grpc 1.62.0 → 1.64.0

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/ec/ec_key.c

@@ -242,7 +242,10 @@ int EC_KEY_set_private_key(EC_KEY *key, const BIGNUM *priv_key) {
     return 0;
   }
   if (!ec_bignum_to_scalar(key->group, &scalar->scalar, priv_key) ||
-      ec_scalar_is_zero(key->group, &scalar->scalar)) {
+      // Zero is not a valid private key, so it is safe to leak the result of
+      // this comparison.
+      constant_time_declassify_int(
+          ec_scalar_is_zero(key->group, &scalar->scalar))) {
     OPENSSL_PUT_ERROR(EC, EC_R_INVALID_PRIVATE_KEY);
     ec_wrapped_scalar_free(scalar);
     return 0;
@@ -518,6 +521,11 @@ int EC_KEY_generate_key(EC_KEY *key) {
 }
 
 int EC_KEY_generate_key_fips(EC_KEY *eckey) {
+  if (eckey == NULL || eckey->group == NULL) {
+    OPENSSL_PUT_ERROR(EC, ERR_R_PASSED_NULL_PARAMETER);
+    return 0;
+  }
+
   boringssl_ensure_ecc_self_test();
 
   if (EC_KEY_generate_key(eckey) && EC_KEY_check_fips(eckey)) {
@@ -534,12 +542,8 @@ int EC_KEY_generate_key_fips(EC_KEY *eckey) {
 int EC_KEY_get_ex_new_index(long argl, void *argp, CRYPTO_EX_unused *unused,
                             CRYPTO_EX_dup *dup_unused,
                             CRYPTO_EX_free *free_func) {
-  int index;
-  if (!CRYPTO_get_ex_new_index(g_ec_ex_data_class_bss_get(), &index, argl, argp,
-                               free_func)) {
-    return -1;
-  }
-  return index;
+  return CRYPTO_get_ex_new_index_ex(g_ec_ex_data_class_bss_get(), argl, argp,
+                                 free_func);
 }
 
 int EC_KEY_set_ex_data(EC_KEY *d, int idx, void *arg) {

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/ec/scalar.c

@@ -23,8 +23,12 @@
 
 int ec_bignum_to_scalar(const EC_GROUP *group, EC_SCALAR *out,
                         const BIGNUM *in) {
+  // Scalars, which are often secret, must be reduced modulo the order. Those
+  // that are not will be discarded, so leaking the result of the comparison is
+  // safe.
   if (!bn_copy_words(out->words, group->order.N.width, in) ||
-      !bn_less_than_words(out->words, group->order.N.d, group->order.N.width)) {
+      !constant_time_declassify_int(bn_less_than_words(
+          out->words, group->order.N.d, group->order.N.width))) {
     OPENSSL_PUT_ERROR(EC, EC_R_INVALID_SCALAR);
     return 0;
   }

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/rand/fork_detect.h

@@ -29,7 +29,8 @@
 // iOS doesn't normally allow fork in apps, but it's there.
 #define OPENSSL_FORK_DETECTION
 #define OPENSSL_FORK_DETECTION_PTHREAD_ATFORK
-#elif defined(OPENSSL_WINDOWS) || defined(OPENSSL_TRUSTY)
+#elif defined(OPENSSL_WINDOWS) || defined(OPENSSL_TRUSTY) || \
+    defined(__ZEPHYR__) || defined(CROS_EC)
 // These platforms do not fork.
 #define OPENSSL_DOES_NOT_FORK
 #endif

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/rsa/rsa.c

@@ -439,12 +439,8 @@ int RSA_is_opaque(const RSA *rsa) {
 
 int RSA_get_ex_new_index(long argl, void *argp, CRYPTO_EX_unused *unused,
                          CRYPTO_EX_dup *dup_unused, CRYPTO_EX_free *free_func) {
-  int index;
-  if (!CRYPTO_get_ex_new_index(g_rsa_ex_data_class_bss_get(), &index, argl,
-                               argp, free_func)) {
-    return -1;
-  }
-  return index;
+  return CRYPTO_get_ex_new_index_ex(g_rsa_ex_data_class_bss_get(), argl, argp,
+                                 free_func);
 }
 
