grpc 1.69.0 → 1.71.0

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/rsa/{rsa_impl.c.inc → rsa_impl.cc.inc}

@@ -1,58 +1,16 @@
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.] */
+// Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
 
 #include <openssl/rsa.h>
 
@@ -79,10 +37,8 @@ int rsa_check_public_key(const RSA *rsa) {
     return 0;
   }
 
-  // TODO(davidben): 16384-bit RSA is huge. Can we bring this down to a limit of
-  // 8192-bit?
   unsigned n_bits = BN_num_bits(rsa->n);
-  if (n_bits > 16 * 1024) {
+  if (n_bits > OPENSSL_RSA_MAX_MODULUS_BITS) {
     OPENSSL_PUT_ERROR(RSA, RSA_R_MODULUS_TOO_LARGE);
     return 0;
   }
@@ -149,8 +105,7 @@ static int ensure_fixed_copy(BIGNUM **out, const BIGNUM *in, int width) {
     return 1;
   }
   BIGNUM *copy = BN_dup(in);
-  if (copy == NULL ||
-      !bn_resize_words(copy, width)) {
+  if (copy == NULL || !bn_resize_words(copy, width)) {
     BN_free(copy);
     return 0;
   }
@@ -173,6 +128,7 @@ static int freeze_private_key(RSA *rsa, BN_CTX *ctx) {
   }
 
   int ret = 0;
+  const BIGNUM *n_fixed;
   CRYPTO_MUTEX_lock_write(&rsa->lock);
   if (rsa->private_key_frozen) {
     ret = 1;
@@ -196,7 +152,7 @@ static int freeze_private_key(RSA *rsa, BN_CTX *ctx) {
       goto err;
     }
   }
-  const BIGNUM *n_fixed = &rsa->mont_n->N;
+  n_fixed = &rsa->mont_n->N;
 
   // The only public upper-bound of |rsa->d| is the bit length of |rsa->n|. The
   // ASN.1 serialization of RSA private keys unfortunately leaks the byte length
@@ -219,7 +175,6 @@ static int freeze_private_key(RSA *rsa, BN_CTX *ctx) {
         goto err;
       }
     }
-    const BIGNUM *p_fixed = &rsa->mont_p->N;
 
     if (rsa->mont_q == NULL) {
       rsa->mont_q = BN_MONT_CTX_new_consttime(rsa->q, ctx);
@@ -227,23 +182,12 @@ static int freeze_private_key(RSA *rsa, BN_CTX *ctx) {
         goto err;
       }
     }
-    const BIGNUM *q_fixed = &rsa->mont_q->N;
-
-    if (rsa->dmp1 != NULL && rsa->dmq1 != NULL) {
-      // Key generation relies on this function to compute |iqmp|.
-      if (rsa->iqmp == NULL) {
-        BIGNUM *iqmp = BN_new();
-        if (iqmp == NULL ||
-            !bn_mod_inverse_secret_prime(iqmp, rsa->q, rsa->p, ctx,
-                                         rsa->mont_p)) {
-          BN_free(iqmp);
-          goto err;
-        }
-        rsa->iqmp = iqmp;
-      }
 
+    if (rsa->dmp1 != NULL && rsa->dmq1 != NULL && rsa->iqmp != NULL) {
       // CRT components are only publicly bounded by their corresponding
       // moduli's bit lengths.
+      const BIGNUM *p_fixed = &rsa->mont_p->N;
+      const BIGNUM *q_fixed = &rsa->mont_q->N;
       if (!ensure_fixed_copy(&rsa->dmp1_fixed, rsa->dmp1, p_fixed->width) ||
           !ensure_fixed_copy(&rsa->dmq1_fixed, rsa->dmq1, q_fixed->width)) {
         goto err;
@@ -302,10 +246,6 @@ void rsa_invalidate_key(RSA *rsa) {
   rsa->blinding_fork_generation = 0;
 }
 
-size_t rsa_default_size(const RSA *rsa) {
-  return BN_num_bytes(rsa->n);
-}
-
 // MAX_BLINDINGS_PER_RSA defines the maximum number of cached BN_BLINDINGs per
 // RSA*. Then this limit is exceeded, BN_BLINDING objects will be created and
 // destroyed as needed.
@@ -344,8 +284,11 @@ static BN_BLINDING *rsa_blinding_get(RSA *rsa, size_t *index_used,
     rsa->blinding_fork_generation = fork_generation;
   }
 
-  uint8_t *const free_inuse_flag =
-      OPENSSL_memchr(rsa->blindings_inuse, 0, rsa->num_blindings);
+  uint8_t *const free_inuse_flag = reinterpret_cast<uint8_t *>(
+      OPENSSL_memchr(rsa->blindings_inuse, 0, rsa->num_blindings));
+  size_t new_num_blindings;
+  BN_BLINDING **new_blindings;
+  uint8_t *new_blindings_inuse;
   if (free_inuse_flag != NULL) {
     *free_inuse_flag = 1;
     *index_used = free_inuse_flag - rsa->blindings_inuse;
@@ -365,7 +308,7 @@ static BN_BLINDING *rsa_blinding_get(RSA *rsa, size_t *index_used,
   // Double the length of the cache.
   static_assert(MAX_BLINDINGS_PER_RSA < UINT_MAX / 2,
                 "MAX_BLINDINGS_PER_RSA too large");
-  size_t new_num_blindings = rsa->num_blindings * 2;
+  new_num_blindings = rsa->num_blindings * 2;
   if (new_num_blindings == 0) {
     new_num_blindings = 1;
   }
@@ -374,9 +317,10 @@ static BN_BLINDING *rsa_blinding_get(RSA *rsa, size_t *index_used,
   }
   assert(new_num_blindings > rsa->num_blindings);
 
-  BN_BLINDING **new_blindings =
-      OPENSSL_calloc(new_num_blindings, sizeof(BN_BLINDING *));
-  uint8_t *new_blindings_inuse = OPENSSL_malloc(new_num_blindings);
+  new_blindings = reinterpret_cast<BN_BLINDING **>(
+      OPENSSL_calloc(new_num_blindings, sizeof(BN_BLINDING *)));
+  new_blindings_inuse =
+      reinterpret_cast<uint8_t *>(OPENSSL_malloc(new_num_blindings));
   if (new_blindings == NULL || new_blindings_inuse == NULL) {
     goto err;
   }
@@ -447,7 +391,7 @@ int rsa_default_sign_raw(RSA *rsa, size_t *out_len, uint8_t *out,
     return 0;
   }
 
-  buf = OPENSSL_malloc(rsa_size);
+  buf = reinterpret_cast<uint8_t *>(OPENSSL_malloc(rsa_size));
   if (buf == NULL) {
     goto err;
   }
@@ -483,7 +427,7 @@ err:
 }
 
 
-static int mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx);
+static int rsa_mod_exp_crt(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx);
 
 int rsa_verify_raw_no_self_test(RSA *rsa, size_t *out_len, uint8_t *out,
                                 size_t max_out, const uint8_t *in,
@@ -529,7 +473,7 @@ int rsa_verify_raw_no_self_test(RSA *rsa, size_t *out_len, uint8_t *out,
     buf = out;
   } else {
     // Allocate a temporary buffer to hold the padded plaintext.
-    buf = OPENSSL_malloc(rsa_size);
+    buf = reinterpret_cast<uint8_t *>(OPENSSL_malloc(rsa_size));
     if (buf == NULL) {
       goto err;
     }
@@ -582,9 +526,8 @@ err:
   return ret;
 }
 
-int RSA_verify_raw(RSA *rsa, size_t *out_len, uint8_t *out,
-                                size_t max_out, const uint8_t *in,
-                                size_t in_len, int padding) {
+int RSA_verify_raw(RSA *rsa, size_t *out_len, uint8_t *out, size_t max_out,
+                   const uint8_t *in, size_t in_len, int padding) {
   boringssl_ensure_rsa_self_test();
   return rsa_verify_raw_no_self_test(rsa, out_len, out, max_out, in, in_len,
                                      padding);
@@ -601,7 +544,7 @@ int rsa_default_private_transform(RSA *rsa, uint8_t *out, const uint8_t *in,
   BN_CTX *ctx = NULL;
   size_t blinding_index = 0;
   BN_BLINDING *blinding = NULL;
-  int ret = 0;
+  int ret = 0, do_blinding;
 
   ctx = BN_CTX_new();
   if (ctx == NULL) {
@@ -634,7 +577,7 @@ int rsa_default_private_transform(RSA *rsa, uint8_t *out, const uint8_t *in,
     goto err;
   }
 
