grpc 1.84.1 → 1.85.0.pre1

data/third_party/boringssl-with-bazel/include/openssl/ecdsa.h

@@ -29,39 +29,45 @@ extern "C" {
 
 
 // Signing and verifying.
-
-// ECDSA_sign signs |digest_len| bytes from |digest| with |key| and writes the
-// resulting signature to |sig|, which must have |ECDSA_size(key)| bytes of
-// space. On successful exit, |*sig_len| is set to the actual number of bytes
-// written. The |type| argument should be zero. It returns one on success and
-// zero otherwise.
 //
-// WARNING: |digest| must be the output of some hash function on the data to be
+// ECDSA does not have a single, common signature format across all
+// applications. These functions implement the more common, ASN.1-based format.
+// In it, signatures are a DER-encoded ECDSA-Sig-Value structure. Note that this
+// format is variable-length. Callers must be prepared to receive signatures
+// that are slightly shorter than the maximum for the ECDSA curve.
+
+// ECDSA_sign signs `digest_len` bytes from `digest` with `key` and writes the
+// resulting ASN.1-based signature to `sig`, which must have `ECDSA_size(key)`
+// bytes of space. On successful exit, `*sig_len` is set to the actual number of
+// bytes written. The `type` argument should be zero. It returns one on success
+// and zero otherwise.
+//
+// WARNING: `digest` must be the output of some hash function on the data to be
 // signed. Passing unhashed inputs will not result in a secure signature scheme.
 OPENSSL_EXPORT int ECDSA_sign(int type, const uint8_t *digest,
                               size_t digest_len, uint8_t *sig,
                               unsigned int *sig_len, const EC_KEY *key);
 
-// ECDSA_verify verifies that |sig_len| bytes from |sig| constitute a valid
-// signature by |key| of |digest|. (The |type| argument should be zero.) It
-// returns one on success or zero if the signature is invalid or an error
-// occurred.
+// ECDSA_verify verifies that `sig_len` bytes from `sig` constitute a valid
+// ASN.1-based signature by `key` of `digest`. (The `type` argument should be
+// zero.) It returns one on success or zero if the signature is invalid or an
+// error occurred.
 //
-// WARNING: |digest| must be the output of some hash function on the data to be
+// WARNING: `digest` must be the output of some hash function on the data to be
 // verified. Passing unhashed inputs will not result in a secure signature
 // scheme.
 OPENSSL_EXPORT int ECDSA_verify(int type, const uint8_t *digest,
                                 size_t digest_len, const uint8_t *sig,
                                 size_t sig_len, const EC_KEY *key);
 
-// ECDSA_size returns the maximum size of an ECDSA signature using |key|. It
-// returns zero if |key| is NULL or if it doesn't have a group set.
+// ECDSA_size returns the maximum size of an ASN.1-based ECDSA signature using
+// `key`. It returns zero if `key` is NULL or if it doesn't have a group set.
 OPENSSL_EXPORT size_t ECDSA_size(const EC_KEY *key);
 
 
 // Low-level signing and verification.
 //
-// Low-level functions handle signatures as |ECDSA_SIG| structures which allow
+// Low-level functions handle signatures as `ECDSA_SIG` structures which allow
 // the two values in an ECDSA signature to be handled separately.
 
 struct ecdsa_sig_st {
@@ -69,41 +75,41 @@ struct ecdsa_sig_st {
   BIGNUM *s;
 };
 
-// ECDSA_SIG_new returns a fresh |ECDSA_SIG| structure or NULL on error.
+// ECDSA_SIG_new returns a fresh `ECDSA_SIG` structure or NULL on error.
 OPENSSL_EXPORT ECDSA_SIG *ECDSA_SIG_new(void);
 
-// ECDSA_SIG_free frees |sig| its member |BIGNUM|s.
+// ECDSA_SIG_free frees `sig` its member `BIGNUM`s.
 OPENSSL_EXPORT void ECDSA_SIG_free(ECDSA_SIG *sig);
 
