grpc 1.40.0.pre1 → 1.42.0.pre1

data/third_party/boringssl-with-bazel/src/crypto/conf/conf.c

@@ -68,6 +68,7 @@
 #include "conf_def.h"
 #include "internal.h"
 #include "../internal.h"
+#include "../lhash/internal.h"
 
 
 DEFINE_LHASH_OF(CONF_VALUE)
@@ -76,12 +77,16 @@ struct conf_st {
   LHASH_OF(CONF_VALUE) *data;
 };
 
+static const char kDefaultSectionName[] = "default";
+
 // The maximum length we can grow a value to after variable expansion. 64k
 // should be more than enough for all reasonable uses.
 #define MAX_CONF_VALUE_LENGTH 65536
 
 static uint32_t conf_value_hash(const CONF_VALUE *v) {
-  return (lh_strhash(v->section) << 2) ^ lh_strhash(v->name);
+  const uint32_t section_hash = v->section ? OPENSSL_strhash(v->section) : 0;
+  const uint32_t name_hash = v->name ? OPENSSL_strhash(v->name) : 0;
+  return (section_hash << 2) ^ name_hash;
 }
 
 static int conf_value_cmp(const CONF_VALUE *a, const CONF_VALUE *b) {
@@ -155,12 +160,14 @@ static void value_free(CONF_VALUE *value) {
   OPENSSL_free(value);
 }
 
+static void value_free_arg(CONF_VALUE *value, void *arg) { value_free(value); }
+
 void NCONF_free(CONF *conf) {
   if (conf == NULL || conf->data == NULL) {
     return;
   }
 
-  lh_CONF_VALUE_doall(conf->data, value_free);
+  lh_CONF_VALUE_doall_arg(conf->data, value_free_arg, NULL);
   lh_CONF_VALUE_free(conf->data);
   OPENSSL_free(conf);
 }
@@ -390,6 +397,10 @@ const char *NCONF_get_string(const CONF *conf, const char *section,
                              const char *name) {
   CONF_VALUE template, *value;
 
+  if (section == NULL) {
+    section = kDefaultSectionName;
+  }
+
   OPENSSL_memset(&template, 0, sizeof(template));
   template.section = (char *) section;
   template.name = (char *) name;
@@ -538,7 +549,7 @@ static int def_load_bio(CONF *conf, BIO *in, long *out_error_line) {
     goto err;
   }
 
-  section = OPENSSL_strdup("default");
+  section = OPENSSL_strdup(kDefaultSectionName);
   if (section == NULL) {
     OPENSSL_PUT_ERROR(CONF, ERR_R_MALLOC_FAILURE);
     goto err;

data/third_party/boringssl-with-bazel/src/crypto/digest_extra/digest_extra.c

@@ -58,11 +58,12 @@
 
 #include <string.h>
 
-#include <openssl/asn1.h>
 #include <openssl/blake2.h>
 #include <openssl/bytestring.h>
+#include <openssl/obj.h>
 #include <openssl/nid.h>
 
+#include "../asn1/internal.h"
 #include "../internal.h"
 #include "../fipsmodule/digest/internal.h"
 
@@ -82,6 +83,7 @@ static const struct nid_to_digest nid_to_digest_mapping[] = {
     {NID_sha256, EVP_sha256, SN_sha256, LN_sha256},
     {NID_sha384, EVP_sha384, SN_sha384, LN_sha384},
     {NID_sha512, EVP_sha512, SN_sha512, LN_sha512},
+    {NID_sha512_256, EVP_sha512_256, SN_sha512_256, LN_sha512_256},
     {NID_md5_sha1, EVP_md5_sha1, SN_md5_sha1, LN_md5_sha1},
     // As a remnant of signing |EVP_MD|s, OpenSSL returned the corresponding
     // hash function when given a signature OID. To avoid unintended lax parsing
@@ -152,13 +154,14 @@ static const EVP_MD *cbs_to_md(const CBS *cbs) {
 }
 
 const EVP_MD *EVP_get_digestbyobj(const ASN1_OBJECT *obj) {
-  // Handle objects with no corresponding OID.
+  // Handle objects with no corresponding OID. Note we don't use |OBJ_obj2nid|
+  // here to avoid pulling in the OID table.
   if (obj->nid != NID_undef) {
     return EVP_get_digestbynid(obj->nid);
   }
 
   CBS cbs;
-  CBS_init(&cbs, obj->data, obj->length);
+  CBS_init(&cbs, OBJ_get0_data(obj), OBJ_length(obj));
   return cbs_to_md(&cbs);
 }
 

data/third_party/boringssl-with-bazel/src/crypto/evp/scrypt.c

@@ -32,8 +32,6 @@ typedef struct { uint32_t words[16]; } block_t;
 
 OPENSSL_STATIC_ASSERT(sizeof(block_t) == 64, "block_t has padding");
 
-#define R(a, b) (((a) << (b)) | ((a) >> (32 - (b))))
-
 // salsa208_word_specification implements the Salsa20/8 core function, also
 // described in RFC 7914, section 3. It modifies the block at |inout|
 // in-place.
@@ -42,38 +40,38 @@ static void salsa208_word_specification(block_t *inout) {
   OPENSSL_memcpy(&x, inout, sizeof(x));
 
   for (int i = 8; i > 0; i -= 2) {
-    x.words[4] ^= R(x.words[0] + x.words[12], 7);
-    x.words[8] ^= R(x.words[4] + x.words[0], 9);
-    x.words[12] ^= R(x.words[8] + x.words[4], 13);
-    x.words[0] ^= R(x.words[12] + x.words[8], 18);
-    x.words[9] ^= R(x.words[5] + x.words[1], 7);
-    x.words[13] ^= R(x.words[9] + x.words[5], 9);
-    x.words[1] ^= R(x.words[13] + x.words[9], 13);
-    x.words[5] ^= R(x.words[1] + x.words[13], 18);
-    x.words[14] ^= R(x.words[10] + x.words[6], 7);
-    x.words[2] ^= R(x.words[14] + x.words[10], 9);
-    x.words[6] ^= R(x.words[2] + x.words[14], 13);
-    x.words[10] ^= R(x.words[6] + x.words[2], 18);
-    x.words[3] ^= R(x.words[15] + x.words[11], 7);
-    x.words[7] ^= R(x.words[3] + x.words[15], 9);
-    x.words[11] ^= R(x.words[7] + x.words[3], 13);
-    x.words[15] ^= R(x.words[11] + x.words[7], 18);
-    x.words[1] ^= R(x.words[0] + x.words[3], 7);
-    x.words[2] ^= R(x.words[1] + x.words[0], 9);
-    x.words[3] ^= R(x.words[2] + x.words[1], 13);
-    x.words[0] ^= R(x.words[3] + x.words[2], 18);
-    x.words[6] ^= R(x.words[5] + x.words[4], 7);
-    x.words[7] ^= R(x.words[6] + x.words[5], 9);
-    x.words[4] ^= R(x.words[7] + x.words[6], 13);
-    x.words[5] ^= R(x.words[4] + x.words[7], 18);
-    x.words[11] ^= R(x.words[10] + x.words[9], 7);
-    x.words[8] ^= R(x.words[11] + x.words[10], 9);
-    x.words[9] ^= R(x.words[8] + x.words[11], 13);
-    x.words[10] ^= R(x.words[9] + x.words[8], 18);
-    x.words[12] ^= R(x.words[15] + x.words[14], 7);
-    x.words[13] ^= R(x.words[12] + x.words[15], 9);
-    x.words[14] ^= R(x.words[13] + x.words[12], 13);
-    x.words[15] ^= R(x.words[14] + x.words[13], 18);
+    x.words[4] ^= CRYPTO_rotl_u32(x.words[0] + x.words[12], 7);
+    x.words[8] ^= CRYPTO_rotl_u32(x.words[4] + x.words[0], 9);
+    x.words[12] ^= CRYPTO_rotl_u32(x.words[8] + x.words[4], 13);
+    x.words[0] ^= CRYPTO_rotl_u32(x.words[12] + x.words[8], 18);
+    x.words[9] ^= CRYPTO_rotl_u32(x.words[5] + x.words[1], 7);
+    x.words[13] ^= CRYPTO_rotl_u32(x.words[9] + x.words[5], 9);
+    x.words[1] ^= CRYPTO_rotl_u32(x.words[13] + x.words[9], 13);
+    x.words[5] ^= CRYPTO_rotl_u32(x.words[1] + x.words[13], 18);
+    x.words[14] ^= CRYPTO_rotl_u32(x.words[10] + x.words[6], 7);
+    x.words[2] ^= CRYPTO_rotl_u32(x.words[14] + x.words[10], 9);
+    x.words[6] ^= CRYPTO_rotl_u32(x.words[2] + x.words[14], 13);
+    x.words[10] ^= CRYPTO_rotl_u32(x.words[6] + x.words[2], 18);
+    x.words[3] ^= CRYPTO_rotl_u32(x.words[15] + x.words[11], 7);
+    x.words[7] ^= CRYPTO_rotl_u32(x.words[3] + x.words[15], 9);
+    x.words[11] ^= CRYPTO_rotl_u32(x.words[7] + x.words[3], 13);
+    x.words[15] ^= CRYPTO_rotl_u32(x.words[11] + x.words[7], 18);
+    x.words[1] ^= CRYPTO_rotl_u32(x.words[0] + x.words[3], 7);
+    x.words[2] ^= CRYPTO_rotl_u32(x.words[1] + x.words[0], 9);
+    x.words[3] ^= CRYPTO_rotl_u32(x.words[2] + x.words[1], 13);
+    x.words[0] ^= CRYPTO_rotl_u32(x.words[3] + x.words[2], 18);
+    x.words[6] ^= CRYPTO_rotl_u32(x.words[5] + x.words[4], 7);
+    x.words[7] ^= CRYPTO_rotl_u32(x.words[6] + x.words[5], 9);
+    x.words[4] ^= CRYPTO_rotl_u32(x.words[7] + x.words[6], 13);
+    x.words[5] ^= CRYPTO_rotl_u32(x.words[4] + x.words[7], 18);
+    x.words[11] ^= CRYPTO_rotl_u32(x.words[10] + x.words[9], 7);
+    x.words[8] ^= CRYPTO_rotl_u32(x.words[11] + x.words[10], 9);
+    x.words[9] ^= CRYPTO_rotl_u32(x.words[8] + x.words[11], 13);
+    x.words[10] ^= CRYPTO_rotl_u32(x.words[9] + x.words[8], 18);
+    x.words[12] ^= CRYPTO_rotl_u32(x.words[15] + x.words[14], 7);
+    x.words[13] ^= CRYPTO_rotl_u32(x.words[12] + x.words[15], 9);
+    x.words[14] ^= CRYPTO_rotl_u32(x.words[13] + x.words[12], 13);
+    x.words[15] ^= CRYPTO_rotl_u32(x.words[14] + x.words[13], 18);
   }
 
   for (int i = 0; i < 16; ++i) {

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/bn/div.c

@@ -285,8 +285,10 @@ int BN_div(BIGNUM *quotient, BIGNUM *rem, const BIGNUM *numerator,
   // pointer to the 'top' of snum
   wnump = &(snum->d[num_n - 1]);
 
-  // Setup to 'res'
-  res->neg = (numerator->neg ^ divisor->neg);
+  // Setup |res|. |numerator| and |res| may alias, so we save |numerator->neg|
+  // for later.
+  const int numerator_neg = numerator->neg;
+  res->neg = (numerator_neg ^ divisor->neg);
   if (!bn_wexpand(res, loop + 1)) {
     goto err;
   }
@@ -379,14 +381,11 @@ int BN_div(BIGNUM *quotient, BIGNUM *rem, const BIGNUM *numerator,
   bn_set_minimal_width(snum);
 
   if (rem != NULL) {
-    // Keep a copy of the neg flag in numerator because if |rem| == |numerator|
-    // |BN_rshift| will overwrite it.
-    int neg = numerator->neg;
     if (!BN_rshift(rem, snum, norm_shift)) {
       goto err;
     }
     if (!BN_is_zero(rem)) {
-      rem->neg = neg;
+      rem->neg = numerator_neg;
     }
   }
 
