grpc 1.81.1 → 1.85.0

data/third_party/boringssl-with-bazel/include/openssl/pkcs8.h

@@ -24,21 +24,28 @@ extern "C" {
 #endif
 
 
+// PKCS#8 and PKCS#12.
+//
+// This library contains functions for reading and writing private key
+// information in PKCS#8 format (RFC 5958), and key and certificate information
+// in PKCS#12 format (RFC 7292).
+
+
 // PKCS8_encrypt serializes and encrypts a PKCS8_PRIV_KEY_INFO with PBES1 or
 // PBES2 as defined in PKCS #5. Only pbeWithSHAAnd128BitRC4,
 // pbeWithSHAAnd3-KeyTripleDES-CBC and pbeWithSHA1And40BitRC2, defined in PKCS
-// #12, and PBES2, are supported.  PBES2 is selected by setting |cipher| and
-// passing -1 for |pbe_nid|.  Otherwise, PBES1 is used and |cipher| is ignored.
+// #12, and PBES2, are supported.  PBES2 is selected by setting `cipher` and
+// passing -1 for `pbe_nid`.  Otherwise, PBES1 is used and `cipher` is ignored.
 //
-// |pass| is used as the password. If a PBES1 scheme from PKCS #12 is used, this
+// `pass` is used as the password. If a PBES1 scheme from PKCS #12 is used, this
 // will be converted to a raw byte string as specified in B.1 of PKCS #12. If
-// |pass| is NULL, it will be encoded as the empty byte string rather than two
+// `pass` is NULL, it will be encoded as the empty byte string rather than two
 // zero bytes, the PKCS #12 encoding of the empty string.
 //
-// If |salt| is NULL, a random salt of |salt_len| bytes is generated. If
-// |salt_len| is zero, a default salt length is used instead.
+// If `salt` is NULL, a random salt of `salt_len` bytes is generated. If
+// `salt_len` is zero, a default salt length is used instead.
 //
-// The resulting structure is stored in an |X509_SIG| which must be freed by the
+// The resulting structure is stored in an `X509_SIG` which must be freed by the
 // caller.
 OPENSSL_EXPORT X509_SIG *PKCS8_encrypt(int pbe_nid, const EVP_CIPHER *cipher,
                                        const char *pass, int pass_len,
@@ -46,8 +53,8 @@ OPENSSL_EXPORT X509_SIG *PKCS8_encrypt(int pbe_nid, const EVP_CIPHER *cipher,
                                        int iterations,
                                        PKCS8_PRIV_KEY_INFO *p8inf);
 
-// PKCS8_marshal_encrypted_private_key behaves like |PKCS8_encrypt| but encrypts
-// an |EVP_PKEY| and writes the serialized EncryptedPrivateKeyInfo to |out|. It
+// PKCS8_marshal_encrypted_private_key behaves like `PKCS8_encrypt` but encrypts
+// an `EVP_PKEY` and writes the serialized EncryptedPrivateKeyInfo to `out`. It
 // returns one on success and zero on error.
 OPENSSL_EXPORT int PKCS8_marshal_encrypted_private_key(
     CBB *out, int pbe_nid, const EVP_CIPHER *cipher, const char *pass,
@@ -59,9 +66,9 @@ OPENSSL_EXPORT int PKCS8_marshal_encrypted_private_key(
 // pbeWithSHAAnd3-KeyTripleDES-CBC and pbeWithSHA1And40BitRC2, and PBES2,
 // defined in PKCS #12, are supported.
 //
-// |pass| is used as the password. If a PBES1 scheme from PKCS #12 is used, this
+// `pass` is used as the password. If a PBES1 scheme from PKCS #12 is used, this
 // will be converted to a raw byte string as specified in B.1 of PKCS #12. If
-// |pass| is NULL, it will be encoded as the empty byte string rather than two
+// `pass` is NULL, it will be encoded as the empty byte string rather than two
 // zero bytes, the PKCS #12 encoding of the empty string.
 //
 // The resulting structure must be freed by the caller.
@@ -69,19 +76,19 @@ OPENSSL_EXPORT PKCS8_PRIV_KEY_INFO *PKCS8_decrypt(X509_SIG *pkcs8,
                                                   const char *pass,
                                                   int pass_len);
 
