grpc 1.53.2 → 1.54.0

data/third_party/boringssl-with-bazel/src/crypto/asn1/a_strnid.c

@@ -74,68 +74,55 @@ DEFINE_LHASH_OF(ASN1_STRING_TABLE)
 static LHASH_OF(ASN1_STRING_TABLE) *string_tables = NULL;
 static struct CRYPTO_STATIC_MUTEX string_tables_lock = CRYPTO_STATIC_MUTEX_INIT;
 
-void ASN1_STRING_set_default_mask(unsigned long mask)
-{
-}
+void ASN1_STRING_set_default_mask(unsigned long mask) {}
 
-unsigned long ASN1_STRING_get_default_mask(void)
-{
-    return B_ASN1_UTF8STRING;
-}
+unsigned long ASN1_STRING_get_default_mask(void) { return B_ASN1_UTF8STRING; }
 
-int ASN1_STRING_set_default_mask_asc(const char *p)
-{
-    return 1;
-}
+int ASN1_STRING_set_default_mask_asc(const char *p) { return 1; }
 
 static const ASN1_STRING_TABLE *asn1_string_table_get(int nid);
 
-/*
- * The following function generates an ASN1_STRING based on limits in a
- * table. Frequently the types and length of an ASN1_STRING are restricted by
- * a corresponding OID. For example certificates and certificate requests.
- */
+// The following function generates an ASN1_STRING based on limits in a
+// table. Frequently the types and length of an ASN1_STRING are restricted by
+// a corresponding OID. For example certificates and certificate requests.
 
 ASN1_STRING *ASN1_STRING_set_by_NID(ASN1_STRING **out, const unsigned char *in,
-                                    int len, int inform, int nid)
-{
-    ASN1_STRING *str = NULL;
-    int ret;
-    if (!out) {
-        out = &str;
-    }
-    const ASN1_STRING_TABLE *tbl = asn1_string_table_get(nid);
-    if (tbl != NULL) {
-        unsigned long mask = tbl->mask;
-        if (!(tbl->flags & STABLE_NO_MASK)) {
-            mask &= B_ASN1_UTF8STRING;
-        }
-        ret = ASN1_mbstring_ncopy(out, in, len, inform, mask, tbl->minsize,
-                                  tbl->maxsize);
-    } else {
-        ret = ASN1_mbstring_copy(out, in, len, inform, B_ASN1_UTF8STRING);
-    }
-    if (ret <= 0) {
-        return NULL;
+                                    int len, int inform, int nid) {
+  ASN1_STRING *str = NULL;
+  int ret;
+  if (!out) {
+    out = &str;
+  }
+  const ASN1_STRING_TABLE *tbl = asn1_string_table_get(nid);
+  if (tbl != NULL) {
+    unsigned long mask = tbl->mask;
+    if (!(tbl->flags & STABLE_NO_MASK)) {
+      mask &= B_ASN1_UTF8STRING;
     }
-    return *out;
+    ret = ASN1_mbstring_ncopy(out, in, len, inform, mask, tbl->minsize,
+                              tbl->maxsize);
+  } else {
+    ret = ASN1_mbstring_copy(out, in, len, inform, B_ASN1_UTF8STRING);
+  }
+  if (ret <= 0) {
+    return NULL;
+  }
+  return *out;
 }
 
-/*
- * Now the tables and helper functions for the string table:
- */
+// Now the tables and helper functions for the string table:
 
-/* See RFC 5280. */
-#define ub_name                         32768
-#define ub_common_name                  64
-#define ub_locality_name                128
-#define ub_state_name                   128
-#define ub_organization_name            64
-#define ub_organization_unit_name       64
-#define ub_email_address                128
-#define ub_serial_number                64
+// See RFC 5280.
+#define ub_name 32768
+#define ub_common_name 64
+#define ub_locality_name 128
+#define ub_state_name 128
+#define ub_organization_name 64
+#define ub_organization_unit_name 64
+#define ub_email_address 128
+#define ub_serial_number 64
 
