visaljs 0.0.2 → 0.0.3

package/runtime/third_party/boringssl/crypto/bytestring/internal.h

@@ -0,0 +1,134 @@
+// Copyright 2014 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef OPENSSL_HEADER_CRYPTO_BYTESTRING_INTERNAL_H
+#define OPENSSL_HEADER_CRYPTO_BYTESTRING_INTERNAL_H
+
+#include <openssl/asn1.h>
+#include <openssl/bytestring.h>
+#include <openssl/err.h>
+
+#include <type_traits>
+
+#include "../mem_internal.h"
+
+
+BSSL_NAMESPACE_BEGIN
+
+// CBS_asn1_ber_to_der reads a BER element from `in`. If it finds
+// indefinite-length elements or constructed strings then it converts the BER
+// data to DER, sets `out` to the converted contents and `*out_storage` to a
+// buffer which the caller must release with `OPENSSL_free`. Otherwise, it sets
+// `out` to the original BER element in `in` and `*out_storage` to NULL.
+// Additionally, `*in` will be advanced over the BER element.
+//
+// This function should successfully process any valid BER input, however it
+// will not convert all of BER's deviations from DER. BER is ambiguous between
+// implicitly-tagged SEQUENCEs of strings and implicitly-tagged constructed
+// strings. Implicitly-tagged strings must be parsed with
+// `CBS_get_ber_implicitly_tagged_string` instead of `CBS_get_asn1`. The caller
+// must also account for BER variations in the contents of a primitive.
+//
+// It returns one on success and zero otherwise.
+OPENSSL_EXPORT int CBS_asn1_ber_to_der(CBS *in, CBS *out,
+                                       uint8_t **out_storage);
+
+// CBS_get_asn1_implicit_string parses a BER string of primitive type
+// `inner_tag` implicitly-tagged with `outer_tag`. It sets `out` to the
+// contents. If concatenation was needed, it sets `*out_storage` to a buffer
+// which the caller must release with `OPENSSL_free`. Otherwise, it sets
+// `*out_storage` to NULL.
+//
+// This function does not parse all of BER. It requires the string be
+// definite-length. Constructed strings are allowed, but all children of the
+// outermost element must be primitive. The caller should use
+// `CBS_asn1_ber_to_der` before running this function.
+//
+// It returns one on success and zero otherwise.
+OPENSSL_EXPORT int CBS_get_asn1_implicit_string(CBS *in, CBS *out,
+                                                uint8_t **out_storage,
+                                                CBS_ASN1_TAG outer_tag,
+                                                CBS_ASN1_TAG inner_tag);
+
+// CBB_finish_i2d calls `CBB_finish` on `cbb` which must have been initialized
+// with `CBB_init`. If `outp` is not NULL then the result is written to `*outp`
+// and `*outp` is advanced just past the output. It returns the number of bytes
+// in the result, whether written or not, or a negative value on error.
+//
+// This function may be used to help implement legacy i2d ASN.1 functions.
+OPENSSL_EXPORT int CBB_finish_i2d(CBB *cbb, uint8_t **outp);
+
+// CBBAsSpan returns a span containing `cbb`'s contents. It does not flush
+// `cbb`. The span is valid until the next operation to `cbb`.
+//
+// To avoid unfinalized length prefixes, it is a fatal error to call this on a
+// CBB with any active children.
+inline Span<uint8_t> CBBAsSpan(const CBB *cbb) {
+  return Span(CBB_data(cbb), CBB_len(cbb));
+}
+
+// CBBFinishArray behaves like `CBB_finish` but stores the result in an Array.
+OPENSSL_EXPORT bool CBBFinishArray(CBB *cbb, Array<uint8_t> *out);
+
+// D2IFromCBS takes a functor of type `Unique<T>(CBS*)` and implements the d2i
+// calling convention. For compatibility with functions that don't tag their
+// return value (e.g. public APIs), `T*(CBS)` is also accepted. The callback can
+// assume that the `CBS`'s length fits in `long`. The callback should not access
+// `out`, `inp`, or `len` directly.
