grpc 1.60.0 → 1.62.0

data/third_party/boringssl-with-bazel/src/crypto/internal.h

@@ -127,24 +127,13 @@
 #endif
 
 #if !defined(__cplusplus)
-#if defined(__STDC_VERSION__) && __STDC_VERSION__ >= 201112L
-#include <stdalign.h>
-#elif defined(_MSC_VER) && !defined(__clang__)
-#define alignas(x) __declspec(align(x))
-#define alignof __alignof
-#else
-// With the exception of MSVC, we require C11 to build the library. C11 is a
-// prerequisite for improved refcounting performance. All our supported C
-// compilers have long implemented C11 and made it default. The most likely
-// cause of pre-C11 modes is stale -std=c99 or -std=gnu99 flags in build
-// configuration. Such flags can be removed.
-//
-// TODO(davidben): In MSVC 2019 16.8 or higher (_MSC_VER >= 1928),
-// |__STDC_VERSION__| will be 201112 when passed /std:c11 and unset otherwise.
-// C11 alignas and alignof are only implemented in C11 mode. Can we mandate C11
-// mode for those versions?
+#if !defined(__STDC_VERSION__) || __STDC_VERSION__ < 201112L
+// BoringSSL requires C11 to build the library. The most likely cause of
+// pre-C11 modes is stale -std=c99 or -std=gnu99 flags in build configuration.
+// Such flags can be removed. If building with MSVC, build with /std:c11.
 #error "BoringSSL must be built in C11 mode or higher."
 #endif
+#include <stdalign.h>
 #endif
 
 #if defined(OPENSSL_THREADS) && \
@@ -160,9 +149,8 @@
 
 // Determine the atomics implementation to use with C.
 #if !defined(__cplusplus)
-#if !defined(OPENSSL_C11_ATOMIC) && defined(OPENSSL_THREADS) &&   \
-    !defined(__STDC_NO_ATOMICS__) && defined(__STDC_VERSION__) && \
-    __STDC_VERSION__ >= 201112L
+#if !defined(OPENSSL_C11_ATOMIC) && defined(OPENSSL_THREADS) && \
+    !defined(__STDC_NO_ATOMICS__)
 #define OPENSSL_C11_ATOMIC
 #endif
 
@@ -247,12 +235,26 @@ typedef __uint128_t uint128_t;
 #define OPENSSL_FALLTHROUGH
 #endif
 
+// GCC-like compilers indicate SSE2 with |__SSE2__|. MSVC leaves the caller to
+// know that x86_64 has SSE2, and uses _M_IX86_FP to indicate SSE2 on x86.
+// https://learn.microsoft.com/en-us/cpp/preprocessor/predefined-macros?view=msvc-170
+#if defined(__SSE2__) || defined(_M_AMD64) || defined(_M_X64) || \
+    (defined(_M_IX86_FP) && _M_IX86_FP >= 2)
+#define OPENSSL_SSE2
+#endif
+
 // For convenience in testing 64-bit generic code, we allow disabling SSE2
 // intrinsics via |OPENSSL_NO_SSE2_FOR_TESTING|. x86_64 always has SSE2
 // available, so we would otherwise need to test such code on a non-x86_64
 // platform.
-#if defined(__SSE2__) && !defined(OPENSSL_NO_SSE2_FOR_TESTING)
-#define OPENSSL_SSE2
+#if defined(OPENSSL_SSE2) && defined(OPENSSL_NO_SSE2_FOR_TESTING)
+#undef OPENSSL_SSE2
+#endif
+
+#if defined(__GNUC__) || defined(__clang__)
+#define OPENSSL_ATTR_PURE __attribute__((pure))
+#else
+#define OPENSSL_ATTR_PURE
 #endif
 
 #if defined(BORINGSSL_MALLOC_FAILURE_TESTING)
@@ -265,6 +267,12 @@ OPENSSL_EXPORT void OPENSSL_reset_malloc_counter_for_testing(void);
 OPENSSL_INLINE void OPENSSL_reset_malloc_counter_for_testing(void) {}
 #endif
 
+#if defined(__has_builtin)
+#define OPENSSL_HAS_BUILTIN(x) __has_builtin(x)
+#else
+#define OPENSSL_HAS_BUILTIN(x) 0
+#endif
+
 
 // Pointer utility functions.
 
