grpc 1.9.1 → 1.10.0.pre1

data/third_party/boringssl/include/openssl/opensslconf.h

@@ -19,18 +19,23 @@
 #define OPENSSL_HEADER_OPENSSLCONF_H
 
 
+#define OPENSSL_NO_ASYNC
 #define OPENSSL_NO_BF
+#define OPENSSL_NO_BLAKE2
 #define OPENSSL_NO_BUF_FREELISTS
 #define OPENSSL_NO_CAMELLIA
 #define OPENSSL_NO_CAPIENG
 #define OPENSSL_NO_CAST
 #define OPENSSL_NO_CMS
 #define OPENSSL_NO_COMP
+#define OPENSSL_NO_CT
 #define OPENSSL_NO_DANE
 #define OPENSSL_NO_DEPRECATED
+#define OPENSSL_NO_DGRAM
 #define OPENSSL_NO_DYNAMIC_ENGINE
 #define OPENSSL_NO_EC_NISTP_64_GCC_128
 #define OPENSSL_NO_EC2M
+#define OPENSSL_NO_EGD
 #define OPENSSL_NO_ENGINE
 #define OPENSSL_NO_GMP
 #define OPENSSL_NO_GOST
@@ -52,9 +57,11 @@
 #define OPENSSL_NO_SEED
 #define OPENSSL_NO_SRP
 #define OPENSSL_NO_SSL2
+#define OPENSSL_NO_SSL3
+#define OPENSSL_NO_SSL3_METHOD
 #define OPENSSL_NO_STATIC_ENGINE
 #define OPENSSL_NO_STORE
 #define OPENSSL_NO_WHIRLPOOL
 
 
-#endif  /* OPENSSL_HEADER_OPENSSLCONF_H */
+#endif  // OPENSSL_HEADER_OPENSSLCONF_H

data/third_party/boringssl/include/openssl/pem.h

@@ -76,41 +76,6 @@ extern "C" {
 
 #define PEM_BUFSIZE		1024
 
-#define PEM_OBJ_UNDEF		0
-#define PEM_OBJ_X509		1
-#define PEM_OBJ_X509_REQ	2
-#define PEM_OBJ_CRL		3
-#define PEM_OBJ_SSL_SESSION	4
-#define PEM_OBJ_PRIV_KEY	10
-#define PEM_OBJ_PRIV_RSA	11
-#define PEM_OBJ_PRIV_DSA	12
-#define PEM_OBJ_PRIV_DH		13
-#define PEM_OBJ_PUB_RSA		14
-#define PEM_OBJ_PUB_DSA		15
-#define PEM_OBJ_PUB_DH		16
-#define PEM_OBJ_DHPARAMS	17
-#define PEM_OBJ_DSAPARAMS	18
-#define PEM_OBJ_PRIV_RSA_PUBLIC	19
-#define PEM_OBJ_PRIV_ECDSA	20
-#define PEM_OBJ_PUB_ECDSA	21
-#define PEM_OBJ_ECPARAMETERS	22
-
-#define PEM_ERROR		30
-#define PEM_DEK_DES_CBC         40
-#define PEM_DEK_IDEA_CBC        45
-#define PEM_DEK_DES_EDE         50
-#define PEM_DEK_DES_ECB         60
-#define PEM_DEK_RSA             70
-#define PEM_DEK_RSA_MD2         80
-#define PEM_DEK_RSA_MD5         90
-
-#define PEM_MD_MD2		NID_md2
-#define PEM_MD_MD5		NID_md5
-#define PEM_MD_SHA		NID_sha
-#define PEM_MD_MD2_RSA		NID_md2WithRSAEncryption
-#define PEM_MD_MD5_RSA		NID_md5WithRSAEncryption
-#define PEM_MD_SHA_RSA		NID_sha1WithRSAEncryption
-
 #define PEM_STRING_X509_OLD	"X509 CERTIFICATE"
 #define PEM_STRING_X509		"CERTIFICATE"
 #define PEM_STRING_X509_PAIR	"CERTIFICATE PAIR"
@@ -136,71 +101,12 @@ extern "C" {
 #define PEM_STRING_ECPRIVATEKEY	"EC PRIVATE KEY"
 #define PEM_STRING_CMS		"CMS"
 
