external/boringssl: Sync to a93bc1124c00b1ac0a68ea5cb14b158d6c8366e1.

am: 927a49544e

Change-Id: I4f052a57397cd2b1dfc00eb4ce26e3044a3795c7

24 files changed, 306 insertions, 108 deletions

diff --git a/BORINGSSL_REVISION b/BORINGSSL_REVISION
index 5833838f..c0340b40 100644
--- a/BORINGSSL_REVISION
+++ b/BORINGSSL_REVISION
@@ -1 +1 @@
-3120950b1e27635ee9b9d167052ce11ce9c96fd4
+a93bc1124c00b1ac0a68ea5cb14b158d6c8366e1
diff --git a/ios-arm/crypto/chacha/chacha-armv4.S b/ios-arm/crypto/chacha/chacha-armv4.S
index ec3555de..8c61ca55 100644
--- a/ios-arm/crypto/chacha/chacha-armv4.S
+++ b/ios-arm/crypto/chacha/chacha-armv4.S
@@ -1,8 +1,10 @@
 #include <openssl/arm_arch.h>
 
 .text
-#if defined(__thumb2__)
+#if defined(__thumb2__) || defined(__clang__)
 .syntax	unified
+#endif
+#if defined(__thumb2__)
 .thumb
 #else
 .code	32
diff --git a/linux-arm/crypto/chacha/chacha-armv4.S b/linux-arm/crypto/chacha/chacha-armv4.S
index 0784fc71..6c947734 100644
--- a/linux-arm/crypto/chacha/chacha-armv4.S
+++ b/linux-arm/crypto/chacha/chacha-armv4.S
@@ -2,8 +2,10 @@
 #include <openssl/arm_arch.h>
 
 .text
-#if defined(__thumb2__)
+#if defined(__thumb2__) || defined(__clang__)
 .syntax	unified
+#endif
+#if defined(__thumb2__)
 .thumb
 #else
 .code	32
diff --git a/src/crypto/chacha/asm/chacha-armv4.pl b/src/crypto/chacha/asm/chacha-armv4.pl
index 200a41cb..a173939f 100755
--- a/src/crypto/chacha/asm/chacha-armv4.pl
+++ b/src/crypto/chacha/asm/chacha-armv4.pl
@@ -172,8 +172,10 @@ $code.=<<___;
 #include <openssl/arm_arch.h>
 
 .text
-#if defined(__thumb2__)
+#if defined(__thumb2__) || defined(__clang__)
 .syntax	unified
+#endif
+#if defined(__thumb2__)
 .thumb
 #else
 .code	32
diff --git a/src/crypto/cipher_extra/aead_test.cc b/src/crypto/cipher_extra/aead_test.cc
index e5e7761f..cce432c5 100644
--- a/src/crypto/cipher_extra/aead_test.cc
+++ b/src/crypto/cipher_extra/aead_test.cc
@@ -23,6 +23,7 @@
 #include <openssl/cipher.h>
 #include <openssl/err.h>
 
+#include "../fipsmodule/cipher/internal.h"
 #include "../internal.h"
 #include "../test/file_test.h"
 #include "../test/test_util.h"
@@ -208,6 +209,55 @@ TEST_P(PerAEADTest, TestVector) {
   });
 }
 
+TEST_P(PerAEADTest, TestExtraInput) {
+  const KnownAEAD &aead_config = GetParam();
+  if (!aead()->seal_scatter_supports_extra_in) {
+    return;
+  }
+
+  const std::string test_vectors =
+      "crypto/cipher_extra/test/" + std::string(aead_config.test_vectors);
+  FileTestGTest(test_vectors.c_str(), [&](FileTest *t) {
+    if (t->HasAttribute("NO_SEAL") ||
+        t->HasAttribute("FAILS")) {
+      t->SkipCurrent();
+      return;
+    }
+
+    std::vector<uint8_t> key, nonce, in, ad, ct, tag;
+    ASSERT_TRUE(t->GetBytes(&key, "KEY"));
+    ASSERT_TRUE(t->GetBytes(&nonce, "NONCE"));
+    ASSERT_TRUE(t->GetBytes(&in, "IN"));
+    ASSERT_TRUE(t->GetBytes(&ad, "AD"));
+    ASSERT_TRUE(t->GetBytes(&ct, "CT"));
+    ASSERT_TRUE(t->GetBytes(&tag, "TAG"));
+
+    bssl::ScopedEVP_AEAD_CTX ctx;
+    ASSERT_TRUE(EVP_AEAD_CTX_init(ctx.get(), aead(), key.data(), key.size(),
+                                  tag.size(), nullptr));
+    std::vector<uint8_t> out_tag(EVP_AEAD_max_overhead(aead()) + in.size());
+    std::vector<uint8_t> out(in.size());
+
+    for (size_t extra_in_size = 0; extra_in_size < in.size(); extra_in_size++) {
+      size_t tag_bytes_written;
+      ASSERT_TRUE(EVP_AEAD_CTX_seal_scatter(
+          ctx.get(), out.data(), out_tag.data(), &tag_bytes_written,
+          out_tag.size(), nonce.data(), nonce.size(), in.data(),
+          in.size() - extra_in_size, in.data() + in.size() - extra_in_size,
+          extra_in_size, ad.data(), ad.size()));
+
+      ASSERT_EQ(tag_bytes_written, extra_in_size + tag.size());
+
+      memcpy(out.data() + in.size() - extra_in_size, out_tag.data(),
+             extra_in_size);
+
+      EXPECT_EQ(Bytes(ct), Bytes(out.data(), in.size()));
+      EXPECT_EQ(Bytes(tag), Bytes(out_tag.data() + extra_in_size,
+                                  tag_bytes_written - extra_in_size));
+    }
+  });
+}
+
 TEST_P(PerAEADTest, TestVectorScatterGather) {
   std::string test_vectors = "crypto/cipher_extra/test/";
   const KnownAEAD &aead_config = GetParam();
@@ -240,8 +290,8 @@ TEST_P(PerAEADTest, TestVectorScatterGather) {
       size_t out_tag_len;
       ASSERT_TRUE(EVP_AEAD_CTX_seal_scatter(
           ctx.get(), out.data(), out_tag.data(), &out_tag_len, out_tag.size(),
-          nonce.data(), nonce.size(), in.data(), in.size(), ad.data(),
-          ad.size()));
+          nonce.data(), nonce.size(), in.data(), in.size(), nullptr, 0,
+          ad.data(), ad.size()));
       out_tag.resize(out_tag_len);
 
