grpc 1.9.1 → 1.10.0.pre1

data/third_party/boringssl/include/openssl/ssl3.h

@@ -125,14 +125,14 @@ extern "C" {
 #endif
 
 
-/* These are kept to support clients that negotiates higher protocol versions
- * using SSLv2 client hello records. */
+// These are kept to support clients that negotiates higher protocol versions
+// using SSLv2 client hello records.
 #define SSL2_MT_CLIENT_HELLO 1
 #define SSL2_VERSION 0x0002
 
-/* Signalling cipher suite value from RFC 5746. */
+// Signalling cipher suite value from RFC 5746.
 #define SSL3_CK_SCSV 0x030000FF
-/* Fallback signalling cipher suite value from RFC 7507. */
+// Fallback signalling cipher suite value from RFC 7507.
 #define SSL3_CK_FALLBACK_SCSV 0x03005600
 
 #define SSL3_CK_RSA_NULL_MD5 0x03000001
@@ -208,11 +208,11 @@ extern "C" {
 #define SSL3_HM_HEADER_LENGTH 4
 
 #ifndef SSL3_ALIGN_PAYLOAD
-/* Some will argue that this increases memory footprint, but it's not actually
- * true. Point is that malloc has to return at least 64-bit aligned pointers,
- * meaning that allocating 5 bytes wastes 3 bytes in either case. Suggested
- * pre-gaping simply moves these wasted bytes from the end of allocated region
- * to its front, but makes data payload aligned, which improves performance. */
+// Some will argue that this increases memory footprint, but it's not actually
+// true. Point is that malloc has to return at least 64-bit aligned pointers,
+// meaning that allocating 5 bytes wastes 3 bytes in either case. Suggested
+// pre-gaping simply moves these wasted bytes from the end of allocated region
+// to its front, but makes data payload aligned, which improves performance.
 #define SSL3_ALIGN_PAYLOAD 8
 #else
 #if (SSL3_ALIGN_PAYLOAD & (SSL3_ALIGN_PAYLOAD - 1)) != 0
@@ -221,33 +221,33 @@ extern "C" {
 #endif
 #endif
 
-/* This is the maximum MAC (digest) size used by the SSL library. Currently
- * maximum of 20 is used by SHA1, but we reserve for future extension for
- * 512-bit hashes. */
+// This is the maximum MAC (digest) size used by the SSL library. Currently
+// maximum of 20 is used by SHA1, but we reserve for future extension for
+// 512-bit hashes.
 
 #define SSL3_RT_MAX_MD_SIZE 64
 
-/* Maximum block size used in all ciphersuites. Currently 16 for AES. */
+// Maximum block size used in all ciphersuites. Currently 16 for AES.
 
 #define SSL_RT_MAX_CIPHER_BLOCK_SIZE 16
 
-/* Maximum plaintext length: defined by SSL/TLS standards */
+// Maximum plaintext length: defined by SSL/TLS standards
 #define SSL3_RT_MAX_PLAIN_LENGTH 16384
-/* Maximum compression overhead: defined by SSL/TLS standards */
+// Maximum compression overhead: defined by SSL/TLS standards
 #define SSL3_RT_MAX_COMPRESSED_OVERHEAD 1024
 
-/* The standards give a maximum encryption overhead of 1024 bytes. In practice
- * the value is lower than this. The overhead is the maximum number of padding
- * bytes (256) plus the mac size.
- *
- * TODO(davidben): This derivation doesn't take AEADs into account, or TLS 1.1
- * explicit nonces. It happens to work because |SSL3_RT_MAX_MD_SIZE| is larger
- * than necessary and no true AEAD has variable overhead in TLS 1.2. */
+// The standards give a maximum encryption overhead of 1024 bytes. In practice
+// the value is lower than this. The overhead is the maximum number of padding
+// bytes (256) plus the mac size.
+//
+// TODO(davidben): This derivation doesn't take AEADs into account, or TLS 1.1
+// explicit nonces. It happens to work because |SSL3_RT_MAX_MD_SIZE| is larger
+// than necessary and no true AEAD has variable overhead in TLS 1.2.
 #define SSL3_RT_MAX_ENCRYPTED_OVERHEAD (256 + SSL3_RT_MAX_MD_SIZE)
 
-/* SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD is the maximum overhead in encrypting a
- * record. This does not include the record header. Some ciphers use explicit
- * nonces, so it includes both the AEAD overhead as well as the nonce. */
+// SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD is the maximum overhead in encrypting a
+// record. This does not include the record header. Some ciphers use explicit
+// nonces, so it includes both the AEAD overhead as well as the nonce.
 #define SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD \
     (EVP_AEAD_MAX_OVERHEAD + EVP_AEAD_MAX_NONCE_LENGTH)
 
@@ -255,9 +255,9 @@ OPENSSL_COMPILE_ASSERT(
     SSL3_RT_MAX_ENCRYPTED_OVERHEAD >= SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD,
     max_overheads_are_consistent);
 
-/* SSL3_RT_MAX_COMPRESSED_LENGTH is an alias for
- * |SSL3_RT_MAX_PLAIN_LENGTH|. Compression is gone, so don't include the
- * compression overhead. */
+// SSL3_RT_MAX_COMPRESSED_LENGTH is an alias for
+// |SSL3_RT_MAX_PLAIN_LENGTH|. Compression is gone, so don't include the
+// compression overhead.
 #define SSL3_RT_MAX_COMPRESSED_LENGTH SSL3_RT_MAX_PLAIN_LENGTH
 
