commit | b1086cdb12052b23b9aa64c9c632fd7a0c6dc467 | [log] [tgz] |
---|---|---|
author | David Benjamin <davidben@google.com> | Fri Feb 01 00:45:23 2019 +0000 |
committer | CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> | Sun Apr 26 18:31:56 2020 +0000 |
tree | 599ecaab69f40597c3865c4baa77e4af9232c74c | |
parent | 14d192e930802135eadf57d1cd90165a94e3441a [diff] |
Harden against fork via MADV_WIPEONFORK. Linux 4.14 and up support MADV_WIPEONFORK, which can be used to reliably and efficiently detect forks. Use it to harden the PRNG and RSA blinding caches. On the RSA side, we currently cache blinding values. (Alas, removing the cache gives a *very* noticeable perf hit. There is some low-hanging fruit to trim a few Montgomery reductions, but it didn't offset much last I toyed with it.) Now, on Linux 4.14 and up, this cache is fork-safe. Since not all platforms that support fork also support fork detection, this should only be used as a hardening measure. Now, when detection is present, BoringSSL will skip doing per-call entropy draws from the kernel. (This might regress protection against VM cloning when no fast RDRAND is available. However, we need to do something for AMD machines. Hypervisors that clone VMs are going to need to signal the kernel to wipe WIPEONFORK pages.) Upgrade-Note: BoringSSL now calls some more syscalls on Linux. If this offends sandboxes, let us know. We can loosen the sandbox or add a mechanism to prime the MADV_WIPEONFORK page before entering it. Change-Id: I6ba43951aeaa2b9b81f74f9e5a7a0ce2de0438a4 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/34745 Reviewed-by: Adam Langley <alangley@gmail.com> Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com>
BoringSSL is a fork of OpenSSL that is designed to meet Google's needs.
Although BoringSSL is an open source project, it is not intended for general use, as OpenSSL is. We don't recommend that third parties depend upon it. Doing so is likely to be frustrating because there are no guarantees of API or ABI stability.
Programs ship their own copies of BoringSSL when they use it and we update everything as needed when deciding to make API changes. This allows us to mostly avoid compromises in the name of compatibility. It works for us, but it may not work for you.
BoringSSL arose because Google used OpenSSL for many years in various ways and, over time, built up a large number of patches that were maintained while tracking upstream OpenSSL. As Google's product portfolio became more complex, more copies of OpenSSL sprung up and the effort involved in maintaining all these patches in multiple places was growing steadily.
Currently BoringSSL is the SSL library in Chrome/Chromium, Android (but it's not part of the NDK) and a number of other apps/programs.
Project links:
There are other files in this directory which might be helpful: