external/boringssl: Sync to 73ffb74b9e36a93a3e593010a367a610105da9a1.

am: 73fa5d69f6

Change-Id: I13991e716458da77776e124a342d7981b44c5c36

12 files changed, 150 insertions, 45 deletions

diff --git a/BORINGSSL_REVISION b/BORINGSSL_REVISION
index 0bc058b2..145401b6 100644
--- a/BORINGSSL_REVISION
+++ b/BORINGSSL_REVISION
@@ -1 +1 @@
-392cedd0a28f15b693c81c8b877ee3d74c122d42
+73ffb74b9e36a93a3e593010a367a610105da9a1
diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index 43277f93..1814b13d 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -36,10 +36,26 @@ if (BORINGSSL_ALLOW_CXX_RUNTIME)
   add_definitions(-DBORINGSSL_ALLOW_CXX_RUNTIME)
 endif()
 
-if(CMAKE_COMPILER_IS_GNUCXX OR CMAKE_CXX_COMPILER_ID MATCHES "Clang")
-  set(C_CXX_FLAGS "-Wall -Werror -Wformat=2 -Wsign-compare -Wmissing-field-initializers -Wwrite-strings -ggdb -fvisibility=hidden -fno-common")
+if(CMAKE_CXX_COMPILER_ID MATCHES "Clang")
+  set(CLANG 1)
+endif()
+
+if(CMAKE_COMPILER_IS_GNUCXX OR CLANG)
+  # Note clang-cl is odd and sets both CLANG and MSVC. We base our configuration
+  # primarily on our normal Clang one because the MSVC one is mostly
+  # suppressions for an overaggressive -Wall.
+  set(C_CXX_FLAGS "-Wall -Werror -Wformat=2 -Wsign-compare -Wmissing-field-initializers -Wwrite-strings")
+  if(MSVC)
+    # clang-cl sets different default warnings than clang.
+    set(C_CXX_FLAGS "${C_CXX_FLAGS} -Wno-unused-parameter -fmsc-version=1900")
+    # googletest suppresses warning C4996 via a pragma, but clang-cl does not
+    # honor it. Suppress it here to compensate. See https://crbug.com/772117.
+    set(C_CXX_FLAGS "${C_CXX_FLAGS} -Wno-deprecated-declarations")
+  else()
+    set(C_CXX_FLAGS "${C_CXX_FLAGS} -ggdb -fvisibility=hidden -fno-common")
+  endif()
 
-  if(CMAKE_CXX_COMPILER_ID MATCHES "Clang")
+  if(CLANG)
     set(C_CXX_FLAGS "${C_CXX_FLAGS} -Wnewline-eof -fcolor-diagnostics")
   else()
     # GCC (at least 4.8.4) has a bug where it'll find unreachable free() calls
@@ -47,16 +63,18 @@ if(CMAKE_COMPILER_IS_GNUCXX OR CMAKE_CXX_COMPILER_ID MATCHES "Clang")
     set(C_CXX_FLAGS "${C_CXX_FLAGS} -Wno-free-nonheap-object")
   endif()
 
-  if(CMAKE_CXX_COMPILER_ID MATCHES "Clang" OR
-     NOT "7.0.0" VERSION_GREATER CMAKE_C_COMPILER_VERSION)
+  if(CLANG OR NOT "7.0.0" VERSION_GREATER CMAKE_C_COMPILER_VERSION)
     set(C_CXX_FLAGS "${C_CXX_FLAGS} -Wimplicit-fallthrough")
   endif()
 
   set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} ${C_CXX_FLAGS} -Wmissing-prototypes -Wold-style-definition -Wstrict-prototypes")
-  set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -std=c++11 ${C_CXX_FLAGS} -Wmissing-declarations")
+  set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} ${C_CXX_FLAGS} -Wmissing-declarations")
 
-  if(NOT BORINGSSL_ALLOW_CXX_RUNTIME)
-    set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -fno-exceptions -fno-rtti")
+  if(NOT MSVC)
+    set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -std=c++11")
+    if(NOT BORINGSSL_ALLOW_CXX_RUNTIME)
+      set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -fno-exceptions -fno-rtti")
+    endif()
   endif()
 
   # In GCC, -Wmissing-declarations is the C++ spelling of -Wmissing-prototypes
@@ -66,9 +84,14 @@ if(CMAKE_COMPILER_IS_GNUCXX OR CMAKE_CXX_COMPILER_ID MATCHES "Clang")
   # https://gcc.gnu.org/onlinedocs/gcc-7.1.0/gcc/Warning-Options.html#Warning-Options
   # https://clang.llvm.org/docs/DiagnosticsReference.html#wmissing-prototypes
   # https://clang.llvm.org/docs/DiagnosticsReference.html#wmissing-declarations
-  if(CMAKE_CXX_COMPILER_ID MATCHES "Clang")
+  if(CLANG)
     set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -Wmissing-prototypes")
   endif()
+
+  if(CMAKE_COMPILER_IS_GNUCXX AND "4.8" VERSION_GREATER CMAKE_C_COMPILER_VERSION)
+    set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wno-array-bounds")
+  endif()
+
 elseif(MSVC)
   set(MSVC_DISABLED_WARNINGS_LIST
       "C4061" # enumerator 'identifier' in switch of enum 'enumeration' is not
@@ -129,7 +152,6 @@ elseif(MSVC)
                             ${MSVC_LEVEL4_WARNINGS_LIST})
   set(CMAKE_C_FLAGS   "-Wall -WX ${MSVC_DISABLED_WARNINGS_STR} ${MSVC_LEVEL4_WARNINGS_STR}")
   set(CMAKE_CXX_FLAGS "-Wall -WX ${MSVC_DISABLED_WARNINGS_STR} ${MSVC_LEVEL4_WARNINGS_STR}")
-  set(CMAKE_ASM_NASM_FLAGS "-g cv8")
 endif()
 
 if(WIN32)
@@ -143,14 +165,13 @@ if(WIN32)
 endif()
 
 if((CMAKE_COMPILER_IS_GNUCXX AND CMAKE_C_COMPILER_VERSION VERSION_GREATER "4.7.99") OR
-   CMAKE_CXX_COMPILER_ID MATCHES "Clang")
+   CLANG)
   set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wshadow")
   set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -Wshadow")
 endif()
 
 if(CMAKE_COMPILER_IS_GNUCXX)
-  if ((CMAKE_C_COMPILER_VERSION VERSION_GREATER "4.8.99") OR
-      CMAKE_CXX_COMPILER_ID MATCHES "Clang")
+  if ((CMAKE_C_COMPILER_VERSION VERSION_GREATER "4.8.99") OR CLANG)
     set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -std=c11")
   else()
     set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -std=c99")
@@ -163,7 +184,7 @@ if(NOT WIN32)
 endif()
 
 if(FUZZ)
-  if(NOT CMAKE_CXX_COMPILER_ID MATCHES "Clang")
+  if(NOT CLANG)
     message(FATAL_ERROR "You need to build with Clang for fuzzing to work")
   endif()
 
@@ -191,7 +212,7 @@ if (BUILD_SHARED_LIBS)
 endif()
 
 if (MSAN)
-  if(NOT CMAKE_CXX_COMPILER_ID MATCHES "Clang")
+  if(NOT CLANG)
     message(FATAL_ERROR "Cannot enable MSAN unless using Clang")
   endif()
 
@@ -205,7 +226,7 @@ if (MSAN)
 endif()
 
 if (ASAN)
-  if(NOT CMAKE_CXX_COMPILER_ID MATCHES "Clang")
+  if(NOT CLANG)
     message(FATAL_ERROR "Cannot enable ASAN unless using Clang")
   endif()
 
diff --git a/src/crypto/CMakeLists.txt b/src/crypto/CMakeLists.txt
index 1cd84589..3266ea2e 100644
--- a/src/crypto/CMakeLists.txt
+++ b/src/crypto/CMakeLists.txt
@@ -53,6 +53,7 @@ if(NOT OPENSSL_NO_ASM)
       set(PERLASM_STYLE win32n)
       set(PERLASM_FLAGS "-DOPENSSL_IA32_SSE2")
     endif()
+    set(CMAKE_ASM_NASM_FLAGS "-g cv8")
 
     # On Windows, we use the NASM output, specifically built with Yasm.
     set(ASM_EXT asm)
diff --git a/src/include/openssl/base.h b/src/include/openssl/base.h
index aa65b4a1..adb5047a 100644
--- a/src/include/openssl/base.h
+++ b/src/include/openssl/base.h
@@ -180,7 +180,7 @@ extern "C" {
 #endif  // defined(BORINGSSL_SHARED_LIBRARY)
 
 
-#if defined(__GNUC__)
+#if defined(__GNUC__) || defined(__clang__)
 // MinGW has two different printf implementations. Ensure the format macro
 // matches the selected implementation. See
 // https://sourceforge.net/p/mingw-w64/wiki2/gnu%20printf/.
diff --git a/src/infra/config/cq.cfg b/src/infra/config/cq.cfg
index c657250b..e63026c1 100644
--- a/src/infra/config/cq.cfg
+++ b/src/infra/config/cq.cfg
@@ -53,7 +53,10 @@ verifiers {
       builders { name: "win64" }
       builders { name: "win64_rel" }
       builders { name: "win64_small" }
-
+      builders { name: "win32_vs2017_compile" }
+      builders { name: "win64_vs2017_compile" }
+      builders { name: "win32_clang_vs2017_compile" }
+      builders { name: "win64_clang_vs2017_compile" }
 
       builders { name: "linux_fips" }
       builders { name: "linux_fips_rel" }
diff --git a/src/ssl/test/runner/common.go b/src/ssl/test/runner/common.go
index 39918707..5bed9625 100644
--- a/src/ssl/test/runner/common.go
+++ b/src/ssl/test/runner/common.go
@@ -583,8 +583,8 @@ type ProtocolBugs struct {
 
 	// EarlyChangeCipherSpec causes the client to send an early
 	// ChangeCipherSpec message before the ClientKeyExchange. A value of
-	// zero disables this behavior. One and two configure variants for 0.9.8
-	// and 1.0.1 modes, respectively.
+	// zero disables this behavior. One and two configure variants for
+	// 1.0.1 and 0.9.8 modes, respectively.
 	EarlyChangeCipherSpec int
 
 	// StrayChangeCipherSpec causes every pre-ChangeCipherSpec handshake
diff --git a/src/ssl/test/runner/runner.go b/src/ssl/test/runner/runner.go
index 39a37658..5918e6b3 100644
--- a/src/ssl/test/runner/runner.go
+++ b/src/ssl/test/runner/runner.go
@@ -1145,21 +1145,27 @@ func runTest(test *testCase, shimPath string, mallocNumToFail int64) error {
 	listener.Close()
 	listener = nil
 
-	var shimKilledLock sync.Mutex
-	var shimKilled bool
-	waitTimeout := time.AfterFunc(*idleTimeout, func() {
+	var childErr error
+	if *useGDB {
+		childErr = <-waitChan
+	} else {
+		var shimKilledLock sync.Mutex
+		var shimKilled bool
+		waitTimeout := time.AfterFunc(*idleTimeout, func() {
+			shimKilledLock.Lock()
+			shimKilled = true
+			shimKilledLock.Unlock()
+			shim.Process.Kill()
+		})
+		childErr = <-waitChan
+		waitTimeout.Stop()
 		shimKilledLock.Lock()
-		shimKilled = true
+		if shimKilled && err == nil {
+			err = errors.New("timeout waiting for the shim to exit.")
+		}
 		shimKilledLock.Unlock()
-		shim.Process.Kill()
-	})
-	childErr := <-waitChan
-	waitTimeout.Stop()
-	shimKilledLock.Lock()
-	if shimKilled && err == nil {
-		err = errors.New("timeout waiting for the shim to exit.")
 	}
-	shimKilledLock.Unlock()
+
 	var isValgrindError bool
 	if exitError, ok := childErr.(*exec.ExitError); ok {
 		switch exitError.Sys().(syscall.WaitStatus).ExitStatus() {
diff --git a/src/tool/client.cc b/src/tool/client.cc
index d439860e..2ec381ff 100644
--- a/src/tool/client.cc
+++ b/src/tool/client.cc
@@ -196,7 +196,15 @@ static bool WaitForSession(SSL *ssl, int sock) {
   }
 