 #define SSL3_RT_MAX_ENCRYPTED_LENGTH \
@@ -273,100 +273,27 @@ OPENSSL_COMPILE_ASSERT(
 #define SSL3_RT_HANDSHAKE 22
 #define SSL3_RT_APPLICATION_DATA 23
 
-/* Pseudo content type for SSL/TLS header info */
+// Pseudo content type for SSL/TLS header info
 #define SSL3_RT_HEADER 0x100
 
 #define SSL3_AL_WARNING 1
 #define SSL3_AL_FATAL 2
 
 #define SSL3_AD_CLOSE_NOTIFY 0
-#define SSL3_AD_UNEXPECTED_MESSAGE 10    /* fatal */
-#define SSL3_AD_BAD_RECORD_MAC 20        /* fatal */
-#define SSL3_AD_DECOMPRESSION_FAILURE 30 /* fatal */
-#define SSL3_AD_HANDSHAKE_FAILURE 40     /* fatal */
+#define SSL3_AD_UNEXPECTED_MESSAGE 10     // fatal
+#define SSL3_AD_BAD_RECORD_MAC 20         // fatal
+#define SSL3_AD_DECOMPRESSION_FAILURE 30  // fatal
+#define SSL3_AD_HANDSHAKE_FAILURE 40      // fatal
 #define SSL3_AD_NO_CERTIFICATE 41
 #define SSL3_AD_BAD_CERTIFICATE 42
 #define SSL3_AD_UNSUPPORTED_CERTIFICATE 43
 #define SSL3_AD_CERTIFICATE_REVOKED 44
 #define SSL3_AD_CERTIFICATE_EXPIRED 45
 #define SSL3_AD_CERTIFICATE_UNKNOWN 46
-#define SSL3_AD_ILLEGAL_PARAMETER 47      /* fatal */
-#define SSL3_AD_INAPPROPRIATE_FALLBACK 86 /* fatal */
+#define SSL3_AD_ILLEGAL_PARAMETER 47       // fatal
+#define SSL3_AD_INAPPROPRIATE_FALLBACK 86  // fatal
 