-// PKCS8_parse_encrypted_private_key behaves like |PKCS8_decrypt| but it parses
-// the EncryptedPrivateKeyInfo structure from |cbs| and advances |cbs|. It
-// returns a newly-allocated |EVP_PKEY| on success and zero on error.
+// PKCS8_parse_encrypted_private_key behaves like `PKCS8_decrypt` but it parses
+// the EncryptedPrivateKeyInfo structure from `cbs` and advances `cbs`. It
+// returns a newly-allocated `EVP_PKEY` on success and zero on error.
 OPENSSL_EXPORT EVP_PKEY *PKCS8_parse_encrypted_private_key(CBS *cbs,
                                                            const char *pass,
                                                            size_t pass_len);
 
-// PKCS12_get_key_and_certs parses a PKCS#12 structure from |in|, authenticates
-// and decrypts it using |password|, sets |*out_key| to the included private
-// key and appends the included certificates to |out_certs|. It returns one on
+// PKCS12_get_key_and_certs parses a PKCS#12 structure from `in`, authenticates
+// and decrypts it using `password`, sets `*out_key` to the included private
+// key and appends the included certificates to `out_certs`. It returns one on
 // success and zero on error. The caller takes ownership of the outputs.
 // Any friendlyName attributes (RFC 2985) in the PKCS#12 structure will be
-// returned on the |X509| objects as aliases. See also |X509_alias_get0|.
+// returned on the `X509` objects as aliases. See also `X509_alias_get0`.
 OPENSSL_EXPORT int PKCS12_get_key_and_certs(EVP_PKEY **out_key,
                                             STACK_OF(X509) *out_certs,
                                             CBS *in, const char *password);
@@ -92,96 +99,95 @@ OPENSSL_EXPORT int PKCS12_get_key_and_certs(EVP_PKEY **out_key,
 // PKCS12_PBE_add does nothing. It exists for compatibility with OpenSSL.
 OPENSSL_EXPORT void PKCS12_PBE_add(void);
 
-// d2i_PKCS12 is a dummy function that copies |*ber_bytes| into a
-// |PKCS12| structure. The |out_p12| argument should be NULL(✝). On exit,
-// |*ber_bytes| will be advanced by |ber_len|. It returns a fresh |PKCS12|
+// d2i_PKCS12 is a dummy function that copies `*ber_bytes` into a
+// `PKCS12` structure. The `out_p12` argument should be NULL(✝). On exit,
+// `*ber_bytes` will be advanced by `ber_len`. It returns a fresh `PKCS12`
 // structure or NULL on error.
 //
-// Note: unlike other d2i functions, |d2i_PKCS12| will always consume |ber_len|
+// Note: unlike other d2i functions, `d2i_PKCS12` will always consume `ber_len`
 // bytes.
 //
-// (✝) If |out_p12| is not NULL and the function is successful, |*out_p12| will
-// be freed if not NULL itself and the result will be written to |*out_p12|.
+// (✝) If `out_p12` is not NULL and the function is successful, `*out_p12` will
+// be freed if not NULL itself and the result will be written to `*out_p12`.
 // New code should not depend on this.
 OPENSSL_EXPORT PKCS12 *d2i_PKCS12(PKCS12 **out_p12, const uint8_t **ber_bytes,
                                   size_t ber_len);
 
-// d2i_PKCS12_bio acts like |d2i_PKCS12| but reads from a |BIO|.
+// d2i_PKCS12_bio acts like `d2i_PKCS12` but reads from a `BIO`.
 OPENSSL_EXPORT PKCS12* d2i_PKCS12_bio(BIO *bio, PKCS12 **out_p12);
 
-// d2i_PKCS12_fp acts like |d2i_PKCS12| but reads from a |FILE|.
+// d2i_PKCS12_fp acts like `d2i_PKCS12` but reads from a `FILE`.
 OPENSSL_EXPORT PKCS12* d2i_PKCS12_fp(FILE *fp, PKCS12 **out_p12);
 
