Skip to content

Commit

Permalink
[dev.boringcrypto] crypto/internal/boring: make SHA calls allocation-…
Browse files Browse the repository at this point in the history 
…free

The standard Go implementations are allocation-free.
Making the BoringCrypto ones the same helps avoid
surprises, including in some of our own tests.

For #51940.

Change-Id: Ic9c5dc46f5e29ca85f571244be2b380ec2cf89c9
Reviewed-on: https://go-review.googlesource.com/c/go/+/395876
Reviewed-by: Roland Shoemaker <roland@golang.org>
Run-TryBot: Russ Cox <rsc@golang.org>
TryBot-Result: Gopher Robot <gobot@golang.org>
  • Loading branch information
@rsc
rsc committed Apr 29, 2022
1 parent 3cb10d1 commit 0ec0828
Show file tree
Hide file tree
Showing 13 changed files with 265 additions and 103 deletions.
7 changes: 5 additions & 2 deletions src/crypto/ed25519/ed25519_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ import (
"bytes"
"compress/gzip"
"crypto"
"crypto/internal/boring"
"crypto/rand"
"encoding/hex"
"os"
Expand Down Expand Up @@ -186,7 +187,9 @@ func TestMalleability(t *testing.T) {
}

func TestAllocations(t *testing.T) {
t.Skip("skipping allocations test on Go+BoringCrypto, as cgo causes allocations")
if boring.Enabled {
t.Skip("skipping allocations test with BoringCrypto")
}
if strings.HasSuffix(os.Getenv("GO_BUILDER_NAME"), "-noopt") {
t.Skip("skipping allocations test without relevant optimizations")
}
Expand All @@ -200,7 +203,7 @@ func TestAllocations(t *testing.T) {
t.Fatal("signature didn't verify")
}
}); allocs > 0 {
t.Errorf("expected zero allocations, got %0.1v", allocs)
t.Errorf("expected zero allocations, got %0.1f", allocs)
}
}

Expand Down
1 change: 0 additions & 1 deletion src/crypto/ed25519/internal/edwards25519/edwards25519_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -281,7 +281,6 @@ func TestNonCanonicalPoints(t *testing.T) {
var testAllocationsSink byte

func TestAllocations(t *testing.T) {
t.Skip("skipping allocations test on Go+BoringCrypto, as cgo causes allocations")
if strings.HasSuffix(os.Getenv("GO_BUILDER_NAME"), "-noopt") {
t.Skip("skipping allocations test without relevant optimizations")
}
Expand Down
12 changes: 12 additions & 0 deletions src/crypto/internal/boring/boring.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -97,3 +97,15 @@ func bigToBn(bnp **C.GO_BIGNUM, b *big.Int) bool {
*bnp = bn
return true
}

// noescape hides a pointer from escape analysis. noescape is
// the identity function but escape analysis doesn't think the
// output depends on the input. noescape is inlined and currently
// compiles down to zero instructions.
// USE CAREFULLY!
//
//go:nosplit
func noescape(p unsafe.Pointer) unsafe.Pointer {
x := uintptr(p)
return unsafe.Pointer(x ^ 0)
}
6 changes: 6 additions & 0 deletions src/crypto/internal/boring/notboring.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,12 @@ func NewSHA256() hash.Hash { panic("boringcrypto: not available") }
func NewSHA384() hash.Hash { panic("boringcrypto: not available") }
func NewSHA512() hash.Hash { panic("boringcrypto: not available") }

func SHA1([]byte) [20]byte { panic("boringcrypto: not available") }
func SHA224([]byte) [28]byte { panic("boringcrypto: not available") }
func SHA256([]byte) [32]byte { panic("boringcrypto: not available") }
func SHA384([]byte) [48]byte { panic("boringcrypto: not available") }
func SHA512([]byte) [64]byte { panic("boringcrypto: not available") }