 #define SSL3_CT_RSA_SIGN 1
-#define SSL3_CT_DSS_SIGN 2
-#define SSL3_CT_RSA_FIXED_DH 3
-#define SSL3_CT_DSS_FIXED_DH 4
-#define SSL3_CT_RSA_EPHEMERAL_DH 5
-#define SSL3_CT_DSS_EPHEMERAL_DH 6
-#define SSL3_CT_FORTEZZA_DMS 20
-
-/* SSLv3 */
-/* client */
-/* extra state */
-#define SSL3_ST_CW_FLUSH (0x100 | SSL_ST_CONNECT)
-#define SSL3_ST_FALSE_START (0x101 | SSL_ST_CONNECT)
-#define SSL3_ST_VERIFY_SERVER_CERT (0x102 | SSL_ST_CONNECT)
-#define SSL3_ST_FINISH_CLIENT_HANDSHAKE (0x103 | SSL_ST_CONNECT)
-/* write to server */
-#define SSL3_ST_CW_CLNT_HELLO_A (0x110 | SSL_ST_CONNECT)
-/* read from server */
-#define SSL3_ST_CR_SRVR_HELLO_A (0x120 | SSL_ST_CONNECT)
-#define DTLS1_ST_CR_HELLO_VERIFY_REQUEST_A (0x126 | SSL_ST_CONNECT)
-#define SSL3_ST_CR_CERT_A (0x130 | SSL_ST_CONNECT)
-#define SSL3_ST_CR_KEY_EXCH_A (0x140 | SSL_ST_CONNECT)
-#define SSL3_ST_CR_KEY_EXCH_B (0x141 | SSL_ST_CONNECT)
-#define SSL3_ST_CR_CERT_REQ_A (0x150 | SSL_ST_CONNECT)
-#define SSL3_ST_CR_SRVR_DONE_A (0x160 | SSL_ST_CONNECT)
-/* write to server */
-#define SSL3_ST_CW_CERT_A (0x170 | SSL_ST_CONNECT)
-#define SSL3_ST_CW_KEY_EXCH_A (0x180 | SSL_ST_CONNECT)
-#define SSL3_ST_CW_CERT_VRFY_A (0x190 | SSL_ST_CONNECT)
-#define SSL3_ST_CW_CERT_VRFY_B (0x191 | SSL_ST_CONNECT)
-#define SSL3_ST_CW_CHANGE (0x1A0 | SSL_ST_CONNECT)
-#define SSL3_ST_CW_NEXT_PROTO_A (0x200 | SSL_ST_CONNECT)
-#define SSL3_ST_CW_CHANNEL_ID_A (0x220 | SSL_ST_CONNECT)
-#define SSL3_ST_CW_FINISHED_A (0x1B0 | SSL_ST_CONNECT)
-/* read from server */
-#define SSL3_ST_CR_CHANGE (0x1C0 | SSL_ST_CONNECT)
-#define SSL3_ST_CR_FINISHED_A (0x1D0 | SSL_ST_CONNECT)
-#define SSL3_ST_CR_SESSION_TICKET_A (0x1E0 | SSL_ST_CONNECT)
-#define SSL3_ST_CR_CERT_STATUS_A (0x1F0 | SSL_ST_CONNECT)
-
-/* SSL3_ST_CR_SRVR_HELLO_B is a legacy alias for |SSL3_ST_CR_SRVR_HELLO_A| used
- * by some consumers which check |SSL_state|. */
-#define SSL3_ST_CR_SRVR_HELLO_B SSL3_ST_CR_SRVR_HELLO_A
-
-/* server */
-/* extra state */
-#define SSL3_ST_SW_FLUSH (0x100 | SSL_ST_ACCEPT)
-/* read from client */
-#define SSL3_ST_SR_CLNT_HELLO_A (0x110 | SSL_ST_ACCEPT)
-#define SSL3_ST_SR_CLNT_HELLO_B (0x111 | SSL_ST_ACCEPT)
-#define SSL3_ST_SR_CLNT_HELLO_C (0x112 | SSL_ST_ACCEPT)
-#define SSL3_ST_SR_CLNT_HELLO_D (0x113 | SSL_ST_ACCEPT)
-/* write to client */
-#define SSL3_ST_SW_SRVR_HELLO_A (0x130 | SSL_ST_ACCEPT)
-#define SSL3_ST_SW_CERT_A (0x140 | SSL_ST_ACCEPT)
-#define SSL3_ST_SW_KEY_EXCH_A (0x150 | SSL_ST_ACCEPT)
-#define SSL3_ST_SW_KEY_EXCH_B (0x151 | SSL_ST_ACCEPT)
-#define SSL3_ST_SW_CERT_REQ_A (0x160 | SSL_ST_ACCEPT)
-#define SSL3_ST_SW_SRVR_DONE_A (0x170 | SSL_ST_ACCEPT)
-/* read from client */
-#define SSL3_ST_SR_CERT_A (0x180 | SSL_ST_ACCEPT)
-#define SSL3_ST_SR_KEY_EXCH_A (0x190 | SSL_ST_ACCEPT)
-#define SSL3_ST_SR_KEY_EXCH_B (0x191 | SSL_ST_ACCEPT)
-#define SSL3_ST_SR_CERT_VRFY_A (0x1A0 | SSL_ST_ACCEPT)
-#define SSL3_ST_SR_CHANGE (0x1B0 | SSL_ST_ACCEPT)
-#define SSL3_ST_SR_NEXT_PROTO_A (0x210 | SSL_ST_ACCEPT)
-#define SSL3_ST_SR_CHANNEL_ID_A (0x230 | SSL_ST_ACCEPT)
-#define SSL3_ST_SR_FINISHED_A (0x1C0 | SSL_ST_ACCEPT)
-
-/* write to client */
-#define SSL3_ST_SW_CHANGE (0x1D0 | SSL_ST_ACCEPT)
-#define SSL3_ST_SW_FINISHED_A (0x1E0 | SSL_ST_ACCEPT)
-#define SSL3_ST_SW_SESSION_TICKET_A (0x1F0 | SSL_ST_ACCEPT)
-#define SSL3_ST_SW_CERT_STATUS_A (0x200 | SSL_ST_ACCEPT)
 
 #define SSL3_MT_HELLO_REQUEST 0
 #define SSL3_MT_CLIENT_HELLO 1
@@ -388,27 +315,17 @@ OPENSSL_COMPILE_ASSERT(
 #define SSL3_MT_CHANNEL_ID 203
 #define DTLS1_MT_HELLO_VERIFY_REQUEST 3
 
-/* The following are legacy aliases for consumers which use
- * |SSL_CTX_set_msg_callback|. */
+// The following are legacy aliases for consumers which use
+// |SSL_CTX_set_msg_callback|.
 #define SSL3_MT_SERVER_DONE SSL3_MT_SERVER_HELLO_DONE
 #define SSL3_MT_NEWSESSION_TICKET SSL3_MT_NEW_SESSION_TICKET
 
 
 #define SSL3_MT_CCS 1
 
-/* These are used when changing over to a new cipher */
-#define SSL3_CC_READ 0x01
-#define SSL3_CC_WRITE 0x02
-#define SSL3_CC_CLIENT 0x10
-#define SSL3_CC_SERVER 0x20
-#define SSL3_CHANGE_CIPHER_CLIENT_WRITE (SSL3_CC_CLIENT | SSL3_CC_WRITE)
-#define SSL3_CHANGE_CIPHER_SERVER_READ (SSL3_CC_SERVER | SSL3_CC_READ)
-#define SSL3_CHANGE_CIPHER_CLIENT_READ (SSL3_CC_CLIENT | SSL3_CC_READ)
-#define SSL3_CHANGE_CIPHER_SERVER_WRITE (SSL3_CC_SERVER | SSL3_CC_WRITE)
-
 
