grpc 1.64.0 → 1.68.1

data/third_party/boringssl-with-bazel/src/crypto/dilithium/internal.h

@@ -0,0 +1,58 @@
+/* Copyright (c) 2023, Google LLC
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+
+#ifndef OPENSSL_HEADER_CRYPTO_DILITHIUM_INTERNAL_H
+#define OPENSSL_HEADER_CRYPTO_DILITHIUM_INTERNAL_H
+
+#include <openssl/base.h>
+#include <openssl/experimental/dilithium.h>
+
+#if defined(__cplusplus)
+extern "C" {
+#endif
+
+
+// DILITHIUM_GENERATE_KEY_ENTROPY is the number of bytes of uniformly random
+// entropy necessary to generate a key pair.
+#define DILITHIUM_GENERATE_KEY_ENTROPY 32
+
+// DILITHIUM_SIGNATURE_RANDOMIZER_BYTES is the number of bytes of uniformly
+// random entropy necessary to generate a signature in randomized mode.
+#define DILITHIUM_SIGNATURE_RANDOMIZER_BYTES 32
+
+// DILITHIUM_generate_key_external_entropy generates a public/private key pair
+// using the given seed, writes the encoded public key to
+// |out_encoded_public_key| and sets |out_private_key| to the private key,
+// returning 1 on success and 0 on failure. Returns 1 on success and 0 on
+// failure.
+OPENSSL_EXPORT int DILITHIUM_generate_key_external_entropy(
+    uint8_t out_encoded_public_key[DILITHIUM_PUBLIC_KEY_BYTES],
+    struct DILITHIUM_private_key *out_private_key,
+    const uint8_t entropy[DILITHIUM_GENERATE_KEY_ENTROPY]);
+
+// DILITHIUM_sign_deterministic generates a signature for the message |msg| of
+// length |msg_len| using |private_key| following the deterministic algorithm,
+// and writes the encoded signature to |out_encoded_signature|. Returns 1 on
+// success and 0 on failure.
+OPENSSL_EXPORT int DILITHIUM_sign_deterministic(
+    uint8_t out_encoded_signature[DILITHIUM_SIGNATURE_BYTES],
+    const struct DILITHIUM_private_key *private_key, const uint8_t *msg,
+    size_t msg_len);
+
+
+#if defined(__cplusplus)
+}  // extern C
+#endif
+
+#endif  // OPENSSL_HEADER_CRYPTO_DILITHIUM_INTERNAL_H

data/third_party/boringssl-with-bazel/src/crypto/dsa/dsa.c

@@ -208,6 +208,11 @@ int DSA_set0_pqg(DSA *dsa, BIGNUM *p, BIGNUM *q, BIGNUM *g) {
 int DSA_generate_parameters_ex(DSA *dsa, unsigned bits, const uint8_t *seed_in,
                                size_t seed_len, int *out_counter,
                                unsigned long *out_h, BN_GENCB *cb) {
+  if (bits > OPENSSL_DSA_MAX_MODULUS_BITS) {
+    OPENSSL_PUT_ERROR(DSA, DSA_R_INVALID_PARAMETERS);
+    return 0;
+  }
+
   int ok = 0;
   unsigned char seed[SHA256_DIGEST_LENGTH];
   unsigned char md[SHA256_DIGEST_LENGTH];
@@ -479,11 +484,13 @@ DSA *DSAparams_dup(const DSA *dsa) {
 }
 
 int DSA_generate_key(DSA *dsa) {
+  if (!dsa_check_key(dsa)) {
+    return 0;
+  }
+
   int ok = 0;
-  BN_CTX *ctx = NULL;
   BIGNUM *pub_key = NULL, *priv_key = NULL;
-
-  ctx = BN_CTX_new();
+  BN_CTX *ctx = BN_CTX_new();
   if (ctx == NULL) {
     goto err;
   }

data/third_party/boringssl-with-bazel/src/crypto/dsa/dsa_asn1.c

@@ -65,8 +65,6 @@
 #include "../bytestring/internal.h"
 
