aws-crt 0.1.9 → 0.2.0

data/aws-crt-ffi/crt/aws-lc/crypto/asn1/a_time.c

@@ -60,6 +60,7 @@
 #include <time.h>
 
 #include <openssl/asn1t.h>
+#include <openssl/bytestring.h>
 #include <openssl/err.h>
 #include <openssl/mem.h>
 
@@ -81,6 +82,10 @@ ASN1_TIME *ASN1_TIME_set(ASN1_TIME *s, time_t time) {
   return ASN1_TIME_adj(s, time, 0, 0);
 }
 
+static int fits_in_utc_time(const struct tm *tm) {
+  return 50 <= tm->tm_year && tm->tm_year < 150;
+}
+
 ASN1_TIME *ASN1_TIME_adj(ASN1_TIME *s, int64_t posix_time, int offset_day,
                          long offset_sec) {
   struct tm tm;
@@ -94,7 +99,7 @@ ASN1_TIME *ASN1_TIME_adj(ASN1_TIME *s, int64_t posix_time, int offset_day,
       return NULL;
     }
   }
-  if ((tm.tm_year >= 50) && (tm.tm_year < 150)) {
+  if (fits_in_utc_time(&tm)) {
     return ASN1_UTCTIME_adj(s, posix_time, offset_day, offset_sec);
   }
   return ASN1_GENERALIZEDTIME_adj(s, posix_time, offset_day, offset_sec);
@@ -170,6 +175,34 @@ int ASN1_TIME_set_string(ASN1_TIME *s, const char *str) {
          ASN1_GENERALIZEDTIME_set_string(s, str);
 }
 
+int ASN1_TIME_set_string_X509(ASN1_TIME *s, const char *str) {
+  CBS cbs;
+  CBS_init(&cbs, (const uint8_t*)str, strlen(str));
+  int type;
+  struct tm tm;
+  if (CBS_parse_utc_time(&cbs, /*out_tm=*/NULL,
+                         /*allow_timezone_offset=*/0)) {
+    type = V_ASN1_UTCTIME;
+  } else if (CBS_parse_generalized_time(&cbs, &tm,
+                                        /*allow_timezone_offset=*/0)) {
+    type = V_ASN1_GENERALIZEDTIME;
+    if (fits_in_utc_time(&tm)) {
+      type = V_ASN1_UTCTIME;
+      CBS_skip(&cbs, 2);
+    }
+  } else {
+    return 0;
+  }
+
+  if (s != NULL) {
+    if (!ASN1_STRING_set(s, CBS_data(&cbs), CBS_len(&cbs))) {
+      return 0;
+    }
+    s->type = type;
+  }
+  return 1;
+}
+
 static int asn1_time_to_tm(struct tm *tm, const ASN1_TIME *t,
                            int allow_timezone_offset) {
   if (t == NULL) {

data/aws-crt-ffi/crt/aws-lc/crypto/asn1/a_utctm.c

@@ -82,11 +82,14 @@ int ASN1_UTCTIME_check(const ASN1_UTCTIME *d) {
 }
 
 int ASN1_UTCTIME_set_string(ASN1_UTCTIME *s, const char *str) {
+  // Although elsewhere we allow timezone offsets with UTCTime, to be compatible
+  // with some existing misissued certificates, this function is used to
+  // construct new certificates and can be stricter.
   size_t len = strlen(str);
   CBS cbs;
   CBS_init(&cbs, (const uint8_t *)str, len);
   if (!CBS_parse_utc_time(&cbs, /*out_tm=*/NULL,
-                          /*allow_timezone_offset=*/1)) {
+                          /*allow_timezone_offset=*/0)) {
     return 0;
   }
   if (s != NULL) {

data/aws-crt-ffi/crt/aws-lc/crypto/asn1/asn1_test.cc

@@ -1131,6 +1131,32 @@ TEST(ASN1Test, TimeSetString) {
   EXPECT_EQ(V_ASN1_GENERALIZEDTIME, ASN1_STRING_type(s.get()));
   EXPECT_EQ("19700101000000Z", ASN1StringToStdString(s.get()));
 
