grpc 1.26.0 → 1.30.0

data/third_party/boringssl/ssl/ssl_stat.cc

@@ -1,224 +0,0 @@
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-/* ====================================================================
- * Copyright 2005 Nokia. All rights reserved.
- *
- * The portions of the attached software ("Contribution") is developed by
- * Nokia Corporation and is licensed pursuant to the OpenSSL open source
- * license.
- *
- * The Contribution, originally written by Mika Kousa and Pasi Eronen of
- * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites
- * support (see RFC 4279) to OpenSSL.
- *
- * No patent licenses or other rights except those expressly stated in
- * the OpenSSL open source license shall be deemed granted or received
- * expressly, by implication, estoppel, or otherwise.
- *
- * No assurances are provided by Nokia that the Contribution does not
- * infringe the patent or other intellectual property rights of any third
- * party or that the license provides you with all the necessary rights
- * to make use of the Contribution.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN
- * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA
- * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY
- * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR
- * OTHERWISE.
- */
-
-#include <openssl/ssl.h>
-
-#include <assert.h>
-
-#include "internal.h"
-
-
-const char *SSL_state_string_long(const SSL *ssl) {
-  if (ssl->s3->hs == nullptr) {
-    return "SSL negotiation finished successfully";
-  }
-
-  return ssl->server ? ssl_server_handshake_state(ssl->s3->hs.get())
-                     : ssl_client_handshake_state(ssl->s3->hs.get());
-}
-
-const char *SSL_state_string(const SSL *ssl) {
-  return "!!!!!!";
-}
-
-const char *SSL_alert_type_string_long(int value) {
-  value >>= 8;
-  if (value == SSL3_AL_WARNING) {
-    return "warning";
-  } else if (value == SSL3_AL_FATAL) {
-    return "fatal";
-  }
-
-  return "unknown";
-}
-
-const char *SSL_alert_type_string(int value) {
-  return "!";
-}
-
-const char *SSL_alert_desc_string(int value) {
-  return "!!";
-}
-
-const char *SSL_alert_desc_string_long(int value) {
-  switch (value & 0xff) {
-    case SSL3_AD_CLOSE_NOTIFY:
-      return "close notify";
-
-    case SSL3_AD_UNEXPECTED_MESSAGE:
-      return "unexpected_message";
-
-    case SSL3_AD_BAD_RECORD_MAC:
-      return "bad record mac";
-
-    case SSL3_AD_DECOMPRESSION_FAILURE:
-      return "decompression failure";
-
-    case SSL3_AD_HANDSHAKE_FAILURE:
-      return "handshake failure";
-
-    case SSL3_AD_NO_CERTIFICATE:
-      return "no certificate";
-
-    case SSL3_AD_BAD_CERTIFICATE:
-      return "bad certificate";
-
-    case SSL3_AD_UNSUPPORTED_CERTIFICATE:
-      return "unsupported certificate";
-
-    case SSL3_AD_CERTIFICATE_REVOKED:
-      return "certificate revoked";
-
-    case SSL3_AD_CERTIFICATE_EXPIRED:
-      return "certificate expired";
-
-    case SSL3_AD_CERTIFICATE_UNKNOWN:
-      return "certificate unknown";
-
-    case SSL3_AD_ILLEGAL_PARAMETER:
-      return "illegal parameter";
-
-    case TLS1_AD_DECRYPTION_FAILED:
-      return "decryption failed";
-
-    case TLS1_AD_RECORD_OVERFLOW:
-      return "record overflow";
-
-    case TLS1_AD_UNKNOWN_CA:
-      return "unknown CA";
-
-    case TLS1_AD_ACCESS_DENIED:
-      return "access denied";
-
-    case TLS1_AD_DECODE_ERROR:
-      return "decode error";
-
-    case TLS1_AD_DECRYPT_ERROR:
-      return "decrypt error";
-
-    case TLS1_AD_EXPORT_RESTRICTION:
-      return "export restriction";
-
-    case TLS1_AD_PROTOCOL_VERSION:
-      return "protocol version";
-
-    case TLS1_AD_INSUFFICIENT_SECURITY:
-      return "insufficient security";
-
-    case TLS1_AD_INTERNAL_ERROR:
-      return "internal error";
-
-    case SSL3_AD_INAPPROPRIATE_FALLBACK:
-      return "inappropriate fallback";
-
-    case TLS1_AD_USER_CANCELLED:
-      return "user canceled";
-
-    case TLS1_AD_NO_RENEGOTIATION:
-      return "no renegotiation";
-
-    case TLS1_AD_UNSUPPORTED_EXTENSION:
-      return "unsupported extension";
-
-    case TLS1_AD_CERTIFICATE_UNOBTAINABLE:
-      return "certificate unobtainable";
-
-    case TLS1_AD_UNRECOGNIZED_NAME:
-      return "unrecognized name";
-
-    case TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE:
-      return "bad certificate status response";
-
-    case TLS1_AD_BAD_CERTIFICATE_HASH_VALUE:
-      return "bad certificate hash value";
-
-    case TLS1_AD_UNKNOWN_PSK_IDENTITY:
-      return "unknown PSK identity";
-
-    case TLS1_AD_CERTIFICATE_REQUIRED:
-      return "certificate required";
-
-    default:
-      return "unknown";
-  }
-}

data/third_party/boringssl/ssl/ssl_versions.cc

@@ -1,394 +0,0 @@
-/* Copyright (c) 2017, Google Inc.
