grpc 1.81.1 → 1.85.0

data/third_party/boringssl-with-bazel/include/openssl/obj.h

@@ -42,46 +42,46 @@ extern "C" {
 
 // Basic operations.
 
-// OBJ_dup returns a duplicate copy of |obj| or NULL on allocation failure. The
-// caller must call |ASN1_OBJECT_free| on the result to release it.
+// OBJ_dup returns a duplicate copy of `obj` or NULL on allocation failure. The
+// caller must call `ASN1_OBJECT_free` on the result to release it.
 OPENSSL_EXPORT ASN1_OBJECT *OBJ_dup(const ASN1_OBJECT *obj);
 
-// OBJ_cmp returns a value less than, equal to or greater than zero if |a| is
-// less than, equal to or greater than |b|, respectively.
+// OBJ_cmp returns a value less than, equal to or greater than zero if `a` is
+// less than, equal to or greater than `b`, respectively.
 OPENSSL_EXPORT int OBJ_cmp(const ASN1_OBJECT *a, const ASN1_OBJECT *b);
 
-// OBJ_get0_data returns a pointer to the DER representation of |obj|. This is
+// OBJ_get0_data returns a pointer to the DER representation of `obj`. This is
 // the contents of the DER-encoded identifier, not including the tag and length.
-// If |obj| does not have an associated object identifier (i.e. it is a nid-only
+// If `obj` does not have an associated object identifier (i.e. it is a nid-only
 // value), this value is the empty string.
 OPENSSL_EXPORT const uint8_t *OBJ_get0_data(const ASN1_OBJECT *obj);
 
-// OBJ_length returns the length of the DER representation of |obj|. This is the
+// OBJ_length returns the length of the DER representation of `obj`. This is the
 // contents of the DER-encoded identifier, not including the tag and length. If
-// |obj| does not have an associated object identifier (i.e. it is a nid-only
+// `obj` does not have an associated object identifier (i.e. it is a nid-only
 // value), this value is the empty string.
 OPENSSL_EXPORT size_t OBJ_length(const ASN1_OBJECT *obj);
 
 
 // Looking up nids.
 
-// OBJ_obj2nid returns the nid corresponding to |obj|, or |NID_undef| if no
+// OBJ_obj2nid returns the nid corresponding to `obj`, or `NID_undef` if no
 // such object is known.
 OPENSSL_EXPORT int OBJ_obj2nid(const ASN1_OBJECT *obj);
 
-// OBJ_cbs2nid returns the nid corresponding to the DER data in |cbs|, or
-// |NID_undef| if no such object is known.
+// OBJ_cbs2nid returns the nid corresponding to the DER data in `cbs`, or
+// `NID_undef` if no such object is known.
 OPENSSL_EXPORT int OBJ_cbs2nid(const CBS *cbs);
 
-// OBJ_sn2nid returns the nid corresponding to |short_name|, or |NID_undef| if
+// OBJ_sn2nid returns the nid corresponding to `short_name`, or `NID_undef` if
 // no such short name is known.
 OPENSSL_EXPORT int OBJ_sn2nid(const char *short_name);
 
-// OBJ_ln2nid returns the nid corresponding to |long_name|, or |NID_undef| if
+// OBJ_ln2nid returns the nid corresponding to `long_name`, or `NID_undef` if
 // no such long name is known.
 OPENSSL_EXPORT int OBJ_ln2nid(const char *long_name);
 
-// OBJ_txt2nid returns the nid corresponding to |s|, which may be a short name,
+// OBJ_txt2nid returns the nid corresponding to `s`, which may be a short name,
 // long name, or an ASCII string containing a dotted sequence of numbers. It
 // returns the nid or NID_undef if unknown.
 OPENSSL_EXPORT int OBJ_txt2nid(const char *s);
@@ -89,54 +89,54 @@ OPENSSL_EXPORT int OBJ_txt2nid(const char *s);
 
 // Getting information about nids.
 
-// OBJ_nid2obj returns the |ASN1_OBJECT| corresponding to |nid|, or NULL if
-// |nid| is unknown.
+// OBJ_nid2obj returns the `ASN1_OBJECT` corresponding to `nid`, or NULL if
+// `nid` is unknown.
 //
 // Although the output is not const, this function returns a static, immutable
-// |ASN1_OBJECT|. It is not necessary to release the object with
-// |ASN1_OBJECT_free|.
+// `ASN1_OBJECT`. It is not necessary to release the object with
+// `ASN1_OBJECT_free`.
 //
-// However, functions like |X509_ALGOR_set0| expect to take ownership of a
-// possibly dynamically-allocated |ASN1_OBJECT|. |ASN1_OBJECT_free| is a no-op
-// for static |ASN1_OBJECT|s, so |OBJ_nid2obj| is compatible with such
+// However, functions like `X509_ALGOR_set0` expect to take ownership of a
+// possibly dynamically-allocated `ASN1_OBJECT`. `ASN1_OBJECT_free` is a no-op
+// for static `ASN1_OBJECT`s, so `OBJ_nid2obj` is compatible with such
 // functions.
 //
 // Callers are encouraged to store the result of this function in a const
-// pointer. However, if using functions like |X509_ALGOR_set0|, callers may use
+// pointer. However, if using functions like `X509_ALGOR_set0`, callers may use
 // a non-const pointer and manage ownership.
 OPENSSL_EXPORT ASN1_OBJECT *OBJ_nid2obj(int nid);
 
-// OBJ_get_undef returns the object for |NID_undef|. Prefer this function over
-// |OBJ_nid2obj| to avoid pulling in the full OID table.
+// OBJ_get_undef returns the object for `NID_undef`. Prefer this function over
+// `OBJ_nid2obj` to avoid pulling in the full OID table.
 OPENSSL_EXPORT const ASN1_OBJECT *OBJ_get_undef(void);
 
-// OBJ_nid2sn returns the short name for |nid|, or NULL if |nid| is unknown.
+// OBJ_nid2sn returns the short name for `nid`, or NULL if `nid` is unknown.
 OPENSSL_EXPORT const char *OBJ_nid2sn(int nid);
 
-// OBJ_nid2ln returns the long name for |nid|, or NULL if |nid| is unknown.
+// OBJ_nid2ln returns the long name for `nid`, or NULL if `nid` is unknown.
 OPENSSL_EXPORT const char *OBJ_nid2ln(int nid);
 
-// OBJ_nid2cbb writes |nid| as an ASN.1 OBJECT IDENTIFIER to |out|. It returns
+// OBJ_nid2cbb writes `nid` as an ASN.1 OBJECT IDENTIFIER to `out`. It returns
 // one on success or zero otherwise.
 OPENSSL_EXPORT int OBJ_nid2cbb(CBB *out, int nid);
 
 
 // Dealing with textual representations of object identifiers.
 
-// OBJ_txt2obj returns an ASN1_OBJECT for the textual representation in |s|.
-// If |dont_search_names| is zero, then |s| will be matched against the long
-// and short names of a known objects to find a match. Otherwise |s| must
+// OBJ_txt2obj returns an ASN1_OBJECT for the textual representation in `s`.
+// If `dont_search_names` is zero, then `s` will be matched against the long
+// and short names of a known objects to find a match. Otherwise `s` must
 // contain an ASCII string with a dotted sequence of numbers. The resulting
 // object need not be previously known. It returns a freshly allocated
-// |ASN1_OBJECT| or NULL on error.
+// `ASN1_OBJECT` or NULL on error.
 OPENSSL_EXPORT ASN1_OBJECT *OBJ_txt2obj(const char *s, int dont_search_names);
 
-// OBJ_obj2txt converts |obj| to a textual representation. If
-// |always_return_oid| is zero then |obj| will be matched against known objects
+// OBJ_obj2txt converts `obj` to a textual representation. If
+// `always_return_oid` is zero then `obj` will be matched against known objects
 // and the long (preferably) or short name will be used if found. Otherwise
-// |obj| will be converted into a dotted sequence of integers. If |out| is not
-// NULL, then at most |out_len| bytes of the textual form will be written
-// there. If |out_len| is at least one, then string written to |out| will
+// `obj` will be converted into a dotted sequence of integers. If `out` is not
+// NULL, then at most `out_len` bytes of the textual form will be written
+// there. If `out_len` is at least one, then string written to `out` will
 // always be NUL terminated. It returns the number of characters that could
 // have been written, not including the final NUL, or -1 on error.
 OPENSSL_EXPORT int OBJ_obj2txt(char *out, int out_len, const ASN1_OBJECT *obj,
@@ -153,7 +153,7 @@ OPENSSL_EXPORT int OBJ_obj2txt(char *out, int out_len, const ASN1_OBJECT *obj,
 // address space add conflicting values, only one registration will take effect.
 // Avoid this function if possible. Instead, callers can process OIDs unknown to
 // BoringSSL by acting on the byte representation directly. See
-// |ASN1_OBJECT_create|, |OBJ_get0_data|, and |OBJ_length|.
+// `ASN1_OBJECT_create`, `OBJ_get0_data`, and `OBJ_length`.
 OPENSSL_EXPORT int OBJ_create(const char *oid, const char *short_name,
                               const char *long_name);
 
