grpc 1.42.0 → 1.51.0

data/third_party/boringssl-with-bazel/src/include/openssl/rsa.h

@@ -526,44 +526,44 @@ OPENSSL_EXPORT int RSA_add_pkcs1_prefix(uint8_t **out_msg, size_t *out_msg_len,
 
 // ASN.1 functions.
 
-// RSA_parse_public_key parses a DER-encoded RSAPublicKey structure (RFC 3447)
+// RSA_parse_public_key parses a DER-encoded RSAPublicKey structure (RFC 8017)
 // from |cbs| and advances |cbs|. It returns a newly-allocated |RSA| or NULL on
 // error.
 OPENSSL_EXPORT RSA *RSA_parse_public_key(CBS *cbs);
 
 // RSA_public_key_from_bytes parses |in| as a DER-encoded RSAPublicKey structure
-// (RFC 3447). It returns a newly-allocated |RSA| or NULL on error.
+// (RFC 8017). It returns a newly-allocated |RSA| or NULL on error.
 OPENSSL_EXPORT RSA *RSA_public_key_from_bytes(const uint8_t *in, size_t in_len);
 
 // RSA_marshal_public_key marshals |rsa| as a DER-encoded RSAPublicKey structure
-// (RFC 3447) and appends the result to |cbb|. It returns one on success and
+// (RFC 8017) and appends the result to |cbb|. It returns one on success and
 // zero on failure.
 OPENSSL_EXPORT int RSA_marshal_public_key(CBB *cbb, const RSA *rsa);
 
 // RSA_public_key_to_bytes marshals |rsa| as a DER-encoded RSAPublicKey
-// structure (RFC 3447) and, on success, sets |*out_bytes| to a newly allocated
+// structure (RFC 8017) and, on success, sets |*out_bytes| to a newly allocated
 // buffer containing the result and returns one. Otherwise, it returns zero. The
 // result should be freed with |OPENSSL_free|.
 OPENSSL_EXPORT int RSA_public_key_to_bytes(uint8_t **out_bytes, size_t *out_len,
                                            const RSA *rsa);
 
-// RSA_parse_private_key parses a DER-encoded RSAPrivateKey structure (RFC 3447)
+// RSA_parse_private_key parses a DER-encoded RSAPrivateKey structure (RFC 8017)
 // from |cbs| and advances |cbs|. It returns a newly-allocated |RSA| or NULL on
 // error.
 OPENSSL_EXPORT RSA *RSA_parse_private_key(CBS *cbs);
 
 // RSA_private_key_from_bytes parses |in| as a DER-encoded RSAPrivateKey
-// structure (RFC 3447). It returns a newly-allocated |RSA| or NULL on error.
+// structure (RFC 8017). It returns a newly-allocated |RSA| or NULL on error.
 OPENSSL_EXPORT RSA *RSA_private_key_from_bytes(const uint8_t *in,
                                                size_t in_len);
 
 // RSA_marshal_private_key marshals |rsa| as a DER-encoded RSAPrivateKey
-// structure (RFC 3447) and appends the result to |cbb|. It returns one on
+// structure (RFC 8017) and appends the result to |cbb|. It returns one on
 // success and zero on failure.
 OPENSSL_EXPORT int RSA_marshal_private_key(CBB *cbb, const RSA *rsa);
 
 // RSA_private_key_to_bytes marshals |rsa| as a DER-encoded RSAPrivateKey
-// structure (RFC 3447) and, on success, sets |*out_bytes| to a newly allocated
+// structure (RFC 8017) and, on success, sets |*out_bytes| to a newly allocated
 // buffer containing the result and returns one. Otherwise, it returns zero. The
 // result should be freed with |OPENSSL_free|.
 OPENSSL_EXPORT int RSA_private_key_to_bytes(uint8_t **out_bytes,
@@ -625,32 +625,28 @@ OPENSSL_EXPORT int RSA_blinding_on(RSA *rsa, BN_CTX *ctx);
 OPENSSL_EXPORT RSA *RSA_generate_key(int bits, unsigned long e, void *callback,
                                      void *cb_arg);
 
