grpc 1.40.0 → 1.46.3

data/third_party/boringssl-with-bazel/src/crypto/cipher_extra/cipher_extra.c

@@ -67,25 +67,42 @@
 #include "../internal.h"
 
 
+static const struct {
+  int nid;
+  const char *name;
+  const EVP_CIPHER *(*func)(void);
+} kCiphers[] = {
+    {NID_aes_128_cbc, "aes-128-cbc", EVP_aes_128_cbc},
+    {NID_aes_128_ctr, "aes-128-ctr", EVP_aes_128_ctr},
+    {NID_aes_128_ecb, "aes-128-ecb", EVP_aes_128_ecb},
+    {NID_aes_128_gcm, "aes-128-gcm", EVP_aes_128_gcm},
+    {NID_aes_128_ofb128, "aes-128-ofb", EVP_aes_128_ofb},
+    {NID_aes_192_cbc, "aes-192-cbc", EVP_aes_192_cbc},
+    {NID_aes_192_ctr, "aes-192-ctr", EVP_aes_192_ctr},
+    {NID_aes_192_ecb, "aes-192-ecb", EVP_aes_192_ecb},
+    {NID_aes_192_gcm, "aes-192-gcm", EVP_aes_192_gcm},
+    {NID_aes_192_ofb128, "aes-192-ofb", EVP_aes_192_ofb},
+    {NID_aes_256_cbc, "aes-256-cbc", EVP_aes_256_cbc},
+    {NID_aes_256_ctr, "aes-256-ctr", EVP_aes_256_ctr},
+    {NID_aes_256_ecb, "aes-256-ecb", EVP_aes_256_ecb},
+    {NID_aes_256_gcm, "aes-256-gcm", EVP_aes_256_gcm},
+    {NID_aes_256_ofb128, "aes-256-ofb", EVP_aes_256_ofb},
+    {NID_des_cbc, "des-cbc", EVP_des_cbc},
+    {NID_des_ecb, "des-ecb", EVP_des_ecb},
+    {NID_des_ede_cbc, "des-ede-cbc", EVP_des_ede_cbc},
+    {NID_des_ede_ecb, "des-ede", EVP_des_ede},
+    {NID_des_ede3_cbc, "des-ede3-cbc", EVP_des_ede3_cbc},
+    {NID_rc2_cbc, "rc2-cbc", EVP_rc2_cbc},
+    {NID_rc4, "rc4", EVP_rc4},
+};
+
 const EVP_CIPHER *EVP_get_cipherbynid(int nid) {
-  switch (nid) {
-    case NID_rc2_cbc:
-      return EVP_rc2_cbc();
-    case NID_rc2_40_cbc:
-      return EVP_rc2_40_cbc();
-    case NID_des_ede3_cbc:
-      return EVP_des_ede3_cbc();
-    case NID_des_ede_cbc:
-      return EVP_des_cbc();
-    case NID_aes_128_cbc:
-      return EVP_aes_128_cbc();
-    case NID_aes_192_cbc:
-      return EVP_aes_192_cbc();
-    case NID_aes_256_cbc:
-      return EVP_aes_256_cbc();
-    default:
-      return NULL;
+  for (size_t i = 0; i < OPENSSL_ARRAY_SIZE(kCiphers); i++) {
+    if (kCiphers[i].nid == nid) {
+      return kCiphers[i].func();
+    }
   }
+  return NULL;
 }
 
 const EVP_CIPHER *EVP_get_cipherbyname(const char *name) {
@@ -93,54 +110,17 @@ const EVP_CIPHER *EVP_get_cipherbyname(const char *name) {
     return NULL;
   }
 
