grpc 1.53.0.pre2 → 1.54.0

data/third_party/boringssl-with-bazel/src/crypto/x509/x_x509a.c

@@ -64,138 +64,146 @@
 #include "internal.h"
 
 
-/*
- * X509_CERT_AUX routines. These are used to encode additional user
- * modifiable data about a certificate. This data is appended to the X509
- * encoding when the *_X509_AUX routines are used. This means that the
- * "traditional" X509 routines will simply ignore the extra data.
- */
+// X509_CERT_AUX routines. These are used to encode additional user
+// modifiable data about a certificate. This data is appended to the X509
+// encoding when the *_X509_AUX routines are used. This means that the
+// "traditional" X509 routines will simply ignore the extra data.
 
 static X509_CERT_AUX *aux_get(X509 *x);
 
 ASN1_SEQUENCE(X509_CERT_AUX) = {
-        ASN1_SEQUENCE_OF_OPT(X509_CERT_AUX, trust, ASN1_OBJECT),
-        ASN1_IMP_SEQUENCE_OF_OPT(X509_CERT_AUX, reject, ASN1_OBJECT, 0),
-        ASN1_OPT(X509_CERT_AUX, alias, ASN1_UTF8STRING),
-        ASN1_OPT(X509_CERT_AUX, keyid, ASN1_OCTET_STRING),
-        ASN1_IMP_SEQUENCE_OF_OPT(X509_CERT_AUX, other, X509_ALGOR, 1)
+    ASN1_SEQUENCE_OF_OPT(X509_CERT_AUX, trust, ASN1_OBJECT),
+    ASN1_IMP_SEQUENCE_OF_OPT(X509_CERT_AUX, reject, ASN1_OBJECT, 0),
+    ASN1_OPT(X509_CERT_AUX, alias, ASN1_UTF8STRING),
+    ASN1_OPT(X509_CERT_AUX, keyid, ASN1_OCTET_STRING),
 } ASN1_SEQUENCE_END(X509_CERT_AUX)
 
-IMPLEMENT_ASN1_FUNCTIONS(X509_CERT_AUX)
+IMPLEMENT_ASN1_FUNCTIONS_const(X509_CERT_AUX)
 
-static X509_CERT_AUX *aux_get(X509 *x)
-{
-    if (!x)
-        return NULL;
-    if (!x->aux && !(x->aux = X509_CERT_AUX_new()))
-        return NULL;
-    return x->aux;
+static X509_CERT_AUX *aux_get(X509 *x) {
+  if (!x) {
+    return NULL;
+  }
+  if (!x->aux && !(x->aux = X509_CERT_AUX_new())) {
+    return NULL;
+  }
+  return x->aux;
 }
 
-int X509_alias_set1(X509 *x, const unsigned char *name, int len)
-{
-    X509_CERT_AUX *aux;
-    if (!name) {
-        if (!x || !x->aux || !x->aux->alias)
-            return 1;
-        ASN1_UTF8STRING_free(x->aux->alias);
-        x->aux->alias = NULL;
-        return 1;
+int X509_alias_set1(X509 *x, const unsigned char *name, int len) {
+  X509_CERT_AUX *aux;
+  // TODO(davidben): Empty aliases are not meaningful in PKCS#12, and the
+  // getters cannot quite represent them. Also erase the object if |len| is
+  // zero.
+  if (!name) {
+    if (!x || !x->aux || !x->aux->alias) {
+      return 1;
     }
-    if (!(aux = aux_get(x)))
-        return 0;
-    if (!aux->alias && !(aux->alias = ASN1_UTF8STRING_new()))
-        return 0;
-    return ASN1_STRING_set(aux->alias, name, len);
+    ASN1_UTF8STRING_free(x->aux->alias);
+    x->aux->alias = NULL;
+    return 1;
+  }
+  if (!(aux = aux_get(x))) {
+    return 0;
+  }
+  if (!aux->alias && !(aux->alias = ASN1_UTF8STRING_new())) {
+    return 0;
+  }
+  return ASN1_STRING_set(aux->alias, name, len);
 }
 