@@ -457,7 +456,7 @@ void bn_mod_add_words(BN_ULONG *r, const BN_ULONG *a, const BN_ULONG *b,
 
 int bn_div_consttime(BIGNUM *quotient, BIGNUM *remainder,
                      const BIGNUM *numerator, const BIGNUM *divisor,
-                     BN_CTX *ctx) {
+                     unsigned divisor_min_bits, BN_CTX *ctx) {
   if (BN_is_negative(numerator) || BN_is_negative(divisor)) {
     OPENSSL_PUT_ERROR(BN, BN_R_NEGATIVE_NUMBER);
     return 0;
@@ -497,8 +496,26 @@ int bn_div_consttime(BIGNUM *quotient, BIGNUM *remainder,
   r->neg = 0;
 
   // Incorporate |numerator| into |r|, one bit at a time, reducing after each
-  // step. At the start of each loop iteration, |r| < |divisor|
-  for (int i = numerator->width - 1; i >= 0; i--) {
+  // step. We maintain the invariant that |0 <= r < divisor| and
+  // |q * divisor + r = n| where |n| is the portion of |numerator| incorporated
+  // so far.
+  //
+  // First, we short-circuit the loop: if we know |divisor| has at least
+  // |divisor_min_bits| bits, the top |divisor_min_bits - 1| can be incorporated
+  // without reductions. This significantly speeds up |RSA_check_key|. For
+  // simplicity, we round down to a whole number of words.
+  assert(divisor_min_bits <= BN_num_bits(divisor));
+  int initial_words = 0;
+  if (divisor_min_bits > 0) {
+    initial_words = (divisor_min_bits - 1) / BN_BITS2;
+    if (initial_words > numerator->width) {
+      initial_words = numerator->width;
+    }
+    OPENSSL_memcpy(r->d, numerator->d + numerator->width - initial_words,
+                   initial_words * sizeof(BN_ULONG));
+  }
+
+  for (int i = numerator->width - initial_words - 1; i >= 0; i--) {
     for (int bit = BN_BITS2 - 1; bit >= 0; bit--) {
       // Incorporate the next bit of the numerator, by computing
       // r = 2*r or 2*r + 1. Note the result fits in one more word. We store the

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/bn/gcd_extra.c

@@ -157,10 +157,11 @@ int bn_lcm_consttime(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx) {
   BN_CTX_start(ctx);
   unsigned shift;
   BIGNUM *gcd = BN_CTX_get(ctx);
-  int ret = gcd != NULL &&
+  int ret = gcd != NULL &&  //
             bn_mul_consttime(r, a, b, ctx) &&
             bn_gcd_consttime(gcd, &shift, a, b, ctx) &&
-            bn_div_consttime(r, NULL, r, gcd, ctx) &&
+            // |gcd| has a secret bit width.
+            bn_div_consttime(r, NULL, r, gcd, /*divisor_min_bits=*/0, ctx) &&
             bn_rshift_secret_shift(r, r, shift, ctx);
   BN_CTX_end(ctx);
   return ret;

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/bn/internal.h

@@ -552,12 +552,15 @@ int bn_sqr_consttime(BIGNUM *r, const BIGNUM *a, BN_CTX *ctx);
 // bn_div_consttime behaves like |BN_div|, but it rejects negative inputs and
 // treats both inputs, including their magnitudes, as secret. It is, as a
 // result, much slower than |BN_div| and should only be used for rare operations
-// where Montgomery reduction is not available.
+// where Montgomery reduction is not available. |divisor_min_bits| is a
+// public lower bound for |BN_num_bits(divisor)|. When |divisor|'s bit width is
+// public, this can speed up the operation.
 //
 // Note that |quotient->width| will be set pessimally to |numerator->width|.
 OPENSSL_EXPORT int bn_div_consttime(BIGNUM *quotient, BIGNUM *remainder,
                                     const BIGNUM *numerator,
-                                    const BIGNUM *divisor, BN_CTX *ctx);
+                                    const BIGNUM *divisor,
+                                    unsigned divisor_min_bits, BN_CTX *ctx);
 