-// ECDSA_SIG_get0_r returns the r component of |sig|.
+// ECDSA_SIG_get0_r returns the r component of `sig`.
 OPENSSL_EXPORT const BIGNUM *ECDSA_SIG_get0_r(const ECDSA_SIG *sig);
 
-// ECDSA_SIG_get0_s returns the s component of |sig|.
+// ECDSA_SIG_get0_s returns the s component of `sig`.
 OPENSSL_EXPORT const BIGNUM *ECDSA_SIG_get0_s(const ECDSA_SIG *sig);
 
-// ECDSA_SIG_get0 sets |*out_r| and |*out_s|, if non-NULL, to the two
-// components of |sig|.
+// ECDSA_SIG_get0 sets `*out_r` and `*out_s`, if non-NULL, to the two
+// components of `sig`.
 OPENSSL_EXPORT void ECDSA_SIG_get0(const ECDSA_SIG *sig, const BIGNUM **out_r,
                                    const BIGNUM **out_s);
 
-// ECDSA_SIG_set0 sets |sig|'s components to |r| and |s|, neither of which may
+// ECDSA_SIG_set0 sets `sig`'s components to `r` and `s`, neither of which may
 // be NULL. On success, it takes ownership of each argument and returns one.
 // Otherwise, it returns zero.
 OPENSSL_EXPORT int ECDSA_SIG_set0(ECDSA_SIG *sig, BIGNUM *r, BIGNUM *s);
 
-// ECDSA_do_sign signs |digest_len| bytes from |digest| with |key| and returns
+// ECDSA_do_sign signs `digest_len` bytes from `digest` with `key` and returns
 // the resulting signature structure, or NULL on error.
 //
-// WARNING: |digest| must be the output of some hash function on the data to be
+// WARNING: `digest` must be the output of some hash function on the data to be
 // signed. Passing unhashed inputs will not result in a secure signature scheme.
 OPENSSL_EXPORT ECDSA_SIG *ECDSA_do_sign(const uint8_t *digest,
                                         size_t digest_len, const EC_KEY *key);
 
-// ECDSA_do_verify verifies that |sig| constitutes a valid signature by |key|
-// of |digest|. It returns one on success or zero if the signature is invalid
+// ECDSA_do_verify verifies that `sig` constitutes a valid signature by `key`
+// of `digest`. It returns one on success or zero if the signature is invalid
 // or on error.
 //
-// WARNING: |digest| must be the output of some hash function on the data to be
+// WARNING: `digest` must be the output of some hash function on the data to be
 // verified. Passing unhashed inputs will not result in a secure signature
 // scheme.
 OPENSSL_EXPORT int ECDSA_do_verify(const uint8_t *digest, size_t digest_len,
@@ -112,38 +118,75 @@ OPENSSL_EXPORT int ECDSA_do_verify(const uint8_t *digest, size_t digest_len,
 
 // ASN.1 functions.
 
-// ECDSA_SIG_parse parses a DER-encoded ECDSA-Sig-Value structure from |cbs| and
-// advances |cbs|. It returns a newly-allocated |ECDSA_SIG| or NULL on error.
+// ECDSA_SIG_parse parses a DER-encoded ECDSA-Sig-Value structure from `cbs` and
+// advances `cbs`. It returns a newly-allocated `ECDSA_SIG` or NULL on error.
 OPENSSL_EXPORT ECDSA_SIG *ECDSA_SIG_parse(CBS *cbs);
 
-// ECDSA_SIG_from_bytes parses |in| as a DER-encoded ECDSA-Sig-Value structure.
-// It returns a newly-allocated |ECDSA_SIG| structure or NULL on error.
+// ECDSA_SIG_from_bytes parses `in` as a DER-encoded ECDSA-Sig-Value structure.
+// It returns a newly-allocated `ECDSA_SIG` structure or NULL on error.
 OPENSSL_EXPORT ECDSA_SIG *ECDSA_SIG_from_bytes(const uint8_t *in,
                                                size_t in_len);
 
