grpc 1.53.2 → 1.54.0

data/third_party/boringssl-with-bazel/src/crypto/x509/internal.h

@@ -70,14 +70,14 @@ extern "C" {
 #endif
 
 
-/* Internal structures. */
+// Internal structures.
 
 typedef struct X509_val_st {
   ASN1_TIME *notBefore;
   ASN1_TIME *notAfter;
 } X509_VAL;
 
-DECLARE_ASN1_FUNCTIONS(X509_VAL)
+DECLARE_ASN1_FUNCTIONS_const(X509_VAL)
 
 struct X509_pubkey_st {
   X509_ALGOR *algor;
@@ -106,13 +106,14 @@ struct x509_attributes_st {
   STACK_OF(ASN1_TYPE) *set;
 } /* X509_ATTRIBUTE */;
 
-struct x509_cert_aux_st {
+typedef struct x509_cert_aux_st {
   STACK_OF(ASN1_OBJECT) *trust;   // trusted uses
   STACK_OF(ASN1_OBJECT) *reject;  // rejected uses
   ASN1_UTF8STRING *alias;         // "friendly name"
   ASN1_OCTET_STRING *keyid;       // key id of private key
-  STACK_OF(X509_ALGOR) *other;    // other unspecified info
-} /* X509_CERT_AUX */;
+} X509_CERT_AUX;
+
+DECLARE_ASN1_FUNCTIONS_const(X509_CERT_AUX)
 
 struct X509_extension_st {
   ASN1_OBJECT *object;
@@ -134,6 +135,8 @@ typedef struct {
   ASN1_ENCODING enc;
 } X509_CINF;
 
+// TODO(https://crbug.com/boringssl/407): This is not const because it contains
+// an |X509_NAME|.
 DECLARE_ASN1_FUNCTIONS(X509_CINF)
 
 struct x509_st {
@@ -144,20 +147,17 @@ struct x509_st {
   CRYPTO_EX_DATA ex_data;
   // These contain copies of various extension values
   long ex_pathlen;
-  long ex_pcpathlen;
-  unsigned long ex_flags;
-  unsigned long ex_kusage;
-  unsigned long ex_xkusage;
-  unsigned long ex_nscert;
+  uint32_t ex_flags;
+  uint32_t ex_kusage;
+  uint32_t ex_xkusage;
+  uint32_t ex_nscert;
   ASN1_OCTET_STRING *skid;
   AUTHORITY_KEYID *akid;
-  X509_POLICY_CACHE *policy_cache;
   STACK_OF(DIST_POINT) *crldp;
   STACK_OF(GENERAL_NAME) *altname;
   NAME_CONSTRAINTS *nc;
-  unsigned char sha1_hash[SHA_DIGEST_LENGTH];
+  unsigned char cert_hash[SHA256_DIGEST_LENGTH];
   X509_CERT_AUX *aux;
-  CRYPTO_BUFFER *buf;
   CRYPTO_MUTEX lock;
 } /* X509 */;
 
@@ -170,15 +170,26 @@ typedef struct {
   STACK_OF(X509_ATTRIBUTE) *attributes;  // [ 0 ]
 } X509_REQ_INFO;
 
+// TODO(https://crbug.com/boringssl/407): This is not const because it contains
+// an |X509_NAME|.
 DECLARE_ASN1_FUNCTIONS(X509_REQ_INFO)
 
 struct X509_req_st {
   X509_REQ_INFO *req_info;
   X509_ALGOR *sig_alg;
   ASN1_BIT_STRING *signature;
-  CRYPTO_refcount_t references;
 } /* X509_REQ */;
 
+struct x509_revoked_st {
+  ASN1_INTEGER *serialNumber;
+  ASN1_TIME *revocationDate;
+  STACK_OF(X509_EXTENSION) /* optional */ *extensions;
+  // Set up if indirect CRL
+  STACK_OF(GENERAL_NAME) *issuer;
+  // Revocation reason
+  int reason;
+} /* X509_REVOKED */;
+
 typedef struct {
   ASN1_INTEGER *version;
   X509_ALGOR *sig_alg;
@@ -190,6 +201,8 @@ typedef struct {
   ASN1_ENCODING enc;
 } X509_CRL_INFO;
 
+// TODO(https://crbug.com/boringssl/407): This is not const because it contains
+// an |X509_NAME|.
 DECLARE_ASN1_FUNCTIONS(X509_CRL_INFO)
 
 struct X509_crl_st {
@@ -208,15 +221,13 @@ struct X509_crl_st {
   // CRL and base CRL numbers for delta processing
   ASN1_INTEGER *crl_number;
   ASN1_INTEGER *base_crl_number;
-  unsigned char sha1_hash[SHA_DIGEST_LENGTH];
+  unsigned char crl_hash[SHA256_DIGEST_LENGTH];
   STACK_OF(GENERAL_NAMES) *issuers;
-  const X509_CRL_METHOD *meth;
-  void *meth_data;
 } /* X509_CRL */;
 
 struct X509_VERIFY_PARAM_st {
   char *name;
-  time_t check_time;                // Time to use
+  int64_t check_time;               // POSIX time to use
   unsigned long inh_flags;          // Inheritance flags
   unsigned long flags;              // Various verify flags
   int purpose;                      // purpose to check untrusted certificates
@@ -256,12 +267,6 @@ struct x509_lookup_method_st {
               char **ret);
   int (*get_by_subject)(X509_LOOKUP *ctx, int type, X509_NAME *name,
                         X509_OBJECT *ret);
-  int (*get_by_issuer_serial)(X509_LOOKUP *ctx, int type, X509_NAME *name,
-                              ASN1_INTEGER *serial, X509_OBJECT *ret);
-  int (*get_by_fingerprint)(X509_LOOKUP *ctx, int type, unsigned char *bytes,
-                            int len, X509_OBJECT *ret);
-  int (*get_by_alias)(X509_LOOKUP *ctx, int type, char *str, int len,
-                      X509_OBJECT *ret);
 } /* X509_LOOKUP_METHOD */;
 
 // This is used to hold everything.  It is used for all certificate
@@ -301,7 +306,7 @@ struct x509_lookup_st {
   int init;                    // have we been started
   int skip;                    // don't use us.
   X509_LOOKUP_METHOD *method;  // the functions
-  char *method_data;           // method data
+  void *method_data;           // method data
 
   X509_STORE *store_ctx;  // who owns us
 } /* X509_LOOKUP */;
@@ -339,9 +344,6 @@ struct x509_store_ctx_st {
   int valid;               // if 0, rebuild chain
   int last_untrusted;      // index of last untrusted cert
   STACK_OF(X509) *chain;   // chain of X509s - built up and trusted
-  X509_POLICY_TREE *tree;  // Valid policy tree
-
-  int explicit_policy;  // Require explicit policy value
 
   // When something goes wrong, this is why
   int error_depth;
@@ -358,47 +360,62 @@ struct x509_store_ctx_st {
   CRYPTO_EX_DATA ex_data;
 } /* X509_STORE_CTX */;
 
-ASN1_TYPE *ASN1_generate_v3(const char *str, X509V3_CTX *cnf);
+ASN1_TYPE *ASN1_generate_v3(const char *str, const X509V3_CTX *cnf);
 
+int X509_CERT_AUX_print(BIO *bp, X509_CERT_AUX *x, int indent);
 
-/* RSA-PSS functions. */
 
-/* x509_rsa_pss_to_ctx configures |ctx| for an RSA-PSS operation based on
- * signature algorithm parameters in |sigalg| (which must have type
- * |NID_rsassaPss|) and key |pkey|. It returns one on success and zero on
- * error. */
+// RSA-PSS functions.
+
+// x509_rsa_pss_to_ctx configures |ctx| for an RSA-PSS operation based on
+// signature algorithm parameters in |sigalg| (which must have type
+// |NID_rsassaPss|) and key |pkey|. It returns one on success and zero on
+// error.
 int x509_rsa_pss_to_ctx(EVP_MD_CTX *ctx, const X509_ALGOR *sigalg,
                         EVP_PKEY *pkey);
 
