grpc 1.53.0.pre2 → 1.54.0

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/service_indicator/internal.h

@@ -0,0 +1,89 @@
+/* Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+
+#ifndef OPENSSL_HEADER_SERVICE_INDICATOR_INTERNAL_H
+#define OPENSSL_HEADER_SERVICE_INDICATOR_INTERNAL_H
+
+#include <openssl/base.h>
+#include <openssl/service_indicator.h>
+
+#if defined(BORINGSSL_FIPS)
+
+// FIPS_service_indicator_update_state records that an approved service has been
+// invoked.
+void FIPS_service_indicator_update_state(void);
+
+// FIPS_service_indicator_lock_state and |FIPS_service_indicator_unlock_state|
+// stop |FIPS_service_indicator_update_state| from actually updating the service
+// indicator. This is used when a primitive calls a potentially approved
+// primitive to avoid false positives. For example, just because a key
+// generation calls |RAND_bytes| (and thus the approved DRBG) doesn't mean that
+// the key generation operation itself is approved.
+//
+// This lock nests: i.e. locking twice is fine so long as each lock is paired
+// with an unlock. If the (64-bit) counter overflows, the process aborts.
+void FIPS_service_indicator_lock_state(void);
+void FIPS_service_indicator_unlock_state(void);
+
+// The following functions may call |FIPS_service_indicator_update_state| if
+// their parameter specifies an approved operation.
+
+void AEAD_GCM_verify_service_indicator(const EVP_AEAD_CTX *ctx);
+void AEAD_CCM_verify_service_indicator(const EVP_AEAD_CTX *ctx);
+void EC_KEY_keygen_verify_service_indicator(const EC_KEY *eckey);
+void ECDH_verify_service_indicator(const EC_KEY *ec_key);
+void EVP_Cipher_verify_service_indicator(const EVP_CIPHER_CTX *ctx);
+void EVP_DigestSign_verify_service_indicator(const EVP_MD_CTX *ctx);
+void EVP_DigestVerify_verify_service_indicator(const EVP_MD_CTX *ctx);
+void HMAC_verify_service_indicator(const EVP_MD *evp_md);
+void TLSKDF_verify_service_indicator(const EVP_MD *dgst);
+
+#else
+
+// Service indicator functions are no-ops in non-FIPS builds.
+
+OPENSSL_INLINE void FIPS_service_indicator_update_state(void) {}
+OPENSSL_INLINE void FIPS_service_indicator_lock_state(void) {}
+OPENSSL_INLINE void FIPS_service_indicator_unlock_state(void) {}
+
+OPENSSL_INLINE void AEAD_GCM_verify_service_indicator(
+    OPENSSL_UNUSED const EVP_AEAD_CTX *ctx) {}
+
+OPENSSL_INLINE void AEAD_CCM_verify_service_indicator(
+    OPENSSL_UNUSED const EVP_AEAD_CTX *ctx) {}
+
+OPENSSL_INLINE void EC_KEY_keygen_verify_service_indicator(
+    OPENSSL_UNUSED const EC_KEY *eckey) {}
+
+OPENSSL_INLINE void ECDH_verify_service_indicator(
+    OPENSSL_UNUSED const EC_KEY *ec_key) {}
+
+OPENSSL_INLINE void EVP_Cipher_verify_service_indicator(
+    OPENSSL_UNUSED const EVP_CIPHER_CTX *ctx) {}
+
+OPENSSL_INLINE void EVP_DigestSign_verify_service_indicator(
+    OPENSSL_UNUSED const EVP_MD_CTX *ctx) {}
+
+OPENSSL_INLINE void EVP_DigestVerify_verify_service_indicator(
+    OPENSSL_UNUSED const EVP_MD_CTX *ctx) {}
+
+OPENSSL_INLINE void HMAC_verify_service_indicator(
+    OPENSSL_UNUSED const EVP_MD *evp_md) {}
+
+OPENSSL_INLINE void TLSKDF_verify_service_indicator(
+    OPENSSL_UNUSED const EVP_MD *dgst) {}
+
+#endif  // BORINGSSL_FIPS
+
+#endif  // OPENSSL_HEADER_SERVICE_INDICATOR_INTERNAL_H