-// ECDSA_SIG_marshal marshals |sig| as a DER-encoded ECDSA-Sig-Value and appends
-// the result to |cbb|. It returns one on success and zero on error.
+// ECDSA_SIG_marshal marshals `sig` as a DER-encoded ECDSA-Sig-Value and appends
+// the result to `cbb`. It returns one on success and zero on error.
 OPENSSL_EXPORT int ECDSA_SIG_marshal(CBB *cbb, const ECDSA_SIG *sig);
 
-// ECDSA_SIG_to_bytes marshals |sig| as a DER-encoded ECDSA-Sig-Value and, on
-// success, sets |*out_bytes| to a newly allocated buffer containing the result
+// ECDSA_SIG_to_bytes marshals `sig` as a DER-encoded ECDSA-Sig-Value and, on
+// success, sets `*out_bytes` to a newly allocated buffer containing the result
 // and returns one. Otherwise, it returns zero. The result should be freed with
-// |OPENSSL_free|.
+// `OPENSSL_free`.
 OPENSSL_EXPORT int ECDSA_SIG_to_bytes(uint8_t **out_bytes, size_t *out_len,
                                       const ECDSA_SIG *sig);
 
 // ECDSA_SIG_max_len returns the maximum length of a DER-encoded ECDSA-Sig-Value
-// structure for a group whose order is represented in |order_len| bytes, or
+// structure for a group whose order is represented in `order_len` bytes, or
 // zero on overflow.
 OPENSSL_EXPORT size_t ECDSA_SIG_max_len(size_t order_len);
 
 
+// IEEE P1363 signing and verifying.
+//
+// ECDSA does not have a single, common signature format across all
+// applications. These functions implement the less common, fixed-width format,
+// defined in IEEE P1363. It is also used in PKCS#11 and DNSSEC. In it,
+// signatures are a concatenation of r and s components, each zero-padded up to
+// the width of the group order. This format is fixed-width, so a given ECDSA
+// curve's signatures will always have the same size.
+
+// ECDSA_sign_p1363 signs `digest_len` bytes from `digest` with `key` and writes
+// the resulting P1363-based signature to `sig`, which must have
+// `ECDSA_size_p1363(key)` bytes of space. On successful exit, `*out_sig_len` is
+// set to the actual number of bytes written, which will always match
+// `ECDSA_size_p1363(key)`. It returns one on success and zero otherwise.
+//
+// WARNING: `digest` must be the output of some hash function on the data to be
+// signed. Passing unhashed inputs will not result in a secure signature scheme.
+OPENSSL_EXPORT int ECDSA_sign_p1363(const uint8_t *digest, size_t digest_len,
+                                    uint8_t *sig, size_t *out_sig_len,
+                                    size_t max_sig_len, const EC_KEY *key);
+
+// ECDSA_verify_p1363 verifies that `sig_len` bytes from `sig` constitute a
+// valid P1363-based signature by `key` of `digest`. It returns one on success
+// or zero if the signature is invalid or an error occurred.
+//
+// WARNING: `digest` must be the output of some hash function on the data to be
+// verified. Passing unhashed inputs will not result in a secure signature
+// scheme.
+OPENSSL_EXPORT int ECDSA_verify_p1363(const uint8_t *digest, size_t digest_len,
+                                      const uint8_t *sig, size_t sig_len,
+                                      const EC_KEY *key);
+
+// ECDSA_size_p1363 returns the size of a P1363-based ECDSA signature using
+// `key`. It returns zero if `key` is NULL or if it doesn't have a group set.
+OPENSSL_EXPORT size_t ECDSA_size_p1363(const EC_KEY *key);
+
+
 // Testing-only functions.
 
