grpc 1.54.3 → 1.59.2

data/third_party/boringssl-with-bazel/src/crypto/x509v3/v3_conf.c

@@ -57,6 +57,7 @@
 // extension creation utilities
 
 #include <ctype.h>
+#include <limits.h>
 #include <stdio.h>
 #include <string.h>
 
@@ -81,7 +82,7 @@ static X509_EXTENSION *v3_generic_extension(const char *ext, const char *value,
 static X509_EXTENSION *do_ext_i2d(const X509V3_EXT_METHOD *method, int ext_nid,
                                   int crit, void *ext_struc);
 static unsigned char *generic_asn1(const char *value, const X509V3_CTX *ctx,
-                                   long *ext_len);
+                                   size_t *ext_len);
 
 X509_EXTENSION *X509V3_EXT_nconf(const CONF *conf, const X509V3_CTX *ctx,
                                  const char *name, const char *value) {
@@ -191,52 +192,30 @@ static X509_EXTENSION *do_ext_nconf(const CONF *conf, const X509V3_CTX *ctx,
   }
 
   ext = do_ext_i2d(method, ext_nid, crit, ext_struc);
-  if (method->it) {
-    ASN1_item_free(ext_struc, ASN1_ITEM_ptr(method->it));
-  } else {
-    method->ext_free(ext_struc);
-  }
+  ASN1_item_free(ext_struc, ASN1_ITEM_ptr(method->it));
   return ext;
 }
 
 static X509_EXTENSION *do_ext_i2d(const X509V3_EXT_METHOD *method, int ext_nid,
                                   int crit, void *ext_struc) {
-  unsigned char *ext_der;
-  int ext_len;
-  ASN1_OCTET_STRING *ext_oct;
-  X509_EXTENSION *ext;
-  // Convert internal representation to DER
-  if (method->it) {
-    ext_der = NULL;
-    ext_len = ASN1_item_i2d(ext_struc, &ext_der, ASN1_ITEM_ptr(method->it));
-    if (ext_len < 0) {
-      goto merr;
-    }
-  } else {
-    unsigned char *p;
-    ext_len = method->i2d(ext_struc, NULL);
-    if (!(ext_der = OPENSSL_malloc(ext_len))) {
-      goto merr;
-    }
-    p = ext_der;
-    method->i2d(ext_struc, &p);
-  }
-  if (!(ext_oct = ASN1_OCTET_STRING_new())) {
-    goto merr;
+  // Convert the extension's internal representation to DER.
+  unsigned char *ext_der = NULL;
+  int ext_len = ASN1_item_i2d(ext_struc, &ext_der, ASN1_ITEM_ptr(method->it));
+  if (ext_len < 0) {
+    return NULL;
   }
-  ext_oct->data = ext_der;
-  ext_oct->length = ext_len;
 
-  ext = X509_EXTENSION_create_by_NID(NULL, ext_nid, crit, ext_oct);
-  if (!ext) {
-    goto merr;
+  ASN1_OCTET_STRING *ext_oct = ASN1_OCTET_STRING_new();
+  if (ext_oct == NULL) {
+    OPENSSL_free(ext_der);
+    return NULL;
   }
-  ASN1_OCTET_STRING_free(ext_oct);
+  ASN1_STRING_set0(ext_oct, ext_der, ext_len);
 
+  X509_EXTENSION *ext =
+      X509_EXTENSION_create_by_NID(NULL, ext_nid, crit, ext_oct);
+  ASN1_OCTET_STRING_free(ext_oct);
   return ext;
-
-merr:
-  return NULL;
 }
 
 // Given an internal structure, nid and critical flag create an extension
@@ -290,7 +269,7 @@ static X509_EXTENSION *v3_generic_extension(const char *ext, const char *value,
                                             int crit, int gen_type,
                                             const X509V3_CTX *ctx) {
   unsigned char *ext_der = NULL;
-  long ext_len = 0;
+  size_t ext_len = 0;
   ASN1_OBJECT *obj = NULL;
   ASN1_OCTET_STRING *oct = NULL;
   X509_EXTENSION *extension = NULL;
@@ -312,12 +291,17 @@ static X509_EXTENSION *v3_generic_extension(const char *ext, const char *value,
     goto err;
   }
 