 int RSA_set_ex_data(RSA *rsa, int idx, void *arg) {
@@ -762,7 +758,8 @@ err:
 static int check_mod_inverse(int *out_ok, const BIGNUM *a, const BIGNUM *ainv,
                              const BIGNUM *m, unsigned m_min_bits,
                              BN_CTX *ctx) {
-  if (BN_is_negative(ainv) || BN_cmp(ainv, m) >= 0) {
+  if (BN_is_negative(ainv) ||
+      constant_time_declassify_int(BN_cmp(ainv, m) >= 0)) {
     *out_ok = 0;
     return 1;
   }
@@ -776,7 +773,7 @@ static int check_mod_inverse(int *out_ok, const BIGNUM *a, const BIGNUM *ainv,
             bn_mul_consttime(tmp, a, ainv, ctx) &&
             bn_div_consttime(NULL, tmp, tmp, m, m_min_bits, ctx);
   if (ret) {
-    *out_ok = BN_is_one(tmp);
+    *out_ok = constant_time_declassify_int(BN_is_one(tmp));
   }
   BN_CTX_end(ctx);
   return ret;
@@ -835,8 +832,10 @@ int RSA_check_key(const RSA *key) {
   // bounds, to avoid a DoS vector in |bn_mul_consttime| below. Note that
   // n was bound by |rsa_check_public_key|. This also implicitly checks p and q
   // are odd, which is a necessary condition for Montgomery reduction.
-  if (BN_is_negative(key->p) || BN_cmp(key->p, key->n) >= 0 ||
-      BN_is_negative(key->q) || BN_cmp(key->q, key->n) >= 0) {
+  if (BN_is_negative(key->p) ||
+      constant_time_declassify_int(BN_cmp(key->p, key->n) >= 0) ||
+      BN_is_negative(key->q) ||
+      constant_time_declassify_int(BN_cmp(key->q, key->n) >= 0)) {
     OPENSSL_PUT_ERROR(RSA, RSA_R_N_NOT_EQUAL_P_Q);
     goto out;
   }
@@ -867,7 +866,8 @@ int RSA_check_key(const RSA *key) {
     goto out;
   }
 
-  if (!BN_is_one(&tmp) || !BN_is_one(&de)) {
+  if (constant_time_declassify_int(!BN_is_one(&tmp)) ||
+      constant_time_declassify_int(!BN_is_one(&de))) {
     OPENSSL_PUT_ERROR(RSA, RSA_R_D_E_NOT_CONGRUENT_TO_1);
     goto out;
   }

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/rsa/rsa_impl.c

@@ -795,7 +795,7 @@ static int mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx) {
 
   // This is a pre-condition for |mod_montgomery|. It was already checked by the
   // caller.
-  assert(BN_ucmp(I, n) < 0);
+  declassify_assert(BN_ucmp(I, n) < 0);
 
   if (// |m1| is the result modulo |q|.
       !mod_montgomery(r1, I, q, rsa->mont_q, p, ctx) ||
@@ -831,7 +831,7 @@ static int mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx) {
   // bound the width slightly higher, so fix it. This trips constant-time checks
   // because a naive data flow analysis does not realize the excess words are
   // publicly zero.
-  assert(BN_cmp(r0, n) < 0);
+  declassify_assert(BN_cmp(r0, n) < 0);
   bn_assert_fits_in_bytes(r0, BN_num_bytes(n));
   if (!bn_resize_words(r0, n->width)) {
     goto err;
@@ -1003,20 +1003,25 @@ static int generate_prime(BIGNUM *out, int bits, const BIGNUM *e,
     // retrying. That is, we reject a negligible fraction of primes that are
     // within the FIPS bound, but we will never accept a prime outside the
     // bound, ensuring the resulting RSA key is the right size.
-    if (BN_cmp(out, sqrt2) <= 0) {
+    //
+    // Values over the threshold are discarded, so it is safe to leak this
+    // comparison.
+    if (constant_time_declassify_int(BN_cmp(out, sqrt2) <= 0)) {
       continue;
     }
 