 // bn_is_relatively_prime checks whether GCD(|x|, |y|) is one. On success, it
 // returns one and sets |*out_relatively_prime| to one if the GCD was one and

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/bn/sqrt.c

@@ -75,10 +75,8 @@ BIGNUM *BN_mod_sqrt(BIGNUM *in, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx) {
       if (ret == NULL) {
         ret = BN_new();
       }
-      if (ret == NULL) {
-        goto end;
-      }
-      if (!BN_set_word(ret, BN_is_bit_set(a, 0))) {
+      if (ret == NULL ||
+          !BN_set_word(ret, BN_is_bit_set(a, 0))) {
         if (ret != in) {
           BN_free(ret);
         }
@@ -88,17 +86,15 @@ BIGNUM *BN_mod_sqrt(BIGNUM *in, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx) {
     }
 
     OPENSSL_PUT_ERROR(BN, BN_R_P_IS_NOT_PRIME);
-    return (NULL);
+    return NULL;
   }
 
   if (BN_is_zero(a) || BN_is_one(a)) {
     if (ret == NULL) {
       ret = BN_new();
     }
-    if (ret == NULL) {
-      goto end;
-    }
-    if (!BN_set_word(ret, BN_is_one(a))) {
+    if (ret == NULL ||
+        !BN_set_word(ret, BN_is_one(a))) {
       if (ret != in) {
         BN_free(ret);
       }

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/cipher/e_aes.c

@@ -911,6 +911,16 @@ static int aead_aes_gcm_init_impl(struct aead_aes_gcm_ctx *gcm_ctx,
                                   size_t key_len, size_t tag_len) {
   const size_t key_bits = key_len * 8;
 
+  switch (key_bits) {
+    case 128:
+      boringssl_fips_inc_counter(fips_counter_evp_aes_128_gcm);
+      break;
+
+    case 256:
+      boringssl_fips_inc_counter(fips_counter_evp_aes_256_gcm);
+      break;
+  }
+
   if (key_bits != 128 && key_bits != 192 && key_bits != 256) {
     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_KEY_LENGTH);
     return 0;  // EVP_AEAD_CTX_init should catch this.

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/des/des.c

@@ -342,10 +342,10 @@ void DES_set_key(const DES_cblock *key, DES_key_schedule *schedule) {
 
     // table contained 0213 4657
     t2 = ((t << 16L) | (s & 0x0000ffffL)) & 0xffffffffL;
-    schedule->subkeys[i][0] = ROTATE(t2, 30) & 0xffffffffL;
+    schedule->subkeys[i][0] = CRYPTO_rotr_u32(t2, 30);
 
     t2 = ((s >> 16L) | (t & 0xffff0000L));
-    schedule->subkeys[i][1] = ROTATE(t2, 26) & 0xffffffffL;
+    schedule->subkeys[i][1] = CRYPTO_rotr_u32(t2, 26);
   }
 }
 
@@ -392,8 +392,8 @@ static void DES_encrypt1(uint32_t *data, const DES_key_schedule *ks, int enc) {
   // <71755.204@CompuServe.COM> for pointing this out.
   // clear the top bits on machines with 8byte longs
   // shift left by 2
-  r = ROTATE(r, 29) & 0xffffffffL;
-  l = ROTATE(l, 29) & 0xffffffffL;
+  r = CRYPTO_rotr_u32(r, 29);
+  l = CRYPTO_rotr_u32(l, 29);
 
   // I don't know if it is worth the effort of loop unrolling the
   // inner loop
@@ -434,8 +434,8 @@ static void DES_encrypt1(uint32_t *data, const DES_key_schedule *ks, int enc) {
   }
 