@@ -165,20 +165,20 @@ OPENSSL_EXPORT int OBJ_create(const char *oid, const char *short_name,
 // and public-key algorithms and the NIDs that specify their combination.
 //
 // Sometimes the combination NID leaves the digest unspecified (e.g.
-// rsassaPss). In these cases, the digest NID is |NID_undef|.
+// rsassaPss). In these cases, the digest NID is `NID_undef`.
 
 // OBJ_find_sigid_algs finds the digest and public-key NIDs that correspond to
-// the signing algorithm |sign_nid|. If successful, it sets |*out_digest_nid|
-// and |*out_pkey_nid| and returns one. Otherwise it returns zero. Any of
-// |out_digest_nid| or |out_pkey_nid| can be NULL if the caller doesn't need
+// the signing algorithm `sign_nid`. If successful, it sets `*out_digest_nid`
+// and `*out_pkey_nid` and returns one. Otherwise it returns zero. Any of
+// `out_digest_nid` or `out_pkey_nid` can be NULL if the caller doesn't need
 // that output value.
 OPENSSL_EXPORT int OBJ_find_sigid_algs(int sign_nid, int *out_digest_nid,
                                        int *out_pkey_nid);
 
 // OBJ_find_sigid_by_algs finds the signature NID that corresponds to the
-// combination of |digest_nid| and |pkey_nid|. If success, it sets
-// |*out_sign_nid| and returns one. Otherwise it returns zero. The
-// |out_sign_nid| argument can be NULL if the caller only wishes to learn
+// combination of `digest_nid` and `pkey_nid`. If success, it sets
+// `*out_sign_nid` and returns one. Otherwise it returns zero. The
+// `out_sign_nid` argument can be NULL if the caller only wishes to learn
 // whether the combination is valid.
 OPENSSL_EXPORT int OBJ_find_sigid_by_algs(int *out_sign_nid, int digest_nid,
                                           int pkey_nid);
@@ -196,17 +196,17 @@ typedef struct obj_name_st {
 #define OBJ_NAME_TYPE_MD_METH 1
 #define OBJ_NAME_TYPE_CIPHER_METH 2
 
-// OBJ_NAME_do_all_sorted calls |callback| zero or more times, each time with
-// the name of a different primitive. If |type| is |OBJ_NAME_TYPE_MD_METH| then
-// the primitives will be hash functions, alternatively if |type| is
-// |OBJ_NAME_TYPE_CIPHER_METH| then the primitives will be ciphers or cipher
+// OBJ_NAME_do_all_sorted calls `callback` zero or more times, each time with
+// the name of a different primitive. If `type` is `OBJ_NAME_TYPE_MD_METH` then
+// the primitives will be hash functions, alternatively if `type` is
+// `OBJ_NAME_TYPE_CIPHER_METH` then the primitives will be ciphers or cipher
 // modes.
 //
 // This function is ill-specified and should never be used.
 OPENSSL_EXPORT void OBJ_NAME_do_all_sorted(
     int type, void (*callback)(const OBJ_NAME *, void *arg), void *arg);
 
-// OBJ_NAME_do_all calls |OBJ_NAME_do_all_sorted|.
+// OBJ_NAME_do_all calls `OBJ_NAME_do_all_sorted`.
 OPENSSL_EXPORT void OBJ_NAME_do_all(int type, void (*callback)(const OBJ_NAME *,
                                                                void *arg),
                                     void *arg);

data/third_party/boringssl-with-bazel/include/openssl/opensslconf.h

@@ -65,6 +65,7 @@
 #define OPENSSL_NO_SSL3_METHOD
 #define OPENSSL_NO_STATIC_ENGINE
 #define OPENSSL_NO_STORE
+#define OPENSSL_NO_UI_CONSOLE
 #define OPENSSL_NO_WHIRLPOOL
 
 // We do not implement OpenSSL's CMS API, except for a tiny subset. Projects
@@ -75,4 +76,33 @@
 #define OPENSSL_NO_CMS
 #endif
 