@@ -1140,6 +1148,110 @@ static inline uint64_t CRYPTO_rotr_u64(uint64_t value, int shift) {
 }
 
 
+// Arithmetic functions.
+
+// CRYPTO_addc_* returns |x + y + carry|, and sets |*out_carry| to the carry
+// bit. |carry| must be zero or one.
+#if OPENSSL_HAS_BUILTIN(__builtin_addc)
+
+#define CRYPTO_GENERIC_ADDC(x, y, carry, out_carry) \
+  (_Generic((x),                                    \
+      unsigned: __builtin_addc,                     \
+      unsigned long: __builtin_addcl,               \
+      unsigned long long: __builtin_addcll))((x), (y), (carry), (out_carry))
+
+static inline uint32_t CRYPTO_addc_u32(uint32_t x, uint32_t y, uint32_t carry,
+                                       uint32_t *out_carry) {
+  assert(carry <= 1);
+  return CRYPTO_GENERIC_ADDC(x, y, carry, out_carry);
+}
+
+static inline uint64_t CRYPTO_addc_u64(uint64_t x, uint64_t y, uint64_t carry,
+                                       uint64_t *out_carry) {
+  assert(carry <= 1);
+  return CRYPTO_GENERIC_ADDC(x, y, carry, out_carry);
+}
+
+#else
+
+static inline uint32_t CRYPTO_addc_u32(uint32_t x, uint32_t y, uint32_t carry,
+                                       uint32_t *out_carry) {
+  assert(carry <= 1);
+  uint64_t ret = carry;
+  ret += (uint64_t)x + y;
+  *out_carry = (uint32_t)(ret >> 32);
+  return (uint32_t)ret;
+}
+
+static inline uint64_t CRYPTO_addc_u64(uint64_t x, uint64_t y, uint64_t carry,
+                                       uint64_t *out_carry) {
+  assert(carry <= 1);
+#if defined(BORINGSSL_HAS_UINT128)
+  uint128_t ret = carry;
+  ret += (uint128_t)x + y;
+  *out_carry = (uint64_t)(ret >> 64);
+  return (uint64_t)ret;
+#else
+  x += carry;
+  carry = x < carry;
+  uint64_t ret = x + y;
+  carry += ret < x;
+  *out_carry = carry;
+  return ret;
+#endif
+}
+#endif
+
+// CRYPTO_subc_* returns |x - y - borrow|, and sets |*out_borrow| to the borrow
+// bit. |borrow| must be zero or one.
+#if OPENSSL_HAS_BUILTIN(__builtin_subc)
+
+#define CRYPTO_GENERIC_SUBC(x, y, borrow, out_borrow) \
+  (_Generic((x),                                      \
+      unsigned: __builtin_subc,                       \
+      unsigned long: __builtin_subcl,                 \
+      unsigned long long: __builtin_subcll))((x), (y), (borrow), (out_borrow))
+
+static inline uint32_t CRYPTO_subc_u32(uint32_t x, uint32_t y, uint32_t borrow,
+                                       uint32_t *out_borrow) {
+  assert(borrow <= 1);
+  return CRYPTO_GENERIC_SUBC(x, y, borrow, out_borrow);
+}
+
+static inline uint64_t CRYPTO_subc_u64(uint64_t x, uint64_t y, uint64_t borrow,
+                                       uint64_t *out_borrow) {
+  assert(borrow <= 1);
+  return CRYPTO_GENERIC_SUBC(x, y, borrow, out_borrow);
+}
+
+#else
+
+static inline uint32_t CRYPTO_subc_u32(uint32_t x, uint32_t y, uint32_t borrow,
+                                       uint32_t *out_borrow) {
+  assert(borrow <= 1);
+  uint32_t ret = x - y - borrow;
+  *out_borrow = (x < y) | ((x == y) & borrow);
+  return ret;
+}
+
+static inline uint64_t CRYPTO_subc_u64(uint64_t x, uint64_t y, uint64_t borrow,
+                                       uint64_t *out_borrow) {
+  assert(borrow <= 1);
+  uint64_t ret = x - y - borrow;
+  *out_borrow = (x < y) | ((x == y) & borrow);
+  return ret;
+}
+#endif
+
+#if defined(OPENSSL_64_BIT)
+#define CRYPTO_addc_w CRYPTO_addc_u64
+#define CRYPTO_subc_w CRYPTO_subc_u64
+#else
+#define CRYPTO_addc_w CRYPTO_addc_u32
+#define CRYPTO_subc_w CRYPTO_subc_u32
+#endif
+
+
 // FIPS functions.
 
