Roll src/third_party/boringssl/src 12fe1b25e..ac8302a09

https://boringssl.googlesource.com/boringssl/+log/12fe1b25ead258858309d22ffa9e1f9a316358d7..ac8302a092e8e232dbabf5a01eff5dd37671b5c8

Also add a script to do the roll so I don't forget to update build files.

BUG=none

Review URL: https://codereview.chromium.org/1321793002

Cr-Commit-Position: refs/heads/master@{#346841}

24 files changed, 383 insertions, 249 deletions

diff --git a/DEPS b/DEPS
index e0e8560..1dca6b8 100644
--- a/DEPS
+++ b/DEPS
@@ -63,7 +63,7 @@ vars = {
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling BoringSSL
   # and whatever else without interference from each other.
-  'boringssl_revision': '12fe1b25ead258858309d22ffa9e1f9a316358d7',
+  'boringssl_revision': 'ac8302a092e8e232dbabf5a01eff5dd37671b5c8',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling nss
   # and whatever else without interference from each other.
diff --git a/crypto/ec_private_key_openssl.cc b/crypto/ec_private_key_openssl.cc
index 35403f3..1a06028 100644
--- a/crypto/ec_private_key_openssl.cc
+++ b/crypto/ec_private_key_openssl.cc
@@ -176,9 +176,10 @@ bool ECPrivateKey::ExportEncryptedPrivateKey(
   // equivalent.
   ScopedX509_SIG encrypted(PKCS8_encrypt_pbe(
       NID_pbe_WithSHA1And3_Key_TripleDES_CBC,
+      nullptr,
       reinterpret_cast<const uint8_t*>(password.data()),
       password.size(),
-      NULL,
+      nullptr,
       0,
       iterations,
       pkcs8.get()));
diff --git a/third_party/boringssl/BUILD.gn b/third_party/boringssl/BUILD.gn
index a8fe16e..dba6a11 100644
--- a/third_party/boringssl/BUILD.gn
+++ b/third_party/boringssl/BUILD.gn
@@ -62,14 +62,7 @@ component("boringssl") {
   ]
 
   # Also gets the include dirs from :openssl_config
-  include_dirs = [
-    "src/include",
-
-    # This is for arm_arch.h, which is needed by some asm files. Since the
-    # asm files are generated and kept in a different directory, they
-    # cannot use relative paths to find this file.
-    "src/crypto",
-  ]
+  include_dirs = [ "src/include" ]
 
   if (is_msan) {
     defines += [ "OPENSSL_NO_ASM" ]
diff --git a/third_party/boringssl/boringssl.gyp b/third_party/boringssl/boringssl.gyp
index 5118fc7..653a70d 100644
--- a/third_party/boringssl/boringssl.gyp
+++ b/third_party/boringssl/boringssl.gyp
@@ -99,10 +99,6 @@
       ],
       'include_dirs': [
         'src/include',
-        # This is for arm_arch.h, which is needed by some asm files. Since the
-        # asm files are generated and kept in a different directory, they
-        # cannot use relative paths to find this file.
-        'src/crypto',
       ],
       'direct_dependent_settings': {
         'include_dirs': [
diff --git a/third_party/boringssl/boringssl.gypi b/third_party/boringssl/boringssl.gypi
index 2c311c2..7ae8461 100644
--- a/third_party/boringssl/boringssl.gypi
+++ b/third_party/boringssl/boringssl.gypi
@@ -15,6 +15,7 @@
       'src/ssl/d1_pkt.c',
       'src/ssl/d1_srtp.c',
       'src/ssl/d1_srvr.c',
+      'src/ssl/dtls_record.c',
       'src/ssl/pqueue/pqueue.c',
       'src/ssl/s3_both.c',
       'src/ssl/s3_clnt.c',
@@ -26,6 +27,7 @@
       'src/ssl/ssl_aead_ctx.c',
       'src/ssl/ssl_algs.c',
       'src/ssl/ssl_asn1.c',
+      'src/ssl/ssl_buffer.c',
       'src/ssl/ssl_cert.c',
       'src/ssl/ssl_cipher.c',
       'src/ssl/ssl_lib.c',
@@ -35,6 +37,7 @@
       'src/ssl/ssl_txt.c',
       'src/ssl/t1_enc.c',
       'src/ssl/t1_lib.c',
+      'src/ssl/tls_record.c',
     ],
     'boringssl_crypto_sources': [
       'err_data.c',
diff --git a/third_party/boringssl/boringssl_nacl.gyp b/third_party/boringssl/boringssl_nacl.gyp
index e560c29..b99e002 100644
--- a/third_party/boringssl/boringssl_nacl.gyp
+++ b/third_party/boringssl/boringssl_nacl.gyp
@@ -31,10 +31,6 @@
       ],
       'include_dirs': [
         'src/include',
-        # This is for arm_arch.h, which is needed by some asm files. Since the
-        # asm files are generated and kept in a different directory, they
-        # cannot use relative paths to find this file.
-        'src/crypto',
       ],
       'direct_dependent_settings': {
         'include_dirs': [
diff --git a/third_party/boringssl/boringssl_tests.gypi b/third_party/boringssl/boringssl_tests.gypi
index f9e919b..a864247 100644
--- a/third_party/boringssl/boringssl_tests.gypi
+++ b/third_party/boringssl/boringssl_tests.gypi
@@ -343,6 +343,20 @@
       'msvs_disabled_warnings': [ 4267, ],
     },
     {
+      'target_name': 'boringssl_pkcs8_test',
+      'type': 'executable',
+      'dependencies': [
+        'boringssl.gyp:boringssl',
+      ],
+      'sources': [
+        'src/crypto/pkcs8/pkcs8_test.cc',
+        '<@(boringssl_test_support_sources)',
+      ],
+      # TODO(davidben): Fix size_t truncations in BoringSSL.
+      # https://crbug.com/429039
+      'msvs_disabled_warnings': [ 4267, ],
+    },
+    {
       'target_name': 'boringssl_poly1305_test',
       'type': 'executable',
       'dependencies': [
@@ -501,6 +515,7 @@
       'boringssl_pbkdf_test',
       'boringssl_pkcs12_test',
       'boringssl_pkcs7_test',
+      'boringssl_pkcs8_test',
       'boringssl_poly1305_test',
       'boringssl_pqueue_test',
       'boringssl_refcount_test',
diff --git a/third_party/boringssl/boringssl_unittest.cc b/third_party/boringssl/boringssl_unittest.cc
index 75b9db8..8538c69 100644
--- a/third_party/boringssl/boringssl_unittest.cc
+++ b/third_party/boringssl/boringssl_unittest.cc
@@ -271,6 +271,10 @@ TEST(BoringSSL, PKCS7) {
   TestSimple("pkcs7_test");
 }
 