-  if (OPENSSL_strcasecmp(name, "rc4") == 0) {
-    return EVP_rc4();
-  } else if (OPENSSL_strcasecmp(name, "des-cbc") == 0) {
-    return EVP_des_cbc();
-  } else if (OPENSSL_strcasecmp(name, "des-ede3-cbc") == 0 ||
-             // This is not a name used by OpenSSL, but tcpdump registers it
-             // with |EVP_add_cipher_alias|. Our |EVP_add_cipher_alias| is a
-             // no-op, so we support the name here.
-             OPENSSL_strcasecmp(name, "3des") == 0) {
-    return EVP_des_ede3_cbc();
-  } else if (OPENSSL_strcasecmp(name, "aes-128-cbc") == 0) {
-    return EVP_aes_128_cbc();
-  } else if (OPENSSL_strcasecmp(name, "aes-192-cbc") == 0) {
-    return EVP_aes_192_cbc();
-  } else if (OPENSSL_strcasecmp(name, "aes-256-cbc") == 0) {
-    return EVP_aes_256_cbc();
-  } else if (OPENSSL_strcasecmp(name, "aes-128-ctr") == 0) {
-    return EVP_aes_128_ctr();
-  } else if (OPENSSL_strcasecmp(name, "aes-192-ctr") == 0) {
-    return EVP_aes_192_ctr();
-  } else if (OPENSSL_strcasecmp(name, "aes-256-ctr") == 0) {
-    return EVP_aes_256_ctr();
-  } else if (OPENSSL_strcasecmp(name, "aes-128-ecb") == 0) {
-    return EVP_aes_128_ecb();
-  } else if (OPENSSL_strcasecmp(name, "aes-192-ecb") == 0) {
-    return EVP_aes_192_ecb();
-  } else if (OPENSSL_strcasecmp(name, "aes-256-ecb") == 0) {
-    return EVP_aes_256_ecb();
-  } else if (OPENSSL_strcasecmp(name, "aes-128-gcm") == 0) {
-    return EVP_aes_128_gcm();
-  } else if (OPENSSL_strcasecmp(name, "aes-192-gcm") == 0) {
-    return EVP_aes_192_gcm();
-  } else if (OPENSSL_strcasecmp(name, "aes-256-gcm") == 0) {
-    return EVP_aes_256_gcm();
-  } else if (OPENSSL_strcasecmp(name, "aes-128-ofb") == 0) {
-    return EVP_aes_128_ofb();
-  } else if (OPENSSL_strcasecmp(name, "aes-192-ofb") == 0) {
-    return EVP_aes_192_ofb();
-  } else if (OPENSSL_strcasecmp(name, "aes-256-ofb") == 0) {
-    return EVP_aes_256_ofb();
-  } else if (OPENSSL_strcasecmp(name, "des-ecb") == 0) {
-    return EVP_des_ecb();
-  } else if (OPENSSL_strcasecmp(name, "des-ede") == 0) {
-    return EVP_des_ede();
-  } else if (OPENSSL_strcasecmp(name, "des-ede-cbc") == 0) {
-    return EVP_des_ede_cbc();
-  } else if (OPENSSL_strcasecmp(name, "rc2-cbc") == 0) {
-    return EVP_rc2_cbc();
+  // This is not a name used by OpenSSL, but tcpdump registers it with
+  // |EVP_add_cipher_alias|. Our |EVP_add_cipher_alias| is a no-op, so we
+  // support the name here.
+  if (OPENSSL_strcasecmp(name, "3des") == 0) {
+    name = "des-ede3-cbc";
+  }
+
+  for (size_t i = 0; i < OPENSSL_ARRAY_SIZE(kCiphers); i++) {
+    if (OPENSSL_strcasecmp(kCiphers[i].name, name) == 0) {
+      return kCiphers[i].func();
+    }
   }
 
   return NULL;

data/third_party/boringssl-with-bazel/src/crypto/conf/conf.c

@@ -68,6 +68,7 @@
 #include "conf_def.h"
 #include "internal.h"
 #include "../internal.h"
+#include "../lhash/internal.h"
 
 
 DEFINE_LHASH_OF(CONF_VALUE)
@@ -76,12 +77,16 @@ struct conf_st {
   LHASH_OF(CONF_VALUE) *data;
 };
 
+static const char kDefaultSectionName[] = "default";
+
 // The maximum length we can grow a value to after variable expansion. 64k
 // should be more than enough for all reasonable uses.
 #define MAX_CONF_VALUE_LENGTH 65536
 
 static uint32_t conf_value_hash(const CONF_VALUE *v) {
-  return (lh_strhash(v->section) << 2) ^ lh_strhash(v->name);
+  const uint32_t section_hash = v->section ? OPENSSL_strhash(v->section) : 0;
+  const uint32_t name_hash = v->name ? OPENSSL_strhash(v->name) : 0;
+  return (section_hash << 2) ^ name_hash;
 }
 
 static int conf_value_cmp(const CONF_VALUE *a, const CONF_VALUE *b) {
@@ -155,12 +160,14 @@ static void value_free(CONF_VALUE *value) {
   OPENSSL_free(value);
 }
 