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/service_indicator/service_indicator.c

@@ -0,0 +1,334 @@
+/* Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+
+#include <openssl/crypto.h>
+#include <openssl/ec.h>
+#include <openssl/ec_key.h>
+#include <openssl/err.h>
+#include <openssl/evp.h>
+#include <openssl/service_indicator.h>
+
+#include "../../evp/internal.h"
+#include "../../internal.h"
+#include "internal.h"
+
+#if defined(BORINGSSL_FIPS)
+
+#define STATE_UNLOCKED 0
+
+// fips_service_indicator_state is a thread-local structure that stores the
+// state of the FIPS service indicator.
+struct fips_service_indicator_state {
+  // lock_state records the number of times the indicator has been locked.
+  // When it is zero (i.e. |STATE_UNLOCKED|) then the indicator can be updated.
+  uint64_t lock_state;
+  // counter is the indicator state. It is incremented when an approved service
+  // completes.
+  uint64_t counter;
+};
+
+// service_indicator_get returns a pointer to the |fips_service_indicator_state|
+// for the current thread. It returns NULL on error.
+//
+// FIPS 140-3 requires that the module should provide the service indicator
+// for approved services irrespective of whether the user queries it or not.
+// Hence, it is lazily initialized in any call to an approved service.
+static struct fips_service_indicator_state *service_indicator_get(void) {
+  struct fips_service_indicator_state *indicator = CRYPTO_get_thread_local(
+      OPENSSL_THREAD_LOCAL_FIPS_SERVICE_INDICATOR_STATE);
+
+  if (indicator == NULL) {
+    indicator = OPENSSL_malloc(sizeof(struct fips_service_indicator_state));
+    if (indicator == NULL) {
+      return NULL;
+    }
+
+    indicator->lock_state = STATE_UNLOCKED;
+    indicator->counter = 0;
+
+    if (!CRYPTO_set_thread_local(
+            OPENSSL_THREAD_LOCAL_FIPS_SERVICE_INDICATOR_STATE, indicator,
+            OPENSSL_free)) {
+      OPENSSL_PUT_ERROR(CRYPTO, ERR_R_INTERNAL_ERROR);
+      return NULL;
+    }
+  }
+
+  return indicator;
+}
+
+static uint64_t service_indicator_get_counter(void) {
+  struct fips_service_indicator_state *indicator = service_indicator_get();
+  if (indicator == NULL) {
+    return 0;
+  }
+  return indicator->counter;
+}
+
+uint64_t FIPS_service_indicator_before_call(void) {
+  return service_indicator_get_counter();
+}
+
+uint64_t FIPS_service_indicator_after_call(void) {
+  return service_indicator_get_counter();
+}
+
+void FIPS_service_indicator_update_state(void) {
+  struct fips_service_indicator_state *indicator = service_indicator_get();
+  if (indicator && indicator->lock_state == STATE_UNLOCKED) {
+    indicator->counter++;
+  }
+}
+
+void FIPS_service_indicator_lock_state(void) {
+  struct fips_service_indicator_state *indicator = service_indicator_get();
+  if (indicator == NULL) {
+    return;
+  }
+
+  // |FIPS_service_indicator_lock_state| and
+  // |FIPS_service_indicator_unlock_state| should not under/overflow in normal
+  // operation. They are still checked and errors added to facilitate testing in
+  // service_indicator_test.cc. This should only happen if lock/unlock are
+  // called in an incorrect order or multiple times in the same function.
+  const uint64_t new_state = indicator->lock_state + 1;
+  if (new_state < indicator->lock_state) {
+    // Overflow. This would imply that our call stack length has exceeded a
+    // |uint64_t| which impossible on a 64-bit system.