+TEST(BoringSSL, PKCS8) {
+  TestSimple("pkcs8_test");
+}
+
 TEST(BoringSSL, PKCS12) {
   TestSimple("pkcs12_test");
 }
diff --git a/third_party/boringssl/err_data.c b/third_party/boringssl/err_data.c
index 9317cd1..258a5c3 100644
--- a/third_party/boringssl/err_data.c
+++ b/third_party/boringssl/err_data.c
@@ -189,43 +189,43 @@ const uint32_t kOpenSSLReasonValues[] = {
     0x28328b9b,
     0x28330b6c,
     0x28338bae,
-    0x2c322be0,
-    0x2c32abee,
-    0x2c332c00,
-    0x2c33ac12,
-    0x2c342c26,
-    0x2c34ac38,
-    0x2c352c53,
-    0x2c35ac65,
-    0x2c362c78,
+    0x2c322bfd,
+    0x2c32ac0b,
+    0x2c332c1d,
+    0x2c33ac2f,
+    0x2c342c43,
+    0x2c34ac55,
+    0x2c352c70,
+    0x2c35ac82,
+    0x2c362c95,
     0x2c3682f3,
-    0x2c372c85,
-    0x2c37ac97,
-    0x2c382caa,
-    0x2c38acb8,
-    0x2c392cc8,
-    0x2c39acda,
-    0x2c3a2cee,
-    0x2c3aacff,
+    0x2c372ca2,
+    0x2c37acb4,
+    0x2c382cc7,
+    0x2c38acd5,
+    0x2c392ce5,
+    0x2c39acf7,
+    0x2c3a2d0b,
+    0x2c3aad1c,
     0x2c3b1359,
-    0x2c3bad10,
-    0x2c3c2d24,
-    0x2c3cad3a,
-    0x2c3d2d53,
-    0x2c3dad81,
-    0x2c3e2d8f,
-    0x2c3eada7,
-    0x2c3f2dbf,
-    0x2c3fadcc,
-    0x2c402def,
-    0x2c40ae0e,
+    0x2c3bad2d,
+    0x2c3c2d41,
+    0x2c3cad57,
+    0x2c3d2d70,
+    0x2c3dad9e,
+    0x2c3e2dac,
+    0x2c3eadc4,
+    0x2c3f2ddc,
+    0x2c3fade9,
+    0x2c402e0c,
+    0x2c40ae2b,
     0x2c4111c3,
-    0x2c41ae1f,
-    0x2c422e32,
+    0x2c41ae3c,
+    0x2c422e4f,
     0x2c429135,
-    0x2c432e43,
+    0x2c432e60,
     0x2c4386a2,
-    0x2c442d70,
+    0x2c442d8d,
     0x30320000,
     0x30328015,
     0x3033001f,
@@ -427,143 +427,144 @@ const uint32_t kOpenSSLReasonValues[] = {
     0x40581eda,
     0x40589eef,
     0x40591f12,
-    0x40599f20,
-    0x405a1f2d,
-    0x405a9f46,
-    0x405b1f5e,
-    0x405b9f71,
-    0x405c1f86,
-    0x405c9f98,
-    0x405d1fad,
-    0x405d9fbd,
-    0x405e1fd6,
-    0x405e9fea,
-    0x405f1ffa,
-    0x405fa012,
-    0x40602023,
-    0x4060a036,
-    0x40612047,
-    0x4061a065,
-    0x40622076,
-    0x4062a083,
-    0x4063209a,
-    0x4063a0db,
-    0x406420f2,
-    0x4064a0ff,
-    0x4065210d,
-    0x4065a12f,
-    0x40662157,
-    0x4066a16c,
-    0x40672183,
-    0x4067a194,
-    0x406821a5,
-    0x4068a1b6,
-    0x406921cb,
-    0x4069a1e2,
-    0x406a21f3,
-    0x406aa20c,
-    0x406b2227,
-    0x406ba23e,
-    0x406c22ab,
-    0x406ca2cc,
-    0x406d22df,
-    0x406da300,
-    0x406e231b,
-    0x406ea364,
-    0x406f2385,
-    0x406fa3ab,
-    0x407023cb,
-    0x4070a3e7,
-    0x40712574,
-    0x4071a597,
-    0x407225ad,
-    0x4072a5cc,
-    0x407325e4,
-    0x4073a604,
-    0x4074282e,
-    0x4074a853,
-    0x4075286e,
-    0x4075a88d,
-    0x407628bc,
-    0x4076a8e4,
-    0x40772915,
-    0x4077a934,
-    0x4078296e,
-    0x4078a985,
-    0x40792998,
-    0x4079a9b5,
+    0x40599f3d,
+    0x405a1f4a,
+    0x405a9f63,
+    0x405b1f7b,
+    0x405b9f8e,
+    0x405c1fa3,
+    0x405c9fb5,
+    0x405d1fca,
+    0x405d9fda,
+    0x405e1ff3,
+    0x405ea007,
+    0x405f2017,