-  /* Note that this structure is initialised by PEM_SealInit and cleaned up
-     by PEM_SealFinal (at least for now) */
-typedef struct PEM_Encode_Seal_st
-	{
-	EVP_ENCODE_CTX encode;
-	EVP_MD_CTX md;
-	EVP_CIPHER_CTX cipher;
-	} PEM_ENCODE_SEAL_CTX;
-
 /* enc_type is one off */
 #define PEM_TYPE_ENCRYPTED      10
 #define PEM_TYPE_MIC_ONLY       20
 #define PEM_TYPE_MIC_CLEAR      30
 #define PEM_TYPE_CLEAR		40
 
-typedef struct pem_recip_st
-	{
-	char *name;
-	X509_NAME *dn;
-
-	int cipher;
-	int key_enc;
-	/*	char iv[8]; unused and wrong size */
-	} PEM_USER;
-
-typedef struct pem_ctx_st
-	{
-	int type;		/* what type of object */
-
-	struct	{
-		int version;	
-		int mode;		
-		} proc_type;
-
-	char *domain;
-
-	struct	{
-		int cipher;
-	/* unused, and wrong size
-	   unsigned char iv[8]; */
-		} DEK_info;
-		
-	PEM_USER *originator;
-
-	int num_recipient;
-	PEM_USER **recipient;
-
-	EVP_MD *md;		/* signature type */
-
-	int md_enc;		/* is the md encrypted or not? */
-	int md_len;		/* length of md_data */
-	char *md_data;		/* message digest, could be pkey encrypted */
-
-	EVP_CIPHER *dec;	/* date encryption cipher */
-	int key_len;		/* key length */
-	unsigned char *key;	/* key */
-	/* unused, and wrong size
-	   unsigned char iv[8]; */
-
-	
-	int  data_enc;		/* is the data encrypted */
-	int data_len;
-	unsigned char *data;
-	} PEM_CTX;
-
 /* These macros make the PEM_read/PEM_write functions easier to maintain and
  * write. Now they are all implemented with either:
  * IMPLEMENT_PEM_rw(...) or IMPLEMENT_PEM_rw_cb(...)
@@ -219,7 +125,7 @@ typedef struct pem_ctx_st
 #define IMPLEMENT_PEM_read_fp(name, type, str, asn1) \
 OPENSSL_EXPORT type *PEM_read_##name(FILE *fp, type **x, pem_password_cb *cb, void *u)\
 { \
-return PEM_ASN1_read((d2i_of_void *)d2i_##asn1, str,fp,(void **)x,cb,u); \
+return (type *)PEM_ASN1_read((d2i_of_void *)d2i_##asn1, str,fp,(void **)x,cb,u); \
 } 
 
 #define IMPLEMENT_PEM_write_fp(name, type, str, asn1) \
@@ -255,7 +161,7 @@ OPENSSL_EXPORT int PEM_write_##name(FILE *fp, type *x, const EVP_CIPHER *enc, \
 #define IMPLEMENT_PEM_read_bio(name, type, str, asn1) \
 OPENSSL_EXPORT type *PEM_read_bio_##name(BIO *bp, type **x, pem_password_cb *cb, void *u)\
 { \
-return PEM_ASN1_read_bio((d2i_of_void *)d2i_##asn1, str,bp,(void **)x,cb,u); \
+return (type *)PEM_ASN1_read_bio((d2i_of_void *)d2i_##asn1, str,bp,(void **)x,cb,u); \
 }
 