-  const int do_blinding =
+  do_blinding =
       (rsa->flags & (RSA_FLAG_NO_BLINDING | RSA_FLAG_NO_PUBLIC_EXPONENT)) == 0;
 
   if (rsa->e == NULL && do_blinding) {
@@ -669,7 +612,7 @@ int rsa_default_private_transform(RSA *rsa, uint8_t *out, const uint8_t *in,
       // but it is true for keys generated by us and all common implementations.
       bn_less_than_montgomery_R(rsa->q, rsa->mont_p) &&
       bn_less_than_montgomery_R(rsa->p, rsa->mont_q)) {
-    if (!mod_exp(result, f, rsa, ctx)) {
+    if (!rsa_mod_exp_crt(result, f, rsa, ctx)) {
       goto err;
     }
   } else if (!BN_mod_exp_mont_consttime(result, f, rsa->d_fixed, rsa->n, ctx,
@@ -697,8 +640,7 @@ int rsa_default_private_transform(RSA *rsa, uint8_t *out, const uint8_t *in,
     }
   }
 
-  if (do_blinding &&
-      !BN_BLINDING_invert(result, blinding, rsa->mont_n, ctx)) {
+  if (do_blinding && !BN_BLINDING_invert(result, blinding, rsa->mont_n, ctx)) {
     goto err;
   }
 
@@ -741,7 +683,7 @@ static int mod_montgomery(BIGNUM *r, const BIGNUM *I, const BIGNUM *p,
     return 0;
   }
 
-  if (// Reduce mod p with Montgomery reduction. This computes I * R^-1 mod p.
+  if (  // Reduce mod p with Montgomery reduction. This computes I * R^-1 mod p.
       !BN_from_montgomery(r, I, mont_p, ctx) ||
       // Multiply by R^2 and do another Montgomery reduction to compute
       // I * R^-1 * R^2 * R^-1 = I mod p.
@@ -759,7 +701,7 @@ static int mod_montgomery(BIGNUM *r, const BIGNUM *I, const BIGNUM *p,
   return 1;
 }
 
-static int mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx) {
+static int rsa_mod_exp_crt(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx) {
   assert(ctx != NULL);
 
   assert(rsa->n != NULL);
@@ -777,27 +719,23 @@ static int mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx) {
   BN_CTX_start(ctx);
   r1 = BN_CTX_get(ctx);
   m1 = BN_CTX_get(ctx);
-  if (r1 == NULL ||
-      m1 == NULL) {
-    goto err;
-  }
-
-  if (!freeze_private_key(rsa, ctx)) {
+  BIGNUM *n, *p, *q;
+  if (r1 == NULL || m1 == NULL) {
     goto err;
   }
 
   // Use the minimal-width versions of |n|, |p|, and |q|. Either works, but if
   // someone gives us non-minimal values, these will be slightly more efficient
   // on the non-Montgomery operations.
-  const BIGNUM *n = &rsa->mont_n->N;
-  const BIGNUM *p = &rsa->mont_p->N;
-  const BIGNUM *q = &rsa->mont_q->N;
+  n = &rsa->mont_n->N;
+  p = &rsa->mont_p->N;
+  q = &rsa->mont_q->N;
 
   // This is a pre-condition for |mod_montgomery|. It was already checked by the
   // caller.
   declassify_assert(BN_ucmp(I, n) < 0);
 