-/* This table must be kept in NID order */
+// This table must be kept in NID order
 
 static const ASN1_STRING_TABLE tbl_standard[] = {
     {NID_commonName, 1, ub_common_name, DIRSTRING_TYPE, 0},
@@ -159,108 +146,100 @@ static const ASN1_STRING_TABLE tbl_standard[] = {
     {NID_name, 1, ub_name, DIRSTRING_TYPE, 0},
     {NID_dnQualifier, -1, -1, B_ASN1_PRINTABLESTRING, STABLE_NO_MASK},
     {NID_domainComponent, 1, -1, B_ASN1_IA5STRING, STABLE_NO_MASK},
-    {NID_ms_csp_name, -1, -1, B_ASN1_BMPSTRING, STABLE_NO_MASK}
-};
+    {NID_ms_csp_name, -1, -1, B_ASN1_BMPSTRING, STABLE_NO_MASK}};
 
-static int table_cmp(const ASN1_STRING_TABLE *a, const ASN1_STRING_TABLE *b)
-{
-    if (a->nid < b->nid) {
-        return -1;
-    }
-    if (a->nid > b->nid) {
-        return 1;
-    }
-    return 0;
+static int table_cmp(const ASN1_STRING_TABLE *a, const ASN1_STRING_TABLE *b) {
+  if (a->nid < b->nid) {
+    return -1;
+  }
+  if (a->nid > b->nid) {
+    return 1;
+  }
+  return 0;
 }
 
-static int table_cmp_void(const void *a, const void *b)
-{
-    return table_cmp(a, b);
+static int table_cmp_void(const void *a, const void *b) {
+  return table_cmp(a, b);
 }
 
-static uint32_t table_hash(const ASN1_STRING_TABLE *tbl)
-{
-    return OPENSSL_hash32(&tbl->nid, sizeof(tbl->nid));   
+static uint32_t table_hash(const ASN1_STRING_TABLE *tbl) {
+  return OPENSSL_hash32(&tbl->nid, sizeof(tbl->nid));
 }
 
-static const ASN1_STRING_TABLE *asn1_string_table_get(int nid)
-{
-    ASN1_STRING_TABLE key;
-    key.nid = nid;
-    const ASN1_STRING_TABLE *tbl =
-        bsearch(&key, tbl_standard, OPENSSL_ARRAY_SIZE(tbl_standard),
-                sizeof(ASN1_STRING_TABLE), table_cmp_void);
-    if (tbl != NULL) {
-        return tbl;
-    }
-
-    CRYPTO_STATIC_MUTEX_lock_read(&string_tables_lock);
-    if (string_tables != NULL) {
-        tbl = lh_ASN1_STRING_TABLE_retrieve(string_tables, &key);
-    }
-    CRYPTO_STATIC_MUTEX_unlock_read(&string_tables_lock);
-    /* Note returning |tbl| without the lock is only safe because
-     * |ASN1_STRING_TABLE_add| cannot modify or delete existing entries. If we
-     * wish to support that, this function must copy the result under a lock. */
+static const ASN1_STRING_TABLE *asn1_string_table_get(int nid) {
+  ASN1_STRING_TABLE key;
+  key.nid = nid;
+  const ASN1_STRING_TABLE *tbl =
+      bsearch(&key, tbl_standard, OPENSSL_ARRAY_SIZE(tbl_standard),
+              sizeof(ASN1_STRING_TABLE), table_cmp_void);
+  if (tbl != NULL) {
     return tbl;
+  }
+
+  CRYPTO_STATIC_MUTEX_lock_read(&string_tables_lock);
+  if (string_tables != NULL) {
+    tbl = lh_ASN1_STRING_TABLE_retrieve(string_tables, &key);
+  }
+  CRYPTO_STATIC_MUTEX_unlock_read(&string_tables_lock);
+  // Note returning |tbl| without the lock is only safe because
+  // |ASN1_STRING_TABLE_add| cannot modify or delete existing entries. If we
+  // wish to support that, this function must copy the result under a lock.
+  return tbl;
 }
 