 #if defined(BORINGSSL_FIPS)
@@ -1227,19 +1339,16 @@ OPENSSL_INLINE int boringssl_fips_break_test(const char *test) {
 //     ECX for CPUID where EAX = 7
 //
 // Note: the CPUID bits are pre-adjusted for the OSXSAVE bit and the YMM and XMM
-// bits in XCR0, so it is not necessary to check those.
+// bits in XCR0, so it is not necessary to check those. (WARNING: See caveats
+// in cpu_intel.c.)
+//
+// From C, this symbol should only be accessed with |OPENSSL_get_ia32cap|.
 extern uint32_t OPENSSL_ia32cap_P[4];
 
-#if defined(BORINGSSL_FIPS) && !defined(BORINGSSL_SHARED_LIBRARY)
-// The FIPS module, as a static library, requires an out-of-line version of
-// |OPENSSL_ia32cap_get| so accesses can be rewritten by delocate. Mark the
-// function const so multiple accesses can be optimized together.
-const uint32_t *OPENSSL_ia32cap_get(void) __attribute__((const));
-#else
-OPENSSL_INLINE const uint32_t *OPENSSL_ia32cap_get(void) {
-  return OPENSSL_ia32cap_P;
-}
-#endif
+// OPENSSL_get_ia32cap initializes the library if needed and returns the |idx|th
+// entry of |OPENSSL_ia32cap_P|. It is marked as a pure function so duplicate
+// calls can be merged by the compiler, at least when indices match.
+OPENSSL_ATTR_PURE uint32_t OPENSSL_get_ia32cap(int idx);
 
 // See Intel manual, volume 2A, table 3-11.
 
@@ -1247,13 +1356,13 @@ OPENSSL_INLINE int CRYPTO_is_FXSR_capable(void) {
 #if defined(__FXSR__)
   return 1;
 #else
-  return (OPENSSL_ia32cap_get()[0] & (1 << 24)) != 0;
+  return (OPENSSL_get_ia32cap(0) & (1u << 24)) != 0;
 #endif
 }
 
 OPENSSL_INLINE int CRYPTO_is_intel_cpu(void) {
   // The reserved bit 30 is used to indicate an Intel CPU.
-  return (OPENSSL_ia32cap_get()[0] & (1 << 30)) != 0;
+  return (OPENSSL_get_ia32cap(0) & (1u << 30)) != 0;
 }
 
 // See Intel manual, volume 2A, table 3-10.
@@ -1262,7 +1371,7 @@ OPENSSL_INLINE int CRYPTO_is_PCLMUL_capable(void) {
 #if defined(__PCLMUL__)
   return 1;
 #else
-  return (OPENSSL_ia32cap_get()[1] & (1 << 1)) != 0;
+  return (OPENSSL_get_ia32cap(1) & (1u << 1)) != 0;
 #endif
 }
 
@@ -1270,7 +1379,7 @@ OPENSSL_INLINE int CRYPTO_is_SSSE3_capable(void) {
 #if defined(__SSSE3__)
   return 1;
 #else
-  return (OPENSSL_ia32cap_get()[1] & (1 << 9)) != 0;
+  return (OPENSSL_get_ia32cap(1) & (1u << 9)) != 0;
 #endif
 }
 
@@ -1278,7 +1387,7 @@ OPENSSL_INLINE int CRYPTO_is_SSE4_1_capable(void) {
 #if defined(__SSE4_1__)
   return 1;
 #else
-  return (OPENSSL_ia32cap_P[1] & (1 << 19)) != 0;
+  return (OPENSSL_get_ia32cap(1) & (1u << 19)) != 0;
 #endif
 }
 
@@ -1286,7 +1395,7 @@ OPENSSL_INLINE int CRYPTO_is_MOVBE_capable(void) {
 #if defined(__MOVBE__)
   return 1;
 #else
-  return (OPENSSL_ia32cap_get()[1] & (1 << 22)) != 0;
+  return (OPENSSL_get_ia32cap(1) & (1u << 22)) != 0;
 #endif
 }
 
