grpc 1.35.0 → 1.36.0

data/third_party/boringssl-with-bazel/src/ssl/tls13_client.cc

@@ -414,8 +414,8 @@ static enum ssl_hs_wait_t do_read_server_hello(SSL_HANDSHAKE *hs) {
   // Set up the key schedule and incorporate the PSK into the running secret.
   if (ssl->s3->session_reused) {
     if (!tls13_init_key_schedule(
-            hs, MakeConstSpan(hs->new_session->master_key,
-                              hs->new_session->master_key_length))) {
+            hs, MakeConstSpan(hs->new_session->secret,
+                              hs->new_session->secret_length))) {
       return ssl_hs_error;
     }
   } else if (!tls13_init_key_schedule(hs, MakeConstSpan(kZeroes, hash_len))) {

data/third_party/boringssl-with-bazel/src/ssl/tls13_enc.cc

@@ -303,10 +303,9 @@ bool tls13_derive_resumption_secret(SSL_HANDSHAKE *hs) {
     OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
     return false;
   }
-  hs->new_session->master_key_length = hs->transcript.DigestLen();
+  hs->new_session->secret_length = hs->transcript.DigestLen();
   return derive_secret(
-      hs,
-      MakeSpan(hs->new_session->master_key, hs->new_session->master_key_length),
+      hs, MakeSpan(hs->new_session->secret, hs->new_session->secret_length),
       label_to_span(kTLS13LabelResumption));
 }
 
@@ -354,8 +353,8 @@ bool tls13_derive_session_psk(SSL_SESSION *session, Span<const uint8_t> nonce) {
   const EVP_MD *digest = ssl_session_get_digest(session);
   // The session initially stores the resumption_master_secret, which we
   // override with the PSK.
-  auto session_key = MakeSpan(session->master_key, session->master_key_length);
-  return hkdf_expand_label(session_key, digest, session_key,
+  auto session_secret = MakeSpan(session->secret, session->secret_length);
+  return hkdf_expand_label(session_secret, digest, session_secret,
                            label_to_span(kTLS13LabelResumptionPSK), nonce);
 }
 
@@ -460,11 +459,10 @@ bool tls13_write_psk_binder(SSL_HANDSHAKE *hs, Span<uint8_t> msg) {
   if (!hash_transcript_and_truncated_client_hello(
           hs, context, &context_len, digest, msg,
           1 /* length prefix */ + hash_len) ||
-      !tls13_psk_binder(verify_data, &verify_data_len,
-                        ssl->session->ssl_version, digest,
-                        MakeConstSpan(ssl->session->master_key,
-                                      ssl->session->master_key_length),
-                        MakeConstSpan(context, context_len)) ||
+      !tls13_psk_binder(
+          verify_data, &verify_data_len, ssl->session->ssl_version, digest,
+          MakeConstSpan(ssl->session->secret, ssl->session->secret_length),
+          MakeConstSpan(context, context_len)) ||
       verify_data_len != hash_len) {
     OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
     return false;
@@ -485,11 +483,10 @@ bool tls13_verify_psk_binder(SSL_HANDSHAKE *hs, SSL_SESSION *session,
   if (!hash_transcript_and_truncated_client_hello(hs, context, &context_len,
                                                   hs->transcript.Digest(),
                                                   msg.raw, CBS_len(binders)) ||
-      !tls13_psk_binder(
-          verify_data, &verify_data_len, hs->ssl->version,
-          hs->transcript.Digest(),
-          MakeConstSpan(session->master_key, session->master_key_length),
-          MakeConstSpan(context, context_len)) ||
+      !tls13_psk_binder(verify_data, &verify_data_len, hs->ssl->version,
+                        hs->transcript.Digest(),
+                        MakeConstSpan(session->secret, session->secret_length),
+                        MakeConstSpan(context, context_len)) ||
       // We only consider the first PSK, so compare against the first binder.