 
-#define OPENSSL_DSA_MAX_MODULUS_BITS 10000
-
 // This function is in dsa_asn1.c rather than dsa.c because it is reachable from
 // |EVP_PKEY| parsers. This makes it easier for the static linker to drop most
 // of the DSA implementation.

data/third_party/boringssl-with-bazel/src/crypto/dsa/internal.h

@@ -42,6 +42,8 @@ struct dsa_st {
   CRYPTO_EX_DATA ex_data;
 };
 
+#define OPENSSL_DSA_MAX_MODULUS_BITS 10000
+
 // dsa_check_key performs cheap self-checks on |dsa|, and ensures it is within
 // DoS bounds. It returns one on success and zero on error.
 int dsa_check_key(const DSA *dsa);

data/third_party/boringssl-with-bazel/src/crypto/ecdsa_extra/ecdsa_asn1.c

@@ -62,34 +62,87 @@
 #include <openssl/mem.h>
 
 #include "../bytestring/internal.h"
-#include "../fipsmodule/ec/internal.h"
+#include "../fipsmodule/ecdsa/internal.h"
 #include "../internal.h"
 
 
+static ECDSA_SIG *ecdsa_sig_from_fixed(const EC_KEY *key, const uint8_t *in,
+                                       size_t len) {
+  const EC_GROUP *group = EC_KEY_get0_group(key);
+  if (group == NULL) {
+    OPENSSL_PUT_ERROR(ECDSA, ERR_R_PASSED_NULL_PARAMETER);
+    return NULL;
+  }
+  size_t scalar_len = BN_num_bytes(EC_GROUP_get0_order(group));
+  if (len != 2 * scalar_len) {
+    OPENSSL_PUT_ERROR(ECDSA, ECDSA_R_BAD_SIGNATURE);
+    return NULL;
+  }
+  ECDSA_SIG *ret = ECDSA_SIG_new();
+  if (ret == NULL ||
+      !BN_bin2bn(in, scalar_len, ret->r) ||
+      !BN_bin2bn(in + scalar_len, scalar_len, ret->s)) {
+    ECDSA_SIG_free(ret);
+    return NULL;
+  }
+  return ret;
+}
+
+static int ecdsa_sig_to_fixed(const EC_KEY *key, uint8_t *out, size_t *out_len,
+                              size_t max_out, const ECDSA_SIG *sig) {
+  const EC_GROUP *group = EC_KEY_get0_group(key);
+  if (group == NULL) {
+    OPENSSL_PUT_ERROR(ECDSA, ERR_R_PASSED_NULL_PARAMETER);
+    return 0;
+  }
+  size_t scalar_len = BN_num_bytes(EC_GROUP_get0_order(group));
+  if (max_out < 2 * scalar_len) {
+    OPENSSL_PUT_ERROR(EC, EC_R_BUFFER_TOO_SMALL);
+    return 0;
+  }
+  if (BN_is_negative(sig->r) ||
+      !BN_bn2bin_padded(out, scalar_len, sig->r) ||
+      BN_is_negative(sig->s) ||
+      !BN_bn2bin_padded(out + scalar_len, scalar_len, sig->s)) {
+    OPENSSL_PUT_ERROR(ECDSA, ECDSA_R_BAD_SIGNATURE);
+    return 0;
+  }
+  *out_len = 2 * scalar_len;
+  return 1;
+}
+
 int ECDSA_sign(int type, const uint8_t *digest, size_t digest_len, uint8_t *sig,
-               unsigned int *sig_len, const EC_KEY *eckey) {
+               unsigned int *out_sig_len, const EC_KEY *eckey) {
   if (eckey->ecdsa_meth && eckey->ecdsa_meth->sign) {
-    return eckey->ecdsa_meth->sign(digest, digest_len, sig, sig_len,
+    return eckey->ecdsa_meth->sign(digest, digest_len, sig, out_sig_len,
                                    (EC_KEY*) eckey /* cast away const */);
   }
 