-/* x509_rsa_pss_to_ctx sets |algor| to the signature algorithm parameters for
- * |ctx|, which must have been configured for an RSA-PSS signing operation. It
- * returns one on success and zero on error. */
+// x509_rsa_pss_to_ctx sets |algor| to the signature algorithm parameters for
+// |ctx|, which must have been configured for an RSA-PSS signing operation. It
+// returns one on success and zero on error.
 int x509_rsa_ctx_to_pss(EVP_MD_CTX *ctx, X509_ALGOR *algor);
 
-/* x509_print_rsa_pss_params prints a human-readable representation of RSA-PSS
- * parameters in |sigalg| to |bp|. It returns one on success and zero on
- * error. */
+// x509_print_rsa_pss_params prints a human-readable representation of RSA-PSS
+// parameters in |sigalg| to |bp|. It returns one on success and zero on
+// error.
 int x509_print_rsa_pss_params(BIO *bp, const X509_ALGOR *sigalg, int indent,
                               ASN1_PCTX *pctx);
 
 
-/* Signature algorithm functions. */
+// Signature algorithm functions.
 
-/* x509_digest_sign_algorithm encodes the signing parameters of |ctx| as an
- * AlgorithmIdentifer and saves the result in |algor|. It returns one on
- * success, or zero on error. */
+// x509_digest_sign_algorithm encodes the signing parameters of |ctx| as an
+// AlgorithmIdentifer and saves the result in |algor|. It returns one on
+// success, or zero on error.
 int x509_digest_sign_algorithm(EVP_MD_CTX *ctx, X509_ALGOR *algor);
 
-/* x509_digest_verify_init sets up |ctx| for a signature verification operation
- * with public key |pkey| and parameters from |algor|. The |ctx| argument must
- * have been initialised with |EVP_MD_CTX_init|. It returns one on success, or
- * zero on error. */
+// x509_digest_verify_init sets up |ctx| for a signature verification operation
+// with public key |pkey| and parameters from |algor|. The |ctx| argument must
+// have been initialised with |EVP_MD_CTX_init|. It returns one on success, or
+// zero on error.
 int x509_digest_verify_init(EVP_MD_CTX *ctx, const X509_ALGOR *sigalg,
                             EVP_PKEY *pkey);
 
 
+// Path-building functions.
+
+// X509_policy_check checks certificate policies in |certs|. |user_policies| is
+// the user-initial-policy-set. |flags| is a set of |X509_V_FLAG_*| values to
+// apply. It returns |X509_V_OK| on success and |X509_V_ERR_*| on error. It
+// additionally sets |*out_current_cert| to the certificate where the error
+// occurred. If the function succeeded, or the error applies to the entire
+// chain, it sets |*out_current_cert| to NULL.
+int X509_policy_check(const STACK_OF(X509) *certs,
+                      const STACK_OF(ASN1_OBJECT) *user_policies,
+                      unsigned long flags, X509 **out_current_cert);
+
+
 #if defined(__cplusplus)
-}  /* extern C */
+}  // extern C
 #endif
 
-#endif  /* OPENSSL_HEADER_X509_INTERNAL_H */
+#endif  // OPENSSL_HEADER_X509_INTERNAL_H

data/third_party/boringssl-with-bazel/src/crypto/x509/name_print.c

@@ -64,183 +64,186 @@
 #include <openssl/obj.h>
 
 
-static int maybe_write(BIO *out, const void *buf, int len)
-{
-    /* If |out| is NULL, ignore the output but report the length. */
-    return out == NULL || BIO_write(out, buf, len) == len;
+static int maybe_write(BIO *out, const void *buf, int len) {
+  // If |out| is NULL, ignore the output but report the length.
+  return out == NULL || BIO_write(out, buf, len) == len;
 }
 
