grpc 1.53.2 → 1.54.0

data/third_party/boringssl-with-bazel/src/crypto/x509/x_pkey.c

@@ -66,41 +66,46 @@
 #include "../internal.h"
 
 
-X509_PKEY *X509_PKEY_new(void)
-{
-    X509_PKEY *ret = OPENSSL_malloc(sizeof(X509_PKEY));
-    if (ret == NULL) {
-        OPENSSL_PUT_ERROR(X509, ERR_R_MALLOC_FAILURE);
-        goto err;
-    }
-    OPENSSL_memset(ret, 0, sizeof(X509_PKEY));
+X509_PKEY *X509_PKEY_new(void) {
+  X509_PKEY *ret = OPENSSL_malloc(sizeof(X509_PKEY));
+  if (ret == NULL) {
+    goto err;
+  }
+  OPENSSL_memset(ret, 0, sizeof(X509_PKEY));
 
-    ret->enc_algor = X509_ALGOR_new();
-    if (ret->enc_algor == NULL)
-        goto err;
-    ret->enc_pkey = ASN1_OCTET_STRING_new();
-    if (ret->enc_pkey == NULL)
-        goto err;
-    return ret;
+  ret->enc_algor = X509_ALGOR_new();
+  if (ret->enc_algor == NULL) {
+    goto err;
+  }
+  ret->enc_pkey = ASN1_OCTET_STRING_new();
+  if (ret->enc_pkey == NULL) {
+    goto err;
+  }
+  return ret;
 
- err:
-    if (ret != NULL)
-        X509_PKEY_free(ret);
-    return NULL;
+err:
+  if (ret != NULL) {
+    X509_PKEY_free(ret);
+  }
+  return NULL;
 }
 
-void X509_PKEY_free(X509_PKEY *x)
-{
-    if (x == NULL)
-        return;
+void X509_PKEY_free(X509_PKEY *x) {
+  if (x == NULL) {
+    return;
+  }
 
-    if (x->enc_algor != NULL)
-        X509_ALGOR_free(x->enc_algor);
-    if (x->enc_pkey != NULL)
-        ASN1_OCTET_STRING_free(x->enc_pkey);
-    if (x->dec_pkey != NULL)
-        EVP_PKEY_free(x->dec_pkey);
-    if ((x->key_data != NULL) && (x->key_free))
-        OPENSSL_free(x->key_data);
-    OPENSSL_free(x);
+  if (x->enc_algor != NULL) {
+    X509_ALGOR_free(x->enc_algor);
+  }
+  if (x->enc_pkey != NULL) {
+    ASN1_OCTET_STRING_free(x->enc_pkey);
+  }
+  if (x->dec_pkey != NULL) {
+    EVP_PKEY_free(x->dec_pkey);
+  }
+  if ((x->key_data != NULL) && (x->key_free)) {
+    OPENSSL_free(x->key_data);
+  }
+  OPENSSL_free(x);
 }

data/third_party/boringssl-with-bazel/src/crypto/x509/x_pubkey.c

@@ -70,148 +70,145 @@
 #include "../internal.h"
 #include "internal.h"
 
-/* Minor tweak to operation: free up EVP_PKEY */
+// Minor tweak to operation: free up EVP_PKEY
 static int pubkey_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,
-                     void *exarg)
-{
-    if (operation == ASN1_OP_FREE_POST) {
-        X509_PUBKEY *pubkey = (X509_PUBKEY *)*pval;
-        EVP_PKEY_free(pubkey->pkey);
-    }
-    return 1;
+                     void *exarg) {
+  if (operation == ASN1_OP_FREE_POST) {
+    X509_PUBKEY *pubkey = (X509_PUBKEY *)*pval;
+    EVP_PKEY_free(pubkey->pkey);
+  }
+  return 1;
 }
 
 ASN1_SEQUENCE_cb(X509_PUBKEY, pubkey_cb) = {
-        ASN1_SIMPLE(X509_PUBKEY, algor, X509_ALGOR),
-        ASN1_SIMPLE(X509_PUBKEY, public_key, ASN1_BIT_STRING)
+    ASN1_SIMPLE(X509_PUBKEY, algor, X509_ALGOR),
+    ASN1_SIMPLE(X509_PUBKEY, public_key, ASN1_BIT_STRING),
 } ASN1_SEQUENCE_END_cb(X509_PUBKEY, X509_PUBKEY)
 