   // rotate and clear the top bits on machines with 8byte longs
-  l = ROTATE(l, 3) & 0xffffffffL;
-  r = ROTATE(r, 3) & 0xffffffffL;
+  l = CRYPTO_rotr_u32(l, 3);
+  r = CRYPTO_rotr_u32(r, 3);
 
   FP(r, l);
   data[0] = l;
@@ -454,8 +454,8 @@ static void DES_encrypt2(uint32_t *data, const DES_key_schedule *ks, int enc) {
   // sparc2. Thanks to Richard Outerbridge <71755.204@CompuServe.COM> for
   // pointing this out.
   // clear the top bits on machines with 8byte longs
-  r = ROTATE(r, 29) & 0xffffffffL;
-  l = ROTATE(l, 29) & 0xffffffffL;
+  r = CRYPTO_rotr_u32(r, 29);
+  l = CRYPTO_rotr_u32(l, 29);
 
   // I don't know if it is worth the effort of loop unrolling the
   // inner loop
@@ -495,8 +495,8 @@ static void DES_encrypt2(uint32_t *data, const DES_key_schedule *ks, int enc) {
     D_ENCRYPT(ks, r, l, 0);
   }
   // rotate and clear the top bits on machines with 8byte longs
-  data[0] = ROTATE(l, 3) & 0xffffffffL;
-  data[1] = ROTATE(r, 3) & 0xffffffffL;
+  data[0] = CRYPTO_rotr_u32(l, 3);
+  data[1] = CRYPTO_rotr_u32(r, 3);
 }
 
 void DES_encrypt3(uint32_t *data, const DES_key_schedule *ks1,
@@ -782,4 +782,3 @@ void DES_set_key_unchecked(const DES_cblock *key, DES_key_schedule *schedule) {
 #undef D_ENCRYPT
 #undef ITERATIONS
 #undef HALF_ITERATIONS
-#undef ROTATE

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/des/internal.h

@@ -218,7 +218,7 @@ how to use xors :-) I got it to its final state.
 #define D_ENCRYPT(ks, LL, R, S)                                                \
   do {                                                                         \
     LOAD_DATA(ks, R, S, u, t, E0, E1);                                         \
-    t = ROTATE(t, 4);                                                          \
+    t = CRYPTO_rotr_u32(t, 4);                                                 \
     (LL) ^=                                                                    \
         DES_SPtrans[0][(u >> 2L) & 0x3f] ^ DES_SPtrans[2][(u >> 10L) & 0x3f] ^ \
         DES_SPtrans[4][(u >> 18L) & 0x3f] ^                                    \
@@ -230,8 +230,6 @@ how to use xors :-) I got it to its final state.
 #define ITERATIONS 16
 #define HALF_ITERATIONS 8
 
-#define ROTATE(a, n) (((a) >> (n)) + ((a) << (32 - (n))))
-
 
 #if defined(__cplusplus)
 }  // extern C

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/digest/digest.c

@@ -68,6 +68,8 @@
 
 int EVP_MD_type(const EVP_MD *md) { return md->type; }
 
+int EVP_MD_nid(const EVP_MD *md) { return EVP_MD_type(md); }
+
 uint32_t EVP_MD_flags(const EVP_MD *md) { return md->flags; }
 
 size_t EVP_MD_size(const EVP_MD *md) { return md->md_size; }

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/md4/md4.c

@@ -72,7 +72,7 @@ uint8_t *MD4(const uint8_t *data, size_t len, uint8_t out[MD4_DIGEST_LENGTH]) {
   return out;
 }
 
-// Implemented from RFC1186 The MD4 Message-Digest Algorithm.
+// Implemented from RFC 1186 The MD4 Message-Digest Algorithm.
 
 int MD4_Init(MD4_CTX *md4) {
   OPENSSL_memset(md4, 0, sizeof(MD4_CTX));
@@ -113,24 +113,22 @@ int MD4_Final(uint8_t out[MD4_DIGEST_LENGTH], MD4_CTX *c) {
 #define G(b, c, d) (((b) & (c)) | ((b) & (d)) | ((c) & (d)))
 #define H(b, c, d) ((b) ^ (c) ^ (d))
 