     // RSA key generation's bottleneck is discarding composites. If it fails
     // trial division, do not bother computing a GCD or performing Miller-Rabin.
     if (!bn_odd_number_is_obviously_composite(out)) {
-      // Check gcd(out-1, e) is one (steps 4.5 and 5.6).
+      // Check gcd(out-1, e) is one (steps 4.5 and 5.6). Leaking the final
+      // result of this comparison is safe because, if not relatively prime, the
+      // value will be discarded.
       int relatively_prime;
-      if (!BN_sub(tmp, out, BN_value_one()) ||
+      if (!bn_usub_consttime(tmp, out, BN_value_one()) ||
           !bn_is_relatively_prime(&relatively_prime, tmp, e, ctx)) {
         goto err;
       }
-      if (relatively_prime) {
+      if (constant_time_declassify_int(relatively_prime)) {
         // Test |out| for primality (steps 4.5.1 and 5.6.1).
         int is_probable_prime;
         if (!BN_primality_test(&is_probable_prime, out,
@@ -1174,8 +1179,9 @@ static int rsa_generate_key_impl(RSA *rsa, int bits, const BIGNUM *e_value,
     }
 
     // Retry if |rsa->d| <= 2^|prime_bits|. See appendix B.3.1's guidance on
-    // values for d.
-  } while (BN_cmp(rsa->d, pow2_prime_bits) <= 0);
+    // values for d. When we retry, p and q are discarded, so it is safe to leak
+    // this comparison.
+  } while (constant_time_declassify_int(BN_cmp(rsa->d, pow2_prime_bits) <= 0));
 
   assert(BN_num_bits(pm1) == (unsigned)prime_bits);
   assert(BN_num_bits(qm1) == (unsigned)prime_bits);
@@ -1189,6 +1195,9 @@ static int rsa_generate_key_impl(RSA *rsa, int bits, const BIGNUM *e_value,
   }
   bn_set_minimal_width(rsa->n);
 
+  // |rsa->n| is computed from the private key, but is public.
+  bn_declassify(rsa->n);
+
   // Sanity-check that |rsa->n| has the specified size. This is implied by
   // |generate_prime|'s bounds.
   if (BN_num_bits(rsa->n) != (unsigned)bits) {
@@ -1241,6 +1250,11 @@ static int RSA_generate_key_ex_maybe_fips(RSA *rsa, int bits,
                                           int check_fips) {
   boringssl_ensure_rsa_self_test();
 
+  if (rsa == NULL) {
+    OPENSSL_PUT_ERROR(EC, ERR_R_PASSED_NULL_PARAMETER);
+    return 0;
+  }
+
   RSA *tmp = NULL;
   uint32_t err;
   int ret = 0;

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/service_indicator/service_indicator.c

@@ -171,7 +171,6 @@ static int is_md_fips_approved_for_signing(int md_type) {
 // type is FIPS approved for verifying, and zero otherwise.
 static int is_md_fips_approved_for_verifying(int md_type) {
   switch (md_type) {
-    case NID_sha1:
     case NID_sha224:
     case NID_sha256:
     case NID_sha384:
@@ -184,7 +183,6 @@ static int is_md_fips_approved_for_verifying(int md_type) {
 }
 
 static void evp_md_ctx_verify_service_indicator(const EVP_MD_CTX *ctx,
-                                                int rsa_1024_ok,
                                                 int (*md_ok)(int md_type)) {
   if (EVP_MD_CTX_md(ctx) == NULL) {
     // Signature schemes without a prehash are currently never FIPS approved.
@@ -232,8 +230,7 @@ static void evp_md_ctx_verify_service_indicator(const EVP_MD_CTX *ctx,
 
     // Check if the MD type and the RSA key size are approved.
     if (md_ok(md_type) &&
-        ((rsa_1024_ok && pkey_size == 128) || pkey_size == 256 ||
-         pkey_size == 384 || pkey_size == 512)) {
+        (pkey_size == 256 || pkey_size == 384 || pkey_size == 512)) {
       FIPS_service_indicator_update_state();
     }
   } else if (pkey_type == EVP_PKEY_EC) {
@@ -280,12 +277,12 @@ void EVP_Cipher_verify_service_indicator(const EVP_CIPHER_CTX *ctx) {
 }
 
 void EVP_DigestVerify_verify_service_indicator(const EVP_MD_CTX *ctx) {
-  return evp_md_ctx_verify_service_indicator(ctx, /*rsa_1024_ok=*/1,
+  return evp_md_ctx_verify_service_indicator(ctx,
                                              is_md_fips_approved_for_verifying);
 }
 
 void EVP_DigestSign_verify_service_indicator(const EVP_MD_CTX *ctx) {
-  return evp_md_ctx_verify_service_indicator(ctx, /*rsa_1024_ok=*/0,
+  return evp_md_ctx_verify_service_indicator(ctx,
                                              is_md_fips_approved_for_signing);
 }
 

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/sha/internal.h

@@ -26,20 +26,7 @@ extern "C" {
 // Define SHA{n}[_{variant}]_ASM if sha{n}_block_data_order[_{variant}] is
 // defined in assembly.
 