-  if (// |m1| is the result modulo |q|.
+  if (  // |m1| is the result modulo |q|.
       !mod_montgomery(r1, I, q, rsa->mont_q, p, ctx) ||
       !BN_mod_exp_mont_consttime(m1, r1, rsa->dmq1_fixed, q, ctx,
                                  rsa->mont_q) ||
@@ -883,10 +821,12 @@ static int ensure_bignum(BIGNUM **out) {
 //     then []
 //     else let (high, low) = divrem 64 x in low : bnWords high
 //
-// showWord x = let (high, low) = divrem 32 x in printf "TOBN(0x%08x, 0x%08x)" high low
+// showWord x = let (high, low) = divrem 32 x in printf "TOBN(0x%08x, 0x%08x)"
+// high low
 //
 // output :: String
-// output = intercalate ", " $ map showWord $ bnWords $ converge (2 ^ (pow2 `div` 2))
+// output = intercalate ", " $ map showWord $ bnWords $ converge (2 ^ (pow2
+// `div` 2))
 //
 // To verify this number, check that n² < 2⁴⁰⁹⁵ < (n+1)², where n is value
 // represented here. Note the components are listed in little-endian order. Here
@@ -964,7 +904,7 @@ static int generate_prime(BIGNUM *out, int bits, const BIGNUM *e,
   // 22.21518251065506
   // >>> f(2048, 3, 8*2048)
   // 22.211701985875937
-  if (bits >= INT_MAX/32) {
+  if (bits >= INT_MAX / 32) {
     OPENSSL_PUT_ERROR(RSA, RSA_R_MODULUS_TOO_LARGE);
     return 0;
   }
@@ -1088,16 +1028,18 @@ static int rsa_generate_key_impl(RSA *rsa, int bits, const BIGNUM *e_value,
   int ret = 0;
   int prime_bits = bits / 2;
   BN_CTX *ctx = BN_CTX_new();
+  BIGNUM *totient, *pm1, *qm1, *sqrt2, *pow2_prime_bits_100, *pow2_prime_bits;
+  int sqrt2_bits;
   if (ctx == NULL) {
     goto bn_err;
   }
   BN_CTX_start(ctx);
-  BIGNUM *totient = BN_CTX_get(ctx);
-  BIGNUM *pm1 = BN_CTX_get(ctx);
-  BIGNUM *qm1 = BN_CTX_get(ctx);
-  BIGNUM *sqrt2 = BN_CTX_get(ctx);
-  BIGNUM *pow2_prime_bits_100 = BN_CTX_get(ctx);
-  BIGNUM *pow2_prime_bits = BN_CTX_get(ctx);
+  totient = BN_CTX_get(ctx);
+  pm1 = BN_CTX_get(ctx);
+  qm1 = BN_CTX_get(ctx);
+  sqrt2 = BN_CTX_get(ctx);
+  pow2_prime_bits_100 = BN_CTX_get(ctx);
+  pow2_prime_bits = BN_CTX_get(ctx);
   if (totient == NULL || pm1 == NULL || qm1 == NULL || sqrt2 == NULL ||
       pow2_prime_bits_100 == NULL || pow2_prime_bits == NULL ||
       !BN_set_bit(pow2_prime_bits_100, prime_bits - 100) ||
@@ -1106,13 +1048,14 @@ static int rsa_generate_key_impl(RSA *rsa, int bits, const BIGNUM *e_value,
   }
 
   // We need the RSA components non-NULL.
-  if (!ensure_bignum(&rsa->n) ||
-      !ensure_bignum(&rsa->d) ||
-      !ensure_bignum(&rsa->e) ||
-      !ensure_bignum(&rsa->p) ||
-      !ensure_bignum(&rsa->q) ||
-      !ensure_bignum(&rsa->dmp1) ||
-      !ensure_bignum(&rsa->dmq1)) {
+  if (!ensure_bignum(&rsa->n) ||     //
+      !ensure_bignum(&rsa->d) ||     //
+      !ensure_bignum(&rsa->e) ||     //
+      !ensure_bignum(&rsa->p) ||     //
+      !ensure_bignum(&rsa->q) ||     //
+      !ensure_bignum(&rsa->dmp1) ||  //
+      !ensure_bignum(&rsa->dmq1) ||  //
+      !ensure_bignum(&rsa->iqmp)) {
     goto bn_err;
   }
 
@@ -1124,7 +1067,7 @@ static int rsa_generate_key_impl(RSA *rsa, int bits, const BIGNUM *e_value,
   if (!bn_set_words(sqrt2, kBoringSSLRSASqrtTwo, kBoringSSLRSASqrtTwoLen)) {
     goto bn_err;
   }
-  int sqrt2_bits = kBoringSSLRSASqrtTwoLen * BN_BITS2;
+  sqrt2_bits = kBoringSSLRSASqrtTwoLen * BN_BITS2;
   assert(sqrt2_bits == (int)BN_num_bits(sqrt2));
   if (sqrt2_bits > prime_bits) {
     // For key sizes up to 4096 (prime_bits = 2048), this is exactly
@@ -1185,7 +1128,7 @@ static int rsa_generate_key_impl(RSA *rsa, int bits, const BIGNUM *e_value,
 
   assert(BN_num_bits(pm1) == (unsigned)prime_bits);
   assert(BN_num_bits(qm1) == (unsigned)prime_bits);
-  if (// Calculate n.
+  if (  // Calculate n.
       !bn_mul_consttime(rsa->n, rsa->p, rsa->q, ctx) ||
       // Calculate d mod (p-1).
       !bn_div_consttime(NULL, rsa->dmp1, rsa->d, pm1, prime_bits, ctx) ||
@@ -1198,6 +1141,14 @@ static int rsa_generate_key_impl(RSA *rsa, int bits, const BIGNUM *e_value,
   // |rsa->n| is computed from the private key, but is public.
   bn_declassify(rsa->n);
 