 int ASN1_STRING_TABLE_add(int nid, long minsize, long maxsize,
-                          unsigned long mask, unsigned long flags)
-{
-    /* Existing entries cannot be overwritten. */
-    if (asn1_string_table_get(nid) != NULL) {
-        OPENSSL_PUT_ERROR(ASN1, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
-        return 0;
-    }
+                          unsigned long mask, unsigned long flags) {
+  // Existing entries cannot be overwritten.
+  if (asn1_string_table_get(nid) != NULL) {
+    OPENSSL_PUT_ERROR(ASN1, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+    return 0;
+  }
 
-    int ret = 0;
-    CRYPTO_STATIC_MUTEX_lock_write(&string_tables_lock);
+  int ret = 0;
+  CRYPTO_STATIC_MUTEX_lock_write(&string_tables_lock);
 
+  if (string_tables == NULL) {
+    string_tables = lh_ASN1_STRING_TABLE_new(table_hash, table_cmp);
     if (string_tables == NULL) {
-        string_tables = lh_ASN1_STRING_TABLE_new(table_hash, table_cmp);
-        if (string_tables == NULL) {
-            goto err;
-        }
-    } else {
-        /* Check again for an existing entry. One may have been added while
-         * unlocked. */
-        ASN1_STRING_TABLE key;
-        key.nid = nid;
-        if (lh_ASN1_STRING_TABLE_retrieve(string_tables, &key) != NULL) {
-            OPENSSL_PUT_ERROR(ASN1, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
-            goto err;
-        }
+      goto err;
     }
-
-    ASN1_STRING_TABLE *tbl = OPENSSL_malloc(sizeof(ASN1_STRING_TABLE));
-    if (tbl == NULL) {
-        goto err;
-    }
-    tbl->nid = nid;
-    tbl->flags = flags;
-    tbl->minsize = minsize;
-    tbl->maxsize = maxsize;
-    tbl->mask = mask;
-    ASN1_STRING_TABLE *old_tbl;
-    if (!lh_ASN1_STRING_TABLE_insert(string_tables, &old_tbl, tbl)) {
-        OPENSSL_free(tbl);
-        goto err;
+  } else {
+    // Check again for an existing entry. One may have been added while
+    // unlocked.
+    ASN1_STRING_TABLE key;
+    key.nid = nid;
+    if (lh_ASN1_STRING_TABLE_retrieve(string_tables, &key) != NULL) {
+      OPENSSL_PUT_ERROR(ASN1, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+      goto err;
     }
-    assert(old_tbl == NULL);
-    ret = 1;
+  }
+
+  ASN1_STRING_TABLE *tbl = OPENSSL_malloc(sizeof(ASN1_STRING_TABLE));
+  if (tbl == NULL) {
+    goto err;
+  }
+  tbl->nid = nid;
+  tbl->flags = flags;
+  tbl->minsize = minsize;
+  tbl->maxsize = maxsize;
+  tbl->mask = mask;
+  ASN1_STRING_TABLE *old_tbl;
+  if (!lh_ASN1_STRING_TABLE_insert(string_tables, &old_tbl, tbl)) {
+    OPENSSL_free(tbl);
+    goto err;
+  }
+  assert(old_tbl == NULL);
+  ret = 1;
 
 err:
-    CRYPTO_STATIC_MUTEX_unlock_write(&string_tables_lock);
-    return ret;
+  CRYPTO_STATIC_MUTEX_unlock_write(&string_tables_lock);
+  return ret;
 }
 