+  // |ASN1_TIME_set_string_X509| behaves similarly except it additionally
+  // converts GeneralizedTime to UTCTime if it fits.
+  ASSERT_TRUE(ASN1_TIME_set_string_X509(s.get(), "700101000000Z"));
+  EXPECT_EQ(V_ASN1_UTCTIME, ASN1_STRING_type(s.get()));
+  EXPECT_EQ("700101000000Z", ASN1StringToStdString(s.get()));
+
+  ASSERT_TRUE(ASN1_TIME_set_string_X509(s.get(), "19700101000000Z"));
+  EXPECT_EQ(V_ASN1_UTCTIME, ASN1_STRING_type(s.get()));
+  EXPECT_EQ("700101000000Z", ASN1StringToStdString(s.get()));
+
+  ASSERT_TRUE(ASN1_TIME_set_string_X509(s.get(), "19500101000000Z"));
+  EXPECT_EQ(V_ASN1_UTCTIME, ASN1_STRING_type(s.get()));
+  EXPECT_EQ("500101000000Z", ASN1StringToStdString(s.get()));
+
+  ASSERT_TRUE(ASN1_TIME_set_string_X509(s.get(), "19491231235959Z"));
+  EXPECT_EQ(V_ASN1_GENERALIZEDTIME, ASN1_STRING_type(s.get()));
+  EXPECT_EQ("19491231235959Z", ASN1StringToStdString(s.get()));
+
+  ASSERT_TRUE(ASN1_TIME_set_string_X509(s.get(), "20491231235959Z"));
+  EXPECT_EQ(V_ASN1_UTCTIME, ASN1_STRING_type(s.get()));
+  EXPECT_EQ("491231235959Z", ASN1StringToStdString(s.get()));
+
+  ASSERT_TRUE(ASN1_TIME_set_string_X509(s.get(), "20500101000000Z"));
+  EXPECT_EQ(V_ASN1_GENERALIZEDTIME, ASN1_STRING_type(s.get()));
+  EXPECT_EQ("20500101000000Z", ASN1StringToStdString(s.get()));
+
   // Invalid inputs are rejected.
   EXPECT_FALSE(ASN1_UTCTIME_set_string(s.get(), "nope"));
   EXPECT_FALSE(ASN1_UTCTIME_set_string(s.get(), "19700101000000Z"));
@@ -1142,11 +1168,26 @@ TEST(ASN1Test, TimeSetString) {
   // to anything.
   EXPECT_TRUE(ASN1_UTCTIME_set_string(nullptr, "700101000000Z"));
   EXPECT_TRUE(ASN1_TIME_set_string(nullptr, "700101000000Z"));
+  EXPECT_TRUE(ASN1_TIME_set_string_X509(nullptr, "700101000000Z"));
   EXPECT_TRUE(ASN1_GENERALIZEDTIME_set_string(nullptr, "19700101000000Z"));
   EXPECT_TRUE(ASN1_TIME_set_string(nullptr, "19700101000000Z"));
+  EXPECT_TRUE(ASN1_TIME_set_string_X509(nullptr, "19700101000000Z"));
+  // Test an input |ASN1_TIME_set_string_X509| won't convert to UTCTime.
+  EXPECT_TRUE(ASN1_GENERALIZEDTIME_set_string(nullptr, "20500101000000Z"));
+  EXPECT_TRUE(ASN1_TIME_set_string(nullptr, "20500101000000Z"));
+  EXPECT_TRUE(ASN1_TIME_set_string_X509(nullptr, "20500101000000Z"));
   EXPECT_FALSE(ASN1_UTCTIME_set_string(nullptr, "nope"));
   EXPECT_FALSE(ASN1_GENERALIZEDTIME_set_string(nullptr, "nope"));
   EXPECT_FALSE(ASN1_TIME_set_string(nullptr, "nope"));
+  EXPECT_FALSE(ASN1_TIME_set_string_X509(nullptr, "nope"));
+
+  // Timezone offsets are not allowed by DER.
+  EXPECT_FALSE(ASN1_UTCTIME_set_string(nullptr, "700101000000-0400"));
+  EXPECT_FALSE(ASN1_TIME_set_string(nullptr, "700101000000-0400"));
+  EXPECT_FALSE(ASN1_TIME_set_string_X509(nullptr, "700101000000-0400"));
+  EXPECT_FALSE(ASN1_GENERALIZEDTIME_set_string(nullptr, "19700101000000-0400"));
+  EXPECT_FALSE(ASN1_TIME_set_string(nullptr, "19700101000000-0400"));
+  EXPECT_FALSE(ASN1_TIME_set_string_X509(nullptr, "19700101000000-0400"));
 }
 
