b1086cdb12
Linux 4.14 and up support MADV_WIPEONFORK, which can be used to reliably and efficiently detect forks. Use it to harden the PRNG and RSA blinding caches. On the RSA side, we currently cache blinding values. (Alas, removing the cache gives a *very* noticeable perf hit. There is some low-hanging fruit to trim a few Montgomery reductions, but it didn't offset much last I toyed with it.) Now, on Linux 4.14 and up, this cache is fork-safe. Since not all platforms that support fork also support fork detection, this should only be used as a hardening measure. Now, when detection is present, BoringSSL will skip doing per-call entropy draws from the kernel. (This might regress protection against VM cloning when no fast RDRAND is available. However, we need to do something for AMD machines. Hypervisors that clone VMs are going to need to signal the kernel to wipe WIPEONFORK pages.) Upgrade-Note: BoringSSL now calls some more syscalls on Linux. If this offends sandboxes, let us know. We can loosen the sandbox or add a mechanism to prime the MADV_WIPEONFORK page before entering it. Change-Id: I6ba43951aeaa2b9b81f74f9e5a7a0ce2de0438a4 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/34745 Reviewed-by: Adam Langley <alangley@gmail.com> Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com>
50 lines
1.4 KiB
JSON
50 lines
1.4 KiB
JSON
[
|
|
{
|
|
"cmd": ["crypto/crypto_test"]
|
|
},
|
|
{
|
|
"cmd": ["crypto/crypto_test", "--gtest_also_run_disabled_tests", "--gtest_filter=BNTest.DISABLED_WycheproofPrimality"]
|
|
},
|
|
{
|
|
"cmd": ["crypto/crypto_test", "--gtest_also_run_disabled_tests", "--gtest_filter=RSATest.DISABLED_BlindingCacheConcurrency"],
|
|
"skip_sde": true
|
|
},
|
|
{
|
|
"cmd": ["crypto/urandom_test"]
|
|
},
|
|
{
|
|
"comment": "Without RDRAND",
|
|
"cmd": ["crypto/urandom_test"],
|
|
"env": ["OPENSSL_ia32cap=~0x4000000000000000"]
|
|
},
|
|
{
|
|
"comment": "Potentially with RDRAND, but not Intel",
|
|
"cmd": ["crypto/urandom_test"],
|
|
"env": ["OPENSSL_ia32cap=~0x0000000040000000"]
|
|
},
|
|
{
|
|
"comment": "Potentially with RDRAND, and forced to Intel",
|
|
"cmd": ["crypto/urandom_test"],
|
|
"env": ["OPENSSL_ia32cap=|0x0000000040000000"]
|
|
},
|
|
{
|
|
"comment": "No RDRAND and without WIPEONFORK",
|
|
"cmd": ["crypto/urandom_test"],
|
|
"env": ["OPENSSL_ia32cap=~0x4000000000000000", "BORINGSSL_IGNORE_MADV_WIPEONFORK=1"]
|
|
},
|
|
{
|
|
"comment": "Potentially with RDRAND, but not Intel, and no WIPEONFORK",
|
|
"cmd": ["crypto/urandom_test"],
|
|
"env": ["OPENSSL_ia32cap=~0x0000000040000000", "BORINGSSL_IGNORE_MADV_WIPEONFORK=1"]
|
|
},
|
|
{
|
|
"cmd": ["crypto/crypto_test", "--fork_unsafe_buffering", "--gtest_filter=RandTest.*:-RandTest.Fork"]
|
|
},
|
|
{
|
|
"cmd": ["decrepit/decrepit_test"]
|
|
},
|
|
{
|
|
"cmd": ["ssl/ssl_test"]
|
|
}
|
|
]
|