grpc 1.68.1 → 1.71.0

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/sha/internal.h

@@ -1,16 +1,16 @@
-/* Copyright (c) 2018, Google Inc.
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+// Copyright 2018 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
 
 #ifndef OPENSSL_HEADER_SHA_INTERNAL_H
 #define OPENSSL_HEADER_SHA_INTERNAL_H
@@ -33,18 +33,14 @@ extern "C" {
 #define SHA512_ASM_NOHW
 
 #define SHA1_ASM_HW
-OPENSSL_INLINE int sha1_hw_capable(void) {
-  return CRYPTO_is_ARMv8_SHA1_capable();
-}
+inline int sha1_hw_capable(void) { return CRYPTO_is_ARMv8_SHA1_capable(); }
 
 #define SHA1_ASM_NEON
 void sha1_block_data_order_neon(uint32_t state[5], const uint8_t *data,
                                 size_t num);
 
 #define SHA256_ASM_HW
-OPENSSL_INLINE int sha256_hw_capable(void) {
-  return CRYPTO_is_ARMv8_SHA256_capable();
-}
+inline int sha256_hw_capable(void) { return CRYPTO_is_ARMv8_SHA256_capable(); }
 
 #define SHA256_ASM_NEON
 void sha256_block_data_order_neon(uint32_t state[8], const uint8_t *data,
@@ -62,19 +58,13 @@ void sha512_block_data_order_neon(uint64_t state[8], const uint8_t *data,
 #define SHA512_ASM_NOHW
 
 #define SHA1_ASM_HW
-OPENSSL_INLINE int sha1_hw_capable(void) {
-  return CRYPTO_is_ARMv8_SHA1_capable();
-}
+inline int sha1_hw_capable(void) { return CRYPTO_is_ARMv8_SHA1_capable(); }
 
 #define SHA256_ASM_HW
-OPENSSL_INLINE int sha256_hw_capable(void) {
-  return CRYPTO_is_ARMv8_SHA256_capable();
-}
+inline int sha256_hw_capable(void) { return CRYPTO_is_ARMv8_SHA256_capable(); }
 
 #define SHA512_ASM_HW
-OPENSSL_INLINE int sha512_hw_capable(void) {
-  return CRYPTO_is_ARMv8_SHA512_capable();
-}
+inline int sha512_hw_capable(void) { return CRYPTO_is_ARMv8_SHA512_capable(); }
 
 #elif !defined(OPENSSL_NO_ASM) && defined(OPENSSL_X86)
 
@@ -83,7 +73,7 @@ OPENSSL_INLINE int sha512_hw_capable(void) {
 #define SHA512_ASM_NOHW
 
 #define SHA1_ASM_SSSE3
-OPENSSL_INLINE int sha1_ssse3_capable(void) {
+inline int sha1_ssse3_capable(void) {
   // TODO(davidben): Do we need to check the FXSR bit? The Intel manual does not
   // say to.
   return CRYPTO_is_SSSE3_capable() && CRYPTO_is_FXSR_capable();
@@ -92,11 +82,10 @@ void sha1_block_data_order_ssse3(uint32_t state[5], const uint8_t *data,
                                  size_t num);
 
 #define SHA1_ASM_AVX
-OPENSSL_INLINE int sha1_avx_capable(void) {
-  // Pre-Zen AMD CPUs had slow SHLD/SHRD; Zen added the SHA extension; see the
-  // discussion in sha1-586.pl.
+inline int sha1_avx_capable(void) {
+  // AMD CPUs have slow SHLD/SHRD. See also the discussion in sha1-586.pl.
   //
-  // TODO(davidben): Should we enable SHAEXT on 32-bit x86?
+  // TODO(crbug.com/42290564): Should we enable SHAEXT on 32-bit x86?
   // TODO(davidben): Do we need to check the FXSR bit? The Intel manual does not
   // say to.
   return CRYPTO_is_AVX_capable() && CRYPTO_is_intel_cpu() &&
@@ -106,7 +95,7 @@ void sha1_block_data_order_avx(uint32_t state[5], const uint8_t *data,
                                size_t num);
 