-#if !defined(OPENSSL_NO_ASM) && defined(OPENSSL_X86)
-
-#define SHA1_ASM
-#define SHA256_ASM
-#define SHA512_ASM
-
-void sha1_block_data_order(uint32_t *state, const uint8_t *data,
-                           size_t num_blocks);
-void sha256_block_data_order(uint32_t *state, const uint8_t *data,
-                             size_t num_blocks);
-void sha512_block_data_order(uint64_t *state, const uint8_t *data,
-                             size_t num_blocks);
-
-#elif !defined(OPENSSL_NO_ASM) && defined(OPENSSL_ARM)
+#if !defined(OPENSSL_NO_ASM) && defined(OPENSSL_ARM)
 
 #define SHA1_ASM_NOHW
 #define SHA256_ASM_NOHW
@@ -51,7 +38,7 @@ OPENSSL_INLINE int sha1_hw_capable(void) {
 }
 
 #define SHA1_ASM_NEON
-void sha1_block_data_order_neon(uint32_t *state, const uint8_t *data,
+void sha1_block_data_order_neon(uint32_t state[5], const uint8_t *data,
                                 size_t num);
 
 #define SHA256_ASM_HW
@@ -60,12 +47,12 @@ OPENSSL_INLINE int sha256_hw_capable(void) {
 }
 
 #define SHA256_ASM_NEON
-void sha256_block_data_order_neon(uint32_t *state, const uint8_t *data,
+void sha256_block_data_order_neon(uint32_t state[8], const uint8_t *data,
                                   size_t num);
 
 // Armv8.2 SHA-512 instructions are not available in 32-bit.
 #define SHA512_ASM_NEON
-void sha512_block_data_order_neon(uint64_t *state, const uint8_t *data,
+void sha512_block_data_order_neon(uint64_t state[8], const uint8_t *data,
                                   size_t num);
 
 #elif !defined(OPENSSL_NO_ASM) && defined(OPENSSL_AARCH64)
@@ -89,6 +76,62 @@ OPENSSL_INLINE int sha512_hw_capable(void) {
   return CRYPTO_is_ARMv8_SHA512_capable();
 }
 
+#elif !defined(OPENSSL_NO_ASM) && defined(OPENSSL_X86)
+
+#define SHA1_ASM_NOHW
+#define SHA256_ASM_NOHW
+
+#define SHA1_ASM_SSSE3
+OPENSSL_INLINE int sha1_ssse3_capable(void) {
+  // TODO(davidben): Do we need to check the FXSR bit? The Intel manual does not
+  // say to.
+  return CRYPTO_is_SSSE3_capable() && CRYPTO_is_FXSR_capable();
+}
+void sha1_block_data_order_ssse3(uint32_t state[5], const uint8_t *data,
+                                 size_t num);
+
+#define SHA1_ASM_AVX
+OPENSSL_INLINE int sha1_avx_capable(void) {
+  // Pre-Zen AMD CPUs had slow SHLD/SHRD; Zen added the SHA extension; see the
+  // discussion in sha1-586.pl.
+  //
+  // TODO(davidben): Should we enable SHAEXT on 32-bit x86?
+  // TODO(davidben): Do we need to check the FXSR bit? The Intel manual does not
+  // say to.
+  return CRYPTO_is_AVX_capable() && CRYPTO_is_intel_cpu() &&
+         CRYPTO_is_FXSR_capable();
+}
+void sha1_block_data_order_avx(uint32_t state[5], const uint8_t *data,
+                               size_t num);
+
+#define SHA256_ASM_SSSE3
+OPENSSL_INLINE int sha256_ssse3_capable(void) {
+  // TODO(davidben): Do we need to check the FXSR bit? The Intel manual does not
+  // say to.
+  return CRYPTO_is_SSSE3_capable() && CRYPTO_is_FXSR_capable();
+}
+void sha256_block_data_order_ssse3(uint32_t state[8], const uint8_t *data,
+                                   size_t num);
+
+#define SHA256_ASM_AVX
+OPENSSL_INLINE int sha256_avx_capable(void) {
+  // Pre-Zen AMD CPUs had slow SHLD/SHRD; Zen added the SHA extension; see the
+  // discussion in sha1-586.pl.
+  //
+  // TODO(davidben): Should we enable SHAEXT on 32-bit x86?
+  // TODO(davidben): Do we need to check the FXSR bit? The Intel manual does not
+  // say to.
+  return CRYPTO_is_AVX_capable() && CRYPTO_is_intel_cpu() &&
+         CRYPTO_is_FXSR_capable();
+}
+void sha256_block_data_order_avx(uint32_t state[8], const uint8_t *data,
+                                 size_t num);
+
+// TODO(crbug.com/boringssl/673): Move the remaining CPU dispatch to C.
+#define SHA512_ASM
+void sha512_block_data_order(uint64_t state[8], const uint8_t *data,
+                             size_t num_blocks);
+
 #elif !defined(OPENSSL_NO_ASM) && defined(OPENSSL_X86_64)
 
