grpc 1.71.0 → 1.73.0

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/slhdsa/slhdsa.cc.inc

@@ -29,15 +29,23 @@
 #include "thash.h"
 
 
+namespace {
+
+namespace fips {
+void ensure_keygen_self_test();
+void ensure_sign_self_test();
+void ensure_verify_self_test();
+}  // namespace fips
+
 // The OBJECT IDENTIFIER header is also included in these values, per the spec.
-static const uint8_t kSHA256OID[] = {0x06, 0x09, 0x60, 0x86, 0x48, 0x01,
-                                     0x65, 0x03, 0x04, 0x02, 0x01};
-static const uint8_t kSHA384OID[] = {0x06, 0x09, 0x60, 0x86, 0x48, 0x01,
-                                     0x65, 0x03, 0x04, 0x02, 0x02};
+const uint8_t kSHA256OID[] = {0x06, 0x09, 0x60, 0x86, 0x48, 0x01,
+                              0x65, 0x03, 0x04, 0x02, 0x01};
+const uint8_t kSHA384OID[] = {0x06, 0x09, 0x60, 0x86, 0x48, 0x01,
+                              0x65, 0x03, 0x04, 0x02, 0x02};
 #define MAX_OID_LENGTH 11
 #define MAX_CONTEXT_LENGTH 255
 
-bcm_infallible BCM_slhdsa_sha2_128s_generate_key_from_seed(
+bcm_infallible generate_key_from_seed_no_self_test(
     uint8_t out_public_key[BCM_SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
     uint8_t out_secret_key[BCM_SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES],
     const uint8_t seed[3 * BCM_SLHDSA_SHA2_128S_N]) {
@@ -57,30 +65,33 @@ bcm_infallible BCM_slhdsa_sha2_128s_generate_key_from_seed(
   OPENSSL_memcpy(out_secret_key + 3 * BCM_SLHDSA_SHA2_128S_N,
                  out_public_key + BCM_SLHDSA_SHA2_128S_N,
                  BCM_SLHDSA_SHA2_128S_N);
-  return bcm_infallible::approved;
-}
 
-bcm_infallible BCM_slhdsa_sha2_128s_generate_key(
-    uint8_t out_public_key[BCM_SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
-    uint8_t out_private_key[BCM_SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES]) {
-  uint8_t seed[3 * BCM_SLHDSA_SHA2_128S_N];
-  RAND_bytes(seed, 3 * BCM_SLHDSA_SHA2_128S_N);
-  BCM_slhdsa_sha2_128s_generate_key_from_seed(out_public_key, out_private_key,
-                                              seed);
-  return bcm_infallible::approved;
-}
+  // FIPS 140-3 IG 10.3.A comment 1 says of the pair-wise consistency test for
+  // SLH-DSA:
+  //
+  // "For key pairs generated for use with approved algorithms in SP 800-208 and
+  // FIPS 205, the PCT (described by the tester in TE10.35.02) may be limited to
+  // confirming the same key identifier (I in the case of LMS, SEED in the case
+  // of XMSS and PK.SEED for SLH-DSA) is shared by the resulting public and
+  // private key following generation."
+  //
+  // Since this is cheap, we always do this.
+
+  if (boringssl_fips_break_test("SLHDSA_PWCT")) {
+    out_public_key[0] ^= 1;
+  }
+  if (OPENSSL_memcmp(out_public_key,
+                     out_secret_key + 2 * BCM_SLHDSA_SHA2_128S_N,
+                     BCM_SLHDSA_SHA2_128S_N) != 0) {
+    abort();
+  }
 
-bcm_infallible BCM_slhdsa_sha2_128s_public_from_private(
-    uint8_t out_public_key[BCM_SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
-    const uint8_t private_key[BCM_SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES]) {
-  OPENSSL_memcpy(out_public_key, private_key + 2 * BCM_SLHDSA_SHA2_128S_N,
-                 BCM_SLHDSA_SHA2_128S_N * 2);
-  return bcm_infallible::approved;
+  return bcm_infallible::not_approved;
 }
 
