grpc 1.69.0 → 1.71.0

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/self_check/{self_check.c.inc → self_check.cc.inc}

@@ -1,16 +1,16 @@
-/* Copyright (c) 2017, Google Inc.
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+// Copyright 2017 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
 
 #include <openssl/crypto.h>
 
@@ -24,14 +24,15 @@
 #include <openssl/dh.h>
 #include <openssl/digest.h>
 #include <openssl/ec.h>
-#include <openssl/ecdsa.h>
 #include <openssl/ec_key.h>
+#include <openssl/ecdsa.h>
 #include <openssl/hkdf.h>
 #include <openssl/hmac.h>
 #include <openssl/nid.h>
 #include <openssl/rsa.h>
 #include <openssl/sha.h>
 
+#include "../../bcm_support.h"
 #include "../../internal.h"
 #include "../delocate.h"
 #include "../dh/internal.h"
@@ -47,27 +48,27 @@
 // compile the real logic.
 #if defined(_MSC_VER)
 
-int BORINGSSL_self_test(void) {
-  return 0;
-}
+int BORINGSSL_self_test(void) { return 0; }
 
 #else
 
-static void hexdump(const uint8_t *in, size_t len) {
+static void hexdump(FILE *out, const void *in, size_t len) {
+  const uint8_t *in8 = reinterpret_cast<const uint8_t *>(in);
   for (size_t i = 0; i < len; i++) {
-    fprintf(stderr, "%02x", in[i]);
+    fprintf(out, "%02x", in8[i]);
   }
 }
 
 static int check_test(const void *expected, const void *actual,
                       size_t expected_len, const char *name) {
   if (OPENSSL_memcmp(actual, expected, expected_len) != 0) {
-    fprintf(stderr, "%s failed.\nExpected:   ", name);
-    hexdump(expected, expected_len);
-    fprintf(stderr, "\nCalculated: ");
-    hexdump(actual, expected_len);
-    fprintf(stderr, "\n");
-    fflush(stderr);
+    FILE *err = CRYPTO_get_stderr();
+    fprintf(err, "%s failed.\nExpected:   ", name);
+    hexdump(err, expected, expected_len);
+    fprintf(err, "\nCalculated: ");
+    hexdump(err, actual, expected_len);
+    fprintf(err, "\n");
+    fflush(err);
     return 0;
   }
   return 1;
@@ -195,7 +196,7 @@ static RSA *self_test_rsa_key(void) {
   };
 
   RSA *rsa = RSA_new();
-  if (rsa == NULL ||
+  if (rsa == NULL ||  //
       !set_bignum(&rsa->n, kN, sizeof(kN)) ||
       !set_bignum(&rsa->e, kE, sizeof(kE)) ||
       !set_bignum(&rsa->d, kD, sizeof(kD)) ||
@@ -294,7 +295,7 @@ static int boringssl_self_test_rsa(void) {
 
   RSA *const rsa_key = self_test_rsa_key();
   if (rsa_key == NULL) {
-    fprintf(stderr, "RSA key construction failed\n");
+    fprintf(CRYPTO_get_stderr(), "RSA key construction failed\n");
     goto err;
   }
   // Disable blinding for the power-on tests because it's not needed and
@@ -338,7 +339,7 @@ static int boringssl_self_test_rsa(void) {
                              output, &sig_len, rsa_key) ||
       !check_test(kRSASignSignature, output, sizeof(kRSASignSignature),
                   "RSA-sign KAT")) {
-    fprintf(stderr, "RSA signing test failed.\n");
+    fprintf(CRYPTO_get_stderr(), "RSA signing test failed.\n");
     goto err;
   }
 
@@ -376,7 +377,7 @@ static int boringssl_self_test_rsa(void) {
   if (!rsa_verify_no_self_test(NID_sha256, kRSAVerifyDigest,
                                sizeof(kRSAVerifyDigest), kRSAVerifySignature,
                                sizeof(kRSAVerifySignature), rsa_key)) {
-    fprintf(stderr, "RSA-verify KAT failed.\n");
+    fprintf(CRYPTO_get_stderr(), "RSA-verify KAT failed.\n");
     goto err;
   }
 
