grpc 1.66.0 → 1.67.0.pre1

data/src/ruby/spec/generic/active_call_spec.rb

@@ -55,17 +55,20 @@ describe GRPC::ActiveCall do
     end
     @ch = GRPC::Core::Channel.new("0.0.0.0:#{server_port}", nil,
                                   :this_channel_is_insecure)
+    @call = make_test_call
   end
 
   after(:each) do
     @server.shutdown_and_notify(deadline)
     @server.close
     @server_thread.join
+    # Don't rely on GC to unref the call, since that can prevent
+    # the channel connectivity state polling thread from shutting down.
+    @call.close
   end
 
   describe 'restricted view methods' do
     before(:each) do
-      @call = make_test_call
       ActiveCall.client_invoke(@call)
       @client_call = ActiveCall.new(@call, @pass_through,
                                     @pass_through, deadline)
@@ -117,9 +120,8 @@ describe GRPC::ActiveCall do
 
   describe '#remote_send' do
     it 'allows a client to send a payload to the server', test: true do
-      call = make_test_call
-      ActiveCall.client_invoke(call)
-      client_call = ActiveCall.new(call, @pass_through,
+      ActiveCall.client_invoke(@call)
+      client_call = ActiveCall.new(@call, @pass_through,
                                    @pass_through, deadline)
       msg = 'message is a string'
       client_call.remote_send(msg)
@@ -137,15 +139,14 @@ describe GRPC::ActiveCall do
       expect(server_call.remote_read).to eq(msg)
       # finish the call
       server_call.send_initial_metadata
-      call.run_batch(CallOps::RECV_INITIAL_METADATA => nil)
-      send_and_receive_close_and_status(call, recvd_call)
+      @call.run_batch(CallOps::RECV_INITIAL_METADATA => nil)
+      send_and_receive_close_and_status(@call, recvd_call)
     end
 
     it 'marshals the payload using the marshal func' do
-      call = make_test_call
-      ActiveCall.client_invoke(call)
+      ActiveCall.client_invoke(@call)
       marshal = proc { |x| 'marshalled:' + x }
-      client_call = ActiveCall.new(call, marshal, @pass_through, deadline)
+      client_call = ActiveCall.new(@call, marshal, @pass_through, deadline)
       msg = 'message is a string'
       client_call.remote_send(msg)
 
@@ -161,23 +162,22 @@ describe GRPC::ActiveCall do
                                    metadata_received: true)
       expect(server_call.remote_read).to eq('marshalled:' + msg)
       # finish the call
-      call.run_batch(CallOps::RECV_INITIAL_METADATA => nil)
-      send_and_receive_close_and_status(call, recvd_call)
+      @call.run_batch(CallOps::RECV_INITIAL_METADATA => nil)
+      send_and_receive_close_and_status(@call, recvd_call)
     end
 
     TEST_WRITE_FLAGS = [WriteFlags::BUFFER_HINT, WriteFlags::NO_COMPRESS]
     TEST_WRITE_FLAGS.each do |f|
       it "successfully makes calls with write_flag set to #{f}" do
-        call = make_test_call
-        ActiveCall.client_invoke(call)
+        ActiveCall.client_invoke(@call)
         marshal = proc { |x| 'marshalled:' + x }
-        client_call = ActiveCall.new(call, marshal,
+        client_call = ActiveCall.new(@call, marshal,
                                      @pass_through, deadline)
         msg = 'message is a string'
         client_call.write_flag = f
         client_call.remote_send(msg)
         # flush the message in case writes are set to buffered
-        call.run_batch(CallOps::SEND_CLOSE_FROM_CLIENT => nil) if f == 1
+        @call.run_batch(CallOps::SEND_CLOSE_FROM_CLIENT => nil) if f == 1
 
         # confirm that the message was marshalled
         recvd_rpc =  @received_rpcs_queue.pop
@@ -199,9 +199,8 @@ describe GRPC::ActiveCall do
 
   describe 'sending initial metadata', send_initial_metadata: true do
     it 'sends metadata before sending a message if it hasnt been sent yet' do
-      call = make_test_call
       @client_call = ActiveCall.new(
-        call,
+        @call,
         @pass_through,
         @pass_through,
         deadline,
@@ -213,13 +212,13 @@ describe GRPC::ActiveCall do
 
       message = 'phony message'
 
-      expect(call).to(
+      expect(@call).to(
         receive(:run_batch)
           .with(
             hash_including(
               CallOps::SEND_INITIAL_METADATA => metadata)).once)
 
-      expect(call).to(
+      expect(@call).to(
         receive(:run_batch).with(hash_including(
                                    CallOps::SEND_MESSAGE => message)).once)
       @client_call.remote_send(message)
@@ -228,14 +227,12 @@ describe GRPC::ActiveCall do
     end
 
     it 'doesnt send metadata if it thinks its already been sent' do
-      call = make_test_call
-
-      @client_call = ActiveCall.new(call,
+      @client_call = ActiveCall.new(@call,
                                     @pass_through,
                                     @pass_through,
                                     deadline)
       expect(@client_call.metadata_sent).to eql(true)
-      expect(call).to(
+      expect(@call).to(
         receive(:run_batch).with(hash_including(
                                    CallOps::SEND_INITIAL_METADATA)).never)
 
@@ -243,9 +240,7 @@ describe GRPC::ActiveCall do
     end
 
     it 'sends metadata if it is explicitly sent and ok to do so' do
-      call = make_test_call
-
-      @client_call = ActiveCall.new(call,
+      @client_call = ActiveCall.new(@call,
                                     @pass_through,
                                     @pass_through,
                                     deadline,
@@ -257,7 +252,7 @@ describe GRPC::ActiveCall do
       @client_call.merge_metadata_to_send(metadata)
       expect(@client_call.metadata_to_send).to eq(metadata)
 
-      expect(call).to(
+      expect(@call).to(
         receive(:run_batch).with(hash_including(
                                    CallOps::SEND_INITIAL_METADATA =>
                                      metadata)).once)
@@ -265,9 +260,7 @@ describe GRPC::ActiveCall do
     end
 
     it 'explicit sending does nothing if metadata has already been sent' do
-      call = make_test_call
-
-      @client_call = ActiveCall.new(call,
+      @client_call = ActiveCall.new(@call,
                                     @pass_through,
                                     @pass_through,
                                     deadline)
@@ -284,7 +277,6 @@ describe GRPC::ActiveCall do
 
   describe '#merge_metadata_to_send', merge_metadata_to_send: true do
     it 'adds to existing metadata when there is existing metadata to send' do
-      call = make_test_call
       starting_metadata = {
         k1: 'key1_val',
         k2: 'key2_val',
@@ -292,7 +284,7 @@ describe GRPC::ActiveCall do
       }
 
       @client_call = ActiveCall.new(
-        call,
+        @call,
         @pass_through, @pass_through,
         deadline,
         started: false,
@@ -318,9 +310,8 @@ describe GRPC::ActiveCall do
     end
 
     it 'fails when initial metadata has already been sent' do
-      call = make_test_call
       @client_call = ActiveCall.new(
-        call,
+        @call,
         @pass_through,
         @pass_through,
         deadline,
@@ -338,9 +329,8 @@ describe GRPC::ActiveCall do
 
   describe '#client_invoke' do
     it 'sends metadata to the server when present' do
-      call = make_test_call
       metadata = { k1: 'v1', k2: 'v2' }
-      ActiveCall.client_invoke(call, metadata)
+      ActiveCall.client_invoke(@call, metadata)
       recvd_rpc =  @received_rpcs_queue.pop
       recvd_call = recvd_rpc.call
       expect(recvd_call).to_not be_nil
@@ -349,15 +339,14 @@ describe GRPC::ActiveCall do
       expect(recvd_rpc.metadata['k2']).to eq('v2')
       # finish the call
       recvd_call.run_batch(CallOps::SEND_INITIAL_METADATA => {})
-      call.run_batch(CallOps::RECV_INITIAL_METADATA => nil)
-      send_and_receive_close_and_status(call, recvd_call)
+      @call.run_batch(CallOps::RECV_INITIAL_METADATA => nil)
+      send_and_receive_close_and_status(@call, recvd_call)
     end
   end
 
   describe '#send_status', send_status: true do
     it 'works when no metadata or messages have been sent yet' do
-      call = make_test_call
-      ActiveCall.client_invoke(call)
+      ActiveCall.client_invoke(@call)
 
       recvd_rpc = @received_rpcs_queue.pop
       server_call = ActiveCall.new(
@@ -375,9 +364,8 @@ describe GRPC::ActiveCall do
 