+// C and C++ handle inline functions differently. In C++, an inline function is
+// defined in just the header file, potentially emitted in multiple compilation
+// units (in cases the compiler did not inline), but each copy must be identical
+// to satisfy ODR. In C, a non-static inline must be manually emitted in exactly
+// one compilation unit with a separate extern inline declaration.
+//
+// In both languages, exported inline functions referencing file-local symbols
+// are problematic. C forbids this altogether (though GCC and Clang seem not to
+// enforce it). It works in C++, but ODR requires the definitions be identical,
+// including all names in the definitions resolving to the "same entity". In
+// practice, this is unlikely to be a problem, but an inline function that
+// returns a pointer to a file-local symbol
+// could compile oddly.
+//
+// Historically, we used static inline in headers. However, to satisfy ODR, use
+// plain inline in C++, to allow inline consumer functions to call our header
+// functions. Plain inline would also work better with C99 inline, but that is
+// not used much in practice, extern inline is tedious, and there are conflicts
+// with the old gnu89 model:
+// https://stackoverflow.com/questions/216510/extern-inline
+//
+// So in C, always use static inline, whereas in C++, use static inline
+// only if `BORINGSSL_ALWAYS_USE_STATIC_INLINE` is defined (which may be useful
+// for some FFI integrations in conjunction with `BORINGSSL_PREFIX`, as static
+// inline functions are local to the compilation unit and need no prefix).
+#if !defined(__cplusplus) && !defined(BORINGSSL_ALWAYS_USE_STATIC_INLINE)
+#define BORINGSSL_ALWAYS_USE_STATIC_INLINE
+#endif
+
 #endif  // OPENSSL_HEADER_OPENSSLCONF_H

data/third_party/boringssl-with-bazel/include/openssl/params.h

@@ -0,0 +1,42 @@
+// Copyright 2026 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef OPENSSL_HEADER_PARAMS_H
+#define OPENSSL_HEADER_PARAMS_H
+
+#include <openssl/base.h>   // IWYU pragma: export
+
+#if defined(__cplusplus)
+extern "C" {
+#endif
+
+// ossl_param_st is a structure for passing arbitrary parameters. It is
+// currently never returned from BoringSSL, but is defined here for
+// compatibility with OpenSSL.
+struct ossl_param_st {
+  const char *key;
+  uint32_t data_type;
+  void *data;
+  size_t data_size;
+  size_t return_size;
+};
+
+// OSSL_PARAM_END is a terminating element in an array of `OSSL_PARAM`s.
+#define OSSL_PARAM_END {NULL, 0, NULL, 0, 0}
+
+#if defined(__cplusplus)
+}  // extern C
+#endif
+
+#endif  // OPENSSL_HEADER_PARAMS_H

data/third_party/boringssl-with-bazel/include/openssl/pem.h

@@ -25,14 +25,22 @@
 #include <openssl/x509.h>
 
 // For compatibility with open-iscsi, which assumes that it can get
-// |OPENSSL_malloc| from pem.h or err.h
+// `OPENSSL_malloc` from pem.h or err.h
 #include <openssl/crypto.h>
 
-#ifdef __cplusplus
+#if defined(__cplusplus)
 extern "C" {
 #endif
 
 
+// PEM.
+//
+// This library contains functions for reading and writing data encoded in PEM
+// format. This format originated in Privacy-Enhanced Mail (RFC 1421).
+//
+// TODO(crbug.com/42290574): Finish documenting this header.
+
+
 #define PEM_BUFSIZE 1024
 
 #define PEM_STRING_X509_OLD "X509 CERTIFICATE"
@@ -60,7 +68,6 @@ extern "C" {
 #define PEM_STRING_ECPRIVATEKEY "EC PRIVATE KEY"
 #define PEM_STRING_CMS "CMS"
 
-// enc_type is one off
 #define PEM_TYPE_ENCRYPTED 10
 #define PEM_TYPE_MIC_ONLY 20
 #define PEM_TYPE_MIC_CLEAR 30
@@ -270,20 +277,20 @@ extern "C" {
 // "userdata": new with OpenSSL 0.9.4
 typedef int pem_password_cb(char *buf, int size, int rwflag, void *userdata);
 