@@ -394,10 +395,15 @@ static int boringssl_self_test_ecc(void) {
   EC_POINT *ec_point_in = NULL;
   EC_POINT *ec_point_out = NULL;
   BIGNUM *ec_scalar = NULL;
+  const EC_GROUP *ec_group = NULL;
+
+  // The 'k' value for ECDSA is fixed to avoid an entropy draw.
+  uint8_t ecdsa_k[32] = {0};
+  ecdsa_k[31] = 42;
 
   ec_key = self_test_ecdsa_key();
   if (ec_key == NULL) {
-    fprintf(stderr, "ECDSA KeyGen failed\n");
+    fprintf(CRYPTO_get_stderr(), "ECDSA KeyGen failed\n");
     goto err;
   }
 
@@ -417,10 +423,6 @@ static int boringssl_self_test_ecc(void) {
       0x70, 0xb5, 0xbb, 0x0d, 0xfd, 0x8e, 0x0c, 0x02, 0x3f,
   };
 
-  // The 'k' value for ECDSA is fixed to avoid an entropy draw.
-  uint8_t ecdsa_k[32] = {0};
-  ecdsa_k[31] = 42;
-
   uint8_t ecdsa_sign_output[64];
   size_t ecdsa_sign_output_len;
   if (!ecdsa_sign_fixed_with_nonce_for_known_answer_test(
@@ -429,7 +431,7 @@ static int boringssl_self_test_ecc(void) {
           sizeof(ecdsa_k)) ||
       !check_test(kECDSASignSig, ecdsa_sign_output, sizeof(ecdsa_sign_output),
                   "ECDSA-sign signature")) {
-    fprintf(stderr, "ECDSA-sign KAT failed.\n");
+    fprintf(CRYPTO_get_stderr(), "ECDSA-sign KAT failed.\n");
     goto err;
   }
 
@@ -450,7 +452,7 @@ static int boringssl_self_test_ecc(void) {
   if (!ecdsa_verify_fixed_no_self_test(
           kECDSAVerifyDigest, sizeof(kECDSAVerifyDigest), kECDSAVerifySig,
           sizeof(kECDSAVerifySig), ec_key)) {
-    fprintf(stderr, "ECDSA-verify KAT failed.\n");
+    fprintf(CRYPTO_get_stderr(), "ECDSA-verify KAT failed.\n");
     goto err;
   }
 
@@ -481,7 +483,7 @@ static int boringssl_self_test_ecc(void) {
       0x7c, 0x41, 0x8f, 0xaf, 0x9c, 0x40, 0xaf, 0x2e, 0x4a, 0x0c,
   };
 
-  const EC_GROUP *ec_group = EC_group_p256();
+  ec_group = EC_group_p256();
   ec_point_in = EC_POINT_new(ec_group);
   ec_point_out = EC_POINT_new(ec_group);
   ec_scalar = BN_new();
@@ -496,7 +498,7 @@ static int boringssl_self_test_ecc(void) {
                           z_comp_result, sizeof(z_comp_result), NULL) ||
       !check_test(kP256PointResult, z_comp_result, sizeof(z_comp_result),
                   "Z Computation Result")) {
-    fprintf(stderr, "Z-computation KAT failed.\n");
+    fprintf(CRYPTO_get_stderr(), "Z-computation KAT failed.\n");
     goto err;
   }
 
@@ -575,7 +577,7 @@ static int boringssl_self_test_ffdh(void) {
       dh_compute_key_padded_no_self_test(dh_out, ffdhe2048_value, dh) !=
           sizeof(dh_out) ||
       !check_test(kDHOutput, dh_out, sizeof(dh_out), "FFC DH")) {
-    fprintf(stderr, "FFDH failed.\n");
+    fprintf(CRYPTO_get_stderr(), "FFDH failed.\n");
     goto err;
   }
 
@@ -598,7 +600,7 @@ static void run_self_test_rsa(void) {
   FIPS_service_indicator_unlock_state();
 }
 
