIFY_NONE|, the error is non-fatal, but we keep the result. 257| 2.99k| if (verify_ret <= 0 && hs->config->verify_mode != SSL_VERIFY_NONE) { ------------------ | | 2629| 0|#define SSL_VERIFY_NONE 0x00 ------------------ | Branch (257:7): [True: 0, False: 2.99k] | Branch (257:26): [True: 0, False: 0] ------------------ 258| 0| *out_alert = SSL_alert_from_verify_result(session->verify_result); 259| 0| return false; 260| 0| } 261| | 262| 2.99k| ERR_clear_error(); 263| 2.99k| return true; 264| 2.99k|} ssl_x509.cc:_ZN4bsslL40ssl_crypto_x509_hs_flush_cached_ca_namesEPNS_13SSL_HANDSHAKEE: 266| 99.1k|static void ssl_crypto_x509_hs_flush_cached_ca_names(SSL_HANDSHAKE *hs) { 267| 99.1k| sk_X509_NAME_pop_free(hs->cached_x509_ca_names, X509_NAME_free); 268| 99.1k| hs->cached_x509_ca_names = nullptr; 269| 99.1k|} ssl_x509.cc:_ZN4bsslL23ssl_crypto_x509_ssl_newEPNS_13SSL_HANDSHAKEE: 271| 19.9k|static bool ssl_crypto_x509_ssl_new(SSL_HANDSHAKE *hs) { 272| 19.9k| hs->config->param = X509_VERIFY_PARAM_new(); 273| 19.9k| if (hs->config->param == nullptr) { ------------------ | Branch (273:7): [True: 0, False: 19.9k] ------------------ 274| 0| return false; 275| 0| } 276| 19.9k| X509_VERIFY_PARAM_inherit(hs->config->param, hs->ssl->ctx->param); 277| 19.9k| return true; 278| 19.9k|} ssl_x509.cc:_ZN4bsslL31ssl_crypto_x509_ssl_config_freeEPNS_10SSL_CONFIGE: 285| 19.9k|static void ssl_crypto_x509_ssl_config_free(SSL_CONFIG *cfg) { 286| 19.9k| sk_X509_NAME_pop_free(cfg->cached_x509_client_CA, X509_NAME_free); 287| 19.9k| cfg->cached_x509_client_CA = nullptr; 288| 19.9k| X509_VERIFY_PARAM_free(cfg->param); 289| 19.9k|} ssl_x509.cc:_ZN4bsslL40ssl_crypto_x509_ssl_auto_chain_if_neededEPNS_13SSL_HANDSHAKEE: 291| 28.0k|static bool ssl_crypto_x509_ssl_auto_chain_if_needed(SSL_HANDSHAKE *hs) { 292| | // Only build a chain if the feature isn't disabled, the legacy credential 293| | // exists but has no intermediates configured. 294| 28.0k| SSL *ssl = hs->ssl; 295| 28.0k| SSL_CREDENTIAL *cred = hs->config->cert->legacy_credential.get(); 296| 28.0k| if ((ssl->mode & SSL_MODE_NO_AUTO_CHAIN) || !cred->IsComplete() || ------------------ | | 668| 28.0k|#define SSL_MODE_NO_AUTO_CHAIN 0x00000008L ------------------ | Branch (296:7): [True: 28.0k, False: 0] | Branch (296:47): [True: 0, False: 0] ------------------ 297| 28.0k| sk_CRYPTO_BUFFER_num(cred->chain.get()) != 1) { ------------------ | Branch (297:7): [True: 0, False: 0] ------------------ 298| 28.0k| return true; 299| 28.0k| } 300| | 301| 0| UniquePtr leaf( 302| 0| X509_parse_from_buffer(sk_CRYPTO_BUFFER_value(cred->chain.get(), 0))); 303| 0| if (!leaf) { ------------------ | Branch (303:7): [True: 0, False: 0] ------------------ 304| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_X509_LIB); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 305| 0| return false; 306| 0| } 307| | 308| 0| UniquePtr ctx(X509_STORE_CTX_new()); 309| 0| if (!ctx || !X509_STORE_CTX_init(ctx.get(), ssl->ctx->cert_store, leaf.get(), ------------------ | Branch (309:7): [True: 0, False: 0] | Branch (309:15): [True: 0, False: 0] ------------------ 310| 0| nullptr)) { 311| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_X509_LIB); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 312| 0| return false; 313| 0| } 314| | 315| | // Attempt to build a chain, ignoring the result. 316| 0| X509_verify_cert(ctx.get()); 317| 0| ERR_clear_error(); 318| | 319| | // Remove the leaf from the generated chain. 320| 0| UniquePtr chain(X509_STORE_CTX_get1_chain(ctx.get())); 321| 0| if (!chain) { ------------------ | Branch (321:7): [True: 0, False: 0] ------------------ 322| 0| return false; 323| 0| } 324| 0| X509_free(sk_X509_shift(chain.get())); 325| | 326| 0| return SSL_set1_chain(ssl, chain.get()); ------------------ | | 6118| 0|#define SSL_set1_chain SSL_set1_chain ------------------ 327| 0|} ssl_x509.cc:_ZN4bsslL27ssl_crypto_x509_ssl_ctx_newEP10ssl_ctx_st: 334| 2|static bool ssl_crypto_x509_ssl_ctx_new(SSL_CTX *ctx) { 335| 2| ctx->cert_store = X509_STORE_new(); 336| 2| ctx->param = X509_VERIFY_PARAM_new(); 337| 2| return (ctx->cert_store != nullptr && ctx->param != nullptr); ------------------ | Branch (337:11): [True: 2, False: 0] | Branch (337:41): [True: 2, False: 0] ------------------ 338| 2|} ssl_x509.cc:_ZN4bsslL25check_ssl_ctx_x509_methodEPK10ssl_ctx_st: 43| 4|static void check_ssl_ctx_x509_method(const SSL_CTX *ctx) { 44| 4| assert(ctx == NULL || ctx->x509_method == &ssl_crypto_x509_method); 45| 4|} ssl_x509.cc:_ZL19ssl_use_certificatePN4bssl4CERTEP7x509_st: 566| 2|static int ssl_use_certificate(CERT *cert, X509 *x) { 567| 2| if (x == NULL) { ------------------ | Branch (567:7): [True: 0, False: 2] ------------------ 568| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_PASSED_NULL_PARAMETER); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 569| 0| return 0; 570| 0| } 571| | 572| 2| UniquePtr buffer = x509_to_buffer(x); 573| 2| if (!buffer) { ------------------ | Branch (573:7): [True: 0, False: 2] ------------------ 574| 0| return 0; 575| 0| } 576| | 577| 2| return ssl_set_cert(cert, std::move(buffer)); 578| 2|} ssl_x509.cc:_ZN4bsslL14x509_to_bufferEP7x509_st: 49| 2|static UniquePtr x509_to_buffer(X509 *x509) { 50| 2| uint8_t *buf = NULL; 51| 2| int cert_len = i2d_X509(x509, &buf); 52| 2| if (cert_len <= 0) { ------------------ | Branch (52:7): [True: 0, False: 2] ------------------ 53| 0| return 0; 54| 0| } 55| | 56| 2| UniquePtr buffer(CRYPTO_BUFFER_new(buf, cert_len, NULL)); 57| 2| OPENSSL_free(buf); 58| | 59| 2| return buffer; 60| 2|} _ZN4bssl8tls1_prfEPK9env_md_stNS_4SpanIhEENS3_IKhEENSt3__117basic_string_viewIcNS7_11char_traitsIcEEEES6_S6_: 41| 208k| Span seed1, Span seed2) { 42| 208k| return 1 == CRYPTO_tls1_prf(digest, out.data(), out.size(), secret.data(), 43| 208k| secret.size(), label.data(), label.size(), 44| 208k| seed1.data(), seed1.size(), seed2.data(), 45| 208k| seed2.size()); 46| 208k|} _ZN4bssl19tls1_configure_aeadEP6ssl_st20evp_aead_direction_tPNS_5ArrayIhEEPK14ssl_session_stNS_4SpanIKhEE: 85| 103k| Span iv_override) { 86| 103k| size_t mac_secret_len, key_len, iv_len; 87| 103k| if (!get_key_block_lengths(ssl, &mac_secret_len, &key_len, &iv_len, ------------------ | Branch (87:7): [True: 0, False: 103k] ------------------ 88| 103k| session->cipher)) { 89| 0| return false; 90| 0| } 91| | 92| | // Ensure that |key_block_cache| is set up. 93| 103k| const size_t key_block_size = 2 * (mac_secret_len + key_len + iv_len); 94| 103k| if (key_block_cache->empty()) { ------------------ | Branch (94:7): [True: 52.2k, False: 51.4k] ------------------ 95| 52.2k| if (!key_block_cache->InitForOverwrite(key_block_size) || ------------------ | Branch (95:9): [True: 0, False: 52.2k] ------------------ 96| 52.2k| !generate_key_block(ssl, Span(*key_block_cache), session)) { ------------------ | Branch (96:9): [True: 0, False: 52.2k] ------------------ 97| 0| return false; 98| 0| } 99| 52.2k| } 100| 103k| assert(key_block_cache->size() == key_block_size); 101| | 102| 103k| Span key_block = *key_block_cache; 103| 103k| Span mac_secret, key, iv; 104| 103k| if (direction == (ssl->server ? evp_aead_open : evp_aead_seal)) { ------------------ | Branch (104:7): [True: 52.2k, False: 51.4k] | Branch (104:21): [True: 0, False: 103k] ------------------ 105| | // Use the client write (server read) keys. 106| 52.2k| mac_secret = key_block.subspan(0, mac_secret_len); 107| 52.2k| key = key_block.subspan(2 * mac_secret_len, key_len); 108| 52.2k| iv = key_block.subspan(2 * mac_secret_len + 2 * key_len, iv_len); 109| 52.2k| } else { 110| | // Use the server write (client read) keys. 111| 51.4k| mac_secret = key_block.subspan(mac_secret_len, mac_secret_len); 112| 51.4k| key = key_block.subspan(2 * mac_secret_len + key_len, key_len); 113| 51.4k| iv = key_block.subspan(2 * mac_secret_len + 2 * key_len + iv_len, iv_len); 114| 51.4k| } 115| | 116| 103k| if (!iv_override.empty()) { ------------------ | Branch (116:7): [True: 0, False: 103k] ------------------ 117| 0| if (iv_override.size() != iv_len) { ------------------ | Branch (117:9): [True: 0, False: 0] ------------------ 118| 0| return false; 119| 0| } 120| 0| iv = iv_override; 121| 0| } 122| | 123| 103k| UniquePtr aead_ctx = SSLAEADContext::Create( 124| 103k| direction, ssl->s3->version, session->cipher, key, mac_secret, iv); 125| 103k| if (!aead_ctx) { ------------------ | Branch (125:7): [True: 0, False: 103k] ------------------ 126| 0| return false; 127| 0| } 128| | 129| 103k| if (direction == evp_aead_open) { ------------------ | Branch (129:7): [True: 51.4k, False: 52.2k] ------------------ 130| 51.4k| return ssl->method->set_read_state(ssl, ssl_encryption_application, 131| 51.4k| std::move(aead_ctx), 132| 51.4k| /*traffic_secret=*/{}); 133| 51.4k| } 134| | 135| 52.2k| return ssl->method->set_write_state(ssl, ssl_encryption_application, 136| 52.2k| std::move(aead_ctx), 137| 52.2k| /*traffic_secret=*/{}); 138| 103k|} _ZN4bssl24tls1_change_cipher_stateEPNS_13SSL_HANDSHAKEE20evp_aead_direction_t: 141| 103k| evp_aead_direction_t direction) { 142| 103k| return tls1_configure_aead(hs->ssl, direction, &hs->key_block, 143| 103k| ssl_handshake_session(hs), {}); 144| 103k|} _ZN4bssl27tls1_generate_master_secretEPNS_13SSL_HANDSHAKEENS_4SpanIhEENS2_IKhEE: 147| 52.0k| Span premaster) { 148| 52.0k| BSSL_CHECK(out.size() == SSL3_MASTER_SECRET_SIZE); ------------------ | | 384| 52.0k| do { \ | | 385| 52.0k| if (!(condition)) { \ | | ------------------ | | | Branch (385:9): [True: 0, False: 52.0k] | | ------------------ | | 386| 0| abort(); \ | | 387| 0| } \ | | 388| 52.0k| } while (0); | | ------------------ | | | Branch (388:12): [Folded - Ignored] | | ------------------ ------------------ 149| | 150| 52.0k| const SSL *ssl = hs->ssl; 151| 52.0k| if (hs->extended_master_secret) { ------------------ | Branch (151:7): [True: 51.8k, False: 260] ------------------ 152| 51.8k| uint8_t digests[EVP_MAX_MD_SIZE]; 153| 51.8k| size_t digests_len; 154| 51.8k| if (!hs->transcript.GetHash(digests, &digests_len) || ------------------ | Branch (154:9): [True: 0, False: 51.8k] | Branch (154:9): [True: 0, False: 51.8k] ------------------ 155| 51.8k| !tls1_prf(hs->transcript.Digest(), out, premaster, ------------------ | Branch (155:9): [True: 0, False: 51.8k] ------------------ 156| 51.8k| "extended master secret", Span(digests, digests_len), {})) { 157| 0| return false; 158| 0| } 159| 51.8k| } else { 160| 260| if (!tls1_prf(hs->transcript.Digest(), out, premaster, "master secret", ------------------ | Branch (160:9): [True: 0, False: 260] ------------------ 161| 260| ssl->s3->client_random, ssl->s3->server_random)) { 162| 0| return false; 163| 0| } 164| 260| } 165| | 166| 52.0k| return true; 167| 52.0k|} t1_enc.cc:_ZN4bsslL21get_key_block_lengthsEPK6ssl_stPmS3_S3_PK13ssl_cipher_st: 50| 103k| const SSL_CIPHER *cipher) { 51| 103k| const EVP_AEAD *aead = NULL; 52| 103k| if (!ssl_cipher_get_evp_aead(&aead, out_mac_secret_len, out_iv_len, cipher, ------------------ | Branch (52:7): [True: 0, False: 103k] ------------------ 53| 103k| ssl_protocol_version(ssl))) { 54| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_CIPHER_OR_HASH_UNAVAILABLE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 55| 0| return false; 56| 0| } 57| | 58| 103k| *out_key_len = EVP_AEAD_key_length(aead); 59| 103k| if (*out_mac_secret_len > 0) { ------------------ | Branch (59:7): [True: 64.0k, False: 39.6k] ------------------ 60| | // For "stateful" AEADs (i.e. compatibility with pre-AEAD cipher suites) the 61| | // key length reported by |EVP_AEAD_key_length| will include the MAC key 62| | // bytes and initial implicit IV. 63| 64.0k| if (*out_key_len < *out_mac_secret_len + *out_iv_len) { ------------------ | Branch (63:9): [True: 0, False: 64.0k] ------------------ 64| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 65| 0| return false; 66| 0| } 67| 64.0k| *out_key_len -= *out_mac_secret_len + *out_iv_len; 68| 64.0k| } 69| | 70| 103k| return true; 71| 103k|} t1_enc.cc:_ZN4bsslL18generate_key_blockEPK6ssl_stNS_4SpanIhEEPK14ssl_session_st: 74| 52.2k| const SSL_SESSION *session) { 75| 52.2k| const EVP_MD *digest = ssl_session_get_digest(session); 76| | // Note this function assumes that |session|'s key material corresponds to 77| | // |ssl->s3->client_random| and |ssl->s3->server_random|. 78| 52.2k| return tls1_prf(digest, out, session->secret, "key expansion", 79| 52.2k| ssl->s3->server_random, ssl->s3->client_random); 80| 52.2k|} client.cc:_ZN12_GLOBAL__N_19TLSFuzzerC2ENS0_8ProtocolENS0_4RoleENS0_10FuzzerModeE: 292| 2| : debug_(getenv("BORINGSSL_FUZZER_DEBUG") != nullptr), 293| 2| protocol_(protocol), 294| 2| role_(role) { 295| 2|#if defined(FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION) 296| 2| if (fuzzer_mode == kFuzzerModeOn) { ------------------ | Branch (296:9): [True: 2, False: 0] ------------------ 297| 2| CRYPTO_set_fuzzer_mode(1); 298| 2| } 299| 2|#endif 300| 2| if (!Init()) { ------------------ | Branch (300:9): [True: 0, False: 2] ------------------ 301| 0| abort(); 302| 0| } 303| 2| } client.cc:_ZN12_GLOBAL__N_19TLSFuzzer4InitEv: 406| 2| bool Init() { 407| 2| ctx_.reset(SSL_CTX_new(protocol_ == kDTLS ? DTLS_method() : TLS_method())); ------------------ | Branch (407:28): [True: 0, False: 2] ------------------ 408| 2| bssl::UniquePtr pkey(EVP_PKEY_new()); 409| 2| bssl::UniquePtr privkey(RSA_private_key_from_bytes( 410| 2| kRSAPrivateKeyDER, sizeof(kRSAPrivateKeyDER))); 411| 2| if (!ctx_ || !privkey || !pkey || ------------------ | Branch (411:9): [True: 0, False: 2] | Branch (411:18): [True: 0, False: 2] | Branch (411:30): [True: 0, False: 2] ------------------ 412| 2| !EVP_PKEY_set1_RSA(pkey.get(), privkey.get()) || ------------------ | Branch (412:9): [True: 0, False: 2] ------------------ 413| 2| !SSL_CTX_use_PrivateKey(ctx_.get(), pkey.get())) { ------------------ | Branch (413:9): [True: 0, False: 2] ------------------ 414| 0| return false; 415| 0| } 416| | 417| 2| const uint8_t *bufp = kCertificateDER; 418| 2| bssl::UniquePtr cert(d2i_X509(NULL, &bufp, sizeof(kCertificateDER))); 419| 2| if (!cert || ------------------ | Branch (419:9): [True: 0, False: 2] ------------------ 420| 2| !SSL_CTX_use_certificate(ctx_.get(), cert.get()) || ------------------ | Branch (420:9): [True: 0, False: 2] ------------------ 421| 2| !SSL_CTX_set_ocsp_response(ctx_.get(), kOCSPResponse, ------------------ | Branch (421:9): [True: 0, False: 2] ------------------ 422| 2| sizeof(kOCSPResponse)) || 423| 2| !SSL_CTX_set_signed_cert_timestamp_list(ctx_.get(), kSCT, ------------------ | Branch (423:9): [True: 0, False: 2] ------------------ 424| 2| sizeof(kSCT))) { 425| 0| return false; 426| 0| } 427| | 428| | // Use a constant clock. 429| 2| SSL_CTX_set_current_time_cb(ctx_.get(), 430| 2| [](const SSL *ssl, timeval *out_clock) { 431| 2| *out_clock = {1234, 1234}; 432| 2| }); 433| | 434| | // When accepting peer certificates, allow any certificate. 435| 2| SSL_CTX_set_cert_verify_callback( 436| 2| ctx_.get(), 437| 2| [](X509_STORE_CTX *store_ctx, void *arg) -> int { return 1; }, nullptr); 438| | 439| 2| SSL_CTX_enable_signed_cert_timestamps(ctx_.get()); 440| 2| SSL_CTX_enable_ocsp_stapling(ctx_.get()); 441| | 442| | // Enable versions and ciphers that are off by default. 443| 2| uint16_t min_version = protocol_ == kDTLS ? DTLS1_VERSION : TLS1_VERSION; ------------------ | | 547| 0|#define DTLS1_VERSION 0xfeff ------------------ uint16_t min_version = protocol_ == kDTLS ? DTLS1_VERSION : TLS1_VERSION; ------------------ | | 542| 4|#define TLS1_VERSION 0x0301 ------------------ | Branch (443:28): [True: 0, False: 2] ------------------ 444| 2| uint16_t max_version = 445| 2| protocol_ == kDTLS ? DTLS1_3_VERSION : TLS1_3_VERSION; ------------------ | | 549| 0|#define DTLS1_3_VERSION 0xfefc ------------------ protocol_ == kDTLS ? DTLS1_3_VERSION : TLS1_3_VERSION; ------------------ | | 545| 4|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (445:9): [True: 0, False: 2] ------------------ 446| 2| if (!SSL_CTX_set_min_proto_version(ctx_.get(), min_version) || ------------------ | Branch (446:9): [True: 0, False: 2] ------------------ 447| 2| !SSL_CTX_set_max_proto_version(ctx_.get(), max_version) || ------------------ | Branch (447:9): [True: 0, False: 2] ------------------ 448| 2| !SSL_CTX_set_strict_cipher_list(ctx_.get(), "ALL:3DES")) { ------------------ | Branch (448:9): [True: 0, False: 2] ------------------ 449| 0| return false; 450| 0| } 451| | 452| 2| static const uint16_t kGroups[] = { 453| 2| SSL_GROUP_X25519_MLKEM768, SSL_GROUP_X25519_KYBER768_DRAFT00, ------------------ | | 2529| 2|#define SSL_GROUP_X25519_MLKEM768 0x11ec ------------------ SSL_GROUP_X25519_MLKEM768, SSL_GROUP_X25519_KYBER768_DRAFT00, ------------------ | | 2530| 2|#define SSL_GROUP_X25519_KYBER768_DRAFT00 0x6399 ------------------ 454| 2| SSL_GROUP_X25519, SSL_GROUP_SECP256R1, ------------------ | | 2528| 2|#define SSL_GROUP_X25519 29 ------------------ SSL_GROUP_X25519, SSL_GROUP_SECP256R1, ------------------ | | 2525| 2|#define SSL_GROUP_SECP256R1 23 ------------------ 455| 2| SSL_GROUP_SECP384R1, SSL_GROUP_SECP521R1}; ------------------ | | 2526| 2|#define SSL_GROUP_SECP384R1 24 ------------------ SSL_GROUP_SECP384R1, SSL_GROUP_SECP521R1}; ------------------ | | 2527| 2|#define SSL_GROUP_SECP521R1 25 ------------------ 456| 2| if (!SSL_CTX_set1_group_ids(ctx_.get(), kGroups, ------------------ | Branch (456:9): [True: 0, False: 2] ------------------ 457| 2| OPENSSL_ARRAY_SIZE(kGroups))) { ------------------ | | 103| 2|#define OPENSSL_ARRAY_SIZE(array) (sizeof(array) / sizeof((array)[0])) ------------------ 458| 0| return false; 459| 0| } 460| | 461| 2| SSL_CTX_set_early_data_enabled(ctx_.get(), 1); 462| | 463| 2| SSL_CTX_set_next_proto_select_cb(ctx_.get(), NPNSelectCallback, nullptr); 464| 2| SSL_CTX_set_next_protos_advertised_cb(ctx_.get(), NPNAdvertiseCallback, 465| 2| nullptr); 466| | 467| 2| SSL_CTX_set_alpn_select_cb(ctx_.get(), ALPNSelectCallback, nullptr); 468| 2| if (SSL_CTX_set_alpn_protos(ctx_.get(), kALPNProtocols, ------------------ | Branch (468:9): [True: 0, False: 2] ------------------ 469| 2| sizeof(kALPNProtocols)) != 0) { 470| 0| return false; 471| 0| } 472| | 473| 2| CBS cbs; 474| 2| CBS_init(&cbs, kP256KeyPKCS8, sizeof(kP256KeyPKCS8)); 475| 2| pkey.reset(EVP_parse_private_key(&cbs)); 476| 2| if (!pkey || !SSL_CTX_set1_tls_channel_id(ctx_.get(), pkey.get())) { ------------------ | Branch (476:9): [True: 0, False: 2] | Branch (476:18): [True: 0, False: 2] ------------------ 477| 0| return false; 478| 0| } 479| 2| SSL_CTX_set_tls_channel_id_enabled(ctx_.get(), 1); 480| | 481| 2| if (role_ == kServer) { ------------------ | Branch (481:9): [True: 0, False: 2] ------------------ 482| 0| bssl::UniquePtr keys(SSL_ECH_KEYS_new()); 483| 0| bssl::ScopedEVP_HPKE_KEY key; 484| 0| uint8_t *ech_config; 485| 0| size_t ech_config_len; 486| 0| if (!keys || ------------------ | Branch (486:11): [True: 0, False: 0] ------------------ 487| 0| !EVP_HPKE_KEY_init(key.get(), EVP_hpke_x25519_hkdf_sha256(), kECHKey, ------------------ | Branch (487:11): [True: 0, False: 0] ------------------ 488| 0| sizeof(kECHKey)) || 489| | // Match |echConfig| in |addEncryptedClientHelloTests| from runner.go. 490| 0| !SSL_marshal_ech_config(&ech_config, &ech_config_len, ------------------ | Branch (490:11): [True: 0, False: 0] ------------------ 491| 0| /*config_id=*/42, key.get(), "public.example", 492| 0| /*max_name_len=*/64)) { 493| 0| return false; 494| 0| } 495| 0| bssl::UniquePtr free_ech_config(ech_config); 496| 0| if (!SSL_ECH_KEYS_add(keys.get(), /*is_retry_config=*/true, ech_config, ------------------ | Branch (496:11): [True: 0, False: 0] ------------------ 497| 0| ech_config_len, key.get()) || 498| 0| !SSL_CTX_set1_ech_keys(ctx_.get(), keys.get())) { ------------------ | Branch (498:11): [True: 0, False: 0] ------------------ 499| 0| return false; 500| 0| } 501| 0| } 502| | 503| 2| return true; 504| 2| } client.cc:_ZZN12_GLOBAL__N_19TLSFuzzer4InitEvENKUlPK6ssl_stP7timevalE_clES3_S5_: 430| 108k| [](const SSL *ssl, timeval *out_clock) { 431| 108k| *out_clock = {1234, 1234}; 432| 108k| }); client.cc:_ZZN12_GLOBAL__N_19TLSFuzzer4InitEvENKUlP17x509_store_ctx_stPvE_clES2_S3_: 437| 2.99k| [](X509_STORE_CTX *store_ctx, void *arg) -> int { return 1; }, nullptr); client.cc:_ZN12_GLOBAL__N_117NPNSelectCallbackEP6ssl_stPPhS2_PKhjPv: 257| 6| const uint8_t *in, unsigned in_len, void *arg) { 258| 6| static const uint8_t kProtocol[] = {'a', 'a'}; 259| 6| *out = const_cast(kProtocol); 260| 6| *out_len = sizeof(kProtocol); 261| 6| return SSL_TLSEXT_ERR_OK; ------------------ | | 3169| 6|#define SSL_TLSEXT_ERR_OK 0 ------------------ 262| 6|} client.cc:_ZN12_GLOBAL__N_19TLSFuzzer12TestOneInputEPKhm: 318| 9.52k| int TestOneInput(const uint8_t *buf, size_t len) { 319| 9.52k|#if defined(FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION) 320| 9.52k| RAND_reset_for_fuzzing(); 321| 9.52k|#endif 322| | 323| 9.52k| CBS cbs; 324| 9.52k| CBS_init(&cbs, buf, len); 325| 9.52k| bssl::UniquePtr ssl = SetupTest(&cbs); 326| 9.52k| if (!ssl) { ------------------ | Branch (326:9): [True: 4.34k, False: 5.18k] ------------------ 327| 4.34k| if (debug_) { ------------------ | Branch (327:11): [True: 0, False: 4.34k] ------------------ 328| 0| fprintf(stderr, "Error parsing parameters.\n"); 329| 0| } 330| 4.34k| return 0; 331| 4.34k| } 332| | 333| 5.18k| if (role_ == kClient) { ------------------ | Branch (333:9): [True: 5.18k, False: 0] ------------------ 334| 5.18k| SSL_set_renegotiate_mode(ssl.get(), ssl_renegotiate_freely); 335| 5.18k| SSL_set_tlsext_host_name(ssl.get(), "hostname"); ------------------ | | 6127| 5.18k|#define SSL_set_tlsext_host_name SSL_set_tlsext_host_name ------------------ 336| 5.18k| } 337| | 338| | // ssl_handoff may or may not be used. 339| 5.18k| bssl::UniquePtr ssl_handoff(SSL_new(ctx_.get())); 340| 5.18k| bssl::UniquePtr ssl_handback(SSL_new(ctx_.get())); 341| 5.18k| SSL_set_accept_state(ssl_handoff.get()); 342| | 343| 5.18k| SSL_set0_rbio(ssl.get(), MakeBIO(CBS_data(&cbs), CBS_len(&cbs)).release()); 344| 5.18k| SSL_set0_wbio(ssl.get(), BIO_new(BIO_s_mem())); 345| | 346| 5.18k| SSL *ssl_handshake = ssl.get(); 347| 5.18k| bool handshake_successful = false; 348| 5.18k| bool handback_successful = false; 349| 5.18k| for (;;) { 350| 5.18k| int ret = SSL_do_handshake(ssl_handshake); 351| 5.18k| if (ret < 0 && SSL_get_error(ssl_handshake, ret) == SSL_ERROR_HANDOFF) { ------------------ | | 466| 1.92k|#define SSL_ERROR_HANDOFF 17 ------------------ | Branch (351:11): [True: 1.92k, False: 3.25k] | Branch (351:22): [True: 0, False: 1.92k] ------------------ 352| 0| MoveBIOs(ssl_handoff.get(), ssl.get()); 353| | // Ordinarily we would call SSL_serialize_handoff(ssl.get(). But for 354| | // fuzzing, use the serialized handoff that's getting fuzzed. 355| 0| if (!bssl::SSL_apply_handoff(ssl_handoff.get(), handoff_)) { ------------------ | Branch (355:13): [True: 0, False: 0] ------------------ 356| 0| if (debug_) { ------------------ | Branch (356:15): [True: 0, False: 0] ------------------ 357| 0| fprintf(stderr, "Handoff failed.\n"); 358| 0| } 359| 0| break; 360| 0| } 361| 0| ssl_handshake = ssl_handoff.get(); 362| 5.18k| } else if (ret < 0 && ------------------ | Branch (362:18): [True: 1.92k, False: 3.25k] ------------------ 363| 5.18k| SSL_get_error(ssl_handshake, ret) == SSL_ERROR_HANDBACK) { ------------------ | | 467| 1.92k|#define SSL_ERROR_HANDBACK 18 ------------------ | Branch (363:18): [True: 0, False: 1.92k] ------------------ 364| 0| MoveBIOs(ssl_handback.get(), ssl_handoff.get()); 365| 0| if (!bssl::SSL_apply_handback(ssl_handback.get(), handback_)) { ------------------ | Branch (365:13): [True: 0, False: 0] ------------------ 366| 0| if (debug_) { ------------------ | Branch (366:15): [True: 0, False: 0] ------------------ 367| 0| fprintf(stderr, "Handback failed.\n"); 368| 0| } 369| 0| break; 370| 0| } 371| 0| handback_successful = true; 372| 0| ssl_handshake = ssl_handback.get(); 373| 5.18k| } else { 374| 5.18k| handshake_successful = ret == 1; 375| 5.18k| break; 376| 5.18k| } 377| 5.18k| } 378| | 379| 5.18k| if (debug_) { ------------------ | Branch (379:9): [True: 0, False: 5.18k] ------------------ 380| 0| if (!handshake_successful) { ------------------ | Branch (380:11): [True: 0, False: 0] ------------------ 381| 0| fprintf(stderr, "Handshake failed.\n"); 382| 0| } else if (handback_successful) { ------------------ | Branch (382:18): [True: 0, False: 0] ------------------ 383| 0| fprintf(stderr, "Handback successful.\n"); 384| 0| } 385| 0| } 386| | 387| 5.18k| if (handshake_successful) { ------------------ | Branch (387:9): [True: 1.74k, False: 3.44k] ------------------ 388| | // Keep reading application data until error or EOF. 389| 1.74k| uint8_t tmp[1024]; 390| 3.94k| for (;;) { 391| 3.94k| if (SSL_read(ssl_handshake, tmp, sizeof(tmp)) <= 0) { ------------------ | Branch (391:13): [True: 1.74k, False: 2.20k] ------------------ 392| 1.74k| break; 393| 1.74k| } 394| 3.94k| } 395| 1.74k| } 396| | 397| 5.18k| if (debug_) { ------------------ | Branch (397:9): [True: 0, False: 5.18k] ------------------ 398| 0| ERR_print_errors_fp(stderr); 399| 0| } 400| 5.18k| ERR_clear_error(); 401| 5.18k| return 0; 402| 9.52k| } client.cc:_ZN12_GLOBAL__N_19TLSFuzzer9SetupTestEP6cbs_st: 509| 9.52k| bssl::UniquePtr SetupTest(CBS *cbs) { 510| | // |ctx| is shared between runs, so we must clear any modifications to it 511| | // made later on in this function. 512| 9.52k| SSL_CTX_flush_sessions(ctx_.get(), 0); 513| 9.52k| handoff_ = {}; 514| 9.52k| handback_ = {}; 515| | 516| 9.52k| bssl::UniquePtr ssl(SSL_new(ctx_.get())); 517| 9.52k| if (role_ == kServer) { ------------------ | Branch (517:9): [True: 0, False: 9.52k] ------------------ 518| 0| SSL_set_accept_state(ssl.get()); 519| 9.52k| } else { 520| 9.52k| SSL_set_connect_state(ssl.get()); 521| 9.52k| } 522| | 523| 46.1k| for (;;) { 524| 46.1k| uint16_t tag; 525| 46.1k| if (!CBS_get_u16(cbs, &tag)) { ------------------ | Branch (525:11): [True: 1.80k, False: 44.3k] ------------------ 526| 1.80k| return nullptr; 527| 1.80k| } 528| 44.3k| switch (tag) { 529| 5.18k| case kDataTag: ------------------ | Branch (529:9): [True: 5.18k, False: 39.2k] ------------------ 530| 5.18k| return ssl; 531| | 532| 20.8k| case kSessionTag: { ------------------ | Branch (532:9): [True: 20.8k, False: 23.4k] ------------------ 533| 20.8k| CBS data; 534| 20.8k| if (!CBS_get_u24_length_prefixed(cbs, &data)) { ------------------ | Branch (534:15): [True: 177, False: 20.7k] ------------------ 535| 177| return nullptr; 536| 177| } 537| 20.7k| bssl::UniquePtr session(SSL_SESSION_from_bytes( 538| 20.7k| CBS_data(&data), CBS_len(&data), ctx_.get())); 539| 20.7k| if (!session) { ------------------ | Branch (539:15): [True: 2.20k, False: 18.5k] ------------------ 540| 2.20k| return nullptr; 541| 2.20k| } 542| | 543| 18.5k| if (role_ == kServer) { ------------------ | Branch (543:15): [True: 0, False: 18.5k] ------------------ 544| 0| SSL_CTX_add_session(ctx_.get(), session.get()); 545| 18.5k| } else { 546| 18.5k| SSL_set_session(ssl.get(), session.get()); 547| 18.5k| } 548| 18.5k| break; 549| 20.7k| } 550| | 551| 1| case kRequestClientCert: ------------------ | Branch (551:9): [True: 1, False: 44.3k] ------------------ 552| 1| if (role_ == kClient) { ------------------ | Branch (552:15): [True: 1, False: 0] ------------------ 553| 1| return nullptr; 554| 1| } 555| 0| SSL_set_verify(ssl.get(), SSL_VERIFY_PEER, nullptr); ------------------ | | 2635| 0|#define SSL_VERIFY_PEER 0x01 ------------------ 556| 0| break; 557| | 558| 478| case kHandoffTag: { ------------------ | Branch (558:9): [True: 478, False: 43.9k] ------------------ 559| 478| CBS handoff; 560| 478| if (!CBS_get_u24_length_prefixed(cbs, &handoff)) { ------------------ | Branch (560:15): [True: 7, False: 471] ------------------ 561| 7| return nullptr; 562| 7| } 563| 471| handoff_.assign(CBS_data(&handoff), 564| 471| CBS_data(&handoff) + CBS_len(&handoff)); 565| 471| bssl::SSL_set_handoff_mode(ssl.get(), 1); 566| 471| break; 567| 478| } 568| | 569| 2.52k| case kHandbackTag: { ------------------ | Branch (569:9): [True: 2.52k, False: 41.8k] ------------------ 570| 2.52k| CBS handback; 571| 2.52k| if (!CBS_get_u24_length_prefixed(cbs, &handback)) { ------------------ | Branch (571:15): [True: 10, False: 2.51k] ------------------ 572| 10| return nullptr; 573| 10| } 574| 2.51k| handback_.assign(CBS_data(&handback), 575| 2.51k| CBS_data(&handback) + CBS_len(&handback)); 576| 2.51k| bssl::SSL_set_handoff_mode(ssl.get(), 1); 577| 2.51k| break; 578| 2.52k| } 579| | 580| 15.1k| case kHintsTag: { ------------------ | Branch (580:9): [True: 15.1k, False: 29.2k] ------------------ 581| 15.1k| CBS hints; 582| 15.1k| if (!CBS_get_u24_length_prefixed(cbs, &hints)) { ------------------ | Branch (582:15): [True: 32, False: 15.1k] ------------------ 583| 32| return nullptr; 584| 32| } 585| 15.1k| SSL_set_handshake_hints(ssl.get(), CBS_data(&hints), CBS_len(&hints)); 586| 15.1k| break; 587| 15.1k| } 588| | 589| 113| default: ------------------ | Branch (589:9): [True: 113, False: 44.2k] ------------------ 590| 113| return nullptr; 591| 44.3k| } 592| 44.3k| } 593| 9.52k| } client.cc:_ZN12_GLOBAL__N_19TLSFuzzer7MakeBIOEPKhm: 600| 5.18k| bssl::UniquePtr MakeBIO(const uint8_t *in, size_t len) { 601| 5.18k| BIOData *b = new BIOData; 602| 5.18k| b->protocol = protocol_; 603| 5.18k| CBS_init(&b->cbs, in, len); 604| | 605| 5.18k| bssl::UniquePtr bio(BIO_new(BIOMethod())); 606| 5.18k| BIO_set_init(bio.get(), 1); 607| 5.18k| BIO_set_data(bio.get(), b); 608| 5.18k| return bio; 609| 5.18k| } client.cc:_ZN12_GLOBAL__N_19TLSFuzzer9BIOMethodEv: 636| 5.18k| static const BIO_METHOD *BIOMethod() { 637| 5.18k| static const BIO_METHOD *method = [] { 638| 5.18k| BIO_METHOD *ret = BIO_meth_new(0, nullptr); 639| 5.18k| BSSL_CHECK(ret); 640| 5.18k| BSSL_CHECK(BIO_meth_set_read(ret, BIORead)); 641| 5.18k| BSSL_CHECK(BIO_meth_set_destroy(ret, BIODestroy)); 642| 5.18k| return ret; 643| 5.18k| }(); 644| 5.18k| return method; 645| 5.18k| } client.cc:_ZZN12_GLOBAL__N_19TLSFuzzer9BIOMethodEvENKUlvE_clEv: 637| 1| static const BIO_METHOD *method = [] { 638| 1| BIO_METHOD *ret = BIO_meth_new(0, nullptr); 639| 1| BSSL_CHECK(ret); ------------------ | | 384| 1| do { \ | | 385| 1| if (!