grpc 1.69.0 → 1.71.0

data/src/core/xds/xds_client/xds_client.h

@@ -28,9 +28,12 @@
 #include <vector>
 
 #include "absl/base/thread_annotations.h"
+#include "absl/container/flat_hash_set.h"
 #include "absl/status/status.h"
 #include "absl/status/statusor.h"
 #include "absl/strings/string_view.h"
+#include "envoy/admin/v3/config_dump_shared.upb.h"
+#include "envoy/service/status/v3/csds.upb.h"
 #include "src/core/lib/debug/trace.h"
 #include "src/core/util/dual_ref_counted.h"
 #include "src/core/util/orphanable.h"
@@ -71,14 +74,12 @@ class XdsClient : public DualRefCounted<XdsClient> {
   class ResourceWatcherInterface : public RefCounted<ResourceWatcherInterface> {
    public:
     virtual void OnGenericResourceChanged(
-        std::shared_ptr<const XdsResourceType::ResourceData> resource,
+        absl::StatusOr<std::shared_ptr<const XdsResourceType::ResourceData>>
+            resource,
         RefCountedPtr<ReadDelayHandle> read_delay_handle)
         ABSL_EXCLUSIVE_LOCKS_REQUIRED(&work_serializer_) = 0;
-    virtual void OnError(absl::Status status,
-                         RefCountedPtr<ReadDelayHandle> read_delay_handle)
-        ABSL_EXCLUSIVE_LOCKS_REQUIRED(&work_serializer_) = 0;
-    virtual void OnResourceDoesNotExist(
-        RefCountedPtr<ReadDelayHandle> read_delay_handle)
+    virtual void OnAmbientError(
+        absl::Status status, RefCountedPtr<ReadDelayHandle> read_delay_handle)
         ABSL_EXCLUSIVE_LOCKS_REQUIRED(&work_serializer_) = 0;
   };
 
@@ -88,7 +89,9 @@ class XdsClient : public DualRefCounted<XdsClient> {
       std::shared_ptr<grpc_event_engine::experimental::EventEngine> engine,
       std::unique_ptr<XdsMetricsReporter> metrics_reporter,
       std::string user_agent_name, std::string user_agent_version,
-      Duration resource_request_timeout = Duration::Seconds(15));
+      // This parameter overrides the timer duration for testing
+      // purposes only -- do not use in production.
+      Duration resource_request_timeout = Duration::Zero());
   ~XdsClient() override;
 
   // Start and cancel watch for a resource.
@@ -138,8 +141,7 @@ class XdsClient : public DualRefCounted<XdsClient> {
   Mutex* mu() ABSL_LOCK_RETURNED(&mu_) { return &mu_; }
 
   // Dumps the active xDS config to the provided
-  // envoy.service.status.v3.ClientConfig message including the config status
-  // (e.g., CLIENT_REQUESTED, CLIENT_ACKED, CLIENT_NACKED).
+  // envoy.service.status.v3.ClientConfig message.
   void DumpClientConfig(std::set<std::string>* string_pool, upb_Arena* arena,
                         envoy_service_status_v3_ClientConfig* client_config)
       ABSL_EXCLUSIVE_LOCKS_REQUIRED(&mu_);
@@ -196,7 +198,6 @@ class XdsClient : public DualRefCounted<XdsClient> {
     ~XdsChannel() override;
 
     XdsClient* xds_client() const { return xds_client_.get(); }
-    AdsCall* ads_call() const;
 
     void ResetBackoff();
 
@@ -253,31 +254,132 @@ class XdsClient : public DualRefCounted<XdsClient> {
     absl::Status status_;
   };
 