-IMPLEMENT_ASN1_FUNCTIONS(X509_PUBKEY)
-
-int X509_PUBKEY_set(X509_PUBKEY **x, EVP_PKEY *pkey)
-{
-    X509_PUBKEY *pk = NULL;
-    uint8_t *spki = NULL;
-    size_t spki_len;
-
-    if (x == NULL)
-        return (0);
-
-    CBB cbb;
-    if (!CBB_init(&cbb, 0) ||
-        !EVP_marshal_public_key(&cbb, pkey) ||
-        !CBB_finish(&cbb, &spki, &spki_len) ||
-        spki_len > LONG_MAX) {
-        CBB_cleanup(&cbb);
-        OPENSSL_PUT_ERROR(X509, X509_R_PUBLIC_KEY_ENCODE_ERROR);
-        goto error;
-    }
-
-    const uint8_t *p = spki;
-    pk = d2i_X509_PUBKEY(NULL, &p, (long)spki_len);
-    if (pk == NULL || p != spki + spki_len) {
-        OPENSSL_PUT_ERROR(X509, X509_R_PUBLIC_KEY_DECODE_ERROR);
-        goto error;
-    }
-
-    OPENSSL_free(spki);
-    X509_PUBKEY_free(*x);
-    *x = pk;
-
-    return 1;
- error:
-    X509_PUBKEY_free(pk);
-    OPENSSL_free(spki);
+IMPLEMENT_ASN1_FUNCTIONS_const(X509_PUBKEY)
+
+int X509_PUBKEY_set(X509_PUBKEY **x, EVP_PKEY *pkey) {
+  X509_PUBKEY *pk = NULL;
+  uint8_t *spki = NULL;
+  size_t spki_len;
+
+  if (x == NULL) {
     return 0;
+  }
+
+  CBB cbb;
+  if (!CBB_init(&cbb, 0) ||  //
+      !EVP_marshal_public_key(&cbb, pkey) ||
+      !CBB_finish(&cbb, &spki, &spki_len) ||  //
+      spki_len > LONG_MAX) {
+    CBB_cleanup(&cbb);
+    OPENSSL_PUT_ERROR(X509, X509_R_PUBLIC_KEY_ENCODE_ERROR);
+    goto error;
+  }
+
+  const uint8_t *p = spki;
+  pk = d2i_X509_PUBKEY(NULL, &p, (long)spki_len);
+  if (pk == NULL || p != spki + spki_len) {
+    OPENSSL_PUT_ERROR(X509, X509_R_PUBLIC_KEY_DECODE_ERROR);
+    goto error;
+  }
+
+  OPENSSL_free(spki);
+  X509_PUBKEY_free(*x);
+  *x = pk;
+
+  return 1;
+error:
+  X509_PUBKEY_free(pk);
+  OPENSSL_free(spki);
+  return 0;
 }
 
-/* g_pubkey_lock is used to protect the initialisation of the |pkey| member of
- * |X509_PUBKEY| objects. Really |X509_PUBKEY| should have a |CRYPTO_once_t|
- * inside it for this, but |CRYPTO_once_t| is private and |X509_PUBKEY| is
- * not. */
+// g_pubkey_lock is used to protect the initialisation of the |pkey| member of
+// |X509_PUBKEY| objects. Really |X509_PUBKEY| should have a |CRYPTO_once_t|
+// inside it for this, but |CRYPTO_once_t| is private and |X509_PUBKEY| is
+// not.
 static struct CRYPTO_STATIC_MUTEX g_pubkey_lock = CRYPTO_STATIC_MUTEX_INIT;
 
-EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key)
-{
-    EVP_PKEY *ret = NULL;
-    uint8_t *spki = NULL;
+EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key) {
+  EVP_PKEY *ret = NULL;
+  uint8_t *spki = NULL;
 
-    if (key == NULL)
-        goto error;
+  if (key == NULL) {
+    goto error;
+  }
 