   describe '#remote_read', remote_read: true do
     it 'reads the response sent by a server' do
-      call = make_test_call
-      ActiveCall.client_invoke(call)
-      client_call = ActiveCall.new(call, @pass_through,
+      ActiveCall.client_invoke(@call)
+      client_call = ActiveCall.new(@call, @pass_through,
                                    @pass_through, deadline)
       msg = 'message is a string'
       client_call.remote_send(msg)
@@ -385,13 +373,12 @@ describe GRPC::ActiveCall do
       server_call.remote_send('server_response')
       expect(client_call.remote_read).to eq('server_response')
       send_and_receive_close_and_status(
-        call, inner_call_of_active_call(server_call))
+        @call, inner_call_of_active_call(server_call))
     end
 
     it 'saves no metadata when the server adds no metadata' do
-      call = make_test_call
-      ActiveCall.client_invoke(call)
-      client_call = ActiveCall.new(call, @pass_through,
+      ActiveCall.client_invoke(@call)
+      client_call = ActiveCall.new(@call, @pass_through,
                                    @pass_through, deadline)
       msg = 'message is a string'
       client_call.remote_send(msg)
@@ -401,13 +388,12 @@ describe GRPC::ActiveCall do
       client_call.remote_read
       expect(client_call.metadata).to eq({})
       send_and_receive_close_and_status(
-        call, inner_call_of_active_call(server_call))
+        @call, inner_call_of_active_call(server_call))
     end
 
     it 'saves metadata add by the server' do
-      call = make_test_call
-      ActiveCall.client_invoke(call)
-      client_call = ActiveCall.new(call, @pass_through,
+      ActiveCall.client_invoke(@call)
+      client_call = ActiveCall.new(@call, @pass_through,
                                    @pass_through, deadline)
       msg = 'message is a string'
       client_call.remote_send(msg)
@@ -418,12 +404,11 @@ describe GRPC::ActiveCall do
       expected = { 'k1' => 'v1', 'k2' => 'v2' }
       expect(client_call.metadata).to eq(expected)
       send_and_receive_close_and_status(
-        call, inner_call_of_active_call(server_call))
+        @call, inner_call_of_active_call(server_call))
     end
 
     it 'get a status from server when nothing else sent from server' do
-      client_call = make_test_call
-      ActiveCall.client_invoke(client_call)
+      ActiveCall.client_invoke(@call)
 
       recvd_rpc = @received_rpcs_queue.pop
       recvd_call = recvd_rpc.call
@@ -438,22 +423,21 @@ describe GRPC::ActiveCall do
       server_call.send_status(OK, 'OK')
 
       # Check that we can receive initial metadata and a status
-      client_call.run_batch(
+      @call.run_batch(
         CallOps::RECV_INITIAL_METADATA => nil)
-      batch_result = client_call.run_batch(
+      batch_result = @call.run_batch(
         CallOps::RECV_STATUS_ON_CLIENT => nil)
 
       expect(batch_result.status.code).to eq(OK)
     end
 
     it 'get a nil msg before a status when an OK status is sent' do
-      call = make_test_call
-      ActiveCall.client_invoke(call)
-      client_call = ActiveCall.new(call, @pass_through,
+      ActiveCall.client_invoke(@call)
+      client_call = ActiveCall.new(@call, @pass_through,
                                    @pass_through, deadline)
       msg = 'message is a string'
       client_call.remote_send(msg)
-      call.run_batch(CallOps::SEND_CLOSE_FROM_CLIENT => nil)
+      @call.run_batch(CallOps::SEND_CLOSE_FROM_CLIENT => nil)
       server_call = expect_server_to_receive(msg)
       server_call.remote_send('server_response')
       server_call.send_status(OK, 'OK')
@@ -463,10 +447,9 @@ describe GRPC::ActiveCall do
     end
 
     it 'unmarshals the response using the unmarshal func' do
-      call = make_test_call
-      ActiveCall.client_invoke(call)
+      ActiveCall.client_invoke(@call)
       unmarshal = proc { |x| 'unmarshalled:' + x }
-      client_call = ActiveCall.new(call, @pass_through,
+      client_call = ActiveCall.new(@call, @pass_through,
                                    unmarshal, deadline)
 
