Merge branch 'master' of github.com:jedisct1/libsodium

* 'master' of github.com:jedisct1/libsodium:
  Remove RUNNING_JS_OPTS for WebAssembly
  chmod +x *.sh
  chmod +x *.sh
  One more compiler assertion
  secretstream: assume the internal nonce is little endian
  Test sodium_pad() with a NULL pointer
  Regen emscripten symbols
  messagesbytes -> messagebytes
  Have generate-emscripten-symbols.sh automatically update the js/wasm build script
  Add secretstream constants
  salsa208: messagebyte -> messagebytes
  constcheck: grab a few more constants
  Update emscripten symbols list
  Update emscripten symbols list
  Bump
  Accept a NULL pointer for the padded length in sodium_pad()

builds/msvc/version.h

@@ -4,10 +4,10 @@
 
 #include "export.h"
 
-#define SODIUM_VERSION_STRING "1.0.13"
+#define SODIUM_VERSION_STRING "1.0.14"
 
 #define SODIUM_LIBRARY_VERSION_MAJOR 9
-#define SODIUM_LIBRARY_VERSION_MINOR 5
+#define SODIUM_LIBRARY_VERSION_MINOR 6
 
 #ifdef __cplusplus
 extern "C" {

configure.ac

@@ -1,5 +1,5 @@
 AC_PREREQ([2.65])
-AC_INIT([libsodium],[1.0.13],
+AC_INIT([libsodium],[1.0.14],
   [https://github.com/jedisct1/libsodium/issues],
   [libsodium],
   [https://github.com/jedisct1/libsodium])
@@ -17,9 +17,9 @@ ISODATE=`date +%Y-%m-%d`
 AC_SUBST(ISODATE)
 
 SODIUM_LIBRARY_VERSION_MAJOR=9
-SODIUM_LIBRARY_VERSION_MINOR=5
+SODIUM_LIBRARY_VERSION_MINOR=6
 DLL_VERSION=8
-SODIUM_LIBRARY_VERSION=21:0:3
+SODIUM_LIBRARY_VERSION=22:0:4
 #                       | | |
 #                +------+ | +---+
 #                |        |     |

dist-build/emscripten-symbols.def

@@ -334,6 +334,7 @@ _crypto_pwhash_scryptsalsa208sha256_str_verify 0 1
 _crypto_pwhash_scryptsalsa208sha256_strbytes 0 1
 _crypto_pwhash_scryptsalsa208sha256_strprefix 0 1
 _crypto_pwhash_str 0 1
+_crypto_pwhash_str_alg 0 1
 _crypto_pwhash_str_verify 0 1
 _crypto_pwhash_strbytes 0 1
 _crypto_pwhash_strprefix 0 1
@@ -377,6 +378,21 @@ _crypto_secretbox_xsalsa20poly1305_noncebytes 0 1
 _crypto_secretbox_xsalsa20poly1305_open 0 1
 _crypto_secretbox_xsalsa20poly1305_zerobytes 0 1
 _crypto_secretbox_zerobytes 0 1
+_crypto_secretstream_xchacha20poly1305_abytes 1 1
+_crypto_secretstream_xchacha20poly1305_init_pull 1 1
+_crypto_secretstream_xchacha20poly1305_init_push 1 1
+_crypto_secretstream_xchacha20poly1305_initbytes 1 1
+_crypto_secretstream_xchacha20poly1305_keybytes 1 1
+_crypto_secretstream_xchacha20poly1305_keygen 1 1
+_crypto_secretstream_xchacha20poly1305_messagebytes_max 1 1
+_crypto_secretstream_xchacha20poly1305_pull 1 1
+_crypto_secretstream_xchacha20poly1305_push 1 1
+_crypto_secretstream_xchacha20poly1305_rekey 1 1
+_crypto_secretstream_xchacha20poly1305_statebytes 1 1
+_crypto_secretstream_xchacha20poly1305_tag_final 1 1
+_crypto_secretstream_xchacha20poly1305_tag_message 1 1
+_crypto_secretstream_xchacha20poly1305_tag_push 1 1
+_crypto_secretstream_xchacha20poly1305_tag_rekey 1 1
 _crypto_shorthash 1 1
 _crypto_shorthash_bytes 1 1
 _crypto_shorthash_keybytes 1 1
@@ -466,6 +482,7 @@ _crypto_stream_salsa2012_xor 0 1
 _crypto_stream_salsa208 0 1
 _crypto_stream_salsa208_keybytes 0 1
 _crypto_stream_salsa208_keygen 0 1
+_crypto_stream_salsa208_messagebytes_max 0 1
 _crypto_stream_salsa208_noncebytes 0 1
 _crypto_stream_salsa208_xor 0 1
 _crypto_stream_salsa20_keybytes 0 1
@@ -507,6 +524,8 @@ _randombytes_stir 1 1
 _randombytes_uniform 1 1
 _sodium_add 0 0
 _sodium_allocarray 0 0
+_sodium_base642bin 1 1
+_sodium_bin2base64 1 1
 _sodium_bin2hex 1 1
 _sodium_compare 0 0
 _sodium_free 0 0
@@ -526,6 +545,7 @@ _sodium_mprotect_noaccess 0 0
 _sodium_mprotect_readonly 0 0
 _sodium_mprotect_readwrite 0 0
 _sodium_munlock 0 0
+_sodium_pad 1 1
 _sodium_runtime_has_aesni 0 0
 _sodium_runtime_has_avx 0 0
 _sodium_runtime_has_avx2 0 0
@@ -536,4 +556,5 @@ _sodium_runtime_has_sse3 0 0
 _sodium_runtime_has_sse41 0 0
 _sodium_runtime_has_ssse3 0 0
 _sodium_set_misuse_handler 0 0
+_sodium_unpad 1 1
 _sodium_version_string 1 1

dist-build/generate-emscripten-symbols.sh

@@ -1,43 +1,61 @@
 #! /bin/sh
 
-if [ "x$1" = "x--sumo" ]; then
-  SUMO=yes
-fi
+set -e
 
-{
-while read symbol standard sumo; do
-  found="$standard"
-  if [ "x$SUMO" != "x" ]; then
-    found="$sumo"
-  fi
-  if [ "$found" = "1" ]; then
-    eval "defined_${symbol}=yes"
-  else
-    eval "defined_${symbol}=no"
-  fi
-done < emscripten-symbols.def
-
-nm /usr/local/lib/libsodium.18.dylib | \
-fgrep ' T _' | \
-cut -d' ' -f3 | {
-    while read symbol; do
-      eval "found=\$defined_${symbol}"
-      if [ "$found" = "yes" ]; then
-        echo "$symbol"
-      elif [ "$found" != "no" ]; then
-        echo >&2
-        echo "*** [$symbol] was not expected ***" >&2
-        echo >&2
-        exit 1
+symbols() {
+  {
+    SUMO="$1"
+    while read symbol standard sumo; do
+      found="$standard"
+      if [ "x$SUMO" = "xsumo" ]; then
+        found="$sumo"
       fi
-    done
-  }
-} | \
-sort | \
-{
-out=''
-while read symbol ; do
-  out="${out},\"${symbol}\""
-done
-echo $out
+      if [ "$found" = "1" ]; then
+        eval "defined_${symbol}=yes"
+      else
+        eval "defined_${symbol}=no"
+      fi
+    done < emscripten-symbols.def
+
+    nm /usr/local/lib/libsodium.18.dylib | \
+    fgrep ' T _' | \
+    cut -d' ' -f3 | {
+      while read symbol; do
+        eval "found=\$defined_${symbol}"
+        if [ "$found" = "yes" ]; then
+          echo "$symbol"
+        elif [ "$found" != "no" ]; then
+          echo >&2
+          echo "*** [$symbol] was not expected ***" >&2
+          echo >&2
+          exit 1
+        fi
+      done
+    }
+  } | \
+    sort | \
+    {
+      out=''
+      while read symbol ; do
+        if [ ! -z "$out" ]; then
+          out="${out},"
+        fi
+        out="${out}\"${symbol}\""
+      done
+      echo "[${out}]"
+    }
 }
+
+out=$(symbols standard)
+sed s/EXPORTED_FUNCTIONS_STANDARD=\'.*\'/EXPORTED_FUNCTIONS_STANDARD=\'${out}\'/ < emscripten.sh > emscripten.sh.tmp && \
+  mv -f emscripten.sh.tmp emscripten.sh
+sed s/EXPORTED_FUNCTIONS_STANDARD=\'.*\'/EXPORTED_FUNCTIONS_STANDARD=\'${out}\'/ < emscripten-wasm.sh > emscripten-wasm.sh.tmp && \
+  mv -f emscripten-wasm.sh.tmp emscripten-wasm.sh
+
+out=$(symbols sumo)
+sed s/EXPORTED_FUNCTIONS_SUMO=\'.*\'/EXPORTED_FUNCTIONS_SUMO=\'${out}\'/ < emscripten.sh > emscripten.sh.tmp && \
+  mv -f emscripten.sh.tmp emscripten.sh
+sed s/EXPORTED_FUNCTIONS_SUMO=\'.*\'/EXPORTED_FUNCTIONS_SUMO=\'${out}\'/ < emscripten-wasm.sh > emscripten-wasm.sh.tmp && \
+  mv -f emscripten-wasm.sh.tmp emscripten-wasm.sh
+
+chmod +x emscripten.sh emscripten-wasm.sh

msvc-scripts/process.bat

@@ -1,5 +1,5 @@
-cscript msvc-scripts/rep.vbs //Nologo s/@VERSION@/1.0.13/ < src\libsodium\include\sodium\version.h.in > tmp
+cscript msvc-scripts/rep.vbs //Nologo s/@VERSION@/1.0.14/ < src\libsodium\include\sodium\version.h.in > tmp
 cscript msvc-scripts/rep.vbs //Nologo s/@SODIUM_LIBRARY_VERSION_MAJOR@/9/ < tmp > tmp2
-cscript msvc-scripts/rep.vbs //Nologo s/@SODIUM_LIBRARY_VERSION_MINOR@/5/ < tmp2 > tmp3
+cscript msvc-scripts/rep.vbs //Nologo s/@SODIUM_LIBRARY_VERSION_MINOR@/6/ < tmp2 > tmp3
 cscript msvc-scripts/rep.vbs //Nologo s/@SODIUM_LIBRARY_MINIMAL_DEF@// < tmp3 > src\libsodium\include\sodium\version.h
 del tmp tmp2 tmp3

src/libsodium/crypto_secretstream/xchacha20poly1305/secretstream_xchacha20poly1305.c

@@ -1,4 +1,3 @@
-
 #include <stdint.h>
 #include <stdlib.h>
 #include <limits.h>
@@ -34,14 +33,20 @@ crypto_secretstream_xchacha20poly1305_init_push
     const unsigned char k[crypto_secretstream_xchacha20poly1305_KEYBYTES])
 {
     COMPILER_ASSERT(crypto_secretstream_xchacha20poly1305_INITBYTES ==
-                    crypto_core_hchacha20_INPUTBYTES + crypto_secretstream_xchacha20poly1305_INONCEBYTES);
+                    crypto_core_hchacha20_INPUTBYTES +
+                    crypto_secretstream_xchacha20poly1305_INONCEBYTES);
+    COMPILER_ASSERT(crypto_secretstream_xchacha20poly1305_INITBYTES ==
+                    crypto_aead_xchacha20poly1305_ietf_NPUBBYTES);
+    COMPILER_ASSERT(sizeof state->nonce ==
+                    crypto_secretstream_xchacha20poly1305_INONCEBYTES +
+                    crypto_secretstream_xchacha20poly1305_COUNTERBYTES);
 
     randombytes_buf(out, crypto_secretstream_xchacha20poly1305_INITBYTES);
     crypto_core_hchacha20(state->k, out, k, NULL);
-    memcpy(state->nonce, out + crypto_core_hchacha20_INPUTBYTES,
+    memset(state->nonce, 0, crypto_secretstream_xchacha20poly1305_COUNTERBYTES);
+    memcpy(state->nonce + crypto_secretstream_xchacha20poly1305_COUNTERBYTES,
+           out + crypto_core_hchacha20_INPUTBYTES,
            crypto_secretstream_xchacha20poly1305_INONCEBYTES);
-    memset(state->nonce + crypto_secretstream_xchacha20poly1305_INONCEBYTES, 0,
-           crypto_secretstream_xchacha20poly1305_COUNTERBYTES);
     memset(state->_pad, 0, sizeof state->_pad);
 
     return 0;
@@ -54,10 +59,10 @@ crypto_secretstream_xchacha20poly1305_init_pull
     const unsigned char k[crypto_secretstream_xchacha20poly1305_KEYBYTES])
 {
     crypto_core_hchacha20(state->k, in, k, NULL);
-    memcpy(state->nonce, in + crypto_core_hchacha20_INPUTBYTES,
+    memset(state->nonce, 0, crypto_secretstream_xchacha20poly1305_COUNTERBYTES);
+    memcpy(state->nonce + crypto_secretstream_xchacha20poly1305_COUNTERBYTES,
+           in + crypto_core_hchacha20_INPUTBYTES,
            crypto_secretstream_xchacha20poly1305_INONCEBYTES);
-    memset(state->nonce + crypto_secretstream_xchacha20poly1305_INONCEBYTES, 0,
-           crypto_secretstream_xchacha20poly1305_COUNTERBYTES);
     memset(state->_pad, 0, sizeof state->_pad);
 
     return 0;
@@ -96,7 +101,7 @@ crypto_secretstream_xchacha20poly1305_push
     if (outlen_p != NULL) {
         *outlen_p = 0U;
     }
-    if (mlen > crypto_secretstream_xchacha20poly1305_MESSAGESBYTES_MAX) {
+    if (mlen > crypto_secretstream_xchacha20poly1305_MESSAGEBYTES_MAX) {
         sodium_misuse();
     }
     crypto_stream_chacha20_ietf(block, sizeof block, state->nonce, state->k);
@@ -132,10 +137,10 @@ crypto_secretstream_xchacha20poly1305_push
     for (i = 0U; i < crypto_secretstream_xchacha20poly1305_INONCEBYTES; i++) {
         state->nonce[i] ^= mac[i];
     }
-    sodium_increment(&state->nonce[crypto_secretstream_xchacha20poly1305_INONCEBYTES],
+    sodium_increment(&state->nonce[0],
                      crypto_secretstream_xchacha20poly1305_COUNTERBYTES);
     if ((tag & crypto_secretstream_xchacha20poly1305_TAG_REKEY) != 0 ||
-        sodium_is_zero(&state->nonce[crypto_secretstream_xchacha20poly1305_INONCEBYTES],
+        sodium_is_zero(&state->nonce[0],
                        crypto_secretstream_xchacha20poly1305_COUNTERBYTES)) {
         crypto_secretstream_xchacha20poly1305_rekey(state);
     }
@@ -172,7 +177,7 @@ crypto_secretstream_xchacha20poly1305_pull
         return -1;
     }
     mlen = inlen - crypto_secretstream_xchacha20poly1305_ABYTES;
-    if (mlen > crypto_secretstream_xchacha20poly1305_MESSAGESBYTES_MAX) {
+    if (mlen > crypto_secretstream_xchacha20poly1305_MESSAGEBYTES_MAX) {
         sodium_misuse();
     }
     crypto_stream_chacha20_ietf(block, sizeof block, state->nonce, state->k);
@@ -214,10 +219,10 @@ crypto_secretstream_xchacha20poly1305_pull
     for (i = 0U; i < crypto_secretstream_xchacha20poly1305_INONCEBYTES; i++) {
         state->nonce[i] ^= mac[i];
     }
-    sodium_increment(&state->nonce[crypto_secretstream_xchacha20poly1305_INONCEBYTES],
+    sodium_increment(&state->nonce[0],
                      crypto_secretstream_xchacha20poly1305_COUNTERBYTES);
     if ((tag & crypto_secretstream_xchacha20poly1305_TAG_REKEY) != 0 ||
-        sodium_is_zero(&state->nonce[crypto_secretstream_xchacha20poly1305_INONCEBYTES],
+        sodium_is_zero(&state->nonce[0],
                        crypto_secretstream_xchacha20poly1305_COUNTERBYTES)) {
         crypto_secretstream_xchacha20poly1305_rekey(state);
     }
@@ -235,3 +240,53 @@ crypto_secretstream_xchacha20poly1305_statebytes(void)
 {
     return sizeof(crypto_secretstream_xchacha20poly1305_state);
 }
+
+
+size_t
+crypto_secretstream_xchacha20poly1305_abytes(void)
+{
+    return crypto_secretstream_xchacha20poly1305_ABYTES;
+}
+
+size_t
+crypto_secretstream_xchacha20poly1305_initbytes(void)
+{
+    return crypto_secretstream_xchacha20poly1305_INITBYTES;
+}
+
+
+size_t
+crypto_secretstream_xchacha20poly1305_keybytes(void)
+{
+    return crypto_secretstream_xchacha20poly1305_KEYBYTES;
+}
+
+size_t
+crypto_secretstream_xchacha20poly1305_messagebytes_max(void)
+{
+    return crypto_secretstream_xchacha20poly1305_MESSAGEBYTES_MAX;
+}
+
+unsigned char
+crypto_secretstream_xchacha20poly1305_tag_message(void)
+{
+    return crypto_secretstream_xchacha20poly1305_TAG_MESSAGE;
+}
+
+unsigned char
+crypto_secretstream_xchacha20poly1305_tag_push(void)
+{
+    return crypto_secretstream_xchacha20poly1305_TAG_PUSH;
+}
+
+unsigned char
+crypto_secretstream_xchacha20poly1305_tag_rekey(void)
+{
+    return crypto_secretstream_xchacha20poly1305_TAG_REKEY;
+}
+
+unsigned char
+crypto_secretstream_xchacha20poly1305_tag_final(void)
+{
+    return crypto_secretstream_xchacha20poly1305_TAG_FINAL;
+}

src/libsodium/crypto_stream/salsa208/stream_salsa208.c

@@ -14,7 +14,7 @@ crypto_stream_salsa208_noncebytes(void)
 }
 
 size_t
-crypto_stream_salsa208_messagebyte_max(void)
+crypto_stream_salsa208_messagebytes_max(void)
 {
     return crypto_stream_salsa208_MESSAGEBYTES_MAX;
 }

src/libsodium/include/sodium/crypto_secretstream_xchacha20poly1305.h

@@ -16,23 +16,41 @@ extern "C" {
 
 #define crypto_secretstream_xchacha20poly1305_ABYTES \
     (1U + crypto_aead_xchacha20poly1305_ietf_ABYTES)
+SODIUM_EXPORT
+size_t crypto_secretstream_xchacha20poly1305_abytes(void);
 
 #define crypto_secretstream_xchacha20poly1305_INITBYTES \
     crypto_aead_xchacha20poly1305_ietf_NPUBBYTES
+SODIUM_EXPORT
+size_t crypto_secretstream_xchacha20poly1305_initbytes(void);
 
 #define crypto_secretstream_xchacha20poly1305_KEYBYTES \
     crypto_aead_xchacha20poly1305_ietf_KEYBYTES
+SODIUM_EXPORT
+size_t crypto_secretstream_xchacha20poly1305_keybytes(void);
 
-#define crypto_secretstream_xchacha20poly1305_MESSAGESBYTES_MAX \
+#define crypto_secretstream_xchacha20poly1305_MESSAGEBYTES_MAX \
     ((1ULL << 32) - 2ULL * 64ULL)
+SODIUM_EXPORT
+size_t crypto_secretstream_xchacha20poly1305_messagebytes_max(void);
 
 #define crypto_secretstream_xchacha20poly1305_TAG_MESSAGE 0x00
+SODIUM_EXPORT
+unsigned char crypto_secretstream_xchacha20poly1305_tag_message(void);
+
 #define crypto_secretstream_xchacha20poly1305_TAG_PUSH    0x01
+SODIUM_EXPORT
+unsigned char crypto_secretstream_xchacha20poly1305_tag_push(void);
+
 #define crypto_secretstream_xchacha20poly1305_TAG_REKEY   0x02
+SODIUM_EXPORT
+unsigned char crypto_secretstream_xchacha20poly1305_tag_rekey(void);
 
 #define crypto_secretstream_xchacha20poly1305_TAG_FINAL \
     (crypto_secretstream_xchacha20poly1305_TAG_PUSH | \
      crypto_secretstream_xchacha20poly1305_TAG_REKEY)
+SODIUM_EXPORT
+unsigned char crypto_secretstream_xchacha20poly1305_tag_final(void);
 
 typedef struct crypto_secretstream_xchacha20poly1305_state {
     unsigned char k[crypto_stream_chacha20_ietf_KEYBYTES];

src/libsodium/sodium/utils.c

@@ -648,7 +648,9 @@ sodium_pad(size_t *padded_buflen_p, unsigned char *buf,
         return -1;
     }
     tail = &buf[xpadded_len];
-    *padded_buflen_p = xpadded_len + 1U;
+    if (padded_buflen_p != NULL) {
+        *padded_buflen_p = xpadded_len + 1U;
+    }
     mask = 0U;
     for (i = 0; i < blocksize; i++) {
         barrier_mask = (unsigned char) (((i ^ xpadlen) - 1U) >> 8);

test/constcheck.sh

@@ -5,14 +5,15 @@ CT='ct.c'
 echo '#include <assert.h>' > "$CT"
 echo '#include <sodium.h>' >> "$CT"
 echo 'int main(void) {' >> "$CT"
-for macro in $(egrep -r '#define crypto_.*BYTES ' src/libsodium/include | \
+for macro in $(egrep -r '#define crypto_.*BYTES(_[A-Z]+)? ' src/libsodium/include | \
                cut -d: -f2- | cut -d' ' -f2 | \
                fgrep -v edwards25519sha512batch | sort -u); do
   func=$(echo "$macro" | tr A-Z a-z)
-  echo "  assert($func() == $macro);" >> "$CT"
+  echo "    assert($func() == $macro);" >> "$CT"
 done
 echo "return 0; }" >> "$CT"
 
-cc "$CT" -lsodium && ./a.out
+cc "$CT" -lsodium || exit 1
+./a.out || exit 1
 rm -f a.out "$CT"
 

test/default/secretstream.c

@@ -174,7 +174,25 @@ main(void)
     sodium_free(k);
     sodium_free(header);
     sodium_free(state);
-    
+
+    assert(crypto_secretstream_xchacha20poly1305_abytes() ==
+           crypto_secretstream_xchacha20poly1305_ABYTES);
+    assert(crypto_secretstream_xchacha20poly1305_initbytes() ==
+           crypto_secretstream_xchacha20poly1305_INITBYTES);
+    assert(crypto_secretstream_xchacha20poly1305_keybytes() ==
+           crypto_secretstream_xchacha20poly1305_KEYBYTES);
+    assert(crypto_secretstream_xchacha20poly1305_messagebytes_max() ==
+           crypto_secretstream_xchacha20poly1305_MESSAGEBYTES_MAX);
+
+    assert(crypto_secretstream_xchacha20poly1305_tag_message() ==
+           crypto_secretstream_xchacha20poly1305_TAG_MESSAGE);
+    assert(crypto_secretstream_xchacha20poly1305_tag_push() ==
+           crypto_secretstream_xchacha20poly1305_TAG_PUSH);
+    assert(crypto_secretstream_xchacha20poly1305_tag_rekey() ==
+           crypto_secretstream_xchacha20poly1305_TAG_REKEY);
+    assert(crypto_secretstream_xchacha20poly1305_tag_final() ==
+           crypto_secretstream_xchacha20poly1305_TAG_FINAL);
+
     printf("OK\n");
 
     return 0;

test/default/sodium_utils.c

@@ -294,6 +294,8 @@ main(void)
 
         assert(sodium_pad(&bin_padded_len, bin_padded, bin_len,
                           blocksize, bin_padded_maxlen - 1U) == -1);
+        assert(sodium_pad(NULL, bin_padded, bin_len,
+                          blocksize, bin_padded_maxlen + 1U) == 0);
         assert(sodium_pad(&bin_padded_len, bin_padded, bin_len,
                           blocksize, bin_padded_maxlen + 1U) == 0);
         assert(sodium_pad(&bin_padded_len, bin_padded, bin_len,