25 files changed, 1010 insertions, 28 deletions

diff --git a/Configurations/00-base-templates.conf b/Configurations/00-base-templates.conf
index 4bc1915906..55da5ec56c 100644
--- a/Configurations/00-base-templates.conf
+++ b/Configurations/00-base-templates.conf
@@ -52,6 +52,8 @@ my %targets=(
                 push @defs, "BROTLI_SHARED" unless $disabled{"brotli-dynamic"};
                 push @defs, "ZLIB" unless $disabled{zlib};
                 push @defs, "ZLIB_SHARED" unless $disabled{"zlib-dynamic"};
+                push @defs, "ZSTD" unless $disabled{zstd};
+                push @defs, "ZSTD_SHARED" unless $disabled{"zstd-dynamic"};
                 return [ @defs ];
             },
         includes        =>
@@ -61,6 +63,8 @@ my %targets=(
                     if !$disabled{brotli} && $withargs{brotli_include};
                 push @incs, $withargs{zlib_include}
                     if !$disabled{zlib} && $withargs{zlib_include};
+                push @incs, $withargs{zstd_include}
+                    if !$disabled{zstd} && $withargs{zstd_include};
                 return [ @incs ];
             },
     },
@@ -77,6 +81,7 @@ my %targets=(
                 my @libs = ();
                 push(@libs, "-L".$withargs{zlib_lib}) if $withargs{zlib_lib};
                 push(@libs, "-L".$withargs{brotli_lib}) if $withargs{brotli_lib};
+                push(@libs, "-L".$withargs{zstd_lib}) if $withargs{zstd_lib};
                 return join(" ", @libs);
             },
         ex_libs         =>
@@ -89,6 +94,7 @@ my %targets=(
                     push(@libs, "-lbrotlicommon");
                     push(@libs, "-lm");
                 }
+                push(@libs, "-lzstd") if !defined($disabled{zstd}) && defined($disabled{"zstd-dynamic"});
                 return join(" ", @libs);
             },
         HASHBANGPERL    => "/usr/bin/env perl", # Only Unix actually cares
@@ -123,6 +129,11 @@ my %targets=(
                         push(@libs, $withargs{zlib_lib} // "ZLIB1");
                     }
                 }
+                unless ($disabled{zstd}) {
+                    if (defined($disabled{"zstd-dynamic"})) {
+                        push(@libs, $withargs{zstd_lib} // "libzstd");
+                    }
+                }
                 unless ($disabled{brotli}) {
                     if (defined($disabled{"brotli-dynamic"})) {
                         my $path = "";
diff --git a/Configure b/Configure
index 7f7c889227..3deeb030a2 100755
--- a/Configure
+++ b/Configure
@@ -517,6 +517,8 @@ my @disablables = (
     "whirlpool",
     "zlib",
     "zlib-dynamic",
+    "zstd",
+    "zstd-dynamic",
     );
 foreach my $proto ((@tls, @dtls))
         {
@@ -574,6 +576,8 @@ our %disabled = ( # "what"         => "comment"
                   "weak-ssl-ciphers"    => "default",
                   "zlib"                => "default",
                   "zlib-dynamic"        => "default",
+                  "zstd"                => "default",
+                  "zstd-dynamic"        => "default",
                 );
 
 # Note: => pair form used for aesthetics, not to truly make a hash table
@@ -602,6 +606,7 @@ my @disable_cascades = (
     "ssl3-method"       => [ "ssl3" ],
     "zlib"              => [ "zlib-dynamic" ],
     "brotli"            => [ "brotli-dynamic" ],
+    "zstd"              => [ "zstd-dynamic" ],
     "des"               => [ "mdc2" ],
     "ec"                => [ "ec2m", "ecdsa", "ecdh", "sm2", "gost" ],
     "dgram"             => [ "dtls", "quic", "sctp" ],
@@ -647,7 +652,7 @@ my @disable_cascades = (
     "stdio"             => [ "apps", "capieng", "egd" ],
     "apps"              => [ "tests" ],
     "tests"             => [ "external-tests" ],
-    "comp"              => [ "zlib", "brotli" ],
+    "comp"              => [ "zlib", "brotli", "zstd" ],
     "sm3"               => [ "sm2" ],
     sub { !$disabled{"unit-test"} } => [ "heartbeats" ],
 
@@ -912,6 +917,10 @@ while (@argvcopy)
                         {
                         delete $disabled{"brotli"};
                         }
+                elsif ($1 eq "zstd-dynamic")
+                        {
+                        delete $disabled{"zstd"};
+                        }
                 my $algo = $1;
                 delete $disabled{$algo};
 
@@ -996,6 +1005,14 @@ while (@argvcopy)
                         {
                         $withargs{brotli_include}=$1;
                         }
+                elsif (/^--with-zstd-lib=(.*)$/)
+                        {
+                        $withargs{zstd_lib}=$1;
+                        }
+                elsif (/^--with-zstd-include=(.*)$/)
+                        {
+                        $withargs{zstd_include}=$1;
+                        }
                 elsif (/^--with-fuzzer-lib=(.*)$/)
                         {
                         $withargs{fuzzer_lib}=$1;
diff --git a/INSTALL.md b/INSTALL.md
index 234f39c201..fdd234fa57 100644
--- a/INSTALL.md
+++ b/INSTALL.md
@@ -440,6 +440,32 @@ then this flag is optional and defaults to `ZLIB1` if not provided.
