/* @generated by `//build/rust/gni_impl/run_bindgen.py` v2025-12-22 */
/* automatically generated by rust-bindgen 0.72.1 */

#[repr(C)]
#[derive(Copy, Clone, Debug, Default, Eq, Hash, Ord, PartialEq, PartialOrd)]
pub struct __BindgenBitfieldUnit<Storage> {
    storage: Storage,
}
impl<Storage> __BindgenBitfieldUnit<Storage> {
    #[inline]
    pub const fn new(storage: Storage) -> Self {
        Self { storage }
    }
}
impl<Storage> __BindgenBitfieldUnit<Storage>
where
    Storage: AsRef<[u8]> + AsMut<[u8]>,
{
    #[inline]
    fn extract_bit(byte: u8, index: usize) -> bool {
        let bit_index = if cfg!(target_endian = "big") { 7 - (index % 8) } else { index % 8 };
        let mask = 1 << bit_index;
        byte & mask == mask
    }
    #[inline]
    pub fn get_bit(&self, index: usize) -> bool {
        debug_assert!(index / 8 < self.storage.as_ref().len());
        let byte_index = index / 8;
        let byte = self.storage.as_ref()[byte_index];
        Self::extract_bit(byte, index)
    }
    #[inline]
    pub unsafe fn raw_get_bit(this: *const Self, index: usize) -> bool {
        debug_assert!(index / 8 < core::mem::size_of::<Storage>());
        let byte_index = index / 8;
        let byte = unsafe {
            *(core::ptr::addr_of!((*this).storage) as *const u8).offset(byte_index as isize)
        };
        Self::extract_bit(byte, index)
    }
    #[inline]
    fn change_bit(byte: u8, index: usize, val: bool) -> u8 {
        let bit_index = if cfg!(target_endian = "big") { 7 - (index % 8) } else { index % 8 };
        let mask = 1 << bit_index;
        if val {
            byte | mask
        } else {
            byte & !mask
        }
    }
    #[inline]
    pub fn set_bit(&mut self, index: usize, val: bool) {
        debug_assert!(index / 8 < self.storage.as_ref().len());
        let byte_index = index / 8;
        let byte = &mut self.storage.as_mut()[byte_index];
        *byte = Self::change_bit(*byte, index, val);
    }
    #[inline]
    pub unsafe fn raw_set_bit(this: *mut Self, index: usize, val: bool) {
        debug_assert!(index / 8 < core::mem::size_of::<Storage>());
        let byte_index = index / 8;
        let byte = unsafe {
            (core::ptr::addr_of_mut!((*this).storage) as *mut u8).offset(byte_index as isize)
        };
        unsafe { *byte = Self::change_bit(*byte, index, val) };
    }
    #[inline]
    pub fn get(&self, bit_offset: usize, bit_width: u8) -> u64 {
        debug_assert!(bit_width <= 64);
        debug_assert!(bit_offset / 8 < self.storage.as_ref().len());
        debug_assert!((bit_offset + (bit_width as usize)) / 8 <= self.storage.as_ref().len());
        let mut val = 0;
        for i in 0..(bit_width as usize) {
            if self.get_bit(i + bit_offset) {
                let index =
                    if cfg!(target_endian = "big") { bit_width as usize - 1 - i } else { i };
                val |= 1 << index;
            }
        }
        val
    }
    #[inline]
    pub unsafe fn raw_get(this: *const Self, bit_offset: usize, bit_width: u8) -> u64 {
        debug_assert!(bit_width <= 64);
        debug_assert!(bit_offset / 8 < core::mem::size_of::<Storage>());
        debug_assert!((bit_offset + (bit_width as usize)) / 8 <= core::mem::size_of::<Storage>());
        let mut val = 0;
        for i in 0..(bit_width as usize) {
            if unsafe { Self::raw_get_bit(this, i + bit_offset) } {
                let index =
                    if cfg!(target_endian = "big") { bit_width as usize - 1 - i } else { i };
                val |= 1 << index;
            }
        }
        val
    }
    #[inline]
    pub fn set(&mut self, bit_offset: usize, bit_width: u8, val: u64) {
        debug_assert!(bit_width <= 64);
        debug_assert!(bit_offset / 8 < self.storage.as_ref().len());
        debug_assert!((bit_offset + (bit_width as usize)) / 8 <= self.storage.as_ref().len());
        for i in 0..(bit_width as usize) {
            let mask = 1 << i;
            let val_bit_is_set = val & mask == mask;
            let index = if cfg!(target_endian = "big") { bit_width as usize - 1 - i } else { i };
            self.set_bit(index + bit_offset, val_bit_is_set);
        }
    }
    #[inline]
    pub unsafe fn raw_set(this: *mut Self, bit_offset: usize, bit_width: u8, val: u64) {
        debug_assert!(bit_width <= 64);
        debug_assert!(bit_offset / 8 < core::mem::size_of::<Storage>());
        debug_assert!((bit_offset + (bit_width as usize)) / 8 <= core::mem::size_of::<Storage>());
        for i in 0..(bit_width as usize) {
            let mask = 1 << i;
            let val_bit_is_set = val & mask == mask;
            let index = if cfg!(target_endian = "big") { bit_width as usize - 1 - i } else { i };
            unsafe { Self::raw_set_bit(this, index + bit_offset, val_bit_is_set) };
        }
    }
}
pub const OPENSSL_VERSION_NUMBER: i32 = 269488255;
pub const SSLEAY_VERSION_NUMBER: i32 = 269488255;
pub const BORINGSSL_API_VERSION: i32 = 42;
pub const AES_ENCRYPT: i32 = 1;
pub const AES_DECRYPT: i32 = 0;
pub const AES_MAXNR: i32 = 14;
pub const AES_BLOCK_SIZE: i32 = 16;
pub const ERR_FLAG_STRING: i32 = 1;
pub const ERR_FLAG_MALLOCED: i32 = 2;
pub const ERR_R_FATAL: i32 = 64;
pub const ERR_R_MALLOC_FAILURE: i32 = 65;
pub const ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED: i32 = 66;
pub const ERR_R_PASSED_NULL_PARAMETER: i32 = 67;
pub const ERR_R_INTERNAL_ERROR: i32 = 68;
pub const ERR_R_OVERFLOW: i32 = 69;
pub const ERR_ERROR_STRING_BUF_LEN: i32 = 120;
pub const ERR_TXT_STRING: i32 = 1;
pub const ERR_TXT_MALLOCED: i32 = 2;
pub const ERR_NUM_ERRORS: i32 = 16;
pub const BIO_RR_CONNECT: i32 = 2;
pub const BIO_RR_ACCEPT: i32 = 3;
pub const BIO_NOCLOSE: i32 = 0;
pub const BIO_CLOSE: i32 = 1;
pub const BIO_FP_TEXT: i32 = 16;
pub const BIO_CTRL_DGRAM_QUERY_MTU: i32 = 40;
pub const BIO_CTRL_DGRAM_SET_MTU: i32 = 42;
pub const BIO_CTRL_DGRAM_MTU_EXCEEDED: i32 = 43;
pub const BIO_CTRL_DGRAM_GET_PEER: i32 = 46;
pub const BIO_CTRL_DGRAM_GET_FALLBACK_MTU: i32 = 47;
pub const BIO_CTRL_RESET: i32 = 1;
pub const BIO_CTRL_EOF: i32 = 2;
pub const BIO_CTRL_INFO: i32 = 3;
pub const BIO_CTRL_GET_CLOSE: i32 = 8;
pub const BIO_CTRL_SET_CLOSE: i32 = 9;
pub const BIO_CTRL_PENDING: i32 = 10;
pub const BIO_CTRL_FLUSH: i32 = 11;
pub const BIO_CTRL_WPENDING: i32 = 13;
pub const BIO_CTRL_SET_CALLBACK: i32 = 14;
pub const BIO_CTRL_GET_CALLBACK: i32 = 15;
pub const BIO_CTRL_SET: i32 = 4;
pub const BIO_CTRL_GET: i32 = 5;
pub const BIO_CTRL_PUSH: i32 = 6;
pub const BIO_CTRL_POP: i32 = 7;
pub const BIO_CTRL_DUP: i32 = 12;
pub const BIO_CTRL_SET_FILENAME: i32 = 30;
pub const BIO_FLAGS_READ: i32 = 1;
pub const BIO_FLAGS_WRITE: i32 = 2;
pub const BIO_FLAGS_IO_SPECIAL: i32 = 4;
pub const BIO_FLAGS_RWS: i32 = 7;
pub const BIO_FLAGS_SHOULD_RETRY: i32 = 8;
pub const BIO_FLAGS_BASE64_NO_NL: i32 = 256;
pub const BIO_FLAGS_MEM_RDONLY: i32 = 512;
pub const BIO_TYPE_DESCRIPTOR: i32 = 256;
pub const BIO_TYPE_FILTER: i32 = 512;
pub const BIO_TYPE_SOURCE_SINK: i32 = 1024;
pub const BIO_TYPE_NONE: i32 = 0;
pub const BIO_TYPE_MEM: i32 = 1025;
pub const BIO_TYPE_FILE: i32 = 1026;
pub const BIO_TYPE_FD: i32 = 1284;
pub const BIO_TYPE_SOCKET: i32 = 1285;
pub const BIO_TYPE_NULL: i32 = 1030;
pub const BIO_TYPE_SSL: i32 = 519;
pub const BIO_TYPE_MD: i32 = 520;
pub const BIO_TYPE_BUFFER: i32 = 521;
pub const BIO_TYPE_CIPHER: i32 = 522;
pub const BIO_TYPE_BASE64: i32 = 523;
pub const BIO_TYPE_CONNECT: i32 = 1292;
pub const BIO_TYPE_ACCEPT: i32 = 1293;
pub const BIO_TYPE_PROXY_CLIENT: i32 = 526;
pub const BIO_TYPE_PROXY_SERVER: i32 = 527;
pub const BIO_TYPE_NBIO_TEST: i32 = 528;
pub const BIO_TYPE_NULL_FILTER: i32 = 529;
pub const BIO_TYPE_BER: i32 = 530;
pub const BIO_TYPE_BIO: i32 = 1043;
pub const BIO_TYPE_LINEBUFFER: i32 = 532;
pub const BIO_TYPE_DGRAM: i32 = 1301;
pub const BIO_TYPE_ASN1: i32 = 534;
pub const BIO_TYPE_COMP: i32 = 535;
pub const BIO_TYPE_START: i32 = 128;
pub const BIO_C_SET_CONNECT: i32 = 100;
pub const BIO_C_DO_STATE_MACHINE: i32 = 101;
pub const BIO_C_SET_NBIO: i32 = 102;
pub const BIO_C_SET_PROXY_PARAM: i32 = 103;
pub const BIO_C_SET_FD: i32 = 104;
pub const BIO_C_GET_FD: i32 = 105;
pub const BIO_C_SET_FILE_PTR: i32 = 106;
pub const BIO_C_GET_FILE_PTR: i32 = 107;
pub const BIO_C_SET_FILENAME: i32 = 108;
pub const BIO_C_SET_SSL: i32 = 109;
pub const BIO_C_SET_MD: i32 = 111;
pub const BIO_C_GET_MD: i32 = 112;
pub const BIO_C_GET_CIPHER_STATUS: i32 = 113;
pub const BIO_C_SET_BUF_MEM: i32 = 114;
pub const BIO_C_GET_BUF_MEM_PTR: i32 = 115;
pub const BIO_C_GET_BUFF_NUM_LINES: i32 = 116;
pub const BIO_C_SET_BUFF_SIZE: i32 = 117;
pub const BIO_C_SET_ACCEPT: i32 = 118;
pub const BIO_C_SSL_MODE: i32 = 119;
pub const BIO_C_GET_MD_CTX: i32 = 120;
pub const BIO_C_GET_PROXY_PARAM: i32 = 121;
pub const BIO_C_SET_BUFF_READ_DATA: i32 = 122;
pub const BIO_C_GET_ACCEPT: i32 = 124;
pub const BIO_C_FILE_SEEK: i32 = 128;
pub const BIO_C_GET_CIPHER_CTX: i32 = 129;
pub const BIO_C_SET_BUF_MEM_EOF_RETURN: i32 = 130;
pub const BIO_C_SET_BIND_MODE: i32 = 131;
pub const BIO_C_GET_BIND_MODE: i32 = 132;
pub const BIO_C_FILE_TELL: i32 = 133;
pub const BIO_C_GET_SOCKS: i32 = 134;
pub const BIO_C_SET_SOCKS: i32 = 135;
pub const BIO_C_SET_WRITE_BUF_SIZE: i32 = 136;
pub const BIO_C_GET_WRITE_BUF_SIZE: i32 = 137;
pub const BIO_C_GET_WRITE_GUARANTEE: i32 = 140;
pub const BIO_C_GET_READ_REQUEST: i32 = 141;
pub const BIO_C_SHUTDOWN_WR: i32 = 142;
pub const BIO_C_NREAD0: i32 = 143;
pub const BIO_C_NREAD: i32 = 144;
pub const BIO_C_NWRITE0: i32 = 145;
pub const BIO_C_NWRITE: i32 = 146;
pub const BIO_C_RESET_READ_REQUEST: i32 = 147;
pub const BIO_C_SET_MD_CTX: i32 = 148;
pub const BIO_C_SET_PREFIX: i32 = 149;
pub const BIO_C_GET_PREFIX: i32 = 150;
pub const BIO_C_SET_SUFFIX: i32 = 151;
pub const BIO_C_GET_SUFFIX: i32 = 152;
pub const BIO_C_SET_EX_ARG: i32 = 153;
pub const BIO_C_GET_EX_ARG: i32 = 154;
pub const BIO_R_BAD_FOPEN_MODE: i32 = 100;
pub const BIO_R_BROKEN_PIPE: i32 = 101;
pub const BIO_R_CONNECT_ERROR: i32 = 102;
pub const BIO_R_ERROR_SETTING_NBIO: i32 = 103;
pub const BIO_R_INVALID_ARGUMENT: i32 = 104;
pub const BIO_R_IN_USE: i32 = 105;
pub const BIO_R_KEEPALIVE: i32 = 106;
pub const BIO_R_NBIO_CONNECT_ERROR: i32 = 107;
pub const BIO_R_NO_HOSTNAME_SPECIFIED: i32 = 108;
pub const BIO_R_NO_PORT_SPECIFIED: i32 = 109;
pub const BIO_R_NO_SUCH_FILE: i32 = 110;
pub const BIO_R_NULL_PARAMETER: i32 = 111;
pub const BIO_R_SYS_LIB: i32 = 112;
pub const BIO_R_UNABLE_TO_CREATE_SOCKET: i32 = 113;
pub const BIO_R_UNINITIALIZED: i32 = 114;
pub const BIO_R_UNSUPPORTED_METHOD: i32 = 115;
pub const BIO_R_WRITE_TO_READ_ONLY_BIO: i32 = 116;
pub const BN_BITS2: i32 = 64;
pub const BN_DEC_FMT1: &[u8; 4] = b"%lu\0";
pub const BN_HEX_FMT1: &[u8; 4] = b"%lx\0";
pub const BN_HEX_FMT2: &[u8; 7] = b"%016lx\0";
pub const BN_RAND_TOP_ANY: i32 = -1;
pub const BN_RAND_TOP_ONE: i32 = 0;
pub const BN_RAND_TOP_TWO: i32 = 1;
pub const BN_RAND_BOTTOM_ANY: i32 = 0;
pub const BN_RAND_BOTTOM_ODD: i32 = 1;
pub const BN_GENCB_GENERATED: i32 = 0;
pub const BN_GENCB_PRIME_TEST: i32 = 1;
pub const BN_prime_checks_for_validation: i32 = 64;
pub const BN_prime_checks_for_generation: i32 = 0;
pub const BN_prime_checks: i32 = 64;
pub const BN_FLG_MALLOCED: i32 = 1;
pub const BN_FLG_STATIC_DATA: i32 = 2;
pub const BN_R_ARG2_LT_ARG3: i32 = 100;
pub const BN_R_BAD_RECIPROCAL: i32 = 101;
pub const BN_R_BIGNUM_TOO_LONG: i32 = 102;
pub const BN_R_BITS_TOO_SMALL: i32 = 103;
pub const BN_R_CALLED_WITH_EVEN_MODULUS: i32 = 104;
pub const BN_R_DIV_BY_ZERO: i32 = 105;
pub const BN_R_EXPAND_ON_STATIC_BIGNUM_DATA: i32 = 106;
pub const BN_R_INPUT_NOT_REDUCED: i32 = 107;
pub const BN_R_INVALID_RANGE: i32 = 108;
pub const BN_R_NEGATIVE_NUMBER: i32 = 109;
pub const BN_R_NOT_A_SQUARE: i32 = 110;
pub const BN_R_NOT_INITIALIZED: i32 = 111;
pub const BN_R_NO_INVERSE: i32 = 112;
pub const BN_R_PRIVATE_KEY_TOO_LARGE: i32 = 113;
pub const BN_R_P_IS_NOT_PRIME: i32 = 114;
pub const BN_R_TOO_MANY_ITERATIONS: i32 = 115;
pub const BN_R_TOO_MANY_TEMPORARY_VARIABLES: i32 = 116;
pub const BN_R_BAD_ENCODING: i32 = 117;
pub const BN_R_ENCODE_ERROR: i32 = 118;
pub const BN_R_INVALID_INPUT: i32 = 119;
pub const V_ASN1_UNIVERSAL: i32 = 0;
pub const V_ASN1_APPLICATION: i32 = 64;
pub const V_ASN1_CONTEXT_SPECIFIC: i32 = 128;
pub const V_ASN1_PRIVATE: i32 = 192;
pub const V_ASN1_CONSTRUCTED: i32 = 32;
pub const V_ASN1_PRIMITIVE_TAG: i32 = 31;
pub const V_ASN1_MAX_UNIVERSAL: i32 = 255;
pub const V_ASN1_UNDEF: i32 = -1;
pub const V_ASN1_OTHER: i32 = -3;
pub const V_ASN1_ANY: i32 = -4;
pub const V_ASN1_EOC: i32 = 0;
pub const V_ASN1_BOOLEAN: i32 = 1;
pub const V_ASN1_INTEGER: i32 = 2;
pub const V_ASN1_BIT_STRING: i32 = 3;
pub const V_ASN1_OCTET_STRING: i32 = 4;
pub const V_ASN1_NULL: i32 = 5;
pub const V_ASN1_OBJECT: i32 = 6;
pub const V_ASN1_OBJECT_DESCRIPTOR: i32 = 7;
pub const V_ASN1_EXTERNAL: i32 = 8;
pub const V_ASN1_REAL: i32 = 9;
pub const V_ASN1_ENUMERATED: i32 = 10;
pub const V_ASN1_UTF8STRING: i32 = 12;
pub const V_ASN1_SEQUENCE: i32 = 16;
pub const V_ASN1_SET: i32 = 17;
pub const V_ASN1_NUMERICSTRING: i32 = 18;
pub const V_ASN1_PRINTABLESTRING: i32 = 19;
pub const V_ASN1_T61STRING: i32 = 20;
pub const V_ASN1_TELETEXSTRING: i32 = 20;
pub const V_ASN1_VIDEOTEXSTRING: i32 = 21;
pub const V_ASN1_IA5STRING: i32 = 22;
pub const V_ASN1_UTCTIME: i32 = 23;
pub const V_ASN1_GENERALIZEDTIME: i32 = 24;
pub const V_ASN1_GRAPHICSTRING: i32 = 25;
pub const V_ASN1_ISO64STRING: i32 = 26;
pub const V_ASN1_VISIBLESTRING: i32 = 26;
pub const V_ASN1_GENERALSTRING: i32 = 27;
pub const V_ASN1_UNIVERSALSTRING: i32 = 28;
pub const V_ASN1_BMPSTRING: i32 = 30;
pub const V_ASN1_NEG: i32 = 256;
pub const V_ASN1_NEG_INTEGER: i32 = 258;
pub const V_ASN1_NEG_ENUMERATED: i32 = 266;
pub const B_ASN1_NUMERICSTRING: i32 = 1;
pub const B_ASN1_PRINTABLESTRING: i32 = 2;
pub const B_ASN1_T61STRING: i32 = 4;
pub const B_ASN1_TELETEXSTRING: i32 = 4;
pub const B_ASN1_VIDEOTEXSTRING: i32 = 8;
pub const B_ASN1_IA5STRING: i32 = 16;
pub const B_ASN1_GRAPHICSTRING: i32 = 32;
pub const B_ASN1_ISO64STRING: i32 = 64;
pub const B_ASN1_VISIBLESTRING: i32 = 64;
pub const B_ASN1_GENERALSTRING: i32 = 128;
pub const B_ASN1_UNIVERSALSTRING: i32 = 256;
pub const B_ASN1_OCTET_STRING: i32 = 512;
pub const B_ASN1_BIT_STRING: i32 = 1024;
pub const B_ASN1_BMPSTRING: i32 = 2048;
pub const B_ASN1_UTF8STRING: i32 = 8192;
pub const B_ASN1_UTCTIME: i32 = 16384;
pub const B_ASN1_GENERALIZEDTIME: i32 = 32768;
pub const B_ASN1_SEQUENCE: i32 = 65536;
pub const ASN1_BOOLEAN_FALSE: i32 = 0;
pub const ASN1_BOOLEAN_TRUE: i32 = 255;
pub const ASN1_BOOLEAN_NONE: i32 = -1;
pub const MBSTRING_FLAG: i32 = 4096;
pub const MBSTRING_UTF8: i32 = 4096;
pub const MBSTRING_ASC: i32 = 4097;
pub const MBSTRING_BMP: i32 = 4098;
pub const MBSTRING_UNIV: i32 = 4100;
pub const DIRSTRING_TYPE: i32 = 10246;
pub const PKCS9STRING_TYPE: i32 = 10262;
pub const STABLE_NO_MASK: i32 = 2;
pub const B_ASN1_DIRECTORYSTRING: i32 = 10502;
pub const B_ASN1_DISPLAYTEXT: i32 = 10320;
pub const B_ASN1_TIME: i32 = 49152;
pub const ASN1_STRFLGS_ESC_2253: i32 = 1;
pub const ASN1_STRFLGS_ESC_CTRL: i32 = 2;
pub const ASN1_STRFLGS_ESC_MSB: i32 = 4;
pub const ASN1_STRFLGS_ESC_QUOTE: i32 = 8;
pub const ASN1_STRFLGS_UTF8_CONVERT: i32 = 16;
pub const ASN1_STRFLGS_IGNORE_TYPE: i32 = 32;
pub const ASN1_STRFLGS_SHOW_TYPE: i32 = 64;
pub const ASN1_STRFLGS_DUMP_ALL: i32 = 128;
pub const ASN1_STRFLGS_DUMP_UNKNOWN: i32 = 256;
pub const ASN1_STRFLGS_DUMP_DER: i32 = 512;
pub const ASN1_STRFLGS_RFC2253: i32 = 791;
pub const ASN1_STRING_FLAG_BITS_LEFT: i32 = 8;
pub const ASN1_R_ASN1_LENGTH_MISMATCH: i32 = 100;
pub const ASN1_R_AUX_ERROR: i32 = 101;
pub const ASN1_R_BAD_GET_ASN1_OBJECT_CALL: i32 = 102;
pub const ASN1_R_BAD_OBJECT_HEADER: i32 = 103;
pub const ASN1_R_BMPSTRING_IS_WRONG_LENGTH: i32 = 104;
pub const ASN1_R_BN_LIB: i32 = 105;
pub const ASN1_R_BOOLEAN_IS_WRONG_LENGTH: i32 = 106;
pub const ASN1_R_BUFFER_TOO_SMALL: i32 = 107;
pub const ASN1_R_CONTEXT_NOT_INITIALISED: i32 = 108;
pub const ASN1_R_DECODE_ERROR: i32 = 109;
pub const ASN1_R_DEPTH_EXCEEDED: i32 = 110;
pub const ASN1_R_DIGEST_AND_KEY_TYPE_NOT_SUPPORTED: i32 = 111;
pub const ASN1_R_ENCODE_ERROR: i32 = 112;
pub const ASN1_R_ERROR_GETTING_TIME: i32 = 113;
pub const ASN1_R_EXPECTING_AN_ASN1_SEQUENCE: i32 = 114;
pub const ASN1_R_EXPECTING_AN_INTEGER: i32 = 115;
pub const ASN1_R_EXPECTING_AN_OBJECT: i32 = 116;
pub const ASN1_R_EXPECTING_A_BOOLEAN: i32 = 117;
pub const ASN1_R_EXPECTING_A_TIME: i32 = 118;
pub const ASN1_R_EXPLICIT_LENGTH_MISMATCH: i32 = 119;
pub const ASN1_R_EXPLICIT_TAG_NOT_CONSTRUCTED: i32 = 120;
pub const ASN1_R_FIELD_MISSING: i32 = 121;
pub const ASN1_R_FIRST_NUM_TOO_LARGE: i32 = 122;
pub const ASN1_R_HEADER_TOO_LONG: i32 = 123;
pub const ASN1_R_ILLEGAL_BITSTRING_FORMAT: i32 = 124;
pub const ASN1_R_ILLEGAL_BOOLEAN: i32 = 125;
pub const ASN1_R_ILLEGAL_CHARACTERS: i32 = 126;
pub const ASN1_R_ILLEGAL_FORMAT: i32 = 127;
pub const ASN1_R_ILLEGAL_HEX: i32 = 128;
pub const ASN1_R_ILLEGAL_IMPLICIT_TAG: i32 = 129;
pub const ASN1_R_ILLEGAL_INTEGER: i32 = 130;
pub const ASN1_R_ILLEGAL_NESTED_TAGGING: i32 = 131;
pub const ASN1_R_ILLEGAL_NULL: i32 = 132;
pub const ASN1_R_ILLEGAL_NULL_VALUE: i32 = 133;
pub const ASN1_R_ILLEGAL_OBJECT: i32 = 134;
pub const ASN1_R_ILLEGAL_OPTIONAL_ANY: i32 = 135;
pub const ASN1_R_ILLEGAL_OPTIONS_ON_ITEM_TEMPLATE: i32 = 136;
pub const ASN1_R_ILLEGAL_TAGGED_ANY: i32 = 137;
pub const ASN1_R_ILLEGAL_TIME_VALUE: i32 = 138;
pub const ASN1_R_INTEGER_NOT_ASCII_FORMAT: i32 = 139;
pub const ASN1_R_INTEGER_TOO_LARGE_FOR_LONG: i32 = 140;
pub const ASN1_R_INVALID_BIT_STRING_BITS_LEFT: i32 = 141;
pub const ASN1_R_INVALID_BMPSTRING: i32 = 142;
pub const ASN1_R_INVALID_DIGIT: i32 = 143;
pub const ASN1_R_INVALID_MODIFIER: i32 = 144;
pub const ASN1_R_INVALID_NUMBER: i32 = 145;
pub const ASN1_R_INVALID_OBJECT_ENCODING: i32 = 146;
pub const ASN1_R_INVALID_SEPARATOR: i32 = 147;
pub const ASN1_R_INVALID_TIME_FORMAT: i32 = 148;
pub const ASN1_R_INVALID_UNIVERSALSTRING: i32 = 149;
pub const ASN1_R_INVALID_UTF8STRING: i32 = 150;
pub const ASN1_R_LIST_ERROR: i32 = 151;
pub const ASN1_R_MISSING_ASN1_EOS: i32 = 152;
pub const ASN1_R_MISSING_EOC: i32 = 153;
pub const ASN1_R_MISSING_SECOND_NUMBER: i32 = 154;
pub const ASN1_R_MISSING_VALUE: i32 = 155;
pub const ASN1_R_MSTRING_NOT_UNIVERSAL: i32 = 156;
pub const ASN1_R_MSTRING_WRONG_TAG: i32 = 157;
pub const ASN1_R_NESTED_ASN1_ERROR: i32 = 158;
pub const ASN1_R_NESTED_ASN1_STRING: i32 = 159;
pub const ASN1_R_NON_HEX_CHARACTERS: i32 = 160;
pub const ASN1_R_NOT_ASCII_FORMAT: i32 = 161;
pub const ASN1_R_NOT_ENOUGH_DATA: i32 = 162;
pub const ASN1_R_NO_MATCHING_CHOICE_TYPE: i32 = 163;
pub const ASN1_R_NULL_IS_WRONG_LENGTH: i32 = 164;
pub const ASN1_R_OBJECT_NOT_ASCII_FORMAT: i32 = 165;
pub const ASN1_R_ODD_NUMBER_OF_CHARS: i32 = 166;
pub const ASN1_R_SECOND_NUMBER_TOO_LARGE: i32 = 167;
pub const ASN1_R_SEQUENCE_LENGTH_MISMATCH: i32 = 168;
pub const ASN1_R_SEQUENCE_NOT_CONSTRUCTED: i32 = 169;
pub const ASN1_R_SEQUENCE_OR_SET_NEEDS_CONFIG: i32 = 170;
pub const ASN1_R_SHORT_LINE: i32 = 171;
pub const ASN1_R_STREAMING_NOT_SUPPORTED: i32 = 172;
pub const ASN1_R_STRING_TOO_LONG: i32 = 173;
pub const ASN1_R_STRING_TOO_SHORT: i32 = 174;
pub const ASN1_R_TAG_VALUE_TOO_HIGH: i32 = 175;
pub const ASN1_R_TIME_NOT_ASCII_FORMAT: i32 = 176;
pub const ASN1_R_TOO_LONG: i32 = 177;
pub const ASN1_R_TYPE_NOT_CONSTRUCTED: i32 = 178;
pub const ASN1_R_TYPE_NOT_PRIMITIVE: i32 = 179;
pub const ASN1_R_UNEXPECTED_EOC: i32 = 180;
pub const ASN1_R_UNIVERSALSTRING_IS_WRONG_LENGTH: i32 = 181;
pub const ASN1_R_UNKNOWN_FORMAT: i32 = 182;
pub const ASN1_R_UNKNOWN_MESSAGE_DIGEST_ALGORITHM: i32 = 183;
pub const ASN1_R_UNKNOWN_SIGNATURE_ALGORITHM: i32 = 184;
pub const ASN1_R_UNKNOWN_TAG: i32 = 185;
pub const ASN1_R_UNSUPPORTED_ANY_DEFINED_BY_TYPE: i32 = 186;
pub const ASN1_R_UNSUPPORTED_PUBLIC_KEY_TYPE: i32 = 187;
pub const ASN1_R_UNSUPPORTED_TYPE: i32 = 188;
pub const ASN1_R_WRONG_PUBLIC_KEY_TYPE: i32 = 189;
pub const ASN1_R_WRONG_TAG: i32 = 190;
pub const ASN1_R_WRONG_TYPE: i32 = 191;
pub const ASN1_R_NESTED_TOO_DEEP: i32 = 192;
pub const ASN1_R_BAD_TEMPLATE: i32 = 193;
pub const ASN1_R_INVALID_BIT_STRING_PADDING: i32 = 194;
pub const ASN1_R_WRONG_INTEGER_TYPE: i32 = 195;
pub const ASN1_R_INVALID_INTEGER: i32 = 196;
pub const ASN1_TFLG_OPTIONAL: i32 = 1;
pub const ASN1_TFLG_SET_OF: i32 = 2;
pub const ASN1_TFLG_SEQUENCE_OF: i32 = 4;
pub const ASN1_TFLG_SK_MASK: i32 = 6;
pub const ASN1_TFLG_IMPTAG: i32 = 8;
pub const ASN1_TFLG_EXPTAG: i32 = 16;
pub const ASN1_TFLG_TAG_MASK: i32 = 24;
pub const ASN1_TFLG_UNIVERSAL: i32 = 0;
pub const ASN1_TFLG_APPLICATION: i32 = 64;
pub const ASN1_TFLG_CONTEXT: i32 = 128;
pub const ASN1_TFLG_PRIVATE: i32 = 192;
pub const ASN1_TFLG_TAG_CLASS: i32 = 192;
pub const ASN1_TFLG_ADB_MASK: i32 = 768;
pub const ASN1_TFLG_ADB_OID: i32 = 256;
pub const ASN1_ITYPE_PRIMITIVE: i32 = 0;
pub const ASN1_ITYPE_SEQUENCE: i32 = 1;
pub const ASN1_ITYPE_CHOICE: i32 = 2;
pub const ASN1_ITYPE_EXTERN: i32 = 4;
pub const ASN1_ITYPE_MSTRING: i32 = 5;
pub const ASN1_AFLG_REFCOUNT: i32 = 1;
pub const ASN1_AFLG_ENCODING: i32 = 2;
pub const ASN1_OP_NEW_PRE: i32 = 0;
pub const ASN1_OP_NEW_POST: i32 = 1;
pub const ASN1_OP_FREE_PRE: i32 = 2;
pub const ASN1_OP_FREE_POST: i32 = 3;
pub const ASN1_OP_D2I_PRE: i32 = 4;
pub const ASN1_OP_D2I_POST: i32 = 5;
pub const ASN1_OP_PRINT_PRE: i32 = 8;
pub const ASN1_OP_PRINT_POST: i32 = 9;
pub const ASN1_OP_STREAM_PRE: i32 = 10;
pub const ASN1_OP_STREAM_POST: i32 = 11;
pub const ASN1_OP_DETACHED_PRE: i32 = 12;
pub const ASN1_OP_DETACHED_POST: i32 = 13;
pub const BLAKE2B256_DIGEST_LENGTH: i32 = 32;
pub const BLAKE2B_CBLOCK: i32 = 128;
pub const BF_ENCRYPT: i32 = 1;
pub const BF_DECRYPT: i32 = 0;
pub const BF_ROUNDS: i32 = 16;
pub const BF_BLOCK: i32 = 8;
pub const CBS_ASN1_TAG_SHIFT: i32 = 24;
pub const CBS_ASN1_CONSTRUCTED: i32 = 536870912;
pub const CBS_ASN1_UNIVERSAL: i32 = 0;
pub const CBS_ASN1_APPLICATION: i32 = 1073741824;
pub const CBS_ASN1_CONTEXT_SPECIFIC: i64 = 2147483648;
pub const CBS_ASN1_PRIVATE: i64 = 3221225472;
pub const CBS_ASN1_CLASS_MASK: i64 = 3221225472;
pub const CBS_ASN1_TAG_NUMBER_MASK: i32 = 536870911;
pub const CBS_ASN1_BOOLEAN: i32 = 1;
pub const CBS_ASN1_INTEGER: i32 = 2;
pub const CBS_ASN1_BITSTRING: i32 = 3;
pub const CBS_ASN1_OCTETSTRING: i32 = 4;
pub const CBS_ASN1_NULL: i32 = 5;
pub const CBS_ASN1_OBJECT: i32 = 6;
pub const CBS_ASN1_ENUMERATED: i32 = 10;
pub const CBS_ASN1_UTF8STRING: i32 = 12;
pub const CBS_ASN1_SEQUENCE: i32 = 536870928;
pub const CBS_ASN1_SET: i32 = 536870929;
pub const CBS_ASN1_NUMERICSTRING: i32 = 18;
pub const CBS_ASN1_PRINTABLESTRING: i32 = 19;
pub const CBS_ASN1_T61STRING: i32 = 20;
pub const CBS_ASN1_VIDEOTEXSTRING: i32 = 21;
pub const CBS_ASN1_IA5STRING: i32 = 22;
pub const CBS_ASN1_UTCTIME: i32 = 23;
pub const CBS_ASN1_GENERALIZEDTIME: i32 = 24;
pub const CBS_ASN1_GRAPHICSTRING: i32 = 25;
pub const CBS_ASN1_VISIBLESTRING: i32 = 26;
pub const CBS_ASN1_GENERALSTRING: i32 = 27;
pub const CBS_ASN1_UNIVERSALSTRING: i32 = 28;
pub const CBS_ASN1_BMPSTRING: i32 = 30;
pub const CAST_ENCRYPT: i32 = 1;
pub const CAST_DECRYPT: i32 = 0;
pub const CAST_BLOCK: i32 = 8;
pub const CAST_KEY_LENGTH: i32 = 16;
pub const EVP_CIPH_STREAM_CIPHER: i32 = 0;
pub const EVP_CIPH_ECB_MODE: i32 = 1;
pub const EVP_CIPH_CBC_MODE: i32 = 2;
pub const EVP_CIPH_CFB_MODE: i32 = 3;
pub const EVP_CIPH_OFB_MODE: i32 = 4;
pub const EVP_CIPH_CTR_MODE: i32 = 5;
pub const EVP_CIPH_GCM_MODE: i32 = 6;
pub const EVP_CIPH_XTS_MODE: i32 = 7;
pub const EVP_CIPH_CCM_MODE: i32 = 8;
pub const EVP_CIPH_OCB_MODE: i32 = 9;
pub const EVP_CIPH_WRAP_MODE: i32 = 10;
pub const EVP_CIPH_VARIABLE_LENGTH: i32 = 64;
pub const EVP_CIPH_ALWAYS_CALL_INIT: i32 = 128;
pub const EVP_CIPH_CUSTOM_IV: i32 = 256;
pub const EVP_CIPH_CTRL_INIT: i32 = 512;
pub const EVP_CIPH_FLAG_CUSTOM_CIPHER: i32 = 1024;
pub const EVP_CIPH_FLAG_AEAD_CIPHER: i32 = 2048;
pub const EVP_CIPH_CUSTOM_COPY: i32 = 4096;
pub const EVP_CIPH_FLAG_NON_FIPS_ALLOW: i32 = 0;
pub const EVP_CIPHER_CTX_FLAG_WRAP_ALLOW: i32 = 0;
pub const EVP_CIPH_NO_PADDING: i32 = 2048;
pub const EVP_CTRL_INIT: i32 = 0;
pub const EVP_CTRL_SET_KEY_LENGTH: i32 = 1;
pub const EVP_CTRL_GET_RC2_KEY_BITS: i32 = 2;
pub const EVP_CTRL_SET_RC2_KEY_BITS: i32 = 3;
pub const EVP_CTRL_GET_RC5_ROUNDS: i32 = 4;
pub const EVP_CTRL_SET_RC5_ROUNDS: i32 = 5;
pub const EVP_CTRL_RAND_KEY: i32 = 6;
pub const EVP_CTRL_PBE_PRF_NID: i32 = 7;
pub const EVP_CTRL_COPY: i32 = 8;
pub const EVP_CTRL_AEAD_SET_IVLEN: i32 = 9;
pub const EVP_CTRL_AEAD_GET_TAG: i32 = 16;
pub const EVP_CTRL_AEAD_SET_TAG: i32 = 17;
pub const EVP_CTRL_AEAD_SET_IV_FIXED: i32 = 18;
pub const EVP_CTRL_GCM_IV_GEN: i32 = 19;
pub const EVP_CTRL_AEAD_SET_MAC_KEY: i32 = 23;
pub const EVP_CTRL_GCM_SET_IV_INV: i32 = 24;
pub const EVP_CTRL_GET_IVLEN: i32 = 25;
pub const EVP_GCM_TLS_FIXED_IV_LEN: i32 = 4;
pub const EVP_GCM_TLS_EXPLICIT_IV_LEN: i32 = 8;
pub const EVP_GCM_TLS_TAG_LEN: i32 = 16;
pub const EVP_CTRL_GCM_SET_IVLEN: i32 = 9;
pub const EVP_CTRL_GCM_GET_TAG: i32 = 16;
pub const EVP_CTRL_GCM_SET_TAG: i32 = 17;
pub const EVP_CTRL_GCM_SET_IV_FIXED: i32 = 18;
pub const EVP_MAX_KEY_LENGTH: i32 = 64;
pub const EVP_MAX_IV_LENGTH: i32 = 16;
pub const EVP_MAX_BLOCK_LENGTH: i32 = 32;
pub const CIPHER_R_AES_KEY_SETUP_FAILED: i32 = 100;
pub const CIPHER_R_BAD_DECRYPT: i32 = 101;
pub const CIPHER_R_BAD_KEY_LENGTH: i32 = 102;
pub const CIPHER_R_BUFFER_TOO_SMALL: i32 = 103;
pub const CIPHER_R_CTRL_NOT_IMPLEMENTED: i32 = 104;
pub const CIPHER_R_CTRL_OPERATION_NOT_IMPLEMENTED: i32 = 105;
pub const CIPHER_R_DATA_NOT_MULTIPLE_OF_BLOCK_LENGTH: i32 = 106;
pub const CIPHER_R_INITIALIZATION_ERROR: i32 = 107;
pub const CIPHER_R_INPUT_NOT_INITIALIZED: i32 = 108;
pub const CIPHER_R_INVALID_AD_SIZE: i32 = 109;
pub const CIPHER_R_INVALID_KEY_LENGTH: i32 = 110;
pub const CIPHER_R_INVALID_NONCE_SIZE: i32 = 111;
pub const CIPHER_R_INVALID_OPERATION: i32 = 112;
pub const CIPHER_R_IV_TOO_LARGE: i32 = 113;
pub const CIPHER_R_NO_CIPHER_SET: i32 = 114;
pub const CIPHER_R_OUTPUT_ALIASES_INPUT: i32 = 115;
pub const CIPHER_R_TAG_TOO_LARGE: i32 = 116;
pub const CIPHER_R_TOO_LARGE: i32 = 117;
pub const CIPHER_R_UNSUPPORTED_AD_SIZE: i32 = 118;
pub const CIPHER_R_UNSUPPORTED_INPUT_SIZE: i32 = 119;
pub const CIPHER_R_UNSUPPORTED_KEY_SIZE: i32 = 120;
pub const CIPHER_R_UNSUPPORTED_NONCE_SIZE: i32 = 121;
pub const CIPHER_R_UNSUPPORTED_TAG_SIZE: i32 = 122;
pub const CIPHER_R_WRONG_FINAL_BLOCK_LENGTH: i32 = 123;
pub const CIPHER_R_NO_DIRECTION_SET: i32 = 124;
pub const CIPHER_R_INVALID_NONCE: i32 = 125;
pub const CONF_MFLAGS_DEFAULT_SECTION: i32 = 0;
pub const CONF_MFLAGS_IGNORE_MISSING_FILE: i32 = 0;
pub const CONF_R_LIST_CANNOT_BE_NULL: i32 = 100;
pub const CONF_R_MISSING_CLOSE_SQUARE_BRACKET: i32 = 101;
pub const CONF_R_MISSING_EQUAL_SIGN: i32 = 102;
pub const CONF_R_NO_CLOSE_BRACE: i32 = 103;
pub const CONF_R_UNABLE_TO_CREATE_NEW_SECTION: i32 = 104;
pub const CONF_R_VARIABLE_HAS_NO_VALUE: i32 = 105;
pub const CONF_R_VARIABLE_EXPANSION_TOO_LONG: i32 = 106;
pub const CONF_R_VARIABLE_EXPANSION_NOT_SUPPORTED: i32 = 107;
pub const SHA224_CBLOCK: i32 = 64;
pub const SHA224_DIGEST_LENGTH: i32 = 28;
pub const SHA256_CBLOCK: i32 = 64;
pub const SHA256_DIGEST_LENGTH: i32 = 32;
pub const SHA384_CBLOCK: i32 = 128;
pub const SHA384_DIGEST_LENGTH: i32 = 48;
pub const SHA512_CBLOCK: i32 = 128;
pub const SHA512_DIGEST_LENGTH: i32 = 64;
pub const SHA512_256_DIGEST_LENGTH: i32 = 32;
pub const SHA_CBLOCK: i32 = 64;
pub const SHA_DIGEST_LENGTH: i32 = 20;
pub const CRYPTO_LOCK: i32 = 1;
pub const CRYPTO_UNLOCK: i32 = 2;
pub const CRYPTO_READ: i32 = 4;
pub const CRYPTO_WRITE: i32 = 8;
pub const OPENSSL_VERSION_TEXT: &[u8; 38] = b"OpenSSL 1.1.1 (compatible; BoringSSL)\0";
pub const OPENSSL_VERSION: i32 = 0;
pub const OPENSSL_CFLAGS: i32 = 1;
pub const OPENSSL_BUILT_ON: i32 = 2;
pub const OPENSSL_PLATFORM: i32 = 3;
pub const OPENSSL_DIR: i32 = 4;
pub const SSLEAY_VERSION: i32 = 0;
pub const SSLEAY_CFLAGS: i32 = 1;
pub const SSLEAY_BUILT_ON: i32 = 2;
pub const SSLEAY_PLATFORM: i32 = 3;
pub const SSLEAY_DIR: i32 = 4;
pub const OPENSSL_INIT_NO_LOAD_CRYPTO_STRINGS: i32 = 0;
pub const OPENSSL_INIT_LOAD_CRYPTO_STRINGS: i32 = 0;
pub const OPENSSL_INIT_ADD_ALL_CIPHERS: i32 = 0;
pub const OPENSSL_INIT_ADD_ALL_DIGESTS: i32 = 0;
pub const OPENSSL_INIT_NO_ADD_ALL_CIPHERS: i32 = 0;
pub const OPENSSL_INIT_NO_ADD_ALL_DIGESTS: i32 = 0;
pub const OPENSSL_INIT_LOAD_CONFIG: i32 = 0;
pub const OPENSSL_INIT_NO_LOAD_CONFIG: i32 = 0;
pub const OPENSSL_INIT_NO_ATEXIT: i32 = 0;
pub const OPENSSL_INIT_ATFORK: i32 = 0;
pub const OPENSSL_INIT_ENGINE_RDRAND: i32 = 0;
pub const OPENSSL_INIT_ENGINE_DYNAMIC: i32 = 0;
pub const OPENSSL_INIT_ENGINE_OPENSSL: i32 = 0;
pub const OPENSSL_INIT_ENGINE_CRYPTODEV: i32 = 0;
pub const OPENSSL_INIT_ENGINE_CAPI: i32 = 0;
pub const OPENSSL_INIT_ENGINE_PADLOCK: i32 = 0;
pub const OPENSSL_INIT_ENGINE_AFALG: i32 = 0;
pub const OPENSSL_INIT_ENGINE_ALL_BUILTIN: i32 = 0;
pub const CTR_DRBG_MIN_ENTROPY_LEN: i32 = 32;
pub const CTR_DRBG_MAX_ENTROPY_LEN: i32 = 64;
pub const CTR_DRBG_ENTROPY_LEN: i32 = 48;
pub const CTR_DRBG_NONCE_LEN: i32 = 16;
pub const CTR_DRBG_MAX_GENERATE_LENGTH: i32 = 65536;
pub const X25519_PRIVATE_KEY_LEN: i32 = 32;
pub const X25519_PUBLIC_VALUE_LEN: i32 = 32;
pub const X25519_SHARED_KEY_LEN: i32 = 32;
pub const ED25519_PRIVATE_KEY_LEN: i32 = 64;
pub const ED25519_PUBLIC_KEY_LEN: i32 = 32;
pub const ED25519_SIGNATURE_LEN: i32 = 64;
pub const SPAKE2_MAX_MSG_SIZE: i32 = 32;
pub const SPAKE2_MAX_KEY_SIZE: i32 = 64;
pub const DES_ENCRYPT: i32 = 1;
pub const DES_DECRYPT: i32 = 0;
pub const DES_CBC_MODE: i32 = 0;
pub const DES_PCBC_MODE: i32 = 1;
pub const OPENSSL_DH_MAX_MODULUS_BITS: i32 = 8192;
pub const DH_GENERATOR_2: i32 = 2;
pub const DH_GENERATOR_5: i32 = 5;
pub const DH_CHECK_P_NOT_PRIME: i32 = 1;
pub const DH_CHECK_P_NOT_SAFE_PRIME: i32 = 2;
pub const DH_CHECK_UNABLE_TO_CHECK_GENERATOR: i32 = 4;
pub const DH_CHECK_NOT_SUITABLE_GENERATOR: i32 = 8;
pub const DH_CHECK_Q_NOT_PRIME: i32 = 16;
pub const DH_CHECK_INVALID_Q_VALUE: i32 = 32;
pub const DH_NOT_SUITABLE_GENERATOR: i32 = 8;
pub const DH_UNABLE_TO_CHECK_GENERATOR: i32 = 4;
pub const DH_CHECK_PUBKEY_TOO_SMALL: i32 = 1;
pub const DH_CHECK_PUBKEY_TOO_LARGE: i32 = 2;
pub const DH_CHECK_PUBKEY_INVALID: i32 = 4;
pub const DH_R_BAD_GENERATOR: i32 = 100;
pub const DH_R_INVALID_PUBKEY: i32 = 101;
pub const DH_R_MODULUS_TOO_LARGE: i32 = 102;
pub const DH_R_NO_PRIVATE_VALUE: i32 = 103;
pub const DH_R_DECODE_ERROR: i32 = 104;
pub const DH_R_ENCODE_ERROR: i32 = 105;
pub const DH_R_INVALID_PARAMETERS: i32 = 106;
pub const EVP_MAX_MD_SIZE: i32 = 64;
pub const EVP_MAX_MD_BLOCK_SIZE: i32 = 128;
pub const EVP_MD_FLAG_DIGALGID_ABSENT: i32 = 2;
pub const EVP_MD_FLAG_XOF: i32 = 4;
pub const EVP_MD_CTX_FLAG_NON_FIPS_ALLOW: i32 = 0;
pub const EVP_MAX_MD_DATA_SIZE: i32 = 208;
pub const DIGEST_R_INPUT_NOT_INITIALIZED: i32 = 100;
pub const DIGEST_R_DECODE_ERROR: i32 = 101;
pub const DIGEST_R_UNKNOWN_HASH: i32 = 102;
pub const OPENSSL_DSA_MAX_MODULUS_BITS: i32 = 8192;
pub const DSA_R_BAD_Q_VALUE: i32 = 100;
pub const DSA_R_MISSING_PARAMETERS: i32 = 101;
pub const DSA_R_MODULUS_TOO_LARGE: i32 = 102;
pub const DSA_R_NEED_NEW_SETUP_VALUES: i32 = 103;
pub const DSA_R_BAD_VERSION: i32 = 104;
pub const DSA_R_DECODE_ERROR: i32 = 105;
pub const DSA_R_ENCODE_ERROR: i32 = 106;
pub const DSA_R_INVALID_PARAMETERS: i32 = 107;
pub const DSA_R_TOO_MANY_ITERATIONS: i32 = 108;
pub const OPENSSL_EC_EXPLICIT_CURVE: i32 = 0;
pub const OPENSSL_EC_NAMED_CURVE: i32 = 1;
pub const ENGINE_R_OPERATION_NOT_SUPPORTED: i32 = 100;
pub const EC_PKEY_NO_PARAMETERS: i32 = 1;
pub const EC_PKEY_NO_PUBKEY: i32 = 2;
pub const ECDSA_FLAG_OPAQUE: i32 = 1;
pub const EC_R_BUFFER_TOO_SMALL: i32 = 100;
pub const EC_R_COORDINATES_OUT_OF_RANGE: i32 = 101;
pub const EC_R_D2I_ECPKPARAMETERS_FAILURE: i32 = 102;
pub const EC_R_EC_GROUP_NEW_BY_NAME_FAILURE: i32 = 103;
pub const EC_R_GROUP2PKPARAMETERS_FAILURE: i32 = 104;
pub const EC_R_I2D_ECPKPARAMETERS_FAILURE: i32 = 105;
pub const EC_R_INCOMPATIBLE_OBJECTS: i32 = 106;
pub const EC_R_INVALID_COMPRESSED_POINT: i32 = 107;
pub const EC_R_INVALID_COMPRESSION_BIT: i32 = 108;
pub const EC_R_INVALID_ENCODING: i32 = 109;
pub const EC_R_INVALID_FIELD: i32 = 110;
pub const EC_R_INVALID_FORM: i32 = 111;
pub const EC_R_INVALID_GROUP_ORDER: i32 = 112;
pub const EC_R_INVALID_PRIVATE_KEY: i32 = 113;
pub const EC_R_MISSING_PARAMETERS: i32 = 114;
pub const EC_R_MISSING_PRIVATE_KEY: i32 = 115;
pub const EC_R_NON_NAMED_CURVE: i32 = 116;
pub const EC_R_NOT_INITIALIZED: i32 = 117;
pub const EC_R_PKPARAMETERS2GROUP_FAILURE: i32 = 118;
pub const EC_R_POINT_AT_INFINITY: i32 = 119;
pub const EC_R_POINT_IS_NOT_ON_CURVE: i32 = 120;
pub const EC_R_SLOT_FULL: i32 = 121;
pub const EC_R_UNDEFINED_GENERATOR: i32 = 122;
pub const EC_R_UNKNOWN_GROUP: i32 = 123;
pub const EC_R_UNKNOWN_ORDER: i32 = 124;
pub const EC_R_WRONG_ORDER: i32 = 125;
pub const EC_R_BIGNUM_OUT_OF_RANGE: i32 = 126;
pub const EC_R_WRONG_CURVE_PARAMETERS: i32 = 127;
pub const EC_R_DECODE_ERROR: i32 = 128;
pub const EC_R_ENCODE_ERROR: i32 = 129;
pub const EC_R_GROUP_MISMATCH: i32 = 130;
pub const EC_R_INVALID_COFACTOR: i32 = 131;
pub const EC_R_PUBLIC_KEY_VALIDATION_FAILED: i32 = 132;
pub const EC_R_INVALID_SCALAR: i32 = 133;
pub const ECDH_R_KDF_FAILED: i32 = 100;
pub const ECDH_R_NO_PRIVATE_VALUE: i32 = 101;
pub const ECDH_R_POINT_ARITHMETIC_FAILURE: i32 = 102;
pub const ECDH_R_UNKNOWN_DIGEST_LENGTH: i32 = 103;
pub const ECDSA_R_BAD_SIGNATURE: i32 = 100;
pub const ECDSA_R_MISSING_PARAMETERS: i32 = 101;
pub const ECDSA_R_NEED_NEW_SETUP_VALUES: i32 = 102;
pub const ECDSA_R_NOT_IMPLEMENTED: i32 = 103;
pub const ECDSA_R_RANDOM_NUMBER_GENERATION_FAILED: i32 = 104;
pub const ECDSA_R_ENCODE_ERROR: i32 = 105;
pub const ECDSA_R_TOO_MANY_ITERATIONS: i32 = 106;
pub const EVP_R_BUFFER_TOO_SMALL: i32 = 100;
pub const EVP_R_COMMAND_NOT_SUPPORTED: i32 = 101;
pub const EVP_R_DECODE_ERROR: i32 = 102;
pub const EVP_R_DIFFERENT_KEY_TYPES: i32 = 103;
pub const EVP_R_DIFFERENT_PARAMETERS: i32 = 104;
pub const EVP_R_ENCODE_ERROR: i32 = 105;
pub const EVP_R_EXPECTING_A_EC_KEY: i32 = 106;
pub const EVP_R_EXPECTING_AN_RSA_KEY: i32 = 107;
pub const EVP_R_EXPECTING_A_DSA_KEY: i32 = 108;
pub const EVP_R_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE: i32 = 109;
pub const EVP_R_INVALID_DIGEST_LENGTH: i32 = 110;
pub const EVP_R_INVALID_DIGEST_TYPE: i32 = 111;
pub const EVP_R_INVALID_KEYBITS: i32 = 112;
pub const EVP_R_INVALID_MGF1_MD: i32 = 113;
pub const EVP_R_INVALID_OPERATION: i32 = 114;
pub const EVP_R_INVALID_PADDING_MODE: i32 = 115;
pub const EVP_R_INVALID_PSS_SALTLEN: i32 = 116;
pub const EVP_R_KEYS_NOT_SET: i32 = 117;
pub const EVP_R_MISSING_PARAMETERS: i32 = 118;
pub const EVP_R_NO_DEFAULT_DIGEST: i32 = 119;
pub const EVP_R_NO_KEY_SET: i32 = 120;
pub const EVP_R_NO_MDC2_SUPPORT: i32 = 121;
pub const EVP_R_NO_NID_FOR_CURVE: i32 = 122;
pub const EVP_R_NO_OPERATION_SET: i32 = 123;
pub const EVP_R_NO_PARAMETERS_SET: i32 = 124;
pub const EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE: i32 = 125;
pub const EVP_R_OPERATION_NOT_INITIALIZED: i32 = 126;
pub const EVP_R_UNKNOWN_PUBLIC_KEY_TYPE: i32 = 127;
pub const EVP_R_UNSUPPORTED_ALGORITHM: i32 = 128;
pub const EVP_R_UNSUPPORTED_PUBLIC_KEY_TYPE: i32 = 129;
pub const EVP_R_NOT_A_PRIVATE_KEY: i32 = 130;
pub const EVP_R_INVALID_SIGNATURE: i32 = 131;
pub const EVP_R_MEMORY_LIMIT_EXCEEDED: i32 = 132;
pub const EVP_R_INVALID_PARAMETERS: i32 = 133;
pub const EVP_R_INVALID_PEER_KEY: i32 = 134;
pub const EVP_R_NOT_XOF_OR_INVALID_LENGTH: i32 = 135;
pub const EVP_R_EMPTY_PSK: i32 = 136;
pub const EVP_R_INVALID_BUFFER_SIZE: i32 = 137;
pub const EVP_R_EXPECTING_A_DH_KEY: i32 = 138;
pub const EVP_R_PRIVATE_KEY_WAS_NOT_SEED: i32 = 139;
pub const EVP_R_MISSING_PUBLIC_KEY: i32 = 140;
pub const EVP_R_INVALID_CIPHERTEXT_LENGTH: i32 = 141;
pub const EVP_R_INVALID_SECRET_LENGTH: i32 = 142;
pub const EVP_R_OPERATON_NOT_INITIALIZED: i32 = 126;
pub const EVP_AEAD_MAX_KEY_LENGTH: i32 = 80;
pub const EVP_AEAD_MAX_NONCE_LENGTH: i32 = 24;
pub const EVP_AEAD_MAX_OVERHEAD: i32 = 64;
pub const EVP_AEAD_MAX_OPEN_OVERHEAD: i32 = 320;
pub const EVP_AEAD_DEFAULT_TAG_LENGTH: i32 = 0;
pub const CRYPTO_IOVEC_MAX: i32 = 16;
pub const SN_undef: &[u8; 6] = b"UNDEF\0";
pub const LN_undef: &[u8; 10] = b"undefined\0";
pub const NID_undef: i32 = 0;
pub const OBJ_undef: i32 = 0;
pub const SN_rsadsi: &[u8; 7] = b"rsadsi\0";
pub const LN_rsadsi: &[u8; 24] = b"RSA Data Security, Inc.\0";
pub const NID_rsadsi: i32 = 1;
pub const SN_pkcs: &[u8; 5] = b"pkcs\0";
pub const LN_pkcs: &[u8; 29] = b"RSA Data Security, Inc. PKCS\0";
pub const NID_pkcs: i32 = 2;
pub const SN_md2: &[u8; 4] = b"MD2\0";
pub const LN_md2: &[u8; 4] = b"md2\0";
pub const NID_md2: i32 = 3;
pub const SN_md5: &[u8; 4] = b"MD5\0";
pub const LN_md5: &[u8; 4] = b"md5\0";
pub const NID_md5: i32 = 4;
pub const SN_rc4: &[u8; 4] = b"RC4\0";
pub const LN_rc4: &[u8; 4] = b"rc4\0";
pub const NID_rc4: i32 = 5;
pub const LN_rsaEncryption: &[u8; 14] = b"rsaEncryption\0";
pub const NID_rsaEncryption: i32 = 6;
pub const SN_md2WithRSAEncryption: &[u8; 8] = b"RSA-MD2\0";
pub const LN_md2WithRSAEncryption: &[u8; 21] = b"md2WithRSAEncryption\0";
pub const NID_md2WithRSAEncryption: i32 = 7;
pub const SN_md5WithRSAEncryption: &[u8; 8] = b"RSA-MD5\0";
pub const LN_md5WithRSAEncryption: &[u8; 21] = b"md5WithRSAEncryption\0";
pub const NID_md5WithRSAEncryption: i32 = 8;
pub const SN_pbeWithMD2AndDES_CBC: &[u8; 12] = b"PBE-MD2-DES\0";
pub const LN_pbeWithMD2AndDES_CBC: &[u8; 21] = b"pbeWithMD2AndDES-CBC\0";
pub const NID_pbeWithMD2AndDES_CBC: i32 = 9;
pub const SN_pbeWithMD5AndDES_CBC: &[u8; 12] = b"PBE-MD5-DES\0";
pub const LN_pbeWithMD5AndDES_CBC: &[u8; 21] = b"pbeWithMD5AndDES-CBC\0";
pub const NID_pbeWithMD5AndDES_CBC: i32 = 10;
pub const SN_X500: &[u8; 5] = b"X500\0";
pub const LN_X500: &[u8; 27] = b"directory services (X.500)\0";
pub const NID_X500: i32 = 11;
pub const OBJ_ENC_X500: i32 = 85;
pub const SN_X509: &[u8; 5] = b"X509\0";
pub const NID_X509: i32 = 12;
pub const SN_commonName: &[u8; 3] = b"CN\0";
pub const LN_commonName: &[u8; 11] = b"commonName\0";
pub const NID_commonName: i32 = 13;
pub const SN_countryName: &[u8; 2] = b"C\0";
pub const LN_countryName: &[u8; 12] = b"countryName\0";
pub const NID_countryName: i32 = 14;
pub const SN_localityName: &[u8; 2] = b"L\0";
pub const LN_localityName: &[u8; 13] = b"localityName\0";
pub const NID_localityName: i32 = 15;
pub const SN_stateOrProvinceName: &[u8; 3] = b"ST\0";
pub const LN_stateOrProvinceName: &[u8; 20] = b"stateOrProvinceName\0";
pub const NID_stateOrProvinceName: i32 = 16;
pub const SN_organizationName: &[u8; 2] = b"O\0";
pub const LN_organizationName: &[u8; 17] = b"organizationName\0";
pub const NID_organizationName: i32 = 17;
pub const SN_organizationalUnitName: &[u8; 3] = b"OU\0";
pub const LN_organizationalUnitName: &[u8; 23] = b"organizationalUnitName\0";
pub const NID_organizationalUnitName: i32 = 18;
pub const SN_rsa: &[u8; 4] = b"RSA\0";
pub const LN_rsa: &[u8; 4] = b"rsa\0";
pub const NID_rsa: i32 = 19;
pub const SN_pkcs7: &[u8; 6] = b"pkcs7\0";
pub const NID_pkcs7: i32 = 20;
pub const LN_pkcs7_data: &[u8; 11] = b"pkcs7-data\0";
pub const NID_pkcs7_data: i32 = 21;
pub const LN_pkcs7_signed: &[u8; 17] = b"pkcs7-signedData\0";
pub const NID_pkcs7_signed: i32 = 22;
pub const LN_pkcs7_enveloped: &[u8; 20] = b"pkcs7-envelopedData\0";
pub const NID_pkcs7_enveloped: i32 = 23;
pub const LN_pkcs7_signedAndEnveloped: &[u8; 29] = b"pkcs7-signedAndEnvelopedData\0";
pub const NID_pkcs7_signedAndEnveloped: i32 = 24;
pub const LN_pkcs7_digest: &[u8; 17] = b"pkcs7-digestData\0";
pub const NID_pkcs7_digest: i32 = 25;
pub const LN_pkcs7_encrypted: &[u8; 20] = b"pkcs7-encryptedData\0";
pub const NID_pkcs7_encrypted: i32 = 26;
pub const SN_pkcs3: &[u8; 6] = b"pkcs3\0";
pub const NID_pkcs3: i32 = 27;
pub const LN_dhKeyAgreement: &[u8; 15] = b"dhKeyAgreement\0";
pub const NID_dhKeyAgreement: i32 = 28;
pub const SN_des_ecb: &[u8; 8] = b"DES-ECB\0";
pub const LN_des_ecb: &[u8; 8] = b"des-ecb\0";
pub const NID_des_ecb: i32 = 29;
pub const SN_des_cfb64: &[u8; 8] = b"DES-CFB\0";
pub const LN_des_cfb64: &[u8; 8] = b"des-cfb\0";
pub const NID_des_cfb64: i32 = 30;
pub const SN_des_cbc: &[u8; 8] = b"DES-CBC\0";
pub const LN_des_cbc: &[u8; 8] = b"des-cbc\0";
pub const NID_des_cbc: i32 = 31;
pub const SN_des_ede_ecb: &[u8; 8] = b"DES-EDE\0";
pub const LN_des_ede_ecb: &[u8; 8] = b"des-ede\0";
pub const NID_des_ede_ecb: i32 = 32;
pub const SN_des_ede3_ecb: &[u8; 9] = b"DES-EDE3\0";
pub const LN_des_ede3_ecb: &[u8; 9] = b"des-ede3\0";
pub const NID_des_ede3_ecb: i32 = 33;
pub const SN_idea_cbc: &[u8; 9] = b"IDEA-CBC\0";
pub const LN_idea_cbc: &[u8; 9] = b"idea-cbc\0";
pub const NID_idea_cbc: i32 = 34;
pub const SN_idea_cfb64: &[u8; 9] = b"IDEA-CFB\0";
pub const LN_idea_cfb64: &[u8; 9] = b"idea-cfb\0";
pub const NID_idea_cfb64: i32 = 35;
pub const SN_idea_ecb: &[u8; 9] = b"IDEA-ECB\0";
pub const LN_idea_ecb: &[u8; 9] = b"idea-ecb\0";
pub const NID_idea_ecb: i32 = 36;
pub const SN_rc2_cbc: &[u8; 8] = b"RC2-CBC\0";
pub const LN_rc2_cbc: &[u8; 8] = b"rc2-cbc\0";
pub const NID_rc2_cbc: i32 = 37;
pub const SN_rc2_ecb: &[u8; 8] = b"RC2-ECB\0";
pub const LN_rc2_ecb: &[u8; 8] = b"rc2-ecb\0";
pub const NID_rc2_ecb: i32 = 38;
pub const SN_rc2_cfb64: &[u8; 8] = b"RC2-CFB\0";
pub const LN_rc2_cfb64: &[u8; 8] = b"rc2-cfb\0";
pub const NID_rc2_cfb64: i32 = 39;
pub const SN_rc2_ofb64: &[u8; 8] = b"RC2-OFB\0";
pub const LN_rc2_ofb64: &[u8; 8] = b"rc2-ofb\0";
pub const NID_rc2_ofb64: i32 = 40;
pub const SN_sha: &[u8; 4] = b"SHA\0";
pub const LN_sha: &[u8; 4] = b"sha\0";
pub const NID_sha: i32 = 41;
pub const SN_shaWithRSAEncryption: &[u8; 8] = b"RSA-SHA\0";
pub const LN_shaWithRSAEncryption: &[u8; 21] = b"shaWithRSAEncryption\0";
pub const NID_shaWithRSAEncryption: i32 = 42;
pub const SN_des_ede_cbc: &[u8; 12] = b"DES-EDE-CBC\0";
pub const LN_des_ede_cbc: &[u8; 12] = b"des-ede-cbc\0";
pub const NID_des_ede_cbc: i32 = 43;
pub const SN_des_ede3_cbc: &[u8; 13] = b"DES-EDE3-CBC\0";
pub const LN_des_ede3_cbc: &[u8; 13] = b"des-ede3-cbc\0";
pub const NID_des_ede3_cbc: i32 = 44;
pub const SN_des_ofb64: &[u8; 8] = b"DES-OFB\0";
pub const LN_des_ofb64: &[u8; 8] = b"des-ofb\0";
pub const NID_des_ofb64: i32 = 45;
pub const SN_idea_ofb64: &[u8; 9] = b"IDEA-OFB\0";
pub const LN_idea_ofb64: &[u8; 9] = b"idea-ofb\0";
pub const NID_idea_ofb64: i32 = 46;
pub const SN_pkcs9: &[u8; 6] = b"pkcs9\0";
pub const NID_pkcs9: i32 = 47;
pub const LN_pkcs9_emailAddress: &[u8; 13] = b"emailAddress\0";
pub const NID_pkcs9_emailAddress: i32 = 48;
pub const LN_pkcs9_unstructuredName: &[u8; 17] = b"unstructuredName\0";
pub const NID_pkcs9_unstructuredName: i32 = 49;
pub const LN_pkcs9_contentType: &[u8; 12] = b"contentType\0";
pub const NID_pkcs9_contentType: i32 = 50;
pub const LN_pkcs9_messageDigest: &[u8; 14] = b"messageDigest\0";
pub const NID_pkcs9_messageDigest: i32 = 51;
pub const LN_pkcs9_signingTime: &[u8; 12] = b"signingTime\0";
pub const NID_pkcs9_signingTime: i32 = 52;
pub const LN_pkcs9_countersignature: &[u8; 17] = b"countersignature\0";
pub const NID_pkcs9_countersignature: i32 = 53;
pub const LN_pkcs9_challengePassword: &[u8; 18] = b"challengePassword\0";
pub const NID_pkcs9_challengePassword: i32 = 54;
pub const LN_pkcs9_unstructuredAddress: &[u8; 20] = b"unstructuredAddress\0";
pub const NID_pkcs9_unstructuredAddress: i32 = 55;
pub const LN_pkcs9_extCertAttributes: &[u8; 30] = b"extendedCertificateAttributes\0";
pub const NID_pkcs9_extCertAttributes: i32 = 56;
pub const SN_netscape: &[u8; 9] = b"Netscape\0";
pub const LN_netscape: &[u8; 30] = b"Netscape Communications Corp.\0";
pub const NID_netscape: i32 = 57;
pub const SN_netscape_cert_extension: &[u8; 10] = b"nsCertExt\0";
pub const LN_netscape_cert_extension: &[u8; 31] = b"Netscape Certificate Extension\0";
pub const NID_netscape_cert_extension: i32 = 58;
pub const SN_netscape_data_type: &[u8; 11] = b"nsDataType\0";
pub const LN_netscape_data_type: &[u8; 19] = b"Netscape Data Type\0";
pub const NID_netscape_data_type: i32 = 59;
pub const SN_des_ede_cfb64: &[u8; 12] = b"DES-EDE-CFB\0";
pub const LN_des_ede_cfb64: &[u8; 12] = b"des-ede-cfb\0";
pub const NID_des_ede_cfb64: i32 = 60;
pub const SN_des_ede3_cfb64: &[u8; 13] = b"DES-EDE3-CFB\0";
pub const LN_des_ede3_cfb64: &[u8; 13] = b"des-ede3-cfb\0";
pub const NID_des_ede3_cfb64: i32 = 61;
pub const SN_des_ede_ofb64: &[u8; 12] = b"DES-EDE-OFB\0";
pub const LN_des_ede_ofb64: &[u8; 12] = b"des-ede-ofb\0";
pub const NID_des_ede_ofb64: i32 = 62;
pub const SN_des_ede3_ofb64: &[u8; 13] = b"DES-EDE3-OFB\0";
pub const LN_des_ede3_ofb64: &[u8; 13] = b"des-ede3-ofb\0";
pub const NID_des_ede3_ofb64: i32 = 63;
pub const SN_sha1: &[u8; 5] = b"SHA1\0";
pub const LN_sha1: &[u8; 5] = b"sha1\0";
pub const NID_sha1: i32 = 64;
pub const SN_sha1WithRSAEncryption: &[u8; 9] = b"RSA-SHA1\0";
pub const LN_sha1WithRSAEncryption: &[u8; 22] = b"sha1WithRSAEncryption\0";
pub const NID_sha1WithRSAEncryption: i32 = 65;
pub const SN_dsaWithSHA: &[u8; 8] = b"DSA-SHA\0";
pub const LN_dsaWithSHA: &[u8; 11] = b"dsaWithSHA\0";
pub const NID_dsaWithSHA: i32 = 66;
pub const SN_dsa_2: &[u8; 8] = b"DSA-old\0";
pub const LN_dsa_2: &[u8; 18] = b"dsaEncryption-old\0";
pub const NID_dsa_2: i32 = 67;
pub const SN_pbeWithSHA1AndRC2_CBC: &[u8; 16] = b"PBE-SHA1-RC2-64\0";
pub const LN_pbeWithSHA1AndRC2_CBC: &[u8; 22] = b"pbeWithSHA1AndRC2-CBC\0";
pub const NID_pbeWithSHA1AndRC2_CBC: i32 = 68;
pub const LN_id_pbkdf2: &[u8; 7] = b"PBKDF2\0";
pub const NID_id_pbkdf2: i32 = 69;
pub const SN_dsaWithSHA1_2: &[u8; 13] = b"DSA-SHA1-old\0";
pub const LN_dsaWithSHA1_2: &[u8; 16] = b"dsaWithSHA1-old\0";
pub const NID_dsaWithSHA1_2: i32 = 70;
pub const SN_netscape_cert_type: &[u8; 11] = b"nsCertType\0";
pub const LN_netscape_cert_type: &[u8; 19] = b"Netscape Cert Type\0";
pub const NID_netscape_cert_type: i32 = 71;
pub const SN_netscape_base_url: &[u8; 10] = b"nsBaseUrl\0";
pub const LN_netscape_base_url: &[u8; 18] = b"Netscape Base Url\0";
pub const NID_netscape_base_url: i32 = 72;
pub const SN_netscape_revocation_url: &[u8; 16] = b"nsRevocationUrl\0";
pub const LN_netscape_revocation_url: &[u8; 24] = b"Netscape Revocation Url\0";
pub const NID_netscape_revocation_url: i32 = 73;
pub const SN_netscape_ca_revocation_url: &[u8; 18] = b"nsCaRevocationUrl\0";
pub const LN_netscape_ca_revocation_url: &[u8; 27] = b"Netscape CA Revocation Url\0";
pub const NID_netscape_ca_revocation_url: i32 = 74;
pub const SN_netscape_renewal_url: &[u8; 13] = b"nsRenewalUrl\0";
pub const LN_netscape_renewal_url: &[u8; 21] = b"Netscape Renewal Url\0";
pub const NID_netscape_renewal_url: i32 = 75;
pub const SN_netscape_ca_policy_url: &[u8; 14] = b"nsCaPolicyUrl\0";
pub const LN_netscape_ca_policy_url: &[u8; 23] = b"Netscape CA Policy Url\0";
pub const NID_netscape_ca_policy_url: i32 = 76;
pub const SN_netscape_ssl_server_name: &[u8; 16] = b"nsSslServerName\0";
pub const LN_netscape_ssl_server_name: &[u8; 25] = b"Netscape SSL Server Name\0";
pub const NID_netscape_ssl_server_name: i32 = 77;
pub const SN_netscape_comment: &[u8; 10] = b"nsComment\0";
pub const LN_netscape_comment: &[u8; 17] = b"Netscape Comment\0";
pub const NID_netscape_comment: i32 = 78;
pub const SN_netscape_cert_sequence: &[u8; 15] = b"nsCertSequence\0";
pub const LN_netscape_cert_sequence: &[u8; 30] = b"Netscape Certificate Sequence\0";
pub const NID_netscape_cert_sequence: i32 = 79;
pub const SN_desx_cbc: &[u8; 9] = b"DESX-CBC\0";
pub const LN_desx_cbc: &[u8; 9] = b"desx-cbc\0";
pub const NID_desx_cbc: i32 = 80;
pub const SN_id_ce: &[u8; 6] = b"id-ce\0";
pub const NID_id_ce: i32 = 81;
pub const SN_subject_key_identifier: &[u8; 21] = b"subjectKeyIdentifier\0";
pub const LN_subject_key_identifier: &[u8; 30] = b"X509v3 Subject Key Identifier\0";
pub const NID_subject_key_identifier: i32 = 82;
pub const SN_key_usage: &[u8; 9] = b"keyUsage\0";
pub const LN_key_usage: &[u8; 17] = b"X509v3 Key Usage\0";
pub const NID_key_usage: i32 = 83;
pub const SN_private_key_usage_period: &[u8; 22] = b"privateKeyUsagePeriod\0";
pub const LN_private_key_usage_period: &[u8; 32] = b"X509v3 Private Key Usage Period\0";
pub const NID_private_key_usage_period: i32 = 84;
pub const SN_subject_alt_name: &[u8; 15] = b"subjectAltName\0";
pub const LN_subject_alt_name: &[u8; 32] = b"X509v3 Subject Alternative Name\0";
pub const NID_subject_alt_name: i32 = 85;
pub const SN_issuer_alt_name: &[u8; 14] = b"issuerAltName\0";
pub const LN_issuer_alt_name: &[u8; 31] = b"X509v3 Issuer Alternative Name\0";
pub const NID_issuer_alt_name: i32 = 86;
pub const SN_basic_constraints: &[u8; 17] = b"basicConstraints\0";
pub const LN_basic_constraints: &[u8; 25] = b"X509v3 Basic Constraints\0";
pub const NID_basic_constraints: i32 = 87;
pub const SN_crl_number: &[u8; 10] = b"crlNumber\0";
pub const LN_crl_number: &[u8; 18] = b"X509v3 CRL Number\0";
pub const NID_crl_number: i32 = 88;
pub const SN_certificate_policies: &[u8; 20] = b"certificatePolicies\0";
pub const LN_certificate_policies: &[u8; 28] = b"X509v3 Certificate Policies\0";
pub const NID_certificate_policies: i32 = 89;
pub const SN_authority_key_identifier: &[u8; 23] = b"authorityKeyIdentifier\0";
pub const LN_authority_key_identifier: &[u8; 32] = b"X509v3 Authority Key Identifier\0";
pub const NID_authority_key_identifier: i32 = 90;
pub const SN_bf_cbc: &[u8; 7] = b"BF-CBC\0";
pub const LN_bf_cbc: &[u8; 7] = b"bf-cbc\0";
pub const NID_bf_cbc: i32 = 91;
pub const SN_bf_ecb: &[u8; 7] = b"BF-ECB\0";
pub const LN_bf_ecb: &[u8; 7] = b"bf-ecb\0";
pub const NID_bf_ecb: i32 = 92;
pub const SN_bf_cfb64: &[u8; 7] = b"BF-CFB\0";
pub const LN_bf_cfb64: &[u8; 7] = b"bf-cfb\0";
pub const NID_bf_cfb64: i32 = 93;
pub const SN_bf_ofb64: &[u8; 7] = b"BF-OFB\0";
pub const LN_bf_ofb64: &[u8; 7] = b"bf-ofb\0";
pub const NID_bf_ofb64: i32 = 94;
pub const SN_mdc2: &[u8; 5] = b"MDC2\0";
pub const LN_mdc2: &[u8; 5] = b"mdc2\0";
pub const NID_mdc2: i32 = 95;
pub const SN_mdc2WithRSA: &[u8; 9] = b"RSA-MDC2\0";
pub const LN_mdc2WithRSA: &[u8; 12] = b"mdc2WithRSA\0";
pub const NID_mdc2WithRSA: i32 = 96;
pub const SN_rc4_40: &[u8; 7] = b"RC4-40\0";
pub const LN_rc4_40: &[u8; 7] = b"rc4-40\0";
pub const NID_rc4_40: i32 = 97;
pub const SN_rc2_40_cbc: &[u8; 11] = b"RC2-40-CBC\0";
pub const LN_rc2_40_cbc: &[u8; 11] = b"rc2-40-cbc\0";
pub const NID_rc2_40_cbc: i32 = 98;
pub const SN_givenName: &[u8; 3] = b"GN\0";
pub const LN_givenName: &[u8; 10] = b"givenName\0";
pub const NID_givenName: i32 = 99;
pub const SN_surname: &[u8; 3] = b"SN\0";
pub const LN_surname: &[u8; 8] = b"surname\0";
pub const NID_surname: i32 = 100;
pub const SN_initials: &[u8; 9] = b"initials\0";
pub const LN_initials: &[u8; 9] = b"initials\0";
pub const NID_initials: i32 = 101;
pub const SN_crl_distribution_points: &[u8; 22] = b"crlDistributionPoints\0";
pub const LN_crl_distribution_points: &[u8; 31] = b"X509v3 CRL Distribution Points\0";
pub const NID_crl_distribution_points: i32 = 103;
pub const SN_md5WithRSA: &[u8; 11] = b"RSA-NP-MD5\0";
pub const LN_md5WithRSA: &[u8; 11] = b"md5WithRSA\0";
pub const NID_md5WithRSA: i32 = 104;
pub const LN_serialNumber: &[u8; 13] = b"serialNumber\0";
pub const NID_serialNumber: i32 = 105;
pub const SN_title: &[u8; 6] = b"title\0";
pub const LN_title: &[u8; 6] = b"title\0";
pub const NID_title: i32 = 106;
pub const LN_description: &[u8; 12] = b"description\0";
pub const NID_description: i32 = 107;
pub const SN_cast5_cbc: &[u8; 10] = b"CAST5-CBC\0";
pub const LN_cast5_cbc: &[u8; 10] = b"cast5-cbc\0";
pub const NID_cast5_cbc: i32 = 108;
pub const SN_cast5_ecb: &[u8; 10] = b"CAST5-ECB\0";
pub const LN_cast5_ecb: &[u8; 10] = b"cast5-ecb\0";
pub const NID_cast5_ecb: i32 = 109;
pub const SN_cast5_cfb64: &[u8; 10] = b"CAST5-CFB\0";
pub const LN_cast5_cfb64: &[u8; 10] = b"cast5-cfb\0";
pub const NID_cast5_cfb64: i32 = 110;
pub const SN_cast5_ofb64: &[u8; 10] = b"CAST5-OFB\0";
pub const LN_cast5_ofb64: &[u8; 10] = b"cast5-ofb\0";
pub const NID_cast5_ofb64: i32 = 111;
pub const LN_pbeWithMD5AndCast5_CBC: &[u8; 22] = b"pbeWithMD5AndCast5CBC\0";
pub const NID_pbeWithMD5AndCast5_CBC: i32 = 112;
pub const SN_dsaWithSHA1: &[u8; 9] = b"DSA-SHA1\0";
pub const LN_dsaWithSHA1: &[u8; 12] = b"dsaWithSHA1\0";
pub const NID_dsaWithSHA1: i32 = 113;
pub const SN_md5_sha1: &[u8; 9] = b"MD5-SHA1\0";
pub const LN_md5_sha1: &[u8; 9] = b"md5-sha1\0";
pub const NID_md5_sha1: i32 = 114;
pub const SN_sha1WithRSA: &[u8; 11] = b"RSA-SHA1-2\0";
pub const LN_sha1WithRSA: &[u8; 12] = b"sha1WithRSA\0";
pub const NID_sha1WithRSA: i32 = 115;
pub const SN_dsa: &[u8; 4] = b"DSA\0";
pub const LN_dsa: &[u8; 14] = b"dsaEncryption\0";
pub const NID_dsa: i32 = 116;
pub const SN_ripemd160: &[u8; 10] = b"RIPEMD160\0";
pub const LN_ripemd160: &[u8; 10] = b"ripemd160\0";
pub const NID_ripemd160: i32 = 117;
pub const SN_ripemd160WithRSA: &[u8; 14] = b"RSA-RIPEMD160\0";
pub const LN_ripemd160WithRSA: &[u8; 17] = b"ripemd160WithRSA\0";
pub const NID_ripemd160WithRSA: i32 = 119;
pub const SN_rc5_cbc: &[u8; 8] = b"RC5-CBC\0";
pub const LN_rc5_cbc: &[u8; 8] = b"rc5-cbc\0";
pub const NID_rc5_cbc: i32 = 120;
pub const SN_rc5_ecb: &[u8; 8] = b"RC5-ECB\0";
pub const LN_rc5_ecb: &[u8; 8] = b"rc5-ecb\0";
pub const NID_rc5_ecb: i32 = 121;
pub const SN_rc5_cfb64: &[u8; 8] = b"RC5-CFB\0";
pub const LN_rc5_cfb64: &[u8; 8] = b"rc5-cfb\0";
pub const NID_rc5_cfb64: i32 = 122;
pub const SN_rc5_ofb64: &[u8; 8] = b"RC5-OFB\0";
pub const LN_rc5_ofb64: &[u8; 8] = b"rc5-ofb\0";
pub const NID_rc5_ofb64: i32 = 123;
pub const SN_zlib_compression: &[u8; 5] = b"ZLIB\0";
pub const LN_zlib_compression: &[u8; 17] = b"zlib compression\0";
pub const NID_zlib_compression: i32 = 125;
pub const SN_ext_key_usage: &[u8; 17] = b"extendedKeyUsage\0";
pub const LN_ext_key_usage: &[u8; 26] = b"X509v3 Extended Key Usage\0";
pub const NID_ext_key_usage: i32 = 126;
pub const SN_id_pkix: &[u8; 5] = b"PKIX\0";
pub const NID_id_pkix: i32 = 127;
pub const SN_id_kp: &[u8; 6] = b"id-kp\0";
pub const NID_id_kp: i32 = 128;
pub const SN_server_auth: &[u8; 11] = b"serverAuth\0";
pub const LN_server_auth: &[u8; 30] = b"TLS Web Server Authentication\0";
pub const NID_server_auth: i32 = 129;
pub const SN_client_auth: &[u8; 11] = b"clientAuth\0";
pub const LN_client_auth: &[u8; 30] = b"TLS Web Client Authentication\0";
pub const NID_client_auth: i32 = 130;
pub const SN_code_sign: &[u8; 12] = b"codeSigning\0";
pub const LN_code_sign: &[u8; 13] = b"Code Signing\0";
pub const NID_code_sign: i32 = 131;
pub const SN_email_protect: &[u8; 16] = b"emailProtection\0";
pub const LN_email_protect: &[u8; 18] = b"E-mail Protection\0";
pub const NID_email_protect: i32 = 132;
pub const SN_time_stamp: &[u8; 13] = b"timeStamping\0";
pub const LN_time_stamp: &[u8; 14] = b"Time Stamping\0";
pub const NID_time_stamp: i32 = 133;
pub const SN_ms_code_ind: &[u8; 10] = b"msCodeInd\0";
pub const LN_ms_code_ind: &[u8; 34] = b"Microsoft Individual Code Signing\0";
pub const NID_ms_code_ind: i32 = 134;
pub const SN_ms_code_com: &[u8; 10] = b"msCodeCom\0";
pub const LN_ms_code_com: &[u8; 34] = b"Microsoft Commercial Code Signing\0";
pub const NID_ms_code_com: i32 = 135;
pub const SN_ms_ctl_sign: &[u8; 10] = b"msCTLSign\0";
pub const LN_ms_ctl_sign: &[u8; 29] = b"Microsoft Trust List Signing\0";
pub const NID_ms_ctl_sign: i32 = 136;
pub const SN_ms_sgc: &[u8; 6] = b"msSGC\0";
pub const LN_ms_sgc: &[u8; 30] = b"Microsoft Server Gated Crypto\0";
pub const NID_ms_sgc: i32 = 137;
pub const SN_ms_efs: &[u8; 6] = b"msEFS\0";
pub const LN_ms_efs: &[u8; 32] = b"Microsoft Encrypted File System\0";
pub const NID_ms_efs: i32 = 138;
pub const SN_ns_sgc: &[u8; 6] = b"nsSGC\0";
pub const LN_ns_sgc: &[u8; 29] = b"Netscape Server Gated Crypto\0";
pub const NID_ns_sgc: i32 = 139;
pub const SN_delta_crl: &[u8; 9] = b"deltaCRL\0";
pub const LN_delta_crl: &[u8; 27] = b"X509v3 Delta CRL Indicator\0";
pub const NID_delta_crl: i32 = 140;
pub const SN_crl_reason: &[u8; 10] = b"CRLReason\0";
pub const LN_crl_reason: &[u8; 23] = b"X509v3 CRL Reason Code\0";
pub const NID_crl_reason: i32 = 141;
pub const SN_invalidity_date: &[u8; 15] = b"invalidityDate\0";
pub const LN_invalidity_date: &[u8; 16] = b"Invalidity Date\0";
pub const NID_invalidity_date: i32 = 142;
pub const SN_sxnet: &[u8; 8] = b"SXNetID\0";
pub const LN_sxnet: &[u8; 19] = b"Strong Extranet ID\0";
pub const NID_sxnet: i32 = 143;
pub const SN_pbe_WithSHA1And128BitRC4: &[u8; 17] = b"PBE-SHA1-RC4-128\0";
pub const LN_pbe_WithSHA1And128BitRC4: &[u8; 24] = b"pbeWithSHA1And128BitRC4\0";
pub const NID_pbe_WithSHA1And128BitRC4: i32 = 144;
pub const SN_pbe_WithSHA1And40BitRC4: &[u8; 16] = b"PBE-SHA1-RC4-40\0";
pub const LN_pbe_WithSHA1And40BitRC4: &[u8; 23] = b"pbeWithSHA1And40BitRC4\0";
pub const NID_pbe_WithSHA1And40BitRC4: i32 = 145;
pub const SN_pbe_WithSHA1And3_Key_TripleDES_CBC: &[u8; 14] = b"PBE-SHA1-3DES\0";
pub const LN_pbe_WithSHA1And3_Key_TripleDES_CBC: &[u8; 33] = b"pbeWithSHA1And3-KeyTripleDES-CBC\0";
pub const NID_pbe_WithSHA1And3_Key_TripleDES_CBC: i32 = 146;
pub const SN_pbe_WithSHA1And2_Key_TripleDES_CBC: &[u8; 14] = b"PBE-SHA1-2DES\0";
pub const LN_pbe_WithSHA1And2_Key_TripleDES_CBC: &[u8; 33] = b"pbeWithSHA1And2-KeyTripleDES-CBC\0";
pub const NID_pbe_WithSHA1And2_Key_TripleDES_CBC: i32 = 147;
pub const SN_pbe_WithSHA1And128BitRC2_CBC: &[u8; 17] = b"PBE-SHA1-RC2-128\0";
pub const LN_pbe_WithSHA1And128BitRC2_CBC: &[u8; 28] = b"pbeWithSHA1And128BitRC2-CBC\0";
pub const NID_pbe_WithSHA1And128BitRC2_CBC: i32 = 148;
pub const SN_pbe_WithSHA1And40BitRC2_CBC: &[u8; 16] = b"PBE-SHA1-RC2-40\0";
pub const LN_pbe_WithSHA1And40BitRC2_CBC: &[u8; 27] = b"pbeWithSHA1And40BitRC2-CBC\0";
pub const NID_pbe_WithSHA1And40BitRC2_CBC: i32 = 149;
pub const LN_keyBag: &[u8; 7] = b"keyBag\0";
pub const NID_keyBag: i32 = 150;
pub const LN_pkcs8ShroudedKeyBag: &[u8; 20] = b"pkcs8ShroudedKeyBag\0";
pub const NID_pkcs8ShroudedKeyBag: i32 = 151;
pub const LN_certBag: &[u8; 8] = b"certBag\0";
pub const NID_certBag: i32 = 152;
pub const LN_crlBag: &[u8; 7] = b"crlBag\0";
pub const NID_crlBag: i32 = 153;
pub const LN_secretBag: &[u8; 10] = b"secretBag\0";
pub const NID_secretBag: i32 = 154;
pub const LN_safeContentsBag: &[u8; 16] = b"safeContentsBag\0";
pub const NID_safeContentsBag: i32 = 155;
pub const LN_friendlyName: &[u8; 13] = b"friendlyName\0";
pub const NID_friendlyName: i32 = 156;
pub const LN_localKeyID: &[u8; 11] = b"localKeyID\0";
pub const NID_localKeyID: i32 = 157;
pub const LN_x509Certificate: &[u8; 16] = b"x509Certificate\0";
pub const NID_x509Certificate: i32 = 158;
pub const LN_sdsiCertificate: &[u8; 16] = b"sdsiCertificate\0";
pub const NID_sdsiCertificate: i32 = 159;
pub const LN_x509Crl: &[u8; 8] = b"x509Crl\0";
pub const NID_x509Crl: i32 = 160;
pub const LN_pbes2: &[u8; 6] = b"PBES2\0";
pub const NID_pbes2: i32 = 161;
pub const LN_pbmac1: &[u8; 7] = b"PBMAC1\0";
pub const NID_pbmac1: i32 = 162;
pub const LN_hmacWithSHA1: &[u8; 13] = b"hmacWithSHA1\0";
pub const NID_hmacWithSHA1: i32 = 163;
pub const SN_id_qt_cps: &[u8; 10] = b"id-qt-cps\0";
pub const LN_id_qt_cps: &[u8; 21] = b"Policy Qualifier CPS\0";
pub const NID_id_qt_cps: i32 = 164;
pub const SN_id_qt_unotice: &[u8; 14] = b"id-qt-unotice\0";
pub const LN_id_qt_unotice: &[u8; 29] = b"Policy Qualifier User Notice\0";
pub const NID_id_qt_unotice: i32 = 165;
pub const SN_rc2_64_cbc: &[u8; 11] = b"RC2-64-CBC\0";
pub const LN_rc2_64_cbc: &[u8; 11] = b"rc2-64-cbc\0";
pub const NID_rc2_64_cbc: i32 = 166;
pub const SN_SMIMECapabilities: &[u8; 11] = b"SMIME-CAPS\0";
pub const LN_SMIMECapabilities: &[u8; 20] = b"S/MIME Capabilities\0";
pub const NID_SMIMECapabilities: i32 = 167;
pub const SN_pbeWithMD2AndRC2_CBC: &[u8; 15] = b"PBE-MD2-RC2-64\0";
pub const LN_pbeWithMD2AndRC2_CBC: &[u8; 21] = b"pbeWithMD2AndRC2-CBC\0";
pub const NID_pbeWithMD2AndRC2_CBC: i32 = 168;
pub const SN_pbeWithMD5AndRC2_CBC: &[u8; 15] = b"PBE-MD5-RC2-64\0";
pub const LN_pbeWithMD5AndRC2_CBC: &[u8; 21] = b"pbeWithMD5AndRC2-CBC\0";
pub const NID_pbeWithMD5AndRC2_CBC: i32 = 169;
pub const SN_pbeWithSHA1AndDES_CBC: &[u8; 13] = b"PBE-SHA1-DES\0";
pub const LN_pbeWithSHA1AndDES_CBC: &[u8; 22] = b"pbeWithSHA1AndDES-CBC\0";
pub const NID_pbeWithSHA1AndDES_CBC: i32 = 170;
pub const SN_ms_ext_req: &[u8; 9] = b"msExtReq\0";
pub const LN_ms_ext_req: &[u8; 28] = b"Microsoft Extension Request\0";
pub const NID_ms_ext_req: i32 = 171;
pub const SN_ext_req: &[u8; 7] = b"extReq\0";
pub const LN_ext_req: &[u8; 18] = b"Extension Request\0";
pub const NID_ext_req: i32 = 172;
pub const SN_name: &[u8; 5] = b"name\0";
pub const LN_name: &[u8; 5] = b"name\0";
pub const NID_name: i32 = 173;
pub const SN_dnQualifier: &[u8; 12] = b"dnQualifier\0";
pub const LN_dnQualifier: &[u8; 12] = b"dnQualifier\0";
pub const NID_dnQualifier: i32 = 174;
pub const SN_id_pe: &[u8; 6] = b"id-pe\0";
pub const NID_id_pe: i32 = 175;
pub const SN_id_ad: &[u8; 6] = b"id-ad\0";
pub const NID_id_ad: i32 = 176;
pub const SN_info_access: &[u8; 20] = b"authorityInfoAccess\0";
pub const LN_info_access: &[u8; 29] = b"Authority Information Access\0";
pub const NID_info_access: i32 = 177;
pub const SN_ad_OCSP: &[u8; 5] = b"OCSP\0";
pub const LN_ad_OCSP: &[u8; 5] = b"OCSP\0";
pub const NID_ad_OCSP: i32 = 178;
pub const SN_ad_ca_issuers: &[u8; 10] = b"caIssuers\0";
pub const LN_ad_ca_issuers: &[u8; 11] = b"CA Issuers\0";
pub const NID_ad_ca_issuers: i32 = 179;
pub const SN_OCSP_sign: &[u8; 12] = b"OCSPSigning\0";
pub const LN_OCSP_sign: &[u8; 13] = b"OCSP Signing\0";
pub const NID_OCSP_sign: i32 = 180;
pub const SN_iso: &[u8; 4] = b"ISO\0";
pub const LN_iso: &[u8; 4] = b"iso\0";
pub const NID_iso: i32 = 181;
pub const OBJ_iso: i32 = 1;
pub const SN_member_body: &[u8; 12] = b"member-body\0";
pub const LN_member_body: &[u8; 16] = b"ISO Member Body\0";
pub const NID_member_body: i32 = 182;
pub const OBJ_ENC_member_body: i32 = 42;
pub const SN_ISO_US: &[u8; 7] = b"ISO-US\0";
pub const LN_ISO_US: &[u8; 19] = b"ISO US Member Body\0";
pub const NID_ISO_US: i32 = 183;
pub const SN_X9_57: &[u8; 6] = b"X9-57\0";
pub const LN_X9_57: &[u8; 6] = b"X9.57\0";
pub const NID_X9_57: i32 = 184;
pub const SN_X9cm: &[u8; 5] = b"X9cm\0";
pub const LN_X9cm: &[u8; 11] = b"X9.57 CM ?\0";
pub const NID_X9cm: i32 = 185;
pub const SN_pkcs1: &[u8; 6] = b"pkcs1\0";
pub const NID_pkcs1: i32 = 186;
pub const SN_pkcs5: &[u8; 6] = b"pkcs5\0";
pub const NID_pkcs5: i32 = 187;
pub const SN_SMIME: &[u8; 6] = b"SMIME\0";
pub const LN_SMIME: &[u8; 7] = b"S/MIME\0";
pub const NID_SMIME: i32 = 188;
pub const SN_id_smime_mod: &[u8; 13] = b"id-smime-mod\0";
pub const NID_id_smime_mod: i32 = 189;
pub const SN_id_smime_ct: &[u8; 12] = b"id-smime-ct\0";
pub const NID_id_smime_ct: i32 = 190;
pub const SN_id_smime_aa: &[u8; 12] = b"id-smime-aa\0";
pub const NID_id_smime_aa: i32 = 191;
pub const SN_id_smime_alg: &[u8; 13] = b"id-smime-alg\0";
pub const NID_id_smime_alg: i32 = 192;
pub const SN_id_smime_cd: &[u8; 12] = b"id-smime-cd\0";
pub const NID_id_smime_cd: i32 = 193;
pub const SN_id_smime_spq: &[u8; 13] = b"id-smime-spq\0";
pub const NID_id_smime_spq: i32 = 194;
pub const SN_id_smime_cti: &[u8; 13] = b"id-smime-cti\0";
pub const NID_id_smime_cti: i32 = 195;
pub const SN_id_smime_mod_cms: &[u8; 17] = b"id-smime-mod-cms\0";
pub const NID_id_smime_mod_cms: i32 = 196;
pub const SN_id_smime_mod_ess: &[u8; 17] = b"id-smime-mod-ess\0";
pub const NID_id_smime_mod_ess: i32 = 197;
pub const SN_id_smime_mod_oid: &[u8; 17] = b"id-smime-mod-oid\0";
pub const NID_id_smime_mod_oid: i32 = 198;
pub const SN_id_smime_mod_msg_v3: &[u8; 20] = b"id-smime-mod-msg-v3\0";
pub const NID_id_smime_mod_msg_v3: i32 = 199;
pub const SN_id_smime_mod_ets_eSignature_88: &[u8; 31] = b"id-smime-mod-ets-eSignature-88\0";
pub const NID_id_smime_mod_ets_eSignature_88: i32 = 200;
pub const SN_id_smime_mod_ets_eSignature_97: &[u8; 31] = b"id-smime-mod-ets-eSignature-97\0";
pub const NID_id_smime_mod_ets_eSignature_97: i32 = 201;
pub const SN_id_smime_mod_ets_eSigPolicy_88: &[u8; 31] = b"id-smime-mod-ets-eSigPolicy-88\0";
pub const NID_id_smime_mod_ets_eSigPolicy_88: i32 = 202;
pub const SN_id_smime_mod_ets_eSigPolicy_97: &[u8; 31] = b"id-smime-mod-ets-eSigPolicy-97\0";
pub const NID_id_smime_mod_ets_eSigPolicy_97: i32 = 203;
pub const SN_id_smime_ct_receipt: &[u8; 20] = b"id-smime-ct-receipt\0";
pub const NID_id_smime_ct_receipt: i32 = 204;
pub const SN_id_smime_ct_authData: &[u8; 21] = b"id-smime-ct-authData\0";
pub const NID_id_smime_ct_authData: i32 = 205;
pub const SN_id_smime_ct_publishCert: &[u8; 24] = b"id-smime-ct-publishCert\0";
pub const NID_id_smime_ct_publishCert: i32 = 206;
pub const SN_id_smime_ct_TSTInfo: &[u8; 20] = b"id-smime-ct-TSTInfo\0";
pub const NID_id_smime_ct_TSTInfo: i32 = 207;
pub const SN_id_smime_ct_TDTInfo: &[u8; 20] = b"id-smime-ct-TDTInfo\0";
pub const NID_id_smime_ct_TDTInfo: i32 = 208;
pub const SN_id_smime_ct_contentInfo: &[u8; 24] = b"id-smime-ct-contentInfo\0";
pub const NID_id_smime_ct_contentInfo: i32 = 209;
pub const SN_id_smime_ct_DVCSRequestData: &[u8; 28] = b"id-smime-ct-DVCSRequestData\0";
pub const NID_id_smime_ct_DVCSRequestData: i32 = 210;
pub const SN_id_smime_ct_DVCSResponseData: &[u8; 29] = b"id-smime-ct-DVCSResponseData\0";
pub const NID_id_smime_ct_DVCSResponseData: i32 = 211;
pub const SN_id_smime_aa_receiptRequest: &[u8; 27] = b"id-smime-aa-receiptRequest\0";
pub const NID_id_smime_aa_receiptRequest: i32 = 212;
pub const SN_id_smime_aa_securityLabel: &[u8; 26] = b"id-smime-aa-securityLabel\0";
pub const NID_id_smime_aa_securityLabel: i32 = 213;
pub const SN_id_smime_aa_mlExpandHistory: &[u8; 28] = b"id-smime-aa-mlExpandHistory\0";
pub const NID_id_smime_aa_mlExpandHistory: i32 = 214;
pub const SN_id_smime_aa_contentHint: &[u8; 24] = b"id-smime-aa-contentHint\0";
pub const NID_id_smime_aa_contentHint: i32 = 215;
pub const SN_id_smime_aa_msgSigDigest: &[u8; 25] = b"id-smime-aa-msgSigDigest\0";
pub const NID_id_smime_aa_msgSigDigest: i32 = 216;
pub const SN_id_smime_aa_encapContentType: &[u8; 29] = b"id-smime-aa-encapContentType\0";
pub const NID_id_smime_aa_encapContentType: i32 = 217;
pub const SN_id_smime_aa_contentIdentifier: &[u8; 30] = b"id-smime-aa-contentIdentifier\0";
pub const NID_id_smime_aa_contentIdentifier: i32 = 218;
pub const SN_id_smime_aa_macValue: &[u8; 21] = b"id-smime-aa-macValue\0";
pub const NID_id_smime_aa_macValue: i32 = 219;
pub const SN_id_smime_aa_equivalentLabels: &[u8; 29] = b"id-smime-aa-equivalentLabels\0";
pub const NID_id_smime_aa_equivalentLabels: i32 = 220;
pub const SN_id_smime_aa_contentReference: &[u8; 29] = b"id-smime-aa-contentReference\0";
pub const NID_id_smime_aa_contentReference: i32 = 221;
pub const SN_id_smime_aa_encrypKeyPref: &[u8; 26] = b"id-smime-aa-encrypKeyPref\0";
pub const NID_id_smime_aa_encrypKeyPref: i32 = 222;
pub const SN_id_smime_aa_signingCertificate: &[u8; 31] = b"id-smime-aa-signingCertificate\0";
pub const NID_id_smime_aa_signingCertificate: i32 = 223;
pub const SN_id_smime_aa_smimeEncryptCerts: &[u8; 30] = b"id-smime-aa-smimeEncryptCerts\0";
pub const NID_id_smime_aa_smimeEncryptCerts: i32 = 224;
pub const SN_id_smime_aa_timeStampToken: &[u8; 27] = b"id-smime-aa-timeStampToken\0";
pub const NID_id_smime_aa_timeStampToken: i32 = 225;
pub const SN_id_smime_aa_ets_sigPolicyId: &[u8; 28] = b"id-smime-aa-ets-sigPolicyId\0";
pub const NID_id_smime_aa_ets_sigPolicyId: i32 = 226;
pub const SN_id_smime_aa_ets_commitmentType: &[u8; 31] = b"id-smime-aa-ets-commitmentType\0";
pub const NID_id_smime_aa_ets_commitmentType: i32 = 227;
pub const SN_id_smime_aa_ets_signerLocation: &[u8; 31] = b"id-smime-aa-ets-signerLocation\0";
pub const NID_id_smime_aa_ets_signerLocation: i32 = 228;
pub const SN_id_smime_aa_ets_signerAttr: &[u8; 27] = b"id-smime-aa-ets-signerAttr\0";
pub const NID_id_smime_aa_ets_signerAttr: i32 = 229;
pub const SN_id_smime_aa_ets_otherSigCert: &[u8; 29] = b"id-smime-aa-ets-otherSigCert\0";
pub const NID_id_smime_aa_ets_otherSigCert: i32 = 230;
pub const SN_id_smime_aa_ets_contentTimestamp: &[u8; 33] = b"id-smime-aa-ets-contentTimestamp\0";
pub const NID_id_smime_aa_ets_contentTimestamp: i32 = 231;
pub const SN_id_smime_aa_ets_CertificateRefs: &[u8; 32] = b"id-smime-aa-ets-CertificateRefs\0";
pub const NID_id_smime_aa_ets_CertificateRefs: i32 = 232;
pub const SN_id_smime_aa_ets_RevocationRefs: &[u8; 31] = b"id-smime-aa-ets-RevocationRefs\0";
pub const NID_id_smime_aa_ets_RevocationRefs: i32 = 233;
pub const SN_id_smime_aa_ets_certValues: &[u8; 27] = b"id-smime-aa-ets-certValues\0";
pub const NID_id_smime_aa_ets_certValues: i32 = 234;
pub const SN_id_smime_aa_ets_revocationValues: &[u8; 33] = b"id-smime-aa-ets-revocationValues\0";
pub const NID_id_smime_aa_ets_revocationValues: i32 = 235;
pub const SN_id_smime_aa_ets_escTimeStamp: &[u8; 29] = b"id-smime-aa-ets-escTimeStamp\0";
pub const NID_id_smime_aa_ets_escTimeStamp: i32 = 236;
pub const SN_id_smime_aa_ets_certCRLTimestamp: &[u8; 33] = b"id-smime-aa-ets-certCRLTimestamp\0";
pub const NID_id_smime_aa_ets_certCRLTimestamp: i32 = 237;
pub const SN_id_smime_aa_ets_archiveTimeStamp: &[u8; 33] = b"id-smime-aa-ets-archiveTimeStamp\0";
pub const NID_id_smime_aa_ets_archiveTimeStamp: i32 = 238;
pub const SN_id_smime_aa_signatureType: &[u8; 26] = b"id-smime-aa-signatureType\0";
pub const NID_id_smime_aa_signatureType: i32 = 239;
pub const SN_id_smime_aa_dvcs_dvc: &[u8; 21] = b"id-smime-aa-dvcs-dvc\0";
pub const NID_id_smime_aa_dvcs_dvc: i32 = 240;
pub const SN_id_smime_alg_ESDHwith3DES: &[u8; 26] = b"id-smime-alg-ESDHwith3DES\0";
pub const NID_id_smime_alg_ESDHwith3DES: i32 = 241;
pub const SN_id_smime_alg_ESDHwithRC2: &[u8; 25] = b"id-smime-alg-ESDHwithRC2\0";
pub const NID_id_smime_alg_ESDHwithRC2: i32 = 242;
pub const SN_id_smime_alg_3DESwrap: &[u8; 22] = b"id-smime-alg-3DESwrap\0";
pub const NID_id_smime_alg_3DESwrap: i32 = 243;
pub const SN_id_smime_alg_RC2wrap: &[u8; 21] = b"id-smime-alg-RC2wrap\0";
pub const NID_id_smime_alg_RC2wrap: i32 = 244;
pub const SN_id_smime_alg_ESDH: &[u8; 18] = b"id-smime-alg-ESDH\0";
pub const NID_id_smime_alg_ESDH: i32 = 245;
pub const SN_id_smime_alg_CMS3DESwrap: &[u8; 25] = b"id-smime-alg-CMS3DESwrap\0";
pub const NID_id_smime_alg_CMS3DESwrap: i32 = 246;
pub const SN_id_smime_alg_CMSRC2wrap: &[u8; 24] = b"id-smime-alg-CMSRC2wrap\0";
pub const NID_id_smime_alg_CMSRC2wrap: i32 = 247;
pub const SN_id_smime_cd_ldap: &[u8; 17] = b"id-smime-cd-ldap\0";
pub const NID_id_smime_cd_ldap: i32 = 248;
pub const SN_id_smime_spq_ets_sqt_uri: &[u8; 25] = b"id-smime-spq-ets-sqt-uri\0";
pub const NID_id_smime_spq_ets_sqt_uri: i32 = 249;
pub const SN_id_smime_spq_ets_sqt_unotice: &[u8; 29] = b"id-smime-spq-ets-sqt-unotice\0";
pub const NID_id_smime_spq_ets_sqt_unotice: i32 = 250;
pub const SN_id_smime_cti_ets_proofOfOrigin: &[u8; 31] = b"id-smime-cti-ets-proofOfOrigin\0";
pub const NID_id_smime_cti_ets_proofOfOrigin: i32 = 251;
pub const SN_id_smime_cti_ets_proofOfReceipt: &[u8; 32] = b"id-smime-cti-ets-proofOfReceipt\0";
pub const NID_id_smime_cti_ets_proofOfReceipt: i32 = 252;
pub const SN_id_smime_cti_ets_proofOfDelivery: &[u8; 33] = b"id-smime-cti-ets-proofOfDelivery\0";
pub const NID_id_smime_cti_ets_proofOfDelivery: i32 = 253;
pub const SN_id_smime_cti_ets_proofOfSender: &[u8; 31] = b"id-smime-cti-ets-proofOfSender\0";
pub const NID_id_smime_cti_ets_proofOfSender: i32 = 254;
pub const SN_id_smime_cti_ets_proofOfApproval: &[u8; 33] = b"id-smime-cti-ets-proofOfApproval\0";
pub const NID_id_smime_cti_ets_proofOfApproval: i32 = 255;
pub const SN_id_smime_cti_ets_proofOfCreation: &[u8; 33] = b"id-smime-cti-ets-proofOfCreation\0";
pub const NID_id_smime_cti_ets_proofOfCreation: i32 = 256;
pub const SN_md4: &[u8; 4] = b"MD4\0";
pub const LN_md4: &[u8; 4] = b"md4\0";
pub const NID_md4: i32 = 257;
pub const SN_id_pkix_mod: &[u8; 12] = b"id-pkix-mod\0";
pub const NID_id_pkix_mod: i32 = 258;
pub const SN_id_qt: &[u8; 6] = b"id-qt\0";
pub const NID_id_qt: i32 = 259;
pub const SN_id_it: &[u8; 6] = b"id-it\0";
pub const NID_id_it: i32 = 260;
pub const SN_id_pkip: &[u8; 8] = b"id-pkip\0";
pub const NID_id_pkip: i32 = 261;
pub const SN_id_alg: &[u8; 7] = b"id-alg\0";
pub const NID_id_alg: i32 = 262;
pub const SN_id_cmc: &[u8; 7] = b"id-cmc\0";
pub const NID_id_cmc: i32 = 263;
pub const SN_id_on: &[u8; 6] = b"id-on\0";
pub const NID_id_on: i32 = 264;
pub const SN_id_pda: &[u8; 7] = b"id-pda\0";
pub const NID_id_pda: i32 = 265;
pub const SN_id_aca: &[u8; 7] = b"id-aca\0";
pub const NID_id_aca: i32 = 266;
pub const SN_id_qcs: &[u8; 7] = b"id-qcs\0";
pub const NID_id_qcs: i32 = 267;
pub const SN_id_cct: &[u8; 7] = b"id-cct\0";
pub const NID_id_cct: i32 = 268;
pub const SN_id_pkix1_explicit_88: &[u8; 21] = b"id-pkix1-explicit-88\0";
pub const NID_id_pkix1_explicit_88: i32 = 269;
pub const SN_id_pkix1_implicit_88: &[u8; 21] = b"id-pkix1-implicit-88\0";
pub const NID_id_pkix1_implicit_88: i32 = 270;
pub const SN_id_pkix1_explicit_93: &[u8; 21] = b"id-pkix1-explicit-93\0";
pub const NID_id_pkix1_explicit_93: i32 = 271;
pub const SN_id_pkix1_implicit_93: &[u8; 21] = b"id-pkix1-implicit-93\0";
pub const NID_id_pkix1_implicit_93: i32 = 272;
pub const SN_id_mod_crmf: &[u8; 12] = b"id-mod-crmf\0";
pub const NID_id_mod_crmf: i32 = 273;
pub const SN_id_mod_cmc: &[u8; 11] = b"id-mod-cmc\0";
pub const NID_id_mod_cmc: i32 = 274;
pub const SN_id_mod_kea_profile_88: &[u8; 22] = b"id-mod-kea-profile-88\0";
pub const NID_id_mod_kea_profile_88: i32 = 275;
pub const SN_id_mod_kea_profile_93: &[u8; 22] = b"id-mod-kea-profile-93\0";
pub const NID_id_mod_kea_profile_93: i32 = 276;
pub const SN_id_mod_cmp: &[u8; 11] = b"id-mod-cmp\0";
pub const NID_id_mod_cmp: i32 = 277;
pub const SN_id_mod_qualified_cert_88: &[u8; 25] = b"id-mod-qualified-cert-88\0";
pub const NID_id_mod_qualified_cert_88: i32 = 278;
pub const SN_id_mod_qualified_cert_93: &[u8; 25] = b"id-mod-qualified-cert-93\0";
pub const NID_id_mod_qualified_cert_93: i32 = 279;
pub const SN_id_mod_attribute_cert: &[u8; 22] = b"id-mod-attribute-cert\0";
pub const NID_id_mod_attribute_cert: i32 = 280;
pub const SN_id_mod_timestamp_protocol: &[u8; 26] = b"id-mod-timestamp-protocol\0";
pub const NID_id_mod_timestamp_protocol: i32 = 281;
pub const SN_id_mod_ocsp: &[u8; 12] = b"id-mod-ocsp\0";
pub const NID_id_mod_ocsp: i32 = 282;
pub const SN_id_mod_dvcs: &[u8; 12] = b"id-mod-dvcs\0";
pub const NID_id_mod_dvcs: i32 = 283;
pub const SN_id_mod_cmp2000: &[u8; 15] = b"id-mod-cmp2000\0";
pub const NID_id_mod_cmp2000: i32 = 284;
pub const SN_biometricInfo: &[u8; 14] = b"biometricInfo\0";
pub const LN_biometricInfo: &[u8; 15] = b"Biometric Info\0";
pub const NID_biometricInfo: i32 = 285;
pub const SN_qcStatements: &[u8; 13] = b"qcStatements\0";
pub const NID_qcStatements: i32 = 286;
pub const SN_ac_auditEntity: &[u8; 15] = b"ac-auditEntity\0";
pub const NID_ac_auditEntity: i32 = 287;
pub const SN_ac_targeting: &[u8; 13] = b"ac-targeting\0";
pub const NID_ac_targeting: i32 = 288;
pub const SN_aaControls: &[u8; 11] = b"aaControls\0";
pub const NID_aaControls: i32 = 289;
pub const SN_sbgp_ipAddrBlock: &[u8; 17] = b"sbgp-ipAddrBlock\0";
pub const NID_sbgp_ipAddrBlock: i32 = 290;
pub const SN_sbgp_autonomousSysNum: &[u8; 22] = b"sbgp-autonomousSysNum\0";
pub const NID_sbgp_autonomousSysNum: i32 = 291;
pub const SN_sbgp_routerIdentifier: &[u8; 22] = b"sbgp-routerIdentifier\0";
pub const NID_sbgp_routerIdentifier: i32 = 292;
pub const SN_textNotice: &[u8; 11] = b"textNotice\0";
pub const NID_textNotice: i32 = 293;
pub const SN_ipsecEndSystem: &[u8; 15] = b"ipsecEndSystem\0";
pub const LN_ipsecEndSystem: &[u8; 17] = b"IPSec End System\0";
pub const NID_ipsecEndSystem: i32 = 294;
pub const SN_ipsecTunnel: &[u8; 12] = b"ipsecTunnel\0";
pub const LN_ipsecTunnel: &[u8; 13] = b"IPSec Tunnel\0";
pub const NID_ipsecTunnel: i32 = 295;
pub const SN_ipsecUser: &[u8; 10] = b"ipsecUser\0";
pub const LN_ipsecUser: &[u8; 11] = b"IPSec User\0";
pub const NID_ipsecUser: i32 = 296;
pub const SN_dvcs: &[u8; 5] = b"DVCS\0";
pub const LN_dvcs: &[u8; 5] = b"dvcs\0";
pub const NID_dvcs: i32 = 297;
pub const SN_id_it_caProtEncCert: &[u8; 20] = b"id-it-caProtEncCert\0";
pub const NID_id_it_caProtEncCert: i32 = 298;
pub const SN_id_it_signKeyPairTypes: &[u8; 23] = b"id-it-signKeyPairTypes\0";
pub const NID_id_it_signKeyPairTypes: i32 = 299;
pub const SN_id_it_encKeyPairTypes: &[u8; 22] = b"id-it-encKeyPairTypes\0";
pub const NID_id_it_encKeyPairTypes: i32 = 300;
pub const SN_id_it_preferredSymmAlg: &[u8; 23] = b"id-it-preferredSymmAlg\0";
pub const NID_id_it_preferredSymmAlg: i32 = 301;
pub const SN_id_it_caKeyUpdateInfo: &[u8; 22] = b"id-it-caKeyUpdateInfo\0";
pub const NID_id_it_caKeyUpdateInfo: i32 = 302;
pub const SN_id_it_currentCRL: &[u8; 17] = b"id-it-currentCRL\0";
pub const NID_id_it_currentCRL: i32 = 303;
pub const SN_id_it_unsupportedOIDs: &[u8; 22] = b"id-it-unsupportedOIDs\0";
pub const NID_id_it_unsupportedOIDs: i32 = 304;
pub const SN_id_it_subscriptionRequest: &[u8; 26] = b"id-it-subscriptionRequest\0";
pub const NID_id_it_subscriptionRequest: i32 = 305;
pub const SN_id_it_subscriptionResponse: &[u8; 27] = b"id-it-subscriptionResponse\0";
pub const NID_id_it_subscriptionResponse: i32 = 306;
pub const SN_id_it_keyPairParamReq: &[u8; 22] = b"id-it-keyPairParamReq\0";
pub const NID_id_it_keyPairParamReq: i32 = 307;
pub const SN_id_it_keyPairParamRep: &[u8; 22] = b"id-it-keyPairParamRep\0";
pub const NID_id_it_keyPairParamRep: i32 = 308;
pub const SN_id_it_revPassphrase: &[u8; 20] = b"id-it-revPassphrase\0";
pub const NID_id_it_revPassphrase: i32 = 309;
pub const SN_id_it_implicitConfirm: &[u8; 22] = b"id-it-implicitConfirm\0";
pub const NID_id_it_implicitConfirm: i32 = 310;
pub const SN_id_it_confirmWaitTime: &[u8; 22] = b"id-it-confirmWaitTime\0";
pub const NID_id_it_confirmWaitTime: i32 = 311;
pub const SN_id_it_origPKIMessage: &[u8; 21] = b"id-it-origPKIMessage\0";
pub const NID_id_it_origPKIMessage: i32 = 312;
pub const SN_id_regCtrl: &[u8; 11] = b"id-regCtrl\0";
pub const NID_id_regCtrl: i32 = 313;
pub const SN_id_regInfo: &[u8; 11] = b"id-regInfo\0";
pub const NID_id_regInfo: i32 = 314;
pub const SN_id_regCtrl_regToken: &[u8; 20] = b"id-regCtrl-regToken\0";
pub const NID_id_regCtrl_regToken: i32 = 315;
pub const SN_id_regCtrl_authenticator: &[u8; 25] = b"id-regCtrl-authenticator\0";
pub const NID_id_regCtrl_authenticator: i32 = 316;
pub const SN_id_regCtrl_pkiPublicationInfo: &[u8; 30] = b"id-regCtrl-pkiPublicationInfo\0";
pub const NID_id_regCtrl_pkiPublicationInfo: i32 = 317;
pub const SN_id_regCtrl_pkiArchiveOptions: &[u8; 29] = b"id-regCtrl-pkiArchiveOptions\0";
pub const NID_id_regCtrl_pkiArchiveOptions: i32 = 318;
pub const SN_id_regCtrl_oldCertID: &[u8; 21] = b"id-regCtrl-oldCertID\0";
pub const NID_id_regCtrl_oldCertID: i32 = 319;
pub const SN_id_regCtrl_protocolEncrKey: &[u8; 27] = b"id-regCtrl-protocolEncrKey\0";
pub const NID_id_regCtrl_protocolEncrKey: i32 = 320;
pub const SN_id_regInfo_utf8Pairs: &[u8; 21] = b"id-regInfo-utf8Pairs\0";
pub const NID_id_regInfo_utf8Pairs: i32 = 321;
pub const SN_id_regInfo_certReq: &[u8; 19] = b"id-regInfo-certReq\0";
pub const NID_id_regInfo_certReq: i32 = 322;
pub const SN_id_alg_des40: &[u8; 13] = b"id-alg-des40\0";
pub const NID_id_alg_des40: i32 = 323;
pub const SN_id_alg_noSignature: &[u8; 19] = b"id-alg-noSignature\0";
pub const NID_id_alg_noSignature: i32 = 324;
pub const SN_id_alg_dh_sig_hmac_sha1: &[u8; 24] = b"id-alg-dh-sig-hmac-sha1\0";
pub const NID_id_alg_dh_sig_hmac_sha1: i32 = 325;
pub const SN_id_alg_dh_pop: &[u8; 14] = b"id-alg-dh-pop\0";
pub const NID_id_alg_dh_pop: i32 = 326;
pub const SN_id_cmc_statusInfo: &[u8; 18] = b"id-cmc-statusInfo\0";
pub const NID_id_cmc_statusInfo: i32 = 327;
pub const SN_id_cmc_identification: &[u8; 22] = b"id-cmc-identification\0";
pub const NID_id_cmc_identification: i32 = 328;
pub const SN_id_cmc_identityProof: &[u8; 21] = b"id-cmc-identityProof\0";
pub const NID_id_cmc_identityProof: i32 = 329;
pub const SN_id_cmc_dataReturn: &[u8; 18] = b"id-cmc-dataReturn\0";
pub const NID_id_cmc_dataReturn: i32 = 330;
pub const SN_id_cmc_transactionId: &[u8; 21] = b"id-cmc-transactionId\0";
pub const NID_id_cmc_transactionId: i32 = 331;
pub const SN_id_cmc_senderNonce: &[u8; 19] = b"id-cmc-senderNonce\0";
pub const NID_id_cmc_senderNonce: i32 = 332;
pub const SN_id_cmc_recipientNonce: &[u8; 22] = b"id-cmc-recipientNonce\0";
pub const NID_id_cmc_recipientNonce: i32 = 333;
pub const SN_id_cmc_addExtensions: &[u8; 21] = b"id-cmc-addExtensions\0";
pub const NID_id_cmc_addExtensions: i32 = 334;
pub const SN_id_cmc_encryptedPOP: &[u8; 20] = b"id-cmc-encryptedPOP\0";
pub const NID_id_cmc_encryptedPOP: i32 = 335;
pub const SN_id_cmc_decryptedPOP: &[u8; 20] = b"id-cmc-decryptedPOP\0";
pub const NID_id_cmc_decryptedPOP: i32 = 336;
pub const SN_id_cmc_lraPOPWitness: &[u8; 21] = b"id-cmc-lraPOPWitness\0";
pub const NID_id_cmc_lraPOPWitness: i32 = 337;
pub const SN_id_cmc_getCert: &[u8; 15] = b"id-cmc-getCert\0";
pub const NID_id_cmc_getCert: i32 = 338;
pub const SN_id_cmc_getCRL: &[u8; 14] = b"id-cmc-getCRL\0";
pub const NID_id_cmc_getCRL: i32 = 339;
pub const SN_id_cmc_revokeRequest: &[u8; 21] = b"id-cmc-revokeRequest\0";
pub const NID_id_cmc_revokeRequest: i32 = 340;
pub const SN_id_cmc_regInfo: &[u8; 15] = b"id-cmc-regInfo\0";
pub const NID_id_cmc_regInfo: i32 = 341;
pub const SN_id_cmc_responseInfo: &[u8; 20] = b"id-cmc-responseInfo\0";
pub const NID_id_cmc_responseInfo: i32 = 342;
pub const SN_id_cmc_queryPending: &[u8; 20] = b"id-cmc-queryPending\0";
pub const NID_id_cmc_queryPending: i32 = 343;
pub const SN_id_cmc_popLinkRandom: &[u8; 21] = b"id-cmc-popLinkRandom\0";
pub const NID_id_cmc_popLinkRandom: i32 = 344;
pub const SN_id_cmc_popLinkWitness: &[u8; 22] = b"id-cmc-popLinkWitness\0";
pub const NID_id_cmc_popLinkWitness: i32 = 345;
pub const SN_id_cmc_confirmCertAcceptance: &[u8; 29] = b"id-cmc-confirmCertAcceptance\0";
pub const NID_id_cmc_confirmCertAcceptance: i32 = 346;
pub const SN_id_on_personalData: &[u8; 19] = b"id-on-personalData\0";
pub const NID_id_on_personalData: i32 = 347;
pub const SN_id_pda_dateOfBirth: &[u8; 19] = b"id-pda-dateOfBirth\0";
pub const NID_id_pda_dateOfBirth: i32 = 348;
pub const SN_id_pda_placeOfBirth: &[u8; 20] = b"id-pda-placeOfBirth\0";
pub const NID_id_pda_placeOfBirth: i32 = 349;
pub const SN_id_pda_gender: &[u8; 14] = b"id-pda-gender\0";
pub const NID_id_pda_gender: i32 = 351;
pub const SN_id_pda_countryOfCitizenship: &[u8; 28] = b"id-pda-countryOfCitizenship\0";
pub const NID_id_pda_countryOfCitizenship: i32 = 352;
pub const SN_id_pda_countryOfResidence: &[u8; 26] = b"id-pda-countryOfResidence\0";
pub const NID_id_pda_countryOfResidence: i32 = 353;
pub const SN_id_aca_authenticationInfo: &[u8; 26] = b"id-aca-authenticationInfo\0";
pub const NID_id_aca_authenticationInfo: i32 = 354;
pub const SN_id_aca_accessIdentity: &[u8; 22] = b"id-aca-accessIdentity\0";
pub const NID_id_aca_accessIdentity: i32 = 355;
pub const SN_id_aca_chargingIdentity: &[u8; 24] = b"id-aca-chargingIdentity\0";
pub const NID_id_aca_chargingIdentity: i32 = 356;
pub const SN_id_aca_group: &[u8; 13] = b"id-aca-group\0";
pub const NID_id_aca_group: i32 = 357;
pub const SN_id_aca_role: &[u8; 12] = b"id-aca-role\0";
pub const NID_id_aca_role: i32 = 358;
pub const SN_id_qcs_pkixQCSyntax_v1: &[u8; 23] = b"id-qcs-pkixQCSyntax-v1\0";
pub const NID_id_qcs_pkixQCSyntax_v1: i32 = 359;
pub const SN_id_cct_crs: &[u8; 11] = b"id-cct-crs\0";
pub const NID_id_cct_crs: i32 = 360;
pub const SN_id_cct_PKIData: &[u8; 15] = b"id-cct-PKIData\0";
pub const NID_id_cct_PKIData: i32 = 361;
pub const SN_id_cct_PKIResponse: &[u8; 19] = b"id-cct-PKIResponse\0";
pub const NID_id_cct_PKIResponse: i32 = 362;
pub const SN_ad_timeStamping: &[u8; 16] = b"ad_timestamping\0";
pub const LN_ad_timeStamping: &[u8; 17] = b"AD Time Stamping\0";
pub const NID_ad_timeStamping: i32 = 363;
pub const SN_ad_dvcs: &[u8; 8] = b"AD_DVCS\0";
pub const LN_ad_dvcs: &[u8; 8] = b"ad dvcs\0";
pub const NID_ad_dvcs: i32 = 364;
pub const SN_id_pkix_OCSP_basic: &[u8; 18] = b"basicOCSPResponse\0";
pub const LN_id_pkix_OCSP_basic: &[u8; 20] = b"Basic OCSP Response\0";
pub const NID_id_pkix_OCSP_basic: i32 = 365;
pub const SN_id_pkix_OCSP_Nonce: &[u8; 6] = b"Nonce\0";
pub const LN_id_pkix_OCSP_Nonce: &[u8; 11] = b"OCSP Nonce\0";
pub const NID_id_pkix_OCSP_Nonce: i32 = 366;
pub const SN_id_pkix_OCSP_CrlID: &[u8; 6] = b"CrlID\0";
pub const LN_id_pkix_OCSP_CrlID: &[u8; 12] = b"OCSP CRL ID\0";
pub const NID_id_pkix_OCSP_CrlID: i32 = 367;
pub const SN_id_pkix_OCSP_acceptableResponses: &[u8; 20] = b"acceptableResponses\0";
pub const LN_id_pkix_OCSP_acceptableResponses: &[u8; 26] = b"Acceptable OCSP Responses\0";
pub const NID_id_pkix_OCSP_acceptableResponses: i32 = 368;
pub const SN_id_pkix_OCSP_noCheck: &[u8; 8] = b"noCheck\0";
pub const LN_id_pkix_OCSP_noCheck: &[u8; 14] = b"OCSP No Check\0";
pub const NID_id_pkix_OCSP_noCheck: i32 = 369;
pub const SN_id_pkix_OCSP_archiveCutoff: &[u8; 14] = b"archiveCutoff\0";
pub const LN_id_pkix_OCSP_archiveCutoff: &[u8; 20] = b"OCSP Archive Cutoff\0";
pub const NID_id_pkix_OCSP_archiveCutoff: i32 = 370;
pub const SN_id_pkix_OCSP_serviceLocator: &[u8; 15] = b"serviceLocator\0";
pub const LN_id_pkix_OCSP_serviceLocator: &[u8; 21] = b"OCSP Service Locator\0";
pub const NID_id_pkix_OCSP_serviceLocator: i32 = 371;
pub const SN_id_pkix_OCSP_extendedStatus: &[u8; 15] = b"extendedStatus\0";
pub const LN_id_pkix_OCSP_extendedStatus: &[u8; 21] = b"Extended OCSP Status\0";
pub const NID_id_pkix_OCSP_extendedStatus: i32 = 372;
pub const SN_id_pkix_OCSP_valid: &[u8; 6] = b"valid\0";
pub const NID_id_pkix_OCSP_valid: i32 = 373;
pub const SN_id_pkix_OCSP_path: &[u8; 5] = b"path\0";
pub const NID_id_pkix_OCSP_path: i32 = 374;
pub const SN_id_pkix_OCSP_trustRoot: &[u8; 10] = b"trustRoot\0";
pub const LN_id_pkix_OCSP_trustRoot: &[u8; 11] = b"Trust Root\0";
pub const NID_id_pkix_OCSP_trustRoot: i32 = 375;
pub const SN_algorithm: &[u8; 10] = b"algorithm\0";
pub const LN_algorithm: &[u8; 10] = b"algorithm\0";
pub const NID_algorithm: i32 = 376;
pub const SN_rsaSignature: &[u8; 13] = b"rsaSignature\0";
pub const NID_rsaSignature: i32 = 377;
pub const SN_X500algorithms: &[u8; 15] = b"X500algorithms\0";
pub const LN_X500algorithms: &[u8; 32] = b"directory services - algorithms\0";
pub const NID_X500algorithms: i32 = 378;
pub const SN_org: &[u8; 4] = b"ORG\0";
pub const LN_org: &[u8; 4] = b"org\0";
pub const NID_org: i32 = 379;
pub const OBJ_ENC_org: i32 = 43;
pub const SN_dod: &[u8; 4] = b"DOD\0";
pub const LN_dod: &[u8; 4] = b"dod\0";
pub const NID_dod: i32 = 380;
pub const SN_iana: &[u8; 5] = b"IANA\0";
pub const LN_iana: &[u8; 5] = b"iana\0";
pub const NID_iana: i32 = 381;
pub const SN_Directory: &[u8; 10] = b"directory\0";
pub const LN_Directory: &[u8; 10] = b"Directory\0";
pub const NID_Directory: i32 = 382;
pub const SN_Management: &[u8; 5] = b"mgmt\0";
pub const LN_Management: &[u8; 11] = b"Management\0";
pub const NID_Management: i32 = 383;
pub const SN_Experimental: &[u8; 13] = b"experimental\0";
pub const LN_Experimental: &[u8; 13] = b"Experimental\0";
pub const NID_Experimental: i32 = 384;
pub const SN_Private: &[u8; 8] = b"private\0";
pub const LN_Private: &[u8; 8] = b"Private\0";
pub const NID_Private: i32 = 385;
pub const SN_Security: &[u8; 9] = b"security\0";
pub const LN_Security: &[u8; 9] = b"Security\0";
pub const NID_Security: i32 = 386;
pub const SN_SNMPv2: &[u8; 7] = b"snmpv2\0";
pub const LN_SNMPv2: &[u8; 7] = b"SNMPv2\0";
pub const NID_SNMPv2: i32 = 387;
pub const LN_Mail: &[u8; 5] = b"Mail\0";
pub const NID_Mail: i32 = 388;
pub const SN_Enterprises: &[u8; 12] = b"enterprises\0";
pub const LN_Enterprises: &[u8; 12] = b"Enterprises\0";
pub const NID_Enterprises: i32 = 389;
pub const SN_dcObject: &[u8; 9] = b"dcobject\0";
pub const LN_dcObject: &[u8; 9] = b"dcObject\0";
pub const NID_dcObject: i32 = 390;
pub const SN_domainComponent: &[u8; 3] = b"DC\0";
pub const LN_domainComponent: &[u8; 16] = b"domainComponent\0";
pub const NID_domainComponent: i32 = 391;
pub const SN_Domain: &[u8; 7] = b"domain\0";
pub const LN_Domain: &[u8; 7] = b"Domain\0";
pub const NID_Domain: i32 = 392;
pub const SN_selected_attribute_types: &[u8; 25] = b"selected-attribute-types\0";
pub const LN_selected_attribute_types: &[u8; 25] = b"Selected Attribute Types\0";
pub const NID_selected_attribute_types: i32 = 394;
pub const SN_clearance: &[u8; 10] = b"clearance\0";
pub const NID_clearance: i32 = 395;
pub const SN_md4WithRSAEncryption: &[u8; 8] = b"RSA-MD4\0";
pub const LN_md4WithRSAEncryption: &[u8; 21] = b"md4WithRSAEncryption\0";
pub const NID_md4WithRSAEncryption: i32 = 396;
pub const SN_ac_proxying: &[u8; 12] = b"ac-proxying\0";
pub const NID_ac_proxying: i32 = 397;
pub const SN_sinfo_access: &[u8; 18] = b"subjectInfoAccess\0";
pub const LN_sinfo_access: &[u8; 27] = b"Subject Information Access\0";
pub const NID_sinfo_access: i32 = 398;
pub const SN_id_aca_encAttrs: &[u8; 16] = b"id-aca-encAttrs\0";
pub const NID_id_aca_encAttrs: i32 = 399;
pub const SN_role: &[u8; 5] = b"role\0";
pub const LN_role: &[u8; 5] = b"role\0";
pub const NID_role: i32 = 400;
pub const SN_policy_constraints: &[u8; 18] = b"policyConstraints\0";
pub const LN_policy_constraints: &[u8; 26] = b"X509v3 Policy Constraints\0";
pub const NID_policy_constraints: i32 = 401;
pub const SN_target_information: &[u8; 18] = b"targetInformation\0";
pub const LN_target_information: &[u8; 20] = b"X509v3 AC Targeting\0";
pub const NID_target_information: i32 = 402;
pub const SN_no_rev_avail: &[u8; 11] = b"noRevAvail\0";
pub const LN_no_rev_avail: &[u8; 31] = b"X509v3 No Revocation Available\0";
pub const NID_no_rev_avail: i32 = 403;
pub const SN_ansi_X9_62: &[u8; 11] = b"ansi-X9-62\0";
pub const LN_ansi_X9_62: &[u8; 11] = b"ANSI X9.62\0";
pub const NID_ansi_X9_62: i32 = 405;
pub const SN_X9_62_prime_field: &[u8; 12] = b"prime-field\0";
pub const NID_X9_62_prime_field: i32 = 406;
pub const SN_X9_62_characteristic_two_field: &[u8; 25] = b"characteristic-two-field\0";
pub const NID_X9_62_characteristic_two_field: i32 = 407;
pub const SN_X9_62_id_ecPublicKey: &[u8; 15] = b"id-ecPublicKey\0";
pub const NID_X9_62_id_ecPublicKey: i32 = 408;
pub const SN_X9_62_prime192v1: &[u8; 11] = b"prime192v1\0";
pub const NID_X9_62_prime192v1: i32 = 409;
pub const SN_X9_62_prime192v2: &[u8; 11] = b"prime192v2\0";
pub const NID_X9_62_prime192v2: i32 = 410;
pub const SN_X9_62_prime192v3: &[u8; 11] = b"prime192v3\0";
pub const NID_X9_62_prime192v3: i32 = 411;
pub const SN_X9_62_prime239v1: &[u8; 11] = b"prime239v1\0";
pub const NID_X9_62_prime239v1: i32 = 412;
pub const SN_X9_62_prime239v2: &[u8; 11] = b"prime239v2\0";
pub const NID_X9_62_prime239v2: i32 = 413;
pub const SN_X9_62_prime239v3: &[u8; 11] = b"prime239v3\0";
pub const NID_X9_62_prime239v3: i32 = 414;
pub const SN_X9_62_prime256v1: &[u8; 11] = b"prime256v1\0";
pub const NID_X9_62_prime256v1: i32 = 415;
pub const SN_ecdsa_with_SHA1: &[u8; 16] = b"ecdsa-with-SHA1\0";
pub const NID_ecdsa_with_SHA1: i32 = 416;
pub const SN_ms_csp_name: &[u8; 8] = b"CSPName\0";
pub const LN_ms_csp_name: &[u8; 19] = b"Microsoft CSP Name\0";
pub const NID_ms_csp_name: i32 = 417;
pub const SN_aes_128_ecb: &[u8; 12] = b"AES-128-ECB\0";
pub const LN_aes_128_ecb: &[u8; 12] = b"aes-128-ecb\0";
pub const NID_aes_128_ecb: i32 = 418;
pub const SN_aes_128_cbc: &[u8; 12] = b"AES-128-CBC\0";
pub const LN_aes_128_cbc: &[u8; 12] = b"aes-128-cbc\0";
pub const NID_aes_128_cbc: i32 = 419;
pub const SN_aes_128_ofb128: &[u8; 12] = b"AES-128-OFB\0";
pub const LN_aes_128_ofb128: &[u8; 12] = b"aes-128-ofb\0";
pub const NID_aes_128_ofb128: i32 = 420;
pub const SN_aes_128_cfb128: &[u8; 12] = b"AES-128-CFB\0";
pub const LN_aes_128_cfb128: &[u8; 12] = b"aes-128-cfb\0";
pub const NID_aes_128_cfb128: i32 = 421;
pub const SN_aes_192_ecb: &[u8; 12] = b"AES-192-ECB\0";
pub const LN_aes_192_ecb: &[u8; 12] = b"aes-192-ecb\0";
pub const NID_aes_192_ecb: i32 = 422;
pub const SN_aes_192_cbc: &[u8; 12] = b"AES-192-CBC\0";
pub const LN_aes_192_cbc: &[u8; 12] = b"aes-192-cbc\0";
pub const NID_aes_192_cbc: i32 = 423;
pub const SN_aes_192_ofb128: &[u8; 12] = b"AES-192-OFB\0";
pub const LN_aes_192_ofb128: &[u8; 12] = b"aes-192-ofb\0";
pub const NID_aes_192_ofb128: i32 = 424;
pub const SN_aes_192_cfb128: &[u8; 12] = b"AES-192-CFB\0";
pub const LN_aes_192_cfb128: &[u8; 12] = b"aes-192-cfb\0";
pub const NID_aes_192_cfb128: i32 = 425;
pub const SN_aes_256_ecb: &[u8; 12] = b"AES-256-ECB\0";
pub const LN_aes_256_ecb: &[u8; 12] = b"aes-256-ecb\0";
pub const NID_aes_256_ecb: i32 = 426;
pub const SN_aes_256_cbc: &[u8; 12] = b"AES-256-CBC\0";
pub const LN_aes_256_cbc: &[u8; 12] = b"aes-256-cbc\0";
pub const NID_aes_256_cbc: i32 = 427;
pub const SN_aes_256_ofb128: &[u8; 12] = b"AES-256-OFB\0";
pub const LN_aes_256_ofb128: &[u8; 12] = b"aes-256-ofb\0";
pub const NID_aes_256_ofb128: i32 = 428;
pub const SN_aes_256_cfb128: &[u8; 12] = b"AES-256-CFB\0";
pub const LN_aes_256_cfb128: &[u8; 12] = b"aes-256-cfb\0";
pub const NID_aes_256_cfb128: i32 = 429;
pub const SN_hold_instruction_code: &[u8; 20] = b"holdInstructionCode\0";
pub const LN_hold_instruction_code: &[u8; 22] = b"Hold Instruction Code\0";
pub const NID_hold_instruction_code: i32 = 430;
pub const SN_hold_instruction_none: &[u8; 20] = b"holdInstructionNone\0";
pub const LN_hold_instruction_none: &[u8; 22] = b"Hold Instruction None\0";
pub const NID_hold_instruction_none: i32 = 431;
pub const SN_hold_instruction_call_issuer: &[u8; 26] = b"holdInstructionCallIssuer\0";
pub const LN_hold_instruction_call_issuer: &[u8; 29] = b"Hold Instruction Call Issuer\0";
pub const NID_hold_instruction_call_issuer: i32 = 432;
pub const SN_hold_instruction_reject: &[u8; 22] = b"holdInstructionReject\0";
pub const LN_hold_instruction_reject: &[u8; 24] = b"Hold Instruction Reject\0";
pub const NID_hold_instruction_reject: i32 = 433;
pub const SN_data: &[u8; 5] = b"data\0";
pub const NID_data: i32 = 434;
pub const OBJ_ENC_data: i32 = 9;
pub const SN_pss: &[u8; 4] = b"pss\0";
pub const NID_pss: i32 = 435;
pub const SN_ucl: &[u8; 4] = b"ucl\0";
pub const NID_ucl: i32 = 436;
pub const SN_pilot: &[u8; 6] = b"pilot\0";
pub const NID_pilot: i32 = 437;
pub const LN_pilotAttributeType: &[u8; 19] = b"pilotAttributeType\0";
pub const NID_pilotAttributeType: i32 = 438;
pub const LN_pilotAttributeSyntax: &[u8; 21] = b"pilotAttributeSyntax\0";
pub const NID_pilotAttributeSyntax: i32 = 439;
pub const LN_pilotObjectClass: &[u8; 17] = b"pilotObjectClass\0";
pub const NID_pilotObjectClass: i32 = 440;
pub const LN_pilotGroups: &[u8; 12] = b"pilotGroups\0";
pub const NID_pilotGroups: i32 = 441;
pub const LN_iA5StringSyntax: &[u8; 16] = b"iA5StringSyntax\0";
pub const NID_iA5StringSyntax: i32 = 442;
pub const LN_caseIgnoreIA5StringSyntax: &[u8; 26] = b"caseIgnoreIA5StringSyntax\0";
pub const NID_caseIgnoreIA5StringSyntax: i32 = 443;
pub const LN_pilotObject: &[u8; 12] = b"pilotObject\0";
pub const NID_pilotObject: i32 = 444;
pub const LN_pilotPerson: &[u8; 12] = b"pilotPerson\0";
pub const NID_pilotPerson: i32 = 445;
pub const SN_account: &[u8; 8] = b"account\0";
pub const NID_account: i32 = 446;
pub const SN_document: &[u8; 9] = b"document\0";
pub const NID_document: i32 = 447;
pub const SN_room: &[u8; 5] = b"room\0";
pub const NID_room: i32 = 448;
pub const LN_documentSeries: &[u8; 15] = b"documentSeries\0";
pub const NID_documentSeries: i32 = 449;
pub const LN_rFC822localPart: &[u8; 16] = b"rFC822localPart\0";
pub const NID_rFC822localPart: i32 = 450;
pub const LN_dNSDomain: &[u8; 10] = b"dNSDomain\0";
pub const NID_dNSDomain: i32 = 451;
pub const LN_domainRelatedObject: &[u8; 20] = b"domainRelatedObject\0";
pub const NID_domainRelatedObject: i32 = 452;
pub const LN_friendlyCountry: &[u8; 16] = b"friendlyCountry\0";
pub const NID_friendlyCountry: i32 = 453;
pub const LN_simpleSecurityObject: &[u8; 21] = b"simpleSecurityObject\0";
pub const NID_simpleSecurityObject: i32 = 454;
pub const LN_pilotOrganization: &[u8; 18] = b"pilotOrganization\0";
pub const NID_pilotOrganization: i32 = 455;
pub const LN_pilotDSA: &[u8; 9] = b"pilotDSA\0";
pub const NID_pilotDSA: i32 = 456;
pub const LN_qualityLabelledData: &[u8; 20] = b"qualityLabelledData\0";
pub const NID_qualityLabelledData: i32 = 457;
pub const SN_userId: &[u8; 4] = b"UID\0";
pub const LN_userId: &[u8; 7] = b"userId\0";
pub const NID_userId: i32 = 458;
pub const LN_textEncodedORAddress: &[u8; 21] = b"textEncodedORAddress\0";
pub const NID_textEncodedORAddress: i32 = 459;
pub const SN_rfc822Mailbox: &[u8; 5] = b"mail\0";
pub const LN_rfc822Mailbox: &[u8; 14] = b"rfc822Mailbox\0";
pub const NID_rfc822Mailbox: i32 = 460;
pub const SN_info: &[u8; 5] = b"info\0";
pub const NID_info: i32 = 461;
pub const LN_favouriteDrink: &[u8; 15] = b"favouriteDrink\0";
pub const NID_favouriteDrink: i32 = 462;
pub const LN_roomNumber: &[u8; 11] = b"roomNumber\0";
pub const NID_roomNumber: i32 = 463;
pub const SN_photo: &[u8; 6] = b"photo\0";
pub const NID_photo: i32 = 464;
pub const LN_userClass: &[u8; 10] = b"userClass\0";
pub const NID_userClass: i32 = 465;
pub const SN_host: &[u8; 5] = b"host\0";
pub const NID_host: i32 = 466;
pub const SN_manager: &[u8; 8] = b"manager\0";
pub const NID_manager: i32 = 467;
pub const LN_documentIdentifier: &[u8; 19] = b"documentIdentifier\0";
pub const NID_documentIdentifier: i32 = 468;
pub const LN_documentTitle: &[u8; 14] = b"documentTitle\0";
pub const NID_documentTitle: i32 = 469;
pub const LN_documentVersion: &[u8; 16] = b"documentVersion\0";
pub const NID_documentVersion: i32 = 470;
pub const LN_documentAuthor: &[u8; 15] = b"documentAuthor\0";
pub const NID_documentAuthor: i32 = 471;
pub const LN_documentLocation: &[u8; 17] = b"documentLocation\0";
pub const NID_documentLocation: i32 = 472;
pub const LN_homeTelephoneNumber: &[u8; 20] = b"homeTelephoneNumber\0";
pub const NID_homeTelephoneNumber: i32 = 473;
pub const SN_secretary: &[u8; 10] = b"secretary\0";
pub const NID_secretary: i32 = 474;
pub const LN_otherMailbox: &[u8; 13] = b"otherMailbox\0";
pub const NID_otherMailbox: i32 = 475;
pub const LN_lastModifiedTime: &[u8; 17] = b"lastModifiedTime\0";
pub const NID_lastModifiedTime: i32 = 476;
pub const LN_lastModifiedBy: &[u8; 15] = b"lastModifiedBy\0";
pub const NID_lastModifiedBy: i32 = 477;
pub const LN_aRecord: &[u8; 8] = b"aRecord\0";
pub const NID_aRecord: i32 = 478;
pub const LN_pilotAttributeType27: &[u8; 21] = b"pilotAttributeType27\0";
pub const NID_pilotAttributeType27: i32 = 479;
pub const LN_mXRecord: &[u8; 9] = b"mXRecord\0";
pub const NID_mXRecord: i32 = 480;
pub const LN_nSRecord: &[u8; 9] = b"nSRecord\0";
pub const NID_nSRecord: i32 = 481;
pub const LN_sOARecord: &[u8; 10] = b"sOARecord\0";
pub const NID_sOARecord: i32 = 482;
pub const LN_cNAMERecord: &[u8; 12] = b"cNAMERecord\0";
pub const NID_cNAMERecord: i32 = 483;
pub const LN_associatedDomain: &[u8; 17] = b"associatedDomain\0";
pub const NID_associatedDomain: i32 = 484;
pub const LN_associatedName: &[u8; 15] = b"associatedName\0";
pub const NID_associatedName: i32 = 485;
pub const LN_homePostalAddress: &[u8; 18] = b"homePostalAddress\0";
pub const NID_homePostalAddress: i32 = 486;
pub const LN_personalTitle: &[u8; 14] = b"personalTitle\0";
pub const NID_personalTitle: i32 = 487;
pub const LN_mobileTelephoneNumber: &[u8; 22] = b"mobileTelephoneNumber\0";
pub const NID_mobileTelephoneNumber: i32 = 488;
pub const LN_pagerTelephoneNumber: &[u8; 21] = b"pagerTelephoneNumber\0";
pub const NID_pagerTelephoneNumber: i32 = 489;
pub const LN_friendlyCountryName: &[u8; 20] = b"friendlyCountryName\0";
pub const NID_friendlyCountryName: i32 = 490;
pub const LN_organizationalStatus: &[u8; 21] = b"organizationalStatus\0";
pub const NID_organizationalStatus: i32 = 491;
pub const LN_janetMailbox: &[u8; 13] = b"janetMailbox\0";
pub const NID_janetMailbox: i32 = 492;
pub const LN_mailPreferenceOption: &[u8; 21] = b"mailPreferenceOption\0";
pub const NID_mailPreferenceOption: i32 = 493;
pub const LN_buildingName: &[u8; 13] = b"buildingName\0";
pub const NID_buildingName: i32 = 494;
pub const LN_dSAQuality: &[u8; 11] = b"dSAQuality\0";
pub const NID_dSAQuality: i32 = 495;
pub const LN_singleLevelQuality: &[u8; 19] = b"singleLevelQuality\0";
pub const NID_singleLevelQuality: i32 = 496;
pub const LN_subtreeMinimumQuality: &[u8; 22] = b"subtreeMinimumQuality\0";
pub const NID_subtreeMinimumQuality: i32 = 497;
pub const LN_subtreeMaximumQuality: &[u8; 22] = b"subtreeMaximumQuality\0";
pub const NID_subtreeMaximumQuality: i32 = 498;
pub const LN_personalSignature: &[u8; 18] = b"personalSignature\0";
pub const NID_personalSignature: i32 = 499;
pub const LN_dITRedirect: &[u8; 12] = b"dITRedirect\0";
pub const NID_dITRedirect: i32 = 500;
pub const SN_audio: &[u8; 6] = b"audio\0";
pub const NID_audio: i32 = 501;
pub const LN_documentPublisher: &[u8; 18] = b"documentPublisher\0";
pub const NID_documentPublisher: i32 = 502;
pub const LN_x500UniqueIdentifier: &[u8; 21] = b"x500UniqueIdentifier\0";
pub const NID_x500UniqueIdentifier: i32 = 503;
pub const SN_mime_mhs: &[u8; 9] = b"mime-mhs\0";
pub const LN_mime_mhs: &[u8; 9] = b"MIME MHS\0";
pub const NID_mime_mhs: i32 = 504;
pub const SN_mime_mhs_headings: &[u8; 18] = b"mime-mhs-headings\0";
pub const LN_mime_mhs_headings: &[u8; 18] = b"mime-mhs-headings\0";
pub const NID_mime_mhs_headings: i32 = 505;
pub const SN_mime_mhs_bodies: &[u8; 16] = b"mime-mhs-bodies\0";
pub const LN_mime_mhs_bodies: &[u8; 16] = b"mime-mhs-bodies\0";
pub const NID_mime_mhs_bodies: i32 = 506;
pub const SN_id_hex_partial_message: &[u8; 23] = b"id-hex-partial-message\0";
pub const LN_id_hex_partial_message: &[u8; 23] = b"id-hex-partial-message\0";
pub const NID_id_hex_partial_message: i32 = 507;
pub const SN_id_hex_multipart_message: &[u8; 25] = b"id-hex-multipart-message\0";
pub const LN_id_hex_multipart_message: &[u8; 25] = b"id-hex-multipart-message\0";
pub const NID_id_hex_multipart_message: i32 = 508;
pub const LN_generationQualifier: &[u8; 20] = b"generationQualifier\0";
pub const NID_generationQualifier: i32 = 509;
pub const LN_pseudonym: &[u8; 10] = b"pseudonym\0";
pub const NID_pseudonym: i32 = 510;
pub const SN_id_set: &[u8; 7] = b"id-set\0";
pub const LN_id_set: &[u8; 31] = b"Secure Electronic Transactions\0";
pub const NID_id_set: i32 = 512;
pub const SN_set_ctype: &[u8; 10] = b"set-ctype\0";
pub const LN_set_ctype: &[u8; 14] = b"content types\0";
pub const NID_set_ctype: i32 = 513;
pub const SN_set_msgExt: &[u8; 11] = b"set-msgExt\0";
pub const LN_set_msgExt: &[u8; 19] = b"message extensions\0";
pub const NID_set_msgExt: i32 = 514;
pub const SN_set_attr: &[u8; 9] = b"set-attr\0";
pub const NID_set_attr: i32 = 515;
pub const SN_set_policy: &[u8; 11] = b"set-policy\0";
pub const NID_set_policy: i32 = 516;
pub const SN_set_certExt: &[u8; 12] = b"set-certExt\0";
pub const LN_set_certExt: &[u8; 23] = b"certificate extensions\0";
pub const NID_set_certExt: i32 = 517;
pub const SN_set_brand: &[u8; 10] = b"set-brand\0";
pub const NID_set_brand: i32 = 518;
pub const SN_setct_PANData: &[u8; 14] = b"setct-PANData\0";
pub const NID_setct_PANData: i32 = 519;
pub const SN_setct_PANToken: &[u8; 15] = b"setct-PANToken\0";
pub const NID_setct_PANToken: i32 = 520;
pub const SN_setct_PANOnly: &[u8; 14] = b"setct-PANOnly\0";
pub const NID_setct_PANOnly: i32 = 521;
pub const SN_setct_OIData: &[u8; 13] = b"setct-OIData\0";
pub const NID_setct_OIData: i32 = 522;
pub const SN_setct_PI: &[u8; 9] = b"setct-PI\0";
pub const NID_setct_PI: i32 = 523;
pub const SN_setct_PIData: &[u8; 13] = b"setct-PIData\0";
pub const NID_setct_PIData: i32 = 524;
pub const SN_setct_PIDataUnsigned: &[u8; 21] = b"setct-PIDataUnsigned\0";
pub const NID_setct_PIDataUnsigned: i32 = 525;
pub const SN_setct_HODInput: &[u8; 15] = b"setct-HODInput\0";
pub const NID_setct_HODInput: i32 = 526;
pub const SN_setct_AuthResBaggage: &[u8; 21] = b"setct-AuthResBaggage\0";
pub const NID_setct_AuthResBaggage: i32 = 527;
pub const SN_setct_AuthRevReqBaggage: &[u8; 24] = b"setct-AuthRevReqBaggage\0";
pub const NID_setct_AuthRevReqBaggage: i32 = 528;
pub const SN_setct_AuthRevResBaggage: &[u8; 24] = b"setct-AuthRevResBaggage\0";
pub const NID_setct_AuthRevResBaggage: i32 = 529;
pub const SN_setct_CapTokenSeq: &[u8; 18] = b"setct-CapTokenSeq\0";
pub const NID_setct_CapTokenSeq: i32 = 530;
pub const SN_setct_PInitResData: &[u8; 19] = b"setct-PInitResData\0";
pub const NID_setct_PInitResData: i32 = 531;
pub const SN_setct_PI_TBS: &[u8; 13] = b"setct-PI-TBS\0";
pub const NID_setct_PI_TBS: i32 = 532;
pub const SN_setct_PResData: &[u8; 15] = b"setct-PResData\0";
pub const NID_setct_PResData: i32 = 533;
pub const SN_setct_AuthReqTBS: &[u8; 17] = b"setct-AuthReqTBS\0";
pub const NID_setct_AuthReqTBS: i32 = 534;
pub const SN_setct_AuthResTBS: &[u8; 17] = b"setct-AuthResTBS\0";
pub const NID_setct_AuthResTBS: i32 = 535;
pub const SN_setct_AuthResTBSX: &[u8; 18] = b"setct-AuthResTBSX\0";
pub const NID_setct_AuthResTBSX: i32 = 536;
pub const SN_setct_AuthTokenTBS: &[u8; 19] = b"setct-AuthTokenTBS\0";
pub const NID_setct_AuthTokenTBS: i32 = 537;
pub const SN_setct_CapTokenData: &[u8; 19] = b"setct-CapTokenData\0";
pub const NID_setct_CapTokenData: i32 = 538;
pub const SN_setct_CapTokenTBS: &[u8; 18] = b"setct-CapTokenTBS\0";
pub const NID_setct_CapTokenTBS: i32 = 539;
pub const SN_setct_AcqCardCodeMsg: &[u8; 21] = b"setct-AcqCardCodeMsg\0";
pub const NID_setct_AcqCardCodeMsg: i32 = 540;
pub const SN_setct_AuthRevReqTBS: &[u8; 20] = b"setct-AuthRevReqTBS\0";
pub const NID_setct_AuthRevReqTBS: i32 = 541;
pub const SN_setct_AuthRevResData: &[u8; 21] = b"setct-AuthRevResData\0";
pub const NID_setct_AuthRevResData: i32 = 542;
pub const SN_setct_AuthRevResTBS: &[u8; 20] = b"setct-AuthRevResTBS\0";
pub const NID_setct_AuthRevResTBS: i32 = 543;
pub const SN_setct_CapReqTBS: &[u8; 16] = b"setct-CapReqTBS\0";
pub const NID_setct_CapReqTBS: i32 = 544;
pub const SN_setct_CapReqTBSX: &[u8; 17] = b"setct-CapReqTBSX\0";
pub const NID_setct_CapReqTBSX: i32 = 545;
pub const SN_setct_CapResData: &[u8; 17] = b"setct-CapResData\0";
pub const NID_setct_CapResData: i32 = 546;
pub const SN_setct_CapRevReqTBS: &[u8; 19] = b"setct-CapRevReqTBS\0";
pub const NID_setct_CapRevReqTBS: i32 = 547;
pub const SN_setct_CapRevReqTBSX: &[u8; 20] = b"setct-CapRevReqTBSX\0";
pub const NID_setct_CapRevReqTBSX: i32 = 548;
pub const SN_setct_CapRevResData: &[u8; 20] = b"setct-CapRevResData\0";
pub const NID_setct_CapRevResData: i32 = 549;
pub const SN_setct_CredReqTBS: &[u8; 17] = b"setct-CredReqTBS\0";
pub const NID_setct_CredReqTBS: i32 = 550;
pub const SN_setct_CredReqTBSX: &[u8; 18] = b"setct-CredReqTBSX\0";
pub const NID_setct_CredReqTBSX: i32 = 551;
pub const SN_setct_CredResData: &[u8; 18] = b"setct-CredResData\0";
pub const NID_setct_CredResData: i32 = 552;
pub const SN_setct_CredRevReqTBS: &[u8; 20] = b"setct-CredRevReqTBS\0";
pub const NID_setct_CredRevReqTBS: i32 = 553;
pub const SN_setct_CredRevReqTBSX: &[u8; 21] = b"setct-CredRevReqTBSX\0";
pub const NID_setct_CredRevReqTBSX: i32 = 554;
pub const SN_setct_CredRevResData: &[u8; 21] = b"setct-CredRevResData\0";
pub const NID_setct_CredRevResData: i32 = 555;
pub const SN_setct_PCertReqData: &[u8; 19] = b"setct-PCertReqData\0";
pub const NID_setct_PCertReqData: i32 = 556;
pub const SN_setct_PCertResTBS: &[u8; 18] = b"setct-PCertResTBS\0";
pub const NID_setct_PCertResTBS: i32 = 557;
pub const SN_setct_BatchAdminReqData: &[u8; 24] = b"setct-BatchAdminReqData\0";
pub const NID_setct_BatchAdminReqData: i32 = 558;
pub const SN_setct_BatchAdminResData: &[u8; 24] = b"setct-BatchAdminResData\0";
pub const NID_setct_BatchAdminResData: i32 = 559;
pub const SN_setct_CardCInitResTBS: &[u8; 22] = b"setct-CardCInitResTBS\0";
pub const NID_setct_CardCInitResTBS: i32 = 560;
pub const SN_setct_MeAqCInitResTBS: &[u8; 22] = b"setct-MeAqCInitResTBS\0";
pub const NID_setct_MeAqCInitResTBS: i32 = 561;
pub const SN_setct_RegFormResTBS: &[u8; 20] = b"setct-RegFormResTBS\0";
pub const NID_setct_RegFormResTBS: i32 = 562;
pub const SN_setct_CertReqData: &[u8; 18] = b"setct-CertReqData\0";
pub const NID_setct_CertReqData: i32 = 563;
pub const SN_setct_CertReqTBS: &[u8; 17] = b"setct-CertReqTBS\0";
pub const NID_setct_CertReqTBS: i32 = 564;
pub const SN_setct_CertResData: &[u8; 18] = b"setct-CertResData\0";
pub const NID_setct_CertResData: i32 = 565;
pub const SN_setct_CertInqReqTBS: &[u8; 20] = b"setct-CertInqReqTBS\0";
pub const NID_setct_CertInqReqTBS: i32 = 566;
pub const SN_setct_ErrorTBS: &[u8; 15] = b"setct-ErrorTBS\0";
pub const NID_setct_ErrorTBS: i32 = 567;
pub const SN_setct_PIDualSignedTBE: &[u8; 22] = b"setct-PIDualSignedTBE\0";
pub const NID_setct_PIDualSignedTBE: i32 = 568;
pub const SN_setct_PIUnsignedTBE: &[u8; 20] = b"setct-PIUnsignedTBE\0";
pub const NID_setct_PIUnsignedTBE: i32 = 569;
pub const SN_setct_AuthReqTBE: &[u8; 17] = b"setct-AuthReqTBE\0";
pub const NID_setct_AuthReqTBE: i32 = 570;
pub const SN_setct_AuthResTBE: &[u8; 17] = b"setct-AuthResTBE\0";
pub const NID_setct_AuthResTBE: i32 = 571;
pub const SN_setct_AuthResTBEX: &[u8; 18] = b"setct-AuthResTBEX\0";
pub const NID_setct_AuthResTBEX: i32 = 572;
pub const SN_setct_AuthTokenTBE: &[u8; 19] = b"setct-AuthTokenTBE\0";
pub const NID_setct_AuthTokenTBE: i32 = 573;
pub const SN_setct_CapTokenTBE: &[u8; 18] = b"setct-CapTokenTBE\0";
pub const NID_setct_CapTokenTBE: i32 = 574;
pub const SN_setct_CapTokenTBEX: &[u8; 19] = b"setct-CapTokenTBEX\0";
pub const NID_setct_CapTokenTBEX: i32 = 575;
pub const SN_setct_AcqCardCodeMsgTBE: &[u8; 24] = b"setct-AcqCardCodeMsgTBE\0";
pub const NID_setct_AcqCardCodeMsgTBE: i32 = 576;
pub const SN_setct_AuthRevReqTBE: &[u8; 20] = b"setct-AuthRevReqTBE\0";
pub const NID_setct_AuthRevReqTBE: i32 = 577;
pub const SN_setct_AuthRevResTBE: &[u8; 20] = b"setct-AuthRevResTBE\0";
pub const NID_setct_AuthRevResTBE: i32 = 578;
pub const SN_setct_AuthRevResTBEB: &[u8; 21] = b"setct-AuthRevResTBEB\0";
pub const NID_setct_AuthRevResTBEB: i32 = 579;
pub const SN_setct_CapReqTBE: &[u8; 16] = b"setct-CapReqTBE\0";
pub const NID_setct_CapReqTBE: i32 = 580;
pub const SN_setct_CapReqTBEX: &[u8; 17] = b"setct-CapReqTBEX\0";
pub const NID_setct_CapReqTBEX: i32 = 581;
pub const SN_setct_CapResTBE: &[u8; 16] = b"setct-CapResTBE\0";
pub const NID_setct_CapResTBE: i32 = 582;
pub const SN_setct_CapRevReqTBE: &[u8; 19] = b"setct-CapRevReqTBE\0";
pub const NID_setct_CapRevReqTBE: i32 = 583;
pub const SN_setct_CapRevReqTBEX: &[u8; 20] = b"setct-CapRevReqTBEX\0";
pub const NID_setct_CapRevReqTBEX: i32 = 584;
pub const SN_setct_CapRevResTBE: &[u8; 19] = b"setct-CapRevResTBE\0";
pub const NID_setct_CapRevResTBE: i32 = 585;
pub const SN_setct_CredReqTBE: &[u8; 17] = b"setct-CredReqTBE\0";
pub const NID_setct_CredReqTBE: i32 = 586;
pub const SN_setct_CredReqTBEX: &[u8; 18] = b"setct-CredReqTBEX\0";
pub const NID_setct_CredReqTBEX: i32 = 587;
pub const SN_setct_CredResTBE: &[u8; 17] = b"setct-CredResTBE\0";
pub const NID_setct_CredResTBE: i32 = 588;
pub const SN_setct_CredRevReqTBE: &[u8; 20] = b"setct-CredRevReqTBE\0";
pub const NID_setct_CredRevReqTBE: i32 = 589;
pub const SN_setct_CredRevReqTBEX: &[u8; 21] = b"setct-CredRevReqTBEX\0";
pub const NID_setct_CredRevReqTBEX: i32 = 590;
pub const SN_setct_CredRevResTBE: &[u8; 20] = b"setct-CredRevResTBE\0";
pub const NID_setct_CredRevResTBE: i32 = 591;
pub const SN_setct_BatchAdminReqTBE: &[u8; 23] = b"setct-BatchAdminReqTBE\0";
pub const NID_setct_BatchAdminReqTBE: i32 = 592;
pub const SN_setct_BatchAdminResTBE: &[u8; 23] = b"setct-BatchAdminResTBE\0";
pub const NID_setct_BatchAdminResTBE: i32 = 593;
pub const SN_setct_RegFormReqTBE: &[u8; 20] = b"setct-RegFormReqTBE\0";
pub const NID_setct_RegFormReqTBE: i32 = 594;
pub const SN_setct_CertReqTBE: &[u8; 17] = b"setct-CertReqTBE\0";
pub const NID_setct_CertReqTBE: i32 = 595;
pub const SN_setct_CertReqTBEX: &[u8; 18] = b"setct-CertReqTBEX\0";
pub const NID_setct_CertReqTBEX: i32 = 596;
pub const SN_setct_CertResTBE: &[u8; 17] = b"setct-CertResTBE\0";
pub const NID_setct_CertResTBE: i32 = 597;
pub const SN_setct_CRLNotificationTBS: &[u8; 25] = b"setct-CRLNotificationTBS\0";
pub const NID_setct_CRLNotificationTBS: i32 = 598;
pub const SN_setct_CRLNotificationResTBS: &[u8; 28] = b"setct-CRLNotificationResTBS\0";
pub const NID_setct_CRLNotificationResTBS: i32 = 599;
pub const SN_setct_BCIDistributionTBS: &[u8; 25] = b"setct-BCIDistributionTBS\0";
pub const NID_setct_BCIDistributionTBS: i32 = 600;
pub const SN_setext_genCrypt: &[u8; 16] = b"setext-genCrypt\0";
pub const LN_setext_genCrypt: &[u8; 19] = b"generic cryptogram\0";
pub const NID_setext_genCrypt: i32 = 601;
pub const SN_setext_miAuth: &[u8; 14] = b"setext-miAuth\0";
pub const LN_setext_miAuth: &[u8; 24] = b"merchant initiated auth\0";
pub const NID_setext_miAuth: i32 = 602;
pub const SN_setext_pinSecure: &[u8; 17] = b"setext-pinSecure\0";
pub const NID_setext_pinSecure: i32 = 603;
pub const SN_setext_pinAny: &[u8; 14] = b"setext-pinAny\0";
pub const NID_setext_pinAny: i32 = 604;
pub const SN_setext_track2: &[u8; 14] = b"setext-track2\0";
pub const NID_setext_track2: i32 = 605;
pub const SN_setext_cv: &[u8; 10] = b"setext-cv\0";
pub const LN_setext_cv: &[u8; 24] = b"additional verification\0";
pub const NID_setext_cv: i32 = 606;
pub const SN_set_policy_root: &[u8; 16] = b"set-policy-root\0";
pub const NID_set_policy_root: i32 = 607;
pub const SN_setCext_hashedRoot: &[u8; 19] = b"setCext-hashedRoot\0";
pub const NID_setCext_hashedRoot: i32 = 608;
pub const SN_setCext_certType: &[u8; 17] = b"setCext-certType\0";
pub const NID_setCext_certType: i32 = 609;
pub const SN_setCext_merchData: &[u8; 18] = b"setCext-merchData\0";
pub const NID_setCext_merchData: i32 = 610;
pub const SN_setCext_cCertRequired: &[u8; 22] = b"setCext-cCertRequired\0";
pub const NID_setCext_cCertRequired: i32 = 611;
pub const SN_setCext_tunneling: &[u8; 18] = b"setCext-tunneling\0";
pub const NID_setCext_tunneling: i32 = 612;
pub const SN_setCext_setExt: &[u8; 15] = b"setCext-setExt\0";
pub const NID_setCext_setExt: i32 = 613;
pub const SN_setCext_setQualf: &[u8; 17] = b"setCext-setQualf\0";
pub const NID_setCext_setQualf: i32 = 614;
pub const SN_setCext_PGWYcapabilities: &[u8; 25] = b"setCext-PGWYcapabilities\0";
pub const NID_setCext_PGWYcapabilities: i32 = 615;
pub const SN_setCext_TokenIdentifier: &[u8; 24] = b"setCext-TokenIdentifier\0";
pub const NID_setCext_TokenIdentifier: i32 = 616;
pub const SN_setCext_Track2Data: &[u8; 19] = b"setCext-Track2Data\0";
pub const NID_setCext_Track2Data: i32 = 617;
pub const SN_setCext_TokenType: &[u8; 18] = b"setCext-TokenType\0";
pub const NID_setCext_TokenType: i32 = 618;
pub const SN_setCext_IssuerCapabilities: &[u8; 27] = b"setCext-IssuerCapabilities\0";
pub const NID_setCext_IssuerCapabilities: i32 = 619;
pub const SN_setAttr_Cert: &[u8; 13] = b"setAttr-Cert\0";
pub const NID_setAttr_Cert: i32 = 620;
pub const SN_setAttr_PGWYcap: &[u8; 16] = b"setAttr-PGWYcap\0";
pub const LN_setAttr_PGWYcap: &[u8; 29] = b"payment gateway capabilities\0";
pub const NID_setAttr_PGWYcap: i32 = 621;
pub const SN_setAttr_TokenType: &[u8; 18] = b"setAttr-TokenType\0";
pub const NID_setAttr_TokenType: i32 = 622;
pub const SN_setAttr_IssCap: &[u8; 15] = b"setAttr-IssCap\0";
pub const LN_setAttr_IssCap: &[u8; 20] = b"issuer capabilities\0";
pub const NID_setAttr_IssCap: i32 = 623;
pub const SN_set_rootKeyThumb: &[u8; 17] = b"set-rootKeyThumb\0";
pub const NID_set_rootKeyThumb: i32 = 624;
pub const SN_set_addPolicy: &[u8; 14] = b"set-addPolicy\0";
pub const NID_set_addPolicy: i32 = 625;
pub const SN_setAttr_Token_EMV: &[u8; 18] = b"setAttr-Token-EMV\0";
pub const NID_setAttr_Token_EMV: i32 = 626;
pub const SN_setAttr_Token_B0Prime: &[u8; 22] = b"setAttr-Token-B0Prime\0";
pub const NID_setAttr_Token_B0Prime: i32 = 627;
pub const SN_setAttr_IssCap_CVM: &[u8; 19] = b"setAttr-IssCap-CVM\0";
pub const NID_setAttr_IssCap_CVM: i32 = 628;
pub const SN_setAttr_IssCap_T2: &[u8; 18] = b"setAttr-IssCap-T2\0";
pub const NID_setAttr_IssCap_T2: i32 = 629;
pub const SN_setAttr_IssCap_Sig: &[u8; 19] = b"setAttr-IssCap-Sig\0";
pub const NID_setAttr_IssCap_Sig: i32 = 630;
pub const SN_setAttr_GenCryptgrm: &[u8; 20] = b"setAttr-GenCryptgrm\0";
pub const LN_setAttr_GenCryptgrm: &[u8; 20] = b"generate cryptogram\0";
pub const NID_setAttr_GenCryptgrm: i32 = 631;
pub const SN_setAttr_T2Enc: &[u8; 14] = b"setAttr-T2Enc\0";
pub const LN_setAttr_T2Enc: &[u8; 18] = b"encrypted track 2\0";
pub const NID_setAttr_T2Enc: i32 = 632;
pub const SN_setAttr_T2cleartxt: &[u8; 19] = b"setAttr-T2cleartxt\0";
pub const LN_setAttr_T2cleartxt: &[u8; 18] = b"cleartext track 2\0";
pub const NID_setAttr_T2cleartxt: i32 = 633;
pub const SN_setAttr_TokICCsig: &[u8; 18] = b"setAttr-TokICCsig\0";
pub const LN_setAttr_TokICCsig: &[u8; 23] = b"ICC or token signature\0";
pub const NID_setAttr_TokICCsig: i32 = 634;
pub const SN_setAttr_SecDevSig: &[u8; 18] = b"setAttr-SecDevSig\0";
pub const LN_setAttr_SecDevSig: &[u8; 24] = b"secure device signature\0";
pub const NID_setAttr_SecDevSig: i32 = 635;
pub const SN_set_brand_IATA_ATA: &[u8; 19] = b"set-brand-IATA-ATA\0";
pub const NID_set_brand_IATA_ATA: i32 = 636;
pub const SN_set_brand_Diners: &[u8; 17] = b"set-brand-Diners\0";
pub const NID_set_brand_Diners: i32 = 637;
pub const SN_set_brand_AmericanExpress: &[u8; 26] = b"set-brand-AmericanExpress\0";
pub const NID_set_brand_AmericanExpress: i32 = 638;
pub const SN_set_brand_JCB: &[u8; 14] = b"set-brand-JCB\0";
pub const NID_set_brand_JCB: i32 = 639;
pub const SN_set_brand_Visa: &[u8; 15] = b"set-brand-Visa\0";
pub const NID_set_brand_Visa: i32 = 640;
pub const SN_set_brand_MasterCard: &[u8; 21] = b"set-brand-MasterCard\0";
pub const NID_set_brand_MasterCard: i32 = 641;
pub const SN_set_brand_Novus: &[u8; 16] = b"set-brand-Novus\0";
pub const NID_set_brand_Novus: i32 = 642;
pub const SN_des_cdmf: &[u8; 9] = b"DES-CDMF\0";
pub const LN_des_cdmf: &[u8; 9] = b"des-cdmf\0";
pub const NID_des_cdmf: i32 = 643;
pub const SN_rsaOAEPEncryptionSET: &[u8; 21] = b"rsaOAEPEncryptionSET\0";
pub const NID_rsaOAEPEncryptionSET: i32 = 644;
pub const SN_itu_t: &[u8; 6] = b"ITU-T\0";
pub const LN_itu_t: &[u8; 6] = b"itu-t\0";
pub const NID_itu_t: i32 = 645;
pub const OBJ_itu_t: i32 = 0;
pub const SN_joint_iso_itu_t: &[u8; 16] = b"JOINT-ISO-ITU-T\0";
pub const LN_joint_iso_itu_t: &[u8; 16] = b"joint-iso-itu-t\0";
pub const NID_joint_iso_itu_t: i32 = 646;
pub const OBJ_joint_iso_itu_t: i32 = 2;
pub const SN_international_organizations: &[u8; 28] = b"international-organizations\0";
pub const LN_international_organizations: &[u8; 28] = b"International Organizations\0";
pub const NID_international_organizations: i32 = 647;
pub const OBJ_ENC_international_organizations: i32 = 103;
pub const SN_ms_smartcard_login: &[u8; 17] = b"msSmartcardLogin\0";
pub const LN_ms_smartcard_login: &[u8; 25] = b"Microsoft Smartcardlogin\0";
pub const NID_ms_smartcard_login: i32 = 648;
pub const SN_ms_upn: &[u8; 6] = b"msUPN\0";
pub const LN_ms_upn: &[u8; 35] = b"Microsoft Universal Principal Name\0";
pub const NID_ms_upn: i32 = 649;
pub const SN_aes_128_cfb1: &[u8; 13] = b"AES-128-CFB1\0";
pub const LN_aes_128_cfb1: &[u8; 13] = b"aes-128-cfb1\0";
pub const NID_aes_128_cfb1: i32 = 650;
pub const SN_aes_192_cfb1: &[u8; 13] = b"AES-192-CFB1\0";
pub const LN_aes_192_cfb1: &[u8; 13] = b"aes-192-cfb1\0";
pub const NID_aes_192_cfb1: i32 = 651;
pub const SN_aes_256_cfb1: &[u8; 13] = b"AES-256-CFB1\0";
pub const LN_aes_256_cfb1: &[u8; 13] = b"aes-256-cfb1\0";
pub const NID_aes_256_cfb1: i32 = 652;
pub const SN_aes_128_cfb8: &[u8; 13] = b"AES-128-CFB8\0";
pub const LN_aes_128_cfb8: &[u8; 13] = b"aes-128-cfb8\0";
pub const NID_aes_128_cfb8: i32 = 653;
pub const SN_aes_192_cfb8: &[u8; 13] = b"AES-192-CFB8\0";
pub const LN_aes_192_cfb8: &[u8; 13] = b"aes-192-cfb8\0";
pub const NID_aes_192_cfb8: i32 = 654;
pub const SN_aes_256_cfb8: &[u8; 13] = b"AES-256-CFB8\0";
pub const LN_aes_256_cfb8: &[u8; 13] = b"aes-256-cfb8\0";
pub const NID_aes_256_cfb8: i32 = 655;
pub const SN_des_cfb1: &[u8; 9] = b"DES-CFB1\0";
pub const LN_des_cfb1: &[u8; 9] = b"des-cfb1\0";
pub const NID_des_cfb1: i32 = 656;
pub const SN_des_cfb8: &[u8; 9] = b"DES-CFB8\0";
pub const LN_des_cfb8: &[u8; 9] = b"des-cfb8\0";
pub const NID_des_cfb8: i32 = 657;
pub const SN_des_ede3_cfb1: &[u8; 14] = b"DES-EDE3-CFB1\0";
pub const LN_des_ede3_cfb1: &[u8; 14] = b"des-ede3-cfb1\0";
pub const NID_des_ede3_cfb1: i32 = 658;
pub const SN_des_ede3_cfb8: &[u8; 14] = b"DES-EDE3-CFB8\0";
pub const LN_des_ede3_cfb8: &[u8; 14] = b"des-ede3-cfb8\0";
pub const NID_des_ede3_cfb8: i32 = 659;
pub const SN_streetAddress: &[u8; 7] = b"street\0";
pub const LN_streetAddress: &[u8; 14] = b"streetAddress\0";
pub const NID_streetAddress: i32 = 660;
pub const LN_postalCode: &[u8; 11] = b"postalCode\0";
pub const NID_postalCode: i32 = 661;
pub const SN_id_ppl: &[u8; 7] = b"id-ppl\0";
pub const NID_id_ppl: i32 = 662;
pub const SN_proxyCertInfo: &[u8; 14] = b"proxyCertInfo\0";
pub const LN_proxyCertInfo: &[u8; 30] = b"Proxy Certificate Information\0";
pub const NID_proxyCertInfo: i32 = 663;
pub const SN_id_ppl_anyLanguage: &[u8; 19] = b"id-ppl-anyLanguage\0";
pub const LN_id_ppl_anyLanguage: &[u8; 13] = b"Any language\0";
pub const NID_id_ppl_anyLanguage: i32 = 664;
pub const SN_id_ppl_inheritAll: &[u8; 18] = b"id-ppl-inheritAll\0";
pub const LN_id_ppl_inheritAll: &[u8; 12] = b"Inherit all\0";
pub const NID_id_ppl_inheritAll: i32 = 665;
pub const SN_name_constraints: &[u8; 16] = b"nameConstraints\0";
pub const LN_name_constraints: &[u8; 24] = b"X509v3 Name Constraints\0";
pub const NID_name_constraints: i32 = 666;
pub const SN_Independent: &[u8; 19] = b"id-ppl-independent\0";
pub const LN_Independent: &[u8; 12] = b"Independent\0";
pub const NID_Independent: i32 = 667;
pub const SN_sha256WithRSAEncryption: &[u8; 11] = b"RSA-SHA256\0";
pub const LN_sha256WithRSAEncryption: &[u8; 24] = b"sha256WithRSAEncryption\0";
pub const NID_sha256WithRSAEncryption: i32 = 668;
pub const SN_sha384WithRSAEncryption: &[u8; 11] = b"RSA-SHA384\0";
pub const LN_sha384WithRSAEncryption: &[u8; 24] = b"sha384WithRSAEncryption\0";
pub const NID_sha384WithRSAEncryption: i32 = 669;
pub const SN_sha512WithRSAEncryption: &[u8; 11] = b"RSA-SHA512\0";
pub const LN_sha512WithRSAEncryption: &[u8; 24] = b"sha512WithRSAEncryption\0";
pub const NID_sha512WithRSAEncryption: i32 = 670;
pub const SN_sha224WithRSAEncryption: &[u8; 11] = b"RSA-SHA224\0";
pub const LN_sha224WithRSAEncryption: &[u8; 24] = b"sha224WithRSAEncryption\0";
pub const NID_sha224WithRSAEncryption: i32 = 671;
pub const SN_sha256: &[u8; 7] = b"SHA256\0";
pub const LN_sha256: &[u8; 7] = b"sha256\0";
pub const NID_sha256: i32 = 672;
pub const SN_sha384: &[u8; 7] = b"SHA384\0";
pub const LN_sha384: &[u8; 7] = b"sha384\0";
pub const NID_sha384: i32 = 673;
pub const SN_sha512: &[u8; 7] = b"SHA512\0";
pub const LN_sha512: &[u8; 7] = b"sha512\0";
pub const NID_sha512: i32 = 674;
pub const SN_sha224: &[u8; 7] = b"SHA224\0";
pub const LN_sha224: &[u8; 7] = b"sha224\0";
pub const NID_sha224: i32 = 675;
pub const SN_identified_organization: &[u8; 24] = b"identified-organization\0";
pub const NID_identified_organization: i32 = 676;
pub const OBJ_ENC_identified_organization: i32 = 43;
pub const SN_certicom_arc: &[u8; 13] = b"certicom-arc\0";
pub const NID_certicom_arc: i32 = 677;
pub const SN_wap: &[u8; 4] = b"wap\0";
pub const NID_wap: i32 = 678;
pub const SN_wap_wsg: &[u8; 8] = b"wap-wsg\0";
pub const NID_wap_wsg: i32 = 679;
pub const SN_X9_62_id_characteristic_two_basis: &[u8; 28] = b"id-characteristic-two-basis\0";
pub const NID_X9_62_id_characteristic_two_basis: i32 = 680;
pub const SN_X9_62_onBasis: &[u8; 8] = b"onBasis\0";
pub const NID_X9_62_onBasis: i32 = 681;
pub const SN_X9_62_tpBasis: &[u8; 8] = b"tpBasis\0";
pub const NID_X9_62_tpBasis: i32 = 682;
pub const SN_X9_62_ppBasis: &[u8; 8] = b"ppBasis\0";
pub const NID_X9_62_ppBasis: i32 = 683;
pub const SN_X9_62_c2pnb163v1: &[u8; 11] = b"c2pnb163v1\0";
pub const NID_X9_62_c2pnb163v1: i32 = 684;
pub const SN_X9_62_c2pnb163v2: &[u8; 11] = b"c2pnb163v2\0";
pub const NID_X9_62_c2pnb163v2: i32 = 685;
pub const SN_X9_62_c2pnb163v3: &[u8; 11] = b"c2pnb163v3\0";
pub const NID_X9_62_c2pnb163v3: i32 = 686;
pub const SN_X9_62_c2pnb176v1: &[u8; 11] = b"c2pnb176v1\0";
pub const NID_X9_62_c2pnb176v1: i32 = 687;
pub const SN_X9_62_c2tnb191v1: &[u8; 11] = b"c2tnb191v1\0";
pub const NID_X9_62_c2tnb191v1: i32 = 688;
pub const SN_X9_62_c2tnb191v2: &[u8; 11] = b"c2tnb191v2\0";
pub const NID_X9_62_c2tnb191v2: i32 = 689;
pub const SN_X9_62_c2tnb191v3: &[u8; 11] = b"c2tnb191v3\0";
pub const NID_X9_62_c2tnb191v3: i32 = 690;
pub const SN_X9_62_c2onb191v4: &[u8; 11] = b"c2onb191v4\0";
pub const NID_X9_62_c2onb191v4: i32 = 691;
pub const SN_X9_62_c2onb191v5: &[u8; 11] = b"c2onb191v5\0";
pub const NID_X9_62_c2onb191v5: i32 = 692;
pub const SN_X9_62_c2pnb208w1: &[u8; 11] = b"c2pnb208w1\0";
pub const NID_X9_62_c2pnb208w1: i32 = 693;
pub const SN_X9_62_c2tnb239v1: &[u8; 11] = b"c2tnb239v1\0";
pub const NID_X9_62_c2tnb239v1: i32 = 694;
pub const SN_X9_62_c2tnb239v2: &[u8; 11] = b"c2tnb239v2\0";
pub const NID_X9_62_c2tnb239v2: i32 = 695;
pub const SN_X9_62_c2tnb239v3: &[u8; 11] = b"c2tnb239v3\0";
pub const NID_X9_62_c2tnb239v3: i32 = 696;
pub const SN_X9_62_c2onb239v4: &[u8; 11] = b"c2onb239v4\0";
pub const NID_X9_62_c2onb239v4: i32 = 697;
pub const SN_X9_62_c2onb239v5: &[u8; 11] = b"c2onb239v5\0";
pub const NID_X9_62_c2onb239v5: i32 = 698;
pub const SN_X9_62_c2pnb272w1: &[u8; 11] = b"c2pnb272w1\0";
pub const NID_X9_62_c2pnb272w1: i32 = 699;
pub const SN_X9_62_c2pnb304w1: &[u8; 11] = b"c2pnb304w1\0";
pub const NID_X9_62_c2pnb304w1: i32 = 700;
pub const SN_X9_62_c2tnb359v1: &[u8; 11] = b"c2tnb359v1\0";
pub const NID_X9_62_c2tnb359v1: i32 = 701;
pub const SN_X9_62_c2pnb368w1: &[u8; 11] = b"c2pnb368w1\0";
pub const NID_X9_62_c2pnb368w1: i32 = 702;
pub const SN_X9_62_c2tnb431r1: &[u8; 11] = b"c2tnb431r1\0";
pub const NID_X9_62_c2tnb431r1: i32 = 703;
pub const SN_secp112r1: &[u8; 10] = b"secp112r1\0";
pub const NID_secp112r1: i32 = 704;
pub const SN_secp112r2: &[u8; 10] = b"secp112r2\0";
pub const NID_secp112r2: i32 = 705;
pub const SN_secp128r1: &[u8; 10] = b"secp128r1\0";
pub const NID_secp128r1: i32 = 706;
pub const SN_secp128r2: &[u8; 10] = b"secp128r2\0";
pub const NID_secp128r2: i32 = 707;
pub const SN_secp160k1: &[u8; 10] = b"secp160k1\0";
pub const NID_secp160k1: i32 = 708;
pub const SN_secp160r1: &[u8; 10] = b"secp160r1\0";
pub const NID_secp160r1: i32 = 709;
pub const SN_secp160r2: &[u8; 10] = b"secp160r2\0";
pub const NID_secp160r2: i32 = 710;
pub const SN_secp192k1: &[u8; 10] = b"secp192k1\0";
pub const NID_secp192k1: i32 = 711;
pub const SN_secp224k1: &[u8; 10] = b"secp224k1\0";
pub const NID_secp224k1: i32 = 712;
pub const SN_secp224r1: &[u8; 10] = b"secp224r1\0";
pub const NID_secp224r1: i32 = 713;
pub const SN_secp256k1: &[u8; 10] = b"secp256k1\0";
pub const NID_secp256k1: i32 = 714;
pub const SN_secp384r1: &[u8; 10] = b"secp384r1\0";
pub const NID_secp384r1: i32 = 715;
pub const SN_secp521r1: &[u8; 10] = b"secp521r1\0";
pub const NID_secp521r1: i32 = 716;
pub const SN_sect113r1: &[u8; 10] = b"sect113r1\0";
pub const NID_sect113r1: i32 = 717;
pub const SN_sect113r2: &[u8; 10] = b"sect113r2\0";
pub const NID_sect113r2: i32 = 718;
pub const SN_sect131r1: &[u8; 10] = b"sect131r1\0";
pub const NID_sect131r1: i32 = 719;
pub const SN_sect131r2: &[u8; 10] = b"sect131r2\0";
pub const NID_sect131r2: i32 = 720;
pub const SN_sect163k1: &[u8; 10] = b"sect163k1\0";
pub const NID_sect163k1: i32 = 721;
pub const SN_sect163r1: &[u8; 10] = b"sect163r1\0";
pub const NID_sect163r1: i32 = 722;
pub const SN_sect163r2: &[u8; 10] = b"sect163r2\0";
pub const NID_sect163r2: i32 = 723;
pub const SN_sect193r1: &[u8; 10] = b"sect193r1\0";
pub const NID_sect193r1: i32 = 724;
pub const SN_sect193r2: &[u8; 10] = b"sect193r2\0";
pub const NID_sect193r2: i32 = 725;
pub const SN_sect233k1: &[u8; 10] = b"sect233k1\0";
pub const NID_sect233k1: i32 = 726;
pub const SN_sect233r1: &[u8; 10] = b"sect233r1\0";
pub const NID_sect233r1: i32 = 727;
pub const SN_sect239k1: &[u8; 10] = b"sect239k1\0";
pub const NID_sect239k1: i32 = 728;
pub const SN_sect283k1: &[u8; 10] = b"sect283k1\0";
pub const NID_sect283k1: i32 = 729;
pub const SN_sect283r1: &[u8; 10] = b"sect283r1\0";
pub const NID_sect283r1: i32 = 730;
pub const SN_sect409k1: &[u8; 10] = b"sect409k1\0";
pub const NID_sect409k1: i32 = 731;
pub const SN_sect409r1: &[u8; 10] = b"sect409r1\0";
pub const NID_sect409r1: i32 = 732;
pub const SN_sect571k1: &[u8; 10] = b"sect571k1\0";
pub const NID_sect571k1: i32 = 733;
pub const SN_sect571r1: &[u8; 10] = b"sect571r1\0";
pub const NID_sect571r1: i32 = 734;
pub const SN_wap_wsg_idm_ecid_wtls1: &[u8; 23] = b"wap-wsg-idm-ecid-wtls1\0";
pub const NID_wap_wsg_idm_ecid_wtls1: i32 = 735;
pub const SN_wap_wsg_idm_ecid_wtls3: &[u8; 23] = b"wap-wsg-idm-ecid-wtls3\0";
pub const NID_wap_wsg_idm_ecid_wtls3: i32 = 736;
pub const SN_wap_wsg_idm_ecid_wtls4: &[u8; 23] = b"wap-wsg-idm-ecid-wtls4\0";
pub const NID_wap_wsg_idm_ecid_wtls4: i32 = 737;
pub const SN_wap_wsg_idm_ecid_wtls5: &[u8; 23] = b"wap-wsg-idm-ecid-wtls5\0";
pub const NID_wap_wsg_idm_ecid_wtls5: i32 = 738;
pub const SN_wap_wsg_idm_ecid_wtls6: &[u8; 23] = b"wap-wsg-idm-ecid-wtls6\0";
pub const NID_wap_wsg_idm_ecid_wtls6: i32 = 739;
pub const SN_wap_wsg_idm_ecid_wtls7: &[u8; 23] = b"wap-wsg-idm-ecid-wtls7\0";
pub const NID_wap_wsg_idm_ecid_wtls7: i32 = 740;
pub const SN_wap_wsg_idm_ecid_wtls8: &[u8; 23] = b"wap-wsg-idm-ecid-wtls8\0";
pub const NID_wap_wsg_idm_ecid_wtls8: i32 = 741;
pub const SN_wap_wsg_idm_ecid_wtls9: &[u8; 23] = b"wap-wsg-idm-ecid-wtls9\0";
pub const NID_wap_wsg_idm_ecid_wtls9: i32 = 742;
pub const SN_wap_wsg_idm_ecid_wtls10: &[u8; 24] = b"wap-wsg-idm-ecid-wtls10\0";
pub const NID_wap_wsg_idm_ecid_wtls10: i32 = 743;
pub const SN_wap_wsg_idm_ecid_wtls11: &[u8; 24] = b"wap-wsg-idm-ecid-wtls11\0";
pub const NID_wap_wsg_idm_ecid_wtls11: i32 = 744;
pub const SN_wap_wsg_idm_ecid_wtls12: &[u8; 24] = b"wap-wsg-idm-ecid-wtls12\0";
pub const NID_wap_wsg_idm_ecid_wtls12: i32 = 745;
pub const SN_any_policy: &[u8; 10] = b"anyPolicy\0";
pub const LN_any_policy: &[u8; 18] = b"X509v3 Any Policy\0";
pub const NID_any_policy: i32 = 746;
pub const SN_policy_mappings: &[u8; 15] = b"policyMappings\0";
pub const LN_policy_mappings: &[u8; 23] = b"X509v3 Policy Mappings\0";
pub const NID_policy_mappings: i32 = 747;
pub const SN_inhibit_any_policy: &[u8; 17] = b"inhibitAnyPolicy\0";
pub const LN_inhibit_any_policy: &[u8; 26] = b"X509v3 Inhibit Any Policy\0";
pub const NID_inhibit_any_policy: i32 = 748;
pub const SN_ipsec3: &[u8; 14] = b"Oakley-EC2N-3\0";
pub const LN_ipsec3: &[u8; 7] = b"ipsec3\0";
pub const NID_ipsec3: i32 = 749;
pub const SN_ipsec4: &[u8; 14] = b"Oakley-EC2N-4\0";
pub const LN_ipsec4: &[u8; 7] = b"ipsec4\0";
pub const NID_ipsec4: i32 = 750;
pub const SN_camellia_128_cbc: &[u8; 17] = b"CAMELLIA-128-CBC\0";
pub const LN_camellia_128_cbc: &[u8; 17] = b"camellia-128-cbc\0";
pub const NID_camellia_128_cbc: i32 = 751;
pub const SN_camellia_192_cbc: &[u8; 17] = b"CAMELLIA-192-CBC\0";
pub const LN_camellia_192_cbc: &[u8; 17] = b"camellia-192-cbc\0";
pub const NID_camellia_192_cbc: i32 = 752;
pub const SN_camellia_256_cbc: &[u8; 17] = b"CAMELLIA-256-CBC\0";
pub const LN_camellia_256_cbc: &[u8; 17] = b"camellia-256-cbc\0";
pub const NID_camellia_256_cbc: i32 = 753;
pub const SN_camellia_128_ecb: &[u8; 17] = b"CAMELLIA-128-ECB\0";
pub const LN_camellia_128_ecb: &[u8; 17] = b"camellia-128-ecb\0";
pub const NID_camellia_128_ecb: i32 = 754;
pub const SN_camellia_192_ecb: &[u8; 17] = b"CAMELLIA-192-ECB\0";
pub const LN_camellia_192_ecb: &[u8; 17] = b"camellia-192-ecb\0";
pub const NID_camellia_192_ecb: i32 = 755;
pub const SN_camellia_256_ecb: &[u8; 17] = b"CAMELLIA-256-ECB\0";
pub const LN_camellia_256_ecb: &[u8; 17] = b"camellia-256-ecb\0";
pub const NID_camellia_256_ecb: i32 = 756;
pub const SN_camellia_128_cfb128: &[u8; 17] = b"CAMELLIA-128-CFB\0";
pub const LN_camellia_128_cfb128: &[u8; 17] = b"camellia-128-cfb\0";
pub const NID_camellia_128_cfb128: i32 = 757;
pub const SN_camellia_192_cfb128: &[u8; 17] = b"CAMELLIA-192-CFB\0";
pub const LN_camellia_192_cfb128: &[u8; 17] = b"camellia-192-cfb\0";
pub const NID_camellia_192_cfb128: i32 = 758;
pub const SN_camellia_256_cfb128: &[u8; 17] = b"CAMELLIA-256-CFB\0";
pub const LN_camellia_256_cfb128: &[u8; 17] = b"camellia-256-cfb\0";
pub const NID_camellia_256_cfb128: i32 = 759;
pub const SN_camellia_128_cfb1: &[u8; 18] = b"CAMELLIA-128-CFB1\0";
pub const LN_camellia_128_cfb1: &[u8; 18] = b"camellia-128-cfb1\0";
pub const NID_camellia_128_cfb1: i32 = 760;
pub const SN_camellia_192_cfb1: &[u8; 18] = b"CAMELLIA-192-CFB1\0";
pub const LN_camellia_192_cfb1: &[u8; 18] = b"camellia-192-cfb1\0";
pub const NID_camellia_192_cfb1: i32 = 761;
pub const SN_camellia_256_cfb1: &[u8; 18] = b"CAMELLIA-256-CFB1\0";
pub const LN_camellia_256_cfb1: &[u8; 18] = b"camellia-256-cfb1\0";
pub const NID_camellia_256_cfb1: i32 = 762;
pub const SN_camellia_128_cfb8: &[u8; 18] = b"CAMELLIA-128-CFB8\0";
pub const LN_camellia_128_cfb8: &[u8; 18] = b"camellia-128-cfb8\0";
pub const NID_camellia_128_cfb8: i32 = 763;
pub const SN_camellia_192_cfb8: &[u8; 18] = b"CAMELLIA-192-CFB8\0";
pub const LN_camellia_192_cfb8: &[u8; 18] = b"camellia-192-cfb8\0";
pub const NID_camellia_192_cfb8: i32 = 764;
pub const SN_camellia_256_cfb8: &[u8; 18] = b"CAMELLIA-256-CFB8\0";
pub const LN_camellia_256_cfb8: &[u8; 18] = b"camellia-256-cfb8\0";
pub const NID_camellia_256_cfb8: i32 = 765;
pub const SN_camellia_128_ofb128: &[u8; 17] = b"CAMELLIA-128-OFB\0";
pub const LN_camellia_128_ofb128: &[u8; 17] = b"camellia-128-ofb\0";
pub const NID_camellia_128_ofb128: i32 = 766;
pub const SN_camellia_192_ofb128: &[u8; 17] = b"CAMELLIA-192-OFB\0";
pub const LN_camellia_192_ofb128: &[u8; 17] = b"camellia-192-ofb\0";
pub const NID_camellia_192_ofb128: i32 = 767;
pub const SN_camellia_256_ofb128: &[u8; 17] = b"CAMELLIA-256-OFB\0";
pub const LN_camellia_256_ofb128: &[u8; 17] = b"camellia-256-ofb\0";
pub const NID_camellia_256_ofb128: i32 = 768;
pub const SN_subject_directory_attributes: &[u8; 27] = b"subjectDirectoryAttributes\0";
pub const LN_subject_directory_attributes: &[u8; 36] = b"X509v3 Subject Directory Attributes\0";
pub const NID_subject_directory_attributes: i32 = 769;
pub const SN_issuing_distribution_point: &[u8; 25] = b"issuingDistributionPoint\0";
pub const LN_issuing_distribution_point: &[u8; 34] = b"X509v3 Issuing Distribution Point\0";
pub const NID_issuing_distribution_point: i32 = 770;
pub const SN_certificate_issuer: &[u8; 18] = b"certificateIssuer\0";
pub const LN_certificate_issuer: &[u8; 26] = b"X509v3 Certificate Issuer\0";
pub const NID_certificate_issuer: i32 = 771;
pub const SN_kisa: &[u8; 5] = b"KISA\0";
pub const LN_kisa: &[u8; 5] = b"kisa\0";
pub const NID_kisa: i32 = 773;
pub const SN_seed_ecb: &[u8; 9] = b"SEED-ECB\0";
pub const LN_seed_ecb: &[u8; 9] = b"seed-ecb\0";
pub const NID_seed_ecb: i32 = 776;
pub const SN_seed_cbc: &[u8; 9] = b"SEED-CBC\0";
pub const LN_seed_cbc: &[u8; 9] = b"seed-cbc\0";
pub const NID_seed_cbc: i32 = 777;
pub const SN_seed_ofb128: &[u8; 9] = b"SEED-OFB\0";
pub const LN_seed_ofb128: &[u8; 9] = b"seed-ofb\0";
pub const NID_seed_ofb128: i32 = 778;
pub const SN_seed_cfb128: &[u8; 9] = b"SEED-CFB\0";
pub const LN_seed_cfb128: &[u8; 9] = b"seed-cfb\0";
pub const NID_seed_cfb128: i32 = 779;
pub const SN_hmac_md5: &[u8; 9] = b"HMAC-MD5\0";
pub const LN_hmac_md5: &[u8; 9] = b"hmac-md5\0";
pub const NID_hmac_md5: i32 = 780;
pub const SN_hmac_sha1: &[u8; 10] = b"HMAC-SHA1\0";
pub const LN_hmac_sha1: &[u8; 10] = b"hmac-sha1\0";
pub const NID_hmac_sha1: i32 = 781;
pub const SN_id_PasswordBasedMAC: &[u8; 20] = b"id-PasswordBasedMAC\0";
pub const LN_id_PasswordBasedMAC: &[u8; 19] = b"password based MAC\0";
pub const NID_id_PasswordBasedMAC: i32 = 782;
pub const SN_id_DHBasedMac: &[u8; 14] = b"id-DHBasedMac\0";
pub const LN_id_DHBasedMac: &[u8; 25] = b"Diffie-Hellman based MAC\0";
pub const NID_id_DHBasedMac: i32 = 783;
pub const SN_id_it_suppLangTags: &[u8; 19] = b"id-it-suppLangTags\0";
pub const NID_id_it_suppLangTags: i32 = 784;
pub const SN_caRepository: &[u8; 13] = b"caRepository\0";
pub const LN_caRepository: &[u8; 14] = b"CA Repository\0";
pub const NID_caRepository: i32 = 785;
pub const SN_id_smime_ct_compressedData: &[u8; 27] = b"id-smime-ct-compressedData\0";
pub const NID_id_smime_ct_compressedData: i32 = 786;
pub const SN_id_ct_asciiTextWithCRLF: &[u8; 24] = b"id-ct-asciiTextWithCRLF\0";
pub const NID_id_ct_asciiTextWithCRLF: i32 = 787;
pub const SN_id_aes128_wrap: &[u8; 15] = b"id-aes128-wrap\0";
pub const NID_id_aes128_wrap: i32 = 788;
pub const SN_id_aes192_wrap: &[u8; 15] = b"id-aes192-wrap\0";
pub const NID_id_aes192_wrap: i32 = 789;
pub const SN_id_aes256_wrap: &[u8; 15] = b"id-aes256-wrap\0";
pub const NID_id_aes256_wrap: i32 = 790;
pub const SN_ecdsa_with_Recommended: &[u8; 23] = b"ecdsa-with-Recommended\0";
pub const NID_ecdsa_with_Recommended: i32 = 791;
pub const SN_ecdsa_with_Specified: &[u8; 21] = b"ecdsa-with-Specified\0";
pub const NID_ecdsa_with_Specified: i32 = 792;
pub const SN_ecdsa_with_SHA224: &[u8; 18] = b"ecdsa-with-SHA224\0";
pub const NID_ecdsa_with_SHA224: i32 = 793;
pub const SN_ecdsa_with_SHA256: &[u8; 18] = b"ecdsa-with-SHA256\0";
pub const NID_ecdsa_with_SHA256: i32 = 794;
pub const SN_ecdsa_with_SHA384: &[u8; 18] = b"ecdsa-with-SHA384\0";
pub const NID_ecdsa_with_SHA384: i32 = 795;
pub const SN_ecdsa_with_SHA512: &[u8; 18] = b"ecdsa-with-SHA512\0";
pub const NID_ecdsa_with_SHA512: i32 = 796;
pub const LN_hmacWithMD5: &[u8; 12] = b"hmacWithMD5\0";
pub const NID_hmacWithMD5: i32 = 797;
pub const LN_hmacWithSHA224: &[u8; 15] = b"hmacWithSHA224\0";
pub const NID_hmacWithSHA224: i32 = 798;
pub const LN_hmacWithSHA256: &[u8; 15] = b"hmacWithSHA256\0";
pub const NID_hmacWithSHA256: i32 = 799;
pub const LN_hmacWithSHA384: &[u8; 15] = b"hmacWithSHA384\0";
pub const NID_hmacWithSHA384: i32 = 800;
pub const LN_hmacWithSHA512: &[u8; 15] = b"hmacWithSHA512\0";
pub const NID_hmacWithSHA512: i32 = 801;
pub const SN_dsa_with_SHA224: &[u8; 16] = b"dsa_with_SHA224\0";
pub const NID_dsa_with_SHA224: i32 = 802;
pub const SN_dsa_with_SHA256: &[u8; 16] = b"dsa_with_SHA256\0";
pub const NID_dsa_with_SHA256: i32 = 803;
pub const SN_whirlpool: &[u8; 10] = b"whirlpool\0";
pub const NID_whirlpool: i32 = 804;
pub const SN_cryptopro: &[u8; 10] = b"cryptopro\0";
pub const NID_cryptopro: i32 = 805;
pub const SN_cryptocom: &[u8; 10] = b"cryptocom\0";
pub const NID_cryptocom: i32 = 806;
pub const SN_id_GostR3411_94_with_GostR3410_2001: &[u8; 36] =
    b"id-GostR3411-94-with-GostR3410-2001\0";
pub const LN_id_GostR3411_94_with_GostR3410_2001: &[u8; 39] =
    b"GOST R 34.11-94 with GOST R 34.10-2001\0";
pub const NID_id_GostR3411_94_with_GostR3410_2001: i32 = 807;
pub const SN_id_GostR3411_94_with_GostR3410_94: &[u8; 34] = b"id-GostR3411-94-with-GostR3410-94\0";
pub const LN_id_GostR3411_94_with_GostR3410_94: &[u8; 37] =
    b"GOST R 34.11-94 with GOST R 34.10-94\0";
pub const NID_id_GostR3411_94_with_GostR3410_94: i32 = 808;
pub const SN_id_GostR3411_94: &[u8; 10] = b"md_gost94\0";
pub const LN_id_GostR3411_94: &[u8; 16] = b"GOST R 34.11-94\0";
pub const NID_id_GostR3411_94: i32 = 809;
pub const SN_id_HMACGostR3411_94: &[u8; 20] = b"id-HMACGostR3411-94\0";
pub const LN_id_HMACGostR3411_94: &[u8; 19] = b"HMAC GOST 34.11-94\0";
pub const NID_id_HMACGostR3411_94: i32 = 810;
pub const SN_id_GostR3410_2001: &[u8; 9] = b"gost2001\0";
pub const LN_id_GostR3410_2001: &[u8; 18] = b"GOST R 34.10-2001\0";
pub const NID_id_GostR3410_2001: i32 = 811;
pub const SN_id_GostR3410_94: &[u8; 7] = b"gost94\0";
pub const LN_id_GostR3410_94: &[u8; 16] = b"GOST R 34.10-94\0";
pub const NID_id_GostR3410_94: i32 = 812;
pub const SN_id_Gost28147_89: &[u8; 7] = b"gost89\0";
pub const LN_id_Gost28147_89: &[u8; 14] = b"GOST 28147-89\0";
pub const NID_id_Gost28147_89: i32 = 813;
pub const SN_gost89_cnt: &[u8; 11] = b"gost89-cnt\0";
pub const NID_gost89_cnt: i32 = 814;
pub const SN_id_Gost28147_89_MAC: &[u8; 9] = b"gost-mac\0";
pub const LN_id_Gost28147_89_MAC: &[u8; 18] = b"GOST 28147-89 MAC\0";
pub const NID_id_Gost28147_89_MAC: i32 = 815;
pub const SN_id_GostR3411_94_prf: &[u8; 17] = b"prf-gostr3411-94\0";
pub const LN_id_GostR3411_94_prf: &[u8; 20] = b"GOST R 34.11-94 PRF\0";
pub const NID_id_GostR3411_94_prf: i32 = 816;
pub const SN_id_GostR3410_2001DH: &[u8; 20] = b"id-GostR3410-2001DH\0";
pub const LN_id_GostR3410_2001DH: &[u8; 21] = b"GOST R 34.10-2001 DH\0";
pub const NID_id_GostR3410_2001DH: i32 = 817;
pub const SN_id_GostR3410_94DH: &[u8; 18] = b"id-GostR3410-94DH\0";
pub const LN_id_GostR3410_94DH: &[u8; 19] = b"GOST R 34.10-94 DH\0";
pub const NID_id_GostR3410_94DH: i32 = 818;
pub const SN_id_Gost28147_89_CryptoPro_KeyMeshing: &[u8; 37] =
    b"id-Gost28147-89-CryptoPro-KeyMeshing\0";
pub const NID_id_Gost28147_89_CryptoPro_KeyMeshing: i32 = 819;
pub const SN_id_Gost28147_89_None_KeyMeshing: &[u8; 32] = b"id-Gost28147-89-None-KeyMeshing\0";
pub const NID_id_Gost28147_89_None_KeyMeshing: i32 = 820;
pub const SN_id_GostR3411_94_TestParamSet: &[u8; 29] = b"id-GostR3411-94-TestParamSet\0";
pub const NID_id_GostR3411_94_TestParamSet: i32 = 821;
pub const SN_id_GostR3411_94_CryptoProParamSet: &[u8; 34] = b"id-GostR3411-94-CryptoProParamSet\0";
pub const NID_id_GostR3411_94_CryptoProParamSet: i32 = 822;
pub const SN_id_Gost28147_89_TestParamSet: &[u8; 29] = b"id-Gost28147-89-TestParamSet\0";
pub const NID_id_Gost28147_89_TestParamSet: i32 = 823;
pub const SN_id_Gost28147_89_CryptoPro_A_ParamSet: &[u8; 37] =
    b"id-Gost28147-89-CryptoPro-A-ParamSet\0";
pub const NID_id_Gost28147_89_CryptoPro_A_ParamSet: i32 = 824;
pub const SN_id_Gost28147_89_CryptoPro_B_ParamSet: &[u8; 37] =
    b"id-Gost28147-89-CryptoPro-B-ParamSet\0";
pub const NID_id_Gost28147_89_CryptoPro_B_ParamSet: i32 = 825;
pub const SN_id_Gost28147_89_CryptoPro_C_ParamSet: &[u8; 37] =
    b"id-Gost28147-89-CryptoPro-C-ParamSet\0";
pub const NID_id_Gost28147_89_CryptoPro_C_ParamSet: i32 = 826;
pub const SN_id_Gost28147_89_CryptoPro_D_ParamSet: &[u8; 37] =
    b"id-Gost28147-89-CryptoPro-D-ParamSet\0";
pub const NID_id_Gost28147_89_CryptoPro_D_ParamSet: i32 = 827;
pub const SN_id_Gost28147_89_CryptoPro_Oscar_1_1_ParamSet: &[u8; 45] =
    b"id-Gost28147-89-CryptoPro-Oscar-1-1-ParamSet\0";
pub const NID_id_Gost28147_89_CryptoPro_Oscar_1_1_ParamSet: i32 = 828;
pub const SN_id_Gost28147_89_CryptoPro_Oscar_1_0_ParamSet: &[u8; 45] =
    b"id-Gost28147-89-CryptoPro-Oscar-1-0-ParamSet\0";
pub const NID_id_Gost28147_89_CryptoPro_Oscar_1_0_ParamSet: i32 = 829;
pub const SN_id_Gost28147_89_CryptoPro_RIC_1_ParamSet: &[u8; 41] =
    b"id-Gost28147-89-CryptoPro-RIC-1-ParamSet\0";
pub const NID_id_Gost28147_89_CryptoPro_RIC_1_ParamSet: i32 = 830;
pub const SN_id_GostR3410_94_TestParamSet: &[u8; 29] = b"id-GostR3410-94-TestParamSet\0";
pub const NID_id_GostR3410_94_TestParamSet: i32 = 831;
pub const SN_id_GostR3410_94_CryptoPro_A_ParamSet: &[u8; 37] =
    b"id-GostR3410-94-CryptoPro-A-ParamSet\0";
pub const NID_id_GostR3410_94_CryptoPro_A_ParamSet: i32 = 832;
pub const SN_id_GostR3410_94_CryptoPro_B_ParamSet: &[u8; 37] =
    b"id-GostR3410-94-CryptoPro-B-ParamSet\0";
pub const NID_id_GostR3410_94_CryptoPro_B_ParamSet: i32 = 833;
pub const SN_id_GostR3410_94_CryptoPro_C_ParamSet: &[u8; 37] =
    b"id-GostR3410-94-CryptoPro-C-ParamSet\0";
pub const NID_id_GostR3410_94_CryptoPro_C_ParamSet: i32 = 834;
pub const SN_id_GostR3410_94_CryptoPro_D_ParamSet: &[u8; 37] =
    b"id-GostR3410-94-CryptoPro-D-ParamSet\0";
pub const NID_id_GostR3410_94_CryptoPro_D_ParamSet: i32 = 835;
pub const SN_id_GostR3410_94_CryptoPro_XchA_ParamSet: &[u8; 40] =
    b"id-GostR3410-94-CryptoPro-XchA-ParamSet\0";
pub const NID_id_GostR3410_94_CryptoPro_XchA_ParamSet: i32 = 836;
pub const SN_id_GostR3410_94_CryptoPro_XchB_ParamSet: &[u8; 40] =
    b"id-GostR3410-94-CryptoPro-XchB-ParamSet\0";
pub const NID_id_GostR3410_94_CryptoPro_XchB_ParamSet: i32 = 837;
pub const SN_id_GostR3410_94_CryptoPro_XchC_ParamSet: &[u8; 40] =
    b"id-GostR3410-94-CryptoPro-XchC-ParamSet\0";
pub const NID_id_GostR3410_94_CryptoPro_XchC_ParamSet: i32 = 838;
pub const SN_id_GostR3410_2001_TestParamSet: &[u8; 31] = b"id-GostR3410-2001-TestParamSet\0";
pub const NID_id_GostR3410_2001_TestParamSet: i32 = 839;
pub const SN_id_GostR3410_2001_CryptoPro_A_ParamSet: &[u8; 39] =
    b"id-GostR3410-2001-CryptoPro-A-ParamSet\0";
pub const NID_id_GostR3410_2001_CryptoPro_A_ParamSet: i32 = 840;
pub const SN_id_GostR3410_2001_CryptoPro_B_ParamSet: &[u8; 39] =
    b"id-GostR3410-2001-CryptoPro-B-ParamSet\0";
pub const NID_id_GostR3410_2001_CryptoPro_B_ParamSet: i32 = 841;
pub const SN_id_GostR3410_2001_CryptoPro_C_ParamSet: &[u8; 39] =
    b"id-GostR3410-2001-CryptoPro-C-ParamSet\0";
pub const NID_id_GostR3410_2001_CryptoPro_C_ParamSet: i32 = 842;
pub const SN_id_GostR3410_2001_CryptoPro_XchA_ParamSet: &[u8; 42] =
    b"id-GostR3410-2001-CryptoPro-XchA-ParamSet\0";
pub const NID_id_GostR3410_2001_CryptoPro_XchA_ParamSet: i32 = 843;
pub const SN_id_GostR3410_2001_CryptoPro_XchB_ParamSet: &[u8; 42] =
    b"id-GostR3410-2001-CryptoPro-XchB-ParamSet\0";
pub const NID_id_GostR3410_2001_CryptoPro_XchB_ParamSet: i32 = 844;
pub const SN_id_GostR3410_94_a: &[u8; 18] = b"id-GostR3410-94-a\0";
pub const NID_id_GostR3410_94_a: i32 = 845;
pub const SN_id_GostR3410_94_aBis: &[u8; 21] = b"id-GostR3410-94-aBis\0";
pub const NID_id_GostR3410_94_aBis: i32 = 846;
pub const SN_id_GostR3410_94_b: &[u8; 18] = b"id-GostR3410-94-b\0";
pub const NID_id_GostR3410_94_b: i32 = 847;
pub const SN_id_GostR3410_94_bBis: &[u8; 21] = b"id-GostR3410-94-bBis\0";
pub const NID_id_GostR3410_94_bBis: i32 = 848;
pub const SN_id_Gost28147_89_cc: &[u8; 19] = b"id-Gost28147-89-cc\0";
pub const LN_id_Gost28147_89_cc: &[u8; 33] = b"GOST 28147-89 Cryptocom ParamSet\0";
pub const NID_id_Gost28147_89_cc: i32 = 849;
pub const SN_id_GostR3410_94_cc: &[u8; 9] = b"gost94cc\0";
pub const LN_id_GostR3410_94_cc: &[u8; 24] = b"GOST 34.10-94 Cryptocom\0";
pub const NID_id_GostR3410_94_cc: i32 = 850;
pub const SN_id_GostR3410_2001_cc: &[u8; 11] = b"gost2001cc\0";
pub const LN_id_GostR3410_2001_cc: &[u8; 26] = b"GOST 34.10-2001 Cryptocom\0";
pub const NID_id_GostR3410_2001_cc: i32 = 851;
pub const SN_id_GostR3411_94_with_GostR3410_94_cc: &[u8; 37] =
    b"id-GostR3411-94-with-GostR3410-94-cc\0";
pub const LN_id_GostR3411_94_with_GostR3410_94_cc: &[u8; 47] =
    b"GOST R 34.11-94 with GOST R 34.10-94 Cryptocom\0";
pub const NID_id_GostR3411_94_with_GostR3410_94_cc: i32 = 852;
pub const SN_id_GostR3411_94_with_GostR3410_2001_cc: &[u8; 39] =
    b"id-GostR3411-94-with-GostR3410-2001-cc\0";
pub const LN_id_GostR3411_94_with_GostR3410_2001_cc: &[u8; 49] =
    b"GOST R 34.11-94 with GOST R 34.10-2001 Cryptocom\0";
pub const NID_id_GostR3411_94_with_GostR3410_2001_cc: i32 = 853;
pub const SN_id_GostR3410_2001_ParamSet_cc: &[u8; 30] = b"id-GostR3410-2001-ParamSet-cc\0";
pub const LN_id_GostR3410_2001_ParamSet_cc: &[u8; 41] =
    b"GOST R 3410-2001 Parameter Set Cryptocom\0";
pub const NID_id_GostR3410_2001_ParamSet_cc: i32 = 854;
pub const SN_hmac: &[u8; 5] = b"HMAC\0";
pub const LN_hmac: &[u8; 5] = b"hmac\0";
pub const NID_hmac: i32 = 855;
pub const SN_LocalKeySet: &[u8; 12] = b"LocalKeySet\0";
pub const LN_LocalKeySet: &[u8; 24] = b"Microsoft Local Key set\0";
pub const NID_LocalKeySet: i32 = 856;
pub const SN_freshest_crl: &[u8; 12] = b"freshestCRL\0";
pub const LN_freshest_crl: &[u8; 20] = b"X509v3 Freshest CRL\0";
pub const NID_freshest_crl: i32 = 857;
pub const SN_id_on_permanentIdentifier: &[u8; 26] = b"id-on-permanentIdentifier\0";
pub const LN_id_on_permanentIdentifier: &[u8; 21] = b"Permanent Identifier\0";
pub const NID_id_on_permanentIdentifier: i32 = 858;
pub const LN_searchGuide: &[u8; 12] = b"searchGuide\0";
pub const NID_searchGuide: i32 = 859;
pub const LN_businessCategory: &[u8; 17] = b"businessCategory\0";
pub const NID_businessCategory: i32 = 860;
pub const LN_postalAddress: &[u8; 14] = b"postalAddress\0";
pub const NID_postalAddress: i32 = 861;
pub const LN_postOfficeBox: &[u8; 14] = b"postOfficeBox\0";
pub const NID_postOfficeBox: i32 = 862;
pub const LN_physicalDeliveryOfficeName: &[u8; 27] = b"physicalDeliveryOfficeName\0";
pub const NID_physicalDeliveryOfficeName: i32 = 863;
pub const LN_telephoneNumber: &[u8; 16] = b"telephoneNumber\0";
pub const NID_telephoneNumber: i32 = 864;
pub const LN_telexNumber: &[u8; 12] = b"telexNumber\0";
pub const NID_telexNumber: i32 = 865;
pub const LN_teletexTerminalIdentifier: &[u8; 26] = b"teletexTerminalIdentifier\0";
pub const NID_teletexTerminalIdentifier: i32 = 866;
pub const LN_facsimileTelephoneNumber: &[u8; 25] = b"facsimileTelephoneNumber\0";
pub const NID_facsimileTelephoneNumber: i32 = 867;
pub const LN_x121Address: &[u8; 12] = b"x121Address\0";
pub const NID_x121Address: i32 = 868;
pub const LN_internationaliSDNNumber: &[u8; 24] = b"internationaliSDNNumber\0";
pub const NID_internationaliSDNNumber: i32 = 869;
pub const LN_registeredAddress: &[u8; 18] = b"registeredAddress\0";
pub const NID_registeredAddress: i32 = 870;
pub const LN_destinationIndicator: &[u8; 21] = b"destinationIndicator\0";
pub const NID_destinationIndicator: i32 = 871;
pub const LN_preferredDeliveryMethod: &[u8; 24] = b"preferredDeliveryMethod\0";
pub const NID_preferredDeliveryMethod: i32 = 872;
pub const LN_presentationAddress: &[u8; 20] = b"presentationAddress\0";
pub const NID_presentationAddress: i32 = 873;
pub const LN_supportedApplicationContext: &[u8; 28] = b"supportedApplicationContext\0";
pub const NID_supportedApplicationContext: i32 = 874;
pub const SN_member: &[u8; 7] = b"member\0";
pub const NID_member: i32 = 875;
pub const SN_owner: &[u8; 6] = b"owner\0";
pub const NID_owner: i32 = 876;
pub const LN_roleOccupant: &[u8; 13] = b"roleOccupant\0";
pub const NID_roleOccupant: i32 = 877;
pub const SN_seeAlso: &[u8; 8] = b"seeAlso\0";
pub const NID_seeAlso: i32 = 878;
pub const LN_userPassword: &[u8; 13] = b"userPassword\0";
pub const NID_userPassword: i32 = 879;
pub const LN_userCertificate: &[u8; 16] = b"userCertificate\0";
pub const NID_userCertificate: i32 = 880;
pub const LN_cACertificate: &[u8; 14] = b"cACertificate\0";
pub const NID_cACertificate: i32 = 881;
pub const LN_authorityRevocationList: &[u8; 24] = b"authorityRevocationList\0";
pub const NID_authorityRevocationList: i32 = 882;
pub const LN_certificateRevocationList: &[u8; 26] = b"certificateRevocationList\0";
pub const NID_certificateRevocationList: i32 = 883;
pub const LN_crossCertificatePair: &[u8; 21] = b"crossCertificatePair\0";
pub const NID_crossCertificatePair: i32 = 884;
pub const LN_enhancedSearchGuide: &[u8; 20] = b"enhancedSearchGuide\0";
pub const NID_enhancedSearchGuide: i32 = 885;
pub const LN_protocolInformation: &[u8; 20] = b"protocolInformation\0";
pub const NID_protocolInformation: i32 = 886;
pub const LN_distinguishedName: &[u8; 18] = b"distinguishedName\0";
pub const NID_distinguishedName: i32 = 887;
pub const LN_uniqueMember: &[u8; 13] = b"uniqueMember\0";
pub const NID_uniqueMember: i32 = 888;
pub const LN_houseIdentifier: &[u8; 16] = b"houseIdentifier\0";
pub const NID_houseIdentifier: i32 = 889;
pub const LN_supportedAlgorithms: &[u8; 20] = b"supportedAlgorithms\0";
pub const NID_supportedAlgorithms: i32 = 890;
pub const LN_deltaRevocationList: &[u8; 20] = b"deltaRevocationList\0";
pub const NID_deltaRevocationList: i32 = 891;
pub const SN_dmdName: &[u8; 8] = b"dmdName\0";
pub const NID_dmdName: i32 = 892;
pub const SN_id_alg_PWRI_KEK: &[u8; 16] = b"id-alg-PWRI-KEK\0";
pub const NID_id_alg_PWRI_KEK: i32 = 893;
pub const SN_cmac: &[u8; 5] = b"CMAC\0";
pub const LN_cmac: &[u8; 5] = b"cmac\0";
pub const NID_cmac: i32 = 894;
pub const SN_aes_128_gcm: &[u8; 14] = b"id-aes128-GCM\0";
pub const LN_aes_128_gcm: &[u8; 12] = b"aes-128-gcm\0";
pub const NID_aes_128_gcm: i32 = 895;
pub const SN_aes_128_ccm: &[u8; 14] = b"id-aes128-CCM\0";
pub const LN_aes_128_ccm: &[u8; 12] = b"aes-128-ccm\0";
pub const NID_aes_128_ccm: i32 = 896;
pub const SN_id_aes128_wrap_pad: &[u8; 19] = b"id-aes128-wrap-pad\0";
pub const NID_id_aes128_wrap_pad: i32 = 897;
pub const SN_aes_192_gcm: &[u8; 14] = b"id-aes192-GCM\0";
pub const LN_aes_192_gcm: &[u8; 12] = b"aes-192-gcm\0";
pub const NID_aes_192_gcm: i32 = 898;
pub const SN_aes_192_ccm: &[u8; 14] = b"id-aes192-CCM\0";
pub const LN_aes_192_ccm: &[u8; 12] = b"aes-192-ccm\0";
pub const NID_aes_192_ccm: i32 = 899;
pub const SN_id_aes192_wrap_pad: &[u8; 19] = b"id-aes192-wrap-pad\0";
pub const NID_id_aes192_wrap_pad: i32 = 900;
pub const SN_aes_256_gcm: &[u8; 14] = b"id-aes256-GCM\0";
pub const LN_aes_256_gcm: &[u8; 12] = b"aes-256-gcm\0";
pub const NID_aes_256_gcm: i32 = 901;
pub const SN_aes_256_ccm: &[u8; 14] = b"id-aes256-CCM\0";
pub const LN_aes_256_ccm: &[u8; 12] = b"aes-256-ccm\0";
pub const NID_aes_256_ccm: i32 = 902;
pub const SN_id_aes256_wrap_pad: &[u8; 19] = b"id-aes256-wrap-pad\0";
pub const NID_id_aes256_wrap_pad: i32 = 903;
pub const SN_aes_128_ctr: &[u8; 12] = b"AES-128-CTR\0";
pub const LN_aes_128_ctr: &[u8; 12] = b"aes-128-ctr\0";
pub const NID_aes_128_ctr: i32 = 904;
pub const SN_aes_192_ctr: &[u8; 12] = b"AES-192-CTR\0";
pub const LN_aes_192_ctr: &[u8; 12] = b"aes-192-ctr\0";
pub const NID_aes_192_ctr: i32 = 905;
pub const SN_aes_256_ctr: &[u8; 12] = b"AES-256-CTR\0";
pub const LN_aes_256_ctr: &[u8; 12] = b"aes-256-ctr\0";
pub const NID_aes_256_ctr: i32 = 906;
pub const SN_id_camellia128_wrap: &[u8; 20] = b"id-camellia128-wrap\0";
pub const NID_id_camellia128_wrap: i32 = 907;
pub const SN_id_camellia192_wrap: &[u8; 20] = b"id-camellia192-wrap\0";
pub const NID_id_camellia192_wrap: i32 = 908;
pub const SN_id_camellia256_wrap: &[u8; 20] = b"id-camellia256-wrap\0";
pub const NID_id_camellia256_wrap: i32 = 909;
pub const SN_anyExtendedKeyUsage: &[u8; 20] = b"anyExtendedKeyUsage\0";
pub const LN_anyExtendedKeyUsage: &[u8; 23] = b"Any Extended Key Usage\0";
pub const NID_anyExtendedKeyUsage: i32 = 910;
pub const SN_mgf1: &[u8; 5] = b"MGF1\0";
pub const LN_mgf1: &[u8; 5] = b"mgf1\0";
pub const NID_mgf1: i32 = 911;
pub const SN_rsassaPss: &[u8; 11] = b"RSASSA-PSS\0";
pub const LN_rsassaPss: &[u8; 10] = b"rsassaPss\0";
pub const NID_rsassaPss: i32 = 912;
pub const SN_aes_128_xts: &[u8; 12] = b"AES-128-XTS\0";
pub const LN_aes_128_xts: &[u8; 12] = b"aes-128-xts\0";
pub const NID_aes_128_xts: i32 = 913;
pub const SN_aes_256_xts: &[u8; 12] = b"AES-256-XTS\0";
pub const LN_aes_256_xts: &[u8; 12] = b"aes-256-xts\0";
pub const NID_aes_256_xts: i32 = 914;
pub const SN_rc4_hmac_md5: &[u8; 13] = b"RC4-HMAC-MD5\0";
pub const LN_rc4_hmac_md5: &[u8; 13] = b"rc4-hmac-md5\0";
pub const NID_rc4_hmac_md5: i32 = 915;
pub const SN_aes_128_cbc_hmac_sha1: &[u8; 22] = b"AES-128-CBC-HMAC-SHA1\0";
pub const LN_aes_128_cbc_hmac_sha1: &[u8; 22] = b"aes-128-cbc-hmac-sha1\0";
pub const NID_aes_128_cbc_hmac_sha1: i32 = 916;
pub const SN_aes_192_cbc_hmac_sha1: &[u8; 22] = b"AES-192-CBC-HMAC-SHA1\0";
pub const LN_aes_192_cbc_hmac_sha1: &[u8; 22] = b"aes-192-cbc-hmac-sha1\0";
pub const NID_aes_192_cbc_hmac_sha1: i32 = 917;
pub const SN_aes_256_cbc_hmac_sha1: &[u8; 22] = b"AES-256-CBC-HMAC-SHA1\0";
pub const LN_aes_256_cbc_hmac_sha1: &[u8; 22] = b"aes-256-cbc-hmac-sha1\0";
pub const NID_aes_256_cbc_hmac_sha1: i32 = 918;
pub const SN_rsaesOaep: &[u8; 11] = b"RSAES-OAEP\0";
pub const LN_rsaesOaep: &[u8; 10] = b"rsaesOaep\0";
pub const NID_rsaesOaep: i32 = 919;
pub const SN_dhpublicnumber: &[u8; 15] = b"dhpublicnumber\0";
pub const LN_dhpublicnumber: &[u8; 9] = b"X9.42 DH\0";
pub const NID_dhpublicnumber: i32 = 920;
pub const SN_brainpoolP160r1: &[u8; 16] = b"brainpoolP160r1\0";
pub const NID_brainpoolP160r1: i32 = 921;
pub const SN_brainpoolP160t1: &[u8; 16] = b"brainpoolP160t1\0";
pub const NID_brainpoolP160t1: i32 = 922;
pub const SN_brainpoolP192r1: &[u8; 16] = b"brainpoolP192r1\0";
pub const NID_brainpoolP192r1: i32 = 923;
pub const SN_brainpoolP192t1: &[u8; 16] = b"brainpoolP192t1\0";
pub const NID_brainpoolP192t1: i32 = 924;
pub const SN_brainpoolP224r1: &[u8; 16] = b"brainpoolP224r1\0";
pub const NID_brainpoolP224r1: i32 = 925;
pub const SN_brainpoolP224t1: &[u8; 16] = b"brainpoolP224t1\0";
pub const NID_brainpoolP224t1: i32 = 926;
pub const SN_brainpoolP256r1: &[u8; 16] = b"brainpoolP256r1\0";
pub const NID_brainpoolP256r1: i32 = 927;
pub const SN_brainpoolP256t1: &[u8; 16] = b"brainpoolP256t1\0";
pub const NID_brainpoolP256t1: i32 = 928;
pub const SN_brainpoolP320r1: &[u8; 16] = b"brainpoolP320r1\0";
pub const NID_brainpoolP320r1: i32 = 929;
pub const SN_brainpoolP320t1: &[u8; 16] = b"brainpoolP320t1\0";
pub const NID_brainpoolP320t1: i32 = 930;
pub const SN_brainpoolP384r1: &[u8; 16] = b"brainpoolP384r1\0";
pub const NID_brainpoolP384r1: i32 = 931;
pub const SN_brainpoolP384t1: &[u8; 16] = b"brainpoolP384t1\0";
pub const NID_brainpoolP384t1: i32 = 932;
pub const SN_brainpoolP512r1: &[u8; 16] = b"brainpoolP512r1\0";
pub const NID_brainpoolP512r1: i32 = 933;
pub const SN_brainpoolP512t1: &[u8; 16] = b"brainpoolP512t1\0";
pub const NID_brainpoolP512t1: i32 = 934;
pub const SN_pSpecified: &[u8; 11] = b"PSPECIFIED\0";
pub const LN_pSpecified: &[u8; 11] = b"pSpecified\0";
pub const NID_pSpecified: i32 = 935;
pub const SN_dhSinglePass_stdDH_sha1kdf_scheme: &[u8; 34] = b"dhSinglePass-stdDH-sha1kdf-scheme\0";
pub const NID_dhSinglePass_stdDH_sha1kdf_scheme: i32 = 936;
pub const SN_dhSinglePass_stdDH_sha224kdf_scheme: &[u8; 36] =
    b"dhSinglePass-stdDH-sha224kdf-scheme\0";
pub const NID_dhSinglePass_stdDH_sha224kdf_scheme: i32 = 937;
pub const SN_dhSinglePass_stdDH_sha256kdf_scheme: &[u8; 36] =
    b"dhSinglePass-stdDH-sha256kdf-scheme\0";
pub const NID_dhSinglePass_stdDH_sha256kdf_scheme: i32 = 938;
pub const SN_dhSinglePass_stdDH_sha384kdf_scheme: &[u8; 36] =
    b"dhSinglePass-stdDH-sha384kdf-scheme\0";
pub const NID_dhSinglePass_stdDH_sha384kdf_scheme: i32 = 939;
pub const SN_dhSinglePass_stdDH_sha512kdf_scheme: &[u8; 36] =
    b"dhSinglePass-stdDH-sha512kdf-scheme\0";
pub const NID_dhSinglePass_stdDH_sha512kdf_scheme: i32 = 940;
pub const SN_dhSinglePass_cofactorDH_sha1kdf_scheme: &[u8; 39] =
    b"dhSinglePass-cofactorDH-sha1kdf-scheme\0";
pub const NID_dhSinglePass_cofactorDH_sha1kdf_scheme: i32 = 941;
pub const SN_dhSinglePass_cofactorDH_sha224kdf_scheme: &[u8; 41] =
    b"dhSinglePass-cofactorDH-sha224kdf-scheme\0";
pub const NID_dhSinglePass_cofactorDH_sha224kdf_scheme: i32 = 942;
pub const SN_dhSinglePass_cofactorDH_sha256kdf_scheme: &[u8; 41] =
    b"dhSinglePass-cofactorDH-sha256kdf-scheme\0";
pub const NID_dhSinglePass_cofactorDH_sha256kdf_scheme: i32 = 943;
pub const SN_dhSinglePass_cofactorDH_sha384kdf_scheme: &[u8; 41] =
    b"dhSinglePass-cofactorDH-sha384kdf-scheme\0";
pub const NID_dhSinglePass_cofactorDH_sha384kdf_scheme: i32 = 944;
pub const SN_dhSinglePass_cofactorDH_sha512kdf_scheme: &[u8; 41] =
    b"dhSinglePass-cofactorDH-sha512kdf-scheme\0";
pub const NID_dhSinglePass_cofactorDH_sha512kdf_scheme: i32 = 945;
pub const SN_dh_std_kdf: &[u8; 11] = b"dh-std-kdf\0";
pub const NID_dh_std_kdf: i32 = 946;
pub const SN_dh_cofactor_kdf: &[u8; 16] = b"dh-cofactor-kdf\0";
pub const NID_dh_cofactor_kdf: i32 = 947;
pub const SN_X25519: &[u8; 7] = b"X25519\0";
pub const NID_X25519: i32 = 948;
pub const SN_ED25519: &[u8; 8] = b"ED25519\0";
pub const NID_ED25519: i32 = 949;
pub const SN_chacha20_poly1305: &[u8; 18] = b"ChaCha20-Poly1305\0";
pub const LN_chacha20_poly1305: &[u8; 18] = b"chacha20-poly1305\0";
pub const NID_chacha20_poly1305: i32 = 950;
pub const SN_kx_rsa: &[u8; 6] = b"KxRSA\0";
pub const LN_kx_rsa: &[u8; 7] = b"kx-rsa\0";
pub const NID_kx_rsa: i32 = 951;
pub const SN_kx_ecdhe: &[u8; 8] = b"KxECDHE\0";
pub const LN_kx_ecdhe: &[u8; 9] = b"kx-ecdhe\0";
pub const NID_kx_ecdhe: i32 = 952;
pub const SN_kx_psk: &[u8; 6] = b"KxPSK\0";
pub const LN_kx_psk: &[u8; 7] = b"kx-psk\0";
pub const NID_kx_psk: i32 = 953;
pub const SN_auth_rsa: &[u8; 8] = b"AuthRSA\0";
pub const LN_auth_rsa: &[u8; 9] = b"auth-rsa\0";
pub const NID_auth_rsa: i32 = 954;
pub const SN_auth_ecdsa: &[u8; 10] = b"AuthECDSA\0";
pub const LN_auth_ecdsa: &[u8; 11] = b"auth-ecdsa\0";
pub const NID_auth_ecdsa: i32 = 955;
pub const SN_auth_psk: &[u8; 8] = b"AuthPSK\0";
pub const LN_auth_psk: &[u8; 9] = b"auth-psk\0";
pub const NID_auth_psk: i32 = 956;
pub const SN_kx_any: &[u8; 6] = b"KxANY\0";
pub const LN_kx_any: &[u8; 7] = b"kx-any\0";
pub const NID_kx_any: i32 = 957;
pub const SN_auth_any: &[u8; 8] = b"AuthANY\0";
pub const LN_auth_any: &[u8; 9] = b"auth-any\0";
pub const NID_auth_any: i32 = 958;
pub const SN_ED448: &[u8; 6] = b"ED448\0";
pub const NID_ED448: i32 = 960;
pub const SN_X448: &[u8; 5] = b"X448\0";
pub const NID_X448: i32 = 961;
pub const SN_sha512_256: &[u8; 11] = b"SHA512-256\0";
pub const LN_sha512_256: &[u8; 11] = b"sha512-256\0";
pub const NID_sha512_256: i32 = 962;
pub const SN_hkdf: &[u8; 5] = b"HKDF\0";
pub const LN_hkdf: &[u8; 5] = b"hkdf\0";
pub const NID_hkdf: i32 = 963;
pub const SN_X25519Kyber768Draft00: &[u8; 22] = b"X25519Kyber768Draft00\0";
pub const NID_X25519Kyber768Draft00: i32 = 964;
pub const SN_X25519MLKEM768: &[u8; 15] = b"X25519MLKEM768\0";
pub const NID_X25519MLKEM768: i32 = 965;
pub const SN_ML_KEM_1024: &[u8; 19] = b"id-alg-ml-kem-1024\0";
pub const LN_ML_KEM_1024: &[u8; 12] = b"ML-KEM-1024\0";
pub const NID_ML_KEM_1024: i32 = 966;
pub const SN_ML_DSA_44: &[u8; 13] = b"id-ml-dsa-44\0";
pub const LN_ML_DSA_44: &[u8; 10] = b"ML-DSA-44\0";
pub const NID_ML_DSA_44: i32 = 967;
pub const SN_ML_DSA_65: &[u8; 13] = b"id-ml-dsa-65\0";
pub const LN_ML_DSA_65: &[u8; 10] = b"ML-DSA-65\0";
pub const NID_ML_DSA_65: i32 = 968;
pub const SN_ML_DSA_87: &[u8; 13] = b"id-ml-dsa-87\0";
pub const LN_ML_DSA_87: &[u8; 10] = b"ML-DSA-87\0";
pub const NID_ML_DSA_87: i32 = 969;
pub const SN_ML_KEM_768: &[u8; 18] = b"id-alg-ml-kem-768\0";
pub const LN_ML_KEM_768: &[u8; 11] = b"ML-KEM-768\0";
pub const NID_ML_KEM_768: i32 = 970;
pub const SN_X_Wing: &[u8; 7] = b"X-Wing\0";
pub const NID_X_Wing: i32 = 972;
pub const EVP_PKEY_NONE: i32 = 0;
pub const EVP_PKEY_RSA: i32 = 6;
pub const EVP_PKEY_RSA_PSS: i32 = 912;
pub const EVP_PKEY_DSA: i32 = 116;
pub const EVP_PKEY_EC: i32 = 408;
pub const EVP_PKEY_ED25519: i32 = 949;
pub const EVP_PKEY_X25519: i32 = 948;
pub const EVP_PKEY_HKDF: i32 = 963;
pub const EVP_PKEY_DH: i32 = 28;
pub const EVP_PKEY_ML_DSA_44: i32 = 967;
pub const EVP_PKEY_ML_DSA_65: i32 = 968;
pub const EVP_PKEY_ML_DSA_87: i32 = 969;
pub const EVP_PKEY_ML_KEM_768: i32 = 970;
pub const EVP_PKEY_ML_KEM_1024: i32 = 966;
pub const EVP_PKEY_XWING: i32 = 972;
pub const EVP_PKEY_RSA2: i32 = 19;
pub const EVP_PKEY_X448: i32 = 961;
pub const EVP_PKEY_ED448: i32 = 960;
pub const HKDF_R_OUTPUT_TOO_LARGE: i32 = 100;
pub const EVP_HPKE_DHKEM_P256_HKDF_SHA256: i32 = 16;
pub const EVP_HPKE_DHKEM_X25519_HKDF_SHA256: i32 = 32;
pub const EVP_HPKE_XWING: i32 = 25722;
pub const EVP_HPKE_MLKEM768: i32 = 65;
pub const EVP_HPKE_MLKEM1024: i32 = 66;
pub const EVP_HPKE_MAX_PUBLIC_KEY_LENGTH: i32 = 1568;
pub const EVP_HPKE_MAX_PRIVATE_KEY_LENGTH: i32 = 64;
pub const EVP_HPKE_MAX_ENC_LENGTH: i32 = 1568;
pub const EVP_HPKE_HKDF_SHA256: i32 = 1;
pub const EVP_HPKE_HKDF_SHA384: i32 = 2;
pub const EVP_HPKE_AES_128_GCM: i32 = 1;
pub const EVP_HPKE_AES_256_GCM: i32 = 2;
pub const EVP_HPKE_CHACHA20_POLY1305: i32 = 3;
pub const EVP_HPKE_MAX_OVERHEAD: i32 = 64;
pub const HRSS_SAMPLE_BYTES: i32 = 700;
pub const HRSS_GENERATE_KEY_BYTES: i32 = 1432;
pub const HRSS_ENCAP_BYTES: i32 = 1400;
pub const HRSS_PUBLIC_KEY_BYTES: i32 = 1138;
pub const HRSS_CIPHERTEXT_BYTES: i32 = 1138;
pub const HRSS_KEY_BYTES: i32 = 32;
pub const HRSS_POLY3_BYTES: i32 = 140;
pub const HRSS_PRIVATE_KEY_BYTES: i32 = 1452;
pub const EVP_PKEY_HKDEF_MODE_EXTRACT_AND_EXPAND: i32 = 0;
pub const EVP_PKEY_HKDEF_MODE_EXTRACT_ONLY: i32 = 1;
pub const EVP_PKEY_HKDEF_MODE_EXPAND_ONLY: i32 = 2;
pub const MD4_CBLOCK: i32 = 64;
pub const MD4_DIGEST_LENGTH: i32 = 16;
pub const MD5_CBLOCK: i32 = 64;
pub const MD5_DIGEST_LENGTH: i32 = 16;
pub const MLDSA_SEED_BYTES: i32 = 32;
pub const MLDSA_MU_BYTES: i32 = 64;
pub const MLDSA65_PUBLIC_KEY_BYTES: i32 = 1952;
pub const MLDSA65_SIGNATURE_BYTES: i32 = 3309;
pub const MLDSA87_PUBLIC_KEY_BYTES: i32 = 2592;
pub const MLDSA87_SIGNATURE_BYTES: i32 = 4627;
pub const MLDSA44_PUBLIC_KEY_BYTES: i32 = 1312;
pub const MLDSA44_SIGNATURE_BYTES: i32 = 2420;
pub const MLKEM768_PUBLIC_KEY_BYTES: i32 = 1184;
pub const MLKEM_SEED_BYTES: i32 = 64;
pub const MLKEM768_CIPHERTEXT_BYTES: i32 = 1088;
pub const MLKEM_SHARED_SECRET_BYTES: i32 = 32;
pub const MLKEM1024_PUBLIC_KEY_BYTES: i32 = 1568;
pub const MLKEM1024_CIPHERTEXT_BYTES: i32 = 1568;
pub const OBJ_NAME_TYPE_MD_METH: i32 = 1;
pub const OBJ_NAME_TYPE_CIPHER_METH: i32 = 2;
pub const OBJ_R_UNKNOWN_NID: i32 = 100;
pub const OBJ_R_INVALID_OID_STRING: i32 = 101;
pub const PKCS7_DETACHED: i32 = 64;
pub const PKCS7_TEXT: i32 = 1;
pub const PKCS7_NOCERTS: i32 = 2;
pub const PKCS7_NOSIGS: i32 = 4;
pub const PKCS7_NOCHAIN: i32 = 8;
pub const PKCS7_NOINTERN: i32 = 16;
pub const PKCS7_NOVERIFY: i32 = 32;
pub const PKCS7_BINARY: i32 = 128;
pub const PKCS7_NOATTR: i32 = 256;
pub const PKCS7_NOSMIMECAP: i32 = 512;
pub const PKCS7_STREAM: i32 = 4096;
pub const PKCS7_PARTIAL: i32 = 16384;
pub const PKCS7_R_BAD_PKCS7_VERSION: i32 = 100;
pub const PKCS7_R_NOT_PKCS7_SIGNED_DATA: i32 = 101;
pub const PKCS7_R_NO_CERTIFICATES_INCLUDED: i32 = 102;
pub const PKCS7_R_NO_CRLS_INCLUDED: i32 = 103;
pub const OPENSSL_RSA_MAX_MODULUS_BITS: i32 = 16384;
pub const RSA_PKCS1_PADDING: i32 = 1;
pub const RSA_NO_PADDING: i32 = 3;
pub const RSA_PKCS1_OAEP_PADDING: i32 = 4;
pub const RSA_PKCS1_PSS_PADDING: i32 = 6;
pub const RSA_PSS_SALTLEN_DIGEST: i32 = -1;
pub const RSA_PSS_SALTLEN_AUTO: i32 = -2;
pub const RSA_FLAG_OPAQUE: i32 = 1;
pub const RSA_FLAG_NO_BLINDING: i32 = 8;
pub const RSA_FLAG_EXT_PKEY: i32 = 32;
pub const RSA_FLAG_NO_PUBLIC_EXPONENT: i32 = 64;
pub const RSA_FLAG_LARGE_PUBLIC_EXPONENT: i32 = 128;
pub const RSA_3: i32 = 3;
pub const RSA_F4: i32 = 65537;
pub const RSA_METHOD_FLAG_NO_CHECK: i32 = 1;
pub const RSA_R_BAD_ENCODING: i32 = 100;
pub const RSA_R_BAD_E_VALUE: i32 = 101;
pub const RSA_R_BAD_FIXED_HEADER_DECRYPT: i32 = 102;
pub const RSA_R_BAD_PAD_BYTE_COUNT: i32 = 103;
pub const RSA_R_BAD_RSA_PARAMETERS: i32 = 104;
pub const RSA_R_BAD_SIGNATURE: i32 = 105;
pub const RSA_R_BAD_VERSION: i32 = 106;
pub const RSA_R_BLOCK_TYPE_IS_NOT_01: i32 = 107;
pub const RSA_R_BN_NOT_INITIALIZED: i32 = 108;
pub const RSA_R_CANNOT_RECOVER_MULTI_PRIME_KEY: i32 = 109;
pub const RSA_R_CRT_PARAMS_ALREADY_GIVEN: i32 = 110;
pub const RSA_R_CRT_VALUES_INCORRECT: i32 = 111;
pub const RSA_R_DATA_LEN_NOT_EQUAL_TO_MOD_LEN: i32 = 112;
pub const RSA_R_DATA_TOO_LARGE: i32 = 113;
pub const RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE: i32 = 114;
pub const RSA_R_DATA_TOO_LARGE_FOR_MODULUS: i32 = 115;
pub const RSA_R_DATA_TOO_SMALL: i32 = 116;
pub const RSA_R_DATA_TOO_SMALL_FOR_KEY_SIZE: i32 = 117;
pub const RSA_R_DIGEST_TOO_BIG_FOR_RSA_KEY: i32 = 118;
pub const RSA_R_D_E_NOT_CONGRUENT_TO_1: i32 = 119;
pub const RSA_R_EMPTY_PUBLIC_KEY: i32 = 120;
pub const RSA_R_ENCODE_ERROR: i32 = 121;
pub const RSA_R_FIRST_OCTET_INVALID: i32 = 122;
pub const RSA_R_INCONSISTENT_SET_OF_CRT_VALUES: i32 = 123;
pub const RSA_R_INTERNAL_ERROR: i32 = 124;
pub const RSA_R_INVALID_MESSAGE_LENGTH: i32 = 125;
pub const RSA_R_KEY_SIZE_TOO_SMALL: i32 = 126;
pub const RSA_R_LAST_OCTET_INVALID: i32 = 127;
pub const RSA_R_MODULUS_TOO_LARGE: i32 = 128;
pub const RSA_R_MUST_HAVE_AT_LEAST_TWO_PRIMES: i32 = 129;
pub const RSA_R_NO_PUBLIC_EXPONENT: i32 = 130;
pub const RSA_R_NULL_BEFORE_BLOCK_MISSING: i32 = 131;
pub const RSA_R_N_NOT_EQUAL_P_Q: i32 = 132;
pub const RSA_R_OAEP_DECODING_ERROR: i32 = 133;
pub const RSA_R_ONLY_ONE_OF_P_Q_GIVEN: i32 = 134;
pub const RSA_R_OUTPUT_BUFFER_TOO_SMALL: i32 = 135;
pub const RSA_R_PADDING_CHECK_FAILED: i32 = 136;
pub const RSA_R_PKCS_DECODING_ERROR: i32 = 137;
pub const RSA_R_SLEN_CHECK_FAILED: i32 = 138;
pub const RSA_R_SLEN_RECOVERY_FAILED: i32 = 139;
pub const RSA_R_TOO_LONG: i32 = 140;
pub const RSA_R_TOO_MANY_ITERATIONS: i32 = 141;
pub const RSA_R_UNKNOWN_ALGORITHM_TYPE: i32 = 142;
pub const RSA_R_UNKNOWN_PADDING_TYPE: i32 = 143;
pub const RSA_R_VALUE_MISSING: i32 = 144;
pub const RSA_R_WRONG_SIGNATURE_LENGTH: i32 = 145;
pub const RSA_R_PUBLIC_KEY_VALIDATION_FAILED: i32 = 146;
pub const RSA_R_D_OUT_OF_RANGE: i32 = 147;
pub const RSA_R_BLOCK_TYPE_IS_NOT_02: i32 = 148;
pub const X509V3_R_BAD_IP_ADDRESS: i32 = 100;
pub const X509V3_R_BAD_OBJECT: i32 = 101;
pub const X509V3_R_BN_DEC2BN_ERROR: i32 = 102;
pub const X509V3_R_BN_TO_ASN1_INTEGER_ERROR: i32 = 103;
pub const X509V3_R_CANNOT_FIND_FREE_FUNCTION: i32 = 104;
pub const X509V3_R_DIRNAME_ERROR: i32 = 105;
pub const X509V3_R_DISTPOINT_ALREADY_SET: i32 = 106;
pub const X509V3_R_DUPLICATE_ZONE_ID: i32 = 107;
pub const X509V3_R_ERROR_CONVERTING_ZONE: i32 = 108;
pub const X509V3_R_ERROR_CREATING_EXTENSION: i32 = 109;
pub const X509V3_R_ERROR_IN_EXTENSION: i32 = 110;
pub const X509V3_R_EXPECTED_A_SECTION_NAME: i32 = 111;
pub const X509V3_R_EXTENSION_EXISTS: i32 = 112;
pub const X509V3_R_EXTENSION_NAME_ERROR: i32 = 113;
pub const X509V3_R_EXTENSION_NOT_FOUND: i32 = 114;
pub const X509V3_R_EXTENSION_SETTING_NOT_SUPPORTED: i32 = 115;
pub const X509V3_R_EXTENSION_VALUE_ERROR: i32 = 116;
pub const X509V3_R_ILLEGAL_EMPTY_EXTENSION: i32 = 117;
pub const X509V3_R_ILLEGAL_HEX_DIGIT: i32 = 118;
pub const X509V3_R_INCORRECT_POLICY_SYNTAX_TAG: i32 = 119;
pub const X509V3_R_INVALID_BOOLEAN_STRING: i32 = 120;
pub const X509V3_R_INVALID_EXTENSION_STRING: i32 = 121;
pub const X509V3_R_INVALID_MULTIPLE_RDNS: i32 = 122;
pub const X509V3_R_INVALID_NAME: i32 = 123;
pub const X509V3_R_INVALID_NULL_ARGUMENT: i32 = 124;
pub const X509V3_R_INVALID_NULL_NAME: i32 = 125;
pub const X509V3_R_INVALID_NULL_VALUE: i32 = 126;
pub const X509V3_R_INVALID_NUMBER: i32 = 127;
pub const X509V3_R_INVALID_NUMBERS: i32 = 128;
pub const X509V3_R_INVALID_OBJECT_IDENTIFIER: i32 = 129;
pub const X509V3_R_INVALID_OPTION: i32 = 130;
pub const X509V3_R_INVALID_POLICY_IDENTIFIER: i32 = 131;
pub const X509V3_R_INVALID_PROXY_POLICY_SETTING: i32 = 132;
pub const X509V3_R_INVALID_PURPOSE: i32 = 133;
pub const X509V3_R_INVALID_SECTION: i32 = 134;
pub const X509V3_R_INVALID_SYNTAX: i32 = 135;
pub const X509V3_R_ISSUER_DECODE_ERROR: i32 = 136;
pub const X509V3_R_MISSING_VALUE: i32 = 137;
pub const X509V3_R_NEED_ORGANIZATION_AND_NUMBERS: i32 = 138;
pub const X509V3_R_NO_CONFIG_DATABASE: i32 = 139;
pub const X509V3_R_NO_ISSUER_CERTIFICATE: i32 = 140;
pub const X509V3_R_NO_ISSUER_DETAILS: i32 = 141;
pub const X509V3_R_NO_POLICY_IDENTIFIER: i32 = 142;
pub const X509V3_R_NO_PROXY_CERT_POLICY_LANGUAGE_DEFINED: i32 = 143;
pub const X509V3_R_NO_PUBLIC_KEY: i32 = 144;
pub const X509V3_R_NO_SUBJECT_DETAILS: i32 = 145;
pub const X509V3_R_ODD_NUMBER_OF_DIGITS: i32 = 146;
pub const X509V3_R_OPERATION_NOT_DEFINED: i32 = 147;
pub const X509V3_R_OTHERNAME_ERROR: i32 = 148;
pub const X509V3_R_POLICY_LANGUAGE_ALREADY_DEFINED: i32 = 149;
pub const X509V3_R_POLICY_PATH_LENGTH: i32 = 150;
pub const X509V3_R_POLICY_PATH_LENGTH_ALREADY_DEFINED: i32 = 151;
pub const X509V3_R_POLICY_WHEN_PROXY_LANGUAGE_REQUIRES_NO_POLICY: i32 = 152;
pub const X509V3_R_SECTION_NOT_FOUND: i32 = 153;
pub const X509V3_R_UNABLE_TO_GET_ISSUER_DETAILS: i32 = 154;
pub const X509V3_R_UNABLE_TO_GET_ISSUER_KEYID: i32 = 155;
pub const X509V3_R_UNKNOWN_BIT_STRING_ARGUMENT: i32 = 156;
pub const X509V3_R_UNKNOWN_EXTENSION: i32 = 157;
pub const X509V3_R_UNKNOWN_EXTENSION_NAME: i32 = 158;
pub const X509V3_R_UNKNOWN_OPTION: i32 = 159;
pub const X509V3_R_UNSUPPORTED_OPTION: i32 = 160;
pub const X509V3_R_UNSUPPORTED_TYPE: i32 = 161;
pub const X509V3_R_USER_TOO_LONG: i32 = 162;
pub const X509V3_R_INVALID_VALUE: i32 = 163;
pub const X509V3_R_TRAILING_DATA_IN_EXTENSION: i32 = 164;
pub const X509_VERSION_1: i32 = 0;
pub const X509_VERSION_2: i32 = 1;
pub const X509_VERSION_3: i32 = 2;
pub const EXFLAG_BCONS: i32 = 1;
pub const EXFLAG_KUSAGE: i32 = 2;
pub const EXFLAG_XKUSAGE: i32 = 4;
pub const EXFLAG_CA: i32 = 16;
pub const EXFLAG_SI: i32 = 32;
pub const EXFLAG_V1: i32 = 64;
pub const EXFLAG_INVALID: i32 = 128;
pub const EXFLAG_SET: i32 = 256;
pub const EXFLAG_CRITICAL: i32 = 512;
pub const EXFLAG_SS: i32 = 8192;
pub const X509v3_KU_DIGITAL_SIGNATURE: i32 = 128;
pub const X509v3_KU_NON_REPUDIATION: i32 = 64;
pub const X509v3_KU_KEY_ENCIPHERMENT: i32 = 32;
pub const X509v3_KU_DATA_ENCIPHERMENT: i32 = 16;
pub const X509v3_KU_KEY_AGREEMENT: i32 = 8;
pub const X509v3_KU_KEY_CERT_SIGN: i32 = 4;
pub const X509v3_KU_CRL_SIGN: i32 = 2;
pub const X509v3_KU_ENCIPHER_ONLY: i32 = 1;
pub const X509v3_KU_DECIPHER_ONLY: i32 = 32768;
pub const XKU_SSL_SERVER: i32 = 1;
pub const XKU_SSL_CLIENT: i32 = 2;
pub const XKU_SMIME: i32 = 4;
pub const XKU_CODE_SIGN: i32 = 8;
pub const XKU_SGC: i32 = 16;
pub const XKU_OCSP_SIGN: i32 = 32;
pub const XKU_TIMESTAMP: i32 = 64;
pub const XKU_DVCS: i32 = 128;
pub const XKU_ANYEKU: i32 = 256;
pub const X509_CRL_VERSION_1: i32 = 0;
pub const X509_CRL_VERSION_2: i32 = 1;
pub const X509_REQ_VERSION_1: i32 = 0;
pub const X509V3_ADD_OP_MASK: i32 = 15;
pub const X509V3_ADD_DEFAULT: i32 = 0;
pub const X509V3_ADD_APPEND: i32 = 1;
pub const X509V3_ADD_REPLACE: i32 = 2;
pub const X509V3_ADD_REPLACE_EXISTING: i32 = 3;
pub const X509V3_ADD_KEEP_EXISTING: i32 = 4;
pub const X509V3_ADD_DELETE: i32 = 5;
pub const X509V3_ADD_SILENT: i32 = 16;
pub const GEN_OTHERNAME: i32 = 0;
pub const GEN_EMAIL: i32 = 1;
pub const GEN_DNS: i32 = 2;
pub const GEN_X400: i32 = 3;
pub const GEN_DIRNAME: i32 = 4;
pub const GEN_EDIPARTY: i32 = 5;
pub const GEN_URI: i32 = 6;
pub const GEN_IPADD: i32 = 7;
pub const GEN_RID: i32 = 8;
pub const X509_LU_NONE: i32 = 0;
pub const X509_LU_X509: i32 = 1;
pub const X509_LU_CRL: i32 = 2;
pub const X509_LU_PKEY: i32 = 3;
pub const X509_V_OK: i32 = 0;
pub const X509_V_ERR_UNSPECIFIED: i32 = 1;
pub const X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT: i32 = 2;
pub const X509_V_ERR_UNABLE_TO_GET_CRL: i32 = 3;
pub const X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE: i32 = 4;
pub const X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE: i32 = 5;
pub const X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY: i32 = 6;
pub const X509_V_ERR_CERT_SIGNATURE_FAILURE: i32 = 7;
pub const X509_V_ERR_CRL_SIGNATURE_FAILURE: i32 = 8;
pub const X509_V_ERR_CERT_NOT_YET_VALID: i32 = 9;
pub const X509_V_ERR_CERT_HAS_EXPIRED: i32 = 10;
pub const X509_V_ERR_CRL_NOT_YET_VALID: i32 = 11;
pub const X509_V_ERR_CRL_HAS_EXPIRED: i32 = 12;
pub const X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD: i32 = 13;
pub const X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD: i32 = 14;
pub const X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD: i32 = 15;
pub const X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD: i32 = 16;
pub const X509_V_ERR_OUT_OF_MEM: i32 = 17;
pub const X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT: i32 = 18;
pub const X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN: i32 = 19;
pub const X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY: i32 = 20;
pub const X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE: i32 = 21;
pub const X509_V_ERR_CERT_CHAIN_TOO_LONG: i32 = 22;
pub const X509_V_ERR_CERT_REVOKED: i32 = 23;
pub const X509_V_ERR_INVALID_CA: i32 = 24;
pub const X509_V_ERR_PATH_LENGTH_EXCEEDED: i32 = 25;
pub const X509_V_ERR_INVALID_PURPOSE: i32 = 26;
pub const X509_V_ERR_CERT_UNTRUSTED: i32 = 27;
pub const X509_V_ERR_CERT_REJECTED: i32 = 28;
pub const X509_V_ERR_SUBJECT_ISSUER_MISMATCH: i32 = 29;
pub const X509_V_ERR_AKID_SKID_MISMATCH: i32 = 30;
pub const X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH: i32 = 31;
pub const X509_V_ERR_KEYUSAGE_NO_CERTSIGN: i32 = 32;
pub const X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER: i32 = 33;
pub const X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION: i32 = 34;
pub const X509_V_ERR_KEYUSAGE_NO_CRL_SIGN: i32 = 35;
pub const X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION: i32 = 36;
pub const X509_V_ERR_INVALID_NON_CA: i32 = 37;
pub const X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED: i32 = 38;
pub const X509_V_ERR_KEYUSAGE_NO_DIGITAL_SIGNATURE: i32 = 39;
pub const X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED: i32 = 40;
pub const X509_V_ERR_INVALID_EXTENSION: i32 = 41;
pub const X509_V_ERR_INVALID_POLICY_EXTENSION: i32 = 42;
pub const X509_V_ERR_NO_EXPLICIT_POLICY: i32 = 43;
pub const X509_V_ERR_DIFFERENT_CRL_SCOPE: i32 = 44;
pub const X509_V_ERR_UNSUPPORTED_EXTENSION_FEATURE: i32 = 45;
pub const X509_V_ERR_UNNESTED_RESOURCE: i32 = 46;
pub const X509_V_ERR_PERMITTED_VIOLATION: i32 = 47;
pub const X509_V_ERR_EXCLUDED_VIOLATION: i32 = 48;
pub const X509_V_ERR_SUBTREE_MINMAX: i32 = 49;
pub const X509_V_ERR_APPLICATION_VERIFICATION: i32 = 50;
pub const X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE: i32 = 51;
pub const X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX: i32 = 52;
pub const X509_V_ERR_UNSUPPORTED_NAME_SYNTAX: i32 = 53;
pub const X509_V_ERR_CRL_PATH_VALIDATION_ERROR: i32 = 54;
pub const X509_V_ERR_HOSTNAME_MISMATCH: i32 = 62;
pub const X509_V_ERR_EMAIL_MISMATCH: i32 = 63;
pub const X509_V_ERR_IP_ADDRESS_MISMATCH: i32 = 64;
pub const X509_V_ERR_INVALID_CALL: i32 = 65;
pub const X509_V_ERR_STORE_LOOKUP: i32 = 66;
pub const X509_V_ERR_NAME_CONSTRAINTS_WITHOUT_SANS: i32 = 67;
pub const X509_V_FLAG_CB_ISSUER_CHECK: i32 = 1;
pub const X509_V_FLAG_USE_CHECK_TIME: i32 = 2;
pub const X509_V_FLAG_CRL_CHECK: i32 = 4;
pub const X509_V_FLAG_CRL_CHECK_ALL: i32 = 8;
pub const X509_V_FLAG_IGNORE_CRITICAL: i32 = 16;
pub const X509_V_FLAG_X509_STRICT: i32 = 0;
pub const X509_V_FLAG_ALLOW_PROXY_CERTS: i32 = 64;
pub const X509_V_FLAG_POLICY_CHECK: i32 = 128;
pub const X509_V_FLAG_EXPLICIT_POLICY: i32 = 256;
pub const X509_V_FLAG_INHIBIT_ANY: i32 = 512;
pub const X509_V_FLAG_INHIBIT_MAP: i32 = 1024;
pub const X509_V_FLAG_NOTIFY_POLICY: i32 = 2048;
pub const X509_V_FLAG_EXTENDED_CRL_SUPPORT: i32 = 4096;
pub const X509_V_FLAG_USE_DELTAS: i32 = 8192;
pub const X509_V_FLAG_CHECK_SS_SIGNATURE: i32 = 16384;
pub const X509_V_FLAG_TRUSTED_FIRST: i32 = 32768;
pub const X509_V_FLAG_PARTIAL_CHAIN: i32 = 524288;
pub const X509_V_FLAG_NO_ALT_CHAINS: i32 = 1048576;
pub const X509_V_FLAG_NO_CHECK_TIME: i32 = 2097152;
pub const X509_CHECK_FLAG_NO_WILDCARDS: i32 = 2;
pub const X509_CHECK_FLAG_NEVER_CHECK_SUBJECT: i32 = 32;
pub const X509_PURPOSE_SSL_CLIENT: i32 = 1;
pub const X509_PURPOSE_SSL_SERVER: i32 = 2;
pub const X509_PURPOSE_NS_SSL_SERVER: i32 = 3;
pub const X509_PURPOSE_SMIME_SIGN: i32 = 4;
pub const X509_PURPOSE_SMIME_ENCRYPT: i32 = 5;
pub const X509_PURPOSE_CRL_SIGN: i32 = 6;
pub const X509_PURPOSE_ANY: i32 = 7;
pub const X509_PURPOSE_OCSP_HELPER: i32 = 8;
pub const X509_PURPOSE_TIMESTAMP_SIGN: i32 = 9;
pub const X509_TRUST_COMPAT: i32 = 1;
pub const X509_TRUST_SSL_CLIENT: i32 = 2;
pub const X509_TRUST_SSL_SERVER: i32 = 3;
pub const X509_TRUST_EMAIL: i32 = 4;
pub const X509_TRUST_OBJECT_SIGN: i32 = 5;
pub const X509_TRUST_TSA: i32 = 8;
pub const X509_FILETYPE_PEM: i32 = 1;
pub const X509_FILETYPE_ASN1: i32 = 2;
pub const X509_FILETYPE_DEFAULT: i32 = 3;
pub const X509_L_FILE_LOAD: i32 = 1;
pub const X509_L_ADD_DIR: i32 = 2;
pub const X509_FLAG_COMPAT: i32 = 0;
pub const X509_FLAG_NO_HEADER: i32 = 1;
pub const X509_FLAG_NO_VERSION: i32 = 2;
pub const X509_FLAG_NO_SERIAL: i32 = 4;
pub const X509_FLAG_NO_SIGNAME: i32 = 8;
pub const X509_FLAG_NO_ISSUER: i32 = 16;
pub const X509_FLAG_NO_VALIDITY: i32 = 32;
pub const X509_FLAG_NO_SUBJECT: i32 = 64;
pub const X509_FLAG_NO_PUBKEY: i32 = 128;
pub const X509_FLAG_NO_EXTENSIONS: i32 = 256;
pub const X509_FLAG_NO_SIGDUMP: i32 = 512;
pub const X509_FLAG_NO_AUX: i32 = 1024;
pub const X509_FLAG_NO_ATTRIBUTES: i32 = 2048;
pub const X509_FLAG_NO_IDS: i32 = 4096;
pub const X509V3_EXT_UNKNOWN_MASK: i32 = 983040;
pub const X509V3_EXT_DEFAULT: i32 = 0;
pub const X509V3_EXT_ERROR_UNKNOWN: i32 = 65536;
pub const X509V3_EXT_PARSE_UNKNOWN: i32 = 131072;
pub const X509V3_EXT_DUMP_UNKNOWN: i32 = 196608;
pub const XN_FLAG_COMPAT: i32 = 0;
pub const XN_FLAG_SEP_MASK: i32 = 983040;
pub const XN_FLAG_SEP_COMMA_PLUS: i32 = 65536;
pub const XN_FLAG_SEP_CPLUS_SPC: i32 = 131072;
pub const XN_FLAG_SEP_SPLUS_SPC: i32 = 196608;
pub const XN_FLAG_SEP_MULTILINE: i32 = 262144;
pub const XN_FLAG_DN_REV: i32 = 1048576;
pub const XN_FLAG_FN_MASK: i32 = 6291456;
pub const XN_FLAG_FN_SN: i32 = 0;
pub const XN_FLAG_SPC_EQ: i32 = 8388608;
pub const XN_FLAG_DUMP_UNKNOWN_FIELDS: i32 = 16777216;
pub const XN_FLAG_RFC2253: i32 = 17892119;
pub const XN_FLAG_ONELINE: i32 = 8520479;
pub const X509_TRUST_TRUSTED: i32 = 1;
pub const X509_TRUST_REJECTED: i32 = 2;
pub const X509_TRUST_UNTRUSTED: i32 = 3;
pub const X509V3_EXT_MULTILINE: i32 = 4;
pub const X509V3_CTX_TEST: i32 = 1;
pub const X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT: i32 = 0;
pub const X509_CHECK_FLAG_MULTI_LABEL_WILDCARDS: i32 = 0;
pub const X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS: i32 = 0;
pub const X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS: i32 = 0;
pub const NS_SSL_CLIENT: i32 = 128;
pub const NS_SSL_SERVER: i32 = 64;
pub const NS_SMIME: i32 = 32;
pub const NS_OBJSIGN: i32 = 16;
pub const NS_SSL_CA: i32 = 4;
pub const NS_SMIME_CA: i32 = 2;
pub const NS_OBJSIGN_CA: i32 = 1;
pub const NS_ANY_CA: i32 = 7;
pub const X509_R_AKID_MISMATCH: i32 = 100;
pub const X509_R_BAD_PKCS7_VERSION: i32 = 101;
pub const X509_R_BAD_X509_FILETYPE: i32 = 102;
pub const X509_R_BASE64_DECODE_ERROR: i32 = 103;
pub const X509_R_CANT_CHECK_DH_KEY: i32 = 104;
pub const X509_R_CERT_ALREADY_IN_HASH_TABLE: i32 = 105;
pub const X509_R_CRL_ALREADY_DELTA: i32 = 106;
pub const X509_R_CRL_VERIFY_FAILURE: i32 = 107;
pub const X509_R_IDP_MISMATCH: i32 = 108;
pub const X509_R_INVALID_BIT_STRING_BITS_LEFT: i32 = 109;
pub const X509_R_INVALID_DIRECTORY: i32 = 110;
pub const X509_R_INVALID_FIELD_NAME: i32 = 111;
pub const X509_R_INVALID_PSS_PARAMETERS: i32 = 112;
pub const X509_R_INVALID_TRUST: i32 = 113;
pub const X509_R_ISSUER_MISMATCH: i32 = 114;
pub const X509_R_KEY_TYPE_MISMATCH: i32 = 115;
pub const X509_R_KEY_VALUES_MISMATCH: i32 = 116;
pub const X509_R_LOADING_CERT_DIR: i32 = 117;
pub const X509_R_LOADING_DEFAULTS: i32 = 118;
pub const X509_R_NEWER_CRL_NOT_NEWER: i32 = 119;
pub const X509_R_NOT_PKCS7_SIGNED_DATA: i32 = 120;
pub const X509_R_NO_CERTIFICATES_INCLUDED: i32 = 121;
pub const X509_R_NO_CERT_SET_FOR_US_TO_VERIFY: i32 = 122;
pub const X509_R_NO_CRLS_INCLUDED: i32 = 123;
pub const X509_R_NO_CRL_NUMBER: i32 = 124;
pub const X509_R_PUBLIC_KEY_DECODE_ERROR: i32 = 125;
pub const X509_R_PUBLIC_KEY_ENCODE_ERROR: i32 = 126;
pub const X509_R_SHOULD_RETRY: i32 = 127;
pub const X509_R_UNKNOWN_KEY_TYPE: i32 = 128;
pub const X509_R_UNKNOWN_NID: i32 = 129;
pub const X509_R_UNKNOWN_PURPOSE_ID: i32 = 130;
pub const X509_R_UNKNOWN_TRUST_ID: i32 = 131;
pub const X509_R_UNSUPPORTED_ALGORITHM: i32 = 132;
pub const X509_R_WRONG_LOOKUP_TYPE: i32 = 133;
pub const X509_R_WRONG_TYPE: i32 = 134;
pub const X509_R_NAME_TOO_LONG: i32 = 135;
pub const X509_R_INVALID_PARAMETER: i32 = 136;
pub const X509_R_SIGNATURE_ALGORITHM_MISMATCH: i32 = 137;
pub const X509_R_DELTA_CRL_WITHOUT_CRL_NUMBER: i32 = 138;
pub const X509_R_INVALID_FIELD_FOR_VERSION: i32 = 139;
pub const X509_R_INVALID_VERSION: i32 = 140;
pub const X509_R_NO_CERTIFICATE_FOUND: i32 = 141;
pub const X509_R_NO_CERTIFICATE_OR_CRL_FOUND: i32 = 142;
pub const X509_R_NO_CRL_FOUND: i32 = 143;
pub const X509_R_INVALID_POLICY_EXTENSION: i32 = 144;
pub const PEM_BUFSIZE: i32 = 1024;
pub const PEM_STRING_X509_OLD: &[u8; 17] = b"X509 CERTIFICATE\0";
pub const PEM_STRING_X509: &[u8; 12] = b"CERTIFICATE\0";
pub const PEM_STRING_X509_PAIR: &[u8; 17] = b"CERTIFICATE PAIR\0";
pub const PEM_STRING_X509_TRUSTED: &[u8; 20] = b"TRUSTED CERTIFICATE\0";
pub const PEM_STRING_X509_REQ_OLD: &[u8; 24] = b"NEW CERTIFICATE REQUEST\0";
pub const PEM_STRING_X509_REQ: &[u8; 20] = b"CERTIFICATE REQUEST\0";
pub const PEM_STRING_X509_CRL: &[u8; 9] = b"X509 CRL\0";
pub const PEM_STRING_PUBLIC: &[u8; 11] = b"PUBLIC KEY\0";
pub const PEM_STRING_RSA: &[u8; 16] = b"RSA PRIVATE KEY\0";
pub const PEM_STRING_RSA_PUBLIC: &[u8; 15] = b"RSA PUBLIC KEY\0";
pub const PEM_STRING_DSA: &[u8; 16] = b"DSA PRIVATE KEY\0";
pub const PEM_STRING_DSA_PUBLIC: &[u8; 15] = b"DSA PUBLIC KEY\0";
pub const PEM_STRING_EC: &[u8; 15] = b"EC PRIVATE KEY\0";
pub const PEM_STRING_PKCS7: &[u8; 6] = b"PKCS7\0";
pub const PEM_STRING_PKCS7_SIGNED: &[u8; 20] = b"PKCS #7 SIGNED DATA\0";
pub const PEM_STRING_PKCS8: &[u8; 22] = b"ENCRYPTED PRIVATE KEY\0";
pub const PEM_STRING_PKCS8INF: &[u8; 12] = b"PRIVATE KEY\0";
pub const PEM_STRING_DHPARAMS: &[u8; 14] = b"DH PARAMETERS\0";
pub const PEM_STRING_SSL_SESSION: &[u8; 23] = b"SSL SESSION PARAMETERS\0";
pub const PEM_STRING_DSAPARAMS: &[u8; 15] = b"DSA PARAMETERS\0";
pub const PEM_STRING_ECDSA_PUBLIC: &[u8; 17] = b"ECDSA PUBLIC KEY\0";
pub const PEM_STRING_ECPRIVATEKEY: &[u8; 15] = b"EC PRIVATE KEY\0";
pub const PEM_STRING_CMS: &[u8; 4] = b"CMS\0";
pub const PEM_STRING_EVP_PKEY: &[u8; 16] = b"ANY PRIVATE KEY\0";
pub const PEM_R_BAD_BASE64_DECODE: i32 = 100;
pub const PEM_R_BAD_DECRYPT: i32 = 101;
pub const PEM_R_BAD_END_LINE: i32 = 102;
pub const PEM_R_BAD_IV_CHARS: i32 = 103;
pub const PEM_R_BAD_PASSWORD_READ: i32 = 104;
pub const PEM_R_CIPHER_IS_NULL: i32 = 105;
pub const PEM_R_ERROR_CONVERTING_PRIVATE_KEY: i32 = 106;
pub const PEM_R_NOT_DEK_INFO: i32 = 107;
pub const PEM_R_NOT_ENCRYPTED: i32 = 108;
pub const PEM_R_NOT_PROC_TYPE: i32 = 109;
pub const PEM_R_NO_START_LINE: i32 = 110;
pub const PEM_R_READ_KEY: i32 = 111;
pub const PEM_R_SHORT_HEADER: i32 = 112;
pub const PEM_R_UNSUPPORTED_CIPHER: i32 = 113;
pub const PEM_R_UNSUPPORTED_ENCRYPTION: i32 = 114;
pub const PEM_R_UNSUPPORTED_PROC_TYPE_VERSION: i32 = 115;
pub const PEM_R_NO_DATA: i32 = 116;
pub const PKCS12_DEFAULT_ITER: i32 = 2048;
pub const PKCS8_R_BAD_PKCS12_DATA: i32 = 100;
pub const PKCS8_R_BAD_PKCS12_VERSION: i32 = 101;
pub const PKCS8_R_CIPHER_HAS_NO_OBJECT_IDENTIFIER: i32 = 102;
pub const PKCS8_R_CRYPT_ERROR: i32 = 103;
pub const PKCS8_R_DECODE_ERROR: i32 = 104;
pub const PKCS8_R_ENCODE_ERROR: i32 = 105;
pub const PKCS8_R_ENCRYPT_ERROR: i32 = 106;
pub const PKCS8_R_ERROR_SETTING_CIPHER_PARAMS: i32 = 107;
pub const PKCS8_R_INCORRECT_PASSWORD: i32 = 108;
pub const PKCS8_R_KEYGEN_FAILURE: i32 = 109;
pub const PKCS8_R_KEY_GEN_ERROR: i32 = 110;
pub const PKCS8_R_METHOD_NOT_SUPPORTED: i32 = 111;
pub const PKCS8_R_MISSING_MAC: i32 = 112;
pub const PKCS8_R_MULTIPLE_PRIVATE_KEYS_IN_PKCS12: i32 = 113;
pub const PKCS8_R_PKCS12_PUBLIC_KEY_INTEGRITY_NOT_SUPPORTED: i32 = 114;
pub const PKCS8_R_PKCS12_TOO_DEEPLY_NESTED: i32 = 115;
pub const PKCS8_R_PRIVATE_KEY_DECODE_ERROR: i32 = 116;
pub const PKCS8_R_PRIVATE_KEY_ENCODE_ERROR: i32 = 117;
pub const PKCS8_R_TOO_LONG: i32 = 118;
pub const PKCS8_R_UNKNOWN_ALGORITHM: i32 = 119;
pub const PKCS8_R_UNKNOWN_CIPHER: i32 = 120;
pub const PKCS8_R_UNKNOWN_CIPHER_ALGORITHM: i32 = 121;
pub const PKCS8_R_UNKNOWN_DIGEST: i32 = 122;
pub const PKCS8_R_UNKNOWN_HASH: i32 = 123;
pub const PKCS8_R_UNSUPPORTED_PRIVATE_KEY_ALGORITHM: i32 = 124;
pub const PKCS8_R_UNSUPPORTED_KEYLENGTH: i32 = 125;
pub const PKCS8_R_UNSUPPORTED_SALT_TYPE: i32 = 126;
pub const PKCS8_R_UNSUPPORTED_CIPHER: i32 = 127;
pub const PKCS8_R_UNSUPPORTED_KEY_DERIVATION_FUNCTION: i32 = 128;
pub const PKCS8_R_BAD_ITERATION_COUNT: i32 = 129;
pub const PKCS8_R_UNSUPPORTED_PRF: i32 = 130;
pub const PKCS8_R_INVALID_CHARACTERS: i32 = 131;
pub const PKCS8_R_UNSUPPORTED_OPTIONS: i32 = 132;
pub const PKCS8_R_AMBIGUOUS_FRIENDLY_NAME: i32 = 133;
pub const RIPEMD160_CBLOCK: i32 = 64;
pub const RIPEMD160_LBLOCK: i32 = 16;
pub const RIPEMD160_DIGEST_LENGTH: i32 = 20;
pub const SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES: i32 = 32;
pub const SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES: i32 = 64;
pub const SLHDSA_SHA2_128S_SIGNATURE_BYTES: i32 = 7856;
pub const SLHDSA_SHAKE_256F_PUBLIC_KEY_BYTES: i32 = 64;
pub const SLHDSA_SHAKE_256F_PRIVATE_KEY_BYTES: i32 = 128;
pub const SLHDSA_SHAKE_256F_SIGNATURE_BYTES: i32 = 49856;
pub const SSL2_MT_CLIENT_HELLO: i32 = 1;
pub const SSL2_VERSION: i32 = 2;
pub const SSL3_CK_RSA_DES_192_CBC3_SHA: i32 = 50331658;
pub const SSL3_CK_SCSV: i32 = 50331903;
pub const SSL3_CK_FALLBACK_SCSV: i32 = 50353664;
pub const SSL3_TXT_RSA_DES_192_CBC3_SHA: &[u8; 13] = b"DES-CBC3-SHA\0";
pub const SSL3_SSL_SESSION_ID_LENGTH: i32 = 32;
pub const SSL3_MAX_SSL_SESSION_ID_LENGTH: i32 = 32;
pub const SSL3_MASTER_SECRET_SIZE: i32 = 48;
pub const SSL3_RANDOM_SIZE: i32 = 32;
pub const SSL3_SESSION_ID_SIZE: i32 = 32;
pub const SSL3_RT_HEADER_LENGTH: i32 = 5;
pub const SSL3_HM_HEADER_LENGTH: i32 = 4;
pub const SSL3_ALIGN_PAYLOAD: i32 = 8;
pub const SSL3_RT_MAX_MD_SIZE: i32 = 64;
pub const SSL_RT_MAX_CIPHER_BLOCK_SIZE: i32 = 16;
pub const SSL3_RT_MAX_PLAIN_LENGTH: i32 = 16384;
pub const SSL3_RT_MAX_COMPRESSED_OVERHEAD: i32 = 1024;
pub const SSL3_RT_MAX_ENCRYPTED_OVERHEAD: i32 = 320;
pub const SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD: i32 = 88;
pub const SSL3_RT_MAX_COMPRESSED_LENGTH: i32 = 16384;
pub const SSL3_RT_MAX_ENCRYPTED_LENGTH: i32 = 16704;
pub const SSL3_RT_MAX_PACKET_SIZE: i32 = 16709;
pub const SSL3_RT_CHANGE_CIPHER_SPEC: i32 = 20;
pub const SSL3_RT_ALERT: i32 = 21;
pub const SSL3_RT_HANDSHAKE: i32 = 22;
pub const SSL3_RT_APPLICATION_DATA: i32 = 23;
pub const SSL3_RT_ACK: i32 = 26;
pub const SSL3_RT_HEADER: i32 = 256;
pub const SSL3_RT_CLIENT_HELLO_INNER: i32 = 257;
pub const SSL3_AL_WARNING: i32 = 1;
pub const SSL3_AL_FATAL: i32 = 2;
pub const SSL3_AD_CLOSE_NOTIFY: i32 = 0;
pub const SSL3_AD_UNEXPECTED_MESSAGE: i32 = 10;
pub const SSL3_AD_BAD_RECORD_MAC: i32 = 20;
pub const SSL3_AD_DECOMPRESSION_FAILURE: i32 = 30;
pub const SSL3_AD_HANDSHAKE_FAILURE: i32 = 40;
pub const SSL3_AD_NO_CERTIFICATE: i32 = 41;
pub const SSL3_AD_BAD_CERTIFICATE: i32 = 42;
pub const SSL3_AD_UNSUPPORTED_CERTIFICATE: i32 = 43;
pub const SSL3_AD_CERTIFICATE_REVOKED: i32 = 44;
pub const SSL3_AD_CERTIFICATE_EXPIRED: i32 = 45;
pub const SSL3_AD_CERTIFICATE_UNKNOWN: i32 = 46;
pub const SSL3_AD_ILLEGAL_PARAMETER: i32 = 47;
pub const SSL3_AD_INAPPROPRIATE_FALLBACK: i32 = 86;
pub const SSL3_CT_RSA_SIGN: i32 = 1;
pub const SSL3_MT_HELLO_REQUEST: i32 = 0;
pub const SSL3_MT_CLIENT_HELLO: i32 = 1;
pub const SSL3_MT_SERVER_HELLO: i32 = 2;
pub const SSL3_MT_NEW_SESSION_TICKET: i32 = 4;
pub const SSL3_MT_END_OF_EARLY_DATA: i32 = 5;
pub const SSL3_MT_ENCRYPTED_EXTENSIONS: i32 = 8;
pub const SSL3_MT_CERTIFICATE: i32 = 11;
pub const SSL3_MT_SERVER_KEY_EXCHANGE: i32 = 12;
pub const SSL3_MT_CERTIFICATE_REQUEST: i32 = 13;
pub const SSL3_MT_SERVER_HELLO_DONE: i32 = 14;
pub const SSL3_MT_CERTIFICATE_VERIFY: i32 = 15;
pub const SSL3_MT_CLIENT_KEY_EXCHANGE: i32 = 16;
pub const SSL3_MT_FINISHED: i32 = 20;
pub const SSL3_MT_CERTIFICATE_STATUS: i32 = 22;
pub const SSL3_MT_SUPPLEMENTAL_DATA: i32 = 23;
pub const SSL3_MT_KEY_UPDATE: i32 = 24;
pub const SSL3_MT_COMPRESSED_CERTIFICATE: i32 = 25;
pub const SSL3_MT_NEXT_PROTO: i32 = 67;
pub const SSL3_MT_CHANNEL_ID: i32 = 203;
pub const SSL3_MT_MESSAGE_HASH: i32 = 254;
pub const DTLS1_MT_HELLO_VERIFY_REQUEST: i32 = 3;
pub const SSL3_MT_SERVER_DONE: i32 = 14;
pub const SSL3_MT_NEWSESSION_TICKET: i32 = 4;
pub const SSL3_MT_CCS: i32 = 1;
pub const TLS1_AD_END_OF_EARLY_DATA: i32 = 1;
pub const TLS1_AD_DECRYPTION_FAILED: i32 = 21;
pub const TLS1_AD_RECORD_OVERFLOW: i32 = 22;
pub const TLS1_AD_UNKNOWN_CA: i32 = 48;
pub const TLS1_AD_ACCESS_DENIED: i32 = 49;
pub const TLS1_AD_DECODE_ERROR: i32 = 50;
pub const TLS1_AD_DECRYPT_ERROR: i32 = 51;
pub const TLS1_AD_EXPORT_RESTRICTION: i32 = 60;
pub const TLS1_AD_PROTOCOL_VERSION: i32 = 70;
pub const TLS1_AD_INSUFFICIENT_SECURITY: i32 = 71;
pub const TLS1_AD_INTERNAL_ERROR: i32 = 80;
pub const TLS1_AD_USER_CANCELLED: i32 = 90;
pub const TLS1_AD_NO_RENEGOTIATION: i32 = 100;
pub const TLS1_AD_MISSING_EXTENSION: i32 = 109;
pub const TLS1_AD_UNSUPPORTED_EXTENSION: i32 = 110;
pub const TLS1_AD_CERTIFICATE_UNOBTAINABLE: i32 = 111;
pub const TLS1_AD_UNRECOGNIZED_NAME: i32 = 112;
pub const TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE: i32 = 113;
pub const TLS1_AD_BAD_CERTIFICATE_HASH_VALUE: i32 = 114;
pub const TLS1_AD_UNKNOWN_PSK_IDENTITY: i32 = 115;
pub const TLS1_AD_CERTIFICATE_REQUIRED: i32 = 116;
pub const TLS1_AD_NO_APPLICATION_PROTOCOL: i32 = 120;
pub const TLS1_AD_ECH_REQUIRED: i32 = 121;
pub const TLSEXT_TYPE_server_name: i32 = 0;
pub const TLSEXT_TYPE_status_request: i32 = 5;
pub const TLSEXT_TYPE_ec_point_formats: i32 = 11;
pub const TLSEXT_TYPE_signature_algorithms: i32 = 13;
pub const TLSEXT_TYPE_srtp: i32 = 14;
pub const TLSEXT_TYPE_application_layer_protocol_negotiation: i32 = 16;
pub const TLSEXT_TYPE_client_cert_type: i32 = 19;
pub const TLSEXT_TYPE_server_cert_type: i32 = 20;
pub const TLSEXT_TYPE_padding: i32 = 21;
pub const TLSEXT_TYPE_extended_master_secret: i32 = 23;
pub const TLSEXT_TYPE_quic_transport_parameters_legacy: i32 = 65445;
pub const TLSEXT_TYPE_quic_transport_parameters: i32 = 57;
pub const TLSEXT_TYPE_quic_transport_parameters_standard: i32 = 57;
pub const TLSEXT_TYPE_cert_compression: i32 = 27;
pub const TLSEXT_TYPE_session_ticket: i32 = 35;
pub const TLSEXT_TYPE_supported_groups: i32 = 10;
pub const TLSEXT_TYPE_pre_shared_key: i32 = 41;
pub const TLSEXT_TYPE_early_data: i32 = 42;
pub const TLSEXT_TYPE_supported_versions: i32 = 43;
pub const TLSEXT_TYPE_cookie: i32 = 44;
pub const TLSEXT_TYPE_psk_key_exchange_modes: i32 = 45;
pub const TLSEXT_TYPE_certificate_authorities: i32 = 47;
pub const TLSEXT_TYPE_signature_algorithms_cert: i32 = 50;
pub const TLSEXT_TYPE_key_share: i32 = 51;
pub const TLSEXT_TYPE_renegotiate: i32 = 65281;
pub const TLSEXT_TYPE_delegated_credential: i32 = 34;
pub const TLSEXT_TYPE_application_settings_old: i32 = 17513;
pub const TLSEXT_TYPE_application_settings: i32 = 17613;
pub const TLSEXT_TYPE_encrypted_client_hello: i32 = 65037;
pub const TLSEXT_TYPE_ech_outer_extensions: i32 = 64768;
pub const TLSEXT_TYPE_pake: i32 = 35387;
pub const TLSEXT_TYPE_certificate_timestamp: i32 = 18;
pub const TLSEXT_TYPE_next_proto_neg: i32 = 13172;
pub const TLSEXT_TYPE_channel_id: i32 = 30032;
pub const TLSEXT_TYPE_trust_anchors: i32 = 51764;
pub const TLSEXT_TYPE_server_padding: i32 = 4832;
pub const TLSEXT_TYPE_tls_flags: i32 = 62;
pub const TLSEXT_STATUSTYPE_nothing: i32 = -1;
pub const TLSEXT_STATUSTYPE_ocsp: i32 = 1;
pub const TLSEXT_ECPOINTFORMAT_uncompressed: i32 = 0;
pub const TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime: i32 = 1;
pub const TLSEXT_signature_anonymous: i32 = 0;
pub const TLSEXT_signature_rsa: i32 = 1;
pub const TLSEXT_signature_dsa: i32 = 2;
pub const TLSEXT_signature_ecdsa: i32 = 3;
pub const TLSEXT_hash_none: i32 = 0;
pub const TLSEXT_hash_md5: i32 = 1;
pub const TLSEXT_hash_sha1: i32 = 2;
pub const TLSEXT_hash_sha224: i32 = 3;
pub const TLSEXT_hash_sha256: i32 = 4;
pub const TLSEXT_hash_sha384: i32 = 5;
pub const TLSEXT_hash_sha512: i32 = 6;
pub const TLSEXT_cert_compression_zlib: i32 = 1;
pub const TLSEXT_cert_compression_brotli: i32 = 2;
pub const TLSEXT_MAXLEN_host_name: i32 = 255;
pub const TLS1_CK_PSK_WITH_AES_128_CBC_SHA: i32 = 50331788;
pub const TLS1_CK_PSK_WITH_AES_256_CBC_SHA: i32 = 50331789;
pub const TLS1_CK_ECDHE_PSK_WITH_AES_128_CBC_SHA: i32 = 50380853;
pub const TLS1_CK_ECDHE_PSK_WITH_AES_256_CBC_SHA: i32 = 50380854;
pub const TLS1_CK_RSA_WITH_AES_128_SHA: i32 = 50331695;
pub const TLS1_CK_RSA_WITH_AES_256_SHA: i32 = 50331701;
pub const TLS1_CK_RSA_WITH_AES_128_GCM_SHA256: i32 = 50331804;
pub const TLS1_CK_RSA_WITH_AES_256_GCM_SHA384: i32 = 50331805;
pub const TLS1_CK_ECDHE_ECDSA_WITH_AES_128_CBC_SHA: i32 = 50380809;
pub const TLS1_CK_ECDHE_ECDSA_WITH_AES_256_CBC_SHA: i32 = 50380810;
pub const TLS1_CK_ECDHE_RSA_WITH_AES_128_CBC_SHA: i32 = 50380819;
pub const TLS1_CK_ECDHE_RSA_WITH_AES_256_CBC_SHA: i32 = 50380820;
pub const TLS1_CK_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256: i32 = 50380835;
pub const TLS1_CK_ECDHE_RSA_WITH_AES_128_CBC_SHA256: i32 = 50380839;
pub const TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256: i32 = 50380843;
pub const TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384: i32 = 50380844;
pub const TLS1_CK_ECDHE_RSA_WITH_AES_128_GCM_SHA256: i32 = 50380847;
pub const TLS1_CK_ECDHE_RSA_WITH_AES_256_GCM_SHA384: i32 = 50380848;
pub const TLS1_CK_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256: i32 = 50384040;
pub const TLS1_CK_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256: i32 = 50384041;
pub const TLS1_CK_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256: i32 = 50384044;
pub const TLS1_3_CK_AES_128_GCM_SHA256: i32 = 50336513;
pub const TLS1_3_CK_AES_256_GCM_SHA384: i32 = 50336514;
pub const TLS1_3_CK_CHACHA20_POLY1305_SHA256: i32 = 50336515;
pub const TLS1_CK_AES_128_GCM_SHA256: i32 = 50336513;
pub const TLS1_CK_AES_256_GCM_SHA384: i32 = 50336514;
pub const TLS1_CK_CHACHA20_POLY1305_SHA256: i32 = 50336515;
pub const TLS1_TXT_PSK_WITH_AES_128_CBC_SHA: &[u8; 19] = b"PSK-AES128-CBC-SHA\0";
pub const TLS1_TXT_PSK_WITH_AES_256_CBC_SHA: &[u8; 19] = b"PSK-AES256-CBC-SHA\0";
pub const TLS1_TXT_ECDHE_PSK_WITH_AES_128_CBC_SHA: &[u8; 25] = b"ECDHE-PSK-AES128-CBC-SHA\0";
pub const TLS1_TXT_ECDHE_PSK_WITH_AES_256_CBC_SHA: &[u8; 25] = b"ECDHE-PSK-AES256-CBC-SHA\0";
pub const TLS1_TXT_RSA_WITH_AES_128_SHA: &[u8; 11] = b"AES128-SHA\0";
pub const TLS1_TXT_RSA_WITH_AES_256_SHA: &[u8; 11] = b"AES256-SHA\0";
pub const TLS1_TXT_RSA_WITH_AES_128_GCM_SHA256: &[u8; 18] = b"AES128-GCM-SHA256\0";
pub const TLS1_TXT_RSA_WITH_AES_256_GCM_SHA384: &[u8; 18] = b"AES256-GCM-SHA384\0";
pub const TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_CBC_SHA: &[u8; 23] = b"ECDHE-ECDSA-AES128-SHA\0";
pub const TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_CBC_SHA: &[u8; 23] = b"ECDHE-ECDSA-AES256-SHA\0";
pub const TLS1_TXT_ECDHE_RSA_WITH_AES_128_CBC_SHA: &[u8; 21] = b"ECDHE-RSA-AES128-SHA\0";
pub const TLS1_TXT_ECDHE_RSA_WITH_AES_256_CBC_SHA: &[u8; 21] = b"ECDHE-RSA-AES256-SHA\0";
pub const TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256: &[u8; 26] = b"ECDHE-ECDSA-AES128-SHA256\0";
pub const TLS1_TXT_ECDHE_RSA_WITH_AES_128_CBC_SHA256: &[u8; 24] = b"ECDHE-RSA-AES128-SHA256\0";
pub const TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256: &[u8; 30] =
    b"ECDHE-ECDSA-AES128-GCM-SHA256\0";
pub const TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384: &[u8; 30] =
    b"ECDHE-ECDSA-AES256-GCM-SHA384\0";
pub const TLS1_TXT_ECDHE_RSA_WITH_AES_128_GCM_SHA256: &[u8; 28] = b"ECDHE-RSA-AES128-GCM-SHA256\0";
pub const TLS1_TXT_ECDHE_RSA_WITH_AES_256_GCM_SHA384: &[u8; 28] = b"ECDHE-RSA-AES256-GCM-SHA384\0";
pub const TLS1_TXT_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256: &[u8; 28] =
    b"ECDHE-RSA-CHACHA20-POLY1305\0";
pub const TLS1_TXT_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256: &[u8; 30] =
    b"ECDHE-ECDSA-CHACHA20-POLY1305\0";
pub const TLS1_TXT_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256: &[u8; 28] =
    b"ECDHE-PSK-CHACHA20-POLY1305\0";
pub const TLS1_3_RFC_AES_128_GCM_SHA256: &[u8; 23] = b"TLS_AES_128_GCM_SHA256\0";
pub const TLS1_3_RFC_AES_256_GCM_SHA384: &[u8; 23] = b"TLS_AES_256_GCM_SHA384\0";
pub const TLS1_3_RFC_CHACHA20_POLY1305_SHA256: &[u8; 29] = b"TLS_CHACHA20_POLY1305_SHA256\0";
pub const TLS_CT_RSA_SIGN: i32 = 1;
pub const TLS_CT_DSS_SIGN: i32 = 2;
pub const TLS_CT_RSA_FIXED_DH: i32 = 3;
pub const TLS_CT_DSS_FIXED_DH: i32 = 4;
pub const TLS_CT_ECDSA_SIGN: i32 = 64;
pub const TLS_CT_RSA_FIXED_ECDH: i32 = 65;
pub const TLS_CT_ECDSA_FIXED_ECDH: i32 = 66;
pub const SSL_KEY_UPDATE_REQUESTED: i32 = 1;
pub const SSL_KEY_UPDATE_NOT_REQUESTED: i32 = 0;
pub const SSL_ERROR_NONE: i32 = 0;
pub const SSL_ERROR_SSL: i32 = 1;
pub const SSL_ERROR_WANT_READ: i32 = 2;
pub const SSL_ERROR_WANT_WRITE: i32 = 3;
pub const SSL_ERROR_WANT_X509_LOOKUP: i32 = 4;
pub const SSL_ERROR_SYSCALL: i32 = 5;
pub const SSL_ERROR_ZERO_RETURN: i32 = 6;
pub const SSL_ERROR_WANT_CONNECT: i32 = 7;
pub const SSL_ERROR_WANT_ACCEPT: i32 = 8;
pub const SSL_ERROR_WANT_CHANNEL_ID_LOOKUP: i32 = 9;
pub const SSL_ERROR_PENDING_SESSION: i32 = 11;
pub const SSL_ERROR_PENDING_CERTIFICATE: i32 = 12;
pub const SSL_ERROR_WANT_PRIVATE_KEY_OPERATION: i32 = 13;
pub const SSL_ERROR_PENDING_TICKET: i32 = 14;
pub const SSL_ERROR_EARLY_DATA_REJECTED: i32 = 15;
pub const SSL_ERROR_WANT_CERTIFICATE_VERIFY: i32 = 16;
pub const SSL_ERROR_HANDOFF: i32 = 17;
pub const SSL_ERROR_HANDBACK: i32 = 18;
pub const SSL_ERROR_WANT_RENEGOTIATE: i32 = 19;
pub const SSL_ERROR_HANDSHAKE_HINTS_READY: i32 = 20;
pub const DTLS1_VERSION_MAJOR: i32 = 254;
pub const SSL3_VERSION_MAJOR: i32 = 3;
pub const SSL3_VERSION: i32 = 768;
pub const TLS1_VERSION: i32 = 769;
pub const TLS1_1_VERSION: i32 = 770;
pub const TLS1_2_VERSION: i32 = 771;
pub const TLS1_3_VERSION: i32 = 772;
pub const DTLS1_VERSION: i32 = 65279;
pub const DTLS1_2_VERSION: i32 = 65277;
pub const DTLS1_3_VERSION: i32 = 65276;
pub const SSL_OP_LEGACY_SERVER_CONNECT: i32 = 4;
pub const SSL_OP_NO_QUERY_MTU: i32 = 4096;
pub const SSL_OP_NO_TICKET: i32 = 16384;
pub const SSL_OP_CIPHER_SERVER_PREFERENCE: i32 = 4194304;
pub const SSL_OP_ALL: i32 = 4;
pub const SSL_OP_NO_TLSv1: i32 = 67108864;
pub const SSL_OP_NO_TLSv1_2: i32 = 134217728;
pub const SSL_OP_NO_TLSv1_1: i32 = 268435456;
pub const SSL_OP_NO_TLSv1_3: i32 = 536870912;
pub const SSL_OP_NO_DTLSv1: i32 = 67108864;
pub const SSL_OP_NO_DTLSv1_2: i32 = 134217728;
pub const SSL_MODE_ENABLE_PARTIAL_WRITE: i32 = 1;
pub const SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER: i32 = 2;
pub const SSL_MODE_NO_AUTO_CHAIN: i32 = 8;
pub const SSL_MODE_ENABLE_FALSE_START: i32 = 128;
pub const SSL_MODE_CBC_RECORD_SPLITTING: i32 = 256;
pub const SSL_MODE_NO_SESSION_CREATION: i32 = 512;
pub const SSL_MODE_SEND_FALLBACK_SCSV: i32 = 1024;
pub const SSL_SIGN_RSA_PKCS1_SHA1: i32 = 513;
pub const SSL_SIGN_RSA_PKCS1_SHA256: i32 = 1025;
pub const SSL_SIGN_RSA_PKCS1_SHA384: i32 = 1281;
pub const SSL_SIGN_RSA_PKCS1_SHA512: i32 = 1537;
pub const SSL_SIGN_ECDSA_SHA1: i32 = 515;
pub const SSL_SIGN_ECDSA_SECP256R1_SHA256: i32 = 1027;
pub const SSL_SIGN_ECDSA_SECP384R1_SHA384: i32 = 1283;
pub const SSL_SIGN_ECDSA_SECP521R1_SHA512: i32 = 1539;
pub const SSL_SIGN_RSA_PSS_RSAE_SHA256: i32 = 2052;
pub const SSL_SIGN_RSA_PSS_RSAE_SHA384: i32 = 2053;
pub const SSL_SIGN_RSA_PSS_RSAE_SHA512: i32 = 2054;
pub const SSL_SIGN_ED25519: i32 = 2055;
pub const SSL_SIGN_ML_DSA_44: i32 = 2308;
pub const SSL_SIGN_ML_DSA_65: i32 = 2309;
pub const SSL_SIGN_ML_DSA_87: i32 = 2310;
pub const SSL_SIGN_RSA_PKCS1_SHA256_LEGACY: i32 = 1056;
pub const SSL_SIGN_RSA_PKCS1_MD5_SHA1: i32 = 65281;
pub const SSL_FILETYPE_PEM: i32 = 1;
pub const SSL_FILETYPE_ASN1: i32 = 2;
pub const SSL_CIPHER_AES_128_GCM_SHA256: i32 = 4865;
pub const SSL_CIPHER_AES_256_GCM_SHA384: i32 = 4866;
pub const SSL_CIPHER_CHACHA20_POLY1305_SHA256: i32 = 4867;
pub const SSL_CIPHER_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256: i32 = 49195;
pub const SSL_CIPHER_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384: i32 = 49196;
pub const SSL_CIPHER_ECDHE_RSA_WITH_AES_128_GCM_SHA256: i32 = 49199;
pub const SSL_CIPHER_ECDHE_RSA_WITH_AES_256_GCM_SHA384: i32 = 49200;
pub const SSL_CIPHER_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256: i32 = 52392;
pub const SSL_CIPHER_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256: i32 = 52393;
pub const SSL_CIPHER_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256: i32 = 52396;
pub const SSL_CIPHER_ECDHE_ECDSA_WITH_AES_128_CBC_SHA: i32 = 49161;
pub const SSL_CIPHER_ECDHE_ECDSA_WITH_AES_256_CBC_SHA: i32 = 49162;
pub const SSL_CIPHER_ECDHE_RSA_WITH_AES_128_CBC_SHA: i32 = 49171;
pub const SSL_CIPHER_ECDHE_RSA_WITH_AES_256_CBC_SHA: i32 = 49172;
pub const SSL_CIPHER_ECDHE_PSK_WITH_AES_128_CBC_SHA: i32 = 49205;
pub const SSL_CIPHER_ECDHE_PSK_WITH_AES_256_CBC_SHA: i32 = 49206;
pub const SSL_CIPHER_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256: i32 = 49187;
pub const SSL_CIPHER_ECDHE_RSA_WITH_AES_128_CBC_SHA256: i32 = 49191;
pub const SSL_CIPHER_RSA_WITH_AES_128_GCM_SHA256: i32 = 156;
pub const SSL_CIPHER_RSA_WITH_AES_256_GCM_SHA384: i32 = 157;
pub const SSL_CIPHER_RSA_WITH_AES_128_CBC_SHA: i32 = 47;
pub const SSL_CIPHER_RSA_WITH_AES_256_CBC_SHA: i32 = 53;
pub const SSL_CIPHER_PSK_WITH_AES_128_CBC_SHA: i32 = 140;
pub const SSL_CIPHER_PSK_WITH_AES_256_CBC_SHA: i32 = 141;
pub const SSL_CIPHER_RSA_WITH_3DES_EDE_CBC_SHA: i32 = 10;
pub const SSL_CIPHER_EMPTY_RENEGOTIATION_INFO_SCSV: i32 = 255;
pub const SSL_CIPHER_FALLBACK_SCSV: i32 = 22016;
pub const SSL_DEFAULT_CIPHER_LIST: &[u8; 4] = b"ALL\0";
pub const SSL_MAX_SSL_SESSION_ID_LENGTH: i32 = 32;
pub const SSL_MAX_MASTER_KEY_LENGTH: i32 = 48;
pub const SSL_SESS_CACHE_OFF: i32 = 0;
pub const SSL_SESS_CACHE_CLIENT: i32 = 1;
pub const SSL_SESS_CACHE_SERVER: i32 = 2;
pub const SSL_SESS_CACHE_BOTH: i32 = 3;
pub const SSL_SESS_CACHE_NO_AUTO_CLEAR: i32 = 128;
pub const SSL_SESS_CACHE_NO_INTERNAL_LOOKUP: i32 = 256;
pub const SSL_SESS_CACHE_NO_INTERNAL_STORE: i32 = 512;
pub const SSL_SESS_CACHE_NO_INTERNAL: i32 = 768;
pub const SSL_DEFAULT_SESSION_TIMEOUT: i32 = 7200;
pub const SSL_DEFAULT_SESSION_PSK_DHE_TIMEOUT: i32 = 172800;
pub const SSL_DEFAULT_SESSION_AUTH_TIMEOUT: i32 = 604800;
pub const SSL_MAX_SID_CTX_LENGTH: i32 = 32;
pub const SSL_SESSION_CACHE_MAX_SIZE_DEFAULT: i32 = 20480;
pub const SSL_DEFAULT_TICKET_KEY_ROTATION_INTERVAL: i32 = 172800;
pub const SSL_TICKET_KEY_NAME_LEN: i32 = 16;
pub const SSL_GROUP_SECP256R1: i32 = 23;
pub const SSL_GROUP_SECP384R1: i32 = 24;
pub const SSL_GROUP_SECP521R1: i32 = 25;
pub const SSL_GROUP_X25519: i32 = 29;
pub const SSL_GROUP_X25519_MLKEM768: i32 = 4588;
pub const SSL_GROUP_X25519_KYBER768_DRAFT00: i32 = 25497;
pub const SSL_GROUP_MLKEM1024: i32 = 514;
pub const SSL_GROUP_FLAG_EQUAL_PREFERENCE_WITH_NEXT: i32 = 1;
pub const SSL_VERIFY_NONE: i32 = 0;
pub const SSL_VERIFY_PEER: i32 = 1;
pub const SSL_VERIFY_FAIL_IF_NO_PEER_CERT: i32 = 2;
pub const TLSEXT_NAMETYPE_host_name: i32 = 0;
pub const SSL_TLSEXT_ERR_OK: i32 = 0;
pub const SSL_TLSEXT_ERR_ALERT_WARNING: i32 = 1;
pub const SSL_TLSEXT_ERR_ALERT_FATAL: i32 = 2;
pub const SSL_TLSEXT_ERR_NOACK: i32 = 3;
pub const OPENSSL_NPN_UNSUPPORTED: i32 = 0;
pub const OPENSSL_NPN_NEGOTIATED: i32 = 1;
pub const OPENSSL_NPN_NO_OVERLAP: i32 = 2;
pub const SRTP_AES128_CM_SHA1_80: i32 = 1;
pub const SRTP_AES128_CM_SHA1_32: i32 = 2;
pub const SRTP_AES128_F8_SHA1_80: i32 = 3;
pub const SRTP_AES128_F8_SHA1_32: i32 = 4;
pub const SRTP_NULL_SHA1_80: i32 = 5;
pub const SRTP_NULL_SHA1_32: i32 = 6;
pub const SRTP_AEAD_AES_128_GCM: i32 = 7;
pub const SRTP_AEAD_AES_256_GCM: i32 = 8;
pub const PSK_MAX_IDENTITY_LEN: i32 = 128;
pub const PSK_MAX_PSK_LEN: i32 = 256;
pub const TLSEXT_cert_type_x509: i32 = 0;
pub const TLSEXT_cert_type_rpk: i32 = 2;
pub const SSL_PAKE_SPAKE2PLUSV1: i32 = 32150;
pub const SSL_AD_REASON_OFFSET: i32 = 1000;
pub const SSL_AD_CLOSE_NOTIFY: i32 = 0;
pub const SSL_AD_UNEXPECTED_MESSAGE: i32 = 10;
pub const SSL_AD_BAD_RECORD_MAC: i32 = 20;
pub const SSL_AD_DECRYPTION_FAILED: i32 = 21;
pub const SSL_AD_RECORD_OVERFLOW: i32 = 22;
pub const SSL_AD_DECOMPRESSION_FAILURE: i32 = 30;
pub const SSL_AD_HANDSHAKE_FAILURE: i32 = 40;
pub const SSL_AD_NO_CERTIFICATE: i32 = 41;
pub const SSL_AD_BAD_CERTIFICATE: i32 = 42;
pub const SSL_AD_UNSUPPORTED_CERTIFICATE: i32 = 43;
pub const SSL_AD_CERTIFICATE_REVOKED: i32 = 44;
pub const SSL_AD_CERTIFICATE_EXPIRED: i32 = 45;
pub const SSL_AD_CERTIFICATE_UNKNOWN: i32 = 46;
pub const SSL_AD_ILLEGAL_PARAMETER: i32 = 47;
pub const SSL_AD_UNKNOWN_CA: i32 = 48;
pub const SSL_AD_ACCESS_DENIED: i32 = 49;
pub const SSL_AD_DECODE_ERROR: i32 = 50;
pub const SSL_AD_DECRYPT_ERROR: i32 = 51;
pub const SSL_AD_EXPORT_RESTRICTION: i32 = 60;
pub const SSL_AD_PROTOCOL_VERSION: i32 = 70;
pub const SSL_AD_INSUFFICIENT_SECURITY: i32 = 71;
pub const SSL_AD_INTERNAL_ERROR: i32 = 80;
pub const SSL_AD_INAPPROPRIATE_FALLBACK: i32 = 86;
pub const SSL_AD_USER_CANCELLED: i32 = 90;
pub const SSL_AD_NO_RENEGOTIATION: i32 = 100;
pub const SSL_AD_MISSING_EXTENSION: i32 = 109;
pub const SSL_AD_UNSUPPORTED_EXTENSION: i32 = 110;
pub const SSL_AD_CERTIFICATE_UNOBTAINABLE: i32 = 111;
pub const SSL_AD_UNRECOGNIZED_NAME: i32 = 112;
pub const SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE: i32 = 113;
pub const SSL_AD_BAD_CERTIFICATE_HASH_VALUE: i32 = 114;
pub const SSL_AD_UNKNOWN_PSK_IDENTITY: i32 = 115;
pub const SSL_AD_CERTIFICATE_REQUIRED: i32 = 116;
pub const SSL_AD_NO_APPLICATION_PROTOCOL: i32 = 120;
pub const SSL_AD_ECH_REQUIRED: i32 = 121;
pub const SSL_MAX_CERT_LIST_DEFAULT: i32 = 102400;
pub const SSL_ST_CONNECT: i32 = 4096;
pub const SSL_ST_ACCEPT: i32 = 8192;
pub const SSL_ST_MASK: i32 = 4095;
pub const SSL_ST_INIT: i32 = 12288;
pub const SSL_ST_OK: i32 = 3;
pub const SSL_ST_RENEGOTIATE: i32 = 12292;
pub const SSL_ST_BEFORE: i32 = 12293;
pub const TLS_ST_OK: i32 = 3;
pub const TLS_ST_BEFORE: i32 = 12293;
pub const SSL_CB_LOOP: i32 = 1;
pub const SSL_CB_EXIT: i32 = 2;
pub const SSL_CB_READ: i32 = 4;
pub const SSL_CB_WRITE: i32 = 8;
pub const SSL_CB_ALERT: i32 = 16384;
pub const SSL_CB_READ_ALERT: i32 = 16388;
pub const SSL_CB_WRITE_ALERT: i32 = 16392;
pub const SSL_CB_ACCEPT_LOOP: i32 = 8193;
pub const SSL_CB_ACCEPT_EXIT: i32 = 8194;
pub const SSL_CB_CONNECT_LOOP: i32 = 4097;
pub const SSL_CB_CONNECT_EXIT: i32 = 4098;
pub const SSL_CB_HANDSHAKE_START: i32 = 16;
pub const SSL_CB_HANDSHAKE_DONE: i32 = 32;
pub const SSL_SENT_SHUTDOWN: i32 = 1;
pub const SSL_RECEIVED_SHUTDOWN: i32 = 2;
pub const SSL_MODE_HANDSHAKE_CUTTHROUGH: i32 = 128;
pub const SSL_MODE_AUTO_RETRY: i32 = 0;
pub const SSL_MODE_RELEASE_BUFFERS: i32 = 0;
pub const SSL_MODE_SEND_CLIENTHELLO_TIME: i32 = 0;
pub const SSL_MODE_SEND_SERVERHELLO_TIME: i32 = 0;
pub const SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION: i32 = 0;
pub const SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS: i32 = 0;
pub const SSL_OP_EPHEMERAL_RSA: i32 = 0;
pub const SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER: i32 = 0;
pub const SSL_OP_MICROSOFT_SESS_ID_BUG: i32 = 0;
pub const SSL_OP_MSIE_SSLV2_RSA_PADDING: i32 = 0;
pub const SSL_OP_NETSCAPE_CA_DN_BUG: i32 = 0;
pub const SSL_OP_NETSCAPE_CHALLENGE_BUG: i32 = 0;
pub const SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG: i32 = 0;
pub const SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG: i32 = 0;
pub const SSL_OP_NO_COMPRESSION: i32 = 0;
pub const SSL_OP_NO_RENEGOTIATION: i32 = 0;
pub const SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION: i32 = 0;
pub const SSL_OP_NO_SSLv2: i32 = 0;
pub const SSL_OP_NO_SSLv3: i32 = 0;
pub const SSL_OP_PKCS1_CHECK_1: i32 = 0;
pub const SSL_OP_PKCS1_CHECK_2: i32 = 0;
pub const SSL_OP_SINGLE_DH_USE: i32 = 0;
pub const SSL_OP_SINGLE_ECDH_USE: i32 = 0;
pub const SSL_OP_SSLEAY_080_CLIENT_DH_BUG: i32 = 0;
pub const SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG: i32 = 0;
pub const SSL_OP_TLS_BLOCK_PADDING_BUG: i32 = 0;
pub const SSL_OP_TLS_D5_BUG: i32 = 0;
pub const SSL_OP_TLS_ROLLBACK_BUG: i32 = 0;
pub const SSL_VERIFY_CLIENT_ONCE: i32 = 0;
pub const SSL_NOTHING: i32 = 0;
pub const SSL_WRITING: i32 = 3;
pub const SSL_READING: i32 = 2;
pub const SSL_TXT_MEDIUM: &[u8; 7] = b"MEDIUM\0";
pub const SSL_TXT_HIGH: &[u8; 5] = b"HIGH\0";
pub const SSL_TXT_FIPS: &[u8; 5] = b"FIPS\0";
pub const SSL_TXT_kRSA: &[u8; 5] = b"kRSA\0";
pub const SSL_TXT_kDHE: &[u8; 5] = b"kDHE\0";
pub const SSL_TXT_kEDH: &[u8; 5] = b"kEDH\0";
pub const SSL_TXT_kECDHE: &[u8; 7] = b"kECDHE\0";
pub const SSL_TXT_kEECDH: &[u8; 7] = b"kEECDH\0";
pub const SSL_TXT_kPSK: &[u8; 5] = b"kPSK\0";
pub const SSL_TXT_aRSA: &[u8; 5] = b"aRSA\0";
pub const SSL_TXT_aECDSA: &[u8; 7] = b"aECDSA\0";
pub const SSL_TXT_aPSK: &[u8; 5] = b"aPSK\0";
pub const SSL_TXT_DH: &[u8; 3] = b"DH\0";
pub const SSL_TXT_DHE: &[u8; 4] = b"DHE\0";
pub const SSL_TXT_EDH: &[u8; 4] = b"EDH\0";
pub const SSL_TXT_RSA: &[u8; 4] = b"RSA\0";
pub const SSL_TXT_ECDH: &[u8; 5] = b"ECDH\0";
pub const SSL_TXT_ECDHE: &[u8; 6] = b"ECDHE\0";
pub const SSL_TXT_EECDH: &[u8; 6] = b"EECDH\0";
pub const SSL_TXT_ECDSA: &[u8; 6] = b"ECDSA\0";
pub const SSL_TXT_PSK: &[u8; 4] = b"PSK\0";
pub const SSL_TXT_3DES: &[u8; 5] = b"3DES\0";
pub const SSL_TXT_RC4: &[u8; 4] = b"RC4\0";
pub const SSL_TXT_AES128: &[u8; 7] = b"AES128\0";
pub const SSL_TXT_AES256: &[u8; 7] = b"AES256\0";
pub const SSL_TXT_AES: &[u8; 4] = b"AES\0";
pub const SSL_TXT_AES_GCM: &[u8; 7] = b"AESGCM\0";
pub const SSL_TXT_CHACHA20: &[u8; 9] = b"CHACHA20\0";
pub const SSL_TXT_MD5: &[u8; 4] = b"MD5\0";
pub const SSL_TXT_SHA1: &[u8; 5] = b"SHA1\0";
pub const SSL_TXT_SHA: &[u8; 4] = b"SHA\0";
pub const SSL_TXT_SHA256: &[u8; 7] = b"SHA256\0";
pub const SSL_TXT_SHA384: &[u8; 7] = b"SHA384\0";
pub const SSL_TXT_SSLV3: &[u8; 6] = b"SSLv3\0";
pub const SSL_TXT_TLSV1: &[u8; 6] = b"TLSv1\0";
pub const SSL_TXT_TLSV1_1: &[u8; 8] = b"TLSv1.1\0";
pub const SSL_TXT_TLSV1_2: &[u8; 8] = b"TLSv1.2\0";
pub const SSL_TXT_TLSV1_3: &[u8; 8] = b"TLSv1.3\0";
pub const SSL_TXT_ALL: &[u8; 4] = b"ALL\0";
pub const SSL_TXT_CMPDEF: &[u8; 20] = b"COMPLEMENTOFDEFAULT\0";
pub const OPENSSL_INIT_NO_LOAD_SSL_STRINGS: i32 = 0;
pub const OPENSSL_INIT_LOAD_SSL_STRINGS: i32 = 0;
pub const OPENSSL_INIT_SSL_DEFAULT: i32 = 0;
pub const SSL_SIGN_RSA_PSS_SHA256: i32 = 2052;
pub const SSL_SIGN_RSA_PSS_SHA384: i32 = 2053;
pub const SSL_SIGN_RSA_PSS_SHA512: i32 = 2054;
pub const SSL_CURVE_SECP256R1: i32 = 23;
pub const SSL_CURVE_SECP384R1: i32 = 24;
pub const SSL_CURVE_SECP521R1: i32 = 25;
pub const SSL_CURVE_X25519: i32 = 29;
pub const SSL_CURVE_X25519_KYBER768_DRAFT00: i32 = 25497;
pub const TLSEXT_nid_unknown: i32 = 16777216;
pub const SSL_R_APP_DATA_IN_HANDSHAKE: i32 = 100;
pub const SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT: i32 = 101;
pub const SSL_R_BAD_ALERT: i32 = 102;
pub const SSL_R_BAD_CHANGE_CIPHER_SPEC: i32 = 103;
pub const SSL_R_BAD_DATA_RETURNED_BY_CALLBACK: i32 = 104;
pub const SSL_R_BAD_DH_P_LENGTH: i32 = 105;
pub const SSL_R_BAD_DIGEST_LENGTH: i32 = 106;
pub const SSL_R_BAD_ECC_CERT: i32 = 107;
pub const SSL_R_BAD_ECPOINT: i32 = 108;
pub const SSL_R_BAD_HANDSHAKE_RECORD: i32 = 109;
pub const SSL_R_BAD_HELLO_REQUEST: i32 = 110;
pub const SSL_R_BAD_LENGTH: i32 = 111;
pub const SSL_R_BAD_PACKET_LENGTH: i32 = 112;
pub const SSL_R_BAD_RSA_ENCRYPT: i32 = 113;
pub const SSL_R_BAD_SIGNATURE: i32 = 114;
pub const SSL_R_BAD_SRTP_MKI_VALUE: i32 = 115;
pub const SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST: i32 = 116;
pub const SSL_R_BAD_SSL_FILETYPE: i32 = 117;
pub const SSL_R_BAD_WRITE_RETRY: i32 = 118;
pub const SSL_R_BIO_NOT_SET: i32 = 119;
pub const SSL_R_BN_LIB: i32 = 120;
pub const SSL_R_BUFFER_TOO_SMALL: i32 = 121;
pub const SSL_R_CA_DN_LENGTH_MISMATCH: i32 = 122;
pub const SSL_R_CA_DN_TOO_LONG: i32 = 123;
pub const SSL_R_CCS_RECEIVED_EARLY: i32 = 124;
pub const SSL_R_CERTIFICATE_VERIFY_FAILED: i32 = 125;
pub const SSL_R_CERT_CB_ERROR: i32 = 126;
pub const SSL_R_CERT_LENGTH_MISMATCH: i32 = 127;
pub const SSL_R_CHANNEL_ID_NOT_P256: i32 = 128;
pub const SSL_R_CHANNEL_ID_SIGNATURE_INVALID: i32 = 129;
pub const SSL_R_CIPHER_OR_HASH_UNAVAILABLE: i32 = 130;
pub const SSL_R_CLIENTHELLO_PARSE_FAILED: i32 = 131;
pub const SSL_R_CLIENTHELLO_TLSEXT: i32 = 132;
pub const SSL_R_CONNECTION_REJECTED: i32 = 133;
pub const SSL_R_CONNECTION_TYPE_NOT_SET: i32 = 134;
pub const SSL_R_CUSTOM_EXTENSION_ERROR: i32 = 135;
pub const SSL_R_DATA_LENGTH_TOO_LONG: i32 = 136;
pub const SSL_R_DECODE_ERROR: i32 = 137;
pub const SSL_R_DECRYPTION_FAILED: i32 = 138;
pub const SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC: i32 = 139;
pub const SSL_R_DH_PUBLIC_VALUE_LENGTH_IS_WRONG: i32 = 140;
pub const SSL_R_DH_P_TOO_LONG: i32 = 141;
pub const SSL_R_DIGEST_CHECK_FAILED: i32 = 142;
pub const SSL_R_DTLS_MESSAGE_TOO_BIG: i32 = 143;
pub const SSL_R_ECC_CERT_NOT_FOR_SIGNING: i32 = 144;
pub const SSL_R_EMS_STATE_INCONSISTENT: i32 = 145;
pub const SSL_R_ENCRYPTED_LENGTH_TOO_LONG: i32 = 146;
pub const SSL_R_ERROR_ADDING_EXTENSION: i32 = 147;
pub const SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST: i32 = 148;
pub const SSL_R_ERROR_PARSING_EXTENSION: i32 = 149;
pub const SSL_R_EXCESSIVE_MESSAGE_SIZE: i32 = 150;
pub const SSL_R_EXTRA_DATA_IN_MESSAGE: i32 = 151;
pub const SSL_R_FRAGMENT_MISMATCH: i32 = 152;
pub const SSL_R_GOT_NEXT_PROTO_WITHOUT_EXTENSION: i32 = 153;
pub const SSL_R_HANDSHAKE_FAILURE_ON_CLIENT_HELLO: i32 = 154;
pub const SSL_R_HTTPS_PROXY_REQUEST: i32 = 155;
pub const SSL_R_HTTP_REQUEST: i32 = 156;
pub const SSL_R_INAPPROPRIATE_FALLBACK: i32 = 157;
pub const SSL_R_INVALID_COMMAND: i32 = 158;
pub const SSL_R_INVALID_MESSAGE: i32 = 159;
pub const SSL_R_INVALID_SSL_SESSION: i32 = 160;
pub const SSL_R_INVALID_TICKET_KEYS_LENGTH: i32 = 161;
pub const SSL_R_LENGTH_MISMATCH: i32 = 162;
pub const SSL_R_MISSING_EXTENSION: i32 = 164;
pub const SSL_R_MISSING_RSA_CERTIFICATE: i32 = 165;
pub const SSL_R_MISSING_TMP_DH_KEY: i32 = 166;
pub const SSL_R_MISSING_TMP_ECDH_KEY: i32 = 167;
pub const SSL_R_MIXED_SPECIAL_OPERATOR_WITH_GROUPS: i32 = 168;
pub const SSL_R_MTU_TOO_SMALL: i32 = 169;
pub const SSL_R_NEGOTIATED_BOTH_NPN_AND_ALPN: i32 = 170;
pub const SSL_R_NESTED_GROUP: i32 = 171;
pub const SSL_R_NO_CERTIFICATES_RETURNED: i32 = 172;
pub const SSL_R_NO_CERTIFICATE_ASSIGNED: i32 = 173;
pub const SSL_R_NO_CERTIFICATE_SET: i32 = 174;
pub const SSL_R_NO_CIPHERS_AVAILABLE: i32 = 175;
pub const SSL_R_NO_CIPHERS_PASSED: i32 = 176;
pub const SSL_R_NO_CIPHER_MATCH: i32 = 177;
pub const SSL_R_NO_COMPRESSION_SPECIFIED: i32 = 178;
pub const SSL_R_NO_METHOD_SPECIFIED: i32 = 179;
pub const SSL_R_NO_PRIVATE_KEY_ASSIGNED: i32 = 181;
pub const SSL_R_NO_RENEGOTIATION: i32 = 182;
pub const SSL_R_NO_REQUIRED_DIGEST: i32 = 183;
pub const SSL_R_NO_SHARED_CIPHER: i32 = 184;
pub const SSL_R_NULL_SSL_CTX: i32 = 185;
pub const SSL_R_NULL_SSL_METHOD_PASSED: i32 = 186;
pub const SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED: i32 = 187;
pub const SSL_R_OLD_SESSION_VERSION_NOT_RETURNED: i32 = 188;
pub const SSL_R_OUTPUT_ALIASES_INPUT: i32 = 189;
pub const SSL_R_PARSE_TLSEXT: i32 = 190;
pub const SSL_R_PATH_TOO_LONG: i32 = 191;
pub const SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE: i32 = 192;
pub const SSL_R_PEER_ERROR_UNSUPPORTED_CERTIFICATE_TYPE: i32 = 193;
pub const SSL_R_PROTOCOL_IS_SHUTDOWN: i32 = 194;
pub const SSL_R_PSK_IDENTITY_NOT_FOUND: i32 = 195;
pub const SSL_R_PSK_NO_CLIENT_CB: i32 = 196;
pub const SSL_R_PSK_NO_SERVER_CB: i32 = 197;
pub const SSL_R_READ_TIMEOUT_EXPIRED: i32 = 198;
pub const SSL_R_RECORD_LENGTH_MISMATCH: i32 = 199;
pub const SSL_R_RECORD_TOO_LARGE: i32 = 200;
pub const SSL_R_RENEGOTIATION_ENCODING_ERR: i32 = 201;
pub const SSL_R_RENEGOTIATION_MISMATCH: i32 = 202;
pub const SSL_R_REQUIRED_CIPHER_MISSING: i32 = 203;
pub const SSL_R_RESUMED_EMS_SESSION_WITHOUT_EMS_EXTENSION: i32 = 204;
pub const SSL_R_RESUMED_NON_EMS_SESSION_WITH_EMS_EXTENSION: i32 = 205;
pub const SSL_R_SCSV_RECEIVED_WHEN_RENEGOTIATING: i32 = 206;
pub const SSL_R_SERVERHELLO_TLSEXT: i32 = 207;
pub const SSL_R_SESSION_ID_CONTEXT_UNINITIALIZED: i32 = 208;
pub const SSL_R_SESSION_MAY_NOT_BE_CREATED: i32 = 209;
pub const SSL_R_SIGNATURE_ALGORITHMS_EXTENSION_SENT_BY_SERVER: i32 = 210;
pub const SSL_R_SRTP_COULD_NOT_ALLOCATE_PROFILES: i32 = 211;
pub const SSL_R_SRTP_UNKNOWN_PROTECTION_PROFILE: i32 = 212;
pub const SSL_R_SSL3_EXT_INVALID_SERVERNAME: i32 = 213;
pub const SSL_R_SSL_CTX_HAS_NO_DEFAULT_SSL_VERSION: i32 = 214;
pub const SSL_R_SSL_HANDSHAKE_FAILURE: i32 = 215;
pub const SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG: i32 = 216;
pub const SSL_R_TLS_PEER_DID_NOT_RESPOND_WITH_CERTIFICATE_LIST: i32 = 217;
pub const SSL_R_TLS_RSA_ENCRYPTED_VALUE_LENGTH_IS_WRONG: i32 = 218;
pub const SSL_R_TOO_MANY_EMPTY_FRAGMENTS: i32 = 219;
pub const SSL_R_TOO_MANY_WARNING_ALERTS: i32 = 220;
pub const SSL_R_UNABLE_TO_FIND_ECDH_PARAMETERS: i32 = 221;
pub const SSL_R_UNEXPECTED_EXTENSION: i32 = 222;
pub const SSL_R_UNEXPECTED_MESSAGE: i32 = 223;
pub const SSL_R_UNEXPECTED_OPERATOR_IN_GROUP: i32 = 224;
pub const SSL_R_UNEXPECTED_RECORD: i32 = 225;
pub const SSL_R_UNINITIALIZED: i32 = 226;
pub const SSL_R_UNKNOWN_ALERT_TYPE: i32 = 227;
pub const SSL_R_UNKNOWN_CERTIFICATE_TYPE: i32 = 228;
pub const SSL_R_UNKNOWN_CIPHER_RETURNED: i32 = 229;
pub const SSL_R_UNKNOWN_CIPHER_TYPE: i32 = 230;
pub const SSL_R_UNKNOWN_DIGEST: i32 = 231;
pub const SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE: i32 = 232;
pub const SSL_R_UNKNOWN_PROTOCOL: i32 = 233;
pub const SSL_R_UNKNOWN_SSL_VERSION: i32 = 234;
pub const SSL_R_UNKNOWN_STATE: i32 = 235;
pub const SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED: i32 = 236;
pub const SSL_R_UNSUPPORTED_CIPHER: i32 = 237;
pub const SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM: i32 = 238;
pub const SSL_R_UNSUPPORTED_ELLIPTIC_CURVE: i32 = 239;
pub const SSL_R_UNSUPPORTED_PROTOCOL: i32 = 240;
pub const SSL_R_WRONG_CERTIFICATE_TYPE: i32 = 241;
pub const SSL_R_WRONG_CIPHER_RETURNED: i32 = 242;
pub const SSL_R_WRONG_CURVE: i32 = 243;
pub const SSL_R_WRONG_MESSAGE_TYPE: i32 = 244;
pub const SSL_R_WRONG_SIGNATURE_TYPE: i32 = 245;
pub const SSL_R_WRONG_SSL_VERSION: i32 = 246;
pub const SSL_R_WRONG_VERSION_NUMBER: i32 = 247;
pub const SSL_R_X509_LIB: i32 = 248;
pub const SSL_R_X509_VERIFICATION_SETUP_PROBLEMS: i32 = 249;
pub const SSL_R_SHUTDOWN_WHILE_IN_INIT: i32 = 250;
pub const SSL_R_INVALID_OUTER_RECORD_TYPE: i32 = 251;
pub const SSL_R_UNSUPPORTED_PROTOCOL_FOR_CUSTOM_KEY: i32 = 252;
pub const SSL_R_NO_COMMON_SIGNATURE_ALGORITHMS: i32 = 253;
pub const SSL_R_DOWNGRADE_DETECTED: i32 = 254;
pub const SSL_R_EXCESS_HANDSHAKE_DATA: i32 = 255;
pub const SSL_R_INVALID_COMPRESSION_LIST: i32 = 256;
pub const SSL_R_DUPLICATE_EXTENSION: i32 = 257;
pub const SSL_R_MISSING_KEY_SHARE: i32 = 258;
pub const SSL_R_INVALID_ALPN_PROTOCOL: i32 = 259;
pub const SSL_R_TOO_MANY_KEY_UPDATES: i32 = 260;
pub const SSL_R_BLOCK_CIPHER_PAD_IS_WRONG: i32 = 261;
pub const SSL_R_NO_CIPHERS_SPECIFIED: i32 = 262;
pub const SSL_R_RENEGOTIATION_EMS_MISMATCH: i32 = 263;
pub const SSL_R_DUPLICATE_KEY_SHARE: i32 = 264;
pub const SSL_R_NO_GROUPS_SPECIFIED: i32 = 265;
pub const SSL_R_NO_SHARED_GROUP: i32 = 266;
pub const SSL_R_PRE_SHARED_KEY_MUST_BE_LAST: i32 = 267;
pub const SSL_R_OLD_SESSION_PRF_HASH_MISMATCH: i32 = 268;
pub const SSL_R_INVALID_SCT_LIST: i32 = 269;
pub const SSL_R_TOO_MUCH_SKIPPED_EARLY_DATA: i32 = 270;
pub const SSL_R_PSK_IDENTITY_BINDER_COUNT_MISMATCH: i32 = 271;
pub const SSL_R_CANNOT_PARSE_LEAF_CERT: i32 = 272;
pub const SSL_R_SERVER_CERT_CHANGED: i32 = 273;
pub const SSL_R_CERTIFICATE_AND_PRIVATE_KEY_MISMATCH: i32 = 274;
pub const SSL_R_CANNOT_HAVE_BOTH_PRIVKEY_AND_METHOD: i32 = 275;
pub const SSL_R_TICKET_ENCRYPTION_FAILED: i32 = 276;
pub const SSL_R_ALPN_MISMATCH_ON_EARLY_DATA: i32 = 277;
pub const SSL_R_WRONG_VERSION_ON_EARLY_DATA: i32 = 278;
pub const SSL_R_UNEXPECTED_EXTENSION_ON_EARLY_DATA: i32 = 279;
pub const SSL_R_NO_SUPPORTED_VERSIONS_ENABLED: i32 = 280;
pub const SSL_R_EMPTY_HELLO_RETRY_REQUEST: i32 = 282;
pub const SSL_R_EARLY_DATA_NOT_IN_USE: i32 = 283;
pub const SSL_R_HANDSHAKE_NOT_COMPLETE: i32 = 284;
pub const SSL_R_NEGOTIATED_TB_WITHOUT_EMS_OR_RI: i32 = 285;
pub const SSL_R_SERVER_ECHOED_INVALID_SESSION_ID: i32 = 286;
pub const SSL_R_PRIVATE_KEY_OPERATION_FAILED: i32 = 287;
pub const SSL_R_SECOND_SERVERHELLO_VERSION_MISMATCH: i32 = 288;
pub const SSL_R_OCSP_CB_ERROR: i32 = 289;
pub const SSL_R_SSL_SESSION_ID_TOO_LONG: i32 = 290;
pub const SSL_R_APPLICATION_DATA_ON_SHUTDOWN: i32 = 291;
pub const SSL_R_CERT_DECOMPRESSION_FAILED: i32 = 292;
pub const SSL_R_UNCOMPRESSED_CERT_TOO_LARGE: i32 = 293;
pub const SSL_R_UNKNOWN_CERT_COMPRESSION_ALG: i32 = 294;
pub const SSL_R_INVALID_SIGNATURE_ALGORITHM: i32 = 295;
pub const SSL_R_DUPLICATE_SIGNATURE_ALGORITHM: i32 = 296;
pub const SSL_R_TLS13_DOWNGRADE: i32 = 297;
pub const SSL_R_QUIC_INTERNAL_ERROR: i32 = 298;
pub const SSL_R_WRONG_ENCRYPTION_LEVEL_RECEIVED: i32 = 299;
pub const SSL_R_TOO_MUCH_READ_EARLY_DATA: i32 = 300;
pub const SSL_R_INVALID_DELEGATED_CREDENTIAL: i32 = 301;
pub const SSL_R_KEY_USAGE_BIT_INCORRECT: i32 = 302;
pub const SSL_R_INCONSISTENT_CLIENT_HELLO: i32 = 303;
pub const SSL_R_CIPHER_MISMATCH_ON_EARLY_DATA: i32 = 304;
pub const SSL_R_QUIC_TRANSPORT_PARAMETERS_MISCONFIGURED: i32 = 305;
pub const SSL_R_UNEXPECTED_COMPATIBILITY_MODE: i32 = 306;
pub const SSL_R_NO_APPLICATION_PROTOCOL: i32 = 307;
pub const SSL_R_NEGOTIATED_ALPS_WITHOUT_ALPN: i32 = 308;
pub const SSL_R_ALPS_MISMATCH_ON_EARLY_DATA: i32 = 309;
pub const SSL_R_ECH_SERVER_CONFIG_AND_PRIVATE_KEY_MISMATCH: i32 = 310;
pub const SSL_R_ECH_SERVER_CONFIG_UNSUPPORTED_EXTENSION: i32 = 311;
pub const SSL_R_UNSUPPORTED_ECH_SERVER_CONFIG: i32 = 312;
pub const SSL_R_ECH_SERVER_WOULD_HAVE_NO_RETRY_CONFIGS: i32 = 313;
pub const SSL_R_INVALID_CLIENT_HELLO_INNER: i32 = 314;
pub const SSL_R_INVALID_ALPN_PROTOCOL_LIST: i32 = 315;
pub const SSL_R_COULD_NOT_PARSE_HINTS: i32 = 316;
pub const SSL_R_INVALID_ECH_PUBLIC_NAME: i32 = 317;
pub const SSL_R_INVALID_ECH_CONFIG_LIST: i32 = 318;
pub const SSL_R_ECH_REJECTED: i32 = 319;
pub const SSL_R_INVALID_OUTER_EXTENSION: i32 = 320;
pub const SSL_R_INCONSISTENT_ECH_NEGOTIATION: i32 = 321;
pub const SSL_R_INVALID_ALPS_CODEPOINT: i32 = 322;
pub const SSL_R_NO_MATCHING_ISSUER: i32 = 323;
pub const SSL_R_INVALID_SPAKE2PLUSV1_VALUE: i32 = 324;
pub const SSL_R_PAKE_EXHAUSTED: i32 = 325;
pub const SSL_R_PEER_PAKE_MISMATCH: i32 = 326;
pub const SSL_R_UNSUPPORTED_CREDENTIAL_LIST: i32 = 327;
pub const SSL_R_INVALID_TRUST_ANCHOR_LIST: i32 = 328;
pub const SSL_R_INVALID_CERTIFICATE_PROPERTY_LIST: i32 = 329;
pub const SSL_R_DUPLICATE_GROUP: i32 = 330;
pub const SSL_R_INVALID_PSK_FOR_CONNECTION: i32 = 331;
pub const SSL_R_NO_SUPPORTED_PSK_MODE: i32 = 332;
pub const SSL_R_INVALID_CERT_TYPES_LIST: i32 = 333;
pub const SSL_R_UNSUPPORTED_CERTIFICATE: i32 = 334;
pub const SSL_R_MISSING_KEY: i32 = 335;
pub const SSL_R_INVALID_RAW_PUBLIC_KEY: i32 = 336;
pub const SSL_R_SSLV3_ALERT_CLOSE_NOTIFY: i32 = 1000;
pub const SSL_R_SSLV3_ALERT_UNEXPECTED_MESSAGE: i32 = 1010;
pub const SSL_R_SSLV3_ALERT_BAD_RECORD_MAC: i32 = 1020;
pub const SSL_R_TLSV1_ALERT_DECRYPTION_FAILED: i32 = 1021;
pub const SSL_R_TLSV1_ALERT_RECORD_OVERFLOW: i32 = 1022;
pub const SSL_R_SSLV3_ALERT_DECOMPRESSION_FAILURE: i32 = 1030;
pub const SSL_R_SSLV3_ALERT_HANDSHAKE_FAILURE: i32 = 1040;
pub const SSL_R_SSLV3_ALERT_NO_CERTIFICATE: i32 = 1041;
pub const SSL_R_SSLV3_ALERT_BAD_CERTIFICATE: i32 = 1042;
pub const SSL_R_SSLV3_ALERT_UNSUPPORTED_CERTIFICATE: i32 = 1043;
pub const SSL_R_SSLV3_ALERT_CERTIFICATE_REVOKED: i32 = 1044;
pub const SSL_R_SSLV3_ALERT_CERTIFICATE_EXPIRED: i32 = 1045;
pub const SSL_R_SSLV3_ALERT_CERTIFICATE_UNKNOWN: i32 = 1046;
pub const SSL_R_SSLV3_ALERT_ILLEGAL_PARAMETER: i32 = 1047;
pub const SSL_R_TLSV1_ALERT_UNKNOWN_CA: i32 = 1048;
pub const SSL_R_TLSV1_ALERT_ACCESS_DENIED: i32 = 1049;
pub const SSL_R_TLSV1_ALERT_DECODE_ERROR: i32 = 1050;
pub const SSL_R_TLSV1_ALERT_DECRYPT_ERROR: i32 = 1051;
pub const SSL_R_TLSV1_ALERT_EXPORT_RESTRICTION: i32 = 1060;
pub const SSL_R_TLSV1_ALERT_PROTOCOL_VERSION: i32 = 1070;
pub const SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY: i32 = 1071;
pub const SSL_R_TLSV1_ALERT_INTERNAL_ERROR: i32 = 1080;
pub const SSL_R_TLSV1_ALERT_INAPPROPRIATE_FALLBACK: i32 = 1086;
pub const SSL_R_TLSV1_ALERT_USER_CANCELLED: i32 = 1090;
pub const SSL_R_TLSV1_ALERT_NO_RENEGOTIATION: i32 = 1100;
pub const SSL_R_TLSV1_ALERT_UNSUPPORTED_EXTENSION: i32 = 1110;
pub const SSL_R_TLSV1_ALERT_CERTIFICATE_UNOBTAINABLE: i32 = 1111;
pub const SSL_R_TLSV1_ALERT_UNRECOGNIZED_NAME: i32 = 1112;
pub const SSL_R_TLSV1_ALERT_BAD_CERTIFICATE_STATUS_RESPONSE: i32 = 1113;
pub const SSL_R_TLSV1_ALERT_BAD_CERTIFICATE_HASH_VALUE: i32 = 1114;
pub const SSL_R_TLSV1_ALERT_UNKNOWN_PSK_IDENTITY: i32 = 1115;
pub const SSL_R_TLSV1_ALERT_CERTIFICATE_REQUIRED: i32 = 1116;
pub const SSL_R_TLSV1_ALERT_NO_APPLICATION_PROTOCOL: i32 = 1120;
pub const SSL_R_TLSV1_ALERT_ECH_REQUIRED: i32 = 1121;
pub const TRUST_TOKEN_MAX_PRIVATE_KEY_SIZE: i32 = 512;
pub const TRUST_TOKEN_MAX_PUBLIC_KEY_SIZE: i32 = 512;
pub const TRUST_TOKEN_R_KEYGEN_FAILURE: i32 = 100;
pub const TRUST_TOKEN_R_BUFFER_TOO_SMALL: i32 = 101;
pub const TRUST_TOKEN_R_OVER_BATCHSIZE: i32 = 102;
pub const TRUST_TOKEN_R_DECODE_ERROR: i32 = 103;
pub const TRUST_TOKEN_R_SRR_SIGNATURE_ERROR: i32 = 104;
pub const TRUST_TOKEN_R_DECODE_FAILURE: i32 = 105;
pub const TRUST_TOKEN_R_INVALID_METADATA: i32 = 106;
pub const TRUST_TOKEN_R_TOO_MANY_KEYS: i32 = 107;
pub const TRUST_TOKEN_R_NO_KEYS_CONFIGURED: i32 = 108;
pub const TRUST_TOKEN_R_INVALID_KEY_ID: i32 = 109;
pub const TRUST_TOKEN_R_INVALID_TOKEN: i32 = 110;
pub const TRUST_TOKEN_R_BAD_VALIDITY_CHECK: i32 = 111;
pub const TRUST_TOKEN_R_NO_SRR_KEY_CONFIGURED: i32 = 112;
pub const TRUST_TOKEN_R_INVALID_METADATA_KEY: i32 = 113;
pub const TRUST_TOKEN_R_INVALID_PROOF: i32 = 114;
pub const CRL_REASON_NONE: i32 = -1;
pub const CRL_REASON_UNSPECIFIED: i32 = 0;
pub const CRL_REASON_KEY_COMPROMISE: i32 = 1;
pub const CRL_REASON_CA_COMPROMISE: i32 = 2;
pub const CRL_REASON_AFFILIATION_CHANGED: i32 = 3;
pub const CRL_REASON_SUPERSEDED: i32 = 4;
pub const CRL_REASON_CESSATION_OF_OPERATION: i32 = 5;
pub const CRL_REASON_CERTIFICATE_HOLD: i32 = 6;
pub const CRL_REASON_REMOVE_FROM_CRL: i32 = 8;
pub const CRL_REASON_PRIVILEGE_WITHDRAWN: i32 = 9;
pub const CRL_REASON_AA_COMPROMISE: i32 = 10;
pub const KU_DIGITAL_SIGNATURE: i32 = 128;
pub const KU_NON_REPUDIATION: i32 = 64;
pub const KU_KEY_ENCIPHERMENT: i32 = 32;
pub const KU_DATA_ENCIPHERMENT: i32 = 16;
pub const KU_KEY_AGREEMENT: i32 = 8;
pub const KU_KEY_CERT_SIGN: i32 = 4;
pub const KU_CRL_SIGN: i32 = 2;
pub const KU_ENCIPHER_ONLY: i32 = 1;
pub const KU_DECIPHER_ONLY: i32 = 32768;
pub type __uint64_t = ::core::ffi::c_ulong;
pub type __off_t = ::core::ffi::c_long;
pub type __off64_t = ::core::ffi::c_long;
pub type __time_t = ::core::ffi::c_long;
pub type __suseconds_t = ::core::ffi::c_long;
pub type time_t = __time_t;
/// Forward-declare struct timeval. On Windows, it is defined in winsock2.h and
/// Windows headers define too many macros to be included in public headers.
/// However, only a forward declaration is needed.
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct timeval {
    pub tv_sec: __time_t,
    pub tv_usec: __suseconds_t,
}
/// ossl_ssize_t is a signed type which is large enough to fit the size of any
/// valid memory allocation. We prefer using `size_t`, but sometimes we need a
/// signed type for OpenSSL API compatibility. This type can be used in such
/// cases to avoid overflow.
///
/// Not all `size_t` values fit in `ossl_ssize_t`, but all `size_t` values that
/// are sizes of or indices into C objects, can be converted without overflow.
pub type ossl_ssize_t = isize;
/// CBS_ASN1_TAG is the type used by `CBS` and `CBB` for ASN.1 tags. See that
/// header for details. This type is defined in base.h as a forward declaration.
pub type CBS_ASN1_TAG = u32;
/// CRYPTO_THREADID is a dummy value.
pub type CRYPTO_THREADID = ::core::ffi::c_int;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct asn1_null_st {
    _unused: [u8; 0],
}
/// An `ASN1_NULL` is an opaque type. asn1.h represents the ASN.1 NULL value as
/// an opaque, non-NULL `ASN1_NULL*` pointer.
pub type ASN1_NULL = asn1_null_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct crypto_must_be_null_st {
    _unused: [u8; 0],
}
/// CRYPTO_MUST_BE_NULL is an opaque type that is never returned from BoringSSL.
/// It is used in function parameters that must be NULL.
pub type CRYPTO_MUST_BE_NULL = crypto_must_be_null_st;
pub type ASN1_BOOLEAN = ::core::ffi::c_int;
/// This is the actual ASN1 item itself
pub type ASN1_ITEM = ASN1_ITEM_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct asn1_object_st {
    _unused: [u8; 0],
}
pub type ASN1_OBJECT = asn1_object_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct asn1_pctx_st {
    _unused: [u8; 0],
}
pub type ASN1_PCTX = asn1_pctx_st;
/// An asn1_string_st (aka `ASN1_STRING`) represents a value of a string-like
/// ASN.1 type. It contains a `type` field, and a byte string `data` field with a
/// type-specific representation. This type-specific representation does not
/// always correspond to the DER encoding of the type.
///
/// If `type` is one of `V_ASN1_OCTET_STRING`, `V_ASN1_UTF8STRING`,
/// `V_ASN1_NUMERICSTRING`, `V_ASN1_PRINTABLESTRING`, `V_ASN1_T61STRING`,
/// `V_ASN1_VIDEOTEXSTRING`, `V_ASN1_IA5STRING`, `V_ASN1_GRAPHICSTRING`,
/// `V_ASN1_ISO64STRING`, `V_ASN1_VISIBLESTRING`, `V_ASN1_GENERALSTRING`,
/// `V_ASN1_UNIVERSALSTRING`, or `V_ASN1_BMPSTRING`, the object represents an
/// ASN.1 string type. The data contains the byte representation of the
/// string.
///
/// If `type` is `V_ASN1_BIT_STRING`, the object represents a BIT STRING value.
/// See bit string documentation below for the data and flags.
///
/// If `type` is one of `V_ASN1_INTEGER`, `V_ASN1_NEG_INTEGER`,
/// `V_ASN1_ENUMERATED`, or `V_ASN1_NEG_ENUMERATED`, the object represents an
/// INTEGER or ENUMERATED value. See integer documentation below for details.
///
/// If `type` is `V_ASN1_GENERALIZEDTIME` or `V_ASN1_UTCTIME`, the object
/// represents a GeneralizedTime or UTCTime value, respectively. The data
/// contains the DER encoding of the value. For example, the UNIX epoch would be
/// "19700101000000Z" for a GeneralizedTime and "700101000000Z" for a UTCTime.
///
/// If `type` is `V_ASN1_SEQUENCE`, `V_ASN1_SET`, or `V_ASN1_OTHER`, the object
/// represents a SEQUENCE, SET, or arbitrary ASN.1 value, respectively. Unlike
/// the above cases, the data contains the DER encoding of the entire structure,
/// including the header. If the value is explicitly or implicitly tagged, this
/// too will be reflected in the data field. As this case handles unknown types,
/// the contents are not checked when parsing or serializing.
///
/// Other values of `type` do not represent a valid ASN.1 value, though
/// default-constructed objects may set `type` to -1. Such objects cannot be
/// serialized.
///
/// `ASN1_STRING` additionally has the following typedefs: `ASN1_BIT_STRING`,
/// `ASN1_BMPSTRING`, `ASN1_ENUMERATED`, `ASN1_GENERALIZEDTIME`,
/// `ASN1_GENERALSTRING`, `ASN1_IA5STRING`, `ASN1_INTEGER`, `ASN1_OCTET_STRING`,
/// `ASN1_PRINTABLESTRING`, `ASN1_T61STRING`, `ASN1_TIME`,
/// `ASN1_UNIVERSALSTRING`, `ASN1_UTCTIME`, `ASN1_UTF8STRING`, and
/// `ASN1_VISIBLESTRING`. Other than `ASN1_TIME`, these correspond to universal
/// ASN.1 types. `ASN1_TIME` represents a CHOICE of UTCTime and GeneralizedTime,
/// with a cutoff of 2049, as used in Section 4.1.2.5 of RFC 5280.
///
/// For clarity, callers are encouraged to use the appropriate typedef when
/// available. They are the same type as `ASN1_STRING`, so a caller may freely
/// pass them into functions expecting `ASN1_STRING`, such as
/// `ASN1_STRING_length`.
///
/// If a function returns an `ASN1_STRING` where the typedef or ASN.1 structure
/// implies constraints on `type`, callers may assume that `type` is correct.
/// However, if a function takes an `ASN1_STRING` as input, callers must ensure
/// `type` matches. These invariants are not captured by the C type system and
/// may not be checked at runtime. For example, callers may assume the output of
/// `X509_get0_serialNumber` has type `V_ASN1_INTEGER` or `V_ASN1_NEG_INTEGER`.
/// Callers must not pass a string of type `V_ASN1_OCTET_STRING` to
/// `X509_set_serialNumber`. Doing so may break invariants on the `X509` object
/// and break the `X509_get0_serialNumber` invariant.
///
/// TODO(https://crbug.com/boringssl/445): This is very unfriendly. Getting the
/// type field wrong should not cause memory errors, but it may do strange
/// things. We should add runtime checks to anything that consumes `ASN1_STRING`s
/// from the caller.
pub type ASN1_BIT_STRING = asn1_string_st;
/// An asn1_string_st (aka `ASN1_STRING`) represents a value of a string-like
/// ASN.1 type. It contains a `type` field, and a byte string `data` field with a
/// type-specific representation. This type-specific representation does not
/// always correspond to the DER encoding of the type.
///
/// If `type` is one of `V_ASN1_OCTET_STRING`, `V_ASN1_UTF8STRING`,
/// `V_ASN1_NUMERICSTRING`, `V_ASN1_PRINTABLESTRING`, `V_ASN1_T61STRING`,
/// `V_ASN1_VIDEOTEXSTRING`, `V_ASN1_IA5STRING`, `V_ASN1_GRAPHICSTRING`,
/// `V_ASN1_ISO64STRING`, `V_ASN1_VISIBLESTRING`, `V_ASN1_GENERALSTRING`,
/// `V_ASN1_UNIVERSALSTRING`, or `V_ASN1_BMPSTRING`, the object represents an
/// ASN.1 string type. The data contains the byte representation of the
/// string.
///
/// If `type` is `V_ASN1_BIT_STRING`, the object represents a BIT STRING value.
/// See bit string documentation below for the data and flags.
///
/// If `type` is one of `V_ASN1_INTEGER`, `V_ASN1_NEG_INTEGER`,
/// `V_ASN1_ENUMERATED`, or `V_ASN1_NEG_ENUMERATED`, the object represents an
/// INTEGER or ENUMERATED value. See integer documentation below for details.
///
/// If `type` is `V_ASN1_GENERALIZEDTIME` or `V_ASN1_UTCTIME`, the object
/// represents a GeneralizedTime or UTCTime value, respectively. The data
/// contains the DER encoding of the value. For example, the UNIX epoch would be
/// "19700101000000Z" for a GeneralizedTime and "700101000000Z" for a UTCTime.
///
/// If `type` is `V_ASN1_SEQUENCE`, `V_ASN1_SET`, or `V_ASN1_OTHER`, the object
/// represents a SEQUENCE, SET, or arbitrary ASN.1 value, respectively. Unlike
/// the above cases, the data contains the DER encoding of the entire structure,
/// including the header. If the value is explicitly or implicitly tagged, this
/// too will be reflected in the data field. As this case handles unknown types,
/// the contents are not checked when parsing or serializing.
///
/// Other values of `type` do not represent a valid ASN.1 value, though
/// default-constructed objects may set `type` to -1. Such objects cannot be
/// serialized.
///
/// `ASN1_STRING` additionally has the following typedefs: `ASN1_BIT_STRING`,
/// `ASN1_BMPSTRING`, `ASN1_ENUMERATED`, `ASN1_GENERALIZEDTIME`,
/// `ASN1_GENERALSTRING`, `ASN1_IA5STRING`, `ASN1_INTEGER`, `ASN1_OCTET_STRING`,
/// `ASN1_PRINTABLESTRING`, `ASN1_T61STRING`, `ASN1_TIME`,
/// `ASN1_UNIVERSALSTRING`, `ASN1_UTCTIME`, `ASN1_UTF8STRING`, and
/// `ASN1_VISIBLESTRING`. Other than `ASN1_TIME`, these correspond to universal
/// ASN.1 types. `ASN1_TIME` represents a CHOICE of UTCTime and GeneralizedTime,
/// with a cutoff of 2049, as used in Section 4.1.2.5 of RFC 5280.
///
/// For clarity, callers are encouraged to use the appropriate typedef when
/// available. They are the same type as `ASN1_STRING`, so a caller may freely
/// pass them into functions expecting `ASN1_STRING`, such as
/// `ASN1_STRING_length`.
///
/// If a function returns an `ASN1_STRING` where the typedef or ASN.1 structure
/// implies constraints on `type`, callers may assume that `type` is correct.
/// However, if a function takes an `ASN1_STRING` as input, callers must ensure
/// `type` matches. These invariants are not captured by the C type system and
/// may not be checked at runtime. For example, callers may assume the output of
/// `X509_get0_serialNumber` has type `V_ASN1_INTEGER` or `V_ASN1_NEG_INTEGER`.
/// Callers must not pass a string of type `V_ASN1_OCTET_STRING` to
/// `X509_set_serialNumber`. Doing so may break invariants on the `X509` object
/// and break the `X509_get0_serialNumber` invariant.
///
/// TODO(https://crbug.com/boringssl/445): This is very unfriendly. Getting the
/// type field wrong should not cause memory errors, but it may do strange
/// things. We should add runtime checks to anything that consumes `ASN1_STRING`s
/// from the caller.
pub type ASN1_BMPSTRING = asn1_string_st;
/// An asn1_string_st (aka `ASN1_STRING`) represents a value of a string-like
/// ASN.1 type. It contains a `type` field, and a byte string `data` field with a
/// type-specific representation. This type-specific representation does not
/// always correspond to the DER encoding of the type.
///
/// If `type` is one of `V_ASN1_OCTET_STRING`, `V_ASN1_UTF8STRING`,
/// `V_ASN1_NUMERICSTRING`, `V_ASN1_PRINTABLESTRING`, `V_ASN1_T61STRING`,
/// `V_ASN1_VIDEOTEXSTRING`, `V_ASN1_IA5STRING`, `V_ASN1_GRAPHICSTRING`,
/// `V_ASN1_ISO64STRING`, `V_ASN1_VISIBLESTRING`, `V_ASN1_GENERALSTRING`,
/// `V_ASN1_UNIVERSALSTRING`, or `V_ASN1_BMPSTRING`, the object represents an
/// ASN.1 string type. The data contains the byte representation of the
/// string.
///
/// If `type` is `V_ASN1_BIT_STRING`, the object represents a BIT STRING value.
/// See bit string documentation below for the data and flags.
///
/// If `type` is one of `V_ASN1_INTEGER`, `V_ASN1_NEG_INTEGER`,
/// `V_ASN1_ENUMERATED`, or `V_ASN1_NEG_ENUMERATED`, the object represents an
/// INTEGER or ENUMERATED value. See integer documentation below for details.
///
/// If `type` is `V_ASN1_GENERALIZEDTIME` or `V_ASN1_UTCTIME`, the object
/// represents a GeneralizedTime or UTCTime value, respectively. The data
/// contains the DER encoding of the value. For example, the UNIX epoch would be
/// "19700101000000Z" for a GeneralizedTime and "700101000000Z" for a UTCTime.
///
/// If `type` is `V_ASN1_SEQUENCE`, `V_ASN1_SET`, or `V_ASN1_OTHER`, the object
/// represents a SEQUENCE, SET, or arbitrary ASN.1 value, respectively. Unlike
/// the above cases, the data contains the DER encoding of the entire structure,
/// including the header. If the value is explicitly or implicitly tagged, this
/// too will be reflected in the data field. As this case handles unknown types,
/// the contents are not checked when parsing or serializing.
///
/// Other values of `type` do not represent a valid ASN.1 value, though
/// default-constructed objects may set `type` to -1. Such objects cannot be
/// serialized.
///
/// `ASN1_STRING` additionally has the following typedefs: `ASN1_BIT_STRING`,
/// `ASN1_BMPSTRING`, `ASN1_ENUMERATED`, `ASN1_GENERALIZEDTIME`,
/// `ASN1_GENERALSTRING`, `ASN1_IA5STRING`, `ASN1_INTEGER`, `ASN1_OCTET_STRING`,
/// `ASN1_PRINTABLESTRING`, `ASN1_T61STRING`, `ASN1_TIME`,
/// `ASN1_UNIVERSALSTRING`, `ASN1_UTCTIME`, `ASN1_UTF8STRING`, and
/// `ASN1_VISIBLESTRING`. Other than `ASN1_TIME`, these correspond to universal
/// ASN.1 types. `ASN1_TIME` represents a CHOICE of UTCTime and GeneralizedTime,
/// with a cutoff of 2049, as used in Section 4.1.2.5 of RFC 5280.
///
/// For clarity, callers are encouraged to use the appropriate typedef when
/// available. They are the same type as `ASN1_STRING`, so a caller may freely
/// pass them into functions expecting `ASN1_STRING`, such as
/// `ASN1_STRING_length`.
///
/// If a function returns an `ASN1_STRING` where the typedef or ASN.1 structure
/// implies constraints on `type`, callers may assume that `type` is correct.
/// However, if a function takes an `ASN1_STRING` as input, callers must ensure
/// `type` matches. These invariants are not captured by the C type system and
/// may not be checked at runtime. For example, callers may assume the output of
/// `X509_get0_serialNumber` has type `V_ASN1_INTEGER` or `V_ASN1_NEG_INTEGER`.
/// Callers must not pass a string of type `V_ASN1_OCTET_STRING` to
/// `X509_set_serialNumber`. Doing so may break invariants on the `X509` object
/// and break the `X509_get0_serialNumber` invariant.
///
/// TODO(https://crbug.com/boringssl/445): This is very unfriendly. Getting the
/// type field wrong should not cause memory errors, but it may do strange
/// things. We should add runtime checks to anything that consumes `ASN1_STRING`s
/// from the caller.
pub type ASN1_ENUMERATED = asn1_string_st;
/// An asn1_string_st (aka `ASN1_STRING`) represents a value of a string-like
/// ASN.1 type. It contains a `type` field, and a byte string `data` field with a
/// type-specific representation. This type-specific representation does not
/// always correspond to the DER encoding of the type.
///
/// If `type` is one of `V_ASN1_OCTET_STRING`, `V_ASN1_UTF8STRING`,
/// `V_ASN1_NUMERICSTRING`, `V_ASN1_PRINTABLESTRING`, `V_ASN1_T61STRING`,
/// `V_ASN1_VIDEOTEXSTRING`, `V_ASN1_IA5STRING`, `V_ASN1_GRAPHICSTRING`,
/// `V_ASN1_ISO64STRING`, `V_ASN1_VISIBLESTRING`, `V_ASN1_GENERALSTRING`,
/// `V_ASN1_UNIVERSALSTRING`, or `V_ASN1_BMPSTRING`, the object represents an
/// ASN.1 string type. The data contains the byte representation of the
/// string.
///
/// If `type` is `V_ASN1_BIT_STRING`, the object represents a BIT STRING value.
/// See bit string documentation below for the data and flags.
///
/// If `type` is one of `V_ASN1_INTEGER`, `V_ASN1_NEG_INTEGER`,
/// `V_ASN1_ENUMERATED`, or `V_ASN1_NEG_ENUMERATED`, the object represents an
/// INTEGER or ENUMERATED value. See integer documentation below for details.
///
/// If `type` is `V_ASN1_GENERALIZEDTIME` or `V_ASN1_UTCTIME`, the object
/// represents a GeneralizedTime or UTCTime value, respectively. The data
/// contains the DER encoding of the value. For example, the UNIX epoch would be
/// "19700101000000Z" for a GeneralizedTime and "700101000000Z" for a UTCTime.
///
/// If `type` is `V_ASN1_SEQUENCE`, `V_ASN1_SET`, or `V_ASN1_OTHER`, the object
/// represents a SEQUENCE, SET, or arbitrary ASN.1 value, respectively. Unlike
/// the above cases, the data contains the DER encoding of the entire structure,
/// including the header. If the value is explicitly or implicitly tagged, this
/// too will be reflected in the data field. As this case handles unknown types,
/// the contents are not checked when parsing or serializing.
///
/// Other values of `type` do not represent a valid ASN.1 value, though
/// default-constructed objects may set `type` to -1. Such objects cannot be
/// serialized.
///
/// `ASN1_STRING` additionally has the following typedefs: `ASN1_BIT_STRING`,
/// `ASN1_BMPSTRING`, `ASN1_ENUMERATED`, `ASN1_GENERALIZEDTIME`,
/// `ASN1_GENERALSTRING`, `ASN1_IA5STRING`, `ASN1_INTEGER`, `ASN1_OCTET_STRING`,
/// `ASN1_PRINTABLESTRING`, `ASN1_T61STRING`, `ASN1_TIME`,
/// `ASN1_UNIVERSALSTRING`, `ASN1_UTCTIME`, `ASN1_UTF8STRING`, and
/// `ASN1_VISIBLESTRING`. Other than `ASN1_TIME`, these correspond to universal
/// ASN.1 types. `ASN1_TIME` represents a CHOICE of UTCTime and GeneralizedTime,
/// with a cutoff of 2049, as used in Section 4.1.2.5 of RFC 5280.
///
/// For clarity, callers are encouraged to use the appropriate typedef when
/// available. They are the same type as `ASN1_STRING`, so a caller may freely
/// pass them into functions expecting `ASN1_STRING`, such as
/// `ASN1_STRING_length`.
///
/// If a function returns an `ASN1_STRING` where the typedef or ASN.1 structure
/// implies constraints on `type`, callers may assume that `type` is correct.
/// However, if a function takes an `ASN1_STRING` as input, callers must ensure
/// `type` matches. These invariants are not captured by the C type system and
/// may not be checked at runtime. For example, callers may assume the output of
/// `X509_get0_serialNumber` has type `V_ASN1_INTEGER` or `V_ASN1_NEG_INTEGER`.
/// Callers must not pass a string of type `V_ASN1_OCTET_STRING` to
/// `X509_set_serialNumber`. Doing so may break invariants on the `X509` object
/// and break the `X509_get0_serialNumber` invariant.
///
/// TODO(https://crbug.com/boringssl/445): This is very unfriendly. Getting the
/// type field wrong should not cause memory errors, but it may do strange
/// things. We should add runtime checks to anything that consumes `ASN1_STRING`s
/// from the caller.
pub type ASN1_GENERALIZEDTIME = asn1_string_st;
/// An asn1_string_st (aka `ASN1_STRING`) represents a value of a string-like
/// ASN.1 type. It contains a `type` field, and a byte string `data` field with a
/// type-specific representation. This type-specific representation does not
/// always correspond to the DER encoding of the type.
///
/// If `type` is one of `V_ASN1_OCTET_STRING`, `V_ASN1_UTF8STRING`,
/// `V_ASN1_NUMERICSTRING`, `V_ASN1_PRINTABLESTRING`, `V_ASN1_T61STRING`,
/// `V_ASN1_VIDEOTEXSTRING`, `V_ASN1_IA5STRING`, `V_ASN1_GRAPHICSTRING`,
/// `V_ASN1_ISO64STRING`, `V_ASN1_VISIBLESTRING`, `V_ASN1_GENERALSTRING`,
/// `V_ASN1_UNIVERSALSTRING`, or `V_ASN1_BMPSTRING`, the object represents an
/// ASN.1 string type. The data contains the byte representation of the
/// string.
///
/// If `type` is `V_ASN1_BIT_STRING`, the object represents a BIT STRING value.
/// See bit string documentation below for the data and flags.
///
/// If `type` is one of `V_ASN1_INTEGER`, `V_ASN1_NEG_INTEGER`,
/// `V_ASN1_ENUMERATED`, or `V_ASN1_NEG_ENUMERATED`, the object represents an
/// INTEGER or ENUMERATED value. See integer documentation below for details.
///
/// If `type` is `V_ASN1_GENERALIZEDTIME` or `V_ASN1_UTCTIME`, the object
/// represents a GeneralizedTime or UTCTime value, respectively. The data
/// contains the DER encoding of the value. For example, the UNIX epoch would be
/// "19700101000000Z" for a GeneralizedTime and "700101000000Z" for a UTCTime.
///
/// If `type` is `V_ASN1_SEQUENCE`, `V_ASN1_SET`, or `V_ASN1_OTHER`, the object
/// represents a SEQUENCE, SET, or arbitrary ASN.1 value, respectively. Unlike
/// the above cases, the data contains the DER encoding of the entire structure,
/// including the header. If the value is explicitly or implicitly tagged, this
/// too will be reflected in the data field. As this case handles unknown types,
/// the contents are not checked when parsing or serializing.
///
/// Other values of `type` do not represent a valid ASN.1 value, though
/// default-constructed objects may set `type` to -1. Such objects cannot be
/// serialized.
///
/// `ASN1_STRING` additionally has the following typedefs: `ASN1_BIT_STRING`,
/// `ASN1_BMPSTRING`, `ASN1_ENUMERATED`, `ASN1_GENERALIZEDTIME`,
/// `ASN1_GENERALSTRING`, `ASN1_IA5STRING`, `ASN1_INTEGER`, `ASN1_OCTET_STRING`,
/// `ASN1_PRINTABLESTRING`, `ASN1_T61STRING`, `ASN1_TIME`,
/// `ASN1_UNIVERSALSTRING`, `ASN1_UTCTIME`, `ASN1_UTF8STRING`, and
/// `ASN1_VISIBLESTRING`. Other than `ASN1_TIME`, these correspond to universal
/// ASN.1 types. `ASN1_TIME` represents a CHOICE of UTCTime and GeneralizedTime,
/// with a cutoff of 2049, as used in Section 4.1.2.5 of RFC 5280.
///
/// For clarity, callers are encouraged to use the appropriate typedef when
/// available. They are the same type as `ASN1_STRING`, so a caller may freely
/// pass them into functions expecting `ASN1_STRING`, such as
/// `ASN1_STRING_length`.
///
/// If a function returns an `ASN1_STRING` where the typedef or ASN.1 structure
/// implies constraints on `type`, callers may assume that `type` is correct.
/// However, if a function takes an `ASN1_STRING` as input, callers must ensure
/// `type` matches. These invariants are not captured by the C type system and
/// may not be checked at runtime. For example, callers may assume the output of
/// `X509_get0_serialNumber` has type `V_ASN1_INTEGER` or `V_ASN1_NEG_INTEGER`.
/// Callers must not pass a string of type `V_ASN1_OCTET_STRING` to
/// `X509_set_serialNumber`. Doing so may break invariants on the `X509` object
/// and break the `X509_get0_serialNumber` invariant.
///
/// TODO(https://crbug.com/boringssl/445): This is very unfriendly. Getting the
/// type field wrong should not cause memory errors, but it may do strange
/// things. We should add runtime checks to anything that consumes `ASN1_STRING`s
/// from the caller.
pub type ASN1_GENERALSTRING = asn1_string_st;
/// An asn1_string_st (aka `ASN1_STRING`) represents a value of a string-like
/// ASN.1 type. It contains a `type` field, and a byte string `data` field with a
/// type-specific representation. This type-specific representation does not
/// always correspond to the DER encoding of the type.
///
/// If `type` is one of `V_ASN1_OCTET_STRING`, `V_ASN1_UTF8STRING`,
/// `V_ASN1_NUMERICSTRING`, `V_ASN1_PRINTABLESTRING`, `V_ASN1_T61STRING`,
/// `V_ASN1_VIDEOTEXSTRING`, `V_ASN1_IA5STRING`, `V_ASN1_GRAPHICSTRING`,
/// `V_ASN1_ISO64STRING`, `V_ASN1_VISIBLESTRING`, `V_ASN1_GENERALSTRING`,
/// `V_ASN1_UNIVERSALSTRING`, or `V_ASN1_BMPSTRING`, the object represents an
/// ASN.1 string type. The data contains the byte representation of the
/// string.
///
/// If `type` is `V_ASN1_BIT_STRING`, the object represents a BIT STRING value.
/// See bit string documentation below for the data and flags.
///
/// If `type` is one of `V_ASN1_INTEGER`, `V_ASN1_NEG_INTEGER`,
/// `V_ASN1_ENUMERATED`, or `V_ASN1_NEG_ENUMERATED`, the object represents an
/// INTEGER or ENUMERATED value. See integer documentation below for details.
///
/// If `type` is `V_ASN1_GENERALIZEDTIME` or `V_ASN1_UTCTIME`, the object
/// represents a GeneralizedTime or UTCTime value, respectively. The data
/// contains the DER encoding of the value. For example, the UNIX epoch would be
/// "19700101000000Z" for a GeneralizedTime and "700101000000Z" for a UTCTime.
///
/// If `type` is `V_ASN1_SEQUENCE`, `V_ASN1_SET`, or `V_ASN1_OTHER`, the object
/// represents a SEQUENCE, SET, or arbitrary ASN.1 value, respectively. Unlike
/// the above cases, the data contains the DER encoding of the entire structure,
/// including the header. If the value is explicitly or implicitly tagged, this
/// too will be reflected in the data field. As this case handles unknown types,
/// the contents are not checked when parsing or serializing.
///
/// Other values of `type` do not represent a valid ASN.1 value, though
/// default-constructed objects may set `type` to -1. Such objects cannot be
/// serialized.
///
/// `ASN1_STRING` additionally has the following typedefs: `ASN1_BIT_STRING`,
/// `ASN1_BMPSTRING`, `ASN1_ENUMERATED`, `ASN1_GENERALIZEDTIME`,
/// `ASN1_GENERALSTRING`, `ASN1_IA5STRING`, `ASN1_INTEGER`, `ASN1_OCTET_STRING`,
/// `ASN1_PRINTABLESTRING`, `ASN1_T61STRING`, `ASN1_TIME`,
/// `ASN1_UNIVERSALSTRING`, `ASN1_UTCTIME`, `ASN1_UTF8STRING`, and
/// `ASN1_VISIBLESTRING`. Other than `ASN1_TIME`, these correspond to universal
/// ASN.1 types. `ASN1_TIME` represents a CHOICE of UTCTime and GeneralizedTime,
/// with a cutoff of 2049, as used in Section 4.1.2.5 of RFC 5280.
///
/// For clarity, callers are encouraged to use the appropriate typedef when
/// available. They are the same type as `ASN1_STRING`, so a caller may freely
/// pass them into functions expecting `ASN1_STRING`, such as
/// `ASN1_STRING_length`.
///
/// If a function returns an `ASN1_STRING` where the typedef or ASN.1 structure
/// implies constraints on `type`, callers may assume that `type` is correct.
/// However, if a function takes an `ASN1_STRING` as input, callers must ensure
/// `type` matches. These invariants are not captured by the C type system and
/// may not be checked at runtime. For example, callers may assume the output of
/// `X509_get0_serialNumber` has type `V_ASN1_INTEGER` or `V_ASN1_NEG_INTEGER`.
/// Callers must not pass a string of type `V_ASN1_OCTET_STRING` to
/// `X509_set_serialNumber`. Doing so may break invariants on the `X509` object
/// and break the `X509_get0_serialNumber` invariant.
///
/// TODO(https://crbug.com/boringssl/445): This is very unfriendly. Getting the
/// type field wrong should not cause memory errors, but it may do strange
/// things. We should add runtime checks to anything that consumes `ASN1_STRING`s
/// from the caller.
pub type ASN1_IA5STRING = asn1_string_st;
/// An asn1_string_st (aka `ASN1_STRING`) represents a value of a string-like
/// ASN.1 type. It contains a `type` field, and a byte string `data` field with a
/// type-specific representation. This type-specific representation does not
/// always correspond to the DER encoding of the type.
///
/// If `type` is one of `V_ASN1_OCTET_STRING`, `V_ASN1_UTF8STRING`,
/// `V_ASN1_NUMERICSTRING`, `V_ASN1_PRINTABLESTRING`, `V_ASN1_T61STRING`,
/// `V_ASN1_VIDEOTEXSTRING`, `V_ASN1_IA5STRING`, `V_ASN1_GRAPHICSTRING`,
/// `V_ASN1_ISO64STRING`, `V_ASN1_VISIBLESTRING`, `V_ASN1_GENERALSTRING`,
/// `V_ASN1_UNIVERSALSTRING`, or `V_ASN1_BMPSTRING`, the object represents an
/// ASN.1 string type. The data contains the byte representation of the
/// string.
///
/// If `type` is `V_ASN1_BIT_STRING`, the object represents a BIT STRING value.
/// See bit string documentation below for the data and flags.
///
/// If `type` is one of `V_ASN1_INTEGER`, `V_ASN1_NEG_INTEGER`,
/// `V_ASN1_ENUMERATED`, or `V_ASN1_NEG_ENUMERATED`, the object represents an
/// INTEGER or ENUMERATED value. See integer documentation below for details.
///
/// If `type` is `V_ASN1_GENERALIZEDTIME` or `V_ASN1_UTCTIME`, the object
/// represents a GeneralizedTime or UTCTime value, respectively. The data
/// contains the DER encoding of the value. For example, the UNIX epoch would be
/// "19700101000000Z" for a GeneralizedTime and "700101000000Z" for a UTCTime.
///
/// If `type` is `V_ASN1_SEQUENCE`, `V_ASN1_SET`, or `V_ASN1_OTHER`, the object
/// represents a SEQUENCE, SET, or arbitrary ASN.1 value, respectively. Unlike
/// the above cases, the data contains the DER encoding of the entire structure,
/// including the header. If the value is explicitly or implicitly tagged, this
/// too will be reflected in the data field. As this case handles unknown types,
/// the contents are not checked when parsing or serializing.
///
/// Other values of `type` do not represent a valid ASN.1 value, though
/// default-constructed objects may set `type` to -1. Such objects cannot be
/// serialized.
///
/// `ASN1_STRING` additionally has the following typedefs: `ASN1_BIT_STRING`,
/// `ASN1_BMPSTRING`, `ASN1_ENUMERATED`, `ASN1_GENERALIZEDTIME`,
/// `ASN1_GENERALSTRING`, `ASN1_IA5STRING`, `ASN1_INTEGER`, `ASN1_OCTET_STRING`,
/// `ASN1_PRINTABLESTRING`, `ASN1_T61STRING`, `ASN1_TIME`,
/// `ASN1_UNIVERSALSTRING`, `ASN1_UTCTIME`, `ASN1_UTF8STRING`, and
/// `ASN1_VISIBLESTRING`. Other than `ASN1_TIME`, these correspond to universal
/// ASN.1 types. `ASN1_TIME` represents a CHOICE of UTCTime and GeneralizedTime,
/// with a cutoff of 2049, as used in Section 4.1.2.5 of RFC 5280.
///
/// For clarity, callers are encouraged to use the appropriate typedef when
/// available. They are the same type as `ASN1_STRING`, so a caller may freely
/// pass them into functions expecting `ASN1_STRING`, such as
/// `ASN1_STRING_length`.
///
/// If a function returns an `ASN1_STRING` where the typedef or ASN.1 structure
/// implies constraints on `type`, callers may assume that `type` is correct.
/// However, if a function takes an `ASN1_STRING` as input, callers must ensure
/// `type` matches. These invariants are not captured by the C type system and
/// may not be checked at runtime. For example, callers may assume the output of
/// `X509_get0_serialNumber` has type `V_ASN1_INTEGER` or `V_ASN1_NEG_INTEGER`.
/// Callers must not pass a string of type `V_ASN1_OCTET_STRING` to
/// `X509_set_serialNumber`. Doing so may break invariants on the `X509` object
/// and break the `X509_get0_serialNumber` invariant.
///
/// TODO(https://crbug.com/boringssl/445): This is very unfriendly. Getting the
/// type field wrong should not cause memory errors, but it may do strange
/// things. We should add runtime checks to anything that consumes `ASN1_STRING`s
/// from the caller.
pub type ASN1_INTEGER = asn1_string_st;
/// An asn1_string_st (aka `ASN1_STRING`) represents a value of a string-like
/// ASN.1 type. It contains a `type` field, and a byte string `data` field with a
/// type-specific representation. This type-specific representation does not
/// always correspond to the DER encoding of the type.
///
/// If `type` is one of `V_ASN1_OCTET_STRING`, `V_ASN1_UTF8STRING`,
/// `V_ASN1_NUMERICSTRING`, `V_ASN1_PRINTABLESTRING`, `V_ASN1_T61STRING`,
/// `V_ASN1_VIDEOTEXSTRING`, `V_ASN1_IA5STRING`, `V_ASN1_GRAPHICSTRING`,
/// `V_ASN1_ISO64STRING`, `V_ASN1_VISIBLESTRING`, `V_ASN1_GENERALSTRING`,
/// `V_ASN1_UNIVERSALSTRING`, or `V_ASN1_BMPSTRING`, the object represents an
/// ASN.1 string type. The data contains the byte representation of the
/// string.
///
/// If `type` is `V_ASN1_BIT_STRING`, the object represents a BIT STRING value.
/// See bit string documentation below for the data and flags.
///
/// If `type` is one of `V_ASN1_INTEGER`, `V_ASN1_NEG_INTEGER`,
/// `V_ASN1_ENUMERATED`, or `V_ASN1_NEG_ENUMERATED`, the object represents an
/// INTEGER or ENUMERATED value. See integer documentation below for details.
///
/// If `type` is `V_ASN1_GENERALIZEDTIME` or `V_ASN1_UTCTIME`, the object
/// represents a GeneralizedTime or UTCTime value, respectively. The data
/// contains the DER encoding of the value. For example, the UNIX epoch would be
/// "19700101000000Z" for a GeneralizedTime and "700101000000Z" for a UTCTime.
///
/// If `type` is `V_ASN1_SEQUENCE`, `V_ASN1_SET`, or `V_ASN1_OTHER`, the object
/// represents a SEQUENCE, SET, or arbitrary ASN.1 value, respectively. Unlike
/// the above cases, the data contains the DER encoding of the entire structure,
/// including the header. If the value is explicitly or implicitly tagged, this
/// too will be reflected in the data field. As this case handles unknown types,
/// the contents are not checked when parsing or serializing.
///
/// Other values of `type` do not represent a valid ASN.1 value, though
/// default-constructed objects may set `type` to -1. Such objects cannot be
/// serialized.
///
/// `ASN1_STRING` additionally has the following typedefs: `ASN1_BIT_STRING`,
/// `ASN1_BMPSTRING`, `ASN1_ENUMERATED`, `ASN1_GENERALIZEDTIME`,
/// `ASN1_GENERALSTRING`, `ASN1_IA5STRING`, `ASN1_INTEGER`, `ASN1_OCTET_STRING`,
/// `ASN1_PRINTABLESTRING`, `ASN1_T61STRING`, `ASN1_TIME`,
/// `ASN1_UNIVERSALSTRING`, `ASN1_UTCTIME`, `ASN1_UTF8STRING`, and
/// `ASN1_VISIBLESTRING`. Other than `ASN1_TIME`, these correspond to universal
/// ASN.1 types. `ASN1_TIME` represents a CHOICE of UTCTime and GeneralizedTime,
/// with a cutoff of 2049, as used in Section 4.1.2.5 of RFC 5280.
///
/// For clarity, callers are encouraged to use the appropriate typedef when
/// available. They are the same type as `ASN1_STRING`, so a caller may freely
/// pass them into functions expecting `ASN1_STRING`, such as
/// `ASN1_STRING_length`.
///
/// If a function returns an `ASN1_STRING` where the typedef or ASN.1 structure
/// implies constraints on `type`, callers may assume that `type` is correct.
/// However, if a function takes an `ASN1_STRING` as input, callers must ensure
/// `type` matches. These invariants are not captured by the C type system and
/// may not be checked at runtime. For example, callers may assume the output of
/// `X509_get0_serialNumber` has type `V_ASN1_INTEGER` or `V_ASN1_NEG_INTEGER`.
/// Callers must not pass a string of type `V_ASN1_OCTET_STRING` to
/// `X509_set_serialNumber`. Doing so may break invariants on the `X509` object
/// and break the `X509_get0_serialNumber` invariant.
///
/// TODO(https://crbug.com/boringssl/445): This is very unfriendly. Getting the
/// type field wrong should not cause memory errors, but it may do strange
/// things. We should add runtime checks to anything that consumes `ASN1_STRING`s
/// from the caller.
pub type ASN1_OCTET_STRING = asn1_string_st;
/// An asn1_string_st (aka `ASN1_STRING`) represents a value of a string-like
/// ASN.1 type. It contains a `type` field, and a byte string `data` field with a
/// type-specific representation. This type-specific representation does not
/// always correspond to the DER encoding of the type.
///
/// If `type` is one of `V_ASN1_OCTET_STRING`, `V_ASN1_UTF8STRING`,
/// `V_ASN1_NUMERICSTRING`, `V_ASN1_PRINTABLESTRING`, `V_ASN1_T61STRING`,
/// `V_ASN1_VIDEOTEXSTRING`, `V_ASN1_IA5STRING`, `V_ASN1_GRAPHICSTRING`,
/// `V_ASN1_ISO64STRING`, `V_ASN1_VISIBLESTRING`, `V_ASN1_GENERALSTRING`,
/// `V_ASN1_UNIVERSALSTRING`, or `V_ASN1_BMPSTRING`, the object represents an
/// ASN.1 string type. The data contains the byte representation of the
/// string.
///
/// If `type` is `V_ASN1_BIT_STRING`, the object represents a BIT STRING value.
/// See bit string documentation below for the data and flags.
///
/// If `type` is one of `V_ASN1_INTEGER`, `V_ASN1_NEG_INTEGER`,
/// `V_ASN1_ENUMERATED`, or `V_ASN1_NEG_ENUMERATED`, the object represents an
/// INTEGER or ENUMERATED value. See integer documentation below for details.
///
/// If `type` is `V_ASN1_GENERALIZEDTIME` or `V_ASN1_UTCTIME`, the object
/// represents a GeneralizedTime or UTCTime value, respectively. The data
/// contains the DER encoding of the value. For example, the UNIX epoch would be
/// "19700101000000Z" for a GeneralizedTime and "700101000000Z" for a UTCTime.
///
/// If `type` is `V_ASN1_SEQUENCE`, `V_ASN1_SET`, or `V_ASN1_OTHER`, the object
/// represents a SEQUENCE, SET, or arbitrary ASN.1 value, respectively. Unlike
/// the above cases, the data contains the DER encoding of the entire structure,
/// including the header. If the value is explicitly or implicitly tagged, this
/// too will be reflected in the data field. As this case handles unknown types,
/// the contents are not checked when parsing or serializing.
///
/// Other values of `type` do not represent a valid ASN.1 value, though
/// default-constructed objects may set `type` to -1. Such objects cannot be
/// serialized.
///
/// `ASN1_STRING` additionally has the following typedefs: `ASN1_BIT_STRING`,
/// `ASN1_BMPSTRING`, `ASN1_ENUMERATED`, `ASN1_GENERALIZEDTIME`,
/// `ASN1_GENERALSTRING`, `ASN1_IA5STRING`, `ASN1_INTEGER`, `ASN1_OCTET_STRING`,
/// `ASN1_PRINTABLESTRING`, `ASN1_T61STRING`, `ASN1_TIME`,
/// `ASN1_UNIVERSALSTRING`, `ASN1_UTCTIME`, `ASN1_UTF8STRING`, and
/// `ASN1_VISIBLESTRING`. Other than `ASN1_TIME`, these correspond to universal
/// ASN.1 types. `ASN1_TIME` represents a CHOICE of UTCTime and GeneralizedTime,
/// with a cutoff of 2049, as used in Section 4.1.2.5 of RFC 5280.
///
/// For clarity, callers are encouraged to use the appropriate typedef when
/// available. They are the same type as `ASN1_STRING`, so a caller may freely
/// pass them into functions expecting `ASN1_STRING`, such as
/// `ASN1_STRING_length`.
///
/// If a function returns an `ASN1_STRING` where the typedef or ASN.1 structure
/// implies constraints on `type`, callers may assume that `type` is correct.
/// However, if a function takes an `ASN1_STRING` as input, callers must ensure
/// `type` matches. These invariants are not captured by the C type system and
/// may not be checked at runtime. For example, callers may assume the output of
/// `X509_get0_serialNumber` has type `V_ASN1_INTEGER` or `V_ASN1_NEG_INTEGER`.
/// Callers must not pass a string of type `V_ASN1_OCTET_STRING` to
/// `X509_set_serialNumber`. Doing so may break invariants on the `X509` object
/// and break the `X509_get0_serialNumber` invariant.
///
/// TODO(https://crbug.com/boringssl/445): This is very unfriendly. Getting the
/// type field wrong should not cause memory errors, but it may do strange
/// things. We should add runtime checks to anything that consumes `ASN1_STRING`s
/// from the caller.
pub type ASN1_PRINTABLESTRING = asn1_string_st;
/// An asn1_string_st (aka `ASN1_STRING`) represents a value of a string-like
/// ASN.1 type. It contains a `type` field, and a byte string `data` field with a
/// type-specific representation. This type-specific representation does not
/// always correspond to the DER encoding of the type.
///
/// If `type` is one of `V_ASN1_OCTET_STRING`, `V_ASN1_UTF8STRING`,
/// `V_ASN1_NUMERICSTRING`, `V_ASN1_PRINTABLESTRING`, `V_ASN1_T61STRING`,
/// `V_ASN1_VIDEOTEXSTRING`, `V_ASN1_IA5STRING`, `V_ASN1_GRAPHICSTRING`,
/// `V_ASN1_ISO64STRING`, `V_ASN1_VISIBLESTRING`, `V_ASN1_GENERALSTRING`,
/// `V_ASN1_UNIVERSALSTRING`, or `V_ASN1_BMPSTRING`, the object represents an
/// ASN.1 string type. The data contains the byte representation of the
/// string.
///
/// If `type` is `V_ASN1_BIT_STRING`, the object represents a BIT STRING value.
/// See bit string documentation below for the data and flags.
///
/// If `type` is one of `V_ASN1_INTEGER`, `V_ASN1_NEG_INTEGER`,
/// `V_ASN1_ENUMERATED`, or `V_ASN1_NEG_ENUMERATED`, the object represents an
/// INTEGER or ENUMERATED value. See integer documentation below for details.
///
/// If `type` is `V_ASN1_GENERALIZEDTIME` or `V_ASN1_UTCTIME`, the object
/// represents a GeneralizedTime or UTCTime value, respectively. The data
/// contains the DER encoding of the value. For example, the UNIX epoch would be
/// "19700101000000Z" for a GeneralizedTime and "700101000000Z" for a UTCTime.
///
/// If `type` is `V_ASN1_SEQUENCE`, `V_ASN1_SET`, or `V_ASN1_OTHER`, the object
/// represents a SEQUENCE, SET, or arbitrary ASN.1 value, respectively. Unlike
/// the above cases, the data contains the DER encoding of the entire structure,
/// including the header. If the value is explicitly or implicitly tagged, this
/// too will be reflected in the data field. As this case handles unknown types,
/// the contents are not checked when parsing or serializing.
///
/// Other values of `type` do not represent a valid ASN.1 value, though
/// default-constructed objects may set `type` to -1. Such objects cannot be
/// serialized.
///
/// `ASN1_STRING` additionally has the following typedefs: `ASN1_BIT_STRING`,
/// `ASN1_BMPSTRING`, `ASN1_ENUMERATED`, `ASN1_GENERALIZEDTIME`,
/// `ASN1_GENERALSTRING`, `ASN1_IA5STRING`, `ASN1_INTEGER`, `ASN1_OCTET_STRING`,
/// `ASN1_PRINTABLESTRING`, `ASN1_T61STRING`, `ASN1_TIME`,
/// `ASN1_UNIVERSALSTRING`, `ASN1_UTCTIME`, `ASN1_UTF8STRING`, and
/// `ASN1_VISIBLESTRING`. Other than `ASN1_TIME`, these correspond to universal
/// ASN.1 types. `ASN1_TIME` represents a CHOICE of UTCTime and GeneralizedTime,
/// with a cutoff of 2049, as used in Section 4.1.2.5 of RFC 5280.
///
/// For clarity, callers are encouraged to use the appropriate typedef when
/// available. They are the same type as `ASN1_STRING`, so a caller may freely
/// pass them into functions expecting `ASN1_STRING`, such as
/// `ASN1_STRING_length`.
///
/// If a function returns an `ASN1_STRING` where the typedef or ASN.1 structure
/// implies constraints on `type`, callers may assume that `type` is correct.
/// However, if a function takes an `ASN1_STRING` as input, callers must ensure
/// `type` matches. These invariants are not captured by the C type system and
/// may not be checked at runtime. For example, callers may assume the output of
/// `X509_get0_serialNumber` has type `V_ASN1_INTEGER` or `V_ASN1_NEG_INTEGER`.
/// Callers must not pass a string of type `V_ASN1_OCTET_STRING` to
/// `X509_set_serialNumber`. Doing so may break invariants on the `X509` object
/// and break the `X509_get0_serialNumber` invariant.
///
/// TODO(https://crbug.com/boringssl/445): This is very unfriendly. Getting the
/// type field wrong should not cause memory errors, but it may do strange
/// things. We should add runtime checks to anything that consumes `ASN1_STRING`s
/// from the caller.
pub type ASN1_STRING = asn1_string_st;
/// An asn1_string_st (aka `ASN1_STRING`) represents a value of a string-like
/// ASN.1 type. It contains a `type` field, and a byte string `data` field with a
/// type-specific representation. This type-specific representation does not
/// always correspond to the DER encoding of the type.
///
/// If `type` is one of `V_ASN1_OCTET_STRING`, `V_ASN1_UTF8STRING`,
/// `V_ASN1_NUMERICSTRING`, `V_ASN1_PRINTABLESTRING`, `V_ASN1_T61STRING`,
/// `V_ASN1_VIDEOTEXSTRING`, `V_ASN1_IA5STRING`, `V_ASN1_GRAPHICSTRING`,
/// `V_ASN1_ISO64STRING`, `V_ASN1_VISIBLESTRING`, `V_ASN1_GENERALSTRING`,
/// `V_ASN1_UNIVERSALSTRING`, or `V_ASN1_BMPSTRING`, the object represents an
/// ASN.1 string type. The data contains the byte representation of the
/// string.
///
/// If `type` is `V_ASN1_BIT_STRING`, the object represents a BIT STRING value.
/// See bit string documentation below for the data and flags.
///
/// If `type` is one of `V_ASN1_INTEGER`, `V_ASN1_NEG_INTEGER`,
/// `V_ASN1_ENUMERATED`, or `V_ASN1_NEG_ENUMERATED`, the object represents an
/// INTEGER or ENUMERATED value. See integer documentation below for details.
///
/// If `type` is `V_ASN1_GENERALIZEDTIME` or `V_ASN1_UTCTIME`, the object
/// represents a GeneralizedTime or UTCTime value, respectively. The data
/// contains the DER encoding of the value. For example, the UNIX epoch would be
/// "19700101000000Z" for a GeneralizedTime and "700101000000Z" for a UTCTime.
///
/// If `type` is `V_ASN1_SEQUENCE`, `V_ASN1_SET`, or `V_ASN1_OTHER`, the object
/// represents a SEQUENCE, SET, or arbitrary ASN.1 value, respectively. Unlike
/// the above cases, the data contains the DER encoding of the entire structure,
/// including the header. If the value is explicitly or implicitly tagged, this
/// too will be reflected in the data field. As this case handles unknown types,
/// the contents are not checked when parsing or serializing.
///
/// Other values of `type` do not represent a valid ASN.1 value, though
/// default-constructed objects may set `type` to -1. Such objects cannot be
/// serialized.
///
/// `ASN1_STRING` additionally has the following typedefs: `ASN1_BIT_STRING`,
/// `ASN1_BMPSTRING`, `ASN1_ENUMERATED`, `ASN1_GENERALIZEDTIME`,
/// `ASN1_GENERALSTRING`, `ASN1_IA5STRING`, `ASN1_INTEGER`, `ASN1_OCTET_STRING`,
/// `ASN1_PRINTABLESTRING`, `ASN1_T61STRING`, `ASN1_TIME`,
/// `ASN1_UNIVERSALSTRING`, `ASN1_UTCTIME`, `ASN1_UTF8STRING`, and
/// `ASN1_VISIBLESTRING`. Other than `ASN1_TIME`, these correspond to universal
/// ASN.1 types. `ASN1_TIME` represents a CHOICE of UTCTime and GeneralizedTime,
/// with a cutoff of 2049, as used in Section 4.1.2.5 of RFC 5280.
///
/// For clarity, callers are encouraged to use the appropriate typedef when
/// available. They are the same type as `ASN1_STRING`, so a caller may freely
/// pass them into functions expecting `ASN1_STRING`, such as
/// `ASN1_STRING_length`.
///
/// If a function returns an `ASN1_STRING` where the typedef or ASN.1 structure
/// implies constraints on `type`, callers may assume that `type` is correct.
/// However, if a function takes an `ASN1_STRING` as input, callers must ensure
/// `type` matches. These invariants are not captured by the C type system and
/// may not be checked at runtime. For example, callers may assume the output of
/// `X509_get0_serialNumber` has type `V_ASN1_INTEGER` or `V_ASN1_NEG_INTEGER`.
/// Callers must not pass a string of type `V_ASN1_OCTET_STRING` to
/// `X509_set_serialNumber`. Doing so may break invariants on the `X509` object
/// and break the `X509_get0_serialNumber` invariant.
///
/// TODO(https://crbug.com/boringssl/445): This is very unfriendly. Getting the
/// type field wrong should not cause memory errors, but it may do strange
/// things. We should add runtime checks to anything that consumes `ASN1_STRING`s
/// from the caller.
pub type ASN1_T61STRING = asn1_string_st;
/// An asn1_string_st (aka `ASN1_STRING`) represents a value of a string-like
/// ASN.1 type. It contains a `type` field, and a byte string `data` field with a
/// type-specific representation. This type-specific representation does not
/// always correspond to the DER encoding of the type.
///
/// If `type` is one of `V_ASN1_OCTET_STRING`, `V_ASN1_UTF8STRING`,
/// `V_ASN1_NUMERICSTRING`, `V_ASN1_PRINTABLESTRING`, `V_ASN1_T61STRING`,
/// `V_ASN1_VIDEOTEXSTRING`, `V_ASN1_IA5STRING`, `V_ASN1_GRAPHICSTRING`,
/// `V_ASN1_ISO64STRING`, `V_ASN1_VISIBLESTRING`, `V_ASN1_GENERALSTRING`,
/// `V_ASN1_UNIVERSALSTRING`, or `V_ASN1_BMPSTRING`, the object represents an
/// ASN.1 string type. The data contains the byte representation of the
/// string.
///
/// If `type` is `V_ASN1_BIT_STRING`, the object represents a BIT STRING value.
/// See bit string documentation below for the data and flags.
///
/// If `type` is one of `V_ASN1_INTEGER`, `V_ASN1_NEG_INTEGER`,
/// `V_ASN1_ENUMERATED`, or `V_ASN1_NEG_ENUMERATED`, the object represents an
/// INTEGER or ENUMERATED value. See integer documentation below for details.
///
/// If `type` is `V_ASN1_GENERALIZEDTIME` or `V_ASN1_UTCTIME`, the object
/// represents a GeneralizedTime or UTCTime value, respectively. The data
/// contains the DER encoding of the value. For example, the UNIX epoch would be
/// "19700101000000Z" for a GeneralizedTime and "700101000000Z" for a UTCTime.
///
/// If `type` is `V_ASN1_SEQUENCE`, `V_ASN1_SET`, or `V_ASN1_OTHER`, the object
/// represents a SEQUENCE, SET, or arbitrary ASN.1 value, respectively. Unlike
/// the above cases, the data contains the DER encoding of the entire structure,
/// including the header. If the value is explicitly or implicitly tagged, this
/// too will be reflected in the data field. As this case handles unknown types,
/// the contents are not checked when parsing or serializing.
///
/// Other values of `type` do not represent a valid ASN.1 value, though
/// default-constructed objects may set `type` to -1. Such objects cannot be
/// serialized.
///
/// `ASN1_STRING` additionally has the following typedefs: `ASN1_BIT_STRING`,
/// `ASN1_BMPSTRING`, `ASN1_ENUMERATED`, `ASN1_GENERALIZEDTIME`,
/// `ASN1_GENERALSTRING`, `ASN1_IA5STRING`, `ASN1_INTEGER`, `ASN1_OCTET_STRING`,
/// `ASN1_PRINTABLESTRING`, `ASN1_T61STRING`, `ASN1_TIME`,
/// `ASN1_UNIVERSALSTRING`, `ASN1_UTCTIME`, `ASN1_UTF8STRING`, and
/// `ASN1_VISIBLESTRING`. Other than `ASN1_TIME`, these correspond to universal
/// ASN.1 types. `ASN1_TIME` represents a CHOICE of UTCTime and GeneralizedTime,
/// with a cutoff of 2049, as used in Section 4.1.2.5 of RFC 5280.
///
/// For clarity, callers are encouraged to use the appropriate typedef when
/// available. They are the same type as `ASN1_STRING`, so a caller may freely
/// pass them into functions expecting `ASN1_STRING`, such as
/// `ASN1_STRING_length`.
///
/// If a function returns an `ASN1_STRING` where the typedef or ASN.1 structure
/// implies constraints on `type`, callers may assume that `type` is correct.
/// However, if a function takes an `ASN1_STRING` as input, callers must ensure
/// `type` matches. These invariants are not captured by the C type system and
/// may not be checked at runtime. For example, callers may assume the output of
/// `X509_get0_serialNumber` has type `V_ASN1_INTEGER` or `V_ASN1_NEG_INTEGER`.
/// Callers must not pass a string of type `V_ASN1_OCTET_STRING` to
/// `X509_set_serialNumber`. Doing so may break invariants on the `X509` object
/// and break the `X509_get0_serialNumber` invariant.
///
/// TODO(https://crbug.com/boringssl/445): This is very unfriendly. Getting the
/// type field wrong should not cause memory errors, but it may do strange
/// things. We should add runtime checks to anything that consumes `ASN1_STRING`s
/// from the caller.
pub type ASN1_TIME = asn1_string_st;
/// An asn1_string_st (aka `ASN1_STRING`) represents a value of a string-like
/// ASN.1 type. It contains a `type` field, and a byte string `data` field with a
/// type-specific representation. This type-specific representation does not
/// always correspond to the DER encoding of the type.
///
/// If `type` is one of `V_ASN1_OCTET_STRING`, `V_ASN1_UTF8STRING`,
/// `V_ASN1_NUMERICSTRING`, `V_ASN1_PRINTABLESTRING`, `V_ASN1_T61STRING`,
/// `V_ASN1_VIDEOTEXSTRING`, `V_ASN1_IA5STRING`, `V_ASN1_GRAPHICSTRING`,
/// `V_ASN1_ISO64STRING`, `V_ASN1_VISIBLESTRING`, `V_ASN1_GENERALSTRING`,
/// `V_ASN1_UNIVERSALSTRING`, or `V_ASN1_BMPSTRING`, the object represents an
/// ASN.1 string type. The data contains the byte representation of the
/// string.
///
/// If `type` is `V_ASN1_BIT_STRING`, the object represents a BIT STRING value.
/// See bit string documentation below for the data and flags.
///
/// If `type` is one of `V_ASN1_INTEGER`, `V_ASN1_NEG_INTEGER`,
/// `V_ASN1_ENUMERATED`, or `V_ASN1_NEG_ENUMERATED`, the object represents an
/// INTEGER or ENUMERATED value. See integer documentation below for details.
///
/// If `type` is `V_ASN1_GENERALIZEDTIME` or `V_ASN1_UTCTIME`, the object
/// represents a GeneralizedTime or UTCTime value, respectively. The data
/// contains the DER encoding of the value. For example, the UNIX epoch would be
/// "19700101000000Z" for a GeneralizedTime and "700101000000Z" for a UTCTime.
///
/// If `type` is `V_ASN1_SEQUENCE`, `V_ASN1_SET`, or `V_ASN1_OTHER`, the object
/// represents a SEQUENCE, SET, or arbitrary ASN.1 value, respectively. Unlike
/// the above cases, the data contains the DER encoding of the entire structure,
/// including the header. If the value is explicitly or implicitly tagged, this
/// too will be reflected in the data field. As this case handles unknown types,
/// the contents are not checked when parsing or serializing.
///
/// Other values of `type` do not represent a valid ASN.1 value, though
/// default-constructed objects may set `type` to -1. Such objects cannot be
/// serialized.
///
/// `ASN1_STRING` additionally has the following typedefs: `ASN1_BIT_STRING`,
/// `ASN1_BMPSTRING`, `ASN1_ENUMERATED`, `ASN1_GENERALIZEDTIME`,
/// `ASN1_GENERALSTRING`, `ASN1_IA5STRING`, `ASN1_INTEGER`, `ASN1_OCTET_STRING`,
/// `ASN1_PRINTABLESTRING`, `ASN1_T61STRING`, `ASN1_TIME`,
/// `ASN1_UNIVERSALSTRING`, `ASN1_UTCTIME`, `ASN1_UTF8STRING`, and
/// `ASN1_VISIBLESTRING`. Other than `ASN1_TIME`, these correspond to universal
/// ASN.1 types. `ASN1_TIME` represents a CHOICE of UTCTime and GeneralizedTime,
/// with a cutoff of 2049, as used in Section 4.1.2.5 of RFC 5280.
///
/// For clarity, callers are encouraged to use the appropriate typedef when
/// available. They are the same type as `ASN1_STRING`, so a caller may freely
/// pass them into functions expecting `ASN1_STRING`, such as
/// `ASN1_STRING_length`.
///
/// If a function returns an `ASN1_STRING` where the typedef or ASN.1 structure
/// implies constraints on `type`, callers may assume that `type` is correct.
/// However, if a function takes an `ASN1_STRING` as input, callers must ensure
/// `type` matches. These invariants are not captured by the C type system and
/// may not be checked at runtime. For example, callers may assume the output of
/// `X509_get0_serialNumber` has type `V_ASN1_INTEGER` or `V_ASN1_NEG_INTEGER`.
/// Callers must not pass a string of type `V_ASN1_OCTET_STRING` to
/// `X509_set_serialNumber`. Doing so may break invariants on the `X509` object
/// and break the `X509_get0_serialNumber` invariant.
///
/// TODO(https://crbug.com/boringssl/445): This is very unfriendly. Getting the
/// type field wrong should not cause memory errors, but it may do strange
/// things. We should add runtime checks to anything that consumes `ASN1_STRING`s
/// from the caller.
pub type ASN1_UNIVERSALSTRING = asn1_string_st;
/// An asn1_string_st (aka `ASN1_STRING`) represents a value of a string-like
/// ASN.1 type. It contains a `type` field, and a byte string `data` field with a
/// type-specific representation. This type-specific representation does not
/// always correspond to the DER encoding of the type.
///
/// If `type` is one of `V_ASN1_OCTET_STRING`, `V_ASN1_UTF8STRING`,
/// `V_ASN1_NUMERICSTRING`, `V_ASN1_PRINTABLESTRING`, `V_ASN1_T61STRING`,
/// `V_ASN1_VIDEOTEXSTRING`, `V_ASN1_IA5STRING`, `V_ASN1_GRAPHICSTRING`,
/// `V_ASN1_ISO64STRING`, `V_ASN1_VISIBLESTRING`, `V_ASN1_GENERALSTRING`,
/// `V_ASN1_UNIVERSALSTRING`, or `V_ASN1_BMPSTRING`, the object represents an
/// ASN.1 string type. The data contains the byte representation of the
/// string.
///
/// If `type` is `V_ASN1_BIT_STRING`, the object represents a BIT STRING value.
/// See bit string documentation below for the data and flags.
///
/// If `type` is one of `V_ASN1_INTEGER`, `V_ASN1_NEG_INTEGER`,
/// `V_ASN1_ENUMERATED`, or `V_ASN1_NEG_ENUMERATED`, the object represents an
/// INTEGER or ENUMERATED value. See integer documentation below for details.
///
/// If `type` is `V_ASN1_GENERALIZEDTIME` or `V_ASN1_UTCTIME`, the object
/// represents a GeneralizedTime or UTCTime value, respectively. The data
/// contains the DER encoding of the value. For example, the UNIX epoch would be
/// "19700101000000Z" for a GeneralizedTime and "700101000000Z" for a UTCTime.
///
/// If `type` is `V_ASN1_SEQUENCE`, `V_ASN1_SET`, or `V_ASN1_OTHER`, the object
/// represents a SEQUENCE, SET, or arbitrary ASN.1 value, respectively. Unlike
/// the above cases, the data contains the DER encoding of the entire structure,
/// including the header. If the value is explicitly or implicitly tagged, this
/// too will be reflected in the data field. As this case handles unknown types,
/// the contents are not checked when parsing or serializing.
///
/// Other values of `type` do not represent a valid ASN.1 value, though
/// default-constructed objects may set `type` to -1. Such objects cannot be
/// serialized.
///
/// `ASN1_STRING` additionally has the following typedefs: `ASN1_BIT_STRING`,
/// `ASN1_BMPSTRING`, `ASN1_ENUMERATED`, `ASN1_GENERALIZEDTIME`,
/// `ASN1_GENERALSTRING`, `ASN1_IA5STRING`, `ASN1_INTEGER`, `ASN1_OCTET_STRING`,
/// `ASN1_PRINTABLESTRING`, `ASN1_T61STRING`, `ASN1_TIME`,
/// `ASN1_UNIVERSALSTRING`, `ASN1_UTCTIME`, `ASN1_UTF8STRING`, and
/// `ASN1_VISIBLESTRING`. Other than `ASN1_TIME`, these correspond to universal
/// ASN.1 types. `ASN1_TIME` represents a CHOICE of UTCTime and GeneralizedTime,
/// with a cutoff of 2049, as used in Section 4.1.2.5 of RFC 5280.
///
/// For clarity, callers are encouraged to use the appropriate typedef when
/// available. They are the same type as `ASN1_STRING`, so a caller may freely
/// pass them into functions expecting `ASN1_STRING`, such as
/// `ASN1_STRING_length`.
///
/// If a function returns an `ASN1_STRING` where the typedef or ASN.1 structure
/// implies constraints on `type`, callers may assume that `type` is correct.
/// However, if a function takes an `ASN1_STRING` as input, callers must ensure
/// `type` matches. These invariants are not captured by the C type system and
/// may not be checked at runtime. For example, callers may assume the output of
/// `X509_get0_serialNumber` has type `V_ASN1_INTEGER` or `V_ASN1_NEG_INTEGER`.
/// Callers must not pass a string of type `V_ASN1_OCTET_STRING` to
/// `X509_set_serialNumber`. Doing so may break invariants on the `X509` object
/// and break the `X509_get0_serialNumber` invariant.
///
/// TODO(https://crbug.com/boringssl/445): This is very unfriendly. Getting the
/// type field wrong should not cause memory errors, but it may do strange
/// things. We should add runtime checks to anything that consumes `ASN1_STRING`s
/// from the caller.
pub type ASN1_UTCTIME = asn1_string_st;
/// An asn1_string_st (aka `ASN1_STRING`) represents a value of a string-like
/// ASN.1 type. It contains a `type` field, and a byte string `data` field with a
/// type-specific representation. This type-specific representation does not
/// always correspond to the DER encoding of the type.
///
/// If `type` is one of `V_ASN1_OCTET_STRING`, `V_ASN1_UTF8STRING`,
/// `V_ASN1_NUMERICSTRING`, `V_ASN1_PRINTABLESTRING`, `V_ASN1_T61STRING`,
/// `V_ASN1_VIDEOTEXSTRING`, `V_ASN1_IA5STRING`, `V_ASN1_GRAPHICSTRING`,
/// `V_ASN1_ISO64STRING`, `V_ASN1_VISIBLESTRING`, `V_ASN1_GENERALSTRING`,
/// `V_ASN1_UNIVERSALSTRING`, or `V_ASN1_BMPSTRING`, the object represents an
/// ASN.1 string type. The data contains the byte representation of the
/// string.
///
/// If `type` is `V_ASN1_BIT_STRING`, the object represents a BIT STRING value.
/// See bit string documentation below for the data and flags.
///
/// If `type` is one of `V_ASN1_INTEGER`, `V_ASN1_NEG_INTEGER`,
/// `V_ASN1_ENUMERATED`, or `V_ASN1_NEG_ENUMERATED`, the object represents an
/// INTEGER or ENUMERATED value. See integer documentation below for details.
///
/// If `type` is `V_ASN1_GENERALIZEDTIME` or `V_ASN1_UTCTIME`, the object
/// represents a GeneralizedTime or UTCTime value, respectively. The data
/// contains the DER encoding of the value. For example, the UNIX epoch would be
/// "19700101000000Z" for a GeneralizedTime and "700101000000Z" for a UTCTime.
///
/// If `type` is `V_ASN1_SEQUENCE`, `V_ASN1_SET`, or `V_ASN1_OTHER`, the object
/// represents a SEQUENCE, SET, or arbitrary ASN.1 value, respectively. Unlike
/// the above cases, the data contains the DER encoding of the entire structure,
/// including the header. If the value is explicitly or implicitly tagged, this
/// too will be reflected in the data field. As this case handles unknown types,
/// the contents are not checked when parsing or serializing.
///
/// Other values of `type` do not represent a valid ASN.1 value, though
/// default-constructed objects may set `type` to -1. Such objects cannot be
/// serialized.
///
/// `ASN1_STRING` additionally has the following typedefs: `ASN1_BIT_STRING`,
/// `ASN1_BMPSTRING`, `ASN1_ENUMERATED`, `ASN1_GENERALIZEDTIME`,
/// `ASN1_GENERALSTRING`, `ASN1_IA5STRING`, `ASN1_INTEGER`, `ASN1_OCTET_STRING`,
/// `ASN1_PRINTABLESTRING`, `ASN1_T61STRING`, `ASN1_TIME`,
/// `ASN1_UNIVERSALSTRING`, `ASN1_UTCTIME`, `ASN1_UTF8STRING`, and
/// `ASN1_VISIBLESTRING`. Other than `ASN1_TIME`, these correspond to universal
/// ASN.1 types. `ASN1_TIME` represents a CHOICE of UTCTime and GeneralizedTime,
/// with a cutoff of 2049, as used in Section 4.1.2.5 of RFC 5280.
///
/// For clarity, callers are encouraged to use the appropriate typedef when
/// available. They are the same type as `ASN1_STRING`, so a caller may freely
/// pass them into functions expecting `ASN1_STRING`, such as
/// `ASN1_STRING_length`.
///
/// If a function returns an `ASN1_STRING` where the typedef or ASN.1 structure
/// implies constraints on `type`, callers may assume that `type` is correct.
/// However, if a function takes an `ASN1_STRING` as input, callers must ensure
/// `type` matches. These invariants are not captured by the C type system and
/// may not be checked at runtime. For example, callers may assume the output of
/// `X509_get0_serialNumber` has type `V_ASN1_INTEGER` or `V_ASN1_NEG_INTEGER`.
/// Callers must not pass a string of type `V_ASN1_OCTET_STRING` to
/// `X509_set_serialNumber`. Doing so may break invariants on the `X509` object
/// and break the `X509_get0_serialNumber` invariant.
///
/// TODO(https://crbug.com/boringssl/445): This is very unfriendly. Getting the
/// type field wrong should not cause memory errors, but it may do strange
/// things. We should add runtime checks to anything that consumes `ASN1_STRING`s
/// from the caller.
pub type ASN1_UTF8STRING = asn1_string_st;
/// An asn1_string_st (aka `ASN1_STRING`) represents a value of a string-like
/// ASN.1 type. It contains a `type` field, and a byte string `data` field with a
/// type-specific representation. This type-specific representation does not
/// always correspond to the DER encoding of the type.
///
/// If `type` is one of `V_ASN1_OCTET_STRING`, `V_ASN1_UTF8STRING`,
/// `V_ASN1_NUMERICSTRING`, `V_ASN1_PRINTABLESTRING`, `V_ASN1_T61STRING`,
/// `V_ASN1_VIDEOTEXSTRING`, `V_ASN1_IA5STRING`, `V_ASN1_GRAPHICSTRING`,
/// `V_ASN1_ISO64STRING`, `V_ASN1_VISIBLESTRING`, `V_ASN1_GENERALSTRING`,
/// `V_ASN1_UNIVERSALSTRING`, or `V_ASN1_BMPSTRING`, the object represents an
/// ASN.1 string type. The data contains the byte representation of the
/// string.
///
/// If `type` is `V_ASN1_BIT_STRING`, the object represents a BIT STRING value.
/// See bit string documentation below for the data and flags.
///
/// If `type` is one of `V_ASN1_INTEGER`, `V_ASN1_NEG_INTEGER`,
/// `V_ASN1_ENUMERATED`, or `V_ASN1_NEG_ENUMERATED`, the object represents an
/// INTEGER or ENUMERATED value. See integer documentation below for details.
///
/// If `type` is `V_ASN1_GENERALIZEDTIME` or `V_ASN1_UTCTIME`, the object
/// represents a GeneralizedTime or UTCTime value, respectively. The data
/// contains the DER encoding of the value. For example, the UNIX epoch would be
/// "19700101000000Z" for a GeneralizedTime and "700101000000Z" for a UTCTime.
///
/// If `type` is `V_ASN1_SEQUENCE`, `V_ASN1_SET`, or `V_ASN1_OTHER`, the object
/// represents a SEQUENCE, SET, or arbitrary ASN.1 value, respectively. Unlike
/// the above cases, the data contains the DER encoding of the entire structure,
/// including the header. If the value is explicitly or implicitly tagged, this
/// too will be reflected in the data field. As this case handles unknown types,
/// the contents are not checked when parsing or serializing.
///
/// Other values of `type` do not represent a valid ASN.1 value, though
/// default-constructed objects may set `type` to -1. Such objects cannot be
/// serialized.
///
/// `ASN1_STRING` additionally has the following typedefs: `ASN1_BIT_STRING`,
/// `ASN1_BMPSTRING`, `ASN1_ENUMERATED`, `ASN1_GENERALIZEDTIME`,
/// `ASN1_GENERALSTRING`, `ASN1_IA5STRING`, `ASN1_INTEGER`, `ASN1_OCTET_STRING`,
/// `ASN1_PRINTABLESTRING`, `ASN1_T61STRING`, `ASN1_TIME`,
/// `ASN1_UNIVERSALSTRING`, `ASN1_UTCTIME`, `ASN1_UTF8STRING`, and
/// `ASN1_VISIBLESTRING`. Other than `ASN1_TIME`, these correspond to universal
/// ASN.1 types. `ASN1_TIME` represents a CHOICE of UTCTime and GeneralizedTime,
/// with a cutoff of 2049, as used in Section 4.1.2.5 of RFC 5280.
///
/// For clarity, callers are encouraged to use the appropriate typedef when
/// available. They are the same type as `ASN1_STRING`, so a caller may freely
/// pass them into functions expecting `ASN1_STRING`, such as
/// `ASN1_STRING_length`.
///
/// If a function returns an `ASN1_STRING` where the typedef or ASN.1 structure
/// implies constraints on `type`, callers may assume that `type` is correct.
/// However, if a function takes an `ASN1_STRING` as input, callers must ensure
/// `type` matches. These invariants are not captured by the C type system and
/// may not be checked at runtime. For example, callers may assume the output of
/// `X509_get0_serialNumber` has type `V_ASN1_INTEGER` or `V_ASN1_NEG_INTEGER`.
/// Callers must not pass a string of type `V_ASN1_OCTET_STRING` to
/// `X509_set_serialNumber`. Doing so may break invariants on the `X509` object
/// and break the `X509_get0_serialNumber` invariant.
///
/// TODO(https://crbug.com/boringssl/445): This is very unfriendly. Getting the
/// type field wrong should not cause memory errors, but it may do strange
/// things. We should add runtime checks to anything that consumes `ASN1_STRING`s
/// from the caller.
pub type ASN1_VISIBLESTRING = asn1_string_st;
/// An asn1_type_st (aka `ASN1_TYPE`) represents an arbitrary ASN.1 element,
/// typically used for ANY types. It contains a `type` field and a `value` union
/// dependent on `type`.
///
/// WARNING: This struct has a complex representation. Callers must not construct
/// `ASN1_TYPE` values manually. Use `ASN1_TYPE_set` and `ASN1_TYPE_set1`
/// instead. Additionally, callers performing non-trivial operations on this type
/// are encouraged to use `CBS` and `CBB` from <openssl/bytestring.h>, and
/// convert to or from `ASN1_TYPE` with `d2i_ASN1_TYPE` or `i2d_ASN1_TYPE`.
///
/// The `type` field corresponds to the tag of the ASN.1 element being
/// represented:
///
/// If `type` is a `V_ASN1_*` constant for an ASN.1 string-like type, as defined
/// by `ASN1_STRING`, the tag matches the constant. `value` contains an
/// `ASN1_STRING` pointer (equivalently, one of the more specific typedefs). See
/// `ASN1_STRING` for details on the representation. Unlike `ASN1_STRING`,
/// `ASN1_TYPE` does not use the `V_ASN1_NEG` flag for negative INTEGER and
/// ENUMERATE values. For a negative value, the `ASN1_TYPE`'s `type` will be
/// `V_ASN1_INTEGER` or `V_ASN1_ENUMERATED`, but `value` will an `ASN1_STRING`
/// whose `type` is `V_ASN1_NEG_INTEGER` or `V_ASN1_NEG_ENUMERATED`.
///
/// If `type` is `V_ASN1_OBJECT`, the tag is OBJECT IDENTIFIER and `value`
/// contains an `ASN1_OBJECT` pointer.
///
/// If `type` is `V_ASN1_NULL`, the tag is NULL. `value` contains a NULL pointer.
///
/// If `type` is `V_ASN1_BOOLEAN`, the tag is BOOLEAN. `value` contains an
/// `ASN1_BOOLEAN`.
///
/// If `type` is `V_ASN1_SEQUENCE`, `V_ASN1_SET`, or `V_ASN1_OTHER`, the tag is
/// SEQUENCE, SET, or some arbitrary tag, respectively. `value` uses the
/// corresponding `ASN1_STRING` representation. Although any type may be
/// represented in `V_ASN1_OTHER`, the parser will always return the more
/// specific encoding when available.
///
/// Other values of `type` do not represent a valid ASN.1 value, though
/// default-constructed objects may set `type` to -1. Such objects cannot be
/// serialized.
pub type ASN1_TYPE = asn1_type_st;
/// A AUTHORITY_KEYID_st, aka `AUTHORITY_KEYID`, represents an
/// AuthorityKeyIdentifier structure (RFC 5280).
pub type AUTHORITY_KEYID = AUTHORITY_KEYID_st;
/// A BASIC_CONSTRAINTS_st, aka `BASIC_CONSTRAINTS` represents an
/// BasicConstraints structure (RFC 5280).
pub type BASIC_CONSTRAINTS = BASIC_CONSTRAINTS_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct CMS_ContentInfo_st {
    _unused: [u8; 0],
}
pub type CMS_ContentInfo = CMS_ContentInfo_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct CMS_SignerInfo_st {
    _unused: [u8; 0],
}
pub type CMS_SignerInfo = CMS_SignerInfo_st;
/// A DIST_POINT_st, aka `DIST_POINT`, represents a DistributionPoint structure
/// (RFC 5280).
pub type DIST_POINT = DIST_POINT_st;
/// DSA_SIG_st (aka `DSA_SIG`) contains a DSA signature as a pair of integers.
pub type DSA_SIG = DSA_SIG_st;
/// A GENERAL_NAME_st, aka `GENERAL_NAME`, represents an X.509 GeneralName. The
/// `type` field determines which member of `d` is active. A `GENERAL_NAME` may
/// also be empty, in which case `type` is -1 and `d` is NULL. Empty
/// `GENERAL_NAME`s are invalid and will never be returned from the parser, but
/// may be created temporarily, e.g. by `GENERAL_NAME_new`.
///
/// WARNING: `type` and `d` must be kept consistent. An inconsistency will result
/// in a potentially exploitable memory error.
pub type GENERAL_NAME = GENERAL_NAME_st;
/// A ISSUING_DIST_POINT_st, aka `ISSUING_DIST_POINT`, represents a
/// IssuingDistributionPoint structure (RFC 5280).
pub type ISSUING_DIST_POINT = ISSUING_DIST_POINT_st;
/// A NAME_CONSTRAINTS_st, aka `NAME_CONSTRAINTS`, represents a NameConstraints
/// structure (RFC 5280).
pub type NAME_CONSTRAINTS = NAME_CONSTRAINTS_st;
/// A Netscape_spkac_st, or `NETSCAPE_SPKAC`, represents a PublicKeyAndChallenge
/// structure. This type is misnamed. The full SPKAC includes the signature,
/// which is represented with the `NETSCAPE_SPKI` type.
pub type NETSCAPE_SPKAC = Netscape_spkac_st;
/// A Netscape_spki_st, or `NETSCAPE_SPKI`, represents a
/// SignedPublicKeyAndChallenge structure. Although this structure contains a
/// `spkac` field of type `NETSCAPE_SPKAC`, these are misnamed. The SPKAC is the
/// entire structure, not the signed portion.
pub type NETSCAPE_SPKI = Netscape_spki_st;
pub type RIPEMD160_CTX = RIPEMD160state_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct X509_VERIFY_PARAM_st {
    _unused: [u8; 0],
}
pub type X509_VERIFY_PARAM = X509_VERIFY_PARAM_st;
/// Private structures.
pub type X509_ALGOR = X509_algor_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct X509_crl_st {
    _unused: [u8; 0],
}
pub type X509_CRL = X509_crl_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct X509_extension_st {
    _unused: [u8; 0],
}
pub type X509_EXTENSION = X509_extension_st;
pub type X509_INFO = X509_info_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct X509_name_entry_st {
    _unused: [u8; 0],
}
pub type X509_NAME_ENTRY = X509_name_entry_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct X509_name_st {
    _unused: [u8; 0],
}
pub type X509_NAME = X509_name_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct X509_pubkey_st {
    _unused: [u8; 0],
}
pub type X509_PUBKEY = X509_pubkey_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct X509_req_st {
    _unused: [u8; 0],
}
pub type X509_REQ = X509_req_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct X509_sig_st {
    _unused: [u8; 0],
}
pub type X509_SIG = X509_sig_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct bignum_ctx {
    _unused: [u8; 0],
}
pub type BN_CTX = bignum_ctx;
/// Private functions
pub type BIGNUM = bignum_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct bio_method_st {
    _unused: [u8; 0],
}
pub type BIO_METHOD = bio_method_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct bio_st {
    _unused: [u8; 0],
}
pub type BIO = bio_st;
pub type BLAKE2B_CTX = blake2b_state_st;
/// bn_gencb_st, or `BN_GENCB`, holds a callback function that is used by
/// generation functions that can take a very long time to complete. Use
/// `BN_GENCB_set` to initialise a `BN_GENCB` structure.
///
/// The callback receives the address of that `BN_GENCB` structure as its last
/// argument and the user is free to put an arbitrary pointer in `arg`. The other
/// arguments are set as follows:
/// - event=BN_GENCB_GENERATED, n=i:   after generating the i'th possible prime
///                                    number.
/// - event=BN_GENCB_PRIME_TEST, n=-1: when finished trial division primality
///                                    checks.
/// - event=BN_GENCB_PRIME_TEST, n=i:  when the i'th primality test has finished.
///
/// The callback can return zero to abort the generation progress or one to
/// allow it to continue.
///
/// When other code needs to call a BN generation function it will often take a
/// BN_GENCB argument and may call the function with other argument values.
pub type BN_GENCB = bn_gencb_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct bn_mont_ctx_st {
    _unused: [u8; 0],
}
pub type BN_MONT_CTX = bn_mont_ctx_st;
/// buf_mem_st (aka `BUF_MEM`) is a generic buffer object used by OpenSSL.
pub type BUF_MEM = buf_mem_st;
pub type CBB = cbb_st;
/// CRYPTO ByteString
pub type CBS = cbs_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct cmac_ctx_st {
    _unused: [u8; 0],
}
pub type CMAC_CTX = cmac_ctx_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct conf_st {
    _unused: [u8; 0],
}
pub type CONF = conf_st;
/// Config files.
///
/// This library handles OpenSSL's config files, which look like:
///
///   # Comment
///
///   # This key is in the default section.
///   key=value
///
///   [section_name]
///   key2=value2
///
/// Config files are represented by a `CONF`. Use of this module is strongly
/// discouraged. It is a remnant of the OpenSSL command-line tool. Parsing an
/// untrusted input as a config file risks string injection and denial of service
/// vulnerabilities.
pub type CONF_VALUE = conf_value_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct crypto_buffer_pool_st {
    _unused: [u8; 0],
}
pub type CRYPTO_BUFFER_POOL = crypto_buffer_pool_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct crypto_buffer_st {
    _unused: [u8; 0],
}
pub type CRYPTO_BUFFER = crypto_buffer_st;
/// crypto_ivec_st (aka `CRYPTO_IVEC`) combines a pointer to input data with its
/// length. It is usually passed as an array of length of at most
/// `CRYPTO_IOVEC_MAX`.
pub type CRYPTO_IVEC = crypto_ivec_st;
/// crypto_iovec_st (aka `CRYPTO_IOVEC` combines a pointer to input data and a
/// pointer to an output buffer with their common length. It is usually passed
/// as an array of length of at most `CRYPTO_IOVEC_MAX`.
pub type CRYPTO_IOVEC = crypto_iovec_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct ctr_drbg_state_st {
    _unused: [u8; 0],
}
pub type CTR_DRBG_STATE = ctr_drbg_state_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct dh_st {
    _unused: [u8; 0],
}
pub type DH = dh_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct dsa_st {
    _unused: [u8; 0],
}
pub type DSA = dsa_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct ec_group_st {
    _unused: [u8; 0],
}
pub type EC_GROUP = ec_group_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct ec_key_st {
    _unused: [u8; 0],
}
pub type EC_KEY = ec_key_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct ec_point_st {
    _unused: [u8; 0],
}
pub type EC_POINT = ec_point_st;
/// ecdsa_method_st is a structure of function pointers for implementing ECDSA.
/// See engine.h.
pub type ECDSA_METHOD = ecdsa_method_st;
/// Low-level signing and verification.
///
/// Low-level functions handle signatures as `ECDSA_SIG` structures which allow
/// the two values in an ECDSA signature to be handled separately.
pub type ECDSA_SIG = ecdsa_sig_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct engine_st {
    _unused: [u8; 0],
}
pub type ENGINE = engine_st;
/// env_md_ctx_st is typoed ("evp" -> "env"), but the typo comes from OpenSSL
/// and some consumers forward-declare these structures so we're leaving it
/// alone.
pub type EVP_MD_CTX = env_md_ctx_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct env_md_st {
    _unused: [u8; 0],
}
pub type EVP_MD = env_md_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct evp_aead_st {
    _unused: [u8; 0],
}
pub type EVP_AEAD = evp_aead_st;
/// An evp_aead_ctx_st (typedefed as `EVP_AEAD_CTX` in base.h) represents an AEAD
/// algorithm configured with a specific key and message-independent IV.
pub type EVP_AEAD_CTX = evp_aead_ctx_st;
pub type EVP_CIPHER_CTX = evp_cipher_ctx_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct evp_cipher_st {
    _unused: [u8; 0],
}
pub type EVP_CIPHER = evp_cipher_st;
pub type EVP_ENCODE_CTX = evp_encode_ctx_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct evp_hpke_aead_st {
    _unused: [u8; 0],
}
pub type EVP_HPKE_AEAD = evp_hpke_aead_st;
/// Private structures.
///
/// The following structures are exported so their types are stack-allocatable,
/// but accessing or modifying their fields is forbidden.
pub type EVP_HPKE_CTX = evp_hpke_ctx_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct evp_hpke_kdf_st {
    _unused: [u8; 0],
}
pub type EVP_HPKE_KDF = evp_hpke_kdf_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct evp_hpke_kem_st {
    _unused: [u8; 0],
}
pub type EVP_HPKE_KEM = evp_hpke_kem_st;
pub type EVP_HPKE_KEY = evp_hpke_key_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct evp_kem_st {
    _unused: [u8; 0],
}
pub type EVP_KEM = evp_kem_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct evp_pkey_alg_st {
    _unused: [u8; 0],
}
pub type EVP_PKEY_ALG = evp_pkey_alg_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct evp_pkey_ctx_st {
    _unused: [u8; 0],
}
pub type EVP_PKEY_CTX = evp_pkey_ctx_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct evp_pkey_st {
    _unused: [u8; 0],
}
pub type EVP_PKEY = evp_pkey_st;
/// Private functions
pub type HMAC_CTX = hmac_ctx_st;
pub type MD4_CTX = md4_state_st;
pub type MD5_CTX = md5_state_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct ossl_init_settings_st {
    _unused: [u8; 0],
}
pub type OPENSSL_INIT_SETTINGS = ossl_init_settings_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct ossl_lib_ctx_st {
    _unused: [u8; 0],
}
pub type OSSL_LIB_CTX = ossl_lib_ctx_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct ossl_param_st {
    _unused: [u8; 0],
}
pub type OSSL_PARAM = ossl_param_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct pkcs12_st {
    _unused: [u8; 0],
}
pub type PKCS12 = pkcs12_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct pkcs8_priv_key_info_st {
    _unused: [u8; 0],
}
pub type PKCS8_PRIV_KEY_INFO = pkcs8_priv_key_info_st;
/// X.509 information.
///
/// `X509_INFO` is the return type for `PEM_X509_INFO_read_bio`, defined in
/// <openssl/pem.h>. It is used to store a certificate, CRL, or private key. This
/// type is defined in this header for OpenSSL compatibility.
pub type X509_PKEY = private_key_st;
/// rand_meth_st is typedefed to `RAND_METHOD` in base.h. It isn't used; it
/// exists only to be the return type of `RAND_SSLeay`. It's
/// external so that variables of this type can be initialized.
pub type RAND_METHOD = rand_meth_st;
/// RC4.
pub type RC4_KEY = rc4_key_st;
pub type RSA_METHOD = rsa_meth_st;
/// An rsa_pss_params_st, aka `RSA_PSS_PARAMS`, represents a parsed
/// RSASSA-PSS-params structure, as defined in (RFC 4055).
pub type RSA_PSS_PARAMS = rsa_pss_params_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct rsa_st {
    _unused: [u8; 0],
}
pub type RSA = rsa_st;
pub type SHA256_CTX = sha256_state_st;
pub type SHA512_CTX = sha512_state_st;
pub type SHA_CTX = sha_state_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct spake2_ctx_st {
    _unused: [u8; 0],
}
pub type SPAKE2_CTX = spake2_ctx_st;
/// srtp_protection_profile_st (aka `SRTP_PROTECTION_PROFILE`) is an SRTP
/// profile for use with the use_srtp extension.
pub type SRTP_PROTECTION_PROFILE = srtp_protection_profile_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct ssl_cipher_st {
    _unused: [u8; 0],
}
pub type SSL_CIPHER = ssl_cipher_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct ssl_credential_st {
    _unused: [u8; 0],
}
pub type SSL_CREDENTIAL = ssl_credential_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct ssl_ctx_st {
    _unused: [u8; 0],
}
pub type SSL_CTX = ssl_ctx_st;
/// ssl_early_callback_ctx (aka `SSL_CLIENT_HELLO`) is passed to certain
/// callbacks that are called very early on during the server handshake. At this
/// point, much of the SSL* hasn't been filled out and only the ClientHello can
/// be depended on.
pub type SSL_CLIENT_HELLO = ssl_early_callback_ctx;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct ssl_ech_keys_st {
    _unused: [u8; 0],
}
pub type SSL_ECH_KEYS = ssl_ech_keys_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct ssl_method_st {
    _unused: [u8; 0],
}
pub type SSL_METHOD = ssl_method_st;
/// ssl_private_key_method_st (aka `SSL_PRIVATE_KEY_METHOD`) describes private
/// key hooks. This is used to off-load signing operations to a custom,
/// potentially asynchronous, backend. Metadata about the key such as the type
/// and size are parsed out of the certificate.
pub type SSL_PRIVATE_KEY_METHOD = ssl_private_key_method_st;
/// ssl_quic_method_st (aka `SSL_QUIC_METHOD`) describes custom QUIC hooks.
pub type SSL_QUIC_METHOD = ssl_quic_method_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct ssl_session_st {
    _unused: [u8; 0],
}
pub type SSL_SESSION = ssl_session_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct ssl_st {
    _unused: [u8; 0],
}
pub type SSL = ssl_st;
/// ssl_ticket_aead_method_st (aka `SSL_TICKET_AEAD_METHOD`) contains methods
/// for encrypting and decrypting session tickets.
pub type SSL_TICKET_AEAD_METHOD = ssl_ticket_aead_method_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct st_ERR_FNS {
    _unused: [u8; 0],
}
pub type ERR_FNS = st_ERR_FNS;
/// trust_token_st represents a single-use token for the Trust Token protocol.
/// For the client, this is the token and its corresponding signature. For the
/// issuer, this is the token itself.
pub type TRUST_TOKEN = trust_token_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct trust_token_client_st {
    _unused: [u8; 0],
}
pub type TRUST_TOKEN_CLIENT = trust_token_client_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct trust_token_issuer_st {
    _unused: [u8; 0],
}
pub type TRUST_TOKEN_ISSUER = trust_token_issuer_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct trust_token_method_st {
    _unused: [u8; 0],
}
pub type TRUST_TOKEN_METHOD = trust_token_method_st;
/// v3_ext_ctx, aka `X509V3_CTX`, contains additional context information for
/// constructing extensions. Some string formats reference additional values in
/// these objects. It must be initialized with `X509V3_set_ctx` or
/// `X509V3_set_ctx_test` before use.
pub type X509V3_CTX = v3_ext_ctx;
/// A v3_ext_method, aka `X509V3_EXT_METHOD`, is a deprecated type which defines
/// a custom extension.
pub type X509V3_EXT_METHOD = v3_ext_method;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct x509_attributes_st {
    _unused: [u8; 0],
}
pub type X509_ATTRIBUTE = x509_attributes_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct x509_lookup_st {
    _unused: [u8; 0],
}
pub type X509_LOOKUP = x509_lookup_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct x509_lookup_method_st {
    _unused: [u8; 0],
}
pub type X509_LOOKUP_METHOD = x509_lookup_method_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct x509_object_st {
    _unused: [u8; 0],
}
pub type X509_OBJECT = x509_object_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct x509_purpose_st {
    _unused: [u8; 0],
}
pub type X509_PURPOSE = x509_purpose_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct x509_revoked_st {
    _unused: [u8; 0],
}
pub type X509_REVOKED = x509_revoked_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct x509_st {
    _unused: [u8; 0],
}
pub type X509 = x509_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct x509_store_ctx_st {
    _unused: [u8; 0],
}
pub type X509_STORE_CTX = x509_store_ctx_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct x509_store_st {
    _unused: [u8; 0],
}
pub type X509_STORE = x509_store_st;
pub type OPENSSL_BLOCK = *mut ::core::ffi::c_void;
/// aes_key_st should be an opaque type, but EVP requires that the size be
/// known.
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct aes_key_st {
    pub rd_key: [u32; 60usize],
    pub rounds: ::core::ffi::c_uint,
}
/// aes_key_st should be an opaque type, but EVP requires that the size be
/// known.
pub type AES_KEY = aes_key_st;
unsafe extern "C" {
    /// AES_set_encrypt_key configures `aeskey` to encrypt with the `bits`-bit key,
    /// `key`. `key` must point to `bits`/8 bytes. It returns zero on success and a
    /// negative number if `bits` is an invalid AES key size.
    ///
    /// WARNING: this function breaks the usual return value convention.
    pub fn AES_set_encrypt_key(
        key: *const u8,
        bits: ::core::ffi::c_uint,
        aeskey: *mut AES_KEY,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// AES_set_decrypt_key configures `aeskey` to decrypt with the `bits`-bit key,
    /// `key`. `key` must point to `bits`/8 bytes. It returns zero on success and a
    /// negative number if `bits` is an invalid AES key size.
    ///
    /// WARNING: this function breaks the usual return value convention.
    pub fn AES_set_decrypt_key(
        key: *const u8,
        bits: ::core::ffi::c_uint,
        aeskey: *mut AES_KEY,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// AES_encrypt encrypts a single block from `in` to `out` with `key`. The `in`
    /// and `out` pointers may overlap.
    pub fn AES_encrypt(in_: *const u8, out: *mut u8, key: *const AES_KEY);
}
unsafe extern "C" {
    /// AES_decrypt decrypts a single block from `in` to `out` with `key`. The `in`
    /// and `out` pointers may overlap.
    pub fn AES_decrypt(in_: *const u8, out: *mut u8, key: *const AES_KEY);
}
unsafe extern "C" {
    /// AES_ctr128_encrypt encrypts (or decrypts, it's the same in CTR mode) `len`
    /// bytes from `in` to `out`. The `num` parameter must be set to zero on the
    /// first call and `ivec` will be incremented. This function may be called
    /// in-place with `in` equal to `out`, but otherwise the buffers may not
    /// partially overlap. A partial overlap may overwrite input data before it is
    /// read.
    pub fn AES_ctr128_encrypt(
        in_: *const u8,
        out: *mut u8,
        len: usize,
        key: *const AES_KEY,
        ivec: *mut u8,
        ecount_buf: *mut u8,
        num: *mut ::core::ffi::c_uint,
    );
}
unsafe extern "C" {
    /// AES_ecb_encrypt encrypts (or decrypts, if `enc` == `AES_DECRYPT`) a single,
    /// 16 byte block from `in` to `out`. This function may be called in-place with
    /// `in` equal to `out`, but otherwise the buffers may not partially overlap. A
    /// partial overlap may overwrite input data before it is read.
    pub fn AES_ecb_encrypt(
        in_: *const u8,
        out: *mut u8,
        key: *const AES_KEY,
        enc: ::core::ffi::c_int,
    );
}
unsafe extern "C" {
    /// AES_cbc_encrypt encrypts (or decrypts, if `enc` == `AES_DECRYPT`) `len`
    /// bytes from `in` to `out`. The length must be a multiple of the block size.
    /// This function may be called in-place with `in` equal to `out`, but otherwise
    /// the buffers may not partially overlap. A partial overlap may overwrite input
    /// data before it is read.
    pub fn AES_cbc_encrypt(
        in_: *const u8,
        out: *mut u8,
        len: usize,
        key: *const AES_KEY,
        ivec: *mut u8,
        enc: ::core::ffi::c_int,
    );
}
unsafe extern "C" {
    /// AES_ofb128_encrypt encrypts (or decrypts, it's the same in OFB mode) `len`
    /// bytes from `in` to `out`. The `num` parameter must be set to zero on the
    /// first call. This function may be called in-place with `in` equal to `out`,
    /// but otherwise the buffers may not partially overlap. A partial overlap may
    /// overwrite input data before it is read.
    pub fn AES_ofb128_encrypt(
        in_: *const u8,
        out: *mut u8,
        len: usize,
        key: *const AES_KEY,
        ivec: *mut u8,
        num: *mut ::core::ffi::c_int,
    );
}
unsafe extern "C" {
    /// AES_cfb128_encrypt encrypts (or decrypts, if `enc` == `AES_DECRYPT`) `len`
    /// bytes from `in` to `out`. The `num` parameter must be set to zero on the
    /// first call. This function may be called in-place with `in` equal to `out`,
    /// but otherwise the buffers may not partially overlap. A partial overlap may
    /// overwrite input data before it is read.
    pub fn AES_cfb128_encrypt(
        in_: *const u8,
        out: *mut u8,
        len: usize,
        key: *const AES_KEY,
        ivec: *mut u8,
        num: *mut ::core::ffi::c_int,
        enc: ::core::ffi::c_int,
    );
}
unsafe extern "C" {
    /// AES_wrap_key performs AES key wrap on `in` which must be a multiple of 8
    /// bytes. `iv` must point to an 8 byte value or be NULL to use the default IV.
    /// `key` must have been configured for encryption. On success, it writes
    /// `in_len` + 8 bytes to `out` and returns `in_len` + 8. Otherwise, it returns
    /// -1.
    pub fn AES_wrap_key(
        key: *const AES_KEY,
        iv: *const u8,
        out: *mut u8,
        in_: *const u8,
        in_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// AES_unwrap_key performs AES key unwrap on `in` which must be a multiple of 8
    /// bytes. `iv` must point to an 8 byte value or be NULL to use the default IV.
    /// `key` must have been configured for decryption. On success, it writes
    /// `in_len` - 8 bytes to `out` and returns `in_len` - 8. Otherwise, it returns
    /// -1.
    pub fn AES_unwrap_key(
        key: *const AES_KEY,
        iv: *const u8,
        out: *mut u8,
        in_: *const u8,
        in_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// AES_wrap_key_padded performs a padded AES key wrap on `in` which must be
    /// between 1 and 2^32-1 bytes. `key` must have been configured for encryption.
    /// On success it writes at most `max_out` bytes of ciphertext to `out`, sets
    /// `*out_len` to the number of bytes written, and returns one. On failure it
    /// returns zero. To ensure success, set `max_out` to at least `in_len` + 15.
    pub fn AES_wrap_key_padded(
        key: *const AES_KEY,
        out: *mut u8,
        out_len: *mut usize,
        max_out: usize,
        in_: *const u8,
        in_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// AES_unwrap_key_padded performs a padded AES key unwrap on `in` which must be
    /// a multiple of 8 bytes. `key` must have been configured for decryption. On
    /// success it writes at most `max_out` bytes to `out`, sets `*out_len` to the
    /// number of bytes written, and returns one. On failure it returns zero. Setting
    /// `max_out` to `in_len` is a sensible estimate.
    pub fn AES_unwrap_key_padded(
        key: *const AES_KEY,
        out: *mut u8,
        out_len: *mut usize,
        max_out: usize,
        in_: *const u8,
        in_len: usize,
    ) -> ::core::ffi::c_int;
}
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct tm {
    pub tm_sec: ::core::ffi::c_int,
    pub tm_min: ::core::ffi::c_int,
    pub tm_hour: ::core::ffi::c_int,
    pub tm_mday: ::core::ffi::c_int,
    pub tm_mon: ::core::ffi::c_int,
    pub tm_year: ::core::ffi::c_int,
    pub tm_wday: ::core::ffi::c_int,
    pub tm_yday: ::core::ffi::c_int,
    pub tm_isdst: ::core::ffi::c_int,
    pub tm_gmtoff: ::core::ffi::c_long,
    pub tm_zone: *const ::core::ffi::c_char,
}
pub type __gnuc_va_list = __builtin_va_list;
pub type FILE = _IO_FILE;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct _IO_marker {
    _unused: [u8; 0],
}
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct _IO_codecvt {
    _unused: [u8; 0],
}
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct _IO_wide_data {
    _unused: [u8; 0],
}
pub type _IO_lock_t = ::core::ffi::c_void;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct _IO_FILE {
    pub _flags: ::core::ffi::c_int,
    pub _IO_read_ptr: *mut ::core::ffi::c_char,
    pub _IO_read_end: *mut ::core::ffi::c_char,
    pub _IO_read_base: *mut ::core::ffi::c_char,
    pub _IO_write_base: *mut ::core::ffi::c_char,
    pub _IO_write_ptr: *mut ::core::ffi::c_char,
    pub _IO_write_end: *mut ::core::ffi::c_char,
    pub _IO_buf_base: *mut ::core::ffi::c_char,
    pub _IO_buf_end: *mut ::core::ffi::c_char,
    pub _IO_save_base: *mut ::core::ffi::c_char,
    pub _IO_backup_base: *mut ::core::ffi::c_char,
    pub _IO_save_end: *mut ::core::ffi::c_char,
    pub _markers: *mut _IO_marker,
    pub _chain: *mut _IO_FILE,
    pub _fileno: ::core::ffi::c_int,
    pub _bitfield_align_1: [u32; 0],
    pub _bitfield_1: __BindgenBitfieldUnit<[u8; 3usize]>,
    pub _short_backupbuf: [::core::ffi::c_char; 1usize],
    pub _old_offset: __off_t,
    pub _cur_column: ::core::ffi::c_ushort,
    pub _vtable_offset: ::core::ffi::c_schar,
    pub _shortbuf: [::core::ffi::c_char; 1usize],
    pub _lock: *mut _IO_lock_t,
    pub _offset: __off64_t,
    pub _codecvt: *mut _IO_codecvt,
    pub _wide_data: *mut _IO_wide_data,
    pub _freeres_list: *mut _IO_FILE,
    pub _freeres_buf: *mut ::core::ffi::c_void,
    pub _prevchain: *mut *mut _IO_FILE,
    pub _mode: ::core::ffi::c_int,
    pub _unused3: ::core::ffi::c_int,
    pub _total_written: __uint64_t,
    pub _unused2: [::core::ffi::c_char; 8usize],
}
impl _IO_FILE {
    #[inline]
    pub fn _flags2(&self) -> ::core::ffi::c_int {
        unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 24u8) as u32) }
    }
    #[inline]
    pub fn set__flags2(&mut self, val: ::core::ffi::c_int) {
        unsafe {
            let val: u32 = ::core::mem::transmute(val);
            self._bitfield_1.set(0usize, 24u8, val as u64)
        }
    }
    #[inline]
    pub unsafe fn _flags2_raw(this: *const Self) -> ::core::ffi::c_int {
        unsafe {
            ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 3usize]>>::raw_get(
                ::core::ptr::addr_of!((*this)._bitfield_1),
                0usize,
                24u8,
            ) as u32)
        }
    }
    #[inline]
    pub unsafe fn set__flags2_raw(this: *mut Self, val: ::core::ffi::c_int) {
        unsafe {
            let val: u32 = ::core::mem::transmute(val);
            <__BindgenBitfieldUnit<[u8; 3usize]>>::raw_set(
                ::core::ptr::addr_of_mut!((*this)._bitfield_1),
                0usize,
                24u8,
                val as u64,
            )
        }
    }
    #[inline]
    pub fn new_bitfield_1(_flags2: ::core::ffi::c_int) -> __BindgenBitfieldUnit<[u8; 3usize]> {
        let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 3usize]> = Default::default();
        __bindgen_bitfield_unit.set(0usize, 24u8, {
            let _flags2: u32 = unsafe { ::core::mem::transmute(_flags2) };
            _flags2 as u64
        });
        __bindgen_bitfield_unit
    }
}
pub type va_list = __gnuc_va_list;
/// buf_mem_st (aka `BUF_MEM`) is a generic buffer object used by OpenSSL.
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct buf_mem_st {
    /// current number of bytes
    pub length: usize,
    pub data: *mut ::core::ffi::c_char,
    /// size of buffer
    pub max: usize,
}
unsafe extern "C" {
    /// BUF_MEM_new creates a new BUF_MEM which has no allocated data buffer.
    pub fn BUF_MEM_new() -> *mut BUF_MEM;
}
unsafe extern "C" {
    /// BUF_MEM_free frees `buf->data` if needed and then frees `buf` itself.
    pub fn BUF_MEM_free(buf: *mut BUF_MEM);
}
unsafe extern "C" {
    /// BUF_MEM_reserve ensures `buf` has capacity `cap` and allocates memory if
    /// needed. It returns one on success and zero on error.
    pub fn BUF_MEM_reserve(buf: *mut BUF_MEM, cap: usize) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BUF_MEM_grow ensures that `buf` has length `len` and allocates memory if
    /// needed. If the length of `buf` increased, the new bytes are filled with
    /// zeros. It returns the length of `buf`, or zero if there's an error.
    pub fn BUF_MEM_grow(buf: *mut BUF_MEM, len: usize) -> usize;
}
unsafe extern "C" {
    /// BUF_MEM_grow_clean calls `BUF_MEM_grow`. BoringSSL always zeros memory
    /// allocated memory on free.
    pub fn BUF_MEM_grow_clean(buf: *mut BUF_MEM, len: usize) -> usize;
}
unsafe extern "C" {
    /// BUF_MEM_append appends `in` to `buf`. It returns one on success and zero on
    /// error.
    pub fn BUF_MEM_append(
        buf: *mut BUF_MEM,
        in_: *const ::core::ffi::c_void,
        len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BUF_strdup calls `OPENSSL_strdup`.
    pub fn BUF_strdup(str_: *const ::core::ffi::c_char) -> *mut ::core::ffi::c_char;
}
unsafe extern "C" {
    /// BUF_strnlen calls `OPENSSL_strnlen`.
    pub fn BUF_strnlen(str_: *const ::core::ffi::c_char, max_len: usize) -> usize;
}
unsafe extern "C" {
    /// BUF_strndup calls `OPENSSL_strndup`.
    pub fn BUF_strndup(str_: *const ::core::ffi::c_char, size: usize) -> *mut ::core::ffi::c_char;
}
unsafe extern "C" {
    /// BUF_memdup calls `OPENSSL_memdup`.
    pub fn BUF_memdup(data: *const ::core::ffi::c_void, size: usize) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    /// BUF_strlcpy calls `OPENSSL_strlcpy`.
    pub fn BUF_strlcpy(
        dst: *mut ::core::ffi::c_char,
        src: *const ::core::ffi::c_char,
        dst_size: usize,
    ) -> usize;
}
unsafe extern "C" {
    /// BUF_strlcat calls `OPENSSL_strlcat`.
    pub fn BUF_strlcat(
        dst: *mut ::core::ffi::c_char,
        src: *const ::core::ffi::c_char,
        dst_size: usize,
    ) -> usize;
}
unsafe extern "C" {
    /// ERR_GET_LIB returns the library code for the error. This is one of
    /// the `ERR_LIB_*` values.
    #[link_name = "ERR_GET_LIB__extern"]
    pub fn ERR_GET_LIB(packed_error: u32) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ERR_GET_REASON returns the reason code for the error. This is one of
    /// library-specific `LIB_R_*` values where `LIB` is the library (see
    /// `ERR_GET_LIB`). Note that reason codes are specific to the library.
    #[link_name = "ERR_GET_REASON__extern"]
    pub fn ERR_GET_REASON(packed_error: u32) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ERR_equals returns one if `packed_error`'s library and reason code are `lib`
    /// and `reason`, respectively, and zero otherwise.
    #[link_name = "ERR_equals__extern"]
    pub fn ERR_equals(
        packed_error: u32,
        lib: ::core::ffi::c_int,
        reason: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ERR_get_error gets the packed error code for the least recent error and
    /// removes that error from the queue. If there are no errors in the queue then
    /// it returns zero.
    pub fn ERR_get_error() -> u32;
}
unsafe extern "C" {
    /// ERR_get_error_line acts like `ERR_get_error`, except that the file and line
    /// number of the call that added the error are also returned.
    pub fn ERR_get_error_line(
        file: *mut *const ::core::ffi::c_char,
        line: *mut ::core::ffi::c_int,
    ) -> u32;
}
unsafe extern "C" {
    /// ERR_get_error_line_data acts like `ERR_get_error_line`, but also returns the
    /// error-specific data pointer and flags. The flags are a bitwise-OR of
    /// `ERR_FLAG_*` values. The error-specific data is owned by the error queue
    /// and the pointer becomes invalid after the next call that affects the same
    /// thread's error queue. If `*flags` contains `ERR_FLAG_STRING` then `*data` is
    /// human-readable.
    pub fn ERR_get_error_line_data(
        file: *mut *const ::core::ffi::c_char,
        line: *mut ::core::ffi::c_int,
        data: *mut *const ::core::ffi::c_char,
        flags: *mut ::core::ffi::c_int,
    ) -> u32;
}
unsafe extern "C" {
    /// The "peek" functions act like the `ERR_get_error` functions, above, but they
    /// do not remove the error from the queue.
    pub fn ERR_peek_error() -> u32;
}
unsafe extern "C" {
    pub fn ERR_peek_error_line(
        file: *mut *const ::core::ffi::c_char,
        line: *mut ::core::ffi::c_int,
    ) -> u32;
}
unsafe extern "C" {
    pub fn ERR_peek_error_line_data(
        file: *mut *const ::core::ffi::c_char,
        line: *mut ::core::ffi::c_int,
        data: *mut *const ::core::ffi::c_char,
        flags: *mut ::core::ffi::c_int,
    ) -> u32;
}
unsafe extern "C" {
    /// The "peek last" functions act like the "peek" functions, above, except that
    /// they return the most recent error.
    pub fn ERR_peek_last_error() -> u32;
}
unsafe extern "C" {
    pub fn ERR_peek_last_error_line(
        file: *mut *const ::core::ffi::c_char,
        line: *mut ::core::ffi::c_int,
    ) -> u32;
}
unsafe extern "C" {
    pub fn ERR_peek_last_error_line_data(
        file: *mut *const ::core::ffi::c_char,
        line: *mut ::core::ffi::c_int,
        data: *mut *const ::core::ffi::c_char,
        flags: *mut ::core::ffi::c_int,
    ) -> u32;
}
unsafe extern "C" {
    /// ERR_error_string_n generates a human-readable string representing
    /// `packed_error`, places it at `buf`, and returns `buf`. It writes at most
    /// `len` bytes (including the terminating NUL) and truncates the string if
    /// necessary. If `len` is greater than zero then `buf` is always NUL terminated.
    ///
    /// The string will have the following format:
    ///
    ///   error:[error code]:[library name]:OPENSSL_internal:[reason string]
    ///
    /// error code is an 8 digit hexadecimal number; library name and reason string
    /// are ASCII text.
    pub fn ERR_error_string_n(
        packed_error: u32,
        buf: *mut ::core::ffi::c_char,
        len: usize,
    ) -> *mut ::core::ffi::c_char;
}
unsafe extern "C" {
    /// ERR_lib_error_string returns a string representation of the library that
    /// generated `packed_error`, or a placeholder string is the library is
    /// unrecognized.
    pub fn ERR_lib_error_string(packed_error: u32) -> *const ::core::ffi::c_char;
}
unsafe extern "C" {
    /// ERR_reason_error_string returns a string representation of the reason for
    /// `packed_error`, or a placeholder string if the reason is unrecognized.
    pub fn ERR_reason_error_string(packed_error: u32) -> *const ::core::ffi::c_char;
}
unsafe extern "C" {
    /// ERR_lib_symbol_name returns the symbol name of library that generated
    /// `packed_error`, or NULL if unrecognized. For example, an error from
    /// `ERR_LIB_EVP` would return "EVP".
    pub fn ERR_lib_symbol_name(packed_error: u32) -> *const ::core::ffi::c_char;
}
unsafe extern "C" {
    /// ERR_reason_symbol_name returns the symbol name of the reason for
    /// `packed_error`, or NULL if unrecognized. For example, `ERR_R_INTERNAL_ERROR`
    /// would return "INTERNAL_ERROR".
    ///
    /// Errors from the `ERR_LIB_SYS` library are typically `errno` values and will
    /// return NULL. User-defined errors will also return NULL.
    pub fn ERR_reason_symbol_name(packed_error: u32) -> *const ::core::ffi::c_char;
}
/// ERR_print_errors_callback_t is the type of a function used by
/// `ERR_print_errors_cb`. It takes a pointer to a human readable string (and
/// its length) that describes an entry in the error queue. The `ctx` argument
/// is an opaque pointer given to `ERR_print_errors_cb`.
///
/// It should return one on success or zero on error, which will stop the
/// iteration over the error queue.
pub type ERR_print_errors_callback_t = ::core::option::Option<
    unsafe extern "C" fn(
        str_: *const ::core::ffi::c_char,
        len: usize,
        ctx: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int,
>;
unsafe extern "C" {
    /// ERR_print_errors_cb clears the current thread's error queue, calling
    /// `callback` with a string representation of each error, from the least recent
    /// to the most recent error.
    ///
    /// The string will have the following format (which differs from
    /// `ERR_error_string`):
    ///
    ///   [thread id]:error:[error code]:[library name]:OPENSSL_internal:[reason string]:[file]:[line number]:[optional string data]
    ///
    /// The callback can return one to continue the iteration or zero to stop it.
    /// The `ctx` argument is an opaque value that is passed through to the
    /// callback.
    pub fn ERR_print_errors_cb(
        callback: ERR_print_errors_callback_t,
        ctx: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    /// ERR_print_errors_fp clears the current thread's error queue, printing each
    /// error to `file`. See `ERR_print_errors_cb` for the format.
    pub fn ERR_print_errors_fp(file: *mut FILE);
}
unsafe extern "C" {
    /// ERR_clear_error clears the error queue for the current thread.
    pub fn ERR_clear_error();
}
unsafe extern "C" {
    /// ERR_set_mark "marks" the most recent error for use with `ERR_pop_to_mark`.
    /// It returns one if an error was marked and zero if there are no errors.
    pub fn ERR_set_mark() -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ERR_pop_to_mark removes errors from the most recent to the least recent
    /// until (and not including) a "marked" error. It returns zero if no marked
    /// error was found (and thus all errors were removed) and one otherwise. Errors
    /// are marked using `ERR_set_mark`.
    pub fn ERR_pop_to_mark() -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ERR_get_next_error_library returns a value suitable for passing as the
    /// `library` argument to `ERR_put_error`. This is intended for code that wishes
    /// to push its own, non-standard errors to the error queue.
    pub fn ERR_get_next_error_library() -> ::core::ffi::c_int;
}
pub const ERR_LIB_NONE: _bindgen_ty_1 = 1;
pub const ERR_LIB_SYS: _bindgen_ty_1 = 2;
pub const ERR_LIB_BN: _bindgen_ty_1 = 3;
pub const ERR_LIB_RSA: _bindgen_ty_1 = 4;
pub const ERR_LIB_DH: _bindgen_ty_1 = 5;
pub const ERR_LIB_EVP: _bindgen_ty_1 = 6;
pub const ERR_LIB_BUF: _bindgen_ty_1 = 7;
pub const ERR_LIB_OBJ: _bindgen_ty_1 = 8;
pub const ERR_LIB_PEM: _bindgen_ty_1 = 9;
pub const ERR_LIB_DSA: _bindgen_ty_1 = 10;
pub const ERR_LIB_X509: _bindgen_ty_1 = 11;
pub const ERR_LIB_ASN1: _bindgen_ty_1 = 12;
pub const ERR_LIB_CONF: _bindgen_ty_1 = 13;
pub const ERR_LIB_CRYPTO: _bindgen_ty_1 = 14;
pub const ERR_LIB_EC: _bindgen_ty_1 = 15;
pub const ERR_LIB_SSL: _bindgen_ty_1 = 16;
pub const ERR_LIB_BIO: _bindgen_ty_1 = 17;
pub const ERR_LIB_PKCS7: _bindgen_ty_1 = 18;
pub const ERR_LIB_PKCS8: _bindgen_ty_1 = 19;
pub const ERR_LIB_X509V3: _bindgen_ty_1 = 20;
pub const ERR_LIB_RAND: _bindgen_ty_1 = 21;
pub const ERR_LIB_ENGINE: _bindgen_ty_1 = 22;
pub const ERR_LIB_OCSP: _bindgen_ty_1 = 23;
pub const ERR_LIB_UI: _bindgen_ty_1 = 24;
pub const ERR_LIB_COMP: _bindgen_ty_1 = 25;
pub const ERR_LIB_ECDSA: _bindgen_ty_1 = 26;
pub const ERR_LIB_ECDH: _bindgen_ty_1 = 27;
pub const ERR_LIB_HMAC: _bindgen_ty_1 = 28;
pub const ERR_LIB_DIGEST: _bindgen_ty_1 = 29;
pub const ERR_LIB_CIPHER: _bindgen_ty_1 = 30;
pub const ERR_LIB_HKDF: _bindgen_ty_1 = 31;
pub const ERR_LIB_TRUST_TOKEN: _bindgen_ty_1 = 32;
pub const ERR_LIB_CMS: _bindgen_ty_1 = 33;
pub const ERR_LIB_USER: _bindgen_ty_1 = 34;
pub const ERR_NUM_LIBS: _bindgen_ty_1 = 35;
/// The following values are built-in library codes.
pub type _bindgen_ty_1 = ::core::ffi::c_uint;
unsafe extern "C" {
    /// ERR_load_BIO_strings does nothing.
    pub fn ERR_load_BIO_strings();
}
unsafe extern "C" {
    /// ERR_load_ERR_strings does nothing.
    pub fn ERR_load_ERR_strings();
}
unsafe extern "C" {
    /// ERR_load_crypto_strings does nothing.
    pub fn ERR_load_crypto_strings();
}
unsafe extern "C" {
    /// ERR_load_RAND_strings does nothing.
    pub fn ERR_load_RAND_strings();
}
unsafe extern "C" {
    /// ERR_free_strings does nothing.
    pub fn ERR_free_strings();
}
unsafe extern "C" {
    /// ERR_remove_state calls `ERR_clear_error`.
    pub fn ERR_remove_state(pid: ::core::ffi::c_ulong);
}
unsafe extern "C" {
    /// ERR_remove_thread_state clears the error queue for the current thread if
    /// `tid` is NULL. Otherwise it calls `assert(0)`, because it's no longer
    /// possible to delete the error queue for other threads.
    ///
    /// Use `ERR_clear_error` instead. Note error queues are deleted automatically on
    /// thread exit. You do not need to call this function to release memory.
    pub fn ERR_remove_thread_state(tid: *const CRYPTO_THREADID);
}
unsafe extern "C" {
    /// ERR_func_error_string returns the string "OPENSSL_internal".
    pub fn ERR_func_error_string(packed_error: u32) -> *const ::core::ffi::c_char;
}
unsafe extern "C" {
    /// ERR_error_string behaves like `ERR_error_string_n` but `len` is implicitly
    /// `ERR_ERROR_STRING_BUF_LEN`.
    ///
    /// Additionally, if `buf` is NULL, the error string is placed in a static buffer
    /// which is returned. This is not thread-safe and only exists for backwards
    /// compatibility with legacy callers. The static buffer will be overridden by
    /// calls in other threads.
    ///
    /// Use `ERR_error_string_n` instead.
    ///
    /// TODO(fork): remove this function.
    pub fn ERR_error_string(
        packed_error: u32,
        buf: *mut ::core::ffi::c_char,
    ) -> *mut ::core::ffi::c_char;
}
unsafe extern "C" {
    /// ERR_GET_FUNC returns zero. BoringSSL errors do not report a function code.
    #[link_name = "ERR_GET_FUNC__extern"]
    pub fn ERR_GET_FUNC(packed_error: u32) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ERR_clear_system_error clears the system's error value (i.e. errno).
    pub fn ERR_clear_system_error();
}
unsafe extern "C" {
    /// ERR_put_error adds an error to the error queue, dropping the least recent
    /// error if necessary for space reasons.
    pub fn ERR_put_error(
        library: ::core::ffi::c_int,
        unused: ::core::ffi::c_int,
        reason: ::core::ffi::c_int,
        file: *const ::core::ffi::c_char,
        line: ::core::ffi::c_uint,
    );
}
unsafe extern "C" {
    /// ERR_add_error_data takes a variable number (`count`) of const char*
    /// pointers, concatenates them and sets the result as the data on the most
    /// recent error.
    pub fn ERR_add_error_data(count: ::core::ffi::c_uint, ...);
}
unsafe extern "C" {
    /// ERR_add_error_dataf takes a printf-style format and arguments, and sets the
    /// result as the data on the most recent error.
    pub fn ERR_add_error_dataf(format: *const ::core::ffi::c_char, ...);
}
unsafe extern "C" {
    /// ERR_set_error_data sets the data on the most recent error to `data`, which
    /// must be a NUL-terminated string. `flags` must contain `ERR_FLAG_STRING`. If
    /// `flags` contains `ERR_FLAG_MALLOCED`, this function takes ownership of
    /// `data`, which must have been allocated with `OPENSSL_malloc`. Otherwise, it
    /// saves a copy of `data`.
    ///
    /// Note this differs from OpenSSL which, when `ERR_FLAG_MALLOCED` is unset,
    /// saves the pointer as-is and requires it remain valid for the lifetime of the
    /// address space.
    pub fn ERR_set_error_data(data: *mut ::core::ffi::c_char, flags: ::core::ffi::c_int);
}
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct crypto_ex_data_st {
    _unused: [u8; 0],
}
/// CRYPTO_EX_DATA, in the public API, is an opaque struct that is never returned
/// from the library.
pub type CRYPTO_EX_DATA = crypto_ex_data_st;
/// CRYPTO_EX_free is a callback function that is called when an object of the
/// class with extra data pointers is being destroyed. For example, if this
/// callback has been passed to `SSL_get_ex_new_index` then it may be called each
/// time an `SSL*` is destroyed.
///
/// `parent` and `ad` will be NULL. Historically, the parent object was passed in
/// `parent`, but accessing the pointer was not safe because `parent` was in the
/// process of being destroyed. If the callback has access to some other pointer
/// to the parent object, it must not pass the pointer to any BoringSSL APIs.
/// Mid-destruction, invariants on the parent object no longer hold.
///
/// The arguments `argl` and `argp` contain opaque values that were given to
/// `CRYPTO_get_ex_new_index_ex`.
///
/// This callback may be called with a NULL value for `ptr` if the object has no
/// value set for this index. However, the callbacks may also be skipped entirely
/// if no extra data pointers are set on the object at all.
pub type CRYPTO_EX_free = ::core::option::Option<
    unsafe extern "C" fn(
        parent: *mut ::core::ffi::c_void,
        ptr: *mut ::core::ffi::c_void,
        ad: *mut CRYPTO_EX_DATA,
        index: ::core::ffi::c_int,
        argl: ::core::ffi::c_long,
        argp: *mut ::core::ffi::c_void,
    ),
>;
unsafe extern "C" {
    /// CRYPTO_cleanup_all_ex_data does nothing.
    pub fn CRYPTO_cleanup_all_ex_data();
}
/// CRYPTO_EX_dup is a legacy callback function type which is ignored.
pub type CRYPTO_EX_dup = ::core::option::Option<
    unsafe extern "C" fn(
        to: *mut CRYPTO_EX_DATA,
        from: *const CRYPTO_EX_DATA,
        from_d: *mut *mut ::core::ffi::c_void,
        index: ::core::ffi::c_int,
        argl: ::core::ffi::c_long,
        argp: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int,
>;
/// CRYPTO_EX_unused is a placeholder for an unused callback. It is aliased to
/// int to ensure non-NULL callers fail to compile rather than fail silently.
pub type CRYPTO_EX_unused = ::core::ffi::c_int;
/// OPENSSL_sk_free_func is a function that frees an element in a stack. Note its
/// actual type is void (*)(T *) for some T. Low-level `sk_*` functions will be
/// passed a type-specific wrapper to call it correctly.
pub type OPENSSL_sk_free_func =
    ::core::option::Option<unsafe extern "C" fn(ptr: *mut ::core::ffi::c_void)>;
/// OPENSSL_sk_copy_func is a function that copies an element in a stack. Note
/// its actual type is T *(*)(const T *) for some T. Low-level `sk_*` functions
/// will be passed a type-specific wrapper to call it correctly.
pub type OPENSSL_sk_copy_func = ::core::option::Option<
    unsafe extern "C" fn(ptr: *const ::core::ffi::c_void) -> *mut ::core::ffi::c_void,
>;
/// OPENSSL_sk_cmp_func is a comparison function that returns a value < 0, 0 or >
/// 0 if `*a` is less than, equal to or greater than `*b`, respectively.  Note
/// the extra indirection - the function is given a pointer to a pointer to the
/// element. This differs from the usual qsort/bsearch comparison function.
///
/// Note its actual type is `int (*)(const T *const *a, const T *const *b)`.
/// Low-level `sk_*` functions will be passed a type-specific wrapper to call it
/// correctly.
pub type OPENSSL_sk_cmp_func = ::core::option::Option<
    unsafe extern "C" fn(
        a: *const *const ::core::ffi::c_void,
        b: *const *const ::core::ffi::c_void,
    ) -> ::core::ffi::c_int,
>;
/// OPENSSL_sk_delete_if_func is the generic version of
/// `sk_SAMPLE_delete_if_func`.
pub type OPENSSL_sk_delete_if_func = ::core::option::Option<
    unsafe extern "C" fn(
        obj: *mut ::core::ffi::c_void,
        data: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int,
>;
/// The following function types call the above type-erased signatures with the
/// true types.
pub type OPENSSL_sk_call_free_func = ::core::option::Option<
    unsafe extern "C" fn(arg1: OPENSSL_sk_free_func, arg2: *mut ::core::ffi::c_void),
>;
pub type OPENSSL_sk_call_copy_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: OPENSSL_sk_copy_func,
        arg2: *const ::core::ffi::c_void,
    ) -> *mut ::core::ffi::c_void,
>;
pub type OPENSSL_sk_call_cmp_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: OPENSSL_sk_cmp_func,
        arg2: *const ::core::ffi::c_void,
        arg3: *const ::core::ffi::c_void,
    ) -> ::core::ffi::c_int,
>;
pub type OPENSSL_sk_call_delete_if_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: OPENSSL_sk_delete_if_func,
        arg2: *mut ::core::ffi::c_void,
        arg3: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int,
>;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct stack_st {
    _unused: [u8; 0],
}
/// An OPENSSL_STACK contains an array of pointers. It is not designed to be used
/// directly, rather the wrapper macros should be used.
pub type OPENSSL_STACK = stack_st;
unsafe extern "C" {
    /// The following are raw stack functions. They implement the corresponding typed
    /// `sk_SAMPLE_*` functions generated by `DEFINE_STACK_OF`. Callers shouldn't be
    /// using them. Rather, callers should use the typed functions.
    pub fn OPENSSL_sk_new(comp: OPENSSL_sk_cmp_func) -> *mut OPENSSL_STACK;
}
unsafe extern "C" {
    pub fn OPENSSL_sk_new_null() -> *mut OPENSSL_STACK;
}
unsafe extern "C" {
    pub fn OPENSSL_sk_num(sk: *const OPENSSL_STACK) -> usize;
}
unsafe extern "C" {
    pub fn OPENSSL_sk_zero(sk: *mut OPENSSL_STACK);
}
unsafe extern "C" {
    pub fn OPENSSL_sk_value(sk: *const OPENSSL_STACK, i: usize) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    pub fn OPENSSL_sk_set(
        sk: *mut OPENSSL_STACK,
        i: usize,
        p: *mut ::core::ffi::c_void,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    pub fn OPENSSL_sk_free(sk: *mut OPENSSL_STACK);
}
unsafe extern "C" {
    pub fn OPENSSL_sk_pop_free_ex(
        sk: *mut OPENSSL_STACK,
        call_free_func: OPENSSL_sk_call_free_func,
        free_func: OPENSSL_sk_free_func,
    );
}
unsafe extern "C" {
    pub fn OPENSSL_sk_insert(
        sk: *mut OPENSSL_STACK,
        p: *mut ::core::ffi::c_void,
        where_: usize,
    ) -> usize;
}
unsafe extern "C" {
    pub fn OPENSSL_sk_delete(sk: *mut OPENSSL_STACK, where_: usize) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    pub fn OPENSSL_sk_delete_ptr(
        sk: *mut OPENSSL_STACK,
        p: *const ::core::ffi::c_void,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    pub fn OPENSSL_sk_delete_if(
        sk: *mut OPENSSL_STACK,
        call_func: OPENSSL_sk_call_delete_if_func,
        func: OPENSSL_sk_delete_if_func,
        data: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    pub fn OPENSSL_sk_find(
        sk: *const OPENSSL_STACK,
        out_index: *mut usize,
        p: *const ::core::ffi::c_void,
        call_cmp_func: OPENSSL_sk_call_cmp_func,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn OPENSSL_sk_shift(sk: *mut OPENSSL_STACK) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    pub fn OPENSSL_sk_push(sk: *mut OPENSSL_STACK, p: *mut ::core::ffi::c_void) -> usize;
}
unsafe extern "C" {
    pub fn OPENSSL_sk_pop(sk: *mut OPENSSL_STACK) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    pub fn OPENSSL_sk_dup(sk: *const OPENSSL_STACK) -> *mut OPENSSL_STACK;
}
unsafe extern "C" {
    pub fn OPENSSL_sk_sort(sk: *mut OPENSSL_STACK, call_cmp_func: OPENSSL_sk_call_cmp_func);
}
unsafe extern "C" {
    pub fn OPENSSL_sk_sort_and_dedup(
        sk: *mut OPENSSL_STACK,
        call_cmp_func: OPENSSL_sk_call_cmp_func,
        call_free_func: OPENSSL_sk_call_free_func,
        free_func: OPENSSL_sk_free_func,
    );
}
unsafe extern "C" {
    pub fn OPENSSL_sk_is_sorted(sk: *const OPENSSL_STACK) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn OPENSSL_sk_set_cmp_func(
        sk: *mut OPENSSL_STACK,
        comp: OPENSSL_sk_cmp_func,
    ) -> OPENSSL_sk_cmp_func;
}
unsafe extern "C" {
    pub fn OPENSSL_sk_deep_copy(
        sk: *const OPENSSL_STACK,
        call_copy_func: OPENSSL_sk_call_copy_func,
        copy_func: OPENSSL_sk_copy_func,
        call_free_func: OPENSSL_sk_call_free_func,
        free_func: OPENSSL_sk_free_func,
    ) -> *mut OPENSSL_STACK;
}
/// Deprecated private functions (hidden).
///
/// TODO(crbug.com/boringssl/499): Migrate callers to the typed wrappers, or at
/// least the new names and remove the old ones.
///
/// TODO(b/290792019, b/290785937): Ideally these would at least be inline
/// functions, so we do not squat the symbols.
pub type _STACK = OPENSSL_STACK;
unsafe extern "C" {
    /// The following functions call the corresponding `OPENSSL_sk_*` function.
    pub fn sk_new_null() -> *mut OPENSSL_STACK;
}
unsafe extern "C" {
    pub fn sk_num(sk: *const OPENSSL_STACK) -> usize;
}
unsafe extern "C" {
    pub fn sk_value(sk: *const OPENSSL_STACK, i: usize) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    pub fn sk_free(sk: *mut OPENSSL_STACK);
}
unsafe extern "C" {
    pub fn sk_push(sk: *mut OPENSSL_STACK, p: *mut ::core::ffi::c_void) -> usize;
}
unsafe extern "C" {
    pub fn sk_pop(sk: *mut OPENSSL_STACK) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    /// sk_pop_free_ex calls `OPENSSL_sk_pop_free_ex`.
    ///
    /// TODO(b/291994116): Remove this.
    pub fn sk_pop_free_ex(
        sk: *mut OPENSSL_STACK,
        call_free_func: OPENSSL_sk_call_free_func,
        free_func: OPENSSL_sk_free_func,
    );
}
unsafe extern "C" {
    /// sk_pop_free behaves like `OPENSSL_sk_pop_free_ex` but performs an invalid
    /// function pointer cast. It exists because some existing callers called
    /// `sk_pop_free` directly.
    ///
    /// TODO(davidben): Migrate callers to bssl::UniquePtr and remove this.
    pub fn sk_pop_free(sk: *mut OPENSSL_STACK, free_func: OPENSSL_sk_free_func);
}
/// Built-in stacks.
pub type OPENSSL_STRING = *mut ::core::ffi::c_char;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct stack_st_void {
    _unused: [u8; 0],
}
/// We also disable -Wcast-qual. As part of this C-based type erasure setup,  \
/// the wrapper macros need to cast away const in places. In C++, const_cast  \
/// suppresses the warning, but it seemingly cannot be suppressed in C.
pub type sk_void_free_func =
    ::core::option::Option<unsafe extern "C" fn(arg1: *mut ::core::ffi::c_void)>;
pub type sk_void_copy_func = ::core::option::Option<
    unsafe extern "C" fn(arg1: *const ::core::ffi::c_void) -> *mut ::core::ffi::c_void,
>;
pub type sk_void_cmp_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *const *const ::core::ffi::c_void,
        arg2: *const *const ::core::ffi::c_void,
    ) -> ::core::ffi::c_int,
>;
pub type sk_void_delete_if_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *mut ::core::ffi::c_void,
        arg2: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int,
>;
unsafe extern "C" {
    #[link_name = "sk_void_call_free_func__extern"]
    pub fn sk_void_call_free_func(free_func: OPENSSL_sk_free_func, ptr: *mut ::core::ffi::c_void);
}
unsafe extern "C" {
    #[link_name = "sk_void_call_copy_func__extern"]
    pub fn sk_void_call_copy_func(
        copy_func: OPENSSL_sk_copy_func,
        ptr: *const ::core::ffi::c_void,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    #[link_name = "sk_void_call_cmp_func__extern"]
    pub fn sk_void_call_cmp_func(
        cmp_func: OPENSSL_sk_cmp_func,
        a: *const ::core::ffi::c_void,
        b: *const ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_void_call_delete_if_func__extern"]
    pub fn sk_void_call_delete_if_func(
        func: OPENSSL_sk_delete_if_func,
        obj: *mut ::core::ffi::c_void,
        data: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_void_new__extern"]
    pub fn sk_void_new(comp: sk_void_cmp_func) -> *mut stack_st_void;
}
unsafe extern "C" {
    #[link_name = "sk_void_new_null__extern"]
    pub fn sk_void_new_null() -> *mut stack_st_void;
}
unsafe extern "C" {
    #[link_name = "sk_void_num__extern"]
    pub fn sk_void_num(sk: *const stack_st_void) -> usize;
}
unsafe extern "C" {
    #[link_name = "sk_void_zero__extern"]
    pub fn sk_void_zero(sk: *mut stack_st_void);
}
unsafe extern "C" {
    #[link_name = "sk_void_value__extern"]
    pub fn sk_void_value(sk: *const stack_st_void, i: usize) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    #[link_name = "sk_void_set__extern"]
    pub fn sk_void_set(
        sk: *mut stack_st_void,
        i: usize,
        p: *mut ::core::ffi::c_void,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    #[link_name = "sk_void_free__extern"]
    pub fn sk_void_free(sk: *mut stack_st_void);
}
unsafe extern "C" {
    #[link_name = "sk_void_pop_free__extern"]
    pub fn sk_void_pop_free(sk: *mut stack_st_void, free_func: sk_void_free_func);
}
unsafe extern "C" {
    #[link_name = "sk_void_insert__extern"]
    pub fn sk_void_insert(
        sk: *mut stack_st_void,
        p: *mut ::core::ffi::c_void,
        where_: usize,
    ) -> usize;
}
unsafe extern "C" {
    #[link_name = "sk_void_delete__extern"]
    pub fn sk_void_delete(sk: *mut stack_st_void, where_: usize) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    #[link_name = "sk_void_delete_ptr__extern"]
    pub fn sk_void_delete_ptr(
        sk: *mut stack_st_void,
        p: *const ::core::ffi::c_void,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    #[link_name = "sk_void_delete_if__extern"]
    pub fn sk_void_delete_if(
        sk: *mut stack_st_void,
        func: sk_void_delete_if_func,
        data: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    #[link_name = "sk_void_find__extern"]
    pub fn sk_void_find(
        sk: *const stack_st_void,
        out_index: *mut usize,
        p: *const ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_void_shift__extern"]
    pub fn sk_void_shift(sk: *mut stack_st_void) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    #[link_name = "sk_void_push__extern"]
    pub fn sk_void_push(sk: *mut stack_st_void, p: *mut ::core::ffi::c_void) -> usize;
}
unsafe extern "C" {
    #[link_name = "sk_void_pop__extern"]
    pub fn sk_void_pop(sk: *mut stack_st_void) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    #[link_name = "sk_void_dup__extern"]
    pub fn sk_void_dup(sk: *const stack_st_void) -> *mut stack_st_void;
}
unsafe extern "C" {
    #[link_name = "sk_void_sort__extern"]
    pub fn sk_void_sort(sk: *mut stack_st_void);
}
unsafe extern "C" {
    #[link_name = "sk_void_sort_and_dedup__extern"]
    pub fn sk_void_sort_and_dedup(sk: *mut stack_st_void, free_func: sk_void_free_func);
}
unsafe extern "C" {
    #[link_name = "sk_void_is_sorted__extern"]
    pub fn sk_void_is_sorted(sk: *const stack_st_void) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_void_set_cmp_func__extern"]
    pub fn sk_void_set_cmp_func(sk: *mut stack_st_void, comp: sk_void_cmp_func)
        -> sk_void_cmp_func;
}
unsafe extern "C" {
    #[link_name = "sk_void_deep_copy__extern"]
    pub fn sk_void_deep_copy(
        sk: *const stack_st_void,
        copy_func: sk_void_copy_func,
        free_func: sk_void_free_func,
    ) -> *mut stack_st_void;
}
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct stack_st_OPENSSL_STRING {
    _unused: [u8; 0],
}
/// We also disable -Wcast-qual. As part of this C-based type erasure setup,  \
/// the wrapper macros need to cast away const in places. In C++, const_cast  \
/// suppresses the warning, but it seemingly cannot be suppressed in C.
pub type sk_OPENSSL_STRING_free_func =
    ::core::option::Option<unsafe extern "C" fn(arg1: *mut ::core::ffi::c_char)>;
pub type sk_OPENSSL_STRING_copy_func = ::core::option::Option<
    unsafe extern "C" fn(arg1: *const ::core::ffi::c_char) -> *mut ::core::ffi::c_char,
>;
pub type sk_OPENSSL_STRING_cmp_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *const *const ::core::ffi::c_char,
        arg2: *const *const ::core::ffi::c_char,
    ) -> ::core::ffi::c_int,
>;
pub type sk_OPENSSL_STRING_delete_if_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *mut ::core::ffi::c_char,
        arg2: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int,
>;
unsafe extern "C" {
    #[link_name = "sk_OPENSSL_STRING_call_free_func__extern"]
    pub fn sk_OPENSSL_STRING_call_free_func(
        free_func: OPENSSL_sk_free_func,
        ptr: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    #[link_name = "sk_OPENSSL_STRING_call_copy_func__extern"]
    pub fn sk_OPENSSL_STRING_call_copy_func(
        copy_func: OPENSSL_sk_copy_func,
        ptr: *const ::core::ffi::c_void,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    #[link_name = "sk_OPENSSL_STRING_call_cmp_func__extern"]
    pub fn sk_OPENSSL_STRING_call_cmp_func(
        cmp_func: OPENSSL_sk_cmp_func,
        a: *const ::core::ffi::c_void,
        b: *const ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_OPENSSL_STRING_call_delete_if_func__extern"]
    pub fn sk_OPENSSL_STRING_call_delete_if_func(
        func: OPENSSL_sk_delete_if_func,
        obj: *mut ::core::ffi::c_void,
        data: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_OPENSSL_STRING_new__extern"]
    pub fn sk_OPENSSL_STRING_new(comp: sk_OPENSSL_STRING_cmp_func) -> *mut stack_st_OPENSSL_STRING;
}
unsafe extern "C" {
    #[link_name = "sk_OPENSSL_STRING_new_null__extern"]
    pub fn sk_OPENSSL_STRING_new_null() -> *mut stack_st_OPENSSL_STRING;
}
unsafe extern "C" {
    #[link_name = "sk_OPENSSL_STRING_num__extern"]
    pub fn sk_OPENSSL_STRING_num(sk: *const stack_st_OPENSSL_STRING) -> usize;
}
unsafe extern "C" {
    #[link_name = "sk_OPENSSL_STRING_zero__extern"]
    pub fn sk_OPENSSL_STRING_zero(sk: *mut stack_st_OPENSSL_STRING);
}
unsafe extern "C" {
    #[link_name = "sk_OPENSSL_STRING_value__extern"]
    pub fn sk_OPENSSL_STRING_value(
        sk: *const stack_st_OPENSSL_STRING,
        i: usize,
    ) -> *mut ::core::ffi::c_char;
}
unsafe extern "C" {
    #[link_name = "sk_OPENSSL_STRING_set__extern"]
    pub fn sk_OPENSSL_STRING_set(
        sk: *mut stack_st_OPENSSL_STRING,
        i: usize,
        p: *mut ::core::ffi::c_char,
    ) -> *mut ::core::ffi::c_char;
}
unsafe extern "C" {
    #[link_name = "sk_OPENSSL_STRING_free__extern"]
    pub fn sk_OPENSSL_STRING_free(sk: *mut stack_st_OPENSSL_STRING);
}
unsafe extern "C" {
    #[link_name = "sk_OPENSSL_STRING_pop_free__extern"]
    pub fn sk_OPENSSL_STRING_pop_free(
        sk: *mut stack_st_OPENSSL_STRING,
        free_func: sk_OPENSSL_STRING_free_func,
    );
}
unsafe extern "C" {
    #[link_name = "sk_OPENSSL_STRING_insert__extern"]
    pub fn sk_OPENSSL_STRING_insert(
        sk: *mut stack_st_OPENSSL_STRING,
        p: *mut ::core::ffi::c_char,
        where_: usize,
    ) -> usize;
}
unsafe extern "C" {
    #[link_name = "sk_OPENSSL_STRING_delete__extern"]
    pub fn sk_OPENSSL_STRING_delete(
        sk: *mut stack_st_OPENSSL_STRING,
        where_: usize,
    ) -> *mut ::core::ffi::c_char;
}
unsafe extern "C" {
    #[link_name = "sk_OPENSSL_STRING_delete_ptr__extern"]
    pub fn sk_OPENSSL_STRING_delete_ptr(
        sk: *mut stack_st_OPENSSL_STRING,
        p: *const ::core::ffi::c_char,
    ) -> *mut ::core::ffi::c_char;
}
unsafe extern "C" {
    #[link_name = "sk_OPENSSL_STRING_delete_if__extern"]
    pub fn sk_OPENSSL_STRING_delete_if(
        sk: *mut stack_st_OPENSSL_STRING,
        func: sk_OPENSSL_STRING_delete_if_func,
        data: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    #[link_name = "sk_OPENSSL_STRING_find__extern"]
    pub fn sk_OPENSSL_STRING_find(
        sk: *const stack_st_OPENSSL_STRING,
        out_index: *mut usize,
        p: *const ::core::ffi::c_char,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_OPENSSL_STRING_shift__extern"]
    pub fn sk_OPENSSL_STRING_shift(sk: *mut stack_st_OPENSSL_STRING) -> *mut ::core::ffi::c_char;
}
unsafe extern "C" {
    #[link_name = "sk_OPENSSL_STRING_push__extern"]
    pub fn sk_OPENSSL_STRING_push(
        sk: *mut stack_st_OPENSSL_STRING,
        p: *mut ::core::ffi::c_char,
    ) -> usize;
}
unsafe extern "C" {
    #[link_name = "sk_OPENSSL_STRING_pop__extern"]
    pub fn sk_OPENSSL_STRING_pop(sk: *mut stack_st_OPENSSL_STRING) -> *mut ::core::ffi::c_char;
}
unsafe extern "C" {
    #[link_name = "sk_OPENSSL_STRING_dup__extern"]
    pub fn sk_OPENSSL_STRING_dup(
        sk: *const stack_st_OPENSSL_STRING,
    ) -> *mut stack_st_OPENSSL_STRING;
}
unsafe extern "C" {
    #[link_name = "sk_OPENSSL_STRING_sort__extern"]
    pub fn sk_OPENSSL_STRING_sort(sk: *mut stack_st_OPENSSL_STRING);
}
unsafe extern "C" {
    #[link_name = "sk_OPENSSL_STRING_sort_and_dedup__extern"]
    pub fn sk_OPENSSL_STRING_sort_and_dedup(
        sk: *mut stack_st_OPENSSL_STRING,
        free_func: sk_OPENSSL_STRING_free_func,
    );
}
unsafe extern "C" {
    #[link_name = "sk_OPENSSL_STRING_is_sorted__extern"]
    pub fn sk_OPENSSL_STRING_is_sorted(sk: *const stack_st_OPENSSL_STRING) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_OPENSSL_STRING_set_cmp_func__extern"]
    pub fn sk_OPENSSL_STRING_set_cmp_func(
        sk: *mut stack_st_OPENSSL_STRING,
        comp: sk_OPENSSL_STRING_cmp_func,
    ) -> sk_OPENSSL_STRING_cmp_func;
}
unsafe extern "C" {
    #[link_name = "sk_OPENSSL_STRING_deep_copy__extern"]
    pub fn sk_OPENSSL_STRING_deep_copy(
        sk: *const stack_st_OPENSSL_STRING,
        copy_func: sk_OPENSSL_STRING_copy_func,
        free_func: sk_OPENSSL_STRING_free_func,
    ) -> *mut stack_st_OPENSSL_STRING;
}
/// Allocation and freeing.
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct stack_st_BIO {
    _unused: [u8; 0],
}
/// Allocation and freeing.
pub type sk_BIO_free_func = ::core::option::Option<unsafe extern "C" fn(arg1: *mut BIO)>;
/// Allocation and freeing.
pub type sk_BIO_copy_func =
    ::core::option::Option<unsafe extern "C" fn(arg1: *const BIO) -> *mut BIO>;
/// Allocation and freeing.
pub type sk_BIO_cmp_func = ::core::option::Option<
    unsafe extern "C" fn(arg1: *const *const BIO, arg2: *const *const BIO) -> ::core::ffi::c_int,
>;
/// Allocation and freeing.
pub type sk_BIO_delete_if_func = ::core::option::Option<
    unsafe extern "C" fn(arg1: *mut BIO, arg2: *mut ::core::ffi::c_void) -> ::core::ffi::c_int,
>;
unsafe extern "C" {
    /// Allocation and freeing.
    #[link_name = "sk_BIO_call_free_func__extern"]
    pub fn sk_BIO_call_free_func(free_func: OPENSSL_sk_free_func, ptr: *mut ::core::ffi::c_void);
}
unsafe extern "C" {
    /// Allocation and freeing.
    #[link_name = "sk_BIO_call_copy_func__extern"]
    pub fn sk_BIO_call_copy_func(
        copy_func: OPENSSL_sk_copy_func,
        ptr: *const ::core::ffi::c_void,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    /// Allocation and freeing.
    #[link_name = "sk_BIO_call_cmp_func__extern"]
    pub fn sk_BIO_call_cmp_func(
        cmp_func: OPENSSL_sk_cmp_func,
        a: *const ::core::ffi::c_void,
        b: *const ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Allocation and freeing.
    #[link_name = "sk_BIO_call_delete_if_func__extern"]
    pub fn sk_BIO_call_delete_if_func(
        func: OPENSSL_sk_delete_if_func,
        obj: *mut ::core::ffi::c_void,
        data: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Allocation and freeing.
    #[link_name = "sk_BIO_new__extern"]
    pub fn sk_BIO_new(comp: sk_BIO_cmp_func) -> *mut stack_st_BIO;
}
unsafe extern "C" {
    /// Allocation and freeing.
    #[link_name = "sk_BIO_new_null__extern"]
    pub fn sk_BIO_new_null() -> *mut stack_st_BIO;
}
unsafe extern "C" {
    /// Allocation and freeing.
    #[link_name = "sk_BIO_num__extern"]
    pub fn sk_BIO_num(sk: *const stack_st_BIO) -> usize;
}
unsafe extern "C" {
    /// Allocation and freeing.
    #[link_name = "sk_BIO_zero__extern"]
    pub fn sk_BIO_zero(sk: *mut stack_st_BIO);
}
unsafe extern "C" {
    /// Allocation and freeing.
    #[link_name = "sk_BIO_value__extern"]
    pub fn sk_BIO_value(sk: *const stack_st_BIO, i: usize) -> *mut BIO;
}
unsafe extern "C" {
    /// Allocation and freeing.
    #[link_name = "sk_BIO_set__extern"]
    pub fn sk_BIO_set(sk: *mut stack_st_BIO, i: usize, p: *mut BIO) -> *mut BIO;
}
unsafe extern "C" {
    /// Allocation and freeing.
    #[link_name = "sk_BIO_free__extern"]
    pub fn sk_BIO_free(sk: *mut stack_st_BIO);
}
unsafe extern "C" {
    /// Allocation and freeing.
    #[link_name = "sk_BIO_pop_free__extern"]
    pub fn sk_BIO_pop_free(sk: *mut stack_st_BIO, free_func: sk_BIO_free_func);
}
unsafe extern "C" {
    /// Allocation and freeing.
    #[link_name = "sk_BIO_insert__extern"]
    pub fn sk_BIO_insert(sk: *mut stack_st_BIO, p: *mut BIO, where_: usize) -> usize;
}
unsafe extern "C" {
    /// Allocation and freeing.
    #[link_name = "sk_BIO_delete__extern"]
    pub fn sk_BIO_delete(sk: *mut stack_st_BIO, where_: usize) -> *mut BIO;
}
unsafe extern "C" {
    /// Allocation and freeing.
    #[link_name = "sk_BIO_delete_ptr__extern"]
    pub fn sk_BIO_delete_ptr(sk: *mut stack_st_BIO, p: *const BIO) -> *mut BIO;
}
unsafe extern "C" {
    /// Allocation and freeing.
    #[link_name = "sk_BIO_delete_if__extern"]
    pub fn sk_BIO_delete_if(
        sk: *mut stack_st_BIO,
        func: sk_BIO_delete_if_func,
        data: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    /// Allocation and freeing.
    #[link_name = "sk_BIO_find__extern"]
    pub fn sk_BIO_find(
        sk: *const stack_st_BIO,
        out_index: *mut usize,
        p: *const BIO,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Allocation and freeing.
    #[link_name = "sk_BIO_shift__extern"]
    pub fn sk_BIO_shift(sk: *mut stack_st_BIO) -> *mut BIO;
}
unsafe extern "C" {
    /// Allocation and freeing.
    #[link_name = "sk_BIO_push__extern"]
    pub fn sk_BIO_push(sk: *mut stack_st_BIO, p: *mut BIO) -> usize;
}
unsafe extern "C" {
    /// Allocation and freeing.
    #[link_name = "sk_BIO_pop__extern"]
    pub fn sk_BIO_pop(sk: *mut stack_st_BIO) -> *mut BIO;
}
unsafe extern "C" {
    /// Allocation and freeing.
    #[link_name = "sk_BIO_dup__extern"]
    pub fn sk_BIO_dup(sk: *const stack_st_BIO) -> *mut stack_st_BIO;
}
unsafe extern "C" {
    /// Allocation and freeing.
    #[link_name = "sk_BIO_sort__extern"]
    pub fn sk_BIO_sort(sk: *mut stack_st_BIO);
}
unsafe extern "C" {
    /// Allocation and freeing.
    #[link_name = "sk_BIO_sort_and_dedup__extern"]
    pub fn sk_BIO_sort_and_dedup(sk: *mut stack_st_BIO, free_func: sk_BIO_free_func);
}
unsafe extern "C" {
    /// Allocation and freeing.
    #[link_name = "sk_BIO_is_sorted__extern"]
    pub fn sk_BIO_is_sorted(sk: *const stack_st_BIO) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Allocation and freeing.
    #[link_name = "sk_BIO_set_cmp_func__extern"]
    pub fn sk_BIO_set_cmp_func(sk: *mut stack_st_BIO, comp: sk_BIO_cmp_func) -> sk_BIO_cmp_func;
}
unsafe extern "C" {
    /// Allocation and freeing.
    #[link_name = "sk_BIO_deep_copy__extern"]
    pub fn sk_BIO_deep_copy(
        sk: *const stack_st_BIO,
        copy_func: sk_BIO_copy_func,
        free_func: sk_BIO_free_func,
    ) -> *mut stack_st_BIO;
}
unsafe extern "C" {
    /// BIO_new creates a new BIO with the given method and a reference count of one.
    /// It returns the fresh `BIO`, or NULL on error.
    pub fn BIO_new(method: *const BIO_METHOD) -> *mut BIO;
}
unsafe extern "C" {
    /// BIO_free decrements the reference count of `bio`. If the reference count
    /// drops to zero, it calls the destroy callback, if present, on the method and
    /// frees `bio` itself. If `bio` is part of a chain (see `BIO_push`), this will
    /// also free the next `BIO` in the chain, and so on.
    ///
    /// It returns one if `bio` was NULL or freed. It returns zero if `bio` was
    /// shared and some other owner still owns a reference count to it.
    ///
    /// WARNING: Do not use the return value. Returning zero is not a sign of an
    /// error, nor an indication to retry the operation. `BIO` is a reference-counted
    /// type. A given `BIO` object may be shared between multiple parts of an
    /// application. To correctly track the reference count, without leaks or
    /// use-after-free, each part of the application must release only the reference
    /// counts it owns.
    pub fn BIO_free(bio: *mut BIO) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_vfree performs the same actions as `BIO_free`, but has a void return
    /// value. This is provided for API-compat.
    ///
    /// TODO(fork): remove.
    pub fn BIO_vfree(bio: *mut BIO);
}
unsafe extern "C" {
    /// BIO_up_ref increments the reference count of `bio` and returns one.
    pub fn BIO_up_ref(bio: *mut BIO) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_read attempts to read `len` bytes into `data`. It returns the number of
    /// bytes read, zero on EOF, or a negative number on error.
    pub fn BIO_read(
        bio: *mut BIO,
        data: *mut ::core::ffi::c_void,
        len: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_gets reads a line from `bio` and writes at most `size` bytes into `buf`.
    /// It returns the number of bytes read or a negative number on error. This
    /// function's output always includes a trailing NUL byte, so it will read at
    /// most `size - 1` bytes.
    ///
    /// If the function read a complete line, the output will include the newline
    /// character, '\n'. If no newline was found before `size - 1` bytes or EOF, it
    /// outputs the bytes which were available.
    pub fn BIO_gets(
        bio: *mut BIO,
        buf: *mut ::core::ffi::c_char,
        size: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_write_ex writes `len` bytes from `data` to `bio`. On success, it returns
    /// one and sets `*out_written` to the number of bytes written. Otherwise, it
    /// returns zero. `out_written` may be NULL to ignore the value.
    pub fn BIO_write_ex(
        bio: *mut BIO,
        data: *const ::core::ffi::c_void,
        len: usize,
        out_written: *mut usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_write writes `len` bytes from `data` to `bio`. It returns the number of
    /// bytes written or a negative number on error.
    pub fn BIO_write(
        bio: *mut BIO,
        data: *const ::core::ffi::c_void,
        len: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_write_all writes `len` bytes from `data` to `bio`, looping as necessary.
    /// It returns one if all bytes were successfully written and zero on error.
    pub fn BIO_write_all(
        bio: *mut BIO,
        data: *const ::core::ffi::c_void,
        len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_puts writes a NUL terminated string from `buf` to `bio`. It returns the
    /// number of bytes written or a negative number on error.
    pub fn BIO_puts(bio: *mut BIO, buf: *const ::core::ffi::c_char) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_flush flushes any buffered output. It returns one on success and zero
    /// otherwise.
    pub fn BIO_flush(bio: *mut BIO) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_ctrl sends the control request `cmd` to `bio`. The `cmd` argument should
    /// be one of the `BIO_C_*` values.
    pub fn BIO_ctrl(
        bio: *mut BIO,
        cmd: ::core::ffi::c_int,
        larg: ::core::ffi::c_long,
        parg: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_long;
}
unsafe extern "C" {
    /// BIO_ptr_ctrl acts like `BIO_ctrl` but passes the address of a `void*`
    /// pointer as `parg` and returns the value that is written to it, or NULL if
    /// the control request returns <= 0.
    pub fn BIO_ptr_ctrl(
        bp: *mut BIO,
        cmd: ::core::ffi::c_int,
        larg: ::core::ffi::c_long,
    ) -> *mut ::core::ffi::c_char;
}
unsafe extern "C" {
    /// BIO_int_ctrl acts like `BIO_ctrl` but passes the address of a copy of `iarg`
    /// as `parg`.
    pub fn BIO_int_ctrl(
        bp: *mut BIO,
        cmd: ::core::ffi::c_int,
        larg: ::core::ffi::c_long,
        iarg: ::core::ffi::c_int,
    ) -> ::core::ffi::c_long;
}
unsafe extern "C" {
    /// BIO_reset resets `bio` to its initial state, the precise meaning of which
    /// depends on the concrete type of `bio`. It normally returns one on success and
    /// <= 0 otherwise. However, for file and fd BIOs, it returns zero on success and
    /// a negative number on error.
    ///
    /// WARNING: This function's return value conventions differs from most functions
    /// in this library.
    pub fn BIO_reset(bio: *mut BIO) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_eof returns non-zero when `bio` has reached end-of-file. The precise
    /// meaning of which depends on the concrete type of `bio`. Note that in the
    /// case of BIO_pair this always returns non-zero.
    pub fn BIO_eof(bio: *mut BIO) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_set_flags ORs `flags` with `bio->flags`. Unless otherwise documented,
    /// flags are private to either BoringSSL or the custom `BIO_METHOD`.
    pub fn BIO_set_flags(bio: *mut BIO, flags: ::core::ffi::c_int);
}
unsafe extern "C" {
    /// BIO_clear_flags ANDs `bio->flags` with the bitwise-complement of `flags`.
    /// Unless otherwise documented, flags are private to either BoringSSL or the
    /// custom `BIO_METHOD`.
    pub fn BIO_clear_flags(bio: *mut BIO, flags: ::core::ffi::c_int);
}
unsafe extern "C" {
    /// BIO_test_flags returns `bio->flags` AND `flags`.
    pub fn BIO_test_flags(bio: *const BIO, flags: ::core::ffi::c_int) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_should_read returns non-zero if `bio` encountered a temporary error
    /// while reading (i.e. EAGAIN), indicating that the caller should retry the
    /// read.
    pub fn BIO_should_read(bio: *const BIO) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_should_write returns non-zero if `bio` encountered a temporary error
    /// while writing (i.e. EAGAIN), indicating that the caller should retry the
    /// write.
    pub fn BIO_should_write(bio: *const BIO) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_should_retry returns non-zero if the reason that caused a failed I/O
    /// operation is temporary and thus the operation should be retried. Otherwise,
    /// it was a permanent error and it returns zero.
    pub fn BIO_should_retry(bio: *const BIO) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_should_io_special returns non-zero if `bio` encountered a temporary
    /// error while performing a special I/O operation, indicating that the caller
    /// should retry. The operation that caused the error is returned by
    /// `BIO_get_retry_reason`.
    pub fn BIO_should_io_special(bio: *const BIO) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_get_retry_reason returns the special I/O operation that needs to be
    /// retried. The return value is one of the `BIO_RR_*` values.
    pub fn BIO_get_retry_reason(bio: *const BIO) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_set_retry_reason sets the special I/O operation that needs to be retried
    /// to `reason`, which should be one of the `BIO_RR_*` values.
    pub fn BIO_set_retry_reason(bio: *mut BIO, reason: ::core::ffi::c_int);
}
unsafe extern "C" {
    /// BIO_set_retry_read sets the `BIO_FLAGS_READ` and `BIO_FLAGS_SHOULD_RETRY`
    /// flags on `bio`.
    pub fn BIO_set_retry_read(bio: *mut BIO);
}
unsafe extern "C" {
    /// BIO_set_retry_write sets the `BIO_FLAGS_WRITE` and `BIO_FLAGS_SHOULD_RETRY`
    /// flags on `bio`.
    pub fn BIO_set_retry_write(bio: *mut BIO);
}
unsafe extern "C" {
    /// BIO_get_retry_flags gets the `BIO_FLAGS_READ`, `BIO_FLAGS_WRITE`,
    /// `BIO_FLAGS_IO_SPECIAL` and `BIO_FLAGS_SHOULD_RETRY` flags from `bio`.
    pub fn BIO_get_retry_flags(bio: *mut BIO) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_clear_retry_flags clears the `BIO_FLAGS_READ`, `BIO_FLAGS_WRITE`,
    /// `BIO_FLAGS_IO_SPECIAL` and `BIO_FLAGS_SHOULD_RETRY` flags from `bio`.
    pub fn BIO_clear_retry_flags(bio: *mut BIO);
}
unsafe extern "C" {
    /// BIO_method_type returns the type of `bio`, which is one of the `BIO_TYPE_*`
    /// values.
    pub fn BIO_method_type(bio: *const BIO) -> ::core::ffi::c_int;
}
pub type BIO_info_cb = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *mut BIO,
        arg2: ::core::ffi::c_int,
        arg3: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int,
>;
unsafe extern "C" {
    /// BIO_callback_ctrl allows the callback function to be manipulated. The `cmd`
    /// arg will generally be `BIO_CTRL_SET_CALLBACK` but arbitrary command values
    /// can be interpreted by the `BIO`.
    pub fn BIO_callback_ctrl(
        bio: *mut BIO,
        cmd: ::core::ffi::c_int,
        fp: BIO_info_cb,
    ) -> ::core::ffi::c_long;
}
unsafe extern "C" {
    /// BIO_pending returns the number of bytes pending to be read.
    pub fn BIO_pending(bio: *const BIO) -> usize;
}
unsafe extern "C" {
    /// BIO_ctrl_pending calls `BIO_pending` and exists only for compatibility with
    /// OpenSSL.
    pub fn BIO_ctrl_pending(bio: *const BIO) -> usize;
}
unsafe extern "C" {
    /// BIO_wpending returns the number of bytes pending to be written.
    pub fn BIO_wpending(bio: *const BIO) -> usize;
}
unsafe extern "C" {
    /// BIO_set_close sets the close flag for `bio`. The meaning of which depends on
    /// the type of `bio` but, for example, a memory BIO interprets the close flag
    /// as meaning that it owns its buffer. It returns one on success and zero
    /// otherwise.
    pub fn BIO_set_close(bio: *mut BIO, close_flag: ::core::ffi::c_int) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_number_read returns the number of bytes that have been read from
    /// `bio`.
    pub fn BIO_number_read(bio: *const BIO) -> u64;
}
unsafe extern "C" {
    /// BIO_number_written returns the number of bytes that have been written to
    /// `bio`.
    pub fn BIO_number_written(bio: *const BIO) -> u64;
}
unsafe extern "C" {
    /// BIO_push adds `appended_bio` to the end of the chain with `bio` at the head.
    /// It returns `bio`. Note that `appended_bio` may be the head of a chain itself
    /// and thus this function can be used to join two chains.
    ///
    /// BIO_push takes ownership of the caller's reference to `appended_bio`.
    pub fn BIO_push(bio: *mut BIO, appended_bio: *mut BIO) -> *mut BIO;
}
unsafe extern "C" {
    /// BIO_pop removes `bio` from the head of a chain and returns the next BIO in
    /// the chain, or NULL if there is no next BIO.
    ///
    /// The caller takes ownership of the chain's reference to `bio`.
    pub fn BIO_pop(bio: *mut BIO) -> *mut BIO;
}
unsafe extern "C" {
    /// BIO_next returns the next BIO in the chain after `bio`, or NULL if there is
    /// no such BIO.
    pub fn BIO_next(bio: *mut BIO) -> *mut BIO;
}
unsafe extern "C" {
    /// BIO_find_type walks a chain of BIOs and returns the first that matches
    /// `type`, which is one of the `BIO_TYPE_*` values.
    ///
    /// If `type & 0xff` is non-zero, i.e. `type` is a complete type and contains an
    /// "index" component, the function looks for an exact match. If `type & 0xff` is
    /// zero, i.e. `type` just specifies `BIO_TYPE_DESCRIPTOR`, `BIO_TYPE_FILTER`,
    /// and `BIO_TYPE_SOURCE_SINK` bits, the function looks for any BIO whose type
    /// contains at least one of those bits.
    pub fn BIO_find_type(bio: *mut BIO, type_: ::core::ffi::c_int) -> *mut BIO;
}
unsafe extern "C" {
    /// BIO_copy_next_retry sets the retry flags and `retry_reason` of `bio` from
    /// the next BIO in the chain.
    pub fn BIO_copy_next_retry(bio: *mut BIO);
}
unsafe extern "C" {
    /// BIO_printf behaves like `printf` but outputs to `bio` rather than a `FILE`.
    /// It returns the number of bytes written or a negative number on error.
    pub fn BIO_printf(bio: *mut BIO, format: *const ::core::ffi::c_char, ...)
        -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_indent prints min(`indent`, `max_indent`) spaces. It returns one on
    /// success and zero otherwise.
    pub fn BIO_indent(
        bio: *mut BIO,
        indent: ::core::ffi::c_uint,
        max_indent: ::core::ffi::c_uint,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_hexdump writes a hex dump of `data` to `bio`. Each line will be indented
    /// by `indent` spaces. It returns one on success and zero otherwise.
    pub fn BIO_hexdump(
        bio: *mut BIO,
        data: *const u8,
        len: usize,
        indent: ::core::ffi::c_uint,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ERR_print_errors prints the current contents of the error stack to `bio`
    /// using human readable strings where possible.
    pub fn ERR_print_errors(bio: *mut BIO);
}
unsafe extern "C" {
    /// BIO_read_asn1 reads a single ASN.1 object from `bio`. If successful it sets
    /// `*out` to be an allocated buffer (that should be freed with `OPENSSL_free`),
    /// `*out_size` to the length, in bytes, of that buffer and returns one.
    /// Otherwise it returns zero.
    ///
    /// If the length of the object is greater than `max_len` or 2^32 then the
    /// function will fail. Long-form tags are not supported. If the length of the
    /// object is indefinite the full contents of `bio` are read, unless it would be
    /// greater than `max_len`, in which case the function fails.
    ///
    /// If the function fails then some unknown amount of data may have been read
    /// from `bio`.
    pub fn BIO_read_asn1(
        bio: *mut BIO,
        out: *mut *mut u8,
        out_len: *mut usize,
        max_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_s_mem returns a `BIO_METHOD` that uses an in-memory buffer.
    pub fn BIO_s_mem() -> *const BIO_METHOD;
}
unsafe extern "C" {
    /// BIO_new_mem_buf creates read-only BIO that reads from `len` bytes at `buf`.
    /// It returns the BIO or NULL on error. This function does not copy or take
    /// ownership of `buf`. The caller must ensure the memory pointed to by `buf`
    /// outlives the `BIO`.
    ///
    /// If `len` is negative, then `buf` is treated as a NUL-terminated string, but
    /// don't depend on this in new code.
    pub fn BIO_new_mem_buf(buf: *const ::core::ffi::c_void, len: ossl_ssize_t) -> *mut BIO;
}
unsafe extern "C" {
    /// BIO_mem_contents sets `*out_contents` to point to the current contents of
    /// `bio` and `*out_len` to contain the length of that data. It returns one on
    /// success and zero otherwise.
    pub fn BIO_mem_contents(
        bio: *const BIO,
        out_contents: *mut *const u8,
        out_len: *mut usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_get_mem_data sets `*contents` to point to the current contents of `bio`
    /// and returns the length of the data.
    ///
    /// WARNING: don't use this, use `BIO_mem_contents`. A return value of zero from
    /// this function can mean either that it failed or that the memory buffer is
    /// empty.
    pub fn BIO_get_mem_data(
        bio: *mut BIO,
        contents: *mut *mut ::core::ffi::c_char,
    ) -> ::core::ffi::c_long;
}
unsafe extern "C" {
    /// BIO_get_mem_ptr sets `*out` to a BUF_MEM containing the current contents of
    /// `bio`. It returns one on success or zero on error.
    pub fn BIO_get_mem_ptr(bio: *mut BIO, out: *mut *mut BUF_MEM) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_set_mem_buf sets `b` as the contents of `bio`. If `take_ownership` is
    /// non-zero, then `b` will be freed when `bio` is closed. Returns one on
    /// success or zero otherwise.
    pub fn BIO_set_mem_buf(
        bio: *mut BIO,
        b: *mut BUF_MEM,
        take_ownership: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_set_mem_eof_return sets the value that will be returned from reading
    /// `bio` when empty. If `eof_value` is zero then an empty memory BIO will
    /// return EOF (that is it will return zero and `BIO_should_retry` will be
    /// false). If `eof_value` is non zero then it will return `eof_value` when it
    /// is empty and it will set the read retry flag (that is `BIO_read_retry` is
    /// true). To avoid ambiguity with a normal positive return value, `eof_value`
    /// should be set to a negative value, typically -1.
    ///
    /// For a read-only BIO, the default is zero (EOF). For a writable BIO, the
    /// default is -1 so that additional data can be written once exhausted.
    pub fn BIO_set_mem_eof_return(
        bio: *mut BIO,
        eof_value: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_s_fd returns a `BIO_METHOD` for file descriptor fds.
    pub fn BIO_s_fd() -> *const BIO_METHOD;
}
unsafe extern "C" {
    /// BIO_new_fd creates a new file descriptor BIO wrapping `fd`. If `close_flag`
    /// is non-zero, then `fd` will be closed when the BIO is.
    pub fn BIO_new_fd(fd: ::core::ffi::c_int, close_flag: ::core::ffi::c_int) -> *mut BIO;
}
unsafe extern "C" {
    /// BIO_set_fd sets the file descriptor of `bio` to `fd`. If `close_flag` is
    /// non-zero then `fd` will be closed when `bio` is. It returns one on success
    /// or zero on error.
    ///
    /// This function may also be used with socket BIOs (see `BIO_s_socket` and
    /// `BIO_new_socket`).
    pub fn BIO_set_fd(
        bio: *mut BIO,
        fd: ::core::ffi::c_int,
        close_flag: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_get_fd returns the file descriptor currently in use by `bio` or -1 if
    /// `bio` does not wrap a file descriptor. If there is a file descriptor and
    /// `out_fd` is not NULL, it also sets `*out_fd` to the file descriptor.
    ///
    /// This function may also be used with socket BIOs (see `BIO_s_socket` and
    /// `BIO_new_socket`).
    pub fn BIO_get_fd(bio: *mut BIO, out_fd: *mut ::core::ffi::c_int) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_s_file returns a BIO_METHOD that wraps a `FILE`.
    pub fn BIO_s_file() -> *const BIO_METHOD;
}
unsafe extern "C" {
    /// BIO_new_file creates a file BIO by opening `filename` with the given mode.
    /// See the `fopen` manual page for details of the mode argument. On Windows,
    /// files may be opened in either binary or text mode so, as in `fopen`, callers
    /// must specify the desired option in `mode`.
    pub fn BIO_new_file(
        filename: *const ::core::ffi::c_char,
        mode: *const ::core::ffi::c_char,
    ) -> *mut BIO;
}
unsafe extern "C" {
    /// BIO_new_fp creates a new file BIO that wraps `file`. If `flags` contains
    /// `BIO_CLOSE`, then `fclose` will be called on `file` when the BIO is closed.
    ///
    /// On Windows, if `flags` contains `BIO_FP_TEXT`, this function will
    /// additionally switch `file` to text mode. This is not recommended, but may be
    /// required for OpenSSL compatibility. If `file` was not already in text mode,
    /// mode changes can cause unflushed data in `file` to be written in unexpected
    /// ways. See `_setmode` in Windows documentation for details.
    ///
    /// Unlike OpenSSL, if `flags` does not contain `BIO_FP_TEXT`, the translation
    /// mode of `file` is left as-is. In OpenSSL, `file` will be set to binary, with
    /// the same pitfalls as above. BoringSSL does not do this so that wrapping a
    /// `FILE` in a `BIO` will not inadvertently change its state.
    ///
    /// To avoid these pitfalls, callers should set the desired translation mode when
    /// opening the file. If targeting just BoringSSL, this is sufficient. If
    /// targeting both OpenSSL and BoringSSL, callers should set `BIO_FP_TEXT` to
    /// match the desired state of the file.
    pub fn BIO_new_fp(file: *mut FILE, flags: ::core::ffi::c_int) -> *mut BIO;
}
unsafe extern "C" {
    /// BIO_get_fp sets `*out_file` to the current `FILE` for `bio`. It returns one
    /// on success and zero otherwise.
    pub fn BIO_get_fp(bio: *mut BIO, out_file: *mut *mut FILE) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_set_fp sets the `FILE` for `bio`. If `flags` contains `BIO_CLOSE` then
    /// `fclose` will be called on `file` when `bio` is closed. It returns one on
    /// success and zero otherwise.
    ///
    /// On Windows, if `flags` contains `BIO_FP_TEXT`, this function will
    /// additionally switch `file` to text mode. This is not recommended, but may be
    /// required for OpenSSL compatibility. If `file` was not already in text mode,
    /// mode changes can cause unflushed data in `file` to be written in unexpected
    /// ways. See `_setmode` in Windows documentation for details.
    ///
    /// Unlike OpenSSL, if `flags` does not contain `BIO_FP_TEXT`, the translation
    /// mode of `file` is left as-is. In OpenSSL, `file` will be set to binary, with
    /// the same pitfalls as above. BoringSSL does not do this so that wrapping a
    /// `FILE` in a `BIO` will not inadvertently change its state.