-  if (!(oct = ASN1_OCTET_STRING_new())) {
+  if (ext_len > INT_MAX) {
+    OPENSSL_PUT_ERROR(X509V3, ERR_R_OVERFLOW);
+    goto err;
+  }
+
+  oct = ASN1_OCTET_STRING_new();
+  if (oct == NULL) {
     goto err;
   }
 
-  oct->data = ext_der;
-  oct->length = ext_len;
+  ASN1_STRING_set0(oct, ext_der, (int)ext_len);
   ext_der = NULL;
 
   extension = X509_EXTENSION_create_by_OBJ(NULL, obj, crit, oct);
@@ -330,15 +314,18 @@ err:
 }
 
 static unsigned char *generic_asn1(const char *value, const X509V3_CTX *ctx,
-                                   long *ext_len) {
-  ASN1_TYPE *typ;
-  unsigned char *ext_der = NULL;
-  typ = ASN1_generate_v3(value, ctx);
+                                   size_t *ext_len) {
+  ASN1_TYPE *typ = ASN1_generate_v3(value, ctx);
   if (typ == NULL) {
     return NULL;
   }
-  *ext_len = i2d_ASN1_TYPE(typ, &ext_der);
+  unsigned char *ext_der = NULL;
+  int len = i2d_ASN1_TYPE(typ, &ext_der);
   ASN1_TYPE_free(typ);
+  if (len < 0) {
+    return NULL;
+  }
+  *ext_len = len;
   return ext_der;
 }
 

data/third_party/boringssl-with-bazel/src/crypto/x509v3/v3_cpols.c

@@ -356,6 +356,7 @@ static POLICYQUALINFO *notice_section(const X509V3_CTX *ctx,
       if (!nos || !sk_CONF_VALUE_num(nos)) {
         OPENSSL_PUT_ERROR(X509V3, X509V3_R_INVALID_NUMBERS);
         X509V3_conf_err(cnf);
+        sk_CONF_VALUE_pop_free(nos, X509V3_conf_free);
         goto err;
       }
       int ret = nref_nos(nref->noticenos, nos);

data/third_party/boringssl-with-bazel/src/crypto/x509v3/v3_info.c

@@ -168,7 +168,6 @@ static void *v2i_AUTHORITY_INFO_ACCESS(const X509V3_EXT_METHOD *method,
                                        const STACK_OF(CONF_VALUE) *nval) {
   AUTHORITY_INFO_ACCESS *ainfo = NULL;
   ACCESS_DESCRIPTION *acc;
-  char *objtmp, *ptmp;
   if (!(ainfo = sk_ACCESS_DESCRIPTION_new_null())) {
     return NULL;
   }
@@ -178,22 +177,21 @@ static void *v2i_AUTHORITY_INFO_ACCESS(const X509V3_EXT_METHOD *method,
         !sk_ACCESS_DESCRIPTION_push(ainfo, acc)) {
       goto err;
     }
-    ptmp = strchr(cnf->name, ';');
+    char *ptmp = strchr(cnf->name, ';');
     if (!ptmp) {
       OPENSSL_PUT_ERROR(X509V3, X509V3_R_INVALID_SYNTAX);
       goto err;
     }
-    int objlen = ptmp - cnf->name;
     CONF_VALUE ctmp;
     ctmp.name = ptmp + 1;
     ctmp.value = cnf->value;
     if (!v2i_GENERAL_NAME_ex(acc->location, method, ctx, &ctmp, 0)) {
       goto err;
     }
-    if (!(objtmp = OPENSSL_malloc(objlen + 1))) {
+    char *objtmp = OPENSSL_strndup(cnf->name, ptmp - cnf->name);
+    if (objtmp == NULL) {
       goto err;
     }
-    OPENSSL_strlcpy(objtmp, cnf->name, objlen + 1);
     acc->method = OBJ_txt2obj(objtmp, 0);
     if (!acc->method) {
       OPENSSL_PUT_ERROR(X509V3, X509V3_R_BAD_OBJECT);