 TEST(ASN1Test, AdjTime) {

data/aws-crt-ffi/crt/aws-lc/crypto/bio/bio_mem.c

@@ -206,7 +206,6 @@ static int mem_gets(BIO *bio, char *buf, int size) {
 
 static long mem_ctrl(BIO *bio, int cmd, long num, void *ptr) {
   long ret = 1;
-  char **pptr;
 
   BUF_MEM *b = (BUF_MEM *)bio->ptr;
 
@@ -232,8 +231,8 @@ static long mem_ctrl(BIO *bio, int cmd, long num, void *ptr) {
     case BIO_CTRL_INFO:
       ret = (long)b->length;
       if (ptr != NULL) {
-        pptr = (char **)ptr;
-        *pptr = (char *)&b->data[0];
+        char **pptr = ptr;
+        *pptr = b->data;
       }
       break;
     case BIO_C_SET_BUF_MEM:
@@ -243,8 +242,8 @@ static long mem_ctrl(BIO *bio, int cmd, long num, void *ptr) {
       break;
     case BIO_C_GET_BUF_MEM_PTR:
       if (ptr != NULL) {
-        pptr = (char **)ptr;
-        *pptr = (char *)b;
+        BUF_MEM **pptr = ptr;
+        *pptr = b;
       }
       break;
     case BIO_CTRL_GET_CLOSE:
@@ -294,11 +293,11 @@ int BIO_mem_contents(const BIO *bio, const uint8_t **out_contents,
 }
 
 int BIO_get_mem_ptr(BIO *bio, BUF_MEM **out) {
-  return (int)BIO_ctrl(bio, BIO_C_GET_BUF_MEM_PTR, 0, (char *) out);
+  return (int)BIO_ctrl(bio, BIO_C_GET_BUF_MEM_PTR, 0, out);
 }
 
 int BIO_set_mem_buf(BIO *bio, BUF_MEM *b, int take_ownership) {
-  return (int)BIO_ctrl(bio, BIO_C_SET_BUF_MEM, take_ownership, (char *) b);
+  return (int)BIO_ctrl(bio, BIO_C_SET_BUF_MEM, take_ownership, b);
 }
 