-void ASN1_STRING_TABLE_cleanup(void)
-{
-}
+void ASN1_STRING_TABLE_cleanup(void) {}
 
 void asn1_get_string_table_for_testing(const ASN1_STRING_TABLE **out_ptr,
                                        size_t *out_len) {
-    *out_ptr = tbl_standard;
-    *out_len = OPENSSL_ARRAY_SIZE(tbl_standard);
+  *out_ptr = tbl_standard;
+  *out_len = OPENSSL_ARRAY_SIZE(tbl_standard);
 }

data/third_party/boringssl-with-bazel/src/crypto/asn1/a_time.c

@@ -55,6 +55,7 @@
  * [including the GNU Public Licence.] */
 
 #include <openssl/asn1.h>
+#include <openssl/time.h>
 
 #include <string.h>
 #include <time.h>
@@ -65,148 +66,161 @@
 
 #include "internal.h"
 
-/*
- * This is an implementation of the ASN1 Time structure which is: Time ::=
- * CHOICE { utcTime UTCTime, generalTime GeneralizedTime } written by Steve
- * Henson.
- */
+// This is an implementation of the ASN1 Time structure which is: Time ::=
+// CHOICE { utcTime UTCTime, generalTime GeneralizedTime } written by Steve
+// Henson.
 
 IMPLEMENT_ASN1_MSTRING(ASN1_TIME, B_ASN1_TIME)
 
 IMPLEMENT_ASN1_FUNCTIONS_const(ASN1_TIME)
 
-ASN1_TIME *ASN1_TIME_set(ASN1_TIME *s, time_t t)
-{
-    return ASN1_TIME_adj(s, t, 0, 0);
+ASN1_TIME *ASN1_TIME_set_posix(ASN1_TIME *s, int64_t posix_time) {
+  return ASN1_TIME_adj(s, posix_time, 0, 0);
 }
 
-ASN1_TIME *ASN1_TIME_adj(ASN1_TIME *s, time_t t,
-                         int offset_day, long offset_sec)
-{
-    struct tm *ts;
-    struct tm data;
+ASN1_TIME *ASN1_TIME_set(ASN1_TIME *s, time_t time) {
+  return ASN1_TIME_adj(s, time, 0, 0);
+}
 
-    ts = OPENSSL_gmtime(&t, &data);
-    if (ts == NULL) {
-        OPENSSL_PUT_ERROR(ASN1, ASN1_R_ERROR_GETTING_TIME);
-        return NULL;
-    }
-    if (offset_day || offset_sec) {
-        if (!OPENSSL_gmtime_adj(ts, offset_day, offset_sec))
-            return NULL;
+ASN1_TIME *ASN1_TIME_adj(ASN1_TIME *s, int64_t posix_time, int offset_day,
+                         long offset_sec) {
+  struct tm tm;
+
+  if (!OPENSSL_posix_to_tm(posix_time, &tm)) {
+    OPENSSL_PUT_ERROR(ASN1, ASN1_R_ERROR_GETTING_TIME);
+    return NULL;
+  }
+  if (offset_day || offset_sec) {
+    if (!OPENSSL_gmtime_adj(&tm, offset_day, offset_sec)) {
+      return NULL;
     }
-    if ((ts->tm_year >= 50) && (ts->tm_year < 150))
-        return ASN1_UTCTIME_adj(s, t, offset_day, offset_sec);
-    return ASN1_GENERALIZEDTIME_adj(s, t, offset_day, offset_sec);
+  }
+  if ((tm.tm_year >= 50) && (tm.tm_year < 150)) {
+    return ASN1_UTCTIME_adj(s, posix_time, offset_day, offset_sec);
+  }
+  return ASN1_GENERALIZEDTIME_adj(s, posix_time, offset_day, offset_sec);
 }
 
-int ASN1_TIME_check(const ASN1_TIME *t)
-{
-    if (t->type == V_ASN1_GENERALIZEDTIME)
-        return ASN1_GENERALIZEDTIME_check(t);
-    else if (t->type == V_ASN1_UTCTIME)
-        return ASN1_UTCTIME_check(t);
-    return 0;
+int ASN1_TIME_check(const ASN1_TIME *t) {
+  if (t->type == V_ASN1_GENERALIZEDTIME) {
+    return ASN1_GENERALIZEDTIME_check(t);
+  } else if (t->type == V_ASN1_UTCTIME) {
+    return ASN1_UTCTIME_check(t);
+  }
+  return 0;
 }
 