-// d2i_RSAPublicKey parses an ASN.1, DER-encoded, RSA public key from |len|
-// bytes at |*inp|. If |out| is not NULL then, on exit, a pointer to the result
-// is in |*out|. Note that, even if |*out| is already non-NULL on entry, it
-// will not be written to. Rather, a fresh |RSA| is allocated and the previous
-// one is freed. On successful exit, |*inp| is advanced past the DER structure.
-// It returns the result or NULL on error.
+// d2i_RSAPublicKey parses a DER-encoded RSAPublicKey structure (RFC 8017) from
+// |len| bytes at |*inp|, as described in |d2i_SAMPLE|.
+//
+// Use |RSA_parse_public_key| instead.
 OPENSSL_EXPORT RSA *d2i_RSAPublicKey(RSA **out, const uint8_t **inp, long len);
 
-// i2d_RSAPublicKey marshals |in| to an ASN.1, DER structure. If |outp| is not
-// NULL then the result is written to |*outp| and |*outp| is advanced just past
-// the output. It returns the number of bytes in the result, whether written or
-// not, or a negative value on error.
+// i2d_RSAPublicKey marshals |in| to a DER-encoded RSAPublicKey structure (RFC
+// 8017), as described in |i2d_SAMPLE|.
+//
+// Use |RSA_marshal_public_key| instead.
 OPENSSL_EXPORT int i2d_RSAPublicKey(const RSA *in, uint8_t **outp);
 
-// d2i_RSAPrivateKey parses an ASN.1, DER-encoded, RSA private key from |len|
-// bytes at |*inp|. If |out| is not NULL then, on exit, a pointer to the result
-// is in |*out|. Note that, even if |*out| is already non-NULL on entry, it
-// will not be written to. Rather, a fresh |RSA| is allocated and the previous
-// one is freed. On successful exit, |*inp| is advanced past the DER structure.
-// It returns the result or NULL on error.
+// d2i_RSAPrivateKey parses a DER-encoded RSAPrivateKey structure (RFC 8017)
+// from |len| bytes at |*inp|, as described in |d2i_SAMPLE|.
+//
+// Use |RSA_parse_private_key| instead.
 OPENSSL_EXPORT RSA *d2i_RSAPrivateKey(RSA **out, const uint8_t **inp, long len);
 
-// i2d_RSAPrivateKey marshals |in| to an ASN.1, DER structure. If |outp| is not
-// NULL then the result is written to |*outp| and |*outp| is advanced just past
-// the output. It returns the number of bytes in the result, whether written or
-// not, or a negative value on error.
+// i2d_RSAPrivateKey marshals |in| to a DER-encoded RSAPrivateKey structure (RFC
+// 8017), as described in |i2d_SAMPLE|.
+//
+// Use |RSA_marshal_private_key| instead.
 OPENSSL_EXPORT int i2d_RSAPrivateKey(const RSA *in, uint8_t **outp);
 
 // RSA_padding_add_PKCS1_PSS acts like |RSA_padding_add_PKCS1_PSS_mgf1| but the

data/third_party/boringssl-with-bazel/src/include/openssl/ssl.h

@@ -362,10 +362,31 @@ OPENSSL_EXPORT int SSL_read(SSL *ssl, void *buf, int num);
 // SSL_peek behaves like |SSL_read| but does not consume any bytes returned.
 OPENSSL_EXPORT int SSL_peek(SSL *ssl, void *buf, int num);
 
-// SSL_pending returns the number of bytes available in |ssl|. It does not read
-// from the transport.
+// SSL_pending returns the number of buffered, decrypted bytes available for
+// read in |ssl|. It does not read from the transport.
+//
+// In DTLS, it is possible for this function to return zero while there is
+// buffered, undecrypted data from the transport in |ssl|. For example,
+// |SSL_read| may read a datagram with two records, decrypt the first, and leave
+// the second buffered for a subsequent call to |SSL_read|. Callers that wish to
+// detect this case can use |SSL_has_pending|.
 OPENSSL_EXPORT int SSL_pending(const SSL *ssl);
 