       ASSERT_EQ(out.size(), ct.size());
@@ -271,7 +321,7 @@ TEST_P(PerAEADTest, TestVectorScatterGather) {
       int err = ERR_peek_error();
       if (ERR_GET_LIB(err) == ERR_LIB_CIPHER &&
           ERR_GET_REASON(err) == CIPHER_R_CTRL_NOT_IMPLEMENTED) {
-          (void)t->HasAttribute("FAILS");  // All attributes need to be used.
+          t->SkipCurrent();
           return;
         }
     }
diff --git a/src/crypto/cipher_extra/e_aesctrhmac.c b/src/crypto/cipher_extra/e_aesctrhmac.c
index dbe9f062..2982d0de 100644
--- a/src/crypto/cipher_extra/e_aesctrhmac.c
+++ b/src/crypto/cipher_extra/e_aesctrhmac.c
@@ -178,8 +178,8 @@ static void aead_aes_ctr_hmac_sha256_crypt(
 static int aead_aes_ctr_hmac_sha256_seal_scatter(
     const EVP_AEAD_CTX *ctx, uint8_t *out, uint8_t *out_tag,
     size_t *out_tag_len, size_t max_out_tag_len, const uint8_t *nonce,
-    size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *ad,
-    size_t ad_len) {
+    size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *extra_in,
+    size_t extra_in_len, const uint8_t *ad, size_t ad_len) {
   const struct aead_aes_ctr_hmac_sha256_ctx *aes_ctx = ctx->aead_state;
   const uint64_t in_len_64 = in_len;
 
@@ -242,9 +242,10 @@ static int aead_aes_ctr_hmac_sha256_open_gather(
 
 static const EVP_AEAD aead_aes_128_ctr_hmac_sha256 = {
     16 /* AES key */ + 32 /* HMAC key */,
-    12,                                       /* nonce length */
-    EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN,     /* overhead */
-    EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN,     /* max tag length */
+    12,                                   /* nonce length */
+    EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN, /* overhead */
+    EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN, /* max tag length */
+    0,                                    /* seal_scatter_supports_extra_in */
 
     aead_aes_ctr_hmac_sha256_init,
     NULL /* init_with_direction */,
@@ -257,9 +258,10 @@ static const EVP_AEAD aead_aes_128_ctr_hmac_sha256 = {
 
 static const EVP_AEAD aead_aes_256_ctr_hmac_sha256 = {
     32 /* AES key */ + 32 /* HMAC key */,
-    12,                                       /* nonce length */
-    EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN,     /* overhead */
-    EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN,     /* max tag length */
+    12,                                   /* nonce length */
+    EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN, /* overhead */
+    EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN, /* max tag length */
+    0,                                    /* seal_scatter_supports_extra_in */
 
     aead_aes_ctr_hmac_sha256_init,
     NULL /* init_with_direction */,
diff --git a/src/crypto/cipher_extra/e_aesgcmsiv.c b/src/crypto/cipher_extra/e_aesgcmsiv.c
index 3a1ec47a..190a1b96 100644
--- a/src/crypto/cipher_extra/e_aesgcmsiv.c
+++ b/src/crypto/cipher_extra/e_aesgcmsiv.c
@@ -322,8 +322,8 @@ static void aead_aes_gcm_siv_kdf(
 static int aead_aes_gcm_siv_asm_seal_scatter(
     const EVP_AEAD_CTX *ctx, uint8_t *out, uint8_t *out_tag,
     size_t *out_tag_len, size_t max_out_tag_len, const uint8_t *nonce,
-    size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *ad,
-    size_t ad_len) {
+    size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *extra_in,
+    size_t extra_in_len, const uint8_t *ad, size_t ad_len) {
   const struct aead_aes_gcm_siv_asm_ctx *gcm_siv_ctx = ctx->aead_state;
   const uint64_t in_len_64 = in_len;
   const uint64_t ad_len_64 = ad_len;
@@ -505,6 +505,7 @@ static const EVP_AEAD aead_aes_128_gcm_siv_asm = {
     EVP_AEAD_AES_GCM_SIV_NONCE_LEN, /* nonce length */
     EVP_AEAD_AES_GCM_SIV_TAG_LEN,   /* overhead */
     EVP_AEAD_AES_GCM_SIV_TAG_LEN,   /* max tag length */
+    0,                              /* seal_scatter_supports_extra_in */
 
     aead_aes_gcm_siv_asm_init,
     NULL /* init_with_direction */,
@@ -520,6 +521,7 @@ static const EVP_AEAD aead_aes_256_gcm_siv_asm = {
     EVP_AEAD_AES_GCM_SIV_NONCE_LEN, /* nonce length */
     EVP_AEAD_AES_GCM_SIV_TAG_LEN,   /* overhead */
     EVP_AEAD_AES_GCM_SIV_TAG_LEN,   /* max tag length */
+    0,                              /* seal_scatter_supports_extra_in */
 
     aead_aes_gcm_siv_asm_init,
     NULL /* init_with_direction */,
@@ -698,12 +700,11 @@ static void gcm_siv_keys(
                   key_material + 16, gcm_siv_ctx->is_256 ? 32 : 16);
 }
 
-static int aead_aes_gcm_siv_seal_scatter(const EVP_AEAD_CTX *ctx, uint8_t *out,
-                                         uint8_t *out_tag, size_t *out_tag_len,
-                                         size_t max_out_tag_len,
-                                         const uint8_t *nonce, size_t nonce_len,
-                                         const uint8_t *in, size_t in_len,
-                                         const uint8_t *ad, size_t ad_len) {
+static int aead_aes_gcm_siv_seal_scatter(
+    const EVP_AEAD_CTX *ctx, uint8_t *out, uint8_t *out_tag,
+    size_t *out_tag_len, size_t max_out_tag_len, const uint8_t *nonce,
+    size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *extra_in,
+    size_t extra_in_len, const uint8_t *ad, size_t ad_len) {
   const struct aead_aes_gcm_siv_ctx *gcm_siv_ctx = ctx->aead_state;
   const uint64_t in_len_64 = in_len;
   const uint64_t ad_len_64 = ad_len;
@@ -788,6 +789,7 @@ static const EVP_AEAD aead_aes_128_gcm_siv = {
     EVP_AEAD_AES_GCM_SIV_NONCE_LEN, /* nonce length */
     EVP_AEAD_AES_GCM_SIV_TAG_LEN,   /* overhead */
     EVP_AEAD_AES_GCM_SIV_TAG_LEN,   /* max tag length */
+    0,                              /* seal_scatter_supports_extra_in */
 
     aead_aes_gcm_siv_init,
     NULL /* init_with_direction */,
@@ -803,6 +805,7 @@ static const EVP_AEAD aead_aes_256_gcm_siv = {
     EVP_AEAD_AES_GCM_SIV_NONCE_LEN, /* nonce length */
     EVP_AEAD_AES_GCM_SIV_TAG_LEN,   /* overhead */
     EVP_AEAD_AES_GCM_SIV_TAG_LEN,   /* max tag length */
+    0,                              /* seal_scatter_supports_extra_in */
 
     aead_aes_gcm_siv_init,
     NULL /* init_with_direction */,
diff --git a/src/crypto/cipher_extra/e_chacha20poly1305.c b/src/crypto/cipher_extra/e_chacha20poly1305.c
index c433053e..6cfc856c 100644
--- a/src/crypto/cipher_extra/e_chacha20poly1305.c
+++ b/src/crypto/cipher_extra/e_chacha20poly1305.c
@@ -157,8 +157,8 @@ static void calc_tag(uint8_t tag[POLY1305_TAG_LEN],
 static int aead_chacha20_poly1305_seal_scatter(
     const EVP_AEAD_CTX *ctx, uint8_t *out, uint8_t *out_tag,
     size_t *out_tag_len, size_t max_out_tag_len, const uint8_t *nonce,
-    size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *ad,
-    size_t ad_len) {
+    size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *extra_in,
+    size_t extra_in_len, const uint8_t *ad, size_t ad_len) {
   const struct aead_chacha20_poly1305_ctx *c20_ctx = ctx->aead_state;
 
   if (nonce_len != 12) {
@@ -249,17 +249,19 @@ static int aead_chacha20_poly1305_open_gather(
 }
 
 static const EVP_AEAD aead_chacha20_poly1305 = {
-    32,                 /* key len */
-    12,                 /* nonce len */
-    POLY1305_TAG_LEN,   /* overhead */
-    POLY1305_TAG_LEN,   /* max tag length */
+    32,               /* key len */
+    12,               /* nonce len */
+    POLY1305_TAG_LEN, /* overhead */
+    POLY1305_TAG_LEN, /* max tag length */
+    0,                /* seal_scatter_supports_extra_in */
+
     aead_chacha20_poly1305_init,
     NULL, /* init_with_direction */
     aead_chacha20_poly1305_cleanup,
     NULL /* open */,
     aead_chacha20_poly1305_seal_scatter,
     aead_chacha20_poly1305_open_gather,
-    NULL,               /* get_iv */
+    NULL, /* get_iv */
 };
 
 const EVP_AEAD *EVP_aead_chacha20_poly1305(void) {
diff --git a/src/crypto/cipher_extra/e_ssl3.c b/src/crypto/cipher_extra/e_ssl3.c
index 7af9a58c..f2eb357c 100644
--- a/src/crypto/cipher_extra/e_ssl3.c
+++ b/src/crypto/cipher_extra/e_ssl3.c
@@ -127,7 +127,8 @@ static int aead_ssl3_seal_scatter(const EVP_AEAD_CTX *ctx, uint8_t *out,
                                   uint8_t *out_tag, size_t *out_tag_len,
                                   size_t max_out_tag_len, const uint8_t *nonce,
                                   size_t nonce_len, const uint8_t *in,
-                                  size_t in_len, const uint8_t *ad,
+                                  size_t in_len, const uint8_t *extra_in,
+                                  size_t extra_in_len, const uint8_t *ad,
                                   size_t ad_len) {
   AEAD_SSL3_CTX *ssl3_ctx = (AEAD_SSL3_CTX *)ctx->aead_state;
 
@@ -362,6 +363,8 @@ static const EVP_AEAD aead_aes_128_cbc_sha1_ssl3 = {
     0,                           /* nonce len */
     16 + SHA_DIGEST_LENGTH,      /* overhead (padding + SHA1) */
     SHA_DIGEST_LENGTH,           /* max tag length */
+    0,                           /* seal_scatter_supports_extra_in */
+
     NULL, /* init */
     aead_aes_128_cbc_sha1_ssl3_init,
     aead_ssl3_cleanup,
@@ -376,6 +379,8 @@ static const EVP_AEAD aead_aes_256_cbc_sha1_ssl3 = {
     0,                           /* nonce len */
     16 + SHA_DIGEST_LENGTH,      /* overhead (padding + SHA1) */
     SHA_DIGEST_LENGTH,           /* max tag length */
+    0,                           /* seal_scatter_supports_extra_in */
+
     NULL, /* init */
     aead_aes_256_cbc_sha1_ssl3_init,
     aead_ssl3_cleanup,
@@ -390,6 +395,8 @@ static const EVP_AEAD aead_des_ede3_cbc_sha1_ssl3 = {
     0,                          /* nonce len */
     8 + SHA_DIGEST_LENGTH,      /* overhead (padding + SHA1) */
     SHA_DIGEST_LENGTH,          /* max tag length */
+    0,                          /* seal_scatter_supports_extra_in */
+
     NULL, /* init */
     aead_des_ede3_cbc_sha1_ssl3_init,
     aead_ssl3_cleanup,
@@ -400,11 +407,13 @@ static const EVP_AEAD aead_des_ede3_cbc_sha1_ssl3 = {
 };
 
 static const EVP_AEAD aead_null_sha1_ssl3 = {
-    SHA_DIGEST_LENGTH,          /* key len */
-    0,                          /* nonce len */
-    SHA_DIGEST_LENGTH,          /* overhead (SHA1) */
-    SHA_DIGEST_LENGTH,          /* max tag length */
-    NULL,                       /* init */
+    SHA_DIGEST_LENGTH, /* key len */
+    0,                 /* nonce len */
+    SHA_DIGEST_LENGTH, /* overhead (SHA1) */
+    SHA_DIGEST_LENGTH, /* max tag length */
+    0,                 /* seal_scatter_supports_extra_in */
+
+    NULL, /* init */
     aead_null_sha1_ssl3_init,
     aead_ssl3_cleanup,
     aead_ssl3_open,
diff --git a/src/crypto/cipher_extra/e_tls.c b/src/crypto/cipher_extra/e_tls.c
index bf4f2e4a..14d53771 100644
--- a/src/crypto/cipher_extra/e_tls.c
+++ b/src/crypto/cipher_extra/e_tls.c
@@ -103,7 +103,8 @@ static int aead_tls_seal_scatter(const EVP_AEAD_CTX *ctx, uint8_t *out,
                                  uint8_t *out_tag, size_t *out_tag_len,
                                  size_t max_out_tag_len, const uint8_t *nonce,
                                  size_t nonce_len, const uint8_t *in,
-                                 size_t in_len, const uint8_t *ad,
+                                 size_t in_len, const uint8_t *extra_in,
+                                 size_t extra_in_len, const uint8_t *ad,
                                  size_t ad_len) {
   AEAD_TLS_CTX *tls_ctx = (AEAD_TLS_CTX *)ctx->aead_state;
 