 // Note that this overreads by a byte. This is fine in the context that it's
 // used.
-static uint64_t load_tree_index(const uint8_t in[8]) {
+uint64_t load_tree_index(const uint8_t in[8]) {
   static_assert(SLHDSA_SHA2_128S_TREE_BYTES == 7,
                 "This code needs to be updated");
   uint64_t index = CRYPTO_load_u64_be(in);
@@ -90,7 +101,7 @@ static uint64_t load_tree_index(const uint8_t in[8]) {
 }
 
 // Implements Algorithm 22: slh_sign function (Section 10.2.1, page 39)
-bcm_infallible BCM_slhdsa_sha2_128s_sign_internal(
+bcm_infallible sign_internal_no_self_test(
     uint8_t out_signature[BCM_SLHDSA_SHA2_128S_SIGNATURE_BYTES],
     const uint8_t secret_key[BCM_SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES],
     const uint8_t header[BCM_SLHDSA_M_PRIME_HEADER_LEN], const uint8_t *context,
@@ -139,6 +150,189 @@ bcm_infallible BCM_slhdsa_sha2_128s_sign_internal(
   return bcm_infallible::approved;
 }
 
+bcm_status verify_internal(
+    const uint8_t *signature, size_t signature_len,
+    const uint8_t public_key[BCM_SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
+    const uint8_t header[BCM_SLHDSA_M_PRIME_HEADER_LEN], const uint8_t *context,
+    size_t context_len, const uint8_t *msg, size_t msg_len) {
+  if (signature_len != BCM_SLHDSA_SHA2_128S_SIGNATURE_BYTES) {
+    return bcm_status::failure;
+  }
+  const uint8_t *pk_seed = public_key;
+  const uint8_t *pk_root = public_key + BCM_SLHDSA_SHA2_128S_N;
+
+  const uint8_t *r = signature;
+  const uint8_t *sig_fors = signature + BCM_SLHDSA_SHA2_128S_N;
+  const uint8_t *sig_ht = sig_fors + SLHDSA_SHA2_128S_FORS_BYTES;
+
+  uint8_t digest[SLHDSA_SHA2_128S_DIGEST_SIZE];
+  slhdsa_thash_hmsg(digest, r, pk_seed, pk_root, header, context, context_len,
+                    msg, msg_len);
+
+  uint8_t fors_digest[SLHDSA_SHA2_128S_FORS_MSG_BYTES];
+  OPENSSL_memcpy(fors_digest, digest, SLHDSA_SHA2_128S_FORS_MSG_BYTES);
+
+  const uint64_t idx_tree =
+      load_tree_index(digest + SLHDSA_SHA2_128S_FORS_MSG_BYTES);
+  uint32_t idx_leaf = CRYPTO_load_u16_be(
+      digest + SLHDSA_SHA2_128S_FORS_MSG_BYTES + SLHDSA_SHA2_128S_TREE_BYTES);
+  idx_leaf &= (~(uint32_t)0) >> (32 - SLHDSA_SHA2_128S_LEAF_BITS);
+
+  uint8_t addr[32] = {0};
+  slhdsa_set_tree_addr(addr, idx_tree);
+  slhdsa_set_type(addr, SLHDSA_SHA2_128S_ADDR_TYPE_FORSTREE);
+  slhdsa_set_keypair_addr(addr, idx_leaf);
+
+  uint8_t pk_fors[BCM_SLHDSA_SHA2_128S_N];
+  slhdsa_fors_pk_from_sig(pk_fors, sig_fors, fors_digest, pk_seed, addr);
+
+  if (!slhdsa_ht_verify(sig_ht, pk_fors, idx_tree, idx_leaf, pk_root,
+                        pk_seed)) {
+    return bcm_status::failure;
+  }
+
+  return bcm_status::approved;
+}
+
+namespace fips {
+
+#include "fips_known_values.inc"
+
+static int keygen_self_test() {
+  uint8_t seed[3 * BCM_SLHDSA_SHA2_128S_N] = {0};
+  uint8_t pub[BCM_SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES];
+  uint8_t priv[BCM_SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES];
+  generate_key_from_seed_no_self_test(pub, priv, seed);
+
+  static_assert(sizeof(kExpectedPublicKey) == sizeof(pub));
+  static_assert(sizeof(kExpectedPrivateKey) == sizeof(priv));
+  if (!BORINGSSL_check_test(kExpectedPublicKey, pub, sizeof(pub),
+                            "SLH-DSA public key") ||
+      !BORINGSSL_check_test(kExpectedPrivateKey, priv, sizeof(priv),
+                            "SLH-DSA private key")) {
+    return 0;
+  }
+
+  return 1;
+}
+
+static int sign_self_test() {
+  uint8_t header[BCM_SLHDSA_M_PRIME_HEADER_LEN] = {0};
+  uint8_t entropy[BCM_SLHDSA_SHA2_128S_N] = {0};
+  uint8_t sig[BCM_SLHDSA_SHA2_128S_SIGNATURE_BYTES];
+  sign_internal_no_self_test(sig, kExpectedPrivateKey, header, nullptr, 0,
+                             nullptr, 0, entropy);
+  uint8_t digest[32];
+  SHA256(sig, sizeof(sig), digest);
+
+  static_assert(sizeof(kExpectedSignatureSHA256) == sizeof(digest));
+  if (!BORINGSSL_check_test(kExpectedSignatureSHA256, digest, sizeof(digest),