 #define IMPLEMENT_PEM_write_bio(name, type, str, asn1) \
@@ -404,14 +310,6 @@ OPENSSL_EXPORT void *  PEM_ASN1_read(d2i_of_void *d2i, const char *name, FILE *f
 OPENSSL_EXPORT int	PEM_ASN1_write(i2d_of_void *i2d,const char *name,FILE *fp, void *x,const EVP_CIPHER *enc,unsigned char *kstr, int klen,pem_password_cb *callback, void *u);
 OPENSSL_EXPORT STACK_OF(X509_INFO) *	PEM_X509_INFO_read(FILE *fp, STACK_OF(X509_INFO) *sk, pem_password_cb *cb, void *u);
 
-OPENSSL_EXPORT int	PEM_SealInit(PEM_ENCODE_SEAL_CTX *ctx, EVP_CIPHER *type, EVP_MD *md_type, unsigned char **ek, int *ekl, unsigned char *iv, EVP_PKEY **pubk, int npubk);
-OPENSSL_EXPORT void	PEM_SealUpdate(PEM_ENCODE_SEAL_CTX *ctx, unsigned char *out, int *outl, unsigned char *in, int inl);
-OPENSSL_EXPORT int	PEM_SealFinal(PEM_ENCODE_SEAL_CTX *ctx, unsigned char *sig,int *sigl, unsigned char *out, int *outl, EVP_PKEY *priv);
-
-OPENSSL_EXPORT void    PEM_SignInit(EVP_MD_CTX *ctx, EVP_MD *type);
-OPENSSL_EXPORT void    PEM_SignUpdate(EVP_MD_CTX *ctx,unsigned char *d,unsigned int cnt);
-OPENSSL_EXPORT int	PEM_SignFinal(EVP_MD_CTX *ctx, unsigned char *sigret, unsigned int *siglen, EVP_PKEY *pkey);
-
 /* PEM_def_callback treats |userdata| as a string and copies it into |buf|,
  * assuming its |size| is sufficient. Returns the length of the string, or 0
  * if there is not enough room. If either |buf| or |userdata| is NULL, 0 is
@@ -426,17 +324,11 @@ DECLARE_PEM_rw(X509, X509)
 
 DECLARE_PEM_rw(X509_AUX, X509)
 
-DECLARE_PEM_rw(X509_CERT_PAIR, X509_CERT_PAIR)
-
 DECLARE_PEM_rw(X509_REQ, X509_REQ)
 DECLARE_PEM_write(X509_REQ_NEW, X509_REQ)
 
 DECLARE_PEM_rw(X509_CRL, X509_CRL)
 
-/* DECLARE_PEM_rw(PKCS7, PKCS7) */
-
-DECLARE_PEM_rw(NETSCAPE_CERT_SEQUENCE, NETSCAPE_CERT_SEQUENCE)
-
 DECLARE_PEM_rw(PKCS8, X509_SIG)
 
 DECLARE_PEM_rw(PKCS8_PRIV_KEY_INFO, PKCS8_PRIV_KEY_INFO)
@@ -481,18 +373,6 @@ OPENSSL_EXPORT EVP_PKEY *d2i_PKCS8PrivateKey_fp(FILE *fp, EVP_PKEY **x, pem_pass
 
 OPENSSL_EXPORT int PEM_write_PKCS8PrivateKey(FILE *fp,EVP_PKEY *x,const EVP_CIPHER *enc, char *kstr,int klen, pem_password_cb *cd, void *u);
 
-OPENSSL_EXPORT EVP_PKEY *b2i_PrivateKey(const unsigned char **in, long length);
-OPENSSL_EXPORT EVP_PKEY *b2i_PublicKey(const unsigned char **in, long length);
-OPENSSL_EXPORT EVP_PKEY *b2i_PrivateKey_bio(BIO *in);
-OPENSSL_EXPORT EVP_PKEY *b2i_PublicKey_bio(BIO *in);
-OPENSSL_EXPORT int i2b_PrivateKey_bio(BIO *out, EVP_PKEY *pk);
-OPENSSL_EXPORT int i2b_PublicKey_bio(BIO *out, EVP_PKEY *pk);
-OPENSSL_EXPORT EVP_PKEY *b2i_PVK_bio(BIO *in, pem_password_cb *cb, void *u);
-OPENSSL_EXPORT int i2b_PVK_bio(BIO *out, EVP_PKEY *pk, int enclevel, pem_password_cb *cb, void *u);
-
-
-void ERR_load_PEM_strings(void);
-
 