 int BIO_set_mem_eof_return(BIO *bio, int eof_value) {

data/aws-crt-ffi/crt/aws-lc/crypto/bio/bio_test.cc

@@ -154,6 +154,108 @@ TEST(BIOTest, Printf) {
   }
 }
 
+TEST(BIOTest, CloseFlags) {
+#if defined(OPENSSL_ANDROID)
+  // On Android, when running from an APK, |tmpfile| does not work. See
+  // b/36991167#comment8.
+  GTEST_SKIP();
+#endif
+
+  // unique_ptr will automatically call fclose on the file descriptior when the
+  // variable goes out of scope, so we need to specify BIO_NOCLOSE close flags
+  // to avoid a double-free condition.
+  struct fclose_deleter {
+      void operator()(FILE *f) const { fclose(f); }
+  };
+  using TempFILE = std::unique_ptr<FILE, fclose_deleter>;
+
+  const char *test_str = "test\ntest\ntest\n";
+
+  // Assert that CRLF line endings get inserted on write and translated back out on
+  // read for text mode.
+  TempFILE text_bio_file(tmpfile());
+  ASSERT_TRUE(text_bio_file);
+  bssl::UniquePtr<BIO> text_bio(BIO_new_fp(text_bio_file.get(), BIO_NOCLOSE | BIO_FP_TEXT));
+  int bytes_written = BIO_write(text_bio.get(), test_str, strlen(test_str));
+  EXPECT_GE(bytes_written, 0);
+  ASSERT_TRUE(BIO_flush(text_bio.get()));
+  ASSERT_EQ(0, BIO_seek(text_bio.get(), 0));    // 0 indicates success here
+  char contents[256];
+  OPENSSL_memset(contents, 0, sizeof(contents));
+  int bytes_read = BIO_read(text_bio.get(), contents, sizeof(contents));
+  EXPECT_GE(bytes_read, bytes_written);
+  EXPECT_EQ(test_str, std::string(contents));
+
+  // Windows should have translated '\n' to '\r\n' on write, so validate that
+  // by opening the file in raw binary mode (i.e. no BIO_FP_TEXT).
+  bssl::UniquePtr<BIO> text_bio_raw(BIO_new_fp(text_bio_file.get(), BIO_NOCLOSE));
+  ASSERT_EQ(0, BIO_seek(text_bio.get(), 0));    // 0 indicates success here
+  OPENSSL_memset(contents, 0, sizeof(contents));
+  bytes_read = BIO_read(text_bio_raw.get(), contents, sizeof(contents));
+  EXPECT_GT(bytes_read, 0);
+#if defined(OPENSSL_WINDOWS)
+  EXPECT_EQ("test\r\ntest\r\ntest\r\n", std::string(contents));
+#else
+  EXPECT_EQ(test_str, std::string(contents));
+#endif
+
+  // Assert that CRLF line endings don't get inserted on write for
+  // (default) binary mode.
+  TempFILE binary_bio_file(tmpfile());
+  ASSERT_TRUE(binary_bio_file);
+  bssl::UniquePtr<BIO> binary_bio(BIO_new_fp(binary_bio_file.get(), BIO_NOCLOSE));
+  bytes_written = BIO_write(binary_bio.get(), test_str, strlen(test_str));
+  EXPECT_EQ((int) strlen(test_str), bytes_written);
+  ASSERT_TRUE(BIO_flush(binary_bio.get()));
+  ASSERT_EQ(0, BIO_seek(binary_bio.get(), 0));    // 0 indicates success here
+  OPENSSL_memset(contents, 0, sizeof(contents));
+  bytes_read = BIO_read(binary_bio.get(), contents, sizeof(contents));
+  EXPECT_GE(bytes_read, bytes_written);
+  EXPECT_EQ(test_str, std::string(contents));
+
+  // This test is meant to ensure that we're correctly handling a ftell/fseek
+  // bug on Windows documented and reproduced here:
+  // https://developercommunity.visualstudio.com/t/fseek-ftell-fail-in-text-mode-for-unix-style-text/425878
+  long pos;
+  char b1[256], b2[256];
+  binary_bio.reset(BIO_new_fp(binary_bio_file.get(), BIO_NOCLOSE));
+  ASSERT_EQ(0, BIO_seek(binary_bio.get(), 0));    // 0 indicates success here
+  BIO_gets(binary_bio.get(), b1, sizeof(b1));
+  pos = BIO_tell(binary_bio.get());
+  ASSERT_GT(BIO_gets(binary_bio.get(), b1, sizeof(b1)), 0);
+  BIO_seek(binary_bio.get(), pos);
+  BIO_gets(binary_bio.get(), b2, sizeof(b2));
+  EXPECT_EQ(std::string(b1), std::string(b2));
+
+  // Assert that BIO_CLOSE causes the underlying file to be closed on BIO free
+  // (ftell will return < 0)
+  FILE *tmp = tmpfile();
+  ASSERT_TRUE(tmp);
+  BIO *bio = BIO_new_fp(tmp, BIO_CLOSE);
+  EXPECT_EQ(0, BIO_tell(bio));
+  // save off fd to avoid referencing |tmp| after free and angering valgrind
+  int tmp_fd = fileno(tmp);
+  EXPECT_LT(0, tmp_fd);
+  EXPECT_TRUE(BIO_free(bio));
+  // Windows CRT hits an assertion error and stack overflow (exception code
+  // 0xc0000409) when calling _tell or lseek on an already-closed file
+  // descriptor, so only consider the non-Windows case here.
+#if !defined(OPENSSL_WINDOWS)
+  EXPECT_EQ(-1, lseek(tmp_fd, 0, SEEK_CUR));
+  EXPECT_EQ(EBADF, errno);  // EBADF indicates that |BIO_free| closed the file
+#endif
+
+  // Assert that BIO_NOCLOSE does not close the underlying file on BIO free
+  tmp = tmpfile();
+  ASSERT_TRUE(tmp);
+  bio = BIO_new_fp(tmp, BIO_NOCLOSE);
+  EXPECT_EQ(0, BIO_tell(bio));
+  EXPECT_TRUE(BIO_free(bio));
+  EXPECT_TRUE(tmp);
+  EXPECT_EQ(0, ftell(tmp));     // 0 indicates file is still open
+  EXPECT_EQ(0, fclose(tmp));    // 0 indicates success for fclose
+}
+
 TEST(BIOTest, ReadASN1) {
   static const size_t kLargeASN1PayloadLen = 8000;
 
@@ -287,11 +389,24 @@ TEST(BIOTest, MemWritable) {
   bssl::UniquePtr<BIO> bio(BIO_new(BIO_s_mem()));
   ASSERT_TRUE(bio);
 