+                            "SLH-DSA signature")) {
+    return 0;
+  }
+
+  return 1;
+}
+
+static int verify_self_test() {
+  uint8_t header[BCM_SLHDSA_M_PRIME_HEADER_LEN] = {0};
+  return verify_internal(kExpectedSignature, sizeof(kExpectedSignature),
+                         kExpectedPublicKey, header, nullptr, 0, nullptr,
+                         0) == bcm_status::approved;
+}
+
+#if defined(BORINGSSL_FIPS)
+
+DEFINE_STATIC_ONCE(g_slhdsa_keygen_self_test_once)
+
+void ensure_keygen_self_test(void) {
+  CRYPTO_once(g_slhdsa_keygen_self_test_once_bss_get(), []() {
+    if (!keygen_self_test()) {
+      BORINGSSL_FIPS_abort();
+    }
+  });
+}
+
+DEFINE_STATIC_ONCE(g_slhdsa_sign_self_test_once)
+
+void ensure_sign_self_test(void) {
+  CRYPTO_once(g_slhdsa_sign_self_test_once_bss_get(), []() {
+    if (!sign_self_test()) {
+      BORINGSSL_FIPS_abort();
+    }
+  });
+}
+
+DEFINE_STATIC_ONCE(g_slhdsa_verify_self_test_once)
+
+void ensure_verify_self_test(void) {
+  CRYPTO_once(g_slhdsa_verify_self_test_once_bss_get(), []() {
+    if (!verify_self_test()) {
+      BORINGSSL_FIPS_abort();
+    }
+  });
+}
+
+#else
+
+void ensure_keygen_self_test(void) {}
+void ensure_sign_self_test(void) {}
+void ensure_verify_self_test(void) {}
+
+#endif
+
+}  // namespace fips
+
+}  // namespace
+
+bcm_infallible BCM_slhdsa_sha2_128s_generate_key_from_seed(
+    uint8_t out_public_key[BCM_SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
+    uint8_t out_secret_key[BCM_SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES],
+    const uint8_t seed[3 * BCM_SLHDSA_SHA2_128S_N]) {
+  fips::ensure_keygen_self_test();
+  return generate_key_from_seed_no_self_test(out_public_key, out_secret_key,
+                                             seed);
+}
+
+bcm_status BCM_slhdsa_sha2_128s_generate_key_from_seed_fips(
+    uint8_t out_public_key[BCM_SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
+    uint8_t out_secret_key[BCM_SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES],
+    const uint8_t seed[3 * BCM_SLHDSA_SHA2_128S_N]) {
+  if (out_public_key == nullptr || out_secret_key == nullptr) {
+    return bcm_status::failure;
+  }
+  BCM_slhdsa_sha2_128s_generate_key_from_seed(out_public_key, out_secret_key,
+                                              seed);
+  return bcm_status::approved;
+}
+
+bcm_infallible BCM_slhdsa_sha2_128s_generate_key(
+    uint8_t out_public_key[BCM_SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
+    uint8_t out_private_key[BCM_SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES]) {
+  uint8_t seed[3 * BCM_SLHDSA_SHA2_128S_N];
+  RAND_bytes(seed, 3 * BCM_SLHDSA_SHA2_128S_N);
+  return BCM_slhdsa_sha2_128s_generate_key_from_seed(out_public_key,
+                                                     out_private_key, seed);
+}
+
+bcm_status BCM_slhdsa_sha2_128s_generate_key_fips(
+    uint8_t out_public_key[BCM_SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
+    uint8_t out_private_key[BCM_SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES]) {
+  if (out_public_key == nullptr || out_private_key == nullptr) {
+    return bcm_status::failure;
+  }
+  BCM_slhdsa_sha2_128s_generate_key(out_public_key, out_private_key);
+  return bcm_status::approved;
+}
+
+bcm_infallible BCM_slhdsa_sha2_128s_public_from_private(
+    uint8_t out_public_key[BCM_SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
+    const uint8_t private_key[BCM_SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES]) {
+  OPENSSL_memcpy(out_public_key, private_key + 2 * BCM_SLHDSA_SHA2_128S_N,
+                 BCM_SLHDSA_SHA2_128S_N * 2);
+  return bcm_infallible::approved;
+}
+
 bcm_status BCM_slhdsa_sha2_128s_sign(
     uint8_t out_signature[BCM_SLHDSA_SHA2_128S_SIGNATURE_BYTES],
     const uint8_t private_key[BCM_SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES],
@@ -208,6 +402,16 @@ static int slhdsa_get_context_and_oid(uint8_t *out_context_and_oid,
   return 1;
 }
 