-#define ROTATE(a, n) (((a) << (n)) | ((a) >> (32 - (n))))
-
 #define R0(a, b, c, d, k, s, t)            \
   do {                                     \
     (a) += ((k) + (t) + F((b), (c), (d))); \
-    (a) = ROTATE(a, s);                    \
+    (a) = CRYPTO_rotl_u32(a, s);           \
   } while (0)
 
 #define R1(a, b, c, d, k, s, t)            \
   do {                                     \
     (a) += ((k) + (t) + G((b), (c), (d))); \
-    (a) = ROTATE(a, s);                    \
+    (a) = CRYPTO_rotl_u32(a, s);           \
   } while (0)
 
 #define R2(a, b, c, d, k, s, t)            \
   do {                                     \
     (a) += ((k) + (t) + H((b), (c), (d))); \
-    (a) = ROTATE(a, s);                    \
+    (a) = CRYPTO_rotl_u32(a, s);           \
   } while (0)
 
 void md4_block_data_order(uint32_t *state, const uint8_t *data, size_t num) {
@@ -237,7 +235,6 @@ void md4_block_data_order(uint32_t *state, const uint8_t *data, size_t num) {
 #undef F
 #undef G
 #undef H
-#undef ROTATE
 #undef R0
 #undef R1
 #undef R2

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/md5/md5.c

@@ -119,33 +119,31 @@ int MD5_Final(uint8_t out[MD5_DIGEST_LENGTH], MD5_CTX *c) {
 #define H(b, c, d) ((b) ^ (c) ^ (d))
 #define I(b, c, d) (((~(d)) | (b)) ^ (c))
 
-#define ROTATE(a, n) (((a) << (n)) | ((a) >> (32 - (n))))
-
 #define R0(a, b, c, d, k, s, t)            \
   do {                                     \
     (a) += ((k) + (t) + F((b), (c), (d))); \
-    (a) = ROTATE(a, s);                    \
+    (a) = CRYPTO_rotl_u32(a, s);           \
     (a) += (b);                            \
   } while (0)
 
 #define R1(a, b, c, d, k, s, t)            \
   do {                                     \
     (a) += ((k) + (t) + G((b), (c), (d))); \
-    (a) = ROTATE(a, s);                    \
+    (a) = CRYPTO_rotl_u32(a, s);           \
     (a) += (b);                            \
   } while (0)
 
 #define R2(a, b, c, d, k, s, t)            \
   do {                                     \
     (a) += ((k) + (t) + H((b), (c), (d))); \
-    (a) = ROTATE(a, s);                    \
+    (a) = CRYPTO_rotl_u32(a, s);           \
     (a) += (b);                            \
   } while (0)
 
 #define R3(a, b, c, d, k, s, t)            \
   do {                                     \
     (a) += ((k) + (t) + I((b), (c), (d))); \
-    (a) = ROTATE(a, s);                    \
+    (a) = CRYPTO_rotl_u32(a, s);           \
     (a) += (b);                            \
   } while (0)
 
@@ -280,7 +278,6 @@ static void md5_block_data_order(uint32_t *state, const uint8_t *data,
 #undef G
 #undef H
 #undef I
-#undef ROTATE
 #undef R0
 #undef R1
 #undef R2

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/modes/gcm_nohw.c

@@ -193,7 +193,7 @@ static void gcm_mul64_nohw(uint64_t *out_lo, uint64_t *out_hi, uint64_t a,
 #endif  // BORINGSSL_HAS_UINT128
 
 void gcm_init_nohw(u128 Htable[16], const uint64_t Xi[2]) {
-  // We implement GHASH in terms of POLYVAL, as described in RFC8452. This
+  // We implement GHASH in terms of POLYVAL, as described in RFC 8452. This
   // avoids a shift by 1 in the multiplication, needed to account for bit
   // reversal losing a bit after multiplication, that is,
   // rev128(X) * rev128(Y) = rev255(X*Y).