data/third_party/boringssl-with-bazel/src/crypto/x509v3/v3_lib.c

@@ -57,6 +57,7 @@
  */
 /* X509 v3 extension utilities */
 
+#include <assert.h>
 #include <stdio.h>
 
 #include <openssl/conf.h>
@@ -70,22 +71,23 @@
 #include "ext_dat.h"
 static STACK_OF(X509V3_EXT_METHOD) *ext_list = NULL;
 
-static void ext_list_free(X509V3_EXT_METHOD *ext);
-
-static int ext_stack_cmp(const X509V3_EXT_METHOD **a,
-                         const X509V3_EXT_METHOD **b) {
+static int ext_stack_cmp(const X509V3_EXT_METHOD *const *a,
+                         const X509V3_EXT_METHOD *const *b) {
   return ((*a)->ext_nid - (*b)->ext_nid);
 }
 
 int X509V3_EXT_add(X509V3_EXT_METHOD *ext) {
+  // We only support |ASN1_ITEM|-based extensions.
+  assert(ext->it != NULL);
+
+  // TODO(davidben): This should be locked. Also check for duplicates.
   if (!ext_list && !(ext_list = sk_X509V3_EXT_METHOD_new(ext_stack_cmp))) {
-    ext_list_free(ext);
     return 0;
   }
   if (!sk_X509V3_EXT_METHOD_push(ext_list, ext)) {
-    ext_list_free(ext);
     return 0;
   }
+  sk_X509V3_EXT_METHOD_sort(ext_list);
   return 1;
 }
 
@@ -113,7 +115,6 @@ const X509V3_EXT_METHOD *X509V3_EXT_get_nid(int nid) {
     return NULL;
   }
 
-  sk_X509V3_EXT_METHOD_sort(ext_list);
   if (!sk_X509V3_EXT_METHOD_find(ext_list, &idx, &tmp)) {
     return NULL;
   }
@@ -135,28 +136,12 @@ int X509V3_EXT_free(int nid, void *ext_data) {
     return 0;
   }
 
-  if (ext_method->it != NULL) {
-    ASN1_item_free(ext_data, ASN1_ITEM_ptr(ext_method->it));
-  } else if (ext_method->ext_free != NULL) {
-    ext_method->ext_free(ext_data);
-  } else {
-    OPENSSL_PUT_ERROR(X509V3, X509V3_R_CANNOT_FIND_FREE_FUNCTION);
-    return 0;
-  }
-
-  return 1;
-}
-
-int X509V3_EXT_add_list(X509V3_EXT_METHOD *extlist) {
-  for (; extlist->ext_nid != -1; extlist++) {
-    if (!X509V3_EXT_add(extlist)) {
-      return 0;
-    }
-  }
+  ASN1_item_free(ext_data, ASN1_ITEM_ptr(ext_method->it));
   return 1;
 }
 
 int X509V3_EXT_add_alias(int nid_to, int nid_from) {
+OPENSSL_BEGIN_ALLOW_DEPRECATED
   const X509V3_EXT_METHOD *ext;
   X509V3_EXT_METHOD *tmpext;
 
@@ -170,19 +155,12 @@ int X509V3_EXT_add_alias(int nid_to, int nid_from) {
   }
   *tmpext = *ext;
   tmpext->ext_nid = nid_to;
-  tmpext->ext_flags |= X509V3_EXT_DYNAMIC;
-  return X509V3_EXT_add(tmpext);
-}
-
-void X509V3_EXT_cleanup(void) {
-  sk_X509V3_EXT_METHOD_pop_free(ext_list, ext_list_free);
-  ext_list = NULL;
-}
-
-static void ext_list_free(X509V3_EXT_METHOD *ext) {
-  if (ext->ext_flags & X509V3_EXT_DYNAMIC) {
-    OPENSSL_free(ext);
+  if (!X509V3_EXT_add(tmpext)) {
+    OPENSSL_free(tmpext);
+    return 0;
   }
+  return 1;
+OPENSSL_END_ALLOW_DEPRECATED
 }
 