@@ -457,7 +458,9 @@ static const EVP_AEAD aead_aes_128_cbc_sha1_tls = {
     16,                     /* nonce len (IV) */
     16 + SHA_DIGEST_LENGTH, /* overhead (padding + SHA1) */
     SHA_DIGEST_LENGTH,      /* max tag length */
-    NULL,                   /* init */
+    0,                      /* seal_scatter_supports_extra_in */
+
+    NULL, /* init */
     aead_aes_128_cbc_sha1_tls_init,
     aead_tls_cleanup,
     aead_tls_open,
@@ -471,7 +474,9 @@ static const EVP_AEAD aead_aes_128_cbc_sha1_tls_implicit_iv = {
     0,                           /* nonce len */
     16 + SHA_DIGEST_LENGTH,      /* overhead (padding + SHA1) */
     SHA_DIGEST_LENGTH,           /* max tag length */
-    NULL,                        /* init */
+    0,                           /* seal_scatter_supports_extra_in */
+
+    NULL, /* init */
     aead_aes_128_cbc_sha1_tls_implicit_iv_init,
     aead_tls_cleanup,
     aead_tls_open,
@@ -485,7 +490,9 @@ static const EVP_AEAD aead_aes_128_cbc_sha256_tls = {
     16,                        /* nonce len (IV) */
     16 + SHA256_DIGEST_LENGTH, /* overhead (padding + SHA256) */
     SHA256_DIGEST_LENGTH,      /* max tag length */
-    NULL,                      /* init */
+    0,                         /* seal_scatter_supports_extra_in */
+
+    NULL, /* init */
     aead_aes_128_cbc_sha256_tls_init,
     aead_tls_cleanup,
     aead_tls_open,
@@ -499,7 +506,9 @@ static const EVP_AEAD aead_aes_256_cbc_sha1_tls = {
     16,                     /* nonce len (IV) */
     16 + SHA_DIGEST_LENGTH, /* overhead (padding + SHA1) */
     SHA_DIGEST_LENGTH,      /* max tag length */
-    NULL,                   /* init */
+    0,                      /* seal_scatter_supports_extra_in */
+
+    NULL, /* init */
     aead_aes_256_cbc_sha1_tls_init,
     aead_tls_cleanup,
     aead_tls_open,
@@ -513,7 +522,9 @@ static const EVP_AEAD aead_aes_256_cbc_sha1_tls_implicit_iv = {
     0,                           /* nonce len */
     16 + SHA_DIGEST_LENGTH,      /* overhead (padding + SHA1) */
     SHA_DIGEST_LENGTH,           /* max tag length */
-    NULL,                        /* init */
+    0,                           /* seal_scatter_supports_extra_in */
+
+    NULL, /* init */
     aead_aes_256_cbc_sha1_tls_implicit_iv_init,
     aead_tls_cleanup,
     aead_tls_open,
@@ -527,7 +538,9 @@ static const EVP_AEAD aead_aes_256_cbc_sha256_tls = {
     16,                        /* nonce len (IV) */
     16 + SHA256_DIGEST_LENGTH, /* overhead (padding + SHA256) */
     SHA256_DIGEST_LENGTH,      /* max tag length */
-    NULL,                      /* init */
+    0,                         /* seal_scatter_supports_extra_in */
+
+    NULL, /* init */
     aead_aes_256_cbc_sha256_tls_init,
     aead_tls_cleanup,
     aead_tls_open,
@@ -541,7 +554,9 @@ static const EVP_AEAD aead_aes_256_cbc_sha384_tls = {
     16,                        /* nonce len (IV) */
     16 + SHA384_DIGEST_LENGTH, /* overhead (padding + SHA384) */
     SHA384_DIGEST_LENGTH,      /* max tag length */
-    NULL,                      /* init */
+    0,                         /* seal_scatter_supports_extra_in */
+
+    NULL, /* init */
     aead_aes_256_cbc_sha384_tls_init,
     aead_tls_cleanup,
     aead_tls_open,
@@ -555,7 +570,9 @@ static const EVP_AEAD aead_des_ede3_cbc_sha1_tls = {
     8,                      /* nonce len (IV) */
     8 + SHA_DIGEST_LENGTH,  /* overhead (padding + SHA1) */
     SHA_DIGEST_LENGTH,      /* max tag length */
-    NULL,                   /* init */
+    0,                      /* seal_scatter_supports_extra_in */
+
+    NULL, /* init */
     aead_des_ede3_cbc_sha1_tls_init,
     aead_tls_cleanup,
     aead_tls_open,
@@ -569,7 +586,9 @@ static const EVP_AEAD aead_des_ede3_cbc_sha1_tls_implicit_iv = {
     0,                          /* nonce len */
     8 + SHA_DIGEST_LENGTH,      /* overhead (padding + SHA1) */
     SHA_DIGEST_LENGTH,          /* max tag length */
-    NULL,                       /* init */
+    0,                          /* seal_scatter_supports_extra_in */
+
+    NULL, /* init */
     aead_des_ede3_cbc_sha1_tls_implicit_iv_init,
     aead_tls_cleanup,
     aead_tls_open,
@@ -583,7 +602,9 @@ static const EVP_AEAD aead_null_sha1_tls = {
     0,                 /* nonce len */
     SHA_DIGEST_LENGTH, /* overhead (SHA1) */
     SHA_DIGEST_LENGTH, /* max tag length */
-    NULL,              /* init */
+    0,                 /* seal_scatter_supports_extra_in */
+
+    NULL, /* init */
     aead_null_sha1_tls_init,
     aead_tls_cleanup,
     aead_tls_open,
diff --git a/src/crypto/fipsmodule/cipher/aead.c b/src/crypto/fipsmodule/cipher/aead.c
index a44889f9..79139e60 100644
--- a/src/crypto/fipsmodule/cipher/aead.c
+++ b/src/crypto/fipsmodule/cipher/aead.c
@@ -134,7 +134,7 @@ int EVP_AEAD_CTX_seal(const EVP_AEAD_CTX *ctx, uint8_t *out, size_t *out_len,
   size_t out_tag_len;
   if (ctx->aead->seal_scatter(ctx, out, out + in_len, &out_tag_len,
                               max_out_len - in_len, nonce, nonce_len, in,
-                              in_len, ad, ad_len)) {
+                              in_len, NULL, 0, ad, ad_len)) {
     *out_len = in_len + out_tag_len;
     return 1;
   }
@@ -148,10 +148,10 @@ error:
 }
 
 int EVP_AEAD_CTX_seal_scatter(
-    const EVP_AEAD_CTX *ctx, uint8_t *out, uint8_t *out_tag,
-    size_t *out_tag_len, size_t max_out_tag_len, const uint8_t *nonce,
-    size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *ad,
-    size_t ad_len) {
+    const EVP_AEAD_CTX *ctx, uint8_t *out, uint8_t *out_tag, size_t
+    *out_tag_len, size_t max_out_tag_len, const uint8_t *nonce, size_t
+    nonce_len, const uint8_t *in, size_t in_len, const uint8_t *extra_in,
+    size_t extra_in_len, const uint8_t *ad, size_t ad_len) {
   // |in| and |out| may alias exactly, |out_tag| may not alias.
   if (!check_alias(in, in_len, out, in_len) ||
       buffers_alias(out, in_len, out_tag, max_out_tag_len) ||
@@ -160,8 +160,14 @@ int EVP_AEAD_CTX_seal_scatter(
     goto error;
   }
 
+  if (!ctx->aead->seal_scatter_supports_extra_in && extra_in_len) {
+    OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_INVALID_OPERATION);
+    goto error;
+  }
+
   if (ctx->aead->seal_scatter(ctx, out, out_tag, out_tag_len, max_out_tag_len,
-                              nonce, nonce_len, in, in_len, ad, ad_len)) {
+                              nonce, nonce_len, in, in_len, extra_in,
+                              extra_in_len, ad, ad_len)) {
     return 1;
   }
 
diff --git a/src/crypto/fipsmodule/cipher/e_aes.c b/src/crypto/fipsmodule/cipher/e_aes.c
index 5556ff35..7c7521b4 100644
--- a/src/crypto/fipsmodule/cipher/e_aes.c
+++ b/src/crypto/fipsmodule/cipher/e_aes.c
@@ -1144,7 +1144,6 @@ struct aead_aes_gcm_ctx {
   } ks;
   GCM128_CONTEXT gcm;
   ctr128_f ctr;
-  uint8_t tag_len;
 };
 
 struct aead_aes_gcm_tls12_ctx {
@@ -1153,8 +1152,8 @@ struct aead_aes_gcm_tls12_ctx {
 };
 
 static int aead_aes_gcm_init_impl(struct aead_aes_gcm_ctx *gcm_ctx,
-                                  const uint8_t *key, size_t key_len,
-                                  size_t tag_len) {
+                                  size_t *out_tag_len, const uint8_t *key,
+                                  size_t key_len, size_t tag_len) {
   const size_t key_bits = key_len * 8;
 
   if (key_bits != 128 && key_bits != 256) {
@@ -1173,25 +1172,27 @@ static int aead_aes_gcm_init_impl(struct aead_aes_gcm_ctx *gcm_ctx,
 
   gcm_ctx->ctr =
       aes_ctr_set_key(&gcm_ctx->ks.ks, &gcm_ctx->gcm, NULL, key, key_len);
-  gcm_ctx->tag_len = tag_len;
+  *out_tag_len = tag_len;
   return 1;
 }
 
 static int aead_aes_gcm_init(EVP_AEAD_CTX *ctx, const uint8_t *key,
-                             size_t key_len, size_t tag_len) {
+                             size_t key_len, size_t requested_tag_len) {
   struct aead_aes_gcm_ctx *gcm_ctx;
   gcm_ctx = OPENSSL_malloc(sizeof(struct aead_aes_gcm_ctx));
   if (gcm_ctx == NULL) {
     return 0;
   }
 
-  if (!aead_aes_gcm_init_impl(gcm_ctx, key, key_len, tag_len)) {
+  size_t actual_tag_len;
+  if (!aead_aes_gcm_init_impl(gcm_ctx, &actual_tag_len, key, key_len,
+                              requested_tag_len)) {
     OPENSSL_free(gcm_ctx);
     return 0;
   }
 
   ctx->aead_state = gcm_ctx;
-  ctx->tag_len = gcm_ctx->tag_len;
+  ctx->tag_len = actual_tag_len;
   return 1;
 }
 
@@ -1206,16 +1207,26 @@ static int aead_aes_gcm_seal_scatter(const EVP_AEAD_CTX *ctx, uint8_t *out,
                                      size_t max_out_tag_len,
                                      const uint8_t *nonce, size_t nonce_len,
                                      const uint8_t *in, size_t in_len,
+                                     const uint8_t *extra_in,
+                                     size_t extra_in_len,
                                      const uint8_t *ad, size_t ad_len) {
   const struct aead_aes_gcm_ctx *gcm_ctx = ctx->aead_state;
   GCM128_CONTEXT gcm;
 
+  if (extra_in_len + ctx->tag_len < ctx->tag_len) {
+    OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_TOO_LARGE);
+    return 0;
+  }
+  if (max_out_tag_len < ctx->tag_len + extra_in_len) {
+    OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BUFFER_TOO_SMALL);
+    return 0;
+  }
   if (nonce_len == 0) {
     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_INVALID_NONCE_SIZE);
     return 0;
   }
 
-  if (max_out_tag_len < gcm_ctx->tag_len) {
+  if (max_out_tag_len < ctx->tag_len) {
     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BUFFER_TOO_SMALL);
     return 0;
   }
@@ -1240,8 +1251,22 @@ static int aead_aes_gcm_seal_scatter(const EVP_AEAD_CTX *ctx, uint8_t *out,
     }
   }
 
-  CRYPTO_gcm128_tag(&gcm, out_tag, gcm_ctx->tag_len);
-  *out_tag_len = gcm_ctx->tag_len;
+  if (extra_in_len) {
+    if (gcm_ctx->ctr) {
+      if (!CRYPTO_gcm128_encrypt_ctr32(&gcm, key, extra_in, out_tag,
+                                       extra_in_len, gcm_ctx->ctr)) {
+        return 0;
+      }
+    } else {
+      if (!CRYPTO_gcm128_encrypt(&gcm, key, extra_in, out_tag, extra_in_len)) {
+        return 0;
+      }
+    }
+  }
+
+  CRYPTO_gcm128_tag(&gcm, out_tag + extra_in_len, ctx->tag_len);
+  *out_tag_len = ctx->tag_len + extra_in_len;
+
   return 1;
 }
 
@@ -1259,7 +1284,7 @@ static int aead_aes_gcm_open_gather(const EVP_AEAD_CTX *ctx, uint8_t *out,
     return 0;
   }
 
-  if (in_tag_len != gcm_ctx->tag_len) {
+  if (in_tag_len != ctx->tag_len) {
     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_DECRYPT);
     return 0;
   }
@@ -1284,8 +1309,8 @@ static int aead_aes_gcm_open_gather(const EVP_AEAD_CTX *ctx, uint8_t *out,
     }
   }
 
