grpc 1.69.0 → 1.70.1

data/third_party/boringssl-with-bazel/src/crypto/evp/{scrypt.c → scrypt.cc}

@@ -27,7 +27,9 @@
 // scrypt blocks, respectively.
 
 // A block_t is a Salsa20 block.
-typedef struct { uint32_t words[16]; } block_t;
+typedef struct {
+  uint32_t words[16];
+} block_t;
 
 static_assert(sizeof(block_t) == 64, "block_t has padding");
 
@@ -138,7 +140,7 @@ static void scryptROMix(block_t *B, uint64_t r, uint64_t N, block_t *T,
 
 // SCRYPT_MAX_MEM is the default maximum memory that may be allocated by
 // |EVP_PBE_scrypt|.
-#define SCRYPT_MAX_MEM (1024 * 1024 * 32)
+#define SCRYPT_MAX_MEM (1024 * 1024 * 65)
 
 int EVP_PBE_scrypt(const char *password, size_t password_len,
                    const uint8_t *salt, size_t salt_len, uint64_t N, uint64_t r,
@@ -162,8 +164,7 @@ int EVP_PBE_scrypt(const char *password, size_t password_len,
   }
 
   size_t max_scrypt_blocks = max_mem / (2 * r * sizeof(block_t));
-  if (max_scrypt_blocks < p + 1 ||
-      max_scrypt_blocks - p - 1 < N) {
+  if (max_scrypt_blocks < p + 1 || max_scrypt_blocks - p - 1 < N) {
     OPENSSL_PUT_ERROR(EVP, EVP_R_MEMORY_LIMIT_EXCEEDED);
     return 0;
   }
@@ -175,7 +176,8 @@ int EVP_PBE_scrypt(const char *password, size_t password_len,
   size_t B_bytes = B_blocks * sizeof(block_t);
   size_t T_blocks = 2 * r;
   size_t V_blocks = N * 2 * r;
-  block_t *B = OPENSSL_calloc(B_blocks + T_blocks + V_blocks, sizeof(block_t));
+  block_t *B = reinterpret_cast<block_t *>(
+      OPENSSL_calloc(B_blocks + T_blocks + V_blocks, sizeof(block_t)));
   if (B == NULL) {
     return 0;
   }

data/third_party/boringssl-with-bazel/src/crypto/{ex_data.c → ex_data.cc}

@@ -134,7 +134,8 @@ struct crypto_ex_data_func_st {
 
 int CRYPTO_get_ex_new_index_ex(CRYPTO_EX_DATA_CLASS *ex_data_class, long argl,
                                void *argp, CRYPTO_EX_free *free_func) {
-  CRYPTO_EX_DATA_FUNCS *funcs = OPENSSL_malloc(sizeof(CRYPTO_EX_DATA_FUNCS));
+  CRYPTO_EX_DATA_FUNCS *funcs = reinterpret_cast<CRYPTO_EX_DATA_FUNCS *>(
+      OPENSSL_malloc(sizeof(CRYPTO_EX_DATA_FUNCS)));
   if (funcs == NULL) {
     return -1;
   }
@@ -202,9 +203,7 @@ void *CRYPTO_get_ex_data(const CRYPTO_EX_DATA *ad, int idx) {
   return sk_void_value(ad->sk, idx);
 }
 
-void CRYPTO_new_ex_data(CRYPTO_EX_DATA *ad) {
-  ad->sk = NULL;
-}
+void CRYPTO_new_ex_data(CRYPTO_EX_DATA *ad) { ad->sk = NULL; }
 
 void CRYPTO_free_ex_data(CRYPTO_EX_DATA_CLASS *ex_data_class, void *obj,
                          CRYPTO_EX_DATA *ad) {

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/aes/{aes_nohw.c.inc → aes_nohw.cc.inc}

@@ -1,4 +1,4 @@
-/* Copyright (c) 2019, Google Inc.
+/* Copyright 2019 The BoringSSL Authors
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/aes/internal.h

@@ -1,4 +1,4 @@
-/* Copyright (c) 2017, Google Inc.
+/* Copyright 2017 The BoringSSL Authors
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -21,9 +21,7 @@
 
 #include "../../internal.h"
 