 // Legacy function: we don't need to add standard extensions any more because
@@ -200,23 +178,14 @@ void *X509V3_EXT_d2i(const X509_EXTENSION *ext) {
     return NULL;
   }
   p = ext->value->data;
-  void *ret;
-  if (method->it) {
-    ret =
-        ASN1_item_d2i(NULL, &p, ext->value->length, ASN1_ITEM_ptr(method->it));
-  } else {
-    ret = method->d2i(NULL, &p, ext->value->length);
-  }
+  void *ret =
+      ASN1_item_d2i(NULL, &p, ext->value->length, ASN1_ITEM_ptr(method->it));
   if (ret == NULL) {
     return NULL;
   }
   // Check for trailing data.
   if (p != ext->value->data + ext->value->length) {
-    if (method->it) {
-      ASN1_item_free(ret, ASN1_ITEM_ptr(method->it));
-    } else {
-      method->ext_free(ret);
-    }
+    ASN1_item_free(ret, ASN1_ITEM_ptr(method->it));
     OPENSSL_PUT_ERROR(X509V3, X509V3_R_TRAILING_DATA_IN_EXTENSION);
     return NULL;
   }
@@ -226,7 +195,6 @@ void *X509V3_EXT_d2i(const X509_EXTENSION *ext) {
 void *X509V3_get_d2i(const STACK_OF(X509_EXTENSION) *extensions, int nid,
                      int *out_critical, int *out_idx) {
   int lastpos;
-  size_t i;
   X509_EXTENSION *ex, *found_ex = NULL;
   if (!extensions) {
     if (out_idx) {
@@ -245,13 +213,13 @@ void *X509V3_get_d2i(const STACK_OF(X509_EXTENSION) *extensions, int nid,
   if (lastpos < 0) {
     lastpos = 0;
   }
-  for (i = lastpos; i < sk_X509_EXTENSION_num(extensions); i++) {
+  for (size_t i = lastpos; i < sk_X509_EXTENSION_num(extensions); i++) {
     ex = sk_X509_EXTENSION_value(extensions, i);
     if (OBJ_obj2nid(ex->object) == nid) {
       if (out_idx) {
         // TODO(https://crbug.com/boringssl/379): Consistently reject
         // duplicate extensions.
-        *out_idx = i;
+        *out_idx = (int)i;
         found_ex = ex;
         break;
       } else if (found_ex) {

data/third_party/boringssl-with-bazel/src/crypto/x509v3/v3_prn.c

@@ -105,59 +105,47 @@ void X509V3_EXT_val_prn(BIO *out, const STACK_OF(CONF_VALUE) *val, int indent,
 
 int X509V3_EXT_print(BIO *out, const X509_EXTENSION *ext, unsigned long flag,
                      int indent) {
-  void *ext_str = NULL;
-  char *value = NULL;
-  const X509V3_EXT_METHOD *method;
-  STACK_OF(CONF_VALUE) *nval = NULL;
-  int ok = 1;
-
-  if (!(method = X509V3_EXT_get(ext))) {
+  const X509V3_EXT_METHOD *method = X509V3_EXT_get(ext);
+  if (method == NULL) {
     return unknown_ext_print(out, ext, flag, indent, 0);
   }
   const ASN1_STRING *ext_data = X509_EXTENSION_get_data(ext);
   const unsigned char *p = ASN1_STRING_get0_data(ext_data);
-  if (method->it) {
-    ext_str = ASN1_item_d2i(NULL, &p, ASN1_STRING_length(ext_data),
-                            ASN1_ITEM_ptr(method->it));
-  } else {
-    ext_str = method->d2i(NULL, &p, ASN1_STRING_length(ext_data));
-  }
-
+  void *ext_str = ASN1_item_d2i(NULL, &p, ASN1_STRING_length(ext_data),
+                                ASN1_ITEM_ptr(method->it));
   if (!ext_str) {
     return unknown_ext_print(out, ext, flag, indent, 1);
   }
 