-  struct ResourceState {
-    std::map<ResourceWatcherInterface*, RefCountedPtr<ResourceWatcherInterface>>
-        watchers;
+  using WatcherSet =
+      absl::flat_hash_set<RefCountedPtr<ResourceWatcherInterface>,
+                          RefCountedPtrHash<ResourceWatcherInterface>,
+                          RefCountedPtrEq<ResourceWatcherInterface>>;
+
+  class ResourceState {
+   public:
+    // Resource status from the view of a xDS client, which tells the
+    // synchronization status between the xDS client and the xDS server.
+    enum ClientResourceStatus {
+      // Client requested this resource but hasn't received any update from
+      // management server. The client will not fail requests, but will queue
+      // them until update arrives or the client times out waiting for the
+      // resource.
+      REQUESTED = 1,
+      // This resource has been requested by the client but has either not been
+      // delivered by the server or was previously delivered by the server and
+      // then subsequently removed from resources provided by the server.
+      DOES_NOT_EXIST,
+      // Client received this resource and replied with ACK.
+      ACKED,
+      // Client received this resource and replied with NACK.
+      NACKED,
+      // Server sent an error for the resource.
+      RECEIVED_ERROR,
+      // Client encountered timeout getting resource from server.
+      TIMEOUT,
+    };
+    static_assert(static_cast<ClientResourceStatus>(envoy_admin_v3_REQUESTED) ==
+                  ClientResourceStatus::REQUESTED);
+    static_assert(
+        static_cast<ClientResourceStatus>(envoy_admin_v3_DOES_NOT_EXIST) ==
+        ClientResourceStatus::DOES_NOT_EXIST);
+    static_assert(static_cast<ClientResourceStatus>(envoy_admin_v3_ACKED) ==
+                  ClientResourceStatus::ACKED);
+    static_assert(static_cast<ClientResourceStatus>(envoy_admin_v3_NACKED) ==
+                  ClientResourceStatus::NACKED);
+    static_assert(
+        static_cast<ClientResourceStatus>(envoy_admin_v3_RECEIVED_ERROR) ==
+        ClientResourceStatus::RECEIVED_ERROR);
+    static_assert(static_cast<ClientResourceStatus>(envoy_admin_v3_TIMEOUT) ==
+                  ClientResourceStatus::TIMEOUT);
+
+    void AddWatcher(RefCountedPtr<ResourceWatcherInterface> watcher) {
+      watchers_.insert(std::move(watcher));
+    }
+    void RemoveWatcher(ResourceWatcherInterface* watcher) {
+      watchers_.erase(watcher);
+    }
+    bool HasWatchers() const { return !watchers_.empty(); }
+    const WatcherSet& watchers() const { return watchers_; }
+
+    void SetAcked(std::shared_ptr<const XdsResourceType::ResourceData> resource,
+                  std::string serialized_proto, std::string version,
+                  Timestamp update_time);
+    void SetNacked(const std::string& version, absl::string_view details,
+                   Timestamp update_time, bool drop_cached_resource);
+    void SetReceivedError(const std::string& version, absl::Status status,
+                          Timestamp update_time, bool drop_cached_resource);
+    void SetDoesNotExistOnLdsOrCdsDeletion(const std::string& version,
+                                           Timestamp update_time,
+                                           bool drop_cached_resource);
+    void SetDoesNotExistOnTimeout();
+    void SetTimeout(const std::string& details);
+
+    ClientResourceStatus client_status() const { return client_status_; }
+    absl::string_view CacheStateString() const;
+
+    bool HasResource() const { return resource_ != nullptr; }
+    std::shared_ptr<const XdsResourceType::ResourceData> resource() const {
+      return resource_;
+    }
+
+    const absl::Status& failed_status() const { return failed_status_; }
+
+    void FillGenericXdsConfig(
+        upb_StringView type_url, upb_StringView resource_name, upb_Arena* arena,
+        envoy_service_status_v3_ClientConfig_GenericXdsConfig* entry) const;
+
+   private:
+    WatcherSet watchers_;
     // The latest data seen for the resource.
-    std::shared_ptr<const XdsResourceType::ResourceData> resource;
-    XdsApi::ResourceMetadata meta;
-    bool ignored_deletion = false;
+    std::shared_ptr<const XdsResourceType::ResourceData> resource_;
+    // Cache state.
+    ClientResourceStatus client_status_ = REQUESTED;
+    // The serialized bytes of the last successfully updated raw xDS resource.
+    std::string serialized_proto_;
+    // The timestamp when the resource was last successfully updated.
+    Timestamp update_time_;
+    // The last successfully updated version of the resource.
+    std::string version_;
+    // Details about the last failed update attempt or transient error.
+    absl::Status failed_status_;
+    // The rejected version string of the last failed update attempt.
+    std::string failed_version_;
+    // Timestamp of the last failed update attempt.
+    // Used only if failed_version_ is non-empty.
+    Timestamp failed_update_time_;
   };
 
   struct AuthorityState {
     std::vector<RefCountedPtr<XdsChannel>> xds_channels;
     std::map<const XdsResourceType*, std::map<XdsResourceKey, ResourceState>>
-        resource_map;
+        type_map;
   };
 