    ///
    /// To avoid these pitfalls, callers should set the desired translation mode when
    /// opening the file. If targeting just BoringSSL, this is sufficient. If
    /// targeting both OpenSSL and BoringSSL, callers should set `BIO_FP_TEXT` to
    /// match the desired state of the file.
    pub fn BIO_set_fp(
        bio: *mut BIO,
        file: *mut FILE,
        flags: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_read_filename opens `filename` for reading and sets the result as the
    /// `FILE` for `bio`. It returns one on success and zero otherwise. The `FILE`
    /// will be closed when `bio` is freed. On Windows, the file is opened in binary
    /// mode.
    pub fn BIO_read_filename(
        bio: *mut BIO,
        filename: *const ::core::ffi::c_char,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_write_filename opens `filename` for writing and sets the result as the
    /// `FILE` for `bio`. It returns one on success and zero otherwise. The `FILE`
    /// will be closed when `bio` is freed. On Windows, the file is opened in binary
    /// mode.
    pub fn BIO_write_filename(
        bio: *mut BIO,
        filename: *const ::core::ffi::c_char,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_append_filename opens `filename` for appending and sets the result as
    /// the `FILE` for `bio`. It returns one on success and zero otherwise. The
    /// `FILE` will be closed when `bio` is freed. On Windows, the file is opened in
    /// binary mode.
    pub fn BIO_append_filename(
        bio: *mut BIO,
        filename: *const ::core::ffi::c_char,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_rw_filename opens `filename` for reading and writing and sets the result
    /// as the `FILE` for `bio`. It returns one on success and zero otherwise. The
    /// `FILE` will be closed when `bio` is freed. On Windows, the file is opened in
    /// binary mode.
    pub fn BIO_rw_filename(
        bio: *mut BIO,
        filename: *const ::core::ffi::c_char,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_tell returns the file offset of `bio`, or a negative number on error or
    /// if `bio` does not support the operation.
    ///
    /// TODO(crbug.com/42290329): On platforms where `long` is 32-bit, this function
    /// cannot report 64-bit offsets.
    pub fn BIO_tell(bio: *mut BIO) -> ::core::ffi::c_long;
}
unsafe extern "C" {
    /// BIO_seek sets the file offset of `bio` to `offset`. It returns a non-negative
    /// number on success and a negative number on error. If `bio` is a file
    /// descriptor `BIO`, it returns the resulting file offset on success. If `bio`
    /// is a file `BIO`, it returns zero on success.
    ///
    /// WARNING: This function's return value conventions differs from most functions
    /// in this library.
    ///
    /// TODO(crbug.com/42290329): On platforms where `long` is 32-bit, this function
    /// cannot handle 64-bit offsets.
    pub fn BIO_seek(bio: *mut BIO, offset: ::core::ffi::c_long) -> ::core::ffi::c_long;
}
unsafe extern "C" {
    pub fn BIO_s_socket() -> *const BIO_METHOD;
}
unsafe extern "C" {
    /// BIO_new_socket allocates and initialises a fresh BIO which will read and
    /// write to the socket `fd`. If `close_flag` is `BIO_CLOSE` then closing the
    /// BIO will close `fd`. It returns the fresh `BIO` or NULL on error.
    pub fn BIO_new_socket(fd: ::core::ffi::c_int, close_flag: ::core::ffi::c_int) -> *mut BIO;
}
unsafe extern "C" {
    pub fn BIO_s_connect() -> *const BIO_METHOD;
}
unsafe extern "C" {
    /// BIO_new_connect returns a BIO that connects to the given hostname and port.
    /// The `host_and_optional_port` argument should be of the form
    /// "www.example.com" or "www.example.com:443". If the port is omitted, it must
    /// be provided with `BIO_set_conn_port`.
    ///
    /// It returns the new BIO on success, or NULL on error.
    pub fn BIO_new_connect(host_and_optional_port: *const ::core::ffi::c_char) -> *mut BIO;
}
unsafe extern "C" {
    /// BIO_set_conn_hostname sets `host_and_optional_port` as the hostname and
    /// optional port that `bio` will connect to. If the port is omitted, it must be
    /// provided with `BIO_set_conn_port`.
    ///
    /// It returns one on success and zero otherwise.
    pub fn BIO_set_conn_hostname(
        bio: *mut BIO,
        host_and_optional_port: *const ::core::ffi::c_char,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_set_conn_port sets `port_str` as the port or service name that `bio`
    /// will connect to. It returns one on success and zero otherwise.
    pub fn BIO_set_conn_port(
        bio: *mut BIO,
        port_str: *const ::core::ffi::c_char,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_set_conn_int_port sets `*port` as the port that `bio` will connect to.
    /// It returns one on success and zero otherwise.
    pub fn BIO_set_conn_int_port(
        bio: *mut BIO,
        port: *const ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_set_nbio sets whether `bio` will use non-blocking I/O operations. It
    /// returns one on success and zero otherwise. This only works for connect BIOs
    /// and must be called before `bio` is connected to take effect.
    ///
    /// For socket and fd BIOs, callers must configure blocking vs. non-blocking I/O
    /// using the underlying platform APIs.
    pub fn BIO_set_nbio(bio: *mut BIO, on: ::core::ffi::c_int) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_do_connect connects `bio` if it has not been connected yet. It returns
    /// one on success and <= 0 otherwise.
    pub fn BIO_do_connect(bio: *mut BIO) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_new_bio_pair sets `*out1` and `*out2` to two freshly created BIOs where
    /// data written to one can be read from the other and vice versa. The
    /// `writebuf1` argument gives the size of the buffer used in `*out1` and
    /// `writebuf2` for `*out2`. It returns one on success and zero on error.
    pub fn BIO_new_bio_pair(
        out1: *mut *mut BIO,
        writebuf1: usize,
        out2: *mut *mut BIO,
        writebuf2: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_ctrl_get_read_request returns the number of bytes that the other side of
    /// `bio` tried (unsuccessfully) to read.
    pub fn BIO_ctrl_get_read_request(bio: *mut BIO) -> usize;
}
unsafe extern "C" {
    /// BIO_ctrl_get_write_guarantee returns the number of bytes that `bio` (which
    /// must have been returned by `BIO_new_bio_pair`) will accept on the next
    /// `BIO_write` call.
    pub fn BIO_ctrl_get_write_guarantee(bio: *mut BIO) -> usize;
}
unsafe extern "C" {
    /// BIO_shutdown_wr marks `bio` as closed, from the point of view of the other
    /// side of the pair. Future `BIO_write` calls on `bio` will fail. It returns
    /// one on success and zero otherwise.
    pub fn BIO_shutdown_wr(bio: *mut BIO) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_get_new_index returns a new "type" value for a custom `BIO`, or -1 on
    /// error.
    pub fn BIO_get_new_index() -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_meth_new returns a newly-allocated `BIO_METHOD` or NULL on allocation
    /// error. The `type` specifies the type that will be returned by
    /// `BIO_method_type`. If this is unnecessary, this value may be zero. The `name`
    /// parameter is vestigial and may be NULL.
    ///
    /// Use the `BIO_meth_set_*` functions below to initialize the `BIO_METHOD`. The
    /// function implementations may use `BIO_set_data` and `BIO_get_data` to add
    /// method-specific state to associated `BIO`s. Additionally, `BIO_set_init` must
    /// be called after an associated `BIO` is fully initialized. State set via
    /// `BIO_set_data` may be released by configuring a destructor with
    /// `BIO_meth_set_destroy`.
    pub fn BIO_meth_new(
        type_: ::core::ffi::c_int,
        name: *const ::core::ffi::c_char,
    ) -> *mut BIO_METHOD;
}
unsafe extern "C" {
    /// BIO_meth_free releases memory associated with `method`.
    pub fn BIO_meth_free(method: *mut BIO_METHOD);
}
unsafe extern "C" {
    /// BIO_meth_set_create sets a function to be called on `BIO_new` for `method`
    /// and returns one. The function should return one on success and zero on
    /// error.
    pub fn BIO_meth_set_create(
        method: *mut BIO_METHOD,
        create_func: ::core::option::Option<
            unsafe extern "C" fn(arg1: *mut BIO) -> ::core::ffi::c_int,
        >,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_meth_set_destroy sets a function to release data associated with a `BIO`
    /// and returns one. The function's return value is ignored.
    ///
    /// As the `BIO` is about to be destroyed, it is not necessary for `destroy_func`
    /// to clear the BIO's state with `BIO_set_data` or `BIO_set_init`. There is no
    /// harm in clearing them, but the `BIO` will not be passed to `BIO` operations,
    /// unless `destroy_func` itself does so.
    pub fn BIO_meth_set_destroy(
        method: *mut BIO_METHOD,
        destroy_func: ::core::option::Option<
            unsafe extern "C" fn(arg1: *mut BIO) -> ::core::ffi::c_int,
        >,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_meth_set_write_ex sets the implementation of `BIO_write_ex` for `method`
    /// and returns one. `BIO_METHOD`s which implement `BIO_write_ex` should also
    /// implement `BIO_CTRL_FLUSH`. (See `BIO_meth_set_ctrl`.)
    ///
    /// `write_ex_func` can assume `BIO_get_init` returns one, the input size is
    /// greater than zero, and `out_written` is non-NULL. Those cases are handled
    /// before calling into the `BIO_METHOD`.
    ///
    /// If configured, `write_ex_func` will also be used to implement `BIO_write`,
    /// with the `BIO` framework converting the conventions. `BIO_meth_set_write_ex`
    /// and `BIO_meth_set_write` should not be configured on the same `BIO_METHOD`.
    /// Prefer `BIO_meth_set_write_ex` for a `size_t`-based API.
    pub fn BIO_meth_set_write_ex(
        method: *mut BIO_METHOD,
        write_ex_func: ::core::option::Option<
            unsafe extern "C" fn(
                arg1: *mut BIO,
                arg2: *const ::core::ffi::c_char,
                arg3: usize,
                arg4: *mut usize,
            ) -> ::core::ffi::c_int,
        >,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_meth_set_write sets the implementation of `BIO_write` for `method` and
    /// returns one. `BIO_METHOD`s which implement `BIO_write` should also implement
    /// `BIO_CTRL_FLUSH`. (See `BIO_meth_set_ctrl`.)
    ///
    /// `write_func` can assume `BIO_get_init` returns one and the input size is
    /// greater than zero. Those cases are handled before calling into the
    /// `BIO_METHOD`.
    ///
    /// If configured, `write_func` will also be used to implement `BIO_write_ex`,
    /// with the `BIO` framework converting the conventions. `BIO_meth_set_write_ex`
    /// and `BIO_meth_set_write` should not be configured on the same `BIO_METHOD`.
    /// Prefer `BIO_meth_set_write_ex` for a `size_t`-based API.
    pub fn BIO_meth_set_write(
        method: *mut BIO_METHOD,
        write_func: ::core::option::Option<
            unsafe extern "C" fn(
                arg1: *mut BIO,
                arg2: *const ::core::ffi::c_char,
                arg3: ::core::ffi::c_int,
            ) -> ::core::ffi::c_int,
        >,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_meth_set_read sets the implementation of `BIO_read` for `method` and
    /// returns one.
    ///
    /// `read_func` can assume `BIO_get_init` returns one and the output size is
    /// greater than zero. Those cases are handled before calling into the
    /// `BIO_METHOD`.
    pub fn BIO_meth_set_read(
        method: *mut BIO_METHOD,
        read_func: ::core::option::Option<
            unsafe extern "C" fn(
                arg1: *mut BIO,
                arg2: *mut ::core::ffi::c_char,
                arg3: ::core::ffi::c_int,
            ) -> ::core::ffi::c_int,
        >,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_meth_set_gets sets the implementation of `BIO_gets` for `method` and
    /// returns one.
    ///
    /// `gets_func` can assume `BIO_get_init` returns one and the output size is
    /// greater than zero. Those cases are handled before calling into the
    /// `BIO_METHOD`.
    pub fn BIO_meth_set_gets(
        method: *mut BIO_METHOD,
        gets_func: ::core::option::Option<
            unsafe extern "C" fn(
                arg1: *mut BIO,
                arg2: *mut ::core::ffi::c_char,
                arg3: ::core::ffi::c_int,
            ) -> ::core::ffi::c_int,
        >,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_meth_set_ctrl sets the implementation of `BIO_ctrl` for `method` and
    /// returns one.
    pub fn BIO_meth_set_ctrl(
        method: *mut BIO_METHOD,
        ctrl_func: ::core::option::Option<
            unsafe extern "C" fn(
                arg1: *mut BIO,
                arg2: ::core::ffi::c_int,
                arg3: ::core::ffi::c_long,
                arg4: *mut ::core::ffi::c_void,
            ) -> ::core::ffi::c_long,
        >,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_meth_set_callback_ctrl sets the implementation of `BIO_callback_ctrl` for
    /// `method` and returns one.
    pub fn BIO_meth_set_callback_ctrl(
        method: *mut BIO_METHOD,
        callback_ctrl_func: ::core::option::Option<
            unsafe extern "C" fn(
                arg1: *mut BIO,
                arg2: ::core::ffi::c_int,
                arg3: BIO_info_cb,
            ) -> ::core::ffi::c_long,
        >,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_set_data sets custom data on `bio`. It may be retried with
    /// `BIO_get_data`.
    ///
    /// This function should only be called by the implementation of a custom `BIO`.
    /// In particular, the data pointer of a built-in `BIO` is private to the
    /// library. For other uses, see `BIO_set_ex_data` and `BIO_set_app_data`.
    pub fn BIO_set_data(bio: *mut BIO, ptr: *mut ::core::ffi::c_void);
}
unsafe extern "C" {
    /// BIO_get_data returns custom data on `bio` set by `BIO_get_data`.
    ///
    /// This function should only be called by the implementation of a custom `BIO`.
    /// In particular, the data pointer of a built-in `BIO` is private to the
    /// library. For other uses, see `BIO_get_ex_data` and `BIO_get_app_data`.
    pub fn BIO_get_data(bio: *mut BIO) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    /// BIO_set_init sets whether `bio` has been fully initialized. Until fully
    /// initialized, `BIO_read` and `BIO_write` will fail.
    pub fn BIO_set_init(bio: *mut BIO, init: ::core::ffi::c_int);
}
unsafe extern "C" {
    /// BIO_get_init returns whether `bio` has been fully initialized.
    pub fn BIO_get_init(bio: *mut BIO) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ex_data functions.
    ///
    /// See `ex_data.h` for details.
    pub fn BIO_get_ex_new_index(
        argl: ::core::ffi::c_long,
        argp: *mut ::core::ffi::c_void,
        unused: *mut CRYPTO_EX_unused,
        dup_unused: CRYPTO_EX_dup,
        free_func: CRYPTO_EX_free,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn BIO_set_ex_data(
        bio: *mut BIO,
        idx: ::core::ffi::c_int,
        arg: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn BIO_get_ex_data(bio: *const BIO, idx: ::core::ffi::c_int) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    /// BIO_free_all calls `BIO_free`. Code that targets BoringSSL does not need to
    /// call a separate free function for `BIO`s that are part of a chain.
    pub fn BIO_free_all(bio: *mut BIO);
}
pub type bio_info_cb = BIO_info_cb;
unsafe extern "C" {
    /// BIO_f_base64 returns a filter `BIO` that base64-encodes data written into
    /// it, and decodes data read from it. `BIO_gets` is not supported. Call
    /// `BIO_flush` when done writing, to signal that no more data are to be
    /// encoded. The flag `BIO_FLAGS_BASE64_NO_NL` may be set to encode all the data
    /// on one line.
    ///
    /// Use `EVP_EncodeBlock` and `EVP_DecodeBase64` instead.
    pub fn BIO_f_base64() -> *const BIO_METHOD;
}
unsafe extern "C" {
    pub fn BIO_set_retry_special(bio: *mut BIO);
}
unsafe extern "C" {
    /// BIO_set_write_buffer_size returns zero.
    pub fn BIO_set_write_buffer_size(
        bio: *mut BIO,
        buffer_size: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_set_shutdown sets a method-specific "shutdown" bit on `bio`.
    pub fn BIO_set_shutdown(bio: *mut BIO, shutdown: ::core::ffi::c_int);
}
unsafe extern "C" {
    /// BIO_get_shutdown returns the method-specific "shutdown" bit.
    pub fn BIO_get_shutdown(bio: *mut BIO) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_meth_set_puts returns one. `BIO_puts` is implemented with `BIO_write` in
    /// BoringSSL.
    pub fn BIO_meth_set_puts(
        method: *mut BIO_METHOD,
        puts: ::core::option::Option<
            unsafe extern "C" fn(
                arg1: *mut BIO,
                arg2: *const ::core::ffi::c_char,
            ) -> ::core::ffi::c_int,
        >,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// The following functions return function pointers, possibly NULL, which are
    /// compatible with the corresponding `BIO_meth_set_*` function. `method` must be
    /// `BIO_s_socket` or the program will abort.
    ///
    /// Using these functions is inherently unsafe and fragile. It is not possible to
    /// use them in a future-proof way. See
    /// https://github.com/openssl/openssl/issues/26047 for details. BoringSSL
    /// implements them solely for compatibility with Folly and older versions of
    /// PostgreSQL. To work around the future-proofing problems, the return values
    /// may diverge from the true implementation of `BIO_s_socket`.
    ///
    /// Caller should not use these functions. They are not necessary to define
    /// custom `BIO_METHOD`s. Instead, callers should either:
    ///
    /// - Define a custom `BIO_METHOD` that owns a socket `BIO` somewhere in the
    ///   custom data. See `BIO_set_data`.
    ///
    /// - Define a custom `BIO_METHOD` that wraps a socket `BIO` as a filter. See
    ///   `BIO_push` and `BIO_next`.
    ///
    /// - Define a custom `BIO_METHOD` without `BIO_s_socket` at all. If not using
    ///   the built-in read or write functions, `BIO_s_socket` only provides a no-op
    ///   `BIO_CTRL_FLUSH` implementation. This can be implemented by the caller.
    pub fn BIO_meth_get_write(
        method: *const BIO_METHOD,
    ) -> ::core::option::Option<
        unsafe extern "C" fn(
            method: *mut BIO,
            arg1: *const ::core::ffi::c_char,
            arg2: ::core::ffi::c_int,
        ) -> ::core::ffi::c_int,
    >;
}
unsafe extern "C" {
    pub fn BIO_meth_get_read(
        method: *const BIO_METHOD,
    ) -> ::core::option::Option<
        unsafe extern "C" fn(
            method: *mut BIO,
            arg1: *mut ::core::ffi::c_char,
            arg2: ::core::ffi::c_int,
        ) -> ::core::ffi::c_int,
    >;
}
unsafe extern "C" {
    pub fn BIO_meth_get_gets(
        method: *const BIO_METHOD,
    ) -> ::core::option::Option<
        unsafe extern "C" fn(
            method: *mut BIO,
            arg1: *mut ::core::ffi::c_char,
            arg2: ::core::ffi::c_int,
        ) -> ::core::ffi::c_int,
    >;
}
unsafe extern "C" {
    pub fn BIO_meth_get_puts(
        method: *const BIO_METHOD,
    ) -> ::core::option::Option<
        unsafe extern "C" fn(
            method: *mut BIO,
            arg1: *const ::core::ffi::c_char,
        ) -> ::core::ffi::c_int,
    >;
}
unsafe extern "C" {
    pub fn BIO_meth_get_ctrl(
        method: *const BIO_METHOD,
    ) -> ::core::option::Option<
        unsafe extern "C" fn(
            method: *mut BIO,
            arg1: ::core::ffi::c_int,
            arg2: ::core::ffi::c_long,
            arg3: *mut ::core::ffi::c_void,
        ) -> ::core::ffi::c_long,
    >;
}
unsafe extern "C" {
    pub fn BIO_meth_get_create(
        method: *const BIO_METHOD,
    ) -> ::core::option::Option<unsafe extern "C" fn(method: *mut BIO) -> ::core::ffi::c_int>;
}
unsafe extern "C" {
    pub fn BIO_meth_get_destroy(
        method: *const BIO_METHOD,
    ) -> ::core::option::Option<unsafe extern "C" fn(method: *mut BIO) -> ::core::ffi::c_int>;
}
unsafe extern "C" {
    pub fn BIO_meth_get_callback_ctrl(
        method: *const BIO_METHOD,
    ) -> ::core::option::Option<
        unsafe extern "C" fn(
            method: *mut BIO,
            arg1: ::core::ffi::c_int,
            arg2: BIO_info_cb,
        ) -> ::core::ffi::c_long,
    >;
}
pub type BN_ULONG = u64;
unsafe extern "C" {
    /// BN_new creates a new, allocated BIGNUM and initialises it.
    pub fn BN_new() -> *mut BIGNUM;
}
unsafe extern "C" {
    /// BN_init initialises a stack allocated `BIGNUM`.
    pub fn BN_init(bn: *mut BIGNUM);
}
unsafe extern "C" {
    /// BN_free frees the data referenced by `bn` and, if `bn` was originally
    /// allocated on the heap, frees `bn` also.
    pub fn BN_free(bn: *mut BIGNUM);
}
unsafe extern "C" {
    /// BN_clear_free erases and frees the data referenced by `bn` and, if `bn` was
    /// originally allocated on the heap, frees `bn` also.
    pub fn BN_clear_free(bn: *mut BIGNUM);
}
unsafe extern "C" {
    /// BN_dup allocates a new BIGNUM and sets it equal to `src`. It returns the
    /// allocated BIGNUM on success or NULL otherwise.
    pub fn BN_dup(src: *const BIGNUM) -> *mut BIGNUM;
}
unsafe extern "C" {
    /// BN_copy sets `dest` equal to `src` and returns `dest` or NULL on allocation
    /// failure.
    pub fn BN_copy(dest: *mut BIGNUM, src: *const BIGNUM) -> *mut BIGNUM;
}
unsafe extern "C" {
    /// BN_clear sets `bn` to zero and erases the old data.
    pub fn BN_clear(bn: *mut BIGNUM);
}
unsafe extern "C" {
    /// BN_value_one returns a static BIGNUM with value 1.
    pub fn BN_value_one() -> *const BIGNUM;
}
unsafe extern "C" {
    /// BN_num_bits returns the minimum number of bits needed to represent the
    /// absolute value of `bn`.
    pub fn BN_num_bits(bn: *const BIGNUM) -> ::core::ffi::c_uint;
}
unsafe extern "C" {
    /// BN_num_bytes returns the minimum number of bytes needed to represent the
    /// absolute value of `bn`.
    ///
    /// While `size_t` is the preferred type for byte counts, callers can assume that
    /// `BIGNUM`s are bounded such that this value, and its corresponding bit count,
    /// will always fit in `int`.
    pub fn BN_num_bytes(bn: *const BIGNUM) -> ::core::ffi::c_uint;
}
unsafe extern "C" {
    /// BN_zero sets `bn` to zero.
    pub fn BN_zero(bn: *mut BIGNUM);
}
unsafe extern "C" {
    /// BN_one sets `bn` to one. It returns one on success or zero on allocation
    /// failure.
    pub fn BN_one(bn: *mut BIGNUM) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_set_word sets `bn` to `value`. It returns one on success or zero on
    /// allocation failure.
    pub fn BN_set_word(bn: *mut BIGNUM, value: BN_ULONG) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_set_u64 sets `bn` to `value`. It returns one on success or zero on
    /// allocation failure.
    pub fn BN_set_u64(bn: *mut BIGNUM, value: u64) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_set_negative sets the sign of `bn`.
    pub fn BN_set_negative(bn: *mut BIGNUM, sign: ::core::ffi::c_int);
}
unsafe extern "C" {
    /// BN_is_negative returns one if `bn` is negative and zero otherwise.
    pub fn BN_is_negative(bn: *const BIGNUM) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_bin2bn sets `*ret` to the value of `len` bytes from `in`, interpreted as
    /// a big-endian number, and returns `ret`. If `ret` is NULL then a fresh
    /// `BIGNUM` is allocated and returned. It returns NULL on allocation
    /// failure.
    pub fn BN_bin2bn(in_: *const u8, len: usize, ret: *mut BIGNUM) -> *mut BIGNUM;
}
unsafe extern "C" {
    /// BN_bn2bin serialises the absolute value of `in` to `out` as a big-endian
    /// integer, which must have `BN_num_bytes` of space available. It returns the
    /// number of bytes written. Note this function leaks the magnitude of `in`. If
    /// `in` is secret, use `BN_bn2bin_padded` instead.
    pub fn BN_bn2bin(in_: *const BIGNUM, out: *mut u8) -> usize;
}
unsafe extern "C" {
    /// BN_lebin2bn sets `*ret` to the value of `len` bytes from `in`, interpreted as
    /// a little-endian number, and returns `ret`. If `ret` is NULL then a fresh
    /// `BIGNUM` is allocated and returned. It returns NULL on allocation
    /// failure.
    pub fn BN_lebin2bn(in_: *const u8, len: usize, ret: *mut BIGNUM) -> *mut BIGNUM;
}
unsafe extern "C" {
    /// BN_bn2le_padded serialises the absolute value of `in` to `out` as a
    /// little-endian integer, which must have `len` of space available, padding
    /// out the remainder of out with zeros. If `len` is smaller than `BN_num_bytes`,
    /// the function fails and returns 0. Otherwise, it returns 1.
    pub fn BN_bn2le_padded(out: *mut u8, len: usize, in_: *const BIGNUM) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_bn2bin_padded serialises the absolute value of `in` to `out` as a
    /// big-endian integer. The integer is padded with leading zeros up to size
    /// `len`. If `len` is smaller than `BN_num_bytes`, the function fails and
    /// returns 0. Otherwise, it returns 1.
    pub fn BN_bn2bin_padded(out: *mut u8, len: usize, in_: *const BIGNUM) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_bn2cbb_padded behaves like `BN_bn2bin_padded` but writes to a `CBB`.
    pub fn BN_bn2cbb_padded(out: *mut CBB, len: usize, in_: *const BIGNUM) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_bn2hex returns an allocated string that contains a NUL-terminated, hex
    /// representation of `bn`. If `bn` is negative, the first char in the resulting
    /// string will be '-'. Returns NULL on allocation failure.
    pub fn BN_bn2hex(bn: *const BIGNUM) -> *mut ::core::ffi::c_char;
}
unsafe extern "C" {
    /// BN_hex2bn parses the leading hex number from `in`, which may be proceeded by
    /// a '-' to indicate a negative number and may contain trailing, non-hex data.
    /// If `outp` is not NULL, it constructs a BIGNUM equal to the hex number and
    /// stores it in `*outp`. If `*outp` is NULL then it allocates a new BIGNUM and
    /// updates `*outp`. It returns the number of bytes of `in` processed or zero on
    /// error.
    pub fn BN_hex2bn(outp: *mut *mut BIGNUM, in_: *const ::core::ffi::c_char)
        -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_bn2dec returns an allocated string that contains a NUL-terminated,
    /// decimal representation of `bn`. If `bn` is negative, the first char in the
    /// resulting string will be '-'. Returns NULL on allocation failure.
    ///
    /// Converting an arbitrarily large integer to decimal is quadratic in the bit
    /// length of `a`. This function assumes the caller has capped the input within
    /// performance tolerances.
    pub fn BN_bn2dec(a: *const BIGNUM) -> *mut ::core::ffi::c_char;
}
unsafe extern "C" {
    /// BN_dec2bn parses the leading decimal number from `in`, which may be
    /// proceeded by a '-' to indicate a negative number and may contain trailing,
    /// non-decimal data. If `outp` is not NULL, it constructs a BIGNUM equal to the
    /// decimal number and stores it in `*outp`. If `*outp` is NULL then it
    /// allocates a new BIGNUM and updates `*outp`. It returns the number of bytes
    /// of `in` processed or zero on error.
    ///
    /// Converting an arbitrarily large integer to decimal is quadratic in the bit
    /// length of `a`. This function assumes the caller has capped the input within
    /// performance tolerances.
    pub fn BN_dec2bn(outp: *mut *mut BIGNUM, in_: *const ::core::ffi::c_char)
        -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_asc2bn acts like `BN_dec2bn` or `BN_hex2bn` depending on whether `in`
    /// begins with "0X" or "0x" (indicating hex) or not (indicating decimal). A
    /// leading '-' is still permitted and comes before the optional 0X/0x. It
    /// returns one on success or zero on error.
    pub fn BN_asc2bn(outp: *mut *mut BIGNUM, in_: *const ::core::ffi::c_char)
        -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_print writes a hex encoding of `a` to `bio`. It returns one on success
    /// and zero on error.
    pub fn BN_print(bio: *mut BIO, a: *const BIGNUM) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_print_fp acts like `BIO_print`, but wraps `fp` in a `BIO` first.
    pub fn BN_print_fp(fp: *mut FILE, a: *const BIGNUM) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_get_word returns the absolute value of `bn` as a single word. If `bn` is
    /// too large to be represented as a single word, the maximum possible value
    /// will be returned.
    pub fn BN_get_word(bn: *const BIGNUM) -> BN_ULONG;
}
unsafe extern "C" {
    /// BN_get_u64 sets `*out` to the absolute value of `bn` as a `uint64_t` and
    /// returns one. If `bn` is too large to be represented as a `uint64_t`, it
    /// returns zero.
    pub fn BN_get_u64(bn: *const BIGNUM, out: *mut u64) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_parse_asn1_unsigned parses a non-negative DER INTEGER from `cbs` writes
    /// the result to `ret`. It returns one on success and zero on failure.
    pub fn BN_parse_asn1_unsigned(cbs: *mut CBS, ret: *mut BIGNUM) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_marshal_asn1 marshals `bn` as a non-negative DER INTEGER and appends the
    /// result to `cbb`. It returns one on success and zero on failure.
    pub fn BN_marshal_asn1(cbb: *mut CBB, bn: *const BIGNUM) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_CTX_new returns a new, empty BN_CTX or NULL on allocation failure.
    pub fn BN_CTX_new() -> *mut BN_CTX;
}
unsafe extern "C" {
    /// BN_CTX_free frees all BIGNUMs contained in `ctx` and then frees `ctx`
    /// itself.
    pub fn BN_CTX_free(ctx: *mut BN_CTX);
}
unsafe extern "C" {
    /// BN_CTX_start "pushes" a new entry onto the `ctx` stack and allows future
    /// calls to `BN_CTX_get`.
    pub fn BN_CTX_start(ctx: *mut BN_CTX);
}
unsafe extern "C" {
    /// BN_CTX_get returns a new `BIGNUM`, or NULL on allocation failure. Once
    /// `BN_CTX_get` has returned NULL, all future calls will also return NULL until
    /// `BN_CTX_end` is called.
    pub fn BN_CTX_get(ctx: *mut BN_CTX) -> *mut BIGNUM;
}
unsafe extern "C" {
    /// BN_CTX_end invalidates all `BIGNUM`s returned from `BN_CTX_get` since the
    /// matching `BN_CTX_start` call.
    pub fn BN_CTX_end(ctx: *mut BN_CTX);
}
unsafe extern "C" {
    /// BN_add sets `r` = `a` + `b`, where `r` may be the same pointer as either `a`
    /// or `b`. It returns one on success and zero on allocation failure.
    pub fn BN_add(r: *mut BIGNUM, a: *const BIGNUM, b: *const BIGNUM) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_uadd sets `r` = `a` + `b`, considering only the absolute values of `a` and
    /// `b`. `r` may be the same pointer as either `a` or `b`. It returns one on
    /// success and zero on allocation failure.
    pub fn BN_uadd(r: *mut BIGNUM, a: *const BIGNUM, b: *const BIGNUM) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_add_word adds `w` to `a`. It returns one on success and zero otherwise.
    pub fn BN_add_word(a: *mut BIGNUM, w: BN_ULONG) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_sub sets `r` = `a` - `b`, where `r` may be the same pointer as either `a`
    /// or `b`. It returns one on success and zero on allocation failure.
    pub fn BN_sub(r: *mut BIGNUM, a: *const BIGNUM, b: *const BIGNUM) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_usub sets `r` = `a` - `b`, considering only the absolute values of `a` and
    /// `b`. The result must be non-negative, i.e. `b` <= `a`. `r` may be the same
    /// pointer as either `a` or `b`. It returns one on success and zero on error.
    pub fn BN_usub(r: *mut BIGNUM, a: *const BIGNUM, b: *const BIGNUM) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_sub_word subtracts `w` from `a`. It returns one on success and zero on
    /// allocation failure.
    pub fn BN_sub_word(a: *mut BIGNUM, w: BN_ULONG) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_mul sets `r` = `a` * `b`, where `r` may be the same pointer as `a` or
    /// `b`. Returns one on success and zero otherwise.
    pub fn BN_mul(
        r: *mut BIGNUM,
        a: *const BIGNUM,
        b: *const BIGNUM,
        ctx: *mut BN_CTX,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_mul_word sets `bn` = `bn` * `w`. It returns one on success or zero on
    /// allocation failure.
    pub fn BN_mul_word(bn: *mut BIGNUM, w: BN_ULONG) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_sqr sets `r` = `a`^2 (i.e. squares), where `r` may be the same pointer as
    /// `a`. Returns one on success and zero otherwise. This is more efficient than
    /// BN_mul(r, a, a, ctx).
    pub fn BN_sqr(r: *mut BIGNUM, a: *const BIGNUM, ctx: *mut BN_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_div divides `numerator` by `divisor` and places the result in `quotient`
    /// and the remainder in `rem`. Either of `quotient` or `rem` may be NULL, in
    /// which case the respective value is not returned. It returns one on success or
    /// zero on error. It is an error condition if `divisor` is zero.
    ///
    /// The outputs will be such that `quotient` * `divisor` + `rem` = `numerator`,
    /// with the quotient rounded towards zero. Thus, if `numerator` is negative,
    /// `rem` will be zero or negative. If `divisor` is negative, the sign of
    /// `quotient` will be flipped to compensate but otherwise rounding will be as if
    /// `divisor` were its absolute value.
    pub fn BN_div(
        quotient: *mut BIGNUM,
        rem: *mut BIGNUM,
        numerator: *const BIGNUM,
        divisor: *const BIGNUM,
        ctx: *mut BN_CTX,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_div_word sets `numerator` = `numerator`/`divisor` and returns the
    /// remainder or (BN_ULONG)-1 on error.
    pub fn BN_div_word(numerator: *mut BIGNUM, divisor: BN_ULONG) -> BN_ULONG;
}
unsafe extern "C" {
    /// BN_sqrt sets `*out_sqrt` (which may be the same `BIGNUM` as `in`) to the
    /// square root of `in`, using `ctx`. It returns one on success or zero on
    /// error. Negative numbers and non-square numbers will result in an error with
    /// appropriate errors on the error queue.
    pub fn BN_sqrt(
        out_sqrt: *mut BIGNUM,
        in_: *const BIGNUM,
        ctx: *mut BN_CTX,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_cmp returns a value less than, equal to or greater than zero if `a` is
    /// less than, equal to or greater than `b`, respectively.
    pub fn BN_cmp(a: *const BIGNUM, b: *const BIGNUM) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_cmp_word is like `BN_cmp` except it takes its second argument as a
    /// `BN_ULONG` instead of a `BIGNUM`.
    pub fn BN_cmp_word(a: *const BIGNUM, b: BN_ULONG) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_ucmp returns a value less than, equal to or greater than zero if the
    /// absolute value of `a` is less than, equal to or greater than the absolute
    /// value of `b`, respectively.
    pub fn BN_ucmp(a: *const BIGNUM, b: *const BIGNUM) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_equal_consttime returns one if `a` is equal to `b`, and zero otherwise.
    /// It takes an amount of time dependent on the sizes of `a` and `b`, but
    /// independent of the contents (including the signs) of `a` and `b`.
    pub fn BN_equal_consttime(a: *const BIGNUM, b: *const BIGNUM) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_abs_is_word returns one if the absolute value of `bn` equals `w` and zero
    /// otherwise.
    pub fn BN_abs_is_word(bn: *const BIGNUM, w: BN_ULONG) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_is_zero returns one if `bn` is zero and zero otherwise.
    pub fn BN_is_zero(bn: *const BIGNUM) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_is_one returns one if `bn` equals one and zero otherwise.
    pub fn BN_is_one(bn: *const BIGNUM) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_is_word returns one if `bn` is exactly `w` and zero otherwise.
    pub fn BN_is_word(bn: *const BIGNUM, w: BN_ULONG) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_is_odd returns one if `bn` is odd and zero otherwise.
    pub fn BN_is_odd(bn: *const BIGNUM) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_is_pow2 returns 1 if `a` is a power of two, and 0 otherwise.
    pub fn BN_is_pow2(a: *const BIGNUM) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_lshift sets `r` equal to `a` << n. The `a` and `r` arguments may be the
    /// same `BIGNUM`. It returns one on success and zero on allocation failure.
    pub fn BN_lshift(r: *mut BIGNUM, a: *const BIGNUM, n: ::core::ffi::c_int)
        -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_lshift1 sets `r` equal to `a` << 1, where `r` and `a` may be the same
    /// pointer. It returns one on success and zero on allocation failure.
    pub fn BN_lshift1(r: *mut BIGNUM, a: *const BIGNUM) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_rshift sets `r` equal to `a` >> n, where `r` and `a` may be the same
    /// pointer. It returns one on success and zero on allocation failure.
    pub fn BN_rshift(r: *mut BIGNUM, a: *const BIGNUM, n: ::core::ffi::c_int)
        -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_rshift1 sets `r` equal to `a` >> 1, where `r` and `a` may be the same
    /// pointer. It returns one on success and zero on allocation failure.
    pub fn BN_rshift1(r: *mut BIGNUM, a: *const BIGNUM) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_set_bit sets the `n`th, least-significant bit in `a`. For example, if `a`
    /// is 2 then setting bit zero will make it 3. It returns one on success or zero
    /// on allocation failure.
    pub fn BN_set_bit(a: *mut BIGNUM, n: ::core::ffi::c_int) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_clear_bit clears the `n`th, least-significant bit in `a`. For example, if
    /// `a` is 3, clearing bit zero will make it two. It returns one on success or
    /// zero on allocation failure.
    pub fn BN_clear_bit(a: *mut BIGNUM, n: ::core::ffi::c_int) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_is_bit_set returns one if the `n`th least-significant bit in `a` exists
    /// and is set. Otherwise, it returns zero.
    pub fn BN_is_bit_set(a: *const BIGNUM, n: ::core::ffi::c_int) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_mask_bits truncates `a` so that it is only `n` bits long. It returns one
    /// on success or zero if `n` is negative.
    ///
    /// This differs from OpenSSL which additionally returns zero if `a`'s word
    /// length is less than or equal to `n`, rounded down to a number of words. Note
    /// word size is platform-dependent, so this behavior is also difficult to rely
    /// on in OpenSSL and not very useful.
    pub fn BN_mask_bits(a: *mut BIGNUM, n: ::core::ffi::c_int) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_count_low_zero_bits returns the number of low-order zero bits in `bn`, or
    /// the number of factors of two which divide it. It returns zero if `bn` is
    /// zero.
    pub fn BN_count_low_zero_bits(bn: *const BIGNUM) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_mod_word returns `a` mod `w` or (BN_ULONG)-1 on error.
    pub fn BN_mod_word(a: *const BIGNUM, w: BN_ULONG) -> BN_ULONG;
}
unsafe extern "C" {
    /// BN_mod_pow2 sets `r` = `a` mod 2^`e`. It returns 1 on success and
    /// 0 on error.
    pub fn BN_mod_pow2(r: *mut BIGNUM, a: *const BIGNUM, e: usize) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_nnmod_pow2 sets `r` = `a` mod 2^`e` where `r` is always positive.
    /// It returns 1 on success and 0 on error.
    pub fn BN_nnmod_pow2(r: *mut BIGNUM, a: *const BIGNUM, e: usize) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_nnmod is a non-negative modulo function. It acts like `BN_mod`, but 0 <=
    /// `rem` < `divisor` is always true. It returns one on success and zero on
    /// error.
    pub fn BN_nnmod(
        rem: *mut BIGNUM,
        numerator: *const BIGNUM,
        divisor: *const BIGNUM,
        ctx: *mut BN_CTX,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_mod_add sets `r` = `a` + `b` mod `m`. It returns one on success and zero
    /// on error.
    pub fn BN_mod_add(
        r: *mut BIGNUM,
        a: *const BIGNUM,
        b: *const BIGNUM,
        m: *const BIGNUM,
        ctx: *mut BN_CTX,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_mod_add_quick acts like `BN_mod_add` but requires that `a` and `b` be
    /// non-negative and less than `m`.
    pub fn BN_mod_add_quick(
        r: *mut BIGNUM,
        a: *const BIGNUM,
        b: *const BIGNUM,
        m: *const BIGNUM,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_mod_sub sets `r` = `a` - `b` mod `m`. It returns one on success and zero
    /// on error.
    pub fn BN_mod_sub(
        r: *mut BIGNUM,
        a: *const BIGNUM,
        b: *const BIGNUM,
        m: *const BIGNUM,
        ctx: *mut BN_CTX,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_mod_sub_quick acts like `BN_mod_sub` but requires that `a` and `b` be
    /// non-negative and less than `m`.
    pub fn BN_mod_sub_quick(
        r: *mut BIGNUM,
        a: *const BIGNUM,
        b: *const BIGNUM,
        m: *const BIGNUM,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_mod_mul sets `r` = `a`*`b` mod `m`. It returns one on success and zero
    /// on error.
    pub fn BN_mod_mul(
        r: *mut BIGNUM,
        a: *const BIGNUM,
        b: *const BIGNUM,
        m: *const BIGNUM,
        ctx: *mut BN_CTX,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_mod_sqr sets `r` = `a`^2 mod `m`. It returns one on success and zero
    /// on error.
    pub fn BN_mod_sqr(
        r: *mut BIGNUM,
        a: *const BIGNUM,
        m: *const BIGNUM,
        ctx: *mut BN_CTX,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_mod_lshift sets `r` = (`a` << n) mod `m`, where `r` and `a` may be the
    /// same pointer. It returns one on success and zero on error.
    pub fn BN_mod_lshift(
        r: *mut BIGNUM,
        a: *const BIGNUM,
        n: ::core::ffi::c_int,
        m: *const BIGNUM,
        ctx: *mut BN_CTX,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_mod_lshift_quick acts like `BN_mod_lshift` but requires that `a` be
    /// non-negative and less than `m`.
    pub fn BN_mod_lshift_quick(
        r: *mut BIGNUM,
        a: *const BIGNUM,
        n: ::core::ffi::c_int,
        m: *const BIGNUM,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_mod_lshift1 sets `r` = (`a` << 1) mod `m`, where `r` and `a` may be the
    /// same pointer. It returns one on success and zero on error.
    pub fn BN_mod_lshift1(
        r: *mut BIGNUM,
        a: *const BIGNUM,
        m: *const BIGNUM,
        ctx: *mut BN_CTX,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_mod_lshift1_quick acts like `BN_mod_lshift1` but requires that `a` be
    /// non-negative and less than `m`.
    pub fn BN_mod_lshift1_quick(
        r: *mut BIGNUM,
        a: *const BIGNUM,
        m: *const BIGNUM,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_mod_sqrt returns a newly-allocated `BIGNUM`, r, such that
    /// r^2 == a (mod p). It returns NULL on error or if `a` is not a square mod `p`.
    /// In the latter case, it will add `BN_R_NOT_A_SQUARE` to the error queue.
    /// If `a` is a square and `p` > 2, there are two possible square roots. This
    /// function may return either and may even select one non-deterministically.
    ///
    /// If `in` is non-NULL, the function, instead of allocating the result, stores
    /// the result in `in` and returns `in` on success or NULL on failure.
    ///
    /// This function only works if `p` is a prime. If `p` is composite, it may fail
    /// or return an arbitrary value. Callers should not pass attacker-controlled
    /// values of `p`.
    pub fn BN_mod_sqrt(
        in_: *mut BIGNUM,
        a: *const BIGNUM,
        p: *const BIGNUM,
        ctx: *mut BN_CTX,
    ) -> *mut BIGNUM;
}
unsafe extern "C" {
    /// BN_rand sets `rnd` to a random number of length `bits`. It returns one on
    /// success and zero otherwise.
    ///
    /// `top` must be one of the `BN_RAND_TOP_*` values. If `BN_RAND_TOP_ONE`, the
    /// most-significant bit, if any, will be set. If `BN_RAND_TOP_TWO`, the two
    /// most significant bits, if any, will be set. If `BN_RAND_TOP_ANY`, no extra
    /// action will be taken and `BN_num_bits(rnd)` may not equal `bits` if the most
    /// significant bits randomly ended up as zeros.
    ///
    /// `bottom` must be one of the `BN_RAND_BOTTOM_*` values. If
    /// `BN_RAND_BOTTOM_ODD`, the least-significant bit, if any, will be set. If
    /// `BN_RAND_BOTTOM_ANY`, no extra action will be taken.
    pub fn BN_rand(
        rnd: *mut BIGNUM,
        bits: ::core::ffi::c_int,
        top: ::core::ffi::c_int,
        bottom: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_pseudo_rand is an alias for `BN_rand`.
    pub fn BN_pseudo_rand(
        rnd: *mut BIGNUM,
        bits: ::core::ffi::c_int,
        top: ::core::ffi::c_int,
        bottom: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_rand_range is equivalent to `BN_rand_range_ex` with `min_inclusive` set
    /// to zero and `max_exclusive` set to `range`.
    pub fn BN_rand_range(rnd: *mut BIGNUM, range: *const BIGNUM) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_rand_range_ex sets `rnd` to a random value in
    /// [min_inclusive..max_exclusive). It returns one on success and zero
    /// otherwise.
    pub fn BN_rand_range_ex(
        r: *mut BIGNUM,
        min_inclusive: BN_ULONG,
        max_exclusive: *const BIGNUM,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_pseudo_rand_range is an alias for BN_rand_range.
    pub fn BN_pseudo_rand_range(rnd: *mut BIGNUM, range: *const BIGNUM) -> ::core::ffi::c_int;
}
/// bn_gencb_st, or `BN_GENCB`, holds a callback function that is used by
/// generation functions that can take a very long time to complete. Use
/// `BN_GENCB_set` to initialise a `BN_GENCB` structure.
///
/// The callback receives the address of that `BN_GENCB` structure as its last
/// argument and the user is free to put an arbitrary pointer in `arg`. The other
/// arguments are set as follows:
/// - event=BN_GENCB_GENERATED, n=i:   after generating the i'th possible prime
///                                    number.
/// - event=BN_GENCB_PRIME_TEST, n=-1: when finished trial division primality
///                                    checks.
/// - event=BN_GENCB_PRIME_TEST, n=i:  when the i'th primality test has finished.
///
/// The callback can return zero to abort the generation progress or one to
/// allow it to continue.
///
/// When other code needs to call a BN generation function it will often take a
/// BN_GENCB argument and may call the function with other argument values.
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct bn_gencb_st {
    /// callback-specific data
    pub arg: *mut ::core::ffi::c_void,
    pub callback: ::core::option::Option<
        unsafe extern "C" fn(
            event: ::core::ffi::c_int,
            n: ::core::ffi::c_int,
            arg1: *mut bn_gencb_st,
        ) -> ::core::ffi::c_int,
    >,
}
unsafe extern "C" {
    /// BN_GENCB_new returns a newly-allocated `BN_GENCB` object, or NULL on
    /// allocation failure. The result must be released with `BN_GENCB_free` when
    /// done.
    pub fn BN_GENCB_new() -> *mut BN_GENCB;
}
unsafe extern "C" {
    /// BN_GENCB_free releases memory associated with `callback`.
    pub fn BN_GENCB_free(callback: *mut BN_GENCB);
}
unsafe extern "C" {
    /// BN_GENCB_set configures `callback` to call `f` and sets `callout->arg` to
    /// `arg`.
    pub fn BN_GENCB_set(
        callback: *mut BN_GENCB,
        f: ::core::option::Option<
            unsafe extern "C" fn(
                event: ::core::ffi::c_int,
                n: ::core::ffi::c_int,
                arg1: *mut BN_GENCB,
            ) -> ::core::ffi::c_int,
        >,
        arg: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    /// BN_GENCB_call calls `callback`, if not NULL, and returns the return value of
    /// the callback, or 1 if `callback` is NULL.
    pub fn BN_GENCB_call(
        callback: *mut BN_GENCB,
        event: ::core::ffi::c_int,
        n: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_GENCB_get_arg returns `callback->arg`.
    pub fn BN_GENCB_get_arg(callback: *const BN_GENCB) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    /// BN_generate_prime_ex sets `ret` to a prime number of `bits` length. If safe
    /// is non-zero then the prime will be such that (ret-1)/2 is also a prime.
    /// (This is needed for Diffie-Hellman groups to ensure that the only subgroups
    /// are of size 2 and (p-1)/2.).
    ///
    /// If `add` is not NULL, the prime will fulfill the condition `ret` % `add` ==
    /// `rem` in order to suit a given generator. (If `rem` is NULL then `ret` %
    /// `add` == 1.)
    ///
    /// If `cb` is not NULL, it will be called during processing to give an
    /// indication of progress. See the comments for `BN_GENCB`. It returns one on
    /// success and zero otherwise.
    pub fn BN_generate_prime_ex(
        ret: *mut BIGNUM,
        bits: ::core::ffi::c_int,
        safe: ::core::ffi::c_int,
        add: *const BIGNUM,
        rem: *const BIGNUM,
        cb: *mut BN_GENCB,
    ) -> ::core::ffi::c_int;
}
pub const bn_primality_result_t_bn_probably_prime: bn_primality_result_t = 0;
pub const bn_primality_result_t_bn_composite: bn_primality_result_t = 1;
pub const bn_primality_result_t_bn_non_prime_power_composite: bn_primality_result_t = 2;
/// bn_primality_result_t enumerates the outcomes of primality-testing.
pub type bn_primality_result_t = ::core::ffi::c_uint;
unsafe extern "C" {
    /// BN_enhanced_miller_rabin_primality_test tests whether `w` is probably a prime
    /// number using the Enhanced Miller-Rabin Test (FIPS 186-5 B.3.2) with
    /// `checks` iterations and returns the result in `out_result`. Enhanced
    /// Miller-Rabin tests primality for odd integers greater than 3, returning
    /// `bn_probably_prime` if the number is probably prime,
    /// `bn_non_prime_power_composite` if the number is a composite that is not the
    /// power of a single prime, and `bn_composite` otherwise. It returns one on
    /// success and zero on failure. If `cb` is not NULL, then it is called during
    /// each iteration of the primality test.
    ///
    /// See `BN_prime_checks_for_validation` and `BN_prime_checks_for_generation` for
    /// recommended values of `checks`.
    pub fn BN_enhanced_miller_rabin_primality_test(
        out_result: *mut bn_primality_result_t,
        w: *const BIGNUM,
        checks: ::core::ffi::c_int,
        ctx: *mut BN_CTX,
        cb: *mut BN_GENCB,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_primality_test sets `*is_probably_prime` to one if `candidate` is
    /// probably a prime number by the Miller-Rabin test or zero if it's certainly
    /// not.
    ///
    /// If `do_trial_division` is non-zero then `candidate` will be tested against a
    /// list of small primes before Miller-Rabin tests. The probability of this
    /// function returning a false positive is at most 2^{2*checks}. See
    /// `BN_prime_checks_for_validation` and `BN_prime_checks_for_generation` for
    /// recommended values of `checks`.
    ///
    /// If `cb` is not NULL then it is called during the checking process. See the
    /// comment above `BN_GENCB`.
    ///
    /// The function returns one on success and zero on error.
    pub fn BN_primality_test(
        is_probably_prime: *mut ::core::ffi::c_int,
        candidate: *const BIGNUM,
        checks: ::core::ffi::c_int,
        ctx: *mut BN_CTX,
        do_trial_division: ::core::ffi::c_int,
        cb: *mut BN_GENCB,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_is_prime_fasttest_ex returns one if `candidate` is probably a prime
    /// number by the Miller-Rabin test, zero if it's certainly not and -1 on error.
    ///
    /// If `do_trial_division` is non-zero then `candidate` will be tested against a
    /// list of small primes before Miller-Rabin tests. The probability of this
    /// function returning one when `candidate` is composite is at most 2^{2*checks}.
    /// See `BN_prime_checks_for_validation` and `BN_prime_checks_for_generation` for
    /// recommended values of `checks`.
    ///
    /// If `cb` is not NULL then it is called during the checking process. See the
    /// comment above `BN_GENCB`.
    ///
    /// WARNING: deprecated. Use `BN_primality_test`.
    pub fn BN_is_prime_fasttest_ex(
        candidate: *const BIGNUM,
        checks: ::core::ffi::c_int,
        ctx: *mut BN_CTX,
        do_trial_division: ::core::ffi::c_int,
        cb: *mut BN_GENCB,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_is_prime_ex acts the same as `BN_is_prime_fasttest_ex` with
    /// `do_trial_division` set to zero.
    ///
    /// WARNING: deprecated: Use `BN_primality_test`.
    pub fn BN_is_prime_ex(
        candidate: *const BIGNUM,
        checks: ::core::ffi::c_int,
        ctx: *mut BN_CTX,
        cb: *mut BN_GENCB,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_gcd sets `r` = gcd(`a`, `b`). It returns one on success and zero
    /// otherwise.
    pub fn BN_gcd(
        r: *mut BIGNUM,
        a: *const BIGNUM,
        b: *const BIGNUM,
        ctx: *mut BN_CTX,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_mod_inverse sets `out` equal to `a`^-1, mod `n`. If `out` is NULL, a
    /// fresh BIGNUM is allocated. It returns the result or NULL on error.
    ///
    /// If `n` is even then the operation is performed using an algorithm that avoids
    /// some branches but which isn't constant-time. This function shouldn't be used
    /// for secret values; use `BN_mod_inverse_blinded` instead. Or, if `n` is
    /// guaranteed to be prime, use
    /// `BN_mod_exp_mont_consttime(out, a, m_minus_2, m, ctx, m_mont)`, taking
    /// advantage of Fermat's Little Theorem.
    pub fn BN_mod_inverse(
        out: *mut BIGNUM,
        a: *const BIGNUM,
        n: *const BIGNUM,
        ctx: *mut BN_CTX,
    ) -> *mut BIGNUM;
}
unsafe extern "C" {
    /// BN_mod_inverse_blinded sets `out` equal to `a`^-1, mod `n`, where `n` is the
    /// Montgomery modulus for `mont`. `a` must be non-negative and must be less
    /// than `n`. `n` must be greater than 1. `a` is blinded (masked by a random
    /// value) to protect it against side-channel attacks. On failure, if the failure
    /// was caused by `a` having no inverse mod `n` then `*out_no_inverse` will be
    /// set to one; otherwise it will be set to zero.
    ///
    /// Note this function may incorrectly report `a` has no inverse if the random
    /// blinding value has no inverse. It should only be used when `n` has few
    /// non-invertible elements, such as an RSA modulus.
    pub fn BN_mod_inverse_blinded(
        out: *mut BIGNUM,
        out_no_inverse: *mut ::core::ffi::c_int,
        a: *const BIGNUM,
        mont: *const BN_MONT_CTX,
        ctx: *mut BN_CTX,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_mod_inverse_odd sets `out` equal to `a`^-1, mod `n`. `a` must be
    /// non-negative and must be less than `n`. `n` must be odd. This function
    /// shouldn't be used for secret values; use `BN_mod_inverse_blinded` instead.
    /// Or, if `n` is guaranteed to be prime, use
    /// `BN_mod_exp_mont_consttime(out, a, m_minus_2, m, ctx, m_mont)`, taking
    /// advantage of Fermat's Little Theorem. It returns one on success or zero on
    /// failure. On failure, if the failure was caused by `a` having no inverse mod
    /// `n` then `*out_no_inverse` will be set to one; otherwise it will be set to
    /// zero.
    pub fn BN_mod_inverse_odd(
        out: *mut BIGNUM,
        out_no_inverse: *mut ::core::ffi::c_int,
        a: *const BIGNUM,
        n: *const BIGNUM,
        ctx: *mut BN_CTX,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_MONT_CTX_new_for_modulus returns a fresh `BN_MONT_CTX` given the modulus,
    /// `mod` or NULL on error. Note this function assumes `mod` is public.
    pub fn BN_MONT_CTX_new_for_modulus(mod_: *const BIGNUM, ctx: *mut BN_CTX) -> *mut BN_MONT_CTX;
}
unsafe extern "C" {
    /// BN_MONT_CTX_new_consttime behaves like `BN_MONT_CTX_new_for_modulus` but
    /// treats `mod` as secret.
    pub fn BN_MONT_CTX_new_consttime(mod_: *const BIGNUM, ctx: *mut BN_CTX) -> *mut BN_MONT_CTX;
}
unsafe extern "C" {
    /// BN_MONT_CTX_free frees memory associated with `mont`.
    pub fn BN_MONT_CTX_free(mont: *mut BN_MONT_CTX);
}
unsafe extern "C" {
    /// BN_MONT_CTX_copy sets `to` equal to `from`. It returns `to` on success or
    /// NULL on error.
    pub fn BN_MONT_CTX_copy(to: *mut BN_MONT_CTX, from: *const BN_MONT_CTX) -> *mut BN_MONT_CTX;
}
unsafe extern "C" {
    /// BN_to_montgomery sets `ret` equal to `a` in the Montgomery domain. `a` is
    /// assumed to be in the range [0, n), where `n` is the Montgomery modulus. It
    /// returns one on success or zero on error.
    pub fn BN_to_montgomery(
        ret: *mut BIGNUM,
        a: *const BIGNUM,
        mont: *const BN_MONT_CTX,
        ctx: *mut BN_CTX,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_from_montgomery sets `ret` equal to `a` * R^-1, i.e. translates values out
    /// of the Montgomery domain. `a` is assumed to be in the range [0, n*R), where
    /// `n` is the Montgomery modulus. Note n < R, so inputs in the range [0, n*n)
    /// are valid. This function returns one on success or zero on error.
    pub fn BN_from_montgomery(
        ret: *mut BIGNUM,
        a: *const BIGNUM,
        mont: *const BN_MONT_CTX,
        ctx: *mut BN_CTX,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_mod_mul_montgomery set `r` equal to `a` * `b`, in the Montgomery domain.
    /// Both `a` and `b` must already be in the Montgomery domain (by
    /// `BN_to_montgomery`). In particular, `a` and `b` are assumed to be in the
    /// range [0, n), where `n` is the Montgomery modulus. It returns one on success
    /// or zero on error.
    pub fn BN_mod_mul_montgomery(
        r: *mut BIGNUM,
        a: *const BIGNUM,
        b: *const BIGNUM,
        mont: *const BN_MONT_CTX,
        ctx: *mut BN_CTX,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_exp sets `r` equal to `a`^{`p`}. It does so with a square-and-multiply
    /// algorithm that leaks side-channel information. It returns one on success or
    /// zero otherwise.
    pub fn BN_exp(
        r: *mut BIGNUM,
        a: *const BIGNUM,
        p: *const BIGNUM,
        ctx: *mut BN_CTX,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_mod_exp sets `r` equal to `a`^{`p`} mod `m`. It does so with the best
    /// algorithm for the values provided. It returns one on success or zero
    /// otherwise. The `BN_mod_exp_mont_consttime` variant must be used if the
    /// exponent is secret.
    pub fn BN_mod_exp(
        r: *mut BIGNUM,
        a: *const BIGNUM,
        p: *const BIGNUM,
        m: *const BIGNUM,
        ctx: *mut BN_CTX,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_mod_exp_mont behaves like `BN_mod_exp` but treats `a` as secret and
    /// requires 0 <= `a` < `m`.
    pub fn BN_mod_exp_mont(
        r: *mut BIGNUM,
        a: *const BIGNUM,
        p: *const BIGNUM,
        m: *const BIGNUM,
        ctx: *mut BN_CTX,
        mont: *const BN_MONT_CTX,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_mod_exp_mont_consttime behaves like `BN_mod_exp` but treats `a`, `p`, and
    /// `m` as secret and requires 0 <= `a` < `m`.
    pub fn BN_mod_exp_mont_consttime(
        rr: *mut BIGNUM,
        a: *const BIGNUM,
        p: *const BIGNUM,
        m: *const BIGNUM,
        ctx: *mut BN_CTX,
        mont: *const BN_MONT_CTX,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_bn2mpi serialises the value of `in` to `out`, using a format that consists
    /// of the number's length in bytes represented as a 4-byte big-endian number,
    /// and the number itself in big-endian format, where the most significant bit
    /// signals a negative number. (The representation of numbers with the MSB set is
    /// prefixed with null byte). `out` must have sufficient space available; to
    /// find the needed amount of space, call the function with `out` set to NULL.
    pub fn BN_bn2mpi(in_: *const BIGNUM, out: *mut u8) -> usize;
}
unsafe extern "C" {
    /// BN_mpi2bn parses `len` bytes from `in` and returns the resulting value. The
    /// bytes at `in` are expected to be in the format emitted by `BN_bn2mpi`.
    ///
    /// If `out` is NULL then a fresh `BIGNUM` is allocated and returned, otherwise
    /// `out` is reused and returned. On error, NULL is returned and the error queue
    /// is updated.
    pub fn BN_mpi2bn(in_: *const u8, len: usize, out: *mut BIGNUM) -> *mut BIGNUM;
}
unsafe extern "C" {
    /// BN_mod_exp_mont_word is like `BN_mod_exp_mont` except that the base `a` is
    /// given as a `BN_ULONG` instead of a `BIGNUM *`. It returns one on success
    /// or zero otherwise.
    pub fn BN_mod_exp_mont_word(
        r: *mut BIGNUM,
        a: BN_ULONG,
        p: *const BIGNUM,
        m: *const BIGNUM,
        ctx: *mut BN_CTX,
        mont: *const BN_MONT_CTX,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_mod_exp2_mont calculates (a1^p1) * (a2^p2) mod m. It returns 1 on success
    /// or zero otherwise.
    pub fn BN_mod_exp2_mont(
        r: *mut BIGNUM,
        a1: *const BIGNUM,
        p1: *const BIGNUM,
        a2: *const BIGNUM,
        p2: *const BIGNUM,
        m: *const BIGNUM,
        ctx: *mut BN_CTX,
        mont: *const BN_MONT_CTX,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_MONT_CTX_new returns a fresh `BN_MONT_CTX` or NULL on allocation failure.
    /// Use `BN_MONT_CTX_new_for_modulus` instead.
    pub fn BN_MONT_CTX_new() -> *mut BN_MONT_CTX;
}
unsafe extern "C" {
    /// BN_MONT_CTX_set sets up a Montgomery context given the modulus, `mod`. It
    /// returns one on success and zero on error. Use `BN_MONT_CTX_new_for_modulus`
    /// instead.
    pub fn BN_MONT_CTX_set(
        mont: *mut BN_MONT_CTX,
        mod_: *const BIGNUM,
        ctx: *mut BN_CTX,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_bn2binpad behaves like `BN_bn2bin_padded`, but it returns `len` on success
    /// and -1 on error.
    ///
    /// Use `BN_bn2bin_padded` instead. It is `size_t`-clean.
    pub fn BN_bn2binpad(
        in_: *const BIGNUM,
        out: *mut u8,
        len: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_bn2lebinpad behaves like `BN_bn2le_padded`, but it returns `len` on
    /// success and -1 on error.
    ///
    /// Use `BN_bn2le_padded` instead. It is `size_t`-clean.
    pub fn BN_bn2lebinpad(
        in_: *const BIGNUM,
        out: *mut u8,
        len: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_secure_new calls `BN_new`.
    pub fn BN_secure_new() -> *mut BIGNUM;
}
unsafe extern "C" {
    /// BN_le2bn calls `BN_lebin2bn`.
    pub fn BN_le2bn(in_: *const u8, len: usize, ret: *mut BIGNUM) -> *mut BIGNUM;
}
/// Private functions
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct bignum_st {
    /// d is a pointer to an array of `width` `BN_BITS2`-bit chunks in
    /// little-endian order. This stores the absolute value of the number.
    pub d: *mut BN_ULONG,
    /// width is the number of elements of `d` which are valid. This value is not
    /// necessarily minimal; the most-significant words of `d` may be zero.
    /// `width` determines a potentially loose upper-bound on the absolute value
    /// of the `BIGNUM`.
    ///
    /// Functions taking `BIGNUM` inputs must compute the same answer for all
    /// possible widths. `bn_minimal_width`, `bn_set_minimal_width`, and other
    /// helpers may be used to recover the minimal width, provided it is not
    /// secret. If it is secret, use a different algorithm. Functions may output
    /// minimal or non-minimal `BIGNUM`s depending on secrecy requirements, but
    /// those which cause widths to unboundedly grow beyond the minimal value
    /// should be documented such.
    ///
    /// Note this is different from historical `BIGNUM` semantics.
    pub width: ::core::ffi::c_int,
    /// dmax is number of elements of `d` which are allocated.
    pub dmax: ::core::ffi::c_int,
    /// neg is one if the number if negative and zero otherwise.
    pub neg: ::core::ffi::c_int,
    /// flags is a bitmask of `BN_FLG_*` values
    pub flags: ::core::ffi::c_int,
}
unsafe extern "C" {
    pub fn BN_num_bits_word(l: BN_ULONG) -> ::core::ffi::c_uint;
}
unsafe extern "C" {
    /// ASN1_tag2bit converts `tag` from the tag number of a universal type to a
    /// corresponding `B_ASN1_*` constant, or zero if `tag` has no bitmask.
    pub fn ASN1_tag2bit(tag: ::core::ffi::c_int) -> ::core::ffi::c_ulong;
}
unsafe extern "C" {
    /// ASN1_tag2str returns a string representation of `tag`, interpret as a tag
    /// number for a universal type, or `V_ASN1_NEG_*`.
    pub fn ASN1_tag2str(tag: ::core::ffi::c_int) -> *const ::core::ffi::c_char;
}
/// The following typedefs are sometimes used for pointers to functions like
/// `d2i_SAMPLE` and `i2d_SAMPLE`. Note, however, that these act on `void*`.
/// Calling a function with a different pointer type is undefined in C, so this
/// is only valid with a wrapper.
pub type d2i_of_void = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *mut *mut ::core::ffi::c_void,
        arg2: *mut *const ::core::ffi::c_uchar,
        arg3: ::core::ffi::c_long,
    ) -> *mut ::core::ffi::c_void,
>;
pub type i2d_of_void = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *const ::core::ffi::c_void,
        arg2: *mut *mut ::core::ffi::c_uchar,
    ) -> ::core::ffi::c_int,
>;
/// ASN1_ITEM_EXP is an abstraction for referencing an `ASN1_ITEM` in a
/// constant-initialized structure, such as a method table. It exists because, on
/// some OpenSSL platforms, `ASN1_ITEM` references are indirected through
/// functions. Structures reference the `ASN1_ITEM` by declaring a field like
/// `ASN1_ITEM_EXP *item` and initializing it with `ASN1_ITEM_ref`.
pub type ASN1_ITEM_EXP = ASN1_ITEM;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct ASN1_VALUE_st {
    _unused: [u8; 0],
}
/// ASN1_VALUE_st (aka `ASN1_VALUE`) is an opaque type used as a placeholder for
/// the C type corresponding to an `ASN1_ITEM`.
pub type ASN1_VALUE = ASN1_VALUE_st;
unsafe extern "C" {
    /// ASN1_item_new allocates a new value of the C type corresponding to `it`, or
    /// NULL on error. On success, the caller must release the value with
    /// `ASN1_item_free`, or the corresponding C type's free function, when done. The
    /// new value will initialize fields of the value to some default state, such as
    /// an empty string. Note, however, that this default state sometimes omits
    /// required values, such as with CHOICE types.
    ///
    /// This function may not be used with `ASN1_ITEM`s whose C type is
    /// `ASN1_BOOLEAN`.
    ///
    /// WARNING: Casting the result of this function to the wrong type is a
    /// potentially exploitable memory error. Callers must ensure the value is used
    /// consistently with `it`. Prefer using type-specific functions such as
    /// `ASN1_OCTET_STRING_new`.
    pub fn ASN1_item_new(it: *const ASN1_ITEM) -> *mut ASN1_VALUE;
}
unsafe extern "C" {
    /// ASN1_item_free releases memory associated with `val`, which must be an object
    /// of the C type corresponding to `it`.
    ///
    /// This function may not be used with `ASN1_ITEM`s whose C type is
    /// `ASN1_BOOLEAN`.
    ///
    /// WARNING: Passing a pointer of the wrong type into this function is a
    /// potentially exploitable memory error. Callers must ensure `val` is consistent
    /// with `it`. Prefer using type-specific functions such as
    /// `ASN1_OCTET_STRING_free`.
    pub fn ASN1_item_free(val: *mut ASN1_VALUE, it: *const ASN1_ITEM);
}
unsafe extern "C" {
    /// ASN1_item_d2i parses the ASN.1 type `it` from up to `len` bytes at `*inp`.
    /// It behaves like `d2i_SAMPLE`, except that `out` and the return value are cast
    /// to `ASN1_VALUE` pointers.
    ///
    /// This function may not be used with `ASN1_ITEM`s whose C type is
    /// `ASN1_BOOLEAN`.
    ///
    /// WARNING: Casting the result of this function to the wrong type, or passing a
    /// pointer of the wrong type into this function, are potentially exploitable
    /// memory errors. Callers must ensure `out` is consistent with `it`. Prefer
    /// using type-specific functions such as `d2i_ASN1_OCTET_STRING`.
    pub fn ASN1_item_d2i(
        out: *mut *mut ASN1_VALUE,
        inp: *mut *const ::core::ffi::c_uchar,
        len: ::core::ffi::c_long,
        it: *const ASN1_ITEM,
    ) -> *mut ASN1_VALUE;
}
unsafe extern "C" {
    /// ASN1_item_i2d marshals `val` as the ASN.1 type associated with `it`, as
    /// described in `i2d_SAMPLE`.
    ///
    /// This function may not be used with `ASN1_ITEM`s whose C type is
    /// `ASN1_BOOLEAN`.
    ///
    /// WARNING: Passing a pointer of the wrong type into this function is a
    /// potentially exploitable memory error. Callers must ensure `val` is consistent
    /// with `it`. Prefer using type-specific functions such as
    /// `i2d_ASN1_OCTET_STRING`.
    pub fn ASN1_item_i2d(
        val: *mut ASN1_VALUE,
        outp: *mut *mut ::core::ffi::c_uchar,
        it: *const ASN1_ITEM,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_item_dup returns a newly-allocated copy of `x`, or NULL on error. `x`
    /// must be an object of `it`'s C type.
    ///
    /// This function may not be used with `ASN1_ITEM`s whose C type is
    /// `ASN1_BOOLEAN`.
    ///
    /// WARNING: Casting the result of this function to the wrong type, or passing a
    /// pointer of the wrong type into this function, are potentially exploitable
    /// memory errors. Prefer using type-specific functions such as
    /// `ASN1_STRING_dup`.
    pub fn ASN1_item_dup(
        it: *const ASN1_ITEM,
        x: *mut ::core::ffi::c_void,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    /// The following functions behave like `ASN1_item_d2i` but read from `in`
    /// instead. `out` is the same parameter as in `ASN1_item_d2i`, but written with
    /// `void*` instead. The return values similarly match.
    ///
    /// These functions may not be used with `ASN1_ITEM`s whose C type is
    /// `ASN1_BOOLEAN`.
    ///
    /// WARNING: These functions do not bound how much data is read from `in`.
    /// Parsing an untrusted input could consume unbounded memory.
    pub fn ASN1_item_d2i_fp(
        it: *const ASN1_ITEM,
        in_: *mut FILE,
        out: *mut ::core::ffi::c_void,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    pub fn ASN1_item_d2i_bio(
        it: *const ASN1_ITEM,
        in_: *mut BIO,
        out: *mut ::core::ffi::c_void,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    /// The following functions behave like `ASN1_item_i2d` but write to `out`
    /// instead. `in` is the same parameter as in `ASN1_item_i2d`, but written with
    /// `void*` instead.
    ///
    /// These functions may not be used with `ASN1_ITEM`s whose C type is
    /// `ASN1_BOOLEAN`.
    pub fn ASN1_item_i2d_fp(
        it: *const ASN1_ITEM,
        out: *mut FILE,
        in_: *const ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn ASN1_item_i2d_bio(
        it: *const ASN1_ITEM,
        out: *mut BIO,
        in_: *const ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_item_unpack parses `oct`'s contents as `it`'s ASN.1 type. It returns a
    /// newly-allocated instance of `it`'s C type on success, or NULL on error.
    ///
    /// This function may not be used with `ASN1_ITEM`s whose C type is
    /// `ASN1_BOOLEAN`.
    ///
    /// WARNING: Casting the result of this function to the wrong type is a
    /// potentially exploitable memory error. Callers must ensure the value is used
    /// consistently with `it`.
    pub fn ASN1_item_unpack(
        oct: *const ASN1_STRING,
        it: *const ASN1_ITEM,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    /// ASN1_item_pack marshals `obj` as `it`'s ASN.1 type. If `out` is NULL, it
    /// returns a newly-allocated `ASN1_STRING` with the result, or NULL on error.
    /// If `out` is non-NULL, but `*out` is NULL, it does the same but additionally
    /// sets `*out` to the result. If both `out` and `*out` are non-NULL, it writes
    /// the result to `*out` and returns `*out` on success or NULL on error.
    ///
    /// This function may not be used with `ASN1_ITEM`s whose C type is
    /// `ASN1_BOOLEAN`.
    ///
    /// WARNING: Passing a pointer of the wrong type into this function is a
    /// potentially exploitable memory error. Callers must ensure `val` is consistent
    /// with `it`.
    pub fn ASN1_item_pack(
        obj: *mut ::core::ffi::c_void,
        it: *const ASN1_ITEM,
        out: *mut *mut ASN1_STRING,
    ) -> *mut ASN1_STRING;
}
unsafe extern "C" {
    /// d2i_ASN1_BOOLEAN parses a DER-encoded ASN.1 BOOLEAN from up to `len` bytes at
    /// `*inp`. On success, it advances `*inp` by the number of bytes read and
    /// returns the result. If `out` is non-NULL, it additionally writes the result
    /// to `*out`. On error, it returns `ASN1_BOOLEAN_NONE`.
    ///
    /// This function does not reject trailing data in the input. This allows the
    /// caller to parse a sequence of concatenated structures. Callers parsing only
    /// one structure should check for trailing data by comparing the updated `*inp`
    /// with the end of the input.
    ///
    /// WARNING: This function's is slightly different from other `d2i_*` functions
    /// because `ASN1_BOOLEAN` is not a pointer type.
    pub fn d2i_ASN1_BOOLEAN(
        out: *mut ASN1_BOOLEAN,
        inp: *mut *const ::core::ffi::c_uchar,
        len: ::core::ffi::c_long,
    ) -> ASN1_BOOLEAN;
}
unsafe extern "C" {
    /// i2d_ASN1_BOOLEAN marshals `a` as a DER-encoded ASN.1 BOOLEAN, as described in
    /// `i2d_SAMPLE`.
    pub fn i2d_ASN1_BOOLEAN(
        a: ASN1_BOOLEAN,
        outp: *mut *mut ::core::ffi::c_uchar,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// The following `ASN1_ITEM`s have ASN.1 type BOOLEAN and C type `ASN1_BOOLEAN`.
    /// `ASN1_TBOOLEAN` and `ASN1_FBOOLEAN` must be marked OPTIONAL. When omitted,
    /// they are parsed as TRUE and FALSE, respectively, rather than
    /// `ASN1_BOOLEAN_NONE`.
    pub static ASN1_BOOLEAN_it: ASN1_ITEM;
}
unsafe extern "C" {
    /// The following `ASN1_ITEM`s have ASN.1 type BOOLEAN and C type `ASN1_BOOLEAN`.
    /// `ASN1_TBOOLEAN` and `ASN1_FBOOLEAN` must be marked OPTIONAL. When omitted,
    /// they are parsed as TRUE and FALSE, respectively, rather than
    /// `ASN1_BOOLEAN_NONE`.
    pub static ASN1_TBOOLEAN_it: ASN1_ITEM;
}
unsafe extern "C" {
    /// The following `ASN1_ITEM`s have ASN.1 type BOOLEAN and C type `ASN1_BOOLEAN`.
    /// `ASN1_TBOOLEAN` and `ASN1_FBOOLEAN` must be marked OPTIONAL. When omitted,
    /// they are parsed as TRUE and FALSE, respectively, rather than
    /// `ASN1_BOOLEAN_NONE`.
    pub static ASN1_FBOOLEAN_it: ASN1_ITEM;
}
/// An asn1_string_st (aka `ASN1_STRING`) represents a value of a string-like
/// ASN.1 type. It contains a `type` field, and a byte string `data` field with a
/// type-specific representation. This type-specific representation does not
/// always correspond to the DER encoding of the type.
///
/// If `type` is one of `V_ASN1_OCTET_STRING`, `V_ASN1_UTF8STRING`,
/// `V_ASN1_NUMERICSTRING`, `V_ASN1_PRINTABLESTRING`, `V_ASN1_T61STRING`,
/// `V_ASN1_VIDEOTEXSTRING`, `V_ASN1_IA5STRING`, `V_ASN1_GRAPHICSTRING`,
/// `V_ASN1_ISO64STRING`, `V_ASN1_VISIBLESTRING`, `V_ASN1_GENERALSTRING`,
/// `V_ASN1_UNIVERSALSTRING`, or `V_ASN1_BMPSTRING`, the object represents an
/// ASN.1 string type. The data contains the byte representation of the
/// string.
///
/// If `type` is `V_ASN1_BIT_STRING`, the object represents a BIT STRING value.
/// See bit string documentation below for the data and flags.
///
/// If `type` is one of `V_ASN1_INTEGER`, `V_ASN1_NEG_INTEGER`,
/// `V_ASN1_ENUMERATED`, or `V_ASN1_NEG_ENUMERATED`, the object represents an
/// INTEGER or ENUMERATED value. See integer documentation below for details.
///
/// If `type` is `V_ASN1_GENERALIZEDTIME` or `V_ASN1_UTCTIME`, the object
/// represents a GeneralizedTime or UTCTime value, respectively. The data
/// contains the DER encoding of the value. For example, the UNIX epoch would be
/// "19700101000000Z" for a GeneralizedTime and "700101000000Z" for a UTCTime.
///
/// If `type` is `V_ASN1_SEQUENCE`, `V_ASN1_SET`, or `V_ASN1_OTHER`, the object
/// represents a SEQUENCE, SET, or arbitrary ASN.1 value, respectively. Unlike
/// the above cases, the data contains the DER encoding of the entire structure,
/// including the header. If the value is explicitly or implicitly tagged, this
/// too will be reflected in the data field. As this case handles unknown types,
/// the contents are not checked when parsing or serializing.
///
/// Other values of `type` do not represent a valid ASN.1 value, though
/// default-constructed objects may set `type` to -1. Such objects cannot be
/// serialized.
///
/// `ASN1_STRING` additionally has the following typedefs: `ASN1_BIT_STRING`,
/// `ASN1_BMPSTRING`, `ASN1_ENUMERATED`, `ASN1_GENERALIZEDTIME`,
/// `ASN1_GENERALSTRING`, `ASN1_IA5STRING`, `ASN1_INTEGER`, `ASN1_OCTET_STRING`,
/// `ASN1_PRINTABLESTRING`, `ASN1_T61STRING`, `ASN1_TIME`,
/// `ASN1_UNIVERSALSTRING`, `ASN1_UTCTIME`, `ASN1_UTF8STRING`, and
/// `ASN1_VISIBLESTRING`. Other than `ASN1_TIME`, these correspond to universal
/// ASN.1 types. `ASN1_TIME` represents a CHOICE of UTCTime and GeneralizedTime,
/// with a cutoff of 2049, as used in Section 4.1.2.5 of RFC 5280.
///
/// For clarity, callers are encouraged to use the appropriate typedef when
/// available. They are the same type as `ASN1_STRING`, so a caller may freely
/// pass them into functions expecting `ASN1_STRING`, such as
/// `ASN1_STRING_length`.
///
/// If a function returns an `ASN1_STRING` where the typedef or ASN.1 structure
/// implies constraints on `type`, callers may assume that `type` is correct.
/// However, if a function takes an `ASN1_STRING` as input, callers must ensure
/// `type` matches. These invariants are not captured by the C type system and
/// may not be checked at runtime. For example, callers may assume the output of
/// `X509_get0_serialNumber` has type `V_ASN1_INTEGER` or `V_ASN1_NEG_INTEGER`.
/// Callers must not pass a string of type `V_ASN1_OCTET_STRING` to
/// `X509_set_serialNumber`. Doing so may break invariants on the `X509` object
/// and break the `X509_get0_serialNumber` invariant.
///
/// TODO(https://crbug.com/boringssl/445): This is very unfriendly. Getting the
/// type field wrong should not cause memory errors, but it may do strange
/// things. We should add runtime checks to anything that consumes `ASN1_STRING`s
/// from the caller.
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct asn1_string_st {
    pub length: ::core::ffi::c_int,
    pub type_: ::core::ffi::c_int,
    pub data: *mut ::core::ffi::c_uchar,
    pub flags: ::core::ffi::c_long,
}
unsafe extern "C" {
    /// ASN1_STRING_type_new returns a newly-allocated empty `ASN1_STRING` object of
    /// type `type`, or NULL on error.
    pub fn ASN1_STRING_type_new(type_: ::core::ffi::c_int) -> *mut ASN1_STRING;
}
unsafe extern "C" {
    /// ASN1_STRING_new returns a newly-allocated empty `ASN1_STRING` object with an
    /// arbitrary type. Prefer one of the type-specific constructors, such as
    /// `ASN1_OCTET_STRING_new`, or `ASN1_STRING_type_new`.
    pub fn ASN1_STRING_new() -> *mut ASN1_STRING;
}
unsafe extern "C" {
    /// ASN1_STRING_free releases memory associated with `str`.
    pub fn ASN1_STRING_free(str_: *mut ASN1_STRING);
}
unsafe extern "C" {
    /// ASN1_STRING_copy sets `dst` to a copy of `str`. It returns one on success and
    /// zero on error.
    pub fn ASN1_STRING_copy(dst: *mut ASN1_STRING, str_: *const ASN1_STRING) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_STRING_dup returns a newly-allocated copy of `str`, or NULL on error.
    pub fn ASN1_STRING_dup(str_: *const ASN1_STRING) -> *mut ASN1_STRING;
}
unsafe extern "C" {
    /// ASN1_STRING_type returns the type of `str`. This value will be one of the
    /// `V_ASN1_*` constants.
    pub fn ASN1_STRING_type(str_: *const ASN1_STRING) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_STRING_get0_data returns a pointer to `str`'s contents. Callers should
    /// use `ASN1_STRING_length` to determine the length of the string. The string
    /// may have embedded NUL bytes and may not be NUL-terminated.
    ///
    /// The contents of an `ASN1_STRING` encode the value in some type-specific
    /// representation that does not always correspond to the DER encoding of the
    /// type. See the documentation for `ASN1_STRING` for details.
    pub fn ASN1_STRING_get0_data(str_: *const ASN1_STRING) -> *const ::core::ffi::c_uchar;
}
unsafe extern "C" {
    /// ASN1_STRING_data returns a mutable pointer to `str`'s contents. Callers
    /// should use `ASN1_STRING_length` to determine the length of the string. The
    /// string may have embedded NUL bytes and may not be NUL-terminated.
    ///
    /// The contents of an `ASN1_STRING` encode the value in some type-specific
    /// representation that does not always correspond to the DER encoding of the
    /// type. See the documentation for `ASN1_STRING` for details.
    ///
    /// Prefer `ASN1_STRING_get0_data`.
    pub fn ASN1_STRING_data(str_: *mut ASN1_STRING) -> *mut ::core::ffi::c_uchar;
}
unsafe extern "C" {
    /// ASN1_STRING_length returns the length of `str`, in bytes.
    ///
    /// The contents of an `ASN1_STRING` encode the value in some type-specific
    /// representation that does not always correspond to the DER encoding of the
    /// type. See the documentation for `ASN1_STRING` for details.
    pub fn ASN1_STRING_length(str_: *const ASN1_STRING) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_STRING_cmp compares `a` and `b`'s type and contents. It returns an
    /// integer equal to, less than, or greater than zero if `a` is equal to, less
    /// than, or greater than `b`, respectively. This function compares by length,
    /// then data, then type. Note the data compared is the `ASN1_STRING` internal
    /// representation and the type order is arbitrary. While this comparison is
    /// suitable for sorting, callers should not rely on the exact order when `a`
    /// and `b` are different types.
    ///
    /// Note that, if `a` and `b` are INTEGERs, this comparison does not order the
    /// values numerically. For a numerical comparison, use `ASN1_INTEGER_cmp`.
    pub fn ASN1_STRING_cmp(a: *const ASN1_STRING, b: *const ASN1_STRING) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_STRING_set sets the contents of `str` to a copy of `len` bytes from
    /// `data`. It returns one on success and zero on error. If `data` is NULL, it
    /// updates the length and allocates the buffer as needed, but does not
    /// initialize the contents.
    ///
    /// If `str` is a BIT STRING, this function sets the number of unused bits to
    /// zero. `ASN1_BIT_STRING_set1` may be used to set a BIT STRING that is not a
    /// whole number of bytes.
    pub fn ASN1_STRING_set(
        str_: *mut ASN1_STRING,
        data: *const ::core::ffi::c_void,
        len: ossl_ssize_t,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_STRING_set0 sets the contents of `str` to `len` bytes from `data`. It
    /// takes ownership of `data`, which must have been allocated with
    /// `OPENSSL_malloc`.
    ///
    /// If `str` is a BIT STRING, this function sets the number of unused bits to
    /// zero. `ASN1_BIT_STRING_set1` may be used to set a BIT STRING that is not a
    /// whole number of bytes.
    pub fn ASN1_STRING_set0(
        str_: *mut ASN1_STRING,
        data: *mut ::core::ffi::c_void,
        len: ::core::ffi::c_int,
    );
}
unsafe extern "C" {
    /// The following functions call `ASN1_STRING_type_new` with the corresponding
    /// `V_ASN1_*` constant.
    pub fn ASN1_BMPSTRING_new() -> *mut ASN1_BMPSTRING;
}
unsafe extern "C" {
    pub fn ASN1_GENERALSTRING_new() -> *mut ASN1_GENERALSTRING;
}
unsafe extern "C" {
    pub fn ASN1_IA5STRING_new() -> *mut ASN1_IA5STRING;
}
unsafe extern "C" {
    pub fn ASN1_OCTET_STRING_new() -> *mut ASN1_OCTET_STRING;
}
unsafe extern "C" {
    pub fn ASN1_PRINTABLESTRING_new() -> *mut ASN1_PRINTABLESTRING;
}
unsafe extern "C" {
    pub fn ASN1_T61STRING_new() -> *mut ASN1_T61STRING;
}
unsafe extern "C" {
    pub fn ASN1_UNIVERSALSTRING_new() -> *mut ASN1_UNIVERSALSTRING;
}
unsafe extern "C" {
    pub fn ASN1_UTF8STRING_new() -> *mut ASN1_UTF8STRING;
}
unsafe extern "C" {
    pub fn ASN1_VISIBLESTRING_new() -> *mut ASN1_VISIBLESTRING;
}
unsafe extern "C" {
    /// The following functions call `ASN1_STRING_free`.
    pub fn ASN1_BMPSTRING_free(str_: *mut ASN1_BMPSTRING);
}
unsafe extern "C" {
    pub fn ASN1_GENERALSTRING_free(str_: *mut ASN1_GENERALSTRING);
}
unsafe extern "C" {
    pub fn ASN1_IA5STRING_free(str_: *mut ASN1_IA5STRING);
}
unsafe extern "C" {
    pub fn ASN1_OCTET_STRING_free(str_: *mut ASN1_OCTET_STRING);
}
unsafe extern "C" {
    pub fn ASN1_PRINTABLESTRING_free(str_: *mut ASN1_PRINTABLESTRING);
}
unsafe extern "C" {
    pub fn ASN1_T61STRING_free(str_: *mut ASN1_T61STRING);
}
unsafe extern "C" {
    pub fn ASN1_UNIVERSALSTRING_free(str_: *mut ASN1_UNIVERSALSTRING);
}
unsafe extern "C" {
    pub fn ASN1_UTF8STRING_free(str_: *mut ASN1_UTF8STRING);
}
unsafe extern "C" {
    pub fn ASN1_VISIBLESTRING_free(str_: *mut ASN1_VISIBLESTRING);
}
unsafe extern "C" {
    /// The following functions parse up to `len` bytes from `*inp` as a
    /// DER-encoded ASN.1 value of the corresponding type, as described in
    /// `d2i_SAMPLE`.
    pub fn d2i_ASN1_BMPSTRING(
        out: *mut *mut ASN1_BMPSTRING,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut ASN1_BMPSTRING;
}
unsafe extern "C" {
    pub fn d2i_ASN1_GENERALSTRING(
        out: *mut *mut ASN1_GENERALSTRING,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut ASN1_GENERALSTRING;
}
unsafe extern "C" {
    pub fn d2i_ASN1_IA5STRING(
        out: *mut *mut ASN1_IA5STRING,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut ASN1_IA5STRING;
}
unsafe extern "C" {
    pub fn d2i_ASN1_OCTET_STRING(
        out: *mut *mut ASN1_OCTET_STRING,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut ASN1_OCTET_STRING;
}
unsafe extern "C" {
    pub fn d2i_ASN1_PRINTABLESTRING(
        out: *mut *mut ASN1_PRINTABLESTRING,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut ASN1_PRINTABLESTRING;
}
unsafe extern "C" {
    pub fn d2i_ASN1_T61STRING(
        out: *mut *mut ASN1_T61STRING,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut ASN1_T61STRING;
}
unsafe extern "C" {
    pub fn d2i_ASN1_UNIVERSALSTRING(
        out: *mut *mut ASN1_UNIVERSALSTRING,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut ASN1_UNIVERSALSTRING;
}
unsafe extern "C" {
    pub fn d2i_ASN1_UTF8STRING(
        out: *mut *mut ASN1_UTF8STRING,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut ASN1_UTF8STRING;
}
unsafe extern "C" {
    pub fn d2i_ASN1_VISIBLESTRING(
        out: *mut *mut ASN1_VISIBLESTRING,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut ASN1_VISIBLESTRING;
}
unsafe extern "C" {
    /// The following functions marshal `in` as a DER-encoded ASN.1 value of the
    /// corresponding type, as described in `i2d_SAMPLE`.
    pub fn i2d_ASN1_BMPSTRING(in_: *const ASN1_BMPSTRING, outp: *mut *mut u8)
        -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn i2d_ASN1_GENERALSTRING(
        in_: *const ASN1_GENERALSTRING,
        outp: *mut *mut u8,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn i2d_ASN1_IA5STRING(in_: *const ASN1_IA5STRING, outp: *mut *mut u8)
        -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn i2d_ASN1_OCTET_STRING(
        in_: *const ASN1_OCTET_STRING,
        outp: *mut *mut u8,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn i2d_ASN1_PRINTABLESTRING(
        in_: *const ASN1_PRINTABLESTRING,
        outp: *mut *mut u8,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn i2d_ASN1_T61STRING(in_: *const ASN1_T61STRING, outp: *mut *mut u8)
        -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn i2d_ASN1_UNIVERSALSTRING(
        in_: *const ASN1_UNIVERSALSTRING,
        outp: *mut *mut u8,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn i2d_ASN1_UTF8STRING(
        in_: *const ASN1_UTF8STRING,
        outp: *mut *mut u8,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn i2d_ASN1_VISIBLESTRING(
        in_: *const ASN1_VISIBLESTRING,
        outp: *mut *mut u8,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// The following `ASN1_ITEM`s have the ASN.1 type referred to in their name and
    /// C type `ASN1_STRING*`. The C type may also be written as the corresponding
    /// typedef.
    pub static ASN1_BMPSTRING_it: ASN1_ITEM;
}
unsafe extern "C" {
    /// The following `ASN1_ITEM`s have the ASN.1 type referred to in their name and
    /// C type `ASN1_STRING*`. The C type may also be written as the corresponding
    /// typedef.
    pub static ASN1_GENERALSTRING_it: ASN1_ITEM;
}
unsafe extern "C" {
    /// The following `ASN1_ITEM`s have the ASN.1 type referred to in their name and
    /// C type `ASN1_STRING*`. The C type may also be written as the corresponding
    /// typedef.
    pub static ASN1_IA5STRING_it: ASN1_ITEM;
}
unsafe extern "C" {
    /// The following `ASN1_ITEM`s have the ASN.1 type referred to in their name and
    /// C type `ASN1_STRING*`. The C type may also be written as the corresponding
    /// typedef.
    pub static ASN1_OCTET_STRING_it: ASN1_ITEM;
}
unsafe extern "C" {
    /// The following `ASN1_ITEM`s have the ASN.1 type referred to in their name and
    /// C type `ASN1_STRING*`. The C type may also be written as the corresponding
    /// typedef.
    pub static ASN1_PRINTABLESTRING_it: ASN1_ITEM;
}
unsafe extern "C" {
    /// The following `ASN1_ITEM`s have the ASN.1 type referred to in their name and
    /// C type `ASN1_STRING*`. The C type may also be written as the corresponding
    /// typedef.
    pub static ASN1_T61STRING_it: ASN1_ITEM;
}
unsafe extern "C" {
    /// The following `ASN1_ITEM`s have the ASN.1 type referred to in their name and
    /// C type `ASN1_STRING*`. The C type may also be written as the corresponding
    /// typedef.
    pub static ASN1_UNIVERSALSTRING_it: ASN1_ITEM;
}
unsafe extern "C" {
    /// The following `ASN1_ITEM`s have the ASN.1 type referred to in their name and
    /// C type `ASN1_STRING*`. The C type may also be written as the corresponding
    /// typedef.
    pub static ASN1_UTF8STRING_it: ASN1_ITEM;
}
unsafe extern "C" {
    /// The following `ASN1_ITEM`s have the ASN.1 type referred to in their name and
    /// C type `ASN1_STRING*`. The C type may also be written as the corresponding
    /// typedef.
    pub static ASN1_VISIBLESTRING_it: ASN1_ITEM;
}
unsafe extern "C" {
    /// ASN1_OCTET_STRING_dup calls `ASN1_STRING_dup`.
    pub fn ASN1_OCTET_STRING_dup(a: *const ASN1_OCTET_STRING) -> *mut ASN1_OCTET_STRING;
}
unsafe extern "C" {
    /// ASN1_OCTET_STRING_cmp calls `ASN1_STRING_cmp`.
    pub fn ASN1_OCTET_STRING_cmp(
        a: *const ASN1_OCTET_STRING,
        b: *const ASN1_OCTET_STRING,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_OCTET_STRING_set calls `ASN1_STRING_set`.
    pub fn ASN1_OCTET_STRING_set(
        str_: *mut ASN1_OCTET_STRING,
        data: *const ::core::ffi::c_uchar,
        len: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_STRING_to_UTF8 converts `in` to UTF-8. On success, sets `*out` to a
    /// newly-allocated buffer containing the resulting string and returns the length
    /// of the string. The caller must call `OPENSSL_free` to release `*out` when
    /// done. On error, it returns a negative number.
    pub fn ASN1_STRING_to_UTF8(
        out: *mut *mut ::core::ffi::c_uchar,
        in_: *const ASN1_STRING,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_mbstring_copy converts `len` bytes from `in` to an ASN.1 string. If
    /// `len` is -1, `in` must be NUL-terminated and the length is determined by
    /// `strlen`. `in` is decoded according to `inform`, which must be one of
    /// `MBSTRING_*`. `mask` determines the set of valid output types and is a
    /// bitmask containing a subset of `B_ASN1_PRINTABLESTRING`, `B_ASN1_IA5STRING`,
    /// `B_ASN1_T61STRING`, `B_ASN1_BMPSTRING`, `B_ASN1_UNIVERSALSTRING`, and
    /// `B_ASN1_UTF8STRING`, in that preference order. This function chooses the
    /// first output type in `mask` which can represent `in`. It interprets T61String
    /// as Latin-1, rather than T.61.
    ///
    /// If `mask` is zero, `DIRSTRING_TYPE` is used by default.
    ///
    /// On success, this function returns the `V_ASN1_*` constant corresponding to
    /// the selected output type and, if `out` and `*out` are both non-NULL, updates
    /// the object at `*out` with the result. If `out` is non-NULL and `*out` is
    /// NULL, it instead sets `*out` to a newly-allocated `ASN1_STRING` containing
    /// the result. If `out` is NULL, it returns the selected output type without
    /// constructing an `ASN1_STRING`. On error, this function returns -1.
    pub fn ASN1_mbstring_copy(
        out: *mut *mut ASN1_STRING,
        in_: *const u8,
        len: ossl_ssize_t,
        inform: ::core::ffi::c_int,
        mask: ::core::ffi::c_ulong,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_mbstring_ncopy behaves like `ASN1_mbstring_copy` but returns an error if
    /// the input is less than `minsize` or greater than `maxsize` codepoints long. A
    /// `maxsize` value of zero is ignored. Note the sizes are measured in
    /// codepoints, not output bytes.
    pub fn ASN1_mbstring_ncopy(
        out: *mut *mut ASN1_STRING,
        in_: *const u8,
        len: ossl_ssize_t,
        inform: ::core::ffi::c_int,
        mask: ::core::ffi::c_ulong,
        minsize: ossl_ssize_t,
        maxsize: ossl_ssize_t,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_STRING_set_by_NID behaves like `ASN1_mbstring_ncopy`, but determines
    /// `mask`, `minsize`, and `maxsize` based on `nid`. When `nid` is a recognized
    /// X.509 attribute type, it will pick a suitable ASN.1 string type and bounds.
    /// For most attribute types, it preferentially chooses UTF8String. If `nid` is
    /// unrecognized, it uses UTF8String by default. This function will also enforce
    /// any known attribute-specific constraints on the sizes of the string and fail
    /// if the size is invalid. In RFC 5280, these bounds are specified by
    /// constraints like "SIZE (1..ub-common-name)" in ASN.1.
    ///
    /// Slightly unlike `ASN1_mbstring_ncopy`, this function interprets `out` and
    /// returns its result as follows: If `out` is NULL, it returns a newly-allocated
    /// `ASN1_STRING` containing the result. If `out` is non-NULL and
    /// `*out` is NULL, it additionally sets `*out` to the result. If both `out` and
    /// `*out` are non-NULL, it instead updates the object at `*out` and returns
    /// `*out`. In all cases, it returns NULL on error.
    ///
    /// This function supports the following NIDs: `NID_countryName`,
    /// `NID_dnQualifier`, `NID_domainComponent`, `NID_friendlyName`,
    /// `NID_givenName`, `NID_initials`, `NID_localityName`, `NID_ms_csp_name`,
    /// `NID_name`, `NID_organizationalUnitName`, `NID_organizationName`,
    /// `NID_pkcs9_challengePassword`, `NID_pkcs9_emailAddress`,
    /// `NID_pkcs9_unstructuredAddress`, `NID_pkcs9_unstructuredName`,
    /// `NID_serialNumber`, `NID_stateOrProvinceName`, and `NID_surname`. Additional
    /// NIDs may be registered with `ASN1_STRING_set_by_NID`, but it is recommended
    /// to call `ASN1_mbstring_ncopy` directly instead.
    pub fn ASN1_STRING_set_by_NID(
        out: *mut *mut ASN1_STRING,
        in_: *const ::core::ffi::c_uchar,
        len: ossl_ssize_t,
        inform: ::core::ffi::c_int,
        nid: ::core::ffi::c_int,
    ) -> *mut ASN1_STRING;
}
unsafe extern "C" {
    /// ASN1_STRING_TABLE_add registers the corresponding parameters with `nid`, for
    /// use with `ASN1_STRING_set_by_NID`. It returns one on success and zero on
    /// error. It is an error to call this function if `nid` is a built-in NID, or
    /// was already registered by a previous call.
    ///
    /// WARNING: This function affects global state in the library. If two libraries
    /// in the same address space register information for the same OID, one call
    /// will fail. Prefer directly passing the desired parameters to
    /// `ASN1_mbstring_copy` or `ASN1_mbstring_ncopy` instead.
    pub fn ASN1_STRING_TABLE_add(
        nid: ::core::ffi::c_int,
        minsize: ::core::ffi::c_long,
        maxsize: ::core::ffi::c_long,
        mask: ::core::ffi::c_ulong,
        flags: ::core::ffi::c_ulong,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// DIRECTORYSTRING_new returns a newly-allocated `ASN1_STRING` with type -1, or
    /// NULL on error. The resulting `ASN1_STRING` is not a valid X.509
    /// DirectoryString until initialized with a value.
    pub fn DIRECTORYSTRING_new() -> *mut ASN1_STRING;
}
unsafe extern "C" {
    /// DIRECTORYSTRING_free calls `ASN1_STRING_free`.
    pub fn DIRECTORYSTRING_free(str_: *mut ASN1_STRING);
}
unsafe extern "C" {
    /// d2i_DIRECTORYSTRING parses up to `len` bytes from `*inp` as a DER-encoded
    /// X.509 DirectoryString (RFC 5280), as described in `d2i_SAMPLE`.
    ///
    /// TODO(https://crbug.com/boringssl/354): This function currently also accepts
    /// BER, but this will be removed in the future.
    ///
    /// TODO(https://crbug.com/boringssl/449): DirectoryString's non-empty string
    /// requirement is not currently enforced.
    pub fn d2i_DIRECTORYSTRING(
        out: *mut *mut ASN1_STRING,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut ASN1_STRING;
}
unsafe extern "C" {
    /// i2d_DIRECTORYSTRING marshals `in` as a DER-encoded X.509 DirectoryString (RFC
    /// 5280), as described in `i2d_SAMPLE`.
    pub fn i2d_DIRECTORYSTRING(in_: *const ASN1_STRING, outp: *mut *mut u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// DISPLAYTEXT_new returns a newly-allocated `ASN1_STRING` with type -1, or NULL
    /// on error. The resulting `ASN1_STRING` is not a valid X.509 DisplayText until
    /// initialized with a value.
    pub fn DISPLAYTEXT_new() -> *mut ASN1_STRING;
}
unsafe extern "C" {
    /// DISPLAYTEXT_free calls `ASN1_STRING_free`.
    pub fn DISPLAYTEXT_free(str_: *mut ASN1_STRING);
}
unsafe extern "C" {
    /// d2i_DISPLAYTEXT parses up to `len` bytes from `*inp` as a DER-encoded X.509
    /// DisplayText (RFC 5280), as described in `d2i_SAMPLE`.
    ///
    /// TODO(https://crbug.com/boringssl/354): This function currently also accepts
    /// BER, but this will be removed in the future.
    ///
    /// TODO(https://crbug.com/boringssl/449): DisplayText's size limits are not
    /// currently enforced.
    pub fn d2i_DISPLAYTEXT(
        out: *mut *mut ASN1_STRING,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut ASN1_STRING;
}
unsafe extern "C" {
    /// i2d_DISPLAYTEXT marshals `in` as a DER-encoded X.509 DisplayText (RFC 5280),
    /// as described in `i2d_SAMPLE`.
    pub fn i2d_DISPLAYTEXT(in_: *const ASN1_STRING, outp: *mut *mut u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_BIT_STRING_new calls `ASN1_STRING_type_new` with `V_ASN1_BIT_STRING`.
    pub fn ASN1_BIT_STRING_new() -> *mut ASN1_BIT_STRING;
}
unsafe extern "C" {
    /// ASN1_BIT_STRING_free calls `ASN1_STRING_free`.
    pub fn ASN1_BIT_STRING_free(str_: *mut ASN1_BIT_STRING);
}
unsafe extern "C" {
    /// d2i_ASN1_BIT_STRING parses up to `len` bytes from `*inp` as a DER-encoded
    /// ASN.1 BIT STRING, as described in `d2i_SAMPLE`.
    pub fn d2i_ASN1_BIT_STRING(
        out: *mut *mut ASN1_BIT_STRING,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut ASN1_BIT_STRING;
}
unsafe extern "C" {
    /// i2d_ASN1_BIT_STRING marshals `in` as a DER-encoded ASN.1 BIT STRING, as
    /// described in `i2d_SAMPLE`.
    pub fn i2d_ASN1_BIT_STRING(
        in_: *const ASN1_BIT_STRING,
        outp: *mut *mut u8,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// c2i_ASN1_BIT_STRING decodes `len` bytes from `*inp` as the contents of a
    /// DER-encoded BIT STRING, excluding the tag and length. It behaves like
    /// `d2i_SAMPLE` except, on success, it always consumes all `len` bytes.
    pub fn c2i_ASN1_BIT_STRING(
        out: *mut *mut ASN1_BIT_STRING,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut ASN1_BIT_STRING;
}
unsafe extern "C" {
    /// i2c_ASN1_BIT_STRING encodes `in` as the contents of a DER-encoded BIT STRING,
    /// excluding the tag and length. If `outp` is non-NULL, it writes the result to
    /// `*outp`, advances `*outp` just past the output, and returns the number of
    /// bytes written. `*outp` must have space available for the result. If `outp` is
    /// NULL, it returns the number of bytes without writing anything. On error, it
    /// returns a value <= 0.
    ///
    /// Note this function differs slightly from `i2d_SAMPLE`. If `outp` is non-NULL
    /// and `*outp` is NULL, it does not allocate a new buffer.
    ///
    /// TODO(davidben): This function currently returns zero on error instead of -1,
    /// but it is also mostly infallible. I've currently documented <= 0 to suggest
    /// callers work with both.
    pub fn i2c_ASN1_BIT_STRING(
        in_: *const ASN1_BIT_STRING,
        outp: *mut *mut u8,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_BIT_STRING is an `ASN1_ITEM` with ASN.1 type BIT STRING and C type
    /// `ASN1_BIT_STRING*`.
    pub static ASN1_BIT_STRING_it: ASN1_ITEM;
}
unsafe extern "C" {
    /// ASN1_BIT_STRING_unused_bits returns the number of unused bits in the last
    /// byte of `str`. If `str` is empty (i.e. `ASN1_STRING_length` is zero), this
    /// always returns zero. Otherwise it returns a number between 0 and 7.
    pub fn ASN1_BIT_STRING_unused_bits(str_: *const ASN1_BIT_STRING) -> u8;
}
unsafe extern "C" {
    /// ASN1_BIT_STRING_set calls `ASN1_STRING_set`.
    pub fn ASN1_BIT_STRING_set(
        str_: *mut ASN1_BIT_STRING,
        data: *const u8,
        length: ossl_ssize_t,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_BIT_STRING_set1 sets `str` to a BIT STRING containing `length` bytes
    /// from `data`. It returns one on success and zero on error. The least
    /// significant `unused_bits` of the last byte of `data` are removed from the bit
    /// string. The removed bits must all be zero. `unused_bits` must be between 0
    /// and 7, and must be 0 if `length` is zero.
    pub fn ASN1_BIT_STRING_set1(
        str_: *mut ASN1_BIT_STRING,
        data: *const u8,
        length: usize,
        unused_bits: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_BIT_STRING_set_bit sets bit `n` of `str` to one if `value` is non-zero
    /// and zero if `value` is zero, resizing `str` as needed. It then truncates
    /// trailing zeros in `str` to align with the DER representation for a bit string
    /// with named bits. It returns one on success and zero on error. `n` is indexed
    /// beginning from zero.
    pub fn ASN1_BIT_STRING_set_bit(
        str_: *mut ASN1_BIT_STRING,
        n: ::core::ffi::c_int,
        value: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_BIT_STRING_get_bit returns one if bit `n` of `a` is in bounds and set,
    /// and zero otherwise. `n` is indexed beginning from zero.
    pub fn ASN1_BIT_STRING_get_bit(
        str_: *const ASN1_BIT_STRING,
        n: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_BIT_STRING_check returns one if `str` only contains bits that are set in
    /// the `flags_len` bytes pointed by `flags`. Otherwise it returns zero. Bits in
    /// `flags` are arranged according to the DER representation, so bit 0
    /// corresponds to the MSB of `flags[0]`.
    pub fn ASN1_BIT_STRING_check(
        str_: *const ASN1_BIT_STRING,
        flags: *const ::core::ffi::c_uchar,
        flags_len: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
/// Integers and enumerated values.
///
/// INTEGER and ENUMERATED values are represented as `ASN1_STRING`s where the
/// data contains the big-endian encoding of the absolute value of the integer.
/// The sign bit is encoded in the type: non-negative values have a type of
/// `V_ASN1_INTEGER` or `V_ASN1_ENUMERATED`, while negative values have a type of
/// `V_ASN1_NEG_INTEGER` or `V_ASN1_NEG_ENUMERATED`. Note this differs from DER's
/// two's complement representation.
///
/// The data in the `ASN1_STRING` may not have leading zeros. Note this means
/// zero is represented as the empty string. Parsing functions will never return
/// invalid representations. If an invalid input is constructed, the marshaling
/// functions will skip leading zeros, however other functions, such as
/// `ASN1_INTEGER_cmp` or `ASN1_INTEGER_get`, may not return the correct result.
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct stack_st_ASN1_INTEGER {
    _unused: [u8; 0],
}
/// Integers and enumerated values.
///
/// INTEGER and ENUMERATED values are represented as `ASN1_STRING`s where the
/// data contains the big-endian encoding of the absolute value of the integer.
/// The sign bit is encoded in the type: non-negative values have a type of
/// `V_ASN1_INTEGER` or `V_ASN1_ENUMERATED`, while negative values have a type of
/// `V_ASN1_NEG_INTEGER` or `V_ASN1_NEG_ENUMERATED`. Note this differs from DER's
/// two's complement representation.
///
/// The data in the `ASN1_STRING` may not have leading zeros. Note this means
/// zero is represented as the empty string. Parsing functions will never return
/// invalid representations. If an invalid input is constructed, the marshaling
/// functions will skip leading zeros, however other functions, such as
/// `ASN1_INTEGER_cmp` or `ASN1_INTEGER_get`, may not return the correct result.
pub type sk_ASN1_INTEGER_free_func =
    ::core::option::Option<unsafe extern "C" fn(arg1: *mut ASN1_INTEGER)>;
/// Integers and enumerated values.
///
/// INTEGER and ENUMERATED values are represented as `ASN1_STRING`s where the
/// data contains the big-endian encoding of the absolute value of the integer.
/// The sign bit is encoded in the type: non-negative values have a type of
/// `V_ASN1_INTEGER` or `V_ASN1_ENUMERATED`, while negative values have a type of
/// `V_ASN1_NEG_INTEGER` or `V_ASN1_NEG_ENUMERATED`. Note this differs from DER's
/// two's complement representation.
///
/// The data in the `ASN1_STRING` may not have leading zeros. Note this means
/// zero is represented as the empty string. Parsing functions will never return
/// invalid representations. If an invalid input is constructed, the marshaling
/// functions will skip leading zeros, however other functions, such as
/// `ASN1_INTEGER_cmp` or `ASN1_INTEGER_get`, may not return the correct result.
pub type sk_ASN1_INTEGER_copy_func =
    ::core::option::Option<unsafe extern "C" fn(arg1: *const ASN1_INTEGER) -> *mut ASN1_INTEGER>;
/// Integers and enumerated values.
///
/// INTEGER and ENUMERATED values are represented as `ASN1_STRING`s where the
/// data contains the big-endian encoding of the absolute value of the integer.
/// The sign bit is encoded in the type: non-negative values have a type of
/// `V_ASN1_INTEGER` or `V_ASN1_ENUMERATED`, while negative values have a type of
/// `V_ASN1_NEG_INTEGER` or `V_ASN1_NEG_ENUMERATED`. Note this differs from DER's
/// two's complement representation.
///
/// The data in the `ASN1_STRING` may not have leading zeros. Note this means
/// zero is represented as the empty string. Parsing functions will never return
/// invalid representations. If an invalid input is constructed, the marshaling
/// functions will skip leading zeros, however other functions, such as
/// `ASN1_INTEGER_cmp` or `ASN1_INTEGER_get`, may not return the correct result.
pub type sk_ASN1_INTEGER_cmp_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *const *const ASN1_INTEGER,
        arg2: *const *const ASN1_INTEGER,
    ) -> ::core::ffi::c_int,
>;
/// Integers and enumerated values.
///
/// INTEGER and ENUMERATED values are represented as `ASN1_STRING`s where the
/// data contains the big-endian encoding of the absolute value of the integer.
/// The sign bit is encoded in the type: non-negative values have a type of
/// `V_ASN1_INTEGER` or `V_ASN1_ENUMERATED`, while negative values have a type of
/// `V_ASN1_NEG_INTEGER` or `V_ASN1_NEG_ENUMERATED`. Note this differs from DER's
/// two's complement representation.
///
/// The data in the `ASN1_STRING` may not have leading zeros. Note this means
/// zero is represented as the empty string. Parsing functions will never return
/// invalid representations. If an invalid input is constructed, the marshaling
/// functions will skip leading zeros, however other functions, such as
/// `ASN1_INTEGER_cmp` or `ASN1_INTEGER_get`, may not return the correct result.
pub type sk_ASN1_INTEGER_delete_if_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *mut ASN1_INTEGER,
        arg2: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int,
>;
unsafe extern "C" {
    /// Integers and enumerated values.
    ///
    /// INTEGER and ENUMERATED values are represented as `ASN1_STRING`s where the
    /// data contains the big-endian encoding of the absolute value of the integer.
    /// The sign bit is encoded in the type: non-negative values have a type of
    /// `V_ASN1_INTEGER` or `V_ASN1_ENUMERATED`, while negative values have a type of
    /// `V_ASN1_NEG_INTEGER` or `V_ASN1_NEG_ENUMERATED`. Note this differs from DER's
    /// two's complement representation.
    ///
    /// The data in the `ASN1_STRING` may not have leading zeros. Note this means
    /// zero is represented as the empty string. Parsing functions will never return
    /// invalid representations. If an invalid input is constructed, the marshaling
    /// functions will skip leading zeros, however other functions, such as
    /// `ASN1_INTEGER_cmp` or `ASN1_INTEGER_get`, may not return the correct result.
    #[link_name = "sk_ASN1_INTEGER_call_free_func__extern"]
    pub fn sk_ASN1_INTEGER_call_free_func(
        free_func: OPENSSL_sk_free_func,
        ptr: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    /// Integers and enumerated values.
    ///
    /// INTEGER and ENUMERATED values are represented as `ASN1_STRING`s where the
    /// data contains the big-endian encoding of the absolute value of the integer.
    /// The sign bit is encoded in the type: non-negative values have a type of
    /// `V_ASN1_INTEGER` or `V_ASN1_ENUMERATED`, while negative values have a type of
    /// `V_ASN1_NEG_INTEGER` or `V_ASN1_NEG_ENUMERATED`. Note this differs from DER's
    /// two's complement representation.
    ///
    /// The data in the `ASN1_STRING` may not have leading zeros. Note this means
    /// zero is represented as the empty string. Parsing functions will never return
    /// invalid representations. If an invalid input is constructed, the marshaling
    /// functions will skip leading zeros, however other functions, such as
    /// `ASN1_INTEGER_cmp` or `ASN1_INTEGER_get`, may not return the correct result.
    #[link_name = "sk_ASN1_INTEGER_call_copy_func__extern"]
    pub fn sk_ASN1_INTEGER_call_copy_func(
        copy_func: OPENSSL_sk_copy_func,
        ptr: *const ::core::ffi::c_void,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    /// Integers and enumerated values.
    ///
    /// INTEGER and ENUMERATED values are represented as `ASN1_STRING`s where the
    /// data contains the big-endian encoding of the absolute value of the integer.
    /// The sign bit is encoded in the type: non-negative values have a type of
    /// `V_ASN1_INTEGER` or `V_ASN1_ENUMERATED`, while negative values have a type of
    /// `V_ASN1_NEG_INTEGER` or `V_ASN1_NEG_ENUMERATED`. Note this differs from DER's
    /// two's complement representation.
    ///
    /// The data in the `ASN1_STRING` may not have leading zeros. Note this means
    /// zero is represented as the empty string. Parsing functions will never return
    /// invalid representations. If an invalid input is constructed, the marshaling
    /// functions will skip leading zeros, however other functions, such as
    /// `ASN1_INTEGER_cmp` or `ASN1_INTEGER_get`, may not return the correct result.
    #[link_name = "sk_ASN1_INTEGER_call_cmp_func__extern"]
    pub fn sk_ASN1_INTEGER_call_cmp_func(
        cmp_func: OPENSSL_sk_cmp_func,
        a: *const ::core::ffi::c_void,
        b: *const ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Integers and enumerated values.
    ///
    /// INTEGER and ENUMERATED values are represented as `ASN1_STRING`s where the
    /// data contains the big-endian encoding of the absolute value of the integer.
    /// The sign bit is encoded in the type: non-negative values have a type of
    /// `V_ASN1_INTEGER` or `V_ASN1_ENUMERATED`, while negative values have a type of
    /// `V_ASN1_NEG_INTEGER` or `V_ASN1_NEG_ENUMERATED`. Note this differs from DER's
    /// two's complement representation.
    ///
    /// The data in the `ASN1_STRING` may not have leading zeros. Note this means
    /// zero is represented as the empty string. Parsing functions will never return
    /// invalid representations. If an invalid input is constructed, the marshaling
    /// functions will skip leading zeros, however other functions, such as
    /// `ASN1_INTEGER_cmp` or `ASN1_INTEGER_get`, may not return the correct result.
    #[link_name = "sk_ASN1_INTEGER_call_delete_if_func__extern"]
    pub fn sk_ASN1_INTEGER_call_delete_if_func(
        func: OPENSSL_sk_delete_if_func,
        obj: *mut ::core::ffi::c_void,
        data: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Integers and enumerated values.
    ///
    /// INTEGER and ENUMERATED values are represented as `ASN1_STRING`s where the
    /// data contains the big-endian encoding of the absolute value of the integer.
    /// The sign bit is encoded in the type: non-negative values have a type of
    /// `V_ASN1_INTEGER` or `V_ASN1_ENUMERATED`, while negative values have a type of
    /// `V_ASN1_NEG_INTEGER` or `V_ASN1_NEG_ENUMERATED`. Note this differs from DER's
    /// two's complement representation.
    ///
    /// The data in the `ASN1_STRING` may not have leading zeros. Note this means
    /// zero is represented as the empty string. Parsing functions will never return
    /// invalid representations. If an invalid input is constructed, the marshaling
    /// functions will skip leading zeros, however other functions, such as
    /// `ASN1_INTEGER_cmp` or `ASN1_INTEGER_get`, may not return the correct result.
    #[link_name = "sk_ASN1_INTEGER_new__extern"]
    pub fn sk_ASN1_INTEGER_new(comp: sk_ASN1_INTEGER_cmp_func) -> *mut stack_st_ASN1_INTEGER;
}
unsafe extern "C" {
    /// Integers and enumerated values.
    ///
    /// INTEGER and ENUMERATED values are represented as `ASN1_STRING`s where the
    /// data contains the big-endian encoding of the absolute value of the integer.
    /// The sign bit is encoded in the type: non-negative values have a type of
    /// `V_ASN1_INTEGER` or `V_ASN1_ENUMERATED`, while negative values have a type of
    /// `V_ASN1_NEG_INTEGER` or `V_ASN1_NEG_ENUMERATED`. Note this differs from DER's
    /// two's complement representation.
    ///
    /// The data in the `ASN1_STRING` may not have leading zeros. Note this means
    /// zero is represented as the empty string. Parsing functions will never return
    /// invalid representations. If an invalid input is constructed, the marshaling
    /// functions will skip leading zeros, however other functions, such as
    /// `ASN1_INTEGER_cmp` or `ASN1_INTEGER_get`, may not return the correct result.
    #[link_name = "sk_ASN1_INTEGER_new_null__extern"]
    pub fn sk_ASN1_INTEGER_new_null() -> *mut stack_st_ASN1_INTEGER;
}
unsafe extern "C" {
    /// Integers and enumerated values.
    ///
    /// INTEGER and ENUMERATED values are represented as `ASN1_STRING`s where the
    /// data contains the big-endian encoding of the absolute value of the integer.
    /// The sign bit is encoded in the type: non-negative values have a type of
    /// `V_ASN1_INTEGER` or `V_ASN1_ENUMERATED`, while negative values have a type of
    /// `V_ASN1_NEG_INTEGER` or `V_ASN1_NEG_ENUMERATED`. Note this differs from DER's
    /// two's complement representation.
    ///
    /// The data in the `ASN1_STRING` may not have leading zeros. Note this means
    /// zero is represented as the empty string. Parsing functions will never return
    /// invalid representations. If an invalid input is constructed, the marshaling
    /// functions will skip leading zeros, however other functions, such as
    /// `ASN1_INTEGER_cmp` or `ASN1_INTEGER_get`, may not return the correct result.
    #[link_name = "sk_ASN1_INTEGER_num__extern"]
    pub fn sk_ASN1_INTEGER_num(sk: *const stack_st_ASN1_INTEGER) -> usize;
}
unsafe extern "C" {
    /// Integers and enumerated values.
    ///
    /// INTEGER and ENUMERATED values are represented as `ASN1_STRING`s where the
    /// data contains the big-endian encoding of the absolute value of the integer.
    /// The sign bit is encoded in the type: non-negative values have a type of
    /// `V_ASN1_INTEGER` or `V_ASN1_ENUMERATED`, while negative values have a type of
    /// `V_ASN1_NEG_INTEGER` or `V_ASN1_NEG_ENUMERATED`. Note this differs from DER's
    /// two's complement representation.
    ///
    /// The data in the `ASN1_STRING` may not have leading zeros. Note this means
    /// zero is represented as the empty string. Parsing functions will never return
    /// invalid representations. If an invalid input is constructed, the marshaling
    /// functions will skip leading zeros, however other functions, such as
    /// `ASN1_INTEGER_cmp` or `ASN1_INTEGER_get`, may not return the correct result.
    #[link_name = "sk_ASN1_INTEGER_zero__extern"]
    pub fn sk_ASN1_INTEGER_zero(sk: *mut stack_st_ASN1_INTEGER);
}
unsafe extern "C" {
    /// Integers and enumerated values.
    ///
    /// INTEGER and ENUMERATED values are represented as `ASN1_STRING`s where the
    /// data contains the big-endian encoding of the absolute value of the integer.
    /// The sign bit is encoded in the type: non-negative values have a type of
    /// `V_ASN1_INTEGER` or `V_ASN1_ENUMERATED`, while negative values have a type of
    /// `V_ASN1_NEG_INTEGER` or `V_ASN1_NEG_ENUMERATED`. Note this differs from DER's
    /// two's complement representation.
    ///
    /// The data in the `ASN1_STRING` may not have leading zeros. Note this means
    /// zero is represented as the empty string. Parsing functions will never return
    /// invalid representations. If an invalid input is constructed, the marshaling
    /// functions will skip leading zeros, however other functions, such as
    /// `ASN1_INTEGER_cmp` or `ASN1_INTEGER_get`, may not return the correct result.
    #[link_name = "sk_ASN1_INTEGER_value__extern"]
    pub fn sk_ASN1_INTEGER_value(sk: *const stack_st_ASN1_INTEGER, i: usize) -> *mut ASN1_INTEGER;
}
unsafe extern "C" {
    /// Integers and enumerated values.
    ///
    /// INTEGER and ENUMERATED values are represented as `ASN1_STRING`s where the
    /// data contains the big-endian encoding of the absolute value of the integer.
    /// The sign bit is encoded in the type: non-negative values have a type of
    /// `V_ASN1_INTEGER` or `V_ASN1_ENUMERATED`, while negative values have a type of
    /// `V_ASN1_NEG_INTEGER` or `V_ASN1_NEG_ENUMERATED`. Note this differs from DER's
    /// two's complement representation.
    ///
    /// The data in the `ASN1_STRING` may not have leading zeros. Note this means
    /// zero is represented as the empty string. Parsing functions will never return
    /// invalid representations. If an invalid input is constructed, the marshaling
    /// functions will skip leading zeros, however other functions, such as
    /// `ASN1_INTEGER_cmp` or `ASN1_INTEGER_get`, may not return the correct result.
    #[link_name = "sk_ASN1_INTEGER_set__extern"]
    pub fn sk_ASN1_INTEGER_set(
        sk: *mut stack_st_ASN1_INTEGER,
        i: usize,
        p: *mut ASN1_INTEGER,
    ) -> *mut ASN1_INTEGER;
}
unsafe extern "C" {
    /// Integers and enumerated values.
    ///
    /// INTEGER and ENUMERATED values are represented as `ASN1_STRING`s where the
    /// data contains the big-endian encoding of the absolute value of the integer.
    /// The sign bit is encoded in the type: non-negative values have a type of
    /// `V_ASN1_INTEGER` or `V_ASN1_ENUMERATED`, while negative values have a type of
    /// `V_ASN1_NEG_INTEGER` or `V_ASN1_NEG_ENUMERATED`. Note this differs from DER's
    /// two's complement representation.
    ///
    /// The data in the `ASN1_STRING` may not have leading zeros. Note this means
    /// zero is represented as the empty string. Parsing functions will never return
    /// invalid representations. If an invalid input is constructed, the marshaling
    /// functions will skip leading zeros, however other functions, such as
    /// `ASN1_INTEGER_cmp` or `ASN1_INTEGER_get`, may not return the correct result.
    #[link_name = "sk_ASN1_INTEGER_free__extern"]
    pub fn sk_ASN1_INTEGER_free(sk: *mut stack_st_ASN1_INTEGER);
}
unsafe extern "C" {
    /// Integers and enumerated values.
    ///
    /// INTEGER and ENUMERATED values are represented as `ASN1_STRING`s where the
    /// data contains the big-endian encoding of the absolute value of the integer.
    /// The sign bit is encoded in the type: non-negative values have a type of
    /// `V_ASN1_INTEGER` or `V_ASN1_ENUMERATED`, while negative values have a type of
    /// `V_ASN1_NEG_INTEGER` or `V_ASN1_NEG_ENUMERATED`. Note this differs from DER's
    /// two's complement representation.
    ///
    /// The data in the `ASN1_STRING` may not have leading zeros. Note this means
    /// zero is represented as the empty string. Parsing functions will never return
    /// invalid representations. If an invalid input is constructed, the marshaling
    /// functions will skip leading zeros, however other functions, such as
    /// `ASN1_INTEGER_cmp` or `ASN1_INTEGER_get`, may not return the correct result.
    #[link_name = "sk_ASN1_INTEGER_pop_free__extern"]
    pub fn sk_ASN1_INTEGER_pop_free(
        sk: *mut stack_st_ASN1_INTEGER,
        free_func: sk_ASN1_INTEGER_free_func,
    );
}
unsafe extern "C" {
    /// Integers and enumerated values.
    ///
    /// INTEGER and ENUMERATED values are represented as `ASN1_STRING`s where the
    /// data contains the big-endian encoding of the absolute value of the integer.
    /// The sign bit is encoded in the type: non-negative values have a type of
    /// `V_ASN1_INTEGER` or `V_ASN1_ENUMERATED`, while negative values have a type of
    /// `V_ASN1_NEG_INTEGER` or `V_ASN1_NEG_ENUMERATED`. Note this differs from DER's
    /// two's complement representation.
    ///
    /// The data in the `ASN1_STRING` may not have leading zeros. Note this means
    /// zero is represented as the empty string. Parsing functions will never return
    /// invalid representations. If an invalid input is constructed, the marshaling
    /// functions will skip leading zeros, however other functions, such as
    /// `ASN1_INTEGER_cmp` or `ASN1_INTEGER_get`, may not return the correct result.
    #[link_name = "sk_ASN1_INTEGER_insert__extern"]
    pub fn sk_ASN1_INTEGER_insert(
        sk: *mut stack_st_ASN1_INTEGER,
        p: *mut ASN1_INTEGER,
        where_: usize,
    ) -> usize;
}
unsafe extern "C" {
    /// Integers and enumerated values.
    ///
    /// INTEGER and ENUMERATED values are represented as `ASN1_STRING`s where the
    /// data contains the big-endian encoding of the absolute value of the integer.
    /// The sign bit is encoded in the type: non-negative values have a type of
    /// `V_ASN1_INTEGER` or `V_ASN1_ENUMERATED`, while negative values have a type of
    /// `V_ASN1_NEG_INTEGER` or `V_ASN1_NEG_ENUMERATED`. Note this differs from DER's
    /// two's complement representation.
    ///
    /// The data in the `ASN1_STRING` may not have leading zeros. Note this means
    /// zero is represented as the empty string. Parsing functions will never return
    /// invalid representations. If an invalid input is constructed, the marshaling
    /// functions will skip leading zeros, however other functions, such as
    /// `ASN1_INTEGER_cmp` or `ASN1_INTEGER_get`, may not return the correct result.
    #[link_name = "sk_ASN1_INTEGER_delete__extern"]
    pub fn sk_ASN1_INTEGER_delete(
        sk: *mut stack_st_ASN1_INTEGER,
        where_: usize,
    ) -> *mut ASN1_INTEGER;
}
unsafe extern "C" {
    /// Integers and enumerated values.
    ///
    /// INTEGER and ENUMERATED values are represented as `ASN1_STRING`s where the
    /// data contains the big-endian encoding of the absolute value of the integer.
    /// The sign bit is encoded in the type: non-negative values have a type of
    /// `V_ASN1_INTEGER` or `V_ASN1_ENUMERATED`, while negative values have a type of
    /// `V_ASN1_NEG_INTEGER` or `V_ASN1_NEG_ENUMERATED`. Note this differs from DER's
    /// two's complement representation.
    ///
    /// The data in the `ASN1_STRING` may not have leading zeros. Note this means
    /// zero is represented as the empty string. Parsing functions will never return
    /// invalid representations. If an invalid input is constructed, the marshaling
    /// functions will skip leading zeros, however other functions, such as
    /// `ASN1_INTEGER_cmp` or `ASN1_INTEGER_get`, may not return the correct result.
    #[link_name = "sk_ASN1_INTEGER_delete_ptr__extern"]
    pub fn sk_ASN1_INTEGER_delete_ptr(
        sk: *mut stack_st_ASN1_INTEGER,
        p: *const ASN1_INTEGER,
    ) -> *mut ASN1_INTEGER;
}
unsafe extern "C" {
    /// Integers and enumerated values.
    ///
    /// INTEGER and ENUMERATED values are represented as `ASN1_STRING`s where the
    /// data contains the big-endian encoding of the absolute value of the integer.
    /// The sign bit is encoded in the type: non-negative values have a type of
    /// `V_ASN1_INTEGER` or `V_ASN1_ENUMERATED`, while negative values have a type of
    /// `V_ASN1_NEG_INTEGER` or `V_ASN1_NEG_ENUMERATED`. Note this differs from DER's
    /// two's complement representation.
    ///
    /// The data in the `ASN1_STRING` may not have leading zeros. Note this means
    /// zero is represented as the empty string. Parsing functions will never return
    /// invalid representations. If an invalid input is constructed, the marshaling
    /// functions will skip leading zeros, however other functions, such as
    /// `ASN1_INTEGER_cmp` or `ASN1_INTEGER_get`, may not return the correct result.
    #[link_name = "sk_ASN1_INTEGER_delete_if__extern"]
    pub fn sk_ASN1_INTEGER_delete_if(
        sk: *mut stack_st_ASN1_INTEGER,
        func: sk_ASN1_INTEGER_delete_if_func,
        data: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    /// Integers and enumerated values.
    ///
    /// INTEGER and ENUMERATED values are represented as `ASN1_STRING`s where the
    /// data contains the big-endian encoding of the absolute value of the integer.
    /// The sign bit is encoded in the type: non-negative values have a type of
    /// `V_ASN1_INTEGER` or `V_ASN1_ENUMERATED`, while negative values have a type of
    /// `V_ASN1_NEG_INTEGER` or `V_ASN1_NEG_ENUMERATED`. Note this differs from DER's
    /// two's complement representation.
    ///
    /// The data in the `ASN1_STRING` may not have leading zeros. Note this means
    /// zero is represented as the empty string. Parsing functions will never return
    /// invalid representations. If an invalid input is constructed, the marshaling
    /// functions will skip leading zeros, however other functions, such as
    /// `ASN1_INTEGER_cmp` or `ASN1_INTEGER_get`, may not return the correct result.
    #[link_name = "sk_ASN1_INTEGER_find__extern"]
    pub fn sk_ASN1_INTEGER_find(
        sk: *const stack_st_ASN1_INTEGER,
        out_index: *mut usize,
        p: *const ASN1_INTEGER,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Integers and enumerated values.
    ///
    /// INTEGER and ENUMERATED values are represented as `ASN1_STRING`s where the
    /// data contains the big-endian encoding of the absolute value of the integer.
    /// The sign bit is encoded in the type: non-negative values have a type of
    /// `V_ASN1_INTEGER` or `V_ASN1_ENUMERATED`, while negative values have a type of
    /// `V_ASN1_NEG_INTEGER` or `V_ASN1_NEG_ENUMERATED`. Note this differs from DER's
    /// two's complement representation.
    ///
    /// The data in the `ASN1_STRING` may not have leading zeros. Note this means
    /// zero is represented as the empty string. Parsing functions will never return
    /// invalid representations. If an invalid input is constructed, the marshaling
    /// functions will skip leading zeros, however other functions, such as
    /// `ASN1_INTEGER_cmp` or `ASN1_INTEGER_get`, may not return the correct result.
    #[link_name = "sk_ASN1_INTEGER_shift__extern"]
    pub fn sk_ASN1_INTEGER_shift(sk: *mut stack_st_ASN1_INTEGER) -> *mut ASN1_INTEGER;
}
unsafe extern "C" {
    /// Integers and enumerated values.
    ///
    /// INTEGER and ENUMERATED values are represented as `ASN1_STRING`s where the
    /// data contains the big-endian encoding of the absolute value of the integer.
    /// The sign bit is encoded in the type: non-negative values have a type of
    /// `V_ASN1_INTEGER` or `V_ASN1_ENUMERATED`, while negative values have a type of
    /// `V_ASN1_NEG_INTEGER` or `V_ASN1_NEG_ENUMERATED`. Note this differs from DER's
    /// two's complement representation.
    ///
    /// The data in the `ASN1_STRING` may not have leading zeros. Note this means
    /// zero is represented as the empty string. Parsing functions will never return
    /// invalid representations. If an invalid input is constructed, the marshaling
    /// functions will skip leading zeros, however other functions, such as
    /// `ASN1_INTEGER_cmp` or `ASN1_INTEGER_get`, may not return the correct result.
    #[link_name = "sk_ASN1_INTEGER_push__extern"]
    pub fn sk_ASN1_INTEGER_push(sk: *mut stack_st_ASN1_INTEGER, p: *mut ASN1_INTEGER) -> usize;
}
unsafe extern "C" {
    /// Integers and enumerated values.
    ///
    /// INTEGER and ENUMERATED values are represented as `ASN1_STRING`s where the
    /// data contains the big-endian encoding of the absolute value of the integer.
    /// The sign bit is encoded in the type: non-negative values have a type of
    /// `V_ASN1_INTEGER` or `V_ASN1_ENUMERATED`, while negative values have a type of
    /// `V_ASN1_NEG_INTEGER` or `V_ASN1_NEG_ENUMERATED`. Note this differs from DER's
    /// two's complement representation.
    ///
    /// The data in the `ASN1_STRING` may not have leading zeros. Note this means
    /// zero is represented as the empty string. Parsing functions will never return
    /// invalid representations. If an invalid input is constructed, the marshaling
    /// functions will skip leading zeros, however other functions, such as
    /// `ASN1_INTEGER_cmp` or `ASN1_INTEGER_get`, may not return the correct result.
    #[link_name = "sk_ASN1_INTEGER_pop__extern"]
    pub fn sk_ASN1_INTEGER_pop(sk: *mut stack_st_ASN1_INTEGER) -> *mut ASN1_INTEGER;
}
unsafe extern "C" {
    /// Integers and enumerated values.
    ///
    /// INTEGER and ENUMERATED values are represented as `ASN1_STRING`s where the
    /// data contains the big-endian encoding of the absolute value of the integer.
    /// The sign bit is encoded in the type: non-negative values have a type of
    /// `V_ASN1_INTEGER` or `V_ASN1_ENUMERATED`, while negative values have a type of
    /// `V_ASN1_NEG_INTEGER` or `V_ASN1_NEG_ENUMERATED`. Note this differs from DER's
    /// two's complement representation.
    ///
    /// The data in the `ASN1_STRING` may not have leading zeros. Note this means
    /// zero is represented as the empty string. Parsing functions will never return
    /// invalid representations. If an invalid input is constructed, the marshaling
    /// functions will skip leading zeros, however other functions, such as
    /// `ASN1_INTEGER_cmp` or `ASN1_INTEGER_get`, may not return the correct result.
    #[link_name = "sk_ASN1_INTEGER_dup__extern"]
    pub fn sk_ASN1_INTEGER_dup(sk: *const stack_st_ASN1_INTEGER) -> *mut stack_st_ASN1_INTEGER;
}
unsafe extern "C" {
    /// Integers and enumerated values.
    ///
    /// INTEGER and ENUMERATED values are represented as `ASN1_STRING`s where the
    /// data contains the big-endian encoding of the absolute value of the integer.
    /// The sign bit is encoded in the type: non-negative values have a type of
    /// `V_ASN1_INTEGER` or `V_ASN1_ENUMERATED`, while negative values have a type of
    /// `V_ASN1_NEG_INTEGER` or `V_ASN1_NEG_ENUMERATED`. Note this differs from DER's
    /// two's complement representation.
    ///
    /// The data in the `ASN1_STRING` may not have leading zeros. Note this means
    /// zero is represented as the empty string. Parsing functions will never return
    /// invalid representations. If an invalid input is constructed, the marshaling
    /// functions will skip leading zeros, however other functions, such as
    /// `ASN1_INTEGER_cmp` or `ASN1_INTEGER_get`, may not return the correct result.
    #[link_name = "sk_ASN1_INTEGER_sort__extern"]
    pub fn sk_ASN1_INTEGER_sort(sk: *mut stack_st_ASN1_INTEGER);
}
unsafe extern "C" {
    /// Integers and enumerated values.
    ///
    /// INTEGER and ENUMERATED values are represented as `ASN1_STRING`s where the
    /// data contains the big-endian encoding of the absolute value of the integer.
    /// The sign bit is encoded in the type: non-negative values have a type of
    /// `V_ASN1_INTEGER` or `V_ASN1_ENUMERATED`, while negative values have a type of
    /// `V_ASN1_NEG_INTEGER` or `V_ASN1_NEG_ENUMERATED`. Note this differs from DER's
    /// two's complement representation.
    ///
    /// The data in the `ASN1_STRING` may not have leading zeros. Note this means
    /// zero is represented as the empty string. Parsing functions will never return
    /// invalid representations. If an invalid input is constructed, the marshaling
    /// functions will skip leading zeros, however other functions, such as
    /// `ASN1_INTEGER_cmp` or `ASN1_INTEGER_get`, may not return the correct result.
    #[link_name = "sk_ASN1_INTEGER_sort_and_dedup__extern"]
    pub fn sk_ASN1_INTEGER_sort_and_dedup(
        sk: *mut stack_st_ASN1_INTEGER,
        free_func: sk_ASN1_INTEGER_free_func,
    );
}
unsafe extern "C" {
    /// Integers and enumerated values.
    ///
    /// INTEGER and ENUMERATED values are represented as `ASN1_STRING`s where the
    /// data contains the big-endian encoding of the absolute value of the integer.
    /// The sign bit is encoded in the type: non-negative values have a type of
    /// `V_ASN1_INTEGER` or `V_ASN1_ENUMERATED`, while negative values have a type of
    /// `V_ASN1_NEG_INTEGER` or `V_ASN1_NEG_ENUMERATED`. Note this differs from DER's
    /// two's complement representation.
    ///
    /// The data in the `ASN1_STRING` may not have leading zeros. Note this means
    /// zero is represented as the empty string. Parsing functions will never return
    /// invalid representations. If an invalid input is constructed, the marshaling
    /// functions will skip leading zeros, however other functions, such as
    /// `ASN1_INTEGER_cmp` or `ASN1_INTEGER_get`, may not return the correct result.
    #[link_name = "sk_ASN1_INTEGER_is_sorted__extern"]
    pub fn sk_ASN1_INTEGER_is_sorted(sk: *const stack_st_ASN1_INTEGER) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Integers and enumerated values.
    ///
    /// INTEGER and ENUMERATED values are represented as `ASN1_STRING`s where the
    /// data contains the big-endian encoding of the absolute value of the integer.
    /// The sign bit is encoded in the type: non-negative values have a type of
    /// `V_ASN1_INTEGER` or `V_ASN1_ENUMERATED`, while negative values have a type of
    /// `V_ASN1_NEG_INTEGER` or `V_ASN1_NEG_ENUMERATED`. Note this differs from DER's
    /// two's complement representation.
    ///
    /// The data in the `ASN1_STRING` may not have leading zeros. Note this means
    /// zero is represented as the empty string. Parsing functions will never return
    /// invalid representations. If an invalid input is constructed, the marshaling
    /// functions will skip leading zeros, however other functions, such as
    /// `ASN1_INTEGER_cmp` or `ASN1_INTEGER_get`, may not return the correct result.
    #[link_name = "sk_ASN1_INTEGER_set_cmp_func__extern"]
    pub fn sk_ASN1_INTEGER_set_cmp_func(
        sk: *mut stack_st_ASN1_INTEGER,
        comp: sk_ASN1_INTEGER_cmp_func,
    ) -> sk_ASN1_INTEGER_cmp_func;
}
unsafe extern "C" {
    /// Integers and enumerated values.
    ///
    /// INTEGER and ENUMERATED values are represented as `ASN1_STRING`s where the
    /// data contains the big-endian encoding of the absolute value of the integer.
    /// The sign bit is encoded in the type: non-negative values have a type of
    /// `V_ASN1_INTEGER` or `V_ASN1_ENUMERATED`, while negative values have a type of
    /// `V_ASN1_NEG_INTEGER` or `V_ASN1_NEG_ENUMERATED`. Note this differs from DER's
    /// two's complement representation.
    ///
    /// The data in the `ASN1_STRING` may not have leading zeros. Note this means
    /// zero is represented as the empty string. Parsing functions will never return
    /// invalid representations. If an invalid input is constructed, the marshaling
    /// functions will skip leading zeros, however other functions, such as
    /// `ASN1_INTEGER_cmp` or `ASN1_INTEGER_get`, may not return the correct result.
    #[link_name = "sk_ASN1_INTEGER_deep_copy__extern"]
    pub fn sk_ASN1_INTEGER_deep_copy(
        sk: *const stack_st_ASN1_INTEGER,
        copy_func: sk_ASN1_INTEGER_copy_func,
        free_func: sk_ASN1_INTEGER_free_func,
    ) -> *mut stack_st_ASN1_INTEGER;
}
unsafe extern "C" {
    /// ASN1_INTEGER_new calls `ASN1_STRING_type_new` with `V_ASN1_INTEGER`. The
    /// resulting object has value zero.
    pub fn ASN1_INTEGER_new() -> *mut ASN1_INTEGER;
}
unsafe extern "C" {
    /// ASN1_INTEGER_free calls `ASN1_STRING_free`.
    pub fn ASN1_INTEGER_free(str_: *mut ASN1_INTEGER);
}
unsafe extern "C" {
    /// ASN1_INTEGER_dup calls `ASN1_STRING_dup`.
    pub fn ASN1_INTEGER_dup(x: *const ASN1_INTEGER) -> *mut ASN1_INTEGER;
}
unsafe extern "C" {
    /// d2i_ASN1_INTEGER parses up to `len` bytes from `*inp` as a DER-encoded
    /// ASN.1 INTEGER, as described in `d2i_SAMPLE`.
    pub fn d2i_ASN1_INTEGER(
        out: *mut *mut ASN1_INTEGER,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut ASN1_INTEGER;
}
unsafe extern "C" {
    /// i2d_ASN1_INTEGER marshals `in` as a DER-encoded ASN.1 INTEGER, as
    /// described in `i2d_SAMPLE`.
    pub fn i2d_ASN1_INTEGER(in_: *const ASN1_INTEGER, outp: *mut *mut u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// c2i_ASN1_INTEGER decodes `len` bytes from `*inp` as the contents of a
    /// DER-encoded INTEGER, excluding the tag and length. It behaves like
    /// `d2i_SAMPLE` except, on success, it always consumes all `len` bytes.
    pub fn c2i_ASN1_INTEGER(
        in_: *mut *mut ASN1_INTEGER,
        outp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut ASN1_INTEGER;
}
unsafe extern "C" {
    /// i2c_ASN1_INTEGER encodes `in` as the contents of a DER-encoded INTEGER,
    /// excluding the tag and length. If `outp` is non-NULL, it writes the result to
    /// `*outp`, advances `*outp` just past the output, and returns the number of
    /// bytes written. `*outp` must have space available for the result. If `outp` is
    /// NULL, it returns the number of bytes without writing anything. On error, it
    /// returns a value <= 0.
    ///
    /// Note this function differs slightly from `i2d_SAMPLE`. If `outp` is non-NULL
    /// and `*outp` is NULL, it does not allocate a new buffer.
    ///
    /// TODO(davidben): This function currently returns zero on error instead of -1,
    /// but it is also mostly infallible. I've currently documented <= 0 to suggest
    /// callers work with both.
    pub fn i2c_ASN1_INTEGER(in_: *const ASN1_INTEGER, outp: *mut *mut u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_INTEGER is an `ASN1_ITEM` with ASN.1 type INTEGER and C type
    /// `ASN1_INTEGER*`.
    pub static ASN1_INTEGER_it: ASN1_ITEM;
}
unsafe extern "C" {
    /// ASN1_INTEGER_set_uint64 sets `a` to an INTEGER with value `v`. It returns one
    /// on success and zero on error.
    pub fn ASN1_INTEGER_set_uint64(out: *mut ASN1_INTEGER, v: u64) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_INTEGER_set_int64 sets `a` to an INTEGER with value `v`. It returns one
    /// on success and zero on error.
    pub fn ASN1_INTEGER_set_int64(out: *mut ASN1_INTEGER, v: i64) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_INTEGER_get_uint64 converts `a` to a `uint64_t`. On success, it returns
    /// one and sets `*out` to the result. If `a` did not fit or has the wrong type,
    /// it returns zero.
    pub fn ASN1_INTEGER_get_uint64(out: *mut u64, a: *const ASN1_INTEGER) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_INTEGER_get_int64 converts `a` to a `int64_t`. On success, it returns
    /// one and sets `*out` to the result. If `a` did not fit or has the wrong type,
    /// it returns zero.
    pub fn ASN1_INTEGER_get_int64(out: *mut i64, a: *const ASN1_INTEGER) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_to_ASN1_INTEGER sets `ai` to an INTEGER with value `bn` and returns `ai`
    /// on success or NULL or error. If `ai` is NULL, it returns a newly-allocated
    /// `ASN1_INTEGER` on success instead, which the caller must release with
    /// `ASN1_INTEGER_free`.
    pub fn BN_to_ASN1_INTEGER(bn: *const BIGNUM, ai: *mut ASN1_INTEGER) -> *mut ASN1_INTEGER;
}
unsafe extern "C" {
    /// ASN1_INTEGER_to_BN sets `bn` to the value of `ai` and returns `bn` on success
    /// or NULL or error. If `bn` is NULL, it returns a newly-allocated `BIGNUM` on
    /// success instead, which the caller must release with `BN_free`.
    pub fn ASN1_INTEGER_to_BN(ai: *const ASN1_INTEGER, bn: *mut BIGNUM) -> *mut BIGNUM;
}
unsafe extern "C" {
    /// ASN1_INTEGER_cmp compares the values of `x` and `y`. It returns an integer
    /// equal to, less than, or greater than zero if `x` is equal to, less than, or
    /// greater than `y`, respectively.
    pub fn ASN1_INTEGER_cmp(x: *const ASN1_INTEGER, y: *const ASN1_INTEGER) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_ENUMERATED_new calls `ASN1_STRING_type_new` with `V_ASN1_ENUMERATED`.
    /// The resulting object has value zero.
    pub fn ASN1_ENUMERATED_new() -> *mut ASN1_ENUMERATED;
}
unsafe extern "C" {
    /// ASN1_ENUMERATED_free calls `ASN1_STRING_free`.
    pub fn ASN1_ENUMERATED_free(str_: *mut ASN1_ENUMERATED);
}
unsafe extern "C" {
    /// d2i_ASN1_ENUMERATED parses up to `len` bytes from `*inp` as a DER-encoded
    /// ASN.1 ENUMERATED, as described in `d2i_SAMPLE`.
    pub fn d2i_ASN1_ENUMERATED(
        out: *mut *mut ASN1_ENUMERATED,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut ASN1_ENUMERATED;
}
unsafe extern "C" {
    /// i2d_ASN1_ENUMERATED marshals `in` as a DER-encoded ASN.1 ENUMERATED, as
    /// described in `i2d_SAMPLE`.
    pub fn i2d_ASN1_ENUMERATED(
        in_: *const ASN1_ENUMERATED,
        outp: *mut *mut u8,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_ENUMERATED is an `ASN1_ITEM` with ASN.1 type ENUMERATED and C type
    /// `ASN1_ENUMERATED*`.
    pub static ASN1_ENUMERATED_it: ASN1_ITEM;
}
unsafe extern "C" {
    /// ASN1_ENUMERATED_set_uint64 sets `a` to an ENUMERATED with value `v`. It
    /// returns one on success and zero on error.
    pub fn ASN1_ENUMERATED_set_uint64(out: *mut ASN1_ENUMERATED, v: u64) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_ENUMERATED_set_int64 sets `a` to an ENUMERATED with value `v`. It
    /// returns one on success and zero on error.
    pub fn ASN1_ENUMERATED_set_int64(out: *mut ASN1_ENUMERATED, v: i64) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_ENUMERATED_get_uint64 converts `a` to a `uint64_t`. On success, it
    /// returns one and sets `*out` to the result. If `a` did not fit or has the
    /// wrong type, it returns zero.
    pub fn ASN1_ENUMERATED_get_uint64(
        out: *mut u64,
        a: *const ASN1_ENUMERATED,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_ENUMERATED_get_int64 converts `a` to a `int64_t`. On success, it
    /// returns one and sets `*out` to the result. If `a` did not fit or has the
    /// wrong type, it returns zero.
    pub fn ASN1_ENUMERATED_get_int64(
        out: *mut i64,
        a: *const ASN1_ENUMERATED,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BN_to_ASN1_ENUMERATED sets `ai` to an ENUMERATED with value `bn` and returns
    /// `ai` on success or NULL or error. If `ai` is NULL, it returns a
    /// newly-allocated `ASN1_ENUMERATED` on success instead, which the caller must
    /// release with `ASN1_ENUMERATED_free`.
    pub fn BN_to_ASN1_ENUMERATED(
        bn: *const BIGNUM,
        ai: *mut ASN1_ENUMERATED,
    ) -> *mut ASN1_ENUMERATED;
}
unsafe extern "C" {
    /// ASN1_ENUMERATED_to_BN sets `bn` to the value of `ai` and returns `bn` on
    /// success or NULL or error. If `bn` is NULL, it returns a newly-allocated
    /// `BIGNUM` on success instead, which the caller must release with `BN_free`.
    pub fn ASN1_ENUMERATED_to_BN(ai: *const ASN1_ENUMERATED, bn: *mut BIGNUM) -> *mut BIGNUM;
}
unsafe extern "C" {
    /// ASN1_UTCTIME_new calls `ASN1_STRING_type_new` with `V_ASN1_UTCTIME`. The
    /// resulting object contains empty contents and must be initialized to be a
    /// valid UTCTime.
    pub fn ASN1_UTCTIME_new() -> *mut ASN1_UTCTIME;
}
unsafe extern "C" {
    /// ASN1_UTCTIME_free calls `ASN1_STRING_free`.
    pub fn ASN1_UTCTIME_free(str_: *mut ASN1_UTCTIME);
}
unsafe extern "C" {
    /// d2i_ASN1_UTCTIME parses up to `len` bytes from `*inp` as a DER-encoded
    /// ASN.1 UTCTime, as described in `d2i_SAMPLE`.
    ///
    /// TODO(https://crbug.com/boringssl/354): This function currently also accepts
    /// BER, but this will be removed in the future.
    pub fn d2i_ASN1_UTCTIME(
        out: *mut *mut ASN1_UTCTIME,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut ASN1_UTCTIME;
}
unsafe extern "C" {
    /// i2d_ASN1_UTCTIME marshals `in` as a DER-encoded ASN.1 UTCTime, as
    /// described in `i2d_SAMPLE`.
    pub fn i2d_ASN1_UTCTIME(in_: *const ASN1_UTCTIME, outp: *mut *mut u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_UTCTIME is an `ASN1_ITEM` with ASN.1 type UTCTime and C type
    /// `ASN1_UTCTIME*`.
    pub static ASN1_UTCTIME_it: ASN1_ITEM;
}
unsafe extern "C" {
    /// ASN1_UTCTIME_check returns one if `a` is a valid UTCTime and zero otherwise.
    pub fn ASN1_UTCTIME_check(a: *const ASN1_UTCTIME) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_UTCTIME_set represents `posix_time` as a UTCTime and writes the result
    /// to `s`. It returns `s` on success and NULL on error. If `s` is NULL, it
    /// returns a newly-allocated `ASN1_UTCTIME` instead.
    ///
    /// Note this function may fail if the time is out of range for UTCTime.
    pub fn ASN1_UTCTIME_set(s: *mut ASN1_UTCTIME, posix_time: i64) -> *mut ASN1_UTCTIME;
}
unsafe extern "C" {
    /// ASN1_UTCTIME_adj adds `offset_day` days and `offset_sec` seconds to
    /// `posix_time` and writes the result to `s` as a UTCTime. It returns `s` on
    /// success and NULL on error. If `s` is NULL, it returns a newly-allocated
    /// `ASN1_UTCTIME` instead.
    ///
    /// Note this function may fail if the time overflows or is out of range for
    /// UTCTime.
    pub fn ASN1_UTCTIME_adj(
        s: *mut ASN1_UTCTIME,
        posix_time: i64,
        offset_day: ::core::ffi::c_int,
        offset_sec: ::core::ffi::c_long,
    ) -> *mut ASN1_UTCTIME;
}
unsafe extern "C" {
    /// ASN1_UTCTIME_set_string sets `s` to a UTCTime whose contents are a copy of
    /// `str`. It returns one on success and zero on error or if `str` is not a valid
    /// UTCTime.
    ///
    /// If `s` is NULL, this function validates `str` without copying it.
    pub fn ASN1_UTCTIME_set_string(
        s: *mut ASN1_UTCTIME,
        str_: *const ::core::ffi::c_char,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_GENERALIZEDTIME_new calls `ASN1_STRING_type_new` with
    /// `V_ASN1_GENERALIZEDTIME`. The resulting object contains empty contents and
    /// must be initialized to be a valid GeneralizedTime.
    pub fn ASN1_GENERALIZEDTIME_new() -> *mut ASN1_GENERALIZEDTIME;
}
unsafe extern "C" {
    /// ASN1_GENERALIZEDTIME_free calls `ASN1_STRING_free`.
    pub fn ASN1_GENERALIZEDTIME_free(str_: *mut ASN1_GENERALIZEDTIME);
}
unsafe extern "C" {
    /// d2i_ASN1_GENERALIZEDTIME parses up to `len` bytes from `*inp` as a
    /// DER-encoded ASN.1 GeneralizedTime, as described in `d2i_SAMPLE`.
    pub fn d2i_ASN1_GENERALIZEDTIME(
        out: *mut *mut ASN1_GENERALIZEDTIME,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut ASN1_GENERALIZEDTIME;
}
unsafe extern "C" {
    /// i2d_ASN1_GENERALIZEDTIME marshals `in` as a DER-encoded ASN.1
    /// GeneralizedTime, as described in `i2d_SAMPLE`.
    pub fn i2d_ASN1_GENERALIZEDTIME(
        in_: *const ASN1_GENERALIZEDTIME,
        outp: *mut *mut u8,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_GENERALIZEDTIME is an `ASN1_ITEM` with ASN.1 type GeneralizedTime and C
    /// type `ASN1_GENERALIZEDTIME*`.
    pub static ASN1_GENERALIZEDTIME_it: ASN1_ITEM;
}
unsafe extern "C" {
    /// ASN1_GENERALIZEDTIME_check returns one if `a` is a valid GeneralizedTime and
    /// zero otherwise.
    pub fn ASN1_GENERALIZEDTIME_check(a: *const ASN1_GENERALIZEDTIME) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_GENERALIZEDTIME_set represents `posix_time` as a GeneralizedTime and
    /// writes the result to `s`. It returns `s` on success and NULL on error. If `s`
    /// is NULL, it returns a newly-allocated `ASN1_GENERALIZEDTIME` instead.
    ///
    /// Note this function may fail if the time is out of range for GeneralizedTime.
    pub fn ASN1_GENERALIZEDTIME_set(
        s: *mut ASN1_GENERALIZEDTIME,
        posix_time: i64,
    ) -> *mut ASN1_GENERALIZEDTIME;
}
unsafe extern "C" {
    /// ASN1_GENERALIZEDTIME_adj adds `offset_day` days and `offset_sec` seconds to
    /// `posix_time` and writes the result to `s` as a GeneralizedTime. It returns
    /// `s` on success and NULL on error. If `s` is NULL, it returns a
    /// newly-allocated `ASN1_GENERALIZEDTIME` instead.
    ///
    /// Note this function may fail if the time overflows or is out of range for
    /// GeneralizedTime.
    pub fn ASN1_GENERALIZEDTIME_adj(
        s: *mut ASN1_GENERALIZEDTIME,
        posix_time: i64,
        offset_day: ::core::ffi::c_int,
        offset_sec: ::core::ffi::c_long,
    ) -> *mut ASN1_GENERALIZEDTIME;
}
unsafe extern "C" {
    /// ASN1_GENERALIZEDTIME_set_string sets `s` to a GeneralizedTime whose contents
    /// are a copy of `str`. It returns one on success and zero on error or if `str`
    /// is not a valid GeneralizedTime.
    ///
    /// If `s` is NULL, this function validates `str` without copying it.
    pub fn ASN1_GENERALIZEDTIME_set_string(
        s: *mut ASN1_GENERALIZEDTIME,
        str_: *const ::core::ffi::c_char,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_TIME_new returns a newly-allocated `ASN1_TIME` with type -1, or NULL on
    /// error. The resulting `ASN1_TIME` is not a valid X.509 Time until initialized
    /// with a value.
    pub fn ASN1_TIME_new() -> *mut ASN1_TIME;
}
unsafe extern "C" {
    /// ASN1_TIME_free releases memory associated with `str`.
    pub fn ASN1_TIME_free(str_: *mut ASN1_TIME);
}
unsafe extern "C" {
    /// d2i_ASN1_TIME parses up to `len` bytes from `*inp` as a DER-encoded X.509
    /// Time (RFC 5280), as described in `d2i_SAMPLE`.
    ///
    /// TODO(https://crbug.com/boringssl/354): This function currently also accepts
    /// BER, but this will be removed in the future.
    pub fn d2i_ASN1_TIME(
        out: *mut *mut ASN1_TIME,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut ASN1_TIME;
}
unsafe extern "C" {
    /// i2d_ASN1_TIME marshals `in` as a DER-encoded X.509 Time (RFC 5280), as
    /// described in `i2d_SAMPLE`.
    pub fn i2d_ASN1_TIME(in_: *const ASN1_TIME, outp: *mut *mut u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_TIME_diff computes `to` - `from`. On success, it sets `*out_days` to the
    /// difference in days, rounded towards zero, sets `*out_seconds` to the
    /// remainder, and returns one. On error, it returns zero.
    ///
    /// If `from` is before `to`, both outputs will be <= 0, with at least one
    /// negative. If `from` is after `to`, both will be >= 0, with at least one
    /// positive. If they are equal, ignoring fractional seconds, both will be zero.
    ///
    /// Note this function may fail on overflow, or if `from` or `to` cannot be
    /// decoded.
    pub fn ASN1_TIME_diff(
        out_days: *mut ::core::ffi::c_int,
        out_seconds: *mut ::core::ffi::c_int,
        from: *const ASN1_TIME,
        to: *const ASN1_TIME,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_TIME_set_posix represents `posix_time` as a GeneralizedTime or UTCTime
    /// and writes the result to `s`. As in RFC 5280, section 4.1.2.5, it uses
    /// UTCTime when the time fits and GeneralizedTime otherwise. It returns `s` on
    /// success and NULL on error. If `s` is NULL, it returns a newly-allocated
    /// `ASN1_TIME` instead.
    ///
    /// Note this function may fail if the time is out of range for GeneralizedTime.
    pub fn ASN1_TIME_set_posix(s: *mut ASN1_TIME, posix_time: i64) -> *mut ASN1_TIME;
}
unsafe extern "C" {
    /// ASN1_TIME_set is exactly the same as `ASN1_TIME_set_posix` but with a
    /// time_t as input for compatibility.
    pub fn ASN1_TIME_set(s: *mut ASN1_TIME, time: time_t) -> *mut ASN1_TIME;
}
unsafe extern "C" {
    /// ASN1_TIME_adj adds `offset_day` days and `offset_sec` seconds to
    /// `posix_time` and writes the result to `s`. As in RFC 5280, section 4.1.2.5,
    /// it uses UTCTime when the time fits and GeneralizedTime otherwise. It returns
    /// `s` on success and NULL on error. If `s` is NULL, it returns a
    /// newly-allocated `ASN1_GENERALIZEDTIME` instead.
    ///
    /// Note this function may fail if the time overflows or is out of range for
    /// GeneralizedTime.
    pub fn ASN1_TIME_adj(
        s: *mut ASN1_TIME,
        posix_time: i64,
        offset_day: ::core::ffi::c_int,
        offset_sec: ::core::ffi::c_long,
    ) -> *mut ASN1_TIME;
}
unsafe extern "C" {
    /// ASN1_TIME_check returns one if `t` is a valid UTCTime or GeneralizedTime, and
    /// zero otherwise. `t`'s type determines which check is performed. This
    /// function does not enforce that UTCTime was used when possible.
    pub fn ASN1_TIME_check(t: *const ASN1_TIME) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_TIME_to_generalizedtime converts `t` to a GeneralizedTime. If `out` is
    /// NULL, it returns a newly-allocated `ASN1_GENERALIZEDTIME` on success, or NULL
    /// on error. If `out` is non-NULL and `*out` is NULL, it additionally sets
    /// `*out` to the result. If `out` and `*out` are non-NULL, it instead updates
    /// the object pointed by `*out` and returns `*out` on success or NULL on error.
    pub fn ASN1_TIME_to_generalizedtime(
        t: *const ASN1_TIME,
        out: *mut *mut ASN1_GENERALIZEDTIME,
    ) -> *mut ASN1_GENERALIZEDTIME;
}
unsafe extern "C" {
    /// ASN1_TIME_set_string behaves like `ASN1_UTCTIME_set_string` if `str` is a
    /// valid UTCTime, and `ASN1_GENERALIZEDTIME_set_string` if `str` is a valid
    /// GeneralizedTime. If `str` is neither, it returns zero.
    pub fn ASN1_TIME_set_string(
        s: *mut ASN1_TIME,
        str_: *const ::core::ffi::c_char,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_TIME_set_string_X509 behaves like `ASN1_TIME_set_string` except it
    /// additionally converts GeneralizedTime to UTCTime if it is in the range where
    /// UTCTime is used. See RFC 5280, section 4.1.2.5.
    pub fn ASN1_TIME_set_string_X509(
        s: *mut ASN1_TIME,
        str_: *const ::core::ffi::c_char,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_TIME_to_time_t converts `t` to a time_t value in `out`. On
    /// success, one is returned. On failure, zero is returned. This function
    /// will fail if the time can not be represented in a time_t.
    pub fn ASN1_TIME_to_time_t(t: *const ASN1_TIME, out: *mut time_t) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_TIME_to_posix converts `t` to a POSIX time value in `out`. On
    /// success, one is returned. On failure, zero is returned.
    pub fn ASN1_TIME_to_posix(t: *const ASN1_TIME, out: *mut i64) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_TIME_to_posix_nonstandard converts `t` to a POSIX time value in
    /// `out`. It is exactly the same as `ASN1_TIME_to_posix` but allows for
    /// non-standard four-digit timezone offsets on UTC times. On success, one is
    /// returned. On failure, zero is returned. `ASN1_TIME_to_posix` should normally
    /// be used instead of this function.
    pub fn ASN1_TIME_to_posix_nonstandard(t: *const ASN1_TIME, out: *mut i64)
        -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_NULL_new returns an opaque, non-NULL pointer. It is safe to call
    /// `ASN1_NULL_free` on the result, but not necessary.
    pub fn ASN1_NULL_new() -> *mut ASN1_NULL;
}
unsafe extern "C" {
    /// ASN1_NULL_free does nothing.
    pub fn ASN1_NULL_free(null: *mut ASN1_NULL);
}
unsafe extern "C" {
    /// d2i_ASN1_NULL parses a DER-encoded ASN.1 NULL value from up to `len` bytes
    /// at `*inp`, as described in `d2i_SAMPLE`.
    pub fn d2i_ASN1_NULL(
        out: *mut *mut ASN1_NULL,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut ASN1_NULL;
}
unsafe extern "C" {
    /// i2d_ASN1_NULL marshals `in` as a DER-encoded ASN.1 NULL value, as described
    /// in `i2d_SAMPLE`.
    pub fn i2d_ASN1_NULL(in_: *const ASN1_NULL, outp: *mut *mut u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_NULL is an `ASN1_ITEM` with ASN.1 type NULL and C type `ASN1_NULL*`.
    pub static ASN1_NULL_it: ASN1_ITEM;
}
/// Object identifiers.
///
/// An `ASN1_OBJECT` represents an ASN.1 OBJECT IDENTIFIER. See also obj.h for
/// additional functions relating to `ASN1_OBJECT`.
///
/// TODO(davidben): What's the relationship between asn1.h and obj.h? Most of
/// obj.h deals with the large NID table, but then functions like `OBJ_get0_data`
/// or `OBJ_dup` are general `ASN1_OBJECT` functions.
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct stack_st_ASN1_OBJECT {
    _unused: [u8; 0],
}
/// Object identifiers.
///
/// An `ASN1_OBJECT` represents an ASN.1 OBJECT IDENTIFIER. See also obj.h for
/// additional functions relating to `ASN1_OBJECT`.
///
/// TODO(davidben): What's the relationship between asn1.h and obj.h? Most of
/// obj.h deals with the large NID table, but then functions like `OBJ_get0_data`
/// or `OBJ_dup` are general `ASN1_OBJECT` functions.
pub type sk_ASN1_OBJECT_free_func =
    ::core::option::Option<unsafe extern "C" fn(arg1: *mut ASN1_OBJECT)>;
/// Object identifiers.
///
/// An `ASN1_OBJECT` represents an ASN.1 OBJECT IDENTIFIER. See also obj.h for
/// additional functions relating to `ASN1_OBJECT`.
///
/// TODO(davidben): What's the relationship between asn1.h and obj.h? Most of
/// obj.h deals with the large NID table, but then functions like `OBJ_get0_data`
/// or `OBJ_dup` are general `ASN1_OBJECT` functions.
pub type sk_ASN1_OBJECT_copy_func =
    ::core::option::Option<unsafe extern "C" fn(arg1: *const ASN1_OBJECT) -> *mut ASN1_OBJECT>;
/// Object identifiers.
///
/// An `ASN1_OBJECT` represents an ASN.1 OBJECT IDENTIFIER. See also obj.h for
/// additional functions relating to `ASN1_OBJECT`.
///
/// TODO(davidben): What's the relationship between asn1.h and obj.h? Most of
/// obj.h deals with the large NID table, but then functions like `OBJ_get0_data`
/// or `OBJ_dup` are general `ASN1_OBJECT` functions.
pub type sk_ASN1_OBJECT_cmp_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *const *const ASN1_OBJECT,
        arg2: *const *const ASN1_OBJECT,
    ) -> ::core::ffi::c_int,
>;
/// Object identifiers.
///
/// An `ASN1_OBJECT` represents an ASN.1 OBJECT IDENTIFIER. See also obj.h for
/// additional functions relating to `ASN1_OBJECT`.
///
/// TODO(davidben): What's the relationship between asn1.h and obj.h? Most of
/// obj.h deals with the large NID table, but then functions like `OBJ_get0_data`
/// or `OBJ_dup` are general `ASN1_OBJECT` functions.
pub type sk_ASN1_OBJECT_delete_if_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *mut ASN1_OBJECT,
        arg2: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int,
>;
unsafe extern "C" {
    /// Object identifiers.
    ///
    /// An `ASN1_OBJECT` represents an ASN.1 OBJECT IDENTIFIER. See also obj.h for
    /// additional functions relating to `ASN1_OBJECT`.
    ///
    /// TODO(davidben): What's the relationship between asn1.h and obj.h? Most of
    /// obj.h deals with the large NID table, but then functions like `OBJ_get0_data`
    /// or `OBJ_dup` are general `ASN1_OBJECT` functions.
    #[link_name = "sk_ASN1_OBJECT_call_free_func__extern"]
    pub fn sk_ASN1_OBJECT_call_free_func(
        free_func: OPENSSL_sk_free_func,
        ptr: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    /// Object identifiers.
    ///
    /// An `ASN1_OBJECT` represents an ASN.1 OBJECT IDENTIFIER. See also obj.h for
    /// additional functions relating to `ASN1_OBJECT`.
    ///
    /// TODO(davidben): What's the relationship between asn1.h and obj.h? Most of
    /// obj.h deals with the large NID table, but then functions like `OBJ_get0_data`
    /// or `OBJ_dup` are general `ASN1_OBJECT` functions.
    #[link_name = "sk_ASN1_OBJECT_call_copy_func__extern"]
    pub fn sk_ASN1_OBJECT_call_copy_func(
        copy_func: OPENSSL_sk_copy_func,
        ptr: *const ::core::ffi::c_void,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    /// Object identifiers.
    ///
    /// An `ASN1_OBJECT` represents an ASN.1 OBJECT IDENTIFIER. See also obj.h for
    /// additional functions relating to `ASN1_OBJECT`.
    ///
    /// TODO(davidben): What's the relationship between asn1.h and obj.h? Most of
    /// obj.h deals with the large NID table, but then functions like `OBJ_get0_data`
    /// or `OBJ_dup` are general `ASN1_OBJECT` functions.
    #[link_name = "sk_ASN1_OBJECT_call_cmp_func__extern"]
    pub fn sk_ASN1_OBJECT_call_cmp_func(
        cmp_func: OPENSSL_sk_cmp_func,
        a: *const ::core::ffi::c_void,
        b: *const ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Object identifiers.
    ///
    /// An `ASN1_OBJECT` represents an ASN.1 OBJECT IDENTIFIER. See also obj.h for
    /// additional functions relating to `ASN1_OBJECT`.
    ///
    /// TODO(davidben): What's the relationship between asn1.h and obj.h? Most of
    /// obj.h deals with the large NID table, but then functions like `OBJ_get0_data`
    /// or `OBJ_dup` are general `ASN1_OBJECT` functions.
    #[link_name = "sk_ASN1_OBJECT_call_delete_if_func__extern"]
    pub fn sk_ASN1_OBJECT_call_delete_if_func(
        func: OPENSSL_sk_delete_if_func,
        obj: *mut ::core::ffi::c_void,
        data: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Object identifiers.
    ///
    /// An `ASN1_OBJECT` represents an ASN.1 OBJECT IDENTIFIER. See also obj.h for
    /// additional functions relating to `ASN1_OBJECT`.
    ///
    /// TODO(davidben): What's the relationship between asn1.h and obj.h? Most of
    /// obj.h deals with the large NID table, but then functions like `OBJ_get0_data`
    /// or `OBJ_dup` are general `ASN1_OBJECT` functions.
    #[link_name = "sk_ASN1_OBJECT_new__extern"]
    pub fn sk_ASN1_OBJECT_new(comp: sk_ASN1_OBJECT_cmp_func) -> *mut stack_st_ASN1_OBJECT;
}
unsafe extern "C" {
    /// Object identifiers.
    ///
    /// An `ASN1_OBJECT` represents an ASN.1 OBJECT IDENTIFIER. See also obj.h for
    /// additional functions relating to `ASN1_OBJECT`.
    ///
    /// TODO(davidben): What's the relationship between asn1.h and obj.h? Most of
    /// obj.h deals with the large NID table, but then functions like `OBJ_get0_data`
    /// or `OBJ_dup` are general `ASN1_OBJECT` functions.
    #[link_name = "sk_ASN1_OBJECT_new_null__extern"]
    pub fn sk_ASN1_OBJECT_new_null() -> *mut stack_st_ASN1_OBJECT;
}
unsafe extern "C" {
    /// Object identifiers.
    ///
    /// An `ASN1_OBJECT` represents an ASN.1 OBJECT IDENTIFIER. See also obj.h for
    /// additional functions relating to `ASN1_OBJECT`.
    ///
    /// TODO(davidben): What's the relationship between asn1.h and obj.h? Most of
    /// obj.h deals with the large NID table, but then functions like `OBJ_get0_data`
    /// or `OBJ_dup` are general `ASN1_OBJECT` functions.
    #[link_name = "sk_ASN1_OBJECT_num__extern"]
    pub fn sk_ASN1_OBJECT_num(sk: *const stack_st_ASN1_OBJECT) -> usize;
}
unsafe extern "C" {
    /// Object identifiers.
    ///
    /// An `ASN1_OBJECT` represents an ASN.1 OBJECT IDENTIFIER. See also obj.h for
    /// additional functions relating to `ASN1_OBJECT`.
    ///
    /// TODO(davidben): What's the relationship between asn1.h and obj.h? Most of
    /// obj.h deals with the large NID table, but then functions like `OBJ_get0_data`
    /// or `OBJ_dup` are general `ASN1_OBJECT` functions.
    #[link_name = "sk_ASN1_OBJECT_zero__extern"]
    pub fn sk_ASN1_OBJECT_zero(sk: *mut stack_st_ASN1_OBJECT);
}
unsafe extern "C" {
    /// Object identifiers.
    ///
    /// An `ASN1_OBJECT` represents an ASN.1 OBJECT IDENTIFIER. See also obj.h for
    /// additional functions relating to `ASN1_OBJECT`.
    ///
    /// TODO(davidben): What's the relationship between asn1.h and obj.h? Most of
    /// obj.h deals with the large NID table, but then functions like `OBJ_get0_data`
    /// or `OBJ_dup` are general `ASN1_OBJECT` functions.
    #[link_name = "sk_ASN1_OBJECT_value__extern"]
    pub fn sk_ASN1_OBJECT_value(sk: *const stack_st_ASN1_OBJECT, i: usize) -> *mut ASN1_OBJECT;
}
unsafe extern "C" {
    /// Object identifiers.
    ///
    /// An `ASN1_OBJECT` represents an ASN.1 OBJECT IDENTIFIER. See also obj.h for
    /// additional functions relating to `ASN1_OBJECT`.
    ///
    /// TODO(davidben): What's the relationship between asn1.h and obj.h? Most of
    /// obj.h deals with the large NID table, but then functions like `OBJ_get0_data`
    /// or `OBJ_dup` are general `ASN1_OBJECT` functions.
    #[link_name = "sk_ASN1_OBJECT_set__extern"]
    pub fn sk_ASN1_OBJECT_set(
        sk: *mut stack_st_ASN1_OBJECT,
        i: usize,
        p: *mut ASN1_OBJECT,
    ) -> *mut ASN1_OBJECT;
}
unsafe extern "C" {
    /// Object identifiers.
    ///
    /// An `ASN1_OBJECT` represents an ASN.1 OBJECT IDENTIFIER. See also obj.h for
    /// additional functions relating to `ASN1_OBJECT`.
    ///
    /// TODO(davidben): What's the relationship between asn1.h and obj.h? Most of
    /// obj.h deals with the large NID table, but then functions like `OBJ_get0_data`
    /// or `OBJ_dup` are general `ASN1_OBJECT` functions.
    #[link_name = "sk_ASN1_OBJECT_free__extern"]
    pub fn sk_ASN1_OBJECT_free(sk: *mut stack_st_ASN1_OBJECT);
}
unsafe extern "C" {
    /// Object identifiers.
    ///
    /// An `ASN1_OBJECT` represents an ASN.1 OBJECT IDENTIFIER. See also obj.h for
    /// additional functions relating to `ASN1_OBJECT`.
    ///
    /// TODO(davidben): What's the relationship between asn1.h and obj.h? Most of
    /// obj.h deals with the large NID table, but then functions like `OBJ_get0_data`
    /// or `OBJ_dup` are general `ASN1_OBJECT` functions.
    #[link_name = "sk_ASN1_OBJECT_pop_free__extern"]
    pub fn sk_ASN1_OBJECT_pop_free(
        sk: *mut stack_st_ASN1_OBJECT,
        free_func: sk_ASN1_OBJECT_free_func,
    );
}
unsafe extern "C" {
    /// Object identifiers.
    ///
    /// An `ASN1_OBJECT` represents an ASN.1 OBJECT IDENTIFIER. See also obj.h for
    /// additional functions relating to `ASN1_OBJECT`.
    ///
    /// TODO(davidben): What's the relationship between asn1.h and obj.h? Most of
    /// obj.h deals with the large NID table, but then functions like `OBJ_get0_data`
    /// or `OBJ_dup` are general `ASN1_OBJECT` functions.
    #[link_name = "sk_ASN1_OBJECT_insert__extern"]
    pub fn sk_ASN1_OBJECT_insert(
        sk: *mut stack_st_ASN1_OBJECT,
        p: *mut ASN1_OBJECT,
        where_: usize,
    ) -> usize;
}
unsafe extern "C" {
    /// Object identifiers.
    ///
    /// An `ASN1_OBJECT` represents an ASN.1 OBJECT IDENTIFIER. See also obj.h for
    /// additional functions relating to `ASN1_OBJECT`.
    ///
    /// TODO(davidben): What's the relationship between asn1.h and obj.h? Most of
    /// obj.h deals with the large NID table, but then functions like `OBJ_get0_data`
    /// or `OBJ_dup` are general `ASN1_OBJECT` functions.
    #[link_name = "sk_ASN1_OBJECT_delete__extern"]
    pub fn sk_ASN1_OBJECT_delete(sk: *mut stack_st_ASN1_OBJECT, where_: usize) -> *mut ASN1_OBJECT;
}
unsafe extern "C" {
    /// Object identifiers.
    ///
    /// An `ASN1_OBJECT` represents an ASN.1 OBJECT IDENTIFIER. See also obj.h for
    /// additional functions relating to `ASN1_OBJECT`.
    ///
    /// TODO(davidben): What's the relationship between asn1.h and obj.h? Most of
    /// obj.h deals with the large NID table, but then functions like `OBJ_get0_data`
    /// or `OBJ_dup` are general `ASN1_OBJECT` functions.
    #[link_name = "sk_ASN1_OBJECT_delete_ptr__extern"]
    pub fn sk_ASN1_OBJECT_delete_ptr(
        sk: *mut stack_st_ASN1_OBJECT,
        p: *const ASN1_OBJECT,
    ) -> *mut ASN1_OBJECT;
}
unsafe extern "C" {
    /// Object identifiers.
    ///
    /// An `ASN1_OBJECT` represents an ASN.1 OBJECT IDENTIFIER. See also obj.h for
    /// additional functions relating to `ASN1_OBJECT`.
    ///
    /// TODO(davidben): What's the relationship between asn1.h and obj.h? Most of
    /// obj.h deals with the large NID table, but then functions like `OBJ_get0_data`
    /// or `OBJ_dup` are general `ASN1_OBJECT` functions.
    #[link_name = "sk_ASN1_OBJECT_delete_if__extern"]
    pub fn sk_ASN1_OBJECT_delete_if(
        sk: *mut stack_st_ASN1_OBJECT,
        func: sk_ASN1_OBJECT_delete_if_func,
        data: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    /// Object identifiers.
    ///
    /// An `ASN1_OBJECT` represents an ASN.1 OBJECT IDENTIFIER. See also obj.h for
    /// additional functions relating to `ASN1_OBJECT`.
    ///
    /// TODO(davidben): What's the relationship between asn1.h and obj.h? Most of
    /// obj.h deals with the large NID table, but then functions like `OBJ_get0_data`
    /// or `OBJ_dup` are general `ASN1_OBJECT` functions.
    #[link_name = "sk_ASN1_OBJECT_find__extern"]
    pub fn sk_ASN1_OBJECT_find(
        sk: *const stack_st_ASN1_OBJECT,
        out_index: *mut usize,
        p: *const ASN1_OBJECT,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Object identifiers.
    ///
    /// An `ASN1_OBJECT` represents an ASN.1 OBJECT IDENTIFIER. See also obj.h for
    /// additional functions relating to `ASN1_OBJECT`.
    ///
    /// TODO(davidben): What's the relationship between asn1.h and obj.h? Most of
    /// obj.h deals with the large NID table, but then functions like `OBJ_get0_data`
    /// or `OBJ_dup` are general `ASN1_OBJECT` functions.
    #[link_name = "sk_ASN1_OBJECT_shift__extern"]
    pub fn sk_ASN1_OBJECT_shift(sk: *mut stack_st_ASN1_OBJECT) -> *mut ASN1_OBJECT;
}
unsafe extern "C" {
    /// Object identifiers.
    ///
    /// An `ASN1_OBJECT` represents an ASN.1 OBJECT IDENTIFIER. See also obj.h for
    /// additional functions relating to `ASN1_OBJECT`.
    ///
    /// TODO(davidben): What's the relationship between asn1.h and obj.h? Most of
    /// obj.h deals with the large NID table, but then functions like `OBJ_get0_data`
    /// or `OBJ_dup` are general `ASN1_OBJECT` functions.
    #[link_name = "sk_ASN1_OBJECT_push__extern"]
    pub fn sk_ASN1_OBJECT_push(sk: *mut stack_st_ASN1_OBJECT, p: *mut ASN1_OBJECT) -> usize;
}
unsafe extern "C" {
    /// Object identifiers.
    ///
    /// An `ASN1_OBJECT` represents an ASN.1 OBJECT IDENTIFIER. See also obj.h for
    /// additional functions relating to `ASN1_OBJECT`.
    ///
    /// TODO(davidben): What's the relationship between asn1.h and obj.h? Most of
    /// obj.h deals with the large NID table, but then functions like `OBJ_get0_data`
    /// or `OBJ_dup` are general `ASN1_OBJECT` functions.
    #[link_name = "sk_ASN1_OBJECT_pop__extern"]
    pub fn sk_ASN1_OBJECT_pop(sk: *mut stack_st_ASN1_OBJECT) -> *mut ASN1_OBJECT;
}
unsafe extern "C" {
    /// Object identifiers.
    ///
    /// An `ASN1_OBJECT` represents an ASN.1 OBJECT IDENTIFIER. See also obj.h for
    /// additional functions relating to `ASN1_OBJECT`.
    ///
    /// TODO(davidben): What's the relationship between asn1.h and obj.h? Most of
    /// obj.h deals with the large NID table, but then functions like `OBJ_get0_data`
    /// or `OBJ_dup` are general `ASN1_OBJECT` functions.
    #[link_name = "sk_ASN1_OBJECT_dup__extern"]
    pub fn sk_ASN1_OBJECT_dup(sk: *const stack_st_ASN1_OBJECT) -> *mut stack_st_ASN1_OBJECT;
}
unsafe extern "C" {
    /// Object identifiers.
    ///
    /// An `ASN1_OBJECT` represents an ASN.1 OBJECT IDENTIFIER. See also obj.h for
    /// additional functions relating to `ASN1_OBJECT`.
    ///
    /// TODO(davidben): What's the relationship between asn1.h and obj.h? Most of
    /// obj.h deals with the large NID table, but then functions like `OBJ_get0_data`
    /// or `OBJ_dup` are general `ASN1_OBJECT` functions.
    #[link_name = "sk_ASN1_OBJECT_sort__extern"]
    pub fn sk_ASN1_OBJECT_sort(sk: *mut stack_st_ASN1_OBJECT);
}
unsafe extern "C" {
    /// Object identifiers.
    ///
    /// An `ASN1_OBJECT` represents an ASN.1 OBJECT IDENTIFIER. See also obj.h for
    /// additional functions relating to `ASN1_OBJECT`.
    ///
    /// TODO(davidben): What's the relationship between asn1.h and obj.h? Most of
    /// obj.h deals with the large NID table, but then functions like `OBJ_get0_data`
    /// or `OBJ_dup` are general `ASN1_OBJECT` functions.
    #[link_name = "sk_ASN1_OBJECT_sort_and_dedup__extern"]
    pub fn sk_ASN1_OBJECT_sort_and_dedup(
        sk: *mut stack_st_ASN1_OBJECT,
        free_func: sk_ASN1_OBJECT_free_func,
    );
}
unsafe extern "C" {
    /// Object identifiers.
    ///
    /// An `ASN1_OBJECT` represents an ASN.1 OBJECT IDENTIFIER. See also obj.h for
    /// additional functions relating to `ASN1_OBJECT`.
    ///
    /// TODO(davidben): What's the relationship between asn1.h and obj.h? Most of
    /// obj.h deals with the large NID table, but then functions like `OBJ_get0_data`
    /// or `OBJ_dup` are general `ASN1_OBJECT` functions.
    #[link_name = "sk_ASN1_OBJECT_is_sorted__extern"]
    pub fn sk_ASN1_OBJECT_is_sorted(sk: *const stack_st_ASN1_OBJECT) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Object identifiers.
    ///
    /// An `ASN1_OBJECT` represents an ASN.1 OBJECT IDENTIFIER. See also obj.h for
    /// additional functions relating to `ASN1_OBJECT`.
    ///
    /// TODO(davidben): What's the relationship between asn1.h and obj.h? Most of
    /// obj.h deals with the large NID table, but then functions like `OBJ_get0_data`
    /// or `OBJ_dup` are general `ASN1_OBJECT` functions.
    #[link_name = "sk_ASN1_OBJECT_set_cmp_func__extern"]
    pub fn sk_ASN1_OBJECT_set_cmp_func(
        sk: *mut stack_st_ASN1_OBJECT,
        comp: sk_ASN1_OBJECT_cmp_func,
    ) -> sk_ASN1_OBJECT_cmp_func;
}
unsafe extern "C" {
    /// Object identifiers.
    ///
    /// An `ASN1_OBJECT` represents an ASN.1 OBJECT IDENTIFIER. See also obj.h for
    /// additional functions relating to `ASN1_OBJECT`.
    ///
    /// TODO(davidben): What's the relationship between asn1.h and obj.h? Most of
    /// obj.h deals with the large NID table, but then functions like `OBJ_get0_data`
    /// or `OBJ_dup` are general `ASN1_OBJECT` functions.
    #[link_name = "sk_ASN1_OBJECT_deep_copy__extern"]
    pub fn sk_ASN1_OBJECT_deep_copy(
        sk: *const stack_st_ASN1_OBJECT,
        copy_func: sk_ASN1_OBJECT_copy_func,
        free_func: sk_ASN1_OBJECT_free_func,
    ) -> *mut stack_st_ASN1_OBJECT;
}
unsafe extern "C" {
    /// ASN1_OBJECT_create returns a newly-allocated `ASN1_OBJECT` with `len` bytes
    /// from `data` as the encoded OID, or NULL on error. `data` should contain the
    /// DER-encoded identifier, excluding the tag and length.
    ///
    /// `nid` should be `NID_undef`. Passing a NID value that does not match `data`
    /// will cause some functions to misbehave. `sn` and `ln` should be NULL. If
    /// non-NULL, they are stored as short and long names, respectively, but these
    /// values have no effect for `ASN1_OBJECT`s created through this function.
    ///
    /// TODO(davidben): Should we just ignore all those parameters? NIDs and names
    /// are only relevant for `ASN1_OBJECT`s in the obj.h table.
    pub fn ASN1_OBJECT_create(
        nid: ::core::ffi::c_int,
        data: *const u8,
        len: usize,
        sn: *const ::core::ffi::c_char,
        ln: *const ::core::ffi::c_char,
    ) -> *mut ASN1_OBJECT;
}
unsafe extern "C" {
    /// ASN1_OBJECT_free releases memory associated with `a`. If `a` is a static
    /// `ASN1_OBJECT`, returned from `OBJ_nid2obj`, this function does nothing.
    pub fn ASN1_OBJECT_free(a: *mut ASN1_OBJECT);
}
unsafe extern "C" {
    /// d2i_ASN1_OBJECT parses a DER-encoded ASN.1 OBJECT IDENTIFIER from up to `len`
    /// bytes at `*inp`, as described in `d2i_SAMPLE`.
    pub fn d2i_ASN1_OBJECT(
        out: *mut *mut ASN1_OBJECT,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut ASN1_OBJECT;
}
unsafe extern "C" {
    /// i2d_ASN1_OBJECT marshals `in` as a DER-encoded ASN.1 OBJECT IDENTIFIER, as
    /// described in `i2d_SAMPLE`.
    pub fn i2d_ASN1_OBJECT(in_: *const ASN1_OBJECT, outp: *mut *mut u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// c2i_ASN1_OBJECT decodes `len` bytes from `*inp` as the contents of a
    /// DER-encoded OBJECT IDENTIFIER, excluding the tag and length. It behaves like
    /// `d2i_SAMPLE` except, on success, it always consumes all `len` bytes.
    pub fn c2i_ASN1_OBJECT(
        out: *mut *mut ASN1_OBJECT,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut ASN1_OBJECT;
}
unsafe extern "C" {
    /// ASN1_OBJECT is an `ASN1_ITEM` with ASN.1 type OBJECT IDENTIFIER and C type
    /// `ASN1_OBJECT*`.
    pub static ASN1_OBJECT_it: ASN1_ITEM;
}
/// An asn1_type_st (aka `ASN1_TYPE`) represents an arbitrary ASN.1 element,
/// typically used for ANY types. It contains a `type` field and a `value` union
/// dependent on `type`.
///
/// WARNING: This struct has a complex representation. Callers must not construct
/// `ASN1_TYPE` values manually. Use `ASN1_TYPE_set` and `ASN1_TYPE_set1`
/// instead. Additionally, callers performing non-trivial operations on this type
/// are encouraged to use `CBS` and `CBB` from <openssl/bytestring.h>, and
/// convert to or from `ASN1_TYPE` with `d2i_ASN1_TYPE` or `i2d_ASN1_TYPE`.
///
/// The `type` field corresponds to the tag of the ASN.1 element being
/// represented:
///
/// If `type` is a `V_ASN1_*` constant for an ASN.1 string-like type, as defined
/// by `ASN1_STRING`, the tag matches the constant. `value` contains an
/// `ASN1_STRING` pointer (equivalently, one of the more specific typedefs). See
/// `ASN1_STRING` for details on the representation. Unlike `ASN1_STRING`,
/// `ASN1_TYPE` does not use the `V_ASN1_NEG` flag for negative INTEGER and
/// ENUMERATE values. For a negative value, the `ASN1_TYPE`'s `type` will be
/// `V_ASN1_INTEGER` or `V_ASN1_ENUMERATED`, but `value` will an `ASN1_STRING`
/// whose `type` is `V_ASN1_NEG_INTEGER` or `V_ASN1_NEG_ENUMERATED`.
///
/// If `type` is `V_ASN1_OBJECT`, the tag is OBJECT IDENTIFIER and `value`
/// contains an `ASN1_OBJECT` pointer.
///
/// If `type` is `V_ASN1_NULL`, the tag is NULL. `value` contains a NULL pointer.
///
/// If `type` is `V_ASN1_BOOLEAN`, the tag is BOOLEAN. `value` contains an
/// `ASN1_BOOLEAN`.
///
/// If `type` is `V_ASN1_SEQUENCE`, `V_ASN1_SET`, or `V_ASN1_OTHER`, the tag is
/// SEQUENCE, SET, or some arbitrary tag, respectively. `value` uses the
/// corresponding `ASN1_STRING` representation. Although any type may be
/// represented in `V_ASN1_OTHER`, the parser will always return the more
/// specific encoding when available.
///
/// Other values of `type` do not represent a valid ASN.1 value, though
/// default-constructed objects may set `type` to -1. Such objects cannot be
/// serialized.
#[repr(C)]
#[derive(Copy, Clone)]
pub struct asn1_type_st {
    pub type_: ::core::ffi::c_int,
    pub value: asn1_type_st__bindgen_ty_1,
}
#[repr(C)]
#[derive(Copy, Clone)]
pub union asn1_type_st__bindgen_ty_1 {
    pub ptr: *mut ::core::ffi::c_char,
    pub boolean: ASN1_BOOLEAN,
    pub asn1_string: *mut ASN1_STRING,
    pub object: *mut ASN1_OBJECT,
    pub integer: *mut ASN1_INTEGER,
    pub enumerated: *mut ASN1_ENUMERATED,
    pub bit_string: *mut ASN1_BIT_STRING,
    pub octet_string: *mut ASN1_OCTET_STRING,
    pub printablestring: *mut ASN1_PRINTABLESTRING,
    pub t61string: *mut ASN1_T61STRING,
    pub ia5string: *mut ASN1_IA5STRING,
    pub generalstring: *mut ASN1_GENERALSTRING,
    pub bmpstring: *mut ASN1_BMPSTRING,
    pub universalstring: *mut ASN1_UNIVERSALSTRING,
    pub utctime: *mut ASN1_UTCTIME,
    pub generalizedtime: *mut ASN1_GENERALIZEDTIME,
    pub visiblestring: *mut ASN1_VISIBLESTRING,
    pub utf8string: *mut ASN1_UTF8STRING,
    /// set and sequence are left complete and still contain the entire element.
    pub set: *mut ASN1_STRING,
    pub sequence: *mut ASN1_STRING,
    pub asn1_value: *mut ASN1_VALUE,
}
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct stack_st_ASN1_TYPE {
    _unused: [u8; 0],
}
/// We also disable -Wcast-qual. As part of this C-based type erasure setup,  \
/// the wrapper macros need to cast away const in places. In C++, const_cast  \
/// suppresses the warning, but it seemingly cannot be suppressed in C.
pub type sk_ASN1_TYPE_free_func =
    ::core::option::Option<unsafe extern "C" fn(arg1: *mut ASN1_TYPE)>;
pub type sk_ASN1_TYPE_copy_func =
    ::core::option::Option<unsafe extern "C" fn(arg1: *const ASN1_TYPE) -> *mut ASN1_TYPE>;
pub type sk_ASN1_TYPE_cmp_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *const *const ASN1_TYPE,
        arg2: *const *const ASN1_TYPE,
    ) -> ::core::ffi::c_int,
>;
pub type sk_ASN1_TYPE_delete_if_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *mut ASN1_TYPE,
        arg2: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int,
>;
unsafe extern "C" {
    #[link_name = "sk_ASN1_TYPE_call_free_func__extern"]
    pub fn sk_ASN1_TYPE_call_free_func(
        free_func: OPENSSL_sk_free_func,
        ptr: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    #[link_name = "sk_ASN1_TYPE_call_copy_func__extern"]
    pub fn sk_ASN1_TYPE_call_copy_func(
        copy_func: OPENSSL_sk_copy_func,
        ptr: *const ::core::ffi::c_void,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    #[link_name = "sk_ASN1_TYPE_call_cmp_func__extern"]
    pub fn sk_ASN1_TYPE_call_cmp_func(
        cmp_func: OPENSSL_sk_cmp_func,
        a: *const ::core::ffi::c_void,
        b: *const ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_ASN1_TYPE_call_delete_if_func__extern"]
    pub fn sk_ASN1_TYPE_call_delete_if_func(
        func: OPENSSL_sk_delete_if_func,
        obj: *mut ::core::ffi::c_void,
        data: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_ASN1_TYPE_new__extern"]
    pub fn sk_ASN1_TYPE_new(comp: sk_ASN1_TYPE_cmp_func) -> *mut stack_st_ASN1_TYPE;
}
unsafe extern "C" {
    #[link_name = "sk_ASN1_TYPE_new_null__extern"]
    pub fn sk_ASN1_TYPE_new_null() -> *mut stack_st_ASN1_TYPE;
}
unsafe extern "C" {
    #[link_name = "sk_ASN1_TYPE_num__extern"]
    pub fn sk_ASN1_TYPE_num(sk: *const stack_st_ASN1_TYPE) -> usize;
}
unsafe extern "C" {
    #[link_name = "sk_ASN1_TYPE_zero__extern"]
    pub fn sk_ASN1_TYPE_zero(sk: *mut stack_st_ASN1_TYPE);
}
unsafe extern "C" {
    #[link_name = "sk_ASN1_TYPE_value__extern"]
    pub fn sk_ASN1_TYPE_value(sk: *const stack_st_ASN1_TYPE, i: usize) -> *mut ASN1_TYPE;
}
unsafe extern "C" {
    #[link_name = "sk_ASN1_TYPE_set__extern"]
    pub fn sk_ASN1_TYPE_set(
        sk: *mut stack_st_ASN1_TYPE,
        i: usize,
        p: *mut ASN1_TYPE,
    ) -> *mut ASN1_TYPE;
}
unsafe extern "C" {
    #[link_name = "sk_ASN1_TYPE_free__extern"]
    pub fn sk_ASN1_TYPE_free(sk: *mut stack_st_ASN1_TYPE);
}
unsafe extern "C" {
    #[link_name = "sk_ASN1_TYPE_pop_free__extern"]
    pub fn sk_ASN1_TYPE_pop_free(sk: *mut stack_st_ASN1_TYPE, free_func: sk_ASN1_TYPE_free_func);
}
unsafe extern "C" {
    #[link_name = "sk_ASN1_TYPE_insert__extern"]
    pub fn sk_ASN1_TYPE_insert(
        sk: *mut stack_st_ASN1_TYPE,
        p: *mut ASN1_TYPE,
        where_: usize,
    ) -> usize;
}
unsafe extern "C" {
    #[link_name = "sk_ASN1_TYPE_delete__extern"]
    pub fn sk_ASN1_TYPE_delete(sk: *mut stack_st_ASN1_TYPE, where_: usize) -> *mut ASN1_TYPE;
}
unsafe extern "C" {
    #[link_name = "sk_ASN1_TYPE_delete_ptr__extern"]
    pub fn sk_ASN1_TYPE_delete_ptr(
        sk: *mut stack_st_ASN1_TYPE,
        p: *const ASN1_TYPE,
    ) -> *mut ASN1_TYPE;
}
unsafe extern "C" {
    #[link_name = "sk_ASN1_TYPE_delete_if__extern"]
    pub fn sk_ASN1_TYPE_delete_if(
        sk: *mut stack_st_ASN1_TYPE,
        func: sk_ASN1_TYPE_delete_if_func,
        data: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    #[link_name = "sk_ASN1_TYPE_find__extern"]
    pub fn sk_ASN1_TYPE_find(
        sk: *const stack_st_ASN1_TYPE,
        out_index: *mut usize,
        p: *const ASN1_TYPE,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_ASN1_TYPE_shift__extern"]
    pub fn sk_ASN1_TYPE_shift(sk: *mut stack_st_ASN1_TYPE) -> *mut ASN1_TYPE;
}
unsafe extern "C" {
    #[link_name = "sk_ASN1_TYPE_push__extern"]
    pub fn sk_ASN1_TYPE_push(sk: *mut stack_st_ASN1_TYPE, p: *mut ASN1_TYPE) -> usize;
}
unsafe extern "C" {
    #[link_name = "sk_ASN1_TYPE_pop__extern"]
    pub fn sk_ASN1_TYPE_pop(sk: *mut stack_st_ASN1_TYPE) -> *mut ASN1_TYPE;
}
unsafe extern "C" {
    #[link_name = "sk_ASN1_TYPE_dup__extern"]
    pub fn sk_ASN1_TYPE_dup(sk: *const stack_st_ASN1_TYPE) -> *mut stack_st_ASN1_TYPE;
}
unsafe extern "C" {
    #[link_name = "sk_ASN1_TYPE_sort__extern"]
    pub fn sk_ASN1_TYPE_sort(sk: *mut stack_st_ASN1_TYPE);
}
unsafe extern "C" {
    #[link_name = "sk_ASN1_TYPE_sort_and_dedup__extern"]
    pub fn sk_ASN1_TYPE_sort_and_dedup(
        sk: *mut stack_st_ASN1_TYPE,
        free_func: sk_ASN1_TYPE_free_func,
    );
}
unsafe extern "C" {
    #[link_name = "sk_ASN1_TYPE_is_sorted__extern"]
    pub fn sk_ASN1_TYPE_is_sorted(sk: *const stack_st_ASN1_TYPE) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_ASN1_TYPE_set_cmp_func__extern"]
    pub fn sk_ASN1_TYPE_set_cmp_func(
        sk: *mut stack_st_ASN1_TYPE,
        comp: sk_ASN1_TYPE_cmp_func,
    ) -> sk_ASN1_TYPE_cmp_func;
}
unsafe extern "C" {
    #[link_name = "sk_ASN1_TYPE_deep_copy__extern"]
    pub fn sk_ASN1_TYPE_deep_copy(
        sk: *const stack_st_ASN1_TYPE,
        copy_func: sk_ASN1_TYPE_copy_func,
        free_func: sk_ASN1_TYPE_free_func,
    ) -> *mut stack_st_ASN1_TYPE;
}
unsafe extern "C" {
    /// ASN1_TYPE_new returns a newly-allocated `ASN1_TYPE`, or NULL on allocation
    /// failure. The resulting object has type -1 and must be initialized to be
    /// a valid ANY value.
    pub fn ASN1_TYPE_new() -> *mut ASN1_TYPE;
}
unsafe extern "C" {
    /// ASN1_TYPE_free releases memory associated with `a`.
    pub fn ASN1_TYPE_free(a: *mut ASN1_TYPE);
}
unsafe extern "C" {
    /// d2i_ASN1_TYPE parses up to `len` bytes from `*inp` as an ASN.1 value of any
    /// type, as described in `d2i_SAMPLE`. Note this function only validates
    /// primitive, universal types supported by this library. Values of type
    /// `V_ASN1_SEQUENCE`, `V_ASN1_SET`, `V_ASN1_OTHER`, or an unsupported primitive
    /// type must be validated by the caller when interpreting.
    ///
    /// TODO(https://crbug.com/boringssl/354): This function currently also accepts
    /// BER, but this will be removed in the future.
    pub fn d2i_ASN1_TYPE(
        out: *mut *mut ASN1_TYPE,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut ASN1_TYPE;
}
unsafe extern "C" {
    /// i2d_ASN1_TYPE marshals `in` as DER, as described in `i2d_SAMPLE`.
    pub fn i2d_ASN1_TYPE(in_: *const ASN1_TYPE, outp: *mut *mut u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_ANY is an `ASN1_ITEM` with ASN.1 type ANY and C type `ASN1_TYPE*`. Note
    /// the `ASN1_ITEM` name and C type do not match.
    pub static ASN1_ANY_it: ASN1_ITEM;
}
unsafe extern "C" {
    /// ASN1_TYPE_get returns the type of `a`, which will be one of the `V_ASN1_*`
    /// constants, or zero if `a` is not fully initialized.
    pub fn ASN1_TYPE_get(a: *const ASN1_TYPE) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_TYPE_set sets `a` to an `ASN1_TYPE` of type `type` and value `value`,
    /// releasing the previous contents of `a`.
    ///
    /// If `type` is `V_ASN1_BOOLEAN`, `a` is set to FALSE if `value` is NULL and
    /// TRUE otherwise. If setting `a` to TRUE, `value` may be an invalid pointer,
    /// such as (void*)1.
    ///
    /// If `type` is `V_ASN1_NULL`, `value` must be NULL.
    ///
    /// For other values of `type`, this function takes ownership of `value`, which
    /// must point to an object of the corresponding type. See `ASN1_TYPE` for
    /// details.
    pub fn ASN1_TYPE_set(
        a: *mut ASN1_TYPE,
        type_: ::core::ffi::c_int,
        value: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    /// ASN1_TYPE_set1 behaves like `ASN1_TYPE_set` except it does not take ownership
    /// of `value`. It returns one on success and zero on error.
    pub fn ASN1_TYPE_set1(
        a: *mut ASN1_TYPE,
        type_: ::core::ffi::c_int,
        value: *const ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_TYPE_cmp returns zero if `a` and `b` are equal and some non-zero value
    /// otherwise. Note this function can only be used for equality checks, not an
    /// ordering.
    pub fn ASN1_TYPE_cmp(a: *const ASN1_TYPE, b: *const ASN1_TYPE) -> ::core::ffi::c_int;
}
pub type ASN1_SEQUENCE_ANY = stack_st_ASN1_TYPE;
unsafe extern "C" {
    /// d2i_ASN1_SEQUENCE_ANY parses up to `len` bytes from `*inp` as a DER-encoded
    /// ASN.1 SEQUENCE OF ANY structure, as described in `d2i_SAMPLE`. The resulting
    /// `ASN1_SEQUENCE_ANY` owns its contents and thus must be released with
    /// `sk_ASN1_TYPE_pop_free` and `ASN1_TYPE_free`, not `sk_ASN1_TYPE_free`.
    ///
    /// TODO(https://crbug.com/boringssl/354): This function currently also accepts
    /// BER, but this will be removed in the future.
    pub fn d2i_ASN1_SEQUENCE_ANY(
        out: *mut *mut ASN1_SEQUENCE_ANY,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut ASN1_SEQUENCE_ANY;
}
unsafe extern "C" {
    /// i2d_ASN1_SEQUENCE_ANY marshals `in` as a DER-encoded SEQUENCE OF ANY
    /// structure, as described in `i2d_SAMPLE`.
    pub fn i2d_ASN1_SEQUENCE_ANY(
        in_: *const ASN1_SEQUENCE_ANY,
        outp: *mut *mut u8,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// d2i_ASN1_SET_ANY parses up to `len` bytes from `*inp` as a DER-encoded ASN.1
    /// SET OF ANY structure, as described in `d2i_SAMPLE`. The resulting
    /// `ASN1_SEQUENCE_ANY` owns its contents and thus must be released with
    /// `sk_ASN1_TYPE_pop_free` and `ASN1_TYPE_free`, not `sk_ASN1_TYPE_free`.
    ///
    /// TODO(https://crbug.com/boringssl/354): This function currently also accepts
    /// BER, but this will be removed in the future.
    pub fn d2i_ASN1_SET_ANY(
        out: *mut *mut ASN1_SEQUENCE_ANY,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut ASN1_SEQUENCE_ANY;
}
unsafe extern "C" {
    /// i2d_ASN1_SET_ANY marshals `in` as a DER-encoded SET OF ANY structure, as
    /// described in `i2d_SAMPLE`.
    pub fn i2d_ASN1_SET_ANY(
        in_: *const ASN1_SEQUENCE_ANY,
        outp: *mut *mut u8,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_UTCTIME_print writes a human-readable representation of `a` to `out`. It
    /// returns one on success and zero on error.
    pub fn ASN1_UTCTIME_print(out: *mut BIO, a: *const ASN1_UTCTIME) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_GENERALIZEDTIME_print writes a human-readable representation of `a` to
    /// `out`. It returns one on success and zero on error.
    pub fn ASN1_GENERALIZEDTIME_print(
        out: *mut BIO,
        a: *const ASN1_GENERALIZEDTIME,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_TIME_print writes a human-readable representation of `a` to `out`. It
    /// returns one on success and zero on error.
    pub fn ASN1_TIME_print(out: *mut BIO, a: *const ASN1_TIME) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_STRING_print writes a human-readable representation of `str` to `out`.
    /// It returns one on success and zero on error. Unprintable characters are
    /// replaced with '.'.
    pub fn ASN1_STRING_print(out: *mut BIO, str_: *const ASN1_STRING) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_STRING_print_ex writes a human-readable representation of `str` to
    /// `out`. It returns the number of bytes written on success and -1 on error. If
    /// `out` is NULL, it returns the number of bytes it would have written, without
    /// writing anything.
    ///
    /// The `flags` should be a combination of combination of `ASN1_STRFLGS_*`
    /// constants. See the documentation for each flag for how it controls the
    /// output. If unsure, use `ASN1_STRFLGS_RFC2253`.
    pub fn ASN1_STRING_print_ex(
        out: *mut BIO,
        str_: *const ASN1_STRING,
        flags: ::core::ffi::c_ulong,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_STRING_print_ex_fp behaves like `ASN1_STRING_print_ex` but writes to a
    /// `FILE` rather than a `BIO`.
    pub fn ASN1_STRING_print_ex_fp(
        fp: *mut FILE,
        str_: *const ASN1_STRING,
        flags: ::core::ffi::c_ulong,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// i2a_ASN1_INTEGER writes a human-readable representation of `a` to `bp`. It
    /// returns the number of bytes written on success, or a negative number on
    /// error. On error, this function may have written a partial output to `bp`.
    pub fn i2a_ASN1_INTEGER(bp: *mut BIO, a: *const ASN1_INTEGER) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// i2a_ASN1_ENUMERATED writes a human-readable representation of `a` to `bp`. It
    /// returns the number of bytes written on success, or a negative number on
    /// error. On error, this function may have written a partial output to `bp`.
    pub fn i2a_ASN1_ENUMERATED(bp: *mut BIO, a: *const ASN1_ENUMERATED) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// i2a_ASN1_OBJECT writes a human-readable representation of `a` to `bp`. It
    /// returns the number of bytes written on success, or a negative number on
    /// error. On error, this function may have written a partial output to `bp`.
    pub fn i2a_ASN1_OBJECT(bp: *mut BIO, a: *const ASN1_OBJECT) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// i2a_ASN1_STRING writes a text representation of `a`'s contents to `bp`. It
    /// returns the number of bytes written on success, or a negative number on
    /// error. On error, this function may have written a partial output to `bp`.
    /// `type` is ignored.
    ///
    /// This function does not decode `a` into a Unicode string. It only hex-encodes
    /// the internal representation of `a`. This is suitable for printing an OCTET
    /// STRING, but may not be human-readable for any other string type.
    pub fn i2a_ASN1_STRING(
        bp: *mut BIO,
        a: *const ASN1_STRING,
        type_: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// i2t_ASN1_OBJECT calls `OBJ_obj2txt` with `always_return_oid` set to zero.
    pub fn i2t_ASN1_OBJECT(
        buf: *mut ::core::ffi::c_char,
        buf_len: ::core::ffi::c_int,
        a: *const ASN1_OBJECT,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_get_object parses a BER element from up to `max_len` bytes at `*inp`. It
    /// returns `V_ASN1_CONSTRUCTED` if it successfully parsed a constructed element,
    /// zero if it successfully parsed a primitive element, and 0x80 on error. On
    /// success, it additionally advances `*inp` to the element body, sets
    /// `*out_length`, `*out_tag`, and `*out_class` to the element's length, tag
    /// number, and tag class, respectively,
    ///
    /// Unlike OpenSSL, this function only supports DER. Indefinite and non-minimal
    /// lengths are rejected.
    ///
    /// This function is difficult to use correctly. Use `CBS_get_asn1` and related
    /// functions from bytestring.h.
    pub fn ASN1_get_object(
        inp: *mut *const ::core::ffi::c_uchar,
        out_length: *mut ::core::ffi::c_long,
        out_tag: *mut ::core::ffi::c_int,
        out_class: *mut ::core::ffi::c_int,
        max_len: ::core::ffi::c_long,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_put_object writes the header for a DER or BER element to `*outp` and
    /// advances `*outp` by the number of bytes written. The caller is responsible
    /// for ensuring `*outp` has enough space for the output. The header describes an
    /// element with length `length`, tag number `tag`, and class `xclass`. `xclass`
    /// should be one of the `V_ASN1_*` tag class constants. The element is primitive
    /// if `constructed` is zero and constructed if it is one or two. If
    /// `constructed` is two, `length` is ignored and the element uses
    /// indefinite-length encoding.
    ///
    /// Use `CBB_add_asn1` instead.
    pub fn ASN1_put_object(
        outp: *mut *mut ::core::ffi::c_uchar,
        constructed: ::core::ffi::c_int,
        length: ::core::ffi::c_int,
        tag: ::core::ffi::c_int,
        xclass: ::core::ffi::c_int,
    );
}
unsafe extern "C" {
    /// ASN1_put_eoc writes two zero bytes to `*outp`, advances `*outp` to point past
    /// those bytes, and returns two.
    ///
    /// Use definite-length encoding instead.
    pub fn ASN1_put_eoc(outp: *mut *mut ::core::ffi::c_uchar) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_object_size returns the number of bytes needed to encode a DER or BER
    /// value with length `length` and tag number `tag`, or -1 on error. `tag` should
    /// not include the constructed bit or tag class. If `constructed` is zero or
    /// one, the result uses a definite-length encoding with minimally-encoded
    /// length, as in DER. If `constructed` is two, the result uses BER
    /// indefinite-length encoding.
    ///
    /// Use `CBB_add_asn1` instead.
    pub fn ASN1_object_size(
        constructed: ::core::ffi::c_int,
        length: ::core::ffi::c_int,
        tag: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_BIT_STRING_num_bytes computes the length of `str` in bytes. If `str`'s
    /// bit length is a multiple of 8, it sets `*out` to the byte length and returns
    /// one. Otherwise, it returns zero.
    ///
    /// This function may be used with `ASN1_STRING_get0_data` to interpret `str` as
    /// a byte string.
    ///
    /// This function is no longer necessary. The byte length is always equal to
    /// `ASN1_STRING_length` and callers can check for a whole number of bytes by
    /// checking if `ASN1_BIT_STRING_unused_bits` is zero.
    pub fn ASN1_BIT_STRING_num_bytes(
        str_: *const ASN1_BIT_STRING,
        out: *mut usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_STRING_set_default_mask does nothing.
    pub fn ASN1_STRING_set_default_mask(mask: ::core::ffi::c_ulong);
}
unsafe extern "C" {
    /// ASN1_STRING_set_default_mask_asc returns one.
    pub fn ASN1_STRING_set_default_mask_asc(p: *const ::core::ffi::c_char) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_STRING_get_default_mask returns `B_ASN1_UTF8STRING`.
    pub fn ASN1_STRING_get_default_mask() -> ::core::ffi::c_ulong;
}
unsafe extern "C" {
    /// ASN1_STRING_TABLE_cleanup does nothing.
    pub fn ASN1_STRING_TABLE_cleanup();
}
unsafe extern "C" {
    /// ASN1_INTEGER_set sets `a` to an INTEGER with value `v`. It returns one on
    /// success and zero on error.
    ///
    /// Use `ASN1_INTEGER_set_uint64` and `ASN1_INTEGER_set_int64` instead.
    pub fn ASN1_INTEGER_set(a: *mut ASN1_INTEGER, v: ::core::ffi::c_long) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_ENUMERATED_set sets `a` to an ENUMERATED with value `v`. It returns one
    /// on success and zero on error.
    ///
    /// Use `ASN1_ENUMERATED_set_uint64` and `ASN1_ENUMERATED_set_int64` instead.
    pub fn ASN1_ENUMERATED_set(
        a: *mut ASN1_ENUMERATED,
        v: ::core::ffi::c_long,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_INTEGER_get returns the value of `a` as a `long`, or -1 if `a` is out of
    /// range or the wrong type.
    ///
    /// WARNING: This function's return value cannot distinguish errors from -1.
    /// Use `ASN1_INTEGER_get_uint64` and `ASN1_INTEGER_get_int64` instead.
    pub fn ASN1_INTEGER_get(a: *const ASN1_INTEGER) -> ::core::ffi::c_long;
}
unsafe extern "C" {
    /// ASN1_ENUMERATED_get returns the value of `a` as a `long`, or -1 if `a` is out
    /// of range or the wrong type.
    ///
    /// WARNING: This function's return value cannot distinguish errors from -1.
    /// Use `ASN1_ENUMERATED_get_uint64` and `ASN1_ENUMERATED_get_int64` instead.
    pub fn ASN1_ENUMERATED_get(a: *const ASN1_ENUMERATED) -> ::core::ffi::c_long;
}
/// Legacy ASN.1 library template definitions.
///
/// This header is used to define new types in OpenSSL's ASN.1 implementation. It
/// is deprecated and will be unexported from the library. Use the new `CBS` and
/// `CBB` library in <openssl/bytestring.h> instead.
pub type ASN1_TEMPLATE = ASN1_TEMPLATE_st;
/// Deprecated tag and length cache
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct ASN1_TLC_st {
    _unused: [u8; 0],
}
pub type ASN1_TLC = ASN1_TLC_st;
/// This is the ASN1 template structure that defines
/// a wrapper round the actual type. It determines the
/// actual position of the field in the value structure,
/// various flags such as OPTIONAL and the field name.
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct ASN1_TEMPLATE_st {
    /// Various flags
    pub flags: u32,
    /// tag, not used if no tagging
    pub tag: ::core::ffi::c_int,
    /// Offset of this field in structure
    pub offset: ::core::ffi::c_ulong,
    /// Field name
    pub field_name: *const ::core::ffi::c_char,
    /// Relevant ASN1_ITEM or ASN1_ADB
    pub item: *const ASN1_ITEM_st,
}
pub type ASN1_ADB_TABLE = ASN1_ADB_TABLE_st;
pub type ASN1_ADB = ASN1_ADB_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct ASN1_ADB_st {
    /// Various flags
    pub flags: u32,
    /// Offset of selector field
    pub offset: ::core::ffi::c_ulong,
    pub unused: *mut CRYPTO_MUST_BE_NULL,
    /// Table of possible types
    pub tbl: *const ASN1_ADB_TABLE,
    /// Number of entries in tbl
    pub tblcount: ::core::ffi::c_long,
    /// Type to use if no match
    pub default_tt: *const ASN1_TEMPLATE,
    /// Type to use if selector is NULL
    pub null_tt: *const ASN1_TEMPLATE,
}
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct ASN1_ADB_TABLE_st {
    /// NID for an object
    pub value: ::core::ffi::c_int,
    /// item for this value
    pub tt: ASN1_TEMPLATE,
}
/// This is the actual ASN1 item itself
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct ASN1_ITEM_st {
    /// The item type, primitive, SEQUENCE, CHOICE or extern
    pub itype: ::core::ffi::c_char,
    /// underlying type
    pub utype: ::core::ffi::c_int,
    /// If SEQUENCE or CHOICE this contains the contents
    pub templates: *const ASN1_TEMPLATE,
    /// Number of templates if SEQUENCE or CHOICE
    pub tcount: ::core::ffi::c_long,
    /// functions that handle this type
    pub funcs: *const ::core::ffi::c_void,
    /// Structure size (usually)
    pub size: ::core::ffi::c_long,
    /// Structure name
    pub sname: *const ::core::ffi::c_char,
}
/// This is the ASN1_AUX structure: it handles various
/// miscellaneous requirements. For example the use of
/// reference counts and an informational callback.
///
/// The "informational callback" is called at various
/// points during the ASN1 encoding and decoding. It can
/// be used to provide minor customisation of the structures
/// used. This is most useful where the supplied routines
/// *almost* do the right thing but need some extra help
/// at a few points. If the callback returns zero then
/// it is assumed a fatal error has occurred and the
/// main operation should be abandoned.
///
/// If major changes in the default behaviour are required
/// then an external type is more appropriate.
pub type ASN1_aux_cb = ::core::option::Option<
    unsafe extern "C" fn(
        operation: ::core::ffi::c_int,
        in_: *mut *mut ASN1_VALUE,
        it: *const ASN1_ITEM,
        exarg: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int,
>;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct ASN1_AUX_st {
    pub app_data: *mut ::core::ffi::c_void,
    pub flags: u32,
    /// Offset of reference value
    pub ref_offset: ::core::ffi::c_int,
    pub asn1_cb: ASN1_aux_cb,
    /// Offset of bssl::ASN1_ENCODING structure
    pub enc_offset: ::core::ffi::c_int,
}
pub type ASN1_AUX = ASN1_AUX_st;
unsafe extern "C" {
    /// external definitions for primitive types
    pub static ASN1_SEQUENCE_it: ASN1_ITEM;
}
/// external definitions for primitive types
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct stack_st_ASN1_VALUE {
    _unused: [u8; 0],
}
/// external definitions for primitive types
pub type sk_ASN1_VALUE_free_func =
    ::core::option::Option<unsafe extern "C" fn(arg1: *mut ASN1_VALUE)>;
/// external definitions for primitive types
pub type sk_ASN1_VALUE_copy_func =
    ::core::option::Option<unsafe extern "C" fn(arg1: *const ASN1_VALUE) -> *mut ASN1_VALUE>;
/// external definitions for primitive types
pub type sk_ASN1_VALUE_cmp_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *const *const ASN1_VALUE,
        arg2: *const *const ASN1_VALUE,
    ) -> ::core::ffi::c_int,
>;
/// external definitions for primitive types
pub type sk_ASN1_VALUE_delete_if_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *mut ASN1_VALUE,
        arg2: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int,
>;
unsafe extern "C" {
    /// external definitions for primitive types
    #[link_name = "sk_ASN1_VALUE_call_free_func__extern"]
    pub fn sk_ASN1_VALUE_call_free_func(
        free_func: OPENSSL_sk_free_func,
        ptr: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    /// external definitions for primitive types
    #[link_name = "sk_ASN1_VALUE_call_copy_func__extern"]
    pub fn sk_ASN1_VALUE_call_copy_func(
        copy_func: OPENSSL_sk_copy_func,
        ptr: *const ::core::ffi::c_void,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    /// external definitions for primitive types
    #[link_name = "sk_ASN1_VALUE_call_cmp_func__extern"]
    pub fn sk_ASN1_VALUE_call_cmp_func(
        cmp_func: OPENSSL_sk_cmp_func,
        a: *const ::core::ffi::c_void,
        b: *const ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// external definitions for primitive types
    #[link_name = "sk_ASN1_VALUE_call_delete_if_func__extern"]
    pub fn sk_ASN1_VALUE_call_delete_if_func(
        func: OPENSSL_sk_delete_if_func,
        obj: *mut ::core::ffi::c_void,
        data: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// external definitions for primitive types
    #[link_name = "sk_ASN1_VALUE_new__extern"]
    pub fn sk_ASN1_VALUE_new(comp: sk_ASN1_VALUE_cmp_func) -> *mut stack_st_ASN1_VALUE;
}
unsafe extern "C" {
    /// external definitions for primitive types
    #[link_name = "sk_ASN1_VALUE_new_null__extern"]
    pub fn sk_ASN1_VALUE_new_null() -> *mut stack_st_ASN1_VALUE;
}
unsafe extern "C" {
    /// external definitions for primitive types
    #[link_name = "sk_ASN1_VALUE_num__extern"]
    pub fn sk_ASN1_VALUE_num(sk: *const stack_st_ASN1_VALUE) -> usize;
}
unsafe extern "C" {
    /// external definitions for primitive types
    #[link_name = "sk_ASN1_VALUE_zero__extern"]
    pub fn sk_ASN1_VALUE_zero(sk: *mut stack_st_ASN1_VALUE);
}
unsafe extern "C" {
    /// external definitions for primitive types
    #[link_name = "sk_ASN1_VALUE_value__extern"]
    pub fn sk_ASN1_VALUE_value(sk: *const stack_st_ASN1_VALUE, i: usize) -> *mut ASN1_VALUE;
}
unsafe extern "C" {
    /// external definitions for primitive types
    #[link_name = "sk_ASN1_VALUE_set__extern"]
    pub fn sk_ASN1_VALUE_set(
        sk: *mut stack_st_ASN1_VALUE,
        i: usize,
        p: *mut ASN1_VALUE,
    ) -> *mut ASN1_VALUE;
}
unsafe extern "C" {
    /// external definitions for primitive types
    #[link_name = "sk_ASN1_VALUE_free__extern"]
    pub fn sk_ASN1_VALUE_free(sk: *mut stack_st_ASN1_VALUE);
}
unsafe extern "C" {
    /// external definitions for primitive types
    #[link_name = "sk_ASN1_VALUE_pop_free__extern"]
    pub fn sk_ASN1_VALUE_pop_free(sk: *mut stack_st_ASN1_VALUE, free_func: sk_ASN1_VALUE_free_func);
}
unsafe extern "C" {
    /// external definitions for primitive types
    #[link_name = "sk_ASN1_VALUE_insert__extern"]
    pub fn sk_ASN1_VALUE_insert(
        sk: *mut stack_st_ASN1_VALUE,
        p: *mut ASN1_VALUE,
        where_: usize,
    ) -> usize;
}
unsafe extern "C" {
    /// external definitions for primitive types
    #[link_name = "sk_ASN1_VALUE_delete__extern"]
    pub fn sk_ASN1_VALUE_delete(sk: *mut stack_st_ASN1_VALUE, where_: usize) -> *mut ASN1_VALUE;
}
unsafe extern "C" {
    /// external definitions for primitive types
    #[link_name = "sk_ASN1_VALUE_delete_ptr__extern"]
    pub fn sk_ASN1_VALUE_delete_ptr(
        sk: *mut stack_st_ASN1_VALUE,
        p: *const ASN1_VALUE,
    ) -> *mut ASN1_VALUE;
}
unsafe extern "C" {
    /// external definitions for primitive types
    #[link_name = "sk_ASN1_VALUE_delete_if__extern"]
    pub fn sk_ASN1_VALUE_delete_if(
        sk: *mut stack_st_ASN1_VALUE,
        func: sk_ASN1_VALUE_delete_if_func,
        data: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    /// external definitions for primitive types
    #[link_name = "sk_ASN1_VALUE_find__extern"]
    pub fn sk_ASN1_VALUE_find(
        sk: *const stack_st_ASN1_VALUE,
        out_index: *mut usize,
        p: *const ASN1_VALUE,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// external definitions for primitive types
    #[link_name = "sk_ASN1_VALUE_shift__extern"]
    pub fn sk_ASN1_VALUE_shift(sk: *mut stack_st_ASN1_VALUE) -> *mut ASN1_VALUE;
}
unsafe extern "C" {
    /// external definitions for primitive types
    #[link_name = "sk_ASN1_VALUE_push__extern"]
    pub fn sk_ASN1_VALUE_push(sk: *mut stack_st_ASN1_VALUE, p: *mut ASN1_VALUE) -> usize;
}
unsafe extern "C" {
    /// external definitions for primitive types
    #[link_name = "sk_ASN1_VALUE_pop__extern"]
    pub fn sk_ASN1_VALUE_pop(sk: *mut stack_st_ASN1_VALUE) -> *mut ASN1_VALUE;
}
unsafe extern "C" {
    /// external definitions for primitive types
    #[link_name = "sk_ASN1_VALUE_dup__extern"]
    pub fn sk_ASN1_VALUE_dup(sk: *const stack_st_ASN1_VALUE) -> *mut stack_st_ASN1_VALUE;
}
unsafe extern "C" {
    /// external definitions for primitive types
    #[link_name = "sk_ASN1_VALUE_sort__extern"]
    pub fn sk_ASN1_VALUE_sort(sk: *mut stack_st_ASN1_VALUE);
}
unsafe extern "C" {
    /// external definitions for primitive types
    #[link_name = "sk_ASN1_VALUE_sort_and_dedup__extern"]
    pub fn sk_ASN1_VALUE_sort_and_dedup(
        sk: *mut stack_st_ASN1_VALUE,
        free_func: sk_ASN1_VALUE_free_func,
    );
}
unsafe extern "C" {
    /// external definitions for primitive types
    #[link_name = "sk_ASN1_VALUE_is_sorted__extern"]
    pub fn sk_ASN1_VALUE_is_sorted(sk: *const stack_st_ASN1_VALUE) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// external definitions for primitive types
    #[link_name = "sk_ASN1_VALUE_set_cmp_func__extern"]
    pub fn sk_ASN1_VALUE_set_cmp_func(
        sk: *mut stack_st_ASN1_VALUE,
        comp: sk_ASN1_VALUE_cmp_func,
    ) -> sk_ASN1_VALUE_cmp_func;
}
unsafe extern "C" {
    /// external definitions for primitive types
    #[link_name = "sk_ASN1_VALUE_deep_copy__extern"]
    pub fn sk_ASN1_VALUE_deep_copy(
        sk: *const stack_st_ASN1_VALUE,
        copy_func: sk_ASN1_VALUE_copy_func,
        free_func: sk_ASN1_VALUE_free_func,
    ) -> *mut stack_st_ASN1_VALUE;
}
unsafe extern "C" {
    /// EVP_EncodeBlock encodes `src_len` bytes from `src` and writes the
    /// result to `dst` with a trailing NUL. It returns the number of bytes
    /// written, not including this trailing NUL.
    pub fn EVP_EncodeBlock(dst: *mut u8, src: *const u8, src_len: usize) -> usize;
}
unsafe extern "C" {
    /// EVP_EncodedLength sets `*out_len` to the number of bytes that will be needed
    /// to call `EVP_EncodeBlock` on an input of length `len`. This includes the
    /// final NUL that `EVP_EncodeBlock` writes. It returns one on success or zero
    /// on error.
    pub fn EVP_EncodedLength(out_len: *mut usize, len: usize) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_DecodedLength sets `*out_len` to the maximum number of bytes that will
    /// be needed to call `EVP_DecodeBase64` on an input of length `len`. It returns
    /// one on success or zero if `len` is not a valid length for a base64-encoded
    /// string.
    pub fn EVP_DecodedLength(out_len: *mut usize, len: usize) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_DecodeBase64 decodes `in_len` bytes from base64 and writes
    /// `*out_len` bytes to `out`. `max_out` is the size of the output
    /// buffer. If it is not enough for the maximum output size, the
    /// operation fails. It returns one on success or zero on error.
    pub fn EVP_DecodeBase64(
        out: *mut u8,
        out_len: *mut usize,
        max_out: usize,
        in_: *const u8,
        in_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_ENCODE_CTX_new returns a newly-allocated `EVP_ENCODE_CTX` or NULL on
    /// error. The caller must release the result with `EVP_ENCODE_CTX_free`  when
    /// done.
    pub fn EVP_ENCODE_CTX_new() -> *mut EVP_ENCODE_CTX;
}
unsafe extern "C" {
    /// EVP_ENCODE_CTX_free releases memory associated with `ctx`.
    pub fn EVP_ENCODE_CTX_free(ctx: *mut EVP_ENCODE_CTX);
}
unsafe extern "C" {
    /// EVP_EncodeInit initialises `*ctx`, which is typically stack
    /// allocated, for an encoding operation.
    ///
    /// NOTE: The encoding operation breaks its output with newlines every
    /// 64 characters of output (48 characters of input). Use
    /// EVP_EncodeBlock to encode raw base64.
    pub fn EVP_EncodeInit(ctx: *mut EVP_ENCODE_CTX);
}
unsafe extern "C" {
    /// EVP_EncodeUpdate encodes `in_len` bytes from `in` and writes an encoded
    /// version of them to `out` and sets `*out_len` to the number of bytes written.
    /// Some state may be contained in `ctx` so `EVP_EncodeFinal` must be used to
    /// flush it before using the encoded data.
    pub fn EVP_EncodeUpdate(
        ctx: *mut EVP_ENCODE_CTX,
        out: *mut u8,
        out_len: *mut ::core::ffi::c_int,
        in_: *const u8,
        in_len: usize,
    );
}
unsafe extern "C" {
    /// EVP_EncodeFinal flushes any remaining output bytes from `ctx` to `out` and
    /// sets `*out_len` to the number of bytes written.
    pub fn EVP_EncodeFinal(
        ctx: *mut EVP_ENCODE_CTX,
        out: *mut u8,
        out_len: *mut ::core::ffi::c_int,
    );
}
unsafe extern "C" {
    /// EVP_DecodeInit initialises `*ctx`, which is typically stack allocated, for
    /// a decoding operation.
    ///
    /// TODO(davidben): This isn't a straight-up base64 decode either. Document
    /// and/or fix exactly what's going on here; maximum line length and such.
    pub fn EVP_DecodeInit(ctx: *mut EVP_ENCODE_CTX);
}
unsafe extern "C" {
    /// EVP_DecodeUpdate decodes `in_len` bytes from `in` and writes the decoded
    /// data to `out` and sets `*out_len` to the number of bytes written. Some state
    /// may be contained in `ctx` so `EVP_DecodeFinal` must be used to flush it
    /// before using the encoded data.
    ///
    /// It returns -1 on error, one if a full line of input was processed and zero
    /// if the line was short (i.e. it was the last line).
    pub fn EVP_DecodeUpdate(
        ctx: *mut EVP_ENCODE_CTX,
        out: *mut u8,
        out_len: *mut ::core::ffi::c_int,
        in_: *const u8,
        in_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_DecodeFinal flushes any remaining output bytes from `ctx` to `out` and
    /// sets `*out_len` to the number of bytes written. It returns one on success
    /// and minus one on error.
    pub fn EVP_DecodeFinal(
        ctx: *mut EVP_ENCODE_CTX,
        out: *mut u8,
        out_len: *mut ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_DecodeBlock encodes `src_len` bytes from `src` and writes the result to
    /// `dst`. It returns the number of bytes written or -1 on error.
    ///
    /// WARNING: EVP_DecodeBlock's return value does not take padding into
    /// account. It also strips leading whitespace and trailing
    /// whitespace and minuses.
    pub fn EVP_DecodeBlock(dst: *mut u8, src: *const u8, src_len: usize) -> ::core::ffi::c_int;
}
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct evp_encode_ctx_st {
    /// data_used indicates the number of bytes of `data` that are valid. When
    /// encoding, `data` will be filled and encoded as a lump. When decoding, only
    /// the first four bytes of `data` will be used.
    pub data_used: ::core::ffi::c_uint,
    pub data: [u8; 48usize],
    /// eof_seen indicates that the end of the base64 data has been seen when
    /// decoding. Only whitespace can follow.
    pub eof_seen: ::core::ffi::c_char,
    /// error_encountered indicates that invalid base64 data was found. This will
    /// cause all future calls to fail.
    pub error_encountered: ::core::ffi::c_char,
}
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct blake2b_state_st {
    pub h: [u64; 8usize],
    pub t_low: u64,
    pub t_high: u32,
    pub block_used: u32,
    pub block: [u8; 128usize],
}
unsafe extern "C" {
    /// BLAKE2B256_Init initialises `b2b` to perform a BLAKE2b-256 hash. There are no
    /// pointers inside `b2b` thus release of `b2b` is purely managed by the caller.
    pub fn BLAKE2B256_Init(b2b: *mut BLAKE2B_CTX);
}
unsafe extern "C" {
    /// BLAKE2B256_Update appends `len` bytes from `data` to the digest being
    /// calculated by `b2b`.
    pub fn BLAKE2B256_Update(b2b: *mut BLAKE2B_CTX, data: *const ::core::ffi::c_void, len: usize);
}
unsafe extern "C" {
    /// BLAKE2B256_Final completes the digest calculated by `b2b` and writes
    /// `BLAKE2B256_DIGEST_LENGTH` bytes to `out`.
    pub fn BLAKE2B256_Final(out: *mut u8, b2b: *mut BLAKE2B_CTX);
}
unsafe extern "C" {
    /// BLAKE2B256 writes the BLAKE2b-256 digset of `len` bytes from `data` to
    /// `out`.
    pub fn BLAKE2B256(data: *const u8, len: usize, out: *mut u8);
}
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct bf_key_st {
    pub P: [u32; 18usize],
    pub S: [u32; 1024usize],
}
pub type BF_KEY = bf_key_st;
unsafe extern "C" {
    pub fn BF_set_key(key: *mut BF_KEY, len: usize, data: *const u8);
}
unsafe extern "C" {
    pub fn BF_encrypt(data: *mut u32, key: *const BF_KEY);
}
unsafe extern "C" {
    pub fn BF_decrypt(data: *mut u32, key: *const BF_KEY);
}
unsafe extern "C" {
    pub fn BF_ecb_encrypt(
        in_: *const u8,
        out: *mut u8,
        key: *const BF_KEY,
        enc: ::core::ffi::c_int,
    );
}
unsafe extern "C" {
    pub fn BF_cbc_encrypt(
        in_: *const u8,
        out: *mut u8,
        length: usize,
        schedule: *const BF_KEY,
        ivec: *mut u8,
        enc: ::core::ffi::c_int,
    );
}
/// CRYPTO ByteString
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct cbs_st {
    pub data: *const u8,
    pub len: usize,
}
unsafe extern "C" {
    /// CBS_init sets `cbs` to point to `data`. It does not take ownership of
    /// `data`.
    #[link_name = "CBS_init__extern"]
    pub fn CBS_init(cbs: *mut CBS, data: *const u8, len: usize);
}
unsafe extern "C" {
    /// CBS_skip advances `cbs` by `len` bytes. It returns one on success and zero
    /// otherwise.
    pub fn CBS_skip(cbs: *mut CBS, len: usize) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBS_data returns a pointer to the contents of `cbs`.
    #[link_name = "CBS_data__extern"]
    pub fn CBS_data(cbs: *const CBS) -> *const u8;
}
unsafe extern "C" {
    /// CBS_len returns the number of bytes remaining in `cbs`.
    #[link_name = "CBS_len__extern"]
    pub fn CBS_len(cbs: *const CBS) -> usize;
}
unsafe extern "C" {
    /// CBS_stow copies the current contents of `cbs` into `*out_ptr` and
    /// `*out_len`. If `*out_ptr` is not NULL, the contents are freed with
    /// OPENSSL_free. It returns one on success and zero on allocation failure. On
    /// success, `*out_ptr` should be freed with OPENSSL_free. If `cbs` is empty,
    /// `*out_ptr` will be NULL.
    pub fn CBS_stow(
        cbs: *const CBS,
        out_ptr: *mut *mut u8,
        out_len: *mut usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBS_strdup copies the current contents of `cbs` into `*out_ptr` as a
    /// NUL-terminated C string. If `*out_ptr` is not NULL, the contents are freed
    /// with OPENSSL_free. It returns one on success and zero on allocation
    /// failure. On success, `*out_ptr` should be freed with OPENSSL_free.
    ///
    /// NOTE: If `cbs` contains NUL bytes, the string will be truncated. Call
    /// `CBS_contains_zero_byte(cbs)` to check for NUL bytes.
    pub fn CBS_strdup(
        cbs: *const CBS,
        out_ptr: *mut *mut ::core::ffi::c_char,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBS_contains_zero_byte returns one if the current contents of `cbs` contains
    /// a NUL byte and zero otherwise.
    pub fn CBS_contains_zero_byte(cbs: *const CBS) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBS_mem_equal compares the current contents of `cbs` with the `len` bytes
    /// starting at `data`. If they're equal, it returns one, otherwise zero. If the
    /// lengths match, it uses a constant-time comparison.
    pub fn CBS_mem_equal(cbs: *const CBS, data: *const u8, len: usize) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBS_get_u8 sets `*out` to the next uint8_t from `cbs` and advances `cbs`. It
    /// returns one on success and zero on error.
    pub fn CBS_get_u8(cbs: *mut CBS, out: *mut u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBS_get_u16 sets `*out` to the next, big-endian uint16_t from `cbs` and
    /// advances `cbs`. It returns one on success and zero on error.
    pub fn CBS_get_u16(cbs: *mut CBS, out: *mut u16) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBS_get_u16le sets `*out` to the next, little-endian uint16_t from `cbs` and
    /// advances `cbs`. It returns one on success and zero on error.
    pub fn CBS_get_u16le(cbs: *mut CBS, out: *mut u16) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBS_get_u24 sets `*out` to the next, big-endian 24-bit value from `cbs` and
    /// advances `cbs`. It returns one on success and zero on error.
    pub fn CBS_get_u24(cbs: *mut CBS, out: *mut u32) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBS_get_u32 sets `*out` to the next, big-endian uint32_t value from `cbs`
    /// and advances `cbs`. It returns one on success and zero on error.
    pub fn CBS_get_u32(cbs: *mut CBS, out: *mut u32) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBS_get_u32le sets `*out` to the next, little-endian uint32_t value from
    /// `cbs` and advances `cbs`. It returns one on success and zero on error.
    pub fn CBS_get_u32le(cbs: *mut CBS, out: *mut u32) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBS_get_u48 sets `*out` to the next, big-endian 48-bit value from `cbs` and
    /// advances `cbs`. It returns one on success and zero on error.
    pub fn CBS_get_u48(cbs: *mut CBS, out: *mut u64) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBS_get_u64 sets `*out` to the next, big-endian uint64_t value from `cbs`
    /// and advances `cbs`. It returns one on success and zero on error.
    pub fn CBS_get_u64(cbs: *mut CBS, out: *mut u64) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBS_get_u64le sets `*out` to the next, little-endian uint64_t value from
    /// `cbs` and advances `cbs`. It returns one on success and zero on error.
    pub fn CBS_get_u64le(cbs: *mut CBS, out: *mut u64) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBS_get_last_u8 sets `*out` to the last uint8_t from `cbs` and shortens
    /// `cbs`. It returns one on success and zero on error.
    pub fn CBS_get_last_u8(cbs: *mut CBS, out: *mut u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBS_get_bytes sets `*out` to the next `len` bytes from `cbs` and advances
    /// `cbs`. It returns one on success and zero on error.
    pub fn CBS_get_bytes(cbs: *mut CBS, out: *mut CBS, len: usize) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBS_copy_bytes copies the next `len` bytes from `cbs` to `out` and advances
    /// `cbs`. It returns one on success and zero on error.
    pub fn CBS_copy_bytes(cbs: *mut CBS, out: *mut u8, len: usize) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBS_get_u8_length_prefixed sets `*out` to the contents of an 8-bit,
    /// length-prefixed value from `cbs` and advances `cbs` over it. It returns one
    /// on success and zero on error.
    pub fn CBS_get_u8_length_prefixed(cbs: *mut CBS, out: *mut CBS) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBS_get_u16_length_prefixed sets `*out` to the contents of a 16-bit,
    /// big-endian, length-prefixed value from `cbs` and advances `cbs` over it. It
    /// returns one on success and zero on error.
    pub fn CBS_get_u16_length_prefixed(cbs: *mut CBS, out: *mut CBS) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBS_get_u24_length_prefixed sets `*out` to the contents of a 24-bit,
    /// big-endian, length-prefixed value from `cbs` and advances `cbs` over it. It
    /// returns one on success and zero on error.
    pub fn CBS_get_u24_length_prefixed(cbs: *mut CBS, out: *mut CBS) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBS_get_until_first finds the first instance of `c` in `cbs`. If found, it
    /// sets `*out` to the text before the match, advances `cbs` over it, and returns
    /// one. Otherwise, it returns zero and leaves `cbs` unmodified.
    pub fn CBS_get_until_first(cbs: *mut CBS, out: *mut CBS, c: u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBS_get_until_first_of finds the first byte in `cbs` matching one of the
    /// characters in `chars`, which is a NUL-terminated C string. If found, it sets
    /// `*out` to the text before the match, advances `cbs` over it, and returns one.
    /// Otherwise, it returns zero and leaves `cbs` unmodified.
    pub fn CBS_get_until_first_of(
        cbs: *mut CBS,
        out: *mut CBS,
        chars: *const ::core::ffi::c_char,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBS_get_until_first_not_of finds the first byte in `cbs` that does not match
    /// any of the characters in `chars`, which is a NUL-terminated C string. If
    /// found, it sets `*out` to the text before the match, advances `cbs` over it,
    /// and returns one. Otherwise, it returns zero and leaves `cbs` unmodified.
    pub fn CBS_get_until_first_not_of(
        cbs: *mut CBS,
        out: *mut CBS,
        chars: *const ::core::ffi::c_char,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBS_get_u64_decimal reads a decimal integer from `cbs` and writes it to
    /// `*out`. It stops reading at the end of the string, or the first non-digit
    /// character. It returns one on success and zero on error. This function behaves
    /// analogously to `strtoul` except it does not accept empty inputs, leading
    /// zeros, or negative values.
    pub fn CBS_get_u64_decimal(cbs: *mut CBS, out: *mut u64) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBS_get_asn1 sets `*out` to the contents of DER-encoded, ASN.1 element (not
    /// including tag and length bytes) and advances `cbs` over it. The ASN.1
    /// element must match `tag_value`. It returns one on success and zero
    /// on error.
    pub fn CBS_get_asn1(
        cbs: *mut CBS,
        out: *mut CBS,
        tag_value: CBS_ASN1_TAG,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBS_get_asn1_element acts like `CBS_get_asn1` but `out` will include the
    /// ASN.1 header bytes too.
    pub fn CBS_get_asn1_element(
        cbs: *mut CBS,
        out: *mut CBS,
        tag_value: CBS_ASN1_TAG,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBS_peek_any_asn1_tag looks ahead at the next ASN.1 tag and returns it. If a
    /// tag could not be parsed, it returns zero, which is never a valid tag. Note:
    /// if it returns non-zero, `CBS_get_asn1` may still fail if the rest of the
    /// element is malformed.
    pub fn CBS_peek_any_asn1_tag(cbs: *const CBS) -> CBS_ASN1_TAG;
}
unsafe extern "C" {
    /// CBS_peek_asn1_tag looks ahead at the next ASN.1 tag and returns one if the
    /// next ASN.1 element on `cbs` would have tag `tag_value`. If `cbs` is empty or
    /// the tag does not match, it returns zero. Note: if it returns one,
    /// `CBS_get_asn1` may still fail if the rest of the element is malformed.
    pub fn CBS_peek_asn1_tag(cbs: *const CBS, tag_value: CBS_ASN1_TAG) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBS_get_any_asn1 sets `*out` to contain the next ASN.1 element from `*cbs`
    /// (not including tag and length bytes), sets `*out_tag` to the tag number, and
    /// advances `*cbs`. It returns one on success and zero on error. Either of `out`
    /// and `out_tag` may be NULL to ignore the value.
    pub fn CBS_get_any_asn1(
        cbs: *mut CBS,
        out: *mut CBS,
        out_tag: *mut CBS_ASN1_TAG,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBS_get_any_asn1_element sets `*out` to contain the next ASN.1 element from
    /// `*cbs` (including header bytes) and advances `*cbs`. It sets `*out_tag` to
    /// the tag number and `*out_header_len` to the length of the ASN.1 header. Each
    /// of `out`, `out_tag`, and `out_header_len` may be NULL to ignore the value.
    pub fn CBS_get_any_asn1_element(
        cbs: *mut CBS,
        out: *mut CBS,
        out_tag: *mut CBS_ASN1_TAG,
        out_header_len: *mut usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBS_get_any_ber_asn1_element acts the same as `CBS_get_any_asn1_element` but
    /// also allows indefinite-length elements to be returned and does not enforce
    /// that lengths are minimal. It sets `*out_indefinite` to one if the length was
    /// indefinite and zero otherwise. If indefinite, `*out_header_len` and
    /// `CBS_len(out)` will be equal as only the header is returned (although this is
    /// also true for empty elements so `*out_indefinite` should be checked). If
    /// `out_ber_found` is not NULL then it is set to one if any case of invalid DER
    /// but valid BER is found, and to zero otherwise.
    ///
    /// This function will not successfully parse an end-of-contents (EOC) as an
    /// element. Callers parsing indefinite-length encoding must check for EOC
    /// separately.
    pub fn CBS_get_any_ber_asn1_element(
        cbs: *mut CBS,
        out: *mut CBS,
        out_tag: *mut CBS_ASN1_TAG,
        out_header_len: *mut usize,
        out_ber_found: *mut ::core::ffi::c_int,
        out_indefinite: *mut ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBS_get_asn1_uint64 gets an ASN.1 INTEGER from `cbs` using `CBS_get_asn1`
    /// and sets `*out` to its value. It returns one on success and zero on error,
    /// where error includes the integer being negative, or too large to represent
    /// in 64 bits.
    pub fn CBS_get_asn1_uint64(cbs: *mut CBS, out: *mut u64) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBS_get_asn1_uint64_with_tag gets an ASN.1 INTEGER from `cbs` using
    /// `CBS_get_asn1` and sets `*out` to its value. `tag` is used to handle to
    /// handle implicitly tagged INTEGER fields. It returns one on success and zero
    /// on error, where error includes the integer being negative, or too large to
    /// represent in 64 bits.
    pub fn CBS_get_asn1_uint64_with_tag(
        cbs: *mut CBS,
        out: *mut u64,
        tag: CBS_ASN1_TAG,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBS_get_asn1_int64 gets an ASN.1 INTEGER from `cbs` using `CBS_get_asn1`
    /// and sets `*out` to its value. It returns one on success and zero on error,
    /// where error includes the integer being too large to represent in 64 bits.
    pub fn CBS_get_asn1_int64(cbs: *mut CBS, out: *mut i64) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBS_get_asn1_int64_with_tag gets an ASN.1 INTEGER from `cbs` using
    /// `CBS_get_asn1` and sets `*out` to its value. `tag` is used to handle to
    /// handle implicitly tagged INTEGER fields. It returns one on success and zero
    /// on error, where error includes the integer being too large to represent in 64
    /// bits.
    pub fn CBS_get_asn1_int64_with_tag(
        cbs: *mut CBS,
        out: *mut i64,
        tag: CBS_ASN1_TAG,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBS_get_asn1_bool gets an ASN.1 BOOLEAN from `cbs` and sets `*out` to zero
    /// or one based on its value. It returns one on success or zero on error.
    pub fn CBS_get_asn1_bool(cbs: *mut CBS, out: *mut ::core::ffi::c_int) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBS_get_optional_asn1 gets an optional explicitly-tagged element from `cbs`
    /// tagged with `tag` and sets `*out` to its contents, or ignores it if `out` is
    /// NULL. If present and if `out_present` is not NULL, it sets `*out_present` to
    /// one, otherwise zero. It returns one on success, whether or not the element
    /// was present, and zero on decode failure.
    pub fn CBS_get_optional_asn1(
        cbs: *mut CBS,
        out: *mut CBS,
        out_present: *mut ::core::ffi::c_int,
        tag: CBS_ASN1_TAG,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBS_get_optional_asn1_octet_string gets an optional
    /// explicitly-tagged OCTET STRING from `cbs`. If present, it sets
    /// `*out` to the string and `*out_present` to one. Otherwise, it sets
    /// `*out` to empty and `*out_present` to zero. `out_present` may be
    /// NULL. It returns one on success, whether or not the element was
    /// present, and zero on decode failure.
    pub fn CBS_get_optional_asn1_octet_string(
        cbs: *mut CBS,
        out: *mut CBS,
        out_present: *mut ::core::ffi::c_int,
        tag: CBS_ASN1_TAG,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBS_get_optional_asn1_uint64 gets an optional explicitly-tagged
    /// INTEGER from `cbs`. If present, it sets `*out` to the
    /// value. Otherwise, it sets `*out` to `default_value`. It returns one
    /// on success, whether or not the element was present, and zero on
    /// decode failure.
    pub fn CBS_get_optional_asn1_uint64(
        cbs: *mut CBS,
        out: *mut u64,
        tag: CBS_ASN1_TAG,
        default_value: u64,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBS_get_optional_asn1_bool gets an optional, explicitly-tagged BOOLEAN from
    /// `cbs`. If present, it sets `*out` to either zero or one, based on the
    /// boolean. Otherwise, it sets `*out` to `default_value`. It returns one on
    /// success, whether or not the element was present, and zero on decode
    /// failure.
    pub fn CBS_get_optional_asn1_bool(
        cbs: *mut CBS,
        out: *mut ::core::ffi::c_int,
        tag: CBS_ASN1_TAG,
        default_value: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBS_is_valid_asn1_bitstring returns one if `cbs` is a valid ASN.1 BIT STRING
    /// body and zero otherwise.
    pub fn CBS_is_valid_asn1_bitstring(cbs: *const CBS) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBS_asn1_bitstring_has_bit returns one if `cbs` is a valid ASN.1 BIT STRING
    /// body and the specified bit is present and set. Otherwise, it returns zero.
    /// `bit` is indexed starting from zero.
    pub fn CBS_asn1_bitstring_has_bit(
        cbs: *const CBS,
        bit: ::core::ffi::c_uint,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBS_is_valid_asn1_integer returns one if `cbs` is a valid ASN.1 INTEGER,
    /// body and zero otherwise. On success, if `out_is_negative` is non-NULL,
    /// `*out_is_negative` will be set to one if `cbs` is negative and zero
    /// otherwise.
    pub fn CBS_is_valid_asn1_integer(
        cbs: *const CBS,
        out_is_negative: *mut ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBS_is_unsigned_asn1_integer returns one if `cbs` is a valid non-negative
    /// ASN.1 INTEGER body and zero otherwise.
    pub fn CBS_is_unsigned_asn1_integer(cbs: *const CBS) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBS_is_valid_asn1_oid returns one if `cbs` is a valid DER-encoded ASN.1
    /// OBJECT IDENTIFIER contents (not including the element framing) and zero
    /// otherwise. This function tolerates arbitrarily large OID components.
    pub fn CBS_is_valid_asn1_oid(cbs: *const CBS) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBS_asn1_oid_to_text interprets `cbs` as DER-encoded ASN.1 OBJECT IDENTIFIER
    /// contents (not including the element framing) and returns the ASCII
    /// representation (e.g., "1.2.840.113554.4.1.72585") in a newly-allocated
    /// string, or NULL on failure. The caller must release the result with
    /// `OPENSSL_free`.
    ///
    /// This function may fail if `cbs` is an invalid OBJECT IDENTIFIER, or if any
    /// OID components are too large.
    pub fn CBS_asn1_oid_to_text(cbs: *const CBS) -> *mut ::core::ffi::c_char;
}
unsafe extern "C" {
    /// CBS_is_valid_asn1_relative_oid returns one if `cbs` is a valid DER-encoded
    /// ASN.1 RELATIVE-OID contents (not including the element framing) and zero
    /// otherwise. This function tolerates arbitrarily large OID components.
    ///
    /// (This is actually the same as `CBS_is_valid_asn1_oid`, but is also exposed
    /// under the relative_oid name for API symmetry.)
    pub fn CBS_is_valid_asn1_relative_oid(cbs: *const CBS) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBS_asn1_relative_oid_to_text interprets `cbs` as DER-encoded ASN.1
    /// RELATIVE-OID contents (not including the element framing) and returns the
    /// ASCII representation (e.g., "32473.1") in a newly-allocated string, or NULL
    /// on failure. The caller must release the result with `OPENSSL_free`.
    ///
    /// This function may fail if `cbs` is an invalid RELATIVE-OID, or if any
    /// OID components are too large.
    pub fn CBS_asn1_relative_oid_to_text(cbs: *const CBS) -> *mut ::core::ffi::c_char;
}
unsafe extern "C" {
    /// CBS_parse_generalized_time returns one if `cbs` is a valid DER-encoded, ASN.1
    /// GeneralizedTime body within the limitations imposed by RFC 5280, or zero
    /// otherwise. If `allow_timezone_offset` is non-zero, four-digit timezone
    /// offsets, which would not be allowed by DER, are permitted. On success, if
    /// `out_tm` is non-NULL, `*out_tm` will be zeroed, and then set to the
    /// corresponding time in UTC. This function does not compute `out_tm->tm_wday`
    /// or `out_tm->tm_yday`.
    pub fn CBS_parse_generalized_time(
        cbs: *const CBS,
        out_tm: *mut tm,
        allow_timezone_offset: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBS_parse_utc_time returns one if `cbs` is a valid DER-encoded, ASN.1
    /// UTCTime body within the limitations imposed by RFC 5280, or zero otherwise.
    /// If `allow_timezone_offset` is non-zero, four-digit timezone offsets, which
    /// would not be allowed by DER, are permitted. On success, if `out_tm` is
    /// non-NULL, `*out_tm` will be zeroed, and then set to the corresponding time
    /// in UTC. This function does not compute `out_tm->tm_wday` or
    /// `out_tm->tm_yday`.
    pub fn CBS_parse_utc_time(
        cbs: *const CBS,
        out_tm: *mut tm,
        allow_timezone_offset: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
/// CRYPTO ByteBuilder.
///
/// `CBB` objects allow one to build length-prefixed serialisations. A `CBB`
/// object is associated with a buffer and new buffers are created with
/// `CBB_init`. Several `CBB` objects can point at the same buffer when a
/// length-prefix is pending, however only a single `CBB` can be 'current' at
/// any one time. For example, if one calls `CBB_add_u8_length_prefixed` then
/// the new `CBB` points at the same buffer as the original. But if the original
/// `CBB` is used then the length prefix is written out and the new `CBB` must
/// not be used again.
///
/// If one needs to force a length prefix to be written out because a `CBB` is
/// going out of scope, use `CBB_flush`. If an operation on a `CBB` fails, it is
/// in an undefined state and must not be used except to call `CBB_cleanup`.
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct cbb_buffer_st {
    pub buf: *mut u8,
    /// len is the number of valid bytes in `buf`.
    pub len: usize,
    /// cap is the size of `buf`.
    pub cap: usize,
    pub _bitfield_align_1: [u8; 0],
    pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>,
    pub __bindgen_padding_0: [u8; 7usize],
}
impl cbb_buffer_st {
    #[inline]
    pub fn can_resize(&self) -> ::core::ffi::c_uint {
        unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) }
    }
    #[inline]
    pub fn set_can_resize(&mut self, val: ::core::ffi::c_uint) {
        unsafe {
            let val: u32 = ::core::mem::transmute(val);
            self._bitfield_1.set(0usize, 1u8, val as u64)
        }
    }
    #[inline]
    pub unsafe fn can_resize_raw(this: *const Self) -> ::core::ffi::c_uint {
        unsafe {
            ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get(
                ::core::ptr::addr_of!((*this)._bitfield_1),
                0usize,
                1u8,
            ) as u32)
        }
    }
    #[inline]
    pub unsafe fn set_can_resize_raw(this: *mut Self, val: ::core::ffi::c_uint) {
        unsafe {
            let val: u32 = ::core::mem::transmute(val);
            <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set(
                ::core::ptr::addr_of_mut!((*this)._bitfield_1),
                0usize,
                1u8,
                val as u64,
            )
        }
    }
    #[inline]
    pub fn error(&self) -> ::core::ffi::c_uint {
        unsafe { ::core::mem::transmute(self._bitfield_1.get(1usize, 1u8) as u32) }
    }
    #[inline]
    pub fn set_error(&mut self, val: ::core::ffi::c_uint) {
        unsafe {
            let val: u32 = ::core::mem::transmute(val);
            self._bitfield_1.set(1usize, 1u8, val as u64)
        }
    }
    #[inline]
    pub unsafe fn error_raw(this: *const Self) -> ::core::ffi::c_uint {
        unsafe {
            ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get(
                ::core::ptr::addr_of!((*this)._bitfield_1),
                1usize,
                1u8,
            ) as u32)
        }
    }
    #[inline]
    pub unsafe fn set_error_raw(this: *mut Self, val: ::core::ffi::c_uint) {
        unsafe {
            let val: u32 = ::core::mem::transmute(val);
            <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set(
                ::core::ptr::addr_of_mut!((*this)._bitfield_1),
                1usize,
                1u8,
                val as u64,
            )
        }
    }
    #[inline]
    pub fn new_bitfield_1(
        can_resize: ::core::ffi::c_uint,
        error: ::core::ffi::c_uint,
    ) -> __BindgenBitfieldUnit<[u8; 1usize]> {
        let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default();
        __bindgen_bitfield_unit.set(0usize, 1u8, {
            let can_resize: u32 = unsafe { ::core::mem::transmute(can_resize) };
            can_resize as u64
        });
        __bindgen_bitfield_unit.set(1usize, 1u8, {
            let error: u32 = unsafe { ::core::mem::transmute(error) };
            error as u64
        });
        __bindgen_bitfield_unit
    }
}
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct cbb_child_st {
    /// base is a pointer to the buffer this `CBB` writes to.
    pub base: *mut cbb_buffer_st,
    /// offset is the number of bytes from the start of `base->buf` to this `CBB`'s
    /// pending length prefix.
    pub offset: usize,
    /// pending_len_len contains the number of bytes in this `CBB`'s pending
    /// length-prefix, or zero if no length-prefix is pending.
    pub pending_len_len: u8,
    pub _bitfield_align_1: [u8; 0],
    pub _bitfield_1: __BindgenBitfieldUnit<[u8; 1usize]>,
    pub __bindgen_padding_0: [u16; 3usize],
}
impl cbb_child_st {
    #[inline]
    pub fn pending_is_asn1(&self) -> ::core::ffi::c_uint {
        unsafe { ::core::mem::transmute(self._bitfield_1.get(0usize, 1u8) as u32) }
    }
    #[inline]
    pub fn set_pending_is_asn1(&mut self, val: ::core::ffi::c_uint) {
        unsafe {
            let val: u32 = ::core::mem::transmute(val);
            self._bitfield_1.set(0usize, 1u8, val as u64)
        }
    }
    #[inline]
    pub unsafe fn pending_is_asn1_raw(this: *const Self) -> ::core::ffi::c_uint {
        unsafe {
            ::core::mem::transmute(<__BindgenBitfieldUnit<[u8; 1usize]>>::raw_get(
                ::core::ptr::addr_of!((*this)._bitfield_1),
                0usize,
                1u8,
            ) as u32)
        }
    }
    #[inline]
    pub unsafe fn set_pending_is_asn1_raw(this: *mut Self, val: ::core::ffi::c_uint) {
        unsafe {
            let val: u32 = ::core::mem::transmute(val);
            <__BindgenBitfieldUnit<[u8; 1usize]>>::raw_set(
                ::core::ptr::addr_of_mut!((*this)._bitfield_1),
                0usize,
                1u8,
                val as u64,
            )
        }
    }
    #[inline]
    pub fn new_bitfield_1(
        pending_is_asn1: ::core::ffi::c_uint,
    ) -> __BindgenBitfieldUnit<[u8; 1usize]> {
        let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 1usize]> = Default::default();
        __bindgen_bitfield_unit.set(0usize, 1u8, {
            let pending_is_asn1: u32 = unsafe { ::core::mem::transmute(pending_is_asn1) };
            pending_is_asn1 as u64
        });
        __bindgen_bitfield_unit
    }
}
#[repr(C)]
#[derive(Copy, Clone)]
pub struct cbb_st {
    /// child points to a child CBB if a length-prefix is pending.
    pub child: *mut CBB,
    /// is_child is one if this is a child `CBB` and zero if it is a top-level
    /// `CBB`. This determines which arm of the union is valid.
    pub is_child: ::core::ffi::c_char,
    pub u: cbb_st__bindgen_ty_1,
}
#[repr(C)]
#[derive(Copy, Clone)]
pub union cbb_st__bindgen_ty_1 {
    pub base: cbb_buffer_st,
    pub child: cbb_child_st,
}
unsafe extern "C" {
    /// CBB_zero sets an uninitialised `cbb` to the zero state. It must be
    /// initialised with `CBB_init` or `CBB_init_fixed` before use, but it is safe to
    /// call `CBB_cleanup` without a successful `CBB_init`. This may be used for more
    /// uniform cleanup of a `CBB`.
    pub fn CBB_zero(cbb: *mut CBB);
}
unsafe extern "C" {
    /// CBB_init initialises `cbb` with `initial_capacity`. Since a `CBB` grows as
    /// needed, the `initial_capacity` is just a hint. It returns one on success or
    /// zero on allocation failure.
    pub fn CBB_init(cbb: *mut CBB, initial_capacity: usize) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBB_init_fixed initialises `cbb` to write to `len` bytes at `buf`. Since
    /// `buf` cannot grow, trying to write more than `len` bytes will cause CBB
    /// functions to fail. This function is infallible and always returns one. It is
    /// safe, but not necessary, to call `CBB_cleanup` on `cbb`.
    pub fn CBB_init_fixed(cbb: *mut CBB, buf: *mut u8, len: usize) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBB_cleanup frees all resources owned by `cbb` and other `CBB` objects
    /// writing to the same buffer. This should be used in an error case where a
    /// serialisation is abandoned.
