grpc 1.63.0 → 1.65.2

data/third_party/boringssl-with-bazel/src/crypto/pem/pem_lib.c

@@ -261,21 +261,22 @@ err:
 }
 
 int PEM_ASN1_write(i2d_of_void *i2d, const char *name, FILE *fp, void *x,
-                   const EVP_CIPHER *enc, unsigned char *kstr, int klen,
-                   pem_password_cb *callback, void *u) {
+                   const EVP_CIPHER *enc, const unsigned char *pass,
+                   int pass_len, pem_password_cb *callback, void *u) {
   BIO *b = BIO_new_fp(fp, BIO_NOCLOSE);
   if (b == NULL) {
     OPENSSL_PUT_ERROR(PEM, ERR_R_BUF_LIB);
     return 0;
   }
-  int ret = PEM_ASN1_write_bio(i2d, name, b, x, enc, kstr, klen, callback, u);
+  int ret =
+      PEM_ASN1_write_bio(i2d, name, b, x, enc, pass, pass_len, callback, u);
   BIO_free(b);
   return ret;
 }
 
 int PEM_ASN1_write_bio(i2d_of_void *i2d, const char *name, BIO *bp, void *x,
-                       const EVP_CIPHER *enc, unsigned char *kstr, int klen,
-                       pem_password_cb *callback, void *u) {
+                       const EVP_CIPHER *enc, const unsigned char *pass,
+                       int pass_len, pem_password_cb *callback, void *u) {
   EVP_CIPHER_CTX ctx;
   int dsize = 0, i, j, ret = 0;
   unsigned char *p, *data = NULL;
@@ -310,17 +311,17 @@ int PEM_ASN1_write_bio(i2d_of_void *i2d, const char *name, BIO *bp, void *x,
   if (enc != NULL) {
     const unsigned iv_len = EVP_CIPHER_iv_length(enc);
 
-    if (kstr == NULL) {
-      klen = 0;
+    if (pass == NULL) {
+      pass_len = 0;
       if (!callback) {
         callback = PEM_def_callback;
       }
-      klen = (*callback)(buf, PEM_BUFSIZE, 1, u);
-      if (klen <= 0) {
+      pass_len = (*callback)(buf, PEM_BUFSIZE, 1, u);
+      if (pass_len <= 0) {
         OPENSSL_PUT_ERROR(PEM, PEM_R_READ_KEY);
         goto err;
       }
-      kstr = (unsigned char *)buf;
+      pass = (const unsigned char *)buf;
     }
     assert(iv_len <= sizeof(iv));
     if (!RAND_bytes(iv, iv_len)) {  // Generate a salt
@@ -328,11 +329,11 @@ int PEM_ASN1_write_bio(i2d_of_void *i2d, const char *name, BIO *bp, void *x,
     }
     // The 'iv' is used as the iv and as a salt.  It is NOT taken from
     // the BytesToKey function
-    if (!EVP_BytesToKey(enc, EVP_md5(), iv, kstr, klen, 1, key, NULL)) {
+    if (!EVP_BytesToKey(enc, EVP_md5(), iv, pass, pass_len, 1, key, NULL)) {
       goto err;
     }
 
-    if (kstr == (unsigned char *)buf) {
+    if (pass == (const unsigned char *)buf) {
       OPENSSL_cleanse(buf, PEM_BUFSIZE);
     }
 
@@ -375,7 +376,7 @@ err:
 
 int PEM_do_header(EVP_CIPHER_INFO *cipher, unsigned char *data, long *plen,
                   pem_password_cb *callback, void *u) {
-  int i = 0, j, o, klen;
+  int i = 0, j, o, pass_len;
   long len;
   EVP_CIPHER_CTX ctx;
   unsigned char key[EVP_MAX_KEY_LENGTH];
@@ -387,18 +388,18 @@ int PEM_do_header(EVP_CIPHER_INFO *cipher, unsigned char *data, long *plen,
     return 1;
   }
 
-  klen = 0;
+  pass_len = 0;
   if (!callback) {
     callback = PEM_def_callback;
   }
-  klen = callback(buf, PEM_BUFSIZE, 0, u);
-  if (klen <= 0) {
+  pass_len = callback(buf, PEM_BUFSIZE, 0, u);
+  if (pass_len <= 0) {
     OPENSSL_PUT_ERROR(PEM, PEM_R_BAD_PASSWORD_READ);
     return 0;
   }
 
   if (!EVP_BytesToKey(cipher->cipher, EVP_md5(), &(cipher->iv[0]),
-                      (unsigned char *)buf, klen, 1, key, NULL)) {
+                      (unsigned char *)buf, pass_len, 1, key, NULL)) {
     return 0;
   }
 

data/third_party/boringssl-with-bazel/src/crypto/pem/pem_pk8.c

@@ -65,10 +65,10 @@
 #include <openssl/x509.h>
 
 static int do_pk8pkey(BIO *bp, const EVP_PKEY *x, int isder, int nid,
-                      const EVP_CIPHER *enc, char *kstr, int klen,
+                      const EVP_CIPHER *enc, const char *pass, int pass_len,
                       pem_password_cb *cb, void *u);
 static int do_pk8pkey_fp(FILE *bp, const EVP_PKEY *x, int isder, int nid,
-                         const EVP_CIPHER *enc, char *kstr, int klen,
+                         const EVP_CIPHER *enc, const char *pass, int pass_len,
                          pem_password_cb *cb, void *u);
 