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/rand/internal.h

@@ -65,16 +65,16 @@ void RAND_need_entropy(size_t bytes_needed);
 // system.
 void CRYPTO_sysrand(uint8_t *buf, size_t len);
 
-#if defined(OPENSSL_URANDOM)
-// CRYPTO_init_sysrand initializes long-lived resources needed to draw entropy
-// from the operating system.
-void CRYPTO_init_sysrand(void);
-
 // CRYPTO_sysrand_for_seed fills |len| bytes at |buf| with entropy from the
 // operating system. It may draw from the |GRND_RANDOM| pool on Android,
 // depending on the vendor's configuration.
 void CRYPTO_sysrand_for_seed(uint8_t *buf, size_t len);
 
+#if defined(OPENSSL_URANDOM)
+// CRYPTO_init_sysrand initializes long-lived resources needed to draw entropy
+// from the operating system.
+void CRYPTO_init_sysrand(void);
+
 // CRYPTO_sysrand_if_available fills |len| bytes at |buf| with entropy from the
 // operating system, or early /dev/urandom data, and returns 1, _if_ the entropy
 // pool is initialized or if getrandom() is not available and not in FIPS mode.
@@ -84,10 +84,6 @@ int CRYPTO_sysrand_if_available(uint8_t *buf, size_t len);
 #else
 OPENSSL_INLINE void CRYPTO_init_sysrand(void) {}
 
-OPENSSL_INLINE void CRYPTO_sysrand_for_seed(uint8_t *buf, size_t len) {
-  CRYPTO_sysrand(buf, len);
-}
-
 OPENSSL_INLINE int CRYPTO_sysrand_if_available(uint8_t *buf, size_t len) {
   CRYPTO_sysrand(buf, len);
   return 1;

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/rand/rand.c

@@ -293,7 +293,7 @@ static void rand_get_seed(struct rand_thread_state *state,
                           int *out_used_cpu) {
   // If not in FIPS mode, we don't overread from the system entropy source and
   // we don't depend only on the hardware RDRAND.
-  CRYPTO_sysrand(seed, CTR_DRBG_ENTROPY_LEN);
+  CRYPTO_sysrand_for_seed(seed, CTR_DRBG_ENTROPY_LEN);
   *out_used_cpu = 0;
 }
 
@@ -356,7 +356,7 @@ void RAND_bytes_with_additional_data(uint8_t *out, size_t out_len,
     int used_cpu;
     rand_get_seed(state, seed, &used_cpu);
 
-    uint8_t personalization[CTR_DRBG_ENTROPY_LEN];
+    uint8_t personalization[CTR_DRBG_ENTROPY_LEN] = {0};
     size_t personalization_len = 0;
 #if defined(OPENSSL_URANDOM)
     // If we used RDRAND, also opportunistically read from the system. This

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/rand/urandom.c

@@ -367,6 +367,10 @@ static int fill_with_entropy(uint8_t *out, size_t len, int block, int seed) {
   return 1;
 }
 
+void CRYPTO_init_sysrand(void) {
+  CRYPTO_once(rand_once_bss_get(), init_once);
+}
+
 // CRYPTO_sysrand puts |requested| random bytes into |out|.
 void CRYPTO_sysrand(uint8_t *out, size_t requested) {
   if (!fill_with_entropy(out, requested, /*block=*/1, /*seed=*/0)) {
@@ -375,18 +379,12 @@ void CRYPTO_sysrand(uint8_t *out, size_t requested) {
   }
 }
 
-void CRYPTO_init_sysrand(void) {
-  CRYPTO_once(rand_once_bss_get(), init_once);
-}
-
-#if defined(BORINGSSL_FIPS)
 void CRYPTO_sysrand_for_seed(uint8_t *out, size_t requested) {
   if (!fill_with_entropy(out, requested, /*block=*/1, /*seed=*/1)) {
     perror("entropy fill failed");
     abort();
   }
 }
-#endif  // BORINGSSL_FIPS
 
 int CRYPTO_sysrand_if_available(uint8_t *out, size_t requested) {
   if (fill_with_entropy(out, requested, /*block=*/0, /*seed=*/0)) {