 #define SHA256_ASM_SSSE3
-OPENSSL_INLINE int sha256_ssse3_capable(void) {
+inline int sha256_ssse3_capable(void) {
   // TODO(davidben): Do we need to check the FXSR bit? The Intel manual does not
   // say to.
   return CRYPTO_is_SSSE3_capable() && CRYPTO_is_FXSR_capable();
@@ -115,11 +104,10 @@ void sha256_block_data_order_ssse3(uint32_t state[8], const uint8_t *data,
                                    size_t num);
 
 #define SHA256_ASM_AVX
-OPENSSL_INLINE int sha256_avx_capable(void) {
-  // Pre-Zen AMD CPUs had slow SHLD/SHRD; Zen added the SHA extension; see the
-  // discussion in sha1-586.pl.
+inline int sha256_avx_capable(void) {
+  // AMD CPUs have slow SHLD/SHRD. See also the discussion in sha1-586.pl.
   //
-  // TODO(davidben): Should we enable SHAEXT on 32-bit x86?
+  // TODO(crbug.com/42290564): Should we enable SHAEXT on 32-bit x86?
   // TODO(davidben): Do we need to check the FXSR bit? The Intel manual does not
   // say to.
   return CRYPTO_is_AVX_capable() && CRYPTO_is_intel_cpu() &&
@@ -129,7 +117,7 @@ void sha256_block_data_order_avx(uint32_t state[8], const uint8_t *data,
                                  size_t num);
 
 #define SHA512_ASM_SSSE3
-OPENSSL_INLINE int sha512_ssse3_capable(void) {
+inline int sha512_ssse3_capable(void) {
   // TODO(davidben): Do we need to check the FXSR bit? The Intel manual does not
   // say to.
   return CRYPTO_is_SSSE3_capable() && CRYPTO_is_FXSR_capable();
@@ -144,12 +132,12 @@ void sha512_block_data_order_ssse3(uint64_t state[8], const uint8_t *data,
 #define SHA512_ASM_NOHW
 
 #define SHA1_ASM_HW
-OPENSSL_INLINE int sha1_hw_capable(void) {
+inline int sha1_hw_capable(void) {
   return CRYPTO_is_x86_SHA_capable() && CRYPTO_is_SSSE3_capable();
 }
 
 #define SHA1_ASM_AVX2
-OPENSSL_INLINE int sha1_avx2_capable(void) {
+inline int sha1_avx2_capable(void) {
   return CRYPTO_is_AVX2_capable() && CRYPTO_is_BMI2_capable() &&
          CRYPTO_is_BMI1_capable();
 }
@@ -157,47 +145,45 @@ void sha1_block_data_order_avx2(uint32_t state[5], const uint8_t *data,
                                 size_t num);
 
 #define SHA1_ASM_AVX
-OPENSSL_INLINE int sha1_avx_capable(void) {
-  // Pre-Zen AMD CPUs had slow SHLD/SHRD; Zen added the SHA extension; see the
-  // discussion in sha1-586.pl.
+inline int sha1_avx_capable(void) {
+  // AMD CPUs have slow SHLD/SHRD. See also the discussion in sha1-586.pl. Zen
+  // added the SHA extension, so this is moot on newer AMD CPUs.
   return CRYPTO_is_AVX_capable() && CRYPTO_is_intel_cpu();
 }
 void sha1_block_data_order_avx(uint32_t state[5], const uint8_t *data,
                                size_t num);
 
 #define SHA1_ASM_SSSE3
-OPENSSL_INLINE int sha1_ssse3_capable(void) {
-  return CRYPTO_is_SSSE3_capable();
-}
+inline int sha1_ssse3_capable(void) { return CRYPTO_is_SSSE3_capable(); }
 void sha1_block_data_order_ssse3(uint32_t state[5], const uint8_t *data,
                                  size_t num);
 
 #define SHA256_ASM_HW
-OPENSSL_INLINE int sha256_hw_capable(void) {
+inline int sha256_hw_capable(void) {
   // Note that the original assembly did not check SSSE3.
   return CRYPTO_is_x86_SHA_capable() && CRYPTO_is_SSSE3_capable();
 }
 