+  auto check_bio_contents = [&](Bytes b) {
+    const uint8_t *contents;
+    size_t len;
+    ASSERT_TRUE(BIO_mem_contents(bio.get(), &contents, &len));
+    EXPECT_EQ(Bytes(contents, len), b);
+
+    char *contents_c;
+    long len_l = BIO_get_mem_data(bio.get(), &contents_c);
+    ASSERT_GE(len_l, 0);
+    EXPECT_EQ(Bytes(contents_c, len_l), b);
+
+    BUF_MEM *buf;
+    ASSERT_EQ(BIO_get_mem_ptr(bio.get(), &buf), 1);
+    EXPECT_EQ(Bytes(buf->data, buf->length), b);
+  };
+
   // It is initially empty.
-  const uint8_t *contents;
-  size_t len;
-  ASSERT_TRUE(BIO_mem_contents(bio.get(), &contents, &len));
-  EXPECT_EQ(Bytes(contents, len), Bytes(""));
+  check_bio_contents(Bytes(""));
   EXPECT_EQ(BIO_eof(bio.get()), 1);
 
   // Reading from it should default to returning a retryable error.
@@ -310,44 +425,38 @@ TEST(BIOTest, MemWritable) {
 
   // Writes append to the buffer.
   ASSERT_EQ(BIO_write(bio.get(), "abcdef", 6), 6);
-  ASSERT_TRUE(BIO_mem_contents(bio.get(), &contents, &len));
-  EXPECT_EQ(Bytes(contents, len), Bytes("abcdef"));
+  check_bio_contents(Bytes("abcdef"));
   EXPECT_EQ(BIO_eof(bio.get()), 0);
 
   // Writes can include embedded NULs.
   ASSERT_EQ(BIO_write(bio.get(), "\0ghijk", 6), 6);
-  ASSERT_TRUE(BIO_mem_contents(bio.get(), &contents, &len));
-  EXPECT_EQ(Bytes(contents, len), Bytes("abcdef\0ghijk", 12));
+  check_bio_contents(Bytes("abcdef\0ghijk", 12));
   EXPECT_EQ(BIO_eof(bio.get()), 0);
 
   // Do a partial read.
   int ret = BIO_read(bio.get(), buf, 4);
   ASSERT_GT(ret, 0);
   EXPECT_EQ(Bytes(buf, ret), Bytes("abcd"));
-  ASSERT_TRUE(BIO_mem_contents(bio.get(), &contents, &len));
-  EXPECT_EQ(Bytes(contents, len), Bytes("ef\0ghijk", 8));
+  check_bio_contents(Bytes("ef\0ghijk", 8));
   EXPECT_EQ(BIO_eof(bio.get()), 0);
 
   // Reads and writes may alternate.
   ASSERT_EQ(BIO_write(bio.get(), "lmnopq", 6), 6);
-  ASSERT_TRUE(BIO_mem_contents(bio.get(), &contents, &len));
-  EXPECT_EQ(Bytes(contents, len), Bytes("ef\0ghijklmnopq", 14));
+  check_bio_contents(Bytes("ef\0ghijklmnopq", 14));
   EXPECT_EQ(BIO_eof(bio.get()), 0);
 
   // Reads may consume embedded NULs.
   ret = BIO_read(bio.get(), buf, 4);
   ASSERT_GT(ret, 0);
   EXPECT_EQ(Bytes(buf, ret), Bytes("ef\0g", 4));
-  ASSERT_TRUE(BIO_mem_contents(bio.get(), &contents, &len));
-  EXPECT_EQ(Bytes(contents, len), Bytes("hijklmnopq"));
+  check_bio_contents(Bytes("hijklmnopq"));
   EXPECT_EQ(BIO_eof(bio.get()), 0);
 
   // The read buffer exceeds the |BIO|, so we consume everything.
   ret = BIO_read(bio.get(), buf, sizeof(buf));
   ASSERT_GT(ret, 0);
   EXPECT_EQ(Bytes(buf, ret), Bytes("hijklmnopq"));
-  ASSERT_TRUE(BIO_mem_contents(bio.get(), &contents, &len));
-  EXPECT_EQ(Bytes(contents, len), Bytes(""));
+  check_bio_contents(Bytes(""));
   EXPECT_EQ(BIO_eof(bio.get()), 1);
 
   // The |BIO| is now empty.
@@ -696,4 +805,31 @@ TEST_P(BIOPairTest, TestCallbacks) {
   ASSERT_EQ(param_len_ex[0], 0u);
 }
 