-  int ret = 0;
-  ECDSA_SIG *s = ECDSA_do_sign(digest, digest_len, eckey);
+  *out_sig_len = 0;
+  uint8_t fixed[ECDSA_MAX_FIXED_LEN];
+  size_t fixed_len;
+  if (!ecdsa_sign_fixed(digest, digest_len, fixed, &fixed_len, sizeof(fixed),
+                        eckey)) {
+    return 0;
+  }
+
+  // TODO(davidben): We can actually do better and go straight from the DER
+  // format to the fixed-width format without a malloc.
+  ECDSA_SIG *s = ecdsa_sig_from_fixed(eckey, fixed, fixed_len);
   if (s == NULL) {
-    *sig_len = 0;
-    goto err;
+    return 0;
   }
 
+  int ret = 0;
   CBB cbb;
   CBB_init_fixed(&cbb, sig, ECDSA_size(eckey));
   size_t len;
   if (!ECDSA_SIG_marshal(&cbb, s) ||
       !CBB_finish(&cbb, NULL, &len)) {
     OPENSSL_PUT_ERROR(ECDSA, ECDSA_R_ENCODE_ERROR);
-    *sig_len = 0;
     goto err;
   }
-  *sig_len = (unsigned)len;
+  *out_sig_len = (unsigned)len;
   ret = 1;
 
 err:
@@ -99,12 +152,13 @@ err:
 
 int ECDSA_verify(int type, const uint8_t *digest, size_t digest_len,
                  const uint8_t *sig, size_t sig_len, const EC_KEY *eckey) {
-  ECDSA_SIG *s;
+  // Decode the ECDSA signature.
+  //
+  // TODO(davidben): We can actually do better and go straight from the DER
+  // format to the fixed-width format without a malloc.
   int ret = 0;
   uint8_t *der = NULL;
-
-  // Decode the ECDSA signature.
-  s = ECDSA_SIG_from_bytes(sig, sig_len);
+  ECDSA_SIG *s = ECDSA_SIG_from_bytes(sig, sig_len);
   if (s == NULL) {
     goto err;
   }
@@ -118,7 +172,10 @@ int ECDSA_verify(int type, const uint8_t *digest, size_t digest_len,
     goto err;
   }
 
-  ret = ECDSA_do_verify(digest, digest_len, s, eckey);
+  uint8_t fixed[ECDSA_MAX_FIXED_LEN];
+  size_t fixed_len;
+  ret = ecdsa_sig_to_fixed(eckey, fixed, &fixed_len, sizeof(fixed), s) &&
+        ecdsa_verify_fixed(digest, digest_len, fixed, fixed_len, eckey);
 
 err:
   OPENSSL_free(der);
@@ -147,6 +204,95 @@ size_t ECDSA_size(const EC_KEY *key) {
   return ECDSA_SIG_max_len(group_order_size);
 }
 