 // ECDSA_sign_with_nonce_and_leak_private_key_for_testing behaves like
-// |ECDSA_do_sign| but uses |nonce| for the ECDSA nonce 'k', instead of a random
-// value. |nonce| is interpreted as a big-endian integer. It must be reduced
-// modulo the group order and padded with zeros up to |BN_num_bytes(order)|
+// `ECDSA_do_sign` but uses `nonce` for the ECDSA nonce 'k', instead of a random
+// value. `nonce` is interpreted as a big-endian integer. It must be reduced
+// modulo the group order and padded with zeros up to `BN_num_bytes(order)`
 // bytes.
 //
 // WARNING: This function is only exported for testing purposes, when using test
@@ -159,17 +202,17 @@ ECDSA_sign_with_nonce_and_leak_private_key_for_testing(const uint8_t *digest,
 
 // Deprecated functions.
 
-// d2i_ECDSA_SIG parses aa DER-encoded ECDSA-Sig-Value structure from |len|
-// bytes at |*inp|, as described in |d2i_SAMPLE|.
+// d2i_ECDSA_SIG parses aa DER-encoded ECDSA-Sig-Value structure from `len`
+// bytes at `*inp`, as described in `d2i_SAMPLE`.
 //
-// Use |ECDSA_SIG_parse| instead.
+// Use `ECDSA_SIG_parse` instead.
 OPENSSL_EXPORT ECDSA_SIG *d2i_ECDSA_SIG(ECDSA_SIG **out, const uint8_t **inp,
                                         long len);
 
-// i2d_ECDSA_SIG marshals |sig| as a DER-encoded ECDSA-Sig-Value, as described
-// in |i2d_SAMPLE|.
+// i2d_ECDSA_SIG marshals `sig` as a DER-encoded ECDSA-Sig-Value, as described
+// in `i2d_SAMPLE`.
 //
-// Use |ECDSA_SIG_marshal| instead.
+// Use `ECDSA_SIG_marshal` instead.
 OPENSSL_EXPORT int i2d_ECDSA_SIG(const ECDSA_SIG *sig, uint8_t **outp);
 
 

data/third_party/boringssl-with-bazel/include/openssl/engine.h

@@ -27,9 +27,9 @@ extern "C" {
 // be overridden via a callback. This can be used, for example, to implement an
 // RSA* that forwards operations to a hardware module.
 //
-// Methods are reference counted but |ENGINE|s are not. When creating a method,
+// Methods are reference counted but `ENGINE`s are not. When creating a method,
 // you should zero the whole structure and fill in the function pointers that
-// you wish before setting it on an |ENGINE|. Any functions pointers that
+// you wish before setting it on an `ENGINE`. Any functions pointers that
 // are NULL indicate that the default behaviour should be used.
 
 
@@ -40,7 +40,7 @@ extern "C" {
 OPENSSL_EXPORT ENGINE *ENGINE_new(void);
 
 // ENGINE_free decrements the reference counts for all methods linked from
-// |engine| and frees |engine| itself. It returns one.
+// `engine` and frees `engine` itself. It returns one.
 OPENSSL_EXPORT int ENGINE_free(ENGINE *engine);
 
 
@@ -69,11 +69,11 @@ OPENSSL_EXPORT ECDSA_METHOD *ENGINE_get_ECDSA_method(const ENGINE *engine);
 // These functions take a void* type but actually operate on all method
 // structures.
 
-// METHOD_ref increments the reference count of |method|. This is a no-op for
+// METHOD_ref increments the reference count of `method`. This is a no-op for
 // now because all methods are currently static.
 void METHOD_ref(void *method);
 
-// METHOD_unref decrements the reference count of |method| and frees it if the
+// METHOD_unref decrements the reference count of `method` and frees it if the
 // reference count drops to zero. This is a no-op for now because all methods
 // are currently static.
 void METHOD_unref(void *method);

data/third_party/boringssl-with-bazel/include/openssl/err.h

@@ -45,73 +45,60 @@ extern "C" {
 // backtrace of sorts.
 