+    0x405fa02f,
+    0x40602040,
+    0x4060a053,
+    0x40612064,
+    0x4061a082,
+    0x40622093,
+    0x4062a0a0,
+    0x406320b7,
+    0x4063a0f8,
+    0x4064210f,
+    0x4064a11c,
+    0x4065212a,
+    0x4065a14c,
+    0x40662174,
+    0x4066a189,
+    0x406721a0,
+    0x4067a1b1,
+    0x406821c2,
+    0x4068a1d3,
+    0x406921e8,
+    0x4069a1ff,
+    0x406a2210,
+    0x406aa229,
+    0x406b2244,
+    0x406ba25b,
+    0x406c22c8,
+    0x406ca2e9,
+    0x406d22fc,
+    0x406da31d,
+    0x406e2338,
+    0x406ea381,
+    0x406f23a2,
+    0x406fa3c8,
+    0x407023e8,
+    0x4070a404,
+    0x40712591,
+    0x4071a5b4,
+    0x407225ca,
+    0x4072a5e9,
+    0x40732601,
+    0x4073a621,
+    0x4074284b,
+    0x4074a870,
+    0x4075288b,
+    0x4075a8aa,
+    0x407628d9,
+    0x4076a901,
+    0x40772932,
+    0x4077a951,
+    0x4078298b,
+    0x4078a9a2,
+    0x407929b5,
+    0x4079a9d2,
     0x407a0782,
-    0x407aa9c7,
-    0x407b29da,
-    0x407ba9f3,
-    0x407c2a0b,
+    0x407aa9e4,
+    0x407b29f7,
+    0x407baa10,
+    0x407c2a28,
     0x407c90bd,
-    0x407d2a1f,
-    0x407daa39,
-    0x407e2a4a,
-    0x407eaa5e,
-    0x407f2a6c,
-    0x407faa87,
+    0x407d2a3c,
+    0x407daa56,
+    0x407e2a67,
+    0x407eaa7b,
+    0x407f2a89,
+    0x407faaa4,
     0x40801286,
-    0x4080aaac,
-    0x40812ace,
-    0x4081aae9,
-    0x40822afe,
-    0x4082ab16,
-    0x40832b2e,
-    0x4083ab45,
-    0x40842b5b,
-    0x4084ab67,
-    0x40852b7a,
-    0x4085ab8f,
-    0x40862ba1,
-    0x4086abb6,
-    0x40872bbf,
+    0x4080aac9,
+    0x40812aeb,
+    0x4081ab06,
+    0x40822b1b,
+    0x4082ab33,
+    0x40832b4b,
+    0x4083ab62,
+    0x40842b78,
+    0x4084ab84,
+    0x40852b97,
+    0x4085abac,
+    0x40862bbe,
+    0x4086abd3,
+    0x40872bdc,
     0x40879cd0,
     0x40880083,
-    0x4088a0ba,
+    0x4088a0d7,
     0x40890a17,
-    0x4089a256,
+    0x4089a273,
     0x408a1bf0,
-    0x408aa280,
-    0x408b28fd,
-    0x408ba959,
-    0x408c2336,
+    0x408aa29d,
+    0x408b291a,
+    0x408ba976,
+    0x408c2353,
     0x408c9c21,
     0x408d1c56,
     0x408d9e68,
     0x408e1ab9,
     0x408e9add,
-    0x41f4249f,
-    0x41f92531,
-    0x41fe2424,
-    0x41fea655,
-    0x41ff2746,
-    0x420324b8,
-    0x420824da,
-    0x4208a516,
-    0x42092408,
-    0x4209a550,
-    0x420a245f,
-    0x420aa43f,
-    0x420b247f,
-    0x420ba4f8,
-    0x420c2762,
-    0x420ca622,
-    0x420d263c,
-    0x420da673,
-    0x4212268d,
-    0x42172729,
-    0x4217a6cf,
-    0x421c26f1,
-    0x421f26ac,
-    0x42212779,
-    0x4226270c,
-    0x422b2812,
-    0x422ba7db,
-    0x422c27fa,
-    0x422ca7b5,
-    0x422d2794,
+    0x408f1f20,
+    0x41f424bc,
+    0x41f9254e,
+    0x41fe2441,
+    0x41fea672,
+    0x41ff2763,
+    0x420324d5,
+    0x420824f7,
+    0x4208a533,
+    0x42092425,
+    0x4209a56d,
+    0x420a247c,
+    0x420aa45c,
+    0x420b249c,
+    0x420ba515,
+    0x420c277f,
+    0x420ca63f,
+    0x420d2659,
+    0x420da690,
+    0x421226aa,
+    0x42172746,
+    0x4217a6ec,
+    0x421c270e,
+    0x421f26c9,
+    0x42212796,
+    0x42262729,