-// i2d_PKCS12 is a dummy function which copies the contents of |p12|. If |out|
-// is not NULL then the result is written to |*out| and |*out| is advanced just
+// i2d_PKCS12 is a dummy function which copies the contents of `p12`. If `out`
+// is not NULL then the result is written to `*out` and `*out` is advanced just
 // past the output. It returns the number of bytes in the result, whether
 // written or not, or a negative value on error.
 OPENSSL_EXPORT int i2d_PKCS12(const PKCS12 *p12, uint8_t **out);
 
-// i2d_PKCS12_bio writes the contents of |p12| to |bio|. It returns one on
+// i2d_PKCS12_bio writes the contents of `p12` to `bio`. It returns one on
 // success and zero on error.
 OPENSSL_EXPORT int i2d_PKCS12_bio(BIO *bio, const PKCS12 *p12);
 
-// i2d_PKCS12_fp writes the contents of |p12| to |fp|. It returns one on
+// i2d_PKCS12_fp writes the contents of `p12` to `fp`. It returns one on
 // success and zero on error.
 OPENSSL_EXPORT int i2d_PKCS12_fp(FILE *fp, const PKCS12 *p12);
 
-// PKCS12_parse calls |PKCS12_get_key_and_certs| on the ASN.1 data stored in
-// |p12|. The |out_pkey| and |out_cert| arguments must not be NULL and, on
+// PKCS12_parse calls `PKCS12_get_key_and_certs` on the ASN.1 data stored in
+// `p12`. The `out_pkey` and `out_cert` arguments must not be NULL and, on
 // successful exit, the private key and matching certificate will be stored in
-// them. The |out_ca_certs| argument may be NULL but, if not, then any extra
-// certificates will be appended to |*out_ca_certs|. If |*out_ca_certs| is NULL
+// them. The `out_ca_certs` argument may be NULL but, if not, then any extra
+// certificates will be appended to `*out_ca_certs`. If `*out_ca_certs` is NULL
 // then it will be set to a freshly allocated stack containing the extra certs.
 //
-// Note if |p12| does not contain a private key, both |*out_pkey| and
-// |*out_cert| will be set to NULL and all certificates will be returned via
-// |*out_ca_certs|. Also note this function differs from OpenSSL in that extra
+// Note if `p12` does not contain a private key, both `*out_pkey` and
+// `*out_cert` will be set to NULL and all certificates will be returned via
+// `*out_ca_certs`. Also note this function differs from OpenSSL in that extra
 // certificates are returned in the order they appear in the file. OpenSSL 1.1.1
 // returns them in reverse order, but this will be fixed in OpenSSL 3.0.
 //
 // It returns one on success and zero on error.
 //
-// Use |PKCS12_get_key_and_certs| instead.
+// Use `PKCS12_get_key_and_certs` instead.
 OPENSSL_EXPORT int PKCS12_parse(const PKCS12 *p12, const char *password,
                                 EVP_PKEY **out_pkey, X509 **out_cert,
                                 STACK_OF(X509) **out_ca_certs);
 
-// PKCS12_verify_mac returns one if |password| is a valid password for |p12|
-// and zero otherwise. Since |PKCS12_parse| doesn't take a length parameter,
+// PKCS12_verify_mac returns one if `password` is a valid password for `p12`
+// and zero otherwise. Since `PKCS12_parse` doesn't take a length parameter,
 // it's not actually possible to use a non-NUL-terminated password to actually
-// get anything from a |PKCS12|. Thus |password| and |password_len| may be
-// |NULL| and zero, respectively, or else |password_len| may be -1, or else
-// |password[password_len]| must be zero and no other NUL bytes may appear in
-// |password|. If the |password_len| checks fail, zero is returned
+// get anything from a `PKCS12`. Thus `password` and `password_len` may be
+// `NULL` and zero, respectively, or else `password_len` may be -1, or else
+// `password[password_len]` must be zero and no other NUL bytes may appear in
+// `password`. If the `password_len` checks fail, zero is returned
 // immediately.
 OPENSSL_EXPORT int PKCS12_verify_mac(const PKCS12 *p12, const char *password,
                                      int password_len);
 