-#if defined(__cplusplus)
 extern "C" {
-#endif
 
 
 #if !defined(OPENSSL_NO_ASM)
@@ -247,8 +245,6 @@ void aes_nohw_cbc_encrypt(const uint8_t *in, uint8_t *out, size_t len,
                           const AES_KEY *key, uint8_t *ivec, int enc);
 
 
-#if defined(__cplusplus)
 }  // extern C
-#endif
 
 #endif  // OPENSSL_HEADER_AES_INTERNAL_H

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/aes/{key_wrap.c.inc → key_wrap.cc.inc}

@@ -184,7 +184,7 @@ int AES_wrap_key_padded(const AES_KEY *key, uint8_t *out, size_t *out_len,
     return 1;
   }
 
-  uint8_t *padded_in = OPENSSL_malloc(padded_len);
+  uint8_t *padded_in = reinterpret_cast<uint8_t *>(OPENSSL_malloc(padded_len));
   if (padded_in == NULL) {
     return 0;
   }

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/{bcm.c → bcm.cc}

@@ -1,4 +1,4 @@
-/* Copyright (c) 2017, Google Inc.
+/* Copyright 2017 The BoringSSL Authors
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -28,85 +28,84 @@
 #include <openssl/hmac.h>
 #include <openssl/sha.h>
 
-#include "bcm_interface.h"
+#include "../bcm_support.h"
 #include "../internal.h"
+#include "bcm_interface.h"
 
 // TODO(crbug.com/362530616): When delocate is removed, build these files as
 // separate compilation units again.
-#include "aes/aes.c.inc"
-#include "aes/aes_nohw.c.inc"
-#include "aes/key_wrap.c.inc"
-#include "aes/mode_wrappers.c.inc"
-#include "bn/add.c.inc"
-#include "bn/asm/x86_64-gcc.c.inc"
-#include "bn/bn.c.inc"
-#include "bn/bytes.c.inc"
-#include "bn/cmp.c.inc"
-#include "bn/ctx.c.inc"
-#include "bn/div.c.inc"
-#include "bn/div_extra.c.inc"
-#include "bn/exponentiation.c.inc"
-#include "bn/gcd.c.inc"
-#include "bn/gcd_extra.c.inc"
-#include "bn/generic.c.inc"
-#include "bn/jacobi.c.inc"
-#include "bn/montgomery.c.inc"
-#include "bn/montgomery_inv.c.inc"
-#include "bn/mul.c.inc"
-#include "bn/prime.c.inc"
-#include "bn/random.c.inc"
-#include "bn/rsaz_exp.c.inc"
-#include "bn/shift.c.inc"
-#include "bn/sqrt.c.inc"
-#include "cipher/aead.c.inc"
-#include "cipher/cipher.c.inc"
-#include "cipher/e_aes.c.inc"
-#include "cipher/e_aesccm.c.inc"
-#include "cmac/cmac.c.inc"
-#include "dh/check.c.inc"
-#include "dh/dh.c.inc"
-#include "digest/digest.c.inc"
-#include "digest/digests.c.inc"
-#include "digestsign/digestsign.c.inc"
-#include "ecdh/ecdh.c.inc"
-#include "ecdsa/ecdsa.c.inc"
-#include "ec/ec.c.inc"
-#include "ec/ec_key.c.inc"
-#include "ec/ec_montgomery.c.inc"
-#include "ec/felem.c.inc"
-#include "ec/oct.c.inc"
-#include "ec/p224-64.c.inc"
-#include "ec/p256.c.inc"
-#include "ec/p256-nistz.c.inc"
-#include "ec/scalar.c.inc"
-#include "ec/simple.c.inc"
-#include "ec/simple_mul.c.inc"
-#include "ec/util.c.inc"
-#include "ec/wnaf.c.inc"
-#include "hkdf/hkdf.c.inc"
-#include "hmac/hmac.c.inc"
-#include "md4/md4.c.inc"
-#include "md5/md5.c.inc"
-#include "modes/cbc.c.inc"
-#include "modes/cfb.c.inc"
-#include "modes/ctr.c.inc"
-#include "modes/gcm.c.inc"
-#include "modes/gcm_nohw.c.inc"
-#include "modes/ofb.c.inc"
-#include "modes/polyval.c.inc"
-#include "rand/ctrdrbg.c.inc"
-#include "rand/rand.c.inc"
-#include "rsa/blinding.c.inc"
-#include "rsa/padding.c.inc"
-#include "rsa/rsa.c.inc"
-#include "rsa/rsa_impl.c.inc"
-#include "self_check/fips.c.inc"
-#include "self_check/self_check.c.inc"
-#include "service_indicator/service_indicator.c.inc"
-#include "sha/sha1.c.inc"
-#include "sha/sha256.c.inc"
-#include "sha/sha512.c.inc"
-#include "tls/kdf.c.inc"
+#include "aes/aes.cc.inc"
+#include "aes/aes_nohw.cc.inc"
+#include "aes/key_wrap.cc.inc"
+#include "aes/mode_wrappers.cc.inc"
+#include "bn/add.cc.inc"
+#include "bn/asm/x86_64-gcc.cc.inc"
+#include "bn/bn.cc.inc"
+#include "bn/bytes.cc.inc"
+#include "bn/cmp.cc.inc"
+#include "bn/ctx.cc.inc"
+#include "bn/div.cc.inc"
+#include "bn/div_extra.cc.inc"
+#include "bn/exponentiation.cc.inc"
+#include "bn/gcd.cc.inc"
+#include "bn/gcd_extra.cc.inc"
+#include "bn/generic.cc.inc"
+#include "bn/jacobi.cc.inc"
+#include "bn/montgomery.cc.inc"
+#include "bn/montgomery_inv.cc.inc"
+#include "bn/mul.cc.inc"
+#include "bn/prime.cc.inc"
+#include "bn/random.cc.inc"
+#include "bn/rsaz_exp.cc.inc"
+#include "bn/shift.cc.inc"
+#include "bn/sqrt.cc.inc"
+#include "cipher/aead.cc.inc"
+#include "cipher/cipher.cc.inc"
+#include "cipher/e_aes.cc.inc"
+#include "cipher/e_aesccm.cc.inc"
+#include "cmac/cmac.cc.inc"
+#include "dh/check.cc.inc"
+#include "dh/dh.cc.inc"
+#include "digest/digest.cc.inc"
+#include "digest/digests.cc.inc"
+#include "digestsign/digestsign.cc.inc"
+#include "ec/ec.cc.inc"
+#include "ec/ec_key.cc.inc"
+#include "ec/ec_montgomery.cc.inc"
+#include "ec/felem.cc.inc"
+#include "ec/oct.cc.inc"
+#include "ec/p224-64.cc.inc"
+#include "ec/p256-nistz.cc.inc"
+#include "ec/p256.cc.inc"
+#include "ec/scalar.cc.inc"
+#include "ec/simple.cc.inc"
+#include "ec/simple_mul.cc.inc"
+#include "ec/util.cc.inc"
+#include "ec/wnaf.cc.inc"
+#include "ecdh/ecdh.cc.inc"
+#include "ecdsa/ecdsa.cc.inc"
+#include "hkdf/hkdf.cc.inc"
+#include "hmac/hmac.cc.inc"
+#include "modes/cbc.cc.inc"
+#include "modes/cfb.cc.inc"
+#include "modes/ctr.cc.inc"
+#include "modes/gcm.cc.inc"
+#include "modes/gcm_nohw.cc.inc"
+#include "modes/ofb.cc.inc"
+#include "modes/polyval.cc.inc"
+#include "rand/ctrdrbg.cc.inc"
+#include "rand/rand.cc.inc"
+#include "rsa/blinding.cc.inc"
+#include "rsa/padding.cc.inc"
+#include "rsa/rsa.cc.inc"
+#include "rsa/rsa_impl.cc.inc"
+#include "self_check/fips.cc.inc"
+#include "self_check/self_check.cc.inc"
+#include "service_indicator/service_indicator.cc.inc"
+#include "sha/sha1.cc.inc"
+#include "sha/sha256.cc.inc"
+#include "sha/sha512.cc.inc"
+#include "tls/kdf.cc.inc"
 
 
 #if defined(BORINGSSL_FIPS)
@@ -129,18 +128,17 @@ extern const uint8_t BORINGSSL_bcm_rodata_end[];
 // aborts otherwise.
 static void assert_within(const void *start, const void *symbol,
                           const void *end) {
-  const uintptr_t start_val = (uintptr_t) start;
-  const uintptr_t symbol_val = (uintptr_t) symbol;
-  const uintptr_t end_val = (uintptr_t) end;
+  const uintptr_t start_val = (uintptr_t)start;
+  const uintptr_t symbol_val = (uintptr_t)symbol;
+  const uintptr_t end_val = (uintptr_t)end;
 
   if (start_val <= symbol_val && symbol_val < end_val) {
     return;
   }
 
-  fprintf(
-      stderr,
-      "FIPS module doesn't span expected symbol. Expected %p <= %p < %p\n",
-      start, symbol, end);
+  fprintf(CRYPTO_get_stderr(),
+          "FIPS module doesn't span expected symbol. Expected %p <= %p < %p\n",
+          start, symbol, end);
   BORINGSSL_FIPS_abort();
 }
 
@@ -192,13 +190,13 @@ int BORINGSSL_integrity_test(void) {
   const uint8_t *const start = BORINGSSL_bcm_text_start;
   const uint8_t *const end = BORINGSSL_bcm_text_end;
 
-  assert_within(start, AES_encrypt, end);
-  assert_within(start, RSA_sign, end);
-  assert_within(start, BCM_rand_bytes, end);
-  assert_within(start, EC_GROUP_cmp, end);
-  assert_within(start, SHA256_Update, end);
-  assert_within(start, ecdsa_verify_fixed, end);
-  assert_within(start, EVP_AEAD_CTX_seal, end);
+  assert_within(start, reinterpret_cast<const void *>(AES_encrypt), end);
+  assert_within(start, reinterpret_cast<const void *>(RSA_sign), end);
+  assert_within(start, reinterpret_cast<const void *>(BCM_rand_bytes), end);
+  assert_within(start, reinterpret_cast<const void *>(EC_GROUP_cmp), end);
+  assert_within(start, reinterpret_cast<const void *>(BCM_sha256_update), end);
+  assert_within(start, reinterpret_cast<const void *>(ecdsa_verify_fixed), end);
+  assert_within(start, reinterpret_cast<const void *>(EVP_AEAD_CTX_seal), end);
 
 #if defined(BORINGSSL_SHARED_LIBRARY)
   const uint8_t *const rodata_start = BORINGSSL_bcm_rodata_start;
@@ -215,8 +213,7 @@ int BORINGSSL_integrity_test(void) {
 
   uint8_t result[SHA256_DIGEST_LENGTH];
   const EVP_MD *const kHashFunction = EVP_sha256();
-  if (!boringssl_self_test_sha256() ||
-      !boringssl_self_test_hmac_sha256()) {
+  if (!boringssl_self_test_sha256() || !boringssl_self_test_hmac_sha256()) {
     return 0;
   }
 
@@ -226,18 +223,18 @@ int BORINGSSL_integrity_test(void) {
   HMAC_CTX_init(&hmac_ctx);
   if (!HMAC_Init_ex(&hmac_ctx, kHMACKey, sizeof(kHMACKey), kHashFunction,
                     NULL /* no ENGINE */)) {
-    fprintf(stderr, "HMAC_Init_ex failed.\n");
+    fprintf(CRYPTO_get_stderr(), "HMAC_Init_ex failed.\n");
     return 0;
   }
 
   BORINGSSL_maybe_set_module_text_permissions(PROT_READ | PROT_EXEC);
 #if defined(BORINGSSL_SHARED_LIBRARY)
   uint64_t length = end - start;
-  HMAC_Update(&hmac_ctx, (const uint8_t *) &length, sizeof(length));
+  HMAC_Update(&hmac_ctx, (const uint8_t *)&length, sizeof(length));
   HMAC_Update(&hmac_ctx, start, length);
 
   length = rodata_end - rodata_start;
-  HMAC_Update(&hmac_ctx, (const uint8_t *) &length, sizeof(length));
+  HMAC_Update(&hmac_ctx, (const uint8_t *)&length, sizeof(length));
   HMAC_Update(&hmac_ctx, rodata_start, length);
 #else
   HMAC_Update(&hmac_ctx, start, end - start);
@@ -246,10 +243,10 @@ int BORINGSSL_integrity_test(void) {
 
   if (!HMAC_Final(&hmac_ctx, result, &result_len) ||
       result_len != sizeof(result)) {
-    fprintf(stderr, "HMAC failed.\n");
+    fprintf(CRYPTO_get_stderr(), "HMAC failed.\n");
     return 0;
   }
-  HMAC_CTX_cleanse(&hmac_ctx); // FIPS 140-3, AS05.10.
+  HMAC_CTX_cleanse(&hmac_ctx);  // FIPS 140-3, AS05.10.
 