 #define SHA256_ASM_AVX
-OPENSSL_INLINE int sha256_avx_capable(void) {
-  // Pre-Zen AMD CPUs had slow SHLD/SHRD; Zen added the SHA extension; see the
-  // discussion in sha1-586.pl.
+inline int sha256_avx_capable(void) {
+  // AMD CPUs have slow SHLD/SHRD. See also the discussion in sha1-586.pl. Zen
+  // added the SHA extension, so this is moot on newer AMD CPUs.
   return CRYPTO_is_AVX_capable() && CRYPTO_is_intel_cpu();
 }
 void sha256_block_data_order_avx(uint32_t state[8], const uint8_t *data,
                                  size_t num);
 
 #define SHA256_ASM_SSSE3
-OPENSSL_INLINE int sha256_ssse3_capable(void) {
-  return CRYPTO_is_SSSE3_capable();
-}
+inline int sha256_ssse3_capable(void) { return CRYPTO_is_SSSE3_capable(); }
 void sha256_block_data_order_ssse3(uint32_t state[8], const uint8_t *data,
                                    size_t num);
 
 #define SHA512_ASM_AVX
-OPENSSL_INLINE int sha512_avx_capable(void) {
-  // Pre-Zen AMD CPUs had slow SHLD/SHRD; Zen added the SHA extension; see the
-  // discussion in sha1-586.pl.
+inline int sha512_avx_capable(void) {
+  // AMD CPUs have slow SHLD/SHRD. See also the discussion in sha1-586.pl.
+  //
+  // TODO(crbug.com/42290564): Fixing and enabling the AVX2 implementation would
+  // mitigate this on newer AMD CPUs.
   return CRYPTO_is_AVX_capable() && CRYPTO_is_intel_cpu();
 }
 void sha512_block_data_order_avx(uint64_t state[8], const uint8_t *data,

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/sha/{sha1.c.inc → sha1.cc.inc}

@@ -1,88 +1,36 @@
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.] */
-
-#include <openssl/sha.h>
+// Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
 
 #include <string.h>
 
 #include <openssl/mem.h>
 
 #include "../../internal.h"
+#include "../bcm_interface.h"
 #include "../digest/md32_common.h"
 #include "../service_indicator/internal.h"
 #include "internal.h"
 
 
-int SHA1_Init(SHA_CTX *sha) {
+bcm_infallible BCM_sha1_init(SHA_CTX *sha) {
   OPENSSL_memset(sha, 0, sizeof(SHA_CTX));
   sha->h[0] = 0x67452301UL;
   sha->h[1] = 0xefcdab89UL;
   sha->h[2] = 0x98badcfeUL;
   sha->h[3] = 0x10325476UL;
   sha->h[4] = 0xc3d2e1f0UL;
-  return 1;
-}
-
-uint8_t *SHA1(const uint8_t *data, size_t len, uint8_t out[SHA_DIGEST_LENGTH]) {
-  SHA_CTX ctx;
-  SHA1_Init(&ctx);
-  SHA1_Update(&ctx, data, len);
-  SHA1_Final(out, &ctx);
-  OPENSSL_cleanse(&ctx, sizeof(ctx));
-  return out;
+  return bcm_infallible::approved;
 }
 
 #if !defined(SHA1_ASM)
@@ -90,14 +38,16 @@ static void sha1_block_data_order(uint32_t state[5], const uint8_t *data,
                                   size_t num);
 #endif
 
-void SHA1_Transform(SHA_CTX *c, const uint8_t data[SHA_CBLOCK]) {
+bcm_infallible BCM_sha1_transform(SHA_CTX *c, const uint8_t data[SHA_CBLOCK]) {
   sha1_block_data_order(c->h, data, 1);
+  return bcm_infallible::approved;
 }
 
-int SHA1_Update(SHA_CTX *c, const void *data, size_t len) {
+bcm_infallible BCM_sha1_update(SHA_CTX *c, const void *data, size_t len) {
   crypto_md32_update(&sha1_block_data_order, c->h, c->data, SHA_CBLOCK, &c->num,
-                     &c->Nh, &c->Nl, data, len);
-  return 1;
+                     &c->Nh, &c->Nl, reinterpret_cast<const uint8_t *>(data),
+                     len);
+  return bcm_infallible::approved;
 }
 
 static void sha1_output_state(uint8_t out[SHA_DIGEST_LENGTH],
@@ -109,17 +59,17 @@ static void sha1_output_state(uint8_t out[SHA_DIGEST_LENGTH],
   CRYPTO_store_u32_be(out + 16, ctx->h[4]);
 }
 