+template <typename T, typename CBSFunc>
+inline T *D2IFromCBS(T **out, const uint8_t **inp, long len, CBSFunc func) {
+  static_assert(std::is_invocable_v<CBSFunc, CBS *>);
+  static_assert(
+      std::is_same_v<std::invoke_result_t<CBSFunc, CBS *>, UniquePtr<T>> ||
+      std::is_same_v<std::invoke_result_t<CBSFunc, CBS *>, T *>);
+  if (len < 0) {
+    OPENSSL_PUT_ERROR(ASN1, ASN1_R_BUFFER_TOO_SMALL);
+    return nullptr;
+  }
+  CBS cbs;
+  CBS_init(&cbs, *inp, len);
+  UniquePtr<T> ret(func(&cbs));
+  if (ret == nullptr) {
+    return nullptr;
+  }
+  if (out != nullptr) {
+    UniquePtr<T> free_out(*out);
+    *out = ret.get();
+  }
+  *inp = CBS_data(&cbs);
+  return ret.release();
+}
+
+// I2DFromCBB takes a functor of type `bool(CBB*)` and implements the i2d
+// calling convention. It internally makes a `CBB` with the specified initial
+// capacity. The callback should not access `outp` directly.
+template <typename CBBFunc>
+inline int I2DFromCBB(size_t initial_capacity, uint8_t **outp, CBBFunc func) {
+  static_assert(std::is_invocable_v<CBBFunc, CBB *>);
+  static_assert(std::is_same_v<std::invoke_result_t<CBBFunc, CBB *>, bool>);
+  ScopedCBB cbb;
+  if (!CBB_init(cbb.get(), initial_capacity) || !func(cbb.get())) {
+    return -1;
+  }
+  return CBB_finish_i2d(cbb.get(), outp);
+}
+
+// cbb_add_decimal_ascii adds the characters of an ASCII string representation
+// of `v` as a decimal value to `out` (without a terminating NUL byte). It
+// returns one on success and zero on error.
+int cbb_add_decimal_ascii(CBB *out, uint64_t v);
+
+BSSL_NAMESPACE_END
+
+#endif  // OPENSSL_HEADER_CRYPTO_BYTESTRING_INTERNAL_H

package/runtime/third_party/boringssl/crypto/bytestring/unicode.cc

@@ -0,0 +1,156 @@
+// Copyright 2018 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <openssl/bytestring.h>
+
+#include "internal.h"
+
+
+static int is_valid_code_point(uint32_t v) {
+  // References in the following are to Unicode 15.0.0.
+  if (// The Unicode space runs from zero to 0x10ffff (3.4 D9).
+      v > 0x10ffff ||
+      // Values 0x...fffe, 0x...ffff, and 0xfdd0-0xfdef are permanently reserved
+      // as noncharacters (3.4 D14). See also 23.7. As our APIs are intended for
+      // "open interchange", such as ASN.1, we reject them.
+      (v & 0xfffe) == 0xfffe ||
+      (v >= 0xfdd0 && v <= 0xfdef) ||
+      // Surrogate code points are invalid (3.2 C1).
+      (v >= 0xd800 && v <= 0xdfff)) {
+    return 0;
+  }
+  return 1;
+}
+
+// BOTTOM_BITS returns a byte with the bottom `n` bits set.
+#define BOTTOM_BITS(n) (uint8_t)((1u << (n)) - 1)
+
+// TOP_BITS returns a byte with the top `n` bits set.
+#define TOP_BITS(n) ((uint8_t)~BOTTOM_BITS(8 - (n)))
+
+int CBS_get_utf8(CBS *cbs, uint32_t *out) {
+  uint8_t c;
+  if (!CBS_get_u8(cbs, &c)) {
+    return 0;
+  }
+  if (c <= 0x7f) {
+    *out = c;
+    return 1;
+  }
+  uint32_t v, lower_bound;
+  size_t len;
+  if ((c & TOP_BITS(3)) == TOP_BITS(2)) {
+    v = c & BOTTOM_BITS(5);
+    len = 1;
+    lower_bound = 0x80;
+  } else if ((c & TOP_BITS(4)) == TOP_BITS(3)) {
+    v = c & BOTTOM_BITS(4);
+    len = 2;
+    lower_bound = 0x800;
+  } else if ((c & TOP_BITS(5)) == TOP_BITS(4)) {
+    v = c & BOTTOM_BITS(3);
+    len = 3;
+    lower_bound = 0x10000;
+  } else {
+    return 0;
+  }
+  for (size_t i = 0; i < len; i++) {
+    if (!CBS_get_u8(cbs, &c) ||
+        (c & TOP_BITS(2)) != TOP_BITS(1)) {
+      return 0;
+    }
+    v <<= 6;
+    v |= c & BOTTOM_BITS(6);
+  }
+  if (!is_valid_code_point(v) ||
+      v < lower_bound) {
+    return 0;
+  }
+  *out = v;
+  return 1;
+}
+
+int CBS_get_latin1(CBS *cbs, uint32_t *out) {
+  uint8_t c;
+  if (!CBS_get_u8(cbs, &c)) {
+    return 0;
+  }
+  *out = c;
+  return 1;
+}
+
+int CBS_get_ucs2_be(CBS *cbs, uint32_t *out) {
+  // Note UCS-2 (used by BMPString) does not support surrogates.