-  // Sends an error notification to a specific set of watchers.
-  void NotifyWatchersOnErrorLocked(
-      const std::map<ResourceWatcherInterface*,
-                     RefCountedPtr<ResourceWatcherInterface>>& watchers,
-      absl::Status status, RefCountedPtr<ReadDelayHandle> read_delay_handle);
-  // Sends a resource-does-not-exist notification to a specific set of watchers.
-  void NotifyWatchersOnResourceDoesNotExist(
-      const std::map<ResourceWatcherInterface*,
-                     RefCountedPtr<ResourceWatcherInterface>>& watchers,
+  absl::Status AppendNodeToStatus(const absl::Status& status) const;
+
+  // Sends an OnResourceChanged() notification to a specific set of watchers.
+  void NotifyWatchersOnResourceChanged(
+      absl::StatusOr<std::shared_ptr<const XdsResourceType::ResourceData>>
+          resource,
+      WatcherSet watchers, RefCountedPtr<ReadDelayHandle> read_delay_handle);
+  // Sends an OnAmbientError() notification to a specific set of watchers.
+  void NotifyWatchersOnAmbientError(
+      absl::Status status, WatcherSet watchers,
       RefCountedPtr<ReadDelayHandle> read_delay_handle);
+  // Notifies watchers for resource_state of an error, using
+  // OnResourceChanged() if there is no cached resource or
+  // OnAmbientError() if there is a cached resource.
+  void NotifyWatchersOnError(const ResourceState& resource_state,
+                             RefCountedPtr<ReadDelayHandle> read_delay_handle,
+                             // If empty, will use resource_state.watchers().
+                             WatcherSet watchers = {},
+                             // If OK, will use resource_state.failed_status().
+                             absl::Status status = absl::OkStatus());
 
   void MaybeRegisterResourceTypeLocked(const XdsResourceType* resource_type)
       ABSL_EXCLUSIVE_LOCKS_REQUIRED(mu_);
@@ -288,6 +390,10 @@ class XdsClient : public DualRefCounted<XdsClient> {
 
   bool HasUncachedResources(const AuthorityState& authority_state);
 
+  void MaybeRemoveUnsubscribedCacheEntriesForTypeLocked(
+      XdsChannel* xds_channel, const XdsResourceType* type)
+      ABSL_EXCLUSIVE_LOCKS_REQUIRED(mu_);
+
   absl::StatusOr<XdsResourceName> ParseXdsResourceName(
       absl::string_view name, const XdsResourceType* type);
   static std::string ConstructFullXdsResourceName(
@@ -299,10 +405,11 @@ class XdsClient : public DualRefCounted<XdsClient> {
       ABSL_EXCLUSIVE_LOCKS_REQUIRED(mu_);
 
   std::shared_ptr<XdsBootstrap> bootstrap_;
+  const std::string user_agent_name_;
+  const std::string user_agent_version_;
   RefCountedPtr<XdsTransportFactory> transport_factory_;
   const Duration request_timeout_;
   const bool xds_federation_enabled_;
-  XdsApi api_;
   WorkSerializer work_serializer_;
   std::shared_ptr<grpc_event_engine::experimental::EventEngine> engine_;
   std::unique_ptr<XdsMetricsReporter> metrics_reporter_;
@@ -323,8 +430,7 @@ class XdsClient : public DualRefCounted<XdsClient> {
 
   // Stores started watchers whose resource name was not parsed successfully,
   // waiting to be cancelled or reset in Orphan().
-  std::map<ResourceWatcherInterface*, RefCountedPtr<ResourceWatcherInterface>>
-      invalid_watchers_ ABSL_GUARDED_BY(mu_);
+  WatcherSet invalid_watchers_ ABSL_GUARDED_BY(mu_);
 
   bool shutting_down_ ABSL_GUARDED_BY(mu_) = false;
 };

data/src/core/xds/xds_client/xds_resource_type.h

@@ -19,11 +19,11 @@
 #include <grpc/support/port_platform.h>
 
 #include <memory>
+#include <optional>
 #include <string>
 
 #include "absl/status/statusor.h"
 #include "absl/strings/string_view.h"
-#include "absl/types/optional.h"
 #include "src/core/lib/debug/trace.h"
 #include "src/core/xds/xds_client/xds_bootstrap.h"
 #include "upb/mem/arena.h"
@@ -41,7 +41,6 @@ class XdsResourceType {
   struct DecodeContext {
     XdsClient* client;
     const XdsBootstrap::XdsServer& server;
-    TraceFlag* tracer;
     upb_DefPool* symtab;
     upb_Arena* arena;
   };
@@ -58,7 +57,7 @@ class XdsResourceType {
     // The resource's name, if it can be determined.
     // If the name is not returned, the resource field should contain a
     // non-OK status.
-    absl::optional<std::string> name;
+    std::optional<std::string> name;
     // The parsed and validated resource, or an error status.
     absl::StatusOr<std::shared_ptr<const ResourceData>> resource;
   };

data/src/core/xds/xds_client/xds_resource_type_impl.h

@@ -16,12 +16,12 @@
 
 #ifndef GRPC_SRC_CORE_XDS_XDS_CLIENT_XDS_RESOURCE_TYPE_IMPL_H
 #define GRPC_SRC_CORE_XDS_XDS_CLIENT_XDS_RESOURCE_TYPE_IMPL_H
-#include <grpc/support/port_platform.h>
 