       # confirm the client receives the unmarshalled message
@@ -476,14 +459,13 @@ describe GRPC::ActiveCall do
       server_call.remote_send('server_response')
       expect(client_call.remote_read).to eq('unmarshalled:server_response')
       send_and_receive_close_and_status(
-        call, inner_call_of_active_call(server_call))
+        @call, inner_call_of_active_call(server_call))
     end
   end
 
   describe '#each_remote_read' do
     it 'creates an Enumerator' do
-      call = make_test_call
-      client_call = ActiveCall.new(call, @pass_through,
+      client_call = ActiveCall.new(@call, @pass_through,
                                    @pass_through, deadline)
       expect(client_call.each_remote_read).to be_a(Enumerator)
       # finish the call
@@ -491,9 +473,8 @@ describe GRPC::ActiveCall do
     end
 
     it 'the returned enumerator can read n responses' do
-      call = make_test_call
-      ActiveCall.client_invoke(call)
-      client_call = ActiveCall.new(call, @pass_through,
+      ActiveCall.client_invoke(@call)
+      client_call = ActiveCall.new(@call, @pass_through,
                                    @pass_through, deadline)
       msg = 'message is a string'
       reply = 'server_response'
@@ -506,18 +487,17 @@ describe GRPC::ActiveCall do
         expect(e.next).to eq(reply)
       end
       send_and_receive_close_and_status(
-        call, inner_call_of_active_call(server_call))
+        @call, inner_call_of_active_call(server_call))
     end
 
     it 'the returns an enumerator that stops after an OK Status' do
-      call = make_test_call
-      ActiveCall.client_invoke(call)
-      client_call = ActiveCall.new(call, @pass_through,
+      ActiveCall.client_invoke(@call)
+      client_call = ActiveCall.new(@call, @pass_through,
                                    @pass_through, deadline)
       msg = 'message is a string'
       reply = 'server_response'
       client_call.remote_send(msg)
-      call.run_batch(CallOps::SEND_CLOSE_FROM_CLIENT => nil)
+      @call.run_batch(CallOps::SEND_CLOSE_FROM_CLIENT => nil)
       server_call = expect_server_to_receive(msg)
       e = client_call.each_remote_read
       n = 3 # arbitrary value > 1
@@ -532,14 +512,13 @@ describe GRPC::ActiveCall do
 
   describe '#closing the call from the client' do
     it 'finishes ok if the server sends a status response' do
-      call = make_test_call
-      ActiveCall.client_invoke(call)
-      client_call = ActiveCall.new(call, @pass_through,
+      ActiveCall.client_invoke(@call)
+      client_call = ActiveCall.new(@call, @pass_through,
                                    @pass_through, deadline)
       msg = 'message is a string'
       client_call.remote_send(msg)
       expect do
-        call.run_batch(CallOps::SEND_CLOSE_FROM_CLIENT => nil)
+        @call.run_batch(CallOps::SEND_CLOSE_FROM_CLIENT => nil)
       end.to_not raise_error
       server_call = expect_server_to_receive(msg)
       server_call.remote_send('server_response')
@@ -549,9 +528,8 @@ describe GRPC::ActiveCall do
     end
 
     it 'finishes ok if the server sends an early status response' do
-      call = make_test_call
-      ActiveCall.client_invoke(call)
-      client_call = ActiveCall.new(call, @pass_through,
+      ActiveCall.client_invoke(@call)
+      client_call = ActiveCall.new(@call, @pass_through,
                                    @pass_through, deadline)
       msg = 'message is a string'
       client_call.remote_send(msg)
@@ -560,15 +538,14 @@ describe GRPC::ActiveCall do
       server_call.send_status(OK, 'status code is OK')
       expect(client_call.remote_read).to eq('server_response')
       expect do
-        call.run_batch(CallOps::SEND_CLOSE_FROM_CLIENT => nil)
+        @call.run_batch(CallOps::SEND_CLOSE_FROM_CLIENT => nil)
       end.to_not raise_error
       expect { client_call.receive_and_check_status }.to_not raise_error
     end
 
     it 'finishes ok if SEND_CLOSE and RECV_STATUS has been sent' do
-      call = make_test_call
-      ActiveCall.client_invoke(call)
-      client_call = ActiveCall.new(call, @pass_through,
+      ActiveCall.client_invoke(@call)
+      client_call = ActiveCall.new(@call, @pass_through,
                                    @pass_through, deadline)
       msg = 'message is a string'
       client_call.remote_send(msg)
@@ -577,7 +554,7 @@ describe GRPC::ActiveCall do
       server_call.send_status(OK, 'status code is OK')
       expect(client_call.remote_read).to eq('server_response')
       expect do
-        call.run_batch(
+        @call.run_batch(
           CallOps::SEND_CLOSE_FROM_CLIENT => nil,
           CallOps::RECV_STATUS_ON_CLIENT => nil)
       end.to_not raise_error
@@ -631,6 +608,7 @@ describe GRPC::ActiveCall do
       batch_result = @client_call.run_batch(
         CallOps::RECV_STATUS_ON_CLIENT => nil)
       expect(batch_result.status.code).to eq(@server_status)
+      @client_call.close
     end
 