+bcm_infallible BCM_slhdsa_sha2_128s_sign_internal(
+    uint8_t out_signature[BCM_SLHDSA_SHA2_128S_SIGNATURE_BYTES],
+    const uint8_t secret_key[BCM_SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES],
+    const uint8_t header[BCM_SLHDSA_M_PRIME_HEADER_LEN], const uint8_t *context,
+    size_t context_len, const uint8_t *msg, size_t msg_len,
+    const uint8_t entropy[BCM_SLHDSA_SHA2_128S_N]) {
+  fips::ensure_sign_self_test();
+  return sign_internal_no_self_test(out_signature, secret_key, header, context,
+                                    context_len, msg, msg_len, entropy);
+}
 
 bcm_status BCM_slhdsa_sha2_128s_prehash_sign(
     uint8_t out_signature[BCM_SLHDSA_SHA2_128S_SIGNATURE_BYTES],
@@ -289,41 +493,12 @@ bcm_status BCM_slhdsa_sha2_128s_verify_internal(
     const uint8_t public_key[BCM_SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
     const uint8_t header[BCM_SLHDSA_M_PRIME_HEADER_LEN], const uint8_t *context,
     size_t context_len, const uint8_t *msg, size_t msg_len) {
-  if (signature_len != BCM_SLHDSA_SHA2_128S_SIGNATURE_BYTES) {
-    return bcm_status::failure;
-  }
-  const uint8_t *pk_seed = public_key;
-  const uint8_t *pk_root = public_key + BCM_SLHDSA_SHA2_128S_N;
-
-  const uint8_t *r = signature;
-  const uint8_t *sig_fors = signature + BCM_SLHDSA_SHA2_128S_N;
-  const uint8_t *sig_ht = sig_fors + SLHDSA_SHA2_128S_FORS_BYTES;
-
-  uint8_t digest[SLHDSA_SHA2_128S_DIGEST_SIZE];
-  slhdsa_thash_hmsg(digest, r, pk_seed, pk_root, header, context, context_len,
-                    msg, msg_len);
-
-  uint8_t fors_digest[SLHDSA_SHA2_128S_FORS_MSG_BYTES];
-  OPENSSL_memcpy(fors_digest, digest, SLHDSA_SHA2_128S_FORS_MSG_BYTES);
-
-  const uint64_t idx_tree =
-      load_tree_index(digest + SLHDSA_SHA2_128S_FORS_MSG_BYTES);
-  uint32_t idx_leaf = CRYPTO_load_u16_be(
-      digest + SLHDSA_SHA2_128S_FORS_MSG_BYTES + SLHDSA_SHA2_128S_TREE_BYTES);
-  idx_leaf &= (~(uint32_t)0) >> (32 - SLHDSA_SHA2_128S_LEAF_BITS);
-
-  uint8_t addr[32] = {0};
-  slhdsa_set_tree_addr(addr, idx_tree);
-  slhdsa_set_type(addr, SLHDSA_SHA2_128S_ADDR_TYPE_FORSTREE);
-  slhdsa_set_keypair_addr(addr, idx_leaf);
-
-  uint8_t pk_fors[BCM_SLHDSA_SHA2_128S_N];
-  slhdsa_fors_pk_from_sig(pk_fors, sig_fors, fors_digest, pk_seed, addr);
-
-  if (!slhdsa_ht_verify(sig_ht, pk_fors, idx_tree, idx_leaf, pk_root,
-                        pk_seed)) {
-    return bcm_status::failure;
-  }
+  fips::ensure_verify_self_test();
+  return verify_internal(signature, signature_len, public_key, header, context,
+                         context_len, msg, msg_len);
+}
 