 #define SHA1_ASM_NOHW
@@ -105,7 +148,7 @@ OPENSSL_INLINE int sha1_avx2_capable(void) {
   return CRYPTO_is_AVX2_capable() && CRYPTO_is_BMI2_capable() &&
          CRYPTO_is_BMI1_capable();
 }
-void sha1_block_data_order_avx2(uint32_t *state, const uint8_t *data,
+void sha1_block_data_order_avx2(uint32_t state[5], const uint8_t *data,
                                 size_t num);
 
 #define SHA1_ASM_AVX
@@ -114,14 +157,14 @@ OPENSSL_INLINE int sha1_avx_capable(void) {
   // discussion in sha1-586.pl.
   return CRYPTO_is_AVX_capable() && CRYPTO_is_intel_cpu();
 }
-void sha1_block_data_order_avx(uint32_t *state, const uint8_t *data,
+void sha1_block_data_order_avx(uint32_t state[5], const uint8_t *data,
                                size_t num);
 
 #define SHA1_ASM_SSSE3
 OPENSSL_INLINE int sha1_ssse3_capable(void) {
   return CRYPTO_is_SSSE3_capable();
 }
-void sha1_block_data_order_ssse3(uint32_t *state, const uint8_t *data,
+void sha1_block_data_order_ssse3(uint32_t state[5], const uint8_t *data,
                                  size_t num);
 
 #define SHA256_ASM_HW
@@ -136,14 +179,14 @@ OPENSSL_INLINE int sha256_avx_capable(void) {
   // discussion in sha1-586.pl.
   return CRYPTO_is_AVX_capable() && CRYPTO_is_intel_cpu();
 }
-void sha256_block_data_order_avx(uint32_t *state, const uint8_t *data,
+void sha256_block_data_order_avx(uint32_t state[8], const uint8_t *data,
                                  size_t num);
 
 #define SHA256_ASM_SSSE3
 OPENSSL_INLINE int sha256_ssse3_capable(void) {
   return CRYPTO_is_SSSE3_capable();
 }
-void sha256_block_data_order_ssse3(uint32_t *state, const uint8_t *data,
+void sha256_block_data_order_ssse3(uint32_t state[8], const uint8_t *data,
                                    size_t num);
 
 #define SHA512_ASM_AVX
@@ -152,35 +195,36 @@ OPENSSL_INLINE int sha512_avx_capable(void) {
   // discussion in sha1-586.pl.
   return CRYPTO_is_AVX_capable() && CRYPTO_is_intel_cpu();
 }
-void sha512_block_data_order_avx(uint64_t *state, const uint8_t *data,
+void sha512_block_data_order_avx(uint64_t state[8], const uint8_t *data,
                                  size_t num);
 