 #ifdef  __cplusplus
 }

data/third_party/boringssl/include/openssl/pkcs7.h

@@ -12,5 +12,71 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
 
-/* This header is provided in order to make compiling against code that expects
-   OpenSSL easier. */
+#ifndef OPENSSL_HEADER_PKCS7_H
+#define OPENSSL_HEADER_PKCS7_H
+
+#include <openssl/base.h>
+
+#include <openssl/stack.h>
+
+#if defined(__cplusplus)
+extern "C" {
+#endif
+
+
+// PKCS#7.
+//
+// This library contains functions for extracting information from PKCS#7
+// structures (RFC 2315).
+
+DECLARE_STACK_OF(CRYPTO_BUFFER)
+DECLARE_STACK_OF(X509)
+DECLARE_STACK_OF(X509_CRL)
+
+// PKCS7_get_raw_certificates parses a PKCS#7, SignedData structure from |cbs|
+// and appends the included certificates to |out_certs|. It returns one on
+// success and zero on error.
+OPENSSL_EXPORT int PKCS7_get_raw_certificates(
+    STACK_OF(CRYPTO_BUFFER) *out_certs, CBS *cbs, CRYPTO_BUFFER_POOL *pool);
+
+// PKCS7_get_certificates behaves like |PKCS7_get_raw_certificates| but parses
+// them into |X509| objects.
+OPENSSL_EXPORT int PKCS7_get_certificates(STACK_OF(X509) *out_certs, CBS *cbs);
+
+// PKCS7_bundle_certificates appends a PKCS#7, SignedData structure containing
+// |certs| to |out|. It returns one on success and zero on error.
+OPENSSL_EXPORT int PKCS7_bundle_certificates(
+    CBB *out, const STACK_OF(X509) *certs);
+
+// PKCS7_get_CRLs parses a PKCS#7, SignedData structure from |cbs| and appends
+// the included CRLs to |out_crls|. It returns one on success and zero on
+// error.
+OPENSSL_EXPORT int PKCS7_get_CRLs(STACK_OF(X509_CRL) *out_crls, CBS *cbs);
+
+// PKCS7_bundle_CRLs appends a PKCS#7, SignedData structure containing
+// |crls| to |out|. It returns one on success and zero on error.
+OPENSSL_EXPORT int PKCS7_bundle_CRLs(CBB *out, const STACK_OF(X509_CRL) *crls);
+
+// PKCS7_get_PEM_certificates reads a PEM-encoded, PKCS#7, SignedData structure
+// from |pem_bio| and appends the included certificates to |out_certs|. It
+// returns one on success and zero on error.
+OPENSSL_EXPORT int PKCS7_get_PEM_certificates(STACK_OF(X509) *out_certs,
+                                              BIO *pem_bio);
+
+// PKCS7_get_PEM_CRLs reads a PEM-encoded, PKCS#7, SignedData structure from
+// |pem_bio| and appends the included CRLs to |out_crls|. It returns one on
+// success and zero on error.
+OPENSSL_EXPORT int PKCS7_get_PEM_CRLs(STACK_OF(X509_CRL) *out_crls,
+                                      BIO *pem_bio);
+
+
+#if defined(__cplusplus)
+}  // extern C
+#endif
+
+#define PKCS7_R_BAD_PKCS7_VERSION 100
+#define PKCS7_R_NOT_PKCS7_SIGNED_DATA 101
+#define PKCS7_R_NO_CERTIFICATES_INCLUDED 102
+#define PKCS7_R_NO_CRLS_INCLUDED 103
+
+#endif  // OPENSSL_HEADER_PKCS7_H