-int SHA1_Final(uint8_t out[SHA_DIGEST_LENGTH], SHA_CTX *c) {
+bcm_infallible BCM_sha1_final(uint8_t out[SHA_DIGEST_LENGTH], SHA_CTX *c) {
   crypto_md32_final(&sha1_block_data_order, c->h, c->data, SHA_CBLOCK, &c->num,
                     c->Nh, c->Nl, /*is_big_endian=*/1);
 
   sha1_output_state(out, c);
   FIPS_service_indicator_update_state();
-  return 1;
+  return bcm_infallible::approved;
 }
 
-void CRYPTO_fips_186_2_prf(uint8_t *out, size_t out_len,
-                           const uint8_t xkey[SHA_DIGEST_LENGTH]) {
+bcm_infallible BCM_fips_186_2_prf(uint8_t *out, size_t out_len,
+                                  const uint8_t xkey[SHA_DIGEST_LENGTH]) {
   // XKEY and XVAL are 160-bit values, but are internally right-padded up to
   // block size. See FIPS 186-2, Appendix 3.3. This buffer maintains both the
   // current value of XKEY and the padding.
@@ -130,8 +80,8 @@ void CRYPTO_fips_186_2_prf(uint8_t *out, size_t out_len,
     // We always use a zero XSEED, so we can merge the inner and outer loops.
     // XVAL is also always equal to XKEY.
     SHA_CTX ctx;
-    SHA1_Init(&ctx);
-    SHA1_Transform(&ctx, block);
+    BCM_sha1_init(&ctx);
+    BCM_sha1_transform(&ctx, block);
 
     // XKEY = (1 + XKEY + w_i) mod 2^b
     uint32_t carry = 1;
@@ -152,6 +102,7 @@ void CRYPTO_fips_186_2_prf(uint8_t *out, size_t out_len,
     out += SHA_DIGEST_LENGTH;
     out_len -= SHA_DIGEST_LENGTH;
   }
+  return bcm_infallible::not_approved;
 }
 
 #define Xupdate(a, ix, ia, ib, ic, id)    \
@@ -223,22 +174,22 @@ void CRYPTO_fips_186_2_prf(uint8_t *out, size_t out_len,
 #endif
 
 /* Originally X was an array. As it's automatic it's natural
-* to expect RISC compiler to accomodate at least part of it in
-* the register bank, isn't it? Unfortunately not all compilers
-* "find" this expectation reasonable:-( On order to make such
-* compilers generate better code I replace X[] with a bunch of
-* X0, X1, etc. See the function body below...
-*         <appro@fy.chalmers.se> */
-#define X(i)  XX##i
+ * to expect RISC compiler to accomodate at least part of it in
+ * the register bank, isn't it? Unfortunately not all compilers
+ * "find" this expectation reasonable:-( On order to make such
+ * compilers generate better code I replace X[] with a bunch of
+ * X0, X1, etc. See the function body below...
+ *         <appro@fy.chalmers.se> */
+#define X(i) XX##i
 
 #if !defined(SHA1_ASM)
 
 #if !defined(SHA1_ASM_NOHW)
 static void sha1_block_data_order_nohw(uint32_t state[5], const uint8_t *data,
                                        size_t num) {
-  register uint32_t A, B, C, D, E, T;
-  uint32_t XX0, XX1, XX2, XX3, XX4, XX5, XX6, XX7, XX8, XX9, XX10,
-      XX11, XX12, XX13, XX14, XX15;
+  uint32_t A, B, C, D, E, T;
+  uint32_t XX0, XX1, XX2, XX3, XX4, XX5, XX6, XX7, XX8, XX9, XX10, XX11, XX12,
+      XX13, XX14, XX15;
 
   A = state[0];
   B = state[1];