-/* Convert an ASN1_TIME structure to GeneralizedTime */
+// Convert an ASN1_TIME structure to GeneralizedTime
 ASN1_GENERALIZEDTIME *ASN1_TIME_to_generalizedtime(const ASN1_TIME *t,
-                                                   ASN1_GENERALIZEDTIME **out)
-{
-    ASN1_GENERALIZEDTIME *ret = NULL;
-    char *str;
-    int newlen;
-
-    if (!ASN1_TIME_check(t))
-        return NULL;
-
-    if (!out || !*out) {
-        if (!(ret = ASN1_GENERALIZEDTIME_new()))
-            goto err;
-    } else {
-        ret = *out;
-    }
+                                                   ASN1_GENERALIZEDTIME **out) {
+  ASN1_GENERALIZEDTIME *ret = NULL;
+  char *str;
+  int newlen;
 
-    /* If already GeneralizedTime just copy across */
-    if (t->type == V_ASN1_GENERALIZEDTIME) {
-        if (!ASN1_STRING_set(ret, t->data, t->length))
-            goto err;
-        goto done;
-    }
-
-    /* grow the string */
-    if (!ASN1_STRING_set(ret, NULL, t->length + 2))
-        goto err;
-    /* ASN1_STRING_set() allocated 'len + 1' bytes. */
-    newlen = t->length + 2 + 1;
-    str = (char *)ret->data;
-    /* Work out the century and prepend */
-    if (t->data[0] >= '5')
-        OPENSSL_strlcpy(str, "19", newlen);
-    else
-        OPENSSL_strlcpy(str, "20", newlen);
-
-    OPENSSL_strlcat(str, (char *)t->data, newlen);
-
- done:
-   if (out != NULL && *out == NULL)
-       *out = ret;
-   return ret;
-
- err:
-    if (out == NULL || *out != ret)
-        ASN1_GENERALIZEDTIME_free(ret);
+  if (!ASN1_TIME_check(t)) {
     return NULL;
-}
-
-
-int ASN1_TIME_set_string(ASN1_TIME *s, const char *str)
-{
-    ASN1_TIME t;
+  }
 
-    t.length = strlen(str);
-    t.data = (unsigned char *)str;
-    t.flags = 0;
+  if (!out || !*out) {
+    if (!(ret = ASN1_GENERALIZEDTIME_new())) {
+      goto err;
+    }
+  } else {
+    ret = *out;
+  }
+
+  // If already GeneralizedTime just copy across
+  if (t->type == V_ASN1_GENERALIZEDTIME) {
+    if (!ASN1_STRING_set(ret, t->data, t->length)) {
+      goto err;
+    }
+    goto done;
+  }
+
+  // grow the string
+  if (!ASN1_STRING_set(ret, NULL, t->length + 2)) {
+    goto err;
+  }
+  // ASN1_STRING_set() allocated 'len + 1' bytes.
+  newlen = t->length + 2 + 1;
+  str = (char *)ret->data;
+  // Work out the century and prepend
+  if (t->data[0] >= '5') {
+    OPENSSL_strlcpy(str, "19", newlen);
+  } else {
+    OPENSSL_strlcpy(str, "20", newlen);
+  }
+
+  OPENSSL_strlcat(str, (char *)t->data, newlen);
+
+done:
+  if (out != NULL && *out == NULL) {
+    *out = ret;
+  }
+  return ret;
+
+err:
+  if (out == NULL || *out != ret) {
+    ASN1_GENERALIZEDTIME_free(ret);
+  }
+  return NULL;
+}
 