-// PEM_read_bio reads from |bp|, until the next PEM block. If one is found, it
-// returns one and sets |*name|, |*header|, and |*data| to newly-allocated
+// PEM_read_bio reads from `bp`, until the next PEM block. If one is found, it
+// returns one and sets `*name`, `*header`, and `*data` to newly-allocated
 // buffers containing the PEM type, the header block, and the decoded data,
-// respectively. |*name| and |*header| are NUL-terminated C strings, while
-// |*data| has |*len| bytes. The caller must release each of |*name|, |*header|,
-// and |*data| with |OPENSSL_free| when done. If no PEM block is found, this
-// function returns zero and pushes |PEM_R_NO_START_LINE| to the error queue. If
+// respectively. `*name` and `*header` are NUL-terminated C strings, while
+// `*data` has `*len` bytes. The caller must release each of `*name`, `*header`,
+// and `*data` with `OPENSSL_free` when done. If no PEM block is found, this
+// function returns zero and pushes `PEM_R_NO_START_LINE` to the error queue. If
 // one is found, but there is an error decoding it, it returns zero and pushes
 // some other error to the error queue.
 OPENSSL_EXPORT int PEM_read_bio(BIO *bp, char **name, char **header,
                                 unsigned char **data, long *len);
 
-// PEM_write_bio writes a PEM block to |bp|, containing |len| bytes from |data|
-// as data. |name| and |hdr| are NUL-terminated C strings containing the PEM
+// PEM_write_bio writes a PEM block to `bp`, containing `len` bytes from `data`
+// as data. `name` and `hdr` are NUL-terminated C strings containing the PEM
 // type and header block, respectively. This function returns zero on error and
 // the number of bytes written on success.
 OPENSSL_EXPORT int PEM_write_bio(BIO *bp, const char *name, const char *hdr,
@@ -300,35 +307,35 @@ OPENSSL_EXPORT int PEM_ASN1_write_bio(i2d_of_void *i2d, const char *name,
                                       const unsigned char *pass, int pass_len,
                                       pem_password_cb *cb, void *u);
 
-// PEM_X509_INFO_read_bio reads PEM blocks from |bp| and decodes any
+// PEM_X509_INFO_read_bio reads PEM blocks from `bp` and decodes any
 // certificates, CRLs, and private keys found. It returns a
-// |STACK_OF(X509_INFO)| structure containing the results, or NULL on error.
+// `STACK_OF(X509_INFO)` structure containing the results, or NULL on error.
 //
-// If |sk| is NULL, the result on success will be a newly-allocated
-// |STACK_OF(X509_INFO)| structure which should be released with
-// |sk_X509_INFO_pop_free| and |X509_INFO_free| when done.
+// If `sk` is NULL, the result on success will be a newly-allocated
+// `STACK_OF(X509_INFO)` structure which should be released with
+// `sk_X509_INFO_pop_free` and `X509_INFO_free` when done.
 //
-// If |sk| is non-NULL, it appends the results to |sk| instead and returns |sk|
-// on success. In this case, the caller retains ownership of |sk| in both
+// If `sk` is non-NULL, it appends the results to `sk` instead and returns `sk`
+// on success. In this case, the caller retains ownership of `sk` in both
 // success and failure.
 //
-// This function will decrypt any encrypted certificates in |bp|, using |cb|,
+// This function will decrypt any encrypted certificates in `bp`, using `cb`,
 // but it will not decrypt encrypted private keys. Encrypted private keys are
-// instead represented as placeholder |X509_INFO| objects with an empty |x_pkey|
+// instead represented as placeholder `X509_INFO` objects with an empty `x_pkey`
 // field. This allows this function to be used with inputs with unencrypted
 // certificates, but encrypted passwords, without knowing the password. However,
 // it also means that this function cannot be used to decrypt the private key
 // when the password is known.
 //
 // WARNING: If the input contains "TRUSTED CERTIFICATE" PEM blocks, this
-// function parses auxiliary properties as in |d2i_X509_AUX|. Passing untrusted
+// function parses auxiliary properties as in `d2i_X509_AUX`. Passing untrusted
 // input to this function allows an attacker to influence those properties. See
-// |d2i_X509_AUX| for details.
+// `d2i_X509_AUX` for details.
 OPENSSL_EXPORT STACK_OF(X509_INFO) *PEM_X509_INFO_read_bio(
     BIO *bp, STACK_OF(X509_INFO) *sk, pem_password_cb *cb, void *u);
 