 This flag is optional and if not provided then `GNV$LIBZSHR`, `GNV$LIBZSHR32`
 or `GNV$LIBZSHR64` is used by default depending on the pointer size chosen.
 
+### with-zstd-include
+
+    --with-zstd-include=DIR
+
+The directory for the location of the Zstd include file. This option is only
+necessary if [enable-std](#enable-zstd) is used and the include file is not
+already on the system include path.
+
+OpenSSL requires Zstd 1.4 or greater. The Linux kernel source contains a
+*zstd.h* file that is not compatible with the 1.4.x Zstd distribution, the
+compilation will generate an error if the Linux *zstd.h* is included before
+(or instead of) the Zstd distribution header.
+
+### with-zstd-lib
+
+    --with-zstd-lib=LIB
+
+**On Unix**: this is the directory containing the Zstd library.
+If not provided the system library path will be used.
+
+**On Windows:** this is the filename of the Zstd library (with or
+without a path).  This flag must be provided if the
+[enable-zstd-dynamic](#enable-zstd-dynamic) option is not also used.
+If `zstd-dynamic` is used then this flag is optional and defaults
+to `LIBZSTD` if not provided.
+
 Seeding the Random Generator
 ----------------------------
 
@@ -1014,6 +1040,17 @@ when needed.
 
 This is only supported on systems where loading of shared libraries is supported.
 
+### enable-zstd
+
+Build with support for Zstd compression/decompression.
+
+### enable-zstd-dynamic
+
+Like the enable-zstd option, but has OpenSSL load the Zstd library dynamically
+when needed.
+
+This is only supported on systems where loading of shared libraries is supported.
+
 ### 386
 
 In 32-bit x86 builds, use the 80386 instruction set only in assembly modules
diff --git a/apps/enc.c b/apps/enc.c
index 4da2342791..cbeaeaa8aa 100644
--- a/apps/enc.c
+++ b/apps/enc.c
@@ -136,6 +136,8 @@ int enc_main(int argc, char **argv)
 #endif
     int do_brotli = 0;
     BIO *bbrot = NULL;
+    int do_zstd = 0;
+    BIO *bzstd = NULL;
 
     /* first check the command name */
     if (strcmp(argv[0], "base64") == 0)
@@ -148,6 +150,10 @@ int enc_main(int argc, char **argv)
     else if (strcmp(argv[0], "brotli") == 0)
         do_brotli = 1;
 #endif
+#ifndef OPENSSL_NO_ZSTD
+    else if (strcmp(argv[0], "zstd") == 0)
+        do_zstd = 1;
+#endif
     else if (strcmp(argv[0], "enc") != 0)
         ciphername = argv[0];
 
@@ -332,6 +338,8 @@ int enc_main(int argc, char **argv)
 #endif
     if (do_brotli)
         base64 = 0;
+    if (do_zstd)
+        base64 = 0;
 
     if (base64) {
         if (enc)
@@ -436,6 +444,19 @@ int enc_main(int argc, char **argv)
         else
             rbio = BIO_push(bbrot, rbio);
     }
+
+    if (do_zstd) {
+        if ((bzstd = BIO_new(BIO_f_zstd())) == NULL)
+            goto end;
+        if (debug) {
+            BIO_set_callback_ex(bzstd, BIO_debug_callback_ex);
+            BIO_set_callback_arg(bzstd, (char *)bio_err);
+        }
+        if (enc)
+            wbio = BIO_push(bzstd, wbio);
+        else
+            rbio = BIO_push(bzstd, rbio);
+    }
 #endif
 
     if (base64) {
@@ -682,6 +703,7 @@ int enc_main(int argc, char **argv)
     BIO_free(bzl);
 #endif
     BIO_free(bbrot);
+    BIO_free(bzstd);
     release_engine(e);
     OPENSSL_free(pass);
     return ret;
diff --git a/apps/list.c b/apps/list.c
index f198c1cda7..76067f6b3b 100644
--- a/apps/list.c
+++ b/apps/list.c
@@ -1427,6 +1427,9 @@ static void list_disabled(void)
 #ifdef OPENSSL_NO_BROTLI
     BIO_puts(bio_out, "BROTLI\n");
 #endif
+#ifdef OPENSSL_NO_ZSTD
+    BIO_puts(bio_out, "ZSTD\n");
+#endif
 }
 
 /* Unified enum for help and list commands. */
diff --git a/apps/progs.pl b/apps/progs.pl
index c4e7ae59cf..77404e78dc 100644
--- a/apps/progs.pl
+++ b/apps/progs.pl
@@ -188,7 +188,7 @@ EOF
         "camellia-128-cbc", "camellia-128-ecb",
         "camellia-192-cbc", "camellia-192-ecb",
         "camellia-256-cbc", "camellia-256-ecb",
-        "base64", "zlib", "brotli",
+        "base64", "zlib", "brotli", "zstd",
         "des", "des3", "desx", "idea", "seed", "rc4", "rc4-40",
         "rc2", "bf", "cast", "rc5",
         "des-ecb", "des-ede", "des-ede3",
diff --git a/crypto/comp/build.info b/crypto/comp/build.info
index 014628e45d..7892c96ff2 100644
--- a/crypto/comp/build.info
+++ b/crypto/comp/build.info
@@ -1,5 +1,6 @@
 LIBS=../../libcrypto
 SOURCE[../../libcrypto]= \
         comp_lib.c comp_err.c \
-	c_brotli.c \
+        c_brotli.c \
+        c_zstd.c \
         c_zlib.c
diff --git a/crypto/comp/c_zstd.c b/crypto/comp/c_zstd.c
new file mode 100644
index 0000000000..99d326219e
--- /dev/null
+++ b/crypto/comp/c_zstd.c
@@ -0,0 +1,827 @@
+/*
+ * Copyright 1998-2021 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ *
+ * Uses zstd compression library from https://github.com/facebook/zstd
+ * Requires version 1.4.x (latest as of this writing is 1.4.5)
+ * Using custom free functions require static linking, so that is disabled when
+ * using the shared library.
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <openssl/objects.h>
+#include "internal/comp.h"
+#include <openssl/err.h>
+#include "crypto/cryptlib.h"
+#include "internal/bio.h"
+#include "internal/thread_once.h"
+#include "comp_local.h"
+
+COMP_METHOD *COMP_zstd(void);
+
+static COMP_METHOD zstd_method_nozstd = {
+    NID_undef,
+    "(undef)",
+    NULL,
+    NULL,
+    NULL,
+    NULL,
+};
+
+#ifdef OPENSSL_NO_ZSTD
+# undef ZSTD_SHARED
+#else
+
+# ifndef ZSTD_SHARED
+#  define ZSTD_STATIC_LINKING_ONLY
+# endif
+# include <zstd.h>
+
+/* Note: There is also a linux zstd.h file in the kernel source */
+# ifndef ZSTD_H_235446
+#  error Wrong (i.e. linux) zstd.h included.
+# endif
+
+# if ZSTD_VERSION_MAJOR != 1 && ZSTD_VERSION_MINOR < 4
+#  error Expecting version 1.4 or greater of ZSTD
+# endif
+
+# ifndef ZSTD_SHARED
+/* memory allocations functions for zstd initialisation */
+static void *zstd_alloc(void *opaque, size_t size)
+{
+    return OPENSSL_zalloc(size);
+}
+
+static void zstd_free(void *opaque, void *address)
+{
+    OPENSSL_free(address);
+}
+
+static ZSTD_customMem zstd_mem_funcs = {
+    zstd_alloc,
+    zstd_free,
+    NULL
+};
+# endif
+
+/*
+ * When OpenSSL is built on Windows, we do not want to require that
+ * the LIBZSTD.DLL be available in order for the OpenSSL DLLs to
+ * work.  Therefore, all ZSTD routines are loaded at run time
+ * and we do not link to a .LIB file when ZSTD_SHARED is set.
+ */
+# if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_WIN32)
+#  include <windows.h>
+# endif
+
+# ifdef ZSTD_SHARED
+#  include "internal/dso.h"
+
+/* Function pointers */
+typedef ZSTD_CStream* (*createCStream_ft)(void);
+typedef size_t (*initCStream_ft)(ZSTD_CStream*, int);
+typedef size_t (*freeCStream_ft)(ZSTD_CStream*);
+typedef size_t (*compressStream2_ft)(ZSTD_CCtx*, ZSTD_outBuffer*, ZSTD_inBuffer*, ZSTD_EndDirective);
+typedef size_t (*flushStream_ft)(ZSTD_CStream*, ZSTD_outBuffer*);
+typedef size_t (*endStream_ft)(ZSTD_CStream*, ZSTD_outBuffer*);
+typedef size_t (*compress_ft)(void*, size_t, const void*, size_t, int);
+typedef ZSTD_DStream* (*createDStream_ft)(void);
+typedef size_t (*initDStream_ft)(ZSTD_DStream*);
+typedef size_t (*freeDStream_ft)(ZSTD_DStream*);
+typedef size_t (*decompressStream_ft)(ZSTD_DStream*, ZSTD_outBuffer*, ZSTD_inBuffer*);
+typedef size_t (*decompress_ft)(void*, size_t, const void*, size_t);
+typedef unsigned (*isError_ft)(size_t);
+typedef const char* (*getErrorName_ft)(size_t);
+typedef size_t (*DStreamInSize_ft)(void);
+typedef size_t (*CStreamInSize_ft)(void);
+
+static createCStream_ft p_createCStream = NULL;
+static initCStream_ft p_initCStream = NULL;
+static freeCStream_ft p_freeCStream = NULL;
+static compressStream2_ft p_compressStream2 = NULL;
+static flushStream_ft p_flushStream = NULL;
+static endStream_ft p_endStream = NULL;
+static compress_ft p_compress = NULL;
+static createDStream_ft p_createDStream = NULL;
+static initDStream_ft p_initDStream = NULL;
+static freeDStream_ft p_freeDStream = NULL;
+static decompressStream_ft p_decompressStream = NULL;
+static decompress_ft p_decompress = NULL;
+static isError_ft p_isError = NULL;
+static getErrorName_ft p_getErrorName = NULL;
+static DStreamInSize_ft p_DStreamInSize = NULL;
+static CStreamInSize_ft p_CStreamInSize = NULL;
+
+static DSO *zstd_dso = NULL;
+
+#  define ZSTD_createCStream p_createCStream
+#  define ZSTD_initCStream p_initCStream
+#  define ZSTD_freeCStream p_freeCStream
+#  define ZSTD_compressStream2 p_compressStream2
+#  define ZSTD_flushStream p_flushStream
+#  define ZSTD_endStream p_endStream
+#  define ZSTD_compress p_compress
+#  define ZSTD_createDStream p_createDStream
+#  define ZSTD_initDStream p_initDStream
+#  define ZSTD_freeDStream p_freeDStream
+#  define ZSTD_decompressStream p_decompressStream
+#  define ZSTD_decompress p_decompress
+#  define ZSTD_isError p_isError
+#  define ZSTD_getErrorName p_getErrorName
+#  define ZSTD_DStreamInSize p_DStreamInSize
+#  define ZSTD_CStreamInSize p_CStreamInSize
+
+# endif /* ifdef ZSTD_SHARED */
+
+struct zstd_state {
+    ZSTD_CStream *compressor;
+    ZSTD_DStream *decompressor;
+};
+
+static int zstd_stateful_init(COMP_CTX *ctx)
+{
+    struct zstd_state *state = OPENSSL_zalloc(sizeof(*state));
+
+    if (state == NULL)
+        return 0;
+
+# ifdef ZSTD_SHARED
+    state->compressor = ZSTD_createCStream();
+# else
+    state->compressor = ZSTD_createCStream_advanced(zstd_mem_funcs);
+# endif
+    if (state->compressor == NULL)
+        goto err;
+    ZSTD_initCStream(state->compressor, ZSTD_CLEVEL_DEFAULT);
+
+# ifdef ZSTD_SHARED
+    state->decompressor = ZSTD_createDStream();
+# else
+    state->decompressor = ZSTD_createDStream_advanced(zstd_mem_funcs);
+# endif
+    if (state->decompressor == NULL)
+        goto err;
+    ZSTD_initDStream(state->decompressor);
+
+    ctx->data = state;
+    return 1;
+ err:
+    ZSTD_freeCStream(state->compressor);
+    ZSTD_freeDStream(state->decompressor);
+    OPENSSL_free(state);
+    return 0;
+}
+
+static void zstd_stateful_finish(COMP_CTX *ctx)
+{
+    struct zstd_state *state = ctx->data;
+
+    if (state != NULL) {
+        ZSTD_freeCStream(state->compressor);
+        ZSTD_freeDStream(state->decompressor);
+        OPENSSL_free(state);
+        ctx->data = NULL;
+    }
+}
+
+static int zstd_stateful_compress_block(COMP_CTX *ctx, unsigned char *out,
+                                        unsigned int olen, unsigned char *in,
+                                        unsigned int ilen)
+{
+    ZSTD_inBuffer inbuf;
+    ZSTD_outBuffer outbuf;
+    size_t ret;
+    struct zstd_state *state = ctx->data;
+
+    inbuf.src = in;
+    inbuf.size = ilen;
+    inbuf.pos = 0;
+    outbuf.dst = out;
+    outbuf.size = olen;
+    outbuf.pos = 0;
+
+    if (state == NULL)
+        return -1;
+
+    /* If input length is zero, end the stream/frame ? */
+    if (ilen == 0) {
+        ret = ZSTD_endStream(state->compressor, &outbuf);
+        if (ZSTD_isError(ret))
+            return -1;
+        return outbuf.pos;
+    }
+
+    /*
+     * The finish API does not provide a final output buffer,
+     * so each compress operation has to be ended, if all
+     * the input data can't be accepted, or there is more output,
+     * this has to be considered an error, since there is no more
+     * output buffer space.
+     */
+    do {
+        ret = ZSTD_compressStream2(state->compressor, &outbuf, &inbuf, ZSTD_e_continue);
+        if (ZSTD_isError(ret))
+            return -1;
+        /* do I need to check for ret == 0 ? */
+    } while (inbuf.pos < inbuf.size);
+
+    /* Did not consume all the data */
+    if (inbuf.pos < inbuf.size)
+        return -1;
+
+    ret = ZSTD_flushStream(state->compressor, &outbuf);
+    if (ZSTD_isError(ret))
+        return -1;
+
+    return outbuf.pos;
+}
+
+static int zstd_stateful_expand_block(COMP_CTX *ctx, unsigned char *out,
+                                      unsigned int olen, unsigned char *in,
+                                      unsigned int ilen)
+{
+    ZSTD_inBuffer inbuf;
+    ZSTD_outBuffer outbuf;
+    size_t ret;
+    struct zstd_state *state = ctx->data;
+
+    inbuf.src = in;
+    inbuf.size = ilen;
+    inbuf.pos = 0;
+    outbuf.dst = out;
+    outbuf.size = olen;
+    outbuf.pos = 0;
+
+    if (state == NULL)
+        return -1;
+
+    if (ilen == 0)
+        return 0;
+
+    do {
+        ret = ZSTD_decompressStream(state->decompressor, &outbuf, &inbuf);
+        if (ZSTD_isError(ret))
+            return -1;
+        /* If we completed a frame, and there's more data, try again */
+    } while (ret == 0 && inbuf.pos < inbuf.size);
+
+    /* Did not consume all the data */
+    if (inbuf.pos < inbuf.size)
+        return -1;
+
+    return outbuf.pos;
+}
+
+
+static COMP_METHOD zstd_stateful_method = {
+    NID_zstd,
+    LN_zstd,
+    zstd_stateful_init,
+    zstd_stateful_finish,
+    zstd_stateful_compress_block,
+    zstd_stateful_expand_block
+};
+
+static int zstd_oneshot_init(COMP_CTX *ctx)
+{
+    return 1;
+}
+
+static void zstd_oneshot_finish(COMP_CTX *ctx)
+{
+}
+
+static int zstd_oneshot_compress_block(COMP_CTX *ctx, unsigned char *out,
+                                       unsigned int olen, unsigned char *in,
+                                       unsigned int ilen)
+{
+    size_t out_size;
+
+    if (ilen == 0)
+        return 0;
+
+    /* Note: uses STDLIB memory allocators */
+    out_size = ZSTD_compress(out, olen, in, ilen, ZSTD_CLEVEL_DEFAULT);
+    if (ZSTD_isError(out_size))
+        return -1;
+
+    return out_size;
+}
+
+static int zstd_oneshot_expand_block(COMP_CTX *ctx, unsigned char *out,
+                                     unsigned int olen, unsigned char *in,
+                                     unsigned int ilen)
+{
+    size_t out_size;
+
+    if (ilen == 0)
+        return 0;
+
+    /* Note: uses STDLIB memory allocators */
+    out_size = ZSTD_decompress(out, olen, in, ilen);
+    if (ZSTD_isError(out_size))
+        return -1;
+
+    return out_size;
+}
+
+static COMP_METHOD zstd_oneshot_method = {
+    NID_zstd,
+    LN_zstd,
+    zstd_oneshot_init,
+    zstd_oneshot_finish,
+    zstd_oneshot_compress_block,
+    zstd_oneshot_expand_block
+};
+
+static CRYPTO_ONCE zstd_once = CRYPTO_ONCE_STATIC_INIT;
+DEFINE_RUN_ONCE_STATIC(ossl_comp_zstd_init)
+{
+# ifdef ZSTD_SHARED
+#  if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_WIN32)
+#   define LIBZSTD "LIBZSTD"
+#  else
+#   define LIBZSTD  "zstd"
+#  endif
+
+    zstd_dso = DSO_load(NULL, LIBZSTD, NULL, 0);
+    if (zstd_dso != NULL) {
+        p_createCStream = (createCStream_ft)DSO_bind_func(zstd_dso, "ZSTD_createCStream");
+        p_initCStream = (initCStream_ft)DSO_bind_func(zstd_dso, "ZSTD_initCStream");
+        p_freeCStream = (freeCStream_ft)DSO_bind_func(zstd_dso, "ZSTD_freeCStream");
+        p_compressStream2 = (compressStream2_ft)DSO_bind_func(zstd_dso, "ZSTD_compressStream2");
+        p_flushStream = (flushStream_ft)DSO_bind_func(zstd_dso, "ZSTD_flushStream");
+        p_endStream = (endStream_ft)DSO_bind_func(zstd_dso, "ZSTD_endStream");
+        p_compress = (compress_ft)DSO_bind_func(zstd_dso, "ZSTD_compress");
+        p_createDStream = (createDStream_ft)DSO_bind_func(zstd_dso, "ZSTD_createDStream");
+        p_initDStream = (initDStream_ft)DSO_bind_func(zstd_dso, "ZSTD_initDStream");
+        p_freeDStream = (freeDStream_ft)DSO_bind_func(zstd_dso, "ZSTD_freeDStream");
+        p_decompressStream = (decompressStream_ft)DSO_bind_func(zstd_dso, "ZSTD_decompressStream");
+        p_decompress = (decompress_ft)DSO_bind_func(zstd_dso, "ZSTD_decompress");
+        p_isError = (isError_ft)DSO_bind_func(zstd_dso, "ZSTD_isError");
+        p_getErrorName = (getErrorName_ft)DSO_bind_func(zstd_dso, "ZSTD_getErrorName");
+        p_DStreamInSize = (DStreamInSize_ft)DSO_bind_func(zstd_dso, "ZSTD_DStreamInSize");
+        p_CStreamInSize = (CStreamInSize_ft)DSO_bind_func(zstd_dso, "ZSTD_CStreamInSize");
+    }
+
+    if (p_createCStream == NULL || p_initCStream == NULL || p_freeCStream == NULL
+            || p_compressStream2 == NULL || p_flushStream == NULL || p_endStream == NULL
+            || p_compress == NULL || p_createDStream == NULL || p_initDStream == NULL
+            || p_freeDStream == NULL || p_decompressStream == NULL || p_decompress == NULL
+            || p_isError == NULL || p_getErrorName == NULL || p_DStreamInSize == NULL
+            || p_CStreamInSize == NULL) {
+        ossl_comp_zstd_cleanup();
+        return 0;
+    }
+# endif
+    return 1;
+}
+#endif /* ifndef ZSTD / else */
+
+COMP_METHOD *COMP_zstd(void)
+{
+    COMP_METHOD *meth = &zstd_method_nozstd;
+
+#ifndef OPENSSL_NO_ZSTD
+    if (RUN_ONCE(&zstd_once, ossl_comp_zstd_init))
+        meth = &zstd_stateful_method;
+#endif
+    return meth;
+}
+
+COMP_METHOD *COMP_zstd_oneshot(void)
+{
+    COMP_METHOD *meth = &zstd_method_nozstd;
+
+#ifndef OPENSSL_NO_ZSTD
+    if (RUN_ONCE(&zstd_once, ossl_comp_zstd_init))
+        meth = &zstd_oneshot_method;
+#endif
+    return meth;
+}
+
+/* Also called from OPENSSL_cleanup() */
+void ossl_comp_zstd_cleanup(void)
+{
+#ifdef ZSTD_SHARED
+    DSO_free(zstd_dso);
+    zstd_dso = NULL;
+    p_createCStream = NULL;
+    p_initCStream = NULL;
+    p_freeCStream = NULL;
+    p_compressStream2 = NULL;
+    p_flushStream = NULL;
+    p_endStream = NULL;
+    p_compress = NULL;
+    p_createDStream = NULL;
+    p_initDStream = NULL;
+    p_freeDStream = NULL;
+    p_decompressStream = NULL;
+    p_decompress = NULL;
+    p_isError = NULL;
+    p_getErrorName = NULL;
+    p_DStreamInSize = NULL;
+    p_CStreamInSize = NULL;
+#endif
+}
+
+#ifndef OPENSSL_NO_ZSTD
+
+/* Zstd-based compression/decompression filter BIO */
+
+typedef struct {
+    struct { /* input structure */
+        ZSTD_DStream *state;
+        ZSTD_inBuffer inbuf; /* has const src */
+        size_t bufsize;
+        void* buffer;
+    } decompress;
+    struct { /* output structure */
+        ZSTD_CStream *state;
+        ZSTD_outBuffer outbuf;
+        size_t bufsize;
+        size_t write_pos;
+    } compress;
+} BIO_ZSTD_CTX;
+
+# define ZSTD_DEFAULT_BUFSIZE 1024
+
+static int bio_zstd_new(BIO *bi);
+static int bio_zstd_free(BIO *bi);
+static int bio_zstd_read(BIO *b, char *out, int outl);
+static int bio_zstd_write(BIO *b, const char *in, int inl);
+static long bio_zstd_ctrl(BIO *b, int cmd, long num, void *ptr);
+static long bio_zstd_callback_ctrl(BIO *b, int cmd, BIO_info_cb *fp);
+
+static const BIO_METHOD bio_meth_zstd = {
+    BIO_TYPE_COMP,
+    "zstd",
+    /* TODO: Convert to new style write function */
+    bwrite_conv,
+    bio_zstd_write,
+    /* TODO: Convert to new style read function */
+    bread_conv,
+    bio_zstd_read,
+    NULL,                      /* bio_zstd_puts, */
+    NULL,                      /* bio_zstd_gets, */
+    bio_zstd_ctrl,
+    bio_zstd_new,
+    bio_zstd_free,
+    bio_zstd_callback_ctrl
+};
+#endif
+
+const BIO_METHOD *BIO_f_zstd(void)
+{
+#ifndef OPENSSL_NO_ZSTD
+    return &bio_meth_zstd;
+#else
+    return NULL;
+#endif
+}
+
+#ifndef OPENSSL_NO_ZSTD
+static int bio_zstd_new(BIO *bi)
+{
+    BIO_ZSTD_CTX *ctx;
+
+# ifdef ZSTD_SHARED
+    (void)COMP_zstd();
+    if (zstd_dso == NULL) {
+        ERR_raise(ERR_LIB_COMP, COMP_R_ZSTD_NOT_SUPPORTED);
+        return 0;
+    }
+# endif
+    ctx = OPENSSL_zalloc(sizeof(*ctx));
+    if (ctx == NULL) {
+        ERR_raise(ERR_LIB_COMP, ERR_R_MALLOC_FAILURE);
+        return 0;
+    }
+
+# ifdef ZSTD_SHARED
+    ctx->decompress.state =  ZSTD_createDStream();
+# else
+    ctx->decompress.state =  ZSTD_createDStream_advanced(zstd_mem_funcs);
+# endif
+    if (ctx->decompress.state == NULL)
+        goto err;
+    ZSTD_initDStream(ctx->decompress.state);
+    ctx->decompress.bufsize = ZSTD_DStreamInSize();
+
+# ifdef ZSTD_SHARED
+    ctx->compress.state = ZSTD_createCStream();
+# else
+    ctx->compress.state = ZSTD_createCStream_advanced(zstd_mem_funcs);
+# endif
+    if (ctx->compress.state == NULL)
+        goto err;
+    ZSTD_initCStream(ctx->compress.state, ZSTD_CLEVEL_DEFAULT);
+    ctx->compress.bufsize = ZSTD_CStreamInSize();
+
+    BIO_set_init(bi, 1);
+    BIO_set_data(bi, ctx);
+
+    return 1;
+ err:
+    ERR_raise(ERR_LIB_COMP, ERR_R_MALLOC_FAILURE);
+    ZSTD_freeDStream(ctx->decompress.state);
+    ZSTD_freeCStream(ctx->compress.state);
+    OPENSSL_free(ctx);
+    return 0;
+}
+
+static int bio_zstd_free(BIO *bi)
+{
+    BIO_ZSTD_CTX *ctx;
+
+    if (bi == NULL)
+        return 0;
+
+    ctx = BIO_get_data(bi);
+    if (ctx != NULL) {
+        ZSTD_freeDStream(ctx->decompress.state);
+        OPENSSL_free(ctx->decompress.buffer);
+        ZSTD_freeCStream(ctx->compress.state);
+        OPENSSL_free(ctx->compress.outbuf.dst);
+        OPENSSL_free(ctx);
+    }
+    BIO_set_data(bi, NULL);
+    BIO_set_init(bi, 0);
+
+    return 1;
+}
+
+static int bio_zstd_read(BIO *b, char *out, int outl)
+{
+    BIO_ZSTD_CTX *ctx;
+    size_t zret;
+    int ret;
+    ZSTD_outBuffer outBuf;
+    BIO *next = BIO_next(b);
+
+    if (out == NULL || outl <= 0)
+        return 0;
+
+    ctx = BIO_get_data(b);
+    BIO_clear_retry_flags(b);
+    if (ctx->decompress.buffer == NULL) {
+        ctx->decompress.buffer = OPENSSL_malloc(ctx->decompress.bufsize);
+        if (ctx->decompress.buffer == NULL) {
+            ERR_raise(ERR_LIB_COMP, ERR_R_MALLOC_FAILURE);
+            return 0;
+        }
+        ctx->decompress.inbuf.src = ctx->decompress.buffer;
+        ctx->decompress.inbuf.size = 0;
+        ctx->decompress.inbuf.pos = 0;
+    }
+
+    /* Copy output data directly to supplied buffer */
+    outBuf.dst = out;
+    outBuf.size = (size_t)outl;
+    outBuf.pos = 0;
+    for (;;) {
+        /* Decompress while data available */
+        do {
+            zret = ZSTD_decompressStream(ctx->decompress.state, &outBuf, &ctx->decompress.inbuf);
+            if (ZSTD_isError(zret)) {
+                ERR_raise(ERR_LIB_COMP, COMP_R_ZSTD_DECOMPRESS_ERROR);
+                ERR_add_error_data(1, ZSTD_getErrorName(zret));
+                return -1;
+            }
+            /* No more output space */
+            if (outBuf.pos == outBuf.size)
+                return outBuf.pos;
+        } while (ctx->decompress.inbuf.pos < ctx->decompress.inbuf.size);