data/third_party/boringssl/include/openssl/pkcs8.h

@@ -66,106 +66,121 @@ extern "C" {
 #endif
 
 
-/* PKCS8_encrypt serializes and encrypts a PKCS8_PRIV_KEY_INFO with PBES1 or
- * PBES2 as defined in PKCS #5. Only pbeWithSHAAnd128BitRC4,
- * pbeWithSHAAnd3-KeyTripleDES-CBC and pbeWithSHA1And40BitRC2, defined in PKCS
- * #12, and PBES2, are supported.  PBES2 is selected by setting |cipher| and
- * passing -1 for |pbe_nid|.  Otherwise, PBES1 is used and |cipher| is ignored.
- *
- * |pass| is used as the password. If a PBES1 scheme from PKCS #12 is used, this
- * will be converted to a raw byte string as specified in B.1 of PKCS #12. If
- * |pass| is NULL, it will be encoded as the empty byte string rather than two
- * zero bytes, the PKCS #12 encoding of the empty string.
- *
- * If |salt| is NULL, a random salt of |salt_len| bytes is generated. If
- * |salt_len| is zero, a default salt length is used instead.
- *
- * The resulting structure is stored in an |X509_SIG| which must be freed by the
- * caller. */
+// PKCS8_encrypt serializes and encrypts a PKCS8_PRIV_KEY_INFO with PBES1 or
+// PBES2 as defined in PKCS #5. Only pbeWithSHAAnd128BitRC4,
+// pbeWithSHAAnd3-KeyTripleDES-CBC and pbeWithSHA1And40BitRC2, defined in PKCS
+// #12, and PBES2, are supported.  PBES2 is selected by setting |cipher| and
+// passing -1 for |pbe_nid|.  Otherwise, PBES1 is used and |cipher| is ignored.
+//
+// |pass| is used as the password. If a PBES1 scheme from PKCS #12 is used, this
+// will be converted to a raw byte string as specified in B.1 of PKCS #12. If
+// |pass| is NULL, it will be encoded as the empty byte string rather than two
+// zero bytes, the PKCS #12 encoding of the empty string.
+//
+// If |salt| is NULL, a random salt of |salt_len| bytes is generated. If
+// |salt_len| is zero, a default salt length is used instead.
+//
+// The resulting structure is stored in an |X509_SIG| which must be freed by the
+// caller.
 OPENSSL_EXPORT X509_SIG *PKCS8_encrypt(int pbe_nid, const EVP_CIPHER *cipher,
                                        const char *pass, int pass_len,
                                        const uint8_t *salt, size_t salt_len,
                                        int iterations,
                                        PKCS8_PRIV_KEY_INFO *p8inf);
 
-/* PKCS8_decrypt decrypts and decodes a PKCS8_PRIV_KEY_INFO with PBES1 or PBES2
- * as defined in PKCS #5. Only pbeWithSHAAnd128BitRC4,
- * pbeWithSHAAnd3-KeyTripleDES-CBC and pbeWithSHA1And40BitRC2, and PBES2,
- * defined in PKCS #12, are supported.
- *
- * |pass| is used as the password. If a PBES1 scheme from PKCS #12 is used, this
- * will be converted to a raw byte string as specified in B.1 of PKCS #12. If
- * |pass| is NULL, it will be encoded as the empty byte string rather than two
- * zero bytes, the PKCS #12 encoding of the empty string.
- *
- * The resulting structure must be freed by the caller. */
+// PKCS8_marshal_encrypted_private_key behaves like |PKCS8_encrypt| but encrypts
+// an |EVP_PKEY| and writes the serialized EncryptedPrivateKeyInfo to |out|. It
+// returns one on success and zero on error.
+OPENSSL_EXPORT int PKCS8_marshal_encrypted_private_key(
+    CBB *out, int pbe_nid, const EVP_CIPHER *cipher, const char *pass,
+    size_t pass_len, const uint8_t *salt, size_t salt_len, int iterations,
+    const EVP_PKEY *pkey);
+
+// PKCS8_decrypt decrypts and decodes a PKCS8_PRIV_KEY_INFO with PBES1 or PBES2
+// as defined in PKCS #5. Only pbeWithSHAAnd128BitRC4,
+// pbeWithSHAAnd3-KeyTripleDES-CBC and pbeWithSHA1And40BitRC2, and PBES2,
+// defined in PKCS #12, are supported.
+//
+// |pass| is used as the password. If a PBES1 scheme from PKCS #12 is used, this
+// will be converted to a raw byte string as specified in B.1 of PKCS #12. If
+// |pass| is NULL, it will be encoded as the empty byte string rather than two
+// zero bytes, the PKCS #12 encoding of the empty string.
+//
+// The resulting structure must be freed by the caller.
 OPENSSL_EXPORT PKCS8_PRIV_KEY_INFO *PKCS8_decrypt(X509_SIG *pkcs8,
                                                   const char *pass,
                                                   int pass_len);
 
