grpc 1.63.0 → 1.69.0

data/third_party/boringssl-with-bazel/src/crypto/obj/obj_dat.h

@@ -57,7 +57,7 @@
 /* This file is generated by crypto/obj/objects.go. */
 
 
-#define NUM_NID 965
+#define NUM_NID 966
 
 static const uint8_t kObjectData[] = {
     /* NID_rsadsi */
@@ -8783,6 +8783,7 @@ static const ASN1_OBJECT kObjects[NUM_NID] = {
     {"HKDF", "hkdf", NID_hkdf, 0, NULL, 0},
     {"X25519Kyber768Draft00", "X25519Kyber768Draft00",
      NID_X25519Kyber768Draft00, 0, NULL, 0},
+    {"X25519MLKEM768", "X25519MLKEM768", NID_X25519MLKEM768, 0, NULL, 0},
 };
 
 static const uint16_t kNIDsInShortNameOrder[] = {
@@ -8981,6 +8982,7 @@ static const uint16_t kNIDsInShortNameOrder[] = {
     458 /* UID */,
     948 /* X25519 */,
     964 /* X25519Kyber768Draft00 */,
+    965 /* X25519MLKEM768 */,
     961 /* X448 */,
     11 /* X500 */,
     378 /* X500algorithms */,
@@ -9852,6 +9854,7 @@ static const uint16_t kNIDsInLongNameOrder[] = {
     375 /* Trust Root */,
     948 /* X25519 */,
     964 /* X25519Kyber768Draft00 */,
+    965 /* X25519MLKEM768 */,
     961 /* X448 */,
     12 /* X509 */,
     402 /* X509v3 AC Targeting */,

data/third_party/boringssl-with-bazel/src/crypto/pem/pem_lib.c

@@ -261,21 +261,22 @@ err:
 }
 
 int PEM_ASN1_write(i2d_of_void *i2d, const char *name, FILE *fp, void *x,
-                   const EVP_CIPHER *enc, unsigned char *kstr, int klen,
-                   pem_password_cb *callback, void *u) {
+                   const EVP_CIPHER *enc, const unsigned char *pass,
+                   int pass_len, pem_password_cb *callback, void *u) {
   BIO *b = BIO_new_fp(fp, BIO_NOCLOSE);
   if (b == NULL) {
     OPENSSL_PUT_ERROR(PEM, ERR_R_BUF_LIB);
     return 0;
   }
-  int ret = PEM_ASN1_write_bio(i2d, name, b, x, enc, kstr, klen, callback, u);
+  int ret =
+      PEM_ASN1_write_bio(i2d, name, b, x, enc, pass, pass_len, callback, u);
   BIO_free(b);
   return ret;
 }
 
 int PEM_ASN1_write_bio(i2d_of_void *i2d, const char *name, BIO *bp, void *x,
-                       const EVP_CIPHER *enc, unsigned char *kstr, int klen,
-                       pem_password_cb *callback, void *u) {
+                       const EVP_CIPHER *enc, const unsigned char *pass,
+                       int pass_len, pem_password_cb *callback, void *u) {
   EVP_CIPHER_CTX ctx;
   int dsize = 0, i, j, ret = 0;
   unsigned char *p, *data = NULL;
@@ -310,17 +311,16 @@ int PEM_ASN1_write_bio(i2d_of_void *i2d, const char *name, BIO *bp, void *x,
   if (enc != NULL) {
     const unsigned iv_len = EVP_CIPHER_iv_length(enc);
 