+    abort();
+  }
+
+  indicator->lock_state = new_state;
+}
+
+void FIPS_service_indicator_unlock_state(void) {
+  struct fips_service_indicator_state *indicator = service_indicator_get();
+  if (indicator == NULL) {
+    return;
+  }
+
+  if (indicator->lock_state == 0) {
+    abort();
+  }
+
+  indicator->lock_state--;
+}
+
+void AEAD_GCM_verify_service_indicator(const EVP_AEAD_CTX *ctx) {
+  const size_t key_len = EVP_AEAD_key_length(ctx->aead);
+  if (key_len == 16 || key_len == 32) {
+    FIPS_service_indicator_update_state();
+  }
+}
+
+void AEAD_CCM_verify_service_indicator(const EVP_AEAD_CTX *ctx) {
+  if (EVP_AEAD_key_length(ctx->aead) == 16 && ctx->tag_len == 4) {
+    FIPS_service_indicator_update_state();
+  }
+}
+
+// is_ec_fips_approved returns one if the curve corresponding to the given NID
+// is FIPS approved, and zero otherwise.
+static int is_ec_fips_approved(int curve_nid) {
+  switch (curve_nid) {
+    case NID_secp224r1:
+    case NID_X9_62_prime256v1:
+    case NID_secp384r1:
+    case NID_secp521r1:
+      return 1;
+    default:
+      return 0;
+  }
+}
+
+// is_md_fips_approved_for_signing returns one if the given message digest type
+// is FIPS approved for signing, and zero otherwise.
+static int is_md_fips_approved_for_signing(int md_type) {
+  switch (md_type) {
+    case NID_sha224:
+    case NID_sha256:
+    case NID_sha384:
+    case NID_sha512:
+    case NID_sha512_256:
+      return 1;
+    default:
+      return 0;
+  }
+}
+
+// is_md_fips_approved_for_verifying returns one if the given message digest
+// type is FIPS approved for verifying, and zero otherwise.
+static int is_md_fips_approved_for_verifying(int md_type) {
+  switch (md_type) {
+    case NID_sha1:
+    case NID_sha224:
+    case NID_sha256:
+    case NID_sha384:
+    case NID_sha512:
+    case NID_sha512_256:
+      return 1;
+    default:
+      return 0;
+  }
+}
+
+static void evp_md_ctx_verify_service_indicator(const EVP_MD_CTX *ctx,
+                                                int rsa_1024_ok,
+                                                int (*md_ok)(int md_type)) {
+  if (EVP_MD_CTX_md(ctx) == NULL) {
+    // Signature schemes without a prehash are currently never FIPS approved.
+    goto err;
+  }
+
+  EVP_PKEY_CTX *const pctx = ctx->pctx;
+  const EVP_PKEY *const pkey = EVP_PKEY_CTX_get0_pkey(pctx);
+  const int pkey_type = EVP_PKEY_id(pkey);
+  const int md_type = EVP_MD_CTX_type(ctx);
+
+  // EVP_PKEY_RSA_PSS SPKIs aren't supported.
+  if (pkey_type == EVP_PKEY_RSA) {
+    // Message digest used in the private key should be of the same type
+    // as the given one, so we extract the MD type from the |EVP_PKEY|
+    // and compare it with the type in |ctx|.
+    const EVP_MD *pctx_md;
+    if (!EVP_PKEY_CTX_get_signature_md(pctx, &pctx_md)) {
+      goto err;
+    }
+    if (EVP_MD_type(pctx_md) != md_type) {
+      goto err;
+    }
+
+    int padding;
+    if (!EVP_PKEY_CTX_get_rsa_padding(pctx, &padding)) {
+      goto err;
+    }
+    if (padding == RSA_PKCS1_PSS_PADDING) {
+      int salt_len;
+      const EVP_MD *mgf1_md;
+      if (!EVP_PKEY_CTX_get_rsa_pss_saltlen(pctx, &salt_len) ||
+          !EVP_PKEY_CTX_get_rsa_mgf1_md(pctx, &mgf1_md) ||
+          (salt_len != -1 && salt_len != (int)EVP_MD_size(pctx_md)) ||
+          EVP_MD_type(mgf1_md) != md_type) {
+        // Only PSS where saltLen == hashLen is tested with ACVP. Cases with
+        // non-standard padding functions are also excluded.