+ECDSA_SIG *ECDSA_SIG_new(void) {
+  ECDSA_SIG *sig = OPENSSL_malloc(sizeof(ECDSA_SIG));
+  if (sig == NULL) {
+    return NULL;
+  }
+  sig->r = BN_new();
+  sig->s = BN_new();
+  if (sig->r == NULL || sig->s == NULL) {
+    ECDSA_SIG_free(sig);
+    return NULL;
+  }
+  return sig;
+}
+
+void ECDSA_SIG_free(ECDSA_SIG *sig) {
+  if (sig == NULL) {
+    return;
+  }
+
+  BN_free(sig->r);
+  BN_free(sig->s);
+  OPENSSL_free(sig);
+}
+
+const BIGNUM *ECDSA_SIG_get0_r(const ECDSA_SIG *sig) {
+  return sig->r;
+}
+
+const BIGNUM *ECDSA_SIG_get0_s(const ECDSA_SIG *sig) {
+  return sig->s;
+}
+
+void ECDSA_SIG_get0(const ECDSA_SIG *sig, const BIGNUM **out_r,
+                    const BIGNUM **out_s) {
+  if (out_r != NULL) {
+    *out_r = sig->r;
+  }
+  if (out_s != NULL) {
+    *out_s = sig->s;
+  }
+}
+
+int ECDSA_SIG_set0(ECDSA_SIG *sig, BIGNUM *r, BIGNUM *s) {
+  if (r == NULL || s == NULL) {
+    return 0;
+  }
+  BN_free(sig->r);
+  BN_free(sig->s);
+  sig->r = r;
+  sig->s = s;
+  return 1;
+}
+
+int ECDSA_do_verify(const uint8_t *digest, size_t digest_len,
+                    const ECDSA_SIG *sig, const EC_KEY *eckey) {
+  uint8_t fixed[ECDSA_MAX_FIXED_LEN];
+  size_t fixed_len;
+  return ecdsa_sig_to_fixed(eckey, fixed, &fixed_len, sizeof(fixed), sig) &&
+         ecdsa_verify_fixed(digest, digest_len, fixed, fixed_len, eckey);
+}
+
+// This function is only exported for testing and is not called in production
+// code.
+ECDSA_SIG *ECDSA_sign_with_nonce_and_leak_private_key_for_testing(
+    const uint8_t *digest, size_t digest_len, const EC_KEY *eckey,
+    const uint8_t *nonce, size_t nonce_len) {
+  uint8_t sig[ECDSA_MAX_FIXED_LEN];
+  size_t sig_len;
+  if (!ecdsa_sign_fixed_with_nonce_for_known_answer_test(
+          digest, digest_len, sig, &sig_len, sizeof(sig), eckey, nonce,
+          nonce_len)) {
+    return NULL;
+  }
+
+  return ecdsa_sig_from_fixed(eckey, sig, sig_len);
+}
+
+ECDSA_SIG *ECDSA_do_sign(const uint8_t *digest, size_t digest_len,
+                         const EC_KEY *eckey) {
+  uint8_t sig[ECDSA_MAX_FIXED_LEN];
+  size_t sig_len;
+  if (!ecdsa_sign_fixed(digest, digest_len, sig, &sig_len, sizeof(sig),
+                        eckey)) {
+    return NULL;
+  }
+
+  return ecdsa_sig_from_fixed(eckey, sig, sig_len);
+}
+
 ECDSA_SIG *ECDSA_SIG_parse(CBS *cbs) {
   ECDSA_SIG *ret = ECDSA_SIG_new();
   if (ret == NULL) {

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/aes/{aes.c → aes.c.inc}

@@ -104,3 +104,24 @@ int AES_set_decrypt_key(const uint8_t *key, unsigned bits, AES_KEY *aeskey) {
     return aes_nohw_set_decrypt_key(key, bits, aeskey);
   }
 }
+
+#if defined(HWAES) && (defined(OPENSSL_X86) || defined(OPENSSL_X86_64))
+// On x86 and x86_64, |aes_hw_set_decrypt_key|, we implement
+// |aes_hw_encrypt_key_to_decrypt_key| in assembly and rely on C code to combine
+// the operations.
+int aes_hw_set_decrypt_key(const uint8_t *user_key, int bits, AES_KEY *key) {
+  int ret = aes_hw_set_encrypt_key(user_key, bits, key);
+  if (ret == 0) {
+    aes_hw_encrypt_key_to_decrypt_key(key);
+  }
+  return ret;
+}
+
+int aes_hw_set_encrypt_key(const uint8_t *user_key, int bits, AES_KEY *key) {
+  if (aes_hw_set_encrypt_key_alt_preferred()) {
+    return aes_hw_set_encrypt_key_alt(user_key, bits, key);
+  } else {
+    return aes_hw_set_encrypt_key_base(user_key, bits, key);
+  }
+}
+#endif

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/aes/internal.h

@@ -17,6 +17,8 @@
 
 #include <stdlib.h>
 
+#include <openssl/aes.h>
+
 #include "../../internal.h"
 
 #if defined(__cplusplus)
@@ -66,17 +68,41 @@ OPENSSL_INLINE int vpaes_capable(void) { return CRYPTO_is_NEON_capable(); }
 