-  CRYPTO_gcm128_tag(&gcm, tag, gcm_ctx->tag_len);
-  if (CRYPTO_memcmp(tag, in_tag, gcm_ctx->tag_len) != 0) {
+  CRYPTO_gcm128_tag(&gcm, tag, ctx->tag_len);
+  if (CRYPTO_memcmp(tag, in_tag, ctx->tag_len) != 0) {
     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_DECRYPT);
     return 0;
   }
@@ -1300,6 +1325,8 @@ DEFINE_METHOD_FUNCTION(EVP_AEAD, EVP_aead_aes_128_gcm) {
   out->nonce_len = 12;
   out->overhead = EVP_AEAD_AES_GCM_TAG_LEN;
   out->max_tag_len = EVP_AEAD_AES_GCM_TAG_LEN;
+  out->seal_scatter_supports_extra_in = 1;
+
   out->init = aead_aes_gcm_init;
   out->cleanup = aead_aes_gcm_cleanup;
   out->seal_scatter = aead_aes_gcm_seal_scatter;
@@ -1313,6 +1340,8 @@ DEFINE_METHOD_FUNCTION(EVP_AEAD, EVP_aead_aes_256_gcm) {
   out->nonce_len = 12;
   out->overhead = EVP_AEAD_AES_GCM_TAG_LEN;
   out->max_tag_len = EVP_AEAD_AES_GCM_TAG_LEN;
+  out->seal_scatter_supports_extra_in = 1;
+
   out->init = aead_aes_gcm_init;
   out->cleanup = aead_aes_gcm_cleanup;
   out->seal_scatter = aead_aes_gcm_seal_scatter;
@@ -1320,7 +1349,7 @@ DEFINE_METHOD_FUNCTION(EVP_AEAD, EVP_aead_aes_256_gcm) {
 }
 
 static int aead_aes_gcm_tls12_init(EVP_AEAD_CTX *ctx, const uint8_t *key,
-                                   size_t key_len, size_t tag_len) {
+                                   size_t key_len, size_t requested_tag_len) {
   struct aead_aes_gcm_tls12_ctx *gcm_ctx;
   gcm_ctx = OPENSSL_malloc(sizeof(struct aead_aes_gcm_tls12_ctx));
   if (gcm_ctx == NULL) {
@@ -1329,13 +1358,15 @@ static int aead_aes_gcm_tls12_init(EVP_AEAD_CTX *ctx, const uint8_t *key,
 
   gcm_ctx->counter = 0;
 
-  if (!aead_aes_gcm_init_impl(&gcm_ctx->gcm_ctx, key, key_len, tag_len)) {
+  size_t actual_tag_len;
+  if (!aead_aes_gcm_init_impl(&gcm_ctx->gcm_ctx, &actual_tag_len, key, key_len,
+                              requested_tag_len)) {
     OPENSSL_free(gcm_ctx);
     return 0;
   }
 
   ctx->aead_state = gcm_ctx;
-  ctx->tag_len = gcm_ctx->gcm_ctx.tag_len;
+  ctx->tag_len = actual_tag_len;
   return 1;
 }
 
@@ -1348,8 +1379,8 @@ static void aead_aes_gcm_tls12_cleanup(EVP_AEAD_CTX *ctx) {
 static int aead_aes_gcm_tls12_seal_scatter(
     const EVP_AEAD_CTX *ctx, uint8_t *out, uint8_t *out_tag,
     size_t *out_tag_len, size_t max_out_tag_len, const uint8_t *nonce,
-    size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *ad,
-    size_t ad_len) {
+    size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *extra_in,
+    size_t extra_in_len, const uint8_t *ad, size_t ad_len) {
   struct aead_aes_gcm_tls12_ctx *gcm_ctx = ctx->aead_state;
   if (gcm_ctx->counter == UINT64_MAX) {
     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_INVALID_NONCE);
@@ -1371,7 +1402,7 @@ static int aead_aes_gcm_tls12_seal_scatter(
 
   return aead_aes_gcm_seal_scatter(ctx, out, out_tag, out_tag_len,
                                    max_out_tag_len, nonce, nonce_len, in,
-                                   in_len, ad, ad_len);
+                                   in_len, extra_in, extra_in_len, ad, ad_len);
 }
 
 DEFINE_METHOD_FUNCTION(EVP_AEAD, EVP_aead_aes_128_gcm_tls12) {
@@ -1381,6 +1412,8 @@ DEFINE_METHOD_FUNCTION(EVP_AEAD, EVP_aead_aes_128_gcm_tls12) {
   out->nonce_len = 12;
   out->overhead = EVP_AEAD_AES_GCM_TAG_LEN;
   out->max_tag_len = EVP_AEAD_AES_GCM_TAG_LEN;
+  out->seal_scatter_supports_extra_in = 1;
+
   out->init = aead_aes_gcm_tls12_init;
   out->cleanup = aead_aes_gcm_tls12_cleanup;
   out->seal_scatter = aead_aes_gcm_tls12_seal_scatter;
@@ -1394,6 +1427,8 @@ DEFINE_METHOD_FUNCTION(EVP_AEAD, EVP_aead_aes_256_gcm_tls12) {
   out->nonce_len = 12;
   out->overhead = EVP_AEAD_AES_GCM_TAG_LEN;
   out->max_tag_len = EVP_AEAD_AES_GCM_TAG_LEN;
+  out->seal_scatter_supports_extra_in = 1;
+
   out->init = aead_aes_gcm_tls12_init;
   out->cleanup = aead_aes_gcm_tls12_cleanup;
   out->seal_scatter = aead_aes_gcm_tls12_seal_scatter;
diff --git a/src/crypto/fipsmodule/cipher/internal.h b/src/crypto/fipsmodule/cipher/internal.h
index c61bff75..ea59723e 100644
--- a/src/crypto/fipsmodule/cipher/internal.h
+++ b/src/crypto/fipsmodule/cipher/internal.h
@@ -79,6 +79,7 @@ struct evp_aead_st {
   uint8_t nonce_len;
   uint8_t overhead;
   uint8_t max_tag_len;
+  int seal_scatter_supports_extra_in;
 