-// PEM_X509_INFO_read behaves like |PEM_X509_INFO_read_bio| but reads from a
-// |FILE|.
+// PEM_X509_INFO_read behaves like `PEM_X509_INFO_read_bio` but reads from a
+// `FILE`.
 OPENSSL_EXPORT STACK_OF(X509_INFO) *PEM_X509_INFO_read(FILE *fp,
                                                        STACK_OF(X509_INFO) *sk,
                                                        pem_password_cb *cb,
@@ -345,9 +352,9 @@ OPENSSL_EXPORT int PEM_ASN1_write(i2d_of_void *i2d, const char *name, FILE *fp,
                                   const unsigned char *pass, int pass_len,
                                   pem_password_cb *callback, void *u);
 
-// PEM_def_callback treats |userdata| as a string and copies it into |buf|,
-// assuming its |size| is sufficient. Returns the length of the string, or -1 on
-// error. Error cases the buffer being too small, or |buf| and |userdata| being
+// PEM_def_callback treats `userdata` as a string and copies it into `buf`,
+// assuming its `size` is sufficient. Returns the length of the string, or -1 on
+// error. Error cases the buffer being too small, or `buf` and `userdata` being
 // NULL. Note that this is different from OpenSSL, which prompts for a password.
 OPENSSL_EXPORT int PEM_def_callback(char *buf, int size, int rwflag,
                                     void *userdata);
@@ -356,7 +363,8 @@ OPENSSL_EXPORT int PEM_def_callback(char *buf, int size, int rwflag,
 DECLARE_PEM_rw(X509, X509)
 
 // TODO(crbug.com/boringssl/426): When documenting these, copy the warning
-// about auxiliary properties from |PEM_X509_INFO_read_bio|.
+// about auxiliary properties from `PEM_X509_INFO_read_bio`.
+
 DECLARE_PEM_rw(X509_AUX, X509)
 
 DECLARE_PEM_rw(X509_REQ, X509_REQ)
@@ -437,8 +445,8 @@ OPENSSL_EXPORT int PEM_write_PKCS8PrivateKey(FILE *fp, const EVP_PKEY *x,
                                              pem_password_cb *cd, void *u);
 
 
-#ifdef __cplusplus
-}  // extern "C"
+#if defined(__cplusplus)
+}  // extern C
 #endif
 
 #define PEM_R_BAD_BASE64_DECODE 100
@@ -457,5 +465,6 @@ OPENSSL_EXPORT int PEM_write_PKCS8PrivateKey(FILE *fp, const EVP_PKEY *x,
 #define PEM_R_UNSUPPORTED_CIPHER 113
 #define PEM_R_UNSUPPORTED_ENCRYPTION 114
 #define PEM_R_UNSUPPORTED_PROC_TYPE_VERSION 115
+#define PEM_R_NO_DATA 116
 
 #endif  // OPENSSL_HEADER_PEM_H

data/third_party/boringssl-with-bazel/include/openssl/pkcs7.h

@@ -29,74 +29,75 @@ extern "C" {
 // This library contains functions for extracting information from PKCS#7
 // structures (RFC 2315).
 
+
 DECLARE_STACK_OF(CRYPTO_BUFFER)
 DECLARE_STACK_OF(X509)
 DECLARE_STACK_OF(X509_CRL)
 
-// PKCS7_get_raw_certificates parses a PKCS#7, SignedData structure from |cbs|
-// and appends the included certificates to |out_certs|. It returns one on
-// success and zero on error. |cbs| is advanced passed the structure.
+// PKCS7_get_raw_certificates parses a PKCS#7, SignedData structure from `cbs`
+// and appends the included certificates to `out_certs`. It returns one on
+// success and zero on error. `cbs` is advanced passed the structure.
 //
 // Note that a SignedData structure may contain no certificates, in which case
 // this function succeeds but does not append any certificates. Additionally,
 // certificates in SignedData structures are unordered. Callers should not
-// assume a particular order in |*out_certs| and may need to search for matches
+// assume a particular order in `*out_certs` and may need to search for matches
 // or run path-building algorithms.
 OPENSSL_EXPORT int PKCS7_get_raw_certificates(
     STACK_OF(CRYPTO_BUFFER) *out_certs, CBS *cbs, CRYPTO_BUFFER_POOL *pool);
 
-// PKCS7_get_certificates behaves like |PKCS7_get_raw_certificates| but parses
-// them into |X509| objects.
+// PKCS7_get_certificates behaves like `PKCS7_get_raw_certificates` but parses
+// them into `X509` objects.
 OPENSSL_EXPORT int PKCS7_get_certificates(STACK_OF(X509) *out_certs, CBS *cbs);
 