-DEFINE_STATIC_ONCE(g_self_test_once_rsa);
+DEFINE_STATIC_ONCE(g_self_test_once_rsa)
 
 void boringssl_ensure_rsa_self_test(void) {
   CRYPTO_once(g_self_test_once_rsa_bss_get(), run_self_test_rsa);
@@ -612,7 +614,7 @@ static void run_self_test_ecc(void) {
   FIPS_service_indicator_unlock_state();
 }
 
-DEFINE_STATIC_ONCE(g_self_test_once_ecc);
+DEFINE_STATIC_ONCE(g_self_test_once_ecc)
 
 void boringssl_ensure_ecc_self_test(void) {
   CRYPTO_once(g_self_test_once_ecc_bss_get(), run_self_test_ecc);
@@ -626,7 +628,7 @@ static void run_self_test_ffdh(void) {
   FIPS_service_indicator_unlock_state();
 }
 
-DEFINE_STATIC_ONCE(g_self_test_once_ffdh);
+DEFINE_STATIC_ONCE(g_self_test_once_ffdh)
 
 void boringssl_ensure_ffdh_self_test(void) {
   CRYPTO_once(g_self_test_once_ffdh_bss_get(), run_self_test_ffdh);
@@ -699,7 +701,10 @@ int boringssl_self_test_hmac_sha256(void) {
 }
 
 static int boringssl_self_test_fast(void) {
-  static const uint8_t kAESKey[16] = "BoringCrypto Key";
+  static const uint8_t kAESKey[16] = {
+      'B', 'o', 'r', 'i', 'n', 'g', 'C', 'r',
+      'y', 'p', 't', 'o', ' ', 'K', 'e', 'y',
+  };
   static const uint8_t kAESIV[16] = {0};
 
   EVP_AEAD_CTX aead_ctx;
@@ -723,7 +728,7 @@ static int boringssl_self_test_fast(void) {
   };
   memcpy(aes_iv, kAESIV, sizeof(kAESIV));
   if (AES_set_encrypt_key(kAESKey, 8 * sizeof(kAESKey), &aes_key) != 0) {
-    fprintf(stderr, "AES_set_encrypt_key failed.\n");
+    fprintf(CRYPTO_get_stderr(), "AES_set_encrypt_key failed.\n");
     goto err;
   }
   AES_cbc_encrypt(kAESCBCEncPlaintext, output, sizeof(kAESCBCEncPlaintext),
@@ -746,7 +751,7 @@ static int boringssl_self_test_fast(void) {
   };
   memcpy(aes_iv, kAESIV, sizeof(kAESIV));
   if (AES_set_decrypt_key(kAESKey, 8 * sizeof(kAESKey), &aes_key) != 0) {
-    fprintf(stderr, "AES_set_decrypt_key failed.\n");
+    fprintf(CRYPTO_get_stderr(), "AES_set_decrypt_key failed.\n");
     goto err;
   }
   AES_cbc_encrypt(kAESCBCDecCiphertext, output, sizeof(kAESCBCDecCiphertext),
@@ -761,7 +766,7 @@ static int boringssl_self_test_fast(void) {
   OPENSSL_memset(nonce, 0, sizeof(nonce));
   if (!EVP_AEAD_CTX_init(&aead_ctx, EVP_aead_aes_128_gcm(), kAESKey,
                          sizeof(kAESKey), 0, NULL)) {
-    fprintf(stderr, "EVP_AEAD_CTX_init for AES-128-GCM failed.\n");
+    fprintf(CRYPTO_get_stderr(), "EVP_AEAD_CTX_init for AES-128-GCM failed.\n");
     goto err;
   }
 
@@ -783,7 +788,7 @@ static int boringssl_self_test_fast(void) {
                          0) ||
       !check_test(kAESGCMCiphertext, output, sizeof(kAESGCMCiphertext),
                   "AES-GCM-encrypt KAT")) {
-    fprintf(stderr, "EVP_AEAD_CTX_seal for AES-128-GCM failed.\n");
+    fprintf(CRYPTO_get_stderr(), "EVP_AEAD_CTX_seal for AES-128-GCM failed.\n");
     goto err;
   }
 