 
-// Startup and shutdown.
-
-// ERR_load_BIO_strings does nothing.
-//
-// TODO(fork): remove. libjingle calls this.
-OPENSSL_EXPORT void ERR_load_BIO_strings(void);
-
-// ERR_load_ERR_strings does nothing.
-OPENSSL_EXPORT void ERR_load_ERR_strings(void);
-
-// ERR_load_crypto_strings does nothing.
-OPENSSL_EXPORT void ERR_load_crypto_strings(void);
-
-// ERR_load_RAND_strings does nothing.
-OPENSSL_EXPORT void ERR_load_RAND_strings(void);
-
-// ERR_free_strings does nothing.
-OPENSSL_EXPORT void ERR_free_strings(void);
-
-
 // Reading and formatting errors.
 
 // ERR_GET_LIB returns the library code for the error. This is one of
-// the |ERR_LIB_*| values.
+// the `ERR_LIB_*` values.
 OPENSSL_INLINE int ERR_GET_LIB(uint32_t packed_error) {
   return (int)((packed_error >> 24) & 0xff);
 }
 
 // ERR_GET_REASON returns the reason code for the error. This is one of
-// library-specific |LIB_R_*| values where |LIB| is the library (see
-// |ERR_GET_LIB|). Note that reason codes are specific to the library.
+// library-specific `LIB_R_*` values where `LIB` is the library (see
+// `ERR_GET_LIB`). Note that reason codes are specific to the library.
 OPENSSL_INLINE int ERR_GET_REASON(uint32_t packed_error) {
   return (int)(packed_error & 0xfff);
 }
 
+// ERR_equals returns one if `packed_error`'s library and reason code are `lib`
+// and `reason`, respectively, and zero otherwise.
+OPENSSL_INLINE int ERR_equals(uint32_t packed_error, int lib, int reason) {
+  return ERR_GET_LIB(packed_error) == lib &&
+         ERR_GET_REASON(packed_error) == reason;
+}
+
 // ERR_get_error gets the packed error code for the least recent error and
 // removes that error from the queue. If there are no errors in the queue then
 // it returns zero.
 OPENSSL_EXPORT uint32_t ERR_get_error(void);
 
-// ERR_get_error_line acts like |ERR_get_error|, except that the file and line
+// ERR_get_error_line acts like `ERR_get_error`, except that the file and line
 // number of the call that added the error are also returned.
 OPENSSL_EXPORT uint32_t ERR_get_error_line(const char **file, int *line);
 
-// ERR_FLAG_STRING means that the |data| member is a NUL-terminated string that
-// can be printed. This is always set if |data| is non-NULL.
+// ERR_FLAG_STRING means that the `data` member is a NUL-terminated string that
+// can be printed. This is always set if `data` is non-NULL.
 #define ERR_FLAG_STRING 1
 
-// ERR_FLAG_MALLOCED is passed into |ERR_set_error_data| to indicate that |data|
-// was allocated with |OPENSSL_malloc|.
+// ERR_FLAG_MALLOCED is passed into `ERR_set_error_data` to indicate that `data`
+// was allocated with `OPENSSL_malloc`.
 //
-// It is, separately, returned in |*flags| from |ERR_get_error_line_data| to
-// indicate that |*data| has a non-static lifetime, but this lifetime is still
-// managed by the library. The caller must not call |OPENSSL_free| or |free| on
-// |data|.
+// It is, separately, returned in `*flags` from `ERR_get_error_line_data` to
+// indicate that `*data` has a non-static lifetime, but this lifetime is still
+// managed by the library. The caller must not call `OPENSSL_free` or `free` on
+// `data`.
 #define ERR_FLAG_MALLOCED 2
 
-// ERR_get_error_line_data acts like |ERR_get_error_line|, but also returns the
+// ERR_get_error_line_data acts like `ERR_get_error_line`, but also returns the
 // error-specific data pointer and flags. The flags are a bitwise-OR of
-// |ERR_FLAG_*| values. The error-specific data is owned by the error queue
+// `ERR_FLAG_*` values. The error-specific data is owned by the error queue
 // and the pointer becomes invalid after the next call that affects the same
-// thread's error queue. If |*flags| contains |ERR_FLAG_STRING| then |*data| is
+// thread's error queue. If `*flags` contains `ERR_FLAG_STRING` then `*data` is
 // human-readable.
 OPENSSL_EXPORT uint32_t ERR_get_error_line_data(const char **file, int *line,
                                                 const char **data, int *flags);
 
