aws-crt 0.1.9 → 0.2.0

data/aws-crt-ffi/crt/aws-lc/crypto/internal.h

@@ -156,14 +156,17 @@ OPENSSL_MSVC_PRAGMA(warning(pop))
 extern "C" {
 #endif
 
+// On non-MSVC 64-bit targets, we expect __uint128_t support. This includes
+// clang-cl, which defines both __clang__ and _MSC_VER.
 #if (!defined(_MSC_VER) || defined(__clang__)) && defined(OPENSSL_64_BIT)
 #define BORINGSSL_HAS_UINT128
 typedef __int128_t int128_t;
 typedef __uint128_t uint128_t;
 
-// clang-cl supports __uint128_t but modulus and division don't work.
-// https://crbug.com/787617.
-#if !defined(_MSC_VER) || !defined(__clang__)
+// __uint128_t division depends on intrinsics in the compiler runtime. Those
+// intrinsics are missing in clang-cl (https://crbug.com/787617) and nanolibc.
+// These may be bugs in the toolchain definition, but just disable it for now.
+#if !defined(_MSC_VER) && !defined(OPENSSL_NANOLIBC)
 #define BORINGSSL_CAN_DIVIDE_UINT128
 #endif
 #endif
@@ -445,20 +448,44 @@ static inline int constant_time_select_int(crypto_word_t mask, int a, int b) {
 // of memory as secret. Secret data is tracked as it flows to registers and
 // other parts of a memory. If secret data is used as a condition for a branch,
 // or as a memory index, it will trigger warnings in valgrind.
-#define CONSTTIME_SECRET(x, y) VALGRIND_MAKE_MEM_UNDEFINED(x, y)
+#define CONSTTIME_SECRET(ptr, len) VALGRIND_MAKE_MEM_UNDEFINED(ptr, len)
 
 // CONSTTIME_DECLASSIFY takes a pointer and a number of bytes and marks that
 // region of memory as public. Public data is not subject to constant-time
 // rules.
-#define CONSTTIME_DECLASSIFY(x, y) VALGRIND_MAKE_MEM_DEFINED(x, y)
+#define CONSTTIME_DECLASSIFY(ptr, len) VALGRIND_MAKE_MEM_DEFINED(ptr, len)
 
 #else
 
-#define CONSTTIME_SECRET(x, y)
-#define CONSTTIME_DECLASSIFY(x, y)
+#define CONSTTIME_SECRET(ptr, len)
+#define CONSTTIME_DECLASSIFY(ptr, len)
 
 #endif  // BORINGSSL_CONSTANT_TIME_VALIDATION
 
+static inline crypto_word_t constant_time_declassify_w(crypto_word_t v) {
+  // Return |v| through a value barrier to be safe. Valgrind-based constant-time
+  // validation is partly to check the compiler has not undone any constant-time
+  // work. Any place |BORINGSSL_CONSTANT_TIME_VALIDATION| influences
+  // optimizations, this validation is inaccurate.
+  //
+  // However, by sending pointers through valgrind, we likely inhibit escape
+  // analysis. On local variables, particularly booleans, we likely
+  // significantly impact optimizations.
+  //
+  // Thus, to be safe, stick a value barrier, in hopes of comparably inhibiting
+  // compiler analysis.
+  CONSTTIME_DECLASSIFY(&v, sizeof(v));
+  return value_barrier_w(v);
+}
+
+static inline int constant_time_declassify_int(int v) {
+  OPENSSL_STATIC_ASSERT(sizeof(uint32_t) == sizeof(int),
+                int_is_not_the_same_size_as_uint32_t);
+  // See comment above.
+  CONSTTIME_DECLASSIFY(&v, sizeof(v));
+  return value_barrier_u32(v);
+}
+
 
 // Thread-safe initialisation.
 