+  uint16_t c;
+  if (!CBS_get_u16(cbs, &c) ||
+      !is_valid_code_point(c)) {
+    return 0;
+  }
+  *out = c;
+  return 1;
+}
+
+int CBS_get_utf32_be(CBS *cbs, uint32_t *out) {
+  return CBS_get_u32(cbs, out) && is_valid_code_point(*out);
+}
+
+size_t CBB_get_utf8_len(uint32_t u) {
+  if (u <= 0x7f) {
+    return 1;
+  }
+  if (u <= 0x7ff) {
+    return 2;
+  }
+  if (u <= 0xffff) {
+    return 3;
+  }
+  return 4;
+}
+
+int CBB_add_utf8(CBB *cbb, uint32_t u) {
+  if (!is_valid_code_point(u)) {
+    return 0;
+  }
+  if (u <= 0x7f) {
+    return CBB_add_u8(cbb, (uint8_t)u);
+  }
+  if (u <= 0x7ff) {
+    return CBB_add_u8(cbb, TOP_BITS(2) | (u >> 6)) &&
+           CBB_add_u8(cbb, TOP_BITS(1) | (u & BOTTOM_BITS(6)));
+  }
+  if (u <= 0xffff) {
+    return CBB_add_u8(cbb, TOP_BITS(3) | (u >> 12)) &&
+           CBB_add_u8(cbb, TOP_BITS(1) | ((u >> 6) & BOTTOM_BITS(6))) &&
+           CBB_add_u8(cbb, TOP_BITS(1) | (u & BOTTOM_BITS(6)));
+  }
+  if (u <= 0x10ffff) {
+    return CBB_add_u8(cbb, TOP_BITS(4) | (u >> 18)) &&
+           CBB_add_u8(cbb, TOP_BITS(1) | ((u >> 12) & BOTTOM_BITS(6))) &&
+           CBB_add_u8(cbb, TOP_BITS(1) | ((u >> 6) & BOTTOM_BITS(6))) &&
+           CBB_add_u8(cbb, TOP_BITS(1) | (u & BOTTOM_BITS(6)));
+  }
+  return 0;
+}
+
+int CBB_add_latin1(CBB *cbb, uint32_t u) {
+  return u <= 0xff && CBB_add_u8(cbb, (uint8_t)u);
+}
+
+int CBB_add_ucs2_be(CBB *cbb, uint32_t u) {
+  return u <= 0xffff && is_valid_code_point(u) && CBB_add_u16(cbb, (uint16_t)u);
+}
+
+int CBB_add_utf32_be(CBB *cbb, uint32_t u) {
+  return is_valid_code_point(u) && CBB_add_u32(cbb, u);
+}

package/runtime/third_party/boringssl/crypto/chacha/chacha.cc

@@ -0,0 +1,226 @@
+// Copyright 2014 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Adapted from the public domain, estream code by D. Bernstein.
+
+#include <openssl/chacha.h>
+
+#include <assert.h>
+#include <string.h>
+
+#include "../internal.h"
+#include "internal.h"
+
+
+// sigma contains the ChaCha constants, which happen to be an ASCII string.
+using namespace bssl;
+
+static const uint8_t sigma[16] = { 'e', 'x', 'p', 'a', 'n', 'd', ' ', '3',
+                                   '2', '-', 'b', 'y', 't', 'e', ' ', 'k' };
+
+// QUARTERROUND updates a, b, c, d with a ChaCha "quarter" round.