-/* do_indent prints |indent| spaces to |out|. */
-static int do_indent(BIO *out, int indent)
-{
-    for (int i = 0; i < indent; i++) {
-        if (!maybe_write(out, " ", 1)) {
-            return 0;
-        }
+// do_indent prints |indent| spaces to |out|.
+static int do_indent(BIO *out, int indent) {
+  for (int i = 0; i < indent; i++) {
+    if (!maybe_write(out, " ", 1)) {
+      return 0;
     }
-    return 1;
+  }
+  return 1;
 }
 
-#define FN_WIDTH_LN     25
-#define FN_WIDTH_SN     10
+#define FN_WIDTH_LN 25
+#define FN_WIDTH_SN 10
 
 static int do_name_ex(BIO *out, const X509_NAME *n, int indent,
-                      unsigned long flags)
-{
-    int i, prev = -1, orflags, cnt;
-    int fn_opt, fn_nid;
-    ASN1_OBJECT *fn;
-    ASN1_STRING *val;
-    X509_NAME_ENTRY *ent;
-    char objtmp[80];
-    const char *objbuf;
-    int outlen, len;
-    const char *sep_dn, *sep_mv, *sep_eq;
-    int sep_dn_len, sep_mv_len, sep_eq_len;
-    if (indent < 0)
-        indent = 0;
-    outlen = indent;
-    if (!do_indent(out, indent))
-        return -1;
-    switch (flags & XN_FLAG_SEP_MASK) {
+                      unsigned long flags) {
+  int i, prev = -1, orflags, cnt;
+  int fn_opt, fn_nid;
+  char objtmp[80];
+  const char *objbuf;
+  int outlen, len;
+  const char *sep_dn, *sep_mv, *sep_eq;
+  int sep_dn_len, sep_mv_len, sep_eq_len;
+  if (indent < 0) {
+    indent = 0;
+  }
+  outlen = indent;
+  if (!do_indent(out, indent)) {
+    return -1;
+  }
+  switch (flags & XN_FLAG_SEP_MASK) {
     case XN_FLAG_SEP_MULTILINE:
-        sep_dn = "\n";
-        sep_dn_len = 1;
-        sep_mv = " + ";
-        sep_mv_len = 3;
-        break;
+      sep_dn = "\n";
+      sep_dn_len = 1;
+      sep_mv = " + ";
+      sep_mv_len = 3;
+      break;
 
     case XN_FLAG_SEP_COMMA_PLUS:
-        sep_dn = ",";
-        sep_dn_len = 1;
-        sep_mv = "+";
-        sep_mv_len = 1;
-        indent = 0;
-        break;
+      sep_dn = ",";
+      sep_dn_len = 1;
+      sep_mv = "+";
+      sep_mv_len = 1;
+      indent = 0;
+      break;
 
     case XN_FLAG_SEP_CPLUS_SPC:
-        sep_dn = ", ";
-        sep_dn_len = 2;
-        sep_mv = " + ";
-        sep_mv_len = 3;
-        indent = 0;
-        break;
+      sep_dn = ", ";
+      sep_dn_len = 2;
+      sep_mv = " + ";
+      sep_mv_len = 3;
+      indent = 0;
+      break;
 
     case XN_FLAG_SEP_SPLUS_SPC:
-        sep_dn = "; ";
-        sep_dn_len = 2;
-        sep_mv = " + ";
-        sep_mv_len = 3;
-        indent = 0;
-        break;
+      sep_dn = "; ";
+      sep_dn_len = 2;
+      sep_mv = " + ";
+      sep_mv_len = 3;
+      indent = 0;
+      break;
 