@@ -734,6 +761,15 @@ static inline uint32_t CRYPTO_bswap4(uint32_t x) {
 static inline uint64_t CRYPTO_bswap8(uint64_t x) {
   return __builtin_bswap64(x);
 }
+static inline crypto_word_t CRYPTO_bswap_word(crypto_word_t x) {
+#if defined(OPENSSL_64_BIT)
+  return CRYPTO_bswap8(x);
+#else
+  return CRYPTO_bswap4(x);
+#endif
+}
+
+
 #elif defined(_MSC_VER)
 OPENSSL_MSVC_PRAGMA(warning(push, 3))
 #include <stdlib.h>
@@ -855,58 +891,104 @@ static inline void *OPENSSL_memset(void *dst, int c, size_t n) {
 static inline uint32_t CRYPTO_load_u32_le(const void *in) {
   uint32_t v;
   OPENSSL_memcpy(&v, in, sizeof(v));
+#if defined(OPENSSL_BIG_ENDIAN)
+  return CRYPTO_bswap4(v);
+#else
   return v;
+#endif
 }
 
 static inline void CRYPTO_store_u32_le(void *out, uint32_t v) {
+#if defined(OPENSSL_BIG_ENDIAN)
+  v = CRYPTO_bswap4(v);
+#endif
   OPENSSL_memcpy(out, &v, sizeof(v));
+
 }
 
 static inline uint32_t CRYPTO_load_u32_be(const void *in) {
   uint32_t v;
   OPENSSL_memcpy(&v, in, sizeof(v));
+#if defined(OPENSSL_BIG_ENDIAN)
+  return v;
+#else
   return CRYPTO_bswap4(v);
+#endif
 }
 
 static inline void CRYPTO_store_u32_be(void *out, uint32_t v) {
+
+#if !defined(OPENSSL_BIG_ENDIAN)
   v = CRYPTO_bswap4(v);
+#endif
   OPENSSL_memcpy(out, &v, sizeof(v));
+
 }
 
 static inline uint64_t CRYPTO_load_u64_le(const void *in) {
   uint64_t v;
   OPENSSL_memcpy(&v, in, sizeof(v));
+#if defined(OPENSSL_BIG_ENDIAN)
+  return CRYPTO_bswap8(v);
+#else
   return v;
+#endif
 }
 
 static inline void CRYPTO_store_u64_le(void *out, uint64_t v) {
+#if defined(OPENSSL_BIG_ENDIAN)
+  v = CRYPTO_bswap8(v);
+#endif
   OPENSSL_memcpy(out, &v, sizeof(v));
+
 }
 
 static inline uint64_t CRYPTO_load_u64_be(const void *ptr) {
   uint64_t ret;
   OPENSSL_memcpy(&ret, ptr, sizeof(ret));
+#if defined(OPENSSL_BIG_ENDIAN)
+  return ret;
+#else
   return CRYPTO_bswap8(ret);
+#endif
 }
 
 static inline void CRYPTO_store_u64_be(void *out, uint64_t v) {
+#if defined(OPENSSL_BIG_ENDIAN)
+#else
   v = CRYPTO_bswap8(v);
+#endif
   OPENSSL_memcpy(out, &v, sizeof(v));
+
 }
 
 static inline crypto_word_t CRYPTO_load_word_le(const void *in) {
+
   crypto_word_t v;
   OPENSSL_memcpy(&v, in, sizeof(v));
+#if defined(OPENSSL_BIG_ENDIAN)
+  return CRYPTO_bswap_word(v);
+#else
   return v;
+#endif
 }
 
 static inline void CRYPTO_store_word_le(void *out, crypto_word_t v) {
+
+
+#if defined(OPENSSL_BIG_ENDIAN)
+  v = CRYPTO_bswap_word(v);
+#endif
   OPENSSL_memcpy(out, &v, sizeof(v));
+
 }
 
 static inline crypto_word_t CRYPTO_load_word_be(const void *in) {
   crypto_word_t v;
   OPENSSL_memcpy(&v, in, sizeof(v));
+#if defined(OPENSSL_BIG_ENDIAN)
+  return v;
+#else
 #if defined(OPENSSL_64_BIT)
   assert(sizeof(v) == 8);
   return CRYPTO_bswap8(v);
@@ -914,9 +996,9 @@ static inline crypto_word_t CRYPTO_load_word_be(const void *in) {
   assert(sizeof(v) == 4);
   return CRYPTO_bswap4(v);
 #endif
+#endif
 }
 
-
 // Bit rotation functions.
 //
 // Note these functions use |(-shift) & 31|, etc., because shifting by the bit

data/aws-crt-ffi/crt/aws-lc/crypto/kem/kem.c

@@ -9,6 +9,7 @@
 #include "../fipsmodule/delocate.h"
 #include "../internal.h"
 #include "internal.h"
+#include "../kyber/kem_kyber.h"
 