func NewHMAC(h func() hash.Hash, key []byte) hash.Hash { panic("boringcrypto: not available") }

func NewAESCipher(key []byte) (cipher.Block, error) { panic("boringcrypto: not available") }
Expand Down
205 changes: 162 additions & 43 deletions src/crypto/internal/boring/sha.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -7,14 +7,104 @@

package boring

// #include "goboringcrypto.h"
/*
#include "goboringcrypto.h"
int
_goboringcrypto_gosha1(void *p, size_t n, void *out)
{
GO_SHA_CTX ctx;
_goboringcrypto_SHA1_Init(&ctx);
return _goboringcrypto_SHA1_Update(&ctx, p, n) &&
_goboringcrypto_SHA1_Final(out, &ctx);
}
int
_goboringcrypto_gosha224(void *p, size_t n, void *out)
{
GO_SHA256_CTX ctx;
_goboringcrypto_SHA224_Init(&ctx);
return _goboringcrypto_SHA224_Update(&ctx, p, n) &&
_goboringcrypto_SHA224_Final(out, &ctx);
}
int
_goboringcrypto_gosha256(void *p, size_t n, void *out)
{
GO_SHA256_CTX ctx;
_goboringcrypto_SHA256_Init(&ctx);
return _goboringcrypto_SHA256_Update(&ctx, p, n) &&
_goboringcrypto_SHA256_Final(out, &ctx);
}
int
_goboringcrypto_gosha384(void *p, size_t n, void *out)
{
GO_SHA512_CTX ctx;
_goboringcrypto_SHA384_Init(&ctx);
return _goboringcrypto_SHA384_Update(&ctx, p, n) &&
_goboringcrypto_SHA384_Final(out, &ctx);
}
int
_goboringcrypto_gosha512(void *p, size_t n, void *out)
{
GO_SHA512_CTX ctx;
_goboringcrypto_SHA512_Init(&ctx);
return _goboringcrypto_SHA512_Update(&ctx, p, n) &&
_goboringcrypto_SHA512_Final(out, &ctx);
}
*/
import "C"
import (
"errors"
"hash"
"unsafe"
)

func addr(p []byte) unsafe.Pointer {
if len(p) == 0 {
return nil
}
return unsafe.Pointer(&p[0])
}

func SHA1(p []byte) (sum [20]byte) {
if C._goboringcrypto_gosha1(noescape(addr(p)), C.size_t(len(p)), noescape(unsafe.Pointer(&sum[0]))) == 0 {
panic("boringcrypto: SHA1 failed")
}
return
}

func SHA224(p []byte) (sum [28]byte) {
if C._goboringcrypto_gosha224(noescape(addr(p)), C.size_t(len(p)), noescape(unsafe.Pointer(&sum[0]))) == 0 {
panic("boringcrypto: SHA224 failed")
}
return
}

func SHA256(p []byte) (sum [32]byte) {
if C._goboringcrypto_gosha256(noescape(addr(p)), C.size_t(len(p)), noescape(unsafe.Pointer(&sum[0]))) == 0 {
panic("boringcrypto: SHA256 failed")
}
return
}

func SHA384(p []byte) (sum [48]byte) {
if C._goboringcrypto_gosha384(noescape(addr(p)), C.size_t(len(p)), noescape(unsafe.Pointer(&sum[0]))) == 0 {
panic("boringcrypto: SHA384 failed")
}
return
}

func SHA512(p []byte) (sum [64]byte) {
if C._goboringcrypto_gosha512(noescape(addr(p)), C.size_t(len(p)), noescape(unsafe.Pointer(&sum[0]))) == 0 {
panic("boringcrypto: SHA512 failed")
}
return
}