+    0x422b282f,
+    0x422ba7f8,
+    0x422c2817,
+    0x422ca7d2,
+    0x422d27b1,
     0x443206ad,
     0x443286bc,
     0x443306c8,
@@ -606,69 +607,69 @@ const uint32_t kOpenSSLReasonValues[] = {
     0x4c3d10bd,
     0x4c3d9449,
     0x4c3e1456,
-    0x50322e55,
-    0x5032ae64,
-    0x50332e6f,
-    0x5033ae7f,
-    0x50342e98,
-    0x5034aeb2,
-    0x50352ec0,
-    0x5035aed6,
-    0x50362ee8,
-    0x5036aefe,
-    0x50372f17,
-    0x5037af2a,
-    0x50382f42,
-    0x5038af53,
-    0x50392f68,
-    0x5039af7c,
-    0x503a2f9c,
-    0x503aafb2,
-    0x503b2fca,
-    0x503bafdc,
-    0x503c2ff8,
-    0x503cb00f,
-    0x503d3028,
-    0x503db03e,
-    0x503e304b,
-    0x503eb061,
-    0x503f3073,
+    0x50322e72,
+    0x5032ae81,
+    0x50332e8c,
+    0x5033ae9c,
+    0x50342eb5,
+    0x5034aecf,
+    0x50352edd,
+    0x5035aef3,
+    0x50362f05,
+    0x5036af1b,
+    0x50372f34,
+    0x5037af47,
+    0x50382f5f,
+    0x5038af70,
+    0x50392f85,
+    0x5039af99,
+    0x503a2fb9,
+    0x503aafcf,
+    0x503b2fe7,
+    0x503baff9,
+    0x503c3015,
+    0x503cb02c,
+    0x503d3045,
+    0x503db05b,
+    0x503e3068,
+    0x503eb07e,
+    0x503f3090,
     0x503f8348,
-    0x50403086,
-    0x5040b096,
-    0x504130b0,
-    0x5041b0bf,
-    0x504230d9,
-    0x5042b0f6,
-    0x50433106,
-    0x5043b116,
-    0x50443125,
+    0x504030a3,
+    0x5040b0b3,
+    0x504130cd,
+    0x5041b0dc,
+    0x504230f6,
+    0x5042b113,
+    0x50433123,
+    0x5043b133,
+    0x50443142,
     0x50448414,
-    0x50453139,
-    0x5045b157,
-    0x5046316a,
-    0x5046b180,
-    0x50473192,
-    0x5047b1a7,
-    0x504831cd,
-    0x5048b1db,
-    0x504931ee,
-    0x5049b203,
-    0x504a3219,
-    0x504ab229,
-    0x504b3249,
-    0x504bb25c,
-    0x504c327f,
-    0x504cb2ad,
-    0x504d32bf,
-    0x504db2dc,
-    0x504e32f7,
-    0x504eb313,
-    0x504f3325,
-    0x504fb33c,
-    0x5050334b,
+    0x50453156,
+    0x5045b174,
+    0x50463187,
+    0x5046b19d,
+    0x504731af,
+    0x5047b1c4,
+    0x504831ea,
+    0x5048b1f8,
+    0x5049320b,
+    0x5049b220,
+    0x504a3236,
+    0x504ab246,
+    0x504b3266,
+    0x504bb279,
+    0x504c329c,
+    0x504cb2ca,
+    0x504d32dc,
+    0x504db2f9,
+    0x504e3314,
+    0x504eb330,
+    0x504f3342,
+    0x504fb359,
+    0x50503368,
     0x50508687,
-    0x5051335e,
+    0x5051337b,
     0x58320e1f,
     0x68320de1,
     0x68328b9b,
@@ -1103,6 +1104,7 @@ const char kOpenSSLReasonStringData[] =
     "MISSING_TMP_ECDH_KEY\0"
     "MIXED_SPECIAL_OPERATOR_WITH_GROUPS\0"
     "MTU_TOO_SMALL\0"
+    "NEGOTIATED_BOTH_NPN_AND_ALPN\0"
     "NESTED_GROUP\0"
     "NO_CERTIFICATES_RETURNED\0"
     "NO_CERTIFICATE_ASSIGNED\0"
diff --git a/third_party/boringssl/linux-aarch64/crypto/aes/aesv8-armx64.S b/third_party/boringssl/linux-aarch64/crypto/aes/aesv8-armx64.S
index c414476..fa2abbc 100644
--- a/third_party/boringssl/linux-aarch64/crypto/aes/aesv8-armx64.S
+++ b/third_party/boringssl/linux-aarch64/crypto/aes/aesv8-armx64.S
@@ -1,5 +1,5 @@
 #if defined(__aarch64__)
-#include "arm_arch.h"
+#include <openssl/arm_arch.h>
 
 #if __ARM_MAX_ARCH__>=7
 .text
diff --git a/third_party/boringssl/linux-aarch64/crypto/modes/ghashv8-armx64.S b/third_party/boringssl/linux-aarch64/crypto/modes/ghashv8-armx64.S
index bc9a156..8d44667 100644
--- a/third_party/boringssl/linux-aarch64/crypto/modes/ghashv8-armx64.S
+++ b/third_party/boringssl/linux-aarch64/crypto/modes/ghashv8-armx64.S
@@ -1,5 +1,5 @@
 #if defined(__aarch64__)
-#include "arm_arch.h"
+#include <openssl/arm_arch.h>
 
 .text
 #if !defined(__clang__)
diff --git a/third_party/boringssl/linux-aarch64/crypto/sha/sha1-armv8.S b/third_party/boringssl/linux-aarch64/crypto/sha/sha1-armv8.S
index 487a497..6cf9877e 100644
--- a/third_party/boringssl/linux-aarch64/crypto/sha/sha1-armv8.S
+++ b/third_party/boringssl/linux-aarch64/crypto/sha/sha1-armv8.S
@@ -1,5 +1,5 @@
 #if defined(__aarch64__)
-#include "arm_arch.h"
+#include <openssl/arm_arch.h>
 
 .text
 
diff --git a/third_party/boringssl/linux-aarch64/crypto/sha/sha256-armv8.S b/third_party/boringssl/linux-aarch64/crypto/sha/sha256-armv8.S
index 4834553..0fad009 100644
--- a/third_party/boringssl/linux-aarch64/crypto/sha/sha256-armv8.S
+++ b/third_party/boringssl/linux-aarch64/crypto/sha/sha256-armv8.S
@@ -1,5 +1,5 @@
 #if defined(__aarch64__)
-#include "arm_arch.h"
+#include <openssl/arm_arch.h>
 
 .text
 
diff --git a/third_party/boringssl/linux-aarch64/crypto/sha/sha512-armv8.S b/third_party/boringssl/linux-aarch64/crypto/sha/sha512-armv8.S
index 654c473..517c033 100644
--- a/third_party/boringssl/linux-aarch64/crypto/sha/sha512-armv8.S
+++ b/third_party/boringssl/linux-aarch64/crypto/sha/sha512-armv8.S
@@ -1,5 +1,5 @@
 #if defined(__aarch64__)
-#include "arm_arch.h"
+#include <openssl/arm_arch.h>
 
 .text
 
diff --git a/third_party/boringssl/linux-arm/crypto/aes/aes-armv4.S b/third_party/boringssl/linux-arm/crypto/aes/aes-armv4.S
index cb94841..c4d7065 100644
--- a/third_party/boringssl/linux-arm/crypto/aes/aes-armv4.S
+++ b/third_party/boringssl/linux-arm/crypto/aes/aes-armv4.S
@@ -34,7 +34,7 @@
 
 #if defined(__arm__)
 #ifndef __KERNEL__
-# include "arm_arch.h"
+# include <openssl/arm_arch.h>
 #else
 # define __ARM_ARCH__ __LINUX_ARM_ARCH__
 #endif
diff --git a/third_party/boringssl/linux-arm/crypto/aes/aesv8-armx32.S b/third_party/boringssl/linux-arm/crypto/aes/aesv8-armx32.S
index 6f0ee7d..6012b0c 100644
--- a/third_party/boringssl/linux-arm/crypto/aes/aesv8-armx32.S
+++ b/third_party/boringssl/linux-arm/crypto/aes/aesv8-armx32.S
@@ -1,5 +1,5 @@
 #if defined(__arm__)
-#include "arm_arch.h"
+#include <openssl/arm_arch.h>
 
 #if __ARM_MAX_ARCH__>=7
 .text
diff --git a/third_party/boringssl/linux-arm/crypto/aes/bsaes-armv7.S b/third_party/boringssl/linux-arm/crypto/aes/bsaes-armv7.S
index dd84f35..85262d5 100644
--- a/third_party/boringssl/linux-arm/crypto/aes/bsaes-armv7.S
+++ b/third_party/boringssl/linux-arm/crypto/aes/bsaes-armv7.S
@@ -49,7 +49,7 @@
 
 #if defined(__arm__)
 #ifndef __KERNEL__
-# include "arm_arch.h"
+# include <openssl/arm_arch.h>
 
 # define VFP_ABI_PUSH	vstmdb	sp!,{d8-d15}
 # define VFP_ABI_POP	vldmia	sp!,{d8-d15}
diff --git a/third_party/boringssl/linux-arm/crypto/bn/armv4-mont.S b/third_party/boringssl/linux-arm/crypto/bn/armv4-mont.S
index 68dfb2c..fc671e8 100644
--- a/third_party/boringssl/linux-arm/crypto/bn/armv4-mont.S
+++ b/third_party/boringssl/linux-arm/crypto/bn/armv4-mont.S
@@ -1,5 +1,5 @@
 #if defined(__arm__)
-#include "arm_arch.h"
+#include <openssl/arm_arch.h>
 
 .text
 .code	32
diff --git a/third_party/boringssl/linux-arm/crypto/modes/ghash-armv4.S b/third_party/boringssl/linux-arm/crypto/modes/ghash-armv4.S
index c6f025d..f868c2d 100644
--- a/third_party/boringssl/linux-arm/crypto/modes/ghash-armv4.S
+++ b/third_party/boringssl/linux-arm/crypto/modes/ghash-armv4.S
@@ -1,6 +1,6 @@
 #if defined(__arm__)
 #if defined(__arm__)
-#include "arm_arch.h"
+#include <openssl/arm_arch.h>
 
 .syntax	unified
 
diff --git a/third_party/boringssl/linux-arm/crypto/modes/ghashv8-armx32.S b/third_party/boringssl/linux-arm/crypto/modes/ghashv8-armx32.S
index ea177b6..9a38ded 100644
--- a/third_party/boringssl/linux-arm/crypto/modes/ghashv8-armx32.S
+++ b/third_party/boringssl/linux-arm/crypto/modes/ghashv8-armx32.S
@@ -1,5 +1,5 @@
 #if defined(__arm__)
-#include "arm_arch.h"
+#include <openssl/arm_arch.h>
 
 .text
 .fpu	neon
diff --git a/third_party/boringssl/linux-arm/crypto/sha/sha1-armv4-large.S b/third_party/boringssl/linux-arm/crypto/sha/sha1-armv4-large.S
index 4911458..66d0ef3 100644
--- a/third_party/boringssl/linux-arm/crypto/sha/sha1-armv4-large.S
+++ b/third_party/boringssl/linux-arm/crypto/sha/sha1-armv4-large.S
@@ -1,5 +1,5 @@
 #if defined(__arm__)
-#include "arm_arch.h"
+#include <openssl/arm_arch.h>
 
 .text
 .code	32
diff --git a/third_party/boringssl/linux-arm/crypto/sha/sha256-armv4.S b/third_party/boringssl/linux-arm/crypto/sha/sha256-armv4.S
index ac9f2f1..9fc3e0b 100644
--- a/third_party/boringssl/linux-arm/crypto/sha/sha256-armv4.S
+++ b/third_party/boringssl/linux-arm/crypto/sha/sha256-armv4.S
@@ -38,7 +38,7 @@
 @ Add ARMv8 code path performing at 2.0 cpb on Apple A7.
 
 #ifndef __KERNEL__
-# include "arm_arch.h"
+# include <openssl/arm_arch.h>
 #else
 # define __ARM_ARCH__ __LINUX_ARM_ARCH__
 # define __ARM_MAX_ARCH__ 7
diff --git a/third_party/boringssl/linux-arm/crypto/sha/sha512-armv4.S b/third_party/boringssl/linux-arm/crypto/sha/sha512-armv4.S
index c794f87..834ede9 100644
--- a/third_party/boringssl/linux-arm/crypto/sha/sha512-armv4.S
+++ b/third_party/boringssl/linux-arm/crypto/sha/sha512-armv4.S
@@ -47,7 +47,7 @@
 @ was reflected in below two parameters as 0 and 4. Now caller is
 @ expected to maintain native byte order for whole 64-bit values.
 #ifndef __KERNEL__
-# include "arm_arch.h"
+# include <openssl/arm_arch.h>
 # define VFP_ABI_PUSH	vstmdb	sp!,{d8-d15}
 # define VFP_ABI_POP	vldmia	sp!,{d8-d15}
 #else
diff --git a/third_party/boringssl/roll_boringssl.py b/third_party/boringssl/roll_boringssl.py
new file mode 100755
index 0000000..884df5b
--- /dev/null
+++ b/third_party/boringssl/roll_boringssl.py
@@ -0,0 +1,124 @@
+#!/usr/bin/env python
+# Copyright 2015 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+"""Rolls third_party/boringssl/src in DEPS and updates generated build files."""
+
+import os
+import os.path
+import shutil
+import subprocess
+import sys
+
+
+SCRIPT_PATH = os.path.abspath(__file__)
+SRC_PATH = os.path.dirname(os.path.dirname(os.path.dirname(SCRIPT_PATH)))
+DEPS_PATH = os.path.join(SRC_PATH, 'DEPS')
+BORINGSSL_PATH = os.path.join(SRC_PATH, 'third_party', 'boringssl')
+BORINGSSL_SRC_PATH = os.path.join(BORINGSSL_PATH, 'src')
+
+if not os.path.isfile(DEPS_PATH) or not os.path.isdir(BORINGSSL_SRC_PATH):
+  raise Exception('Could not find Chromium checkout')
+
+# Pull OS_ARCH_COMBOS out of the BoringSSL script.
+sys.path.append(os.path.join(BORINGSSL_SRC_PATH, 'util'))
+import generate_build_files
+
+GENERATED_FILES = [
+    'boringssl.gypi',
+    'boringssl_tests.gypi',
+    'err_data.c',
+]
+
+
+def IsPristine(repo):
+  """Returns True if a git checkout is pristine."""
+  cmd = ['git', 'diff', '--ignore-submodules']
+  return not (subprocess.check_output(cmd, cwd=repo).strip() or
+              subprocess.check_output(cmd + ['--cached'], cwd=repo).strip())
+
+
+def RevParse(repo, rev):
+  """Resolves a string to a git commit."""
+  return subprocess.check_output(['git', 'rev-parse', rev], cwd=repo).strip()
+
+
+def UpdateDEPS(deps, from_hash, to_hash):
+  """Updates all references of |from_hash| to |to_hash| in |deps|."""
+  with open(deps, 'rb') as f:
+    contents = f.read()
+    if from_hash not in contents:
+      raise Exception('%s not in DEPS' % from_hash)
+  contents = contents.replace(from_hash, to_hash)
+  with open(deps, 'wb') as f:
+    f.write(contents)
+
+
+def main():
+  if len(sys.argv) > 2:
+    sys.stderr.write('Usage: %s [COMMIT]' % sys.argv[0])
+    return 1
+
+  if not IsPristine(SRC_PATH):
+    print >>sys.stderr, 'Chromium checkout not pristine.'
+    return 0
+  if not IsPristine(BORINGSSL_SRC_PATH):
+    print >>sys.stderr, 'BoringSSL checkout not pristine.'
+    return 0
+
+  if len(sys.argv) > 1:
+    commit = RevParse(BORINGSSL_SRC_PATH, sys.argv[1])
+  else:
+    subprocess.check_call(['git', 'fetch', 'origin'], cwd=BORINGSSL_SRC_PATH)
+    commit = RevParse(BORINGSSL_SRC_PATH, 'origin/master')
+
+  head = RevParse(BORINGSSL_SRC_PATH, 'HEAD')
+  if head == commit:
+    print 'BoringSSL already up-to-date.'
+    return 0
+
+  print 'Rolling BoringSSL from %s to %s...' % (head, commit)
+
+  UpdateDEPS(DEPS_PATH, head, commit)
+
+  # Checkout third_party/boringssl/src to generate new files.
+  subprocess.check_call(['git', 'checkout', commit], cwd=BORINGSSL_SRC_PATH)
+
+  # Clear the old generated files.
+  for (osname, arch, _, _, _) in generate_build_files.OS_ARCH_COMBOS:
+    path = os.path.join(BORINGSSL_PATH, osname + '-' + arch)
+    shutil.rmtree(path)
+  for file in GENERATED_FILES:
+    path = os.path.join(BORINGSSL_PATH, file)
+    os.unlink(path)
+
+  # Generate new ones.
+  subprocess.check_call(['python',
+                         os.path.join(BORINGSSL_SRC_PATH, 'util',
+                                      'generate_build_files.py'),
+                         'gyp'],
+                        cwd=BORINGSSL_PATH)
+
+  # Commit everything.
+  subprocess.check_call(['git', 'add', DEPS_PATH], cwd=SRC_PATH)
+  for (osname, arch, _, _, _) in generate_build_files.OS_ARCH_COMBOS:
+    path = os.path.join(BORINGSSL_PATH, osname + '-' + arch)
+    subprocess.check_call(['git', 'add', path], cwd=SRC_PATH)
+  for file in GENERATED_FILES:
+    path = os.path.join(BORINGSSL_PATH, file)
+    subprocess.check_call(['git', 'add', path], cwd=SRC_PATH)
+
+  message = """Roll src/third_party/boringssl/src %s..%s
+
+https://boringssl.googlesource.com/boringssl/+log/%s..%s
+
+BUG=none
+""" % (head[:9], commit[:9], head, commit)
+  subprocess.check_call(['git', 'commit', '-m', message], cwd=SRC_PATH)
+
+  return 0
+
+
+if __name__ == '__main__':
+  sys.exit(main())