visaljs 0.0.1 → 0.0.3

package/runtime/third_party/boringssl/crypto/fipsmodule/aes/key_wrap.cc.inc

@@ -0,0 +1,211 @@
+// Copyright 2008-2016 The OpenSSL Project Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <openssl/aes.h>
+
+#include <assert.h>
+#include <limits.h>
+#include <string.h>
+
+#include <openssl/mem.h>
+
+#include "../bcm_interface.h"
+#include "../../internal.h"
+#include "../service_indicator/internal.h"
+
+
+using namespace bssl;
+
+// kDefaultIV is the default IV value given in RFC 3394, 2.2.3.1.
+static const uint8_t kDefaultIV[] = {
+    0xa6, 0xa6, 0xa6, 0xa6, 0xa6, 0xa6, 0xa6, 0xa6,
+};
+
+static const unsigned kBound = 6;
+
+int AES_wrap_key(const AES_KEY *key, const uint8_t *iv, uint8_t *out,
+                 const uint8_t *in, size_t in_len) {
+  // See RFC 3394, section 2.2.1. Additionally, note that section 2 requires the
+  // plaintext be at least two 8-byte blocks.
+
+  if (in_len > INT_MAX - 8 || in_len < 16 || in_len % 8 != 0) {
+    return -1;
+  }
+
+  if (iv == nullptr) {
+    iv = kDefaultIV;
+  }
+
+  OPENSSL_memmove(out + 8, in, in_len);
+  uint8_t A[AES_BLOCK_SIZE];
+  OPENSSL_memcpy(A, iv, 8);
+
+  size_t n = in_len / 8;
+
+  for (unsigned j = 0; j < kBound; j++) {
+    for (size_t i = 1; i <= n; i++) {
+      OPENSSL_memcpy(A + 8, out + 8 * i, 8);
+      BCM_aes_encrypt(A, A, key);
+
+      uint32_t t = (uint32_t)(n * j + i);
+      A[7] ^= t & 0xff;
+      A[6] ^= (t >> 8) & 0xff;
+      A[5] ^= (t >> 16) & 0xff;
+      A[4] ^= (t >> 24) & 0xff;
+      OPENSSL_memcpy(out + 8 * i, A + 8, 8);
+    }
+  }
+
+  OPENSSL_memcpy(out, A, 8);
+  FIPS_service_indicator_update_state();
+  return (int)in_len + 8;
+}
+
+// aes_unwrap_key_inner performs steps one and two from
+// https://tools.ietf.org/html/rfc3394#section-2.2.2
+static int aes_unwrap_key_inner(const AES_KEY *key, uint8_t *out,
+                                uint8_t out_iv[8], const uint8_t *in,
+                                size_t in_len) {
+  // See RFC 3394, section 2.2.2. Additionally, note that section 2 requires the
+  // plaintext be at least two 8-byte blocks, so the ciphertext must be at least
+  // three blocks.
+
+  if (in_len > INT_MAX || in_len < 24 || in_len % 8 != 0) {
+    return 0;
+  }
+
+  uint8_t A[AES_BLOCK_SIZE];
+  OPENSSL_memcpy(A, in, 8);
+  OPENSSL_memmove(out, in + 8, in_len - 8);
+
+  size_t n = (in_len / 8) - 1;
+
+  for (unsigned j = kBound - 1; j < kBound; j--) {
+    for (size_t i = n; i > 0; i--) {
+      uint32_t t = (uint32_t)(n * j + i);
+      A[7] ^= t & 0xff;
+      A[6] ^= (t >> 8) & 0xff;
+      A[5] ^= (t >> 16) & 0xff;
+      A[4] ^= (t >> 24) & 0xff;
+      OPENSSL_memcpy(A + 8, out + 8 * (i - 1), 8);
+      BCM_aes_decrypt(A, A, key);
+      OPENSSL_memcpy(out + 8 * (i - 1), A + 8, 8);
+    }
+  }
+
+  memcpy(out_iv, A, 8);
+  return 1;
+}
+
+int AES_unwrap_key(const AES_KEY *key, const uint8_t *iv, uint8_t *out,
+                   const uint8_t *in, size_t in_len) {
+  uint8_t calculated_iv[8];
+  if (!aes_unwrap_key_inner(key, out, calculated_iv, in, in_len)) {
+    return -1;
+  }
+
+  if (iv == nullptr) {
+    iv = kDefaultIV;
+  }
+  if (CRYPTO_memcmp(calculated_iv, iv, 8) != 0) {
+    return -1;
+  }
+
+  FIPS_service_indicator_update_state();
+  return (int)in_len - 8;
+}
+
+// kPaddingConstant is used in Key Wrap with Padding. See
+// https://tools.ietf.org/html/rfc5649#section-3
+static const uint8_t kPaddingConstant[4] = {0xa6, 0x59, 0x59, 0xa6};
+
+int AES_wrap_key_padded(const AES_KEY *key, uint8_t *out, size_t *out_len,
+                        size_t max_out, const uint8_t *in, size_t in_len) {
+  // See https://tools.ietf.org/html/rfc5649#section-4.1
+  const uint64_t in_len64 = in_len;
+  const size_t padded_len = (in_len + 7) & ~7;
+  *out_len = 0;
+  if (in_len == 0 || in_len64 > 0xffffffffu || in_len + 7 < in_len ||
+      padded_len + 8 < padded_len || max_out < padded_len + 8) {
+    return 0;
+  }
+
+  uint8_t block[AES_BLOCK_SIZE];
+  memcpy(block, kPaddingConstant, sizeof(kPaddingConstant));
+  CRYPTO_store_u32_be(block + 4, (uint32_t)in_len);
+
+  if (in_len <= 8) {
+    memset(block + 8, 0, 8);
+    memcpy(block + 8, in, in_len);
+    BCM_aes_encrypt(block, out, key);
+    *out_len = AES_BLOCK_SIZE;
+    return 1;
+  }
+
+  uint8_t *padded_in = reinterpret_cast<uint8_t *>(OPENSSL_malloc(padded_len));
+  if (padded_in == nullptr) {
+    return 0;
+  }
+  assert(padded_len >= 8);
+  memset(padded_in + padded_len - 8, 0, 8);
+  memcpy(padded_in, in, in_len);
+  FIPS_service_indicator_lock_state();
+  const int ret = AES_wrap_key(key, block, out, padded_in, padded_len);
+  FIPS_service_indicator_unlock_state();
+  OPENSSL_free(padded_in);
+  if (ret < 0) {
+    return 0;
+  }
+  *out_len = ret;
+  FIPS_service_indicator_update_state();
+  return 1;
+}
+
+int AES_unwrap_key_padded(const AES_KEY *key, uint8_t *out, size_t *out_len,
+                          size_t max_out, const uint8_t *in, size_t in_len) {
+  *out_len = 0;
+  if (in_len < AES_BLOCK_SIZE || max_out < in_len - 8) {
+    return 0;
+  }
+
+  uint8_t iv[8];
+  if (in_len == AES_BLOCK_SIZE) {
+    uint8_t block[AES_BLOCK_SIZE];
+    BCM_aes_decrypt(in, block, key);
+    memcpy(iv, block, sizeof(iv));
+    memcpy(out, block + 8, 8);
+  } else if (!aes_unwrap_key_inner(key, out, iv, in, in_len)) {
+    return 0;
+  }
+  assert(in_len % 8 == 0);
+
+  crypto_word_t ok = constant_time_eq_int(
+      CRYPTO_memcmp(iv, kPaddingConstant, sizeof(kPaddingConstant)), 0);
+
+  const size_t claimed_len = CRYPTO_load_u32_be(iv + 4);
+  ok &= ~constant_time_is_zero_w(claimed_len);
+  ok &= constant_time_eq_w((claimed_len - 1) >> 3, (in_len - 9) >> 3);
+
+  // Check that padding bytes are all zero.