+  // Calculate q^-1 mod p.
+  rsa->mont_p = BN_MONT_CTX_new_consttime(rsa->p, ctx);
+  if (rsa->mont_p == NULL ||  //
+      !bn_mod_inverse_secret_prime(rsa->iqmp, rsa->q, rsa->p, ctx,
+                                   rsa->mont_p)) {
+    goto bn_err;
+  }
+
   // Sanity-check that |rsa->n| has the specified size. This is implied by
   // |generate_prime|'s bounds.
   if (BN_num_bits(rsa->n) != (unsigned)bits) {
@@ -1205,16 +1156,11 @@ static int rsa_generate_key_impl(RSA *rsa, int bits, const BIGNUM *e_value,
     goto err;
   }
 
-  // Call |freeze_private_key| to compute the inverse of q mod p, by way of
-  // |rsa->mont_p|.
-  if (!freeze_private_key(rsa, ctx)) {
-    goto bn_err;
-  }
-
   // The key generation process is complex and thus error-prone. It could be
   // disastrous to generate and then use a bad key so double-check that the key
-  // makes sense.
-  if (!RSA_check_key(rsa)) {
+  // makes sense. Also, while |rsa| is mutable, fill in the cached components.
+  if (!RSA_check_key(rsa) ||
+      !freeze_private_key(rsa, ctx)) {
     OPENSSL_PUT_ERROR(RSA, RSA_R_INTERNAL_ERROR);
     goto err;
   }
@@ -1331,8 +1277,7 @@ int RSA_generate_key_fips(RSA *rsa, int bits, BN_GENCB *cb) {
   }
 
   BIGNUM *e = BN_new();
-  int ret = e != NULL &&
-            BN_set_word(e, RSA_F4) &&
+  int ret = e != NULL && BN_set_word(e, RSA_F4) &&
             RSA_generate_key_ex_maybe_fips(rsa, bits, e, cb, /*check_fips=*/1);
   BN_free(e);
 

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/self_check/{fips.c.inc → fips.cc.inc}

@@ -1,16 +1,16 @@
-/* Copyright (c) 2017, Google Inc.
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+// Copyright 2017 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
 
 #include <openssl/crypto.h>
 
@@ -30,6 +30,14 @@ int FIPS_mode_set(int on) { return on == FIPS_mode(); }
 
 const char *FIPS_module_name(void) { return "BoringCrypto"; }
 
+int CRYPTO_has_asm(void) {
+#if defined(OPENSSL_NO_ASM)
+  return 0;
+#else
+  return 1;
+#endif
+}
+
 uint32_t FIPS_version(void) {
   return 0;
 }
@@ -77,8 +85,8 @@ size_t FIPS_read_counter(enum fips_counter_t counter) {
     abort();
   }
 
-  const size_t *array =
-      CRYPTO_get_thread_local(OPENSSL_THREAD_LOCAL_FIPS_COUNTERS);
+  const size_t *array = reinterpret_cast<const size_t *>(
+      CRYPTO_get_thread_local(OPENSSL_THREAD_LOCAL_FIPS_COUNTERS));
   if (!array) {
     return 0;
   }
@@ -92,11 +100,11 @@ void boringssl_fips_inc_counter(enum fips_counter_t counter) {
     abort();
   }
 
-  size_t *array =
-      CRYPTO_get_thread_local(OPENSSL_THREAD_LOCAL_FIPS_COUNTERS);
+  size_t *array = reinterpret_cast<size_t *>(
+      CRYPTO_get_thread_local(OPENSSL_THREAD_LOCAL_FIPS_COUNTERS));
   if (!array) {
     const size_t num_bytes = sizeof(size_t) * (fips_counter_max + 1);
-    array = OPENSSL_zalloc(num_bytes);
+    array = reinterpret_cast<size_t *>(OPENSSL_zalloc(num_bytes));
     if (!array) {
       return;
     }