 // PKCS12_DEFAULT_ITER is the default number of KDF iterations used when
-// creating a |PKCS12| object.
+// creating a `PKCS12` object.
 #define PKCS12_DEFAULT_ITER 2048
 
-// PKCS12_create returns a newly-allocated |PKCS12| object containing |pkey|,
-// |cert|, and |chain|, encrypted with the specified password. |name|, if not
+// PKCS12_create returns a newly-allocated `PKCS12` object containing `pkey`,
+// `cert`, and `chain`, encrypted with the specified password. `name`, if not
 // NULL, specifies a user-friendly name to encode with the key and
-// certificate. The key and certificates are encrypted with |key_nid| and
-// |cert_nid|, respectively, using |iterations| iterations in the
-// KDF. |mac_iterations| is the number of iterations when deriving the MAC
-// key. |key_type| must be zero. |pkey| and |cert| may be NULL to omit them.
+// certificate. The key and certificates are encrypted with `key_nid` and
+// `cert_nid`, respectively, using `iterations` iterations in the
+// KDF. `mac_iterations` is the number of iterations when deriving the MAC
+// key. `key_type` must be zero. `pkey` and `cert` may be NULL to omit them.
 //
-// Each of |key_nid|, |cert_nid|, |iterations|, and |mac_iterations| may be zero
-// to use defaults, which are |NID_pbe_WithSHA1And3_Key_TripleDES_CBC|,
-// |NID_pbe_WithSHA1And40BitRC2_CBC|, |PKCS12_DEFAULT_ITER|, and one,
-// respectively.
+// Each of `key_nid`, `cert_nid`, `iterations`, and `mac_iterations` may be zero
+// to use defaults, which are `NID_aes_256_cbc`, `NID_aes_256_cbc`,
+// `PKCS12_DEFAULT_ITER`, and `PKCS12_DEFAULT_ITER`, respectively.
 //
-// |key_nid| and |cert_nid| are then interpreted as follows:
+// `key_nid` and `cert_nid` are then interpreted as follows:
 //
 // * If the NID is a cipher that is supported with PBES2, e.g.
-//   |NID_aes_256_cbc|, this function will use it with PBES2 and a default KDF
-//   (currently PBKDF2 with HMAC-SHA1). There is no way to specify the KDF in
+//   `NID_aes_256_cbc`, this function will use it with PBES2 and a default KDF
+//   (currently PBKDF2 with HMAC-SHA256). There is no way to specify the KDF in
 //   this function.
 //
-// * If the NID is a PBES1 suite, e.g. |NID_pbe_WithSHA1And3_Key_TripleDES_CBC|,
+// * If the NID is a PBES1 suite, e.g. `NID_pbe_WithSHA1And3_Key_TripleDES_CBC`,
 //   this function will use the specified suite.
 //
 // * If the NID is -1, this function will disable encryption for the key or
@@ -191,11 +197,11 @@ OPENSSL_EXPORT int PKCS12_verify_mac(const PKCS12 *p12, const char *password,
 //   supported and may not open in other implementations.
 //
 // WARNING: This differs from other functions in this module, which use a pair
-// of NID and |EVP_CIPHER| parameters to pick between PBES1 and PBES2 schemes.
+// of NID and `EVP_CIPHER` parameters to pick between PBES1 and PBES2 schemes.
 //
-// If |cert| or |chain| have associated aliases (see |X509_alias_set1|), they
+// If `cert` or `chain` have associated aliases (see `X509_alias_set1`), they
 // will be included in the output as friendlyName attributes (RFC 2985). It is
-// an error to specify both an alias on |cert| and a non-NULL |name|
+// an error to specify both an alias on `cert` and a non-NULL `name`
 // parameter.
 OPENSSL_EXPORT PKCS12 *PKCS12_create(const char *password, const char *name,
                                      const EVP_PKEY *pkey, X509 *cert,
@@ -203,7 +209,7 @@ OPENSSL_EXPORT PKCS12 *PKCS12_create(const char *password, const char *name,
                                      int cert_nid, int iterations,
                                      int mac_iterations, int key_type);
 