+#define QUARTERROUND(a, b, c, d)           \
+  x[a] += x[b];                            \
+  x[d] = CRYPTO_rotl_u32(x[d] ^ x[a], 16); \
+  x[c] += x[d];                            \
+  x[b] = CRYPTO_rotl_u32(x[b] ^ x[c], 12); \
+  x[a] += x[b];                            \
+  x[d] = CRYPTO_rotl_u32(x[d] ^ x[a], 8);  \
+  x[c] += x[d];                            \
+  x[b] = CRYPTO_rotl_u32(x[b] ^ x[c], 7);
+
+void bssl::CRYPTO_hchacha20(uint8_t out[32], const uint8_t key[32],
+                            const uint8_t nonce[16]) {
+  uint32_t x[16];
+  OPENSSL_memcpy(x, sigma, sizeof(sigma));
+  OPENSSL_memcpy(&x[4], key, 32);
+  OPENSSL_memcpy(&x[12], nonce, 16);
+
+  for (size_t i = 0; i < 20; i += 2) {
+    QUARTERROUND(0, 4, 8, 12)
+    QUARTERROUND(1, 5, 9, 13)
+    QUARTERROUND(2, 6, 10, 14)
+    QUARTERROUND(3, 7, 11, 15)
+    QUARTERROUND(0, 5, 10, 15)
+    QUARTERROUND(1, 6, 11, 12)
+    QUARTERROUND(2, 7, 8, 13)
+    QUARTERROUND(3, 4, 9, 14)
+  }
+
+  OPENSSL_memcpy(out, &x[0], sizeof(uint32_t) * 4);
+  OPENSSL_memcpy(&out[16], &x[12], sizeof(uint32_t) * 4);
+}
+
+#if defined(CHACHA20_ASM_NOHW)
+static void ChaCha20_ctr32(uint8_t *out, const uint8_t *in, size_t in_len,
+                           const uint32_t key[8], const uint32_t counter[4]) {
+#if defined(CHACHA20_ASM_NEON)
+  if (ChaCha20_ctr32_neon_capable(in_len)) {
+    ChaCha20_ctr32_neon(out, in, in_len, key, counter);
+    return;
+  }
+#endif
+#if defined(CHACHA20_ASM_AVX2)
+  if (ChaCha20_ctr32_avx2_capable(in_len)) {
+    ChaCha20_ctr32_avx2(out, in, in_len, key, counter);
+    return;
+  }
+#endif
+#if defined(CHACHA20_ASM_SSSE3_4X)
+  if (ChaCha20_ctr32_ssse3_4x_capable(in_len)) {
+    ChaCha20_ctr32_ssse3_4x(out, in, in_len, key, counter);
+    return;
+  }
+#endif
+#if defined(CHACHA20_ASM_SSSE3)
+  if (ChaCha20_ctr32_ssse3_capable(in_len)) {
+    ChaCha20_ctr32_ssse3(out, in, in_len, key, counter);
+    return;
+  }
+#endif
+  if (in_len > 0) {
+    ChaCha20_ctr32_nohw(out, in, in_len, key, counter);
+  }
+}
+#endif
+
+#if defined(CHACHA20_ASM_NOHW)
+
+void CRYPTO_chacha_20(uint8_t *out, const uint8_t *in, size_t in_len,
+                      const uint8_t key[32], const uint8_t nonce[12],
+                      uint32_t counter) {
+  assert(!buffers_alias(out, in_len, in, in_len) || in == out);
+
+  uint32_t counter_nonce[4];
+  counter_nonce[0] = counter;
+  counter_nonce[1] = CRYPTO_load_u32_le(nonce + 0);
+  counter_nonce[2] = CRYPTO_load_u32_le(nonce + 4);
+  counter_nonce[3] = CRYPTO_load_u32_le(nonce + 8);
+
+  const uint32_t *key_ptr = (const uint32_t *)key;
+#if !defined(OPENSSL_X86) && !defined(OPENSSL_X86_64)
+  // The assembly expects the key to be four-byte aligned.