-    t.type = V_ASN1_UTCTIME;
+int ASN1_TIME_set_string(ASN1_TIME *s, const char *str) {
+  return ASN1_UTCTIME_set_string(s, str) ||
+         ASN1_GENERALIZEDTIME_set_string(s, str);
+}
 
-    if (!ASN1_TIME_check(&t)) {
-        t.type = V_ASN1_GENERALIZEDTIME;
-        if (!ASN1_TIME_check(&t))
-            return 0;
+static int asn1_time_to_tm(struct tm *tm, const ASN1_TIME *t,
+                           int allow_timezone_offset) {
+  if (t == NULL) {
+    if (OPENSSL_posix_to_tm(time(NULL), tm)) {
+      return 1;
     }
+    return 0;
+  }
 
-    if (s && !ASN1_STRING_copy((ASN1_STRING *)s, (ASN1_STRING *)&t))
-        return 0;
+  if (t->type == V_ASN1_UTCTIME) {
+    return asn1_utctime_to_tm(tm, t, allow_timezone_offset);
+  } else if (t->type == V_ASN1_GENERALIZEDTIME) {
+    return asn1_generalizedtime_to_tm(tm, t);
+  }
 
-    return 1;
+  return 0;
 }
 
-static int asn1_time_to_tm(struct tm *tm, const ASN1_TIME *t)
-{
-    if (t == NULL) {
-        time_t now_t;
-        time(&now_t);
-        if (OPENSSL_gmtime(&now_t, tm))
-            return 1;
-        return 0;
-    }
-
-    if (t->type == V_ASN1_UTCTIME)
-        return asn1_utctime_to_tm(tm, t);
-    else if (t->type == V_ASN1_GENERALIZEDTIME)
-        return asn1_generalizedtime_to_tm(tm, t);
+int ASN1_TIME_diff(int *out_days, int *out_seconds, const ASN1_TIME *from,
+                   const ASN1_TIME *to) {
+  struct tm tm_from, tm_to;
+  if (!asn1_time_to_tm(&tm_from, from, /*allow_timezone_offset=*/1)) {
+    return 0;
+  }
+  if (!asn1_time_to_tm(&tm_to, to, /*allow_timezone_offset=*/1)) {
+    return 0;
+  }
+  return OPENSSL_gmtime_diff(out_days, out_seconds, &tm_from, &tm_to);
+}
 
+// The functions below do *not* permissively allow the use of four digit
+// timezone offsets in UTC times, as is done elsewhere in the code. They are
+// both new API, and used internally to X509_cmp_time. This is to discourage the
+// use of nonstandard times in new code, and to ensure that this code behaves
+// correctly in X509_cmp_time which historically did its own time validations
+// slightly different than the many other copies of X.509 time validation
+// sprinkled through the codebase. The custom checks in X509_cmp_time meant that
+// it did not allow four digit timezone offsets in UTC times.
+int ASN1_TIME_to_time_t(const ASN1_TIME *t, time_t *out_time) {
+  struct tm tm;
+  if (!asn1_time_to_tm(&tm, t, /*allow_timezone_offset=*/0)) {
     return 0;
+  }
+  return OPENSSL_timegm(&tm, out_time);
 }
 
-int ASN1_TIME_diff(int *out_days, int *out_seconds,
-                   const ASN1_TIME *from, const ASN1_TIME *to)
-{
-    struct tm tm_from, tm_to;
-    if (!asn1_time_to_tm(&tm_from, from))
-        return 0;
-    if (!asn1_time_to_tm(&tm_to, to))
-        return 0;
-    return OPENSSL_gmtime_diff(out_days, out_seconds, &tm_from, &tm_to);
+int ASN1_TIME_to_posix(const ASN1_TIME *t, int64_t *out_time) {
+  struct tm tm;
+  if (!asn1_time_to_tm(&tm, t, /*allow_timezone_offset=*/0)) {
+    return 0;
+  }
+  return OPENSSL_tm_to_posix(&tm, out_time);
 }