ring/util/all_tests.json
David Benjamin b1086cdb12 Harden against fork via MADV_WIPEONFORK.
Linux 4.14 and up support MADV_WIPEONFORK, which can be used to reliably
and efficiently detect forks. Use it to harden the PRNG and RSA blinding
caches.

On the RSA side, we currently cache blinding values. (Alas, removing the cache
gives a *very* noticeable perf hit. There is some low-hanging fruit to trim a
few Montgomery reductions, but it didn't offset much last I toyed with it.)
Now, on Linux 4.14 and up, this cache is fork-safe.

Since not all platforms that support fork also support fork detection,
this should only be used as a hardening measure. Now, when detection is
present, BoringSSL will skip doing per-call entropy draws from the
kernel. (This might regress protection against VM cloning when no fast
RDRAND is available. However, we need to do something for AMD machines.
Hypervisors that clone VMs are going to need to signal the kernel to
wipe WIPEONFORK pages.)

Upgrade-Note: BoringSSL now calls some more syscalls on Linux. If this offends
sandboxes, let us know. We can loosen the sandbox or add a mechanism to prime
the MADV_WIPEONFORK page before entering it.

Change-Id: I6ba43951aeaa2b9b81f74f9e5a7a0ce2de0438a4
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/34745
Reviewed-by: Adam Langley <alangley@gmail.com>
Reviewed-by: Adam Langley <agl@google.com>
Commit-Queue: Adam Langley <agl@google.com>
2020-04-26 18:31:56 +00:00

50 lines
1.4 KiB
JSON

[
{
"cmd": ["crypto/crypto_test"]
},
{
"cmd": ["crypto/crypto_test", "--gtest_also_run_disabled_tests", "--gtest_filter=BNTest.DISABLED_WycheproofPrimality"]
},
{
"cmd": ["crypto/crypto_test", "--gtest_also_run_disabled_tests", "--gtest_filter=RSATest.DISABLED_BlindingCacheConcurrency"],
"skip_sde": true
},
{
"cmd": ["crypto/urandom_test"]
},
{
"comment": "Without RDRAND",
"cmd": ["crypto/urandom_test"],
"env": ["OPENSSL_ia32cap=~0x4000000000000000"]
},
{
"comment": "Potentially with RDRAND, but not Intel",
"cmd": ["crypto/urandom_test"],
"env": ["OPENSSL_ia32cap=~0x0000000040000000"]
},
{
"comment": "Potentially with RDRAND, and forced to Intel",
"cmd": ["crypto/urandom_test"],
"env": ["OPENSSL_ia32cap=|0x0000000040000000"]
},
{
"comment": "No RDRAND and without WIPEONFORK",
"cmd": ["crypto/urandom_test"],
"env": ["OPENSSL_ia32cap=~0x4000000000000000", "BORINGSSL_IGNORE_MADV_WIPEONFORK=1"]
},
{
"comment": "Potentially with RDRAND, but not Intel, and no WIPEONFORK",
"cmd": ["crypto/urandom_test"],
"env": ["OPENSSL_ia32cap=~0x0000000040000000", "BORINGSSL_IGNORE_MADV_WIPEONFORK=1"]
},
{
"cmd": ["crypto/crypto_test", "--fork_unsafe_buffering", "--gtest_filter=RandTest.*:-RandTest.Fork"]
},
{
"cmd": ["decrepit/decrepit_test"]
},
{
"cmd": ["ssl/ssl_test"]
}
]