     default:
+      return -1;
+  }
+
+  if (flags & XN_FLAG_SPC_EQ) {
+    sep_eq = " = ";
+    sep_eq_len = 3;
+  } else {
+    sep_eq = "=";
+    sep_eq_len = 1;
+  }
+
+  fn_opt = flags & XN_FLAG_FN_MASK;
+
+  cnt = X509_NAME_entry_count(n);
+  for (i = 0; i < cnt; i++) {
+    const X509_NAME_ENTRY *ent;
+    if (flags & XN_FLAG_DN_REV) {
+      ent = X509_NAME_get_entry(n, cnt - i - 1);
+    } else {
+      ent = X509_NAME_get_entry(n, i);
+    }
+    if (prev != -1) {
+      if (prev == X509_NAME_ENTRY_set(ent)) {
+        if (!maybe_write(out, sep_mv, sep_mv_len)) {
+          return -1;
+        }
+        outlen += sep_mv_len;
+      } else {
+        if (!maybe_write(out, sep_dn, sep_dn_len)) {
+          return -1;
+        }
+        outlen += sep_dn_len;
+        if (!do_indent(out, indent)) {
+          return -1;
+        }
+        outlen += indent;
+      }
+    }
+    prev = X509_NAME_ENTRY_set(ent);
+    const ASN1_OBJECT *fn = X509_NAME_ENTRY_get_object(ent);
+    const ASN1_STRING *val = X509_NAME_ENTRY_get_data(ent);
+    fn_nid = OBJ_obj2nid(fn);
+    if (fn_opt != XN_FLAG_FN_NONE) {
+      int objlen, fld_len;
+      if ((fn_opt == XN_FLAG_FN_OID) || (fn_nid == NID_undef)) {
+        OBJ_obj2txt(objtmp, sizeof objtmp, fn, 1);
+        fld_len = 0;  // XXX: what should this be?
+        objbuf = objtmp;
+      } else {
+        if (fn_opt == XN_FLAG_FN_SN) {
+          fld_len = FN_WIDTH_SN;
+          objbuf = OBJ_nid2sn(fn_nid);
+        } else if (fn_opt == XN_FLAG_FN_LN) {
+          fld_len = FN_WIDTH_LN;
+          objbuf = OBJ_nid2ln(fn_nid);
+        } else {
+          fld_len = 0;  // XXX: what should this be?
+          objbuf = "";
+        }
+      }
+      objlen = strlen(objbuf);
+      if (!maybe_write(out, objbuf, objlen)) {
+        return -1;
+      }
+      if ((objlen < fld_len) && (flags & XN_FLAG_FN_ALIGN)) {
+        if (!do_indent(out, fld_len - objlen)) {
+          return -1;
+        }
+        outlen += fld_len - objlen;
+      }
+      if (!maybe_write(out, sep_eq, sep_eq_len)) {
         return -1;
+      }
+      outlen += objlen + sep_eq_len;
     }
-
-    if (flags & XN_FLAG_SPC_EQ) {
-        sep_eq = " = ";
-        sep_eq_len = 3;
+    // If the field name is unknown then fix up the DER dump flag. We
+    // might want to limit this further so it will DER dump on anything
+    // other than a few 'standard' fields.
+    if ((fn_nid == NID_undef) && (flags & XN_FLAG_DUMP_UNKNOWN_FIELDS)) {
+      orflags = ASN1_STRFLGS_DUMP_ALL;
     } else {
-        sep_eq = "=";
-        sep_eq_len = 1;
+      orflags = 0;
     }
 