-    if (kstr == NULL) {
-      klen = 0;
+    if (pass == NULL) {
       if (!callback) {
         callback = PEM_def_callback;
       }
-      klen = (*callback)(buf, PEM_BUFSIZE, 1, u);
-      if (klen <= 0) {
+      pass_len = (*callback)(buf, PEM_BUFSIZE, 1, u);
+      if (pass_len < 0) {
         OPENSSL_PUT_ERROR(PEM, PEM_R_READ_KEY);
         goto err;
       }
-      kstr = (unsigned char *)buf;
+      pass = (const unsigned char *)buf;
     }
     assert(iv_len <= sizeof(iv));
     if (!RAND_bytes(iv, iv_len)) {  // Generate a salt
@@ -328,11 +328,11 @@ int PEM_ASN1_write_bio(i2d_of_void *i2d, const char *name, BIO *bp, void *x,
     }
     // The 'iv' is used as the iv and as a salt.  It is NOT taken from
     // the BytesToKey function
-    if (!EVP_BytesToKey(enc, EVP_md5(), iv, kstr, klen, 1, key, NULL)) {
+    if (!EVP_BytesToKey(enc, EVP_md5(), iv, pass, pass_len, 1, key, NULL)) {
       goto err;
     }
 
-    if (kstr == (unsigned char *)buf) {
+    if (pass == (const unsigned char *)buf) {
       OPENSSL_cleanse(buf, PEM_BUFSIZE);
     }
 
@@ -375,7 +375,7 @@ err:
 
 int PEM_do_header(EVP_CIPHER_INFO *cipher, unsigned char *data, long *plen,
                   pem_password_cb *callback, void *u) {
-  int i = 0, j, o, klen;
+  int i = 0, j, o, pass_len;
   long len;
   EVP_CIPHER_CTX ctx;
   unsigned char key[EVP_MAX_KEY_LENGTH];
@@ -387,18 +387,18 @@ int PEM_do_header(EVP_CIPHER_INFO *cipher, unsigned char *data, long *plen,
     return 1;
   }
 
-  klen = 0;
+  pass_len = 0;
   if (!callback) {
     callback = PEM_def_callback;
   }
-  klen = callback(buf, PEM_BUFSIZE, 0, u);
-  if (klen <= 0) {
+  pass_len = callback(buf, PEM_BUFSIZE, 0, u);
+  if (pass_len < 0) {
     OPENSSL_PUT_ERROR(PEM, PEM_R_BAD_PASSWORD_READ);
     return 0;
   }
 
   if (!EVP_BytesToKey(cipher->cipher, EVP_md5(), &(cipher->iv[0]),
-                      (unsigned char *)buf, klen, 1, key, NULL)) {
+                      (unsigned char *)buf, pass_len, 1, key, NULL)) {
     return 0;
   }
 
@@ -778,11 +778,11 @@ err:
 
 int PEM_def_callback(char *buf, int size, int rwflag, void *userdata) {
   if (!buf || !userdata || size < 0) {
-    return 0;
+    return -1;
   }
   size_t len = strlen((char *)userdata);
   if (len >= (size_t)size) {
-    return 0;
+    return -1;
   }
   OPENSSL_strlcpy(buf, userdata, (size_t)size);
   return (int)len;

data/third_party/boringssl-with-bazel/src/crypto/pem/pem_pk8.c

@@ -65,10 +65,10 @@
 #include <openssl/x509.h>
 
 static int do_pk8pkey(BIO *bp, const EVP_PKEY *x, int isder, int nid,
-                      const EVP_CIPHER *enc, char *kstr, int klen,
+                      const EVP_CIPHER *enc, const char *pass, int pass_len,
                       pem_password_cb *cb, void *u);
 static int do_pk8pkey_fp(FILE *bp, const EVP_PKEY *x, int isder, int nid,
-                         const EVP_CIPHER *enc, char *kstr, int klen,
+                         const EVP_CIPHER *enc, const char *pass, int pass_len,
                          pem_password_cb *cb, void *u);
 
 // These functions write a private key in PKCS#8 format: it is a "drop in"
@@ -77,30 +77,31 @@ static int do_pk8pkey_fp(FILE *bp, const EVP_PKEY *x, int isder, int nid,
 // uses PKCS#5 v1.5 PBE algorithms whereas the others use PKCS#5 v2.0.
 