   /* init initialises an |EVP_AEAD_CTX|. If this call returns zero then
    * |cleanup| will not be called for that context. */
@@ -96,7 +97,8 @@ struct evp_aead_st {
   int (*seal_scatter)(const EVP_AEAD_CTX *ctx, uint8_t *out, uint8_t *out_tag,
                       size_t *out_tag_len, size_t max_out_tag_len,
                       const uint8_t *nonce, size_t nonce_len, const uint8_t *in,
-                      size_t in_len, const uint8_t *ad, size_t ad_len);
+                      size_t in_len, const uint8_t *extra_in,
+                      size_t extra_in_len, const uint8_t *ad, size_t ad_len);
 
   int (*open_gather)(const EVP_AEAD_CTX *ctx, uint8_t *out,
                      const uint8_t *nonce, size_t nonce_len, const uint8_t *in,
diff --git a/src/crypto/test/file_test.cc b/src/crypto/test/file_test.cc
index 5bc5fb46..c85fac68 100644
--- a/src/crypto/test/file_test.cc
+++ b/src/crypto/test/file_test.cc
@@ -465,3 +465,7 @@ int FileTestMain(const FileTest::Options &opts) {
 
   return failed ? 1 : 0;
 }
+
+void FileTest::SkipCurrent() {
+  ClearTest();
+}
diff --git a/src/crypto/test/file_test.h b/src/crypto/test/file_test.h
index 8c476c47..fd1dcd7c 100644
--- a/src/crypto/test/file_test.h
+++ b/src/crypto/test/file_test.h
@@ -184,6 +184,9 @@ class FileTest {
   // instructions.
   void InjectInstruction(const std::string &key, const std::string &value);
 
+  // SkipCurrent passes the current test case. Unused attributes are ignored.
+  void SkipCurrent();
+
  private:
   void ClearTest();
   void ClearInstructions();
diff --git a/src/include/openssl/aead.h b/src/include/openssl/aead.h
index e0d64325..f0a67d8f 100644
--- a/src/include/openssl/aead.h
+++ b/src/include/openssl/aead.h
@@ -267,8 +267,15 @@ OPENSSL_EXPORT int EVP_AEAD_CTX_open(const EVP_AEAD_CTX *ctx, uint8_t *out,
  * function on the same |EVP_AEAD_CTX|.
  *
  * Exactly |in_len| bytes are written to |out|, and up to
- * |EVP_AEAD_max_overhead| bytes to |out_tag|. On successful return,
- * |*out_tag_len| is set to the actual number of bytes written to |out_tag|.
+ * |EVP_AEAD_max_overhead+extra_in_len| bytes to |out_tag|. On successful
+ * return, |*out_tag_len| is set to the actual number of bytes written to
+ * |out_tag|.
+ *
+ * |extra_in| may point to an additional plaintext input buffer if the cipher
+ * supports it. If present, |extra_in_len| additional bytes of plaintext are
+ * encrypted and authenticated, and the ciphertext is written (before the tag)
+ * to |out_tag|. |max_out_tag_len| must be sized to allow for the additional
+ * |extra_in_len| bytes.
  *
  * The length of |nonce|, |nonce_len|, must be equal to the result of
  * |EVP_AEAD_nonce_length| for this AEAD.
@@ -281,10 +288,12 @@ OPENSSL_EXPORT int EVP_AEAD_CTX_open(const EVP_AEAD_CTX *ctx, uint8_t *out,
  * If |in| and |out| alias then |out| must be == |in|. |out_tag| may not alias
  * any other argument. */
 OPENSSL_EXPORT int EVP_AEAD_CTX_seal_scatter(
-    const EVP_AEAD_CTX *ctx, uint8_t *out, uint8_t *out_tag,
-    size_t *out_tag_len, size_t max_out_tag_len, const uint8_t *nonce,
-    size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *ad,
-    size_t ad_len);
+    const EVP_AEAD_CTX *ctx, uint8_t *out,
+    uint8_t *out_tag, size_t *out_tag_len, size_t max_out_tag_len,
+    const uint8_t *nonce, size_t nonce_len,
+    const uint8_t *in, size_t in_len,
+    const uint8_t *extra_in, size_t extra_in_len,
+    const uint8_t *ad, size_t ad_len);
 
 /* EVP_AEAD_CTX_open_gather decrypts and authenticates |in_len| bytes from |in|
  * and authenticates |ad_len| bytes from |ad| using |in_tag_len| bytes of
diff --git a/src/tool/server.cc b/src/tool/server.cc
index 53f9a9cb..1d6d27c7 100644
--- a/src/tool/server.cc
+++ b/src/tool/server.cc
@@ -233,10 +233,15 @@ bool Server(const std::vector<std::string> &args) {
     SSL_CTX_set_early_data_enabled(ctx.get(), 1);
   }
 
+  Listener listener;
+  if (!listener.Init(args_map["-accept"])) {
+    return false;
+  }
+
   bool result = true;
   do {
     int sock = -1;
-    if (!Accept(&sock, args_map["-accept"])) {
+    if (!listener.Accept(&sock)) {
       return false;
     }
 
diff --git a/src/tool/transport_common.cc b/src/tool/transport_common.cc
index cf1d5f8b..912e6802 100644
--- a/src/tool/transport_common.cc
+++ b/src/tool/transport_common.cc
@@ -149,48 +149,56 @@ out:
   return ok;
 }
 
-bool Accept(int *out_sock, const std::string &port) {
-  struct sockaddr_in6 addr, cli_addr;
-  socklen_t cli_addr_len = sizeof(cli_addr);
+Listener::~Listener() {
+  if (server_sock_ >= 0) {
+    closesocket(server_sock_);
+  }
+}
+
+bool Listener::Init(const std::string &port) {
+  if (server_sock_ >= 0) {
+    return false;
+  }
+
+  struct sockaddr_in6 addr;
   OPENSSL_memset(&addr, 0, sizeof(addr));
 
   addr.sin6_family = AF_INET6;
   addr.sin6_addr = IN6ADDR_ANY_INIT;
   addr.sin6_port = htons(atoi(port.c_str()));
 
-  bool ok = false;
 #if defined(OPENSSL_WINDOWS)
   const BOOL enable = TRUE;
 #else
   const int enable = 1;
 #endif
-  int server_sock = -1;
 
-  server_sock =
-      socket(addr.sin6_family, SOCK_STREAM, 0);
-  if (server_sock < 0) {
+  server_sock_ = socket(addr.sin6_family, SOCK_STREAM, 0);
+  if (server_sock_ < 0) {
     perror("socket");
-    goto out;
+    return false;
   }
 
-  if (setsockopt(server_sock, SOL_SOCKET, SO_REUSEADDR, (const char *)&enable,
+  if (setsockopt(server_sock_, SOL_SOCKET, SO_REUSEADDR, (const char *)&enable,
                  sizeof(enable)) < 0) {
     perror("setsockopt");
-    goto out;
+    return false;
   }
 
-  if (bind(server_sock, (struct sockaddr*)&addr, sizeof(addr)) != 0) {
+  if (bind(server_sock_, (struct sockaddr *)&addr, sizeof(addr)) != 0) {
     perror("connect");
-    goto out;
+    return false;
   }
-  listen(server_sock, 1);
-  *out_sock = accept(server_sock, (struct sockaddr*)&cli_addr, &cli_addr_len);
 