       !CBS_get_u8_length_prefixed(binders, &binder)) {
     OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
@@ -510,4 +507,40 @@ bool tls13_verify_psk_binder(SSL_HANDSHAKE *hs, SSL_SESSION *session,
   return true;
 }
 
+bool tls13_ech_accept_confirmation(
+    SSL_HANDSHAKE *hs, bssl::Span<uint8_t> out,
+    bssl::Span<const uint8_t> server_hello_ech_conf) {
+  // Compute the hash of the transcript concatenated with
+  // |server_hello_ech_conf| without modifying |hs->transcript|.
+  uint8_t context_hash[EVP_MAX_MD_SIZE];
+  unsigned context_hash_len;
+  ScopedEVP_MD_CTX ctx;
+  if (!hs->transcript.CopyToHashContext(ctx.get(), hs->transcript.Digest()) ||
+      !EVP_DigestUpdate(ctx.get(), server_hello_ech_conf.data(),
+                        server_hello_ech_conf.size()) ||
+      !EVP_DigestFinal_ex(ctx.get(), context_hash, &context_hash_len)) {
+    return false;
+  }
+
+  // Per draft-ietf-tls-esni-09, accept_confirmation is computed with
+  // Derive-Secret, which derives a secret of size Hash.length. That value is
+  // then truncated to the first 8 bytes. Note this differs from deriving an
+  // 8-byte secret because the target length is included in the derivation.
+  uint8_t accept_confirmation_buf[EVP_MAX_MD_SIZE];
+  bssl::Span<uint8_t> accept_confirmation =
+      MakeSpan(accept_confirmation_buf, hs->transcript.DigestLen());
+  if (!hkdf_expand_label(accept_confirmation, hs->transcript.Digest(),
+                         hs->secret(), label_to_span("ech accept confirmation"),
+                         MakeConstSpan(context_hash, context_hash_len))) {
+    return false;
+  }
+
+  if (out.size() > accept_confirmation.size()) {
+    OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
+    return false;
+  }
+  OPENSSL_memcpy(out.data(), accept_confirmation.data(), out.size());
+  return true;
+}
+
 BSSL_NAMESPACE_END

data/third_party/boringssl-with-bazel/src/ssl/tls13_server.cc

@@ -477,8 +477,8 @@ static enum ssl_hs_wait_t do_select_session(SSL_HANDSHAKE *hs) {
   // Set up the key schedule and incorporate the PSK into the running secret.
   if (ssl->s3->session_reused) {
     if (!tls13_init_key_schedule(
-            hs, MakeConstSpan(hs->new_session->master_key,
-                              hs->new_session->master_key_length))) {
+            hs, MakeConstSpan(hs->new_session->secret,
+                              hs->new_session->secret_length))) {
       return ssl_hs_error;
     }
   } else if (!tls13_init_key_schedule(hs, MakeConstSpan(kZeroes, hash_len))) {
@@ -636,20 +636,58 @@ static enum ssl_hs_wait_t do_read_second_client_hello(SSL_HANDSHAKE *hs) {
 static enum ssl_hs_wait_t do_send_server_hello(SSL_HANDSHAKE *hs) {
   SSL *const ssl = hs->ssl;
 
+  Span<uint8_t> random(ssl->s3->server_random);
+  RAND_bytes(random.data(), random.size());
+
+  // If the ClientHello has an ech_is_inner extension, we must be the ECH
+  // backend server. In response to ech_is_inner, we will overwrite part of the
+  // ServerHello.random with the ECH acceptance confirmation.
+  if (hs->ech_is_inner_present) {
+    // Construct the ServerHelloECHConf message, which is the same as
+    // ServerHello, except the last 8 bytes of its random field are zeroed out.