+  uint32_t key_u32[8];
+  if ((((uintptr_t)key) & 3) != 0) {
+    key_u32[0] = CRYPTO_load_u32_le(key + 0);
+    key_u32[1] = CRYPTO_load_u32_le(key + 4);
+    key_u32[2] = CRYPTO_load_u32_le(key + 8);
+    key_u32[3] = CRYPTO_load_u32_le(key + 12);
+    key_u32[4] = CRYPTO_load_u32_le(key + 16);
+    key_u32[5] = CRYPTO_load_u32_le(key + 20);
+    key_u32[6] = CRYPTO_load_u32_le(key + 24);
+    key_u32[7] = CRYPTO_load_u32_le(key + 28);
+
+    key_ptr = key_u32;
+  }
+#endif
+
+  while (in_len > 0) {
+    // The assembly functions do not have defined overflow behavior. While
+    // overflow is almost always a bug in the caller, we prefer our functions to
+    // behave the same across platforms, so divide into multiple calls to avoid
+    // this case.
+    uint64_t todo = 64 * ((UINT64_C(1) << 32) - counter_nonce[0]);
+    if (todo > in_len) {
+      todo = in_len;
+    }
+
+    ChaCha20_ctr32(out, in, (size_t)todo, key_ptr, counter_nonce);
+    in += todo;
+    out += todo;
+    in_len -= todo;
+
+    // We're either done and will next break out of the loop, or we stopped at
+    // the wraparound point and the counter should continue at zero.
+    counter_nonce[0] = 0;
+  }
+}
+
+#else
+
+// chacha_core performs 20 rounds of ChaCha on the input words in
+// `input` and writes the 64 output bytes to `output`.
+static void chacha_core(uint8_t output[64], const uint32_t input[16]) {
+  uint32_t x[16];
+  int i;
+
+  OPENSSL_memcpy(x, input, sizeof(uint32_t) * 16);
+  for (i = 20; i > 0; i -= 2) {
+    QUARTERROUND(0, 4, 8, 12)
+    QUARTERROUND(1, 5, 9, 13)
+    QUARTERROUND(2, 6, 10, 14)
+    QUARTERROUND(3, 7, 11, 15)
+    QUARTERROUND(0, 5, 10, 15)
+    QUARTERROUND(1, 6, 11, 12)
+    QUARTERROUND(2, 7, 8, 13)
+    QUARTERROUND(3, 4, 9, 14)
+  }
+
+  for (i = 0; i < 16; ++i) {
+    x[i] += input[i];
+  }
+  for (i = 0; i < 16; ++i) {
+    CRYPTO_store_u32_le(output + 4 * i, x[i]);
+  }
+}
+
+void CRYPTO_chacha_20(uint8_t *out, const uint8_t *in, size_t in_len,
+                      const uint8_t key[32], const uint8_t nonce[12],
+                      uint32_t counter) {
+  assert(!buffers_alias(out, in_len, in, in_len) || in == out);
+
+  uint32_t input[16];
+  uint8_t buf[64];
+  size_t todo, i;
+
+  input[0] = CRYPTO_load_u32_le(sigma + 0);
+  input[1] = CRYPTO_load_u32_le(sigma + 4);
+  input[2] = CRYPTO_load_u32_le(sigma + 8);
+  input[3] = CRYPTO_load_u32_le(sigma + 12);
+
+  input[4] = CRYPTO_load_u32_le(key + 0);
+  input[5] = CRYPTO_load_u32_le(key + 4);
+  input[6] = CRYPTO_load_u32_le(key + 8);
+  input[7] = CRYPTO_load_u32_le(key + 12);
+
+  input[8] = CRYPTO_load_u32_le(key + 16);
+  input[9] = CRYPTO_load_u32_le(key + 20);
+  input[10] = CRYPTO_load_u32_le(key + 24);
+  input[11] = CRYPTO_load_u32_le(key + 28);
+
+  input[12] = counter;
+  input[13] = CRYPTO_load_u32_le(nonce + 0);
+  input[14] = CRYPTO_load_u32_le(nonce + 4);
+  input[15] = CRYPTO_load_u32_le(nonce + 8);
+
+  while (in_len > 0) {
+    todo = sizeof(buf);
+    if (in_len < todo) {
+      todo = in_len;
+    }
+
+    chacha_core(buf, input);
+    for (i = 0; i < todo; i++) {
+      out[i] = in[i] ^ buf[i];
+    }
+
+    out += todo;
+    in += todo;
+    in_len -= todo;
+
+    input[12]++;
+  }
+}
+
+#endif

package/runtime/third_party/boringssl/crypto/chacha/internal.h

@@ -0,0 +1,103 @@
+// Copyright 2018 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef OPENSSL_HEADER_CRYPTO_CHACHA_INTERNAL_H
+#define OPENSSL_HEADER_CRYPTO_CHACHA_INTERNAL_H
+
+#include <openssl/base.h>
+
+#include "../internal.h"
+
+
+BSSL_NAMESPACE_BEGIN
+
+// CRYPTO_hchacha20 computes the HChaCha20 function, which should only be used
+// as part of XChaCha20.