   const uint8_t *expected = BORINGSSL_bcm_text_hash;
 
@@ -259,13 +256,11 @@ int BORINGSSL_integrity_test(void) {
 #endif
   }
 
-  OPENSSL_cleanse(result, sizeof(result)); // FIPS 140-3, AS05.10.
+  OPENSSL_cleanse(result, sizeof(result));  // FIPS 140-3, AS05.10.
   return 1;
 }
 
-const uint8_t* FIPS_module_hash(void) {
-  return BORINGSSL_bcm_text_hash;
-}
+const uint8_t *FIPS_module_hash(void) { return BORINGSSL_bcm_text_hash; }
 
 #endif  // OPENSSL_ASAN
 

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/bcm_interface.h

@@ -1,4 +1,4 @@
-/* Copyright (c) 2024, Google Inc.
+/* Copyright 2024 The BoringSSL Authors
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,6 +15,8 @@
 #ifndef OPENSSL_HEADER_CRYPTO_BCM_INTERFACE_H
 #define OPENSSL_HEADER_CRYPTO_BCM_INTERFACE_H
 
+#include <openssl/bcm_public.h>
+
 // This header will eventually become the interface between BCM and the
 // rest of libcrypto. More cleanly separating the two is still a work in
 // progress (see https://crbug.com/boringssl/722) so, at the moment, we
@@ -32,25 +34,26 @@ extern "C" {
 // FIPS service indicator. For the moment, the official service indicator
 // remains the counter, not these values. Once we fully transition to
 // these return values from bcm we will change that.
-enum bcm_infallible_t {
-  bcm_infallible_approved,
-  bcm_infallible_not_approved,
+enum class bcm_infallible_t {
+  approved,
+  not_approved,
 };
 
-enum bcm_status_t {
-  bcm_status_approved,
-  bcm_status_not_approved,
-
-  // Failure codes, which must all be negative.
-  bcm_status_failure,
+enum class bcm_status_t {
+  approved,
+  not_approved,
+  failure,
 };
 typedef enum bcm_status_t bcm_status;
 typedef enum bcm_infallible_t bcm_infallible;
 
 OPENSSL_INLINE int bcm_success(bcm_status status) {
-  return status == bcm_status_approved || status == bcm_status_not_approved;
+  return status == bcm_status::approved || status == bcm_status::not_approved;
 }
 
+
+// Random number generator.
+
 #if defined(BORINGSSL_FIPS)
 
 // We overread from /dev/urandom or RDRAND by a factor of 10 and XOR to whiten.
@@ -64,7 +67,7 @@ OPENSSL_INLINE int bcm_success(bcm_status status) {
 // module. The |want_additional_input| parameter is true iff the entropy was
 // obtained from a source other than the system, e.g. directly from the CPU.
 bcm_infallible BCM_rand_load_entropy(const uint8_t *entropy, size_t entropy_len,
-                       int want_additional_input);
+                                     int want_additional_input);
 
 // BCM_rand_bytes is the same as the public |RAND_bytes| function, other
 // than returning a bcm_infallible status indicator.
@@ -82,6 +85,156 @@ bcm_infallible BCM_rand_bytes_with_additional_data(
     uint8_t *out, size_t out_len, const uint8_t user_additional_data[32]);
 