-// PKCS12_free frees |p12| and its contents.
+// PKCS12_free frees `p12` and its contents.
 OPENSSL_EXPORT void PKCS12_free(PKCS12 *p12);
 
 

data/third_party/boringssl-with-bazel/include/openssl/poly1305.h

@@ -17,27 +17,30 @@
 
 #include <openssl/base.h>   // IWYU pragma: export
 
-#ifdef  __cplusplus
+#if defined(__cplusplus)
 extern "C" {
 #endif
 
 
+// Poly1305.
+
+
 typedef uint8_t poly1305_state[512];
 
-// CRYPTO_poly1305_init sets up |state| so that it can be used to calculate an
-// authentication tag with the one-time key |key|. Note that |key| is a
+// CRYPTO_poly1305_init sets up `state` so that it can be used to calculate an
+// authentication tag with the one-time key `key`. Note that `key` is a
 // one-time key and therefore there is no `reset' method because that would
 // enable several messages to be authenticated with the same key.
 OPENSSL_EXPORT void CRYPTO_poly1305_init(poly1305_state *state,
                                          const uint8_t key[32]);
 
-// CRYPTO_poly1305_update processes |in_len| bytes from |in|. It can be called
+// CRYPTO_poly1305_update processes `in_len` bytes from `in`. It can be called
 // zero or more times after poly1305_init.
 OPENSSL_EXPORT void CRYPTO_poly1305_update(poly1305_state *state,
                                            const uint8_t *in, size_t in_len);
 
 // CRYPTO_poly1305_finish completes the poly1305 calculation and writes a 16
-// byte authentication tag to |mac|.
+// byte authentication tag to `mac`.
 OPENSSL_EXPORT void CRYPTO_poly1305_finish(poly1305_state *state,
                                            uint8_t mac[16]);
 

data/third_party/boringssl-with-bazel/include/openssl/pool.h

@@ -15,7 +15,7 @@
 #ifndef OPENSSL_HEADER_POOL_H
 #define OPENSSL_HEADER_POOL_H
 
-#include <openssl/base.h>   // IWYU pragma: export
+#include <openssl/base.h>  // IWYU pragma: export
 
 #include <openssl/stack.h>
 
@@ -26,65 +26,93 @@ extern "C" {
 
 // Buffers and buffer pools.
 //
-// |CRYPTO_BUFFER|s are simply reference-counted blobs. A |CRYPTO_BUFFER_POOL|
-// is an intern table for |CRYPTO_BUFFER|s. This allows for a single copy of a
-// given blob to be kept in memory and referenced from multiple places.
+// `CRYPTO_BUFFER`s are simply reference-counted, immutable byte string. A
+// single `CRYPTO_BUFFER` can be referenced from multiple parts of an
+// application without storing multiple copies of the underlying data in
+// memory.
+//
+// A `CRYPTO_BUFFER_POOL` can be used to additionally deduplicate
+// `CRYPTO_BUFFER`s on construction. It maintains weak references to associated
+// `CRYPTO_BUFFER`s and returns an existing `CRYPTO_BUFFER` if matching ones
+// already exist.
+//
+// Without a `CRYPTO_BUFFER_POOL`, if two parts of application construct an
+// identical `CRYPTO_BUFFER` (e.g. if two TLS connections received the same
+// certificate), there will be two copies of the buffer in memory. A
+// `CRYPTO_BUFFER_POOL` allows two parts of an application that construct
+// `CRYPTO_BUFFER`s to deduplicate their contents, at the cost of more thread
+// contention.
 