+void CRYPTO_hchacha20(uint8_t out[32], const uint8_t key[32],
+                      const uint8_t nonce[16]);
+
+#if !defined(OPENSSL_NO_ASM) && defined(OPENSSL_X86)
+
+#define CHACHA20_ASM_NOHW
+
+#define CHACHA20_ASM_SSSE3
+inline int ChaCha20_ctr32_ssse3_capable(size_t len) {
+  // Unlike the x86_64 version, the x86 SSSE3 routine runs for all non-zero
+  // lengths.
+  return len > 0 && CRYPTO_is_SSSE3_capable();
+}
+extern "C" void ChaCha20_ctr32_ssse3(uint8_t *out, const uint8_t *in,
+                                     size_t in_len, const uint32_t key[8],
+                                     const uint32_t counter[4]);
+
+#elif !defined(OPENSSL_NO_ASM) && \
+    (defined(OPENSSL_ARM) || defined(OPENSSL_AARCH64))
+
+#define CHACHA20_ASM_NOHW
+
+#define CHACHA20_ASM_NEON
+inline int ChaCha20_ctr32_neon_capable(size_t len) {
+  return len >= 192 && CRYPTO_is_NEON_capable();
+}
+extern "C" void ChaCha20_ctr32_neon(uint8_t *out, const uint8_t *in,
+                                    size_t in_len, const uint32_t key[8],
+                                    const uint32_t counter[4]);
+#elif !defined(OPENSSL_NO_ASM) && defined(OPENSSL_X86_64)
+#define CHACHA20_ASM_NOHW
+
+#define CHACHA20_ASM_AVX2
+inline int ChaCha20_ctr32_avx2_capable(size_t len) {
+  return len > 128 && CRYPTO_is_AVX2_capable();
+}
+extern "C" void ChaCha20_ctr32_avx2(uint8_t *out, const uint8_t *in,
+                                    size_t in_len, const uint32_t key[8],
+                                    const uint32_t counter[4]);
+
+#define CHACHA20_ASM_SSSE3_4X
+inline int ChaCha20_ctr32_ssse3_4x_capable(size_t len) {
+  int capable = len > 128 && CRYPTO_is_SSSE3_capable();
+  int faster = len > 192 || !CRYPTO_cpu_perf_is_like_silvermont();
+  return capable && faster;
+}
+extern "C" void ChaCha20_ctr32_ssse3_4x(uint8_t *out, const uint8_t *in,
+                                        size_t in_len, const uint32_t key[8],
+                                        const uint32_t counter[4]);
+
+#define CHACHA20_ASM_SSSE3
+inline int ChaCha20_ctr32_ssse3_capable(size_t len) {
+  return len > 128 && CRYPTO_is_SSSE3_capable();
+}
+extern "C" void ChaCha20_ctr32_ssse3(uint8_t *out, const uint8_t *in,
+                                     size_t in_len, const uint32_t key[8],
+                                     const uint32_t counter[4]);
+#endif
+
+#if defined(CHACHA20_ASM_NOHW)
+// ChaCha20_ctr32_nohw encrypts `in_len` bytes from `in` and writes the result
+// to `out`. If `in` and `out` alias, they must be equal. `in_len` may not be
+// zero.
+//
+// `counter[0]` is the initial 32-bit block counter, and the remainder is the
+// 96-bit nonce. If the counter overflows, the output is undefined. The function
+// will produce output, but the output may vary by machine and may not be
+// self-consistent. (On some architectures, the assembly implements a mix of
+// 64-bit and 32-bit counters.)
+extern "C" void ChaCha20_ctr32_nohw(uint8_t *out, const uint8_t *in,
+                                    size_t in_len, const uint32_t key[8],
+                                    const uint32_t counter[4]);
+#endif
+
+BSSL_NAMESPACE_END
+
+#endif  // OPENSSL_HEADER_CRYPTO_CHACHA_INTERNAL_H