 int PEM_write_bio_PKCS8PrivateKey_nid(BIO *bp, const EVP_PKEY *x, int nid,
-                                      char *kstr, int klen, pem_password_cb *cb,
-                                      void *u) {
-  return do_pk8pkey(bp, x, 0, nid, NULL, kstr, klen, cb, u);
+                                      const char *pass, int pass_len,
+                                      pem_password_cb *cb, void *u) {
+  return do_pk8pkey(bp, x, 0, nid, NULL, pass, pass_len, cb, u);
 }
 
 int PEM_write_bio_PKCS8PrivateKey(BIO *bp, const EVP_PKEY *x,
-                                  const EVP_CIPHER *enc, char *kstr, int klen,
-                                  pem_password_cb *cb, void *u) {
-  return do_pk8pkey(bp, x, 0, -1, enc, kstr, klen, cb, u);
+                                  const EVP_CIPHER *enc, const char *pass,
+                                  int pass_len, pem_password_cb *cb, void *u) {
+  return do_pk8pkey(bp, x, 0, -1, enc, pass, pass_len, cb, u);
 }
 
 int i2d_PKCS8PrivateKey_bio(BIO *bp, const EVP_PKEY *x, const EVP_CIPHER *enc,
-                            char *kstr, int klen, pem_password_cb *cb,
+                            const char *pass, int pass_len, pem_password_cb *cb,
                             void *u) {
-  return do_pk8pkey(bp, x, 1, -1, enc, kstr, klen, cb, u);
+  return do_pk8pkey(bp, x, 1, -1, enc, pass, pass_len, cb, u);
 }
 
-int i2d_PKCS8PrivateKey_nid_bio(BIO *bp, const EVP_PKEY *x, int nid, char *kstr,
-                                int klen, pem_password_cb *cb, void *u) {
-  return do_pk8pkey(bp, x, 1, nid, NULL, kstr, klen, cb, u);
+int i2d_PKCS8PrivateKey_nid_bio(BIO *bp, const EVP_PKEY *x, int nid,
+                                const char *pass, int pass_len,
+                                pem_password_cb *cb, void *u) {
+  return do_pk8pkey(bp, x, 1, nid, NULL, pass, pass_len, cb, u);
 }
 
 static int do_pk8pkey(BIO *bp, const EVP_PKEY *x, int isder, int nid,
-                      const EVP_CIPHER *enc, char *kstr, int klen,
+                      const EVP_CIPHER *enc, const char *pass, int pass_len,
                       pem_password_cb *cb, void *u) {
   X509_SIG *p8;
   PKCS8_PRIV_KEY_INFO *p8inf;
@@ -111,23 +112,22 @@ static int do_pk8pkey(BIO *bp, const EVP_PKEY *x, int isder, int nid,
     return 0;
   }
   if (enc || (nid != -1)) {
-    if (!kstr) {
-      klen = 0;
+    if (!pass) {
       if (!cb) {
         cb = PEM_def_callback;
       }
-      klen = cb(buf, PEM_BUFSIZE, 1, u);
-      if (klen <= 0) {
+      pass_len = cb(buf, PEM_BUFSIZE, 1, u);
+      if (pass_len < 0) {
         OPENSSL_PUT_ERROR(PEM, PEM_R_READ_KEY);
         PKCS8_PRIV_KEY_INFO_free(p8inf);
         return 0;
       }
 
-      kstr = buf;
+      pass = buf;
     }
-    p8 = PKCS8_encrypt(nid, enc, kstr, klen, NULL, 0, 0, p8inf);
-    if (kstr == buf) {
-      OPENSSL_cleanse(buf, klen);
+    p8 = PKCS8_encrypt(nid, enc, pass, pass_len, NULL, 0, 0, p8inf);
+    if (pass == buf) {
+      OPENSSL_cleanse(buf, pass_len);
     }
     PKCS8_PRIV_KEY_INFO_free(p8inf);
     if (isder) {
@@ -152,7 +152,7 @@ EVP_PKEY *d2i_PKCS8PrivateKey_bio(BIO *bp, EVP_PKEY **x, pem_password_cb *cb,
                                   void *u) {
   PKCS8_PRIV_KEY_INFO *p8inf = NULL;
   X509_SIG *p8 = NULL;
-  int klen;
+  int pass_len;
   EVP_PKEY *ret;
   char psbuf[PEM_BUFSIZE];
   p8 = d2i_PKCS8_bio(bp, NULL);
@@ -160,19 +160,19 @@ EVP_PKEY *d2i_PKCS8PrivateKey_bio(BIO *bp, EVP_PKEY **x, pem_password_cb *cb,
     return NULL;
   }
 