   while (!resume_session) {
+#if defined(OPENSSL_WINDOWS)
+    // Windows sockets are really of type SOCKET, not int, but everything here
+    // casts them to ints. Clang gets unhappy about signed values as a result.
+    //
+    // TODO(davidben): Keep everything as the appropriate platform type.
+    FD_SET(static_cast<SOCKET>(sock), &read_fds);
+#else
     FD_SET(sock, &read_fds);
+#endif
     int ret = select(sock + 1, &read_fds, NULL, NULL, NULL);
     if (ret <= 0) {
       perror("select");
diff --git a/src/tool/transport_common.cc b/src/tool/transport_common.cc
index 73f9e2d6..a7c2b36a 100644
--- a/src/tool/transport_common.cc
+++ b/src/tool/transport_common.cc
@@ -170,7 +170,14 @@ bool Listener::Init(const std::string &port) {
   OPENSSL_memset(&addr, 0, sizeof(addr));
 
   addr.sin6_family = AF_INET6;
+  // Windows' IN6ADDR_ANY_INIT does not have enough curly braces for clang-cl
+  // (https://crbug.com/772108), while other platforms like NaCl are missing
+  // in6addr_any, so use a mix of both.
+#if defined(OPENSSL_WINDOWS)
+  addr.sin6_addr = in6addr_any;
+#else
   addr.sin6_addr = IN6ADDR_ANY_INIT;
+#endif
   addr.sin6_port = htons(atoi(port.c_str()));
 
 #if defined(OPENSSL_WINDOWS)
diff --git a/src/util/bot/UPDATING b/src/util/bot/UPDATING
index 6b8b48e0..fee87493 100644
--- a/src/util/bot/UPDATING
+++ b/src/util/bot/UPDATING
@@ -12,11 +12,10 @@ update_clang.py: Set CLANG_REVISION and CLANG_SUB_REVISION to the values used in
     Chromium, found at
     https://chromium.googlesource.com/chromium/src/+/master/tools/clang/scripts/update.py
 
-vs_toolchain.py: Set the hash in TOOLCHAIN_HASH to the toolchain
-    used in Chromium, found at _GetDesiredVsToolchainHashes
+vs_toolchain.py: Update _GetDesiredVsToolchainHashes from Chromium, found at
     https://chromium.googlesource.com/chromium/src/+/master/build/vs_toolchain.py
-    This may require taking other updates to that file. If updating MSVS
-    version, also update TOOLCHAIN_VERSION accordingly.
+    This may require taking other updates to that file. (Don't remove MSVC
+    versions if BoringSSL still needs to support them.)
 
 The .sha1 files correspond to files downloaded from Google Cloud Storage. To
 update, place the updated files in their intended location and run:
diff --git a/src/util/bot/vs_toolchain.py b/src/util/bot/vs_toolchain.py
index 58d22980..cf7b5d0b 100644
--- a/src/util/bot/vs_toolchain.py
+++ b/src/util/bot/vs_toolchain.py
@@ -18,8 +18,8 @@ json_data_file = os.path.join(script_dir, 'win_toolchain.json')
 import gyp
 