-int X509_keyid_set1(X509 *x, const unsigned char *id, int len)
-{
-    X509_CERT_AUX *aux;
-    if (!id) {
-        if (!x || !x->aux || !x->aux->keyid)
-            return 1;
-        ASN1_OCTET_STRING_free(x->aux->keyid);
-        x->aux->keyid = NULL;
-        return 1;
+int X509_keyid_set1(X509 *x, const unsigned char *id, int len) {
+  X509_CERT_AUX *aux;
+  // TODO(davidben): Empty key IDs are not meaningful in PKCS#12, and the
+  // getters cannot quite represent them. Also erase the object if |len| is
+  // zero.
+  if (!id) {
+    if (!x || !x->aux || !x->aux->keyid) {
+      return 1;
     }
-    if (!(aux = aux_get(x)))
-        return 0;
-    if (!aux->keyid && !(aux->keyid = ASN1_OCTET_STRING_new()))
-        return 0;
-    return ASN1_STRING_set(aux->keyid, id, len);
+    ASN1_OCTET_STRING_free(x->aux->keyid);
+    x->aux->keyid = NULL;
+    return 1;
+  }
+  if (!(aux = aux_get(x))) {
+    return 0;
+  }
+  if (!aux->keyid && !(aux->keyid = ASN1_OCTET_STRING_new())) {
+    return 0;
+  }
+  return ASN1_STRING_set(aux->keyid, id, len);
 }
 
-unsigned char *X509_alias_get0(X509 *x, int *len)
-{
-    if (!x->aux || !x->aux->alias)
-        return NULL;
-    if (len)
-        *len = x->aux->alias->length;
-    return x->aux->alias->data;
+unsigned char *X509_alias_get0(X509 *x, int *out_len) {
+  const ASN1_UTF8STRING *alias = x->aux != NULL ? x->aux->alias : NULL;
+  if (out_len != NULL) {
+    *out_len = alias != NULL ? alias->length : 0;
+  }
+  return alias != NULL ? alias->data : NULL;
 }
 
-unsigned char *X509_keyid_get0(X509 *x, int *len)
-{
-    if (!x->aux || !x->aux->keyid)
-        return NULL;
-    if (len)
-        *len = x->aux->keyid->length;
-    return x->aux->keyid->data;
+unsigned char *X509_keyid_get0(X509 *x, int *out_len) {
+  const ASN1_OCTET_STRING *keyid = x->aux != NULL ? x->aux->keyid : NULL;
+  if (out_len != NULL) {
+    *out_len = keyid != NULL ? keyid->length : 0;
+  }
+  return keyid != NULL ? keyid->data : NULL;
 }
 
-int X509_add1_trust_object(X509 *x, ASN1_OBJECT *obj)
-{
-    ASN1_OBJECT *objtmp = OBJ_dup(obj);
-    if (objtmp == NULL)
-        goto err;
-    X509_CERT_AUX *aux = aux_get(x);
+int X509_add1_trust_object(X509 *x, ASN1_OBJECT *obj) {
+  ASN1_OBJECT *objtmp = OBJ_dup(obj);
+  if (objtmp == NULL) {
+    goto err;
+  }
+  X509_CERT_AUX *aux = aux_get(x);
+  if (aux->trust == NULL) {
+    aux->trust = sk_ASN1_OBJECT_new_null();
     if (aux->trust == NULL) {
-        aux->trust = sk_ASN1_OBJECT_new_null();
-        if (aux->trust == NULL)
-            goto err;
+      goto err;
     }
-    if (!sk_ASN1_OBJECT_push(aux->trust, objtmp))
-        goto err;
-    return 1;
-
- err:
-    ASN1_OBJECT_free(objtmp);
-    return 0;
+  }
+  if (!sk_ASN1_OBJECT_push(aux->trust, objtmp)) {
+    goto err;
+  }
+  return 1;
+
+err:
+  ASN1_OBJECT_free(objtmp);
+  return 0;
 }
 
-int X509_add1_reject_object(X509 *x, ASN1_OBJECT *obj)
-{
-    ASN1_OBJECT *objtmp = OBJ_dup(obj);
-    if (objtmp == NULL)
-        goto err;
-    X509_CERT_AUX *aux = aux_get(x);
+int X509_add1_reject_object(X509 *x, ASN1_OBJECT *obj) {
+  ASN1_OBJECT *objtmp = OBJ_dup(obj);
+  if (objtmp == NULL) {
+    goto err;
+  }
+  X509_CERT_AUX *aux = aux_get(x);
+  if (aux->reject == NULL) {
+    aux->reject = sk_ASN1_OBJECT_new_null();
     if (aux->reject == NULL) {
-        aux->reject = sk_ASN1_OBJECT_new_null();
-        if (aux->reject == NULL)
-            goto err;
+      goto err;
     }
-    if (!sk_ASN1_OBJECT_push(aux->reject, objtmp))
-        goto err;
-    return 1;
-
- err:
-    ASN1_OBJECT_free(objtmp);
-    return 0;
+  }
+  if (!sk_ASN1_OBJECT_push(aux->reject, objtmp)) {
+    goto err;
+  }
+  return 1;
+
+err:
+  ASN1_OBJECT_free(objtmp);
+  return 0;
 }
 
-void X509_trust_clear(X509 *x)
-{
-    if (x->aux && x->aux->trust) {
-        sk_ASN1_OBJECT_pop_free(x->aux->trust, ASN1_OBJECT_free);
-        x->aux->trust = NULL;
-    }
+void X509_trust_clear(X509 *x) {
+  if (x->aux && x->aux->trust) {
+    sk_ASN1_OBJECT_pop_free(x->aux->trust, ASN1_OBJECT_free);
+    x->aux->trust = NULL;
+  }
 }
 
-void X509_reject_clear(X509 *x)
-{
-    if (x->aux && x->aux->reject) {
-        sk_ASN1_OBJECT_pop_free(x->aux->reject, ASN1_OBJECT_free);
-        x->aux->reject = NULL;
-    }
+void X509_reject_clear(X509 *x) {
+  if (x->aux && x->aux->reject) {
+    sk_ASN1_OBJECT_pop_free(x->aux->reject, ASN1_OBJECT_free);
+    x->aux->reject = NULL;
+  }
 }

data/third_party/boringssl-with-bazel/src/crypto/x509v3/ext_dat.h

@@ -54,7 +54,7 @@
  * (eay@cryptsoft.com).  This product includes software written by Tim
  * Hudson (tjh@cryptsoft.com). */
 
-/* This file contains a table of "standard" extensions */
+// This file contains a table of "standard" extensions
 
 #if defined(__cplusplus)
 extern "C" {
@@ -65,23 +65,19 @@ extern const X509V3_EXT_METHOD v3_info, v3_sinfo;
 extern const X509V3_EXT_METHOD v3_ns_ia5_list[], v3_alt[], v3_skey_id,
     v3_akey_id;
 extern const X509V3_EXT_METHOD v3_crl_num, v3_crl_reason, v3_crl_invdate;
-extern const X509V3_EXT_METHOD v3_delta_crl, v3_cpols, v3_crld,
-    v3_freshest_crl;
-extern const X509V3_EXT_METHOD v3_ocsp_nonce, v3_ocsp_accresp,
-    v3_ocsp_acutoff;
+extern const X509V3_EXT_METHOD v3_delta_crl, v3_cpols, v3_crld, v3_freshest_crl;
+extern const X509V3_EXT_METHOD v3_ocsp_nonce, v3_ocsp_accresp, v3_ocsp_acutoff;
 extern const X509V3_EXT_METHOD v3_ocsp_crlid, v3_ocsp_nocheck,
     v3_ocsp_serviceloc;
-extern const X509V3_EXT_METHOD v3_crl_hold, v3_pci;
+extern const X509V3_EXT_METHOD v3_crl_hold;
 extern const X509V3_EXT_METHOD v3_policy_mappings, v3_policy_constraints;
 extern const X509V3_EXT_METHOD v3_name_constraints, v3_inhibit_anyp, v3_idp;
 extern const X509V3_EXT_METHOD v3_addr, v3_asid;
 
-/*
- * This table will be searched using OBJ_bsearch so it *must* kept in order
- * of the ext_nid values.
- */
+// This table will be searched using OBJ_bsearch so it *must* kept in order
+// of the ext_nid values.
 
-/* TODO(fork): OCSP support */
+// TODO(fork): OCSP support
 #define OPENSSL_NO_OCSP
 
 static const X509V3_EXT_METHOD *const standard_exts[] = {
@@ -120,7 +116,6 @@ static const X509V3_EXT_METHOD *const standard_exts[] = {
 #ifndef OPENSSL_NO_OCSP
     &v3_crl_hold,
 #endif
-    &v3_pci,
     &v3_name_constraints,
     &v3_policy_mappings,
     &v3_inhibit_anyp,
@@ -129,10 +124,11 @@ static const X509V3_EXT_METHOD *const standard_exts[] = {
     &v3_freshest_crl,
 };
 