+  char *value = NULL;
+  STACK_OF(CONF_VALUE) *nval = NULL;
+  int ok = 0;
   if (method->i2s) {
     if (!(value = method->i2s(method, ext_str))) {
-      ok = 0;
       goto err;
     }
     BIO_printf(out, "%*s%s", indent, "", value);
   } else if (method->i2v) {
     if (!(nval = method->i2v(method, ext_str, NULL))) {
-      ok = 0;
       goto err;
     }
     X509V3_EXT_val_prn(out, nval, indent,
                        method->ext_flags & X509V3_EXT_MULTILINE);
   } else if (method->i2r) {
     if (!method->i2r(method, ext_str, out, indent)) {
-      ok = 0;
+      goto err;
     }
   } else {
-    ok = 0;
+    OPENSSL_PUT_ERROR(X509V3, X509V3_R_OPERATION_NOT_DEFINED);
+    goto err;
   }
 
+  ok = 1;
+
 err:
   sk_CONF_VALUE_pop_free(nval, X509V3_conf_free);
-  if (value) {
-    OPENSSL_free(value);
-  }
-  if (method->it) {
-    ASN1_item_free(ext_str, ASN1_ITEM_ptr(method->it));
-  } else {
-    method->ext_free(ext_str);
-  }
+  OPENSSL_free(value);
+  ASN1_item_free(ext_str, ASN1_ITEM_ptr(method->it));
   return ok;
 }
 

data/third_party/boringssl-with-bazel/src/crypto/x509v3/v3_purp.c

@@ -95,7 +95,7 @@ static int check_purpose_timestamp_sign(const X509_PURPOSE *xp, const X509 *x,
 static int no_check(const X509_PURPOSE *xp, const X509 *x, int ca);
 static int ocsp_helper(const X509_PURPOSE *xp, const X509 *x, int ca);
 
-static int xp_cmp(const X509_PURPOSE **a, const X509_PURPOSE **b);
+static int xp_cmp(const X509_PURPOSE *const *a, const X509_PURPOSE *const *b);
 static void xptable_free(X509_PURPOSE *p);
 
 static X509_PURPOSE xstandard[] = {
@@ -126,7 +126,7 @@ static X509_PURPOSE xstandard[] = {
 
 static STACK_OF(X509_PURPOSE) *xptable = NULL;
 
-static int xp_cmp(const X509_PURPOSE **a, const X509_PURPOSE **b) {
+static int xp_cmp(const X509_PURPOSE *const *a, const X509_PURPOSE *const *b) {
   return (*a)->purpose - (*b)->purpose;
 }
 
@@ -177,10 +177,9 @@ X509_PURPOSE *X509_PURPOSE_get0(int idx) {
   return sk_X509_PURPOSE_value(xptable, idx - X509_PURPOSE_COUNT);
 }
 
-int X509_PURPOSE_get_by_sname(char *sname) {
-  int i;
+int X509_PURPOSE_get_by_sname(const char *sname) {
   X509_PURPOSE *xptmp;
-  for (i = 0; i < X509_PURPOSE_get_count(); i++) {
+  for (int i = 0; i < X509_PURPOSE_get_count(); i++) {
     xptmp = X509_PURPOSE_get0(i);
     if (!strcmp(xptmp->sname, sname)) {
       return i;
@@ -201,7 +200,6 @@ int X509_PURPOSE_get_by_id(int purpose) {
     return -1;
   }
 
-  sk_X509_PURPOSE_sort(xptable);
   if (!sk_X509_PURPOSE_find(xptable, &idx, &tmp)) {
     return -1;
   }
@@ -210,8 +208,7 @@ int X509_PURPOSE_get_by_id(int purpose) {
 
 int X509_PURPOSE_add(int id, int trust, int flags,
                      int (*ck)(const X509_PURPOSE *, const X509 *, int),
-                     char *name, char *sname, void *arg) {
-  int idx;
+                     const char *name, const char *sname, void *arg) {
   X509_PURPOSE *ptmp;
   char *name_dup, *sname_dup;
 