 #include <memory>
 #include <utility>
 
 #include "absl/strings/string_view.h"
+#include "src/core/util/down_cast.h"
 #include "src/core/util/ref_counted_ptr.h"
 #include "src/core/xds/xds_client/xds_client.h"
 #include "src/core/xds/xds_client/xds_resource_type.h"
@@ -41,18 +41,23 @@ class XdsResourceTypeImpl : public XdsResourceType {
   class WatcherInterface : public XdsClient::ResourceWatcherInterface {
    public:
     virtual void OnResourceChanged(
-        std::shared_ptr<const ResourceType> resource,
+        absl::StatusOr<std::shared_ptr<const ResourceType>> resource,
         RefCountedPtr<XdsClient::ReadDelayHandle> read_delay_handle) = 0;
 
    private:
     // Get result from XdsClient generic watcher interface, perform
     // down-casting, and invoke the caller's OnResourceChanged() method.
     void OnGenericResourceChanged(
-        std::shared_ptr<const XdsResourceType::ResourceData> resource,
+        absl::StatusOr<std::shared_ptr<const XdsResourceType::ResourceData>>
+            resource,
         RefCountedPtr<XdsClient::ReadDelayHandle> read_delay_handle) override {
-      OnResourceChanged(
-          std::static_pointer_cast<const ResourceType>(std::move(resource)),
-          std::move(read_delay_handle));
+      if (!resource.ok()) {
+        OnResourceChanged(resource.status(), std::move(read_delay_handle));
+      } else {
+        OnResourceChanged(
+            std::static_pointer_cast<const ResourceType>(std::move(*resource)),
+            std::move(read_delay_handle));
+      }
     }
   };
 
@@ -77,8 +82,8 @@ class XdsResourceTypeImpl : public XdsResourceType {
 
   bool ResourcesEqual(const ResourceData* r1,
                       const ResourceData* r2) const override {
-    return *static_cast<const ResourceType*>(r1) ==
-           *static_cast<const ResourceType*>(r2);
+    return *DownCast<const ResourceType*>(r1) ==
+           *DownCast<const ResourceType*>(r2);
   }
 };
 

data/src/ruby/ext/grpc/extconf.rb

@@ -149,6 +149,7 @@ $CFLAGS << ' -g'
 def have_ruby_abi_version()
   return true if RUBY_ENGINE == 'truffleruby'
   # ruby_abi_version is only available in development versions: https://github.com/ruby/ruby/pull/6231
+  # See also discussion for Ruby 3.4 in https://github.com/grpc/grpc/pull/38338 and https://github.com/grpc/grpc/pull/38487
   return false if RUBY_PATCHLEVEL >= 0
 
   m = /(\d+)\.(\d+)/.match(RUBY_VERSION)

data/src/ruby/lib/grpc/version.rb

@@ -14,5 +14,5 @@
 
 # GRPC contains the General RPC module.
 module GRPC
-  VERSION = '1.69.0'
+  VERSION = '1.71.0'
 end

data/third_party/boringssl-with-bazel/src/crypto/asn1/{a_bitstr.c → a_bitstr.cc}

@@ -1,58 +1,16 @@
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.] */
+// Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
 
 #include <openssl/asn1.h>
 
@@ -142,6 +100,7 @@ ASN1_BIT_STRING *c2i_ASN1_BIT_STRING(ASN1_BIT_STRING **a,
   const unsigned char *p;
   unsigned char *s;
   int padding;
+  uint8_t padding_mask;
 
   if (len < 1) {
     OPENSSL_PUT_ERROR(ASN1, ASN1_R_STRING_TOO_SHORT);
@@ -170,7 +129,7 @@ ASN1_BIT_STRING *c2i_ASN1_BIT_STRING(ASN1_BIT_STRING **a,
   }
 