+        goto err;
+      }
+    }
+
+    // The approved RSA key sizes for signing are 2048, 3072 and 4096 bits.
+    // Note: |EVP_PKEY_size| returns the size in bytes.
+    size_t pkey_size = EVP_PKEY_size(ctx->pctx->pkey);
+
+    // Check if the MD type and the RSA key size are approved.
+    if (md_ok(md_type) &&
+        ((rsa_1024_ok && pkey_size == 128) || pkey_size == 256 ||
+         pkey_size == 384 || pkey_size == 512)) {
+      FIPS_service_indicator_update_state();
+    }
+  } else if (pkey_type == EVP_PKEY_EC) {
+    // Check if the MD type and the elliptic curve are approved.
+    if (md_ok(md_type) &&
+        is_ec_fips_approved(EC_GROUP_get_curve_name(
+            EC_KEY_get0_group(EVP_PKEY_get0_EC_KEY(ctx->pctx->pkey))))) {
+      FIPS_service_indicator_update_state();
+    }
+  }
+
+ err:
+  // Ensure that junk errors aren't left on the queue.
+  ERR_clear_error();
+}
+
+void EC_KEY_keygen_verify_service_indicator(const EC_KEY *eckey) {
+  if (is_ec_fips_approved(EC_GROUP_get_curve_name(eckey->group))) {
+    FIPS_service_indicator_update_state();
+  }
+}
+
+void ECDH_verify_service_indicator(const EC_KEY *ec_key) {
+  if (is_ec_fips_approved(EC_GROUP_get_curve_name(EC_KEY_get0_group(ec_key)))) {
+    FIPS_service_indicator_update_state();
+  }
+}
+
+void EVP_Cipher_verify_service_indicator(const EVP_CIPHER_CTX *ctx) {
+  switch (EVP_CIPHER_CTX_nid(ctx)) {
+    case NID_aes_128_ecb:
+    case NID_aes_192_ecb:
+    case NID_aes_256_ecb:
+
+    case NID_aes_128_cbc:
+    case NID_aes_192_cbc:
+    case NID_aes_256_cbc:
+
+    case NID_aes_128_ctr:
+    case NID_aes_192_ctr:
+    case NID_aes_256_ctr:
+      FIPS_service_indicator_update_state();
+  }
+}
+
+void EVP_DigestVerify_verify_service_indicator(const EVP_MD_CTX *ctx) {
+  return evp_md_ctx_verify_service_indicator(ctx, /*rsa_1024_ok=*/1,
+                                             is_md_fips_approved_for_verifying);
+}
+
+void EVP_DigestSign_verify_service_indicator(const EVP_MD_CTX *ctx) {
+  return evp_md_ctx_verify_service_indicator(ctx, /*rsa_1024_ok=*/0,
+                                             is_md_fips_approved_for_signing);
+}
+
+void HMAC_verify_service_indicator(const EVP_MD *evp_md) {
+  switch (evp_md->type) {
+    case NID_sha1:
+    case NID_sha224:
+    case NID_sha256:
+    case NID_sha384:
+    case NID_sha512:
+    case NID_sha512_256:
+      FIPS_service_indicator_update_state();
+      break;
+  }
+}
+
+void TLSKDF_verify_service_indicator(const EVP_MD *md) {
+  // HMAC-MD5, HMAC-SHA1, and HMAC-MD5/HMAC-SHA1 (both used concurrently) are
+  // approved for use in the KDF in TLS 1.0/1.1.
+  // HMAC-SHA{256, 384, 512} are approved for use in the KDF in TLS 1.2.
+  // These Key Derivation functions are to be used in the context of the TLS
+  // protocol.
+  switch (EVP_MD_type(md)) {
+    case NID_md5:
+    case NID_sha1:
+    case NID_md5_sha1:
+    case NID_sha256:
+    case NID_sha384:
+    case NID_sha512:
+      FIPS_service_indicator_update_state();
+      break;
+  }
+}
+
+#else
+
+uint64_t FIPS_service_indicator_before_call(void) { return 0; }
+
+uint64_t FIPS_service_indicator_after_call(void) {
+  // One is returned so that the return value is always greater than zero, the
+  // return value of |FIPS_service_indicator_before_call|. This makes everything
+  // report as "approved" in non-FIPS builds.
+  return 1;
+}
+
+#endif  // BORINGSSL_FIPS