-    CRYPTO_STATIC_MUTEX_lock_read(&g_pubkey_lock);
-    if (key->pkey != NULL) {
-        CRYPTO_STATIC_MUTEX_unlock_read(&g_pubkey_lock);
-        EVP_PKEY_up_ref(key->pkey);
-        return key->pkey;
-    }
+  CRYPTO_STATIC_MUTEX_lock_read(&g_pubkey_lock);
+  if (key->pkey != NULL) {
     CRYPTO_STATIC_MUTEX_unlock_read(&g_pubkey_lock);
-
-    /* Re-encode the |X509_PUBKEY| to DER and parse it. */
-    int spki_len = i2d_X509_PUBKEY(key, &spki);
-    if (spki_len < 0) {
-        goto error;
-    }
-    CBS cbs;
-    CBS_init(&cbs, spki, (size_t)spki_len);
-    ret = EVP_parse_public_key(&cbs);
-    if (ret == NULL || CBS_len(&cbs) != 0) {
-        OPENSSL_PUT_ERROR(X509, X509_R_PUBLIC_KEY_DECODE_ERROR);
-        goto error;
-    }
-
-    /* Check to see if another thread set key->pkey first */
-    CRYPTO_STATIC_MUTEX_lock_write(&g_pubkey_lock);
-    if (key->pkey) {
-        CRYPTO_STATIC_MUTEX_unlock_write(&g_pubkey_lock);
-        EVP_PKEY_free(ret);
-        ret = key->pkey;
-    } else {
-        key->pkey = ret;
-        CRYPTO_STATIC_MUTEX_unlock_write(&g_pubkey_lock);
-    }
-
-    OPENSSL_free(spki);
-    EVP_PKEY_up_ref(ret);
-    return ret;
-
- error:
-    OPENSSL_free(spki);
+    EVP_PKEY_up_ref(key->pkey);
+    return key->pkey;
+  }
+  CRYPTO_STATIC_MUTEX_unlock_read(&g_pubkey_lock);
+
+  // Re-encode the |X509_PUBKEY| to DER and parse it.
+  int spki_len = i2d_X509_PUBKEY(key, &spki);
+  if (spki_len < 0) {
+    goto error;
+  }
+  CBS cbs;
+  CBS_init(&cbs, spki, (size_t)spki_len);
+  ret = EVP_parse_public_key(&cbs);
+  if (ret == NULL || CBS_len(&cbs) != 0) {
+    OPENSSL_PUT_ERROR(X509, X509_R_PUBLIC_KEY_DECODE_ERROR);
+    goto error;
+  }
+
+  // Check to see if another thread set key->pkey first
+  CRYPTO_STATIC_MUTEX_lock_write(&g_pubkey_lock);
+  if (key->pkey) {
+    CRYPTO_STATIC_MUTEX_unlock_write(&g_pubkey_lock);
     EVP_PKEY_free(ret);
-    return NULL;
+    ret = key->pkey;
+  } else {
+    key->pkey = ret;
+    CRYPTO_STATIC_MUTEX_unlock_write(&g_pubkey_lock);
+  }
+
+  OPENSSL_free(spki);
+  EVP_PKEY_up_ref(ret);
+  return ret;
+
+error:
+  OPENSSL_free(spki);
+  EVP_PKEY_free(ret);
+  return NULL;
 }
 
 int X509_PUBKEY_set0_param(X509_PUBKEY *pub, ASN1_OBJECT *obj, int param_type,
-                           void *param_value, uint8_t *key, int key_len)
-{
-    if (!X509_ALGOR_set0(pub->algor, obj, param_type, param_value)) {
-        return 0;
-    }
-
-    ASN1_STRING_set0(pub->public_key, key, key_len);
-    /* Set the number of unused bits to zero. */
-    pub->public_key->flags &= ~(ASN1_STRING_FLAG_BITS_LEFT | 0x07);
-    pub->public_key->flags |= ASN1_STRING_FLAG_BITS_LEFT;
-    return 1;
+                           void *param_value, uint8_t *key, int key_len) {
+  if (!X509_ALGOR_set0(pub->algor, obj, param_type, param_value)) {
+    return 0;
+  }
+
+  ASN1_STRING_set0(pub->public_key, key, key_len);
+  // Set the number of unused bits to zero.
+  pub->public_key->flags &= ~(ASN1_STRING_FLAG_BITS_LEFT | 0x07);
+  pub->public_key->flags |= ASN1_STRING_FLAG_BITS_LEFT;
+  return 1;
 }
 
 int X509_PUBKEY_get0_param(ASN1_OBJECT **out_obj, const uint8_t **out_key,
                            int *out_key_len, X509_ALGOR **out_alg,
-                           X509_PUBKEY *pub)
-{
-    if (out_obj != NULL) {
-        *out_obj = pub->algor->algorithm;
-    }
-    if (out_key != NULL) {
-        *out_key = pub->public_key->data;
-        *out_key_len = pub->public_key->length;
-    }
-    if (out_alg != NULL) {
-        *out_alg = pub->algor;
-    }
-    return 1;
+                           X509_PUBKEY *pub) {
+  if (out_obj != NULL) {
+    *out_obj = pub->algor->algorithm;
+  }
+  if (out_key != NULL) {
+    *out_key = pub->public_key->data;
+    *out_key_len = pub->public_key->length;
+  }
+  if (out_alg != NULL) {
+    *out_alg = pub->algor;
+  }
+  return 1;
 }
 
 const ASN1_BIT_STRING *X509_PUBKEY_get0_public_key(const X509_PUBKEY *pub) {
-    return pub->public_key;
+  return pub->public_key;
 }

data/third_party/boringssl-with-bazel/src/crypto/x509/x_req.c

@@ -63,43 +63,53 @@
 #include "internal.h"
 