    ///
    /// This function can only be called on a "top level" `CBB`, i.e. one initialised
    /// with `CBB_init` or `CBB_init_fixed`, or a `CBB` set to the zero state with
    /// `CBB_zero`.
    pub fn CBB_cleanup(cbb: *mut CBB);
}
unsafe extern "C" {
    /// CBB_finish completes any pending length prefix and sets `*out_data` to a
    /// malloced buffer and `*out_len` to the length of that buffer. The caller
    /// takes ownership of the buffer and, unless the buffer was fixed with
    /// `CBB_init_fixed`, must call `OPENSSL_free` when done.
    ///
    /// It can only be called on a "top level" `CBB`, i.e. one initialised with
    /// `CBB_init` or `CBB_init_fixed`. It returns one on success and zero on
    /// error.
    pub fn CBB_finish(
        cbb: *mut CBB,
        out_data: *mut *mut u8,
        out_len: *mut usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBB_flush causes any pending length prefixes to be written out and any child
    /// `CBB` objects of `cbb` to be invalidated. This allows `cbb` to continue to be
    /// used after the children go out of scope, e.g. when local `CBB` objects are
    /// added as children to a `CBB` that persists after a function returns. This
    /// function returns one on success or zero on error.
    pub fn CBB_flush(cbb: *mut CBB) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBB_data returns a pointer to the bytes written to `cbb`. It does not flush
    /// `cbb`. The pointer is valid until the next operation to `cbb`.
    ///
    /// To avoid unfinalized length prefixes, it is a fatal error to call this on a
    /// CBB with any active children.
    pub fn CBB_data(cbb: *const CBB) -> *mut u8;
}
unsafe extern "C" {
    /// CBB_len returns the number of bytes written to `cbb`. It does not flush
    /// `cbb`.
    ///
    /// To avoid unfinalized length prefixes, it is a fatal error to call this on a
    /// CBB with any active children.
    pub fn CBB_len(cbb: *const CBB) -> usize;
}
unsafe extern "C" {
    /// CBB_add_u8_length_prefixed sets `*out_contents` to a new child of `cbb`. The
    /// data written to `*out_contents` will be prefixed in `cbb` with an 8-bit
    /// length. It returns one on success or zero on error.
    pub fn CBB_add_u8_length_prefixed(cbb: *mut CBB, out_contents: *mut CBB) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBB_add_u16_length_prefixed sets `*out_contents` to a new child of `cbb`.
    /// The data written to `*out_contents` will be prefixed in `cbb` with a 16-bit,
    /// big-endian length. It returns one on success or zero on error.
    pub fn CBB_add_u16_length_prefixed(cbb: *mut CBB, out_contents: *mut CBB)
        -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBB_add_u24_length_prefixed sets `*out_contents` to a new child of `cbb`.
    /// The data written to `*out_contents` will be prefixed in `cbb` with a 24-bit,
    /// big-endian length. It returns one on success or zero on error.
    pub fn CBB_add_u24_length_prefixed(cbb: *mut CBB, out_contents: *mut CBB)
        -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBB_add_asn1 sets `*out_contents` to a `CBB` into which the contents of an
    /// ASN.1 object can be written. The `tag` argument will be used as the tag for
    /// the object. It returns one on success or zero on error.
    pub fn CBB_add_asn1(
        cbb: *mut CBB,
        out_contents: *mut CBB,
        tag: CBS_ASN1_TAG,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBB_add_bytes appends `len` bytes from `data` to `cbb`. It returns one on
    /// success and zero otherwise.
    pub fn CBB_add_bytes(cbb: *mut CBB, data: *const u8, len: usize) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBB_add_zeros append `len` bytes with value zero to `cbb`. It returns one on
    /// success and zero otherwise.
    pub fn CBB_add_zeros(cbb: *mut CBB, len: usize) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBB_add_space appends `len` bytes to `cbb` and sets `*out_data` to point to
    /// the beginning of that space. The caller must then write `len` bytes of
    /// actual contents to `*out_data`. It returns one on success and zero
    /// otherwise.
    pub fn CBB_add_space(cbb: *mut CBB, out_data: *mut *mut u8, len: usize) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBB_reserve ensures `cbb` has room for `len` additional bytes and sets
    /// `*out_data` to point to the beginning of that space. It returns one on
    /// success and zero otherwise. The caller may write up to `len` bytes to
    /// `*out_data` and call `CBB_did_write` to complete the write. `*out_data` is
    /// valid until the next operation on `cbb` or an ancestor `CBB`.
    pub fn CBB_reserve(cbb: *mut CBB, out_data: *mut *mut u8, len: usize) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBB_did_write advances `cbb` by `len` bytes, assuming the space has been
    /// written to by the caller. It returns one on success and zero on error.
    pub fn CBB_did_write(cbb: *mut CBB, len: usize) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBB_add_u8 appends an 8-bit number from `value` to `cbb`. It returns one on
    /// success and zero otherwise.
    pub fn CBB_add_u8(cbb: *mut CBB, value: u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBB_add_u16 appends a 16-bit, big-endian number from `value` to `cbb`. It
    /// returns one on success and zero otherwise.
    pub fn CBB_add_u16(cbb: *mut CBB, value: u16) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBB_add_u16le appends a 16-bit, little-endian number from `value` to `cbb`.
    /// It returns one on success and zero otherwise.
    pub fn CBB_add_u16le(cbb: *mut CBB, value: u16) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBB_add_u24 appends a 24-bit, big-endian number from `value` to `cbb`. It
    /// returns one on success and zero otherwise.
    pub fn CBB_add_u24(cbb: *mut CBB, value: u32) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBB_add_u32 appends a 32-bit, big-endian number from `value` to `cbb`. It
    /// returns one on success and zero otherwise.
    pub fn CBB_add_u32(cbb: *mut CBB, value: u32) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBB_add_u32le appends a 32-bit, little-endian number from `value` to `cbb`.
    /// It returns one on success and zero otherwise.
    pub fn CBB_add_u32le(cbb: *mut CBB, value: u32) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBB_add_u64 appends a 64-bit, big-endian number from `value` to `cbb`. It
    /// returns one on success and zero otherwise.
    pub fn CBB_add_u64(cbb: *mut CBB, value: u64) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBB_add_u64le appends a 64-bit, little-endian number from `value` to `cbb`.
    /// It returns one on success and zero otherwise.
    pub fn CBB_add_u64le(cbb: *mut CBB, value: u64) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBB_discard discards the last `len` bytes written to `cbb`. The process will
    /// abort if `cbb` has an unflushed child, or its length is smaller than `len`.
    pub fn CBB_discard(cbb: *mut CBB, len: usize);
}
unsafe extern "C" {
    /// CBB_discard_child discards the current unflushed child of `cbb`. Neither the
    /// child's contents nor the length prefix will be included in the output.
    pub fn CBB_discard_child(cbb: *mut CBB);
}
unsafe extern "C" {
    /// CBB_add_asn1_element adds an ASN.1 element with the specified tag and
    /// contents. It returns one on success and zero on error. This is a convenience
    /// function over `CBB_add_asn1` when the data is already available.
    pub fn CBB_add_asn1_element(
        cbb: *mut CBB,
        tag: CBS_ASN1_TAG,
        data: *const u8,
        data_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBB_add_asn1_uint64 writes an ASN.1 INTEGER into `cbb` using `CBB_add_asn1`
    /// and writes `value` in its contents. It returns one on success and zero on
    /// error.
    pub fn CBB_add_asn1_uint64(cbb: *mut CBB, value: u64) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBB_add_asn1_uint64_with_tag behaves like `CBB_add_asn1_uint64` but uses
    /// `tag` as the tag instead of INTEGER. This is useful if the INTEGER type uses
    /// implicit tagging.
    pub fn CBB_add_asn1_uint64_with_tag(
        cbb: *mut CBB,
        value: u64,
        tag: CBS_ASN1_TAG,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBB_add_asn1_int64 writes an ASN.1 INTEGER into `cbb` using `CBB_add_asn1`
    /// and writes `value` in its contents. It returns one on success and zero on
    /// error.
    pub fn CBB_add_asn1_int64(cbb: *mut CBB, value: i64) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBB_add_asn1_int64_with_tag behaves like `CBB_add_asn1_int64` but uses `tag`
    /// as the tag instead of INTEGER. This is useful if the INTEGER type uses
    /// implicit tagging.
    pub fn CBB_add_asn1_int64_with_tag(
        cbb: *mut CBB,
        value: i64,
        tag: CBS_ASN1_TAG,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBB_add_asn1_octet_string writes an ASN.1 OCTET STRING into `cbb` with the
    /// given contents. It returns one on success and zero on error.
    pub fn CBB_add_asn1_octet_string(
        cbb: *mut CBB,
        data: *const u8,
        data_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBB_add_asn1_bool writes an ASN.1 BOOLEAN into `cbb` which is true iff
    /// `value` is non-zero.  It returns one on success and zero on error.
    pub fn CBB_add_asn1_bool(cbb: *mut CBB, value: ::core::ffi::c_int) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBB_add_asn1_oid_from_text decodes `len` bytes from `text` as an ASCII OID
    /// representation, e.g. "1.2.840.113554.4.1.72585", and writes the DER-encoded
    /// contents to `cbb`. It returns one on success and zero on malloc failure or if
    /// `text` was invalid. It does not include the OBJECT IDENTIFIER framing, only
    /// the element's contents.
    ///
    /// This function considers OID strings with components which do not fit in a
    /// `uint64_t` to be invalid.
    pub fn CBB_add_asn1_oid_from_text(
        cbb: *mut CBB,
        text: *const ::core::ffi::c_char,
        len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBB_add_asn1_relative_oid_from_text decodes `len` bytes from `text` as an
    /// ASCII RELATIVE-OID representation, e.g. "32473.1", and writes the
    /// DER-encoded contents to `cbb`. It returns one on success and zero on malloc
    /// failure or if `text` was invalid. It does not include any framing, only the
    /// element's contents.
    ///
    /// This function considers OID strings with components which do not fit in a
    /// `uint64_t` to be invalid.
    pub fn CBB_add_asn1_relative_oid_from_text(
        cbb: *mut CBB,
        text: *const ::core::ffi::c_char,
        len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBB_add_asn1_oid_component appends a single OID component to `cbb`.
    /// It returns one on success and zero on error.
    pub fn CBB_add_asn1_oid_component(cbb: *mut CBB, value: u64) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBB_flush_asn1_set_of calls `CBB_flush` on `cbb` and then reorders the
    /// contents for a DER-encoded ASN.1 SET OF type. It returns one on success and
    /// zero on failure. DER canonicalizes SET OF contents by sorting
    /// lexicographically by encoding. Call this function when encoding a SET OF
    /// type in an order that is not already known to be canonical.
    ///
    /// Note a SET type has a slightly different ordering than a SET OF.
    pub fn CBB_flush_asn1_set_of(cbb: *mut CBB) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// The following functions read one Unicode code point from `cbs` with the
    /// corresponding encoding and store it in `*out`. They return one on success and
    /// zero on error.
    pub fn CBS_get_utf8(cbs: *mut CBS, out: *mut u32) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn CBS_get_latin1(cbs: *mut CBS, out: *mut u32) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn CBS_get_ucs2_be(cbs: *mut CBS, out: *mut u32) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn CBS_get_utf32_be(cbs: *mut CBS, out: *mut u32) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CBB_get_utf8_len returns the number of bytes needed to represent `u` in
    /// UTF-8.
    pub fn CBB_get_utf8_len(u: u32) -> usize;
}
unsafe extern "C" {
    /// The following functions encode `u` to `cbb` with the corresponding
    /// encoding. They return one on success and zero on error. Error conditions
    /// include `u` being an invalid code point, or `u` being unencodable in the
    /// specified encoding.
    pub fn CBB_add_utf8(cbb: *mut CBB, u: u32) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn CBB_add_latin1(cbb: *mut CBB, u: u32) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn CBB_add_ucs2_be(cbb: *mut CBB, u: u32) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn CBB_add_utf32_be(cbb: *mut CBB, u: u32) -> ::core::ffi::c_int;
}
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct cast_key_st {
    pub data: [u32; 32usize],
    /// Use reduced rounds for short key
    pub short_key: ::core::ffi::c_int,
}
pub type CAST_KEY = cast_key_st;
unsafe extern "C" {
    /// CAST_set_key initializes `key` from `len` bytes of key material starting from
    /// `data`. CAST-128 keys are between 5 and 16 bytes long. If `len` is greater
    /// than 16, `data` is truncated and only the first 16 bytes are processed. If
    /// `len` is less than 5, it is internally zero-padded.
    pub fn CAST_set_key(key: *mut CAST_KEY, len: usize, data: *const u8);
}
unsafe extern "C" {
    /// CAST_ecb_encrypt encrypts (or decrypts, if `enc` is `CAST_DECRYPT`) a single
    /// 8-byte block from `in` to `out`, using `key`.
    pub fn CAST_ecb_encrypt(
        in_: *const u8,
        out: *mut u8,
        key: *const CAST_KEY,
        enc: ::core::ffi::c_int,
    );
}
unsafe extern "C" {
    /// CAST_encrypt encrypts an 8-byte block from `data` in-place with `key`. An
    /// 8-byte block is represented in this function as two 32-bit integers,
    /// containing the first and second four bytes in big-endian order.
    pub fn CAST_encrypt(data: *mut u32, key: *const CAST_KEY);
}
unsafe extern "C" {
    /// CAST_decrypt decrypts an 8-byte block from `data` in-place with `key`. An
    /// 8-byte block is represented in this function as two 32-bit integers,
    /// containing the first and second four bytes in big-endian order.
    pub fn CAST_decrypt(data: *mut u32, key: *const CAST_KEY);
}
unsafe extern "C" {
    /// CAST_cbc_encrypt encrypts (or decrypts, if `enc` is `CAST_DECRYPT`) `length`
    /// bytes from `in` to `out` with CAST-128 in CBC mode. `length` must be a
    /// multiple of 8. The IV is taken from `iv`. When the function completes, the IV
    /// for the next block is written to `iv`.
    pub fn CAST_cbc_encrypt(
        in_: *const u8,
        out: *mut u8,
        length: usize,
        ks: *const CAST_KEY,
        iv: *mut u8,
        enc: ::core::ffi::c_int,
    );
}
unsafe extern "C" {
    /// CAST_cfb64_encrypt encrypts (or decrypts, if `enc` is `CAST_DECRYPT`)
    /// `length` bytes from `in` to `out` with CAST-128 in CFB-64 mode. `length` must
    /// be a multiple of 8. On the first call, `*num` should be zero and `ivec` the
    /// IV. On exit, this function will write state to `ivec` and `*num` to resume an
    /// encryption or decryption operation if the buffers are not contiguous.
    pub fn CAST_cfb64_encrypt(
        in_: *const u8,
        out: *mut u8,
        length: usize,
        schedule: *const CAST_KEY,
        ivec: *mut u8,
        num: *mut ::core::ffi::c_int,
        enc: ::core::ffi::c_int,
    );
}
unsafe extern "C" {
    /// CRYPTO_chacha_20 encrypts `in_len` bytes from `in` with the given key and
    /// nonce and writes the result to `out`. If `in` and `out` alias, they must be
    /// equal. The initial block counter is specified by `counter`.
    ///
    /// This function implements a 32-bit block counter as in RFC 8439. On overflow,
    /// the counter wraps. Reusing a key, nonce, and block counter combination is not
    /// secure, so wrapping is usually a bug in the caller. While it is possible to
    /// wrap without reuse with a large initial block counter, this is not
    /// recommended and may not be portable to other ChaCha20 implementations.
    pub fn CRYPTO_chacha_20(
        out: *mut u8,
        in_: *const u8,
        in_len: usize,
        key: *const u8,
        nonce: *const u8,
        counter: u32,
    );
}
unsafe extern "C" {
    /// Cipher primitives.
    ///
    /// The following functions return `EVP_CIPHER` objects that implement the named
    /// cipher algorithm.
    pub fn EVP_rc4() -> *const EVP_CIPHER;
}
unsafe extern "C" {
    pub fn EVP_des_cbc() -> *const EVP_CIPHER;
}
unsafe extern "C" {
    pub fn EVP_des_ecb() -> *const EVP_CIPHER;
}
unsafe extern "C" {
    pub fn EVP_des_ede() -> *const EVP_CIPHER;
}
unsafe extern "C" {
    pub fn EVP_des_ede3() -> *const EVP_CIPHER;
}
unsafe extern "C" {
    pub fn EVP_des_ede_cbc() -> *const EVP_CIPHER;
}
unsafe extern "C" {
    pub fn EVP_des_ede3_cbc() -> *const EVP_CIPHER;
}
unsafe extern "C" {
    pub fn EVP_aes_128_ecb() -> *const EVP_CIPHER;
}
unsafe extern "C" {
    pub fn EVP_aes_128_cbc() -> *const EVP_CIPHER;
}
unsafe extern "C" {
    pub fn EVP_aes_128_ctr() -> *const EVP_CIPHER;
}
unsafe extern "C" {
    pub fn EVP_aes_128_ofb() -> *const EVP_CIPHER;
}
unsafe extern "C" {
    pub fn EVP_aes_256_ecb() -> *const EVP_CIPHER;
}
unsafe extern "C" {
    pub fn EVP_aes_256_cbc() -> *const EVP_CIPHER;
}
unsafe extern "C" {
    pub fn EVP_aes_256_ctr() -> *const EVP_CIPHER;
}
unsafe extern "C" {
    pub fn EVP_aes_256_ofb() -> *const EVP_CIPHER;
}
unsafe extern "C" {
    pub fn EVP_aes_256_xts() -> *const EVP_CIPHER;
}
unsafe extern "C" {
    /// EVP_enc_null returns a 'cipher' that passes plaintext through as
    /// ciphertext.
    pub fn EVP_enc_null() -> *const EVP_CIPHER;
}
unsafe extern "C" {
    /// EVP_rc2_cbc returns a cipher that implements 128-bit RC2 in CBC mode.
    pub fn EVP_rc2_cbc() -> *const EVP_CIPHER;
}
unsafe extern "C" {
    /// EVP_rc2_40_cbc returns a cipher that implements 40-bit RC2 in CBC mode. This
    /// is obviously very, very weak and is included only in order to read PKCS#12
    /// files, which often encrypt the certificate chain using this cipher. It is
    /// deliberately not exported.
    pub fn EVP_rc2_40_cbc() -> *const EVP_CIPHER;
}
unsafe extern "C" {
    /// EVP_get_cipherbynid returns the cipher corresponding to the given NID, or
    /// NULL if no such cipher is known. Note using this function links almost every
    /// cipher implemented by BoringSSL into the binary, whether the caller uses them
    /// or not. Size-conscious callers, such as client software, should not use this
    /// function.
    pub fn EVP_get_cipherbynid(nid: ::core::ffi::c_int) -> *const EVP_CIPHER;
}
unsafe extern "C" {
    /// EVP_CIPHER_CTX_init sets an uninitialized `EVP_CIPHER_CTX` to the zero state.
    /// This is the same as setting the structure to zero.
    ///
    /// This function is used for initializing uninitialized memory in an
    /// `EVP_CIPHER_CTX`, e.g. if it is declared as a local variable on the stack.
    /// This function should not be used on objects that have already been
    /// initialized.
    pub fn EVP_CIPHER_CTX_init(ctx: *mut EVP_CIPHER_CTX);
}
unsafe extern "C" {
    /// EVP_CIPHER_CTX_new returns a newly-allocated `EVP_CIPHER_CTX` in the zero
    /// state, or NULL on allocation failure. The caller must use
    /// `EVP_CIPHER_CTX_free` to release the resulting object.
    pub fn EVP_CIPHER_CTX_new() -> *mut EVP_CIPHER_CTX;
}
unsafe extern "C" {
    /// EVP_CIPHER_CTX_cleanup frees any memory referenced by `ctx`. It returns
    /// one.
    pub fn EVP_CIPHER_CTX_cleanup(ctx: *mut EVP_CIPHER_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_CIPHER_CTX_free calls `EVP_CIPHER_CTX_cleanup` on `ctx` and then frees
    /// `ctx` itself.
    pub fn EVP_CIPHER_CTX_free(ctx: *mut EVP_CIPHER_CTX);
}
unsafe extern "C" {
    /// EVP_CIPHER_CTX_copy sets `out` to be a duplicate of the current state of
    /// `in`. The `out` argument must have been previously initialised, e.g. with
    /// `EVP_CIPHER_CTX_init` or `EVP_CIPHER_CTX_new`.
    pub fn EVP_CIPHER_CTX_copy(
        out: *mut EVP_CIPHER_CTX,
        in_: *const EVP_CIPHER_CTX,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_CIPHER_CTX_reset calls `EVP_CIPHER_CTX_cleanup` followed by
    /// `EVP_CIPHER_CTX_init` and returns one.
    pub fn EVP_CIPHER_CTX_reset(ctx: *mut EVP_CIPHER_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_CipherInit_ex configures `ctx` for a fresh encryption (or decryption, if
    /// `enc` is zero) operation using `cipher`. The memory in `ctx` must already
    /// have been initialized, e.g. with `EVP_CIPHER_CTX_init` or
    /// `EVP_CIPHER_CTX_new`. If non-NULL, `key` and `iv` will be used as the key and
    /// IV, respectively. These must point to `EVP_CIPHER_key_length` and
    /// `EVP_CIPHER_iv_length` bytes, respectively. It returns one on success and
    /// zero on error.
    ///
    /// This function may be called multiple times on a single `EVP_CIPHER_CTX`,
    /// either to reset an existing object, or to configure a single operation in
    /// multiple steps. In such cases:
    ///
    /// - `cipher` may be NULL to reuse the previous cipher state. A non-NULL
    ///   `cipher` will reset all cipher state, including the key and IV, even if
    ///   configuring the same `EVP_CIPHER` as before.
    ///
    /// - `key` and `iv` may be NULL to either reuse the previous value, or leave
    ///   them unconfigured.
    ///
    /// - `enc` may be -1 to reuse the previous value. In ciphers that use a
    ///   different key schedule between encryption and decryption (e.g. CBC and ECB
    ///   modes), callers must configure `key` and `enc` together.
    ///
    /// Some example multi-step configuration patterns:
    ///
    /// - If setting a variable-length key with `EVP_CIPHER_CTX_set_key_length`,
    ///   first configure only `cipher`, then use `EVP_CIPHER_CTX_set_key_length`,
    ///   and finally configure `key`, leaving `cipher` NULL.
    ///
    /// - If setting a variable-length IV with `EVP_CTRL_AEAD_SET_IVLEN`, first
    ///   configure `cipher` and `key`, then use `EVP_CTRL_AEAD_SET_IVLEN`, and
    ///   finally configure `iv`, leaving other parameters NULL.
    ///
    /// - If retaining a long-lived context to reuse the key schedule across
    ///   operations, first configure only `cipher` and `key` on the long-lived
    ///   context, then copy the key schedule to a per-operation context with
    ///   `EVP_CIPHER_CTX_copy`, and finally configure only `iv` on the per-operation
    ///   context.
    ///
    /// WARNING: This API is difficult to use correctly. Use `EVP_AEAD` for AEADs.
    pub fn EVP_CipherInit_ex(
        ctx: *mut EVP_CIPHER_CTX,
        cipher: *const EVP_CIPHER,
        engine: *mut ENGINE,
        key: *const u8,
        iv: *const u8,
        enc: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_EncryptInit_ex calls `EVP_CipherInit_ex` with `enc` equal to one.
    pub fn EVP_EncryptInit_ex(
        ctx: *mut EVP_CIPHER_CTX,
        cipher: *const EVP_CIPHER,
        impl_: *mut ENGINE,
        key: *const u8,
        iv: *const u8,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_DecryptInit_ex calls `EVP_CipherInit_ex` with `enc` equal to zero.
    pub fn EVP_DecryptInit_ex(
        ctx: *mut EVP_CIPHER_CTX,
        cipher: *const EVP_CIPHER,
        impl_: *mut ENGINE,
        key: *const u8,
        iv: *const u8,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_EncryptUpdate_ex encrypts `in_len` bytes from `in` and writes up to
    /// `max_out_len` bytes of ciphertext to `out`. On success, it sets `*out_len` to
    /// the number of output bytes and returns one. Otherwise, it returns zero.
    ///
    /// If `max_out_len` is not large enough for the output, the function will return
    /// zero. The size of output buffer needed depends on the cipher and the number
    /// of bytes encrypted by `ctx` thus far. `EVP_CIPHER_CTX_max_next_update` will
    /// return the maximum output for this call.
    ///
    /// In ciphers whose block size is not 1, such as CBC, individual calls to
    /// `EVP_EncryptUpdate_ex` may output more or less than `in_len` bytes: a single
    /// call to `EVP_EncryptUpdate_ex` may output at most `in_len + block_size - 1`
    /// bytes. Additionally, the total output across all `EVP_EncryptUpdate_ex` and
    /// `EVP_EncryptFinal_ex2` calls will be at most the total input plus one byte,
    /// rounded up to a multiple of the block size.
    pub fn EVP_EncryptUpdate_ex(
        ctx: *mut EVP_CIPHER_CTX,
        out: *mut u8,
        out_len: *mut usize,
        max_out_len: usize,
        in_: *const u8,
        in_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_EncryptFinal_ex2 finishes an encryption operation and writes up to
    /// `max_out_len` bytes of output to out. On success, it sets `*out_len` to the
    /// number of bytes written and returns one. Otherwise, it returns zero.
    ///
    /// If `max_out_len` is not large enough for the output, the function will return
    /// zero. The size of output buffer needed depends on the cipher and the number
    /// of bytes encrypted. `EVP_CIPHER_CTX_max_final` will return the maximum output
    /// for this call.
    ///
    /// If the block size is 1, there will be no final output at all; otherwise, at
    /// most one block of ciphertext will be written to the output.
    ///
    /// If padding is enabled (the default) and the block size is not 1, then
    /// standard padding is applied to create the final block. If padding is
    /// disabled (with `EVP_CIPHER_CTX_set_padding`) then any partial block
    /// remaining will cause an error. The function returns one on success and zero
    /// otherwise.
    pub fn EVP_EncryptFinal_ex2(
        ctx: *mut EVP_CIPHER_CTX,
        out: *mut u8,
        out_len: *mut usize,
        max_out_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_DecryptUpdate_ex decrypts `in_len` bytes from `in` and writes up to
    /// `max_out_len` bytes of plaintext to `out`. On success, it sets `*out_len` to
    /// the number of output bytes and returns one. Otherwise, it returns zero.
    ///
    /// If `max_out_len` is not large enough for the output, the function will return
    /// zero. The size of output buffer needed depends on the cipher and the number
    /// of bytes decrypted by `ctx` thus far. `EVP_CIPHER_CTX_max_next_update` will
    /// return the maximum output for this call.
    ///
    /// In ciphers whose block size is not 1, such as CBC, individual calls to
    /// `EVP_DecryptUpdate_ex` may output more or less than `in_len` bytes: a single
    /// call to `EVP_DecryptUpdate_ex` may output at most `in_len + block_size - 1`
    /// bytes. Additionally, the total output across all `EVP_DecryptUpdate_ex` and
    /// `EVP_DecryptFinal_ex2` calls will be at most the total input.
    ///
    /// WARNING: if the cipher is an AEAD cipher, decrypted data should not be
    /// parsed or otherwise processed until success has been returned by
    /// `EVP_EncryptFinal_ex2`.
    pub fn EVP_DecryptUpdate_ex(
        ctx: *mut EVP_CIPHER_CTX,
        out: *mut u8,
        out_len: *mut usize,
        max_out_len: usize,
        in_: *const u8,
        in_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_DecryptFinal_ex2 finishes a decryption operation and writes up to
    /// `max_out_len` bytes of output to out. On success, it sets `*out_len` to the
    /// number of bytes written and returns one. Otherwise, it returns zero.
    ///
    /// If `max_out_len` is not large enough for the output, the function will return
    /// zero. The size of output buffer needed depends on the cipher and the number
    /// of bytes decrypted. `EVP_CIPHER_CTX_max_final` will return the maximum output
    /// for this call.
    ///
    /// If the block size is 1, there will be no final output at all; otherwise, at
    /// most one block of ciphertext will be written to the output.
    ///
    /// If padding is enabled (the default) and the block size is not 1, then
    /// standard padding is removed from the final block.
    ///
    /// WARNING: it is unsafe to call this function after decrypting unauthenticated
    /// ciphertext if padding is enabled and the block size is not 1 ("padding
    /// oracle").
    pub fn EVP_DecryptFinal_ex2(
        ctx: *mut EVP_CIPHER_CTX,
        out: *mut u8,
        out_len: *mut usize,
        max_out_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_CipherUpdate_ex calls either `EVP_EncryptUpdate_ex` or
    /// `EVP_DecryptUpdate_ex` depending on how `ctx` has been setup.
    pub fn EVP_CipherUpdate_ex(
        ctx: *mut EVP_CIPHER_CTX,
        out: *mut u8,
        out_len: *mut usize,
        max_out_len: usize,
        in_: *const u8,
        in_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_CipherUpdateAAD adds `in_len` bytes from `in` to the AAD. The AAD must
    /// be fully specified in this way before any plaintext or ciphertext is
    /// supplied to the other functions. Please consider moving to the `EVP_AEAD`
    /// APIs instead.
    pub fn EVP_CipherUpdateAAD(
        ctx: *mut EVP_CIPHER_CTX,
        in_: *const u8,
        in_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_CipherFinal_ex2 calls either `EVP_EncryptFinal_ex2` or
    /// `EVP_DecryptFinal_ex2` depending on how `ctx` has been setup.
    pub fn EVP_CipherFinal_ex2(
        ctx: *mut EVP_CIPHER_CTX,
        out: *mut u8,
        out_len: *mut usize,
        max_out_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_CIPHER_CTX_max_next_update returns the maximum number of bytes that may
    /// be output from `ctx` by a call to `EVP_CipherUpdate_ex` with `in_len` bytes
    /// of input. This takes the current state of `ctx` into account, so the output
    /// will change as bytes are passed in and out.
    pub fn EVP_CIPHER_CTX_max_next_update(ctx: *const EVP_CIPHER_CTX, in_len: usize) -> usize;
}
unsafe extern "C" {
    /// EVP_CIPHER_CTX_max_final returns the maximum number of bytes that may
    /// be output from `ctx` by a call to `EVP_CipherFinal_ex2`. This takes the
    /// current state of `ctx` into account, so the output will change as bytes are
    /// passed in and out.
    pub fn EVP_CIPHER_CTX_max_final(ctx: *const EVP_CIPHER_CTX) -> usize;
}
unsafe extern "C" {
    /// EVP_CIPHER_CTX_cipher returns the `EVP_CIPHER` underlying `ctx`, or NULL if
    /// none has been set.
    pub fn EVP_CIPHER_CTX_cipher(ctx: *const EVP_CIPHER_CTX) -> *const EVP_CIPHER;
}
unsafe extern "C" {
    /// EVP_CIPHER_CTX_nid returns a NID identifying the `EVP_CIPHER` underlying
    /// `ctx` (e.g. `NID_aes_128_gcm`). It will crash if no cipher has been
    /// configured.
    pub fn EVP_CIPHER_CTX_nid(ctx: *const EVP_CIPHER_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_CIPHER_CTX_encrypting returns one if `ctx` is configured for encryption
    /// and zero otherwise.
    pub fn EVP_CIPHER_CTX_encrypting(ctx: *const EVP_CIPHER_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_CIPHER_CTX_block_size returns the block size, in bytes, of the cipher
    /// underlying `ctx`, or one if the cipher is a stream cipher. It will crash if
    /// no cipher has been configured.
    pub fn EVP_CIPHER_CTX_block_size(ctx: *const EVP_CIPHER_CTX) -> ::core::ffi::c_uint;
}
unsafe extern "C" {
    /// EVP_CIPHER_CTX_key_length returns the key size, in bytes, of the cipher
    /// underlying `ctx` or zero if no cipher has been configured.
    pub fn EVP_CIPHER_CTX_key_length(ctx: *const EVP_CIPHER_CTX) -> ::core::ffi::c_uint;
}
unsafe extern "C" {
    /// EVP_CIPHER_CTX_iv_length returns the IV size, in bytes, of the cipher
    /// underlying `ctx`. It will crash if no cipher has been configured.
    pub fn EVP_CIPHER_CTX_iv_length(ctx: *const EVP_CIPHER_CTX) -> ::core::ffi::c_uint;
}
unsafe extern "C" {
    /// EVP_CIPHER_CTX_get_app_data returns the opaque, application data pointer for
    /// `ctx`, or NULL if none has been set.
    pub fn EVP_CIPHER_CTX_get_app_data(ctx: *const EVP_CIPHER_CTX) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    /// EVP_CIPHER_CTX_set_app_data sets the opaque, application data pointer for
    /// `ctx` to `data`.
    pub fn EVP_CIPHER_CTX_set_app_data(ctx: *mut EVP_CIPHER_CTX, data: *mut ::core::ffi::c_void);
}
unsafe extern "C" {
    /// EVP_CIPHER_CTX_flags returns a value which is the OR of zero or more
    /// `EVP_CIPH_*` flags. It will crash if no cipher has been configured.
    pub fn EVP_CIPHER_CTX_flags(ctx: *const EVP_CIPHER_CTX) -> u32;
}
unsafe extern "C" {
    /// EVP_CIPHER_CTX_mode returns one of the `EVP_CIPH_*` cipher mode values
    /// enumerated below. It will crash if no cipher has been configured.
    pub fn EVP_CIPHER_CTX_mode(ctx: *const EVP_CIPHER_CTX) -> u32;
}
unsafe extern "C" {
    /// EVP_CIPHER_CTX_ctrl is an `ioctl` like function. The `command` argument
    /// should be one of the `EVP_CTRL_*` values. The `arg` and `ptr` arguments are
    /// specific to the command in question.
    pub fn EVP_CIPHER_CTX_ctrl(
        ctx: *mut EVP_CIPHER_CTX,
        command: ::core::ffi::c_int,
        arg: ::core::ffi::c_int,
        ptr: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_CIPHER_CTX_set_padding sets whether padding is enabled for `ctx` and
    /// returns one. Pass a non-zero `pad` to enable padding (the default) or zero
    /// to disable.
    pub fn EVP_CIPHER_CTX_set_padding(
        ctx: *mut EVP_CIPHER_CTX,
        pad: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_CIPHER_CTX_set_key_length sets the key length for `ctx`. This is only
    /// valid for ciphers that can take a variable length key. It returns one on
    /// success and zero on error.
    ///
    /// In order to use this function, |ctx| must have been configured with an
    /// |EVP_CIPHER| with |EVP_CipherInit_ex|. Callers should first configure only
    /// the cipher, leaving |key| NULL, call |EVP_CIPHER_CTX_set_key_length|, and
    /// finally call |EVP_CipherInit_ex| with a NULL |cipher| and non-NULL |key|.
    pub fn EVP_CIPHER_CTX_set_key_length(
        ctx: *mut EVP_CIPHER_CTX,
        key_len: ::core::ffi::c_uint,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_CIPHER_nid returns a NID identifying `cipher`. (For example,
    /// `NID_aes_128_gcm`.)
    pub fn EVP_CIPHER_nid(cipher: *const EVP_CIPHER) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_CIPHER_block_size returns the block size, in bytes, for `cipher`, or one
    /// if `cipher` is a stream cipher.
    pub fn EVP_CIPHER_block_size(cipher: *const EVP_CIPHER) -> ::core::ffi::c_uint;
}
unsafe extern "C" {
    /// EVP_CIPHER_key_length returns the key size, in bytes, for `cipher`. If
    /// `cipher` can take a variable key length then this function returns the
    /// default key length and `EVP_CIPHER_flags` will return a value with
    /// `EVP_CIPH_VARIABLE_LENGTH` set.
    pub fn EVP_CIPHER_key_length(cipher: *const EVP_CIPHER) -> ::core::ffi::c_uint;
}
unsafe extern "C" {
    /// EVP_CIPHER_iv_length returns the IV size, in bytes, of `cipher`, or zero if
    /// `cipher` doesn't take an IV.
    pub fn EVP_CIPHER_iv_length(cipher: *const EVP_CIPHER) -> ::core::ffi::c_uint;
}
unsafe extern "C" {
    /// EVP_CIPHER_flags returns a value which is the OR of zero or more
    /// `EVP_CIPH_*` flags.
    pub fn EVP_CIPHER_flags(cipher: *const EVP_CIPHER) -> u32;
}
unsafe extern "C" {
    /// EVP_CIPHER_mode returns one of the cipher mode values enumerated below.
    pub fn EVP_CIPHER_mode(cipher: *const EVP_CIPHER) -> u32;
}
unsafe extern "C" {
    /// EVP_BytesToKey generates a key and IV for the cipher `type` by iterating
    /// `md` `count` times using `data` and an optional `salt`, writing the result to
    /// `key` and `iv`. If not NULL, the `key` and `iv` buffers must have enough
    /// space to hold a key and IV for `type`, as returned by `EVP_CIPHER_key_length`
    /// and `EVP_CIPHER_iv_length`. This function returns the length of the key
    /// (without the IV) on success or zero on error.
    ///
    /// If `salt` is NULL, the empty string is used as the salt. Salt lengths other
    /// than 0 and 8 are not supported by this function. Either of `key` or `iv` may
    /// be NULL to skip that output.
    ///
    /// When the total data derived is less than the size of `md`, this function
    /// implements PBKDF1 from RFC 8018. Otherwise, it generalizes PBKDF1 by
    /// computing prepending the previous output to `data` and re-running PBKDF1 for
    /// further output.
    ///
    /// This function is provided for compatibility with legacy uses of PBKDF1. New
    /// applications should use a more modern algorithm, such as `EVP_PBE_scrypt`.
    pub fn EVP_BytesToKey(
        type_: *const EVP_CIPHER,
        md: *const EVP_MD,
        salt: *const u8,
        data: *const u8,
        data_len: usize,
        count: ::core::ffi::c_uint,
        key: *mut u8,
        iv: *mut u8,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_CipherInit acts like `EVP_CipherInit_ex` except that
    /// `EVP_CIPHER_CTX_init` is called on `cipher` first, if `cipher` is not NULL.
    ///
    /// `EVP_CIPHER_CTX_init` is used for initializing uninitialized memory in an
    /// `EVP_CIPHER_CTX`, e.g. if it is declared as a local variable on the stack.
    /// Thus this function should not be used on objects that have already been
    /// initialized.
    ///
    /// WARNING: This differs from OpenSSL 1.1.x, where `EVP_CipherInit` and
    /// `EVP_CipherInit_ex` are largely equivalent. This difference is because
    /// BoringSSL, like OpenSSL 1.0.x, still supports stack-allocating
    /// `EVP_CIPHER_CTX`. Implementing the OpenSSL 1.1.x semantics would introduce
    /// uninitialized reads in those callers.
    pub fn EVP_CipherInit(
        ctx: *mut EVP_CIPHER_CTX,
        cipher: *const EVP_CIPHER,
        key: *const u8,
        iv: *const u8,
        enc: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_EncryptInit calls `EVP_CipherInit` with `enc` equal to one.
    ///
    /// WARNING: See discussion in `EVP_CipherInit`.
    pub fn EVP_EncryptInit(
        ctx: *mut EVP_CIPHER_CTX,
        cipher: *const EVP_CIPHER,
        key: *const u8,
        iv: *const u8,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_DecryptInit calls `EVP_CipherInit` with `enc` equal to zero.
    ///
    /// WARNING: See discussion in `EVP_CipherInit`.
    pub fn EVP_DecryptInit(
        ctx: *mut EVP_CIPHER_CTX,
        cipher: *const EVP_CIPHER,
        key: *const u8,
        iv: *const u8,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_CipherUpdate does the same as `EVP_CipherUpdate_ex`, except that no
    /// output size is given and thus no bounds checking is performed.
    ///
    /// Additionally, if `ctx` is an AEAD cipher, e.g. `EVP_aes_128_gcm`, and `out`
    /// is NULL, this function instead behaves like `EVP_CipherUpdateAAD`.
    ///
    /// WARNING: This function does not check bounds on `out`, and correctly sizing
    /// the output buffer is difficult. Use `EVP_CipherUpdate_ex` or
    /// `EVP_CipherUpdateAAD` instead.
    pub fn EVP_CipherUpdate(
        ctx: *mut EVP_CIPHER_CTX,
        out: *mut u8,
        out_len: *mut ::core::ffi::c_int,
        in_: *const u8,
        in_len: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_EncryptUpdate does the same as `EVP_EncryptUpdate_ex`, except that no
    /// output size is given and thus no bounds checking is performed.
    ///
    /// Additionally, if `ctx` is an AEAD cipher, e.g. `EVP_aes_128_gcm`, and `out`
    /// is NULL, this function instead behaves like `EVP_CipherUpdateAAD`.
    ///
    /// WARNING: This function does not check bounds on `out`, and correctly sizing
    /// the output buffer is difficult. Use `EVP_EncryptUpdate_ex` or
    /// `EVP_CipherUpdateAAD` instead.
    pub fn EVP_EncryptUpdate(
        ctx: *mut EVP_CIPHER_CTX,
        out: *mut u8,
        out_len: *mut ::core::ffi::c_int,
        in_: *const u8,
        in_len: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_DecryptUpdate does the same as `EVP_DecryptUpdate_ex`, except that no
    /// output size is given and thus no bounds checking is performed.
    ///
    /// Additionally, if `ctx` is an AEAD cipher, e.g. `EVP_aes_128_gcm`, and `out`
    /// is NULL, this function instead behaves like `EVP_CipherUpdateAAD`.
    ///
    /// WARNING: This function does not check bounds on out, and correctly sizing
    /// the output buffer is difficult. Use `EVP_DecryptUpdate_ex` or
    /// `EVP_CipherUpdateAAD` instead.
    pub fn EVP_DecryptUpdate(
        ctx: *mut EVP_CIPHER_CTX,
        out: *mut u8,
        out_len: *mut ::core::ffi::c_int,
        in_: *const u8,
        in_len: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_CipherFinal calls `EVP_CipherFinal_ex`.
    pub fn EVP_CipherFinal(
        ctx: *mut EVP_CIPHER_CTX,
        out: *mut u8,
        out_len: *mut ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_CipherFinal_ex does the same as `EVP_CipherFinal_ex2`, except that no
    /// output size is given and thus no bounds checking is performed.
    ///
    /// WARNING: This function does not check bounds on out, and correctly sizing
    /// the output buffer is difficult. Use `EVP_CipherFinal_ex2` instead.
    pub fn EVP_CipherFinal_ex(
        ctx: *mut EVP_CIPHER_CTX,
        out: *mut u8,
        out_len: *mut ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_EncryptFinal calls `EVP_EncryptFinal_ex`.
    pub fn EVP_EncryptFinal(
        ctx: *mut EVP_CIPHER_CTX,
        out: *mut u8,
        out_len: *mut ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_EncryptFinal_ex does the same as `EVP_EncryptFinal_ex2`, except that no
    /// output size is given and thus no bounds checking is performed.
    ///
    /// WARNING: This function does not check bounds on out, and correctly sizing
    /// the output buffer is difficult. Use `EVP_EncryptFinal_ex2` instead.
    pub fn EVP_EncryptFinal_ex(
        ctx: *mut EVP_CIPHER_CTX,
        out: *mut u8,
        out_len: *mut ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_DecryptFinal calls `EVP_DecryptFinal_ex`.
    pub fn EVP_DecryptFinal(
        ctx: *mut EVP_CIPHER_CTX,
        out: *mut u8,
        out_len: *mut ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_DecryptFinal_ex does the same as `EVP_DecryptFinal_ex2`, except that no
    /// output size is given and thus no bounds checking is performed.
    ///
    /// WARNING: This function does not check bounds on out, and correctly sizing
    /// the output buffer is difficult. Use `EVP_DecryptFinal_ex2` instead.
    pub fn EVP_DecryptFinal_ex(
        ctx: *mut EVP_CIPHER_CTX,
        out: *mut u8,
        out_len: *mut ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_Cipher historically exposed an internal implementation detail of `ctx`
    /// and should not be used. Use `EVP_CipherUpdate` and `EVP_CipherFinal_ex`
    /// instead.
    ///
    /// If `ctx`'s cipher does not have the `EVP_CIPH_FLAG_CUSTOM_CIPHER` flag, it
    /// encrypts or decrypts `in_len` bytes from `in` and writes the resulting
    /// `in_len` bytes to `out`. It returns one on success and zero on error.
    /// `in_len` must be a multiple of the cipher's block size, or the behavior is
    /// undefined.
    ///
    /// TODO(davidben): Rather than being undefined (it'll often round the length up
    /// and likely read past the buffer), just fail the operation.
    ///
    /// If `ctx`'s cipher has the `EVP_CIPH_FLAG_CUSTOM_CIPHER` flag, it runs in one
    /// of two modes: If `in` is non-NULL, it behaves like `EVP_CipherUpdate`. If
    /// `in` is NULL, it behaves like `EVP_CipherFinal_ex`. In both cases, it returns
    /// `*out_len` on success and -1 on error.
    ///
    /// WARNING: The two possible calling conventions of this function signal errors
    /// incompatibly. In the first, zero indicates an error. In the second, zero
    /// indicates success with zero bytes of output.
    pub fn EVP_Cipher(
        ctx: *mut EVP_CIPHER_CTX,
        out: *mut u8,
        in_: *const u8,
        in_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_add_cipher_alias does nothing and returns one.
    pub fn EVP_add_cipher_alias(
        a: *const ::core::ffi::c_char,
        b: *const ::core::ffi::c_char,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_get_cipherbyname returns an `EVP_CIPHER` given a human readable name in
    /// `name`, or NULL if the name is unknown. Note using this function links almost
    /// every cipher implemented by BoringSSL into the binary, not just the ones the
    /// caller requests. Size-conscious callers, such as client software, should not
    /// use this function.
    pub fn EVP_get_cipherbyname(name: *const ::core::ffi::c_char) -> *const EVP_CIPHER;
}
unsafe extern "C" {
    /// These AEADs are deprecated AES-GCM implementations that set
    /// `EVP_CIPH_FLAG_CUSTOM_CIPHER`. Use `EVP_aead_aes_128_gcm` and
    /// `EVP_aead_aes_256_gcm` instead.
    ///
    /// WARNING: Although these APIs allow streaming an individual AES-GCM operation,
    /// this is not secure. Until calling `EVP_DecryptFinal_ex`, the tag has not yet
    /// been checked and output released by `EVP_DecryptUpdate` is unauthenticated
    /// and easily manipulated by attackers. Callers must buffer the output and may
    /// not act on it until the entire operation is complete.
    pub fn EVP_aes_128_gcm() -> *const EVP_CIPHER;
}
unsafe extern "C" {
    pub fn EVP_aes_256_gcm() -> *const EVP_CIPHER;
}
unsafe extern "C" {
    /// These are deprecated, 192-bit version of AES.
    pub fn EVP_aes_192_ecb() -> *const EVP_CIPHER;
}
unsafe extern "C" {
    pub fn EVP_aes_192_cbc() -> *const EVP_CIPHER;
}
unsafe extern "C" {
    pub fn EVP_aes_192_ctr() -> *const EVP_CIPHER;
}
unsafe extern "C" {
    pub fn EVP_aes_192_gcm() -> *const EVP_CIPHER;
}
unsafe extern "C" {
    pub fn EVP_aes_192_ofb() -> *const EVP_CIPHER;
}
unsafe extern "C" {
    /// EVP_des_ede3_ecb is an alias for `EVP_des_ede3`. Use the former instead.
    pub fn EVP_des_ede3_ecb() -> *const EVP_CIPHER;
}
unsafe extern "C" {
    /// EVP_aes_128_cfb128 is only available in decrepit.
    pub fn EVP_aes_128_cfb128() -> *const EVP_CIPHER;
}
unsafe extern "C" {
    /// EVP_aes_128_cfb is an alias for `EVP_aes_128_cfb128` and is only available in
    /// decrepit.
    pub fn EVP_aes_128_cfb() -> *const EVP_CIPHER;
}
unsafe extern "C" {
    /// EVP_aes_192_cfb128 is only available in decrepit.
    pub fn EVP_aes_192_cfb128() -> *const EVP_CIPHER;
}
unsafe extern "C" {
    /// EVP_aes_192_cfb is an alias for `EVP_aes_192_cfb128` and is only available in
    /// decrepit.
    pub fn EVP_aes_192_cfb() -> *const EVP_CIPHER;
}
unsafe extern "C" {
    /// EVP_aes_256_cfb128 is only available in decrepit.
    pub fn EVP_aes_256_cfb128() -> *const EVP_CIPHER;
}
unsafe extern "C" {
    /// EVP_aes_256_cfb is an alias for `EVP_aes_256_cfb128` and is only available in
    /// decrepit.
    pub fn EVP_aes_256_cfb() -> *const EVP_CIPHER;
}
unsafe extern "C" {
    /// EVP_bf_ecb is Blowfish in ECB mode and is only available in decrepit.
    pub fn EVP_bf_ecb() -> *const EVP_CIPHER;
}
unsafe extern "C" {
    /// EVP_bf_cbc is Blowfish in CBC mode and is only available in decrepit.
    pub fn EVP_bf_cbc() -> *const EVP_CIPHER;
}
unsafe extern "C" {
    /// EVP_bf_cfb is Blowfish in 64-bit CFB mode and is only available in decrepit.
    pub fn EVP_bf_cfb() -> *const EVP_CIPHER;
}
unsafe extern "C" {
    /// EVP_cast5_ecb is CAST5 in ECB mode and is only available in decrepit.
    pub fn EVP_cast5_ecb() -> *const EVP_CIPHER;
}
unsafe extern "C" {
    /// EVP_cast5_cbc is CAST5 in CBC mode and is only available in decrepit.
    pub fn EVP_cast5_cbc() -> *const EVP_CIPHER;
}
unsafe extern "C" {
    /// EVP_CIPHER_CTX_set_flags does nothing.
    pub fn EVP_CIPHER_CTX_set_flags(ctx: *const EVP_CIPHER_CTX, flags: u32);
}
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct evp_cipher_ctx_st {
    /// cipher contains the underlying cipher for this context.
    pub cipher: *const EVP_CIPHER,
    /// application stuff
    pub app_data: *mut ::core::ffi::c_void,
    /// cipher_data points to the `cipher` specific state.
    pub cipher_data: *mut ::core::ffi::c_void,
    /// key_len contains the length of the key, which may differ from
    /// `cipher->key_len` if the cipher can take a variable key length.
    pub key_len: ::core::ffi::c_uint,
    /// encrypt is one if encrypting and zero if decrypting.
    pub encrypt: ::core::ffi::c_int,
    /// flags contains the OR of zero or more `EVP_CIPH_*` flags, above.
    pub flags: u32,
    /// oiv contains the original IV value.
    pub oiv: [u8; 16usize],
    /// iv contains the current IV value, which may have been updated.
    pub iv: [u8; 16usize],
    /// buf contains a partial block which is used by, for example, CTR mode to
    /// store unused keystream bytes.
    pub buf: [u8; 32usize],
    /// buf_len contains the number of bytes of a partial block contained in
    /// `buf`.
    pub buf_len: ::core::ffi::c_int,
    /// num contains the number of bytes of `iv` which are valid for modes that
    /// manage partial blocks themselves.
    pub num: ::core::ffi::c_uint,
    /// final_used is non-zero if the `final` buffer contains plaintext.
    pub final_used: ::core::ffi::c_int,
    /// possible final block
    pub final_: [u8; 32usize],
    /// Has this structure been rendered unusable by a failure.
    pub poisoned: ::core::ffi::c_int,
}
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct evp_cipher_info_st {
    pub cipher: *const EVP_CIPHER,
    pub iv: [::core::ffi::c_uchar; 16usize],
}
pub type EVP_CIPHER_INFO = evp_cipher_info_st;
unsafe extern "C" {
    /// AES_CMAC calculates the 16-byte, CMAC authenticator of `in_len` bytes of
    /// `in` and writes it to `out`. The `key_len` may be 16 or 32 bytes to select
    /// between AES-128 and AES-256. It returns one on success or zero on error.
    pub fn AES_CMAC(
        out: *mut u8,
        key: *const u8,
        key_len: usize,
        in_: *const u8,
        in_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CMAC_CTX_new allocates a fresh `CMAC_CTX` and returns it, or NULL on
    /// error.
    pub fn CMAC_CTX_new() -> *mut CMAC_CTX;
}
unsafe extern "C" {
    /// CMAC_CTX_free frees a `CMAC_CTX`.
    pub fn CMAC_CTX_free(ctx: *mut CMAC_CTX);
}
unsafe extern "C" {
    /// CMAC_CTX_copy sets `out` to be a duplicate of the current state `in`. It
    /// returns one on success and zero on error.
    pub fn CMAC_CTX_copy(out: *mut CMAC_CTX, in_: *const CMAC_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CMAC_Init configures `ctx` to use the given `key` and `cipher`. The CMAC RFC
    /// only specifies the use of AES-128 thus `key_len` should be 16 and `cipher`
    /// should be `EVP_aes_128_cbc()`. However, this implementation also supports
    /// AES-256 by setting `key_len` to 32 and `cipher` to `EVP_aes_256_cbc()`. The
    /// `engine` argument is ignored.
    ///
    /// It returns one on success or zero on error.
    pub fn CMAC_Init(
        ctx: *mut CMAC_CTX,
        key: *const ::core::ffi::c_void,
        key_len: usize,
        cipher: *const EVP_CIPHER,
        engine: *mut ENGINE,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CMAC_Reset resets `ctx` so that a fresh message can be authenticated.
    pub fn CMAC_Reset(ctx: *mut CMAC_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CMAC_Update processes `in_len` bytes of message from `in`. It returns one on
    /// success or zero on error.
    pub fn CMAC_Update(ctx: *mut CMAC_CTX, in_: *const u8, in_len: usize) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CMAC_Final sets `*out_len` to 16 and, if `out` is not NULL, writes 16 bytes
    /// of authenticator to it. It returns one on success or zero on error.
    pub fn CMAC_Final(ctx: *mut CMAC_CTX, out: *mut u8, out_len: *mut usize) -> ::core::ffi::c_int;
}
/// Config files.
///
/// This library handles OpenSSL's config files, which look like:
///
///   # Comment
///
///   # This key is in the default section.
///   key=value
///
///   [section_name]
///   key2=value2
///
/// Config files are represented by a `CONF`. Use of this module is strongly
/// discouraged. It is a remnant of the OpenSSL command-line tool. Parsing an
/// untrusted input as a config file risks string injection and denial of service
/// vulnerabilities.
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct conf_value_st {
    pub section: *mut ::core::ffi::c_char,
    pub name: *mut ::core::ffi::c_char,
    pub value: *mut ::core::ffi::c_char,
}
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct stack_st_CONF_VALUE {
    _unused: [u8; 0],
}
/// We also disable -Wcast-qual. As part of this C-based type erasure setup,  \
/// the wrapper macros need to cast away const in places. In C++, const_cast  \
/// suppresses the warning, but it seemingly cannot be suppressed in C.
pub type sk_CONF_VALUE_free_func =
    ::core::option::Option<unsafe extern "C" fn(arg1: *mut CONF_VALUE)>;
pub type sk_CONF_VALUE_copy_func =
    ::core::option::Option<unsafe extern "C" fn(arg1: *const CONF_VALUE) -> *mut CONF_VALUE>;
pub type sk_CONF_VALUE_cmp_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *const *const CONF_VALUE,
        arg2: *const *const CONF_VALUE,
    ) -> ::core::ffi::c_int,
>;
pub type sk_CONF_VALUE_delete_if_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *mut CONF_VALUE,
        arg2: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int,
>;
unsafe extern "C" {
    #[link_name = "sk_CONF_VALUE_call_free_func__extern"]
    pub fn sk_CONF_VALUE_call_free_func(
        free_func: OPENSSL_sk_free_func,
        ptr: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    #[link_name = "sk_CONF_VALUE_call_copy_func__extern"]
    pub fn sk_CONF_VALUE_call_copy_func(
        copy_func: OPENSSL_sk_copy_func,
        ptr: *const ::core::ffi::c_void,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    #[link_name = "sk_CONF_VALUE_call_cmp_func__extern"]
    pub fn sk_CONF_VALUE_call_cmp_func(
        cmp_func: OPENSSL_sk_cmp_func,
        a: *const ::core::ffi::c_void,
        b: *const ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_CONF_VALUE_call_delete_if_func__extern"]
    pub fn sk_CONF_VALUE_call_delete_if_func(
        func: OPENSSL_sk_delete_if_func,
        obj: *mut ::core::ffi::c_void,
        data: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_CONF_VALUE_new__extern"]
    pub fn sk_CONF_VALUE_new(comp: sk_CONF_VALUE_cmp_func) -> *mut stack_st_CONF_VALUE;
}
unsafe extern "C" {
    #[link_name = "sk_CONF_VALUE_new_null__extern"]
    pub fn sk_CONF_VALUE_new_null() -> *mut stack_st_CONF_VALUE;
}
unsafe extern "C" {
    #[link_name = "sk_CONF_VALUE_num__extern"]
    pub fn sk_CONF_VALUE_num(sk: *const stack_st_CONF_VALUE) -> usize;
}
unsafe extern "C" {
    #[link_name = "sk_CONF_VALUE_zero__extern"]
    pub fn sk_CONF_VALUE_zero(sk: *mut stack_st_CONF_VALUE);
}
unsafe extern "C" {
    #[link_name = "sk_CONF_VALUE_value__extern"]
    pub fn sk_CONF_VALUE_value(sk: *const stack_st_CONF_VALUE, i: usize) -> *mut CONF_VALUE;
}
unsafe extern "C" {
    #[link_name = "sk_CONF_VALUE_set__extern"]
    pub fn sk_CONF_VALUE_set(
        sk: *mut stack_st_CONF_VALUE,
        i: usize,
        p: *mut CONF_VALUE,
    ) -> *mut CONF_VALUE;
}
unsafe extern "C" {
    #[link_name = "sk_CONF_VALUE_free__extern"]
    pub fn sk_CONF_VALUE_free(sk: *mut stack_st_CONF_VALUE);
}
unsafe extern "C" {
    #[link_name = "sk_CONF_VALUE_pop_free__extern"]
    pub fn sk_CONF_VALUE_pop_free(sk: *mut stack_st_CONF_VALUE, free_func: sk_CONF_VALUE_free_func);
}
unsafe extern "C" {
    #[link_name = "sk_CONF_VALUE_insert__extern"]
    pub fn sk_CONF_VALUE_insert(
        sk: *mut stack_st_CONF_VALUE,
        p: *mut CONF_VALUE,
        where_: usize,
    ) -> usize;
}
unsafe extern "C" {
    #[link_name = "sk_CONF_VALUE_delete__extern"]
    pub fn sk_CONF_VALUE_delete(sk: *mut stack_st_CONF_VALUE, where_: usize) -> *mut CONF_VALUE;
}
unsafe extern "C" {
    #[link_name = "sk_CONF_VALUE_delete_ptr__extern"]
    pub fn sk_CONF_VALUE_delete_ptr(
        sk: *mut stack_st_CONF_VALUE,
        p: *const CONF_VALUE,
    ) -> *mut CONF_VALUE;
}
unsafe extern "C" {
    #[link_name = "sk_CONF_VALUE_delete_if__extern"]
    pub fn sk_CONF_VALUE_delete_if(
        sk: *mut stack_st_CONF_VALUE,
        func: sk_CONF_VALUE_delete_if_func,
        data: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    #[link_name = "sk_CONF_VALUE_find__extern"]
    pub fn sk_CONF_VALUE_find(
        sk: *const stack_st_CONF_VALUE,
        out_index: *mut usize,
        p: *const CONF_VALUE,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_CONF_VALUE_shift__extern"]
    pub fn sk_CONF_VALUE_shift(sk: *mut stack_st_CONF_VALUE) -> *mut CONF_VALUE;
}
unsafe extern "C" {
    #[link_name = "sk_CONF_VALUE_push__extern"]
    pub fn sk_CONF_VALUE_push(sk: *mut stack_st_CONF_VALUE, p: *mut CONF_VALUE) -> usize;
}
unsafe extern "C" {
    #[link_name = "sk_CONF_VALUE_pop__extern"]
    pub fn sk_CONF_VALUE_pop(sk: *mut stack_st_CONF_VALUE) -> *mut CONF_VALUE;
}
unsafe extern "C" {
    #[link_name = "sk_CONF_VALUE_dup__extern"]
    pub fn sk_CONF_VALUE_dup(sk: *const stack_st_CONF_VALUE) -> *mut stack_st_CONF_VALUE;
}
unsafe extern "C" {
    #[link_name = "sk_CONF_VALUE_sort__extern"]
    pub fn sk_CONF_VALUE_sort(sk: *mut stack_st_CONF_VALUE);
}
unsafe extern "C" {
    #[link_name = "sk_CONF_VALUE_sort_and_dedup__extern"]
    pub fn sk_CONF_VALUE_sort_and_dedup(
        sk: *mut stack_st_CONF_VALUE,
        free_func: sk_CONF_VALUE_free_func,
    );
}
unsafe extern "C" {
    #[link_name = "sk_CONF_VALUE_is_sorted__extern"]
    pub fn sk_CONF_VALUE_is_sorted(sk: *const stack_st_CONF_VALUE) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_CONF_VALUE_set_cmp_func__extern"]
    pub fn sk_CONF_VALUE_set_cmp_func(
        sk: *mut stack_st_CONF_VALUE,
        comp: sk_CONF_VALUE_cmp_func,
    ) -> sk_CONF_VALUE_cmp_func;
}
unsafe extern "C" {
    #[link_name = "sk_CONF_VALUE_deep_copy__extern"]
    pub fn sk_CONF_VALUE_deep_copy(
        sk: *const stack_st_CONF_VALUE,
        copy_func: sk_CONF_VALUE_copy_func,
        free_func: sk_CONF_VALUE_free_func,
    ) -> *mut stack_st_CONF_VALUE;
}
unsafe extern "C" {
    /// NCONF_new returns a fresh, empty `CONF`, or NULL on error. The `method`
    /// argument must be NULL.
    pub fn NCONF_new(method: *mut ::core::ffi::c_void) -> *mut CONF;
}
unsafe extern "C" {
    /// NCONF_free frees all the data owned by `conf` and then `conf` itself.
    pub fn NCONF_free(conf: *mut CONF);
}
unsafe extern "C" {
    /// NCONF_load parses the file named `filename` and adds the values found to
    /// `conf`. It returns one on success and zero on error. In the event of an
    /// error, if `out_error_line` is not NULL, `*out_error_line` is set to the
    /// number of the line that contained the error.
    pub fn NCONF_load(
        conf: *mut CONF,
        filename: *const ::core::ffi::c_char,
        out_error_line: *mut ::core::ffi::c_long,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// NCONF_load_bio acts like `NCONF_load` but reads from `bio` rather than from
    /// a named file.
    pub fn NCONF_load_bio(
        conf: *mut CONF,
        bio: *mut BIO,
        out_error_line: *mut ::core::ffi::c_long,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// NCONF_get_section returns a stack of values for a given section in `conf`.
    /// If `section` is NULL, the default section is returned. It returns NULL on
    /// error.
    pub fn NCONF_get_section(
        conf: *const CONF,
        section: *const ::core::ffi::c_char,
    ) -> *const stack_st_CONF_VALUE;
}
unsafe extern "C" {
    /// NCONF_get_string returns the value of the key `name`, in section `section`.
    /// The `section` argument may be NULL to indicate the default section. It
    /// returns the value or NULL on error.
    pub fn NCONF_get_string(
        conf: *const CONF,
        section: *const ::core::ffi::c_char,
        name: *const ::core::ffi::c_char,
    ) -> *const ::core::ffi::c_char;
}
unsafe extern "C" {
    /// CONF_modules_load_file returns one. BoringSSL is defined to have no config
    /// file options, thus loading from `filename` always succeeds by doing nothing.
    pub fn CONF_modules_load_file(
        filename: *const ::core::ffi::c_char,
        appname: *const ::core::ffi::c_char,
        flags: ::core::ffi::c_ulong,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CONF_modules_unload does nothing.
    pub fn CONF_modules_unload(all: ::core::ffi::c_int);
}
unsafe extern "C" {
    /// CONF_modules_free does nothing.
    pub fn CONF_modules_free();
}
unsafe extern "C" {
    /// OPENSSL_config does nothing.
    pub fn OPENSSL_config(config_name: *const ::core::ffi::c_char);
}
unsafe extern "C" {
    /// OPENSSL_no_config does nothing.
    pub fn OPENSSL_no_config();
}
unsafe extern "C" {
    /// SHA224_Init initialises `sha` and returns 1.
    pub fn SHA224_Init(sha: *mut SHA256_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SHA224_Update adds `len` bytes from `data` to `sha` and returns 1.
    pub fn SHA224_Update(
        sha: *mut SHA256_CTX,
        data: *const ::core::ffi::c_void,
        len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SHA224_Final adds the final padding to `sha` and writes the resulting digest
    /// to `out`, which must have at least `SHA224_DIGEST_LENGTH` bytes of space. It
    /// returns 1.
    pub fn SHA224_Final(out: *mut u8, sha: *mut SHA256_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SHA224 writes the digest of `len` bytes from `data` to `out` and returns
    /// `out`. There must be at least `SHA224_DIGEST_LENGTH` bytes of space in
    /// `out`.
    pub fn SHA224(data: *const u8, len: usize, out: *mut u8) -> *mut u8;
}
unsafe extern "C" {
    /// SHA256_Init initialises `sha` and returns 1.
    pub fn SHA256_Init(sha: *mut SHA256_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SHA256_Update adds `len` bytes from `data` to `sha` and returns 1.
    pub fn SHA256_Update(
        sha: *mut SHA256_CTX,
        data: *const ::core::ffi::c_void,
        len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SHA256_Final adds the final padding to `sha` and writes the resulting digest
    /// to `out`, which must have at least `SHA256_DIGEST_LENGTH` bytes of space. It
    /// returns one on success and zero on programmer error.
    pub fn SHA256_Final(out: *mut u8, sha: *mut SHA256_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SHA256 writes the digest of `len` bytes from `data` to `out` and returns
    /// `out`. There must be at least `SHA256_DIGEST_LENGTH` bytes of space in
    /// `out`.
    pub fn SHA256(data: *const u8, len: usize, out: *mut u8) -> *mut u8;
}
unsafe extern "C" {
    /// SHA256_Transform is a low-level function that performs a single, SHA-256
    /// block transformation using the state from `sha` and `SHA256_CBLOCK` bytes
    /// from `block`.
    pub fn SHA256_Transform(sha: *mut SHA256_CTX, block: *const u8);
}
unsafe extern "C" {
    /// SHA256_TransformBlocks is a low-level function that takes `num_blocks` *
    /// `SHA256_CBLOCK` bytes of data and performs SHA-256 transforms on it to update
    /// `state`. You should not use this function unless you are implementing a
    /// derivative of SHA-256.
    pub fn SHA256_TransformBlocks(state: *mut u32, data: *const u8, num_blocks: usize);
}
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct sha256_state_st {
    pub h: [u32; 8usize],
    pub Nl: u32,
    pub Nh: u32,
    pub data: [u8; 64usize],
    pub num: ::core::ffi::c_uint,
    pub md_len: ::core::ffi::c_uint,
}
unsafe extern "C" {
    /// SHA384_Init initialises `sha` and returns 1.
    pub fn SHA384_Init(sha: *mut SHA512_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SHA384_Update adds `len` bytes from `data` to `sha` and returns 1.
    pub fn SHA384_Update(
        sha: *mut SHA512_CTX,
        data: *const ::core::ffi::c_void,
        len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SHA384_Final adds the final padding to `sha` and writes the resulting digest
    /// to `out`, which must have at least `SHA384_DIGEST_LENGTH` bytes of space. It
    /// returns one on success and zero on programmer error.
    pub fn SHA384_Final(out: *mut u8, sha: *mut SHA512_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SHA384 writes the digest of `len` bytes from `data` to `out` and returns
    /// `out`. There must be at least `SHA384_DIGEST_LENGTH` bytes of space in
    /// `out`.
    pub fn SHA384(data: *const u8, len: usize, out: *mut u8) -> *mut u8;
}
unsafe extern "C" {
    /// SHA512_Init initialises `sha` and returns 1.
    pub fn SHA512_Init(sha: *mut SHA512_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SHA512_Update adds `len` bytes from `data` to `sha` and returns 1.
    pub fn SHA512_Update(
        sha: *mut SHA512_CTX,
        data: *const ::core::ffi::c_void,
        len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SHA512_Final adds the final padding to `sha` and writes the resulting digest
    /// to `out`, which must have at least `SHA512_DIGEST_LENGTH` bytes of space. It
    /// returns one on success and zero on programmer error.
    pub fn SHA512_Final(out: *mut u8, sha: *mut SHA512_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SHA512 writes the digest of `len` bytes from `data` to `out` and returns
    /// `out`. There must be at least `SHA512_DIGEST_LENGTH` bytes of space in
    /// `out`.
    pub fn SHA512(data: *const u8, len: usize, out: *mut u8) -> *mut u8;
}
unsafe extern "C" {
    /// SHA512_Transform is a low-level function that performs a single, SHA-512
    /// block transformation using the state from `sha` and `SHA512_CBLOCK` bytes
    /// from `block`.
    pub fn SHA512_Transform(sha: *mut SHA512_CTX, block: *const u8);
}
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct sha512_state_st {
    pub h: [u64; 8usize],
    pub num: u16,
    pub md_len: u16,
    pub bytes_so_far_high: u32,
    pub bytes_so_far_low: u64,
    pub p: [u8; 128usize],
}
unsafe extern "C" {
    /// SHA512_256_Init initialises `sha` and returns 1.
    pub fn SHA512_256_Init(sha: *mut SHA512_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SHA512_256_Update adds `len` bytes from `data` to `sha` and returns 1.
    pub fn SHA512_256_Update(
        sha: *mut SHA512_CTX,
        data: *const ::core::ffi::c_void,
        len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SHA512_256_Final adds the final padding to `sha` and writes the resulting
    /// digest to `out`, which must have at least `SHA512_256_DIGEST_LENGTH` bytes of
    /// space. It returns one on success and zero on programmer error.
    pub fn SHA512_256_Final(out: *mut u8, sha: *mut SHA512_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SHA512_256 writes the digest of `len` bytes from `data` to `out` and returns
    /// `out`. There must be at least `SHA512_256_DIGEST_LENGTH` bytes of space in
    /// `out`.
    pub fn SHA512_256(data: *const u8, len: usize, out: *mut u8) -> *mut u8;
}
unsafe extern "C" {
    /// SHA1_Init initialises `sha` and returns one.
    pub fn SHA1_Init(sha: *mut SHA_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SHA1_Update adds `len` bytes from `data` to `sha` and returns one.
    pub fn SHA1_Update(
        sha: *mut SHA_CTX,
        data: *const ::core::ffi::c_void,
        len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SHA1_Final adds the final padding to `sha` and writes the resulting digest to
    /// `out`, which must have at least `SHA_DIGEST_LENGTH` bytes of space. It
    /// returns one.
    pub fn SHA1_Final(out: *mut u8, sha: *mut SHA_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SHA1 writes the digest of `len` bytes from `data` to `out` and returns
    /// `out`. There must be at least `SHA_DIGEST_LENGTH` bytes of space in
    /// `out`.
    pub fn SHA1(data: *const u8, len: usize, out: *mut u8) -> *mut u8;
}
unsafe extern "C" {
    /// SHA1_Transform is a low-level function that performs a single, SHA-1 block
    /// transformation using the state from `sha` and `SHA_CBLOCK` bytes from
    /// `block`.
    pub fn SHA1_Transform(sha: *mut SHA_CTX, block: *const u8);
}
#[repr(C)]
#[derive(Copy, Clone)]
pub struct sha_state_st {
    pub __bindgen_anon_1: sha_state_st__bindgen_ty_1,
    pub Nl: u32,
    pub Nh: u32,
    pub data: [u8; 64usize],
    pub num: ::core::ffi::c_uint,
}
/// wpa_supplicant accesses `h0`..`h4` so we must support those names for
/// compatibility with it until it can be updated. Anonymous unions are only
/// standard in C11, so disable this workaround in C++.
#[repr(C)]
#[derive(Copy, Clone)]
pub union sha_state_st__bindgen_ty_1 {
    pub h: [u32; 5usize],
    pub __bindgen_anon_1: sha_state_st__bindgen_ty_1__bindgen_ty_1,
}
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct sha_state_st__bindgen_ty_1__bindgen_ty_1 {
    pub h0: u32,
    pub h1: u32,
    pub h2: u32,
    pub h3: u32,
    pub h4: u32,
}
unsafe extern "C" {
    /// CRYPTO_fips_186_2_prf derives `out_len` bytes from `xkey` using the PRF
    /// defined in FIPS 186-2, Appendix 3.1, with change notice 1 applied. The b
    /// parameter is 160 and seed, XKEY, is also 160 bits. The optional XSEED user
    /// input is all zeros.
    ///
    /// The PRF generates a sequence of 320-bit numbers. Each number is encoded as a
    /// 40-byte string in big-endian and then concatenated to form `out`. If
    /// `out_len` is not a multiple of 40, the result is truncated. This matches the
    /// construction used in Section 7 of RFC 4186 and Section 7 of RFC 4187.
    ///
    /// This PRF is based on SHA-1, a weak hash function, and should not be used
    /// in new protocols. It is provided for compatibility with some legacy EAP
    /// methods.
    pub fn CRYPTO_fips_186_2_prf(out: *mut u8, out_len: usize, xkey: *const u8);
}
unsafe extern "C" {
    /// OPENSSL_malloc is similar to a regular `malloc`, but allocates additional
    /// private data. The resulting pointer must be freed with `OPENSSL_free`. In
    /// the case of a malloc failure, prior to returning NULL `OPENSSL_malloc` will
    /// push `ERR_R_MALLOC_FAILURE` onto the openssl error stack.
    pub fn OPENSSL_malloc(size: usize) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    /// OPENSSL_zalloc behaves like `OPENSSL_malloc` except it also initializes the
    /// resulting memory to zero.
    pub fn OPENSSL_zalloc(size: usize) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    /// OPENSSL_calloc is similar to a regular `calloc`, but allocates data with
    /// `OPENSSL_malloc`. On overflow, it will push `ERR_R_OVERFLOW` onto the error
    /// queue.
    pub fn OPENSSL_calloc(num: usize, size: usize) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    /// OPENSSL_realloc returns a pointer to a buffer of `new_size` bytes that
    /// contains the contents of `ptr`. Unlike `realloc`, a new buffer is always
    /// allocated and the data at `ptr` is always wiped and freed. Memory is
    /// allocated with `OPENSSL_malloc` and must be freed with `OPENSSL_free`.
    pub fn OPENSSL_realloc(
        ptr: *mut ::core::ffi::c_void,
        new_size: usize,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    /// OPENSSL_free does nothing if `ptr` is NULL. Otherwise it zeros out the
    /// memory allocated at `ptr` and frees it along with the private data.
    /// It must only be used on `ptr` values obtained from `OPENSSL_malloc`
    pub fn OPENSSL_free(ptr: *mut ::core::ffi::c_void);
}
unsafe extern "C" {
    /// OPENSSL_cleanse zeros out `len` bytes of memory at `ptr`. This is similar to
    /// `memset_s` from C11.
    pub fn OPENSSL_cleanse(ptr: *mut ::core::ffi::c_void, len: usize);
}
unsafe extern "C" {
    /// CRYPTO_memcmp returns zero iff the `len` bytes at `a` and `b` are equal. It
    /// takes an amount of time dependent on `len`, but independent of the contents
    /// of `a` and `b`. Unlike memcmp, it cannot be used to put elements into a
    /// defined order as the return value when a != b is undefined, other than to be
    /// non-zero.
    pub fn CRYPTO_memcmp(
        a: *const ::core::ffi::c_void,
        b: *const ::core::ffi::c_void,
        len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// OPENSSL_hash32 implements the 32 bit, FNV-1a hash.
    pub fn OPENSSL_hash32(ptr: *const ::core::ffi::c_void, len: usize) -> u32;
}
unsafe extern "C" {
    /// OPENSSL_strhash calls `OPENSSL_hash32` on the NUL-terminated string `s`.
    pub fn OPENSSL_strhash(s: *const ::core::ffi::c_char) -> u32;
}
unsafe extern "C" {
    /// OPENSSL_strdup has the same behaviour as strdup(3).
    pub fn OPENSSL_strdup(s: *const ::core::ffi::c_char) -> *mut ::core::ffi::c_char;
}
unsafe extern "C" {
    /// OPENSSL_strnlen has the same behaviour as strnlen(3).
    pub fn OPENSSL_strnlen(s: *const ::core::ffi::c_char, len: usize) -> usize;
}
unsafe extern "C" {
    /// OPENSSL_isalpha is a locale-independent, ASCII-only version of isalpha(3), It
    /// only recognizes 'a' through 'z' and 'A' through 'Z' as alphabetic.
    pub fn OPENSSL_isalpha(c: ::core::ffi::c_int) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// OPENSSL_isdigit is a locale-independent, ASCII-only version of isdigit(3), It
    /// only recognizes '0' through '9' as digits.
    pub fn OPENSSL_isdigit(c: ::core::ffi::c_int) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// OPENSSL_isxdigit is a locale-independent, ASCII-only version of isxdigit(3),
    /// It only recognizes '0' through '9', 'a' through 'f', and 'A through 'F' as
    /// digits.
    pub fn OPENSSL_isxdigit(c: ::core::ffi::c_int) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// OPENSSL_fromxdigit returns one if `c` is a hexadecimal digit as recognized
    /// by OPENSSL_isxdigit, and sets `out` to the corresponding value. Otherwise
    /// zero is returned.
    pub fn OPENSSL_fromxdigit(out: *mut u8, c: ::core::ffi::c_int) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// OPENSSL_isalnum is a locale-independent, ASCII-only version of isalnum(3), It
    /// only recognizes what `OPENSSL_isalpha` and `OPENSSL_isdigit` recognize.
    pub fn OPENSSL_isalnum(c: ::core::ffi::c_int) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// OPENSSL_tolower is a locale-independent, ASCII-only version of tolower(3). It
    /// only lowercases ASCII values. Other values are returned as-is.
    pub fn OPENSSL_tolower(c: ::core::ffi::c_int) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// OPENSSL_isspace is a locale-independent, ASCII-only version of isspace(3). It
    /// only recognizes '\t', '\n', '\v', '\f', '\r', and ' '.
    pub fn OPENSSL_isspace(c: ::core::ffi::c_int) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// OPENSSL_strcasecmp is a locale-independent, ASCII-only version of
    /// strcasecmp(3).
    pub fn OPENSSL_strcasecmp(
        a: *const ::core::ffi::c_char,
        b: *const ::core::ffi::c_char,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// OPENSSL_strncasecmp is a locale-independent, ASCII-only version of
    /// strncasecmp(3).
    pub fn OPENSSL_strncasecmp(
        a: *const ::core::ffi::c_char,
        b: *const ::core::ffi::c_char,
        n: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_snprintf has the same behavior as snprintf(3).
    pub fn BIO_snprintf(
        buf: *mut ::core::ffi::c_char,
        n: usize,
        format: *const ::core::ffi::c_char,
        ...
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// OPENSSL_asprintf has the same behavior as asprintf(3), except that
    /// memory allocated in a returned string must be freed with `OPENSSL_free`.
    pub fn OPENSSL_asprintf(
        str_: *mut *mut ::core::ffi::c_char,
        format: *const ::core::ffi::c_char,
        ...
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// OPENSSL_strndup returns an allocated, duplicate of `str`, which is, at most,
    /// `size` bytes. The result is always NUL terminated. The memory allocated
    /// must be freed with `OPENSSL_free`.
    pub fn OPENSSL_strndup(
        str_: *const ::core::ffi::c_char,
        size: usize,
    ) -> *mut ::core::ffi::c_char;
}
unsafe extern "C" {
    /// OPENSSL_memdup returns an allocated, duplicate of `size` bytes from `data` or
    /// NULL on allocation failure. The memory allocated must be freed with
    /// `OPENSSL_free`.
    pub fn OPENSSL_memdup(
        data: *const ::core::ffi::c_void,
        size: usize,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    /// OPENSSL_strlcpy acts like strlcpy(3).
    pub fn OPENSSL_strlcpy(
        dst: *mut ::core::ffi::c_char,
        src: *const ::core::ffi::c_char,
        dst_size: usize,
    ) -> usize;
}
unsafe extern "C" {
    /// OPENSSL_strlcat acts like strlcat(3).
    pub fn OPENSSL_strlcat(
        dst: *mut ::core::ffi::c_char,
        src: *const ::core::ffi::c_char,
        dst_size: usize,
    ) -> usize;
}
unsafe extern "C" {
    /// CRYPTO_malloc calls `OPENSSL_malloc`. `file` and `line` are ignored.
    pub fn CRYPTO_malloc(
        size: usize,
        file: *const ::core::ffi::c_char,
        line: ::core::ffi::c_int,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    /// CRYPTO_realloc calls `OPENSSL_realloc`. `file` and `line` are ignored.
    pub fn CRYPTO_realloc(
        ptr: *mut ::core::ffi::c_void,
        new_size: usize,
        file: *const ::core::ffi::c_char,
        line: ::core::ffi::c_int,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    /// CRYPTO_free calls `OPENSSL_free`. `file` and `line` are ignored.
    pub fn CRYPTO_free(
        ptr: *mut ::core::ffi::c_void,
        file: *const ::core::ffi::c_char,
        line: ::core::ffi::c_int,
    );
}
unsafe extern "C" {
    /// OPENSSL_clear_free calls `OPENSSL_free`. BoringSSL automatically clears all
    /// allocations on free, but we define `OPENSSL_clear_free` for compatibility.
    pub fn OPENSSL_clear_free(ptr: *mut ::core::ffi::c_void, len: usize);
}
unsafe extern "C" {
    /// CRYPTO_secure_malloc_init returns zero.
    pub fn CRYPTO_secure_malloc_init(size: usize, min_size: usize) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CRYPTO_secure_malloc_initialized returns zero.
    pub fn CRYPTO_secure_malloc_initialized() -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CRYPTO_secure_used returns zero.
    pub fn CRYPTO_secure_used() -> usize;
}
unsafe extern "C" {
    /// OPENSSL_secure_malloc calls `OPENSSL_malloc`.
    pub fn OPENSSL_secure_malloc(size: usize) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    /// OPENSSL_secure_clear_free calls `OPENSSL_clear_free`.
    pub fn OPENSSL_secure_clear_free(ptr: *mut ::core::ffi::c_void, len: usize);
}
unsafe extern "C" {
    /// CRYPTO_num_locks returns one. (This is non-zero that callers who allocate
    /// sizeof(lock) times this value don't get zero and then fail because malloc(0)
    /// returned NULL.)
    pub fn CRYPTO_num_locks() -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CRYPTO_set_locking_callback does nothing.
    pub fn CRYPTO_set_locking_callback(
        func: ::core::option::Option<
            unsafe extern "C" fn(
                mode: ::core::ffi::c_int,
                lock_num: ::core::ffi::c_int,
                file: *const ::core::ffi::c_char,
                line: ::core::ffi::c_int,
            ),
        >,
    );
}
unsafe extern "C" {
    /// CRYPTO_set_add_lock_callback does nothing.
    pub fn CRYPTO_set_add_lock_callback(
        func: ::core::option::Option<
            unsafe extern "C" fn(
                num: *mut ::core::ffi::c_int,
                amount: ::core::ffi::c_int,
                lock_num: ::core::ffi::c_int,
                file: *const ::core::ffi::c_char,
                line: ::core::ffi::c_int,
            ) -> ::core::ffi::c_int,
        >,
    );
}
unsafe extern "C" {
    /// CRYPTO_get_locking_callback returns NULL.
    pub fn CRYPTO_get_locking_callback() -> ::core::option::Option<
        unsafe extern "C" fn(
            arg1: ::core::ffi::c_int,
            arg2: ::core::ffi::c_int,
            arg3: *const ::core::ffi::c_char,
            arg4: ::core::ffi::c_int,
        ),
    >;
}
unsafe extern "C" {
    /// CRYPTO_get_lock_name returns a fixed, dummy string.
    pub fn CRYPTO_get_lock_name(lock_num: ::core::ffi::c_int) -> *const ::core::ffi::c_char;
}
unsafe extern "C" {
    /// CRYPTO_THREADID_set_callback returns one.
    pub fn CRYPTO_THREADID_set_callback(
        threadid_func: ::core::option::Option<unsafe extern "C" fn(threadid: *mut CRYPTO_THREADID)>,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CRYPTO_THREADID_set_numeric does nothing.
    pub fn CRYPTO_THREADID_set_numeric(id: *mut CRYPTO_THREADID, val: ::core::ffi::c_ulong);
}
unsafe extern "C" {
    /// CRYPTO_THREADID_set_pointer does nothing.
    pub fn CRYPTO_THREADID_set_pointer(id: *mut CRYPTO_THREADID, ptr: *mut ::core::ffi::c_void);
}
unsafe extern "C" {
    /// CRYPTO_THREADID_current does nothing.
    pub fn CRYPTO_THREADID_current(id: *mut CRYPTO_THREADID);
}
unsafe extern "C" {
    /// CRYPTO_set_id_callback does nothing.
    pub fn CRYPTO_set_id_callback(
        func: ::core::option::Option<unsafe extern "C" fn() -> ::core::ffi::c_ulong>,
    );
}
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct CRYPTO_dynlock {
    pub references: ::core::ffi::c_int,
    pub data: *mut CRYPTO_dynlock_value,
}
unsafe extern "C" {
    /// CRYPTO_set_dynlock_create_callback does nothing.
    pub fn CRYPTO_set_dynlock_create_callback(
        dyn_create_function: ::core::option::Option<
            unsafe extern "C" fn(
                file: *const ::core::ffi::c_char,
                line: ::core::ffi::c_int,
            ) -> *mut CRYPTO_dynlock_value,
        >,
    );
}
unsafe extern "C" {
    /// CRYPTO_set_dynlock_lock_callback does nothing.
    pub fn CRYPTO_set_dynlock_lock_callback(
        dyn_lock_function: ::core::option::Option<
            unsafe extern "C" fn(
                mode: ::core::ffi::c_int,
                l: *mut CRYPTO_dynlock_value,
                file: *const ::core::ffi::c_char,
                line: ::core::ffi::c_int,
            ),
        >,
    );
}
unsafe extern "C" {
    /// CRYPTO_set_dynlock_destroy_callback does nothing.
    pub fn CRYPTO_set_dynlock_destroy_callback(
        dyn_destroy_function: ::core::option::Option<
            unsafe extern "C" fn(
                l: *mut CRYPTO_dynlock_value,
                file: *const ::core::ffi::c_char,
                line: ::core::ffi::c_int,
            ),
        >,
    );
}
unsafe extern "C" {
    /// CRYPTO_get_dynlock_create_callback returns NULL.
    pub fn CRYPTO_get_dynlock_create_callback() -> ::core::option::Option<
        unsafe extern "C" fn(
            arg1: *const ::core::ffi::c_char,
            arg2: ::core::ffi::c_int,
        ) -> *mut CRYPTO_dynlock_value,
    >;
}
unsafe extern "C" {
    /// CRYPTO_get_dynlock_lock_callback returns NULL.
    pub fn CRYPTO_get_dynlock_lock_callback() -> ::core::option::Option<
        unsafe extern "C" fn(
            arg1: ::core::ffi::c_int,
            arg2: *mut CRYPTO_dynlock_value,
            arg3: *const ::core::ffi::c_char,
            arg4: ::core::ffi::c_int,
        ),
    >;
}
unsafe extern "C" {
    /// CRYPTO_get_dynlock_destroy_callback returns NULL.
    pub fn CRYPTO_get_dynlock_destroy_callback() -> ::core::option::Option<
        unsafe extern "C" fn(
            arg1: *mut CRYPTO_dynlock_value,
            arg2: *const ::core::ffi::c_char,
            arg3: ::core::ffi::c_int,
        ),
    >;
}
unsafe extern "C" {
    /// CRYPTO_is_confidential_build returns one if the linked version of BoringSSL
    /// has been built with the BORINGSSL_CONFIDENTIAL define and zero otherwise.
    ///
    /// This is used by some consumers to identify whether they are using an
    /// internal version of BoringSSL.
    pub fn CRYPTO_is_confidential_build() -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CRYPTO_has_asm returns one unless BoringSSL was built with OPENSSL_NO_ASM,
    /// in which case it returns zero.
    pub fn CRYPTO_has_asm() -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BORINGSSL_self_test triggers most of the FIPS KAT-based self tests. It
    /// returns one on success and zero on error. It currently skips the SLH-DSA
    /// tests, which take a really long time to run.
    pub fn BORINGSSL_self_test() -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BORINGSSL_self_test_all triggers all of the FIPS KAT-based self tests. This
    /// is the 'self-test' entry point required by FIPS 140. It returns one on
    /// success and zero on error. This test will take a very long time to run. You
    /// probably do not want to run this in a resource or time constrained test.
    pub fn BORINGSSL_self_test_all() -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BORINGSSL_integrity_test triggers the module's integrity test where the code
    /// and data of the module is matched against a hash injected at build time. It
    /// returns one on success or zero if there's a mismatch. This function only
    /// exists if the module was built in FIPS mode without ASAN.
    pub fn BORINGSSL_integrity_test() -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CRYPTO_pre_sandbox_init initializes the crypto library, pre-acquiring some
    /// unusual resources to aid running in sandboxed environments. It is safe to
    /// call this function multiple times and concurrently from multiple threads.
    ///
    /// For more details on using BoringSSL in a sandboxed environment, see
    /// SANDBOXING.md in the source tree.
    pub fn CRYPTO_pre_sandbox_init();
}
unsafe extern "C" {
    /// FIPS_mode returns zero unless BoringSSL is built with BORINGSSL_FIPS, in
    /// which case it returns one.
    pub fn FIPS_mode() -> ::core::ffi::c_int;
}
pub const fips_counter_t_fips_counter_evp_aes_128_gcm: fips_counter_t = 0;
pub const fips_counter_t_fips_counter_evp_aes_256_gcm: fips_counter_t = 1;
pub const fips_counter_t_fips_counter_evp_aes_128_ctr: fips_counter_t = 2;
pub const fips_counter_t_fips_counter_evp_aes_256_ctr: fips_counter_t = 3;
pub const fips_counter_t_fips_counter_max: fips_counter_t = 3;
/// fips_counter_t denotes specific APIs/algorithms. A counter is maintained for
/// each in FIPS mode so that tests can be written to assert that the expected,
/// FIPS functions are being called by a certain piece of code.
pub type fips_counter_t = ::core::ffi::c_uint;
unsafe extern "C" {
    /// FIPS_read_counter returns a counter of the number of times the specific
    /// function denoted by `counter` has been used. This always returns zero unless
    /// BoringSSL was built with BORINGSSL_FIPS_COUNTERS defined.
    pub fn FIPS_read_counter(counter: fips_counter_t) -> usize;
}
unsafe extern "C" {
    /// OpenSSL_version is a compatibility function that returns the string
    /// "BoringSSL" if `which` is `OPENSSL_VERSION` and placeholder strings
    /// otherwise.
    pub fn OpenSSL_version(which: ::core::ffi::c_int) -> *const ::core::ffi::c_char;
}
unsafe extern "C" {
    /// SSLeay_version calls `OpenSSL_version`.
    pub fn SSLeay_version(which: ::core::ffi::c_int) -> *const ::core::ffi::c_char;
}
unsafe extern "C" {
    /// SSLeay is a compatibility function that returns OPENSSL_VERSION_NUMBER from
    /// base.h.
    pub fn SSLeay() -> ::core::ffi::c_ulong;
}
unsafe extern "C" {
    /// OpenSSL_version_num is a compatibility function that returns
    /// OPENSSL_VERSION_NUMBER from base.h.
    pub fn OpenSSL_version_num() -> ::core::ffi::c_ulong;
}
unsafe extern "C" {
    /// CRYPTO_malloc_init returns one.
    pub fn CRYPTO_malloc_init() -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// OPENSSL_malloc_init returns one.
    pub fn OPENSSL_malloc_init() -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ENGINE_load_builtin_engines does nothing.
    pub fn ENGINE_load_builtin_engines();
}
unsafe extern "C" {
    /// ENGINE_register_all_complete returns one.
    pub fn ENGINE_register_all_complete() -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ENGINE_cleanup does nothing.
    pub fn ENGINE_cleanup();
}
unsafe extern "C" {
    /// OPENSSL_load_builtin_modules does nothing.
    pub fn OPENSSL_load_builtin_modules();
}
unsafe extern "C" {
    /// OPENSSL_init_crypto returns one.
    pub fn OPENSSL_init_crypto(
        opts: u64,
        settings: *const OPENSSL_INIT_SETTINGS,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// OPENSSL_cleanup does nothing.
    pub fn OPENSSL_cleanup();
}
unsafe extern "C" {
    /// FIPS_mode_set returns one if `on` matches whether BoringSSL was built with
    /// `BORINGSSL_FIPS` and zero otherwise.
    pub fn FIPS_mode_set(on: ::core::ffi::c_int) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// FIPS_module_name returns the name of the FIPS module.
    pub fn FIPS_module_name() -> *const ::core::ffi::c_char;
}
unsafe extern "C" {
    /// FIPS_module_hash returns the 32-byte hash of the FIPS module.
    pub fn FIPS_module_hash() -> *const u8;
}
unsafe extern "C" {
    /// FIPS_version returns the version of the FIPS module, or zero if the build
    /// isn't exactly at a verified version. The version, expressed in base 10, will
    /// be a date in the form yyyymmdd.
    ///
    /// (This format exceeds a `uint32_t` in the year 4294.)
    pub fn FIPS_version() -> u32;
}
unsafe extern "C" {
    /// FIPS_query_algorithm_status returns one if `algorithm` is FIPS validated in
    /// the current BoringSSL and zero otherwise.
    pub fn FIPS_query_algorithm_status(algorithm: *const ::core::ffi::c_char)
        -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CRYPTO_library_init does nothing. Historically, it was needed in some build
    /// configurations to initialization the library. This is no longer necessary.
    pub fn CRYPTO_library_init();
}
unsafe extern "C" {
    /// CTR_DRBG_new returns an initialized `CTR_DRBG_STATE`, or NULL if either
    /// allocation failed or if `personalization_len` is invalid. This DRBG will not
    /// use a derivation function.
    pub fn CTR_DRBG_new(
        entropy: *const u8,
        personalization: *const u8,
        personalization_len: usize,
    ) -> *mut CTR_DRBG_STATE;
}
unsafe extern "C" {
    /// CTR_DRBG_new_df returns an initialized `CTR_DRBG_STATE`, or NULL if either
    /// allocation failed or if an argument is invalid. This DRBG will use a
    /// derivation function.
    pub fn CTR_DRBG_new_df(
        entropy: *const u8,
        entropy_len: usize,
        nonce: *const u8,
        personalization: *const u8,
        personalization_len: usize,
    ) -> *mut CTR_DRBG_STATE;
}
unsafe extern "C" {
    /// CTR_DRBG_free frees `state` if non-NULL, or else does nothing.
    pub fn CTR_DRBG_free(state: *mut CTR_DRBG_STATE);
}
unsafe extern "C" {
    /// CTR_DRBG_reseed reseeds `drbg` given `CTR_DRBG_ENTROPY_LEN` bytes of entropy
    /// in `entropy` and, optionally, up to `CTR_DRBG_SEED_LEN` bytes of
    /// additional data. It returns one on success or zero on error.
    pub fn CTR_DRBG_reseed(
        drbg: *mut CTR_DRBG_STATE,
        entropy: *const u8,
        additional_data: *const u8,
        additional_data_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CTR_DRBG_reseed_ex acts like `CTR_DRBG_reseed` but with variable-length
    /// entropy input, up to `CTR_DRBG_MAX_ENTROPY_LEN`.
    pub fn CTR_DRBG_reseed_ex(
        drbg: *mut CTR_DRBG_STATE,
        entropy: *const u8,
        entropy_len: usize,
        additional_data: *const u8,
        additional_data_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CTR_DRBG_generate processes to up `CTR_DRBG_ENTROPY_LEN` bytes of additional
    /// data (if any) and then writes `out_len` random bytes to `out`, where
    /// `out_len` <= `CTR_DRBG_MAX_GENERATE_LENGTH`. It returns one on success or
    /// zero on error.
    pub fn CTR_DRBG_generate(
        drbg: *mut CTR_DRBG_STATE,
        out: *mut u8,
        out_len: usize,
        additional_data: *const u8,
        additional_data_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CTR_DRBG_clear zeroises the state of `drbg`.
    pub fn CTR_DRBG_clear(drbg: *mut CTR_DRBG_STATE);
}
unsafe extern "C" {
    /// X25519_keypair sets `out_public_value` and `out_private_key` to a freshly
    /// generated, public–private key pair.
    pub fn X25519_keypair(out_public_value: *mut u8, out_private_key: *mut u8);
}
unsafe extern "C" {
    /// X25519 writes a shared key to `out_shared_key` that is calculated from the
    /// given private key and the peer's public value. It returns one on success and
    /// zero on error.
    ///
    /// Don't use the shared key directly, rather use a KDF and also include the two
    /// public values as inputs.
    pub fn X25519(
        out_shared_key: *mut u8,
        private_key: *const u8,
        peer_public_value: *const u8,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X25519_public_from_private calculates a Diffie-Hellman public value from the
    /// given private key and writes it to `out_public_value`.
    pub fn X25519_public_from_private(out_public_value: *mut u8, private_key: *const u8);
}
unsafe extern "C" {
    /// ED25519_keypair sets `out_public_key` and `out_private_key` to a freshly
    /// generated, public–private key pair.
    pub fn ED25519_keypair(out_public_key: *mut u8, out_private_key: *mut u8);
}
unsafe extern "C" {
    /// ED25519_sign sets `out_sig` to be a signature of `message_len` bytes from
    /// `message` using `private_key`. It returns one on success or zero on
    /// allocation failure.
    pub fn ED25519_sign(
        out_sig: *mut u8,
        message: *const u8,
        message_len: usize,
        private_key: *const u8,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ED25519_verify returns one iff `signature` is a valid signature, by
    /// `public_key` of `message_len` bytes from `message`. It returns zero
    /// otherwise.
    pub fn ED25519_verify(
        message: *const u8,
        message_len: usize,
        signature: *const u8,
        public_key: *const u8,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ED25519_keypair_from_seed calculates a public and private key from an
    /// Ed25519 “seed”. Seed values are not exposed by this API (although they
    /// happen to be the first 32 bytes of a private key) so this function is for
    /// interoperating with systems that may store just a seed instead of a full
    /// private key.
    pub fn ED25519_keypair_from_seed(
        out_public_key: *mut u8,
        out_private_key: *mut u8,
        seed: *const u8,
    );
}
pub const spake2_role_t_spake2_role_alice: spake2_role_t = 0;
pub const spake2_role_t_spake2_role_bob: spake2_role_t = 1;
/// spake2_role_t enumerates the different “roles” in SPAKE2. The protocol
/// requires that the symmetry of the two parties be broken so one participant
/// must be “Alice” and the other be “Bob”.
pub type spake2_role_t = ::core::ffi::c_uint;
unsafe extern "C" {
    /// SPAKE2_CTX_new creates a new `SPAKE2_CTX` (which can only be used for a
    /// single execution of the protocol). SPAKE2 requires the symmetry of the two
    /// parties to be broken which is indicated via `my_role` – each party must pass
    /// a different value for this argument.
    ///
    /// The `my_name` and `their_name` arguments allow optional, opaque names to be
    /// bound into the protocol. For example MAC addresses, hostnames, usernames
    /// etc. These values are not exposed and can avoid context-confusion attacks
    /// when a password is shared between several devices.
    pub fn SPAKE2_CTX_new(
        my_role: spake2_role_t,
        my_name: *const u8,
        my_name_len: usize,
        their_name: *const u8,
        their_name_len: usize,
    ) -> *mut SPAKE2_CTX;
}
unsafe extern "C" {
    /// SPAKE2_CTX_free frees `ctx` and all the resources that it has allocated.
    pub fn SPAKE2_CTX_free(ctx: *mut SPAKE2_CTX);
}
unsafe extern "C" {
    /// SPAKE2_generate_msg generates a SPAKE2 message given `password`, writes
    /// it to `out` and sets `*out_len` to the number of bytes written.
    ///
    /// At most `max_out_len` bytes are written to `out` and, in order to ensure
    /// success, `max_out_len` should be at least `SPAKE2_MAX_MSG_SIZE` bytes.
    ///
    /// This function can only be called once for a given `SPAKE2_CTX`.
    ///
    /// It returns one on success and zero on error.
    pub fn SPAKE2_generate_msg(
        ctx: *mut SPAKE2_CTX,
        out: *mut u8,
        out_len: *mut usize,
        max_out_len: usize,
        password: *const u8,
        password_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SPAKE2_process_msg completes the SPAKE2 exchange given the peer's message in
    /// `their_msg`, writes at most `max_out_key_len` bytes to `out_key` and sets
    /// `*out_key_len` to the number of bytes written.
    ///
    /// The resulting keying material is suitable for:
    ///    - Using directly in a key-confirmation step: i.e. each side could
    ///      transmit a hash of their role, a channel-binding value and the key
    ///      material to prove to the other side that they know the shared key.
    ///   -  Using as input keying material to HKDF to generate a variety of subkeys
    ///      for encryption etc.
    ///
    /// If `max_out_key_key` is smaller than the amount of key material generated
    /// then the key is silently truncated. If you want to ensure that no truncation
    /// occurs then `max_out_key` should be at least `SPAKE2_MAX_KEY_SIZE`.
    ///
    /// You must call `SPAKE2_generate_msg` on a given `SPAKE2_CTX` before calling
    /// this function. On successful return, `ctx` is complete and calling
    /// `SPAKE2_CTX_free` is the only acceptable operation on it.
    ///
    /// Returns one on success or zero on error.
    pub fn SPAKE2_process_msg(
        ctx: *mut SPAKE2_CTX,
        out_key: *mut u8,
        out_key_len: *mut usize,
        max_out_key_len: usize,
        their_msg: *const u8,
        their_msg_len: usize,
    ) -> ::core::ffi::c_int;
}
/// DES.
///
/// This module is deprecated and retained for legacy reasons only. It is slow
/// and may leak key material with timing or cache side channels. Moreover,
/// single-keyed DES is broken and can be brute-forced in under a day.
///
/// Use a modern cipher, such as AES-GCM or ChaCha20-Poly1305, instead.
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct DES_cblock_st {
    pub bytes: [u8; 8usize],
}
/// DES.
///
/// This module is deprecated and retained for legacy reasons only. It is slow
/// and may leak key material with timing or cache side channels. Moreover,
/// single-keyed DES is broken and can be brute-forced in under a day.
///
/// Use a modern cipher, such as AES-GCM or ChaCha20-Poly1305, instead.
pub type DES_cblock = DES_cblock_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct DES_ks {
    pub subkeys: [[u32; 2usize]; 16usize],
}
pub type DES_key_schedule = DES_ks;
unsafe extern "C" {
    /// DES_set_key performs a key schedule and initialises `schedule` with `key`.
    pub fn DES_set_key(key: *const DES_cblock, schedule: *mut DES_key_schedule);
}
unsafe extern "C" {
    /// DES_set_odd_parity sets the parity bits (the least-significant bits in each
    /// byte) of `key` given the other bits in each byte.
    pub fn DES_set_odd_parity(key: *mut DES_cblock);
}
unsafe extern "C" {
    /// DES_ecb_encrypt encrypts (or decrypts, if `is_encrypt` is `DES_DECRYPT`) a
    /// single DES block (8 bytes) from `in` to `out`, using the key configured in
    /// `schedule`.
    pub fn DES_ecb_encrypt(
        in_: *const DES_cblock,
        out: *mut DES_cblock,
        schedule: *const DES_key_schedule,
        is_encrypt: ::core::ffi::c_int,
    );
}
unsafe extern "C" {
    /// DES_ncbc_encrypt encrypts (or decrypts, if `enc` is `DES_DECRYPT`) `len`
    /// bytes from `in` to `out` with DES in CBC mode. `len` must be a multiple of 8.
    /// The IV is taken from `ivec`. When the function completes, the IV for the next
    /// block is written to `ivec`.
    pub fn DES_ncbc_encrypt(
        in_: *const u8,
        out: *mut u8,
        len: usize,
        schedule: *const DES_key_schedule,
        ivec: *mut DES_cblock,
        enc: ::core::ffi::c_int,
    );
}
unsafe extern "C" {
    /// DES_ecb3_encrypt encrypts (or decrypts, if `enc` is `DES_DECRYPT`) a single
    /// block (8 bytes) of data from `input` to `output` using 3DES.
    pub fn DES_ecb3_encrypt(
        input: *const DES_cblock,
        output: *mut DES_cblock,
        ks1: *const DES_key_schedule,
        ks2: *const DES_key_schedule,
        ks3: *const DES_key_schedule,
        enc: ::core::ffi::c_int,
    );
}
unsafe extern "C" {
    /// DES_ede3_cbc_encrypt encrypts (or decrypts, if `enc` is `DES_DECRYPT`) `len`
    /// bytes from `in` to `out` with 3DES in CBC mode. 3DES uses three keys, thus
    /// the function takes three different `DES_key_schedule`s. `len` must be a
    /// multiple of 8. The IV is taken from `ivec`. When the function completes, the
    /// IV for the next block is written to `ivec`.
    pub fn DES_ede3_cbc_encrypt(
        in_: *const u8,
        out: *mut u8,
        len: usize,
        ks1: *const DES_key_schedule,
        ks2: *const DES_key_schedule,
        ks3: *const DES_key_schedule,
        ivec: *mut DES_cblock,
        enc: ::core::ffi::c_int,
    );
}
unsafe extern "C" {
    /// DES_ede2_cbc_encrypt encrypts (or decrypts, if `enc` is `DES_DECRYPT`) `len`
    /// bytes from `in` to `out` with 3DES in CBC mode. With this keying option, the
    /// first and third 3DES keys are identical. Thus, this function takes only two
    /// different `DES_key_schedule`s. `len` must be a multiple of 8. The IV is taken
    /// from `ivec`. When the function completes, the IV for the next block is
    /// written to `ivec`.
    pub fn DES_ede2_cbc_encrypt(
        in_: *const u8,
        out: *mut u8,
        len: usize,
        ks1: *const DES_key_schedule,
        ks2: *const DES_key_schedule,
        ivec: *mut DES_cblock,
        enc: ::core::ffi::c_int,
    );
}
unsafe extern "C" {
    /// DES_set_key_unchecked calls `DES_set_key`.
    pub fn DES_set_key_unchecked(key: *const DES_cblock, schedule: *mut DES_key_schedule);
}
unsafe extern "C" {
    pub fn DES_ede3_cfb64_encrypt(
        in_: *const u8,
        out: *mut u8,
        length: ::core::ffi::c_long,
        ks1: *mut DES_key_schedule,
        ks2: *mut DES_key_schedule,
        ks3: *mut DES_key_schedule,
        ivec: *mut DES_cblock,
        num: *mut ::core::ffi::c_int,
        enc: ::core::ffi::c_int,
    );
}
unsafe extern "C" {
    pub fn DES_ede3_cfb_encrypt(
        in_: *const u8,
        out: *mut u8,
        numbits: ::core::ffi::c_int,
        length: ::core::ffi::c_long,
        ks1: *mut DES_key_schedule,
        ks2: *mut DES_key_schedule,
        ks3: *mut DES_key_schedule,
        ivec: *mut DES_cblock,
        enc: ::core::ffi::c_int,
    );
}
unsafe extern "C" {
    /// DH_new returns a new, empty DH object or NULL on error.
    pub fn DH_new() -> *mut DH;
}
unsafe extern "C" {
    /// DH_free decrements the reference count of `dh` and frees it if the reference
    /// count drops to zero.
    pub fn DH_free(dh: *mut DH);
}
unsafe extern "C" {
    /// DH_up_ref increments the reference count of `dh` and returns one. It does not
    /// mutate `dh` for thread-safety purposes and may be used concurrently.
    pub fn DH_up_ref(dh: *mut DH) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// DH_bits returns the size of `dh`'s group modulus, in bits.
    pub fn DH_bits(dh: *const DH) -> ::core::ffi::c_uint;
}
unsafe extern "C" {
    /// DH_size returns the number of bytes in the DH group's prime.
    pub fn DH_size(dh: *const DH) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// DH_get0_pub_key returns `dh`'s public key.
    pub fn DH_get0_pub_key(dh: *const DH) -> *const BIGNUM;
}
unsafe extern "C" {
    /// DH_get0_priv_key returns `dh`'s private key, or NULL if `dh` is a public key.
    pub fn DH_get0_priv_key(dh: *const DH) -> *const BIGNUM;
}
unsafe extern "C" {
    /// DH_get0_p returns `dh`'s group modulus.
    pub fn DH_get0_p(dh: *const DH) -> *const BIGNUM;
}
unsafe extern "C" {
    /// DH_get0_q returns the size of `dh`'s subgroup, or NULL if it is unset.
    pub fn DH_get0_q(dh: *const DH) -> *const BIGNUM;
}
unsafe extern "C" {
    /// DH_get0_g returns `dh`'s group generator.
    pub fn DH_get0_g(dh: *const DH) -> *const BIGNUM;
}
unsafe extern "C" {
    /// DH_get0_key sets `*out_pub_key` and `*out_priv_key`, if non-NULL, to `dh`'s
    /// public and private key, respectively. If `dh` is a public key, the private
    /// key will be set to NULL.
    pub fn DH_get0_key(
        dh: *const DH,
        out_pub_key: *mut *const BIGNUM,
        out_priv_key: *mut *const BIGNUM,
    );
}
unsafe extern "C" {
    /// DH_set0_key sets `dh`'s public and private key to the specified values. If
    /// NULL, the field is left unchanged. On success, it takes ownership of each
    /// argument and returns one. Otherwise, it returns zero.
    pub fn DH_set0_key(
        dh: *mut DH,
        pub_key: *mut BIGNUM,
        priv_key: *mut BIGNUM,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// DH_get0_pqg sets `*out_p`, `*out_q`, and `*out_g`, if non-NULL, to `dh`'s p,
    /// q, and g parameters, respectively.
    pub fn DH_get0_pqg(
        dh: *const DH,
        out_p: *mut *const BIGNUM,
        out_q: *mut *const BIGNUM,
        out_g: *mut *const BIGNUM,
    );
}
unsafe extern "C" {
    /// DH_set0_pqg sets `dh`'s p, q, and g parameters to the specified values.  If
    /// NULL, the field is left unchanged. On success, it takes ownership of each
    /// argument and returns one. Otherwise, it returns zero. `q` may be NULL, but
    /// `p` and `g` must either be specified or already configured on `dh`.
    pub fn DH_set0_pqg(
        dh: *mut DH,
        p: *mut BIGNUM,
        q: *mut BIGNUM,
        g: *mut BIGNUM,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// DH_set_length sets the number of bits to use for the secret exponent when
    /// calling `DH_generate_key` on `dh` and returns one. If unset,
    /// `DH_generate_key` will use the bit length of p.
    pub fn DH_set_length(dh: *mut DH, priv_length: ::core::ffi::c_uint) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// DH_get_rfc7919_2048 returns the group `ffdhe2048` from
    /// https://tools.ietf.org/html/rfc7919#appendix-A.1. It returns NULL if out
    /// of memory.
    pub fn DH_get_rfc7919_2048() -> *mut DH;
}
unsafe extern "C" {
    /// BN_get_rfc3526_prime_1536 sets `*ret` to the 1536-bit MODP group from RFC
    /// 3526 and returns `ret`. If `ret` is NULL then a fresh `BIGNUM` is allocated
    /// and returned. It returns NULL on allocation failure. The generator for this
    /// group is 2.
    pub fn BN_get_rfc3526_prime_1536(ret: *mut BIGNUM) -> *mut BIGNUM;
}
unsafe extern "C" {
    /// BN_get_rfc3526_prime_2048 sets `*ret` to the 2048-bit MODP group from RFC
    /// 3526 and returns `ret`. If `ret` is NULL then a fresh `BIGNUM` is allocated
    /// and returned. It returns NULL on allocation failure. The generator for this
    /// group is 2.
    pub fn BN_get_rfc3526_prime_2048(ret: *mut BIGNUM) -> *mut BIGNUM;
}
unsafe extern "C" {
    /// BN_get_rfc3526_prime_3072 sets `*ret` to the 3072-bit MODP group from RFC
    /// 3526 and returns `ret`. If `ret` is NULL then a fresh `BIGNUM` is allocated
    /// and returned. It returns NULL on allocation failure. The generator for this
    /// group is 2.
    pub fn BN_get_rfc3526_prime_3072(ret: *mut BIGNUM) -> *mut BIGNUM;
}
unsafe extern "C" {
    /// BN_get_rfc3526_prime_4096 sets `*ret` to the 4096-bit MODP group from RFC
    /// 3526 and returns `ret`. If `ret` is NULL then a fresh `BIGNUM` is allocated
    /// and returned. It returns NULL on allocation failure. The generator for this
    /// group is 2.
    pub fn BN_get_rfc3526_prime_4096(ret: *mut BIGNUM) -> *mut BIGNUM;
}
unsafe extern "C" {
    /// BN_get_rfc3526_prime_6144 sets `*ret` to the 6144-bit MODP group from RFC
    /// 3526 and returns `ret`. If `ret` is NULL then a fresh `BIGNUM` is allocated
    /// and returned. It returns NULL on allocation failure. The generator for this
    /// group is 2.
    pub fn BN_get_rfc3526_prime_6144(ret: *mut BIGNUM) -> *mut BIGNUM;
}
unsafe extern "C" {
    /// BN_get_rfc3526_prime_8192 sets `*ret` to the 8192-bit MODP group from RFC
    /// 3526 and returns `ret`. If `ret` is NULL then a fresh `BIGNUM` is allocated
    /// and returned. It returns NULL on allocation failure. The generator for this
    /// group is 2.
    pub fn BN_get_rfc3526_prime_8192(ret: *mut BIGNUM) -> *mut BIGNUM;
}
unsafe extern "C" {
    /// DH_generate_parameters_ex generates a suitable Diffie-Hellman group with a
    /// prime that is `prime_bits` long and stores it in `dh`. The generator of the
    /// group will be `generator`, which should be `DH_GENERATOR_2` unless there's a
    /// good reason to use a different value. The `cb` argument contains a callback
    /// function that will be called during the generation. See the documentation in
    /// `bn.h` about this. In addition to the callback invocations from `BN`, `cb`
    /// will also be called with `event` equal to three when the generation is
    /// complete.
    pub fn DH_generate_parameters_ex(
        dh: *mut DH,
        prime_bits: ::core::ffi::c_int,
        generator: ::core::ffi::c_int,
        cb: *mut BN_GENCB,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// DH_generate_key generates a new, random, private key and stores it in
    /// `dh`, if `dh` does not already have a private key. Otherwise, it updates
    /// `dh`'s public key to match the private key. It returns one on success and
    /// zero on error.
    pub fn DH_generate_key(dh: *mut DH) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// DH_compute_key_padded calculates the shared key between `dh` and `peers_key`
    /// and writes it as a big-endian integer into `out`, padded up to `DH_size`
    /// bytes. It returns the number of bytes written, which is always `DH_size`, or
    /// a negative number on error. `out` must have `DH_size` bytes of space.
    ///
    /// WARNING: this differs from the usual BoringSSL return-value convention.
    ///
    /// Note this function differs from `DH_compute_key` in that it preserves leading
    /// zeros in the secret. This function is the preferred variant. It matches PKCS
    /// #3 and avoids some side channel attacks. However, the two functions are not
    /// drop-in replacements for each other. Using a different variant than the
    /// application expects will result in sporadic key mismatches.
    ///
    /// Callers that expect a fixed-width secret should use this function over
    /// `DH_compute_key`. Callers that use either function should migrate to a modern
    /// primitive such as X25519 or ECDH with P-256 instead.
    ///
    /// This function does not mutate `dh` for thread-safety purposes and may be used
    /// concurrently.
    pub fn DH_compute_key_padded(
        out: *mut u8,
        peers_key: *const BIGNUM,
        dh: *mut DH,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// DH_compute_key_hashed calculates the shared key between `dh` and `peers_key`
    /// and hashes it with the given `digest`. If the hash output is less than
    /// `max_out_len` bytes then it writes the hash output to `out` and sets
    /// `*out_len` to the number of bytes written. Otherwise it signals an error. It
    /// returns one on success or zero on error.
    ///
    /// NOTE: this follows the usual BoringSSL return-value convention, but that's
    /// different from `DH_compute_key` and `DH_compute_key_padded`.
    ///
    /// This function does not mutate `dh` for thread-safety purposes and may be used
    /// concurrently.
    pub fn DH_compute_key_hashed(
        dh: *mut DH,
        out: *mut u8,
        out_len: *mut usize,
        max_out_len: usize,
        peers_key: *const BIGNUM,
        digest: *const EVP_MD,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// DH_check checks the suitability of `dh` as a Diffie-Hellman group. and sets
    /// `DH_CHECK_*` flags in `*out_flags` if it finds any errors. It returns one if
    /// `*out_flags` was successfully set and zero on error.
    ///
    /// Note: these checks may be quite computationally expensive.
    pub fn DH_check(dh: *const DH, out_flags: *mut ::core::ffi::c_int) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// DH_check_pub_key checks the suitability of `pub_key` as a public key for the
    /// DH group in `dh` and sets `DH_CHECK_PUBKEY_*` flags in `*out_flags` if it
    /// finds any errors. It returns one if `*out_flags` was successfully set and
    /// zero on error.
    pub fn DH_check_pub_key(
        dh: *const DH,
        pub_key: *const BIGNUM,
        out_flags: *mut ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// DHparams_dup allocates a fresh `DH` and copies the parameters from `dh` into
    /// it. It returns the new `DH` or NULL on error.
    pub fn DHparams_dup(dh: *const DH) -> *mut DH;
}
unsafe extern "C" {
    /// DH_parse_parameters decodes a DER-encoded DHParameter structure (PKCS #3)
    /// from `cbs` and advances `cbs`. It returns a newly-allocated `DH` or NULL on
    /// error.
    pub fn DH_parse_parameters(cbs: *mut CBS) -> *mut DH;
}
unsafe extern "C" {
    /// DH_marshal_parameters marshals `dh` as a DER-encoded DHParameter structure
    /// (PKCS #3) and appends the result to `cbb`. It returns one on success and zero
    /// on error.
    pub fn DH_marshal_parameters(cbb: *mut CBB, dh: *const DH) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// DH_generate_parameters behaves like `DH_generate_parameters_ex`, which is
    /// what you should use instead. It returns NULL on error, or a newly-allocated
    /// `DH` on success. This function is provided for compatibility only.
    pub fn DH_generate_parameters(
        prime_len: ::core::ffi::c_int,
        generator: ::core::ffi::c_int,
        callback: ::core::option::Option<
            unsafe extern "C" fn(
                arg1: ::core::ffi::c_int,
                arg2: ::core::ffi::c_int,
                arg3: *mut ::core::ffi::c_void,
            ),
        >,
        cb_arg: *mut ::core::ffi::c_void,
    ) -> *mut DH;
}
unsafe extern "C" {
    /// d2i_DHparams parses a DER-encoded DHParameter structure (PKCS #3) from `len`
    /// bytes at `*inp`, as in `d2i_SAMPLE`.
    ///
    /// Use `DH_parse_parameters` instead.
    pub fn d2i_DHparams(
        ret: *mut *mut DH,
        inp: *mut *const ::core::ffi::c_uchar,
        len: ::core::ffi::c_long,
    ) -> *mut DH;
}
unsafe extern "C" {
    /// i2d_DHparams marshals `in` to a DER-encoded DHParameter structure (PKCS #3),
    /// as described in `i2d_SAMPLE`.
    ///
    /// Use `DH_marshal_parameters` instead.
    pub fn i2d_DHparams(in_: *const DH, outp: *mut *mut ::core::ffi::c_uchar)
        -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// DH_compute_key behaves like `DH_compute_key_padded` but, contrary to PKCS #3,
    /// returns a variable-length shared key with leading zeros. It returns the
    /// number of bytes written, or a negative number on error. `out` must have
    /// `DH_size` bytes of space.
    ///
    /// WARNING: this differs from the usual BoringSSL return-value convention.
    ///
    /// Note this function's running time and memory access pattern leaks information
    /// about the shared secret. Particularly if `dh` is reused, this may result in
    /// side channel attacks such as https://raccoon-attack.com/.
    ///
    /// `DH_compute_key_padded` is the preferred variant and avoids the above
    /// attacks. However, the two functions are not drop-in replacements for each
    /// other. Using a different variant than the application expects will result in
    /// sporadic key mismatches.
    ///
    /// Callers that expect a fixed-width secret should use `DH_compute_key_padded`
    /// instead. Callers that use either function should migrate to a modern
    /// primitive such as X25519 or ECDH with P-256 instead.
    ///
    /// This function does not mutate `dh` for thread-safety purposes and may be used
    /// concurrently.
    pub fn DH_compute_key(
        out: *mut u8,
        peers_key: *const BIGNUM,
        dh: *mut DH,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Hash algorithms.
    ///
    /// The following functions return `EVP_MD` objects that implement the named hash
    /// function.
    pub fn EVP_md4() -> *const EVP_MD;
}
unsafe extern "C" {
    pub fn EVP_md5() -> *const EVP_MD;
}
unsafe extern "C" {
    pub fn EVP_sha1() -> *const EVP_MD;
}
unsafe extern "C" {
    pub fn EVP_sha224() -> *const EVP_MD;
}
unsafe extern "C" {
    pub fn EVP_sha256() -> *const EVP_MD;
}
unsafe extern "C" {
    pub fn EVP_sha384() -> *const EVP_MD;
}
unsafe extern "C" {
    pub fn EVP_sha512() -> *const EVP_MD;
}
unsafe extern "C" {
    pub fn EVP_sha512_256() -> *const EVP_MD;
}
unsafe extern "C" {
    pub fn EVP_blake2b256() -> *const EVP_MD;
}
unsafe extern "C" {
    /// EVP_md5_sha1 is a TLS-specific `EVP_MD` which computes the concatenation of
    /// MD5 and SHA-1, as used in TLS 1.1 and below.
    pub fn EVP_md5_sha1() -> *const EVP_MD;
}
unsafe extern "C" {
    /// EVP_get_digestbynid returns an `EVP_MD` for the given NID, or NULL if no
    /// such digest is known.
    pub fn EVP_get_digestbynid(nid: ::core::ffi::c_int) -> *const EVP_MD;
}
unsafe extern "C" {
    /// EVP_get_digestbyobj returns an `EVP_MD` for the given `ASN1_OBJECT`, or NULL
    /// if no such digest is known.
    pub fn EVP_get_digestbyobj(obj: *const ASN1_OBJECT) -> *const EVP_MD;
}
unsafe extern "C" {
    /// EVP_MD_CTX_init sets an uninitialized `EVP_MD_CTX` to the zero state. This
    /// is the same as setting the structure to zero.
    ///
    /// This function is used for initializing uninitialized memory in an
    /// `EVP_MD_CTX`, e.g. if it is declared as a local variable on the stack. This
    /// function should not be used on objects that have already been initialized.
    pub fn EVP_MD_CTX_init(ctx: *mut EVP_MD_CTX);
}
unsafe extern "C" {
    /// EVP_MD_CTX_new returns a newly-allocated `EVP_MD_CTX` in the zero state, or
    /// NULL on allocation failure. The caller must use `EVP_MD_CTX_free` to release
    /// the resulting object.
    pub fn EVP_MD_CTX_new() -> *mut EVP_MD_CTX;
}
unsafe extern "C" {
    /// EVP_MD_CTX_cleanup frees any resources owned by `ctx` and resets it to the
    /// zero state. It does not free `ctx` itself. It returns one.
    pub fn EVP_MD_CTX_cleanup(ctx: *mut EVP_MD_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_MD_CTX_cleanse zeros the digest state in `ctx` and then performs the
    /// actions of `EVP_MD_CTX_cleanup`. Note that some `EVP_MD_CTX` objects contain
    /// more than just a digest (e.g. those resulting from `EVP_DigestSignInit`) but
    /// this function does not zero out more than just the digest state even in that
    /// case.
    pub fn EVP_MD_CTX_cleanse(ctx: *mut EVP_MD_CTX);
}
unsafe extern "C" {
    /// EVP_MD_CTX_free calls `EVP_MD_CTX_cleanup` and then frees `ctx` itself.
    pub fn EVP_MD_CTX_free(ctx: *mut EVP_MD_CTX);
}
unsafe extern "C" {
    /// EVP_MD_CTX_copy_ex sets `out` to be a copy of `in`. It returns one on success
    /// and zero on allocation failure. `out` must have been previously initialized,
    /// e.g. with `EVP_MD_CTX_init` or `EVP_MD_CTX_new`.
    pub fn EVP_MD_CTX_copy_ex(out: *mut EVP_MD_CTX, in_: *const EVP_MD_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_MD_CTX_move sets `out`, which must already be initialised, to the hash
    /// state in `in`. `in` is mutated and left in an empty state.
    pub fn EVP_MD_CTX_move(out: *mut EVP_MD_CTX, in_: *mut EVP_MD_CTX);
}
unsafe extern "C" {
    /// EVP_MD_CTX_reset calls `EVP_MD_CTX_cleanup` followed by `EVP_MD_CTX_init`. It
    /// returns one.
    pub fn EVP_MD_CTX_reset(ctx: *mut EVP_MD_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_DigestInit_ex configures `ctx`, whose memory must already have been
    /// initialised (e.g. with `EVP_MD_CTX_init` or `EVP_MD_CTX_new`), for a fresh
    /// hashing operation using `type`. It returns one on success and zero on
    /// allocation failure.
    ///
    /// This function may be used to reconfigure an `EVP_MD_CTX` that was previously
    /// used for another operation.
    pub fn EVP_DigestInit_ex(
        ctx: *mut EVP_MD_CTX,
        type_: *const EVP_MD,
        engine: *mut ENGINE,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_DigestUpdate hashes `len` bytes from `data` into the hashing operation
    /// in `ctx`. It returns one.
    pub fn EVP_DigestUpdate(
        ctx: *mut EVP_MD_CTX,
        data: *const ::core::ffi::c_void,
        len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_DigestFinal_ex finishes the digest in `ctx` and writes the output to
    /// `md_out`. `EVP_MD_CTX_size` bytes are written, which is at most
    /// `EVP_MAX_MD_SIZE`. If `out_size` is not NULL then `*out_size` is set to the
    /// number of bytes written. It returns one. After this call, the hash cannot be
    /// updated or finished again until `EVP_DigestInit_ex` is called to start
    /// another hashing operation.
    pub fn EVP_DigestFinal_ex(
        ctx: *mut EVP_MD_CTX,
        md_out: *mut u8,
        out_size: *mut ::core::ffi::c_uint,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_DigestFinal acts like `EVP_DigestFinal_ex` except that
    /// `EVP_MD_CTX_cleanup` is called on `ctx` before returning.
    pub fn EVP_DigestFinal(
        ctx: *mut EVP_MD_CTX,
        md_out: *mut u8,
        out_size: *mut ::core::ffi::c_uint,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_Digest performs a complete hashing operation in one call. It hashes `len`
    /// bytes from `data` and writes the digest to `md_out`. `EVP_MD_CTX_size` bytes
    /// are written, which is at most `EVP_MAX_MD_SIZE`. If `out_size` is not NULL
    /// then `*out_size` is set to the number of bytes written. It returns one on
    /// success and zero otherwise.
    pub fn EVP_Digest(
        data: *const ::core::ffi::c_void,
        len: usize,
        md_out: *mut u8,
        md_out_size: *mut ::core::ffi::c_uint,
        type_: *const EVP_MD,
        impl_: *mut ENGINE,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_MD_type returns a NID identifying `md`. (For example, `NID_sha256`.)
    pub fn EVP_MD_type(md: *const EVP_MD) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_MD_flags returns the flags for `md`, which is a set of `EVP_MD_FLAG_*`
    /// values, ORed together.
    pub fn EVP_MD_flags(md: *const EVP_MD) -> u32;
}
unsafe extern "C" {
    /// EVP_MD_size returns the digest size of `md`, in bytes.
    pub fn EVP_MD_size(md: *const EVP_MD) -> usize;
}
unsafe extern "C" {
    /// EVP_MD_block_size returns the native block-size of `md`, in bytes.
    pub fn EVP_MD_block_size(md: *const EVP_MD) -> usize;
}
unsafe extern "C" {
    /// EVP_MD_CTX_get0_md returns the underlying digest function, or NULL if one has
    /// not been set.
    pub fn EVP_MD_CTX_get0_md(ctx: *const EVP_MD_CTX) -> *const EVP_MD;
}
unsafe extern "C" {
    /// EVP_MD_CTX_md returns the underlying digest function, or NULL if one has not
    /// been set. (This is the same as `EVP_MD_CTX_get0_md` but OpenSSL has
    /// deprecated this spelling.)
    pub fn EVP_MD_CTX_md(ctx: *const EVP_MD_CTX) -> *const EVP_MD;
}
unsafe extern "C" {
    /// EVP_MD_CTX_size returns the digest size of `ctx`, in bytes. It
    /// will crash if a digest hasn't been set on `ctx`.
    pub fn EVP_MD_CTX_size(ctx: *const EVP_MD_CTX) -> usize;
}
unsafe extern "C" {
    /// EVP_MD_CTX_block_size returns the block size of the digest function used by
    /// `ctx`, in bytes. It will crash if a digest hasn't been set on `ctx`.
    pub fn EVP_MD_CTX_block_size(ctx: *const EVP_MD_CTX) -> usize;
}
unsafe extern "C" {
    /// EVP_MD_CTX_type returns a NID describing the digest function used by `ctx`.
    /// (For example, `NID_sha256`.) It will crash if a digest hasn't been set on
    /// `ctx`.
    pub fn EVP_MD_CTX_type(ctx: *const EVP_MD_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_MD_CTX_pkey_ctx returns the `EVP_PKEY_CTX` used to configure additional
    /// parameters on `ctx` if `ctx` is used for a sign or verify operation with
    /// `EVP_DigestSignInit` or `EVP_DigestVerifyInit`. It returns NULL otherwise.
    pub fn EVP_MD_CTX_pkey_ctx(ctx: *const EVP_MD_CTX) -> *mut EVP_PKEY_CTX;
}
unsafe extern "C" {
    /// EVP_parse_digest_algorithm parses an AlgorithmIdentifier structure containing
    /// a hash function OID (for example, 2.16.840.1.101.3.4.2.1 is SHA-256) and
    /// advances `cbs`. The parameters field may either be omitted or a NULL. It
    /// returns the digest function or NULL on error.
    pub fn EVP_parse_digest_algorithm(cbs: *mut CBS) -> *const EVP_MD;
}
unsafe extern "C" {
    /// EVP_parse_digest_algorithm_nid behaves like `EVP_parse_digest_algorithm`
    /// except it returns `NID_undef` on error and some other value on success. This
    /// may be used to avoid depending on every digest algorithm in the library.
    pub fn EVP_parse_digest_algorithm_nid(cbs: *mut CBS) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_marshal_digest_algorithm marshals `md` as an AlgorithmIdentifier
    /// structure and appends the result to `cbb`. It returns one on success and zero
    /// on error. It sets the parameters field to NULL. Use
    /// `EVP_marshal_digest_algorithm_no_params` to omit the parameters instead.
    ///
    /// In general, the parameters should be omitted for digest algorithms, but the
    /// following specifications require a NULL parameter instead.
    ///
    /// - Hash algorithms and MGF-1 hash algorithms used in RSASSA-PSS and RSAES-OAEP
    ///   (see RFC 4055, Section 2.1)
    /// - The hash algorithm in the DigestInfo structure of RSASSA-PKCS1-v1_5 (see
    ///   RFC 8017, Appendix A.2.4)
    ///
    /// Some existing software also uses NULL parameters in other contexts. In
    /// practice, digest algorithms are encoded wildly inconsistently.
    pub fn EVP_marshal_digest_algorithm(cbb: *mut CBB, md: *const EVP_MD) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_marshal_digest_algorithm_no_params behaves like
    /// `EVP_marshal_digest_algorithm` but omits the parameters field.
    pub fn EVP_marshal_digest_algorithm_no_params(
        cbb: *mut CBB,
        md: *const EVP_MD,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_DigestInit calls `EVP_MD_CTX_init`, followed by `EVP_DigestInit_ex`.
    ///
    /// `EVP_MD_CTX_init` is used for initializing uninitialized memory in an
    /// `EVP_MD_CTX`, e.g. if it is declared as a local variable on the stack. Thus
    /// this function should not be used on objects that have already been
    /// initialized.
    ///
    /// WARNING: This differs from OpenSSL 1.1.x, where `EVP_DigestInit` and
    /// `EVP_DigestInit_ex` are largely equivalent. This difference is because
    /// BoringSSL, like OpenSSL 1.0.x, still supports stack-allocating `EVP_MD_CTX`.
    /// Implementing the OpenSSL 1.1.x semantics would introduce uninitialized reads
    /// in those callers.
    pub fn EVP_DigestInit(ctx: *mut EVP_MD_CTX, type_: *const EVP_MD) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_MD_CTX_copy calls `EVP_MD_CTX_init`, followed by `EVP_MD_CTX_copy_ex`.
    ///
    /// `EVP_MD_CTX_init` is used for initializing uninitialized memory in an
    /// `EVP_MD_CTX`, e.g. if it is declared as a local variable on the stack. Thus
    /// this function should not be used on objects that have already been
    /// initialized.
    ///
    /// WARNING: This differs from OpenSSL 1.1.x, where `EVP_MD_CTX_copy` and
    /// |EVP_MD_CTX_copy_ex| are largely equivalent. This difference is because
    /// BoringSSL, like OpenSSL 1.0.x, still supports stack-allocating `EVP_MD_CTX`.
    /// Implementing the OpenSSL 1.1.x semantics would introduce uninitialized reads
    /// in those callers.
    pub fn EVP_MD_CTX_copy(out: *mut EVP_MD_CTX, in_: *const EVP_MD_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_add_digest does nothing and returns one. It exists only for
    /// compatibility with OpenSSL.
    pub fn EVP_add_digest(digest: *const EVP_MD) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_get_digestbyname returns an `EVP_MD` given a human readable name in
    /// `name`, or NULL if the name is unknown.
    pub fn EVP_get_digestbyname(name: *const ::core::ffi::c_char) -> *const EVP_MD;
}
unsafe extern "C" {
    /// EVP_dss1 returns the value of EVP_sha1(). This was provided by OpenSSL to
    /// specify the original DSA signatures, which were fixed to use SHA-1. Note,
    /// however, that attempting to sign or verify DSA signatures with the EVP
    /// interface will always fail.
    pub fn EVP_dss1() -> *const EVP_MD;
}
unsafe extern "C" {
    /// EVP_MD_CTX_create calls `EVP_MD_CTX_new`.
    pub fn EVP_MD_CTX_create() -> *mut EVP_MD_CTX;
}
unsafe extern "C" {
    /// EVP_MD_CTX_destroy calls `EVP_MD_CTX_free`.
    pub fn EVP_MD_CTX_destroy(ctx: *mut EVP_MD_CTX);
}
unsafe extern "C" {
    /// EVP_DigestFinalXOF returns zero and adds an error to the error queue.
    /// BoringSSL does not support any XOF digests.
    pub fn EVP_DigestFinalXOF(ctx: *mut EVP_MD_CTX, out: *mut u8, len: usize)
        -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_MD_meth_get_flags calls `EVP_MD_flags`.
    pub fn EVP_MD_meth_get_flags(md: *const EVP_MD) -> u32;
}
unsafe extern "C" {
    /// EVP_MD_CTX_set_flags does nothing.
    pub fn EVP_MD_CTX_set_flags(ctx: *mut EVP_MD_CTX, flags: ::core::ffi::c_int);
}
unsafe extern "C" {
    /// EVP_MD_nid calls `EVP_MD_type`.
    pub fn EVP_MD_nid(md: *const EVP_MD) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_MD_fetch behaves like `EVP_get_digestbyname`. `libctx` and `propq` are
    /// ignored. Although it returns a non-const pointer, `EVP_MD`s in BoringSSL are
    /// static and do not need to be freed.
    pub fn EVP_MD_fetch(
        libctx: *mut OSSL_LIB_CTX,
        name: *const ::core::ffi::c_char,
        propq: *const ::core::ffi::c_char,
    ) -> *mut EVP_MD;
}
unsafe extern "C" {
    /// EVP_MD_up_ref returns one. `EVP_MD`s in BoringSSL are static.
    pub fn EVP_MD_up_ref(md: *mut EVP_MD) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_MD_free does nothing. `EVP_MD`s in BoringSSL are static.
    pub fn EVP_MD_free(md: *mut EVP_MD);
}
unsafe extern "C" {
    /// EVP_Q_digest behaves like `EVP_Digest` but specifies the digest by a string
    /// `name`. `libctx` and `propq` are ignored.
    pub fn EVP_Q_digest(
        libctx: *mut OSSL_LIB_CTX,
        name: *const ::core::ffi::c_char,
        propq: *const ::core::ffi::c_char,
        in_: *const ::core::ffi::c_void,
        in_len: usize,
        out: *mut u8,
        out_len: *mut usize,
    ) -> ::core::ffi::c_int;
}
/// Internal constants and structures (hidden).
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct evp_md_pctx_ops {
    _unused: [u8; 0],
}
/// env_md_ctx_st is typoed ("evp" -> "env"), but the typo comes from OpenSSL
/// and some consumers forward-declare these structures so we're leaving it
/// alone.
#[repr(C)]
#[derive(Copy, Clone)]
pub struct env_md_ctx_st {
    pub __bindgen_anon_1: env_md_ctx_st__bindgen_ty_1,
    /// digest is the underlying digest function, or NULL if not set.
    pub digest: *const EVP_MD,
    /// pctx is an opaque (at this layer) pointer to additional context that
    /// EVP_PKEY functions may store in this object.
    pub pctx: *mut EVP_PKEY_CTX,
    /// pctx_ops, if not NULL, points to a vtable that contains functions to
    /// manipulate `pctx`.
    pub pctx_ops: *const evp_md_pctx_ops,
}
/// md_data contains the hash-specific context.
#[repr(C)]
#[derive(Copy, Clone)]
pub union env_md_ctx_st__bindgen_ty_1 {
    pub md_data: [u8; 208usize],
    pub alignment: u64,
}
unsafe extern "C" {
    /// DSA_new returns a new, empty DSA object or NULL on error.
    pub fn DSA_new() -> *mut DSA;
}
unsafe extern "C" {
    /// DSA_free decrements the reference count of `dsa` and frees it if the
    /// reference count drops to zero.
    pub fn DSA_free(dsa: *mut DSA);
}
unsafe extern "C" {
    /// DSA_up_ref increments the reference count of `dsa` and returns one. It does
    /// not mutate `dsa` for thread-safety purposes and may be used concurrently.
    pub fn DSA_up_ref(dsa: *mut DSA) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// DSA_bits returns the size of `dsa`'s group modulus, in bits.
    pub fn DSA_bits(dsa: *const DSA) -> ::core::ffi::c_uint;
}
unsafe extern "C" {
    /// DSA_get0_pub_key returns `dsa`'s public key.
    pub fn DSA_get0_pub_key(dsa: *const DSA) -> *const BIGNUM;
}
unsafe extern "C" {
    /// DSA_get0_priv_key returns `dsa`'s private key, or NULL if `dsa` is a public
    /// key.
    pub fn DSA_get0_priv_key(dsa: *const DSA) -> *const BIGNUM;
}
unsafe extern "C" {
    /// DSA_get0_p returns `dsa`'s group modulus.
    pub fn DSA_get0_p(dsa: *const DSA) -> *const BIGNUM;
}
unsafe extern "C" {
    /// DSA_get0_q returns the size of `dsa`'s subgroup.
    pub fn DSA_get0_q(dsa: *const DSA) -> *const BIGNUM;
}
unsafe extern "C" {
    /// DSA_get0_g returns `dsa`'s group generator.
    pub fn DSA_get0_g(dsa: *const DSA) -> *const BIGNUM;
}
unsafe extern "C" {
    /// DSA_get0_key sets `*out_pub_key` and `*out_priv_key`, if non-NULL, to `dsa`'s
    /// public and private key, respectively. If `dsa` is a public key, the private
    /// key will be set to NULL.
    pub fn DSA_get0_key(
        dsa: *const DSA,
        out_pub_key: *mut *const BIGNUM,
        out_priv_key: *mut *const BIGNUM,
    );
}
unsafe extern "C" {
    /// DSA_get0_pqg sets `*out_p`, `*out_q`, and `*out_g`, if non-NULL, to `dsa`'s
    /// p, q, and g parameters, respectively.
    pub fn DSA_get0_pqg(
        dsa: *const DSA,
        out_p: *mut *const BIGNUM,
        out_q: *mut *const BIGNUM,
        out_g: *mut *const BIGNUM,
    );
}
unsafe extern "C" {
    /// DSA_set0_key sets `dsa`'s public and private key to `pub_key` and `priv_key`,
    /// respectively, if non-NULL. On success, it takes ownership of each argument
    /// and returns one. Otherwise, it returns zero.
    ///
    /// `priv_key` may be NULL, but `pub_key` must either be non-NULL or already
    /// configured on `dsa`.
    pub fn DSA_set0_key(
        dsa: *mut DSA,
        pub_key: *mut BIGNUM,
        priv_key: *mut BIGNUM,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// DSA_set0_pqg sets `dsa`'s parameters to `p`, `q`, and `g`, if non-NULL, and
    /// takes ownership of them. On success, it takes ownership of each argument and
    /// returns one. Otherwise, it returns zero.
    ///
    /// Each argument must either be non-NULL or already configured on `dsa`.
    pub fn DSA_set0_pqg(
        dsa: *mut DSA,
        p: *mut BIGNUM,
        q: *mut BIGNUM,
        g: *mut BIGNUM,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// DSA_generate_parameters_ex generates a set of DSA parameters by following
    /// the procedure given in FIPS 186-4, appendix A.
    /// (http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf)
    ///
    /// The larger prime will have a length of `bits` (e.g. 2048). The `seed` value
    /// allows others to generate and verify the same parameters and should be
    /// random input which is kept for reference. If `out_counter` or `out_h` are
    /// not NULL then the counter and h value used in the generation are written to
    /// them.
    ///
    /// The `cb` argument is passed to `BN_generate_prime_ex` and is thus called
    /// during the generation process in order to indicate progress. See the
    /// comments for that function for details. In addition to the calls made by
    /// `BN_generate_prime_ex`, `DSA_generate_parameters_ex` will call it with
    /// `event` equal to 2 and 3 at different stages of the process.
    ///
    /// It returns one on success and zero otherwise.
    pub fn DSA_generate_parameters_ex(
        dsa: *mut DSA,
        bits: ::core::ffi::c_uint,
        seed: *const u8,
        seed_len: usize,
        out_counter: *mut ::core::ffi::c_int,
        out_h: *mut ::core::ffi::c_ulong,
        cb: *mut BN_GENCB,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// DSAparams_dup returns a freshly allocated `DSA` that contains a copy of the
    /// parameters from `dsa`. It returns NULL on error.
    pub fn DSAparams_dup(dsa: *const DSA) -> *mut DSA;
}
unsafe extern "C" {
    /// DSA_generate_key generates a public/private key pair in `dsa`, which must
    /// already have parameters setup. It returns one on success and zero on
    /// error.
    pub fn DSA_generate_key(dsa: *mut DSA) -> ::core::ffi::c_int;
}
/// DSA_SIG_st (aka `DSA_SIG`) contains a DSA signature as a pair of integers.
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct DSA_SIG_st {
    pub r: *mut BIGNUM,
    pub s: *mut BIGNUM,
}
unsafe extern "C" {
    /// DSA_SIG_new returns a freshly allocated, DIG_SIG structure or NULL on error.
    /// Both `r` and `s` in the signature will be NULL.
    pub fn DSA_SIG_new() -> *mut DSA_SIG;
}
unsafe extern "C" {
    /// DSA_SIG_free frees the contents of `sig` and then frees `sig` itself.
    pub fn DSA_SIG_free(sig: *mut DSA_SIG);
}
unsafe extern "C" {
    /// DSA_SIG_get0 sets `*out_r` and `*out_s`, if non-NULL, to the two components
    /// of `sig`.
    pub fn DSA_SIG_get0(sig: *const DSA_SIG, out_r: *mut *const BIGNUM, out_s: *mut *const BIGNUM);
}
unsafe extern "C" {
    /// DSA_SIG_set0 sets `sig`'s components to `r` and `s`, neither of which may be
    /// NULL. On success, it takes ownership of each argument and returns one.
    /// Otherwise, it returns zero.
    pub fn DSA_SIG_set0(sig: *mut DSA_SIG, r: *mut BIGNUM, s: *mut BIGNUM) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// DSA_do_sign returns a signature of the hash in `digest` by the key in `dsa`
    /// and returns an allocated, DSA_SIG structure, or NULL on error.
    pub fn DSA_do_sign(digest: *const u8, digest_len: usize, dsa: *const DSA) -> *mut DSA_SIG;
}
unsafe extern "C" {
    /// DSA_do_verify verifies that `sig` is a valid signature, by the public key in
    /// `dsa`, of the hash in `digest`. It returns one if so, zero if invalid and -1
    /// on error.
    ///
    /// WARNING: do not use. This function returns -1 for error, 0 for invalid and 1
    /// for valid. However, this is dangerously different to the usual OpenSSL
    /// convention and could be a disaster if a user did `if (DSA_do_verify(...))`.
    /// Because of this, `DSA_check_signature` is a safer version of this.
    ///
    /// TODO(fork): deprecate.
    pub fn DSA_do_verify(
        digest: *const u8,
        digest_len: usize,
        sig: *const DSA_SIG,
        dsa: *const DSA,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// DSA_do_check_signature sets `*out_valid` to zero. Then it verifies that `sig`
    /// is a valid signature, by the public key in `dsa` of the hash in `digest`
    /// and, if so, it sets `*out_valid` to one.
    ///
    /// It returns one if it was able to verify the signature as valid or invalid,
    /// and zero on error.
    pub fn DSA_do_check_signature(
        out_valid: *mut ::core::ffi::c_int,
        digest: *const u8,
        digest_len: usize,
        sig: *const DSA_SIG,
        dsa: *const DSA,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// DSA_sign signs `digest` with the key in `dsa` and writes the resulting
    /// signature, in ASN.1 form, to `out_sig` and the length of the signature to
    /// `*out_siglen`. There must be, at least, `DSA_size(dsa)` bytes of space in
    /// `out_sig`. It returns one on success and zero otherwise.
    ///
    /// (The `type` argument is ignored.)
    pub fn DSA_sign(
        type_: ::core::ffi::c_int,
        digest: *const u8,
        digest_len: usize,
        out_sig: *mut u8,
        out_siglen: *mut ::core::ffi::c_uint,
        dsa: *const DSA,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// DSA_verify verifies that `sig` is a valid, ASN.1 signature, by the public
    /// key in `dsa`, of the hash in `digest`. It returns one if so, zero if invalid
    /// and -1 on error.
    ///
    /// (The `type` argument is ignored.)
    ///
    /// WARNING: do not use. This function returns -1 for error, 0 for invalid and 1
    /// for valid. However, this is dangerously different to the usual OpenSSL
    /// convention and could be a disaster if a user did `if (DSA_do_verify(...))`.
    /// Because of this, `DSA_check_signature` is a safer version of this.
    ///
    /// TODO(fork): deprecate.
    pub fn DSA_verify(
        type_: ::core::ffi::c_int,
        digest: *const u8,
        digest_len: usize,
        sig: *const u8,
        sig_len: usize,
        dsa: *const DSA,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// DSA_check_signature sets `*out_valid` to zero. Then it verifies that `sig`
    /// is a valid, ASN.1 signature, by the public key in `dsa`, of the hash in
    /// `digest`. If so, it sets `*out_valid` to one.
    ///
    /// It returns one if it was able to verify the signature as valid or invalid,
    /// and zero on error.
    pub fn DSA_check_signature(
        out_valid: *mut ::core::ffi::c_int,
        digest: *const u8,
        digest_len: usize,
        sig: *const u8,
        sig_len: usize,
        dsa: *const DSA,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// DSA_size returns the size, in bytes, of an ASN.1 encoded, DSA signature
    /// generated by `dsa`. Parameters must already have been setup in `dsa`.
    pub fn DSA_size(dsa: *const DSA) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// DSA_SIG_parse parses a DER-encoded DSA-Sig-Value structure from `cbs` and
    /// advances `cbs`. It returns a newly-allocated `DSA_SIG` or NULL on error.
    pub fn DSA_SIG_parse(cbs: *mut CBS) -> *mut DSA_SIG;
}
unsafe extern "C" {
    /// DSA_SIG_marshal marshals `sig` as a DER-encoded DSA-Sig-Value and appends the
    /// result to `cbb`. It returns one on success and zero on error.
    pub fn DSA_SIG_marshal(cbb: *mut CBB, sig: *const DSA_SIG) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// DSA_parse_public_key parses a DER-encoded DSA public key from `cbs` and
    /// advances `cbs`. It returns a newly-allocated `DSA` or NULL on error.
    pub fn DSA_parse_public_key(cbs: *mut CBS) -> *mut DSA;
}
unsafe extern "C" {
    /// DSA_marshal_public_key marshals `dsa` as a DER-encoded DSA public key and
    /// appends the result to `cbb`. It returns one on success and zero on
    /// failure.
    pub fn DSA_marshal_public_key(cbb: *mut CBB, dsa: *const DSA) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// DSA_parse_private_key parses a DER-encoded DSA private key from `cbs` and
    /// advances `cbs`. It returns a newly-allocated `DSA` or NULL on error.
    pub fn DSA_parse_private_key(cbs: *mut CBS) -> *mut DSA;
}
unsafe extern "C" {
    /// DSA_marshal_private_key marshals `dsa` as a DER-encoded DSA private key and
    /// appends the result to `cbb`. It returns one on success and zero on
    /// failure.
    pub fn DSA_marshal_private_key(cbb: *mut CBB, dsa: *const DSA) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// DSA_parse_parameters parses a DER-encoded Dss-Parms structure (RFC 3279)
    /// from `cbs` and advances `cbs`. It returns a newly-allocated `DSA` or NULL on
    /// error.
    pub fn DSA_parse_parameters(cbs: *mut CBS) -> *mut DSA;
}
unsafe extern "C" {
    /// DSA_marshal_parameters marshals `dsa` as a DER-encoded Dss-Parms structure
    /// (RFC 3279) and appends the result to `cbb`. It returns one on success and
    /// zero on failure.
    pub fn DSA_marshal_parameters(cbb: *mut CBB, dsa: *const DSA) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// DSA_dup_DH returns a `DH` constructed from the parameters of `dsa`. This is
    /// sometimes needed when Diffie-Hellman parameters are stored in the form of
    /// DSA parameters. It returns an allocated `DH` on success or NULL on error.
    pub fn DSA_dup_DH(dsa: *const DSA) -> *mut DH;
}
unsafe extern "C" {
    /// ex_data functions.
    ///
    /// See `ex_data.h` for details.
    pub fn DSA_get_ex_new_index(
        argl: ::core::ffi::c_long,
        argp: *mut ::core::ffi::c_void,
        unused: *mut CRYPTO_EX_unused,
        dup_unused: CRYPTO_EX_dup,
        free_func: CRYPTO_EX_free,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn DSA_set_ex_data(
        dsa: *mut DSA,
        idx: ::core::ffi::c_int,
        arg: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn DSA_get_ex_data(dsa: *const DSA, idx: ::core::ffi::c_int) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    /// d2i_DSA_SIG parses a DER-encoded DSA-Sig-Value structure from `len` bytes at
    /// `*inp`, as described in `d2i_SAMPLE`.
    ///
    /// Use `DSA_SIG_parse` instead.
    pub fn d2i_DSA_SIG(
        out_sig: *mut *mut DSA_SIG,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut DSA_SIG;
}
unsafe extern "C" {
    /// i2d_DSA_SIG marshals `in` to a DER-encoded DSA-Sig-Value structure, as
    /// described in `i2d_SAMPLE`.
    ///
    /// Use `DSA_SIG_marshal` instead.
    pub fn i2d_DSA_SIG(in_: *const DSA_SIG, outp: *mut *mut u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// d2i_DSAPublicKey parses a DER-encoded DSA public key from `len` bytes at
    /// `*inp`, as described in `d2i_SAMPLE`.
    ///
    /// Use `DSA_parse_public_key` instead.
    pub fn d2i_DSAPublicKey(
        out: *mut *mut DSA,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut DSA;
}
unsafe extern "C" {
    /// i2d_DSAPublicKey marshals `in` as a DER-encoded DSA public key, as described
    /// in `i2d_SAMPLE`.
    ///
    /// Use `DSA_marshal_public_key` instead.
    pub fn i2d_DSAPublicKey(in_: *const DSA, outp: *mut *mut u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// d2i_DSAPrivateKey parses a DER-encoded DSA private key from `len` bytes at
    /// `*inp`, as described in `d2i_SAMPLE`.
    ///
    /// Use `DSA_parse_private_key` instead.
    pub fn d2i_DSAPrivateKey(
        out: *mut *mut DSA,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut DSA;
}
unsafe extern "C" {
    /// i2d_DSAPrivateKey marshals `in` as a DER-encoded DSA private key, as
    /// described in `i2d_SAMPLE`.
    ///
    /// Use `DSA_marshal_private_key` instead.
    pub fn i2d_DSAPrivateKey(in_: *const DSA, outp: *mut *mut u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// d2i_DSAparams parses a DER-encoded Dss-Parms structure (RFC 3279) from `len`
    /// bytes at `*inp`, as described in `d2i_SAMPLE`.
    ///
    /// Use `DSA_parse_parameters` instead.
    pub fn d2i_DSAparams(
        out: *mut *mut DSA,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut DSA;
}
unsafe extern "C" {
    /// i2d_DSAparams marshals `in`'s parameters as a DER-encoded Dss-Parms structure
    /// (RFC 3279), as described in `i2d_SAMPLE`.
    ///
    /// Use `DSA_marshal_parameters` instead.
    pub fn i2d_DSAparams(in_: *const DSA, outp: *mut *mut u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// DSA_generate_parameters is a deprecated version of
    /// `DSA_generate_parameters_ex` that creates and returns a `DSA*`. Don't use
    /// it.
    pub fn DSA_generate_parameters(
        bits: ::core::ffi::c_int,
        seed: *mut ::core::ffi::c_uchar,
        seed_len: ::core::ffi::c_int,
        counter_ret: *mut ::core::ffi::c_int,
        h_ret: *mut ::core::ffi::c_ulong,
        callback: ::core::option::Option<
            unsafe extern "C" fn(
                arg1: ::core::ffi::c_int,
                arg2: ::core::ffi::c_int,
                arg3: *mut ::core::ffi::c_void,
            ),
        >,
        cb_arg: *mut ::core::ffi::c_void,
    ) -> *mut DSA;
}
#[repr(u32)]
/// point_conversion_form_t enumerates forms, as defined in X9.62 (ECDSA), for
/// the encoding of an elliptic curve point (x,y)
#[derive(Debug, Copy, Clone, Hash, PartialEq, Eq)]
pub enum point_conversion_form_t {
    /// POINT_CONVERSION_COMPRESSED indicates that the point is encoded as z||x,
    /// where the octet z specifies which solution of the quadratic equation y
    /// is.
    POINT_CONVERSION_COMPRESSED = 2,
    /// POINT_CONVERSION_UNCOMPRESSED indicates that the point is encoded as
    /// z||x||y, where z is the octet 0x04.
    POINT_CONVERSION_UNCOMPRESSED = 4,
    /// POINT_CONVERSION_HYBRID indicates that the point is encoded as z||x||y,
    /// where z specifies which solution of the quadratic equation y is. This is
    /// not supported by the code and has never been observed in use.
    ///
    /// TODO(agl): remove once node.js no longer references this.
    POINT_CONVERSION_HYBRID = 6,
}
unsafe extern "C" {
    /// EC_group_p224 returns an `EC_GROUP` for P-224, also known as secp224r1.
    pub fn EC_group_p224() -> *const EC_GROUP;
}
unsafe extern "C" {
    /// EC_group_p256 returns an `EC_GROUP` for P-256, also known as secp256r1 or
    /// prime256v1.
    pub fn EC_group_p256() -> *const EC_GROUP;
}
unsafe extern "C" {
    /// EC_group_p384 returns an `EC_GROUP` for P-384, also known as secp384r1.
    pub fn EC_group_p384() -> *const EC_GROUP;
}
unsafe extern "C" {
    /// EC_group_p521 returns an `EC_GROUP` for P-521, also known as secp521r1.
    pub fn EC_group_p521() -> *const EC_GROUP;
}
unsafe extern "C" {
    /// EC_GROUP_new_by_curve_name returns the `EC_GROUP` object for the elliptic
    /// curve specified by `nid`, or NULL on unsupported NID.  For OpenSSL
    /// compatibility, this function returns a non-const pointer which may be passed
    /// to `EC_GROUP_free`. However, the resulting object is actually static and
    /// calling `EC_GROUP_free` is optional.
    ///
    /// The supported NIDs are:
    /// - `NID_secp224r1` (P-224)
    /// - `NID_X9_62_prime256v1` (P-256)
    /// - `NID_secp384r1` (P-384)
    /// - `NID_secp521r1` (P-521)
    ///
    /// Calling this function causes all four curves to be linked into the binary.
    /// Prefer calling `EC_group_*` to allow the static linker to drop unused curves.
    ///
    /// If in doubt, use `NID_X9_62_prime256v1`, or see the curve25519.h header for
    /// more modern primitives.
    pub fn EC_GROUP_new_by_curve_name(nid: ::core::ffi::c_int) -> *mut EC_GROUP;
}
unsafe extern "C" {
    /// EC_GROUP_cmp returns zero if `a` and `b` are the same group and non-zero
    /// otherwise.
    pub fn EC_GROUP_cmp(
        a: *const EC_GROUP,
        b: *const EC_GROUP,
        ignored: *mut BN_CTX,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EC_GROUP_get0_generator returns a pointer to the internal `EC_POINT` object
    /// in `group` that specifies the generator for the group.
    pub fn EC_GROUP_get0_generator(group: *const EC_GROUP) -> *const EC_POINT;
}
unsafe extern "C" {
    /// EC_GROUP_get0_order returns a pointer to the internal `BIGNUM` object in
    /// `group` that specifies the order of the group.
    pub fn EC_GROUP_get0_order(group: *const EC_GROUP) -> *const BIGNUM;
}
unsafe extern "C" {
    /// EC_GROUP_order_bits returns the number of bits of the order of `group`.
    pub fn EC_GROUP_order_bits(group: *const EC_GROUP) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EC_GROUP_get_cofactor sets `*cofactor` to the cofactor of `group`. It returns
    /// one on success and zero otherwise. `ctx` is ignored and may be NULL.
    pub fn EC_GROUP_get_cofactor(
        group: *const EC_GROUP,
        cofactor: *mut BIGNUM,
        ctx: *mut BN_CTX,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EC_GROUP_get_curve_GFp gets various parameters about a group. It sets
    /// `*out_p` to the order of the coordinate field and `*out_a` and `*out_b` to
    /// the parameters of the curve when expressed as y² = x³ + ax + b. Any of the
    /// output parameters can be NULL. It returns one on success and zero on
    /// error. `ctx` is ignored and may be NULL.
    pub fn EC_GROUP_get_curve_GFp(
        group: *const EC_GROUP,
        out_p: *mut BIGNUM,
        out_a: *mut BIGNUM,
        out_b: *mut BIGNUM,
        ctx: *mut BN_CTX,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EC_GROUP_get_curve_name returns a NID that identifies `group`.
    pub fn EC_GROUP_get_curve_name(group: *const EC_GROUP) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EC_GROUP_get_degree returns the number of bits needed to represent an
    /// element of the field underlying `group`.
    pub fn EC_GROUP_get_degree(group: *const EC_GROUP) -> ::core::ffi::c_uint;
}
unsafe extern "C" {
    /// EC_curve_nid2nist returns the NIST name of the elliptic curve specified by
    /// `nid`, or NULL if `nid` is not a NIST curve. For example, it returns "P-256"
    /// for `NID_X9_62_prime256v1`.
    pub fn EC_curve_nid2nist(nid: ::core::ffi::c_int) -> *const ::core::ffi::c_char;
}
unsafe extern "C" {
    /// EC_curve_nist2nid returns the NID of the elliptic curve specified by the NIST
    /// name `name`, or `NID_undef` if `name` is not a recognized name. For example,
    /// it returns `NID_X9_62_prime256v1` for "P-256".
    pub fn EC_curve_nist2nid(name: *const ::core::ffi::c_char) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EC_POINT_new returns a fresh `EC_POINT` object in the given group, or NULL
    /// on error.
    pub fn EC_POINT_new(group: *const EC_GROUP) -> *mut EC_POINT;
}
unsafe extern "C" {
    /// EC_POINT_free frees `point` and the data that it points to.
    pub fn EC_POINT_free(point: *mut EC_POINT);
}
unsafe extern "C" {
    /// EC_POINT_copy sets `*dest` equal to `*src`. It returns one on success and
    /// zero otherwise.
    pub fn EC_POINT_copy(dest: *mut EC_POINT, src: *const EC_POINT) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EC_POINT_dup returns a fresh `EC_POINT` that contains the same values as
    /// `src`, or NULL on error.
    pub fn EC_POINT_dup(src: *const EC_POINT, group: *const EC_GROUP) -> *mut EC_POINT;
}
unsafe extern "C" {
    /// EC_POINT_set_to_infinity sets `point` to be the "point at infinity" for the
    /// given group.
    pub fn EC_POINT_set_to_infinity(
        group: *const EC_GROUP,
        point: *mut EC_POINT,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EC_POINT_is_at_infinity returns one iff `point` is the point at infinity and
    /// zero otherwise.
    pub fn EC_POINT_is_at_infinity(
        group: *const EC_GROUP,
        point: *const EC_POINT,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EC_POINT_is_on_curve returns one if `point` is an element of `group` and
    /// and zero otherwise or when an error occurs. This is different from OpenSSL,
    /// which returns -1 on error. `ctx` is ignored and may be NULL.
    pub fn EC_POINT_is_on_curve(
        group: *const EC_GROUP,
        point: *const EC_POINT,
        ctx: *mut BN_CTX,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EC_POINT_cmp returns zero if `a` is equal to `b`, greater than zero if
    /// not equal and -1 on error. `ctx` is ignored and may be NULL.
    pub fn EC_POINT_cmp(
        group: *const EC_GROUP,
        a: *const EC_POINT,
        b: *const EC_POINT,
        ctx: *mut BN_CTX,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EC_POINT_get_affine_coordinates_GFp sets `x` and `y` to the affine value of
    /// `point`. It returns one on success and zero otherwise. `ctx` is ignored and
    /// may be NULL.
    ///
    /// Either `x` or `y` may be NULL to skip computing that coordinate. This is
    /// slightly faster in the common case where only the x-coordinate is needed.
    pub fn EC_POINT_get_affine_coordinates_GFp(
        group: *const EC_GROUP,
        point: *const EC_POINT,
        x: *mut BIGNUM,
        y: *mut BIGNUM,
        ctx: *mut BN_CTX,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EC_POINT_get_affine_coordinates is an alias of
    /// `EC_POINT_get_affine_coordinates_GFp`.
    pub fn EC_POINT_get_affine_coordinates(
        group: *const EC_GROUP,
        point: *const EC_POINT,
        x: *mut BIGNUM,
        y: *mut BIGNUM,
        ctx: *mut BN_CTX,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EC_POINT_set_affine_coordinates_GFp sets the value of `point` to be
    /// (`x`, `y`). `ctx` is ignored and may be NULL. It returns one on success or
    /// zero on error. It's considered an error if the point is not on the curve.
    ///
    /// Note that the corresponding function in OpenSSL versions prior to 1.0.2s does
    /// not check if the point is on the curve. This is a security-critical check, so
    /// code additionally supporting OpenSSL should repeat the check with
    /// `EC_POINT_is_on_curve` or check for older OpenSSL versions with
    /// `OPENSSL_VERSION_NUMBER`.
    pub fn EC_POINT_set_affine_coordinates_GFp(
        group: *const EC_GROUP,
        point: *mut EC_POINT,
        x: *const BIGNUM,
        y: *const BIGNUM,
        ctx: *mut BN_CTX,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EC_POINT_set_affine_coordinates is an alias of
    /// `EC_POINT_set_affine_coordinates_GFp`.
    pub fn EC_POINT_set_affine_coordinates(
        group: *const EC_GROUP,
        point: *mut EC_POINT,
        x: *const BIGNUM,
        y: *const BIGNUM,
        ctx: *mut BN_CTX,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EC_POINT_point2oct serialises `point` into the X9.62 form given by `form`
    /// into, at most, `max_out` bytes at `buf`. It returns the number of bytes
    /// written or zero on error if `buf` is non-NULL, else the number of bytes
    /// needed. `ctx` is ignored and may be NULL.
    pub fn EC_POINT_point2oct(
        group: *const EC_GROUP,
        point: *const EC_POINT,
        form: point_conversion_form_t,
        buf: *mut u8,
        max_out: usize,
        ctx: *mut BN_CTX,
    ) -> usize;
}
unsafe extern "C" {
    /// EC_POINT_point2buf serialises `point` into the X9.62 form given by `form` to
    /// a newly-allocated buffer and sets `*out_buf` to point to it. It returns the
    /// length of the result on success or zero on error. The caller must release
    /// `*out_buf` with `OPENSSL_free` when done. `ctx` is ignored and may be NULL.
    pub fn EC_POINT_point2buf(
        group: *const EC_GROUP,
        point: *const EC_POINT,
        form: point_conversion_form_t,
        out_buf: *mut *mut u8,
        ctx: *mut BN_CTX,
    ) -> usize;
}
unsafe extern "C" {
    /// EC_POINT_point2cbb behaves like `EC_POINT_point2oct` but appends the
    /// serialised point to `cbb`. It returns one on success and zero on error. `ctx`
    /// is ignored and may be NULL.
    pub fn EC_POINT_point2cbb(
        out: *mut CBB,
        group: *const EC_GROUP,
        point: *const EC_POINT,
        form: point_conversion_form_t,
        ctx: *mut BN_CTX,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EC_POINT_oct2point sets `point` from `len` bytes of X9.62 format
    /// serialisation in `buf`. It returns one on success and zero on error. `ctx`
    /// may be NULL. It's considered an error if `buf` does not represent a point on
    /// the curve.
    pub fn EC_POINT_oct2point(
        group: *const EC_GROUP,
        point: *mut EC_POINT,
        buf: *const u8,
        len: usize,
        ctx: *mut BN_CTX,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EC_POINT_set_compressed_coordinates_GFp sets `point` to equal the point with
    /// the given `x` coordinate and the y coordinate specified by `y_bit` (see
    /// X9.62). It returns one on success and zero otherwise. `ctx` may be NULL.
    pub fn EC_POINT_set_compressed_coordinates_GFp(
        group: *const EC_GROUP,
        point: *mut EC_POINT,
        x: *const BIGNUM,
        y_bit: ::core::ffi::c_int,
        ctx: *mut BN_CTX,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EC_POINT_add sets `r` equal to `a` plus `b`. It returns one on success and
    /// zero otherwise. `ctx` is ignored and may be NULL.
    pub fn EC_POINT_add(
        group: *const EC_GROUP,
        r: *mut EC_POINT,
        a: *const EC_POINT,
        b: *const EC_POINT,
        ctx: *mut BN_CTX,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EC_POINT_dbl sets `r` equal to `a` plus `a`. It returns one on success and
    /// zero otherwise. `ctx` is ignored and may be NULL.
    pub fn EC_POINT_dbl(
        group: *const EC_GROUP,
        r: *mut EC_POINT,
        a: *const EC_POINT,
        ctx: *mut BN_CTX,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EC_POINT_invert sets `a` equal to minus `a`. It returns one on success and
    /// zero otherwise. `ctx` is ignored and may be NULL.
    pub fn EC_POINT_invert(
        group: *const EC_GROUP,
        a: *mut EC_POINT,
        ctx: *mut BN_CTX,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EC_POINT_mul sets r = generator*n + q*m. It returns one on success and zero
    /// otherwise. `ctx` may be NULL.
    pub fn EC_POINT_mul(
        group: *const EC_GROUP,
        r: *mut EC_POINT,
        n: *const BIGNUM,
        q: *const EC_POINT,
        m: *const BIGNUM,
        ctx: *mut BN_CTX,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EC_hash_to_curve_p256_xmd_sha256_sswu hashes `msg` to a point on `group` and
    /// writes the result to `out`, implementing the P256_XMD:SHA-256_SSWU_RO_ suite
    /// from RFC 9380. It returns one on success and zero on error.
    pub fn EC_hash_to_curve_p256_xmd_sha256_sswu(
        group: *const EC_GROUP,
        out: *mut EC_POINT,
        dst: *const u8,
        dst_len: usize,
        msg: *const u8,
        msg_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EC_hash_to_curve_p384_xmd_sha384_sswu hashes `msg` to a point on `group` and
    /// writes the result to `out`, implementing the P384_XMD:SHA-384_SSWU_RO_ suite
    /// from RFC 9380. It returns one on success and zero on error.
    pub fn EC_hash_to_curve_p384_xmd_sha384_sswu(
        group: *const EC_GROUP,
        out: *mut EC_POINT,
        dst: *const u8,
        dst_len: usize,
        msg: *const u8,
        msg_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EC_encode_to_curve_p256_xmd_sha256_sswu hashes `msg` to a point on `group`
    /// and writes the result to `out`, implementing the P256_XMD:SHA-256_SSWU_NU_
    /// suite from RFC 9380. It returns one on success and zero on error.
    ///
    /// This is a nonuniform encoding from byte strings to points in `group`. That
    /// is, the set of possible outputs is only a fraction of the points in `group`,
    /// and some points in this set are more likely to be output than others. See
    /// also RFC 9380, section 10.4
    pub fn EC_encode_to_curve_p256_xmd_sha256_sswu(
        group: *const EC_GROUP,
        out: *mut EC_POINT,
        dst: *const u8,
        dst_len: usize,
        msg: *const u8,
        msg_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EC_encode_to_curve_p384_xmd_sha384_sswu hashes `msg` to a point on `group`
    /// and writes the result to `out`, implementing the P384_XMD:SHA-384_SSWU_NU_
    /// suite from RFC 9380. It returns one on success and zero on error.
    ///
    /// This is a nonuniform encoding from byte strings to points in `group`. That
    /// is, the set of possible outputs is only a fraction of the points in `group`,
    /// and some points in this set are more likely to be output than others. See
    /// also RFC 9380, section 10.4
    pub fn EC_encode_to_curve_p384_xmd_sha384_sswu(
        group: *const EC_GROUP,
        out: *mut EC_POINT,
        dst: *const u8,
        dst_len: usize,
        msg: *const u8,
        msg_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EC_wpa3_sae_hash_to_curve_p256 hashes `salt` and `ikm` to a point on `group`
    /// and writes the result to `out`, implementing the WPA3 SAE hash-to-curve
    /// variant for P-256 defined in IEEE Std 802.11-2020, Section 12.4.4.2.3. It
    /// returns one on success and zero on error. `salt` is the HKDF-Extract salt,
    /// which is the SSID. `ikm` is the HKDF-Extract input, or password and
    /// identifier concatenation.
    pub fn EC_wpa3_sae_hash_to_curve_p256(
        group: *const EC_GROUP,
        out: *mut EC_POINT,
        salt: *const u8,
        salt_len: usize,
        ikm: *const u8,
        ikm_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EC_GROUP_free releases a reference to `group`, if `group` was created by
    /// `EC_GROUP_new_curve_GFp`. If `group` is static, it does nothing.
    ///
    /// This function exists for OpenSSL compatibility, and to manage dynamic
    /// `EC_GROUP`s constructed by `EC_GROUP_new_curve_GFp`. Callers that do not need
    /// either may ignore this function.
    pub fn EC_GROUP_free(group: *mut EC_GROUP);
}
unsafe extern "C" {
    /// EC_GROUP_dup increments `group`'s reference count and returns it, if `group`
    /// was created by `EC_GROUP_new_curve_GFp`. If `group` is static, it simply
    /// returns `group`.
    ///
    /// This function exists for OpenSSL compatibility, and to manage dynamic
    /// `EC_GROUP`s constructed by `EC_GROUP_new_curve_GFp`. Callers that do not need
    /// either may ignore this function.
    pub fn EC_GROUP_dup(group: *const EC_GROUP) -> *mut EC_GROUP;
}
unsafe extern "C" {
    /// EC_GROUP_new_curve_GFp creates a new, arbitrary elliptic curve group based
    /// on the equation y² = x³ + a·x + b. It returns the new group or NULL on
    /// error. The lifetime of the resulting object must be managed with
    /// `EC_GROUP_dup` and `EC_GROUP_free`.
    ///
    /// This new group has no generator. It is an error to use a generator-less group
    /// with any functions except for `EC_GROUP_free`, `EC_POINT_new`,
    /// `EC_POINT_set_affine_coordinates_GFp`, and `EC_GROUP_set_generator`.
    ///
    /// `EC_GROUP`s returned by this function will always compare as unequal via
    /// `EC_GROUP_cmp` (even to themselves). `EC_GROUP_get_curve_name` will always
    /// return `NID_undef`.
    ///
    /// This function is provided for compatibility with some legacy applications
    /// only. Avoid using arbitrary curves and use `EC_GROUP_new_by_curve_name`
    /// instead. This ensures the result meets preconditions necessary for
    /// elliptic curve algorithms to function correctly and securely.
    ///
    /// Given invalid parameters, this function may fail or it may return an
    /// `EC_GROUP` which breaks these preconditions. Subsequent operations may then
    /// return arbitrary, incorrect values. Callers should not pass
    /// attacker-controlled values to this function.
    pub fn EC_GROUP_new_curve_GFp(
        p: *const BIGNUM,
        a: *const BIGNUM,
        b: *const BIGNUM,
        ctx: *mut BN_CTX,
    ) -> *mut EC_GROUP;
}
unsafe extern "C" {
    /// EC_GROUP_set_generator sets the generator for `group` to `generator`, which
    /// must have the given order and cofactor. It may only be used with `EC_GROUP`
    /// objects returned by `EC_GROUP_new_curve_GFp` and may only be used once on
    /// each group. `generator` must have been created using `group`.
    pub fn EC_GROUP_set_generator(
        group: *mut EC_GROUP,
        generator: *const EC_POINT,
        order: *const BIGNUM,
        cofactor: *const BIGNUM,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EC_GROUP_get_order sets `*order` to the order of `group`, if it's not
    /// NULL. It returns one on success and zero otherwise. `ctx` is ignored and may
    /// be NULL. Use `EC_GROUP_get0_order` instead.
    pub fn EC_GROUP_get_order(
        group: *const EC_GROUP,
        order: *mut BIGNUM,
        ctx: *mut BN_CTX,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EC_GROUP_set_asn1_flag does nothing.
    pub fn EC_GROUP_set_asn1_flag(group: *mut EC_GROUP, flag: ::core::ffi::c_int);
}
unsafe extern "C" {
    /// EC_GROUP_get_asn1_flag returns `OPENSSL_EC_NAMED_CURVE`.
    pub fn EC_GROUP_get_asn1_flag(group: *const EC_GROUP) -> ::core::ffi::c_int;
}
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct ec_method_st {
    _unused: [u8; 0],
}
pub type EC_METHOD = ec_method_st;
unsafe extern "C" {
    /// EC_GROUP_method_of returns a dummy non-NULL pointer.
    pub fn EC_GROUP_method_of(group: *const EC_GROUP) -> *const EC_METHOD;
}
unsafe extern "C" {
    /// EC_METHOD_get_field_type returns NID_X9_62_prime_field.
    pub fn EC_METHOD_get_field_type(meth: *const EC_METHOD) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EC_GROUP_set_point_conversion_form aborts the process if `form` is not
    /// `POINT_CONVERSION_UNCOMPRESSED` and otherwise does nothing.
    pub fn EC_GROUP_set_point_conversion_form(group: *mut EC_GROUP, form: point_conversion_form_t);
}
/// EC_builtin_curve describes a supported elliptic curve.
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct EC_builtin_curve {
    pub nid: ::core::ffi::c_int,
    pub comment: *const ::core::ffi::c_char,
}
unsafe extern "C" {
    /// EC_get_builtin_curves writes at most `max_num_curves` elements to
    /// `out_curves` and returns the total number that it would have written, had
    /// `max_num_curves` been large enough.
    ///
    /// The `EC_builtin_curve` items describe the supported elliptic curves.
    pub fn EC_get_builtin_curves(out_curves: *mut EC_builtin_curve, max_num_curves: usize)
        -> usize;
}
unsafe extern "C" {
    /// EC_POINT_clear_free calls `EC_POINT_free`.
    pub fn EC_POINT_clear_free(point: *mut EC_POINT);
}
unsafe extern "C" {
    /// ENGINE_new returns an empty ENGINE that uses the default method for all
    /// algorithms.
    pub fn ENGINE_new() -> *mut ENGINE;
}
unsafe extern "C" {
    /// ENGINE_free decrements the reference counts for all methods linked from
    /// `engine` and frees `engine` itself. It returns one.
    pub fn ENGINE_free(engine: *mut ENGINE) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Method accessors.
    ///
    /// Method accessors take a method pointer and the size of the structure. The
    /// size allows for ABI compatibility in the case that the method structure is
    /// extended with extra elements at the end. Methods are always copied by the
    /// set functions.
    ///
    /// Set functions return one on success and zero on allocation failure.
    pub fn ENGINE_set_RSA_method(
        engine: *mut ENGINE,
        method: *const RSA_METHOD,
        method_size: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn ENGINE_get_RSA_method(engine: *const ENGINE) -> *mut RSA_METHOD;
}
unsafe extern "C" {
    pub fn ENGINE_set_ECDSA_method(
        engine: *mut ENGINE,
        method: *const ECDSA_METHOD,
        method_size: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn ENGINE_get_ECDSA_method(engine: *const ENGINE) -> *mut ECDSA_METHOD;
}
unsafe extern "C" {
    /// METHOD_ref increments the reference count of `method`. This is a no-op for
    /// now because all methods are currently static.
    pub fn METHOD_ref(method: *mut ::core::ffi::c_void);
}
unsafe extern "C" {
    /// METHOD_unref decrements the reference count of `method` and frees it if the
    /// reference count drops to zero. This is a no-op for now because all methods
    /// are currently static.
    pub fn METHOD_unref(method: *mut ::core::ffi::c_void);
}
/// openssl_method_common_st contains the common part of all method structures.
/// This must be the first member of all method structures.
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct openssl_method_common_st {
    /// dummy – not used.
    pub references: ::core::ffi::c_int,
    pub is_static: ::core::ffi::c_char,
}
unsafe extern "C" {
    /// EC_KEY_new returns a fresh `EC_KEY` object or NULL on error.
    pub fn EC_KEY_new() -> *mut EC_KEY;
}
unsafe extern "C" {
    /// EC_KEY_new_method acts the same as `EC_KEY_new`, but takes an explicit
    /// `ENGINE`.
    pub fn EC_KEY_new_method(engine: *const ENGINE) -> *mut EC_KEY;
}
unsafe extern "C" {
    /// EC_KEY_new_by_curve_name returns a fresh EC_KEY for group specified by `nid`
    /// or NULL on error.
    pub fn EC_KEY_new_by_curve_name(nid: ::core::ffi::c_int) -> *mut EC_KEY;
}
unsafe extern "C" {
    /// EC_KEY_free frees all the data owned by `key` and `key` itself.
    pub fn EC_KEY_free(key: *mut EC_KEY);
}
unsafe extern "C" {
    /// EC_KEY_dup returns a fresh copy of `src` or NULL on error.
    pub fn EC_KEY_dup(src: *const EC_KEY) -> *mut EC_KEY;
}
unsafe extern "C" {
    /// EC_KEY_up_ref increases the reference count of `key` and returns one. It does
    /// not mutate `key` for thread-safety purposes and may be used concurrently.
    pub fn EC_KEY_up_ref(key: *mut EC_KEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EC_KEY_is_opaque returns one if `key` is opaque and doesn't expose its key
    /// material. Otherwise it return zero.
    pub fn EC_KEY_is_opaque(key: *const EC_KEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EC_KEY_get0_group returns a pointer to the `EC_GROUP` object inside `key`.
    pub fn EC_KEY_get0_group(key: *const EC_KEY) -> *const EC_GROUP;
}
unsafe extern "C" {
    /// EC_KEY_set_group sets the `EC_GROUP` object that `key` will use to `group`.
    /// It returns one on success and zero if `key` is already configured with a
    /// different group.
    pub fn EC_KEY_set_group(key: *mut EC_KEY, group: *const EC_GROUP) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EC_KEY_get0_private_key returns a pointer to the private key inside `key`.
    pub fn EC_KEY_get0_private_key(key: *const EC_KEY) -> *const BIGNUM;
}
unsafe extern "C" {
    /// EC_KEY_set_private_key sets the private key of `key` to `priv`. It returns
    /// one on success and zero otherwise. `key` must already have had a group
    /// configured (see `EC_KEY_set_group` and `EC_KEY_new_by_curve_name`).
    pub fn EC_KEY_set_private_key(key: *mut EC_KEY, priv_: *const BIGNUM) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EC_KEY_get0_public_key returns a pointer to the public key point inside
    /// `key`.
    pub fn EC_KEY_get0_public_key(key: *const EC_KEY) -> *const EC_POINT;
}
unsafe extern "C" {
    /// EC_KEY_set_public_key sets the public key of `key` to `pub`, by copying it.
    /// It returns one on success and zero otherwise. `key` must already have had a
    /// group configured (see `EC_KEY_set_group` and `EC_KEY_new_by_curve_name`), and
    /// `pub` must also belong to that group, and must not be the point at infinity.
    pub fn EC_KEY_set_public_key(key: *mut EC_KEY, pub_: *const EC_POINT) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EC_KEY_get_enc_flags returns the encoding flags for `key`, which is a
    /// bitwise-OR of `EC_PKEY_*` values.
    pub fn EC_KEY_get_enc_flags(key: *const EC_KEY) -> ::core::ffi::c_uint;
}
unsafe extern "C" {
    /// EC_KEY_set_enc_flags sets the encoding flags for `key`, which is a
    /// bitwise-OR of `EC_PKEY_*` values.
    pub fn EC_KEY_set_enc_flags(key: *mut EC_KEY, flags: ::core::ffi::c_uint);
}
unsafe extern "C" {
    /// EC_KEY_get_conv_form returns the conversion form that will be used by
    /// `key`.
    pub fn EC_KEY_get_conv_form(key: *const EC_KEY) -> point_conversion_form_t;
}
unsafe extern "C" {
    /// EC_KEY_set_conv_form sets the conversion form to be used by `key`.
    pub fn EC_KEY_set_conv_form(key: *mut EC_KEY, cform: point_conversion_form_t);
}
unsafe extern "C" {
    /// EC_KEY_check_key performs several checks on `key` (possibly including an
    /// expensive check that the public key is in the primary subgroup). It returns
    /// one if all checks pass and zero otherwise. If it returns zero then detail
    /// about the problem can be found on the error stack.
    pub fn EC_KEY_check_key(key: *const EC_KEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EC_KEY_check_fips performs both a signing pairwise consistency test
    /// (FIPS 140-2 4.9.2) and the consistency test from SP 800-56Ar3 section
    /// 5.6.2.1.4. It returns one if it passes and zero otherwise.
    pub fn EC_KEY_check_fips(key: *const EC_KEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EC_KEY_set_public_key_affine_coordinates sets the public key in `key` to
    /// (`x`, `y`). It returns one on success and zero on error. It's considered an
    /// error if `x` and `y` do not represent a point on `key`'s curve.
    pub fn EC_KEY_set_public_key_affine_coordinates(
        key: *mut EC_KEY,
        x: *const BIGNUM,
        y: *const BIGNUM,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EC_KEY_oct2key decodes `len` bytes from `in` as an EC public key in X9.62
    /// form. `key` must already have a group configured. On success, it sets the
    /// public key in `key` to the result and returns one. Otherwise, it returns
    /// zero. `ctx` may be NULL.
    pub fn EC_KEY_oct2key(
        key: *mut EC_KEY,
        in_: *const u8,
        len: usize,
        ctx: *mut BN_CTX,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EC_KEY_key2buf behaves like `EC_POINT_point2buf`, except it encodes the
    /// public key in `key`. `ctx` is ignored and may be NULL.
    pub fn EC_KEY_key2buf(
        key: *const EC_KEY,
        form: point_conversion_form_t,
        out_buf: *mut *mut u8,
        ctx: *mut BN_CTX,
    ) -> usize;
}
unsafe extern "C" {
    /// EC_KEY_oct2priv decodes a big-endian, zero-padded integer from `len` bytes
    /// from `in` and sets `key`'s private key to the result. It returns one on
    /// success and zero on error. The input must be padded to the size of `key`'s
    /// group order.
    pub fn EC_KEY_oct2priv(key: *mut EC_KEY, in_: *const u8, len: usize) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EC_KEY_priv2oct serializes `key`'s private key as a big-endian integer,
    /// zero-padded to the size of `key`'s group order and writes the result to at
    /// most `max_out` bytes of `out`. It returns the number of bytes written on
    /// success and zero on error. If `out` is NULL, it returns the number of bytes
    /// needed without writing anything.
    pub fn EC_KEY_priv2oct(key: *const EC_KEY, out: *mut u8, max_out: usize) -> usize;
}
unsafe extern "C" {
    /// EC_KEY_priv2buf behaves like `EC_KEY_priv2oct` but sets `*out_buf` to a
    /// newly-allocated buffer containing the result. It returns the size of the
    /// result on success and zero on error. The caller must release `*out_buf` with
    /// `OPENSSL_free` when done.
    pub fn EC_KEY_priv2buf(key: *const EC_KEY, out_buf: *mut *mut u8) -> usize;
}
unsafe extern "C" {
    /// EC_KEY_generate_key generates a random, private key, calculates the
    /// corresponding public key and stores both in `key`. It returns one on success
    /// or zero otherwise.
    pub fn EC_KEY_generate_key(key: *mut EC_KEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EC_KEY_generate_key_fips behaves like `EC_KEY_generate_key` but performs
    /// additional checks for FIPS compliance. This function is applicable when
    /// generating keys for either signing/verification or key agreement because
    /// both types of consistency check (PCT) are performed.
    pub fn EC_KEY_generate_key_fips(key: *mut EC_KEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EC_KEY_derive_from_secret deterministically derives a private key for `group`
    /// from an input secret using HKDF-SHA256. It returns a newly-allocated `EC_KEY`
    /// on success or NULL on error. `secret` must not be used in any other
    /// algorithm. If using a base secret for multiple operations, derive separate
    /// values with a KDF such as HKDF first.
    ///
    /// Note this function implements an arbitrary derivation scheme, rather than any
    /// particular standard one. New protocols are recommended to use X25519 and
    /// Ed25519, which have standard byte import functions. See
    /// `X25519_public_from_private` and `ED25519_keypair_from_seed`.
    pub fn EC_KEY_derive_from_secret(
        group: *const EC_GROUP,
        secret: *const u8,
        secret_len: usize,
    ) -> *mut EC_KEY;
}
unsafe extern "C" {
    /// EC_KEY_parse_private_key parses a DER-encoded ECPrivateKey structure (RFC
    /// 5915) from `cbs` and advances `cbs`. It returns a newly-allocated `EC_KEY` or
    /// NULL on error. If `group` is non-null, the parameters field of the
    /// ECPrivateKey may be omitted (but must match `group` if present). Otherwise,
    /// the parameters field is required.
    pub fn EC_KEY_parse_private_key(cbs: *mut CBS, group: *const EC_GROUP) -> *mut EC_KEY;
}
unsafe extern "C" {
    /// EC_KEY_marshal_private_key marshals `key` as a DER-encoded ECPrivateKey
    /// structure (RFC 5915) and appends the result to `cbb`. It returns one on
    /// success and zero on failure. `enc_flags` is a combination of `EC_PKEY_*`
    /// values and controls whether corresponding fields are omitted.
    pub fn EC_KEY_marshal_private_key(
        cbb: *mut CBB,
        key: *const EC_KEY,
        enc_flags: ::core::ffi::c_uint,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EC_KEY_parse_curve_name parses a DER-encoded OBJECT IDENTIFIER as a curve
    /// name from `cbs` and advances `cbs`. It returns the decoded `EC_GROUP` or NULL
    /// on error.
    ///
    /// This function returns a non-const pointer which may be passed to
    /// `EC_GROUP_free`. However, the resulting object is actually static and calling
    /// `EC_GROUP_free` is optional.
    ///
    /// TODO(davidben): Make this return a const pointer, if it does not break too
    /// many callers.
    pub fn EC_KEY_parse_curve_name(cbs: *mut CBS) -> *mut EC_GROUP;
}
unsafe extern "C" {
    /// EC_KEY_marshal_curve_name marshals `group` as a DER-encoded OBJECT IDENTIFIER
    /// and appends the result to `cbb`. It returns one on success and zero on
    /// failure.
    pub fn EC_KEY_marshal_curve_name(cbb: *mut CBB, group: *const EC_GROUP) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EC_KEY_parse_parameters parses a DER-encoded ECParameters structure (RFC
    /// 5480) from `cbs` and advances `cbs`. It returns the resulting `EC_GROUP` or
    /// NULL on error. It supports the namedCurve and specifiedCurve options, but use
    /// of specifiedCurve is deprecated. Use `EC_KEY_parse_curve_name` instead.
    ///
    /// This function returns a non-const pointer which may be passed to
    /// `EC_GROUP_free`. However, the resulting object is actually static and calling
    /// `EC_GROUP_free` is optional.
    ///
    /// TODO(davidben): Make this return a const pointer, if it does not break too
    /// many callers.
    pub fn EC_KEY_parse_parameters(cbs: *mut CBS) -> *mut EC_GROUP;
}
unsafe extern "C" {
    /// ex_data functions.
    ///
    /// These functions are wrappers. See `ex_data.h` for details.
    pub fn EC_KEY_get_ex_new_index(
        argl: ::core::ffi::c_long,
        argp: *mut ::core::ffi::c_void,
        unused: *mut CRYPTO_EX_unused,
        dup_unused: CRYPTO_EX_dup,
        free_func: CRYPTO_EX_free,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn EC_KEY_set_ex_data(
        r: *mut EC_KEY,
        idx: ::core::ffi::c_int,
        arg: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn EC_KEY_get_ex_data(
        r: *const EC_KEY,
        idx: ::core::ffi::c_int,
    ) -> *mut ::core::ffi::c_void;
}
/// ecdsa_method_st is a structure of function pointers for implementing ECDSA.
/// See engine.h.
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct ecdsa_method_st {
    pub common: openssl_method_common_st,
    pub app_data: *mut ::core::ffi::c_void,
    pub init: ::core::option::Option<unsafe extern "C" fn(key: *mut EC_KEY) -> ::core::ffi::c_int>,
    pub finish:
        ::core::option::Option<unsafe extern "C" fn(key: *mut EC_KEY) -> ::core::ffi::c_int>,
    /// sign matches the arguments and behaviour of `ECDSA_sign`.
    pub sign: ::core::option::Option<
        unsafe extern "C" fn(
            digest: *const u8,
            digest_len: usize,
            sig: *mut u8,
            sig_len: *mut ::core::ffi::c_uint,
            eckey: *mut EC_KEY,
        ) -> ::core::ffi::c_int,
    >,
    pub flags: ::core::ffi::c_int,
}
unsafe extern "C" {
    /// EC_KEY_set_asn1_flag does nothing.
    pub fn EC_KEY_set_asn1_flag(key: *mut EC_KEY, flag: ::core::ffi::c_int);
}
unsafe extern "C" {
    /// d2i_ECPrivateKey parses a DER-encoded ECPrivateKey structure (RFC 5915) from
    /// `len` bytes at `*inp`, as described in `d2i_SAMPLE`. On input, if `*out_key`
    /// is non-NULL and has a group configured, the parameters field may be omitted
    /// but must match that group if present.
    ///
    /// Use `EC_KEY_parse_private_key` instead.
    pub fn d2i_ECPrivateKey(
        out_key: *mut *mut EC_KEY,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut EC_KEY;
}
unsafe extern "C" {
    /// i2d_ECPrivateKey marshals `key` as a DER-encoded ECPrivateKey structure (RFC
    /// 5915), as described in `i2d_SAMPLE`.
    ///
    /// Use `EC_KEY_marshal_private_key` instead.
    pub fn i2d_ECPrivateKey(key: *const EC_KEY, outp: *mut *mut u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// d2i_ECPKParameters parses a DER-encoded ECParameters structure (RFC 5480)
    /// from `len` bytes at `*inp`, as described in `d2i_SAMPLE`. For legacy reasons,
    /// it recognizes the specifiedCurve form, but only for curves that are already
    /// supported as named curves.
    ///
    /// Use `EC_KEY_parse_parameters` or `EC_KEY_parse_curve_name` instead.
    pub fn d2i_ECPKParameters(
        out: *mut *mut EC_GROUP,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut EC_GROUP;
}
unsafe extern "C" {
    /// i2d_ECPKParameters marshals `group` as a DER-encoded ECParameters structure
    /// (RFC 5480), as described in `i2d_SAMPLE`.
    ///
    /// Use `EC_KEY_marshal_curve_name` instead.
    pub fn i2d_ECPKParameters(group: *const EC_GROUP, outp: *mut *mut u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// d2i_ECParameters parses a DER-encoded ECParameters structure (RFC 5480) from
    /// `len` bytes at `*inp`, as described in `d2i_SAMPLE`. It returns the result as
    /// an `EC_KEY` with parameters, but no key, configured.
    ///
    /// Use `EC_KEY_parse_parameters` or `EC_KEY_parse_curve_name` instead.
    pub fn d2i_ECParameters(
        out_key: *mut *mut EC_KEY,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut EC_KEY;
}
unsafe extern "C" {
    /// i2d_ECParameters marshals `key`'s parameters as a DER-encoded OBJECT
    /// IDENTIFIER, as described in `i2d_SAMPLE`.
    ///
    /// Use `EC_KEY_marshal_curve_name` instead.
    pub fn i2d_ECParameters(key: *const EC_KEY, outp: *mut *mut u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// o2i_ECPublicKey parses an EC point from `len` bytes at `*inp` into
    /// `*out_key`. Note that this differs from the d2i format in that `*out_key`
    /// must be non-NULL with a group set. On successful exit, `*inp` is advanced by
    /// `len` bytes. It returns `*out_key` or NULL on error.
    ///
    /// Use `EC_POINT_oct2point` instead.
    pub fn o2i_ECPublicKey(
        out_key: *mut *mut EC_KEY,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut EC_KEY;
}
unsafe extern "C" {
    /// i2o_ECPublicKey marshals an EC point from `key`, as described in
    /// `i2d_SAMPLE`, except it returns zero on error instead of a negative value.
    ///
    /// Use `EC_POINT_point2cbb` instead.
    pub fn i2o_ECPublicKey(
        key: *const EC_KEY,
        outp: *mut *mut ::core::ffi::c_uchar,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ECDH_compute_key calculates the shared key between `pub_key` and `priv_key`.
    /// If `kdf` is not NULL, then it is called with the bytes of the shared key and
    /// the parameter `out`. When `kdf` returns, the value of `*outlen` becomes the
    /// return value. Otherwise, as many bytes of the shared key as will fit are
    /// copied directly to, at most, `outlen` bytes at `out`. It returns the number
    /// of bytes written to `out`, or -1 on error.
    pub fn ECDH_compute_key(
        out: *mut ::core::ffi::c_void,
        outlen: usize,
        pub_key: *const EC_POINT,
        priv_key: *const EC_KEY,
        kdf: ::core::option::Option<
            unsafe extern "C" fn(
                in_: *const ::core::ffi::c_void,
                inlen: usize,
                out: *mut ::core::ffi::c_void,
                outlen: *mut usize,
            ) -> *mut ::core::ffi::c_void,
        >,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ECDH_compute_key_fips calculates the shared key between `pub_key` and
    /// `priv_key` and hashes it with the appropriate SHA function for `out_len`. The
    /// only value values for `out_len` are thus 24 (SHA-224), 32 (SHA-256), 48
    /// (SHA-384), and 64 (SHA-512). It returns one on success and zero on error.
    ///
    /// Note that the return value is different to `ECDH_compute_key`: it returns an
    /// error flag (as is common for BoringSSL) rather than the number of bytes
    /// written.
    ///
    /// This function allows the FIPS module to compute an ECDH and KDF within the
    /// module boundary without taking an arbitrary function pointer for the KDF,
    /// which isn't very FIPSy.
    pub fn ECDH_compute_key_fips(
        out: *mut u8,
        out_len: usize,
        pub_key: *const EC_POINT,
        priv_key: *const EC_KEY,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ECDSA_sign signs `digest_len` bytes from `digest` with `key` and writes the
    /// resulting ASN.1-based signature to `sig`, which must have `ECDSA_size(key)`
    /// bytes of space. On successful exit, `*sig_len` is set to the actual number of
    /// bytes written. The `type` argument should be zero. It returns one on success
    /// and zero otherwise.
    ///
    /// WARNING: `digest` must be the output of some hash function on the data to be
    /// signed. Passing unhashed inputs will not result in a secure signature scheme.
    pub fn ECDSA_sign(
        type_: ::core::ffi::c_int,
        digest: *const u8,
        digest_len: usize,
        sig: *mut u8,
        sig_len: *mut ::core::ffi::c_uint,
        key: *const EC_KEY,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ECDSA_verify verifies that `sig_len` bytes from `sig` constitute a valid
    /// ASN.1-based signature by `key` of `digest`. (The `type` argument should be
    /// zero.) It returns one on success or zero if the signature is invalid or an
    /// error occurred.
    ///
    /// WARNING: `digest` must be the output of some hash function on the data to be
    /// verified. Passing unhashed inputs will not result in a secure signature
    /// scheme.
    pub fn ECDSA_verify(
        type_: ::core::ffi::c_int,
        digest: *const u8,
        digest_len: usize,
        sig: *const u8,
        sig_len: usize,
        key: *const EC_KEY,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ECDSA_size returns the maximum size of an ASN.1-based ECDSA signature using
    /// `key`. It returns zero if `key` is NULL or if it doesn't have a group set.
    pub fn ECDSA_size(key: *const EC_KEY) -> usize;
}
/// Low-level signing and verification.
///
/// Low-level functions handle signatures as `ECDSA_SIG` structures which allow
/// the two values in an ECDSA signature to be handled separately.
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct ecdsa_sig_st {
    pub r: *mut BIGNUM,
    pub s: *mut BIGNUM,
}
unsafe extern "C" {
    /// ECDSA_SIG_new returns a fresh `ECDSA_SIG` structure or NULL on error.
    pub fn ECDSA_SIG_new() -> *mut ECDSA_SIG;
}
unsafe extern "C" {
    /// ECDSA_SIG_free frees `sig` its member `BIGNUM`s.
    pub fn ECDSA_SIG_free(sig: *mut ECDSA_SIG);
}
unsafe extern "C" {
    /// ECDSA_SIG_get0_r returns the r component of `sig`.
    pub fn ECDSA_SIG_get0_r(sig: *const ECDSA_SIG) -> *const BIGNUM;
}
unsafe extern "C" {
    /// ECDSA_SIG_get0_s returns the s component of `sig`.
    pub fn ECDSA_SIG_get0_s(sig: *const ECDSA_SIG) -> *const BIGNUM;
}
unsafe extern "C" {
    /// ECDSA_SIG_get0 sets `*out_r` and `*out_s`, if non-NULL, to the two
    /// components of `sig`.
    pub fn ECDSA_SIG_get0(
        sig: *const ECDSA_SIG,
        out_r: *mut *const BIGNUM,
        out_s: *mut *const BIGNUM,
    );
}
unsafe extern "C" {
    /// ECDSA_SIG_set0 sets `sig`'s components to `r` and `s`, neither of which may
    /// be NULL. On success, it takes ownership of each argument and returns one.
    /// Otherwise, it returns zero.
    pub fn ECDSA_SIG_set0(
        sig: *mut ECDSA_SIG,
        r: *mut BIGNUM,
        s: *mut BIGNUM,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ECDSA_do_sign signs `digest_len` bytes from `digest` with `key` and returns
    /// the resulting signature structure, or NULL on error.
    ///
    /// WARNING: `digest` must be the output of some hash function on the data to be
    /// signed. Passing unhashed inputs will not result in a secure signature scheme.
    pub fn ECDSA_do_sign(
        digest: *const u8,
        digest_len: usize,
        key: *const EC_KEY,
    ) -> *mut ECDSA_SIG;
}
unsafe extern "C" {
    /// ECDSA_do_verify verifies that `sig` constitutes a valid signature by `key`
    /// of `digest`. It returns one on success or zero if the signature is invalid
    /// or on error.
    ///
    /// WARNING: `digest` must be the output of some hash function on the data to be
    /// verified. Passing unhashed inputs will not result in a secure signature
    /// scheme.
    pub fn ECDSA_do_verify(
        digest: *const u8,
        digest_len: usize,
        sig: *const ECDSA_SIG,
        key: *const EC_KEY,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ECDSA_SIG_parse parses a DER-encoded ECDSA-Sig-Value structure from `cbs` and
    /// advances `cbs`. It returns a newly-allocated `ECDSA_SIG` or NULL on error.
    pub fn ECDSA_SIG_parse(cbs: *mut CBS) -> *mut ECDSA_SIG;
}
unsafe extern "C" {
    /// ECDSA_SIG_from_bytes parses `in` as a DER-encoded ECDSA-Sig-Value structure.
    /// It returns a newly-allocated `ECDSA_SIG` structure or NULL on error.
    pub fn ECDSA_SIG_from_bytes(in_: *const u8, in_len: usize) -> *mut ECDSA_SIG;
}
unsafe extern "C" {
    /// ECDSA_SIG_marshal marshals `sig` as a DER-encoded ECDSA-Sig-Value and appends
    /// the result to `cbb`. It returns one on success and zero on error.
    pub fn ECDSA_SIG_marshal(cbb: *mut CBB, sig: *const ECDSA_SIG) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ECDSA_SIG_to_bytes marshals `sig` as a DER-encoded ECDSA-Sig-Value and, on
    /// success, sets `*out_bytes` to a newly allocated buffer containing the result
    /// and returns one. Otherwise, it returns zero. The result should be freed with
    /// `OPENSSL_free`.
    pub fn ECDSA_SIG_to_bytes(
        out_bytes: *mut *mut u8,
        out_len: *mut usize,
        sig: *const ECDSA_SIG,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ECDSA_SIG_max_len returns the maximum length of a DER-encoded ECDSA-Sig-Value
    /// structure for a group whose order is represented in `order_len` bytes, or
    /// zero on overflow.
    pub fn ECDSA_SIG_max_len(order_len: usize) -> usize;
}
unsafe extern "C" {
    /// ECDSA_sign_p1363 signs `digest_len` bytes from `digest` with `key` and writes
    /// the resulting P1363-based signature to `sig`, which must have
    /// `ECDSA_size_p1363(key)` bytes of space. On successful exit, `*out_sig_len` is
    /// set to the actual number of bytes written, which will always match
    /// `ECDSA_size_p1363(key)`. It returns one on success and zero otherwise.
    ///
    /// WARNING: `digest` must be the output of some hash function on the data to be
    /// signed. Passing unhashed inputs will not result in a secure signature scheme.
    pub fn ECDSA_sign_p1363(
        digest: *const u8,
        digest_len: usize,
        sig: *mut u8,
        out_sig_len: *mut usize,
        max_sig_len: usize,
        key: *const EC_KEY,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ECDSA_verify_p1363 verifies that `sig_len` bytes from `sig` constitute a
    /// valid P1363-based signature by `key` of `digest`. It returns one on success
    /// or zero if the signature is invalid or an error occurred.
    ///
    /// WARNING: `digest` must be the output of some hash function on the data to be
    /// verified. Passing unhashed inputs will not result in a secure signature
    /// scheme.
    pub fn ECDSA_verify_p1363(
        digest: *const u8,
        digest_len: usize,
        sig: *const u8,
        sig_len: usize,
        key: *const EC_KEY,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ECDSA_size_p1363 returns the size of a P1363-based ECDSA signature using
    /// `key`. It returns zero if `key` is NULL or if it doesn't have a group set.
    pub fn ECDSA_size_p1363(key: *const EC_KEY) -> usize;
}
unsafe extern "C" {
    /// ECDSA_sign_with_nonce_and_leak_private_key_for_testing behaves like
    /// `ECDSA_do_sign` but uses `nonce` for the ECDSA nonce 'k', instead of a random
    /// value. `nonce` is interpreted as a big-endian integer. It must be reduced
    /// modulo the group order and padded with zeros up to `BN_num_bytes(order)`
    /// bytes.
    ///
    /// WARNING: This function is only exported for testing purposes, when using test
    /// vectors or fuzzing strategies. It must not be used outside tests and may leak
    /// any private keys it is used with.
    pub fn ECDSA_sign_with_nonce_and_leak_private_key_for_testing(
        digest: *const u8,
        digest_len: usize,
        eckey: *const EC_KEY,
        nonce: *const u8,
        nonce_len: usize,
    ) -> *mut ECDSA_SIG;
}
unsafe extern "C" {
    /// d2i_ECDSA_SIG parses aa DER-encoded ECDSA-Sig-Value structure from `len`
    /// bytes at `*inp`, as described in `d2i_SAMPLE`.
    ///
    /// Use `ECDSA_SIG_parse` instead.
    pub fn d2i_ECDSA_SIG(
        out: *mut *mut ECDSA_SIG,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut ECDSA_SIG;
}
unsafe extern "C" {
    /// i2d_ECDSA_SIG marshals `sig` as a DER-encoded ECDSA-Sig-Value, as described
    /// in `i2d_SAMPLE`.
    ///
    /// Use `ECDSA_SIG_marshal` instead.
    pub fn i2d_ECDSA_SIG(sig: *const ECDSA_SIG, outp: *mut *mut u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_aead_aes_128_gcm is AES-128 in Galois Counter Mode.
    ///
    /// Note: AES-GCM should only be used with 12-byte (96-bit) nonces. Although it
    /// is specified to take a variable-length nonce, nonces with other lengths are
    /// effectively randomized, which means one must consider collisions. Unless
    /// implementing an existing protocol which has already specified incorrect
    /// parameters, only use 12-byte nonces.
    pub fn EVP_aead_aes_128_gcm() -> *const EVP_AEAD;
}
unsafe extern "C" {
    /// EVP_aead_aes_192_gcm is AES-192 in Galois Counter Mode.
    ///
    /// WARNING: AES-192 is superfluous and shouldn't exist. NIST should never have
    /// defined it. Use only when interop with another system requires it, never
    /// de novo.
    ///
    /// Note: AES-GCM should only be used with 12-byte (96-bit) nonces. Although it
    /// is specified to take a variable-length nonce, nonces with other lengths are
    /// effectively randomized, which means one must consider collisions. Unless
    /// implementing an existing protocol which has already specified incorrect
    /// parameters, only use 12-byte nonces.
    pub fn EVP_aead_aes_192_gcm() -> *const EVP_AEAD;
}
unsafe extern "C" {
    /// EVP_aead_aes_256_gcm is AES-256 in Galois Counter Mode.
    ///
    /// Note: AES-GCM should only be used with 12-byte (96-bit) nonces. Although it
    /// is specified to take a variable-length nonce, nonces with other lengths are
    /// effectively randomized, which means one must consider collisions. Unless
    /// implementing an existing protocol which has already specified incorrect
    /// parameters, only use 12-byte nonces.
    pub fn EVP_aead_aes_256_gcm() -> *const EVP_AEAD;
}
unsafe extern "C" {
    /// EVP_aead_chacha20_poly1305 is the AEAD built from ChaCha20 and
    /// Poly1305 as described in RFC 8439.
    pub fn EVP_aead_chacha20_poly1305() -> *const EVP_AEAD;
}
unsafe extern "C" {
    /// EVP_aead_xchacha20_poly1305 is ChaCha20-Poly1305 with an extended nonce that
    /// makes random generation of nonces safe.
    pub fn EVP_aead_xchacha20_poly1305() -> *const EVP_AEAD;
}
unsafe extern "C" {
    /// EVP_aead_aes_128_ctr_hmac_sha256 is AES-128 in CTR mode with HMAC-SHA256 for
    /// authentication. The nonce is 12 bytes; the bottom 32-bits are used as the
    /// block counter, thus the maximum plaintext size is 64GB.
    pub fn EVP_aead_aes_128_ctr_hmac_sha256() -> *const EVP_AEAD;
}
unsafe extern "C" {
    /// EVP_aead_aes_256_ctr_hmac_sha256 is AES-256 in CTR mode with HMAC-SHA256 for
    /// authentication. See `EVP_aead_aes_128_ctr_hmac_sha256` for details.
    pub fn EVP_aead_aes_256_ctr_hmac_sha256() -> *const EVP_AEAD;
}
unsafe extern "C" {
    /// EVP_aead_aes_128_gcm_siv is AES-128 in GCM-SIV mode. See RFC 8452.
    pub fn EVP_aead_aes_128_gcm_siv() -> *const EVP_AEAD;
}
unsafe extern "C" {
    /// EVP_aead_aes_256_gcm_siv is AES-256 in GCM-SIV mode. See RFC 8452.
    pub fn EVP_aead_aes_256_gcm_siv() -> *const EVP_AEAD;
}
unsafe extern "C" {
    /// EVP_aead_aes_128_gcm_randnonce is AES-128 in Galois Counter Mode with
    /// internal nonce generation. The 12-byte nonce is appended to the tag
    /// and is generated internally. The "tag", for the purpurses of the API, is thus
    /// 12 bytes larger. The nonce parameter when using this AEAD must be
    /// zero-length. Since the nonce is random, a single key should not be used for
    /// more than 2^32 seal operations.
    ///
    /// Warning: this is for use for FIPS compliance only. It is probably not
    /// suitable for other uses. Using standard AES-GCM AEADs allows one to achieve
    /// the same effect, but gives more control over nonce storage.
    pub fn EVP_aead_aes_128_gcm_randnonce() -> *const EVP_AEAD;
}
unsafe extern "C" {
    /// EVP_aead_aes_256_gcm_randnonce is AES-256 in Galois Counter Mode with
    /// internal nonce generation. The 12-byte nonce is appended to the tag
    /// and is generated internally. The "tag", for the purpurses of the API, is thus
    /// 12 bytes larger. The nonce parameter when using this AEAD must be
    /// zero-length. Since the nonce is random, a single key should not be used for
    /// more than 2^32 seal operations.
    ///
    /// Warning: this is for use for FIPS compliance only. It is probably not
    /// suitable for other uses. Using standard AES-GCM AEADs allows one to achieve
    /// the same effect, but gives more control over nonce storage.
    pub fn EVP_aead_aes_256_gcm_randnonce() -> *const EVP_AEAD;
}
unsafe extern "C" {
    /// EVP_aead_aes_128_ccm_bluetooth is AES-128-CCM with M=4 and L=2 (4-byte tags
    /// and 13-byte nonces), as described in the Bluetooth Core Specification v5.0,
    /// Volume 6, Part E, Section 1.
    pub fn EVP_aead_aes_128_ccm_bluetooth() -> *const EVP_AEAD;
}
unsafe extern "C" {
    /// EVP_aead_aes_128_ccm_bluetooth_8 is AES-128-CCM with M=8 and L=2 (8-byte tags
    /// and 13-byte nonces), as used in the Bluetooth Mesh Networking Specification
    /// v1.0.
    pub fn EVP_aead_aes_128_ccm_bluetooth_8() -> *const EVP_AEAD;
}
unsafe extern "C" {
    /// EVP_aead_aes_128_ccm_matter is AES-128-CCM with M=16 and L=2 (16-byte tags
    /// and 13-byte nonces), as used in the Matter specification.
    pub fn EVP_aead_aes_128_ccm_matter() -> *const EVP_AEAD;
}
unsafe extern "C" {
    /// EVP_has_aes_hardware returns one if we enable hardware support for fast and
    /// constant-time AES-GCM.
    pub fn EVP_has_aes_hardware() -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_aead_aes_128_eax is AES-128 in EAX mode. Nonce size is either 12 or 16
    /// bytes, tag length is 16 bytes.
    /// See https://doi.org/10.1007/978-3-540-25937-4_25.
    pub fn EVP_aead_aes_128_eax() -> *const EVP_AEAD;
}
unsafe extern "C" {
    /// EVP_aead_aes_256_eax is AES-256 in EAX mode. Nonce size is either 12 or 16
    /// bytes, tag length is 16 bytes.
    /// See https://doi.org/10.1007/978-3-540-25937-4_25.
    pub fn EVP_aead_aes_256_eax() -> *const EVP_AEAD;
}
unsafe extern "C" {
    /// EVP_AEAD_key_length returns the length, in bytes, of the keys used by
    /// `aead`.
    pub fn EVP_AEAD_key_length(aead: *const EVP_AEAD) -> usize;
}
unsafe extern "C" {
    /// EVP_AEAD_nonce_length returns the length, in bytes, of the per-message nonce
    /// for `aead`.
    pub fn EVP_AEAD_nonce_length(aead: *const EVP_AEAD) -> usize;
}
unsafe extern "C" {
    /// EVP_AEAD_max_overhead returns the maximum number of additional bytes added
    /// by the act of sealing data with `aead`.
    pub fn EVP_AEAD_max_overhead(aead: *const EVP_AEAD) -> usize;
}
unsafe extern "C" {
    /// EVP_AEAD_max_tag_len returns the maximum tag length when using `aead`. This
    /// is the largest value that can be passed as `tag_len` to
    /// `EVP_AEAD_CTX_init`.
    pub fn EVP_AEAD_max_tag_len(aead: *const EVP_AEAD) -> usize;
}
/// AEAD operations.
#[repr(C)]
#[derive(Copy, Clone)]
pub union evp_aead_ctx_st_state {
    pub opaque: [u8; 560usize],
    pub alignment: u64,
}
/// An evp_aead_ctx_st (typedefed as `EVP_AEAD_CTX` in base.h) represents an AEAD
/// algorithm configured with a specific key and message-independent IV.
#[repr(C)]
#[derive(Copy, Clone)]
pub struct evp_aead_ctx_st {
    pub aead: *const EVP_AEAD,
    pub state: evp_aead_ctx_st_state,
    /// tag_len may contain the actual length of the authentication tag if it is
    /// known at initialization time.
    pub tag_len: u8,
}
unsafe extern "C" {
    /// EVP_AEAD_CTX_zero sets an uninitialized `ctx` to the zero state. It must be
    /// initialized with `EVP_AEAD_CTX_init` before use. It is safe, but not
    /// necessary, to call `EVP_AEAD_CTX_cleanup` in this state. This may be used for
    /// more uniform cleanup of `EVP_AEAD_CTX`.
    pub fn EVP_AEAD_CTX_zero(ctx: *mut EVP_AEAD_CTX);
}
unsafe extern "C" {
    /// EVP_AEAD_CTX_new allocates an `EVP_AEAD_CTX`, calls `EVP_AEAD_CTX_init` and
    /// returns the `EVP_AEAD_CTX`, or NULL on error.
    pub fn EVP_AEAD_CTX_new(
        aead: *const EVP_AEAD,
        key: *const u8,
        key_len: usize,
        tag_len: usize,
    ) -> *mut EVP_AEAD_CTX;
}
unsafe extern "C" {
    /// EVP_AEAD_CTX_free calls `EVP_AEAD_CTX_cleanup` and `OPENSSL_free` on
    /// `ctx`.
    pub fn EVP_AEAD_CTX_free(ctx: *mut EVP_AEAD_CTX);
}
unsafe extern "C" {
    /// EVP_AEAD_CTX_init initializes `ctx` for the given AEAD algorithm. The `impl`
    /// argument is ignored and should be NULL. Authentication tags may be truncated
    /// by passing a size as `tag_len`. A `tag_len` of zero indicates the default
    /// tag length and this is defined as EVP_AEAD_DEFAULT_TAG_LENGTH for
    /// readability.
    ///
    /// Returns 1 on success. Otherwise returns 0 and pushes to the error stack. In
    /// the error case, you do not need to call `EVP_AEAD_CTX_cleanup`, but it's
    /// harmless to do so.
    pub fn EVP_AEAD_CTX_init(
        ctx: *mut EVP_AEAD_CTX,
        aead: *const EVP_AEAD,
        key: *const u8,
        key_len: usize,
        tag_len: usize,
        impl_: *mut ENGINE,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_AEAD_CTX_cleanup frees any data allocated by `ctx`. It is a no-op to
    /// call `EVP_AEAD_CTX_cleanup` on a `EVP_AEAD_CTX` that has been `memset` to
    /// all zeros.
    pub fn EVP_AEAD_CTX_cleanup(ctx: *mut EVP_AEAD_CTX);
}
unsafe extern "C" {
    /// EVP_AEAD_CTX_seal encrypts and authenticates `in_len` bytes from `in` and
    /// authenticates `ad_len` bytes from `ad` and writes the result to `out`. It
    /// returns one on success and zero otherwise.
    ///
    /// This function may be called concurrently with itself or any other seal/open
    /// function on the same `EVP_AEAD_CTX`.
    ///
    /// At most `max_out_len` bytes are written to `out` and, in order to ensure
    /// success, `max_out_len` should be `in_len` plus the result of
    /// `EVP_AEAD_max_overhead`. On successful return, `*out_len` is set to the
    /// actual number of bytes written.
    ///
    /// The length of `nonce`, `nonce_len`, must be equal to the result of
    /// `EVP_AEAD_nonce_length` for this AEAD.
    ///
    /// `EVP_AEAD_CTX_seal` never results in a partial output. If `max_out_len` is
    /// insufficient, zero will be returned. If any error occurs, `out` will be
    /// filled with zero bytes and `*out_len` set to zero.
    ///
    /// If `in` and `out` alias then `out` must be == `in`.
    pub fn EVP_AEAD_CTX_seal(
        ctx: *const EVP_AEAD_CTX,
        out: *mut u8,
        out_len: *mut usize,
        max_out_len: usize,
        nonce: *const u8,
        nonce_len: usize,
        in_: *const u8,
        in_len: usize,
        ad: *const u8,
        ad_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_AEAD_CTX_open authenticates `in_len` bytes from `in` and `ad_len` bytes
    /// from `ad` and decrypts at most `in_len` bytes into `out`. It returns one on
    /// success and zero otherwise.
    ///
    /// This function may be called concurrently with itself or any other seal/open
    /// function on the same `EVP_AEAD_CTX`.
    ///
    /// At most `in_len` bytes are written to `out`. In order to ensure success,
    /// `max_out_len` should be at least `in_len`. On successful return, `*out_len`
    /// is set to the actual number of bytes written.
    ///
    /// The length of `nonce`, `nonce_len`, must be equal to the result of
    /// `EVP_AEAD_nonce_length` for this AEAD.
    ///
    /// `EVP_AEAD_CTX_open` never results in a partial output. If `max_out_len` is
    /// insufficient, zero will be returned. If any error occurs, `out` will be
    /// filled with zero bytes and `*out_len` set to zero.
    ///
    /// If `in` and `out` alias then `out` must be == `in`.
    pub fn EVP_AEAD_CTX_open(
        ctx: *const EVP_AEAD_CTX,
        out: *mut u8,
        out_len: *mut usize,
        max_out_len: usize,
        nonce: *const u8,
        nonce_len: usize,
        in_: *const u8,
        in_len: usize,
        ad: *const u8,
        ad_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_AEAD_CTX_seal_scatter encrypts and authenticates `in_len` bytes from `in`
    /// and authenticates `ad_len` bytes from `ad`. It writes `in_len` bytes of
    /// ciphertext to `out` and the authentication tag to `out_tag`. It returns one
    /// on success and zero otherwise.
    ///
    /// This function may be called concurrently with itself or any other seal/open
    /// function on the same `EVP_AEAD_CTX`.
    ///
    /// Exactly `in_len` bytes are written to `out`, and up to
    /// `EVP_AEAD_max_overhead+extra_in_len` bytes to `out_tag`. On successful
    /// return, `*out_tag_len` is set to the actual number of bytes written to
    /// `out_tag`.
    ///
    /// `extra_in` may point to an additional plaintext input buffer if the cipher
    /// supports it. If present, `extra_in_len` additional bytes of plaintext are
    /// encrypted and authenticated, and the ciphertext is written (before the tag)
    /// to `out_tag`. `max_out_tag_len` must be sized to allow for the additional
    /// `extra_in_len` bytes.
    ///
    /// The length of `nonce`, `nonce_len`, must be equal to the result of
    /// `EVP_AEAD_nonce_length` for this AEAD.
    ///
    /// `EVP_AEAD_CTX_seal_scatter` never results in a partial output. If
    /// `max_out_tag_len` is insufficient, zero will be returned. If any error
    /// occurs, `out` and `out_tag` will be filled with zero bytes and `*out_tag_len`
    /// set to zero.
    ///
    /// If `in` and `out` alias then `out` must be == `in`. `out_tag` may not alias
    /// any other argument.
    pub fn EVP_AEAD_CTX_seal_scatter(
        ctx: *const EVP_AEAD_CTX,
        out: *mut u8,
        out_tag: *mut u8,
        out_tag_len: *mut usize,
        max_out_tag_len: usize,
        nonce: *const u8,
        nonce_len: usize,
        in_: *const u8,
        in_len: usize,
        extra_in: *const u8,
        extra_in_len: usize,
        ad: *const u8,
        ad_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_AEAD_CTX_open_gather decrypts and authenticates `in_len` bytes from `in`
    /// and authenticates `ad_len` bytes from `ad` using `in_tag_len` bytes of
    /// authentication tag from `in_tag`. If successful, it writes `in_len` bytes of
    /// plaintext to `out`. It returns one on success and zero otherwise.
    ///
    /// This function may be called concurrently with itself or any other seal/open
    /// function on the same `EVP_AEAD_CTX`.
    ///
    /// The length of `nonce`, `nonce_len`, must be equal to the result of
    /// `EVP_AEAD_nonce_length` for this AEAD.
    ///
    /// `EVP_AEAD_CTX_open_gather` never results in a partial output. If any error
    /// occurs, `out` will be filled with zero bytes.
    ///
    /// If `in` and `out` alias then `out` must be == `in`.
    pub fn EVP_AEAD_CTX_open_gather(
        ctx: *const EVP_AEAD_CTX,
        out: *mut u8,
        nonce: *const u8,
        nonce_len: usize,
        in_: *const u8,
        in_len: usize,
        in_tag: *const u8,
        in_tag_len: usize,
        ad: *const u8,
        ad_len: usize,
    ) -> ::core::ffi::c_int;
}
/// crypto_ivec_st (aka `CRYPTO_IVEC`) combines a pointer to input data with its
/// length. It is usually passed as an array of length of at most
/// `CRYPTO_IOVEC_MAX`.
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct crypto_ivec_st {
    pub in_: *const u8,
    pub len: usize,
}
/// crypto_iovec_st (aka `CRYPTO_IOVEC` combines a pointer to input data and a
/// pointer to an output buffer with their common length. It is usually passed
/// as an array of length of at most `CRYPTO_IOVEC_MAX`.
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct crypto_iovec_st {
    /// `out` and `in` must be disjoint or equal
    pub out: *mut u8,
    pub in_: *const u8,
    pub len: usize,
}
unsafe extern "C" {
    /// EVP_AEAD_CTX_sealv encrypts and authenticates the `in` bytes from `iovec`
    /// and authenticates the `aadvec` bytes. It writes the same amount of
    /// ciphertext to the `out` pointers of `iovec` and the authentication tag to
    /// `out_tag`. It returns one on success and zero otherwise.
    ///
    /// This function computes the same output as `EVP_AEAD_CTX_seal_scatter`, but
    /// without requiring the input or output to be a contiguous buffer. The
    /// individual input and output pieces are logically concatenated for a single
    /// operation; their boundaries are not semantically significant and will not
    /// impact the output.
    ///
    /// This function may be called concurrently with itself or any other seal/open
    /// function on the same `EVP_AEAD_CTX`.
    ///
    /// Exactly `len` bytes are written to each `out` member of the `iovec`, and up
    /// to `EVP_AEAD_max_overhead+extra_in_len` bytes to `out_tag`. On successful
    /// return, `*out_tag_len` is set to the actual number of bytes written to
    /// `out_tag`.
    ///
    /// The length of `nonce`, `nonce_len`, must be equal to the result of
    /// `EVP_AEAD_nonce_length` for this AEAD.
    ///
    /// `EVP_AEAD_CTX_sealv` never results in a partial output. If `max_out_tag_len`
    /// is insufficient, zero will be returned. If any error occurs, the `out`
    /// members of the `iovec` and `out_tag` will be filled with zero bytes and
    /// `*out_tag_len` set to zero.
    ///
    /// No output pointer may alias any other pointer passed to this function either
    /// directly or via `iovec` and `aadvec`, with the one exception that it is
    /// permitted for the same `iovec` member's `in` and `out` members to be equal
    /// (in-place operation).
    ///
    /// `num_iovec` and `num_aadvec` must be <= `CRYPTO_IOVEC_MAX`.
    pub fn EVP_AEAD_CTX_sealv(
        ctx: *const EVP_AEAD_CTX,
        iovec: *const CRYPTO_IOVEC,
        num_iovec: usize,
        out_tag: *mut u8,
        out_tag_len: *mut usize,
        max_out_tag_len: usize,
        nonce: *const u8,
        nonce_len: usize,
        aadvec: *const CRYPTO_IVEC,
        num_aadvec: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_AEAD_CTX_openv authenticates the `in` bytes from `iovec` and `aadvec`,
    /// and decrypts the `in` bytes to the `out` pointers of `iovec`. It returns one
    /// on success and zero otherwise.
    ///
    /// This function computes the same output as `EVP_AEAD_CTX_open`, but without
    /// requiring the input or output to be a contiguous buffer. The individual
    /// input and output pieces are logically concatenated for a single operation;
    /// their boundaries are not semantically significant and will not impact the
    /// output.
    ///
    /// This function may (and usually will) output less than the total length of
    /// `iovec`. In this case, it outputs to a prefix of `iovec`'s output space,
    /// then returns the length of what was actually written.
    ///
    /// In AEADs with a fixed-length authentication tag, the tag is treated as if it
    /// were appended to the ciphertext, and successful outputs will always be
    /// exactly the tag length shorter. To open with a separate, detached tag,
    /// either provide it as a separate `CRYPTO_IOVEC`, or use
    /// `EVP_AEAD_CTX_openv_detached`. The latter may be more convenient, one does
    /// not need consider the possibility of output to the final `CRYPTO_IOVEC`.
    ///
    /// This function may be called concurrently with itself or any other seal/open
    /// function on the same `EVP_AEAD_CTX`.
    ///
    /// The length of `nonce`, `nonce_len`, must be equal to the result of
    /// `EVP_AEAD_nonce_length` for this AEAD.
    ///
    /// `EVP_AEAD_CTX_openv` never results in a partial output. If any error occurs,
    /// `out` will be filled with zero bytes and `*out_len` set to zero.
    ///
    /// No output pointer may alias any other pointer passed to this function either
    /// directly or via `iovec` and `aadvec`, with the one exception that it is
    /// permitted for the same `iovec` member's `in` and `out` members to be equal
    /// (in-place operation).
    ///
    /// `num_iovec` and `num_aadvec` must be <= `CRYPTO_IOVEC_MAX`.
    pub fn EVP_AEAD_CTX_openv(
        ctx: *const EVP_AEAD_CTX,
        iovec: *const CRYPTO_IOVEC,
        num_iovec: usize,
        out_total_bytes: *mut usize,
        nonce: *const u8,
        nonce_len: usize,
        aadvec: *const CRYPTO_IVEC,
        num_aadvec: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_AEAD_CTX_openv_detached authenticates the `in` bytes from `iovec` and
    /// `aadvec` using `in_tag_len` bytes of authentication tag from `in_tag`. If
    /// successful, it writes the plaintext of the `in` bytes to the `out` pointers
    /// of `iovec`. It returns one on success and zero otherwise.
    ///
    /// This function is usable with AEADs whose output can be split into a
    /// ciphertext portion, with the same length as the plaintext, and a
    /// fixed-length authentication tag. If the AEAD has a variable-length overhead,
    /// this function will return zero. Such AEADs can only be used with
    /// `EVP_AEAD_CTX_openv`.
    ///
    /// This function computes the same output as `EVP_AEAD_CTX_open`, but with a
    /// detached tag and without requiring the input or output to be a contiguous
    /// buffer. The individual input and output pieces are logically concatenated
    /// for a single operation; their boundaries are not semantically significant
    /// and will not impact the output.
    ///
    /// This function may be called concurrently with itself or any other seal/open
    /// function on the same `EVP_AEAD_CTX`.
    ///
    /// The length of `nonce`, `nonce_len`, must be equal to the result of
    /// `EVP_AEAD_nonce_length` for this AEAD.
    ///
    /// `EVP_AEAD_CTX_openv_detached` never results in a partial output. If any
    /// error occurs, `out` will be filled with zero bytes.
    ///
    /// No output pointer may alias any other pointer passed to this function either
    /// directly or via `iovec` and `aadvec`, with the one exception that it is
    /// permitted for the same `iovec` member's `in` and `out` members to be equal
    /// (in-place operation).
    ///
    /// `num_iovec` and `num_aadvec` must be <= `CRYPTO_IOVEC_MAX`.
    pub fn EVP_AEAD_CTX_openv_detached(
        ctx: *const EVP_AEAD_CTX,
        iovec: *const CRYPTO_IOVEC,
        num_iovec: usize,
        nonce: *const u8,
        nonce_len: usize,
        in_tag: *const u8,
        in_tag_len: usize,
        aadvec: *const CRYPTO_IVEC,
        num_aadvec: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_AEAD_CTX_aead returns the underlying AEAD for `ctx`, or NULL if one has
    /// not been set.
    pub fn EVP_AEAD_CTX_aead(ctx: *const EVP_AEAD_CTX) -> *const EVP_AEAD;
}
unsafe extern "C" {
    /// The following functions implement legacy TLS CBC cipher suites.
    ///
    /// WARNING: These functions are effectively internal implementation details of
    /// libssl, not general-purpose constructions. They are not true AEADs and differ
    /// from a normal `EVP_AEAD` in many ways:
    ///
    /// * They must be initialized with `EVP_AEAD_CTX_init_with_direction`, not
    ///   `EVP_AEAD_CTX_init`.
    ///
    /// * The resulting `EVP_AEAD_CTX`s are stateful. Neither `EVP_AEAD_CTX_open*`
    ///   nor `EVP_AEAD_CTX_seal*` can be called concurrently.
    ///
    /// * The `ad` parameter must have length 11 (the standard TLS one with length
    ///   omitted).
    ///
    /// * The `nonce` parameter is used as a CBC IV and must be unpredictable, not
    ///   just unique.
    ///
    /// * The `*_implicit_iv` variants implicitly set the IV to the last block of the
    ///   previous message. They are vulnerable the BEAST attack unless the caller
    ///   applies record-splitting mitigations externally.
    pub fn EVP_aead_aes_128_cbc_sha1_tls() -> *const EVP_AEAD;
}
unsafe extern "C" {
    pub fn EVP_aead_aes_128_cbc_sha1_tls_implicit_iv() -> *const EVP_AEAD;
}
unsafe extern "C" {
    pub fn EVP_aead_aes_128_cbc_sha256_tls() -> *const EVP_AEAD;
}
unsafe extern "C" {
    pub fn EVP_aead_aes_256_cbc_sha1_tls() -> *const EVP_AEAD;
}
unsafe extern "C" {
    pub fn EVP_aead_aes_256_cbc_sha1_tls_implicit_iv() -> *const EVP_AEAD;
}
unsafe extern "C" {
    pub fn EVP_aead_des_ede3_cbc_sha1_tls() -> *const EVP_AEAD;
}
unsafe extern "C" {
    pub fn EVP_aead_des_ede3_cbc_sha1_tls_implicit_iv() -> *const EVP_AEAD;
}
unsafe extern "C" {
    /// The following functions behave like `EVP_aead_aes_128_gcm` or
    /// `EVP_aead_aes_256_gcm`, except that seal operations fail if nonces do not
    /// match the TLS 1.2 or TLS 1.3 nonce construction.
    ///
    /// These functions are only applicable for callers that want an extra AEAD-level
    /// nonce check. `EVP_aead_aes_128_gcm` and `EVP_aead_aes_256_gcm` are otherwise
    /// suitable for implementing TLS and will produce the same output.
    ///
    /// WARNING: `EVP_AEAD_CTX` objects initialized with these `EVP_AEAD`s are
    /// stateful. `EVP_AEAD_CTX_seal*` cannot be called concurrently.
    pub fn EVP_aead_aes_128_gcm_tls12() -> *const EVP_AEAD;
}
unsafe extern "C" {
    pub fn EVP_aead_aes_256_gcm_tls12() -> *const EVP_AEAD;
}
unsafe extern "C" {
    pub fn EVP_aead_aes_128_gcm_tls13() -> *const EVP_AEAD;
}
unsafe extern "C" {
    pub fn EVP_aead_aes_256_gcm_tls13() -> *const EVP_AEAD;
}
pub const evp_aead_direction_t_evp_aead_open: evp_aead_direction_t = 0;
pub const evp_aead_direction_t_evp_aead_seal: evp_aead_direction_t = 1;
/// evp_aead_direction_t denotes the direction of an AEAD operation.
pub type evp_aead_direction_t = ::core::ffi::c_uint;
unsafe extern "C" {
    /// EVP_AEAD_CTX_init_with_direction calls `EVP_AEAD_CTX_init` for normal
    /// AEADs. For TLS-specific AEADs, it initializes `ctx` for a given direction.
    pub fn EVP_AEAD_CTX_init_with_direction(
        ctx: *mut EVP_AEAD_CTX,
        aead: *const EVP_AEAD,
        key: *const u8,
        key_len: usize,
        tag_len: usize,
        dir: evp_aead_direction_t,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_AEAD_CTX_get_iv sets `*out_len` to the length of the IV for `ctx` and
    /// sets `*out_iv` to point to that many bytes of the current IV. This is only
    /// meaningful for AEADs with implicit IVs (i.e. CBC mode in TLS 1.0).
    ///
    /// It returns one on success or zero on error.
    pub fn EVP_AEAD_CTX_get_iv(
        ctx: *const EVP_AEAD_CTX,
        out_iv: *mut *const u8,
        out_len: *mut usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_AEAD_CTX_tag_len computes the exact byte length of the tag written by
    /// `EVP_AEAD_CTX_seal_scatter` and writes it to `*out_tag_len`. It returns one
    /// on success or zero on error. `in_len` and `extra_in_len` must equal the
    /// arguments of the same names passed to `EVP_AEAD_CTX_seal_scatter`.
    ///
    /// To compute the exact byte length of the output written by
    /// `EVP_AEAD_CTX_seal`, set `extra_in_len` to zero and add `in_len` to the
    /// result.
    ///
    /// To compute the exact byte length of the tag written by `EVP_AEAD_CTX_sealv`,
    /// set `in_len` to the sum of `len` over the entire `iovec`, and set
    /// `extra_in_len` to zero.
    pub fn EVP_AEAD_CTX_tag_len(
        ctx: *const EVP_AEAD_CTX,
        out_tag_len: *mut usize,
        in_len: usize,
        extra_in_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_new creates a new, empty public-key object and returns it or NULL
    /// on allocation failure.
    pub fn EVP_PKEY_new() -> *mut EVP_PKEY;
}
unsafe extern "C" {
    /// EVP_PKEY_free decrements the reference count of `pkey` and frees it if the
    /// reference count drops to zero.
    pub fn EVP_PKEY_free(pkey: *mut EVP_PKEY);
}
unsafe extern "C" {
    /// EVP_PKEY_up_ref increments the reference count of `pkey` and returns one. It
    /// does not mutate `pkey` for thread-safety purposes and may be used
    /// concurrently.
    pub fn EVP_PKEY_up_ref(pkey: *mut EVP_PKEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_dup_ref increments the reference count of `pkey` and returns `pkey`.
    /// The caller must call `EVP_PKEY_free` on the result to release the reference.
    ///
    /// WARNING: Although the result is non-const for use with `EVP_PKEY_free`, it is
    /// still shared with other parts of the application that share the same object.
    /// Avoid mutating shared `EVP_PKEY`s.
    pub fn EVP_PKEY_dup_ref(pkey: *const EVP_PKEY) -> *mut EVP_PKEY;
}
unsafe extern "C" {
    /// EVP_PKEY_is_opaque returns one if `pkey` is opaque. Opaque keys are backed by
    /// custom implementations which do not expose key material and parameters. It is
    /// an error to attempt to duplicate, export, or compare an opaque key.
    pub fn EVP_PKEY_is_opaque(pkey: *const EVP_PKEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_eq compares `a` and `b` and returns one if their public keys are
    /// equal and zero otherwise.
    pub fn EVP_PKEY_eq(a: *const EVP_PKEY, b: *const EVP_PKEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_copy_parameters sets the parameters of `to` to equal the parameters
    /// of `from`. It returns one on success and zero on error.
    pub fn EVP_PKEY_copy_parameters(to: *mut EVP_PKEY, from: *const EVP_PKEY)
        -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_missing_parameters returns one if `pkey` is missing needed
    /// parameters or zero if not, or if the algorithm doesn't take parameters.
    pub fn EVP_PKEY_missing_parameters(pkey: *const EVP_PKEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_parameters_eq compares the parameters of `a` and `b`. It returns one
    /// if they match and zero otherwise. In algorithms that do not use parameters,
    /// this function returns one; null parameters are vacuously equal.
    pub fn EVP_PKEY_parameters_eq(a: *const EVP_PKEY, b: *const EVP_PKEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_size returns the maximum size, in bytes, of a signature signed by
    /// `pkey`. For an RSA key, this returns the number of bytes needed to represent
    /// the modulus. For an EC key, this returns the maximum size of a DER-encoded
    /// ECDSA signature.
    pub fn EVP_PKEY_size(pkey: *const EVP_PKEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_bits returns the "size", in bits, of `pkey`. For an RSA key, this
    /// returns the bit length of the modulus. For an EC key, this returns the bit
    /// length of the group order.
    pub fn EVP_PKEY_bits(pkey: *const EVP_PKEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_has_public returns one if `pkey` has a public key, or zero
    /// otherwise.
    pub fn EVP_PKEY_has_public(pkey: *const EVP_PKEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_has_private returns one if `pkey` has a private key, or zero
    /// otherwise.
    pub fn EVP_PKEY_has_private(pkey: *const EVP_PKEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_copy_public returns a newly-allocated `EVP_PKEY` that contains only
    /// the public key of `pkey`, or NULL on error. Parameters, if relevant for the
    /// key type, are also copied.
    pub fn EVP_PKEY_copy_public(pkey: *const EVP_PKEY) -> *mut EVP_PKEY;
}
unsafe extern "C" {
    /// EVP_PKEY_id returns the type of `pkey`, which is one of the `EVP_PKEY_*`
    /// values above. These type values generally correspond to the algorithm OID,
    /// but not the parameters, of a SubjectPublicKeyInfo (RFC 5280) or
    /// PrivateKeyInfo (RFC 5208) AlgorithmIdentifier. Algorithm parameters can be
    /// inspected with algorithm-specific accessors, e.g.
    /// `EVP_PKEY_get_ec_curve_nid`.
    pub fn EVP_PKEY_id(pkey: *const EVP_PKEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_pkey_rsa implements RSA keys (RFC 8017), encoded as rsaEncryption (RFC
    /// 3279, Section 2.3.1). The rsaEncryption encoding is confusingly named: these
    /// keys are used for all RSA operations, including signing. The `EVP_PKEY_id`
    /// value is `EVP_PKEY_RSA`.
    ///
    /// WARNING: This `EVP_PKEY_ALG` accepts all RSA key sizes supported by
    /// BoringSSL. When parsing RSA keys, callers should check the size is within
    /// their desired bounds with `EVP_PKEY_bits`. RSA public key operations scale
    /// quadratically and RSA private key operations scale cubicly, so key sizes may
    /// be a DoS vector.
    pub fn EVP_pkey_rsa() -> *const EVP_PKEY_ALG;
}
unsafe extern "C" {
    /// EVP_pkey_ec_* implement EC keys, encoded as id-ecPublicKey (RFC 5480,
    /// Section 2.1.1). The id-ecPublicKey encoding is confusingly named: it is also
    /// used for private keys (RFC 5915). The `EVP_PKEY_id` value is `EVP_PKEY_EC`.
    ///
    /// Each function only supports the specified curve, but curves are not reflected
    /// in `EVP_PKEY_id`. The curve can be inspected with
    /// `EVP_PKEY_get_ec_curve_nid`.
    pub fn EVP_pkey_ec_p224() -> *const EVP_PKEY_ALG;
}
unsafe extern "C" {
    pub fn EVP_pkey_ec_p256() -> *const EVP_PKEY_ALG;
}
unsafe extern "C" {
    pub fn EVP_pkey_ec_p384() -> *const EVP_PKEY_ALG;
}
unsafe extern "C" {
    pub fn EVP_pkey_ec_p521() -> *const EVP_PKEY_ALG;
}
unsafe extern "C" {
    /// EVP_pkey_x25519 implements X25519 keys (RFC 7748), encoded as in RFC 8410.
    /// The `EVP_PKEY_id` value is `EVP_PKEY_X25519`.
    pub fn EVP_pkey_x25519() -> *const EVP_PKEY_ALG;
}
unsafe extern "C" {
    /// EVP_pkey_ed25519 implements Ed25519 keys (RFC 8032), encoded as in RFC 8410.
    /// The `EVP_PKEY_id` value is `EVP_PKEY_ED25519`.
    pub fn EVP_pkey_ed25519() -> *const EVP_PKEY_ALG;
}
unsafe extern "C" {
    /// EVP_pkey_ml_dsa_* implement ML-DSA keys, encoded as in RFC 9881. The
    /// `EVP_PKEY_id` values are `EVP_PKEY_ML_DSA_*`. In the private key
    /// representation, only the "seed" form is serialized or parsed.
    ///
    /// To configure OpenSSL to output the standard "seed" form, configure the
    /// "ml-dsa.output_formats" provider parameter so that "seed-only" is first. This
    /// can be done programmatically with OpenSSL's
    /// `OSSL_PROVIDER_add_conf_parameter` function, or by passing "-provparam" to
    /// the command-line tool.
    pub fn EVP_pkey_ml_dsa_44() -> *const EVP_PKEY_ALG;
}
unsafe extern "C" {
    pub fn EVP_pkey_ml_dsa_65() -> *const EVP_PKEY_ALG;
}
unsafe extern "C" {
    pub fn EVP_pkey_ml_dsa_87() -> *const EVP_PKEY_ALG;
}
unsafe extern "C" {
    /// EVP_pkey_ml_kem_* implement ML-KEM keys, encoded as in RFC 9935. The
    /// `EVP_PKEY_id` values are `EVP_PKEY_ML_KEM_*`. In the private key
    /// representation, only the "seed" form is serialized or parsed.
    ///
    /// To configure OpenSSL to output the standard "seed" form, configure the
    /// "ml-kem.output_formats" provider parameter so that "seed-only" is first. This
    /// can be done programmatically with OpenSSL's
    /// `OSSL_PROVIDER_add_conf_parameter` function, or by passing "-provparam" to
    /// the command-line tool.
    pub fn EVP_pkey_ml_kem_768() -> *const EVP_PKEY_ALG;
}
unsafe extern "C" {
    pub fn EVP_pkey_ml_kem_1024() -> *const EVP_PKEY_ALG;
}
unsafe extern "C" {
    /// EVP_pkey_xwing implements the hybrid key encapsulation mechanism (KEM) known
    /// as X-Wing or MLKEM768-X25519, defined in
    /// draft-irtf-cfrg-concrete-hybrid-kems. Its private key representation is the
    /// "seed" form. It does not have public and private key encodings for X.509.
    pub fn EVP_pkey_xwing() -> *const EVP_PKEY_ALG;
}
unsafe extern "C" {
    /// EVP_pkey_dsa implements DSA keys, encoded as in RFC 3279, Section 2.3.2. The
    /// `EVP_PKEY_id` value is `EVP_PKEY_DSA`. This `EVP_PKEY_ALG` accepts all DSA
    /// parameters supported by BoringSSL.
    ///
    /// Keys of this type are not usable with any operations, though the underlying
    /// `DSA` object can be extracted with `EVP_PKEY_get0_DSA`. This key type is
    /// deprecated and only implemented for compatibility with legacy applications.
    ///
    /// TODO(crbug.com/42290364): We didn't wire up `EVP_PKEY_sign` and
    /// `EVP_PKEY_verify` just so it was auditable which callers used DSA. Once DSA
    /// is removed from the default SPKI and PKCS#8 parser and DSA users explicitly
    /// request `EVP_pkey_dsa`, we could change that.
    pub fn EVP_pkey_dsa() -> *const EVP_PKEY_ALG;
}
unsafe extern "C" {
    /// EVP_pkey_rsa_pss_* implements RSASSA-PSS keys, encoded as id-RSASSA-PSS
    /// (RFC 4055, Section 3.1). The `EVP_PKEY_id` value is `EVP_PKEY_RSA_PSS`. Each
    /// `EVP_PKEY_ALG` only accepts keys whose parameters specify:
    ///
    ///  - A hashAlgorithm of the specified hash
    ///  - A maskGenAlgorithm of MGF1 with the specified hash
    ///  - A minimum saltLength of the specified hash's digest length
    ///  - A trailerField of one (must be omitted in the encoding)
    ///
    /// Keys of this type will only be usable with RSASSA-PSS with matching signature
    /// parameters.
    ///
    /// This algorithm type is not recommended. The id-RSASSA-PSS key type is not
    /// widely implemented. Using it negates any compatibility benefits of using RSA.
    /// More modern algorithms like ECDSA are more performant and more compatible
    /// than id-RSASSA-PSS keys. This key type also adds significant complexity to a
    /// system. It has a wide range of possible parameter sets, so any uses must
    /// ensure all components not only support id-RSASSA-PSS, but also the specific
    /// parameters chosen.
    ///
    /// Note the id-RSASSA-PSS key type is distinct from the RSASSA-PSS signature
    /// algorithm. The widely implemented id-rsaEncryption key type (`EVP_pkey_rsa`
    /// and `EVP_PKEY_RSA`) also supports RSASSA-PSS signatures.
    ///
    /// WARNING: Any `EVP_PKEY`s produced by this algorithm will return a non-NULL
    /// `RSA` object through `EVP_PKEY_get1_RSA` and `EVP_PKEY_get0_RSA`. This is
    /// dangerous as existing code may assume a non-NULL return implies the more
    /// common id-rsaEncryption key. Additionally, the operations on the underlying
    /// `RSA` object will not capture the RSA-PSS constraints, so callers risk
    /// misusing the key by calling these functions. Callers using this algorithm
    /// must use `EVP_PKEY_id` to distinguish `EVP_PKEY_RSA` and `EVP_PKEY_RSA_PSS`.
    ///
    /// WARNING: BoringSSL does not currently implement `RSA_get0_pss_params` with
    /// these keys. Callers that require this functionality should contact the
    /// BoringSSL team.
    pub fn EVP_pkey_rsa_pss_sha256() -> *const EVP_PKEY_ALG;
}
unsafe extern "C" {
    pub fn EVP_pkey_rsa_pss_sha384() -> *const EVP_PKEY_ALG;
}
unsafe extern "C" {
    pub fn EVP_pkey_rsa_pss_sha512() -> *const EVP_PKEY_ALG;
}
unsafe extern "C" {
    /// Getting and setting concrete key types.
    ///
    /// The following functions get and set the underlying key representation in an
    /// `EVP_PKEY` object. The `set1` functions take an additional reference to the
    /// underlying key and return one on success or zero if `key` is NULL. The
    /// `assign` functions adopt the caller's reference and return one on success or
    /// zero if `key` is NULL. The `get1` functions return a fresh reference to the
    /// underlying object or NULL if `pkey` is not of the correct type. The `get0`
    /// functions behave the same but return a non-owning pointer.
    ///
    /// The `get0` and `get1` functions take `const` pointers and are thus
    /// non-mutating for thread-safety purposes, but mutating functions on the
    /// returned lower-level objects are considered to also mutate the `EVP_PKEY` and
    /// may not be called concurrently with other operations on the `EVP_PKEY`.
    ///
    /// WARNING: Matching OpenSSL, the RSA functions behave non-uniformly.
    /// `EVP_PKEY_set1_RSA` and `EVP_PKEY_assign_RSA` construct an `EVP_PKEY_RSA`
    /// key, while the `EVP_PKEY_get0_RSA` and `EVP_PKEY_get1_RSA` will return
    /// non-NULL for both `EVP_PKEY_RSA` and `EVP_PKEY_RSA_PSS`.
    ///
    /// This means callers risk misusing a key if they assume a non-NULL return from
    /// `EVP_PKEY_get0_RSA` or `EVP_PKEY_get1_RSA` implies `EVP_PKEY_RSA`. Prefer
    /// `EVP_PKEY_id` to check the type of a key. To reduce this risk, BoringSSL does
    /// not make `EVP_PKEY_RSA_PSS` available by default, only when callers opt in
    /// via `EVP_pkey_rsa_pss_sha256`. This differs from upstream OpenSSL, where
    /// callers are exposed to `EVP_PKEY_RSA_PSS` by default.
    pub fn EVP_PKEY_set1_RSA(pkey: *mut EVP_PKEY, key: *mut RSA) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn EVP_PKEY_assign_RSA(pkey: *mut EVP_PKEY, key: *mut RSA) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn EVP_PKEY_get0_RSA(pkey: *const EVP_PKEY) -> *mut RSA;
}
unsafe extern "C" {
    pub fn EVP_PKEY_get1_RSA(pkey: *const EVP_PKEY) -> *mut RSA;
}
unsafe extern "C" {
    pub fn EVP_PKEY_set1_DSA(pkey: *mut EVP_PKEY, key: *mut DSA) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn EVP_PKEY_assign_DSA(pkey: *mut EVP_PKEY, key: *mut DSA) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn EVP_PKEY_get0_DSA(pkey: *const EVP_PKEY) -> *mut DSA;
}
unsafe extern "C" {
    pub fn EVP_PKEY_get1_DSA(pkey: *const EVP_PKEY) -> *mut DSA;
}
unsafe extern "C" {
    pub fn EVP_PKEY_set1_EC_KEY(pkey: *mut EVP_PKEY, key: *mut EC_KEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn EVP_PKEY_assign_EC_KEY(pkey: *mut EVP_PKEY, key: *mut EC_KEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn EVP_PKEY_get0_EC_KEY(pkey: *const EVP_PKEY) -> *mut EC_KEY;
}
unsafe extern "C" {
    pub fn EVP_PKEY_get1_EC_KEY(pkey: *const EVP_PKEY) -> *mut EC_KEY;
}
unsafe extern "C" {
    pub fn EVP_PKEY_set1_DH(pkey: *mut EVP_PKEY, key: *mut DH) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn EVP_PKEY_assign_DH(pkey: *mut EVP_PKEY, key: *mut DH) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn EVP_PKEY_get0_DH(pkey: *const EVP_PKEY) -> *mut DH;
}
unsafe extern "C" {
    pub fn EVP_PKEY_get1_DH(pkey: *const EVP_PKEY) -> *mut DH;
}
unsafe extern "C" {
    /// EVP_PKEY_from_subject_public_key_info decodes a DER-encoded
    /// SubjectPublicKeyInfo structure (RFC 5280) from `in`. It returns a
    /// newly-allocated `EVP_PKEY` or NULL on error. Only the `num_algs` algorithms
    /// in `algs` will be considered when parsing.
    pub fn EVP_PKEY_from_subject_public_key_info(
        in_: *const u8,
        len: usize,
        algs: *const *const EVP_PKEY_ALG,
        num_algs: usize,
    ) -> *mut EVP_PKEY;
}
unsafe extern "C" {
    /// EVP_parse_public_key decodes a DER-encoded SubjectPublicKeyInfo structure
    /// (RFC 5280) from `cbs` and advances `cbs`. It returns a newly-allocated
    /// `EVP_PKEY` or NULL on error.
    ///
    /// Prefer `EVP_PKEY_from_subject_public_key_info` instead. This function has
    /// several pitfalls:
    ///
    /// Callers are expected to handle trailing data returned from `cbs`, making more
    /// common cases error-prone.
    ///
    /// There is also no way to pass in supported algorithms. This function instead
    /// supports some default set of algorithms. Future versions of BoringSSL may add
    /// to this list, based on the needs of the other callers. Conversely, some
    /// algorithms may be intentionally omitted, if they cause too much risk to
    /// existing callers.
    ///
    /// This means callers must check the type of the parsed public key to ensure it
    /// is suitable and validate other desired key properties such as RSA modulus
    /// size or EC curve.
    pub fn EVP_parse_public_key(cbs: *mut CBS) -> *mut EVP_PKEY;
}
unsafe extern "C" {
    /// EVP_marshal_public_key marshals `key` as a DER-encoded SubjectPublicKeyInfo
    /// structure (RFC 5280) and appends the result to `cbb`. It returns one on
    /// success and zero on error.
    pub fn EVP_marshal_public_key(cbb: *mut CBB, key: *const EVP_PKEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_from_private_key_info decodes a DER-encoded PrivateKeyInfo structure
    /// (RFC 5208) from `in`. It returns a newly-allocated `EVP_PKEY` or NULL on
    /// error. Only the `num_algs` algorithms in `algs` will be considered when
    /// parsing.
    ///
    /// A PrivateKeyInfo ends with an optional set of attributes. These are silently
    /// ignored.
    pub fn EVP_PKEY_from_private_key_info(
        in_: *const u8,
        len: usize,
        algs: *const *const EVP_PKEY_ALG,
        num_algs: usize,
    ) -> *mut EVP_PKEY;
}
unsafe extern "C" {
    /// EVP_parse_private_key decodes a DER-encoded PrivateKeyInfo structure (RFC
    /// 5208) from `cbs` and advances `cbs`. It returns a newly-allocated `EVP_PKEY`
    /// or NULL on error.
    ///
    /// Prefer `EVP_PKEY_from_private_key_info` instead. This function has
    /// several pitfalls:
    ///
    /// Callers are expected to handle trailing data returned from `cbs`, making more
    /// common cases error-prone.
    ///
    /// There is also no way to pass in supported algorithms. This function instead
    /// supports some default set of algorithms. Future versions of BoringSSL may add
    /// to this list, based on the needs of the other callers. Conversely, some
    /// algorithms may be intentionally omitted, if they cause too much risk to
    /// existing callers.
    ///
    /// This means the caller must check the type of the parsed private key to ensure
    /// it is suitable and validate other desired key properties such as RSA modulus
    /// size or EC curve. In particular, RSA private key operations scale cubicly, so
    /// applications accepting RSA private keys from external sources may need to
    /// bound key sizes (use `EVP_PKEY_bits` or `RSA_bits`) to avoid a DoS vector.
    ///
    /// A PrivateKeyInfo ends with an optional set of attributes. These are silently
    /// ignored.
    pub fn EVP_parse_private_key(cbs: *mut CBS) -> *mut EVP_PKEY;
}
unsafe extern "C" {
    /// EVP_marshal_private_key marshals `key` as a DER-encoded PrivateKeyInfo
    /// structure (RFC 5208) and appends the result to `cbb`. It returns one on
    /// success and zero on error.
    pub fn EVP_marshal_private_key(cbb: *mut CBB, key: *const EVP_PKEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_from_raw_private_key interprets `in` as a raw private key of type
    /// `alg` and returns a newly-allocated `EVP_PKEY`, or nullptr on error.
    pub fn EVP_PKEY_from_raw_private_key(
        alg: *const EVP_PKEY_ALG,
        in_: *const u8,
        len: usize,
    ) -> *mut EVP_PKEY;
}
unsafe extern "C" {
    /// EVP_PKEY_from_private_seed interprets `in` as a private seed of type `alg`
    /// and returns a newly-allocated `EVP_PKEY`, or nullptr on error.
    pub fn EVP_PKEY_from_private_seed(
        alg: *const EVP_PKEY_ALG,
        in_: *const u8,
        len: usize,
    ) -> *mut EVP_PKEY;
}
unsafe extern "C" {
    /// EVP_PKEY_from_raw_public_key interprets `in` as a raw public key of type
    /// `alg` and returns a newly-allocated `EVP_PKEY`, or nullptr on error.
    pub fn EVP_PKEY_from_raw_public_key(
        alg: *const EVP_PKEY_ALG,
        in_: *const u8,
        len: usize,
    ) -> *mut EVP_PKEY;
}
unsafe extern "C" {
    /// EVP_PKEY_get_raw_private_key outputs the private key for `pkey` in raw form.
    /// If `out` is NULL, it sets `*out_len` to the size of the raw private key.
    /// Otherwise, it writes at most `*out_len` bytes to `out` and sets `*out_len` to
    /// the number of bytes written.
    ///
    /// It returns one on success and zero if `pkey` has no private key, the key
    /// type does not support this format, or the buffer is too small.
    pub fn EVP_PKEY_get_raw_private_key(
        pkey: *const EVP_PKEY,
        out: *mut u8,
        out_len: *mut usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_get_private_seed outputs the private key for `pkey` as a private
    /// seed. If `out` is NULL, it sets `*out_len` to the size of the seed.
    /// Otherwise, it writes at most `*out_len` bytes to `out` and sets
    /// `*out_len` to the number of bytes written.
    ///
    /// It returns one on success and zero if `pkey` has no private key, the key
    /// type does not support this format, or the buffer is too small.
    pub fn EVP_PKEY_get_private_seed(
        pkey: *const EVP_PKEY,
        out: *mut u8,
        out_len: *mut usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_get_raw_public_key outputs the public key for `pkey` in raw form.
    /// If `out` is NULL, it sets `*out_len` to the size of the raw public key.
    /// Otherwise, it writes at most `*out_len` bytes to `out` and sets `*out_len` to
    /// the number of bytes written.
    ///
    /// It returns one on success and zero if `pkey` has no public key, the key
    /// type does not support this format, or the buffer is too small.
    pub fn EVP_PKEY_get_raw_public_key(
        pkey: *const EVP_PKEY,
        out: *mut u8,
        out_len: *mut usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_generate_from_alg generates a new key of type `alg`. It returns a
    /// newly-allocated `EVP_PKEY` or nullptr on error.
    ///
    /// When passed `EVP_pkey_rsa`, this function generates an RSA-2048 key with the
    /// recommended public exponent of 65537, or `RSA_F4`. Use `EVP_RSA_gen` or
    /// `EVP_PKEY_keygen` instead to customize these parameters.
    pub fn EVP_PKEY_generate_from_alg(alg: *const EVP_PKEY_ALG) -> *mut EVP_PKEY;
}
unsafe extern "C" {
    /// EVP_DigestSignInit sets up `ctx` for a signing operation with `type` and
    /// `pkey`. The `ctx` argument must have been initialised with
    /// `EVP_MD_CTX_init`. If `pctx` is not NULL, the `EVP_PKEY_CTX` of the signing
    /// operation will be written to `*pctx`; this can be used to set alternative
    /// signing options.
    ///
    /// For single-shot signing algorithms which do not use a pre-hash, such as
    /// Ed25519, `type` should be NULL. The `EVP_MD_CTX` itself is unused but is
    /// present so the API is uniform. See `EVP_DigestSign`.
    ///
    /// This function does not mutate `pkey` for thread-safety purposes and may be
    /// used concurrently with other non-mutating functions on `pkey`.