+// SSL_has_pending returns one if |ssl| has buffered, decrypted bytes available
+// for read, or if |ssl| has buffered data from the transport that has not yet
+// been decrypted. If |ssl| has neither, this function returns zero.
+//
+// In TLS, BoringSSL does not implement read-ahead, so this function returns one
+// if and only if |SSL_pending| would return a non-zero value. In DTLS, it is
+// possible for this function to return one while |SSL_pending| returns zero.
+// For example, |SSL_read| may read a datagram with two records, decrypt the
+// first, and leave the second buffered for a subsequent call to |SSL_read|.
+//
+// As a result, if this function returns one, the next call to |SSL_read| may
+// still fail, read from the transport, or both. The buffered, undecrypted data
+// may be invalid or incomplete.
+OPENSSL_EXPORT int SSL_has_pending(const SSL *ssl);
+
 // SSL_write writes up to |num| bytes from |buf| into |ssl|. It implicitly runs
 // any pending handshakes, including renegotiations when enabled. On success, it
 // returns the number of bytes written. Otherwise, it returns <= 0. The caller
@@ -3887,6 +3908,10 @@ OPENSSL_EXPORT uint64_t SSL_get_read_sequence(const SSL *ssl);
 // two most significant bytes.
 OPENSSL_EXPORT uint64_t SSL_get_write_sequence(const SSL *ssl);
 
+// SSL_CTX_set_record_protocol_version returns whether |version| is zero.
+OPENSSL_EXPORT int SSL_CTX_set_record_protocol_version(SSL_CTX *ctx,
+                                                       int version);
+
 
 // Handshake hints.
 //
@@ -4575,20 +4600,13 @@ OPENSSL_EXPORT int SSL_get_shared_sigalgs(SSL *ssl, int idx, int *psign,
 // SSL_MODE_HANDSHAKE_CUTTHROUGH is the same as SSL_MODE_ENABLE_FALSE_START.
 #define SSL_MODE_HANDSHAKE_CUTTHROUGH SSL_MODE_ENABLE_FALSE_START
 
-// i2d_SSL_SESSION serializes |in| to the bytes pointed to by |*pp|. On success,
-// it returns the number of bytes written and advances |*pp| by that many bytes.
-// On failure, it returns -1. If |pp| is NULL, no bytes are written and only the
-// length is returned.
+// i2d_SSL_SESSION serializes |in|, as described in |i2d_SAMPLE|.
 //
 // Use |SSL_SESSION_to_bytes| instead.
 OPENSSL_EXPORT int i2d_SSL_SESSION(SSL_SESSION *in, uint8_t **pp);
 
 // d2i_SSL_SESSION parses a serialized session from the |length| bytes pointed
-// to by |*pp|. It returns the new |SSL_SESSION| and advances |*pp| by the
-// number of bytes consumed on success and NULL on failure. The caller takes
-// ownership of the new session and must call |SSL_SESSION_free| when done.
-//
-// If |a| is non-NULL, |*a| is released and set the new |SSL_SESSION|.
+// to by |*pp|, as described in |d2i_SAMPLE|.
 //
 // Use |SSL_SESSION_from_bytes| instead.
 OPENSSL_EXPORT SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a, const uint8_t **pp,

data/third_party/boringssl-with-bazel/src/include/openssl/x509.h

@@ -82,7 +82,7 @@
 #include <openssl/thread.h>
 #include <time.h>
 
-#ifdef __cplusplus
+#if defined(__cplusplus)
 extern "C" {
 #endif
 
@@ -831,7 +831,6 @@ OPENSSL_EXPORT X509_REQ *X509_to_X509_REQ(X509 *x, EVP_PKEY *pkey,
                                           const EVP_MD *md);
 
 DECLARE_ASN1_ENCODE_FUNCTIONS(X509_ALGORS, X509_ALGORS, X509_ALGORS)
-DECLARE_ASN1_FUNCTIONS(X509_VAL)
 
 DECLARE_ASN1_FUNCTIONS(X509_PUBKEY)
 
@@ -885,28 +884,16 @@ OPENSSL_EXPORT int i2d_X509_AUX(X509 *a, unsigned char **pp);
 OPENSSL_EXPORT X509 *d2i_X509_AUX(X509 **a, const unsigned char **pp,
                                   long length);
 
-// i2d_re_X509_tbs serializes the TBSCertificate portion of |x509|. If |outp| is
-// NULL, nothing is written. Otherwise, if |*outp| is not NULL, the result is
-// written to |*outp|, which must have enough space available, and |*outp| is
-// advanced just past the output. If |outp| is non-NULL and |*outp| is NULL, it
-// sets |*outp| to a newly-allocated buffer containing the result. The caller is
-// responsible for releasing the buffer with |OPENSSL_free|. In all cases, this
-// function returns the number of bytes in the result, whether written or not,
-// or a negative value on error.
+// i2d_re_X509_tbs serializes the TBSCertificate portion of |x509|, as described
+// in |i2d_SAMPLE|.
 //
 // This function re-encodes the TBSCertificate and may not reflect |x509|'s
 // original encoding. It may be used to manually generate a signature for a new
 // certificate. To verify certificates, use |i2d_X509_tbs| instead.
 OPENSSL_EXPORT int i2d_re_X509_tbs(X509 *x509, unsigned char **outp);
 
-// i2d_X509_tbs serializes the TBSCertificate portion of |x509|. If |outp| is
-// NULL, nothing is written. Otherwise, if |*outp| is not NULL, the result is
-// written to |*outp|, which must have enough space available, and |*outp| is
-// advanced just past the output. If |outp| is non-NULL and |*outp| is NULL, it
-// sets |*outp| to a newly-allocated buffer containing the result. The caller is
-// responsible for releasing the buffer with |OPENSSL_free|. In all cases, this
-// function returns the number of bytes in the result, whether written or not,
-// or a negative value on error.
+// i2d_X509_tbs serializes the TBSCertificate portion of |x509|, as described in
+// |i2d_SAMPLE|.
 //
 // This function preserves the original encoding of the TBSCertificate and may
 // not reflect modifications made to |x509|. It may be used to manually verify
@@ -1073,13 +1060,7 @@ OPENSSL_EXPORT void X509_REQ_get0_signature(const X509_REQ *req,
 OPENSSL_EXPORT int X509_REQ_get_signature_nid(const X509_REQ *req);
 
 // i2d_re_X509_REQ_tbs serializes the CertificationRequestInfo (see RFC 2986)
-// portion of |req|. If |outp| is NULL, nothing is written. Otherwise, if
-// |*outp| is not NULL, the result is written to |*outp|, which must have enough
-// space available, and |*outp| is advanced just past the output. If |outp| is
-// non-NULL and |*outp| is NULL, it sets |*outp| to a newly-allocated buffer
-// containing the result. The caller is responsible for releasing the buffer
-// with |OPENSSL_free|. In all cases, this function returns the number of bytes
-// in the result, whether written or not, or a negative value on error.
+// portion of |req|, as described in |i2d_SAMPLE|.
 //
 // This function re-encodes the CertificationRequestInfo and may not reflect
 // |req|'s original encoding. It may be used to manually generate a signature
@@ -1217,28 +1198,16 @@ OPENSSL_EXPORT void X509_CRL_get0_signature(const X509_CRL *crl,
 // a known NID.
 OPENSSL_EXPORT int X509_CRL_get_signature_nid(const X509_CRL *crl);
 
-// i2d_re_X509_CRL_tbs serializes the TBSCertList portion of |crl|. If |outp| is
-// NULL, nothing is written. Otherwise, if |*outp| is not NULL, the result is
-// written to |*outp|, which must have enough space available, and |*outp| is
-// advanced just past the output. If |outp| is non-NULL and |*outp| is NULL, it
-// sets |*outp| to a newly-allocated buffer containing the result. The caller is
-// responsible for releasing the buffer with |OPENSSL_free|. In all cases, this
-// function returns the number of bytes in the result, whether written or not,
-// or a negative value on error.
+// i2d_re_X509_CRL_tbs serializes the TBSCertList portion of |crl|, as described
+// in |i2d_SAMPLE|.
 //
 // This function re-encodes the TBSCertList and may not reflect |crl|'s original
 // encoding. It may be used to manually generate a signature for a new CRL. To
 // verify CRLs, use |i2d_X509_CRL_tbs| instead.
 OPENSSL_EXPORT int i2d_re_X509_CRL_tbs(X509_CRL *crl, unsigned char **outp);
 