+    Span<uint8_t> random_suffix = random.subspan(24);
+    OPENSSL_memset(random_suffix.data(), 0, random_suffix.size());
+
+    ScopedCBB cbb;
+    CBB body, extensions, session_id;
+    if (!ssl->method->init_message(ssl, cbb.get(), &body,
+                                   SSL3_MT_SERVER_HELLO) ||
+        !CBB_add_u16(&body, TLS1_2_VERSION) ||
+        !CBB_add_bytes(&body, random.data(), random.size()) ||
+        !CBB_add_u8_length_prefixed(&body, &session_id) ||
+        !CBB_add_bytes(&session_id, hs->session_id, hs->session_id_len) ||
+        !CBB_add_u16(&body, SSL_CIPHER_get_protocol_id(hs->new_cipher)) ||
+        !CBB_add_u8(&body, 0) ||
+        !CBB_add_u16_length_prefixed(&body, &extensions) ||
+        !ssl_ext_pre_shared_key_add_serverhello(hs, &extensions) ||
+        !ssl_ext_key_share_add_serverhello(hs, &extensions, /*dry_run=*/true) ||
+        !ssl_ext_supported_versions_add_serverhello(hs, &extensions) ||
+        !CBB_flush(cbb.get())) {
+      return ssl_hs_error;
+    }
+
+    // Note that |cbb| includes the message type and length fields, but not the
+    // record layer header.
+    if (!tls13_ech_accept_confirmation(
+            hs, random_suffix,
+            bssl::MakeConstSpan(CBB_data(cbb.get()), CBB_len(cbb.get())))) {
+      return ssl_hs_error;
+    }
+  }
+
   // Send a ServerHello.
   ScopedCBB cbb;
   CBB body, extensions, session_id;
   if (!ssl->method->init_message(ssl, cbb.get(), &body, SSL3_MT_SERVER_HELLO) ||
       !CBB_add_u16(&body, TLS1_2_VERSION) ||
-      !RAND_bytes(ssl->s3->server_random, sizeof(ssl->s3->server_random)) ||
-      !CBB_add_bytes(&body, ssl->s3->server_random, SSL3_RANDOM_SIZE) ||
+      !CBB_add_bytes(&body, random.data(), random.size()) ||
       !CBB_add_u8_length_prefixed(&body, &session_id) ||
       !CBB_add_bytes(&session_id, hs->session_id, hs->session_id_len) ||
       !CBB_add_u16(&body, SSL_CIPHER_get_protocol_id(hs->new_cipher)) ||
       !CBB_add_u8(&body, 0) ||
       !CBB_add_u16_length_prefixed(&body, &extensions) ||
       !ssl_ext_pre_shared_key_add_serverhello(hs, &extensions) ||
-      !ssl_ext_key_share_add_serverhello(hs, &extensions) ||
+      !ssl_ext_key_share_add_serverhello(hs, &extensions, /*dry_run=*/false) ||
       !ssl_ext_supported_versions_add_serverhello(hs, &extensions) ||
       !ssl_add_message_cbb(ssl, cbb.get())) {
     return ssl_hs_error;
@@ -844,7 +882,7 @@ static enum ssl_hs_wait_t do_read_second_client_flight(SSL_HANDSHAKE *hs) {
                                hs->client_handshake_secret())) {
       return ssl_hs_error;
     }
-    hs->tls13_state = state13_read_client_certificate;
+    hs->tls13_state = state13_process_end_of_early_data;
     return ssl->s3->early_data_accepted ? ssl_hs_early_return : ssl_hs_ok;
   }
 
@@ -855,27 +893,31 @@ static enum ssl_hs_wait_t do_read_second_client_flight(SSL_HANDSHAKE *hs) {
 
 static enum ssl_hs_wait_t do_process_end_of_early_data(SSL_HANDSHAKE *hs) {
   SSL *const ssl = hs->ssl;
-  // If early data was not accepted, the EndOfEarlyData will be in the discarded
-  // early data.
-  if (hs->ssl->s3->early_data_accepted) {
-    SSLMessage msg;
-    if (!ssl->method->get_message(ssl, &msg)) {
-      return ssl_hs_read_message;
-    }
-    if (!ssl_check_message_type(ssl, msg, SSL3_MT_END_OF_EARLY_DATA)) {
-      return ssl_hs_error;
+  // In protocols that use EndOfEarlyData, we must consume the extra message and
+  // switch to client_handshake_secret after the early return.
+  if (ssl->quic_method == nullptr) {
+    // If early data was not accepted, the EndOfEarlyData will be in the
+    // discarded early data.