 
-/*
- * X509_REQ_INFO is handled in an unusual way to get round invalid encodings.
- * Some broken certificate requests don't encode the attributes field if it
- * is empty. This is in violation of PKCS#10 but we need to tolerate it. We
- * do this by making the attributes field OPTIONAL then using the callback to
- * initialise it to an empty STACK. This means that the field will be
- * correctly encoded unless we NULL out the field.
- */
+// X509_REQ_INFO is handled in an unusual way to get round invalid encodings.
+// Some broken certificate requests don't encode the attributes field if it
+// is empty. This is in violation of PKCS#10 but we need to tolerate it. We
+// do this by making the attributes field OPTIONAL then using the callback to
+// initialise it to an empty STACK. This means that the field will be
+// correctly encoded unless we NULL out the field.
 
 static int rinf_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,
-                   void *exarg)
-{
-    X509_REQ_INFO *rinf = (X509_REQ_INFO *)*pval;
+                   void *exarg) {
+  X509_REQ_INFO *rinf = (X509_REQ_INFO *)*pval;
 
-    if (operation == ASN1_OP_NEW_POST) {
-        rinf->attributes = sk_X509_ATTRIBUTE_new_null();
-        if (!rinf->attributes)
-            return 0;
+  if (operation == ASN1_OP_NEW_POST) {
+    rinf->attributes = sk_X509_ATTRIBUTE_new_null();
+    if (!rinf->attributes) {
+      return 0;
     }
-    return 1;
+  }
+
+  if (operation == ASN1_OP_D2I_POST) {
+    // The only defined CSR version is v1(0). For compatibility, we also accept
+    // a hypothetical v3(2). Although not defined, older versions of certbot
+    // use it. See https://github.com/certbot/certbot/pull/9334.
+    long version = ASN1_INTEGER_get(rinf->version);
+    if (version != X509_REQ_VERSION_1 && version != 2) {
+      OPENSSL_PUT_ERROR(X509, X509_R_INVALID_VERSION);
+      return 0;
+    }
+  }
+
+  return 1;
 }
 
 ASN1_SEQUENCE_enc(X509_REQ_INFO, enc, rinf_cb) = {
-        ASN1_SIMPLE(X509_REQ_INFO, version, ASN1_INTEGER),
-        ASN1_SIMPLE(X509_REQ_INFO, subject, X509_NAME),
-        ASN1_SIMPLE(X509_REQ_INFO, pubkey, X509_PUBKEY),
-        /* This isn't really OPTIONAL but it gets around invalid encodings. */
-        ASN1_IMP_SET_OF_OPT(X509_REQ_INFO, attributes, X509_ATTRIBUTE, 0)
+    ASN1_SIMPLE(X509_REQ_INFO, version, ASN1_INTEGER),
+    ASN1_SIMPLE(X509_REQ_INFO, subject, X509_NAME),
+    ASN1_SIMPLE(X509_REQ_INFO, pubkey, X509_PUBKEY),
+    // This isn't really OPTIONAL but it gets around invalid encodings.
+    ASN1_IMP_SET_OF_OPT(X509_REQ_INFO, attributes, X509_ATTRIBUTE, 0),
 } ASN1_SEQUENCE_END_enc(X509_REQ_INFO, X509_REQ_INFO)
 
 IMPLEMENT_ASN1_FUNCTIONS(X509_REQ_INFO)
 
-ASN1_SEQUENCE_ref(X509_REQ, 0) = {
-        ASN1_SIMPLE(X509_REQ, req_info, X509_REQ_INFO),
-        ASN1_SIMPLE(X509_REQ, sig_alg, X509_ALGOR),
-        ASN1_SIMPLE(X509_REQ, signature, ASN1_BIT_STRING)
-} ASN1_SEQUENCE_END_ref(X509_REQ, X509_REQ)
+ASN1_SEQUENCE(X509_REQ) = {
+    ASN1_SIMPLE(X509_REQ, req_info, X509_REQ_INFO),
+    ASN1_SIMPLE(X509_REQ, sig_alg, X509_ALGOR),
+    ASN1_SIMPLE(X509_REQ, signature, ASN1_BIT_STRING),
+} ASN1_SEQUENCE_END(X509_REQ)
 