-  klen = 0;
+  pass_len = 0;
   if (!cb) {
     cb = PEM_def_callback;
   }
-  klen = cb(psbuf, PEM_BUFSIZE, 0, u);
-  if (klen <= 0) {
+  pass_len = cb(psbuf, PEM_BUFSIZE, 0, u);
+  if (pass_len < 0) {
     OPENSSL_PUT_ERROR(PEM, PEM_R_BAD_PASSWORD_READ);
     X509_SIG_free(p8);
     return NULL;
   }
-  p8inf = PKCS8_decrypt(p8, psbuf, klen);
+  p8inf = PKCS8_decrypt(p8, psbuf, pass_len);
   X509_SIG_free(p8);
-  OPENSSL_cleanse(psbuf, klen);
+  OPENSSL_cleanse(psbuf, pass_len);
   if (!p8inf) {
     return NULL;
   }
@@ -192,29 +192,31 @@ EVP_PKEY *d2i_PKCS8PrivateKey_bio(BIO *bp, EVP_PKEY **x, pem_password_cb *cb,
 
 
 int i2d_PKCS8PrivateKey_fp(FILE *fp, const EVP_PKEY *x, const EVP_CIPHER *enc,
-                           char *kstr, int klen, pem_password_cb *cb, void *u) {
-  return do_pk8pkey_fp(fp, x, 1, -1, enc, kstr, klen, cb, u);
+                           const char *pass, int pass_len, pem_password_cb *cb,
+                           void *u) {
+  return do_pk8pkey_fp(fp, x, 1, -1, enc, pass, pass_len, cb, u);
 }
 
-int i2d_PKCS8PrivateKey_nid_fp(FILE *fp, const EVP_PKEY *x, int nid, char *kstr,
-                               int klen, pem_password_cb *cb, void *u) {
-  return do_pk8pkey_fp(fp, x, 1, nid, NULL, kstr, klen, cb, u);
+int i2d_PKCS8PrivateKey_nid_fp(FILE *fp, const EVP_PKEY *x, int nid,
+                               const char *pass, int pass_len,
+                               pem_password_cb *cb, void *u) {
+  return do_pk8pkey_fp(fp, x, 1, nid, NULL, pass, pass_len, cb, u);
 }
 
 int PEM_write_PKCS8PrivateKey_nid(FILE *fp, const EVP_PKEY *x, int nid,
-                                  char *kstr, int klen, pem_password_cb *cb,
-                                  void *u) {
-  return do_pk8pkey_fp(fp, x, 0, nid, NULL, kstr, klen, cb, u);
+                                  const char *pass, int pass_len,
+                                  pem_password_cb *cb, void *u) {
+  return do_pk8pkey_fp(fp, x, 0, nid, NULL, pass, pass_len, cb, u);
 }
 
 int PEM_write_PKCS8PrivateKey(FILE *fp, const EVP_PKEY *x,
-                              const EVP_CIPHER *enc, char *kstr, int klen,
-                              pem_password_cb *cb, void *u) {
-  return do_pk8pkey_fp(fp, x, 0, -1, enc, kstr, klen, cb, u);
+                              const EVP_CIPHER *enc, const char *pass,
+                              int pass_len, pem_password_cb *cb, void *u) {
+  return do_pk8pkey_fp(fp, x, 0, -1, enc, pass, pass_len, cb, u);
 }
 
 static int do_pk8pkey_fp(FILE *fp, const EVP_PKEY *x, int isder, int nid,
-                         const EVP_CIPHER *enc, char *kstr, int klen,
+                         const EVP_CIPHER *enc, const char *pass, int pass_len,
                          pem_password_cb *cb, void *u) {
   BIO *bp;
   int ret;
@@ -222,7 +224,7 @@ static int do_pk8pkey_fp(FILE *fp, const EVP_PKEY *x, int isder, int nid,
     OPENSSL_PUT_ERROR(PEM, ERR_R_BUF_LIB);
     return 0;
   }
-  ret = do_pk8pkey(bp, x, isder, nid, enc, kstr, klen, cb, u);
+  ret = do_pk8pkey(bp, x, isder, nid, enc, pass, pass_len, cb, u);
   BIO_free(bp);
   return ret;
 }

data/third_party/boringssl-with-bazel/src/crypto/pem/pem_pkey.c

@@ -98,26 +98,26 @@ EVP_PKEY *PEM_read_bio_PrivateKey(BIO *bp, EVP_PKEY **x, pem_password_cb *cb,
   } else if (strcmp(nm, PEM_STRING_PKCS8) == 0) {
     PKCS8_PRIV_KEY_INFO *p8inf;
     X509_SIG *p8;
-    int klen;
+    int pass_len;
     char psbuf[PEM_BUFSIZE];
     p8 = d2i_X509_SIG(NULL, &p, len);
     if (!p8) {
       goto p8err;
     }
 
-    klen = 0;
+    pass_len = 0;
     if (!cb) {
       cb = PEM_def_callback;
     }
-    klen = cb(psbuf, PEM_BUFSIZE, 0, u);
-    if (klen <= 0) {
+    pass_len = cb(psbuf, PEM_BUFSIZE, 0, u);
+    if (pass_len < 0) {
       OPENSSL_PUT_ERROR(PEM, PEM_R_BAD_PASSWORD_READ);
       X509_SIG_free(p8);
       goto err;
     }
-    p8inf = PKCS8_decrypt(p8, psbuf, klen);
+    p8inf = PKCS8_decrypt(p8, psbuf, pass_len);
     X509_SIG_free(p8);
-    OPENSSL_cleanse(psbuf, klen);
+    OPENSSL_cleanse(psbuf, pass_len);
     if (!p8inf) {
       goto p8err;
     }
@@ -151,9 +151,10 @@ err:
 }
 
 int PEM_write_bio_PrivateKey(BIO *bp, EVP_PKEY *x, const EVP_CIPHER *enc,
-                             unsigned char *kstr, int klen, pem_password_cb *cb,
-                             void *u) {
-  return PEM_write_bio_PKCS8PrivateKey(bp, x, enc, (char *)kstr, klen, cb, u);
+                             const unsigned char *pass, int pass_len,
+                             pem_password_cb *cb, void *u) {
+  return PEM_write_bio_PKCS8PrivateKey(bp, x, enc, (const char *)pass, pass_len,
+                                       cb, u);
 }
 
 EVP_PKEY *PEM_read_PrivateKey(FILE *fp, EVP_PKEY **x, pem_password_cb *cb,
@@ -169,14 +170,14 @@ EVP_PKEY *PEM_read_PrivateKey(FILE *fp, EVP_PKEY **x, pem_password_cb *cb,
 }
 
 int PEM_write_PrivateKey(FILE *fp, EVP_PKEY *x, const EVP_CIPHER *enc,
-                         unsigned char *kstr, int klen, pem_password_cb *cb,
-                         void *u) {
+                         const unsigned char *pass, int pass_len,
+                         pem_password_cb *cb, void *u) {
   BIO *b = BIO_new_fp(fp, BIO_NOCLOSE);
   if (b == NULL) {
     OPENSSL_PUT_ERROR(PEM, ERR_R_BUF_LIB);
     return 0;
   }
-  int ret = PEM_write_bio_PrivateKey(b, x, enc, kstr, klen, cb, u);
+  int ret = PEM_write_bio_PrivateKey(b, x, enc, pass, pass_len, cb, u);
   BIO_free(b);
   return ret;
 }

data/third_party/boringssl-with-bazel/src/crypto/pkcs8/internal.h

@@ -57,6 +57,7 @@
 #define OPENSSL_HEADER_PKCS8_INTERNAL_H
 
 #include <openssl/base.h>
+#include <openssl/stack.h>
 
 #if defined(__cplusplus)
 extern "C" {

data/third_party/boringssl-with-bazel/src/crypto/rand_extra/deterministic.c

@@ -14,7 +14,8 @@
 
 #include <openssl/rand.h>
 
-#include "../fipsmodule/rand/internal.h"
+#include "../bcm_support.h"
+#include "sysrand_internal.h"
 
 #if defined(OPENSSL_RAND_DETERMINISTIC)
 
@@ -35,6 +36,8 @@ static CRYPTO_MUTEX g_num_calls_lock = CRYPTO_MUTEX_INIT;
 
 void RAND_reset_for_fuzzing(void) { g_num_calls = 0; }
 
+void CRYPTO_init_sysrand(void) {}
+
 void CRYPTO_sysrand(uint8_t *out, size_t requested) {
   static const uint8_t kZeroKey[32];
 
@@ -50,6 +53,11 @@ void CRYPTO_sysrand(uint8_t *out, size_t requested) {
   CRYPTO_chacha_20(out, out, requested, kZeroKey, nonce, 0);
 }
 
+int CRYPTO_sysrand_if_available(uint8_t *buf, size_t len) {
+  CRYPTO_sysrand(buf, len);
+  return 1;
+}
+
 void CRYPTO_sysrand_for_seed(uint8_t *out, size_t requested) {
   CRYPTO_sysrand(out, requested);
 }

data/third_party/boringssl-with-bazel/src/crypto/{fipsmodule/rand → rand_extra}/fork_detect.c

@@ -16,8 +16,7 @@
 #define _GNU_SOURCE  // needed for madvise() and MAP_ANONYMOUS on Linux.
 #endif
 
-#include <openssl/base.h>
-#include "fork_detect.h"
+#include "../bcm_support.h"
 
 #if defined(OPENSSL_FORK_DETECTION_MADVISE)
 #include <unistd.h>
@@ -35,19 +34,18 @@ static_assert(MADV_WIPEONFORK == 18, "MADV_WIPEONFORK is not 18");
 #include <pthread.h>
 #endif // OPENSSL_FORK_DETECTION_MADVISE
 
-#include "../delocate.h"
-#include "../../internal.h"
+#include "../internal.h"
 
 #if defined(OPENSSL_FORK_DETECTION_MADVISE)
-DEFINE_BSS_GET(int, g_force_madv_wipeonfork);
-DEFINE_BSS_GET(int, g_force_madv_wipeonfork_enabled);
-DEFINE_STATIC_ONCE(g_fork_detect_once);
-DEFINE_STATIC_MUTEX(g_fork_detect_lock);
-DEFINE_BSS_GET(CRYPTO_atomic_u32 *, g_fork_detect_addr);
-DEFINE_BSS_GET(uint64_t, g_fork_generation);
+static int g_force_madv_wipeonfork;
+static int g_force_madv_wipeonfork_enabled;
+static CRYPTO_once_t g_fork_detect_once = CRYPTO_ONCE_INIT;
+static CRYPTO_MUTEX g_fork_detect_lock = CRYPTO_MUTEX_INIT;
+static CRYPTO_atomic_u32 * g_fork_detect_addr;
+static uint64_t g_fork_generation;
 
 static void init_fork_detect(void) {
-  if (*g_force_madv_wipeonfork_bss_get()) {
+  if (g_force_madv_wipeonfork) {
     return;
   }
 
@@ -74,13 +72,13 @@ static void init_fork_detect(void) {
   }
 
   CRYPTO_atomic_store_u32(addr, 1);
-  *g_fork_detect_addr_bss_get() = addr;
-  *g_fork_generation_bss_get() = 1;
+  g_fork_detect_addr = addr;
+  g_fork_generation = 1;
 
 }
 
 uint64_t CRYPTO_get_fork_generation(void) {
-  CRYPTO_once(g_fork_detect_once_bss_get(), init_fork_detect);
+  CRYPTO_once(&g_fork_detect_once, init_fork_detect);
 
   // In a single-threaded process, there are obviously no races because there's
   // only a single mutator in the address space.
@@ -93,12 +91,12 @@ uint64_t CRYPTO_get_fork_generation(void) {
   // child process is single-threaded, the child may become multi-threaded
   // before it observes this. Therefore, we must synchronize the logic below.
 
-  CRYPTO_atomic_u32 *const flag_ptr = *g_fork_detect_addr_bss_get();
+  CRYPTO_atomic_u32 *const flag_ptr = g_fork_detect_addr;
   if (flag_ptr == NULL) {
     // Our kernel is too old to support |MADV_WIPEONFORK| or
     // |g_force_madv_wipeonfork| is set.
-    if (*g_force_madv_wipeonfork_bss_get() &&
-        *g_force_madv_wipeonfork_enabled_bss_get()) {
+    if (g_force_madv_wipeonfork &&
+        g_force_madv_wipeonfork_enabled) {
       // A constant generation number to simulate support, even if the kernel
       // doesn't support it.
       return 42;
@@ -114,7 +112,7 @@ uint64_t CRYPTO_get_fork_generation(void) {
 
   // In the common case, try to observe the flag without taking a lock. This
   // avoids cacheline contention in the PRNG.
-  uint64_t *const generation_ptr = g_fork_generation_bss_get();
+  uint64_t *const generation_ptr = &g_fork_generation;
   if (CRYPTO_atomic_load_u32(flag_ptr) != 0) {
     // If we observe a non-zero flag, it is safe to read |generation_ptr|
     // without a lock. The flag and generation number are fixed for this copy of
@@ -125,7 +123,7 @@ uint64_t CRYPTO_get_fork_generation(void) {
   // The flag was zero. The generation number must be incremented, but other
   // threads may have concurrently observed the zero, so take a lock before
   // incrementing.
-  CRYPTO_MUTEX *const lock = g_fork_detect_lock_bss_get();
+  CRYPTO_MUTEX *const lock = &g_fork_detect_lock;
   CRYPTO_MUTEX_lock_write(lock);
   uint64_t current_generation = *generation_ptr;
   if (CRYPTO_atomic_load_u32(flag_ptr) == 0) {
@@ -147,35 +145,35 @@ uint64_t CRYPTO_get_fork_generation(void) {
 }
 
 void CRYPTO_fork_detect_force_madv_wipeonfork_for_testing(int on) {
-  *g_force_madv_wipeonfork_bss_get() = 1;
-  *g_force_madv_wipeonfork_enabled_bss_get() = on;
+  g_force_madv_wipeonfork = 1;
+  g_force_madv_wipeonfork_enabled = on;
 }
 
 #elif defined(OPENSSL_FORK_DETECTION_PTHREAD_ATFORK)
 
-DEFINE_STATIC_ONCE(g_pthread_fork_detection_once);
-DEFINE_BSS_GET(uint64_t, g_atfork_fork_generation);
+static CRYPTO_once_t g_pthread_fork_detection_once = CRYPTO_ONCE_INIT;
+static uint64_t g_atfork_fork_generation;
 
 static void we_are_forked(void) {
   // Immediately after a fork, the process must be single-threaded.
-  uint64_t value = *g_atfork_fork_generation_bss_get() + 1;
+  uint64_t value = g_atfork_fork_generation + 1;
   if (value == 0) {
     value = 1;
   }
-  *g_atfork_fork_generation_bss_get() = value;
+  g_atfork_fork_generation = value;
 }
 
 static void init_pthread_fork_detection(void) {
   if (pthread_atfork(NULL, NULL, we_are_forked) != 0) {
     abort();
   }
-  *g_atfork_fork_generation_bss_get() = 1;
+  g_atfork_fork_generation = 1;
 }
 
 uint64_t CRYPTO_get_fork_generation(void) {
-  CRYPTO_once(g_pthread_fork_detection_once_bss_get(), init_pthread_fork_detection);
+  CRYPTO_once(&g_pthread_fork_detection_once, init_pthread_fork_detection);
 
-  return *g_atfork_fork_generation_bss_get();
+  return g_atfork_fork_generation;
 }
 
 #elif defined(OPENSSL_DOES_NOT_FORK)

data/third_party/boringssl-with-bazel/src/crypto/rand_extra/getentropy.c

@@ -18,7 +18,8 @@
 
 #include <openssl/rand.h>
 
-#include "../fipsmodule/rand/internal.h"
+#include "../bcm_support.h"
+#include "sysrand_internal.h"
 