 #ifdef  __cplusplus
-}  /* extern C */
+}  // extern C
 #endif
 
-#endif  /* OPENSSL_HEADER_SSL3_H */
+#endif  // OPENSSL_HEADER_SSL3_H

data/third_party/boringssl/include/openssl/stack.h

@@ -66,45 +66,45 @@ extern "C" {
 #endif
 
 
-/* A stack, in OpenSSL, is an array of pointers. They are the most commonly
- * used collection object.
- *
- * This file defines macros for type safe use of the stack functions. A stack
- * of a specific type of object has type |STACK_OF(type)|. This can be defined
- * (once) with |DEFINE_STACK_OF(type)| and declared where needed with
- * |DECLARE_STACK_OF(type)|. For example:
- *
- *   struct foo {
- *     int bar;
- *   };
- *
- *   DEFINE_STACK_OF(struct foo);
- *
- * Although note that the stack will contain /pointers/ to |foo|.
- *
- * A macro will be defined for each of the sk_* functions below. For
- * STACK_OF(foo), the macros would be sk_foo_new, sk_foo_pop etc. */
-
-
-/* stack_cmp_func is a comparison function that returns a value < 0, 0 or > 0
- * if |*a| is less than, equal to or greater than |*b|, respectively.  Note the
- * extra indirection - the function is given a pointer to a pointer to the
- * element. This differs from the usual qsort/bsearch comparison function. */
+// A stack, in OpenSSL, is an array of pointers. They are the most commonly
+// used collection object.
+//
+// This file defines macros for type safe use of the stack functions. A stack
+// of a specific type of object has type |STACK_OF(type)|. This can be defined
+// (once) with |DEFINE_STACK_OF(type)| and declared where needed with
+// |DECLARE_STACK_OF(type)|. For example:
+//
+//   typedef struct foo_st {
+//     int bar;
+//   } FOO;
+//
+//   DEFINE_STACK_OF(FOO);
+//
+// Although note that the stack will contain /pointers/ to |FOO|.
+//
+// A macro will be defined for each of the sk_* functions below. For
+// STACK_OF(FOO), the macros would be sk_FOO_new, sk_FOO_pop etc.
+
+
+// stack_cmp_func is a comparison function that returns a value < 0, 0 or > 0
+// if |*a| is less than, equal to or greater than |*b|, respectively.  Note the
+// extra indirection - the function is given a pointer to a pointer to the
+// element. This differs from the usual qsort/bsearch comparison function.
 typedef int (*stack_cmp_func)(const void **a, const void **b);
 
-/* stack_st contains an array of pointers. It is not designed to be used
- * directly, rather the wrapper macros should be used. */
+// stack_st contains an array of pointers. It is not designed to be used
+// directly, rather the wrapper macros should be used.
 typedef struct stack_st {
-  /* num contains the number of valid pointers in |data|. */
+  // num contains the number of valid pointers in |data|.
   size_t num;
   void **data;
-  /* sorted is non-zero if the values pointed to by |data| are in ascending
-   * order, based on |comp|. */
+  // sorted is non-zero if the values pointed to by |data| are in ascending
+  // order, based on |comp|.
   int sorted;
-  /* num_alloc contains the number of pointers allocated in the buffer pointed
-   * to by |data|, which may be larger than |num|. */
+  // num_alloc contains the number of pointers allocated in the buffer pointed
+  // to by |data|, which may be larger than |num|.
   size_t num_alloc;
-  /* comp is an optional comparison function. */
+  // comp is an optional comparison function.
   stack_cmp_func comp;
 } _STACK;
 
@@ -113,182 +113,373 @@ typedef struct stack_st {
 
 #define DECLARE_STACK_OF(type) STACK_OF(type);
 
-/* The make_macros.sh script in this directory parses the following lines and
- * generates the stack_macros.h file that contains macros for the following
- * types of stacks:
- *
- * STACK_OF:ACCESS_DESCRIPTION
- * STACK_OF:ASN1_ADB_TABLE
- * STACK_OF:ASN1_GENERALSTRING
- * STACK_OF:ASN1_INTEGER
- * STACK_OF:ASN1_OBJECT
- * STACK_OF:ASN1_STRING_TABLE
- * STACK_OF:ASN1_TYPE
- * STACK_OF:ASN1_VALUE
- * STACK_OF:BIO
- * STACK_OF:BY_DIR_ENTRY
- * STACK_OF:BY_DIR_HASH
- * STACK_OF:CONF_VALUE
- * STACK_OF:CRYPTO_BUFFER
- * STACK_OF:CRYPTO_EX_DATA_FUNCS
- * STACK_OF:DIST_POINT
- * STACK_OF:GENERAL_NAME
- * STACK_OF:GENERAL_NAMES
- * STACK_OF:GENERAL_SUBTREE
- * STACK_OF:POLICYINFO
- * STACK_OF:POLICYQUALINFO
- * STACK_OF:POLICY_MAPPING
- * STACK_OF:RSA_additional_prime
- * STACK_OF:SSL_COMP
- * STACK_OF:SSL_CUSTOM_EXTENSION
- * STACK_OF:STACK_OF_X509_NAME_ENTRY
- * STACK_OF:SXNETID
- * STACK_OF:X509
- * STACK_OF:X509V3_EXT_METHOD
- * STACK_OF:X509_ALGOR
- * STACK_OF:X509_ATTRIBUTE
- * STACK_OF:X509_CRL
- * STACK_OF:X509_EXTENSION
- * STACK_OF:X509_INFO
- * STACK_OF:X509_LOOKUP
- * STACK_OF:X509_NAME
- * STACK_OF:X509_NAME_ENTRY
- * STACK_OF:X509_OBJECT
- * STACK_OF:X509_POLICY_DATA
- * STACK_OF:X509_POLICY_NODE
- * STACK_OF:X509_PURPOSE
- * STACK_OF:X509_REVOKED
- * STACK_OF:X509_TRUST
- * STACK_OF:X509_VERIFY_PARAM
- * STACK_OF:void
- *
- * Some stacks contain only const structures, so the stack should return const
- * pointers to retain type-checking.
- *
- * CONST_STACK_OF:SRTP_PROTECTION_PROFILE
- * CONST_STACK_OF:SSL_CIPHER */
-
-
-/* Some stacks are special because, although we would like STACK_OF(char *),
- * that would actually be a stack of pointers to char*, but we just want to
- * point to the string directly. In this case we call them "special" and use
- * |DEFINE_SPECIAL_STACK_OF(type)| */
-#define DEFINE_SPECIAL_STACK_OF(type, inner)             \
-  STACK_OF(type) { _STACK special_stack; };              \
-  OPENSSL_COMPILE_ASSERT(sizeof(type) == sizeof(void *), \
-                         special_stack_of_non_pointer_##type);
-
-typedef char *OPENSSL_STRING;
-
-DEFINE_SPECIAL_STACK_OF(OPENSSL_STRING, char)
+// These are the raw stack functions, you shouldn't be using them. Rather you
+// should be using the type stack macros implemented above.
 