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
-
-#include <openssl/ssl.h>
-
-#include <assert.h>
-
-#include <openssl/bytestring.h>
-#include <openssl/err.h>
-
-#include "internal.h"
-#include "../crypto/internal.h"
-
-
-BSSL_NAMESPACE_BEGIN
-
-bool ssl_protocol_version_from_wire(uint16_t *out, uint16_t version) {
-  switch (version) {
-    case TLS1_VERSION:
-    case TLS1_1_VERSION:
-    case TLS1_2_VERSION:
-    case TLS1_3_VERSION:
-      *out = version;
-      return true;
-
-    case DTLS1_VERSION:
-      // DTLS 1.0 is analogous to TLS 1.1, not TLS 1.0.
-      *out = TLS1_1_VERSION;
-      return true;
-
-    case DTLS1_2_VERSION:
-      *out = TLS1_2_VERSION;
-      return true;
-
-    default:
-      return false;
-  }
-}
-
-// The follow arrays are the supported versions for TLS and DTLS, in order of
-// decreasing preference.
-
-static const uint16_t kTLSVersions[] = {
-    TLS1_3_VERSION,
-    TLS1_2_VERSION,
-    TLS1_1_VERSION,
-    TLS1_VERSION,
-};
-
-static const uint16_t kDTLSVersions[] = {
-    DTLS1_2_VERSION,
-    DTLS1_VERSION,
-};
-
-static Span<const uint16_t> get_method_versions(
-    const SSL_PROTOCOL_METHOD *method) {
-  return method->is_dtls ? Span<const uint16_t>(kDTLSVersions)
-                         : Span<const uint16_t>(kTLSVersions);
-}
-
-bool ssl_method_supports_version(const SSL_PROTOCOL_METHOD *method,
-                                 uint16_t version) {
-  for (uint16_t supported : get_method_versions(method)) {
-    if (supported == version) {
-      return true;
-    }
-  }
-  return false;
-}
-
-// The following functions map between API versions and wire versions. The
-// public API works on wire versions.
-
-static const char *ssl_version_to_string(uint16_t version) {
-  switch (version) {
-    case TLS1_3_VERSION:
-      return "TLSv1.3";
-
-    case TLS1_2_VERSION:
-      return "TLSv1.2";
-
-    case TLS1_1_VERSION:
-      return "TLSv1.1";
-
-    case TLS1_VERSION:
-      return "TLSv1";
-
-    case DTLS1_VERSION:
-      return "DTLSv1";
-
-    case DTLS1_2_VERSION:
-      return "DTLSv1.2";
-
-    default:
-      return "unknown";
-  }
-}
-
-static uint16_t wire_version_to_api(uint16_t version) {
-  return version;
-}
-
-// api_version_to_wire maps |version| to some representative wire version.
-static bool api_version_to_wire(uint16_t *out, uint16_t version) {
-  // Check it is a real protocol version.
-  uint16_t unused;
-  if (!ssl_protocol_version_from_wire(&unused, version)) {
-    return false;
-  }
-
-  *out = version;
-  return true;
-}
-
-static bool set_version_bound(const SSL_PROTOCOL_METHOD *method, uint16_t *out,
-                              uint16_t version) {
-  if (!api_version_to_wire(&version, version) ||
-      !ssl_method_supports_version(method, version)) {
-    OPENSSL_PUT_ERROR(SSL, SSL_R_UNKNOWN_SSL_VERSION);
-    return false;
-  }
-
-  *out = version;
-  return true;
-}
-
-static bool set_min_version(const SSL_PROTOCOL_METHOD *method, uint16_t *out,
-                            uint16_t version) {
-  // Zero is interpreted as the default minimum version.