-  ok = true;
+  listen(server_sock_, SOMAXCONN);
+  return true;
+}
 
-out:
-  closesocket(server_sock);
-  return ok;
+bool Listener::Accept(int *out_sock) {
+  struct sockaddr_in6 addr;
+  socklen_t addr_len = sizeof(addr);
+  *out_sock = accept(server_sock_, (struct sockaddr *)&addr, &addr_len);
+  return *out_sock >= 0;
 }
 
 bool VersionFromString(uint16_t *out_version, const std::string &version) {
diff --git a/src/tool/transport_common.h b/src/tool/transport_common.h
index 7595f456..7c157ba0 100644
--- a/src/tool/transport_common.h
+++ b/src/tool/transport_common.h
@@ -26,10 +26,24 @@ bool InitSocketLibrary();
 // It returns true on success and false otherwise.
 bool Connect(int *out_sock, const std::string &hostname_and_port);
 
-// Accept sets |*out_sock| to be a socket connected to the port given
-// in |port|, which should be of the form "123".
-// It returns true on success and false otherwise.
-bool Accept(int *out_sock, const std::string &port);
+class Listener {
+ public:
+  Listener() {}
+  ~Listener();
+
+  // Init initializes the listener to listen on |port|, which should be of the
+  // form "123".
+  bool Init(const std::string &port);
+
+  // Accept sets |*out_sock| to be a socket connected to the listener.
+  bool Accept(int *out_sock);
+
+ private:
+  int server_sock_ = -1;
+
+  Listener(const Listener &) = delete;
+  Listener &operator=(const Listener &) = delete;
+};
 
 bool VersionFromString(uint16_t *out_version, const std::string &version);
 
diff --git a/src/util/bot/DEPS b/src/util/bot/DEPS
index 0e1b7dc7..ccaf75d3 100644
--- a/src/util/bot/DEPS
+++ b/src/util/bot/DEPS
@@ -24,7 +24,7 @@ deps = {
 deps_os = {
   'android': {
     'boringssl/util/bot/android_tools':
-      Var('chromium_git') + '/android_tools.git' + '@' + '023e2f65409a2b7886b8d644d6a88542ead6cd0a',
+      Var('chromium_git') + '/android_tools.git' + '@' + 'e9d4018e149d50172ed462a7c21137aa915940ec',
   },
   'unix': {
     'boringssl/util/bot/libFuzzer':
diff --git a/src/util/bot/UPDATING b/src/util/bot/UPDATING
index 2007d46f..43aa30a6 100644
--- a/src/util/bot/UPDATING
+++ b/src/util/bot/UPDATING
@@ -29,19 +29,38 @@ cmake-linux64.tar.gz: Download the latest CMake source tarball, found at
         ./bootstrap --prefix=$PWD/cmake-linux64 && make && make install
         tar -czf cmake-linux64.tar.gz cmake-linux64/
 
+    The current revision was built against cmake-3.5.0.tar.gz.
+
 cmake-mac.tar.gz: Follow the same instructions as above on a Mac, but replace
     cmake-linux64 with cmake-mac.
 
+    The current revision was built against cmake-3.5.0.tar.gz.
+
 cmake-win32.zip: Update to the latest prebuilt release of CMake, found at
     https://cmake.org/download/. Use the file labeled "Windows ZIP". The
     download will be named cmake-VERSION-win32-x86.zip.
 
+    The current revision is cmake-3.5.0-win32-x86.zip.
+
 perl-win32.zip: Update to the latest 32-bit prebuilt "PortableZip" edition of
     Strawberry Perl, found at http://strawberryperl.com/releases.html. The
     download will be named strawberry-perl-VERSION-32bit-portable.zip.
 
+    The current revision is strawberry-perl-5.22.1.2-32bit-portable.zip.
+
 yasm-win32.exe: Update to the appropriate release of Yasm. Use the same version
     as Chromium, found at
     https://chromium.googlesource.com/chromium/src/+/master/third_party/yasm/README.chromium
     Use the release at http://yasm.tortall.net/Download.html labeled
     "Win32 .exe". The download will be named yasm-VERSION-win32.exe.
+
+    The current revision is yasm-1.2.0-win32.exe.
+
+Finally, update sde-linux64.tar.bz2 by downloading the latet release from intel
+at
+https://software.intel.com/en-us/articles/intel-software-development-emulator,
+but upload it with the following command. (Note the bucket is different.)
+
+    upload_to_google_storage.py -b chrome-boringssl-sde sde-linux64.tar.bz2
+
+The current revision is sde-external-8.5.0-2017-06-08-lin.tar.bz2.
diff --git a/src/util/bot/sde-linux64.tar.bz2.sha1 b/src/util/bot/sde-linux64.tar.bz2.sha1
index afa9875d..1598a951 100644
--- a/src/util/bot/sde-linux64.tar.bz2.sha1
+++ b/src/util/bot/sde-linux64.tar.bz2.sha1
@@ -1 +1 @@
-3d612f0095a0830656614e5b442f70289e266088
\ No newline at end of file
+2b13efc6fb26fcee614a8c4534b0ffa71c50a2a5
\ No newline at end of file
diff --git a/src/util/bot/update_clang.py b/src/util/bot/update_clang.py
index 3fd59a30..3ba423da 100644
--- a/src/util/bot/update_clang.py
+++ b/src/util/bot/update_clang.py
@@ -22,8 +22,8 @@ import urllib
 # CLANG_REVISION and CLANG_SUB_REVISION determine the build of clang
 # to use. These should be synced with tools/clang/scripts/update.py in
 # Chromium.
-CLANG_REVISION = "305281"
-CLANG_SUB_REVISION = "1"
+CLANG_REVISION = "305735"
+CLANG_SUB_REVISION = "2"
 
 PACKAGE_VERSION = "%s-%s" % (CLANG_REVISION, CLANG_SUB_REVISION)
 LLVM_BUILD_DIR = os.path.join(os.path.dirname(__file__), "llvm-build")
diff --git a/src/util/bot/vs_toolchain.py b/src/util/bot/vs_toolchain.py
index 2e87272e..d86f7257 100644
--- a/src/util/bot/vs_toolchain.py
+++ b/src/util/bot/vs_toolchain.py
@@ -19,7 +19,7 @@ import gyp
 
 
 TOOLCHAIN_VERSION = '2015'
-TOOLCHAIN_HASH = 'd3cb0e37bdd120ad0ac4650b674b09e81be45616'
+TOOLCHAIN_HASH = 'f53e4598951162bad6330f7a167486c7ae5db1e5'
 
 
 def SetEnvironmentAndGetRuntimeDllDirs():