-/* The make_macros.sh script in this directory parses the following lines and
- * generates the stack_macros.h file that contains macros for the following
- * types of stacks:
- *
- * SPECIAL_STACK_OF:OPENSSL_STRING */
-
-#define IN_STACK_H
-#include <openssl/stack_macros.h>
-#undef IN_STACK_H
-
-
-/* These are the raw stack functions, you shouldn't be using them. Rather you
- * should be using the type stack macros implemented above. */
-
-/* sk_new creates a new, empty stack with the given comparison function, which
- * may be zero. It returns the new stack or NULL on allocation failure. */
+// sk_new creates a new, empty stack with the given comparison function, which
+// may be zero. It returns the new stack or NULL on allocation failure.
 OPENSSL_EXPORT _STACK *sk_new(stack_cmp_func comp);
 
-/* sk_new_null creates a new, empty stack. It returns the new stack or NULL on
- * allocation failure. */
+// sk_new_null creates a new, empty stack. It returns the new stack or NULL on
+// allocation failure.
 OPENSSL_EXPORT _STACK *sk_new_null(void);
 
-/* sk_num returns the number of elements in |s|. */
+// sk_num returns the number of elements in |s|.
 OPENSSL_EXPORT size_t sk_num(const _STACK *sk);
 
-/* sk_zero resets |sk| to the empty state but does nothing to free the
- * individual elements themselves. */
+// sk_zero resets |sk| to the empty state but does nothing to free the
+// individual elements themselves.
 OPENSSL_EXPORT void sk_zero(_STACK *sk);
 
-/* sk_value returns the |i|th pointer in |sk|, or NULL if |i| is out of
- * range. */
+// sk_value returns the |i|th pointer in |sk|, or NULL if |i| is out of
+// range.
 OPENSSL_EXPORT void *sk_value(const _STACK *sk, size_t i);
 
-/* sk_set sets the |i|th pointer in |sk| to |p| and returns |p|. If |i| is out
- * of range, it returns NULL. */
+// sk_set sets the |i|th pointer in |sk| to |p| and returns |p|. If |i| is out
+// of range, it returns NULL.
 OPENSSL_EXPORT void *sk_set(_STACK *sk, size_t i, void *p);
 
-/* sk_free frees the given stack and array of pointers, but does nothing to
- * free the individual elements. Also see |sk_pop_free|. */
+// sk_free frees the given stack and array of pointers, but does nothing to
+// free the individual elements. Also see |sk_pop_free|.
 OPENSSL_EXPORT void sk_free(_STACK *sk);
 
-/* sk_pop_free calls |free_func| on each element in the stack and then frees
- * the stack itself. */
+// sk_pop_free calls |free_func| on each element in the stack and then frees
+// the stack itself.
 OPENSSL_EXPORT void sk_pop_free(_STACK *sk, void (*free_func)(void *));
 
-/* sk_insert inserts |p| into the stack at index |where|, moving existing
- * elements if needed. It returns the length of the new stack, or zero on
- * error. */
+// sk_insert inserts |p| into the stack at index |where|, moving existing
+// elements if needed. It returns the length of the new stack, or zero on
+// error.
 OPENSSL_EXPORT size_t sk_insert(_STACK *sk, void *p, size_t where);
 
-/* sk_delete removes the pointer at index |where|, moving other elements down
- * if needed. It returns the removed pointer, or NULL if |where| is out of
- * range. */
+// sk_delete removes the pointer at index |where|, moving other elements down
+// if needed. It returns the removed pointer, or NULL if |where| is out of
+// range.
 OPENSSL_EXPORT void *sk_delete(_STACK *sk, size_t where);
 
-/* sk_delete_ptr removes, at most, one instance of |p| from the stack based on
- * pointer equality. If an instance of |p| is found then |p| is returned,
- * otherwise it returns NULL. */
+// sk_delete_ptr removes, at most, one instance of |p| from the stack based on
+// pointer equality. If an instance of |p| is found then |p| is returned,
+// otherwise it returns NULL.
 OPENSSL_EXPORT void *sk_delete_ptr(_STACK *sk, void *p);
 
-/* sk_find returns the first value in the stack equal to |p|. If a comparison
- * function has been set on the stack, then equality is defined by it and the
- * stack will be sorted if need be so that a binary search can be used.
- * Otherwise pointer equality is used. If a matching element is found, its
- * index is written to |*out_index| (if |out_index| is not NULL) and one is
- * returned. Otherwise zero is returned. */
+// sk_find returns the first value in the stack equal to |p|. If a comparison
+// function has been set on the stack, then equality is defined by it and the
+// stack will be sorted if need be so that a binary search can be used.
+// Otherwise pointer equality is used. If a matching element is found, its
+// index is written to |*out_index| (if |out_index| is not NULL) and one is
+// returned. Otherwise zero is returned.
 OPENSSL_EXPORT int sk_find(_STACK *sk, size_t *out_index, void *p);
 
-/* sk_shift removes and returns the first element in the stack, or returns NULL
- * if the stack is empty. */
+// sk_shift removes and returns the first element in the stack, or returns NULL
+// if the stack is empty.
 OPENSSL_EXPORT void *sk_shift(_STACK *sk);
 
-/* sk_push appends |p| to the stack and returns the length of the new stack, or
- * 0 on allocation failure. */
+// sk_push appends |p| to the stack and returns the length of the new stack, or
+// 0 on allocation failure.
 OPENSSL_EXPORT size_t sk_push(_STACK *sk, void *p);
 
-/* sk_pop returns and removes the last element on the stack, or NULL if the
- * stack is empty. */
+// sk_pop returns and removes the last element on the stack, or NULL if the
+// stack is empty.
 OPENSSL_EXPORT void *sk_pop(_STACK *sk);
 
-/* sk_dup performs a shallow copy of a stack and returns the new stack, or NULL
- * on error. */
+// sk_dup performs a shallow copy of a stack and returns the new stack, or NULL
+// on error.
 OPENSSL_EXPORT _STACK *sk_dup(const _STACK *sk);
 
-/* sk_sort sorts the elements of |sk| into ascending order based on the
- * comparison function. The stack maintains a |sorted| flag and sorting an
- * already sorted stack is a no-op. */
+// sk_sort sorts the elements of |sk| into ascending order based on the
+// comparison function. The stack maintains a |sorted| flag and sorting an
+// already sorted stack is a no-op.
 OPENSSL_EXPORT void sk_sort(_STACK *sk);
 
-/* sk_is_sorted returns one if |sk| is known to be sorted and zero
- * otherwise. */
+// sk_is_sorted returns one if |sk| is known to be sorted and zero
+// otherwise.
 OPENSSL_EXPORT int sk_is_sorted(const _STACK *sk);
 
-/* sk_set_cmp_func sets the comparison function to be used by |sk| and returns
- * the previous one. */
+// sk_set_cmp_func sets the comparison function to be used by |sk| and returns
+// the previous one.
 OPENSSL_EXPORT stack_cmp_func sk_set_cmp_func(_STACK *sk, stack_cmp_func comp);
 
-/* sk_deep_copy performs a copy of |sk| and of each of the non-NULL elements in
- * |sk| by using |copy_func|. If an error occurs, |free_func| is used to free
- * any copies already made and NULL is returned. */
+// sk_deep_copy performs a copy of |sk| and of each of the non-NULL elements in
+// |sk| by using |copy_func|. If an error occurs, |free_func| is used to free
+// any copies already made and NULL is returned.
 OPENSSL_EXPORT _STACK *sk_deep_copy(const _STACK *sk,
                                     void *(*copy_func)(void *),
                                     void (*free_func)(void *));
 
