grpc 1.27.0 → 1.30.2

data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/base.h

@@ -184,7 +184,7 @@ extern "C" {
 // A consumer may use this symbol in the preprocessor to temporarily build
 // against multiple revisions of BoringSSL at the same time. It is not
 // recommended to do so for longer than is necessary.
-#define BORINGSSL_API_VERSION 9
+#define BORINGSSL_API_VERSION 10
 
 #if defined(BORINGSSL_SHARED_LIBRARY)
 
@@ -422,6 +422,10 @@ typedef struct ssl_session_st SSL_SESSION;
 typedef struct ssl_st SSL;
 typedef struct ssl_ticket_aead_method_st SSL_TICKET_AEAD_METHOD;
 typedef struct st_ERR_FNS ERR_FNS;
+typedef struct trust_token_st TRUST_TOKEN;
+typedef struct trust_token_client_st TRUST_TOKEN_CLIENT;
+typedef struct trust_token_issuer_st TRUST_TOKEN_ISSUER;
+typedef struct trust_token_method_st TRUST_TOKEN_METHOD;
 typedef struct v3_ext_ctx X509V3_CTX;
 typedef struct x509_attributes_st X509_ATTRIBUTE;
 typedef struct x509_cert_aux_st X509_CERT_AUX;

data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/bn.h

@@ -684,10 +684,22 @@ OPENSSL_EXPORT int BN_generate_prime_ex(BIGNUM *ret, int bits, int safe,
                                         const BIGNUM *add, const BIGNUM *rem,
                                         BN_GENCB *cb);
 
-// BN_prime_checks is magic value that can be used as the |checks| argument to
-// the primality testing functions in order to automatically select a number of
-// Miller-Rabin checks that gives a false positive rate of ~2^{-80}.
-#define BN_prime_checks 0
+// BN_prime_checks_for_validation can be used as the |checks| argument to the
+// primarily testing functions when validating an externally-supplied candidate
+// prime. It gives a false positive rate of at most 2^{-128}. (The worst case
+// false positive rate for a single iteration is 1/4, so we perform 32
+// iterations.)
+#define BN_prime_checks_for_validation 32
+
+// BN_prime_checks_for_generation can be used as the |checks| argument to the
+// primality testing functions when generating random primes. It gives a false
+// positive rate at most the security level of the corresponding RSA key size.
+//
+// Note this value only performs enough checks if the candidate prime was
+// selected randomly. If validating an externally-supplied candidate, especially
+// one that may be selected adversarially, use |BN_prime_checks_for_validation|
+// instead.
+#define BN_prime_checks_for_generation 0
 
 // bn_primality_result_t enumerates the outcomes of primality-testing.
 enum bn_primality_result_t {
@@ -698,7 +710,7 @@ enum bn_primality_result_t {
 
 // BN_enhanced_miller_rabin_primality_test tests whether |w| is probably a prime
 // number using the Enhanced Miller-Rabin Test (FIPS 186-4 C.3.2) with
-// |iterations| iterations and returns the result in |out_result|. Enhanced
+// |checks| iterations and returns the result in |out_result|. Enhanced
 // Miller-Rabin tests primality for odd integers greater than 3, returning
 // |bn_probably_prime| if the number is probably prime,
 // |bn_non_prime_power_composite| if the number is a composite that is not the
@@ -706,12 +718,10 @@ enum bn_primality_result_t {
 // success and zero on failure. If |cb| is not NULL, then it is called during
 // each iteration of the primality test.
 //
-// If |iterations| is |BN_prime_checks|, then a value that results in a false
-// positive rate lower than the number-field sieve security level of |w| is
-// used, provided |w| was generated randomly. |BN_prime_checks| is not suitable
-// for inputs potentially crafted by an adversary.
+// See |BN_prime_checks_for_validation| and |BN_prime_checks_for_generation| for
+// recommended values of |checks|.
 OPENSSL_EXPORT int BN_enhanced_miller_rabin_primality_test(
-    enum bn_primality_result_t *out_result, const BIGNUM *w, int iterations,
+    enum bn_primality_result_t *out_result, const BIGNUM *w, int checks,
     BN_CTX *ctx, BN_GENCB *cb);
 