 IMPLEMENT_ASN1_FUNCTIONS(X509_REQ)
 

data/third_party/boringssl-with-bazel/src/crypto/x509/x_sig.c

@@ -1,4 +1,3 @@
-/* crypto/asn1/x_sig.c */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -67,11 +66,11 @@ struct X509_sig_st {
 } /* X509_SIG */;
 
 ASN1_SEQUENCE(X509_SIG) = {
-        ASN1_SIMPLE(X509_SIG, algor, X509_ALGOR),
-        ASN1_SIMPLE(X509_SIG, digest, ASN1_OCTET_STRING)
+    ASN1_SIMPLE(X509_SIG, algor, X509_ALGOR),
+    ASN1_SIMPLE(X509_SIG, digest, ASN1_OCTET_STRING),
 } ASN1_SEQUENCE_END(X509_SIG)
 
-IMPLEMENT_ASN1_FUNCTIONS(X509_SIG)
+IMPLEMENT_ASN1_FUNCTIONS_const(X509_SIG)
 
 void X509_SIG_get0(const X509_SIG *sig, const X509_ALGOR **out_alg,
                    const ASN1_OCTET_STRING **out_digest) {

data/third_party/boringssl-with-bazel/src/crypto/x509/x_spki.c

@@ -1,4 +1,3 @@
-/* crypto/asn1/x_spki.c */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -55,26 +54,24 @@
  * copied and put under another distribution licence
  * [including the GNU Public Licence.] */
 
- /*
-  * This module was send to me my Pat Richards <patr@x509.com> who wrote it.
-  * It is under my Copyright with his permission.
-  */
+// This module was send to me my Pat Richards <patr@x509.com> who wrote it.
+// It is under my Copyright with his permission.
 
-#include <openssl/x509.h>
 #include <openssl/asn1t.h>
+#include <openssl/x509.h>
 
 
 ASN1_SEQUENCE(NETSCAPE_SPKAC) = {
-        ASN1_SIMPLE(NETSCAPE_SPKAC, pubkey, X509_PUBKEY),
-        ASN1_SIMPLE(NETSCAPE_SPKAC, challenge, ASN1_IA5STRING)
+    ASN1_SIMPLE(NETSCAPE_SPKAC, pubkey, X509_PUBKEY),
+    ASN1_SIMPLE(NETSCAPE_SPKAC, challenge, ASN1_IA5STRING),
 } ASN1_SEQUENCE_END(NETSCAPE_SPKAC)
 
-IMPLEMENT_ASN1_FUNCTIONS(NETSCAPE_SPKAC)
+IMPLEMENT_ASN1_FUNCTIONS_const(NETSCAPE_SPKAC)
 
 ASN1_SEQUENCE(NETSCAPE_SPKI) = {
-        ASN1_SIMPLE(NETSCAPE_SPKI, spkac, NETSCAPE_SPKAC),
-        ASN1_SIMPLE(NETSCAPE_SPKI, sig_algor, X509_ALGOR),
-        ASN1_SIMPLE(NETSCAPE_SPKI, signature, ASN1_BIT_STRING)
+    ASN1_SIMPLE(NETSCAPE_SPKI, spkac, NETSCAPE_SPKAC),
+    ASN1_SIMPLE(NETSCAPE_SPKI, sig_algor, X509_ALGOR),
+    ASN1_SIMPLE(NETSCAPE_SPKI, signature, ASN1_BIT_STRING),
 } ASN1_SEQUENCE_END(NETSCAPE_SPKI)
 
-IMPLEMENT_ASN1_FUNCTIONS(NETSCAPE_SPKI)
+IMPLEMENT_ASN1_FUNCTIONS_const(NETSCAPE_SPKI)

data/third_party/boringssl-with-bazel/src/crypto/x509/x_val.c

@@ -1,4 +1,3 @@
-/* crypto/asn1/x_val.c */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -64,8 +63,8 @@
 
 
 ASN1_SEQUENCE(X509_VAL) = {
-        ASN1_SIMPLE(X509_VAL, notBefore, ASN1_TIME),
-        ASN1_SIMPLE(X509_VAL, notAfter, ASN1_TIME)
+    ASN1_SIMPLE(X509_VAL, notBefore, ASN1_TIME),
+    ASN1_SIMPLE(X509_VAL, notAfter, ASN1_TIME),
 } ASN1_SEQUENCE_END(X509_VAL)
 
-IMPLEMENT_ASN1_FUNCTIONS(X509_VAL)
+IMPLEMENT_ASN1_FUNCTIONS_const(X509_VAL)