+static void value_free_arg(CONF_VALUE *value, void *arg) { value_free(value); }
+
 void NCONF_free(CONF *conf) {
   if (conf == NULL || conf->data == NULL) {
     return;
   }
 
-  lh_CONF_VALUE_doall(conf->data, value_free);
+  lh_CONF_VALUE_doall_arg(conf->data, value_free_arg, NULL);
   lh_CONF_VALUE_free(conf->data);
   OPENSSL_free(conf);
 }
@@ -390,6 +397,10 @@ const char *NCONF_get_string(const CONF *conf, const char *section,
                              const char *name) {
   CONF_VALUE template, *value;
 
+  if (section == NULL) {
+    section = kDefaultSectionName;
+  }
+
   OPENSSL_memset(&template, 0, sizeof(template));
   template.section = (char *) section;
   template.name = (char *) name;
@@ -538,7 +549,7 @@ static int def_load_bio(CONF *conf, BIO *in, long *out_error_line) {
     goto err;
   }
 
-  section = OPENSSL_strdup("default");
+  section = OPENSSL_strdup(kDefaultSectionName);
   if (section == NULL) {
     OPENSSL_PUT_ERROR(CONF, ERR_R_MALLOC_FAILURE);
     goto err;

data/third_party/boringssl-with-bazel/src/crypto/digest_extra/digest_extra.c

@@ -58,11 +58,12 @@
 
 #include <string.h>
 
-#include <openssl/asn1.h>
 #include <openssl/blake2.h>
 #include <openssl/bytestring.h>
+#include <openssl/obj.h>
 #include <openssl/nid.h>
 
+#include "../asn1/internal.h"
 #include "../internal.h"
 #include "../fipsmodule/digest/internal.h"
 
@@ -82,6 +83,7 @@ static const struct nid_to_digest nid_to_digest_mapping[] = {
     {NID_sha256, EVP_sha256, SN_sha256, LN_sha256},
     {NID_sha384, EVP_sha384, SN_sha384, LN_sha384},
     {NID_sha512, EVP_sha512, SN_sha512, LN_sha512},
+    {NID_sha512_256, EVP_sha512_256, SN_sha512_256, LN_sha512_256},
     {NID_md5_sha1, EVP_md5_sha1, SN_md5_sha1, LN_md5_sha1},
     // As a remnant of signing |EVP_MD|s, OpenSSL returned the corresponding
     // hash function when given a signature OID. To avoid unintended lax parsing
@@ -152,13 +154,14 @@ static const EVP_MD *cbs_to_md(const CBS *cbs) {
 }
 
 const EVP_MD *EVP_get_digestbyobj(const ASN1_OBJECT *obj) {
-  // Handle objects with no corresponding OID.
+  // Handle objects with no corresponding OID. Note we don't use |OBJ_obj2nid|
+  // here to avoid pulling in the OID table.
   if (obj->nid != NID_undef) {
     return EVP_get_digestbynid(obj->nid);
   }
 
   CBS cbs;
-  CBS_init(&cbs, obj->data, obj->length);
+  CBS_init(&cbs, OBJ_get0_data(obj), OBJ_length(obj));
   return cbs_to_md(&cbs);
 }
 

data/third_party/boringssl-with-bazel/src/crypto/dsa/dsa.c

@@ -550,6 +550,27 @@ void DSA_SIG_free(DSA_SIG *sig) {
   OPENSSL_free(sig);
 }
 
+void DSA_SIG_get0(const DSA_SIG *sig, const BIGNUM **out_r,
+                  const BIGNUM **out_s) {
+  if (out_r != NULL) {
+    *out_r = sig->r;
+  }
+  if (out_s != NULL) {
+    *out_s = sig->s;
+  }
+}
+
+int DSA_SIG_set0(DSA_SIG *sig, BIGNUM *r, BIGNUM *s) {
+  if (r == NULL || s == NULL) {
+    return 0;
+  }
+  BN_free(sig->r);
+  BN_free(sig->s);
+  sig->r = r;
+  sig->s = s;
+  return 1;
+}
+
 // mod_mul_consttime sets |r| to |a| * |b| modulo |mont->N|, treating |a| and
 // |b| as secret. This function internally uses Montgomery reduction, but
 // neither inputs nor outputs are in Montgomery form.