 #endif
 
 #if defined(SHA1_ASM_HW)
-void sha1_block_data_order_hw(uint32_t *state, const uint8_t *data, size_t num);
+void sha1_block_data_order_hw(uint32_t state[5], const uint8_t *data,
+                              size_t num);
 #endif
 #if defined(SHA1_ASM_NOHW)
-void sha1_block_data_order_nohw(uint32_t *state, const uint8_t *data,
+void sha1_block_data_order_nohw(uint32_t state[5], const uint8_t *data,
                                 size_t num);
 #endif
 
 #if defined(SHA256_ASM_HW)
-void sha256_block_data_order_hw(uint32_t *state, const uint8_t *data,
+void sha256_block_data_order_hw(uint32_t state[8], const uint8_t *data,
                                 size_t num);
 #endif
 #if defined(SHA256_ASM_NOHW)
-void sha256_block_data_order_nohw(uint32_t *state, const uint8_t *data,
+void sha256_block_data_order_nohw(uint32_t state[8], const uint8_t *data,
                                   size_t num);
 #endif
 
 #if defined(SHA512_ASM_HW)
-void sha512_block_data_order_hw(uint64_t *state, const uint8_t *data,
+void sha512_block_data_order_hw(uint64_t state[8], const uint8_t *data,
                                 size_t num);
 #endif
 
 #if defined(SHA512_ASM_NOHW)
-void sha512_block_data_order_nohw(uint64_t *state, const uint8_t *data,
+void sha512_block_data_order_nohw(uint64_t state[8], const uint8_t *data,
                                   size_t num);
 #endif
 

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/sha/sha1.c

@@ -86,7 +86,7 @@ uint8_t *SHA1(const uint8_t *data, size_t len, uint8_t out[SHA_DIGEST_LENGTH]) {
 }
 
 #if !defined(SHA1_ASM)
-static void sha1_block_data_order(uint32_t *state, const uint8_t *data,
+static void sha1_block_data_order(uint32_t state[5], const uint8_t *data,
                                   size_t num);
 #endif
 
@@ -234,7 +234,7 @@ void CRYPTO_fips_186_2_prf(uint8_t *out, size_t out_len,
 #if !defined(SHA1_ASM)
 
 #if !defined(SHA1_ASM_NOHW)
-static void sha1_block_data_order_nohw(uint32_t *state, const uint8_t *data,
+static void sha1_block_data_order_nohw(uint32_t state[5], const uint8_t *data,
                                        size_t num) {
   register uint32_t A, B, C, D, E, T;
   uint32_t XX0, XX1, XX2, XX3, XX4, XX5, XX6, XX7, XX8, XX9, XX10,
@@ -384,7 +384,7 @@ static void sha1_block_data_order_nohw(uint32_t *state, const uint8_t *data,
 }
 #endif  // !SHA1_ASM_NOHW
 
-static void sha1_block_data_order(uint32_t *state, const uint8_t *data,
+static void sha1_block_data_order(uint32_t state[5], const uint8_t *data,
                                   size_t num) {
 #if defined(SHA1_ASM_HW)
   if (sha1_hw_capable()) {
@@ -394,7 +394,7 @@ static void sha1_block_data_order(uint32_t *state, const uint8_t *data,
 #endif
 #if defined(SHA1_ASM_AVX2)
   if (sha1_avx2_capable()) {
-    sha1_block_data_order_avx(state, data, num);
+    sha1_block_data_order_avx2(state, data, num);
     return;
   }
 #endif

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/sha/sha256.c

@@ -115,7 +115,7 @@ uint8_t *SHA256(const uint8_t *data, size_t len,
 }
 
 #if !defined(SHA256_ASM)
-static void sha256_block_data_order(uint32_t *state, const uint8_t *in,
+static void sha256_block_data_order(uint32_t state[8], const uint8_t *in,
                                     size_t num);
 #endif
 
@@ -223,7 +223,7 @@ static const uint32_t K256[64] = {
     ROUND_00_15(i, a, b, c, d, e, f, g, h);            \
   } while (0)
 
-static void sha256_block_data_order_nohw(uint32_t *state, const uint8_t *data,
+static void sha256_block_data_order_nohw(uint32_t state[8], const uint8_t *data,
                                          size_t num) {
   uint32_t a, b, c, d, e, f, g, h, s0, s1, T1;
   uint32_t X[16];
@@ -312,7 +312,7 @@ static void sha256_block_data_order_nohw(uint32_t *state, const uint8_t *data,
 