+namespace {
+  static int callback_invoked = 0;
+
+  static long callback(BIO *b, int state, int res) {
+    callback_invoked = 1;
+    EXPECT_EQ(state, 0);
+    EXPECT_EQ(res, -1);
+    return 0;
+  }
+
+  TEST(BIOTest, InvokeConnectCallback) {
+
+    ASSERT_EQ(callback_invoked, 0);
+    BIO *bio = BIO_new(BIO_s_connect());
+    ASSERT_NE(bio, nullptr);
+
+    ASSERT_TRUE(BIO_set_conn_hostname(bio, "localhost"));
+    ASSERT_TRUE(BIO_set_conn_port(bio, "8080"));
+    ASSERT_TRUE(BIO_callback_ctrl(bio, BIO_CTRL_SET_CALLBACK, callback));
+
+    ASSERT_EQ(BIO_do_connect(bio), 0);
+    ASSERT_EQ(callback_invoked, 1);
+
+    ASSERT_TRUE(BIO_free(bio));
+  }
+}
+
 INSTANTIATE_TEST_SUITE_P(All, BIOPairTest, testing::Values(false, true));

data/aws-crt-ffi/crt/aws-lc/crypto/bio/connect.c

@@ -56,7 +56,7 @@
 
 #include <openssl/bio.h>
 
-#if !defined(OPENSSL_TRUSTY)
+#if !defined(OPENSSL_NO_SOCK)
 
 #include <assert.h>
 #include <errno.h>
@@ -105,7 +105,7 @@ typedef struct bio_connect_st {
   // info_callback is called when the connection is initially made
   // callback(BIO,state,ret);  The callback should return 'ret', state is for
   // compatibility with the SSL info_callback.
-  int (*info_callback)(const BIO *bio, int state, int ret);
+  bio_info_cb info_callback;
 } BIO_CONNECT;
 
 #if !defined(OPENSSL_WINDOWS)
@@ -168,7 +168,7 @@ static int split_host_and_port(char **out_host, char **out_port,
 
 static int conn_state(BIO *bio, BIO_CONNECT *c) {
   int ret = -1, i;
-  int (*cb)(const BIO *, int, int) = NULL;
+  bio_info_cb cb = NULL;
 
   if (c->info_callback != NULL) {
     cb = c->info_callback;
@@ -467,7 +467,7 @@ static long conn_ctrl(BIO *bio, int cmd, long num, void *ptr) {
     case BIO_CTRL_FLUSH:
       break;
     case BIO_CTRL_GET_CALLBACK: {
-      int (**fptr)(const BIO *bio, int state, int xret) = ptr;
+      bio_info_cb *fptr = ptr;
       *fptr = data->info_callback;
     } break;
     default:
@@ -485,13 +485,7 @@ static long conn_callback_ctrl(BIO *bio, int cmd, bio_info_cb fp) {
 
   switch (cmd) {
     case BIO_CTRL_SET_CALLBACK:
-      // This is the actual type signature of |fp|. The caller is expected to
-      // cast it to |bio_info_cb| due to the |BIO_callback_ctrl| calling
-      // convention.
-      OPENSSL_MSVC_PRAGMA(warning(push))
-      OPENSSL_MSVC_PRAGMA(warning(disable : 4191))
-      data->info_callback = (int (*)(const struct bio_st *, int, int))fp;
-      OPENSSL_MSVC_PRAGMA(warning(pop))
+      data->info_callback = fp;
       break;
     default:
       ret = 0;
@@ -544,4 +538,4 @@ int BIO_do_connect(BIO *bio) {
   return (int)BIO_ctrl(bio, BIO_C_DO_STATE_MACHINE, 0, NULL);
 }
 
-#endif  // OPENSSL_TRUSTY
+#endif  // OPENSSL_NO_SOCK

data/aws-crt-ffi/crt/aws-lc/crypto/bio/fd.c

@@ -56,7 +56,7 @@
 
 #include <openssl/bio.h>
 
-#if !defined(OPENSSL_TRUSTY)
+#if !defined(OPENSSL_NO_POSIX_IO)
 
 #include <errno.h>
 #include <string.h>
@@ -276,4 +276,4 @@ int BIO_get_fd(BIO *bio, int *out_fd) {
   return (int)BIO_ctrl(bio, BIO_C_GET_FD, 0, (char *) out_fd);
 }
 