data/third_party/boringssl-with-bazel/src/crypto/evp/evp_asn1.c

@@ -369,8 +369,8 @@ EVP_PKEY *d2i_PublicKey(int type, EVP_PKEY **out, const uint8_t **inp,
     // Unlike OpenSSL, we do not support EC keys with this API. The raw EC
     // public key serialization requires knowing the group. In OpenSSL, calling
     // this function with |EVP_PKEY_EC| and setting |out| to NULL does not work.
-    // It requires |*out| to include a partially-initiazed |EVP_PKEY| to extract
-    // the group.
+    // It requires |*out| to include a partially-initialized |EVP_PKEY| to
+    // extract the group.
     default:
       OPENSSL_PUT_ERROR(EVP, EVP_R_UNSUPPORTED_PUBLIC_KEY_TYPE);
       goto err;

data/third_party/boringssl-with-bazel/src/crypto/evp/scrypt.c

@@ -32,8 +32,6 @@ typedef struct { uint32_t words[16]; } block_t;
 
 OPENSSL_STATIC_ASSERT(sizeof(block_t) == 64, "block_t has padding");
 
-#define R(a, b) (((a) << (b)) | ((a) >> (32 - (b))))
-
 // salsa208_word_specification implements the Salsa20/8 core function, also
 // described in RFC 7914, section 3. It modifies the block at |inout|
 // in-place.
@@ -42,38 +40,38 @@ static void salsa208_word_specification(block_t *inout) {
   OPENSSL_memcpy(&x, inout, sizeof(x));
 
   for (int i = 8; i > 0; i -= 2) {
-    x.words[4] ^= R(x.words[0] + x.words[12], 7);
-    x.words[8] ^= R(x.words[4] + x.words[0], 9);
-    x.words[12] ^= R(x.words[8] + x.words[4], 13);
-    x.words[0] ^= R(x.words[12] + x.words[8], 18);
-    x.words[9] ^= R(x.words[5] + x.words[1], 7);
-    x.words[13] ^= R(x.words[9] + x.words[5], 9);
-    x.words[1] ^= R(x.words[13] + x.words[9], 13);
-    x.words[5] ^= R(x.words[1] + x.words[13], 18);
-    x.words[14] ^= R(x.words[10] + x.words[6], 7);
-    x.words[2] ^= R(x.words[14] + x.words[10], 9);
-    x.words[6] ^= R(x.words[2] + x.words[14], 13);
-    x.words[10] ^= R(x.words[6] + x.words[2], 18);
-    x.words[3] ^= R(x.words[15] + x.words[11], 7);
-    x.words[7] ^= R(x.words[3] + x.words[15], 9);
-    x.words[11] ^= R(x.words[7] + x.words[3], 13);
-    x.words[15] ^= R(x.words[11] + x.words[7], 18);
-    x.words[1] ^= R(x.words[0] + x.words[3], 7);
-    x.words[2] ^= R(x.words[1] + x.words[0], 9);
-    x.words[3] ^= R(x.words[2] + x.words[1], 13);
-    x.words[0] ^= R(x.words[3] + x.words[2], 18);
-    x.words[6] ^= R(x.words[5] + x.words[4], 7);
-    x.words[7] ^= R(x.words[6] + x.words[5], 9);
-    x.words[4] ^= R(x.words[7] + x.words[6], 13);
-    x.words[5] ^= R(x.words[4] + x.words[7], 18);
-    x.words[11] ^= R(x.words[10] + x.words[9], 7);
-    x.words[8] ^= R(x.words[11] + x.words[10], 9);
-    x.words[9] ^= R(x.words[8] + x.words[11], 13);
-    x.words[10] ^= R(x.words[9] + x.words[8], 18);
-    x.words[12] ^= R(x.words[15] + x.words[14], 7);
-    x.words[13] ^= R(x.words[12] + x.words[15], 9);
-    x.words[14] ^= R(x.words[13] + x.words[12], 13);
-    x.words[15] ^= R(x.words[14] + x.words[13], 18);
+    x.words[4] ^= CRYPTO_rotl_u32(x.words[0] + x.words[12], 7);
+    x.words[8] ^= CRYPTO_rotl_u32(x.words[4] + x.words[0], 9);
+    x.words[12] ^= CRYPTO_rotl_u32(x.words[8] + x.words[4], 13);
+    x.words[0] ^= CRYPTO_rotl_u32(x.words[12] + x.words[8], 18);
+    x.words[9] ^= CRYPTO_rotl_u32(x.words[5] + x.words[1], 7);
+    x.words[13] ^= CRYPTO_rotl_u32(x.words[9] + x.words[5], 9);
+    x.words[1] ^= CRYPTO_rotl_u32(x.words[13] + x.words[9], 13);
+    x.words[5] ^= CRYPTO_rotl_u32(x.words[1] + x.words[13], 18);
+    x.words[14] ^= CRYPTO_rotl_u32(x.words[10] + x.words[6], 7);
+    x.words[2] ^= CRYPTO_rotl_u32(x.words[14] + x.words[10], 9);
+    x.words[6] ^= CRYPTO_rotl_u32(x.words[2] + x.words[14], 13);
+    x.words[10] ^= CRYPTO_rotl_u32(x.words[6] + x.words[2], 18);
+    x.words[3] ^= CRYPTO_rotl_u32(x.words[15] + x.words[11], 7);
+    x.words[7] ^= CRYPTO_rotl_u32(x.words[3] + x.words[15], 9);
+    x.words[11] ^= CRYPTO_rotl_u32(x.words[7] + x.words[3], 13);
+    x.words[15] ^= CRYPTO_rotl_u32(x.words[11] + x.words[7], 18);
+    x.words[1] ^= CRYPTO_rotl_u32(x.words[0] + x.words[3], 7);
+    x.words[2] ^= CRYPTO_rotl_u32(x.words[1] + x.words[0], 9);
+    x.words[3] ^= CRYPTO_rotl_u32(x.words[2] + x.words[1], 13);
+    x.words[0] ^= CRYPTO_rotl_u32(x.words[3] + x.words[2], 18);
+    x.words[6] ^= CRYPTO_rotl_u32(x.words[5] + x.words[4], 7);
+    x.words[7] ^= CRYPTO_rotl_u32(x.words[6] + x.words[5], 9);
+    x.words[4] ^= CRYPTO_rotl_u32(x.words[7] + x.words[6], 13);
+    x.words[5] ^= CRYPTO_rotl_u32(x.words[4] + x.words[7], 18);
+    x.words[11] ^= CRYPTO_rotl_u32(x.words[10] + x.words[9], 7);
+    x.words[8] ^= CRYPTO_rotl_u32(x.words[11] + x.words[10], 9);
+    x.words[9] ^= CRYPTO_rotl_u32(x.words[8] + x.words[11], 13);
+    x.words[10] ^= CRYPTO_rotl_u32(x.words[9] + x.words[8], 18);
+    x.words[12] ^= CRYPTO_rotl_u32(x.words[15] + x.words[14], 7);
+    x.words[13] ^= CRYPTO_rotl_u32(x.words[12] + x.words[15], 9);
+    x.words[14] ^= CRYPTO_rotl_u32(x.words[13] + x.words[12], 13);
+    x.words[15] ^= CRYPTO_rotl_u32(x.words[14] + x.words[13], 18);
   }
 
   for (int i = 0; i < 16; ++i) {

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/bn/div.c

@@ -285,8 +285,10 @@ int BN_div(BIGNUM *quotient, BIGNUM *rem, const BIGNUM *numerator,
   // pointer to the 'top' of snum
   wnump = &(snum->d[num_n - 1]);
 
-  // Setup to 'res'
-  res->neg = (numerator->neg ^ divisor->neg);
+  // Setup |res|. |numerator| and |res| may alias, so we save |numerator->neg|
+  // for later.
+  const int numerator_neg = numerator->neg;
+  res->neg = (numerator_neg ^ divisor->neg);
   if (!bn_wexpand(res, loop + 1)) {
     goto err;
   }
@@ -379,14 +381,11 @@ int BN_div(BIGNUM *quotient, BIGNUM *rem, const BIGNUM *numerator,
   bn_set_minimal_width(snum);
 
   if (rem != NULL) {
-    // Keep a copy of the neg flag in numerator because if |rem| == |numerator|
-    // |BN_rshift| will overwrite it.
-    int neg = numerator->neg;
     if (!BN_rshift(rem, snum, norm_shift)) {
       goto err;
     }
     if (!BN_is_zero(rem)) {
-      rem->neg = neg;
+      rem->neg = numerator_neg;
     }
   }
 
@@ -457,7 +456,7 @@ void bn_mod_add_words(BN_ULONG *r, const BN_ULONG *a, const BN_ULONG *b,
 
 int bn_div_consttime(BIGNUM *quotient, BIGNUM *remainder,
                      const BIGNUM *numerator, const BIGNUM *divisor,
-                     BN_CTX *ctx) {
+                     unsigned divisor_min_bits, BN_CTX *ctx) {
   if (BN_is_negative(numerator) || BN_is_negative(divisor)) {
     OPENSSL_PUT_ERROR(BN, BN_R_NEGATIVE_NUMBER);
     return 0;
@@ -497,8 +496,26 @@ int bn_div_consttime(BIGNUM *quotient, BIGNUM *remainder,
   r->neg = 0;
 
   // Incorporate |numerator| into |r|, one bit at a time, reducing after each
-  // step. At the start of each loop iteration, |r| < |divisor|
-  for (int i = numerator->width - 1; i >= 0; i--) {
+  // step. We maintain the invariant that |0 <= r < divisor| and
+  // |q * divisor + r = n| where |n| is the portion of |numerator| incorporated
+  // so far.
+  //
+  // First, we short-circuit the loop: if we know |divisor| has at least
+  // |divisor_min_bits| bits, the top |divisor_min_bits - 1| can be incorporated
+  // without reductions. This significantly speeds up |RSA_check_key|. For
+  // simplicity, we round down to a whole number of words.
+  assert(divisor_min_bits <= BN_num_bits(divisor));
+  int initial_words = 0;
+  if (divisor_min_bits > 0) {
+    initial_words = (divisor_min_bits - 1) / BN_BITS2;
+    if (initial_words > numerator->width) {
+      initial_words = numerator->width;
+    }
+    OPENSSL_memcpy(r->d, numerator->d + numerator->width - initial_words,
+                   initial_words * sizeof(BN_ULONG));
+  }
+
+  for (int i = numerator->width - initial_words - 1; i >= 0; i--) {
     for (int bit = BN_BITS2 - 1; bit >= 0; bit--) {
       // Incorporate the next bit of the numerator, by computing
       // r = 2*r or 2*r + 1. Note the result fits in one more word. We store the

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/bn/gcd_extra.c

@@ -157,10 +157,11 @@ int bn_lcm_consttime(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx) {
   BN_CTX_start(ctx);
   unsigned shift;
   BIGNUM *gcd = BN_CTX_get(ctx);
-  int ret = gcd != NULL &&
+  int ret = gcd != NULL &&  //
             bn_mul_consttime(r, a, b, ctx) &&
             bn_gcd_consttime(gcd, &shift, a, b, ctx) &&
-            bn_div_consttime(r, NULL, r, gcd, ctx) &&
+            // |gcd| has a secret bit width.
+            bn_div_consttime(r, NULL, r, gcd, /*divisor_min_bits=*/0, ctx) &&
             bn_rshift_secret_shift(r, r, shift, ctx);
   BN_CTX_end(ctx);
   return ret;

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/bn/internal.h

@@ -552,12 +552,15 @@ int bn_sqr_consttime(BIGNUM *r, const BIGNUM *a, BN_CTX *ctx);
 // bn_div_consttime behaves like |BN_div|, but it rejects negative inputs and
 // treats both inputs, including their magnitudes, as secret. It is, as a
 // result, much slower than |BN_div| and should only be used for rare operations
-// where Montgomery reduction is not available.
+// where Montgomery reduction is not available. |divisor_min_bits| is a
+// public lower bound for |BN_num_bits(divisor)|. When |divisor|'s bit width is
+// public, this can speed up the operation.
 //
 // Note that |quotient->width| will be set pessimally to |numerator->width|.
 OPENSSL_EXPORT int bn_div_consttime(BIGNUM *quotient, BIGNUM *remainder,
                                     const BIGNUM *numerator,
-                                    const BIGNUM *divisor, BN_CTX *ctx);
+                                    const BIGNUM *divisor,
+                                    unsigned divisor_min_bits, BN_CTX *ctx);
 
 // bn_is_relatively_prime checks whether GCD(|x|, |y|) is one. On success, it
 // returns one and sets |*out_relatively_prime| to one if the GCD was one and

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/bn/sqrt.c

@@ -75,10 +75,8 @@ BIGNUM *BN_mod_sqrt(BIGNUM *in, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx) {
       if (ret == NULL) {
         ret = BN_new();
       }
-      if (ret == NULL) {
-        goto end;
-      }
-      if (!BN_set_word(ret, BN_is_bit_set(a, 0))) {
+      if (ret == NULL ||
+          !BN_set_word(ret, BN_is_bit_set(a, 0))) {
         if (ret != in) {
           BN_free(ret);
         }
@@ -88,17 +86,15 @@ BIGNUM *BN_mod_sqrt(BIGNUM *in, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx) {
     }
 
     OPENSSL_PUT_ERROR(BN, BN_R_P_IS_NOT_PRIME);
-    return (NULL);
+    return NULL;
   }
 
   if (BN_is_zero(a) || BN_is_one(a)) {
     if (ret == NULL) {
       ret = BN_new();
     }
-    if (ret == NULL) {
-      goto end;
-    }
-    if (!BN_set_word(ret, BN_is_one(a))) {
+    if (ret == NULL ||
+        !BN_set_word(ret, BN_is_one(a))) {
       if (ret != in) {
         BN_free(ret);
       }

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/cipher/cipher.c

@@ -629,6 +629,18 @@ int EVP_DecryptInit(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
   return EVP_CipherInit(ctx, cipher, key, iv, 0);
 }
 
+int EVP_CipherFinal(EVP_CIPHER_CTX *ctx, uint8_t *out, int *out_len) {
+  return EVP_CipherFinal_ex(ctx, out, out_len);
+}
+
+int EVP_EncryptFinal(EVP_CIPHER_CTX *ctx, uint8_t *out, int *out_len) {
+  return EVP_EncryptFinal_ex(ctx, out, out_len);
+}
+
+int EVP_DecryptFinal(EVP_CIPHER_CTX *ctx, uint8_t *out, int *out_len) {
+  return EVP_DecryptFinal_ex(ctx, out, out_len);
+}
+
 int EVP_add_cipher_alias(const char *a, const char *b) {
   return 1;
 }

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/cipher/e_aes.c

@@ -911,6 +911,16 @@ static int aead_aes_gcm_init_impl(struct aead_aes_gcm_ctx *gcm_ctx,
                                   size_t key_len, size_t tag_len) {
   const size_t key_bits = key_len * 8;
 
+  switch (key_bits) {
+    case 128:
+      boringssl_fips_inc_counter(fips_counter_evp_aes_128_gcm);
+      break;
+
+    case 256:
+      boringssl_fips_inc_counter(fips_counter_evp_aes_256_gcm);
+      break;
+  }
+
   if (key_bits != 128 && key_bits != 192 && key_bits != 256) {
     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_KEY_LENGTH);
     return 0;  // EVP_AEAD_CTX_init should catch this.

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/des/des.c

@@ -342,10 +342,10 @@ void DES_set_key(const DES_cblock *key, DES_key_schedule *schedule) {
 
     // table contained 0213 4657
     t2 = ((t << 16L) | (s & 0x0000ffffL)) & 0xffffffffL;
-    schedule->subkeys[i][0] = ROTATE(t2, 30) & 0xffffffffL;
+    schedule->subkeys[i][0] = CRYPTO_rotr_u32(t2, 30);
 
     t2 = ((s >> 16L) | (t & 0xffff0000L));
-    schedule->subkeys[i][1] = ROTATE(t2, 26) & 0xffffffffL;
+    schedule->subkeys[i][1] = CRYPTO_rotr_u32(t2, 26);
   }
 }
 
@@ -392,8 +392,8 @@ static void DES_encrypt1(uint32_t *data, const DES_key_schedule *ks, int enc) {
   // <71755.204@CompuServe.COM> for pointing this out.
   // clear the top bits on machines with 8byte longs
   // shift left by 2
-  r = ROTATE(r, 29) & 0xffffffffL;
-  l = ROTATE(l, 29) & 0xffffffffL;
+  r = CRYPTO_rotr_u32(r, 29);
+  l = CRYPTO_rotr_u32(l, 29);
 
   // I don't know if it is worth the effort of loop unrolling the
   // inner loop
@@ -434,8 +434,8 @@ static void DES_encrypt1(uint32_t *data, const DES_key_schedule *ks, int enc) {
   }
 
   // rotate and clear the top bits on machines with 8byte longs
-  l = ROTATE(l, 3) & 0xffffffffL;
-  r = ROTATE(r, 3) & 0xffffffffL;
+  l = CRYPTO_rotr_u32(l, 3);
+  r = CRYPTO_rotr_u32(r, 3);
 
   FP(r, l);
   data[0] = l;
@@ -454,8 +454,8 @@ static void DES_encrypt2(uint32_t *data, const DES_key_schedule *ks, int enc) {
   // sparc2. Thanks to Richard Outerbridge <71755.204@CompuServe.COM> for
   // pointing this out.
   // clear the top bits on machines with 8byte longs
-  r = ROTATE(r, 29) & 0xffffffffL;
-  l = ROTATE(l, 29) & 0xffffffffL;
+  r = CRYPTO_rotr_u32(r, 29);
+  l = CRYPTO_rotr_u32(l, 29);
 
   // I don't know if it is worth the effort of loop unrolling the
   // inner loop
@@ -495,8 +495,8 @@ static void DES_encrypt2(uint32_t *data, const DES_key_schedule *ks, int enc) {
     D_ENCRYPT(ks, r, l, 0);
   }
   // rotate and clear the top bits on machines with 8byte longs
-  data[0] = ROTATE(l, 3) & 0xffffffffL;
-  data[1] = ROTATE(r, 3) & 0xffffffffL;
+  data[0] = CRYPTO_rotr_u32(l, 3);
+  data[1] = CRYPTO_rotr_u32(r, 3);
 }
 
 void DES_encrypt3(uint32_t *data, const DES_key_schedule *ks1,
@@ -782,4 +782,3 @@ void DES_set_key_unchecked(const DES_cblock *key, DES_key_schedule *schedule) {
 #undef D_ENCRYPT
 #undef ITERATIONS
 #undef HALF_ITERATIONS
-#undef ROTATE

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/des/internal.h

@@ -218,7 +218,7 @@ how to use xors :-) I got it to its final state.
 #define D_ENCRYPT(ks, LL, R, S)                                                \
   do {                                                                         \
     LOAD_DATA(ks, R, S, u, t, E0, E1);                                         \
-    t = ROTATE(t, 4);                                                          \
+    t = CRYPTO_rotr_u32(t, 4);                                                 \
     (LL) ^=                                                                    \
         DES_SPtrans[0][(u >> 2L) & 0x3f] ^ DES_SPtrans[2][(u >> 10L) & 0x3f] ^ \
         DES_SPtrans[4][(u >> 18L) & 0x3f] ^                                    \
@@ -230,8 +230,6 @@ how to use xors :-) I got it to its final state.
 #define ITERATIONS 16
 #define HALF_ITERATIONS 8
 
-#define ROTATE(a, n) (((a) >> (n)) + ((a) << (32 - (n))))
-
 
 #if defined(__cplusplus)
 }  // extern C

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/digest/digest.c

@@ -68,6 +68,8 @@
 
 int EVP_MD_type(const EVP_MD *md) { return md->type; }
 
+int EVP_MD_nid(const EVP_MD *md) { return EVP_MD_type(md); }
+
 uint32_t EVP_MD_flags(const EVP_MD *md) { return md->flags; }
 
 size_t EVP_MD_size(const EVP_MD *md) { return md->md_size; }

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/ecdsa/ecdsa.c

@@ -68,8 +68,7 @@
 
 
 // digest_to_scalar interprets |digest_len| bytes from |digest| as a scalar for
-// ECDSA. Note this value is not fully reduced modulo the order, only the
-// correct number of bits.
+// ECDSA.
 static void digest_to_scalar(const EC_GROUP *group, EC_SCALAR *out,
                              const uint8_t *digest, size_t digest_len) {
   const BIGNUM *order = &group->order;