    ///
    /// It returns one on success, or zero on error.
    pub fn EVP_DigestSignInit(
        ctx: *mut EVP_MD_CTX,
        pctx: *mut *mut EVP_PKEY_CTX,
        type_: *const EVP_MD,
        e: *mut ENGINE,
        pkey: *mut EVP_PKEY,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_DigestSignUpdate appends `len` bytes from `data` to the data which will
    /// be signed in `EVP_DigestSignFinal`. It returns one.
    ///
    /// This function performs a streaming signing operation and will fail for
    /// signature algorithms which do not support this. Use `EVP_DigestSign` for a
    /// single-shot operation.
    pub fn EVP_DigestSignUpdate(
        ctx: *mut EVP_MD_CTX,
        data: *const ::core::ffi::c_void,
        len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_DigestSignFinal signs the data that has been included by one or more
    /// calls to `EVP_DigestSignUpdate`. If `out_sig` is NULL then `*out_sig_len` is
    /// set to the maximum number of output bytes. Otherwise, on entry,
    /// `*out_sig_len` must contain the length of the `out_sig` buffer. If the call
    /// is successful, the signature is written to `out_sig` and `*out_sig_len` is
    /// set to its length.
    ///
    /// This function performs a streaming signing operation and will fail for
    /// signature algorithms which do not support this. Use `EVP_DigestSign` for a
    /// single-shot operation.
    ///
    /// It returns one on success, or zero on error.
    pub fn EVP_DigestSignFinal(
        ctx: *mut EVP_MD_CTX,
        out_sig: *mut u8,
        out_sig_len: *mut usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_DigestSign signs `data_len` bytes from `data` using `ctx`. If `out_sig`
    /// is NULL then `*out_sig_len` is set to the maximum number of output
    /// bytes. Otherwise, on entry, `*out_sig_len` must contain the length of the
    /// `out_sig` buffer. If the call is successful, the signature is written to
    /// `out_sig` and `*out_sig_len` is set to its length.
    ///
    /// It returns one on success and zero on error.
    pub fn EVP_DigestSign(
        ctx: *mut EVP_MD_CTX,
        out_sig: *mut u8,
        out_sig_len: *mut usize,
        data: *const u8,
        data_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_DigestVerifyInit sets up `ctx` for a signature verification operation
    /// with `type` and `pkey`. The `ctx` argument must have been initialised with
    /// `EVP_MD_CTX_init`. If `pctx` is not NULL, the `EVP_PKEY_CTX` of the signing
    /// operation will be written to `*pctx`; this can be used to set alternative
    /// signing options.
    ///
    /// For single-shot signing algorithms which do not use a pre-hash, such as
    /// Ed25519, `type` should be NULL. The `EVP_MD_CTX` itself is unused but is
    /// present so the API is uniform. See `EVP_DigestVerify`.
    ///
    /// This function does not mutate `pkey` for thread-safety purposes and may be
    /// used concurrently with other non-mutating functions on `pkey`.
    ///
    /// It returns one on success, or zero on error.
    pub fn EVP_DigestVerifyInit(
        ctx: *mut EVP_MD_CTX,
        pctx: *mut *mut EVP_PKEY_CTX,
        type_: *const EVP_MD,
        e: *mut ENGINE,
        pkey: *mut EVP_PKEY,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_DigestVerifyUpdate appends `len` bytes from `data` to the data which
    /// will be verified by `EVP_DigestVerifyFinal`. It returns one.
    ///
    /// This function performs streaming signature verification and will fail for
    /// signature algorithms which do not support this. Use `EVP_DigestVerify` for a
    /// single-shot verification.
    pub fn EVP_DigestVerifyUpdate(
        ctx: *mut EVP_MD_CTX,
        data: *const ::core::ffi::c_void,
        len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_DigestVerifyFinal verifies that `sig_len` bytes of `sig` are a valid
    /// signature for the data that has been included by one or more calls to
    /// `EVP_DigestVerifyUpdate`. It returns one on success and zero otherwise.
    ///
    /// This function performs streaming signature verification and will fail for
    /// signature algorithms which do not support this. Use `EVP_DigestVerify` for a
    /// single-shot verification.
    pub fn EVP_DigestVerifyFinal(
        ctx: *mut EVP_MD_CTX,
        sig: *const u8,
        sig_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_DigestVerify verifies that `sig_len` bytes from `sig` are a valid
    /// signature for `data`. It returns one on success or zero on error.
    pub fn EVP_DigestVerify(
        ctx: *mut EVP_MD_CTX,
        sig: *const u8,
        sig_len: usize,
        data: *const u8,
        len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_SignInit_ex configures `ctx`, which must already have been initialised,
    /// for a fresh signing operation using the hash function `type`. It returns one
    /// on success and zero otherwise.
    ///
    /// (In order to initialise `ctx`, either obtain it initialised with
    /// `EVP_MD_CTX_create`, or use `EVP_MD_CTX_init`.)
    pub fn EVP_SignInit_ex(
        ctx: *mut EVP_MD_CTX,
        type_: *const EVP_MD,
        impl_: *mut ENGINE,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_SignInit is a deprecated version of `EVP_SignInit_ex`.
    ///
    /// TODO(fork): remove.
    pub fn EVP_SignInit(ctx: *mut EVP_MD_CTX, type_: *const EVP_MD) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_SignUpdate appends `len` bytes from `data` to the data which will be
    /// signed in `EVP_SignFinal`.
    pub fn EVP_SignUpdate(
        ctx: *mut EVP_MD_CTX,
        data: *const ::core::ffi::c_void,
        len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_SignFinal signs the data that has been included by one or more calls to
    /// `EVP_SignUpdate`, using the key `pkey`, and writes it to `sig`. On entry,
    /// `sig` must point to at least `EVP_PKEY_size(pkey)` bytes of space. The
    /// actual size of the signature is written to `*out_sig_len`.
    ///
    /// It returns one on success and zero otherwise.
    ///
    /// It does not modify `ctx`, thus it's possible to continue to use `ctx` in
    /// order to sign a longer message. It also does not mutate `pkey` for
    /// thread-safety purposes and may be used concurrently with other non-mutating
    /// functions on `pkey`.
    pub fn EVP_SignFinal(
        ctx: *const EVP_MD_CTX,
        sig: *mut u8,
        out_sig_len: *mut ::core::ffi::c_uint,
        pkey: *mut EVP_PKEY,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_VerifyInit_ex configures `ctx`, which must already have been
    /// initialised, for a fresh signature verification operation using the hash
    /// function `type`. It returns one on success and zero otherwise.
    ///
    /// (In order to initialise `ctx`, either obtain it initialised with
    /// `EVP_MD_CTX_create`, or use `EVP_MD_CTX_init`.)
    pub fn EVP_VerifyInit_ex(
        ctx: *mut EVP_MD_CTX,
        type_: *const EVP_MD,
        impl_: *mut ENGINE,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_VerifyInit is a deprecated version of `EVP_VerifyInit_ex`.
    ///
    /// TODO(fork): remove.
    pub fn EVP_VerifyInit(ctx: *mut EVP_MD_CTX, type_: *const EVP_MD) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_VerifyUpdate appends `len` bytes from `data` to the data which will be
    /// signed in `EVP_VerifyFinal`.
    pub fn EVP_VerifyUpdate(
        ctx: *mut EVP_MD_CTX,
        data: *const ::core::ffi::c_void,
        len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_VerifyFinal verifies that `sig_len` bytes of `sig` are a valid
    /// signature, by `pkey`, for the data that has been included by one or more
    /// calls to `EVP_VerifyUpdate`.
    ///
    /// It returns one on success and zero otherwise.
    ///
    /// It does not modify `ctx`, thus it's possible to continue to use `ctx` in
    /// order to verify a longer message. It also does not mutate `pkey` for
    /// thread-safety purposes and may be used concurrently with other non-mutating
    /// functions on `pkey`.
    pub fn EVP_VerifyFinal(
        ctx: *mut EVP_MD_CTX,
        sig: *const u8,
        sig_len: usize,
        pkey: *mut EVP_PKEY,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_print_public prints a textual representation of the public key in
    /// `pkey` to `out`. Returns one on success or zero otherwise.
    pub fn EVP_PKEY_print_public(
        out: *mut BIO,
        pkey: *const EVP_PKEY,
        indent: ::core::ffi::c_int,
        pctx: *mut ASN1_PCTX,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_print_private prints a textual representation of the private key in
    /// `pkey` to `out`. Returns one on success or zero otherwise.
    pub fn EVP_PKEY_print_private(
        out: *mut BIO,
        pkey: *const EVP_PKEY,
        indent: ::core::ffi::c_int,
        pctx: *mut ASN1_PCTX,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_print_params prints a textual representation of the parameters in
    /// `pkey` to `out`. Returns one on success or zero otherwise.
    pub fn EVP_PKEY_print_params(
        out: *mut BIO,
        pkey: *const EVP_PKEY,
        indent: ::core::ffi::c_int,
        pctx: *mut ASN1_PCTX,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PKCS5_PBKDF2_HMAC computes `iterations` iterations of PBKDF2 of `password`
    /// and `salt`, using `digest`, and outputs `key_len` bytes to `out_key`. It
    /// returns one on success and zero on allocation failure or if iterations is 0.
    pub fn PKCS5_PBKDF2_HMAC(
        password: *const ::core::ffi::c_char,
        password_len: usize,
        salt: *const u8,
        salt_len: usize,
        iterations: u32,
        digest: *const EVP_MD,
        key_len: usize,
        out_key: *mut u8,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PKCS5_PBKDF2_HMAC_SHA1 is the same as PKCS5_PBKDF2_HMAC, but with `digest`
    /// fixed to `EVP_sha1`.
    pub fn PKCS5_PBKDF2_HMAC_SHA1(
        password: *const ::core::ffi::c_char,
        password_len: usize,
        salt: *const u8,
        salt_len: usize,
        iterations: u32,
        key_len: usize,
        out_key: *mut u8,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PBE_scrypt expands `password` into a secret key of length `key_len` using
    /// scrypt, as described in RFC 7914, and writes the result to `out_key`. It
    /// returns one on success and zero on allocation failure, if the memory required
    /// for the operation exceeds `max_mem`, or if any of the parameters are invalid
    /// as described below.
    ///
    /// `N`, `r`, and `p` are as described in RFC 7914 section 6. They determine the
    /// cost of the operation. If `max_mem` is zero, a default limit of 65MiB will be
    /// used.
    ///
    /// The parameters are considered invalid under any of the following conditions:
    /// - `r` or `p` are zero
    /// - `p` > (2^30 - 1) / `r`
    /// - `N` is not a power of two
    /// - `N` > 2^32
    /// - `N` > 2^(128 * `r` / 8)
    pub fn EVP_PBE_scrypt(
        password: *const ::core::ffi::c_char,
        password_len: usize,
        salt: *const u8,
        salt_len: usize,
        N: u64,
        r: u64,
        p: u64,
        max_mem: usize,
        out_key: *mut u8,
        key_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_CTX_new allocates a fresh `EVP_PKEY_CTX` for use with `pkey`. It
    /// returns the context or NULL on error.
    pub fn EVP_PKEY_CTX_new(pkey: *mut EVP_PKEY, e: *mut ENGINE) -> *mut EVP_PKEY_CTX;
}
unsafe extern "C" {
    /// EVP_PKEY_CTX_new_id allocates a fresh `EVP_PKEY_CTX` for a key of type `id`
    /// (e.g. `EVP_PKEY_HMAC`). This can be used for key generation where
    /// `EVP_PKEY_CTX_new` can't be used because there isn't an `EVP_PKEY` to pass
    /// it. It returns the context or NULL on error.
    ///
    /// For key generation, prefer to use `EVP_PKEY_generate_from_alg`.
    pub fn EVP_PKEY_CTX_new_id(id: ::core::ffi::c_int, e: *mut ENGINE) -> *mut EVP_PKEY_CTX;
}
unsafe extern "C" {
    /// EVP_PKEY_CTX_free frees `ctx` and the data it owns.
    pub fn EVP_PKEY_CTX_free(ctx: *mut EVP_PKEY_CTX);
}
unsafe extern "C" {
    /// EVP_PKEY_CTX_dup allocates a fresh `EVP_PKEY_CTX` and sets it equal to the
    /// state of `ctx`. It returns the fresh `EVP_PKEY_CTX` or NULL on error.
    pub fn EVP_PKEY_CTX_dup(ctx: *mut EVP_PKEY_CTX) -> *mut EVP_PKEY_CTX;
}
unsafe extern "C" {
    /// EVP_PKEY_CTX_get0_pkey returns the `EVP_PKEY` associated with `ctx`.
    pub fn EVP_PKEY_CTX_get0_pkey(ctx: *mut EVP_PKEY_CTX) -> *mut EVP_PKEY;
}
unsafe extern "C" {
    /// EVP_PKEY_sign_init initialises an `EVP_PKEY_CTX` for a signing operation. It
    /// should be called before `EVP_PKEY_sign`.
    ///
    /// It returns one on success or zero on error.
    pub fn EVP_PKEY_sign_init(ctx: *mut EVP_PKEY_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_sign signs `digest_len` bytes from `digest` using `ctx`. If `sig` is
    /// NULL, the maximum size of the signature is written to `out_sig_len`.
    /// Otherwise, `*sig_len` must contain the number of bytes of space available at
    /// `sig`. If sufficient, the signature will be written to `sig` and `*sig_len`
    /// updated with the true length. This function will fail for signature
    /// algorithms like Ed25519 that do not support signing pre-hashed inputs.
    ///
    /// WARNING: `digest` must be the output of some hash function on the data to be
    /// signed. Passing unhashed inputs will not result in a secure signature scheme.
    /// Use `EVP_DigestSignInit` to sign an unhashed input.
    ///
    /// WARNING: Setting `sig` to NULL only gives the maximum size of the
    /// signature. The actual signature may be smaller.
    ///
    /// It returns one on success or zero on error. (Note: this differs from
    /// OpenSSL, which can also return negative values to indicate an error.)
    pub fn EVP_PKEY_sign(
        ctx: *mut EVP_PKEY_CTX,
        sig: *mut u8,
        sig_len: *mut usize,
        digest: *const u8,
        digest_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_verify_init initialises an `EVP_PKEY_CTX` for a signature
    /// verification operation. It should be called before `EVP_PKEY_verify`.
    ///
    /// It returns one on success or zero on error.
    pub fn EVP_PKEY_verify_init(ctx: *mut EVP_PKEY_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_verify verifies that `sig_len` bytes from `sig` are a valid
    /// signature for `digest`. This function will fail for signature
    /// algorithms like Ed25519 that do not support signing pre-hashed inputs.
    ///
    /// WARNING: `digest` must be the output of some hash function on the data to be
    /// verified. Passing unhashed inputs will not result in a secure signature
    /// scheme. Use `EVP_DigestVerifyInit` to verify a signature given the unhashed
    /// input.
    ///
    /// It returns one on success or zero on error.
    pub fn EVP_PKEY_verify(
        ctx: *mut EVP_PKEY_CTX,
        sig: *const u8,
        sig_len: usize,
        digest: *const u8,
        digest_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_encrypt_init initialises an `EVP_PKEY_CTX` for an encryption
    /// operation. It should be called before `EVP_PKEY_encrypt`.
    ///
    /// It returns one on success or zero on error.
    pub fn EVP_PKEY_encrypt_init(ctx: *mut EVP_PKEY_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_encrypt encrypts `in_len` bytes from `in`. If `out` is NULL, the
    /// maximum size of the ciphertext is written to `out_len`. Otherwise, `*out_len`
    /// must contain the number of bytes of space available at `out`. If sufficient,
    /// the ciphertext will be written to `out` and `*out_len` updated with the true
    /// length.
    ///
    /// WARNING: Setting `out` to NULL only gives the maximum size of the
    /// ciphertext. The actual ciphertext may be smaller.
    ///
    /// It returns one on success or zero on error.
    pub fn EVP_PKEY_encrypt(
        ctx: *mut EVP_PKEY_CTX,
        out: *mut u8,
        out_len: *mut usize,
        in_: *const u8,
        in_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_decrypt_init initialises an `EVP_PKEY_CTX` for a decryption
    /// operation. It should be called before `EVP_PKEY_decrypt`.
    ///
    /// It returns one on success or zero on error.
    pub fn EVP_PKEY_decrypt_init(ctx: *mut EVP_PKEY_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_decrypt decrypts `in_len` bytes from `in`. If `out` is NULL, the
    /// maximum size of the plaintext is written to `out_len`. Otherwise, `*out_len`
    /// must contain the number of bytes of space available at `out`. If sufficient,
    /// the ciphertext will be written to `out` and `*out_len` updated with the true
    /// length.
    ///
    /// WARNING: Setting `out` to NULL only gives the maximum size of the
    /// plaintext. The actual plaintext may be smaller.
    ///
    /// It returns one on success or zero on error.
    pub fn EVP_PKEY_decrypt(
        ctx: *mut EVP_PKEY_CTX,
        out: *mut u8,
        out_len: *mut usize,
        in_: *const u8,
        in_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_verify_recover_init initialises an `EVP_PKEY_CTX` for a public-key
    /// decryption operation. It should be called before `EVP_PKEY_verify_recover`.
    ///
    /// Public-key decryption is a very obscure operation that is only implemented
    /// by RSA keys. It is effectively a signature verification operation that
    /// returns the signed message directly. It is almost certainly not what you
    /// want.
    ///
    /// It returns one on success or zero on error.
    pub fn EVP_PKEY_verify_recover_init(ctx: *mut EVP_PKEY_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_verify_recover decrypts `sig_len` bytes from `sig`. If `out` is
    /// NULL, the maximum size of the plaintext is written to `out_len`. Otherwise,
    /// `*out_len` must contain the number of bytes of space available at `out`. If
    /// sufficient, the ciphertext will be written to `out` and `*out_len` updated
    /// with the true length.
    ///
    /// WARNING: Setting `out` to NULL only gives the maximum size of the
    /// plaintext. The actual plaintext may be smaller.
    ///
    /// See the warning about this operation in `EVP_PKEY_verify_recover_init`. It
    /// is probably not what you want.
    ///
    /// It returns one on success or zero on error.
    pub fn EVP_PKEY_verify_recover(
        ctx: *mut EVP_PKEY_CTX,
        out: *mut u8,
        out_len: *mut usize,
        sig: *const u8,
        siglen: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_derive_init initialises an `EVP_PKEY_CTX` for a key derivation
    /// operation. It should be called before `EVP_PKEY_derive_set_peer` and
    /// `EVP_PKEY_derive`.
    ///
    /// It returns one on success or zero on error.
    pub fn EVP_PKEY_derive_init(ctx: *mut EVP_PKEY_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_derive_set_peer sets the peer's key to be used for key derivation
    /// by `ctx` to `peer`. It should be called after `EVP_PKEY_derive_init`. (For
    /// example, this is used to set the peer's key in (EC)DH.) It returns one on
    /// success and zero on error.
    pub fn EVP_PKEY_derive_set_peer(
        ctx: *mut EVP_PKEY_CTX,
        peer: *mut EVP_PKEY,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_derive derives a shared key from `ctx`. If `key` is non-NULL then,
    /// on entry, `out_key_len` must contain the amount of space at `key`. If
    /// sufficient then the shared key will be written to `key` and `*out_key_len`
    /// will be set to the length. If `key` is NULL then `out_key_len` will be set to
    /// the maximum length.
    ///
    /// WARNING: Setting `out` to NULL only gives the maximum size of the key. The
    /// actual key may be smaller.
    ///
    /// It returns one on success and zero on error.
    pub fn EVP_PKEY_derive(
        ctx: *mut EVP_PKEY_CTX,
        key: *mut u8,
        out_key_len: *mut usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_keygen_init initialises an `EVP_PKEY_CTX` for a key generation
    /// operation. It should be called before `EVP_PKEY_keygen`.
    ///
    /// It returns one on success or zero on error.
    pub fn EVP_PKEY_keygen_init(ctx: *mut EVP_PKEY_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_keygen performs a key generation operation using the values from
    /// `ctx`. If `*out_pkey` is non-NULL, it overwrites `*out_pkey` with the
    /// resulting key. Otherwise, it sets `*out_pkey` to a newly-allocated `EVP_PKEY`
    /// containing the result. It returns one on success or zero on error.
    pub fn EVP_PKEY_keygen(
        ctx: *mut EVP_PKEY_CTX,
        out_pkey: *mut *mut EVP_PKEY,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_paramgen_init initialises an `EVP_PKEY_CTX` for a parameter
    /// generation operation. It should be called before `EVP_PKEY_paramgen`.
    ///
    /// It returns one on success or zero on error.
    pub fn EVP_PKEY_paramgen_init(ctx: *mut EVP_PKEY_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_paramgen performs a parameter generation using the values from
    /// `ctx`. If `*out_pkey` is non-NULL, it overwrites `*out_pkey` with the
    /// resulting parameters, but no key. Otherwise, it sets `*out_pkey` to a
    /// newly-allocated `EVP_PKEY` containing the result. It returns one on success
    /// or zero on error.
    pub fn EVP_PKEY_paramgen(
        ctx: *mut EVP_PKEY_CTX,
        out_pkey: *mut *mut EVP_PKEY,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_encapsulate_init initialises an `EVP_PKEY_CTX` for an encapsulate
    /// operation. It should be called before `EVP_PKEY_encapsulate`. `params` is
    /// included for OpenSSL compatibility, but this parameter should be NULL or have
    /// `OSSL_PARAM_END` as its first element.
    ///
    /// It returns one on success or zero on error.
    pub fn EVP_PKEY_encapsulate_init(
        ctx: *mut EVP_PKEY_CTX,
        params: *const OSSL_PARAM,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_encapsulate implements public key encapsulation using `ctx`. It
    /// either performs the operation or returns the maximum output sizes, depending
    /// on whether `out_ciphertext` is NULL:
    ///
    /// If `out_ciphertext` is NULL, it writes the maximum ciphertext length to
    /// `*out_ciphertext_len` and the maximum shared secret length to
    /// `*out_secret_len`. Either of `out_ciphertext_len` or `out_secret_len` may be
    /// NULL to ignore the corresponding output.
    ///
    /// If `out_ciphertext` is non-NULL, it performs the operation and, on success,
    /// writes the ciphertext to `out_ciphertext`, the ciphertext size to
    /// `out_ciphertext_len`, the shared secret to `out_secret`, and the shared
    /// secret length to `out_secret_len`. On input, `*out_ciphertext_len` and
    /// `*out_secret_len` must contain the amount of space available in
    /// `out_ciphertext` and `out_secret`, respectively. If there is insufficient
    /// space to write the output, the operation will fail.
    ///
    /// In both modes, this function returns one on success or zero on error.
    pub fn EVP_PKEY_encapsulate(
        ctx: *mut EVP_PKEY_CTX,
        out_ciphertext: *mut u8,
        out_ciphertext_len: *mut usize,
        out_secret: *mut u8,
        out_secret_len: *mut usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_decapsulate_init initialises an `EVP_PKEY_CTX` for a decapsulate
    /// operation. It should be called before `EVP_PKEY_decapsulate`. `params` is
    /// included for OpenSSL compatibility, but this parameter should be NULL or have
    /// `OSSL_PARAM_END` as its first element.
    ///
    /// It returns one on success or zero on error.
    pub fn EVP_PKEY_decapsulate_init(
        ctx: *mut EVP_PKEY_CTX,
        params: *const OSSL_PARAM,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_decapsulate implements private key decapsulation using `ctx`.
    /// `ciphertext` and `ciphertext_len` specify the ciphertext to be decapsulated.
    /// If `out_secret` is NULL, it writes the maximum size of the shared secret
    /// output to `*out_secret_len` and returns one. Otherwise, `*out_secret_len`
    /// must contain the number of bytes of space available at `out_secret`. If the
    /// space is insufficient, this function returns zero. If the space is
    /// sufficient, the decapsulated shared secret will be written to `out_secret`
    /// and the size of the output to `out_secret_len`, and this function will return
    /// one. If `ciphertext` has been corrupted, the function may fail or it may
    /// output a shared secret that appears to be random. Any subsequent symmetric
    /// encryption using `out_secret` must use an authenticated encryption scheme to
    /// discover the decapsulation failure.
    pub fn EVP_PKEY_decapsulate(
        ctx: *mut EVP_PKEY_CTX,
        out_secret: *mut u8,
        out_secret_len: *mut usize,
        ciphertext: *const u8,
        ciphertext_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_CTX_set_signature_md sets `md` as the digest to be used in a
    /// signature operation. It returns one on success or zero on error.
    pub fn EVP_PKEY_CTX_set_signature_md(
        ctx: *mut EVP_PKEY_CTX,
        md: *const EVP_MD,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_CTX_get_signature_md sets `*out_md` to the digest to be used in a
    /// signature operation. It returns one on success or zero on error.
    pub fn EVP_PKEY_CTX_get_signature_md(
        ctx: *mut EVP_PKEY_CTX,
        out_md: *mut *const EVP_MD,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_CTX_set1_signature_context_string sets the context string for a
    /// signature or verification operation to `context`. It returns one success and
    /// zero on error. The context string is an additional input to some signature
    /// algorithms, such as ML-DSA, to separate different uses of the same key.  This
    /// is known as domain separation. Section 8.3 of RFC 8032 provides some
    /// additional guidance on context strings.
    ///
    /// Not all signature algorithms support context strings. Callers that support
    /// a mix of algorithms, with and without context string support, can instead
    /// separate the signature input itself. For example, callers can prepend
    /// context-specific prefixes to signature inputs.
    pub fn EVP_PKEY_CTX_set1_signature_context_string(
        ctx: *mut EVP_PKEY_CTX,
        context: *const u8,
        context_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_RSA_gen generates a new RSA key with the specified number of bits. It
    /// returns a newly-allocated `EVP_PKEY` or nullptr on error.
    ///
    /// This function sets the public exponent to the recommended value of 65537, or
    /// `RSA_F4`. To use a less common value, instead use
    /// `EVP_PKEY_CTX_set_rsa_keygen_pubexp` and `EVP_PKEY_keygen`.
    pub fn EVP_RSA_gen(bits: ::core::ffi::c_uint) -> *mut EVP_PKEY;
}
unsafe extern "C" {
    /// EVP_PKEY_CTX_set_rsa_padding sets the padding type to use. It should be one
    /// of the `RSA_*_PADDING` values. Returns one on success or zero on error. By
    /// default, the padding is `RSA_PKCS1_PADDING`.
    pub fn EVP_PKEY_CTX_set_rsa_padding(
        ctx: *mut EVP_PKEY_CTX,
        padding: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_CTX_get_rsa_padding sets `*out_padding` to the current padding
    /// value, which is one of the `RSA_*_PADDING` values. Returns one on success or
    /// zero on error.
    pub fn EVP_PKEY_CTX_get_rsa_padding(
        ctx: *mut EVP_PKEY_CTX,
        out_padding: *mut ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_CTX_set_rsa_pss_saltlen sets the length of the salt in a PSS-padded
    /// signature. A value of `RSA_PSS_SALTLEN_DIGEST` causes the salt to be the same
    /// length as the digest in the signature. A value of `RSA_PSS_SALTLEN_AUTO`
    /// causes the salt to be the maximum length that will fit when signing and
    /// recovered from the signature when verifying. Otherwise the value gives the
    /// size of the salt in bytes.
    ///
    /// If unsure, use `RSA_PSS_SALTLEN_DIGEST`, which is the default. Note this
    /// differs from OpenSSL, which defaults to `RSA_PSS_SALTLEN_AUTO`.
    ///
    /// Returns one on success or zero on error.
    pub fn EVP_PKEY_CTX_set_rsa_pss_saltlen(
        ctx: *mut EVP_PKEY_CTX,
        salt_len: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_CTX_get_rsa_pss_saltlen sets `*out_salt_len` to the salt length of
    /// a PSS-padded signature. See the documentation for
    /// `EVP_PKEY_CTX_set_rsa_pss_saltlen` for details of the special values that it
    /// can take.
    ///
    /// Returns one on success or zero on error.
    pub fn EVP_PKEY_CTX_get_rsa_pss_saltlen(
        ctx: *mut EVP_PKEY_CTX,
        out_salt_len: *mut ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_CTX_set_rsa_keygen_bits sets the size of the desired RSA modulus,
    /// in bits, for key generation. Returns one on success or zero on
    /// error.
    pub fn EVP_PKEY_CTX_set_rsa_keygen_bits(
        ctx: *mut EVP_PKEY_CTX,
        bits: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_CTX_set_rsa_keygen_pubexp sets `e` as the public exponent for key
    /// generation. Returns one on success or zero on error. On success, `ctx` takes
    /// ownership of `e`. The library will then call `BN_free` on `e` when `ctx` is
    /// destroyed.
    pub fn EVP_PKEY_CTX_set_rsa_keygen_pubexp(
        ctx: *mut EVP_PKEY_CTX,
        e: *mut BIGNUM,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_CTX_set_rsa_oaep_md sets `md` as the digest used in OAEP padding.
    /// Returns one on success or zero on error. If unset, the default is SHA-1.
    /// Callers are recommended to overwrite this default.
    ///
    /// TODO(davidben): Remove the default and require callers specify this.
    pub fn EVP_PKEY_CTX_set_rsa_oaep_md(
        ctx: *mut EVP_PKEY_CTX,
        md: *const EVP_MD,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_CTX_get_rsa_oaep_md sets `*out_md` to the digest function used in
    /// OAEP padding. Returns one on success or zero on error.
    pub fn EVP_PKEY_CTX_get_rsa_oaep_md(
        ctx: *mut EVP_PKEY_CTX,
        out_md: *mut *const EVP_MD,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_CTX_set_rsa_mgf1_md sets `md` as the digest used in MGF1. Returns
    /// one on success or zero on error.
    ///
    /// If unset, the default is the signing hash for `RSA_PKCS1_PSS_PADDING` and the
    /// OAEP hash for `RSA_PKCS1_OAEP_PADDING`. Callers are recommended to use this
    /// default and not call this function.
    pub fn EVP_PKEY_CTX_set_rsa_mgf1_md(
        ctx: *mut EVP_PKEY_CTX,
        md: *const EVP_MD,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_CTX_get_rsa_mgf1_md sets `*out_md` to the digest function used in
    /// MGF1. Returns one on success or zero on error.
    pub fn EVP_PKEY_CTX_get_rsa_mgf1_md(
        ctx: *mut EVP_PKEY_CTX,
        out_md: *mut *const EVP_MD,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_CTX_set0_rsa_oaep_label sets `label_len` bytes from `label` as the
    /// label used in OAEP. DANGER: On success, this call takes ownership of `label`
    /// and will call `OPENSSL_free` on it when `ctx` is destroyed.
    ///
    /// Returns one on success or zero on error.
    pub fn EVP_PKEY_CTX_set0_rsa_oaep_label(
        ctx: *mut EVP_PKEY_CTX,
        label: *mut u8,
        label_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_CTX_get0_rsa_oaep_label sets `*out_label` to point to the internal
    /// buffer containing the OAEP label (which may be NULL) and returns the length
    /// of the label or a negative value on error.
    ///
    /// WARNING: the return value differs from the usual return value convention.
    pub fn EVP_PKEY_CTX_get0_rsa_oaep_label(
        ctx: *mut EVP_PKEY_CTX,
        out_label: *mut *const u8,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_get_ec_curve_nid returns `pkey`'s curve as a NID constant, such as
    /// `NID_X9_62_prime256v1`, or `NID_undef` if `pkey` is not an EC key.
    pub fn EVP_PKEY_get_ec_curve_nid(pkey: *const EVP_PKEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_get_ec_point_conv_form returns `pkey`'s point conversion form as a
    /// `POINT_CONVERSION_*` constant, or zero if `pkey` is not an EC key.
    pub fn EVP_PKEY_get_ec_point_conv_form(pkey: *const EVP_PKEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_CTX_set_ec_paramgen_curve_nid sets the curve used for
    /// `EVP_PKEY_keygen` or `EVP_PKEY_paramgen` operations to `nid`. It returns one
    /// on success and zero on error.
    pub fn EVP_PKEY_CTX_set_ec_paramgen_curve_nid(
        ctx: *mut EVP_PKEY_CTX,
        nid: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_CTX_set_dh_pad configures whether `ctx`, which must be an
    /// `EVP_PKEY_derive` operation, configures the handling of leading zeros in the
    /// Diffie-Hellman shared secret. If `pad` is zero, leading zeros are removed
    /// from the secret. If `pad` is non-zero, the fixed-width shared secret is used
    /// unmodified, as in PKCS #3. If this function is not called, the default is to
    /// remove leading zeros.
    ///
    /// WARNING: The behavior when `pad` is zero leaks information about the shared
    /// secret. This may result in side channel attacks such as
    /// https://raccoon-attack.com/, particularly when the same private key is used
    /// for multiple operations.
    pub fn EVP_PKEY_CTX_set_dh_pad(
        ctx: *mut EVP_PKEY_CTX,
        pad: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_kem_ml_kem_* implement ML-KEM, defined in FIPS 203.
    pub fn EVP_kem_ml_kem_768() -> *const EVP_KEM;
}
unsafe extern "C" {
    pub fn EVP_kem_ml_kem_1024() -> *const EVP_KEM;
}
unsafe extern "C" {
    /// EVP_kem_xwing implements the hybrid KEM known as X-Wing or MLKEM768-X25519,
    /// defined in draft-irtf-cfrg-concrete-hybrid-kems.
    pub fn EVP_kem_xwing() -> *const EVP_KEM;
}
unsafe extern "C" {
    /// EVP_KEM_ciphertext_len returns the fixed length, in bytes, of a ciphertext
    /// produced and consumed by `kem`.
    pub fn EVP_KEM_ciphertext_len(kem: *const EVP_KEM) -> usize;
}
unsafe extern "C" {
    /// EVP_KEM_secret_len returns the fixed length, in bytes, of the shared
    /// secret produced and consumed by `kem`.
    pub fn EVP_KEM_secret_len(kem: *const EVP_KEM) -> usize;
}
unsafe extern "C" {
    /// EVP_KEM_encap uses `kem` to encapsulate a `peer_key`. It outputs a
    /// ciphertext of length `ciphertext_len` into `*out_ciphertext` and outputs a
    /// shared secret of length `secret_len` into `*out_secret`. `peer_key` must be
    /// a public key of the type expected by `kem`. `ciphertext_len` and
    /// `secret_len` must match the output of `EVP_KEM_ciphertext_len` and
    /// `EVP_KEM_secret_len`, respectively, when called with `kem`. This function
    /// returns one on success or zero on failure.
    pub fn EVP_KEM_encap(
        kem: *const EVP_KEM,
        out_ciphertext: *mut u8,
        ciphertext_len: usize,
        out_secret: *mut u8,
        secret_len: usize,
        peer_key: *const EVP_PKEY,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_KEM_decap uses `kem` to decapsulate a `ciphertext` of length
    /// `ciphertext_len`, using `key` as a decapsulation key. It outputs a shared
    /// secret of length `secret_len` into `*out_secret`. `key` must be a private key
    /// of the type expected by `kem`. `secret_len` must match the output of
    /// `EVP_KEM_secret_len` when called with `kem`. This function returns one on
    /// success or zero on failure. If `ciphertext` has been corrupted, the function
    /// may fail or it may output a shared secret that appears to be random. Any
    /// subsequent symmetric encryption using `*out_secret` must use an authenticated
    /// encryption scheme in order to discover the decapsulation failure.
    pub fn EVP_KEM_decap(
        kem: *const EVP_KEM,
        out_secret: *mut u8,
        secret_len: usize,
        ciphertext: *const u8,
        ciphertext_len: usize,
        key: *const EVP_PKEY,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_get0 returns NULL. This function is provided for compatibility with
    /// OpenSSL but does not return anything. Use the typed `EVP_PKEY_get0_*`
    /// functions instead.
    pub fn EVP_PKEY_get0(pkey: *const EVP_PKEY) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    /// OpenSSL_add_all_algorithms does nothing.
    pub fn OpenSSL_add_all_algorithms();
}
unsafe extern "C" {
    /// OPENSSL_add_all_algorithms_conf does nothing.
    pub fn OPENSSL_add_all_algorithms_conf();
}
unsafe extern "C" {
    /// OpenSSL_add_all_ciphers does nothing.
    pub fn OpenSSL_add_all_ciphers();
}
unsafe extern "C" {
    /// OpenSSL_add_all_digests does nothing.
    pub fn OpenSSL_add_all_digests();
}
unsafe extern "C" {
    /// EVP_cleanup does nothing.
    pub fn EVP_cleanup();
}
unsafe extern "C" {
    /// EVP_default_properties_is_fips_enabled calls `FIPS_mode`.
    pub fn EVP_default_properties_is_fips_enabled(libctx: *mut OSSL_LIB_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn EVP_CIPHER_do_all_sorted(
        callback: ::core::option::Option<
            unsafe extern "C" fn(
                cipher: *const EVP_CIPHER,
                name: *const ::core::ffi::c_char,
                unused: *const ::core::ffi::c_char,
                arg: *mut ::core::ffi::c_void,
            ),
        >,
        arg: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    pub fn EVP_MD_do_all_sorted(
        callback: ::core::option::Option<
            unsafe extern "C" fn(
                md: *const EVP_MD,
                name: *const ::core::ffi::c_char,
                unused: *const ::core::ffi::c_char,
                arg: *mut ::core::ffi::c_void,
            ),
        >,
        arg: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    pub fn EVP_MD_do_all(
        callback: ::core::option::Option<
            unsafe extern "C" fn(
                md: *const EVP_MD,
                name: *const ::core::ffi::c_char,
                unused: *const ::core::ffi::c_char,
                arg: *mut ::core::ffi::c_void,
            ),
        >,
        arg: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    pub fn EVP_MD_do_all_provided(
        libctx: *mut OSSL_LIB_CTX,
        callback: ::core::option::Option<
            unsafe extern "C" fn(md: *mut EVP_MD, arg: *mut ::core::ffi::c_void),
        >,
        arg: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    /// i2d_PrivateKey marshals a private key from `key` to type-specific format, as
    /// described in `i2d_SAMPLE`.
    ///
    /// RSA keys are serialized as a DER-encoded RSAPublicKey (RFC 8017) structure.
    /// EC keys are serialized as a DER-encoded ECPrivateKey (RFC 5915) structure.
    ///
    /// Use `RSA_marshal_private_key` or `EC_KEY_marshal_private_key` instead.
    pub fn i2d_PrivateKey(key: *const EVP_PKEY, outp: *mut *mut u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// i2d_PublicKey marshals a public key from `key` to a type-specific format, as
    /// described in `i2d_SAMPLE`.
    ///
    /// RSA keys are serialized as a DER-encoded RSAPublicKey (RFC 8017) structure.
    /// EC keys are serialized as an EC point per SEC 1.
    ///
    /// Use `RSA_marshal_public_key` or `EC_POINT_point2cbb` instead.
    pub fn i2d_PublicKey(key: *const EVP_PKEY, outp: *mut *mut u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// d2i_PrivateKey parses a DER-encoded private key from `len` bytes at `*inp`,
    /// as described in `d2i_SAMPLE`. The private key must have type `type`,
    /// otherwise it will be rejected.
    ///
    /// This function tries to detect one of several formats. Instead, use
    /// `EVP_parse_private_key` for a PrivateKeyInfo, `RSA_parse_private_key` for an
    /// RSAPrivateKey, and `EC_parse_private_key` for an ECPrivateKey.
    pub fn d2i_PrivateKey(
        type_: ::core::ffi::c_int,
        out: *mut *mut EVP_PKEY,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut EVP_PKEY;
}
unsafe extern "C" {
    /// d2i_AutoPrivateKey acts the same as `d2i_PrivateKey`, but detects the type
    /// of the private key.
    ///
    /// This function tries to detect one of several formats. Instead, use
    /// `EVP_parse_private_key` for a PrivateKeyInfo, `RSA_parse_private_key` for an
    /// RSAPrivateKey, and `EC_parse_private_key` for an ECPrivateKey.
    pub fn d2i_AutoPrivateKey(
        out: *mut *mut EVP_PKEY,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut EVP_PKEY;
}
unsafe extern "C" {
    /// d2i_PublicKey parses a public key from `len` bytes at `*inp` in a type-
    /// specific format specified by `type`, as described in `d2i_SAMPLE`.
    ///
    /// The only supported value for `type` is `EVP_PKEY_RSA`, which parses a
    /// DER-encoded RSAPublicKey (RFC 8017) structure. Parsing EC keys is not
    /// supported by this function.
    ///
    /// Use `RSA_parse_public_key` instead.
    pub fn d2i_PublicKey(
        type_: ::core::ffi::c_int,
        out: *mut *mut EVP_PKEY,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut EVP_PKEY;
}
unsafe extern "C" {
    /// EVP_PKEY_CTX_set_ec_param_enc returns one if `encoding` is
    /// `OPENSSL_EC_NAMED_CURVE` or zero with an error otherwise.
    pub fn EVP_PKEY_CTX_set_ec_param_enc(
        ctx: *mut EVP_PKEY_CTX,
        encoding: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_set_type sets the type of `pkey` to `type`. It returns one if
    /// successful or zero if the `type` argument is not one of the `EVP_PKEY_*`
    /// values supported for use with this function. If `pkey` is NULL, it simply
    /// reports whether the type is known.
    ///
    /// There are very few cases where this function is useful. Changing `pkey`'s
    /// type clears any previously stored keys, so there is no benefit to loading a
    /// key and then changing its type. Although `pkey` is left with a type
    /// configured, it has no key, and functions which set a key, such as
    /// `EVP_PKEY_set1_RSA`, will configure a type anyway. If writing unit tests that
    /// are only sensitive to the type of a key, it is preferable to construct a real
    /// key, so that tests are more representative of production code.
    ///
    /// The only API pattern which requires this function is
    /// `EVP_PKEY_set1_tls_encodedpoint` with X25519, which requires a half-empty
    /// `EVP_PKEY` that was first configured with `EVP_PKEY_X25519`. Currently, all
    /// other values of `type` will result in an error.
    pub fn EVP_PKEY_set_type(pkey: *mut EVP_PKEY, type_: ::core::ffi::c_int) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_set1_tls_encodedpoint replaces `pkey` with a public key encoded by
    /// `in`. It returns one on success and zero on error.
    ///
    /// If `pkey` is an EC key, the format is an X9.62 point and `pkey` must already
    /// have an EC group configured. If it is an X25519 key, it is the 32-byte X25519
    /// public key representation. This function is not supported for other key types
    /// and will fail.
    pub fn EVP_PKEY_set1_tls_encodedpoint(
        pkey: *mut EVP_PKEY,
        in_: *const u8,
        len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_get1_tls_encodedpoint sets `*out_ptr` to a newly-allocated buffer
    /// containing the raw encoded public key for `pkey`. The caller must call
    /// `OPENSSL_free` to release this buffer. The function returns the length of the
    /// buffer on success and zero on error.
    ///
    /// If `pkey` is an EC key, the format is an X9.62 point with uncompressed
    /// coordinates. If it is an X25519 key, it is the 32-byte X25519 public key
    /// representation. This function is not supported for other key types and will
    /// fail.
    pub fn EVP_PKEY_get1_tls_encodedpoint(pkey: *const EVP_PKEY, out_ptr: *mut *mut u8) -> usize;
}
unsafe extern "C" {
    /// EVP_PKEY_base_id calls `EVP_PKEY_id`.
    pub fn EVP_PKEY_base_id(pkey: *const EVP_PKEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_CTX_set_rsa_pss_keygen_md returns 0.
    pub fn EVP_PKEY_CTX_set_rsa_pss_keygen_md(
        ctx: *mut EVP_PKEY_CTX,
        md: *const EVP_MD,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_CTX_set_rsa_pss_keygen_saltlen returns 0.
    pub fn EVP_PKEY_CTX_set_rsa_pss_keygen_saltlen(
        ctx: *mut EVP_PKEY_CTX,
        salt_len: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_CTX_set_rsa_pss_keygen_mgf1_md returns 0.
    pub fn EVP_PKEY_CTX_set_rsa_pss_keygen_mgf1_md(
        ctx: *mut EVP_PKEY_CTX,
        md: *const EVP_MD,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// i2d_PUBKEY marshals `pkey` as a DER-encoded SubjectPublicKeyInfo, as
    /// described in `i2d_SAMPLE`.
    ///
    /// Use `EVP_marshal_public_key` instead.
    pub fn i2d_PUBKEY(pkey: *const EVP_PKEY, outp: *mut *mut u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// d2i_PUBKEY parses a DER-encoded SubjectPublicKeyInfo from `len` bytes at
    /// `*inp`, as described in `d2i_SAMPLE`.
    ///
    /// Use `EVP_parse_public_key` instead.
    pub fn d2i_PUBKEY(
        out: *mut *mut EVP_PKEY,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut EVP_PKEY;
}
unsafe extern "C" {
    /// i2d_RSA_PUBKEY marshals `rsa` as a DER-encoded SubjectPublicKeyInfo
    /// structure, as described in `i2d_SAMPLE`.
    ///
    /// Use `EVP_marshal_public_key` instead.
    pub fn i2d_RSA_PUBKEY(rsa: *const RSA, outp: *mut *mut u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// d2i_RSA_PUBKEY parses an RSA public key as a DER-encoded SubjectPublicKeyInfo
    /// from `len` bytes at `*inp`, as described in `d2i_SAMPLE`.
    /// SubjectPublicKeyInfo structures containing other key types are rejected.
    ///
    /// Use `EVP_parse_public_key` instead.
    pub fn d2i_RSA_PUBKEY(
        out: *mut *mut RSA,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut RSA;
}
unsafe extern "C" {
    /// i2d_DSA_PUBKEY marshals `dsa` as a DER-encoded SubjectPublicKeyInfo, as
    /// described in `i2d_SAMPLE`.
    ///
    /// Use `EVP_marshal_public_key` instead.
    pub fn i2d_DSA_PUBKEY(dsa: *const DSA, outp: *mut *mut u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// d2i_DSA_PUBKEY parses a DSA public key as a DER-encoded SubjectPublicKeyInfo
    /// from `len` bytes at `*inp`, as described in `d2i_SAMPLE`.
    /// SubjectPublicKeyInfo structures containing other key types are rejected.
    ///
    /// Use `EVP_parse_public_key` instead.
    pub fn d2i_DSA_PUBKEY(
        out: *mut *mut DSA,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut DSA;
}
unsafe extern "C" {
    /// i2d_EC_PUBKEY marshals `ec_key` as a DER-encoded SubjectPublicKeyInfo, as
    /// described in `i2d_SAMPLE`.
    ///
    /// Use `EVP_marshal_public_key` instead.
    pub fn i2d_EC_PUBKEY(ec_key: *const EC_KEY, outp: *mut *mut u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// d2i_EC_PUBKEY parses an EC public key as a DER-encoded SubjectPublicKeyInfo
    /// from `len` bytes at `*inp`, as described in `d2i_SAMPLE`.
    /// SubjectPublicKeyInfo structures containing other key types are rejected.
    ///
    /// Use `EVP_parse_public_key` instead.
    pub fn d2i_EC_PUBKEY(
        out: *mut *mut EC_KEY,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut EC_KEY;
}
unsafe extern "C" {
    /// EVP_PKEY_CTX_set_dsa_paramgen_bits returns zero.
    pub fn EVP_PKEY_CTX_set_dsa_paramgen_bits(
        ctx: *mut EVP_PKEY_CTX,
        nbits: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_CTX_set_dsa_paramgen_q_bits returns zero.
    pub fn EVP_PKEY_CTX_set_dsa_paramgen_q_bits(
        ctx: *mut EVP_PKEY_CTX,
        qbits: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_assign sets the underlying key of `pkey` to `key`, which must be of
    /// the given type. If successful, it returns one. If the `type` argument
    /// is not one of `EVP_PKEY_RSA`, `EVP_PKEY_DSA`, or `EVP_PKEY_EC` values or if
    /// `key` is NULL, it returns zero. This function may not be used with other
    /// `EVP_PKEY_*` types.
    ///
    /// Use the `EVP_PKEY_assign_*` functions instead.
    pub fn EVP_PKEY_assign(
        pkey: *mut EVP_PKEY,
        type_: ::core::ffi::c_int,
        key: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_type returns `nid`.
    pub fn EVP_PKEY_type(nid: ::core::ffi::c_int) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_new_raw_private_key interprets `in` as a raw private key of type
    /// `type`, which must be an `EVP_PKEY_*` constant, such as `EVP_PKEY_X25519`,
    /// and returns a newly-allocated `EVP_PKEY`, or nullptr on error.
    ///
    /// Prefer `EVP_PKEY_from_raw_private_key`, which allows dead code elimination to
    /// discard algorithms that aren't reachable from the caller.
    pub fn EVP_PKEY_new_raw_private_key(
        type_: ::core::ffi::c_int,
        unused: *mut ENGINE,
        in_: *const u8,
        len: usize,
    ) -> *mut EVP_PKEY;
}
unsafe extern "C" {
    /// EVP_PKEY_new_raw_public_key interprets `in` as a raw public key of type
    /// `type`, which must be an `EVP_PKEY_*` constant, such as `EVP_PKEY_X25519`,
    /// and returns a newly-allocated `EVP_PKEY`, or nullptr on error.
    ///
    /// Prefer `EVP_PKEY_from_raw_private_key`, which allows dead code elimination to
    /// discard algorithms that aren't reachable from the caller.
    pub fn EVP_PKEY_new_raw_public_key(
        type_: ::core::ffi::c_int,
        unused: *mut ENGINE,
        in_: *const u8,
        len: usize,
    ) -> *mut EVP_PKEY;
}
unsafe extern "C" {
    /// EVP_PKEY_cmp calls `EVP_PKEY_eq`. It returns one if public keys are equal and
    /// zero otherwise.
    ///
    /// WARNING: This differs from the traditional return value of a "cmp" function.
    pub fn EVP_PKEY_cmp(a: *const EVP_PKEY, b: *const EVP_PKEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_cmp_parameters calls `EVP_PKEY_parameters_eq`. It returns one if
    /// parameters are equal and zero otherwise.
    ///
    /// WARNING: This differs from the traditional return value of a "cmp" function.
    pub fn EVP_PKEY_cmp_parameters(a: *const EVP_PKEY, b: *const EVP_PKEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// HKDF computes HKDF (as specified by RFC 5869) of initial keying material
    /// `secret` with `salt` and `info` using `digest`, and outputs `out_len` bytes
    /// to `out_key`. It returns one on success and zero on error.
    ///
    /// HKDF is an Extract-and-Expand algorithm. It does not do any key stretching,
    /// and as such, is not suited to be used alone to generate a key from a
    /// password.
    pub fn HKDF(
        out_key: *mut u8,
        out_len: usize,
        digest: *const EVP_MD,
        secret: *const u8,
        secret_len: usize,
        salt: *const u8,
        salt_len: usize,
        info: *const u8,
        info_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// HKDF_extract computes a HKDF PRK (as specified by RFC 5869) from initial
    /// keying material `secret` and salt `salt` using `digest`, and outputs
    /// `out_len` bytes to `out_key`. The maximum output size is `EVP_MAX_MD_SIZE`.
    /// It returns one on success and zero on error.
    ///
    /// WARNING: This function orders the inputs differently from RFC 5869
    /// specification. Double-check which parameter is the secret/IKM and which is
    /// the salt when using.
    pub fn HKDF_extract(
        out_key: *mut u8,
        out_len: *mut usize,
        digest: *const EVP_MD,
        secret: *const u8,
        secret_len: usize,
        salt: *const u8,
        salt_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// HKDF_expand computes a HKDF OKM (as specified by RFC 5869) of length
    /// `out_len` from the PRK `prk` and info `info` using `digest`, and outputs
    /// the result to `out_key`. It returns one on success and zero on error.
    pub fn HKDF_expand(
        out_key: *mut u8,
        out_len: usize,
        digest: *const EVP_MD,
        prk: *const u8,
        prk_len: usize,
        info: *const u8,
        info_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// HMAC calculates the HMAC of `data_len` bytes of `data`, using the given key
    /// and hash function, and writes the result to `out`. On entry, `out` must
    /// contain at least `EVP_MD_size` bytes of space. The actual length of the
    /// result is written to `*out_len`. An output size of `EVP_MAX_MD_SIZE` will
    /// always be large enough. It returns `out` or NULL on error.
    pub fn HMAC(
        evp_md: *const EVP_MD,
        key: *const ::core::ffi::c_void,
        key_len: usize,
        data: *const u8,
        data_len: usize,
        out: *mut u8,
        out_len: *mut ::core::ffi::c_uint,
    ) -> *mut u8;
}
unsafe extern "C" {
    /// HMAC_CTX_init initialises `ctx` for use in an HMAC operation. It's assumed
    /// that HMAC_CTX objects will be allocated on the stack thus no allocation
    /// function is provided.
    pub fn HMAC_CTX_init(ctx: *mut HMAC_CTX);
}
unsafe extern "C" {
    /// HMAC_CTX_new allocates and initialises a new `HMAC_CTX` and returns it, or
    /// NULL on allocation failure. The caller must use `HMAC_CTX_free` to release
    /// the resulting object.
    pub fn HMAC_CTX_new() -> *mut HMAC_CTX;
}
unsafe extern "C" {
    /// HMAC_CTX_cleanup frees data owned by `ctx`. It does not free `ctx` itself.
    pub fn HMAC_CTX_cleanup(ctx: *mut HMAC_CTX);
}
unsafe extern "C" {
    /// HMAC_CTX_cleanse zeros the digest state from `ctx` and then performs the
    /// actions of `HMAC_CTX_cleanup`.
    pub fn HMAC_CTX_cleanse(ctx: *mut HMAC_CTX);
}
unsafe extern "C" {
    /// HMAC_CTX_free calls `HMAC_CTX_cleanup` and then frees `ctx` itself.
    pub fn HMAC_CTX_free(ctx: *mut HMAC_CTX);
}
unsafe extern "C" {
    /// HMAC_Init_ex sets up an initialised `HMAC_CTX` to use `md` as the hash
    /// function and `key` as the key. For a non-initial call, `md` may be NULL, in
    /// which case the previous hash function will be used. If the hash function has
    /// not changed and `key` is NULL, `ctx` reuses the previous key. It returns one
    /// on success or zero on allocation failure.
    ///
    /// WARNING: NULL and empty keys are ambiguous on non-initial calls. Passing NULL
    /// `key` but repeating the previous `md` reuses the previous key rather than the
    /// empty key.
    pub fn HMAC_Init_ex(
        ctx: *mut HMAC_CTX,
        key: *const ::core::ffi::c_void,
        key_len: usize,
        md: *const EVP_MD,
        impl_: *mut ENGINE,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// HMAC_Update hashes `data_len` bytes from `data` into the current HMAC
    /// operation in `ctx`. It returns one.
    pub fn HMAC_Update(ctx: *mut HMAC_CTX, data: *const u8, data_len: usize) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// HMAC_Final completes the HMAC operation in `ctx` and writes the result to
    /// `out`. If `out_len` is not `NULL` then it writes the length of the result to
    /// `*out_len`. On entry, `out` must contain at least `HMAC_size` bytes of
    /// space. An output size of `EVP_MAX_MD_SIZE` will always be large enough. It
    /// returns one on success or zero on allocation failure.
    pub fn HMAC_Final(
        ctx: *mut HMAC_CTX,
        out: *mut u8,
        out_len: *mut ::core::ffi::c_uint,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// HMAC_size returns the size, in bytes, of the HMAC that will be produced by
    /// `ctx`. On entry, `ctx` must have been setup with `HMAC_Init_ex`.
    pub fn HMAC_size(ctx: *const HMAC_CTX) -> usize;
}
unsafe extern "C" {
    /// HMAC_CTX_get_md returns `ctx`'s hash function.
    pub fn HMAC_CTX_get_md(ctx: *const HMAC_CTX) -> *const EVP_MD;
}
unsafe extern "C" {
    /// HMAC_CTX_copy_ex sets `dest` equal to `src`. On entry, `dest` must have been
    /// initialised by calling `HMAC_CTX_init`. It returns one on success and zero
    /// on error.
    pub fn HMAC_CTX_copy_ex(dest: *mut HMAC_CTX, src: *const HMAC_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// HMAC_CTX_reset calls `HMAC_CTX_cleanup` followed by `HMAC_CTX_init`.
    pub fn HMAC_CTX_reset(ctx: *mut HMAC_CTX);
}
unsafe extern "C" {
    /// Deprecated functions.
    pub fn HMAC_Init(
        ctx: *mut HMAC_CTX,
        key: *const ::core::ffi::c_void,
        key_len: ::core::ffi::c_int,
        md: *const EVP_MD,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// HMAC_CTX_copy calls `HMAC_CTX_init` on `dest` and then sets it equal to
    /// `src`. On entry, `dest` must /not/ be initialised for an operation with
    /// `HMAC_Init_ex`. It returns one on success and zero on error.
    pub fn HMAC_CTX_copy(dest: *mut HMAC_CTX, src: *const HMAC_CTX) -> ::core::ffi::c_int;
}
/// Private functions
#[repr(C)]
#[derive(Copy, Clone)]
pub struct hmac_ctx_st {
    pub md: *const EVP_MD,
    pub md_ctx: EVP_MD_CTX,
    pub i_ctx: EVP_MD_CTX,
    pub o_ctx: EVP_MD_CTX,
}
unsafe extern "C" {
    /// The following functions are KEM algorithms which may be used with HPKE. Note
    /// that, while some HPKE KEMs use KDFs internally, this is separate from the
    /// `EVP_HPKE_KDF` selection.
    pub fn EVP_hpke_x25519_hkdf_sha256() -> *const EVP_HPKE_KEM;
}
unsafe extern "C" {
    pub fn EVP_hpke_p256_hkdf_sha256() -> *const EVP_HPKE_KEM;
}
unsafe extern "C" {
    pub fn EVP_hpke_xwing() -> *const EVP_HPKE_KEM;
}
unsafe extern "C" {
    pub fn EVP_hpke_mlkem768() -> *const EVP_HPKE_KEM;
}
unsafe extern "C" {
    pub fn EVP_hpke_mlkem1024() -> *const EVP_HPKE_KEM;
}
unsafe extern "C" {
    /// EVP_HPKE_KEM_id returns the HPKE KEM identifier for `kem`, which
    /// will be one of the `EVP_HPKE_KEM_*` constants.
    pub fn EVP_HPKE_KEM_id(kem: *const EVP_HPKE_KEM) -> u16;
}
unsafe extern "C" {
    /// EVP_HPKE_KEM_public_key_len returns the length of a public key for `kem`.
    /// This value will be at most `EVP_HPKE_MAX_PUBLIC_KEY_LENGTH`.
    pub fn EVP_HPKE_KEM_public_key_len(kem: *const EVP_HPKE_KEM) -> usize;
}
unsafe extern "C" {
    /// EVP_HPKE_KEM_private_key_len returns the length of a private key for `kem`.
    /// This value will be at most `EVP_HPKE_MAX_PRIVATE_KEY_LENGTH`.
    pub fn EVP_HPKE_KEM_private_key_len(kem: *const EVP_HPKE_KEM) -> usize;
}
unsafe extern "C" {
    /// EVP_HPKE_KEM_enc_len returns the length of the "enc", the encapsulated shared
    /// secret, for `kem`. This value will be at most `EVP_HPKE_MAX_ENC_LENGTH`.
    pub fn EVP_HPKE_KEM_enc_len(kem: *const EVP_HPKE_KEM) -> usize;
}
unsafe extern "C" {
    /// The following functions are KDF algorithms which may be used with HPKE. If
    /// unsure, use `EVP_hpke_hkdf_sha256`.
    pub fn EVP_hpke_hkdf_sha256() -> *const EVP_HPKE_KDF;
}
unsafe extern "C" {
    pub fn EVP_hpke_hkdf_sha384() -> *const EVP_HPKE_KDF;
}
unsafe extern "C" {
    /// EVP_HPKE_KDF_id returns the HPKE KDF identifier for `kdf`.
    pub fn EVP_HPKE_KDF_id(kdf: *const EVP_HPKE_KDF) -> u16;
}
unsafe extern "C" {
    /// EVP_HPKE_KDF_hkdf_md returns the HKDF hash function corresponding to `kdf`,
    /// or NULL if `kdf` is not an HKDF-based KDF. All currently supported KDFs are
    /// HKDF-based.
    pub fn EVP_HPKE_KDF_hkdf_md(kdf: *const EVP_HPKE_KDF) -> *const EVP_MD;
}
unsafe extern "C" {
    /// The following functions are AEAD algorithms which may be used with HPKE.
    pub fn EVP_hpke_aes_128_gcm() -> *const EVP_HPKE_AEAD;
}
unsafe extern "C" {
    pub fn EVP_hpke_aes_256_gcm() -> *const EVP_HPKE_AEAD;
}
unsafe extern "C" {
    pub fn EVP_hpke_chacha20_poly1305() -> *const EVP_HPKE_AEAD;
}
unsafe extern "C" {
    /// EVP_HPKE_AEAD_id returns the HPKE AEAD identifier for `aead`.
    pub fn EVP_HPKE_AEAD_id(aead: *const EVP_HPKE_AEAD) -> u16;
}
unsafe extern "C" {
    /// EVP_HPKE_AEAD_aead returns the `EVP_AEAD` corresponding to `aead`.
    pub fn EVP_HPKE_AEAD_aead(aead: *const EVP_HPKE_AEAD) -> *const EVP_AEAD;
}
unsafe extern "C" {
    /// EVP_HPKE_KEY_zero sets an uninitialized `EVP_HPKE_KEY` to the zero state. The
    /// caller should then use `EVP_HPKE_KEY_init`, `EVP_HPKE_KEY_copy`, or
    /// `EVP_HPKE_KEY_generate` to finish initializing `key`.
    ///
    /// It is safe, but not necessary to call `EVP_HPKE_KEY_cleanup` in this state.
    /// This may be used for more uniform cleanup of `EVP_HPKE_KEY`.
    pub fn EVP_HPKE_KEY_zero(key: *mut EVP_HPKE_KEY);
}
unsafe extern "C" {
    /// EVP_HPKE_KEY_cleanup releases memory referenced by `key`.
    pub fn EVP_HPKE_KEY_cleanup(key: *mut EVP_HPKE_KEY);
}
unsafe extern "C" {
    /// EVP_HPKE_KEY_new returns a newly-allocated `EVP_HPKE_KEY`, or NULL on error.
    /// The caller must call `EVP_HPKE_KEY_free` on the result to release it.
    ///
    /// This is a convenience function for callers that need a heap-allocated
    /// `EVP_HPKE_KEY`.
    pub fn EVP_HPKE_KEY_new() -> *mut EVP_HPKE_KEY;
}
unsafe extern "C" {
    /// EVP_HPKE_KEY_free releases memory associated with `key`, which must have been
    /// created with `EVP_HPKE_KEY_new`.
    pub fn EVP_HPKE_KEY_free(key: *mut EVP_HPKE_KEY);
}
unsafe extern "C" {
    /// EVP_HPKE_KEY_copy sets `dst` to a copy of `src`. It returns one on success
    /// and zero on error. On success, the caller must call `EVP_HPKE_KEY_cleanup` to
    /// release `dst`. On failure, calling `EVP_HPKE_KEY_cleanup` is safe, but not
    /// necessary.
    pub fn EVP_HPKE_KEY_copy(
        dst: *mut EVP_HPKE_KEY,
        src: *const EVP_HPKE_KEY,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_HPKE_KEY_move sets `out`, which must be initialized or in the zero state,
    /// to the key in `in`. `in` is mutated and left in the zero state.
    pub fn EVP_HPKE_KEY_move(out: *mut EVP_HPKE_KEY, in_: *mut EVP_HPKE_KEY);
}
unsafe extern "C" {
    /// EVP_HPKE_KEY_init decodes `priv_key` as a private key for `kem` and
    /// initializes `key` with the result. It returns one on success and zero if
    /// `priv_key` was invalid. On success, the caller must call
    /// `EVP_HPKE_KEY_cleanup` to release the key. On failure, calling
    /// `EVP_HPKE_KEY_cleanup` is safe, but not necessary.
    pub fn EVP_HPKE_KEY_init(
        key: *mut EVP_HPKE_KEY,
        kem: *const EVP_HPKE_KEM,
        priv_key: *const u8,
        priv_key_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_HPKE_KEY_generate sets `key` to a newly-generated key using `kem`.
    pub fn EVP_HPKE_KEY_generate(
        key: *mut EVP_HPKE_KEY,
        kem: *const EVP_HPKE_KEM,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_HPKE_KEY_derive deterministically derives a key from `ikm` for use with
    /// `kem` and initializes `key` with the result. It returns one on success and
    /// zero on error. This corresponds to the DeriveKeyPair operation in RFC 9180.
    pub fn EVP_HPKE_KEY_derive(
        key: *mut EVP_HPKE_KEY,
        kem: *const EVP_HPKE_KEM,
        ikm: *const u8,
        ikm_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_HPKE_KEY_kem returns the HPKE KEM used by `key`.
    pub fn EVP_HPKE_KEY_kem(key: *const EVP_HPKE_KEY) -> *const EVP_HPKE_KEM;
}
unsafe extern "C" {
    /// EVP_HPKE_KEY_public_key writes `key`'s public key to `out` and sets
    /// `*out_len` to the number of bytes written. On success, it returns one and
    /// writes at most `max_out` bytes. If `max_out` is too small, it returns zero.
    /// Setting `max_out` to `EVP_HPKE_MAX_PUBLIC_KEY_LENGTH` will ensure the public
    /// key fits. An exact size can also be determined by
    /// `EVP_HPKE_KEM_public_key_len`.
    pub fn EVP_HPKE_KEY_public_key(
        key: *const EVP_HPKE_KEY,
        out: *mut u8,
        out_len: *mut usize,
        max_out: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_HPKE_KEY_private_key writes `key`'s private key to `out` and sets
    /// `*out_len` to the number of bytes written. On success, it returns one and
    /// writes at most `max_out` bytes. If `max_out` is too small, it returns zero.
    /// Setting `max_out` to `EVP_HPKE_MAX_PRIVATE_KEY_LENGTH` will ensure the
    /// private key fits. An exact size can also be determined by
    /// `EVP_HPKE_KEM_private_key_len`.
    pub fn EVP_HPKE_KEY_private_key(
        key: *const EVP_HPKE_KEY,
        out: *mut u8,
        out_len: *mut usize,
        max_out: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_HPKE_CTX_zero sets an uninitialized `EVP_HPKE_CTX` to the zero state. The
    /// caller should then use one of the `EVP_HPKE_CTX_setup_*` functions to finish
    /// setting up `ctx`.
    ///
    /// It is safe, but not necessary to call `EVP_HPKE_CTX_cleanup` in this state.
    /// This may be used for more uniform cleanup of `EVP_HPKE_CTX`.
    pub fn EVP_HPKE_CTX_zero(ctx: *mut EVP_HPKE_CTX);
}
unsafe extern "C" {
    /// EVP_HPKE_CTX_cleanup releases memory referenced by `ctx`. `ctx` must have
    /// been initialized with `EVP_HPKE_CTX_zero` or one of the
    /// `EVP_HPKE_CTX_setup_*` functions.
    pub fn EVP_HPKE_CTX_cleanup(ctx: *mut EVP_HPKE_CTX);
}
unsafe extern "C" {
    /// EVP_HPKE_CTX_new returns a newly-allocated `EVP_HPKE_CTX`, or NULL on error.
    /// The caller must call `EVP_HPKE_CTX_free` on the result to release it.
    ///
    /// This is a convenience function for callers that need a heap-allocated
    /// `EVP_HPKE_CTX`.
    pub fn EVP_HPKE_CTX_new() -> *mut EVP_HPKE_CTX;
}
unsafe extern "C" {
    /// EVP_HPKE_CTX_free releases memory associated with `ctx`, which must have been
    /// created with `EVP_HPKE_CTX_new`.
    pub fn EVP_HPKE_CTX_free(ctx: *mut EVP_HPKE_CTX);
}
unsafe extern "C" {
    /// EVP_HPKE_CTX_setup_sender implements the SetupBaseS HPKE operation. It
    /// encapsulates a shared secret for `peer_public_key` and sets up `ctx` as a
    /// sender context. It writes the encapsulated shared secret to `out_enc` and
    /// sets `*out_enc_len` to the number of bytes written. It writes at most
    /// `max_enc` bytes and fails if the buffer is too small. Setting `max_enc` to at
    /// least `EVP_HPKE_MAX_ENC_LENGTH` will ensure the buffer is large enough. An
    /// exact size may also be determined by `EVP_PKEY_KEM_enc_len`.
    ///
    /// This function returns one on success and zero on error. Note that
    /// `peer_public_key` may be invalid, in which case this function will return an
    /// error.
    ///
    /// On success, callers may call `EVP_HPKE_CTX_seal` to encrypt messages for the
    /// recipient. Callers must then call `EVP_HPKE_CTX_cleanup` when done. On
    /// failure, calling `EVP_HPKE_CTX_cleanup` is safe, but not required.
    pub fn EVP_HPKE_CTX_setup_sender(
        ctx: *mut EVP_HPKE_CTX,
        out_enc: *mut u8,
        out_enc_len: *mut usize,
        max_enc: usize,
        kem: *const EVP_HPKE_KEM,
        kdf: *const EVP_HPKE_KDF,
        aead: *const EVP_HPKE_AEAD,
        peer_public_key: *const u8,
        peer_public_key_len: usize,
        info: *const u8,
        info_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_HPKE_CTX_setup_sender_with_seed_for_testing behaves like
    /// `EVP_HPKE_CTX_setup_sender`, but takes a seed to behave deterministically.
    /// The seed's format depends on `kem`. For X25519, it is the sender's
    /// ephemeral private key. For P256, it's an HKDF input.
    pub fn EVP_HPKE_CTX_setup_sender_with_seed_for_testing(
        ctx: *mut EVP_HPKE_CTX,
        out_enc: *mut u8,
        out_enc_len: *mut usize,
        max_enc: usize,
        kem: *const EVP_HPKE_KEM,
        kdf: *const EVP_HPKE_KDF,
        aead: *const EVP_HPKE_AEAD,
        peer_public_key: *const u8,
        peer_public_key_len: usize,
        info: *const u8,
        info_len: usize,
        seed: *const u8,
        seed_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_HPKE_CTX_setup_recipient implements the SetupBaseR HPKE operation. It
    /// decapsulates the shared secret in `enc` with `key` and sets up `ctx` as a
    /// recipient context. It returns one on success and zero on failure. Note that
    /// `enc` may be invalid, in which case this function will return an error.
    ///
    /// On success, callers may call `EVP_HPKE_CTX_open` to decrypt messages from the
    /// sender. Callers must then call `EVP_HPKE_CTX_cleanup` when done. On failure,
    /// calling `EVP_HPKE_CTX_cleanup` is safe, but not required.
    pub fn EVP_HPKE_CTX_setup_recipient(
        ctx: *mut EVP_HPKE_CTX,
        key: *const EVP_HPKE_KEY,
        kdf: *const EVP_HPKE_KDF,
        aead: *const EVP_HPKE_AEAD,
        enc: *const u8,
        enc_len: usize,
        info: *const u8,
        info_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_HPKE_CTX_setup_auth_sender implements the SetupAuthS HPKE operation. It
    /// behaves like `EVP_HPKE_CTX_setup_sender` but authenticates the resulting
    /// context with `key`.
    pub fn EVP_HPKE_CTX_setup_auth_sender(
        ctx: *mut EVP_HPKE_CTX,
        out_enc: *mut u8,
        out_enc_len: *mut usize,
        max_enc: usize,
        key: *const EVP_HPKE_KEY,
        kdf: *const EVP_HPKE_KDF,
        aead: *const EVP_HPKE_AEAD,
        peer_public_key: *const u8,
        peer_public_key_len: usize,
        info: *const u8,
        info_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_HPKE_CTX_setup_auth_sender_with_seed_for_testing behaves like
    /// `EVP_HPKE_CTX_setup_auth_sender`, but takes a seed to behave
    /// deterministically. The seed's format depends on `kem`. For X25519, it is the
    /// sender's ephemeral private key. For P256, it's an HKDF input.
    pub fn EVP_HPKE_CTX_setup_auth_sender_with_seed_for_testing(
        ctx: *mut EVP_HPKE_CTX,
        out_enc: *mut u8,
        out_enc_len: *mut usize,
        max_enc: usize,
        key: *const EVP_HPKE_KEY,
        kdf: *const EVP_HPKE_KDF,
        aead: *const EVP_HPKE_AEAD,
        peer_public_key: *const u8,
        peer_public_key_len: usize,
        info: *const u8,
        info_len: usize,
        seed: *const u8,
        seed_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_HPKE_CTX_setup_auth_recipient implements the SetupAuthR HPKE operation.
    /// It behaves like `EVP_HPKE_CTX_setup_recipient` but checks the resulting
    /// context was authenticated with `peer_public_key`.
    pub fn EVP_HPKE_CTX_setup_auth_recipient(
        ctx: *mut EVP_HPKE_CTX,
        key: *const EVP_HPKE_KEY,
        kdf: *const EVP_HPKE_KDF,
        aead: *const EVP_HPKE_AEAD,
        enc: *const u8,
        enc_len: usize,
        info: *const u8,
        info_len: usize,
        peer_public_key: *const u8,
        peer_public_key_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_HPKE_CTX_open uses the HPKE context `ctx` to authenticate `in_len` bytes
    /// from `in` and `ad_len` bytes from `ad` and to decrypt at most `in_len` bytes
    /// into `out`. It returns one on success, and zero otherwise.
    ///
    /// This operation will fail if the `ctx` context is not set up as a receiver.
    ///
    /// Note that HPKE encryption is stateful and ordered. The sender's first call to
    /// `EVP_HPKE_CTX_seal` must correspond to the recipient's first call to
    /// `EVP_HPKE_CTX_open`, etc.
    ///
    /// At most `in_len` bytes are written to `out`. In order to ensure success,
    /// `max_out_len` should be at least `in_len`. On successful return, `*out_len`
    /// is set to the actual number of bytes written.
    pub fn EVP_HPKE_CTX_open(
        ctx: *mut EVP_HPKE_CTX,
        out: *mut u8,
        out_len: *mut usize,
        max_out_len: usize,
        in_: *const u8,
        in_len: usize,
        ad: *const u8,
        ad_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_HPKE_CTX_seal uses the HPKE context `ctx` to encrypt and authenticate
    /// `in_len` bytes of ciphertext `in` and authenticate `ad_len` bytes from `ad`,
    /// writing the result to `out`. It returns one on success and zero otherwise.
    ///
    /// This operation will fail if the `ctx` context is not set up as a sender.
    ///
    /// Note that HPKE encryption is stateful and ordered. The sender's first call to
    /// `EVP_HPKE_CTX_seal` must correspond to the recipient's first call to
    /// `EVP_HPKE_CTX_open`, etc.
    ///
    /// At most, `max_out_len` encrypted bytes are written to `out`. On successful
    /// return, `*out_len` is set to the actual number of bytes written.
    ///
    /// To ensure success, `max_out_len` should be `in_len` plus the result of
    /// `EVP_HPKE_CTX_max_overhead` or `EVP_HPKE_MAX_OVERHEAD`.
    pub fn EVP_HPKE_CTX_seal(
        ctx: *mut EVP_HPKE_CTX,
        out: *mut u8,
        out_len: *mut usize,
        max_out_len: usize,
        in_: *const u8,
        in_len: usize,
        ad: *const u8,
        ad_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_HPKE_CTX_export uses the HPKE context `ctx` to export a secret of
    /// `secret_len` bytes into `out`. This function uses `context_len` bytes from
    /// `context` as a context string for the secret. This is necessary to separate
    /// different uses of exported secrets and bind relevant caller-specific context
    /// into the output. It returns one on success and zero otherwise.
    pub fn EVP_HPKE_CTX_export(
        ctx: *const EVP_HPKE_CTX,
        out: *mut u8,
        secret_len: usize,
        context: *const u8,
        context_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_HPKE_CTX_max_overhead returns the maximum number of additional bytes
    /// added by sealing data with `EVP_HPKE_CTX_seal`. The `ctx` context must be set
    /// up as a sender.
    pub fn EVP_HPKE_CTX_max_overhead(ctx: *const EVP_HPKE_CTX) -> usize;
}
unsafe extern "C" {
    /// EVP_HPKE_CTX_kem returns `ctx`'s configured KEM, or NULL if the context has
    /// not been set up.
    pub fn EVP_HPKE_CTX_kem(ctx: *const EVP_HPKE_CTX) -> *const EVP_HPKE_KEM;
}
unsafe extern "C" {
    /// EVP_HPKE_CTX_aead returns `ctx`'s configured AEAD, or NULL if the context has
    /// not been set up.
    pub fn EVP_HPKE_CTX_aead(ctx: *const EVP_HPKE_CTX) -> *const EVP_HPKE_AEAD;
}
unsafe extern "C" {
    /// EVP_HPKE_CTX_kdf returns `ctx`'s configured KDF, or NULL if the context has
    /// not been set up.
    pub fn EVP_HPKE_CTX_kdf(ctx: *const EVP_HPKE_CTX) -> *const EVP_HPKE_KDF;
}
/// Private structures.
///
/// The following structures are exported so their types are stack-allocatable,
/// but accessing or modifying their fields is forbidden.
#[repr(C)]
#[derive(Copy, Clone)]
pub struct evp_hpke_ctx_st {
    pub kem: *const EVP_HPKE_KEM,
    pub aead: *const EVP_HPKE_AEAD,
    pub kdf: *const EVP_HPKE_KDF,
    pub aead_ctx: EVP_AEAD_CTX,
    pub base_nonce: [u8; 24usize],
    pub exporter_secret: [u8; 64usize],
    pub seq: u64,
    pub is_sender: ::core::ffi::c_int,
}
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct evp_hpke_key_st {
    pub kem: *const EVP_HPKE_KEM,
    pub private_key: [u8; 64usize],
    pub public_key: [u8; 1568usize],
}
/// HRSS
///
/// HRSS is a structured-lattice-based post-quantum key encapsulation mechanism.
/// The best exposition is https://eprint.iacr.org/2017/667.pdf although this
/// implementation uses a different KEM construction based on
/// https://eprint.iacr.org/2017/1005.pdf.
///
/// This module is a remnant of early post-quantum KEM deployments. It should not
/// be used in any new applications. Use ML-KEM instead.
///
/// TODO(crbug.com/503068543): Remove this.
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct HRSS_private_key {
    pub opaque: [u8; 1808usize],
}
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct HRSS_public_key {
    pub opaque: [u8; 1424usize],
}
unsafe extern "C" {
    /// HRSS_generate_key is a deterministic function that outputs a public and
    /// private key based on the given entropy. It returns one on success or zero
    /// on malloc failure.
    pub fn HRSS_generate_key(
        out_pub: *mut HRSS_public_key,
        out_priv: *mut HRSS_private_key,
        input: *const u8,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// HRSS_encap is a deterministic function the generates and encrypts a random
    /// session key from the given entropy, writing those values to `out_shared_key`
    /// and `out_ciphertext`, respectively. It returns one on success or zero on
    /// malloc failure.
    pub fn HRSS_encap(
        out_ciphertext: *mut u8,
        out_shared_key: *mut u8,
        in_pub: *const HRSS_public_key,
        in_: *const u8,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// HRSS_decap decrypts a session key from `ciphertext_len` bytes of
    /// `ciphertext`. If the ciphertext is valid, the decrypted key is written to
    /// `out_shared_key`. Otherwise the HMAC of `ciphertext` under a secret key (kept
    /// in `in_priv`) is written. If the ciphertext is the wrong length then it will
    /// leak which was done via side-channels. Otherwise it should perform either
    /// action in constant-time. It returns one on success (whether the ciphertext
    /// was valid or not) and zero on malloc failure.
    pub fn HRSS_decap(
        out_shared_key: *mut u8,
        in_priv: *const HRSS_private_key,
        ciphertext: *const u8,
        ciphertext_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// HRSS_marshal_public_key serialises `in_pub` to `out`.
    pub fn HRSS_marshal_public_key(out: *mut u8, in_pub: *const HRSS_public_key);
}
unsafe extern "C" {
    /// HRSS_parse_public_key sets `*out` to the public-key encoded in `in`. It
    /// returns true on success and zero on error.
    pub fn HRSS_parse_public_key(out: *mut HRSS_public_key, in_: *const u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_CTX_hkdf_mode configures which HKDF operation to run. It returns one
    /// on success and zero on error. `mode` must be one of `EVP_PKEY_HKDEF_MODE_*`.
    /// By default, the mode is `EVP_PKEY_HKDEF_MODE_EXTRACT_AND_EXPAND`.
    ///
    /// If `mode` is `EVP_PKEY_HKDEF_MODE_EXTRACT_AND_EXPAND` or
    /// `EVP_PKEY_HKDEF_MODE_EXPAND_ONLY`, the output is variable-length.
    /// `EVP_PKEY_derive` uses the size of the output buffer as the output length for
    /// HKDF-Expand.
    ///
    /// WARNING: Although this API calls it a "mode", HKDF-Extract and HKDF-Expand
    /// are distinct operations with distinct inputs and distinct kinds of keys.
    /// Callers should not pass input secrets for one operation into the other.
    pub fn EVP_PKEY_CTX_hkdf_mode(
        ctx: *mut EVP_PKEY_CTX,
        mode: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_CTX_set_hkdf_md sets `md` as the digest to use with HKDF. It returns
    /// one on success and zero on error.
    pub fn EVP_PKEY_CTX_set_hkdf_md(
        ctx: *mut EVP_PKEY_CTX,
        md: *const EVP_MD,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_CTX_set1_hkdf_key configures HKDF to use `key_len` bytes from `key`
    /// as the "key", described below. It returns one on success and zero on error.
    ///
    /// Which input is the key depends on the "mode" (see `EVP_PKEY_CTX_hkdf_mode`).
    /// If `EVP_PKEY_HKDEF_MODE_EXTRACT_AND_EXPAND` or
    /// `EVP_PKEY_HKDEF_MODE_EXTRACT_ONLY`, this function specifies the input keying
    /// material (IKM) for HKDF-Extract. If `EVP_PKEY_HKDEF_MODE_EXPAND_ONLY`, it
    /// instead specifies the pseudorandom key (PRK) for HKDF-Expand.
    pub fn EVP_PKEY_CTX_set1_hkdf_key(
        ctx: *mut EVP_PKEY_CTX,
        key: *const u8,
        key_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_CTX_set1_hkdf_salt configures HKDF to use `salt_len` bytes from
    /// `salt` as the salt parameter to HKDF-Extract. It returns one on success and
    /// zero on error. If performing HKDF-Expand only, this parameter is ignored.
    pub fn EVP_PKEY_CTX_set1_hkdf_salt(
        ctx: *mut EVP_PKEY_CTX,
        salt: *const u8,
        salt_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKEY_CTX_add1_hkdf_info appends `info_len` bytes from `info` to the info
    /// parameter used with HKDF-Expand. It returns one on success and zero on error.
    /// If performing HKDF-Extract only, this parameter is ignored.
    pub fn EVP_PKEY_CTX_add1_hkdf_info(
        ctx: *mut EVP_PKEY_CTX,
        info: *const u8,
        info_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// MD4_Init initialises `md4` and returns one.
    pub fn MD4_Init(md4: *mut MD4_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// MD4_Update adds `len` bytes from `data` to `md4` and returns one.
    pub fn MD4_Update(
        md4: *mut MD4_CTX,
        data: *const ::core::ffi::c_void,
        len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// MD4_Final adds the final padding to `md4` and writes the resulting digest to
    /// `out`, which must have at least `MD4_DIGEST_LENGTH` bytes of space. It
    /// returns one.
    pub fn MD4_Final(out: *mut u8, md4: *mut MD4_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// MD4 writes the digest of `len` bytes from `data` to `out` and returns `out`.
    /// There must be at least `MD4_DIGEST_LENGTH` bytes of space in `out`.
    pub fn MD4(data: *const u8, len: usize, out: *mut u8) -> *mut u8;
}
unsafe extern "C" {
    /// MD4_Transform is a low-level function that performs a single, MD4 block
    /// transformation using the state from `md4` and 64 bytes from `block`.
    pub fn MD4_Transform(md4: *mut MD4_CTX, block: *const u8);
}
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct md4_state_st {
    pub h: [u32; 4usize],
    pub Nl: u32,
    pub Nh: u32,
    pub data: [u8; 64usize],
    pub num: ::core::ffi::c_uint,
}
unsafe extern "C" {
    /// MD5_Init initialises `md5` and returns one.
    pub fn MD5_Init(md5: *mut MD5_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// MD5_Update adds `len` bytes from `data` to `md5` and returns one.
    pub fn MD5_Update(
        md5: *mut MD5_CTX,
        data: *const ::core::ffi::c_void,
        len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// MD5_Final adds the final padding to `md5` and writes the resulting digest to
    /// `out`, which must have at least `MD5_DIGEST_LENGTH` bytes of space. It
    /// returns one.
    pub fn MD5_Final(out: *mut u8, md5: *mut MD5_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// MD5 writes the digest of `len` bytes from `data` to `out` and returns `out`.
    /// There must be at least `MD5_DIGEST_LENGTH` bytes of space in `out`.
    pub fn MD5(data: *const u8, len: usize, out: *mut u8) -> *mut u8;
}
unsafe extern "C" {
    /// MD5_Transform is a low-level function that performs a single, MD5 block
    /// transformation using the state from `md5` and 64 bytes from `block`.
    pub fn MD5_Transform(md5: *mut MD5_CTX, block: *const u8);
}
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct md5_state_st {
    pub h: [u32; 4usize],
    pub Nl: u32,
    pub Nh: u32,
    pub data: [u8; 64usize],
    pub num: ::core::ffi::c_uint,
}
/// MLDSA65_private_key contains an ML-DSA-65 private key. The contents of this
/// object should never leave the address space since the format is unstable.
#[repr(C)]
#[derive(Copy, Clone)]
pub struct MLDSA65_private_key {
    pub opaque: MLDSA65_private_key__bindgen_ty_1,
}
#[repr(C)]
#[derive(Copy, Clone)]
pub union MLDSA65_private_key__bindgen_ty_1 {
    pub bytes: [u8; 23680usize],
    pub alignment: u32,
}
/// MLDSA65_public_key contains an ML-DSA-65 public key. The contents of this
/// object should never leave the address space since the format is unstable.
#[repr(C)]
#[derive(Copy, Clone)]
pub struct MLDSA65_public_key {
    pub opaque: MLDSA65_public_key__bindgen_ty_1,
}
#[repr(C)]
#[derive(Copy, Clone)]
pub union MLDSA65_public_key__bindgen_ty_1 {
    pub bytes: [u8; 6240usize],
    pub alignment: u32,
}
/// MLDSA65_prehash contains a pre-hash context for ML-DSA-65. The contents of
/// this object should never leave the address space since the format is
/// unstable.
#[repr(C)]
#[derive(Copy, Clone)]
pub struct MLDSA65_prehash {
    pub opaque: MLDSA65_prehash__bindgen_ty_1,
}
#[repr(C)]
#[derive(Copy, Clone)]
pub union MLDSA65_prehash__bindgen_ty_1 {
    pub bytes: [u8; 240usize],
    pub alignment: u64,
}
unsafe extern "C" {
    /// MLDSA65_generate_key generates a random public/private key pair, writes the
    /// encoded public key to `out_encoded_public_key`, writes the seed to
    /// `out_seed`, and sets `out_private_key` to the private key. Returns 1 on
    /// success and 0 on allocation failure.
    pub fn MLDSA65_generate_key(
        out_encoded_public_key: *mut u8,
        out_seed: *mut u8,
        out_private_key: *mut MLDSA65_private_key,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// MLDSA65_private_key_from_seed regenerates a private key from a seed value
    /// that was generated by `MLDSA65_generate_key`. Returns 1 on success and 0 on
    /// allocation failure or if `seed_len` is incorrect.
    pub fn MLDSA65_private_key_from_seed(
        out_private_key: *mut MLDSA65_private_key,
        seed: *const u8,
        seed_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// MLDSA65_public_from_private sets `*out_public_key` to the public key that
    /// corresponds to `private_key`. Returns 1 on success and 0 on failure.
    pub fn MLDSA65_public_from_private(
        out_public_key: *mut MLDSA65_public_key,
        private_key: *const MLDSA65_private_key,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// MLDSA65_sign generates a signature for the message `msg` of length
    /// `msg_len` using `private_key` (following the randomized algorithm), and
    /// writes the encoded signature to `out_encoded_signature`. The `context`
    /// argument is also signed over and can be used to include implicit contextual
    /// information that isn't included in `msg`. The same value of `context` must be
    /// presented to `MLDSA65_verify` in order for the generated signature to be
    /// considered valid. `context` and `context_len` may be `NULL` and 0 to use an
    /// empty context (this is common). Returns 1 on success and 0 on failure.
    pub fn MLDSA65_sign(
        out_encoded_signature: *mut u8,
        private_key: *const MLDSA65_private_key,
        msg: *const u8,
        msg_len: usize,
        context: *const u8,
        context_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// MLDSA65_verify verifies that `signature` constitutes a valid
    /// signature for the message `msg` of length `msg_len` using `public_key`. The
    /// value of `context` must equal the value that was passed to `MLDSA65_sign`
    /// when the signature was generated. Returns 1 on success or 0 on error.
    pub fn MLDSA65_verify(
        public_key: *const MLDSA65_public_key,
        signature: *const u8,
        signature_len: usize,
        msg: *const u8,
        msg_len: usize,
        context: *const u8,
        context_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// MLDSA65_prehash_init initializes a pre-hashing state using `public_key`. The
    /// `context` argument can be used to include implicit contextual information
    /// that isn't included in the message. The same value of `context` must be
    /// presented to `MLDSA65_verify` in order for the generated signature to be
    /// considered valid. `context` and `context_len` may be `NULL` and 0 to use an
    /// empty context (this is common). Returns 1 on success and 0 on failure (if the
    /// context is too long).
    pub fn MLDSA65_prehash_init(
        out_state: *mut MLDSA65_prehash,
        public_key: *const MLDSA65_public_key,
        context: *const u8,
        context_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// MLDSA65_prehash_update incorporates the given `msg` of length `msg_len` into
    /// the pre-hashing state. This can be called multiple times on successive chunks
    /// of the message. This should be called after `MLDSA65_prehash_init` and before
    /// `MLDSA65_prehash_finalize`.
    pub fn MLDSA65_prehash_update(
        inout_state: *mut MLDSA65_prehash,
        msg: *const u8,
        msg_len: usize,
    );
}
unsafe extern "C" {
    /// MLDSA65_prehash_finalize extracts a pre-hashed message representative from
    /// the given pre-hashing state. This should be called after
    /// `MLDSA65_prehash_init` and `MLDSA65_prehash_update`. The resulting
    /// `out_msg_rep` should then be passed to `MLDSA65_sign_message_representative`
    /// to obtain a signature.
    pub fn MLDSA65_prehash_finalize(out_msg_rep: *mut u8, inout_state: *mut MLDSA65_prehash);
}
unsafe extern "C" {
    /// MLDSA65_sign_message_representative generates a signature for the pre-hashed
    /// message `msg_rep` using `private_key` (following the randomized algorithm),
    /// and writes the encoded signature to `out_encoded_signature`. The `msg_rep`
    /// should be obtained via calls to `MLDSA65_prehash_init`,
    /// `MLDSA65_prehash_update` and `MLDSA65_prehash_finalize` using the public key
    /// from the same key pair, otherwise the signature will not verify. Returns 1 on
    /// success and 0 on failure.
    pub fn MLDSA65_sign_message_representative(
        out_encoded_signature: *mut u8,
        private_key: *const MLDSA65_private_key,
        msg_rep: *const u8,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// MLDSA65_verify_message_representative verifies that `signature` constitutes a
    /// valid signature for the pre-hashed message `msg_rep` using `public_key`. The
    /// `msg_rep` should be obtained via calls to `MLDSA65_prehash_init`,
    /// `MLDSA65_prehash_update` and `MLDSA65_prehash_finalize` using `public_key`
    /// and the same context as when the signature was generated. Returns 1 on
    /// success or 0 on error.
    pub fn MLDSA65_verify_message_representative(
        public_key: *const MLDSA65_public_key,
        signature: *const u8,
        signature_len: usize,
        msg_rep: *const u8,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// MLDSA65_marshal_public_key serializes `public_key` to `out` in the standard
    /// format for ML-DSA-65 public keys. It returns 1 on success or 0 on
    /// allocation error.
    pub fn MLDSA65_marshal_public_key(
        out: *mut CBB,
        public_key: *const MLDSA65_public_key,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// MLDSA65_parse_public_key parses a public key, in the format generated by
    /// `MLDSA65_marshal_public_key`, from `in` and writes the result to
    /// `out_public_key`. It returns 1 on success or 0 on parse error or if
    /// there are trailing bytes in `in`.
    pub fn MLDSA65_parse_public_key(
        public_key: *mut MLDSA65_public_key,
        in_: *mut CBS,
    ) -> ::core::ffi::c_int;
}
/// MLDSA87_private_key contains an ML-DSA-87 private key. The contents of this
/// object should never leave the address space since the format is unstable.
#[repr(C)]
#[derive(Copy, Clone)]
pub struct MLDSA87_private_key {
    pub opaque: MLDSA87_private_key__bindgen_ty_1,
}
#[repr(C)]
#[derive(Copy, Clone)]
pub union MLDSA87_private_key__bindgen_ty_1 {
    pub bytes: [u8; 31872usize],
    pub alignment: u32,
}
/// MLDSA87_public_key contains an ML-DSA-87 public key. The contents of this
/// object should never leave the address space since the format is unstable.
#[repr(C)]
#[derive(Copy, Clone)]
pub struct MLDSA87_public_key {
    pub opaque: MLDSA87_public_key__bindgen_ty_1,
}
#[repr(C)]
#[derive(Copy, Clone)]
pub union MLDSA87_public_key__bindgen_ty_1 {
    pub bytes: [u8; 8288usize],
    pub alignment: u32,
}
/// MLDSA87_prehash contains a pre-hash context for ML-DSA-87. The contents of
/// this object should never leave the address space since the format is
/// unstable.
#[repr(C)]
#[derive(Copy, Clone)]
pub struct MLDSA87_prehash {
    pub opaque: MLDSA87_prehash__bindgen_ty_1,
}
#[repr(C)]
#[derive(Copy, Clone)]
pub union MLDSA87_prehash__bindgen_ty_1 {
    pub bytes: [u8; 240usize],
    pub alignment: u64,
}
unsafe extern "C" {
    /// MLDSA87_generate_key generates a random public/private key pair, writes the
    /// encoded public key to `out_encoded_public_key`, writes the seed to
    /// `out_seed`, and sets `out_private_key` to the private key. Returns 1 on
    /// success and 0 on allocation failure.
    pub fn MLDSA87_generate_key(
        out_encoded_public_key: *mut u8,
        out_seed: *mut u8,
        out_private_key: *mut MLDSA87_private_key,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// MLDSA87_private_key_from_seed regenerates a private key from a seed value
    /// that was generated by `MLDSA87_generate_key`. Returns 1 on success and 0 on
    /// allocation failure or if `seed_len` is incorrect.
    pub fn MLDSA87_private_key_from_seed(
        out_private_key: *mut MLDSA87_private_key,
        seed: *const u8,
        seed_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// MLDSA87_public_from_private sets `*out_public_key` to the public key that
    /// corresponds to `private_key`. Returns 1 on success and 0 on failure.
    pub fn MLDSA87_public_from_private(
        out_public_key: *mut MLDSA87_public_key,
        private_key: *const MLDSA87_private_key,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// MLDSA87_sign generates a signature for the message `msg` of length
    /// `msg_len` using `private_key` (following the randomized algorithm), and
    /// writes the encoded signature to `out_encoded_signature`. The `context`
    /// argument is also signed over and can be used to include implicit contextual
    /// information that isn't included in `msg`. The same value of `context` must be
    /// presented to `MLDSA87_verify` in order for the generated signature to be
    /// considered valid. `context` and `context_len` may be `NULL` and 0 to use an
    /// empty context (this is common). Returns 1 on success and 0 on failure.
    pub fn MLDSA87_sign(
        out_encoded_signature: *mut u8,
        private_key: *const MLDSA87_private_key,
        msg: *const u8,
        msg_len: usize,
        context: *const u8,
        context_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// MLDSA87_verify verifies that `signature` constitutes a valid
    /// signature for the message `msg` of length `msg_len` using `public_key`. The
    /// value of `context` must equal the value that was passed to `MLDSA87_sign`
    /// when the signature was generated. Returns 1 on success or 0 on error.
    pub fn MLDSA87_verify(
        public_key: *const MLDSA87_public_key,
        signature: *const u8,
        signature_len: usize,
        msg: *const u8,
        msg_len: usize,
        context: *const u8,
        context_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// MLDSA87_prehash_init initializes a pre-hashing state using `public_key`. The
    /// `context` argument can be used to include implicit contextual information
    /// that isn't included in the message. The same value of `context` must be
    /// presented to `MLDSA87_verify` in order for the generated signature to be
    /// considered valid. `context` and `context_len` may be `NULL` and 0 to use an
    /// empty context (this is common). Returns 1 on success and 0 on failure (if the
    /// context is too long).
    pub fn MLDSA87_prehash_init(
        out_state: *mut MLDSA87_prehash,
        public_key: *const MLDSA87_public_key,
        context: *const u8,
        context_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// MLDSA87_prehash_update incorporates the given `msg` of length `msg_len` into
    /// the pre-hashing state. This can be called multiple times on successive chunks
    /// of the message. This should be called after `MLDSA87_prehash_init` and before
    /// `MLDSA87_prehash_finalize`.
    pub fn MLDSA87_prehash_update(
        inout_state: *mut MLDSA87_prehash,
        msg: *const u8,
        msg_len: usize,
    );
}
unsafe extern "C" {
    /// MLDSA87_prehash_finalize extracts a pre-hashed message representative from
    /// the given pre-hashing state. This should be called after
    /// `MLDSA87_prehash_init` and `MLDSA87_prehash_update`. The resulting
    /// `out_msg_rep` should then be passed to `MLDSA87_sign_message_representative`
    /// to obtain a signature.
    pub fn MLDSA87_prehash_finalize(out_msg_rep: *mut u8, inout_state: *mut MLDSA87_prehash);
}
unsafe extern "C" {
    /// MLDSA87_sign_message_representative generates a signature for the pre-hashed
    /// message `msg_rep` using `private_key` (following the randomized algorithm),
    /// and writes the encoded signature to `out_encoded_signature`. The `msg_rep`
    /// should be obtained via calls to `MLDSA87_prehash_init`,
    /// `MLDSA87_prehash_update` and `MLDSA87_prehash_finalize` using the public key
    /// from the same key pair, otherwise the signature will not verify. Returns 1 on
    /// success and 0 on failure.
    pub fn MLDSA87_sign_message_representative(
        out_encoded_signature: *mut u8,
        private_key: *const MLDSA87_private_key,
        msg_rep: *const u8,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// MLDSA87_verify_message_representative verifies that `signature` constitutes a
    /// valid signature for the pre-hashed message `msg_rep` using `public_key`. The
    /// `msg_rep` should be obtained via calls to `MLDSA87_prehash_init`,
    /// `MLDSA87_prehash_update` and `MLDSA87_prehash_finalize` using `public_key`
    /// and the same context as when the signature was generated. Returns 1 on
    /// success or 0 on error.
    pub fn MLDSA87_verify_message_representative(
        public_key: *const MLDSA87_public_key,
        signature: *const u8,
        signature_len: usize,
        msg_rep: *const u8,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// MLDSA87_marshal_public_key serializes `public_key` to `out` in the standard
    /// format for ML-DSA-87 public keys. It returns 1 on success or 0 on
    /// allocation error.
    pub fn MLDSA87_marshal_public_key(
        out: *mut CBB,
        public_key: *const MLDSA87_public_key,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// MLDSA87_parse_public_key parses a public key, in the format generated by
    /// `MLDSA87_marshal_public_key`, from `in` and writes the result to
    /// `out_public_key`. It returns 1 on success or 0 on parse error or if
    /// there are trailing bytes in `in`.
    pub fn MLDSA87_parse_public_key(
        public_key: *mut MLDSA87_public_key,
        in_: *mut CBS,
    ) -> ::core::ffi::c_int;
}
/// MLDSA44_private_key contains an ML-DSA-44 private key. The contents of this
/// object should never leave the address space since the format is unstable.
#[repr(C)]
#[derive(Copy, Clone)]
pub struct MLDSA44_private_key {
    pub opaque: MLDSA44_private_key__bindgen_ty_1,
}
#[repr(C)]
#[derive(Copy, Clone)]
pub union MLDSA44_private_key__bindgen_ty_1 {
    pub bytes: [u8; 16512usize],
    pub alignment: u32,
}
/// MLDSA44_public_key contains an ML-DSA-44 public key. The contents of this
/// object should never leave the address space since the format is unstable.
#[repr(C)]
#[derive(Copy, Clone)]
pub struct MLDSA44_public_key {
    pub opaque: MLDSA44_public_key__bindgen_ty_1,
}
#[repr(C)]
#[derive(Copy, Clone)]
pub union MLDSA44_public_key__bindgen_ty_1 {
    pub bytes: [u8; 4192usize],
    pub alignment: u32,
}
/// MLDSA44_prehash contains a pre-hash context for ML-DSA-44. The contents of
/// this object should never leave the address space since the format is
/// unstable.
#[repr(C)]
#[derive(Copy, Clone)]
pub struct MLDSA44_prehash {
    pub opaque: MLDSA44_prehash__bindgen_ty_1,
}
#[repr(C)]
#[derive(Copy, Clone)]
pub union MLDSA44_prehash__bindgen_ty_1 {
    pub bytes: [u8; 240usize],
    pub alignment: u64,
}
unsafe extern "C" {
    /// MLDSA44_generate_key generates a random public/private key pair, writes the
    /// encoded public key to `out_encoded_public_key`, writes the seed to
    /// `out_seed`, and sets `out_private_key` to the private key. Returns 1 on
    /// success and 0 on allocation failure.
    pub fn MLDSA44_generate_key(
        out_encoded_public_key: *mut u8,
        out_seed: *mut u8,
        out_private_key: *mut MLDSA44_private_key,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// MLDSA44_private_key_from_seed regenerates a private key from a seed value
    /// that was generated by `MLDSA44_generate_key`. Returns 1 on success and 0 on
    /// allocation failure or if `seed_len` is incorrect.
    pub fn MLDSA44_private_key_from_seed(
        out_private_key: *mut MLDSA44_private_key,
        seed: *const u8,
        seed_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// MLDSA44_public_from_private sets `*out_public_key` to the public key that
    /// corresponds to `private_key`. Returns 1 on success and 0 on failure.
    pub fn MLDSA44_public_from_private(
        out_public_key: *mut MLDSA44_public_key,
        private_key: *const MLDSA44_private_key,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// MLDSA44_sign generates a signature for the message `msg` of length
    /// `msg_len` using `private_key` (following the randomized algorithm), and
    /// writes the encoded signature to `out_encoded_signature`. The `context`
    /// argument is also signed over and can be used to include implicit contextual
    /// information that isn't included in `msg`. The same value of `context` must be
    /// presented to `MLDSA44_verify` in order for the generated signature to be
    /// considered valid. `context` and `context_len` may be `NULL` and 0 to use an
    /// empty context (this is common). Returns 1 on success and 0 on failure.
    pub fn MLDSA44_sign(
        out_encoded_signature: *mut u8,
        private_key: *const MLDSA44_private_key,
        msg: *const u8,
        msg_len: usize,
        context: *const u8,
        context_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// MLDSA44_verify verifies that `signature` constitutes a valid
    /// signature for the message `msg` of length `msg_len` using `public_key`. The
    /// value of `context` must equal the value that was passed to `MLDSA44_sign`
    /// when the signature was generated. Returns 1 on success or 0 on error.
    pub fn MLDSA44_verify(
        public_key: *const MLDSA44_public_key,
        signature: *const u8,
        signature_len: usize,
        msg: *const u8,
        msg_len: usize,
        context: *const u8,
        context_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// MLDSA44_prehash_init initializes a pre-hashing state using `public_key`. The
    /// `context` argument can be used to include implicit contextual information
    /// that isn't included in the message. The same value of `context` must be
    /// presented to `MLDSA44_verify` in order for the generated signature to be
    /// considered valid. `context` and `context_len` may be `NULL` and 0 to use an
    /// empty context (this is common). Returns 1 on success and 0 on failure (if the
    /// context is too long).
    pub fn MLDSA44_prehash_init(
        out_state: *mut MLDSA44_prehash,
        public_key: *const MLDSA44_public_key,
        context: *const u8,
        context_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// MLDSA44_prehash_update incorporates the given `msg` of length `msg_len` into
    /// the pre-hashing state. This can be called multiple times on successive chunks
    /// of the message. This should be called after `MLDSA44_prehash_init` and before
    /// `MLDSA44_prehash_finalize`.
    pub fn MLDSA44_prehash_update(
        inout_state: *mut MLDSA44_prehash,
        msg: *const u8,
        msg_len: usize,
    );
}
unsafe extern "C" {
    /// MLDSA44_prehash_finalize extracts a pre-hashed message representative from
    /// the given pre-hashing state. This should be called after
    /// `MLDSA44_prehash_init` and `MLDSA44_prehash_update`. The resulting
    /// `out_msg_rep` should then be passed to `MLDSA44_sign_message_representative`
    /// to obtain a signature.
    pub fn MLDSA44_prehash_finalize(out_msg_rep: *mut u8, inout_state: *mut MLDSA44_prehash);
}
unsafe extern "C" {
    /// MLDSA44_sign_message_representative generates a signature for the pre-hashed
    /// message `msg_rep` using `private_key` (following the randomized algorithm),
    /// and writes the encoded signature to `out_encoded_signature`. The `msg_rep`
    /// should be obtained via calls to `MLDSA44_prehash_init`,
    /// `MLDSA44_prehash_update` and `MLDSA44_prehash_finalize` using the public key
    /// from the same key pair, otherwise the signature will not verify. Returns 1 on
    /// success and 0 on failure.
    pub fn MLDSA44_sign_message_representative(
        out_encoded_signature: *mut u8,
        private_key: *const MLDSA44_private_key,
        msg_rep: *const u8,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// MLDSA44_verify_message_representative verifies that `signature` constitutes a
    /// valid signature for the pre-hashed message `msg_rep` using `public_key`. The
    /// `msg_rep` should be obtained via calls to `MLDSA44_prehash_init`,
    /// `MLDSA44_prehash_update` and `MLDSA44_prehash_finalize` using `public_key`
    /// and the same context as when the signature was generated. Returns 1 on
    /// success or 0 on error.
    pub fn MLDSA44_verify_message_representative(
        public_key: *const MLDSA44_public_key,
        signature: *const u8,
        signature_len: usize,
        msg_rep: *const u8,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// MLDSA44_marshal_public_key serializes `public_key` to `out` in the standard
    /// format for ML-DSA-44 public keys. It returns 1 on success or 0 on
    /// allocation error.
    pub fn MLDSA44_marshal_public_key(
        out: *mut CBB,
        public_key: *const MLDSA44_public_key,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// MLDSA44_parse_public_key parses a public key, in the format generated by
    /// `MLDSA44_marshal_public_key`, from `in` and writes the result to
    /// `out_public_key`. It returns 1 on success or 0 on parse error or if
    /// there are trailing bytes in `in`.
    pub fn MLDSA44_parse_public_key(
        public_key: *mut MLDSA44_public_key,
        in_: *mut CBS,
    ) -> ::core::ffi::c_int;
}
/// MLKEM768_public_key contains an ML-KEM-768 public key. The contents of this
/// object should never leave the address space since the format is unstable.
#[repr(C)]
#[derive(Copy, Clone)]
pub struct MLKEM768_public_key {
    pub opaque: MLKEM768_public_key__bindgen_ty_1,
}
#[repr(C)]
#[derive(Copy, Clone)]
pub union MLKEM768_public_key__bindgen_ty_1 {
    pub bytes: [u8; 6208usize],
    pub alignment: u16,
}
/// MLKEM768_private_key contains an ML-KEM-768 private key. The contents of this
/// object should never leave the address space since the format is unstable.
#[repr(C)]
#[derive(Copy, Clone)]
pub struct MLKEM768_private_key {
    pub opaque: MLKEM768_private_key__bindgen_ty_1,
}
#[repr(C)]
#[derive(Copy, Clone)]
pub union MLKEM768_private_key__bindgen_ty_1 {
    pub bytes: [u8; 7776usize],
    pub alignment: u16,
}
unsafe extern "C" {
    /// MLKEM768_generate_key generates a random public/private key pair, writes the
    /// encoded public key to `out_encoded_public_key` and sets `out_private_key` to
    /// the private key. If `optional_out_seed` is not NULL then the seed used to
    /// generate the private key is written to it.
    pub fn MLKEM768_generate_key(
        out_encoded_public_key: *mut u8,
        optional_out_seed: *mut u8,
        out_private_key: *mut MLKEM768_private_key,
    );
}
unsafe extern "C" {
    /// MLKEM768_private_key_from_seed derives a private key from a seed that was
    /// generated by `MLKEM768_generate_key`. It fails and returns 0 if `seed_len` is
    /// incorrect, otherwise it writes `*out_private_key` and returns 1.
    pub fn MLKEM768_private_key_from_seed(
        out_private_key: *mut MLKEM768_private_key,
        seed: *const u8,
        seed_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// MLKEM768_public_from_private sets `*out_public_key` to the public key that
    /// corresponds to `private_key`. (This is faster than parsing the output of
    /// `MLKEM768_generate_key` if, for some reason, you need to encapsulate to a key
    /// that was just generated.)
    pub fn MLKEM768_public_from_private(
        out_public_key: *mut MLKEM768_public_key,
        private_key: *const MLKEM768_private_key,
    );
}
unsafe extern "C" {
    /// MLKEM768_encap encrypts a random shared secret for `public_key`, writes the
    /// ciphertext to `out_ciphertext`, and writes the random shared secret to
    /// `out_shared_secret`.
    pub fn MLKEM768_encap(
        out_ciphertext: *mut u8,
        out_shared_secret: *mut u8,
        public_key: *const MLKEM768_public_key,
    );
}
unsafe extern "C" {
    /// MLKEM768_decap decrypts a shared secret from `ciphertext` using `private_key`
    /// and writes it to `out_shared_secret`. If `ciphertext_len` is incorrect it
    /// returns 0, otherwise it returns 1. If `ciphertext` is invalid (but of the
    /// correct length), `out_shared_secret` is filled with a key that will always be
    /// the same for the same `ciphertext` and `private_key`, but which appears to be
    /// random unless one has access to `private_key`. These alternatives occur in
    /// constant time. Any subsequent symmetric encryption using `out_shared_secret`
    /// must use an authenticated encryption scheme in order to discover the
    /// decapsulation failure.
    pub fn MLKEM768_decap(
        out_shared_secret: *mut u8,
        ciphertext: *const u8,
        ciphertext_len: usize,
        private_key: *const MLKEM768_private_key,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// MLKEM768_marshal_public_key serializes `public_key` to `out` in the standard
    /// format for ML-KEM-768 public keys. It returns one on success or zero on
    /// allocation error.
    pub fn MLKEM768_marshal_public_key(
        out: *mut CBB,
        public_key: *const MLKEM768_public_key,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// MLKEM768_parse_public_key parses a public key, in the format generated by
    /// `MLKEM768_marshal_public_key`, from `in` and writes the result to
    /// `out_public_key`. It returns one on success or zero on parse error or if
    /// there are trailing bytes in `in`.
    pub fn MLKEM768_parse_public_key(
        out_public_key: *mut MLKEM768_public_key,
        in_: *mut CBS,
    ) -> ::core::ffi::c_int;
}
/// MLKEM1024_public_key contains an ML-KEM-1024 public key. The contents of this
/// object should never leave the address space since the format is unstable.
#[repr(C)]
#[derive(Copy, Clone)]
pub struct MLKEM1024_public_key {
    pub opaque: MLKEM1024_public_key__bindgen_ty_1,
}
#[repr(C)]
#[derive(Copy, Clone)]
pub union MLKEM1024_public_key__bindgen_ty_1 {
    pub bytes: [u8; 10304usize],
    pub alignment: u16,
}
/// MLKEM1024_private_key contains a ML-KEM-1024 private key. The contents of
/// this object should never leave the address space since the format is
/// unstable.
#[repr(C)]
#[derive(Copy, Clone)]
pub struct MLKEM1024_private_key {
    pub opaque: MLKEM1024_private_key__bindgen_ty_1,
}
#[repr(C)]
#[derive(Copy, Clone)]
pub union MLKEM1024_private_key__bindgen_ty_1 {
    pub bytes: [u8; 12384usize],
    pub alignment: u16,
}
unsafe extern "C" {
    /// MLKEM1024_generate_key generates a random public/private key pair, writes the
    /// encoded public key to `out_encoded_public_key` and sets `out_private_key` to
    /// the private key. If `optional_out_seed` is not NULL then the seed used to
    /// generate the private key is written to it.
    pub fn MLKEM1024_generate_key(
        out_encoded_public_key: *mut u8,
        optional_out_seed: *mut u8,
        out_private_key: *mut MLKEM1024_private_key,
    );
}
unsafe extern "C" {
    /// MLKEM1024_private_key_from_seed derives a private key from a seed that was
    /// generated by `MLKEM1024_generate_key`. It fails and returns 0 if `seed_len`
    /// is incorrect, otherwise it writes `*out_private_key` and returns 1.
    pub fn MLKEM1024_private_key_from_seed(
        out_private_key: *mut MLKEM1024_private_key,
        seed: *const u8,
        seed_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// MLKEM1024_public_from_private sets `*out_public_key` to the public key that
    /// corresponds to `private_key`. (This is faster than parsing the output of
    /// `MLKEM1024_generate_key` if, for some reason, you need to encapsulate to a
    /// key that was just generated.)
    pub fn MLKEM1024_public_from_private(
        out_public_key: *mut MLKEM1024_public_key,
        private_key: *const MLKEM1024_private_key,
    );
}
unsafe extern "C" {
    /// MLKEM1024_encap encrypts a random shared secret for `public_key`, writes the
    /// ciphertext to `out_ciphertext`, and writes the random shared secret to
    /// `out_shared_secret`.
    pub fn MLKEM1024_encap(
        out_ciphertext: *mut u8,
        out_shared_secret: *mut u8,
        public_key: *const MLKEM1024_public_key,
    );
}
unsafe extern "C" {
    /// MLKEM1024_decap decrypts a shared secret from `ciphertext` using
    /// `private_key` and writes it to `out_shared_secret`. If `ciphertext_len` is
    /// incorrect it returns 0, otherwise it returns 1. If `ciphertext` is invalid
    /// (but of the correct length), `out_shared_secret` is filled with a key that
    /// will always be the same for the same `ciphertext` and `private_key`, but
    /// which appears to be random unless one has access to `private_key`. These
    /// alternatives occur in constant time. Any subsequent symmetric encryption
    /// using `out_shared_secret` must use an authenticated encryption scheme in
    /// order to discover the decapsulation failure.
    pub fn MLKEM1024_decap(
        out_shared_secret: *mut u8,
        ciphertext: *const u8,
        ciphertext_len: usize,
        private_key: *const MLKEM1024_private_key,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// MLKEM1024_marshal_public_key serializes `public_key` to `out` in the standard
    /// format for ML-KEM-1024 public keys. It returns one on success or zero on
    /// allocation error.
    pub fn MLKEM1024_marshal_public_key(
        out: *mut CBB,
        public_key: *const MLKEM1024_public_key,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// MLKEM1024_parse_public_key parses a public key, in the format generated by
    /// `MLKEM1024_marshal_public_key`, from `in` and writes the result to
    /// `out_public_key`. It returns one on success or zero on parse error or if
    /// there are trailing bytes in `in`.
    pub fn MLKEM1024_parse_public_key(
        out_public_key: *mut MLKEM1024_public_key,
        in_: *mut CBS,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// OBJ_dup returns a duplicate copy of `obj` or NULL on allocation failure. The
    /// caller must call `ASN1_OBJECT_free` on the result to release it.
    pub fn OBJ_dup(obj: *const ASN1_OBJECT) -> *mut ASN1_OBJECT;
}
unsafe extern "C" {
    /// OBJ_cmp returns a value less than, equal to or greater than zero if `a` is
    /// less than, equal to or greater than `b`, respectively.
    pub fn OBJ_cmp(a: *const ASN1_OBJECT, b: *const ASN1_OBJECT) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// OBJ_get0_data returns a pointer to the DER representation of `obj`. This is
    /// the contents of the DER-encoded identifier, not including the tag and length.
    /// If `obj` does not have an associated object identifier (i.e. it is a nid-only
    /// value), this value is the empty string.
    pub fn OBJ_get0_data(obj: *const ASN1_OBJECT) -> *const u8;
}
unsafe extern "C" {
    /// OBJ_length returns the length of the DER representation of `obj`. This is the
    /// contents of the DER-encoded identifier, not including the tag and length. If
    /// `obj` does not have an associated object identifier (i.e. it is a nid-only
    /// value), this value is the empty string.
    pub fn OBJ_length(obj: *const ASN1_OBJECT) -> usize;
}
unsafe extern "C" {
    /// OBJ_obj2nid returns the nid corresponding to `obj`, or `NID_undef` if no
    /// such object is known.
    pub fn OBJ_obj2nid(obj: *const ASN1_OBJECT) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// OBJ_cbs2nid returns the nid corresponding to the DER data in `cbs`, or
    /// `NID_undef` if no such object is known.
    pub fn OBJ_cbs2nid(cbs: *const CBS) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// OBJ_sn2nid returns the nid corresponding to `short_name`, or `NID_undef` if
    /// no such short name is known.
    pub fn OBJ_sn2nid(short_name: *const ::core::ffi::c_char) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// OBJ_ln2nid returns the nid corresponding to `long_name`, or `NID_undef` if
    /// no such long name is known.
    pub fn OBJ_ln2nid(long_name: *const ::core::ffi::c_char) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// OBJ_txt2nid returns the nid corresponding to `s`, which may be a short name,
    /// long name, or an ASCII string containing a dotted sequence of numbers. It
    /// returns the nid or NID_undef if unknown.
    pub fn OBJ_txt2nid(s: *const ::core::ffi::c_char) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// OBJ_nid2obj returns the `ASN1_OBJECT` corresponding to `nid`, or NULL if
    /// `nid` is unknown.
    ///
    /// Although the output is not const, this function returns a static, immutable
    /// `ASN1_OBJECT`. It is not necessary to release the object with
    /// `ASN1_OBJECT_free`.
    ///
    /// However, functions like `X509_ALGOR_set0` expect to take ownership of a
    /// possibly dynamically-allocated `ASN1_OBJECT`. `ASN1_OBJECT_free` is a no-op
    /// for static `ASN1_OBJECT`s, so `OBJ_nid2obj` is compatible with such
    /// functions.
    ///
    /// Callers are encouraged to store the result of this function in a const
    /// pointer. However, if using functions like `X509_ALGOR_set0`, callers may use
    /// a non-const pointer and manage ownership.
    pub fn OBJ_nid2obj(nid: ::core::ffi::c_int) -> *mut ASN1_OBJECT;
}
unsafe extern "C" {
    /// OBJ_get_undef returns the object for `NID_undef`. Prefer this function over
    /// `OBJ_nid2obj` to avoid pulling in the full OID table.
    pub fn OBJ_get_undef() -> *const ASN1_OBJECT;
}
unsafe extern "C" {
    /// OBJ_nid2sn returns the short name for `nid`, or NULL if `nid` is unknown.
    pub fn OBJ_nid2sn(nid: ::core::ffi::c_int) -> *const ::core::ffi::c_char;
}
unsafe extern "C" {
    /// OBJ_nid2ln returns the long name for `nid`, or NULL if `nid` is unknown.
    pub fn OBJ_nid2ln(nid: ::core::ffi::c_int) -> *const ::core::ffi::c_char;
}
unsafe extern "C" {
    /// OBJ_nid2cbb writes `nid` as an ASN.1 OBJECT IDENTIFIER to `out`. It returns
    /// one on success or zero otherwise.
    pub fn OBJ_nid2cbb(out: *mut CBB, nid: ::core::ffi::c_int) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// OBJ_txt2obj returns an ASN1_OBJECT for the textual representation in `s`.
    /// If `dont_search_names` is zero, then `s` will be matched against the long
    /// and short names of a known objects to find a match. Otherwise `s` must
    /// contain an ASCII string with a dotted sequence of numbers. The resulting
    /// object need not be previously known. It returns a freshly allocated
    /// `ASN1_OBJECT` or NULL on error.
    pub fn OBJ_txt2obj(
        s: *const ::core::ffi::c_char,
        dont_search_names: ::core::ffi::c_int,
    ) -> *mut ASN1_OBJECT;
}
unsafe extern "C" {
    /// OBJ_obj2txt converts `obj` to a textual representation. If
    /// `always_return_oid` is zero then `obj` will be matched against known objects
    /// and the long (preferably) or short name will be used if found. Otherwise
    /// `obj` will be converted into a dotted sequence of integers. If `out` is not
    /// NULL, then at most `out_len` bytes of the textual form will be written
    /// there. If `out_len` is at least one, then string written to `out` will
    /// always be NUL terminated. It returns the number of characters that could
    /// have been written, not including the final NUL, or -1 on error.
    pub fn OBJ_obj2txt(
        out: *mut ::core::ffi::c_char,
        out_len: ::core::ffi::c_int,
        obj: *const ASN1_OBJECT,
        always_return_oid: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// OBJ_create adds a known object and returns the NID of the new object, or
    /// NID_undef on error.
    ///
    /// WARNING: This function modifies global state. The table cannot contain
    /// duplicate OIDs, short names, or long names. If two callers in the same
    /// address space add conflicting values, only one registration will take effect.
    /// Avoid this function if possible. Instead, callers can process OIDs unknown to
    /// BoringSSL by acting on the byte representation directly. See
    /// `ASN1_OBJECT_create`, `OBJ_get0_data`, and `OBJ_length`.
    pub fn OBJ_create(
        oid: *const ::core::ffi::c_char,
        short_name: *const ::core::ffi::c_char,
        long_name: *const ::core::ffi::c_char,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// OBJ_find_sigid_algs finds the digest and public-key NIDs that correspond to
    /// the signing algorithm `sign_nid`. If successful, it sets `*out_digest_nid`
    /// and `*out_pkey_nid` and returns one. Otherwise it returns zero. Any of
    /// `out_digest_nid` or `out_pkey_nid` can be NULL if the caller doesn't need
    /// that output value.
    pub fn OBJ_find_sigid_algs(
        sign_nid: ::core::ffi::c_int,
        out_digest_nid: *mut ::core::ffi::c_int,
        out_pkey_nid: *mut ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// OBJ_find_sigid_by_algs finds the signature NID that corresponds to the
    /// combination of `digest_nid` and `pkey_nid`. If success, it sets
    /// `*out_sign_nid` and returns one. Otherwise it returns zero. The
    /// `out_sign_nid` argument can be NULL if the caller only wishes to learn
    /// whether the combination is valid.
    pub fn OBJ_find_sigid_by_algs(
        out_sign_nid: *mut ::core::ffi::c_int,
        digest_nid: ::core::ffi::c_int,
        pkey_nid: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
/// Deprecated functions.
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct obj_name_st {
    pub type_: ::core::ffi::c_int,
    pub alias: ::core::ffi::c_int,
    pub name: *const ::core::ffi::c_char,
    pub data: *const ::core::ffi::c_char,
}
/// Deprecated functions.
pub type OBJ_NAME = obj_name_st;
unsafe extern "C" {
    /// OBJ_NAME_do_all_sorted calls `callback` zero or more times, each time with
    /// the name of a different primitive. If `type` is `OBJ_NAME_TYPE_MD_METH` then
    /// the primitives will be hash functions, alternatively if `type` is
    /// `OBJ_NAME_TYPE_CIPHER_METH` then the primitives will be ciphers or cipher
    /// modes.
    ///
    /// This function is ill-specified and should never be used.
    pub fn OBJ_NAME_do_all_sorted(
        type_: ::core::ffi::c_int,
        callback: ::core::option::Option<
            unsafe extern "C" fn(arg1: *const OBJ_NAME, arg: *mut ::core::ffi::c_void),
        >,
        arg: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    /// OBJ_NAME_do_all calls `OBJ_NAME_do_all_sorted`.
    pub fn OBJ_NAME_do_all(
        type_: ::core::ffi::c_int,
        callback: ::core::option::Option<
            unsafe extern "C" fn(arg1: *const OBJ_NAME, arg: *mut ::core::ffi::c_void),
        >,
        arg: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    /// OBJ_cleanup does nothing.
    pub fn OBJ_cleanup();
}
/// PKCS#7.
///
/// This library contains functions for extracting information from PKCS#7
/// structures (RFC 2315).
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct stack_st_CRYPTO_BUFFER {
    _unused: [u8; 0],
}
/// PKCS#7.
///
/// This library contains functions for extracting information from PKCS#7
/// structures (RFC 2315).
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct stack_st_X509 {
    _unused: [u8; 0],
}
/// PKCS#7.
///
/// This library contains functions for extracting information from PKCS#7
/// structures (RFC 2315).
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct stack_st_X509_CRL {
    _unused: [u8; 0],
}
unsafe extern "C" {
    /// PKCS7_get_raw_certificates parses a PKCS#7, SignedData structure from `cbs`
    /// and appends the included certificates to `out_certs`. It returns one on
    /// success and zero on error. `cbs` is advanced passed the structure.
    ///
    /// Note that a SignedData structure may contain no certificates, in which case
    /// this function succeeds but does not append any certificates. Additionally,
    /// certificates in SignedData structures are unordered. Callers should not
    /// assume a particular order in `*out_certs` and may need to search for matches
    /// or run path-building algorithms.
    pub fn PKCS7_get_raw_certificates(
        out_certs: *mut stack_st_CRYPTO_BUFFER,
        cbs: *mut CBS,
        pool: *mut CRYPTO_BUFFER_POOL,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PKCS7_get_certificates behaves like `PKCS7_get_raw_certificates` but parses
    /// them into `X509` objects.
    pub fn PKCS7_get_certificates(
        out_certs: *mut stack_st_X509,
        cbs: *mut CBS,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PKCS7_bundle_raw_certificates appends a PKCS#7, SignedData structure
    /// containing `certs` to `out`. It returns one on success and zero on error.
    /// Note that certificates in SignedData structures are unordered. The order in
    /// `certs` will not be preserved.
    pub fn PKCS7_bundle_raw_certificates(
        out: *mut CBB,
        certs: *const stack_st_CRYPTO_BUFFER,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PKCS7_bundle_certificates behaves like `PKCS7_bundle_raw_certificates` but
    /// takes `X509` objects as input.
    pub fn PKCS7_bundle_certificates(
        out: *mut CBB,
        certs: *const stack_st_X509,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PKCS7_get_CRLs parses a PKCS#7, SignedData structure from `cbs` and appends
    /// the included CRLs to `out_crls`. It returns one on success and zero on error.
    /// `cbs` is advanced passed the structure.
    ///
    /// Note that a SignedData structure may contain no CRLs, in which case this
    /// function succeeds but does not append any CRLs. Additionally, CRLs in
    /// SignedData structures are unordered. Callers should not assume an order in
    /// `*out_crls` and may need to search for matches.
    pub fn PKCS7_get_CRLs(out_crls: *mut stack_st_X509_CRL, cbs: *mut CBS) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PKCS7_bundle_CRLs appends a PKCS#7, SignedData structure containing
    /// `crls` to `out`. It returns one on success and zero on error. Note that CRLs
    /// in SignedData structures are unordered. The order in `crls` will not be
    /// preserved.
    pub fn PKCS7_bundle_CRLs(out: *mut CBB, crls: *const stack_st_X509_CRL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PKCS7_get_PEM_certificates reads a PEM-encoded, PKCS#7, SignedData structure
    /// from `pem_bio` and appends the included certificates to `out_certs`. It
    /// returns one on success and zero on error.
    ///
    /// Note that a SignedData structure may contain no certificates, in which case
    /// this function succeeds but does not append any certificates. Additionally,
    /// certificates in SignedData structures are unordered. Callers should not
    /// assume a particular order in `*out_certs` and may need to search for matches
    /// or run path-building algorithms.
    pub fn PKCS7_get_PEM_certificates(
        out_certs: *mut stack_st_X509,
        pem_bio: *mut BIO,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PKCS7_get_PEM_CRLs reads a PEM-encoded, PKCS#7, SignedData structure from
    /// `pem_bio` and appends the included CRLs to `out_crls`. It returns one on
    /// success and zero on error.
    ///
    /// Note that a SignedData structure may contain no CRLs, in which case this
    /// function succeeds but does not append any CRLs. Additionally, CRLs in
    /// SignedData structures are unordered. Callers should not assume an order in
    /// `*out_crls` and may need to search for matches.
    pub fn PKCS7_get_PEM_CRLs(
        out_crls: *mut stack_st_X509_CRL,
        pem_bio: *mut BIO,
    ) -> ::core::ffi::c_int;
}
/// Deprecated functions.
///
/// These functions are a compatibility layer over a subset of OpenSSL's PKCS#7
/// API. It intentionally does not implement the whole thing, only the minimum
/// needed to build cryptography.io.
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct PKCS7_SIGNED {
    pub cert: *mut stack_st_X509,
    pub crl: *mut stack_st_X509_CRL,
}
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct PKCS7_SIGN_ENVELOPE {
    pub cert: *mut stack_st_X509,
    pub crl: *mut stack_st_X509_CRL,
}
pub type PKCS7_ENVELOPE = ::core::ffi::c_void;
pub type PKCS7_DIGEST = ::core::ffi::c_void;
pub type PKCS7_ENCRYPT = ::core::ffi::c_void;
pub type PKCS7_SIGNER_INFO = ::core::ffi::c_void;
#[repr(C)]
#[derive(Copy, Clone)]
pub struct PKCS7 {
    pub ber_bytes: *mut u8,
    pub ber_len: usize,
    /// Unlike OpenSSL, the following fields are immutable. They filled in when the
    /// object is parsed and ignored in serialization.
    pub type_: *mut ASN1_OBJECT,
    pub d: PKCS7__bindgen_ty_1,
}
#[repr(C)]
#[derive(Copy, Clone)]
pub union PKCS7__bindgen_ty_1 {
    pub ptr: *mut ::core::ffi::c_char,
    pub data: *mut ASN1_OCTET_STRING,
    pub sign: *mut PKCS7_SIGNED,
    pub enveloped: *mut PKCS7_ENVELOPE,
    pub signed_and_enveloped: *mut PKCS7_SIGN_ENVELOPE,
    pub digest: *mut PKCS7_DIGEST,
    pub encrypted: *mut PKCS7_ENCRYPT,
    pub other: *mut ASN1_TYPE,
}
unsafe extern "C" {
    /// d2i_PKCS7 parses a BER-encoded, PKCS#7 signed data ContentInfo structure from
    /// `len` bytes at `*inp`, as described in `d2i_SAMPLE`.
    pub fn d2i_PKCS7(out: *mut *mut PKCS7, inp: *mut *const u8, len: usize) -> *mut PKCS7;
}
unsafe extern "C" {
    /// d2i_PKCS7_bio behaves like `d2i_PKCS7` but reads the input from `bio`.  If
    /// the length of the object is indefinite the full contents of `bio` are read.
    ///
    /// If the function fails then some unknown amount of data may have been read
    /// from `bio`.
    pub fn d2i_PKCS7_bio(bio: *mut BIO, out: *mut *mut PKCS7) -> *mut PKCS7;
}
unsafe extern "C" {
    /// i2d_PKCS7 marshals `p7` as a DER-encoded PKCS#7 ContentInfo structure, as
    /// described in `i2d_SAMPLE`.
    pub fn i2d_PKCS7(p7: *const PKCS7, out: *mut *mut u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// i2d_PKCS7_bio writes `p7` to `bio`. It returns one on success and zero on
    /// error.
    pub fn i2d_PKCS7_bio(bio: *mut BIO, p7: *const PKCS7) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PKCS7_free releases memory associated with `p7`.
    pub fn PKCS7_free(p7: *mut PKCS7);
}
unsafe extern "C" {
    /// PKCS7_type_is_data returns zero.
    pub fn PKCS7_type_is_data(p7: *const PKCS7) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PKCS7_type_is_digest returns zero.
    pub fn PKCS7_type_is_digest(p7: *const PKCS7) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PKCS7_type_is_encrypted returns zero.
    pub fn PKCS7_type_is_encrypted(p7: *const PKCS7) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PKCS7_type_is_enveloped returns zero.
    pub fn PKCS7_type_is_enveloped(p7: *const PKCS7) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PKCS7_type_is_signed returns one. (We only support signed data ContentInfos.)
    pub fn PKCS7_type_is_signed(p7: *const PKCS7) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PKCS7_type_is_signedAndEnveloped returns zero.
    pub fn PKCS7_type_is_signedAndEnveloped(p7: *const PKCS7) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PKCS7_sign can operate in two modes to provide some backwards compatibility:
    ///
    /// The first mode assembles `certs` into a PKCS#7 signed data ContentInfo with
    /// external data and no signatures. It returns a newly-allocated `PKCS7` on
    /// success or NULL on error. `sign_cert` and `pkey` must be NULL. `data` is
    /// ignored. `flags` must be equal to `PKCS7_DETACHED`. Additionally,
    /// certificates in SignedData structures are unordered. The order of `certs`
    /// will not be preserved.
    ///
    /// The second mode generates a detached RSA SHA-256 signature of `data` using
    /// `pkey` and produces a PKCS#7 SignedData structure containing it. `certs`
    /// must be NULL and `flags` must be exactly
    /// `PKCS7_NOATTR | PKCS7_BINARY | PKCS7_NOCERTS | PKCS7_DETACHED`.
    ///
    /// Note this function only implements a subset of the corresponding OpenSSL
    /// function. It is provided for backwards compatibility only.
    pub fn PKCS7_sign(
        sign_cert: *mut X509,
        pkey: *mut EVP_PKEY,
        certs: *mut stack_st_X509,
        data: *mut BIO,
        flags: ::core::ffi::c_int,
    ) -> *mut PKCS7;
}
/// Buffers and buffer pools.
///
/// `CRYPTO_BUFFER`s are simply reference-counted, immutable byte string. A
/// single `CRYPTO_BUFFER` can be referenced from multiple parts of an
/// application without storing multiple copies of the underlying data in
/// memory.
///
/// A `CRYPTO_BUFFER_POOL` can be used to additionally deduplicate
/// `CRYPTO_BUFFER`s on construction. It maintains weak references to associated
/// `CRYPTO_BUFFER`s and returns an existing `CRYPTO_BUFFER` if matching ones
/// already exist.
///
/// Without a `CRYPTO_BUFFER_POOL`, if two parts of application construct an
/// identical `CRYPTO_BUFFER` (e.g. if two TLS connections received the same
/// certificate), there will be two copies of the buffer in memory. A
/// `CRYPTO_BUFFER_POOL` allows two parts of an application that construct
/// `CRYPTO_BUFFER`s to deduplicate their contents, at the cost of more thread
/// contention.
pub type sk_CRYPTO_BUFFER_free_func =
    ::core::option::Option<unsafe extern "C" fn(arg1: *mut CRYPTO_BUFFER)>;
/// Buffers and buffer pools.
///
/// `CRYPTO_BUFFER`s are simply reference-counted, immutable byte string. A
/// single `CRYPTO_BUFFER` can be referenced from multiple parts of an
/// application without storing multiple copies of the underlying data in
/// memory.
///
/// A `CRYPTO_BUFFER_POOL` can be used to additionally deduplicate
/// `CRYPTO_BUFFER`s on construction. It maintains weak references to associated
/// `CRYPTO_BUFFER`s and returns an existing `CRYPTO_BUFFER` if matching ones
/// already exist.
///
/// Without a `CRYPTO_BUFFER_POOL`, if two parts of application construct an
/// identical `CRYPTO_BUFFER` (e.g. if two TLS connections received the same
/// certificate), there will be two copies of the buffer in memory. A
/// `CRYPTO_BUFFER_POOL` allows two parts of an application that construct
/// `CRYPTO_BUFFER`s to deduplicate their contents, at the cost of more thread
/// contention.
pub type sk_CRYPTO_BUFFER_copy_func =
    ::core::option::Option<unsafe extern "C" fn(arg1: *const CRYPTO_BUFFER) -> *mut CRYPTO_BUFFER>;
/// Buffers and buffer pools.
///
/// `CRYPTO_BUFFER`s are simply reference-counted, immutable byte string. A
/// single `CRYPTO_BUFFER` can be referenced from multiple parts of an
/// application without storing multiple copies of the underlying data in
/// memory.
///
/// A `CRYPTO_BUFFER_POOL` can be used to additionally deduplicate
/// `CRYPTO_BUFFER`s on construction. It maintains weak references to associated
/// `CRYPTO_BUFFER`s and returns an existing `CRYPTO_BUFFER` if matching ones
/// already exist.
///
/// Without a `CRYPTO_BUFFER_POOL`, if two parts of application construct an
/// identical `CRYPTO_BUFFER` (e.g. if two TLS connections received the same
/// certificate), there will be two copies of the buffer in memory. A
/// `CRYPTO_BUFFER_POOL` allows two parts of an application that construct
/// `CRYPTO_BUFFER`s to deduplicate their contents, at the cost of more thread
/// contention.
pub type sk_CRYPTO_BUFFER_cmp_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *const *const CRYPTO_BUFFER,
        arg2: *const *const CRYPTO_BUFFER,
    ) -> ::core::ffi::c_int,
>;
/// Buffers and buffer pools.
///
/// `CRYPTO_BUFFER`s are simply reference-counted, immutable byte string. A
/// single `CRYPTO_BUFFER` can be referenced from multiple parts of an
/// application without storing multiple copies of the underlying data in
/// memory.
///
/// A `CRYPTO_BUFFER_POOL` can be used to additionally deduplicate
/// `CRYPTO_BUFFER`s on construction. It maintains weak references to associated
/// `CRYPTO_BUFFER`s and returns an existing `CRYPTO_BUFFER` if matching ones
/// already exist.
///
/// Without a `CRYPTO_BUFFER_POOL`, if two parts of application construct an
/// identical `CRYPTO_BUFFER` (e.g. if two TLS connections received the same
/// certificate), there will be two copies of the buffer in memory. A
/// `CRYPTO_BUFFER_POOL` allows two parts of an application that construct
/// `CRYPTO_BUFFER`s to deduplicate their contents, at the cost of more thread
/// contention.
pub type sk_CRYPTO_BUFFER_delete_if_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *mut CRYPTO_BUFFER,
        arg2: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int,
>;
unsafe extern "C" {
    /// Buffers and buffer pools.
    ///
    /// `CRYPTO_BUFFER`s are simply reference-counted, immutable byte string. A
    /// single `CRYPTO_BUFFER` can be referenced from multiple parts of an
    /// application without storing multiple copies of the underlying data in
    /// memory.
    ///
    /// A `CRYPTO_BUFFER_POOL` can be used to additionally deduplicate
    /// `CRYPTO_BUFFER`s on construction. It maintains weak references to associated
    /// `CRYPTO_BUFFER`s and returns an existing `CRYPTO_BUFFER` if matching ones
    /// already exist.
    ///
    /// Without a `CRYPTO_BUFFER_POOL`, if two parts of application construct an
    /// identical `CRYPTO_BUFFER` (e.g. if two TLS connections received the same
    /// certificate), there will be two copies of the buffer in memory. A
    /// `CRYPTO_BUFFER_POOL` allows two parts of an application that construct
    /// `CRYPTO_BUFFER`s to deduplicate their contents, at the cost of more thread
    /// contention.
    #[link_name = "sk_CRYPTO_BUFFER_call_free_func__extern"]
    pub fn sk_CRYPTO_BUFFER_call_free_func(
        free_func: OPENSSL_sk_free_func,
        ptr: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    /// Buffers and buffer pools.
    ///
    /// `CRYPTO_BUFFER`s are simply reference-counted, immutable byte string. A
    /// single `CRYPTO_BUFFER` can be referenced from multiple parts of an
    /// application without storing multiple copies of the underlying data in
    /// memory.
    ///
    /// A `CRYPTO_BUFFER_POOL` can be used to additionally deduplicate
    /// `CRYPTO_BUFFER`s on construction. It maintains weak references to associated
    /// `CRYPTO_BUFFER`s and returns an existing `CRYPTO_BUFFER` if matching ones
    /// already exist.
    ///
    /// Without a `CRYPTO_BUFFER_POOL`, if two parts of application construct an
    /// identical `CRYPTO_BUFFER` (e.g. if two TLS connections received the same
    /// certificate), there will be two copies of the buffer in memory. A
    /// `CRYPTO_BUFFER_POOL` allows two parts of an application that construct
    /// `CRYPTO_BUFFER`s to deduplicate their contents, at the cost of more thread
    /// contention.
    #[link_name = "sk_CRYPTO_BUFFER_call_copy_func__extern"]
    pub fn sk_CRYPTO_BUFFER_call_copy_func(
        copy_func: OPENSSL_sk_copy_func,
        ptr: *const ::core::ffi::c_void,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    /// Buffers and buffer pools.
    ///
    /// `CRYPTO_BUFFER`s are simply reference-counted, immutable byte string. A
    /// single `CRYPTO_BUFFER` can be referenced from multiple parts of an
    /// application without storing multiple copies of the underlying data in
    /// memory.
    ///
    /// A `CRYPTO_BUFFER_POOL` can be used to additionally deduplicate
    /// `CRYPTO_BUFFER`s on construction. It maintains weak references to associated
    /// `CRYPTO_BUFFER`s and returns an existing `CRYPTO_BUFFER` if matching ones
    /// already exist.
    ///
    /// Without a `CRYPTO_BUFFER_POOL`, if two parts of application construct an
    /// identical `CRYPTO_BUFFER` (e.g. if two TLS connections received the same
    /// certificate), there will be two copies of the buffer in memory. A
    /// `CRYPTO_BUFFER_POOL` allows two parts of an application that construct
    /// `CRYPTO_BUFFER`s to deduplicate their contents, at the cost of more thread
    /// contention.
    #[link_name = "sk_CRYPTO_BUFFER_call_cmp_func__extern"]
    pub fn sk_CRYPTO_BUFFER_call_cmp_func(
        cmp_func: OPENSSL_sk_cmp_func,
        a: *const ::core::ffi::c_void,
        b: *const ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Buffers and buffer pools.
    ///
    /// `CRYPTO_BUFFER`s are simply reference-counted, immutable byte string. A
    /// single `CRYPTO_BUFFER` can be referenced from multiple parts of an
    /// application without storing multiple copies of the underlying data in
    /// memory.
    ///
    /// A `CRYPTO_BUFFER_POOL` can be used to additionally deduplicate
    /// `CRYPTO_BUFFER`s on construction. It maintains weak references to associated
    /// `CRYPTO_BUFFER`s and returns an existing `CRYPTO_BUFFER` if matching ones
    /// already exist.
    ///
    /// Without a `CRYPTO_BUFFER_POOL`, if two parts of application construct an
    /// identical `CRYPTO_BUFFER` (e.g. if two TLS connections received the same
    /// certificate), there will be two copies of the buffer in memory. A
    /// `CRYPTO_BUFFER_POOL` allows two parts of an application that construct
    /// `CRYPTO_BUFFER`s to deduplicate their contents, at the cost of more thread
    /// contention.
    #[link_name = "sk_CRYPTO_BUFFER_call_delete_if_func__extern"]
    pub fn sk_CRYPTO_BUFFER_call_delete_if_func(
        func: OPENSSL_sk_delete_if_func,
        obj: *mut ::core::ffi::c_void,
        data: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Buffers and buffer pools.
    ///
    /// `CRYPTO_BUFFER`s are simply reference-counted, immutable byte string. A
    /// single `CRYPTO_BUFFER` can be referenced from multiple parts of an
    /// application without storing multiple copies of the underlying data in
    /// memory.
    ///
    /// A `CRYPTO_BUFFER_POOL` can be used to additionally deduplicate
    /// `CRYPTO_BUFFER`s on construction. It maintains weak references to associated
    /// `CRYPTO_BUFFER`s and returns an existing `CRYPTO_BUFFER` if matching ones
    /// already exist.
    ///
    /// Without a `CRYPTO_BUFFER_POOL`, if two parts of application construct an
    /// identical `CRYPTO_BUFFER` (e.g. if two TLS connections received the same
    /// certificate), there will be two copies of the buffer in memory. A
    /// `CRYPTO_BUFFER_POOL` allows two parts of an application that construct
    /// `CRYPTO_BUFFER`s to deduplicate their contents, at the cost of more thread
    /// contention.
    #[link_name = "sk_CRYPTO_BUFFER_new__extern"]
    pub fn sk_CRYPTO_BUFFER_new(comp: sk_CRYPTO_BUFFER_cmp_func) -> *mut stack_st_CRYPTO_BUFFER;
}
unsafe extern "C" {
    /// Buffers and buffer pools.
    ///
    /// `CRYPTO_BUFFER`s are simply reference-counted, immutable byte string. A
    /// single `CRYPTO_BUFFER` can be referenced from multiple parts of an
    /// application without storing multiple copies of the underlying data in
    /// memory.
    ///
    /// A `CRYPTO_BUFFER_POOL` can be used to additionally deduplicate
    /// `CRYPTO_BUFFER`s on construction. It maintains weak references to associated
    /// `CRYPTO_BUFFER`s and returns an existing `CRYPTO_BUFFER` if matching ones
    /// already exist.
    ///
    /// Without a `CRYPTO_BUFFER_POOL`, if two parts of application construct an
    /// identical `CRYPTO_BUFFER` (e.g. if two TLS connections received the same
    /// certificate), there will be two copies of the buffer in memory. A
    /// `CRYPTO_BUFFER_POOL` allows two parts of an application that construct
    /// `CRYPTO_BUFFER`s to deduplicate their contents, at the cost of more thread
    /// contention.
    #[link_name = "sk_CRYPTO_BUFFER_new_null__extern"]
    pub fn sk_CRYPTO_BUFFER_new_null() -> *mut stack_st_CRYPTO_BUFFER;
}
unsafe extern "C" {
    /// Buffers and buffer pools.
    ///
    /// `CRYPTO_BUFFER`s are simply reference-counted, immutable byte string. A
    /// single `CRYPTO_BUFFER` can be referenced from multiple parts of an
    /// application without storing multiple copies of the underlying data in
    /// memory.
    ///
    /// A `CRYPTO_BUFFER_POOL` can be used to additionally deduplicate
    /// `CRYPTO_BUFFER`s on construction. It maintains weak references to associated
    /// `CRYPTO_BUFFER`s and returns an existing `CRYPTO_BUFFER` if matching ones
    /// already exist.
    ///
    /// Without a `CRYPTO_BUFFER_POOL`, if two parts of application construct an
    /// identical `CRYPTO_BUFFER` (e.g. if two TLS connections received the same
    /// certificate), there will be two copies of the buffer in memory. A
    /// `CRYPTO_BUFFER_POOL` allows two parts of an application that construct
    /// `CRYPTO_BUFFER`s to deduplicate their contents, at the cost of more thread
    /// contention.
    #[link_name = "sk_CRYPTO_BUFFER_num__extern"]
    pub fn sk_CRYPTO_BUFFER_num(sk: *const stack_st_CRYPTO_BUFFER) -> usize;
}
unsafe extern "C" {
    /// Buffers and buffer pools.
    ///
    /// `CRYPTO_BUFFER`s are simply reference-counted, immutable byte string. A
    /// single `CRYPTO_BUFFER` can be referenced from multiple parts of an
    /// application without storing multiple copies of the underlying data in
    /// memory.
    ///
    /// A `CRYPTO_BUFFER_POOL` can be used to additionally deduplicate
    /// `CRYPTO_BUFFER`s on construction. It maintains weak references to associated
    /// `CRYPTO_BUFFER`s and returns an existing `CRYPTO_BUFFER` if matching ones
    /// already exist.
    ///
    /// Without a `CRYPTO_BUFFER_POOL`, if two parts of application construct an
    /// identical `CRYPTO_BUFFER` (e.g. if two TLS connections received the same
    /// certificate), there will be two copies of the buffer in memory. A
    /// `CRYPTO_BUFFER_POOL` allows two parts of an application that construct
    /// `CRYPTO_BUFFER`s to deduplicate their contents, at the cost of more thread
    /// contention.
    #[link_name = "sk_CRYPTO_BUFFER_zero__extern"]
    pub fn sk_CRYPTO_BUFFER_zero(sk: *mut stack_st_CRYPTO_BUFFER);
}
unsafe extern "C" {
    /// Buffers and buffer pools.
    ///
    /// `CRYPTO_BUFFER`s are simply reference-counted, immutable byte string. A
    /// single `CRYPTO_BUFFER` can be referenced from multiple parts of an
    /// application without storing multiple copies of the underlying data in
    /// memory.
    ///
    /// A `CRYPTO_BUFFER_POOL` can be used to additionally deduplicate
    /// `CRYPTO_BUFFER`s on construction. It maintains weak references to associated
    /// `CRYPTO_BUFFER`s and returns an existing `CRYPTO_BUFFER` if matching ones
    /// already exist.
    ///
    /// Without a `CRYPTO_BUFFER_POOL`, if two parts of application construct an
    /// identical `CRYPTO_BUFFER` (e.g. if two TLS connections received the same
    /// certificate), there will be two copies of the buffer in memory. A
    /// `CRYPTO_BUFFER_POOL` allows two parts of an application that construct
    /// `CRYPTO_BUFFER`s to deduplicate their contents, at the cost of more thread
    /// contention.
    #[link_name = "sk_CRYPTO_BUFFER_value__extern"]
    pub fn sk_CRYPTO_BUFFER_value(
        sk: *const stack_st_CRYPTO_BUFFER,
        i: usize,
    ) -> *mut CRYPTO_BUFFER;
}
unsafe extern "C" {
    /// Buffers and buffer pools.
    ///
    /// `CRYPTO_BUFFER`s are simply reference-counted, immutable byte string. A
    /// single `CRYPTO_BUFFER` can be referenced from multiple parts of an
    /// application without storing multiple copies of the underlying data in
    /// memory.
    ///
    /// A `CRYPTO_BUFFER_POOL` can be used to additionally deduplicate
    /// `CRYPTO_BUFFER`s on construction. It maintains weak references to associated
    /// `CRYPTO_BUFFER`s and returns an existing `CRYPTO_BUFFER` if matching ones
    /// already exist.
    ///
    /// Without a `CRYPTO_BUFFER_POOL`, if two parts of application construct an
    /// identical `CRYPTO_BUFFER` (e.g. if two TLS connections received the same
    /// certificate), there will be two copies of the buffer in memory. A
    /// `CRYPTO_BUFFER_POOL` allows two parts of an application that construct
    /// `CRYPTO_BUFFER`s to deduplicate their contents, at the cost of more thread
    /// contention.
    #[link_name = "sk_CRYPTO_BUFFER_set__extern"]
    pub fn sk_CRYPTO_BUFFER_set(
        sk: *mut stack_st_CRYPTO_BUFFER,
        i: usize,
        p: *mut CRYPTO_BUFFER,
    ) -> *mut CRYPTO_BUFFER;
}
unsafe extern "C" {
    /// Buffers and buffer pools.
    ///
    /// `CRYPTO_BUFFER`s are simply reference-counted, immutable byte string. A
    /// single `CRYPTO_BUFFER` can be referenced from multiple parts of an
    /// application without storing multiple copies of the underlying data in
    /// memory.
    ///
    /// A `CRYPTO_BUFFER_POOL` can be used to additionally deduplicate
    /// `CRYPTO_BUFFER`s on construction. It maintains weak references to associated
    /// `CRYPTO_BUFFER`s and returns an existing `CRYPTO_BUFFER` if matching ones
    /// already exist.
    ///
    /// Without a `CRYPTO_BUFFER_POOL`, if two parts of application construct an
    /// identical `CRYPTO_BUFFER` (e.g. if two TLS connections received the same
    /// certificate), there will be two copies of the buffer in memory. A
    /// `CRYPTO_BUFFER_POOL` allows two parts of an application that construct
    /// `CRYPTO_BUFFER`s to deduplicate their contents, at the cost of more thread
    /// contention.
    #[link_name = "sk_CRYPTO_BUFFER_free__extern"]
    pub fn sk_CRYPTO_BUFFER_free(sk: *mut stack_st_CRYPTO_BUFFER);
}
unsafe extern "C" {
    /// Buffers and buffer pools.
    ///
    /// `CRYPTO_BUFFER`s are simply reference-counted, immutable byte string. A
    /// single `CRYPTO_BUFFER` can be referenced from multiple parts of an
    /// application without storing multiple copies of the underlying data in
    /// memory.
    ///
    /// A `CRYPTO_BUFFER_POOL` can be used to additionally deduplicate
    /// `CRYPTO_BUFFER`s on construction. It maintains weak references to associated
    /// `CRYPTO_BUFFER`s and returns an existing `CRYPTO_BUFFER` if matching ones
    /// already exist.
    ///
    /// Without a `CRYPTO_BUFFER_POOL`, if two parts of application construct an
    /// identical `CRYPTO_BUFFER` (e.g. if two TLS connections received the same
    /// certificate), there will be two copies of the buffer in memory. A
    /// `CRYPTO_BUFFER_POOL` allows two parts of an application that construct
    /// `CRYPTO_BUFFER`s to deduplicate their contents, at the cost of more thread
    /// contention.
    #[link_name = "sk_CRYPTO_BUFFER_pop_free__extern"]
    pub fn sk_CRYPTO_BUFFER_pop_free(
        sk: *mut stack_st_CRYPTO_BUFFER,
        free_func: sk_CRYPTO_BUFFER_free_func,
    );
}
unsafe extern "C" {
    /// Buffers and buffer pools.
    ///
    /// `CRYPTO_BUFFER`s are simply reference-counted, immutable byte string. A
    /// single `CRYPTO_BUFFER` can be referenced from multiple parts of an
    /// application without storing multiple copies of the underlying data in
    /// memory.
    ///
    /// A `CRYPTO_BUFFER_POOL` can be used to additionally deduplicate
    /// `CRYPTO_BUFFER`s on construction. It maintains weak references to associated
    /// `CRYPTO_BUFFER`s and returns an existing `CRYPTO_BUFFER` if matching ones
    /// already exist.
    ///
    /// Without a `CRYPTO_BUFFER_POOL`, if two parts of application construct an
    /// identical `CRYPTO_BUFFER` (e.g. if two TLS connections received the same
    /// certificate), there will be two copies of the buffer in memory. A
    /// `CRYPTO_BUFFER_POOL` allows two parts of an application that construct
    /// `CRYPTO_BUFFER`s to deduplicate their contents, at the cost of more thread
    /// contention.
    #[link_name = "sk_CRYPTO_BUFFER_insert__extern"]
    pub fn sk_CRYPTO_BUFFER_insert(
        sk: *mut stack_st_CRYPTO_BUFFER,
        p: *mut CRYPTO_BUFFER,
        where_: usize,
    ) -> usize;
}
unsafe extern "C" {
    /// Buffers and buffer pools.
    ///
    /// `CRYPTO_BUFFER`s are simply reference-counted, immutable byte string. A
    /// single `CRYPTO_BUFFER` can be referenced from multiple parts of an
    /// application without storing multiple copies of the underlying data in
    /// memory.
    ///
    /// A `CRYPTO_BUFFER_POOL` can be used to additionally deduplicate
    /// `CRYPTO_BUFFER`s on construction. It maintains weak references to associated
    /// `CRYPTO_BUFFER`s and returns an existing `CRYPTO_BUFFER` if matching ones
    /// already exist.
    ///
    /// Without a `CRYPTO_BUFFER_POOL`, if two parts of application construct an
    /// identical `CRYPTO_BUFFER` (e.g. if two TLS connections received the same
    /// certificate), there will be two copies of the buffer in memory. A
    /// `CRYPTO_BUFFER_POOL` allows two parts of an application that construct
    /// `CRYPTO_BUFFER`s to deduplicate their contents, at the cost of more thread
    /// contention.
    #[link_name = "sk_CRYPTO_BUFFER_delete__extern"]
    pub fn sk_CRYPTO_BUFFER_delete(
        sk: *mut stack_st_CRYPTO_BUFFER,
        where_: usize,
    ) -> *mut CRYPTO_BUFFER;
}
unsafe extern "C" {
    /// Buffers and buffer pools.
    ///
    /// `CRYPTO_BUFFER`s are simply reference-counted, immutable byte string. A
    /// single `CRYPTO_BUFFER` can be referenced from multiple parts of an
    /// application without storing multiple copies of the underlying data in
    /// memory.
    ///
    /// A `CRYPTO_BUFFER_POOL` can be used to additionally deduplicate
    /// `CRYPTO_BUFFER`s on construction. It maintains weak references to associated
    /// `CRYPTO_BUFFER`s and returns an existing `CRYPTO_BUFFER` if matching ones
    /// already exist.
    ///
    /// Without a `CRYPTO_BUFFER_POOL`, if two parts of application construct an
    /// identical `CRYPTO_BUFFER` (e.g. if two TLS connections received the same
    /// certificate), there will be two copies of the buffer in memory. A
    /// `CRYPTO_BUFFER_POOL` allows two parts of an application that construct
    /// `CRYPTO_BUFFER`s to deduplicate their contents, at the cost of more thread
    /// contention.
    #[link_name = "sk_CRYPTO_BUFFER_delete_ptr__extern"]
    pub fn sk_CRYPTO_BUFFER_delete_ptr(
        sk: *mut stack_st_CRYPTO_BUFFER,
        p: *const CRYPTO_BUFFER,
    ) -> *mut CRYPTO_BUFFER;
}
unsafe extern "C" {
    /// Buffers and buffer pools.
    ///
    /// `CRYPTO_BUFFER`s are simply reference-counted, immutable byte string. A
    /// single `CRYPTO_BUFFER` can be referenced from multiple parts of an
    /// application without storing multiple copies of the underlying data in
    /// memory.
    ///
    /// A `CRYPTO_BUFFER_POOL` can be used to additionally deduplicate
    /// `CRYPTO_BUFFER`s on construction. It maintains weak references to associated
    /// `CRYPTO_BUFFER`s and returns an existing `CRYPTO_BUFFER` if matching ones
    /// already exist.
    ///
    /// Without a `CRYPTO_BUFFER_POOL`, if two parts of application construct an
    /// identical `CRYPTO_BUFFER` (e.g. if two TLS connections received the same
    /// certificate), there will be two copies of the buffer in memory. A
    /// `CRYPTO_BUFFER_POOL` allows two parts of an application that construct
    /// `CRYPTO_BUFFER`s to deduplicate their contents, at the cost of more thread
    /// contention.
    #[link_name = "sk_CRYPTO_BUFFER_delete_if__extern"]
    pub fn sk_CRYPTO_BUFFER_delete_if(
        sk: *mut stack_st_CRYPTO_BUFFER,
        func: sk_CRYPTO_BUFFER_delete_if_func,
        data: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    /// Buffers and buffer pools.
    ///
    /// `CRYPTO_BUFFER`s are simply reference-counted, immutable byte string. A
    /// single `CRYPTO_BUFFER` can be referenced from multiple parts of an
    /// application without storing multiple copies of the underlying data in
    /// memory.
    ///
    /// A `CRYPTO_BUFFER_POOL` can be used to additionally deduplicate
    /// `CRYPTO_BUFFER`s on construction. It maintains weak references to associated
    /// `CRYPTO_BUFFER`s and returns an existing `CRYPTO_BUFFER` if matching ones
    /// already exist.
    ///
    /// Without a `CRYPTO_BUFFER_POOL`, if two parts of application construct an
    /// identical `CRYPTO_BUFFER` (e.g. if two TLS connections received the same
    /// certificate), there will be two copies of the buffer in memory. A
    /// `CRYPTO_BUFFER_POOL` allows two parts of an application that construct
    /// `CRYPTO_BUFFER`s to deduplicate their contents, at the cost of more thread
    /// contention.
    #[link_name = "sk_CRYPTO_BUFFER_find__extern"]
    pub fn sk_CRYPTO_BUFFER_find(
        sk: *const stack_st_CRYPTO_BUFFER,
        out_index: *mut usize,
        p: *const CRYPTO_BUFFER,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Buffers and buffer pools.
    ///
    /// `CRYPTO_BUFFER`s are simply reference-counted, immutable byte string. A
    /// single `CRYPTO_BUFFER` can be referenced from multiple parts of an
    /// application without storing multiple copies of the underlying data in
    /// memory.
    ///
    /// A `CRYPTO_BUFFER_POOL` can be used to additionally deduplicate
    /// `CRYPTO_BUFFER`s on construction. It maintains weak references to associated
    /// `CRYPTO_BUFFER`s and returns an existing `CRYPTO_BUFFER` if matching ones
    /// already exist.
    ///
    /// Without a `CRYPTO_BUFFER_POOL`, if two parts of application construct an
    /// identical `CRYPTO_BUFFER` (e.g. if two TLS connections received the same
    /// certificate), there will be two copies of the buffer in memory. A
    /// `CRYPTO_BUFFER_POOL` allows two parts of an application that construct
    /// `CRYPTO_BUFFER`s to deduplicate their contents, at the cost of more thread
    /// contention.
    #[link_name = "sk_CRYPTO_BUFFER_shift__extern"]
    pub fn sk_CRYPTO_BUFFER_shift(sk: *mut stack_st_CRYPTO_BUFFER) -> *mut CRYPTO_BUFFER;
}
unsafe extern "C" {
    /// Buffers and buffer pools.
    ///
    /// `CRYPTO_BUFFER`s are simply reference-counted, immutable byte string. A
    /// single `CRYPTO_BUFFER` can be referenced from multiple parts of an
    /// application without storing multiple copies of the underlying data in
    /// memory.
    ///
    /// A `CRYPTO_BUFFER_POOL` can be used to additionally deduplicate
    /// `CRYPTO_BUFFER`s on construction. It maintains weak references to associated
    /// `CRYPTO_BUFFER`s and returns an existing `CRYPTO_BUFFER` if matching ones
    /// already exist.
    ///
    /// Without a `CRYPTO_BUFFER_POOL`, if two parts of application construct an
    /// identical `CRYPTO_BUFFER` (e.g. if two TLS connections received the same
    /// certificate), there will be two copies of the buffer in memory. A
    /// `CRYPTO_BUFFER_POOL` allows two parts of an application that construct
    /// `CRYPTO_BUFFER`s to deduplicate their contents, at the cost of more thread
    /// contention.
    #[link_name = "sk_CRYPTO_BUFFER_push__extern"]
    pub fn sk_CRYPTO_BUFFER_push(sk: *mut stack_st_CRYPTO_BUFFER, p: *mut CRYPTO_BUFFER) -> usize;
}
unsafe extern "C" {
    /// Buffers and buffer pools.
    ///
    /// `CRYPTO_BUFFER`s are simply reference-counted, immutable byte string. A
    /// single `CRYPTO_BUFFER` can be referenced from multiple parts of an
    /// application without storing multiple copies of the underlying data in
    /// memory.
    ///
    /// A `CRYPTO_BUFFER_POOL` can be used to additionally deduplicate
    /// `CRYPTO_BUFFER`s on construction. It maintains weak references to associated
    /// `CRYPTO_BUFFER`s and returns an existing `CRYPTO_BUFFER` if matching ones
    /// already exist.
    ///
    /// Without a `CRYPTO_BUFFER_POOL`, if two parts of application construct an
    /// identical `CRYPTO_BUFFER` (e.g. if two TLS connections received the same
    /// certificate), there will be two copies of the buffer in memory. A
    /// `CRYPTO_BUFFER_POOL` allows two parts of an application that construct
    /// `CRYPTO_BUFFER`s to deduplicate their contents, at the cost of more thread
    /// contention.
    #[link_name = "sk_CRYPTO_BUFFER_pop__extern"]
    pub fn sk_CRYPTO_BUFFER_pop(sk: *mut stack_st_CRYPTO_BUFFER) -> *mut CRYPTO_BUFFER;
}
unsafe extern "C" {
    /// Buffers and buffer pools.
    ///
    /// `CRYPTO_BUFFER`s are simply reference-counted, immutable byte string. A
    /// single `CRYPTO_BUFFER` can be referenced from multiple parts of an
    /// application without storing multiple copies of the underlying data in
    /// memory.
    ///
    /// A `CRYPTO_BUFFER_POOL` can be used to additionally deduplicate
    /// `CRYPTO_BUFFER`s on construction. It maintains weak references to associated
    /// `CRYPTO_BUFFER`s and returns an existing `CRYPTO_BUFFER` if matching ones
    /// already exist.
    ///
    /// Without a `CRYPTO_BUFFER_POOL`, if two parts of application construct an
    /// identical `CRYPTO_BUFFER` (e.g. if two TLS connections received the same
    /// certificate), there will be two copies of the buffer in memory. A
    /// `CRYPTO_BUFFER_POOL` allows two parts of an application that construct
    /// `CRYPTO_BUFFER`s to deduplicate their contents, at the cost of more thread
    /// contention.
    #[link_name = "sk_CRYPTO_BUFFER_dup__extern"]
    pub fn sk_CRYPTO_BUFFER_dup(sk: *const stack_st_CRYPTO_BUFFER) -> *mut stack_st_CRYPTO_BUFFER;
}
unsafe extern "C" {
    /// Buffers and buffer pools.
    ///
    /// `CRYPTO_BUFFER`s are simply reference-counted, immutable byte string. A
    /// single `CRYPTO_BUFFER` can be referenced from multiple parts of an
    /// application without storing multiple copies of the underlying data in
    /// memory.
    ///
    /// A `CRYPTO_BUFFER_POOL` can be used to additionally deduplicate
    /// `CRYPTO_BUFFER`s on construction. It maintains weak references to associated
    /// `CRYPTO_BUFFER`s and returns an existing `CRYPTO_BUFFER` if matching ones
    /// already exist.
    ///
    /// Without a `CRYPTO_BUFFER_POOL`, if two parts of application construct an
    /// identical `CRYPTO_BUFFER` (e.g. if two TLS connections received the same
    /// certificate), there will be two copies of the buffer in memory. A
    /// `CRYPTO_BUFFER_POOL` allows two parts of an application that construct
    /// `CRYPTO_BUFFER`s to deduplicate their contents, at the cost of more thread
    /// contention.
    #[link_name = "sk_CRYPTO_BUFFER_sort__extern"]
    pub fn sk_CRYPTO_BUFFER_sort(sk: *mut stack_st_CRYPTO_BUFFER);
}
unsafe extern "C" {
    /// Buffers and buffer pools.
    ///
    /// `CRYPTO_BUFFER`s are simply reference-counted, immutable byte string. A
    /// single `CRYPTO_BUFFER` can be referenced from multiple parts of an
    /// application without storing multiple copies of the underlying data in
    /// memory.
    ///
    /// A `CRYPTO_BUFFER_POOL` can be used to additionally deduplicate
    /// `CRYPTO_BUFFER`s on construction. It maintains weak references to associated
    /// `CRYPTO_BUFFER`s and returns an existing `CRYPTO_BUFFER` if matching ones
    /// already exist.
    ///
    /// Without a `CRYPTO_BUFFER_POOL`, if two parts of application construct an
    /// identical `CRYPTO_BUFFER` (e.g. if two TLS connections received the same
    /// certificate), there will be two copies of the buffer in memory. A
    /// `CRYPTO_BUFFER_POOL` allows two parts of an application that construct
    /// `CRYPTO_BUFFER`s to deduplicate their contents, at the cost of more thread
    /// contention.
    #[link_name = "sk_CRYPTO_BUFFER_sort_and_dedup__extern"]
    pub fn sk_CRYPTO_BUFFER_sort_and_dedup(
        sk: *mut stack_st_CRYPTO_BUFFER,
        free_func: sk_CRYPTO_BUFFER_free_func,
    );
}
unsafe extern "C" {
    /// Buffers and buffer pools.
    ///
    /// `CRYPTO_BUFFER`s are simply reference-counted, immutable byte string. A
    /// single `CRYPTO_BUFFER` can be referenced from multiple parts of an
    /// application without storing multiple copies of the underlying data in
    /// memory.
    ///
    /// A `CRYPTO_BUFFER_POOL` can be used to additionally deduplicate
    /// `CRYPTO_BUFFER`s on construction. It maintains weak references to associated
    /// `CRYPTO_BUFFER`s and returns an existing `CRYPTO_BUFFER` if matching ones
    /// already exist.
    ///
    /// Without a `CRYPTO_BUFFER_POOL`, if two parts of application construct an
    /// identical `CRYPTO_BUFFER` (e.g. if two TLS connections received the same
    /// certificate), there will be two copies of the buffer in memory. A
    /// `CRYPTO_BUFFER_POOL` allows two parts of an application that construct
    /// `CRYPTO_BUFFER`s to deduplicate their contents, at the cost of more thread
    /// contention.
    #[link_name = "sk_CRYPTO_BUFFER_is_sorted__extern"]
    pub fn sk_CRYPTO_BUFFER_is_sorted(sk: *const stack_st_CRYPTO_BUFFER) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Buffers and buffer pools.
    ///
    /// `CRYPTO_BUFFER`s are simply reference-counted, immutable byte string. A
    /// single `CRYPTO_BUFFER` can be referenced from multiple parts of an
    /// application without storing multiple copies of the underlying data in
    /// memory.
    ///
    /// A `CRYPTO_BUFFER_POOL` can be used to additionally deduplicate
    /// `CRYPTO_BUFFER`s on construction. It maintains weak references to associated
    /// `CRYPTO_BUFFER`s and returns an existing `CRYPTO_BUFFER` if matching ones
    /// already exist.
    ///
    /// Without a `CRYPTO_BUFFER_POOL`, if two parts of application construct an
    /// identical `CRYPTO_BUFFER` (e.g. if two TLS connections received the same
    /// certificate), there will be two copies of the buffer in memory. A
    /// `CRYPTO_BUFFER_POOL` allows two parts of an application that construct
    /// `CRYPTO_BUFFER`s to deduplicate their contents, at the cost of more thread
    /// contention.
    #[link_name = "sk_CRYPTO_BUFFER_set_cmp_func__extern"]
    pub fn sk_CRYPTO_BUFFER_set_cmp_func(
        sk: *mut stack_st_CRYPTO_BUFFER,
        comp: sk_CRYPTO_BUFFER_cmp_func,
    ) -> sk_CRYPTO_BUFFER_cmp_func;
}
unsafe extern "C" {
    /// Buffers and buffer pools.
    ///
    /// `CRYPTO_BUFFER`s are simply reference-counted, immutable byte string. A
    /// single `CRYPTO_BUFFER` can be referenced from multiple parts of an
    /// application without storing multiple copies of the underlying data in
    /// memory.
    ///
    /// A `CRYPTO_BUFFER_POOL` can be used to additionally deduplicate
    /// `CRYPTO_BUFFER`s on construction. It maintains weak references to associated
    /// `CRYPTO_BUFFER`s and returns an existing `CRYPTO_BUFFER` if matching ones
    /// already exist.
    ///
    /// Without a `CRYPTO_BUFFER_POOL`, if two parts of application construct an
    /// identical `CRYPTO_BUFFER` (e.g. if two TLS connections received the same
    /// certificate), there will be two copies of the buffer in memory. A
    /// `CRYPTO_BUFFER_POOL` allows two parts of an application that construct
    /// `CRYPTO_BUFFER`s to deduplicate their contents, at the cost of more thread
    /// contention.
    #[link_name = "sk_CRYPTO_BUFFER_deep_copy__extern"]
    pub fn sk_CRYPTO_BUFFER_deep_copy(
        sk: *const stack_st_CRYPTO_BUFFER,
        copy_func: sk_CRYPTO_BUFFER_copy_func,
        free_func: sk_CRYPTO_BUFFER_free_func,
    ) -> *mut stack_st_CRYPTO_BUFFER;
}
unsafe extern "C" {
    /// CRYPTO_BUFFER_POOL_new returns a freshly allocated `CRYPTO_BUFFER_POOL` or
    /// NULL on error.
    pub fn CRYPTO_BUFFER_POOL_new() -> *mut CRYPTO_BUFFER_POOL;
}
unsafe extern "C" {
    /// CRYPTO_BUFFER_POOL_free decrements the reference count of `pool` and frees it
    /// if the reference count drops to zero.
    pub fn CRYPTO_BUFFER_POOL_free(pool: *mut CRYPTO_BUFFER_POOL);
}
unsafe extern "C" {
    /// CRYPTO_BUFFER_POOL_up_ref increments the reference count of `pool` and
    /// returns one. It does not mutate `pool` for thread-safety purposes and may be
    /// used concurrently.
    pub fn CRYPTO_BUFFER_POOL_up_ref(pool: *mut CRYPTO_BUFFER_POOL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CRYPTO_BUFFER_new returns a `CRYPTO_BUFFER` containing a copy of `data`, or
    /// else NULL on error. If `pool` is not NULL then the returned value may be a
    /// reference to a previously existing `CRYPTO_BUFFER` that contained the same
    /// data. Otherwise, the returned, fresh `CRYPTO_BUFFER` will be added to the
    /// pool.
    ///
    /// There is no requirement that `pool` outlive the `CRYPTO_BUFFER`, or vice
    /// versa. If the `CRYPTO_BUFFER` is released first, it will be removed from
    /// `pool`. If `pool` is released first, the `CRYPTO_BUFFER` remains valid.
    pub fn CRYPTO_BUFFER_new(
        data: *const u8,
        len: usize,
        pool: *mut CRYPTO_BUFFER_POOL,
    ) -> *mut CRYPTO_BUFFER;
}
unsafe extern "C" {
    /// CRYPTO_BUFFER_alloc creates an unpooled `CRYPTO_BUFFER` of the given size and
    /// writes the underlying data pointer to `*out_data`. It returns NULL on error.
    ///
    /// After calling this function, `len` bytes of contents must be written to
    /// `out_data` before passing the returned pointer to any other BoringSSL
    /// functions. Once initialized, the `CRYPTO_BUFFER` should be treated as
    /// immutable.
    pub fn CRYPTO_BUFFER_alloc(out_data: *mut *mut u8, len: usize) -> *mut CRYPTO_BUFFER;
}
unsafe extern "C" {
    /// CRYPTO_BUFFER_new_from_CBS acts the same as `CRYPTO_BUFFER_new`.
    pub fn CRYPTO_BUFFER_new_from_CBS(
        cbs: *const CBS,
        pool: *mut CRYPTO_BUFFER_POOL,
    ) -> *mut CRYPTO_BUFFER;
}
unsafe extern "C" {
    /// CRYPTO_BUFFER_new_from_static_data_unsafe behaves like `CRYPTO_BUFFER_new`
    /// but does not copy `data`. `data` must be immutable and last for the lifetime
    /// of the address space.
    pub fn CRYPTO_BUFFER_new_from_static_data_unsafe(
        data: *const u8,
        len: usize,
        pool: *mut CRYPTO_BUFFER_POOL,
    ) -> *mut CRYPTO_BUFFER;
}
unsafe extern "C" {
    /// CRYPTO_BUFFER_free decrements the reference count of `buf`. If there are no
    /// other references, or if the only remaining reference is from a pool, then
    /// `buf` will be freed.
    pub fn CRYPTO_BUFFER_free(buf: *mut CRYPTO_BUFFER);
}
unsafe extern "C" {
    /// CRYPTO_BUFFER_up_ref increments the reference count of `buf` and returns
    /// one.
    pub fn CRYPTO_BUFFER_up_ref(buf: *mut CRYPTO_BUFFER) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CRYPTO_BUFFER_dup_ref increments the reference count of `buf` and returns
    /// `buf`. The caller must call `CRYPTO_BUFFER_free` on the result to release the
    /// reference.
    pub fn CRYPTO_BUFFER_dup_ref(buf: *const CRYPTO_BUFFER) -> *mut CRYPTO_BUFFER;
}
unsafe extern "C" {
    /// CRYPTO_BUFFER_data returns a pointer to the data contained in `buf`.
    pub fn CRYPTO_BUFFER_data(buf: *const CRYPTO_BUFFER) -> *const u8;
}
unsafe extern "C" {
    /// CRYPTO_BUFFER_len returns the length, in bytes, of the data contained in
    /// `buf`.
    pub fn CRYPTO_BUFFER_len(buf: *const CRYPTO_BUFFER) -> usize;
}
unsafe extern "C" {
    /// CRYPTO_BUFFER_init_CBS initialises `out` to point at the data from `buf`.
    pub fn CRYPTO_BUFFER_init_CBS(buf: *const CRYPTO_BUFFER, out: *mut CBS);
}
unsafe extern "C" {
    /// RSA_new_public_key returns a new `RSA` object containing a public key with
    /// the specified parameters, or NULL on error or invalid input.
    pub fn RSA_new_public_key(n: *const BIGNUM, e: *const BIGNUM) -> *mut RSA;
}
unsafe extern "C" {
    /// RSA_new_private_key returns a new `RSA` object containing a private key with
    /// the specified parameters, or NULL on error or invalid input. All parameters
    /// are mandatory and may not be NULL.
    ///
    /// This function creates standard RSA private keys with CRT parameters.
    pub fn RSA_new_private_key(
        n: *const BIGNUM,
        e: *const BIGNUM,
        d: *const BIGNUM,
        p: *const BIGNUM,
        q: *const BIGNUM,
        dmp1: *const BIGNUM,
        dmq1: *const BIGNUM,
        iqmp: *const BIGNUM,
    ) -> *mut RSA;
}
unsafe extern "C" {
    /// RSA_new returns a new, empty `RSA` object or NULL on error. Prefer using
    /// `RSA_new_public_key` or `RSA_new_private_key` to import an RSA key.
    pub fn RSA_new() -> *mut RSA;
}
unsafe extern "C" {
    /// RSA_new_method acts the same as `RSA_new` but takes an explicit `ENGINE`.
    pub fn RSA_new_method(engine: *const ENGINE) -> *mut RSA;
}
unsafe extern "C" {
    /// RSA_free decrements the reference count of `rsa` and frees it if the
    /// reference count drops to zero.
    pub fn RSA_free(rsa: *mut RSA);
}
unsafe extern "C" {
    /// RSA_up_ref increments the reference count of `rsa` and returns one. It does
    /// not mutate `rsa` for thread-safety purposes and may be used concurrently.
    pub fn RSA_up_ref(rsa: *mut RSA) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// RSA_bits returns the size of `rsa`, in bits.
    pub fn RSA_bits(rsa: *const RSA) -> ::core::ffi::c_uint;
}
unsafe extern "C" {
    /// RSA_get0_n returns `rsa`'s public modulus.
    pub fn RSA_get0_n(rsa: *const RSA) -> *const BIGNUM;
}
unsafe extern "C" {
    /// RSA_get0_e returns `rsa`'s public exponent.
    pub fn RSA_get0_e(rsa: *const RSA) -> *const BIGNUM;
}
unsafe extern "C" {
    /// RSA_get0_d returns `rsa`'s private exponent. If `rsa` is a public key, this
    /// value will be NULL.
    pub fn RSA_get0_d(rsa: *const RSA) -> *const BIGNUM;
}
unsafe extern "C" {
    /// RSA_get0_p returns `rsa`'s first private prime factor. If `rsa` is a public
    /// key or lacks its prime factors, this value will be NULL.
    pub fn RSA_get0_p(rsa: *const RSA) -> *const BIGNUM;
}
unsafe extern "C" {
    /// RSA_get0_q returns `rsa`'s second private prime factor. If `rsa` is a public
    /// key or lacks its prime factors, this value will be NULL.
    pub fn RSA_get0_q(rsa: *const RSA) -> *const BIGNUM;
}
unsafe extern "C" {
    /// RSA_get0_dmp1 returns d (mod p-1) for `rsa`. If `rsa` is a public key or
    /// lacks CRT parameters, this value will be NULL.
    pub fn RSA_get0_dmp1(rsa: *const RSA) -> *const BIGNUM;
}
unsafe extern "C" {
    /// RSA_get0_dmq1 returns d (mod q-1) for `rsa`. If `rsa` is a public key or
    /// lacks CRT parameters, this value will be NULL.
    pub fn RSA_get0_dmq1(rsa: *const RSA) -> *const BIGNUM;
}
unsafe extern "C" {
    /// RSA_get0_iqmp returns q^-1 (mod p). If `rsa` is a public key or lacks CRT
    /// parameters, this value will be NULL.
    pub fn RSA_get0_iqmp(rsa: *const RSA) -> *const BIGNUM;
}
unsafe extern "C" {
    /// RSA_get0_key sets `*out_n`, `*out_e`, and `*out_d`, if non-NULL, to `rsa`'s
    /// modulus, public exponent, and private exponent, respectively. If `rsa` is a
    /// public key, the private exponent will be set to NULL.
    pub fn RSA_get0_key(
        rsa: *const RSA,
        out_n: *mut *const BIGNUM,
        out_e: *mut *const BIGNUM,
        out_d: *mut *const BIGNUM,
    );
}
unsafe extern "C" {
    /// RSA_get0_factors sets `*out_p` and `*out_q`, if non-NULL, to `rsa`'s prime
    /// factors. If `rsa` is a public key, they will be set to NULL.
    pub fn RSA_get0_factors(rsa: *const RSA, out_p: *mut *const BIGNUM, out_q: *mut *const BIGNUM);
}
unsafe extern "C" {
    /// RSA_get0_crt_params sets `*out_dmp1`, `*out_dmq1`, and `*out_iqmp`, if
    /// non-NULL, to `rsa`'s CRT parameters. These are d (mod p-1), d (mod q-1) and
    /// q^-1 (mod p), respectively. If `rsa` is a public key, each parameter will be
    /// set to NULL.
    pub fn RSA_get0_crt_params(
        rsa: *const RSA,
        out_dmp1: *mut *const BIGNUM,
        out_dmq1: *mut *const BIGNUM,
        out_iqmp: *mut *const BIGNUM,
    );
}
unsafe extern "C" {
    /// RSA_set0_key sets `rsa`'s modulus, public exponent, and private exponent to
    /// `n`, `e`, and `d` respectively, if non-NULL. On success, it takes ownership
    /// of each argument and returns one. Otherwise, it returns zero.
    ///
    /// `d` may be NULL, but `n` and `e` must either be non-NULL or already
    /// configured on `rsa`.
    ///
    /// It is an error to call this function after `rsa` has been used for a
    /// cryptographic operation. Construct a new `RSA` object instead.
    pub fn RSA_set0_key(
        rsa: *mut RSA,
        n: *mut BIGNUM,
        e: *mut BIGNUM,
        d: *mut BIGNUM,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// RSA_set0_factors sets `rsa`'s prime factors to `p` and `q`, if non-NULL, and
    /// takes ownership of them. On success, it takes ownership of each argument and
    /// returns one. Otherwise, it returns zero.
    ///
    /// Each argument must either be non-NULL or already configured on `rsa`.
    ///
    /// It is an error to call this function after `rsa` has been used for a
    /// cryptographic operation. Construct a new `RSA` object instead.
    pub fn RSA_set0_factors(rsa: *mut RSA, p: *mut BIGNUM, q: *mut BIGNUM) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// RSA_set0_crt_params sets `rsa`'s CRT parameters to `dmp1`, `dmq1`, and
    /// `iqmp`, if non-NULL, and takes ownership of them. On success, it takes
    /// ownership of its parameters and returns one. Otherwise, it returns zero.
    ///
    /// Each argument must either be non-NULL or already configured on `rsa`.
    ///
    /// It is an error to call this function after `rsa` has been used for a
    /// cryptographic operation. Construct a new `RSA` object instead.
    pub fn RSA_set0_crt_params(
        rsa: *mut RSA,
        dmp1: *mut BIGNUM,
        dmq1: *mut BIGNUM,
        iqmp: *mut BIGNUM,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// RSA_generate_key_ex generates a new RSA key where the modulus has size
    /// `bits` and the public exponent is `e`. If unsure, `RSA_F4` is a good value
    /// for `e`. If `cb` is not NULL then it is called during the key generation
    /// process. In addition to the calls documented for `BN_generate_prime_ex`, it
    /// is called with event=2 when the n'th prime is rejected as unsuitable and
    /// with event=3 when a suitable value for `p` is found.
    ///
    /// It returns one on success or zero on error.
    pub fn RSA_generate_key_ex(
        rsa: *mut RSA,
        bits: ::core::ffi::c_int,
        e: *const BIGNUM,
        cb: *mut BN_GENCB,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// RSA_generate_key_fips behaves like `RSA_generate_key_ex` but performs
    /// additional checks for FIPS compliance. The public exponent is always 65537
    /// and `bits` must be either 2048 or 3072.
    pub fn RSA_generate_key_fips(
        rsa: *mut RSA,
        bits: ::core::ffi::c_int,
        cb: *mut BN_GENCB,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// RSA_encrypt encrypts `in_len` bytes from `in` to the public key from `rsa`
    /// and writes, at most, `max_out` bytes of encrypted data to `out`. The
    /// `max_out` argument must be, at least, `RSA_size` in order to ensure success.
    ///
    /// It returns 1 on success or zero on error.
    ///
    /// The `padding` argument must be one of the `RSA_*_PADDING` values. If in
    /// doubt, use `RSA_PKCS1_OAEP_PADDING` for new protocols. When `padding` is
    /// `RSA_PKCS1_OAEP_PADDING`, this function has no way to set the OAEP or MGF-1
    /// digest, so it is always SHA-1. For other OAEP parameters, wrap `rsa` in an
    /// `EVP_PKEY` and use `EVP_PKEY_encrypt` with `EVP_PKEY_CTX_set_rsa_padding` and
    /// related functions.
    pub fn RSA_encrypt(
        rsa: *mut RSA,
        out_len: *mut usize,
        out: *mut u8,
        max_out: usize,
        in_: *const u8,
        in_len: usize,
        padding: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// RSA_decrypt decrypts `in_len` bytes from `in` with the private key from
    /// `rsa` and writes, at most, `max_out` bytes of plaintext to `out`. The
    /// `max_out` argument must be, at least, `RSA_size` in order to ensure success.
    ///
    /// It returns 1 on success or zero on error.
    ///
    /// The `padding` argument must be one of the `RSA_*_PADDING` values. If in
    /// doubt, use `RSA_PKCS1_OAEP_PADDING` for new protocols. When `padding` is
    /// `RSA_PKCS1_OAEP_PADDING`, this function has no way to set the OAEP or MGF-1
    /// digest, so it is always SHA-1. For other OAEP parameters, wrap `rsa` in an
    /// `EVP_PKEY` and use `EVP_PKEY_decrypt` with `EVP_PKEY_CTX_set_rsa_padding` and
    /// related functions.
    ///
    /// WARNING: Passing `RSA_PKCS1_PADDING` into this function is deprecated and
    /// insecure. RSAES-PKCS1-v1_5 is vulnerable to a chosen-ciphertext attack.
    /// Decrypting attacker-supplied ciphertext with RSAES-PKCS1-v1_5 may give the
    /// attacker control over your private key. See "Chosen Ciphertext Attacks
    /// Against Protocols Based on the RSA Encryption Standard PKCS #1", Daniel
    /// Bleichenbacher, Advances in Cryptology (Crypto '98).
    ///
    /// In some limited cases, such as TLS RSA key exchange, it is possible to
    /// mitigate this flaw with custom, protocol-specific padding logic. This
    /// should be implemented with `RSA_NO_PADDING`, not `RSA_PKCS1_PADDING`.
    pub fn RSA_decrypt(
        rsa: *mut RSA,
        out_len: *mut usize,
        out: *mut u8,
        max_out: usize,
        in_: *const u8,
        in_len: usize,
        padding: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// RSA_public_encrypt encrypts `flen` bytes from `from` to the public key in
    /// `rsa` and writes the encrypted data to `to`. The `to` buffer must have at
    /// least `RSA_size` bytes of space. It returns the number of bytes written, or
    /// -1 on error. The `padding` argument must be one of the `RSA_*_PADDING`
    /// values. If in doubt, use `RSA_PKCS1_OAEP_PADDING` for new protocols.
    ///
    /// When `padding` is `RSA_PKCS1_OAEP_PADDING`, this function has no way to set
    /// the OAEP or MGF-1 digest, so it is always SHA-1. For other OAEP parameters,
    /// wrap `rsa` in an `EVP_PKEY` and use `EVP_PKEY_encrypt` with
    /// `EVP_PKEY_CTX_set_rsa_padding` and related functions.
    ///
    /// WARNING: this function is dangerous because it breaks the usual return value
    /// convention. Use `RSA_encrypt` instead.
    pub fn RSA_public_encrypt(
        flen: usize,
        from: *const u8,
        to: *mut u8,
        rsa: *mut RSA,
        padding: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// RSA_private_decrypt decrypts `flen` bytes from `from` with the public key in
    /// `rsa` and writes the plaintext to `to`. The `to` buffer must have at least
    /// `RSA_size` bytes of space. It returns the number of bytes written, or -1 on
    /// error. The `padding` argument must be one of the `RSA_*_PADDING` values. If
    /// in doubt, use `RSA_PKCS1_OAEP_PADDING` for new protocols. Passing
    /// `RSA_PKCS1_PADDING` into this function is deprecated and insecure. See
    /// `RSA_decrypt`.
    ///
    /// When `padding` is `RSA_PKCS1_OAEP_PADDING`, this function has no way to set
    /// the OAEP or MGF-1 digest, so it is always SHA-1. For other OAEP parameters,
    /// wrap `rsa` in an `EVP_PKEY` and use `EVP_PKEY_decrypt` with
    /// `EVP_PKEY_CTX_set_rsa_padding` and related functions.
    ///
    /// WARNING: this function is dangerous because it breaks the usual return value
    /// convention. Use `RSA_decrypt` instead.
    pub fn RSA_private_decrypt(
        flen: usize,
        from: *const u8,
        to: *mut u8,
        rsa: *mut RSA,
        padding: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// RSA_sign signs `digest_len` bytes of digest from `digest` with `rsa` using
    /// RSASSA-PKCS1-v1_5. It writes, at most, `RSA_size(rsa)` bytes to `out`. On
    /// successful return, the actual number of bytes written is written to
    /// `*out_len`.
    ///
    /// The `hash_nid` argument identifies the hash function used to calculate
    /// `digest` and is embedded in the resulting signature. For example, it might be
    /// `NID_sha256`.
    ///
    /// It returns 1 on success and zero on error.
    ///
    /// WARNING: `digest` must be the result of hashing the data to be signed with
    /// `hash_nid`. Passing unhashed inputs will not result in a secure signature
    /// scheme.
    pub fn RSA_sign(
        hash_nid: ::core::ffi::c_int,
        digest: *const u8,
        digest_len: usize,
        out: *mut u8,
        out_len: *mut ::core::ffi::c_uint,
        rsa: *mut RSA,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// RSA_sign_pss_mgf1 signs `digest_len` bytes from `digest` with the public key
    /// from `rsa` using RSASSA-PSS with MGF1 as the mask generation function. It
    /// writes, at most, `max_out` bytes of signature data to `out`. The `max_out`
    /// argument must be, at least, `RSA_size` in order to ensure success. It returns
    /// 1 on success or zero on error.
    ///
    /// The `md` and `mgf1_md` arguments identify the hash used to calculate `digest`
    /// and the MGF1 hash, respectively. If `mgf1_md` is NULL, `md` is
    /// used.
    ///
    /// `salt_len` specifies the expected salt length in bytes. If `salt_len` is
    /// `RSA_PSS_SALTLEN_DIGEST`, then the salt length is the same as the hash
    /// length. If `RSA_PSS_SALTLEN_AUTO`, then the salt length is maximal given the
    /// size of `rsa`. If unsure, use `RSA_PSS_SALTLEN_DIGEST`.
    ///
    /// WARNING: `digest` must be the result of hashing the data to be signed with
    /// `md`. Passing unhashed inputs will not result in a secure signature scheme.
    pub fn RSA_sign_pss_mgf1(
        rsa: *mut RSA,
        out_len: *mut usize,
        out: *mut u8,
        max_out: usize,
        digest: *const u8,
        digest_len: usize,
        md: *const EVP_MD,
        mgf1_md: *const EVP_MD,
        salt_len: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// RSA_sign_raw performs the private key portion of computing a signature with
    /// `rsa`. It writes, at most, `max_out` bytes of signature data to `out`. The
    /// `max_out` argument must be, at least, `RSA_size` in order to ensure the
    /// output fits. It returns 1 on success or zero on error.
    ///
    /// If `padding` is `RSA_PKCS1_PADDING`, this function wraps `in` with the
    /// padding portion of RSASSA-PKCS1-v1_5 and then performs the raw private key
    /// operation. The caller is responsible for hashing the input and wrapping it in
    /// a DigestInfo structure.
    ///
    /// If `padding` is `RSA_NO_PADDING`, this function only performs the raw private
    /// key operation, interpreting `in` as an integer modulo n. The caller is
    /// responsible for hashing the input and encoding it for the signature scheme
    /// being implemented.
    ///
    /// WARNING: This function is a building block for a signature scheme, not a
    /// complete one. `in` must be the result of hashing and encoding the data as
    /// needed for the scheme being implemented. Passing in arbitrary inputs will not
    /// result in a secure signature scheme.
    pub fn RSA_sign_raw(
        rsa: *mut RSA,
        out_len: *mut usize,
        out: *mut u8,
        max_out: usize,
        in_: *const u8,
        in_len: usize,
        padding: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// RSA_verify verifies that `sig_len` bytes from `sig` are a valid,
    /// RSASSA-PKCS1-v1_5 signature of `digest_len` bytes at `digest` by `rsa`.
    ///
    /// The `hash_nid` argument identifies the hash function used to calculate
    /// `digest` and is embedded in the resulting signature in order to prevent hash
    /// confusion attacks. For example, it might be `NID_sha256`.
    ///
    /// It returns one if the signature is valid and zero otherwise.
    ///
    /// WARNING: this differs from the original, OpenSSL function which additionally
    /// returned -1 on error.
    ///
    /// WARNING: `digest` must be the result of hashing the data to be verified with
    /// `hash_nid`. Passing unhashed input will not result in a secure signature
    /// scheme.
    pub fn RSA_verify(
        hash_nid: ::core::ffi::c_int,
        digest: *const u8,
        digest_len: usize,
        sig: *const u8,
        sig_len: usize,
        rsa: *mut RSA,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// RSA_verify_pss_mgf1 verifies that `sig_len` bytes from `sig` are a valid,
    /// RSASSA-PSS signature of `digest_len` bytes at `digest` by `rsa`. It returns
    /// one if the signature is valid and zero otherwise. MGF1 is used as the mask
    /// generation function.
    ///
    /// The `md` and `mgf1_md` arguments identify the hash used to calculate `digest`
    /// and the MGF1 hash, respectively. If `mgf1_md` is NULL, `md` is
    /// used. `salt_len` specifies the expected salt length in bytes.
    ///
    /// If `salt_len` is `RSA_PSS_SALTLEN_DIGEST`, then the salt length is the same
    /// as the hash length. If `RSA_PSS_SALTLEN_AUTO`, then the salt length is
    /// recovered and all values accepted. If unsure, use `RSA_PSS_SALTLEN_DIGEST`.
    ///
    /// WARNING: `digest` must be the result of hashing the data to be verified with
    /// `md`. Passing unhashed input will not result in a secure signature scheme.
    pub fn RSA_verify_pss_mgf1(
        rsa: *mut RSA,
        digest: *const u8,
        digest_len: usize,
        md: *const EVP_MD,
        mgf1_md: *const EVP_MD,
        salt_len: ::core::ffi::c_int,
        sig: *const u8,
        sig_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// RSA_verify_raw performs the public key portion of verifying `in_len` bytes of
    /// signature from `in` using the public key from `rsa`. On success, it returns
    /// one and writes, at most, `max_out` bytes of output to `out`. The `max_out`
    /// argument must be, at least, `RSA_size` in order to ensure the output fits. On
    /// failure or invalid input, it returns zero.
    ///
    /// If `padding` is `RSA_PKCS1_PADDING`, this function checks the padding portion
    /// of RSASSA-PKCS1-v1_5 and outputs the remainder of the encoded digest. The
    /// caller is responsible for checking the output is a DigestInfo-wrapped digest
    /// of the message.
    ///
    /// If `padding` is `RSA_NO_PADDING`, this function only performs the raw public
    /// key operation. The caller is responsible for checking the output is a valid
    /// result for the signature scheme being implemented.
    ///
    /// WARNING: This function is a building block for a signature scheme, not a
    /// complete one. Checking for arbitrary strings in `out` will not result in a
    /// secure signature scheme.
    pub fn RSA_verify_raw(
        rsa: *mut RSA,
        out_len: *mut usize,
        out: *mut u8,
        max_out: usize,
        in_: *const u8,
        in_len: usize,
        padding: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// RSA_private_encrypt performs the private key portion of computing a signature
    /// with `rsa`. It takes `flen` bytes from `from` as input and writes the result
    /// to `to`. The `to` buffer must have at least `RSA_size` bytes of space. It
    /// returns the number of bytes written, or -1 on error.
    ///
    /// For the interpretation of `padding` and the input, see `RSA_sign_raw`.
    ///
    /// WARNING: This function is a building block for a signature scheme, not a
    /// complete one. See `RSA_sign_raw` for details.
    ///
    /// WARNING: This function is dangerous because it breaks the usual return value
    /// convention. Use `RSA_sign_raw` instead.
    pub fn RSA_private_encrypt(
        flen: usize,
        from: *const u8,
        to: *mut u8,
        rsa: *mut RSA,
        padding: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// RSA_public_decrypt performs the public key portion of verifying `flen` bytes
    /// of signature from `from` using the public key from `rsa`. It writes the
    /// result to `to`, which must have at least `RSA_size` bytes of space. It
    /// returns the number of bytes written, or -1 on error.
    ///
    /// For the interpretation of `padding` and the result, see `RSA_verify_raw`.
    ///
    /// WARNING: This function is a building block for a signature scheme, not a
    /// complete one. See `RSA_verify_raw` for details.
    ///
    /// WARNING: This function is dangerous because it breaks the usual return value
    /// convention. Use `RSA_verify_raw` instead.
    pub fn RSA_public_decrypt(
        flen: usize,
        from: *const u8,
        to: *mut u8,
        rsa: *mut RSA,
        padding: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// RSA_size returns the number of bytes in the modulus, which is also the size
    /// of a signature or encrypted value using `rsa`.
    pub fn RSA_size(rsa: *const RSA) -> ::core::ffi::c_uint;
}
unsafe extern "C" {
    /// RSA_is_opaque returns one if `rsa` is opaque and doesn't expose its key
    /// material. Otherwise it returns zero.
    pub fn RSA_is_opaque(rsa: *const RSA) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// RSAPublicKey_dup allocates a fresh `RSA` and copies the public key from
    /// `rsa` into it. It returns the fresh `RSA` object, or NULL on error.
    pub fn RSAPublicKey_dup(rsa: *const RSA) -> *mut RSA;
}
unsafe extern "C" {
    /// RSAPrivateKey_dup allocates a fresh `RSA` and copies the private key from
    /// `rsa` into it. It returns the fresh `RSA` object, or NULL on error.
    pub fn RSAPrivateKey_dup(rsa: *const RSA) -> *mut RSA;
}
unsafe extern "C" {
    /// RSA_check_key performs basic validity tests on `rsa`. It returns one if
    /// they pass and zero otherwise. Opaque keys and public keys always pass. If it
    /// returns zero then a more detailed error is available on the error queue.
    pub fn RSA_check_key(rsa: *const RSA) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// RSA_check_fips performs public key validity tests on `key`. It returns one if
    /// they pass and zero otherwise. Opaque keys always fail. This function does not
    /// mutate `rsa` for thread-safety purposes and may be used concurrently.
    pub fn RSA_check_fips(key: *mut RSA) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// RSA_verify_PKCS1_PSS_mgf1 verifies that `EM` is a correct PSS padding of
    /// `mHash`, where `mHash` is a digest produced by `Hash`. `EM` must point to
    /// exactly `RSA_size(rsa)` bytes of data. The `mgf1Hash` argument specifies the
    /// hash function for generating the mask. If NULL, `Hash` is used. The `sLen`
    /// argument specifies the expected salt length in bytes. If `sLen` is -1 then
    /// the salt length is the same as the hash length. If -2, then the salt length
    /// is recovered and all values accepted.
    ///
    /// If unsure, use -1.
    ///
    /// It returns one on success or zero on error.
    ///
    /// This function implements only the low-level padding logic. Use
    /// `RSA_verify_pss_mgf1` instead.
    pub fn RSA_verify_PKCS1_PSS_mgf1(
        rsa: *const RSA,
        mHash: *const u8,
        Hash: *const EVP_MD,
        mgf1Hash: *const EVP_MD,
        EM: *const u8,
        sLen: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// RSA_padding_add_PKCS1_PSS_mgf1 writes a PSS padding of `mHash` to `EM`,
    /// where `mHash` is a digest produced by `Hash`. `RSA_size(rsa)` bytes of
    /// output will be written to `EM`. The `mgf1Hash` argument specifies the hash
    /// function for generating the mask. If NULL, `Hash` is used. The `sLen`
    /// argument specifies the expected salt length in bytes. If `sLen` is -1 then
    /// the salt length is the same as the hash length. If -2, then the salt length
    /// is maximal given the space in `EM`.
    ///
    /// It returns one on success or zero on error.
    ///
    /// This function implements only the low-level padding logic. Use
    /// `RSA_sign_pss_mgf1` instead.
    pub fn RSA_padding_add_PKCS1_PSS_mgf1(
        rsa: *const RSA,
        EM: *mut u8,
        mHash: *const u8,
        Hash: *const EVP_MD,
        mgf1Hash: *const EVP_MD,
        sLen: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// RSA_padding_add_PKCS1_OAEP_mgf1 writes an OAEP padding of `from` to `to`
    /// with the given parameters and hash functions. If `md` is NULL then SHA-1 is
    /// used. If `mgf1md` is NULL then the value of `md` is used (which means SHA-1
    /// if that, in turn, is NULL).
    ///
    /// It returns one on success or zero on error.
    pub fn RSA_padding_add_PKCS1_OAEP_mgf1(
        to: *mut u8,
        to_len: usize,
        from: *const u8,
        from_len: usize,
        param: *const u8,
        param_len: usize,
        md: *const EVP_MD,
        mgf1md: *const EVP_MD,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// RSA_add_pkcs1_prefix builds a version of `digest` prefixed with the
    /// DigestInfo header for the given hash function and sets `out_msg` to point to
    /// it. On successful return, if `*is_alloced` is one, the caller must release
    /// `*out_msg` with `OPENSSL_free`.
    pub fn RSA_add_pkcs1_prefix(
        out_msg: *mut *mut u8,
        out_msg_len: *mut usize,
        is_alloced: *mut ::core::ffi::c_int,
        hash_nid: ::core::ffi::c_int,
        digest: *const u8,
        digest_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// RSA_parse_public_key parses a DER-encoded RSAPublicKey structure (RFC 8017)
    /// from `cbs` and advances `cbs`. It returns a newly-allocated `RSA` or NULL on
    /// error.
    pub fn RSA_parse_public_key(cbs: *mut CBS) -> *mut RSA;
}
unsafe extern "C" {
    /// RSA_public_key_from_bytes parses `in` as a DER-encoded RSAPublicKey structure
    /// (RFC 8017). It returns a newly-allocated `RSA` or NULL on error.
    pub fn RSA_public_key_from_bytes(in_: *const u8, in_len: usize) -> *mut RSA;
}
unsafe extern "C" {
    /// RSA_marshal_public_key marshals `rsa` as a DER-encoded RSAPublicKey structure
    /// (RFC 8017) and appends the result to `cbb`. It returns one on success and
    /// zero on failure.
    pub fn RSA_marshal_public_key(cbb: *mut CBB, rsa: *const RSA) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// RSA_public_key_to_bytes marshals `rsa` as a DER-encoded RSAPublicKey
    /// structure (RFC 8017) and, on success, sets `*out_bytes` to a newly allocated
    /// buffer containing the result and returns one. Otherwise, it returns zero. The
    /// result should be freed with `OPENSSL_free`.
    pub fn RSA_public_key_to_bytes(
        out_bytes: *mut *mut u8,
        out_len: *mut usize,
        rsa: *const RSA,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// RSA_parse_private_key parses a DER-encoded RSAPrivateKey structure (RFC 8017)
    /// from `cbs` and advances `cbs`. It returns a newly-allocated `RSA` or NULL on
    /// error.
    pub fn RSA_parse_private_key(cbs: *mut CBS) -> *mut RSA;
}
unsafe extern "C" {
    /// RSA_private_key_from_bytes parses `in` as a DER-encoded RSAPrivateKey
    /// structure (RFC 8017). It returns a newly-allocated `RSA` or NULL on error.
    pub fn RSA_private_key_from_bytes(in_: *const u8, in_len: usize) -> *mut RSA;
}
unsafe extern "C" {
    /// RSA_marshal_private_key marshals `rsa` as a DER-encoded RSAPrivateKey
    /// structure (RFC 8017) and appends the result to `cbb`. It returns one on
    /// success and zero on failure.
    pub fn RSA_marshal_private_key(cbb: *mut CBB, rsa: *const RSA) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// RSA_private_key_to_bytes marshals `rsa` as a DER-encoded RSAPrivateKey
    /// structure (RFC 8017) and, on success, sets `*out_bytes` to a newly allocated
    /// buffer containing the result and returns one. Otherwise, it returns zero. The
    /// result should be freed with `OPENSSL_free`.
    pub fn RSA_private_key_to_bytes(
        out_bytes: *mut *mut u8,
        out_len: *mut usize,
        rsa: *const RSA,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// RSA_new_private_key_no_crt behaves like `RSA_new_private_key` but constructs
    /// an RSA key without CRT coefficients.
    ///
    /// Keys created by this function will be less performant and cannot be
    /// serialized.
    pub fn RSA_new_private_key_no_crt(
        n: *const BIGNUM,
        e: *const BIGNUM,
        d: *const BIGNUM,
    ) -> *mut RSA;
}
unsafe extern "C" {
    /// RSA_new_private_key_no_e behaves like `RSA_new_private_key` but constructs an
    /// RSA key without CRT parameters or public exponent.
    ///
    /// Keys created by this function will be less performant, cannot be serialized,
    /// and lack hardening measures that protect against side channels and fault
    /// attacks.
    pub fn RSA_new_private_key_no_e(n: *const BIGNUM, d: *const BIGNUM) -> *mut RSA;
}
unsafe extern "C" {
    /// RSA_new_public_key_large_e behaves like `RSA_new_public_key` but allows any
    /// `e` up to `n`.
    ///
    /// BoringSSL typically bounds public exponents as a denial-of-service
    /// mitigation. Keys created by this function may perform worse than those
    /// created by `RSA_new_public_key`.
    pub fn RSA_new_public_key_large_e(n: *const BIGNUM, e: *const BIGNUM) -> *mut RSA;
}
unsafe extern "C" {
    /// RSA_new_private_key_large_e behaves like `RSA_new_private_key` but allows any
    /// `e` up to `n`.
    ///
    /// BoringSSL typically bounds public exponents as a denial-of-service
    /// mitigation. Keys created by this function may perform worse than those
    /// created by `RSA_new_private_key`.
    pub fn RSA_new_private_key_large_e(
        n: *const BIGNUM,
        e: *const BIGNUM,
        d: *const BIGNUM,
        p: *const BIGNUM,
        q: *const BIGNUM,
        dmp1: *const BIGNUM,
        dmq1: *const BIGNUM,
        iqmp: *const BIGNUM,
    ) -> *mut RSA;
}
unsafe extern "C" {
    /// ex_data functions.
    ///
    /// See `ex_data.h` for details.
    pub fn RSA_get_ex_new_index(
        argl: ::core::ffi::c_long,
        argp: *mut ::core::ffi::c_void,
        unused: *mut CRYPTO_EX_unused,
        dup_unused: CRYPTO_EX_dup,
        free_func: CRYPTO_EX_free,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn RSA_set_ex_data(
        rsa: *mut RSA,
        idx: ::core::ffi::c_int,
        arg: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn RSA_get_ex_data(rsa: *const RSA, idx: ::core::ffi::c_int) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    /// RSA_flags returns the flags for `rsa`. These are a bitwise OR of `RSA_FLAG_*`
    /// constants.
    pub fn RSA_flags(rsa: *const RSA) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// RSA_test_flags returns the subset of flags in `flags` which are set in `rsa`.
    pub fn RSA_test_flags(rsa: *const RSA, flags: ::core::ffi::c_int) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// RSA_blinding_on returns one.
    pub fn RSA_blinding_on(rsa: *mut RSA, ctx: *mut BN_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// RSA_blinding_off does nothing.
    pub fn RSA_blinding_off(rsa: *mut RSA);
}
unsafe extern "C" {
    /// RSA_generate_key behaves like `RSA_generate_key_ex`, which is what you
    /// should use instead. It returns NULL on error, or a newly-allocated `RSA` on
    /// success. This function is provided for compatibility only. The `callback`
    /// and `cb_arg` parameters must be NULL.
    pub fn RSA_generate_key(
        bits: ::core::ffi::c_int,
        e: u64,
        callback: *mut ::core::ffi::c_void,
        cb_arg: *mut ::core::ffi::c_void,
    ) -> *mut RSA;
}
unsafe extern "C" {
    /// d2i_RSAPublicKey parses a DER-encoded RSAPublicKey structure (RFC 8017) from
    /// `len` bytes at `*inp`, as described in `d2i_SAMPLE`.
    ///
    /// Use `RSA_parse_public_key` instead.
    pub fn d2i_RSAPublicKey(
        out: *mut *mut RSA,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut RSA;
}
unsafe extern "C" {
    /// i2d_RSAPublicKey marshals `in` to a DER-encoded RSAPublicKey structure (RFC
    /// 8017), as described in `i2d_SAMPLE`.
    ///
    /// Use `RSA_marshal_public_key` instead.
    pub fn i2d_RSAPublicKey(in_: *const RSA, outp: *mut *mut u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// d2i_RSAPrivateKey parses a DER-encoded RSAPrivateKey structure (RFC 8017)
    /// from `len` bytes at `*inp`, as described in `d2i_SAMPLE`.
    ///
    /// Use `RSA_parse_private_key` instead.
    pub fn d2i_RSAPrivateKey(
        out: *mut *mut RSA,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut RSA;
}
unsafe extern "C" {
    /// i2d_RSAPrivateKey marshals `in` to a DER-encoded RSAPrivateKey structure (RFC
    /// 8017), as described in `i2d_SAMPLE`.
    ///
    /// Use `RSA_marshal_private_key` instead.
    pub fn i2d_RSAPrivateKey(in_: *const RSA, outp: *mut *mut u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// RSA_padding_add_PKCS1_PSS acts like `RSA_padding_add_PKCS1_PSS_mgf1` but the
    /// `mgf1Hash` parameter of the latter is implicitly set to `Hash`.
    ///
    /// This function implements only the low-level padding logic. Use
    /// `RSA_sign_pss_mgf1` instead.
    pub fn RSA_padding_add_PKCS1_PSS(
        rsa: *const RSA,
        EM: *mut u8,
        mHash: *const u8,
        Hash: *const EVP_MD,
        sLen: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// RSA_verify_PKCS1_PSS acts like `RSA_verify_PKCS1_PSS_mgf1` but the
    /// `mgf1Hash` parameter of the latter is implicitly set to `Hash`.
    ///
    /// This function implements only the low-level padding logic. Use
    /// `RSA_verify_pss_mgf1` instead.
    pub fn RSA_verify_PKCS1_PSS(
        rsa: *const RSA,
        mHash: *const u8,
        Hash: *const EVP_MD,
        EM: *const u8,
        sLen: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// RSA_padding_add_PKCS1_OAEP acts like `RSA_padding_add_PKCS1_OAEP_mgf1` but
    /// the `md` and `mgf1md` parameters of the latter are implicitly set to NULL,
    /// which means SHA-1.
    pub fn RSA_padding_add_PKCS1_OAEP(
        to: *mut u8,
        to_len: usize,
        from: *const u8,
        from_len: usize,
        param: *const u8,
        param_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// RSA_print prints a textual representation of `rsa` to `bio`. It returns one
    /// on success or zero otherwise.
    pub fn RSA_print(
        bio: *mut BIO,
        rsa: *const RSA,
        indent: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// RSA_get0_pss_params returns NULL. In OpenSSL, this function retries RSA-PSS
    /// parameters associated with `RSA` objects, but BoringSSL does not enable the
    /// id-RSASSA-PSS key encoding by default.
    ///
    /// WARNING: BoringSSL does support id-RSASSA-PSS parameters when callers opt in
    /// (see `EVP_pkey_rsa_pss_sha256` and others). We currently assume such callers
    /// do not need this function. Callers that opt into id-RSASSA-PSS support and
    /// require this functionality should contact the BoringSSL team.
    pub fn RSA_get0_pss_params(rsa: *const RSA) -> *const RSA_PSS_PARAMS;
}
unsafe extern "C" {
    /// RSA_new_method_no_e returns a newly-allocated `RSA` object backed by
    /// `engine`, with a public modulus of `n` and no known public exponent.
    ///
    /// Do not use this function. It exists only to support Conscrypt, whose use
    /// should be replaced with a more sound mechanism. See
    /// https://crbug.com/boringssl/602.
    pub fn RSA_new_method_no_e(engine: *const ENGINE, n: *const BIGNUM) -> *mut RSA;
}
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct rsa_meth_st {
    pub common: openssl_method_common_st,
    pub app_data: *mut ::core::ffi::c_void,
    pub init: ::core::option::Option<unsafe extern "C" fn(rsa: *mut RSA) -> ::core::ffi::c_int>,
    pub finish: ::core::option::Option<unsafe extern "C" fn(rsa: *mut RSA) -> ::core::ffi::c_int>,
    pub sign: ::core::option::Option<
        unsafe extern "C" fn(
            type_: ::core::ffi::c_int,
            m: *const u8,
            m_length: ::core::ffi::c_uint,
            sigret: *mut u8,
            siglen: *mut ::core::ffi::c_uint,
            rsa: *const RSA,
        ) -> ::core::ffi::c_int,
    >,
    /// These functions mirror the `RSA_*` functions of the same name.
    pub sign_raw: ::core::option::Option<
        unsafe extern "C" fn(
            rsa: *mut RSA,
            out_len: *mut usize,
            out: *mut u8,
            max_out: usize,
            in_: *const u8,
            in_len: usize,
            padding: ::core::ffi::c_int,
        ) -> ::core::ffi::c_int,
    >,
    pub decrypt: ::core::option::Option<
        unsafe extern "C" fn(
            rsa: *mut RSA,
            out_len: *mut usize,
            out: *mut u8,
            max_out: usize,
            in_: *const u8,
            in_len: usize,
            padding: ::core::ffi::c_int,
        ) -> ::core::ffi::c_int,
    >,
    /// private_transform takes a big-endian integer from `in`, calculates the
    /// d'th power of it, modulo the RSA modulus and writes the result as a
    /// big-endian integer to `out`. Both `in` and `out` are `len` bytes long and
    /// `len` is always equal to `RSA_size(rsa)`. If the result of the transform
    /// can be represented in fewer than `len` bytes, then `out` must be zero
    /// padded on the left.
    ///
    /// It returns one on success and zero otherwise.
    ///
    /// RSA decrypt and sign operations will call this, thus an ENGINE might wish
    /// to override it in order to avoid having to implement the padding
    /// functionality demanded by those, higher level, operations.
    pub private_transform: ::core::option::Option<
        unsafe extern "C" fn(
            rsa: *mut RSA,
            out: *mut u8,
            in_: *const u8,
            len: usize,
        ) -> ::core::ffi::c_int,
    >,
    pub flags: ::core::ffi::c_int,
}
/// Certificates.
///
/// An `X509` object represents an X.509 certificate, defined in RFC 5280.
///
/// Although an `X509` is a mutable object, mutating an `X509` can give incorrect
/// results. Callers typically obtain `X509`s by parsing some input with
/// `d2i_X509`, etc. Such objects carry information such as the serialized
/// TBSCertificate and decoded extensions, which will become inconsistent when
/// mutated.
///
/// Instead, mutation functions should only be used when issuing new
/// certificates, as described in a later section.
pub type sk_X509_free_func = ::core::option::Option<unsafe extern "C" fn(arg1: *mut X509)>;
/// Certificates.
///
/// An `X509` object represents an X.509 certificate, defined in RFC 5280.
///
/// Although an `X509` is a mutable object, mutating an `X509` can give incorrect
/// results. Callers typically obtain `X509`s by parsing some input with
/// `d2i_X509`, etc. Such objects carry information such as the serialized
/// TBSCertificate and decoded extensions, which will become inconsistent when
/// mutated.
///
/// Instead, mutation functions should only be used when issuing new
/// certificates, as described in a later section.
pub type sk_X509_copy_func =
    ::core::option::Option<unsafe extern "C" fn(arg1: *const X509) -> *mut X509>;
/// Certificates.
///
/// An `X509` object represents an X.509 certificate, defined in RFC 5280.
///
/// Although an `X509` is a mutable object, mutating an `X509` can give incorrect
/// results. Callers typically obtain `X509`s by parsing some input with
/// `d2i_X509`, etc. Such objects carry information such as the serialized
/// TBSCertificate and decoded extensions, which will become inconsistent when
/// mutated.
///
/// Instead, mutation functions should only be used when issuing new
/// certificates, as described in a later section.
pub type sk_X509_cmp_func = ::core::option::Option<
    unsafe extern "C" fn(arg1: *const *const X509, arg2: *const *const X509) -> ::core::ffi::c_int,
>;
/// Certificates.
///
/// An `X509` object represents an X.509 certificate, defined in RFC 5280.
///
/// Although an `X509` is a mutable object, mutating an `X509` can give incorrect
/// results. Callers typically obtain `X509`s by parsing some input with
/// `d2i_X509`, etc. Such objects carry information such as the serialized
/// TBSCertificate and decoded extensions, which will become inconsistent when
/// mutated.
///
/// Instead, mutation functions should only be used when issuing new
/// certificates, as described in a later section.
pub type sk_X509_delete_if_func = ::core::option::Option<
    unsafe extern "C" fn(arg1: *mut X509, arg2: *mut ::core::ffi::c_void) -> ::core::ffi::c_int,
>;
unsafe extern "C" {
    /// Certificates.
    ///
    /// An `X509` object represents an X.509 certificate, defined in RFC 5280.
    ///
    /// Although an `X509` is a mutable object, mutating an `X509` can give incorrect
    /// results. Callers typically obtain `X509`s by parsing some input with
    /// `d2i_X509`, etc. Such objects carry information such as the serialized
    /// TBSCertificate and decoded extensions, which will become inconsistent when
    /// mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new
    /// certificates, as described in a later section.
    #[link_name = "sk_X509_call_free_func__extern"]
    pub fn sk_X509_call_free_func(free_func: OPENSSL_sk_free_func, ptr: *mut ::core::ffi::c_void);
}
unsafe extern "C" {
    /// Certificates.
    ///
    /// An `X509` object represents an X.509 certificate, defined in RFC 5280.
    ///
    /// Although an `X509` is a mutable object, mutating an `X509` can give incorrect
    /// results. Callers typically obtain `X509`s by parsing some input with
    /// `d2i_X509`, etc. Such objects carry information such as the serialized
    /// TBSCertificate and decoded extensions, which will become inconsistent when
    /// mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new
    /// certificates, as described in a later section.
    #[link_name = "sk_X509_call_copy_func__extern"]
    pub fn sk_X509_call_copy_func(
        copy_func: OPENSSL_sk_copy_func,
        ptr: *const ::core::ffi::c_void,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    /// Certificates.
    ///
    /// An `X509` object represents an X.509 certificate, defined in RFC 5280.
    ///
    /// Although an `X509` is a mutable object, mutating an `X509` can give incorrect
    /// results. Callers typically obtain `X509`s by parsing some input with
    /// `d2i_X509`, etc. Such objects carry information such as the serialized
    /// TBSCertificate and decoded extensions, which will become inconsistent when
    /// mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new
    /// certificates, as described in a later section.
    #[link_name = "sk_X509_call_cmp_func__extern"]
    pub fn sk_X509_call_cmp_func(
        cmp_func: OPENSSL_sk_cmp_func,
        a: *const ::core::ffi::c_void,
        b: *const ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Certificates.
    ///
    /// An `X509` object represents an X.509 certificate, defined in RFC 5280.
    ///
    /// Although an `X509` is a mutable object, mutating an `X509` can give incorrect
    /// results. Callers typically obtain `X509`s by parsing some input with
    /// `d2i_X509`, etc. Such objects carry information such as the serialized
    /// TBSCertificate and decoded extensions, which will become inconsistent when
    /// mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new
    /// certificates, as described in a later section.
    #[link_name = "sk_X509_call_delete_if_func__extern"]
    pub fn sk_X509_call_delete_if_func(
        func: OPENSSL_sk_delete_if_func,
        obj: *mut ::core::ffi::c_void,
        data: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Certificates.
    ///
    /// An `X509` object represents an X.509 certificate, defined in RFC 5280.
    ///
    /// Although an `X509` is a mutable object, mutating an `X509` can give incorrect
    /// results. Callers typically obtain `X509`s by parsing some input with
    /// `d2i_X509`, etc. Such objects carry information such as the serialized
    /// TBSCertificate and decoded extensions, which will become inconsistent when
    /// mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new
    /// certificates, as described in a later section.
    #[link_name = "sk_X509_new__extern"]
    pub fn sk_X509_new(comp: sk_X509_cmp_func) -> *mut stack_st_X509;
}
unsafe extern "C" {
    /// Certificates.
    ///
    /// An `X509` object represents an X.509 certificate, defined in RFC 5280.
    ///
    /// Although an `X509` is a mutable object, mutating an `X509` can give incorrect
    /// results. Callers typically obtain `X509`s by parsing some input with
    /// `d2i_X509`, etc. Such objects carry information such as the serialized
    /// TBSCertificate and decoded extensions, which will become inconsistent when
    /// mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new
    /// certificates, as described in a later section.
    #[link_name = "sk_X509_new_null__extern"]
    pub fn sk_X509_new_null() -> *mut stack_st_X509;
}
unsafe extern "C" {
    /// Certificates.
    ///
    /// An `X509` object represents an X.509 certificate, defined in RFC 5280.
    ///
    /// Although an `X509` is a mutable object, mutating an `X509` can give incorrect
    /// results. Callers typically obtain `X509`s by parsing some input with
    /// `d2i_X509`, etc. Such objects carry information such as the serialized
    /// TBSCertificate and decoded extensions, which will become inconsistent when
    /// mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new
    /// certificates, as described in a later section.
    #[link_name = "sk_X509_num__extern"]
    pub fn sk_X509_num(sk: *const stack_st_X509) -> usize;
}
unsafe extern "C" {
    /// Certificates.
    ///
    /// An `X509` object represents an X.509 certificate, defined in RFC 5280.
    ///
    /// Although an `X509` is a mutable object, mutating an `X509` can give incorrect
    /// results. Callers typically obtain `X509`s by parsing some input with
    /// `d2i_X509`, etc. Such objects carry information such as the serialized
    /// TBSCertificate and decoded extensions, which will become inconsistent when
    /// mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new
    /// certificates, as described in a later section.
    #[link_name = "sk_X509_zero__extern"]
    pub fn sk_X509_zero(sk: *mut stack_st_X509);
}
unsafe extern "C" {
    /// Certificates.
    ///
    /// An `X509` object represents an X.509 certificate, defined in RFC 5280.
    ///
    /// Although an `X509` is a mutable object, mutating an `X509` can give incorrect
    /// results. Callers typically obtain `X509`s by parsing some input with
    /// `d2i_X509`, etc. Such objects carry information such as the serialized
    /// TBSCertificate and decoded extensions, which will become inconsistent when
    /// mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new
    /// certificates, as described in a later section.
    #[link_name = "sk_X509_value__extern"]
    pub fn sk_X509_value(sk: *const stack_st_X509, i: usize) -> *mut X509;
}
unsafe extern "C" {
    /// Certificates.
    ///
    /// An `X509` object represents an X.509 certificate, defined in RFC 5280.
    ///
    /// Although an `X509` is a mutable object, mutating an `X509` can give incorrect
    /// results. Callers typically obtain `X509`s by parsing some input with
    /// `d2i_X509`, etc. Such objects carry information such as the serialized
    /// TBSCertificate and decoded extensions, which will become inconsistent when
    /// mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new
    /// certificates, as described in a later section.
    #[link_name = "sk_X509_set__extern"]
    pub fn sk_X509_set(sk: *mut stack_st_X509, i: usize, p: *mut X509) -> *mut X509;
}
unsafe extern "C" {
    /// Certificates.
    ///
    /// An `X509` object represents an X.509 certificate, defined in RFC 5280.
    ///
    /// Although an `X509` is a mutable object, mutating an `X509` can give incorrect
    /// results. Callers typically obtain `X509`s by parsing some input with
    /// `d2i_X509`, etc. Such objects carry information such as the serialized
    /// TBSCertificate and decoded extensions, which will become inconsistent when
    /// mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new
    /// certificates, as described in a later section.
    #[link_name = "sk_X509_free__extern"]
    pub fn sk_X509_free(sk: *mut stack_st_X509);
}
unsafe extern "C" {
    /// Certificates.
    ///
    /// An `X509` object represents an X.509 certificate, defined in RFC 5280.
    ///
    /// Although an `X509` is a mutable object, mutating an `X509` can give incorrect
    /// results. Callers typically obtain `X509`s by parsing some input with
    /// `d2i_X509`, etc. Such objects carry information such as the serialized
    /// TBSCertificate and decoded extensions, which will become inconsistent when
    /// mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new
    /// certificates, as described in a later section.
    #[link_name = "sk_X509_pop_free__extern"]
    pub fn sk_X509_pop_free(sk: *mut stack_st_X509, free_func: sk_X509_free_func);
}
unsafe extern "C" {
    /// Certificates.
    ///
    /// An `X509` object represents an X.509 certificate, defined in RFC 5280.
    ///
    /// Although an `X509` is a mutable object, mutating an `X509` can give incorrect
    /// results. Callers typically obtain `X509`s by parsing some input with
    /// `d2i_X509`, etc. Such objects carry information such as the serialized
    /// TBSCertificate and decoded extensions, which will become inconsistent when
    /// mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new
    /// certificates, as described in a later section.
    #[link_name = "sk_X509_insert__extern"]
    pub fn sk_X509_insert(sk: *mut stack_st_X509, p: *mut X509, where_: usize) -> usize;
}
unsafe extern "C" {
    /// Certificates.
    ///
    /// An `X509` object represents an X.509 certificate, defined in RFC 5280.
    ///
    /// Although an `X509` is a mutable object, mutating an `X509` can give incorrect
    /// results. Callers typically obtain `X509`s by parsing some input with
    /// `d2i_X509`, etc. Such objects carry information such as the serialized
    /// TBSCertificate and decoded extensions, which will become inconsistent when
    /// mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new
    /// certificates, as described in a later section.
    #[link_name = "sk_X509_delete__extern"]
    pub fn sk_X509_delete(sk: *mut stack_st_X509, where_: usize) -> *mut X509;
}
unsafe extern "C" {
    /// Certificates.
    ///
    /// An `X509` object represents an X.509 certificate, defined in RFC 5280.
    ///
    /// Although an `X509` is a mutable object, mutating an `X509` can give incorrect
    /// results. Callers typically obtain `X509`s by parsing some input with
    /// `d2i_X509`, etc. Such objects carry information such as the serialized
    /// TBSCertificate and decoded extensions, which will become inconsistent when
    /// mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new
    /// certificates, as described in a later section.
    #[link_name = "sk_X509_delete_ptr__extern"]
    pub fn sk_X509_delete_ptr(sk: *mut stack_st_X509, p: *const X509) -> *mut X509;
}
unsafe extern "C" {
    /// Certificates.
    ///
    /// An `X509` object represents an X.509 certificate, defined in RFC 5280.
    ///
    /// Although an `X509` is a mutable object, mutating an `X509` can give incorrect
    /// results. Callers typically obtain `X509`s by parsing some input with
    /// `d2i_X509`, etc. Such objects carry information such as the serialized
    /// TBSCertificate and decoded extensions, which will become inconsistent when
    /// mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new
    /// certificates, as described in a later section.
    #[link_name = "sk_X509_delete_if__extern"]
    pub fn sk_X509_delete_if(
        sk: *mut stack_st_X509,
        func: sk_X509_delete_if_func,
        data: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    /// Certificates.
    ///
    /// An `X509` object represents an X.509 certificate, defined in RFC 5280.
    ///
    /// Although an `X509` is a mutable object, mutating an `X509` can give incorrect
    /// results. Callers typically obtain `X509`s by parsing some input with
    /// `d2i_X509`, etc. Such objects carry information such as the serialized
    /// TBSCertificate and decoded extensions, which will become inconsistent when
    /// mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new
    /// certificates, as described in a later section.
    #[link_name = "sk_X509_find__extern"]
    pub fn sk_X509_find(
        sk: *const stack_st_X509,
        out_index: *mut usize,
        p: *const X509,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Certificates.
    ///
    /// An `X509` object represents an X.509 certificate, defined in RFC 5280.
    ///
    /// Although an `X509` is a mutable object, mutating an `X509` can give incorrect
    /// results. Callers typically obtain `X509`s by parsing some input with
    /// `d2i_X509`, etc. Such objects carry information such as the serialized
    /// TBSCertificate and decoded extensions, which will become inconsistent when
    /// mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new
    /// certificates, as described in a later section.
    #[link_name = "sk_X509_shift__extern"]
    pub fn sk_X509_shift(sk: *mut stack_st_X509) -> *mut X509;
}
unsafe extern "C" {
    /// Certificates.
    ///
    /// An `X509` object represents an X.509 certificate, defined in RFC 5280.
    ///
    /// Although an `X509` is a mutable object, mutating an `X509` can give incorrect
    /// results. Callers typically obtain `X509`s by parsing some input with
    /// `d2i_X509`, etc. Such objects carry information such as the serialized
    /// TBSCertificate and decoded extensions, which will become inconsistent when
    /// mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new
    /// certificates, as described in a later section.
    #[link_name = "sk_X509_push__extern"]
    pub fn sk_X509_push(sk: *mut stack_st_X509, p: *mut X509) -> usize;
}
unsafe extern "C" {
    /// Certificates.
    ///
    /// An `X509` object represents an X.509 certificate, defined in RFC 5280.
    ///
    /// Although an `X509` is a mutable object, mutating an `X509` can give incorrect
    /// results. Callers typically obtain `X509`s by parsing some input with
    /// `d2i_X509`, etc. Such objects carry information such as the serialized
    /// TBSCertificate and decoded extensions, which will become inconsistent when
    /// mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new
    /// certificates, as described in a later section.
    #[link_name = "sk_X509_pop__extern"]
    pub fn sk_X509_pop(sk: *mut stack_st_X509) -> *mut X509;
}
unsafe extern "C" {
    /// Certificates.
    ///
    /// An `X509` object represents an X.509 certificate, defined in RFC 5280.
    ///
    /// Although an `X509` is a mutable object, mutating an `X509` can give incorrect
    /// results. Callers typically obtain `X509`s by parsing some input with
    /// `d2i_X509`, etc. Such objects carry information such as the serialized
    /// TBSCertificate and decoded extensions, which will become inconsistent when
    /// mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new
    /// certificates, as described in a later section.
    #[link_name = "sk_X509_dup__extern"]
    pub fn sk_X509_dup(sk: *const stack_st_X509) -> *mut stack_st_X509;
}
unsafe extern "C" {
    /// Certificates.
    ///
    /// An `X509` object represents an X.509 certificate, defined in RFC 5280.
    ///
    /// Although an `X509` is a mutable object, mutating an `X509` can give incorrect
    /// results. Callers typically obtain `X509`s by parsing some input with
    /// `d2i_X509`, etc. Such objects carry information such as the serialized
    /// TBSCertificate and decoded extensions, which will become inconsistent when
    /// mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new
    /// certificates, as described in a later section.
    #[link_name = "sk_X509_sort__extern"]
    pub fn sk_X509_sort(sk: *mut stack_st_X509);
}
unsafe extern "C" {
    /// Certificates.
    ///
    /// An `X509` object represents an X.509 certificate, defined in RFC 5280.
    ///
    /// Although an `X509` is a mutable object, mutating an `X509` can give incorrect
    /// results. Callers typically obtain `X509`s by parsing some input with
    /// `d2i_X509`, etc. Such objects carry information such as the serialized
    /// TBSCertificate and decoded extensions, which will become inconsistent when
    /// mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new
    /// certificates, as described in a later section.
    #[link_name = "sk_X509_sort_and_dedup__extern"]
    pub fn sk_X509_sort_and_dedup(sk: *mut stack_st_X509, free_func: sk_X509_free_func);
}
unsafe extern "C" {
    /// Certificates.
    ///
    /// An `X509` object represents an X.509 certificate, defined in RFC 5280.
    ///
    /// Although an `X509` is a mutable object, mutating an `X509` can give incorrect
    /// results. Callers typically obtain `X509`s by parsing some input with
    /// `d2i_X509`, etc. Such objects carry information such as the serialized
    /// TBSCertificate and decoded extensions, which will become inconsistent when
    /// mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new
    /// certificates, as described in a later section.
    #[link_name = "sk_X509_is_sorted__extern"]
    pub fn sk_X509_is_sorted(sk: *const stack_st_X509) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Certificates.
    ///
    /// An `X509` object represents an X.509 certificate, defined in RFC 5280.
    ///
    /// Although an `X509` is a mutable object, mutating an `X509` can give incorrect
    /// results. Callers typically obtain `X509`s by parsing some input with
    /// `d2i_X509`, etc. Such objects carry information such as the serialized
    /// TBSCertificate and decoded extensions, which will become inconsistent when
    /// mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new
    /// certificates, as described in a later section.
    #[link_name = "sk_X509_set_cmp_func__extern"]
    pub fn sk_X509_set_cmp_func(sk: *mut stack_st_X509, comp: sk_X509_cmp_func)
        -> sk_X509_cmp_func;
}
unsafe extern "C" {
    /// Certificates.
    ///
    /// An `X509` object represents an X.509 certificate, defined in RFC 5280.
    ///
    /// Although an `X509` is a mutable object, mutating an `X509` can give incorrect
    /// results. Callers typically obtain `X509`s by parsing some input with
    /// `d2i_X509`, etc. Such objects carry information such as the serialized
    /// TBSCertificate and decoded extensions, which will become inconsistent when
    /// mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new
    /// certificates, as described in a later section.
    #[link_name = "sk_X509_deep_copy__extern"]
    pub fn sk_X509_deep_copy(
        sk: *const stack_st_X509,
        copy_func: sk_X509_copy_func,
        free_func: sk_X509_free_func,
    ) -> *mut stack_st_X509;
}
unsafe extern "C" {
    /// X509 is an `ASN1_ITEM` whose ASN.1 type is X.509 Certificate (RFC 5280) and C
    /// type is `X509*`.
    pub static X509_it: ASN1_ITEM;
}
unsafe extern "C" {
    /// X509_up_ref adds one to the reference count of `x509` and returns one.
    pub fn X509_up_ref(x509: *mut X509) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_dup_ref increments the reference count of `x509` and returns `x509`.
    /// The caller must call `X509_free` on the result to release the reference.
    ///
    /// WARNING: Although the result is non-const for use with `X509_free`, it is
    /// still shared with other parts of the application for the same object. Avoid
    /// mutating shared `X509`s.
    pub fn X509_dup_ref(x509: *const X509) -> *mut X509;
}
unsafe extern "C" {
    /// X509_chain_up_ref returns a newly-allocated `STACK_OF(X509)` containing a
    /// shallow copy of `chain`, or NULL on error. That is, the return value has the
    /// same contents as `chain`, and each `X509`'s reference count is incremented by
    /// one.
    pub fn X509_chain_up_ref(chain: *mut stack_st_X509) -> *mut stack_st_X509;
}
unsafe extern "C" {
    /// X509_dup returns a newly-allocated copy of `x509`, or NULL on error. This
    /// function works by serializing the structure, so auxiliary properties (see
    /// `i2d_X509_AUX`) are not preserved. Additionally, if `x509` is incomplete,
    /// this function may fail.
    pub fn X509_dup(x509: *const X509) -> *mut X509;
}
unsafe extern "C" {
    /// X509_free decrements `x509`'s reference count and, if zero, releases memory
    /// associated with `x509`.
    pub fn X509_free(x509: *mut X509);
}
unsafe extern "C" {
    /// d2i_X509 parses up to `len` bytes from `*inp` as a DER-encoded X.509
    /// Certificate (RFC 5280), as described in `d2i_SAMPLE`.
    pub fn d2i_X509(
        out: *mut *mut X509,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut X509;
}
unsafe extern "C" {
    /// X509_parse_with_algorithms parses an X.509 structure from `buf` and returns a
    /// fresh X509 or NULL on error. There must not be any trailing data in `buf`.
    /// The returned structure (if any) increments `buf`'s reference count and
    /// retains a reference to it.
    ///
    /// Only the `num_algs` algorithms from `algs` will be considered when parsing
    /// the certificate's public key. If the certificate uses a different algorithm,
    /// it will still be parsed, but `X509_get0_pubkey` will return NULL.
    pub fn X509_parse_with_algorithms(
        buf: *mut CRYPTO_BUFFER,
        algs: *const *const EVP_PKEY_ALG,
        num_algs: usize,
    ) -> *mut X509;
}
unsafe extern "C" {
    /// X509_parse_from_buffer behaves like `X509_parse_with_algorithms` but uses a
    /// default algorithm list.
    pub fn X509_parse_from_buffer(buf: *mut CRYPTO_BUFFER) -> *mut X509;
}
unsafe extern "C" {
    /// i2d_X509 marshals `x509` as a DER-encoded X.509 Certificate (RFC 5280), as
    /// described in `i2d_SAMPLE`.
    pub fn i2d_X509(x509: *const X509, outp: *mut *mut u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_get_version returns the numerical value of `x509`'s version, which will
    /// be one of the `X509_VERSION_*` constants.
    pub fn X509_get_version(x509: *const X509) -> ::core::ffi::c_long;
}
unsafe extern "C" {
    /// X509_get0_serialNumber returns `x509`'s serial number.
    pub fn X509_get0_serialNumber(x509: *const X509) -> *const ASN1_INTEGER;
}
unsafe extern "C" {
    /// X509_get0_notBefore returns `x509`'s notBefore time.
    pub fn X509_get0_notBefore(x509: *const X509) -> *const ASN1_TIME;
}
unsafe extern "C" {
    /// X509_get0_notAfter returns `x509`'s notAfter time.
    pub fn X509_get0_notAfter(x509: *const X509) -> *const ASN1_TIME;
}
unsafe extern "C" {
    /// X509_get_issuer_name returns `x509`'s issuer.
    pub fn X509_get_issuer_name(x509: *const X509) -> *mut X509_NAME;
}
unsafe extern "C" {
    /// X509_get_subject_name returns `x509`'s subject.
    pub fn X509_get_subject_name(x509: *const X509) -> *mut X509_NAME;
}
unsafe extern "C" {
    /// X509_get_X509_PUBKEY returns the public key of `x509`. Note this function is
    /// not const-correct for legacy reasons. Callers should not modify the returned
    /// object.
    pub fn X509_get_X509_PUBKEY(x509: *const X509) -> *mut X509_PUBKEY;
}
unsafe extern "C" {
    /// X509_get0_pubkey returns `x509`'s public key as an `EVP_PKEY`, or NULL if the
    /// public key was unsupported or could not be decoded. The `EVP_PKEY` is cached
    /// in `x509`, so callers must not mutate the result.
    pub fn X509_get0_pubkey(x509: *const X509) -> *mut EVP_PKEY;
}
unsafe extern "C" {
    /// X509_get_pubkey behaves like `X509_get0_pubkey` but increments the reference
    /// count on the `EVP_PKEY`. The caller must release the result with
    /// `EVP_PKEY_free` when done. The `EVP_PKEY` is cached in `x509`, so callers
    /// must not mutate the result.
    pub fn X509_get_pubkey(x509: *const X509) -> *mut EVP_PKEY;
}
unsafe extern "C" {
    /// X509_get0_pubkey_bitstr returns the BIT STRING portion of `x509`'s public
    /// key. Note this does not contain the AlgorithmIdentifier portion.
    ///
    /// WARNING: This function returns a non-const pointer for OpenSSL compatibility,
    /// but the caller must not modify the resulting object. Doing so will break
    /// internal invariants in `x509`.
    pub fn X509_get0_pubkey_bitstr(x509: *const X509) -> *mut ASN1_BIT_STRING;
}
unsafe extern "C" {
    /// X509_check_private_key returns one if `x509`'s public key matches `pkey` and
    /// zero otherwise.
    pub fn X509_check_private_key(x509: *const X509, pkey: *const EVP_PKEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_get0_uids sets `*out_issuer_uid` to a non-owning pointer to the
    /// issuerUID field of `x509`, or NULL if `x509` has no issuerUID. It similarly
    /// outputs `x509`'s subjectUID field to `*out_subject_uid`.
    ///
    /// Callers may pass NULL to either `out_issuer_uid` or `out_subject_uid` to
    /// ignore the corresponding field.
    pub fn X509_get0_uids(
        x509: *const X509,
        out_issuer_uid: *mut *const ASN1_BIT_STRING,
        out_subject_uid: *mut *const ASN1_BIT_STRING,
    );
}
unsafe extern "C" {
    /// X509_get_extension_flags decodes a set of extensions from `x509` and returns
    /// a collection of `EXFLAG_*` bits which reflect `x509`. If there was an error
    /// in computing this bitmask, the result will include the `EXFLAG_INVALID` bit.
    pub fn X509_get_extension_flags(x509: *mut X509) -> u32;
}
unsafe extern "C" {
    /// X509_get_pathlen returns path length constraint from the basic constraints
    /// extension in `x509`. (See RFC 5280, section 4.2.1.9.) It returns -1 if the
    /// constraint is not present, or if some extension in `x509` was invalid.
    ///
    /// TODO(crbug.com/boringssl/381): Decoding an `X509` object will not check for
    /// invalid extensions. To detect the error case, call
    /// `X509_get_extension_flags` and check the `EXFLAG_INVALID` bit.
    pub fn X509_get_pathlen(x509: *mut X509) -> ::core::ffi::c_long;
}
unsafe extern "C" {
    /// X509_get_key_usage returns a bitmask of key usages (see Section 4.2.1.3 of
    /// RFC 5280) which `x509` is valid for. This function only reports the first 16
    /// bits, in a little-endian byte order, but big-endian bit order. That is, bits
    /// 0 though 7 are reported at 1<<7 through 1<<0, and bits 8 through 15 are
    /// reported at 1<<15 through 1<<8.
    ///
    /// Instead of depending on this bit order, callers should compare against the
    /// `X509v3_KU_*` constants.
    ///
    /// If `x509` has no key usage extension, all key usages are valid and this
    /// function returns `UINT32_MAX`. If there was an error processing `x509`'s
    /// extensions, or if the first 16 bits in the key usage extension were all zero,
    /// this function returns zero.
    pub fn X509_get_key_usage(x509: *mut X509) -> u32;
}
unsafe extern "C" {
    /// X509_get_extended_key_usage returns a bitmask of extended key usages (see
    /// Section 4.2.1.12 of RFC 5280) which `x509` is valid for. The result will be
    /// a combination of `XKU_*` constants. If checking an extended key usage not
    /// defined above, callers should extract the extended key usage extension
    /// separately, e.g. via `X509_get_ext_d2i`.
    ///
    /// If `x509` has no extended key usage extension, all extended key usages are
    /// valid and this function returns `UINT32_MAX`. If there was an error
    /// processing `x509`'s extensions, or if `x509`'s extended key usage extension
    /// contained no recognized usages, this function returns zero.
    pub fn X509_get_extended_key_usage(x509: *mut X509) -> u32;
}
unsafe extern "C" {
    /// X509_get0_subject_key_id returns `x509`'s subject key identifier, if present.
    /// (See RFC 5280, section 4.2.1.2.) It returns NULL if the extension is not
    /// present or if some extension in `x509` was invalid.
    ///
    /// TODO(crbug.com/boringssl/381): Decoding an `X509` object will not check for
    /// invalid extensions. To detect the error case, call
    /// `X509_get_extension_flags` and check the `EXFLAG_INVALID` bit.
    pub fn X509_get0_subject_key_id(x509: *mut X509) -> *const ASN1_OCTET_STRING;
}
unsafe extern "C" {
    /// X509_get0_authority_key_id returns keyIdentifier of `x509`'s authority key
    /// identifier, if the extension and field are present. (See RFC 5280,
    /// section 4.2.1.1.) It returns NULL if the extension is not present, if it is
    /// present but lacks a keyIdentifier field, or if some extension in `x509` was
    /// invalid.
    ///
    /// TODO(crbug.com/boringssl/381): Decoding an `X509` object will not check for
    /// invalid extensions. To detect the error case, call
    /// `X509_get_extension_flags` and check the `EXFLAG_INVALID` bit.
    pub fn X509_get0_authority_key_id(x509: *mut X509) -> *const ASN1_OCTET_STRING;
}
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct stack_st_GENERAL_NAME {
    _unused: [u8; 0],
}
/// We also disable -Wcast-qual. As part of this C-based type erasure setup,  \
/// the wrapper macros need to cast away const in places. In C++, const_cast  \
/// suppresses the warning, but it seemingly cannot be suppressed in C.
pub type sk_GENERAL_NAME_free_func =
    ::core::option::Option<unsafe extern "C" fn(arg1: *mut GENERAL_NAME)>;
pub type sk_GENERAL_NAME_copy_func =
    ::core::option::Option<unsafe extern "C" fn(arg1: *const GENERAL_NAME) -> *mut GENERAL_NAME>;
pub type sk_GENERAL_NAME_cmp_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *const *const GENERAL_NAME,
        arg2: *const *const GENERAL_NAME,
    ) -> ::core::ffi::c_int,
>;
pub type sk_GENERAL_NAME_delete_if_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *mut GENERAL_NAME,
        arg2: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int,
>;
unsafe extern "C" {
    #[link_name = "sk_GENERAL_NAME_call_free_func__extern"]
    pub fn sk_GENERAL_NAME_call_free_func(
        free_func: OPENSSL_sk_free_func,
        ptr: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_NAME_call_copy_func__extern"]
    pub fn sk_GENERAL_NAME_call_copy_func(
        copy_func: OPENSSL_sk_copy_func,
        ptr: *const ::core::ffi::c_void,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_NAME_call_cmp_func__extern"]
    pub fn sk_GENERAL_NAME_call_cmp_func(
        cmp_func: OPENSSL_sk_cmp_func,
        a: *const ::core::ffi::c_void,
        b: *const ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_NAME_call_delete_if_func__extern"]
    pub fn sk_GENERAL_NAME_call_delete_if_func(
        func: OPENSSL_sk_delete_if_func,
        obj: *mut ::core::ffi::c_void,
        data: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_NAME_new__extern"]
    pub fn sk_GENERAL_NAME_new(comp: sk_GENERAL_NAME_cmp_func) -> *mut stack_st_GENERAL_NAME;
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_NAME_new_null__extern"]
    pub fn sk_GENERAL_NAME_new_null() -> *mut stack_st_GENERAL_NAME;
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_NAME_num__extern"]
    pub fn sk_GENERAL_NAME_num(sk: *const stack_st_GENERAL_NAME) -> usize;
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_NAME_zero__extern"]
    pub fn sk_GENERAL_NAME_zero(sk: *mut stack_st_GENERAL_NAME);
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_NAME_value__extern"]
    pub fn sk_GENERAL_NAME_value(sk: *const stack_st_GENERAL_NAME, i: usize) -> *mut GENERAL_NAME;
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_NAME_set__extern"]
    pub fn sk_GENERAL_NAME_set(
        sk: *mut stack_st_GENERAL_NAME,
        i: usize,
        p: *mut GENERAL_NAME,
    ) -> *mut GENERAL_NAME;
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_NAME_free__extern"]
    pub fn sk_GENERAL_NAME_free(sk: *mut stack_st_GENERAL_NAME);
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_NAME_pop_free__extern"]
    pub fn sk_GENERAL_NAME_pop_free(
        sk: *mut stack_st_GENERAL_NAME,
        free_func: sk_GENERAL_NAME_free_func,
    );
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_NAME_insert__extern"]
    pub fn sk_GENERAL_NAME_insert(
        sk: *mut stack_st_GENERAL_NAME,
        p: *mut GENERAL_NAME,
        where_: usize,
    ) -> usize;
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_NAME_delete__extern"]
    pub fn sk_GENERAL_NAME_delete(
        sk: *mut stack_st_GENERAL_NAME,
        where_: usize,
    ) -> *mut GENERAL_NAME;
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_NAME_delete_ptr__extern"]
    pub fn sk_GENERAL_NAME_delete_ptr(
        sk: *mut stack_st_GENERAL_NAME,
        p: *const GENERAL_NAME,
    ) -> *mut GENERAL_NAME;
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_NAME_delete_if__extern"]
    pub fn sk_GENERAL_NAME_delete_if(
        sk: *mut stack_st_GENERAL_NAME,
        func: sk_GENERAL_NAME_delete_if_func,
        data: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_NAME_find__extern"]
    pub fn sk_GENERAL_NAME_find(
        sk: *const stack_st_GENERAL_NAME,
        out_index: *mut usize,
        p: *const GENERAL_NAME,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_NAME_shift__extern"]
    pub fn sk_GENERAL_NAME_shift(sk: *mut stack_st_GENERAL_NAME) -> *mut GENERAL_NAME;
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_NAME_push__extern"]
    pub fn sk_GENERAL_NAME_push(sk: *mut stack_st_GENERAL_NAME, p: *mut GENERAL_NAME) -> usize;
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_NAME_pop__extern"]
    pub fn sk_GENERAL_NAME_pop(sk: *mut stack_st_GENERAL_NAME) -> *mut GENERAL_NAME;
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_NAME_dup__extern"]
    pub fn sk_GENERAL_NAME_dup(sk: *const stack_st_GENERAL_NAME) -> *mut stack_st_GENERAL_NAME;
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_NAME_sort__extern"]
    pub fn sk_GENERAL_NAME_sort(sk: *mut stack_st_GENERAL_NAME);
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_NAME_sort_and_dedup__extern"]
    pub fn sk_GENERAL_NAME_sort_and_dedup(
        sk: *mut stack_st_GENERAL_NAME,
        free_func: sk_GENERAL_NAME_free_func,
    );
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_NAME_is_sorted__extern"]
    pub fn sk_GENERAL_NAME_is_sorted(sk: *const stack_st_GENERAL_NAME) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_NAME_set_cmp_func__extern"]
    pub fn sk_GENERAL_NAME_set_cmp_func(
        sk: *mut stack_st_GENERAL_NAME,
        comp: sk_GENERAL_NAME_cmp_func,
    ) -> sk_GENERAL_NAME_cmp_func;
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_NAME_deep_copy__extern"]
    pub fn sk_GENERAL_NAME_deep_copy(
        sk: *const stack_st_GENERAL_NAME,
        copy_func: sk_GENERAL_NAME_copy_func,
        free_func: sk_GENERAL_NAME_free_func,
    ) -> *mut stack_st_GENERAL_NAME;
}
pub type GENERAL_NAMES = stack_st_GENERAL_NAME;
unsafe extern "C" {
    /// X509_get0_authority_issuer returns the authorityCertIssuer of `x509`'s
    /// authority key identifier, if the extension and field are present. (See
    /// RFC 5280, section 4.2.1.1.) It returns NULL if the extension is not present,
    /// if it is present but lacks an authorityCertIssuer field, or if some extension
    /// in `x509` was invalid.
    ///
    /// TODO(crbug.com/boringssl/381): Decoding an `X509` object will not check for
    /// invalid extensions. To detect the error case, call
    /// `X509_get_extension_flags` and check the `EXFLAG_INVALID` bit.
    pub fn X509_get0_authority_issuer(x509: *mut X509) -> *const GENERAL_NAMES;
}
unsafe extern "C" {
    /// X509_get0_authority_serial returns the authorityCertSerialNumber of `x509`'s
    /// authority key identifier, if the extension and field are present. (See
    /// RFC 5280, section 4.2.1.1.) It returns NULL if the extension is not present,
    /// if it is present but lacks an authorityCertSerialNumber field, or if some
    /// extension in `x509` was invalid.
    ///
    /// TODO(crbug.com/boringssl/381): Decoding an `X509` object will not check for
    /// invalid extensions. To detect the error case, call
    /// `X509_get_extension_flags` and check the `EXFLAG_INVALID` bit.
    pub fn X509_get0_authority_serial(x509: *mut X509) -> *const ASN1_INTEGER;
}
/// Extension lists.
///
/// The following functions manipulate lists of extensions. Most of them have
/// corresponding functions on the containing `X509`, `X509_CRL`, or
/// `X509_REVOKED`.
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct stack_st_X509_EXTENSION {
    _unused: [u8; 0],
}
unsafe extern "C" {
    /// X509_get0_extensions returns `x509`'s extension list, or NULL if `x509` omits
    /// it.
    pub fn X509_get0_extensions(x509: *const X509) -> *const stack_st_X509_EXTENSION;
}
unsafe extern "C" {
    /// X509_get_ext_count returns the number of extensions in `x`.
    pub fn X509_get_ext_count(x: *const X509) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_get_ext_by_NID behaves like `X509v3_get_ext_by_NID` but searches for
    /// extensions in `x`.
    pub fn X509_get_ext_by_NID(
        x: *const X509,
        nid: ::core::ffi::c_int,
        lastpos: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_get_ext_by_OBJ behaves like `X509v3_get_ext_by_OBJ` but searches for
    /// extensions in `x`.
    pub fn X509_get_ext_by_OBJ(
        x: *const X509,
        obj: *const ASN1_OBJECT,
        lastpos: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_get_ext_by_critical behaves like `X509v3_get_ext_by_critical` but
    /// searches for extensions in `x`.
    pub fn X509_get_ext_by_critical(
        x: *const X509,
        crit: ::core::ffi::c_int,
        lastpos: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_get_ext returns the extension in `x` at index `loc`, or NULL if `loc` is
    /// out of bounds. This function returns a non-const pointer for OpenSSL
    /// compatibility, but callers should not mutate the result.
    pub fn X509_get_ext(x: *const X509, loc: ::core::ffi::c_int) -> *mut X509_EXTENSION;
}
unsafe extern "C" {
    /// X509_get_ext_d2i behaves like `X509V3_get_d2i` but looks for the extension in
    /// `x509`'s extension list.
    ///
    /// WARNING: This function is difficult to use correctly. See the documentation
    /// for `X509V3_get_d2i` for details.
    pub fn X509_get_ext_d2i(
        x509: *const X509,
        nid: ::core::ffi::c_int,
        out_critical: *mut ::core::ffi::c_int,
        out_idx: *mut ::core::ffi::c_int,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    /// X509_get0_tbs_sigalg returns the signature algorithm in `x509`'s
    /// TBSCertificate. For the outer signature algorithm, see `X509_get0_signature`.
    ///
    /// Certificates with mismatched signature algorithms will successfully parse,
    /// but they will be rejected when verifying.
    pub fn X509_get0_tbs_sigalg(x509: *const X509) -> *const X509_ALGOR;
}
unsafe extern "C" {
    /// X509_get0_signature sets `*out_sig` and `*out_alg` to the signature and
    /// signature algorithm of `x509`, respectively. Either output pointer may be
    /// NULL to ignore the value.
    ///
    /// This function outputs the outer signature algorithm. For the one in the
    /// TBSCertificate, see `X509_get0_tbs_sigalg`. Certificates with mismatched
    /// signature algorithms will successfully parse, but they will be rejected when
    /// verifying.
    pub fn X509_get0_signature(
        out_sig: *mut *const ASN1_BIT_STRING,
        out_alg: *mut *const X509_ALGOR,
        x509: *const X509,
    );
}
unsafe extern "C" {
    /// X509_get_signature_nid returns the NID corresponding to `x509`'s signature
    /// algorithm, or `NID_undef` if the signature algorithm does not correspond to
    /// a known NID.
    pub fn X509_get_signature_nid(x509: *const X509) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// i2d_X509_tbs serializes the TBSCertificate portion of `x509`, as described in
    /// `i2d_SAMPLE`.
    ///
    /// This function preserves the original encoding of the TBSCertificate and may
    /// not reflect modifications made to `x509`. It may be used to manually verify
    /// the signature of an existing certificate. To generate certificates, use
    /// `i2d_re_X509_tbs` instead.
    pub fn i2d_X509_tbs(x509: *const X509, outp: *mut *mut u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_verify checks that `x509` has a valid signature by `pkey`. It returns
    /// one if the signature is valid and zero otherwise. Note this function only
    /// checks the signature itself and does not perform a full certificate
    /// validation.
    pub fn X509_verify(x509: *const X509, pkey: *mut EVP_PKEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_get1_email returns a newly-allocated list of NUL-terminated strings
    /// containing all email addresses in `x509`'s subject and all rfc822name names
    /// in `x509`'s subject alternative names. Email addresses which contain embedded
    /// NUL bytes are skipped. The results are returned in an arbitrary order.
    ///
    /// On error, or if there are no such email addresses, it returns NULL. When
    /// done, the caller must release the result with `X509_email_free`.
    pub fn X509_get1_email(x509: *const X509) -> *mut stack_st_OPENSSL_STRING;
}
unsafe extern "C" {
    /// X509_get1_ocsp returns a newly-allocated list of NUL-terminated strings
    /// containing all OCSP URIs in `x509`. That is, it collects all URI
    /// AccessDescriptions with an accessMethod of id-ad-ocsp in `x509`'s authority
    /// information access extension. URIs which contain embedded NUL bytes are
    /// skipped. The results are returned in an arbitrary order.
    ///
    /// On error, or if there are no such URIs, it returns NULL. When done, the
    /// caller must release the result with `X509_email_free`.
    pub fn X509_get1_ocsp(x509: *const X509) -> *mut stack_st_OPENSSL_STRING;
}
unsafe extern "C" {
    /// X509_email_free releases memory associated with `sk`, including `sk` itself.
    /// Each `OPENSSL_STRING` in `sk` must be a NUL-terminated string allocated with
    /// `OPENSSL_malloc`. If `sk` is NULL, no action is taken.
    pub fn X509_email_free(sk: *mut stack_st_OPENSSL_STRING);
}
unsafe extern "C" {
    /// X509_cmp compares `a` and `b` and returns zero if they are equal, a negative
    /// number if `b` sorts after `a` and a negative number if `a` sorts after `b`.
    /// The sort order implemented by this function is arbitrary and does not
    /// reflect properties of the certificate such as expiry. Applications should not
    /// rely on the order itself.
    ///
    /// TODO(https://crbug.com/boringssl/355): This function works by comparing a
    /// cached hash of the encoded certificate. If `a` or `b` could not be
    /// serialized, the current behavior is to compare all unencodable certificates
    /// as equal. This function should only be used with `X509` objects that were
    /// parsed from bytes and never mutated.
    pub fn X509_cmp(a: *const X509, b: *const X509) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_new returns a newly-allocated, empty `X509` object, or NULL on error.
    /// This produces an incomplete certificate which may be filled in to issue a new
    /// certificate.
    pub fn X509_new() -> *mut X509;
}
unsafe extern "C" {
    /// X509_set_version sets `x509`'s version to `version`, which should be one of
    /// the `X509V_VERSION_*` constants. It returns one on success and zero on error.
    ///
    /// If unsure, use `X509_VERSION_3`.
    pub fn X509_set_version(x509: *mut X509, version: ::core::ffi::c_long) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_set_serialNumber sets `x509`'s serial number to `serial`. It returns one
    /// on success and zero on error.
    pub fn X509_set_serialNumber(
        x509: *mut X509,
        serial: *const ASN1_INTEGER,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_set1_notBefore sets `x509`'s notBefore time to `tm`. It returns one on
    /// success and zero on error.
    pub fn X509_set1_notBefore(x509: *mut X509, tm: *const ASN1_TIME) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_set1_notAfter sets `x509`'s notAfter time to `tm`. it returns one on
    /// success and zero on error.
    pub fn X509_set1_notAfter(x509: *mut X509, tm: *const ASN1_TIME) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_getm_notBefore returns a mutable pointer to `x509`'s notBefore time.
    pub fn X509_getm_notBefore(x509: *mut X509) -> *mut ASN1_TIME;
}
unsafe extern "C" {
    /// X509_getm_notAfter returns a mutable pointer to `x509`'s notAfter time.
    pub fn X509_getm_notAfter(x: *mut X509) -> *mut ASN1_TIME;
}
unsafe extern "C" {
    /// X509_set_issuer_name sets `x509`'s issuer to a copy of `name`. It returns one
    /// on success and zero on error.
    pub fn X509_set_issuer_name(x509: *mut X509, name: *const X509_NAME) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_set_subject_name sets `x509`'s subject to a copy of `name`. It returns
    /// one on success and zero on error.
    pub fn X509_set_subject_name(x509: *mut X509, name: *const X509_NAME) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_set_pubkey sets `x509`'s public key to `pkey`. It returns one on success
    /// and zero on error. This function does not take ownership of `pkey` and
    /// internally copies and updates reference counts as needed.
    pub fn X509_set_pubkey(x509: *mut X509, pkey: *mut EVP_PKEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_delete_ext removes the extension in `x` at index `loc` and returns the
    /// removed extension, or NULL if `loc` was out of bounds. If non-NULL, the
    /// caller must release the result with `X509_EXTENSION_free`.
    pub fn X509_delete_ext(x: *mut X509, loc: ::core::ffi::c_int) -> *mut X509_EXTENSION;
}
unsafe extern "C" {
    /// X509_add_ext adds a copy of `ex` to `x`. It returns one on success and zero
    /// on failure. The caller retains ownership of `ex` and can release it
    /// independently of `x`.