@@ -220,7 +217,7 @@ int X509_PURPOSE_add(int id, int trust, int flags,
   // This will always be set for application modified trust entries
   flags |= X509_PURPOSE_DYNAMIC_NAME;
   // Get existing entry if any
-  idx = X509_PURPOSE_get_by_id(id);
+  int idx = X509_PURPOSE_get_by_id(id);
   // Need a new entry
   if (idx == -1) {
     if (!(ptmp = OPENSSL_malloc(sizeof(X509_PURPOSE)))) {
@@ -267,6 +264,10 @@ int X509_PURPOSE_add(int id, int trust, int flags,
 
   // If its a new entry manage the dynamic table
   if (idx == -1) {
+    // TODO(davidben): This should be locked. Alternatively, remove the dynamic
+    // registration mechanism entirely. The trouble is there no way to pass in
+    // the various parameters into an |X509_VERIFY_PARAM| directly. You can only
+    // register it in the global table and get an ID.
     if (!xptable && !(xptable = sk_X509_PURPOSE_new(xp_cmp))) {
       xptable_free(ptmp);
       return 0;
@@ -275,6 +276,7 @@ int X509_PURPOSE_add(int id, int trust, int flags,
       xptable_free(ptmp);
       return 0;
     }
+    sk_X509_PURPOSE_sort(xptable);
   }
   return 1;
 }

data/third_party/boringssl-with-bazel/src/crypto/x509v3/v3_skey.c

@@ -54,12 +54,14 @@
  * (eay@cryptsoft.com).  This product includes software written by Tim
  * Hudson (tjh@cryptsoft.com). */
 
+#include <limits.h>
 #include <stdio.h>
 #include <string.h>
 
 #include <openssl/digest.h>
 #include <openssl/err.h>
 #include <openssl/obj.h>
+#include <openssl/mem.h>
 #include <openssl/x509v3.h>
 
 #include "../x509/internal.h"
@@ -74,21 +76,26 @@ char *i2s_ASN1_OCTET_STRING(const X509V3_EXT_METHOD *method,
 ASN1_OCTET_STRING *s2i_ASN1_OCTET_STRING(const X509V3_EXT_METHOD *method,
                                          const X509V3_CTX *ctx,
                                          const char *str) {
-  ASN1_OCTET_STRING *oct;
-  long length;
-
-  if (!(oct = ASN1_OCTET_STRING_new())) {
+  size_t len;
+  uint8_t *data = x509v3_hex_to_bytes(str, &len);
+  if (data == NULL) {
     return NULL;
   }
-
-  if (!(oct->data = x509v3_hex_to_bytes(str, &length))) {
-    ASN1_OCTET_STRING_free(oct);
-    return NULL;
+  if (len > INT_MAX) {
+    OPENSSL_PUT_ERROR(X509V3, ERR_R_OVERFLOW);
+    goto err;
   }
 
-  oct->length = length;
-
+  ASN1_OCTET_STRING *oct = ASN1_OCTET_STRING_new();
+  if (oct == NULL) {
+    goto err;
+  }
+  ASN1_STRING_set0(oct, data, (int)len);
   return oct;
+
+err:
+  OPENSSL_free(data);
+  return NULL;
 }
 
 static char *i2s_ASN1_OCTET_STRING_cb(const X509V3_EXT_METHOD *method,

data/third_party/boringssl-with-bazel/src/crypto/x509v3/v3_utl.c

@@ -75,7 +75,7 @@
 
 
 static char *strip_spaces(char *name);
-static int sk_strcmp(const char **a, const char **b);
+static int sk_strcmp(const char *const *a, const char *const *b);
 static STACK_OF(OPENSSL_STRING) *get_email(const X509_NAME *name,
                                            const GENERAL_NAMES *gens);
 static void str_free(OPENSSL_STRING str);
@@ -494,7 +494,7 @@ err:
   return NULL;
 }
 