-// The "peek" functions act like the |ERR_get_error| functions, above, but they
+// The "peek" functions act like the `ERR_get_error` functions, above, but they
 // do not remove the error from the queue.
 OPENSSL_EXPORT uint32_t ERR_peek_error(void);
 OPENSSL_EXPORT uint32_t ERR_peek_error_line(const char **file, int *line);
@@ -128,9 +115,9 @@ OPENSSL_EXPORT uint32_t ERR_peek_last_error_line_data(const char **file,
                                                       int *flags);
 
 // ERR_error_string_n generates a human-readable string representing
-// |packed_error|, places it at |buf|, and returns |buf|. It writes at most
-// |len| bytes (including the terminating NUL) and truncates the string if
-// necessary. If |len| is greater than zero then |buf| is always NUL terminated.
+// `packed_error`, places it at `buf`, and returns `buf`. It writes at most
+// `len` bytes (including the terminating NUL) and truncates the string if
+// necessary. If `len` is greater than zero then `buf` is always NUL terminated.
 //
 // The string will have the following format:
 //
@@ -142,31 +129,31 @@ OPENSSL_EXPORT char *ERR_error_string_n(uint32_t packed_error, char *buf,
                                         size_t len);
 
 // ERR_lib_error_string returns a string representation of the library that
-// generated |packed_error|, or a placeholder string is the library is
+// generated `packed_error`, or a placeholder string is the library is
 // unrecognized.
 OPENSSL_EXPORT const char *ERR_lib_error_string(uint32_t packed_error);
 
 // ERR_reason_error_string returns a string representation of the reason for
-// |packed_error|, or a placeholder string if the reason is unrecognized.
+// `packed_error`, or a placeholder string if the reason is unrecognized.
 OPENSSL_EXPORT const char *ERR_reason_error_string(uint32_t packed_error);
 
 // ERR_lib_symbol_name returns the symbol name of library that generated
-// |packed_error|, or NULL if unrecognized. For example, an error from
-// |ERR_LIB_EVP| would return "EVP".
+// `packed_error`, or NULL if unrecognized. For example, an error from
+// `ERR_LIB_EVP` would return "EVP".
 OPENSSL_EXPORT const char *ERR_lib_symbol_name(uint32_t packed_error);
 
 // ERR_reason_symbol_name returns the symbol name of the reason for
-// |packed_error|, or NULL if unrecognized. For example, |ERR_R_INTERNAL_ERROR|
+// `packed_error`, or NULL if unrecognized. For example, `ERR_R_INTERNAL_ERROR`
 // would return "INTERNAL_ERROR".
 //
-// Errors from the |ERR_LIB_SYS| library are typically |errno| values and will
+// Errors from the `ERR_LIB_SYS` library are typically `errno` values and will
 // return NULL. User-defined errors will also return NULL.
 OPENSSL_EXPORT const char *ERR_reason_symbol_name(uint32_t packed_error);
 
 // ERR_print_errors_callback_t is the type of a function used by
-// |ERR_print_errors_cb|. It takes a pointer to a human readable string (and
-// its length) that describes an entry in the error queue. The |ctx| argument
-// is an opaque pointer given to |ERR_print_errors_cb|.
+// `ERR_print_errors_cb`. It takes a pointer to a human readable string (and
+// its length) that describes an entry in the error queue. The `ctx` argument
+// is an opaque pointer given to `ERR_print_errors_cb`.
 //
 // It should return one on success or zero on error, which will stop the
 // iteration over the error queue.
@@ -174,22 +161,22 @@ typedef int (*ERR_print_errors_callback_t)(const char *str, size_t len,
                                            void *ctx);
 