-  return bcm_status::approved;
+int boringssl_self_test_slhdsa() {
+  return fips::keygen_self_test() && fips::sign_self_test() &&
+         fips::verify_self_test();
 }

data/third_party/boringssl-with-bazel/src/crypto/fuzzer_mode.cc

@@ -0,0 +1,30 @@
+// Copyright 2025 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <openssl/crypto.h>
+
+#include "internal.h"
+
+
+#if defined(FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION)
+static CRYPTO_atomic_u32 fuzzer_mode_enabled = 0;
+
+int CRYPTO_fuzzer_mode_enabled(void) {
+  return CRYPTO_atomic_load_u32(&fuzzer_mode_enabled);
+}
+
+void CRYPTO_set_fuzzer_mode(int enabled) {
+  CRYPTO_atomic_store_u32(&fuzzer_mode_enabled, !!enabled);
+}
+#endif  // FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION

data/third_party/boringssl-with-bazel/src/crypto/hrss/internal.h

@@ -12,8 +12,8 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-#ifndef OPENSSL_HEADER_HRSS_INTERNAL_H
-#define OPENSSL_HEADER_HRSS_INTERNAL_H
+#ifndef OPENSSL_HEADER_CRYPTO_HRSS_INTERNAL_H
+#define OPENSSL_HEADER_CRYPTO_HRSS_INTERNAL_H
 
 #include <openssl/base.h>
 #include "../internal.h"
@@ -65,4 +65,4 @@ extern void poly_Rq_mul(
 }  // extern "C"
 #endif
 
-#endif  // !OPENSSL_HEADER_HRSS_INTERNAL_H
+#endif  // !OPENSSL_HEADER_CRYPTO_HRSS_INTERNAL_H

data/third_party/boringssl-with-bazel/src/crypto/internal.h

@@ -15,13 +15,13 @@
 #ifndef OPENSSL_HEADER_CRYPTO_INTERNAL_H
 #define OPENSSL_HEADER_CRYPTO_INTERNAL_H
 
-#include <openssl/arm_arch.h>
 #include <openssl/crypto.h>
 #include <openssl/ex_data.h>
 #include <openssl/stack.h>
 #include <openssl/thread.h>
 
 #include <assert.h>
+#include <stdlib.h>
 #include <string.h>
 
 #if defined(BORINGSSL_CONSTANT_TIME_VALIDATION)
@@ -48,9 +48,7 @@
 #endif
 
 #if defined(OPENSSL_WINDOWS_THREADS)
-OPENSSL_MSVC_PRAGMA(warning(push, 3))
 #include <windows.h>
-OPENSSL_MSVC_PRAGMA(warning(pop))
 #endif
 
 #if defined(__cplusplus)
@@ -105,12 +103,6 @@ typedef __uint128_t uint128_t;
 
 #define OPENSSL_ARRAY_SIZE(array) (sizeof(array) / sizeof((array)[0]))
 