    ///
    /// The new extension is inserted at index `loc`, shifting extensions to the
    /// right. If `loc` is -1 or out of bounds, the new extension is appended to the
    /// list.
    pub fn X509_add_ext(
        x: *mut X509,
        ex: *const X509_EXTENSION,
        loc: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_add1_ext_i2d behaves like `X509V3_add1_i2d` but adds the extension to
    /// `x`'s extension list.
    ///
    /// WARNING: This function may return zero or -1 on error. The caller must also
    /// ensure `value`'s type matches `nid`. See the documentation for
    /// `X509V3_add1_i2d` for details.
    pub fn X509_add1_ext_i2d(
        x: *mut X509,
        nid: ::core::ffi::c_int,
        value: *mut ::core::ffi::c_void,
        crit: ::core::ffi::c_int,
        flags: ::core::ffi::c_ulong,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_sign signs `x509` with `pkey` and replaces the signature algorithm and
    /// signature fields. It returns the length of the signature on success and zero
    /// on error. This function uses digest algorithm `md`, or `pkey`'s default if
    /// NULL. Other signing parameters use `pkey`'s defaults. To customize them, use
    /// `X509_sign_ctx`.
    pub fn X509_sign(x509: *mut X509, pkey: *mut EVP_PKEY, md: *const EVP_MD)
        -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_sign_ctx signs `x509` with `ctx` and replaces the signature algorithm
    /// and signature fields. It returns the length of the signature on success and
    /// zero on error. The signature algorithm and parameters come from `ctx`, which
    /// must have been initialized with `EVP_DigestSignInit`. The caller should
    /// configure the corresponding `EVP_PKEY_CTX` before calling this function.
    ///
    /// On success or failure, this function mutates `ctx` and resets it to the empty
    /// state. Caller should not rely on its contents after the function returns.
    pub fn X509_sign_ctx(x509: *mut X509, ctx: *mut EVP_MD_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// i2d_re_X509_tbs serializes the TBSCertificate portion of `x509`, as described
    /// in `i2d_SAMPLE`.
    ///
    /// This function re-encodes the TBSCertificate and may not reflect `x509`'s
    /// original encoding. It may be used to manually generate a signature for a new
    /// certificate. To verify certificates, use `i2d_X509_tbs` instead.
    ///
    /// Unlike `i2d_X509_tbs`, this function is not `const` and thus may not be to
    /// use concurrently with other functions that access `x509`. It mutates `x509`
    /// by dropping the cached encoding. This function is intended to be used during
    /// certificate construction, where `x509` is still single-threaded and being
    /// mutated.
    pub fn i2d_re_X509_tbs(x509: *mut X509, outp: *mut *mut u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_set1_signature_algo sets `x509`'s signature algorithm to `algo` and
    /// returns one on success or zero on error. It updates both the signature field
    /// of the TBSCertificate structure, and the signatureAlgorithm field of the
    /// Certificate.
    pub fn X509_set1_signature_algo(x509: *mut X509, algo: *const X509_ALGOR)
        -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_set1_signature_value sets `x509`'s signature to a copy of the `sig_len`
    /// bytes pointed by `sig`. It returns one on success and zero on error.
    ///
    /// Due to a specification error, X.509 certificates store signatures in ASN.1
    /// BIT STRINGs, but signature algorithms return byte strings rather than bit
    /// strings. This function creates a BIT STRING containing a whole number of
    /// bytes, with the bit order matching the DER encoding. This matches the
    /// encoding used by all X.509 signature algorithms.
    pub fn X509_set1_signature_value(
        x509: *mut X509,
        sig: *const u8,
        sig_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// i2d_X509_AUX marshals `x509` as a DER-encoded X.509 Certificate (RFC 5280),
    /// followed optionally by a separate, OpenSSL-specific structure with auxiliary
    /// properties. It behaves as described in `i2d_SAMPLE`.
    ///
    /// Unlike similarly-named functions, this function does not output a single
    /// ASN.1 element. Directly embedding the output in a larger ASN.1 structure will
    /// not behave correctly.
    pub fn i2d_X509_AUX(x509: *const X509, outp: *mut *mut u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// d2i_X509_AUX parses up to `length` bytes from `*inp` as a DER-encoded X.509
    /// Certificate (RFC 5280), followed optionally by a separate, OpenSSL-specific
    /// structure with auxiliary properties. It behaves as described in `d2i_SAMPLE`.
    ///
    /// WARNING: Passing untrusted input to this function allows an attacker to
    /// control auxiliary properties. This can allow unexpected influence over the
    /// application if the certificate is used in a context that reads auxiliary
    /// properties. This includes PKCS#12 serialization, trusted certificates in
    /// `X509_STORE`, and callers of `X509_alias_get0` or `X509_keyid_get0`.
    ///
    /// Unlike similarly-named functions, this function does not parse a single
    /// ASN.1 element. Trying to parse data directly embedded in a larger ASN.1
    /// structure will not behave correctly.
    pub fn d2i_X509_AUX(
        x509: *mut *mut X509,
        inp: *mut *const u8,
        length: ::core::ffi::c_long,
    ) -> *mut X509;
}
unsafe extern "C" {
    /// X509_alias_set1 sets `x509`'s alias to `len` bytes from `name`. If `name` is
    /// NULL, the alias is cleared instead. Aliases are not part of the certificate
    /// itself and will not be serialized by `i2d_X509`. If `x509` is serialized in
    /// a PKCS#12 structure, the friendlyName attribute (RFC 2985) will contain this
    /// alias.
    pub fn X509_alias_set1(
        x509: *mut X509,
        name: *const u8,
        len: ossl_ssize_t,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_keyid_set1 sets `x509`'s key ID to `len` bytes from `id`. If `id` is
    /// NULL, the key ID is cleared instead. Key IDs are not part of the certificate
    /// itself and will not be serialized by `i2d_X509`.
    pub fn X509_keyid_set1(x509: *mut X509, id: *const u8, len: ossl_ssize_t)
        -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_alias_get0 looks up `x509`'s alias. If found, it sets `*out_len` to the
    /// alias's length and returns a pointer to a buffer containing the contents. If
    /// not found, it outputs the empty string by returning NULL and setting
    /// `*out_len` to zero.
    ///
    /// If `x509` was parsed from a PKCS#12 structure (see
    /// `PKCS12_get_key_and_certs`), the alias will reflect the friendlyName
    /// attribute (RFC 2985).
    ///
    /// WARNING: In OpenSSL, this function did not set `*out_len` when the alias was
    /// missing. Callers that target both OpenSSL and BoringSSL should set the value
    /// to zero before calling this function.
    pub fn X509_alias_get0(x509: *const X509, out_len: *mut ::core::ffi::c_int) -> *const u8;
}
unsafe extern "C" {
    /// X509_keyid_get0 looks up `x509`'s key ID. If found, it sets `*out_len` to the
    /// key ID's length and returns a pointer to a buffer containing the contents. If
    /// not found, it outputs the empty string by returning NULL and setting
    /// `*out_len` to zero.
    ///
    /// WARNING: In OpenSSL, this function did not set `*out_len` when the alias was
    /// missing. Callers that target both OpenSSL and BoringSSL should set the value
    /// to zero before calling this function.
    pub fn X509_keyid_get0(x509: *const X509, out_len: *mut ::core::ffi::c_int) -> *const u8;
}
unsafe extern "C" {
    /// X509_add1_trust_object configures `x509` as a valid trust anchor for `obj`.
    /// It returns one on success and zero on error. `obj` should be a certificate
    /// usage OID associated with an `X509_TRUST_*` constant.
    ///
    /// See `X509_VERIFY_PARAM_set_trust` for details on how this value is evaluated.
    /// Note this only takes effect if `x509` was configured as a trusted certificate
    /// via `X509_STORE`.
    pub fn X509_add1_trust_object(x509: *mut X509, obj: *const ASN1_OBJECT) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_add1_reject_object configures `x509` as distrusted for `obj`. It returns
    /// one on success and zero on error. `obj` should be a certificate usage OID
    /// associated with an `X509_TRUST_*` constant.
    ///
    /// See `X509_VERIFY_PARAM_set_trust` for details on how this value is evaluated.
    /// Note this only takes effect if `x509` was configured as a trusted certificate
    /// via `X509_STORE`.
    pub fn X509_add1_reject_object(x509: *mut X509, obj: *const ASN1_OBJECT) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_trust_clear clears the list of OIDs for which `x509` is trusted. See
    /// also `X509_add1_trust_object`.
    pub fn X509_trust_clear(x509: *mut X509);
}
unsafe extern "C" {
    /// X509_reject_clear clears the list of OIDs for which `x509` is distrusted. See
    /// also `X509_add1_reject_object`.
    pub fn X509_reject_clear(x509: *mut X509);
}
/// Certificate revocation lists.
///
/// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
/// defined in RFC 5280. A CRL is a signed list of certificates, the
/// revokedCertificates field, which are no longer considered valid. Each entry
/// of this list is represented with an `X509_REVOKED` object, documented in the
/// "CRL entries" section below.
///
/// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
/// `X509_REVOKED`s can give incorrect results. Callers typically obtain
/// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
/// carry information such as the serialized TBSCertList and decoded extensions,
/// which will become inconsistent when mutated.
///
/// Instead, mutation functions should only be used when issuing new CRLs, as
/// described in a later section.
pub type sk_X509_CRL_free_func = ::core::option::Option<unsafe extern "C" fn(arg1: *mut X509_CRL)>;
/// Certificate revocation lists.
///
/// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
/// defined in RFC 5280. A CRL is a signed list of certificates, the
/// revokedCertificates field, which are no longer considered valid. Each entry
/// of this list is represented with an `X509_REVOKED` object, documented in the
/// "CRL entries" section below.
///
/// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
/// `X509_REVOKED`s can give incorrect results. Callers typically obtain
/// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
/// carry information such as the serialized TBSCertList and decoded extensions,
/// which will become inconsistent when mutated.
///
/// Instead, mutation functions should only be used when issuing new CRLs, as
/// described in a later section.
pub type sk_X509_CRL_copy_func =
    ::core::option::Option<unsafe extern "C" fn(arg1: *const X509_CRL) -> *mut X509_CRL>;
/// Certificate revocation lists.
///
/// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
/// defined in RFC 5280. A CRL is a signed list of certificates, the
/// revokedCertificates field, which are no longer considered valid. Each entry
/// of this list is represented with an `X509_REVOKED` object, documented in the
/// "CRL entries" section below.
///
/// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
/// `X509_REVOKED`s can give incorrect results. Callers typically obtain
/// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
/// carry information such as the serialized TBSCertList and decoded extensions,
/// which will become inconsistent when mutated.
///
/// Instead, mutation functions should only be used when issuing new CRLs, as
/// described in a later section.
pub type sk_X509_CRL_cmp_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *const *const X509_CRL,
        arg2: *const *const X509_CRL,
    ) -> ::core::ffi::c_int,
>;
/// Certificate revocation lists.
///
/// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
/// defined in RFC 5280. A CRL is a signed list of certificates, the
/// revokedCertificates field, which are no longer considered valid. Each entry
/// of this list is represented with an `X509_REVOKED` object, documented in the
/// "CRL entries" section below.
///
/// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
/// `X509_REVOKED`s can give incorrect results. Callers typically obtain
/// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
/// carry information such as the serialized TBSCertList and decoded extensions,
/// which will become inconsistent when mutated.
///
/// Instead, mutation functions should only be used when issuing new CRLs, as
/// described in a later section.
pub type sk_X509_CRL_delete_if_func = ::core::option::Option<
    unsafe extern "C" fn(arg1: *mut X509_CRL, arg2: *mut ::core::ffi::c_void) -> ::core::ffi::c_int,
>;
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_CRL_call_free_func__extern"]
    pub fn sk_X509_CRL_call_free_func(
        free_func: OPENSSL_sk_free_func,
        ptr: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_CRL_call_copy_func__extern"]
    pub fn sk_X509_CRL_call_copy_func(
        copy_func: OPENSSL_sk_copy_func,
        ptr: *const ::core::ffi::c_void,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_CRL_call_cmp_func__extern"]
    pub fn sk_X509_CRL_call_cmp_func(
        cmp_func: OPENSSL_sk_cmp_func,
        a: *const ::core::ffi::c_void,
        b: *const ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_CRL_call_delete_if_func__extern"]
    pub fn sk_X509_CRL_call_delete_if_func(
        func: OPENSSL_sk_delete_if_func,
        obj: *mut ::core::ffi::c_void,
        data: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_CRL_new__extern"]
    pub fn sk_X509_CRL_new(comp: sk_X509_CRL_cmp_func) -> *mut stack_st_X509_CRL;
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_CRL_new_null__extern"]
    pub fn sk_X509_CRL_new_null() -> *mut stack_st_X509_CRL;
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_CRL_num__extern"]
    pub fn sk_X509_CRL_num(sk: *const stack_st_X509_CRL) -> usize;
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_CRL_zero__extern"]
    pub fn sk_X509_CRL_zero(sk: *mut stack_st_X509_CRL);
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_CRL_value__extern"]
    pub fn sk_X509_CRL_value(sk: *const stack_st_X509_CRL, i: usize) -> *mut X509_CRL;
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_CRL_set__extern"]
    pub fn sk_X509_CRL_set(sk: *mut stack_st_X509_CRL, i: usize, p: *mut X509_CRL)
        -> *mut X509_CRL;
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_CRL_free__extern"]
    pub fn sk_X509_CRL_free(sk: *mut stack_st_X509_CRL);
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_CRL_pop_free__extern"]
    pub fn sk_X509_CRL_pop_free(sk: *mut stack_st_X509_CRL, free_func: sk_X509_CRL_free_func);
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_CRL_insert__extern"]
    pub fn sk_X509_CRL_insert(sk: *mut stack_st_X509_CRL, p: *mut X509_CRL, where_: usize)
        -> usize;
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_CRL_delete__extern"]
    pub fn sk_X509_CRL_delete(sk: *mut stack_st_X509_CRL, where_: usize) -> *mut X509_CRL;
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_CRL_delete_ptr__extern"]
    pub fn sk_X509_CRL_delete_ptr(sk: *mut stack_st_X509_CRL, p: *const X509_CRL) -> *mut X509_CRL;
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_CRL_delete_if__extern"]
    pub fn sk_X509_CRL_delete_if(
        sk: *mut stack_st_X509_CRL,
        func: sk_X509_CRL_delete_if_func,
        data: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_CRL_find__extern"]
    pub fn sk_X509_CRL_find(
        sk: *const stack_st_X509_CRL,
        out_index: *mut usize,
        p: *const X509_CRL,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_CRL_shift__extern"]
    pub fn sk_X509_CRL_shift(sk: *mut stack_st_X509_CRL) -> *mut X509_CRL;
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_CRL_push__extern"]
    pub fn sk_X509_CRL_push(sk: *mut stack_st_X509_CRL, p: *mut X509_CRL) -> usize;
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_CRL_pop__extern"]
    pub fn sk_X509_CRL_pop(sk: *mut stack_st_X509_CRL) -> *mut X509_CRL;
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_CRL_dup__extern"]
    pub fn sk_X509_CRL_dup(sk: *const stack_st_X509_CRL) -> *mut stack_st_X509_CRL;
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_CRL_sort__extern"]
    pub fn sk_X509_CRL_sort(sk: *mut stack_st_X509_CRL);
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_CRL_sort_and_dedup__extern"]
    pub fn sk_X509_CRL_sort_and_dedup(sk: *mut stack_st_X509_CRL, free_func: sk_X509_CRL_free_func);
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_CRL_is_sorted__extern"]
    pub fn sk_X509_CRL_is_sorted(sk: *const stack_st_X509_CRL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_CRL_set_cmp_func__extern"]
    pub fn sk_X509_CRL_set_cmp_func(
        sk: *mut stack_st_X509_CRL,
        comp: sk_X509_CRL_cmp_func,
    ) -> sk_X509_CRL_cmp_func;
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_CRL_deep_copy__extern"]
    pub fn sk_X509_CRL_deep_copy(
        sk: *const stack_st_X509_CRL,
        copy_func: sk_X509_CRL_copy_func,
        free_func: sk_X509_CRL_free_func,
    ) -> *mut stack_st_X509_CRL;
}
/// Certificate revocation lists.
///
/// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
/// defined in RFC 5280. A CRL is a signed list of certificates, the
/// revokedCertificates field, which are no longer considered valid. Each entry
/// of this list is represented with an `X509_REVOKED` object, documented in the
/// "CRL entries" section below.
///
/// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
/// `X509_REVOKED`s can give incorrect results. Callers typically obtain
/// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
/// carry information such as the serialized TBSCertList and decoded extensions,
/// which will become inconsistent when mutated.
///
/// Instead, mutation functions should only be used when issuing new CRLs, as
/// described in a later section.
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct stack_st_X509_REVOKED {
    _unused: [u8; 0],
}
/// Certificate revocation lists.
///
/// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
/// defined in RFC 5280. A CRL is a signed list of certificates, the
/// revokedCertificates field, which are no longer considered valid. Each entry
/// of this list is represented with an `X509_REVOKED` object, documented in the
/// "CRL entries" section below.
///
/// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
/// `X509_REVOKED`s can give incorrect results. Callers typically obtain
/// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
/// carry information such as the serialized TBSCertList and decoded extensions,
/// which will become inconsistent when mutated.
///
/// Instead, mutation functions should only be used when issuing new CRLs, as
/// described in a later section.
pub type sk_X509_REVOKED_free_func =
    ::core::option::Option<unsafe extern "C" fn(arg1: *mut X509_REVOKED)>;
/// Certificate revocation lists.
///
/// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
/// defined in RFC 5280. A CRL is a signed list of certificates, the
/// revokedCertificates field, which are no longer considered valid. Each entry
/// of this list is represented with an `X509_REVOKED` object, documented in the
/// "CRL entries" section below.
///
/// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
/// `X509_REVOKED`s can give incorrect results. Callers typically obtain
/// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
/// carry information such as the serialized TBSCertList and decoded extensions,
/// which will become inconsistent when mutated.
///
/// Instead, mutation functions should only be used when issuing new CRLs, as
/// described in a later section.
pub type sk_X509_REVOKED_copy_func =
    ::core::option::Option<unsafe extern "C" fn(arg1: *const X509_REVOKED) -> *mut X509_REVOKED>;
/// Certificate revocation lists.
///
/// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
/// defined in RFC 5280. A CRL is a signed list of certificates, the
/// revokedCertificates field, which are no longer considered valid. Each entry
/// of this list is represented with an `X509_REVOKED` object, documented in the
/// "CRL entries" section below.
///
/// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
/// `X509_REVOKED`s can give incorrect results. Callers typically obtain
/// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
/// carry information such as the serialized TBSCertList and decoded extensions,
/// which will become inconsistent when mutated.
///
/// Instead, mutation functions should only be used when issuing new CRLs, as
/// described in a later section.
pub type sk_X509_REVOKED_cmp_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *const *const X509_REVOKED,
        arg2: *const *const X509_REVOKED,
    ) -> ::core::ffi::c_int,
>;
/// Certificate revocation lists.
///
/// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
/// defined in RFC 5280. A CRL is a signed list of certificates, the
/// revokedCertificates field, which are no longer considered valid. Each entry
/// of this list is represented with an `X509_REVOKED` object, documented in the
/// "CRL entries" section below.
///
/// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
/// `X509_REVOKED`s can give incorrect results. Callers typically obtain
/// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
/// carry information such as the serialized TBSCertList and decoded extensions,
/// which will become inconsistent when mutated.
///
/// Instead, mutation functions should only be used when issuing new CRLs, as
/// described in a later section.
pub type sk_X509_REVOKED_delete_if_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *mut X509_REVOKED,
        arg2: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int,
>;
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_REVOKED_call_free_func__extern"]
    pub fn sk_X509_REVOKED_call_free_func(
        free_func: OPENSSL_sk_free_func,
        ptr: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_REVOKED_call_copy_func__extern"]
    pub fn sk_X509_REVOKED_call_copy_func(
        copy_func: OPENSSL_sk_copy_func,
        ptr: *const ::core::ffi::c_void,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_REVOKED_call_cmp_func__extern"]
    pub fn sk_X509_REVOKED_call_cmp_func(
        cmp_func: OPENSSL_sk_cmp_func,
        a: *const ::core::ffi::c_void,
        b: *const ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_REVOKED_call_delete_if_func__extern"]
    pub fn sk_X509_REVOKED_call_delete_if_func(
        func: OPENSSL_sk_delete_if_func,
        obj: *mut ::core::ffi::c_void,
        data: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_REVOKED_new__extern"]
    pub fn sk_X509_REVOKED_new(comp: sk_X509_REVOKED_cmp_func) -> *mut stack_st_X509_REVOKED;
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_REVOKED_new_null__extern"]
    pub fn sk_X509_REVOKED_new_null() -> *mut stack_st_X509_REVOKED;
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_REVOKED_num__extern"]
    pub fn sk_X509_REVOKED_num(sk: *const stack_st_X509_REVOKED) -> usize;
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_REVOKED_zero__extern"]
    pub fn sk_X509_REVOKED_zero(sk: *mut stack_st_X509_REVOKED);
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_REVOKED_value__extern"]
    pub fn sk_X509_REVOKED_value(sk: *const stack_st_X509_REVOKED, i: usize) -> *mut X509_REVOKED;
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_REVOKED_set__extern"]
    pub fn sk_X509_REVOKED_set(
        sk: *mut stack_st_X509_REVOKED,
        i: usize,
        p: *mut X509_REVOKED,
    ) -> *mut X509_REVOKED;
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_REVOKED_free__extern"]
    pub fn sk_X509_REVOKED_free(sk: *mut stack_st_X509_REVOKED);
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_REVOKED_pop_free__extern"]
    pub fn sk_X509_REVOKED_pop_free(
        sk: *mut stack_st_X509_REVOKED,
        free_func: sk_X509_REVOKED_free_func,
    );
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_REVOKED_insert__extern"]
    pub fn sk_X509_REVOKED_insert(
        sk: *mut stack_st_X509_REVOKED,
        p: *mut X509_REVOKED,
        where_: usize,
    ) -> usize;
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_REVOKED_delete__extern"]
    pub fn sk_X509_REVOKED_delete(
        sk: *mut stack_st_X509_REVOKED,
        where_: usize,
    ) -> *mut X509_REVOKED;
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_REVOKED_delete_ptr__extern"]
    pub fn sk_X509_REVOKED_delete_ptr(
        sk: *mut stack_st_X509_REVOKED,
        p: *const X509_REVOKED,
    ) -> *mut X509_REVOKED;
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_REVOKED_delete_if__extern"]
    pub fn sk_X509_REVOKED_delete_if(
        sk: *mut stack_st_X509_REVOKED,
        func: sk_X509_REVOKED_delete_if_func,
        data: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_REVOKED_find__extern"]
    pub fn sk_X509_REVOKED_find(
        sk: *const stack_st_X509_REVOKED,
        out_index: *mut usize,
        p: *const X509_REVOKED,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_REVOKED_shift__extern"]
    pub fn sk_X509_REVOKED_shift(sk: *mut stack_st_X509_REVOKED) -> *mut X509_REVOKED;
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_REVOKED_push__extern"]
    pub fn sk_X509_REVOKED_push(sk: *mut stack_st_X509_REVOKED, p: *mut X509_REVOKED) -> usize;
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_REVOKED_pop__extern"]
    pub fn sk_X509_REVOKED_pop(sk: *mut stack_st_X509_REVOKED) -> *mut X509_REVOKED;
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_REVOKED_dup__extern"]
    pub fn sk_X509_REVOKED_dup(sk: *const stack_st_X509_REVOKED) -> *mut stack_st_X509_REVOKED;
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_REVOKED_sort__extern"]
    pub fn sk_X509_REVOKED_sort(sk: *mut stack_st_X509_REVOKED);
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_REVOKED_sort_and_dedup__extern"]
    pub fn sk_X509_REVOKED_sort_and_dedup(
        sk: *mut stack_st_X509_REVOKED,
        free_func: sk_X509_REVOKED_free_func,
    );
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_REVOKED_is_sorted__extern"]
    pub fn sk_X509_REVOKED_is_sorted(sk: *const stack_st_X509_REVOKED) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_REVOKED_set_cmp_func__extern"]
    pub fn sk_X509_REVOKED_set_cmp_func(
        sk: *mut stack_st_X509_REVOKED,
        comp: sk_X509_REVOKED_cmp_func,
    ) -> sk_X509_REVOKED_cmp_func;
}
unsafe extern "C" {
    /// Certificate revocation lists.
    ///
    /// An `X509_CRL` object represents an X.509 certificate revocation list (CRL),
    /// defined in RFC 5280. A CRL is a signed list of certificates, the
    /// revokedCertificates field, which are no longer considered valid. Each entry
    /// of this list is represented with an `X509_REVOKED` object, documented in the
    /// "CRL entries" section below.
    ///
    /// Although an `X509_CRL` is a mutable object, mutating an `X509_CRL` or its
    /// `X509_REVOKED`s can give incorrect results. Callers typically obtain
    /// `X509_CRL`s by parsing some input with `d2i_X509_CRL`, etc. Such objects
    /// carry information such as the serialized TBSCertList and decoded extensions,
    /// which will become inconsistent when mutated.
    ///
    /// Instead, mutation functions should only be used when issuing new CRLs, as
    /// described in a later section.
    #[link_name = "sk_X509_REVOKED_deep_copy__extern"]
    pub fn sk_X509_REVOKED_deep_copy(
        sk: *const stack_st_X509_REVOKED,
        copy_func: sk_X509_REVOKED_copy_func,
        free_func: sk_X509_REVOKED_free_func,
    ) -> *mut stack_st_X509_REVOKED;
}
unsafe extern "C" {
    /// X509_CRL_up_ref adds one to the reference count of `crl` and returns one.
    pub fn X509_CRL_up_ref(crl: *mut X509_CRL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_CRL_dup returns a newly-allocated copy of `crl`, or NULL on error. This
    /// function works by serializing the structure, so if `crl` is incomplete, it
    /// may fail.
    pub fn X509_CRL_dup(crl: *const X509_CRL) -> *mut X509_CRL;
}
unsafe extern "C" {
    /// X509_CRL_free decrements `crl`'s reference count and, if zero, releases
    /// memory associated with `crl`.
    pub fn X509_CRL_free(crl: *mut X509_CRL);
}
unsafe extern "C" {
    /// d2i_X509_CRL parses up to `len` bytes from `*inp` as a DER-encoded X.509
    /// CertificateList (RFC 5280), as described in `d2i_SAMPLE`.
    pub fn d2i_X509_CRL(
        out: *mut *mut X509_CRL,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut X509_CRL;
}
unsafe extern "C" {
    /// i2d_X509_CRL marshals `crl` as a X.509 CertificateList (RFC 5280), as
    /// described in `i2d_SAMPLE`.
    pub fn i2d_X509_CRL(crl: *const X509_CRL, outp: *mut *mut u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_CRL_match compares `a` and `b` and returns zero if they are equal, a
    /// negative number if `b` sorts after `a` and a negative number if `a` sorts
    /// after `b`. The sort order implemented by this function is arbitrary and does
    /// not reflect properties of the CRL such as expiry. Applications should not
    /// rely on the order itself.
    ///
    /// TODO(https://crbug.com/boringssl/355): This function works by comparing a
    /// cached hash of the encoded CRL. This cached hash is computed when the CRL is
    /// parsed, but not when mutating or issuing CRLs. This function should only be
    /// used with `X509_CRL` objects that were parsed from bytes and never mutated.
    pub fn X509_CRL_match(a: *const X509_CRL, b: *const X509_CRL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_CRL_get_version returns the numerical value of `crl`'s version, which
    /// will be one of the `X509_CRL_VERSION_*` constants.
    pub fn X509_CRL_get_version(crl: *const X509_CRL) -> ::core::ffi::c_long;
}
unsafe extern "C" {
    /// X509_CRL_get0_lastUpdate returns `crl`'s thisUpdate time. The OpenSSL API
    /// refers to this field as lastUpdate.
    pub fn X509_CRL_get0_lastUpdate(crl: *const X509_CRL) -> *const ASN1_TIME;
}
unsafe extern "C" {
    /// X509_CRL_get0_nextUpdate returns `crl`'s nextUpdate time, or NULL if `crl`
    /// has none.
    pub fn X509_CRL_get0_nextUpdate(crl: *const X509_CRL) -> *const ASN1_TIME;
}
unsafe extern "C" {
    /// X509_CRL_get_issuer returns `crl`'s issuer name. Note this function is not
    /// const-correct for legacy reasons.
    pub fn X509_CRL_get_issuer(crl: *const X509_CRL) -> *mut X509_NAME;
}
unsafe extern "C" {
    /// X509_CRL_get0_by_serial finds the entry in `crl` whose serial number is
    /// `serial`. If found, it sets `*out` to the entry and returns one. If not
    /// found, it returns zero.
    ///
    /// On success, `*out` continues to be owned by `crl`. It is an error to free or
    /// otherwise modify `*out`.
    ///
    /// TODO(crbug.com/42290473): Ideally `crl` would be const. It is broadly
    /// thread-safe, but changes the order of entries in `crl`. It cannot be called
    /// concurrently with `i2d_X509_CRL`.
    pub fn X509_CRL_get0_by_serial(
        crl: *mut X509_CRL,
        out: *mut *mut X509_REVOKED,
        serial: *const ASN1_INTEGER,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_CRL_get0_by_cert behaves like `X509_CRL_get0_by_serial`, except it looks
    /// for the entry that matches `x509`.
    ///
    /// TODO(crbug.com/42290473): Ideally `crl` would be const. It is broadly
    /// thread-safe, but changes the order of entries in `crl`. It cannot be called
    /// concurrently with `i2d_X509_CRL`.
    pub fn X509_CRL_get0_by_cert(
        crl: *mut X509_CRL,
        out: *mut *mut X509_REVOKED,
        x509: *const X509,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_CRL_get_REVOKED returns the list of revoked certificates in `crl`, or
    /// NULL if `crl` omits it.
    ///
    /// TODO(davidben): This function was originally a macro, without clear const
    /// semantics. It should take a const input and give const output, but the latter
    /// would break existing callers. For now, we match upstream.
    pub fn X509_CRL_get_REVOKED(crl: *mut X509_CRL) -> *mut stack_st_X509_REVOKED;
}
unsafe extern "C" {
    /// X509_CRL_get0_extensions returns `crl`'s extension list, or NULL if `crl`
    /// omits it. A CRL can have extensions on individual entries, which is
    /// `X509_REVOKED_get0_extensions`, or on the overall CRL, which is this
    /// function.
    pub fn X509_CRL_get0_extensions(crl: *const X509_CRL) -> *const stack_st_X509_EXTENSION;
}
unsafe extern "C" {
    /// X509_CRL_get_ext_count returns the number of extensions in `x`.
    pub fn X509_CRL_get_ext_count(x: *const X509_CRL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_CRL_get_ext_by_NID behaves like `X509v3_get_ext_by_NID` but searches for
    /// extensions in `x`.
    pub fn X509_CRL_get_ext_by_NID(
        x: *const X509_CRL,
        nid: ::core::ffi::c_int,
        lastpos: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_CRL_get_ext_by_OBJ behaves like `X509v3_get_ext_by_OBJ` but searches for
    /// extensions in `x`.
    pub fn X509_CRL_get_ext_by_OBJ(
        x: *const X509_CRL,
        obj: *const ASN1_OBJECT,
        lastpos: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_CRL_get_ext_by_critical behaves like `X509v3_get_ext_by_critical` but
    /// searches for extensions in `x`.
    pub fn X509_CRL_get_ext_by_critical(
        x: *const X509_CRL,
        crit: ::core::ffi::c_int,
        lastpos: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_CRL_get_ext returns the extension in `x` at index `loc`, or NULL if
    /// `loc` is out of bounds. This function returns a non-const pointer for OpenSSL
    /// compatibility, but callers should not mutate the result.
    pub fn X509_CRL_get_ext(x: *const X509_CRL, loc: ::core::ffi::c_int) -> *mut X509_EXTENSION;
}
unsafe extern "C" {
    /// X509_CRL_get_ext_d2i behaves like `X509V3_get_d2i` but looks for the
    /// extension in `crl`'s extension list.
    ///
    /// WARNING: This function is difficult to use correctly. See the documentation
    /// for `X509V3_get_d2i` for details.
    pub fn X509_CRL_get_ext_d2i(
        crl: *const X509_CRL,
        nid: ::core::ffi::c_int,
        out_critical: *mut ::core::ffi::c_int,
        out_idx: *mut ::core::ffi::c_int,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    /// X509_CRL_get0_signature sets `*out_sig` and `*out_alg` to the signature and
    /// signature algorithm of `crl`, respectively. Either output pointer may be NULL
    /// to ignore the value.
    ///
    /// This function outputs the outer signature algorithm, not the one in the
    /// TBSCertList. CRLs with mismatched signature algorithms will successfully
    /// parse, but they will be rejected when verifying.
    pub fn X509_CRL_get0_signature(
        crl: *const X509_CRL,
        out_sig: *mut *const ASN1_BIT_STRING,
        out_alg: *mut *const X509_ALGOR,
    );
}
unsafe extern "C" {
    /// X509_CRL_get_signature_nid returns the NID corresponding to `crl`'s signature
    /// algorithm, or `NID_undef` if the signature algorithm does not correspond to
    /// a known NID.
    pub fn X509_CRL_get_signature_nid(crl: *const X509_CRL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// i2d_X509_CRL_tbs serializes the TBSCertList portion of `crl`, as described in
    /// `i2d_SAMPLE`.
    ///
    /// This function preserves the original encoding of the TBSCertList and may not
    /// reflect modifications made to `crl`. It may be used to manually verify the
    /// signature of an existing CRL. To generate CRLs, use `i2d_re_X509_CRL_tbs`
    /// instead.
    pub fn i2d_X509_CRL_tbs(
        crl: *const X509_CRL,
        outp: *mut *mut ::core::ffi::c_uchar,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_CRL_verify checks that `crl` has a valid signature by `pkey`. It returns
    /// one if the signature is valid and zero otherwise.
    pub fn X509_CRL_verify(crl: *const X509_CRL, pkey: *mut EVP_PKEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_CRL_new returns a newly-allocated, empty `X509_CRL` object, or NULL on
    /// error. This object may be filled in and then signed to construct a CRL.
    pub fn X509_CRL_new() -> *mut X509_CRL;
}
unsafe extern "C" {
    /// X509_CRL_set_version sets `crl`'s version to `version`, which should be one
    /// of the `X509_CRL_VERSION_*` constants. It returns one on success and zero on
    /// error.
    ///
    /// If unsure, use `X509_CRL_VERSION_2`. Note that, unlike certificates, CRL
    /// versions are only defined up to v2. Callers should not use `X509_VERSION_3`.
    pub fn X509_CRL_set_version(
        crl: *mut X509_CRL,
        version: ::core::ffi::c_long,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_CRL_set_issuer_name sets `crl`'s issuer to a copy of `name`. It returns
    /// one on success and zero on error.
    pub fn X509_CRL_set_issuer_name(
        crl: *mut X509_CRL,
        name: *const X509_NAME,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_CRL_set1_lastUpdate sets `crl`'s thisUpdate time to `tm`. It returns one
    /// on success and zero on error. The OpenSSL API refers to this field as
    /// lastUpdate.
    pub fn X509_CRL_set1_lastUpdate(crl: *mut X509_CRL, tm: *const ASN1_TIME)
        -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_CRL_set1_nextUpdate sets `crl`'s nextUpdate time to `tm`. It returns one
    /// on success and zero on error.
    pub fn X509_CRL_set1_nextUpdate(crl: *mut X509_CRL, tm: *const ASN1_TIME)
        -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_CRL_add0_revoked adds `rev` to `crl`. On success, it takes ownership of
    /// `rev` and returns one. On error, it returns zero. If this function fails, the
    /// caller retains ownership of `rev` and must release it when done.
    pub fn X509_CRL_add0_revoked(crl: *mut X509_CRL, rev: *mut X509_REVOKED) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_CRL_sort sorts the entries in `crl` by serial number. It returns one on
    /// success and zero on error.
    pub fn X509_CRL_sort(crl: *mut X509_CRL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_CRL_delete_ext removes the extension in `x` at index `loc` and returns
    /// the removed extension, or NULL if `loc` was out of bounds. If non-NULL, the
    /// caller must release the result with `X509_EXTENSION_free`.
    pub fn X509_CRL_delete_ext(x: *mut X509_CRL, loc: ::core::ffi::c_int) -> *mut X509_EXTENSION;
}
unsafe extern "C" {
    /// X509_CRL_add_ext adds a copy of `ex` to `x`. It returns one on success and
    /// zero on failure. The caller retains ownership of `ex` and can release it
    /// independently of `x`.
    ///
    /// The new extension is inserted at index `loc`, shifting extensions to the
    /// right. If `loc` is -1 or out of bounds, the new extension is appended to the
    /// list.
    pub fn X509_CRL_add_ext(
        x: *mut X509_CRL,
        ex: *const X509_EXTENSION,
        loc: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_CRL_add1_ext_i2d behaves like `X509V3_add1_i2d` but adds the extension
    /// to `x`'s extension list.
    ///
    /// WARNING: This function may return zero or -1 on error. The caller must also
    /// ensure `value`'s type matches `nid`. See the documentation for
    /// `X509V3_add1_i2d` for details.
    pub fn X509_CRL_add1_ext_i2d(
        x: *mut X509_CRL,
        nid: ::core::ffi::c_int,
        value: *mut ::core::ffi::c_void,
        crit: ::core::ffi::c_int,
        flags: ::core::ffi::c_ulong,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_CRL_sign signs `crl` with `pkey` and replaces the signature algorithm
    /// and signature fields. It returns the length of the signature on success and
    /// zero on error. This function uses digest algorithm `md`, or `pkey`'s default
    /// if NULL. Other signing parameters use `pkey`'s defaults. To customize them,
    /// use `X509_CRL_sign_ctx`.
    pub fn X509_CRL_sign(
        crl: *mut X509_CRL,
        pkey: *mut EVP_PKEY,
        md: *const EVP_MD,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_CRL_sign_ctx signs `crl` with `ctx` and replaces the signature algorithm
    /// and signature fields. It returns the length of the signature on success and
    /// zero on error. The signature algorithm and parameters come from `ctx`, which
    /// must have been initialized with `EVP_DigestSignInit`. The caller should
    /// configure the corresponding `EVP_PKEY_CTX` before calling this function.
    ///
    /// On success or failure, this function mutates `ctx` and resets it to the empty
    /// state. Caller should not rely on its contents after the function returns.
    pub fn X509_CRL_sign_ctx(crl: *mut X509_CRL, ctx: *mut EVP_MD_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// i2d_re_X509_CRL_tbs serializes the TBSCertList portion of `crl`, as described
    /// in `i2d_SAMPLE`.
    ///
    /// This function re-encodes the TBSCertList and may not reflect `crl`'s original
    /// encoding. It may be used to manually generate a signature for a new CRL. To
    /// verify CRLs, use `i2d_X509_CRL_tbs` instead.
    pub fn i2d_re_X509_CRL_tbs(
        crl: *mut X509_CRL,
        outp: *mut *mut ::core::ffi::c_uchar,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_CRL_set1_signature_algo sets `crl`'s signature algorithm to `algo` and
    /// returns one on success or zero on error. It updates both the signature field
    /// of the TBSCertList structure, and the signatureAlgorithm field of the CRL.
    pub fn X509_CRL_set1_signature_algo(
        crl: *mut X509_CRL,
        algo: *const X509_ALGOR,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_CRL_set1_signature_value sets `crl`'s signature to a copy of the
    /// `sig_len` bytes pointed by `sig`. It returns one on success and zero on
    /// error.
    ///
    /// Due to a specification error, X.509 CRLs store signatures in ASN.1 BIT
    /// STRINGs, but signature algorithms return byte strings rather than bit
    /// strings. This function creates a BIT STRING containing a whole number of
    /// bytes, with the bit order matching the DER encoding. This matches the
    /// encoding used by all X.509 signature algorithms.
    pub fn X509_CRL_set1_signature_value(
        crl: *mut X509_CRL,
        sig: *const u8,
        sig_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_REVOKED_new returns a newly-allocated, empty `X509_REVOKED` object, or
    /// NULL on allocation error.
    pub fn X509_REVOKED_new() -> *mut X509_REVOKED;
}
unsafe extern "C" {
    /// X509_REVOKED_free releases memory associated with `rev`.
    pub fn X509_REVOKED_free(rev: *mut X509_REVOKED);
}
unsafe extern "C" {
    /// d2i_X509_REVOKED parses up to `len` bytes from `*inp` as a DER-encoded X.509
    /// CRL entry, as described in `d2i_SAMPLE`.
    pub fn d2i_X509_REVOKED(
        out: *mut *mut X509_REVOKED,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut X509_REVOKED;
}
unsafe extern "C" {
    /// i2d_X509_REVOKED marshals `alg` as a DER-encoded X.509 CRL entry, as
    /// described in `i2d_SAMPLE`.
    pub fn i2d_X509_REVOKED(alg: *const X509_REVOKED, outp: *mut *mut u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_REVOKED_dup returns a newly-allocated copy of `rev`, or NULL on error.
    /// This function works by serializing the structure, so if `rev` is incomplete,
    /// it may fail.
    pub fn X509_REVOKED_dup(rev: *const X509_REVOKED) -> *mut X509_REVOKED;
}
unsafe extern "C" {
    /// X509_REVOKED_get0_serialNumber returns the serial number of the certificate
    /// revoked by `revoked`.
    pub fn X509_REVOKED_get0_serialNumber(revoked: *const X509_REVOKED) -> *const ASN1_INTEGER;
}
unsafe extern "C" {
    /// X509_REVOKED_set_serialNumber sets `revoked`'s serial number to `serial`. It
    /// returns one on success or zero on error.
    pub fn X509_REVOKED_set_serialNumber(
        revoked: *mut X509_REVOKED,
        serial: *const ASN1_INTEGER,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_REVOKED_get0_revocationDate returns the revocation time of the
    /// certificate revoked by `revoked`.
    pub fn X509_REVOKED_get0_revocationDate(revoked: *const X509_REVOKED) -> *const ASN1_TIME;
}
unsafe extern "C" {
    /// X509_REVOKED_set_revocationDate sets `revoked`'s revocation time to `tm`. It
    /// returns one on success or zero on error.
    pub fn X509_REVOKED_set_revocationDate(
        revoked: *mut X509_REVOKED,
        tm: *const ASN1_TIME,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_REVOKED_get0_extensions returns `r`'s extensions list, or NULL if `r`
    /// omits it. A CRL can have extensions on individual entries, which is this
    /// function, or on the overall CRL, which is `X509_CRL_get0_extensions`.
    pub fn X509_REVOKED_get0_extensions(r: *const X509_REVOKED) -> *const stack_st_X509_EXTENSION;
}
unsafe extern "C" {
    /// X509_REVOKED_get_ext_count returns the number of extensions in `x`.
    pub fn X509_REVOKED_get_ext_count(x: *const X509_REVOKED) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_REVOKED_get_ext_by_NID behaves like `X509v3_get_ext_by_NID` but searches
    /// for extensions in `x`.
    pub fn X509_REVOKED_get_ext_by_NID(
        x: *const X509_REVOKED,
        nid: ::core::ffi::c_int,
        lastpos: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_REVOKED_get_ext_by_OBJ behaves like `X509v3_get_ext_by_OBJ` but searches
    /// for extensions in `x`.
    pub fn X509_REVOKED_get_ext_by_OBJ(
        x: *const X509_REVOKED,
        obj: *const ASN1_OBJECT,
        lastpos: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_REVOKED_get_ext_by_critical behaves like `X509v3_get_ext_by_critical`
    /// but searches for extensions in `x`.
    pub fn X509_REVOKED_get_ext_by_critical(
        x: *const X509_REVOKED,
        crit: ::core::ffi::c_int,
        lastpos: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_REVOKED_get_ext returns the extension in `x` at index `loc`, or NULL if
    /// `loc` is out of bounds. This function returns a non-const pointer for OpenSSL
    /// compatibility, but callers should not mutate the result.
    pub fn X509_REVOKED_get_ext(
        x: *const X509_REVOKED,
        loc: ::core::ffi::c_int,
    ) -> *mut X509_EXTENSION;
}
unsafe extern "C" {
    /// X509_REVOKED_delete_ext removes the extension in `x` at index `loc` and
    /// returns the removed extension, or NULL if `loc` was out of bounds. If
    /// non-NULL, the caller must release the result with `X509_EXTENSION_free`.
    pub fn X509_REVOKED_delete_ext(
        x: *mut X509_REVOKED,
        loc: ::core::ffi::c_int,
    ) -> *mut X509_EXTENSION;
}
unsafe extern "C" {
    /// X509_REVOKED_add_ext adds a copy of `ex` to `x`. It returns one on success
    /// and zero on failure. The caller retains ownership of `ex` and can release it
    /// independently of `x`.
    ///
    /// The new extension is inserted at index `loc`, shifting extensions to the
    /// right. If `loc` is -1 or out of bounds, the new extension is appended to the
    /// list.
    pub fn X509_REVOKED_add_ext(
        x: *mut X509_REVOKED,
        ex: *const X509_EXTENSION,
        loc: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_REVOKED_get_ext_d2i behaves like `X509V3_get_d2i` but looks for the
    /// extension in `revoked`'s extension list.
    ///
    /// WARNING: This function is difficult to use correctly. See the documentation
    /// for `X509V3_get_d2i` for details.
    pub fn X509_REVOKED_get_ext_d2i(
        revoked: *const X509_REVOKED,
        nid: ::core::ffi::c_int,
        out_critical: *mut ::core::ffi::c_int,
        out_idx: *mut ::core::ffi::c_int,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    /// X509_REVOKED_add1_ext_i2d behaves like `X509V3_add1_i2d` but adds the
    /// extension to `x`'s extension list.
    ///
    /// WARNING: This function may return zero or -1 on error. The caller must also
    /// ensure `value`'s type matches `nid`. See the documentation for
    /// `X509V3_add1_i2d` for details.
    pub fn X509_REVOKED_add1_ext_i2d(
        x: *mut X509_REVOKED,
        nid: ::core::ffi::c_int,
        value: *mut ::core::ffi::c_void,
        crit: ::core::ffi::c_int,
        flags: ::core::ffi::c_ulong,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_REQ_dup returns a newly-allocated copy of `req`, or NULL on error. This
    /// function works by serializing the structure, so if `req` is incomplete, it
    /// may fail.
    pub fn X509_REQ_dup(req: *const X509_REQ) -> *mut X509_REQ;
}
unsafe extern "C" {
    /// X509_REQ_free releases memory associated with `req`.
    pub fn X509_REQ_free(req: *mut X509_REQ);
}
unsafe extern "C" {
    /// d2i_X509_REQ parses up to `len` bytes from `*inp` as a DER-encoded
    /// CertificateRequest (RFC 2986), as described in `d2i_SAMPLE`.
    pub fn d2i_X509_REQ(
        out: *mut *mut X509_REQ,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut X509_REQ;
}
unsafe extern "C" {
    /// i2d_X509_REQ marshals `req` as a CertificateRequest (RFC 2986), as described
    /// in `i2d_SAMPLE`.
    pub fn i2d_X509_REQ(req: *const X509_REQ, outp: *mut *mut u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_REQ_get_version returns the numerical value of `req`'s version. This
    /// will always be `X509_REQ_VERSION_1` for valid CSRs. For compatibility,
    /// `d2i_X509_REQ` also accepts some invalid version numbers, in which case this
    /// function may return other values.
    pub fn X509_REQ_get_version(req: *const X509_REQ) -> ::core::ffi::c_long;
}
unsafe extern "C" {
    /// X509_REQ_get_subject_name returns `req`'s subject name. Note this function is
    /// not const-correct for legacy reasons.
    pub fn X509_REQ_get_subject_name(req: *const X509_REQ) -> *mut X509_NAME;
}
unsafe extern "C" {
    /// X509_REQ_get0_pubkey returns `req`'s public key as an `EVP_PKEY`, or NULL if
    /// the public key was unsupported or could not be decoded. The `EVP_PKEY` is
    /// cached in `req`, so callers must not mutate the result.
    pub fn X509_REQ_get0_pubkey(req: *const X509_REQ) -> *mut EVP_PKEY;
}
unsafe extern "C" {
    /// X509_REQ_get_pubkey behaves like `X509_REQ_get0_pubkey` but increments the
    /// reference count on the `EVP_PKEY`. The caller must release the result with
    /// `EVP_PKEY_free` when done. The `EVP_PKEY` is cached in `req`, so callers must
    /// not mutate the result.
    pub fn X509_REQ_get_pubkey(req: *const X509_REQ) -> *mut EVP_PKEY;
}
unsafe extern "C" {
    /// X509_REQ_check_private_key returns one if `req`'s public key matches `pkey`
    /// and zero otherwise.
    pub fn X509_REQ_check_private_key(
        req: *const X509_REQ,
        pkey: *const EVP_PKEY,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_REQ_get_attr_count returns the number of attributes in `req`.
    pub fn X509_REQ_get_attr_count(req: *const X509_REQ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_REQ_get_attr returns the attribute at index `loc` in `req`, or NULL if
    /// out of bounds.
    pub fn X509_REQ_get_attr(req: *const X509_REQ, loc: ::core::ffi::c_int) -> *mut X509_ATTRIBUTE;
}
unsafe extern "C" {
    /// X509_REQ_get_attr_by_NID returns the index of the attribute in `req` of type
    /// `nid`, or a negative number if not found. If found, callers can use
    /// `X509_REQ_get_attr` to look up the attribute by index.
    ///
    /// If `lastpos` is non-negative, it begins searching at `lastpos` + 1. Callers
    /// can thus loop over all matching attributes by first passing -1 and then
    /// passing the previously-returned value until no match is returned.
    pub fn X509_REQ_get_attr_by_NID(
        req: *const X509_REQ,
        nid: ::core::ffi::c_int,
        lastpos: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_REQ_get_attr_by_OBJ behaves like `X509_REQ_get_attr_by_NID` but looks
    /// for attributes of type `obj`.
    pub fn X509_REQ_get_attr_by_OBJ(
        req: *const X509_REQ,
        obj: *const ASN1_OBJECT,
        lastpos: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_REQ_extension_nid returns one if `nid` is a supported CSR attribute type
    /// for carrying extensions and zero otherwise. The supported types are
    /// `NID_ext_req` (pkcs-9-at-extensionRequest from RFC 2985) and `NID_ms_ext_req`
    /// (a Microsoft szOID_CERT_EXTENSIONS variant).
    pub fn X509_REQ_extension_nid(nid: ::core::ffi::c_int) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_REQ_get_extensions decodes the most preferred list of requested
    /// extensions in `req` and returns a newly-allocated `STACK_OF(X509_EXTENSION)`
    /// containing the result. It returns NULL on error, or if `req` did not request
    /// extensions.
    ///
    /// CSRs do not store extensions directly. Instead there are attribute types
    /// which are defined to hold extensions. See `X509_REQ_extension_nid`. This
    /// function supports both pkcs-9-at-extensionRequest from RFC 2985 and the
    /// Microsoft szOID_CERT_EXTENSIONS variant. If both are present,
    /// pkcs-9-at-extensionRequest is preferred.
    pub fn X509_REQ_get_extensions(req: *const X509_REQ) -> *mut stack_st_X509_EXTENSION;
}
unsafe extern "C" {
    /// X509_REQ_get0_signature sets `*out_sig` and `*out_alg` to the signature and
    /// signature algorithm of `req`, respectively. Either output pointer may be NULL
    /// to ignore the value.
    pub fn X509_REQ_get0_signature(
        req: *const X509_REQ,
        out_sig: *mut *const ASN1_BIT_STRING,
        out_alg: *mut *const X509_ALGOR,
    );
}
unsafe extern "C" {
    /// X509_REQ_get_signature_nid returns the NID corresponding to `req`'s signature
    /// algorithm, or `NID_undef` if the signature algorithm does not correspond to
    /// a known NID.
    pub fn X509_REQ_get_signature_nid(req: *const X509_REQ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_REQ_verify checks that `req` has a valid signature by `pkey`. It returns
    /// one if the signature is valid and zero otherwise.
    pub fn X509_REQ_verify(req: *const X509_REQ, pkey: *mut EVP_PKEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_REQ_get1_email returns a newly-allocated list of NUL-terminated strings
    /// containing all email addresses in `req`'s subject and all rfc822name names
    /// in `req`'s subject alternative names. The subject alternative names extension
    /// is extracted from the result of `X509_REQ_get_extensions`. Email addresses
    /// which contain embedded NUL bytes are skipped. The results are returned in an
    /// arbitrary order.
    ///
    /// On error, or if there are no such email addresses, it returns NULL. When
    /// done, the caller must release the result with `X509_email_free`.
    pub fn X509_REQ_get1_email(req: *const X509_REQ) -> *mut stack_st_OPENSSL_STRING;
}
unsafe extern "C" {
    /// X509_REQ_new returns a newly-allocated, empty `X509_REQ` object, or NULL on
    /// error. This object may be filled in and then signed to construct a CSR.
    pub fn X509_REQ_new() -> *mut X509_REQ;
}
unsafe extern "C" {
    /// X509_REQ_set_version sets `req`'s version to `version`, which should be
    /// `X509_REQ_VERSION_1`. It returns one on success and zero on error.
    ///
    /// The only defined CSR version is `X509_REQ_VERSION_1`, so there is no need to
    /// call this function.
    pub fn X509_REQ_set_version(
        req: *mut X509_REQ,
        version: ::core::ffi::c_long,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_REQ_set_subject_name sets `req`'s subject to a copy of `name`. It
    /// returns one on success and zero on error.
    pub fn X509_REQ_set_subject_name(
        req: *mut X509_REQ,
        name: *mut X509_NAME,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_REQ_set_pubkey sets `req`'s public key to `pkey`. It returns one on
    /// success and zero on error. This function does not take ownership of `pkey`
    /// and internally copies and updates reference counts as needed.
    pub fn X509_REQ_set_pubkey(req: *mut X509_REQ, pkey: *mut EVP_PKEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_REQ_delete_attr removes the attribute at index `loc` in `req`. It
    /// returns the removed attribute to the caller, or NULL if `loc` was out of
    /// bounds. If non-NULL, the caller must release the result with
    /// `X509_ATTRIBUTE_free` when done. It is also safe, but not necessary, to call
    /// `X509_ATTRIBUTE_free` if the result is NULL.
    pub fn X509_REQ_delete_attr(req: *mut X509_REQ, loc: ::core::ffi::c_int)
        -> *mut X509_ATTRIBUTE;
}
unsafe extern "C" {
    /// X509_REQ_add1_attr appends a copy of `attr` to `req`'s list of attributes. It
    /// returns one on success and zero on error.
    pub fn X509_REQ_add1_attr(
        req: *mut X509_REQ,
        attr: *const X509_ATTRIBUTE,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_REQ_add1_attr_by_OBJ appends a new attribute to `req` with type `obj`.
    /// It returns one on success and zero on error. The value is determined by
    /// `X509_ATTRIBUTE_set1_data`.
    ///
    /// WARNING: The interpretation of `attrtype`, `data`, and `len` is complex and
    /// error-prone. See `X509_ATTRIBUTE_set1_data` for details.
    pub fn X509_REQ_add1_attr_by_OBJ(
        req: *mut X509_REQ,
        obj: *const ASN1_OBJECT,
        attrtype: ::core::ffi::c_int,
        data: *const ::core::ffi::c_uchar,
        len: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_REQ_add1_attr_by_NID behaves like `X509_REQ_add1_attr_by_OBJ` except the
    /// attribute type is determined by `nid`.
    pub fn X509_REQ_add1_attr_by_NID(
        req: *mut X509_REQ,
        nid: ::core::ffi::c_int,
        attrtype: ::core::ffi::c_int,
        data: *const ::core::ffi::c_uchar,
        len: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_REQ_add1_attr_by_txt behaves like `X509_REQ_add1_attr_by_OBJ` except the
    /// attribute type is determined by calling `OBJ_txt2obj` with `attrname`.
    pub fn X509_REQ_add1_attr_by_txt(
        req: *mut X509_REQ,
        attrname: *const ::core::ffi::c_char,
        attrtype: ::core::ffi::c_int,
        data: *const ::core::ffi::c_uchar,
        len: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_REQ_add_extensions_nid adds an attribute to `req` of type `nid`, to
    /// request the certificate extensions in `exts`. It returns one on success and
    /// zero on error. `nid` should be `NID_ext_req` or `NID_ms_ext_req`.
    pub fn X509_REQ_add_extensions_nid(
        req: *mut X509_REQ,
        exts: *const stack_st_X509_EXTENSION,
        nid: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_REQ_add_extensions behaves like `X509_REQ_add_extensions_nid`, using the
    /// standard `NID_ext_req` for the attribute type.
    pub fn X509_REQ_add_extensions(
        req: *mut X509_REQ,
        exts: *const stack_st_X509_EXTENSION,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_REQ_sign signs `req` with `pkey` and replaces the signature algorithm
    /// and signature fields. It returns the length of the signature on success and
    /// zero on error. This function uses digest algorithm `md`, or `pkey`'s default
    /// if NULL. Other signing parameters use `pkey`'s defaults. To customize them,
    /// use `X509_REQ_sign_ctx`.
    pub fn X509_REQ_sign(
        req: *mut X509_REQ,
        pkey: *mut EVP_PKEY,
        md: *const EVP_MD,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_REQ_sign_ctx signs `req` with `ctx` and replaces the signature algorithm
    /// and signature fields. It returns the length of the signature on success and
    /// zero on error. The signature algorithm and parameters come from `ctx`, which
    /// must have been initialized with `EVP_DigestSignInit`. The caller should
    /// configure the corresponding `EVP_PKEY_CTX` before calling this function.
    ///
    /// On success or failure, this function mutates `ctx` and resets it to the empty
    /// state. Caller should not rely on its contents after the function returns.
    pub fn X509_REQ_sign_ctx(req: *mut X509_REQ, ctx: *mut EVP_MD_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// i2d_re_X509_REQ_tbs serializes the CertificationRequestInfo (see RFC 2986)
    /// portion of `req`, as described in `i2d_SAMPLE`.
    ///
    /// This function re-encodes the CertificationRequestInfo and may not reflect
    /// `req`'s original encoding. It may be used to manually generate a signature
    /// for a new certificate request.
    pub fn i2d_re_X509_REQ_tbs(req: *mut X509_REQ, outp: *mut *mut u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_REQ_set1_signature_algo sets `req`'s signature algorithm to `algo` and
    /// returns one on success or zero on error.
    pub fn X509_REQ_set1_signature_algo(
        req: *mut X509_REQ,
        algo: *const X509_ALGOR,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_REQ_set1_signature_value sets `req`'s signature to a copy of the
    /// `sig_len` bytes pointed by `sig`. It returns one on success and zero on
    /// error.
    ///
    /// Due to a specification error, PKCS#10 certificate requests store signatures
    /// in ASN.1 BIT STRINGs, but signature algorithms return byte strings rather
    /// than bit strings. This function creates a BIT STRING containing a whole
    /// number of bytes, with the bit order matching the DER encoding. This matches
    /// the encoding used by all X.509 signature algorithms.
    pub fn X509_REQ_set1_signature_value(
        req: *mut X509_REQ,
        sig: *const u8,
        sig_len: usize,
    ) -> ::core::ffi::c_int;
}
/// Names.
///
/// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
/// a complex, hierarchical structure over a collection of attributes. Each name
/// is sequence of relative distinguished names (RDNs), decreasing in
/// specificity. For example, the first RDN may specify the country, while the
/// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
/// Having more than one attribute in an RDN is uncommon, but possible. Within an
/// RDN, attributes have the same level in specificity. Attribute types are
/// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
/// commonly a string but may be other types.
///
/// The `X509_NAME` representation flattens this two-level structure into a
/// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
/// with also maintains the index of the RDN it is part of, accessible via
/// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
///
/// X.509 names are largely vestigial. Historically, DNS names were parsed out of
/// the subject's common name attribute, but this is deprecated and has since
/// moved to the subject alternative name extension. In modern usage, X.509 names
/// are primarily opaque identifiers to link a certificate with its issuer.
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct stack_st_X509_NAME_ENTRY {
    _unused: [u8; 0],
}
/// Names.
///
/// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
/// a complex, hierarchical structure over a collection of attributes. Each name
/// is sequence of relative distinguished names (RDNs), decreasing in
/// specificity. For example, the first RDN may specify the country, while the
/// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
/// Having more than one attribute in an RDN is uncommon, but possible. Within an
/// RDN, attributes have the same level in specificity. Attribute types are
/// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
/// commonly a string but may be other types.
///
/// The `X509_NAME` representation flattens this two-level structure into a
/// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
/// with also maintains the index of the RDN it is part of, accessible via
/// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
///
/// X.509 names are largely vestigial. Historically, DNS names were parsed out of
/// the subject's common name attribute, but this is deprecated and has since
/// moved to the subject alternative name extension. In modern usage, X.509 names
/// are primarily opaque identifiers to link a certificate with its issuer.
pub type sk_X509_NAME_ENTRY_free_func =
    ::core::option::Option<unsafe extern "C" fn(arg1: *mut X509_NAME_ENTRY)>;
/// Names.
///
/// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
/// a complex, hierarchical structure over a collection of attributes. Each name
/// is sequence of relative distinguished names (RDNs), decreasing in
/// specificity. For example, the first RDN may specify the country, while the
/// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
/// Having more than one attribute in an RDN is uncommon, but possible. Within an
/// RDN, attributes have the same level in specificity. Attribute types are
/// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
/// commonly a string but may be other types.
///
/// The `X509_NAME` representation flattens this two-level structure into a
/// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
/// with also maintains the index of the RDN it is part of, accessible via
/// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
///
/// X.509 names are largely vestigial. Historically, DNS names were parsed out of
/// the subject's common name attribute, but this is deprecated and has since
/// moved to the subject alternative name extension. In modern usage, X.509 names
/// are primarily opaque identifiers to link a certificate with its issuer.
pub type sk_X509_NAME_ENTRY_copy_func = ::core::option::Option<
    unsafe extern "C" fn(arg1: *const X509_NAME_ENTRY) -> *mut X509_NAME_ENTRY,
>;
/// Names.
///
/// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
/// a complex, hierarchical structure over a collection of attributes. Each name
/// is sequence of relative distinguished names (RDNs), decreasing in
/// specificity. For example, the first RDN may specify the country, while the
/// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
/// Having more than one attribute in an RDN is uncommon, but possible. Within an
/// RDN, attributes have the same level in specificity. Attribute types are
/// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
/// commonly a string but may be other types.
///
/// The `X509_NAME` representation flattens this two-level structure into a
/// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
/// with also maintains the index of the RDN it is part of, accessible via
/// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
///
/// X.509 names are largely vestigial. Historically, DNS names were parsed out of
/// the subject's common name attribute, but this is deprecated and has since
/// moved to the subject alternative name extension. In modern usage, X.509 names
/// are primarily opaque identifiers to link a certificate with its issuer.
pub type sk_X509_NAME_ENTRY_cmp_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *const *const X509_NAME_ENTRY,
        arg2: *const *const X509_NAME_ENTRY,
    ) -> ::core::ffi::c_int,
>;
/// Names.
///
/// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
/// a complex, hierarchical structure over a collection of attributes. Each name
/// is sequence of relative distinguished names (RDNs), decreasing in
/// specificity. For example, the first RDN may specify the country, while the
/// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
/// Having more than one attribute in an RDN is uncommon, but possible. Within an
/// RDN, attributes have the same level in specificity. Attribute types are
/// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
/// commonly a string but may be other types.
///
/// The `X509_NAME` representation flattens this two-level structure into a
/// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
/// with also maintains the index of the RDN it is part of, accessible via
/// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
///
/// X.509 names are largely vestigial. Historically, DNS names were parsed out of
/// the subject's common name attribute, but this is deprecated and has since
/// moved to the subject alternative name extension. In modern usage, X.509 names
/// are primarily opaque identifiers to link a certificate with its issuer.
pub type sk_X509_NAME_ENTRY_delete_if_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *mut X509_NAME_ENTRY,
        arg2: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int,
>;
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_ENTRY_call_free_func__extern"]
    pub fn sk_X509_NAME_ENTRY_call_free_func(
        free_func: OPENSSL_sk_free_func,
        ptr: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_ENTRY_call_copy_func__extern"]
    pub fn sk_X509_NAME_ENTRY_call_copy_func(
        copy_func: OPENSSL_sk_copy_func,
        ptr: *const ::core::ffi::c_void,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_ENTRY_call_cmp_func__extern"]
    pub fn sk_X509_NAME_ENTRY_call_cmp_func(
        cmp_func: OPENSSL_sk_cmp_func,
        a: *const ::core::ffi::c_void,
        b: *const ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_ENTRY_call_delete_if_func__extern"]
    pub fn sk_X509_NAME_ENTRY_call_delete_if_func(
        func: OPENSSL_sk_delete_if_func,
        obj: *mut ::core::ffi::c_void,
        data: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_ENTRY_new__extern"]
    pub fn sk_X509_NAME_ENTRY_new(
        comp: sk_X509_NAME_ENTRY_cmp_func,
    ) -> *mut stack_st_X509_NAME_ENTRY;
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_ENTRY_new_null__extern"]
    pub fn sk_X509_NAME_ENTRY_new_null() -> *mut stack_st_X509_NAME_ENTRY;
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_ENTRY_num__extern"]
    pub fn sk_X509_NAME_ENTRY_num(sk: *const stack_st_X509_NAME_ENTRY) -> usize;
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_ENTRY_zero__extern"]
    pub fn sk_X509_NAME_ENTRY_zero(sk: *mut stack_st_X509_NAME_ENTRY);
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_ENTRY_value__extern"]
    pub fn sk_X509_NAME_ENTRY_value(
        sk: *const stack_st_X509_NAME_ENTRY,
        i: usize,
    ) -> *mut X509_NAME_ENTRY;
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_ENTRY_set__extern"]
    pub fn sk_X509_NAME_ENTRY_set(
        sk: *mut stack_st_X509_NAME_ENTRY,
        i: usize,
        p: *mut X509_NAME_ENTRY,
    ) -> *mut X509_NAME_ENTRY;
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_ENTRY_free__extern"]
    pub fn sk_X509_NAME_ENTRY_free(sk: *mut stack_st_X509_NAME_ENTRY);
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_ENTRY_pop_free__extern"]
    pub fn sk_X509_NAME_ENTRY_pop_free(
        sk: *mut stack_st_X509_NAME_ENTRY,
        free_func: sk_X509_NAME_ENTRY_free_func,
    );
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_ENTRY_insert__extern"]
    pub fn sk_X509_NAME_ENTRY_insert(
        sk: *mut stack_st_X509_NAME_ENTRY,
        p: *mut X509_NAME_ENTRY,
        where_: usize,
    ) -> usize;
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_ENTRY_delete__extern"]
    pub fn sk_X509_NAME_ENTRY_delete(
        sk: *mut stack_st_X509_NAME_ENTRY,
        where_: usize,
    ) -> *mut X509_NAME_ENTRY;
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_ENTRY_delete_ptr__extern"]
    pub fn sk_X509_NAME_ENTRY_delete_ptr(
        sk: *mut stack_st_X509_NAME_ENTRY,
        p: *const X509_NAME_ENTRY,
    ) -> *mut X509_NAME_ENTRY;
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_ENTRY_delete_if__extern"]
    pub fn sk_X509_NAME_ENTRY_delete_if(
        sk: *mut stack_st_X509_NAME_ENTRY,
        func: sk_X509_NAME_ENTRY_delete_if_func,
        data: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_ENTRY_find__extern"]
    pub fn sk_X509_NAME_ENTRY_find(
        sk: *const stack_st_X509_NAME_ENTRY,
        out_index: *mut usize,
        p: *const X509_NAME_ENTRY,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_ENTRY_shift__extern"]
    pub fn sk_X509_NAME_ENTRY_shift(sk: *mut stack_st_X509_NAME_ENTRY) -> *mut X509_NAME_ENTRY;
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_ENTRY_push__extern"]
    pub fn sk_X509_NAME_ENTRY_push(
        sk: *mut stack_st_X509_NAME_ENTRY,
        p: *mut X509_NAME_ENTRY,
    ) -> usize;
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_ENTRY_pop__extern"]
    pub fn sk_X509_NAME_ENTRY_pop(sk: *mut stack_st_X509_NAME_ENTRY) -> *mut X509_NAME_ENTRY;
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_ENTRY_dup__extern"]
    pub fn sk_X509_NAME_ENTRY_dup(
        sk: *const stack_st_X509_NAME_ENTRY,
    ) -> *mut stack_st_X509_NAME_ENTRY;
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_ENTRY_sort__extern"]
    pub fn sk_X509_NAME_ENTRY_sort(sk: *mut stack_st_X509_NAME_ENTRY);
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_ENTRY_sort_and_dedup__extern"]
    pub fn sk_X509_NAME_ENTRY_sort_and_dedup(
        sk: *mut stack_st_X509_NAME_ENTRY,
        free_func: sk_X509_NAME_ENTRY_free_func,
    );
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_ENTRY_is_sorted__extern"]
    pub fn sk_X509_NAME_ENTRY_is_sorted(sk: *const stack_st_X509_NAME_ENTRY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_ENTRY_set_cmp_func__extern"]
    pub fn sk_X509_NAME_ENTRY_set_cmp_func(
        sk: *mut stack_st_X509_NAME_ENTRY,
        comp: sk_X509_NAME_ENTRY_cmp_func,
    ) -> sk_X509_NAME_ENTRY_cmp_func;
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_ENTRY_deep_copy__extern"]
    pub fn sk_X509_NAME_ENTRY_deep_copy(
        sk: *const stack_st_X509_NAME_ENTRY,
        copy_func: sk_X509_NAME_ENTRY_copy_func,
        free_func: sk_X509_NAME_ENTRY_free_func,
    ) -> *mut stack_st_X509_NAME_ENTRY;
}
/// Names.
///
/// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
/// a complex, hierarchical structure over a collection of attributes. Each name
/// is sequence of relative distinguished names (RDNs), decreasing in
/// specificity. For example, the first RDN may specify the country, while the
/// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
/// Having more than one attribute in an RDN is uncommon, but possible. Within an
/// RDN, attributes have the same level in specificity. Attribute types are
/// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
/// commonly a string but may be other types.
///
/// The `X509_NAME` representation flattens this two-level structure into a
/// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
/// with also maintains the index of the RDN it is part of, accessible via
/// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
///
/// X.509 names are largely vestigial. Historically, DNS names were parsed out of
/// the subject's common name attribute, but this is deprecated and has since
/// moved to the subject alternative name extension. In modern usage, X.509 names
/// are primarily opaque identifiers to link a certificate with its issuer.
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct stack_st_X509_NAME {
    _unused: [u8; 0],
}
/// Names.
///
/// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
/// a complex, hierarchical structure over a collection of attributes. Each name
/// is sequence of relative distinguished names (RDNs), decreasing in
/// specificity. For example, the first RDN may specify the country, while the
/// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
/// Having more than one attribute in an RDN is uncommon, but possible. Within an
/// RDN, attributes have the same level in specificity. Attribute types are
/// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
/// commonly a string but may be other types.
///
/// The `X509_NAME` representation flattens this two-level structure into a
/// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
/// with also maintains the index of the RDN it is part of, accessible via
/// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
///
/// X.509 names are largely vestigial. Historically, DNS names were parsed out of
/// the subject's common name attribute, but this is deprecated and has since
/// moved to the subject alternative name extension. In modern usage, X.509 names
/// are primarily opaque identifiers to link a certificate with its issuer.
pub type sk_X509_NAME_free_func =
    ::core::option::Option<unsafe extern "C" fn(arg1: *mut X509_NAME)>;
/// Names.
///
/// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
/// a complex, hierarchical structure over a collection of attributes. Each name
/// is sequence of relative distinguished names (RDNs), decreasing in
/// specificity. For example, the first RDN may specify the country, while the
/// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
/// Having more than one attribute in an RDN is uncommon, but possible. Within an
/// RDN, attributes have the same level in specificity. Attribute types are
/// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
/// commonly a string but may be other types.
///
/// The `X509_NAME` representation flattens this two-level structure into a
/// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
/// with also maintains the index of the RDN it is part of, accessible via
/// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
///
/// X.509 names are largely vestigial. Historically, DNS names were parsed out of
/// the subject's common name attribute, but this is deprecated and has since
/// moved to the subject alternative name extension. In modern usage, X.509 names
/// are primarily opaque identifiers to link a certificate with its issuer.
pub type sk_X509_NAME_copy_func =
    ::core::option::Option<unsafe extern "C" fn(arg1: *const X509_NAME) -> *mut X509_NAME>;
/// Names.
///
/// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
/// a complex, hierarchical structure over a collection of attributes. Each name
/// is sequence of relative distinguished names (RDNs), decreasing in
/// specificity. For example, the first RDN may specify the country, while the
/// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
/// Having more than one attribute in an RDN is uncommon, but possible. Within an
/// RDN, attributes have the same level in specificity. Attribute types are
/// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
/// commonly a string but may be other types.
///
/// The `X509_NAME` representation flattens this two-level structure into a
/// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
/// with also maintains the index of the RDN it is part of, accessible via
/// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
///
/// X.509 names are largely vestigial. Historically, DNS names were parsed out of
/// the subject's common name attribute, but this is deprecated and has since
/// moved to the subject alternative name extension. In modern usage, X.509 names
/// are primarily opaque identifiers to link a certificate with its issuer.
pub type sk_X509_NAME_cmp_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *const *const X509_NAME,
        arg2: *const *const X509_NAME,
    ) -> ::core::ffi::c_int,
>;
/// Names.
///
/// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
/// a complex, hierarchical structure over a collection of attributes. Each name
/// is sequence of relative distinguished names (RDNs), decreasing in
/// specificity. For example, the first RDN may specify the country, while the
/// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
/// Having more than one attribute in an RDN is uncommon, but possible. Within an
/// RDN, attributes have the same level in specificity. Attribute types are
/// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
/// commonly a string but may be other types.
///
/// The `X509_NAME` representation flattens this two-level structure into a
/// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
/// with also maintains the index of the RDN it is part of, accessible via
/// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
///
/// X.509 names are largely vestigial. Historically, DNS names were parsed out of
/// the subject's common name attribute, but this is deprecated and has since
/// moved to the subject alternative name extension. In modern usage, X.509 names
/// are primarily opaque identifiers to link a certificate with its issuer.
pub type sk_X509_NAME_delete_if_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *mut X509_NAME,
        arg2: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int,
>;
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_call_free_func__extern"]
    pub fn sk_X509_NAME_call_free_func(
        free_func: OPENSSL_sk_free_func,
        ptr: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_call_copy_func__extern"]
    pub fn sk_X509_NAME_call_copy_func(
        copy_func: OPENSSL_sk_copy_func,
        ptr: *const ::core::ffi::c_void,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_call_cmp_func__extern"]
    pub fn sk_X509_NAME_call_cmp_func(
        cmp_func: OPENSSL_sk_cmp_func,
        a: *const ::core::ffi::c_void,
        b: *const ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_call_delete_if_func__extern"]
    pub fn sk_X509_NAME_call_delete_if_func(
        func: OPENSSL_sk_delete_if_func,
        obj: *mut ::core::ffi::c_void,
        data: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_new__extern"]
    pub fn sk_X509_NAME_new(comp: sk_X509_NAME_cmp_func) -> *mut stack_st_X509_NAME;
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_new_null__extern"]
    pub fn sk_X509_NAME_new_null() -> *mut stack_st_X509_NAME;
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_num__extern"]
    pub fn sk_X509_NAME_num(sk: *const stack_st_X509_NAME) -> usize;
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_zero__extern"]
    pub fn sk_X509_NAME_zero(sk: *mut stack_st_X509_NAME);
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_value__extern"]
    pub fn sk_X509_NAME_value(sk: *const stack_st_X509_NAME, i: usize) -> *mut X509_NAME;
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_set__extern"]
    pub fn sk_X509_NAME_set(
        sk: *mut stack_st_X509_NAME,
        i: usize,
        p: *mut X509_NAME,
    ) -> *mut X509_NAME;
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_free__extern"]
    pub fn sk_X509_NAME_free(sk: *mut stack_st_X509_NAME);
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_pop_free__extern"]
    pub fn sk_X509_NAME_pop_free(sk: *mut stack_st_X509_NAME, free_func: sk_X509_NAME_free_func);
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_insert__extern"]
    pub fn sk_X509_NAME_insert(
        sk: *mut stack_st_X509_NAME,
        p: *mut X509_NAME,
        where_: usize,
    ) -> usize;
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_delete__extern"]
    pub fn sk_X509_NAME_delete(sk: *mut stack_st_X509_NAME, where_: usize) -> *mut X509_NAME;
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_delete_ptr__extern"]
    pub fn sk_X509_NAME_delete_ptr(
        sk: *mut stack_st_X509_NAME,
        p: *const X509_NAME,
    ) -> *mut X509_NAME;
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_delete_if__extern"]
    pub fn sk_X509_NAME_delete_if(
        sk: *mut stack_st_X509_NAME,
        func: sk_X509_NAME_delete_if_func,
        data: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_find__extern"]
    pub fn sk_X509_NAME_find(
        sk: *const stack_st_X509_NAME,
        out_index: *mut usize,
        p: *const X509_NAME,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_shift__extern"]
    pub fn sk_X509_NAME_shift(sk: *mut stack_st_X509_NAME) -> *mut X509_NAME;
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_push__extern"]
    pub fn sk_X509_NAME_push(sk: *mut stack_st_X509_NAME, p: *mut X509_NAME) -> usize;
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_pop__extern"]
    pub fn sk_X509_NAME_pop(sk: *mut stack_st_X509_NAME) -> *mut X509_NAME;
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_dup__extern"]
    pub fn sk_X509_NAME_dup(sk: *const stack_st_X509_NAME) -> *mut stack_st_X509_NAME;
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_sort__extern"]
    pub fn sk_X509_NAME_sort(sk: *mut stack_st_X509_NAME);
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_sort_and_dedup__extern"]
    pub fn sk_X509_NAME_sort_and_dedup(
        sk: *mut stack_st_X509_NAME,
        free_func: sk_X509_NAME_free_func,
    );
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_is_sorted__extern"]
    pub fn sk_X509_NAME_is_sorted(sk: *const stack_st_X509_NAME) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_set_cmp_func__extern"]
    pub fn sk_X509_NAME_set_cmp_func(
        sk: *mut stack_st_X509_NAME,
        comp: sk_X509_NAME_cmp_func,
    ) -> sk_X509_NAME_cmp_func;
}
unsafe extern "C" {
    /// Names.
    ///
    /// An `X509_NAME` represents an X.509 Name structure (RFC 5280). X.509 names are
    /// a complex, hierarchical structure over a collection of attributes. Each name
    /// is sequence of relative distinguished names (RDNs), decreasing in
    /// specificity. For example, the first RDN may specify the country, while the
    /// next RDN may specify a locality. Each RDN is, itself, a set of attributes.
    /// Having more than one attribute in an RDN is uncommon, but possible. Within an
    /// RDN, attributes have the same level in specificity. Attribute types are
    /// OBJECT IDENTIFIERs. This determines the ASN.1 type of the value, which is
    /// commonly a string but may be other types.
    ///
    /// The `X509_NAME` representation flattens this two-level structure into a
    /// single list of attributes. Each attribute is stored in an `X509_NAME_ENTRY`,
    /// with also maintains the index of the RDN it is part of, accessible via
    /// `X509_NAME_ENTRY_set`. This can be used to recover the two-level structure.
    ///
    /// X.509 names are largely vestigial. Historically, DNS names were parsed out of
    /// the subject's common name attribute, but this is deprecated and has since
    /// moved to the subject alternative name extension. In modern usage, X.509 names
    /// are primarily opaque identifiers to link a certificate with its issuer.
    #[link_name = "sk_X509_NAME_deep_copy__extern"]
    pub fn sk_X509_NAME_deep_copy(
        sk: *const stack_st_X509_NAME,
        copy_func: sk_X509_NAME_copy_func,
        free_func: sk_X509_NAME_free_func,
    ) -> *mut stack_st_X509_NAME;
}
unsafe extern "C" {
    /// X509_NAME is an `ASN1_ITEM` whose ASN.1 type is X.509 Name (RFC 5280) and C
    /// type is `X509_NAME*`.
    pub static X509_NAME_it: ASN1_ITEM;
}
unsafe extern "C" {
    /// X509_NAME_new returns a new, empty `X509_NAME`, or NULL on error.
    pub fn X509_NAME_new() -> *mut X509_NAME;
}
unsafe extern "C" {
    /// X509_NAME_free releases memory associated with `name`.
    pub fn X509_NAME_free(name: *mut X509_NAME);
}
unsafe extern "C" {
    /// d2i_X509_NAME parses up to `len` bytes from `*inp` as a DER-encoded X.509
    /// Name (RFC 5280), as described in `d2i_SAMPLE`.
    pub fn d2i_X509_NAME(
        out: *mut *mut X509_NAME,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut X509_NAME;
}
unsafe extern "C" {
    /// i2d_X509_NAME marshals `in` as a DER-encoded X.509 Name (RFC 5280), as
    /// described in `i2d_SAMPLE`.
    pub fn i2d_X509_NAME(in_: *const X509_NAME, outp: *mut *mut u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_NAME_dup returns a newly-allocated copy of `name`, or NULL on error.
    pub fn X509_NAME_dup(name: *const X509_NAME) -> *mut X509_NAME;
}
unsafe extern "C" {
    /// X509_NAME_cmp compares `a` and `b`'s canonicalized forms. It returns zero if
    /// they are equal, one if `a` sorts after `b`, -1 if `b` sorts after `a`, and -2
    /// on error.
    ///
    /// TODO(https://crbug.com/boringssl/355): The -2 return is very inconvenient to
    /// pass to a sorting function. Can we make this infallible? In the meantime,
    /// prefer to use this function only for equality checks rather than comparisons.
    /// Although even the library itself passes this to a sorting function.
    pub fn X509_NAME_cmp(a: *const X509_NAME, b: *const X509_NAME) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_NAME_get0_der marshals `name` as a DER-encoded X.509 Name (RFC 5280). On
    /// success, it returns one and sets `*out_der` and `*out_der_len` to a buffer
    /// containing the result. Otherwise, it returns zero. `*out_der` is owned by
    /// `name` and must not be freed by the caller. It is invalidated after `name` is
    /// mutated or freed.
    pub fn X509_NAME_get0_der(
        name: *const X509_NAME,
        out_der: *mut *const u8,
        out_der_len: *mut usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_NAME_set makes a copy of `name`. On success, it frees `*xn`, sets `*xn`
    /// to the copy, and returns one. Otherwise, it returns zero.
    pub fn X509_NAME_set(xn: *mut *mut X509_NAME, name: *const X509_NAME) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_NAME_entry_count returns the number of entries in `name`.
    pub fn X509_NAME_entry_count(name: *const X509_NAME) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_NAME_get_index_by_NID returns the zero-based index of the first
    /// attribute in `name` with type `nid`, or -1 if there is none. `nid` should be
    /// one of the `NID_*` constants. If `lastpos` is non-negative, it begins
    /// searching at `lastpos+1`. To search all attributes, pass in -1, not zero.
    ///
    /// Indices from this function refer to `X509_NAME`'s flattened representation.
    pub fn X509_NAME_get_index_by_NID(
        name: *const X509_NAME,
        nid: ::core::ffi::c_int,
        lastpos: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_NAME_get_index_by_OBJ behaves like `X509_NAME_get_index_by_NID` but
    /// looks for attributes with type `obj`.
    pub fn X509_NAME_get_index_by_OBJ(
        name: *const X509_NAME,
        obj: *const ASN1_OBJECT,
        lastpos: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_NAME_get_entry returns the attribute in `name` at index `loc`, or NULL
    /// if `loc` is out of range. `loc` is interpreted using `X509_NAME`'s flattened
    /// representation. This function returns a non-const pointer for OpenSSL
    /// compatibility, but callers should not mutate the result. Doing so will break
    /// internal invariants in the library.
    pub fn X509_NAME_get_entry(
        name: *const X509_NAME,
        loc: ::core::ffi::c_int,
    ) -> *mut X509_NAME_ENTRY;
}
unsafe extern "C" {
    /// X509_NAME_delete_entry removes and returns the attribute in `name` at index
    /// `loc`, or NULL if `loc` is out of range. `loc` is interpreted using
    /// `X509_NAME`'s flattened representation. If the attribute is found, the caller
    /// is responsible for releasing the result with `X509_NAME_ENTRY_free`.
    ///
    /// This function will internally update RDN indices (see `X509_NAME_ENTRY_set`)
    /// so they continue to be consecutive.
    pub fn X509_NAME_delete_entry(
        name: *mut X509_NAME,
        loc: ::core::ffi::c_int,
    ) -> *mut X509_NAME_ENTRY;
}
unsafe extern "C" {
    /// X509_NAME_add_entry adds a copy of `entry` to `name` and returns one on
    /// success or zero on error. If `loc` is -1, the entry is appended to `name`.
    /// Otherwise, it is inserted at index `loc`. If `set` is -1, the entry is added
    /// to the previous entry's RDN. If it is 0, the entry becomes a singleton RDN.
    /// If 1, it is added to next entry's RDN.
    ///
    /// This function will internally update RDN indices (see `X509_NAME_ENTRY_set`)
    /// so they continue to be consecutive.
    pub fn X509_NAME_add_entry(
        name: *mut X509_NAME,
        entry: *const X509_NAME_ENTRY,
        loc: ::core::ffi::c_int,
        set: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_NAME_add_entry_by_OBJ adds a new entry to `name` and returns one on
    /// success or zero on error. The entry's attribute type is `obj`. The entry's
    /// attribute value is determined by `type`, `bytes`, and `len`, as in
    /// `X509_NAME_ENTRY_set_data`. The entry's position is determined by `loc` and
    /// `set` as in `X509_NAME_add_entry`.
    pub fn X509_NAME_add_entry_by_OBJ(
        name: *mut X509_NAME,
        obj: *const ASN1_OBJECT,
        type_: ::core::ffi::c_int,
        bytes: *const u8,
        len: ossl_ssize_t,
        loc: ::core::ffi::c_int,
        set: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_NAME_add_entry_by_NID behaves like `X509_NAME_add_entry_by_OBJ` but sets
    /// the entry's attribute type to `nid`, which should be one of the `NID_*`
    /// constants.
    pub fn X509_NAME_add_entry_by_NID(
        name: *mut X509_NAME,
        nid: ::core::ffi::c_int,
        type_: ::core::ffi::c_int,
        bytes: *const u8,
        len: ossl_ssize_t,
        loc: ::core::ffi::c_int,
        set: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_NAME_add_entry_by_txt behaves like `X509_NAME_add_entry_by_OBJ` but sets
    /// the entry's attribute type to `field`, which is passed to `OBJ_txt2obj`.
    pub fn X509_NAME_add_entry_by_txt(
        name: *mut X509_NAME,
        field: *const ::core::ffi::c_char,
        type_: ::core::ffi::c_int,
        bytes: *const u8,
        len: ossl_ssize_t,
        loc: ::core::ffi::c_int,
        set: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_NAME_ENTRY_new returns a new, empty `X509_NAME_ENTRY`, or NULL on error.
    pub fn X509_NAME_ENTRY_new() -> *mut X509_NAME_ENTRY;
}
unsafe extern "C" {
    /// X509_NAME_ENTRY_free releases memory associated with `entry`.
    pub fn X509_NAME_ENTRY_free(entry: *mut X509_NAME_ENTRY);
}
unsafe extern "C" {
    /// X509_NAME_ENTRY_dup returns a newly-allocated copy of `entry`, or NULL on
    /// error.
    pub fn X509_NAME_ENTRY_dup(entry: *const X509_NAME_ENTRY) -> *mut X509_NAME_ENTRY;
}
unsafe extern "C" {
    /// X509_NAME_ENTRY_get_object returns `entry`'s attribute type. This function
    /// returns a non-const pointer for OpenSSL compatibility, but callers should not
    /// mutate the result. Doing so will break internal invariants in the library.
    pub fn X509_NAME_ENTRY_get_object(entry: *const X509_NAME_ENTRY) -> *mut ASN1_OBJECT;
}
unsafe extern "C" {
    /// X509_NAME_ENTRY_set_object sets `entry`'s attribute type to `obj`. It returns
    /// one on success and zero on error.
    pub fn X509_NAME_ENTRY_set_object(
        entry: *mut X509_NAME_ENTRY,
        obj: *const ASN1_OBJECT,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_NAME_ENTRY_get_data returns `entry`'s attribute value, represented as an
    /// `ASN1_STRING`. This value may have any ASN.1 type, so callers must check the
    /// type before interpreting the contents. This function returns a non-const
    /// pointer for OpenSSL compatibility, but callers should not mutate the result.
    /// Doing so will break internal invariants in the library.
    ///
    /// See `ASN1_STRING` for how values are represented in this library. Where a
    /// specific `ASN1_STRING` representation exists, that representation is used.
    /// Otherwise, the `V_ASN1_OTHER` representation is used. Note that NULL, OBJECT
    /// IDENTIFIER, and BOOLEAN attribute values are represented as `V_ASN1_OTHER`,
    /// because their usual representation in this library is not
    /// `ASN1_STRING`-compatible.
    pub fn X509_NAME_ENTRY_get_data(entry: *const X509_NAME_ENTRY) -> *mut ASN1_STRING;
}
unsafe extern "C" {
    /// X509_NAME_ENTRY_set_data sets `entry`'s value to `len` bytes from `bytes`. It
    /// returns one on success and zero on error. If `len` is -1, `bytes` must be a
    /// NUL-terminated C string and the length is determined by `strlen`. `bytes` is
    /// converted to an ASN.1 type as follows:
    ///
    /// If `type` is a `MBSTRING_*` constant, the value is an ASN.1 string. The
    /// string is determined by decoding `bytes` in the encoding specified by `type`,
    /// and then re-encoding it in a form appropriate for `entry`'s attribute type.
    /// See `ASN1_STRING_set_by_NID` for details.
    ///
    /// Otherwise, the value is an `ASN1_STRING` with type `type` and value `bytes`.
    /// See `ASN1_STRING` for how to format ASN.1 types as an `ASN1_STRING`. If
    /// `type` is `V_ASN1_UNDEF` the previous `ASN1_STRING` type is reused.
    pub fn X509_NAME_ENTRY_set_data(
        entry: *mut X509_NAME_ENTRY,
        type_: ::core::ffi::c_int,
        bytes: *const u8,
        len: ossl_ssize_t,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_NAME_ENTRY_set returns the zero-based index of the RDN which contains
    /// `entry`. Consecutive entries with the same index are part of the same RDN.
    pub fn X509_NAME_ENTRY_set(entry: *const X509_NAME_ENTRY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_NAME_ENTRY_create_by_OBJ creates a new `X509_NAME_ENTRY` with attribute
    /// type `obj`. The attribute value is determined from `type`, `bytes`, and `len`
    /// as in `X509_NAME_ENTRY_set_data`. It returns the `X509_NAME_ENTRY` on success
    /// and NULL on error.
    ///
    /// If `out` is non-NULL and `*out` is NULL, it additionally sets `*out` to the
    /// result on success. If both `out` and `*out` are non-NULL, it updates the
    /// object at `*out` instead of allocating a new one.
    pub fn X509_NAME_ENTRY_create_by_OBJ(
        out: *mut *mut X509_NAME_ENTRY,
        obj: *const ASN1_OBJECT,
        type_: ::core::ffi::c_int,
        bytes: *const u8,
        len: ossl_ssize_t,
    ) -> *mut X509_NAME_ENTRY;
}
unsafe extern "C" {
    /// X509_NAME_ENTRY_create_by_NID behaves like `X509_NAME_ENTRY_create_by_OBJ`
    /// except the attribute type is `nid`, which should be one of the `NID_*`
    /// constants.
    pub fn X509_NAME_ENTRY_create_by_NID(
        out: *mut *mut X509_NAME_ENTRY,
        nid: ::core::ffi::c_int,
        type_: ::core::ffi::c_int,
        bytes: *const u8,
        len: ossl_ssize_t,
    ) -> *mut X509_NAME_ENTRY;
}
unsafe extern "C" {
    /// X509_NAME_ENTRY_create_by_txt behaves like `X509_NAME_ENTRY_create_by_OBJ`
    /// except the attribute type is `field`, which is passed to `OBJ_txt2obj`.
    pub fn X509_NAME_ENTRY_create_by_txt(
        out: *mut *mut X509_NAME_ENTRY,
        field: *const ::core::ffi::c_char,
        type_: ::core::ffi::c_int,
        bytes: *const u8,
        len: ossl_ssize_t,
    ) -> *mut X509_NAME_ENTRY;
}
unsafe extern "C" {
    /// X509_PUBKEY_new returns a newly-allocated, empty `X509_PUBKEY` object, or
    /// NULL on error.
    pub fn X509_PUBKEY_new() -> *mut X509_PUBKEY;
}
unsafe extern "C" {
    /// X509_PUBKEY_free releases memory associated with `key`.
    pub fn X509_PUBKEY_free(key: *mut X509_PUBKEY);
}
unsafe extern "C" {
    /// d2i_X509_PUBKEY parses up to `len` bytes from `*inp` as a DER-encoded
    /// SubjectPublicKeyInfo, as described in `d2i_SAMPLE`.
    pub fn d2i_X509_PUBKEY(
        out: *mut *mut X509_PUBKEY,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut X509_PUBKEY;
}
unsafe extern "C" {
    /// i2d_X509_PUBKEY marshals `key` as a DER-encoded SubjectPublicKeyInfo, as
    /// described in `i2d_SAMPLE`.
    pub fn i2d_X509_PUBKEY(key: *const X509_PUBKEY, outp: *mut *mut u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_PUBKEY_set serializes `pkey` into a newly-allocated `X509_PUBKEY`
    /// structure. On success, it frees `*x` if non-NULL, then sets `*x` to the new
    /// object, and returns one. Otherwise, it returns zero.
    pub fn X509_PUBKEY_set(x: *mut *mut X509_PUBKEY, pkey: *mut EVP_PKEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_PUBKEY_get0 returns `key` as an `EVP_PKEY`, or NULL if `key` either
    /// could not be parsed or is an unrecognized algorithm. The `EVP_PKEY` is cached
    /// in `key`, so callers must not mutate the result.
    pub fn X509_PUBKEY_get0(key: *const X509_PUBKEY) -> *mut EVP_PKEY;
}
unsafe extern "C" {
    /// X509_PUBKEY_get behaves like `X509_PUBKEY_get0` but increments the reference
    /// count on the `EVP_PKEY`. The caller must release the result with
    /// `EVP_PKEY_free` when done. The `EVP_PKEY` is cached in `key`, so callers must
    /// not mutate the result.
    pub fn X509_PUBKEY_get(key: *const X509_PUBKEY) -> *mut EVP_PKEY;
}
unsafe extern "C" {
    /// X509_PUBKEY_set0_param sets `pub` to a key with AlgorithmIdentifier
    /// determined by `obj`, `param_type`, and `param_value`, and an encoded
    /// public key of `key`. On success, it gives `pub` ownership of all the other
    /// parameters and returns one. Otherwise, it returns zero. `key` must have been
    /// allocated by `OPENSSL_malloc`. `obj` and, if applicable, `param_value` must
    /// not be freed after a successful call, and must have been allocated in a
    /// manner compatible with `ASN1_OBJECT_free` or `ASN1_STRING_free`.
    ///
    /// `obj`, `param_type`, and `param_value` are interpreted as in
    /// `X509_ALGOR_set0`. See `X509_ALGOR_set0` for details.
    pub fn X509_PUBKEY_set0_param(
        pub_: *mut X509_PUBKEY,
        obj: *mut ASN1_OBJECT,
        param_type: ::core::ffi::c_int,
        param_value: *mut ::core::ffi::c_void,
        key: *mut u8,
        key_len: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_PUBKEY_get0_param outputs fields of `pub` and returns one. If `out_obj`
    /// is not NULL, it sets `*out_obj` to AlgorithmIdentifier's OID. If `out_key`
    /// is not NULL, it sets `*out_key` and `*out_key_len` to the encoded public key.
    /// If `out_alg` is not NULL, it sets `*out_alg` to the AlgorithmIdentifier.
    ///
    /// All pointers outputted by this function are internal to `pub` and must not be
    /// freed by the caller. Additionally, although some outputs are non-const,
    /// callers must not mutate the resulting objects.
    ///
    /// Note: X.509 SubjectPublicKeyInfo structures store the encoded public key as a
    /// BIT STRING. `*out_key` and `*out_key_len` will silently pad the key with zero
    /// bits if `pub` did not contain a whole number of bytes. Use
    /// `X509_PUBKEY_get0_public_key` to preserve this information.
    pub fn X509_PUBKEY_get0_param(
        out_obj: *mut *mut ASN1_OBJECT,
        out_key: *mut *const u8,
        out_key_len: *mut ::core::ffi::c_int,
        out_alg: *mut *mut X509_ALGOR,
        pub_: *mut X509_PUBKEY,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_PUBKEY_get0_public_key returns `pub`'s encoded public key.
    pub fn X509_PUBKEY_get0_public_key(pub_: *const X509_PUBKEY) -> *const ASN1_BIT_STRING;
}
unsafe extern "C" {
    /// X509_EXTENSION is an `ASN1_ITEM` whose ASN.1 type is X.509 Extension (RFC
    /// 5280) and C type is `X509_EXTENSION*`.
    pub static X509_EXTENSION_it: ASN1_ITEM;
}
unsafe extern "C" {
    /// X509_EXTENSION_new returns a newly-allocated, empty `X509_EXTENSION` object
    /// or NULL on error.
    pub fn X509_EXTENSION_new() -> *mut X509_EXTENSION;
}
unsafe extern "C" {
    /// X509_EXTENSION_free releases memory associated with `ex`.
    pub fn X509_EXTENSION_free(ex: *mut X509_EXTENSION);
}
unsafe extern "C" {
    /// d2i_X509_EXTENSION parses up to `len` bytes from `*inp` as a DER-encoded
    /// X.509 Extension (RFC 5280), as described in `d2i_SAMPLE`.
    pub fn d2i_X509_EXTENSION(
        out: *mut *mut X509_EXTENSION,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut X509_EXTENSION;
}
unsafe extern "C" {
    /// i2d_X509_EXTENSION marshals `ex` as a DER-encoded X.509 Extension (RFC
    /// 5280), as described in `i2d_SAMPLE`.
    pub fn i2d_X509_EXTENSION(ex: *const X509_EXTENSION, outp: *mut *mut u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_EXTENSION_dup returns a newly-allocated copy of `ex`, or NULL on error.
    /// This function works by serializing the structure, so if `ex` is incomplete,
    /// it may fail.
    pub fn X509_EXTENSION_dup(ex: *const X509_EXTENSION) -> *mut X509_EXTENSION;
}
unsafe extern "C" {
    /// X509_EXTENSION_create_by_NID creates a new `X509_EXTENSION` with type `nid`,
    /// value `data`, and critical bit `crit`. It returns an `X509_EXTENSION` on
    /// success, and NULL on error. `nid` should be a `NID_*` constant.
    ///
    /// If `ex` and `*ex` are both non-NULL, `*ex` is used to hold the result,
    /// otherwise a new object is allocated. If `ex` is non-NULL and `*ex` is NULL,
    /// the function sets `*ex` to point to the newly allocated result, in addition
    /// to returning the result.
    pub fn X509_EXTENSION_create_by_NID(
        ex: *mut *mut X509_EXTENSION,
        nid: ::core::ffi::c_int,
        crit: ::core::ffi::c_int,
        data: *const ASN1_OCTET_STRING,
    ) -> *mut X509_EXTENSION;
}
unsafe extern "C" {
    /// X509_EXTENSION_create_by_OBJ behaves like `X509_EXTENSION_create_by_NID`, but
    /// the extension type is determined by an `ASN1_OBJECT`.
    pub fn X509_EXTENSION_create_by_OBJ(
        ex: *mut *mut X509_EXTENSION,
        obj: *const ASN1_OBJECT,
        crit: ::core::ffi::c_int,
        data: *const ASN1_OCTET_STRING,
    ) -> *mut X509_EXTENSION;
}
unsafe extern "C" {
    /// X509_EXTENSION_get_object returns `ex`'s extension type. This function
    /// returns a non-const pointer for OpenSSL compatibility, but callers should not
    /// mutate the result.
    pub fn X509_EXTENSION_get_object(ex: *const X509_EXTENSION) -> *mut ASN1_OBJECT;
}
unsafe extern "C" {
    /// X509_EXTENSION_get_data returns `ne`'s extension value. This function returns
    /// a non-const pointer for OpenSSL compatibility, but callers should not mutate
    /// the result.
    pub fn X509_EXTENSION_get_data(ne: *const X509_EXTENSION) -> *mut ASN1_OCTET_STRING;
}
unsafe extern "C" {
    /// X509_EXTENSION_get_critical returns one if `ex` is critical and zero
    /// otherwise.
    pub fn X509_EXTENSION_get_critical(ex: *const X509_EXTENSION) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_EXTENSION_set_object sets `ex`'s extension type to `obj`. It returns one
    /// on success and zero on error.
    pub fn X509_EXTENSION_set_object(
        ex: *mut X509_EXTENSION,
        obj: *const ASN1_OBJECT,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_EXTENSION_set_critical sets `ex` to critical if `crit` is non-zero and
    /// to non-critical if `crit` is zero.
    pub fn X509_EXTENSION_set_critical(
        ex: *mut X509_EXTENSION,
        crit: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_EXTENSION_set_data sets `ex`'s extension value to a copy of `data`. It
    /// returns one on success and zero on error.
    pub fn X509_EXTENSION_set_data(
        ex: *mut X509_EXTENSION,
        data: *const ASN1_OCTET_STRING,
    ) -> ::core::ffi::c_int;
}
/// Extension lists.
///
/// The following functions manipulate lists of extensions. Most of them have
/// corresponding functions on the containing `X509`, `X509_CRL`, or
/// `X509_REVOKED`.
pub type sk_X509_EXTENSION_free_func =
    ::core::option::Option<unsafe extern "C" fn(arg1: *mut X509_EXTENSION)>;
/// Extension lists.
///
/// The following functions manipulate lists of extensions. Most of them have
/// corresponding functions on the containing `X509`, `X509_CRL`, or
/// `X509_REVOKED`.
pub type sk_X509_EXTENSION_copy_func = ::core::option::Option<
    unsafe extern "C" fn(arg1: *const X509_EXTENSION) -> *mut X509_EXTENSION,
>;
/// Extension lists.
///
/// The following functions manipulate lists of extensions. Most of them have
/// corresponding functions on the containing `X509`, `X509_CRL`, or
/// `X509_REVOKED`.
pub type sk_X509_EXTENSION_cmp_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *const *const X509_EXTENSION,
        arg2: *const *const X509_EXTENSION,
    ) -> ::core::ffi::c_int,
>;
/// Extension lists.
///
/// The following functions manipulate lists of extensions. Most of them have
/// corresponding functions on the containing `X509`, `X509_CRL`, or
/// `X509_REVOKED`.
pub type sk_X509_EXTENSION_delete_if_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *mut X509_EXTENSION,
        arg2: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int,
>;
unsafe extern "C" {
    /// Extension lists.
    ///
    /// The following functions manipulate lists of extensions. Most of them have
    /// corresponding functions on the containing `X509`, `X509_CRL`, or
    /// `X509_REVOKED`.
    #[link_name = "sk_X509_EXTENSION_call_free_func__extern"]
    pub fn sk_X509_EXTENSION_call_free_func(
        free_func: OPENSSL_sk_free_func,
        ptr: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    /// Extension lists.
    ///
    /// The following functions manipulate lists of extensions. Most of them have
    /// corresponding functions on the containing `X509`, `X509_CRL`, or
    /// `X509_REVOKED`.
    #[link_name = "sk_X509_EXTENSION_call_copy_func__extern"]
    pub fn sk_X509_EXTENSION_call_copy_func(
        copy_func: OPENSSL_sk_copy_func,
        ptr: *const ::core::ffi::c_void,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    /// Extension lists.
    ///
    /// The following functions manipulate lists of extensions. Most of them have
    /// corresponding functions on the containing `X509`, `X509_CRL`, or
    /// `X509_REVOKED`.
    #[link_name = "sk_X509_EXTENSION_call_cmp_func__extern"]
    pub fn sk_X509_EXTENSION_call_cmp_func(
        cmp_func: OPENSSL_sk_cmp_func,
        a: *const ::core::ffi::c_void,
        b: *const ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Extension lists.
    ///
    /// The following functions manipulate lists of extensions. Most of them have
    /// corresponding functions on the containing `X509`, `X509_CRL`, or
    /// `X509_REVOKED`.
    #[link_name = "sk_X509_EXTENSION_call_delete_if_func__extern"]
    pub fn sk_X509_EXTENSION_call_delete_if_func(
        func: OPENSSL_sk_delete_if_func,
        obj: *mut ::core::ffi::c_void,
        data: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Extension lists.
    ///
    /// The following functions manipulate lists of extensions. Most of them have
    /// corresponding functions on the containing `X509`, `X509_CRL`, or
    /// `X509_REVOKED`.
    #[link_name = "sk_X509_EXTENSION_new__extern"]
    pub fn sk_X509_EXTENSION_new(comp: sk_X509_EXTENSION_cmp_func) -> *mut stack_st_X509_EXTENSION;
}
unsafe extern "C" {
    /// Extension lists.
    ///
    /// The following functions manipulate lists of extensions. Most of them have
    /// corresponding functions on the containing `X509`, `X509_CRL`, or
    /// `X509_REVOKED`.
    #[link_name = "sk_X509_EXTENSION_new_null__extern"]
    pub fn sk_X509_EXTENSION_new_null() -> *mut stack_st_X509_EXTENSION;
}
unsafe extern "C" {
    /// Extension lists.
    ///
    /// The following functions manipulate lists of extensions. Most of them have
    /// corresponding functions on the containing `X509`, `X509_CRL`, or
    /// `X509_REVOKED`.
    #[link_name = "sk_X509_EXTENSION_num__extern"]
    pub fn sk_X509_EXTENSION_num(sk: *const stack_st_X509_EXTENSION) -> usize;
}
unsafe extern "C" {
    /// Extension lists.
    ///
    /// The following functions manipulate lists of extensions. Most of them have
    /// corresponding functions on the containing `X509`, `X509_CRL`, or
    /// `X509_REVOKED`.
    #[link_name = "sk_X509_EXTENSION_zero__extern"]
    pub fn sk_X509_EXTENSION_zero(sk: *mut stack_st_X509_EXTENSION);
}
unsafe extern "C" {
    /// Extension lists.
    ///
    /// The following functions manipulate lists of extensions. Most of them have
    /// corresponding functions on the containing `X509`, `X509_CRL`, or
    /// `X509_REVOKED`.
    #[link_name = "sk_X509_EXTENSION_value__extern"]
    pub fn sk_X509_EXTENSION_value(
        sk: *const stack_st_X509_EXTENSION,
        i: usize,
    ) -> *mut X509_EXTENSION;
}
unsafe extern "C" {
    /// Extension lists.
    ///
    /// The following functions manipulate lists of extensions. Most of them have
    /// corresponding functions on the containing `X509`, `X509_CRL`, or
    /// `X509_REVOKED`.
    #[link_name = "sk_X509_EXTENSION_set__extern"]
    pub fn sk_X509_EXTENSION_set(
        sk: *mut stack_st_X509_EXTENSION,
        i: usize,
        p: *mut X509_EXTENSION,
    ) -> *mut X509_EXTENSION;
}
unsafe extern "C" {
    /// Extension lists.
    ///
    /// The following functions manipulate lists of extensions. Most of them have
    /// corresponding functions on the containing `X509`, `X509_CRL`, or
    /// `X509_REVOKED`.
    #[link_name = "sk_X509_EXTENSION_free__extern"]
    pub fn sk_X509_EXTENSION_free(sk: *mut stack_st_X509_EXTENSION);
}
unsafe extern "C" {
    /// Extension lists.
    ///
    /// The following functions manipulate lists of extensions. Most of them have
    /// corresponding functions on the containing `X509`, `X509_CRL`, or
    /// `X509_REVOKED`.
    #[link_name = "sk_X509_EXTENSION_pop_free__extern"]
    pub fn sk_X509_EXTENSION_pop_free(
        sk: *mut stack_st_X509_EXTENSION,
        free_func: sk_X509_EXTENSION_free_func,
    );
}
unsafe extern "C" {
    /// Extension lists.
    ///
    /// The following functions manipulate lists of extensions. Most of them have
    /// corresponding functions on the containing `X509`, `X509_CRL`, or
    /// `X509_REVOKED`.
    #[link_name = "sk_X509_EXTENSION_insert__extern"]
    pub fn sk_X509_EXTENSION_insert(
        sk: *mut stack_st_X509_EXTENSION,
        p: *mut X509_EXTENSION,
        where_: usize,
    ) -> usize;
}
unsafe extern "C" {
    /// Extension lists.
    ///
    /// The following functions manipulate lists of extensions. Most of them have
    /// corresponding functions on the containing `X509`, `X509_CRL`, or
    /// `X509_REVOKED`.
    #[link_name = "sk_X509_EXTENSION_delete__extern"]
    pub fn sk_X509_EXTENSION_delete(
        sk: *mut stack_st_X509_EXTENSION,
        where_: usize,
    ) -> *mut X509_EXTENSION;
}
unsafe extern "C" {
    /// Extension lists.
    ///
    /// The following functions manipulate lists of extensions. Most of them have
    /// corresponding functions on the containing `X509`, `X509_CRL`, or
    /// `X509_REVOKED`.
    #[link_name = "sk_X509_EXTENSION_delete_ptr__extern"]
    pub fn sk_X509_EXTENSION_delete_ptr(
        sk: *mut stack_st_X509_EXTENSION,
        p: *const X509_EXTENSION,
    ) -> *mut X509_EXTENSION;
}
unsafe extern "C" {
    /// Extension lists.
    ///
    /// The following functions manipulate lists of extensions. Most of them have
    /// corresponding functions on the containing `X509`, `X509_CRL`, or
    /// `X509_REVOKED`.
    #[link_name = "sk_X509_EXTENSION_delete_if__extern"]
    pub fn sk_X509_EXTENSION_delete_if(
        sk: *mut stack_st_X509_EXTENSION,
        func: sk_X509_EXTENSION_delete_if_func,
        data: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    /// Extension lists.
    ///
    /// The following functions manipulate lists of extensions. Most of them have
    /// corresponding functions on the containing `X509`, `X509_CRL`, or
    /// `X509_REVOKED`.
    #[link_name = "sk_X509_EXTENSION_find__extern"]
    pub fn sk_X509_EXTENSION_find(
        sk: *const stack_st_X509_EXTENSION,
        out_index: *mut usize,
        p: *const X509_EXTENSION,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Extension lists.
    ///
    /// The following functions manipulate lists of extensions. Most of them have
    /// corresponding functions on the containing `X509`, `X509_CRL`, or
    /// `X509_REVOKED`.
    #[link_name = "sk_X509_EXTENSION_shift__extern"]
    pub fn sk_X509_EXTENSION_shift(sk: *mut stack_st_X509_EXTENSION) -> *mut X509_EXTENSION;
}
unsafe extern "C" {
    /// Extension lists.
    ///
    /// The following functions manipulate lists of extensions. Most of them have
    /// corresponding functions on the containing `X509`, `X509_CRL`, or
    /// `X509_REVOKED`.
    #[link_name = "sk_X509_EXTENSION_push__extern"]
    pub fn sk_X509_EXTENSION_push(
        sk: *mut stack_st_X509_EXTENSION,
        p: *mut X509_EXTENSION,
    ) -> usize;
}
unsafe extern "C" {
    /// Extension lists.
    ///
    /// The following functions manipulate lists of extensions. Most of them have
    /// corresponding functions on the containing `X509`, `X509_CRL`, or
    /// `X509_REVOKED`.
    #[link_name = "sk_X509_EXTENSION_pop__extern"]
    pub fn sk_X509_EXTENSION_pop(sk: *mut stack_st_X509_EXTENSION) -> *mut X509_EXTENSION;
}
unsafe extern "C" {
    /// Extension lists.
    ///
    /// The following functions manipulate lists of extensions. Most of them have
    /// corresponding functions on the containing `X509`, `X509_CRL`, or
    /// `X509_REVOKED`.
    #[link_name = "sk_X509_EXTENSION_dup__extern"]
    pub fn sk_X509_EXTENSION_dup(
        sk: *const stack_st_X509_EXTENSION,
    ) -> *mut stack_st_X509_EXTENSION;
}
unsafe extern "C" {
    /// Extension lists.
    ///
    /// The following functions manipulate lists of extensions. Most of them have
    /// corresponding functions on the containing `X509`, `X509_CRL`, or
    /// `X509_REVOKED`.
    #[link_name = "sk_X509_EXTENSION_sort__extern"]
    pub fn sk_X509_EXTENSION_sort(sk: *mut stack_st_X509_EXTENSION);
}
unsafe extern "C" {
    /// Extension lists.
    ///
    /// The following functions manipulate lists of extensions. Most of them have
    /// corresponding functions on the containing `X509`, `X509_CRL`, or
    /// `X509_REVOKED`.
    #[link_name = "sk_X509_EXTENSION_sort_and_dedup__extern"]
    pub fn sk_X509_EXTENSION_sort_and_dedup(
        sk: *mut stack_st_X509_EXTENSION,
        free_func: sk_X509_EXTENSION_free_func,
    );
}
unsafe extern "C" {
    /// Extension lists.
    ///
    /// The following functions manipulate lists of extensions. Most of them have
    /// corresponding functions on the containing `X509`, `X509_CRL`, or
    /// `X509_REVOKED`.
    #[link_name = "sk_X509_EXTENSION_is_sorted__extern"]
    pub fn sk_X509_EXTENSION_is_sorted(sk: *const stack_st_X509_EXTENSION) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Extension lists.
    ///
    /// The following functions manipulate lists of extensions. Most of them have
    /// corresponding functions on the containing `X509`, `X509_CRL`, or
    /// `X509_REVOKED`.
    #[link_name = "sk_X509_EXTENSION_set_cmp_func__extern"]
    pub fn sk_X509_EXTENSION_set_cmp_func(
        sk: *mut stack_st_X509_EXTENSION,
        comp: sk_X509_EXTENSION_cmp_func,
    ) -> sk_X509_EXTENSION_cmp_func;
}
unsafe extern "C" {
    /// Extension lists.
    ///
    /// The following functions manipulate lists of extensions. Most of them have
    /// corresponding functions on the containing `X509`, `X509_CRL`, or
    /// `X509_REVOKED`.
    #[link_name = "sk_X509_EXTENSION_deep_copy__extern"]
    pub fn sk_X509_EXTENSION_deep_copy(
        sk: *const stack_st_X509_EXTENSION,
        copy_func: sk_X509_EXTENSION_copy_func,
        free_func: sk_X509_EXTENSION_free_func,
    ) -> *mut stack_st_X509_EXTENSION;
}
/// Extension lists.
///
/// The following functions manipulate lists of extensions. Most of them have
/// corresponding functions on the containing `X509`, `X509_CRL`, or
/// `X509_REVOKED`.
pub type X509_EXTENSIONS = stack_st_X509_EXTENSION;
unsafe extern "C" {
    /// d2i_X509_EXTENSIONS parses up to `len` bytes from `*inp` as a DER-encoded
    /// SEQUENCE OF Extension (RFC 5280), as described in `d2i_SAMPLE`.
    pub fn d2i_X509_EXTENSIONS(
        out: *mut *mut X509_EXTENSIONS,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut X509_EXTENSIONS;
}
unsafe extern "C" {
    /// i2d_X509_EXTENSIONS marshals `alg` as a DER-encoded SEQUENCE OF Extension
    /// (RFC 5280), as described in `i2d_SAMPLE`.
    pub fn i2d_X509_EXTENSIONS(
        alg: *const X509_EXTENSIONS,
        outp: *mut *mut u8,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509v3_get_ext_count returns the number of extensions in `x`.
    pub fn X509v3_get_ext_count(x: *const stack_st_X509_EXTENSION) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509v3_get_ext_by_NID returns the index of the first extension in `x` with
    /// type `nid`, or a negative number if not found. If found, callers can use
    /// `X509v3_get_ext` to look up the extension by index.
    ///
    /// If `lastpos` is non-negative, it begins searching at `lastpos` + 1. Callers
    /// can thus loop over all matching extensions by first passing -1 and then
    /// passing the previously-returned value until no match is returned.
    pub fn X509v3_get_ext_by_NID(
        x: *const stack_st_X509_EXTENSION,
        nid: ::core::ffi::c_int,
        lastpos: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509v3_get_ext_by_OBJ behaves like `X509v3_get_ext_by_NID` but looks for
    /// extensions matching `obj`.
    pub fn X509v3_get_ext_by_OBJ(
        x: *const stack_st_X509_EXTENSION,
        obj: *const ASN1_OBJECT,
        lastpos: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509v3_get_ext_by_critical returns the index of the first extension in `x`
    /// whose critical bit matches `crit`, or a negative number if no such extension
    /// was found.
    ///
    /// If `lastpos` is non-negative, it begins searching at `lastpos` + 1. Callers
    /// can thus loop over all matching extensions by first passing -1 and then
    /// passing the previously-returned value until no match is returned.
    pub fn X509v3_get_ext_by_critical(
        x: *const stack_st_X509_EXTENSION,
        crit: ::core::ffi::c_int,
        lastpos: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509v3_get_ext returns the extension in `x` at index `loc`, or NULL if `loc`
    /// is out of bounds. This function returns a non-const pointer for OpenSSL
    /// compatibility, but callers should not mutate the result.
    pub fn X509v3_get_ext(
        x: *const stack_st_X509_EXTENSION,
        loc: ::core::ffi::c_int,
    ) -> *mut X509_EXTENSION;
}
unsafe extern "C" {
    /// X509v3_delete_ext removes the extension in `x` at index `loc` and returns the
    /// removed extension, or NULL if `loc` was out of bounds. If an extension was
    /// returned, the caller must release it with `X509_EXTENSION_free`.
    pub fn X509v3_delete_ext(
        x: *mut stack_st_X509_EXTENSION,
        loc: ::core::ffi::c_int,
    ) -> *mut X509_EXTENSION;
}
unsafe extern "C" {
    /// X509v3_add_ext adds a copy of `ex` to the extension list in `*x`. If `*x` is
    /// NULL, it allocates a new `STACK_OF(X509_EXTENSION)` to hold the copy and sets
    /// `*x` to the new list. It returns `*x` on success and NULL on error. The
    /// caller retains ownership of `ex` and can release it independently of `*x`.
    ///
    /// The new extension is inserted at index `loc`, shifting extensions to the
    /// right. If `loc` is -1 or out of bounds, the new extension is appended to the
    /// list.
    pub fn X509v3_add_ext(
        x: *mut *mut stack_st_X509_EXTENSION,
        ex: *const X509_EXTENSION,
        loc: ::core::ffi::c_int,
    ) -> *mut stack_st_X509_EXTENSION;
}
unsafe extern "C" {
    /// X509V3_EXT_d2i decodes `ext` and returns a pointer to a newly-allocated
    /// structure, with type dependent on the type of the extension. It returns NULL
    /// if `ext` is an unsupported extension or if there was a syntax error in the
    /// extension. The caller should cast the return value to the expected type and
    /// free the structure when done.
    ///
    /// WARNING: Casting the return value to the wrong type is a potentially
    /// exploitable memory error, so callers must not use this function before
    /// checking `ext` is of a known type. See the list at the top of this section
    /// for the correct types.
    pub fn X509V3_EXT_d2i(ext: *const X509_EXTENSION) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    /// X509V3_get_d2i finds and decodes the extension in `extensions` of type `nid`.
    /// If found, it decodes it and returns a newly-allocated structure, with type
    /// dependent on `nid`. If the extension is not found or on error, it returns
    /// NULL. The caller may distinguish these cases using the `out_critical` value.
    ///
    /// If `out_critical` is not NULL, this function sets `*out_critical` to one if
    /// the extension is found and critical, zero if it is found and not critical, -1
    /// if it is not found, and -2 if there is an invalid duplicate extension. Note
    /// this function may set `*out_critical` to one or zero and still return NULL if
    /// the extension is found but has a syntax error.
    ///
    /// If `out_idx` is not NULL, this function looks for the first occurrence of the
    /// extension after `*out_idx`. It then sets `*out_idx` to the index of the
    /// extension, or -1 if not found. If `out_idx` is non-NULL, duplicate extensions
    /// are not treated as an error. Callers, however, should not rely on this
    /// behavior as it may be removed in the future. Duplicate extensions are
    /// forbidden in RFC 5280.
    ///
    /// WARNING: This function is difficult to use correctly. Callers should pass a
    /// non-NULL `out_critical` and check both the return value and `*out_critical`
    /// to handle errors. If the return value is NULL and `*out_critical` is not -1,
    /// there was an error. Otherwise, the function succeeded and but may return NULL
    /// for a missing extension. Callers should pass NULL to `out_idx` so that
    /// duplicate extensions are handled correctly.
    ///
    /// Additionally, casting the return value to the wrong type is a potentially
    /// exploitable memory error, so callers must ensure the cast and `nid` match.
    /// See the list at the top of this section for the correct types.
    pub fn X509V3_get_d2i(
        extensions: *const stack_st_X509_EXTENSION,
        nid: ::core::ffi::c_int,
        out_critical: *mut ::core::ffi::c_int,
        out_idx: *mut ::core::ffi::c_int,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    /// X509V3_EXT_free casts `ext_data` into the type that corresponds to `nid` and
    /// releases memory associated with it. It returns one on success and zero if
    /// `nid` is not a known extension.
    ///
    /// WARNING: Casting `ext_data` to the wrong type is a potentially exploitable
    /// memory error, so callers must ensure `ext_data`'s type matches `nid`. See the
    /// list at the top of this section for the correct types.
    ///
    /// TODO(davidben): OpenSSL upstream no longer exposes this function. Remove it?
    pub fn X509V3_EXT_free(
        nid: ::core::ffi::c_int,
        ext_data: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509V3_EXT_i2d casts `ext_struc` into the type that corresponds to
    /// `ext_nid`, serializes it, and returns a newly-allocated `X509_EXTENSION`
    /// object containing the serialization, or NULL on error. The `X509_EXTENSION`
    /// has OID `ext_nid` and is critical if `crit` is one.
    ///
    /// WARNING: Casting `ext_struc` to the wrong type is a potentially exploitable
    /// memory error, so callers must ensure `ext_struct`'s type matches `ext_nid`.
    /// See the list at the top of this section for the correct types.
    pub fn X509V3_EXT_i2d(
        ext_nid: ::core::ffi::c_int,
        crit: ::core::ffi::c_int,
        ext_struc: *mut ::core::ffi::c_void,
    ) -> *mut X509_EXTENSION;
}
unsafe extern "C" {
    /// X509V3_add1_i2d casts `value` to the type that corresponds to `nid`,
    /// serializes it, and appends it to the extension list in `*x`. If `*x` is NULL,
    /// it will set `*x` to a newly-allocated `STACK_OF(X509_EXTENSION)` as needed.
    /// The `crit` parameter determines whether the new extension is critical.
    /// `flags` may be some combination of the `X509V3_ADD_*` constants to control
    /// the function's behavior on duplicate extension.
    ///
    /// This function returns one on success, zero if the operation failed due to a
    /// missing or duplicate extension, and -1 on other errors.
    ///
    /// WARNING: Casting `value` to the wrong type is a potentially exploitable
    /// memory error, so callers must ensure `value`'s type matches `nid`. See the
    /// list at the top of this section for the correct types.
    pub fn X509V3_add1_i2d(
        x: *mut *mut stack_st_X509_EXTENSION,
        nid: ::core::ffi::c_int,
        value: *mut ::core::ffi::c_void,
        crit: ::core::ffi::c_int,
        flags: ::core::ffi::c_ulong,
    ) -> ::core::ffi::c_int;
}
/// A BASIC_CONSTRAINTS_st, aka `BASIC_CONSTRAINTS` represents an
/// BasicConstraints structure (RFC 5280).
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct BASIC_CONSTRAINTS_st {
    pub ca: ASN1_BOOLEAN,
    pub pathlen: *mut ASN1_INTEGER,
}
unsafe extern "C" {
    /// BASIC_CONSTRAINTS is an `ASN1_ITEM` whose ASN.1 type is BasicConstraints (RFC
    /// 5280) and C type is `BASIC_CONSTRAINTS*`.
    pub static BASIC_CONSTRAINTS_it: ASN1_ITEM;
}
unsafe extern "C" {
    /// BASIC_CONSTRAINTS_new returns a newly-allocated, empty `BASIC_CONSTRAINTS`
    /// object, or NULL on error.
    pub fn BASIC_CONSTRAINTS_new() -> *mut BASIC_CONSTRAINTS;
}
unsafe extern "C" {
    /// BASIC_CONSTRAINTS_free releases memory associated with `bcons`.
    pub fn BASIC_CONSTRAINTS_free(bcons: *mut BASIC_CONSTRAINTS);
}
unsafe extern "C" {
    /// d2i_BASIC_CONSTRAINTS parses up to `len` bytes from `*inp` as a DER-encoded
    /// BasicConstraints (RFC 5280), as described in `d2i_SAMPLE`.
    pub fn d2i_BASIC_CONSTRAINTS(
        out: *mut *mut BASIC_CONSTRAINTS,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut BASIC_CONSTRAINTS;
}
unsafe extern "C" {
    /// i2d_BASIC_CONSTRAINTS marshals `bcons` as a DER-encoded BasicConstraints (RFC
    /// 5280), as described in `i2d_SAMPLE`.
    pub fn i2d_BASIC_CONSTRAINTS(
        bcons: *const BASIC_CONSTRAINTS,
        outp: *mut *mut u8,
    ) -> ::core::ffi::c_int;
}
/// Extended key usage.
///
/// The extended key usage extension (RFC 5280, section 4.2.1.12) indicates the
/// purposes of the certificate's public key. Such constraints are important to
/// avoid cross-protocol attacks.
pub type EXTENDED_KEY_USAGE = stack_st_ASN1_OBJECT;
unsafe extern "C" {
    /// EXTENDED_KEY_USAGE is an `ASN1_ITEM` whose ASN.1 type is ExtKeyUsageSyntax
    /// (RFC 5280) and C type is `STACK_OF(ASN1_OBJECT)*`, or `EXTENDED_KEY_USAGE*`.
    pub static EXTENDED_KEY_USAGE_it: ASN1_ITEM;
}
unsafe extern "C" {
    /// EXTENDED_KEY_USAGE_new returns a newly-allocated, empty `EXTENDED_KEY_USAGE`
    /// object, or NULL on error.
    pub fn EXTENDED_KEY_USAGE_new() -> *mut EXTENDED_KEY_USAGE;
}
unsafe extern "C" {
    /// EXTENDED_KEY_USAGE_free releases memory associated with `eku`.
    pub fn EXTENDED_KEY_USAGE_free(eku: *mut EXTENDED_KEY_USAGE);
}
unsafe extern "C" {
    /// d2i_EXTENDED_KEY_USAGE parses up to `len` bytes from `*inp` as a DER-encoded
    /// ExtKeyUsageSyntax (RFC 5280), as described in `d2i_SAMPLE`.
    pub fn d2i_EXTENDED_KEY_USAGE(
        out: *mut *mut EXTENDED_KEY_USAGE,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut EXTENDED_KEY_USAGE;
}
unsafe extern "C" {
    /// i2d_EXTENDED_KEY_USAGE marshals `eku` as a DER-encoded ExtKeyUsageSyntax (RFC
    /// 5280), as described in `i2d_SAMPLE`.
    pub fn i2d_EXTENDED_KEY_USAGE(
        eku: *const EXTENDED_KEY_USAGE,
        outp: *mut *mut u8,
    ) -> ::core::ffi::c_int;
}
/// General names.
///
/// A `GENERAL_NAME` represents an X.509 GeneralName structure, defined in RFC
/// 5280, Section 4.2.1.6. General names are distinct from names (`X509_NAME`). A
/// general name is a CHOICE type which may contain one of several name types,
/// most commonly a DNS name or an IP address. General names most commonly appear
/// in the subject alternative name (SAN) extension, though they are also used in
/// other extensions.
///
/// Many extensions contain a SEQUENCE OF GeneralName, or GeneralNames, so
/// `STACK_OF(GENERAL_NAME)` is defined and aliased to `GENERAL_NAMES`.
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct otherName_st {
    pub type_id: *mut ASN1_OBJECT,
    pub value: *mut ASN1_TYPE,
}
/// General names.
///
/// A `GENERAL_NAME` represents an X.509 GeneralName structure, defined in RFC
/// 5280, Section 4.2.1.6. General names are distinct from names (`X509_NAME`). A
/// general name is a CHOICE type which may contain one of several name types,
/// most commonly a DNS name or an IP address. General names most commonly appear
/// in the subject alternative name (SAN) extension, though they are also used in
/// other extensions.
///
/// Many extensions contain a SEQUENCE OF GeneralName, or GeneralNames, so
/// `STACK_OF(GENERAL_NAME)` is defined and aliased to `GENERAL_NAMES`.
pub type OTHERNAME = otherName_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct EDIPartyName_st {
    pub nameAssigner: *mut ASN1_STRING,
    pub partyName: *mut ASN1_STRING,
}
pub type EDIPARTYNAME = EDIPartyName_st;
/// A GENERAL_NAME_st, aka `GENERAL_NAME`, represents an X.509 GeneralName. The
/// `type` field determines which member of `d` is active. A `GENERAL_NAME` may
/// also be empty, in which case `type` is -1 and `d` is NULL. Empty
/// `GENERAL_NAME`s are invalid and will never be returned from the parser, but
/// may be created temporarily, e.g. by `GENERAL_NAME_new`.
///
/// WARNING: `type` and `d` must be kept consistent. An inconsistency will result
/// in a potentially exploitable memory error.
#[repr(C)]
#[derive(Copy, Clone)]
pub struct GENERAL_NAME_st {
    pub type_: ::core::ffi::c_int,
    pub d: GENERAL_NAME_st__bindgen_ty_1,
}
#[repr(C)]
#[derive(Copy, Clone)]
pub union GENERAL_NAME_st__bindgen_ty_1 {
    pub ptr: *mut ::core::ffi::c_char,
    pub otherName: *mut OTHERNAME,
    pub rfc822Name: *mut ASN1_IA5STRING,
    pub dNSName: *mut ASN1_IA5STRING,
    pub x400Address: *mut ASN1_STRING,
    pub directoryName: *mut X509_NAME,
    pub ediPartyName: *mut EDIPARTYNAME,
    pub uniformResourceIdentifier: *mut ASN1_IA5STRING,
    pub iPAddress: *mut ASN1_OCTET_STRING,
    pub registeredID: *mut ASN1_OBJECT,
    /// iPAddress
    pub ip: *mut ASN1_OCTET_STRING,
    /// dirn
    pub dirn: *mut X509_NAME,
    /// rfc822Name, dNSName, uniformResourceIdentifier
    pub ia5: *mut ASN1_IA5STRING,
    /// registeredID
    pub rid: *mut ASN1_OBJECT,
}
unsafe extern "C" {
    /// GENERAL_NAME_new returns a new, empty `GENERAL_NAME`, or NULL on error.
    pub fn GENERAL_NAME_new() -> *mut GENERAL_NAME;
}
unsafe extern "C" {
    /// GENERAL_NAME_free releases memory associated with `gen`.
    pub fn GENERAL_NAME_free(gen_: *mut GENERAL_NAME);
}
unsafe extern "C" {
    /// d2i_GENERAL_NAME parses up to `len` bytes from `*inp` as a DER-encoded X.509
    /// GeneralName (RFC 5280), as described in `d2i_SAMPLE`.
    pub fn d2i_GENERAL_NAME(
        out: *mut *mut GENERAL_NAME,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut GENERAL_NAME;
}
unsafe extern "C" {
    /// i2d_GENERAL_NAME marshals `in` as a DER-encoded X.509 GeneralName (RFC 5280),
    /// as described in `i2d_SAMPLE`.
    pub fn i2d_GENERAL_NAME(in_: *const GENERAL_NAME, outp: *mut *mut u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// GENERAL_NAME_dup returns a newly-allocated copy of `gen`, or NULL on error.
    /// This function works by serializing the structure, so it will fail if `gen` is
    /// empty.
    pub fn GENERAL_NAME_dup(gen_: *const GENERAL_NAME) -> *mut GENERAL_NAME;
}
unsafe extern "C" {
    /// GENERAL_NAMES_new returns a new, empty `GENERAL_NAMES`, or NULL on error.
    pub fn GENERAL_NAMES_new() -> *mut GENERAL_NAMES;
}
unsafe extern "C" {
    /// GENERAL_NAMES_free releases memory associated with `gens`.
    pub fn GENERAL_NAMES_free(gens: *mut GENERAL_NAMES);
}
unsafe extern "C" {
    /// d2i_GENERAL_NAMES parses up to `len` bytes from `*inp` as a DER-encoded
    /// SEQUENCE OF GeneralName, as described in `d2i_SAMPLE`.
    pub fn d2i_GENERAL_NAMES(
        out: *mut *mut GENERAL_NAMES,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut GENERAL_NAMES;
}
unsafe extern "C" {
    /// i2d_GENERAL_NAMES marshals `in` as a DER-encoded SEQUENCE OF GeneralName, as
    /// described in `i2d_SAMPLE`.
    pub fn i2d_GENERAL_NAMES(in_: *const GENERAL_NAMES, outp: *mut *mut u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// OTHERNAME_new returns a new, empty `OTHERNAME`, or NULL on error.
    pub fn OTHERNAME_new() -> *mut OTHERNAME;
}
unsafe extern "C" {
    /// OTHERNAME_free releases memory associated with `name`.
    pub fn OTHERNAME_free(name: *mut OTHERNAME);
}
unsafe extern "C" {
    /// EDIPARTYNAME_new returns a new, empty `EDIPARTYNAME`, or NULL on error.
    /// EDIPartyName is rarely used in practice, so callers are unlikely to need this
    /// function.
    pub fn EDIPARTYNAME_new() -> *mut EDIPARTYNAME;
}
unsafe extern "C" {
    /// EDIPARTYNAME_free releases memory associated with `name`. EDIPartyName is
    /// rarely used in practice, so callers are unlikely to need this function.
    pub fn EDIPARTYNAME_free(name: *mut EDIPARTYNAME);
}
unsafe extern "C" {
    /// GENERAL_NAME_set0_value set `gen`'s type and value to `type` and `value`.
    /// `type` must be a `GEN_*` constant and `value` must be an object of the
    /// corresponding type. `gen` takes ownership of `value`, so `value` must have
    /// been an allocated object.
    ///
    /// WARNING: `gen` must be empty (typically as returned from `GENERAL_NAME_new`)
    /// before calling this function. If `gen` already contained a value, the
    /// previous contents will be leaked.
    pub fn GENERAL_NAME_set0_value(
        gen_: *mut GENERAL_NAME,
        type_: ::core::ffi::c_int,
        value: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    /// GENERAL_NAME_get0_value returns the in-memory representation of `gen`'s
    /// contents and, `out_type` is not NULL, sets `*out_type` to the type of `gen`,
    /// which will be a `GEN_*` constant. If `gen` is incomplete, the return value
    /// will be NULL and the type will be -1.
    ///
    /// WARNING: Casting the result of this function to the wrong type is a
    /// potentially exploitable memory error. Callers must check `gen`'s type, either
    /// via `*out_type` or checking `gen->type` directly, before inspecting the
    /// result.
    ///
    /// WARNING: This function is not const-correct. The return value should be
    /// const. Callers should not mutate the returned object.
    pub fn GENERAL_NAME_get0_value(
        gen_: *const GENERAL_NAME,
        out_type: *mut ::core::ffi::c_int,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    /// GENERAL_NAME_set0_othername sets `gen` to be an OtherName with type `oid` and
    /// value `value`. On success, it returns one and takes ownership of `oid` and
    /// `value`, which must be created in a way compatible with `ASN1_OBJECT_free`
    /// and `ASN1_TYPE_free`, respectively. On allocation failure, it returns zero.
    /// In the failure case, the caller retains ownership of `oid` and `value` and
    /// must release them when done.
    ///
    /// WARNING: `gen` must be empty (typically as returned from `GENERAL_NAME_new`)
    /// before calling this function. If `gen` already contained a value, the
    /// previously contents will be leaked.
    pub fn GENERAL_NAME_set0_othername(
        gen_: *mut GENERAL_NAME,
        oid: *mut ASN1_OBJECT,
        value: *mut ASN1_TYPE,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// GENERAL_NAME_get0_otherName, if `gen` is an OtherName, sets `*out_oid` and
    /// `*out_value` to the OtherName's type-id and value, respectively, and returns
    /// one. If `gen` is not an OtherName, it returns zero and leaves `*out_oid` and
    /// `*out_value` unmodified. Either of `out_oid` or `out_value` may be NULL to
    /// ignore the value.
    ///
    /// WARNING: This function is not const-correct. `out_oid` and `out_value` are
    /// not const, but callers should not mutate the resulting objects.
    pub fn GENERAL_NAME_get0_otherName(
        gen_: *const GENERAL_NAME,
        out_oid: *mut *mut ASN1_OBJECT,
        out_value: *mut *mut ASN1_TYPE,
    ) -> ::core::ffi::c_int;
}
/// A AUTHORITY_KEYID_st, aka `AUTHORITY_KEYID`, represents an
/// AuthorityKeyIdentifier structure (RFC 5280).
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct AUTHORITY_KEYID_st {
    pub keyid: *mut ASN1_OCTET_STRING,
    pub issuer: *mut GENERAL_NAMES,
    pub serial: *mut ASN1_INTEGER,
}
unsafe extern "C" {
    /// AUTHORITY_KEYID is an `ASN1_ITEM` whose ASN.1 type is AuthorityKeyIdentifier
    /// (RFC 5280) and C type is `AUTHORITY_KEYID*`.
    pub static AUTHORITY_KEYID_it: ASN1_ITEM;
}
unsafe extern "C" {
    /// AUTHORITY_KEYID_new returns a newly-allocated, empty `AUTHORITY_KEYID`
    /// object, or NULL on error.
    pub fn AUTHORITY_KEYID_new() -> *mut AUTHORITY_KEYID;
}
unsafe extern "C" {
    /// AUTHORITY_KEYID_free releases memory associated with `akid`.
    pub fn AUTHORITY_KEYID_free(akid: *mut AUTHORITY_KEYID);
}
unsafe extern "C" {
    /// d2i_AUTHORITY_KEYID parses up to `len` bytes from `*inp` as a DER-encoded
    /// AuthorityKeyIdentifier (RFC 5280), as described in `d2i_SAMPLE`.
    pub fn d2i_AUTHORITY_KEYID(
        out: *mut *mut AUTHORITY_KEYID,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut AUTHORITY_KEYID;
}
unsafe extern "C" {
    /// i2d_AUTHORITY_KEYID marshals `akid` as a DER-encoded AuthorityKeyIdentifier
    /// (RFC 5280), as described in `i2d_SAMPLE`.
    pub fn i2d_AUTHORITY_KEYID(
        akid: *const AUTHORITY_KEYID,
        outp: *mut *mut u8,
    ) -> ::core::ffi::c_int;
}
/// A GENERAL_SUBTREE represents a GeneralSubtree structure (RFC 5280).
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct GENERAL_SUBTREE_st {
    pub base: *mut GENERAL_NAME,
    pub minimum: *mut ASN1_INTEGER,
    pub maximum: *mut ASN1_INTEGER,
}
/// A GENERAL_SUBTREE represents a GeneralSubtree structure (RFC 5280).
pub type GENERAL_SUBTREE = GENERAL_SUBTREE_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct stack_st_GENERAL_SUBTREE {
    _unused: [u8; 0],
}
/// We also disable -Wcast-qual. As part of this C-based type erasure setup,  \
/// the wrapper macros need to cast away const in places. In C++, const_cast  \
/// suppresses the warning, but it seemingly cannot be suppressed in C.
pub type sk_GENERAL_SUBTREE_free_func =
    ::core::option::Option<unsafe extern "C" fn(arg1: *mut GENERAL_SUBTREE)>;
pub type sk_GENERAL_SUBTREE_copy_func = ::core::option::Option<
    unsafe extern "C" fn(arg1: *const GENERAL_SUBTREE) -> *mut GENERAL_SUBTREE,
>;
pub type sk_GENERAL_SUBTREE_cmp_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *const *const GENERAL_SUBTREE,
        arg2: *const *const GENERAL_SUBTREE,
    ) -> ::core::ffi::c_int,
>;
pub type sk_GENERAL_SUBTREE_delete_if_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *mut GENERAL_SUBTREE,
        arg2: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int,
>;
unsafe extern "C" {
    #[link_name = "sk_GENERAL_SUBTREE_call_free_func__extern"]
    pub fn sk_GENERAL_SUBTREE_call_free_func(
        free_func: OPENSSL_sk_free_func,
        ptr: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_SUBTREE_call_copy_func__extern"]
    pub fn sk_GENERAL_SUBTREE_call_copy_func(
        copy_func: OPENSSL_sk_copy_func,
        ptr: *const ::core::ffi::c_void,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_SUBTREE_call_cmp_func__extern"]
    pub fn sk_GENERAL_SUBTREE_call_cmp_func(
        cmp_func: OPENSSL_sk_cmp_func,
        a: *const ::core::ffi::c_void,
        b: *const ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_SUBTREE_call_delete_if_func__extern"]
    pub fn sk_GENERAL_SUBTREE_call_delete_if_func(
        func: OPENSSL_sk_delete_if_func,
        obj: *mut ::core::ffi::c_void,
        data: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_SUBTREE_new__extern"]
    pub fn sk_GENERAL_SUBTREE_new(
        comp: sk_GENERAL_SUBTREE_cmp_func,
    ) -> *mut stack_st_GENERAL_SUBTREE;
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_SUBTREE_new_null__extern"]
    pub fn sk_GENERAL_SUBTREE_new_null() -> *mut stack_st_GENERAL_SUBTREE;
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_SUBTREE_num__extern"]
    pub fn sk_GENERAL_SUBTREE_num(sk: *const stack_st_GENERAL_SUBTREE) -> usize;
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_SUBTREE_zero__extern"]
    pub fn sk_GENERAL_SUBTREE_zero(sk: *mut stack_st_GENERAL_SUBTREE);
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_SUBTREE_value__extern"]
    pub fn sk_GENERAL_SUBTREE_value(
        sk: *const stack_st_GENERAL_SUBTREE,
        i: usize,
    ) -> *mut GENERAL_SUBTREE;
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_SUBTREE_set__extern"]
    pub fn sk_GENERAL_SUBTREE_set(
        sk: *mut stack_st_GENERAL_SUBTREE,
        i: usize,
        p: *mut GENERAL_SUBTREE,
    ) -> *mut GENERAL_SUBTREE;
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_SUBTREE_free__extern"]
    pub fn sk_GENERAL_SUBTREE_free(sk: *mut stack_st_GENERAL_SUBTREE);
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_SUBTREE_pop_free__extern"]
    pub fn sk_GENERAL_SUBTREE_pop_free(
        sk: *mut stack_st_GENERAL_SUBTREE,
        free_func: sk_GENERAL_SUBTREE_free_func,
    );
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_SUBTREE_insert__extern"]
    pub fn sk_GENERAL_SUBTREE_insert(
        sk: *mut stack_st_GENERAL_SUBTREE,
        p: *mut GENERAL_SUBTREE,
        where_: usize,
    ) -> usize;
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_SUBTREE_delete__extern"]
    pub fn sk_GENERAL_SUBTREE_delete(
        sk: *mut stack_st_GENERAL_SUBTREE,
        where_: usize,
    ) -> *mut GENERAL_SUBTREE;
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_SUBTREE_delete_ptr__extern"]
    pub fn sk_GENERAL_SUBTREE_delete_ptr(
        sk: *mut stack_st_GENERAL_SUBTREE,
        p: *const GENERAL_SUBTREE,
    ) -> *mut GENERAL_SUBTREE;
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_SUBTREE_delete_if__extern"]
    pub fn sk_GENERAL_SUBTREE_delete_if(
        sk: *mut stack_st_GENERAL_SUBTREE,
        func: sk_GENERAL_SUBTREE_delete_if_func,
        data: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_SUBTREE_find__extern"]
    pub fn sk_GENERAL_SUBTREE_find(
        sk: *const stack_st_GENERAL_SUBTREE,
        out_index: *mut usize,
        p: *const GENERAL_SUBTREE,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_SUBTREE_shift__extern"]
    pub fn sk_GENERAL_SUBTREE_shift(sk: *mut stack_st_GENERAL_SUBTREE) -> *mut GENERAL_SUBTREE;
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_SUBTREE_push__extern"]
    pub fn sk_GENERAL_SUBTREE_push(
        sk: *mut stack_st_GENERAL_SUBTREE,
        p: *mut GENERAL_SUBTREE,
    ) -> usize;
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_SUBTREE_pop__extern"]
    pub fn sk_GENERAL_SUBTREE_pop(sk: *mut stack_st_GENERAL_SUBTREE) -> *mut GENERAL_SUBTREE;
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_SUBTREE_dup__extern"]
    pub fn sk_GENERAL_SUBTREE_dup(
        sk: *const stack_st_GENERAL_SUBTREE,
    ) -> *mut stack_st_GENERAL_SUBTREE;
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_SUBTREE_sort__extern"]
    pub fn sk_GENERAL_SUBTREE_sort(sk: *mut stack_st_GENERAL_SUBTREE);
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_SUBTREE_sort_and_dedup__extern"]
    pub fn sk_GENERAL_SUBTREE_sort_and_dedup(
        sk: *mut stack_st_GENERAL_SUBTREE,
        free_func: sk_GENERAL_SUBTREE_free_func,
    );
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_SUBTREE_is_sorted__extern"]
    pub fn sk_GENERAL_SUBTREE_is_sorted(sk: *const stack_st_GENERAL_SUBTREE) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_SUBTREE_set_cmp_func__extern"]
    pub fn sk_GENERAL_SUBTREE_set_cmp_func(
        sk: *mut stack_st_GENERAL_SUBTREE,
        comp: sk_GENERAL_SUBTREE_cmp_func,
    ) -> sk_GENERAL_SUBTREE_cmp_func;
}
unsafe extern "C" {
    #[link_name = "sk_GENERAL_SUBTREE_deep_copy__extern"]
    pub fn sk_GENERAL_SUBTREE_deep_copy(
        sk: *const stack_st_GENERAL_SUBTREE,
        copy_func: sk_GENERAL_SUBTREE_copy_func,
        free_func: sk_GENERAL_SUBTREE_free_func,
    ) -> *mut stack_st_GENERAL_SUBTREE;
}
unsafe extern "C" {
    /// GENERAL_SUBTREE_new returns a newly-allocated, empty `GENERAL_SUBTREE`
    /// object, or NULL on error.
    pub fn GENERAL_SUBTREE_new() -> *mut GENERAL_SUBTREE;
}
unsafe extern "C" {
    /// GENERAL_SUBTREE_free releases memory associated with `subtree`.
    pub fn GENERAL_SUBTREE_free(subtree: *mut GENERAL_SUBTREE);
}
/// A NAME_CONSTRAINTS_st, aka `NAME_CONSTRAINTS`, represents a NameConstraints
/// structure (RFC 5280).
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct NAME_CONSTRAINTS_st {
    pub permittedSubtrees: *mut stack_st_GENERAL_SUBTREE,
    pub excludedSubtrees: *mut stack_st_GENERAL_SUBTREE,
}
unsafe extern "C" {
    /// NAME_CONSTRAINTS is an `ASN1_ITEM` whose ASN.1 type is NameConstraints (RFC
    /// 5280) and C type is `NAME_CONSTRAINTS*`.
    pub static NAME_CONSTRAINTS_it: ASN1_ITEM;
}
unsafe extern "C" {
    /// NAME_CONSTRAINTS_new returns a newly-allocated, empty `NAME_CONSTRAINTS`
    /// object, or NULL on error.
    pub fn NAME_CONSTRAINTS_new() -> *mut NAME_CONSTRAINTS;
}
unsafe extern "C" {
    /// NAME_CONSTRAINTS_free releases memory associated with `ncons`.
    pub fn NAME_CONSTRAINTS_free(ncons: *mut NAME_CONSTRAINTS);
}
/// An ACCESS_DESCRIPTION represents an AccessDescription structure (RFC 5280).
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct ACCESS_DESCRIPTION_st {
    pub method: *mut ASN1_OBJECT,
    pub location: *mut GENERAL_NAME,
}
/// An ACCESS_DESCRIPTION represents an AccessDescription structure (RFC 5280).
pub type ACCESS_DESCRIPTION = ACCESS_DESCRIPTION_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct stack_st_ACCESS_DESCRIPTION {
    _unused: [u8; 0],
}
/// We also disable -Wcast-qual. As part of this C-based type erasure setup,  \
/// the wrapper macros need to cast away const in places. In C++, const_cast  \
/// suppresses the warning, but it seemingly cannot be suppressed in C.
pub type sk_ACCESS_DESCRIPTION_free_func =
    ::core::option::Option<unsafe extern "C" fn(arg1: *mut ACCESS_DESCRIPTION)>;
pub type sk_ACCESS_DESCRIPTION_copy_func = ::core::option::Option<
    unsafe extern "C" fn(arg1: *const ACCESS_DESCRIPTION) -> *mut ACCESS_DESCRIPTION,
>;
pub type sk_ACCESS_DESCRIPTION_cmp_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *const *const ACCESS_DESCRIPTION,
        arg2: *const *const ACCESS_DESCRIPTION,
    ) -> ::core::ffi::c_int,
>;
pub type sk_ACCESS_DESCRIPTION_delete_if_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *mut ACCESS_DESCRIPTION,
        arg2: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int,
>;
unsafe extern "C" {
    #[link_name = "sk_ACCESS_DESCRIPTION_call_free_func__extern"]
    pub fn sk_ACCESS_DESCRIPTION_call_free_func(
        free_func: OPENSSL_sk_free_func,
        ptr: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    #[link_name = "sk_ACCESS_DESCRIPTION_call_copy_func__extern"]
    pub fn sk_ACCESS_DESCRIPTION_call_copy_func(
        copy_func: OPENSSL_sk_copy_func,
        ptr: *const ::core::ffi::c_void,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    #[link_name = "sk_ACCESS_DESCRIPTION_call_cmp_func__extern"]
    pub fn sk_ACCESS_DESCRIPTION_call_cmp_func(
        cmp_func: OPENSSL_sk_cmp_func,
        a: *const ::core::ffi::c_void,
        b: *const ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_ACCESS_DESCRIPTION_call_delete_if_func__extern"]
    pub fn sk_ACCESS_DESCRIPTION_call_delete_if_func(
        func: OPENSSL_sk_delete_if_func,
        obj: *mut ::core::ffi::c_void,
        data: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_ACCESS_DESCRIPTION_new__extern"]
    pub fn sk_ACCESS_DESCRIPTION_new(
        comp: sk_ACCESS_DESCRIPTION_cmp_func,
    ) -> *mut stack_st_ACCESS_DESCRIPTION;
}
unsafe extern "C" {
    #[link_name = "sk_ACCESS_DESCRIPTION_new_null__extern"]
    pub fn sk_ACCESS_DESCRIPTION_new_null() -> *mut stack_st_ACCESS_DESCRIPTION;
}
unsafe extern "C" {
    #[link_name = "sk_ACCESS_DESCRIPTION_num__extern"]
    pub fn sk_ACCESS_DESCRIPTION_num(sk: *const stack_st_ACCESS_DESCRIPTION) -> usize;
}
unsafe extern "C" {
    #[link_name = "sk_ACCESS_DESCRIPTION_zero__extern"]
    pub fn sk_ACCESS_DESCRIPTION_zero(sk: *mut stack_st_ACCESS_DESCRIPTION);
}
unsafe extern "C" {
    #[link_name = "sk_ACCESS_DESCRIPTION_value__extern"]
    pub fn sk_ACCESS_DESCRIPTION_value(
        sk: *const stack_st_ACCESS_DESCRIPTION,
        i: usize,
    ) -> *mut ACCESS_DESCRIPTION;
}
unsafe extern "C" {
    #[link_name = "sk_ACCESS_DESCRIPTION_set__extern"]
    pub fn sk_ACCESS_DESCRIPTION_set(
        sk: *mut stack_st_ACCESS_DESCRIPTION,
        i: usize,
        p: *mut ACCESS_DESCRIPTION,
    ) -> *mut ACCESS_DESCRIPTION;
}
unsafe extern "C" {
    #[link_name = "sk_ACCESS_DESCRIPTION_free__extern"]
    pub fn sk_ACCESS_DESCRIPTION_free(sk: *mut stack_st_ACCESS_DESCRIPTION);
}
unsafe extern "C" {
    #[link_name = "sk_ACCESS_DESCRIPTION_pop_free__extern"]
    pub fn sk_ACCESS_DESCRIPTION_pop_free(
        sk: *mut stack_st_ACCESS_DESCRIPTION,
        free_func: sk_ACCESS_DESCRIPTION_free_func,
    );
}
unsafe extern "C" {
    #[link_name = "sk_ACCESS_DESCRIPTION_insert__extern"]
    pub fn sk_ACCESS_DESCRIPTION_insert(
        sk: *mut stack_st_ACCESS_DESCRIPTION,
        p: *mut ACCESS_DESCRIPTION,
        where_: usize,
    ) -> usize;
}
unsafe extern "C" {
    #[link_name = "sk_ACCESS_DESCRIPTION_delete__extern"]
    pub fn sk_ACCESS_DESCRIPTION_delete(
        sk: *mut stack_st_ACCESS_DESCRIPTION,
        where_: usize,
    ) -> *mut ACCESS_DESCRIPTION;
}
unsafe extern "C" {
    #[link_name = "sk_ACCESS_DESCRIPTION_delete_ptr__extern"]
    pub fn sk_ACCESS_DESCRIPTION_delete_ptr(
        sk: *mut stack_st_ACCESS_DESCRIPTION,
        p: *const ACCESS_DESCRIPTION,
    ) -> *mut ACCESS_DESCRIPTION;
}
unsafe extern "C" {
    #[link_name = "sk_ACCESS_DESCRIPTION_delete_if__extern"]
    pub fn sk_ACCESS_DESCRIPTION_delete_if(
        sk: *mut stack_st_ACCESS_DESCRIPTION,
        func: sk_ACCESS_DESCRIPTION_delete_if_func,
        data: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    #[link_name = "sk_ACCESS_DESCRIPTION_find__extern"]
    pub fn sk_ACCESS_DESCRIPTION_find(
        sk: *const stack_st_ACCESS_DESCRIPTION,
        out_index: *mut usize,
        p: *const ACCESS_DESCRIPTION,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_ACCESS_DESCRIPTION_shift__extern"]
    pub fn sk_ACCESS_DESCRIPTION_shift(
        sk: *mut stack_st_ACCESS_DESCRIPTION,
    ) -> *mut ACCESS_DESCRIPTION;
}
unsafe extern "C" {
    #[link_name = "sk_ACCESS_DESCRIPTION_push__extern"]
    pub fn sk_ACCESS_DESCRIPTION_push(
        sk: *mut stack_st_ACCESS_DESCRIPTION,
        p: *mut ACCESS_DESCRIPTION,
    ) -> usize;
}
unsafe extern "C" {
    #[link_name = "sk_ACCESS_DESCRIPTION_pop__extern"]
    pub fn sk_ACCESS_DESCRIPTION_pop(
        sk: *mut stack_st_ACCESS_DESCRIPTION,
    ) -> *mut ACCESS_DESCRIPTION;
}
unsafe extern "C" {
    #[link_name = "sk_ACCESS_DESCRIPTION_dup__extern"]
    pub fn sk_ACCESS_DESCRIPTION_dup(
        sk: *const stack_st_ACCESS_DESCRIPTION,
    ) -> *mut stack_st_ACCESS_DESCRIPTION;
}
unsafe extern "C" {
    #[link_name = "sk_ACCESS_DESCRIPTION_sort__extern"]
    pub fn sk_ACCESS_DESCRIPTION_sort(sk: *mut stack_st_ACCESS_DESCRIPTION);
}
unsafe extern "C" {
    #[link_name = "sk_ACCESS_DESCRIPTION_sort_and_dedup__extern"]
    pub fn sk_ACCESS_DESCRIPTION_sort_and_dedup(
        sk: *mut stack_st_ACCESS_DESCRIPTION,
        free_func: sk_ACCESS_DESCRIPTION_free_func,
    );
}
unsafe extern "C" {
    #[link_name = "sk_ACCESS_DESCRIPTION_is_sorted__extern"]
    pub fn sk_ACCESS_DESCRIPTION_is_sorted(
        sk: *const stack_st_ACCESS_DESCRIPTION,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_ACCESS_DESCRIPTION_set_cmp_func__extern"]
    pub fn sk_ACCESS_DESCRIPTION_set_cmp_func(
        sk: *mut stack_st_ACCESS_DESCRIPTION,
        comp: sk_ACCESS_DESCRIPTION_cmp_func,
    ) -> sk_ACCESS_DESCRIPTION_cmp_func;
}
unsafe extern "C" {
    #[link_name = "sk_ACCESS_DESCRIPTION_deep_copy__extern"]
    pub fn sk_ACCESS_DESCRIPTION_deep_copy(
        sk: *const stack_st_ACCESS_DESCRIPTION,
        copy_func: sk_ACCESS_DESCRIPTION_copy_func,
        free_func: sk_ACCESS_DESCRIPTION_free_func,
    ) -> *mut stack_st_ACCESS_DESCRIPTION;
}
unsafe extern "C" {
    /// ACCESS_DESCRIPTION_new returns a newly-allocated, empty `ACCESS_DESCRIPTION`
    /// object, or NULL on error.
    pub fn ACCESS_DESCRIPTION_new() -> *mut ACCESS_DESCRIPTION;
}
unsafe extern "C" {
    /// ACCESS_DESCRIPTION_free releases memory associated with `desc`.
    pub fn ACCESS_DESCRIPTION_free(desc: *mut ACCESS_DESCRIPTION);
}
pub type AUTHORITY_INFO_ACCESS = stack_st_ACCESS_DESCRIPTION;
unsafe extern "C" {
    /// AUTHORITY_INFO_ACCESS is an `ASN1_ITEM` whose ASN.1 type is
    /// AuthorityInfoAccessSyntax (RFC 5280) and C type is
    /// `STACK_OF(ACCESS_DESCRIPTION)*`, or `AUTHORITY_INFO_ACCESS*`.
    pub static AUTHORITY_INFO_ACCESS_it: ASN1_ITEM;
}
unsafe extern "C" {
    /// AUTHORITY_INFO_ACCESS_new returns a newly-allocated, empty
    /// `AUTHORITY_INFO_ACCESS` object, or NULL on error.
    pub fn AUTHORITY_INFO_ACCESS_new() -> *mut AUTHORITY_INFO_ACCESS;
}
unsafe extern "C" {
    /// AUTHORITY_INFO_ACCESS_free releases memory associated with `aia`.
    pub fn AUTHORITY_INFO_ACCESS_free(aia: *mut AUTHORITY_INFO_ACCESS);
}
unsafe extern "C" {
    /// d2i_AUTHORITY_INFO_ACCESS parses up to `len` bytes from `*inp` as a
    /// DER-encoded AuthorityInfoAccessSyntax (RFC 5280), as described in
    /// `d2i_SAMPLE`.
    pub fn d2i_AUTHORITY_INFO_ACCESS(
        out: *mut *mut AUTHORITY_INFO_ACCESS,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut AUTHORITY_INFO_ACCESS;
}
unsafe extern "C" {
    /// i2d_AUTHORITY_INFO_ACCESS marshals `aia` as a DER-encoded
    /// AuthorityInfoAccessSyntax (RFC 5280), as described in `i2d_SAMPLE`.
    pub fn i2d_AUTHORITY_INFO_ACCESS(
        aia: *const AUTHORITY_INFO_ACCESS,
        outp: *mut *mut u8,
    ) -> ::core::ffi::c_int;
}
/// A DIST_POINT_NAME represents a DistributionPointName structure (RFC 5280).
/// The `name` field contains the CHOICE value and is determined by `type`. If
/// `type` is zero, `name` must be a `fullname`. If `type` is one, `name` must be
/// a `relativename`.
///
/// WARNING: `type` and `name` must be kept consistent. An inconsistency will
/// result in a potentially exploitable memory error.
#[repr(C)]
#[derive(Copy, Clone)]
pub struct DIST_POINT_NAME_st {
    pub type_: ::core::ffi::c_int,
    pub name: DIST_POINT_NAME_st__bindgen_ty_1,
    /// If relativename then this contains the full distribution point name
    pub dpname: *mut X509_NAME,
}
#[repr(C)]
#[derive(Copy, Clone)]
pub union DIST_POINT_NAME_st__bindgen_ty_1 {
    pub fullname: *mut GENERAL_NAMES,
    pub relativename: *mut stack_st_X509_NAME_ENTRY,
}
/// A DIST_POINT_NAME represents a DistributionPointName structure (RFC 5280).
/// The `name` field contains the CHOICE value and is determined by `type`. If
/// `type` is zero, `name` must be a `fullname`. If `type` is one, `name` must be
/// a `relativename`.
///
/// WARNING: `type` and `name` must be kept consistent. An inconsistency will
/// result in a potentially exploitable memory error.
pub type DIST_POINT_NAME = DIST_POINT_NAME_st;
unsafe extern "C" {
    /// DIST_POINT_NAME_new returns a newly-allocated, empty `DIST_POINT_NAME`
    /// object, or NULL on error.
    pub fn DIST_POINT_NAME_new() -> *mut DIST_POINT_NAME;
}
unsafe extern "C" {
    /// DIST_POINT_NAME_free releases memory associated with `name`.
    pub fn DIST_POINT_NAME_free(name: *mut DIST_POINT_NAME);
}
/// A DIST_POINT_st, aka `DIST_POINT`, represents a DistributionPoint structure
/// (RFC 5280).
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct DIST_POINT_st {
    pub distpoint: *mut DIST_POINT_NAME,
    pub reasons: *mut ASN1_BIT_STRING,
    pub CRLissuer: *mut GENERAL_NAMES,
}
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct stack_st_DIST_POINT {
    _unused: [u8; 0],
}
/// We also disable -Wcast-qual. As part of this C-based type erasure setup,  \
/// the wrapper macros need to cast away const in places. In C++, const_cast  \
/// suppresses the warning, but it seemingly cannot be suppressed in C.
pub type sk_DIST_POINT_free_func =
    ::core::option::Option<unsafe extern "C" fn(arg1: *mut DIST_POINT)>;
pub type sk_DIST_POINT_copy_func =
    ::core::option::Option<unsafe extern "C" fn(arg1: *const DIST_POINT) -> *mut DIST_POINT>;
pub type sk_DIST_POINT_cmp_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *const *const DIST_POINT,
        arg2: *const *const DIST_POINT,
    ) -> ::core::ffi::c_int,
>;
pub type sk_DIST_POINT_delete_if_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *mut DIST_POINT,
        arg2: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int,
>;
unsafe extern "C" {
    #[link_name = "sk_DIST_POINT_call_free_func__extern"]
    pub fn sk_DIST_POINT_call_free_func(
        free_func: OPENSSL_sk_free_func,
        ptr: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    #[link_name = "sk_DIST_POINT_call_copy_func__extern"]
    pub fn sk_DIST_POINT_call_copy_func(
        copy_func: OPENSSL_sk_copy_func,
        ptr: *const ::core::ffi::c_void,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    #[link_name = "sk_DIST_POINT_call_cmp_func__extern"]
    pub fn sk_DIST_POINT_call_cmp_func(
        cmp_func: OPENSSL_sk_cmp_func,
        a: *const ::core::ffi::c_void,
        b: *const ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_DIST_POINT_call_delete_if_func__extern"]
    pub fn sk_DIST_POINT_call_delete_if_func(
        func: OPENSSL_sk_delete_if_func,
        obj: *mut ::core::ffi::c_void,
        data: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_DIST_POINT_new__extern"]
    pub fn sk_DIST_POINT_new(comp: sk_DIST_POINT_cmp_func) -> *mut stack_st_DIST_POINT;
}
unsafe extern "C" {
    #[link_name = "sk_DIST_POINT_new_null__extern"]
    pub fn sk_DIST_POINT_new_null() -> *mut stack_st_DIST_POINT;
}
unsafe extern "C" {
    #[link_name = "sk_DIST_POINT_num__extern"]
    pub fn sk_DIST_POINT_num(sk: *const stack_st_DIST_POINT) -> usize;
}
unsafe extern "C" {
    #[link_name = "sk_DIST_POINT_zero__extern"]
    pub fn sk_DIST_POINT_zero(sk: *mut stack_st_DIST_POINT);
}
unsafe extern "C" {
    #[link_name = "sk_DIST_POINT_value__extern"]
    pub fn sk_DIST_POINT_value(sk: *const stack_st_DIST_POINT, i: usize) -> *mut DIST_POINT;
}
unsafe extern "C" {
    #[link_name = "sk_DIST_POINT_set__extern"]
    pub fn sk_DIST_POINT_set(
        sk: *mut stack_st_DIST_POINT,
        i: usize,
        p: *mut DIST_POINT,
    ) -> *mut DIST_POINT;
}
unsafe extern "C" {
    #[link_name = "sk_DIST_POINT_free__extern"]
    pub fn sk_DIST_POINT_free(sk: *mut stack_st_DIST_POINT);
}
unsafe extern "C" {
    #[link_name = "sk_DIST_POINT_pop_free__extern"]
    pub fn sk_DIST_POINT_pop_free(sk: *mut stack_st_DIST_POINT, free_func: sk_DIST_POINT_free_func);
}
unsafe extern "C" {
    #[link_name = "sk_DIST_POINT_insert__extern"]
    pub fn sk_DIST_POINT_insert(
        sk: *mut stack_st_DIST_POINT,
        p: *mut DIST_POINT,
        where_: usize,
    ) -> usize;
}
unsafe extern "C" {
    #[link_name = "sk_DIST_POINT_delete__extern"]
    pub fn sk_DIST_POINT_delete(sk: *mut stack_st_DIST_POINT, where_: usize) -> *mut DIST_POINT;
}
unsafe extern "C" {
    #[link_name = "sk_DIST_POINT_delete_ptr__extern"]
    pub fn sk_DIST_POINT_delete_ptr(
        sk: *mut stack_st_DIST_POINT,
        p: *const DIST_POINT,
    ) -> *mut DIST_POINT;
}
unsafe extern "C" {
    #[link_name = "sk_DIST_POINT_delete_if__extern"]
    pub fn sk_DIST_POINT_delete_if(
        sk: *mut stack_st_DIST_POINT,
        func: sk_DIST_POINT_delete_if_func,
        data: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    #[link_name = "sk_DIST_POINT_find__extern"]
    pub fn sk_DIST_POINT_find(
        sk: *const stack_st_DIST_POINT,
        out_index: *mut usize,
        p: *const DIST_POINT,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_DIST_POINT_shift__extern"]
    pub fn sk_DIST_POINT_shift(sk: *mut stack_st_DIST_POINT) -> *mut DIST_POINT;
}
unsafe extern "C" {
    #[link_name = "sk_DIST_POINT_push__extern"]
    pub fn sk_DIST_POINT_push(sk: *mut stack_st_DIST_POINT, p: *mut DIST_POINT) -> usize;
}
unsafe extern "C" {
    #[link_name = "sk_DIST_POINT_pop__extern"]
    pub fn sk_DIST_POINT_pop(sk: *mut stack_st_DIST_POINT) -> *mut DIST_POINT;
}
unsafe extern "C" {
    #[link_name = "sk_DIST_POINT_dup__extern"]
    pub fn sk_DIST_POINT_dup(sk: *const stack_st_DIST_POINT) -> *mut stack_st_DIST_POINT;
}
unsafe extern "C" {
    #[link_name = "sk_DIST_POINT_sort__extern"]
    pub fn sk_DIST_POINT_sort(sk: *mut stack_st_DIST_POINT);
}
unsafe extern "C" {
    #[link_name = "sk_DIST_POINT_sort_and_dedup__extern"]
    pub fn sk_DIST_POINT_sort_and_dedup(
        sk: *mut stack_st_DIST_POINT,
        free_func: sk_DIST_POINT_free_func,
    );
}
unsafe extern "C" {
    #[link_name = "sk_DIST_POINT_is_sorted__extern"]
    pub fn sk_DIST_POINT_is_sorted(sk: *const stack_st_DIST_POINT) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_DIST_POINT_set_cmp_func__extern"]
    pub fn sk_DIST_POINT_set_cmp_func(
        sk: *mut stack_st_DIST_POINT,
        comp: sk_DIST_POINT_cmp_func,
    ) -> sk_DIST_POINT_cmp_func;
}
unsafe extern "C" {
    #[link_name = "sk_DIST_POINT_deep_copy__extern"]
    pub fn sk_DIST_POINT_deep_copy(
        sk: *const stack_st_DIST_POINT,
        copy_func: sk_DIST_POINT_copy_func,
        free_func: sk_DIST_POINT_free_func,
    ) -> *mut stack_st_DIST_POINT;
}
unsafe extern "C" {
    /// DIST_POINT_new returns a newly-allocated, empty `DIST_POINT` object, or NULL
    /// on error.
    pub fn DIST_POINT_new() -> *mut DIST_POINT;
}
unsafe extern "C" {
    /// DIST_POINT_free releases memory associated with `dp`.
    pub fn DIST_POINT_free(dp: *mut DIST_POINT);
}
pub type CRL_DIST_POINTS = stack_st_DIST_POINT;
unsafe extern "C" {
    /// CRL_DIST_POINTS is an `ASN1_ITEM` whose ASN.1 type is CRLDistributionPoints
    /// (RFC 5280) and C type is `CRL_DIST_POINTS*`.
    pub static CRL_DIST_POINTS_it: ASN1_ITEM;
}
unsafe extern "C" {
    /// CRL_DIST_POINTS_new returns a newly-allocated, empty `CRL_DIST_POINTS`
    /// object, or NULL on error.
    pub fn CRL_DIST_POINTS_new() -> *mut CRL_DIST_POINTS;
}
unsafe extern "C" {
    /// CRL_DIST_POINTS_free releases memory associated with `crldp`.
    pub fn CRL_DIST_POINTS_free(crldp: *mut CRL_DIST_POINTS);
}
unsafe extern "C" {
    /// d2i_CRL_DIST_POINTS parses up to `len` bytes from `*inp` as a DER-encoded
    /// CRLDistributionPoints (RFC 5280), as described in `d2i_SAMPLE`.
    pub fn d2i_CRL_DIST_POINTS(
        out: *mut *mut CRL_DIST_POINTS,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut CRL_DIST_POINTS;
}
unsafe extern "C" {
    /// i2d_CRL_DIST_POINTS marshals `crldp` as a DER-encoded CRLDistributionPoints
    /// (RFC 5280), as described in `i2d_SAMPLE`.
    pub fn i2d_CRL_DIST_POINTS(
        crldp: *const CRL_DIST_POINTS,
        outp: *mut *mut u8,
    ) -> ::core::ffi::c_int;
}
/// A ISSUING_DIST_POINT_st, aka `ISSUING_DIST_POINT`, represents a
/// IssuingDistributionPoint structure (RFC 5280).
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct ISSUING_DIST_POINT_st {
    pub distpoint: *mut DIST_POINT_NAME,
    pub onlyuser: ASN1_BOOLEAN,
    pub onlyCA: ASN1_BOOLEAN,
    pub onlysomereasons: *mut ASN1_BIT_STRING,
    pub indirectCRL: ASN1_BOOLEAN,
    pub onlyattr: ASN1_BOOLEAN,
}
unsafe extern "C" {
    /// ISSUING_DIST_POINT is an `ASN1_ITEM` whose ASN.1 type is
    /// IssuingDistributionPoint (RFC 5280) and C type is `ISSUING_DIST_POINT*`.
    pub static ISSUING_DIST_POINT_it: ASN1_ITEM;
}
unsafe extern "C" {
    /// ISSUING_DIST_POINT_new returns a newly-allocated, empty `ISSUING_DIST_POINT`
    /// object, or NULL on error.
    pub fn ISSUING_DIST_POINT_new() -> *mut ISSUING_DIST_POINT;
}
unsafe extern "C" {
    /// ISSUING_DIST_POINT_free releases memory associated with `idp`.
    pub fn ISSUING_DIST_POINT_free(idp: *mut ISSUING_DIST_POINT);
}
unsafe extern "C" {
    /// d2i_ISSUING_DIST_POINT parses up to `len` bytes from `*inp` as a DER-encoded
    /// IssuingDistributionPoint (RFC 5280), as described in `d2i_SAMPLE`.
    pub fn d2i_ISSUING_DIST_POINT(
        out: *mut *mut ISSUING_DIST_POINT,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut ISSUING_DIST_POINT;
}
unsafe extern "C" {
    /// i2d_ISSUING_DIST_POINT marshals `idp` as a DER-encoded
    /// IssuingDistributionPoint (RFC 5280), as described in `i2d_SAMPLE`.
    pub fn i2d_ISSUING_DIST_POINT(
        idp: *const ISSUING_DIST_POINT,
        outp: *mut *mut u8,
    ) -> ::core::ffi::c_int;
}
/// A NOTICEREF represents a NoticeReference structure (RFC 5280).
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct NOTICEREF_st {
    pub organization: *mut ASN1_STRING,
    pub noticenos: *mut stack_st_ASN1_INTEGER,
}
/// A NOTICEREF represents a NoticeReference structure (RFC 5280).
pub type NOTICEREF = NOTICEREF_st;
unsafe extern "C" {
    /// NOTICEREF_new returns a newly-allocated, empty `NOTICEREF` object, or NULL
    /// on error.
    pub fn NOTICEREF_new() -> *mut NOTICEREF;
}
unsafe extern "C" {
    /// NOTICEREF_free releases memory associated with `ref`.
    pub fn NOTICEREF_free(ref_: *mut NOTICEREF);
}
/// A USERNOTICE represents a UserNotice structure (RFC 5280).
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct USERNOTICE_st {
    pub noticeref: *mut NOTICEREF,
    pub exptext: *mut ASN1_STRING,
}
/// A USERNOTICE represents a UserNotice structure (RFC 5280).
pub type USERNOTICE = USERNOTICE_st;
unsafe extern "C" {
    /// USERNOTICE_new returns a newly-allocated, empty `USERNOTICE` object, or NULL
    /// on error.
    pub fn USERNOTICE_new() -> *mut USERNOTICE;
}
unsafe extern "C" {
    /// USERNOTICE_free releases memory associated with `notice`.
    pub fn USERNOTICE_free(notice: *mut USERNOTICE);
}
/// A POLICYQUALINFO represents a PolicyQualifierInfo structure (RFC 5280). `d`
/// contains the qualifier field of the PolicyQualifierInfo. Its type is
/// determined by `pqualid`. If `pqualid` is `NID_id_qt_cps`, `d` must be
/// `cpsuri`. If `pqualid` is `NID_id_qt_unotice`, `d` must be `usernotice`.
/// Otherwise, `d` must be `other`.
///
/// WARNING: `pqualid` and `d` must be kept consistent. An inconsistency will
/// result in a potentially exploitable memory error.
#[repr(C)]
#[derive(Copy, Clone)]
pub struct POLICYQUALINFO_st {
    pub pqualid: *mut ASN1_OBJECT,
    pub d: POLICYQUALINFO_st__bindgen_ty_1,
}
#[repr(C)]
#[derive(Copy, Clone)]
pub union POLICYQUALINFO_st__bindgen_ty_1 {
    pub cpsuri: *mut ASN1_IA5STRING,
    pub usernotice: *mut USERNOTICE,
    pub other: *mut ASN1_TYPE,
}
/// A POLICYQUALINFO represents a PolicyQualifierInfo structure (RFC 5280). `d`
/// contains the qualifier field of the PolicyQualifierInfo. Its type is
/// determined by `pqualid`. If `pqualid` is `NID_id_qt_cps`, `d` must be
/// `cpsuri`. If `pqualid` is `NID_id_qt_unotice`, `d` must be `usernotice`.
/// Otherwise, `d` must be `other`.
///
/// WARNING: `pqualid` and `d` must be kept consistent. An inconsistency will
/// result in a potentially exploitable memory error.
pub type POLICYQUALINFO = POLICYQUALINFO_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct stack_st_POLICYQUALINFO {
    _unused: [u8; 0],
}
/// We also disable -Wcast-qual. As part of this C-based type erasure setup,  \
/// the wrapper macros need to cast away const in places. In C++, const_cast  \
/// suppresses the warning, but it seemingly cannot be suppressed in C.
pub type sk_POLICYQUALINFO_free_func =
    ::core::option::Option<unsafe extern "C" fn(arg1: *mut POLICYQUALINFO)>;
pub type sk_POLICYQUALINFO_copy_func = ::core::option::Option<
    unsafe extern "C" fn(arg1: *const POLICYQUALINFO) -> *mut POLICYQUALINFO,
>;
pub type sk_POLICYQUALINFO_cmp_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *const *const POLICYQUALINFO,
        arg2: *const *const POLICYQUALINFO,
    ) -> ::core::ffi::c_int,
>;
pub type sk_POLICYQUALINFO_delete_if_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *mut POLICYQUALINFO,
        arg2: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int,
>;
unsafe extern "C" {
    #[link_name = "sk_POLICYQUALINFO_call_free_func__extern"]
    pub fn sk_POLICYQUALINFO_call_free_func(
        free_func: OPENSSL_sk_free_func,
        ptr: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    #[link_name = "sk_POLICYQUALINFO_call_copy_func__extern"]
    pub fn sk_POLICYQUALINFO_call_copy_func(
        copy_func: OPENSSL_sk_copy_func,
        ptr: *const ::core::ffi::c_void,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    #[link_name = "sk_POLICYQUALINFO_call_cmp_func__extern"]
    pub fn sk_POLICYQUALINFO_call_cmp_func(
        cmp_func: OPENSSL_sk_cmp_func,
        a: *const ::core::ffi::c_void,
        b: *const ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_POLICYQUALINFO_call_delete_if_func__extern"]
    pub fn sk_POLICYQUALINFO_call_delete_if_func(
        func: OPENSSL_sk_delete_if_func,
        obj: *mut ::core::ffi::c_void,
        data: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_POLICYQUALINFO_new__extern"]
    pub fn sk_POLICYQUALINFO_new(comp: sk_POLICYQUALINFO_cmp_func) -> *mut stack_st_POLICYQUALINFO;
}
unsafe extern "C" {
    #[link_name = "sk_POLICYQUALINFO_new_null__extern"]
    pub fn sk_POLICYQUALINFO_new_null() -> *mut stack_st_POLICYQUALINFO;
}
unsafe extern "C" {
    #[link_name = "sk_POLICYQUALINFO_num__extern"]
    pub fn sk_POLICYQUALINFO_num(sk: *const stack_st_POLICYQUALINFO) -> usize;
}
unsafe extern "C" {
    #[link_name = "sk_POLICYQUALINFO_zero__extern"]
    pub fn sk_POLICYQUALINFO_zero(sk: *mut stack_st_POLICYQUALINFO);
}
unsafe extern "C" {
    #[link_name = "sk_POLICYQUALINFO_value__extern"]
    pub fn sk_POLICYQUALINFO_value(
        sk: *const stack_st_POLICYQUALINFO,
        i: usize,
    ) -> *mut POLICYQUALINFO;
}
unsafe extern "C" {
    #[link_name = "sk_POLICYQUALINFO_set__extern"]
    pub fn sk_POLICYQUALINFO_set(
        sk: *mut stack_st_POLICYQUALINFO,
        i: usize,
        p: *mut POLICYQUALINFO,
    ) -> *mut POLICYQUALINFO;
}
unsafe extern "C" {
    #[link_name = "sk_POLICYQUALINFO_free__extern"]
    pub fn sk_POLICYQUALINFO_free(sk: *mut stack_st_POLICYQUALINFO);
}
unsafe extern "C" {
    #[link_name = "sk_POLICYQUALINFO_pop_free__extern"]
    pub fn sk_POLICYQUALINFO_pop_free(
        sk: *mut stack_st_POLICYQUALINFO,
        free_func: sk_POLICYQUALINFO_free_func,
    );
}
unsafe extern "C" {
    #[link_name = "sk_POLICYQUALINFO_insert__extern"]
    pub fn sk_POLICYQUALINFO_insert(
        sk: *mut stack_st_POLICYQUALINFO,
        p: *mut POLICYQUALINFO,
        where_: usize,
    ) -> usize;
}
unsafe extern "C" {
    #[link_name = "sk_POLICYQUALINFO_delete__extern"]
    pub fn sk_POLICYQUALINFO_delete(
        sk: *mut stack_st_POLICYQUALINFO,
        where_: usize,
    ) -> *mut POLICYQUALINFO;
}
unsafe extern "C" {
    #[link_name = "sk_POLICYQUALINFO_delete_ptr__extern"]
    pub fn sk_POLICYQUALINFO_delete_ptr(
        sk: *mut stack_st_POLICYQUALINFO,
        p: *const POLICYQUALINFO,
    ) -> *mut POLICYQUALINFO;
}
unsafe extern "C" {
    #[link_name = "sk_POLICYQUALINFO_delete_if__extern"]
    pub fn sk_POLICYQUALINFO_delete_if(
        sk: *mut stack_st_POLICYQUALINFO,
        func: sk_POLICYQUALINFO_delete_if_func,
        data: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    #[link_name = "sk_POLICYQUALINFO_find__extern"]
    pub fn sk_POLICYQUALINFO_find(
        sk: *const stack_st_POLICYQUALINFO,
        out_index: *mut usize,
        p: *const POLICYQUALINFO,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_POLICYQUALINFO_shift__extern"]
    pub fn sk_POLICYQUALINFO_shift(sk: *mut stack_st_POLICYQUALINFO) -> *mut POLICYQUALINFO;
}
unsafe extern "C" {
    #[link_name = "sk_POLICYQUALINFO_push__extern"]
    pub fn sk_POLICYQUALINFO_push(
        sk: *mut stack_st_POLICYQUALINFO,
        p: *mut POLICYQUALINFO,
    ) -> usize;
}
unsafe extern "C" {
    #[link_name = "sk_POLICYQUALINFO_pop__extern"]
    pub fn sk_POLICYQUALINFO_pop(sk: *mut stack_st_POLICYQUALINFO) -> *mut POLICYQUALINFO;
}
unsafe extern "C" {
    #[link_name = "sk_POLICYQUALINFO_dup__extern"]
    pub fn sk_POLICYQUALINFO_dup(
        sk: *const stack_st_POLICYQUALINFO,
    ) -> *mut stack_st_POLICYQUALINFO;
}
unsafe extern "C" {
    #[link_name = "sk_POLICYQUALINFO_sort__extern"]
    pub fn sk_POLICYQUALINFO_sort(sk: *mut stack_st_POLICYQUALINFO);
}
unsafe extern "C" {
    #[link_name = "sk_POLICYQUALINFO_sort_and_dedup__extern"]
    pub fn sk_POLICYQUALINFO_sort_and_dedup(
        sk: *mut stack_st_POLICYQUALINFO,
        free_func: sk_POLICYQUALINFO_free_func,
    );
}
unsafe extern "C" {
    #[link_name = "sk_POLICYQUALINFO_is_sorted__extern"]
    pub fn sk_POLICYQUALINFO_is_sorted(sk: *const stack_st_POLICYQUALINFO) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_POLICYQUALINFO_set_cmp_func__extern"]
    pub fn sk_POLICYQUALINFO_set_cmp_func(
        sk: *mut stack_st_POLICYQUALINFO,
        comp: sk_POLICYQUALINFO_cmp_func,
    ) -> sk_POLICYQUALINFO_cmp_func;
}
unsafe extern "C" {
    #[link_name = "sk_POLICYQUALINFO_deep_copy__extern"]
    pub fn sk_POLICYQUALINFO_deep_copy(
        sk: *const stack_st_POLICYQUALINFO,
        copy_func: sk_POLICYQUALINFO_copy_func,
        free_func: sk_POLICYQUALINFO_free_func,
    ) -> *mut stack_st_POLICYQUALINFO;
}
unsafe extern "C" {
    /// POLICYQUALINFO_new returns a newly-allocated, empty `POLICYQUALINFO` object,
    /// or NULL on error.
    pub fn POLICYQUALINFO_new() -> *mut POLICYQUALINFO;
}
unsafe extern "C" {
    /// POLICYQUALINFO_free releases memory associated with `info`.
    pub fn POLICYQUALINFO_free(info: *mut POLICYQUALINFO);
}
/// A POLICYINFO represents a PolicyInformation structure (RFC 5280).
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct POLICYINFO_st {
    pub policyid: *mut ASN1_OBJECT,
    pub qualifiers: *mut stack_st_POLICYQUALINFO,
}
/// A POLICYINFO represents a PolicyInformation structure (RFC 5280).
pub type POLICYINFO = POLICYINFO_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct stack_st_POLICYINFO {
    _unused: [u8; 0],
}
/// We also disable -Wcast-qual. As part of this C-based type erasure setup,  \
/// the wrapper macros need to cast away const in places. In C++, const_cast  \
/// suppresses the warning, but it seemingly cannot be suppressed in C.
pub type sk_POLICYINFO_free_func =
    ::core::option::Option<unsafe extern "C" fn(arg1: *mut POLICYINFO)>;
pub type sk_POLICYINFO_copy_func =
    ::core::option::Option<unsafe extern "C" fn(arg1: *const POLICYINFO) -> *mut POLICYINFO>;
pub type sk_POLICYINFO_cmp_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *const *const POLICYINFO,
        arg2: *const *const POLICYINFO,
    ) -> ::core::ffi::c_int,
>;
pub type sk_POLICYINFO_delete_if_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *mut POLICYINFO,
        arg2: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int,
>;
unsafe extern "C" {
    #[link_name = "sk_POLICYINFO_call_free_func__extern"]
    pub fn sk_POLICYINFO_call_free_func(
        free_func: OPENSSL_sk_free_func,
        ptr: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    #[link_name = "sk_POLICYINFO_call_copy_func__extern"]
    pub fn sk_POLICYINFO_call_copy_func(
        copy_func: OPENSSL_sk_copy_func,
        ptr: *const ::core::ffi::c_void,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    #[link_name = "sk_POLICYINFO_call_cmp_func__extern"]
    pub fn sk_POLICYINFO_call_cmp_func(
        cmp_func: OPENSSL_sk_cmp_func,
        a: *const ::core::ffi::c_void,
        b: *const ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_POLICYINFO_call_delete_if_func__extern"]
    pub fn sk_POLICYINFO_call_delete_if_func(
        func: OPENSSL_sk_delete_if_func,
        obj: *mut ::core::ffi::c_void,
        data: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_POLICYINFO_new__extern"]
    pub fn sk_POLICYINFO_new(comp: sk_POLICYINFO_cmp_func) -> *mut stack_st_POLICYINFO;
}
unsafe extern "C" {
    #[link_name = "sk_POLICYINFO_new_null__extern"]
    pub fn sk_POLICYINFO_new_null() -> *mut stack_st_POLICYINFO;
}
unsafe extern "C" {
    #[link_name = "sk_POLICYINFO_num__extern"]
    pub fn sk_POLICYINFO_num(sk: *const stack_st_POLICYINFO) -> usize;
}
unsafe extern "C" {
    #[link_name = "sk_POLICYINFO_zero__extern"]
    pub fn sk_POLICYINFO_zero(sk: *mut stack_st_POLICYINFO);
}
unsafe extern "C" {
    #[link_name = "sk_POLICYINFO_value__extern"]
    pub fn sk_POLICYINFO_value(sk: *const stack_st_POLICYINFO, i: usize) -> *mut POLICYINFO;
}
unsafe extern "C" {
    #[link_name = "sk_POLICYINFO_set__extern"]
    pub fn sk_POLICYINFO_set(
        sk: *mut stack_st_POLICYINFO,
        i: usize,
        p: *mut POLICYINFO,
    ) -> *mut POLICYINFO;
}
unsafe extern "C" {
    #[link_name = "sk_POLICYINFO_free__extern"]
    pub fn sk_POLICYINFO_free(sk: *mut stack_st_POLICYINFO);
}
unsafe extern "C" {
    #[link_name = "sk_POLICYINFO_pop_free__extern"]
    pub fn sk_POLICYINFO_pop_free(sk: *mut stack_st_POLICYINFO, free_func: sk_POLICYINFO_free_func);
}
unsafe extern "C" {
    #[link_name = "sk_POLICYINFO_insert__extern"]
    pub fn sk_POLICYINFO_insert(
        sk: *mut stack_st_POLICYINFO,
        p: *mut POLICYINFO,
        where_: usize,
    ) -> usize;
}
unsafe extern "C" {
    #[link_name = "sk_POLICYINFO_delete__extern"]
    pub fn sk_POLICYINFO_delete(sk: *mut stack_st_POLICYINFO, where_: usize) -> *mut POLICYINFO;
}
unsafe extern "C" {
    #[link_name = "sk_POLICYINFO_delete_ptr__extern"]
    pub fn sk_POLICYINFO_delete_ptr(
        sk: *mut stack_st_POLICYINFO,
        p: *const POLICYINFO,
    ) -> *mut POLICYINFO;
}
unsafe extern "C" {
    #[link_name = "sk_POLICYINFO_delete_if__extern"]
    pub fn sk_POLICYINFO_delete_if(
        sk: *mut stack_st_POLICYINFO,
        func: sk_POLICYINFO_delete_if_func,
        data: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    #[link_name = "sk_POLICYINFO_find__extern"]
    pub fn sk_POLICYINFO_find(
        sk: *const stack_st_POLICYINFO,
        out_index: *mut usize,
        p: *const POLICYINFO,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_POLICYINFO_shift__extern"]
    pub fn sk_POLICYINFO_shift(sk: *mut stack_st_POLICYINFO) -> *mut POLICYINFO;
}
unsafe extern "C" {
    #[link_name = "sk_POLICYINFO_push__extern"]
    pub fn sk_POLICYINFO_push(sk: *mut stack_st_POLICYINFO, p: *mut POLICYINFO) -> usize;
}
unsafe extern "C" {
    #[link_name = "sk_POLICYINFO_pop__extern"]
    pub fn sk_POLICYINFO_pop(sk: *mut stack_st_POLICYINFO) -> *mut POLICYINFO;
}
unsafe extern "C" {
    #[link_name = "sk_POLICYINFO_dup__extern"]
    pub fn sk_POLICYINFO_dup(sk: *const stack_st_POLICYINFO) -> *mut stack_st_POLICYINFO;
}
unsafe extern "C" {
    #[link_name = "sk_POLICYINFO_sort__extern"]
    pub fn sk_POLICYINFO_sort(sk: *mut stack_st_POLICYINFO);
}
unsafe extern "C" {
    #[link_name = "sk_POLICYINFO_sort_and_dedup__extern"]
    pub fn sk_POLICYINFO_sort_and_dedup(
        sk: *mut stack_st_POLICYINFO,
        free_func: sk_POLICYINFO_free_func,
    );
}
unsafe extern "C" {
    #[link_name = "sk_POLICYINFO_is_sorted__extern"]
    pub fn sk_POLICYINFO_is_sorted(sk: *const stack_st_POLICYINFO) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_POLICYINFO_set_cmp_func__extern"]
    pub fn sk_POLICYINFO_set_cmp_func(
        sk: *mut stack_st_POLICYINFO,
        comp: sk_POLICYINFO_cmp_func,
    ) -> sk_POLICYINFO_cmp_func;
}
unsafe extern "C" {
    #[link_name = "sk_POLICYINFO_deep_copy__extern"]
    pub fn sk_POLICYINFO_deep_copy(
        sk: *const stack_st_POLICYINFO,
        copy_func: sk_POLICYINFO_copy_func,
        free_func: sk_POLICYINFO_free_func,
    ) -> *mut stack_st_POLICYINFO;
}
unsafe extern "C" {
    /// POLICYINFO_new returns a newly-allocated, empty `POLICYINFO` object, or NULL
    /// on error.
    pub fn POLICYINFO_new() -> *mut POLICYINFO;
}
unsafe extern "C" {
    /// POLICYINFO_free releases memory associated with `info`.
    pub fn POLICYINFO_free(info: *mut POLICYINFO);
}
pub type CERTIFICATEPOLICIES = stack_st_POLICYINFO;
unsafe extern "C" {
    /// CERTIFICATEPOLICIES is an `ASN1_ITEM` whose ASN.1 type is CertificatePolicies
    /// (RFC 5280) and C type is `STACK_OF(POLICYINFO)*`, or `CERTIFICATEPOLICIES*`.
    pub static CERTIFICATEPOLICIES_it: ASN1_ITEM;
}
unsafe extern "C" {
    /// CERTIFICATEPOLICIES_new returns a newly-allocated, empty
    /// `CERTIFICATEPOLICIES` object, or NULL on error.
    pub fn CERTIFICATEPOLICIES_new() -> *mut CERTIFICATEPOLICIES;
}
unsafe extern "C" {
    /// CERTIFICATEPOLICIES_free releases memory associated with `policies`.
    pub fn CERTIFICATEPOLICIES_free(policies: *mut CERTIFICATEPOLICIES);
}
unsafe extern "C" {
    /// d2i_CERTIFICATEPOLICIES parses up to `len` bytes from `*inp` as a DER-encoded
    /// CertificatePolicies (RFC 5280), as described in `d2i_SAMPLE`.
    pub fn d2i_CERTIFICATEPOLICIES(
        out: *mut *mut CERTIFICATEPOLICIES,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut CERTIFICATEPOLICIES;
}
unsafe extern "C" {
    /// i2d_CERTIFICATEPOLICIES marshals `policies` as a DER-encoded
    /// CertificatePolicies (RFC 5280), as described in `i2d_SAMPLE`.
    pub fn i2d_CERTIFICATEPOLICIES(
        policies: *const CERTIFICATEPOLICIES,
        outp: *mut *mut u8,
    ) -> ::core::ffi::c_int;
}
/// A POLICY_MAPPING represents an individual element of a PolicyMappings
/// structure (RFC 5280).
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct POLICY_MAPPING_st {
    pub issuerDomainPolicy: *mut ASN1_OBJECT,
    pub subjectDomainPolicy: *mut ASN1_OBJECT,
}
/// A POLICY_MAPPING represents an individual element of a PolicyMappings
/// structure (RFC 5280).
pub type POLICY_MAPPING = POLICY_MAPPING_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct stack_st_POLICY_MAPPING {
    _unused: [u8; 0],
}
/// We also disable -Wcast-qual. As part of this C-based type erasure setup,  \
/// the wrapper macros need to cast away const in places. In C++, const_cast  \
/// suppresses the warning, but it seemingly cannot be suppressed in C.
pub type sk_POLICY_MAPPING_free_func =
    ::core::option::Option<unsafe extern "C" fn(arg1: *mut POLICY_MAPPING)>;
pub type sk_POLICY_MAPPING_copy_func = ::core::option::Option<
    unsafe extern "C" fn(arg1: *const POLICY_MAPPING) -> *mut POLICY_MAPPING,
>;
pub type sk_POLICY_MAPPING_cmp_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *const *const POLICY_MAPPING,
        arg2: *const *const POLICY_MAPPING,
    ) -> ::core::ffi::c_int,
>;
pub type sk_POLICY_MAPPING_delete_if_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *mut POLICY_MAPPING,
        arg2: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int,
>;
unsafe extern "C" {
    #[link_name = "sk_POLICY_MAPPING_call_free_func__extern"]
    pub fn sk_POLICY_MAPPING_call_free_func(
        free_func: OPENSSL_sk_free_func,
        ptr: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    #[link_name = "sk_POLICY_MAPPING_call_copy_func__extern"]
    pub fn sk_POLICY_MAPPING_call_copy_func(
        copy_func: OPENSSL_sk_copy_func,
        ptr: *const ::core::ffi::c_void,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    #[link_name = "sk_POLICY_MAPPING_call_cmp_func__extern"]
    pub fn sk_POLICY_MAPPING_call_cmp_func(
        cmp_func: OPENSSL_sk_cmp_func,
        a: *const ::core::ffi::c_void,
        b: *const ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_POLICY_MAPPING_call_delete_if_func__extern"]
    pub fn sk_POLICY_MAPPING_call_delete_if_func(
        func: OPENSSL_sk_delete_if_func,
        obj: *mut ::core::ffi::c_void,
        data: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_POLICY_MAPPING_new__extern"]
    pub fn sk_POLICY_MAPPING_new(comp: sk_POLICY_MAPPING_cmp_func) -> *mut stack_st_POLICY_MAPPING;
}
unsafe extern "C" {
    #[link_name = "sk_POLICY_MAPPING_new_null__extern"]
    pub fn sk_POLICY_MAPPING_new_null() -> *mut stack_st_POLICY_MAPPING;
}
unsafe extern "C" {
    #[link_name = "sk_POLICY_MAPPING_num__extern"]
    pub fn sk_POLICY_MAPPING_num(sk: *const stack_st_POLICY_MAPPING) -> usize;
}
unsafe extern "C" {
    #[link_name = "sk_POLICY_MAPPING_zero__extern"]
    pub fn sk_POLICY_MAPPING_zero(sk: *mut stack_st_POLICY_MAPPING);
}
unsafe extern "C" {
    #[link_name = "sk_POLICY_MAPPING_value__extern"]
    pub fn sk_POLICY_MAPPING_value(
        sk: *const stack_st_POLICY_MAPPING,
        i: usize,
    ) -> *mut POLICY_MAPPING;
}
unsafe extern "C" {
    #[link_name = "sk_POLICY_MAPPING_set__extern"]
    pub fn sk_POLICY_MAPPING_set(
        sk: *mut stack_st_POLICY_MAPPING,
        i: usize,
        p: *mut POLICY_MAPPING,
    ) -> *mut POLICY_MAPPING;
}
unsafe extern "C" {
    #[link_name = "sk_POLICY_MAPPING_free__extern"]
    pub fn sk_POLICY_MAPPING_free(sk: *mut stack_st_POLICY_MAPPING);
}
unsafe extern "C" {
    #[link_name = "sk_POLICY_MAPPING_pop_free__extern"]
    pub fn sk_POLICY_MAPPING_pop_free(
        sk: *mut stack_st_POLICY_MAPPING,
        free_func: sk_POLICY_MAPPING_free_func,
    );
}
unsafe extern "C" {
    #[link_name = "sk_POLICY_MAPPING_insert__extern"]
    pub fn sk_POLICY_MAPPING_insert(
        sk: *mut stack_st_POLICY_MAPPING,
        p: *mut POLICY_MAPPING,
        where_: usize,
    ) -> usize;
}
unsafe extern "C" {
    #[link_name = "sk_POLICY_MAPPING_delete__extern"]
    pub fn sk_POLICY_MAPPING_delete(
        sk: *mut stack_st_POLICY_MAPPING,
        where_: usize,
    ) -> *mut POLICY_MAPPING;
}
unsafe extern "C" {
    #[link_name = "sk_POLICY_MAPPING_delete_ptr__extern"]
    pub fn sk_POLICY_MAPPING_delete_ptr(
        sk: *mut stack_st_POLICY_MAPPING,
        p: *const POLICY_MAPPING,
    ) -> *mut POLICY_MAPPING;
}
unsafe extern "C" {
    #[link_name = "sk_POLICY_MAPPING_delete_if__extern"]
    pub fn sk_POLICY_MAPPING_delete_if(
        sk: *mut stack_st_POLICY_MAPPING,
        func: sk_POLICY_MAPPING_delete_if_func,
        data: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    #[link_name = "sk_POLICY_MAPPING_find__extern"]
    pub fn sk_POLICY_MAPPING_find(
        sk: *const stack_st_POLICY_MAPPING,
        out_index: *mut usize,
        p: *const POLICY_MAPPING,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_POLICY_MAPPING_shift__extern"]
    pub fn sk_POLICY_MAPPING_shift(sk: *mut stack_st_POLICY_MAPPING) -> *mut POLICY_MAPPING;
}
unsafe extern "C" {
    #[link_name = "sk_POLICY_MAPPING_push__extern"]
    pub fn sk_POLICY_MAPPING_push(
        sk: *mut stack_st_POLICY_MAPPING,
        p: *mut POLICY_MAPPING,
    ) -> usize;
}
unsafe extern "C" {
    #[link_name = "sk_POLICY_MAPPING_pop__extern"]
    pub fn sk_POLICY_MAPPING_pop(sk: *mut stack_st_POLICY_MAPPING) -> *mut POLICY_MAPPING;
}
unsafe extern "C" {
    #[link_name = "sk_POLICY_MAPPING_dup__extern"]
    pub fn sk_POLICY_MAPPING_dup(
        sk: *const stack_st_POLICY_MAPPING,
    ) -> *mut stack_st_POLICY_MAPPING;
}
unsafe extern "C" {
    #[link_name = "sk_POLICY_MAPPING_sort__extern"]
    pub fn sk_POLICY_MAPPING_sort(sk: *mut stack_st_POLICY_MAPPING);
}
unsafe extern "C" {
    #[link_name = "sk_POLICY_MAPPING_sort_and_dedup__extern"]
    pub fn sk_POLICY_MAPPING_sort_and_dedup(
        sk: *mut stack_st_POLICY_MAPPING,
        free_func: sk_POLICY_MAPPING_free_func,
    );
}
unsafe extern "C" {
    #[link_name = "sk_POLICY_MAPPING_is_sorted__extern"]
    pub fn sk_POLICY_MAPPING_is_sorted(sk: *const stack_st_POLICY_MAPPING) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_POLICY_MAPPING_set_cmp_func__extern"]
    pub fn sk_POLICY_MAPPING_set_cmp_func(
        sk: *mut stack_st_POLICY_MAPPING,
        comp: sk_POLICY_MAPPING_cmp_func,
    ) -> sk_POLICY_MAPPING_cmp_func;
}
unsafe extern "C" {
    #[link_name = "sk_POLICY_MAPPING_deep_copy__extern"]
    pub fn sk_POLICY_MAPPING_deep_copy(
        sk: *const stack_st_POLICY_MAPPING,
        copy_func: sk_POLICY_MAPPING_copy_func,
        free_func: sk_POLICY_MAPPING_free_func,
    ) -> *mut stack_st_POLICY_MAPPING;
}
unsafe extern "C" {
    /// POLICY_MAPPING_new returns a newly-allocated, empty `POLICY_MAPPING` object,
    /// or NULL on error.
    pub fn POLICY_MAPPING_new() -> *mut POLICY_MAPPING;
}
unsafe extern "C" {
    /// POLICY_MAPPING_free releases memory associated with `mapping`.
    pub fn POLICY_MAPPING_free(mapping: *mut POLICY_MAPPING);
}
pub type POLICY_MAPPINGS = stack_st_POLICY_MAPPING;
unsafe extern "C" {
    /// POLICY_MAPPINGS is an `ASN1_ITEM` whose ASN.1 type is PolicyMappings (RFC
    /// 5280) and C type is `STACK_OF(POLICY_MAPPING)*`, or `POLICY_MAPPINGS*`.
    pub static POLICY_MAPPINGS_it: ASN1_ITEM;
}
/// A POLICY_CONSTRAINTS represents a PolicyConstraints structure (RFC 5280).
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct POLICY_CONSTRAINTS_st {
    pub requireExplicitPolicy: *mut ASN1_INTEGER,
    pub inhibitPolicyMapping: *mut ASN1_INTEGER,
}
/// A POLICY_CONSTRAINTS represents a PolicyConstraints structure (RFC 5280).
pub type POLICY_CONSTRAINTS = POLICY_CONSTRAINTS_st;
unsafe extern "C" {
    /// POLICY_CONSTRAINTS is an `ASN1_ITEM` whose ASN.1 type is PolicyConstraints
    /// (RFC 5280) and C type is `POLICY_CONSTRAINTS*`.
    pub static POLICY_CONSTRAINTS_it: ASN1_ITEM;
}
unsafe extern "C" {
    /// POLICY_CONSTRAINTS_new returns a newly-allocated, empty `POLICY_CONSTRAINTS`
    /// object, or NULL on error.
    pub fn POLICY_CONSTRAINTS_new() -> *mut POLICY_CONSTRAINTS;
}
unsafe extern "C" {
    /// POLICY_CONSTRAINTS_free releases memory associated with `pcons`.
    pub fn POLICY_CONSTRAINTS_free(pcons: *mut POLICY_CONSTRAINTS);
}
/// Algorithm identifiers.
///
/// An `X509_ALGOR` represents an AlgorithmIdentifier structure, used in X.509
/// to represent signature algorithms and public key algorithms.
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct stack_st_X509_ALGOR {
    _unused: [u8; 0],
}
/// Algorithm identifiers.
///
/// An `X509_ALGOR` represents an AlgorithmIdentifier structure, used in X.509
/// to represent signature algorithms and public key algorithms.
pub type sk_X509_ALGOR_free_func =
    ::core::option::Option<unsafe extern "C" fn(arg1: *mut X509_ALGOR)>;
/// Algorithm identifiers.
///
/// An `X509_ALGOR` represents an AlgorithmIdentifier structure, used in X.509
/// to represent signature algorithms and public key algorithms.
pub type sk_X509_ALGOR_copy_func =
    ::core::option::Option<unsafe extern "C" fn(arg1: *const X509_ALGOR) -> *mut X509_ALGOR>;
/// Algorithm identifiers.
///
/// An `X509_ALGOR` represents an AlgorithmIdentifier structure, used in X.509
/// to represent signature algorithms and public key algorithms.
pub type sk_X509_ALGOR_cmp_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *const *const X509_ALGOR,
        arg2: *const *const X509_ALGOR,
    ) -> ::core::ffi::c_int,
>;
/// Algorithm identifiers.
///
/// An `X509_ALGOR` represents an AlgorithmIdentifier structure, used in X.509
/// to represent signature algorithms and public key algorithms.
pub type sk_X509_ALGOR_delete_if_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *mut X509_ALGOR,
        arg2: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int,
>;
unsafe extern "C" {
    /// Algorithm identifiers.
    ///
    /// An `X509_ALGOR` represents an AlgorithmIdentifier structure, used in X.509
    /// to represent signature algorithms and public key algorithms.
    #[link_name = "sk_X509_ALGOR_call_free_func__extern"]
    pub fn sk_X509_ALGOR_call_free_func(
        free_func: OPENSSL_sk_free_func,
        ptr: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    /// Algorithm identifiers.
    ///
    /// An `X509_ALGOR` represents an AlgorithmIdentifier structure, used in X.509
    /// to represent signature algorithms and public key algorithms.
    #[link_name = "sk_X509_ALGOR_call_copy_func__extern"]
    pub fn sk_X509_ALGOR_call_copy_func(
        copy_func: OPENSSL_sk_copy_func,
        ptr: *const ::core::ffi::c_void,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    /// Algorithm identifiers.
    ///
    /// An `X509_ALGOR` represents an AlgorithmIdentifier structure, used in X.509
    /// to represent signature algorithms and public key algorithms.
    #[link_name = "sk_X509_ALGOR_call_cmp_func__extern"]
    pub fn sk_X509_ALGOR_call_cmp_func(
        cmp_func: OPENSSL_sk_cmp_func,
        a: *const ::core::ffi::c_void,
        b: *const ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Algorithm identifiers.
    ///
    /// An `X509_ALGOR` represents an AlgorithmIdentifier structure, used in X.509
    /// to represent signature algorithms and public key algorithms.
    #[link_name = "sk_X509_ALGOR_call_delete_if_func__extern"]
    pub fn sk_X509_ALGOR_call_delete_if_func(
        func: OPENSSL_sk_delete_if_func,
        obj: *mut ::core::ffi::c_void,
        data: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Algorithm identifiers.
    ///
    /// An `X509_ALGOR` represents an AlgorithmIdentifier structure, used in X.509
    /// to represent signature algorithms and public key algorithms.
    #[link_name = "sk_X509_ALGOR_new__extern"]
    pub fn sk_X509_ALGOR_new(comp: sk_X509_ALGOR_cmp_func) -> *mut stack_st_X509_ALGOR;
}
unsafe extern "C" {
    /// Algorithm identifiers.
    ///
    /// An `X509_ALGOR` represents an AlgorithmIdentifier structure, used in X.509
    /// to represent signature algorithms and public key algorithms.
    #[link_name = "sk_X509_ALGOR_new_null__extern"]
    pub fn sk_X509_ALGOR_new_null() -> *mut stack_st_X509_ALGOR;
}
unsafe extern "C" {
    /// Algorithm identifiers.
    ///
    /// An `X509_ALGOR` represents an AlgorithmIdentifier structure, used in X.509
    /// to represent signature algorithms and public key algorithms.
    #[link_name = "sk_X509_ALGOR_num__extern"]
    pub fn sk_X509_ALGOR_num(sk: *const stack_st_X509_ALGOR) -> usize;
}
unsafe extern "C" {
    /// Algorithm identifiers.
    ///
    /// An `X509_ALGOR` represents an AlgorithmIdentifier structure, used in X.509
    /// to represent signature algorithms and public key algorithms.
    #[link_name = "sk_X509_ALGOR_zero__extern"]
    pub fn sk_X509_ALGOR_zero(sk: *mut stack_st_X509_ALGOR);
}
unsafe extern "C" {
    /// Algorithm identifiers.
    ///
    /// An `X509_ALGOR` represents an AlgorithmIdentifier structure, used in X.509
    /// to represent signature algorithms and public key algorithms.
    #[link_name = "sk_X509_ALGOR_value__extern"]
    pub fn sk_X509_ALGOR_value(sk: *const stack_st_X509_ALGOR, i: usize) -> *mut X509_ALGOR;
}
unsafe extern "C" {
    /// Algorithm identifiers.
    ///
    /// An `X509_ALGOR` represents an AlgorithmIdentifier structure, used in X.509
    /// to represent signature algorithms and public key algorithms.
    #[link_name = "sk_X509_ALGOR_set__extern"]
    pub fn sk_X509_ALGOR_set(
        sk: *mut stack_st_X509_ALGOR,
        i: usize,
        p: *mut X509_ALGOR,
    ) -> *mut X509_ALGOR;
}
unsafe extern "C" {
    /// Algorithm identifiers.
    ///
    /// An `X509_ALGOR` represents an AlgorithmIdentifier structure, used in X.509
    /// to represent signature algorithms and public key algorithms.
    #[link_name = "sk_X509_ALGOR_free__extern"]
    pub fn sk_X509_ALGOR_free(sk: *mut stack_st_X509_ALGOR);
}
unsafe extern "C" {
    /// Algorithm identifiers.
    ///
    /// An `X509_ALGOR` represents an AlgorithmIdentifier structure, used in X.509
    /// to represent signature algorithms and public key algorithms.
    #[link_name = "sk_X509_ALGOR_pop_free__extern"]
    pub fn sk_X509_ALGOR_pop_free(sk: *mut stack_st_X509_ALGOR, free_func: sk_X509_ALGOR_free_func);
}
unsafe extern "C" {
    /// Algorithm identifiers.
    ///
    /// An `X509_ALGOR` represents an AlgorithmIdentifier structure, used in X.509
    /// to represent signature algorithms and public key algorithms.
    #[link_name = "sk_X509_ALGOR_insert__extern"]
    pub fn sk_X509_ALGOR_insert(
        sk: *mut stack_st_X509_ALGOR,
        p: *mut X509_ALGOR,
        where_: usize,
    ) -> usize;
}
unsafe extern "C" {
    /// Algorithm identifiers.
    ///
    /// An `X509_ALGOR` represents an AlgorithmIdentifier structure, used in X.509
    /// to represent signature algorithms and public key algorithms.
    #[link_name = "sk_X509_ALGOR_delete__extern"]
    pub fn sk_X509_ALGOR_delete(sk: *mut stack_st_X509_ALGOR, where_: usize) -> *mut X509_ALGOR;
}
unsafe extern "C" {
    /// Algorithm identifiers.
    ///
    /// An `X509_ALGOR` represents an AlgorithmIdentifier structure, used in X.509
    /// to represent signature algorithms and public key algorithms.
    #[link_name = "sk_X509_ALGOR_delete_ptr__extern"]
    pub fn sk_X509_ALGOR_delete_ptr(
        sk: *mut stack_st_X509_ALGOR,
        p: *const X509_ALGOR,
    ) -> *mut X509_ALGOR;
}
unsafe extern "C" {
    /// Algorithm identifiers.
    ///
    /// An `X509_ALGOR` represents an AlgorithmIdentifier structure, used in X.509
    /// to represent signature algorithms and public key algorithms.
    #[link_name = "sk_X509_ALGOR_delete_if__extern"]
    pub fn sk_X509_ALGOR_delete_if(
        sk: *mut stack_st_X509_ALGOR,
        func: sk_X509_ALGOR_delete_if_func,
        data: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    /// Algorithm identifiers.
    ///
    /// An `X509_ALGOR` represents an AlgorithmIdentifier structure, used in X.509
    /// to represent signature algorithms and public key algorithms.
    #[link_name = "sk_X509_ALGOR_find__extern"]
    pub fn sk_X509_ALGOR_find(
        sk: *const stack_st_X509_ALGOR,
        out_index: *mut usize,
        p: *const X509_ALGOR,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Algorithm identifiers.
    ///
    /// An `X509_ALGOR` represents an AlgorithmIdentifier structure, used in X.509
    /// to represent signature algorithms and public key algorithms.
    #[link_name = "sk_X509_ALGOR_shift__extern"]
    pub fn sk_X509_ALGOR_shift(sk: *mut stack_st_X509_ALGOR) -> *mut X509_ALGOR;
}
unsafe extern "C" {
    /// Algorithm identifiers.
    ///
    /// An `X509_ALGOR` represents an AlgorithmIdentifier structure, used in X.509
    /// to represent signature algorithms and public key algorithms.
    #[link_name = "sk_X509_ALGOR_push__extern"]
    pub fn sk_X509_ALGOR_push(sk: *mut stack_st_X509_ALGOR, p: *mut X509_ALGOR) -> usize;
}
unsafe extern "C" {
    /// Algorithm identifiers.
    ///
    /// An `X509_ALGOR` represents an AlgorithmIdentifier structure, used in X.509
    /// to represent signature algorithms and public key algorithms.
    #[link_name = "sk_X509_ALGOR_pop__extern"]
    pub fn sk_X509_ALGOR_pop(sk: *mut stack_st_X509_ALGOR) -> *mut X509_ALGOR;
}
unsafe extern "C" {
    /// Algorithm identifiers.
    ///
    /// An `X509_ALGOR` represents an AlgorithmIdentifier structure, used in X.509
    /// to represent signature algorithms and public key algorithms.
    #[link_name = "sk_X509_ALGOR_dup__extern"]
    pub fn sk_X509_ALGOR_dup(sk: *const stack_st_X509_ALGOR) -> *mut stack_st_X509_ALGOR;
}
unsafe extern "C" {
    /// Algorithm identifiers.
    ///
    /// An `X509_ALGOR` represents an AlgorithmIdentifier structure, used in X.509
    /// to represent signature algorithms and public key algorithms.
    #[link_name = "sk_X509_ALGOR_sort__extern"]
    pub fn sk_X509_ALGOR_sort(sk: *mut stack_st_X509_ALGOR);
}
unsafe extern "C" {
    /// Algorithm identifiers.
    ///
    /// An `X509_ALGOR` represents an AlgorithmIdentifier structure, used in X.509
    /// to represent signature algorithms and public key algorithms.
    #[link_name = "sk_X509_ALGOR_sort_and_dedup__extern"]
    pub fn sk_X509_ALGOR_sort_and_dedup(
        sk: *mut stack_st_X509_ALGOR,
        free_func: sk_X509_ALGOR_free_func,
    );
}
unsafe extern "C" {
    /// Algorithm identifiers.
    ///
    /// An `X509_ALGOR` represents an AlgorithmIdentifier structure, used in X.509
    /// to represent signature algorithms and public key algorithms.
    #[link_name = "sk_X509_ALGOR_is_sorted__extern"]
    pub fn sk_X509_ALGOR_is_sorted(sk: *const stack_st_X509_ALGOR) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Algorithm identifiers.
    ///
    /// An `X509_ALGOR` represents an AlgorithmIdentifier structure, used in X.509
    /// to represent signature algorithms and public key algorithms.
    #[link_name = "sk_X509_ALGOR_set_cmp_func__extern"]
    pub fn sk_X509_ALGOR_set_cmp_func(
        sk: *mut stack_st_X509_ALGOR,
        comp: sk_X509_ALGOR_cmp_func,
    ) -> sk_X509_ALGOR_cmp_func;
}
unsafe extern "C" {
    /// Algorithm identifiers.
    ///
    /// An `X509_ALGOR` represents an AlgorithmIdentifier structure, used in X.509
    /// to represent signature algorithms and public key algorithms.
    #[link_name = "sk_X509_ALGOR_deep_copy__extern"]
    pub fn sk_X509_ALGOR_deep_copy(
        sk: *const stack_st_X509_ALGOR,
        copy_func: sk_X509_ALGOR_copy_func,
        free_func: sk_X509_ALGOR_free_func,
    ) -> *mut stack_st_X509_ALGOR;
}
unsafe extern "C" {
    /// X509_ALGOR is an `ASN1_ITEM` whose ASN.1 type is AlgorithmIdentifier and C
    /// type is `X509_ALGOR*`.
    pub static X509_ALGOR_it: ASN1_ITEM;
}
unsafe extern "C" {
    /// X509_ALGOR_new returns a newly-allocated, empty `X509_ALGOR` object, or NULL
    /// on error.
    pub fn X509_ALGOR_new() -> *mut X509_ALGOR;
}
unsafe extern "C" {
    /// X509_ALGOR_dup returns a newly-allocated copy of `alg`, or NULL on error.
    /// This function works by serializing the structure, so if `alg` is incomplete,
    /// it may fail.
    pub fn X509_ALGOR_dup(alg: *const X509_ALGOR) -> *mut X509_ALGOR;
}
unsafe extern "C" {
    /// X509_ALGOR_copy sets `dst` to a copy of the contents of `src`. It returns one
    /// on success and zero on error.
    pub fn X509_ALGOR_copy(dst: *mut X509_ALGOR, src: *const X509_ALGOR) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_ALGOR_free releases memory associated with `alg`.
    pub fn X509_ALGOR_free(alg: *mut X509_ALGOR);
}
unsafe extern "C" {
    /// d2i_X509_ALGOR parses up to `len` bytes from `*inp` as a DER-encoded
    /// AlgorithmIdentifier, as described in `d2i_SAMPLE`.
    pub fn d2i_X509_ALGOR(
        out: *mut *mut X509_ALGOR,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut X509_ALGOR;
}
unsafe extern "C" {
    /// i2d_X509_ALGOR marshals `alg` as a DER-encoded AlgorithmIdentifier, as
    /// described in `i2d_SAMPLE`.
    pub fn i2d_X509_ALGOR(alg: *const X509_ALGOR, outp: *mut *mut u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_ALGOR_set0 sets `alg` to an AlgorithmIdentifier with algorithm `obj` and
    /// parameter determined by `param_type` and `param_value`. It returns one on
    /// success and zero on error. This function takes ownership of `obj` and
    /// `param_value` on success.
    ///
    /// If `param_type` is `V_ASN1_UNDEF`, the parameter is omitted. If `param_type`
    /// is zero, the parameter is left unchanged. Otherwise, `param_type` and
    /// `param_value` are interpreted as in `ASN1_TYPE_set`.
    ///
    /// Note omitting the parameter (`V_ASN1_UNDEF`) and encoding an explicit NULL
    /// value (`V_ASN1_NULL`) are different. Some algorithms require one and some the
    /// other. Consult the relevant specification before calling this function. The
    /// correct parameter for an RSASSA-PKCS1-v1_5 signature is `V_ASN1_NULL`. The
    /// correct one for an ECDSA or Ed25519 signature is `V_ASN1_UNDEF`.
    pub fn X509_ALGOR_set0(
        alg: *mut X509_ALGOR,
        obj: *mut ASN1_OBJECT,
        param_type: ::core::ffi::c_int,
        param_value: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_ALGOR_get0 sets `*out_obj` to the `alg`'s algorithm. If `alg`'s
    /// parameter is omitted, it sets `*out_param_type` and `*out_param_value` to
    /// `V_ASN1_UNDEF` and NULL. Otherwise, it sets `*out_param_type` and
    /// `*out_param_value` to the parameter, using the same representation as
    /// `ASN1_TYPE_set0`. See `ASN1_TYPE_set0` and `ASN1_TYPE` for details.
    ///
    /// Callers that require the parameter in serialized form should, after checking
    /// for `V_ASN1_UNDEF`, use `ASN1_TYPE_set1` and `d2i_ASN1_TYPE`, rather than
    /// inspecting `*out_param_value`.
    ///
    /// Each of `out_obj`, `out_param_type`, and `out_param_value` may be NULL to
    /// ignore the output. If `out_param_type` is NULL, `out_param_value` is ignored.
    ///
    /// WARNING: If `*out_param_type` is set to `V_ASN1_UNDEF`, OpenSSL and older
    /// revisions of BoringSSL leave `*out_param_value` unset rather than setting it
    /// to NULL. Callers that support both OpenSSL and BoringSSL should not assume
    /// `*out_param_value` is uniformly initialized.
    pub fn X509_ALGOR_get0(
        out_obj: *mut *const ASN1_OBJECT,
        out_param_type: *mut ::core::ffi::c_int,
        out_param_value: *mut *const ::core::ffi::c_void,
        alg: *const X509_ALGOR,
    );
}
unsafe extern "C" {
    /// X509_ALGOR_set_md sets `alg` to the hash function `md`. Note this
    /// AlgorithmIdentifier represents the hash function itself, not a signature
    /// algorithm that uses `md`. It returns one on success and zero on error.
    ///
    /// Due to historical specification mistakes (see Section 2.1 of RFC 4055), the
    /// parameters field is sometimes omitted and sometimes a NULL value. When used
    /// in RSASSA-PSS and RSAES-OAEP, it should be a NULL value. In other contexts,
    /// the parameters should be omitted. This function assumes the caller is
    /// constructing a RSASSA-PSS or RSAES-OAEP AlgorithmIdentifier and includes a
    /// NULL parameter. This differs from OpenSSL's behavior.
    ///
    /// TODO(davidben): Rename this function, or perhaps just add a bespoke API for
    /// constructing PSS and move on.
    pub fn X509_ALGOR_set_md(alg: *mut X509_ALGOR, md: *const EVP_MD) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_ALGOR_cmp returns zero if `a` and `b` are equal, and some non-zero value
    /// otherwise. Note this function can only be used for equality checks, not an
    /// ordering.
    pub fn X509_ALGOR_cmp(a: *const X509_ALGOR, b: *const X509_ALGOR) -> ::core::ffi::c_int;
}
/// Attributes.
///
/// Unlike certificates and CRLs, CSRs use a separate Attribute structure (RFC
/// 2985, RFC 2986) for extensibility. This is represented by the library as
/// `X509_ATTRIBUTE`.
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct stack_st_X509_ATTRIBUTE {
    _unused: [u8; 0],
}
/// Attributes.
///
/// Unlike certificates and CRLs, CSRs use a separate Attribute structure (RFC
/// 2985, RFC 2986) for extensibility. This is represented by the library as
/// `X509_ATTRIBUTE`.
pub type sk_X509_ATTRIBUTE_free_func =
    ::core::option::Option<unsafe extern "C" fn(arg1: *mut X509_ATTRIBUTE)>;
/// Attributes.
///
/// Unlike certificates and CRLs, CSRs use a separate Attribute structure (RFC
/// 2985, RFC 2986) for extensibility. This is represented by the library as
/// `X509_ATTRIBUTE`.
pub type sk_X509_ATTRIBUTE_copy_func = ::core::option::Option<
    unsafe extern "C" fn(arg1: *const X509_ATTRIBUTE) -> *mut X509_ATTRIBUTE,
>;
/// Attributes.
///
/// Unlike certificates and CRLs, CSRs use a separate Attribute structure (RFC
/// 2985, RFC 2986) for extensibility. This is represented by the library as
/// `X509_ATTRIBUTE`.
pub type sk_X509_ATTRIBUTE_cmp_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *const *const X509_ATTRIBUTE,
        arg2: *const *const X509_ATTRIBUTE,
    ) -> ::core::ffi::c_int,
>;
/// Attributes.
///
/// Unlike certificates and CRLs, CSRs use a separate Attribute structure (RFC
/// 2985, RFC 2986) for extensibility. This is represented by the library as
/// `X509_ATTRIBUTE`.
pub type sk_X509_ATTRIBUTE_delete_if_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *mut X509_ATTRIBUTE,
        arg2: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int,
>;
unsafe extern "C" {
    /// Attributes.
    ///
    /// Unlike certificates and CRLs, CSRs use a separate Attribute structure (RFC
    /// 2985, RFC 2986) for extensibility. This is represented by the library as
    /// `X509_ATTRIBUTE`.
    #[link_name = "sk_X509_ATTRIBUTE_call_free_func__extern"]
    pub fn sk_X509_ATTRIBUTE_call_free_func(
        free_func: OPENSSL_sk_free_func,
        ptr: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    /// Attributes.
    ///
    /// Unlike certificates and CRLs, CSRs use a separate Attribute structure (RFC
    /// 2985, RFC 2986) for extensibility. This is represented by the library as
    /// `X509_ATTRIBUTE`.
    #[link_name = "sk_X509_ATTRIBUTE_call_copy_func__extern"]
    pub fn sk_X509_ATTRIBUTE_call_copy_func(
        copy_func: OPENSSL_sk_copy_func,
        ptr: *const ::core::ffi::c_void,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    /// Attributes.
    ///
    /// Unlike certificates and CRLs, CSRs use a separate Attribute structure (RFC
    /// 2985, RFC 2986) for extensibility. This is represented by the library as
    /// `X509_ATTRIBUTE`.
    #[link_name = "sk_X509_ATTRIBUTE_call_cmp_func__extern"]
    pub fn sk_X509_ATTRIBUTE_call_cmp_func(
        cmp_func: OPENSSL_sk_cmp_func,
        a: *const ::core::ffi::c_void,
        b: *const ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Attributes.
    ///
    /// Unlike certificates and CRLs, CSRs use a separate Attribute structure (RFC
    /// 2985, RFC 2986) for extensibility. This is represented by the library as
    /// `X509_ATTRIBUTE`.
    #[link_name = "sk_X509_ATTRIBUTE_call_delete_if_func__extern"]
    pub fn sk_X509_ATTRIBUTE_call_delete_if_func(
        func: OPENSSL_sk_delete_if_func,
        obj: *mut ::core::ffi::c_void,
        data: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Attributes.
    ///
    /// Unlike certificates and CRLs, CSRs use a separate Attribute structure (RFC
    /// 2985, RFC 2986) for extensibility. This is represented by the library as
    /// `X509_ATTRIBUTE`.
    #[link_name = "sk_X509_ATTRIBUTE_new__extern"]
    pub fn sk_X509_ATTRIBUTE_new(comp: sk_X509_ATTRIBUTE_cmp_func) -> *mut stack_st_X509_ATTRIBUTE;
}
unsafe extern "C" {
    /// Attributes.
    ///
    /// Unlike certificates and CRLs, CSRs use a separate Attribute structure (RFC
    /// 2985, RFC 2986) for extensibility. This is represented by the library as
    /// `X509_ATTRIBUTE`.
    #[link_name = "sk_X509_ATTRIBUTE_new_null__extern"]
    pub fn sk_X509_ATTRIBUTE_new_null() -> *mut stack_st_X509_ATTRIBUTE;
}
unsafe extern "C" {
    /// Attributes.
    ///
    /// Unlike certificates and CRLs, CSRs use a separate Attribute structure (RFC
    /// 2985, RFC 2986) for extensibility. This is represented by the library as
    /// `X509_ATTRIBUTE`.
    #[link_name = "sk_X509_ATTRIBUTE_num__extern"]
    pub fn sk_X509_ATTRIBUTE_num(sk: *const stack_st_X509_ATTRIBUTE) -> usize;
}
unsafe extern "C" {
    /// Attributes.
    ///
    /// Unlike certificates and CRLs, CSRs use a separate Attribute structure (RFC
    /// 2985, RFC 2986) for extensibility. This is represented by the library as
    /// `X509_ATTRIBUTE`.
    #[link_name = "sk_X509_ATTRIBUTE_zero__extern"]
    pub fn sk_X509_ATTRIBUTE_zero(sk: *mut stack_st_X509_ATTRIBUTE);
}
unsafe extern "C" {
    /// Attributes.
    ///
    /// Unlike certificates and CRLs, CSRs use a separate Attribute structure (RFC
    /// 2985, RFC 2986) for extensibility. This is represented by the library as
    /// `X509_ATTRIBUTE`.
    #[link_name = "sk_X509_ATTRIBUTE_value__extern"]
    pub fn sk_X509_ATTRIBUTE_value(
        sk: *const stack_st_X509_ATTRIBUTE,
        i: usize,
    ) -> *mut X509_ATTRIBUTE;
}
unsafe extern "C" {
    /// Attributes.
    ///
    /// Unlike certificates and CRLs, CSRs use a separate Attribute structure (RFC
    /// 2985, RFC 2986) for extensibility. This is represented by the library as
    /// `X509_ATTRIBUTE`.
    #[link_name = "sk_X509_ATTRIBUTE_set__extern"]
    pub fn sk_X509_ATTRIBUTE_set(
        sk: *mut stack_st_X509_ATTRIBUTE,
        i: usize,
        p: *mut X509_ATTRIBUTE,
    ) -> *mut X509_ATTRIBUTE;
}
unsafe extern "C" {
    /// Attributes.
    ///
    /// Unlike certificates and CRLs, CSRs use a separate Attribute structure (RFC
    /// 2985, RFC 2986) for extensibility. This is represented by the library as
    /// `X509_ATTRIBUTE`.
    #[link_name = "sk_X509_ATTRIBUTE_free__extern"]
    pub fn sk_X509_ATTRIBUTE_free(sk: *mut stack_st_X509_ATTRIBUTE);
}
unsafe extern "C" {
    /// Attributes.
    ///
    /// Unlike certificates and CRLs, CSRs use a separate Attribute structure (RFC
    /// 2985, RFC 2986) for extensibility. This is represented by the library as
    /// `X509_ATTRIBUTE`.
    #[link_name = "sk_X509_ATTRIBUTE_pop_free__extern"]
    pub fn sk_X509_ATTRIBUTE_pop_free(
        sk: *mut stack_st_X509_ATTRIBUTE,
        free_func: sk_X509_ATTRIBUTE_free_func,
    );
}
unsafe extern "C" {
    /// Attributes.
    ///
    /// Unlike certificates and CRLs, CSRs use a separate Attribute structure (RFC
    /// 2985, RFC 2986) for extensibility. This is represented by the library as
    /// `X509_ATTRIBUTE`.
    #[link_name = "sk_X509_ATTRIBUTE_insert__extern"]
    pub fn sk_X509_ATTRIBUTE_insert(
        sk: *mut stack_st_X509_ATTRIBUTE,
        p: *mut X509_ATTRIBUTE,
        where_: usize,
    ) -> usize;
}
unsafe extern "C" {
    /// Attributes.
    ///
    /// Unlike certificates and CRLs, CSRs use a separate Attribute structure (RFC
    /// 2985, RFC 2986) for extensibility. This is represented by the library as
    /// `X509_ATTRIBUTE`.
    #[link_name = "sk_X509_ATTRIBUTE_delete__extern"]
    pub fn sk_X509_ATTRIBUTE_delete(
        sk: *mut stack_st_X509_ATTRIBUTE,
        where_: usize,
    ) -> *mut X509_ATTRIBUTE;
}
unsafe extern "C" {
    /// Attributes.
    ///
    /// Unlike certificates and CRLs, CSRs use a separate Attribute structure (RFC
    /// 2985, RFC 2986) for extensibility. This is represented by the library as
    /// `X509_ATTRIBUTE`.
    #[link_name = "sk_X509_ATTRIBUTE_delete_ptr__extern"]
    pub fn sk_X509_ATTRIBUTE_delete_ptr(
        sk: *mut stack_st_X509_ATTRIBUTE,
        p: *const X509_ATTRIBUTE,
    ) -> *mut X509_ATTRIBUTE;
}
unsafe extern "C" {
    /// Attributes.
    ///
    /// Unlike certificates and CRLs, CSRs use a separate Attribute structure (RFC
    /// 2985, RFC 2986) for extensibility. This is represented by the library as
    /// `X509_ATTRIBUTE`.
    #[link_name = "sk_X509_ATTRIBUTE_delete_if__extern"]
    pub fn sk_X509_ATTRIBUTE_delete_if(
        sk: *mut stack_st_X509_ATTRIBUTE,
        func: sk_X509_ATTRIBUTE_delete_if_func,
        data: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    /// Attributes.
    ///
    /// Unlike certificates and CRLs, CSRs use a separate Attribute structure (RFC
    /// 2985, RFC 2986) for extensibility. This is represented by the library as
    /// `X509_ATTRIBUTE`.
    #[link_name = "sk_X509_ATTRIBUTE_find__extern"]
    pub fn sk_X509_ATTRIBUTE_find(
        sk: *const stack_st_X509_ATTRIBUTE,
        out_index: *mut usize,
        p: *const X509_ATTRIBUTE,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Attributes.
    ///
    /// Unlike certificates and CRLs, CSRs use a separate Attribute structure (RFC
    /// 2985, RFC 2986) for extensibility. This is represented by the library as
    /// `X509_ATTRIBUTE`.
    #[link_name = "sk_X509_ATTRIBUTE_shift__extern"]
    pub fn sk_X509_ATTRIBUTE_shift(sk: *mut stack_st_X509_ATTRIBUTE) -> *mut X509_ATTRIBUTE;
}
unsafe extern "C" {
    /// Attributes.
    ///
    /// Unlike certificates and CRLs, CSRs use a separate Attribute structure (RFC
    /// 2985, RFC 2986) for extensibility. This is represented by the library as
    /// `X509_ATTRIBUTE`.
    #[link_name = "sk_X509_ATTRIBUTE_push__extern"]
    pub fn sk_X509_ATTRIBUTE_push(
        sk: *mut stack_st_X509_ATTRIBUTE,
        p: *mut X509_ATTRIBUTE,
    ) -> usize;
}
unsafe extern "C" {
    /// Attributes.
    ///
    /// Unlike certificates and CRLs, CSRs use a separate Attribute structure (RFC
    /// 2985, RFC 2986) for extensibility. This is represented by the library as
    /// `X509_ATTRIBUTE`.
    #[link_name = "sk_X509_ATTRIBUTE_pop__extern"]
    pub fn sk_X509_ATTRIBUTE_pop(sk: *mut stack_st_X509_ATTRIBUTE) -> *mut X509_ATTRIBUTE;
}
unsafe extern "C" {
    /// Attributes.
    ///
    /// Unlike certificates and CRLs, CSRs use a separate Attribute structure (RFC
    /// 2985, RFC 2986) for extensibility. This is represented by the library as
    /// `X509_ATTRIBUTE`.
    #[link_name = "sk_X509_ATTRIBUTE_dup__extern"]
    pub fn sk_X509_ATTRIBUTE_dup(
        sk: *const stack_st_X509_ATTRIBUTE,
    ) -> *mut stack_st_X509_ATTRIBUTE;
}
unsafe extern "C" {
    /// Attributes.
    ///
    /// Unlike certificates and CRLs, CSRs use a separate Attribute structure (RFC
    /// 2985, RFC 2986) for extensibility. This is represented by the library as
    /// `X509_ATTRIBUTE`.
    #[link_name = "sk_X509_ATTRIBUTE_sort__extern"]
    pub fn sk_X509_ATTRIBUTE_sort(sk: *mut stack_st_X509_ATTRIBUTE);
}
unsafe extern "C" {
    /// Attributes.
    ///
    /// Unlike certificates and CRLs, CSRs use a separate Attribute structure (RFC
    /// 2985, RFC 2986) for extensibility. This is represented by the library as
    /// `X509_ATTRIBUTE`.
    #[link_name = "sk_X509_ATTRIBUTE_sort_and_dedup__extern"]
    pub fn sk_X509_ATTRIBUTE_sort_and_dedup(
        sk: *mut stack_st_X509_ATTRIBUTE,
        free_func: sk_X509_ATTRIBUTE_free_func,
    );
}
unsafe extern "C" {
    /// Attributes.
    ///
    /// Unlike certificates and CRLs, CSRs use a separate Attribute structure (RFC
    /// 2985, RFC 2986) for extensibility. This is represented by the library as
    /// `X509_ATTRIBUTE`.
    #[link_name = "sk_X509_ATTRIBUTE_is_sorted__extern"]
    pub fn sk_X509_ATTRIBUTE_is_sorted(sk: *const stack_st_X509_ATTRIBUTE) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Attributes.
    ///
    /// Unlike certificates and CRLs, CSRs use a separate Attribute structure (RFC
    /// 2985, RFC 2986) for extensibility. This is represented by the library as
    /// `X509_ATTRIBUTE`.
    #[link_name = "sk_X509_ATTRIBUTE_set_cmp_func__extern"]
    pub fn sk_X509_ATTRIBUTE_set_cmp_func(
        sk: *mut stack_st_X509_ATTRIBUTE,
        comp: sk_X509_ATTRIBUTE_cmp_func,
    ) -> sk_X509_ATTRIBUTE_cmp_func;
}
unsafe extern "C" {
    /// Attributes.
    ///
    /// Unlike certificates and CRLs, CSRs use a separate Attribute structure (RFC
    /// 2985, RFC 2986) for extensibility. This is represented by the library as
    /// `X509_ATTRIBUTE`.
    #[link_name = "sk_X509_ATTRIBUTE_deep_copy__extern"]
    pub fn sk_X509_ATTRIBUTE_deep_copy(
        sk: *const stack_st_X509_ATTRIBUTE,
        copy_func: sk_X509_ATTRIBUTE_copy_func,
        free_func: sk_X509_ATTRIBUTE_free_func,
    ) -> *mut stack_st_X509_ATTRIBUTE;
}
unsafe extern "C" {
    /// X509_ATTRIBUTE_new returns a newly-allocated, empty `X509_ATTRIBUTE` object,
    /// or NULL on error. `X509_ATTRIBUTE_set1_*` may be used to finish initializing
    /// it.
    pub fn X509_ATTRIBUTE_new() -> *mut X509_ATTRIBUTE;
}
unsafe extern "C" {
    /// X509_ATTRIBUTE_dup returns a newly-allocated copy of `attr`, or NULL on
    /// error. This function works by serializing the structure, so if `attr` is
    /// incomplete, it may fail.
    pub fn X509_ATTRIBUTE_dup(attr: *const X509_ATTRIBUTE) -> *mut X509_ATTRIBUTE;
}
unsafe extern "C" {
    /// X509_ATTRIBUTE_free releases memory associated with `attr`.
    pub fn X509_ATTRIBUTE_free(attr: *mut X509_ATTRIBUTE);
}
unsafe extern "C" {
    /// d2i_X509_ATTRIBUTE parses up to `len` bytes from `*inp` as a DER-encoded
    /// Attribute (RFC 2986), as described in `d2i_SAMPLE`.
    pub fn d2i_X509_ATTRIBUTE(
        out: *mut *mut X509_ATTRIBUTE,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut X509_ATTRIBUTE;
}
unsafe extern "C" {
    /// i2d_X509_ATTRIBUTE marshals `alg` as a DER-encoded Attribute (RFC 2986), as
    /// described in `i2d_SAMPLE`.
    pub fn i2d_X509_ATTRIBUTE(alg: *const X509_ATTRIBUTE, outp: *mut *mut u8)
        -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_ATTRIBUTE_create returns a newly-allocated `X509_ATTRIBUTE`, or NULL on
    /// error. The attribute has type `nid` and contains a single value determined by
    /// `attrtype` and `value`, which are interpreted as in `ASN1_TYPE_set`. Note
    /// this function takes ownership of `value`.
    pub fn X509_ATTRIBUTE_create(
        nid: ::core::ffi::c_int,
        attrtype: ::core::ffi::c_int,
        value: *mut ::core::ffi::c_void,
    ) -> *mut X509_ATTRIBUTE;
}
unsafe extern "C" {
    /// X509_ATTRIBUTE_create_by_NID returns a newly-allocated `X509_ATTRIBUTE` of
    /// type `nid`, or NULL on error. The value is determined as in
    /// `X509_ATTRIBUTE_set1_data`.
    ///
    /// If `attr` is non-NULL, the resulting `X509_ATTRIBUTE` is also written to
    /// `*attr`. If `*attr` was non-NULL when the function was called, `*attr` is
    /// reused instead of creating a new object.
    ///
    /// WARNING: The interpretation of `attrtype`, `data`, and `len` is complex and
    /// error-prone. See `X509_ATTRIBUTE_set1_data` for details.
    ///
    /// WARNING: The object reuse form is deprecated and may be removed in the
    /// future. It also currently incorrectly appends to the reused object's value
    /// set rather than overwriting it.
    pub fn X509_ATTRIBUTE_create_by_NID(
        attr: *mut *mut X509_ATTRIBUTE,
        nid: ::core::ffi::c_int,
        attrtype: ::core::ffi::c_int,
        data: *const ::core::ffi::c_void,
        len: ::core::ffi::c_int,
    ) -> *mut X509_ATTRIBUTE;
}
unsafe extern "C" {
    /// X509_ATTRIBUTE_create_by_OBJ behaves like `X509_ATTRIBUTE_create_by_NID`
    /// except the attribute's type is determined by `obj`.
    pub fn X509_ATTRIBUTE_create_by_OBJ(
        attr: *mut *mut X509_ATTRIBUTE,
        obj: *const ASN1_OBJECT,
        attrtype: ::core::ffi::c_int,
        data: *const ::core::ffi::c_void,
        len: ::core::ffi::c_int,
    ) -> *mut X509_ATTRIBUTE;
}
unsafe extern "C" {
    /// X509_ATTRIBUTE_create_by_txt behaves like `X509_ATTRIBUTE_create_by_NID`
    /// except the attribute's type is determined by calling `OBJ_txt2obj` with
    /// `attrname`.
    pub fn X509_ATTRIBUTE_create_by_txt(
        attr: *mut *mut X509_ATTRIBUTE,
        attrname: *const ::core::ffi::c_char,
        type_: ::core::ffi::c_int,
        bytes: *const ::core::ffi::c_uchar,
        len: ::core::ffi::c_int,
    ) -> *mut X509_ATTRIBUTE;
}
unsafe extern "C" {
    /// X509_ATTRIBUTE_set1_object sets `attr`'s type to `obj`. It returns one on
    /// success and zero on error.
    pub fn X509_ATTRIBUTE_set1_object(
        attr: *mut X509_ATTRIBUTE,
        obj: *const ASN1_OBJECT,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_ATTRIBUTE_set1_data appends a value to `attr`'s value set and returns
    /// one on success or zero on error. The value is determined as follows:
    ///
    /// If `attrtype` is zero, this function returns one and does nothing. This form
    /// may be used when calling `X509_ATTRIBUTE_create_by_*` to create an attribute
    /// with an empty value set. Such attributes are invalid, but OpenSSL supports
    /// creating them.
    ///
    /// Otherwise, if `attrtype` is a `MBSTRING_*` constant, the value is an ASN.1
    /// string. The string is determined by decoding `len` bytes from `data` in the
    /// encoding specified by `attrtype`, and then re-encoding it in a form
    /// appropriate for `attr`'s type. If `len` is -1, `strlen(data)` is used
    /// instead. See `ASN1_STRING_set_by_NID` for details.
    ///
    /// Otherwise, if `len` is not -1, the value is an ASN.1 string. `attrtype` is an
    /// `ASN1_STRING` type value and the `len` bytes from `data` are copied as the
    /// type-specific representation of `ASN1_STRING`. See `ASN1_STRING` for details.
    ///
    /// Otherwise, if `len` is -1, the value is constructed by passing `attrtype` and
    /// `data` to `ASN1_TYPE_set1`. That is, `attrtype` is an `ASN1_TYPE` type value,
    /// and `data` is cast to the corresponding pointer type.
    ///
    /// WARNING: Despite the name, this function appends to `attr`'s value set,
    /// rather than overwriting it. To overwrite the value set, create a new
    /// `X509_ATTRIBUTE` with `X509_ATTRIBUTE_new`.
    ///
    /// WARNING: If using the `MBSTRING_*` form, pass a length rather than relying on
    /// `strlen`. In particular, `strlen` will not behave correctly if the input is
    /// `MBSTRING_BMP` or `MBSTRING_UNIV`.
    ///
    /// WARNING: This function currently misinterprets `V_ASN1_OTHER` as an
    /// `MBSTRING_*` constant. This matches OpenSSL but means it is impossible to
    /// construct a value with a non-universal tag.
    pub fn X509_ATTRIBUTE_set1_data(
        attr: *mut X509_ATTRIBUTE,
        attrtype: ::core::ffi::c_int,
        data: *const ::core::ffi::c_void,
        len: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_ATTRIBUTE_get0_data returns the `idx`th value of `attr` in a
    /// type-specific representation to `attrtype`, or NULL if out of bounds or the
    /// type does not match. `attrtype` is one of the type values in `ASN1_TYPE`. On
    /// match, the return value uses the same representation as `ASN1_TYPE_set0`. See
    /// `ASN1_TYPE` for details.
    pub fn X509_ATTRIBUTE_get0_data(
        attr: *mut X509_ATTRIBUTE,
        idx: ::core::ffi::c_int,
        attrtype: ::core::ffi::c_int,
        unused: *mut ::core::ffi::c_void,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    /// X509_ATTRIBUTE_count returns the number of values in `attr`.
    pub fn X509_ATTRIBUTE_count(attr: *const X509_ATTRIBUTE) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_ATTRIBUTE_get0_object returns the type of `attr`.
    pub fn X509_ATTRIBUTE_get0_object(attr: *mut X509_ATTRIBUTE) -> *mut ASN1_OBJECT;
}
unsafe extern "C" {
    /// X509_ATTRIBUTE_get0_type returns the `idx`th value in `attr`, or NULL if out
    /// of bounds. Note this function returns one of `attr`'s values, not the type.
    pub fn X509_ATTRIBUTE_get0_type(
        attr: *mut X509_ATTRIBUTE,
        idx: ::core::ffi::c_int,
    ) -> *mut ASN1_TYPE;
}
unsafe extern "C" {
    /// X509_STORE_new returns a newly-allocated `X509_STORE`, or NULL on error.
    pub fn X509_STORE_new() -> *mut X509_STORE;
}
unsafe extern "C" {
    /// X509_STORE_up_ref adds one to the reference count of `store` and returns one.
    /// Although `store` is not const, this function's use of `store` is thread-safe.
    pub fn X509_STORE_up_ref(store: *mut X509_STORE) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_STORE_free releases memory associated with `store`.
    pub fn X509_STORE_free(store: *mut X509_STORE);
}
unsafe extern "C" {
    /// X509_STORE_add_cert adds `x509` to `store` as a trusted certificate. It
    /// returns one on success and zero on error. This function internally increments
    /// `x509`'s reference count, so the caller retains ownership of `x509`.
    ///
    /// Certificates configured by this function are still subject to the checks
    /// described in `X509_VERIFY_PARAM_set_trust`.
    ///
    /// Although `store` is not const, this function's use of `store` is thread-safe.
    /// However, if this function is called concurrently with `X509_verify_cert`, it
    /// is a race condition whether `x509` is available for issuer lookups.
    /// Moreover, the result may differ for each issuer lookup performed by a single
    /// `X509_verify_cert` call.
    pub fn X509_STORE_add_cert(store: *mut X509_STORE, x509: *mut X509) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_STORE_add_crl adds `crl` to `store`. It returns one on success and zero
    /// on error. This function internally increments `crl`'s reference count, so the
    /// caller retains ownership of `crl`. CRLs added in this way are candidates for
    /// CRL lookup when `X509_V_FLAG_CRL_CHECK` is set.
    ///
    /// Although `store` is not const, this function's use of `store` is thread-safe.
    /// However, if this function is called concurrently with `X509_verify_cert`, it
    /// is a race condition whether `crl` is available for CRL checks. Moreover, the
    /// result may differ for each CRL check performed by a single
    /// `X509_verify_cert` call.
    ///
    /// Note there are no supported APIs to remove CRLs from `store` once inserted.
    /// To vary the set of CRLs over time, callers should either create a new
    /// `X509_STORE` or configure CRLs on a per-verification basis with
    /// `X509_STORE_CTX_set0_crls`.
    pub fn X509_STORE_add_crl(store: *mut X509_STORE, crl: *mut X509_CRL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_STORE_get0_param returns `store`'s verification parameters. This object
    /// is mutable and may be modified by the caller. For an individual certificate
    /// verification operation, `X509_STORE_CTX_init` initializes the
    /// `X509_STORE_CTX`'s parameters with these parameters.
    ///
    /// WARNING: `X509_STORE_CTX_init` applies some default parameters (as in
    /// `X509_VERIFY_PARAM_inherit`) after copying `store`'s parameters. This means
    /// it is impossible to leave some parameters unset at `store`. They must be
    /// explicitly unset after creating the `X509_STORE_CTX`.
    ///
    /// As of writing these late defaults are a depth limit (see
    /// `X509_VERIFY_PARAM_set_depth`) and the `X509_V_FLAG_TRUSTED_FIRST` flag. This
    /// warning does not apply if the parameters were set in `store`.
    ///
    /// TODO(crbug.com/boringssl/441): This behavior is very surprising. Can we
    /// remove this notion of late defaults? The unsettable value at `X509_STORE` is
    /// -1, which rejects everything but explicitly-trusted self-signed certificates.
    /// `X509_V_FLAG_TRUSTED_FIRST` is mostly a workaround for poor path-building.
    pub fn X509_STORE_get0_param(store: *mut X509_STORE) -> *mut X509_VERIFY_PARAM;
}
unsafe extern "C" {
    /// X509_STORE_set1_param copies verification parameters from `param` as in
    /// `X509_VERIFY_PARAM_set1`. It returns one on success and zero on error.
    pub fn X509_STORE_set1_param(
        store: *mut X509_STORE,
        param: *const X509_VERIFY_PARAM,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_STORE_set_flags enables all values in `flags` in `store`'s verification
    /// flags. `flags` should be a combination of `X509_V_FLAG_*` constants.
    ///
    /// WARNING: These flags will be combined with default flags when copied to an
    /// `X509_STORE_CTX`. This means it is impossible to unset those defaults from
    /// the `X509_STORE`. See discussion in `X509_STORE_get0_param`.
    pub fn X509_STORE_set_flags(
        store: *mut X509_STORE,
        flags: ::core::ffi::c_ulong,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_STORE_set_depth configures `store` to, by default, limit certificate
    /// chains to `depth` intermediate certificates. This count excludes both the
    /// target certificate and the trust anchor (root certificate).
    pub fn X509_STORE_set_depth(
        store: *mut X509_STORE,
        depth: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_STORE_set_purpose configures the purpose check for `store`. See
    /// `X509_VERIFY_PARAM_set_purpose` for details.
    pub fn X509_STORE_set_purpose(
        store: *mut X509_STORE,
        purpose: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_STORE_set_trust configures the trust check for `store`. See
    /// `X509_VERIFY_PARAM_set_trust` for details.
    pub fn X509_STORE_set_trust(
        store: *mut X509_STORE,
        trust: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct stack_st_X509_OBJECT {
    _unused: [u8; 0],
}
/// We also disable -Wcast-qual. As part of this C-based type erasure setup,  \
/// the wrapper macros need to cast away const in places. In C++, const_cast  \
/// suppresses the warning, but it seemingly cannot be suppressed in C.
pub type sk_X509_OBJECT_free_func =
    ::core::option::Option<unsafe extern "C" fn(arg1: *mut X509_OBJECT)>;
pub type sk_X509_OBJECT_copy_func =
    ::core::option::Option<unsafe extern "C" fn(arg1: *const X509_OBJECT) -> *mut X509_OBJECT>;
pub type sk_X509_OBJECT_cmp_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *const *const X509_OBJECT,
        arg2: *const *const X509_OBJECT,
    ) -> ::core::ffi::c_int,
>;
pub type sk_X509_OBJECT_delete_if_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *mut X509_OBJECT,
        arg2: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int,
>;
unsafe extern "C" {
    #[link_name = "sk_X509_OBJECT_call_free_func__extern"]
    pub fn sk_X509_OBJECT_call_free_func(
        free_func: OPENSSL_sk_free_func,
        ptr: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    #[link_name = "sk_X509_OBJECT_call_copy_func__extern"]
    pub fn sk_X509_OBJECT_call_copy_func(
        copy_func: OPENSSL_sk_copy_func,
        ptr: *const ::core::ffi::c_void,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    #[link_name = "sk_X509_OBJECT_call_cmp_func__extern"]
    pub fn sk_X509_OBJECT_call_cmp_func(
        cmp_func: OPENSSL_sk_cmp_func,
        a: *const ::core::ffi::c_void,
        b: *const ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_X509_OBJECT_call_delete_if_func__extern"]
    pub fn sk_X509_OBJECT_call_delete_if_func(
        func: OPENSSL_sk_delete_if_func,
        obj: *mut ::core::ffi::c_void,
        data: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_X509_OBJECT_new__extern"]
    pub fn sk_X509_OBJECT_new(comp: sk_X509_OBJECT_cmp_func) -> *mut stack_st_X509_OBJECT;
}
unsafe extern "C" {
    #[link_name = "sk_X509_OBJECT_new_null__extern"]
    pub fn sk_X509_OBJECT_new_null() -> *mut stack_st_X509_OBJECT;
}
unsafe extern "C" {
    #[link_name = "sk_X509_OBJECT_num__extern"]
    pub fn sk_X509_OBJECT_num(sk: *const stack_st_X509_OBJECT) -> usize;
}
unsafe extern "C" {
    #[link_name = "sk_X509_OBJECT_zero__extern"]
    pub fn sk_X509_OBJECT_zero(sk: *mut stack_st_X509_OBJECT);
}
unsafe extern "C" {
    #[link_name = "sk_X509_OBJECT_value__extern"]
    pub fn sk_X509_OBJECT_value(sk: *const stack_st_X509_OBJECT, i: usize) -> *mut X509_OBJECT;
}
unsafe extern "C" {
    #[link_name = "sk_X509_OBJECT_set__extern"]
    pub fn sk_X509_OBJECT_set(
        sk: *mut stack_st_X509_OBJECT,
        i: usize,
        p: *mut X509_OBJECT,
    ) -> *mut X509_OBJECT;
}
unsafe extern "C" {
    #[link_name = "sk_X509_OBJECT_free__extern"]
    pub fn sk_X509_OBJECT_free(sk: *mut stack_st_X509_OBJECT);
}
unsafe extern "C" {
    #[link_name = "sk_X509_OBJECT_pop_free__extern"]
    pub fn sk_X509_OBJECT_pop_free(
        sk: *mut stack_st_X509_OBJECT,
        free_func: sk_X509_OBJECT_free_func,
    );
}
unsafe extern "C" {
    #[link_name = "sk_X509_OBJECT_insert__extern"]
    pub fn sk_X509_OBJECT_insert(
        sk: *mut stack_st_X509_OBJECT,
        p: *mut X509_OBJECT,
        where_: usize,
    ) -> usize;
}
unsafe extern "C" {
    #[link_name = "sk_X509_OBJECT_delete__extern"]
    pub fn sk_X509_OBJECT_delete(sk: *mut stack_st_X509_OBJECT, where_: usize) -> *mut X509_OBJECT;
}
unsafe extern "C" {
    #[link_name = "sk_X509_OBJECT_delete_ptr__extern"]
    pub fn sk_X509_OBJECT_delete_ptr(
        sk: *mut stack_st_X509_OBJECT,
        p: *const X509_OBJECT,
    ) -> *mut X509_OBJECT;
}
unsafe extern "C" {
    #[link_name = "sk_X509_OBJECT_delete_if__extern"]
    pub fn sk_X509_OBJECT_delete_if(
        sk: *mut stack_st_X509_OBJECT,
        func: sk_X509_OBJECT_delete_if_func,
        data: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    #[link_name = "sk_X509_OBJECT_find__extern"]
    pub fn sk_X509_OBJECT_find(
        sk: *const stack_st_X509_OBJECT,
        out_index: *mut usize,
        p: *const X509_OBJECT,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_X509_OBJECT_shift__extern"]
    pub fn sk_X509_OBJECT_shift(sk: *mut stack_st_X509_OBJECT) -> *mut X509_OBJECT;
}
unsafe extern "C" {
    #[link_name = "sk_X509_OBJECT_push__extern"]
    pub fn sk_X509_OBJECT_push(sk: *mut stack_st_X509_OBJECT, p: *mut X509_OBJECT) -> usize;
}
unsafe extern "C" {
    #[link_name = "sk_X509_OBJECT_pop__extern"]
    pub fn sk_X509_OBJECT_pop(sk: *mut stack_st_X509_OBJECT) -> *mut X509_OBJECT;
}
unsafe extern "C" {
    #[link_name = "sk_X509_OBJECT_dup__extern"]
    pub fn sk_X509_OBJECT_dup(sk: *const stack_st_X509_OBJECT) -> *mut stack_st_X509_OBJECT;
}
unsafe extern "C" {
    #[link_name = "sk_X509_OBJECT_sort__extern"]
    pub fn sk_X509_OBJECT_sort(sk: *mut stack_st_X509_OBJECT);
}
unsafe extern "C" {
    #[link_name = "sk_X509_OBJECT_sort_and_dedup__extern"]
    pub fn sk_X509_OBJECT_sort_and_dedup(
        sk: *mut stack_st_X509_OBJECT,
        free_func: sk_X509_OBJECT_free_func,
    );
}
unsafe extern "C" {
    #[link_name = "sk_X509_OBJECT_is_sorted__extern"]
    pub fn sk_X509_OBJECT_is_sorted(sk: *const stack_st_X509_OBJECT) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_X509_OBJECT_set_cmp_func__extern"]
    pub fn sk_X509_OBJECT_set_cmp_func(
        sk: *mut stack_st_X509_OBJECT,
        comp: sk_X509_OBJECT_cmp_func,
    ) -> sk_X509_OBJECT_cmp_func;
}
unsafe extern "C" {
    #[link_name = "sk_X509_OBJECT_deep_copy__extern"]
    pub fn sk_X509_OBJECT_deep_copy(
        sk: *const stack_st_X509_OBJECT,
        copy_func: sk_X509_OBJECT_copy_func,
        free_func: sk_X509_OBJECT_free_func,
    ) -> *mut stack_st_X509_OBJECT;
}
unsafe extern "C" {
    /// X509_OBJECT_new returns a newly-allocated, empty `X509_OBJECT` or NULL on
    /// error.
    pub fn X509_OBJECT_new() -> *mut X509_OBJECT;
}
unsafe extern "C" {
    /// X509_OBJECT_free releases memory associated with `obj`.
    pub fn X509_OBJECT_free(obj: *mut X509_OBJECT);
}
unsafe extern "C" {
    /// X509_OBJECT_get_type returns the type of `obj`, which will be one of the
    /// `X509_LU_*` constants.
    pub fn X509_OBJECT_get_type(obj: *const X509_OBJECT) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_OBJECT_get0_X509 returns `obj` as a certificate, or NULL if `obj` is not
    /// a certificate.
    pub fn X509_OBJECT_get0_X509(obj: *const X509_OBJECT) -> *mut X509;
}
unsafe extern "C" {
    /// X509_STORE_get1_objects returns a newly-allocated stack containing the
    /// contents of `store`, or NULL on error. The caller must release the result
    /// with `sk_X509_OBJECT_pop_free` and `X509_OBJECT_free` when done.
    ///
    /// The result will include all certificates and CRLs added via
    /// `X509_STORE_add_cert` and `X509_STORE_add_crl`, as well as any cached objects
    /// added by `X509_LOOKUP_add_dir`. The last of these may change over time, as
    /// different objects are loaded from the filesystem. Callers should not depend
    /// on this caching behavior. The objects are returned in no particular order.
    pub fn X509_STORE_get1_objects(store: *mut X509_STORE) -> *mut stack_st_X509_OBJECT;
}
unsafe extern "C" {
    /// X509_STORE_CTX_new returns a newly-allocated, empty `X509_STORE_CTX`, or NULL
    /// on error.
    pub fn X509_STORE_CTX_new() -> *mut X509_STORE_CTX;
}
unsafe extern "C" {
    /// X509_STORE_CTX_free releases memory associated with `ctx`.
    pub fn X509_STORE_CTX_free(ctx: *mut X509_STORE_CTX);
}
unsafe extern "C" {
    /// X509_STORE_CTX_init initializes `ctx` to verify `x509`, using trusted
    /// certificates and parameters in `store`. It returns one on success and zero on
    /// error. `chain` is a list of untrusted intermediate certificates to use in
    /// verification.
    ///
    /// `ctx` stores pointers to `store`, `x509`, and `chain`. Each of these objects
    /// must outlive `ctx` and may not be mutated for the duration of the certificate
    /// verification.
    pub fn X509_STORE_CTX_init(
        ctx: *mut X509_STORE_CTX,
        store: *mut X509_STORE,
        x509: *mut X509,
        chain: *mut stack_st_X509,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_verify_cert performs certificate verification with `ctx`, which must
    /// have been initialized with `X509_STORE_CTX_init`. It returns one on success
    /// and zero on error. On success, `X509_STORE_CTX_get0_chain` or
    /// `X509_STORE_CTX_get1_chain` may be used to return the verified certificate
    /// chain. On error, `X509_STORE_CTX_get_error` may be used to return additional
    /// error information.