@@ -1294,26 +1403,26 @@ OPENSSL_INLINE int CRYPTO_is_AESNI_capable(void) {
 #if defined(__AES__)
   return 1;
 #else
-  return (OPENSSL_ia32cap_get()[1] & (1 << 25)) != 0;
+  return (OPENSSL_get_ia32cap(1) & (1u << 25)) != 0;
 #endif
 }
 
+// We intentionally avoid defining a |CRYPTO_is_XSAVE_capable| function. See
+// |CRYPTO_cpu_perf_is_like_silvermont|.
+
 OPENSSL_INLINE int CRYPTO_is_AVX_capable(void) {
 #if defined(__AVX__)
   return 1;
 #else
-  return (OPENSSL_ia32cap_get()[1] & (1 << 28)) != 0;
+  return (OPENSSL_get_ia32cap(1) & (1u << 28)) != 0;
 #endif
 }
 
 OPENSSL_INLINE int CRYPTO_is_RDRAND_capable(void) {
-  // The GCC/Clang feature name and preprocessor symbol for RDRAND are "rdrnd"
-  // and |__RDRND__|, respectively.
-#if defined(__RDRND__)
-  return 1;
-#else
-  return (OPENSSL_ia32cap_get()[1] & (1u << 30)) != 0;
-#endif
+  // We intentionally do not check |__RDRND__| here. On some AMD processors, we
+  // will act as if the hardware is RDRAND-incapable, even it actually supports
+  // it. See cpu_intel.c.
+  return (OPENSSL_get_ia32cap(1) & (1u << 30)) != 0;
 }
 
 // See Intel manual, volume 2A, table 3-8.
@@ -1322,7 +1431,7 @@ OPENSSL_INLINE int CRYPTO_is_BMI1_capable(void) {
 #if defined(__BMI1__)
   return 1;
 #else
-  return (OPENSSL_ia32cap_get()[2] & (1 << 3)) != 0;
+  return (OPENSSL_get_ia32cap(2) & (1u << 3)) != 0;
 #endif
 }
 
@@ -1330,7 +1439,7 @@ OPENSSL_INLINE int CRYPTO_is_AVX2_capable(void) {
 #if defined(__AVX2__)
   return 1;
 #else
-  return (OPENSSL_ia32cap_get()[2] & (1 << 5)) != 0;
+  return (OPENSSL_get_ia32cap(2) & (1u << 5)) != 0;
 #endif
 }
 
@@ -1338,7 +1447,7 @@ OPENSSL_INLINE int CRYPTO_is_BMI2_capable(void) {
 #if defined(__BMI2__)
   return 1;
 #else
-  return (OPENSSL_ia32cap_get()[2] & (1 << 8)) != 0;
+  return (OPENSSL_get_ia32cap(2) & (1u << 8)) != 0;
 #endif
 }
 
@@ -1346,16 +1455,72 @@ OPENSSL_INLINE int CRYPTO_is_ADX_capable(void) {
 #if defined(__ADX__)
   return 1;
 #else
-  return (OPENSSL_ia32cap_get()[2] & (1 << 19)) != 0;
+  return (OPENSSL_get_ia32cap(2) & (1u << 19)) != 0;
 #endif
 }
 