 // The KEM parameters listed below are taken from corresponding specifications.
 //
@@ -25,39 +26,39 @@ static const uint8_t kOIDKyber1024r3[] = {0xff, 0xff, 0xff, 0xff};
 
 static const KEM built_in_kems[AWSLC_NUM_BUILT_IN_KEMS] = {
   {
-    NID_KYBER512_R3,         // kem.nid
-    kOIDKyber512r3,          // kem.oid
-    sizeof(kOIDKyber512r3),  // kem.oid_len
-    "Kyber512 Round-3",      // kem.comment
-    800,                     // kem.public_key_len
-    1632,                    // kem.secret_key_len
-    768,                     // kem.ciphertext_len
-    32,                      // kem.shared_secret_len
-    &kem_kyber512r3_method,  // kem.method
+    NID_KYBER512_R3,                // kem.nid
+    kOIDKyber512r3,                 // kem.oid
+    sizeof(kOIDKyber512r3),         // kem.oid_len
+    "Kyber512 Round-3",             // kem.comment
+    KYBER512_R3_PUBLIC_KEY_BYTES,   // kem.public_key_len
+    KYBER512_R3_SECRET_KEY_BYTES,   // kem.secret_key_len
+    KYBER512_R3_CIPHERTEXT_BYTES,   // kem.ciphertext_len
+    KYBER_R3_SHARED_SECRET_LEN,     // kem.shared_secret_len
+    &kem_kyber512r3_method,         // kem.method
   },
 
   {
-    NID_KYBER768_R3,         // kem.nid
-    kOIDKyber768r3,          // kem.oid
-    sizeof(kOIDKyber768r3),  // kem.oid_len
-    "Kyber768 Round-3",      // kem.comment
-    1184,                    // kem.public_key_len
-    2400,                    // kem.secret_key_len
-    1088,                    // kem.ciphertext_len
-    32,                      // kem.shared_secret_len
-    &kem_kyber768r3_method,  // kem.method
+    NID_KYBER768_R3,                // kem.nid
+    kOIDKyber768r3,                 // kem.oid
+    sizeof(kOIDKyber768r3),         // kem.oid_len
+    "Kyber768 Round-3",             // kem.comment
+    KYBER768_R3_PUBLIC_KEY_BYTES,   // kem.public_key_len
+    KYBER768_R3_SECRET_KEY_BYTES,   // kem.secret_key_len
+    KYBER768_R3_CIPHERTEXT_BYTES,   // kem.ciphertext_len
+    KYBER_R3_SHARED_SECRET_LEN,     // kem.shared_secret_len
+    &kem_kyber768r3_method,         // kem.method
   },
 
   {
-    NID_KYBER1024_R3,         // kem.nid
-    kOIDKyber1024r3,          // kem.oid
-    sizeof(kOIDKyber1024r3),  // kem.oid_len
-    "Kyber1024 Round-3",      // kem.comment
-    1568,                     // kem.public_key_len
-    3168,                     // kem.secret_key_len
-    1568,                     // kem.ciphertext_len
-    32,                       // kem.shared_secret_len
-    &kem_kyber1024r3_method,  // kem.method
+    NID_KYBER1024_R3,               // kem.nid
+    kOIDKyber1024r3,                // kem.oid
+    sizeof(kOIDKyber1024r3),        // kem.oid_len
+    "Kyber1024 Round-3",            // kem.comment
+    KYBER1024_R3_PUBLIC_KEY_BYTES,  // kem.public_key_len
+    KYBER1024_R3_SECRET_KEY_BYTES,  // kem.secret_key_len
+    KYBER1024_R3_CIPHERTEXT_BYTES,  // kem.ciphertext_len
+    KYBER_R3_SHARED_SECRET_LEN,     // kem.shared_secret_len
+    &kem_kyber1024r3_method,        // kem.method
   },
 };
 