 // BN_primality_test sets |*is_probably_prime| to one if |candidate| is
@@ -720,11 +730,9 @@ OPENSSL_EXPORT int BN_enhanced_miller_rabin_primality_test(
 //
 // If |do_trial_division| is non-zero then |candidate| will be tested against a
 // list of small primes before Miller-Rabin tests. The probability of this
-// function returning a false positive is 2^{2*checks}. If |checks| is
-// |BN_prime_checks| then a value that results in a false positive rate lower
-// than the number-field sieve security level of |candidate| is used, provided
-// |candidate| was generated randomly. |BN_prime_checks| is not suitable for
-// inputs potentially crafted by an adversary.
+// function returning a false positive is at most 2^{2*checks}. See
+// |BN_prime_checks_for_validation| and |BN_prime_checks_for_generation| for
+// recommended values of |checks|.
 //
 // If |cb| is not NULL then it is called during the checking process. See the
 // comment above |BN_GENCB|.
@@ -740,11 +748,9 @@ OPENSSL_EXPORT int BN_primality_test(int *is_probably_prime,
 //
 // If |do_trial_division| is non-zero then |candidate| will be tested against a
 // list of small primes before Miller-Rabin tests. The probability of this
-// function returning one when |candidate| is composite is 2^{2*checks}. If
-// |checks| is |BN_prime_checks| then a value that results in a false positive
-// rate lower than the number-field sieve security level of |candidate| is used,
-// provided |candidate| was generated randomly. |BN_prime_checks| is not
-// suitable for inputs potentially crafted by an adversary.
+// function returning one when |candidate| is composite is at most 2^{2*checks}.
+// See |BN_prime_checks_for_validation| and |BN_prime_checks_for_generation| for
+// recommended values of |checks|.
 //
 // If |cb| is not NULL then it is called during the checking process. See the
 // comment above |BN_GENCB|.
@@ -939,6 +945,12 @@ OPENSSL_EXPORT int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *mod,
 // Use |BN_bn2bin_padded| instead. It is |size_t|-clean.
 OPENSSL_EXPORT int BN_bn2binpad(const BIGNUM *in, uint8_t *out, int len);
 
+// BN_prime_checks is a deprecated alias for |BN_prime_checks_for_validation|.
+// Use |BN_prime_checks_for_generation| or |BN_prime_checks_for_validation|
+// instead. (This defaults to the |_for_validation| value in order to be
+// conservative.)
+#define BN_prime_checks BN_prime_checks_for_validation
+
 
 // Private functions
 

data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/buf.h

@@ -97,25 +97,25 @@ OPENSSL_EXPORT size_t BUF_MEM_grow_clean(BUF_MEM *buf, size_t len);
 // error.
 OPENSSL_EXPORT int BUF_MEM_append(BUF_MEM *buf, const void *in, size_t len);
 
-// BUF_strdup returns an allocated, duplicate of |str|.
+
+// Deprecated functions.
+
+// BUF_strdup calls |OPENSSL_strdup|.
 OPENSSL_EXPORT char *BUF_strdup(const char *str);
 
-// BUF_strnlen returns the number of characters in |str|, excluding the NUL
-// byte, but at most |max_len|. This function never reads more than |max_len|
-// bytes from |str|.
+// BUF_strnlen calls |OPENSSL_strnlen|.
 OPENSSL_EXPORT size_t BUF_strnlen(const char *str, size_t max_len);
 
-// BUF_strndup returns an allocated, duplicate of |str|, which is, at most,
-// |size| bytes. The result is always NUL terminated.
+// BUF_strndup calls |OPENSSL_strndup|.
 OPENSSL_EXPORT char *BUF_strndup(const char *str, size_t size);
 
-// BUF_memdup returns an allocated, duplicate of |size| bytes from |data|.
+// BUF_memdup calls |OPENSSL_memdup|.
 OPENSSL_EXPORT void *BUF_memdup(const void *data, size_t size);
 
-// BUF_strlcpy acts like strlcpy(3).
+// BUF_strlcpy calls |OPENSSL_strlcpy|.
 OPENSSL_EXPORT size_t BUF_strlcpy(char *dst, const char *src, size_t dst_size);
 
-// BUF_strlcat acts like strlcat(3).
+// BUF_strlcat calls |OPENSSL_strlcat|.
 OPENSSL_EXPORT size_t BUF_strlcat(char *dst, const char *src, size_t dst_size);
 
 

data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/bytestring.h

@@ -102,6 +102,10 @@ OPENSSL_EXPORT int CBS_get_u8(CBS *cbs, uint8_t *out);
 // advances |cbs|. It returns one on success and zero on error.
 OPENSSL_EXPORT int CBS_get_u16(CBS *cbs, uint16_t *out);
 
+// CBS_get_u16le sets |*out| to the next, little-endian uint16_t from |cbs| and
+// advances |cbs|. It returns one on success and zero on error.
+OPENSSL_EXPORT int CBS_get_u16le(CBS *cbs, uint16_t *out);
+
 // CBS_get_u24 sets |*out| to the next, big-endian 24-bit value from |cbs| and
 // advances |cbs|. It returns one on success and zero on error.
 OPENSSL_EXPORT int CBS_get_u24(CBS *cbs, uint32_t *out);
@@ -110,10 +114,18 @@ OPENSSL_EXPORT int CBS_get_u24(CBS *cbs, uint32_t *out);
 // and advances |cbs|. It returns one on success and zero on error.
 OPENSSL_EXPORT int CBS_get_u32(CBS *cbs, uint32_t *out);
 
+// CBS_get_u32le sets |*out| to the next, little-endian uint32_t value from
+// |cbs| and advances |cbs|. It returns one on success and zero on error.
+OPENSSL_EXPORT int CBS_get_u32le(CBS *cbs, uint32_t *out);
+
 // CBS_get_u64 sets |*out| to the next, big-endian uint64_t value from |cbs|
 // and advances |cbs|. It returns one on success and zero on error.
 OPENSSL_EXPORT int CBS_get_u64(CBS *cbs, uint64_t *out);
 
+// CBS_get_u64le sets |*out| to the next, little-endian uint64_t value from
+// |cbs| and advances |cbs|. It returns one on success and zero on error.
+OPENSSL_EXPORT int CBS_get_u64le(CBS *cbs, uint64_t *out);
+
 // CBS_get_last_u8 sets |*out| to the last uint8_t from |cbs| and shortens
 // |cbs|. It returns one on success and zero on error.
 OPENSSL_EXPORT int CBS_get_last_u8(CBS *cbs, uint8_t *out);
@@ -253,6 +265,11 @@ OPENSSL_EXPORT int CBS_get_any_ber_asn1_element(CBS *cbs, CBS *out,
 // in 64 bits.
 OPENSSL_EXPORT int CBS_get_asn1_uint64(CBS *cbs, uint64_t *out);
 
+// CBS_get_asn1_int64 gets an ASN.1 INTEGER from |cbs| using |CBS_get_asn1|
+// and sets |*out| to its value. It returns one on success and zero on error,
+// where error includes the integer being too large to represent in 64 bits.
+OPENSSL_EXPORT int CBS_get_asn1_int64(CBS *cbs, int64_t *out);
+
 // CBS_get_asn1_bool gets an ASN.1 BOOLEAN from |cbs| and sets |*out| to zero
 // or one based on its value. It returns one on success or zero on error.
 OPENSSL_EXPORT int CBS_get_asn1_bool(CBS *cbs, int *out);
@@ -455,6 +472,10 @@ OPENSSL_EXPORT int CBB_add_u8(CBB *cbb, uint8_t value);
 // returns one on success and zero otherwise.
 OPENSSL_EXPORT int CBB_add_u16(CBB *cbb, uint16_t value);
 
+// CBB_add_u16le appends a 16-bit, little-endian number from |value| to |cbb|.
+// It returns one on success and zero otherwise.
+OPENSSL_EXPORT int CBB_add_u16le(CBB *cbb, uint16_t value);
+
 // CBB_add_u24 appends a 24-bit, big-endian number from |value| to |cbb|. It
 // returns one on success and zero otherwise.
 OPENSSL_EXPORT int CBB_add_u24(CBB *cbb, uint32_t value);
@@ -463,10 +484,18 @@ OPENSSL_EXPORT int CBB_add_u24(CBB *cbb, uint32_t value);
 // returns one on success and zero otherwise.
 OPENSSL_EXPORT int CBB_add_u32(CBB *cbb, uint32_t value);
 
+// CBB_add_u32le appends a 32-bit, little-endian number from |value| to |cbb|.
+// It returns one on success and zero otherwise.
+OPENSSL_EXPORT int CBB_add_u32le(CBB *cbb, uint32_t value);
+
 // CBB_add_u64 appends a 64-bit, big-endian number from |value| to |cbb|. It
 // returns one on success and zero otherwise.
 OPENSSL_EXPORT int CBB_add_u64(CBB *cbb, uint64_t value);
 
+// CBB_add_u64le appends a 64-bit, little-endian number from |value| to |cbb|.
+// It returns one on success and zero otherwise.
+OPENSSL_EXPORT int CBB_add_u64le(CBB *cbb, uint64_t value);
+
 // CBB_discard_child discards the current unflushed child of |cbb|. Neither the
 // child's contents nor the length prefix will be included in the output.
 OPENSSL_EXPORT void CBB_discard_child(CBB *cbb);
@@ -476,6 +505,11 @@ OPENSSL_EXPORT void CBB_discard_child(CBB *cbb);
 // error.
 OPENSSL_EXPORT int CBB_add_asn1_uint64(CBB *cbb, uint64_t value);
 
+// CBB_add_asn1_int64 writes an ASN.1 INTEGER into |cbb| using |CBB_add_asn1|
+// and writes |value| in its contents. It returns one on success and zero on
+// error.
+OPENSSL_EXPORT int CBB_add_asn1_int64(CBB *cbb, int64_t value);
+
 // CBB_add_asn1_octet_string writes an ASN.1 OCTET STRING into |cbb| with the
 // given contents. It returns one on success and zero on error.
 OPENSSL_EXPORT int CBB_add_asn1_octet_string(CBB *cbb, const uint8_t *data,

data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/crypto.h

@@ -60,12 +60,17 @@ OPENSSL_EXPORT int CRYPTO_has_asm(void);
 OPENSSL_EXPORT int FIPS_mode(void);
 
 // BORINGSSL_self_test triggers the FIPS KAT-based self tests. It returns one on
-// success and zero on error. The argument is the integrity hash of the FIPS
-// module and may be used to check and write flag files to suppress duplicate
-// self-tests. If it is all zeros, no flag file will be checked nor written and
-// tests will always be run.
+// success and zero on error.
 OPENSSL_EXPORT int BORINGSSL_self_test(void);
 
+// CRYPTO_pre_sandbox_init initializes the crypto library, pre-acquiring some
+// unusual resources to aid running in sandboxed environments. It is safe to
+// call this function multiple times and concurrently from multiple threads.
+//
+// For more details on using BoringSSL in a sandboxed environment, see
+// SANDBOXING.md in the source tree.
+OPENSSL_EXPORT void CRYPTO_pre_sandbox_init(void);
+
 
 // Deprecated functions.
 

data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/dh.h

@@ -86,6 +86,21 @@ OPENSSL_EXPORT int DH_up_ref(DH *dh);
 
 // Properties.
 
+// DH_get0_pub_key returns |dh|'s public key.
+OPENSSL_EXPORT const BIGNUM *DH_get0_pub_key(const DH *dh);
+
+// DH_get0_priv_key returns |dh|'s private key, or NULL if |dh| is a public key.
+OPENSSL_EXPORT const BIGNUM *DH_get0_priv_key(const DH *dh);
+
+// DH_get0_p returns |dh|'s group modulus.
+OPENSSL_EXPORT const BIGNUM *DH_get0_p(const DH *dh);
+
+// DH_get0_q returns the size of |dh|'s subgroup, or NULL if it is unset.
+OPENSSL_EXPORT const BIGNUM *DH_get0_q(const DH *dh);
+
+// DH_get0_g returns |dh|'s group generator.
+OPENSSL_EXPORT const BIGNUM *DH_get0_g(const DH *dh);
+
 // DH_get0_key sets |*out_pub_key| and |*out_priv_key|, if non-NULL, to |dh|'s
 // public and private key, respectively. If |dh| is a public key, the private
 // key will be set to NULL.
@@ -108,6 +123,11 @@ OPENSSL_EXPORT void DH_get0_pqg(const DH *dh, const BIGNUM **out_p,
 // |p| and |g| must either be specified or already configured on |dh|.
 OPENSSL_EXPORT int DH_set0_pqg(DH *dh, BIGNUM *p, BIGNUM *q, BIGNUM *g);
 
+// DH_set_length sets the number of bits to use for the secret exponent when
+// calling |DH_generate_key| on |dh| and returns one. If unset,
+// |DH_generate_key| will use the bit length of p.
+OPENSSL_EXPORT int DH_set_length(DH *dh, unsigned priv_length);
+
 
 // Standard parameters.
 

data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/digest.h

@@ -83,6 +83,7 @@ OPENSSL_EXPORT const EVP_MD *EVP_sha224(void);
 OPENSSL_EXPORT const EVP_MD *EVP_sha256(void);
 OPENSSL_EXPORT const EVP_MD *EVP_sha384(void);
 OPENSSL_EXPORT const EVP_MD *EVP_sha512(void);
+OPENSSL_EXPORT const EVP_MD *EVP_sha512_256(void);
 
 // EVP_md5_sha1 is a TLS-specific |EVP_MD| which computes the concatenation of
 // MD5 and SHA-1, as used in TLS 1.1 and below.

data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/dsa.h

@@ -94,6 +94,22 @@ OPENSSL_EXPORT int DSA_up_ref(DSA *dsa);
 
 // Properties.
 
+// DSA_get0_pub_key returns |dsa|'s public key.
+OPENSSL_EXPORT const BIGNUM *DSA_get0_pub_key(const DSA *dsa);
+
+// DSA_get0_priv_key returns |dsa|'s private key, or NULL if |dsa| is a public
+// key.
+OPENSSL_EXPORT const BIGNUM *DSA_get0_priv_key(const DSA *dsa);
+
+// DSA_get0_p returns |dsa|'s group modulus.
+OPENSSL_EXPORT const BIGNUM *DSA_get0_p(const DSA *dsa);
+
+// DSA_get0_q returns the size of |dsa|'s subgroup.
+OPENSSL_EXPORT const BIGNUM *DSA_get0_q(const DSA *dsa);
+
+// DSA_get0_g returns |dsa|'s group generator.
+OPENSSL_EXPORT const BIGNUM *DSA_get0_g(const DSA *dsa);
+
 // DSA_get0_key sets |*out_pub_key| and |*out_priv_key|, if non-NULL, to |dsa|'s
 // public and private key, respectively. If |dsa| is a public key, the private
 // key will be set to NULL.

data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/ec.h

@@ -223,8 +223,14 @@ OPENSSL_EXPORT int EC_POINT_get_affine_coordinates_GFp(const EC_GROUP *group,
 
 // EC_POINT_set_affine_coordinates_GFp sets the value of |point| to be
 // (|x|, |y|). The |ctx| argument may be used if not NULL. It returns one
-// on success or zero on error. Note that, unlike with OpenSSL, it's
-// considered an error if the point is not on the curve.
+// on success or zero on error. It's considered an error if the point is not on
+// the curve.
+//
+// Note that the corresponding function in OpenSSL versions prior to 1.0.2s does
+// not check if the point is on the curve. This is a security-critical check, so
+// code additionally supporting OpenSSL should repeat the check with
+// |EC_POINT_is_on_curve| or check for older OpenSSL versions with
+// |OPENSSL_VERSION_NUMBER|.
 OPENSSL_EXPORT int EC_POINT_set_affine_coordinates_GFp(const EC_GROUP *group,
                                                        EC_POINT *point,
                                                        const BIGNUM *x,
@@ -248,8 +254,9 @@ OPENSSL_EXPORT int EC_POINT_point2cbb(CBB *out, const EC_GROUP *group,
                                       BN_CTX *ctx);
 
 // EC_POINT_oct2point sets |point| from |len| bytes of X9.62 format
-// serialisation in |buf|. It returns one on success and zero otherwise. The
-// |ctx| argument may be used if not NULL.
+// serialisation in |buf|. It returns one on success and zero on error. The
+// |ctx| argument may be used if not NULL. It's considered an error if |buf|
+// does not represent a point on the curve.
 OPENSSL_EXPORT int EC_POINT_oct2point(const EC_GROUP *group, EC_POINT *point,
                                       const uint8_t *buf, size_t len,
                                       BN_CTX *ctx);

data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/ec_key.h

@@ -172,7 +172,8 @@ OPENSSL_EXPORT int EC_KEY_check_key(const EC_KEY *key);
 OPENSSL_EXPORT int EC_KEY_check_fips(const EC_KEY *key);
 
 // EC_KEY_set_public_key_affine_coordinates sets the public key in |key| to
-// (|x|, |y|). It returns one on success and zero otherwise.
+// (|x|, |y|). It returns one on success and zero on error. It's considered an
+// error if |x| and |y| do not represent a point on |key|'s curve.
 OPENSSL_EXPORT int EC_KEY_set_public_key_affine_coordinates(EC_KEY *key,
                                                             const BIGNUM *x,
                                                             const BIGNUM *y);
@@ -180,7 +181,8 @@ OPENSSL_EXPORT int EC_KEY_set_public_key_affine_coordinates(EC_KEY *key,
 // EC_KEY_key2buf encodes the public key in |key| to an allocated octet string
 // and sets |*out_buf| to point to it. It returns the length of the encoded
 // octet string or zero if an error occurred.
-OPENSSL_EXPORT size_t EC_KEY_key2buf(EC_KEY *key, point_conversion_form_t form,
+OPENSSL_EXPORT size_t EC_KEY_key2buf(const EC_KEY *key,
+                                     point_conversion_form_t form,
                                      unsigned char **out_buf, BN_CTX *ctx);
 
 

data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/ecdsa.h

@@ -106,6 +106,12 @@ OPENSSL_EXPORT ECDSA_SIG *ECDSA_SIG_new(void);
 // ECDSA_SIG_free frees |sig| its member |BIGNUM|s.
 OPENSSL_EXPORT void ECDSA_SIG_free(ECDSA_SIG *sig);
 
+// ECDSA_SIG_get0_r returns the r component of |sig|.
+OPENSSL_EXPORT const BIGNUM *ECDSA_SIG_get0_r(const ECDSA_SIG *sig);
+
+// ECDSA_SIG_get0_s returns the s component of |sig|.
+OPENSSL_EXPORT const BIGNUM *ECDSA_SIG_get0_s(const ECDSA_SIG *sig);
+
 // ECDSA_SIG_get0 sets |*out_r| and |*out_s|, if non-NULL, to the two
 // components of |sig|.
 OPENSSL_EXPORT void ECDSA_SIG_get0(const ECDSA_SIG *sig, const BIGNUM **out_r,

data/third_party/{boringssl → boringssl-with-bazel/src}/include/openssl/err.h

@@ -209,9 +209,9 @@ OPENSSL_EXPORT uint32_t ERR_peek_last_error_line_data(const char **file,
                                                       int *flags);
 
 // ERR_error_string_n generates a human-readable string representing
-// |packed_error| and places it at |buf|. It writes at most |len| bytes
-// (including the terminating NUL) and truncates the string if necessary. If
-// |len| is greater than zero then |buf| is always NUL terminated.
+// |packed_error|, places it at |buf|, and returns |buf|. It writes at most
+// |len| bytes (including the terminating NUL) and truncates the string if
+// necessary. If |len| is greater than zero then |buf| is always NUL terminated.
 //
 // The string will have the following format:
 //
@@ -219,8 +219,8 @@ OPENSSL_EXPORT uint32_t ERR_peek_last_error_line_data(const char **file,
 //
 // error code is an 8 digit hexadecimal number; library name and reason string
 // are ASCII text.
-OPENSSL_EXPORT void ERR_error_string_n(uint32_t packed_error, char *buf,
-                                       size_t len);
+OPENSSL_EXPORT char *ERR_error_string_n(uint32_t packed_error, char *buf,
+                                        size_t len);
 
 // ERR_lib_error_string returns a string representation of the library that
 // generated |packed_error|.
@@ -319,6 +319,7 @@ enum {
   ERR_LIB_DIGEST,
   ERR_LIB_CIPHER,
   ERR_LIB_HKDF,
+  ERR_LIB_TRUST_TOKEN,
   ERR_LIB_USER,
   ERR_NUM_LIBS
 };
@@ -362,6 +363,7 @@ enum {
 #define ERR_R_DIGEST_LIB ERR_LIB_DIGEST
 #define ERR_R_CIPHER_LIB ERR_LIB_CIPHER
 #define ERR_R_HKDF_LIB ERR_LIB_HKDF
+#define ERR_R_TRUST_TOKEN_LIB ERR_LIB_TRUST_TOKEN
 
 // The following values are global reason codes. They may occur in any library.
 #define ERR_R_FATAL 64
@@ -389,10 +391,12 @@ OPENSSL_EXPORT void ERR_remove_thread_state(const CRYPTO_THREADID *tid);
 OPENSSL_EXPORT const char *ERR_func_error_string(uint32_t packed_error);
 
 // ERR_error_string behaves like |ERR_error_string_n| but |len| is implicitly
-// |ERR_ERROR_STRING_BUF_LEN| and it returns |buf|. If |buf| is NULL, the error
-// string is placed in a static buffer which is returned. (The static buffer may
-// be overridden by concurrent calls in other threads so this form should not be
-// used.)
+// |ERR_ERROR_STRING_BUF_LEN|.
+//
+// Additionally, if |buf| is NULL, the error string is placed in a static buffer
+// which is returned. This is not thread-safe and only exists for backwards
+// compatibility with legacy callers. The static buffer will be overridden by
+// calls in other threads.
 //
 // Use |ERR_error_string_n| instead.
 //