-  if (version == 0) {
-    *out = method->is_dtls ? DTLS1_VERSION : TLS1_VERSION;
-    return true;
-  }
-
-  return set_version_bound(method, out, version);
-}
-
-static bool set_max_version(const SSL_PROTOCOL_METHOD *method, uint16_t *out,
-                            uint16_t version) {
-  // Zero is interpreted as the default maximum version.
-  if (version == 0) {
-    *out = method->is_dtls ? DTLS1_2_VERSION : TLS1_2_VERSION;
-    return true;
-  }
-
-  return set_version_bound(method, out, version);
-}
-
-const struct {
-  uint16_t version;
-  uint32_t flag;
-} kProtocolVersions[] = {
-    {TLS1_VERSION, SSL_OP_NO_TLSv1},
-    {TLS1_1_VERSION, SSL_OP_NO_TLSv1_1},
-    {TLS1_2_VERSION, SSL_OP_NO_TLSv1_2},
-    {TLS1_3_VERSION, SSL_OP_NO_TLSv1_3},
-};
-
-bool ssl_get_version_range(const SSL_HANDSHAKE *hs, uint16_t *out_min_version,
-                           uint16_t *out_max_version) {
-  // For historical reasons, |SSL_OP_NO_DTLSv1| aliases |SSL_OP_NO_TLSv1|, but
-  // DTLS 1.0 should be mapped to TLS 1.1.
-  uint32_t options = hs->ssl->options;
-  if (SSL_is_dtls(hs->ssl)) {
-    options &= ~SSL_OP_NO_TLSv1_1;
-    if (options & SSL_OP_NO_DTLSv1) {
-      options |= SSL_OP_NO_TLSv1_1;
-    }
-  }
-
-  uint16_t min_version, max_version;
-  if (!ssl_protocol_version_from_wire(&min_version,
-                                      hs->config->conf_min_version) ||
-      !ssl_protocol_version_from_wire(&max_version,
-                                      hs->config->conf_max_version)) {
-    OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
-    return false;
-  }
-
-  // QUIC requires TLS 1.3.
-  if (hs->ssl->quic_method && min_version < TLS1_3_VERSION) {
-    min_version = TLS1_3_VERSION;
-  }
-
-  // OpenSSL's API for controlling versions entails blacklisting individual
-  // protocols. This has two problems. First, on the client, the protocol can
-  // only express a contiguous range of versions. Second, a library consumer
-  // trying to set a maximum version cannot disable protocol versions that get
-  // added in a future version of the library.
-  //
-  // To account for both of these, OpenSSL interprets the client-side bitmask
-  // as a min/max range by picking the lowest contiguous non-empty range of
-  // enabled protocols. Note that this means it is impossible to set a maximum
-  // version of the higest supported TLS version in a future-proof way.
-  bool any_enabled = false;
-  for (size_t i = 0; i < OPENSSL_ARRAY_SIZE(kProtocolVersions); i++) {
-    // Only look at the versions already enabled.
-    if (min_version > kProtocolVersions[i].version) {
-      continue;
-    }
-    if (max_version < kProtocolVersions[i].version) {
-      break;
-    }
-
-    if (!(options & kProtocolVersions[i].flag)) {
-      // The minimum version is the first enabled version.
-      if (!any_enabled) {
-        any_enabled = true;
-        min_version = kProtocolVersions[i].version;
-      }
-      continue;
-    }
-
-    // If there is a disabled version after the first enabled one, all versions
-    // after it are implicitly disabled.
-    if (any_enabled) {
-      max_version = kProtocolVersions[i-1].version;
-      break;
-    }
-  }
-
-  if (!any_enabled) {
-    OPENSSL_PUT_ERROR(SSL, SSL_R_NO_SUPPORTED_VERSIONS_ENABLED);
-    return false;
-  }
-
-  *out_min_version = min_version;
-  *out_max_version = max_version;
-  return true;
-}
-
-static uint16_t ssl_version(const SSL *ssl) {
-  // In early data, we report the predicted version.
-  if (SSL_in_early_data(ssl) && !ssl->server) {
-    return ssl->s3->hs->early_session->ssl_version;
-  }
-  return ssl->version;
-}
-
-uint16_t ssl_protocol_version(const SSL *ssl) {
-  assert(ssl->s3->have_version);
-  uint16_t version;
-  if (!ssl_protocol_version_from_wire(&version, ssl->version)) {
-    // |ssl->version| will always be set to a valid version.