(condition)) { \ | | ------------------ | | | Branch (385:9): [True: 0, False: 1] | | ------------------ | | 386| 0| abort(); \ | | 387| 0| } \ | | 388| 1| } while (0); | | ------------------ | | | Branch (388:12): [Folded - Ignored] | | ------------------ ------------------ 640| 1| BSSL_CHECK(BIO_meth_set_read(ret, BIORead)); ------------------ | | 384| 1| do { \ | | 385| 1| if (!(condition)) { \ | | ------------------ | | | Branch (385:9): [True: 0, False: 1] | | ------------------ | | 386| 0| abort(); \ | | 387| 0| } \ | | 388| 1| } while (0); | | ------------------ | | | Branch (388:12): [Folded - Ignored] | | ------------------ ------------------ 641| 1| BSSL_CHECK(BIO_meth_set_destroy(ret, BIODestroy)); ------------------ | | 384| 1| do { \ | | 385| 1| if (!(condition)) { \ | | ------------------ | | | Branch (385:9): [True: 0, False: 1] | | ------------------ | | 386| 0| abort(); \ | | 387| 0| } \ | | 388| 1| } while (0); | | ------------------ | | | Branch (388:12): [Folded - Ignored] | | ------------------ ------------------ 642| 1| return ret; 643| 1| }(); client.cc:_ZN12_GLOBAL__N_19TLSFuzzer7BIOReadEP6bio_stPci: 611| 954k| static int BIORead(BIO *bio, char *out, int len) { 612| 954k| BIOData *b = reinterpret_cast(BIO_get_data(bio)); 613| 954k| if (b->protocol == kTLS) { ------------------ | Branch (613:9): [True: 954k, False: 0] ------------------ 614| 954k| len = std::min(static_cast(len), CBS_len(&b->cbs)); 615| 954k| memcpy(out, CBS_data(&b->cbs), len); 616| 954k| CBS_skip(&b->cbs, len); 617| 954k| return len; 618| 954k| } 619| | 620| | // Preserve packet boundaries for DTLS. 621| 0| CBS packet; 622| 0| if (!CBS_get_u24_length_prefixed(&b->cbs, &packet)) { ------------------ | Branch (622:9): [True: 0, False: 0] ------------------ 623| 0| return -1; 624| 0| } 625| 0| len = std::min(static_cast(len), CBS_len(&packet)); 626| 0| memcpy(out, CBS_data(&packet), len); 627| 0| return len; 628| 0| } client.cc:_ZN12_GLOBAL__N_19TLSFuzzer10BIODestroyEP6bio_st: 630| 5.18k| static int BIODestroy(BIO *bio) { 631| 5.18k| BIOData *b = reinterpret_cast(BIO_get_data(bio)); 632| 5.18k| delete b; 633| 5.18k| return 1; 634| 5.18k| } _ZN4bssl37tls13_get_cert_verify_signature_inputEPNS_13SSL_HANDSHAKEEPNS_5ArrayIhEENS_25ssl_cert_verify_context_tE: 58| 123| enum ssl_cert_verify_context_t cert_verify_context) { 59| 123| ScopedCBB cbb; 60| 123| if (!CBB_init(cbb.get(), 64 + 33 + 1 + 2 * EVP_MAX_MD_SIZE)) { ------------------ | | 121| 123|#define EVP_MAX_MD_SIZE 64 // SHA-512 is the longest so far. ------------------ | Branch (60:7): [True: 0, False: 123] ------------------ 61| 0| return false; 62| 0| } 63| | 64| 7.99k| for (size_t i = 0; i < 64; i++) { ------------------ | Branch (64:22): [True: 7.87k, False: 123] ------------------ 65| 7.87k| if (!CBB_add_u8(cbb.get(), 0x20)) { ------------------ | Branch (65:9): [True: 0, False: 7.87k] ------------------ 66| 0| return false; 67| 0| } 68| 7.87k| } 69| | 70| 123| Span context; 71| 123| if (cert_verify_context == ssl_cert_verify_server) { ------------------ | Branch (71:7): [True: 123, False: 0] ------------------ 72| 123| static const char kContext[] = "TLS 1.3, server CertificateVerify"; 73| 123| context = kContext; 74| 123| } else if (cert_verify_context == ssl_cert_verify_client) { ------------------ | Branch (74:14): [True: 0, False: 0] ------------------ 75| 0| static const char kContext[] = "TLS 1.3, client CertificateVerify"; 76| 0| context = kContext; 77| 0| } else if (cert_verify_context == ssl_cert_verify_channel_id) { ------------------ | Branch (77:14): [True: 0, False: 0] ------------------ 78| 0| static const char kContext[] = "TLS 1.3, Channel ID"; 79| 0| context = kContext; 80| 0| } else { 81| 0| return false; 82| 0| } 83| | 84| | // Note |context| includes the NUL byte separator. 85| 123| if (!CBB_add_bytes(cbb.get(), ------------------ | Branch (85:7): [True: 0, False: 123] ------------------ 86| 123| reinterpret_cast(context.data()), 87| 123| context.size())) { 88| 0| return false; 89| 0| } 90| | 91| 123| uint8_t context_hash[EVP_MAX_MD_SIZE]; 92| 123| size_t context_hash_len; 93| 123| if (!hs->transcript.GetHash(context_hash, &context_hash_len) || ------------------ | Branch (93:7): [True: 0, False: 123] ------------------ 94| 123| !CBB_add_bytes(cbb.get(), context_hash, context_hash_len) || ------------------ | Branch (94:7): [True: 0, False: 123] ------------------ 95| 123| !CBBFinishArray(cbb.get(), out)) { ------------------ | Branch (95:7): [True: 0, False: 123] ------------------ 96| 0| return false; 97| 0| } 98| | 99| 123| return true; 100| 123|} _ZN4bssl25tls13_process_certificateEPNS_13SSL_HANDSHAKEERKNS_10SSLMessageEb: 103| 187| bool allow_anonymous) { 104| 187| SSL *const ssl = hs->ssl; 105| 187| CBS body = msg.body; 106| 187| bssl::UniquePtr decompressed; 107| | 108| 187| if (msg.type == SSL3_MT_COMPRESSED_CERTIFICATE) { ------------------ | | 210| 187|#define SSL3_MT_COMPRESSED_CERTIFICATE 25 ------------------ | Branch (108:7): [True: 18, False: 169] ------------------ 109| 18| CBS compressed; 110| 18| uint16_t alg_id; 111| 18| uint32_t uncompressed_len; 112| | 113| 18| if (!CBS_get_u16(&body, &alg_id) || ------------------ | Branch (113:9): [True: 1, False: 17] ------------------ 114| 18| !CBS_get_u24(&body, &uncompressed_len) || ------------------ | Branch (114:9): [True: 1, False: 16] ------------------ 115| 18| !CBS_get_u24_length_prefixed(&body, &compressed) || ------------------ | Branch (115:9): [True: 1, False: 15] ------------------ 116| 18| CBS_len(&body) != 0) { ------------------ | Branch (116:9): [True: 2, False: 13] ------------------ 117| 5| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 176| 5|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 4382| 5|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 5|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 118| 5| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); ------------------ | | 361| 5| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 119| 5| return false; 120| 5| } 121| | 122| 13| if (uncompressed_len > ssl->max_cert_list) { ------------------ | Branch (122:9): [True: 12, False: 1] ------------------ 123| 12| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 176| 12|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 4379| 12|#define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER | | ------------------ | | | | 189| 12|#define SSL3_AD_ILLEGAL_PARAMETER 47 // fatal | | ------------------ ------------------ 124| 12| OPENSSL_PUT_ERROR(SSL, SSL_R_UNCOMPRESSED_CERT_TOO_LARGE); ------------------ | | 361| 12| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 125| 12| ERR_add_error_dataf("requested=%u", 126| 12| static_cast(uncompressed_len)); 127| 12| return false; 128| 12| } 129| | 130| 1| ssl_cert_decompression_func_t decompress = nullptr; 131| 1| for (const auto &alg : ssl->ctx->cert_compression_algs) { ------------------ | Branch (131:26): [True: 0, False: 1] ------------------ 132| 0| if (alg.alg_id == alg_id) { ------------------ | Branch (132:11): [True: 0, False: 0] ------------------ 133| 0| decompress = alg.decompress; 134| 0| break; 135| 0| } 136| 0| } 137| | 138| 1| if (decompress == nullptr) { ------------------ | Branch (138:9): [True: 1, False: 0] ------------------ 139| 1| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 176| 1|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 4379| 1|#define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER | | ------------------ | | | | 189| 1|#define SSL3_AD_ILLEGAL_PARAMETER 47 // fatal | | ------------------ ------------------ 140| 1| OPENSSL_PUT_ERROR(SSL, SSL_R_UNKNOWN_CERT_COMPRESSION_ALG); ------------------ | | 361| 1| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 141| 1| ERR_add_error_dataf("alg=%d", static_cast(alg_id)); 142| 1| return false; 143| 1| } 144| | 145| 0| CRYPTO_BUFFER *decompressed_ptr = nullptr; 146| 0| if (!decompress(ssl, &decompressed_ptr, uncompressed_len, ------------------ | Branch (146:9): [True: 0, False: 0] ------------------ 147| 0| CBS_data(&compressed), CBS_len(&compressed))) { 148| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 4382| 0|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 0|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 149| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_CERT_DECOMPRESSION_FAILED); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 150| 0| ERR_add_error_dataf("alg=%d", static_cast(alg_id)); 151| 0| return false; 152| 0| } 153| 0| decompressed.reset(decompressed_ptr); 154| | 155| 0| if (CRYPTO_BUFFER_len(decompressed_ptr) != uncompressed_len) { ------------------ | Branch (155:9): [True: 0, False: 0] ------------------ 156| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 4382| 0|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 0|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 157| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_CERT_DECOMPRESSION_FAILED); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 158| 0| ERR_add_error_dataf( 159| 0| "alg=%d got=%u expected=%u", static_cast(alg_id), 160| 0| static_cast(CRYPTO_BUFFER_len(decompressed_ptr)), 161| 0| static_cast(uncompressed_len)); 162| 0| return false; 163| 0| } 164| | 165| 0| CBS_init(&body, CRYPTO_BUFFER_data(decompressed_ptr), 166| 0| CRYPTO_BUFFER_len(decompressed_ptr)); 167| 169| } else { 168| 169| assert(msg.type == SSL3_MT_CERTIFICATE); 169| 169| } 170| | 171| 169| CBS context, certificate_list; 172| 169| if (!CBS_get_u8_length_prefixed(&body, &context) || // ------------------ | Branch (172:7): [True: 1, False: 168] ------------------ 173| 169| CBS_len(&context) != 0 || // ------------------ | Branch (173:7): [True: 7, False: 161] ------------------ 174| 169| !CBS_get_u24_length_prefixed(&body, &certificate_list) || // ------------------ | Branch (174:7): [True: 1, False: 160] ------------------ 175| 169| CBS_len(&body) != 0) { ------------------ | Branch (175:7): [True: 5, False: 155] ------------------ 176| 14| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 176| 14|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 4382| 14|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 14|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 177| 14| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); ------------------ | | 361| 14| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 178| 14| return false; 179| 14| } 180| | 181| 155| UniquePtr certs(sk_CRYPTO_BUFFER_new_null()); 182| 155| if (!certs) { ------------------ | Branch (182:7): [True: 0, False: 155] ------------------ 183| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); ------------------ | | 4387| 0|#define SSL_AD_INTERNAL_ERROR TLS1_AD_INTERNAL_ERROR | | ------------------ | | | | 37| 0|#define TLS1_AD_INTERNAL_ERROR 80 | | ------------------ ------------------ 184| 0| return false; 185| 0| } 186| | 187| 155| const bool retain_sha256 = 188| 155| ssl->server && hs->config->retain_only_sha256_of_client_certs; ------------------ | Branch (188:7): [True: 0, False: 155] | Branch (188:22): [True: 0, False: 0] ------------------ 189| 155| UniquePtr pkey; 190| 293| while (CBS_len(&certificate_list) > 0) { ------------------ | Branch (190:10): [True: 154, False: 139] ------------------ 191| 154| CBS certificate, extensions; 192| 154| if (!CBS_get_u24_length_prefixed(&certificate_list, &certificate) || ------------------ | Branch (192:9): [True: 1, False: 153] ------------------ 193| 154| !CBS_get_u16_length_prefixed(&certificate_list, &extensions) || ------------------ | Branch (193:9): [True: 1, False: 152] ------------------ 194| 154| CBS_len(&certificate) == 0) { ------------------ | Branch (194:9): [True: 1, False: 151] ------------------ 195| 3| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 176| 3|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 4382| 3|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 3|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 196| 3| OPENSSL_PUT_ERROR(SSL, SSL_R_CERT_LENGTH_MISMATCH); ------------------ | | 361| 3| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 197| 3| return false; 198| 3| } 199| | 200| 151| const bool is_leaf = sk_CRYPTO_BUFFER_num(certs.get()) == 0; 201| 151| if (is_leaf) { ------------------ | Branch (201:9): [True: 151, False: 0] ------------------ 202| 151| pkey = ssl_cert_parse_pubkey(&certificate); 203| 151| if (!pkey) { ------------------ | Branch (203:11): [True: 3, False: 148] ------------------ 204| 3| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 176| 3|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 4382| 3|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 3|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 205| 3| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); ------------------ | | 361| 3| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 206| 3| return false; 207| 3| } 208| | // TLS 1.3 always uses certificate keys for signing thus the correct 209| | // keyUsage is enforced. 210| 148| if (!ssl_cert_check_key_usage(&certificate, ------------------ | Branch (210:11): [True: 10, False: 138] ------------------ 211| 148| key_usage_digital_signature)) { 212| 10| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 176| 10|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 4379| 10|#define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER | | ------------------ | | | | 189| 10|#define SSL3_AD_ILLEGAL_PARAMETER 47 // fatal | | ------------------ ------------------ 213| 10| return false; 214| 10| } 215| | 216| 138| if (retain_sha256) { ------------------ | Branch (216:11): [True: 0, False: 138] ------------------ 217| | // Retain the hash of the leaf certificate if requested. 218| 0| SHA256(CBS_data(&certificate), CBS_len(&certificate), 219| 0| hs->new_session->peer_sha256); 220| 0| } 221| 138| } 222| | 223| 138| UniquePtr buf( 224| 138| CRYPTO_BUFFER_new_from_CBS(&certificate, ssl->ctx->pool)); 225| 138| if (!buf || // ------------------ | Branch (225:9): [True: 0, False: 138] | Branch (225:9): [True: 0, False: 138] ------------------ 226| 138| !PushToStack(certs.get(), std::move(buf))) { ------------------ | Branch (226:9): [True: 0, False: 138] ------------------ 227| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); ------------------ | | 4387| 0|#define SSL_AD_INTERNAL_ERROR TLS1_AD_INTERNAL_ERROR | | ------------------ | | | | 37| 0|#define TLS1_AD_INTERNAL_ERROR 80 | | ------------------ ------------------ 228| 0| return false; 229| 0| } 230| | 231| | // Parse out the extensions. 232| 138| SSLExtension status_request( 233| 138| TLSEXT_TYPE_status_request, ------------------ | | 53| 138|#define TLSEXT_TYPE_status_request 5 ------------------ 234| 138| !ssl->server && hs->config->ocsp_stapling_enabled); ------------------ | Branch (234:9): [True: 138, False: 0] | Branch (234:25): [True: 138, False: 0] ------------------ 235| 138| SSLExtension sct( 236| 138| TLSEXT_TYPE_certificate_timestamp, ------------------ | | 127| 138|#define TLSEXT_TYPE_certificate_timestamp 18 ------------------ 237| 138| !ssl->server && hs->config->signed_cert_timestamps_enabled); ------------------ | Branch (237:9): [True: 138, False: 0] | Branch (237:25): [True: 138, False: 0] ------------------ 238| 138| SSLExtension trust_anchors( 239| 138| TLSEXT_TYPE_trust_anchors, ------------------ | | 138| 138|#define TLSEXT_TYPE_trust_anchors 0xca34 ------------------ 240| 138| !ssl->server && is_leaf && ------------------ | Branch (240:9): [True: 138, False: 0] | Branch (240:25): [True: 138, False: 0] ------------------ 241| 138| hs->config->requested_trust_anchors.has_value()); ------------------ | Branch (241:13): [True: 0, False: 138] ------------------ 242| 138| uint8_t alert = SSL_AD_DECODE_ERROR; ------------------ | | 4382| 138|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 138|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 243| 138| if (!ssl_parse_extensions(&extensions, &alert, ------------------ | Branch (243:9): [True: 0, False: 138] ------------------ 244| 138| {&status_request, &sct, &trust_anchors}, 245| 138| /*ignore_unknown=*/false)) { 246| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, alert); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ 247| 0| return false; 248| 0| } 249| | 250| | // All Certificate extensions are parsed, but only the leaf extensions are 251| | // stored. 252| 138| if (status_request.present) { ------------------ | Branch (252:9): [True: 0, False: 138] ------------------ 253| 0| uint8_t status_type; 254| 0| CBS ocsp_response; 255| 0| if (!CBS_get_u8(&status_request.data, &status_type) || ------------------ | Branch (255:11): [True: 0, False: 0] ------------------ 256| 0| status_type != TLSEXT_STATUSTYPE_ocsp || ------------------ | | 145| 0|#define TLSEXT_STATUSTYPE_ocsp 1 ------------------ | Branch (256:11): [True: 0, False: 0] ------------------ 257| 0| !CBS_get_u24_length_prefixed(&status_request.data, &ocsp_response) || ------------------ | Branch (257:11): [True: 0, False: 0] ------------------ 258| 0| CBS_len(&ocsp_response) == 0 || CBS_len(&status_request.data) != 0) { ------------------ | Branch (258:11): [True: 0, False: 0] | Branch (258:43): [True: 0, False: 0] ------------------ 259| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 4382| 0|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 0|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 260| 0| return false; 261| 0| } 262| | 263| 0| if (sk_CRYPTO_BUFFER_num(certs.get()) == 1) { ------------------ | Branch (263:11): [True: 0, False: 0] ------------------ 264| 0| hs->new_session->ocsp_response.reset( 265| 0| CRYPTO_BUFFER_new_from_CBS(&ocsp_response, ssl->ctx->pool)); 266| 0| if (hs->new_session->ocsp_response == nullptr) { ------------------ | Branch (266:13): [True: 0, False: 0] ------------------ 267| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); ------------------ | | 4387| 0|#define SSL_AD_INTERNAL_ERROR TLS1_AD_INTERNAL_ERROR | | ------------------ | | | | 37| 0|#define TLS1_AD_INTERNAL_ERROR 80 | | ------------------ ------------------ 268| 0| return false; 269| 0| } 270| 0| } 271| 0| } 272| | 273| 138| if (sct.present) { ------------------ | Branch (273:9): [True: 0, False: 138] ------------------ 274| 0| if (!ssl_is_sct_list_valid(&sct.data)) { ------------------ | Branch (274:11): [True: 0, False: 0] ------------------ 275| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_ERROR_PARSING_EXTENSION); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 276| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 4382| 0|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 0|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 277| 0| return false; 278| 0| } 279| | 280| 0| if (sk_CRYPTO_BUFFER_num(certs.get()) == 1) { ------------------ | Branch (280:11): [True: 0, False: 0] ------------------ 281| 0| hs->new_session->signed_cert_timestamp_list.reset( 282| 0| CRYPTO_BUFFER_new_from_CBS(&sct.data, ssl->ctx->pool)); 283| 0| if (hs->new_session->signed_cert_timestamp_list == nullptr) { ------------------ | Branch (283:13): [True: 0, False: 0] ------------------ 284| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); ------------------ | | 4387| 0|#define SSL_AD_INTERNAL_ERROR TLS1_AD_INTERNAL_ERROR | | ------------------ | | | | 37| 0|#define TLS1_AD_INTERNAL_ERROR 80 | | ------------------ ------------------ 285| 0| return false; 286| 0| } 287| 0| } 288| 0| } 289| | 290| 138| if (trust_anchors.present) { ------------------ | Branch (290:9): [True: 0, False: 138] ------------------ 291| 0| if (CBS_len(&trust_anchors.data) != 0) { ------------------ | Branch (291:11): [True: 0, False: 0] ------------------ 292| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_ERROR_PARSING_EXTENSION); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 293| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 4382| 0|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 0|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 294| 0| return false; 295| 0| } 296| 0| hs->peer_matched_trust_anchor = true; 297| 0| } 298| 138| } 299| | 300| | // Store a null certificate list rather than an empty one if the peer didn't 301| | // send certificates. 302| 139| if (sk_CRYPTO_BUFFER_num(certs.get()) == 0) { ------------------ | Branch (302:7): [True: 1, False: 138] ------------------ 303| 1| certs.reset(); 304| 1| } 305| | 306| 139| hs->peer_pubkey = std::move(pkey); 307| 139| hs->new_session->certs = std::move(certs); 308| | 309| 139| if (!ssl->ctx->x509_method->session_cache_objects(hs->new_session.get())) { ------------------ | Branch (309:7): [True: 2, False: 137] ------------------ 310| 2| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); ------------------ | | 361| 2| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 311| 2| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 176| 2|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 4382| 2|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 2|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 312| 2| return false; 313| 2| } 314| | 315| 137| if (sk_CRYPTO_BUFFER_num(hs->new_session->certs.get()) == 0) { ------------------ | Branch (315:7): [True: 1, False: 136] ------------------ 316| 1| if (!allow_anonymous) { ------------------ | Branch (316:9): [True: 1, False: 0] ------------------ 317| 1| OPENSSL_PUT_ERROR(SSL, SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE); ------------------ | | 361| 1| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 318| 1| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_CERTIFICATE_REQUIRED); ------------------ | | 176| 1|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_CERTIFICATE_REQUIRED); ------------------ | | 4399| 1|#define SSL_AD_CERTIFICATE_REQUIRED TLS1_AD_CERTIFICATE_REQUIRED | | ------------------ | | | | 47| 1|#define TLS1_AD_CERTIFICATE_REQUIRED 116 | | ------------------ ------------------ 319| 1| return false; 320| 1| } 321| | 322| | // OpenSSL returns X509_V_OK when no certificates are requested. This is 323| | // classed by them as a bug, but it's assumed by at least NGINX. 324| 0| hs->new_session->verify_result = X509_V_OK; ------------------ | | 3013| 0|#define X509_V_OK 0 ------------------ 325| | 326| | // No certificate, so nothing more to do. 327| 0| return true; 328| 1| } 329| | 330| 136| hs->new_session->peer_sha256_valid = retain_sha256; 331| 136| return true; 332| 137|} _ZN4bssl32tls13_process_certificate_verifyEPNS_13SSL_HANDSHAKEERKNS_10SSLMessageE: 335| 128| const SSLMessage &msg) { 336| 128| SSL *const ssl = hs->ssl; 337| 128| if (hs->peer_pubkey == NULL) { ------------------ | Branch (337:7): [True: 0, False: 128] ------------------ 338| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 339| 0| return false; 340| 0| } 341| | 342| 128| CBS body = msg.body, signature; 343| 128| uint16_t signature_algorithm; 344| 128| if (!CBS_get_u16(&body, &signature_algorithm) || // ------------------ | Branch (344:7): [True: 1, False: 127] ------------------ 345| 128| !CBS_get_u16_length_prefixed(&body, &signature) || // ------------------ | Branch (345:7): [True: 1, False: 126] ------------------ 346| 128| CBS_len(&body) != 0) { ------------------ | Branch (346:7): [True: 1, False: 125] ------------------ 347| 3| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); ------------------ | | 361| 3| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 348| 3| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 176| 3|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 4382| 3|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 3|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 349| 3| return false; 350| 3| } 351| | 352| 125| uint8_t alert = SSL_AD_DECODE_ERROR; ------------------ | | 4382| 125|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 125|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 353| 125| if (!tls12_check_peer_sigalg(hs, &alert, signature_algorithm, ------------------ | Branch (353:7): [True: 2, False: 123] ------------------ 354| 125| hs->peer_pubkey.get())) { 355| 2| ssl_send_alert(ssl, SSL3_AL_FATAL, alert); ------------------ | | 176| 2|#define SSL3_AL_FATAL 2 ------------------ 356| 2| return false; 357| 2| } 358| 123| hs->new_session->peer_signature_algorithm = signature_algorithm; 359| | 360| 123| Array input; 361| 123| if (!tls13_get_cert_verify_signature_input( ------------------ | Branch (361:7): [True: 0, False: 123] ------------------ 362| 123| hs, &input, 363| 123| ssl->server ? ssl_cert_verify_client : ssl_cert_verify_server)) { ------------------ | Branch (363:11): [True: 0, False: 123] ------------------ 364| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); ------------------ | | 4387| 0|#define SSL_AD_INTERNAL_ERROR TLS1_AD_INTERNAL_ERROR | | ------------------ | | | | 37| 0|#define TLS1_AD_INTERNAL_ERROR 80 | | ------------------ ------------------ 365| 0| return false; 366| 0| } 367| | 368| 123| if (!ssl_public_key_verify(ssl, signature, signature_algorithm, ------------------ | Branch (368:7): [True: 0, False: 123] ------------------ 369| 123| hs->peer_pubkey.get(), input)) { 370| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_SIGNATURE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 371| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECRYPT_ERROR); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECRYPT_ERROR); ------------------ | | 4383| 0|#define SSL_AD_DECRYPT_ERROR TLS1_AD_DECRYPT_ERROR | | ------------------ | | | | 33| 0|#define TLS1_AD_DECRYPT_ERROR 51 | | ------------------ ------------------ 372| 0| return false; 373| 0| } 374| | 375| 123| return true; 376| 123|} _ZN4bssl22tls13_process_finishedEPNS_13SSL_HANDSHAKEERKNS_10SSLMessageEb: 379| 115| bool use_saved_value) { 380| 115| SSL *const ssl = hs->ssl; 381| 115| uint8_t verify_data_buf[EVP_MAX_MD_SIZE]; 382| 115| Span verify_data; 383| 115| if (use_saved_value) { ------------------ | Branch (383:7): [True: 0, False: 115] ------------------ 384| 0| assert(ssl->server); 385| 0| verify_data = hs->expected_client_finished; 386| 115| } else { 387| 115| size_t len; 388| 115| if (!tls13_finished_mac(hs, verify_data_buf, &len, !ssl->server)) { ------------------ | Branch (388:9): [True: 0, False: 115] ------------------ 389| 0| return false; 390| 0| } 391| 115| verify_data = Span(verify_data_buf, len); 392| 115| } 393| | 394| 115| bool finished_ok = 395| 115| CBS_mem_equal(&msg.body, verify_data.data(), verify_data.size()); 396| 115| if (CRYPTO_fuzzer_mode_enabled()) { ------------------ | Branch (396:7): [True: 115, False: 0] ------------------ 397| 115| finished_ok = true; 398| 115| } 399| 115| if (!finished_ok) { ------------------ | Branch (399:7): [True: 0, False: 115] ------------------ 400| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECRYPT_ERROR); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECRYPT_ERROR); ------------------ | | 4383| 0|#define SSL_AD_DECRYPT_ERROR TLS1_AD_DECRYPT_ERROR | | ------------------ | | | | 33| 0|#define TLS1_AD_DECRYPT_ERROR 51 | | ------------------ ------------------ 401| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_DIGEST_CHECK_FAILED); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 402| 0| return false; 403| 0| } 404| | 405| 115| return true; 406| 115|} _ZN4bssl18tls13_add_finishedEPNS_13SSL_HANDSHAKEE: 624| 114|bool tls13_add_finished(SSL_HANDSHAKE *hs) { 625| 114| SSL *const ssl = hs->ssl; 626| 114| size_t verify_data_len; 627| 114| uint8_t verify_data[EVP_MAX_MD_SIZE]; 628| | 629| 114| if (!tls13_finished_mac(hs, verify_data, &verify_data_len, ssl->server)) { ------------------ | Branch (629:7): [True: 0, False: 114] ------------------ 630| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); ------------------ | | 4387| 0|#define SSL_AD_INTERNAL_ERROR TLS1_AD_INTERNAL_ERROR | | ------------------ | | | | 37| 0|#define TLS1_AD_INTERNAL_ERROR 80 | | ------------------ ------------------ 631| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_DIGEST_CHECK_FAILED); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 632| 0| return false; 633| 0| } 634| | 635| 114| ScopedCBB cbb; 636| 114| CBB body; 637| 114| if (!ssl->method->init_message(ssl, cbb.get(), &body, SSL3_MT_FINISHED) || ------------------ | | 206| 114|#define SSL3_MT_FINISHED 20 ------------------ | Branch (637:7): [True: 0, False: 114] ------------------ 638| 114| !CBB_add_bytes(&body, verify_data, verify_data_len) || ------------------ | Branch (638:7): [True: 0, False: 114] ------------------ 639| 114| !ssl_add_message_cbb(ssl, cbb.get())) { ------------------ | Branch (639:7): [True: 0, False: 114] ------------------ 640| 0| return false; 641| 0| } 642| | 643| 114| return true; 644| 114|} _ZN4bssl20tls13_post_handshakeEP6ssl_stRKNS_10SSLMessageE: 707| 1.49k|bool tls13_post_handshake(SSL *ssl, const SSLMessage &msg) { 708| 1.49k| if (msg.type == SSL3_MT_NEW_SESSION_TICKET && !ssl->server) { ------------------ | | 197| 2.98k|#define SSL3_MT_NEW_SESSION_TICKET 4 ------------------ | Branch (708:7): [True: 1.48k, False: 8] | Branch (708:49): [True: 1.48k, False: 0] ------------------ 709| 1.48k| return tls13_process_new_session_ticket(ssl, msg); 710| 1.48k| } 711| | 712| 8| if (msg.type == SSL3_MT_KEY_UPDATE) { ------------------ | | 209| 8|#define SSL3_MT_KEY_UPDATE 24 ------------------ | Branch (712:7): [True: 5, False: 3] ------------------ 713| 5| ssl->s3->key_update_count++; 714| 5| if (SSL_is_quic(ssl) || ssl->s3->key_update_count > kMaxKeyUpdates) { ------------------ | Branch (714:9): [True: 0, False: 5] | Branch (714:29): [True: 0, False: 5] ------------------ 715| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_TOO_MANY_KEY_UPDATES); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 716| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE); ------------------ | | 4367| 0|#define SSL_AD_UNEXPECTED_MESSAGE SSL3_AD_UNEXPECTED_MESSAGE | | ------------------ | | | | 179| 0|#define SSL3_AD_UNEXPECTED_MESSAGE 10 // fatal | | ------------------ ------------------ 717| 0| return false; 718| 0| } 719| | 720| 5| return tls13_receive_key_update(ssl, msg); 721| 5| } 722| | 723| 3| ssl->s3->key_update_count = 0; 724| | 725| 3| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE); ------------------ | | 176| 3|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE); ------------------ | | 4367| 3|#define SSL_AD_UNEXPECTED_MESSAGE SSL3_AD_UNEXPECTED_MESSAGE | | ------------------ | | | | 179| 3|#define SSL3_AD_UNEXPECTED_MESSAGE 10 // fatal | | ------------------ ------------------ 726| 3| OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_MESSAGE); ------------------ | | 361| 3| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 727| 3| return false; 728| 8|} tls13_both.cc:_ZN4bsslL24tls13_receive_key_updateEP6ssl_stRKNS_10SSLMessageE: 682| 5|static bool tls13_receive_key_update(SSL *ssl, const SSLMessage &msg) { 683| 5| CBS body = msg.body; 684| 5| uint8_t key_update_request; 685| 5| if (!CBS_get_u8(&body, &key_update_request) || // ------------------ | Branch (685:7): [True: 1, False: 4] ------------------ 686| 5| CBS_len(&body) != 0 || // ------------------ | Branch (686:7): [True: 1, False: 3] ------------------ 687| 5| (key_update_request != SSL_KEY_UPDATE_NOT_REQUESTED && // ------------------ | | 316| 6|#define SSL_KEY_UPDATE_NOT_REQUESTED 0 ------------------ | Branch (687:8): [True: 2, False: 1] ------------------ 688| 3| key_update_request != SSL_KEY_UPDATE_REQUESTED)) { ------------------ | | 312| 2|#define SSL_KEY_UPDATE_REQUESTED 1 ------------------ | Branch (688:8): [True: 1, False: 1] ------------------ 689| 3| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); ------------------ | | 361| 3| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 690| 3| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 176| 3|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 4382| 3|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 3|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 691| 3| return false; 692| 3| } 693| | 694| 2| if (!tls13_rotate_traffic_key(ssl, evp_aead_open)) { ------------------ | Branch (694:7): [True: 2, False: 0] ------------------ 695| 2| return false; 696| 2| } 697| | 698| | // Acknowledge the KeyUpdate 699| 0| if (key_update_request == SSL_KEY_UPDATE_REQUESTED && ------------------ | | 312| 0|#define SSL_KEY_UPDATE_REQUESTED 1 ------------------ | Branch (699:7): [True: 0, False: 0] ------------------ 700| 0| !tls13_add_key_update(ssl, SSL_KEY_UPDATE_NOT_REQUESTED)) { ------------------ | | 316| 0|#define SSL_KEY_UPDATE_NOT_REQUESTED 0 ------------------ | Branch (700:7): [True: 0, False: 0] ------------------ 701| 0| return false; 702| 0| } 703| | 704| 0| return true; 705| 0|} _ZN4bssl22tls13_client_handshakeEPNS_13SSL_HANDSHAKEE: 1028| 2.81k|enum ssl_hs_wait_t tls13_client_handshake(SSL_HANDSHAKE *hs) { 1029| 4.52k| while (hs->tls13_state != state_done) { ------------------ | Branch (1029:10): [True: 4.41k, False: 114] ------------------ 1030| 4.41k| enum ssl_hs_wait_t ret = ssl_hs_error; 1031| 4.41k| enum client_hs_state_t state = 1032| 4.41k| static_cast(hs->tls13_state); 1033| 4.41k| switch (state) { ------------------ | Branch (1033:13): [True: 0, False: 4.41k] ------------------ 1034| 444| case state_read_hello_retry_request: ------------------ | Branch (1034:7): [True: 444, False: 3.96k] ------------------ 1035| 444| ret = do_read_hello_retry_request(hs); 1036| 444| break; 1037| 96| case state_send_second_client_hello: ------------------ | Branch (1037:7): [True: 96, False: 4.31k] ------------------ 1038| 96| ret = do_send_second_client_hello(hs); 1039| 96| break; 1040| 1.58k| case state_read_server_hello: ------------------ | Branch (1040:7): [True: 1.58k, False: 2.82k] ------------------ 1041| 1.58k| ret = do_read_server_hello(hs); 1042| 1.58k| break; 1043| 513| case state_read_encrypted_extensions: ------------------ | Branch (1043:7): [True: 513, False: 3.89k] ------------------ 1044| 513| ret = do_read_encrypted_extensions(hs); 1045| 513| break; 1046| 504| case state_read_certificate_request: ------------------ | Branch (1046:7): [True: 504, False: 3.90k] ------------------ 1047| 504| ret = do_read_certificate_request(hs); 1048| 504| break; 1049| 189| case state_read_server_certificate: ------------------ | Branch (1049:7): [True: 189, False: 4.22k] ------------------ 1050| 189| ret = do_read_server_certificate(hs); 1051| 189| break; 1052| 324| case state_read_server_certificate_verify: ------------------ | Branch (1052:7): [True: 324, False: 4.08k] ------------------ 1053| 324| ret = do_read_server_certificate_verify(hs); 1054| 324| break; 1055| 0| case state_server_certificate_reverify: ------------------ | Branch (1055:7): [True: 0, False: 4.41k] ------------------ 1056| 0| ret = do_server_certificate_reverify(hs); 1057| 0| break; 1058| 298| case state_read_server_finished: ------------------ | Branch (1058:7): [True: 298, False: 4.11k] ------------------ 1059| 298| ret = do_read_server_finished(hs); 1060| 298| break; 1061| 114| case state_send_end_of_early_data: ------------------ | Branch (1061:7): [True: 114, False: 4.29k] ------------------ 1062| 114| ret = do_send_end_of_early_data(hs); 1063| 114| break; 1064| 114| case state_send_client_certificate: ------------------ | Branch (1064:7): [True: 114, False: 4.29k] ------------------ 1065| 114| ret = do_send_client_certificate(hs); 1066| 114| break; 1067| 114| case state_send_client_encrypted_extensions: ------------------ | Branch (1067:7): [True: 114, False: 4.29k] ------------------ 1068| 114| ret = do_send_client_encrypted_extensions(hs); 1069| 114| break; 1070| 0| case state_send_client_certificate_verify: ------------------ | Branch (1070:7): [True: 0, False: 4.41k] ------------------ 1071| 0| ret = do_send_client_certificate_verify(hs); 1072| 0| break; 1073| 114| case state_complete_second_flight: ------------------ | Branch (1073:7): [True: 114, False: 4.29k] ------------------ 1074| 114| ret = do_complete_second_flight(hs); 1075| 114| break; 1076| 0| case state_done: ------------------ | Branch (1076:7): [True: 0, False: 4.41k] ------------------ 1077| 0| ret = ssl_hs_ok; 1078| 0| break; 1079| 4.41k| } 1080| | 1081| 4.41k| if (hs->tls13_state != state) { ------------------ | Branch (1081:9): [True: 1.92k, False: 2.48k] ------------------ 1082| 1.92k| ssl_do_info_callback(hs->ssl, SSL_CB_CONNECT_LOOP, 1); ------------------ | | 5029| 1.92k|#define SSL_CB_CONNECT_LOOP (SSL_ST_CONNECT | SSL_CB_LOOP) | | ------------------ | | | | 5006| 1.92k|#define SSL_ST_CONNECT 0x1000 | | ------------------ | | #define SSL_CB_CONNECT_LOOP (SSL_ST_CONNECT | SSL_CB_LOOP) | | ------------------ | | | | 5020| 1.92k|#define SSL_CB_LOOP 0x01 | | ------------------ ------------------ 1083| 1.92k| } 1084| | 1085| 4.41k| if (ret != ssl_hs_ok) { ------------------ | Branch (1085:9): [True: 2.69k, False: 1.71k] ------------------ 1086| 2.69k| return ret; 1087| 2.69k| } 1088| 4.41k| } 1089| | 1090| 114| return ssl_hs_ok; 1091| 2.81k|} _ZN4bssl32tls13_process_new_session_ticketEP6ssl_stRKNS_10SSLMessageE: 1132| 1.48k|bool tls13_process_new_session_ticket(SSL *ssl, const SSLMessage &msg) { 1133| 1.48k| if (ssl->s3->write_shutdown != ssl_shutdown_none) { ------------------ | Branch (1133:7): [True: 0, False: 1.48k] ------------------ 1134| | // Ignore tickets on shutdown. Callers tend to indiscriminately call 1135| | // |SSL_shutdown| before destroying an |SSL|, at which point calling the new 1136| | // session callback may be confusing. 1137| 0| return true; 1138| 0| } 1139| | 1140| 1.48k| CBS body = msg.body; 1141| 1.48k| UniquePtr session = tls13_create_session_with_ticket(ssl, &body); 1142| 1.48k| if (!session) { ------------------ | Branch (1142:7): [True: 16, False: 1.47k] ------------------ 1143| 16| return false; 1144| 16| } 1145| | 1146| 1.47k| if ((ssl->session_ctx->session_cache_mode & SSL_SESS_CACHE_CLIENT) && ------------------ | | 2119| 1.47k|#define SSL_SESS_CACHE_CLIENT 0x0001 ------------------ | Branch (1146:7): [True: 0, False: 1.47k] ------------------ 1147| 1.47k| ssl->session_ctx->new_session_cb != NULL && ------------------ | Branch (1147:7): [True: 0, False: 0] ------------------ 1148| 1.47k| ssl->session_ctx->new_session_cb(ssl, session.get())) { ------------------ | Branch (1148:7): [True: 0, False: 0] ------------------ 1149| | // |new_session_cb|'s return value signals that it took ownership. 1150| 0| session.release(); 1151| 0| } 1152| | 1153| 1.47k| return true; 1154| 1.48k|} _ZN4bssl32tls13_create_session_with_ticketEP6ssl_stP6cbs_st: 1156| 1.48k|UniquePtr tls13_create_session_with_ticket(SSL *ssl, CBS *body) { 1157| 1.48k| UniquePtr session = SSL_SESSION_dup( 1158| 1.48k| ssl->s3->established_session.get(), SSL_SESSION_INCLUDE_NONAUTH); ------------------ | | 3457| 1.48k|#define SSL_SESSION_INCLUDE_NONAUTH 0x2 ------------------ 1159| 1.48k| if (!session) { ------------------ | Branch (1159:7): [True: 0, False: 1.48k] ------------------ 1160| 0| return nullptr; 1161| 0| } 1162| | 1163| 1.48k| ssl_session_rebase_time(ssl, session.get()); 1164| | 1165| 1.48k| uint32_t server_timeout; 1166| 1.48k| CBS ticket_nonce, ticket, extensions; 1167| 1.48k| if (!CBS_get_u32(body, &server_timeout) || ------------------ | Branch (1167:7): [True: 1, False: 1.48k] ------------------ 1168| 1.48k| !CBS_get_u32(body, &session->ticket_age_add) || ------------------ | Branch (1168:7): [True: 1, False: 1.48k] ------------------ 1169| 1.48k| !CBS_get_u8_length_prefixed(body, &ticket_nonce) || ------------------ | Branch (1169:7): [True: 2, False: 1.48k] ------------------ 1170| 1.48k| !CBS_get_u16_length_prefixed(body, &ticket) || ------------------ | Branch (1170:7): [True: 1, False: 1.48k] ------------------ 1171| 1.48k| CBS_len(&ticket) == 0 || // ------------------ | Branch (1171:7): [True: 1, False: 1.48k] ------------------ 1172| 1.48k| !session->ticket.CopyFrom(ticket) || ------------------ | Branch (1172:7): [True: 0, False: 1.48k] ------------------ 1173| 1.48k| !CBS_get_u16_length_prefixed(body, &extensions) || // ------------------ | Branch (1173:7): [True: 6, False: 1.47k] ------------------ 1174| 1.48k| CBS_len(body) != 0) { ------------------ | Branch (1174:7): [True: 3, False: 1.47k] ------------------ 1175| 15| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 176| 15|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 4382| 15|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 15|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 1176| 15| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); ------------------ | | 361| 15| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1177| 15| return nullptr; 1178| 15| } 1179| | 1180| | // Cap the renewable lifetime by the server advertised value. This avoids 1181| | // wasting bandwidth on 0-RTT when we know the server will reject it. 1182| 1.47k| if (session->timeout > server_timeout) { ------------------ | Branch (1182:7): [True: 903, False: 568] ------------------ 1183| 903| session->timeout = server_timeout; 1184| 903| } 1185| | 1186| 1.47k| if (!tls13_derive_session_psk(session.get(), ticket_nonce, ------------------ | Branch (1186:7): [True: 0, False: 1.47k] ------------------ 1187| 1.47k| SSL_is_dtls(ssl))) { 1188| 0| return nullptr; 1189| 0| } 1190| | 1191| 1.47k| SSLExtension early_data(TLSEXT_TYPE_early_data); ------------------ | | 98| 1.47k|#define TLSEXT_TYPE_early_data 42 ------------------ 1192| 1.47k| SSLExtension flags(TLSEXT_TYPE_tls_flags); ------------------ | | 141| 1.47k|#define TLSEXT_TYPE_tls_flags 62 ------------------ 1193| 1.47k| uint8_t alert = SSL_AD_DECODE_ERROR; ------------------ | | 4382| 1.47k|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 1.47k|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 1194| 1.47k| if (!ssl_parse_extensions(&extensions, &alert, {&early_data, &flags}, ------------------ | Branch (1194:7): [True: 1, False: 1.47k] ------------------ 1195| 1.47k| /*ignore_unknown=*/true)) { 1196| 1| ssl_send_alert(ssl, SSL3_AL_FATAL, alert); ------------------ | | 176| 1|#define SSL3_AL_FATAL 2 ------------------ 1197| 1| return nullptr; 1198| 1| } 1199| | 1200| 1.47k| if (early_data.present) { ------------------ | Branch (1200:7): [True: 0, False: 1.47k] ------------------ 1201| 0| if (!CBS_get_u32(&early_data.data, &session->ticket_max_early_data) || ------------------ | Branch (1201:9): [True: 0, False: 0] ------------------ 1202| 0| CBS_len(&early_data.data) != 0) { ------------------ | Branch (1202:9): [True: 0, False: 0] ------------------ 1203| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 4382| 0|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 0|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 1204| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1205| 0| return nullptr; 1206| 0| } 1207| | 1208| | // QUIC does not use the max_early_data_size parameter and always sets it to 1209| | // a fixed value. See RFC 9001, section 4.6.1. 1210| 0| if (SSL_is_quic(ssl) && session->ticket_max_early_data != 0xffffffff) { ------------------ | Branch (1210:9): [True: 0, False: 0] | Branch (1210:29): [True: 0, False: 0] ------------------ 1211| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 4379| 0|#define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER | | ------------------ | | | | 189| 0|#define SSL3_AD_ILLEGAL_PARAMETER 47 // fatal | | ------------------ ------------------ 1212| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 1213| 0| return nullptr; 1214| 0| } 1215| 0| } 1216| | 1217| 1.47k| if (flags.present) { ------------------ | Branch (1217:7): [True: 0, False: 1.47k] ------------------ 1218| 0| SSLFlags parsed; 1219| 0| if (!ssl_parse_flags_extension_request(&flags.data, &parsed, &alert)) { ------------------ | Branch (1219:9): [True: 0, False: 0] ------------------ 1220| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, alert); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ 1221| 0| return nullptr; 1222| 0| } 1223| 0| if (parsed & kSSLFlagResumptionAcrossNames) { ------------------ | Branch (1223:9): [True: 0, False: 0] ------------------ 1224| 0| session->is_resumable_across_names = true; 1225| 0| } 1226| 0| } 1227| | 1228| | // Historically, OpenSSL filled in fake session IDs for ticket-based sessions. 1229| | // Envoy's tests depend on this, although perhaps they shouldn't. 1230| 1.47k| session->session_id.ResizeForOverwrite(SHA256_DIGEST_LENGTH); ------------------ | | 110| 1.47k|#define SHA256_DIGEST_LENGTH 32 ------------------ 1231| 1.47k| SHA256(CBS_data(&ticket), CBS_len(&ticket), session->session_id.data()); 1232| | 1233| 1.47k| session->ticket_age_add_valid = true; 1234| 1.47k| session->not_resumable = false; 1235| | 1236| 1.47k| return session; 1237| 1.47k|} tls13_client.cc:_ZN4bsslL27do_read_hello_retry_requestEPNS_13SSL_HANDSHAKEE: 183| 444|static enum ssl_hs_wait_t do_read_hello_retry_request(SSL_HANDSHAKE *hs) { 184| 444| SSL *const ssl = hs->ssl; 185| 444| assert(ssl->s3->version != 0); 186| 444| SSLMessage msg; 187| 444| if (!ssl->method->get_message(ssl, &msg)) { ------------------ | Branch (187:7): [True: 0, False: 444] ------------------ 188| 0| return ssl_hs_read_message; 189| 0| } 190| | 191| | // Queue up a ChangeCipherSpec for whenever we next send something. This 192| | // will be before the second ClientHello. If we offered early data, this was 193| | // already done. 194| 444| if (!hs->early_data_offered && // ------------------ | Branch (194:7): [True: 443, False: 1] ------------------ 195| 444| !ssl->method->add_change_cipher_spec(ssl)) { ------------------ | Branch (195:7): [True: 0, False: 443] ------------------ 196| 0| return ssl_hs_error; 197| 0| } 198| | 199| 444| ParsedServerHello server_hello; 200| 444| uint8_t alert = SSL_AD_DECODE_ERROR; ------------------ | | 4382| 444|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 444|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 201| 444| if (!parse_server_hello_tls13(hs, &server_hello, &alert, msg)) { ------------------ | Branch (201:7): [True: 53, False: 391] ------------------ 202| 53| ssl_send_alert(ssl, SSL3_AL_FATAL, alert); ------------------ | | 176| 53|#define SSL3_AL_FATAL 2 ------------------ 203| 53| return ssl_hs_error; 204| 53| } 205| | 206| | // The cipher suite must be one we offered. We currently offer all supported 207| | // TLS 1.3 ciphers unless policy controls limited it. So we check the version 208| | // and that it's ok per policy. 209| 391| const SSL_CIPHER *cipher = SSL_get_cipher_by_value(server_hello.cipher_suite); 210| 391| if (cipher == nullptr || ------------------ | Branch (210:7): [True: 1, False: 390] ------------------ 211| 391| SSL_CIPHER_get_min_version(cipher) > ssl_protocol_version(ssl) || ------------------ | Branch (211:7): [True: 0, False: 390] ------------------ 212| 391| SSL_CIPHER_get_max_version(cipher) < ssl_protocol_version(ssl) || ------------------ | Branch (212:7): [True: 1, False: 389] ------------------ 213| 391| !ssl_tls13_cipher_meets_policy(SSL_CIPHER_get_protocol_id(cipher), ------------------ | Branch (213:7): [True: 0, False: 389] ------------------ 214| 389| ssl->config->compliance_policy)) { 215| 2| OPENSSL_PUT_ERROR(SSL, SSL_R_WRONG_CIPHER_RETURNED); ------------------ | | 361| 2| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 216| 2| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 176| 2|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 4379| 2|#define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER | | ------------------ | | | | 189| 2|#define SSL3_AD_ILLEGAL_PARAMETER 47 // fatal | | ------------------ ------------------ 217| 2| return ssl_hs_error; 218| 2| } 219| | 220| 389| hs->new_cipher = cipher; 221| | 222| 389| const bool is_hrr = is_hello_retry_request(server_hello); 223| 389| if (!hs->transcript.InitHash(ssl_protocol_version(ssl), hs->new_cipher) || ------------------ | Branch (223:7): [True: 0, False: 389] ------------------ 224| 389| (is_hrr && !hs->transcript.UpdateForHelloRetryRequest())) { ------------------ | Branch (224:8): [True: 115, False: 274] | Branch (224:18): [True: 0, False: 115] ------------------ 225| 0| return ssl_hs_error; 226| 0| } 227| 389| if (hs->selected_ech_config) { ------------------ | Branch (227:7): [True: 0, False: 389] ------------------ 228| 0| if (!hs->inner_transcript.InitHash(ssl_protocol_version(ssl), ------------------ | Branch (228:9): [True: 0, False: 0] ------------------ 229| 0| hs->new_cipher) || 230| 0| (is_hrr && !hs->inner_transcript.UpdateForHelloRetryRequest())) { ------------------ | Branch (230:10): [True: 0, False: 0] | Branch (230:20): [True: 0, False: 0] ------------------ 231| 0| return ssl_hs_error; 232| 0| } 233| 0| } 234| | 235| | // Determine which ClientHello the server is responding to. Run 236| | // |check_ech_confirmation| unconditionally, so we validate the extension 237| | // contents. 238| 389| bool ech_accepted; 239| 389| if (!check_ech_confirmation(hs, &ech_accepted, &alert, server_hello)) { ------------------ | Branch (239:7): [True: 0, False: 389] ------------------ 240| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, alert); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ 241| 0| return ssl_hs_error; 242| 0| } 243| 389| if (hs->selected_ech_config) { ------------------ | Branch (243:7): [True: 0, False: 389] ------------------ 244| 0| ssl->s3->ech_status = ech_accepted ? ssl_ech_accepted : ssl_ech_rejected; ------------------ | Branch (244:27): [True: 0, False: 0] ------------------ 245| 0| } 246| | 247| 389| if (!is_hrr) { ------------------ | Branch (247:7): [True: 274, False: 115] ------------------ 248| 274| hs->tls13_state = state_read_server_hello; 249| 274| return ssl_hs_ok; 250| 274| } 251| | 252| | // The ECH extension, if present, was already parsed by 253| | // |check_ech_confirmation|. 254| 115| SSLExtension cookie(TLSEXT_TYPE_cookie), ------------------ | | 100| 115|#define TLSEXT_TYPE_cookie 44 ------------------ 255| 115| key_share(TLSEXT_TYPE_key_share, !hs->key_share_bytes.empty()), ------------------ | | 104| 115|#define TLSEXT_TYPE_key_share 51 ------------------ 256| 115| supported_versions(TLSEXT_TYPE_supported_versions), ------------------ | | 99| 115|#define TLSEXT_TYPE_supported_versions 43 ------------------ 257| 115| ech_unused(TLSEXT_TYPE_encrypted_client_hello, ------------------ | | 119| 115|#define TLSEXT_TYPE_encrypted_client_hello 0xfe0d ------------------ 258| 115| hs->selected_ech_config || hs->config->ech_grease_enabled); ------------------ | Branch (258:18): [True: 0, False: 115] | Branch (258:45): [True: 0, False: 115] ------------------ 259| 115| if (!ssl_parse_extensions( ------------------ | Branch (259:7): [True: 1, False: 114] ------------------ 260| 115| &server_hello.extensions, &alert, 261| 115| {&cookie, &key_share, &supported_versions, &ech_unused}, 262| 115| /*ignore_unknown=*/false)) { 263| 1| ssl_send_alert(ssl, SSL3_AL_FATAL, alert); ------------------ | | 176| 1|#define SSL3_AL_FATAL 2 ------------------ 264| 1| return ssl_hs_error; 265| 1| } 266| | 267| 114| if (!cookie.present && !key_share.present) { ------------------ | Branch (267:7): [True: 110, False: 4] | Branch (267:26): [True: 0, False: 110] ------------------ 268| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_EMPTY_HELLO_RETRY_REQUEST); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 269| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 4379| 0|#define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER | | ------------------ | | | | 189| 0|#define SSL3_AD_ILLEGAL_PARAMETER 47 // fatal | | ------------------ ------------------ 270| 0| return ssl_hs_error; 271| 0| } 272| 114| if (cookie.present) { ------------------ | Branch (272:7): [True: 4, False: 110] ------------------ 273| 4| CBS cookie_value; 274| 4| if (!CBS_get_u16_length_prefixed(&cookie.data, &cookie_value) || // ------------------ | Branch (274:9): [True: 1, False: 3] ------------------ 275| 4| CBS_len(&cookie_value) == 0 || // ------------------ | Branch (275:9): [True: 1, False: 2] ------------------ 276| 4| CBS_len(&cookie.data) != 0) { ------------------ | Branch (276:9): [True: 1, False: 1] ------------------ 277| 3| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); ------------------ | | 361| 3| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 278| 3| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 176| 3|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 4382| 3|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 3|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 279| 3| return ssl_hs_error; 280| 3| } 281| | 282| 1| if (!hs->cookie.CopyFrom(cookie_value)) { ------------------ | Branch (282:9): [True: 0, False: 1] ------------------ 283| 0| return ssl_hs_error; 284| 0| } 285| 1| } 286| | 287| 111| if (key_share.present) { ------------------ | Branch (287:7): [True: 110, False: 1] ------------------ 288| | // If offering PAKE, we won't send key_share extensions, in which case we 289| | // would have rejected key_share from the peer. 290| 110| assert(!hs->pake_prover); 291| | 292| 110| uint16_t group_id; 293| 110| if (!CBS_get_u16(&key_share.data, &group_id) || ------------------ | Branch (293:9): [True: 0, False: 110] ------------------ 294| 110| CBS_len(&key_share.data) != 0) { ------------------ | Branch (294:9): [True: 1, False: 109] ------------------ 295| 1| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); ------------------ | | 361| 1| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 296| 1| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 176| 1|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 4382| 1|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 1|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 297| 1| return ssl_hs_error; 298| 1| } 299| | 300| | // The group must be supported. 301| 109| if (!tls1_check_group_id(hs, group_id)) { ------------------ | Branch (301:9): [True: 4, False: 105] ------------------ 302| 4| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 176| 4|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 4379| 4|#define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER | | ------------------ | | | | 189| 4|#define SSL3_AD_ILLEGAL_PARAMETER 47 // fatal | | ------------------ ------------------ 303| 4| OPENSSL_PUT_ERROR(SSL, SSL_R_WRONG_CURVE); ------------------ | | 361| 4| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 304| 4| return ssl_hs_error; 305| 4| } 306| | 307| | // Check that the HelloRetryRequest does not request a key share that was 308| | // provided in the initial ClientHello. 309| 105| if (hs->key_shares[0]->GroupID() == group_id || ------------------ | Branch (309:9): [True: 0, False: 105] ------------------ 310| 105| (hs->key_shares[1] && hs->key_shares[1]->GroupID() == group_id)) { ------------------ | Branch (310:10): [True: 105, False: 0] | Branch (310:31): [True: 1, False: 104] ------------------ 311| 1| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 176| 1|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 4379| 1|#define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER | | ------------------ | | | | 189| 1|#define SSL3_AD_ILLEGAL_PARAMETER 47 // fatal | | ------------------ ------------------ 312| 1| OPENSSL_PUT_ERROR(SSL, SSL_R_WRONG_CURVE); ------------------ | | 361| 1| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 313| 1| return ssl_hs_error; 314| 1| } 315| | 316| 104| if (!ssl_setup_key_shares(hs, group_id)) { ------------------ | Branch (316:9): [True: 0, False: 104] ------------------ 317| 0| return ssl_hs_error; 318| 0| } 319| 104| } 320| | 321| | // Although we now know whether ClientHelloInner was used, we currently 322| | // maintain both transcripts up to ServerHello. We could swap transcripts 323| | // early, but then ClientHello construction and |check_ech_confirmation| 324| | // become more complex. 325| 105| if (!ssl_hash_message(hs, msg)) { ------------------ | Branch (325:7): [True: 0, False: 105] ------------------ 326| 0| return ssl_hs_error; 327| 0| } 328| 105| if (ssl->s3->ech_status == ssl_ech_accepted && ------------------ | Branch (328:7): [True: 0, False: 105] ------------------ 329| 105| !hs->inner_transcript.Update(msg.raw)) { ------------------ | Branch (329:7): [True: 0, False: 0] ------------------ 330| 0| return ssl_hs_error; 331| 0| } 332| | 333| | // HelloRetryRequest should be the end of the flight. 334| 105| if (ssl->method->has_unprocessed_handshake_data(ssl)) { ------------------ | Branch (334:7): [True: 9, False: 96] ------------------ 335| 9| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE); ------------------ | | 176| 9|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE); ------------------ | | 4367| 9|#define SSL_AD_UNEXPECTED_MESSAGE SSL3_AD_UNEXPECTED_MESSAGE | | ------------------ | | | | 179| 9|#define SSL3_AD_UNEXPECTED_MESSAGE 10 // fatal | | ------------------ ------------------ 336| 9| OPENSSL_PUT_ERROR(SSL, SSL_R_EXCESS_HANDSHAKE_DATA); ------------------ | | 361| 9| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 337| 9| return ssl_hs_error; 338| 9| } 339| | 340| 96| ssl->method->next_message(ssl); 341| 96| ssl->s3->used_hello_retry_request = true; 342| 96| hs->tls13_state = state_send_second_client_hello; 343| | // 0-RTT is rejected if we receive a HelloRetryRequest. 344| 96| if (hs->in_early_data) { ------------------ | Branch (344:7): [True: 0, False: 96] ------------------ 345| 0| ssl->s3->early_data_reason = ssl_early_data_hello_retry_request; 346| 0| if (!close_early_data(hs, ssl_encryption_initial)) { ------------------ | Branch (346:9): [True: 0, False: 0] ------------------ 347| 0| return ssl_hs_error; 348| 0| } 349| 0| return ssl_hs_early_data_rejected; 350| 0| } 351| 96| return ssl_hs_ok; 352| 96|} tls13_client.cc:_ZN4bsslL24parse_server_hello_tls13EPKNS_13SSL_HANDSHAKEEPNS_17ParsedServerHelloEPhRKNS_10SSLMessageE: 109| 755| const SSLMessage &msg) { 110| 755| if (!ssl_parse_server_hello(out, out_alert, msg)) { ------------------ | Branch (110:7): [True: 2, False: 753] ------------------ 111| 2| return false; 112| 2| } 113| 753| uint16_t expected_version = 114| 753| SSL_is_dtls(hs->ssl) ? DTLS1_2_VERSION : TLS1_2_VERSION; ------------------ | | 548| 0|#define DTLS1_2_VERSION 0xfefd ------------------ SSL_is_dtls(hs->ssl) ? DTLS1_2_VERSION : TLS1_2_VERSION; ------------------ | | 544| 1.50k|#define TLS1_2_VERSION 0x0303 ------------------ | Branch (114:7): [True: 0, False: 753] ------------------ 115| | // DTLS 1.3 disables "compatibility mode" (RFC 8446, appendix D.4). When 116| | // disabled, servers MUST NOT echo the legacy_session_id (RFC 9147, section 117| | // 5). The client could have sent a session ID indicating its willingness to 118| | // resume a DTLS 1.2 session, so just checking that the session IDs match is 119| | // incorrect. 120| 753| Span expected_session_id = 121| 753| SSL_is_dtls(hs->ssl) ? Span() : Span(hs->session_id); ------------------ | Branch (121:7): [True: 0, False: 753] ------------------ 122| | 123| | // RFC 8446 fixes some legacy values. Check them. 124| 753| if (out->legacy_version != expected_version || // ------------------ | Branch (124:7): [True: 21, False: 732] ------------------ 125| 753| out->compression_method != 0 || ------------------ | Branch (125:7): [True: 5, False: 727] ------------------ 126| 753| Span(out->session_id) != expected_session_id || ------------------ | Branch (126:7): [True: 44, False: 683] ------------------ 127| 753| CBS_len(&out->extensions) == 0) { ------------------ | Branch (127:7): [True: 1, False: 682] ------------------ 128| 71| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); ------------------ | | 361| 71| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 129| 71| *out_alert = SSL_AD_DECODE_ERROR; ------------------ | | 4382| 71|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 71|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 130| 71| return false; 131| 71| } 132| 682| return true; 133| 753|} tls13_client.cc:_ZN4bsslL22is_hello_retry_requestERKNS_17ParsedServerHelloE: 135| 1.06k|static bool is_hello_retry_request(const ParsedServerHello &server_hello) { 136| 1.06k| return Span(server_hello.random) == kHelloRetryRequest; 137| 1.06k|} tls13_client.cc:_ZN4bsslL22check_ech_confirmationEPKNS_13SSL_HANDSHAKEEPbPhRKNS_17ParsedServerHelloE: 141| 389| const ParsedServerHello &server_hello) { 142| 389| const bool is_hrr = is_hello_retry_request(server_hello); 143| 389| size_t offset; 144| 389| if (is_hrr) { ------------------ | Branch (144:7): [True: 115, False: 274] ------------------ 145| | // We check for an unsolicited extension when parsing all of them. 146| 115| SSLExtension ech(TLSEXT_TYPE_encrypted_client_hello); ------------------ | | 119| 115|#define TLSEXT_TYPE_encrypted_client_hello 0xfe0d ------------------ 147| 115| if (!ssl_parse_extensions(&server_hello.extensions, out_alert, {&ech}, ------------------ | Branch (147:9): [True: 0, False: 115] ------------------ 148| 115| /*ignore_unknown=*/true)) { 149| 0| return false; 150| 0| } 151| 115| if (!ech.present) { ------------------ | Branch (151:9): [True: 115, False: 0] ------------------ 152| 115| *out_accepted = false; 153| 115| return true; 154| 115| } 155| 0| if (CBS_len(&ech.data) != ECH_CONFIRMATION_SIGNAL_LEN) { ------------------ | | 1337| 0|#define ECH_CONFIRMATION_SIGNAL_LEN 8 ------------------ | Branch (155:9): [True: 0, False: 0] ------------------ 156| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 157| 0| *out_alert = SSL_AD_DECODE_ERROR; ------------------ | | 4382| 0|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 0|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 158| 0| return false; 159| 0| } 160| 0| offset = CBS_data(&ech.data) - CBS_data(&server_hello.raw); 161| 274| } else { 162| 274| offset = ssl_ech_confirmation_signal_hello_offset(hs->ssl); 163| 274| } 164| | 165| 274| if (!hs->selected_ech_config) { ------------------ | Branch (165:7): [True: 274, False: 0] ------------------ 166| 274| *out_accepted = false; 167| 274| return true; 168| 274| } 169| | 170| 0| uint8_t expected[ECH_CONFIRMATION_SIGNAL_LEN]; 171| 0| if (!ssl_ech_accept_confirmation(hs, expected, hs->inner_client_random, ------------------ | Branch (171:7): [True: 0, False: 0] ------------------ 172| 0| hs->inner_transcript, is_hrr, 173| 0| server_hello.raw, offset)) { 174| 0| *out_alert = SSL_AD_INTERNAL_ERROR; ------------------ | | 4387| 0|#define SSL_AD_INTERNAL_ERROR TLS1_AD_INTERNAL_ERROR | | ------------------ | | | | 37| 0|#define TLS1_AD_INTERNAL_ERROR 80 | | ------------------ ------------------ 175| 0| return false; 176| 0| } 177| | 178| 0| *out_accepted = CRYPTO_memcmp(CBS_data(&server_hello.raw) + offset, expected, 179| 0| sizeof(expected)) == 0; 180| 0| return true; 181| 0|} tls13_client.cc:_ZN4bsslL27do_send_second_client_helloEPNS_13SSL_HANDSHAKEE: 354| 96|static enum ssl_hs_wait_t do_send_second_client_hello(SSL_HANDSHAKE *hs) { 355| | // Build the second ClientHelloInner, if applicable. The second ClientHello 356| | // uses an empty string for |enc|. 