    ///
    /// WARNING: Most failure conditions from this function do not use the error
    /// queue. Use `X509_STORE_CTX_get_error` to determine the cause of the error.
    pub fn X509_verify_cert(ctx: *mut X509_STORE_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_STORE_CTX_get0_chain, after a successful `X509_verify_cert` call,
    /// returns the verified certificate chain. The chain begins with the leaf and
    /// ends with trust anchor.
    ///
    /// At other points, such as after a failed verification or during the deprecated
    /// verification callback, it returns the partial chain built so far. Callers
    /// should avoid relying on this as this exposes unstable library implementation
    /// details.
    pub fn X509_STORE_CTX_get0_chain(ctx: *const X509_STORE_CTX) -> *mut stack_st_X509;
}
unsafe extern "C" {
    /// X509_STORE_CTX_get1_chain behaves like `X509_STORE_CTX_get0_chain` but
    /// returns a newly-allocated `STACK_OF(X509)` containing the completed chain,
    /// with each certificate's reference count incremented. Callers must free the
    /// result with `sk_X509_pop_free` and `X509_free` when done.
    pub fn X509_STORE_CTX_get1_chain(ctx: *const X509_STORE_CTX) -> *mut stack_st_X509;
}
unsafe extern "C" {
    /// X509_STORE_CTX_get_error, after `X509_verify_cert` returns, returns
    /// `X509_V_OK` if verification succeeded or an `X509_V_ERR_*` describing why
    /// verification failed. This will be consistent with `X509_verify_cert`'s return
    /// value, unless the caller used the deprecated verification callback (see
    /// `X509_STORE_CTX_set_verify_cb`) in a way that breaks `ctx`'s invariants.
    ///
    /// If called during the deprecated verification callback when `ok` is zero, it
    /// returns the current error under consideration.
    pub fn X509_STORE_CTX_get_error(ctx: *const X509_STORE_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_STORE_CTX_set_error sets `ctx`'s error to `err`, which should be
    /// `X509_V_OK` or an `X509_V_ERR_*` constant. It is not expected to be called in
    /// typical `X509_STORE_CTX` usage, but may be used in callback APIs where
    /// applications synthesize `X509_STORE_CTX` error conditions. See also
    /// `X509_STORE_CTX_set_verify_cb` and `SSL_CTX_set_cert_verify_callback`.
    pub fn X509_STORE_CTX_set_error(ctx: *mut X509_STORE_CTX, err: ::core::ffi::c_int);
}
unsafe extern "C" {
    /// X509_verify_cert_error_string returns `err` as a human-readable string, where
    /// `err` should be one of the `X509_V_*` values. If `err` is unknown, it returns
    /// a default description.
    pub fn X509_verify_cert_error_string(err: ::core::ffi::c_long) -> *const ::core::ffi::c_char;
}
unsafe extern "C" {
    /// X509_STORE_CTX_get_error_depth returns the depth at which the error returned
    /// by `X509_STORE_CTX_get_error` occurred. This is zero-indexed integer into the
    /// certificate chain. Zero indicates the target certificate, one its issuer, and
    /// so on.
    pub fn X509_STORE_CTX_get_error_depth(ctx: *const X509_STORE_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_STORE_CTX_get_current_cert returns the certificate which caused the
    /// error returned by `X509_STORE_CTX_get_error`.
    pub fn X509_STORE_CTX_get_current_cert(ctx: *const X509_STORE_CTX) -> *mut X509;
}
unsafe extern "C" {
    /// X509_STORE_CTX_get0_current_crl returns the CRL which caused the error
    /// returned by `X509_STORE_CTX_get_error`.
    pub fn X509_STORE_CTX_get0_current_crl(ctx: *const X509_STORE_CTX) -> *mut X509_CRL;
}
unsafe extern "C" {
    /// X509_STORE_CTX_get0_store returns the `X509_STORE` that `ctx` uses.
    pub fn X509_STORE_CTX_get0_store(ctx: *const X509_STORE_CTX) -> *mut X509_STORE;
}
unsafe extern "C" {
    /// X509_STORE_CTX_get0_cert returns the leaf certificate that `ctx` is
    /// verifying.
    pub fn X509_STORE_CTX_get0_cert(ctx: *const X509_STORE_CTX) -> *mut X509;
}
unsafe extern "C" {
    /// X509_STORE_CTX_get0_untrusted returns the stack of untrusted intermediates
    /// used by `ctx` for certificate verification.
    pub fn X509_STORE_CTX_get0_untrusted(ctx: *const X509_STORE_CTX) -> *mut stack_st_X509;
}
unsafe extern "C" {
    /// X509_STORE_CTX_set0_trusted_stack configures `ctx` to trust the certificates
    /// in `sk`. `sk` must remain valid for the duration of `ctx`. Calling this
    /// function causes `ctx` to ignore any certificates configured in the
    /// `X509_STORE`. Certificates in `sk` are still subject to the check described
    /// in `X509_VERIFY_PARAM_set_trust`.
    ///
    /// WARNING: This function differs from most `set0` functions in that it does not
    /// take ownership of its input. The caller is required to ensure the lifetimes
    /// are consistent.
    pub fn X509_STORE_CTX_set0_trusted_stack(ctx: *mut X509_STORE_CTX, sk: *mut stack_st_X509);
}
unsafe extern "C" {
    /// X509_STORE_CTX_set0_crls configures `ctx` to consider the CRLs in `sk` as
    /// candidates for CRL lookup. `sk` must remain valid for the duration of `ctx`.
    /// These CRLs are considered in addition to CRLs found in `X509_STORE`.
    ///
    /// WARNING: This function differs from most `set0` functions in that it does not
    /// take ownership of its input. The caller is required to ensure the lifetimes
    /// are consistent.
    pub fn X509_STORE_CTX_set0_crls(ctx: *mut X509_STORE_CTX, sk: *mut stack_st_X509_CRL);
}
unsafe extern "C" {
    /// X509_STORE_CTX_set_default looks up the set of parameters named `name` and
    /// applies those default verification parameters for `ctx`. As in
    /// `X509_VERIFY_PARAM_inherit`, only unset parameters are changed. This function
    /// returns one on success and zero on error.
    ///
    /// The supported values of `name` are:
    /// - "default" is an internal value which configures some late defaults. See the
    ///   discussion in `X509_STORE_get0_param`.
    /// - "pkcs7" configures default trust and purpose checks for PKCS#7 signatures.
    /// - "smime_sign" configures trust and purpose checks for S/MIME signatures.
    /// - "ssl_client" configures trust and purpose checks for TLS clients.
    /// - "ssl_server" configures trust and purpose checks for TLS servers.
    ///
    /// TODO(crbug.com/boringssl/441): Make "default" a no-op.
    pub fn X509_STORE_CTX_set_default(
        ctx: *mut X509_STORE_CTX,
        name: *const ::core::ffi::c_char,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_STORE_CTX_get0_param returns `ctx`'s verification parameters. This
    /// object is mutable and may be modified by the caller.
    pub fn X509_STORE_CTX_get0_param(ctx: *mut X509_STORE_CTX) -> *mut X509_VERIFY_PARAM;
}
unsafe extern "C" {
    /// X509_STORE_CTX_set0_param returns `ctx`'s verification parameters to `param`
    /// and takes ownership of `param`. After this function returns, the caller
    /// should not free `param`.
    ///
    /// WARNING: This function discards any values which were previously applied in
    /// `ctx`, including the "default" parameters applied late in
    /// `X509_STORE_CTX_init`. These late defaults are not applied to parameters
    /// created standalone by `X509_VERIFY_PARAM_new`.
    ///
    /// TODO(crbug.com/boringssl/441): This behavior is very surprising. Should we
    /// re-apply the late defaults in `param`, or somehow avoid this notion of late
    /// defaults altogether?
    pub fn X509_STORE_CTX_set0_param(ctx: *mut X509_STORE_CTX, param: *mut X509_VERIFY_PARAM);
}
unsafe extern "C" {
    /// X509_STORE_CTX_set_flags enables all values in `flags` in `ctx`'s
    /// verification flags. `flags` should be a combination of `X509_V_FLAG_*`
    /// constants.
    pub fn X509_STORE_CTX_set_flags(ctx: *mut X509_STORE_CTX, flags: ::core::ffi::c_ulong);
}
unsafe extern "C" {
    /// X509_STORE_CTX_set_time configures certificate verification to use `t`
    /// instead of the current time. `flags` is ignored and should be zero.
    pub fn X509_STORE_CTX_set_time(
        ctx: *mut X509_STORE_CTX,
        flags: ::core::ffi::c_ulong,
        t: time_t,
    );
}
unsafe extern "C" {
    /// X509_STORE_CTX_set_time_posix configures certificate verification to use `t`
    /// instead of the current time. `t` is interpreted as a POSIX timestamp in
    /// seconds. `flags` is ignored and should be zero.
    pub fn X509_STORE_CTX_set_time_posix(
        ctx: *mut X509_STORE_CTX,
        flags: ::core::ffi::c_ulong,
        t: i64,
    );
}
unsafe extern "C" {
    /// X509_STORE_CTX_set_depth configures `ctx` to, by default, limit certificate
    /// chains to `depth` intermediate certificates. This count excludes both the
    /// target certificate and the trust anchor (root certificate).
    pub fn X509_STORE_CTX_set_depth(ctx: *mut X509_STORE_CTX, depth: ::core::ffi::c_int);
}
unsafe extern "C" {
    /// X509_STORE_CTX_set_purpose simultaneously configures `ctx`'s purpose and
    /// trust checks, if unset. It returns one on success and zero if `purpose` is
    /// not a valid purpose value. `purpose` should be an `X509_PURPOSE_*` constant.
    /// If so, it configures `ctx` with a purpose check of `purpose` and a trust
    /// check of `purpose`'s corresponding trust value. If either the purpose or
    /// trust check had already been specified for `ctx`, that corresponding
    /// modification is silently dropped.
    ///
    /// See `X509_VERIFY_PARAM_set_purpose` and `X509_VERIFY_PARAM_set_trust` for
    /// details on the purpose and trust checks, respectively.
    ///
    /// If `purpose` is `X509_PURPOSE_ANY`, this function returns an error because it
    /// has no corresponding `X509_TRUST_*` value. It is not possible to set
    /// `X509_PURPOSE_ANY` with this function, only `X509_VERIFY_PARAM_set_purpose`.
    ///
    /// WARNING: Unlike similarly named functions in this header, this function
    /// silently does not behave the same as `X509_VERIFY_PARAM_set_purpose`. Callers
    /// may use `X509_VERIFY_PARAM_set_purpose` with `X509_STORE_CTX_get0_param` to
    /// avoid this difference.
    pub fn X509_STORE_CTX_set_purpose(
        ctx: *mut X509_STORE_CTX,
        purpose: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_STORE_CTX_set_trust configures `ctx`'s trust check, if unset. It returns
    /// one on success and zero if `trust` is not a valid trust value. `trust` should
    /// be an `X509_TRUST_*` constant. If so, it configures `ctx` with a trust check
    /// of `trust`. If the trust check had already been specified for `ctx`, it
    /// silently does nothing.
    ///
    /// See `X509_VERIFY_PARAM_set_trust` for details on the purpose and trust check.
    ///
    /// WARNING: Unlike similarly named functions in this header, this function
    /// does not behave the same as `X509_VERIFY_PARAM_set_trust`. Callers may use
    /// `X509_VERIFY_PARAM_set_trust` with `X509_STORE_CTX_get0_param` to avoid this
    /// difference.
    pub fn X509_STORE_CTX_set_trust(
        ctx: *mut X509_STORE_CTX,
        trust: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_VERIFY_PARAM_new returns a newly-allocated `X509_VERIFY_PARAM`, or NULL
    /// on error.
    pub fn X509_VERIFY_PARAM_new() -> *mut X509_VERIFY_PARAM;
}
unsafe extern "C" {
    /// X509_VERIFY_PARAM_free releases memory associated with `param`.
    pub fn X509_VERIFY_PARAM_free(param: *mut X509_VERIFY_PARAM);
}
unsafe extern "C" {
    /// X509_VERIFY_PARAM_inherit applies `from` as the default values for `to`. That
    /// is, for each parameter that is unset in `to`, it copies the value in `from`.
    /// This function returns one on success and zero on error.
    pub fn X509_VERIFY_PARAM_inherit(
        to: *mut X509_VERIFY_PARAM,
        from: *const X509_VERIFY_PARAM,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_VERIFY_PARAM_set1 copies parameters from `from` to `to`. If a parameter
    /// is unset in `from`, the existing value in `to` is preserved. This function
    /// returns one on success and zero on error.
    pub fn X509_VERIFY_PARAM_set1(
        to: *mut X509_VERIFY_PARAM,
        from: *const X509_VERIFY_PARAM,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_VERIFY_PARAM_set_flags enables all values in `flags` in `param`'s
    /// verification flags and returns one. `flags` should be a combination of
    /// `X509_V_FLAG_*` constants.
    pub fn X509_VERIFY_PARAM_set_flags(
        param: *mut X509_VERIFY_PARAM,
        flags: ::core::ffi::c_ulong,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_VERIFY_PARAM_clear_flags disables all values in `flags` in `param`'s
    /// verification flags and returns one. `flags` should be a combination of
    /// `X509_V_FLAG_*` constants.
    pub fn X509_VERIFY_PARAM_clear_flags(
        param: *mut X509_VERIFY_PARAM,
        flags: ::core::ffi::c_ulong,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_VERIFY_PARAM_get_flags returns `param`'s verification flags.
    pub fn X509_VERIFY_PARAM_get_flags(param: *const X509_VERIFY_PARAM) -> ::core::ffi::c_ulong;
}
unsafe extern "C" {
    /// X509_VERIFY_PARAM_set_depth configures `param` to limit certificate chains to
    /// `depth` intermediate certificates. This count excludes both the target
    /// certificate and the trust anchor (root certificate).
    pub fn X509_VERIFY_PARAM_set_depth(param: *mut X509_VERIFY_PARAM, depth: ::core::ffi::c_int);
}
unsafe extern "C" {
    /// X509_VERIFY_PARAM_get_depth returns the maximum depth configured in `param`.
    /// See `X509_VERIFY_PARAM_set_depth`.
    pub fn X509_VERIFY_PARAM_get_depth(param: *const X509_VERIFY_PARAM) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_VERIFY_PARAM_set_time configures certificate verification to use `t`
    /// instead of the current time.
    pub fn X509_VERIFY_PARAM_set_time(param: *mut X509_VERIFY_PARAM, t: time_t);
}
unsafe extern "C" {
    /// X509_VERIFY_PARAM_set_time_posix configures certificate verification to use
    /// `t` instead of the current time. `t` is interpreted as a POSIX timestamp in
    /// seconds.
    pub fn X509_VERIFY_PARAM_set_time_posix(param: *mut X509_VERIFY_PARAM, t: i64);
}
unsafe extern "C" {
    /// X509_VERIFY_PARAM_add0_policy adds `policy` to the user-initial-policy-set
    /// (see Section 6.1.1 of RFC 5280). On success, it takes ownership of
    /// `policy` and returns one. Otherwise, it returns zero and the caller retains
    /// ownership of `policy`.
    pub fn X509_VERIFY_PARAM_add0_policy(
        param: *mut X509_VERIFY_PARAM,
        policy: *mut ASN1_OBJECT,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_VERIFY_PARAM_set1_policies sets the user-initial-policy-set (see
    /// Section 6.1.1 of RFC 5280) to a copy of `policies`. It returns one on success
    /// and zero on error.
    pub fn X509_VERIFY_PARAM_set1_policies(
        param: *mut X509_VERIFY_PARAM,
        policies: *const stack_st_ASN1_OBJECT,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_VERIFY_PARAM_set1_host configures `param` to check for the DNS name
    /// specified by `name`. It returns one on success and zero on error.
    ///
    /// By default, both subject alternative names and the subject's common name
    /// attribute are checked. The latter has long been deprecated, so callers should
    /// call `X509_VERIFY_PARAM_set_hostflags` with
    /// `X509_CHECK_FLAG_NEVER_CHECK_SUBJECT` to use the standard behavior.
    /// https://crbug.com/boringssl/464 tracks fixing the default.
    pub fn X509_VERIFY_PARAM_set1_host(
        param: *mut X509_VERIFY_PARAM,
        name: *const ::core::ffi::c_char,
        name_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_VERIFY_PARAM_add1_host adds `name` to the list of names checked by
    /// `param`. If any configured DNS name matches the certificate, verification
    /// succeeds. It returns one on success and zero on error.
    ///
    /// By default, both subject alternative names and the subject's common name
    /// attribute are checked. The latter has long been deprecated, so callers should
    /// call `X509_VERIFY_PARAM_set_hostflags` with
    /// `X509_CHECK_FLAG_NEVER_CHECK_SUBJECT` to use the standard behavior.
    /// https://crbug.com/boringssl/464 tracks fixing the default.
    pub fn X509_VERIFY_PARAM_add1_host(
        param: *mut X509_VERIFY_PARAM,
        name: *const ::core::ffi::c_char,
        name_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_VERIFY_PARAM_set_hostflags sets the name-checking flags on `param` to
    /// `flags`. `flags` should be a combination of `X509_CHECK_FLAG_*` constants.
    pub fn X509_VERIFY_PARAM_set_hostflags(
        param: *mut X509_VERIFY_PARAM,
        flags: ::core::ffi::c_uint,
    );
}
unsafe extern "C" {
    /// X509_VERIFY_PARAM_set1_email configures `param` to check for the email
    /// address specified by `email`. It returns one on success and zero on error.
    ///
    /// By default, both subject alternative names and the subject's email address
    /// attribute are checked. The `X509_CHECK_FLAG_NEVER_CHECK_SUBJECT` flag may be
    /// used to change this behavior.
    pub fn X509_VERIFY_PARAM_set1_email(
        param: *mut X509_VERIFY_PARAM,
        email: *const ::core::ffi::c_char,
        email_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_VERIFY_PARAM_set1_ip configures `param` to check for the IP address
    /// specified by `ip`. It returns one on success and zero on error. The IP
    /// address is specified in its binary representation. `ip_len` must be 4 for an
    /// IPv4 address and 16 for an IPv6 address.
    pub fn X509_VERIFY_PARAM_set1_ip(
        param: *mut X509_VERIFY_PARAM,
        ip: *const u8,
        ip_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_VERIFY_PARAM_set1_ip_asc decodes `ipasc` as the ASCII representation of
    /// an IPv4 or IPv6 address, and configures `param` to check for it. It returns
    /// one on success and zero on error.
    pub fn X509_VERIFY_PARAM_set1_ip_asc(
        param: *mut X509_VERIFY_PARAM,
        ipasc: *const ::core::ffi::c_char,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_VERIFY_PARAM_set_purpose configures `param` to validate certificates for
    /// a specified purpose. It returns one on success and zero if `purpose` is not a
    /// valid purpose type. `purpose` should be one of the `X509_PURPOSE_*` values.
    ///
    /// This option controls checking the extended key usage (EKU) and key usage
    /// extensions. These extensions specify how a certificate's public key may be
    /// used and are important to avoid cross-protocol attacks, particularly in PKIs
    /// that may issue certificates for multiple protocols, or for protocols that use
    /// keys in multiple ways. If not configured, these security checks are the
    /// caller's responsibility.
    ///
    /// This library applies the EKU checks to all untrusted intermediates. Although
    /// not defined in RFC 5280, this matches widely-deployed practice. It also does
    /// not accept anyExtendedKeyUsage.
    ///
    /// Many purpose values have a corresponding trust value, which is not configured
    /// by this function.  See `X509_VERIFY_PARAM_set_trust` for details. Callers
    /// that wish to configure both should either call both functions, or use
    /// `X509_STORE_CTX_set_purpose`.
    ///
    /// It is currently not possible to configure custom EKU OIDs or key usage bits.
    /// Contact the BoringSSL maintainers if your application needs to do so. OpenSSL
    /// had an `X509_PURPOSE_add` API, but it was not thread-safe and relied on
    /// global mutable state, so we removed it.
    ///
    /// TODO(davidben): This function additionally configures checking the legacy
    /// Netscape certificate type extension. Remove this.
    pub fn X509_VERIFY_PARAM_set_purpose(
        param: *mut X509_VERIFY_PARAM,
        purpose: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_VERIFY_PARAM_set_trust configures which certificates from `X509_STORE`
    /// are trust anchors. It returns one on success and zero if `trust` is not a
    /// valid trust value. `trust` should be one of the `X509_TRUST_*` constants.
    /// This function allows applications to vary trust anchors when the same set of
    /// trusted certificates is used in multiple contexts.
    ///
    /// Two properties determine whether a certificate is a trust anchor:
    ///
    /// - Whether it is trusted or distrusted for some OID, via auxiliary information
    ///   configured by `X509_add1_trust_object` or `X509_add1_reject_object`.
    ///
    /// - Whether it is "self-signed". That is, whether `X509_get_extension_flags`
    ///   includes `EXFLAG_SS`. The signature itself is not checked.
    ///
    /// When this function is called, `trust` determines the OID to check in the
    /// first case. If the certificate is not explicitly trusted or distrusted for
    /// any OID, it is trusted if self-signed instead.
    ///
    /// If unset, the default behavior is to check for the `NID_anyExtendedKeyUsage`
    /// OID. If the certificate is not explicitly trusted or distrusted for this OID,
    /// it is trusted if self-signed instead. Note this slightly differs from the
    /// above.
    ///
    /// If the `X509_V_FLAG_PARTIAL_CHAIN` is set, every certificate from
    /// `X509_STORE` is a trust anchor, unless it was explicitly distrusted for the
    /// OID.
    ///
    /// It is currently not possible to configure custom trust OIDs. Contact the
    /// BoringSSL maintainers if your application needs to do so. OpenSSL had an
    /// `X509_TRUST_add` API, but it was not thread-safe and relied on global mutable
    /// state, so we removed it.
    pub fn X509_VERIFY_PARAM_set_trust(
        param: *mut X509_VERIFY_PARAM,
        trust: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_STORE_load_locations configures `store` to load data from filepaths
    /// `file` and `dir`. It returns one on success and zero on error. Either of
    /// `file` or `dir` may be NULL, but at least one must be non-NULL.
    ///
    /// If `file` is non-NULL, it loads CRLs and trusted certificates in PEM format
    /// from the file at `file`, and them to `store`, as in `X509_load_cert_crl_file`
    /// with `X509_FILETYPE_PEM`.
    ///
    /// If `dir` is non-NULL, it configures `store` to load CRLs and trusted
    /// certificates from the directory at `dir` in PEM format, as in
    /// `X509_LOOKUP_add_dir` with `X509_FILETYPE_PEM`.
    pub fn X509_STORE_load_locations(
        store: *mut X509_STORE,
        file: *const ::core::ffi::c_char,
        dir: *const ::core::ffi::c_char,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_STORE_add_lookup returns an `X509_LOOKUP` associated with `store` with
    /// type `method`, or NULL on error. The result is owned by `store`, so callers
    /// are not expected to free it. This may be used with `X509_LOOKUP_add_dir` or
    /// `X509_LOOKUP_load_file`, depending on `method`, to configure `store`.
    ///
    /// A single `X509_LOOKUP` may be configured with multiple paths, and an
    /// `X509_STORE` only contains one `X509_LOOKUP` of each type, so there is no
    /// need to call this function multiple times for a single type. Calling it
    /// multiple times will return the previous `X509_LOOKUP` of that type.
    pub fn X509_STORE_add_lookup(
        store: *mut X509_STORE,
        method: *const X509_LOOKUP_METHOD,
    ) -> *mut X509_LOOKUP;
}
unsafe extern "C" {
    /// X509_LOOKUP_hash_dir creates `X509_LOOKUP`s that may be used with
    /// `X509_LOOKUP_add_dir`.
    pub fn X509_LOOKUP_hash_dir() -> *const X509_LOOKUP_METHOD;
}
unsafe extern "C" {
    /// X509_LOOKUP_file creates `X509_LOOKUP`s that may be used with
    /// `X509_LOOKUP_load_file`.
    ///
    /// Although this is modeled as an `X509_LOOKUP`, this function is redundant. It
    /// has the same effect as loading a certificate or CRL from the filesystem, in
    /// the caller's desired format, and then adding it with `X509_STORE_add_cert`
    /// and `X509_STORE_add_crl`.
    pub fn X509_LOOKUP_file() -> *const X509_LOOKUP_METHOD;
}
unsafe extern "C" {
    /// X509_LOOKUP_load_file calls `X509_load_cert_crl_file`. `lookup` must have
    /// been constructed with `X509_LOOKUP_file`.
    ///
    /// If `type` is `X509_FILETYPE_DEFAULT`, it ignores `file` and instead uses some
    /// default system path with `X509_FILETYPE_PEM`. See also
    /// `X509_STORE_set_default_paths`.
    pub fn X509_LOOKUP_load_file(
        lookup: *mut X509_LOOKUP,
        file: *const ::core::ffi::c_char,
        type_: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_LOOKUP_add_dir configures `lookup` to load CRLs and trusted certificates
    /// from the directories in `path`. It returns one on success and zero on error.
    /// `lookup` must have been constructed with `X509_LOOKUP_hash_dir`.
    ///
    /// WARNING: `path` is interpreted as a colon-separated (semicolon-separated on
    /// Windows) list of paths. It is not possible to configure a path containing the
    /// separator character. https://crbug.com/boringssl/691 tracks removing this
    /// behavior.
    ///
    /// `type` should be one of the `X509_FILETYPE_*` constants and determines the
    /// format of the files. If `type` is `X509_FILETYPE_DEFAULT`, `path` is ignored
    /// and some default system path is used with `X509_FILETYPE_PEM`. See also
    /// `X509_STORE_set_default_paths`.
    ///
    /// Trusted certificates should be named HASH.N and CRLs should be
    /// named HASH.rN. HASH is `X509_NAME_hash` of the certificate subject and CRL
    /// issuer, respectively, in hexadecimal. N is in decimal and counts hash
    /// collisions consecutively, starting from zero. For example, "002c0b4f.0" and
    /// "002c0b4f.r0".
    ///
    /// WARNING: Objects from `path` are loaded on demand, but cached in memory on
    /// the `X509_STORE`. If a CA is removed from the directory, existing
    /// `X509_STORE`s will continue to trust it. Cache entries are not evicted for
    /// the lifetime of the `X509_STORE`.
    ///
    /// WARNING: This mechanism is also not well-suited for CRL updates.
    /// `X509_STORE`s rely on this cache and never load the same CRL file twice. CRL
    /// updates must use a new file, with an incremented suffix, to be reflected in
    /// existing `X509_STORE`s. However, this means each CRL update will use
    /// additional storage and memory. Instead, configure inputs that vary per
    /// verification, such as CRLs, on each `X509_STORE_CTX` separately, using
    /// functions like `X509_STORE_CTX_set0_crl`.
    pub fn X509_LOOKUP_add_dir(
        lookup: *mut X509_LOOKUP,
        path: *const ::core::ffi::c_char,
        type_: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_LOOKUP_ctrl implements commands on `lookup`. `cmd` specifies the
    /// command. The other arguments specify the operation in a command-specific way.
    /// Use `X509_LOOKUP_load_file` or `X509_LOOKUP_add_dir` instead.
    pub fn X509_LOOKUP_ctrl(
        lookup: *mut X509_LOOKUP,
        cmd: ::core::ffi::c_int,
        argc: *const ::core::ffi::c_char,
        argl: ::core::ffi::c_long,
        ret: *mut *mut ::core::ffi::c_char,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_load_cert_file loads trusted certificates from `file` and adds them to
    /// `lookup`'s `X509_STORE`. It returns one on success and zero on error.
    ///
    /// If `type` is `X509_FILETYPE_ASN1`, it loads a single DER-encoded certificate.
    /// If `type` is `X509_FILETYPE_PEM`, it loads a sequence of PEM-encoded
    /// certificates. `type` may not be `X509_FILETYPE_DEFAULT`.
    pub fn X509_load_cert_file(
        lookup: *mut X509_LOOKUP,
        file: *const ::core::ffi::c_char,
        type_: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_load_crl_file loads CRLs from `file` and add them it to `lookup`'s
    /// `X509_STORE`. It returns one on success and zero on error.
    ///
    /// If `type` is `X509_FILETYPE_ASN1`, it loads a single DER-encoded CRL. If
    /// `type` is `X509_FILETYPE_PEM`, it loads a sequence of PEM-encoded CRLs.
    /// `type` may not be `X509_FILETYPE_DEFAULT`.
    pub fn X509_load_crl_file(
        lookup: *mut X509_LOOKUP,
        file: *const ::core::ffi::c_char,
        type_: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_load_cert_crl_file loads CRLs and trusted certificates from `file` and
    /// adds them to `lookup`'s `X509_STORE`. It returns one on success and zero on
    /// error.
    ///
    /// If `type` is `X509_FILETYPE_ASN1`, it loads a single DER-encoded certificate.
    /// This function cannot be used to load a DER-encoded CRL. If `type` is
    /// `X509_FILETYPE_PEM`, it loads a sequence of PEM-encoded certificates and
    /// CRLs. `type` may not be `X509_FILETYPE_DEFAULT`.
    pub fn X509_load_cert_crl_file(
        lookup: *mut X509_LOOKUP,
        file: *const ::core::ffi::c_char,
        type_: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_NAME_hash returns a hash of `name`, or zero on error. This is the new
    /// hash used by `X509_LOOKUP_add_dir`.
    ///
    /// This hash is specific to the `X509_LOOKUP_add_dir` filesystem format and is
    /// not suitable for general-purpose X.509 name processing. It is very short, so
    /// there will be hash collisions. It also depends on an OpenSSL-specific
    /// canonicalization process.
    pub fn X509_NAME_hash(name: *const X509_NAME) -> u32;
}
unsafe extern "C" {
    /// X509_NAME_hash_old returns a hash of `name`, or zero on error. This is the
    /// legacy hash used by `X509_LOOKUP_add_dir`, which is still supported for
    /// compatibility.
    ///
    /// This hash is specific to the `X509_LOOKUP_add_dir` filesystem format and is
    /// not suitable for general-purpose X.509 name processing. It is very short, so
    /// there will be hash collisions.
    pub fn X509_NAME_hash_old(name: *const X509_NAME) -> u32;
}
unsafe extern "C" {
    /// X509_STORE_set_default_paths configures `store` to read from some "default"
    /// filesystem paths. It returns one on success and zero on error. The filesystem
    /// paths are determined by a combination of hardcoded paths and the SSL_CERT_DIR
    /// and SSL_CERT_FILE environment variables.
    ///
    /// Using this function is not recommended. In OpenSSL, these defaults are
    /// determined by OpenSSL's install prefix. There is no corresponding concept for
    /// BoringSSL. Future versions of BoringSSL may change or remove this
    /// functionality.
    pub fn X509_STORE_set_default_paths(store: *mut X509_STORE) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// The following functions return filesystem paths used to determine the above
    /// "default" paths, when the corresponding environment variables are not set.
    ///
    /// Using these functions is not recommended. In OpenSSL, these defaults are
    /// determined by OpenSSL's install prefix. There is no corresponding concept for
    /// BoringSSL. Future versions of BoringSSL may change or remove this
    /// functionality.
    pub fn X509_get_default_cert_area() -> *const ::core::ffi::c_char;
}
unsafe extern "C" {
    pub fn X509_get_default_cert_dir() -> *const ::core::ffi::c_char;
}
unsafe extern "C" {
    pub fn X509_get_default_cert_file() -> *const ::core::ffi::c_char;
}
unsafe extern "C" {
    pub fn X509_get_default_private_dir() -> *const ::core::ffi::c_char;
}
unsafe extern "C" {
    /// X509_get_default_cert_dir_env returns "SSL_CERT_DIR", an environment variable
    /// used to determine the above "default" paths.
    pub fn X509_get_default_cert_dir_env() -> *const ::core::ffi::c_char;
}
unsafe extern "C" {
    /// X509_get_default_cert_file_env returns "SSL_CERT_FILE", an environment
    /// variable used to determine the above "default" paths.
    pub fn X509_get_default_cert_file_env() -> *const ::core::ffi::c_char;
}
/// A Netscape_spki_st, or `NETSCAPE_SPKI`, represents a
/// SignedPublicKeyAndChallenge structure. Although this structure contains a
/// `spkac` field of type `NETSCAPE_SPKAC`, these are misnamed. The SPKAC is the
/// entire structure, not the signed portion.
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct Netscape_spki_st {
    pub spkac: *mut NETSCAPE_SPKAC,
    pub sig_algor: *mut X509_ALGOR,
    pub signature: *mut ASN1_BIT_STRING,
}
unsafe extern "C" {
    /// NETSCAPE_SPKI_new returns a newly-allocated, empty `NETSCAPE_SPKI` object, or
    /// NULL on error.
    pub fn NETSCAPE_SPKI_new() -> *mut NETSCAPE_SPKI;
}
unsafe extern "C" {
    /// NETSCAPE_SPKI_free releases memory associated with `spki`.
    pub fn NETSCAPE_SPKI_free(spki: *mut NETSCAPE_SPKI);
}
unsafe extern "C" {
    /// d2i_NETSCAPE_SPKI parses up to `len` bytes from `*inp` as a DER-encoded
    /// SignedPublicKeyAndChallenge structure, as described in `d2i_SAMPLE`.
    pub fn d2i_NETSCAPE_SPKI(
        out: *mut *mut NETSCAPE_SPKI,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut NETSCAPE_SPKI;
}
unsafe extern "C" {
    /// i2d_NETSCAPE_SPKI marshals `spki` as a DER-encoded
    /// SignedPublicKeyAndChallenge structure, as described in `i2d_SAMPLE`.
    pub fn i2d_NETSCAPE_SPKI(spki: *const NETSCAPE_SPKI, outp: *mut *mut u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// NETSCAPE_SPKI_verify checks that `spki` has a valid signature by `pkey`. It
    /// returns one if the signature is valid and zero otherwise.
    pub fn NETSCAPE_SPKI_verify(
        spki: *mut NETSCAPE_SPKI,
        pkey: *mut EVP_PKEY,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// NETSCAPE_SPKI_b64_decode decodes `len` bytes from `str` as a base64-encoded
    /// SignedPublicKeyAndChallenge structure. It returns a newly-allocated
    /// `NETSCAPE_SPKI` structure with the result, or NULL on error. If `len` is 0 or
    /// negative, the length is calculated with `strlen` and `str` must be a
    /// NUL-terminated C string.
    pub fn NETSCAPE_SPKI_b64_decode(
        str_: *const ::core::ffi::c_char,
        len: ossl_ssize_t,
    ) -> *mut NETSCAPE_SPKI;
}
unsafe extern "C" {
    /// NETSCAPE_SPKI_b64_encode encodes `spki` as a base64-encoded
    /// SignedPublicKeyAndChallenge structure. It returns a newly-allocated
    /// NUL-terminated C string with the result, or NULL on error. The caller must
    /// release the memory with `OPENSSL_free` when done.
    pub fn NETSCAPE_SPKI_b64_encode(spki: *mut NETSCAPE_SPKI) -> *mut ::core::ffi::c_char;
}
unsafe extern "C" {
    /// NETSCAPE_SPKI_get_pubkey decodes and returns the public key in `spki` as an
    /// `EVP_PKEY`, or NULL on error. The caller takes ownership of the resulting
    /// pointer and must call `EVP_PKEY_free` when done.
    pub fn NETSCAPE_SPKI_get_pubkey(spki: *const NETSCAPE_SPKI) -> *mut EVP_PKEY;
}
unsafe extern "C" {
    /// NETSCAPE_SPKI_set_pubkey sets `spki`'s public key to `pkey`. It returns one
    /// on success or zero on error. This function does not take ownership of `pkey`,
    /// so the caller may continue to manage its lifetime independently of `spki`.
    pub fn NETSCAPE_SPKI_set_pubkey(
        spki: *mut NETSCAPE_SPKI,
        pkey: *mut EVP_PKEY,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// NETSCAPE_SPKI_sign signs `spki` with `pkey` and replaces the signature
    /// algorithm and signature fields. It returns the length of the signature on
    /// success and zero on error. This function uses digest algorithm `md`, or
    /// `pkey`'s default if NULL. Other signing parameters use `pkey`'s defaults.
    pub fn NETSCAPE_SPKI_sign(
        spki: *mut NETSCAPE_SPKI,
        pkey: *mut EVP_PKEY,
        md: *const EVP_MD,
    ) -> ::core::ffi::c_int;
}
/// A Netscape_spkac_st, or `NETSCAPE_SPKAC`, represents a PublicKeyAndChallenge
/// structure. This type is misnamed. The full SPKAC includes the signature,
/// which is represented with the `NETSCAPE_SPKI` type.
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct Netscape_spkac_st {
    pub pubkey: *mut X509_PUBKEY,
    pub challenge: *mut ASN1_IA5STRING,
}
unsafe extern "C" {
    /// NETSCAPE_SPKAC_new returns a newly-allocated, empty `NETSCAPE_SPKAC` object,
    /// or NULL on error.
    pub fn NETSCAPE_SPKAC_new() -> *mut NETSCAPE_SPKAC;
}
unsafe extern "C" {
    /// NETSCAPE_SPKAC_free releases memory associated with `spkac`.
    pub fn NETSCAPE_SPKAC_free(spkac: *mut NETSCAPE_SPKAC);
}
unsafe extern "C" {
    /// d2i_NETSCAPE_SPKAC parses up to `len` bytes from `*inp` as a DER-encoded
    /// PublicKeyAndChallenge structure, as described in `d2i_SAMPLE`.
    pub fn d2i_NETSCAPE_SPKAC(
        out: *mut *mut NETSCAPE_SPKAC,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut NETSCAPE_SPKAC;
}
unsafe extern "C" {
    /// i2d_NETSCAPE_SPKAC marshals `spkac` as a DER-encoded PublicKeyAndChallenge
    /// structure, as described in `i2d_SAMPLE`.
    pub fn i2d_NETSCAPE_SPKAC(
        spkac: *const NETSCAPE_SPKAC,
        outp: *mut *mut u8,
    ) -> ::core::ffi::c_int;
}
/// An rsa_pss_params_st, aka `RSA_PSS_PARAMS`, represents a parsed
/// RSASSA-PSS-params structure, as defined in (RFC 4055).
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct rsa_pss_params_st {
    pub hashAlgorithm: *mut X509_ALGOR,
    pub maskGenAlgorithm: *mut X509_ALGOR,
    pub saltLength: *mut ASN1_INTEGER,
    pub trailerField: *mut ASN1_INTEGER,
    /// OpenSSL caches the MGF hash on `RSA_PSS_PARAMS` in some cases. None of the
    /// cases apply to BoringSSL, so this is always NULL, but Node expects the
    /// field to be present.
    pub maskHash: *mut X509_ALGOR,
}
unsafe extern "C" {
    /// RSA_PSS_PARAMS is an `ASN1_ITEM` whose ASN.1 type is RSASSA-PSS-params (RFC
    /// 4055) and C type is `RSA_PSS_PARAMS*`.
    pub static RSA_PSS_PARAMS_it: ASN1_ITEM;
}
unsafe extern "C" {
    /// RSA_PSS_PARAMS_new returns a new, empty `RSA_PSS_PARAMS`, or NULL on error.
    pub fn RSA_PSS_PARAMS_new() -> *mut RSA_PSS_PARAMS;
}
unsafe extern "C" {
    /// RSA_PSS_PARAMS_free releases memory associated with `params`.
    pub fn RSA_PSS_PARAMS_free(params: *mut RSA_PSS_PARAMS);
}
unsafe extern "C" {
    /// d2i_RSA_PSS_PARAMS parses up to `len` bytes from `*inp` as a DER-encoded
    /// RSASSA-PSS-params (RFC 4055), as described in `d2i_SAMPLE`.
    pub fn d2i_RSA_PSS_PARAMS(
        out: *mut *mut RSA_PSS_PARAMS,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut RSA_PSS_PARAMS;
}
unsafe extern "C" {
    /// i2d_RSA_PSS_PARAMS marshals `in` as a DER-encoded RSASSA-PSS-params (RFC
    /// 4055), as described in `i2d_SAMPLE`.
    pub fn i2d_RSA_PSS_PARAMS(in_: *const RSA_PSS_PARAMS, outp: *mut *mut u8)
        -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PKCS8_PRIV_KEY_INFO_new returns a newly-allocated, empty
    /// `PKCS8_PRIV_KEY_INFO` object, or NULL on error.
    pub fn PKCS8_PRIV_KEY_INFO_new() -> *mut PKCS8_PRIV_KEY_INFO;
}
unsafe extern "C" {
    /// PKCS8_PRIV_KEY_INFO_free releases memory associated with `key`.
    pub fn PKCS8_PRIV_KEY_INFO_free(key: *mut PKCS8_PRIV_KEY_INFO);
}
unsafe extern "C" {
    /// d2i_PKCS8_PRIV_KEY_INFO parses up to `len` bytes from `*inp` as a DER-encoded
    /// PrivateKeyInfo, as described in `d2i_SAMPLE`.
    pub fn d2i_PKCS8_PRIV_KEY_INFO(
        out: *mut *mut PKCS8_PRIV_KEY_INFO,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut PKCS8_PRIV_KEY_INFO;
}
unsafe extern "C" {
    /// i2d_PKCS8_PRIV_KEY_INFO marshals `key` as a DER-encoded PrivateKeyInfo, as
    /// described in `i2d_SAMPLE`.
    pub fn i2d_PKCS8_PRIV_KEY_INFO(
        key: *const PKCS8_PRIV_KEY_INFO,
        outp: *mut *mut u8,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// EVP_PKCS82PKEY returns `p8` as a newly-allocated `EVP_PKEY`, or NULL if the
    /// key was unsupported or could not be decoded. The caller must release the
    /// result with `EVP_PKEY_free` when done.
    ///
    /// Use `EVP_parse_private_key` instead.
    pub fn EVP_PKCS82PKEY(p8: *const PKCS8_PRIV_KEY_INFO) -> *mut EVP_PKEY;
}
unsafe extern "C" {
    /// EVP_PKEY2PKCS8 encodes `pkey` as a PKCS#8 PrivateKeyInfo (RFC 5208),
    /// represented as a newly-allocated `PKCS8_PRIV_KEY_INFO`, or NULL on error. The
    /// caller must release the result with `PKCS8_PRIV_KEY_INFO_free` when done.
    ///
    /// Use `EVP_marshal_private_key` instead.
    pub fn EVP_PKEY2PKCS8(pkey: *const EVP_PKEY) -> *mut PKCS8_PRIV_KEY_INFO;
}
unsafe extern "C" {
    /// X509_SIG_new returns a newly-allocated, empty `X509_SIG` object, or NULL on
    /// error.
    pub fn X509_SIG_new() -> *mut X509_SIG;
}
unsafe extern "C" {
    /// X509_SIG_free releases memory associated with `key`.
    pub fn X509_SIG_free(key: *mut X509_SIG);
}
unsafe extern "C" {
    /// d2i_X509_SIG parses up to `len` bytes from `*inp` as a DER-encoded algorithm
    /// and octet string pair, as described in `d2i_SAMPLE`.
    pub fn d2i_X509_SIG(
        out: *mut *mut X509_SIG,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut X509_SIG;
}
unsafe extern "C" {
    /// i2d_X509_SIG marshals `sig` as a DER-encoded algorithm
    /// and octet string pair, as described in `i2d_SAMPLE`.
    pub fn i2d_X509_SIG(sig: *const X509_SIG, outp: *mut *mut u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_SIG_get0 sets `*out_alg` and `*out_digest` to non-owning pointers to
    /// `sig`'s algorithm and digest fields, respectively. Either `out_alg` and
    /// `out_digest` may be NULL to skip those fields.
    pub fn X509_SIG_get0(
        sig: *const X509_SIG,
        out_alg: *mut *const X509_ALGOR,
        out_digest: *mut *const ASN1_OCTET_STRING,
    );
}
unsafe extern "C" {
    /// X509_SIG_getm behaves like `X509_SIG_get0` but returns mutable pointers.
    pub fn X509_SIG_getm(
        sig: *mut X509_SIG,
        out_alg: *mut *mut X509_ALGOR,
        out_digest: *mut *mut ASN1_OCTET_STRING,
    );
}
unsafe extern "C" {
    /// X509_print_ex writes a human-readable representation of `x` to `bp`. It
    /// returns one on success and zero on error. `nmflags` is the flags parameter
    /// for `X509_NAME_print_ex` when printing the subject and issuer. `cflag` should
    /// be some combination of the `X509_FLAG_*` and `X509V3_EXT_*` constants.
    pub fn X509_print_ex(
        bp: *mut BIO,
        x: *const X509,
        nmflag: ::core::ffi::c_ulong,
        cflag: ::core::ffi::c_ulong,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_print_ex_fp behaves like `X509_print_ex` but writes to `fp`.
    pub fn X509_print_ex_fp(
        fp: *mut FILE,
        x: *const X509,
        nmflag: ::core::ffi::c_ulong,
        cflag: ::core::ffi::c_ulong,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_print calls `X509_print_ex` with `XN_FLAG_COMPAT` and `X509_FLAG_COMPAT`
    /// flags.
    pub fn X509_print(bp: *mut BIO, x: *const X509) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_print_fp behaves like `X509_print` but writes to `fp`.
    pub fn X509_print_fp(fp: *mut FILE, x: *const X509) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_CRL_print writes a human-readable representation of `x` to `bp`. It
    /// returns one on success and zero on error.
    pub fn X509_CRL_print(bp: *mut BIO, x: *const X509_CRL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_CRL_print_fp behaves like `X509_CRL_print` but writes to `fp`.
    pub fn X509_CRL_print_fp(fp: *mut FILE, x: *const X509_CRL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_REQ_print_ex writes a human-readable representation of `x` to `bp`. It
    /// returns one on success and zero on error. `nmflags` is the flags parameter
    /// for `X509_NAME_print_ex`, when printing the subject. `cflag` should be some
    /// combination of the `X509_FLAG_*` and `X509V3_EXT_*` constants.
    pub fn X509_REQ_print_ex(
        bp: *mut BIO,
        x: *const X509_REQ,
        nmflag: ::core::ffi::c_ulong,
        cflag: ::core::ffi::c_ulong,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_REQ_print calls `X509_REQ_print_ex` with `XN_FLAG_COMPAT` and
    /// `X509_FLAG_COMPAT` flags.
    pub fn X509_REQ_print(bp: *mut BIO, req: *const X509_REQ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_REQ_print_fp behaves like `X509_REQ_print` but writes to `fp`.
    pub fn X509_REQ_print_fp(fp: *mut FILE, req: *const X509_REQ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_NAME_print_ex writes a human-readable representation of `nm` to `out`.
    /// Each line of output is indented by `indent` spaces. It returns the number of
    /// bytes written on success, and -1 on error. If `out` is NULL, it returns the
    /// number of bytes it would have written but does not write anything. `flags`
    /// should be some combination of `XN_FLAG_*` and `ASN1_STRFLGS_*` values and
    /// determines the output. If unsure, use `XN_FLAG_RFC2253`.
    ///
    /// If `flags` is `XN_FLAG_COMPAT`, or zero, this function calls
    /// `X509_NAME_print` instead. In that case, it returns one on success, rather
    /// than the output length.
    pub fn X509_NAME_print_ex(
        out: *mut BIO,
        nm: *const X509_NAME,
        indent: ::core::ffi::c_int,
        flags: ::core::ffi::c_ulong,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_NAME_print prints a human-readable representation of `name` to `bp`. It
    /// returns one on success and zero on error. `obase` is ignored.
    ///
    /// This function outputs a legacy format that does not correctly handle string
    /// encodings and other cases. Prefer `X509_NAME_print_ex` if printing a name for
    /// debugging purposes.
    pub fn X509_NAME_print(
        bp: *mut BIO,
        name: *const X509_NAME,
        obase: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_NAME_oneline writes a human-readable representation to `name` to a
    /// buffer as a NUL-terminated C string.
    ///
    /// If `buf` is NULL, returns a newly-allocated buffer containing the result on
    /// success, or NULL on error. The buffer must be released with `OPENSSL_free`
    /// when done.
    ///
    /// If `buf` is non-NULL, at most `size` bytes of output are written to `buf`
    /// instead. `size` includes the trailing NUL. The function then returns `buf` on
    /// success or NULL on error. If the output does not fit in `size` bytes, the
    /// output is silently truncated at an attribute boundary.
    ///
    /// This function outputs a legacy format that does not correctly handle string
    /// encodings and other cases. Prefer `X509_NAME_print_ex` if printing a name for
    /// debugging purposes.
    pub fn X509_NAME_oneline(
        name: *const X509_NAME,
        buf: *mut ::core::ffi::c_char,
        size: ::core::ffi::c_int,
    ) -> *mut ::core::ffi::c_char;
}
unsafe extern "C" {
    /// X509_NAME_print_ex_fp behaves like `X509_NAME_print_ex` but writes to `fp`.
    pub fn X509_NAME_print_ex_fp(
        fp: *mut FILE,
        nm: *const X509_NAME,
        indent: ::core::ffi::c_int,
        flags: ::core::ffi::c_ulong,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_signature_dump writes a human-readable representation of `sig` to `bio`,
    /// indented with `indent` spaces. It returns one on success and zero on error.
    pub fn X509_signature_dump(
        bio: *mut BIO,
        sig: *const ASN1_STRING,
        indent: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_signature_print writes a human-readable representation of `alg` and
    /// `sig` to `bio`. It returns one on success and zero on error.
    pub fn X509_signature_print(
        bio: *mut BIO,
        alg: *const X509_ALGOR,
        sig: *const ASN1_STRING,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509V3_EXT_print prints a human-readable representation of `ext` to out. It
    /// returns one on success and zero on error. The output is indented by `indent`
    /// spaces. `flag` is one of the `X509V3_EXT_*` constants and controls printing
    /// of unknown extensions and syntax errors.
    ///
    /// WARNING: Although some applications programmatically parse the output of this
    /// function to process X.509 extensions, this is not safe. In many cases, the
    /// outputs are ambiguous to attempting to parse them can lead to string
    /// injection vulnerabilities. These functions should only be used for debugging
    /// or logging.
    pub fn X509V3_EXT_print(
        out: *mut BIO,
        ext: *const X509_EXTENSION,
        flag: ::core::ffi::c_ulong,
        indent: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509V3_EXT_print_fp behaves like `X509V3_EXT_print` but writes to a `FILE`
    /// instead of a `BIO`.
    pub fn X509V3_EXT_print_fp(
        out: *mut FILE,
        ext: *const X509_EXTENSION,
        flag: ::core::ffi::c_int,
        indent: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509V3_extensions_print prints `title`, followed by a human-readable
    /// representation of `exts` to `out`. It returns one on success and zero on
    /// error. The output is indented by `indent` spaces. `flag` is one of the
    /// `X509V3_EXT_*` constants and controls printing of unknown extensions and
    /// syntax errors.
    pub fn X509V3_extensions_print(
        out: *mut BIO,
        title: *const ::core::ffi::c_char,
        exts: *const stack_st_X509_EXTENSION,
        flag: ::core::ffi::c_ulong,
        indent: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// GENERAL_NAME_print prints a human-readable representation of `gen` to `out`.
    /// It returns one on success and zero on error.
    ///
    /// TODO(davidben): Actually, it just returns one and doesn't check for I/O or
    /// allocation errors. But it should return zero on error.
    pub fn GENERAL_NAME_print(out: *mut BIO, gen_: *const GENERAL_NAME) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_pubkey_digest hashes the contents of the BIT STRING in `x509`'s
    /// subjectPublicKeyInfo field with `md` and writes the result to `out`.
    /// `EVP_MD_CTX_size` bytes are written, which is at most `EVP_MAX_MD_SIZE`. If
    /// `out_len` is not NULL, `*out_len` is set to the number of bytes written. This
    /// function returns one on success and zero on error.
    ///
    /// This hash omits the BIT STRING tag, length, and number of unused bits. It
    /// also omits the AlgorithmIdentifier which describes the key type. It
    /// corresponds to the OCSP KeyHash definition and is not suitable for other
    /// purposes.
    pub fn X509_pubkey_digest(
        x509: *const X509,
        md: *const EVP_MD,
        out: *mut u8,
        out_len: *mut ::core::ffi::c_uint,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_digest hashes `x509`'s DER encoding with `md` and writes the result to
    /// `out`. `EVP_MD_CTX_size` bytes are written, which is at most
    /// `EVP_MAX_MD_SIZE`. If `out_len` is not NULL, `*out_len` is set to the number
    /// of bytes written. This function returns one on success and zero on error.
    /// Note this digest covers the entire certificate, not just the signed portion.
    pub fn X509_digest(
        x509: *const X509,
        md: *const EVP_MD,
        out: *mut u8,
        out_len: *mut ::core::ffi::c_uint,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_CRL_digest hashes `crl`'s DER encoding with `md` and writes the result
    /// to `out`. `EVP_MD_CTX_size` bytes are written, which is at most
    /// `EVP_MAX_MD_SIZE`. If `out_len` is not NULL, `*out_len` is set to the number
    /// of bytes written. This function returns one on success and zero on error.
    /// Note this digest covers the entire CRL, not just the signed portion.
    pub fn X509_CRL_digest(
        crl: *const X509_CRL,
        md: *const EVP_MD,
        out: *mut u8,
        out_len: *mut ::core::ffi::c_uint,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_REQ_digest hashes `req`'s DER encoding with `md` and writes the result
    /// to `out`. `EVP_MD_CTX_size` bytes are written, which is at most
    /// `EVP_MAX_MD_SIZE`. If `out_len` is not NULL, `*out_len` is set to the number
    /// of bytes written. This function returns one on success and zero on error.
    /// Note this digest covers the entire certificate request, not just the signed
    /// portion.
    pub fn X509_REQ_digest(
        req: *const X509_REQ,
        md: *const EVP_MD,
        out: *mut u8,
        out_len: *mut ::core::ffi::c_uint,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_NAME_digest hashes `name`'s DER encoding with `md` and writes the result
    /// to `out`. `EVP_MD_CTX_size` bytes are written, which is at most
    /// `EVP_MAX_MD_SIZE`. If `out_len` is not NULL, `*out_len` is set to the number
    /// of bytes written. This function returns one on success and zero on error.
    pub fn X509_NAME_digest(
        name: *const X509_NAME,
        md: *const EVP_MD,
        out: *mut u8,
        out_len: *mut ::core::ffi::c_uint,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// The following functions behave like the corresponding unsuffixed `d2i_*`
    /// functions, but read the result from `bp` instead. Callers using these
    /// functions with memory `BIO`s to parse structures already in memory should use
    /// `d2i_*` instead.
    pub fn d2i_X509_bio(bp: *mut BIO, x509: *mut *mut X509) -> *mut X509;
}
unsafe extern "C" {
    pub fn d2i_X509_CRL_bio(bp: *mut BIO, crl: *mut *mut X509_CRL) -> *mut X509_CRL;
}
unsafe extern "C" {
    pub fn d2i_X509_REQ_bio(bp: *mut BIO, req: *mut *mut X509_REQ) -> *mut X509_REQ;
}
unsafe extern "C" {
    pub fn d2i_RSAPrivateKey_bio(bp: *mut BIO, rsa: *mut *mut RSA) -> *mut RSA;
}
unsafe extern "C" {
    pub fn d2i_RSAPublicKey_bio(bp: *mut BIO, rsa: *mut *mut RSA) -> *mut RSA;
}
unsafe extern "C" {
    pub fn d2i_RSA_PUBKEY_bio(bp: *mut BIO, rsa: *mut *mut RSA) -> *mut RSA;
}
unsafe extern "C" {
    pub fn d2i_DSA_PUBKEY_bio(bp: *mut BIO, dsa: *mut *mut DSA) -> *mut DSA;
}
unsafe extern "C" {
    pub fn d2i_DSAPrivateKey_bio(bp: *mut BIO, dsa: *mut *mut DSA) -> *mut DSA;
}
unsafe extern "C" {
    pub fn d2i_EC_PUBKEY_bio(bp: *mut BIO, eckey: *mut *mut EC_KEY) -> *mut EC_KEY;
}
unsafe extern "C" {
    pub fn d2i_ECPrivateKey_bio(bp: *mut BIO, eckey: *mut *mut EC_KEY) -> *mut EC_KEY;
}
unsafe extern "C" {
    pub fn d2i_PKCS8_bio(bp: *mut BIO, p8: *mut *mut X509_SIG) -> *mut X509_SIG;
}
unsafe extern "C" {
    pub fn d2i_PKCS8_PRIV_KEY_INFO_bio(
        bp: *mut BIO,
        p8inf: *mut *mut PKCS8_PRIV_KEY_INFO,
    ) -> *mut PKCS8_PRIV_KEY_INFO;
}
unsafe extern "C" {
    pub fn d2i_PUBKEY_bio(bp: *mut BIO, a: *mut *mut EVP_PKEY) -> *mut EVP_PKEY;
}
unsafe extern "C" {
    pub fn d2i_DHparams_bio(bp: *mut BIO, dh: *mut *mut DH) -> *mut DH;
}
unsafe extern "C" {
    /// d2i_PrivateKey_bio behaves like `d2i_AutoPrivateKey`, but reads from `bp`
    /// instead.
    pub fn d2i_PrivateKey_bio(bp: *mut BIO, a: *mut *mut EVP_PKEY) -> *mut EVP_PKEY;
}
unsafe extern "C" {
    /// The following functions behave like the corresponding unsuffixed `i2d_*`
    /// functions, but write the result to `bp`. They return one on success and zero
    /// on error. Callers using them with memory `BIO`s to encode structures to
    /// memory should use `i2d_*` directly instead.
    pub fn i2d_X509_bio(bp: *mut BIO, x509: *const X509) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn i2d_X509_CRL_bio(bp: *mut BIO, crl: *const X509_CRL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn i2d_X509_REQ_bio(bp: *mut BIO, req: *const X509_REQ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn i2d_RSAPrivateKey_bio(bp: *mut BIO, rsa: *const RSA) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn i2d_RSAPublicKey_bio(bp: *mut BIO, rsa: *const RSA) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn i2d_RSA_PUBKEY_bio(bp: *mut BIO, rsa: *const RSA) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn i2d_DSA_PUBKEY_bio(bp: *mut BIO, dsa: *const DSA) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn i2d_DSAPrivateKey_bio(bp: *mut BIO, dsa: *const DSA) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn i2d_EC_PUBKEY_bio(bp: *mut BIO, eckey: *const EC_KEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn i2d_ECPrivateKey_bio(bp: *mut BIO, eckey: *const EC_KEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn i2d_PKCS8_bio(bp: *mut BIO, p8: *const X509_SIG) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn i2d_PKCS8_PRIV_KEY_INFO_bio(
        bp: *mut BIO,
        p8inf: *const PKCS8_PRIV_KEY_INFO,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn i2d_PrivateKey_bio(bp: *mut BIO, pkey: *const EVP_PKEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn i2d_PUBKEY_bio(bp: *mut BIO, pkey: *const EVP_PKEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn i2d_DHparams_bio(bp: *mut BIO, dh: *const DH) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// i2d_PKCS8PrivateKeyInfo_bio encodes `key` as a PKCS#8 PrivateKeyInfo
    /// structure (see `EVP_marshal_private_key`) and writes the result to `bp`. It
    /// returns one on success and zero on error.
    pub fn i2d_PKCS8PrivateKeyInfo_bio(bp: *mut BIO, key: *const EVP_PKEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// The following functions behave like the corresponding `d2i_*_bio` functions,
    /// but read from `fp` instead.
    pub fn d2i_X509_fp(fp: *mut FILE, x509: *mut *mut X509) -> *mut X509;
}
unsafe extern "C" {
    pub fn d2i_X509_CRL_fp(fp: *mut FILE, crl: *mut *mut X509_CRL) -> *mut X509_CRL;
}
unsafe extern "C" {
    pub fn d2i_X509_REQ_fp(fp: *mut FILE, req: *mut *mut X509_REQ) -> *mut X509_REQ;
}
unsafe extern "C" {
    pub fn d2i_RSAPrivateKey_fp(fp: *mut FILE, rsa: *mut *mut RSA) -> *mut RSA;
}
unsafe extern "C" {
    pub fn d2i_RSAPublicKey_fp(fp: *mut FILE, rsa: *mut *mut RSA) -> *mut RSA;
}
unsafe extern "C" {
    pub fn d2i_RSA_PUBKEY_fp(fp: *mut FILE, rsa: *mut *mut RSA) -> *mut RSA;
}
unsafe extern "C" {
    pub fn d2i_DSA_PUBKEY_fp(fp: *mut FILE, dsa: *mut *mut DSA) -> *mut DSA;
}
unsafe extern "C" {
    pub fn d2i_DSAPrivateKey_fp(fp: *mut FILE, dsa: *mut *mut DSA) -> *mut DSA;
}
unsafe extern "C" {
    pub fn d2i_EC_PUBKEY_fp(fp: *mut FILE, eckey: *mut *mut EC_KEY) -> *mut EC_KEY;
}
unsafe extern "C" {
    pub fn d2i_ECPrivateKey_fp(fp: *mut FILE, eckey: *mut *mut EC_KEY) -> *mut EC_KEY;
}
unsafe extern "C" {
    pub fn d2i_PKCS8_fp(fp: *mut FILE, p8: *mut *mut X509_SIG) -> *mut X509_SIG;
}
unsafe extern "C" {
    pub fn d2i_PKCS8_PRIV_KEY_INFO_fp(
        fp: *mut FILE,
        p8inf: *mut *mut PKCS8_PRIV_KEY_INFO,
    ) -> *mut PKCS8_PRIV_KEY_INFO;
}
unsafe extern "C" {
    pub fn d2i_PrivateKey_fp(fp: *mut FILE, a: *mut *mut EVP_PKEY) -> *mut EVP_PKEY;
}
unsafe extern "C" {
    pub fn d2i_PUBKEY_fp(fp: *mut FILE, a: *mut *mut EVP_PKEY) -> *mut EVP_PKEY;
}
unsafe extern "C" {
    /// The following functions behave like the corresponding `i2d_*_bio` functions,
    /// but write to `fp` instead.
    pub fn i2d_X509_fp(fp: *mut FILE, x509: *const X509) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn i2d_X509_CRL_fp(fp: *mut FILE, crl: *const X509_CRL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn i2d_X509_REQ_fp(fp: *mut FILE, req: *const X509_REQ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn i2d_RSAPrivateKey_fp(fp: *mut FILE, rsa: *const RSA) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn i2d_RSAPublicKey_fp(fp: *mut FILE, rsa: *const RSA) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn i2d_RSA_PUBKEY_fp(fp: *mut FILE, rsa: *const RSA) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn i2d_DSA_PUBKEY_fp(fp: *mut FILE, dsa: *const DSA) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn i2d_DSAPrivateKey_fp(fp: *mut FILE, dsa: *const DSA) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn i2d_EC_PUBKEY_fp(fp: *mut FILE, eckey: *const EC_KEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn i2d_ECPrivateKey_fp(fp: *mut FILE, eckey: *const EC_KEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn i2d_PKCS8_fp(fp: *mut FILE, p8: *const X509_SIG) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn i2d_PKCS8_PRIV_KEY_INFO_fp(
        fp: *mut FILE,
        p8inf: *const PKCS8_PRIV_KEY_INFO,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn i2d_PKCS8PrivateKeyInfo_fp(fp: *mut FILE, key: *const EVP_PKEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn i2d_PrivateKey_fp(fp: *mut FILE, pkey: *const EVP_PKEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn i2d_PUBKEY_fp(fp: *mut FILE, pkey: *const EVP_PKEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_find_by_issuer_and_serial returns the first `X509` in `sk` whose issuer
    /// and serial are `name` and `serial`, respectively. If no match is found, it
    /// returns NULL.
    pub fn X509_find_by_issuer_and_serial(
        sk: *const stack_st_X509,
        name: *const X509_NAME,
        serial: *const ASN1_INTEGER,
    ) -> *mut X509;
}
unsafe extern "C" {
    /// X509_find_by_subject returns the first `X509` in `sk` whose subject is
    /// `name`. If no match is found, it returns NULL.
    pub fn X509_find_by_subject(sk: *const stack_st_X509, name: *const X509_NAME) -> *mut X509;
}
unsafe extern "C" {
    /// X509_cmp_time compares `s` against `*t`. On success, it returns a negative
    /// number if `s` <= `*t` and a positive number if `s` > `*t`. On error, it
    /// returns zero. If `t` is NULL, it uses the current time instead of `*t`.
    ///
    /// WARNING: Unlike most comparison functions, this function returns zero on
    /// error, not equality.
    pub fn X509_cmp_time(s: *const ASN1_TIME, t: *const time_t) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_cmp_time_posix compares `s` against `t`. On success, it returns a
    /// negative number if `s` <= `t` and a positive number if `s` > `t`. On error,
    /// it returns zero.
    ///
    /// WARNING: Unlike most comparison functions, this function returns zero on
    /// error, not equality.
    pub fn X509_cmp_time_posix(s: *const ASN1_TIME, t: i64) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_cmp_current_time behaves like `X509_cmp_time` but compares `s` against
    /// the current time.
    pub fn X509_cmp_current_time(s: *const ASN1_TIME) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_time_adj calls `X509_time_adj_ex` with `offset_day` equal to zero.
    pub fn X509_time_adj(
        s: *mut ASN1_TIME,
        offset_sec: ::core::ffi::c_long,
        t: *const time_t,
    ) -> *mut ASN1_TIME;
}
unsafe extern "C" {
    /// X509_time_adj_ex behaves like `ASN1_TIME_adj`, but adds an offset to `*t`. If
    /// `t` is NULL, it uses the current time instead of `*t`.
    pub fn X509_time_adj_ex(
        s: *mut ASN1_TIME,
        offset_day: ::core::ffi::c_int,
        offset_sec: ::core::ffi::c_long,
        t: *const time_t,
    ) -> *mut ASN1_TIME;
}
unsafe extern "C" {
    /// X509_gmtime_adj behaves like `X509_time_adj_ex` but adds `offset_sec` to the
    /// current time.
    pub fn X509_gmtime_adj(s: *mut ASN1_TIME, offset_sec: ::core::ffi::c_long) -> *mut ASN1_TIME;
}
unsafe extern "C" {
    /// X509_issuer_name_cmp behaves like `X509_NAME_cmp`, but compares `a` and `b`'s
    /// issuer names.
    pub fn X509_issuer_name_cmp(a: *const X509, b: *const X509) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_subject_name_cmp behaves like `X509_NAME_cmp`, but compares `a` and
    /// `b`'s subject names.
    pub fn X509_subject_name_cmp(a: *const X509, b: *const X509) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_CRL_cmp behaves like `X509_NAME_cmp`, but compares `a` and `b`'s
    /// issuer names.
    ///
    /// WARNING: This function is misnamed. It does not compare other parts of the
    /// CRL, only the issuer fields using `X509_NAME_cmp`.
    pub fn X509_CRL_cmp(a: *const X509_CRL, b: *const X509_CRL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_issuer_name_hash returns the hash of `x509`'s issuer name with
    /// `X509_NAME_hash`.
    ///
    /// This hash is specific to the `X509_LOOKUP_add_dir` filesystem format and is
    /// not suitable for general-purpose X.509 name processing. It is very short, so
    /// there will be hash collisions. It also depends on an OpenSSL-specific
    /// canonicalization process.
    pub fn X509_issuer_name_hash(x509: *const X509) -> u32;
}
unsafe extern "C" {
    /// X509_subject_name_hash returns the hash of `x509`'s subject name with
    /// `X509_NAME_hash`.
    ///
    /// This hash is specific to the `X509_LOOKUP_add_dir` filesystem format and is
    /// not suitable for general-purpose X.509 name processing. It is very short, so
    /// there will be hash collisions. It also depends on an OpenSSL-specific
    /// canonicalization process.
    pub fn X509_subject_name_hash(x509: *const X509) -> u32;
}
unsafe extern "C" {
    /// X509_issuer_name_hash_old returns the hash of `x509`'s issuer name with
    /// `X509_NAME_hash_old`.
    ///
    /// This hash is specific to the `X509_LOOKUP_add_dir` filesystem format and is
    /// not suitable for general-purpose X.509 name processing. It is very short, so
    /// there will be hash collisions.
    pub fn X509_issuer_name_hash_old(x509: *const X509) -> u32;
}
unsafe extern "C" {
    /// X509_subject_name_hash_old returns the hash of `x509`'s usjbect name with
    /// `X509_NAME_hash_old`.
    ///
    /// This hash is specific to the `X509_LOOKUP_add_dir` filesystem format and is
    /// not suitable for general-purpose X.509 name processing. It is very short, so
    /// there will be hash collisions.
    pub fn X509_subject_name_hash_old(x509: *const X509) -> u32;
}
unsafe extern "C" {
    /// ex_data functions.
    ///
    /// See `ex_data.h` for details.
    pub fn X509_get_ex_new_index(
        argl: ::core::ffi::c_long,
        argp: *mut ::core::ffi::c_void,
        unused: *mut CRYPTO_EX_unused,
        dup_unused: CRYPTO_EX_dup,
        free_func: CRYPTO_EX_free,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn X509_set_ex_data(
        r: *mut X509,
        idx: ::core::ffi::c_int,
        arg: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn X509_get_ex_data(r: *mut X509, idx: ::core::ffi::c_int) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    pub fn X509_STORE_CTX_get_ex_new_index(
        argl: ::core::ffi::c_long,
        argp: *mut ::core::ffi::c_void,
        unused: *mut CRYPTO_EX_unused,
        dup_unused: CRYPTO_EX_dup,
        free_func: CRYPTO_EX_free,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn X509_STORE_CTX_set_ex_data(
        ctx: *mut X509_STORE_CTX,
        idx: ::core::ffi::c_int,
        data: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn X509_STORE_CTX_get_ex_data(
        ctx: *mut X509_STORE_CTX,
        idx: ::core::ffi::c_int,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    /// ASN1_digest serializes `data` with `i2d` and then hashes the result with
    /// `type`. On success, it returns one, writes the digest to `md`, and sets
    /// `*len` to the digest length if non-NULL. On error, it returns zero.
    ///
    /// `EVP_MD_CTX_size` bytes are written, which is at most `EVP_MAX_MD_SIZE`. The
    /// buffer must have sufficient space for this output.
    pub fn ASN1_digest(
        i2d: i2d_of_void,
        type_: *const EVP_MD,
        data: *mut ::core::ffi::c_char,
        md: *mut ::core::ffi::c_uchar,
        len: *mut ::core::ffi::c_uint,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_item_digest serializes `data` with `it` and then hashes the result with
    /// `type`. On success, it returns one, writes the digest to `md`, and sets
    /// `*len` to the digest length if non-NULL. On error, it returns zero.
    ///
    /// `EVP_MD_CTX_size` bytes are written, which is at most `EVP_MAX_MD_SIZE`. The
    /// buffer must have sufficient space for this output.
    ///
    /// WARNING: `data` must be a pointer with the same type as `it`'s corresponding
    /// C type. Using the wrong type is a potentially exploitable memory error.
    pub fn ASN1_item_digest(
        it: *const ASN1_ITEM,
        type_: *const EVP_MD,
        data: *mut ::core::ffi::c_void,
        md: *mut ::core::ffi::c_uchar,
        len: *mut ::core::ffi::c_uint,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_item_verify serializes `data` with `it` and then verifies `signature` is
    /// a valid signature for the result with `algor1` and `pkey`. It returns one on
    /// success and zero on error. The signature and algorithm are interpreted as in
    /// X.509.
    ///
    /// WARNING: `data` must be a pointer with the same type as `it`'s corresponding
    /// C type. Using the wrong type is a potentially exploitable memory error.
    pub fn ASN1_item_verify(
        it: *const ASN1_ITEM,
        algor1: *const X509_ALGOR,
        signature: *const ASN1_BIT_STRING,
        data: *mut ::core::ffi::c_void,
        pkey: *mut EVP_PKEY,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_item_sign serializes `data` with `it` and then signs the result with
    /// the private key `pkey`. It returns the length of the signature on success and
    /// zero on error. On success, it writes the signature to `signature` and the
    /// signature algorithm to each of `algor1` and `algor2`. Either of `algor1` or
    /// `algor2` may be NULL to ignore them. This function uses digest algorithm
    /// `md`, or `pkey`'s default if NULL. Other signing parameters use `pkey`'s
    /// defaults. To customize them, use `ASN1_item_sign_ctx`.
    ///
    /// `algor1` and `algor2` may point into part of `asn` and will be updated before
    /// `asn` is serialized.
    ///
    /// WARNING: `data` must be a pointer with the same type as `it`'s corresponding
    /// C type. Using the wrong type is a potentially exploitable memory error.
    pub fn ASN1_item_sign(
        it: *const ASN1_ITEM,
        algor1: *mut X509_ALGOR,
        algor2: *mut X509_ALGOR,
        signature: *mut ASN1_BIT_STRING,
        data: *mut ::core::ffi::c_void,
        pkey: *mut EVP_PKEY,
        type_: *const EVP_MD,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ASN1_item_sign_ctx behaves like `ASN1_item_sign` except the signature is
    /// signed with `ctx`, `ctx`, which must have been initialized with
    /// `EVP_DigestSignInit`. The caller should configure the corresponding
    /// `EVP_PKEY_CTX` with any additional parameters before calling this function.
    ///
    /// On success or failure, this function mutates `ctx` and resets it to the empty
    /// state. Caller should not rely on its contents after the function returns.
    ///
    /// `algor1` and `algor2` may point into part of `asn` and will be updated before
    /// `asn` is serialized.
    ///
    /// WARNING: `data` must be a pointer with the same type as `it`'s corresponding
    /// C type. Using the wrong type is a potentially exploitable memory error.
    pub fn ASN1_item_sign_ctx(
        it: *const ASN1_ITEM,
        algor1: *mut X509_ALGOR,
        algor2: *mut X509_ALGOR,
        signature: *mut ASN1_BIT_STRING,
        asn: *mut ::core::ffi::c_void,
        ctx: *mut EVP_MD_CTX,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_supported_extension returns one if `ex` is a critical X.509 certificate
    /// extension, supported by `X509_verify_cert`, and zero otherwise.
    ///
    /// Note this function only reports certificate extensions (as opposed to CRL or
    /// CRL extensions), and only extensions that are expected to be marked critical.
    /// Additionally, `X509_verify_cert` checks for unsupported critical extensions
    /// internally, so most callers will not need to call this function separately.
    pub fn X509_supported_extension(ex: *const X509_EXTENSION) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_check_ca returns one if `x509` may be considered a CA certificate,
    /// according to basic constraints and key usage extensions. Otherwise, it
    /// returns zero. If `x509` is an X509v1 certificate, and thus has no extensions,
    /// it is considered eligible.
    ///
    /// This function returning one does not indicate that `x509` is trusted, only
    /// that it is eligible to be a CA.
    pub fn X509_check_ca(x509: *const X509) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_check_issued checks if `issuer` and `subject`'s name, authority key
    /// identifier, and key usage fields allow `issuer` to have issued `subject`. It
    /// returns `X509_V_OK` on success and an `X509_V_ERR_*` value otherwise.
    ///
    /// This function does not check the signature on `subject`. Rather, it is
    /// intended to prune the set of possible issuer certificates during
    /// path-building.
    pub fn X509_check_issued(issuer: *const X509, subject: *const X509) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// NAME_CONSTRAINTS_check checks if `x509` satisfies name constraints in `nc`.
    /// It returns `X509_V_OK` on success and some `X509_V_ERR_*` constant on error.
    pub fn NAME_CONSTRAINTS_check(
        x509: *const X509,
        nc: *const NAME_CONSTRAINTS,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_check_host checks if `x509` matches the DNS name `chk`. It returns one
    /// on match, zero on mismatch, or a negative number on error. `flags` should be
    /// some combination of `X509_CHECK_FLAG_*` and modifies the behavior. On match,
    /// if `out_peername` is non-NULL, it additionally sets `*out_peername` to a
    /// newly-allocated, NUL-terminated string containing the DNS name or wildcard in
    /// the certificate which matched. The caller must then free `*out_peername` with
    /// `OPENSSL_free` when done.
    ///
    /// By default, both subject alternative names and the subject's common name
    /// attribute are checked. The latter has long been deprecated, so callers should
    /// include `X509_CHECK_FLAG_NEVER_CHECK_SUBJECT` in `flags` to use the standard
    /// behavior. https://crbug.com/boringssl/464 tracks fixing the default.
    ///
    /// This function does not check if `x509` is a trusted certificate, only if,
    /// were it trusted, it would match `chk`.
    ///
    /// WARNING: This function differs from the usual calling convention and may
    /// return either 0 or a negative number on error.
    ///
    /// TODO(davidben): Make the error case also return zero.
    pub fn X509_check_host(
        x509: *const X509,
        chk: *const ::core::ffi::c_char,
        chklen: usize,
        flags: ::core::ffi::c_uint,
        out_peername: *mut *mut ::core::ffi::c_char,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_check_email checks if `x509` matches the email address `chk`. It returns
    /// one on match, zero on mismatch, or a negative number on error. `flags` should
    /// be some combination of `X509_CHECK_FLAG_*` and modifies the behavior.
    ///
    /// By default, both subject alternative names and the subject's email address
    /// attribute are checked. The `X509_CHECK_FLAG_NEVER_CHECK_SUBJECT` flag may be
    /// used to change this behavior.
    ///
    /// This function does not check if `x509` is a trusted certificate, only if,
    /// were it trusted, it would match `chk`.
    ///
    /// WARNING: This function differs from the usual calling convention and may
    /// return either 0 or a negative number on error.
    ///
    /// TODO(davidben): Make the error case also return zero.
    pub fn X509_check_email(
        x509: *const X509,
        chk: *const ::core::ffi::c_char,
        chklen: usize,
        flags: ::core::ffi::c_uint,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_check_ip checks if `x509` matches the IP address `chk`. The IP address
    /// is represented in byte form and should be 4 bytes for an IPv4 address and 16
    /// bytes for an IPv6 address. It returns one on match, zero on mismatch, or a
    /// negative number on error. `flags` should be some combination of
    /// `X509_CHECK_FLAG_*` and modifies the behavior.
    ///
    /// This function does not check if `x509` is a trusted certificate, only if,
    /// were it trusted, it would match `chk`.
    ///
    /// WARNING: This function differs from the usual calling convention and may
    /// return either 0 or a negative number on error.
    ///
    /// TODO(davidben): Make the error case also return zero.
    pub fn X509_check_ip(
        x509: *const X509,
        chk: *const u8,
        chklen: usize,
        flags: ::core::ffi::c_uint,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_check_ip_asc behaves like `X509_check_ip` except the IP address is
    /// specified in textual form in `ipasc`.
    ///
    /// WARNING: This function differs from the usual calling convention and may
    /// return either 0 or a negative number on error.
    ///
    /// TODO(davidben): Make the error case also return zero.
    pub fn X509_check_ip_asc(
        x509: *const X509,
        ipasc: *const ::core::ffi::c_char,
        flags: ::core::ffi::c_uint,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_STORE_CTX_get1_issuer looks up a candidate trusted issuer for `x509` out
    /// of `ctx`'s `X509_STORE`, based on the criteria in `X509_check_issued`. If one
    /// was found, it returns one and sets `*out_issuer` to the issuer. The caller
    /// must release `*out_issuer` with `X509_free` when done. If none was found, it
    /// returns zero and leaves `*out_issuer` unchanged.
    ///
    /// This function only searches for trusted issuers. It does not consider
    /// untrusted intermediates passed in to `X509_STORE_CTX_init`.
    pub fn X509_STORE_CTX_get1_issuer(
        out_issuer: *mut *mut X509,
        ctx: *mut X509_STORE_CTX,
        x509: *const X509,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_check_purpose performs checks if `x509`'s basic constraints, key usage,
    /// and extended key usage extensions for the specified purpose. `purpose` should
    /// be one of `X509_PURPOSE_*` constants. See `X509_VERIFY_PARAM_set_purpose` for
    /// details. It returns one if `x509`'s extensions are consistent with `purpose`
    /// and zero otherwise. If `ca` is non-zero, `x509` is checked as a CA
    /// certificate. Otherwise, it is checked as an end-entity certificate.
    ///
    /// If `purpose` is -1, this function performs no purpose checks, but it parses
    /// some extensions in `x509` and may return zero on syntax error. Historically,
    /// callers primarily used this function to trigger this parsing, but this is no
    /// longer necessary. Functions acting on `X509` will internally parse as needed.
    pub fn X509_check_purpose(
        x509: *mut X509,
        purpose: ::core::ffi::c_int,
        ca: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_check_trust checks if `x509` is a valid trust anchor for trust type
    /// `id`. See `X509_VERIFY_PARAM_set_trust` for details. It returns
    /// `X509_TRUST_TRUSTED` if `x509` is a trust anchor, `X509_TRUST_REJECTED` if it
    /// was distrusted, and `X509_TRUST_UNTRUSTED` otherwise. `id` should be one of
    /// the `X509_TRUST_*` constants, or zero to indicate the default behavior.
    /// `flags` should be zero and is ignored.
    pub fn X509_check_trust(
        x509: *mut X509,
        id: ::core::ffi::c_int,
        flags: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_STORE_CTX_get1_certs returns a newly-allocated stack containing all
    /// trusted certificates in `ctx`'s `X509_STORE` whose subject matches `name`, or
    /// NULL on error. The caller must release the result with `sk_X509_pop_free` and
    /// `X509_free` when done.
    pub fn X509_STORE_CTX_get1_certs(
        ctx: *mut X509_STORE_CTX,
        name: *const X509_NAME,
    ) -> *mut stack_st_X509;
}
unsafe extern "C" {
    /// X509_STORE_CTX_get1_crls returns a newly-allocated stack containing all
    /// CRLs in `ctx`'s `X509_STORE` whose subject matches `name`, or NULL on error.
    /// The caller must release the result with `sk_X509_CRL_pop_free` and
    /// `X509_CRL_free` when done.
    pub fn X509_STORE_CTX_get1_crls(
        ctx: *mut X509_STORE_CTX,
        name: *const X509_NAME,
    ) -> *mut stack_st_X509_CRL;
}
unsafe extern "C" {
    /// X509_STORE_CTX_get_by_subject looks up an object of type `type` in `ctx`'s
    /// `X509_STORE` that matches `name`. `type` should be one of the `X509_LU_*`
    /// constants to indicate the type of object. If a match was found, it stores the
    /// result in `ret` and returns one. Otherwise, it returns zero. If multiple
    /// objects match, this function outputs an arbitrary one.
    ///
    /// WARNING: `ret` must be in the empty state, as returned by `X509_OBJECT_new`.
    /// Otherwise, the object currently in `ret` will be leaked when overwritten.
    /// https://crbug.com/boringssl/685 tracks fixing this.
    ///
    /// WARNING: Multiple trusted certificates or CRLs may share a name. In this
    /// case, this function returns an arbitrary match. Use
    /// `X509_STORE_CTX_get1_certs` or `X509_STORE_CTX_get1_crls` instead.
    pub fn X509_STORE_CTX_get_by_subject(
        ctx: *mut X509_STORE_CTX,
        type_: ::core::ffi::c_int,
        name: *const X509_NAME,
        ret: *mut X509_OBJECT,
    ) -> ::core::ffi::c_int;
}
/// X.509 information.
///
/// `X509_INFO` is the return type for `PEM_X509_INFO_read_bio`, defined in
/// <openssl/pem.h>. It is used to store a certificate, CRL, or private key. This
/// type is defined in this header for OpenSSL compatibility.
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct private_key_st {
    pub dec_pkey: *mut EVP_PKEY,
}
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct X509_info_st {
    pub x509: *mut X509,
    pub crl: *mut X509_CRL,
    pub x_pkey: *mut X509_PKEY,
    pub enc_cipher: EVP_CIPHER_INFO,
    pub enc_len: ::core::ffi::c_int,
    pub enc_data: *mut ::core::ffi::c_char,
}
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct stack_st_X509_INFO {
    _unused: [u8; 0],
}
/// We also disable -Wcast-qual. As part of this C-based type erasure setup,  \
/// the wrapper macros need to cast away const in places. In C++, const_cast  \
/// suppresses the warning, but it seemingly cannot be suppressed in C.
pub type sk_X509_INFO_free_func =
    ::core::option::Option<unsafe extern "C" fn(arg1: *mut X509_INFO)>;
pub type sk_X509_INFO_copy_func =
    ::core::option::Option<unsafe extern "C" fn(arg1: *const X509_INFO) -> *mut X509_INFO>;
pub type sk_X509_INFO_cmp_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *const *const X509_INFO,
        arg2: *const *const X509_INFO,
    ) -> ::core::ffi::c_int,
>;
pub type sk_X509_INFO_delete_if_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *mut X509_INFO,
        arg2: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int,
>;
unsafe extern "C" {
    #[link_name = "sk_X509_INFO_call_free_func__extern"]
    pub fn sk_X509_INFO_call_free_func(
        free_func: OPENSSL_sk_free_func,
        ptr: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    #[link_name = "sk_X509_INFO_call_copy_func__extern"]
    pub fn sk_X509_INFO_call_copy_func(
        copy_func: OPENSSL_sk_copy_func,
        ptr: *const ::core::ffi::c_void,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    #[link_name = "sk_X509_INFO_call_cmp_func__extern"]
    pub fn sk_X509_INFO_call_cmp_func(
        cmp_func: OPENSSL_sk_cmp_func,
        a: *const ::core::ffi::c_void,
        b: *const ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_X509_INFO_call_delete_if_func__extern"]
    pub fn sk_X509_INFO_call_delete_if_func(
        func: OPENSSL_sk_delete_if_func,
        obj: *mut ::core::ffi::c_void,
        data: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_X509_INFO_new__extern"]
    pub fn sk_X509_INFO_new(comp: sk_X509_INFO_cmp_func) -> *mut stack_st_X509_INFO;
}
unsafe extern "C" {
    #[link_name = "sk_X509_INFO_new_null__extern"]
    pub fn sk_X509_INFO_new_null() -> *mut stack_st_X509_INFO;
}
unsafe extern "C" {
    #[link_name = "sk_X509_INFO_num__extern"]
    pub fn sk_X509_INFO_num(sk: *const stack_st_X509_INFO) -> usize;
}
unsafe extern "C" {
    #[link_name = "sk_X509_INFO_zero__extern"]
    pub fn sk_X509_INFO_zero(sk: *mut stack_st_X509_INFO);
}
unsafe extern "C" {
    #[link_name = "sk_X509_INFO_value__extern"]
    pub fn sk_X509_INFO_value(sk: *const stack_st_X509_INFO, i: usize) -> *mut X509_INFO;
}
unsafe extern "C" {
    #[link_name = "sk_X509_INFO_set__extern"]
    pub fn sk_X509_INFO_set(
        sk: *mut stack_st_X509_INFO,
        i: usize,
        p: *mut X509_INFO,
    ) -> *mut X509_INFO;
}
unsafe extern "C" {
    #[link_name = "sk_X509_INFO_free__extern"]
    pub fn sk_X509_INFO_free(sk: *mut stack_st_X509_INFO);
}
unsafe extern "C" {
    #[link_name = "sk_X509_INFO_pop_free__extern"]
    pub fn sk_X509_INFO_pop_free(sk: *mut stack_st_X509_INFO, free_func: sk_X509_INFO_free_func);
}
unsafe extern "C" {
    #[link_name = "sk_X509_INFO_insert__extern"]
    pub fn sk_X509_INFO_insert(
        sk: *mut stack_st_X509_INFO,
        p: *mut X509_INFO,
        where_: usize,
    ) -> usize;
}
unsafe extern "C" {
    #[link_name = "sk_X509_INFO_delete__extern"]
    pub fn sk_X509_INFO_delete(sk: *mut stack_st_X509_INFO, where_: usize) -> *mut X509_INFO;
}
unsafe extern "C" {
    #[link_name = "sk_X509_INFO_delete_ptr__extern"]
    pub fn sk_X509_INFO_delete_ptr(
        sk: *mut stack_st_X509_INFO,
        p: *const X509_INFO,
    ) -> *mut X509_INFO;
}
unsafe extern "C" {
    #[link_name = "sk_X509_INFO_delete_if__extern"]
    pub fn sk_X509_INFO_delete_if(
        sk: *mut stack_st_X509_INFO,
        func: sk_X509_INFO_delete_if_func,
        data: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    #[link_name = "sk_X509_INFO_find__extern"]
    pub fn sk_X509_INFO_find(
        sk: *const stack_st_X509_INFO,
        out_index: *mut usize,
        p: *const X509_INFO,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_X509_INFO_shift__extern"]
    pub fn sk_X509_INFO_shift(sk: *mut stack_st_X509_INFO) -> *mut X509_INFO;
}
unsafe extern "C" {
    #[link_name = "sk_X509_INFO_push__extern"]
    pub fn sk_X509_INFO_push(sk: *mut stack_st_X509_INFO, p: *mut X509_INFO) -> usize;
}
unsafe extern "C" {
    #[link_name = "sk_X509_INFO_pop__extern"]
    pub fn sk_X509_INFO_pop(sk: *mut stack_st_X509_INFO) -> *mut X509_INFO;
}
unsafe extern "C" {
    #[link_name = "sk_X509_INFO_dup__extern"]
    pub fn sk_X509_INFO_dup(sk: *const stack_st_X509_INFO) -> *mut stack_st_X509_INFO;
}
unsafe extern "C" {
    #[link_name = "sk_X509_INFO_sort__extern"]
    pub fn sk_X509_INFO_sort(sk: *mut stack_st_X509_INFO);
}
unsafe extern "C" {
    #[link_name = "sk_X509_INFO_sort_and_dedup__extern"]
    pub fn sk_X509_INFO_sort_and_dedup(
        sk: *mut stack_st_X509_INFO,
        free_func: sk_X509_INFO_free_func,
    );
}
unsafe extern "C" {
    #[link_name = "sk_X509_INFO_is_sorted__extern"]
    pub fn sk_X509_INFO_is_sorted(sk: *const stack_st_X509_INFO) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_X509_INFO_set_cmp_func__extern"]
    pub fn sk_X509_INFO_set_cmp_func(
        sk: *mut stack_st_X509_INFO,
        comp: sk_X509_INFO_cmp_func,
    ) -> sk_X509_INFO_cmp_func;
}
unsafe extern "C" {
    #[link_name = "sk_X509_INFO_deep_copy__extern"]
    pub fn sk_X509_INFO_deep_copy(
        sk: *const stack_st_X509_INFO,
        copy_func: sk_X509_INFO_copy_func,
        free_func: sk_X509_INFO_free_func,
    ) -> *mut stack_st_X509_INFO;
}
unsafe extern "C" {
    /// X509_INFO_free releases memory associated with `info`.
    pub fn X509_INFO_free(info: *mut X509_INFO);
}
/// The following function pointer types are used in `X509V3_EXT_METHOD`.
pub type X509V3_EXT_NEW =
    ::core::option::Option<unsafe extern "C" fn() -> *mut ::core::ffi::c_void>;
pub type X509V3_EXT_FREE =
    ::core::option::Option<unsafe extern "C" fn(ext: *mut ::core::ffi::c_void)>;
pub type X509V3_EXT_D2I = ::core::option::Option<
    unsafe extern "C" fn(
        ext: *mut ::core::ffi::c_void,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut ::core::ffi::c_void,
>;
pub type X509V3_EXT_I2D = ::core::option::Option<
    unsafe extern "C" fn(ext: *mut ::core::ffi::c_void, outp: *mut *mut u8) -> ::core::ffi::c_int,
>;
pub type X509V3_EXT_I2V = ::core::option::Option<
    unsafe extern "C" fn(
        method: *const X509V3_EXT_METHOD,
        ext: *mut ::core::ffi::c_void,
        extlist: *mut stack_st_CONF_VALUE,
    ) -> *mut stack_st_CONF_VALUE,
>;
pub type X509V3_EXT_V2I = ::core::option::Option<
    unsafe extern "C" fn(
        method: *const X509V3_EXT_METHOD,
        ctx: *const X509V3_CTX,
        values: *const stack_st_CONF_VALUE,
    ) -> *mut ::core::ffi::c_void,
>;
pub type X509V3_EXT_I2S = ::core::option::Option<
    unsafe extern "C" fn(
        method: *const X509V3_EXT_METHOD,
        ext: *mut ::core::ffi::c_void,
    ) -> *mut ::core::ffi::c_char,
>;
pub type X509V3_EXT_S2I = ::core::option::Option<
    unsafe extern "C" fn(
        method: *const X509V3_EXT_METHOD,
        ctx: *const X509V3_CTX,
        str_: *const ::core::ffi::c_char,
    ) -> *mut ::core::ffi::c_void,
>;
pub type X509V3_EXT_I2R = ::core::option::Option<
    unsafe extern "C" fn(
        method: *const X509V3_EXT_METHOD,
        ext: *mut ::core::ffi::c_void,
        out: *mut BIO,
        indent: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int,
>;
pub type X509V3_EXT_R2I = ::core::option::Option<
    unsafe extern "C" fn(
        method: *const X509V3_EXT_METHOD,
        ctx: *const X509V3_CTX,
        str_: *const ::core::ffi::c_char,
    ) -> *mut ::core::ffi::c_void,
>;
/// A v3_ext_method, aka `X509V3_EXT_METHOD`, is a deprecated type which defines
/// a custom extension.
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct v3_ext_method {
    /// ext_nid is the NID of the extension.
    pub ext_nid: ::core::ffi::c_int,
    /// ext_flags is a combination of `X509V3_EXT_*` constants.
    pub ext_flags: ::core::ffi::c_int,
    /// it determines how values of this extension are allocated, released, parsed,
    /// and marshalled. This must be non-NULL.
    pub it: *const ASN1_ITEM_st,
    /// The following functions are ignored in favor of `it`. They are retained in
    /// the struct only for source compatibility with existing struct definitions.
    pub ext_new: X509V3_EXT_NEW,
    pub ext_free: X509V3_EXT_FREE,
    pub d2i: X509V3_EXT_D2I,
    pub i2d: X509V3_EXT_I2D,
    /// The following functions are used for string extensions.
    pub i2s: X509V3_EXT_I2S,
    pub s2i: X509V3_EXT_S2I,
    /// The following functions are used for multi-valued extensions.
    pub i2v: X509V3_EXT_I2V,
    pub v2i: X509V3_EXT_V2I,
    /// The following functions are used for "raw" extensions, which implement
    /// custom printing behavior.
    pub i2r: X509V3_EXT_I2R,
    pub r2i: X509V3_EXT_R2I,
    /// Any extension specific data
    pub usr_data: *mut ::core::ffi::c_void,
}
unsafe extern "C" {
    /// X509V3_EXT_get returns the `X509V3_EXT_METHOD` corresponding to `ext`'s
    /// extension type, or NULL if none was registered.
    pub fn X509V3_EXT_get(ext: *const X509_EXTENSION) -> *const X509V3_EXT_METHOD;
}
unsafe extern "C" {
    /// X509V3_EXT_get_nid returns the `X509V3_EXT_METHOD` corresponding to `nid`, or
    /// NULL if none was registered.
    pub fn X509V3_EXT_get_nid(nid: ::core::ffi::c_int) -> *const X509V3_EXT_METHOD;
}
unsafe extern "C" {
    /// X509V3_EXT_add registers `ext` as a custom extension for the extension type
    /// `ext->ext_nid`. `ext` must be valid for the remainder of the address space's
    /// lifetime. It returns one on success and zero on error.
    ///
    /// WARNING: This function modifies global state. If other code in the same
    /// address space also registers an extension with type `ext->ext_nid`, the two
    /// registrations will conflict. Which registration takes effect is undefined. If
    /// the two registrations use incompatible in-memory representations, code
    /// expecting the other registration will then cast a type to the wrong type,
    /// resulting in a potentially exploitable memory error. This conflict can also
    /// occur if BoringSSL later adds support for `ext->ext_nid`, with a different
    /// in-memory representation than the one expected by `ext`.
    ///
    /// This function, additionally, is not thread-safe and cannot be called
    /// concurrently with any other BoringSSL function.
    ///
    /// As a result, it is impossible to safely use this function. Registering a
    /// custom extension has no impact on certificate verification so, instead,
    /// callers should simply handle the custom extension with the byte-based
    /// `X509_EXTENSION` APIs directly. Registering `ext` with the library has little
    /// practical value.
    pub fn X509V3_EXT_add(ext: *mut X509V3_EXT_METHOD) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509V3_EXT_add_alias registers a custom extension with NID `nid_to`. The
    /// corresponding ASN.1 type is copied from `nid_from`. It returns one on success
    /// and zero on error.
    ///
    /// WARNING: Do not use this function. See `X509V3_EXT_add`.
    pub fn X509V3_EXT_add_alias(
        nid_to: ::core::ffi::c_int,
        nid_from: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
/// v3_ext_ctx, aka `X509V3_CTX`, contains additional context information for
/// constructing extensions. Some string formats reference additional values in
/// these objects. It must be initialized with `X509V3_set_ctx` or
/// `X509V3_set_ctx_test` before use.
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct v3_ext_ctx {
    pub flags: ::core::ffi::c_int,
    pub issuer_cert: *const X509,
    pub subject_cert: *const X509,
    pub subject_req: *const X509_REQ,
    pub crl: *const X509_CRL,
    pub db: *const CONF,
}
unsafe extern "C" {
    /// X509V3_set_ctx initializes `ctx` with the specified objects. Some string
    /// formats will reference fields in these objects. Each object may be NULL to
    /// omit it, in which case those formats cannot be used. `flags` should be zero,
    /// unless called via `X509V3_set_ctx_test`.
    ///
    /// `issuer`, `subject`, `req`, and `crl`, if non-NULL, must outlive `ctx`.
    pub fn X509V3_set_ctx(
        ctx: *mut X509V3_CTX,
        issuer: *const X509,
        subject: *const X509,
        req: *const X509_REQ,
        crl: *const X509_CRL,
        flags: ::core::ffi::c_int,
    );
}
unsafe extern "C" {
    /// X509V3_set_nconf sets `ctx` to use `conf` as the config database. `ctx` must
    /// have previously been initialized by `X509V3_set_ctx` or
    /// `X509V3_set_ctx_test`. Some string formats will reference sections in `conf`.
    /// `conf` may be NULL, in which case these formats cannot be used. If non-NULL,
    /// `conf` must outlive `ctx`.
    pub fn X509V3_set_nconf(ctx: *mut X509V3_CTX, conf: *const CONF);
}
unsafe extern "C" {
    /// X509V3_EXT_nconf constructs an extension of type specified by `name`, and
    /// value specified by `value`. It returns a newly-allocated `X509_EXTENSION`
    /// object on success, or NULL on error. `conf` and `ctx` specify additional
    /// information referenced by some formats. Either `conf` or `ctx` may be NULL,
    /// in which case features which use it will be disabled.
    ///
    /// If non-NULL, `ctx` must be initialized with `X509V3_set_ctx` or
    /// `X509V3_set_ctx_test`.
    ///
    /// Both `conf` and `ctx` provide a `CONF` object. When `ctx` is non-NULL, most
    /// features use the `ctx` copy, configured with `X509V3_set_ctx`, but some use
    /// `conf`. Callers should ensure the two match to avoid surprisingly behavior.
    pub fn X509V3_EXT_nconf(
        conf: *const CONF,
        ctx: *const X509V3_CTX,
        name: *const ::core::ffi::c_char,
        value: *const ::core::ffi::c_char,
    ) -> *mut X509_EXTENSION;
}
unsafe extern "C" {
    /// X509V3_EXT_nconf_nid behaves like `X509V3_EXT_nconf`, except the extension
    /// type is specified as a NID.
    pub fn X509V3_EXT_nconf_nid(
        conf: *const CONF,
        ctx: *const X509V3_CTX,
        ext_nid: ::core::ffi::c_int,
        value: *const ::core::ffi::c_char,
    ) -> *mut X509_EXTENSION;
}
unsafe extern "C" {
    /// X509V3_EXT_conf_nid calls `X509V3_EXT_nconf_nid`. `conf` must be NULL.
    pub fn X509V3_EXT_conf_nid(
        conf: *mut CRYPTO_MUST_BE_NULL,
        ctx: *const X509V3_CTX,
        ext_nid: ::core::ffi::c_int,
        value: *const ::core::ffi::c_char,
    ) -> *mut X509_EXTENSION;
}
unsafe extern "C" {
    /// X509V3_EXT_add_nconf_sk looks up the section named `section` in `conf`. For
    /// each `CONF_VALUE` in the section, it constructs an extension as in
    /// `X509V3_EXT_nconf`, taking `name` and `value` from the `CONF_VALUE`. Each new
    /// extension is appended to `*sk`. If `*sk` is non-NULL, and at least one
    /// extension is added, it sets `*sk` to a newly-allocated
    /// `STACK_OF(X509_EXTENSION)`. It returns one on success and zero on error.
    pub fn X509V3_EXT_add_nconf_sk(
        conf: *const CONF,
        ctx: *const X509V3_CTX,
        section: *const ::core::ffi::c_char,
        sk: *mut *mut stack_st_X509_EXTENSION,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509V3_EXT_add_nconf adds extensions to `cert` as in
    /// `X509V3_EXT_add_nconf_sk`. It returns one on success and zero on error.
    pub fn X509V3_EXT_add_nconf(
        conf: *const CONF,
        ctx: *const X509V3_CTX,
        section: *const ::core::ffi::c_char,
        cert: *mut X509,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509V3_EXT_REQ_add_nconf adds extensions to `req` as in
    /// `X509V3_EXT_add_nconf_sk`. It returns one on success and zero on error.
    pub fn X509V3_EXT_REQ_add_nconf(
        conf: *const CONF,
        ctx: *const X509V3_CTX,
        section: *const ::core::ffi::c_char,
        req: *mut X509_REQ,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509V3_EXT_CRL_add_nconf adds extensions to `crl` as in
    /// `X509V3_EXT_add_nconf_sk`. It returns one on success and zero on error.
    pub fn X509V3_EXT_CRL_add_nconf(
        conf: *const CONF,
        ctx: *const X509V3_CTX,
        section: *const ::core::ffi::c_char,
        crl: *mut X509_CRL,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// i2s_ASN1_OCTET_STRING returns a human-readable representation of `oct` as a
    /// newly-allocated, NUL-terminated string, or NULL on error. `method` is
    /// ignored. The caller must release the result with `OPENSSL_free` when done.
    pub fn i2s_ASN1_OCTET_STRING(
        method: *const X509V3_EXT_METHOD,
        oct: *const ASN1_OCTET_STRING,
    ) -> *mut ::core::ffi::c_char;
}
unsafe extern "C" {
    /// s2i_ASN1_OCTET_STRING decodes `str` as a hexadecimal byte string, with
    /// optional colon separators between bytes. It returns a newly-allocated
    /// `ASN1_OCTET_STRING` with the result on success, or NULL on error. `method`
    /// and `ctx` are ignored.
    pub fn s2i_ASN1_OCTET_STRING(
        method: *const X509V3_EXT_METHOD,
        ctx: *const X509V3_CTX,
        str_: *const ::core::ffi::c_char,
    ) -> *mut ASN1_OCTET_STRING;
}
unsafe extern "C" {
    /// i2s_ASN1_INTEGER returns a human-readable representation of `aint` as a
    /// newly-allocated, NUL-terminated string, or NULL on error. `method` is
    /// ignored. The caller must release the result with `OPENSSL_free` when done.
    pub fn i2s_ASN1_INTEGER(
        method: *const X509V3_EXT_METHOD,
        aint: *const ASN1_INTEGER,
    ) -> *mut ::core::ffi::c_char;
}
unsafe extern "C" {
    /// s2i_ASN1_INTEGER decodes `value` as the ASCII representation of an integer,
    /// and returns a newly-allocated `ASN1_INTEGER` containing the result, or NULL
    /// on error. `method` is ignored. If `value` begins with "0x" or "0X", the input
    /// is decoded in hexadecimal, otherwise decimal.
    pub fn s2i_ASN1_INTEGER(
        method: *const X509V3_EXT_METHOD,
        value: *const ::core::ffi::c_char,
    ) -> *mut ASN1_INTEGER;
}
unsafe extern "C" {
    /// i2s_ASN1_ENUMERATED returns a human-readable representation of `aint` as a
    /// newly-allocated, NUL-terminated string, or NULL on error. `method` is
    /// ignored. The caller must release the result with `OPENSSL_free` when done.
    pub fn i2s_ASN1_ENUMERATED(
        method: *const X509V3_EXT_METHOD,
        aint: *const ASN1_ENUMERATED,
    ) -> *mut ::core::ffi::c_char;
}
unsafe extern "C" {
    /// X509V3_conf_free releases memory associated with `CONF_VALUE`.
    pub fn X509V3_conf_free(val: *mut CONF_VALUE);
}
unsafe extern "C" {
    /// i2v_GENERAL_NAME serializes `gen` as a `CONF_VALUE`. If `ret` is non-NULL, it
    /// appends the value to `ret` and returns `ret` on success or NULL on error. If
    /// it returns NULL, the caller is still responsible for freeing `ret`. If `ret`
    /// is NULL, it returns a newly-allocated `STACK_OF(CONF_VALUE)` containing the
    /// result. `method` is ignored. When done, the caller should release the result
    /// with `sk_CONF_VALUE_pop_free` and `X509V3_conf_free`.
    ///
    /// Do not use this function. This is an internal implementation detail of the
    /// human-readable print functions. If extracting a SAN list from a certificate,
    /// look at `gen` directly.
    pub fn i2v_GENERAL_NAME(
        method: *const X509V3_EXT_METHOD,
        gen_: *const GENERAL_NAME,
        ret: *mut stack_st_CONF_VALUE,
    ) -> *mut stack_st_CONF_VALUE;
}
unsafe extern "C" {
    /// i2v_GENERAL_NAMES serializes `gen` as a list of `CONF_VALUE`s. If `ret` is
    /// non-NULL, it appends the values to `ret` and returns `ret` on success or NULL
    /// on error. If it returns NULL, the caller is still responsible for freeing
    /// `ret`. If `ret` is NULL, it returns a newly-allocated `STACK_OF(CONF_VALUE)`
    /// containing the results. `method` is ignored.
    ///
    /// Do not use this function. This is an internal implementation detail of the
    /// human-readable print functions. If extracting a SAN list from a certificate,
    /// look at `gen` directly.
    pub fn i2v_GENERAL_NAMES(
        method: *const X509V3_EXT_METHOD,
        gen_: *const GENERAL_NAMES,
        extlist: *mut stack_st_CONF_VALUE,
    ) -> *mut stack_st_CONF_VALUE;
}
unsafe extern "C" {
    /// a2i_IPADDRESS decodes `ipasc` as the textual representation of an IPv4 or
    /// IPv6 address. On success, it returns a newly-allocated `ASN1_OCTET_STRING`
    /// containing the decoded IP address. IPv4 addresses are represented as 4-byte
    /// strings and IPv6 addresses as 16-byte strings. On failure, it returns NULL.
    pub fn a2i_IPADDRESS(ipasc: *const ::core::ffi::c_char) -> *mut ASN1_OCTET_STRING;
}
unsafe extern "C" {
    /// a2i_IPADDRESS_NC decodes `ipasc` as the textual representation of an IPv4 or
    /// IPv6 address range. On success, it returns a newly-allocated
    /// `ASN1_OCTET_STRING` containing the decoded IP address, followed by the
    /// decoded mask. IPv4 ranges are represented as 8-byte strings and IPv6 ranges
    /// as 32-byte strings. On failure, it returns NULL.
    ///
    /// The text format decoded by this function is not the standard CIDR notation.
    /// Instead, the mask after the "/" is represented as another IP address. For
    /// example, "192.168.0.0/16" would be written "192.168.0.0/255.255.0.0".
    pub fn a2i_IPADDRESS_NC(ipasc: *const ::core::ffi::c_char) -> *mut ASN1_OCTET_STRING;
}
unsafe extern "C" {
    /// X509_get_notBefore returns `x509`'s notBefore time. Note this function is not
    /// const-correct for legacy reasons. Use `X509_get0_notBefore` or
    /// `X509_getm_notBefore` instead.
    pub fn X509_get_notBefore(x509: *const X509) -> *mut ASN1_TIME;
}
unsafe extern "C" {
    /// X509_get_notAfter returns `x509`'s notAfter time. Note this function is not
    /// const-correct for legacy reasons. Use `X509_get0_notAfter` or
    /// `X509_getm_notAfter` instead.
    pub fn X509_get_notAfter(x509: *const X509) -> *mut ASN1_TIME;
}
unsafe extern "C" {
    /// X509_set_notBefore calls `X509_set1_notBefore`. Use `X509_set1_notBefore`
    /// instead.
    pub fn X509_set_notBefore(x509: *mut X509, tm: *const ASN1_TIME) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_set_notAfter calls `X509_set1_notAfter`. Use `X509_set1_notAfter`
    /// instead.
    pub fn X509_set_notAfter(x509: *mut X509, tm: *const ASN1_TIME) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_CRL_get_lastUpdate returns a mutable pointer to `crl`'s thisUpdate time.
    /// The OpenSSL API refers to this field as lastUpdate.
    ///
    /// Use `X509_CRL_get0_lastUpdate` or `X509_CRL_set1_lastUpdate` instead.
    pub fn X509_CRL_get_lastUpdate(crl: *mut X509_CRL) -> *mut ASN1_TIME;
}
unsafe extern "C" {
    /// X509_CRL_get_nextUpdate returns a mutable pointer to `crl`'s nextUpdate time,
    /// or NULL if `crl` has none. Use `X509_CRL_get0_nextUpdate` or
    /// `X509_CRL_set1_nextUpdate` instead.
    pub fn X509_CRL_get_nextUpdate(crl: *mut X509_CRL) -> *mut ASN1_TIME;
}
unsafe extern "C" {
    /// X509_get_serialNumber returns a mutable pointer to `x509`'s serial number.
    /// Prefer `X509_get0_serialNumber`.
    pub fn X509_get_serialNumber(x509: *mut X509) -> *mut ASN1_INTEGER;
}
unsafe extern "C" {
    /// X509_NAME_get_text_by_OBJ finds the first attribute with type `obj` in
    /// `name`. If found, it writes the value's UTF-8 representation to `buf`.
    /// followed by a NUL byte, and returns the number of bytes in the output,
    /// excluding the NUL byte. This is unlike OpenSSL which returns the raw
    /// ASN1_STRING data. The UTF-8 encoding of the `ASN1_STRING` may not contain a 0
    /// codepoint.
    ///
    /// This function writes at most `len` bytes, including the NUL byte.  If `buf`
    /// is NULL, it writes nothing and returns the number of bytes in the
    /// output, excluding the NUL byte that would be required for the full UTF-8
    /// output.
    ///
    /// This function may return -1 if an error occurs for any reason, including the
    /// value not being a recognized string type, `len` being of insufficient size to
    /// hold the full UTF-8 encoding and NUL byte, memory allocation failures, an
    /// object with type `obj` not existing in `name`, or if the UTF-8 encoding of
    /// the string contains a zero byte.
    pub fn X509_NAME_get_text_by_OBJ(
        name: *const X509_NAME,
        obj: *const ASN1_OBJECT,
        buf: *mut ::core::ffi::c_char,
        len: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_NAME_get_text_by_NID behaves like `X509_NAME_get_text_by_OBJ` except it
    /// finds an attribute of type `nid`, which should be one of the `NID_*`
    /// constants.
    pub fn X509_NAME_get_text_by_NID(
        name: *const X509_NAME,
        nid: ::core::ffi::c_int,
        buf: *mut ::core::ffi::c_char,
        len: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_STORE_CTX_get0_parent_ctx returns NULL.
    pub fn X509_STORE_CTX_get0_parent_ctx(ctx: *const X509_STORE_CTX) -> *mut X509_STORE_CTX;
}
unsafe extern "C" {
    /// X509_OBJECT_free_contents sets `obj` to the empty object, freeing any values
    /// that were previously there.
    ///
    /// TODO(davidben): Unexport this function after rust-openssl is fixed to no
    /// longer call it.
    pub fn X509_OBJECT_free_contents(obj: *mut X509_OBJECT);
}
unsafe extern "C" {
    /// X509_LOOKUP_free releases memory associated with `ctx`. This function should
    /// never be used outside the library. No function in the public API hands
    /// ownership of an `X509_LOOKUP` to the caller.
    ///
    /// TODO(davidben): Unexport this function after rust-openssl is fixed to no
    /// longer call it.
    pub fn X509_LOOKUP_free(ctx: *mut X509_LOOKUP);
}
unsafe extern "C" {
    /// X509_STORE_CTX_cleanup resets `ctx` to the empty state.
    ///
    /// This function is a remnant of when `X509_STORE_CTX` was stack-allocated and
    /// should not be used. If releasing `ctx`, call `X509_STORE_CTX_free`. If
    /// reusing `ctx` for a new verification, release the old one and create a new
    /// one.
    pub fn X509_STORE_CTX_cleanup(ctx: *mut X509_STORE_CTX);
}
unsafe extern "C" {
    /// X509V3_add_standard_extensions returns one.
    pub fn X509V3_add_standard_extensions() -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_STORE_CTX_get_chain is a legacy alias for `X509_STORE_CTX_get0_chain`.
    pub fn X509_STORE_CTX_get_chain(ctx: *const X509_STORE_CTX) -> *mut stack_st_X509;
}
unsafe extern "C" {
    /// X509_STORE_CTX_trusted_stack is a deprecated alias for
    /// `X509_STORE_CTX_set0_trusted_stack`.
    pub fn X509_STORE_CTX_trusted_stack(ctx: *mut X509_STORE_CTX, sk: *mut stack_st_X509);
}
pub type X509_STORE_CTX_verify_cb = ::core::option::Option<
    unsafe extern "C" fn(arg1: ::core::ffi::c_int, arg2: *mut X509_STORE_CTX) -> ::core::ffi::c_int,
>;
unsafe extern "C" {
    /// X509_STORE_CTX_set_verify_cb configures a callback function for `ctx` that is
    /// called multiple times during `X509_verify_cert`. The callback returns zero to
    /// fail verification and one to proceed. Typically, it will return `ok`, which
    /// preserves the default behavior. Returning one when `ok` is zero will proceed
    /// past some error. The callback may inspect `ctx` and the error queue to
    /// attempt to determine the current stage of certificate verification, but this
    /// is often unreliable. When synthesizing an error, callbacks should use
    /// `X509_STORE_CTX_set_error` to set a corresponding error.
    ///
    /// WARNING: Do not use this function. It is extremely fragile and unpredictable.
    /// This callback exposes implementation details of certificate verification,
    /// which change as the library evolves. Attempting to use it for security checks
    /// can introduce vulnerabilities if making incorrect assumptions about when the
    /// callback is called. Some errors, when suppressed, may implicitly suppress
    /// other errors due to internal implementation details. Additionally, overriding
    /// `ok` may leave `ctx` in an inconsistent state and break invariants.
    ///
    /// Instead, customize certificate verification by configuring options on the
    /// `X509_STORE_CTX` before verification, or applying additional checks after
    /// `X509_verify_cert` completes successfully.
    pub fn X509_STORE_CTX_set_verify_cb(
        ctx: *mut X509_STORE_CTX,
        verify_cb: ::core::option::Option<
            unsafe extern "C" fn(
                ok: ::core::ffi::c_int,
                ctx: *mut X509_STORE_CTX,
            ) -> ::core::ffi::c_int,
        >,
    );
}
unsafe extern "C" {
    /// X509_STORE_set_verify_cb acts like `X509_STORE_CTX_set_verify_cb` but sets
    /// the verify callback for any `X509_STORE_CTX` created from this `X509_STORE`
    ///
    /// Do not use this function. See `X509_STORE_CTX_set_verify_cb` for details.
    pub fn X509_STORE_set_verify_cb(store: *mut X509_STORE, verify_cb: X509_STORE_CTX_verify_cb);
}
unsafe extern "C" {
    /// X509_STORE_CTX_set_chain configures `ctx` to use `sk` for untrusted
    /// intermediate certificates to use in verification. This function is redundant
    /// with the `chain` parameter of `X509_STORE_CTX_init`. Use the parameter
    /// instead.
    ///
    /// WARNING: Despite the similar name, this function is unrelated to
    /// `X509_STORE_CTX_get0_chain`.
    ///
    /// WARNING: This function saves a pointer to `sk` without copying or
    /// incrementing reference counts. `sk` must outlive `ctx` and may not be mutated
    /// for the duration of the certificate verification.
    pub fn X509_STORE_CTX_set_chain(ctx: *mut X509_STORE_CTX, sk: *mut stack_st_X509);
}
unsafe extern "C" {
    /// X509_STORE_get0_objects returns a non-owning pointer of `store`'s internal
    /// object list. Although this function is not const, callers must not modify
    /// the result of this function.
    ///
    /// WARNING: This function is not thread-safe. If `store` is shared across
    /// multiple threads, callers cannot safely inspect the result of this function,
    /// because another thread may have concurrently added to it. In particular,
    /// `X509_LOOKUP_add_dir` treats this list as a cache and may add to it in the
    /// course of certificate verification. This API additionally prevents fixing
    /// some quadratic worst-case behavior in `X509_STORE` and may be removed in the
    /// future. Use `X509_STORE_get1_objects` instead.
    pub fn X509_STORE_get0_objects(store: *mut X509_STORE) -> *mut stack_st_X509_OBJECT;
}
unsafe extern "C" {
    /// X509_PURPOSE_get_by_sname returns the `X509_PURPOSE_*` constant corresponding
    /// a short name `sname`, or -1 if `sname` was not recognized.
    ///
    /// Use `X509_PURPOSE_*` constants directly instead. The short names used by this
    /// function look like "sslserver" or "smimeencrypt", so they do not make
    /// especially good APIs.
    ///
    /// This function differs from OpenSSL, which returns an "index" to be passed to
    /// `X509_PURPOSE_get0`, followed by `X509_PURPOSE_get_id`, to finally obtain an
    /// `X509_PURPOSE_*` value suitable for use with `X509_VERIFY_PARAM_set_purpose`.
    pub fn X509_PURPOSE_get_by_sname(sname: *const ::core::ffi::c_char) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// X509_PURPOSE_get0 returns the `X509_PURPOSE` object corresponding to `id`,
    /// which should be one of the `X509_PURPOSE_*` constants, or NULL if none
    /// exists.
    ///
    /// This function differs from OpenSSL, which takes an "index", returned from
    /// `X509_PURPOSE_get_by_sname`. In BoringSSL, indices and `X509_PURPOSE_*` IDs
    /// are the same.
    pub fn X509_PURPOSE_get0(id: ::core::ffi::c_int) -> *const X509_PURPOSE;
}
unsafe extern "C" {
    /// X509_PURPOSE_get_id returns `purpose`'s ID. This will be one of the
    /// `X509_PURPOSE_*` constants.
    pub fn X509_PURPOSE_get_id(purpose: *const X509_PURPOSE) -> ::core::ffi::c_int;
}
/// Private structures.
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct X509_algor_st {
    pub algorithm: *mut ASN1_OBJECT,
    pub parameter: *mut ASN1_TYPE,
}
/// pem_password_cb is an application-supplied callback to supply a PEM password.
/// On success, the callback should write the password into `out`, which has room
/// for at most `max_out` bytes. On error, including if `max_out` is too small,
/// it should return -1. `enc` is one if the password will be used for encrypting
/// and zero if it is used for decrypting. `userdata` is the application-supplied
/// parameter of the same name to the PEM function.
pub type pem_password_cb = ::core::option::Option<
    unsafe extern "C" fn(
        out: *mut ::core::ffi::c_char,
        max_out: ::core::ffi::c_int,
        enc: ::core::ffi::c_int,
        userdata: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int,
>;
unsafe extern "C" {
    /// PEM_def_callback is the default implementation of `pem_password_cb`. It
    /// interprets `userdata` as a NUL-terminated C string and outputs it according
    /// to `pem_password_cb`. If `userdata` is NULL, it returns -1.
    ///
    /// This differs from OpenSSL, which interactively prompts for a password by
    /// default.
    pub fn PEM_def_callback(
        buf: *mut ::core::ffi::c_char,
        size: ::core::ffi::c_int,
        enc: ::core::ffi::c_int,
        userdata: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PEM_read_bio_X509 reads a PEM block of type "CERTIFICATE" (RFC 7468) or "X509
    /// CERTIFICATE", as described in `PEM_read_bio_SAMPLE`.
    pub fn PEM_read_bio_X509(
        bio: *mut BIO,
        out: *mut *mut X509,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> *mut X509;
}
unsafe extern "C" {
    /// PEM_write_bio_X509 writes a PEM block of type "CERTIFICATE" (RFC 7468), as
    /// described in `PEM_write_bio_SAMPLE`.
    pub fn PEM_write_bio_X509(bio: *mut BIO, in_: *const X509) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PEM_read_bio_X509_AUX reads a PEM block of type "CERTIFICATE" (RFC 7468),
    /// "X509 CERTIFICATE", or "TRUSTED CERTIFICATE", as described in
    /// `PEM_read_bio_SAMPLE`.
    ///
    /// WARNING: This function parses auxiliary properties as in `d2i_X509_AUX`.
    /// Passing untrusted input to this function allows an attacker to influence
    /// those properties. See `d2i_X509_AUX` for details.
    pub fn PEM_read_bio_X509_AUX(
        bio: *mut BIO,
        out: *mut *mut X509,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> *mut X509;
}
unsafe extern "C" {
    /// PEM_write_bio_X509_AUX writes a PEM block of type "TRUSTED CERTIFICATE", as
    /// described in `PEM_write_bio_SAMPLE`.
    ///
    /// WARNING: This function writes a custom OpenSSL-specific format that includes
    /// auxiliary properties. See `i2d_X509_AUX`.
    pub fn PEM_write_bio_X509_AUX(bio: *mut BIO, in_: *const X509) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PEM_read_bio_X509_CRL reads a PEM block of type "X509 CRL" (RFC 7468), as
    /// described in `PEM_read_bio_SAMPLE`.
    pub fn PEM_read_bio_X509_CRL(
        bio: *mut BIO,
        out: *mut *mut X509_CRL,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> *mut X509_CRL;
}
unsafe extern "C" {
    /// PEM_write_bio_X509_CRL writes a PEM block of type "X509 CRL" (RFC 7468), as
    /// described in `PEM_write_bio_SAMPLE`.
    pub fn PEM_write_bio_X509_CRL(bio: *mut BIO, in_: *const X509_CRL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PEM_read_bio_X509_REQ reads a PEM block of type "CERTIFICATE REQUEST"
    /// (RFC 7468) or "NEW CERTIFICATE REQUEST", as described in
    /// `PEM_read_bio_SAMPLE`.
    pub fn PEM_read_bio_X509_REQ(
        bio: *mut BIO,
        out: *mut *mut X509_REQ,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> *mut X509_REQ;
}
unsafe extern "C" {
    /// PEM_write_bio_X509_REQ writes a PEM block of type "CERTIFICATE REQUEST"
    /// (RFC 7468), as described in `PEM_write_bio_SAMPLE`.
    pub fn PEM_write_bio_X509_REQ(bio: *mut BIO, in_: *const X509_REQ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PEM_write_bio_X509_REQ_NEW writes a PEM block of type "NEW CERTIFICATE
    /// REQUEST", as described in `PEM_write_bio_SAMPLE`. Prefer to use
    /// `PEM_write_bio_X509_REQ`. "NEW CERTIFICATE REQUEST" is the older type.
    pub fn PEM_write_bio_X509_REQ_NEW(bio: *mut BIO, in_: *const X509_REQ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PEM_read_bio_PKCS7 reads a PEM block of type "PKCS7" (RFC 7468) or "PKCS #7
    /// SIGNED DATA", as described in `PEM_read_bio_SAMPLE`.
    ///
    /// This function also accepts type "CERTIFICATE" but decodes the contents as a
    /// PKCS #7 structure rather than a certificate. This is a historical workaround
    /// for an old CA bug.
    pub fn PEM_read_bio_PKCS7(
        bio: *mut BIO,
        out: *mut *mut PKCS7,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> *mut PKCS7;
}
unsafe extern "C" {
    /// PEM_write_bio_PKCS7 writes a PEM block of type "PKCS7" (RFC 7468), as
    /// described in `PEM_write_bio_SAMPLE`.
    pub fn PEM_write_bio_PKCS7(bio: *mut BIO, in_: *const PKCS7) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PEM_X509_INFO_read_bio reads PEM blocks from `bio` and decodes any
    /// certificates, CRLs, and private keys found. It returns a
    /// `STACK_OF(X509_INFO)` structure containing the results, or NULL on error.
    ///
    /// If `sk` is NULL, the result on success will be a newly-allocated
    /// `STACK_OF(X509_INFO)` structure which should be released with
    /// `sk_X509_INFO_pop_free` and `X509_INFO_free` when done.
    ///
    /// If `sk` is non-NULL, it appends the results to `sk` instead and returns `sk`
    /// on success. In this case, the caller retains ownership of `sk` in both
    /// success and failure.
    ///
    /// This function will decrypt any encrypted certificates in `bio`, using `cb`,
    /// but it will not decrypt encrypted private keys. Encrypted private keys are
    /// instead represented as placeholder `X509_INFO` objects with an empty `x_pkey`
    /// field. This allows this function to be used with inputs with unencrypted
    /// certificates, but encrypted passwords, without knowing the password. However,
    /// it also means that this function cannot be used to decrypt the private key
    /// when the password is known.
    ///
    /// WARNING: If the input contains "TRUSTED CERTIFICATE" PEM blocks, this
    /// function parses auxiliary properties as in `d2i_X509_AUX`. Passing untrusted
    /// input to this function allows an attacker to influence those properties. See
    /// `d2i_X509_AUX` for details.
    pub fn PEM_X509_INFO_read_bio(
        bio: *mut BIO,
        sk: *mut stack_st_X509_INFO,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> *mut stack_st_X509_INFO;
}
unsafe extern "C" {
    /// PEM_read_bio_PrivateKey reads a PEM block containing a private key, as
    /// described in `PEM_read_bio_SAMPLE`. It handles generic PKCS #8 blocks of type
    /// "PRIVATE KEY" and "ENCRYPTED PRIVATE KEY", as well as key-specific formats
    /// like "RSA PRIVATE KEY", "EC PRIVATE KEY", and "DSA PRIVATE KEY".
    ///
    /// `cb` and `userdata` are used to look up the password for both PEM-level
    /// encryption as well as PKCS #8 encryption, in the case of "ENCRYPTED PRIVATE
    /// KEY" blocks.
    pub fn PEM_read_bio_PrivateKey(
        bio: *mut BIO,
        out: *mut *mut EVP_PKEY,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> *mut EVP_PKEY;
}
unsafe extern "C" {
    /// PEM_write_bio_PrivateKey writes `in` to `bio` in PKCS#8 format, as described
    /// in `PEM_write_bio_SAMPLE`. However, it interprets encryption parameters
    /// differently:
    ///
    /// - If not encrypting (`enc` is NULL), it writes the key as a PEM block of type
    ///   "PRIVATE KEY".
    ///
    /// - If encrypted (`enc` is not NULL), it encrypts the key in an
    ///   EncryptedPrivateKeyInfo using PBES2 (see `PKCS8_encrypt`) and writes the
    ///   result as a PEM block of type "ENCRYPTED PRIVATE KEY".
    pub fn PEM_write_bio_PrivateKey(
        bio: *mut BIO,
        in_: *const EVP_PKEY,
        enc: *const EVP_CIPHER,
        pass: *const u8,
        pass_len: ::core::ffi::c_int,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PEM_read_bio_PUBKEY reads a PEM block of type "PUBLIC KEY", as described in
    /// `PEM_read_bio_SAMPLE`.
    pub fn PEM_read_bio_PUBKEY(
        bio: *mut BIO,
        out: *mut *mut EVP_PKEY,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> *mut EVP_PKEY;
}
unsafe extern "C" {
    /// PEM_write_bio_PUBKEY writes `in` as a PEM block of type "PUBLIC KEY", as
    /// described in `PEM_write_bio_SAMPLE`.
    pub fn PEM_write_bio_PUBKEY(bio: *mut BIO, in_: *const EVP_PKEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PEM_write_bio_PKCS8PrivateKey_nid behaves like `PEM_write_bio_PrivateKey`
    /// but uses the PBES1 algorithm specified by `nid` for encryption. See also
    /// `PKCS8_encrypt`. If `nid` is -1, it writes the private key unencrypted.
    pub fn PEM_write_bio_PKCS8PrivateKey_nid(
        bio: *mut BIO,
        in_: *const EVP_PKEY,
        nid: ::core::ffi::c_int,
        pass: *const ::core::ffi::c_char,
        pass_len: ::core::ffi::c_int,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PEM_write_bio_PKCS8PrivateKey is an alias for `PEM_write_bio_PrivateKey`.
    pub fn PEM_write_bio_PKCS8PrivateKey(
        bio: *mut BIO,
        in_: *const EVP_PKEY,
        enc: *const EVP_CIPHER,
        pass: *const ::core::ffi::c_char,
        pass_len: ::core::ffi::c_int,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PEM_write_PKCS8PrivateKey_nid behaves like
    /// `PEM_write_bio_PKCS8PrivateKey_nid` but writes to `fp`.
    pub fn PEM_write_PKCS8PrivateKey_nid(
        fp: *mut FILE,
        in_: *const EVP_PKEY,
        nid: ::core::ffi::c_int,
        pass: *const ::core::ffi::c_char,
        pass_len: ::core::ffi::c_int,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PEM_write_PKCS8PrivateKey behaves like `PEM_write_bio_PKCS8PrivateKey` but
    /// writes to `fp`.
    pub fn PEM_write_PKCS8PrivateKey(
        fp: *mut FILE,
        in_: *const EVP_PKEY,
        enc: *const EVP_CIPHER,
        pass: *const ::core::ffi::c_char,
        pass_len: ::core::ffi::c_int,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PEM_read_bio_PKCS8 reads a PEM block of type "ENCRYPTED PRIVATE KEY", as
    /// described in `PEM_read_bio_SAMPLE`.
    ///
    /// Although this function accepts `cb` and `userdata` to decrypt the PEM-level
    /// encryption, it does not decrypt the EncryptedPrivateKeyInfo structure. It
    /// returns the encrypted key as an `X509_SIG` object which, despite its name, is
    /// an algorithm and octet string pair.
    pub fn PEM_read_bio_PKCS8(
        bio: *mut BIO,
        out: *mut *mut X509_SIG,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> *mut X509_SIG;
}
unsafe extern "C" {
    /// PEM_write_bio_PKCS8 writes a PEM block of type "ENCRYPTED PRIVATE KEY", as
    /// described in `PEM_write_bio_SAMPLE`. `in` is used to represent an
    /// already-encrypted EncryptedPrivateKeyInfo structure.
    pub fn PEM_write_bio_PKCS8(bio: *mut BIO, in_: *const X509_SIG) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PEM_read_bio_PKCS8_PRIV_KEY_INFO reads a PEM block of type "PRIVATE KEY", as
    /// described in `PEM_read_bio_SAMPLE`.
    pub fn PEM_read_bio_PKCS8_PRIV_KEY_INFO(
        bio: *mut BIO,
        out: *mut *mut PKCS8_PRIV_KEY_INFO,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> *mut PKCS8_PRIV_KEY_INFO;
}
unsafe extern "C" {
    /// PEM_write_bio_PKCS8_PRIV_KEY_INFO writes a PEM block of type "PRIVATE KEY",
    /// as described in `PEM_write_bio_SAMPLE`.
    pub fn PEM_write_bio_PKCS8_PRIV_KEY_INFO(
        bio: *mut BIO,
        in_: *const PKCS8_PRIV_KEY_INFO,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PEM_read_bio_RSAPrivateKey behaves like `PEM_read_bio_PrivateKey` but only
    /// returns RSA keys, represented as an `RSA` object. Keys of other types result
    /// in an error.
    pub fn PEM_read_bio_RSAPrivateKey(
        bio: *mut BIO,
        out: *mut *mut RSA,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> *mut RSA;
}
unsafe extern "C" {
    /// PEM_write_bio_RSAPrivateKey writes `in` as a PEM block of type "RSA PRIVATE
    /// KEY", as described in `PEM_write_bio_SAMPLE`.
    pub fn PEM_write_bio_RSAPrivateKey(
        bio: *mut BIO,
        in_: *const RSA,
        enc: *const EVP_CIPHER,
        pass: *const u8,
        pass_len: ::core::ffi::c_int,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PEM_read_bio_RSAPublicKey reads a PEM block of type "RSA PUBLIC KEY", as
    /// described in `PEM_read_bio_SAMPLE`.
    pub fn PEM_read_bio_RSAPublicKey(
        bio: *mut BIO,
        out: *mut *mut RSA,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> *mut RSA;
}
unsafe extern "C" {
    /// PEM_write_bio_RSAPublicKey writes a PEM block of type "RSA PUBLIC KEY", as
    /// described in `PEM_write_bio_SAMPLE`.
    pub fn PEM_write_bio_RSAPublicKey(bio: *mut BIO, in_: *const RSA) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PEM_read_bio_RSA_PUBKEY behaves like `PEM_read_bio_PUBKEY` but only returns
    /// RSA keys, represented as an `RSA` object. Keys of other types result in an
    /// error.
    pub fn PEM_read_bio_RSA_PUBKEY(
        bio: *mut BIO,
        out: *mut *mut RSA,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> *mut RSA;
}
unsafe extern "C" {
    /// PEM_write_bio_RSA_PUBKEY writes `in` as a PEM block of type "PUBLIC KEY", as
    /// described in `PEM_write_bio_SAMPLE`.
    pub fn PEM_write_bio_RSA_PUBKEY(bio: *mut BIO, in_: *const RSA) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PEM_read_bio_DSAPrivateKey behaves like `PEM_read_bio_PrivateKey` but only
    /// returns DSA keys, represented as a `DSA` object. Keys of other types result
    /// in an error.
    pub fn PEM_read_bio_DSAPrivateKey(
        bio: *mut BIO,
        out: *mut *mut DSA,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> *mut DSA;
}
unsafe extern "C" {
    /// PEM_write_bio_DSAPrivateKey writes `in` as a PEM block of type "DSA PRIVATE
    /// KEY", as described in `PEM_write_bio_SAMPLE`.
    pub fn PEM_write_bio_DSAPrivateKey(
        bio: *mut BIO,
        in_: *const DSA,
        enc: *const EVP_CIPHER,
        pass: *const u8,
        pass_len: ::core::ffi::c_int,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PEM_read_bio_DSA_PUBKEY behaves like `PEM_read_bio_PUBKEY` but only returns
    /// DSA keys, represented as a `DSA` object. Keys of other types result in an
    /// error.
    pub fn PEM_read_bio_DSA_PUBKEY(
        bio: *mut BIO,
        out: *mut *mut DSA,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> *mut DSA;
}
unsafe extern "C" {
    /// PEM_write_bio_DSA_PUBKEY writes `in` in SubjectPublicKeyInfo format as a PEM
    /// block of type "PUBLIC KEY", as described in `PEM_write_bio_SAMPLE`.
    pub fn PEM_write_bio_DSA_PUBKEY(bio: *mut BIO, in_: *const DSA) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PEM_read_bio_DSAparams reads a PEM block of type "DSA PARAMETERS", as
    /// described in `PEM_read_bio_SAMPLE`.
    pub fn PEM_read_bio_DSAparams(
        bio: *mut BIO,
        out: *mut *mut DSA,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> *mut DSA;
}
unsafe extern "C" {
    /// PEM_write_bio_DSAparams writes a PEM block of type "DSA PARAMETERS", as
    /// described in `PEM_write_bio_SAMPLE`.
    pub fn PEM_write_bio_DSAparams(bio: *mut BIO, in_: *const DSA) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PEM_read_bio_ECPrivateKey behaves like `PEM_read_bio_PrivateKey` but only
    /// returns EC keys, represented as an `EC_KEY` object. Keys of other types
    /// result in an error.
    pub fn PEM_read_bio_ECPrivateKey(
        bio: *mut BIO,
        out: *mut *mut EC_KEY,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> *mut EC_KEY;
}
unsafe extern "C" {
    /// PEM_write_bio_ECPrivateKey writes `in` as a PEM block of type "EC PRIVATE
    /// KEY", as described in `PEM_write_bio_SAMPLE`.
    pub fn PEM_write_bio_ECPrivateKey(
        bio: *mut BIO,
        in_: *const EC_KEY,
        enc: *const EVP_CIPHER,
        pass: *const u8,
        pass_len: ::core::ffi::c_int,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PEM_read_bio_EC_PUBKEY behaves like `PEM_read_bio_PUBKEY` but only returns
    /// EC keys, represented as an `EC_KEY` object. Keys of other types result in an
    /// error.
    pub fn PEM_read_bio_EC_PUBKEY(
        bio: *mut BIO,
        out: *mut *mut EC_KEY,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> *mut EC_KEY;
}
unsafe extern "C" {
    /// PEM_write_bio_EC_PUBKEY writes `in` in SubjectPublicKeyInfo format as a PEM
    /// block of type "PUBLIC KEY", as described in `PEM_write_bio_SAMPLE`.
    pub fn PEM_write_bio_EC_PUBKEY(bio: *mut BIO, in_: *const EC_KEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PEM_read_bio_DHparams reads a PEM block of type "DH PARAMETERS", as described
    /// in `PEM_read_bio_SAMPLE`.
    pub fn PEM_read_bio_DHparams(
        bio: *mut BIO,
        out: *mut *mut DH,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> *mut DH;
}
unsafe extern "C" {
    /// PEM_write_bio_DHparams writes a PEM block of type "DH PARAMETERS", as
    /// described in `PEM_write_bio_SAMPLE`.
    pub fn PEM_write_bio_DHparams(bio: *mut BIO, in_: *const DH) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// The following functions behave like the corresponding `PEM_read_bio_*`
    /// functions, but read from `fp`.
    pub fn PEM_read_X509(
        fp: *mut FILE,
        out: *mut *mut X509,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> *mut X509;
}
unsafe extern "C" {
    pub fn PEM_read_X509_CRL(
        fp: *mut FILE,
        out: *mut *mut X509_CRL,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> *mut X509_CRL;
}
unsafe extern "C" {
    pub fn PEM_read_X509_AUX(
        fp: *mut FILE,
        out: *mut *mut X509,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> *mut X509;
}
unsafe extern "C" {
    pub fn PEM_X509_INFO_read(
        fp: *mut FILE,
        sk: *mut stack_st_X509_INFO,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> *mut stack_st_X509_INFO;
}
unsafe extern "C" {
    pub fn PEM_read_X509_REQ(
        fp: *mut FILE,
        out: *mut *mut X509_REQ,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> *mut X509_REQ;
}
unsafe extern "C" {
    pub fn PEM_read_PKCS7(
        fp: *mut FILE,
        out: *mut *mut PKCS7,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> *mut PKCS7;
}
unsafe extern "C" {
    pub fn PEM_read_PKCS8(
        fp: *mut FILE,
        out: *mut *mut X509_SIG,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> *mut X509_SIG;
}
unsafe extern "C" {
    pub fn PEM_read_PKCS8_PRIV_KEY_INFO(
        fp: *mut FILE,
        out: *mut *mut PKCS8_PRIV_KEY_INFO,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> *mut PKCS8_PRIV_KEY_INFO;
}
unsafe extern "C" {
    pub fn PEM_read_RSAPrivateKey(
        fp: *mut FILE,
        out: *mut *mut RSA,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> *mut RSA;
}
unsafe extern "C" {
    pub fn PEM_read_RSAPublicKey(
        fp: *mut FILE,
        out: *mut *mut RSA,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> *mut RSA;
}
unsafe extern "C" {
    pub fn PEM_read_RSA_PUBKEY(
        fp: *mut FILE,
        out: *mut *mut RSA,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> *mut RSA;
}
unsafe extern "C" {
    pub fn PEM_read_DSAPrivateKey(
        fp: *mut FILE,
        out: *mut *mut DSA,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> *mut DSA;
}
unsafe extern "C" {
    pub fn PEM_read_DSA_PUBKEY(
        fp: *mut FILE,
        out: *mut *mut DSA,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> *mut DSA;
}
unsafe extern "C" {
    pub fn PEM_read_DSAparams(
        fp: *mut FILE,
        out: *mut *mut DSA,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> *mut DSA;
}
unsafe extern "C" {
    pub fn PEM_read_ECPrivateKey(
        fp: *mut FILE,
        out: *mut *mut EC_KEY,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> *mut EC_KEY;
}
unsafe extern "C" {
    pub fn PEM_read_EC_PUBKEY(
        fp: *mut FILE,
        out: *mut *mut EC_KEY,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> *mut EC_KEY;
}
unsafe extern "C" {
    pub fn PEM_read_DHparams(
        fp: *mut FILE,
        out: *mut *mut DH,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> *mut DH;
}
unsafe extern "C" {
    pub fn PEM_read_PrivateKey(
        fp: *mut FILE,
        out: *mut *mut EVP_PKEY,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> *mut EVP_PKEY;
}
unsafe extern "C" {
    pub fn PEM_read_PUBKEY(
        fp: *mut FILE,
        out: *mut *mut EVP_PKEY,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> *mut EVP_PKEY;
}
unsafe extern "C" {
    /// The following functions behave like the corresponding `PEM_write_bio_*`
    /// functions, but write to `fp`.
    pub fn PEM_write_X509(fp: *mut FILE, x: *const X509) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn PEM_write_X509_CRL(fp: *mut FILE, in_: *const X509_CRL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn PEM_write_X509_AUX(fp: *mut FILE, in_: *const X509) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn PEM_write_X509_REQ(fp: *mut FILE, in_: *const X509_REQ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn PEM_write_X509_REQ_NEW(fp: *mut FILE, in_: *const X509_REQ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn PEM_write_PKCS7(fp: *mut FILE, in_: *const PKCS7) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn PEM_write_PKCS8(fp: *mut FILE, in_: *const X509_SIG) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn PEM_write_PKCS8_PRIV_KEY_INFO(
        fp: *mut FILE,
        in_: *const PKCS8_PRIV_KEY_INFO,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn PEM_write_RSAPrivateKey(
        fp: *mut FILE,
        in_: *const RSA,
        enc: *const EVP_CIPHER,
        pass: *const u8,
        pass_len: ::core::ffi::c_int,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn PEM_write_RSAPublicKey(fp: *mut FILE, in_: *const RSA) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn PEM_write_RSA_PUBKEY(fp: *mut FILE, in_: *const RSA) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn PEM_write_DSAPrivateKey(
        fp: *mut FILE,
        in_: *const DSA,
        enc: *const EVP_CIPHER,
        pass: *const u8,
        pass_len: ::core::ffi::c_int,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn PEM_write_DSA_PUBKEY(fp: *mut FILE, in_: *const DSA) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn PEM_write_DSAparams(fp: *mut FILE, in_: *const DSA) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn PEM_write_ECPrivateKey(
        fp: *mut FILE,
        in_: *const EC_KEY,
        enc: *const EVP_CIPHER,
        pass: *const u8,
        pass_len: ::core::ffi::c_int,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn PEM_write_EC_PUBKEY(fp: *mut FILE, in_: *const EC_KEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn PEM_write_DHparams(fp: *mut FILE, in_: *const DH) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn PEM_write_PrivateKey(
        fp: *mut FILE,
        in_: *const EVP_PKEY,
        enc: *const EVP_CIPHER,
        pass: *const u8,
        pass_len: ::core::ffi::c_int,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn PEM_write_PUBKEY(fp: *mut FILE, in_: *const EVP_PKEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PEM_read_bio reads from `bio` until the next PEM block. If one is found, it
    /// returns one and sets `*out_name`, `*out_header`, and `*out_data` to
    /// newly-allocated buffers containing the PEM type, the header block, and the
    /// decoded data, respectively. `*out_name` and `*out_header` are NUL-terminated
    /// C strings, while `*out_data` has `*out_len` bytes. The caller must release
    /// each of `*out_name`, `*out_header`, and `*out_data` with `OPENSSL_free` when
    /// done.
    ///
    /// If no PEM block is found, this function returns zero and pushes
    /// `PEM_R_NO_START_LINE` to the error queue. If one is found, but there is an
    /// error decoding it, it returns zero and pushes some other error to the error
    /// queue.
    ///
    /// This function does not decrypt encrypted PEM blocks and instead returns the
    /// header and (possibly encrypted) data unprocessed. See `PEM_bytes_read_bio` to
    /// decrypt blocks.
    pub fn PEM_read_bio(
        bio: *mut BIO,
        out_name: *mut *mut ::core::ffi::c_char,
        out_header: *mut *mut ::core::ffi::c_char,
        out_data: *mut *mut u8,
        out_len: *mut ::core::ffi::c_long,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PEM_read behaves like `PEM_read_bio` but reads from `fp`.
    pub fn PEM_read(
        fp: *mut FILE,
        out_name: *mut *mut ::core::ffi::c_char,
        out_header: *mut *mut ::core::ffi::c_char,
        out_data: *mut *mut u8,
        out_len: *mut ::core::ffi::c_long,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PEM_write_bio writes a PEM block to `bio`, containing `len` bytes from `data`
    /// as data. `name` and `hdr` are NUL-terminated C strings containing the PEM
    /// type and header block, respectively. This function returns zero on error and
    /// the number of bytes written on success.
    pub fn PEM_write_bio(
        bio: *mut BIO,
        name: *const ::core::ffi::c_char,
        hdr: *const ::core::ffi::c_char,
        data: *const u8,
        len: ::core::ffi::c_long,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PEM_write behaves like `PEM_write_bio` but reads from `fp`.
    pub fn PEM_write(
        fp: *mut FILE,
        name: *const ::core::ffi::c_char,
        hdr: *const ::core::ffi::c_char,
        data: *const u8,
        len: ::core::ffi::c_long,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PEM_bytes_read_bio reads from `bio` until it finds a PEM block whose name
    /// matches `expected_name`. If one is found, it sets `*out_name` and `*out_data`
    /// to newly-allocated buffers containing the PEM type and (possibly decrypted)
    /// PEM data. `*out_name` is a NUL-terminated C string, while `*out_data` has
    /// `*out_len` bytes. The caller must release `*out_name` and `*out_data` with
    /// `OPENSSL_free` when done.
    ///
    /// If the PEM block is encrypted, `cb` will be called to look up the password.
    /// See `pem_password_cb` for details. If `cb` is NULL, `PEM_def_callback` is
    /// used and `userdata` should be a NUL-terminated C string containing the
    /// password. Set both `cb` and `userdata` to NULL to only handle plaintext
    /// blocks.
    ///
    /// `expected_name` and `*out_name` may not necessarily be the same value, so
    /// callers must check `*out_name` before decoding `*out_data`. In addition to an
    /// exact match, the following values are also accepted:
    ///
    /// - If `expected_name` is "CERTIFICATE", the older "X509 CERTIFICATE" type is
    ///   also accepted.
    ///
    /// - If `expected_name` is "CERTIFICATE REQUEST", the older "NEW CERTIFICATE
    ///   REQUEST" type is also accepted.
    ///
    /// - If `expected_name` is "TRUSTED CERTIFICATE", "CERTIFICATE" and the older
    ///   "X509 CERTIFICATE" are also accepted.
    ///
    /// - If `expected_name` is "PKCS7", "PKCS #7 SIGNED DATA" is also accepted.
    ///
    /// - If `expected_name` is "PKCS7", "CERTIFICATE" is also accepted. This is an
    ///   exposed implementation detail of `PKCS7_get_PEM_certificates`, which works
    ///   around a 2000-era mistake by some CAs.
    ///
    /// - If `expected_name` is "ANY PRIVATE KEY", the type "ANY PRIVATE KEY" is not
    ///   accepted and, instead, the function accepts "PRIVATE KEY", "ENCRYPTED
    ///   PRIVATE KEY", "RSA PRIVATE KEY", "EC PRIVATE KEY", and "DSA PRIVATE KEY".
    ///   This is an exposed implementation detail of `PEM_read_bio_PrivateKey`.
    ///
    /// TODO(davidben): Can some of the older aliases and workarounds be removed now?
    ///
    /// If no PEM block is found, this function returns zero and pushes
    /// `PEM_R_NO_START_LINE` to the error queue. If one is found, but there is an
    /// error decoding it, it returns zero and pushes some other error to the error
    /// queue.
    pub fn PEM_bytes_read_bio(
        out_data: *mut *mut u8,
        out_len: *mut ::core::ffi::c_long,
        out_name: *mut *mut ::core::ffi::c_char,
        expected_name: *const ::core::ffi::c_char,
        bio: *mut BIO,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// d2i_PKCS8PrivateKey_bio reads a DER-encoded EncryptedPrivateKey structure
    /// (RFC 5208) from `bio`, decrypts it with `PKCS8_decrypt`, and returns the
    /// result as a newly-allocated `EVP_PKEY`, or NULL on error. On success, if
    /// `out` is non-NULL, it additionally frees the previous value at `*out` and
    /// updates `*out` to the result. The password is determined by calling `cb`, or
    /// `PEM_def_callback` if NULL.
    pub fn d2i_PKCS8PrivateKey_bio(
        bio: *mut BIO,
        out: *mut *mut EVP_PKEY,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> *mut EVP_PKEY;
}
unsafe extern "C" {
    /// i2d_PKCS8PrivateKey_bio encodes `in` as a DER-encoded structure and writes
    /// it to `bio`. It returns one on success and zero on error. The structure used
    /// depends on `enc`:
    ///
    /// - If `enc` is NULL, it writes a PrivateKeyInfo structure (RFC 5208).
    ///
    /// - If `enc` is non-NULL, it writes an EncryptedPrivateKeyInfo structure (RFC
    ///   5280). The key is encrypted with PBES2, as in `PKCS8_encrypt`. The password
    ///   is specified by `pass`, `cb`, and `userdata`, as in `PEM_write_bio_SAMPLE`.
    ///
    /// WARNING: PrivateKeyInfo and EncryptedPrivateKeyInfo are different formats,
    /// and DER does not include a type header. The encrypted and unencrypted modes
    /// of this function should not be mixed in the same context.
    pub fn i2d_PKCS8PrivateKey_bio(
        bio: *mut BIO,
        in_: *const EVP_PKEY,
        enc: *const EVP_CIPHER,
        pass: *const ::core::ffi::c_char,
        pass_len: ::core::ffi::c_int,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// i2d_PKCS8PrivateKey_nid_bio encodes `in` as a DER-encoded structure and
    /// writes it to `bio`. It returns one on success and zero on error. The
    /// structure used depends on `nid`:
    ///
    /// - If `nid` is -1, it writes a PrivateKeyInfo structure (RFC 5208).
    ///
    /// - Otherwise, it writes an EncryptedPrivateKeyInfo structure (RFC 5280). The
    ///   key is encrypted with PBES1, as in `PKCS8_encrypt`. The password is
    ///   specified by `pass`, `cb`, and `userdata`, as in `PEM_write_bio_SAMPLE`.
    ///
    /// WARNING: PrivateKeyInfo and EncryptedPrivateKeyInfo are different formats,
    /// and DER does not include a type header. The encrypted and unencrypted modes
    /// of this function should not be mixed in the same context.
    pub fn i2d_PKCS8PrivateKey_nid_bio(
        bio: *mut BIO,
        in_: *const EVP_PKEY,
        nid: ::core::ffi::c_int,
        pass: *const ::core::ffi::c_char,
        pass_len: ::core::ffi::c_int,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// i2d_PKCS8PrivateKey_fp behaves like `i2d_PKCS8PrivateKey_bio` but writes to
    /// `fp`.
    pub fn i2d_PKCS8PrivateKey_fp(
        fp: *mut FILE,
        in_: *const EVP_PKEY,
        enc: *const EVP_CIPHER,
        pass: *const ::core::ffi::c_char,
        pass_len: ::core::ffi::c_int,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// i2d_PKCS8PrivateKey_nid_fp behaves like `i2d_PKCS8PrivateKey_nid_bio` but
    /// writes to `fp`.
    pub fn i2d_PKCS8PrivateKey_nid_fp(
        fp: *mut FILE,
        in_: *const EVP_PKEY,
        nid: ::core::ffi::c_int,
        pass: *const ::core::ffi::c_char,
        pass_len: ::core::ffi::c_int,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// d2i_PKCS8PrivateKey_fp behaves like `d2i_PKCS8PrivateKey_bio` but reads from
    /// `fp`.
    pub fn d2i_PKCS8PrivateKey_fp(
        fp: *mut FILE,
        out: *mut *mut EVP_PKEY,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> *mut EVP_PKEY;
}
unsafe extern "C" {
    /// PEM_ASN1_read_bio calls `PEM_bytes_read_bio` and then decodes the resulting
    /// data with `d2i`, which should behave as in `d2i_SAMPLE`.
    pub fn PEM_ASN1_read_bio(
        d2i: d2i_of_void,
        name: *const ::core::ffi::c_char,
        bio: *mut BIO,
        out: *mut *mut ::core::ffi::c_void,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    /// PEM_ASN1_read behaves like `PEM_ASN1_read_bio` but reads from `fp`.
    pub fn PEM_ASN1_read(
        d2i: d2i_of_void,
        name: *const ::core::ffi::c_char,
        fp: *mut FILE,
        out: *mut *mut ::core::ffi::c_void,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    /// PEM_ASN1_write_bio encodes `in` with `i2d`, which should behave as in
    /// `i2d_SAMPLE`. It then writes the result to `bio` as in
    /// `PEM_write_bio_SAMPLE`.
    pub fn PEM_ASN1_write_bio(
        i2d: i2d_of_void,
        name: *const ::core::ffi::c_char,
        bio: *mut BIO,
        in_: *const ::core::ffi::c_void,
        enc: *const EVP_CIPHER,
        pass: *const u8,
        pass_len: ::core::ffi::c_int,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PEM_ASN1_write behaves like `PEM_ASN1_write_bio` but reads from `fp`.
    pub fn PEM_ASN1_write(
        i2d: i2d_of_void,
        name: *const ::core::ffi::c_char,
        fp: *mut FILE,
        in_: *const ::core::ffi::c_void,
        enc: *const EVP_CIPHER,
        pass: *const u8,
        pass_len: ::core::ffi::c_int,
        callback: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PKCS8_encrypt serializes and encrypts a PKCS8_PRIV_KEY_INFO with PBES1 or
    /// PBES2 as defined in PKCS #5. Only pbeWithSHAAnd128BitRC4,
    /// pbeWithSHAAnd3-KeyTripleDES-CBC and pbeWithSHA1And40BitRC2, defined in PKCS
    /// #12, and PBES2, are supported.  PBES2 is selected by setting `cipher` and
    /// passing -1 for `pbe_nid`.  Otherwise, PBES1 is used and `cipher` is ignored.
    ///
    /// `pass` is used as the password. If a PBES1 scheme from PKCS #12 is used, this
    /// will be converted to a raw byte string as specified in B.1 of PKCS #12. If
    /// `pass` is NULL, it will be encoded as the empty byte string rather than two
    /// zero bytes, the PKCS #12 encoding of the empty string.
    ///
    /// If `salt` is NULL, a random salt of `salt_len` bytes is generated. If
    /// `salt_len` is zero, a default salt length is used instead.
    ///
    /// The resulting structure is stored in an `X509_SIG` which must be freed by the
    /// caller.
    pub fn PKCS8_encrypt(
        pbe_nid: ::core::ffi::c_int,
        cipher: *const EVP_CIPHER,
        pass: *const ::core::ffi::c_char,
        pass_len: ::core::ffi::c_int,
        salt: *const u8,
        salt_len: usize,
        iterations: ::core::ffi::c_int,
        p8inf: *mut PKCS8_PRIV_KEY_INFO,
    ) -> *mut X509_SIG;
}
unsafe extern "C" {
    /// PKCS8_marshal_encrypted_private_key behaves like `PKCS8_encrypt` but encrypts
    /// an `EVP_PKEY` and writes the serialized EncryptedPrivateKeyInfo to `out`. It
    /// returns one on success and zero on error.
    pub fn PKCS8_marshal_encrypted_private_key(
        out: *mut CBB,
        pbe_nid: ::core::ffi::c_int,
        cipher: *const EVP_CIPHER,
        pass: *const ::core::ffi::c_char,
        pass_len: usize,
        salt: *const u8,
        salt_len: usize,
        iterations: ::core::ffi::c_int,
        pkey: *const EVP_PKEY,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PKCS8_decrypt decrypts and decodes a PKCS8_PRIV_KEY_INFO with PBES1 or PBES2
    /// as defined in PKCS #5. Only pbeWithSHAAnd128BitRC4,
    /// pbeWithSHAAnd3-KeyTripleDES-CBC and pbeWithSHA1And40BitRC2, and PBES2,
    /// defined in PKCS #12, are supported.
    ///
    /// `pass` is used as the password. If a PBES1 scheme from PKCS #12 is used, this
    /// will be converted to a raw byte string as specified in B.1 of PKCS #12. If
    /// `pass` is NULL, it will be encoded as the empty byte string rather than two
    /// zero bytes, the PKCS #12 encoding of the empty string.
    ///
    /// The resulting structure must be freed by the caller.
    pub fn PKCS8_decrypt(
        pkcs8: *mut X509_SIG,
        pass: *const ::core::ffi::c_char,
        pass_len: ::core::ffi::c_int,
    ) -> *mut PKCS8_PRIV_KEY_INFO;
}
unsafe extern "C" {
    /// PKCS8_parse_encrypted_private_key behaves like `PKCS8_decrypt` but it parses
    /// the EncryptedPrivateKeyInfo structure from `cbs` and advances `cbs`. It
    /// returns a newly-allocated `EVP_PKEY` on success and zero on error.
    pub fn PKCS8_parse_encrypted_private_key(
        cbs: *mut CBS,
        pass: *const ::core::ffi::c_char,
        pass_len: usize,
    ) -> *mut EVP_PKEY;
}
unsafe extern "C" {
    /// PKCS12_get_key_and_certs parses a PKCS#12 structure from `in`, authenticates
    /// and decrypts it using `password`, sets `*out_key` to the included private
    /// key and appends the included certificates to `out_certs`. It returns one on
    /// success and zero on error. The caller takes ownership of the outputs.
    /// Any friendlyName attributes (RFC 2985) in the PKCS#12 structure will be
    /// returned on the `X509` objects as aliases. See also `X509_alias_get0`.
    pub fn PKCS12_get_key_and_certs(
        out_key: *mut *mut EVP_PKEY,
        out_certs: *mut stack_st_X509,
        in_: *mut CBS,
        password: *const ::core::ffi::c_char,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PKCS12_PBE_add does nothing. It exists for compatibility with OpenSSL.
    pub fn PKCS12_PBE_add();
}
unsafe extern "C" {
    /// d2i_PKCS12 is a dummy function that copies `*ber_bytes` into a
    /// `PKCS12` structure. The `out_p12` argument should be NULL(✝). On exit,
    /// `*ber_bytes` will be advanced by `ber_len`. It returns a fresh `PKCS12`
    /// structure or NULL on error.
    ///
    /// Note: unlike other d2i functions, `d2i_PKCS12` will always consume `ber_len`
    /// bytes.
    ///
    /// (✝) If `out_p12` is not NULL and the function is successful, `*out_p12` will
    /// be freed if not NULL itself and the result will be written to `*out_p12`.
    /// New code should not depend on this.
    pub fn d2i_PKCS12(
        out_p12: *mut *mut PKCS12,
        ber_bytes: *mut *const u8,
        ber_len: usize,
    ) -> *mut PKCS12;
}
unsafe extern "C" {
    /// d2i_PKCS12_bio acts like `d2i_PKCS12` but reads from a `BIO`.
    pub fn d2i_PKCS12_bio(bio: *mut BIO, out_p12: *mut *mut PKCS12) -> *mut PKCS12;
}
unsafe extern "C" {
    /// d2i_PKCS12_fp acts like `d2i_PKCS12` but reads from a `FILE`.
    pub fn d2i_PKCS12_fp(fp: *mut FILE, out_p12: *mut *mut PKCS12) -> *mut PKCS12;
}
unsafe extern "C" {
    /// i2d_PKCS12 is a dummy function which copies the contents of `p12`. If `out`
    /// is not NULL then the result is written to `*out` and `*out` is advanced just
    /// past the output. It returns the number of bytes in the result, whether
    /// written or not, or a negative value on error.
    pub fn i2d_PKCS12(p12: *const PKCS12, out: *mut *mut u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// i2d_PKCS12_bio writes the contents of `p12` to `bio`. It returns one on
    /// success and zero on error.
    pub fn i2d_PKCS12_bio(bio: *mut BIO, p12: *const PKCS12) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// i2d_PKCS12_fp writes the contents of `p12` to `fp`. It returns one on
    /// success and zero on error.
    pub fn i2d_PKCS12_fp(fp: *mut FILE, p12: *const PKCS12) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PKCS12_parse calls `PKCS12_get_key_and_certs` on the ASN.1 data stored in
    /// `p12`. The `out_pkey` and `out_cert` arguments must not be NULL and, on
    /// successful exit, the private key and matching certificate will be stored in
    /// them. The `out_ca_certs` argument may be NULL but, if not, then any extra
    /// certificates will be appended to `*out_ca_certs`. If `*out_ca_certs` is NULL
    /// then it will be set to a freshly allocated stack containing the extra certs.
    ///
    /// Note if `p12` does not contain a private key, both `*out_pkey` and
    /// `*out_cert` will be set to NULL and all certificates will be returned via
    /// `*out_ca_certs`. Also note this function differs from OpenSSL in that extra
    /// certificates are returned in the order they appear in the file. OpenSSL 1.1.1
    /// returns them in reverse order, but this will be fixed in OpenSSL 3.0.
    ///
    /// It returns one on success and zero on error.
    ///
    /// Use `PKCS12_get_key_and_certs` instead.
    pub fn PKCS12_parse(
        p12: *const PKCS12,
        password: *const ::core::ffi::c_char,
        out_pkey: *mut *mut EVP_PKEY,
        out_cert: *mut *mut X509,
        out_ca_certs: *mut *mut stack_st_X509,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PKCS12_verify_mac returns one if `password` is a valid password for `p12`
    /// and zero otherwise. Since `PKCS12_parse` doesn't take a length parameter,
    /// it's not actually possible to use a non-NUL-terminated password to actually
    /// get anything from a `PKCS12`. Thus `password` and `password_len` may be
    /// `NULL` and zero, respectively, or else `password_len` may be -1, or else
    /// `password[password_len]` must be zero and no other NUL bytes may appear in
    /// `password`. If the `password_len` checks fail, zero is returned
    /// immediately.
    pub fn PKCS12_verify_mac(
        p12: *const PKCS12,
        password: *const ::core::ffi::c_char,
        password_len: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PKCS12_create returns a newly-allocated `PKCS12` object containing `pkey`,
    /// `cert`, and `chain`, encrypted with the specified password. `name`, if not
    /// NULL, specifies a user-friendly name to encode with the key and
    /// certificate. The key and certificates are encrypted with `key_nid` and
    /// `cert_nid`, respectively, using `iterations` iterations in the
    /// KDF. `mac_iterations` is the number of iterations when deriving the MAC
    /// key. `key_type` must be zero. `pkey` and `cert` may be NULL to omit them.
    ///
    /// Each of `key_nid`, `cert_nid`, `iterations`, and `mac_iterations` may be zero
    /// to use defaults, which are `NID_aes_256_cbc`, `NID_aes_256_cbc`,
    /// `PKCS12_DEFAULT_ITER`, and `PKCS12_DEFAULT_ITER`, respectively.
    ///
    /// `key_nid` and `cert_nid` are then interpreted as follows:
    ///
    /// * If the NID is a cipher that is supported with PBES2, e.g.
    ///   `NID_aes_256_cbc`, this function will use it with PBES2 and a default KDF
    ///   (currently PBKDF2 with HMAC-SHA256). There is no way to specify the KDF in
    ///   this function.
    ///
    /// * If the NID is a PBES1 suite, e.g. `NID_pbe_WithSHA1And3_Key_TripleDES_CBC`,
    ///   this function will use the specified suite.
    ///
    /// * If the NID is -1, this function will disable encryption for the key or
    ///   certificate. This option is not recommended and is only implemented for
    ///   compatibility with external packages. Note the output still requires a
    ///   password for the MAC. Unencrypted keys in PKCS#12 are also not widely
    ///   supported and may not open in other implementations.
    ///
    /// WARNING: This differs from other functions in this module, which use a pair
    /// of NID and `EVP_CIPHER` parameters to pick between PBES1 and PBES2 schemes.
    ///
    /// If `cert` or `chain` have associated aliases (see `X509_alias_set1`), they
    /// will be included in the output as friendlyName attributes (RFC 2985). It is
    /// an error to specify both an alias on `cert` and a non-NULL `name`
    /// parameter.
    pub fn PKCS12_create(
        password: *const ::core::ffi::c_char,
        name: *const ::core::ffi::c_char,
        pkey: *const EVP_PKEY,
        cert: *mut X509,
        chain: *const stack_st_X509,
        key_nid: ::core::ffi::c_int,
        cert_nid: ::core::ffi::c_int,
        iterations: ::core::ffi::c_int,
        mac_iterations: ::core::ffi::c_int,
        key_type: ::core::ffi::c_int,
    ) -> *mut PKCS12;
}
unsafe extern "C" {
    /// PKCS12_free frees `p12` and its contents.
    pub fn PKCS12_free(p12: *mut PKCS12);
}
/// Poly1305.
pub type poly1305_state = [u8; 512usize];
unsafe extern "C" {
    /// CRYPTO_poly1305_init sets up `state` so that it can be used to calculate an
    /// authentication tag with the one-time key `key`. Note that `key` is a
    /// one-time key and therefore there is no `reset' method because that would
    /// enable several messages to be authenticated with the same key.
    pub fn CRYPTO_poly1305_init(state: *mut poly1305_state, key: *const u8);
}
unsafe extern "C" {
    /// CRYPTO_poly1305_update processes `in_len` bytes from `in`. It can be called
    /// zero or more times after poly1305_init.
    pub fn CRYPTO_poly1305_update(state: *mut poly1305_state, in_: *const u8, in_len: usize);
}
unsafe extern "C" {
    /// CRYPTO_poly1305_finish completes the poly1305 calculation and writes a 16
    /// byte authentication tag to `mac`.
    pub fn CRYPTO_poly1305_finish(state: *mut poly1305_state, mac: *mut u8);
}
unsafe extern "C" {
    /// RAND_bytes writes `len` bytes of random data to `buf` and returns one. In the
    /// event that sufficient random data can not be obtained, `abort` is called.
    pub fn RAND_bytes(buf: *mut u8, len: usize) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// RAND_enable_fork_unsafe_buffering indicates that clones of the address space,
    /// e.g. via `fork`, will never call into BoringSSL. It may be used to disable
    /// BoringSSL's more expensive fork-safety measures. However, calling this
    /// function and then using BoringSSL across `fork` calls will leak secret keys.
    /// `fd` must be -1.
    ///
    /// WARNING: This function affects BoringSSL for the entire address space. Thus
    /// this function should never be called by library code, only by code with
    /// global knowledge of the application's use of BoringSSL.
    ///
    /// Do not use this function unless a performance issue was measured with the
    /// default behavior. BoringSSL can efficiently detect forks on most platforms,
    /// in which case this function is a no-op and is unnecessary. In particular,
    /// Linux kernel versions 4.14 or later provide `MADV_WIPEONFORK`. Future
    /// versions of BoringSSL will remove this functionality when older kernels are
    /// sufficiently rare.
    ///
    /// This function has an unusual name because it historically controlled internal
    /// buffers, but no longer does.
    pub fn RAND_enable_fork_unsafe_buffering(fd: ::core::ffi::c_int);
}
unsafe extern "C" {
    /// RAND_disable_fork_unsafe_buffering restores BoringSSL's default fork-safety
    /// protections. See also `RAND_enable_fork_unsafe_buffering`.
    pub fn RAND_disable_fork_unsafe_buffering();
}
unsafe extern "C" {
    /// RAND_get_system_entropy_for_custom_prng writes `len` bytes of random data
    /// from a system entropy source to `buf`. The maximum length of entropy which
    /// may be requested is 256 bytes. If more than 256 bytes of data is requested,
    /// or if sufficient random data can not be obtained, `abort` is called.
    /// `RAND_bytes` should normally be used instead of this function. This function
    /// should only be used for seed values or where `malloc` should not be called
    /// from BoringSSL. This function is not FIPS compliant.
    pub fn RAND_get_system_entropy_for_custom_prng(buf: *mut u8, len: usize);
}
unsafe extern "C" {
    /// RAND_pseudo_bytes is a wrapper around `RAND_bytes`.
    pub fn RAND_pseudo_bytes(buf: *mut u8, len: usize) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// RAND_seed reads a single byte of random data to ensure that any file
    /// descriptors etc are opened.
    pub fn RAND_seed(buf: *const ::core::ffi::c_void, num: ::core::ffi::c_int);
}
unsafe extern "C" {
    /// RAND_load_file returns a nonnegative number.
    pub fn RAND_load_file(
        path: *const ::core::ffi::c_char,
        num: ::core::ffi::c_long,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// RAND_file_name returns NULL.
    pub fn RAND_file_name(buf: *mut ::core::ffi::c_char, num: usize) -> *const ::core::ffi::c_char;
}
unsafe extern "C" {
    /// RAND_add does nothing.
    pub fn RAND_add(buf: *const ::core::ffi::c_void, num: ::core::ffi::c_int, entropy: f64);
}
unsafe extern "C" {
    /// RAND_egd returns 255.
    pub fn RAND_egd(arg1: *const ::core::ffi::c_char) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// RAND_poll returns one.
    pub fn RAND_poll() -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// RAND_status returns one.
    pub fn RAND_status() -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// RAND_cleanup does nothing.
    pub fn RAND_cleanup();
}
/// rand_meth_st is typedefed to `RAND_METHOD` in base.h. It isn't used; it
/// exists only to be the return type of `RAND_SSLeay`. It's
/// external so that variables of this type can be initialized.
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct rand_meth_st {
    pub seed: ::core::option::Option<
        unsafe extern "C" fn(buf: *const ::core::ffi::c_void, num: ::core::ffi::c_int),
    >,
    pub bytes: ::core::option::Option<
        unsafe extern "C" fn(buf: *mut u8, num: usize) -> ::core::ffi::c_int,
    >,
    pub cleanup: ::core::option::Option<unsafe extern "C" fn()>,
    pub add: ::core::option::Option<
        unsafe extern "C" fn(
            buf: *const ::core::ffi::c_void,
            num: ::core::ffi::c_int,
            entropy: f64,
        ),
    >,
    pub pseudorand: ::core::option::Option<
        unsafe extern "C" fn(buf: *mut u8, num: usize) -> ::core::ffi::c_int,
    >,
    pub status: ::core::option::Option<unsafe extern "C" fn() -> ::core::ffi::c_int>,
}
unsafe extern "C" {
    /// RAND_SSLeay returns a pointer to a dummy `RAND_METHOD`.
    pub fn RAND_SSLeay() -> *mut RAND_METHOD;
}
unsafe extern "C" {
    /// RAND_OpenSSL returns a pointer to a dummy `RAND_METHOD`.
    pub fn RAND_OpenSSL() -> *mut RAND_METHOD;
}
unsafe extern "C" {
    /// RAND_get_rand_method returns `RAND_SSLeay()`.
    pub fn RAND_get_rand_method() -> *const RAND_METHOD;
}
unsafe extern "C" {
    /// RAND_set_rand_method returns one.
    pub fn RAND_set_rand_method(arg1: *const RAND_METHOD) -> ::core::ffi::c_int;
}
/// RC4.
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct rc4_key_st {
    pub x: u32,
    pub y: u32,
    pub data: [u32; 256usize],
}
unsafe extern "C" {
    /// RC4_set_key performs an RC4 key schedule and initialises `rc4key` with `len`
    /// bytes of key material from `key`.
    pub fn RC4_set_key(rc4key: *mut RC4_KEY, len: ::core::ffi::c_uint, key: *const u8);
}
unsafe extern "C" {
    /// RC4 encrypts (or decrypts, it's the same with RC4) `len` bytes from `in` to
    /// `out`.
    pub fn RC4(key: *mut RC4_KEY, len: usize, in_: *const u8, out: *mut u8);
}
unsafe extern "C" {
    /// RC4_options returns the string "rc4(ptr,int)".
    pub fn RC4_options() -> *const ::core::ffi::c_char;
}
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct RIPEMD160state_st {
    pub h: [u32; 5usize],
    pub Nl: u32,
    pub Nh: u32,
    pub data: [u8; 64usize],
    pub num: ::core::ffi::c_uint,
}
unsafe extern "C" {
    /// RIPEMD160_Init initialises `ctx` and returns one.
    pub fn RIPEMD160_Init(ctx: *mut RIPEMD160_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// RIPEMD160_Update adds `len` bytes from `data` to `ctx` and returns one.
    pub fn RIPEMD160_Update(
        ctx: *mut RIPEMD160_CTX,
        data: *const ::core::ffi::c_void,
        len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// RIPEMD160_Final adds the final padding to `ctx` and writes the resulting
    /// digest to `out`, which must have at least `RIPEMD160_DIGEST_LENGTH` bytes of
    /// space. It returns one.
    pub fn RIPEMD160_Final(out: *mut u8, ctx: *mut RIPEMD160_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// RIPEMD160 writes the digest of `len` bytes from `data` to `out` and returns
    /// `out`. There must be at least `RIPEMD160_DIGEST_LENGTH` bytes of space in
    /// `out`.
    pub fn RIPEMD160(data: *const u8, len: usize, out: *mut u8) -> *mut u8;
}
unsafe extern "C" {
    /// RIPEMD160_Transform is a low-level function that performs a single,
    /// RIPEMD160 block transformation using the state from `ctx` and 64 bytes from
    /// `block`.
    pub fn RIPEMD160_Transform(ctx: *mut RIPEMD160_CTX, block: *const u8);
}
unsafe extern "C" {
    /// SIPHASH_24 implements SipHash-2-4. See https://131002.net/siphash/siphash.pdf
    pub fn SIPHASH_24(key: *const u64, input: *const u8, input_len: usize) -> u64;
}
unsafe extern "C" {
    /// SLHDSA_SHA2_128S_generate_key generates a SLH-DSA-SHA2-128s key pair and
    /// writes the result to `out_public_key` and `out_private_key`.
    pub fn SLHDSA_SHA2_128S_generate_key(out_public_key: *mut u8, out_private_key: *mut u8);
}
unsafe extern "C" {
    /// SLHDSA_SHAKE_256F_generate_key generates a SLH-DSA-SHAKE-256f key pair and
    /// writes the result to `out_public_key` and `out_private_key`.
    pub fn SLHDSA_SHAKE_256F_generate_key(out_public_key: *mut u8, out_private_key: *mut u8);
}
unsafe extern "C" {
    /// SLHDSA_SHA2_128S_public_from_private writes the public key corresponding to
    /// `private_key` to `out_public_key`.
    pub fn SLHDSA_SHA2_128S_public_from_private(out_public_key: *mut u8, private_key: *const u8);
}
unsafe extern "C" {
    /// SLHDSA_SHAKE_256F_public_from_private writes the public key corresponding to
    /// `private_key` to `out_public_key`.
    pub fn SLHDSA_SHAKE_256F_public_from_private(out_public_key: *mut u8, private_key: *const u8);
}
unsafe extern "C" {
    /// SLHDSA_SHA2_128S_sign slowly generates a SLH-DSA-SHA2-128s signature of `msg`
    /// using `private_key` and writes it to `out_signature`. The `context` argument
    /// is also signed over and can be used to include implicit contextual
    /// information that isn't included in `msg`. The same value of `context` must be
    /// presented to `SLHDSA_SHA2_128S_verify` in order for the generated signature
    /// to be considered valid. `context` and `context_len` may be `NULL` and 0 to
    /// use an empty context (this is common). It returns 1 on success and 0 if
    /// `context_len` is larger than 255.
    pub fn SLHDSA_SHA2_128S_sign(
        out_signature: *mut u8,
        private_key: *const u8,
        msg: *const u8,
        msg_len: usize,
        context: *const u8,
        context_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SLHDSA_SHAKE_256F_sign slowly generates a SLH-DSA-SHAKE-256f signature of
    /// `msg` using `private_key` and writes it to `out_signature`. The `context`
    /// argument is also signed over and can be used to include implicit contextual
    /// information that isn't included in `msg`. The same value of `context` must be
    /// presented to `SLHDSA_SHAKE_256F_verify` in order for the generated signature
    /// to be considered valid. `context` and `context_len` may be `NULL` and 0 to
    /// use an empty context (this is common). It returns 1 on success and 0 if
    /// `context_len` is larger than 255.
    pub fn SLHDSA_SHAKE_256F_sign(
        out_signature: *mut u8,
        private_key: *const u8,
        msg: *const u8,
        msg_len: usize,
        context: *const u8,
        context_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SLHDSA_SHA2_128S_verify verifies that `signature` is a valid
    /// SLH-DSA-SHA2-128s signature of `msg` by `public_key`. The value of `context`
    /// must equal the value that was passed to `SLHDSA_SHA2_128S_sign` when the
    /// signature was generated. It returns 1 if the signature is valid and 0
    /// otherwise.
    pub fn SLHDSA_SHA2_128S_verify(
        signature: *const u8,
        signature_len: usize,
        public_key: *const u8,
        msg: *const u8,
        msg_len: usize,
        context: *const u8,
        context_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SLHDSA_SHAKE_256F_verify verifies that `signature` is a valid
    /// SLH-DSA-SHAKE-256f signature of `msg` by `public_key`. The value of `context`
    /// must equal the value that was passed to `SLHDSA_SHAKE_256F_sign` when the
    /// signature was generated. It returns 1 if the signature is valid and 0
    /// otherwise.
    pub fn SLHDSA_SHAKE_256F_verify(
        signature: *const u8,
        signature_len: usize,
        public_key: *const u8,
        msg: *const u8,
        msg_len: usize,
        context: *const u8,
        context_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SLHDSA_SHA2_128S_prehash_sign slowly generates a SLH-DSA-SHA2-128s signature
    /// of the prehashed `hashed_msg` using `private_key` and writes it to
    /// `out_signature`. The `context` argument is also signed over and can be used
    /// to include implicit contextual information that isn't included in
    /// `hashed_msg`. The same value of `context` must be presented to
    /// `SLHDSA_SHA2_128S_prehash_verify` in order for the generated signature to be
    /// considered valid. `context` and `context_len` may be `NULL` and 0 to use an
    /// empty context (this is common).
    ///
    /// The `hash_nid` argument must specify the hash function that was used to
    /// generate `hashed_msg`. This function only accepts hash functions listed in
    /// FIPS 205.
    ///
    /// This function returns 1 on success and 0 if `context_len` is larger than 255,
    /// if the hash function is not supported, or if `hashed_msg` is the wrong
    /// length.
    pub fn SLHDSA_SHA2_128S_prehash_sign(
        out_signature: *mut u8,
        private_key: *const u8,
        hashed_msg: *const u8,
        hashed_msg_len: usize,
        hash_nid: ::core::ffi::c_int,
        context: *const u8,
        context_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SLHDSA_SHA2_128S_prehash_verify verifies that `signature` is a valid
    /// SLH-DSA-SHA2-128s signature of the prehashed `hashed_msg` by `public_key`,
    /// using the hash algorithm identified by `hash_nid`. The value of `context`
    /// must equal the value that was passed to `SLHDSA_SHA2_128S_prehash_sign` when
    /// the signature was generated.
    ///
    /// The `hash_nid` argument must specify the hash function that was used to
    /// generate `hashed_msg`. This function only accepts hash functions that are
    /// listed in FIPS 205.
    ///
    /// This function returns 1 if the signature is valid and 0 if the signature is
    /// invalid, the hash function is not supported, or if `hashed_msg` is the wrong
    /// length.
    pub fn SLHDSA_SHA2_128S_prehash_verify(
        signature: *const u8,
        signature_len: usize,
        public_key: *const u8,
        hashed_msg: *const u8,
        hashed_msg_len: usize,
        hash_nid: ::core::ffi::c_int,
        context: *const u8,
        context_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SLHDSA_SHA2_128S_prehash_warning_nonstandard_sign slowly generates a
    /// SLH-DSA-SHA2-128s signature of the prehashed `hashed_msg` using `private_key`
    /// and writes it to `out_signature`. The `context` argument is also signed over
    /// and can be used to include implicit contextual information that isn't
    /// included in `hashed_msg`. The same value of `context` must be presented to
    /// `SLHDSA_SHA2_128S_prehash_warning_nonstandard_verify` in order for the
    /// generated signature to be considered valid. `context` and `context_len` may
    /// be `NULL` and 0 to use an empty context (this is common).
    ///
    /// The `hash_nid` argument must specify the hash function that was used to
    /// generate `hashed_msg`. This function only accepts non-standard hash functions
    /// that are not compliant with FIPS 205.
    ///
    /// This function returns 1 on success and 0 if `context_len` is larger than 255,
    /// if the hash function is not supported, or if `hashed_msg` is the wrong
    /// length.
    pub fn SLHDSA_SHA2_128S_prehash_warning_nonstandard_sign(
        out_signature: *mut u8,
        private_key: *const u8,
        hashed_msg: *const u8,
        hashed_msg_len: usize,
        hash_nid: ::core::ffi::c_int,
        context: *const u8,
        context_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SLHDSA_SHA2_128S_prehash_warning_nonstandard_verify verifies that `signature`
    /// is a valid SLH-DSA-SHA2-128s signature of the prehashed `hashed_msg` by
    /// `public_key`, using the hash algorithm identified by `hash_nid`. The value of
    /// `context` must equal the value that was passed to
    /// `SLHDSA_SHA2_128S_prehash_sign` when the signature was generated.
    ///
    /// The `hash_nid` argument must specify the hash function that was used to
    /// generate `hashed_msg`. This function only accepts non-standard hash functions
    /// that are not compliant with FIPS 205.
    ///
    /// This function returns 1 if the signature is valid and 0 if the signature is
    /// invalid, the hash function is not supported, or if `hashed_msg` is the wrong
    /// length.
    pub fn SLHDSA_SHA2_128S_prehash_warning_nonstandard_verify(
        signature: *const u8,
        signature_len: usize,
        public_key: *const u8,
        hashed_msg: *const u8,
        hashed_msg_len: usize,
        hash_nid: ::core::ffi::c_int,
        context: *const u8,
        context_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// TLS_method is the `SSL_METHOD` used for TLS connections.
    pub fn TLS_method() -> *const SSL_METHOD;
}
unsafe extern "C" {
    /// DTLS_method is the `SSL_METHOD` used for DTLS connections.
    pub fn DTLS_method() -> *const SSL_METHOD;
}
unsafe extern "C" {
    /// TLS_with_buffers_method is like `TLS_method`, but avoids all use of
    /// crypto/x509. All client connections created with `TLS_with_buffers_method`
    /// will fail unless a certificate verifier is installed with
    /// `SSL_set_custom_verify` or `SSL_CTX_set_custom_verify`.
    pub fn TLS_with_buffers_method() -> *const SSL_METHOD;
}
unsafe extern "C" {
    /// DTLS_with_buffers_method is like `DTLS_method`, but avoids all use of
    /// crypto/x509.
    pub fn DTLS_with_buffers_method() -> *const SSL_METHOD;
}
unsafe extern "C" {
    /// SSL_CTX_new returns a newly-allocated `SSL_CTX` with default settings or NULL
    /// on error.
    pub fn SSL_CTX_new(method: *const SSL_METHOD) -> *mut SSL_CTX;
}
unsafe extern "C" {
    /// SSL_CTX_up_ref increments the reference count of `ctx`. It returns one.
    pub fn SSL_CTX_up_ref(ctx: *mut SSL_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_free releases memory associated with `ctx`.
    pub fn SSL_CTX_free(ctx: *mut SSL_CTX);
}
unsafe extern "C" {
    /// SSL_new returns a newly-allocated `SSL` using `ctx` or NULL on error. The new
    /// connection inherits settings from `ctx` at the time of creation. Settings may
    /// also be individually configured on the connection.
    ///
    /// On creation, an `SSL` is not configured to be either a client or server. Call
    /// `SSL_set_connect_state` or `SSL_set_accept_state` to set this.
    pub fn SSL_new(ctx: *mut SSL_CTX) -> *mut SSL;
}
unsafe extern "C" {
    /// SSL_free releases memory associated with `ssl`.
    pub fn SSL_free(ssl: *mut SSL);
}
unsafe extern "C" {
    /// SSL_get_SSL_CTX returns the `SSL_CTX` associated with `ssl`. If
    /// `SSL_set_SSL_CTX` is called, it returns the new `SSL_CTX`, not the initial
    /// one.
    pub fn SSL_get_SSL_CTX(ssl: *const SSL) -> *mut SSL_CTX;
}
unsafe extern "C" {
    /// SSL_set_connect_state configures `ssl` to be a client.
    pub fn SSL_set_connect_state(ssl: *mut SSL);
}
unsafe extern "C" {
    /// SSL_set_accept_state configures `ssl` to be a server.
    pub fn SSL_set_accept_state(ssl: *mut SSL);
}
unsafe extern "C" {
    /// SSL_is_server returns one if `ssl` is configured as a server and zero
    /// otherwise.
    pub fn SSL_is_server(ssl: *const SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_is_dtls returns one if `ssl` is a DTLS connection and zero otherwise.
    pub fn SSL_is_dtls(ssl: *const SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_is_quic returns one if `ssl` is a QUIC connection and zero otherwise.
    pub fn SSL_is_quic(ssl: *const SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set_bio configures `ssl` to read from `rbio` and write to `wbio`. `ssl`
    /// takes ownership of the two `BIO`s. If `rbio` and `wbio` are the same, `ssl`
    /// only takes ownership of one reference. See `SSL_set0_rbio` and
    /// `SSL_set0_wbio` for requirements on `rbio` and `wbio`, respectively.
    ///
    /// If `rbio` is the same as the currently configured `BIO` for reading, that
    /// side is left untouched and is not freed.
    ///
    /// If `wbio` is the same as the currently configured `BIO` for writing AND `ssl`
    /// is not currently configured to read from and write to the same `BIO`, that
    /// side is left untouched and is not freed. This asymmetry is present for
    /// historical reasons.
    ///
    /// Due to the very complex historical behavior of this function, calling this
    /// function if `ssl` already has `BIO`s configured is deprecated. Prefer
    /// `SSL_set0_rbio` and `SSL_set0_wbio` instead.
    pub fn SSL_set_bio(ssl: *mut SSL, rbio: *mut BIO, wbio: *mut BIO);
}
unsafe extern "C" {
    /// SSL_set0_rbio configures `ssl` to read from `rbio`. It takes ownership of
    /// `rbio`. `rbio` may be a custom `BIO`, in which case it must implement
    /// `BIO_read` with `BIO_meth_set_read`. In DTLS, `rbio` must be non-blocking to
    /// properly handle timeouts and retransmits.
    ///
    /// Note that, although this function and `SSL_set0_wbio` may be called on the
    /// same `BIO`, each call takes a reference. Use `BIO_up_ref` to balance this.
    pub fn SSL_set0_rbio(ssl: *mut SSL, rbio: *mut BIO);
}
unsafe extern "C" {
    /// SSL_set0_wbio configures `ssl` to write to `wbio`. It takes ownership of
    /// `wbio`. `wbio` may be a custom `BIO`, in which case it must implement
    /// `BIO_write` with `BIO_meth_set_write`. It must additionally implement
    /// `BIO_flush` with `BIO_meth_set_ctrl` and `BIO_CTRL_FLUSH`. If flushing is
    /// unnecessary with `wbio`, `BIO_flush` should return one and do nothing.
    ///
    /// Note that, although this function and `SSL_set0_rbio` may be called on the
    /// same `BIO`, each call takes a reference. Use `BIO_up_ref` to balance this.
    pub fn SSL_set0_wbio(ssl: *mut SSL, wbio: *mut BIO);
}
unsafe extern "C" {
    /// SSL_get_rbio returns the `BIO` that `ssl` reads from.
    pub fn SSL_get_rbio(ssl: *const SSL) -> *mut BIO;
}
unsafe extern "C" {
    /// SSL_get_wbio returns the `BIO` that `ssl` writes to.
    pub fn SSL_get_wbio(ssl: *const SSL) -> *mut BIO;
}
unsafe extern "C" {
    /// SSL_get_fd calls `SSL_get_rfd`.
    pub fn SSL_get_fd(ssl: *const SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_get_rfd returns the file descriptor that `ssl` is configured to read
    /// from. If `ssl`'s read `BIO` is not configured or doesn't wrap a file
    /// descriptor then it returns -1.
    ///
    /// Note: On Windows, this may return either a file descriptor or a socket (cast
    /// to int), depending on whether `ssl` was configured with a file descriptor or
    /// socket `BIO`.
    pub fn SSL_get_rfd(ssl: *const SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_get_wfd returns the file descriptor that `ssl` is configured to write
    /// to. If `ssl`'s write `BIO` is not configured or doesn't wrap a file
    /// descriptor then it returns -1.
    ///
    /// Note: On Windows, this may return either a file descriptor or a socket (cast
    /// to int), depending on whether `ssl` was configured with a file descriptor or
    /// socket `BIO`.
    pub fn SSL_get_wfd(ssl: *const SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set_fd configures `ssl` to read from and write to `fd`. It returns one
    /// on success and zero on allocation error. The caller retains ownership of
    /// `fd`.
    ///
    /// On Windows, `fd` is cast to a `SOCKET` and used with Winsock APIs.
    pub fn SSL_set_fd(ssl: *mut SSL, fd: ::core::ffi::c_int) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set_rfd configures `ssl` to read from `fd`. It returns one on success and
    /// zero on allocation error. The caller retains ownership of `fd`.
    ///
    /// On Windows, `fd` is cast to a `SOCKET` and used with Winsock APIs.
    pub fn SSL_set_rfd(ssl: *mut SSL, fd: ::core::ffi::c_int) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set_wfd configures `ssl` to write to `fd`. It returns one on success and
    /// zero on allocation error. The caller retains ownership of `fd`.
    ///
    /// On Windows, `fd` is cast to a `SOCKET` and used with Winsock APIs.
    pub fn SSL_set_wfd(ssl: *mut SSL, fd: ::core::ffi::c_int) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_do_handshake continues the current handshake. If there is none or the
    /// handshake has completed or False Started, it returns one. Otherwise, it
    /// returns <= 0. The caller should pass the value into `SSL_get_error` to
    /// determine how to proceed.
    ///
    /// In DTLS, the caller must drive retransmissions and timeouts. After calling
    /// this function, the caller must use `DTLSv1_get_timeout` to determine the
    /// current timeout, if any. If it expires before the application next calls into
    /// `ssl`, call `DTLSv1_handle_timeout`. Note that DTLS handshake retransmissions
    /// use fresh sequence numbers, so it is not sufficient to replay packets at the
    /// transport.
    ///
    /// After the DTLS handshake, some retransmissions may remain. If `ssl` wrote
    /// last in the handshake, it may need to retransmit the final flight in case of
    /// packet loss. Additionally, in DTLS 1.3, it may need to retransmit
    /// post-handshake messages. To handle these, the caller must always be prepared
    /// to receive packets and process them with `SSL_read`, even when the
    /// application protocol would otherwise not read from the connection.
    ///
    /// TODO(davidben): Ensure 0 is only returned on transport EOF.
    /// https://crbug.com/466303.
    pub fn SSL_do_handshake(ssl: *mut SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_connect configures `ssl` as a client, if unconfigured, and calls
    /// `SSL_do_handshake`.
    pub fn SSL_connect(ssl: *mut SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_accept configures `ssl` as a server, if unconfigured, and calls
    /// `SSL_do_handshake`.
    pub fn SSL_accept(ssl: *mut SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_read reads up to `num` bytes from `ssl` into `buf`. It implicitly runs
    /// any pending handshakes, including renegotiations when enabled. On success, it
    /// returns the number of bytes read. Otherwise, it returns <= 0. The caller
    /// should pass the value into `SSL_get_error` to determine how to proceed.
    ///
    /// In DTLS 1.3, the caller must also drive timeouts from retransmitting the
    /// final flight of the handshake, as well as post-handshake messages. After
    /// calling this function, the caller must use `DTLSv1_get_timeout` to determine
    /// the current timeout, if any. If it expires before the application next calls
    /// into `ssl`, call `DTLSv1_handle_timeout`.
    ///
    /// TODO(davidben): Ensure 0 is only returned on transport EOF.
    /// https://crbug.com/466303.
    pub fn SSL_read(
        ssl: *mut SSL,
        buf: *mut ::core::ffi::c_void,
        num: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_peek behaves like `SSL_read` but does not consume any bytes returned.
    pub fn SSL_peek(
        ssl: *mut SSL,
        buf: *mut ::core::ffi::c_void,
        num: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_pending returns the number of buffered, decrypted bytes available for
    /// read in `ssl`. It does not read from the transport.
    ///
    /// In DTLS, it is possible for this function to return zero while there is
    /// buffered, undecrypted data from the transport in `ssl`. For example,
    /// `SSL_read` may read a datagram with two records, decrypt the first, and leave
    /// the second buffered for a subsequent call to `SSL_read`. Callers that wish to
    /// detect this case can use `SSL_has_pending`.
    pub fn SSL_pending(ssl: *const SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_has_pending returns one if `ssl` has buffered, decrypted bytes available
    /// for read, or if `ssl` has buffered data from the transport that has not yet
    /// been decrypted. If `ssl` has neither, this function returns zero.
    ///
    /// In TLS, BoringSSL does not implement read-ahead, so this function returns one
    /// if and only if `SSL_pending` would return a non-zero value. In DTLS, it is
    /// possible for this function to return one while `SSL_pending` returns zero.
    /// For example, `SSL_read` may read a datagram with two records, decrypt the
    /// first, and leave the second buffered for a subsequent call to `SSL_read`.
    ///
    /// As a result, if this function returns one, the next call to `SSL_read` may
    /// still fail, read from the transport, or both. The buffered, undecrypted data
    /// may be invalid or incomplete.
    pub fn SSL_has_pending(ssl: *const SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_write writes up to `num` bytes from `buf` into `ssl`. It implicitly runs
    /// any pending handshakes, including renegotiations when enabled. On success, it
    /// returns the number of bytes written. Otherwise, it returns <= 0. The caller
    /// should pass the value into `SSL_get_error` to determine how to proceed.
    ///
    /// In TLS, a non-blocking `SSL_write` differs from non-blocking `write` in that
    /// a failed `SSL_write` still commits to the data passed in. When retrying, the
    /// caller must supply the original write buffer (or a larger one containing the
    /// original as a prefix). By default, retries will fail if they also do not
    /// reuse the same `buf` pointer. This may be relaxed with
    /// `SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER`, but the buffer contents still must be
    /// unchanged.
    ///
    /// By default, in TLS, `SSL_write` will not return success until all `num` bytes
    /// are written. This may be relaxed with `SSL_MODE_ENABLE_PARTIAL_WRITE`. It
    /// allows `SSL_write` to complete with a partial result when only part of the
    /// input was written in a single record.
    ///
    /// In DTLS, neither `SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER` and
    /// `SSL_MODE_ENABLE_PARTIAL_WRITE` do anything. The caller may retry with a
    /// different buffer freely. A single call to `SSL_write` only ever writes a
    /// single record in a single packet, so `num` must be at most
    /// `SSL3_RT_MAX_PLAIN_LENGTH`.
    ///
    /// TODO(davidben): Ensure 0 is only returned on transport EOF.
    /// https://crbug.com/466303.
    pub fn SSL_write(
        ssl: *mut SSL,
        buf: *const ::core::ffi::c_void,
        num: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_key_update queues a TLS 1.3 KeyUpdate message to be sent on `ssl`
    /// if one is not already queued. The `request_type` argument must one of the
    /// `SSL_KEY_UPDATE_*` values. This function requires that `ssl` have completed a
    /// TLS >= 1.3 handshake. It returns one on success or zero on error.
    ///
    /// Note that this function does not _send_ the message itself. The next call to
    /// `SSL_write` will cause the message to be sent. `SSL_write` may be called with
    /// a zero length to flush a KeyUpdate message when no application data is
    /// pending.
    pub fn SSL_key_update(ssl: *mut SSL, request_type: ::core::ffi::c_int) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_shutdown shuts down `ssl`. It runs in two stages. First, it sends
    /// close_notify and returns zero or one on success or -1 on failure. Zero
    /// indicates that close_notify was sent, but not received, and one additionally
    /// indicates that the peer's close_notify had already been received.
    ///
    /// To then wait for the peer's close_notify, run `SSL_shutdown` to completion a
    /// second time. This returns 1 on success and -1 on failure. Application data
    /// is considered a fatal error at this point. To process or discard it, read
    /// until close_notify with `SSL_read` instead.
    ///
    /// In both cases, on failure, pass the return value into `SSL_get_error` to
    /// determine how to proceed.
    ///
    /// Most callers should stop at the first stage. Reading for close_notify is
    /// primarily used for uncommon protocols where the underlying transport is
    /// reused after TLS completes. Additionally, DTLS uses an unordered transport
    /// and is unordered, so the second stage is a no-op in DTLS.
    pub fn SSL_shutdown(ssl: *mut SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_set_quiet_shutdown sets quiet shutdown on `ctx` to `mode`. If
    /// enabled, `SSL_shutdown` will not send a close_notify alert or wait for one
    /// from the peer. It will instead synchronously return one.
    pub fn SSL_CTX_set_quiet_shutdown(ctx: *mut SSL_CTX, mode: ::core::ffi::c_int);
}
unsafe extern "C" {
    /// SSL_CTX_get_quiet_shutdown returns whether quiet shutdown is enabled for
    /// `ctx`.
    pub fn SSL_CTX_get_quiet_shutdown(ctx: *const SSL_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set_quiet_shutdown sets quiet shutdown on `ssl` to `mode`. If enabled,
    /// `SSL_shutdown` will not send a close_notify alert or wait for one from the
    /// peer. It will instead synchronously return one.
    pub fn SSL_set_quiet_shutdown(ssl: *mut SSL, mode: ::core::ffi::c_int);
}
unsafe extern "C" {
    /// SSL_get_quiet_shutdown returns whether quiet shutdown is enabled for
    /// `ssl`.
    pub fn SSL_get_quiet_shutdown(ssl: *const SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_get_error returns a `SSL_ERROR_*` value for the most recent operation on
    /// `ssl`. It should be called after an operation failed to determine whether the
    /// error was fatal and, if not, when to retry.
    pub fn SSL_get_error(ssl: *const SSL, ret_code: ::core::ffi::c_int) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_error_description returns a string representation of `err`, where `err`
    /// is one of the `SSL_ERROR_*` constants returned by `SSL_get_error`, or NULL
    /// if the value is unrecognized.
    pub fn SSL_error_description(err: ::core::ffi::c_int) -> *const ::core::ffi::c_char;
}
unsafe extern "C" {
    /// SSL_set_mtu sets the `ssl`'s MTU in DTLS to `mtu`. It returns one on success
    /// and zero on failure.
    pub fn SSL_set_mtu(ssl: *mut SSL, mtu: ::core::ffi::c_uint) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// DTLSv1_set_initial_timeout_duration sets the initial duration for a DTLS
    /// handshake timeout.
    ///
    /// This duration overrides the default of 400 milliseconds, which is
    /// recommendation of RFC 9147 for real-time protocols.
    ///
    /// If `ssl` is an open connection, this function may update currently running
    /// timers and may make them expire. Callers should call
    /// `DTLSv1_get_timeout` for an updated timeout and reschedule accordingly.
    pub fn DTLSv1_set_initial_timeout_duration(ssl: *mut SSL, duration_ms: u32);
}
unsafe extern "C" {
    /// DTLSv1_get_timeout queries the running DTLS timers. If there are any in
    /// progress, it sets `*out` to the time remaining until the first timer expires
    /// and returns one. Otherwise, it returns zero. Timers may be scheduled both
    /// during and after the handshake.
    ///
    /// When the timeout expires, call `DTLSv1_handle_timeout` to handle the
    /// retransmit behavior.
    ///
    /// NOTE: This function must be queried again whenever the state machine changes,
    /// including when `DTLSv1_handle_timeout` is called.
    pub fn DTLSv1_get_timeout(ssl: *const SSL, out: *mut timeval) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// DTLSv1_handle_timeout is called when a DTLS timeout expires. If no timeout
    /// had expired, it returns 0. Otherwise, it handles the timeout and returns 1 on
    /// success or -1 on error.
    ///
    /// This function may write to the transport (e.g. to retransmit messages) or
    /// update `ssl`'s internal state and schedule an updated timer.
    ///
    /// The caller's external timer should be compatible with the one `ssl` queries
    /// within some fudge factor. Otherwise, the call will be a no-op, but
    /// `DTLSv1_get_timeout` will return an updated timeout.
    ///
    /// If the function returns -1, checking if `SSL_get_error` returns
    /// `SSL_ERROR_WANT_WRITE` may be used to determine if the retransmit failed due
    /// to a non-fatal error at the write `BIO`. In this case, when the `BIO` is
    /// writable, the operation may be retried by calling the original function,
    /// `SSL_do_handshake` or `SSL_read`.
    ///
    /// WARNING: This function breaks the usual return value convention.
    ///
    /// TODO(davidben): We can make this function entirely optional by just checking
    /// the timers in `SSL_do_handshake` or `SSL_read`. Then timers behave like any
    /// other retry condition: rerun the operation and the library will make what
    /// progress it can.
    pub fn DTLSv1_handle_timeout(ssl: *mut SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_set_min_proto_version sets the minimum protocol version for `ctx` to
    /// `version`. If `version` is zero, the default minimum version is used. It
    /// returns one on success and zero if `version` is invalid.
    pub fn SSL_CTX_set_min_proto_version(ctx: *mut SSL_CTX, version: u16) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_set_max_proto_version sets the maximum protocol version for `ctx` to
    /// `version`. If `version` is zero, the default maximum version is used. It
    /// returns one on success and zero if `version` is invalid.
    pub fn SSL_CTX_set_max_proto_version(ctx: *mut SSL_CTX, version: u16) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_get_min_proto_version returns the minimum protocol version for `ctx`
    pub fn SSL_CTX_get_min_proto_version(ctx: *const SSL_CTX) -> u16;
}
unsafe extern "C" {
    /// SSL_CTX_get_max_proto_version returns the maximum protocol version for `ctx`
    pub fn SSL_CTX_get_max_proto_version(ctx: *const SSL_CTX) -> u16;
}
unsafe extern "C" {
    /// SSL_set_min_proto_version sets the minimum protocol version for `ssl` to
    /// `version`. If `version` is zero, the default minimum version is used. It
    /// returns one on success and zero if `version` is invalid.
    pub fn SSL_set_min_proto_version(ssl: *mut SSL, version: u16) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set_max_proto_version sets the maximum protocol version for `ssl` to
    /// `version`. If `version` is zero, the default maximum version is used. It
    /// returns one on success and zero if `version` is invalid.
    pub fn SSL_set_max_proto_version(ssl: *mut SSL, version: u16) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_get_min_proto_version returns the minimum protocol version for `ssl`. If
    /// the connection's configuration has been shed, 0 is returned.
    pub fn SSL_get_min_proto_version(ssl: *const SSL) -> u16;
}
unsafe extern "C" {
    /// SSL_get_max_proto_version returns the maximum protocol version for `ssl`. If
    /// the connection's configuration has been shed, 0 is returned.
    pub fn SSL_get_max_proto_version(ssl: *const SSL) -> u16;
}
unsafe extern "C" {
    /// SSL_version returns the TLS or DTLS protocol version used by `ssl`, which is
    /// one of the `*_VERSION` values. (E.g. `TLS1_2_VERSION`.) Before the version
    /// is negotiated, the result is undefined.
    pub fn SSL_version(ssl: *const SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_set_options enables all options set in `options` (which should be one
    /// or more of the `SSL_OP_*` values, ORed together) in `ctx`. It returns a
    /// bitmask representing the resulting enabled options.
    pub fn SSL_CTX_set_options(ctx: *mut SSL_CTX, options: u32) -> u32;
}
unsafe extern "C" {
    /// SSL_CTX_clear_options disables all options set in `options` (which should be
    /// one or more of the `SSL_OP_*` values, ORed together) in `ctx`. It returns a
    /// bitmask representing the resulting enabled options.
    pub fn SSL_CTX_clear_options(ctx: *mut SSL_CTX, options: u32) -> u32;
}
unsafe extern "C" {
    /// SSL_CTX_get_options returns a bitmask of `SSL_OP_*` values that represent all
    /// the options enabled for `ctx`.
    pub fn SSL_CTX_get_options(ctx: *const SSL_CTX) -> u32;
}
unsafe extern "C" {
    /// SSL_set_options enables all options set in `options` (which should be one or
    /// more of the `SSL_OP_*` values, ORed together) in `ssl`. It returns a bitmask
    /// representing the resulting enabled options.
    pub fn SSL_set_options(ssl: *mut SSL, options: u32) -> u32;
}
unsafe extern "C" {
    /// SSL_clear_options disables all options set in `options` (which should be one
    /// or more of the `SSL_OP_*` values, ORed together) in `ssl`. It returns a
    /// bitmask representing the resulting enabled options.
    pub fn SSL_clear_options(ssl: *mut SSL, options: u32) -> u32;
}
unsafe extern "C" {
    /// SSL_get_options returns a bitmask of `SSL_OP_*` values that represent all the
    /// options enabled for `ssl`.
    pub fn SSL_get_options(ssl: *const SSL) -> u32;
}
unsafe extern "C" {
    /// SSL_CTX_set_mode enables all modes set in `mode` (which should be one or more
    /// of the `SSL_MODE_*` values, ORed together) in `ctx`. It returns a bitmask
    /// representing the resulting enabled modes.
    pub fn SSL_CTX_set_mode(ctx: *mut SSL_CTX, mode: u32) -> u32;
}
unsafe extern "C" {
    /// SSL_CTX_clear_mode disables all modes set in `mode` (which should be one or
    /// more of the `SSL_MODE_*` values, ORed together) in `ctx`. It returns a
    /// bitmask representing the resulting enabled modes.
    pub fn SSL_CTX_clear_mode(ctx: *mut SSL_CTX, mode: u32) -> u32;
}
unsafe extern "C" {
    /// SSL_CTX_get_mode returns a bitmask of `SSL_MODE_*` values that represent all
    /// the modes enabled for `ssl`.
    pub fn SSL_CTX_get_mode(ctx: *const SSL_CTX) -> u32;
}
unsafe extern "C" {
    /// SSL_set_mode enables all modes set in `mode` (which should be one or more of
    /// the `SSL_MODE_*` values, ORed together) in `ssl`. It returns a bitmask
    /// representing the resulting enabled modes.
    pub fn SSL_set_mode(ssl: *mut SSL, mode: u32) -> u32;
}
unsafe extern "C" {
    /// SSL_clear_mode disables all modes set in `mode` (which should be one or more
    /// of the `SSL_MODE_*` values, ORed together) in `ssl`. It returns a bitmask
    /// representing the resulting enabled modes.
    pub fn SSL_clear_mode(ssl: *mut SSL, mode: u32) -> u32;
}
unsafe extern "C" {
    /// SSL_get_mode returns a bitmask of `SSL_MODE_*` values that represent all the
    /// modes enabled for `ssl`.
    pub fn SSL_get_mode(ssl: *const SSL) -> u32;
}
unsafe extern "C" {
    /// SSL_CTX_set1_buffer_pool sets a `CRYPTO_BUFFER_POOL` that will be used to
    /// store certificates. This can allow multiple connections to share
    /// certificates and thus save memory.
    pub fn SSL_CTX_set1_buffer_pool(ctx: *mut SSL_CTX, pool: *mut CRYPTO_BUFFER_POOL);
}
unsafe extern "C" {
    /// SSL_CREDENTIAL_new_x509 returns a new, empty X.509 credential, or NULL on
    /// error. Callers should release the result with `SSL_CREDENTIAL_free` when
    /// done.
    ///
    /// Callers should configure a certificate chain and private key on the
    /// credential, along with other properties, then add it with
    /// `SSL_CTX_add1_credential`.
    pub fn SSL_CREDENTIAL_new_x509() -> *mut SSL_CREDENTIAL;
}
unsafe extern "C" {
    /// SSL_CREDENTIAL_up_ref increments the reference count of `cred`.
    pub fn SSL_CREDENTIAL_up_ref(cred: *mut SSL_CREDENTIAL);
}
unsafe extern "C" {
    /// SSL_CREDENTIAL_dup_ref increments the reference count of `cred` and returns
    /// `cred`. The caller must call `SSL_CREDENTIAL_free` on the result to release
    /// the reference.
    ///
    /// WARNING: Although the result is non-const for use with `SSL_CREDENTIAL_free`,
    /// it is still shared with other parts of the application that share the same
    /// object. Avoid mutating shared `SSL_CREDENTIAL`s.
    pub fn SSL_CREDENTIAL_dup_ref(cred: *const SSL_CREDENTIAL) -> *mut SSL_CREDENTIAL;
}
unsafe extern "C" {
    /// SSL_CREDENTIAL_free decrements the reference count of `cred`. If it reaches
    /// zero, all data referenced by `cred` and `cred` itself are released.
    pub fn SSL_CREDENTIAL_free(cred: *mut SSL_CREDENTIAL);
}
unsafe extern "C" {
    /// SSL_CREDENTIAL_is_complete returns one if the returns one if `cred` has all
    /// required properties configured, and zero otherwise.
    ///
    /// This includes checks on whether the public key is present in a X.509
    /// credential and whether a private key or private key method has been set up
    /// for such.
    pub fn SSL_CREDENTIAL_is_complete(cred: *const SSL_CREDENTIAL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CREDENTIAL_set1_private_key sets `cred`'s private key to `cred`. It
    /// returns one on success and zero on failure.
    pub fn SSL_CREDENTIAL_set1_private_key(
        cred: *mut SSL_CREDENTIAL,
        key: *mut EVP_PKEY,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CREDENTIAL_set1_signing_algorithm_prefs configures `cred` to use `prefs`
    /// as the preference list when signing with `cred`'s private key. It returns one
    /// on success and zero on error. `prefs` should not include the internal-only
    /// value `SSL_SIGN_RSA_PKCS1_MD5_SHA1`.
    ///
    /// It is an error to call this function with delegated credentials (see
    /// `SSL_CREDENTIAL_new_delegated`) because delegated credentials already
    /// constrain the key to a single algorithm.
    pub fn SSL_CREDENTIAL_set1_signing_algorithm_prefs(
        cred: *mut SSL_CREDENTIAL,
        prefs: *const u16,
        num_prefs: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CREDENTIAL_set1_cert_chain sets `cred`'s certificate chain, starting from
    /// the leaf, to `num_cert`s certificates from `certs`. It returns one on success
    /// and zero on error.
    pub fn SSL_CREDENTIAL_set1_cert_chain(
        cred: *mut SSL_CREDENTIAL,
        certs: *const *mut CRYPTO_BUFFER,
        num_certs: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CREDENTIAL_set1_ocsp_response sets `cred`'s stapled OCSP response to
    /// `ocsp`. It returns one on success and zero on error.
    pub fn SSL_CREDENTIAL_set1_ocsp_response(
        cred: *mut SSL_CREDENTIAL,
        ocsp: *mut CRYPTO_BUFFER,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CREDENTIAL_set1_certificate_properties parses
    /// `certificate_property_list` as a CertificatePropertyList (see Section 6 of
    /// draft-ietf-tls-trust-anchor-ids-00) and applies recognized properties to
    /// `cred`. It returns one on success and zero on error. It is an error if
    /// `certificate_property_list` does not parse correctly, or if any recognized
    /// properties from `certificate_property_list` cannot be applied to `cred`.
    ///
    /// CertificatePropertyList is an extensible structure which allows serving
    /// properties of a certificate chain to be passed from a CA, through an
    /// application's issuance and configuration pipeline, and to the TLS serving
    /// logic, without requiring application changes for each property defined.
    ///
    /// BoringSSL currently supports the following properties:
    /// * trust_anchor_identifier (see `SSL_CREDENTIAL_set1_trust_anchor_id`)
    ///
    /// Note this function does not automatically enable issuer matching. Callers
    /// must separately call `SSL_CREDENTIAL_set_must_match_issuer` if desired.
    pub fn SSL_CREDENTIAL_set1_certificate_properties(
        cred: *mut SSL_CREDENTIAL,
        cert_property_list: *mut CRYPTO_BUFFER,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CREDENTIAL_set1_signed_cert_timestamp_list sets `cred`'s list of signed
    /// certificate timestamps `sct_list`. `sct_list` must contain one or more SCT
    /// structures serialised as a SignedCertificateTimestampList (see
    /// https://tools.ietf.org/html/rfc6962#section-3.3) – i.e. each SCT is prefixed
    /// by a big-endian, uint16 length and the concatenation of one or more such
    /// prefixed SCTs are themselves also prefixed by a uint16 length. It returns one
    /// on success and zero on error.
    pub fn SSL_CREDENTIAL_set1_signed_cert_timestamp_list(
        cred: *mut SSL_CREDENTIAL,
        sct_list: *mut CRYPTO_BUFFER,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CREDENTIAL_set_must_match_issuer configures whether `cred` should check
    /// if the peer supports the certificate chain's issuer.
    ///
    /// If `match` is non-zero, `cred` will only be applicable when the certificate
    /// chain is issued by some CA requested by the peer in the
    /// certificate_authorities extension or, if `cred` has a trust anchor ID (see
    /// `SSL_CREDENTIAL_set1_trust_anchor_id`), the trust_anchors extension. `cred`'s
    /// certificate chain must then be a correctly ordered certification path.
    ///
    /// If `match` is zero (default), `cred` will not be conditioned on the peer's
    /// requested CAs. This can be used for certificate chains that are assumed to be
    /// usable by most peers.
    ///
    /// This setting can be used for certificate chains that may not be usable by all
    /// peers, e.g. chains with fewer cross-signs or issued from a newer CA. The
    /// credential list is tried in order, so more specific credentials that enable
    /// issuer matching should generally be ordered before less specific credentials
    /// that do not.
    pub fn SSL_CREDENTIAL_set_must_match_issuer(
        cred: *mut SSL_CREDENTIAL,
        match_: ::core::ffi::c_int,
    );
}
unsafe extern "C" {
    /// SSL_CTX_add1_credential appends `cred` to `ctx`'s credential list. It returns
    /// one on success and zero on error. The credential list is maintained in order
    /// of decreasing preference, so earlier calls are preferred over later calls.
    ///
    /// After calling this function, it is an error to modify `cred`. Doing so may
    /// result in inconsistent handshake behavior or race conditions.
    pub fn SSL_CTX_add1_credential(
        ctx: *mut SSL_CTX,
        cred: *const SSL_CREDENTIAL,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_add1_credential appends `cred` to `ssl`'s credential list. It returns one
    /// on success and zero on error. The credential list is maintained in order of
    /// decreasing preference, so earlier calls are preferred over later calls.
    ///
    /// After calling this function, it is an error to modify `cred`. Doing so may
    /// result in inconsistent handshake behavior or race conditions.
    pub fn SSL_add1_credential(ssl: *mut SSL, cred: *const SSL_CREDENTIAL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_certs_clear removes all credentials configured on `ssl`. It also removes
    /// the certificate chain and private key on the legacy credential.
    pub fn SSL_certs_clear(ssl: *mut SSL);
}
unsafe extern "C" {
    /// SSL_get0_selected_credential returns the credential in use in the current
    /// handshake on `ssl`. If there is current handshake on `ssl` or if the
    /// handshake has not progressed to this point, it returns NULL.
    ///
    /// This function is intended for use with `SSL_CREDENTIAL_get_ex_data`. It may
    /// be called from handshake callbacks, such as those in
    /// `SSL_PRIVATE_KEY_METHOD`, to trigger credential-specific behavior.
    ///
    /// In applications that use the older APIs, such as `SSL_use_certificate`, this
    /// function may return an internal `SSL_CREDENTIAL` object. This internal object
    /// will have no ex_data installed. To avoid this, it is recommended that callers
    /// moving to `SSL_CREDENTIAL` use the new APIs consistently.
    pub fn SSL_get0_selected_credential(ssl: *const SSL) -> *const SSL_CREDENTIAL;
}
unsafe extern "C" {
    /// SSL_CTX_use_certificate sets `ctx`'s leaf certificate to `x509`. It returns
    /// one on success and zero on failure. If `ctx` has a private key which is
    /// inconsistent with `x509`, the private key is silently dropped.
    pub fn SSL_CTX_use_certificate(ctx: *mut SSL_CTX, x509: *mut X509) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_use_certificate sets `ssl`'s leaf certificate to `x509`. It returns one
    /// on success and zero on failure. If `ssl` has a private key which is
    /// inconsistent with `x509`, the private key is silently dropped.
    pub fn SSL_use_certificate(ssl: *mut SSL, x509: *mut X509) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_use_PrivateKey sets `ctx`'s private key to `pkey`. It returns one on
    /// success and zero on failure. If `ctx` had a private key or
    /// `SSL_PRIVATE_KEY_METHOD` previously configured, it is replaced.
    pub fn SSL_CTX_use_PrivateKey(ctx: *mut SSL_CTX, pkey: *mut EVP_PKEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_use_PrivateKey sets `ssl`'s private key to `pkey`. It returns one on
    /// success and zero on failure. If `ssl` had a private key or
    /// `SSL_PRIVATE_KEY_METHOD` previously configured, it is replaced.
    pub fn SSL_use_PrivateKey(ssl: *mut SSL, pkey: *mut EVP_PKEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_set0_chain sets `ctx`'s certificate chain, excluding the leaf, to
    /// `chain`. On success, it returns one and takes ownership of `chain`.
    /// Otherwise, it returns zero.
    pub fn SSL_CTX_set0_chain(ctx: *mut SSL_CTX, chain: *mut stack_st_X509) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_set1_chain sets `ctx`'s certificate chain, excluding the leaf, to
    /// `chain`. It returns one on success and zero on failure. The caller retains
    /// ownership of `chain` and may release it freely.
    pub fn SSL_CTX_set1_chain(ctx: *mut SSL_CTX, chain: *mut stack_st_X509) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set0_chain sets `ssl`'s certificate chain, excluding the leaf, to
    /// `chain`. On success, it returns one and takes ownership of `chain`.
    /// Otherwise, it returns zero.
    pub fn SSL_set0_chain(ssl: *mut SSL, chain: *mut stack_st_X509) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set1_chain sets `ssl`'s certificate chain, excluding the leaf, to
    /// `chain`. It returns one on success and zero on failure. The caller retains
    /// ownership of `chain` and may release it freely.
    pub fn SSL_set1_chain(ssl: *mut SSL, chain: *mut stack_st_X509) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_add0_chain_cert appends `x509` to `ctx`'s certificate chain. On
    /// success, it returns one and takes ownership of `x509`. Otherwise, it returns
    /// zero.
    pub fn SSL_CTX_add0_chain_cert(ctx: *mut SSL_CTX, x509: *mut X509) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_add1_chain_cert appends `x509` to `ctx`'s certificate chain. It
    /// returns one on success and zero on failure. The caller retains ownership of
    /// `x509` and may release it freely.
    pub fn SSL_CTX_add1_chain_cert(ctx: *mut SSL_CTX, x509: *mut X509) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_add0_chain_cert appends `x509` to `ctx`'s certificate chain. On success,
    /// it returns one and takes ownership of `x509`. Otherwise, it returns zero.
    pub fn SSL_add0_chain_cert(ssl: *mut SSL, x509: *mut X509) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_add_extra_chain_cert calls `SSL_CTX_add0_chain_cert`.
    pub fn SSL_CTX_add_extra_chain_cert(ctx: *mut SSL_CTX, x509: *mut X509) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_add1_chain_cert appends `x509` to `ctx`'s certificate chain. It returns
    /// one on success and zero on failure. The caller retains ownership of `x509`
    /// and may release it freely.
    pub fn SSL_add1_chain_cert(ssl: *mut SSL, x509: *mut X509) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_clear_chain_certs clears `ctx`'s certificate chain and returns
    /// one.
    pub fn SSL_CTX_clear_chain_certs(ctx: *mut SSL_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_clear_extra_chain_certs calls `SSL_CTX_clear_chain_certs`.
    pub fn SSL_CTX_clear_extra_chain_certs(ctx: *mut SSL_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_clear_chain_certs clears `ssl`'s certificate chain and returns one.
    pub fn SSL_clear_chain_certs(ssl: *mut SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_set_cert_cb sets a callback that is called to select a certificate.
    /// The callback returns one on success, zero on internal error, and a negative
    /// number on failure or to pause the handshake. If the handshake is paused,
    /// `SSL_get_error` will return `SSL_ERROR_WANT_X509_LOOKUP`.
    ///
    /// On the client, the callback may call `SSL_get0_certificate_types` and
    /// `SSL_get_client_CA_list` for information on the server's certificate
    /// request.
    ///
    /// On the server, the callback will be called after extensions have been
    /// processed, but before the resumption decision has been made. This differs
    /// from OpenSSL which handles resumption before selecting the certificate.
    pub fn SSL_CTX_set_cert_cb(
        ctx: *mut SSL_CTX,
        cb: ::core::option::Option<
            unsafe extern "C" fn(
                ssl: *mut SSL,
                arg: *mut ::core::ffi::c_void,
            ) -> ::core::ffi::c_int,
        >,
        arg: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    /// SSL_set_cert_cb sets a callback that is called to select a certificate. The
    /// callback returns one on success, zero on internal error, and a negative
    /// number on failure or to pause the handshake. If the handshake is paused,
    /// `SSL_get_error` will return `SSL_ERROR_WANT_X509_LOOKUP`.
    ///
    /// On the client, the callback may call `SSL_get0_certificate_types` and
    /// `SSL_get_client_CA_list` for information on the server's certificate
    /// request.
    ///
    /// On the server, the callback will be called after extensions have been
    /// processed, but before the resumption decision has been made. This differs
    /// from OpenSSL which handles resumption before selecting the certificate.
    pub fn SSL_set_cert_cb(
        ssl: *mut SSL,
        cb: ::core::option::Option<
            unsafe extern "C" fn(
                ssl: *mut SSL,
                arg: *mut ::core::ffi::c_void,
            ) -> ::core::ffi::c_int,
        >,
        arg: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    /// SSL_get0_certificate_types, for a client, sets `*out_types` to an array
    /// containing the client certificate types requested by a server. It returns the
    /// length of the array. Note this list is always empty in TLS 1.3. The server
    /// will instead send signature algorithms. See
    /// `SSL_get0_peer_verify_algorithms`.
    ///
    /// The behavior of this function is undefined except during the callbacks set by
    /// by `SSL_CTX_set_cert_cb` and `SSL_CTX_set_client_cert_cb` or when the
    /// handshake is paused because of them.
    pub fn SSL_get0_certificate_types(ssl: *const SSL, out_types: *mut *const u8) -> usize;
}
unsafe extern "C" {
    /// SSL_get0_peer_verify_algorithms sets `*out_sigalgs` to an array containing
    /// the signature algorithms the peer is able to verify. It returns the length of
    /// the array. Note these values are only sent starting TLS 1.2 and only
    /// mandatory starting TLS 1.3. If not sent, the empty array is returned. For the
    /// historical client certificate types list, see `SSL_get0_certificate_types`.
    ///
    /// The behavior of this function is undefined except during the callbacks set by
    /// by `SSL_CTX_set_cert_cb` and `SSL_CTX_set_client_cert_cb` or when the
    /// handshake is paused because of them.
    pub fn SSL_get0_peer_verify_algorithms(ssl: *const SSL, out_sigalgs: *mut *const u16) -> usize;
}
unsafe extern "C" {
    /// SSL_get0_peer_delegation_algorithms sets `*out_sigalgs` to an array
    /// containing the signature algorithms the peer is willing to use with delegated
    /// credentials.  It returns the length of the array. If not sent, the empty
    /// array is returned.
    ///
    /// The behavior of this function is undefined except during the callbacks set by
    /// by `SSL_CTX_set_cert_cb` and `SSL_CTX_set_client_cert_cb` or when the
    /// handshake is paused because of them.
    pub fn SSL_get0_peer_delegation_algorithms(
        ssl: *const SSL,
        out_sigalgs: *mut *const u16,
    ) -> usize;
}
unsafe extern "C" {
    /// SSL_CTX_get0_certificate returns `ctx`'s leaf certificate.
    pub fn SSL_CTX_get0_certificate(ctx: *const SSL_CTX) -> *mut X509;
}
unsafe extern "C" {
    /// SSL_get_certificate returns `ssl`'s leaf certificate.
    pub fn SSL_get_certificate(ssl: *const SSL) -> *mut X509;
}
unsafe extern "C" {
    /// SSL_CTX_get0_privatekey returns `ctx`'s private key.
    pub fn SSL_CTX_get0_privatekey(ctx: *const SSL_CTX) -> *mut EVP_PKEY;
}
unsafe extern "C" {
    /// SSL_get_privatekey returns `ssl`'s private key.
    pub fn SSL_get_privatekey(ssl: *const SSL) -> *mut EVP_PKEY;
}
unsafe extern "C" {
    /// SSL_CTX_get0_chain_certs sets `*out_chain` to `ctx`'s certificate chain and
    /// returns one.
    pub fn SSL_CTX_get0_chain_certs(
        ctx: *const SSL_CTX,
        out_chain: *mut *mut stack_st_X509,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_get_extra_chain_certs calls `SSL_CTX_get0_chain_certs`.
    pub fn SSL_CTX_get_extra_chain_certs(
        ctx: *const SSL_CTX,
        out_chain: *mut *mut stack_st_X509,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_get0_chain_certs sets `*out_chain` to `ssl`'s certificate chain and
    /// returns one.
    pub fn SSL_get0_chain_certs(
        ssl: *const SSL,
        out_chain: *mut *mut stack_st_X509,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_set_signed_cert_timestamp_list sets the list of signed certificate
    /// timestamps that is sent to clients that request it. The `list` argument must
    /// contain one or more SCT structures serialised as a SignedCertificateTimestamp
    /// List (see https://tools.ietf.org/html/rfc6962#section-3.3) – i.e. each SCT
    /// is prefixed by a big-endian, uint16 length and the concatenation of one or
    /// more such prefixed SCTs are themselves also prefixed by a uint16 length. It
    /// returns one on success and zero on error. The caller retains ownership of
    /// `list`.
    pub fn SSL_CTX_set_signed_cert_timestamp_list(
        ctx: *mut SSL_CTX,
        list: *const u8,
        list_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set_signed_cert_timestamp_list sets the list of signed certificate
    /// timestamps that is sent to clients that request is. The same format as the
    /// one used for `SSL_CTX_set_signed_cert_timestamp_list` applies. The caller
    /// retains ownership of `list`.
    pub fn SSL_set_signed_cert_timestamp_list(
        ctx: *mut SSL,
        list: *const u8,
        list_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_set_ocsp_response sets the OCSP response that is sent to clients
    /// which request it. It returns one on success and zero on error. The caller
    /// retains ownership of `response`.
    pub fn SSL_CTX_set_ocsp_response(
        ctx: *mut SSL_CTX,
        response: *const u8,
        response_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set_ocsp_response sets the OCSP response that is sent to clients which
    /// request it. It returns one on success and zero on error. The caller retains
    /// ownership of `response`.
    pub fn SSL_set_ocsp_response(
        ssl: *mut SSL,
        response: *const u8,
        response_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_get_signature_algorithm_name returns a human-readable name for `sigalg`,
    /// or NULL if unknown. If `include_curve` is one, the curve for ECDSA algorithms
    /// is included as in TLS 1.3. Otherwise, it is excluded as in TLS 1.2.
    pub fn SSL_get_signature_algorithm_name(
        sigalg: u16,
        include_curve: ::core::ffi::c_int,
    ) -> *const ::core::ffi::c_char;
}
unsafe extern "C" {
    /// SSL_get_all_signature_algorithm_names outputs a list of possible strings
    /// `SSL_get_signature_algorithm_name` may return in this version of BoringSSL.
    /// It writes at most `max_out` entries to `out` and returns the total number it
    /// would have written, if `max_out` had been large enough. `max_out` may be
    /// initially set to zero to size the output.
    ///
    /// This function is only intended to help initialize tables in callers that want
    /// possible strings pre-declared. This list would not be suitable to set a list
    /// of supported features. It is in no particular order, and may contain
    /// placeholder, experimental, or deprecated values that do not apply to every
    /// caller. Future versions of BoringSSL may also return strings not in this
    /// list, so this does not apply if, say, sending strings across services.
    pub fn SSL_get_all_signature_algorithm_names(
        out: *mut *const ::core::ffi::c_char,
        max_out: usize,
    ) -> usize;
}
unsafe extern "C" {
    /// SSL_get_signature_algorithm_key_type returns the key type associated with
    /// `sigalg` as an `EVP_PKEY_*` constant or `EVP_PKEY_NONE` if unknown.
    pub fn SSL_get_signature_algorithm_key_type(sigalg: u16) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_get_signature_algorithm_digest returns the digest function associated
    /// with `sigalg` or `NULL` if `sigalg` has no prehash (Ed25519) or is unknown.
    pub fn SSL_get_signature_algorithm_digest(sigalg: u16) -> *const EVP_MD;
}
unsafe extern "C" {
    /// SSL_is_signature_algorithm_rsa_pss returns one if `sigalg` is an RSA-PSS
    /// signature algorithm and zero otherwise.
    pub fn SSL_is_signature_algorithm_rsa_pss(sigalg: u16) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_set_signing_algorithm_prefs configures `ctx` to use `prefs` as the
    /// preference list when signing with `ctx`'s private key in TLS 1.2 and up. It
    /// returns one on success and zero on error. `prefs` should not include the
    /// internal-only TLS 1.0 value `SSL_SIGN_RSA_PKCS1_MD5_SHA1`.
    ///
    /// This setting is not used in TLS 1.0 and 1.1. Those protocols always sign a
    /// hardcoded algorithm (an MD5/SHA-1 concatenation for RSA, and SHA-1 for
    /// ECDSA). BoringSSL will use those algorithms if and only if those versions are
    /// used. To disable them, set the minimum version to TLS 1.2 (default) or
    /// higher.
    pub fn SSL_CTX_set_signing_algorithm_prefs(
        ctx: *mut SSL_CTX,
        prefs: *const u16,
        num_prefs: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set_signing_algorithm_prefs configures `ssl` to use `prefs` as the
    /// preference list when signing with `ssl`'s private key in TLS 1.2 and up. It
    /// returns one on success and zero on error. `prefs` should not include the
    /// internal-only TLS 1.0 value `SSL_SIGN_RSA_PKCS1_MD5_SHA1`.
    ///
    /// This setting is not used in TLS 1.0 and 1.1. Those protocols always sign a
    /// hardcoded algorithm (an MD5/SHA-1 concatenation for RSA, and SHA-1 for
    /// ECDSA). BoringSSL will use those algorithms if and only if those versions are
    /// used. To disable them, set the minimum version to TLS 1.2 (default) or
    /// higher.
    pub fn SSL_set_signing_algorithm_prefs(
        ssl: *mut SSL,
        prefs: *const u16,
        num_prefs: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_set_chain_and_key sets the certificate chain and private key for a
    /// TLS client or server. References to the given `CRYPTO_BUFFER` and `EVP_PKEY`
    /// objects are added as needed. Exactly one of `privkey` or `privkey_method`
    /// may be non-NULL. Returns one on success and zero on error.
    pub fn SSL_CTX_set_chain_and_key(
        ctx: *mut SSL_CTX,
        certs: *const *mut CRYPTO_BUFFER,
        num_certs: usize,
        privkey: *mut EVP_PKEY,
        privkey_method: *const SSL_PRIVATE_KEY_METHOD,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set_chain_and_key sets the certificate chain and private key for a TLS
    /// client or server. References to the given `CRYPTO_BUFFER` and `EVP_PKEY`
    /// objects are added as needed. Exactly one of `privkey` or `privkey_method`
    /// may be non-NULL. Returns one on success and zero on error.
    pub fn SSL_set_chain_and_key(
        ssl: *mut SSL,
        certs: *const *mut CRYPTO_BUFFER,
        num_certs: usize,
        privkey: *mut EVP_PKEY,
        privkey_method: *const SSL_PRIVATE_KEY_METHOD,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_get0_chain returns the list of `CRYPTO_BUFFER`s that were set by
    /// `SSL_CTX_set_chain_and_key`. Reference counts are not incremented by this
    /// call. The return value may be `NULL` if no chain has been set.
    ///
    /// (Note: if a chain was configured by non-`CRYPTO_BUFFER`-based functions then
    /// the return value is undefined and, even if not NULL, the stack itself may
    /// contain nullptrs. Thus you shouldn't mix this function with
    /// non-`CRYPTO_BUFFER` functions for manipulating the chain.)
    pub fn SSL_CTX_get0_chain(ctx: *const SSL_CTX) -> *const stack_st_CRYPTO_BUFFER;
}
unsafe extern "C" {
    /// SSL_get0_chain returns the list of `CRYPTO_BUFFER`s that were set by
    /// `SSL_set_chain_and_key`, unless they have been discarded. Reference counts
    /// are not incremented by this call. The return value may be `NULL` if no chain
    /// has been set.
    ///
    /// (Note: if a chain was configured by non-`CRYPTO_BUFFER`-based functions then
    /// the return value is undefined and, even if not NULL, the stack itself may
    /// contain nullptrs. Thus you shouldn't mix this function with
    /// non-`CRYPTO_BUFFER` functions for manipulating the chain.)
    ///
    /// This function may return nullptr if a handshake has completed even if
    /// `SSL_set_chain_and_key` was previously called, since the configuration
    /// containing the certificates is typically cleared after handshake completion.
    pub fn SSL_get0_chain(ssl: *const SSL) -> *const stack_st_CRYPTO_BUFFER;
}
unsafe extern "C" {
    /// SSL_CTX_use_RSAPrivateKey sets `ctx`'s private key to `rsa`. It returns one
    /// on success and zero on failure.
    pub fn SSL_CTX_use_RSAPrivateKey(ctx: *mut SSL_CTX, rsa: *mut RSA) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_use_RSAPrivateKey sets `ctx`'s private key to `rsa`. It returns one on
    /// success and zero on failure.
    pub fn SSL_use_RSAPrivateKey(ssl: *mut SSL, rsa: *mut RSA) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// The following functions configure certificates or private keys but take as
    /// input DER-encoded structures. They return one on success and zero on
    /// failure.
    pub fn SSL_CTX_use_certificate_ASN1(
        ctx: *mut SSL_CTX,
        der_len: usize,
        der: *const u8,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn SSL_use_certificate_ASN1(
        ssl: *mut SSL,
        der: *const u8,
        der_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn SSL_CTX_use_PrivateKey_ASN1(
        pk: ::core::ffi::c_int,
        ctx: *mut SSL_CTX,
        der: *const u8,
        der_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn SSL_use_PrivateKey_ASN1(
        type_: ::core::ffi::c_int,
        ssl: *mut SSL,
        der: *const u8,
        der_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn SSL_CTX_use_RSAPrivateKey_ASN1(
        ctx: *mut SSL_CTX,
        der: *const u8,
        der_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn SSL_use_RSAPrivateKey_ASN1(
        ssl: *mut SSL,
        der: *const u8,
        der_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn SSL_CTX_use_RSAPrivateKey_file(
        ctx: *mut SSL_CTX,
        file: *const ::core::ffi::c_char,
        type_: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn SSL_use_RSAPrivateKey_file(
        ssl: *mut SSL,
        file: *const ::core::ffi::c_char,
        type_: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn SSL_CTX_use_certificate_file(
        ctx: *mut SSL_CTX,
        file: *const ::core::ffi::c_char,
        type_: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn SSL_use_certificate_file(
        ssl: *mut SSL,
        file: *const ::core::ffi::c_char,
        type_: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn SSL_CTX_use_PrivateKey_file(
        ctx: *mut SSL_CTX,
        file: *const ::core::ffi::c_char,
        type_: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn SSL_use_PrivateKey_file(
        ssl: *mut SSL,
        file: *const ::core::ffi::c_char,
        type_: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_use_certificate_chain_file configures certificates for `ctx`. It
    /// reads the contents of `file` as a PEM-encoded leaf certificate followed
    /// optionally by the certificate chain to send to the peer. It returns one on
    /// success and zero on failure.
    ///
    /// WARNING: If the input contains "TRUSTED CERTIFICATE" PEM blocks, this
    /// function parses auxiliary properties as in `d2i_X509_AUX`. Passing untrusted
    /// input to this function allows an attacker to influence those properties. See
    /// `d2i_X509_AUX` for details.
    pub fn SSL_CTX_use_certificate_chain_file(
        ctx: *mut SSL_CTX,
        file: *const ::core::ffi::c_char,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_set_default_passwd_cb sets the password callback for PEM-based
    /// convenience functions called on `ctx`.
    pub fn SSL_CTX_set_default_passwd_cb(ctx: *mut SSL_CTX, cb: pem_password_cb);
}
unsafe extern "C" {
    /// SSL_CTX_get_default_passwd_cb returns the callback set by
    /// `SSL_CTX_set_default_passwd_cb`.
    pub fn SSL_CTX_get_default_passwd_cb(ctx: *const SSL_CTX) -> pem_password_cb;
}
unsafe extern "C" {
    /// SSL_CTX_set_default_passwd_cb_userdata sets the userdata parameter for
    /// `ctx`'s password callback.
    pub fn SSL_CTX_set_default_passwd_cb_userdata(
        ctx: *mut SSL_CTX,
        data: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    /// SSL_CTX_get_default_passwd_cb_userdata returns the userdata parameter set by
    /// `SSL_CTX_set_default_passwd_cb_userdata`.
    pub fn SSL_CTX_get_default_passwd_cb_userdata(ctx: *const SSL_CTX) -> *mut ::core::ffi::c_void;
}
pub const ssl_private_key_result_t_ssl_private_key_success: ssl_private_key_result_t = 0;
pub const ssl_private_key_result_t_ssl_private_key_retry: ssl_private_key_result_t = 1;
pub const ssl_private_key_result_t_ssl_private_key_failure: ssl_private_key_result_t = 2;
/// Custom private keys.
pub type ssl_private_key_result_t = ::core::ffi::c_uint;
/// ssl_private_key_method_st (aka `SSL_PRIVATE_KEY_METHOD`) describes private
/// key hooks. This is used to off-load signing operations to a custom,
/// potentially asynchronous, backend. Metadata about the key such as the type
/// and size are parsed out of the certificate.
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct ssl_private_key_method_st {
    /// sign signs the message `in` in using the specified signature algorithm. On
    /// success, it returns `ssl_private_key_success` and writes at most `max_out`
    /// bytes of signature data to `out` and sets `*out_len` to the number of bytes
    /// written. On failure, it returns `ssl_private_key_failure`. If the operation
    /// has not completed, it returns `ssl_private_key_retry`. `sign` should
    /// arrange for the high-level operation on `ssl` to be retried when the
    /// operation is completed. This will result in a call to `complete`.
    ///
    /// `signature_algorithm` is one of the `SSL_SIGN_*` values, as defined in TLS
    /// 1.3. Note that, in TLS 1.2, ECDSA algorithms do not require that curve
    /// sizes match hash sizes, so the curve portion of `SSL_SIGN_ECDSA_*` values
    /// must be ignored. BoringSSL will internally handle the curve matching logic
    /// where appropriate.
    ///
    /// It is an error to call `sign` while another private key operation is in
    /// progress on `ssl`.
    pub sign: ::core::option::Option<
        unsafe extern "C" fn(
            ssl: *mut SSL,
            out: *mut u8,
            out_len: *mut usize,
            max_out: usize,
            signature_algorithm: u16,
            in_: *const u8,
            in_len: usize,
        ) -> ssl_private_key_result_t,
    >,
    /// decrypt decrypts `in_len` bytes of encrypted data from `in`. On success it
    /// returns `ssl_private_key_success`, writes at most `max_out` bytes of
    /// decrypted data to `out` and sets `*out_len` to the actual number of bytes
    /// written. On failure it returns `ssl_private_key_failure`. If the operation
    /// has not completed, it returns `ssl_private_key_retry`. The caller should
    /// arrange for the high-level operation on `ssl` to be retried when the
    /// operation is completed, which will result in a call to `complete`. This
    /// function only works with RSA keys and should perform a raw RSA decryption
    /// operation with no padding.
    ///
    /// It is an error to call `decrypt` while another private key operation is in
    /// progress on `ssl`.
    pub decrypt: ::core::option::Option<
        unsafe extern "C" fn(
            ssl: *mut SSL,
            out: *mut u8,
            out_len: *mut usize,
            max_out: usize,
            in_: *const u8,
            in_len: usize,
        ) -> ssl_private_key_result_t,
    >,
    /// complete completes a pending operation. If the operation has completed, it
    /// returns `ssl_private_key_success` and writes the result to `out` as in
    /// `sign`. Otherwise, it returns `ssl_private_key_failure` on failure and
    /// `ssl_private_key_retry` if the operation is still in progress.
    ///
    /// `complete` may be called arbitrarily many times before completion, but it
    /// is an error to call `complete` if there is no pending operation in progress
    /// on `ssl`.
    pub complete: ::core::option::Option<
        unsafe extern "C" fn(
            ssl: *mut SSL,
            out: *mut u8,
            out_len: *mut usize,
            max_out: usize,
        ) -> ssl_private_key_result_t,
    >,
}
unsafe extern "C" {
    /// SSL_set_private_key_method configures a custom private key on `ssl`.
    /// `key_method` must remain valid for the lifetime of `ssl`.
    ///
    /// If using an RSA or ECDSA key, callers should configure signing capabilities
    /// with `SSL_set_signing_algorithm_prefs`. Otherwise, BoringSSL may select a
    /// signature algorithm that `key_method` does not support.
    pub fn SSL_set_private_key_method(ssl: *mut SSL, key_method: *const SSL_PRIVATE_KEY_METHOD);
}
unsafe extern "C" {
    /// SSL_CTX_set_private_key_method configures a custom private key on `ctx`.
    /// `key_method` must remain valid for the lifetime of `ctx`.
    ///
    /// If using an RSA or ECDSA key, callers should configure signing capabilities
    /// with `SSL_CTX_set_signing_algorithm_prefs`. Otherwise, BoringSSL may select a
    /// signature algorithm that `key_method` does not support.
    pub fn SSL_CTX_set_private_key_method(
        ctx: *mut SSL_CTX,
        key_method: *const SSL_PRIVATE_KEY_METHOD,
    );
}
unsafe extern "C" {
    /// SSL_CREDENTIAL_set_private_key_method configures a custom private key on
    /// `cred`. `key_method` must remain valid for the lifetime of `cred`. It returns
    /// one on success and zero if `cred` does not use private keys.
    ///
    /// If using an RSA or ECDSA key, callers should configure signing capabilities
    /// with `SSL_CREDENTIAL_set1_signing_algorithm_prefs`. Otherwise, BoringSSL may
    /// select a signature algorithm that `key_method` does not support. This is not
    /// necessary for delegated credentials (see `SSL_CREDENTIAL_new_delegated`)
    /// because delegated credentials only support a single signature algorithm.
    ///
    /// Functions in `key_method` will be passed an `SSL` object, but not `cred`
    /// directly. Use `SSL_get0_selected_credential` to determine the selected
    /// credential. From there, `SSL_CREDENTIAL_get_ex_data` can be used to look up
    /// credential-specific state, such as a handle to the private key.
    pub fn SSL_CREDENTIAL_set_private_key_method(
        cred: *mut SSL_CREDENTIAL,
        key_method: *const SSL_PRIVATE_KEY_METHOD,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_can_release_private_key returns one if `ssl` will no longer call into the
    /// private key and zero otherwise. If the function returns one, the caller can
    /// release state associated with the private key.
    ///
    /// NOTE: This function assumes the caller does not use `SSL_clear` to reuse
    /// `ssl` for a second connection. If `SSL_clear` is used, BoringSSL may still
    /// use the private key on the second connection.
    pub fn SSL_can_release_private_key(ssl: *const SSL) -> ::core::ffi::c_int;
}
/// Cipher suites.
///
/// `SSL_CIPHER` objects represent cipher suites.
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct stack_st_SSL_CIPHER {
    _unused: [u8; 0],
}
/// Cipher suites.
///
/// `SSL_CIPHER` objects represent cipher suites.
pub type sk_SSL_CIPHER_free_func =
    ::core::option::Option<unsafe extern "C" fn(arg1: *const SSL_CIPHER)>;
/// Cipher suites.
///
/// `SSL_CIPHER` objects represent cipher suites.
pub type sk_SSL_CIPHER_copy_func =
    ::core::option::Option<unsafe extern "C" fn(arg1: *const SSL_CIPHER) -> *const SSL_CIPHER>;
/// Cipher suites.
///
/// `SSL_CIPHER` objects represent cipher suites.
pub type sk_SSL_CIPHER_cmp_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *const *const SSL_CIPHER,
        arg2: *const *const SSL_CIPHER,
    ) -> ::core::ffi::c_int,
>;
/// Cipher suites.
///
/// `SSL_CIPHER` objects represent cipher suites.
pub type sk_SSL_CIPHER_delete_if_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *const SSL_CIPHER,
        arg2: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int,
>;
unsafe extern "C" {
    /// Cipher suites.
    ///
    /// `SSL_CIPHER` objects represent cipher suites.
    #[link_name = "sk_SSL_CIPHER_call_free_func__extern"]
    pub fn sk_SSL_CIPHER_call_free_func(
        free_func: OPENSSL_sk_free_func,
        ptr: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    /// Cipher suites.
    ///
    /// `SSL_CIPHER` objects represent cipher suites.
    #[link_name = "sk_SSL_CIPHER_call_copy_func__extern"]
    pub fn sk_SSL_CIPHER_call_copy_func(
        copy_func: OPENSSL_sk_copy_func,
        ptr: *const ::core::ffi::c_void,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    /// Cipher suites.
    ///
    /// `SSL_CIPHER` objects represent cipher suites.
    #[link_name = "sk_SSL_CIPHER_call_cmp_func__extern"]
    pub fn sk_SSL_CIPHER_call_cmp_func(
        cmp_func: OPENSSL_sk_cmp_func,
        a: *const ::core::ffi::c_void,
        b: *const ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Cipher suites.
    ///
    /// `SSL_CIPHER` objects represent cipher suites.
    #[link_name = "sk_SSL_CIPHER_call_delete_if_func__extern"]
    pub fn sk_SSL_CIPHER_call_delete_if_func(
        func: OPENSSL_sk_delete_if_func,
        obj: *mut ::core::ffi::c_void,
        data: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Cipher suites.
    ///
    /// `SSL_CIPHER` objects represent cipher suites.
    #[link_name = "sk_SSL_CIPHER_new__extern"]
    pub fn sk_SSL_CIPHER_new(comp: sk_SSL_CIPHER_cmp_func) -> *mut stack_st_SSL_CIPHER;
}
unsafe extern "C" {
    /// Cipher suites.
    ///
    /// `SSL_CIPHER` objects represent cipher suites.
    #[link_name = "sk_SSL_CIPHER_new_null__extern"]
    pub fn sk_SSL_CIPHER_new_null() -> *mut stack_st_SSL_CIPHER;
}
unsafe extern "C" {
    /// Cipher suites.
    ///
    /// `SSL_CIPHER` objects represent cipher suites.
    #[link_name = "sk_SSL_CIPHER_num__extern"]
    pub fn sk_SSL_CIPHER_num(sk: *const stack_st_SSL_CIPHER) -> usize;
}
unsafe extern "C" {
    /// Cipher suites.
    ///
    /// `SSL_CIPHER` objects represent cipher suites.
    #[link_name = "sk_SSL_CIPHER_zero__extern"]
    pub fn sk_SSL_CIPHER_zero(sk: *mut stack_st_SSL_CIPHER);
}
unsafe extern "C" {
    /// Cipher suites.
    ///
    /// `SSL_CIPHER` objects represent cipher suites.
    #[link_name = "sk_SSL_CIPHER_value__extern"]
    pub fn sk_SSL_CIPHER_value(sk: *const stack_st_SSL_CIPHER, i: usize) -> *const SSL_CIPHER;
}
unsafe extern "C" {
    /// Cipher suites.
    ///
    /// `SSL_CIPHER` objects represent cipher suites.
    #[link_name = "sk_SSL_CIPHER_set__extern"]
    pub fn sk_SSL_CIPHER_set(
        sk: *mut stack_st_SSL_CIPHER,
        i: usize,
        p: *const SSL_CIPHER,
    ) -> *const SSL_CIPHER;
}
unsafe extern "C" {
    /// Cipher suites.
    ///
    /// `SSL_CIPHER` objects represent cipher suites.
    #[link_name = "sk_SSL_CIPHER_free__extern"]
    pub fn sk_SSL_CIPHER_free(sk: *mut stack_st_SSL_CIPHER);
}
unsafe extern "C" {
    /// Cipher suites.
    ///
    /// `SSL_CIPHER` objects represent cipher suites.
    #[link_name = "sk_SSL_CIPHER_pop_free__extern"]
    pub fn sk_SSL_CIPHER_pop_free(sk: *mut stack_st_SSL_CIPHER, free_func: sk_SSL_CIPHER_free_func);
}
unsafe extern "C" {
    /// Cipher suites.
    ///
    /// `SSL_CIPHER` objects represent cipher suites.
    #[link_name = "sk_SSL_CIPHER_insert__extern"]
    pub fn sk_SSL_CIPHER_insert(
        sk: *mut stack_st_SSL_CIPHER,
        p: *const SSL_CIPHER,
        where_: usize,
    ) -> usize;
}
unsafe extern "C" {
    /// Cipher suites.
    ///
    /// `SSL_CIPHER` objects represent cipher suites.
    #[link_name = "sk_SSL_CIPHER_delete__extern"]
    pub fn sk_SSL_CIPHER_delete(sk: *mut stack_st_SSL_CIPHER, where_: usize) -> *const SSL_CIPHER;
}
unsafe extern "C" {
    /// Cipher suites.
    ///
    /// `SSL_CIPHER` objects represent cipher suites.
    #[link_name = "sk_SSL_CIPHER_delete_ptr__extern"]
    pub fn sk_SSL_CIPHER_delete_ptr(
        sk: *mut stack_st_SSL_CIPHER,
        p: *const SSL_CIPHER,
    ) -> *const SSL_CIPHER;
}
unsafe extern "C" {
    /// Cipher suites.
    ///
    /// `SSL_CIPHER` objects represent cipher suites.
    #[link_name = "sk_SSL_CIPHER_delete_if__extern"]
    pub fn sk_SSL_CIPHER_delete_if(
        sk: *mut stack_st_SSL_CIPHER,
        func: sk_SSL_CIPHER_delete_if_func,
        data: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    /// Cipher suites.
    ///
    /// `SSL_CIPHER` objects represent cipher suites.
    #[link_name = "sk_SSL_CIPHER_find__extern"]
    pub fn sk_SSL_CIPHER_find(
        sk: *const stack_st_SSL_CIPHER,
        out_index: *mut usize,
        p: *const SSL_CIPHER,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Cipher suites.
    ///
    /// `SSL_CIPHER` objects represent cipher suites.
    #[link_name = "sk_SSL_CIPHER_shift__extern"]
    pub fn sk_SSL_CIPHER_shift(sk: *mut stack_st_SSL_CIPHER) -> *const SSL_CIPHER;
}
unsafe extern "C" {
    /// Cipher suites.
    ///
    /// `SSL_CIPHER` objects represent cipher suites.
    #[link_name = "sk_SSL_CIPHER_push__extern"]
    pub fn sk_SSL_CIPHER_push(sk: *mut stack_st_SSL_CIPHER, p: *const SSL_CIPHER) -> usize;
}
unsafe extern "C" {
    /// Cipher suites.
    ///
    /// `SSL_CIPHER` objects represent cipher suites.
    #[link_name = "sk_SSL_CIPHER_pop__extern"]
    pub fn sk_SSL_CIPHER_pop(sk: *mut stack_st_SSL_CIPHER) -> *const SSL_CIPHER;
}
unsafe extern "C" {
    /// Cipher suites.
    ///
    /// `SSL_CIPHER` objects represent cipher suites.
    #[link_name = "sk_SSL_CIPHER_dup__extern"]
    pub fn sk_SSL_CIPHER_dup(sk: *const stack_st_SSL_CIPHER) -> *mut stack_st_SSL_CIPHER;
}
unsafe extern "C" {
    /// Cipher suites.
    ///
    /// `SSL_CIPHER` objects represent cipher suites.
    #[link_name = "sk_SSL_CIPHER_sort__extern"]
    pub fn sk_SSL_CIPHER_sort(sk: *mut stack_st_SSL_CIPHER);
}
unsafe extern "C" {
    /// Cipher suites.
    ///
    /// `SSL_CIPHER` objects represent cipher suites.
    #[link_name = "sk_SSL_CIPHER_sort_and_dedup__extern"]
    pub fn sk_SSL_CIPHER_sort_and_dedup(
        sk: *mut stack_st_SSL_CIPHER,
        free_func: sk_SSL_CIPHER_free_func,
    );
}
unsafe extern "C" {
    /// Cipher suites.
    ///
    /// `SSL_CIPHER` objects represent cipher suites.
    #[link_name = "sk_SSL_CIPHER_is_sorted__extern"]
    pub fn sk_SSL_CIPHER_is_sorted(sk: *const stack_st_SSL_CIPHER) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// Cipher suites.
    ///
    /// `SSL_CIPHER` objects represent cipher suites.
    #[link_name = "sk_SSL_CIPHER_set_cmp_func__extern"]
    pub fn sk_SSL_CIPHER_set_cmp_func(
        sk: *mut stack_st_SSL_CIPHER,
        comp: sk_SSL_CIPHER_cmp_func,
    ) -> sk_SSL_CIPHER_cmp_func;
}
unsafe extern "C" {
    /// Cipher suites.
    ///
    /// `SSL_CIPHER` objects represent cipher suites.
    #[link_name = "sk_SSL_CIPHER_deep_copy__extern"]
    pub fn sk_SSL_CIPHER_deep_copy(
        sk: *const stack_st_SSL_CIPHER,
        copy_func: sk_SSL_CIPHER_copy_func,
        free_func: sk_SSL_CIPHER_free_func,
    ) -> *mut stack_st_SSL_CIPHER;
}
unsafe extern "C" {
    /// SSL_get_cipher_by_value returns the structure representing a TLS cipher
    /// suite based on its assigned number, or NULL if unknown. See
    /// https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-4.
    pub fn SSL_get_cipher_by_value(value: u16) -> *const SSL_CIPHER;
}
unsafe extern "C" {
    /// SSL_CIPHER_get_protocol_id returns `cipher`'s two-byte protocol ID.
    pub fn SSL_CIPHER_get_protocol_id(cipher: *const SSL_CIPHER) -> u16;
}
unsafe extern "C" {
    /// SSL_CIPHER_is_aead returns one if `cipher` uses an AEAD cipher.
    pub fn SSL_CIPHER_is_aead(cipher: *const SSL_CIPHER) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CIPHER_is_block_cipher returns one if `cipher` is a block cipher.
    pub fn SSL_CIPHER_is_block_cipher(cipher: *const SSL_CIPHER) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CIPHER_get_cipher_nid returns the NID for `cipher`'s bulk
    /// cipher. Possible values are `NID_aes_128_gcm`, `NID_aes_256_gcm`,
    /// `NID_chacha20_poly1305`, `NID_aes_128_cbc`, `NID_aes_256_cbc`, and
    /// `NID_des_ede3_cbc`.
    pub fn SSL_CIPHER_get_cipher_nid(cipher: *const SSL_CIPHER) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CIPHER_get_digest_nid returns the NID for `cipher`'s HMAC if it is a
    /// legacy cipher suite. For modern AEAD-based ciphers (see
    /// `SSL_CIPHER_is_aead`), it returns `NID_undef`.
    ///
    /// Note this function only returns the legacy HMAC digest, not the PRF hash.
    pub fn SSL_CIPHER_get_digest_nid(cipher: *const SSL_CIPHER) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CIPHER_get_kx_nid returns the NID for `cipher`'s key exchange. This may
    /// be `NID_kx_rsa`, `NID_kx_ecdhe`, or `NID_kx_psk` for TLS 1.2. In TLS 1.3,
    /// cipher suites do not specify the key exchange, so this function returns
    /// `NID_kx_any`.
    pub fn SSL_CIPHER_get_kx_nid(cipher: *const SSL_CIPHER) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CIPHER_get_auth_nid returns the NID for `cipher`'s authentication
    /// type. This may be `NID_auth_rsa`, `NID_auth_ecdsa`, or `NID_auth_psk` for TLS
    /// 1.2. In TLS 1.3, cipher suites do not specify authentication, so this
    /// function returns `NID_auth_any`.
    pub fn SSL_CIPHER_get_auth_nid(cipher: *const SSL_CIPHER) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CIPHER_get_handshake_digest returns `cipher`'s PRF hash. If `cipher`
    /// is a pre-TLS-1.2 cipher, it returns `EVP_md5_sha1` but note these ciphers use
    /// SHA-256 in TLS 1.2. Other return values may be treated uniformly in all
    /// applicable versions.
    pub fn SSL_CIPHER_get_handshake_digest(cipher: *const SSL_CIPHER) -> *const EVP_MD;
}
unsafe extern "C" {
    /// SSL_CIPHER_get_prf_nid behaves like `SSL_CIPHER_get_handshake_digest` but
    /// returns the NID constant. Use `SSL_CIPHER_get_handshake_digest` instead.
    pub fn SSL_CIPHER_get_prf_nid(cipher: *const SSL_CIPHER) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CIPHER_get_min_version returns the minimum protocol version required
    /// for `cipher`.
    pub fn SSL_CIPHER_get_min_version(cipher: *const SSL_CIPHER) -> u16;
}
unsafe extern "C" {
    /// SSL_CIPHER_get_max_version returns the maximum protocol version that
    /// supports `cipher`.
    pub fn SSL_CIPHER_get_max_version(cipher: *const SSL_CIPHER) -> u16;
}
unsafe extern "C" {
    /// SSL_CIPHER_standard_name returns the standard IETF name for `cipher`. For
    /// example, "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256".
    pub fn SSL_CIPHER_standard_name(cipher: *const SSL_CIPHER) -> *const ::core::ffi::c_char;
}
unsafe extern "C" {
    /// SSL_CIPHER_get_kx_name returns a string that describes the key-exchange
    /// method used by `cipher`. For example, "ECDHE_ECDSA". TLS 1.3 AEAD-only
    /// ciphers return the string "GENERIC".
    pub fn SSL_CIPHER_get_kx_name(cipher: *const SSL_CIPHER) -> *const ::core::ffi::c_char;
}
unsafe extern "C" {
    /// SSL_CIPHER_get_bits returns the strength, in bits, of `cipher`. If
    /// `out_alg_bits` is not NULL, it writes the number of bits consumed by the
    /// symmetric algorithm to `*out_alg_bits`.
    pub fn SSL_CIPHER_get_bits(
        cipher: *const SSL_CIPHER,
        out_alg_bits: *mut ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_get_all_cipher_names outputs a list of possible strings
    /// `SSL_CIPHER_get_name` may return in this version of BoringSSL. It writes at
    /// most `max_out` entries to `out` and returns the total number it would have
    /// written, if `max_out` had been large enough. `max_out` may be initially set
    /// to zero to size the output.
    ///
    /// This function is only intended to help initialize tables in callers that want
    /// possible strings pre-declared. This list would not be suitable to set a list
    /// of supported features. It is in no particular order, and may contain
    /// placeholder, experimental, or deprecated values that do not apply to every
    /// caller. Future versions of BoringSSL may also return strings not in this
    /// list, so this does not apply if, say, sending strings across services.
    pub fn SSL_get_all_cipher_names(out: *mut *const ::core::ffi::c_char, max_out: usize) -> usize;
}
unsafe extern "C" {
    /// SSL_get_all_standard_cipher_names outputs a list of possible strings
    /// `SSL_CIPHER_standard_name` may return in this version of BoringSSL. It writes
    /// at most `max_out` entries to `out` and returns the total number it would have
    /// written, if `max_out` had been large enough. `max_out` may be initially set
    /// to zero to size the output.
    ///
    /// This function is only intended to help initialize tables in callers that want
    /// possible strings pre-declared. This list would not be suitable to set a list
    /// of supported features. It is in no particular order, and may contain
    /// placeholder, experimental, or deprecated values that do not apply to every
    /// caller. Future versions of BoringSSL may also return strings not in this
    /// list, so this does not apply if, say, sending strings across services.
    pub fn SSL_get_all_standard_cipher_names(
        out: *mut *const ::core::ffi::c_char,
        max_out: usize,
    ) -> usize;
}
unsafe extern "C" {
    /// SSL_CTX_set_strict_cipher_list configures the cipher list for `ctx`,
    /// evaluating `str` as a cipher string and returning error if `str` contains
    /// anything meaningless. It returns one on success and zero on failure.
    pub fn SSL_CTX_set_strict_cipher_list(
        ctx: *mut SSL_CTX,
        str_: *const ::core::ffi::c_char,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_set_cipher_list configures the cipher list for `ctx`, evaluating
    /// `str` as a cipher string. It returns one on success and zero on failure.
    ///
    /// Prefer to use `SSL_CTX_set_strict_cipher_list`. This function tolerates
    /// garbage inputs, unless an empty cipher list results.
    pub fn SSL_CTX_set_cipher_list(
        ctx: *mut SSL_CTX,
        str_: *const ::core::ffi::c_char,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set_strict_cipher_list configures the cipher list for `ssl`, evaluating
    /// `str` as a cipher string and returning error if `str` contains anything
    /// meaningless. It returns one on success and zero on failure.
    pub fn SSL_set_strict_cipher_list(
        ssl: *mut SSL,
        str_: *const ::core::ffi::c_char,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set_cipher_list configures the cipher list for `ssl`, evaluating `str` as
    /// a cipher string. It returns one on success and zero on failure.