 
-TOOLCHAIN_VERSION = '2015'
-TOOLCHAIN_HASH = 'f53e4598951162bad6330f7a167486c7ae5db1e5'
+# Use MSVS2015 as the default toolchain.
+CURRENT_DEFAULT_TOOLCHAIN_VERSION = '2015'
 
 
 def SetEnvironmentAndGetRuntimeDllDirs():
@@ -74,8 +74,22 @@ def FindDepotTools():
 
 
 def GetVisualStudioVersion():
-  """Return GYP_MSVS_VERSION of Visual Studio."""
-  return os.environ.get('GYP_MSVS_VERSION', TOOLCHAIN_VERSION)
+  """Return GYP_MSVS_VERSION of Visual Studio.
+  """
+  return os.environ.get('GYP_MSVS_VERSION', CURRENT_DEFAULT_TOOLCHAIN_VERSION)
+
+
+def _GetDesiredVsToolchainHashes():
+  """Load a list of SHA1s corresponding to the toolchains that we want installed
+  to build with."""
+  env_version = GetVisualStudioVersion()
+  if env_version == '2015':
+    # Update 3 final with 10.0.15063.468 SDK and no vctip.exe.
+    return ['f53e4598951162bad6330f7a167486c7ae5db1e5']
+  if env_version == '2017':
+    # VS 2017 Update 3.2 with 10.0.15063.468 SDK.
+    return ['9bc7ccbf9f4bd50d4a3bd185e8ca94ff1618de0b']
+  raise Exception('Unsupported VS version %s' % env_version)
 
 
 def Update():
@@ -89,14 +103,14 @@ def Update():
     depot_tools_path = FindDepotTools()
     # Necessary so that get_toolchain_if_necessary.py will put the VS toolkit
     # in the correct directory.
-    os.environ['GYP_MSVS_VERSION'] = TOOLCHAIN_VERSION
+    os.environ['GYP_MSVS_VERSION'] = GetVisualStudioVersion()
     get_toolchain_args = [
         sys.executable,
         os.path.join(depot_tools_path,
                     'win_toolchain',
                     'get_toolchain_if_necessary.py'),
-        '--output-json', json_data_file, TOOLCHAIN_HASH,
-      ]
+        '--output-json', json_data_file,
+      ] + _GetDesiredVsToolchainHashes()
     subprocess.check_call(get_toolchain_args)
 
   return 0
diff --git a/src/util/generate_build_files.py b/src/util/generate_build_files.py
index aaefa46a..da63ea98 100644
--- a/src/util/generate_build_files.py
+++ b/src/util/generate_build_files.py
@@ -236,6 +236,50 @@ class Bazel(object):
       self.PrintVariableSection(out, 'ssl_test_sources', files['ssl_test'])
 
 
+class Eureka(object):
+
+  def __init__(self):
+    self.header = \
+"""# Copyright (C) 2017 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# This file is created by generate_build_files.py. Do not edit manually.
+
+"""
+
+  def PrintVariableSection(self, out, name, files):
+    out.write('%s := \\\n' % name)
+    for f in sorted(files):
+      out.write('  %s\\\n' % f)
+    out.write('\n')
+
+  def WriteFiles(self, files, asm_outputs):
+    # Legacy Android.mk format
+    with open('eureka.mk', 'w+') as makefile:
+      makefile.write(self.header)
+
+      self.PrintVariableSection(makefile, 'crypto_sources', files['crypto'])
+      self.PrintVariableSection(makefile, 'ssl_sources', files['ssl'])
+      self.PrintVariableSection(makefile, 'tool_sources', files['tool'])
+
+      for ((osname, arch), asm_files) in asm_outputs:
+        if osname != 'linux':
+          continue
+        self.PrintVariableSection(
+            makefile, '%s_%s_sources' % (osname, arch), asm_files)
+
+
 class GN(object):
 
   def __init__(self):
@@ -632,7 +676,7 @@ def main(platforms):
 
 if __name__ == '__main__':
   parser = optparse.OptionParser(usage='Usage: %prog [--prefix=<path>]'
-      ' [android|bazel|gn|gyp]')
+      ' [android|bazel|eureka|gn|gyp]')
   parser.add_option('--prefix', dest='prefix',
       help='For Bazel, prepend argument to all source files')
   options, args = parser.parse_args(sys.argv[1:])
@@ -648,6 +692,8 @@ if __name__ == '__main__':
       platforms.append(Android())
     elif s == 'bazel':
       platforms.append(Bazel())
+    elif s == 'eureka':
+      platforms.append(Eureka())
     elif s == 'gn':
       platforms.append(GN())
     elif s == 'gyp':