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/sha/internal.h

@@ -22,23 +22,14 @@ extern "C" {
 #endif
 
 
-#if defined(OPENSSL_PPC64LE) ||                          \
-    (!defined(OPENSSL_NO_ASM) &&                         \
-     (defined(OPENSSL_X86) || defined(OPENSSL_X86_64) || \
-      defined(OPENSSL_ARM) || defined(OPENSSL_AARCH64)))
-// POWER has an intrinsics-based implementation of SHA-1 and thus the functions
-// normally defined in assembly are available even with |OPENSSL_NO_ASM| in
-// this case.
-#define SHA1_ASM
-void sha1_block_data_order(uint32_t *state, const uint8_t *in,
-                           size_t num_blocks);
-#endif
-
 #if !defined(OPENSSL_NO_ASM) &&                         \
     (defined(OPENSSL_X86) || defined(OPENSSL_X86_64) || \
      defined(OPENSSL_ARM) || defined(OPENSSL_AARCH64))
+#define SHA1_ASM
 #define SHA256_ASM
 #define SHA512_ASM
+void sha1_block_data_order(uint32_t *state, const uint8_t *in,
+                           size_t num_blocks);
 void sha256_block_data_order(uint32_t *state, const uint8_t *in,
                              size_t num_blocks);
 void sha512_block_data_order(uint64_t *state, const uint8_t *in,

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/sha/sha1.c

@@ -62,6 +62,7 @@
 
 #include "../../internal.h"
 #include "../digest/md32_common.h"
+#include "../service_indicator/internal.h"
 #include "internal.h"
 
 
@@ -108,6 +109,7 @@ int SHA1_Final(uint8_t out[SHA_DIGEST_LENGTH], SHA_CTX *c) {
   CRYPTO_store_u32_be(out + 8, c->h[2]);
   CRYPTO_store_u32_be(out + 12, c->h[3]);
   CRYPTO_store_u32_be(out + 16, c->h[4]);
+  FIPS_service_indicator_update_state();
   return 1;
 }
 

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/sha/sha256.c

@@ -62,6 +62,7 @@
 
 #include "../../internal.h"
 #include "../digest/md32_common.h"
+#include "../service_indicator/internal.h"
 #include "internal.h"
 
 
@@ -132,7 +133,7 @@ int SHA224_Update(SHA256_CTX *ctx, const void *data, size_t len) {
   return SHA256_Update(ctx, data, len);
 }
 
-static int sha256_final_impl(uint8_t *out, SHA256_CTX *c) {
+static int sha256_final_impl(uint8_t *out, size_t md_len, SHA256_CTX *c) {
   crypto_md32_final(&sha256_block_data_order, c->h, c->data, SHA256_CBLOCK,
                     &c->num, c->Nh, c->Nl, /*is_big_endian=*/1);
 
@@ -140,16 +141,18 @@ static int sha256_final_impl(uint8_t *out, SHA256_CTX *c) {
   // 'final' function can fail. SHA-512 does not have a corresponding check.
   // These functions already misbehave if the caller arbitrarily mutates |c|, so
   // can we assume one of |SHA256_Init| or |SHA224_Init| was used?
-  if (c->md_len > SHA256_DIGEST_LENGTH) {
+  if (md_len > SHA256_DIGEST_LENGTH) {
     return 0;
   }
 