 #if defined(HWAES)
 
-int aes_hw_set_encrypt_key(const uint8_t *user_key, const int bits,
-                           AES_KEY *key);
-int aes_hw_set_decrypt_key(const uint8_t *user_key, const int bits,
-                           AES_KEY *key);
+int aes_hw_set_encrypt_key(const uint8_t *user_key, int bits, AES_KEY *key);
+int aes_hw_set_decrypt_key(const uint8_t *user_key, int bits, AES_KEY *key);
 void aes_hw_encrypt(const uint8_t *in, uint8_t *out, const AES_KEY *key);
 void aes_hw_decrypt(const uint8_t *in, uint8_t *out, const AES_KEY *key);
 void aes_hw_cbc_encrypt(const uint8_t *in, uint8_t *out, size_t length,
-                        const AES_KEY *key, uint8_t *ivec, const int enc);
+                        const AES_KEY *key, uint8_t *ivec, int enc);
 void aes_hw_ctr32_encrypt_blocks(const uint8_t *in, uint8_t *out, size_t len,
                                  const AES_KEY *key, const uint8_t ivec[16]);
 
+#if defined(OPENSSL_X86) || defined(OPENSSL_X86_64)
+// On x86 and x86_64, |aes_hw_set_decrypt_key| is implemented in terms of
+// |aes_hw_set_encrypt_key| and a conversion function.
+void aes_hw_encrypt_key_to_decrypt_key(AES_KEY *key);
+
+// There are two variants of this function, one which uses aeskeygenassist
+// ("base") and one which uses aesenclast + pshufb ("alt"). aesenclast is
+// overall faster but is slower on some older processors. It doesn't use AVX,
+// but AVX is used as a proxy to detecting this. See
+// https://groups.google.com/g/mailing.openssl.dev/c/OuFXwW4NfO8/m/7d2ZXVjkxVkJ
+//
+// TODO(davidben): It is unclear if the aeskeygenassist version is still
+// worthwhile. However, the aesenclast version requires SSSE3. SSSE3 long
+// predates AES-NI, but it's not clear if AES-NI implies SSSE3. In OpenSSL, the
+// CCM AES-NI assembly seems to assume it does.
+OPENSSL_INLINE int aes_hw_set_encrypt_key_alt_capable(void) {
+  return hwaes_capable() && CRYPTO_is_SSSE3_capable();
+}
+OPENSSL_INLINE int aes_hw_set_encrypt_key_alt_preferred(void) {
+  return hwaes_capable() && CRYPTO_is_AVX_capable();
+}
+int aes_hw_set_encrypt_key_base(const uint8_t *user_key, int bits,
+                                AES_KEY *key);
+int aes_hw_set_encrypt_key_alt(const uint8_t *user_key, int bits, AES_KEY *key);
+#endif  // OPENSSL_X86 || OPENSSL_X86_64
+
 #else
 
 // If HWAES isn't defined then we provide dummy functions for each of the hwaes
@@ -120,7 +146,7 @@ OPENSSL_INLINE void aes_hw_ctr32_encrypt_blocks(const uint8_t *in, uint8_t *out,
 
 #if defined(HWAES_ECB)
 void aes_hw_ecb_encrypt(const uint8_t *in, uint8_t *out, size_t length,
-                        const AES_KEY *key, const int enc);
+                        const AES_KEY *key, int enc);
 #endif  // HWAES_ECB
 
 
@@ -218,7 +244,7 @@ void aes_nohw_ctr32_encrypt_blocks(const uint8_t *in, uint8_t *out,
                                    size_t blocks, const AES_KEY *key,
                                    const uint8_t ivec[16]);
 void aes_nohw_cbc_encrypt(const uint8_t *in, uint8_t *out, size_t len,
-                          const AES_KEY *key, uint8_t *ivec, const int enc);
+                          const AES_KEY *key, uint8_t *ivec, int enc);
 
 
 #if defined(__cplusplus)