-/* Number of standard extensions */
+// Number of standard extensions
 
-#define STANDARD_EXTENSION_COUNT (sizeof(standard_exts)/sizeof(X509V3_EXT_METHOD *))
+#define STANDARD_EXTENSION_COUNT \
+  (sizeof(standard_exts) / sizeof(X509V3_EXT_METHOD *))
 
 #if defined(__cplusplus)
-} /* extern C */
+}  // extern C
 #endif

data/third_party/boringssl-with-bazel/src/crypto/x509v3/internal.h

@@ -65,31 +65,36 @@
 #include <openssl/stack.h>
 #include <openssl/x509v3.h>
 
+// TODO(davidben): Merge x509 and x509v3. This include is needed because some
+// internal typedefs are shared between the two, but the two modules depend on
+// each other circularly.
+#include "../x509/internal.h"
+
 #if defined(__cplusplus)
 extern "C" {
 #endif
 
 
-// x509v3_bytes_to_hex encodes |len| bytes from |buffer| to hex and returns a
+// x509v3_bytes_to_hex encodes |len| bytes from |in| to hex and returns a
 // newly-allocated NUL-terminated string containing the result, or NULL on
 // allocation error.
 //
-// Note this function was historically named |hex_to_string| in OpenSSL, not
-// |string_to_hex|.
-char *x509v3_bytes_to_hex(const unsigned char *buffer, long len);
+// This function was historically named |hex_to_string| in OpenSSL. Despite the
+// name, |hex_to_string| converted to hex.
+OPENSSL_EXPORT char *x509v3_bytes_to_hex(const uint8_t *in, size_t len);
 
 // x509v3_hex_string_to_bytes decodes |str| in hex and returns a newly-allocated
 // array containing the result, or NULL on error. On success, it sets |*len| to
 // the length of the result. Colon separators between bytes in the input are
 // allowed and ignored.
 //
-// Note this function was historically named |string_to_hex| in OpenSSL, not
-// |hex_to_string|.
+// This function was historically named |string_to_hex| in OpenSSL. Despite the
+// name, |string_to_hex| converted from hex.
 unsigned char *x509v3_hex_to_bytes(const char *str, long *len);
 
-// x509v3_name_cmp returns zero if |name| is equal to |cmp| or begins with |cmp|
-// followed by '.'. Otherwise, it returns a non-zero number.
-int x509v3_name_cmp(const char *name, const char *cmp);
+// x509v3_conf_name_matches returns one if |name| is equal to |cmp| or begins
+// with |cmp| followed by '.', and zero otherwise.
+int x509v3_conf_name_matches(const char *name, const char *cmp);
 
 // x509v3_looks_like_dns_name returns one if |in| looks like a DNS name and zero
 // otherwise.
@@ -99,7 +104,7 @@ OPENSSL_EXPORT int x509v3_looks_like_dns_name(const unsigned char *in,
 // x509v3_cache_extensions fills in a number of fields relating to X.509
 // extensions in |x|. It returns one on success and zero if some extensions were
 // invalid.
-int x509v3_cache_extensions(X509 *x);
+OPENSSL_EXPORT int x509v3_cache_extensions(X509 *x);
 
 // x509v3_a2i_ipadd decodes |ipasc| as an IPv4 or IPv6 address. IPv6 addresses
 // use colon-separated syntax while IPv4 addresses use dotted decimal syntax. If
@@ -122,168 +127,71 @@ typedef struct {
 int x509V3_add_value_asn1_string(const char *name, const ASN1_STRING *value,
                                  STACK_OF(CONF_VALUE) **extlist);
 