   // Unused bits in a BIT STRING must be zero.
-  uint8_t padding_mask = (1 << padding) - 1;
+  padding_mask = (1 << padding) - 1;
   if (padding != 0 && (len < 1 || (p[len - 1] & padding_mask) != 0)) {
     OPENSSL_PUT_ERROR(ASN1, ASN1_R_INVALID_BIT_STRING_PADDING);
     goto err;
@@ -182,7 +141,7 @@ ASN1_BIT_STRING *c2i_ASN1_BIT_STRING(ASN1_BIT_STRING **a,
   ret->flags |= (ASN1_STRING_FLAG_BITS_LEFT | padding);  // set
 
   if (len > 0) {
-    s = OPENSSL_memdup(p, len);
+    s = reinterpret_cast<uint8_t *>(OPENSSL_memdup(p, len));
     if (s == NULL) {
       goto err;
     }

data/third_party/boringssl-with-bazel/src/crypto/asn1/a_bool.cc

@@ -0,0 +1,53 @@
+// Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <openssl/asn1.h>
+
+#include <openssl/bytestring.h>
+#include <openssl/err.h>
+
+#include "../bytestring/internal.h"
+
+
+int i2d_ASN1_BOOLEAN(ASN1_BOOLEAN a, unsigned char **outp) {
+  CBB cbb;
+  if (!CBB_init(&cbb, 3) ||  //
+      !CBB_add_asn1_bool(&cbb, a != ASN1_BOOLEAN_FALSE)) {
+    CBB_cleanup(&cbb);
+    return -1;
+  }
+  return CBB_finish_i2d(&cbb, outp);
+}
+
+ASN1_BOOLEAN d2i_ASN1_BOOLEAN(ASN1_BOOLEAN *out, const unsigned char **inp,
+                              long len) {
+  if (len < 0) {
+    return ASN1_BOOLEAN_NONE;
+  }
+
+  CBS cbs;
+  CBS_init(&cbs, *inp, (size_t)len);
+  int val;
+  if (!CBS_get_asn1_bool(&cbs, &val)) {
+    OPENSSL_PUT_ERROR(ASN1, ASN1_R_DECODE_ERROR);
+    return ASN1_BOOLEAN_NONE;
+  }
+
+  ASN1_BOOLEAN ret = val ? ASN1_BOOLEAN_TRUE : ASN1_BOOLEAN_FALSE;
+  if (out != NULL) {
+    *out = ret;
+  }
+  *inp = CBS_data(&cbs);
+  return ret;
+}

data/third_party/boringssl-with-bazel/src/crypto/asn1/a_d2i_fp.cc

@@ -0,0 +1,47 @@
+// Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <openssl/asn1.h>
+
+#include <limits.h>
+
+#include <openssl/bio.h>
+#include <openssl/err.h>
+#include <openssl/mem.h>
+
+
+void *ASN1_item_d2i_bio(const ASN1_ITEM *it, BIO *in, void *x) {
+  uint8_t *data;
+  size_t len;
+  // Historically, this function did not impose a limit in OpenSSL and is used
+  // to read CRLs, so we leave this without an external bound.
+  if (!BIO_read_asn1(in, &data, &len, INT_MAX)) {
+    return NULL;
+  }
+  const uint8_t *ptr = data;
+  void *ret = ASN1_item_d2i(reinterpret_cast<ASN1_VALUE **>(x), &ptr, len, it);
+  OPENSSL_free(data);
+  return ret;
+}
+
+void *ASN1_item_d2i_fp(const ASN1_ITEM *it, FILE *in, void *x) {
+  BIO *b = BIO_new_fp(in, BIO_NOCLOSE);
+  if (b == NULL) {
+    OPENSSL_PUT_ERROR(ASN1, ERR_R_BUF_LIB);
+    return NULL;
+  }
+  void *ret = ASN1_item_d2i_bio(it, b, x);
+  BIO_free(b);
+  return ret;
+}

data/third_party/boringssl-with-bazel/src/crypto/asn1/a_dup.cc

@@ -0,0 +1,42 @@
+// Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <openssl/asn1.h>
+
+#include <openssl/err.h>
+#include <openssl/mem.h>
+
+// ASN1_ITEM version of dup: this follows the model above except we don't
+// need to allocate the buffer. At some point this could be rewritten to
+// directly dup the underlying structure instead of doing and encode and
+// decode.
+void *ASN1_item_dup(const ASN1_ITEM *it, void *x) {
+  unsigned char *b = NULL;
+  const unsigned char *p;
+  long i;
+  void *ret;
+
+  if (x == NULL) {
+    return NULL;
+  }
+
+  i = ASN1_item_i2d(reinterpret_cast<ASN1_VALUE *>(x), &b, it);
+  if (b == NULL) {
+    return NULL;
+  }
+  p = b;
+  ret = ASN1_item_d2i(NULL, &p, i, it);
+  OPENSSL_free(b);
+  return ret;
+}