 
+// SHA-1
+
+// BCM_SHA_DIGEST_LENGTH is the length of a SHA-1 digest.
+#define BCM_SHA_DIGEST_LENGTH 20
+
+// BCM_sha1_init initialises |sha|.
+bcm_infallible BCM_sha1_init(SHA_CTX *sha);
+
+// BCM_SHA1_transform is a low-level function that performs a single, SHA-1
+// block transformation using the state from |sha| and |SHA_CBLOCK| bytes from
+// |block|.
+bcm_infallible BCM_sha1_transform(SHA_CTX *c,
+                                  const uint8_t data[BCM_SHA_CBLOCK]);
+
+// BCM_sha1_update adds |len| bytes from |data| to |sha|.
+bcm_infallible BCM_sha1_update(SHA_CTX *c, const void *data, size_t len);
+
+// BCM_sha1_final adds the final padding to |sha| and writes the resulting
+// digest to |out|, which must have at least |SHA_DIGEST_LENGTH| bytes of space.
+bcm_infallible BCM_sha1_final(uint8_t out[BCM_SHA_DIGEST_LENGTH], SHA_CTX *c);
+
+
+// BCM_fips_186_2_prf derives |out_len| bytes from |xkey| using the PRF
+// defined in FIPS 186-2, Appendix 3.1, with change notice 1 applied. The b
+// parameter is 160 and seed, XKEY, is also 160 bits. The optional XSEED user
+// input is all zeros.
+//
+// The PRF generates a sequence of 320-bit numbers. Each number is encoded as a
+// 40-byte string in big-endian and then concatenated to form |out|. If
+// |out_len| is not a multiple of 40, the result is truncated. This matches the
+// construction used in Section 7 of RFC 4186 and Section 7 of RFC 4187.
+//
+// This PRF is based on SHA-1, a weak hash function, and should not be used
+// in new protocols. It is provided for compatibility with some legacy EAP
+// methods.
+bcm_infallible BCM_fips_186_2_prf(uint8_t *out, size_t out_len,
+                                  const uint8_t xkey[BCM_SHA_DIGEST_LENGTH]);
+
+
+// SHA-224
+
+// SHA224_DIGEST_LENGTH is the length of a SHA-224 digest.
+#define BCM_SHA224_DIGEST_LENGTH 28
+
+// BCM_sha224_unit initialises |sha|.
+bcm_infallible BCM_sha224_init(SHA256_CTX *sha);
+
+// BCM_sha224_update adds |len| bytes from |data| to |sha|.
+bcm_infallible BCM_sha224_update(SHA256_CTX *sha, const void *data, size_t len);
+
+// BCM_sha224_final adds the final padding to |sha| and writes the resulting
+// digest to |out|, which must have at least |SHA224_DIGEST_LENGTH| bytes of
+// space. It aborts on programmer error.
+bcm_infallible BCM_sha224_final(uint8_t out[BCM_SHA224_DIGEST_LENGTH],
+                                SHA256_CTX *sha);
+
+
+// SHA-256
+
+// BCM_SHA256_DIGEST_LENGTH is the length of a SHA-256 digest.
+#define BCM_SHA256_DIGEST_LENGTH 32
+
+// BCM_sha256_init initialises |sha|.
+bcm_infallible BCM_sha256_init(SHA256_CTX *sha);
+
+// BCM_sha256_update adds |len| bytes from |data| to |sha|.
+bcm_infallible BCM_sha256_update(SHA256_CTX *sha, const void *data, size_t len);
+
+// BCM_sha256_final adds the final padding to |sha| and writes the resulting
+// digest to |out|, which must have at least |BCM_SHA256_DIGEST_LENGTH| bytes of
+// space. It aborts on programmer error.
+bcm_infallible BCM_sha256_final(uint8_t out[BCM_SHA256_DIGEST_LENGTH],
+                                SHA256_CTX *sha);
+
+// BCM_sha256_transform is a low-level function that performs a single, SHA-256
+// block transformation using the state from |sha| and |BCM_SHA256_CBLOCK| bytes
+// from |block|.
+bcm_infallible BCM_sha256_transform(SHA256_CTX *sha,
+                                    const uint8_t block[BCM_SHA256_CBLOCK]);
+
+// BCM_sha256_transform_blocks is a low-level function that takes |num_blocks| *
+// |BCM_SHA256_CBLOCK| bytes of data and performs SHA-256 transforms on it to
+// update |state|.
+bcm_infallible BCM_sha256_transform_blocks(uint32_t state[8],
+                                           const uint8_t *data,
+                                           size_t num_blocks);
+
+
+// SHA-384.
+
+// BCM_SHA384_DIGEST_LENGTH is the length of a SHA-384 digest.
+#define BCM_SHA384_DIGEST_LENGTH 48
+
+// BCM_sha384_init initialises |sha|.
+bcm_infallible BCM_sha384_init(SHA512_CTX *sha);
+
+// BCM_sha384_update adds |len| bytes from |data| to |sha|.
+bcm_infallible BCM_sha384_update(SHA512_CTX *sha, const void *data, size_t len);
+
+// BCM_sha384_final adds the final padding to |sha| and writes the resulting
+// digest to |out|, which must have at least |BCM_sha384_DIGEST_LENGTH| bytes of
+// space. It may abort on programmer error.
+bcm_infallible BCM_sha384_final(uint8_t out[BCM_SHA384_DIGEST_LENGTH],
+                                SHA512_CTX *sha);
+
+
+// SHA-512.
+
+// BCM_SHA512_DIGEST_LENGTH is the length of a SHA-512 digest.
+#define BCM_SHA512_DIGEST_LENGTH 64
+
+// BCM_sha512_init initialises |sha|.
+bcm_infallible BCM_sha512_init(SHA512_CTX *sha);
+
+// BCM_sha512_update adds |len| bytes from |data| to |sha|.
+bcm_infallible BCM_sha512_update(SHA512_CTX *sha, const void *data, size_t len);
+
+// BCM_sha512_final adds the final padding to |sha| and writes the resulting
+// digest to |out|, which must have at least |BCM_sha512_DIGEST_LENGTH| bytes of
+// space.
+bcm_infallible BCM_sha512_final(uint8_t out[BCM_SHA512_DIGEST_LENGTH],
+                                SHA512_CTX *sha);
+
+// BCM_sha512_transform is a low-level function that performs a single, SHA-512
+// block transformation using the state from |sha| and |BCM_sha512_CBLOCK| bytes
+// from |block|.
+bcm_infallible BCM_sha512_transform(SHA512_CTX *sha,
+                                    const uint8_t block[BCM_SHA512_CBLOCK]);
+
+
+// SHA-512-256
+//
+// See https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf section 5.3.6
+
+#define BCM_SHA512_256_DIGEST_LENGTH 32
+
+// BCM_sha512_256_init initialises |sha|.
+bcm_infallible BCM_sha512_256_init(SHA512_CTX *sha);
+
+// BCM_sha512_256_update adds |len| bytes from |data| to |sha|.
+bcm_infallible BCM_sha512_256_update(SHA512_CTX *sha, const void *data,
+                                     size_t len);
+
+// BCM_sha512_256_final adds the final padding to |sha| and writes the resulting
+// digest to |out|, which must have at least |BCM_sha512_256_DIGEST_LENGTH|
+// bytes of space. It may abort on programmer error.
+bcm_infallible BCM_sha512_256_final(uint8_t out[BCM_SHA512_256_DIGEST_LENGTH],
+                                    SHA512_CTX *sha);
+
+
 #if defined(__cplusplus)
 }  // extern C
 #endif