-typedef struct X509_POLICY_DATA_st X509_POLICY_DATA;
-
-DEFINE_STACK_OF(X509_POLICY_DATA)
-
-/* Internal structures */
-
-/*
- * This structure and the field names correspond to the Policy 'node' of
- * RFC 3280. NB this structure contains no pointers to parent or child data:
- * X509_POLICY_NODE contains that. This means that the main policy data can
- * be kept static and cached with the certificate.
- */
-
-struct X509_POLICY_DATA_st {
-    unsigned int flags;
-    /* Policy OID and qualifiers for this data */
-    ASN1_OBJECT *valid_policy;
-    STACK_OF(POLICYQUALINFO) *qualifier_set;
-    STACK_OF(ASN1_OBJECT) *expected_policy_set;
-};
-
-/* X509_POLICY_DATA flags values */
-
-/*
- * This flag indicates the structure has been mapped using a policy mapping
- * extension. If policy mapping is not active its references get deleted.
- */
-
-#define POLICY_DATA_FLAG_MAPPED                 0x1
-
-/*
- * This flag indicates the data doesn't correspond to a policy in Certificate
- * Policies: it has been mapped to any policy.
- */
-
-#define POLICY_DATA_FLAG_MAPPED_ANY             0x2
-
-/* AND with flags to see if any mapping has occurred */
-
-#define POLICY_DATA_FLAG_MAP_MASK               0x3
-
-/* qualifiers are shared and shouldn't be freed */
-
-#define POLICY_DATA_FLAG_SHARED_QUALIFIERS      0x4
-
-/* Parent node is an extra node and should be freed */
-
-#define POLICY_DATA_FLAG_EXTRA_NODE             0x8
-
-/* Corresponding CertificatePolicies is critical */
-
-#define POLICY_DATA_FLAG_CRITICAL               0x10
-
-/* This structure is cached with a certificate */
-
-struct X509_POLICY_CACHE_st {
-    /* anyPolicy data or NULL if no anyPolicy */
-    X509_POLICY_DATA *anyPolicy;
-    /* other policy data */
-    STACK_OF(X509_POLICY_DATA) *data;
-    /* If InhibitAnyPolicy present this is its value or -1 if absent. */
-    long any_skip;
-    /*
-     * If policyConstraints and requireExplicitPolicy present this is its
-     * value or -1 if absent.
-     */
-    long explicit_skip;
-    /*
-     * If policyConstraints and policyMapping present this is its value or -1
-     * if absent.
-     */
-    long map_skip;
-};
-
-/*
- * #define POLICY_CACHE_FLAG_CRITICAL POLICY_DATA_FLAG_CRITICAL
- */
-
-/* This structure represents the relationship between nodes */
-
-struct X509_POLICY_NODE_st {
-    /* node data this refers to */
-    const X509_POLICY_DATA *data;
-    /* Parent node */
-    X509_POLICY_NODE *parent;
-    /* Number of child nodes */
-    int nchild;
-};
-
-struct X509_POLICY_LEVEL_st {
-    /* Cert for this level */
-    X509 *cert;
-    /* nodes at this level */
-    STACK_OF(X509_POLICY_NODE) *nodes;
-    /* anyPolicy node */
-    X509_POLICY_NODE *anyPolicy;
-    /* Extra data */
-    /*
-     * STACK_OF(X509_POLICY_DATA) *extra_data;
-     */
-    unsigned int flags;
-};
-
-struct X509_POLICY_TREE_st {
-    /* This is the tree 'level' data */
-    X509_POLICY_LEVEL *levels;
-    int nlevel;
-    /*
-     * Extra policy data when additional nodes (not from the certificate) are
-     * required.
-     */
-    STACK_OF(X509_POLICY_DATA) *extra_data;
-    /* This is the authority constained policy set */
-    STACK_OF(X509_POLICY_NODE) *auth_policies;
-    STACK_OF(X509_POLICY_NODE) *user_policies;
-    unsigned int flags;
-};
-
-/* Set if anyPolicy present in user policies */
-#define POLICY_FLAG_ANY_POLICY          0x2
-
-/* Useful macros */
-
-#define node_data_critical(data) ((data)->flags & POLICY_DATA_FLAG_CRITICAL)
-#define node_critical(node) node_data_critical((node)->data)
-
-/* Internal functions */
-
-X509_POLICY_DATA *policy_data_new(POLICYINFO *policy, const ASN1_OBJECT *id,
-                                  int crit);
-void policy_data_free(X509_POLICY_DATA *data);
-
-X509_POLICY_DATA *policy_cache_find_data(const X509_POLICY_CACHE *cache,
-                                         const ASN1_OBJECT *id);
-int policy_cache_set_mapping(X509 *x, POLICY_MAPPINGS *maps);
-
-STACK_OF(X509_POLICY_NODE) *policy_node_cmp_new(void);
-
-void policy_cache_init(void);
-
-void policy_cache_free(X509_POLICY_CACHE *cache);
-
-X509_POLICY_NODE *level_find_node(const X509_POLICY_LEVEL *level,
-                                  const X509_POLICY_NODE *parent,
-                                  const ASN1_OBJECT *id);
-
-X509_POLICY_NODE *tree_find_sk(STACK_OF(X509_POLICY_NODE) *sk,
-                               const ASN1_OBJECT *id);
-
-X509_POLICY_NODE *level_add_node(X509_POLICY_LEVEL *level,
-                                 X509_POLICY_DATA *data,
-                                 X509_POLICY_NODE *parent,
-                                 X509_POLICY_TREE *tree);
-void policy_node_free(X509_POLICY_NODE *node);
-int policy_node_match(const X509_POLICY_LEVEL *lvl,
-                      const X509_POLICY_NODE *node, const ASN1_OBJECT *oid);
-
-const X509_POLICY_CACHE *policy_cache_set(X509 *x);
+// X509V3_NAME_from_section adds attributes to |nm| by interpreting the
+// key/value pairs in |dn_sk|. It returns one on success and zero on error.
+// |chtype|, which should be one of |MBSTRING_*| constants, determines the
+// character encoding used to interpret values.
+int X509V3_NAME_from_section(X509_NAME *nm, const STACK_OF(CONF_VALUE) *dn_sk,
+                             int chtype);
+
+// X509V3_bool_from_string decodes |str| as a boolean. On success, it returns
+// one and sets |*out_bool| to resulting value. Otherwise, it returns zero.
+int X509V3_bool_from_string(const char *str, ASN1_BOOLEAN *out_bool);
+
+// X509V3_get_value_bool decodes |value| as a boolean. On success, it returns
+// one and sets |*out_bool| to the resulting value. Otherwise, it returns zero.
+int X509V3_get_value_bool(const CONF_VALUE *value, ASN1_BOOLEAN *out_bool);
+
+// X509V3_get_value_int decodes |value| as an integer. On success, it returns
+// one and sets |*aint| to the resulting value. Otherwise, it returns zero. If
+// |*aint| was non-NULL at the start of the function, it frees the previous
+// value before writing a new one.
+int X509V3_get_value_int(const CONF_VALUE *value, ASN1_INTEGER **aint);
+
+// X509V3_get_section behaves like |NCONF_get_section| but queries |ctx|'s
+// config database.
+const STACK_OF(CONF_VALUE) *X509V3_get_section(const X509V3_CTX *ctx,
+                                               const char *section);
+
+// X509V3_add_value appends a |CONF_VALUE| containing |name| and |value| to
+// |*extlist|. It returns one on success and zero on error. If |*extlist| is
+// NULL, it sets |*extlist| to a newly-allocated |STACK_OF(CONF_VALUE)|
+// containing the result. Either |name| or |value| may be NULL to omit the
+// field.
+//
+// On failure, if |*extlist| was NULL, |*extlist| will remain NULL when the
+// function returns.
+int X509V3_add_value(const char *name, const char *value,
+                     STACK_OF(CONF_VALUE) **extlist);
+
+// X509V3_add_value_bool behaves like |X509V3_add_value| but stores the value
+// "TRUE" if |asn1_bool| is non-zero and "FALSE" otherwise.
+int X509V3_add_value_bool(const char *name, int asn1_bool,
+                          STACK_OF(CONF_VALUE) **extlist);
+
+// X509V3_add_value_bool behaves like |X509V3_add_value| but stores a string
+// representation of |aint|. Note this string representation may be decimal or
+// hexadecimal, depending on the size of |aint|.
+int X509V3_add_value_int(const char *name, const ASN1_INTEGER *aint,
+                         STACK_OF(CONF_VALUE) **extlist);
+
+STACK_OF(CONF_VALUE) *X509V3_parse_list(const char *line);
+
+#define X509V3_conf_err(val)                                               \
+  ERR_add_error_data(6, "section:", (val)->section, ",name:", (val)->name, \
+                     ",value:", (val)->value);
+
+// GENERAL_NAME_cmp returns zero if |a| and |b| are equal and a non-zero
+// value otherwise. Note this function does not provide a comparison suitable
+// for sorting.
+//
+// This function is exported for testing.
+OPENSSL_EXPORT int GENERAL_NAME_cmp(const GENERAL_NAME *a,
+                                    const GENERAL_NAME *b);
 
 
 #if defined(__cplusplus)
-}  /* extern C */
+}  // extern C
 #endif
 
-#endif  /* OPENSSL_HEADER_X509V3_INTERNAL_H */
+#endif  // OPENSSL_HEADER_X509V3_INTERNAL_H