data/aws-crt-ffi/crt/aws-lc/crypto/kyber/kem_kyber.h

@@ -9,6 +9,20 @@
 #include <openssl/base.h>
 #include <openssl/evp.h>
 
+#define KYBER_R3_SHARED_SECRET_LEN 32
+
+#define KYBER512_R3_PUBLIC_KEY_BYTES  800
+#define KYBER512_R3_SECRET_KEY_BYTES 1632
+#define KYBER512_R3_CIPHERTEXT_BYTES 768
+
+#define KYBER768_R3_PUBLIC_KEY_BYTES  1184
+#define KYBER768_R3_SECRET_KEY_BYTES 2400
+#define KYBER768_R3_CIPHERTEXT_BYTES 1088
+
+#define KYBER1024_R3_PUBLIC_KEY_BYTES  1568
+#define KYBER1024_R3_SECRET_KEY_BYTES 3168
+#define KYBER1024_R3_CIPHERTEXT_BYTES 1568
+
 int kyber512r3_keypair(uint8_t *public_key /* OUT */,
                      uint8_t *secret_key /* OUT */);
 

data/aws-crt-ffi/crt/aws-lc/crypto/obj/obj_dat.h

@@ -56,7 +56,7 @@
 
 /* This file is generated by crypto/obj/objects.go. */
 
-#define NUM_NID 978
+#define NUM_NID 983
 
 static const uint8_t kObjectData[] = {
     /* NID_rsadsi */
@@ -7188,6 +7188,36 @@ static const uint8_t kObjectData[] = {
     0x07,
     0x06,
     0x05,
+    /* NID_sha512_224 */
+    0x60,
+    0x86,
+    0x48,
+    0x01,
+    0x65,
+    0x03,
+    0x04,
+    0x02,
+    0x05,
+    /* NID_shake128 */
+    0x60,
+    0x86,
+    0x48,
+    0x01,
+    0x65,
+    0x03,
+    0x04,
+    0x02,
+    0x0b,
+    /* NID_shake256 */
+    0x60,
+    0x86,
+    0x48,
+    0x01,
+    0x65,
+    0x03,
+    0x04,
+    0x02,
+    0x0c,
 };
 
 static const ASN1_OBJECT kObjects[NUM_NID] = {
@@ -8850,6 +8880,13 @@ static const ASN1_OBJECT kObjects[NUM_NID] = {
      &kObjectData[6232], 0},
     {"ffdhe2048", "ffdhe2048", NID_ffdhe2048, 0, NULL, 0},
     {"ffdhe4096", "ffdhe4096", NID_ffdhe4096, 0, NULL, 0},
+    {"SHA512-224", "sha512-224", NID_sha512_224, 9, &kObjectData[6243], 0},
+    {"SHAKE128", "shake128", NID_shake128, 9, &kObjectData[6252], 0},
+    {"SHAKE256", "shake256", NID_shake256, 9, &kObjectData[6261], 0},
+    {"SecP256r1Kyber768Draft00", "SecP256r1Kyber768Draft00",
+     NID_SecP256r1Kyber768Draft00, 0, NULL, 0},
+    {"X25519Kyber768Draft00", "X25519Kyber768Draft00",
+     NID_X25519Kyber768Draft00, 0, NULL, 0},
 };
 