 
+// Defining stack types.
+//
+// This set of macros is used to emit the typed functions that act on a
+// |STACK_OF(T)|.
+
+#if !defined(BORINGSSL_NO_CXX)
+extern "C++" {
+namespace bssl {
+namespace internal {
+template <typename T>
+struct StackTraits {};
+}
+}
+}
+
+#define BORINGSSL_DEFINE_STACK_TRAITS(name, type, is_const) \
+  extern "C++" {                                            \
+  namespace bssl {                                          \
+  namespace internal {                                      \
+  template <>                                               \
+  struct StackTraits<STACK_OF(name)> {                      \
+    static constexpr bool kIsStack = true;                  \
+    using Type = type;                                      \
+    static constexpr bool kIsConst = is_const;              \
+  };                                                        \
+  }                                                         \
+  }                                                         \
+  }
+
+#else
+#define BORINGSSL_DEFINE_STACK_TRAITS(name, type, is_const)
+#endif
+
+// Stack functions must be tagged unused to support file-local stack types.
+// Clang's -Wunused-function only allows unused static inline functions if they
+// are defined in a header.
+
+#define BORINGSSL_DEFINE_STACK_OF_IMPL(name, ptrtype, constptrtype)            \
+  DECLARE_STACK_OF(name);                                                      \
+                                                                               \
+  typedef int (*stack_##name##_cmp_func)(constptrtype *a, constptrtype *b);    \
+                                                                               \
+  static inline OPENSSL_UNUSED STACK_OF(name) *                                \
+      sk_##name##_new(stack_##name##_cmp_func comp) {                          \
+    return (STACK_OF(name) *)sk_new((stack_cmp_func)comp);                     \
+  }                                                                            \
+                                                                               \
+  static inline OPENSSL_UNUSED STACK_OF(name) *sk_##name##_new_null(void) {    \
+    return (STACK_OF(name) *)sk_new_null();                                    \
+  }                                                                            \
+                                                                               \
+  static inline OPENSSL_UNUSED size_t sk_##name##_num(                         \
+      const STACK_OF(name) *sk) {                                              \
+    return sk_num((const _STACK *)sk);                                         \
+  }                                                                            \
+                                                                               \
+  static inline OPENSSL_UNUSED void sk_##name##_zero(STACK_OF(name) *sk) {     \
+    sk_zero((_STACK *)sk);                                                     \
+  }                                                                            \
+                                                                               \
+  static inline OPENSSL_UNUSED ptrtype sk_##name##_value(                      \
+      const STACK_OF(name) *sk, size_t i) {                                    \
+    return (ptrtype)sk_value((const _STACK *)sk, i);                           \
+  }                                                                            \
+                                                                               \
+  static inline OPENSSL_UNUSED ptrtype sk_##name##_set(STACK_OF(name) *sk,     \
+                                                       size_t i, ptrtype p) {  \
+    return (ptrtype)sk_set((_STACK *)sk, i, (void *)p);                        \
+  }                                                                            \
+                                                                               \
+  static inline OPENSSL_UNUSED void sk_##name##_free(STACK_OF(name) *sk) {     \
+    sk_free((_STACK *)sk);                                                     \
+  }                                                                            \
+                                                                               \
+  static inline OPENSSL_UNUSED void sk_##name##_pop_free(                      \
+      STACK_OF(name) *sk, void (*free_func)(ptrtype p)) {                      \
+    sk_pop_free((_STACK *)sk, (void (*)(void *))free_func);                    \
+  }                                                                            \
+                                                                               \
+  static inline OPENSSL_UNUSED size_t sk_##name##_insert(                      \
+      STACK_OF(name) *sk, ptrtype p, size_t where) {                           \
+    return sk_insert((_STACK *)sk, (void *)p, where);                          \
+  }                                                                            \
+                                                                               \
+  static inline OPENSSL_UNUSED ptrtype sk_##name##_delete(STACK_OF(name) *sk,  \
+                                                          size_t where) {      \
+    return (ptrtype)sk_delete((_STACK *)sk, where);                            \
+  }                                                                            \
+                                                                               \
+  static inline OPENSSL_UNUSED ptrtype sk_##name##_delete_ptr(                 \
+      STACK_OF(name) *sk, ptrtype p) {                                         \
+    return (ptrtype)sk_delete_ptr((_STACK *)sk, (void *)p);                    \
+  }                                                                            \
+                                                                               \
+  static inline OPENSSL_UNUSED int sk_##name##_find(                           \
+      STACK_OF(name) *sk, size_t *out_index, ptrtype p) {                      \
+    return sk_find((_STACK *)sk, out_index, (void *)p);                        \
+  }                                                                            \
+                                                                               \
+  static inline OPENSSL_UNUSED ptrtype sk_##name##_shift(STACK_OF(name) *sk) { \
+    return (ptrtype)sk_shift((_STACK *)sk);                                    \
+  }                                                                            \
+                                                                               \
+  static inline OPENSSL_UNUSED size_t sk_##name##_push(STACK_OF(name) *sk,     \
+                                                       ptrtype p) {            \
+    return sk_push((_STACK *)sk, (void *)p);                                   \