357| 96| if (hs->ssl->s3->ech_status == ssl_ech_accepted && ------------------ | Branch (357:7): [True: 0, False: 96] ------------------ 358| 96| !ssl_encrypt_client_hello(hs, {})) { ------------------ | Branch (358:7): [True: 0, False: 0] ------------------ 359| 0| return ssl_hs_error; 360| 0| } 361| | 362| 96| if (!ssl_add_client_hello(hs)) { ------------------ | Branch (362:7): [True: 0, False: 96] ------------------ 363| 0| return ssl_hs_error; 364| 0| } 365| | 366| 96| ssl_done_writing_client_hello(hs); 367| 96| hs->tls13_state = state_read_server_hello; 368| 96| return ssl_hs_flush; 369| 96|} tls13_client.cc:_ZN4bsslL20do_read_server_helloEPNS_13SSL_HANDSHAKEE: 371| 1.58k|static enum ssl_hs_wait_t do_read_server_hello(SSL_HANDSHAKE *hs) { 372| 1.58k| SSL *const ssl = hs->ssl; 373| 1.58k| SSLMessage msg; 374| 1.58k| if (!ssl->method->get_message(ssl, &msg)) { ------------------ | Branch (374:7): [True: 1.27k, False: 311] ------------------ 375| 1.27k| return ssl_hs_read_message; 376| 1.27k| } 377| 311| ParsedServerHello server_hello; 378| 311| uint8_t alert = SSL_AD_DECODE_ERROR; ------------------ | | 4382| 311|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 311|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 379| 311| if (!parse_server_hello_tls13(hs, &server_hello, &alert, msg)) { ------------------ | Branch (379:7): [True: 20, False: 291] ------------------ 380| 20| ssl_send_alert(ssl, SSL3_AL_FATAL, alert); ------------------ | | 176| 20|#define SSL3_AL_FATAL 2 ------------------ 381| 20| return ssl_hs_error; 382| 20| } 383| | 384| | // Forbid a second HelloRetryRequest. 385| 291| if (is_hello_retry_request(server_hello)) { ------------------ | Branch (385:7): [True: 1, False: 290] ------------------ 386| 1| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE); ------------------ | | 176| 1|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE); ------------------ | | 4367| 1|#define SSL_AD_UNEXPECTED_MESSAGE SSL3_AD_UNEXPECTED_MESSAGE | | ------------------ | | | | 179| 1|#define SSL3_AD_UNEXPECTED_MESSAGE 10 // fatal | | ------------------ ------------------ 387| 1| OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_MESSAGE); ------------------ | | 361| 1| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 388| 1| return ssl_hs_error; 389| 1| } 390| | 391| | // Check the cipher suite, in case this is after HelloRetryRequest. 392| 290| if (SSL_CIPHER_get_protocol_id(hs->new_cipher) != server_hello.cipher_suite) { ------------------ | Branch (392:7): [True: 1, False: 289] ------------------ 393| 1| OPENSSL_PUT_ERROR(SSL, SSL_R_WRONG_CIPHER_RETURNED); ------------------ | | 361| 1| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 394| 1| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 176| 1|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 4379| 1|#define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER | | ------------------ | | | | 189| 1|#define SSL3_AD_ILLEGAL_PARAMETER 47 // fatal | | ------------------ ------------------ 395| 1| return ssl_hs_error; 396| 1| } 397| | 398| 289| if (ssl->s3->ech_status == ssl_ech_accepted) { ------------------ | Branch (398:7): [True: 0, False: 289] ------------------ 399| 0| if (ssl->s3->used_hello_retry_request) { ------------------ | Branch (399:9): [True: 0, False: 0] ------------------ 400| | // HelloRetryRequest and ServerHello must accept ECH consistently. 401| 0| bool ech_accepted; 402| 0| if (!check_ech_confirmation(hs, &ech_accepted, &alert, server_hello)) { ------------------ | Branch (402:11): [True: 0, False: 0] ------------------ 403| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, alert); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ 404| 0| return ssl_hs_error; 405| 0| } 406| 0| if (!ech_accepted) { ------------------ | Branch (406:11): [True: 0, False: 0] ------------------ 407| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_INCONSISTENT_ECH_NEGOTIATION); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 408| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 4379| 0|#define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER | | ------------------ | | | | 189| 0|#define SSL3_AD_ILLEGAL_PARAMETER 47 // fatal | | ------------------ ------------------ 409| 0| return ssl_hs_error; 410| 0| } 411| 0| } 412| | 413| 0| hs->transcript = std::move(hs->inner_transcript); 414| 0| hs->extensions.sent = hs->inner_extensions_sent; 415| | // Report the inner random value through |SSL_get_client_random|. 416| 0| OPENSSL_memcpy(ssl->s3->client_random, hs->inner_client_random, 417| 0| SSL3_RANDOM_SIZE); ------------------ | | 102| 0|#define SSL3_RANDOM_SIZE 32 ------------------ 418| 0| } 419| | 420| 289| OPENSSL_memcpy(ssl->s3->server_random, CBS_data(&server_hello.random), 421| 289| SSL3_RANDOM_SIZE); ------------------ | | 102| 289|#define SSL3_RANDOM_SIZE 32 ------------------ 422| | 423| | // When offering ECH, |ssl->session| is only offered in ClientHelloInner. 424| 289| const bool pre_shared_key_allowed = 425| 289| ssl->session != nullptr && ------------------ | Branch (425:7): [True: 289, False: 0] ------------------ 426| 289| ssl_session_get_type(ssl->session.get()) == ------------------ | Branch (426:7): [True: 0, False: 289] ------------------ 427| 289| SSLSessionType::kPreSharedKey && 428| 289| ssl->s3->ech_status != ssl_ech_rejected; ------------------ | Branch (428:7): [True: 0, False: 0] ------------------ 429| 289| SSLExtension key_share(TLSEXT_TYPE_key_share, hs->key_shares[0] != nullptr), ------------------ | | 104| 289|#define TLSEXT_TYPE_key_share 51 ------------------ 430| 289| pake_share(TLSEXT_TYPE_pake, hs->pake_prover != nullptr), ------------------ | | 124| 289|#define TLSEXT_TYPE_pake 0x8a3b ------------------ 431| 289| pre_shared_key(TLSEXT_TYPE_pre_shared_key, pre_shared_key_allowed), ------------------ | | 97| 289|#define TLSEXT_TYPE_pre_shared_key 41 ------------------ 432| 289| supported_versions(TLSEXT_TYPE_supported_versions); ------------------ | | 99| 289|#define TLSEXT_TYPE_supported_versions 43 ------------------ 433| 289| if (!ssl_parse_extensions( ------------------ | Branch (433:7): [True: 25, False: 264] ------------------ 434| 289| &server_hello.extensions, &alert, 435| 289| {&key_share, &pre_shared_key, &supported_versions, &pake_share}, 436| 289| /*ignore_unknown=*/false)) { 437| 25| ssl_send_alert(ssl, SSL3_AL_FATAL, alert); ------------------ | | 176| 25|#define SSL3_AL_FATAL 2 ------------------ 438| 25| return ssl_hs_error; 439| 25| } 440| | 441| | // Recheck supported_versions, in case this is after HelloRetryRequest. 442| 264| uint16_t version; 443| 264| if (!supported_versions.present || // ------------------ | Branch (443:7): [True: 1, False: 263] ------------------ 444| 264| !CBS_get_u16(&supported_versions.data, &version) || // ------------------ | Branch (444:7): [True: 0, False: 263] ------------------ 445| 264| CBS_len(&supported_versions.data) != 0 || // ------------------ | Branch (445:7): [True: 1, False: 262] ------------------ 446| 264| version != ssl->s3->version) { ------------------ | Branch (446:7): [True: 7, False: 255] ------------------ 447| 9| OPENSSL_PUT_ERROR(SSL, SSL_R_SECOND_SERVERHELLO_VERSION_MISMATCH); ------------------ | | 361| 9| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 448| 9| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 176| 9|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 4379| 9|#define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER | | ------------------ | | | | 189| 9|#define SSL3_AD_ILLEGAL_PARAMETER 47 // fatal | | ------------------ ------------------ 449| 9| return ssl_hs_error; 450| 9| } 451| | 452| | // The combination of ServerHello extensions determines the kind of handshake 453| | // that the server selected. Check for invalid combinations. 454| | 455| | // pake replaces key_share and may not be used with pre_shared_key. 456| 255| if (pake_share.present && (key_share.present || pre_shared_key.present)) { ------------------ | Branch (456:7): [True: 0, False: 255] | Branch (456:30): [True: 0, False: 0] | Branch (456:51): [True: 0, False: 0] ------------------ 457| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_EXTENSION); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 458| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_UNSUPPORTED_EXTENSION); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_UNSUPPORTED_EXTENSION); ------------------ | | 4392| 0|#define SSL_AD_UNSUPPORTED_EXTENSION TLS1_AD_UNSUPPORTED_EXTENSION | | ------------------ | | | | 41| 0|#define TLS1_AD_UNSUPPORTED_EXTENSION 110 | | ------------------ ------------------ 459| 0| return ssl_hs_error; 460| 0| } 461| | // In PAKE mode, we require a PAKE handshake and do not support resumption. 462| 255| if (hs->pake_prover != nullptr && !pake_share.present) { ------------------ | Branch (462:7): [True: 0, False: 255] | Branch (462:37): [True: 0, False: 0] ------------------ 463| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_MISSING_EXTENSION); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 464| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_MISSING_EXTENSION); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_MISSING_EXTENSION); ------------------ | | 4391| 0|#define SSL_AD_MISSING_EXTENSION TLS1_AD_MISSING_EXTENSION | | ------------------ | | | | 40| 0|#define TLS1_AD_MISSING_EXTENSION 109 | | ------------------ ------------------ 465| 0| return ssl_hs_error; 466| 0| } 467| | // In non-PAKE modes, we require per-connection forward secrecy and do not 468| | // support psk_ke. 469| 255| if (hs->pake_prover == nullptr && !key_share.present) { ------------------ | Branch (469:7): [True: 255, False: 0] | Branch (469:37): [True: 0, False: 255] ------------------ 470| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_MISSING_KEY_SHARE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 471| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_MISSING_EXTENSION); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_MISSING_EXTENSION); ------------------ | | 4391| 0|#define SSL_AD_MISSING_EXTENSION TLS1_AD_MISSING_EXTENSION | | ------------------ | | | | 40| 0|#define TLS1_AD_MISSING_EXTENSION 109 | | ------------------ ------------------ 472| 0| return ssl_hs_error; 473| 0| } 474| | // The above imples only one of three handshake forms will be allowed. The 475| | // checks for unsolicited extensions ensure the server did not select 476| | // something we cannot respond to. 477| 255| assert( 478| | // Full handshake 479| 255| (key_share.present && !pake_share.present && !pre_shared_key.present) || 480| | // PSK/resumption handshake 481| 255| (key_share.present && !pake_share.present && pre_shared_key.present) || 482| | // PAKE handshake 483| 255| (!key_share.present && pake_share.present && !pre_shared_key.present)); 484| | 485| 255| alert = SSL_AD_DECODE_ERROR; ------------------ | | 4382| 255|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 255|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 486| 255| if (pre_shared_key.present) { ------------------ | Branch (486:7): [True: 0, False: 255] ------------------ 487| 0| if (!ssl_ext_pre_shared_key_parse_serverhello(hs, &alert, ------------------ | Branch (487:9): [True: 0, False: 0] ------------------ 488| 0| &pre_shared_key.data)) { 489| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, alert); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ 490| 0| return ssl_hs_error; 491| 0| } 492| | 493| 0| if (ssl->session->ssl_version != ssl->s3->version) { ------------------ | Branch (493:9): [True: 0, False: 0] ------------------ 494| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_OLD_SESSION_VERSION_NOT_RETURNED); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 495| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 4379| 0|#define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER | | ------------------ | | | | 189| 0|#define SSL3_AD_ILLEGAL_PARAMETER 47 // fatal | | ------------------ ------------------ 496| 0| return ssl_hs_error; 497| 0| } 498| | 499| 0| if (ssl->session->cipher->algorithm_prf != hs->new_cipher->algorithm_prf) { ------------------ | Branch (499:9): [True: 0, False: 0] ------------------ 500| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_OLD_SESSION_PRF_HASH_MISMATCH); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 501| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 4379| 0|#define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER | | ------------------ | | | | 189| 0|#define SSL3_AD_ILLEGAL_PARAMETER 47 // fatal | | ------------------ ------------------ 502| 0| return ssl_hs_error; 503| 0| } 504| | 505| 0| if (!ssl_session_is_context_valid(hs, ssl->session.get())) { ------------------ | Branch (505:9): [True: 0, False: 0] ------------------ 506| | // This is actually a client application bug. 507| 0| OPENSSL_PUT_ERROR(SSL, ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 508| 0| SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT); 509| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 4379| 0|#define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER | | ------------------ | | | | 189| 0|#define SSL3_AD_ILLEGAL_PARAMETER 47 // fatal | | ------------------ ------------------ 510| 0| return ssl_hs_error; 511| 0| } 512| | 513| 0| ssl->s3->session_reused = true; 514| 0| hs->can_release_private_key = true; 515| | // Only authentication information carries over in TLS 1.3. 516| 0| hs->new_session = 517| 0| SSL_SESSION_dup(ssl->session.get(), SSL_SESSION_DUP_AUTH_ONLY); ------------------ | | 3455| 0|#define SSL_SESSION_DUP_AUTH_ONLY 0x0 ------------------ 518| 0| if (!hs->new_session) { ------------------ | Branch (518:9): [True: 0, False: 0] ------------------ 519| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); ------------------ | | 4387| 0|#define SSL_AD_INTERNAL_ERROR TLS1_AD_INTERNAL_ERROR | | ------------------ | | | | 37| 0|#define TLS1_AD_INTERNAL_ERROR 80 | | ------------------ ------------------ 520| 0| return ssl_hs_error; 521| 0| } 522| 0| ssl_set_session(ssl, NULL); 523| | 524| | // Resumption incorporates fresh key material, so refresh the timeout. 525| 0| ssl_session_renew_timeout(ssl, hs->new_session.get(), 526| 0| ssl->session_ctx->session_psk_dhe_timeout); 527| 255| } else if (!ssl_get_new_session(hs)) { ------------------ | Branch (527:14): [True: 0, False: 255] ------------------ 528| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); ------------------ | | 4387| 0|#define SSL_AD_INTERNAL_ERROR TLS1_AD_INTERNAL_ERROR | | ------------------ | | | | 37| 0|#define TLS1_AD_INTERNAL_ERROR 80 | | ------------------ ------------------ 529| 0| return ssl_hs_error; 530| 0| } 531| | 532| 255| hs->new_session->cipher = hs->new_cipher; 533| | 534| | // Set up the key schedule and incorporate the PSK into the running secret. 535| 255| size_t hash_len = EVP_MD_size( 536| 255| ssl_get_handshake_digest(ssl_protocol_version(ssl), hs->new_cipher)); 537| 255| if (!tls13_init_key_schedule(hs, ssl->s3->session_reused ------------------ | Branch (537:7): [True: 0, False: 255] | Branch (537:36): [True: 0, False: 255] ------------------ 538| 255| ? Span(hs->new_session->secret) 539| 255| : Span(kZeroes, hash_len))) { 540| 0| return ssl_hs_error; 541| 0| } 542| | 543| | // Resolve ECDHE or PAKE and incorporate it into the secret. 544| 255| Array shared_secret; 545| 255| alert = SSL_AD_DECODE_ERROR; ------------------ | | 4382| 255|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 255|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 546| 255| if (key_share.present) { ------------------ | Branch (546:7): [True: 255, False: 0] ------------------ 547| 255| if (!ssl_ext_key_share_parse_serverhello(hs, &shared_secret, &alert, ------------------ | Branch (547:9): [True: 21, False: 234] ------------------ 548| 255| &key_share.data)) { 549| 21| ssl_send_alert(ssl, SSL3_AL_FATAL, alert); ------------------ | | 176| 21|#define SSL3_AL_FATAL 2 ------------------ 550| 21| return ssl_hs_error; 551| 21| } 552| 255| } else if (pake_share.present) { ------------------ | Branch (552:14): [True: 0, False: 0] ------------------ 553| 0| if (!ssl_ext_pake_parse_serverhello(hs, &shared_secret, &alert, ------------------ | Branch (553:9): [True: 0, False: 0] ------------------ 554| 0| &pake_share.data)) { 555| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, alert); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ 556| 0| return ssl_hs_error; 557| 0| } 558| 0| } else { 559| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 560| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); ------------------ | | 4387| 0|#define SSL_AD_INTERNAL_ERROR TLS1_AD_INTERNAL_ERROR | | ------------------ | | | | 37| 0|#define TLS1_AD_INTERNAL_ERROR 80 | | ------------------ ------------------ 561| 0| return ssl_hs_error; 562| 0| } 563| | 564| 234| if (!tls13_advance_key_schedule(hs, shared_secret) || // ------------------ | Branch (564:7): [True: 0, False: 234] ------------------ 565| 234| !ssl_hash_message(hs, msg) || // ------------------ | Branch (565:7): [True: 0, False: 234] ------------------ 566| 234| !tls13_derive_handshake_secrets(hs)) { ------------------ | Branch (566:7): [True: 0, False: 234] ------------------ 567| 0| return ssl_hs_error; 568| 0| } 569| | 570| | // If currently sending early data over TCP, we defer installing client 571| | // traffic keys to when the early data stream is closed. See 572| | // |close_early_data|. Note if the server has already rejected 0-RTT via 573| | // HelloRetryRequest, |in_early_data| is already false. 574| 234| if (!hs->in_early_data || SSL_is_quic(ssl)) { ------------------ | Branch (574:7): [True: 234, False: 0] | Branch (574:29): [True: 0, False: 0] ------------------ 575| 234| if (!tls13_set_traffic_key(ssl, ssl_encryption_handshake, evp_aead_seal, ------------------ | Branch (575:9): [True: 0, False: 234] ------------------ 576| 234| hs->new_session.get(), 577| 234| hs->client_handshake_secret)) { 578| 0| return ssl_hs_error; 579| 0| } 580| 234| } 581| | 582| 234| if (!tls13_set_traffic_key(ssl, ssl_encryption_handshake, evp_aead_open, ------------------ | Branch (582:7): [True: 1, False: 233] ------------------ 583| 234| hs->new_session.get(), 584| 234| hs->server_handshake_secret)) { 585| 1| return ssl_hs_error; 586| 1| } 587| | 588| 233| ssl->method->next_message(ssl); 589| 233| hs->tls13_state = state_read_encrypted_extensions; 590| 233| return ssl_hs_ok; 591| 234|} tls13_client.cc:_ZN4bsslL28do_read_encrypted_extensionsEPNS_13SSL_HANDSHAKEE: 593| 513|static enum ssl_hs_wait_t do_read_encrypted_extensions(SSL_HANDSHAKE *hs) { 594| 513| SSL *const ssl = hs->ssl; 595| 513| SSLMessage msg; 596| 513| if (!ssl->method->get_message(ssl, &msg)) { ------------------ | Branch (596:7): [True: 297, False: 216] ------------------ 597| 297| return ssl_hs_read_message; 598| 297| } 599| 216| if (!ssl_check_message_type(ssl, msg, SSL3_MT_ENCRYPTED_EXTENSIONS)) { ------------------ | | 199| 216|#define SSL3_MT_ENCRYPTED_EXTENSIONS 8 ------------------ | Branch (599:7): [True: 1, False: 215] ------------------ 600| 1| return ssl_hs_error; 601| 1| } 602| | 603| 215| CBS body = msg.body, extensions; 604| 215| if (!CBS_get_u16_length_prefixed(&body, &extensions) || // ------------------ | Branch (604:7): [True: 1, False: 214] ------------------ 605| 215| CBS_len(&body) != 0) { ------------------ | Branch (605:7): [True: 1, False: 213] ------------------ 606| 2| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); ------------------ | | 361| 2| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 607| 2| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 176| 2|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); ------------------ | | 4382| 2|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 2|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 608| 2| return ssl_hs_error; 609| 2| } 610| | 611| 213| if (!ssl_parse_serverhello_tlsext(hs, &extensions)) { ------------------ | Branch (611:7): [True: 4, False: 209] ------------------ 612| 4| OPENSSL_PUT_ERROR(SSL, SSL_R_PARSE_TLSEXT); ------------------ | | 361| 4| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 613| 4| return ssl_hs_error; 614| 4| } 615| | 616| 209| if (ssl->s3->early_data_accepted) { ------------------ | Branch (616:7): [True: 0, False: 209] ------------------ 617| | // The extension parser checks the server resumed the session. 618| 0| assert(ssl->s3->session_reused); 619| | // If offering ECH, the server may not accept early data with 620| | // ClientHelloOuter. We do not offer sessions with ClientHelloOuter, so this 621| | // this should be implied by checking |session_reused|. 622| 0| assert(ssl->s3->ech_status != ssl_ech_rejected); 623| | 624| 0| if (hs->early_session->cipher != hs->new_session->cipher) { ------------------ | Branch (624:9): [True: 0, False: 0] ------------------ 625| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_CIPHER_MISMATCH_ON_EARLY_DATA); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 626| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 4379| 0|#define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER | | ------------------ | | | | 189| 0|#define SSL3_AD_ILLEGAL_PARAMETER 47 // fatal | | ------------------ ------------------ 627| 0| return ssl_hs_error; 628| 0| } 629| 0| if (Span(hs->early_session->early_alpn) != ssl->s3->alpn_selected) { ------------------ | Branch (629:9): [True: 0, False: 0] ------------------ 630| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_ALPN_MISMATCH_ON_EARLY_DATA); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 631| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 4379| 0|#define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER | | ------------------ | | | | 189| 0|#define SSL3_AD_ILLEGAL_PARAMETER 47 // fatal | | ------------------ ------------------ 632| 0| return ssl_hs_error; 633| 0| } 634| | // Channel ID is incompatible with 0-RTT. The ALPS extension should be 635| | // negotiated implicitly. 636| 0| if (hs->channel_id_negotiated || ------------------ | Branch (636:9): [True: 0, False: 0] ------------------ 637| 0| hs->new_session->has_application_settings) { ------------------ | Branch (637:9): [True: 0, False: 0] ------------------ 638| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_EXTENSION_ON_EARLY_DATA); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 639| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER); ------------------ | | 4379| 0|#define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER | | ------------------ | | | | 189| 0|#define SSL3_AD_ILLEGAL_PARAMETER 47 // fatal | | ------------------ ------------------ 640| 0| return ssl_hs_error; 641| 0| } 642| 0| hs->new_session->has_application_settings = 643| 0| hs->early_session->has_application_settings; 644| 0| if (!hs->new_session->local_application_settings.CopyFrom( ------------------ | Branch (644:9): [True: 0, False: 0] ------------------ 645| 0| hs->early_session->local_application_settings) || 646| 0| !hs->new_session->peer_application_settings.CopyFrom( ------------------ | Branch (646:9): [True: 0, False: 0] ------------------ 647| 0| hs->early_session->peer_application_settings)) { 648| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); ------------------ | | 4387| 0|#define SSL_AD_INTERNAL_ERROR TLS1_AD_INTERNAL_ERROR | | ------------------ | | | | 37| 0|#define TLS1_AD_INTERNAL_ERROR 80 | | ------------------ ------------------ 649| 0| return ssl_hs_error; 650| 0| } 651| 0| } 652| | 653| | // Store the negotiated ALPN in the session. 654| 209| if (!hs->new_session->early_alpn.CopyFrom(ssl->s3->alpn_selected)) { ------------------ | Branch (654:7): [True: 0, False: 209] ------------------ 655| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); ------------------ | | 4387| 0|#define SSL_AD_INTERNAL_ERROR TLS1_AD_INTERNAL_ERROR | | ------------------ | | | | 37| 0|#define TLS1_AD_INTERNAL_ERROR 80 | | ------------------ ------------------ 656| 0| return ssl_hs_error; 657| 0| } 658| | 659| 209| if (!ssl_hash_message(hs, msg)) { ------------------ | Branch (659:7): [True: 0, False: 209] ------------------ 660| 0| return ssl_hs_error; 661| 0| } 662| | 663| 209| ssl->method->next_message(ssl); 664| 209| hs->tls13_state = state_read_certificate_request; 665| 209| if (hs->in_early_data && !ssl->s3->early_data_accepted) { ------------------ | Branch (665:7): [True: 0, False: 209] | Branch (665:28): [True: 0, False: 0] ------------------ 666| 0| if (!close_early_data(hs, ssl_encryption_handshake)) { ------------------ | Branch (666:9): [True: 0, False: 0] ------------------ 667| 0| return ssl_hs_error; 668| 0| } 669| 0| return ssl_hs_early_data_rejected; 670| 0| } 671| 209| return ssl_hs_ok; 672| 209|} tls13_client.cc:_ZN4bsslL27do_read_certificate_requestEPNS_13SSL_HANDSHAKEE: 674| 504|static enum ssl_hs_wait_t do_read_certificate_request(SSL_HANDSHAKE *hs) { 675| 504| SSL *const ssl = hs->ssl; 676| | // CertificateRequest may only be sent in non-resumption handshakes. 677| 504| if (ssl->s3->session_reused) { ------------------ | Branch (677:7): [True: 0, False: 504] ------------------ 678| 0| if (ssl->ctx->reverify_on_resume && !ssl->s3->early_data_accepted) { ------------------ | Branch (678:9): [True: 0, False: 0] | Branch (678:41): [True: 0, False: 0] ------------------ 679| 0| hs->tls13_state = state_server_certificate_reverify; 680| 0| return ssl_hs_ok; 681| 0| } 682| 0| hs->tls13_state = state_read_server_finished; 683| 0| return ssl_hs_ok; 684| 0| } 685| | 686| 504| if (hs->pake_prover) { ------------------ | Branch (686:7): [True: 0, False: 504] ------------------ 687| 0| hs->tls13_state = state_read_server_finished; 688| 0| return ssl_hs_ok; 689| 0| } 690| | 691| 504| SSLMessage msg; 692| 504| if (!ssl->method->get_message(ssl, &msg)) { ------------------ | Branch (692:7): [True: 306, False: 198] ------------------ 693| 306| return ssl_hs_read_message; 694| 306| } 695| | 696| | // CertificateRequest is optional. 697| 198| if (msg.type != SSL3_MT_CERTIFICATE_REQUEST) { ------------------ | | 202| 198|#define SSL3_MT_CERTIFICATE_REQUEST 13 ------------------ | Branch (697:7): [True: 184, False: 14] ------------------ 698| 184| hs->tls13_state = state_read_server_certificate; 699| 184| return ssl_hs_ok; 700| 184| } 701| | 702| 14| SSLExtension sigalgs(TLSEXT_TYPE_signature_algorithms), ------------------ | | 59| 14|#define TLSEXT_TYPE_signature_algorithms 13 ------------------ 703| 14| ca(TLSEXT_TYPE_certificate_authorities); ------------------ | | 102| 14|#define TLSEXT_TYPE_certificate_authorities 47 ------------------ 704| 14| CBS body = msg.body, context, extensions, supported_signature_algorithms; 705| 14| uint8_t alert = SSL_AD_DECODE_ERROR; ------------------ | | 4382| 14|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 14|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 706| 14| if (!CBS_get_u8_length_prefixed(&body, &context) || ------------------ | Branch (706:7): [True: 1, False: 13] | Branch (706:7): [True: 8, False: 6] ------------------ 707| | // The request context is always empty during the handshake. 