 #endif  // !defined(SHA256_ASM_NOHW)
 
-static void sha256_block_data_order(uint32_t *state, const uint8_t *data,
+static void sha256_block_data_order(uint32_t state[8], const uint8_t *data,
                                     size_t num) {
 #if defined(SHA256_ASM_HW)
   if (sha256_hw_capable()) {

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/sha/sha512.c

@@ -156,7 +156,7 @@ uint8_t *SHA512_256(const uint8_t *data, size_t len,
 }
 
 #if !defined(SHA512_ASM)
-static void sha512_block_data_order(uint64_t *state, const uint8_t *in,
+static void sha512_block_data_order(uint64_t state[8], const uint8_t *in,
                                     size_t num_blocks);
 #endif
 
@@ -343,7 +343,7 @@ static const uint64_t K512[80] = {
 #if defined(__i386) || defined(__i386__) || defined(_M_IX86)
 // This code should give better results on 32-bit CPU with less than
 // ~24 registers, both size and performance wise...
-static void sha512_block_data_order_nohw(uint64_t *state, const uint8_t *in,
+static void sha512_block_data_order_nohw(uint64_t state[8], const uint8_t *in,
                                          size_t num) {
   uint64_t A, E, T;
   uint64_t X[9 + 80], *F;
@@ -416,7 +416,7 @@ static void sha512_block_data_order_nohw(uint64_t *state, const uint8_t *in,
     ROUND_00_15(i + j, a, b, c, d, e, f, g, h);        \
   } while (0)
 
-static void sha512_block_data_order_nohw(uint64_t *state, const uint8_t *in,
+static void sha512_block_data_order_nohw(uint64_t state[8], const uint8_t *in,
                                          size_t num) {
   uint64_t a, b, c, d, e, f, g, h, s0, s1, T1;
   uint64_t X[16];
@@ -502,7 +502,7 @@ static void sha512_block_data_order_nohw(uint64_t *state, const uint8_t *in,
 
 #endif  // !SHA512_ASM_NOHW
 
-static void sha512_block_data_order(uint64_t *state, const uint8_t *data,
+static void sha512_block_data_order(uint64_t state[8], const uint8_t *data,
                                     size_t num) {
 #if defined(SHA512_ASM_HW)
   if (sha512_hw_capable()) {

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/tls/kdf.c

@@ -189,6 +189,7 @@ int CRYPTO_tls13_hkdf_expand_label(uint8_t *out, size_t out_len,
   uint8_t *hkdf_label = NULL;
   size_t hkdf_label_len;
 
+  FIPS_service_indicator_lock_state();
   CBB_zero(&cbb);
   if (!CBB_init(&cbb, 2 + 1 + sizeof(kProtocolLabel) - 1 + label_len + 1 +
                           hash_len) ||
@@ -200,12 +201,18 @@ int CRYPTO_tls13_hkdf_expand_label(uint8_t *out, size_t out_len,
       !CBB_add_bytes(&child, hash, hash_len) ||
       !CBB_finish(&cbb, &hkdf_label, &hkdf_label_len)) {
     CBB_cleanup(&cbb);
+    FIPS_service_indicator_unlock_state();
     return 0;
   }
 
   const int ret = HKDF_expand(out, out_len, digest, secret, secret_len,
                               hkdf_label, hkdf_label_len);
   OPENSSL_free(hkdf_label);
+
+  FIPS_service_indicator_unlock_state();
+  if (ret) {
+    TLSKDF_verify_service_indicator(digest);
+  }
   return ret;
 }
 

data/third_party/boringssl-with-bazel/src/crypto/hpke/hpke.c

@@ -355,6 +355,8 @@ int EVP_HPKE_KEY_copy(EVP_HPKE_KEY *dst, const EVP_HPKE_KEY *src) {
 void EVP_HPKE_KEY_move(EVP_HPKE_KEY *out, EVP_HPKE_KEY *in) {
   EVP_HPKE_KEY_cleanup(out);
   // For now, |EVP_HPKE_KEY| is trivially movable.
+  // Note that Rust may move this structure. See
+  // bssl-crypto/src/scoped.rs:EvpHpkeKey.
   OPENSSL_memcpy(out, in, sizeof(EVP_HPKE_KEY));
   EVP_HPKE_KEY_zero(in);
 }