 // PKCS7_bundle_raw_certificates appends a PKCS#7, SignedData structure
-// containing |certs| to |out|. It returns one on success and zero on error.
+// containing `certs` to `out`. It returns one on success and zero on error.
 // Note that certificates in SignedData structures are unordered. The order in
-// |certs| will not be preserved.
+// `certs` will not be preserved.
 OPENSSL_EXPORT int PKCS7_bundle_raw_certificates(
     CBB *out, const STACK_OF(CRYPTO_BUFFER) *certs);
 
-// PKCS7_bundle_certificates behaves like |PKCS7_bundle_raw_certificates| but
-// takes |X509| objects as input.
+// PKCS7_bundle_certificates behaves like `PKCS7_bundle_raw_certificates` but
+// takes `X509` objects as input.
 OPENSSL_EXPORT int PKCS7_bundle_certificates(
     CBB *out, const STACK_OF(X509) *certs);
 
-// PKCS7_get_CRLs parses a PKCS#7, SignedData structure from |cbs| and appends
-// the included CRLs to |out_crls|. It returns one on success and zero on error.
-// |cbs| is advanced passed the structure.
+// PKCS7_get_CRLs parses a PKCS#7, SignedData structure from `cbs` and appends
+// the included CRLs to `out_crls`. It returns one on success and zero on error.
+// `cbs` is advanced passed the structure.
 //
 // Note that a SignedData structure may contain no CRLs, in which case this
 // function succeeds but does not append any CRLs. Additionally, CRLs in
 // SignedData structures are unordered. Callers should not assume an order in
-// |*out_crls| and may need to search for matches.
+// `*out_crls` and may need to search for matches.
 OPENSSL_EXPORT int PKCS7_get_CRLs(STACK_OF(X509_CRL) *out_crls, CBS *cbs);
 
 // PKCS7_bundle_CRLs appends a PKCS#7, SignedData structure containing
-// |crls| to |out|. It returns one on success and zero on error. Note that CRLs
-// in SignedData structures are unordered. The order in |crls| will not be
+// `crls` to `out`. It returns one on success and zero on error. Note that CRLs
+// in SignedData structures are unordered. The order in `crls` will not be
 // preserved.
 OPENSSL_EXPORT int PKCS7_bundle_CRLs(CBB *out, const STACK_OF(X509_CRL) *crls);
 
 // PKCS7_get_PEM_certificates reads a PEM-encoded, PKCS#7, SignedData structure
-// from |pem_bio| and appends the included certificates to |out_certs|. It
+// from `pem_bio` and appends the included certificates to `out_certs`. It
 // returns one on success and zero on error.
 //
 // Note that a SignedData structure may contain no certificates, in which case
 // this function succeeds but does not append any certificates. Additionally,
 // certificates in SignedData structures are unordered. Callers should not
-// assume a particular order in |*out_certs| and may need to search for matches
+// assume a particular order in `*out_certs` and may need to search for matches
 // or run path-building algorithms.
 OPENSSL_EXPORT int PKCS7_get_PEM_certificates(STACK_OF(X509) *out_certs,
                                               BIO *pem_bio);
 
 // PKCS7_get_PEM_CRLs reads a PEM-encoded, PKCS#7, SignedData structure from
-// |pem_bio| and appends the included CRLs to |out_crls|. It returns one on
+// `pem_bio` and appends the included CRLs to `out_crls`. It returns one on
 // success and zero on error.
 //
 // Note that a SignedData structure may contain no CRLs, in which case this
 // function succeeds but does not append any CRLs. Additionally, CRLs in
 // SignedData structures are unordered. Callers should not assume an order in
-// |*out_crls| and may need to search for matches.
+// `*out_crls` and may need to search for matches.
 OPENSSL_EXPORT int PKCS7_get_PEM_CRLs(STACK_OF(X509_CRL) *out_crls,
                                       BIO *pem_bio);
 
@@ -142,26 +143,26 @@ typedef struct {
 } PKCS7;
 
 // d2i_PKCS7 parses a BER-encoded, PKCS#7 signed data ContentInfo structure from
-// |len| bytes at |*inp|, as described in |d2i_SAMPLE|.
+// `len` bytes at `*inp`, as described in `d2i_SAMPLE`.
 OPENSSL_EXPORT PKCS7 *d2i_PKCS7(PKCS7 **out, const uint8_t **inp,
                                 size_t len);
 