-unsigned char *x509v3_hex_to_bytes(const char *str, long *len) {
+unsigned char *x509v3_hex_to_bytes(const char *str, size_t *len) {
   unsigned char *hexbuf, *q;
   unsigned char ch, cl, *p;
   uint8_t high, low;
@@ -551,7 +551,9 @@ int x509v3_conf_name_matches(const char *name, const char *cmp) {
   return name[len] == '\0' || name[len] == '.';
 }
 
-static int sk_strcmp(const char **a, const char **b) { return strcmp(*a, *b); }
+static int sk_strcmp(const char *const *a, const char *const *b) {
+  return strcmp(*a, *b);
+}
 
 STACK_OF(OPENSSL_STRING) *X509_get1_email(X509 *x) {
   GENERAL_NAMES *gens;

data/third_party/boringssl-with-bazel/src/include/openssl/aead.h

@@ -138,12 +138,10 @@ OPENSSL_EXPORT const EVP_AEAD *EVP_aead_aes_128_ctr_hmac_sha256(void);
 // authentication. See |EVP_aead_aes_128_ctr_hmac_sha256| for details.
 OPENSSL_EXPORT const EVP_AEAD *EVP_aead_aes_256_ctr_hmac_sha256(void);
 
-// EVP_aead_aes_128_gcm_siv is AES-128 in GCM-SIV mode. See
-// https://tools.ietf.org/html/draft-irtf-cfrg-gcmsiv-02
+// EVP_aead_aes_128_gcm_siv is AES-128 in GCM-SIV mode. See RFC 8452.
 OPENSSL_EXPORT const EVP_AEAD *EVP_aead_aes_128_gcm_siv(void);
 
-// EVP_aead_aes_256_gcm_siv is AES-256 in GCM-SIV mode. See
-// https://tools.ietf.org/html/draft-irtf-cfrg-gcmsiv-02
+// EVP_aead_aes_256_gcm_siv is AES-256 in GCM-SIV mode. See RFC 8452.
 OPENSSL_EXPORT const EVP_AEAD *EVP_aead_aes_256_gcm_siv(void);
 
 // EVP_aead_aes_128_gcm_randnonce is AES-128 in Galois Counter Mode with
@@ -212,7 +210,7 @@ OPENSSL_EXPORT size_t EVP_AEAD_max_tag_len(const EVP_AEAD *aead);
 // AEAD operations.
 
 union evp_aead_ctx_st_state {
-  uint8_t opaque[580];
+  uint8_t opaque[564];
   uint64_t alignment;
 };
 
@@ -402,14 +400,14 @@ OPENSSL_EXPORT const EVP_AEAD *EVP_AEAD_CTX_aead(const EVP_AEAD_CTX *ctx);
 OPENSSL_EXPORT const EVP_AEAD *EVP_aead_aes_128_cbc_sha1_tls(void);
 OPENSSL_EXPORT const EVP_AEAD *EVP_aead_aes_128_cbc_sha1_tls_implicit_iv(void);
 
+OPENSSL_EXPORT const EVP_AEAD *EVP_aead_aes_128_cbc_sha256_tls(void);
+
 OPENSSL_EXPORT const EVP_AEAD *EVP_aead_aes_256_cbc_sha1_tls(void);
 OPENSSL_EXPORT const EVP_AEAD *EVP_aead_aes_256_cbc_sha1_tls_implicit_iv(void);
 
 OPENSSL_EXPORT const EVP_AEAD *EVP_aead_des_ede3_cbc_sha1_tls(void);
 OPENSSL_EXPORT const EVP_AEAD *EVP_aead_des_ede3_cbc_sha1_tls_implicit_iv(void);
 
-OPENSSL_EXPORT const EVP_AEAD *EVP_aead_null_sha1_tls(void);
-
 // EVP_aead_aes_128_gcm_tls12 is AES-128 in Galois Counter Mode using the TLS
 // 1.2 nonce construction.
 OPENSSL_EXPORT const EVP_AEAD *EVP_aead_aes_128_gcm_tls12(void);