-    fn_opt = flags & XN_FLAG_FN_MASK;
-
-    cnt = X509_NAME_entry_count(n);
-    for (i = 0; i < cnt; i++) {
-        if (flags & XN_FLAG_DN_REV)
-            ent = X509_NAME_get_entry(n, cnt - i - 1);
-        else
-            ent = X509_NAME_get_entry(n, i);
-        if (prev != -1) {
-            if (prev == X509_NAME_ENTRY_set(ent)) {
-                if (!maybe_write(out, sep_mv, sep_mv_len))
-                    return -1;
-                outlen += sep_mv_len;
-            } else {
-                if (!maybe_write(out, sep_dn, sep_dn_len))
-                    return -1;
-                outlen += sep_dn_len;
-                if (!do_indent(out, indent))
-                    return -1;
-                outlen += indent;
-            }
-        }
-        prev = X509_NAME_ENTRY_set(ent);
-        fn = X509_NAME_ENTRY_get_object(ent);
-        val = X509_NAME_ENTRY_get_data(ent);
-        fn_nid = OBJ_obj2nid(fn);
-        if (fn_opt != XN_FLAG_FN_NONE) {
-            int objlen, fld_len;
-            if ((fn_opt == XN_FLAG_FN_OID) || (fn_nid == NID_undef)) {
-                OBJ_obj2txt(objtmp, sizeof objtmp, fn, 1);
-                fld_len = 0;    /* XXX: what should this be? */
-                objbuf = objtmp;
-            } else {
-                if (fn_opt == XN_FLAG_FN_SN) {
-                    fld_len = FN_WIDTH_SN;
-                    objbuf = OBJ_nid2sn(fn_nid);
-                } else if (fn_opt == XN_FLAG_FN_LN) {
-                    fld_len = FN_WIDTH_LN;
-                    objbuf = OBJ_nid2ln(fn_nid);
-                } else {
-                    fld_len = 0; /* XXX: what should this be? */
-                    objbuf = "";
-                }
-            }
-            objlen = strlen(objbuf);
-            if (!maybe_write(out, objbuf, objlen))
-                return -1;
-            if ((objlen < fld_len) && (flags & XN_FLAG_FN_ALIGN)) {
-                if (!do_indent(out, fld_len - objlen))
-                    return -1;
-                outlen += fld_len - objlen;
-            }
-            if (!maybe_write(out, sep_eq, sep_eq_len))
-                return -1;
-            outlen += objlen + sep_eq_len;
-        }
-        /*
-         * If the field name is unknown then fix up the DER dump flag. We
-         * might want to limit this further so it will DER dump on anything
-         * other than a few 'standard' fields.
-         */
-        if ((fn_nid == NID_undef) && (flags & XN_FLAG_DUMP_UNKNOWN_FIELDS))
-            orflags = ASN1_STRFLGS_DUMP_ALL;
-        else
-            orflags = 0;
-
-        len = ASN1_STRING_print_ex(out, val, flags | orflags);
-        if (len < 0)
-            return -1;
-        outlen += len;
+    len = ASN1_STRING_print_ex(out, val, flags | orflags);
+    if (len < 0) {
+      return -1;
     }
-    return outlen;
+    outlen += len;
+  }
+  return outlen;
 }
 
 int X509_NAME_print_ex(BIO *out, const X509_NAME *nm, int indent,
-                       unsigned long flags)
-{
-    if (flags == XN_FLAG_COMPAT)
-        return X509_NAME_print(out, nm, indent);
-    return do_name_ex(out, nm, indent, flags);
+                       unsigned long flags) {
+  if (flags == XN_FLAG_COMPAT) {
+    return X509_NAME_print(out, nm, indent);
+  }
+  return do_name_ex(out, nm, indent, flags);
 }
 
 int X509_NAME_print_ex_fp(FILE *fp, const X509_NAME *nm, int indent,
-                          unsigned long flags)
-{
-    BIO *bio = NULL;
-    if (fp != NULL) {
-        /* If |fp| is NULL, this function returns the number of bytes without
-         * writing. */
-        bio = BIO_new_fp(fp, BIO_NOCLOSE);
-        if (bio == NULL) {
-            return -1;
-        }
+                          unsigned long flags) {
+  BIO *bio = NULL;
+  if (fp != NULL) {
+    // If |fp| is NULL, this function returns the number of bytes without
+    // writing.
+    bio = BIO_new_fp(fp, BIO_NOCLOSE);
+    if (bio == NULL) {
+      return -1;
     }
-    int ret = X509_NAME_print_ex(bio, nm, indent, flags);
-    BIO_free(bio);
-    return ret;
+  }
+  int ret = X509_NAME_print_ex(bio, nm, indent, flags);
+  BIO_free(bio);
+  return ret;
 }