+// SHA-1 and SHA-256 are defined as a single extension.
+OPENSSL_INLINE int CRYPTO_is_x86_SHA_capable(void) {
+  // We should check __SHA__ here, but for now we ignore it. We've run into a
+  // few places where projects build with -march=goldmont, but need a build that
+  // does not require SHA extensions:
+  //
+  // - Some CrOS toolchain definitions are incorrect and build with
+  //   -march=goldmont when targetting boards that are not Goldmont. b/320482539
+  //   tracks fixing this.
+  //
+  // - Sometimes projects build with -march=goldmont as a rough optimized
+  //   baseline. However, Intel CPU capabilities are not strictly linear, so
+  //   this does not quite work. Some combination of -mtune and
+  //   -march=x86-64-v{1,2,3,4} would be a better strategy here.
+  //
+  // - QEMU versions before 8.2 do not support SHA extensions and disable it
+  //   with a warning. Projects that target Goldmont and test on QEMU will
+  //   break. The long-term fix is to update to 8.2. A principled short-term fix
+  //   would be -march=goldmont -mno-sha, to reflect that the binary needs to
+  //   run on both QEMU-8.1-Goldmont and actual-Goldmont.
+  //
+  // TODO(b/320482539): Once the CrOS toolchain is fixed, try this again.
+  return (OPENSSL_get_ia32cap(2) & (1u << 29)) != 0;
+}
+
+// CRYPTO_cpu_perf_is_like_silvermont returns one if, based on a heuristic, the
+// CPU has Silvermont-like performance characteristics. It is often faster to
+// run different codepaths on these CPUs than the available instructions would
+// otherwise select. See chacha-x86_64.pl.
+//
+// Bonnell, Silvermont's predecessor in the Atom lineup, will also be matched by
+// this. |OPENSSL_cpuid_setup| forces Knights Landing to also be matched by
+// this. Goldmont (Silvermont's successor in the Atom lineup) added XSAVE so it
+// isn't matched by this. Various sources indicate AMD first implemented MOVBE
+// and XSAVE at the same time in Jaguar, so it seems like AMD chips will not be
+// matched by this. That seems to be the case for other x86(-64) CPUs.
+OPENSSL_INLINE int CRYPTO_cpu_perf_is_like_silvermont(void) {
+  // WARNING: This MUST NOT be used to guard the execution of the XSAVE
+  // instruction. This is the "hardware supports XSAVE" bit, not the OSXSAVE bit
+  // that indicates whether we can safely execute XSAVE. This bit may be set
+  // even when XSAVE is disabled (by the operating system). See the comment in
+  // cpu_intel.c and check how the users of this bit use it.
+  //
+  // We do not use |__XSAVE__| for static detection because the hack in
+  // |OPENSSL_cpuid_setup| for Knights Landing CPUs needs to override it.
+  int hardware_supports_xsave = (OPENSSL_get_ia32cap(1) & (1u << 26)) != 0;
+  return !hardware_supports_xsave && CRYPTO_is_MOVBE_capable();
+}
+
 #endif  // OPENSSL_X86 || OPENSSL_X86_64
 
 #if defined(OPENSSL_ARM) || defined(OPENSSL_AARCH64)
 
+// OPENSSL_armcap_P contains ARM CPU capabilities. From C, this should only be
+// accessed with |OPENSSL_get_armcap|.
 extern uint32_t OPENSSL_armcap_P;
 
+// OPENSSL_get_armcap initializes the library if needed and returns ARM CPU
+// capabilities. It is marked as a pure function so duplicate calls can be
+// merged by the compiler, at least when indices match.
+OPENSSL_ATTR_PURE uint32_t OPENSSL_get_armcap(void);
+
 // We do not detect any features at runtime on several 32-bit Arm platforms.
 // Apple platforms and OpenBSD require NEON and moved to 64-bit to pick up Armv8
 // extensions. Android baremetal does not aim to support 32-bit Arm at all, but
@@ -1388,7 +1553,7 @@ OPENSSL_INLINE int CRYPTO_is_NEON_capable(void) {
 #elif defined(OPENSSL_STATIC_ARMCAP)
   return 0;
 #else
-  return (OPENSSL_armcap_P & ARMV7_NEON) != 0;
+  return (OPENSSL_get_armcap() & ARMV7_NEON) != 0;
 #endif
 }
 
@@ -1398,7 +1563,7 @@ OPENSSL_INLINE int CRYPTO_is_ARMv8_AES_capable(void) {
 #elif defined(OPENSSL_STATIC_ARMCAP)
   return 0;
 #else
-  return (OPENSSL_armcap_P & ARMV8_AES) != 0;
+  return (OPENSSL_get_armcap() & ARMV8_AES) != 0;
 #endif
 }
 