-#if defined(__clang__) && __clang_major__ >= 5
-#if __has_attribute(fallthrough)
-#define OPENSSL_CAN_USE_ATTR_FALLTHROUGH
-#endif
-#endif
-
 // GCC-like compilers indicate SSE2 with |__SSE2__|. MSVC leaves the caller to
 // know that x86_64 has SSE2, and uses _M_IX86_FP to indicate SSE2 on x86.
 // https://learn.microsoft.com/en-us/cpp/preprocessor/predefined-macros?view=msvc-170
@@ -611,8 +603,7 @@ OPENSSL_EXPORT int CRYPTO_refcount_dec_and_test_zero(CRYPTO_refcount_t *count);
 typedef struct crypto_mutex_st {
   char padding;  // Empty structs have different sizes in C and C++.
 } CRYPTO_MUTEX;
-#define CRYPTO_MUTEX_INIT \
-  { 0 }
+#define CRYPTO_MUTEX_INIT {0}
 #elif defined(OPENSSL_WINDOWS_THREADS)
 typedef SRWLOCK CRYPTO_MUTEX;
 #define CRYPTO_MUTEX_INIT SRWLOCK_INIT
@@ -677,7 +668,7 @@ using MutexReadLock =
 
 BSSL_NAMESPACE_END
 
-}       // extern "C++"
+}  // extern "C++"
 #endif  // defined(__cplusplus)
 
 
@@ -741,10 +732,9 @@ typedef struct {
   uint8_t num_reserved;
 } CRYPTO_EX_DATA_CLASS;
 
-#define CRYPTO_EX_DATA_CLASS_INIT \
-  { CRYPTO_MUTEX_INIT, NULL, NULL, {}, 0 }
+#define CRYPTO_EX_DATA_CLASS_INIT {CRYPTO_MUTEX_INIT, NULL, NULL, {}, 0}
 #define CRYPTO_EX_DATA_CLASS_INIT_WITH_APP_DATA \
-  { CRYPTO_MUTEX_INIT, NULL, NULL, {}, 1 }
+  {CRYPTO_MUTEX_INIT, NULL, NULL, {}, 1}
 
 // CRYPTO_get_ex_new_index_ex allocates a new index for |ex_data_class|. Each
 // class of object should provide a wrapper function that uses the correct
@@ -786,9 +776,6 @@ static inline uint64_t CRYPTO_bswap8(uint64_t x) {
   return __builtin_bswap64(x);
 }
 #elif defined(_MSC_VER)
-OPENSSL_MSVC_PRAGMA(warning(push, 3))
-#include <stdlib.h>
-OPENSSL_MSVC_PRAGMA(warning(pop))
 #pragma intrinsic(_byteswap_uint64, _byteswap_ulong, _byteswap_ushort)
 static inline uint16_t CRYPTO_bswap2(uint16_t x) { return _byteswap_ushort(x); }
 
@@ -843,7 +830,7 @@ static inline void *OPENSSL_memchr(void *s, int c, size_t n) {
   return memchr(s, c, n);
 }
 
-}      // extern "C++"
+}  // extern "C++"
 #else  // __cplusplus
 
 static inline void *OPENSSL_memchr(const void *s, int c, size_t n) {
@@ -1049,6 +1036,12 @@ inline void boringssl_ensure_ffdh_self_test(void) {}
 
 #endif  // FIPS
 
+// BORINGSSL_check_test memcmp's two values of equal length. It returns 1 on
+// success and, on failure, it prints an error message that includes the
+// hexdumps the two values and returns 0.
+int BORINGSSL_check_test(const void *expected, const void *actual,
+                         size_t expected_len, const char *name);
+
 // boringssl_self_test_sha256 performs a SHA-256 KAT.
 int boringssl_self_test_sha256(void);
 
@@ -1058,6 +1051,15 @@ int boringssl_self_test_sha512(void);
 // boringssl_self_test_hmac_sha256 performs an HMAC-SHA-256 KAT.
 int boringssl_self_test_hmac_sha256(void);
 
+// boringssl_self_test_mlkem performs the ML-KEM KATs.
+OPENSSL_EXPORT int boringssl_self_test_mlkem(void);
+
+// boringssl_self_test_mldsa performs the ML-DSA KATs.
+OPENSSL_EXPORT int boringssl_self_test_mldsa(void);
+
+// boringssl_self_test_slhdsa performs the SLH-DSA KATs.
+OPENSSL_EXPORT int boringssl_self_test_slhdsa(void);
+
 #if defined(BORINGSSL_FIPS_COUNTERS)
 void boringssl_fips_inc_counter(enum fips_counter_t counter);
 #else
@@ -1106,14 +1108,6 @@ OPENSSL_ATTR_CONST uint32_t OPENSSL_get_ia32cap(int idx);
 
 // See Intel manual, volume 2A, table 3-11.
 
-inline int CRYPTO_is_FXSR_capable(void) {
-#if defined(__FXSR__)
-  return 1;
-#else
-  return (OPENSSL_get_ia32cap(0) & (1u << 24)) != 0;
-#endif
-}
-
 inline int CRYPTO_is_intel_cpu(void) {
   // The reserved bit 30 is used to indicate an Intel CPU.
   return (OPENSSL_get_ia32cap(0) & (1u << 30)) != 0;
@@ -1290,8 +1284,26 @@ inline int CRYPTO_is_VPCLMULQDQ_capable(void) {
 
 #if defined(OPENSSL_ARM) || defined(OPENSSL_AARCH64)
 
-// OPENSSL_armcap_P contains ARM CPU capabilities. From C, this should only be
-// accessed with |OPENSSL_get_armcap|.
+// ARMV7_NEON indicates support for NEON.
+#define ARMV7_NEON (1 << 0)
+
+// ARMV8_AES indicates support for hardware AES instructions.
+#define ARMV8_AES (1 << 2)
+
+// ARMV8_SHA1 indicates support for hardware SHA-1 instructions.
+#define ARMV8_SHA1 (1 << 3)
+
+// ARMV8_SHA256 indicates support for hardware SHA-256 instructions.
+#define ARMV8_SHA256 (1 << 4)
+
+// ARMV8_PMULL indicates support for carryless multiplication.
+#define ARMV8_PMULL (1 << 5)
+
+// ARMV8_SHA512 indicates support for hardware SHA-512 instructions.
+#define ARMV8_SHA512 (1 << 6)
+
+// OPENSSL_armcap_P contains ARM CPU capabilities as a bitmask of the above
+// constants. This should only be accessed with |OPENSSL_get_armcap|.
 extern uint32_t OPENSSL_armcap_P;
 
 // OPENSSL_get_armcap initializes the library if needed and returns ARM CPU
@@ -1382,6 +1394,7 @@ inline int CRYPTO_is_ARMv8_SHA512_capable(void) {
 
 #endif  // OPENSSL_ARM || OPENSSL_AARCH64
 
+
 #if defined(BORINGSSL_DISPATCH_TEST)
 // Runtime CPU dispatch testing support
 
@@ -1393,12 +1406,12 @@ inline int CRYPTO_is_ARMv8_SHA512_capable(void) {
 //   3: aes_hw_set_encrypt_key
 //   4: vpaes_encrypt
 //   5: vpaes_set_encrypt_key
-//   6: aes_gcm_enc_update_vaes_avx10_256 [reserved]
-//   7: aes_gcm_enc_update_vaes_avx10_512
-//   8: aes_gcm_enc_update_vaes_avx2
-extern uint8_t BORINGSSL_function_hit[9];
+//   6: aes_gcm_enc_update_vaes_avx2
+//   7: aes_gcm_enc_update_vaes_avx512
+extern uint8_t BORINGSSL_function_hit[8];
 #endif  // BORINGSSL_DISPATCH_TEST
 
+
 // OPENSSL_vasprintf_internal is just like |vasprintf(3)|. If |system_malloc| is
 // 0, memory will be allocated with |OPENSSL_malloc| and must be freed with
 // |OPENSSL_free|. Otherwise the system |malloc| function is used and the memory
@@ -1407,6 +1420,19 @@ OPENSSL_EXPORT int OPENSSL_vasprintf_internal(char **str, const char *format,
                                               va_list args, int system_malloc)
     OPENSSL_PRINTF_FORMAT_FUNC(2, 0);
 