708| 14| CBS_len(&context) != 0 || ------------------ | Branch (708:7): [True: 1, False: 12] ------------------ 709| 14| !CBS_get_u16_length_prefixed(&body, &extensions) || // ------------------ | Branch (709:7): [True: 1, False: 11] ------------------ 710| 14| CBS_len(&body) != 0 || ------------------ | Branch (710:7): [True: 1, False: 10] ------------------ 711| 14| !ssl_parse_extensions(&extensions, &alert, {&sigalgs, &ca}, ------------------ | Branch (711:7): [True: 2, False: 8] ------------------ 712| 10| /*ignore_unknown=*/true) || 713| 14| !sigalgs.present || ------------------ | Branch (713:7): [True: 1, False: 7] ------------------ 714| 14| !CBS_get_u16_length_prefixed(&sigalgs.data, ------------------ | Branch (714:7): [True: 1, False: 6] ------------------ 715| 7| &supported_signature_algorithms) || 716| 14| !tls1_parse_peer_sigalgs(hs, &supported_signature_algorithms)) { ------------------ | Branch (716:7): [True: 0, False: 6] ------------------ 717| 8| ssl_send_alert(ssl, SSL3_AL_FATAL, alert); ------------------ | | 176| 8|#define SSL3_AL_FATAL 2 ------------------ 718| 8| OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR); ------------------ | | 361| 8| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 719| 8| return ssl_hs_error; 720| 8| } 721| | 722| 6| if (ca.present) { ------------------ | Branch (722:7): [True: 3, False: 3] ------------------ 723| 3| hs->ca_names = SSL_parse_CA_list(ssl, &alert, &ca.data); 724| 3| if (!hs->ca_names) { ------------------ | Branch (724:9): [True: 1, False: 2] ------------------ 725| 1| ssl_send_alert(ssl, SSL3_AL_FATAL, alert); ------------------ | | 176| 1|#define SSL3_AL_FATAL 2 ------------------ 726| 1| return ssl_hs_error; 727| 1| } 728| 3| } else { 729| 3| hs->ca_names.reset(sk_CRYPTO_BUFFER_new_null()); 730| 3| if (!hs->ca_names) { ------------------ | Branch (730:9): [True: 0, False: 3] ------------------ 731| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); ------------------ | | 4387| 0|#define SSL_AD_INTERNAL_ERROR TLS1_AD_INTERNAL_ERROR | | ------------------ | | | | 37| 0|#define TLS1_AD_INTERNAL_ERROR 80 | | ------------------ ------------------ 732| 0| return ssl_hs_error; 733| 0| } 734| 3| } 735| | 736| 5| hs->cert_request = true; 737| 5| ssl->ctx->x509_method->hs_flush_cached_ca_names(hs); 738| | 739| 5| if (!ssl_hash_message(hs, msg)) { ------------------ | Branch (739:7): [True: 0, False: 5] ------------------ 740| 0| return ssl_hs_error; 741| 0| } 742| | 743| 5| ssl->method->next_message(ssl); 744| 5| hs->tls13_state = state_read_server_certificate; 745| 5| return ssl_hs_ok; 746| 5|} tls13_client.cc:_ZN4bsslL26do_read_server_certificateEPNS_13SSL_HANDSHAKEE: 748| 189|static enum ssl_hs_wait_t do_read_server_certificate(SSL_HANDSHAKE *hs) { 749| 189| SSL *const ssl = hs->ssl; 750| 189| SSLMessage msg; 751| 189| if (!ssl->method->get_message(ssl, &msg)) { ------------------ | Branch (751:7): [True: 1, False: 188] ------------------ 752| 1| return ssl_hs_read_message; 753| 1| } 754| | 755| 188| if (msg.type != SSL3_MT_COMPRESSED_CERTIFICATE && ------------------ | | 210| 376|#define SSL3_MT_COMPRESSED_CERTIFICATE 25 ------------------ | Branch (755:7): [True: 170, False: 18] ------------------ 756| 188| !ssl_check_message_type(ssl, msg, SSL3_MT_CERTIFICATE)) { ------------------ | | 200| 170|#define SSL3_MT_CERTIFICATE 11 ------------------ | Branch (756:7): [True: 1, False: 169] ------------------ 757| 1| return ssl_hs_error; 758| 1| } 759| | 760| 187| if (!tls13_process_certificate(hs, msg, false /* certificate required */) || ------------------ | Branch (760:7): [True: 51, False: 136] ------------------ 761| 187| !ssl_hash_message(hs, msg)) { ------------------ | Branch (761:7): [True: 0, False: 136] ------------------ 762| 51| return ssl_hs_error; 763| 51| } 764| | 765| 136| ssl->method->next_message(ssl); 766| 136| hs->tls13_state = state_read_server_certificate_verify; 767| 136| return ssl_hs_ok; 768| 187|} tls13_client.cc:_ZN4bsslL33do_read_server_certificate_verifyEPNS_13SSL_HANDSHAKEE: 770| 324|static enum ssl_hs_wait_t do_read_server_certificate_verify(SSL_HANDSHAKE *hs) { 771| 324| SSL *const ssl = hs->ssl; 772| 324| SSLMessage msg; 773| 324| if (!ssl->method->get_message(ssl, &msg)) { ------------------ | Branch (773:7): [True: 195, False: 129] ------------------ 774| 195| return ssl_hs_read_message; 775| 195| } 776| 129| switch (ssl_verify_peer_cert(hs)) { ------------------ | Branch (776:11): [True: 0, False: 129] ------------------ 777| 129| case ssl_verify_ok: ------------------ | Branch (777:5): [True: 129, False: 0] ------------------ 778| 129| break; 779| 0| case ssl_verify_invalid: ------------------ | Branch (779:5): [True: 0, False: 129] ------------------ 780| 0| return ssl_hs_error; 781| 0| case ssl_verify_retry: ------------------ | Branch (781:5): [True: 0, False: 129] ------------------ 782| 0| hs->tls13_state = state_read_server_certificate_verify; 783| 0| return ssl_hs_certificate_verify; 784| 129| } 785| | 786| 129| if (!ssl_check_message_type(ssl, msg, SSL3_MT_CERTIFICATE_VERIFY) || ------------------ | | 204| 129|#define SSL3_MT_CERTIFICATE_VERIFY 15 ------------------ | Branch (786:7): [True: 1, False: 128] ------------------ 787| 129| !tls13_process_certificate_verify(hs, msg) || ------------------ | Branch (787:7): [True: 5, False: 123] ------------------ 788| 129| !ssl_hash_message(hs, msg)) { ------------------ | Branch (788:7): [True: 0, False: 123] ------------------ 789| 6| return ssl_hs_error; 790| 6| } 791| | 792| 123| ssl->method->next_message(ssl); 793| 123| hs->tls13_state = state_read_server_finished; 794| 123| return ssl_hs_ok; 795| 129|} tls13_client.cc:_ZN4bsslL23do_read_server_finishedEPNS_13SSL_HANDSHAKEE: 811| 298|static enum ssl_hs_wait_t do_read_server_finished(SSL_HANDSHAKE *hs) { 812| 298| SSL *const ssl = hs->ssl; 813| 298| SSLMessage msg; 814| 298| if (!ssl->method->get_message(ssl, &msg)) { ------------------ | Branch (814:7): [True: 182, False: 116] ------------------ 815| 182| return ssl_hs_read_message; 816| 182| } 817| 116| if (!ssl_check_message_type(ssl, msg, SSL3_MT_FINISHED) || ------------------ | | 206| 116|#define SSL3_MT_FINISHED 20 ------------------ | Branch (817:7): [True: 1, False: 115] ------------------ 818| 116| !tls13_process_finished(hs, msg, false /* don't use saved value */) || ------------------ | Branch (818:7): [True: 0, False: 115] ------------------ 819| 116| !ssl_hash_message(hs, msg) || ------------------ | Branch (819:7): [True: 0, False: 115] ------------------ 820| | // Update the secret to the master secret and derive traffic keys. 821| 116| !tls13_advance_key_schedule(hs, ------------------ | Branch (821:7): [True: 0, False: 115] ------------------ 822| 115| Span(kZeroes, hs->transcript.DigestLen())) || 823| 116| !tls13_derive_application_secrets(hs)) { ------------------ | Branch (823:7): [True: 0, False: 115] ------------------ 824| 1| return ssl_hs_error; 825| 1| } 826| | 827| | // Finished should be the end of the flight. 828| 115| if (ssl->method->has_unprocessed_handshake_data(ssl)) { ------------------ | Branch (828:7): [True: 1, False: 114] ------------------ 829| 1| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE); ------------------ | | 176| 1|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE); ------------------ | | 4367| 1|#define SSL_AD_UNEXPECTED_MESSAGE SSL3_AD_UNEXPECTED_MESSAGE | | ------------------ | | | | 179| 1|#define SSL3_AD_UNEXPECTED_MESSAGE 10 // fatal | | ------------------ ------------------ 830| 1| OPENSSL_PUT_ERROR(SSL, SSL_R_EXCESS_HANDSHAKE_DATA); ------------------ | | 361| 1| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 831| 1| return ssl_hs_error; 832| 1| } 833| | 834| 114| ssl->method->next_message(ssl); 835| 114| hs->tls13_state = state_send_end_of_early_data; 836| 114| return ssl_hs_ok; 837| 115|} tls13_client.cc:_ZN4bsslL25do_send_end_of_early_dataEPNS_13SSL_HANDSHAKEE: 839| 114|static enum ssl_hs_wait_t do_send_end_of_early_data(SSL_HANDSHAKE *hs) { 840| 114| SSL *const ssl = hs->ssl; 841| | 842| 114| if (ssl->s3->early_data_accepted) { ------------------ | Branch (842:7): [True: 0, False: 114] ------------------ 843| | // DTLS and QUIC omit the EndOfEarlyData message. See RFC 9001, section 8.3, 844| | // and RFC 9147, section 5.6. 845| 0| if (!SSL_is_quic(ssl) && !SSL_is_dtls(ssl)) { ------------------ | Branch (845:9): [True: 0, False: 0] | Branch (845:30): [True: 0, False: 0] ------------------ 846| 0| ScopedCBB cbb; 847| 0| CBB body; 848| 0| if (!ssl->method->init_message(ssl, cbb.get(), &body, ------------------ | Branch (848:11): [True: 0, False: 0] ------------------ 849| 0| SSL3_MT_END_OF_EARLY_DATA) || ------------------ | | 198| 0|#define SSL3_MT_END_OF_EARLY_DATA 5 ------------------ 850| 0| !ssl_add_message_cbb(ssl, cbb.get())) { ------------------ | Branch (850:11): [True: 0, False: 0] ------------------ 851| 0| return ssl_hs_error; 852| 0| } 853| 0| } 854| | 855| 0| if (!close_early_data(hs, ssl_encryption_handshake)) { ------------------ | Branch (855:9): [True: 0, False: 0] ------------------ 856| 0| return ssl_hs_error; 857| 0| } 858| 0| } 859| | 860| 114| hs->tls13_state = state_send_client_encrypted_extensions; 861| 114| return ssl_hs_ok; 862| 114|} tls13_client.cc:_ZN4bsslL26do_send_client_certificateEPNS_13SSL_HANDSHAKEE: 910| 114|static enum ssl_hs_wait_t do_send_client_certificate(SSL_HANDSHAKE *hs) { 911| 114| SSL *const ssl = hs->ssl; 912| | 913| | // The peer didn't request a certificate. 914| 114| if (!hs->cert_request) { ------------------ | Branch (914:7): [True: 114, False: 0] ------------------ 915| 114| hs->tls13_state = state_complete_second_flight; 916| 114| return ssl_hs_ok; 917| 114| } 918| | 919| 0| if (ssl->s3->ech_status == ssl_ech_rejected) { ------------------ | Branch (919:7): [True: 0, False: 0] ------------------ 920| | // Do not send client certificates on ECH reject. We have not authenticated 921| | // the server for the name that can learn the certificate. 922| 0| SSL_certs_clear(ssl); 923| 0| } else if (hs->config->cert->cert_cb != nullptr) { ------------------ | Branch (923:14): [True: 0, False: 0] ------------------ 924| | // Call cert_cb to update the certificate. 925| 0| int rv = hs->config->cert->cert_cb(ssl, hs->config->cert->cert_cb_arg); 926| 0| if (rv == 0) { ------------------ | Branch (926:9): [True: 0, False: 0] ------------------ 927| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR); ------------------ | | 4387| 0|#define SSL_AD_INTERNAL_ERROR TLS1_AD_INTERNAL_ERROR | | ------------------ | | | | 37| 0|#define TLS1_AD_INTERNAL_ERROR 80 | | ------------------ ------------------ 928| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_CERT_CB_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 929| 0| return ssl_hs_error; 930| 0| } 931| 0| if (rv < 0) { ------------------ | Branch (931:9): [True: 0, False: 0] ------------------ 932| 0| hs->tls13_state = state_send_client_certificate; 933| 0| return ssl_hs_x509_lookup; 934| 0| } 935| 0| } 936| | 937| 0| Array creds; 938| 0| if (!ssl_get_full_credential_list(hs, &creds)) { ------------------ | Branch (938:7): [True: 0, False: 0] ------------------ 939| 0| return ssl_hs_error; 940| 0| } 941| | 942| 0| if (!creds.empty()) { ------------------ | Branch (942:7): [True: 0, False: 0] ------------------ 943| | // Select the credential to use. 944| 0| for (SSL_CREDENTIAL *cred : creds) { ------------------ | Branch (944:31): [True: 0, False: 0] ------------------ 945| 0| ERR_clear_error(); 946| 0| uint16_t sigalg; 947| 0| if (check_credential(hs, cred, &sigalg)) { ------------------ | Branch (947:11): [True: 0, False: 0] ------------------ 948| 0| hs->credential = UpRef(cred); 949| 0| hs->signature_algorithm = sigalg; 950| 0| break; 951| 0| } 952| 0| } 953| 0| if (hs->credential == nullptr) { ------------------ | Branch (953:9): [True: 0, False: 0] ------------------ 954| | // The error from the last attempt is in the error queue. 955| 0| assert(ERR_peek_error() != 0); 956| 0| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE); ------------------ | | 176| 0|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE); ------------------ | | 4372| 0|#define SSL_AD_HANDSHAKE_FAILURE SSL3_AD_HANDSHAKE_FAILURE | | ------------------ | | | | 182| 0|#define SSL3_AD_HANDSHAKE_FAILURE 40 // fatal | | ------------------ ------------------ 957| 0| return ssl_hs_error; 958| 0| } 959| 0| } 960| | 961| 0| if (!tls13_add_certificate(hs)) { ------------------ | Branch (961:7): [True: 0, False: 0] ------------------ 962| 0| return ssl_hs_error; 963| 0| } 964| | 965| 0| hs->tls13_state = state_send_client_certificate_verify; 966| 0| return ssl_hs_ok; 967| 0|} tls13_client.cc:_ZN4bsslL35do_send_client_encrypted_extensionsEPNS_13SSL_HANDSHAKEE: 865| 114| SSL_HANDSHAKE *hs) { 866| 114| SSL *const ssl = hs->ssl; 867| | // For now, only one extension uses client EncryptedExtensions. This function 868| | // may be generalized if others use it in the future. 869| 114| if (hs->new_session->has_application_settings && ------------------ | Branch (869:7): [True: 0, False: 114] ------------------ 870| 114| !ssl->s3->early_data_accepted) { ------------------ | Branch (870:7): [True: 0, False: 0] ------------------ 871| 0| ScopedCBB cbb; 872| 0| CBB body, extensions, extension; 873| 0| uint16_t extension_type = TLSEXT_TYPE_application_settings_old; ------------------ | | 114| 0|#define TLSEXT_TYPE_application_settings_old 17513 ------------------ 874| 0| if (hs->config->alps_use_new_codepoint) { ------------------ | Branch (874:9): [True: 0, False: 0] ------------------ 875| 0| extension_type = TLSEXT_TYPE_application_settings; ------------------ | | 115| 0|#define TLSEXT_TYPE_application_settings 17613 ------------------ 876| 0| } 877| 0| if (!ssl->method->init_message(ssl, cbb.get(), &body, ------------------ | Branch (877:9): [True: 0, False: 0] ------------------ 878| 0| SSL3_MT_ENCRYPTED_EXTENSIONS) || ------------------ | | 199| 0|#define SSL3_MT_ENCRYPTED_EXTENSIONS 8 ------------------ 879| 0| !CBB_add_u16_length_prefixed(&body, &extensions) || ------------------ | Branch (879:9): [True: 0, False: 0] ------------------ 880| 0| !CBB_add_u16(&extensions, extension_type) || ------------------ | Branch (880:9): [True: 0, False: 0] ------------------ 881| 0| !CBB_add_u16_length_prefixed(&extensions, &extension) || ------------------ | Branch (881:9): [True: 0, False: 0] ------------------ 882| 0| !CBB_add_bytes(&extension, ------------------ | Branch (882:9): [True: 0, False: 0] ------------------ 883| 0| hs->new_session->local_application_settings.data(), 884| 0| hs->new_session->local_application_settings.size()) || 885| 0| !ssl_add_message_cbb(ssl, cbb.get())) { ------------------ | Branch (885:9): [True: 0, False: 0] ------------------ 886| 0| return ssl_hs_error; 887| 0| } 888| 0| } 889| | 890| 114| hs->tls13_state = state_send_client_certificate; 891| 114| return ssl_hs_ok; 892| 114|} tls13_client.cc:_ZN4bsslL25do_complete_second_flightEPNS_13SSL_HANDSHAKEE: 993| 114|static enum ssl_hs_wait_t do_complete_second_flight(SSL_HANDSHAKE *hs) { 994| 114| SSL *const ssl = hs->ssl; 995| 114| hs->can_release_private_key = true; 996| | 997| | // Send a Channel ID assertion if necessary. 998| 114| if (hs->channel_id_negotiated) { ------------------ | Branch (998:7): [True: 0, False: 114] ------------------ 999| 0| ScopedCBB cbb; 1000| 0| CBB body; 1001| 0| if (!ssl->method->init_message(ssl, cbb.get(), &body, SSL3_MT_CHANNEL_ID) || ------------------ | | 212| 0|#define SSL3_MT_CHANNEL_ID 203 ------------------ | Branch (1001:9): [True: 0, False: 0] ------------------ 1002| 0| !tls1_write_channel_id(hs, &body) || ------------------ | Branch (1002:9): [True: 0, False: 0] ------------------ 1003| 0| !ssl_add_message_cbb(ssl, cbb.get())) { ------------------ | Branch (1003:9): [True: 0, False: 0] ------------------ 1004| 0| return ssl_hs_error; 1005| 0| } 1006| 0| } 1007| | 1008| | // Send a Finished message. 1009| 114| if (!tls13_add_finished(hs)) { ------------------ | Branch (1009:7): [True: 0, False: 114] ------------------ 1010| 0| return ssl_hs_error; 1011| 0| } 1012| | 1013| | // Derive the final keys and enable them. 1014| 114| if (!tls13_set_traffic_key(ssl, ssl_encryption_application, evp_aead_seal, ------------------ | Branch (1014:7): [True: 0, False: 114] ------------------ 1015| 114| hs->new_session.get(), 1016| 114| hs->client_traffic_secret_0) || 1017| 114| !tls13_set_traffic_key(ssl, ssl_encryption_application, evp_aead_open, ------------------ | Branch (1017:7): [True: 0, False: 114] ------------------ 1018| 114| hs->new_session.get(), 1019| 114| hs->server_traffic_secret_0) || 1020| 114| !tls13_derive_resumption_secret(hs)) { ------------------ | Branch (1020:7): [True: 0, False: 114] ------------------ 1021| 0| return ssl_hs_error; 1022| 0| } 1023| | 1024| 114| hs->tls13_state = state_done; 1025| 114| return ssl_hs_flush; 1026| 114|} _ZN4bssl23tls13_init_key_scheduleEPNS_13SSL_HANDSHAKEENS_4SpanIKhEE: 64| 255|bool tls13_init_key_schedule(SSL_HANDSHAKE *hs, Span psk) { 65| 255| if (!init_key_schedule(hs, &hs->transcript, ssl_protocol_version(hs->ssl), ------------------ | Branch (65:7): [True: 0, False: 255] ------------------ 66| 255| hs->new_cipher)) { 67| 0| return false; 68| 0| } 69| | 70| | // Handback includes the whole handshake transcript, so we cannot free the 71| | // transcript buffer in the handback case. 72| 255| if (!hs->handback) { ------------------ | Branch (72:7): [True: 255, False: 0] ------------------ 73| 255| hs->transcript.FreeBuffer(); 74| 255| } 75| 255| return hkdf_extract_to_secret(hs, hs->transcript, psk); 76| 255|} _ZN4bssl29tls13_init_early_key_scheduleEPNS_13SSL_HANDSHAKEEPK14ssl_session_st: 79| 6| const SSL_SESSION *session) { 80| 6| assert(!hs->ssl->server); 81| | // When offering ECH, early data is associated with ClientHelloInner, not 82| | // ClientHelloOuter. 83| 6| SSLTranscript *transcript = 84| 6| hs->selected_ech_config ? &hs->inner_transcript : &hs->transcript; ------------------ | Branch (84:7): [True: 0, False: 6] ------------------ 85| 6| return init_key_schedule(hs, transcript, ------------------ | Branch (85:10): [True: 6, False: 0] ------------------ 86| 6| ssl_session_protocol_version(session), 87| 6| session->cipher) && 88| 6| hkdf_extract_to_secret(hs, *transcript, session->secret); ------------------ | Branch (88:10): [True: 6, False: 0] ------------------ 89| 6|} _ZN4bssl26tls13_advance_key_scheduleEPNS_13SSL_HANDSHAKEENS_4SpanIKhEE: 142| 349|bool tls13_advance_key_schedule(SSL_HANDSHAKE *hs, Span in) { 143| 349| uint8_t derive_context[EVP_MAX_MD_SIZE]; 144| 349| unsigned derive_context_len; 145| 349| return EVP_Digest(nullptr, 0, derive_context, &derive_context_len, ------------------ | Branch (145:10): [True: 349, False: 0] ------------------ 146| 349| hs->transcript.Digest(), nullptr) && 147| 349| hkdf_expand_label(Span(hs->secret), hs->transcript.Digest(), ------------------ | Branch (147:10): [True: 349, False: 0] ------------------ 148| 349| hs->secret, kTLS13LabelDerived, 149| 349| Span(derive_context, derive_context_len), 150| 349| SSL_is_dtls(hs->ssl)) && 151| 349| hkdf_extract_to_secret(hs, hs->transcript, in); ------------------ | Branch (151:10): [True: 349, False: 0] ------------------ 152| 349|} _ZN4bssl21tls13_set_traffic_keyEP6ssl_st22ssl_encryption_level_t20evp_aead_direction_tPK14ssl_session_stNS_4SpanIKhEE: 182| 704| Span traffic_secret) { 183| 704| uint16_t version = ssl_session_protocol_version(session); 184| 704| const EVP_MD *digest = ssl_session_get_digest(session); 185| 704| bool is_dtls = SSL_is_dtls(ssl); 186| 704| UniquePtr traffic_aead; 187| 704| if (SSL_is_quic(ssl)) { ------------------ | Branch (187:7): [True: 0, False: 704] ------------------ 188| | // Install a placeholder SSLAEADContext so that SSL accessors work. The 189| | // encryption itself will be handled by the SSL_QUIC_METHOD. 190| 0| traffic_aead = SSLAEADContext::CreatePlaceholderForQUIC(session->cipher); 191| 704| } else { 192| | // Look up cipher suite properties. 193| 704| const EVP_AEAD *aead; 194| 704| size_t discard; 195| 704| if (!ssl_cipher_get_evp_aead(&aead, &discard, &discard, session->cipher, ------------------ | Branch (195:9): [True: 0, False: 704] ------------------ 196| 704| version)) { 197| 0| return false; 198| 0| } 199| | 200| | // Derive the key and IV. 201| 704| uint8_t key_buf[EVP_AEAD_MAX_KEY_LENGTH], iv_buf[EVP_AEAD_MAX_NONCE_LENGTH]; 202| 704| auto key = Span(key_buf).first(EVP_AEAD_key_length(aead)); 203| 704| auto iv = Span(iv_buf).first(EVP_AEAD_nonce_length(aead)); 204| 704| if (!hkdf_expand_label(key, digest, traffic_secret, "key", {}, is_dtls) || ------------------ | Branch (204:9): [True: 0, False: 704] ------------------ 205| 704| !hkdf_expand_label(iv, digest, traffic_secret, "iv", {}, is_dtls)) { ------------------ | Branch (205:9): [True: 0, False: 704] ------------------ 206| 0| return false; 207| 0| } 208| | 209| 704| traffic_aead = SSLAEADContext::Create(direction, session->ssl_version, 210| 704| session->cipher, key, {}, iv); 211| 704| } 212| | 213| 704| if (!traffic_aead) { ------------------ | Branch (213:7): [True: 1, False: 703] ------------------ 214| 1| return false; 215| 1| } 216| | 217| 703| if (direction == evp_aead_open) { ------------------ | Branch (217:7): [True: 350, False: 353] ------------------ 218| 350| if (!ssl->method->set_read_state(ssl, level, std::move(traffic_aead), ------------------ | Branch (218:9): [True: 3, False: 347] ------------------ 219| 350| traffic_secret)) { 220| 3| return false; 221| 3| } 222| 347| ssl->s3->read_traffic_secret.CopyFrom(traffic_secret); 223| 353| } else { 224| 353| if (!ssl->method->set_write_state(ssl, level, std::move(traffic_aead), ------------------ | Branch (224:9): [True: 0, False: 353] ------------------ 225| 353| traffic_secret)) { 226| 0| return false; 227| 0| } 228| 353| ssl->s3->write_traffic_secret.CopyFrom(traffic_secret); 229| 353| } 230| | 231| 700| return true; 232| 703|} _ZN4bssl25tls13_derive_early_secretEPNS_13SSL_HANDSHAKEE: 348| 6|bool tls13_derive_early_secret(SSL_HANDSHAKE *hs) { 349| 6| SSL *const ssl = hs->ssl; 350| | // When offering ECH on the client, early data is associated with 351| | // ClientHelloInner, not ClientHelloOuter. 352| 6| const SSLTranscript &transcript = (!ssl->server && hs->selected_ech_config) ------------------ | Branch (352:38): [True: 6, False: 0] | Branch (352:54): [True: 0, False: 6] ------------------ 353| 6| ? hs->inner_transcript 354| 6| : hs->transcript; 355| 6| if (!derive_secret_with_transcript(hs, &hs->early_traffic_secret, transcript, ------------------ | Branch (355:7): [True: 0, False: 6] ------------------ 356| 6| kTLS13LabelClientEarlyTraffic) || 357| 6| !ssl_log_secret(ssl, "CLIENT_EARLY_TRAFFIC_SECRET", ------------------ | Branch (357:7): [True: 0, False: 6] ------------------ 358| 6| hs->early_traffic_secret)) { 359| 0| return false; 360| 0| } 361| 6| return true; 362| 6|} _ZN4bssl30tls13_derive_handshake_secretsEPNS_13SSL_HANDSHAKEE: 364| 234|bool tls13_derive_handshake_secrets(SSL_HANDSHAKE *hs) { 365| 234| SSL *const ssl = hs->ssl; 366| 234| if (!derive_secret(hs, &hs->client_handshake_secret, ------------------ | Branch (366:7): [True: 0, False: 234] ------------------ 367| 234| kTLS13LabelClientHandshakeTraffic) || 368| 234| !ssl_log_secret(ssl, "CLIENT_HANDSHAKE_TRAFFIC_SECRET", ------------------ | Branch (368:7): [True: 0, False: 234] ------------------ 369| 234| hs->client_handshake_secret) || 370| 234| !derive_secret(hs, &hs->server_handshake_secret, ------------------ | Branch (370:7): [True: 0, False: 234] ------------------ 371| 234| kTLS13LabelServerHandshakeTraffic) || 372| 234| !ssl_log_secret(ssl, "SERVER_HANDSHAKE_TRAFFIC_SECRET", ------------------ | Branch (372:7): [True: 0, False: 234] ------------------ 373| 234| hs->server_handshake_secret)) { 374| 0| return false; 375| 0| } 376| | 377| 234| return true; 378| 234|} _ZN4bssl32tls13_derive_application_secretsEPNS_13SSL_HANDSHAKEE: 380| 115|bool tls13_derive_application_secrets(SSL_HANDSHAKE *hs) { 381| 115| SSL *const ssl = hs->ssl; 382| 115| if (!derive_secret(hs, &hs->client_traffic_secret_0, ------------------ | Branch (382:7): [True: 0, False: 115] ------------------ 383| 115| kTLS13LabelClientApplicationTraffic) || 384| 115| !ssl_log_secret(ssl, "CLIENT_TRAFFIC_SECRET_0", ------------------ | Branch (384:7): [True: 0, False: 115] ------------------ 385| 115| hs->client_traffic_secret_0) || 386| 115| !derive_secret(hs, &hs->server_traffic_secret_0, ------------------ | Branch (386:7): [True: 0, False: 115] ------------------ 387| 115| kTLS13LabelServerApplicationTraffic) || 388| 115| !ssl_log_secret(ssl, "SERVER_TRAFFIC_SECRET_0", ------------------ | Branch (388:7): [True: 0, False: 115] ------------------ 389| 115| hs->server_traffic_secret_0) || 390| 115| !derive_secret(hs, &ssl->s3->exporter_secret, kTLS13LabelExporter) || ------------------ | Branch (390:7): [True: 0, False: 115] ------------------ 391| 115| !ssl_log_secret(ssl, "EXPORTER_SECRET", ssl->s3->exporter_secret)) { ------------------ | Branch (391:7): [True: 0, False: 115] ------------------ 392| 0| return false; 393| 0| } 394| | 395| 115| return true; 396| 115|} _ZN4bssl24tls13_rotate_traffic_keyEP6ssl_st20evp_aead_direction_t: 400| 2|bool tls13_rotate_traffic_key(SSL *ssl, enum evp_aead_direction_t direction) { 401| 2| Span secret = direction == evp_aead_open ------------------ | Branch (401:26): [True: 2, False: 0] ------------------ 402| 2| ? Span(ssl->s3->read_traffic_secret) 403| 2| : Span(ssl->s3->write_traffic_secret); 404| | 405| 2| const SSL_SESSION *session = SSL_get_session(ssl); 406| 2| const EVP_MD *digest = ssl_session_get_digest(session); 407| 2| return hkdf_expand_label(secret, digest, secret, ------------------ | Branch (407:10): [True: 2, False: 0] ------------------ 408| 2| kTLS13LabelApplicationTraffic, {}, 409| 2| SSL_is_dtls(ssl)) && 410| 2| tls13_set_traffic_key(ssl, ssl_encryption_application, direction, ------------------ | Branch (410:10): [True: 0, False: 2] ------------------ 411| 2| session, secret); 412| 2|} _ZN4bssl30tls13_derive_resumption_secretEPNS_13SSL_HANDSHAKEE: 416| 114|bool tls13_derive_resumption_secret(SSL_HANDSHAKE *hs) { 417| 114| return derive_secret(hs, &hs->new_session->secret, kTLS13LabelResumption); 418| 114|} _ZN4bssl18tls13_finished_macEPNS_13SSL_HANDSHAKEEPhPmb: 443| 229| bool is_server) { 444| 229| Span traffic_secret = 445| 229| is_server ? hs->server_handshake_secret : hs->client_handshake_secret; ------------------ | Branch (445:7): [True: 115, False: 114] ------------------ 446| | 447| 229| uint8_t context_hash[EVP_MAX_MD_SIZE]; 448| 229| size_t context_hash_len; 449| 229| if (!hs->transcript.GetHash(context_hash, &context_hash_len) || ------------------ | Branch (449:7): [True: 0, False: 229] | Branch (449:7): [True: 0, False: 229] ------------------ 450| 229| !tls13_verify_data(out, out_len, hs->transcript.Digest(), ------------------ | Branch (450:7): [True: 0, False: 229] ------------------ 451| 229| hs->ssl->s3->version, traffic_secret, 452| 229| Span(context_hash, context_hash_len), 453| 229| SSL_is_dtls(hs->ssl))) { 454| 0| return false; 455| 0| } 456| 229| return true; 457| 229|} _ZN4bssl24tls13_derive_session_pskEP14ssl_session_stNS_4SpanIKhEEb: 462| 1.47k| bool is_dtls) { 463| 1.47k| const EVP_MD *digest = ssl_session_get_digest(session); 464| | // The session initially stores the resumption_master_secret, which we 465| | // override with the PSK. 466| 1.47k| assert(session->secret.size() == EVP_MD_size(digest)); 467| 1.47k| return hkdf_expand_label(Span(session->secret), digest, session->secret, 468| 1.47k| kTLS13LabelResumptionPSK, nonce, is_dtls); 469| 1.47k|} _ZN4bssl22tls13_write_psk_binderEPKNS_13SSL_HANDSHAKEERKNS_13SSLTranscriptENS_4SpanIhEEPm: 582| 47| size_t *out_binder_len) { 583| 47| const SSL *const ssl = hs->ssl; 584| 47| const EVP_MD *digest = ssl_session_get_digest(ssl->session.get()); 585| 47| const size_t hash_len = EVP_MD_size(digest); 586| | // We only offer one PSK, so the binders are a u16 and u8 length 587| | // prefix, followed by the binder. The caller is assumed to have constructed 588| | // |msg| with placeholder binders. 589| 47| const size_t binders_len = 3 + hash_len; 590| 47| uint8_t verify_data[EVP_MAX_MD_SIZE]; 591| 47| size_t verify_data_len; 592| 47| if (!tls13_psk_binder(verify_data, &verify_data_len, ssl->session.get(), ------------------ | Branch (592:7): [True: 0, False: 47] ------------------ 593| 47| transcript, msg, binders_len, SSL_is_dtls(hs->ssl)) || 594| 47| verify_data_len != hash_len) { ------------------ | Branch (594:7): [True: 0, False: 47] ------------------ 595| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 596| 0| return false; 597| 0| } 598| | 599| 47| auto msg_binder = msg.last(verify_data_len); 600| 47| OPENSSL_memcpy(msg_binder.data(), verify_data, verify_data_len); 601| 47| if (out_binder_len != nullptr) { ------------------ | Branch (601:7): [True: 0, False: 47] ------------------ 602| 0| *out_binder_len = verify_data_len; 603| 0| } 604| 47| return true; 605| 47|} _ZN4bssl40ssl_ech_confirmation_signal_hello_offsetEPK6ssl_st: 638| 274|size_t ssl_ech_confirmation_signal_hello_offset(const SSL *ssl) { 639| 274| static_assert(ECH_CONFIRMATION_SIGNAL_LEN < SSL3_RANDOM_SIZE, 640| 274| "the confirmation signal is a suffix of the random"); 641| 274| const size_t header_len = 642| 274| SSL_is_dtls(ssl) ? DTLS1_HM_HEADER_LENGTH : SSL3_HM_HEADER_LENGTH; ------------------ | | 2888| 0|#define DTLS1_HM_HEADER_LENGTH 12 ------------------ SSL_is_dtls(ssl) ? DTLS1_HM_HEADER_LENGTH : SSL3_HM_HEADER_LENGTH; ------------------ | | 106| 548|#define SSL3_HM_HEADER_LENGTH 4 ------------------ | Branch (642:7): [True: 0, False: 274] ------------------ 643| 274| return header_len + 2 /* version */ + SSL3_RANDOM_SIZE - ------------------ | | 102| 274|#define SSL3_RANDOM_SIZE 32 ------------------ 644| 274| ECH_CONFIRMATION_SIGNAL_LEN; ------------------ | | 1337| 274|#define ECH_CONFIRMATION_SIGNAL_LEN 8 ------------------ 645| 274|} tls13_enc.cc:_ZN4bsslL17init_key_scheduleEPNS_13SSL_HANDSHAKEEPNS_13SSLTranscriptEtPK13ssl_cipher_st: 41| 261| uint16_t version, const SSL_CIPHER *cipher) { 42| 261| if (!transcript->InitHash(version, cipher)) { ------------------ | Branch (42:7): [True: 0, False: 261] ------------------ 43| 0| return false; 44| 0| } 45| | 46| | // Initialize the secret to the zero key. 47| 261| hs->secret.clear(); 48| 261| hs->secret.Resize(transcript->DigestLen()); 49| 261| return true; 50| 261|} tls13_enc.cc:_ZN4bsslL22hkdf_extract_to_secretEPNS_13SSL_HANDSHAKEERKNS_13SSLTranscriptENS_4SpanIKhEE: 54| 610| Span in) { 55| 610| size_t len; 56| 610| if (!HKDF_extract(hs->secret.data(), &len, transcript.Digest(), in.data(), ------------------ | Branch (56:7): [True: 0, False: 610] ------------------ 57| 610| in.size(), hs->secret.data(), hs->secret.size())) { 58| 0| return false; 59| 0| } 60| 610| assert(len == hs->secret.size()); 61| 610| return true; 62| 610|} tls13_enc.cc:_ZN4bsslL17hkdf_expand_labelENS_4SpanIhEEPK9env_md_stNS0_IKhEENSt3__117basic_string_viewIcNS7_11char_traitsIcEEEES6_b: 129| 4.48k| bool is_dtls) { 130| 4.48k| if (is_dtls) { ------------------ | Branch (130:7): [True: 0, False: 4.48k] ------------------ 131| 0| return hkdf_expand_label_with_prefix(out, digest, secret, "dtls13", label, 132| 0| hash); 133| 0| } 134| 4.48k| return CRYPTO_tls13_hkdf_expand_label( 135| 4.48k| out.data(), out.size(), digest, secret.data(), secret.size(), 136| 4.48k| reinterpret_cast(label.data()), label.size(), 137| 4.48k| hash.data(), hash.size()) == 1; 138| 4.48k|} tls13_enc.cc:_ZN4bsslL29derive_secret_with_transcriptEPKNS_13SSL_HANDSHAKEEPNS_13InplaceVectorIhLm48EEERKNS_13SSLTranscriptENSt3__117basic_string_viewIcNS9_11char_traitsIcEEEE: 160| 933| const SSLTranscript &transcript, std::string_view label) { 161| 933| uint8_t context_hash[EVP_MAX_MD_SIZE]; 162| 933| size_t context_hash_len; 163| 933| if (!transcript.GetHash(context_hash, &context_hash_len)) { ------------------ | Branch (163:7): [True: 0, False: 933] ------------------ 164| 0| return false; 165| 0| } 166| | 167| 933| out->ResizeForOverwrite(transcript.DigestLen()); 168| 933| return hkdf_expand_label(Span(*out), transcript.Digest(), hs->secret, label, 169| 933| Span(context_hash, context_hash_len), 170| 933| SSL_is_dtls(hs->ssl)); 171| 933|} tls13_enc.cc:_ZN4bsslL13derive_secretEPNS_13SSL_HANDSHAKEEPNS_13InplaceVectorIhLm48EEENSt3__117basic_string_viewIcNS5_11char_traitsIcEEEE: 175| 927| std::string_view label) { 176| 927| return derive_secret_with_transcript(hs, out, hs->transcript, label); 177| 927|} tls13_enc.cc:_ZN4bsslL17tls13_verify_dataEPhPmPK9env_md_sttNS_4SpanIKhEES7_b: 428| 276| Span context, bool is_dtls) { 429| 276| uint8_t key_buf[EVP_MAX_MD_SIZE]; 430| 276| auto key = Span(key_buf, EVP_MD_size(digest)); 431| 276| unsigned len; 432| 276| if (!hkdf_expand_label(key, digest, secret, kTLS13LabelFinished, {}, ------------------ | Branch (432:7): [True: 0, False: 276] ------------------ 433| 276| is_dtls) || 434| 276| HMAC(digest, key.data(), key.size(), context.data(), context.size(), out, ------------------ | Branch (434:7): [True: 0, False: 276] ------------------ 435| 276| &len) == nullptr) { 436| 0| return false; 437| 0| } 438| 276| *out_len = len; 439| 276| return true; 440| 276|} tls13_enc.cc:_ZN4bsslL16tls13_psk_binderEPhPmPK14ssl_session_stRKNS_13SSLTranscriptENS_4SpanIKhEEmb: 512| 47| size_t binders_len, bool is_dtls) { 513| 47| const EVP_MD *digest = ssl_session_get_digest(session); 514| | 515| | // Compute the binder key. 516| | // 517| | // TODO(davidben): Ideally we wouldn't recompute early secret and the binder 518| | // key each time. 519| 47| uint8_t binder_context[EVP_MAX_MD_SIZE]; 520| 47| unsigned binder_context_len; 521| 47| uint8_t early_secret[EVP_MAX_MD_SIZE] = {0}; 522| 47| size_t early_secret_len; 523| 47| uint8_t binder_key_buf[EVP_MAX_MD_SIZE] = {0}; 524| 47| auto binder_key = Span(binder_key_buf, EVP_MD_size(digest)); 525| 47| if (!EVP_Digest(nullptr, 0, binder_context, &binder_context_len, digest, ------------------ | Branch (525:7): [True: 0, False: 47] | Branch (525:7): [True: 0, False: 47] ------------------ 526| 47| nullptr) || 527| 47| !HKDF_extract(early_secret, &early_secret_len, digest, ------------------ | Branch (527:7): [True: 0, False: 47] ------------------ 528| 47| session->secret.data(), session->secret.size(), nullptr, 529| 47| 0) || 530| 47| !hkdf_expand_label(binder_key, digest, ------------------ | Branch (530:7): [True: 0, False: 47] ------------------ 531| 47| Span(early_secret, early_secret_len), 532| 47| kTLS13LabelPSKBinder, 533| 47| Span(binder_context, binder_context_len), is_dtls)) { 534| 0| return false; 535| 0| } 536| | 537| | // Hash the transcript and truncated ClientHello. 538| 47| if (client_hello.size() < binders_len) { ------------------ | Branch (538:7): [True: 0, False: 47] ------------------ 539| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 540| 0| return false; 541| 0| } 542| 47| auto truncated = client_hello.subspan(0, client_hello.size() - binders_len); 543| 47| uint8_t context[EVP_MAX_MD_SIZE]; 544| 47| unsigned context_len; 545| 47| ScopedEVP_MD_CTX ctx; 546| 47| if (!is_dtls) { ------------------ | Branch (546:7): [True: 47, False: 0] ------------------ 547| 47| if (!transcript.CopyToHashContext(ctx.get(), digest) || ------------------ | Branch (547:9): [True: 0, False: 47] ------------------ 548| 47| !EVP_DigestUpdate(ctx.get(), truncated.data(), truncated.size()) || ------------------ | Branch (548:9): [True: 0, False: 47] ------------------ 549| 47| !EVP_DigestFinal_ex(ctx.get(), context, &context_len)) { ------------------ | Branch (549:9): [True: 0, False: 47] ------------------ 550| 0| return false; 551| 0| } 552| 47| } else { 553| | // In DTLS 1.3, the transcript hash is computed over only the TLS 1.3 554| | // handshake messages (i.e. only type and length in the header), not the 555| | // full DTLSHandshake messages that are in |truncated|. This code pulls 556| | // the header and body out of the truncated ClientHello and writes those 557| | // to the hash context so the correct binder value is computed. 558| 0| if (truncated.size() < DTLS1_HM_HEADER_LENGTH) { ------------------ | | 2888| 0|#define DTLS1_HM_HEADER_LENGTH 12 ------------------ | Branch (558:9): [True: 0, False: 0] ------------------ 559| 0| return false; 560| 0| } 561| 0| auto header = truncated.subspan(0, 4); 562| 0| auto body = truncated.subspan(12); 563| 0| if (!transcript.CopyToHashContext(ctx.get(), digest) || ------------------ | Branch (563:9): [True: 0, False: 0] ------------------ 564| 0| !EVP_DigestUpdate(ctx.get(), header.data(), header.size()) || ------------------ | Branch (564:9): [True: 0, False: 0] ------------------ 565| 0| !EVP_DigestUpdate(ctx.get(), body.data(), body.size()) || ------------------ | Branch (565:9): [True: 0, False: 0] ------------------ 566| 0| !EVP_DigestFinal_ex(ctx.get(), context, &context_len)) { ------------------ | Branch (566:9): [True: 0, False: 0] ------------------ 567| 0| return false; 568| 0| } 569| 0| } 570| | 571| 47| if (!tls13_verify_data(out, out_len, digest, session->ssl_version, binder_key, ------------------ | Branch (571:7): [True: 0, False: 47] ------------------ 572| 47| Span(context, context_len), is_dtls)) { 573| 0| return false; 574| 0| } 575| | 576| 47| assert(*out_len == EVP_MD_size(digest)); 577| 47| return true; 578| 47|} TLS_method: 197| 2|const SSL_METHOD *TLS_method(void) { 198| 2| static const SSL_METHOD kMethod = { 199| 2| 0, 200| 2| &kTLSProtocolMethod, 201| 2| &ssl_crypto_x509_method, 202| 2| }; 203| 2| return &kMethod; 204| 2|} tls_method.cc:_ZN4bsslL17tls_finish_flightEP6ssl_st: 104| 108k|static void tls_finish_flight(SSL *ssl) { 105| | // We don't track whether a flight is complete in TLS and instead always flush 106| | // every queued message in |tls_flush|, whether the flight is complete or not. 107| 108k|} tls_method.cc:_ZN4bsslL25tls_on_handshake_completeEP6ssl_st: 28| 51.4k|static void tls_on_handshake_complete(SSL *ssl) { 29| | // The handshake should have released its final message. 30| 51.4k| assert(!ssl->s3->has_message); 31| | 32| | // During the handshake, |hs_buf| is retained. Release if it there is no 33| | // excess in it. There should not be any excess because the handshake logic 34| | // rejects unprocessed data after each Finished message. Note this means we do 35| | // not allow a TLS 1.2 HelloRequest to be packed into the same record as 36| | // Finished. (Schannel also rejects this.) 37| 51.4k| assert(!ssl->s3->hs_buf || ssl->s3->hs_buf->length == 0); 38| 51.4k| if (ssl->s3->hs_buf && ssl->s3->hs_buf->length == 0) { ------------------ | Branch (38:7): [True: 51.4k, False: 0] | Branch (38:26): [True: 51.4k, False: 0] ------------------ 39| 51.4k| ssl->s3->hs_buf.reset(); 40| 51.4k| } 41| 51.4k|} tls_method.cc:_ZN4bsslL18tls_set_read_stateEP6ssl_st22ssl_encryption_level_tNSt3__110unique_ptrINS_14SSLAEADContextENS_8internal7DeleterEEENS_4SpanIKhEE: 45| 51.8k| Span traffic_secret) { 46| | // Cipher changes are forbidden if the current epoch has leftover data. 47| 51.8k| if (tls_has_unprocessed_handshake_data(ssl)) { ------------------ | Branch (47:7): [True: 3, False: 51.8k] ------------------ 48| 3| OPENSSL_PUT_ERROR(SSL, SSL_R_EXCESS_HANDSHAKE_DATA); ------------------ | | 361| 3| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 49| 3| ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE); ------------------ | | 176| 3|#define SSL3_AL_FATAL 2 ------------------ ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE); ------------------ | | 4367| 3|#define SSL_AD_UNEXPECTED_MESSAGE SSL3_AD_UNEXPECTED_MESSAGE | | ------------------ | | | | 179| 3|#define SSL3_AD_UNEXPECTED_MESSAGE 10 // fatal | | ------------------ ------------------ 50| 3| return false; 51| 3| } 52| | 53| 51.8k| if (SSL_is_quic(ssl)) { ------------------ | Branch (53:7): [True: 0, False: 51.8k] ------------------ 54| 0| if ((ssl->s3->hs == nullptr || !ssl->s3->hs->hints_requested) && ------------------ | Branch (54:10): [True: 0, False: 0] | Branch (54:36): [True: 0, False: 0] ------------------ 55| 0| !ssl->quic_method->set_read_secret(ssl, level, aead_ctx->cipher(), ------------------ | Branch (55:9): [True: 0, False: 0] ------------------ 56| 0| traffic_secret.data(), 57| 0| traffic_secret.size())) { 58| 0| return false; 59| 0| } 60| | 61| | // QUIC only uses |ssl| for handshake messages, which never use early data 62| | // keys, so we return without installing anything. This avoids needing to 63| | // have two secrets active at once in 0-RTT. 64| 0| if (level == ssl_encryption_early_data) { ------------------ | Branch (64:9): [True: 0, False: 0] ------------------ 65| 0| return true; 66| 0| } 67| 0| ssl->s3->quic_read_level = level; 68| 0| } 69| | 70| 51.8k| ssl->s3->read_sequence = 0; 71| 51.8k| ssl->s3->aead_read_ctx = std::move(aead_ctx); 72| 51.8k| return true; 73| 51.8k|} tls_method.cc:_ZN4bsslL19tls_set_write_stateEP6ssl_st22ssl_encryption_level_tNSt3__110unique_ptrINS_14SSLAEADContextENS_8internal7DeleterEEENS_4SpanIKhEE: 77| 52.6k| Span traffic_secret) { 78| 52.6k| if (!tls_flush_pending_hs_data(ssl)) { ------------------ | Branch (78:7): [True: 0, False: 52.6k] ------------------ 79| 0| return false; 80| 0| } 81| | 82| 52.6k| if (SSL_is_quic(ssl)) { ------------------ | Branch (82:7): [True: 0, False: 52.6k] ------------------ 83| 0| if ((ssl->s3->hs == nullptr || !ssl->s3->hs->hints_requested) && ------------------ | Branch (83:10): [True: 0, False: 0] | Branch (83:36): [True: 0, False: 0] ------------------ 84| 0| !ssl->quic_method->set_write_secret(ssl, level, aead_ctx->cipher(), ------------------ | Branch (84:9): [True: 0, False: 0] ------------------ 85| 0| traffic_secret.data(), 86| 0| traffic_secret.size())) { 87| 0| return false; 88| 0| } 89| | 90| | // QUIC only uses |ssl| for handshake messages, which never use early data 91| | // keys, so we return without installing anything. This avoids needing to 92| | // have two secrets active at once in 0-RTT. 93| 0| if (level == ssl_encryption_early_data) { ------------------ | Branch (93:9): [True: 0, False: 0] ------------------ 94| 0| return true; 95| 0| } 96| 0| ssl->s3->quic_write_level = level; 97| 0| } 98| | 99| 52.6k| ssl->s3->write_sequence = 0; 100| 52.6k| ssl->s3->aead_write_ctx = std::move(aead_ctx); 101| 52.6k| return true; 102| 52.6k|} _ZN4bssl26ssl_needs_record_splittingEPK6ssl_st: 49| 220k|bool ssl_needs_record_splitting(const SSL *ssl) { 50| 220k| return !CRYPTO_fuzzer_mode_enabled() && ------------------ | Branch (50:10): [True: 0, False: 220k] ------------------ 51| 220k| !ssl->s3->aead_write_ctx->is_null_cipher() && ------------------ | Branch (51:10): [True: 0, False: 0] ------------------ 52| 220k| ssl_protocol_version(ssl) < TLS1_1_VERSION && ------------------ | | 543| 220k|#define TLS1_1_VERSION 0x0302 ------------------ | Branch (52:10): [True: 0, False: 0] ------------------ 53| 220k| (ssl->mode & SSL_MODE_CBC_RECORD_SPLITTING) != 0 && ------------------ | | 686| 0|#define SSL_MODE_CBC_RECORD_SPLITTING 0x00000100L ------------------ | Branch (53:10): [True: 0, False: 0] ------------------ 54| 220k| SSL_CIPHER_is_block_cipher(ssl->s3->aead_write_ctx->cipher()); ------------------ | Branch (54:10): [True: 0, False: 0] ------------------ 55| 220k|} _ZN4bssl21ssl_record_prefix_lenEPK6ssl_st: 57| 217k|size_t ssl_record_prefix_len(const SSL *ssl) { 58| 217k| assert(!SSL_is_dtls(ssl)); 59| 217k| return SSL3_RT_HEADER_LENGTH + ssl->s3->aead_read_ctx->ExplicitNonceLen(); ------------------ | | 104| 217k|#define SSL3_RT_HEADER_LENGTH 5 ------------------ 60| 217k|} _ZN4bssl15tls_open_recordEP6ssl_stPhPNS_4SpanIhEEPmS2_S4_: 93| 1.43M| uint8_t *out_alert, Span in) { 94| 1.43M| *out_consumed = 0; 95| 1.43M| if (ssl->s3->read_shutdown == ssl_shutdown_close_notify) { ------------------ | Branch (95:7): [True: 0, False: 1.43M] ------------------ 96| 0| return ssl_open_record_close_notify; 97| 0| } 98| | 99| | // If there is an unprocessed handshake message or we are already buffering 100| | // too much, stop before decrypting another handshake record. 101| 1.43M| if (!tls_can_accept_handshake_data(ssl, out_alert)) { ------------------ | Branch (101:7): [True: 107, False: 1.43M] ------------------ 102| 107| return ssl_open_record_error; 103| 107| } 104| | 105| 1.43M| CBS cbs = CBS(in); 106| | 107| | // Decode the record header. 108| 1.43M| uint8_t type; 109| 1.43M| uint16_t version, ciphertext_len; 110| 1.43M| if (!CBS_get_u8(&cbs, &type) || // ------------------ | Branch (110:7): [True: 483k, False: 951k] ------------------ 111| 1.43M| !CBS_get_u16(&cbs, &version) || // ------------------ | Branch (111:7): [True: 0, False: 951k] ------------------ 112| 1.43M| !CBS_get_u16(&cbs, &ciphertext_len)) { ------------------ | Branch (112:7): [True: 0, False: 951k] ------------------ 113| 483k| *out_consumed = SSL3_RT_HEADER_LENGTH; ------------------ | | 104| 483k|#define SSL3_RT_HEADER_LENGTH 5 ------------------ 114| 483k| return ssl_open_record_partial; 115| 483k| } 116| | 117| 951k| bool version_ok; 118| 951k| if (ssl->s3->aead_read_ctx->is_null_cipher()) { ------------------ | Branch (118:7): [True: 68.7k, False: 882k] ------------------ 119| | // Only check the first byte. Enforcing beyond that can prevent decoding 120| | // version negotiation failure alerts. 121| 68.7k| version_ok = (version >> 8) == SSL3_VERSION_MAJOR; ------------------ | | 539| 68.7k|#define SSL3_VERSION_MAJOR 0x03 ------------------ 122| 882k| } else { 123| 882k| version_ok = version == tls_record_version(ssl); 124| 882k| } 125| | 126| 951k| if (!version_ok) { ------------------ | Branch (126:7): [True: 525, False: 951k] ------------------ 127| 525| OPENSSL_PUT_ERROR(SSL, SSL_R_WRONG_VERSION_NUMBER); ------------------ | | 361| 525| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 128| 525| *out_alert = SSL_AD_PROTOCOL_VERSION; ------------------ | | 4385| 525|#define SSL_AD_PROTOCOL_VERSION TLS1_AD_PROTOCOL_VERSION | | ------------------ | | | | 35| 525|#define TLS1_AD_PROTOCOL_VERSION 70 | | ------------------ ------------------ 129| 525| return ssl_open_record_error; 130| 525| } 131| | 132| | // Check the ciphertext length. 133| 951k| if (ciphertext_len > SSL3_RT_MAX_ENCRYPTED_LENGTH) { ------------------ | | 158| 951k| (SSL3_RT_MAX_ENCRYPTED_OVERHEAD + SSL3_RT_MAX_COMPRESSED_LENGTH) | | ------------------ | | | | 144| 951k|#define SSL3_RT_MAX_ENCRYPTED_OVERHEAD (256 + SSL3_RT_MAX_MD_SIZE) | | | | ------------------ | | | | | | 126| 951k|#define SSL3_RT_MAX_MD_SIZE 64 | | | | ------------------ | | ------------------ | | (SSL3_RT_MAX_ENCRYPTED_OVERHEAD + SSL3_RT_MAX_COMPRESSED_LENGTH) | | ------------------ | | | | 155| 951k|#define SSL3_RT_MAX_COMPRESSED_LENGTH SSL3_RT_MAX_PLAIN_LENGTH | | | | ------------------ | | | | | | 133| 951k|#define SSL3_RT_MAX_PLAIN_LENGTH 16384 | | | | ------------------ | | ------------------ ------------------ | Branch (133:7): [True: 25, False: 951k] ------------------ 134| 25| OPENSSL_PUT_ERROR(SSL, SSL_R_ENCRYPTED_LENGTH_TOO_LONG); ------------------ | | 361| 25| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 135| 25| *out_alert = SSL_AD_RECORD_OVERFLOW; ------------------ | | 4370| 25|#define SSL_AD_RECORD_OVERFLOW TLS1_AD_RECORD_OVERFLOW | | ------------------ | | | | 29| 25|#define TLS1_AD_RECORD_OVERFLOW 22 | | ------------------ ------------------ 136| 25| return ssl_open_record_error; 137| 25| } 138| | 139| | // Extract the body. 140| 951k| CBS body; 141| 951k| if (!CBS_get_bytes(&cbs, &body, ciphertext_len)) { ------------------ | Branch (141:7): [True: 470k, False: 480k] ------------------ 142| 470k| *out_consumed = SSL3_RT_HEADER_LENGTH + (size_t)ciphertext_len; ------------------ | | 104| 470k|#define SSL3_RT_HEADER_LENGTH 5 ------------------ 143| 470k| return ssl_open_record_partial; 144| 470k| } 145| | 146| 480k| Span header = in.subspan(0, SSL3_RT_HEADER_LENGTH); ------------------ | | 104| 480k|#define SSL3_RT_HEADER_LENGTH 5 ------------------ 147| 480k| ssl_do_msg_callback(ssl, 0 /* read */, SSL3_RT_HEADER, header); ------------------ | | 172| 480k|#define SSL3_RT_HEADER 0x100 ------------------ 148| | 149| 480k| *out_consumed = in.size() - CBS_len(&cbs); 150| | 151| | // In TLS 1.3, during the handshake, skip ChangeCipherSpec records. 152| 480k| static const uint8_t kChangeCipherSpec[] = {SSL3_MT_CCS}; ------------------ | | 222| 480k|#define SSL3_MT_CCS 1 ------------------ 153| 480k| if (ssl_has_final_version(ssl) && ------------------ | Branch (153:7): [True: 468k, False: 11.2k] ------------------ 154| 480k| ssl_protocol_version(ssl) >= TLS1_3_VERSION && SSL_in_init(ssl) && ------------------ | | 545| 949k|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (154:7): [True: 4.10k, False: 464k] | Branch (154:54): [True: 2.56k, False: 1.54k] ------------------ 155| 480k| type == SSL3_RT_CHANGE_CIPHER_SPEC && ------------------ | | 165| 482k|#define SSL3_RT_CHANGE_CIPHER_SPEC 20 ------------------ | Branch (155:7): [True: 382, False: 2.17k] ------------------ 156| 480k| Span(body) == kChangeCipherSpec) { ------------------ | Branch (156:7): [True: 371, False: 11] ------------------ 157| 371| ssl->s3->empty_record_count++; 158| 371| if (ssl->s3->empty_record_count > kMaxEmptyRecords) { ------------------ | Branch (158:9): [True: 0, False: 371] ------------------ 159| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_TOO_MANY_EMPTY_FRAGMENTS); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 160| 0| *out_alert = SSL_AD_UNEXPECTED_MESSAGE; ------------------ | | 4367| 0|#define SSL_AD_UNEXPECTED_MESSAGE SSL3_AD_UNEXPECTED_MESSAGE | | ------------------ | | | | 179| 0|#define SSL3_AD_UNEXPECTED_MESSAGE 10 // fatal | | ------------------ ------------------ 161| 0| return ssl_open_record_error; 162| 0| } 163| 371| return ssl_open_record_discard; 164| 371| } 165| | 166| | // Skip early data received when expecting a second ClientHello if we rejected 167| | // 0RTT. 168| 479k| if (ssl->s3->skip_early_data && // ------------------ | Branch (168:7): [True: 0, False: 479k] ------------------ 169| 479k| ssl->s3->aead_read_ctx->is_null_cipher() && // ------------------ | Branch (169:7): [True: 0, False: 0] ------------------ 170| 479k| type == SSL3_RT_APPLICATION_DATA) { ------------------ | | 168| 0|#define SSL3_RT_APPLICATION_DATA 23 ------------------ | Branch (170:7): [True: 0, False: 0] ------------------ 171| 0| return skip_early_data(ssl, out_alert, *out_consumed); 172| 0| } 173| | 174| | // Ensure the sequence number update does not overflow. 175| 479k| if (ssl->s3->read_sequence + 1 == 0) { ------------------ | Branch (175:7): [True: 0, False: 479k] ------------------ 176| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_OVERFLOW); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 177| 0| *out_alert = SSL_AD_INTERNAL_ERROR; ------------------ | | 4387| 0|#define SSL_AD_INTERNAL_ERROR TLS1_AD_INTERNAL_ERROR | | ------------------ | | | | 37| 0|#define TLS1_AD_INTERNAL_ERROR 80 | | ------------------ ------------------ 178| 0| return ssl_open_record_error; 179| 0| } 180| | 181| | // Decrypt the body in-place. 182| 479k| if (!ssl->s3->aead_read_ctx->Open( ------------------ | Branch (182:7): [True: 0, False: 479k] ------------------ 183| 479k| out, type, version, ssl->s3->read_sequence, header, 184| 479k| Span(const_cast(CBS_data(&body)), CBS_len(&body)))) { 185| 0| if (ssl->s3->skip_early_data && !ssl->s3->aead_read_ctx->is_null_cipher()) { ------------------ | Branch (185:9): [True: 0, False: 0] | Branch (185:37): [True: 0, False: 0] ------------------ 186| 0| ERR_clear_error(); 187| 0| return skip_early_data(ssl, out_alert, *out_consumed); 188| 0| } 189| | 190| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 191| 0| *out_alert = SSL_AD_BAD_RECORD_MAC; ------------------ | | 4368| 0|#define SSL_AD_BAD_RECORD_MAC SSL3_AD_BAD_RECORD_MAC | | ------------------ | | | | 180| 0|#define SSL3_AD_BAD_RECORD_MAC 20 // fatal | | ------------------ ------------------ 192| 0| return ssl_open_record_error; 193| 0| } 194| | 195| 479k| ssl->s3->skip_early_data = false; 196| 479k| ssl->s3->read_sequence++; 197| | 198| | // TLS 1.3 hides the record type inside the encrypted data. 199| 479k| bool has_padding = !ssl->s3->aead_read_ctx->is_null_cipher() && ------------------ | Branch (199:22): [True: 444k, False: 35.6k] ------------------ 200| 479k| ssl_protocol_version(ssl) >= TLS1_3_VERSION; ------------------ | | 545| 444k|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (200:22): [True: 2.49k, False: 441k] ------------------ 201| | 202| | // If there is padding, the plaintext limit includes the padding, but includes 203| | // extra room for the inner content type. 204| 479k| size_t plaintext_limit = 205| 479k| has_padding ? SSL3_RT_MAX_PLAIN_LENGTH + 1 : SSL3_RT_MAX_PLAIN_LENGTH; ------------------ | | 133| 2.49k|#define SSL3_RT_MAX_PLAIN_LENGTH 16384 ------------------ has_padding ? SSL3_RT_MAX_PLAIN_LENGTH + 1 : SSL3_RT_MAX_PLAIN_LENGTH; ------------------ | | 133| 957k|#define SSL3_RT_MAX_PLAIN_LENGTH 16384 ------------------ | Branch (205:7): [True: 2.49k, False: 477k] ------------------ 206| 479k| if (out->size() > plaintext_limit) { ------------------ | Branch (206:7): [True: 6, False: 479k] ------------------ 207| 6| OPENSSL_PUT_ERROR(SSL, SSL_R_DATA_LENGTH_TOO_LONG); ------------------ | | 361| 6| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 208| 6| *out_alert = SSL_AD_RECORD_OVERFLOW; ------------------ | | 4370| 6|#define SSL_AD_RECORD_OVERFLOW TLS1_AD_RECORD_OVERFLOW | | ------------------ | | | | 29| 6|#define TLS1_AD_RECORD_OVERFLOW 22 | | ------------------ ------------------ 209| 6| return ssl_open_record_error; 210| 6| } 211| | 212| 479k| if (has_padding) { ------------------ | Branch (212:7): [True: 2.49k, False: 477k] ------------------ 213| | // The outer record type is always application_data. 214| 2.49k| if (type != SSL3_RT_APPLICATION_DATA) { ------------------ | | 168| 2.49k|#define SSL3_RT_APPLICATION_DATA 23 ------------------ | Branch (214:9): [True: 1, False: 2.49k] ------------------ 215| 1| OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_OUTER_RECORD_TYPE); ------------------ | | 361| 1| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 216| 1| *out_alert = SSL_AD_DECODE_ERROR; ------------------ | | 4382| 1|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 1|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 217| 1| return ssl_open_record_error; 218| 1| } 219| | 220| 2.83k| do { 221| 2.83k| if (out->empty()) { ------------------ | Branch (221:11): [True: 5, False: 2.82k] ------------------ 222| 5| OPENSSL_PUT_ERROR(SSL, SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC); ------------------ | | 361| 5| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 223| 5| *out_alert = SSL_AD_DECRYPT_ERROR; ------------------ | | 4383| 5|#define SSL_AD_DECRYPT_ERROR TLS1_AD_DECRYPT_ERROR | | ------------------ | | | | 33| 5|#define TLS1_AD_DECRYPT_ERROR 51 | | ------------------ ------------------ 224| 5| return ssl_open_record_error; 225| 5| } 226| 2.82k| type = out->back(); 227| 2.82k| *out = out->subspan(0, out->size() - 1); 228| 2.82k| } while (type == 0); ------------------ | Branch (228:14): [True: 337, False: 2.48k] ------------------ 229| 2.49k| } 230| | 231| | // Limit the number of consecutive empty records. 232| 479k| if (out->empty()) { ------------------ | Branch (232:7): [True: 9.84k, False: 469k] ------------------ 233| 9.84k| ssl->s3->empty_record_count++; 234| 9.84k| if (ssl->s3->empty_record_count > kMaxEmptyRecords) { ------------------ | Branch (234:9): [True: 1, False: 9.84k] ------------------ 235| 1| OPENSSL_PUT_ERROR(SSL, SSL_R_TOO_MANY_EMPTY_FRAGMENTS); ------------------ | | 361| 1| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 236| 1| *out_alert = SSL_AD_UNEXPECTED_MESSAGE; ------------------ | | 4367| 1|#define SSL_AD_UNEXPECTED_MESSAGE SSL3_AD_UNEXPECTED_MESSAGE | | ------------------ | | | | 179| 1|#define SSL3_AD_UNEXPECTED_MESSAGE 10 // fatal | | ------------------ ------------------ 237| 1| return ssl_open_record_error; 238| 1| } 239| | // Apart from the limit, empty records are returned up to the caller. This 240| | // allows the caller to reject records of the wrong type. 241| 469k| } else { 242| 469k| ssl->s3->empty_record_count = 0; 243| 469k| } 244| | 245| 479k| if (type == SSL3_RT_ALERT) { ------------------ | | 166| 479k|#define SSL3_RT_ALERT 21 ------------------ | Branch (245:7): [True: 2.62k, False: 477k] ------------------ 246| 2.62k| return ssl_process_alert(ssl, out_alert, *out); 247| 2.62k| } 248| | 249| | // Handshake messages may not interleave with any other record type. 250| 477k| if (type != SSL3_RT_HANDSHAKE && // ------------------ | | 167| 954k|#define SSL3_RT_HANDSHAKE 22 ------------------ | Branch (250:7): [True: 55.5k, False: 421k] ------------------ 251| 477k| tls_has_unprocessed_handshake_data(ssl)) { ------------------ | Branch (251:7): [True: 24, False: 55.5k] ------------------ 252| 24| OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_RECORD); ------------------ | | 361| 24| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 253| 24| *out_alert = SSL_AD_UNEXPECTED_MESSAGE; ------------------ | | 4367| 24|#define SSL_AD_UNEXPECTED_MESSAGE SSL3_AD_UNEXPECTED_MESSAGE | | ------------------ | | | | 179| 24|#define SSL3_AD_UNEXPECTED_MESSAGE 10 // fatal | | ------------------ ------------------ 254| 24| return ssl_open_record_error; 255| 24| } 256| | 257| 477k| ssl->s3->warning_alert_count = 0; 258| | 259| 477k| *out_type = type; 260| 477k| return ssl_open_record_success; 261| 477k|} _ZN4bssl15tls_seal_recordEP6ssl_stPhPmmhPKhm: 408| 217k| size_t in_len) { 409| 217k| if (buffers_alias(in, in_len, out, max_out_len)) { ------------------ | Branch (409:7): [True: 0, False: 217k] ------------------ 410| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_OUTPUT_ALIASES_INPUT); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 411| 0| return false; 412| 0| } 413| | 414| 217k| const size_t prefix_len = tls_seal_scatter_prefix_len(ssl, type, in_len); 415| 217k| size_t suffix_len; 416| 217k| if (!tls_seal_scatter_suffix_len(ssl, &suffix_len, type, in_len)) { ------------------ | Branch (416:7): [True: 0, False: 217k] ------------------ 417| 0| return false; 418| 0| } 419| 217k| if (in_len + prefix_len < in_len || ------------------ | Branch (419:7): [True: 0, False: 217k] ------------------ 420| 217k| prefix_len + in_len + suffix_len < prefix_len + in_len) { ------------------ | Branch (420:7): [True: 0, False: 217k] ------------------ 421| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_RECORD_TOO_LARGE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 422| 0| return false; 423| 0| } 424| 217k| if (max_out_len < in_len + prefix_len + suffix_len) { ------------------ | Branch (424:7): [True: 0, False: 217k] ------------------ 425| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_BUFFER_TOO_SMALL); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 426| 0| return false; 427| 0| } 428| | 429| 217k| uint8_t *prefix = out; 430| 217k| uint8_t *body = out + prefix_len; 431| 217k| uint8_t *suffix = body + in_len; 432| 217k| if (!tls_seal_scatter_record(ssl, prefix, body, suffix, type, in, in_len)) { ------------------ | Branch (432:7): [True: 0, False: 217k] ------------------ 433| 0| return false; 434| 0| } 435| | 436| 217k| *out_len = prefix_len + in_len + suffix_len; 437| 217k| return true; 438| 217k|} _ZN4bssl17ssl_process_alertEP6ssl_stPhNS_4SpanIKhEE: 441| 2.62k| Span in) { 442| | // Alerts records may not contain fragmented or multiple alerts. 443| 2.62k| if (in.size() != 2) { ------------------ | Branch (443:7): [True: 30, False: 2.59k] ------------------ 444| 30| *out_alert = SSL_AD_DECODE_ERROR; ------------------ | | 4382| 30|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 30|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 445| 30| OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_ALERT); ------------------ | | 361| 30| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 446| 30| return ssl_open_record_error; 447| 30| } 448| | 449| 2.59k| ssl_do_msg_callback(ssl, 0 /* read */, SSL3_RT_ALERT, in); ------------------ | | 166| 2.59k|#define SSL3_RT_ALERT 21 ------------------ 450| | 451| 2.59k| const uint8_t alert_level = in[0]; 452| 2.59k| const uint8_t alert_descr = in[1]; 453| | 454| 2.59k| uint16_t alert = (alert_level << 8) | alert_descr; 455| 2.59k| ssl_do_info_callback(ssl, SSL_CB_READ_ALERT, alert); ------------------ | | 5025| 2.59k|#define SSL_CB_READ_ALERT (SSL_CB_ALERT | SSL_CB_READ) | | ------------------ | | | | 5024| 2.59k|#define SSL_CB_ALERT 0x4000 | | ------------------ | | #define SSL_CB_READ_ALERT (SSL_CB_ALERT | SSL_CB_READ) | | ------------------ | | | | 5022| 2.59k|#define SSL_CB_READ 0x04 | | ------------------ ------------------ 456| | 457| 2.59k| if (alert_level == SSL3_AL_WARNING) { ------------------ | | 175| 2.59k|#define SSL3_AL_WARNING 1 ------------------ | Branch (457:7): [True: 2.56k, False: 28] ------------------ 458| 2.56k| if (alert_descr == SSL_AD_CLOSE_NOTIFY) { ------------------ | | 4366| 2.56k|#define SSL_AD_CLOSE_NOTIFY SSL3_AD_CLOSE_NOTIFY | | ------------------ | | | | 178| 2.56k|#define SSL3_AD_CLOSE_NOTIFY 0 | | ------------------ ------------------ | Branch (458:9): [True: 25, False: 2.54k] ------------------ 459| 25| ssl->s3->read_shutdown = ssl_shutdown_close_notify; 460| 25| return ssl_open_record_close_notify; 461| 25| } 462| | 463| | // Warning alerts do not exist in TLS 1.3, but RFC 8446 section 6.1 464| | // continues to define user_canceled as a signal to cancel the handshake, 465| | // without specifying how to handle it. JDK11 misuses it to signal 466| | // full-duplex connection close after the handshake. As a workaround, skip 467| | // user_canceled as in TLS 1.2. This matches NSS and OpenSSL. 468| 2.54k| if (ssl_has_final_version(ssl) && ------------------ | Branch (468:9): [True: 1.10k, False: 1.43k] ------------------ 469| 2.54k| ssl_protocol_version(ssl) >= TLS1_3_VERSION && ------------------ | | 545| 3.64k|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (469:9): [True: 3, False: 1.10k] ------------------ 470| 2.54k| alert_descr != SSL_AD_USER_CANCELLED) { ------------------ | | 4389| 3|#define SSL_AD_USER_CANCELLED TLS1_AD_USER_CANCELLED | | ------------------ | | | | 38| 3|#define TLS1_AD_USER_CANCELLED 90 | | ------------------ ------------------ | Branch (470:9): [True: 3, False: 0] ------------------ 471| 3| *out_alert = SSL_AD_DECODE_ERROR; ------------------ | | 4382| 3|#define SSL_AD_DECODE_ERROR TLS1_AD_DECODE_ERROR | | ------------------ | | | | 32| 3|#define TLS1_AD_DECODE_ERROR 50 | | ------------------ ------------------ 472| 3| OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_ALERT); ------------------ | | 361| 3| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 473| 3| return ssl_open_record_error; 474| 3| } 475| | 476| 2.53k| ssl->s3->warning_alert_count++; 477| 2.53k| if (ssl->s3->warning_alert_count > kMaxWarningAlerts) { ------------------ | Branch (477:9): [True: 6, False: 2.53k] ------------------ 478| 6| *out_alert = SSL_AD_UNEXPECTED_MESSAGE; ------------------ | | 4367| 6|#define SSL_AD_UNEXPECTED_MESSAGE SSL3_AD_UNEXPECTED_MESSAGE | | ------------------ | | | | 179| 6|#define SSL3_AD_UNEXPECTED_MESSAGE 10 // fatal | | ------------------ ------------------ 479| 6| OPENSSL_PUT_ERROR(SSL, SSL_R_TOO_MANY_WARNING_ALERTS); ------------------ | | 361| 6| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 480| 6| return ssl_open_record_error; 481| 6| } 482| 2.53k| return ssl_open_record_discard; 483| 2.53k| } 484| | 485| 28| if (alert_level == SSL3_AL_FATAL) { ------------------ | | 176| 28|#define SSL3_AL_FATAL 2 ------------------ | Branch (485:7): [True: 12, False: 16] ------------------ 486| 12| OPENSSL_PUT_ERROR(SSL, SSL_AD_REASON_OFFSET + alert_descr); ------------------ | | 361| 12| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 487| 12| ERR_add_error_dataf("SSL alert number %d", alert_descr); 488| 12| *out_alert = 0; // No alert to send back to the peer. 489| 12| return ssl_open_record_error; 490| 12| } 491| | 492| 16| *out_alert = SSL_AD_ILLEGAL_PARAMETER; ------------------ | | 4379| 16|#define SSL_AD_ILLEGAL_PARAMETER SSL3_AD_ILLEGAL_PARAMETER | | ------------------ | | | | 189| 16|#define SSL3_AD_ILLEGAL_PARAMETER 47 // fatal | | ------------------ ------------------ 493| 16| OPENSSL_PUT_ERROR(SSL, SSL_R_UNKNOWN_ALERT_TYPE); ------------------ | | 361| 16| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 494| 16| return ssl_open_record_error; 495| 28|} SSL_max_seal_overhead: 501| 217k|size_t SSL_max_seal_overhead(const SSL *ssl) { 502| 217k| if (SSL_is_dtls(ssl)) { ------------------ | Branch (502:7): [True: 0, False: 217k] ------------------ 503| | // TODO(crbug.com/381113363): Use the 0-RTT epoch if writing 0-RTT. 504| 0| return dtls_max_seal_overhead(ssl, ssl->d1->write_epoch.epoch()); 505| 0| } 506| | 507| 217k| size_t ret = SSL3_RT_HEADER_LENGTH; ------------------ | | 104| 217k|#define SSL3_RT_HEADER_LENGTH 5 ------------------ 508| 217k| ret += ssl->s3->aead_write_ctx->MaxOverhead(); 509| | // TLS 1.3 needs an extra byte for the encrypted record type. 510| 217k| if (!ssl->s3->aead_write_ctx->is_null_cipher() && ------------------ | Branch (510:7): [True: 204k, False: 12.5k] ------------------ 511| 217k| ssl_protocol_version(ssl) >= TLS1_3_VERSION) { ------------------ | | 545| 204k|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (511:7): [True: 254, False: 204k] ------------------ 512| 254| ret += 1; 513| 254| } 514| 217k| if (ssl_needs_record_splitting(ssl)) { ------------------ | Branch (514:7): [True: 0, False: 217k] ------------------ 515| 0| ret *= 2; 516| 0| } 517| 217k| return ret; 518| 217k|} tls_record.cc:_ZN4bsslL18tls_record_versionEPK6ssl_st: 78| 1.10M|static uint16_t tls_record_version(const SSL *ssl) { 79| 1.10M| if (ssl->s3->version == 0) { ------------------ | Branch (79:7): [True: 5.49k, False: 1.09M] ------------------ 80| | // Before the version is determined, outgoing records use TLS 1.0 for 81| | // historical compatibility requirements. 82| 5.49k| return TLS1_VERSION; ------------------ | | 542| 5.49k|#define TLS1_VERSION 0x0301 ------------------ 83| 5.49k| } 84| | 85| | // TLS 1.3 freezes the record version at TLS 1.2. Previous ones use the 86| | // version itself. 87| 1.09M| return ssl_protocol_version(ssl) >= TLS1_3_VERSION ? TLS1_2_VERSION ------------------ | | 545| 1.09M|#define TLS1_3_VERSION 0x0304 ------------------ return ssl_protocol_version(ssl) >= TLS1_3_VERSION ? TLS1_2_VERSION ------------------ | | 544| 6.43k|#define TLS1_2_VERSION 0x0303 ------------------ | Branch (87:10): [True: 6.43k, False: 1.08M] ------------------ 88| 1.09M| : ssl->s3->version; 89| 1.10M|} tls_record.cc:_ZN4bsslL27tls_seal_scatter_prefix_lenEPK6ssl_sthm: 317| 217k| size_t in_len) { 318| 217k| size_t ret = SSL3_RT_HEADER_LENGTH; ------------------ | | 104| 217k|#define SSL3_RT_HEADER_LENGTH 5 ------------------ 319| 217k| if (type == SSL3_RT_APPLICATION_DATA && in_len > 1 && ------------------ | | 168| 434k|#define SSL3_RT_APPLICATION_DATA 23 ------------------ | Branch (319:7): [True: 0, False: 217k] | Branch (319:43): [True: 0, False: 0] ------------------ 320| 217k| ssl_needs_record_splitting(ssl)) { ------------------ | Branch (320:7): [True: 0, False: 0] ------------------ 321| | // In the case of record splitting, the 1-byte record (of the 1/n-1 split) 322| | // will be placed in the prefix, as will four of the five bytes of the 323| | // record header for the main record. The final byte will replace the first 324| | // byte of the plaintext that was used in the small record. 325| 0| ret += ssl_cipher_get_record_split_len(ssl->s3->aead_write_ctx->cipher()); 326| 0| ret += SSL3_RT_HEADER_LENGTH - 1; ------------------ | | 104| 0|#define SSL3_RT_HEADER_LENGTH 5 ------------------ 327| 217k| } else { 328| 217k| ret += ssl->s3->aead_write_ctx->ExplicitNonceLen(); 329| 217k| } 330| 217k| return ret; 331| 217k|} tls_record.cc:_ZN4bsslL27tls_seal_scatter_suffix_lenEPK6ssl_stPmhm: 334| 217k| uint8_t type, size_t in_len) { 335| 217k| size_t extra_in_len = 0; 336| 217k| if (!ssl->s3->aead_write_ctx->is_null_cipher() && ------------------ | Branch (336:7): [True: 204k, False: 12.5k] ------------------ 337| 217k| ssl_protocol_version(ssl) >= TLS1_3_VERSION) { ------------------ | | 545| 204k|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (337:7): [True: 254, False: 204k] ------------------ 338| | // TLS 1.3 adds an extra byte for encrypted record type. 339| 254| extra_in_len = 1; 340| 254| } 341| | // clang-format off 342| 217k| if (type == SSL3_RT_APPLICATION_DATA && ------------------ | | 168| 434k|#define SSL3_RT_APPLICATION_DATA 23 ------------------ | Branch (342:7): [True: 0, False: 217k] ------------------ 343| 217k| in_len > 1 && ------------------ | Branch (343:7): [True: 0, False: 0] ------------------ 344| 217k| ssl_needs_record_splitting(ssl)) { ------------------ | Branch (344:7): [True: 0, False: 0] ------------------ 345| | // With record splitting enabled, the first byte gets sealed into a separate 346| | // record which is written into the prefix. 347| 0| in_len -= 1; 348| 0| } 349| | // clang-format on 350| 217k| return ssl->s3->aead_write_ctx->SuffixLen(out_suffix_len, in_len, 351| 217k| extra_in_len); 352| 217k|} tls_record.cc:_ZN4bsslL23tls_seal_scatter_recordEP6ssl_stPhS2_S2_hPKhm: 363| 217k| const uint8_t *in, size_t in_len) { 364| 217k| if (type == SSL3_RT_APPLICATION_DATA && in_len > 1 && ------------------ | | 168| 434k|#define SSL3_RT_APPLICATION_DATA 23 ------------------ | Branch (364:7): [True: 0, False: 217k] | Branch (364:43): [True: 0, False: 0] ------------------ 365| 217k| ssl_needs_record_splitting(ssl)) { ------------------ | Branch (365:7): [True: 0, False: 0] ------------------ 366| 0| assert(ssl->s3->aead_write_ctx->ExplicitNonceLen() == 0); 367| 0| const size_t prefix_len = SSL3_RT_HEADER_LENGTH; ------------------ | | 104| 0|#define SSL3_RT_HEADER_LENGTH 5 ------------------ 368| | 369| | // Write the 1-byte fragment into |out_prefix|. 370| 0| uint8_t *split_body = out_prefix + prefix_len; 371| 0| uint8_t *split_suffix = split_body + 1; 372| | 373| 0| if (!do_seal_record(ssl, out_prefix, split_body, split_suffix, type, in, ------------------ | Branch (373:9): [True: 0, False: 0] ------------------ 374| 0| 1)) { 375| 0| return false; 376| 0| } 377| | 378| 0| size_t split_record_suffix_len; 379| 0| if (!ssl->s3->aead_write_ctx->SuffixLen(&split_record_suffix_len, 1, 0)) { ------------------ | Branch (379:9): [True: 0, False: 0] ------------------ 380| 0| assert(false); 381| 0| return false; 382| 0| } 383| 0| const size_t split_record_len = prefix_len + 1 + split_record_suffix_len; 384| 0| assert(SSL3_RT_HEADER_LENGTH + ssl_cipher_get_record_split_len( 385| 0| ssl->s3->aead_write_ctx->cipher()) == 386| 0| split_record_len); 387| | 388| | // Write the n-1-byte fragment. The header gets split between |out_prefix| 389| | // (header[:-1]) and |out| (header[-1:]). 390| 0| uint8_t tmp_prefix[SSL3_RT_HEADER_LENGTH]; 391| 0| if (!do_seal_record(ssl, tmp_prefix, out + 1, out_suffix, type, in + 1, ------------------ | Branch (391:9): [True: 0, False: 0] ------------------ 392| 0| in_len - 1)) { 393| 0| return false; 394| 0| } 395| 0| assert(tls_seal_scatter_prefix_len(ssl, type, in_len) == 396| 0| split_record_len + SSL3_RT_HEADER_LENGTH - 1); 397| 0| OPENSSL_memcpy(out_prefix + split_record_len, tmp_prefix, 398| 0| SSL3_RT_HEADER_LENGTH - 1); ------------------ | | 104| 0|#define SSL3_RT_HEADER_LENGTH 5 ------------------ 399| 0| OPENSSL_memcpy(out, tmp_prefix + SSL3_RT_HEADER_LENGTH - 1, 1); ------------------ | | 104| 0|#define SSL3_RT_HEADER_LENGTH 5 ------------------ 400| 0| return true; 401| 0| } 402| | 403| 217k| return do_seal_record(ssl, out_prefix, out, out_suffix, type, in, in_len); 404| 217k|} tls_record.cc:_ZN4bsslL14do_seal_recordEP6ssl_stPhS2_S2_hPKhm: 265| 217k| const size_t in_len) { 266| 217k| SSLAEADContext *aead = ssl->s3->aead_write_ctx.get(); 267| 217k| uint8_t *extra_in = NULL; 268| 217k| size_t extra_in_len = 0; 269| 217k| if (!aead->is_null_cipher() && ssl_protocol_version(ssl) >= TLS1_3_VERSION) { ------------------ | | 545| 204k|#define TLS1_3_VERSION 0x0304 ------------------ | Branch (269:7): [True: 204k, False: 12.5k] | Branch (269:34): [True: 254, False: 204k] ------------------ 270| | // TLS 1.3 hides the actual record type inside the encrypted data. 271| 254| extra_in = &type; 272| 254| extra_in_len = 1; 273| 254| } 274| | 275| 217k| size_t suffix_len, ciphertext_len; 276| 217k| if (!aead->SuffixLen(&suffix_len, in_len, extra_in_len) || ------------------ | Branch (276:7): [True: 0, False: 217k] ------------------ 277| 217k| !aead->CiphertextLen(&ciphertext_len, in_len, extra_in_len)) { ------------------ | Branch (277:7): [True: 0, False: 217k] ------------------ 278| 0| OPENSSL_PUT_ERROR(SSL, SSL_R_RECORD_TOO_LARGE); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 279| 0| return false; 280| 0| } 281| | 282| 217k| assert(in == out || !buffers_alias(in, in_len, out, in_len)); 283| 217k| assert(!buffers_alias(in, in_len, out_prefix, ssl_record_prefix_len(ssl))); 284| 217k| assert(!buffers_alias(in, in_len, out_suffix, suffix_len)); 285| | 286| 217k| if (extra_in_len) { ------------------ | Branch (286:7): [True: 254, False: 217k] ------------------ 287| 254| out_prefix[0] = SSL3_RT_APPLICATION_DATA; ------------------ | | 168| 254|#define SSL3_RT_APPLICATION_DATA 23 ------------------ 288| 217k| } else { 289| 217k| out_prefix[0] = type; 290| 217k| } 291| | 292| 217k| uint16_t record_version = tls_record_version(ssl); 293| 217k| out_prefix[1] = record_version >> 8; 294| 217k| out_prefix[2] = record_version & 0xff; 295| 217k| out_prefix[3] = ciphertext_len >> 8; 296| 217k| out_prefix[4] = ciphertext_len & 0xff; 297| 217k| Span header = Span(out_prefix, SSL3_RT_HEADER_LENGTH); ------------------ | | 104| 217k|#define SSL3_RT_HEADER_LENGTH 5 ------------------ 298| | 299| | // Ensure the sequence number update does not overflow. 300| 217k| if (ssl->s3->write_sequence + 1 == 0) { ------------------ | Branch (300:7): [True: 0, False: 217k] ------------------ 301| 0| OPENSSL_PUT_ERROR(SSL, ERR_R_OVERFLOW); ------------------ | | 361| 0| ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__) ------------------ 302| 0| return false; 303| 0| } 304| | 305| 217k| if (!aead->SealScatter(out_prefix + SSL3_RT_HEADER_LENGTH, out, out_suffix, ------------------ | | 104| 217k|#define SSL3_RT_HEADER_LENGTH 5 ------------------ | Branch (305:7): [True: 0, False: 217k] ------------------ 306| 217k| out_prefix[0], record_version, ssl->s3->write_sequence, 307| 217k| header, in, in_len, extra_in, extra_in_len)) { 308| 0| return false; 309| 0| } 310| | 311| 217k| ssl->s3->write_sequence++; 312| 217k| ssl_do_msg_callback(ssl, 1 /* write */, SSL3_RT_HEADER, header); ------------------ | | 172| 217k|#define SSL3_RT_HEADER 0x100 ------------------ 313| 217k| return true; 314| 217k|} curve25519.cc:_ZL20fiat_25519_carry_mulPmPKmS1_: 133| 1.60M|static FIAT_25519_FIAT_INLINE void fiat_25519_carry_mul(fiat_25519_tight_field_element out1, const fiat_25519_loose_field_element arg1, const fiat_25519_loose_field_element arg2) { 134| 1.60M| fiat_25519_uint128 x1; 135| 1.60M| fiat_25519_uint128 x2; 136| 1.60M| fiat_25519_uint128 x3; 137| 1.60M| fiat_25519_uint128 x4; 138| 1.60M| fiat_25519_uint128 x5; 139| 1.60M| fiat_25519_uint128 x6; 140| 1.60M| fiat_25519_uint128 x7; 141| 1.60M| fiat_25519_uint128 x8; 142| 1.60M| fiat_25519_uint128 x9; 143| 1.60M| fiat_25519_uint128 x10; 144| 1.60M| fiat_25519_uint128 x11; 145| 1.60M| fiat_25519_uint128 x12; 146| 1.60M| fiat_25519_uint128 x13; 147| 1.60M| fiat_25519_uint128 x14; 148| 1.60M| fiat_25519_uint128 x15; 149| 1.60M| fiat_25519_uint128 x16; 150| 1.60M| fiat_25519_uint128 x17; 151| 1.60M| fiat_25519_uint128 x18; 152| 1.60M| fiat_25519_uint128 x19; 153| 1.60M| fiat_25519_uint128 x20; 154| 1.60M| fiat_25519_uint128 x21; 155| 1.60M| fiat_25519_uint128 x22; 156| 1.60M| fiat_25519_uint128 x23; 157| 1.60M| fiat_25519_uint128 x24; 158| 1.60M| fiat_25519_uint128 x25; 159| 1.60M| fiat_25519_uint128 x26; 160| 1.60M| uint64_t x27; 161| 1.60M| uint64_t x28; 162| 1.60M| fiat_25519_uint128 x29; 163| 1.60M| fiat_25519_uint128 x30; 164| 1.60M| fiat_25519_uint128 x31; 165| 1.60M| fiat_25519_uint128 x32; 166| 1.60M| fiat_25519_uint128 x33; 167| 1.60M| uint64_t x34; 168| 1.60M| uint64_t x35; 169| 1.60M| fiat_25519_uint128 x36; 170| 1.60M| uint64_t x37; 171| 1.60M| uint64_t x38; 172| 1.60M| fiat_25519_uint128 x39; 173| 1.60M| uint64_t x40; 174| 1.60M| uint64_t x41; 175| 1.60M| fiat_25519_uint128 x42; 176| 1.60M| uint64_t x43; 177| 1.60M| uint64_t x44; 178| 1.60M| uint64_t x45; 179| 1.60M| uint64_t x46; 180| 1.60M| uint64_t x47; 181| 1.60M| uint64_t x48; 182| 1.60M| uint64_t x49; 183| 1.60M| fiat_25519_uint1 x50; 184| 1.60M| uint64_t x51; 185| 1.60M| uint64_t x52; 186| 1.60M| x1 = ((fiat_25519_uint128)(arg1[4]) * ((arg2[4]) * UINT8_C(0x13))); 187| 1.60M| x2 = ((fiat_25519_uint128)(arg1[4]) * ((arg2[3]) * UINT8_C(0x13))); 188| 1.60M| x3 = ((fiat_25519_uint128)(arg1[4]) * ((arg2[2]) * UINT8_C(0x13))); 189| 1.60M| x4 = ((fiat_25519_uint128)(arg1[4]) * ((arg2[1]) * UINT8_C(0x13))); 190| 1.60M| x5 = ((fiat_25519_uint128)(arg1[3]) * ((arg2[4]) * UINT8_C(0x13))); 191| 1.60M| x6 = ((fiat_25519_uint128)(arg1[3]) * ((arg2[3]) * UINT8_C(0x13))); 192| 1.60M| x7 = ((fiat_25519_uint128)(arg1[3]) * ((arg2[2]) * UINT8_C(0x13))); 193| 1.60M| x8 = ((fiat_25519_uint128)(arg1[2]) * ((arg2[4]) * UINT8_C(0x13))); 194| 1.60M| x9 = ((fiat_25519_uint128)(arg1[2]) * ((arg2[3]) * UINT8_C(0x13))); 195| 1.60M| x10 = ((fiat_25519_uint128)(arg1[1]) * ((arg2[4]) * UINT8_C(0x13))); 196| 1.60M| x11 = ((fiat_25519_uint128)(arg1[4]) * (arg2[0])); 197| 1.60M| x12 = ((fiat_25519_uint128)(arg1[3]) * (arg2[1])); 198| 1.60M| x13 = ((fiat_25519_uint128)(arg1[3]) * (arg2[0])); 199| 1.60M| x14 = ((fiat_25519_uint128)(arg1[2]) * (arg2[2])); 200| 1.60M| x15 = ((fiat_25519_uint128)(arg1[2]) * (arg2[1])); 201| 1.60M| x16 = ((fiat_25519_uint128)(arg1[2]) * (arg2[0])); 202| 1.60M| x17 = ((fiat_25519_uint128)(arg1[1]) * (arg2[3])); 203| 1.60M| x18 = ((fiat_25519_uint128)(arg1[1]) * (arg2[2])); 204| 1.60M| x19 = ((fiat_25519_uint128)(arg1[1]) * (arg2[1])); 205| 1.60M| x20 = ((fiat_25519_uint128)(arg1[1]) * (arg2[0])); 206| 1.60M| x21 = ((fiat_25519_uint128)(arg1[0]) * (arg2[4])); 207| 1.60M| x22 = ((fiat_25519_uint128)(arg1[0]) * (arg2[3])); 208| 1.60M| x23 = ((fiat_25519_uint128)(arg1[0]) * (arg2[2])); 209| 1.60M| x24 = ((fiat_25519_uint128)(arg1[0]) * (arg2[1])); 210| 1.60M| x25 = ((fiat_25519_uint128)(arg1[0]) * (arg2[0])); 211| 1.60M| x26 = (x25 + (x10 + (x9 + (x7 + x4)))); 212| 1.60M| x27 = (uint64_t)(x26 >> 51); 213| 1.60M| x28 = (uint64_t)(x26 & UINT64_C(0x7ffffffffffff)); 214| 1.60M| x29 = (x21 + (x17 + (x14 + (x12 + x11)))); 215| 1.60M| x30 = (x22 + (x18 + (x15 + (x13 + x1)))); 216| 1.60M| x31 = (x23 + (x19 + (x16 + (x5 + x2)))); 217| 1.60M| x32 = (x24 + (x20 + (x8 + (x6 + x3)))); 218| 1.60M| x33 = (x27 + x32); 219| 1.60M| x34 = (uint64_t)(x33 >> 51); 220| 1.60M| x35 = (uint64_t)(x33 & UINT64_C(0x7ffffffffffff)); 221| 1.60M| x36 = (x34 + x31); 222| 1.60M| x37 = (uint64_t)(x36 >> 51); 223| 1.60M| x38 = (uint64_t)(x36 & UINT64_C(0x7ffffffffffff)); 224| 1.60M| x39 = (x37 + x30); 225| 1.60M| x40 = (uint64_t)(x39 >> 51); 226| 1.60M| x41 = (uint64_t)(x39 & UINT64_C(0x7ffffffffffff)); 227| 1.60M| x42 = (x40 + x29); 228| 1.60M| x43 = (uint64_t)(x42 >> 51); 229| 1.60M| x44 = (uint64_t)(x42 & UINT64_C(0x7ffffffffffff)); 230| 1.60M| x45 = (x43 * UINT8_C(0x13)); 231| 1.60M| x46 = (x28 + x45); 232| 1.60M| x47 = (x46 >> 51); 233| 1.60M| x48 = (x46 & UINT64_C(0x7ffffffffffff)); 234| 1.60M| x49 = (x47 + x35); 235| 1.60M| x50 = (fiat_25519_uint1)(x49 >> 51); 236| 1.60M| x51 = (x49 & UINT64_C(0x7ffffffffffff)); 237| 1.60M| x52 = (x50 + x38); 238| 1.60M| out1[0] = x48; 239| 1.60M| out1[1] = x51; 240| 1.60M| out1[2] = x52; 241| 1.60M| out1[3] = x41; 242| 1.60M| out1[4] = x44; 243| 1.60M|} curve25519.cc:_ZL19fiat_25519_to_bytesPhPKm: 517| 133k|static FIAT_25519_FIAT_INLINE void fiat_25519_to_bytes(uint8_t out1[32], const fiat_25519_tight_field_element arg1) { 518| 133k| uint64_t x1; 519| 133k| fiat_25519_uint1 x2; 520| 133k| uint64_t x3; 521| 133k| fiat_25519_uint1 x4; 522| 133k| uint64_t x5; 523| 133k| fiat_25519_uint1 x6; 524| 133k| uint64_t x7; 525| 133k| fiat_25519_uint1 x8; 526| 133k| uint64_t x9; 527| 133k| fiat_25519_uint1 x10; 528| 133k| uint64_t x11; 529| 133k| uint64_t x12; 530| 133k| fiat_25519_uint1 x13; 531| 133k| uint64_t x14; 532| 133k| fiat_25519_uint1 x15; 533| 133k| uint64_t x16; 534| 133k| fiat_25519_uint1 x17; 535| 133k| uint64_t x18; 536| 133k| fiat_25519_uint1 x19; 537| 133k| uint64_t x20; 538| 133k| fiat_25519_uint1 x21; 539| 133k| uint64_t x22; 540| 133k| uint64_t x23; 541| 133k| uint64_t x24; 542| 133k| uint64_t x25; 543| 133k| uint8_t x26; 544| 133k| uint64_t x27; 545| 133k| uint8_t x28; 546| 133k| uint64_t x29; 547| 133k| uint8_t x30; 548| 133k| uint64_t x31; 549| 133k| uint8_t x32; 550| 133k| uint64_t x33; 551| 133k| uint8_t x34; 552| 133k| uint64_t x35; 553| 133k| uint8_t x36; 554| 133k| uint8_t x37; 555| 133k| uint64_t x38; 556| 133k| uint8_t x39; 557| 133k| uint64_t x40; 558| 133k| uint8_t x41; 559| 133k| uint64_t x42; 560| 133k| uint8_t x43; 561| 133k| uint64_t x44; 562| 133k| uint8_t x45; 563| 133k| uint64_t x46; 564| 133k| uint8_t x47; 565| 133k| uint64_t x48; 566| 133k| uint8_t x49; 567| 133k| uint8_t x50; 568| 133k| uint64_t x51; 569| 133k| uint8_t x52; 570| 133k| uint64_t x53; 571| 133k| uint8_t x54; 572| 133k| uint64_t x55; 573| 133k| uint8_t x56; 574| 133k| uint64_t x57; 575| 133k| uint8_t x58; 576| 133k| uint64_t x59; 577| 133k| uint8_t x60; 578| 133k| uint64_t x61; 579| 133k| uint8_t x62; 580| 133k| uint64_t x63; 581| 133k| uint8_t x64; 582| 133k| fiat_25519_uint1 x65; 583| 133k| uint64_t x66; 584| 133k| uint8_t x67; 585| 133k| uint64_t x68; 586| 133k| uint8_t x69; 587| 133k| uint64_t x70; 588| 133k| uint8_t x71; 589| 133k| uint64_t x72; 590| 133k| uint8_t x73; 591| 133k| uint64_t x74; 592| 133k| uint8_t x75; 593| 133k| uint64_t x76; 594| 133k| uint8_t x77; 595| 133k| uint8_t x78; 596| 133k| uint64_t x79; 597| 133k| uint8_t x80; 598| 133k| uint64_t x81; 599| 133k| uint8_t x82; 600| 133k| uint64_t x83; 601| 133k| uint8_t x84; 602| 133k| uint64_t x85; 603| 133k| uint8_t x86; 604| 133k| uint64_t x87; 605| 133k| uint8_t x88; 606| 133k| uint64_t x89; 607| 133k| uint8_t x90; 608| 133k| uint8_t x91; 609| 133k| fiat_25519_subborrowx_u51(&x1, &x2, 0x0, (arg1[0]), UINT64_C(0x7ffffffffffed)); 610| 133k| fiat_25519_subborrowx_u51(&x3, &x4, x2, (arg1[1]), UINT64_C(0x7ffffffffffff)); 611| 133k| fiat_25519_subborrowx_u51(&x5, &x6, x4, (arg1[2]), UINT64_C(0x7ffffffffffff)); 612| 133k| fiat_25519_subborrowx_u51(&x7, &x8, x6, (arg1[3]), UINT64_C(0x7ffffffffffff)); 613| 133k| fiat_25519_subborrowx_u51(&x9, &x10, x8, (arg1[4]), UINT64_C(0x7ffffffffffff)); 614| 133k| fiat_25519_cmovznz_u64(&x11, x10, 0x0, UINT64_C(0xffffffffffffffff)); 615| 133k| fiat_25519_addcarryx_u51(&x12, &x13, 0x0, x1, (x11 & UINT64_C(0x7ffffffffffed))); 616| 133k| fiat_25519_addcarryx_u51(&x14, &x15, x13, x3, (x11 & UINT64_C(0x7ffffffffffff))); 617| 133k| fiat_25519_addcarryx_u51(&x16, &x17, x15, x5, (x11 & UINT64_C(0x7ffffffffffff))); 618| 133k| fiat_25519_addcarryx_u51(&x18, &x19, x17, x7, (x11 & UINT64_C(0x7ffffffffffff))); 619| 133k| fiat_25519_addcarryx_u51(&x20, &x21, x19, x9, (x11 & UINT64_C(0x7ffffffffffff))); 620| 133k| x22 = (x20 << 4); 621| 133k| x23 = (x18 * (uint64_t)0x2); 622| 133k| x24 = (x16 << 6); 623| 133k| x25 = (x14 << 3); 624| 133k| x26 = (uint8_t)(x12 & UINT8_C(0xff)); 625| 133k| x27 = (x12 >> 8); 626| 133k| x28 = (uint8_t)(x27 & UINT8_C(0xff)); 627| 133k| x29 = (x27 >> 8); 628| 133k| x30 = (uint8_t)(x29 & UINT8_C(0xff)); 629| 133k| x31 = (x29 >> 8); 630| 133k| x32 = (uint8_t)(x31 & UINT8_C(0xff)); 631| 133k| x33 = (x31 >> 8); 632| 133k| x34 = (uint8_t)(x33 & UINT8_C(0xff)); 633| 133k| x35 = (x33 >> 8); 634| 133k| x36 = (uint8_t)(x35 & UINT8_C(0xff)); 635| 133k| x37 = (uint8_t)(x35 >> 8); 636| 133k| x38 = (x25 + (uint64_t)x37); 637| 133k| x39 = (uint8_t)(x38 & UINT8_C(0xff)); 638| 133k| x40 = (x38 >> 8); 639| 133k| x41 = (uint8_t)(x40 & UINT8_C(0xff)); 640| 133k| x42 = (x40 >> 8); 641| 133k| x43 = (uint8_t)(x42 & UINT8_C(0xff)); 642| 133k| x44 = (x42 >> 8); 643| 133k| x45 = (uint8_t)(x44 & UINT8_C(0xff)); 644| 133k| x46 = (x44 >> 8); 645| 133k| x47 = (uint8_t)(x46 & UINT8_C(0xff)); 646| 133k| x48 = (x46 >> 8); 647| 133k| x49 = (uint8_t)(x48 & UINT8_C(0xff)); 648| 133k| x50 = (uint8_t)(x48 >> 8); 649| 133k| x51 = (x24 + (uint64_t)x50); 650| 133k| x52 = (uint8_t)(x51 & UINT8_C(0xff)); 651| 133k| x53 = (x51 >> 8); 652| 133k| x54 = (uint8_t)(x53 & UINT8_C(0xff)); 653| 133k| x55 = (x53 >> 8); 654| 133k| x56 = (uint8_t)(x55 & UINT8_C(0xff)); 655| 133k| x57 = (x55 >> 8); 656| 133k| x58 = (uint8_t)(x57 & UINT8_C(0xff)); 657| 133k| x59 = (x57 >> 8); 658| 133k| x60 = (uint8_t)(x59 & UINT8_C(0xff)); 659| 133k| x61 = (x59 >> 8); 660| 133k| x62 = (uint8_t)(x61 & UINT8_C(0xff)); 661| 133k| x63 = (x61 >> 8); 662| 133k| x64 = (uint8_t)(x63 & UINT8_C(0xff)); 663| 133k| x65 = (fiat_25519_uint1)(x63 >> 8); 664| 133k| x66 = (x23 + (uint64_t)x65); 665| 133k| x67 = (uint8_t)(x66 & UINT8_C(0xff)); 666| 133k| x68 = (x66 >> 8); 667| 133k| x69 = (uint8_t)(x68 & UINT8_C(0xff)); 668| 133k| x70 = (x68 >> 8); 669| 133k| x71 = (uint8_t)(x70 & UINT8_C(0xff)); 670| 133k| x72 = (x70 >> 8); 671| 133k| x73 = (uint8_t)(x72 & UINT8_C(0xff)); 672| 133k| x74 = (x72 >> 8); 673| 133k| x75 = (uint8_t)(x74 & UINT8_C(0xff)); 674| 133k| x76 = (x74 >> 8); 675| 133k| x77 = (uint8_t)(x76 & UINT8_C(0xff)); 676| 133k| x78 = (uint8_t)(x76 >> 8); 677| 133k| x79 = (x22 + (uint64_t)x78); 678| 133k| x80 = (uint8_t)(x79 & UINT8_C(0xff)); 679| 133k| x81 = (x79 >> 8); 680| 133k| x82 = (uint8_t)(x81 & UINT8_C(0xff)); 681| 133k| x83 = (x81 >> 8); 682| 133k| x84 = (uint8_t)(x83 & UINT8_C(0xff)); 683| 133k| x85 = (x83 >> 8); 684| 133k| x86 = (uint8_t)(x85 & UINT8_C(0xff)); 685| 133k| x87 = (x85 >> 8); 686| 133k| x88 = (uint8_t)(x87 & UINT8_C(0xff)); 687| 133k| x89 = (x87 >> 8); 688| 133k| x90 = (uint8_t)(x89 & UINT8_C(0xff)); 689| 133k| x91 = (uint8_t)(x89 >> 8); 690| 133k| out1[0] = x26; 691| 133k| out1[1] = x28; 692| 133k| out1[2] = x30; 693| 133k| out1[3] = x32; 694| 133k| out1[4] = x34; 695| 133k| out1[5] = x36; 696| 133k| out1[6] = x39; 697| 133k| out1[7] = x41; 698| 133k| out1[8] = x43; 699| 133k| out1[9] = x45; 700| 133k| out1[10] = x47; 701| 133k| out1[11] = x49; 702| 133k| out1[12] = x52; 703| 133k| out1[13] = x54; 704| 133k| out1[14] = x56; 705| 133k| out1[15] = x58; 706| 133k| out1[16] = x60; 707| 133k| out1[17] = x62; 708| 133k| out1[18] = x64; 709| 133k| out1[19] = x67; 710| 133k| out1[20] = x69; 711| 133k| out1[21] = x71; 712| 133k| out1[22] = x73; 713| 133k| out1[23] = x75; 714| 133k| out1[24] = x77; 715| 133k| out1[25] = x80; 716| 133k| out1[26] = x82; 717| 133k| out1[27] = x84; 718| 133k| out1[28] = x86; 719| 133k| out1[29] = x88; 720| 133k| out1[30] = x90; 721| 133k| out1[31] = x91; 722| 133k|} curve25519.cc:_ZL25fiat_25519_subborrowx_u51PmPhhmm: 92| 667k|static FIAT_25519_FIAT_INLINE void fiat_25519_subborrowx_u51(uint64_t* out1, fiat_25519_uint1* out2, fiat_25519_uint1 arg1, uint64_t arg2, uint64_t arg3) { 93| 667k| int64_t x1; 94| 667k| fiat_25519_int1 x2; 95| 667k| uint64_t x3; 96| 667k| x1 = ((int64_t)(arg2 - (int64_t)arg1) - (int64_t)arg3); 97| 667k| x2 = (fiat_25519_int1)(x1 >> 51); 98| 667k| x3 = (x1 & UINT64_C(0x7ffffffffffff)); 99| 667k| *out1 = x3; 100| 667k| *out2 = (fiat_25519_uint1)(0x0 - x2); 101| 667k|} curve25519.cc:_ZL22fiat_25519_cmovznz_u64Pmhmm: 116| 133k|static FIAT_25519_FIAT_INLINE void fiat_25519_cmovznz_u64(uint64_t* out1, fiat_25519_uint1 arg1, uint64_t arg2, uint64_t arg3) { 117| 133k| fiat_25519_uint1 x1; 118| 133k| uint64_t x2; 119| 133k| uint64_t x3; 120| 133k| x1 = (!