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/bn/{add.c.inc → add.cc.inc}

@@ -61,6 +61,7 @@
 #include <openssl/err.h>
 #include <openssl/mem.h>
 
+#include "../../internal.h"
 #include "internal.h"
 
 

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/bn/asm/{x86_64-gcc.c.inc → x86_64-gcc.cc.inc}

@@ -67,7 +67,7 @@
 //			want to keep the value of zero;
 #define mul_add(r, a, word, carry)                                         \
   do {                                                                     \
-    register BN_ULONG high, low;                                           \
+    BN_ULONG high, low;                                                    \
     __asm__("mulq %3" : "=a"(low), "=d"(high) : "a"(word), "m"(a) : "cc"); \
     __asm__("addq %2,%0; adcq %3,%1"                                       \
             : "+r"(carry), "+d"(high)                                      \
@@ -82,7 +82,7 @@
 
 #define mul(r, a, word, carry)                                             \
   do {                                                                     \
-    register BN_ULONG high, low;                                           \
+    BN_ULONG high, low;                                                    \
     __asm__("mulq %3" : "=a"(low), "=d"(high) : "a"(word), "g"(a) : "cc"); \
     __asm__("addq %2,%0; adcq %3,%1"                                       \
             : "+r"(carry), "+d"(high)                                      \
@@ -194,7 +194,7 @@ BN_ULONG bn_add_words(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *bp,
     return 0;
   }
 
-  __asm__ volatile (
+  __asm__ volatile(
       "	subq	%0,%0		\n"  // clear carry
       "	jmp	1f		\n"
       ".p2align 4			\n"
@@ -222,7 +222,7 @@ BN_ULONG bn_sub_words(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *bp,
     return 0;
   }
 
-  __asm__ volatile (
+  __asm__ volatile(
       "	subq	%0,%0		\n"  // clear borrow
       "	jmp	1f		\n"
       ".p2align 4			\n"