 // ERR_print_errors_cb clears the current thread's error queue, calling
-// |callback| with a string representation of each error, from the least recent
+// `callback` with a string representation of each error, from the least recent
 // to the most recent error.
 //
 // The string will have the following format (which differs from
-// |ERR_error_string|):
+// `ERR_error_string`):
 //
 //   [thread id]:error:[error code]:[library name]:OPENSSL_internal:[reason string]:[file]:[line number]:[optional string data]
 //
 // The callback can return one to continue the iteration or zero to stop it.
-// The |ctx| argument is an opaque value that is passed through to the
+// The `ctx` argument is an opaque value that is passed through to the
 // callback.
 OPENSSL_EXPORT void ERR_print_errors_cb(ERR_print_errors_callback_t callback,
                                         void *ctx);
 
 // ERR_print_errors_fp clears the current thread's error queue, printing each
-// error to |file|. See |ERR_print_errors_cb| for the format.
+// error to `file`. See `ERR_print_errors_cb` for the format.
 OPENSSL_EXPORT void ERR_print_errors_fp(FILE *file);
 
 
@@ -198,21 +185,21 @@ OPENSSL_EXPORT void ERR_print_errors_fp(FILE *file);
 // ERR_clear_error clears the error queue for the current thread.
 OPENSSL_EXPORT void ERR_clear_error(void);
 
-// ERR_set_mark "marks" the most recent error for use with |ERR_pop_to_mark|.
+// ERR_set_mark "marks" the most recent error for use with `ERR_pop_to_mark`.
 // It returns one if an error was marked and zero if there are no errors.
 OPENSSL_EXPORT int ERR_set_mark(void);
 
 // ERR_pop_to_mark removes errors from the most recent to the least recent
 // until (and not including) a "marked" error. It returns zero if no marked
 // error was found (and thus all errors were removed) and one otherwise. Errors
-// are marked using |ERR_set_mark|.
+// are marked using `ERR_set_mark`.
 OPENSSL_EXPORT int ERR_pop_to_mark(void);
 
 
 // Custom errors.
 
 // ERR_get_next_error_library returns a value suitable for passing as the
-// |library| argument to |ERR_put_error|. This is intended for code that wishes
+// `library` argument to `ERR_put_error`. This is intended for code that wishes
 // to push its own, non-standard errors to the error queue.
 OPENSSL_EXPORT int ERR_get_next_error_library(void);
 
@@ -258,7 +245,7 @@ enum {
   ERR_NUM_LIBS
 };
 
-// The following reason codes used to denote an error occuring in another
+// The following reason codes used to denote an error occurring in another
 // library. They are sometimes used for a stack trace.
 #define ERR_R_SYS_LIB ERR_LIB_SYS
 #define ERR_R_BN_LIB ERR_LIB_BN
@@ -310,29 +297,44 @@ enum {
 
 // Deprecated functions.
 
-// ERR_remove_state calls |ERR_clear_error|.
+// ERR_load_BIO_strings does nothing.
+OPENSSL_EXPORT void ERR_load_BIO_strings(void);
+
+// ERR_load_ERR_strings does nothing.
+OPENSSL_EXPORT void ERR_load_ERR_strings(void);
+
+// ERR_load_crypto_strings does nothing.
+OPENSSL_EXPORT void ERR_load_crypto_strings(void);
+
+// ERR_load_RAND_strings does nothing.
+OPENSSL_EXPORT void ERR_load_RAND_strings(void);
+
+// ERR_free_strings does nothing.
+OPENSSL_EXPORT void ERR_free_strings(void);
+
+// ERR_remove_state calls `ERR_clear_error`.
 OPENSSL_EXPORT void ERR_remove_state(unsigned long pid);
 