@@ -806,7 +811,7 @@ static int boringssl_self_test_fast(void) {
                          NULL, 0) ||
       !check_test(kAESGCMDecPlaintext, output, sizeof(kAESGCMDecPlaintext),
                   "AES-GCM-decrypt KAT")) {
-    fprintf(stderr,
+    fprintf(CRYPTO_get_stderr(),
             "AES-GCM-decrypt KAT failed because EVP_AEAD_CTX_open failed.\n");
     goto err;
   }
@@ -821,13 +826,11 @@ static int boringssl_self_test_fast(void) {
       0x09, 0x11, 0x6d, 0x1a, 0xfd, 0x0f, 0x1e, 0x11, 0xe3, 0xcb,
   };
   SHA1(kSHA1Input, sizeof(kSHA1Input), output);
-  if (!check_test(kSHA1Digest, output, sizeof(kSHA1Digest),
-                  "SHA-1 KAT")) {
+  if (!check_test(kSHA1Digest, output, sizeof(kSHA1Digest), "SHA-1 KAT")) {
     goto err;
   }
 
-  if (!boringssl_self_test_sha256() ||
-      !boringssl_self_test_sha512() ||
+  if (!boringssl_self_test_sha256() || !boringssl_self_test_sha512() ||
       !boringssl_self_test_hmac_sha256()) {
     goto err;
   }
@@ -839,8 +842,11 @@ static int boringssl_self_test_fast(void) {
       0x3f, 0x17, 0x4c, 0xf4, 0x78, 0x7a, 0x4f, 0x1a, 0x40, 0xc2, 0xb5, 0x0b,
       0xab, 0xe1, 0x4a, 0xae, 0x53, 0x0b, 0xe5, 0x88, 0x6d, 0x91, 0x0a, 0x27,
   };
-  static const uint8_t kDRBGPersonalization[18] = "BCMPersonalization";
-  static const uint8_t kDRBGAD[16] = "BCM DRBG KAT AD ";
+  static const uint8_t kDRBGPersonalization[18] = {
+      'B', 'C', 'M', 'P', 'e', 'r', 's', 'o', 'n',
+      'a', 'l', 'i', 'z', 'a', 't', 'i', 'o', 'n'};
+  static const uint8_t kDRBGAD[16] = {'B', 'C', 'M', ' ', 'D', 'R', 'B', 'G',
+                                      ' ', 'K', 'A', 'T', ' ', 'A', 'D', ' '};
   static const uint8_t kDRBGOutput[64] = {
       0x19, 0x1f, 0x2b, 0x49, 0x76, 0x85, 0xfd, 0x51, 0xb6, 0x56, 0xbc,
       0x1c, 0x7d, 0xd5, 0xdd, 0x44, 0x76, 0xa3, 0x5e, 0x17, 0x9b, 0x8e,
@@ -875,7 +881,7 @@ static int boringssl_self_test_fast(void) {
                          sizeof(kDRBGAD)) ||
       !check_test(kDRBGReseedOutput, output, sizeof(kDRBGReseedOutput),
                   "DRBG-reseed KAT")) {
-    fprintf(stderr, "CTR-DRBG failed.\n");
+    fprintf(CRYPTO_get_stderr(), "CTR-DRBG failed.\n");
     goto err;
   }
   CTR_DRBG_clear(&drbg);
@@ -914,7 +920,7 @@ static int boringssl_self_test_fast(void) {
                        kTLSSeed2, sizeof(kTLSSeed2)) ||
       !check_test(kTLS10Output, tls10_output, sizeof(kTLS10Output),
                   "TLS10-KDF KAT")) {
-    fprintf(stderr, "TLS KDF failed.\n");
+    fprintf(CRYPTO_get_stderr(), "TLS KDF failed.\n");
     goto err;
   }
 
@@ -935,7 +941,7 @@ static int boringssl_self_test_fast(void) {
                        kTLSSeed2, sizeof(kTLSSeed2)) ||
       !check_test(kTLS12Output, tls12_output, sizeof(kTLS12Output),
                   "TLS12-KDF KAT")) {
-    fprintf(stderr, "TLS KDF failed.\n");
+    fprintf(CRYPTO_get_stderr(), "TLS KDF failed.\n");
     goto err;
   }
 