// NewSHA1 returns a new SHA1 hash.
func NewSHA1() hash.Hash {
h := new(sha1Hash)
Expand All @@ -34,24 +124,31 @@ type sha1Ctx struct {
nx uint32
}

func (h *sha1Hash) Reset() { C._goboringcrypto_SHA1_Init(&h.ctx) }
func (h *sha1Hash) Size() int { return 20 }
func (h *sha1Hash) BlockSize() int { return 64 }
func (h *sha1Hash) Sum(in []byte) []byte { return append(in, h.sum()...) }
func (h *sha1Hash) noescapeCtx() *C.GO_SHA_CTX {
return (*C.GO_SHA_CTX)(noescape(unsafe.Pointer(&h.ctx)))
}

func (h *sha1Hash) Reset() {
C._goboringcrypto_SHA1_Init(h.noescapeCtx())
}

func (h *sha1Hash) Size() int { return 20 }
func (h *sha1Hash) BlockSize() int { return 64 }
func (h *sha1Hash) Sum(dst []byte) []byte { return h.sum(dst) }

func (h *sha1Hash) Write(p []byte) (int, error) {
if len(p) > 0 && C._goboringcrypto_SHA1_Update(&h.ctx, unsafe.Pointer(&p[0]), C.size_t(len(p))) == 0 {
if len(p) > 0 && C._goboringcrypto_SHA1_Update(h.noescapeCtx(), noescape(addr(p)), C.size_t(len(p))) == 0 {
panic("boringcrypto: SHA1_Update failed")
}
return len(p), nil
}

func (h0 *sha1Hash) sum() []byte {
func (h0 *sha1Hash) sum(dst []byte) []byte {
h := *h0 // make copy so future Write+Sum is valid
if C._goboringcrypto_SHA1_Final((*C.uint8_t)(unsafe.Pointer(&h.out[0])), &h.ctx) == 0 {
if C._goboringcrypto_SHA1_Final((*C.uint8_t)(noescape(unsafe.Pointer(&h.out[0]))), h.noescapeCtx()) == 0 {
panic("boringcrypto: SHA1_Final failed")
}
return h.out[:]
return append(dst, h.out[:]...)
}

const (
Expand Down Expand Up @@ -108,24 +205,30 @@ type sha224Hash struct {
out [224 / 8]byte
}

func (h *sha224Hash) Reset() { C._goboringcrypto_SHA224_Init(&h.ctx) }
func (h *sha224Hash) Size() int { return 224 / 8 }
func (h *sha224Hash) BlockSize() int { return 64 }
func (h *sha224Hash) Sum(in []byte) []byte { return append(in, h.sum()...) }
func (h *sha224Hash) noescapeCtx() *C.GO_SHA256_CTX {
return (*C.GO_SHA256_CTX)(noescape(unsafe.Pointer(&h.ctx)))
}

func (h *sha224Hash) Reset() {
C._goboringcrypto_SHA224_Init(h.noescapeCtx())
}
func (h *sha224Hash) Size() int { return 224 / 8 }
func (h *sha224Hash) BlockSize() int { return 64 }
func (h *sha224Hash) Sum(dst []byte) []byte { return h.sum(dst) }

func (h *sha224Hash) Write(p []byte) (int, error) {
if len(p) > 0 && C._goboringcrypto_SHA224_Update(&h.ctx, unsafe.Pointer(&p[0]), C.size_t(len(p))) == 0 {
if len(p) > 0 && C._goboringcrypto_SHA224_Update(h.noescapeCtx(), noescape(addr(p)), C.size_t(len(p))) == 0 {
panic("boringcrypto: SHA224_Update failed")
}
return len(p), nil
}

func (h0 *sha224Hash) sum() []byte {
func (h0 *sha224Hash) sum(dst []byte) []byte {
h := *h0 // make copy so future Write+Sum is valid
if C._goboringcrypto_SHA224_Final((*C.uint8_t)(unsafe.Pointer(&h.out[0])), &h.ctx) == 0 {
if C._goboringcrypto_SHA224_Final((*C.uint8_t)(noescape(unsafe.Pointer(&h.out[0]))), h.noescapeCtx()) == 0 {
panic("boringcrypto: SHA224_Final failed")
}
return h.out[:]
return append(dst, h.out[:]...)
}