-  assert(c->md_len % 4 == 0);
-  const size_t out_words = c->md_len / 4;
+  assert(md_len % 4 == 0);
+  const size_t out_words = md_len / 4;
   for (size_t i = 0; i < out_words; i++) {
     CRYPTO_store_u32_be(out, c->h[i]);
     out += 4;
   }
+
+  FIPS_service_indicator_update_state();
   return 1;
 }
 
@@ -159,13 +162,14 @@ int SHA256_Final(uint8_t out[SHA256_DIGEST_LENGTH], SHA256_CTX *c) {
   // |SHA256_Final| and expects |sha->md_len| to carry the size over.
   //
   // TODO(davidben): Add an assert and fix code to match them up.
-  return sha256_final_impl(out, c);
+  return sha256_final_impl(out, c->md_len, c);
 }
+
 int SHA224_Final(uint8_t out[SHA224_DIGEST_LENGTH], SHA256_CTX *ctx) {
-  // SHA224_Init sets |ctx->md_len| to |SHA224_DIGEST_LENGTH|, so this has a
-  // smaller output.
+  // This function must be paired with |SHA224_Init|, which sets |ctx->md_len|
+  // to |SHA224_DIGEST_LENGTH|.
   assert(ctx->md_len == SHA224_DIGEST_LENGTH);
-  return sha256_final_impl(out, ctx);
+  return sha256_final_impl(out, SHA224_DIGEST_LENGTH, ctx);
 }
 
 #ifndef SHA256_ASM

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/sha/sha512.c

@@ -60,8 +60,9 @@
 
 #include <openssl/mem.h>
 
-#include "internal.h"
 #include "../../internal.h"
+#include "../service_indicator/internal.h"
+#include "internal.h"
 
 
 // The 32-bit hash algorithms share a common byte-order neutral collector and
@@ -70,7 +71,7 @@
 // this writing, so there is no need for a common collector/padding
 // implementation yet.
 
-static int sha512_final_impl(uint8_t *out, SHA512_CTX *sha);
+static int sha512_final_impl(uint8_t *out, size_t md_len, SHA512_CTX *sha);
 
 int SHA384_Init(SHA512_CTX *sha) {
   sha->h[0] = UINT64_C(0xcbbb9d5dc1059ed8);
@@ -161,10 +162,10 @@ static void sha512_block_data_order(uint64_t *state, const uint8_t *in,
 
 
 int SHA384_Final(uint8_t out[SHA384_DIGEST_LENGTH], SHA512_CTX *sha) {
-  // |SHA384_Init| sets |sha->md_len| to |SHA384_DIGEST_LENGTH|, so this has a
-  // smaller output.
+  // This function must be paired with |SHA384_Init|, which sets |sha->md_len|
+  // to |SHA384_DIGEST_LENGTH|.
   assert(sha->md_len == SHA384_DIGEST_LENGTH);
-  return sha512_final_impl(out, sha);
+  return sha512_final_impl(out, SHA384_DIGEST_LENGTH, sha);
 }
 
 int SHA384_Update(SHA512_CTX *sha, const void *data, size_t len) {
@@ -176,10 +177,10 @@ int SHA512_256_Update(SHA512_CTX *sha, const void *data, size_t len) {
 }
 
 int SHA512_256_Final(uint8_t out[SHA512_256_DIGEST_LENGTH], SHA512_CTX *sha) {
-  // |SHA512_256_Init| sets |sha->md_len| to |SHA512_256_DIGEST_LENGTH|, so this
-  // has a |smaller output.
+  // This function must be paired with |SHA512_256_Init|, which sets
+  // |sha->md_len| to |SHA512_256_DIGEST_LENGTH|.
   assert(sha->md_len == SHA512_256_DIGEST_LENGTH);
-  return sha512_final_impl(out, sha);
+  return sha512_final_impl(out, SHA512_256_DIGEST_LENGTH, sha);
 }
 
 void SHA512_Transform(SHA512_CTX *c, const uint8_t block[SHA512_CBLOCK]) {
@@ -240,10 +241,10 @@ int SHA512_Final(uint8_t out[SHA512_DIGEST_LENGTH], SHA512_CTX *sha) {
   // |SHA512_Final| and expects |sha->md_len| to carry the size over.
   //
   // TODO(davidben): Add an assert and fix code to match them up.
-  return sha512_final_impl(out, sha);
+  return sha512_final_impl(out, sha->md_len, sha);
 }
 