-#endif  // OPENSSL_TRUSTY
+#endif  // OPENSSL_NO_POSIX_IO

data/aws-crt-ffi/crt/aws-lc/crypto/bio/file.c

@@ -79,6 +79,11 @@
 #include <stdio.h>
 #include <string.h>
 
+#if defined(OPENSSL_WINDOWS)
+#include <fcntl.h>
+#include <io.h>
+#endif  // OPENSSL_WINDOWS
+
 #include <openssl/err.h>
 #include <openssl/mem.h>
 
@@ -172,7 +177,6 @@ static long file_ctrl(BIO *b, int cmd, long num, void *ptr) {
   long ret = 1;
   FILE *fp = (FILE *)b->ptr;
   FILE **fpp;
-  char p[4];
 
   switch (cmd) {
     case BIO_CTRL_RESET:
@@ -193,31 +197,39 @@ static long file_ctrl(BIO *b, int cmd, long num, void *ptr) {
       b->shutdown = (int)num & BIO_CLOSE;
       b->ptr = ptr;
       b->init = 1;
+#if defined(OPENSSL_WINDOWS)
+      // Windows differentiates between "text" and "binary" file modes, so set
+      // the file to text mode if caller specifies BIO_FP_TEXT flag.
+      //
+      // https://learn.microsoft.com/en-us/cpp/c-runtime-library/reference/setmode?view=msvc-170#remarks
+      _setmode(_fileno(b->ptr), num & BIO_FP_TEXT ? _O_TEXT : _O_BINARY);
+#endif
       break;
     case BIO_C_SET_FILENAME:
       file_free(b);
       b->shutdown = (int)num & BIO_CLOSE;
+      const char *mode;
       if (num & BIO_FP_APPEND) {
         if (num & BIO_FP_READ) {
-          OPENSSL_strlcpy(p, "a+", sizeof(p));
+          mode = "a+";
         } else {
-          OPENSSL_strlcpy(p, "a", sizeof(p));
+          mode = "a";
         }
       } else if ((num & BIO_FP_READ) && (num & BIO_FP_WRITE)) {
-        OPENSSL_strlcpy(p, "r+", sizeof(p));
+        mode = "r+";
       } else if (num & BIO_FP_WRITE) {
-        OPENSSL_strlcpy(p, "w", sizeof(p));
+        mode = "w";
       } else if (num & BIO_FP_READ) {
-        OPENSSL_strlcpy(p, "r", sizeof(p));
+        mode = "r";
       } else {
         OPENSSL_PUT_ERROR(BIO, BIO_R_BAD_FOPEN_MODE);
         ret = 0;
         break;
       }
-      fp = fopen(ptr, p);
+      fp = fopen(ptr, mode);
       if (fp == NULL) {
         OPENSSL_PUT_SYSTEM_ERROR();
-        ERR_add_error_data(5, "fopen('", ptr, "','", p, "')");
+        ERR_add_error_data(5, "fopen('", ptr, "','", mode, "')");
         OPENSSL_PUT_ERROR(BIO, ERR_R_SYS_LIB);
         ret = 0;
         break;

data/aws-crt-ffi/crt/aws-lc/crypto/bio/socket.c

@@ -56,7 +56,7 @@
 
 #include <openssl/bio.h>
 
-#if !defined(OPENSSL_TRUSTY)
+#if !defined(OPENSSL_NO_SOCK)
 
 #include <fcntl.h>
 #include <string.h>
@@ -184,4 +184,4 @@ BIO *BIO_new_socket(int fd, int close_flag) {
   return ret;
 }
 
-#endif  // OPENSSL_TRUSTY
+#endif  // OPENSSL_NO_SOCK

data/aws-crt-ffi/crt/aws-lc/crypto/bio/socket_helper.c

@@ -20,7 +20,7 @@
 #include <openssl/bio.h>
 #include <openssl/err.h>
 
-#if !defined(OPENSSL_TRUSTY)
+#if !defined(OPENSSL_NO_SOCK)
 
 #include <time.h>
 #include <fcntl.h>
@@ -122,4 +122,4 @@ int bio_sock_error(int sock) {
   return error;
 }
 
-#endif  // OPENSSL_TRUSTY
+#endif  // OPENSSL_NO_SOCK

data/aws-crt-ffi/crt/aws-lc/crypto/blake2/blake2.c

@@ -59,6 +59,16 @@ static uint64_t blake2b_load(const uint8_t block[BLAKE2B_CBLOCK], size_t i) {
   return CRYPTO_load_u64_le(block + 8 * i);
 }
 