     it 'sends the initial metadata implicitly if not already sent' do

data/src/ruby/spec/support/services.rb

@@ -41,14 +41,17 @@ class EchoService
   rpc :a_bidi_rpc, stream(EchoMsg), stream(EchoMsg)
   rpc :a_client_streaming_rpc_unimplemented, stream(EchoMsg), EchoMsg
   attr_reader :received_md
+  attr_accessor :on_call_started
 
   def initialize(**kw)
     @trailing_metadata = kw
     @received_md = []
+    @on_call_started = nil
   end
 
   def an_rpc(req, call)
     GRPC.logger.info('echo service received a request')
+    on_call_started&.call(call)
     call.output_metadata.update(@trailing_metadata)
     @received_md << call.metadata unless call.metadata.nil?
     req

data/third_party/boringssl-with-bazel/src/crypto/{fipsmodule/rand/fork_detect.h → bcm_support.h}

@@ -1,4 +1,4 @@
-/* Copyright (c) 2020, Google Inc.
+/* Copyright (c) 2024, Google Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -12,11 +12,17 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
 
-#ifndef OPENSSL_HEADER_CRYPTO_FORK_DETECT_H
-#define OPENSSL_HEADER_CRYPTO_FORK_DETECT_H
+#ifndef OPENSSL_HEADER_CRYPTO_BCM_SUPPORT_H
+#define OPENSSL_HEADER_CRYPTO_BCM_SUPPORT_H
 
 #include <openssl/base.h>
 
+// Provided by libcrypto, called from BCM
+
+#if defined(__cplusplus)
+extern "C" {
+#endif
+
 #if defined(OPENSSL_LINUX)
 // On linux we use MADVISE instead of pthread_atfork(), due
 // to concerns about clone() being used for address space
@@ -35,10 +41,48 @@
 #define OPENSSL_DOES_NOT_FORK
 #endif
 
-#if defined(__cplusplus)
-extern "C" {
+#if defined(BORINGSSL_UNSAFE_DETERMINISTIC_MODE)
+#define OPENSSL_RAND_DETERMINISTIC
+#elif defined(OPENSSL_TRUSTY)
+#define OPENSSL_RAND_TRUSTY
+#elif defined(OPENSSL_WINDOWS)
+#define OPENSSL_RAND_WINDOWS
+#elif defined(OPENSSL_LINUX)
+#define OPENSSL_RAND_URANDOM
+#elif defined(OPENSSL_APPLE) && !defined(OPENSSL_MACOS)
+// Unlike macOS, iOS and similar hide away getentropy().
+#define OPENSSL_RAND_IOS
+#else
+// By default if you are integrating BoringSSL we expect you to
+// provide getentropy from the <unistd.h> header file.
+#define OPENSSL_RAND_GETENTROPY
 #endif
 
+// Provided by libcrypto, called from BCM
+
+// CRYPTO_init_sysrand initializes long-lived resources needed to draw entropy
+// from the operating system, if the operating system requires initialization.
+void CRYPTO_init_sysrand(void);
+
+// CRYPTO_sysrand fills |len| bytes at |buf| with entropy from the operating
+// system.
+void CRYPTO_sysrand(uint8_t *buf, size_t len);
+
+// CRYPTO_sysrand_if_available fills |len| bytes at |buf| with entropy from the
+// operating system, or early /dev/urandom data, and returns 1, _if_ the entropy
+// pool is initialized or if getrandom() is not available and not in FIPS mode.
+// Otherwise it will not block and will instead fill |buf| with all zeros and
+// return 0.
+int CRYPTO_sysrand_if_available(uint8_t *buf, size_t len);
+
+// CRYPTO_sysrand_for_seed fills |len| bytes at |buf| with entropy from the
+// operating system. It may draw from the |GRND_RANDOM| pool on Android,
+// depending on the vendor's configuration.
+void CRYPTO_sysrand_for_seed(uint8_t *buf, size_t len);
+
+// RAND_need_entropy is called whenever the BCM module has stopped because it
+// has run out of entropy.
+void RAND_need_entropy(size_t bytes_needed);
 