-// i2d_X509_CRL_tbs serializes the TBSCertList portion of |crl|. If |outp| is
-// NULL, nothing is written. Otherwise, if |*outp| is not NULL, the result is
-// written to |*outp|, which must have enough space available, and |*outp| is
-// advanced just past the output. If |outp| is non-NULL and |*outp| is NULL, it
-// sets |*outp| to a newly-allocated buffer containing the result. The caller is
-// responsible for releasing the buffer with |OPENSSL_free|. In all cases, this
-// function returns the number of bytes in the result, whether written or not,
-// or a negative value on error.
+// i2d_X509_CRL_tbs serializes the TBSCertList portion of |crl|, as described in
+// |i2d_SAMPLE|.
 //
 // This function preserves the original encoding of the TBSCertList and may not
 // reflect modifications made to |crl|. It may be used to manually verify the
@@ -2366,8 +2335,8 @@ OPENSSL_EXPORT const X509_POLICY_NODE *X509_policy_node_get0_parent(
     const X509_POLICY_NODE *node);
 
 
-#ifdef __cplusplus
-}
+#if defined(__cplusplus)
+}  // extern C
 #endif
 
 #if !defined(BORINGSSL_NO_CXX)

data/third_party/boringssl-with-bazel/src/include/openssl/x509v3.h

@@ -60,7 +60,7 @@
 #include <openssl/lhash.h>
 #include <openssl/x509.h>
 
-#ifdef __cplusplus
+#if defined(__cplusplus)
 extern "C" {
 #endif
 
@@ -928,8 +928,8 @@ DEFINE_STACK_OF(X509_POLICY_NODE)
 // made after this point may be overwritten when the script is next run.
 
 
-#ifdef __cplusplus
-}
+#if defined(__cplusplus)
+}  // extern C
 
 extern "C++" {
 
@@ -1016,5 +1016,6 @@ BSSL_NAMESPACE_END
 #define X509V3_R_UNSUPPORTED_TYPE 161
 #define X509V3_R_USER_TOO_LONG 162
 #define X509V3_R_INVALID_VALUE 163
+#define X509V3_R_TRAILING_DATA_IN_EXTENSION 164
 
 #endif

data/third_party/boringssl-with-bazel/src/ssl/internal.h

@@ -3692,7 +3692,7 @@ struct ssl_ctx_st {
 
  private:
   ~ssl_ctx_st();
-  friend void SSL_CTX_free(SSL_CTX *);
+  friend OPENSSL_EXPORT void SSL_CTX_free(SSL_CTX *);
 };
 
 struct ssl_st {
@@ -3934,7 +3934,7 @@ struct ssl_session_st {
 
  private:
   ~ssl_session_st();
-  friend void SSL_SESSION_free(SSL_SESSION *);
+  friend OPENSSL_EXPORT void SSL_SESSION_free(SSL_SESSION *);
 };
 
 struct ssl_ech_keys_st {
@@ -3947,7 +3947,7 @@ struct ssl_ech_keys_st {
 
  private:
   ~ssl_ech_keys_st() = default;
-  friend void SSL_ECH_KEYS_free(SSL_ECH_KEYS *);
+  friend OPENSSL_EXPORT void SSL_ECH_KEYS_free(SSL_ECH_KEYS *);
 };
 
 #endif  // OPENSSL_HEADER_SSL_INTERNAL_H

data/third_party/boringssl-with-bazel/src/ssl/ssl_lib.cc

@@ -1697,6 +1697,10 @@ int SSL_pending(const SSL *ssl) {
   return static_cast<int>(ssl->s3->pending_app_data.size());
 }
 
+int SSL_has_pending(const SSL *ssl) {
+  return SSL_pending(ssl) != 0 || !ssl->s3->read_buffer.empty();
+}
+
 int SSL_CTX_check_private_key(const SSL_CTX *ctx) {
   return ssl_cert_check_private_key(ctx->cert.get(),
                                     ctx->cert->privatekey.get());

data/third_party/boringssl-with-bazel/src/ssl/ssl_versions.cc

@@ -396,3 +396,7 @@ int SSL_SESSION_set_protocol_version(SSL_SESSION *session, uint16_t version) {
   // used on unit test sessions anyway.
   return api_version_to_wire(&session->ssl_version, version);
 }
+
+int SSL_CTX_set_record_protocol_version(SSL_CTX *ctx, int version) {
+  return version == 0;
+}