-/* PKCS12_get_key_and_certs parses a PKCS#12 structure from |in|, authenticates
- * and decrypts it using |password|, sets |*out_key| to the included private
- * key and appends the included certificates to |out_certs|. It returns one on
- * success and zero on error. The caller takes ownership of the outputs. */
+// PKCS8_parse_encrypted_private_key behaves like |PKCS8_decrypt| but it parses
+// the EncryptedPrivateKeyInfo structure from |cbs| and advances |cbs|. It
+// returns a newly-allocated |EVP_PKEY| on success and zero on error.
+OPENSSL_EXPORT EVP_PKEY *PKCS8_parse_encrypted_private_key(CBS *cbs,
+                                                           const char *pass,
+                                                           size_t pass_len);
+
+// PKCS12_get_key_and_certs parses a PKCS#12 structure from |in|, authenticates
+// and decrypts it using |password|, sets |*out_key| to the included private
+// key and appends the included certificates to |out_certs|. It returns one on
+// success and zero on error. The caller takes ownership of the outputs.
 OPENSSL_EXPORT int PKCS12_get_key_and_certs(EVP_PKEY **out_key,
                                             STACK_OF(X509) *out_certs,
                                             CBS *in, const char *password);
 
 
-/* Deprecated functions. */
+// Deprecated functions.
 
-/* PKCS12_PBE_add does nothing. It exists for compatibility with OpenSSL. */
+// PKCS12_PBE_add does nothing. It exists for compatibility with OpenSSL.
 OPENSSL_EXPORT void PKCS12_PBE_add(void);
 
-/* d2i_PKCS12 is a dummy function that copies |*ber_bytes| into a
- * |PKCS12| structure. The |out_p12| argument should be NULL(✝). On exit,
- * |*ber_bytes| will be advanced by |ber_len|. It returns a fresh |PKCS12|
- * structure or NULL on error.
- *
- * Note: unlike other d2i functions, |d2i_PKCS12| will always consume |ber_len|
- * bytes.
- *
- * (✝) If |out_p12| is not NULL and the function is successful, |*out_p12| will
- * be freed if not NULL itself and the result will be written to |*out_p12|.
- * New code should not depend on this. */
+// d2i_PKCS12 is a dummy function that copies |*ber_bytes| into a
+// |PKCS12| structure. The |out_p12| argument should be NULL(✝). On exit,
+// |*ber_bytes| will be advanced by |ber_len|. It returns a fresh |PKCS12|
+// structure or NULL on error.
+//
+// Note: unlike other d2i functions, |d2i_PKCS12| will always consume |ber_len|
+// bytes.
+//
+// (✝) If |out_p12| is not NULL and the function is successful, |*out_p12| will
+// be freed if not NULL itself and the result will be written to |*out_p12|.
+// New code should not depend on this.
 OPENSSL_EXPORT PKCS12 *d2i_PKCS12(PKCS12 **out_p12, const uint8_t **ber_bytes,
                                   size_t ber_len);
 
-/* d2i_PKCS12_bio acts like |d2i_PKCS12| but reads from a |BIO|. */
+// d2i_PKCS12_bio acts like |d2i_PKCS12| but reads from a |BIO|.
 OPENSSL_EXPORT PKCS12* d2i_PKCS12_bio(BIO *bio, PKCS12 **out_p12);
 