+
+// Fuzzer mode.
+
+#if defined(FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION)
+// CRYPTO_fuzzer_mode_enabled returns whether fuzzer mode is enabled. See
+// |CRYPTO_set_fuzzer_mode|. In non-fuzzer builds, this function statically
+// returns zero so the codepaths will be deleted by the optimizer.
+int CRYPTO_fuzzer_mode_enabled(void);
+#else
+inline int CRYPTO_fuzzer_mode_enabled(void) { return 0; }
+#endif
+
+
 #if defined(__cplusplus)
 }  // extern C
 #endif

data/third_party/boringssl-with-bazel/src/crypto/lhash/internal.h

@@ -12,8 +12,8 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-#ifndef OPENSSL_HEADER_LHASH_INTERNAL_H
-#define OPENSSL_HEADER_LHASH_INTERNAL_H
+#ifndef OPENSSL_HEADER_CRYPTO_LHASH_INTERNAL_H
+#define OPENSSL_HEADER_CRYPTO_LHASH_INTERNAL_H
 
 #include <openssl/lhash.h>
 
@@ -218,4 +218,4 @@ OPENSSL_EXPORT void OPENSSL_lh_doall_arg(_LHASH *lh,
 }  // extern C
 #endif
 
-#endif  // OPENSSL_HEADER_LHASH_INTERNAL_H
+#endif  // OPENSSL_HEADER_CRYPTO_LHASH_INTERNAL_H

data/third_party/boringssl-with-bazel/src/crypto/md5/internal.h

@@ -12,8 +12,8 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-#ifndef OPENSSL_HEADER_MD5_INTERNAL_H
-#define OPENSSL_HEADER_MD5_INTERNAL_H
+#ifndef OPENSSL_HEADER_CRYPTO_MD5_INTERNAL_H
+#define OPENSSL_HEADER_CRYPTO_MD5_INTERNAL_H
 
 #include <openssl/base.h>
 
@@ -34,4 +34,4 @@ extern void md5_block_asm_data_order(uint32_t *state, const uint8_t *data,
 }  // extern "C"
 #endif
 
-#endif  // OPENSSL_HEADER_MD5_INTERNAL_H
+#endif  // OPENSSL_HEADER_CRYPTO_MD5_INTERNAL_H

data/third_party/boringssl-with-bazel/src/crypto/mem.cc

@@ -24,9 +24,7 @@
 #include <openssl/err.h>
 
 #if defined(OPENSSL_WINDOWS)
-OPENSSL_MSVC_PRAGMA(warning(push, 3))
 #include <windows.h>
-OPENSSL_MSVC_PRAGMA(warning(pop))
 #endif
 
 #if defined(BORINGSSL_MALLOC_FAILURE_TESTING)

data/third_party/boringssl-with-bazel/src/crypto/obj/obj.cc

@@ -278,14 +278,8 @@ int OBJ_txt2nid(const char *s) {
 
 OPENSSL_EXPORT int OBJ_nid2cbb(CBB *out, int nid) {
   const ASN1_OBJECT *obj = OBJ_nid2obj(nid);
-  CBB oid;
-
-  if (obj == NULL || !CBB_add_asn1(out, &oid, CBS_ASN1_OBJECT) ||
-      !CBB_add_bytes(&oid, obj->data, obj->length) || !CBB_flush(out)) {
-    return 0;
-  }
-
-  return 1;
+  return obj != NULL &&
+         CBB_add_asn1_element(out, CBS_ASN1_OBJECT, obj->data, obj->length);
 }
 
 const ASN1_OBJECT *OBJ_get_undef(void) {

data/third_party/boringssl-with-bazel/src/crypto/pem/internal.h

@@ -12,8 +12,8 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-#ifndef OPENSSL_HEADER_PEM_INTERNAL_H
-#define OPENSSL_HEADER_PEM_INTERNAL_H
+#ifndef OPENSSL_HEADER_CRYPTO_PEM_INTERNAL_H
+#define OPENSSL_HEADER_CRYPTO_PEM_INTERNAL_H
 
 #include <openssl/pem.h>
 
@@ -41,4 +41,4 @@ int PEM_do_header(const EVP_CIPHER_INFO *cipher, uint8_t *data, long *len,
 }  // extern "C"
 #endif
 
-#endif  // OPENSSL_HEADER_PEM_INTERNAL_H
+#endif  // OPENSSL_HEADER_CRYPTO_PEM_INTERNAL_H