sys/crypto/sodium: Add a self-test for IETF ChaCha20/Poly1305 AEAD.

PR kern/58468

branches: 1.6.4; 1.6.10;
rename glue.c to sodium_module.c

Tidy up libsodium makefile and config fragments.

Disable libsodium HAVE_TI_MODE for now.

This may reduce performance by not taking advantage of 64x64->128
multiplications on some platforms, but let's worry about that later
and fix the build on the other platforms instead.

Split flags onto separate lines, sorted, to make diffs easier.

Disable -Wshadow for libsodium.

Evidently ed25519_ref10.c has a global and a local both named `d'.

[ozaki-r] libsodium glue

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

Support aarch64eb in */config.guess.

Cherry-picked from upstream:
https://git.savannah.gnu.org/gitweb/?p=config.git;a=commit;h=1c4398015583eb77bc043234f5734be055e64bea

Everything except external/apache2/llvm/dist/llvm/cmake/config.guess
is patched, which is under vendor tag and cannot be modified. I expect
that this file is not actually used as we use hand-crafted version of
configure script instead of cmake for building LLVM.

Note that external/apache2/llvm/autoconf/autoconf/config.guess has
already been committed on Oct. 20, but commit message disappeared as
cvs aborted due to "permission denied" when trying to modify the file
mentioned above. Sorry for confusing you.

Also note that GMP uses its own config.guess Patch for
external/lgpl3/gmp/dist/config.guess is provided by ryo@. Thanks!

branches: 1.1.1;
Initial revision

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

Support aarch64eb in */config.guess.

Cherry-picked from upstream:
https://git.savannah.gnu.org/gitweb/?p=config.git;a=commit;h=1c4398015583eb77bc043234f5734be055e64bea

Everything except external/apache2/llvm/dist/llvm/cmake/config.guess
is patched, which is under vendor tag and cannot be modified. I expect
that this file is not actually used as we use hand-crafted version of
configure script instead of cmake for building LLVM.

Note that external/apache2/llvm/autoconf/autoconf/config.guess has
already been committed on Oct. 20, but commit message disappeared as
cvs aborted due to "permission denied" when trying to modify the file
mentioned above. Sorry for confusing you.

Also note that GMP uses its own config.guess Patch for
external/lgpl3/gmp/dist/config.guess is provided by ryo@. Thanks!

branches: 1.1.1;
Initial revision

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

Split ge25519_scalarmult up in order to reduce stack usage.

Reuse temporaries in ge25519_scalarmult to reduce stack usage.

branches: 1.1.1;
Initial revision

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

libsodium 1.0.16

sys/crypto/sodium: Nix unused assert.h stub.

Maybe this was a vestige of an earlier draft of the libsodium import,
but it doesn't appear to be needed now by any libsodium files we use.

PR kern/58468

branches: 1.1.20; 1.1.26;
[ozaki-r] libsodium glue

sys/crypto/sodium: Nix risky defines from core.h stub.

These are risky not because they might cause crypto flaws, but
because they might cause usage of the SIMD unit in the kernel along
paths where we haven't made it safe.

That said -- no change to the amd64 module .o and .kmod files, so
this doesn't currently make a difference; it's just risky to have
around in case we later include other parts of libsodium that it does
affect, like the Salsa20 code.

PR kern/58468

branches: 1.1.20; 1.1.26;
[ozaki-r] libsodium glue

sys/crypto/sodium: Fill out crypto_verify_16 stub.

Without this change, libsodium silently accepts forgeries.

This one's a doozy, and it's a sobering reminder that:

(a) wg(4) is still experimental (only user of libsodium in kernel;
both are available only through default-off optional modules).

(b) Known-answer test vectors are critical, including negative tests
(test that forgeries are rejected), and must be mandatory for all
new crypto code -- and should be added to old crypto code too.

(c) Crypto code must also have self-tests that run in the same
environment, not just the same code in a different build or test
environment -- the libsodium code itself is fine, but we built it
differently and need to exercise it differently from upstream's
automatic tests.

It's my fault for not catching this earlier. What happened is:

1. ozaki-r@ adapted libsodium to build in the kernel with various
glue to build code meant for standard userland C, like errno.h and
string.h.

2. Since libsodium's crypto_verify_16.c uses various SIMD intrinsics
on various architectures, it couldn't be used directly in the
kernel build, because -- at the time -- we hadn't wired up any
header files for SIMD intrinsics or any runtime support for saving
and restoring SIMD state appropriately in the kernel.

3. ozaki-r@ put a similar glue header file crypto_verify_16.h to
override libsodium's, with a stub to be implemented later, and
presumably forgot to remind me about it.

4. I missed the stub in crypto_verify_16.h when reviewing the
libsodium import and wg(4) code because it was in the same
directory as various other simple glue code that I deemed
low-risk.

(I did make one change to that glue code, to replace cprng_fast by
cprng_strong, but I suspect I found that by searching for
cprng_fast users rather than by reviewing this code.)

5. I broke my own rule about always having known-answer test vectors
for crypto code because I figured libsodium was well-enough
exercised that we could skimp on it for now, and my focus was more
on the state machine and synchronization logic than on the crypto.

6. I had not yet written known-answer test vectors for the
higher-level wg(4) protocol messages.

Before we can remove the `experimental' tag from wg(4) we will need
to (among other things):

i. Write self-tests for the rest of (what we use from) libsodium.
ii. Write extensive known-answer test vectors for all the wg(4)
protocol messages (and ideally state machine transitions).
iii. Write self-tests for a reasonable subset of the wg(4) KATs.
iv. Review all of the libsodium glue code I neglected to review.

PR kern/58468

branches: 1.1.20; 1.1.26;
[ozaki-r] libsodium glue

sys/crypto/sodium: Nix unused errno.h.

Maybe this was a vestige of an earlier draft of the libsodium import,
but it doesn't appear to be needed now by any libsodium files we use.

PR kern/58468

branches: 1.1.20; 1.1.26;
[ozaki-r] libsodium glue

[ozaki-r] libsodium glue

Use cprng_strong, not cprng_fast, for ephemeral key.

[ozaki-r] libsodium glue

[ozaki-r] libsodium glue

sys/crypto/sodium: Simplify stdint.h stub.

No change to the .o or .kmod files; just the .d make dependency files
change.

PR kern/58468