// NewSHA256 returns a new SHA256 hash.
Expand All @@ -140,24 +243,30 @@ type sha256Hash struct {
out [256 / 8]byte
}

func (h *sha256Hash) Reset() { C._goboringcrypto_SHA256_Init(&h.ctx) }
func (h *sha256Hash) Size() int { return 256 / 8 }
func (h *sha256Hash) BlockSize() int { return 64 }
func (h *sha256Hash) Sum(in []byte) []byte { return append(in, h.sum()...) }
func (h *sha256Hash) noescapeCtx() *C.GO_SHA256_CTX {
return (*C.GO_SHA256_CTX)(noescape(unsafe.Pointer(&h.ctx)))
}

func (h *sha256Hash) Reset() {
C._goboringcrypto_SHA256_Init(h.noescapeCtx())
}
func (h *sha256Hash) Size() int { return 256 / 8 }
func (h *sha256Hash) BlockSize() int { return 64 }
func (h *sha256Hash) Sum(dst []byte) []byte { return h.sum(dst) }

func (h *sha256Hash) Write(p []byte) (int, error) {
if len(p) > 0 && C._goboringcrypto_SHA256_Update(&h.ctx, unsafe.Pointer(&p[0]), C.size_t(len(p))) == 0 {
if len(p) > 0 && C._goboringcrypto_SHA256_Update(h.noescapeCtx(), noescape(addr(p)), C.size_t(len(p))) == 0 {
panic("boringcrypto: SHA256_Update failed")
}
return len(p), nil
}

func (h0 *sha256Hash) sum() []byte {
func (h0 *sha256Hash) sum(dst []byte) []byte {
h := *h0 // make copy so future Write+Sum is valid
if C._goboringcrypto_SHA256_Final((*C.uint8_t)(unsafe.Pointer(&h.out[0])), &h.ctx) == 0 {
if C._goboringcrypto_SHA256_Final((*C.uint8_t)(noescape(unsafe.Pointer(&h.out[0]))), h.noescapeCtx()) == 0 {
panic("boringcrypto: SHA256_Final failed")
}
return h.out[:]
return append(dst, h.out[:]...)
}

const (
Expand Down Expand Up @@ -271,24 +380,30 @@ type sha384Hash struct {
out [384 / 8]byte
}

func (h *sha384Hash) Reset() { C._goboringcrypto_SHA384_Init(&h.ctx) }
func (h *sha384Hash) Size() int { return 384 / 8 }
func (h *sha384Hash) BlockSize() int { return 128 }
func (h *sha384Hash) Sum(in []byte) []byte { return append(in, h.sum()...) }
func (h *sha384Hash) noescapeCtx() *C.GO_SHA512_CTX {
return (*C.GO_SHA512_CTX)(noescape(unsafe.Pointer(&h.ctx)))
}

func (h *sha384Hash) Reset() {
C._goboringcrypto_SHA384_Init(h.noescapeCtx())
}
func (h *sha384Hash) Size() int { return 384 / 8 }
func (h *sha384Hash) BlockSize() int { return 128 }
func (h *sha384Hash) Sum(dst []byte) []byte { return h.sum(dst) }

func (h *sha384Hash) Write(p []byte) (int, error) {
if len(p) > 0 && C._goboringcrypto_SHA384_Update(&h.ctx, unsafe.Pointer(&p[0]), C.size_t(len(p))) == 0 {
if len(p) > 0 && C._goboringcrypto_SHA384_Update(h.noescapeCtx(), noescape(addr(p)), C.size_t(len(p))) == 0 {
panic("boringcrypto: SHA384_Update failed")
}
return len(p), nil
}

func (h0 *sha384Hash) sum() []byte {
func (h0 *sha384Hash) sum(dst []byte) []byte {
h := *h0 // make copy so future Write+Sum is valid
if C._goboringcrypto_SHA384_Final((*C.uint8_t)(unsafe.Pointer(&h.out[0])), &h.ctx) == 0 {
if C._goboringcrypto_SHA384_Final((*C.uint8_t)(noescape(unsafe.Pointer(&h.out[0]))), h.noescapeCtx()) == 0 {
panic("boringcrypto: SHA384_Final failed")
}
return h.out[:]
return append(dst, h.out[:]...)
}

// NewSHA512 returns a new SHA512 hash.
Expand All @@ -303,24 +418,30 @@ type sha512Hash struct {
out [512 / 8]byte
}

func (h *sha512Hash) Reset() { C._goboringcrypto_SHA512_Init(&h.ctx) }
func (h *sha512Hash) Size() int { return 512 / 8 }
func (h *sha512Hash) BlockSize() int { return 128 }
func (h *sha512Hash) Sum(in []byte) []byte { return append(in, h.sum()...) }
func (h *sha512Hash) noescapeCtx() *C.GO_SHA512_CTX {
return (*C.GO_SHA512_CTX)(noescape(unsafe.Pointer(&h.ctx)))
}

func (h *sha512Hash) Reset() {
C._goboringcrypto_SHA512_Init(h.noescapeCtx())
}
func (h *sha512Hash) Size() int { return 512 / 8 }
func (h *sha512Hash) BlockSize() int { return 128 }
func (h *sha512Hash) Sum(dst []byte) []byte { return h.sum(dst) }

func (h *sha512Hash) Write(p []byte) (int, error) {
if len(p) > 0 && C._goboringcrypto_SHA512_Update(&h.ctx, unsafe.Pointer(&p[0]), C.size_t(len(p))) == 0 {
if len(p) > 0 && C._goboringcrypto_SHA512_Update(h.noescapeCtx(), noescape(addr(p)), C.size_t(len(p))) == 0 {
panic("boringcrypto: SHA512_Update failed")
}
return len(p), nil
}

func (h0 *sha512Hash) sum() []byte {
func (h0 *sha512Hash) sum(dst []byte) []byte {
h := *h0 // make copy so future Write+Sum is valid
if C._goboringcrypto_SHA512_Final((*C.uint8_t)(unsafe.Pointer(&h.out[0])), &h.ctx) == 0 {
if C._goboringcrypto_SHA512_Final((*C.uint8_t)(noescape(unsafe.Pointer(&h.out[0]))), h.noescapeCtx()) == 0 {
panic("boringcrypto: SHA512_Final failed")
}
return h.out[:]
return append(dst, h.out[:]...)
}

type sha512Ctx struct {
Expand All @@ -338,8 +459,6 @@ const (
marshaledSize512 = len(magic512) + 8*8 + 128 + 8
)

var zero [128]byte

func (h *sha384Hash) MarshalBinary() ([]byte, error) {
d := (*sha512Ctx)(unsafe.Pointer(&h.ctx))
b := make([]byte, 0, marshaledSize512)
Expand Down
6 changes: 4 additions & 2 deletions src/crypto/sha1/boring.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,8 @@
// cmd/internal/boring is not even imported, so that we don't
// have to maintain changes to cmd/dist's deps graph.

//go:build !cmd_go_bootstrap
// +build !cmd_go_bootstrap
//go:build !cmd_go_bootstrap && cgo
// +build !cmd_go_bootstrap,cgo

package sha1

Expand All @@ -21,3 +21,5 @@ const boringEnabled = boring.Enabled
func boringNewSHA1() hash.Hash { return boring.NewSHA1() }

func boringUnreachable() { boring.Unreachable() }

func boringSHA1(p []byte) [20]byte { return boring.SHA1(p) }
Loading

0 comments on commit 0ec0828

Please sign in to comment.