 static const uint16_t kNIDsInShortNameOrder[] = {
@@ -9051,15 +9088,20 @@ static const uint16_t kNIDsInShortNameOrder[] = {
     968 /* SHA3-512 */,
     673 /* SHA384 */,
     674 /* SHA512 */,
+    978 /* SHA512-224 */,
     962 /* SHA512-256 */,
+    979 /* SHAKE128 */,
+    980 /* SHAKE256 */,
     188 /* SMIME */,
     167 /* SMIME-CAPS */,
     100 /* SN */,
     16 /* ST */,
     143 /* SXNetID */,
+    981 /* SecP256r1Kyber768Draft00 */,
     458 /* UID */,
     0 /* UNDEF */,
     948 /* X25519 */,
+    982 /* X25519Kyber768Draft00 */,
     961 /* X448 */,
     11 /* X500 */,
     378 /* X500algorithms */,
@@ -9927,6 +9969,7 @@ static const uint16_t kNIDsInLongNameOrder[] = {
     188 /* S/MIME */,
     167 /* S/MIME Capabilities */,
     387 /* SNMPv2 */,
+    981 /* SecP256r1Kyber768Draft00 */,
     512 /* Secure Electronic Transactions */,
     386 /* Security */,
     394 /* Selected Attribute Types */,
@@ -9937,6 +9980,7 @@ static const uint16_t kNIDsInLongNameOrder[] = {
     133 /* Time Stamping */,
     375 /* Trust Root */,
     948 /* X25519 */,
+    982 /* X25519Kyber768Draft00 */,
     961 /* X448 */,
     12 /* X509 */,
     402 /* X509v3 AC Targeting */,
@@ -10741,9 +10785,12 @@ static const uint16_t kNIDsInLongNameOrder[] = {
     673 /* sha384 */,
     669 /* sha384WithRSAEncryption */,
     674 /* sha512 */,
+    978 /* sha512-224 */,
     962 /* sha512-256 */,
     670 /* sha512WithRSAEncryption */,
     42 /* shaWithRSAEncryption */,
+    979 /* shake128 */,
+    980 /* shake256 */,
     52 /* signingTime */,
     454 /* simpleSecurityObject */,
     496 /* singleLevelQuality */,
@@ -10795,8 +10842,8 @@ static const uint16_t kNIDsInLongNameOrder[] = {
 static const uint16_t kNIDsInOIDOrder[] = {
     434 /* 0.9 (OBJ_data) */,
     182 /* 1.2 (OBJ_member_body) */,
-    379 /* 1.3 (OBJ_org) */,
     676 /* 1.3 (OBJ_identified_organization) */,
+    379 /* 1.3 (OBJ_org) */,
     11 /* 2.5 (OBJ_X500) */,
     647 /* 2.23 (OBJ_international_organizations) */,
     380 /* 1.3.6 (OBJ_dod) */,
@@ -11501,11 +11548,14 @@ static const uint16_t kNIDsInOIDOrder[] = {
     673 /* 2.16.840.1.101.3.4.2.2 (OBJ_sha384) */,
     674 /* 2.16.840.1.101.3.4.2.3 (OBJ_sha512) */,
     675 /* 2.16.840.1.101.3.4.2.4 (OBJ_sha224) */,
+    978 /* 2.16.840.1.101.3.4.2.5 (OBJ_sha512_224) */,
     962 /* 2.16.840.1.101.3.4.2.6 (OBJ_sha512_256) */,
     965 /* 2.16.840.1.101.3.4.2.7 (OBJ_sha3_224) */,
     966 /* 2.16.840.1.101.3.4.2.8 (OBJ_sha3_256) */,
     967 /* 2.16.840.1.101.3.4.2.9 (OBJ_sha3_384) */,
     968 /* 2.16.840.1.101.3.4.2.10 (OBJ_sha3_512) */,
+    979 /* 2.16.840.1.101.3.4.2.11 (OBJ_shake128) */,
+    980 /* 2.16.840.1.101.3.4.2.12 (OBJ_shake256) */,
     802 /* 2.16.840.1.101.3.4.3.1 (OBJ_dsa_with_SHA224) */,
     803 /* 2.16.840.1.101.3.4.3.2 (OBJ_dsa_with_SHA256) */,
     71 /* 2.16.840.1.113730.1.1 (OBJ_netscape_cert_type) */,

data/aws-crt-ffi/crt/aws-lc/crypto/obj/obj_mac.num

@@ -965,3 +965,8 @@ KYBER1024_R3		974
 DILITHIUM3_R3		975
 ffdhe2048		976
 ffdhe4096		977
+sha512_224		978
+shake128		979
+shake256		980
+SecP256r1Kyber768Draft00		981
+X25519Kyber768Draft00		982

data/aws-crt-ffi/crt/aws-lc/crypto/obj/objects.txt

@@ -131,6 +131,10 @@ secg-ellipticCurve 39		: sect571r1
  : ffdhe2048
  : ffdhe4096
 
+# PQ Groups
+ : SecP256r1Kyber768Draft00
+ : X25519Kyber768Draft00
+
 # WAP/TLS curve OIDs (http://www.wapforum.org/)
 !Alias wap-wsg-idm-ecid wap-wsg 4
 wap-wsg-idm-ecid 1	: wap-wsg-idm-ecid-wtls1
@@ -909,6 +913,7 @@ nist_hashalgs 1		: SHA256		: sha256
 nist_hashalgs 2		: SHA384		: sha384
 nist_hashalgs 3		: SHA512		: sha512
 nist_hashalgs 4		: SHA224		: sha224
+nist_hashalgs 5		: SHA512-224		: sha512-224
 nist_hashalgs 6		: SHA512-256		: sha512-256
 