+  }                                                                            \
+                                                                               \
+  static inline OPENSSL_UNUSED ptrtype sk_##name##_pop(STACK_OF(name) *sk) {   \
+    return (ptrtype)sk_pop((_STACK *)sk);                                      \
+  }                                                                            \
+                                                                               \
+  static inline OPENSSL_UNUSED STACK_OF(name) *                                \
+      sk_##name##_dup(const STACK_OF(name) *sk) {                              \
+    return (STACK_OF(name) *)sk_dup((const _STACK *)sk);                       \
+  }                                                                            \
+                                                                               \
+  static inline OPENSSL_UNUSED void sk_##name##_sort(STACK_OF(name) *sk) {     \
+    sk_sort((_STACK *)sk);                                                     \
+  }                                                                            \
+                                                                               \
+  static inline OPENSSL_UNUSED int sk_##name##_is_sorted(                      \
+      const STACK_OF(name) *sk) {                                              \
+    return sk_is_sorted((const _STACK *)sk);                                   \
+  }                                                                            \
+                                                                               \
+  static inline OPENSSL_UNUSED stack_##name##_cmp_func                         \
+      sk_##name##_set_cmp_func(STACK_OF(name) *sk,                             \
+                               stack_##name##_cmp_func comp) {                 \
+    return (stack_##name##_cmp_func)sk_set_cmp_func((_STACK *)sk,              \
+                                                    (stack_cmp_func)comp);     \
+  }                                                                            \
+                                                                               \
+  static inline OPENSSL_UNUSED STACK_OF(name) *                                \
+      sk_##name##_deep_copy(const STACK_OF(name) *sk,                          \
+                            ptrtype(*copy_func)(ptrtype),                      \
+                            void (*free_func)(ptrtype)) {                      \
+    return (STACK_OF(name) *)sk_deep_copy((_STACK *)sk,                        \
+                                          (void *(*)(void *))copy_func,        \
+                                          (void (*)(void *))free_func);        \
+  }
+
+// DEFINE_STACK_OF defines |STACK_OF(type)| to be a stack whose elements are
+// |type| *.
+#define DEFINE_STACK_OF(type)                                \
+  BORINGSSL_DEFINE_STACK_OF_IMPL(type, type *, const type *) \
+  BORINGSSL_DEFINE_STACK_TRAITS(type, type, false)
+
+// DEFINE_CONST_STACK_OF defines |STACK_OF(type)| to be a stack whose elements
+// are const |type| *.
+#define DEFINE_CONST_STACK_OF(type)                                \
+  BORINGSSL_DEFINE_STACK_OF_IMPL(type, const type *, const type *) \
+  BORINGSSL_DEFINE_STACK_TRAITS(type, const type, true)
+
+// DEFINE_SPECIAL_STACK_OF defines |STACK_OF(type)| to be a stack whose elements
+// are |type|, where |type| must be a typedef for a pointer.
+#define DEFINE_SPECIAL_STACK_OF(type)                          \
+  OPENSSL_COMPILE_ASSERT(sizeof(type) == sizeof(void *),       \
+                         special_stack_of_non_pointer_##type); \
+  BORINGSSL_DEFINE_STACK_OF_IMPL(type, type, const type)
+
+
+typedef char *OPENSSL_STRING;
+
+DEFINE_STACK_OF(void)
+DEFINE_SPECIAL_STACK_OF(OPENSSL_STRING)
+
+
 #if defined(__cplusplus)
-}  /* extern C */
+}  // extern C
+#endif
+
+#if !defined(BORINGSSL_NO_CXX)
+extern "C++" {
+
+#include <type_traits>
+
+namespace bssl {
+
+namespace internal {
+
+// Stacks defined with |DEFINE_CONST_STACK_OF| are freed with |sk_free|.
+template <typename Stack>
+struct DeleterImpl<
+    Stack, typename std::enable_if<StackTraits<Stack>::kIsConst>::type> {
+  static void Free(Stack *sk) { sk_free(reinterpret_cast<_STACK *>(sk)); }
+};
+
+// Stacks defined with |DEFINE_STACK_OF| are freed with |sk_pop_free| and the
+// corresponding type's deleter.
+template <typename Stack>
+struct DeleterImpl<
+    Stack, typename std::enable_if<!StackTraits<Stack>::kIsConst>::type> {
+  static void Free(Stack *sk) {
+    sk_pop_free(
+        reinterpret_cast<_STACK *>(sk),
+        reinterpret_cast<void (*)(void *)>(
+            DeleterImpl<typename StackTraits<Stack>::Type>::Free));
+  }
+};
+
+template <typename Stack>
+class StackIteratorImpl {
+ public:
+  using Type = typename StackTraits<Stack>::Type;
+  // Iterators must be default-constructable.
+  StackIteratorImpl() : sk_(nullptr), idx_(0) {}
+  StackIteratorImpl(const Stack *sk, size_t idx) : sk_(sk), idx_(idx) {}
+
+  bool operator==(StackIteratorImpl other) const {
+    return sk_ == other.sk_ && idx_ == other.idx_;
+  }
+  bool operator!=(StackIteratorImpl other) const {
+    return !(*this == other);
+  }
+
+  Type *operator*() const {
+    return reinterpret_cast<Type *>(
+        sk_value(reinterpret_cast<const _STACK *>(sk_), idx_));
+  }
+
+  StackIteratorImpl &operator++(/* prefix */) {
+    idx_++;
+    return *this;
+  }
+
+  StackIteratorImpl operator++(int /* postfix */) {
+    StackIteratorImpl copy(*this);
+    ++(*this);
+    return copy;
+  }
+
+ private:
+  const Stack *sk_;
+  size_t idx_;
+};
+
+template <typename Stack>
+using StackIterator = typename std::enable_if<StackTraits<Stack>::kIsStack,
+                                              StackIteratorImpl<Stack>>::type;
+
+}  // namespace internal
+
+// PushToStack pushes |elem| to |sk|. It returns true on success and false on
+// allocation failure.
+template <typename Stack>
+static inline
+    typename std::enable_if<!internal::StackTraits<Stack>::kIsConst, bool>::type
+    PushToStack(Stack *sk,
+                UniquePtr<typename internal::StackTraits<Stack>::Type> elem) {
+  if (!sk_push(reinterpret_cast<_STACK *>(sk), elem.get())) {
+    return false;
+  }
+  // sk_push takes ownership on success.
+  elem.release();
+  return true;
+}
+
+}  // namespace bssl
+
+// Define begin() and end() for stack types so C++ range for loops work.
+template <typename Stack>
+static inline bssl::internal::StackIterator<Stack> begin(const Stack *sk) {
+  return bssl::internal::StackIterator<Stack>(sk, 0);
+}
+
+template <typename Stack>
+static inline bssl::internal::StackIterator<Stack> end(const Stack *sk) {
+  return bssl::internal::StackIterator<Stack>(
+      sk, sk_num(reinterpret_cast<const _STACK *>(sk)));
+}
+
+}  // extern C++
 #endif
 
-#endif  /* OPENSSL_HEADER_STACK_H */
+#endif  // OPENSSL_HEADER_STACK_H