    ///
    /// Prefer to use `SSL_set_strict_cipher_list`. This function tolerates garbage
    /// inputs, unless an empty cipher list results.
    pub fn SSL_set_cipher_list(
        ssl: *mut SSL,
        str_: *const ::core::ffi::c_char,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_get_ciphers returns the cipher list for `ctx`, in order of
    /// preference.
    pub fn SSL_CTX_get_ciphers(ctx: *const SSL_CTX) -> *mut stack_st_SSL_CIPHER;
}
unsafe extern "C" {
    /// SSL_CTX_cipher_in_group returns one if the `i`th cipher (see
    /// `SSL_CTX_get_ciphers`) is in the same equipreference group as the one
    /// following it and zero otherwise.
    pub fn SSL_CTX_cipher_in_group(ctx: *const SSL_CTX, i: usize) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_get_ciphers returns the cipher list for `ssl`, in order of preference.
    pub fn SSL_get_ciphers(ssl: *const SSL) -> *mut stack_st_SSL_CIPHER;
}
unsafe extern "C" {
    /// SSL_is_init_finished returns one if `ssl` has completed its initial handshake
    /// and has no pending handshake. It returns zero otherwise.
    pub fn SSL_is_init_finished(ssl: *const SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_in_init returns one if `ssl` has a pending handshake and zero
    /// otherwise.
    pub fn SSL_in_init(ssl: *const SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_in_false_start returns one if `ssl` has a pending handshake that is in
    /// False Start. `SSL_write` may be called at this point without waiting for the
    /// peer, but `SSL_read` will complete the handshake before accepting application
    /// data.
    ///
    /// See also `SSL_MODE_ENABLE_FALSE_START`.
    pub fn SSL_in_false_start(ssl: *const SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_get_peer_certificate returns the peer's leaf certificate or NULL if the
    /// peer did not use certificates. The caller must call `X509_free` on the
    /// result to release it.
    pub fn SSL_get_peer_certificate(ssl: *const SSL) -> *mut X509;
}
unsafe extern "C" {
    /// SSL_get_peer_cert_chain returns the peer's certificate chain or NULL if
    /// unavailable or the peer did not use certificates. This is the unverified list
    /// of certificates as sent by the peer, not the final chain built during
    /// verification. The caller does not take ownership of the result.
    ///
    /// WARNING: This function behaves differently between client and server. If
    /// `ssl` is a server, the returned chain does not include the leaf certificate.
    /// If a client, it does.
    pub fn SSL_get_peer_cert_chain(ssl: *const SSL) -> *mut stack_st_X509;
}
unsafe extern "C" {
    /// SSL_get_peer_full_cert_chain returns the peer's certificate chain, or NULL if
    /// unavailable or the peer did not use certificates. This is the unverified list
    /// of certificates as sent by the peer, not the final chain built during
    /// verification. The caller does not take ownership of the result.
    ///
    /// This is the same as `SSL_get_peer_cert_chain` except that this function
    /// always returns the full chain, i.e. the first element of the return value
    /// (if any) will be the leaf certificate. In contrast, `SSL_get_peer_cert_chain`
    /// returns only the intermediate certificates if the `ssl` is a server.
    pub fn SSL_get_peer_full_cert_chain(ssl: *const SSL) -> *mut stack_st_X509;
}
unsafe extern "C" {
    /// SSL_get0_peer_certificates returns the peer's certificate chain, or NULL if
    /// unavailable or the peer did not use certificates. This is the unverified list
    /// of certificates as sent by the peer, not the final chain built during
    /// verification. The caller does not take ownership of the result.
    ///
    /// This is the `CRYPTO_BUFFER` variant of `SSL_get_peer_full_cert_chain`.
    pub fn SSL_get0_peer_certificates(ssl: *const SSL) -> *const stack_st_CRYPTO_BUFFER;
}
unsafe extern "C" {
    /// SSL_get0_signed_cert_timestamp_list sets `*out` and `*out_len` to point to
    /// `*out_len` bytes of SCT information from the server. This is only valid if
    /// `ssl` is a client. The SCT information is a SignedCertificateTimestampList
    /// (including the two leading length bytes).
    /// See https://tools.ietf.org/html/rfc6962#section-3.3
    /// If no SCT was received then `*out_len` will be zero on return.
    ///
    /// WARNING: the returned data is not guaranteed to be well formed.
    pub fn SSL_get0_signed_cert_timestamp_list(
        ssl: *const SSL,
        out: *mut *const u8,
        out_len: *mut usize,
    );
}
unsafe extern "C" {
    /// SSL_get0_ocsp_response sets `*out` and `*out_len` to point to `*out_len`
    /// bytes of an OCSP response from the server. This is the DER encoding of an
    /// OCSPResponse type as defined in RFC 2560.
    ///
    /// WARNING: the returned data is not guaranteed to be well formed.
    pub fn SSL_get0_ocsp_response(ssl: *const SSL, out: *mut *const u8, out_len: *mut usize);
}
unsafe extern "C" {
    /// SSL_get_tls_unique writes at most `max_out` bytes of the tls-unique value
    /// for `ssl` to `out` and sets `*out_len` to the number of bytes written. It
    /// returns one on success or zero on error. In general `max_out` should be at
    /// least 12.
    ///
    /// This function will always fail if the initial handshake has not completed.
    /// The tls-unique value will change after a renegotiation but, since
    /// renegotiations can be initiated by the server at any point, the higher-level
    /// protocol must either leave them disabled or define states in which the
    /// tls-unique value can be read.
    ///
    /// The tls-unique value is defined by
    /// https://tools.ietf.org/html/rfc5929#section-3.1. Due to a weakness in the
    /// TLS protocol, tls-unique is broken for resumed connections unless the
    /// Extended Master Secret extension is negotiated. Thus this function will
    /// return zero if `ssl` performed session resumption unless EMS was used when
    /// negotiating the original session.
    pub fn SSL_get_tls_unique(
        ssl: *const SSL,
        out: *mut u8,
        out_len: *mut usize,
        max_out: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_get_extms_support returns one if the Extended Master Secret extension or
    /// TLS 1.3 was negotiated. Otherwise, it returns zero.
    pub fn SSL_get_extms_support(ssl: *const SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_get_current_cipher returns cipher suite used by `ssl`, or NULL if it has
    /// not been negotiated yet.
    pub fn SSL_get_current_cipher(ssl: *const SSL) -> *const SSL_CIPHER;
}
unsafe extern "C" {
    /// SSL_session_reused returns one if `ssl` performed an abbreviated handshake
    /// and zero otherwise.
    ///
    /// TODO(davidben): Hammer down the semantics of this API while a handshake,
    /// initial or renego, is in progress.
    pub fn SSL_session_reused(ssl: *const SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_get_secure_renegotiation_support returns one if the peer supports secure
    /// renegotiation (RFC 5746) or TLS 1.3. Otherwise, it returns zero.
    pub fn SSL_get_secure_renegotiation_support(ssl: *const SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_export_keying_material exports a connection-specific secret from `ssl`,
    /// as specified in RFC 5705. It writes `out_len` bytes to `out` given a label
    /// and optional context. If `use_context` is zero, the `context` parameter is
    /// ignored.
    ///
    /// To derive the same value, both sides of a connection must use the same output
    /// length, label, and context. In TLS 1.2 and earlier, using a zero-length
    /// context and using no context would give different output. In TLS 1.3 and
    /// later, the output length impacts the derivation, so a truncated longer export
    /// will not match a shorter export.
    ///
    /// It returns one on success and zero otherwise.
    pub fn SSL_export_keying_material(
        ssl: *const SSL,
        out: *mut u8,
        out_len: usize,
        label: *const ::core::ffi::c_char,
        label_len: usize,
        context: *const u8,
        context_len: usize,
        use_context: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_SESSION_new returns a newly-allocated blank `SSL_SESSION` or NULL on
    /// error. This may be useful when writing tests but should otherwise not be
    /// used.
    pub fn SSL_SESSION_new(ctx: *const SSL_CTX) -> *mut SSL_SESSION;
}
unsafe extern "C" {
    /// SSL_SESSION_up_ref increments the reference count of `session` and returns
    /// one.
    pub fn SSL_SESSION_up_ref(session: *mut SSL_SESSION) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_SESSION_free decrements the reference count of `session`. If it reaches
    /// zero, all data referenced by `session` and `session` itself are released.
    pub fn SSL_SESSION_free(session: *mut SSL_SESSION);
}
unsafe extern "C" {
    /// SSL_SESSION_to_bytes serializes `in` into a newly allocated buffer and sets
    /// `*out_data` to that buffer and `*out_len` to its length. The caller takes
    /// ownership of the buffer and must call `OPENSSL_free` when done. It returns
    /// one on success and zero on error.
    pub fn SSL_SESSION_to_bytes(
        in_: *const SSL_SESSION,
        out_data: *mut *mut u8,
        out_len: *mut usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_SESSION_to_bytes_for_ticket serializes `in`, but excludes the session
    /// identification information, namely the session ID and ticket.
    pub fn SSL_SESSION_to_bytes_for_ticket(
        in_: *const SSL_SESSION,
        out_data: *mut *mut u8,
        out_len: *mut usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_SESSION_from_bytes parses `in_len` bytes from `in` as an SSL_SESSION. It
    /// returns a newly-allocated `SSL_SESSION` on success or NULL on error.
    pub fn SSL_SESSION_from_bytes(
        in_: *const u8,
        in_len: usize,
        ctx: *const SSL_CTX,
    ) -> *mut SSL_SESSION;
}
unsafe extern "C" {
    /// PEM_read_bio_SSL_SESSION reads an `SSL_SESSION` as a PEM block of type "SSL
    /// SESSION PARAMETERS", as described in `PEM_read_bio_SAMPLE`.
    pub fn PEM_read_bio_SSL_SESSION(
        bio: *mut BIO,
        out: *mut *mut SSL_SESSION,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> *mut SSL_SESSION;
}
unsafe extern "C" {
    /// PEM_read_SSL_SESSION behaves like `PEM_read_bio_SSL_SESSION` but reads from
    /// `fp`.
    pub fn PEM_read_SSL_SESSION(
        fp: *mut FILE,
        out: *mut *mut SSL_SESSION,
        cb: pem_password_cb,
        userdata: *mut ::core::ffi::c_void,
    ) -> *mut SSL_SESSION;
}
unsafe extern "C" {
    /// PEM_write_bio_SSL_SESSION writes `in` to `bio` as a PEM block of type "SSL
    /// SESSION PARAMETERS", as described in `PEM_write_bio_SAMPLE`.
    pub fn PEM_write_bio_SSL_SESSION(bio: *mut BIO, in_: *const SSL_SESSION) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// PEM_write_SSL_SESSION behaves like `PEM_write_bio_SSL_SESSION` but writes to
    /// `fp`.
    pub fn PEM_write_SSL_SESSION(fp: *mut FILE, in_: *const SSL_SESSION) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_SESSION_get_version returns a string describing the TLS or DTLS version
    /// `session` was established at. For example, "TLSv1.2" or "DTLSv1".
    pub fn SSL_SESSION_get_version(session: *const SSL_SESSION) -> *const ::core::ffi::c_char;
}
unsafe extern "C" {
    /// SSL_SESSION_get_protocol_version returns the TLS or DTLS version `session`
    /// was established at.
    pub fn SSL_SESSION_get_protocol_version(session: *const SSL_SESSION) -> u16;
}
unsafe extern "C" {
    /// SSL_SESSION_set_protocol_version sets `session`'s TLS or DTLS version to
    /// `version`. This may be useful when writing tests but should otherwise not be
    /// used. It returns one on success and zero on error.
    pub fn SSL_SESSION_set_protocol_version(
        session: *mut SSL_SESSION,
        version: u16,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_SESSION_get_id returns a pointer to a buffer containing `session`'s
    /// session ID and sets `*out_len` to its length.
    ///
    /// This function should only be used for implementing a TLS session cache. TLS
    /// sessions are not suitable for application-level session state, and a session
    /// ID is an implementation detail of the TLS resumption handshake mechanism. Not
    /// all resumption flows use session IDs, and not all connections within an
    /// application-level session will reuse TLS sessions.
    ///
    /// To determine if resumption occurred, use `SSL_session_reused` instead.
    /// Comparing session IDs will not give the right result in all cases.
    ///
    /// As a workaround for some broken applications, BoringSSL sometimes synthesizes
    /// arbitrary session IDs for non-ID-based sessions. This behavior may be
    /// removed in the future.
    pub fn SSL_SESSION_get_id(
        session: *const SSL_SESSION,
        out_len: *mut ::core::ffi::c_uint,
    ) -> *const u8;
}
unsafe extern "C" {
    /// SSL_SESSION_set1_id sets `session`'s session ID to `sid`, It returns one on
    /// success and zero on error. This function may be useful in writing tests but
    /// otherwise should not be used.
    pub fn SSL_SESSION_set1_id(
        session: *mut SSL_SESSION,
        sid: *const u8,
        sid_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_SESSION_get_time returns the time at which `session` was established in
    /// seconds since the UNIX epoch.
    pub fn SSL_SESSION_get_time(session: *const SSL_SESSION) -> u64;
}
unsafe extern "C" {
    /// SSL_SESSION_get_timeout returns the lifetime of `session` in seconds.
    pub fn SSL_SESSION_get_timeout(session: *const SSL_SESSION) -> u32;
}
unsafe extern "C" {
    /// SSL_SESSION_get0_peer returns the peer leaf certificate stored in
    /// `session`.
    ///
    /// TODO(davidben): This should return a const X509 *.
    pub fn SSL_SESSION_get0_peer(session: *const SSL_SESSION) -> *mut X509;
}
unsafe extern "C" {
    /// SSL_SESSION_get0_peer_certificates returns the peer certificate chain stored
    /// in `session`, or NULL if the peer did not use certificates. This is the
    /// unverified list of certificates as sent by the peer, not the final chain
    /// built during verification. The caller does not take ownership of the result.
    pub fn SSL_SESSION_get0_peer_certificates(
        session: *const SSL_SESSION,
    ) -> *const stack_st_CRYPTO_BUFFER;
}
unsafe extern "C" {
    /// SSL_SESSION_get0_peer_rpk returns the peer raw public key stored in
    /// `session`, or NULL if the peer did not send a raw public key.
    pub fn SSL_SESSION_get0_peer_rpk(session: *const SSL_SESSION) -> *mut EVP_PKEY;
}
unsafe extern "C" {
    /// SSL_SESSION_get0_signed_cert_timestamp_list sets `*out` and `*out_len` to
    /// point to `*out_len` bytes of SCT information stored in `session`. This is
    /// only valid for client sessions. The SCT information is a
    /// SignedCertificateTimestampList (including the two leading length bytes). See
    /// https://tools.ietf.org/html/rfc6962#section-3.3 If no SCT was received then
    /// `*out_len` will be zero on return.
    ///
    /// WARNING: the returned data is not guaranteed to be well formed.
    pub fn SSL_SESSION_get0_signed_cert_timestamp_list(
        session: *const SSL_SESSION,
        out: *mut *const u8,
        out_len: *mut usize,
    );
}
unsafe extern "C" {
    /// SSL_SESSION_get0_ocsp_response sets `*out` and `*out_len` to point to
    /// `*out_len` bytes of an OCSP response from the server. This is the DER
    /// encoding of an OCSPResponse type as defined in RFC 2560.
    ///
    /// WARNING: the returned data is not guaranteed to be well formed.
    pub fn SSL_SESSION_get0_ocsp_response(
        session: *const SSL_SESSION,
        out: *mut *const u8,
        out_len: *mut usize,
    );
}
unsafe extern "C" {
    /// SSL_SESSION_get_master_key writes up to `max_out` bytes of `session`'s secret
    /// to `out` and returns the number of bytes written. If `max_out` is zero, it
    /// returns the size of the secret.
    pub fn SSL_SESSION_get_master_key(
        session: *const SSL_SESSION,
        out: *mut u8,
        max_out: usize,
    ) -> usize;
}
unsafe extern "C" {
    /// SSL_SESSION_set_time sets `session`'s creation time to `time` and returns
    /// `time`. This function may be useful in writing tests but otherwise should not
    /// be used.
    pub fn SSL_SESSION_set_time(session: *mut SSL_SESSION, time: u64) -> u64;
}
unsafe extern "C" {
    /// SSL_SESSION_set_timeout sets `session`'s timeout to `timeout` and returns
    /// one. This function may be useful in writing tests but otherwise should not
    /// be used.
    pub fn SSL_SESSION_set_timeout(session: *mut SSL_SESSION, timeout: u32) -> u32;
}
unsafe extern "C" {
    /// SSL_SESSION_get0_id_context returns a pointer to a buffer containing
    /// `session`'s session ID context (see `SSL_CTX_set_session_id_context`) and
    /// sets `*out_len` to its length.
    pub fn SSL_SESSION_get0_id_context(
        session: *const SSL_SESSION,
        out_len: *mut ::core::ffi::c_uint,
    ) -> *const u8;
}
unsafe extern "C" {
    /// SSL_SESSION_set1_id_context sets `session`'s session ID context (see
    /// `SSL_CTX_set_session_id_context`) to `sid_ctx`. It returns one on success and
    /// zero on error. This function may be useful in writing tests but otherwise
    /// should not be used.
    pub fn SSL_SESSION_set1_id_context(
        session: *mut SSL_SESSION,
        sid_ctx: *const u8,
        sid_ctx_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_SESSION_should_be_single_use returns one if `session` should be
    /// single-use (TLS 1.3 and later) and zero otherwise.
    ///
    /// If this function returns one, clients retain multiple sessions and use each
    /// only once. This prevents passive observers from correlating connections with
    /// tickets. See RFC 8446, appendix C.4. If it returns zero, `session` cannot be
    /// used without leaking a correlator.
    pub fn SSL_SESSION_should_be_single_use(session: *const SSL_SESSION) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_SESSION_is_resumable returns one if `session` is complete and contains a
    /// session ID or ticket. It returns zero otherwise. Note this function does not
    /// ensure `session` will be resumed. It may be expired, dropped by the server,
    /// or associated with incompatible parameters.
    pub fn SSL_SESSION_is_resumable(session: *const SSL_SESSION) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_SESSION_has_ticket returns one if `session` has a ticket and zero
    /// otherwise.
    pub fn SSL_SESSION_has_ticket(session: *const SSL_SESSION) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_SESSION_get0_ticket sets `*out_ticket` and `*out_len` to `session`'s
    /// ticket, or NULL and zero if it does not have one. `out_ticket` may be NULL
    /// if only the ticket length is needed.
    pub fn SSL_SESSION_get0_ticket(
        session: *const SSL_SESSION,
        out_ticket: *mut *const u8,
        out_len: *mut usize,
    );
}
unsafe extern "C" {
    /// SSL_SESSION_set_ticket sets `session`'s ticket to `ticket`. It returns one on
    /// success and zero on error. This function may be useful in writing tests but
    /// otherwise should not be used.
    pub fn SSL_SESSION_set_ticket(
        session: *mut SSL_SESSION,
        ticket: *const u8,
        ticket_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_SESSION_get_ticket_lifetime_hint returns ticket lifetime hint of
    /// `session` in seconds or zero if none was set.
    pub fn SSL_SESSION_get_ticket_lifetime_hint(session: *const SSL_SESSION) -> u32;
}
unsafe extern "C" {
    /// SSL_SESSION_get0_cipher returns the cipher negotiated by the connection which
    /// established `session`.
    ///
    /// Note that, in TLS 1.3, there is no guarantee that resumptions with `session`
    /// will use that cipher. Prefer calling `SSL_get_current_cipher` on the `SSL`
    /// instead.
    pub fn SSL_SESSION_get0_cipher(session: *const SSL_SESSION) -> *const SSL_CIPHER;
}
unsafe extern "C" {
    /// SSL_SESSION_has_peer_sha256 returns one if `session` has a SHA-256 hash of
    /// the peer's certificate retained and zero if the peer did not present a
    /// certificate or if this was not enabled when `session` was created. See also
    /// `SSL_CTX_set_retain_only_sha256_of_client_certs`.
    pub fn SSL_SESSION_has_peer_sha256(session: *const SSL_SESSION) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_SESSION_get0_peer_sha256 sets `*out_ptr` and `*out_len` to the SHA-256
    /// hash of the peer certificate retained in `session`, or NULL and zero if it
    /// does not have one. See also `SSL_CTX_set_retain_only_sha256_of_client_certs`.
    pub fn SSL_SESSION_get0_peer_sha256(
        session: *const SSL_SESSION,
        out_ptr: *mut *const u8,
        out_len: *mut usize,
    );
}
unsafe extern "C" {
    /// SSL_SESSION_is_resumable_across_names returns one if `session` may be resumed
    /// with any identity in the server certificate and zero otherwise. See
    /// draft-ietf-tls-cross-sni-resumption.
    pub fn SSL_SESSION_is_resumable_across_names(session: *const SSL_SESSION)
        -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_set_session_cache_mode sets the session cache mode bits for `ctx` to
    /// `mode`. It returns the previous value.
    pub fn SSL_CTX_set_session_cache_mode(
        ctx: *mut SSL_CTX,
        mode: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_get_session_cache_mode returns the session cache mode bits for
    /// `ctx`
    pub fn SSL_CTX_get_session_cache_mode(ctx: *const SSL_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set_session, for a client, configures `ssl` to offer to resume `session`
    /// in the initial handshake and returns one. The caller retains ownership of
    /// `session`. Note that configuring a session assumes the authentication in the
    /// session is valid. For callers that wish to revalidate the session before
    /// offering, see `SSL_SESSION_get0_peer_certificates`,
    /// `SSL_SESSION_get0_signed_cert_timestamp_list`, and
    /// `SSL_SESSION_get0_ocsp_response`.
    ///
    /// It is an error to call this function after the handshake has begun.
    pub fn SSL_set_session(ssl: *mut SSL, session: *mut SSL_SESSION) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_set_timeout sets the lifetime, in seconds, of TLS 1.2 (or earlier)
    /// sessions created in `ctx` to `timeout`.
    pub fn SSL_CTX_set_timeout(ctx: *mut SSL_CTX, timeout: u32) -> u32;
}
unsafe extern "C" {
    /// SSL_CTX_set_session_psk_dhe_timeout sets the lifetime, in seconds, of TLS 1.3
    /// sessions created in `ctx` to `timeout`.
    pub fn SSL_CTX_set_session_psk_dhe_timeout(ctx: *mut SSL_CTX, timeout: u32);
}
unsafe extern "C" {
    /// SSL_CTX_get_timeout returns the lifetime, in seconds, of TLS 1.2 (or earlier)
    /// sessions created in `ctx`.
    pub fn SSL_CTX_get_timeout(ctx: *const SSL_CTX) -> u32;
}
unsafe extern "C" {
    /// SSL_CTX_set_session_id_context sets `ctx`'s session ID context to `sid_ctx`.
    /// It returns one on success and zero on error. The session ID context is an
    /// application-defined opaque byte string. A session will not be used in a
    /// connection without a matching session ID context.
    ///
    /// For a server, if `SSL_VERIFY_PEER` is enabled, it is an error to not set a
    /// session ID context.
    pub fn SSL_CTX_set_session_id_context(
        ctx: *mut SSL_CTX,
        sid_ctx: *const u8,
        sid_ctx_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set_session_id_context sets `ssl`'s session ID context to `sid_ctx`. It
    /// returns one on success and zero on error. See also
    /// `SSL_CTX_set_session_id_context`.
    pub fn SSL_set_session_id_context(
        ssl: *mut SSL,
        sid_ctx: *const u8,
        sid_ctx_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_get0_session_id_context returns a pointer to `ssl`'s session ID context
    /// and sets `*out_len` to its length.  It returns NULL on error.
    pub fn SSL_get0_session_id_context(ssl: *const SSL, out_len: *mut usize) -> *const u8;
}
unsafe extern "C" {
    /// SSL_CTX_sess_set_cache_size sets the maximum size of `ctx`'s internal session
    /// cache to `size`. It returns the previous value.
    pub fn SSL_CTX_sess_set_cache_size(
        ctx: *mut SSL_CTX,
        size: ::core::ffi::c_ulong,
    ) -> ::core::ffi::c_ulong;
}
unsafe extern "C" {
    /// SSL_CTX_sess_get_cache_size returns the maximum size of `ctx`'s internal
    /// session cache.
    pub fn SSL_CTX_sess_get_cache_size(ctx: *const SSL_CTX) -> ::core::ffi::c_ulong;
}
unsafe extern "C" {
    /// SSL_CTX_sess_number returns the number of sessions in `ctx`'s internal
    /// session cache.
    pub fn SSL_CTX_sess_number(ctx: *const SSL_CTX) -> usize;
}
unsafe extern "C" {
    /// SSL_CTX_add_session inserts `session` into `ctx`'s internal session cache. It
    /// returns one on success and zero on error or if `session` is already in the
    /// cache. The caller retains its reference to `session`.
    pub fn SSL_CTX_add_session(ctx: *mut SSL_CTX, session: *mut SSL_SESSION) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_remove_session removes `session` from `ctx`'s internal session cache.
    /// It returns one on success and zero if `session` was not in the cache.
    pub fn SSL_CTX_remove_session(
        ctx: *mut SSL_CTX,
        session: *mut SSL_SESSION,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_flush_sessions removes all sessions from `ctx` which have expired as
    /// of time `time`. If `time` is zero, all sessions are removed.
    pub fn SSL_CTX_flush_sessions(ctx: *mut SSL_CTX, time: u64);
}
/// SSL_new_session_cb is the type of the callback that is called when a new
/// session is established and ready to be cached.
pub type SSL_new_session_cb = ::core::option::Option<
    unsafe extern "C" fn(ssl: *mut SSL, session: *mut SSL_SESSION) -> ::core::ffi::c_int,
>;
unsafe extern "C" {
    /// SSL_CTX_sess_set_new_cb sets the callback to be called when a new session is
    /// established and ready to be cached. If the session cache is disabled (the
    /// appropriate one of `SSL_SESS_CACHE_CLIENT` or `SSL_SESS_CACHE_SERVER` is
    /// unset), the callback is not called.
    ///
    /// The callback is passed a reference to `session`. It returns one if it takes
    /// ownership (and then calls `SSL_SESSION_free` when done) and zero otherwise. A
    /// consumer which places `session` into an in-memory cache will likely return
    /// one, with the cache calling `SSL_SESSION_free`. A consumer which serializes
    /// `session` with `SSL_SESSION_to_bytes` may not need to retain `session` and
    /// will likely return zero. Returning one is equivalent to calling
    /// `SSL_SESSION_up_ref` and then returning zero.
    ///
    /// Note: For a client, the callback may be called on abbreviated handshakes if a
    /// ticket is renewed. Further, it may not be called until some time after
    /// `SSL_do_handshake` or `SSL_connect` completes if False Start is enabled. Thus
    /// it's recommended to use this callback over calling `SSL_get_session` on
    /// handshake completion.
    pub fn SSL_CTX_sess_set_new_cb(ctx: *mut SSL_CTX, new_session_cb: SSL_new_session_cb);
}
unsafe extern "C" {
    /// SSL_CTX_sess_get_new_cb returns the callback set by
    /// `SSL_CTX_sess_set_new_cb`.
    pub fn SSL_CTX_sess_get_new_cb(ctx: *mut SSL_CTX) -> SSL_new_session_cb;
}
/// SSL_remove_session_cb is the type of the callback that is called when a
/// session is removed from the internal session cache.
pub type SSL_remove_session_cb =
    ::core::option::Option<unsafe extern "C" fn(ctx: *mut SSL_CTX, session: *mut SSL_SESSION)>;
unsafe extern "C" {
    /// SSL_CTX_sess_set_remove_cb sets a callback which is called when a session is
    /// removed from the internal session cache.
    ///
    /// TODO(davidben): What is the point of this callback? It seems useless since it
    /// only fires on sessions in the internal cache.
    pub fn SSL_CTX_sess_set_remove_cb(ctx: *mut SSL_CTX, remove_session_cb: SSL_remove_session_cb);
}
unsafe extern "C" {
    /// SSL_CTX_sess_get_remove_cb returns the callback set by
    /// `SSL_CTX_sess_set_remove_cb`.
    pub fn SSL_CTX_sess_get_remove_cb(ctx: *mut SSL_CTX) -> SSL_remove_session_cb;
}
/// SSL_get_session_cb is the type of the callback that is called to look up a
/// session by ID for a server.
pub type SSL_get_session_cb = ::core::option::Option<
    unsafe extern "C" fn(
        ssl: *mut SSL,
        id: *const u8,
        id_len: ::core::ffi::c_int,
        out_copy: *mut ::core::ffi::c_int,
    ) -> *mut SSL_SESSION,
>;
unsafe extern "C" {
    /// SSL_CTX_sess_set_get_cb sets a callback to look up a session by ID for a
    /// server. The callback is passed the session ID and should return a matching
    /// `SSL_SESSION` or NULL if not found. It should set `*out_copy` to zero and
    /// return a new reference to the session. This callback is not used for a
    /// client.
    ///
    /// For historical reasons, if `*out_copy` is set to one (default), the SSL
    /// library will take a new reference to the returned `SSL_SESSION`, expecting
    /// the callback to return a non-owning pointer. This is not recommended. If
    /// `ctx` and thus the callback is used on multiple threads, the session may be
    /// removed and invalidated before the SSL library calls `SSL_SESSION_up_ref`,
    /// whereas the callback may synchronize internally.
    ///
    /// To look up a session asynchronously, the callback may return
    /// `SSL_magic_pending_session_ptr`. See the documentation for that function and
    /// `SSL_ERROR_PENDING_SESSION`.
    ///
    /// If the internal session cache is enabled, the callback is only consulted if
    /// the internal cache does not return a match.
    pub fn SSL_CTX_sess_set_get_cb(ctx: *mut SSL_CTX, get_session_cb: SSL_get_session_cb);
}
unsafe extern "C" {
    /// SSL_CTX_sess_get_get_cb returns the callback set by
    /// `SSL_CTX_sess_set_get_cb`.
    pub fn SSL_CTX_sess_get_get_cb(ctx: *mut SSL_CTX) -> SSL_get_session_cb;
}
unsafe extern "C" {
    /// SSL_magic_pending_session_ptr returns a magic `SSL_SESSION`* which indicates
    /// that the session isn't currently unavailable. `SSL_get_error` will then
    /// return `SSL_ERROR_PENDING_SESSION` and the handshake can be retried later
    /// when the lookup has completed.
    pub fn SSL_magic_pending_session_ptr() -> *mut SSL_SESSION;
}
unsafe extern "C" {
    /// SSL_CTX_set_resumption_across_names_enabled configures whether `ctx`, as a
    /// TLS 1.3 server, signals its sessions are compatible with any identity in the
    /// server certificate, e.g. all DNS names in the subjectAlternateNames list.
    /// This does not change BoringSSL's resumption behavior, only whether it signals
    /// this to the client. See draft-ietf-tls-cross-sni-resumption.
    ///
    /// When this is enabled, all identities in the server certificate should by
    /// hosted by servers that accept TLS 1.3 tickets issued by `ctx`. The connection
    /// will otherwise function, but performance may suffer from clients wasting
    /// single-use tickets.
    pub fn SSL_CTX_set_resumption_across_names_enabled(
        ctx: *mut SSL_CTX,
        enabled: ::core::ffi::c_int,
    );
}
unsafe extern "C" {
    /// SSL_set_resumption_across_names_enabled configures whether `ssl`, as a
    /// TLS 1.3 server, signals its sessions are compatible with any identity in the
    /// server certificate, e.g. all DNS names in the subjectAlternateNames list.
    /// This does not change BoringSSL's resumption behavior, only whether it signals
    /// this to the client. See draft-ietf-tls-cross-sni-resumption.
    ///
    /// When this is enabled, all identities in the server certificate should by
    /// hosted by servers that accept TLS 1.3 tickets issued by `ssl`. The connection
    /// will otherwise function, but performance may suffer from clients wasting
    /// single-use tickets.
    pub fn SSL_set_resumption_across_names_enabled(ssl: *mut SSL, enabled: ::core::ffi::c_int);
}
unsafe extern "C" {
    /// SSL_CTX_get_tlsext_ticket_keys writes `ctx`'s session ticket key material to
    /// `len` bytes of `out`. It returns one on success and zero if `len` is not
    /// 48. If `out` is NULL, it returns 48 instead.
    pub fn SSL_CTX_get_tlsext_ticket_keys(
        ctx: *mut SSL_CTX,
        out: *mut ::core::ffi::c_void,
        len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_set_tlsext_ticket_keys sets `ctx`'s session ticket key material to
    /// `len` bytes of `in`. It returns one on success and zero if `len` is not
    /// 48. If `in` is NULL, it returns 48 instead.
    pub fn SSL_CTX_set_tlsext_ticket_keys(
        ctx: *mut SSL_CTX,
        in_: *const ::core::ffi::c_void,
        len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_set_tlsext_ticket_key_cb sets the ticket callback to `callback` and
    /// returns one. `callback` will be called when encrypting a new ticket and when
    /// decrypting a ticket from the client.
    ///
    /// In both modes, `ctx` and `hmac_ctx` will already have been initialized with
    /// `EVP_CIPHER_CTX_init` and `HMAC_CTX_init`, respectively. `callback`
    /// configures `hmac_ctx` with an HMAC digest and key, and configures `ctx`
    /// for encryption or decryption, based on the mode.
    ///
    /// When encrypting a new ticket, `encrypt` will be one. It writes a public
    /// 16-byte key name to `key_name` and a fresh IV to `iv`. The output IV length
    /// must match `EVP_CIPHER_CTX_iv_length` of the cipher selected. In this mode,
    /// `callback` returns 1 on success, 0 to decline sending a ticket, and -1 on
    /// error.
    ///
    /// When decrypting a ticket, `encrypt` will be zero. `key_name` will point to a
    /// 16-byte key name and `iv` points to an IV. The length of the IV consumed must
    /// match `EVP_CIPHER_CTX_iv_length` of the cipher selected. In this mode,
    /// `callback` returns -1 to abort the handshake, 0 if the ticket key was
    /// unrecognized, and 1 or 2 on success. If it returns 2, the ticket will be
    /// renewed. This may be used to re-key the ticket.
    ///
    /// WARNING: `callback` wildly breaks the usual return value convention and is
    /// called in two different modes.
    pub fn SSL_CTX_set_tlsext_ticket_key_cb(
        ctx: *mut SSL_CTX,
        callback: ::core::option::Option<
            unsafe extern "C" fn(
                ssl: *mut SSL,
                key_name: *mut u8,
                iv: *mut u8,
                ctx: *mut EVP_CIPHER_CTX,
                hmac_ctx: *mut HMAC_CTX,
                encrypt: ::core::ffi::c_int,
            ) -> ::core::ffi::c_int,
        >,
    ) -> ::core::ffi::c_int;
}
/// ssl_ticket_aead_success indicates that the ticket was successfully
/// decrypted.
pub const ssl_ticket_aead_result_t_ssl_ticket_aead_success: ssl_ticket_aead_result_t = 0;
/// ssl_ticket_aead_retry indicates that the operation could not be
/// immediately completed and must be reattempted, via `open`, at a later
/// point.
pub const ssl_ticket_aead_result_t_ssl_ticket_aead_retry: ssl_ticket_aead_result_t = 1;
/// ssl_ticket_aead_ignore_ticket indicates that the ticket should be ignored
/// (i.e. is corrupt or otherwise undecryptable).
pub const ssl_ticket_aead_result_t_ssl_ticket_aead_ignore_ticket: ssl_ticket_aead_result_t = 2;
/// ssl_ticket_aead_error indicates that a fatal error occurred and the
/// handshake should be terminated.
pub const ssl_ticket_aead_result_t_ssl_ticket_aead_error: ssl_ticket_aead_result_t = 3;
/// ssl_ticket_aead_result_t enumerates the possible results from decrypting a
/// ticket with an `SSL_TICKET_AEAD_METHOD`.
pub type ssl_ticket_aead_result_t = ::core::ffi::c_uint;
/// ssl_ticket_aead_method_st (aka `SSL_TICKET_AEAD_METHOD`) contains methods
/// for encrypting and decrypting session tickets.
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct ssl_ticket_aead_method_st {
    /// max_overhead returns the maximum number of bytes of overhead that `seal`
    /// may add.
    pub max_overhead: ::core::option::Option<unsafe extern "C" fn(ssl: *mut SSL) -> usize>,
    /// seal encrypts and authenticates `in_len` bytes from `in`, writes, at most,
    /// `max_out_len` bytes to `out`, and puts the number of bytes written in
    /// `*out_len`. The `in` and `out` buffers may be equal but will not otherwise
    /// alias. It returns one on success or zero on error. If the function returns
    /// but `*out_len` is zero, BoringSSL will skip sending a ticket.
    pub seal: ::core::option::Option<
        unsafe extern "C" fn(
            ssl: *mut SSL,
            out: *mut u8,
            out_len: *mut usize,
            max_out_len: usize,
            in_: *const u8,
            in_len: usize,
        ) -> ::core::ffi::c_int,
    >,
    /// open authenticates and decrypts `in_len` bytes from `in`, writes, at most,
    /// `max_out_len` bytes of plaintext to `out`, and puts the number of bytes
    /// written in `*out_len`. The `in` and `out` buffers may be equal but will
    /// not otherwise alias. See `ssl_ticket_aead_result_t` for details of the
    /// return values. In the case that a retry is indicated, the caller should
    /// arrange for the high-level operation on `ssl` to be retried when the
    /// operation is completed, which will result in another call to `open`.
    pub open: ::core::option::Option<
        unsafe extern "C" fn(
            ssl: *mut SSL,
            out: *mut u8,
            out_len: *mut usize,
            max_out_len: usize,
            in_: *const u8,
            in_len: usize,
        ) -> ssl_ticket_aead_result_t,
    >,
}
unsafe extern "C" {
    /// SSL_CTX_set_ticket_aead_method configures a custom ticket AEAD method table
    /// on `ctx`. `aead_method` must remain valid for the lifetime of `ctx`.
    pub fn SSL_CTX_set_ticket_aead_method(
        ctx: *mut SSL_CTX,
        aead_method: *const SSL_TICKET_AEAD_METHOD,
    );
}
unsafe extern "C" {
    /// SSL_process_tls13_new_session_ticket processes an unencrypted TLS 1.3
    /// NewSessionTicket message from `buf` and returns a resumable `SSL_SESSION`,
    /// or NULL on error. The caller takes ownership of the returned session and
    /// must call `SSL_SESSION_free` to free it.
    ///
    /// `buf` contains `buf_len` bytes that represents a complete NewSessionTicket
    /// message including its header, i.e., one byte for the type (0x04) and three
    /// bytes for the length. `buf` must contain only one such message.
    ///
    /// This function may be used to process NewSessionTicket messages in TLS 1.3
    /// clients that are handling the record layer externally.
    pub fn SSL_process_tls13_new_session_ticket(
        ssl: *mut SSL,
        buf: *const u8,
        buf_len: usize,
    ) -> *mut SSL_SESSION;
}
unsafe extern "C" {
    /// SSL_CTX_set_num_tickets configures `ctx` to send `num_tickets` immediately
    /// after a successful TLS 1.3 handshake as a server. It returns one. Large
    /// values of `num_tickets` will be capped within the library.
    ///
    /// By default, BoringSSL sends two tickets.
    pub fn SSL_CTX_set_num_tickets(ctx: *mut SSL_CTX, num_tickets: usize) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_get_num_tickets returns the number of tickets `ctx` will send
    /// immediately after a successful TLS 1.3 handshake as a server.
    pub fn SSL_CTX_get_num_tickets(ctx: *const SSL_CTX) -> usize;
}
unsafe extern "C" {
    /// SSL_CTX_set1_group_ids sets the preferred groups for `ctx` to `group_ids`.
    /// Each element of `group_ids` should be a unique one of the `SSL_GROUP_*`
    /// constants. If `group_ids` is empty, a default list will be set instead. It
    /// returns one on success and zero on failure.
    pub fn SSL_CTX_set1_group_ids(
        ctx: *mut SSL_CTX,
        group_ids: *const u16,
        num_group_ids: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set1_group_ids sets the preferred groups for `ssl` to `group_ids`. Each
    /// element of `group_ids` should be a unique one of the `SSL_GROUP_*` constants.
    /// If `group_ids` is empty, a default list will be set instead. It returns one
    /// on success and zero on failure.
    pub fn SSL_set1_group_ids(
        ssl: *mut SSL,
        group_ids: *const u16,
        num_group_ids: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_set1_group_ids_with_flags sets the preferred groups for `ctx` to
    /// `group_ids`, using the corresponding `flags` for each element, which is a set
    /// of SSL_GROUP_FLAG_* values ORed together. Each element of `group_ids` should
    /// be a unique one of the `SSL_GROUP_*` constants. If `group_ids` is empty, a
    /// default list of groups and flags defaulting to zero will be set instead.
    /// `group_ids` and `flags` should both have `num_group_ids` elements. It returns
    /// one on success and zero on failure.
    pub fn SSL_CTX_set1_group_ids_with_flags(
        ctx: *mut SSL_CTX,
        group_ids: *const u16,
        flags: *const u32,
        num_group_ids: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set1_group_ids_with_flags sets the preferred groups for `ssl` to
    /// `group_ids`, using the corresponding `flags` for each element, which is a set
    /// of SSL_GROUP_FLAG_* values ORed together. Each element of `group_ids` should
    /// be a unique one of the `SSL_GROUP_*` constants. If `group_ids` is empty, a
    /// default list of groups and flags defaulting to zero will be set instead.
    /// `group_ids` and `flags` should both have `num_group_ids` elements.  It
    /// returns one on success and zero on failure.
    pub fn SSL_set1_group_ids_with_flags(
        ssl: *mut SSL,
        group_ids: *const u16,
        flags: *const u32,
        num_group_ids: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_get_group_id returns the ID of the group used by `ssl`'s most recently
    /// completed handshake, or 0 if not applicable.
    pub fn SSL_get_group_id(ssl: *const SSL) -> u16;
}
unsafe extern "C" {
    /// SSL_get_group_name returns a human-readable name for the group specified by
    /// the given TLS group ID, or NULL if the group is unknown.
    pub fn SSL_get_group_name(group_id: u16) -> *const ::core::ffi::c_char;
}
unsafe extern "C" {
    /// SSL_get_all_group_names outputs a list of possible strings
    /// `SSL_get_group_name` may return in this version of BoringSSL. It writes at
    /// most `max_out` entries to `out` and returns the total number it would have
    /// written, if `max_out` had been large enough. `max_out` may be initially set
    /// to zero to size the output.
    ///
    /// This function is only intended to help initialize tables in callers that want
    /// possible strings pre-declared. This list would not be suitable to set a list
    /// of supported features. It is in no particular order, and may contain
    /// placeholder, experimental, or deprecated values that do not apply to every
    /// caller. Future versions of BoringSSL may also return strings not in this
    /// list, so this does not apply if, say, sending strings across services.
    pub fn SSL_get_all_group_names(out: *mut *const ::core::ffi::c_char, max_out: usize) -> usize;
}
unsafe extern "C" {
    /// SSL_CTX_set1_groups sets the preferred groups for `ctx` to be `groups`. Each
    /// element of `groups` should be a unique `NID_*` constant from nid.h. If
    /// `groups` is empty, a default list will be set instead. It returns one on
    /// success and zero on failure.
    pub fn SSL_CTX_set1_groups(
        ctx: *mut SSL_CTX,
        groups: *const ::core::ffi::c_int,
        num_groups: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set1_groups sets the preferred groups for `ssl` to be `groups`. Each
    /// element of `groups` should be a unique `NID_*` constant from nid.h. If
    /// `groups` is empty, a default list will be set instead. It returns one on
    /// success and zero on failure.
    pub fn SSL_set1_groups(
        ssl: *mut SSL,
        groups: *const ::core::ffi::c_int,
        num_groups: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_set1_groups_list decodes `groups` as a non-empty colon-separated list
    /// of group names (e.g. "X25519" or "P-256") and sets `ctx`'s preferred groups
    /// to the result. The list must not contain duplicates. It returns one on
    /// success and zero on failure.
    pub fn SSL_CTX_set1_groups_list(
        ctx: *mut SSL_CTX,
        groups: *const ::core::ffi::c_char,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set1_groups_list decodes `groups` as a non-empty colon-separated list of
    /// group names (e.g. "X25519" or "P-256") and sets `ssl`'s preferred groups to
    /// the result. The list must not contain duplicates. It returns one on success
    /// and zero on failure.
    pub fn SSL_set1_groups_list(
        ssl: *mut SSL,
        groups: *const ::core::ffi::c_char,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_get_negotiated_group returns the NID of the group used by `ssl`'s most
    /// recently completed handshake, or `NID_undef` if not applicable.
    pub fn SSL_get_negotiated_group(ssl: *const SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set1_client_key_shares, when called by a client before the handshake,
    /// configures `ssl` to send a key_share extension in the initial ClientHello
    /// containing exactly the groups given by `group_ids`, in the order given. Each
    /// member of `group_ids` should be one of the `SSL_GROUP_*` constants, and they
    /// must be unique. This function returns one on success and zero on failure.
    ///
    /// If non-empty, the sequence of `group_ids` must be a (not necessarily
    /// contiguous) subsequence of the groups supported by `ssl`, which may have been
    /// configured explicitly on `ssl` or its context, or populated by default.
    /// Caller should finish configuring the group list before calling this function.
    /// Changing the supported groups for `ssl` after having set client key shares
    /// will result in the key share selections being reset if this constraint no
    /// longer holds.
    ///
    /// Setting an empty sequence of `group_ids` results in an empty client
    /// key_share, which will cause the handshake to always take an extra round-trip
    /// for HelloRetryRequest.
    ///
    /// An extra round-trip will be needed if the server's choice of group is not
    /// among the key shares sent; conversely, sending any key shares other than the
    /// server's choice wastes CPU and bandwidth (the latter is particularly costly
    /// for post-quantum key exchanges). To avoid these sub-optimal outcomes,
    /// key shares should be chosen such that they are likely to be supported by the
    /// peer server.
    pub fn SSL_set1_client_key_shares(
        ssl: *mut SSL,
        group_ids: *const u16,
        num_group_ids: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set1_server_supported_groups_hint, when `ssl` is a client, indicates that
    /// the server is likely to support groups listed in `server_groups`, in order of
    /// decreasing server preference. This function returns one on success and zero
    /// on error. This may be used when receiving a server hint, such as described in
    /// draft-ietf-tls-key-share-prediction.
    ///
    /// If called, `ssl` will try to predict the server's selected named group based
    /// on `ssl`'s local preferences and `server_groups`. If it predicts a group, it
    /// will then send an initial ClientHello with key_share extension containing
    /// only this prediction. In this case, the prediction will supersede any
    /// configuration from `SSL_set1_client_key_shares`. This is a convenience
    /// function so that callers do not need to process the server preference list
    /// themselves.
    ///
    /// Groups listed in `server_groups` should be identified by their TLS group IDs,
    /// such as the `SSL_GROUP_*` constants. A server may implement groups not known
    /// to BoringSSL, so `server_groups` may contain unrecognized group IDs. If so,
    /// this function will ignore them.
    pub fn SSL_set1_server_supported_groups_hint(
        ssl: *mut SSL,
        server_groups: *const u16,
        num_server_groups: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_set_verify configures certificate verification behavior. `mode` is
    /// one of the `SSL_VERIFY_*` values defined above. `callback` should be NULL.
    ///
    /// If `callback` is non-NULL, it is called as in `X509_STORE_CTX_set_verify_cb`,
    /// which is a deprecated and fragile mechanism to run the default certificate
    /// verification process, but suppress individual errors in it. See
    /// `X509_STORE_CTX_set_verify_cb` for details, If set, the callback may use
    /// `SSL_get_ex_data_X509_STORE_CTX_idx` with `X509_STORE_CTX_get_ex_data` to
    /// look up the `SSL` from `store_ctx`.
    ///
    /// WARNING: `callback` is not suitable for implementing custom certificate
    /// check, accepting all certificates, or extracting the certificate after
    /// verification. It does not replace the default process and is called multiple
    /// times throughout that process. It is also very difficult to implement this
    /// callback safely, without inadvertently relying on implementation details or
    /// making incorrect assumptions about when the callback is called.
    ///
    /// Instead, use `SSL_CTX_set_custom_verify` or
    /// `SSL_CTX_set_cert_verify_callback` to customize certificate verification.
    /// Those callbacks can inspect the peer-sent chain, call `X509_verify_cert` and
    /// inspect the result, or perform other operations more straightforwardly.
    pub fn SSL_CTX_set_verify(
        ctx: *mut SSL_CTX,
        mode: ::core::ffi::c_int,
        callback: ::core::option::Option<
            unsafe extern "C" fn(
                ok: ::core::ffi::c_int,
                store_ctx: *mut X509_STORE_CTX,
            ) -> ::core::ffi::c_int,
        >,
    );
}
unsafe extern "C" {
    /// SSL_set_verify configures certificate verification behavior. `mode` is one of
    /// the `SSL_VERIFY_*` values defined above. `callback` should be NULL.
    ///
    /// If `callback` is non-NULL, it is called as in `X509_STORE_CTX_set_verify_cb`,
    /// which is a deprecated and fragile mechanism to run the default certificate
    /// verification process, but suppress individual errors in it. See
    /// `X509_STORE_CTX_set_verify_cb` for details, If set, the callback may use
    /// `SSL_get_ex_data_X509_STORE_CTX_idx` with `X509_STORE_CTX_get_ex_data` to
    /// look up the `SSL` from `store_ctx`.
    ///
    /// WARNING: `callback` is not suitable for implementing custom certificate
    /// check, accepting all certificates, or extracting the certificate after
    /// verification. It does not replace the default process and is called multiple
    /// times throughout that process. It is also very difficult to implement this
    /// callback safely, without inadvertently relying on implementation details or
    /// making incorrect assumptions about when the callback is called.
    ///
    /// Instead, use `SSL_set_custom_verify` or `SSL_set_cert_verify_callback` to
    /// customize certificate verification. Those callbacks can inspect the peer-sent
    /// chain, call `X509_verify_cert` and inspect the result, or perform other
    /// operations more straightforwardly.
    pub fn SSL_set_verify(
        ssl: *mut SSL,
        mode: ::core::ffi::c_int,
        callback: ::core::option::Option<
            unsafe extern "C" fn(
                ok: ::core::ffi::c_int,
                store_ctx: *mut X509_STORE_CTX,
            ) -> ::core::ffi::c_int,
        >,
    );
}
pub const ssl_verify_result_t_ssl_verify_ok: ssl_verify_result_t = 0;
pub const ssl_verify_result_t_ssl_verify_invalid: ssl_verify_result_t = 1;
pub const ssl_verify_result_t_ssl_verify_retry: ssl_verify_result_t = 2;
pub type ssl_verify_result_t = ::core::ffi::c_uint;
unsafe extern "C" {
    /// SSL_CTX_set_custom_verify configures certificate verification. `mode` is one
    /// of the `SSL_VERIFY_*` values defined above. `callback` performs the
    /// certificate verification.
    ///
    /// The callback may call `SSL_get0_peer_certificates` for the certificate chain
    /// to validate. The callback should return `ssl_verify_ok` if the certificate is
    /// valid. If the certificate is invalid, the callback should return
    /// `ssl_verify_invalid` and optionally set `*out_alert` to an alert to send to
    /// the peer. Some useful alerts include `SSL_AD_CERTIFICATE_EXPIRED`,
    /// `SSL_AD_CERTIFICATE_REVOKED`, `SSL_AD_UNKNOWN_CA`, `SSL_AD_BAD_CERTIFICATE`,
    /// `SSL_AD_CERTIFICATE_UNKNOWN`, and `SSL_AD_INTERNAL_ERROR`. See RFC 5246
    /// section 7.2.2 for their precise meanings. If unspecified,
    /// `SSL_AD_CERTIFICATE_UNKNOWN` will be sent by default.
    ///
    /// To verify a certificate asynchronously, the callback may return
    /// `ssl_verify_retry`. The handshake will then pause with `SSL_get_error`
    /// returning `SSL_ERROR_WANT_CERTIFICATE_VERIFY`.
    pub fn SSL_CTX_set_custom_verify(
        ctx: *mut SSL_CTX,
        mode: ::core::ffi::c_int,
        callback: ::core::option::Option<
            unsafe extern "C" fn(ssl: *mut SSL, out_alert: *mut u8) -> ssl_verify_result_t,
        >,
    );
}
unsafe extern "C" {
    /// SSL_set_custom_verify behaves like `SSL_CTX_set_custom_verify` but configures
    /// an individual `SSL`.
    pub fn SSL_set_custom_verify(
        ssl: *mut SSL,
        mode: ::core::ffi::c_int,
        callback: ::core::option::Option<
            unsafe extern "C" fn(ssl: *mut SSL, out_alert: *mut u8) -> ssl_verify_result_t,
        >,
    );
}
unsafe extern "C" {
    /// SSL_CTX_get_verify_mode returns `ctx`'s verify mode, set by
    /// `SSL_CTX_set_verify`.
    pub fn SSL_CTX_get_verify_mode(ctx: *const SSL_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_get_verify_mode returns `ssl`'s verify mode, set by `SSL_CTX_set_verify`
    /// or `SSL_set_verify`.  It returns -1 on error.
    pub fn SSL_get_verify_mode(ssl: *const SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_get_verify_callback returns the callback set by
    /// `SSL_CTX_set_verify`.
    pub fn SSL_CTX_get_verify_callback(
        ctx: *const SSL_CTX,
    ) -> ::core::option::Option<
        unsafe extern "C" fn(
            ctx: ::core::ffi::c_int,
            arg1: *mut X509_STORE_CTX,
        ) -> ::core::ffi::c_int,
    >;
}
unsafe extern "C" {
    /// SSL_get_verify_callback returns the callback set by `SSL_CTX_set_verify` or
    /// `SSL_set_verify`.
    pub fn SSL_get_verify_callback(
        ssl: *const SSL,
    ) -> ::core::option::Option<
        unsafe extern "C" fn(
            ssl: ::core::ffi::c_int,
            arg1: *mut X509_STORE_CTX,
        ) -> ::core::ffi::c_int,
    >;
}
unsafe extern "C" {
    /// SSL_set1_host sets a DNS name that will be required to be present in the
    /// verified leaf certificate. It returns one on success and zero on error.
    ///
    /// Note: unless _some_ name checking is performed, certificate validation is
    /// ineffective. Simply checking that a host has some certificate from a CA is
    /// rarely meaningful—you have to check that the CA believed that the host was
    /// who you expect to be talking to.
    ///
    /// By default, both subject alternative names and the subject's common name
    /// attribute are checked. The latter has long been deprecated, so callers should
    /// call `SSL_set_hostflags` with `X509_CHECK_FLAG_NEVER_CHECK_SUBJECT` to use
    /// the standard behavior. https://crbug.com/boringssl/464 tracks fixing the
    /// default.
    pub fn SSL_set1_host(ssl: *mut SSL, hostname: *const ::core::ffi::c_char)
        -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set_hostflags calls `X509_VERIFY_PARAM_set_hostflags` on the
    /// `X509_VERIFY_PARAM` associated with this `SSL*`. `flags` should be some
    /// combination of the `X509_CHECK_*` constants.
    pub fn SSL_set_hostflags(ssl: *mut SSL, flags: ::core::ffi::c_uint);
}
unsafe extern "C" {
    /// SSL_CTX_set_verify_depth sets the maximum depth of a certificate chain
    /// accepted in verification. This count excludes both the target certificate and
    /// the trust anchor (root certificate).
    pub fn SSL_CTX_set_verify_depth(ctx: *mut SSL_CTX, depth: ::core::ffi::c_int);
}
unsafe extern "C" {
    /// SSL_set_verify_depth sets the maximum depth of a certificate chain accepted
    /// in verification. This count excludes both the target certificate and the
    /// trust anchor (root certificate).
    pub fn SSL_set_verify_depth(ssl: *mut SSL, depth: ::core::ffi::c_int);
}
unsafe extern "C" {
    /// SSL_CTX_get_verify_depth returns the maximum depth of a certificate accepted
    /// in verification.
    pub fn SSL_CTX_get_verify_depth(ctx: *const SSL_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_get_verify_depth returns the maximum depth of a certificate accepted in
    /// verification.
    pub fn SSL_get_verify_depth(ssl: *const SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_set1_param sets verification parameters from `param`. It returns one
    /// on success and zero on failure. The caller retains ownership of `param`.
    pub fn SSL_CTX_set1_param(
        ctx: *mut SSL_CTX,
        param: *const X509_VERIFY_PARAM,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set1_param sets verification parameters from `param`. It returns one on
    /// success and zero on failure. The caller retains ownership of `param`.
    pub fn SSL_set1_param(ssl: *mut SSL, param: *const X509_VERIFY_PARAM) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_get0_param returns `ctx`'s `X509_VERIFY_PARAM` for certificate
    /// verification. The caller must not release the returned pointer but may call
    /// functions on it to configure it.
    pub fn SSL_CTX_get0_param(ctx: *mut SSL_CTX) -> *mut X509_VERIFY_PARAM;
}
unsafe extern "C" {
    /// SSL_get0_param returns `ssl`'s `X509_VERIFY_PARAM` for certificate
    /// verification. The caller must not release the returned pointer but may call
    /// functions on it to configure it.
    pub fn SSL_get0_param(ssl: *mut SSL) -> *mut X509_VERIFY_PARAM;
}
unsafe extern "C" {
    /// SSL_CTX_set_purpose sets `ctx`'s `X509_VERIFY_PARAM`'s 'purpose' parameter to
    /// `purpose`. It returns one on success and zero on error.
    pub fn SSL_CTX_set_purpose(
        ctx: *mut SSL_CTX,
        purpose: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set_purpose sets `ssl`'s `X509_VERIFY_PARAM`'s 'purpose' parameter to
    /// `purpose`. It returns one on success and zero on error.
    pub fn SSL_set_purpose(ssl: *mut SSL, purpose: ::core::ffi::c_int) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_set_trust sets `ctx`'s `X509_VERIFY_PARAM`'s 'trust' parameter to
    /// `trust`. It returns one on success and zero on error.
    pub fn SSL_CTX_set_trust(ctx: *mut SSL_CTX, trust: ::core::ffi::c_int) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set_trust sets `ssl`'s `X509_VERIFY_PARAM`'s 'trust' parameter to
    /// `trust`. It returns one on success and zero on error.
    pub fn SSL_set_trust(ssl: *mut SSL, trust: ::core::ffi::c_int) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_set_cert_store sets `ctx`'s certificate store to `store`. It takes
    /// ownership of `store`. The store is used for certificate verification.
    ///
    /// The store is also used for the auto-chaining feature, but this is deprecated.
    /// See also `SSL_MODE_NO_AUTO_CHAIN`.
    pub fn SSL_CTX_set_cert_store(ctx: *mut SSL_CTX, store: *mut X509_STORE);
}
unsafe extern "C" {
    /// SSL_CTX_get_cert_store returns `ctx`'s certificate store.
    pub fn SSL_CTX_get_cert_store(ctx: *const SSL_CTX) -> *mut X509_STORE;
}
unsafe extern "C" {
    /// SSL_CTX_set_default_verify_paths calls `X509_STORE_set_default_paths` on
    /// `ctx`'s store. See that function for details.
    ///
    /// Using this function is not recommended. In OpenSSL, these defaults are
    /// determined by OpenSSL's install prefix. There is no corresponding concept for
    /// BoringSSL. Future versions of BoringSSL may change or remove this
    /// functionality.
    pub fn SSL_CTX_set_default_verify_paths(ctx: *mut SSL_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_load_verify_locations calls `X509_STORE_load_locations` on `ctx`'s
    /// store. See that function for details.
    pub fn SSL_CTX_load_verify_locations(
        ctx: *mut SSL_CTX,
        ca_file: *const ::core::ffi::c_char,
        ca_dir: *const ::core::ffi::c_char,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_get_verify_result returns the result of certificate verification. It is
    /// either `X509_V_OK` or a `X509_V_ERR_*` value.
    pub fn SSL_get_verify_result(ssl: *const SSL) -> ::core::ffi::c_long;
}
unsafe extern "C" {
    /// SSL_alert_from_verify_result returns the SSL alert code, such as
    /// `SSL_AD_CERTIFICATE_EXPIRED`, that corresponds to an `X509_V_ERR_*` value.
    /// The return value is always an alert, even when `result` is `X509_V_OK`.
    pub fn SSL_alert_from_verify_result(result: ::core::ffi::c_long) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_get_ex_data_X509_STORE_CTX_idx returns the ex_data index used to look up
    /// the `SSL` associated with an `X509_STORE_CTX` in the verify callback.
    pub fn SSL_get_ex_data_X509_STORE_CTX_idx() -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_set_cert_verify_callback sets a custom callback to be called on
    /// certificate verification rather than `X509_verify_cert`. `store_ctx` contains
    /// the verification parameters. The callback should return one on success and
    /// zero on fatal error. It may use `X509_STORE_CTX_set_error` to set a
    /// verification result.
    ///
    /// The callback may use `SSL_get_ex_data_X509_STORE_CTX_idx` to recover the
    /// `SSL` object from `store_ctx`.
    pub fn SSL_CTX_set_cert_verify_callback(
        ctx: *mut SSL_CTX,
        callback: ::core::option::Option<
            unsafe extern "C" fn(
                store_ctx: *mut X509_STORE_CTX,
                arg: *mut ::core::ffi::c_void,
            ) -> ::core::ffi::c_int,
        >,
        arg: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    /// SSL_enable_signed_cert_timestamps causes `ssl` (which must be the client end
    /// of a connection) to request SCTs from the server. See
    /// https://tools.ietf.org/html/rfc6962.
    ///
    /// Call `SSL_get0_signed_cert_timestamp_list` to recover the SCT after the
    /// handshake.
    pub fn SSL_enable_signed_cert_timestamps(ssl: *mut SSL);
}
unsafe extern "C" {
    /// SSL_CTX_enable_signed_cert_timestamps enables SCT requests on all client SSL
    /// objects created from `ctx`.
    ///
    /// Call `SSL_get0_signed_cert_timestamp_list` to recover the SCT after the
    /// handshake.
    pub fn SSL_CTX_enable_signed_cert_timestamps(ctx: *mut SSL_CTX);
}
unsafe extern "C" {
    /// SSL_enable_ocsp_stapling causes `ssl` (which must be the client end of a
    /// connection) to request a stapled OCSP response from the server.
    ///
    /// Call `SSL_get0_ocsp_response` to recover the OCSP response after the
    /// handshake.
    pub fn SSL_enable_ocsp_stapling(ssl: *mut SSL);
}
unsafe extern "C" {
    /// SSL_CTX_enable_ocsp_stapling enables OCSP stapling on all client SSL objects
    /// created from `ctx`.
    ///
    /// Call `SSL_get0_ocsp_response` to recover the OCSP response after the
    /// handshake.
    pub fn SSL_CTX_enable_ocsp_stapling(ctx: *mut SSL_CTX);
}
unsafe extern "C" {
    /// SSL_CTX_set0_verify_cert_store sets an `X509_STORE` that will be used
    /// exclusively for certificate verification and returns one. Ownership of
    /// `store` is transferred to the `SSL_CTX`.
    pub fn SSL_CTX_set0_verify_cert_store(
        ctx: *mut SSL_CTX,
        store: *mut X509_STORE,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_set1_verify_cert_store sets an `X509_STORE` that will be used
    /// exclusively for certificate verification and returns one. An additional
    /// reference to `store` will be taken.
    pub fn SSL_CTX_set1_verify_cert_store(
        ctx: *mut SSL_CTX,
        store: *mut X509_STORE,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set0_verify_cert_store sets an `X509_STORE` that will be used
    /// exclusively for certificate verification and returns one. Ownership of
    /// `store` is transferred to the `SSL`.
    pub fn SSL_set0_verify_cert_store(ssl: *mut SSL, store: *mut X509_STORE) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set1_verify_cert_store sets an `X509_STORE` that will be used
    /// exclusively for certificate verification and returns one. An additional
    /// reference to `store` will be taken.
    pub fn SSL_set1_verify_cert_store(ssl: *mut SSL, store: *mut X509_STORE) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_set_verify_algorithm_prefs configures `ctx` to use `prefs` as the
    /// preference list when verifying signatures from the peer's long-term key in
    /// TLS 1.2 and up. It returns one on zero on error. `prefs` should not include
    /// the internal-only TLS 1.0 value `SSL_SIGN_RSA_PKCS1_MD5_SHA1`.
    ///
    /// This setting is not used in TLS 1.0 and 1.1. Those protocols always sign a
    /// hardcoded algorithm (an MD5/SHA-1 concatenation for RSA, and SHA-1 for
    /// ECDSA). BoringSSL will accept those algorithms if and only if those versions
    /// are used. To disable them, set the minimum version to TLS 1.2 (default) or
    /// higher.
    pub fn SSL_CTX_set_verify_algorithm_prefs(
        ctx: *mut SSL_CTX,
        prefs: *const u16,
        num_prefs: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set_verify_algorithm_prefs configures `ssl` to use `prefs` as the
    /// preference list when verifying signatures from the peer's long-term key in
    /// TLS 1.2 and up. It returns one on zero on error. `prefs` should not include
    /// the internal-only TLS 1.0 value `SSL_SIGN_RSA_PKCS1_MD5_SHA1`.
    ///
    /// This setting is not used in TLS 1.0 and 1.1. Those protocols always sign a
    /// hardcoded algorithm (an MD5/SHA-1 concatenation for RSA, and SHA-1 for
    /// ECDSA). BoringSSL will accept those algorithms if and only if those versions
    /// are used. To disable them, set the minimum version to TLS 1.2 (default) or
    /// higher.
    pub fn SSL_set_verify_algorithm_prefs(
        ssl: *mut SSL,
        prefs: *const u16,
        num_prefs: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set_client_CA_list sets `ssl`'s client certificate CA list to
    /// `name_list`. It takes ownership of `name_list`.
    pub fn SSL_set_client_CA_list(ssl: *mut SSL, name_list: *mut stack_st_X509_NAME);
}
unsafe extern "C" {
    /// SSL_CTX_set_client_CA_list sets `ctx`'s client certificate CA list to
    /// `name_list`. It takes ownership of `name_list`.
    pub fn SSL_CTX_set_client_CA_list(ctx: *mut SSL_CTX, name_list: *mut stack_st_X509_NAME);
}
unsafe extern "C" {
    /// SSL_set0_client_CAs sets `ssl`'s client certificate CA list to `name_list`,
    /// which should contain DER-encoded distinguished names (RFC 5280). It takes
    /// ownership of `name_list`.
    pub fn SSL_set0_client_CAs(ssl: *mut SSL, name_list: *mut stack_st_CRYPTO_BUFFER);
}
unsafe extern "C" {
    /// SSL_set0_CA_names sets `ssl`'s CA name list for the certificate authorities
    /// extension to `name_list`, which should contain DER-encoded distinguished
    /// names (RFC 5280). It takes ownership of `name_list`.
    pub fn SSL_set0_CA_names(ssl: *mut SSL, name_list: *mut stack_st_CRYPTO_BUFFER);
}
unsafe extern "C" {
    /// SSL_CTX_set0_client_CAs sets `ctx`'s client certificate CA list to
    /// `name_list`, which should contain DER-encoded distinguished names (RFC 5280).
    /// It takes ownership of `name_list`.
    pub fn SSL_CTX_set0_client_CAs(ctx: *mut SSL_CTX, name_list: *mut stack_st_CRYPTO_BUFFER);
}
unsafe extern "C" {
    /// SSL_get_client_CA_list returns `ssl`'s client certificate CA list. If `ssl`
    /// has not been configured as a client, this is the list configured by
    /// `SSL_CTX_set_client_CA_list`.
    ///
    /// If configured as a client, it returns the client certificate CA list sent by
    /// the server. In this mode, the behavior is undefined except during the
    /// callbacks set by `SSL_CTX_set_cert_cb` and `SSL_CTX_set_client_cert_cb` or
    /// when the handshake is paused because of them.
    pub fn SSL_get_client_CA_list(ssl: *const SSL) -> *mut stack_st_X509_NAME;
}
unsafe extern "C" {
    /// SSL_get0_server_requested_CAs returns the CAs sent by a server to guide a
    /// client in certificate selection. They are a series of DER-encoded X.509
    /// names. This function may only be called during a callback set by
    /// `SSL_CTX_set_cert_cb` or when the handshake is paused because of it.
    ///
    /// The returned stack is owned by `ssl`, as are its contents. It should not be
    /// used past the point where the handshake is restarted after the callback.
    pub fn SSL_get0_server_requested_CAs(ssl: *const SSL) -> *const stack_st_CRYPTO_BUFFER;
}
unsafe extern "C" {
    /// SSL_CTX_get_client_CA_list returns `ctx`'s client certificate CA list.
    pub fn SSL_CTX_get_client_CA_list(ctx: *const SSL_CTX) -> *mut stack_st_X509_NAME;
}
unsafe extern "C" {
    /// SSL_add_client_CA appends `x509`'s subject to the client certificate CA list.
    /// It returns one on success or zero on error. The caller retains ownership of
    /// `x509`.
    pub fn SSL_add_client_CA(ssl: *mut SSL, x509: *mut X509) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_add_client_CA appends `x509`'s subject to the client certificate CA
    /// list. It returns one on success or zero on error. The caller retains
    /// ownership of `x509`.
    pub fn SSL_CTX_add_client_CA(ctx: *mut SSL_CTX, x509: *mut X509) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_load_client_CA_file opens `file` and reads PEM-encoded certificates from
    /// it. It returns a newly-allocated stack of the certificate subjects or NULL
    /// on error. Duplicates in `file` are ignored.
    pub fn SSL_load_client_CA_file(file: *const ::core::ffi::c_char) -> *mut stack_st_X509_NAME;
}
unsafe extern "C" {
    /// SSL_dup_CA_list makes a deep copy of `list`. It returns the new list on
    /// success or NULL on allocation error.
    pub fn SSL_dup_CA_list(list: *mut stack_st_X509_NAME) -> *mut stack_st_X509_NAME;
}
unsafe extern "C" {
    /// SSL_add_file_cert_subjects_to_stack behaves like `SSL_load_client_CA_file`
    /// but appends the result to `out`. It returns one on success or zero on
    /// error.
    pub fn SSL_add_file_cert_subjects_to_stack(
        out: *mut stack_st_X509_NAME,
        file: *const ::core::ffi::c_char,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_add_bio_cert_subjects_to_stack behaves like
    /// `SSL_add_file_cert_subjects_to_stack` but reads from `bio`.
    pub fn SSL_add_bio_cert_subjects_to_stack(
        out: *mut stack_st_X509_NAME,
        bio: *mut BIO,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CREDENTIAL_set1_trust_anchor_id sets `cred`'s trust anchor ID to `id`, or
    /// clears it if `id_len` is zero. It returns one on success and zero on
    /// error. If not clearing, `id` must be in binary format (Section 3 of
    /// draft-ietf-tls-trust-anchor-ids-00) of length `id_len`, and describe the
    /// issuer of the final certificate in `cred`'s certificate chain.
    ///
    /// Additionally, `cred` must enable issuer matching (see
    /// `SSL_CREDENTIAL_set_must_match_issuer`) for this value to take effect.
    ///
    /// For better extensibility, callers are recommended to configure this
    /// information with a CertificatePropertyList instead. See
    /// `SSL_CREDENTIAL_set1_certificate_properties`.
    pub fn SSL_CREDENTIAL_set1_trust_anchor_id(
        cred: *mut SSL_CREDENTIAL,
        id: *const u8,
        id_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_set1_requested_trust_anchors configures `ctx` to request a
    /// certificate issued by one of the trust anchors in `ids`. It returns one on
    /// success and zero on error. `ids` must be a list of trust anchor IDs in
    /// wire-format (a series of non-empty, 8-bit length-prefixed strings).
    ///
    /// The list may describe application's full list of supported trust anchors, or
    /// a, possibly empty, subset. Applications can select this subset using
    /// out-of-band information, such as the DNS hint in Section 5 of
    /// draft-ietf-tls-trust-anchor-ids-00. Client applications sending a subset
    /// should use `SSL_get0_peer_available_trust_anchors` to implement the retry
    /// flow from Section 4.3 of draft-ietf-tls-trust-anchor-ids-00.
    ///
    /// If empty (`ids_len` is zero), the trust_anchors extension will still be sent
    /// in ClientHello. This may be used by a client application to signal support
    /// for the retry flow without requesting specific trust anchors.
    ///
    /// This function does not directly impact certificate verification, only the
    /// list of trust anchors sent to the peer.
    pub fn SSL_CTX_set1_requested_trust_anchors(
        ctx: *mut SSL_CTX,
        ids: *const u8,
        ids_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set1_requested_trust_anchors behaves like
    /// `SSL_CTX_set1_requested_trust_anchors` but configures the value on `ssl`.
    pub fn SSL_set1_requested_trust_anchors(
        ssl: *mut SSL,
        ids: *const u8,
        ids_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_peer_matched_trust_anchor returns one if the peer reported that its
    /// certificate chain matched one of the trust anchor IDs requested by `ssl`, and
    /// zero otherwise.
    ///
    /// This value is only available during the handshake and is expected to be
    /// called during certificate verification, e.g. during `SSL_set_custom_verify`
    /// or `SSL_CTX_set_cert_verify_callback` callbacks. If the value is one, callers
    /// can safely treat the peer's certificate chain as a pre-built path and skip
    /// path-building in certificate verification.
    pub fn SSL_peer_matched_trust_anchor(ssl: *const SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_get0_peer_available_trust_anchors gets the peer's available trust anchor
    /// IDs. It sets `*out` and `*out_len` so that `*out` points to `*out_len` bytes
    /// containing the list in wire format (i.e. a series of non-empty
    /// 8-bit-length-prefixed strings). If the peer did not provide a list, the
    /// function will output zero bytes. Only servers can provide available trust
    /// anchor IDs, so this API will only output a list when `ssl` is a client.
    ///
    /// This value is only available during the handshake and is expected to be
    /// called in the event of certificate verification failure. Client applications
    /// can use it to retry the connection, requesting different trust anchors. See
    /// Section 4.3 of draft-ietf-tls-trust-anchor-ids-00 for details.
    /// `CBS_get_u8_length_prefixed` may be used to iterate over the format.
    ///
    /// If needed in other contexts, callers may save the value during certificate
    /// verification, or at `SSL_CB_HANDSHAKE_DONE` with `SSL_CTX_set_info_callback`.
    pub fn SSL_get0_peer_available_trust_anchors(
        ssl: *const SSL,
        out: *mut *const u8,
        out_len: *mut usize,
    );
}
unsafe extern "C" {
    /// SSL_CTX_set1_available_trust_anchors configures `ctx`, as a server, to send
    /// `ids` as the list of available trust anchors alongside the certificate. It
    /// returns one on success and zero on error. This list is used to allow the peer
    /// to retry the connection and request a different trust anchor, if the
    /// presented certificate is unacceptable. `ids` must be a non-empty list of
    /// trust anchor IDs in wire-format (a series of non-empty, 8-bit length-prefixed
    /// strings), in order of decreasing preference.
    ///
    /// Most applications will not need to call this. If not configured, BoringSSL
    /// derives available trust anchors from the credential list (see
    /// `SSL_CTX_add1_credential`). This function may be used if, for example, the
    /// caller filters the available credentials by trust anchor in
    /// `SSL_CTX_set_select_certificate_cb`, such that the credential list visible to
    /// BoringSSL is incomplete.
    pub fn SSL_CTX_set1_available_trust_anchors(
        ctx: *mut SSL_CTX,
        ids: *const u8,
        ids_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set1_available_trust_anchors behaves like
    /// `SSL_CTX_set1_available_trust_anchors` but configures the value on `ssl`.
    pub fn SSL_set1_available_trust_anchors(
        ssl: *mut SSL,
        ids: *const u8,
        ids_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set_tlsext_host_name, for a client, configures `ssl` to advertise `name`
    /// in the server_name extension. It returns one on success and zero on error.
    pub fn SSL_set_tlsext_host_name(
        ssl: *mut SSL,
        name: *const ::core::ffi::c_char,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_get_servername, for a server, returns the hostname supplied by the
    /// client or NULL if there was none. The `type` argument must be
    /// `TLSEXT_NAMETYPE_host_name`.
    pub fn SSL_get_servername(
        ssl: *const SSL,
        type_: ::core::ffi::c_int,
    ) -> *const ::core::ffi::c_char;
}
unsafe extern "C" {
    /// SSL_get_servername_type, for a server, returns `TLSEXT_NAMETYPE_host_name`
    /// if the client sent a hostname and -1 otherwise.
    pub fn SSL_get_servername_type(ssl: *const SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_set_tlsext_servername_callback configures `callback` to be called on
    /// the server after ClientHello extensions have been parsed and returns one.
    /// The callback may use `SSL_get_servername` to examine the server_name
    /// extension and returns a `SSL_TLSEXT_ERR_*` value. The value of `arg` may be
    /// set by calling `SSL_CTX_set_tlsext_servername_arg`.
    ///
    /// If the callback returns `SSL_TLSEXT_ERR_NOACK`, the server_name extension is
    /// not acknowledged in the ServerHello. If the return value is
    /// `SSL_TLSEXT_ERR_ALERT_FATAL`, then `*out_alert` is the alert to send,
    /// defaulting to `SSL_AD_UNRECOGNIZED_NAME`. `SSL_TLSEXT_ERR_ALERT_WARNING` is
    /// ignored and treated as `SSL_TLSEXT_ERR_OK`.
    pub fn SSL_CTX_set_tlsext_servername_callback(
        ctx: *mut SSL_CTX,
        callback: ::core::option::Option<
            unsafe extern "C" fn(
                ssl: *mut SSL,
                out_alert: *mut ::core::ffi::c_int,
                arg: *mut ::core::ffi::c_void,
            ) -> ::core::ffi::c_int,
        >,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_set_tlsext_servername_arg sets the argument to the servername
    /// callback and returns one. See `SSL_CTX_set_tlsext_servername_callback`.
    pub fn SSL_CTX_set_tlsext_servername_arg(
        ctx: *mut SSL_CTX,
        arg: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set_SSL_CTX changes `ssl`'s `SSL_CTX`. `ssl` will use the
    /// certificate-related settings from `ctx`, and `SSL_get_SSL_CTX` will report
    /// `ctx`. This function may be used during the callbacks registered by
    /// `SSL_CTX_set_select_certificate_cb`,
    /// `SSL_CTX_set_tlsext_servername_callback`, and `SSL_CTX_set_cert_cb` or when
    /// the handshake is paused from them. It is typically used to switch
    /// certificates based on SNI.
    ///
    /// Note the session cache and related settings will continue to use the initial
    /// `SSL_CTX`. Callers should use `SSL_CTX_set_session_id_context` to partition
    /// the session cache between different domains.
    ///
    /// TODO(davidben): Should other settings change after this call?
    pub fn SSL_set_SSL_CTX(ssl: *mut SSL, ctx: *mut SSL_CTX) -> *mut SSL_CTX;
}
unsafe extern "C" {
    /// SSL_CTX_set_alpn_protos sets the client ALPN protocol list on `ctx` to
    /// `protos`. `protos` must be in wire-format (i.e. a series of non-empty, 8-bit
    /// length-prefixed strings), or the empty string to disable ALPN. It returns
    /// zero on success and one on failure. Configuring a non-empty string enables
    /// ALPN on a client.
    ///
    /// WARNING: this function is dangerous because it breaks the usual return value
    /// convention.
    pub fn SSL_CTX_set_alpn_protos(
        ctx: *mut SSL_CTX,
        protos: *const u8,
        protos_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set_alpn_protos sets the client ALPN protocol list on `ssl` to `protos`.
    /// `protos` must be in wire-format (i.e. a series of non-empty, 8-bit
    /// length-prefixed strings), or the empty string to disable ALPN. It returns
    /// zero on success and one on failure. Configuring a non-empty string enables
    /// ALPN on a client.
    ///
    /// WARNING: this function is dangerous because it breaks the usual return value
    /// convention.
    pub fn SSL_set_alpn_protos(
        ssl: *mut SSL,
        protos: *const u8,
        protos_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_set_alpn_select_cb sets a callback function on `ctx` that is called
    /// during ClientHello processing in order to select an ALPN protocol from the
    /// client's list of offered protocols. `SSL_select_next_proto` is an optional
    /// utility function which may be useful in implementing this callback.
    ///
    /// The callback is passed a wire-format (i.e. a series of non-empty, 8-bit
    /// length-prefixed strings) ALPN protocol list in `in`. To select a protocol,
    /// the callback should set `*out` and `*out_len` to the selected protocol and
    /// return `SSL_TLSEXT_ERR_OK` on success. It does not pass ownership of the
    /// buffer, so `*out` should point to a static string, a buffer that outlives the
    /// callback call, or the corresponding entry in `in`.
    ///
    /// If the server supports ALPN, but there are no protocols in common, the
    /// callback should return `SSL_TLSEXT_ERR_ALERT_FATAL` to abort the connection
    /// with a no_application_protocol alert.
    ///
    /// If the server does not support ALPN, it can return `SSL_TLSEXT_ERR_NOACK` to
    /// continue the handshake without negotiating a protocol. This may be useful if
    /// multiple server configurations share an `SSL_CTX`, only some of which have
    /// ALPN protocols configured.
    ///
    /// `SSL_TLSEXT_ERR_ALERT_WARNING` is ignored and will be treated as
    /// `SSL_TLSEXT_ERR_NOACK`.
    ///
    /// The callback will only be called if the client supports ALPN. Callers that
    /// wish to require ALPN for all clients must check `SSL_get0_alpn_selected`
    /// after the handshake. In QUIC connections, this is done automatically.
    ///
    /// The cipher suite is selected before negotiating ALPN. The callback may use
    /// `SSL_get_pending_cipher` to query the cipher suite. This may be used to
    /// implement HTTP/2's cipher suite constraints.
    pub fn SSL_CTX_set_alpn_select_cb(
        ctx: *mut SSL_CTX,
        cb: ::core::option::Option<
            unsafe extern "C" fn(
                ssl: *mut SSL,
                out: *mut *const u8,
                out_len: *mut u8,
                in_: *const u8,
                in_len: ::core::ffi::c_uint,
                arg: *mut ::core::ffi::c_void,
            ) -> ::core::ffi::c_int,
        >,
        arg: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    /// SSL_get0_alpn_selected gets the selected ALPN protocol (if any) from `ssl`.
    /// On return it sets `*out_data` to point to `*out_len` bytes of protocol name
    /// (not including the leading length-prefix byte). If the server didn't respond
    /// with a negotiated protocol then `*out_len` will be zero.
    pub fn SSL_get0_alpn_selected(
        ssl: *const SSL,
        out_data: *mut *const u8,
        out_len: *mut ::core::ffi::c_uint,
    );
}
unsafe extern "C" {
    /// SSL_CTX_set_allow_unknown_alpn_protos configures client connections on `ctx`
    /// to allow unknown ALPN protocols from the server. Otherwise, by default, the
    /// client will require that the protocol be advertised in
    /// `SSL_CTX_set_alpn_protos`.
    pub fn SSL_CTX_set_allow_unknown_alpn_protos(ctx: *mut SSL_CTX, enabled: ::core::ffi::c_int);
}
unsafe extern "C" {
    /// SSL_add_application_settings configures `ssl` to enable ALPS with ALPN
    /// protocol `proto`, sending an ALPS value of `settings`. It returns one on
    /// success and zero on error. If `proto` is negotiated via ALPN and the peer
    /// supports ALPS, `settings` will be sent to the peer. The peer's ALPS value can
    /// be retrieved with `SSL_get0_peer_application_settings`.
    ///
    /// On the client, this function should be called before the handshake, once for
    /// each supported ALPN protocol which uses ALPS. `proto` must be included in the
    /// client's ALPN configuration (see `SSL_CTX_set_alpn_protos` and
    /// `SSL_set_alpn_protos`). On the server, ALPS can be preconfigured for each
    /// protocol as in the client, or configuration can be deferred to the ALPN
    /// callback (see `SSL_CTX_set_alpn_select_cb`), in which case only the selected
    /// protocol needs to be configured.
    ///
    /// ALPS can be independently configured from 0-RTT, however changes in protocol
    /// settings will fallback to 1-RTT to negotiate the new value, so it is
    /// recommended for `settings` to be relatively stable.
    pub fn SSL_add_application_settings(
        ssl: *mut SSL,
        proto: *const u8,
        proto_len: usize,
        settings: *const u8,
        settings_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_get0_peer_application_settings sets `*out_data` and `*out_len` to a
    /// buffer containing the peer's ALPS value, or the empty string if ALPS was not
    /// negotiated. Note an empty string could also indicate the peer sent an empty
    /// settings value. Use `SSL_has_application_settings` to check if ALPS was
    /// negotiated. The output buffer is owned by `ssl` and is valid until the next
    /// time `ssl` is modified.
    pub fn SSL_get0_peer_application_settings(
        ssl: *const SSL,
        out_data: *mut *const u8,
        out_len: *mut usize,
    );
}
unsafe extern "C" {
    /// SSL_has_application_settings returns one if ALPS was negotiated on this
    /// connection and zero otherwise.
    pub fn SSL_has_application_settings(ssl: *const SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set_alps_use_new_codepoint configures whether to use the new ALPS
    /// codepoint. By default, the new codepoint is used.
    pub fn SSL_set_alps_use_new_codepoint(ssl: *mut SSL, use_new: ::core::ffi::c_int);
}
/// ssl_cert_compression_func_t is a pointer to a function that performs
/// compression. It must write the compressed representation of `in` to `out`,
/// returning one on success and zero on error. The results of compressing
/// certificates are not cached internally. Implementations may wish to implement
/// their own cache if they expect it to be useful given the certificates that
/// they serve.
pub type ssl_cert_compression_func_t = ::core::option::Option<
    unsafe extern "C" fn(
        ssl: *mut SSL,
        out: *mut CBB,
        in_: *const u8,
        in_len: usize,
    ) -> ::core::ffi::c_int,
>;
/// ssl_cert_decompression_func_t is a pointer to a function that performs
/// decompression. The compressed data from the peer is passed as `in` and the
/// decompressed result must be exactly `uncompressed_len` bytes long. It returns
/// one on success, in which case `*out` must be set to the result of
/// decompressing `in`, or zero on error. Setting `*out` transfers ownership,
/// i.e. `CRYPTO_BUFFER_free` will be called on `*out` at some point in the
/// future. The results of decompressions are not cached internally.
/// Implementations may wish to implement their own cache if they expect it to be
/// useful.
pub type ssl_cert_decompression_func_t = ::core::option::Option<
    unsafe extern "C" fn(
        ssl: *mut SSL,
        out: *mut *mut CRYPTO_BUFFER,
        uncompressed_len: usize,
        in_: *const u8,
        in_len: usize,
    ) -> ::core::ffi::c_int,
>;
unsafe extern "C" {
    /// SSL_CTX_add_cert_compression_alg registers a certificate compression
    /// algorithm on `ctx` with ID `alg_id`. (The value of `alg_id` should be an IANA
    /// assigned value and each can only be registered once.)
    ///
    /// One of the function pointers may be NULL to avoid having to implement both
    /// sides of a compression algorithm if you're only going to use it in one
    /// direction. In this case, the unimplemented direction acts like it was never
    /// configured.
    ///
    /// For a server, algorithms are registered in preference order with the most
    /// preferable first. It returns one on success or zero on error.
    pub fn SSL_CTX_add_cert_compression_alg(
        ctx: *mut SSL_CTX,
        alg_id: u16,
        compress: ssl_cert_compression_func_t,
        decompress: ssl_cert_decompression_func_t,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_set_next_protos_advertised_cb sets a callback that is called when a
    /// TLS server needs a list of supported protocols for Next Protocol Negotiation.
    ///
    /// If the callback wishes to advertise NPN to the client, it should return
    /// `SSL_TLSEXT_ERR_OK` and then set `*out` and `*out_len` to describe to a
    /// buffer containing a (possibly empty) list of supported protocols in wire
    /// format. That is, each protocol is prefixed with a 1-byte length, then
    /// concatenated. From there, the client will select a protocol, possibly one not
    /// on the server's list. The caller can use `SSL_get0_next_proto_negotiated`
    /// after the handshake completes to query the final protocol.
    ///
    /// The returned buffer must remain valid and unmodified for at least the
    /// duration of the `SSL` operation (e.g. `SSL_do_handshake`) that triggered the
    /// callback.
    ///
    /// If the caller wishes not to advertise NPN, it should return
    /// `SSL_TLSEXT_ERR_NOACK`. No NPN extension will be included in the ServerHello,
    /// and the TLS server will behave as if it does not implement NPN.
    pub fn SSL_CTX_set_next_protos_advertised_cb(
        ctx: *mut SSL_CTX,
        cb: ::core::option::Option<
            unsafe extern "C" fn(
                ssl: *mut SSL,
                out: *mut *const u8,
                out_len: *mut ::core::ffi::c_uint,
                arg: *mut ::core::ffi::c_void,
            ) -> ::core::ffi::c_int,
        >,
        arg: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    /// SSL_CTX_set_next_proto_select_cb sets a callback that is called when a client
    /// needs to select a protocol from the server's provided list, passed in wire
    /// format in `in_len` bytes from `in`. The callback can assume that `in` is
    /// syntactically valid. `SSL_select_next_proto` is an optional utility function
    /// which may be useful in implementing this callback.
    ///
    /// On success, the callback should return `SSL_TLSEXT_ERR_OK` and set `*out` and
    /// `*out_len` to describe a buffer containing the selected protocol, or an
    /// empty buffer to select no protocol. The returned buffer may point within
    /// `in`, or it may point to some other buffer that remains valid and unmodified
    /// for at least the duration of the `SSL` operation (e.g. `SSL_do_handshake`)
    /// that triggered the callback.
    ///
    /// Returning any other value indicates a fatal error and will terminate the TLS
    /// connection. To proceed without selecting a protocol, the callback must return
    /// `SSL_TLSEXT_ERR_OK` and set `*out` and `*out_len` to an empty buffer. (E.g.
    /// NULL and zero, respectively.)
    ///
    /// Configuring this callback enables NPN on a client. Although the callback can
    /// then decline to negotiate a protocol, merely configuring the callback causes
    /// the client to offer NPN in the ClientHello. Callers thus should not configure
    /// this callback in TLS client contexts that are not intended to use NPN.
    pub fn SSL_CTX_set_next_proto_select_cb(
        ctx: *mut SSL_CTX,
        cb: ::core::option::Option<
            unsafe extern "C" fn(
                ssl: *mut SSL,
                out: *mut *mut u8,
                out_len: *mut u8,
                in_: *const u8,
                in_len: ::core::ffi::c_uint,
                arg: *mut ::core::ffi::c_void,
            ) -> ::core::ffi::c_int,
        >,
        arg: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    /// SSL_get0_next_proto_negotiated sets `*out_data` and `*out_len` to point to
    /// the client's requested protocol for this connection. If the client didn't
    /// request any protocol, then `*out_len` is set to zero.
    ///
    /// Note that the client can request any protocol it chooses. The value returned
    /// from this function need not be a member of the list of supported protocols
    /// provided by the server.
    pub fn SSL_get0_next_proto_negotiated(
        ssl: *const SSL,
        out_data: *mut *const u8,
        out_len: *mut ::core::ffi::c_uint,
    );
}
unsafe extern "C" {
    /// SSL_select_next_proto implements the standard protocol selection for either
    /// ALPN servers or NPN clients. It is expected that this function is called from
    /// the callback set by `SSL_CTX_set_alpn_select_cb` or
    /// `SSL_CTX_set_next_proto_select_cb`.
    ///
    /// `peer` and `supported` contain the peer and locally-configured protocols,
    /// respectively. This function finds the first protocol in `peer` which is also
    /// in `supported`. If one was found, it sets `*out` and `*out_len` to point to
    /// it and returns `OPENSSL_NPN_NEGOTIATED`. Otherwise, it returns
    /// `OPENSSL_NPN_NO_OVERLAP` and sets `*out` and `*out_len` to the first
    /// supported protocol.
    ///
    /// In ALPN, the server should only select protocols among those that the client
    /// offered. Thus, if this function returns `OPENSSL_NPN_NO_OVERLAP`, the caller
    /// should ignore `*out` and return `SSL_TLSEXT_ERR_ALERT_FATAL` from
    /// `SSL_CTX_set_alpn_select_cb`'s callback to indicate there was no match.
    ///
    /// In NPN, the client may either select one of the server's protocols, or an
    /// "opportunistic" protocol as described in Section 6 of
    /// draft-agl-tls-nextprotoneg-03. When this function returns
    /// `OPENSSL_NPN_NO_OVERLAP`, `*out` implicitly selects the first supported
    /// protocol for use as the opportunistic protocol. The caller may use it,
    /// ignore it and select a different opportunistic protocol, or ignore it and
    /// select no protocol (empty string).
    ///
    /// `peer` and `supported` must be vectors of 8-bit, length-prefixed byte
    /// strings. The length byte itself is not included in the length. A byte string
    /// of length 0 is invalid. No byte string may be truncated. `supported` must be
    /// non-empty; a caller that supports no ALPN/NPN protocols should skip
    /// negotiating the extension, rather than calling this function. If any of these
    /// preconditions do not hold, this function will return `OPENSSL_NPN_NO_OVERLAP`
    /// and set `*out` and `*out_len` to an empty buffer for robustness, but callers
    /// are not recommended to rely on this. An empty buffer is not a valid output
    /// for `SSL_CTX_set_alpn_select_cb`'s callback.
    ///
    /// WARNING: `*out` and `*out_len` may alias either `peer` or `supported` and may
    /// not be used after one of those buffers is modified or released. Additionally,
    /// this function is not const-correct for compatibility reasons. Although `*out`
    /// is a non-const pointer, callers may not modify the buffer though `*out`.
    pub fn SSL_select_next_proto(
        out: *mut *mut u8,
        out_len: *mut u8,
        peer: *const u8,
        peer_len: ::core::ffi::c_uint,
        supported: *const u8,
        supported_len: ::core::ffi::c_uint,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_set_tls_channel_id_enabled configures whether connections associated
    /// with `ctx` should enable Channel ID as a server.
    pub fn SSL_CTX_set_tls_channel_id_enabled(ctx: *mut SSL_CTX, enabled: ::core::ffi::c_int);
}
unsafe extern "C" {
    /// SSL_set_tls_channel_id_enabled configures whether `ssl` should enable Channel
    /// ID as a server.
    pub fn SSL_set_tls_channel_id_enabled(ssl: *mut SSL, enabled: ::core::ffi::c_int);
}
unsafe extern "C" {
    /// SSL_CTX_set1_tls_channel_id configures a TLS client to send a TLS Channel ID
    /// to compatible servers. `private_key` must be a P-256 EC key. It returns one
    /// on success and zero on error.
    pub fn SSL_CTX_set1_tls_channel_id(
        ctx: *mut SSL_CTX,
        private_key: *mut EVP_PKEY,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set1_tls_channel_id configures a TLS client to send a TLS Channel ID to
    /// compatible servers. `private_key` must be a P-256 EC key. It returns one on
    /// success and zero on error.
    pub fn SSL_set1_tls_channel_id(ssl: *mut SSL, private_key: *mut EVP_PKEY)
        -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_get_tls_channel_id gets the client's TLS Channel ID from a server `SSL`
    /// and copies up to the first `max_out` bytes into `out`. The Channel ID
    /// consists of the client's P-256 public key as an (x,y) pair where each is a
    /// 32-byte, big-endian field element. It returns 0 if the client didn't offer a
    /// Channel ID and the length of the complete Channel ID otherwise. This function
    /// always returns zero if `ssl` is a client.
    pub fn SSL_get_tls_channel_id(ssl: *mut SSL, out: *mut u8, max_out: usize) -> usize;
}
/// srtp_protection_profile_st (aka `SRTP_PROTECTION_PROFILE`) is an SRTP
/// profile for use with the use_srtp extension.
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct srtp_protection_profile_st {
    pub name: *const ::core::ffi::c_char,
    pub id: ::core::ffi::c_ulong,
}
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct stack_st_SRTP_PROTECTION_PROFILE {
    _unused: [u8; 0],
}
/// We also disable -Wcast-qual. As part of this C-based type erasure setup,  \
/// the wrapper macros need to cast away const in places. In C++, const_cast  \
/// suppresses the warning, but it seemingly cannot be suppressed in C.
pub type sk_SRTP_PROTECTION_PROFILE_free_func =
    ::core::option::Option<unsafe extern "C" fn(arg1: *const SRTP_PROTECTION_PROFILE)>;
pub type sk_SRTP_PROTECTION_PROFILE_copy_func = ::core::option::Option<
    unsafe extern "C" fn(arg1: *const SRTP_PROTECTION_PROFILE) -> *const SRTP_PROTECTION_PROFILE,
>;
pub type sk_SRTP_PROTECTION_PROFILE_cmp_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *const *const SRTP_PROTECTION_PROFILE,
        arg2: *const *const SRTP_PROTECTION_PROFILE,
    ) -> ::core::ffi::c_int,
>;
pub type sk_SRTP_PROTECTION_PROFILE_delete_if_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *const SRTP_PROTECTION_PROFILE,
        arg2: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int,
>;
unsafe extern "C" {
    #[link_name = "sk_SRTP_PROTECTION_PROFILE_call_free_func__extern"]
    pub fn sk_SRTP_PROTECTION_PROFILE_call_free_func(
        free_func: OPENSSL_sk_free_func,
        ptr: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    #[link_name = "sk_SRTP_PROTECTION_PROFILE_call_copy_func__extern"]
    pub fn sk_SRTP_PROTECTION_PROFILE_call_copy_func(
        copy_func: OPENSSL_sk_copy_func,
        ptr: *const ::core::ffi::c_void,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    #[link_name = "sk_SRTP_PROTECTION_PROFILE_call_cmp_func__extern"]
    pub fn sk_SRTP_PROTECTION_PROFILE_call_cmp_func(
        cmp_func: OPENSSL_sk_cmp_func,
        a: *const ::core::ffi::c_void,
        b: *const ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_SRTP_PROTECTION_PROFILE_call_delete_if_func__extern"]
    pub fn sk_SRTP_PROTECTION_PROFILE_call_delete_if_func(
        func: OPENSSL_sk_delete_if_func,
        obj: *mut ::core::ffi::c_void,
        data: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_SRTP_PROTECTION_PROFILE_new__extern"]
    pub fn sk_SRTP_PROTECTION_PROFILE_new(
        comp: sk_SRTP_PROTECTION_PROFILE_cmp_func,
    ) -> *mut stack_st_SRTP_PROTECTION_PROFILE;
}
unsafe extern "C" {
    #[link_name = "sk_SRTP_PROTECTION_PROFILE_new_null__extern"]
    pub fn sk_SRTP_PROTECTION_PROFILE_new_null() -> *mut stack_st_SRTP_PROTECTION_PROFILE;
}
unsafe extern "C" {
    #[link_name = "sk_SRTP_PROTECTION_PROFILE_num__extern"]
    pub fn sk_SRTP_PROTECTION_PROFILE_num(sk: *const stack_st_SRTP_PROTECTION_PROFILE) -> usize;
}
unsafe extern "C" {
    #[link_name = "sk_SRTP_PROTECTION_PROFILE_zero__extern"]
    pub fn sk_SRTP_PROTECTION_PROFILE_zero(sk: *mut stack_st_SRTP_PROTECTION_PROFILE);
}
unsafe extern "C" {
    #[link_name = "sk_SRTP_PROTECTION_PROFILE_value__extern"]
    pub fn sk_SRTP_PROTECTION_PROFILE_value(
        sk: *const stack_st_SRTP_PROTECTION_PROFILE,
        i: usize,
    ) -> *const SRTP_PROTECTION_PROFILE;
}
unsafe extern "C" {
    #[link_name = "sk_SRTP_PROTECTION_PROFILE_set__extern"]
    pub fn sk_SRTP_PROTECTION_PROFILE_set(
        sk: *mut stack_st_SRTP_PROTECTION_PROFILE,
        i: usize,
        p: *const SRTP_PROTECTION_PROFILE,
    ) -> *const SRTP_PROTECTION_PROFILE;
}
unsafe extern "C" {
    #[link_name = "sk_SRTP_PROTECTION_PROFILE_free__extern"]
    pub fn sk_SRTP_PROTECTION_PROFILE_free(sk: *mut stack_st_SRTP_PROTECTION_PROFILE);
}
unsafe extern "C" {
    #[link_name = "sk_SRTP_PROTECTION_PROFILE_pop_free__extern"]
    pub fn sk_SRTP_PROTECTION_PROFILE_pop_free(
        sk: *mut stack_st_SRTP_PROTECTION_PROFILE,
        free_func: sk_SRTP_PROTECTION_PROFILE_free_func,
    );
}
unsafe extern "C" {
    #[link_name = "sk_SRTP_PROTECTION_PROFILE_insert__extern"]
    pub fn sk_SRTP_PROTECTION_PROFILE_insert(
        sk: *mut stack_st_SRTP_PROTECTION_PROFILE,
        p: *const SRTP_PROTECTION_PROFILE,
        where_: usize,
    ) -> usize;
}
unsafe extern "C" {
    #[link_name = "sk_SRTP_PROTECTION_PROFILE_delete__extern"]
    pub fn sk_SRTP_PROTECTION_PROFILE_delete(
        sk: *mut stack_st_SRTP_PROTECTION_PROFILE,
        where_: usize,
    ) -> *const SRTP_PROTECTION_PROFILE;
}
unsafe extern "C" {
    #[link_name = "sk_SRTP_PROTECTION_PROFILE_delete_ptr__extern"]
    pub fn sk_SRTP_PROTECTION_PROFILE_delete_ptr(
        sk: *mut stack_st_SRTP_PROTECTION_PROFILE,
        p: *const SRTP_PROTECTION_PROFILE,
    ) -> *const SRTP_PROTECTION_PROFILE;
}
unsafe extern "C" {
    #[link_name = "sk_SRTP_PROTECTION_PROFILE_delete_if__extern"]
    pub fn sk_SRTP_PROTECTION_PROFILE_delete_if(
        sk: *mut stack_st_SRTP_PROTECTION_PROFILE,
        func: sk_SRTP_PROTECTION_PROFILE_delete_if_func,
        data: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    #[link_name = "sk_SRTP_PROTECTION_PROFILE_find__extern"]
    pub fn sk_SRTP_PROTECTION_PROFILE_find(
        sk: *const stack_st_SRTP_PROTECTION_PROFILE,
        out_index: *mut usize,
        p: *const SRTP_PROTECTION_PROFILE,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_SRTP_PROTECTION_PROFILE_shift__extern"]
    pub fn sk_SRTP_PROTECTION_PROFILE_shift(
        sk: *mut stack_st_SRTP_PROTECTION_PROFILE,
    ) -> *const SRTP_PROTECTION_PROFILE;
}
unsafe extern "C" {
    #[link_name = "sk_SRTP_PROTECTION_PROFILE_push__extern"]
    pub fn sk_SRTP_PROTECTION_PROFILE_push(
        sk: *mut stack_st_SRTP_PROTECTION_PROFILE,
        p: *const SRTP_PROTECTION_PROFILE,
    ) -> usize;
}
unsafe extern "C" {
    #[link_name = "sk_SRTP_PROTECTION_PROFILE_pop__extern"]
    pub fn sk_SRTP_PROTECTION_PROFILE_pop(
        sk: *mut stack_st_SRTP_PROTECTION_PROFILE,
    ) -> *const SRTP_PROTECTION_PROFILE;
}
unsafe extern "C" {
    #[link_name = "sk_SRTP_PROTECTION_PROFILE_dup__extern"]
    pub fn sk_SRTP_PROTECTION_PROFILE_dup(
        sk: *const stack_st_SRTP_PROTECTION_PROFILE,
    ) -> *mut stack_st_SRTP_PROTECTION_PROFILE;
}
unsafe extern "C" {
    #[link_name = "sk_SRTP_PROTECTION_PROFILE_sort__extern"]
    pub fn sk_SRTP_PROTECTION_PROFILE_sort(sk: *mut stack_st_SRTP_PROTECTION_PROFILE);
}
unsafe extern "C" {
    #[link_name = "sk_SRTP_PROTECTION_PROFILE_sort_and_dedup__extern"]
    pub fn sk_SRTP_PROTECTION_PROFILE_sort_and_dedup(
        sk: *mut stack_st_SRTP_PROTECTION_PROFILE,
        free_func: sk_SRTP_PROTECTION_PROFILE_free_func,
    );
}
unsafe extern "C" {
    #[link_name = "sk_SRTP_PROTECTION_PROFILE_is_sorted__extern"]
    pub fn sk_SRTP_PROTECTION_PROFILE_is_sorted(
        sk: *const stack_st_SRTP_PROTECTION_PROFILE,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_SRTP_PROTECTION_PROFILE_set_cmp_func__extern"]
    pub fn sk_SRTP_PROTECTION_PROFILE_set_cmp_func(
        sk: *mut stack_st_SRTP_PROTECTION_PROFILE,
        comp: sk_SRTP_PROTECTION_PROFILE_cmp_func,
    ) -> sk_SRTP_PROTECTION_PROFILE_cmp_func;
}
unsafe extern "C" {
    #[link_name = "sk_SRTP_PROTECTION_PROFILE_deep_copy__extern"]
    pub fn sk_SRTP_PROTECTION_PROFILE_deep_copy(
        sk: *const stack_st_SRTP_PROTECTION_PROFILE,
        copy_func: sk_SRTP_PROTECTION_PROFILE_copy_func,
        free_func: sk_SRTP_PROTECTION_PROFILE_free_func,
    ) -> *mut stack_st_SRTP_PROTECTION_PROFILE;
}
unsafe extern "C" {
    /// SSL_CTX_set_srtp_profiles enables SRTP for all SSL objects created from
    /// `ctx`. `profile` contains a colon-separated list of profile names. It returns
    /// one on success and zero on failure.
    pub fn SSL_CTX_set_srtp_profiles(
        ctx: *mut SSL_CTX,
        profiles: *const ::core::ffi::c_char,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set_srtp_profiles enables SRTP for `ssl`.  `profile` contains a
    /// colon-separated list of profile names. It returns one on success and zero on
    /// failure.
    pub fn SSL_set_srtp_profiles(
        ssl: *mut SSL,
        profiles: *const ::core::ffi::c_char,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_get_srtp_profiles returns the SRTP profiles supported by `ssl`.
    pub fn SSL_get_srtp_profiles(ssl: *const SSL) -> *const stack_st_SRTP_PROTECTION_PROFILE;
}
unsafe extern "C" {
    /// SSL_get_selected_srtp_profile returns the selected SRTP profile, or NULL if
    /// SRTP was not negotiated.
    pub fn SSL_get_selected_srtp_profile(ssl: *mut SSL) -> *const SRTP_PROTECTION_PROFILE;
}
unsafe extern "C" {
    /// SSL_CREDENTIAL_new_pre_shared_key returns a newly-allocated `SSL_CREDENTIAL`
    /// representing an external pre-shared key, as described in RFC 9258, or NULL on
    /// error. `key` is the base key, `id` is the external identity, and `md` is the
    /// hash function. The result may be added to the credential list with
    /// `SSL_CTX_add1_credential` or `SSL_add1_credential`. `context` is the context
    /// string to use when importing to TLS.
    ///
    /// WARNING: An attacker with knowledge of `key` can impersonate either side of
    /// the connection. Additionally, using a pre-shared key exposes `key` to offline
    /// brute force attacks. `key` must thus be a high-entropy, secret value.
    /// Passwords or short PINs, for example, would not be safe to use as `key`.
    ///
    /// Callers can configure the credential list with multiple PSKs, or a mix of
    /// PSKs and other credentials, in some preference order. Due to protocol
    /// differences, clients and servers evaluate PSKs in the credential list
    /// differently:
    ///
    /// - As a server, PSK credentials behave similarly to other credentials. Callers
    ///   can configure them dynamically in the certificate callbacks (see
    ///   `SSL_CTX_set_select_certificate_cb` and `SSL_CTX_set_cert_cb`). After those
    ///   callbacks run, BoringSSL will select a credential to use from the list.
    ///
    /// - As a client, PSK credentials are offered in the ClientHello and selected by
    ///   the server. This means all PSK credentials must be configured before
    ///   starting the handshake, and the order between PSK and non-PSK credentials
    ///   will be ignored. PSK credentials cannot be configured dynamically in
    ///   callbacks such as `SSL_CTX_set_cert_cb`.
    ///
    /// A single connection may be configured to accept only certificate-based
    /// handshakes, only PSK-based handshakes, or both. The server credential
    /// determines the kind of handshake, so this is implicitly controlled by the
    /// credential list as a server:
    ///
    /// - If the credential list only contains PSKs, BoringSSL will only consider
    ///   PSK-based handshakes.
    ///
    /// - If the credential list contains PSKs and certificates, BoringSSL will
    ///   consider both, depending on the client.
    ///
    /// As a client, if any PSK credentials are configured, BoringSSL will only
    /// accept PSK-based handshakes by default. Setting the verify mode to
    /// `SSL_VERIFY_PEER` (see `SSL_CTX_set_verify` and `SSL_CTX_set_custom_verify`)
    /// overrides this behavior and causes BoringSSL to accept either.
    ///
    /// In both clients and servers, if a caller configures one or more PSK
    /// credentials, and calls no certificate-related functions, the connection will
    /// only accept one of those PSKs.
    pub fn SSL_CREDENTIAL_new_pre_shared_key(
        key: *const u8,
        key_len: usize,
        id: *const u8,
        id_len: usize,
        md: *const EVP_MD,
        context: *const u8,
        context_len: usize,
    ) -> *mut SSL_CREDENTIAL;
}
unsafe extern "C" {
    /// SSL_CTX_set_psk_client_callback sets the callback to be called when TLS 1.2
    /// PSK is negotiated on the client. This callback must be set to enable PSK
    /// cipher suites on the client.
    ///
    /// The callback is passed the identity hint in `hint` or NULL if none was
    /// provided. It should select a PSK identity and write the identity and the
    /// corresponding PSK to `identity` and `psk`, respectively. The identity is
    /// written as a NUL-terminated C string of length (excluding the NUL terminator)
    /// at most `max_identity_len`. The PSK's length must be at most `max_psk_len`.
    /// The callback returns the length of the PSK or 0 if no suitable identity was
    /// found.
    pub fn SSL_CTX_set_psk_client_callback(
        ctx: *mut SSL_CTX,
        cb: ::core::option::Option<
            unsafe extern "C" fn(
                ssl: *mut SSL,
                hint: *const ::core::ffi::c_char,
                identity: *mut ::core::ffi::c_char,
                max_identity_len: ::core::ffi::c_uint,
                psk: *mut u8,
                max_psk_len: ::core::ffi::c_uint,
            ) -> ::core::ffi::c_uint,
        >,
    );
}
unsafe extern "C" {
    /// SSL_set_psk_client_callback sets the callback to be called when TLS 1.2 PSK
    /// is negotiated on the client. This callback must be set to enable PSK cipher
    /// suites on the client. See also `SSL_CTX_set_psk_client_callback`.
    pub fn SSL_set_psk_client_callback(
        ssl: *mut SSL,
        cb: ::core::option::Option<
            unsafe extern "C" fn(
                ssl: *mut SSL,
                hint: *const ::core::ffi::c_char,
                identity: *mut ::core::ffi::c_char,
                max_identity_len: ::core::ffi::c_uint,
                psk: *mut u8,
                max_psk_len: ::core::ffi::c_uint,
            ) -> ::core::ffi::c_uint,
        >,
    );
}
unsafe extern "C" {
    /// SSL_CTX_set_psk_server_callback sets the callback to be called when TLS 1.2
    /// PSK is negotiated on the server. This callback must be set to enable PSK
    /// cipher suites on the server.
    ///
    /// The callback is passed the identity in `identity`. It should write a PSK of
    /// length at most `max_psk_len` to `psk` and return the number of bytes written
    /// or zero if the PSK identity is unknown.
    pub fn SSL_CTX_set_psk_server_callback(
        ctx: *mut SSL_CTX,
        cb: ::core::option::Option<
            unsafe extern "C" fn(
                ssl: *mut SSL,
                identity: *const ::core::ffi::c_char,
                psk: *mut u8,
                max_psk_len: ::core::ffi::c_uint,
            ) -> ::core::ffi::c_uint,
        >,
    );
}
unsafe extern "C" {
    /// SSL_set_psk_server_callback sets the callback to be called when TLS 1.2 PSK
    /// is negotiated on the server. This callback must be set to enable PSK cipher
    /// suites on the server. See also `SSL_CTX_set_psk_server_callback`.
    pub fn SSL_set_psk_server_callback(
        ssl: *mut SSL,
        cb: ::core::option::Option<
            unsafe extern "C" fn(
                ssl: *mut SSL,
                identity: *const ::core::ffi::c_char,
                psk: *mut u8,
                max_psk_len: ::core::ffi::c_uint,
            ) -> ::core::ffi::c_uint,
        >,
    );
}
unsafe extern "C" {
    /// SSL_CTX_use_psk_identity_hint configures server connections to advertise an
    /// identity hint of `identity_hint`. It returns one on success and zero on
    /// error.
    pub fn SSL_CTX_use_psk_identity_hint(
        ctx: *mut SSL_CTX,
        identity_hint: *const ::core::ffi::c_char,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_use_psk_identity_hint configures server connections to advertise an
    /// identity hint of `identity_hint`. It returns one on success and zero on
    /// error.
    pub fn SSL_use_psk_identity_hint(
        ssl: *mut SSL,
        identity_hint: *const ::core::ffi::c_char,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_get_psk_identity_hint returns the TLS 1.2 PSK identity hint advertised
    /// for `ssl` or NULL if there is none.
    pub fn SSL_get_psk_identity_hint(ssl: *const SSL) -> *const ::core::ffi::c_char;
}
unsafe extern "C" {
    /// SSL_get_psk_identity, after the handshake completes, returns the TLS 1.2 PSK
    /// identity that was negotiated by `ssl` or NULL if PSK was not used.
    pub fn SSL_get_psk_identity(ssl: *const SSL) -> *const ::core::ffi::c_char;
}
unsafe extern "C" {
    /// SSL_CREDENTIAL_new_delegated returns a new, empty delegated credential, or
    /// NULL on error. Callers should release the result with `SSL_CREDENTIAL_free`
    /// when done.
    ///
    /// Callers should configure a delegated credential, certificate chain and
    /// private key on the credential, along with other properties, then add it with
    /// `SSL_CTX_add1_credential`.
    pub fn SSL_CREDENTIAL_new_delegated() -> *mut SSL_CREDENTIAL;
}
unsafe extern "C" {
    /// SSL_CREDENTIAL_set1_delegated_credential sets `cred`'s delegated credentials
    /// structure to `dc`. It returns one on success and zero on error, including if
    /// `dc` is malformed. This should be a DelegatedCredential structure, signed by
    /// the end-entity certificate, as described in RFC 9345.
    pub fn SSL_CREDENTIAL_set1_delegated_credential(
        cred: *mut SSL_CREDENTIAL,
        dc: *mut CRYPTO_BUFFER,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CREDENTIAL_new_raw_public_key returns a new raw public key credential
    /// using `pkey` as the public and private key, or nullptr on error. `pkey` must
    /// have both a private and public key.
    ///
    /// Callers should then add the returned credential with
    /// `SSL_CTX_add1_credential` and release it with `SSL_CREDENTIAL_free` when
    /// done.
    ///
    /// This credential may be configured before the handshake or dynamically in the
    /// early callback (see `SSL_CTX_set_select_certificate_cb`) and certificate
    /// callback (see `SSL_CTX_set_cert_cb`).
    pub fn SSL_CREDENTIAL_new_raw_public_key(pkey: *mut EVP_PKEY) -> *mut SSL_CREDENTIAL;
}
unsafe extern "C" {
    /// SSL_CREDENTIAL_new_raw_public_key_custom returns a new raw public key
    /// credential using `pubkey` as the public key and `method` as the custom
    /// private key method, or nullptr on error. `pkey` must have a public key.
    /// `method` must remain valid for the lifetime of the returned credential. See
    /// `SSL_CREDENTIAL_set_private_key_method` for how the custom private key method
    /// is used.
    ///
    /// Callers should then add the returned credential with
    /// `SSL_CTX_add1_credential` and release it with `SSL_CREDENTIAL_free` when
    /// done.
    ///
    /// This credential may be configured before the handshake or dynamically in the
    /// early callback (see `SSL_CTX_set_select_certificate_cb`) and certificate
    /// callback (see `SSL_CTX_set_cert_cb`).
    pub fn SSL_CREDENTIAL_new_raw_public_key_custom(
        pubkey: *mut EVP_PKEY,
        method: *const SSL_PRIVATE_KEY_METHOD,
    ) -> *mut SSL_CREDENTIAL;
}
unsafe extern "C" {
    /// SSL_CTX_set1_accepted_peer_cert_types sets the types of certificates that the
    /// caller wishes to accept from the peer, for `ctx`. `values` is a nonempty list
    /// of `num_values` certificate types (`TLSEXT_cert_type_*` values) in preference
    /// order. If a valid list is not configured explicitly, only X.509 certificates
    /// are accepted by default. This function returns one on success or zero on
    /// failure.
    pub fn SSL_CTX_set1_accepted_peer_cert_types(
        ctx: *mut SSL_CTX,
        values: *const u8,
        num_values: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set1_accepted_peer_cert_types behaves like
    /// `SSL_CTX_set1_accepted_peer_cert_types`, but configures the values on `ssl`.
    pub fn SSL_set1_accepted_peer_cert_types(
        ssl: *mut SSL,
        values: *const u8,
        num_values: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_set1_available_client_cert_types sets the types of certificates that
    /// the caller, as a client, wishes to advertise in order to authenticate itself
    /// to the server, for `ctx`. `values` is a nonempty list of `num_values`
    /// certificate types (`TLSEXT_cert_type_*` values) in preference order. Any
    /// values configured via this function will be sent in the
    /// client_certificate_type extension in ClientHello. `values` may be empty to
    /// indicate omission of the client_certificate_extension.
    ///
    /// Calling this function is optional: by default, the client_certificate_type
    /// extension for a client will be determined implicitly by the types of
    /// `SSL_CREDENTIAL`s present in the credential list. This function should only
    /// be used if the caller configures client credentials late (after the handshake
    /// begins), or wishes to override the default order derived from the credential
    /// list. This returns one on success or zero on failure.
    pub fn SSL_CTX_set1_available_client_cert_types(
        ctx: *mut SSL_CTX,
        values: *const u8,
        num_values: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set1_available_client_cert_types behaves like
    /// `SSL_CTX_set1_available_client_cert_types`, but configures the values on
    /// `ssl`.
    pub fn SSL_set1_available_client_cert_types(
        ssl: *mut SSL,
        values: *const u8,
        num_values: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_get_peer_cert_type returns a `TLSEXT_cert_type_*` value describing the
    /// type of the peer's certificate.  If the peer has no certificate, or it is too
    /// early in the handshake to receive one, this function returns
    /// `TLSEXT_cert_type_x509`.
    pub fn SSL_get_peer_cert_type(ssl: *const SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_get0_peer_rpk returns the peer's raw public key from `ssl`, if the peer
    /// has sent one in the handshake. It returns nullptr otherwise.
    pub fn SSL_get0_peer_rpk(ssl: *const SSL) -> *mut EVP_PKEY;
}
unsafe extern "C" {
    /// SSL_spake2plusv1_register computes the values that the client (w0,
    /// w1) and server (w0, registration_record) require to run SPAKE2+. These values
    /// can be used when calling `SSL_CREDENTIAL_new_spake2plusv1_client` and
    /// `SSL_CREDENTIAL_new_spake2plusv1_server`. The client and server identities
    /// must match the values passed to those functions.
    ///
    /// Returns one on success and zero on error.
    pub fn SSL_spake2plusv1_register(
        out_w0: *mut u8,
        out_w1: *mut u8,
        out_registration_record: *mut u8,
        password: *const u8,
        password_len: usize,
        client_identity: *const u8,
        client_identity_len: usize,
        server_identity: *const u8,
        server_identity_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CREDENTIAL_new_spake2plusv1_client creates a new `SSL_CREDENTIAL` that
    /// authenticates using SPAKE2+. It is to be used with a TLS client.
    ///
    /// The `context`, `client_identity`, and `server_identity` fields serve to
    /// identity the SPAKE2+ settings and both sides of a connection must agree on
    /// these values. If `context` is `NULL`, a default value will be used.
    ///
    /// `error_limit` is the number of failed handshakes allowed on the credential.
    /// After the limit is reached, using the credential will fail. Ideally this
    /// value is set to 1. Setting it to a higher value allows an attacker to have
    /// that many attempts at guessing the password using this `SSL_CREDENTIAL`.
    /// (Assuming that multiple TLS connections are allowed.)
    ///
    /// `w0` and `w1` come from calling `SSL_spake2plusv1_register`.
    ///
    /// Unlike most `SSL_CREDENTIAL`s, PAKE client credentials must be the only
    /// credential configured on the connection. BoringSSL does not currently support
    /// configuring multiple PAKE credentials as a client, or configuring a mix of
    /// PAKE and non-PAKE credentials. Once a PAKE credential is configured, the
    /// connection will require the server to authenticate with the same secret, so a
    /// successful connection then implies that the server supported the PAKE and
    /// knew the password.
    pub fn SSL_CREDENTIAL_new_spake2plusv1_client(
        context: *const u8,
        context_len: usize,
        client_identity: *const u8,
        client_identity_len: usize,
        server_identity: *const u8,
        server_identity_len: usize,
        error_limit: u32,
        w0: *const u8,
        w0_len: usize,
        w1: *const u8,
        w1_len: usize,
    ) -> *mut SSL_CREDENTIAL;
}
unsafe extern "C" {
    /// SSL_CREDENTIAL_new_spake2plusv1_server creates a new `SSL_CREDENTIAL` that
    /// authenticates using SPAKE2+. It is to be used with a TLS server.
    ///
    /// The `context`, `client_identity`, and `server_identity` fields serve to
    /// identity the SPAKE2+ settings and both sides of a connection must agree on
    /// these values. If `context` is `NULL`, a default value will be used.
    ///
    /// `rate_limit` is the number of failed or unfinished handshakes allowed on the
    /// credential. After the limit is reached, using the credential will fail.
    /// Ideally this value is set to 1. Setting it to a higher value allows an
    /// attacker to have that many attempts at guessing the password using this
    /// `SSL_CREDENTIAL`. (Assuming that multiple TLS connections are allowed.)
    ///
    /// WARNING: `rate_limit` differs from the client's `error_limit` parameter.
    /// Server PAKE credentials must temporarily deduct incomplete handshakes from
    /// the limit, until the peer completes the handshake correctly. Thus
    /// applications that use multiple connections in parallel may need a higher
    /// limit, and thus higher attacker exposure, to avoid failures. Such
    /// applications should instead use one PAKE-based connection to established a
    /// high-entropy secret (e.g. with `SSL_export_keying_material`) instead of
    /// repeating the PAKE exchange for each connection.
    ///
    /// `w0` and `registration_record` come from calling `SSL_spake2plusv1_register`,
    /// which may be computed externally so that the server does not know the
    /// password, or a password-equivalent secret.
    ///
    /// A server wishing to support a PAKE should install one of these credentials.
    /// It is also possible to install certificate-based credentials, in which case
    /// both PAKE and non-PAKE clients can be supported. However, if only a PAKE
    /// credential is installed then the server knows that any successfully-connected
    /// clients also knows the password. Otherwise, the server must be careful to
    /// inspect the credential used for a connection before assuming that.
    pub fn SSL_CREDENTIAL_new_spake2plusv1_server(
        context: *const u8,
        context_len: usize,
        client_identity: *const u8,
        client_identity_len: usize,
        server_identity: *const u8,
        server_identity_len: usize,
        rate_limit: u32,
        w0: *const u8,
        w0_len: usize,
        registration_record: *const u8,
        registration_record_len: usize,
    ) -> *mut SSL_CREDENTIAL;
}
pub const ssl_encryption_level_t_ssl_encryption_initial: ssl_encryption_level_t = 0;
pub const ssl_encryption_level_t_ssl_encryption_early_data: ssl_encryption_level_t = 1;
pub const ssl_encryption_level_t_ssl_encryption_handshake: ssl_encryption_level_t = 2;
pub const ssl_encryption_level_t_ssl_encryption_application: ssl_encryption_level_t = 3;
/// ssl_encryption_level_t represents an encryption level in TLS 1.3. Values in
/// this enum match the first 4 epochs used in DTLS 1.3 (section 6.1).
pub type ssl_encryption_level_t = ::core::ffi::c_uint;
/// ssl_quic_method_st (aka `SSL_QUIC_METHOD`) describes custom QUIC hooks.
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct ssl_quic_method_st {
    /// set_read_secret configures the read secret and cipher suite for the given
    /// encryption level. It returns one on success and zero to terminate the
    /// handshake with an error. It will be called at most once per encryption
    /// level.
    ///
    /// BoringSSL will not release read keys before QUIC may use them. Once a level
    /// has been initialized, QUIC may begin processing data from it. Handshake
    /// data should be passed to `SSL_provide_quic_data` and application data (if
    /// `level` is `ssl_encryption_early_data` or `ssl_encryption_application`) may
    /// be processed according to the rules of the QUIC protocol.
    ///
    /// QUIC ACKs packets at the same encryption level they were received at,
    /// except that client `ssl_encryption_early_data` (0-RTT) packets trigger
    /// server `ssl_encryption_application` (1-RTT) ACKs. BoringSSL will always
    /// install ACK-writing keys with `set_write_secret` before the packet-reading
    /// keys with `set_read_secret`. This ensures the caller can always ACK any
    /// packet it decrypts. Note this means the server installs 1-RTT write keys
    /// before 0-RTT read keys.
    ///
    /// The converse is not true. An encryption level may be configured with write
    /// secrets a roundtrip before the corresponding secrets for reading ACKs is
    /// available.
    pub set_read_secret: ::core::option::Option<
        unsafe extern "C" fn(
            ssl: *mut SSL,
            level: ssl_encryption_level_t,
            cipher: *const SSL_CIPHER,
            secret: *const u8,
            secret_len: usize,
        ) -> ::core::ffi::c_int,
    >,
    /// set_write_secret behaves like `set_read_secret` but configures the write
    /// secret and cipher suite for the given encryption level. It will be called
    /// at most once per encryption level.
    ///
    /// BoringSSL will not release write keys before QUIC may use them. If `level`
    /// is `ssl_encryption_early_data` or `ssl_encryption_application`, QUIC may
    /// begin sending application data at `level`. However, note that BoringSSL
    /// configures server `ssl_encryption_application` write keys before the client
    /// Finished. This allows QUIC to send half-RTT data, but the handshake is not
    /// confirmed at this point and, if requesting client certificates, the client
    /// is not yet authenticated.
    ///
    /// See `set_read_secret` for additional invariants between packets and their
    /// ACKs.
    ///
    /// Note that, on 0-RTT reject, the `ssl_encryption_early_data` write secret
    /// may use a different cipher suite from the other keys.
    pub set_write_secret: ::core::option::Option<
        unsafe extern "C" fn(
            ssl: *mut SSL,
            level: ssl_encryption_level_t,
            cipher: *const SSL_CIPHER,
            secret: *const u8,
            secret_len: usize,
        ) -> ::core::ffi::c_int,
    >,
    /// add_handshake_data adds handshake data to the current flight at the given
    /// encryption level. It returns one on success and zero on error.
    ///
    /// BoringSSL will pack data from a single encryption level together, but a
    /// single handshake flight may include multiple encryption levels. Callers
    /// should defer writing data to the network until `flush_flight` to better
    /// pack QUIC packets into transport datagrams.
    ///
    /// If `level` is not `ssl_encryption_initial`, this function will not be
    /// called before `level` is initialized with `set_write_secret`.
    pub add_handshake_data: ::core::option::Option<
        unsafe extern "C" fn(
            ssl: *mut SSL,
            level: ssl_encryption_level_t,
            data: *const u8,
            len: usize,
        ) -> ::core::ffi::c_int,
    >,
    /// flush_flight is called when the current flight is complete and should be
    /// written to the transport. Note a flight may contain data at several
    /// encryption levels. It returns one on success and zero on error.
    pub flush_flight:
        ::core::option::Option<unsafe extern "C" fn(ssl: *mut SSL) -> ::core::ffi::c_int>,
    /// send_alert sends a fatal alert at the specified encryption level. It
    /// returns one on success and zero on error.
    ///
    /// If `level` is not `ssl_encryption_initial`, this function will not be
    /// called before `level` is initialized with `set_write_secret`.
    pub send_alert: ::core::option::Option<
        unsafe extern "C" fn(
            ssl: *mut SSL,
            level: ssl_encryption_level_t,
            alert: u8,
        ) -> ::core::ffi::c_int,
    >,
}
unsafe extern "C" {
    /// SSL_quic_max_handshake_flight_len returns the maximum number of bytes
    /// that may be received at the given encryption level. This function should be
    /// used to limit buffering in the QUIC implementation.
    ///
    /// See https://www.rfc-editor.org/rfc/rfc9000#section-7.5
    pub fn SSL_quic_max_handshake_flight_len(
        ssl: *const SSL,
        level: ssl_encryption_level_t,
    ) -> usize;
}
unsafe extern "C" {
    /// SSL_quic_read_level returns the current read encryption level.
    ///
    /// TODO(davidben): Is it still necessary to expose this function to callers?
    /// QUICHE does not use it.
    pub fn SSL_quic_read_level(ssl: *const SSL) -> ssl_encryption_level_t;
}
unsafe extern "C" {
    /// SSL_quic_write_level returns the current write encryption level.
    ///
    /// TODO(davidben): Is it still necessary to expose this function to callers?
    /// QUICHE does not use it.
    pub fn SSL_quic_write_level(ssl: *const SSL) -> ssl_encryption_level_t;
}
unsafe extern "C" {
    /// SSL_provide_quic_data provides data from QUIC at a particular encryption
    /// level `level`. It returns one on success and zero on error. Note this
    /// function will return zero if the handshake is not expecting data from `level`
    /// at this time. The QUIC implementation should then close the connection with
    /// an error.
    pub fn SSL_provide_quic_data(
        ssl: *mut SSL,
        level: ssl_encryption_level_t,
        data: *const u8,
        len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_process_quic_post_handshake processes any data that QUIC has provided
    /// after the handshake has completed. This includes NewSessionTicket messages
    /// sent by the server. It returns one on success and zero on error.
    pub fn SSL_process_quic_post_handshake(ssl: *mut SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_set_quic_method configures the QUIC hooks. This should only be
    /// configured with a minimum version of TLS 1.3. `quic_method` must remain valid
    /// for the lifetime of `ctx`. It returns one on success and zero on error.
    pub fn SSL_CTX_set_quic_method(
        ctx: *mut SSL_CTX,
        quic_method: *const SSL_QUIC_METHOD,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set_quic_method configures the QUIC hooks. This should only be
    /// configured with a minimum version of TLS 1.3. `quic_method` must remain valid
    /// for the lifetime of `ssl`. It returns one on success and zero on error.
    pub fn SSL_set_quic_method(
        ssl: *mut SSL,
        quic_method: *const SSL_QUIC_METHOD,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set_quic_transport_params configures `ssl` to send `params` (of length
    /// `params_len`) in the quic_transport_parameters extension in either the
    /// ClientHello or EncryptedExtensions handshake message. It is an error to set
    /// transport parameters if `ssl` is not configured for QUIC. The buffer pointed
    /// to by `params` only need be valid for the duration of the call to this
    /// function. This function returns 1 on success and 0 on failure.
    pub fn SSL_set_quic_transport_params(
        ssl: *mut SSL,
        params: *const u8,
        params_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_get_peer_quic_transport_params provides the caller with the value of the
    /// quic_transport_parameters extension sent by the peer. A pointer to the buffer
    /// containing the TransportParameters will be put in `*out_params`, and its
    /// length in `*params_len`. This buffer will be valid for the lifetime of the
    /// `SSL`. If no params were received from the peer, `*out_params_len` will be 0.
    pub fn SSL_get_peer_quic_transport_params(
        ssl: *const SSL,
        out_params: *mut *const u8,
        out_params_len: *mut usize,
    );
}
unsafe extern "C" {
    /// SSL_set_quic_use_legacy_codepoint configures whether to use the legacy QUIC
    /// extension codepoint 0xffa5 as opposed to the official value 57. Call with
    /// `use_legacy` set to 1 to use 0xffa5 and call with 0 to use 57. By default,
    /// the standard code point is used.
    pub fn SSL_set_quic_use_legacy_codepoint(ssl: *mut SSL, use_legacy: ::core::ffi::c_int);
}
unsafe extern "C" {
    /// SSL_set_quic_early_data_context configures a context string in QUIC servers
    /// for accepting early data. If a resumption connection offers early data, the
    /// server will check if the value matches that of the connection which minted
    /// the ticket. If not, resumption still succeeds but early data is rejected.
    /// This should include all QUIC Transport Parameters except ones specified that
    /// the client MUST NOT remember. This should also include any application
    /// protocol-specific state. For HTTP/3, this should be the serialized server
    /// SETTINGS frame and the QUIC Transport Parameters (except the stateless reset
    /// token).
    ///
    /// This function may be called before `SSL_do_handshake` or during server
    /// certificate selection. It returns 1 on success and 0 on failure.
    pub fn SSL_set_quic_early_data_context(
        ssl: *mut SSL,
        context: *const u8,
        context_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_set_early_data_enabled sets whether early data is allowed to be used
    /// with resumptions using `ctx`.
    pub fn SSL_CTX_set_early_data_enabled(ctx: *mut SSL_CTX, enabled: ::core::ffi::c_int);
}
unsafe extern "C" {
    /// SSL_set_early_data_enabled sets whether early data is allowed to be used
    /// with resumptions using `ssl`. See `SSL_CTX_set_early_data_enabled` for more
    /// information.
    pub fn SSL_set_early_data_enabled(ssl: *mut SSL, enabled: ::core::ffi::c_int);
}
unsafe extern "C" {
    /// SSL_in_early_data returns one if `ssl` has a pending handshake that has
    /// progressed enough to send or receive early data. Clients may call `SSL_write`
    /// to send early data, but `SSL_read` will complete the handshake before
    /// accepting application data. Servers may call `SSL_read` to read early data
    /// and `SSL_write` to send half-RTT data.
    pub fn SSL_in_early_data(ssl: *const SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_SESSION_early_data_capable returns whether early data would have been
    /// attempted with `session` if enabled.
    pub fn SSL_SESSION_early_data_capable(session: *const SSL_SESSION) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_SESSION_copy_without_early_data returns a copy of `session` with early
    /// data disabled. If `session` already does not support early data, it returns
    /// `session` with the reference count increased. The caller takes ownership of
    /// the result and must release it with `SSL_SESSION_free`.
    ///
    /// This function may be used on the client to clear early data support from
    /// existing sessions when the server rejects early data. In particular,
    /// `SSL_R_WRONG_VERSION_ON_EARLY_DATA` requires a fresh connection to retry, and
    /// the client would not want 0-RTT enabled for the next connection attempt.
    pub fn SSL_SESSION_copy_without_early_data(session: *mut SSL_SESSION) -> *mut SSL_SESSION;
}
unsafe extern "C" {
    /// SSL_early_data_accepted returns whether early data was accepted on the
    /// handshake performed by `ssl`.
    pub fn SSL_early_data_accepted(ssl: *const SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_reset_early_data_reject resets `ssl` after an early data reject. All
    /// 0-RTT state is discarded, including any pending `SSL_write` calls. The caller
    /// should treat `ssl` as a logically fresh connection, usually by driving the
    /// handshake to completion using `SSL_do_handshake`.
    ///
    /// It is an error to call this function on an `SSL` object that is not signaling
    /// `SSL_ERROR_EARLY_DATA_REJECTED`.
    pub fn SSL_reset_early_data_reject(ssl: *mut SSL);
}
unsafe extern "C" {
    /// SSL_get_ticket_age_skew returns the difference, in seconds, between the
    /// client-sent ticket age and the server-computed value in TLS 1.3 server
    /// connections which resumed a session.
    pub fn SSL_get_ticket_age_skew(ssl: *const SSL) -> i32;
}
/// The handshake has not progressed far enough for the 0-RTT status to be
/// known.
pub const ssl_early_data_reason_t_ssl_early_data_unknown: ssl_early_data_reason_t = 0;
/// 0-RTT is disabled for this connection.
pub const ssl_early_data_reason_t_ssl_early_data_disabled: ssl_early_data_reason_t = 1;
/// 0-RTT was accepted.
pub const ssl_early_data_reason_t_ssl_early_data_accepted: ssl_early_data_reason_t = 2;
/// The negotiated protocol version does not support 0-RTT.
pub const ssl_early_data_reason_t_ssl_early_data_protocol_version: ssl_early_data_reason_t = 3;
/// The peer declined to offer or accept 0-RTT for an unknown reason.
pub const ssl_early_data_reason_t_ssl_early_data_peer_declined: ssl_early_data_reason_t = 4;
/// The client did not offer a session.
pub const ssl_early_data_reason_t_ssl_early_data_no_session_offered: ssl_early_data_reason_t = 5;
/// The server declined to resume the session.
pub const ssl_early_data_reason_t_ssl_early_data_session_not_resumed: ssl_early_data_reason_t = 6;
/// The session does not support 0-RTT.
pub const ssl_early_data_reason_t_ssl_early_data_unsupported_for_session: ssl_early_data_reason_t =
    7;
/// The server sent a HelloRetryRequest.
pub const ssl_early_data_reason_t_ssl_early_data_hello_retry_request: ssl_early_data_reason_t = 8;
/// The negotiated ALPN protocol did not match the session.
pub const ssl_early_data_reason_t_ssl_early_data_alpn_mismatch: ssl_early_data_reason_t = 9;
/// The connection negotiated Channel ID, which is incompatible with 0-RTT.
pub const ssl_early_data_reason_t_ssl_early_data_channel_id: ssl_early_data_reason_t = 10;
/// Value 11 is reserved. (It has historically `ssl_early_data_token_binding`.)
/// The client and server ticket age were too far apart.
pub const ssl_early_data_reason_t_ssl_early_data_ticket_age_skew: ssl_early_data_reason_t = 12;
/// QUIC parameters differ between this connection and the original.
pub const ssl_early_data_reason_t_ssl_early_data_quic_parameter_mismatch: ssl_early_data_reason_t =
    13;
/// The application settings did not match the session.
pub const ssl_early_data_reason_t_ssl_early_data_alps_mismatch: ssl_early_data_reason_t = 14;
/// The value of the largest entry.
pub const ssl_early_data_reason_t_ssl_early_data_reason_max_value: ssl_early_data_reason_t = 14;
/// An ssl_early_data_reason_t describes why 0-RTT was accepted or rejected.
/// These values are persisted to logs. Entries should not be renumbered and
/// numeric values should never be reused.
pub type ssl_early_data_reason_t = ::core::ffi::c_uint;
unsafe extern "C" {
    /// SSL_get_early_data_reason returns details why 0-RTT was accepted or rejected
    /// on `ssl`. This is primarily useful on the server.
    pub fn SSL_get_early_data_reason(ssl: *const SSL) -> ssl_early_data_reason_t;
}
unsafe extern "C" {
    /// SSL_early_data_reason_string returns a string representation for `reason`, or
    /// NULL if `reason` is unknown. This function may be used for logging.
    pub fn SSL_early_data_reason_string(
        reason: ssl_early_data_reason_t,
    ) -> *const ::core::ffi::c_char;
}
unsafe extern "C" {
    /// SSL_set_enable_ech_grease configures whether the client will send a GREASE
    /// ECH extension when no supported ECHConfig is available.
    pub fn SSL_set_enable_ech_grease(ssl: *mut SSL, enable: ::core::ffi::c_int);
}
unsafe extern "C" {
    /// SSL_set1_ech_config_list configures `ssl` to, as a client, offer ECH with the
    /// specified configuration. `ech_config_list` should contain a serialized
    /// ECHConfigList structure. It returns one on success and zero on error.
    ///
    /// This function returns an error if the input is malformed. If the input is
    /// valid but none of the ECHConfigs implement supported parameters, it will
    /// return success and proceed without ECH.
    ///
    /// If a supported ECHConfig is found, `ssl` will encrypt the true ClientHello
    /// parameters. If the server cannot decrypt it, e.g. due to a key mismatch, ECH
    /// has a recovery flow. `ssl` will handshake using the cleartext parameters,
    /// including a public name in the ECHConfig. If using
    /// `SSL_CTX_set_custom_verify`, callers should use `SSL_get0_ech_name_override`
    /// to verify the certificate with the public name. If using the built-in
    /// verifier, the `X509_STORE_CTX` will be configured automatically.
    ///
    /// If no other errors are found in this handshake, it will fail with
    /// `SSL_R_ECH_REJECTED`. Since it didn't use the true parameters, the connection
    /// cannot be used for application data. Instead, callers should handle this
    /// error by calling `SSL_get0_ech_retry_configs` and retrying the connection
    /// with updated ECH parameters. If the retry also fails with
    /// `SSL_R_ECH_REJECTED`, the caller should report a connection failure.
    pub fn SSL_set1_ech_config_list(
        ssl: *mut SSL,
        ech_config_list: *const u8,
        ech_config_list_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_get0_ech_name_override, if `ssl` is a client and the server rejected ECH,
    /// sets `*out_name` and `*out_name_len` to point to a buffer containing the ECH
    /// public name. Otherwise, the buffer will be empty.
    ///
    /// When offering ECH as a client, this function should be called during the
    /// certificate verification callback (see `SSL_CTX_set_custom_verify`). If
    /// `*out_name_len` is non-zero, the caller should verify the certificate against
    /// the result, interpreted as a DNS name, rather than the true server name. In
    /// this case, the handshake will never succeed and is only used to authenticate
    /// retry configs. See also `SSL_get0_ech_retry_configs`.
    pub fn SSL_get0_ech_name_override(
        ssl: *const SSL,
        out_name: *mut *const ::core::ffi::c_char,
        out_name_len: *mut usize,
    );
}
unsafe extern "C" {
    /// SSL_get0_ech_retry_configs sets `*out_retry_configs` and
    /// `*out_retry_configs_len` to a buffer containing a serialized ECHConfigList.
    /// If the server did not provide an ECHConfigList, `*out_retry_configs_len` will
    /// be zero.
    ///
    /// When handling an `SSL_R_ECH_REJECTED` error code as a client, callers should
    /// use this function to recover from potential key mismatches. If the result is
    /// non-empty, the caller should retry the connection, passing this buffer to
    /// `SSL_set1_ech_config_list`. If the result is empty, the server has rolled
    /// back ECH support, and the caller should retry without ECH.
    ///
    /// This function must only be called in response to an `SSL_R_ECH_REJECTED`
    /// error code. Calling this function on `ssl`s that have not authenticated the
    /// rejection handshake will assert in debug builds and otherwise return an
    /// unparsable list.
    pub fn SSL_get0_ech_retry_configs(
        ssl: *const SSL,
        out_retry_configs: *mut *const u8,
        out_retry_configs_len: *mut usize,
    );
}
unsafe extern "C" {
    /// SSL_marshal_ech_config constructs a new serialized ECHConfig. On success, it
    /// sets `*out` to a newly-allocated buffer containing the result and `*out_len`
    /// to the size of the buffer. The caller must call `OPENSSL_free` on `*out` to
    /// release the memory. On failure, it returns zero.
    ///
    /// The `config_id` field is a single byte identifier for the ECHConfig. Reusing
    /// config IDs is allowed, but if multiple ECHConfigs with the same config ID are
    /// active at a time, server load may increase. See
    /// `SSL_ECH_KEYS_has_duplicate_config_id`.
    ///
    /// The public key and KEM algorithm are taken from `key`. `public_name` is the
    /// DNS name used to authenticate the recovery flow. `max_name_len` should be the
    /// length of the longest name in the ECHConfig's anonymity set and influences
    /// client padding decisions.
    pub fn SSL_marshal_ech_config(
        out: *mut *mut u8,
        out_len: *mut usize,
        config_id: u8,
        key: *const EVP_HPKE_KEY,
        public_name: *const ::core::ffi::c_char,
        max_name_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_ECH_KEYS_new returns a newly-allocated `SSL_ECH_KEYS` or NULL on error.
    pub fn SSL_ECH_KEYS_new() -> *mut SSL_ECH_KEYS;
}
unsafe extern "C" {
    /// SSL_ECH_KEYS_up_ref increments the reference count of `keys`.
    pub fn SSL_ECH_KEYS_up_ref(keys: *mut SSL_ECH_KEYS);
}
unsafe extern "C" {
    /// SSL_ECH_KEYS_free releases memory associated with `keys`.
    pub fn SSL_ECH_KEYS_free(keys: *mut SSL_ECH_KEYS);
}
unsafe extern "C" {
    /// SSL_ECH_KEYS_add decodes `ech_config` as an ECHConfig and appends it with
    /// `key` to `keys`. If `is_retry_config` is non-zero, this config will be
    /// returned to the client on configuration mismatch. It returns one on success
    /// and zero on error.
    ///
    /// This function should be called successively to register each ECHConfig in
    /// decreasing order of preference. This configuration must be completed before
    /// setting `keys` on an `SSL_CTX` with `SSL_CTX_set1_ech_keys`. After that
    /// point, `keys` is immutable; no more ECHConfig values may be added.
    ///
    /// See also `SSL_CTX_set1_ech_keys`.
    pub fn SSL_ECH_KEYS_add(
        keys: *mut SSL_ECH_KEYS,
        is_retry_config: ::core::ffi::c_int,
        ech_config: *const u8,
        ech_config_len: usize,
        key: *const EVP_HPKE_KEY,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_ECH_KEYS_has_duplicate_config_id returns one if `keys` has duplicate
    /// config IDs or zero otherwise. Duplicate config IDs still work, but may
    /// increase server load due to trial decryption.
    pub fn SSL_ECH_KEYS_has_duplicate_config_id(keys: *const SSL_ECH_KEYS) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_ECH_KEYS_marshal_retry_configs serializes the retry configs in `keys` as
    /// an ECHConfigList. On success, it sets `*out` to a newly-allocated buffer
    /// containing the result and `*out_len` to the size of the buffer. The caller
    /// must call `OPENSSL_free` on `*out` to release the memory. On failure, it
    /// returns zero.
    ///
    /// This output may be advertised to clients in DNS.
    pub fn SSL_ECH_KEYS_marshal_retry_configs(
        keys: *const SSL_ECH_KEYS,
        out: *mut *mut u8,
        out_len: *mut usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_set1_ech_keys configures `ctx` to use `keys` to decrypt encrypted
    /// ClientHellos. It returns one on success, and zero on failure. If `keys` does
    /// not contain any retry configs, this function will fail. Retry configs are
    /// marked as such when they are added to `keys` with `SSL_ECH_KEYS_add`.
    ///
    /// Once `keys` has been passed to this function, it is immutable. Unlike most
    /// `SSL_CTX` configuration functions, this function may be called even if `ctx`
    /// already has associated connections on multiple threads. This may be used to
    /// rotate keys in a long-lived server process.
    ///
    /// The configured ECHConfig values should also be advertised out-of-band via DNS
    /// (see RFC 9848). Before advertising an ECHConfig in DNS, deployments should
    /// ensure all instances of the service are configured with the ECHConfig and
    /// corresponding private key.
    ///
    /// Only the most recent fully-deployed ECHConfigs should be advertised in DNS.
    /// `keys` may contain a newer set if those ECHConfigs are mid-deployment. It
    /// should also contain older sets, until the DNS change has rolled out and the
    /// old records have expired from caches.
    ///
    /// If there is a mismatch, `SSL` objects associated with `ctx` will complete the
    /// handshake using the cleartext ClientHello and send updated ECHConfig values
    /// to the client. The client will then retry to recover, but with a latency
    /// penalty. This recovery flow depends on the public name in the ECHConfig.
    /// Before advertising an ECHConfig in DNS, deployments must ensure all instances
    /// of the service can present a valid certificate for the public name.
    ///
    /// BoringSSL negotiates ECH before certificate selection callbacks are called,
    /// including `SSL_CTX_set_select_certificate_cb`. If ECH is negotiated, the
    /// reported `SSL_CLIENT_HELLO` structure and `SSL_get_servername` function will
    /// transparently reflect the inner ClientHello. Callers should select parameters
    /// based on these values to correctly handle ECH as well as the recovery flow.
    pub fn SSL_CTX_set1_ech_keys(ctx: *mut SSL_CTX, keys: *mut SSL_ECH_KEYS) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_ech_accepted returns one if `ssl` negotiated ECH and zero otherwise.
    pub fn SSL_ech_accepted(ssl: *const SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_alert_type_string_long returns a string description of `value` as an
    /// alert type (warning or fatal).
    pub fn SSL_alert_type_string_long(value: ::core::ffi::c_int) -> *const ::core::ffi::c_char;
}
unsafe extern "C" {
    /// SSL_alert_desc_string_long returns a string description of `value` as an
    /// alert description or "unknown" if unknown.
    pub fn SSL_alert_desc_string_long(value: ::core::ffi::c_int) -> *const ::core::ffi::c_char;
}
unsafe extern "C" {
    /// SSL_send_fatal_alert sends a fatal alert over `ssl` of the specified type,
    /// which should be one of the `SSL_AD_*` constants. It returns one on success
    /// and <= 0 on error. The caller should pass the return value into
    /// `SSL_get_error` to determine how to proceed. Once this function has been
    /// called, future calls to `SSL_write` will fail.
    ///
    /// If retrying a failed operation due to `SSL_ERROR_WANT_WRITE`, subsequent
    /// calls must use the same `alert` parameter.
    pub fn SSL_send_fatal_alert(ssl: *mut SSL, alert: u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// ex_data functions.
    ///
    /// See `ex_data.h` for details.
    pub fn SSL_set_ex_data(
        ssl: *mut SSL,
        idx: ::core::ffi::c_int,
        data: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn SSL_get_ex_data(ssl: *const SSL, idx: ::core::ffi::c_int) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    pub fn SSL_get_ex_new_index(
        argl: ::core::ffi::c_long,
        argp: *mut ::core::ffi::c_void,
        unused: *mut CRYPTO_EX_unused,
        dup_unused: CRYPTO_EX_dup,
        free_func: CRYPTO_EX_free,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn SSL_SESSION_set_ex_data(
        session: *mut SSL_SESSION,
        idx: ::core::ffi::c_int,
        data: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn SSL_SESSION_get_ex_data(
        session: *const SSL_SESSION,
        idx: ::core::ffi::c_int,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    pub fn SSL_SESSION_get_ex_new_index(
        argl: ::core::ffi::c_long,
        argp: *mut ::core::ffi::c_void,
        unused: *mut CRYPTO_EX_unused,
        dup_unused: CRYPTO_EX_dup,
        free_func: CRYPTO_EX_free,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn SSL_CTX_set_ex_data(
        ctx: *mut SSL_CTX,
        idx: ::core::ffi::c_int,
        data: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn SSL_CTX_get_ex_data(
        ctx: *const SSL_CTX,
        idx: ::core::ffi::c_int,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    pub fn SSL_CTX_get_ex_new_index(
        argl: ::core::ffi::c_long,
        argp: *mut ::core::ffi::c_void,
        unused: *mut CRYPTO_EX_unused,
        dup_unused: CRYPTO_EX_dup,
        free_func: CRYPTO_EX_free,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn SSL_CREDENTIAL_set_ex_data(
        cred: *mut SSL_CREDENTIAL,
        idx: ::core::ffi::c_int,
        data: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    pub fn SSL_CREDENTIAL_get_ex_data(
        cred: *const SSL_CREDENTIAL,
        idx: ::core::ffi::c_int,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    pub fn SSL_CREDENTIAL_get_ex_new_index(
        argl: ::core::ffi::c_long,
        argp: *mut ::core::ffi::c_void,
        unused: *mut CRYPTO_EX_unused,
        dup_unused: CRYPTO_EX_dup,
        free_func: CRYPTO_EX_free,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_get_ivs sets `*out_iv_len` to the length of the IVs for the ciphers
    /// underlying `ssl` and sets `*out_read_iv` and `*out_write_iv` to point to the
    /// current IVs for the read and write directions. This is only meaningful for
    /// connections with implicit IVs (i.e. CBC mode with TLS 1.0).
    ///
    /// It returns one on success or zero on error.
    pub fn SSL_get_ivs(
        ssl: *const SSL,
        out_read_iv: *mut *const u8,
        out_write_iv: *mut *const u8,
        out_iv_len: *mut usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_get_key_block_len returns the length of `ssl`'s key block, for TLS 1.2
    /// and below. It is an error to call this function during a handshake, or if
    /// `ssl` negotiated TLS 1.3.
    pub fn SSL_get_key_block_len(ssl: *const SSL) -> usize;
}
unsafe extern "C" {
    /// SSL_generate_key_block generates `out_len` bytes of key material for `ssl`'s
    /// current connection state, for TLS 1.2 and below. It is an error to call this
    /// function during a handshake, or if `ssl` negotiated TLS 1.3.
    pub fn SSL_generate_key_block(
        ssl: *const SSL,
        out: *mut u8,
        out_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_get_read_sequence returns, in TLS, the expected sequence number of the
    /// next incoming record in the current epoch.
    ///
    /// TODO(crbug.com/42290608): In DTLS, it returns the maximum sequence number
    /// received in the current epoch (for some notion of "current" specific to
    /// BoringSSL) and includes the epoch number in the two most significant bytes,
    /// but this is deprecated. Use `SSL_get_dtls_read_sequence` instead.
    pub fn SSL_get_read_sequence(ssl: *const SSL) -> u64;
}
unsafe extern "C" {
    /// SSL_get_write_sequence returns the sequence number of the next outgoing
    /// record in the current epoch.
    ///
    /// TODO(crbug.com/42290608): In DTLS, it includes the epoch number in the two
    /// most significant bytes, but this is deprecated. Use
    /// `SSL_get_dtls_write_sequence` instead.
    pub fn SSL_get_write_sequence(ssl: *const SSL) -> u64;
}
unsafe extern "C" {
    /// SSL_CTX_set_record_protocol_version returns whether `version` is zero.
    pub fn SSL_CTX_set_record_protocol_version(
        ctx: *mut SSL_CTX,
        version: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_is_dtls_handshake_idle returns one `ssl`'s handshake is idle and zero if
    /// it is busy. The handshake is considered idle if all of the following are
    /// true:
    ///
    /// - `ssl` is not mid handshake or post-handshake transaction.
    /// - In DTLS 1.3, all sent handshake messages have been acknowledged. That is,
    ///   `ssl` does not have data to retransmit.
    /// - All received handshake data has been processed. That is, `ssl` has no
    ///   buffered partial or out-of-order messages.
    ///
    /// If any condition is false, the handshake is considered busy. If this function
    /// reports the handshake is busy, it is expected that the handshake will become
    /// idle after short timers and a few roundtrips of successful communication.
    /// However, this is not guaranteed if, e.g., the peer misbehaves or sends many
    /// KeyUpdates.
    ///
    /// WARNING: In DTLS 1.3, this function may return one while multiple active read
    /// epochs exist in `ssl`.
    ///
    /// WARNING: In DTLS 1.2 (or earlier), if `ssl` is the role that speaks last, it
    /// retains its final flight for retransmission in case of loss. There is no
    /// explicit protocol signal for when this completes, though after receiving
    /// application data and/or a timeout it is likely that this is no longer needed.
    /// BoringSSL does not currently evaluate either condition and leaves it to
    /// the caller to determine whether this is now unnecessary. This applies when
    /// `ssl` is a server for full handshakes and when `ssl` is a client for full
    /// handshakes.
    pub fn SSL_is_dtls_handshake_idle(ssl: *const SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_get_dtls_handshake_read_seq returns the 16-bit sequence number of the
    /// next DTLS handshake message to be read, or 0x10000 if handshake message
    /// 0xffff (the maximum) has already been read.
    pub fn SSL_get_dtls_handshake_read_seq(ssl: *const SSL) -> u32;
}
unsafe extern "C" {
    /// SSL_get_dtls_handshake_write_seq returns the 16-bit sequence number of the
    /// next DTLS handshake message to be written or 0x10000 if handshake message
    /// 0xffff (the maximum) has already been written.
    pub fn SSL_get_dtls_handshake_write_seq(ssl: *const SSL) -> u32;
}
unsafe extern "C" {
    /// SSL_get_dtls_read_epoch returns the highest available DTLS read epoch in
    /// `ssl`. In DTLS 1.3, `ssl` may have earlier epochs also active, sometimes to
    /// optionally improve handling of reordered packets and sometimes as an
    /// important part of the protocol correctness in the face of packet loss.
    ///
    /// The failure conditions of `SSL_get_dtls_read_traffic_secret` and
    /// `SSL_get_dtls_read_sequence` can be used to determine if past epochs are
    /// active.
    pub fn SSL_get_dtls_read_epoch(ssl: *const SSL) -> u16;
}
unsafe extern "C" {
    /// SSL_get_dtls_write_epoch returns the current DTLS write epoch. If the
    /// handshake is idle (see `SSL_is_dtls_handshake_idle`), no other write epochs
    /// will be active.
    pub fn SSL_get_dtls_write_epoch(ssl: *const SSL) -> u16;
}
unsafe extern "C" {
    /// SSL_get_dtls_read_sequence returns one more than the sequence number of the
    /// highest record received in `epoch`. If no records have been received in
    /// `epoch`. If the epoch does not exist, it returns `UINT64_MAX`.
    ///
    /// It is safe to discard all sequence numbers less than the return value of this
    /// function. The sequence numbers returned by this function do not include the
    /// epoch number in the upper 16 bits.
    pub fn SSL_get_dtls_read_sequence(ssl: *const SSL, epoch: u16) -> u64;
}
unsafe extern "C" {
    /// SSL_get_dtls_write_sequence returns the sequence number of the next record to
    /// be sent in `epoch`. If the epoch does not exist, it returns `UINT64_MAX`.
    ///
    /// The sequence numbers returned by this function do not include the epoch
    /// number in the upper 16 bits.
    pub fn SSL_get_dtls_write_sequence(ssl: *const SSL, epoch: u16) -> u64;
}
unsafe extern "C" {
    /// SSL_get_dtls_read_traffic_secret looks up the traffic secret for read epoch
    /// `epoch`. If the epoch exists and is an encrypted (not epoch zero) DTLS 1.3
    /// epoch, it sets `*out_data` and `*out_len` to a buffer containing the secrets
    /// and returns one. Otherwise, it returns zero. The buffer is valid until the
    /// next operation on `ssl`.
    pub fn SSL_get_dtls_read_traffic_secret(
        ssl: *const SSL,
        out_data: *mut *const u8,
        out_len: *mut usize,
        epoch: u16,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_get_dtls_write_traffic_secret looks up the traffic secret for write epoch
    /// `epoch`. If the epoch exists and is an encrypted (not epoch zero) DTLS 1.3
    /// epoch, it sets `*out_data` and `*out_len` to a buffer containing the secrets
    /// and returns one. Otherwise, it returns zero. The buffer is valid until the
    /// next operation on `ssl`.
    pub fn SSL_get_dtls_write_traffic_secret(
        ssl: *const SSL,
        out_data: *mut *const u8,
        out_len: *mut usize,
        epoch: u16,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_serialize_capabilities writes an opaque byte string to `out` describing
    /// some of `ssl`'s capabilities. It returns one on success and zero on error.
    ///
    /// This string is used by BoringSSL internally to reduce the impact of version
    /// skew.
    pub fn SSL_serialize_capabilities(ssl: *const SSL, out: *mut CBB) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_request_handshake_hints configures `ssl` to generate a handshake hint for
    /// `client_hello`. It returns one on success and zero on error. `client_hello`
    /// should contain a serialized ClientHello structure, from the `client_hello`
    /// and `client_hello_len` fields of the `SSL_CLIENT_HELLO` structure.
    /// `capabilities` should contain the output of `SSL_serialize_capabilities`.
    ///
    /// When configured, `ssl` will perform no I/O (so there is no need to configure
    /// `BIO`s). For QUIC, the caller should still configure an `SSL_QUIC_METHOD`,
    /// but the callbacks themselves will never be called and may be left NULL or
    /// report failure. `SSL_provide_quic_data` also should not be called.
    ///
    /// If hint generation is successful, `SSL_do_handshake` will stop the handshake
    /// early with `SSL_get_error` returning `SSL_ERROR_HANDSHAKE_HINTS_READY`. At
    /// this point, the caller should run `SSL_serialize_handshake_hints` to extract
    /// the resulting hints.
    ///
    /// Hint generation may fail if, e.g., `ssl` was unable to process the
    /// ClientHello. Callers should then complete the certificate selection RPC and
    /// continue the original handshake with no hint. It will likely fail, but this
    /// reports the correct alert to the client and is more robust in case of
    /// mismatch.
    pub fn SSL_request_handshake_hints(
        ssl: *mut SSL,
        client_hello: *const u8,
        client_hello_len: usize,
        capabilities: *const u8,
        capabilities_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_serialize_handshake_hints writes an opaque byte string to `out`
    /// containing the handshake hints computed by `out`. It returns one on success
    /// and zero on error. This function should only be called if
    /// `SSL_request_handshake_hints` was configured and the handshake terminated
    /// with `SSL_ERROR_HANDSHAKE_HINTS_READY`.
    ///
    /// This string may be passed to `SSL_set_handshake_hints` on another `SSL` to
    /// avoid an extra signature call.
    pub fn SSL_serialize_handshake_hints(ssl: *const SSL, out: *mut CBB) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set_handshake_hints configures `ssl` to use `hints` as handshake hints.
    /// It returns one on success and zero on error. The handshake will then continue
    /// as before, but apply predicted values from `hints` where applicable.
    ///
    /// Hints may contain connection and session secrets, so they must not leak and
    /// must come from a source trusted to terminate the connection. However, they
    /// will not change `ssl`'s configuration. The caller is responsible for
    /// serializing and applying options from the RPC server as needed. This ensures
    /// `ssl`'s behavior is self-consistent and consistent with the caller's local
    /// decisions.
    pub fn SSL_set_handshake_hints(
        ssl: *mut SSL,
        hints: *const u8,
        hints_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_set_msg_callback installs `cb` as the message callback for `ctx`.
    /// This callback will be called when sending or receiving low-level record
    /// headers, complete handshake messages, ChangeCipherSpec, alerts, and DTLS
    /// ACKs. `write_p` is one for outgoing messages and zero for incoming messages.
    ///
    /// For each record header, `cb` is called with `version` = 0 and `content_type`
    /// = `SSL3_RT_HEADER`. The `len` bytes from `buf` contain the header. Note that
    /// this does not include the record body. If the record is sealed, the length
    /// in the header is the length of the ciphertext.
    ///
    /// For each handshake message, ChangeCipherSpec, alert, and DTLS ACK, `version`
    /// is the protocol version and `content_type` is the corresponding record type.
    /// The `len` bytes from `buf` contain the handshake message, one-byte
    /// ChangeCipherSpec body, two-byte alert, and ACK respectively.
    ///
    /// In connections that enable ECH, `cb` is additionally called with
    /// `content_type` = `SSL3_RT_CLIENT_HELLO_INNER` for each ClientHelloInner that
    /// is encrypted or decrypted. The `len` bytes from `buf` contain the
    /// ClientHelloInner, including the reconstructed outer extensions and handshake
    /// header.
    ///
    /// For a V2ClientHello, `version` is `SSL2_VERSION`, `content_type` is zero, and
    /// the `len` bytes from `buf` contain the V2ClientHello structure.
    pub fn SSL_CTX_set_msg_callback(
        ctx: *mut SSL_CTX,
        cb: ::core::option::Option<
            unsafe extern "C" fn(
                is_write: ::core::ffi::c_int,
                version: ::core::ffi::c_int,
                content_type: ::core::ffi::c_int,
                buf: *const ::core::ffi::c_void,
                len: usize,
                ssl: *mut SSL,
                arg: *mut ::core::ffi::c_void,
            ),
        >,
    );
}
unsafe extern "C" {
    /// SSL_CTX_set_msg_callback_arg sets the `arg` parameter of the message
    /// callback.
    pub fn SSL_CTX_set_msg_callback_arg(ctx: *mut SSL_CTX, arg: *mut ::core::ffi::c_void);
}
unsafe extern "C" {
    /// SSL_set_msg_callback installs `cb` as the message callback of `ssl`. See
    /// `SSL_CTX_set_msg_callback` for when this callback is called.
    pub fn SSL_set_msg_callback(
        ssl: *mut SSL,
        cb: ::core::option::Option<
            unsafe extern "C" fn(
                write_p: ::core::ffi::c_int,
                version: ::core::ffi::c_int,
                content_type: ::core::ffi::c_int,
                buf: *const ::core::ffi::c_void,
                len: usize,
                ssl: *mut SSL,
                arg: *mut ::core::ffi::c_void,
            ),
        >,
    );
}
unsafe extern "C" {
    /// SSL_set_msg_callback_arg sets the `arg` parameter of the message callback.
    pub fn SSL_set_msg_callback_arg(ssl: *mut SSL, arg: *mut ::core::ffi::c_void);
}
unsafe extern "C" {
    /// SSL_CTX_set_keylog_callback configures a callback to log key material. This
    /// is intended for debugging use with tools like Wireshark. The `cb` function
    /// should log `line` followed by a newline, synchronizing with any concurrent
    /// access to the log.
    ///
    /// The format is described in
    /// https://www.ietf.org/archive/id/draft-ietf-tls-keylogfile-01.html
    ///
    /// WARNING: The data in `line` allows an attacker to break security properties
    /// of the TLS protocol, including confidentiality, integrity, and forward
    /// secrecy. This impacts both the current connection, and, in TLS 1.2, future
    /// connections that resume a session from it. Both direct access to the data and
    /// side channel leaks from application code are possible attack vectors. This
    /// callback is intended for debugging and should not be used in production
    /// connections.
    pub fn SSL_CTX_set_keylog_callback(
        ctx: *mut SSL_CTX,
        cb: ::core::option::Option<
            unsafe extern "C" fn(ssl: *const SSL, line: *const ::core::ffi::c_char),
        >,
    );
}
unsafe extern "C" {
    /// SSL_CTX_get_keylog_callback returns the callback configured by
    /// `SSL_CTX_set_keylog_callback`.
    pub fn SSL_CTX_get_keylog_callback(
        ctx: *const SSL_CTX,
    ) -> ::core::option::Option<
        unsafe extern "C" fn(ctx: *const SSL, arg1: *const ::core::ffi::c_char),
    >;
}
unsafe extern "C" {
    /// SSL_CTX_set_current_time_cb configures a callback to retrieve the current
    /// time, which should be set in `*out_clock`. This can be used for testing
    /// purposes; for example, a callback can be configured that returns a time
    /// set explicitly by the test. The `ssl` pointer passed to `cb` is always null.
    pub fn SSL_CTX_set_current_time_cb(
        ctx: *mut SSL_CTX,
        cb: ::core::option::Option<unsafe extern "C" fn(ssl: *const SSL, out_clock: *mut timeval)>,
    );
}
unsafe extern "C" {
    /// SSL_set_shed_handshake_config allows some of the configuration of `ssl` to be
    /// freed after its handshake completes.  Once configuration has been shed, APIs
    /// that query it may fail.  "Configuration" in this context means anything that
    /// was set by the caller, as distinct from information derived from the
    /// handshake.  For example, `SSL_get_ciphers` queries how the `SSL` was
    /// configured by the caller, and fails after configuration has been shed,
    /// whereas `SSL_get_cipher` queries the result of the handshake, and is
    /// unaffected by configuration shedding.
    ///
    /// If configuration shedding is enabled, it is an error to call `SSL_clear`.
    ///
    /// Note that configuration shedding as a client additionally depends on
    /// renegotiation being disabled (see `SSL_set_renegotiate_mode`). If
    /// renegotiation is possible, the configuration will be retained. If
    /// configuration shedding is enabled and renegotiation later disabled after the
    /// handshake, `SSL_set_renegotiate_mode` will shed configuration then. This may
    /// be useful for clients which support renegotiation with some ALPN protocols,
    /// such as HTTP/1.1, and not others, such as HTTP/2.
    pub fn SSL_set_shed_handshake_config(ssl: *mut SSL, enable: ::core::ffi::c_int);
}
pub const ssl_renegotiate_mode_t_ssl_renegotiate_never: ssl_renegotiate_mode_t = 0;
pub const ssl_renegotiate_mode_t_ssl_renegotiate_once: ssl_renegotiate_mode_t = 1;
pub const ssl_renegotiate_mode_t_ssl_renegotiate_freely: ssl_renegotiate_mode_t = 2;
pub const ssl_renegotiate_mode_t_ssl_renegotiate_ignore: ssl_renegotiate_mode_t = 3;
pub const ssl_renegotiate_mode_t_ssl_renegotiate_explicit: ssl_renegotiate_mode_t = 4;
pub type ssl_renegotiate_mode_t = ::core::ffi::c_uint;
unsafe extern "C" {
    /// SSL_set_renegotiate_mode configures how `ssl`, a client, reacts to
    /// renegotiation attempts by a server. If `ssl` is a server, peer-initiated
    /// renegotiations are *always* rejected and this function does nothing.
    ///
    /// WARNING: Renegotiation is error-prone, complicates TLS's security properties,
    /// and increases its attack surface. When enabled, many common assumptions about
    /// BoringSSL's behavior no longer hold, and the calling application must handle
    /// more cases. Renegotiation is also incompatible with many application
    /// protocols, e.g. section 9.2.1 of RFC 7540. Many functions behave in ambiguous
    /// or undefined ways during a renegotiation.
    ///
    /// The renegotiation mode defaults to `ssl_renegotiate_never`, but may be set
    /// at any point in a connection's lifetime. Set it to `ssl_renegotiate_once` to
    /// allow one renegotiation, `ssl_renegotiate_freely` to allow all
    /// renegotiations or `ssl_renegotiate_ignore` to ignore HelloRequest messages.
    /// Note that ignoring HelloRequest messages may cause the connection to stall
    /// if the server waits for the renegotiation to complete.
    ///
    /// If set to `ssl_renegotiate_explicit`, `SSL_read` and `SSL_peek` calls which
    /// encounter a HelloRequest will pause with `SSL_ERROR_WANT_RENEGOTIATE`.
    /// `SSL_write` will continue to work while paused. The caller may call
    /// `SSL_renegotiate` to begin the renegotiation at a later point. This mode may
    /// be used if callers wish to eagerly call `SSL_peek` without triggering a
    /// renegotiation.
    ///
    /// If configuration shedding is enabled (see `SSL_set_shed_handshake_config`),
    /// configuration is released if, at any point after the handshake, renegotiation
    /// is disabled. It is not possible to switch from disabling renegotiation to
    /// enabling it on a given connection. Callers that condition renegotiation on,
    /// e.g., ALPN must enable renegotiation before the handshake and conditionally
    /// disable it afterwards.
    ///
    /// When enabled, renegotiation can cause properties of `ssl`, such as the cipher
    /// suite, to change during the lifetime of the connection. More over, during a
    /// renegotiation, not all properties of the new handshake are available or fully
    /// established. In BoringSSL, most functions, such as `SSL_get_current_cipher`,
    /// report information from the most recently completed handshake, not the
    /// pending one. However, renegotiation may rerun handshake callbacks, such as
    /// `SSL_CTX_set_cert_cb`. Such callbacks must ensure they are acting on the
    /// desired versions of each property.
    ///
    /// BoringSSL does not reverify peer certificates on renegotiation and instead
    /// requires they match between handshakes, so certificate verification callbacks
    /// (see `SSL_CTX_set_custom_verify`) may assume `ssl` is in the initial
    /// handshake and use `SSL_get0_peer_certificates`, etc.
    ///
    /// There is no support in BoringSSL for initiating renegotiations as a client
    /// or server.
    pub fn SSL_set_renegotiate_mode(ssl: *mut SSL, mode: ssl_renegotiate_mode_t);
}
unsafe extern "C" {
    /// SSL_renegotiate starts a deferred renegotiation on `ssl` if it was configured
    /// with `ssl_renegotiate_explicit` and has a pending HelloRequest. It returns
    /// one on success and zero on error.
    ///
    /// This function does not do perform any I/O. On success, a subsequent
    /// `SSL_do_handshake` call will run the handshake. `SSL_write` and
    /// `SSL_read` will also complete the handshake before sending or receiving
    /// application data.
    pub fn SSL_renegotiate(ssl: *mut SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_renegotiate_pending returns one if `ssl` is in the middle of a
    /// renegotiation.
    pub fn SSL_renegotiate_pending(ssl: *mut SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_total_renegotiations returns the total number of renegotiation handshakes
    /// performed by `ssl`. This includes the pending renegotiation, if any.
    pub fn SSL_total_renegotiations(ssl: *const SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_get_max_cert_list returns the maximum length, in bytes, of a peer
    /// certificate chain accepted by `ctx`.
    pub fn SSL_CTX_get_max_cert_list(ctx: *const SSL_CTX) -> usize;
}
unsafe extern "C" {
    /// SSL_CTX_set_max_cert_list sets the maximum length, in bytes, of a peer
    /// certificate chain to `max_cert_list`. This affects how much memory may be
    /// consumed during the handshake.
    pub fn SSL_CTX_set_max_cert_list(ctx: *mut SSL_CTX, max_cert_list: usize);
}
unsafe extern "C" {
    /// SSL_get_max_cert_list returns the maximum length, in bytes, of a peer
    /// certificate chain accepted by `ssl`.
    pub fn SSL_get_max_cert_list(ssl: *const SSL) -> usize;
}
unsafe extern "C" {
    /// SSL_set_max_cert_list sets the maximum length, in bytes, of a peer
    /// certificate chain to `max_cert_list`. This affects how much memory may be
    /// consumed during the handshake.
    pub fn SSL_set_max_cert_list(ssl: *mut SSL, max_cert_list: usize);
}
unsafe extern "C" {
    /// SSL_CTX_set_max_send_fragment sets the maximum length, in bytes, of records
    /// sent by `ctx`. Beyond this length, handshake messages and application data
    /// will be split into multiple records. It returns one on success or zero on
    /// error.
    pub fn SSL_CTX_set_max_send_fragment(
        ctx: *mut SSL_CTX,
        max_send_fragment: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set_max_send_fragment sets the maximum length, in bytes, of records sent
    /// by `ssl`. Beyond this length, handshake messages and application data will
    /// be split into multiple records. It returns one on success or zero on
    /// error.
    pub fn SSL_set_max_send_fragment(ssl: *mut SSL, max_send_fragment: usize)
        -> ::core::ffi::c_int;
}
/// ssl_early_callback_ctx (aka `SSL_CLIENT_HELLO`) is passed to certain
/// callbacks that are called very early on during the server handshake. At this
/// point, much of the SSL* hasn't been filled out and only the ClientHello can
/// be depended on.
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct ssl_early_callback_ctx {
    pub ssl: *mut SSL,
    pub client_hello: *const u8,
    pub client_hello_len: usize,
    pub version: u16,
    pub random: *const u8,
    pub random_len: usize,
    pub session_id: *const u8,
    pub session_id_len: usize,
    pub dtls_cookie: *const u8,
    pub dtls_cookie_len: usize,
    pub cipher_suites: *const u8,
    pub cipher_suites_len: usize,
    pub compression_methods: *const u8,
    pub compression_methods_len: usize,
    pub extensions: *const u8,
    pub extensions_len: usize,
}
/// ssl_select_cert_success indicates that the certificate selection was
/// successful.
pub const ssl_select_cert_result_t_ssl_select_cert_success: ssl_select_cert_result_t = 1;
/// ssl_select_cert_retry indicates that the operation could not be
/// immediately completed and must be reattempted at a later point.
pub const ssl_select_cert_result_t_ssl_select_cert_retry: ssl_select_cert_result_t = 0;
/// ssl_select_cert_error indicates that a fatal error occurred and the
/// handshake should be terminated.
pub const ssl_select_cert_result_t_ssl_select_cert_error: ssl_select_cert_result_t = -1;
/// ssl_select_cert_disable_ech indicates that, although an encrypted
/// ClientHelloInner was decrypted, it should be discarded. The certificate
/// selection callback will then be called again, passing in the
/// ClientHelloOuter instead. From there, the handshake will proceed
/// without retry_configs, to signal to the client to disable ECH.
///
/// This value may only be returned when `SSL_ech_accepted` returns one. It
/// may be useful if the ClientHelloInner indicated a service which does not
/// support ECH, e.g. if it is a TLS-1.2 only service.
pub const ssl_select_cert_result_t_ssl_select_cert_disable_ech: ssl_select_cert_result_t = -2;
/// ssl_select_cert_result_t enumerates the possible results from selecting a
/// certificate with `select_certificate_cb`.
pub type ssl_select_cert_result_t = ::core::ffi::c_int;
unsafe extern "C" {
    /// SSL_early_callback_ctx_extension_get searches the extensions in
    /// `client_hello` for an extension of the given type. If not found, it returns
    /// zero. Otherwise it sets `out_data` to point to the extension contents (not
    /// including the type and length bytes), sets `out_len` to the length of the
    /// extension contents and returns one.
    pub fn SSL_early_callback_ctx_extension_get(
        client_hello: *const SSL_CLIENT_HELLO,
        extension_type: u16,
        out_data: *mut *const u8,
        out_len: *mut usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_set_select_certificate_cb sets a callback that is called before most
    /// ClientHello processing and before the decision whether to resume a session
    /// is made. The callback may inspect the ClientHello and configure the
    /// connection. See `ssl_select_cert_result_t` for details of the return values.
    ///
    /// In the case that a retry is indicated, `SSL_get_error` will return
    /// `SSL_ERROR_PENDING_CERTIFICATE` and the caller should arrange for the
    /// high-level operation on `ssl` to be retried at a later time, which will
    /// result in another call to `cb`.
    ///
    /// `SSL_get_servername` may be used during this callback.
    ///
    /// Note: The `SSL_CLIENT_HELLO` is only valid for the duration of the callback
    /// and is not valid while the handshake is paused.
    pub fn SSL_CTX_set_select_certificate_cb(
        ctx: *mut SSL_CTX,
        cb: ::core::option::Option<
            unsafe extern "C" fn(arg1: *const SSL_CLIENT_HELLO) -> ssl_select_cert_result_t,
        >,
    );
}
unsafe extern "C" {
    /// SSL_CTX_set_dos_protection_cb sets a callback that is called once the
    /// resumption decision for a ClientHello has been made. It can return one to
    /// allow the handshake to continue or zero to cause the handshake to abort.
    pub fn SSL_CTX_set_dos_protection_cb(
        ctx: *mut SSL_CTX,
        cb: ::core::option::Option<
            unsafe extern "C" fn(arg1: *const SSL_CLIENT_HELLO) -> ::core::ffi::c_int,
        >,
    );
}
unsafe extern "C" {
    /// SSL_CTX_set_reverify_on_resume configures whether the certificate
    /// verification callback will be used to reverify stored certificates
    /// when resuming a session. This only works with `SSL_CTX_set_custom_verify`.
    /// For now, this is incompatible with `SSL_VERIFY_NONE` mode, and is only
    /// respected on clients.
    pub fn SSL_CTX_set_reverify_on_resume(ctx: *mut SSL_CTX, enabled: ::core::ffi::c_int);
}
unsafe extern "C" {
    /// SSL_CTX_set_info_callback configures a callback to be run when various
    /// events occur during a connection's lifetime. The `type` argument determines
    /// the type of event and the meaning of the `value` argument. Callbacks must
    /// ignore unexpected `type` values.
    ///
    /// `SSL_CB_READ_ALERT` is signaled for each alert received, warning or fatal.
    /// The `value` argument is a 16-bit value where the alert level (either
    /// `SSL3_AL_WARNING` or `SSL3_AL_FATAL`) is in the most-significant eight bits
    /// and the alert type (one of `SSL_AD_*`) is in the least-significant eight.
    ///
    /// `SSL_CB_WRITE_ALERT` is signaled for each alert sent. The `value` argument
    /// is constructed as with `SSL_CB_READ_ALERT`.
    ///
    /// `SSL_CB_HANDSHAKE_START` is signaled when a handshake begins. The `value`
    /// argument is always one.
    ///
    /// `SSL_CB_HANDSHAKE_DONE` is signaled when a handshake completes successfully.
    /// The `value` argument is always one. If a handshake False Starts, this event
    /// may be used to determine when the Finished message is received.
    ///
    /// The following event types expose implementation details of the handshake
    /// state machine. Consuming them is deprecated.
    ///
    /// `SSL_CB_ACCEPT_LOOP` (respectively, `SSL_CB_CONNECT_LOOP`) is signaled when
    /// a server (respectively, client) handshake progresses. The `value` argument
    /// is always one.
    ///
    /// `SSL_CB_ACCEPT_EXIT` (respectively, `SSL_CB_CONNECT_EXIT`) is signaled when
    /// a server (respectively, client) handshake completes, fails, or is paused.
    /// The `value` argument is one if the handshake succeeded and <= 0
    /// otherwise.
    pub fn SSL_CTX_set_info_callback(
        ctx: *mut SSL_CTX,
        cb: ::core::option::Option<
            unsafe extern "C" fn(
                ssl: *const SSL,
                type_: ::core::ffi::c_int,
                value: ::core::ffi::c_int,
            ),
        >,
    );
}
unsafe extern "C" {
    /// SSL_CTX_get_info_callback returns the callback set by
    /// `SSL_CTX_set_info_callback`.
    pub fn SSL_CTX_get_info_callback(
        ctx: *mut SSL_CTX,
    ) -> ::core::option::Option<
        unsafe extern "C" fn(ctx: *const SSL, arg1: ::core::ffi::c_int, arg2: ::core::ffi::c_int),
    >;
}
unsafe extern "C" {
    /// SSL_set_info_callback configures a callback to be run at various events
    /// during a connection's lifetime. See `SSL_CTX_set_info_callback`.
    pub fn SSL_set_info_callback(
        ssl: *mut SSL,
        cb: ::core::option::Option<
            unsafe extern "C" fn(
                ssl: *const SSL,
                type_: ::core::ffi::c_int,
                value: ::core::ffi::c_int,
            ),
        >,
    );
}
unsafe extern "C" {
    /// SSL_get_info_callback returns the callback set by `SSL_set_info_callback`.
    pub fn SSL_get_info_callback(
        ssl: *const SSL,
    ) -> ::core::option::Option<
        unsafe extern "C" fn(ssl: *const SSL, arg1: ::core::ffi::c_int, arg2: ::core::ffi::c_int),
    >;
}
unsafe extern "C" {
    /// SSL_state_string_long returns the current state of the handshake state
    /// machine as a string. This may be useful for debugging and logging.
    pub fn SSL_state_string_long(ssl: *const SSL) -> *const ::core::ffi::c_char;
}
unsafe extern "C" {
    /// SSL_get_shutdown returns a bitmask with a subset of `SSL_SENT_SHUTDOWN` and
    /// `SSL_RECEIVED_SHUTDOWN` to query whether close_notify was sent or received,
    /// respectively.
    pub fn SSL_get_shutdown(ssl: *const SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_get_peer_signature_algorithm returns the signature algorithm used by the
    /// peer. If not applicable, it returns zero.
    pub fn SSL_get_peer_signature_algorithm(ssl: *const SSL) -> u16;
}
unsafe extern "C" {
    /// SSL_get_client_random writes up to `max_out` bytes of the most recent
    /// handshake's client_random to `out` and returns the number of bytes written.
    /// If `max_out` is zero, it returns the size of the client_random.
    pub fn SSL_get_client_random(ssl: *const SSL, out: *mut u8, max_out: usize) -> usize;
}
unsafe extern "C" {
    /// SSL_get_server_random writes up to `max_out` bytes of the most recent
    /// handshake's server_random to `out` and returns the number of bytes written.
    /// If `max_out` is zero, it returns the size of the server_random.
    pub fn SSL_get_server_random(ssl: *const SSL, out: *mut u8, max_out: usize) -> usize;
}
unsafe extern "C" {
    /// SSL_get_signature_algorithm_used returns the signature algorithm that `ssl`
    /// used, or will use, to generate a signature in the current handshake. If not
    /// applicable (e.g. if `ssl` did not authenticate itself with a certificate), it
    /// returns zero.
    ///
    /// This function only returns a value during the handshake. After the handshake
    /// is complete, the value is discarded. If needed after the handshake, callers
    /// may save the value at `SSL_CB_HANDSHAKE_DONE` with
    /// `SSL_CTX_set_info_callback`.
    pub fn SSL_get_signature_algorithm_used(ssl: *const SSL) -> u16;
}
unsafe extern "C" {
    /// SSL_get_pending_cipher returns the cipher suite for the current handshake or
    /// NULL if one has not been negotiated yet or there is no pending handshake.
    pub fn SSL_get_pending_cipher(ssl: *const SSL) -> *const SSL_CIPHER;
}
unsafe extern "C" {
    /// SSL_set_retain_only_sha256_of_client_certs, on a server, sets whether only
    /// the SHA-256 hash of peer's certificate should be saved in memory and in the
    /// session. This can save memory, ticket size and session cache space. If
    /// enabled, `SSL_get_peer_certificate` will return NULL after the handshake
    /// completes. See `SSL_SESSION_has_peer_sha256` and
    /// `SSL_SESSION_get0_peer_sha256` to query the hash.
    pub fn SSL_set_retain_only_sha256_of_client_certs(ssl: *mut SSL, enable: ::core::ffi::c_int);
}
unsafe extern "C" {
    /// SSL_CTX_set_retain_only_sha256_of_client_certs, on a server, sets whether
    /// only the SHA-256 hash of peer's certificate should be saved in memory and in
    /// the session. This can save memory, ticket size and session cache space. If
    /// enabled, `SSL_get_peer_certificate` will return NULL after the handshake
    /// completes. See `SSL_SESSION_has_peer_sha256` and
    /// `SSL_SESSION_get0_peer_sha256` to query the hash.
    pub fn SSL_CTX_set_retain_only_sha256_of_client_certs(
        ctx: *mut SSL_CTX,
        enable: ::core::ffi::c_int,
    );
}
unsafe extern "C" {
    /// SSL_CTX_set_grease_enabled configures whether sockets on `ctx` should enable
    /// GREASE. See RFC 8701.
    pub fn SSL_CTX_set_grease_enabled(ctx: *mut SSL_CTX, enabled: ::core::ffi::c_int);
}
unsafe extern "C" {
    /// SSL_CTX_set_grease_sigalgs_enabled configures whether sockets on `ctx` should
    /// send a GREASE value in signature_algorithms extensions in ClientHello
    /// messages. See RFC 8701.
    /// TODO(crbug.com/526597789): Fold this functionality into
    /// `SSL_CTX_set_grease_enabled` once deployed safely.
    /// TODO(crbug.com/529360100): signature_algorithms extensions in
    /// CertificateRequest messages should also be GREASE'd.
    pub fn SSL_CTX_set_grease_sigalgs_enabled(ctx: *mut SSL_CTX, enabled: ::core::ffi::c_int);
}
unsafe extern "C" {
    /// SSL_CTX_set_permute_extensions configures whether sockets on `ctx` should
    /// permute extensions. For now, this is only implemented for the ClientHello.
    pub fn SSL_CTX_set_permute_extensions(ctx: *mut SSL_CTX, enabled: ::core::ffi::c_int);
}
unsafe extern "C" {
    /// SSL_set_permute_extensions configures whether sockets on `ssl` should
    /// permute extensions. For now, this is only implemented for the ClientHello.
    pub fn SSL_set_permute_extensions(ssl: *mut SSL, enabled: ::core::ffi::c_int);
}
unsafe extern "C" {
    /// SSL_max_seal_overhead returns the maximum overhead, in bytes, of sealing a
    /// record with `ssl`.
    pub fn SSL_max_seal_overhead(ssl: *const SSL) -> usize;
}
unsafe extern "C" {
    /// SSL_CTX_set_false_start_allowed_without_alpn configures whether connections
    /// on `ctx` may use False Start (if `SSL_MODE_ENABLE_FALSE_START` is enabled)
    /// without negotiating ALPN.
    pub fn SSL_CTX_set_false_start_allowed_without_alpn(
        ctx: *mut SSL_CTX,
        allowed: ::core::ffi::c_int,
    );
}
unsafe extern "C" {
    /// SSL_used_hello_retry_request returns one if the TLS 1.3 HelloRetryRequest
    /// message has been either sent by the server or received by the client. It
    /// returns zero otherwise.
    pub fn SSL_used_hello_retry_request(ssl: *const SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set_jdk11_workaround configures whether to workaround various bugs in
    /// JDK 11's TLS 1.3 implementation by disabling TLS 1.3 for such clients.
    ///
    /// https://bugs.openjdk.java.net/browse/JDK-8211806
    /// https://bugs.openjdk.java.net/browse/JDK-8212885
    /// https://bugs.openjdk.java.net/browse/JDK-8213202
    pub fn SSL_set_jdk11_workaround(ssl: *mut SSL, enable: ::core::ffi::c_int);
}
unsafe extern "C" {
    /// SSL_parse_client_hello decodes a ClientHello structure from `len` bytes in
    /// `in`. On success, it returns one and writes the result to `*out`. Otherwise,
    /// it returns zero. `ssl` will be saved into `*out` and determines how the
    /// ClientHello is parsed, notably TLS vs DTLS. The fields in `*out` will alias
    /// `in` and are only valid as long as `in` is valid and unchanged.
    ///
    /// `in` should contain just the ClientHello structure (RFC 8446 and RFC 9147),
    /// excluding the handshake header and already reassembled from record layer.
    /// That is, `in` should begin with the legacy_version field, not the
    /// client_hello HandshakeType constant or the handshake ContentType constant.
    pub fn SSL_parse_client_hello(
        ssl: *const SSL,
        out: *mut SSL_CLIENT_HELLO,
        in_: *const u8,
        len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_library_init returns one.
    pub fn SSL_library_init() -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CIPHER_description writes a description of `cipher` into `buf` and
    /// returns `buf`. If `buf` is NULL, it returns a newly allocated string, to be
    /// freed with `OPENSSL_free`, or NULL on error.
    ///
    /// The description includes a trailing newline and has the form:
    /// AES128-SHA              Kx=RSA      Au=RSA  Enc=AES(128)  Mac=SHA1
    ///
    /// Consider `SSL_CIPHER_standard_name` or `SSL_CIPHER_get_name` instead.
    pub fn SSL_CIPHER_description(
        cipher: *const SSL_CIPHER,
        buf: *mut ::core::ffi::c_char,
        len: ::core::ffi::c_int,
    ) -> *const ::core::ffi::c_char;
}
unsafe extern "C" {
    /// SSL_CIPHER_get_version returns the string "TLSv1/SSLv3".
    pub fn SSL_CIPHER_get_version(cipher: *const SSL_CIPHER) -> *const ::core::ffi::c_char;
}
unsafe extern "C" {
    /// SSL_CIPHER_get_id returns `cipher`'s IANA-assigned number, OR-d with
    /// 0x03000000. This is part of OpenSSL's SSL 2.0 legacy. SSL 2.0 has long since
    /// been removed from BoringSSL. Use `SSL_CIPHER_get_protocol_id` instead.
    pub fn SSL_CIPHER_get_id(cipher: *const SSL_CIPHER) -> u32;
}
unsafe extern "C" {
    /// SSL_CIPHER_get_name returns the OpenSSL name of `cipher`. For example,
    /// "ECDHE-RSA-AES128-GCM-SHA256". Callers are recommended to use
    /// `SSL_CIPHER_standard_name` instead.
    pub fn SSL_CIPHER_get_name(cipher: *const SSL_CIPHER) -> *const ::core::ffi::c_char;
}
pub type COMP_METHOD = ::core::ffi::c_void;
pub type SSL_COMP = ssl_comp_st;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct stack_st_SSL_COMP {
    _unused: [u8; 0],
}
unsafe extern "C" {
    /// SSL_COMP_get_compression_methods returns NULL.
    pub fn SSL_COMP_get_compression_methods() -> *mut stack_st_SSL_COMP;
}
unsafe extern "C" {
    /// SSL_COMP_add_compression_method returns one.
    pub fn SSL_COMP_add_compression_method(
        id: ::core::ffi::c_int,
        cm: *mut COMP_METHOD,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_COMP_get_name returns NULL.
    pub fn SSL_COMP_get_name(comp: *const COMP_METHOD) -> *const ::core::ffi::c_char;
}
unsafe extern "C" {
    /// SSL_COMP_get0_name returns the `name` member of `comp`.
    pub fn SSL_COMP_get0_name(comp: *const SSL_COMP) -> *const ::core::ffi::c_char;
}
unsafe extern "C" {
    /// SSL_COMP_get_id returns the `id` member of `comp`.
    pub fn SSL_COMP_get_id(comp: *const SSL_COMP) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_COMP_free_compression_methods does nothing.
    pub fn SSL_COMP_free_compression_methods();
}
unsafe extern "C" {
    /// SSLv23_method calls `TLS_method`.
    pub fn SSLv23_method() -> *const SSL_METHOD;
}
unsafe extern "C" {
    /// These version-specific methods behave exactly like `TLS_method` and
    /// `DTLS_method` except they also call `SSL_CTX_set_min_proto_version` and
    /// `SSL_CTX_set_max_proto_version` to lock connections to that protocol
    /// version.
    pub fn TLSv1_method() -> *const SSL_METHOD;
}
unsafe extern "C" {
    pub fn TLSv1_1_method() -> *const SSL_METHOD;
}
unsafe extern "C" {
    pub fn TLSv1_2_method() -> *const SSL_METHOD;
}
unsafe extern "C" {
    pub fn DTLSv1_method() -> *const SSL_METHOD;
}
unsafe extern "C" {
    pub fn DTLSv1_2_method() -> *const SSL_METHOD;
}
unsafe extern "C" {
    /// These client- and server-specific methods call their corresponding generic
    /// methods.
    pub fn TLS_server_method() -> *const SSL_METHOD;
}
unsafe extern "C" {
    pub fn TLS_client_method() -> *const SSL_METHOD;
}
unsafe extern "C" {
    pub fn SSLv23_server_method() -> *const SSL_METHOD;
}
unsafe extern "C" {
    pub fn SSLv23_client_method() -> *const SSL_METHOD;
}
unsafe extern "C" {
    pub fn TLSv1_server_method() -> *const SSL_METHOD;
}
unsafe extern "C" {
    pub fn TLSv1_client_method() -> *const SSL_METHOD;
}
unsafe extern "C" {
    pub fn TLSv1_1_server_method() -> *const SSL_METHOD;
}
unsafe extern "C" {
    pub fn TLSv1_1_client_method() -> *const SSL_METHOD;
}
unsafe extern "C" {
    pub fn TLSv1_2_server_method() -> *const SSL_METHOD;
}
unsafe extern "C" {
    pub fn TLSv1_2_client_method() -> *const SSL_METHOD;
}
unsafe extern "C" {
    pub fn DTLS_server_method() -> *const SSL_METHOD;
}
unsafe extern "C" {
    pub fn DTLS_client_method() -> *const SSL_METHOD;
}
unsafe extern "C" {
    pub fn DTLSv1_server_method() -> *const SSL_METHOD;
}
unsafe extern "C" {
    pub fn DTLSv1_client_method() -> *const SSL_METHOD;
}
unsafe extern "C" {
    pub fn DTLSv1_2_server_method() -> *const SSL_METHOD;
}
unsafe extern "C" {
    pub fn DTLSv1_2_client_method() -> *const SSL_METHOD;
}
unsafe extern "C" {
    /// SSL_clear resets `ssl` to allow another connection and returns one on success
    /// or zero on failure. It returns most configuration state but releases memory
    /// associated with the current connection.
    ///
    /// Free `ssl` and create a new one instead.
    pub fn SSL_clear(ssl: *mut SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_set_tmp_rsa_callback does nothing.
    pub fn SSL_CTX_set_tmp_rsa_callback(
        ctx: *mut SSL_CTX,
        cb: ::core::option::Option<
            unsafe extern "C" fn(
                ssl: *mut SSL,
                is_export: ::core::ffi::c_int,
                keylength: ::core::ffi::c_int,
            ) -> *mut RSA,
        >,
    );
}
unsafe extern "C" {
    /// SSL_set_tmp_rsa_callback does nothing.
    pub fn SSL_set_tmp_rsa_callback(
        ssl: *mut SSL,
        cb: ::core::option::Option<
            unsafe extern "C" fn(
                ssl: *mut SSL,
                is_export: ::core::ffi::c_int,
                keylength: ::core::ffi::c_int,
            ) -> *mut RSA,
        >,
    );
}
unsafe extern "C" {
    /// SSL_CTX_sess_connect returns zero.
    pub fn SSL_CTX_sess_connect(ctx: *const SSL_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_sess_connect_good returns zero.
    pub fn SSL_CTX_sess_connect_good(ctx: *const SSL_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_sess_connect_renegotiate returns zero.
    pub fn SSL_CTX_sess_connect_renegotiate(ctx: *const SSL_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_sess_accept returns zero.
    pub fn SSL_CTX_sess_accept(ctx: *const SSL_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_sess_accept_renegotiate returns zero.
    pub fn SSL_CTX_sess_accept_renegotiate(ctx: *const SSL_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_sess_accept_good returns zero.
    pub fn SSL_CTX_sess_accept_good(ctx: *const SSL_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_sess_hits returns zero.
    pub fn SSL_CTX_sess_hits(ctx: *const SSL_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_sess_cb_hits returns zero.
    pub fn SSL_CTX_sess_cb_hits(ctx: *const SSL_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_sess_misses returns zero.
    pub fn SSL_CTX_sess_misses(ctx: *const SSL_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_sess_timeouts returns zero.
    pub fn SSL_CTX_sess_timeouts(ctx: *const SSL_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_sess_cache_full returns zero.
    pub fn SSL_CTX_sess_cache_full(ctx: *const SSL_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_cutthrough_complete calls `SSL_in_false_start`.
    pub fn SSL_cutthrough_complete(ssl: *const SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_num_renegotiations calls `SSL_total_renegotiations`.
    pub fn SSL_num_renegotiations(ssl: *const SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_need_tmp_RSA returns zero.
    pub fn SSL_CTX_need_tmp_RSA(ctx: *const SSL_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_need_tmp_RSA returns zero.
    pub fn SSL_need_tmp_RSA(ssl: *const SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_set_tmp_rsa returns one.
    pub fn SSL_CTX_set_tmp_rsa(ctx: *mut SSL_CTX, rsa: *const RSA) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set_tmp_rsa returns one.
    pub fn SSL_set_tmp_rsa(ssl: *mut SSL, rsa: *const RSA) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_get_read_ahead returns zero.
    pub fn SSL_CTX_get_read_ahead(ctx: *const SSL_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_set_read_ahead returns one.
    pub fn SSL_CTX_set_read_ahead(ctx: *mut SSL_CTX, yes: ::core::ffi::c_int)
        -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_get_read_ahead returns zero.
    pub fn SSL_get_read_ahead(ssl: *const SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set_read_ahead returns one.
    pub fn SSL_set_read_ahead(ssl: *mut SSL, yes: ::core::ffi::c_int) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set_state does nothing.
    pub fn SSL_set_state(ssl: *mut SSL, state: ::core::ffi::c_int);
}
unsafe extern "C" {
    /// SSL_get_shared_ciphers writes an empty string to `buf` and returns a
    /// pointer to `buf`, or NULL if `len` is less than or equal to zero.
    pub fn SSL_get_shared_ciphers(
        ssl: *const SSL,
        buf: *mut ::core::ffi::c_char,
        len: ::core::ffi::c_int,
    ) -> *mut ::core::ffi::c_char;
}
unsafe extern "C" {
    /// SSL_get_shared_sigalgs returns zero.
    pub fn SSL_get_shared_sigalgs(
        ssl: *mut SSL,
        idx: ::core::ffi::c_int,
        psign: *mut ::core::ffi::c_int,
        phash: *mut ::core::ffi::c_int,
        psignandhash: *mut ::core::ffi::c_int,
        rsig: *mut u8,
        rhash: *mut u8,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// i2d_SSL_SESSION serializes `in`, as described in `i2d_SAMPLE`.
    ///
    /// Use `SSL_SESSION_to_bytes` instead.
    pub fn i2d_SSL_SESSION(in_: *const SSL_SESSION, pp: *mut *mut u8) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// d2i_SSL_SESSION parses a serialized session from the `len` bytes pointed to
    /// by `*inp`, as described in `d2i_SAMPLE`.
    ///
    /// Use `SSL_SESSION_from_bytes` instead.
    pub fn d2i_SSL_SESSION(
        out: *mut *mut SSL_SESSION,
        inp: *mut *const u8,
        len: ::core::ffi::c_long,
    ) -> *mut SSL_SESSION;
}
unsafe extern "C" {
    /// i2d_SSL_SESSION_bio serializes `session` and writes the result to `bio`. It
    /// returns the number of bytes written on success and <= 0 on error.
    pub fn i2d_SSL_SESSION_bio(bio: *mut BIO, session: *const SSL_SESSION) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// d2i_SSL_SESSION_bio reads a serialized `SSL_SESSION` from `bio` and returns a
    /// newly-allocated `SSL_SESSION` or NULL on error. If `out` is not NULL, it also
    /// frees `*out` and sets `*out` to the new `SSL_SESSION`.
    pub fn d2i_SSL_SESSION_bio(bio: *mut BIO, out: *mut *mut SSL_SESSION) -> *mut SSL_SESSION;
}
unsafe extern "C" {
    /// ERR_load_SSL_strings does nothing.
    pub fn ERR_load_SSL_strings();
}
unsafe extern "C" {
    /// SSL_load_error_strings does nothing.
    pub fn SSL_load_error_strings();
}
unsafe extern "C" {
    /// SSL_CTX_set_tlsext_use_srtp calls `SSL_CTX_set_srtp_profiles`. It returns
    /// zero on success and one on failure.
    ///
    /// WARNING: this function is dangerous because it breaks the usual return value
    /// convention. Use `SSL_CTX_set_srtp_profiles` instead.
    pub fn SSL_CTX_set_tlsext_use_srtp(
        ctx: *mut SSL_CTX,
        profiles: *const ::core::ffi::c_char,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set_tlsext_use_srtp calls `SSL_set_srtp_profiles`. It returns zero on
    /// success and one on failure.
    ///
    /// WARNING: this function is dangerous because it breaks the usual return value
    /// convention. Use `SSL_set_srtp_profiles` instead.
    pub fn SSL_set_tlsext_use_srtp(
        ssl: *mut SSL,
        profiles: *const ::core::ffi::c_char,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_get_current_compression returns NULL.
    pub fn SSL_get_current_compression(ssl: *mut SSL) -> *const COMP_METHOD;
}
unsafe extern "C" {
    /// SSL_get_current_expansion returns NULL.
    pub fn SSL_get_current_expansion(ssl: *mut SSL) -> *const COMP_METHOD;
}
unsafe extern "C" {
    /// SSL_get_server_tmp_key returns zero.
    pub fn SSL_get_server_tmp_key(ssl: *mut SSL, out_key: *mut *mut EVP_PKEY)
        -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_set_tmp_dh returns 1.
    pub fn SSL_CTX_set_tmp_dh(ctx: *mut SSL_CTX, dh: *const DH) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set_tmp_dh returns 1.
    pub fn SSL_set_tmp_dh(ssl: *mut SSL, dh: *const DH) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_set_tmp_dh_callback does nothing.
    pub fn SSL_CTX_set_tmp_dh_callback(
        ctx: *mut SSL_CTX,
        cb: ::core::option::Option<
            unsafe extern "C" fn(
                ssl: *mut SSL,
                is_export: ::core::ffi::c_int,
                keylength: ::core::ffi::c_int,
            ) -> *mut DH,
        >,
    );
}
unsafe extern "C" {
    /// SSL_set_tmp_dh_callback does nothing.
    pub fn SSL_set_tmp_dh_callback(
        ssl: *mut SSL,
        cb: ::core::option::Option<
            unsafe extern "C" fn(
                ssl: *mut SSL,
                is_export: ::core::ffi::c_int,
                keylength: ::core::ffi::c_int,
            ) -> *mut DH,
        >,
    );
}
unsafe extern "C" {
    /// SSL_CTX_set1_sigalgs takes `num_values` ints and interprets them as pairs
    /// where the first is the nid of a hash function and the second is an
    /// `EVP_PKEY_*` value. It configures the signature algorithm preferences for
    /// `ctx` based on them and returns one on success or zero on error.
    ///
    /// This API is compatible with OpenSSL. However, BoringSSL-specific code should
    /// prefer `SSL_CTX_set_signing_algorithm_prefs` because it's clearer and it's
    /// more convenient to codesearch for specific algorithm values.
    pub fn SSL_CTX_set1_sigalgs(
        ctx: *mut SSL_CTX,
        values: *const ::core::ffi::c_int,
        num_values: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set1_sigalgs takes `num_values` ints and interprets them as pairs where
    /// the first is the nid of a hash function and the second is an `EVP_PKEY_*`
    /// value. It configures the signature algorithm preferences for `ssl` based on
    /// them and returns one on success or zero on error.
    ///
    /// This API is compatible with OpenSSL. However, BoringSSL-specific code should
    /// prefer `SSL_CTX_set_signing_algorithm_prefs` because it's clearer and it's
    /// more convenient to codesearch for specific algorithm values.
    pub fn SSL_set1_sigalgs(
        ssl: *mut SSL,
        values: *const ::core::ffi::c_int,
        num_values: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_set1_sigalgs_list takes a textual specification of a set of signature
    /// algorithms and configures them on `ctx`. It returns one on success and zero
    /// on error. See
    /// https://www.openssl.org/docs/man1.1.0/man3/SSL_CTX_set1_sigalgs_list.html for
    /// a description of the text format. Also note that TLS 1.3 names (e.g.
    /// "rsa_pkcs1_md5_sha1") can also be used (as in OpenSSL, although OpenSSL
    /// doesn't document that).
    ///
    /// This API is compatible with OpenSSL. However, BoringSSL-specific code should
    /// prefer `SSL_CTX_set_signing_algorithm_prefs` because it's clearer and it's
    /// more convenient to codesearch for specific algorithm values.
    pub fn SSL_CTX_set1_sigalgs_list(
        ctx: *mut SSL_CTX,
        str_: *const ::core::ffi::c_char,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set1_sigalgs_list takes a textual specification of a set of signature
    /// algorithms and configures them on `ssl`. It returns one on success and zero
    /// on error. See
    /// https://www.openssl.org/docs/man1.1.0/man3/SSL_CTX_set1_sigalgs_list.html for
    /// a description of the text format. Also note that TLS 1.3 names (e.g.
    /// "rsa_pkcs1_md5_sha1") can also be used (as in OpenSSL, although OpenSSL
    /// doesn't document that).
    ///
    /// This API is compatible with OpenSSL. However, BoringSSL-specific code should
    /// prefer `SSL_CTX_set_signing_algorithm_prefs` because it's clearer and it's
    /// more convenient to codesearch for specific algorithm values.
    pub fn SSL_set1_sigalgs_list(
        ssl: *mut SSL,
        str_: *const ::core::ffi::c_char,
    ) -> ::core::ffi::c_int;
}
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct ssl_comp_st {
    pub id: ::core::ffi::c_int,
    pub name: *const ::core::ffi::c_char,
    pub method: *mut ::core::ffi::c_char,
}
/// We also disable -Wcast-qual. As part of this C-based type erasure setup,  \
/// the wrapper macros need to cast away const in places. In C++, const_cast  \
/// suppresses the warning, but it seemingly cannot be suppressed in C.
pub type sk_SSL_COMP_free_func = ::core::option::Option<unsafe extern "C" fn(arg1: *mut SSL_COMP)>;
pub type sk_SSL_COMP_copy_func =
    ::core::option::Option<unsafe extern "C" fn(arg1: *const SSL_COMP) -> *mut SSL_COMP>;
pub type sk_SSL_COMP_cmp_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *const *const SSL_COMP,
        arg2: *const *const SSL_COMP,
    ) -> ::core::ffi::c_int,
>;
pub type sk_SSL_COMP_delete_if_func = ::core::option::Option<
    unsafe extern "C" fn(arg1: *mut SSL_COMP, arg2: *mut ::core::ffi::c_void) -> ::core::ffi::c_int,
>;
unsafe extern "C" {
    #[link_name = "sk_SSL_COMP_call_free_func__extern"]
    pub fn sk_SSL_COMP_call_free_func(
        free_func: OPENSSL_sk_free_func,
        ptr: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    #[link_name = "sk_SSL_COMP_call_copy_func__extern"]
    pub fn sk_SSL_COMP_call_copy_func(
        copy_func: OPENSSL_sk_copy_func,
        ptr: *const ::core::ffi::c_void,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    #[link_name = "sk_SSL_COMP_call_cmp_func__extern"]
    pub fn sk_SSL_COMP_call_cmp_func(
        cmp_func: OPENSSL_sk_cmp_func,
        a: *const ::core::ffi::c_void,
        b: *const ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_SSL_COMP_call_delete_if_func__extern"]
    pub fn sk_SSL_COMP_call_delete_if_func(
        func: OPENSSL_sk_delete_if_func,
        obj: *mut ::core::ffi::c_void,
        data: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_SSL_COMP_new__extern"]
    pub fn sk_SSL_COMP_new(comp: sk_SSL_COMP_cmp_func) -> *mut stack_st_SSL_COMP;
}
unsafe extern "C" {
    #[link_name = "sk_SSL_COMP_new_null__extern"]
    pub fn sk_SSL_COMP_new_null() -> *mut stack_st_SSL_COMP;
}
unsafe extern "C" {
    #[link_name = "sk_SSL_COMP_num__extern"]
    pub fn sk_SSL_COMP_num(sk: *const stack_st_SSL_COMP) -> usize;
}
unsafe extern "C" {
    #[link_name = "sk_SSL_COMP_zero__extern"]
    pub fn sk_SSL_COMP_zero(sk: *mut stack_st_SSL_COMP);
}
unsafe extern "C" {
    #[link_name = "sk_SSL_COMP_value__extern"]
    pub fn sk_SSL_COMP_value(sk: *const stack_st_SSL_COMP, i: usize) -> *mut SSL_COMP;
}
unsafe extern "C" {
    #[link_name = "sk_SSL_COMP_set__extern"]
    pub fn sk_SSL_COMP_set(sk: *mut stack_st_SSL_COMP, i: usize, p: *mut SSL_COMP)
        -> *mut SSL_COMP;
}
unsafe extern "C" {
    #[link_name = "sk_SSL_COMP_free__extern"]
    pub fn sk_SSL_COMP_free(sk: *mut stack_st_SSL_COMP);
}
unsafe extern "C" {
    #[link_name = "sk_SSL_COMP_pop_free__extern"]
    pub fn sk_SSL_COMP_pop_free(sk: *mut stack_st_SSL_COMP, free_func: sk_SSL_COMP_free_func);
}
unsafe extern "C" {
    #[link_name = "sk_SSL_COMP_insert__extern"]
    pub fn sk_SSL_COMP_insert(sk: *mut stack_st_SSL_COMP, p: *mut SSL_COMP, where_: usize)
        -> usize;
}
unsafe extern "C" {
    #[link_name = "sk_SSL_COMP_delete__extern"]
    pub fn sk_SSL_COMP_delete(sk: *mut stack_st_SSL_COMP, where_: usize) -> *mut SSL_COMP;
}
unsafe extern "C" {
    #[link_name = "sk_SSL_COMP_delete_ptr__extern"]
    pub fn sk_SSL_COMP_delete_ptr(sk: *mut stack_st_SSL_COMP, p: *const SSL_COMP) -> *mut SSL_COMP;
}
unsafe extern "C" {
    #[link_name = "sk_SSL_COMP_delete_if__extern"]
    pub fn sk_SSL_COMP_delete_if(
        sk: *mut stack_st_SSL_COMP,
        func: sk_SSL_COMP_delete_if_func,
        data: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    #[link_name = "sk_SSL_COMP_find__extern"]
    pub fn sk_SSL_COMP_find(
        sk: *const stack_st_SSL_COMP,
        out_index: *mut usize,
        p: *const SSL_COMP,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_SSL_COMP_shift__extern"]
    pub fn sk_SSL_COMP_shift(sk: *mut stack_st_SSL_COMP) -> *mut SSL_COMP;
}
unsafe extern "C" {
    #[link_name = "sk_SSL_COMP_push__extern"]
    pub fn sk_SSL_COMP_push(sk: *mut stack_st_SSL_COMP, p: *mut SSL_COMP) -> usize;
}
unsafe extern "C" {
    #[link_name = "sk_SSL_COMP_pop__extern"]
    pub fn sk_SSL_COMP_pop(sk: *mut stack_st_SSL_COMP) -> *mut SSL_COMP;
}
unsafe extern "C" {
    #[link_name = "sk_SSL_COMP_dup__extern"]
    pub fn sk_SSL_COMP_dup(sk: *const stack_st_SSL_COMP) -> *mut stack_st_SSL_COMP;
}
unsafe extern "C" {
    #[link_name = "sk_SSL_COMP_sort__extern"]
    pub fn sk_SSL_COMP_sort(sk: *mut stack_st_SSL_COMP);
}
unsafe extern "C" {
    #[link_name = "sk_SSL_COMP_sort_and_dedup__extern"]
    pub fn sk_SSL_COMP_sort_and_dedup(sk: *mut stack_st_SSL_COMP, free_func: sk_SSL_COMP_free_func);
}
unsafe extern "C" {
    #[link_name = "sk_SSL_COMP_is_sorted__extern"]
    pub fn sk_SSL_COMP_is_sorted(sk: *const stack_st_SSL_COMP) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_SSL_COMP_set_cmp_func__extern"]
    pub fn sk_SSL_COMP_set_cmp_func(
        sk: *mut stack_st_SSL_COMP,
        comp: sk_SSL_COMP_cmp_func,
    ) -> sk_SSL_COMP_cmp_func;
}
unsafe extern "C" {
    #[link_name = "sk_SSL_COMP_deep_copy__extern"]
    pub fn sk_SSL_COMP_deep_copy(
        sk: *const stack_st_SSL_COMP,
        copy_func: sk_SSL_COMP_copy_func,
        free_func: sk_SSL_COMP_free_func,
    ) -> *mut stack_st_SSL_COMP;
}
unsafe extern "C" {
    /// SSL_cache_hit calls `SSL_session_reused`.
    pub fn SSL_cache_hit(ssl: *mut SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_get_default_timeout returns `SSL_DEFAULT_SESSION_TIMEOUT`.
    pub fn SSL_get_default_timeout(ssl: *const SSL) -> ::core::ffi::c_long;
}
unsafe extern "C" {
    /// SSL_get_version returns a string describing the TLS version used by `ssl`.
    /// For example, "TLSv1.2" or "DTLSv1".
    pub fn SSL_get_version(ssl: *const SSL) -> *const ::core::ffi::c_char;
}
unsafe extern "C" {
    /// SSL_get_all_version_names outputs a list of possible strings
    /// `SSL_get_version` may return in this version of BoringSSL. It writes at most
    /// `max_out` entries to `out` and returns the total number it would have
    /// written, if `max_out` had been large enough. `max_out` may be initially set
    /// to zero to size the output.
    ///
    /// This function is only intended to help initialize tables in callers that want
    /// possible strings pre-declared. This list would not be suitable to set a list
    /// of supported features. It is in no particular order, and may contain
    /// placeholder, experimental, or deprecated values that do not apply to every
    /// caller. Future versions of BoringSSL may also return strings not in this
    /// list, so this does not apply if, say, sending strings across services.
    pub fn SSL_get_all_version_names(out: *mut *const ::core::ffi::c_char, max_out: usize)
        -> usize;
}
unsafe extern "C" {
    /// SSL_get_cipher_list returns the name of the `n`th cipher in the output of
    /// `SSL_get_ciphers` or NULL if out of range. Use `SSL_get_ciphers` instead.
    pub fn SSL_get_cipher_list(
        ssl: *const SSL,
        n: ::core::ffi::c_int,
    ) -> *const ::core::ffi::c_char;
}
unsafe extern "C" {
    /// SSL_CTX_set_client_cert_cb sets a callback which is called on the client if
    /// the server requests a client certificate and none is configured. On success,
    /// the callback should return one and set `*out_x509` to `*out_pkey` to a leaf
    /// certificate and private key, respectively, passing ownership. It should
    /// return zero to send no certificate and -1 to fail or pause the handshake. If
    /// the handshake is paused, `SSL_get_error` will return
    /// `SSL_ERROR_WANT_X509_LOOKUP`.
    ///
    /// The callback may call `SSL_get0_certificate_types` and
    /// `SSL_get_client_CA_list` for information on the server's certificate request.
    ///
    /// Use `SSL_CTX_set_cert_cb` instead. Configuring intermediate certificates with
    /// this function is confusing. This callback may not be registered concurrently
    /// with `SSL_CTX_set_cert_cb` or `SSL_set_cert_cb`.
    pub fn SSL_CTX_set_client_cert_cb(
        ctx: *mut SSL_CTX,
        cb: ::core::option::Option<
            unsafe extern "C" fn(
                ssl: *mut SSL,
                out_x509: *mut *mut X509,
                out_pkey: *mut *mut EVP_PKEY,
            ) -> ::core::ffi::c_int,
        >,
    );
}
unsafe extern "C" {
    /// SSL_want returns one of the above values to determine what the most recent
    /// operation on `ssl` was blocked on. Use `SSL_get_error` instead.
    pub fn SSL_want(ssl: *const SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_get_finished writes up to `count` bytes of the Finished message sent by
    /// `ssl` to `buf`. It returns the total untruncated length or zero if none has
    /// been sent yet. At TLS 1.3 and later, it returns zero.
    ///
    /// Use `SSL_get_tls_unique` instead.
    pub fn SSL_get_finished(ssl: *const SSL, buf: *mut ::core::ffi::c_void, count: usize) -> usize;
}
unsafe extern "C" {
    /// SSL_get_peer_finished writes up to `count` bytes of the Finished message
    /// received from `ssl`'s peer to `buf`. It returns the total untruncated length
    /// or zero if none has been received yet. At TLS 1.3 and later, it returns
    /// zero.
    ///
    /// Use `SSL_get_tls_unique` instead.
    pub fn SSL_get_peer_finished(
        ssl: *const SSL,
        buf: *mut ::core::ffi::c_void,
        count: usize,
    ) -> usize;
}
unsafe extern "C" {
    /// SSL_alert_type_string returns "!". Use `SSL_alert_type_string_long`
    /// instead.
    pub fn SSL_alert_type_string(value: ::core::ffi::c_int) -> *const ::core::ffi::c_char;
}
unsafe extern "C" {
    /// SSL_alert_desc_string returns "!!". Use `SSL_alert_desc_string_long`
    /// instead.
    pub fn SSL_alert_desc_string(value: ::core::ffi::c_int) -> *const ::core::ffi::c_char;
}
unsafe extern "C" {
    /// SSL_state_string returns "!!!!!!". Use `SSL_state_string_long` for a more
    /// intelligible string.
    pub fn SSL_state_string(ssl: *const SSL) -> *const ::core::ffi::c_char;
}
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct ssl_conf_ctx_st {
    _unused: [u8; 0],
}
pub type SSL_CONF_CTX = ssl_conf_ctx_st;
unsafe extern "C" {
    /// SSL_state returns `SSL_ST_INIT` if a handshake is in progress and `SSL_ST_OK`
    /// otherwise.
    ///
    /// Use `SSL_is_init` instead.
    pub fn SSL_state(ssl: *const SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set_shutdown causes `ssl` to behave as if the shutdown bitmask (see
    /// `SSL_get_shutdown`) were `mode`. This may be used to skip sending or
    /// receiving close_notify in `SSL_shutdown` by causing the implementation to
    /// believe the events already happened.
    ///
    /// It is an error to use `SSL_set_shutdown` to unset a bit that has already been
    /// set. Doing so will trigger an `assert` in debug builds and otherwise be
    /// ignored.
    ///
    /// Use `SSL_CTX_set_quiet_shutdown` instead.
    pub fn SSL_set_shutdown(ssl: *mut SSL, mode: ::core::ffi::c_int);
}
unsafe extern "C" {
    /// SSL_CTX_set_tmp_ecdh calls `SSL_CTX_set1_groups` with a one-element list
    /// containing `ec_key`'s curve. The remainder of `ec_key` is ignored.
    pub fn SSL_CTX_set_tmp_ecdh(ctx: *mut SSL_CTX, ec_key: *const EC_KEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set_tmp_ecdh calls `SSL_set1_groups` with a one-element list containing
    /// `ec_key`'s curve. The remainder of `ec_key` is ignored.
    pub fn SSL_set_tmp_ecdh(ssl: *mut SSL, ec_key: *const EC_KEY) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_add_dir_cert_subjects_to_stack lists files in directory `dir`. It calls
    /// `SSL_add_file_cert_subjects_to_stack` on each file and returns one on success
    /// or zero on error. This function is only available from the libdecrepit
    /// library.
    pub fn SSL_add_dir_cert_subjects_to_stack(
        out: *mut stack_st_X509_NAME,
        dir: *const ::core::ffi::c_char,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_enable_tls_channel_id calls `SSL_CTX_set_tls_channel_id_enabled`.
    pub fn SSL_CTX_enable_tls_channel_id(ctx: *mut SSL_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_enable_tls_channel_id calls `SSL_set_tls_channel_id_enabled`.
    pub fn SSL_enable_tls_channel_id(ssl: *mut SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// BIO_f_ssl returns a `BIO_METHOD` that can wrap an `SSL*` in a `BIO*`. Note
    /// that this has quite different behaviour from the version in OpenSSL (notably
    /// that it doesn't try to auto renegotiate).
    ///
    /// IMPORTANT: if you are not curl, don't use this.
    pub fn BIO_f_ssl() -> *const BIO_METHOD;
}
unsafe extern "C" {
    /// BIO_set_ssl sets `ssl` as the underlying connection for `bio`, which must
    /// have been created using `BIO_f_ssl`. If `take_owership` is true, `bio` will
    /// call `SSL_free` on `ssl` when closed. It returns one on success or something
    /// other than one on error.
    pub fn BIO_set_ssl(
        bio: *mut BIO,
        ssl: *mut SSL,
        take_owership: ::core::ffi::c_int,
    ) -> ::core::ffi::c_long;
}
unsafe extern "C" {
    /// SSL_get_session returns a non-owning pointer to `ssl`'s session. For
    /// historical reasons, which session it returns depends on `ssl`'s state.
    ///
    /// Prior to the start of the initial handshake, it returns the session the
    /// caller set with `SSL_set_session`. After the initial handshake has finished
    /// and if no additional handshakes are in progress, it returns the currently
    /// active session. Its behavior is undefined while a handshake is in progress.
    ///
    /// If trying to add new sessions to an external session cache, use
    /// `SSL_CTX_sess_set_new_cb` instead. In particular, using the callback is
    /// required as of TLS 1.3. For compatibility, this function will return an
    /// unresumable session which may be cached, but will never be resumed.
    ///
    /// If querying properties of the connection, use APIs on the `SSL` object.
    pub fn SSL_get_session(ssl: *const SSL) -> *mut SSL_SESSION;
}
unsafe extern "C" {
    /// SSL_get1_session acts like `SSL_get_session` but returns a new reference to
    /// the session.
    pub fn SSL_get1_session(ssl: *mut SSL) -> *mut SSL_SESSION;
}
unsafe extern "C" {
    /// OPENSSL_init_ssl returns one.
    pub fn OPENSSL_init_ssl(
        opts: u64,
        settings: *const OPENSSL_INIT_SETTINGS,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set_tlsext_status_type configures a client to request OCSP stapling if
    /// `type` is `TLSEXT_STATUSTYPE_ocsp` and disables it otherwise. It returns one
    /// on success and zero if handshake configuration has already been shed.
    ///
    /// Use `SSL_enable_ocsp_stapling` instead.
    pub fn SSL_set_tlsext_status_type(
        ssl: *mut SSL,
        type_: ::core::ffi::c_int,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_get_tlsext_status_type returns `TLSEXT_STATUSTYPE_ocsp` if the client
    /// requested OCSP stapling and `TLSEXT_STATUSTYPE_nothing` otherwise. On the
    /// client, this reflects whether OCSP stapling was enabled via, e.g.,
    /// `SSL_set_tlsext_status_type`. On the server, this is determined during the
    /// handshake. It may be queried in callbacks set by `SSL_CTX_set_cert_cb`. The
    /// result is undefined after the handshake completes.
    pub fn SSL_get_tlsext_status_type(ssl: *const SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set_tlsext_status_ocsp_resp sets the OCSP response. It returns one on
    /// success and zero on error. On success, `ssl` takes ownership of `resp`, which
    /// must have been allocated by `OPENSSL_malloc`.
    ///
    /// Use `SSL_set_ocsp_response` instead.
    pub fn SSL_set_tlsext_status_ocsp_resp(
        ssl: *mut SSL,
        resp: *mut u8,
        resp_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_get_tlsext_status_ocsp_resp sets `*out` to point to the OCSP response
    /// from the server. It returns the length of the response. If there was no
    /// response, it sets `*out` to NULL and returns zero.
    ///
    /// Use `SSL_get0_ocsp_response` instead.
    ///
    /// WARNING: the returned data is not guaranteed to be well formed.
    pub fn SSL_get_tlsext_status_ocsp_resp(ssl: *const SSL, out: *mut *const u8) -> usize;
}
unsafe extern "C" {
    /// SSL_CTX_set_tlsext_status_cb configures the legacy OpenSSL OCSP callback and
    /// returns one. Though the type signature is the same, this callback has
    /// different behavior for client and server connections:
    ///
    /// For clients, the callback is called after certificate verification. It should
    /// return one for success, zero for a bad OCSP response, and a negative number
    /// for internal error. Instead, handle this as part of certificate verification.
    /// (Historically, OpenSSL verified certificates just before parsing stapled OCSP
    /// responses, but BoringSSL fixes this ordering. All server credentials are
    /// available during verification.)
    ///
    /// Do not use this callback as a server. It is provided for compatibility
    /// purposes only. For servers, it is called to configure server credentials. It
    /// should return `SSL_TLSEXT_ERR_OK` on success, `SSL_TLSEXT_ERR_NOACK` to
    /// ignore OCSP requests, or `SSL_TLSEXT_ERR_ALERT_FATAL` on error. It is usually
    /// used to fetch OCSP responses on demand, which is not ideal. Instead, treat
    /// OCSP responses like other server credentials, such as certificates or SCT
    /// lists. Configure, store, and refresh them eagerly. This avoids downtime if
    /// the CA's OCSP responder is briefly offline.
    pub fn SSL_CTX_set_tlsext_status_cb(
        ctx: *mut SSL_CTX,
        callback: ::core::option::Option<
            unsafe extern "C" fn(
                ssl: *mut SSL,
                arg: *mut ::core::ffi::c_void,
            ) -> ::core::ffi::c_int,
        >,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_set_tlsext_status_arg sets additional data for
    /// `SSL_CTX_set_tlsext_status_cb`'s callback and returns one.
    pub fn SSL_CTX_set_tlsext_status_arg(
        ctx: *mut SSL_CTX,
        arg: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_get_curve_id calls `SSL_get_group_id`.
    pub fn SSL_get_curve_id(ssl: *const SSL) -> u16;
}
unsafe extern "C" {
    /// SSL_get_curve_name calls `SSL_get_group_name`.
    pub fn SSL_get_curve_name(curve_id: u16) -> *const ::core::ffi::c_char;
}
unsafe extern "C" {
    /// SSL_get_all_curve_names calls `SSL_get_all_group_names`.
    pub fn SSL_get_all_curve_names(out: *mut *const ::core::ffi::c_char, max_out: usize) -> usize;
}
unsafe extern "C" {
    /// SSL_CTX_set1_curves calls `SSL_CTX_set1_groups`.
    pub fn SSL_CTX_set1_curves(
        ctx: *mut SSL_CTX,
        curves: *const ::core::ffi::c_int,
        num_curves: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set1_curves calls `SSL_set1_groups`.
    pub fn SSL_set1_curves(
        ssl: *mut SSL,
        curves: *const ::core::ffi::c_int,
        num_curves: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_set1_curves_list calls `SSL_CTX_set1_groups_list`.
    pub fn SSL_CTX_set1_curves_list(
        ctx: *mut SSL_CTX,
        curves: *const ::core::ffi::c_char,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_set1_curves_list calls `SSL_set1_groups_list`.
    pub fn SSL_set1_curves_list(
        ssl: *mut SSL,
        curves: *const ::core::ffi::c_char,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_check_private_key returns one if `ctx` has both a certificate and
    /// private key, and zero otherwise.
    ///
    /// This function does not check consistency because the library checks when the
    /// certificate and key are individually configured. However, if the private key
    /// is configured before the certificate, inconsistent private keys are silently
    /// dropped. Some callers are inadvertently relying on this function to detect
    /// when this happens.
    ///
    /// Instead, callers should configure the certificate first, then the private
    /// key, checking for errors in each. This function is then unnecessary.
    pub fn SSL_CTX_check_private_key(ctx: *const SSL_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_check_private_key returns one if `ssl` has both a certificate and private
    /// key, and zero otherwise.
    ///
    /// See discussion in `SSL_CTX_check_private_key`.
    pub fn SSL_check_private_key(ssl: *const SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_get_security_level returns zero.
    ///
    /// This function is not meaningful in BoringSSL. OpenSSL has an arbitrary
    /// mapping from algorithms to "security levels" and offers an API to filter TLS
    /// configuration by those levels. In OpenSSL, this function does not return how
    /// secure `ctx` is, just what security level the caller previously configured.
    /// As BoringSSL does not implement this API, we return zero to report that the
    /// security levels mechanism is not used.
    pub fn SSL_CTX_get_security_level(ctx: *const SSL_CTX) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_set0_buffer_pool calls `SSL_CTX_set1_buffer_pool`. Use
    /// `SSL_CTX_set1_buffer_pool` instead.
    ///
    /// WARNING: Despite being named set0, this function does not adopt the caller's
    /// reference to `pool` and instead increments its own reference like a set1
    /// function. Historically, `CRYPTO_BUFFER_POOL` was not reference-counted and
    /// this function saved a non-owning pointer, expecting the caller to maintain a
    /// lifetime relationship between the two objects. Now that pools are
    /// reference-counted, the compatible behavior is to treat it as set0 rather than
    /// ownership-transfering.
    pub fn SSL_CTX_set0_buffer_pool(ctx: *mut SSL_CTX, pool: *mut CRYPTO_BUFFER_POOL);
}
/// ssl_compliance_policy_none does nothing. However, since setting this
/// doesn't undo other policies it's an error to try and set it.
pub const ssl_compliance_policy_t_ssl_compliance_policy_none: ssl_compliance_policy_t = 0;
/// ssl_compliance_policy_fips_202205 configures a TLS connection to use:
///   * TLS 1.2 or 1.3
///   * For TLS 1.2, only ECDHE_[RSA|ECDSA]_WITH_AES_*_GCM_SHA*.
///   * For TLS 1.3, only AES-GCM
///   * P-256 or P-384 for key agreement.
///   * For server signatures, only PKCS#1/PSS with SHA256/384/512, or ECDSA
///     with P-256 or P-384 and SHA256/SHA384.
///
/// Note: this policy can be configured even if BoringSSL has not been built in
/// FIPS mode. Call `FIPS_mode` to check that.
///
/// Note: this setting aids with compliance with NIST requirements but does not
/// guarantee it. Careful reading of SP 800-52r2 is recommended.
pub const ssl_compliance_policy_t_ssl_compliance_policy_fips_202205: ssl_compliance_policy_t = 1;
/// ssl_compliance_policy_wpa3_192_202304 configures a TLS connection to use:
///   * TLS 1.2 or 1.3.
///   * For TLS 1.2, only TLS_ECDHE_[ECDSA|RSA]_WITH_AES_256_GCM_SHA384.
///   * For TLS 1.3, only AES-256-GCM.
///   * P-384 for key agreement.
///   * For handshake signatures, only ECDSA with P-384 and SHA-384, or RSA
///     with SHA-384 or SHA-512.
///
/// No limitations on the certificate chain nor leaf public key are imposed,
/// other than by the supported signature algorithms. But WPA3's "192-bit"
/// mode requires at least P-384 or 3072-bit along the chain. The caller must
/// enforce this themselves on the verified chain using functions such as
/// `X509_STORE_CTX_get0_chain`.
///
/// Note that this setting is less secure than the default. The
/// implementation risks of using a more obscure primitive like P-384
/// dominate other considerations.
pub const ssl_compliance_policy_t_ssl_compliance_policy_wpa3_192_202304: ssl_compliance_policy_t =
    2;
/// ssl_compliance_policy_cnsa_202407 configures a TLS connection to use:
///   * For TLS 1.3, AES-256-GCM over AES-128-GCM over ChaCha20-Poly1305.
///
/// I.e. it ensures that AES-GCM will be used whenever the client supports it.
/// The cipher suite configuration mini-language can be used to similarly
/// configure prior TLS versions if they are enabled.
pub const ssl_compliance_policy_t_ssl_compliance_policy_cnsa_202407: ssl_compliance_policy_t = 3;
/// ssl_compliance_policy_cnsa1_202603 configures a TLS connection to use:
///   * TLS 1.2 or TLS 1.3.
///   * For TLS 1.2, only TLS_ECDHE_[ECDSA|RSA]_WITH_AES_256_GCM_SHA384.
///   * For TLS 1.3, only AES-256-GCM.
///   * ML-KEM-1024 or P-384 for key agreement, preferring ML-KEM-1024 if the
///     client supports it.
///   * For handshake signatures, only ECDSA with P-384 and SHA-384, or RSA
///     with SHA-384.
///
/// Note: this setting aids with compliance with CNSA requirements but does not
/// guarantee it. Careful reading of RFC 9151 is recommended.
pub const ssl_compliance_policy_t_ssl_compliance_policy_cnsa1_202603: ssl_compliance_policy_t = 4;
/// ssl_compliance_policy_cnsa2_202603 configures a TLS connection to use:
///   * Only TLS 1.3, with AES-256-GCM.
///   * Only ML-KEM-1024 for key agreement.
///   * For handshake signatures, only ECDSA with P-384 and SHA-384, or RSA
///     with SHA-384.
///
/// Note: this setting aids with compliance with CNSA requirements but does not
/// guarantee it. Careful reading of draft-becker-cnsa2-tls-profile is
/// recommended.
pub const ssl_compliance_policy_t_ssl_compliance_policy_cnsa2_202603: ssl_compliance_policy_t = 5;
/// Compliance policy configurations
///
/// A TLS connection has a large number of different parameters. Some are well
/// known, like cipher suites, but many are obscure and configuration functions
/// for them may not exist. These policy controls allow broad configuration
/// goals to be specified so that they can flow down to all the different
/// parameters of a TLS connection.
pub type ssl_compliance_policy_t = ::core::ffi::c_uint;
unsafe extern "C" {
    /// SSL_CTX_set_compliance_policy configures various aspects of `ctx` based on
    /// the given policy requirements. Subsequently calling other functions that
    /// configure `ctx` may override `policy`, or may not. This should be the final
    /// configuration function called in order to have defined behaviour matching the
    /// configuration profile documented for `policy` above. It's a fatal error if
    /// `policy` is `ssl_compliance_policy_none`.
    pub fn SSL_CTX_set_compliance_policy(
        ctx: *mut SSL_CTX,
        policy: ssl_compliance_policy_t,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_CTX_get_compliance_policy returns the compliance policy configured on
    /// `ctx`.
    pub fn SSL_CTX_get_compliance_policy(ctx: *const SSL_CTX) -> ssl_compliance_policy_t;
}
unsafe extern "C" {
    /// SSL_set_compliance_policy acts the same as `SSL_CTX_set_compliance_policy`,
    /// but only configures a single `SSL*`.
    pub fn SSL_set_compliance_policy(
        ssl: *mut SSL,
        policy: ssl_compliance_policy_t,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// SSL_get_compliance_policy returns the compliance policy configured on
    /// `ssl`.
    pub fn SSL_get_compliance_policy(ssl: *const SSL) -> ssl_compliance_policy_t;
}
unsafe extern "C" {
    /// SSL_set_server_padding_request configures `ssl` as a client to request
    /// `num_bytes` of additional padding from servers on the TLS handshake. The
    /// client can confirm whether the server sent back the requested amount of
    /// padding in the handshake with `SSL_server_sent_requested_padding`.
    pub fn SSL_set_server_padding_request(ssl: *mut SSL, num_bytes: u16);
}
unsafe extern "C" {
    /// SSL_set_server_padding_enabled configures `ssl` as a server to respond to
    /// the server padding extension with the padding requested by the client.
    /// Passing 0 disables support for the server padding extension, 1 enables
    /// support for the extension.
    ///
    /// By default, the extension is not enabled.
    pub fn SSL_set_server_padding_enabled(ssl: *mut SSL, enabled: ::core::ffi::c_int);
}
unsafe extern "C" {
    /// SSL_server_sent_requested_padding returns 1 if `ssl`, as a client, received
    /// the requested amount of padding from the server as requested through
    /// `SSL_set_server_padding_request`. Otherwise, it returns 0.
    pub fn SSL_server_sent_requested_padding(ssl: *const SSL) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// CRYPTO_tls1_prf calculates `out_len` bytes of the TLS PRF, using `digest`,
    /// and writes them to `out`. It is defined in Section 5 of RFC 5246, acting on
    /// `secret_len` bytes of shared `secret`, `label_len` bytes of `label`,
    /// `seed1_len` bytes of `seed1` and `seed2_len` bytes of `seed2`. It returns one
    /// on success and zero on error.
    pub fn CRYPTO_tls1_prf(
        digest: *const EVP_MD,
        out: *mut u8,
        out_len: usize,
        secret: *const u8,
        secret_len: usize,
        label: *const u8,
        label_len: usize,
        seed1: *const u8,
        seed1_len: usize,
        seed2: *const u8,
        seed2_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// TRUST_TOKEN_experiment_v1 is an experimental Trust Tokens protocol using
    /// PMBTokens and P-384.
    pub fn TRUST_TOKEN_experiment_v1() -> *const TRUST_TOKEN_METHOD;
}
unsafe extern "C" {
    /// TRUST_TOKEN_experiment_v2_voprf is an experimental Trust Tokens protocol
    /// using VOPRFs and P-384 with up to 6 keys, without RR verification.
    pub fn TRUST_TOKEN_experiment_v2_voprf() -> *const TRUST_TOKEN_METHOD;
}
unsafe extern "C" {
    /// TRUST_TOKEN_experiment_v2_pmb is an experimental Trust Tokens protocol using
    /// PMBTokens and P-384 with up to 3 keys, without RR verification.
    pub fn TRUST_TOKEN_experiment_v2_pmb() -> *const TRUST_TOKEN_METHOD;
}
unsafe extern "C" {
    /// TRUST_TOKEN_pst_v1_voprf is an experimental Trust Tokens protocol
    /// using VOPRFs and P-384 with up to 6 keys, without RR verification.
    pub fn TRUST_TOKEN_pst_v1_voprf() -> *const TRUST_TOKEN_METHOD;
}
unsafe extern "C" {
    /// TRUST_TOKEN_pst_v1_pmb is an experimental Trust Tokens protocol using
    /// PMBTokens and P-384 with up to 3 keys, without RR verification.
    pub fn TRUST_TOKEN_pst_v1_pmb() -> *const TRUST_TOKEN_METHOD;
}
/// trust_token_st represents a single-use token for the Trust Token protocol.
/// For the client, this is the token and its corresponding signature. For the
/// issuer, this is the token itself.
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct trust_token_st {
    pub data: *mut u8,
    pub len: usize,
}
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct stack_st_TRUST_TOKEN {
    _unused: [u8; 0],
}
/// We also disable -Wcast-qual. As part of this C-based type erasure setup,  \
/// the wrapper macros need to cast away const in places. In C++, const_cast  \
/// suppresses the warning, but it seemingly cannot be suppressed in C.
pub type sk_TRUST_TOKEN_free_func =
    ::core::option::Option<unsafe extern "C" fn(arg1: *mut TRUST_TOKEN)>;
pub type sk_TRUST_TOKEN_copy_func =
    ::core::option::Option<unsafe extern "C" fn(arg1: *const TRUST_TOKEN) -> *mut TRUST_TOKEN>;
pub type sk_TRUST_TOKEN_cmp_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *const *const TRUST_TOKEN,
        arg2: *const *const TRUST_TOKEN,
    ) -> ::core::ffi::c_int,
>;
pub type sk_TRUST_TOKEN_delete_if_func = ::core::option::Option<
    unsafe extern "C" fn(
        arg1: *mut TRUST_TOKEN,
        arg2: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int,
>;
unsafe extern "C" {
    #[link_name = "sk_TRUST_TOKEN_call_free_func__extern"]
    pub fn sk_TRUST_TOKEN_call_free_func(
        free_func: OPENSSL_sk_free_func,
        ptr: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    #[link_name = "sk_TRUST_TOKEN_call_copy_func__extern"]
    pub fn sk_TRUST_TOKEN_call_copy_func(
        copy_func: OPENSSL_sk_copy_func,
        ptr: *const ::core::ffi::c_void,
    ) -> *mut ::core::ffi::c_void;
}
unsafe extern "C" {
    #[link_name = "sk_TRUST_TOKEN_call_cmp_func__extern"]
    pub fn sk_TRUST_TOKEN_call_cmp_func(
        cmp_func: OPENSSL_sk_cmp_func,
        a: *const ::core::ffi::c_void,
        b: *const ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_TRUST_TOKEN_call_delete_if_func__extern"]
    pub fn sk_TRUST_TOKEN_call_delete_if_func(
        func: OPENSSL_sk_delete_if_func,
        obj: *mut ::core::ffi::c_void,
        data: *mut ::core::ffi::c_void,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_TRUST_TOKEN_new__extern"]
    pub fn sk_TRUST_TOKEN_new(comp: sk_TRUST_TOKEN_cmp_func) -> *mut stack_st_TRUST_TOKEN;
}
unsafe extern "C" {
    #[link_name = "sk_TRUST_TOKEN_new_null__extern"]
    pub fn sk_TRUST_TOKEN_new_null() -> *mut stack_st_TRUST_TOKEN;
}
unsafe extern "C" {
    #[link_name = "sk_TRUST_TOKEN_num__extern"]
    pub fn sk_TRUST_TOKEN_num(sk: *const stack_st_TRUST_TOKEN) -> usize;
}
unsafe extern "C" {
    #[link_name = "sk_TRUST_TOKEN_zero__extern"]
    pub fn sk_TRUST_TOKEN_zero(sk: *mut stack_st_TRUST_TOKEN);
}
unsafe extern "C" {
    #[link_name = "sk_TRUST_TOKEN_value__extern"]
    pub fn sk_TRUST_TOKEN_value(sk: *const stack_st_TRUST_TOKEN, i: usize) -> *mut TRUST_TOKEN;
}
unsafe extern "C" {
    #[link_name = "sk_TRUST_TOKEN_set__extern"]
    pub fn sk_TRUST_TOKEN_set(
        sk: *mut stack_st_TRUST_TOKEN,
        i: usize,
        p: *mut TRUST_TOKEN,
    ) -> *mut TRUST_TOKEN;
}
unsafe extern "C" {
    #[link_name = "sk_TRUST_TOKEN_free__extern"]
    pub fn sk_TRUST_TOKEN_free(sk: *mut stack_st_TRUST_TOKEN);
}
unsafe extern "C" {
    #[link_name = "sk_TRUST_TOKEN_pop_free__extern"]
    pub fn sk_TRUST_TOKEN_pop_free(
        sk: *mut stack_st_TRUST_TOKEN,
        free_func: sk_TRUST_TOKEN_free_func,
    );
}
unsafe extern "C" {
    #[link_name = "sk_TRUST_TOKEN_insert__extern"]
    pub fn sk_TRUST_TOKEN_insert(
        sk: *mut stack_st_TRUST_TOKEN,
        p: *mut TRUST_TOKEN,
        where_: usize,
    ) -> usize;
}
unsafe extern "C" {
    #[link_name = "sk_TRUST_TOKEN_delete__extern"]
    pub fn sk_TRUST_TOKEN_delete(sk: *mut stack_st_TRUST_TOKEN, where_: usize) -> *mut TRUST_TOKEN;
}
unsafe extern "C" {
    #[link_name = "sk_TRUST_TOKEN_delete_ptr__extern"]
    pub fn sk_TRUST_TOKEN_delete_ptr(
        sk: *mut stack_st_TRUST_TOKEN,
        p: *const TRUST_TOKEN,
    ) -> *mut TRUST_TOKEN;
}
unsafe extern "C" {
    #[link_name = "sk_TRUST_TOKEN_delete_if__extern"]
    pub fn sk_TRUST_TOKEN_delete_if(
        sk: *mut stack_st_TRUST_TOKEN,
        func: sk_TRUST_TOKEN_delete_if_func,
        data: *mut ::core::ffi::c_void,
    );
}
unsafe extern "C" {
    #[link_name = "sk_TRUST_TOKEN_find__extern"]
    pub fn sk_TRUST_TOKEN_find(
        sk: *const stack_st_TRUST_TOKEN,
        out_index: *mut usize,
        p: *const TRUST_TOKEN,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_TRUST_TOKEN_shift__extern"]
    pub fn sk_TRUST_TOKEN_shift(sk: *mut stack_st_TRUST_TOKEN) -> *mut TRUST_TOKEN;
}
unsafe extern "C" {
    #[link_name = "sk_TRUST_TOKEN_push__extern"]
    pub fn sk_TRUST_TOKEN_push(sk: *mut stack_st_TRUST_TOKEN, p: *mut TRUST_TOKEN) -> usize;
}
unsafe extern "C" {
    #[link_name = "sk_TRUST_TOKEN_pop__extern"]
    pub fn sk_TRUST_TOKEN_pop(sk: *mut stack_st_TRUST_TOKEN) -> *mut TRUST_TOKEN;
}
unsafe extern "C" {
    #[link_name = "sk_TRUST_TOKEN_dup__extern"]
    pub fn sk_TRUST_TOKEN_dup(sk: *const stack_st_TRUST_TOKEN) -> *mut stack_st_TRUST_TOKEN;
}
unsafe extern "C" {
    #[link_name = "sk_TRUST_TOKEN_sort__extern"]
    pub fn sk_TRUST_TOKEN_sort(sk: *mut stack_st_TRUST_TOKEN);
}
unsafe extern "C" {
    #[link_name = "sk_TRUST_TOKEN_sort_and_dedup__extern"]
    pub fn sk_TRUST_TOKEN_sort_and_dedup(
        sk: *mut stack_st_TRUST_TOKEN,
        free_func: sk_TRUST_TOKEN_free_func,
    );
}
unsafe extern "C" {
    #[link_name = "sk_TRUST_TOKEN_is_sorted__extern"]
    pub fn sk_TRUST_TOKEN_is_sorted(sk: *const stack_st_TRUST_TOKEN) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    #[link_name = "sk_TRUST_TOKEN_set_cmp_func__extern"]
    pub fn sk_TRUST_TOKEN_set_cmp_func(
        sk: *mut stack_st_TRUST_TOKEN,
        comp: sk_TRUST_TOKEN_cmp_func,
    ) -> sk_TRUST_TOKEN_cmp_func;
}
unsafe extern "C" {
    #[link_name = "sk_TRUST_TOKEN_deep_copy__extern"]
    pub fn sk_TRUST_TOKEN_deep_copy(
        sk: *const stack_st_TRUST_TOKEN,
        copy_func: sk_TRUST_TOKEN_copy_func,
        free_func: sk_TRUST_TOKEN_free_func,
    ) -> *mut stack_st_TRUST_TOKEN;
}
unsafe extern "C" {
    /// TRUST_TOKEN_new creates a newly-allocated `TRUST_TOKEN` with value `data` or
    /// NULL on allocation failure.
    pub fn TRUST_TOKEN_new(data: *const u8, len: usize) -> *mut TRUST_TOKEN;
}
unsafe extern "C" {
    /// TRUST_TOKEN_free releases memory associated with `token`.
    pub fn TRUST_TOKEN_free(token: *mut TRUST_TOKEN);
}
unsafe extern "C" {
    /// TRUST_TOKEN_generate_key creates a new Trust Token keypair labeled with `id`
    /// and serializes the private and public keys, writing the private key to
    /// `out_priv_key` and setting `*out_priv_key_len` to the number of bytes
    /// written, and writing the public key to `out_pub_key` and setting
    /// `*out_pub_key_len` to the number of bytes written.
    ///
    /// At most `max_priv_key_len` and `max_pub_key_len` bytes are written. In order
    /// to ensure success, these should be at least
    /// `TRUST_TOKEN_MAX_PRIVATE_KEY_SIZE` and `TRUST_TOKEN_MAX_PUBLIC_KEY_SIZE`.
    ///
    /// This function returns one on success or zero on error.
    pub fn TRUST_TOKEN_generate_key(
        method: *const TRUST_TOKEN_METHOD,
        out_priv_key: *mut u8,
        out_priv_key_len: *mut usize,
        max_priv_key_len: usize,
        out_pub_key: *mut u8,
        out_pub_key_len: *mut usize,
        max_pub_key_len: usize,
        id: u32,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// TRUST_TOKEN_derive_key_from_secret deterministically derives a new Trust
    /// Token keypair labeled with `id` from an input `secret` and serializes the
    /// private and public keys, writing the private key to `out_priv_key` and
    /// setting `*out_priv_key_len` to the number of bytes written, and writing the
    /// public key to `out_pub_key` and setting `*out_pub_key_len` to the number of
    /// bytes written.
    ///
    /// At most `max_priv_key_len` and `max_pub_key_len` bytes are written. In order
    /// to ensure success, these should be at least
    /// `TRUST_TOKEN_MAX_PRIVATE_KEY_SIZE` and `TRUST_TOKEN_MAX_PUBLIC_KEY_SIZE`.
    ///
    /// This function returns one on success or zero on error.
    pub fn TRUST_TOKEN_derive_key_from_secret(
        method: *const TRUST_TOKEN_METHOD,
        out_priv_key: *mut u8,
        out_priv_key_len: *mut usize,
        max_priv_key_len: usize,
        out_pub_key: *mut u8,
        out_pub_key_len: *mut usize,
        max_pub_key_len: usize,
        id: u32,
        secret: *const u8,
        secret_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// TRUST_TOKEN_CLIENT_new returns a newly-allocated `TRUST_TOKEN_CLIENT`
    /// configured to use a max batchsize of `max_batchsize` or NULL on error.
    /// Issuance requests must be made in batches smaller than `max_batchsize`. This
    /// function will return an error if `max_batchsize` is too large for Trust
    /// Tokens.
    pub fn TRUST_TOKEN_CLIENT_new(
        method: *const TRUST_TOKEN_METHOD,
        max_batchsize: usize,
    ) -> *mut TRUST_TOKEN_CLIENT;
}
unsafe extern "C" {
    /// TRUST_TOKEN_CLIENT_free releases memory associated with `ctx`.
    pub fn TRUST_TOKEN_CLIENT_free(ctx: *mut TRUST_TOKEN_CLIENT);
}
unsafe extern "C" {
    /// TRUST_TOKEN_CLIENT_dup_for_testing returns a newly-allocated copy of `ctx`,
    /// or NULL on error. This may be useful for testing the library, e.g. to
    /// benchmark an individual operation.
    ///
    /// WARNING: This function should never be used in production. A
    /// `TRUST_TOKEN_CLIENT` maintains single-use state between
    /// `TRUST_TOKEN_CLIENT_begin_issuance` and `TRUST_TOKEN_CLIENT_finish_issuance`
    /// operations. Cloning this state will cause tokens to be linkable and no longer
    /// anonymized.
    pub fn TRUST_TOKEN_CLIENT_dup_for_testing(
        ctx: *const TRUST_TOKEN_CLIENT,
    ) -> *mut TRUST_TOKEN_CLIENT;
}
unsafe extern "C" {
    /// TRUST_TOKEN_CLIENT_add_key configures the `ctx` to support the public key
    /// `key`. It sets `*out_key_index` to the index this key has been configured to.
    /// It returns one on success or zero on error if the `key` can't be parsed or
    /// too many keys have been configured.
    pub fn TRUST_TOKEN_CLIENT_add_key(
        ctx: *mut TRUST_TOKEN_CLIENT,
        out_key_index: *mut usize,
        key: *const u8,
        key_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// TRUST_TOKEN_CLIENT_set_srr_key sets the public key used to verify the SRR. It
    /// returns one on success and zero on error.
    pub fn TRUST_TOKEN_CLIENT_set_srr_key(
        ctx: *mut TRUST_TOKEN_CLIENT,
        key: *mut EVP_PKEY,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// TRUST_TOKEN_CLIENT_begin_issuance produces a request for `count` trust tokens
    /// and serializes the request into a newly-allocated buffer, setting `*out` to
    /// that buffer and `*out_len` to its length. The caller takes ownership of the
    /// buffer and must call `OPENSSL_free` when done. It returns one on success and
    /// zero on error.
    pub fn TRUST_TOKEN_CLIENT_begin_issuance(
        ctx: *mut TRUST_TOKEN_CLIENT,
        out: *mut *mut u8,
        out_len: *mut usize,
        count: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// TRUST_TOKEN_CLIENT_begin_issuance_over_message produces a request for a trust
    /// token derived from `msg` and serializes the request into a newly-allocated
    /// buffer, setting `*out` to that buffer and `*out_len` to its length. The
    /// caller takes ownership of the buffer and must call `OPENSSL_free` when done.
    /// It returns one on success and zero on error.
    pub fn TRUST_TOKEN_CLIENT_begin_issuance_over_message(
        ctx: *mut TRUST_TOKEN_CLIENT,
        out: *mut *mut u8,
        out_len: *mut usize,
        count: usize,
        msg: *const u8,
        msg_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// TRUST_TOKEN_CLIENT_finish_issuance consumes `response` from the issuer and
    /// extracts the tokens, returning a list of tokens and the index of the key used
    /// to sign the tokens in `*out_key_index`. The caller can use this to determine
    /// what key was used in an issuance and to drop tokens if a new key commitment
    /// arrives without the specified key present. The caller takes ownership of the
    /// list and must call `sk_TRUST_TOKEN_pop_free` when done. The list is empty if
    /// issuance fails.
    pub fn TRUST_TOKEN_CLIENT_finish_issuance(
        ctx: *mut TRUST_TOKEN_CLIENT,
        out_key_index: *mut usize,
        response: *const u8,
        response_len: usize,
    ) -> *mut stack_st_TRUST_TOKEN;
}
unsafe extern "C" {
    /// TRUST_TOKEN_CLIENT_begin_redemption produces a request to redeem a token
    /// `token` and receive a signature over `data` and serializes the request into
    /// a newly-allocated buffer, setting `*out` to that buffer and `*out_len` to
    /// its length. `time` is the number of seconds since the UNIX epoch and used to
    /// verify the validity of the issuer's response in TrustTokenV1 and ignored in
    /// other versions. The caller takes ownership of the buffer and must call
    /// `OPENSSL_free` when done. It returns one on success or zero on error.
    pub fn TRUST_TOKEN_CLIENT_begin_redemption(
        ctx: *mut TRUST_TOKEN_CLIENT,
        out: *mut *mut u8,
        out_len: *mut usize,
        token: *const TRUST_TOKEN,
        data: *const u8,
        data_len: usize,
        time: u64,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// TRUST_TOKEN_CLIENT_finish_redemption consumes `response` from the issuer. In
    /// `TRUST_TOKEN_experiment_v1`, it then verifies the SRR and if valid  sets
    /// `*out_rr` and `*out_rr_len` (respectively, `*out_sig` and `*out_sig_len`)
    /// to a newly-allocated buffer containing the SRR (respectively, the SRR
    /// signature). In other versions, it sets `*out_rr` and `*out_rr_len`
    /// to a newly-allocated buffer containing `response` and leaves all validation
    /// to the caller. It returns one on success or zero on failure.
    pub fn TRUST_TOKEN_CLIENT_finish_redemption(
        ctx: *mut TRUST_TOKEN_CLIENT,
        out_rr: *mut *mut u8,
        out_rr_len: *mut usize,
        out_sig: *mut *mut u8,
        out_sig_len: *mut usize,
        response: *const u8,
        response_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// TRUST_TOKEN_ISSUER_new returns a newly-allocated `TRUST_TOKEN_ISSUER`
    /// configured to use a max batchsize of `max_batchsize` or NULL on error.
    /// Issuance requests must be made in batches smaller than `max_batchsize`. This
    /// function will return an error if `max_batchsize` is too large for Trust
    /// Tokens.
    pub fn TRUST_TOKEN_ISSUER_new(
        method: *const TRUST_TOKEN_METHOD,
        max_batchsize: usize,
    ) -> *mut TRUST_TOKEN_ISSUER;
}
unsafe extern "C" {
    /// TRUST_TOKEN_ISSUER_free releases memory associated with `ctx`.
    pub fn TRUST_TOKEN_ISSUER_free(ctx: *mut TRUST_TOKEN_ISSUER);
}
unsafe extern "C" {
    /// TRUST_TOKEN_ISSUER_add_key configures the `ctx` to support the private key
    /// `key`. It must be a private key returned by `TRUST_TOKEN_generate_key`. It
    /// returns one on success or zero on error. This function may fail if the `key`
    /// can't be parsed or too many keys have been configured.
    pub fn TRUST_TOKEN_ISSUER_add_key(
        ctx: *mut TRUST_TOKEN_ISSUER,
        key: *const u8,
        key_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// TRUST_TOKEN_ISSUER_set_srr_key sets the private key used to sign the SRR. It
    /// returns one on success and zero on error.
    pub fn TRUST_TOKEN_ISSUER_set_srr_key(
        ctx: *mut TRUST_TOKEN_ISSUER,
        key: *mut EVP_PKEY,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// TRUST_TOKEN_ISSUER_issue ingests `request` for token issuance
    /// and generates up to `max_issuance` valid tokens, producing a list of blinded
    /// tokens and storing the response into a newly-allocated buffer and setting
    /// `*out` to that buffer, `*out_len` to its length, and `*out_tokens_issued` to
    /// the number of tokens issued. The tokens are issued with public metadata of
    /// `public_metadata` and a private metadata value of `private_metadata`.
    /// `public_metadata` must be one of the previously configured key IDs.
    /// `private_metadata` must be 0 or 1. The caller takes ownership of the buffer
    /// and must call `OPENSSL_free` when done. It returns one on success or zero on
    /// error.
    pub fn TRUST_TOKEN_ISSUER_issue(
        ctx: *const TRUST_TOKEN_ISSUER,
        out: *mut *mut u8,
        out_len: *mut usize,
        out_tokens_issued: *mut usize,
        request: *const u8,
        request_len: usize,
        public_metadata: u32,
        private_metadata: u8,
        max_issuance: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// TRUST_TOKEN_ISSUER_redeem ingests a `request` for token redemption and
    /// verifies the token. The public metadata is stored in `*out_public`. The
    /// private metadata (if any) is stored in `*out_private`. The extracted
    /// `TRUST_TOKEN` is stored into a newly-allocated buffer and stored in
    /// `*out_token`. The extracted client data is stored into a newly-allocated
    /// buffer and stored in `*out_client_data`. The caller takes ownership of each
    /// output buffer and must call `OPENSSL_free` when done. It returns one on
    /// success or zero on error.
    ///
    /// The caller must keep track of all values of `*out_token` seen globally before
    /// returning a response to the client. If the value has been reused, the caller
    /// must report an error to the client. Returning a response with replayed values
    /// allows an attacker to double-spend tokens.
    pub fn TRUST_TOKEN_ISSUER_redeem(
        ctx: *const TRUST_TOKEN_ISSUER,
        out_public: *mut u32,
        out_private: *mut u8,
        out_token: *mut *mut TRUST_TOKEN,
        out_client_data: *mut *mut u8,
        out_client_data_len: *mut usize,
        request: *const u8,
        request_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// TRUST_TOKEN_ISSUER_redeem_over_message ingests a `request` for token
    /// redemption and a message and verifies the token and that it is derived from
    /// the provided `msg`. The public metadata is stored in
    /// `*out_public`. The private metadata (if any) is stored in `*out_private`. The
    /// extracted `TRUST_TOKEN` is stored into a newly-allocated buffer and stored in
    /// `*out_token`. The extracted client data is stored into a newly-allocated
    /// buffer and stored in `*out_client_data`. The caller takes ownership of each
    /// output buffer and must call `OPENSSL_free` when done. It returns one on
    /// success or zero on error.
    ///
    /// The caller must keep track of all values of `*out_token` seen globally before
    /// returning a response to the client. If the value has been reused, the caller
    /// must report an error to the client. Returning a response with replayed values
    /// allows an attacker to double-spend tokens.
    pub fn TRUST_TOKEN_ISSUER_redeem_over_message(
        ctx: *const TRUST_TOKEN_ISSUER,
        out_public: *mut u32,
        out_private: *mut u8,
        out_token: *mut *mut TRUST_TOKEN,
        out_client_data: *mut *mut u8,
        out_client_data_len: *mut usize,
        request: *const u8,
        request_len: usize,
        msg: *const u8,
        msg_len: usize,
    ) -> ::core::ffi::c_int;
}
unsafe extern "C" {
    /// TRUST_TOKEN_decode_private_metadata decodes `encrypted_bit` using the
    /// private metadata key specified by a `key` buffer of length `key_len` and the
    /// nonce by a `nonce` buffer of length `nonce_len`. The nonce in
    /// `TRUST_TOKEN_experiment_v1` is the token-hash field of the SRR. `*out_value`
    /// is set to the decrypted value, either zero or one. It returns one on success
    /// and zero on error.
    pub fn TRUST_TOKEN_decode_private_metadata(
        method: *const TRUST_TOKEN_METHOD,
        out_value: *mut u8,
        key: *const u8,
        key_len: usize,
        nonce: *const u8,
        nonce_len: usize,
        encrypted_bit: u8,
    ) -> ::core::ffi::c_int;
}
pub type __builtin_va_list = *mut ::core::ffi::c_void;
#[repr(C)]
#[derive(Debug, Copy, Clone)]
pub struct CRYPTO_dynlock_value {
    pub _address: u8,
}