 # OIDs for dsa-with-sha224 and dsa-with-sha256
@@ -1368,6 +1373,8 @@ nist_sha3hashalgs 7		: SHA3-224		: sha3-224
 nist_sha3hashalgs 8		: SHA3-256		: sha3-256
 nist_sha3hashalgs 9		: SHA3-384		: sha3-384
 nist_sha3hashalgs 10		: SHA3-512		: sha3-512
+nist_sha3hashalgs 11		: SHAKE128		: shake128
+nist_sha3hashalgs 12		: SHAKE256		: shake256
 
  : HKDF : hkdf
 

data/aws-crt-ffi/crt/aws-lc/crypto/perlasm/arm-xlate.pl

@@ -153,9 +153,9 @@ sub expand_line {
 
 my ($arch_defines, $target_defines);
 if ($flavour =~ /32/) {
-    $arch_defines = "defined(__ARMEL__)";
+    $arch_defines = "defined(OPENSSL_ARM)";
 } elsif ($flavour =~ /64/) {
-    $arch_defines = "defined(__AARCH64EL__)";
+    $arch_defines = "defined(OPENSSL_AARCH64)";
 } else {
     die "unknown architecture: $flavour";
 }
@@ -177,18 +177,11 @@ print <<___;
 // This file is generated from a similarly-named Perl script in the BoringSSL
 // source tree. Do not edit by hand.
 
-#if !defined(__has_feature)
-#define __has_feature(x) 0
-#endif
-#if __has_feature(memory_sanitizer) && !defined(OPENSSL_NO_ASM)
-#define OPENSSL_NO_ASM
-#endif
+#include <openssl/asm_base.h>
 
 #if !defined(OPENSSL_NO_ASM) && $arch_defines && $target_defines
 ___
 
-print "#include <openssl/boringssl_prefix_symbols_asm.h>\n";
-
 while(my $line=<>) {
 
     if ($line =~ m/^\s*(#|@|\/\/)/)	{ print $line; next; }
@@ -258,10 +251,6 @@ while(my $line=<>) {
 
 print <<___;
 #endif  // !OPENSSL_NO_ASM && $arch_defines && $target_defines
-#if defined(__ELF__)
-// See https://www.airs.com/blog/archives/518.
-.section .note.GNU-stack,"",\%progbits
-#endif
 ___
 
 close STDOUT or die "error closing STDOUT: $!";

data/aws-crt-ffi/crt/aws-lc/crypto/perlasm/ppc-xlate.pl

@@ -259,11 +259,7 @@ print <<___;
 // This file is generated from a similarly-named Perl script in the BoringSSL
 // source tree. Do not edit by hand.
 
-#if defined(__has_feature)
-#if __has_feature(memory_sanitizer) && !defined(OPENSSL_NO_ASM)
-#define OPENSSL_NO_ASM
-#endif
-#endif
+#include <openssl/asm_base.h>
 
 #if !defined(OPENSSL_NO_ASM) && defined(__powerpc64__) && defined(__ELF__)
 #include <openssl/boringssl_prefix_symbols_asm.h>

data/aws-crt-ffi/crt/aws-lc/crypto/perlasm/x86_64-xlate.pl

@@ -1520,14 +1520,9 @@ if ($gas) {
         die "unknown target: $flavour";
     }
     print <<___;
-#if defined(__has_feature)
-#if __has_feature(memory_sanitizer) && !defined(OPENSSL_NO_ASM)
-#define OPENSSL_NO_ASM
-#endif
-#endif
-
-#if defined(__x86_64__) && !defined(OPENSSL_NO_ASM) && $target
-#include <openssl/boringssl_prefix_symbols_asm.h>
+#include <openssl/asm_base.h>
+
+#if !defined(OPENSSL_NO_ASM) && defined(OPENSSL_X86_64) && $target
 ___
 }
 