 // crypto_get_fork_generation returns the fork generation number for the current
 // process, or zero if not supported on the platform. The fork generation number
@@ -61,8 +105,9 @@ OPENSSL_EXPORT uint64_t CRYPTO_get_fork_generation(void);
 OPENSSL_EXPORT void CRYPTO_fork_detect_force_madv_wipeonfork_for_testing(
     int on);
 
+
 #if defined(__cplusplus)
 }  // extern C
 #endif
 
-#endif  // OPENSSL_HEADER_CRYPTO_FORK_DETECT_H
+#endif  // OPENSSL_HEADER_CRYPTO_BCM_SUPPORT_H

data/third_party/boringssl-with-bazel/src/crypto/cipher_extra/internal.h

@@ -192,22 +192,65 @@ OPENSSL_INLINE int chacha20_poly1305_asm_capable(void) {
 // Additional input parameters are passed in |aead_data->in|. On exit, it will
 // write calculated tag value to |aead_data->out.tag|, which the caller must
 // check.
+#if defined(OPENSSL_X86_64)
+extern void chacha20_poly1305_open_nohw(
+    uint8_t *out_plaintext, const uint8_t *ciphertext, size_t plaintext_len,
+    const uint8_t *ad, size_t ad_len, union chacha20_poly1305_open_data *data);
+extern void chacha20_poly1305_open_avx2(
+    uint8_t *out_plaintext, const uint8_t *ciphertext, size_t plaintext_len,
+    const uint8_t *ad, size_t ad_len, union chacha20_poly1305_open_data *data);
+OPENSSL_INLINE void chacha20_poly1305_open(uint8_t *out_plaintext,
+                                   const uint8_t *ciphertext,
+                                   size_t plaintext_len, const uint8_t *ad,
+                                   size_t ad_len,
+                                   union chacha20_poly1305_open_data *data) {
+  if (CRYPTO_is_AVX2_capable() && CRYPTO_is_BMI2_capable()) {
+    chacha20_poly1305_open_avx2(out_plaintext, ciphertext, plaintext_len, ad,
+                                ad_len, data);
+  } else {
+    chacha20_poly1305_open_nohw(out_plaintext, ciphertext, plaintext_len, ad,
+                                ad_len, data);
+  }
+}
+#else
 extern void chacha20_poly1305_open(uint8_t *out_plaintext,
                                    const uint8_t *ciphertext,
                                    size_t plaintext_len, const uint8_t *ad,
                                    size_t ad_len,
                                    union chacha20_poly1305_open_data *data);
+#endif
 
 // chacha20_poly1305_open is defined in chacha20_poly1305_*.pl. It encrypts
 // |plaintext_len| bytes from |plaintext| and writes them to |out_ciphertext|.
 // Additional input parameters are passed in |aead_data->in|. The calculated tag
 // value is over the computed ciphertext concatenated with |extra_ciphertext|
 // and written to |aead_data->out.tag|.
+#if defined(OPENSSL_X86_64)
+extern void chacha20_poly1305_seal_nohw(
+    uint8_t *out_ciphertext, const uint8_t *plaintext, size_t plaintext_len,
+    const uint8_t *ad, size_t ad_len, union chacha20_poly1305_seal_data *data);
+extern void chacha20_poly1305_seal_avx2(
+    uint8_t *out_ciphertext, const uint8_t *plaintext, size_t plaintext_len,
+    const uint8_t *ad, size_t ad_len, union chacha20_poly1305_seal_data *data);
+OPENSSL_INLINE void chacha20_poly1305_seal(
+    uint8_t *out_ciphertext, const uint8_t *plaintext, size_t plaintext_len,
+    const uint8_t *ad, size_t ad_len, union chacha20_poly1305_seal_data *data) {
+  if (CRYPTO_is_AVX2_capable() && CRYPTO_is_BMI2_capable()) {
+    chacha20_poly1305_seal_avx2(out_ciphertext, plaintext, plaintext_len, ad,
+                                ad_len, data);
+  } else {
+    chacha20_poly1305_seal_nohw(out_ciphertext, plaintext, plaintext_len, ad,
+                                ad_len, data);
+  }
+}
+#else
 extern void chacha20_poly1305_seal(uint8_t *out_ciphertext,
                                    const uint8_t *plaintext,
                                    size_t plaintext_len, const uint8_t *ad,
                                    size_t ad_len,
                                    union chacha20_poly1305_seal_data *data);
+#endif
+
 #else
 
 OPENSSL_INLINE int chacha20_poly1305_asm_capable(void) { return 0; }