@@ -1408,7 +1573,42 @@ OPENSSL_INLINE int CRYPTO_is_ARMv8_PMULL_capable(void) {
 #elif defined(OPENSSL_STATIC_ARMCAP)
   return 0;
 #else
-  return (OPENSSL_armcap_P & ARMV8_PMULL) != 0;
+  return (OPENSSL_get_armcap() & ARMV8_PMULL) != 0;
+#endif
+}
+
+OPENSSL_INLINE int CRYPTO_is_ARMv8_SHA1_capable(void) {
+  // SHA-1 and SHA-2 (only) share |__ARM_FEATURE_SHA2| but otherwise
+  // are dealt with independently.
+#if defined(OPENSSL_STATIC_ARMCAP_SHA1) || defined(__ARM_FEATURE_SHA2)
+  return 1;
+#elif defined(OPENSSL_STATIC_ARMCAP)
+  return 0;
+#else
+  return (OPENSSL_get_armcap() & ARMV8_SHA1) != 0;
+#endif
+}
+
+OPENSSL_INLINE int CRYPTO_is_ARMv8_SHA256_capable(void) {
+  // SHA-1 and SHA-2 (only) share |__ARM_FEATURE_SHA2| but otherwise
+  // are dealt with independently.
+#if defined(OPENSSL_STATIC_ARMCAP_SHA256) || defined(__ARM_FEATURE_SHA2)
+  return 1;
+#elif defined(OPENSSL_STATIC_ARMCAP)
+  return 0;
+#else
+  return (OPENSSL_get_armcap() & ARMV8_SHA256) != 0;
+#endif
+}
+
+OPENSSL_INLINE int CRYPTO_is_ARMv8_SHA512_capable(void) {
+  // There is no |OPENSSL_STATIC_ARMCAP_SHA512|.
+#if defined(__ARM_FEATURE_SHA512)
+  return 1;
+#elif defined(OPENSSL_STATIC_ARMCAP)
+  return 0;
+#else
+  return (OPENSSL_get_armcap() & ARMV8_SHA512) != 0;
 #endif
 }
 

data/third_party/boringssl-with-bazel/src/crypto/keccak/internal.h

@@ -0,0 +1,70 @@
+/* Copyright (c) 2023, Google Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+
+#ifndef OPENSSL_HEADER_CRYPTO_KECCAK_INTERNAL_H
+#define OPENSSL_HEADER_CRYPTO_KECCAK_INTERNAL_H
+
+#include <openssl/base.h>
+
+#if defined(__cplusplus)
+extern "C" {
+#endif
+
+
+enum boringssl_keccak_config_t {
+  boringssl_sha3_256,
+  boringssl_sha3_512,
+  boringssl_shake128,
+  boringssl_shake256,
+};
+
+enum boringssl_keccak_phase_t {
+  boringssl_keccak_phase_absorb,
+  boringssl_keccak_phase_squeeze,
+};
+
+struct BORINGSSL_keccak_st {
+  enum boringssl_keccak_config_t config;
+  enum boringssl_keccak_phase_t phase;
+  uint64_t state[25];
+  size_t rate_bytes;
+  size_t absorb_offset;
+  size_t squeeze_offset;
+};
+
+// BORINGSSL_keccak hashes |in_len| bytes from |in| and writes |out_len| bytes
+// of output to |out|. If the |config| specifies a fixed-output function, like
+// SHA3-256, then |out_len| must be the correct length for that function.
+OPENSSL_EXPORT void BORINGSSL_keccak(uint8_t *out, size_t out_len,
+                                     const uint8_t *in, size_t in_len,
+                                     enum boringssl_keccak_config_t config);
+
+// BORINGSSL_keccak_init prepares |ctx| for absorbing. The |config| must specify
+// a SHAKE variant, otherwise callers should use |BORINGSSL_keccak|.
+OPENSSL_EXPORT void BORINGSSL_keccak_init(
+    struct BORINGSSL_keccak_st *ctx, enum boringssl_keccak_config_t config);
+
+// BORINGSSL_keccak_absorb absorbs |in_len| bytes from |in|.
+OPENSSL_EXPORT void BORINGSSL_keccak_absorb(struct BORINGSSL_keccak_st *ctx,
+                                            const uint8_t *in, size_t in_len);
+
+// BORINGSSL_keccak_squeeze writes |out_len| bytes to |out| from |ctx|.
+OPENSSL_EXPORT void BORINGSSL_keccak_squeeze(struct BORINGSSL_keccak_st *ctx,
+                                             uint8_t *out, size_t out_len);
+
+#if defined(__cplusplus)
+}
+#endif
+
+#endif  // OPENSSL_HEADER_CRYPTO_KECCAK_INTERNAL_H