-/* d2i_PKCS12_fp acts like |d2i_PKCS12| but reads from a |FILE|. */
+// d2i_PKCS12_fp acts like |d2i_PKCS12| but reads from a |FILE|.
 OPENSSL_EXPORT PKCS12* d2i_PKCS12_fp(FILE *fp, PKCS12 **out_p12);
 
-/* PKCS12_parse calls |PKCS12_get_key_and_certs| on the ASN.1 data stored in
- * |p12|. The |out_pkey| and |out_cert| arguments must not be NULL and, on
- * successful exit, the private key and first certificate will be stored in
- * them. The |out_ca_certs| argument may be NULL but, if not, then any extra
- * certificates will be appended to |*out_ca_certs|. If |*out_ca_certs| is NULL
- * then it will be set to a freshly allocated stack containing the extra certs.
- *
- * It returns one on success and zero on error. */
+// PKCS12_parse calls |PKCS12_get_key_and_certs| on the ASN.1 data stored in
+// |p12|. The |out_pkey| and |out_cert| arguments must not be NULL and, on
+// successful exit, the private key and first certificate will be stored in
+// them. The |out_ca_certs| argument may be NULL but, if not, then any extra
+// certificates will be appended to |*out_ca_certs|. If |*out_ca_certs| is NULL
+// then it will be set to a freshly allocated stack containing the extra certs.
+//
+// It returns one on success and zero on error.
 OPENSSL_EXPORT int PKCS12_parse(const PKCS12 *p12, const char *password,
                                 EVP_PKEY **out_pkey, X509 **out_cert,
                                 STACK_OF(X509) **out_ca_certs);
 
-/* PKCS12_verify_mac returns one if |password| is a valid password for |p12|
- * and zero otherwise. Since |PKCS12_parse| doesn't take a length parameter,
- * it's not actually possible to use a non-NUL-terminated password to actually
- * get anything from a |PKCS12|. Thus |password| and |password_len| may be
- * |NULL| and zero, respectively, or else |password_len| may be -1, or else
- * |password[password_len]| must be zero and no other NUL bytes may appear in
- * |password|. If the |password_len| checks fail, zero is returned
- * immediately. */
+// PKCS12_verify_mac returns one if |password| is a valid password for |p12|
+// and zero otherwise. Since |PKCS12_parse| doesn't take a length parameter,
+// it's not actually possible to use a non-NUL-terminated password to actually
+// get anything from a |PKCS12|. Thus |password| and |password_len| may be
+// |NULL| and zero, respectively, or else |password_len| may be -1, or else
+// |password[password_len]| must be zero and no other NUL bytes may appear in
+// |password|. If the |password_len| checks fail, zero is returned
+// immediately.
 OPENSSL_EXPORT int PKCS12_verify_mac(const PKCS12 *p12, const char *password,
                                      int password_len);
 
-/* PKCS12_free frees |p12| and its contents. */
+// PKCS12_free frees |p12| and its contents.
 OPENSSL_EXPORT void PKCS12_free(PKCS12 *p12);
 
 
 #if defined(__cplusplus)
-}  /* extern C */
+}  // extern C
 
 extern "C++" {
 
@@ -176,7 +191,7 @@ BORINGSSL_MAKE_DELETER(PKCS8_PRIV_KEY_INFO, PKCS8_PRIV_KEY_INFO_free)
 
 }  // namespace bssl
 
-}  /* extern C++ */
+}  // extern C++
 
 #endif
 
@@ -212,4 +227,4 @@ BORINGSSL_MAKE_DELETER(PKCS8_PRIV_KEY_INFO, PKCS8_PRIV_KEY_INFO_free)
 #define PKCS8_R_BAD_ITERATION_COUNT 129
 #define PKCS8_R_UNSUPPORTED_PRF 130
 
-#endif  /* OPENSSL_HEADER_PKCS8_H */
+#endif  // OPENSSL_HEADER_PKCS8_H