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/sha/{sha256.c.inc → sha256.cc.inc}

@@ -1,72 +1,29 @@
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.] */
-
-#include <openssl/sha.h>
+// Copyright 2004-2016 The OpenSSL Project Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
 
 #include <string.h>
 
 #include <openssl/mem.h>
 
 #include "../../internal.h"
+#include "../bcm_interface.h"
 #include "../digest/md32_common.h"
 #include "../service_indicator/internal.h"
 #include "internal.h"
 
 
-int SHA224_Init(SHA256_CTX *sha) {
+bcm_infallible BCM_sha224_init(SHA256_CTX *sha) {
   OPENSSL_memset(sha, 0, sizeof(SHA256_CTX));
   sha->h[0] = 0xc1059ed8UL;
   sha->h[1] = 0x367cd507UL;
@@ -76,11 +33,11 @@ int SHA224_Init(SHA256_CTX *sha) {
   sha->h[5] = 0x68581511UL;
   sha->h[6] = 0x64f98fa7UL;
   sha->h[7] = 0xbefa4fa4UL;
-  sha->md_len = SHA224_DIGEST_LENGTH;
-  return 1;
+  sha->md_len = BCM_SHA224_DIGEST_LENGTH;
+  return bcm_infallible::approved;
 }
 
-int SHA256_Init(SHA256_CTX *sha) {
+bcm_infallible BCM_sha256_init(SHA256_CTX *sha) {
   OPENSSL_memset(sha, 0, sizeof(SHA256_CTX));
   sha->h[0] = 0x6a09e667UL;
   sha->h[1] = 0xbb67ae85UL;
@@ -90,28 +47,8 @@ int SHA256_Init(SHA256_CTX *sha) {
   sha->h[5] = 0x9b05688cUL;
   sha->h[6] = 0x1f83d9abUL;
   sha->h[7] = 0x5be0cd19UL;
-  sha->md_len = SHA256_DIGEST_LENGTH;
-  return 1;
-}
-
-uint8_t *SHA224(const uint8_t *data, size_t len,
-                uint8_t out[SHA224_DIGEST_LENGTH]) {
-  SHA256_CTX ctx;
-  SHA224_Init(&ctx);
-  SHA224_Update(&ctx, data, len);
-  SHA224_Final(out, &ctx);
-  OPENSSL_cleanse(&ctx, sizeof(ctx));
-  return out;
-}
-
-uint8_t *SHA256(const uint8_t *data, size_t len,
-                uint8_t out[SHA256_DIGEST_LENGTH]) {
-  SHA256_CTX ctx;
-  SHA256_Init(&ctx);
-  SHA256_Update(&ctx, data, len);
-  SHA256_Final(out, &ctx);
-  OPENSSL_cleanse(&ctx, sizeof(ctx));
-  return out;
+  sha->md_len = BCM_SHA256_DIGEST_LENGTH;
+  return bcm_infallible::approved;
 }
 
 #if !defined(SHA256_ASM)
@@ -119,31 +56,29 @@ static void sha256_block_data_order(uint32_t state[8], const uint8_t *in,
                                     size_t num);
 #endif
 
-void SHA256_Transform(SHA256_CTX *c, const uint8_t data[SHA256_CBLOCK]) {
+bcm_infallible BCM_sha256_transform(SHA256_CTX *c,
+                                    const uint8_t data[BCM_SHA256_CBLOCK]) {
   sha256_block_data_order(c->h, data, 1);
+  return bcm_infallible::approved;
 }
 
-int SHA256_Update(SHA256_CTX *c, const void *data, size_t len) {
-  crypto_md32_update(&sha256_block_data_order, c->h, c->data, SHA256_CBLOCK,
-                     &c->num, &c->Nh, &c->Nl, data, len);
-  return 1;
+bcm_infallible BCM_sha256_update(SHA256_CTX *c, const void *data, size_t len) {
+  crypto_md32_update(&sha256_block_data_order, c->h, c->data, BCM_SHA256_CBLOCK,
+                     &c->num, &c->Nh, &c->Nl,
+                     reinterpret_cast<const uint8_t *>(data), len);
+  return bcm_infallible::approved;
 }
 