@@ -975,7 +981,7 @@ static int boringssl_self_test_fast(void) {
       !check_test(kTLS13ExpandLabelOutput, tls13_expand_label_output,
                   sizeof(kTLS13ExpandLabelOutput),
                   "CRYPTO_tls13_hkdf_expand_label")) {
-    fprintf(stderr, "TLS13-KDF failed.\n");
+    fprintf(CRYPTO_get_stderr(), "TLS13-KDF failed.\n");
     goto err;
   }
 
@@ -1005,7 +1011,7 @@ static int boringssl_self_test_fast(void) {
             sizeof(kHKDFSecret), kHKDFSalt, sizeof(kHKDFSalt), kHKDFInfo,
             sizeof(kHKDFInfo)) ||
       !check_test(kHKDFOutput, hkdf_output, sizeof(kHKDFOutput), "HKDF")) {
-    fprintf(stderr, "HKDF failed.\n");
+    fprintf(CRYPTO_get_stderr(), "HKDF failed.\n");
     goto err;
   }
 
@@ -1020,8 +1026,8 @@ err:
 int BORINGSSL_self_test(void) {
   if (!boringssl_self_test_fast() ||
       // When requested to run self tests, also run the lazy tests.
-      !boringssl_self_test_rsa() ||
-      !boringssl_self_test_ecc() ||
+      !boringssl_self_test_rsa() ||  //
+      !boringssl_self_test_ecc() ||  //
       !boringssl_self_test_ffdh()) {
     return 0;
   }
@@ -1030,9 +1036,7 @@ int BORINGSSL_self_test(void) {
 }
 
 #if defined(BORINGSSL_FIPS)
-int boringssl_self_test_startup(void) {
-  return boringssl_self_test_fast();
-}
+int boringssl_self_test_startup(void) { return boringssl_self_test_fast(); }
 #endif
 
 #endif  // !_MSC_VER

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/service_indicator/internal.h

@@ -1,16 +1,16 @@
-/* Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
 
 #ifndef OPENSSL_HEADER_SERVICE_INDICATOR_INTERNAL_H
 #define OPENSSL_HEADER_SERVICE_INDICATOR_INTERNAL_H
@@ -53,36 +53,36 @@ void TLSKDF_verify_service_indicator(const EVP_MD *dgst);
 
 // Service indicator functions are no-ops in non-FIPS builds.
 
-OPENSSL_INLINE void FIPS_service_indicator_update_state(void) {}
-OPENSSL_INLINE void FIPS_service_indicator_lock_state(void) {}
-OPENSSL_INLINE void FIPS_service_indicator_unlock_state(void) {}
+inline void FIPS_service_indicator_update_state(void) {}
+inline void FIPS_service_indicator_lock_state(void) {}
+inline void FIPS_service_indicator_unlock_state(void) {}
 
-OPENSSL_INLINE void AEAD_GCM_verify_service_indicator(
-    OPENSSL_UNUSED const EVP_AEAD_CTX *ctx) {}
+inline void AEAD_GCM_verify_service_indicator(
+    [[maybe_unused]] const EVP_AEAD_CTX *ctx) {}
 
-OPENSSL_INLINE void AEAD_CCM_verify_service_indicator(
-    OPENSSL_UNUSED const EVP_AEAD_CTX *ctx) {}
+inline void AEAD_CCM_verify_service_indicator(
+    [[maybe_unused]] const EVP_AEAD_CTX *ctx) {}
 
-OPENSSL_INLINE void EC_KEY_keygen_verify_service_indicator(
-    OPENSSL_UNUSED const EC_KEY *eckey) {}
+inline void EC_KEY_keygen_verify_service_indicator(
+    [[maybe_unused]] const EC_KEY *eckey) {}
 
-OPENSSL_INLINE void ECDH_verify_service_indicator(
-    OPENSSL_UNUSED const EC_KEY *ec_key) {}
+inline void ECDH_verify_service_indicator(
+    [[maybe_unused]] const EC_KEY *ec_key) {}
 
-OPENSSL_INLINE void EVP_Cipher_verify_service_indicator(
-    OPENSSL_UNUSED const EVP_CIPHER_CTX *ctx) {}
+inline void EVP_Cipher_verify_service_indicator(
+    [[maybe_unused]] const EVP_CIPHER_CTX *ctx) {}
 