+    if (hs->ssl->s3->early_data_accepted) {
+      SSLMessage msg;
+      if (!ssl->method->get_message(ssl, &msg)) {
+        return ssl_hs_read_message;
+      }
+      if (!ssl_check_message_type(ssl, msg, SSL3_MT_END_OF_EARLY_DATA)) {
+        return ssl_hs_error;
+      }
+      if (CBS_len(&msg.body) != 0) {
+        ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
+        OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
+        return ssl_hs_error;
+      }
+      ssl->method->next_message(ssl);
     }
-    if (CBS_len(&msg.body) != 0) {
-      ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
-      OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
+    if (!tls13_set_traffic_key(ssl, ssl_encryption_handshake, evp_aead_open,
+                               hs->new_session.get(),
+                               hs->client_handshake_secret())) {
       return ssl_hs_error;
     }
-    ssl->method->next_message(ssl);
-  }
-  if (!tls13_set_traffic_key(ssl, ssl_encryption_handshake, evp_aead_open,
-                             hs->new_session.get(),
-                             hs->client_handshake_secret())) {
-    return ssl_hs_error;
   }
   hs->tls13_state = state13_read_client_encrypted_extensions;
   return ssl_hs_ok;

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: grpc
 version: !ruby/object:Gem::Version
-  version: 1.35.0
+  version: 1.36.0
 platform: ruby
 authors:
 - gRPC Authors
 autorequire: 
 bindir: src/ruby/bin
 cert_chain: []
-date: 2021-01-19 00:00:00.000000000 Z
+date: 2021-02-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: google-protobuf
@@ -346,6 +346,7 @@ files:
 - src/core/ext/filters/client_channel/resolver/dns/native/dns_resolver.cc
 - src/core/ext/filters/client_channel/resolver/fake/fake_resolver.cc
 - src/core/ext/filters/client_channel/resolver/fake/fake_resolver.h
+- src/core/ext/filters/client_channel/resolver/google_c2p/google_c2p_resolver.cc
 - src/core/ext/filters/client_channel/resolver/sockaddr/sockaddr_resolver.cc
 - src/core/ext/filters/client_channel/resolver/xds/xds_resolver.cc
 - src/core/ext/filters/client_channel/resolver/xds/xds_resolver.h
@@ -516,6 +517,8 @@ files:
 - src/core/ext/upb-generated/envoy/config/route/v3/scoped_route.upb.h
 - src/core/ext/upb-generated/envoy/config/trace/v3/http_tracer.upb.c
 - src/core/ext/upb-generated/envoy/config/trace/v3/http_tracer.upb.h
+- src/core/ext/upb-generated/envoy/extensions/clusters/aggregate/v3/cluster.upb.c
+- src/core/ext/upb-generated/envoy/extensions/clusters/aggregate/v3/cluster.upb.h
 - src/core/ext/upb-generated/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.upb.c
 - src/core/ext/upb-generated/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.upb.h
 - src/core/ext/upb-generated/envoy/extensions/transport_sockets/tls/v3/cert.upb.c
@@ -610,22 +613,22 @@ files:
 - src/core/ext/upb-generated/udpa/annotations/status.upb.h
 - src/core/ext/upb-generated/udpa/annotations/versioning.upb.c
 - src/core/ext/upb-generated/udpa/annotations/versioning.upb.h
-- src/core/ext/upb-generated/udpa/core/v1/authority.upb.c
-- src/core/ext/upb-generated/udpa/core/v1/authority.upb.h
-- src/core/ext/upb-generated/udpa/core/v1/collection_entry.upb.c
-- src/core/ext/upb-generated/udpa/core/v1/collection_entry.upb.h
-- src/core/ext/upb-generated/udpa/core/v1/context_params.upb.c
-- src/core/ext/upb-generated/udpa/core/v1/context_params.upb.h
-- src/core/ext/upb-generated/udpa/core/v1/resource.upb.c
-- src/core/ext/upb-generated/udpa/core/v1/resource.upb.h
-- src/core/ext/upb-generated/udpa/core/v1/resource_locator.upb.c
-- src/core/ext/upb-generated/udpa/core/v1/resource_locator.upb.h
-- src/core/ext/upb-generated/udpa/core/v1/resource_name.upb.c
-- src/core/ext/upb-generated/udpa/core/v1/resource_name.upb.h
 - src/core/ext/upb-generated/udpa/data/orca/v1/orca_load_report.upb.c
 - src/core/ext/upb-generated/udpa/data/orca/v1/orca_load_report.upb.h
 - src/core/ext/upb-generated/validate/validate.upb.c
 - src/core/ext/upb-generated/validate/validate.upb.h
+- src/core/ext/upb-generated/xds/core/v3/authority.upb.c
+- src/core/ext/upb-generated/xds/core/v3/authority.upb.h
+- src/core/ext/upb-generated/xds/core/v3/collection_entry.upb.c
+- src/core/ext/upb-generated/xds/core/v3/collection_entry.upb.h
+- src/core/ext/upb-generated/xds/core/v3/context_params.upb.c
+- src/core/ext/upb-generated/xds/core/v3/context_params.upb.h
+- src/core/ext/upb-generated/xds/core/v3/resource.upb.c
+- src/core/ext/upb-generated/xds/core/v3/resource.upb.h
+- src/core/ext/upb-generated/xds/core/v3/resource_locator.upb.c
+- src/core/ext/upb-generated/xds/core/v3/resource_locator.upb.h
+- src/core/ext/upb-generated/xds/core/v3/resource_name.upb.c
+- src/core/ext/upb-generated/xds/core/v3/resource_name.upb.h
 - src/core/ext/upbdefs-generated/envoy/annotations/deprecation.upbdefs.c
 - src/core/ext/upbdefs-generated/envoy/annotations/deprecation.upbdefs.h
 - src/core/ext/upbdefs-generated/envoy/annotations/resource.upbdefs.c
@@ -688,6 +691,8 @@ files:
 - src/core/ext/upbdefs-generated/envoy/config/route/v3/scoped_route.upbdefs.h
 - src/core/ext/upbdefs-generated/envoy/config/trace/v3/http_tracer.upbdefs.c
 - src/core/ext/upbdefs-generated/envoy/config/trace/v3/http_tracer.upbdefs.h
+- src/core/ext/upbdefs-generated/envoy/extensions/clusters/aggregate/v3/cluster.upbdefs.c
+- src/core/ext/upbdefs-generated/envoy/extensions/clusters/aggregate/v3/cluster.upbdefs.h
 - src/core/ext/upbdefs-generated/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.upbdefs.c
 - src/core/ext/upbdefs-generated/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.upbdefs.h
 - src/core/ext/upbdefs-generated/envoy/extensions/transport_sockets/tls/v3/cert.upbdefs.c
@@ -768,20 +773,20 @@ files:
 - src/core/ext/upbdefs-generated/udpa/annotations/status.upbdefs.h
 - src/core/ext/upbdefs-generated/udpa/annotations/versioning.upbdefs.c
 - src/core/ext/upbdefs-generated/udpa/annotations/versioning.upbdefs.h
-- src/core/ext/upbdefs-generated/udpa/core/v1/authority.upbdefs.c
-- src/core/ext/upbdefs-generated/udpa/core/v1/authority.upbdefs.h
-- src/core/ext/upbdefs-generated/udpa/core/v1/collection_entry.upbdefs.c
-- src/core/ext/upbdefs-generated/udpa/core/v1/collection_entry.upbdefs.h
-- src/core/ext/upbdefs-generated/udpa/core/v1/context_params.upbdefs.c
-- src/core/ext/upbdefs-generated/udpa/core/v1/context_params.upbdefs.h
-- src/core/ext/upbdefs-generated/udpa/core/v1/resource.upbdefs.c
-- src/core/ext/upbdefs-generated/udpa/core/v1/resource.upbdefs.h
-- src/core/ext/upbdefs-generated/udpa/core/v1/resource_locator.upbdefs.c
-- src/core/ext/upbdefs-generated/udpa/core/v1/resource_locator.upbdefs.h
-- src/core/ext/upbdefs-generated/udpa/core/v1/resource_name.upbdefs.c
-- src/core/ext/upbdefs-generated/udpa/core/v1/resource_name.upbdefs.h
 - src/core/ext/upbdefs-generated/validate/validate.upbdefs.c
 - src/core/ext/upbdefs-generated/validate/validate.upbdefs.h
+- src/core/ext/upbdefs-generated/xds/core/v3/authority.upbdefs.c
+- src/core/ext/upbdefs-generated/xds/core/v3/authority.upbdefs.h
+- src/core/ext/upbdefs-generated/xds/core/v3/collection_entry.upbdefs.c
+- src/core/ext/upbdefs-generated/xds/core/v3/collection_entry.upbdefs.h
+- src/core/ext/upbdefs-generated/xds/core/v3/context_params.upbdefs.c
+- src/core/ext/upbdefs-generated/xds/core/v3/context_params.upbdefs.h
+- src/core/ext/upbdefs-generated/xds/core/v3/resource.upbdefs.c
+- src/core/ext/upbdefs-generated/xds/core/v3/resource.upbdefs.h
+- src/core/ext/upbdefs-generated/xds/core/v3/resource_locator.upbdefs.c
+- src/core/ext/upbdefs-generated/xds/core/v3/resource_locator.upbdefs.h
+- src/core/ext/upbdefs-generated/xds/core/v3/resource_name.upbdefs.c
+- src/core/ext/upbdefs-generated/xds/core/v3/resource_name.upbdefs.h
 - src/core/ext/xds/certificate_provider_factory.h
 - src/core/ext/xds/certificate_provider_registry.cc
 - src/core/ext/xds/certificate_provider_registry.h
@@ -924,6 +929,8 @@ files:
 - src/core/lib/gprpp/thd.h
 - src/core/lib/gprpp/thd_posix.cc
 - src/core/lib/gprpp/thd_windows.cc
+- src/core/lib/gprpp/time_util.cc
+- src/core/lib/gprpp/time_util.h
 - src/core/lib/http/format_request.cc
 - src/core/lib/http/format_request.h
 - src/core/lib/http/httpcli.cc
@@ -995,7 +1002,6 @@ files:
 - src/core/lib/iomgr/iomgr_internal.cc
 - src/core/lib/iomgr/iomgr_internal.h
 - src/core/lib/iomgr/iomgr_posix.cc
-- src/core/lib/iomgr/iomgr_posix.h
 - src/core/lib/iomgr/iomgr_posix_cfstream.cc
 - src/core/lib/iomgr/iomgr_uv.cc
 - src/core/lib/iomgr/iomgr_windows.cc
@@ -1117,6 +1123,8 @@ files:
 - src/core/lib/security/authorization/authorization_engine.h
 - src/core/lib/security/authorization/evaluate_args.cc
 - src/core/lib/security/authorization/evaluate_args.h
+- src/core/lib/security/authorization/matchers.cc
+- src/core/lib/security/authorization/matchers.h
 - src/core/lib/security/authorization/mock_cel/activation.h
 - src/core/lib/security/authorization/mock_cel/cel_expr_builder_factory.h
 - src/core/lib/security/authorization/mock_cel/cel_expression.h
@@ -1747,6 +1755,7 @@ files:
 - third_party/boringssl-with-bazel/src/crypto/bio/printf.c
 - third_party/boringssl-with-bazel/src/crypto/bio/socket.c
 - third_party/boringssl-with-bazel/src/crypto/bio/socket_helper.c
+- third_party/boringssl-with-bazel/src/crypto/blake2/blake2.c
 - third_party/boringssl-with-bazel/src/crypto/bn_extra/bn_asn1.c
 - third_party/boringssl-with-bazel/src/crypto/bn_extra/convert.c
 - third_party/boringssl-with-bazel/src/crypto/buf/buf.c
@@ -1776,6 +1785,7 @@ files:
 - third_party/boringssl-with-bazel/src/crypto/conf/internal.h
 - third_party/boringssl-with-bazel/src/crypto/cpu-aarch64-fuchsia.c
 - third_party/boringssl-with-bazel/src/crypto/cpu-aarch64-linux.c
+- third_party/boringssl-with-bazel/src/crypto/cpu-aarch64-win.c
 - third_party/boringssl-with-bazel/src/crypto/cpu-arm-linux.c
 - third_party/boringssl-with-bazel/src/crypto/cpu-arm-linux.h
 - third_party/boringssl-with-bazel/src/crypto/cpu-arm.c
@@ -1786,10 +1796,8 @@ files:
 - third_party/boringssl-with-bazel/src/crypto/curve25519/curve25519_tables.h
 - third_party/boringssl-with-bazel/src/crypto/curve25519/internal.h
 - third_party/boringssl-with-bazel/src/crypto/curve25519/spake25519.c
-- third_party/boringssl-with-bazel/src/crypto/dh/check.c
-- third_party/boringssl-with-bazel/src/crypto/dh/dh.c
-- third_party/boringssl-with-bazel/src/crypto/dh/dh_asn1.c
-- third_party/boringssl-with-bazel/src/crypto/dh/params.c
+- third_party/boringssl-with-bazel/src/crypto/dh_extra/dh_asn1.c
+- third_party/boringssl-with-bazel/src/crypto/dh_extra/params.c
 - third_party/boringssl-with-bazel/src/crypto/digest_extra/digest_extra.c
 - third_party/boringssl-with-bazel/src/crypto/dsa/dsa.c
 - third_party/boringssl-with-bazel/src/crypto/dsa/dsa_asn1.c
@@ -1859,6 +1867,8 @@ files:
 - third_party/boringssl-with-bazel/src/crypto/fipsmodule/delocate.h
 - third_party/boringssl-with-bazel/src/crypto/fipsmodule/des/des.c
 - third_party/boringssl-with-bazel/src/crypto/fipsmodule/des/internal.h
+- third_party/boringssl-with-bazel/src/crypto/fipsmodule/dh/check.c
+- third_party/boringssl-with-bazel/src/crypto/fipsmodule/dh/dh.c
 - third_party/boringssl-with-bazel/src/crypto/fipsmodule/digest/digest.c
 - third_party/boringssl-with-bazel/src/crypto/fipsmodule/digest/digests.c
 - third_party/boringssl-with-bazel/src/crypto/fipsmodule/digest/internal.h
@@ -1951,6 +1961,7 @@ files:
 - third_party/boringssl-with-bazel/src/crypto/rand_extra/deterministic.c
 - third_party/boringssl-with-bazel/src/crypto/rand_extra/forkunsafe.c
 - third_party/boringssl-with-bazel/src/crypto/rand_extra/fuchsia.c
+- third_party/boringssl-with-bazel/src/crypto/rand_extra/passive.c
 - third_party/boringssl-with-bazel/src/crypto/rand_extra/rand_extra.c
 - third_party/boringssl-with-bazel/src/crypto/rand_extra/windows.c
 - third_party/boringssl-with-bazel/src/crypto/rc4/rc4.c
@@ -2063,6 +2074,7 @@ files:
 - third_party/boringssl-with-bazel/src/include/openssl/base.h
 - third_party/boringssl-with-bazel/src/include/openssl/base64.h
 - third_party/boringssl-with-bazel/src/include/openssl/bio.h
+- third_party/boringssl-with-bazel/src/include/openssl/blake2.h
 - third_party/boringssl-with-bazel/src/include/openssl/blowfish.h
 - third_party/boringssl-with-bazel/src/include/openssl/bn.h
 - third_party/boringssl-with-bazel/src/include/openssl/buf.h
@@ -2366,58 +2378,58 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.3.0
+      version: 2.4.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.6
+rubygems_version: 3.2.11
 signing_key: 
 specification_version: 4
 summary: GRPC system in Ruby
 test_files:
-- src/ruby/spec/generic/server_interceptors_spec.rb
-- src/ruby/spec/generic/client_interceptors_spec.rb
-- src/ruby/spec/generic/service_spec.rb
-- src/ruby/spec/generic/client_stub_spec.rb
-- src/ruby/spec/generic/interceptor_registry_spec.rb
-- src/ruby/spec/generic/rpc_server_spec.rb
-- src/ruby/spec/generic/rpc_server_pool_spec.rb
-- src/ruby/spec/generic/rpc_desc_spec.rb
-- src/ruby/spec/generic/active_call_spec.rb
-- src/ruby/spec/channel_credentials_spec.rb
-- src/ruby/spec/channel_connection_spec.rb
+- src/ruby/spec/client_server_spec.rb
+- src/ruby/spec/debug_message_spec.rb
 - src/ruby/spec/user_agent_spec.rb
-- src/ruby/spec/errors_spec.rb
-- src/ruby/spec/google_rpc_status_utils_spec.rb
-- src/ruby/spec/client_auth_spec.rb
-- src/ruby/spec/server_credentials_spec.rb
 - src/ruby/spec/support/helpers.rb
 - src/ruby/spec/support/services.rb
+- src/ruby/spec/client_auth_spec.rb
+- src/ruby/spec/channel_connection_spec.rb
+- src/ruby/spec/errors_spec.rb
 - src/ruby/spec/spec_helper.rb
+- src/ruby/spec/error_sanity_spec.rb
+- src/ruby/spec/server_credentials_spec.rb
+- src/ruby/spec/testdata/client.pem
+- src/ruby/spec/testdata/ca.pem
+- src/ruby/spec/testdata/server1.key
+- src/ruby/spec/testdata/client.key
+- src/ruby/spec/testdata/README
+- src/ruby/spec/testdata/server1.pem
+- src/ruby/spec/channel_credentials_spec.rb
+- src/ruby/spec/google_rpc_status_utils_spec.rb
+- src/ruby/spec/time_consts_spec.rb
+- src/ruby/spec/server_spec.rb
+- src/ruby/spec/call_spec.rb
+- src/ruby/spec/compression_options_spec.rb
+- src/ruby/spec/channel_spec.rb
 - src/ruby/spec/pb/duplicate/codegen_spec.rb
 - src/ruby/spec/pb/health/checker_spec.rb
 - src/ruby/spec/pb/codegen/package_option_spec.rb
 - src/ruby/spec/pb/codegen/grpc/testing/package_options_ruby_style.proto
-- src/ruby/spec/pb/codegen/grpc/testing/same_package_service_name.proto
 - src/ruby/spec/pb/codegen/grpc/testing/package_options_import2.proto
-- src/ruby/spec/pb/codegen/grpc/testing/same_ruby_package_service_name.proto
-- src/ruby/spec/pb/codegen/grpc/testing/package_options.proto
 - src/ruby/spec/pb/codegen/grpc/testing/package_options_import.proto
-- src/ruby/spec/testdata/README
-- src/ruby/spec/testdata/server1.pem
-- src/ruby/spec/testdata/server1.key
-- src/ruby/spec/testdata/client.key
-- src/ruby/spec/testdata/ca.pem
-- src/ruby/spec/testdata/client.pem
-- src/ruby/spec/compression_options_spec.rb
-- src/ruby/spec/server_spec.rb
+- src/ruby/spec/pb/codegen/grpc/testing/package_options.proto
+- src/ruby/spec/pb/codegen/grpc/testing/same_package_service_name.proto
+- src/ruby/spec/pb/codegen/grpc/testing/same_ruby_package_service_name.proto
 - src/ruby/spec/call_credentials_spec.rb
-- src/ruby/spec/debug_message_spec.rb
-- src/ruby/spec/error_sanity_spec.rb
-- src/ruby/spec/client_server_spec.rb
-- src/ruby/spec/time_consts_spec.rb
-- src/ruby/spec/channel_spec.rb
-- src/ruby/spec/call_spec.rb
+- src/ruby/spec/generic/server_interceptors_spec.rb
+- src/ruby/spec/generic/rpc_server_spec.rb
+- src/ruby/spec/generic/interceptor_registry_spec.rb
+- src/ruby/spec/generic/rpc_desc_spec.rb
+- src/ruby/spec/generic/rpc_server_pool_spec.rb
+- src/ruby/spec/generic/client_stub_spec.rb
+- src/ruby/spec/generic/client_interceptors_spec.rb
+- src/ruby/spec/generic/service_spec.rb
+- src/ruby/spec/generic/active_call_spec.rb