-int SHA224_Update(SHA256_CTX *ctx, const void *data, size_t len) {
-  return SHA256_Update(ctx, data, len);
+bcm_infallible BCM_sha224_update(SHA256_CTX *ctx, const void *data,
+                                 size_t len) {
+  return BCM_sha256_update(ctx, data, len);
 }
 
-static int sha256_final_impl(uint8_t *out, size_t md_len, SHA256_CTX *c) {
-  crypto_md32_final(&sha256_block_data_order, c->h, c->data, SHA256_CBLOCK,
+static void sha256_final_impl(uint8_t *out, size_t md_len, SHA256_CTX *c) {
+  crypto_md32_final(&sha256_block_data_order, c->h, c->data, BCM_SHA256_CBLOCK,
                     &c->num, c->Nh, c->Nl, /*is_big_endian=*/1);
 
-  // TODO(davidben): This overflow check one of the few places a low-level hash
-  // 'final' function can fail. SHA-512 does not have a corresponding check.
-  // These functions already misbehave if the caller arbitrarily mutates |c|, so
-  // can we assume one of |SHA256_Init| or |SHA224_Init| was used?
-  if (md_len > SHA256_DIGEST_LENGTH) {
-    return 0;
-  }
+  BSSL_CHECK(md_len <= BCM_SHA256_DIGEST_LENGTH);
 
   assert(md_len % 4 == 0);
   const size_t out_words = md_len / 4;
@@ -153,23 +88,26 @@ static int sha256_final_impl(uint8_t *out, size_t md_len, SHA256_CTX *c) {
   }
 
   FIPS_service_indicator_update_state();
-  return 1;
 }
 
-int SHA256_Final(uint8_t out[SHA256_DIGEST_LENGTH], SHA256_CTX *c) {
-  // Ideally we would assert |sha->md_len| is |SHA256_DIGEST_LENGTH| to match
-  // the size hint, but calling code often pairs |SHA224_Init| with
+bcm_infallible BCM_sha256_final(uint8_t out[BCM_SHA256_DIGEST_LENGTH],
+                                SHA256_CTX *c) {
+  // Ideally we would assert |sha->md_len| is |BCM_SHA256_DIGEST_LENGTH| to
+  // match the size hint, but calling code often pairs |SHA224_Init| with
   // |SHA256_Final| and expects |sha->md_len| to carry the size over.
   //
   // TODO(davidben): Add an assert and fix code to match them up.
-  return sha256_final_impl(out, c->md_len, c);
+  sha256_final_impl(out, c->md_len, c);
+  return bcm_infallible::approved;
 }
 
-int SHA224_Final(uint8_t out[SHA224_DIGEST_LENGTH], SHA256_CTX *ctx) {
+bcm_infallible BCM_sha224_final(uint8_t out[BCM_SHA224_DIGEST_LENGTH],
+                                SHA256_CTX *ctx) {
   // This function must be paired with |SHA224_Init|, which sets |ctx->md_len|
-  // to |SHA224_DIGEST_LENGTH|.
-  assert(ctx->md_len == SHA224_DIGEST_LENGTH);
-  return sha256_final_impl(out, SHA224_DIGEST_LENGTH, ctx);
+  // to |BCM_SHA224_DIGEST_LENGTH|.
+  assert(ctx->md_len == BCM_SHA224_DIGEST_LENGTH);
+  sha256_final_impl(out, BCM_SHA224_DIGEST_LENGTH, ctx);
+  return bcm_infallible::approved;
 }
 
 #if !defined(SHA256_ASM)
@@ -344,9 +282,11 @@ static void sha256_block_data_order(uint32_t state[8], const uint8_t *data,
 #endif  // !defined(SHA256_ASM)
 
 
-void SHA256_TransformBlocks(uint32_t state[8], const uint8_t *data,
-                            size_t num_blocks) {
+bcm_infallible BCM_sha256_transform_blocks(uint32_t state[8],
+                                           const uint8_t *data,
+                                           size_t num_blocks) {
   sha256_block_data_order(state, data, num_blocks);
+  return bcm_infallible::approved;
 }
 
 #undef Sigma0