 
 DEFINE_STACK_OF(CRYPTO_BUFFER)
 
-// CRYPTO_BUFFER_POOL_new returns a freshly allocated |CRYPTO_BUFFER_POOL| or
+// CRYPTO_BUFFER_POOL_new returns a freshly allocated `CRYPTO_BUFFER_POOL` or
 // NULL on error.
-OPENSSL_EXPORT CRYPTO_BUFFER_POOL* CRYPTO_BUFFER_POOL_new(void);
+OPENSSL_EXPORT CRYPTO_BUFFER_POOL *CRYPTO_BUFFER_POOL_new(void);
 
-// CRYPTO_BUFFER_POOL_free frees |pool|, which must be empty.
+// CRYPTO_BUFFER_POOL_free decrements the reference count of `pool` and frees it
+// if the reference count drops to zero.
 OPENSSL_EXPORT void CRYPTO_BUFFER_POOL_free(CRYPTO_BUFFER_POOL *pool);
 
-// CRYPTO_BUFFER_new returns a |CRYPTO_BUFFER| containing a copy of |data|, or
-// else NULL on error. If |pool| is not NULL then the returned value may be a
-// reference to a previously existing |CRYPTO_BUFFER| that contained the same
-// data. Otherwise, the returned, fresh |CRYPTO_BUFFER| will be added to the
+// CRYPTO_BUFFER_POOL_up_ref increments the reference count of `pool` and
+// returns one. It does not mutate `pool` for thread-safety purposes and may be
+// used concurrently.
+OPENSSL_EXPORT int CRYPTO_BUFFER_POOL_up_ref(CRYPTO_BUFFER_POOL *pool);
+
+// CRYPTO_BUFFER_new returns a `CRYPTO_BUFFER` containing a copy of `data`, or
+// else NULL on error. If `pool` is not NULL then the returned value may be a
+// reference to a previously existing `CRYPTO_BUFFER` that contained the same
+// data. Otherwise, the returned, fresh `CRYPTO_BUFFER` will be added to the
 // pool.
+//
+// There is no requirement that `pool` outlive the `CRYPTO_BUFFER`, or vice
+// versa. If the `CRYPTO_BUFFER` is released first, it will be removed from
+// `pool`. If `pool` is released first, the `CRYPTO_BUFFER` remains valid.
 OPENSSL_EXPORT CRYPTO_BUFFER *CRYPTO_BUFFER_new(const uint8_t *data, size_t len,
                                                 CRYPTO_BUFFER_POOL *pool);
 
-// CRYPTO_BUFFER_alloc creates an unpooled |CRYPTO_BUFFER| of the given size and
-// writes the underlying data pointer to |*out_data|. It returns NULL on error.
+// CRYPTO_BUFFER_alloc creates an unpooled `CRYPTO_BUFFER` of the given size and
+// writes the underlying data pointer to `*out_data`. It returns NULL on error.
 //
-// After calling this function, |len| bytes of contents must be written to
-// |out_data| before passing the returned pointer to any other BoringSSL
-// functions. Once initialized, the |CRYPTO_BUFFER| should be treated as
+// After calling this function, `len` bytes of contents must be written to
+// `out_data` before passing the returned pointer to any other BoringSSL
+// functions. Once initialized, the `CRYPTO_BUFFER` should be treated as
 // immutable.
 OPENSSL_EXPORT CRYPTO_BUFFER *CRYPTO_BUFFER_alloc(uint8_t **out_data,
                                                   size_t len);
 
-// CRYPTO_BUFFER_new_from_CBS acts the same as |CRYPTO_BUFFER_new|.
+// CRYPTO_BUFFER_new_from_CBS acts the same as `CRYPTO_BUFFER_new`.
 OPENSSL_EXPORT CRYPTO_BUFFER *CRYPTO_BUFFER_new_from_CBS(
     const CBS *cbs, CRYPTO_BUFFER_POOL *pool);
 
-// CRYPTO_BUFFER_new_from_static_data_unsafe behaves like |CRYPTO_BUFFER_new|
-// but does not copy |data|. |data| must be immutable and last for the lifetime
+// CRYPTO_BUFFER_new_from_static_data_unsafe behaves like `CRYPTO_BUFFER_new`
+// but does not copy `data`. `data` must be immutable and last for the lifetime
 // of the address space.
 OPENSSL_EXPORT CRYPTO_BUFFER *CRYPTO_BUFFER_new_from_static_data_unsafe(
     const uint8_t *data, size_t len, CRYPTO_BUFFER_POOL *pool);
 