 // ERR_remove_thread_state clears the error queue for the current thread if
-// |tid| is NULL. Otherwise it calls |assert(0)|, because it's no longer
+// `tid` is NULL. Otherwise it calls `assert(0)`, because it's no longer
 // possible to delete the error queue for other threads.
 //
-// Use |ERR_clear_error| instead. Note error queues are deleted automatically on
+// Use `ERR_clear_error` instead. Note error queues are deleted automatically on
 // thread exit. You do not need to call this function to release memory.
 OPENSSL_EXPORT void ERR_remove_thread_state(const CRYPTO_THREADID *tid);
 
 // ERR_func_error_string returns the string "OPENSSL_internal".
 OPENSSL_EXPORT const char *ERR_func_error_string(uint32_t packed_error);
 
-// ERR_error_string behaves like |ERR_error_string_n| but |len| is implicitly
-// |ERR_ERROR_STRING_BUF_LEN|.
+// ERR_error_string behaves like `ERR_error_string_n` but `len` is implicitly
+// `ERR_ERROR_STRING_BUF_LEN`.
 //
-// Additionally, if |buf| is NULL, the error string is placed in a static buffer
+// Additionally, if `buf` is NULL, the error string is placed in a static buffer
 // which is returned. This is not thread-safe and only exists for backwards
 // compatibility with legacy callers. The static buffer will be overridden by
 // calls in other threads.
 //
-// Use |ERR_error_string_n| instead.
+// Use `ERR_error_string_n` instead.
 //
 // TODO(fork): remove this function.
 OPENSSL_EXPORT char *ERR_error_string(uint32_t packed_error, char *buf);
@@ -371,7 +373,7 @@ OPENSSL_EXPORT void ERR_clear_system_error(void);
 OPENSSL_EXPORT void ERR_put_error(int library, int unused, int reason,
                                   const char *file, unsigned line);
 
-// ERR_add_error_data takes a variable number (|count|) of const char*
+// ERR_add_error_data takes a variable number (`count`) of const char*
 // pointers, concatenates them and sets the result as the data on the most
 // recent error.
 OPENSSL_EXPORT void ERR_add_error_data(unsigned count, ...);
@@ -381,13 +383,13 @@ OPENSSL_EXPORT void ERR_add_error_data(unsigned count, ...);
 OPENSSL_EXPORT void ERR_add_error_dataf(const char *format, ...)
     OPENSSL_PRINTF_FORMAT_FUNC(1, 2);
 
-// ERR_set_error_data sets the data on the most recent error to |data|, which
-// must be a NUL-terminated string. |flags| must contain |ERR_FLAG_STRING|. If
-// |flags| contains |ERR_FLAG_MALLOCED|, this function takes ownership of
-// |data|, which must have been allocated with |OPENSSL_malloc|. Otherwise, it
-// saves a copy of |data|.
+// ERR_set_error_data sets the data on the most recent error to `data`, which
+// must be a NUL-terminated string. `flags` must contain `ERR_FLAG_STRING`. If
+// `flags` contains `ERR_FLAG_MALLOCED`, this function takes ownership of
+// `data`, which must have been allocated with `OPENSSL_malloc`. Otherwise, it
+// saves a copy of `data`.
 //
-// Note this differs from OpenSSL which, when |ERR_FLAG_MALLOCED| is unset,
+// Note this differs from OpenSSL which, when `ERR_FLAG_MALLOCED` is unset,
 // saves the pointer as-is and requires it remain valid for the lifetime of the
 // address space.
 OPENSSL_EXPORT void ERR_set_error_data(char *data, int flags);
@@ -402,7 +404,7 @@ OPENSSL_EXPORT void ERR_set_error_data(char *data, int flags);
 // OPENSSL_DECLARE_ERROR_REASON is used by util/make_errors.h (which generates
 // the error defines) to recognise that an additional reason value is needed.
 // This is needed when the reason value is used outside of an
-// |OPENSSL_PUT_ERROR| macro. The resulting define will be
+// `OPENSSL_PUT_ERROR` macro. The resulting define will be
 // ${lib}_R_${reason}.
 #define OPENSSL_DECLARE_ERROR_REASON(lib, reason)