@@ -1623,13 +1618,7 @@ print "\n$current_segment\tENDS\n"	if ($current_segment && $masm);
 if ($masm) {
     print "END\n";
 } elsif ($gas) {
-    print <<___;
-#endif
-#if defined(__ELF__)
-// See https://www.airs.com/blog/archives/518.
-.section .note.GNU-stack,"",\%progbits
-#endif
-___
+    print "#endif\n";
 } elsif ($nasm) {
     print <<___;
 \%else

data/aws-crt-ffi/crt/aws-lc/crypto/perlasm/x86asm.pl

@@ -305,22 +305,13 @@ ___
         }
 
         print <<___;
-#if defined(__has_feature)
-#if __has_feature(memory_sanitizer) && !defined(OPENSSL_NO_ASM)
-#define OPENSSL_NO_ASM
-#endif
-#endif
-
-#if !defined(OPENSSL_NO_ASM) && defined(__i386__) && $target
-#include <openssl/boringssl_prefix_symbols_asm.h>
+#include <openssl/asm_base.h>
+
+#if !defined(OPENSSL_NO_ASM) && defined(OPENSSL_X86) && $target
 ___
         print @out;
         print <<___;
-#endif  // !defined(OPENSSL_NO_ASM) && defined(__i386__) && $target
-#if defined(__ELF__)
-// See https://www.airs.com/blog/archives/518.
-.section .note.GNU-stack,"",\%progbits
-#endif
+#endif  // !defined(OPENSSL_NO_ASM) && defined(OPENSSL_X86) && $target
 ___
     }
 }

data/aws-crt-ffi/crt/aws-lc/crypto/poly1305/poly1305_arm_asm.S

@@ -1,12 +1,6 @@
-#if defined(__has_feature)
-#if __has_feature(memory_sanitizer) && !defined(OPENSSL_NO_ASM)
-#define OPENSSL_NO_ASM
-#endif
-#endif
+#include <openssl/asm_base.h>
 
-#if defined(__ARMEL__) && !defined(OPENSSL_NO_ASM) && defined(__ELF__)
-
-#include <openssl/boringssl_prefix_symbols_asm.h>
+#if !defined(OPENSSL_NO_ASM) && defined(OPENSSL_ARM) && defined(__ELF__)
 
 # This implementation was taken from the public domain, neon2 version in
 # SUPERCOP by D. J. Bernstein and Peter Schwabe.
@@ -2020,8 +2014,4 @@ vst1.8 d4,[r0,: 64]
 add sp,sp,#0
 bx lr
 
-#endif  /* __ARMEL__ && !OPENSSL_NO_ASM && __ELF__ */
-
-#if defined(__ELF__)
-.section	.note.GNU-stack,"",%progbits
-#endif
+#endif  /* !OPENSSL_NO_ASM && OPENSSL_ARM && __ELF__ */

data/aws-crt-ffi/crt/aws-lc/crypto/rand_extra/deterministic.c

@@ -14,14 +14,15 @@
 
 #include <openssl/rand.h>
 
-#if defined(BORINGSSL_UNSAFE_DETERMINISTIC_MODE)
+#include "../fipsmodule/rand/internal.h"
+
+#if defined(OPENSSL_RAND_DETERMINISTIC)
 
 #include <string.h>
 
 #include <openssl/chacha.h>
 
 #include "../internal.h"
-#include "../fipsmodule/rand/internal.h"
 
 
 // g_num_calls is the number of calls to |CRYPTO_sysrand| that have occurred.
@@ -53,4 +54,4 @@ void CRYPTO_sysrand_for_seed(uint8_t *out, size_t requested) {
   CRYPTO_sysrand(out, requested);
 }
 
-#endif  // BORINGSSL_UNSAFE_DETERMINISTIC_MODE
+#endif  // OPENSSL_RAND_DETERMINISTIC

data/aws-crt-ffi/crt/aws-lc/crypto/rand_extra/fuchsia.c

@@ -14,15 +14,15 @@
 
 #include <openssl/rand.h>
 
-#if defined(OPENSSL_FUCHSIA) && !defined(BORINGSSL_UNSAFE_DETERMINISTIC_MODE)
+#include "../fipsmodule/rand/internal.h"
+
+#if defined(OPENSSL_RAND_FUCHSIA)
 
 #include <limits.h>
 #include <stdlib.h>
 
 #include <zircon/syscalls.h>
 
-#include "../fipsmodule/rand/internal.h"
-
 void CRYPTO_sysrand(uint8_t *out, size_t requested) {
   zx_cprng_draw(out, requested);
 }
@@ -31,4 +31,4 @@ void CRYPTO_sysrand_for_seed(uint8_t *out, size_t requested) {
   CRYPTO_sysrand(out, requested);
 }
 
-#endif  // OPENSSL_FUCHSIA && !BORINGSSL_UNSAFE_DETERMINISTIC_MODE
+#endif  // OPENSSL_RAND_FUCHSIA