 #if defined(OPENSSL_RAND_GETENTROPY)
 
@@ -30,6 +31,8 @@
 #include <sys/random.h>
 #endif
 
+void CRYPTO_init_sysrand(void) {}
+
 // CRYPTO_sysrand puts |requested| random bytes into |out|.
 void CRYPTO_sysrand(uint8_t *out, size_t requested) {
   while (requested > 0) {
@@ -45,6 +48,11 @@ void CRYPTO_sysrand(uint8_t *out, size_t requested) {
   }
 }
 
+int CRYPTO_sysrand_if_available(uint8_t *buf, size_t len) {
+  CRYPTO_sysrand(buf, len);
+  return 1;
+}
+
 void CRYPTO_sysrand_for_seed(uint8_t *out, size_t requested) {
   CRYPTO_sysrand(out, requested);
 }

data/third_party/boringssl-with-bazel/src/crypto/rand_extra/ios.c

@@ -14,19 +14,27 @@
 
 #include <openssl/rand.h>
 
-#include "../fipsmodule/rand/internal.h"
+#include "../bcm_support.h"
+#include "sysrand_internal.h"
 
 #if defined(OPENSSL_RAND_IOS)
 #include <stdlib.h>
 
 #include <CommonCrypto/CommonRandom.h>
 
+void CRYPTO_init_sysrand(void) {}
+
 void CRYPTO_sysrand(uint8_t *out, size_t requested) {
   if (CCRandomGenerateBytes(out, requested) != kCCSuccess) {
     abort();
   }
 }
 
+int CRYPTO_sysrand_if_available(uint8_t *buf, size_t len) {
+  CRYPTO_sysrand(buf, len);
+  return 1;
+}
+
 void CRYPTO_sysrand_for_seed(uint8_t *out, size_t requested) {
   CRYPTO_sysrand(out, requested);
 }

data/third_party/boringssl-with-bazel/src/crypto/rand_extra/passive.c

@@ -14,11 +14,27 @@
 
 #include <openssl/ctrdrbg.h>
 
-#include "../fipsmodule/rand/internal.h"
+#include "../fipsmodule/bcm_interface.h"
+#include "../bcm_support.h"
 #include "../internal.h"
 
 #if defined(BORINGSSL_FIPS)
 
+// passive_get_seed_entropy writes |out_entropy_len| bytes of entropy, suitable
+// for seeding a DRBG, to |out_entropy|. It sets |*out_used_cpu| to one if the
+// entropy came directly from the CPU and zero if it came from the OS. It
+// actively obtains entropy from the CPU/OS
+static void passive_get_seed_entropy(uint8_t *out_entropy,
+                                     size_t out_entropy_len,
+                                     int *out_want_additional_input) {
+  *out_want_additional_input = 0;
+  if (bcm_success(BCM_rand_bytes_hwrng(out_entropy, out_entropy_len))) {
+    *out_want_additional_input = 1;
+  } else {
+    CRYPTO_sysrand_for_seed(out_entropy, out_entropy_len);
+  }
+}
+
 #define ENTROPY_READ_LEN \
   (/* last_block size */ 16 + CTR_DRBG_ENTROPY_LEN * BORINGSSL_FIPS_OVERREAD)
 
@@ -143,7 +159,7 @@ void RAND_need_entropy(size_t bytes_needed) {
   if (get_seed_from_daemon(buf, todo)) {
     want_additional_input = 1;
   } else {
-    CRYPTO_get_seed_entropy(buf, todo, &want_additional_input);
+    passive_get_seed_entropy(buf, todo, &want_additional_input);
   }
 
   if (boringssl_fips_break_test("CRNG")) {
@@ -152,7 +168,7 @@ void RAND_need_entropy(size_t bytes_needed) {
     OPENSSL_memset(buf, 0, todo);
   }
 
-  RAND_load_entropy(buf, todo, want_additional_input);
+  BCM_rand_load_entropy(buf, todo, want_additional_input);
 }
 
 #endif  // FIPS