(!arg1)); 121| 133k| x2 = ((fiat_25519_int1)(0x0 - x1) & UINT64_C(0xffffffffffffffff)); 122| 133k| x3 = ((fiat_25519_value_barrier_u64(x2) & arg3) | (fiat_25519_value_barrier_u64((~x2)) & arg2)); 123| 133k| *out1 = x3; 124| 133k|} curve25519.cc:_ZL28fiat_25519_value_barrier_u64m: 42| 266k|static __inline__ uint64_t fiat_25519_value_barrier_u64(uint64_t a) { 43| 266k| __asm__("" : "+r"(a) : /* no inputs */); 44| 266k| return a; 45| 266k|} curve25519.cc:_ZL24fiat_25519_addcarryx_u51PmPhhmm: 66| 667k|static FIAT_25519_FIAT_INLINE void fiat_25519_addcarryx_u51(uint64_t* out1, fiat_25519_uint1* out2, fiat_25519_uint1 arg1, uint64_t arg2, uint64_t arg3) { 67| 667k| uint64_t x1; 68| 667k| uint64_t x2; 69| 667k| fiat_25519_uint1 x3; 70| 667k| x1 = ((arg1 + arg2) + arg3); 71| 667k| x2 = (x1 & UINT64_C(0x7ffffffffffff)); 72| 667k| x3 = (fiat_25519_uint1)(x1 >> 51); 73| 667k| *out1 = x2; 74| 667k| *out2 = x3; 75| 667k|} curve25519.cc:_ZL23fiat_25519_carry_squarePmPKm: 252| 33.9M|static FIAT_25519_FIAT_INLINE void fiat_25519_carry_square(fiat_25519_tight_field_element out1, const fiat_25519_loose_field_element arg1) { 253| 33.9M| uint64_t x1; 254| 33.9M| uint64_t x2; 255| 33.9M| uint64_t x3; 256| 33.9M| uint64_t x4; 257| 33.9M| uint64_t x5; 258| 33.9M| uint64_t x6; 259| 33.9M| uint64_t x7; 260| 33.9M| uint64_t x8; 261| 33.9M| fiat_25519_uint128 x9; 262| 33.9M| fiat_25519_uint128 x10; 263| 33.9M| fiat_25519_uint128 x11; 264| 33.9M| fiat_25519_uint128 x12; 265| 33.9M| fiat_25519_uint128 x13; 266| 33.9M| fiat_25519_uint128 x14; 267| 33.9M| fiat_25519_uint128 x15; 268| 33.9M| fiat_25519_uint128 x16; 269| 33.9M| fiat_25519_uint128 x17; 270| 33.9M| fiat_25519_uint128 x18; 271| 33.9M| fiat_25519_uint128 x19; 272| 33.9M| fiat_25519_uint128 x20; 273| 33.9M| fiat_25519_uint128 x21; 274| 33.9M| fiat_25519_uint128 x22; 275| 33.9M| fiat_25519_uint128 x23; 276| 33.9M| fiat_25519_uint128 x24; 277| 33.9M| uint64_t x25; 278| 33.9M| uint64_t x26; 279| 33.9M| fiat_25519_uint128 x27; 280| 33.9M| fiat_25519_uint128 x28; 281| 33.9M| fiat_25519_uint128 x29; 282| 33.9M| fiat_25519_uint128 x30; 283| 33.9M| fiat_25519_uint128 x31; 284| 33.9M| uint64_t x32; 285| 33.9M| uint64_t x33; 286| 33.9M| fiat_25519_uint128 x34; 287| 33.9M| uint64_t x35; 288| 33.9M| uint64_t x36; 289| 33.9M| fiat_25519_uint128 x37; 290| 33.9M| uint64_t x38; 291| 33.9M| uint64_t x39; 292| 33.9M| fiat_25519_uint128 x40; 293| 33.9M| uint64_t x41; 294| 33.9M| uint64_t x42; 295| 33.9M| uint64_t x43; 296| 33.9M| uint64_t x44; 297| 33.9M| uint64_t x45; 298| 33.9M| uint64_t x46; 299| 33.9M| uint64_t x47; 300| 33.9M| fiat_25519_uint1 x48; 301| 33.9M| uint64_t x49; 302| 33.9M| uint64_t x50; 303| 33.9M| x1 = ((arg1[4]) * UINT8_C(0x13)); 304| 33.9M| x2 = (x1 * 0x2); 305| 33.9M| x3 = ((arg1[4]) * 0x2); 306| 33.9M| x4 = ((arg1[3]) * UINT8_C(0x13)); 307| 33.9M| x5 = (x4 * 0x2); 308| 33.9M| x6 = ((arg1[3]) * 0x2); 309| 33.9M| x7 = ((arg1[2]) * 0x2); 310| 33.9M| x8 = ((arg1[1]) * 0x2); 311| 33.9M| x9 = ((fiat_25519_uint128)(arg1[4]) * x1); 312| 33.9M| x10 = ((fiat_25519_uint128)(arg1[3]) * x2); 313| 33.9M| x11 = ((fiat_25519_uint128)(arg1[3]) * x4); 314| 33.9M| x12 = ((fiat_25519_uint128)(arg1[2]) * x2); 315| 33.9M| x13 = ((fiat_25519_uint128)(arg1[2]) * x5); 316| 33.9M| x14 = ((fiat_25519_uint128)(arg1[2]) * (arg1[2])); 317| 33.9M| x15 = ((fiat_25519_uint128)(arg1[1]) * x2); 318| 33.9M| x16 = ((fiat_25519_uint128)(arg1[1]) * x6); 319| 33.9M| x17 = ((fiat_25519_uint128)(arg1[1]) * x7); 320| 33.9M| x18 = ((fiat_25519_uint128)(arg1[1]) * (arg1[1])); 321| 33.9M| x19 = ((fiat_25519_uint128)(arg1[0]) * x3); 322| 33.9M| x20 = ((fiat_25519_uint128)(arg1[0]) * x6); 323| 33.9M| x21 = ((fiat_25519_uint128)(arg1[0]) * x7); 324| 33.9M| x22 = ((fiat_25519_uint128)(arg1[0]) * x8); 325| 33.9M| x23 = ((fiat_25519_uint128)(arg1[0]) * (arg1[0])); 326| 33.9M| x24 = (x23 + (x15 + x13)); 327| 33.9M| x25 = (uint64_t)(x24 >> 51); 328| 33.9M| x26 = (uint64_t)(x24 & UINT64_C(0x7ffffffffffff)); 329| 33.9M| x27 = (x19 + (x16 + x14)); 330| 33.9M| x28 = (x20 + (x17 + x9)); 331| 33.9M| x29 = (x21 + (x18 + x10)); 332| 33.9M| x30 = (x22 + (x12 + x11)); 333| 33.9M| x31 = (x25 + x30); 334| 33.9M| x32 = (uint64_t)(x31 >> 51); 335| 33.9M| x33 = (uint64_t)(x31 & UINT64_C(0x7ffffffffffff)); 336| 33.9M| x34 = (x32 + x29); 337| 33.9M| x35 = (uint64_t)(x34 >> 51); 338| 33.9M| x36 = (uint64_t)(x34 & UINT64_C(0x7ffffffffffff)); 339| 33.9M| x37 = (x35 + x28); 340| 33.9M| x38 = (uint64_t)(x37 >> 51); 341| 33.9M| x39 = (uint64_t)(x37 & UINT64_C(0x7ffffffffffff)); 342| 33.9M| x40 = (x38 + x27); 343| 33.9M| x41 = (uint64_t)(x40 >> 51); 344| 33.9M| x42 = (uint64_t)(x40 & UINT64_C(0x7ffffffffffff)); 345| 33.9M| x43 = (x41 * UINT8_C(0x13)); 346| 33.9M| x44 = (x26 + x43); 347| 33.9M| x45 = (x44 >> 51); 348| 33.9M| x46 = (x44 & UINT64_C(0x7ffffffffffff)); 349| 33.9M| x47 = (x45 + x33); 350| 33.9M| x48 = (fiat_25519_uint1)(x47 >> 51); 351| 33.9M| x49 = (x47 & UINT64_C(0x7ffffffffffff)); 352| 33.9M| x50 = (x48 + x36); 353| 33.9M| out1[0] = x46; 354| 33.9M| out1[1] = x49; 355| 33.9M| out1[2] = x50; 356| 33.9M| out1[3] = x39; 357| 33.9M| out1[4] = x42; 358| 33.9M|} curve25519.cc:_ZL14fiat_25519_subPmPKmS1_: 431| 133k|static FIAT_25519_FIAT_INLINE void fiat_25519_sub(fiat_25519_loose_field_element out1, const fiat_25519_tight_field_element arg1, const fiat_25519_tight_field_element arg2) { 432| 133k| uint64_t x1; 433| 133k| uint64_t x2; 434| 133k| uint64_t x3; 435| 133k| uint64_t x4; 436| 133k| uint64_t x5; 437| 133k| x1 = ((UINT64_C(0xfffffffffffda) + (arg1[0])) - (arg2[0])); 438| 133k| x2 = ((UINT64_C(0xffffffffffffe) + (arg1[1])) - (arg2[1])); 439| 133k| x3 = ((UINT64_C(0xffffffffffffe) + (arg1[2])) - (arg2[2])); 440| 133k| x4 = ((UINT64_C(0xffffffffffffe) + (arg1[3])) - (arg2[3])); 441| 133k| x5 = ((UINT64_C(0xffffffffffffe) + (arg1[4])) - (arg2[4])); 442| 133k| out1[0] = x1; 443| 133k| out1[1] = x2; 444| 133k| out1[2] = x3; 445| 133k| out1[3] = x4; 446| 133k| out1[4] = x5; 447| 133k|} curve25519.cc:_ZL14fiat_25519_addPmPKmS1_: 406| 133k|static FIAT_25519_FIAT_INLINE void fiat_25519_add(fiat_25519_loose_field_element out1, const fiat_25519_tight_field_element arg1, const fiat_25519_tight_field_element arg2) { 407| 133k| uint64_t x1; 408| 133k| uint64_t x2; 409| 133k| uint64_t x3; 410| 133k| uint64_t x4; 411| 133k| uint64_t x5; 412| 133k| x1 = ((arg1[0]) + (arg2[0])); 413| 133k| x2 = ((arg1[1]) + (arg2[1])); 414| 133k| x3 = ((arg1[2]) + (arg2[2])); 415| 133k| x4 = ((arg1[3]) + (arg2[3])); 416| 133k| x5 = ((arg1[4]) + (arg2[4])); 417| 133k| out1[0] = x1; 418| 133k| out1[1] = x2; 419| 133k| out1[2] = x3; 420| 133k| out1[3] = x4; 421| 133k| out1[4] = x5; 422| 133k|} curve25519.cc:_ZL21fiat_25519_from_bytesPmPKh: 733| 533k|static FIAT_25519_FIAT_INLINE void fiat_25519_from_bytes(fiat_25519_tight_field_element out1, const uint8_t arg1[32]) { 734| 533k| uint64_t x1; 735| 533k| uint64_t x2; 736| 533k| uint64_t x3; 737| 533k| uint64_t x4; 738| 533k| uint64_t x5; 739| 533k| uint64_t x6; 740| 533k| uint64_t x7; 741| 533k| uint64_t x8; 742| 533k| uint64_t x9; 743| 533k| uint64_t x10; 744| 533k| uint64_t x11; 745| 533k| uint64_t x12; 746| 533k| uint64_t x13; 747| 533k| uint64_t x14; 748| 533k| uint64_t x15; 749| 533k| uint64_t x16; 750| 533k| uint64_t x17; 751| 533k| uint64_t x18; 752| 533k| uint64_t x19; 753| 533k| uint64_t x20; 754| 533k| uint64_t x21; 755| 533k| uint64_t x22; 756| 533k| uint64_t x23; 757| 533k| uint64_t x24; 758| 533k| uint64_t x25; 759| 533k| uint64_t x26; 760| 533k| uint64_t x27; 761| 533k| uint64_t x28; 762| 533k| uint64_t x29; 763| 533k| uint64_t x30; 764| 533k| uint64_t x31; 765| 533k| uint8_t x32; 766| 533k| uint64_t x33; 767| 533k| uint64_t x34; 768| 533k| uint64_t x35; 769| 533k| uint64_t x36; 770| 533k| uint64_t x37; 771| 533k| uint64_t x38; 772| 533k| uint64_t x39; 773| 533k| uint8_t x40; 774| 533k| uint64_t x41; 775| 533k| uint64_t x42; 776| 533k| uint64_t x43; 777| 533k| uint64_t x44; 778| 533k| uint64_t x45; 779| 533k| uint64_t x46; 780| 533k| uint64_t x47; 781| 533k| uint8_t x48; 782| 533k| uint64_t x49; 783| 533k| uint64_t x50; 784| 533k| uint64_t x51; 785| 533k| uint64_t x52; 786| 533k| uint64_t x53; 787| 533k| uint64_t x54; 788| 533k| uint64_t x55; 789| 533k| uint64_t x56; 790| 533k| uint8_t x57; 791| 533k| uint64_t x58; 792| 533k| uint64_t x59; 793| 533k| uint64_t x60; 794| 533k| uint64_t x61; 795| 533k| uint64_t x62; 796| 533k| uint64_t x63; 797| 533k| uint64_t x64; 798| 533k| uint8_t x65; 799| 533k| uint64_t x66; 800| 533k| uint64_t x67; 801| 533k| uint64_t x68; 802| 533k| uint64_t x69; 803| 533k| uint64_t x70; 804| 533k| uint64_t x71; 805| 533k| x1 = ((uint64_t)(arg1[31]) << 44); 806| 533k| x2 = ((uint64_t)(arg1[30]) << 36); 807| 533k| x3 = ((uint64_t)(arg1[29]) << 28); 808| 533k| x4 = ((uint64_t)(arg1[28]) << 20); 809| 533k| x5 = ((uint64_t)(arg1[27]) << 12); 810| 533k| x6 = ((uint64_t)(arg1[26]) << 4); 811| 533k| x7 = ((uint64_t)(arg1[25]) << 47); 812| 533k| x8 = ((uint64_t)(arg1[24]) << 39); 813| 533k| x9 = ((uint64_t)(arg1[23]) << 31); 814| 533k| x10 = ((uint64_t)(arg1[22]) << 23); 815| 533k| x11 = ((uint64_t)(arg1[21]) << 15); 816| 533k| x12 = ((uint64_t)(arg1[20]) << 7); 817| 533k| x13 = ((uint64_t)(arg1[19]) << 50); 818| 533k| x14 = ((uint64_t)(arg1[18]) << 42); 819| 533k| x15 = ((uint64_t)(arg1[17]) << 34); 820| 533k| x16 = ((uint64_t)(arg1[16]) << 26); 821| 533k| x17 = ((uint64_t)(arg1[15]) << 18); 822| 533k| x18 = ((uint64_t)(arg1[14]) << 10); 823| 533k| x19 = ((uint64_t)(arg1[13]) << 2); 824| 533k| x20 = ((uint64_t)(arg1[12]) << 45); 825| 533k| x21 = ((uint64_t)(arg1[11]) << 37); 826| 533k| x22 = ((uint64_t)(arg1[10]) << 29); 827| 533k| x23 = ((uint64_t)(arg1[9]) << 21); 828| 533k| x24 = ((uint64_t)(arg1[8]) << 13); 829| 533k| x25 = ((uint64_t)(arg1[7]) << 5); 830| 533k| x26 = ((uint64_t)(arg1[6]) << 48); 831| 533k| x27 = ((uint64_t)(arg1[5]) << 40); 832| 533k| x28 = ((uint64_t)(arg1[4]) << 32); 833| 533k| x29 = ((uint64_t)(arg1[3]) << 24); 834| 533k| x30 = ((uint64_t)(arg1[2]) << 16); 835| 533k| x31 = ((uint64_t)(arg1[1]) << 8); 836| 533k| x32 = (arg1[0]); 837| 533k| x33 = (x31 + (uint64_t)x32); 838| 533k| x34 = (x30 + x33); 839| 533k| x35 = (x29 + x34); 840| 533k| x36 = (x28 + x35); 841| 533k| x37 = (x27 + x36); 842| 533k| x38 = (x26 + x37); 843| 533k| x39 = (x38 & UINT64_C(0x7ffffffffffff)); 844| 533k| x40 = (uint8_t)(x38 >> 51); 845| 533k| x41 = (x25 + (uint64_t)x40); 846| 533k| x42 = (x24 + x41); 847| 533k| x43 = (x23 + x42); 848| 533k| x44 = (x22 + x43); 849| 533k| x45 = (x21 + x44); 850| 533k| x46 = (x20 + x45); 851| 533k| x47 = (x46 & UINT64_C(0x7ffffffffffff)); 852| 533k| x48 = (uint8_t)(x46 >> 51); 853| 533k| x49 = (x19 + (uint64_t)x48); 854| 533k| x50 = (x18 + x49); 855| 533k| x51 = (x17 + x50); 856| 533k| x52 = (x16 + x51); 857| 533k| x53 = (x15 + x52); 858| 533k| x54 = (x14 + x53); 859| 533k| x55 = (x13 + x54); 860| 533k| x56 = (x55 & UINT64_C(0x7ffffffffffff)); 861| 533k| x57 = (uint8_t)(x55 >> 51); 862| 533k| x58 = (x12 + (uint64_t)x57); 863| 533k| x59 = (x11 + x58); 864| 533k| x60 = (x10 + x59); 865| 533k| x61 = (x9 + x60); 866| 533k| x62 = (x8 + x61); 867| 533k| x63 = (x7 + x62); 868| 533k| x64 = (x63 & UINT64_C(0x7ffffffffffff)); 869| 533k| x65 = (uint8_t)(x63 >> 51); 870| 533k| x66 = (x6 + (uint64_t)x65); 871| 533k| x67 = (x5 + x66); 872| 533k| x68 = (x4 + x67); 873| 533k| x69 = (x3 + x68); 874| 533k| x70 = (x2 + x69); 875| 533k| x71 = (x1 + x70); 876| 533k| out1[0] = x39; 877| 533k| out1[1] = x47; 878| 533k| out1[2] = x56; 879| 533k| out1[3] = x64; 880| 533k| out1[4] = x71; 881| 533k|} x25519_scalar_mult_adx: 471| 21.0k| const uint8_t point[32]) { 472| 21.0k| uint8_t e[32]; 473| 21.0k| OPENSSL_memcpy(e, scalar, 32); 474| 21.0k| e[0] &= 248; 475| 21.0k| e[31] &= 127; 476| 21.0k| e[31] |= 64; 477| | 478| | // The following implementation was transcribed to Coq and proven to 479| | // correspond to unary scalar multiplication in affine coordinates given that 480| | // x1 != 0 is the x coordinate of some point on the curve. It was also checked 481| | // in Coq that doing a ladderstep with x1 = x3 = 0 gives z2' = z3' = 0, and z2 482| | // = z3 = 0 gives z2' = z3' = 0. The statement was quantified over the 483| | // underlying field, so it applies to Curve25519 itself and the quadratic 484| | // twist of Curve25519. It was not proven in Coq that prime-field arithmetic 485| | // correctly simulates extension-field arithmetic on prime-field values. 486| | // The decoding of the byte array representation of e was not considered. 487| | // Specification of Montgomery curves in affine coordinates: 488| | // 489| | // Proof that these form a group that is isomorphic to a Weierstrass curve: 490| | // 491| | // Coq transcription and correctness proof of the loop (where scalarbits=255): 492| | // 493| | // 494| | // preconditions: 0 <= e < 2^255 (not necessarily e < order), fe_invert(0) = 0 495| 21.0k| fe4 x1, x2 = {1}, z2 = {0}, x3, z3 = {1}, tmp0, tmp1; 496| 21.0k| OPENSSL_memcpy(x1, point, sizeof(fe4)); 497| 21.0k| x1[3] &= (uint64_t)(-1)>>1; 498| 21.0k| OPENSSL_memcpy(x3, x1, sizeof(fe4)); 499| | 500| 21.0k| unsigned swap = 0; 501| 21.0k| int pos; 502| 5.38M| for (pos = 254; pos >= 0; --pos) { ------------------ | Branch (502:19): [True: 5.36M, False: 21.0k] ------------------ 503| | // loop invariant as of right before the test, for the case where x1 != 0: 504| | // pos >= -1; if z2 = 0 then x2 is nonzero; if z3 = 0 then x3 is nonzero 505| | // let r := e >> (pos+1) in the following equalities of projective points: 506| | // to_xz (r*P) === if swap then (x3, z3) else (x2, z2) 507| | // to_xz ((r+1)*P) === if swap then (x2, z2) else (x3, z3) 508| | // x1 is the nonzero x coordinate of the nonzero point (r*P-(r+1)*P) 509| 5.36M| unsigned b = 1 & (e[pos / 8] >> (pos & 7)); 510| 5.36M| swap ^= b; 511| 5.36M| fe4_cswap(x2, x3, swap, x2, x3); 512| 5.36M| fe4_cswap(z2, z3, swap, z2, z3); 513| 5.36M| swap = b; 514| | // Coq transcription of ladderstep formula (called from transcribed loop): 515| | // 516| | // 517| | // x1 != 0 518| | // x1 = 0 519| 5.36M| fe4_sub(tmp0, x3, z3); 520| 5.36M| fe4_sub(tmp1, x2, z2); 521| 5.36M| fe4_add(x2, x2, z2); 522| 5.36M| fe4_add(z2, x3, z3); 523| 5.36M| fe4_mul(z3, tmp0, x2); 524| 5.36M| fe4_mul(z2, z2, tmp1); 525| 5.36M| fe4_sq(tmp0, tmp1); 526| 5.36M| fe4_sq(tmp1, x2); 527| 5.36M| fe4_add(x3, z3, z2); 528| 5.36M| fe4_sub(z2, z3, z2); 529| 5.36M| fe4_mul(x2, tmp1, tmp0); 530| 5.36M| fe4_sub(tmp1, tmp1, tmp0); 531| 5.36M| fe4_sq(z2, z2); 532| 5.36M| fe4_scmul(z3, tmp1, 121666); 533| 5.36M| fe4_sq(x3, x3); 534| 5.36M| fe4_add(tmp0, tmp0, z3); 535| 5.36M| fe4_mul(z3, x1, z2); 536| 5.36M| fe4_mul(z2, tmp1, tmp0); 537| 5.36M| } 538| | // here pos=-1, so r=e, so to_xz (e*P) === if swap then (x3, z3) else (x2, z2) 539| 21.0k| fe4_cswap(x2, x3, swap, x2, x3); 540| 21.0k| fe4_cswap(z2, z3, swap, z2, z3); 541| | 542| 21.0k| fe4_invert(z2, z2); 543| 21.0k| fe4_mul(x2, x2, z2); 544| 21.0k| fe4_canon(x2, x2); 545| 21.0k| OPENSSL_memcpy(out, x2, sizeof(fe4)); 546| 21.0k|} x25519_ge_scalarmult_base_adx: 649| 133k|void x25519_ge_scalarmult_base_adx(uint8_t h[4][32], const uint8_t a[32]) { 650| 133k| signed char e[64]; 651| 133k| signed char carry; 652| | 653| 4.40M| for (unsigned i = 0; i < 32; ++i) { ------------------ | Branch (653:24): [True: 4.27M, False: 133k] ------------------ 654| 4.27M| e[2 * i + 0] = (a[i] >> 0) & 15; 655| 4.27M| e[2 * i + 1] = (a[i] >> 4) & 15; 656| 4.27M| } 657| | // each e[i] is between 0 and 15 658| | // e[63] is between 0 and 7 659| | 660| 133k| carry = 0; 661| 8.54M| for (unsigned i = 0; i < 63; ++i) { ------------------ | Branch (661:24): [True: 8.41M, False: 133k] ------------------ 662| 8.41M| e[i] += carry; 663| 8.41M| carry = e[i] + 8; 664| 8.41M| carry >>= 4; 665| 8.41M| e[i] -= carry << 4; 666| 8.41M| } 667| 133k| e[63] += carry; 668| | // each e[i] is between -8 and 8 669| | 670| 133k| ge_p3_4 r = {{0}, {1}, {1}, {0}}; 671| 4.40M| for (unsigned i = 1; i < 64; i += 2) { ------------------ | Branch (671:24): [True: 4.27M, False: 133k] ------------------ 672| 4.27M| ge_precomp_4 t; 673| 4.27M| table_select_4(&t, i / 2, e[i]); 674| 4.27M| ge_p3_add_p3_precomp_4(&r, &r, &t); 675| 4.27M| } 676| | 677| 133k| inline_x25519_ge_dbl_4(&r, &r, /*skip_t=*/true); 678| 133k| inline_x25519_ge_dbl_4(&r, &r, /*skip_t=*/true); 679| 133k| inline_x25519_ge_dbl_4(&r, &r, /*skip_t=*/true); 680| 133k| inline_x25519_ge_dbl_4(&r, &r, /*skip_t=*/false); 681| | 682| 4.40M| for (unsigned i = 0; i < 64; i += 2) { ------------------ | Branch (682:24): [True: 4.27M, False: 133k] ------------------ 683| 4.27M| ge_precomp_4 t; 684| 4.27M| table_select_4(&t, i / 2, e[i]); 685| 4.27M| ge_p3_add_p3_precomp_4(&r, &r, &t); 686| 4.27M| } 687| | 688| | // fe4 uses saturated 64-bit limbs, so converting to bytes is just a copy. 689| | // Satisfy stated precondition of fiat_25519_from_bytes; tests pass either way 690| 133k| fe4_canon(r.X, r.X); 691| 133k| fe4_canon(r.Y, r.Y); 692| 133k| fe4_canon(r.Z, r.Z); 693| 133k| fe4_canon(r.T, r.T); 694| 133k| static_assert(sizeof(ge_p3_4) == sizeof(uint8_t[4][32]), ""); 695| 133k| OPENSSL_memcpy(h, &r, sizeof(ge_p3_4)); 696| 133k|} curve25519_64_adx.cc:_ZL9fe4_cswapPmS_hPKmS1_: 377| 10.7M|static void fe4_cswap(uint64_t out1[4], uint64_t out2[4], fiat_uint1 arg1, const uint64_t arg2[4], const uint64_t arg3[4]) { 378| 10.7M| uint64_t x1; 379| 10.7M| uint64_t x2; 380| 10.7M| uint64_t x3; 381| 10.7M| uint64_t x4; 382| 10.7M| uint64_t x5; 383| 10.7M| uint64_t x6; 384| 10.7M| uint64_t x7; 385| 10.7M| uint64_t x8; 386| | // NOTE: clang 14 for Zen 2 uses YMM registers 387| 10.7M| fiat_cmovznz_u64(&x1, arg1, (arg2[0]), (arg3[0])); 388| 10.7M| fiat_cmovznz_u64(&x2, arg1, (arg2[1]), (arg3[1])); 389| 10.7M| fiat_cmovznz_u64(&x3, arg1, (arg2[2]), (arg3[2])); 390| 10.7M| fiat_cmovznz_u64(&x4, arg1, (arg2[3]), (arg3[3])); 391| 10.7M| fiat_cmovznz_u64(&x5, arg1, (arg3[0]), (arg2[0])); 392| 10.7M| fiat_cmovznz_u64(&x6, arg1, (arg3[1]), (arg2[1])); 393| 10.7M| fiat_cmovznz_u64(&x7, arg1, (arg3[2]), (arg2[2])); 394| 10.7M| fiat_cmovznz_u64(&x8, arg1, (arg3[3]), (arg2[3])); 395| 10.7M| out1[0] = x1; 396| 10.7M| out1[1] = x2; 397| 10.7M| out1[2] = x3; 398| 10.7M| out1[3] = x4; 399| 10.7M| out2[0] = x5; 400| 10.7M| out2[1] = x6; 401| 10.7M| out2[2] = x7; 402| 10.7M| out2[3] = x8; 403| 10.7M|} curve25519_64_adx.cc:_ZL16fiat_cmovznz_u64Pmhmm: 147| 324M|static inline void fiat_cmovznz_u64(uint64_t* out1, fiat_uint1 arg1, uint64_t arg2, uint64_t arg3) { 148| 324M| fiat_uint1 x1; 149| 324M| uint64_t x2; 150| 324M| uint64_t x3; 151| 324M| x1 = (!(!arg1)); 152| 324M| x2 = ((fiat_int1)(0x0 - x1) & UINT64_C(0xffffffffffffffff)); 153| 324M| x3 = ((fiat_value_barrier_u64(x2) & arg3) | (fiat_value_barrier_u64((~x2)) & arg2)); 154| 324M| *out1 = x3; 155| 324M|} curve25519_64_adx.cc:_ZL22fiat_value_barrier_u64m: 12| 649M|static __inline__ uint64_t fiat_value_barrier_u64(uint64_t a) { 13| 649M| __asm__("" : "+r"(a) : /* no inputs */); 14| 649M| return a; 15| 649M|} curve25519_64_adx.cc:_ZL7fe4_subPmPKmS1_: 211| 57.2M|static void fe4_sub(uint64_t out1[4], const uint64_t arg1[4], const uint64_t arg2[4]) { 212| 57.2M| uint64_t x1; 213| 57.2M| uint64_t x2; 214| 57.2M| fiat_uint1 x3; 215| 57.2M| uint64_t x4; 216| 57.2M| uint64_t x5; 217| 57.2M| fiat_uint1 x6; 218| 57.2M| uint64_t x7; 219| 57.2M| uint64_t x8; 220| 57.2M| fiat_uint1 x9; 221| 57.2M| uint64_t x10; 222| 57.2M| uint64_t x11; 223| 57.2M| fiat_uint1 x12; 224| 57.2M| uint64_t x13; 225| 57.2M| uint64_t x14; 226| 57.2M| fiat_uint1 x15; 227| 57.2M| uint64_t x16; 228| 57.2M| fiat_uint1 x17; 229| 57.2M| uint64_t x18; 230| 57.2M| fiat_uint1 x19; 231| 57.2M| uint64_t x20; 232| 57.2M| fiat_uint1 x21; 233| 57.2M| uint64_t x22; 234| 57.2M| uint64_t x23; 235| 57.2M| fiat_uint1 x24; 236| 57.2M| x1 = (arg2[0]); 237| 57.2M| fiat_subborrowx_u64(&x2, &x3, 0x0, (arg1[0]), x1); 238| 57.2M| x4 = (arg2[1]); 239| 57.2M| fiat_subborrowx_u64(&x5, &x6, x3, (arg1[1]), x4); 240| 57.2M| x7 = (arg2[2]); 241| 57.2M| fiat_subborrowx_u64(&x8, &x9, x6, (arg1[2]), x7); 242| 57.2M| x10 = (arg2[3]); 243| 57.2M| fiat_subborrowx_u64(&x11, &x12, x9, (arg1[3]), x10); 244| 57.2M| fiat_cmovznz_u64(&x13, x12, 0x0, UINT8_C(0x26)); // NOTE: clang 14 for Zen 2 uses sbb, and 245| 57.2M| fiat_subborrowx_u64(&x14, &x15, 0x0, x2, x13); 246| 57.2M| fiat_subborrowx_u64(&x16, &x17, x15, x5, 0x0); 247| 57.2M| fiat_subborrowx_u64(&x18, &x19, x17, x8, 0x0); 248| 57.2M| fiat_subborrowx_u64(&x20, &x21, x19, x11, 0x0); 249| 57.2M| fiat_cmovznz_u64(&x22, x21, 0x0, UINT8_C(0x26)); // NOTE: clang 14 for Zen 2 uses sbb, and 250| 57.2M| fiat_subborrowx_u64(&x23, &x24, 0x0, x14, x22); 251| 57.2M| out1[0] = x23; 252| 57.2M| out1[1] = x16; 253| 57.2M| out1[2] = x18; 254| 57.2M| out1[3] = x20; 255| 57.2M|} curve25519_64_adx.cc:_ZL19fiat_subborrowx_u64PmPhhmm: 112| 519M|static inline void fiat_subborrowx_u64(uint64_t* out1, fiat_uint1* out2, fiat_uint1 arg1, uint64_t arg2, uint64_t arg3) { 113| 519M|#if defined(__has_builtin) 114| 519M|# if __has_builtin(__builtin_ia32_subborrow_u64) 115| 519M|# define subborrow64 __builtin_ia32_subborrow_u64 116| 519M|# endif 117| 519M|#endif 118| 519M|#if defined(subborrow64) 119| 519M| long long unsigned int t; 120| 519M| *out2 = subborrow64(arg1, arg2, arg3, &t); ------------------ | | 115| 519M|# define subborrow64 __builtin_ia32_subborrow_u64 ------------------ 121| 519M| *out1 = t; 122| |#elif defined(_M_X64) 123| | long long unsigned int t; 124| | *out2 = _subborrow_u64(arg1, arg2, arg3, &t); // NOTE: edited after generation 125| | *out1 = t; 126| |#else 127| | *out1 = arg2 - arg3 - arg1; 128| | *out2 = (arg2 < arg3) | ((arg2 == arg3) & arg1); 129| |#endif 130| 519M|#undef subborrow64 131| 519M|} curve25519_64_adx.cc:_ZL7fe4_addPmPKmS1_: 165| 57.2M|static void fe4_add(uint64_t out1[4], const uint64_t arg1[4], const uint64_t arg2[4]) { 166| 57.2M| uint64_t x1; 167| 57.2M| fiat_uint1 x2; 168| 57.2M| uint64_t x3; 169| 57.2M| fiat_uint1 x4; 170| 57.2M| uint64_t x5; 171| 57.2M| fiat_uint1 x6; 172| 57.2M| uint64_t x7; 173| 57.2M| fiat_uint1 x8; 174| 57.2M| uint64_t x9; 175| 57.2M| uint64_t x10; 176| 57.2M| fiat_uint1 x11; 177| 57.2M| uint64_t x12; 178| 57.2M| fiat_uint1 x13; 179| 57.2M| uint64_t x14; 180| 57.2M| fiat_uint1 x15; 181| 57.2M| uint64_t x16; 182| 57.2M| fiat_uint1 x17; 183| 57.2M| uint64_t x18; 184| 57.2M| uint64_t x19; 185| 57.2M| fiat_uint1 x20; 186| 57.2M| fiat_addcarryx_u64(&x1, &x2, 0x0, (arg1[0]), (arg2[0])); 187| 57.2M| fiat_addcarryx_u64(&x3, &x4, x2, (arg1[1]), (arg2[1])); 188| 57.2M| fiat_addcarryx_u64(&x5, &x6, x4, (arg1[2]), (arg2[2])); 189| 57.2M| fiat_addcarryx_u64(&x7, &x8, x6, (arg1[3]), (arg2[3])); 190| 57.2M| fiat_cmovznz_u64(&x9, x8, 0x0, UINT8_C(0x26)); // NOTE: clang 14 for Zen 2 uses sbb, and 191| 57.2M| fiat_addcarryx_u64(&x10, &x11, 0x0, x1, x9); 192| 57.2M| fiat_addcarryx_u64(&x12, &x13, x11, x3, 0x0); 193| 57.2M| fiat_addcarryx_u64(&x14, &x15, x13, x5, 0x0); 194| 57.2M| fiat_addcarryx_u64(&x16, &x17, x15, x7, 0x0); 195| 57.2M| fiat_cmovznz_u64(&x18, x17, 0x0, UINT8_C(0x26)); // NOTE: clang 14 for Zen 2 uses sbb, and 196| 57.2M| fiat_addcarryx_u64(&x19, &x20, 0x0, x10, x18); 197| 57.2M| out1[0] = x19; 198| 57.2M| out1[1] = x12; 199| 57.2M| out1[2] = x14; 200| 57.2M| out1[3] = x16; 201| 57.2M|} curve25519_64_adx.cc:_ZL18fiat_addcarryx_u64PmPhhmm: 70| 557M|static inline void fiat_addcarryx_u64(uint64_t* out1, fiat_uint1* out2, fiat_uint1 arg1, uint64_t arg2, uint64_t arg3) { 71| |// NOTE: edited after generation 72| 557M|#if defined(__has_builtin) 73| 557M|# if __has_builtin(__builtin_ia32_addcarryx_u64) 74| 557M|# define addcarry64 __builtin_ia32_addcarryx_u64 75| 557M|# endif 76| 557M|#endif 77| 557M|#if defined(addcarry64) 78| 557M| long long unsigned int t; 79| 557M| *out2 = addcarry64(arg1, arg2, arg3, &t); ------------------ | | 74| 557M|# define addcarry64 __builtin_ia32_addcarryx_u64 ------------------ 80| 557M| *out1 = t; 81| |#elif defined(_M_X64) 82| | long long unsigned int t; 83| | *out2 = _addcarry_u64(arg1, arg2, arg3, out1); 84| | *out1 = t; 85| |#else 86| | arg2 += arg1; 87| | arg1 = arg2 < arg1; 88| | uint64_t ret = arg2 + arg3; 89| | arg1 += ret < arg2; 90| | *out1 = ret; 91| | *out2 = arg1; 92| |#endif 93| 557M|#undef addcarry64 94| 557M|} curve25519_64_adx.cc:_ZL7fe4_mulPmPKmS1_: 18| 88.6M|static inline void fe4_mul(fe4 out, const fe4 x, const fe4 y) { fiat_curve25519_adx_mul(out, x, y); } curve25519_64_adx.cc:_ZL6fe4_sqPmPKm: 21| 28.9M|static inline void fe4_sq(fe4 out, const fe4 x) { fiat_curve25519_adx_square(out, x); } curve25519_64_adx.cc:_ZL9fe4_scmulPmPKmm: 265| 5.36M|static void fe4_scmul(uint64_t out1[4], const uint64_t arg1[4], uint64_t arg2) { 266| 5.36M| uint64_t x1; 267| 5.36M| uint64_t x2; 268| 5.36M| uint64_t x3; 269| 5.36M| uint64_t x4; 270| 5.36M| uint64_t x5; 271| 5.36M| fiat_uint1 x6; 272| 5.36M| uint64_t x7; 273| 5.36M| uint64_t x8; 274| 5.36M| uint64_t x9; 275| 5.36M| fiat_uint1 x10; 276| 5.36M| uint64_t x11; 277| 5.36M| uint64_t x12; 278| 5.36M| uint64_t x13; 279| 5.36M| fiat_uint1 x14; 280| 5.36M| uint64_t x15; 281| 5.36M| uint64_t x16; 282| 5.36M| uint64_t x17; 283| 5.36M| fiat_uint1 x18; 284| 5.36M| uint64_t x19; 285| 5.36M| fiat_uint1 x20; 286| 5.36M| uint64_t x21; 287| 5.36M| fiat_uint1 x22; 288| 5.36M| uint64_t x23; 289| 5.36M| fiat_uint1 x24; 290| 5.36M| uint64_t x25; 291| 5.36M| uint64_t x26; 292| 5.36M| fiat_uint1 x27; 293| 5.36M| fiat_mulx_u64(&x1, &x2, (arg1[0]), arg2); 294| 5.36M| fiat_mulx_u64(&x3, &x4, (arg1[1]), arg2); 295| 5.36M| fiat_addcarryx_u64(&x5, &x6, 0x0, x2, x3); 296| 5.36M| fiat_mulx_u64(&x7, &x8, (arg1[2]), arg2); 297| 5.36M| fiat_addcarryx_u64(&x9, &x10, x6, x4, x7); 298| 5.36M| fiat_mulx_u64(&x11, &x12, (arg1[3]), arg2); 299| 5.36M| fiat_addcarryx_u64(&x13, &x14, x10, x8, x11); 300| 5.36M| fiat_mulx_u64(&x15, &x16, (x12 + (uint64_t)x14), UINT8_C(0x26)); 301| 5.36M| fiat_addcarryx_u64(&x17, &x18, 0x0, x1, x15); 302| 5.36M| fiat_addcarryx_u64(&x19, &x20, x18, x5, 0x0); 303| 5.36M| fiat_addcarryx_u64(&x21, &x22, x20, x9, 0x0); 304| 5.36M| fiat_addcarryx_u64(&x23, &x24, x22, x13, 0x0); 305| 5.36M| fiat_cmovznz_u64(&x25, x24, 0x0, UINT8_C(0x26)); // NOTE: clang 14 for Zen 2 uses sbb, and 306| 5.36M| fiat_addcarryx_u64(&x26, &x27, 0x0, x17, x25); 307| 5.36M| out1[0] = x26; 308| 5.36M| out1[1] = x19; 309| 5.36M| out1[2] = x21; 310| 5.36M| out1[3] = x23; 311| 5.36M|} curve25519_64_adx.cc:_ZL13fiat_mulx_u64PmS_mm: 38| 26.8M|static inline void fiat_mulx_u64(uint64_t* out1, uint64_t* out2, uint64_t arg1, uint64_t arg2) { 39| |// NOTE: edited after generation 40| |#if defined(_M_X64) 41| | unsigned long long t; 42| | *out1 = _umul128(arg1, arg2, &t); 43| | *out2 = t; 44| |#elif defined(_M_ARM64) 45| | *out1 = arg1 * arg2; 46| | *out2 = __umulh(arg1, arg2); 47| |#else 48| 26.8M| unsigned __int128 t = (unsigned __int128)arg1 * arg2; 49| 26.8M| *out1 = t; 50| 26.8M| *out2 = (t >> 64); 51| 26.8M|#endif 52| 26.8M|} curve25519_64_adx.cc:_ZL10fe4_invertPmPKm: 411| 21.0k|static void fe4_invert(fe4 out, const fe4 z) { 412| 21.0k| fe4 t0; 413| 21.0k| fe4 t1; 414| 21.0k| fe4 t2; 415| 21.0k| fe4 t3; 416| 21.0k| int i; 417| | 418| 21.0k| fe4_sq(t0, z); 419| 21.0k| fe4_sq(t1, t0); 420| 42.0k| for (i = 1; i < 2; ++i) { ------------------ | Branch (420:15): [True: 21.0k, False: 21.0k] ------------------ 421| 21.0k| fe4_sq(t1, t1); 422| 21.0k| } 423| 21.0k| fe4_mul(t1, z, t1); 424| 21.0k| fe4_mul(t0, t0, t1); 425| 21.0k| fe4_sq(t2, t0); 426| 21.0k| fe4_mul(t1, t1, t2); 427| 21.0k| fe4_sq(t2, t1); 428| 105k| for (i = 1; i < 5; ++i) { ------------------ | Branch (428:15): [True: 84.1k, False: 21.0k] ------------------ 429| 84.1k| fe4_sq(t2, t2); 430| 84.1k| } 431| 21.0k| fe4_mul(t1, t2, t1); 432| 21.0k| fe4_sq(t2, t1); 433| 210k| for (i = 1; i < 10; ++i) { ------------------ | Branch (433:15): [True: 189k, False: 21.0k] ------------------ 434| 189k| fe4_sq(t2, t2); 435| 189k| } 436| 21.0k| fe4_mul(t2, t2, t1); 437| 21.0k| fe4_sq(t3, t2); 438| 420k| for (i = 1; i < 20; ++i) { ------------------ | Branch (438:15): [True: 399k, False: 21.0k] ------------------ 439| 399k| fe4_sq(t3, t3); 440| 399k| } 441| 21.0k| fe4_mul(t2, t3, t2); 442| 21.0k| fe4_sq(t2, t2); 443| 210k| for (i = 1; i < 10; ++i) { ------------------ | Branch (443:15): [True: 189k, False: 21.0k] ------------------ 444| 189k| fe4_sq(t2, t2); 445| 189k| } 446| 21.0k| fe4_mul(t1, t2, t1); 447| 21.0k| fe4_sq(t2, t1); 448| 1.05M| for (i = 1; i < 50; ++i) { ------------------ | Branch (448:15): [True: 1.03M, False: 21.0k] ------------------ 449| 1.03M| fe4_sq(t2, t2); 450| 1.03M| } 451| 21.0k| fe4_mul(t2, t2, t1); 452| 21.0k| fe4_sq(t3, t2); 453| 2.10M| for (i = 1; i < 100; ++i) { ------------------ | Branch (453:15): [True: 2.08M, False: 21.0k] ------------------ 454| 2.08M| fe4_sq(t3, t3); 455| 2.08M| } 456| 21.0k| fe4_mul(t2, t3, t2); 457| 21.0k| fe4_sq(t2, t2); 458| 1.05M| for (i = 1; i < 50; ++i) { ------------------ | Branch (458:15): [True: 1.03M, False: 21.0k] ------------------ 459| 1.03M| fe4_sq(t2, t2); 460| 1.03M| } 461| 21.0k| fe4_mul(t1, t2, t1); 462| 21.0k| fe4_sq(t1, t1); 463| 105k| for (i = 1; i < 5; ++i) { ------------------ | Branch (463:15): [True: 84.1k, False: 21.0k] ------------------ 464| 84.1k| fe4_sq(t1, t1); 465| 84.1k| } 466| 21.0k| fe4_mul(out, t1, t0); 467| 21.0k|} curve25519_64_adx.cc:_ZL9fe4_canonPmPKm: 320| 555k|static void fe4_canon(uint64_t out1[4], const uint64_t arg1[4]) { 321| 555k| uint64_t x1; 322| 555k| fiat_uint1 x2; 323| 555k| uint64_t x3; 324| 555k| fiat_uint1 x4; 325| 555k| uint64_t x5; 326| 555k| fiat_uint1 x6; 327| 555k| uint64_t x7; 328| 555k| fiat_uint1 x8; 329| 555k| uint64_t x9; 330| 555k| uint64_t x10; 331| 555k| uint64_t x11; 332| 555k| uint64_t x12; 333| 555k| uint64_t x13; 334| 555k| fiat_uint1 x14; 335| 555k| uint64_t x15; 336| 555k| fiat_uint1 x16; 337| 555k| uint64_t x17; 338| 555k| fiat_uint1 x18; 339| 555k| uint64_t x19; 340| 555k| fiat_uint1 x20; 341| 555k| uint64_t x21; 342| 555k| uint64_t x22; 343| 555k| uint64_t x23; 344| 555k| uint64_t x24; 345| 555k| fiat_subborrowx_u64(&x1, &x2, 0x0, (arg1[0]), UINT64_C(0xffffffffffffffed)); 346| 555k| fiat_subborrowx_u64(&x3, &x4, x2, (arg1[1]), UINT64_C(0xffffffffffffffff)); 347| 555k| fiat_subborrowx_u64(&x5, &x6, x4, (arg1[2]), UINT64_C(0xffffffffffffffff)); 348| 555k| fiat_subborrowx_u64(&x7, &x8, x6, (arg1[3]), UINT64_C(0x7fffffffffffffff)); 349| 555k| fiat_cmovznz_u64(&x9, x8, x1, (arg1[0])); 350| 555k| fiat_cmovznz_u64(&x10, x8, x3, (arg1[1])); 351| 555k| fiat_cmovznz_u64(&x11, x8, x5, (arg1[2])); 352| 555k| fiat_cmovznz_u64(&x12, x8, x7, (arg1[3])); 353| 555k| fiat_subborrowx_u64(&x13, &x14, 0x0, x9, UINT64_C(0xffffffffffffffed)); 354| 555k| fiat_subborrowx_u64(&x15, &x16, x14, x10, UINT64_C(0xffffffffffffffff)); 355| 555k| fiat_subborrowx_u64(&x17, &x18, x16, x11, UINT64_C(0xffffffffffffffff)); 356| 555k| fiat_subborrowx_u64(&x19, &x20, x18, x12, UINT64_C(0x7fffffffffffffff)); 357| 555k| fiat_cmovznz_u64(&x21, x20, x13, x9); 358| 555k| fiat_cmovznz_u64(&x22, x20, x15, x10); 359| 555k| fiat_cmovznz_u64(&x23, x20, x17, x11); 360| 555k| fiat_cmovznz_u64(&x24, x20, x19, x12); 361| 555k| out1[0] = x21; 362| 555k| out1[1] = x22; 363| 555k| out1[2] = x23; 364| 555k| out1[3] = x24; 365| 555k|} curve25519_64_adx.cc:_ZL14table_select_4P12ge_precomp_4ia: 609| 8.54M| const signed char b) { 610| 8.54M| uint8_t bnegative = constant_time_msb_w(b); 611| 8.54M| uint8_t babs = b - ((bnegative & b) << 1); 612| | 613| 8.54M| uint8_t t_bytes[3][32] = { 614| 8.54M| {static_cast(constant_time_is_zero_w(b) & 1)}, 615| 8.54M| {static_cast(constant_time_is_zero_w(b) & 1)}, 616| 8.54M| {0}, 617| 8.54M| }; 618| 8.54M|#if defined(__clang__) 619| 8.54M| __asm__("" : "+m" (t_bytes) : /*no inputs*/); 620| 8.54M|#endif 621| 8.54M| static_assert(sizeof(t_bytes) == sizeof(k25519Precomp[pos][0]), ""); 622| 76.8M| for (int i = 0; i < 8; i++) { ------------------ | Branch (622:19): [True: 68.3M, False: 8.54M] ------------------ 623| 68.3M| constant_time_conditional_memxor(t_bytes, k25519Precomp[pos][i], 624| 68.3M| sizeof(t_bytes), 625| 68.3M| constant_time_eq_w(babs, 1 + i)); 626| 68.3M| } 627| | 628| 8.54M| static_assert(sizeof(t_bytes) == sizeof(ge_precomp_4), ""); 629| | 630| | // fe4 uses saturated 64-bit limbs, so converting from bytes is just a copy. 631| 8.54M| OPENSSL_memcpy(t, t_bytes, sizeof(ge_precomp_4)); 632| | 633| 8.54M| fe4 xy2d_neg = {0}; 634| 8.54M| fe4_sub(xy2d_neg, xy2d_neg, t->xy2d); 635| 8.54M| constant_time_conditional_memcpy(t->yplusx, t_bytes[1], sizeof(fe4), 636| 8.54M| bnegative); 637| 8.54M| constant_time_conditional_memcpy(t->yminusx, t_bytes[0], sizeof(fe4), 638| 8.54M| bnegative); 639| 8.54M| constant_time_conditional_memcpy(t->xy2d, xy2d_neg, sizeof(fe4), bnegative); 640| 8.54M|} curve25519_64_adx.cc:_ZL22ge_p3_add_p3_precomp_4P7ge_p3_4PKS_PK12ge_precomp_4: 587| 8.54M|ge_p3_add_p3_precomp_4(ge_p3_4 *r, const ge_p3_4 *p, const ge_precomp_4 *q) { 588| 8.54M| fe4 A, B, C, YplusX, YminusX, D, X3, Y3, Z3, T3; 589| | // Transcribed from a Coq function proven against affine coordinates. 590| | // https://github.com/mit-plv/fiat-crypto/blob/a36568d1d73aff5d7accc79fd28be672882f9c17/src/Curves/Edwards/XYZT/Precomputed.v#L38-L56 591| 8.54M| fe4_add(YplusX, p->Y, p->X); 592| 8.54M| fe4_sub(YminusX, p->Y, p->X); 593| 8.54M| fe4_mul(A, YplusX, q->yplusx); 594| 8.54M| fe4_mul(B, YminusX, q->yminusx); 595| 8.54M| fe4_mul(C, q->xy2d, p->T); 596| 8.54M| fe4_add(D, p->Z, p->Z); 597| 8.54M| fe4_sub(X3, A, B); 598| 8.54M| fe4_add(Y3, A, B); 599| 8.54M| fe4_add(Z3, D, C); 600| 8.54M| fe4_sub(T3, D, C); 601| 8.54M| fe4_mul(r->X, X3, T3); 602| 8.54M| fe4_mul(r->Y, Y3, Z3); 603| 8.54M| fe4_mul(r->Z, Z3, T3); 604| 8.54M| fe4_mul(r->T, X3, Y3); 605| 8.54M|} curve25519_64_adx.cc:_ZL22inline_x25519_ge_dbl_4P7ge_p3_4PKS_b: 562| 533k|static void inline_x25519_ge_dbl_4(ge_p3_4 *r, const ge_p3_4 *p, bool skip_t) { 563| | // Transcribed from a Coq function proven against affine coordinates. 564| | // https://github.com/mit-plv/fiat-crypto/blob/9943ba9e7d8f3e1c0054b2c94a5edca46ea73ef8/src/Curves/Edwards/XYZT/Basic.v#L136-L165 565| 533k| fe4 trX, trZ, trT, t0, cX, cY, cZ, cT; 566| 533k| fe4_sq(trX, p->X); 567| 533k| fe4_sq(trZ, p->Y); 568| 533k| fe4_sq(trT, p->Z); 569| 533k| fe4_add(trT, trT, trT); 570| 533k| fe4_add(cY, p->X, p->Y); 571| 533k| fe4_sq(t0, cY); 572| 533k| fe4_add(cY, trZ, trX); 573| 533k| fe4_sub(cZ, trZ, trX); 574| 533k| fe4_sub(cX, t0, cY); 575| 533k| fe4_sub(cT, trT, cZ); 576| 533k| fe4_mul(r->X, cX, cT); 577| 533k| fe4_mul(r->Y, cY, cZ); 578| 533k| fe4_mul(r->Z, cZ, cT); 579| 533k| if (!skip_t) { ------------------ | Branch (579:7): [True: 133k, False: 400k] ------------------ 580| 133k| fe4_mul(r->T, cX, cY); 581| 133k| } 582| 533k|}