+static void copy_digest_words_to_dest(uint8_t* dest, uint64_t* src, size_t word_count) {
+#ifdef OPENSSL_BIG_ENDIAN
+  for(size_t i = 0; i < word_count; i++) {
+    CRYPTO_store_u64_le(&dest[i * sizeof(uint64_t)], src[i]);
+  }
+#else
+  OPENSSL_memcpy(dest, src, word_count * sizeof(uint64_t));
+#endif
+}
+
 static void blake2b_transform(BLAKE2B_CTX *b2b,
                               const uint8_t block[BLAKE2B_CBLOCK],
                               size_t num_bytes, int is_final_block) {
@@ -158,7 +168,7 @@ void BLAKE2B256_Final(uint8_t out[BLAKE2B256_DIGEST_LENGTH], BLAKE2B_CTX *b2b) {
   blake2b_transform(b2b, b2b->block, b2b->block_used,
                     /*is_final_block=*/1);
   OPENSSL_STATIC_ASSERT(BLAKE2B256_DIGEST_LENGTH <= sizeof(b2b->h), _)
-  memcpy(out, b2b->h, BLAKE2B256_DIGEST_LENGTH);
+  copy_digest_words_to_dest(out, b2b->h, BLAKE2B256_DIGEST_LENGTH / 8);
 }
 
 void BLAKE2B256(const uint8_t *data, size_t len,

data/aws-crt-ffi/crt/aws-lc/crypto/bytestring/cbb.c

@@ -484,7 +484,7 @@ int CBB_add_asn1_uint64_with_tag(CBB *cbb, uint64_t value, CBS_ASN1_TAG tag) {
 
   int started = 0;
   for (size_t i = 0; i < 8; i++) {
-    uint8_t byte = (value >> 8*(7-i)) & 0xff;
+    uint8_t byte = (value >> 8 * (7 - i)) & 0xff;
     if (!started) {
       if (byte == 0) {
         // Don't encode leading zeros.
@@ -521,17 +521,27 @@ int CBB_add_asn1_int64_with_tag(CBB *cbb, int64_t value, CBS_ASN1_TAG tag) {
 
   uint8_t bytes[sizeof(int64_t)];
   memcpy(bytes, &value, sizeof(value));
-  int start = 7;
   // Skip leading sign-extension bytes unless they are necessary.
+#ifdef OPENSSL_BIG_ENDIAN
+  int start = 0;
+  while (start < 7 && (bytes[start] == 0xff && (bytes[start + 1] & 0x80))) {
+    start++;
+  }
+#else
+  int start = 7;
   while (start > 0 && (bytes[start] == 0xff && (bytes[start - 1] & 0x80))) {
     start--;
   }
-
+#endif
   CBB child;
   if (!CBB_add_asn1(cbb, &child, tag)) {
     return 0;
   }
+#ifdef OPENSSL_BIG_ENDIAN
+  for (int i = start; i <= 7; i++) {
+#else
   for (int i = start; i >= 0; i--) {
+#endif
     if (!CBB_add_u8(&child, bytes[i])) {
       return 0;
     }

data/aws-crt-ffi/crt/aws-lc/crypto/bytestring/cbs.c

@@ -521,8 +521,17 @@ int CBS_get_asn1_int64(CBS *cbs, int64_t *out) {
   uint8_t sign_extend[sizeof(int64_t)];
   memset(sign_extend, is_negative ? 0xff : 0, sizeof(sign_extend));
   for (size_t i = 0; i < len; i++) {
+// `data` is big-endian.
+// Values are always shifted toward the "little" end.
+#ifdef OPENSSL_BIG_ENDIAN
+    // Bytes are written starting at the highest index.
+    sign_extend[sizeof(sign_extend) - i - 1] = data[len - i - 1];
+#else
+    // Bytes are written starting at the lowest index.
     sign_extend[i] = data[len - i - 1];
+#endif
   }
+
   memcpy(out, sign_extend, sizeof(sign_extend));
   return 1;
 }

data/aws-crt-ffi/crt/aws-lc/crypto/chacha/asm/chacha-armv8.pl

@@ -146,7 +146,7 @@ $code.=<<___;
 ChaCha20_ctr32:
 	AARCH64_VALID_CALL_TARGET
 	cbz	$len,.Labort
-#if __has_feature(hwaddress_sanitizer) && __clang_major__ >= 10
+#if defined(OPENSSL_HWASAN) && __clang_major__ >= 10
 	adrp	@x[0],:pg_hi21_nc:OPENSSL_armcap_P
 #else
 	adrp	@x[0],:pg_hi21:OPENSSL_armcap_P