-    assert(0);
-    return 0;
-  }
-
-  return version;
-}
-
-bool ssl_supports_version(SSL_HANDSHAKE *hs, uint16_t version) {
-  SSL *const ssl = hs->ssl;
-  uint16_t protocol_version;
-  if (!ssl_method_supports_version(ssl->method, version) ||
-      !ssl_protocol_version_from_wire(&protocol_version, version) ||
-      hs->min_version > protocol_version ||
-      protocol_version > hs->max_version) {
-    return false;
-  }
-
-  return true;
-}
-
-bool ssl_add_supported_versions(SSL_HANDSHAKE *hs, CBB *cbb) {
-  for (uint16_t version : get_method_versions(hs->ssl->method)) {
-    if (ssl_supports_version(hs, version) &&
-        !CBB_add_u16(cbb, version)) {
-      return false;
-    }
-  }
-  return true;
-}
-
-bool ssl_negotiate_version(SSL_HANDSHAKE *hs, uint8_t *out_alert,
-                           uint16_t *out_version, const CBS *peer_versions) {
-  for (uint16_t version : get_method_versions(hs->ssl->method)) {
-    if (!ssl_supports_version(hs, version)) {
-      continue;
-    }
-
-    // JDK 11, prior to 11.0.2, has a buggy TLS 1.3 implementation which fails
-    // to send SNI when offering 1.3 sessions. Disable TLS 1.3 for such
-    // clients. We apply this logic here rather than |ssl_supports_version| so
-    // the downgrade signal continues to query the true capabilities. (The
-    // workaround is a limitation of the peer's capabilities rather than our
-    // own.)
-    //
-    // See https://bugs.openjdk.java.net/browse/JDK-8211806.
-    if (version == TLS1_3_VERSION && hs->apply_jdk11_workaround) {
-      continue;
-    }
-
-    CBS copy = *peer_versions;
-    while (CBS_len(&copy) != 0) {
-      uint16_t peer_version;
-      if (!CBS_get_u16(&copy, &peer_version)) {
-        OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
-        *out_alert = SSL_AD_DECODE_ERROR;
-        return false;
-      }
-
-      if (peer_version == version) {
-        *out_version = version;
-        return true;
-      }
-    }
-  }
-
-  OPENSSL_PUT_ERROR(SSL, SSL_R_UNSUPPORTED_PROTOCOL);
-  *out_alert = SSL_AD_PROTOCOL_VERSION;
-  return false;
-}
-
-BSSL_NAMESPACE_END
-
-using namespace bssl;
-
-int SSL_CTX_set_min_proto_version(SSL_CTX *ctx, uint16_t version) {
-  return set_min_version(ctx->method, &ctx->conf_min_version, version);
-}
-
-int SSL_CTX_set_max_proto_version(SSL_CTX *ctx, uint16_t version) {
-  return set_max_version(ctx->method, &ctx->conf_max_version, version);
-}
-
-uint16_t SSL_CTX_get_min_proto_version(const SSL_CTX *ctx) {
-  return ctx->conf_min_version;
-}
-
-uint16_t SSL_CTX_get_max_proto_version(const SSL_CTX *ctx) {
-  return ctx->conf_max_version;
-}
-
-int SSL_set_min_proto_version(SSL *ssl, uint16_t version) {
-  if (!ssl->config) {
-    return 0;
-  }
-  return set_min_version(ssl->method, &ssl->config->conf_min_version, version);
-}
-
-int SSL_set_max_proto_version(SSL *ssl, uint16_t version) {
-  if (!ssl->config) {
-    return 0;
-  }
-  return set_max_version(ssl->method, &ssl->config->conf_max_version, version);
-}
-
-uint16_t SSL_get_min_proto_version(const SSL *ssl) {
-  if (!ssl->config) {
-    return 0;
-  }
-  return ssl->config->conf_min_version;
-}
-
-uint16_t SSL_get_max_proto_version(const SSL *ssl) {
-  if (!ssl->config) {
-    return 0;
-  }
-  return ssl->config->conf_max_version;
-}
-
-int SSL_version(const SSL *ssl) {
-  return wire_version_to_api(ssl_version(ssl));
-}
-
-const char *SSL_get_version(const SSL *ssl) {
-  return ssl_version_to_string(ssl_version(ssl));
-}
-
-const char *SSL_SESSION_get_version(const SSL_SESSION *session) {
-  return ssl_version_to_string(session->ssl_version);
-}
-
-uint16_t SSL_SESSION_get_protocol_version(const SSL_SESSION *session) {
-  return wire_version_to_api(session->ssl_version);
-}
-
-int SSL_SESSION_set_protocol_version(SSL_SESSION *session, uint16_t version) {
-  // This picks a representative TLS 1.3 version, but this API should only be
-  // used on unit test sessions anyway.
-  return api_version_to_wire(&session->ssl_version, version);
-}