-OPENSSL_INLINE void EVP_DigestSign_verify_service_indicator(
-    OPENSSL_UNUSED const EVP_MD_CTX *ctx) {}
+inline void EVP_DigestSign_verify_service_indicator(
+    [[maybe_unused]] const EVP_MD_CTX *ctx) {}
 
-OPENSSL_INLINE void EVP_DigestVerify_verify_service_indicator(
-    OPENSSL_UNUSED const EVP_MD_CTX *ctx) {}
+inline void EVP_DigestVerify_verify_service_indicator(
+    [[maybe_unused]] const EVP_MD_CTX *ctx) {}
 
-OPENSSL_INLINE void HMAC_verify_service_indicator(
-    OPENSSL_UNUSED const EVP_MD *evp_md) {}
+inline void HMAC_verify_service_indicator(
+    [[maybe_unused]] const EVP_MD *evp_md) {}
 
-OPENSSL_INLINE void TLSKDF_verify_service_indicator(
-    OPENSSL_UNUSED const EVP_MD *dgst) {}
+inline void TLSKDF_verify_service_indicator(
+    [[maybe_unused]] const EVP_MD *dgst) {}
 
 #endif  // BORINGSSL_FIPS
 

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/service_indicator/{service_indicator.c.inc → service_indicator.cc.inc}

@@ -1,16 +1,16 @@
-/* Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
 
 #include <openssl/crypto.h>
 #include <openssl/ec.h>
@@ -45,11 +45,13 @@ struct fips_service_indicator_state {
 // for approved services irrespective of whether the user queries it or not.
 // Hence, it is lazily initialized in any call to an approved service.
 static struct fips_service_indicator_state *service_indicator_get(void) {
-  struct fips_service_indicator_state *indicator = CRYPTO_get_thread_local(
-      OPENSSL_THREAD_LOCAL_FIPS_SERVICE_INDICATOR_STATE);
+  struct fips_service_indicator_state *indicator =
+      reinterpret_cast<fips_service_indicator_state *>(CRYPTO_get_thread_local(
+          OPENSSL_THREAD_LOCAL_FIPS_SERVICE_INDICATOR_STATE));
 
   if (indicator == NULL) {
-    indicator = OPENSSL_malloc(sizeof(struct fips_service_indicator_state));
+    indicator = reinterpret_cast<fips_service_indicator_state *>(
+        OPENSSL_malloc(sizeof(struct fips_service_indicator_state)));
     if (indicator == NULL) {
       return NULL;
     }
@@ -184,9 +186,9 @@ static int is_md_fips_approved_for_verifying(int md_type) {
 
 static void evp_md_ctx_verify_service_indicator(const EVP_MD_CTX *ctx,
                                                 int (*md_ok)(int md_type)) {
-  if (EVP_MD_CTX_md(ctx) == NULL) {
+  if (EVP_MD_CTX_get0_md(ctx) == NULL) {
     // Signature schemes without a prehash are currently never FIPS approved.
-    goto err;
+    return;
   }
 
   EVP_PKEY_CTX *const pctx = ctx->pctx;
@@ -242,7 +244,7 @@ static void evp_md_ctx_verify_service_indicator(const EVP_MD_CTX *ctx,
     }
   }
 
- err:
+err:
   // Ensure that junk errors aren't left on the queue.
   ERR_clear_error();
 }
@@ -300,12 +302,9 @@ void HMAC_verify_service_indicator(const EVP_MD *evp_md) {
 }
 
 void TLSKDF_verify_service_indicator(const EVP_MD *md) {
-  // HMAC-MD5/HMAC-SHA1 (both used concurrently) is approved for use in the KDF
-  // in TLS 1.0/1.1. HMAC-SHA{256, 384, 512} are approved for use in the KDF in
-  // TLS 1.2. These Key Derivation functions are to be used in the context of
-  // the TLS protocol.
+  // HMAC-SHA{256, 384, 512} are approved for use in the KDF in TLS 1.2. These
+  // Key Derivation functions are to be used in the context of the TLS protocol.
   switch (EVP_MD_type(md)) {
-    case NID_md5_sha1:
     case NID_sha256:
     case NID_sha384:
     case NID_sha512: