update master-with-bazel from master branch

src/crypto/crypto.c

@@ -17,8 +17,8 @@
 #include <assert.h>
 #include <stdio.h>
 
-#include "fipsmodule/rand/internal.h"
 #include "bcm_support.h"
+#include "fipsmodule/rand/internal.h"
 #include "internal.h"
 
 
@@ -132,14 +132,6 @@ int CRYPTO_is_confidential_build(void) {
 #endif
 }
 
-int CRYPTO_has_asm(void) {
-#if defined(OPENSSL_NO_ASM)
-  return 0;
-#else
-  return 1;
-#endif
-}
-
 void CRYPTO_pre_sandbox_init(void) {
   // Read from /proc/cpuinfo if needed.
   OPENSSL_init_cpuid();

src/crypto/fipsmodule/self_check/fips.c.inc

@@ -30,6 +30,14 @@ int FIPS_mode_set(int on) { return on == FIPS_mode(); }
 
 const char *FIPS_module_name(void) { return "BoringCrypto"; }
 
+int CRYPTO_has_asm(void) {
+#if defined(OPENSSL_NO_ASM)
+  return 0;
+#else
+  return 1;
+#endif
+}
+
 uint32_t FIPS_version(void) {
   return 0;
 }

src/include/openssl/crypto.h

@@ -181,7 +181,7 @@ OPENSSL_EXPORT int FIPS_mode_set(int on);
 OPENSSL_EXPORT const char *FIPS_module_name(void);
 
 // FIPS_module_hash returns the 32-byte hash of the FIPS module.
-OPENSSL_EXPORT const uint8_t* FIPS_module_hash(void);
+OPENSSL_EXPORT const uint8_t *FIPS_module_hash(void);
 
 // FIPS_version returns the version of the FIPS module, or zero if the build
 // isn't exactly at a verified version. The version, expressed in base 10, will

src/util/fipstools/acvp/modulewrapper/main.cc

@@ -12,10 +12,11 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
 
+#include <inttypes.h>
 #include <stdio.h>
-#include <string>
 #include <string.h>
 #include <unistd.h>
+#include <string>
 
 #include <openssl/crypto.h>
 #include <openssl/span.h>
@@ -41,6 +42,34 @@ int main(int argc, char **argv) {
 #error "FIPS build not supported on this architecture"
 #endif
 
+    if (!FIPS_mode()) {
+      printf("Module not in FIPS mode\n");
+      abort();
+    }
+    printf("Module is in FIPS mode\n");
+
+    const uint32_t module_version = FIPS_version();
+    if (module_version == 0) {
+      printf("No module version set\n");
+      abort();
+    }
+    printf("Module: '%s', version: %" PRIu32 " hash:\n", FIPS_module_name(),
+           module_version);
+
+#if !defined(BORINGSSL_FIPS)
+    // |module_version| will be zero, so the non-FIPS build will never get
+    // this far.
+    printf("Non zero module version in non-FIPS build - should not happen!\n");
+    abort();
+#elif defined(OPENSSL_ASAN)
+    printf("(not available when compiled for ASAN)");
+#else
+    const uint8_t *module_hash = FIPS_module_hash();
+    for (size_t i = 0; i < SHA256_DIGEST_LENGTH; i++) {
+      printf("%02x", module_hash[i]);
+    }
+    printf("\n");
+#endif
     printf("Hardware acceleration enabled: %s\n",
            CRYPTO_has_asm() ? "yes" : "no");