+  for (size_t i = in_len - 15; i < in_len - 8; i++) {
+    ok &= constant_time_is_zero_w(constant_time_ge_8(i, claimed_len) & out[i]);
+  }
+
+  *out_len = constant_time_select_w(ok, claimed_len, 0);
+  const int ret = ok & 1;
+  if (ret) {
+    FIPS_service_indicator_update_state();
+  }
+  return ret;
+}

package/runtime/third_party/boringssl/crypto/fipsmodule/aes/mode_wrappers.cc.inc

@@ -0,0 +1,97 @@
+// Copyright 2002-2016 The OpenSSL Project Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <openssl/aes.h>
+
+#include <assert.h>
+
+#include "../aes/internal.h"
+#include "../service_indicator/internal.h"
+
+
+using namespace bssl;
+
+namespace {
+void aes_encrypt(const uint8_t *in, uint8_t *out, const AES_KEY *key) {
+  BCM_aes_encrypt(in, out, key);
+}
+
+void aes_decrypt(const uint8_t *in, uint8_t *out, const AES_KEY *key) {
+  BCM_aes_decrypt(in, out, key);
+}
+}  // namespace
+
+void AES_ctr128_encrypt(const uint8_t *in, uint8_t *out, size_t len,
+                        const AES_KEY *key, uint8_t ivec[AES_BLOCK_SIZE],
+                        uint8_t ecount_buf[AES_BLOCK_SIZE], unsigned int *num) {
+  if (hwaes_capable()) {
+    CRYPTO_ctr128_encrypt_ctr32(in, out, len, key, ivec, ecount_buf, num,
+                                aes_hw_ctr32_encrypt_blocks);
+  } else if (vpaes_capable()) {
+    // TODO(davidben): On ARM, where `BSAES` is additionally defined, this could
+    // use `vpaes_ctr32_encrypt_blocks_with_bsaes`.
+    CRYPTO_ctr128_encrypt_ctr32(in, out, len, key, ivec, ecount_buf, num,
+                                vpaes_ctr32_encrypt_blocks);
+  } else {
+    CRYPTO_ctr128_encrypt_ctr32(in, out, len, key, ivec, ecount_buf, num,
+                                aes_nohw_ctr32_encrypt_blocks);
+  }
+
+  FIPS_service_indicator_update_state();
+}
+
+void AES_ecb_encrypt(const uint8_t *in, uint8_t *out, const AES_KEY *key,
+                     const int enc) {
+  assert(in && out && key);
+  assert((AES_ENCRYPT == enc) || (AES_DECRYPT == enc));
+
+  if (AES_ENCRYPT == enc) {
+    BCM_aes_encrypt(in, out, key);
+  } else {
+    BCM_aes_decrypt(in, out, key);
+  }
+
+  FIPS_service_indicator_update_state();
+}
+
+void AES_cbc_encrypt(const uint8_t *in, uint8_t *out, size_t len,
+                     const AES_KEY *key, uint8_t *ivec, const int enc) {
+  assert(len % AES_BLOCK_SIZE == 0);
+  if (hwaes_capable()) {
+    aes_hw_cbc_encrypt(in, out, len, key, ivec, enc);
+  } else if (!vpaes_capable()) {
+    aes_nohw_cbc_encrypt(in, out, len, key, ivec, enc);
+  } else if (enc) {
+    CRYPTO_cbc128_encrypt(in, out, len, key, ivec, aes_encrypt);
+  } else {
+    CRYPTO_cbc128_decrypt(in, out, len, key, ivec, aes_decrypt);
+  }
+
+  FIPS_service_indicator_update_state();
+}
+
+void AES_ofb128_encrypt(const uint8_t *in, uint8_t *out, size_t length,
+                        const AES_KEY *key, uint8_t *ivec, int *num) {
+  unsigned num_u = (unsigned)(*num);
+  CRYPTO_ofb128_encrypt(in, out, length, key, ivec, &num_u, aes_encrypt);
+  *num = (int)num_u;
+}
+
+void AES_cfb128_encrypt(const uint8_t *in, uint8_t *out, size_t length,
+                        const AES_KEY *key, uint8_t *ivec, int *num,
+                        int enc) {
+  unsigned num_u = (unsigned)(*num);
+  CRYPTO_cfb128_encrypt(in, out, length, key, ivec, &num_u, enc, aes_encrypt);
+  *num = (int)num_u;
+}

package/runtime/third_party/boringssl/crypto/fipsmodule/aes/ofb.cc.inc

@@ -0,0 +1,55 @@
+// Copyright 2008-2016 The OpenSSL Project Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <assert.h>
+#include <string.h>
+
+#include "internal.h"
+
+
+using namespace bssl;
+
+static_assert(16 % sizeof(size_t) == 0, "block cannot be divided into size_t");
+
+void bssl::CRYPTO_ofb128_encrypt(const uint8_t *in, uint8_t *out, size_t len,
+                                 const AES_KEY *key, uint8_t ivec[16],
+                                 unsigned *num, block128_f block) {
+  assert(key != nullptr && ivec != nullptr && num != nullptr);
+  assert(len == 0 || (in != nullptr && out != nullptr));
+
+  unsigned n = *num;
+
+  while (n && len) {
+    *(out++) = *(in++) ^ ivec[n];
+    --len;
+    n = (n + 1) % 16;
+  }
+
+  while (len >= 16) {
+    (*block)(ivec, ivec, key);
+    CRYPTO_xor16(out, in, ivec);
+    len -= 16;
+    out += 16;
+    in += 16;
+    n = 0;
+  }
+  if (len) {
+    (*block)(ivec, ivec, key);
+    while (len--) {
+      out[n] = in[n] ^ ivec[n];
+      ++n;
+    }
+  }
+  *num = n;
+}

package/runtime/third_party/boringssl/crypto/fipsmodule/bcm.cc

@@ -0,0 +1,288 @@
+// Copyright 2017 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#if !defined(_GNU_SOURCE)
+#define _GNU_SOURCE  // needed for syscall() on Linux.
+#endif
+
+#include <openssl/crypto.h>
+
+#include <stdlib.h>
+#if defined(BORINGSSL_FIPS)
+#include <sys/mman.h>
+#include <unistd.h>
+#endif
+
+#include <openssl/digest.h>
+#include <openssl/hmac.h>
+#include <openssl/sha2.h>
+#include <openssl/tls_prf.h>
+
+#include "../bcm_support.h"
+#include "../internal.h"
+#include "bcm_interface.h"
+
+// The .cc.inc files are not written as headers, but .cc files which we
+// currently need to combine together in the style of a unity or jumbo build.
+// -Wheader-hygiene interprets them as headers.
+//
+// TODO(crbug.com/362530616): When delocate is removed, build these files as
+// separate compilation units again.
+OPENSSL_CLANG_PRAGMA("clang diagnostic push")
+OPENSSL_CLANG_PRAGMA("clang diagnostic ignored \"-Wheader-hygiene\"")
+#include "aes/aes.cc.inc"
+#include "aes/aes_nohw.cc.inc"
+#include "aes/cbc.cc.inc"
+#include "aes/cfb.cc.inc"
+#include "aes/ctr.cc.inc"
+#include "aes/gcm.cc.inc"
+#include "aes/gcm_nohw.cc.inc"
+#include "aes/key_wrap.cc.inc"
+#include "aes/mode_wrappers.cc.inc"
+#include "aes/ofb.cc.inc"
+#include "bn/add.cc.inc"
+#include "bn/asm/x86_64-gcc.cc.inc"
+#include "bn/bn.cc.inc"
+#include "bn/bytes.cc.inc"
+#include "bn/cmp.cc.inc"
+#include "bn/ctx.cc.inc"
+#include "bn/div.cc.inc"
+#include "bn/div_extra.cc.inc"
+#include "bn/exponentiation.cc.inc"
+#include "bn/gcd.cc.inc"
+#include "bn/gcd_extra.cc.inc"
+#include "bn/generic.cc.inc"
+#include "bn/jacobi.cc.inc"
+#include "bn/montgomery.cc.inc"
+#include "bn/montgomery_inv.cc.inc"
+#include "bn/mul.cc.inc"
+#include "bn/prime.cc.inc"
+#include "bn/random.cc.inc"
+#include "bn/rsaz_exp.cc.inc"
+#include "bn/shift.cc.inc"
+#include "bn/sqrt.cc.inc"
+#include "cipher/aead.cc.inc"
+#include "cipher/cipher.cc.inc"
+#include "cipher/e_aes.cc.inc"
+#include "cipher/e_aesccm.cc.inc"
+#include "cmac/cmac.cc.inc"
+#include "dh/check.cc.inc"
+#include "dh/dh.cc.inc"
+#include "digest/digest.cc.inc"
+#include "digest/digests.cc.inc"
+#include "digestsign/digestsign.cc.inc"
+#include "ec/ec.cc.inc"
+#include "ec/ec_key.cc.inc"
+#include "ec/ec_montgomery.cc.inc"
+#include "ec/felem.cc.inc"
+#include "ec/oct.cc.inc"
+#include "ec/p256-nistz.cc.inc"
+#include "ec/p256.cc.inc"
+#include "ec/scalar.cc.inc"
+#include "ec/simple.cc.inc"
+#include "ec/simple_mul.cc.inc"
+#include "ec/util.cc.inc"
+#include "ec/wnaf.cc.inc"
+#include "ecdh/ecdh.cc.inc"
+#include "ecdsa/ecdsa.cc.inc"
+#include "entropy/jitter.cc.inc"
+#include "hkdf/hkdf.cc.inc"
+#include "hmac/hmac.cc.inc"
+#include "keccak/keccak.cc.inc"
+#include "mldsa/mldsa.cc.inc"
+#include "mlkem/mlkem.cc.inc"
+#include "rand/android_entropy_client.cc.inc"
+#include "rand/ctrdrbg.cc.inc"
+#include "rand/rand.cc.inc"
+#include "rsa/padding.cc.inc"
+#include "rsa/rsa.cc.inc"
+#include "rsa/rsa_impl.cc.inc"
+#include "self_check/fips.cc.inc"
+#include "self_check/self_check.cc.inc"
+#include "service_indicator/service_indicator.cc.inc"
+#include "sha/sha1.cc.inc"
+#include "sha/sha256.cc.inc"
+#include "sha/sha512.cc.inc"
+#include "slhdsa/fors.cc.inc"
+#include "slhdsa/merkle.cc.inc"
+#include "slhdsa/slhdsa.cc.inc"
+#include "slhdsa/thash.cc.inc"
+#include "slhdsa/wots.cc.inc"
+#include "tls/kdf.cc.inc"
+OPENSSL_CLANG_PRAGMA("clang diagnostic pop")
+
+
+using namespace bssl;
+
+#if defined(BORINGSSL_FIPS)
+
+#if !defined(OPENSSL_ASAN)
+
+// These symbols are filled in by delocate.go (in static builds) or a linker
+// script (in shared builds). They point to the start and end of the module, and
+// the location of the integrity hash, respectively.
+extern const uint8_t BORINGSSL_bcm_text_start[];
+extern const uint8_t BORINGSSL_bcm_text_end[];
+extern const uint8_t BORINGSSL_bcm_text_hash[SHA256_DIGEST_LENGTH];
+#if defined(BORINGSSL_SHARED_LIBRARY)
+extern const uint8_t BORINGSSL_bcm_rodata_start[];
+extern const uint8_t BORINGSSL_bcm_rodata_end[];
+#endif
+
+// assert_within is used to sanity check that certain symbols are within the
+// bounds of the integrity check. It checks that start <= symbol < end and
+// aborts otherwise.
+static void assert_within(const void *start, const void *symbol,
+                          const void *end) {
+  const uintptr_t start_val = (uintptr_t)start;
+  const uintptr_t symbol_val = (uintptr_t)symbol;
+  const uintptr_t end_val = (uintptr_t)end;
+
+  if (start_val <= symbol_val && symbol_val < end_val) {
+    return;
+  }
+
+  fprintf(CRYPTO_get_stderr(),
+          "FIPS module doesn't span expected symbol. Expected %p <= %p < %p\n",
+          start, symbol, end);
+  BORINGSSL_FIPS_abort();
+}
+
+#if defined(OPENSSL_ANDROID) && defined(OPENSSL_AARCH64)
+static void BORINGSSL_maybe_set_module_text_permissions(int permission) {
+  // Android may be compiled in execute-only-memory mode, in which case the
+  // .text segment cannot be read. That conflicts with the need for a FIPS
+  // module to hash its own contents, therefore `mprotect` is used to make
+  // the module's .text readable for the duration of the hashing process. In
+  // other build configurations this is a no-op.
+  const uintptr_t page_size = getpagesize();
+  const uintptr_t page_start =
+      ((uintptr_t)BORINGSSL_bcm_text_start) & ~(page_size - 1);
+
+  if (mprotect((void *)page_start,
+               ((uintptr_t)BORINGSSL_bcm_text_end) - page_start,
+               permission) != 0) {
+    perror("BoringSSL: mprotect");
+  }
+}
+#else
+static void BORINGSSL_maybe_set_module_text_permissions(int permission) {}
+#endif  // !ANDROID
+
+#endif  // !ASAN
+
+static void __attribute__((constructor)) BORINGSSL_bcm_power_on_self_test(
+    void) {
+#if !defined(OPENSSL_ASAN)
+  // Integrity tests cannot run under ASAN because it involves reading the full
+  // .text section, which triggers the global-buffer overflow detection.
+  if (!BORINGSSL_integrity_test()) {
+    goto err;
+  }
+#endif  // OPENSSL_ASAN
+
+  if (!boringssl_self_test_startup()) {
+    goto err;
+  }
+
+  return;
+
+err:
+  BORINGSSL_FIPS_abort();
+}
+
+#if !defined(OPENSSL_ASAN)
+int BORINGSSL_integrity_test() {
+  const uint8_t *const start = BORINGSSL_bcm_text_start;
+  const uint8_t *const end = BORINGSSL_bcm_text_end;
+
+  assert_within(start, reinterpret_cast<const void *>(BCM_aes_encrypt), end);
+  assert_within(start, reinterpret_cast<const void *>(RSA_sign), end);
+  assert_within(start, reinterpret_cast<const void *>(BCM_rand_bytes), end);
+  assert_within(start, reinterpret_cast<const void *>(EC_GROUP_cmp), end);
+  assert_within(start, reinterpret_cast<const void *>(BCM_sha256_update), end);
+  assert_within(start, reinterpret_cast<const void *>(ecdsa_verify_fixed), end);
+  assert_within(start, reinterpret_cast<const void *>(EVP_AEAD_CTX_seal), end);
+
+#if defined(BORINGSSL_SHARED_LIBRARY)
+  const uint8_t *const rodata_start = BORINGSSL_bcm_rodata_start;
+  const uint8_t *const rodata_end = BORINGSSL_bcm_rodata_end;
+#else
+  // In the static build, read-only data is placed within the .text segment.
+  const uint8_t *const rodata_start = BORINGSSL_bcm_text_start;
+  const uint8_t *const rodata_end = BORINGSSL_bcm_text_end;
+#endif
+
+  assert_within(rodata_start, kPrimes, rodata_end);
+  assert_within(rodata_start, kP256Field, rodata_end);
+  assert_within(rodata_start, kPKCS1SigPrefixes, rodata_end);
+
+  uint8_t result[SHA256_DIGEST_LENGTH];
+  if (!boringssl_self_test_sha256() || !boringssl_self_test_hmac_sha256()) {
+    return 0;
+  }
+
+  static const uint8_t kHMACKey[64] = {0};
+  unsigned result_len;
+  HMAC_CTX hmac_ctx;
+  HMAC_CTX_init(&hmac_ctx);
+  if (!HMAC_Init_ex(&hmac_ctx, kHMACKey, sizeof(kHMACKey), EVP_sha256(),
+                    nullptr /* no ENGINE */)) {
+    fprintf(CRYPTO_get_stderr(), "HMAC_Init_ex failed.\n");
+    return 0;
+  }
+
+  BORINGSSL_maybe_set_module_text_permissions(PROT_READ | PROT_EXEC);
+#if defined(BORINGSSL_SHARED_LIBRARY)
+  uint64_t length = end - start;
+  HMAC_Update(&hmac_ctx, (const uint8_t *)&length, sizeof(length));
+  HMAC_Update(&hmac_ctx, start, length);
+
+  length = rodata_end - rodata_start;
+  HMAC_Update(&hmac_ctx, (const uint8_t *)&length, sizeof(length));
+  HMAC_Update(&hmac_ctx, rodata_start, length);
+#else
+  HMAC_Update(&hmac_ctx, start, end - start);
+#endif
+  BORINGSSL_maybe_set_module_text_permissions(PROT_EXEC);
+
+  if (!HMAC_Final(&hmac_ctx, result, &result_len)) {
+    fprintf(CRYPTO_get_stderr(), "HMAC failed.\n");
+    return 0;
+  }
+  HMAC_CTX_cleanse(&hmac_ctx);  // FIPS 140-3, AS05.10.
+
+  if (!BORINGSSL_check_test(BORINGSSL_bcm_text_hash, Span(result, result_len),
+                            "FIPS integrity test")) {
+#if !defined(BORINGSSL_FIPS_BREAK_TESTS)
+    return 0;
+#endif
+  }
+
+  OPENSSL_cleanse(result, sizeof(result));  // FIPS 140-3, AS05.10.
+  return 1;
+}
+
+const uint8_t *FIPS_module_hash() { return BORINGSSL_bcm_text_hash; }
+
+#endif  // OPENSSL_ASAN
+
+void bssl::BORINGSSL_FIPS_abort() {
+  for (;;) {
+    abort();
+    exit(1);
+  }
+}
+
+#endif  // BORINGSSL_FIPS