-static int sha512_final_impl(uint8_t *out, SHA512_CTX *sha) {
+static int sha512_final_impl(uint8_t *out, size_t md_len, SHA512_CTX *sha) {
   uint8_t *p = sha->p;
   size_t n = sha->num;
 
@@ -267,13 +268,14 @@ static int sha512_final_impl(uint8_t *out, SHA512_CTX *sha) {
     return 0;
   }
 
-  assert(sha->md_len % 8 == 0);
-  const size_t out_words = sha->md_len / 8;
+  assert(md_len % 8 == 0);
+  const size_t out_words = md_len / 8;
   for (size_t i = 0; i < out_words; i++) {
     CRYPTO_store_u64_be(out, sha->h[i]);
     out += 8;
   }
 
+  FIPS_service_indicator_update_state();
   return 1;
 }
 

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/tls/kdf.c

@@ -58,6 +58,7 @@
 
 #include "internal.h"
 #include "../../internal.h"
+#include "../service_indicator/internal.h"
 
 
 // tls1_P_hash computes the TLS P_<hash> function as described in RFC 5246,
@@ -90,7 +91,7 @@ static int tls1_P_hash(uint8_t *out, size_t out_len,
   }
 
   for (;;) {
-    unsigned len;
+    unsigned len_u;
     uint8_t hmac[EVP_MAX_MD_SIZE];
     if (!HMAC_CTX_copy_ex(&ctx, &ctx_init) ||
         !HMAC_Update(&ctx, A1, A1_len) ||
@@ -99,16 +100,17 @@ static int tls1_P_hash(uint8_t *out, size_t out_len,
         !HMAC_Update(&ctx, (const uint8_t *) label, label_len) ||
         !HMAC_Update(&ctx, seed1, seed1_len) ||
         !HMAC_Update(&ctx, seed2, seed2_len) ||
-        !HMAC_Final(&ctx, hmac, &len)) {
+        !HMAC_Final(&ctx, hmac, &len_u)) {
       goto err;
     }
+    size_t len = len_u;
     assert(len == chunk);
 
     // XOR the result into |out|.
     if (len > out_len) {
       len = out_len;
     }
-    for (unsigned i = 0; i < len; i++) {
+    for (size_t i = 0; i < len; i++) {
       out[i] ^= hmac[i];
     }
     out += len;
@@ -146,12 +148,16 @@ int CRYPTO_tls1_prf(const EVP_MD *digest,
 
   OPENSSL_memset(out, 0, out_len);
 
+  const EVP_MD *const original_digest = digest;
+  FIPS_service_indicator_lock_state();
+  int ret = 0;
+
   if (digest == EVP_md5_sha1()) {
     // If using the MD5/SHA1 PRF, |secret| is partitioned between MD5 and SHA-1.
     size_t secret_half = secret_len - (secret_len / 2);
     if (!tls1_P_hash(out, out_len, EVP_md5(), secret, secret_half, label,
                      label_len, seed1, seed1_len, seed2, seed2_len)) {
-      return 0;
+      goto end;
     }
 
     // Note that, if |secret_len| is odd, the two halves share a byte.
@@ -160,6 +166,13 @@ int CRYPTO_tls1_prf(const EVP_MD *digest,
     digest = EVP_sha1();
   }
 
-  return tls1_P_hash(out, out_len, digest, secret, secret_len, label, label_len,
-                     seed1, seed1_len, seed2, seed2_len);
+  ret = tls1_P_hash(out, out_len, digest, secret, secret_len, label, label_len,
+                    seed1, seed1_len, seed2, seed2_len);
+
+end:
+  FIPS_service_indicator_unlock_state();
+  if (ret) {
+    TLSKDF_verify_service_indicator(original_digest);
+  }
+  return ret;
 }