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/bcm.c

@@ -28,84 +28,85 @@
 #include <openssl/hmac.h>
 #include <openssl/sha.h>
 
+#include "bcm_interface.h"
 #include "../internal.h"
 
-#include "aes/aes.c"
-#include "aes/aes_nohw.c"
-#include "aes/key_wrap.c"
-#include "aes/mode_wrappers.c"
-#include "bn/add.c"
-#include "bn/asm/x86_64-gcc.c"
-#include "bn/bn.c"
-#include "bn/bytes.c"
-#include "bn/cmp.c"
-#include "bn/ctx.c"
-#include "bn/div.c"
-#include "bn/div_extra.c"
-#include "bn/exponentiation.c"
-#include "bn/gcd.c"
-#include "bn/gcd_extra.c"
-#include "bn/generic.c"
-#include "bn/jacobi.c"
-#include "bn/montgomery.c"
-#include "bn/montgomery_inv.c"
-#include "bn/mul.c"
-#include "bn/prime.c"
-#include "bn/random.c"
-#include "bn/rsaz_exp.c"
-#include "bn/shift.c"
-#include "bn/sqrt.c"
-#include "cipher/aead.c"
-#include "cipher/cipher.c"
-#include "cipher/e_aes.c"
-#include "cipher/e_aesccm.c"
-#include "cmac/cmac.c"
-#include "dh/check.c"
-#include "dh/dh.c"
-#include "digest/digest.c"
-#include "digest/digests.c"
-#include "digestsign/digestsign.c"
-#include "ecdh/ecdh.c"
-#include "ecdsa/ecdsa.c"
-#include "ec/ec.c"
-#include "ec/ec_key.c"
-#include "ec/ec_montgomery.c"
-#include "ec/felem.c"
-#include "ec/oct.c"
-#include "ec/p224-64.c"
-#include "ec/p256.c"
-#include "ec/p256-nistz.c"
-#include "ec/scalar.c"
-#include "ec/simple.c"
-#include "ec/simple_mul.c"
-#include "ec/util.c"
-#include "ec/wnaf.c"
-#include "hkdf/hkdf.c"
-#include "hmac/hmac.c"
-#include "md4/md4.c"
-#include "md5/md5.c"
-#include "modes/cbc.c"
-#include "modes/cfb.c"
-#include "modes/ctr.c"
-#include "modes/gcm.c"
-#include "modes/gcm_nohw.c"
-#include "modes/ofb.c"
-#include "modes/polyval.c"
-#include "rand/ctrdrbg.c"
-#include "rand/fork_detect.c"
-#include "rand/rand.c"
-#include "rand/urandom.c"
-#include "rsa/blinding.c"
-#include "rsa/padding.c"
-#include "rsa/rsa.c"
-#include "rsa/rsa_impl.c"
-#include "self_check/fips.c"
-#include "self_check/self_check.c"
-#include "service_indicator/service_indicator.c"
-#include "sha/sha1.c"
-#include "sha/sha256.c"
-#include "sha/sha512.c"
-#include "tls/kdf.c"
+// TODO(crbug.com/362530616): When delocate is removed, build these files as
+// separate compilation units again.
+#include "aes/aes.c.inc"
+#include "aes/aes_nohw.c.inc"
+#include "aes/key_wrap.c.inc"
+#include "aes/mode_wrappers.c.inc"
+#include "bn/add.c.inc"
+#include "bn/asm/x86_64-gcc.c.inc"
+#include "bn/bn.c.inc"
+#include "bn/bytes.c.inc"
+#include "bn/cmp.c.inc"
+#include "bn/ctx.c.inc"
+#include "bn/div.c.inc"
+#include "bn/div_extra.c.inc"
+#include "bn/exponentiation.c.inc"
+#include "bn/gcd.c.inc"
+#include "bn/gcd_extra.c.inc"
+#include "bn/generic.c.inc"
+#include "bn/jacobi.c.inc"
+#include "bn/montgomery.c.inc"
+#include "bn/montgomery_inv.c.inc"
+#include "bn/mul.c.inc"
+#include "bn/prime.c.inc"
+#include "bn/random.c.inc"
+#include "bn/rsaz_exp.c.inc"
+#include "bn/shift.c.inc"
+#include "bn/sqrt.c.inc"
+#include "cipher/aead.c.inc"
+#include "cipher/cipher.c.inc"
+#include "cipher/e_aes.c.inc"
+#include "cipher/e_aesccm.c.inc"
+#include "cmac/cmac.c.inc"
+#include "dh/check.c.inc"
+#include "dh/dh.c.inc"
+#include "digest/digest.c.inc"
+#include "digest/digests.c.inc"
+#include "digestsign/digestsign.c.inc"
+#include "ecdh/ecdh.c.inc"
+#include "ecdsa/ecdsa.c.inc"
+#include "ec/ec.c.inc"
+#include "ec/ec_key.c.inc"
+#include "ec/ec_montgomery.c.inc"
+#include "ec/felem.c.inc"
+#include "ec/oct.c.inc"
+#include "ec/p224-64.c.inc"
+#include "ec/p256.c.inc"
+#include "ec/p256-nistz.c.inc"
+#include "ec/scalar.c.inc"
+#include "ec/simple.c.inc"
+#include "ec/simple_mul.c.inc"
+#include "ec/util.c.inc"
+#include "ec/wnaf.c.inc"
+#include "hkdf/hkdf.c.inc"
+#include "hmac/hmac.c.inc"
+#include "md4/md4.c.inc"
+#include "md5/md5.c.inc"
+#include "modes/cbc.c.inc"
+#include "modes/cfb.c.inc"
+#include "modes/ctr.c.inc"
+#include "modes/gcm.c.inc"
+#include "modes/gcm_nohw.c.inc"
+#include "modes/ofb.c.inc"
+#include "modes/polyval.c.inc"
+#include "rand/ctrdrbg.c.inc"
+#include "rand/rand.c.inc"
+#include "rsa/blinding.c.inc"
+#include "rsa/padding.c.inc"
+#include "rsa/rsa.c.inc"
+#include "rsa/rsa_impl.c.inc"
+#include "self_check/fips.c.inc"
+#include "self_check/self_check.c.inc"
+#include "service_indicator/service_indicator.c.inc"
+#include "sha/sha1.c.inc"
+#include "sha/sha256.c.inc"
+#include "sha/sha512.c.inc"
+#include "tls/kdf.c.inc"
 