-// CRYPTO_BUFFER_free decrements the reference count of |buf|. If there are no
+// CRYPTO_BUFFER_free decrements the reference count of `buf`. If there are no
 // other references, or if the only remaining reference is from a pool, then
-// |buf| will be freed.
+// `buf` will be freed.
 OPENSSL_EXPORT void CRYPTO_BUFFER_free(CRYPTO_BUFFER *buf);
 
-// CRYPTO_BUFFER_up_ref increments the reference count of |buf| and returns
+// CRYPTO_BUFFER_up_ref increments the reference count of `buf` and returns
 // one.
 OPENSSL_EXPORT int CRYPTO_BUFFER_up_ref(CRYPTO_BUFFER *buf);
 
-// CRYPTO_BUFFER_data returns a pointer to the data contained in |buf|.
+// CRYPTO_BUFFER_dup_ref increments the reference count of `buf` and returns
+// `buf`. The caller must call `CRYPTO_BUFFER_free` on the result to release the
+// reference.
+OPENSSL_EXPORT CRYPTO_BUFFER *CRYPTO_BUFFER_dup_ref(const CRYPTO_BUFFER *buf);
+
+// CRYPTO_BUFFER_data returns a pointer to the data contained in `buf`.
 OPENSSL_EXPORT const uint8_t *CRYPTO_BUFFER_data(const CRYPTO_BUFFER *buf);
 
 // CRYPTO_BUFFER_len returns the length, in bytes, of the data contained in
-// |buf|.
+// `buf`.
 OPENSSL_EXPORT size_t CRYPTO_BUFFER_len(const CRYPTO_BUFFER *buf);
 
-// CRYPTO_BUFFER_init_CBS initialises |out| to point at the data from |buf|.
+// CRYPTO_BUFFER_init_CBS initialises `out` to point at the data from `buf`.
 OPENSSL_EXPORT void CRYPTO_BUFFER_init_CBS(const CRYPTO_BUFFER *buf, CBS *out);
 
 
@@ -96,6 +124,7 @@ extern "C++" {
 BSSL_NAMESPACE_BEGIN
 
 BORINGSSL_MAKE_DELETER(CRYPTO_BUFFER_POOL, CRYPTO_BUFFER_POOL_free)
+BORINGSSL_MAKE_UP_REF(CRYPTO_BUFFER_POOL, CRYPTO_BUFFER_POOL_up_ref)
 BORINGSSL_MAKE_DELETER(CRYPTO_BUFFER, CRYPTO_BUFFER_free)
 BORINGSSL_MAKE_UP_REF(CRYPTO_BUFFER, CRYPTO_BUFFER_up_ref)
 

data/third_party/boringssl-with-bazel/include/openssl/posix_time.h

@@ -27,18 +27,18 @@ extern "C" {
 // Time functions.
 
 
-// OPENSSL_posix_to_tm converts a int64_t POSIX time value in |time|, which must
-// be in the range of year 0000 to 9999, to a broken out time value in |tm|. It
+// OPENSSL_posix_to_tm converts a int64_t POSIX time value in `time`, which must
+// be in the range of year 0000 to 9999, to a broken out time value in `tm`. It
 // returns one on success and zero on error.
 OPENSSL_EXPORT int OPENSSL_posix_to_tm(int64_t time, struct tm *out_tm);
 
 // OPENSSL_tm_to_posix converts a time value between the years 0 and 9999 in
-// |tm| to a POSIX time value in |out|. One is returned on success, zero is
-// returned on failure. It is a failure if |tm| contains out of range values.
+// `tm` to a POSIX time value in `out`. One is returned on success, zero is
+// returned on failure. It is a failure if `tm` contains out of range values.
 OPENSSL_EXPORT int OPENSSL_tm_to_posix(const struct tm *tm, int64_t *out);
 
-// OPENSSL_timegm converts a time value between the years 0 and 9999 in |tm| to
-// a time_t value in |out|. One is returned on success, zero is returned on
+// OPENSSL_timegm converts a time value between the years 0 and 9999 in `tm` to
+// a time_t value in `out`. One is returned on success, zero is returned on
 // failure. It is a failure if the converted time can not be represented in a
 // time_t, or if the tm contains out of range values.
 OPENSSL_EXPORT int OPENSSL_timegm(const struct tm *tm, time_t *out);