-// d2i_PKCS7_bio behaves like |d2i_PKCS7| but reads the input from |bio|.  If
-// the length of the object is indefinite the full contents of |bio| are read.
+// d2i_PKCS7_bio behaves like `d2i_PKCS7` but reads the input from `bio`.  If
+// the length of the object is indefinite the full contents of `bio` are read.
 //
 // If the function fails then some unknown amount of data may have been read
-// from |bio|.
+// from `bio`.
 OPENSSL_EXPORT PKCS7 *d2i_PKCS7_bio(BIO *bio, PKCS7 **out);
 
-// i2d_PKCS7 marshals |p7| as a DER-encoded PKCS#7 ContentInfo structure, as
-// described in |i2d_SAMPLE|.
+// i2d_PKCS7 marshals `p7` as a DER-encoded PKCS#7 ContentInfo structure, as
+// described in `i2d_SAMPLE`.
 OPENSSL_EXPORT int i2d_PKCS7(const PKCS7 *p7, uint8_t **out);
 
-// i2d_PKCS7_bio writes |p7| to |bio|. It returns one on success and zero on
+// i2d_PKCS7_bio writes `p7` to `bio`. It returns one on success and zero on
 // error.
 OPENSSL_EXPORT int i2d_PKCS7_bio(BIO *bio, const PKCS7 *p7);
 
-// PKCS7_free releases memory associated with |p7|.
+// PKCS7_free releases memory associated with `p7`.
 OPENSSL_EXPORT void PKCS7_free(PKCS7 *p7);
 
 // PKCS7_type_is_data returns zero.
@@ -176,8 +177,7 @@ OPENSSL_EXPORT int PKCS7_type_is_encrypted(const PKCS7 *p7);
 // PKCS7_type_is_enveloped returns zero.
 OPENSSL_EXPORT int PKCS7_type_is_enveloped(const PKCS7 *p7);
 
-// PKCS7_type_is_signed returns one. (We only supporte signed data
-// ContentInfos.)
+// PKCS7_type_is_signed returns one. (We only support signed data ContentInfos.)
 OPENSSL_EXPORT int PKCS7_type_is_signed(const PKCS7 *p7);
 
 // PKCS7_type_is_signedAndEnveloped returns zero.
@@ -186,7 +186,7 @@ OPENSSL_EXPORT int PKCS7_type_is_signedAndEnveloped(const PKCS7 *p7);
 // PKCS7_DETACHED indicates that the PKCS#7 file specifies its data externally.
 #define PKCS7_DETACHED 0x40
 
-// The following flags cause |PKCS7_sign| to fail.
+// The following flags cause `PKCS7_sign` to fail.
 #define PKCS7_TEXT 0x1
 #define PKCS7_NOCERTS 0x2
 #define PKCS7_NOSIGS 0x4
@@ -201,17 +201,17 @@ OPENSSL_EXPORT int PKCS7_type_is_signedAndEnveloped(const PKCS7 *p7);
 
 // PKCS7_sign can operate in two modes to provide some backwards compatibility:
 //
-// The first mode assembles |certs| into a PKCS#7 signed data ContentInfo with
-// external data and no signatures. It returns a newly-allocated |PKCS7| on
-// success or NULL on error. |sign_cert| and |pkey| must be NULL. |data| is
-// ignored. |flags| must be equal to |PKCS7_DETACHED|. Additionally,
-// certificates in SignedData structures are unordered. The order of |certs|
+// The first mode assembles `certs` into a PKCS#7 signed data ContentInfo with
+// external data and no signatures. It returns a newly-allocated `PKCS7` on
+// success or NULL on error. `sign_cert` and `pkey` must be NULL. `data` is
+// ignored. `flags` must be equal to `PKCS7_DETACHED`. Additionally,
+// certificates in SignedData structures are unordered. The order of `certs`
 // will not be preserved.
 //
-// The second mode generates a detached RSA SHA-256 signature of |data| using
-// |pkey| and produces a PKCS#7 SignedData structure containing it. |certs|
-// must be NULL and |flags| must be exactly |PKCS7_NOATTR | PKCS7_BINARY |
-// PKCS7_NOCERTS | PKCS7_DETACHED|.
+// The second mode generates a detached RSA SHA-256 signature of `data` using
+// `pkey` and produces a PKCS#7 SignedData structure containing it. `certs`
+// must be NULL and `flags` must be exactly
+// `PKCS7_NOATTR | PKCS7_BINARY | PKCS7_NOCERTS | PKCS7_DETACHED`.
 //
 // Note this function only implements a subset of the corresponding OpenSSL
 // function. It is provided for backwards compatibility only.