 
 #if defined(BORINGSSL_FIPS)
@@ -168,8 +169,6 @@ static void BORINGSSL_maybe_set_module_text_permissions(int permission) {}
 
 static void __attribute__((constructor))
 BORINGSSL_bcm_power_on_self_test(void) {
-  CRYPTO_library_init();
-
 #if !defined(OPENSSL_ASAN)
   // Integrity tests cannot run under ASAN because it involves reading the full
   // .text section, which triggers the global-buffer overflow detection.
@@ -195,10 +194,10 @@ int BORINGSSL_integrity_test(void) {
 
   assert_within(start, AES_encrypt, end);
   assert_within(start, RSA_sign, end);
-  assert_within(start, RAND_bytes, end);
+  assert_within(start, BCM_rand_bytes, end);
   assert_within(start, EC_GROUP_cmp, end);
   assert_within(start, SHA256_Update, end);
-  assert_within(start, ECDSA_do_verify, end);
+  assert_within(start, ecdsa_verify_fixed, end);
   assert_within(start, EVP_AEAD_CTX_seal, end);
 
 #if defined(BORINGSSL_SHARED_LIBRARY)
@@ -263,6 +262,11 @@ int BORINGSSL_integrity_test(void) {
   OPENSSL_cleanse(result, sizeof(result)); // FIPS 140-3, AS05.10.
   return 1;
 }
+
+const uint8_t* FIPS_module_hash(void) {
+  return BORINGSSL_bcm_text_hash;
+}
+
 #endif  // OPENSSL_ASAN
 
 void BORINGSSL_FIPS_abort(void) {