 // These functions write a private key in PKCS#8 format: it is a "drop in"
@@ -77,30 +77,31 @@ static int do_pk8pkey_fp(FILE *bp, const EVP_PKEY *x, int isder, int nid,
 // uses PKCS#5 v1.5 PBE algorithms whereas the others use PKCS#5 v2.0.
 
 int PEM_write_bio_PKCS8PrivateKey_nid(BIO *bp, const EVP_PKEY *x, int nid,
-                                      char *kstr, int klen, pem_password_cb *cb,
-                                      void *u) {
-  return do_pk8pkey(bp, x, 0, nid, NULL, kstr, klen, cb, u);
+                                      const char *pass, int pass_len,
+                                      pem_password_cb *cb, void *u) {
+  return do_pk8pkey(bp, x, 0, nid, NULL, pass, pass_len, cb, u);
 }
 
 int PEM_write_bio_PKCS8PrivateKey(BIO *bp, const EVP_PKEY *x,
-                                  const EVP_CIPHER *enc, char *kstr, int klen,
-                                  pem_password_cb *cb, void *u) {
-  return do_pk8pkey(bp, x, 0, -1, enc, kstr, klen, cb, u);
+                                  const EVP_CIPHER *enc, const char *pass,
+                                  int pass_len, pem_password_cb *cb, void *u) {
+  return do_pk8pkey(bp, x, 0, -1, enc, pass, pass_len, cb, u);
 }
 
 int i2d_PKCS8PrivateKey_bio(BIO *bp, const EVP_PKEY *x, const EVP_CIPHER *enc,
-                            char *kstr, int klen, pem_password_cb *cb,
+                            const char *pass, int pass_len, pem_password_cb *cb,
                             void *u) {
-  return do_pk8pkey(bp, x, 1, -1, enc, kstr, klen, cb, u);
+  return do_pk8pkey(bp, x, 1, -1, enc, pass, pass_len, cb, u);
 }
 
-int i2d_PKCS8PrivateKey_nid_bio(BIO *bp, const EVP_PKEY *x, int nid, char *kstr,
-                                int klen, pem_password_cb *cb, void *u) {
-  return do_pk8pkey(bp, x, 1, nid, NULL, kstr, klen, cb, u);
+int i2d_PKCS8PrivateKey_nid_bio(BIO *bp, const EVP_PKEY *x, int nid,
+                                const char *pass, int pass_len,
+                                pem_password_cb *cb, void *u) {
+  return do_pk8pkey(bp, x, 1, nid, NULL, pass, pass_len, cb, u);
 }
 
 static int do_pk8pkey(BIO *bp, const EVP_PKEY *x, int isder, int nid,
-                      const EVP_CIPHER *enc, char *kstr, int klen,
+                      const EVP_CIPHER *enc, const char *pass, int pass_len,
                       pem_password_cb *cb, void *u) {
   X509_SIG *p8;
   PKCS8_PRIV_KEY_INFO *p8inf;
@@ -111,23 +112,23 @@ static int do_pk8pkey(BIO *bp, const EVP_PKEY *x, int isder, int nid,
     return 0;
   }
   if (enc || (nid != -1)) {
-    if (!kstr) {
-      klen = 0;
+    if (!pass) {
+      pass_len = 0;
       if (!cb) {
         cb = PEM_def_callback;
       }
-      klen = cb(buf, PEM_BUFSIZE, 1, u);
-      if (klen <= 0) {
+      pass_len = cb(buf, PEM_BUFSIZE, 1, u);
+      if (pass_len <= 0) {
         OPENSSL_PUT_ERROR(PEM, PEM_R_READ_KEY);
         PKCS8_PRIV_KEY_INFO_free(p8inf);
         return 0;
       }
 
-      kstr = buf;
+      pass = buf;
     }
-    p8 = PKCS8_encrypt(nid, enc, kstr, klen, NULL, 0, 0, p8inf);
-    if (kstr == buf) {
-      OPENSSL_cleanse(buf, klen);
+    p8 = PKCS8_encrypt(nid, enc, pass, pass_len, NULL, 0, 0, p8inf);
+    if (pass == buf) {
+      OPENSSL_cleanse(buf, pass_len);
     }
     PKCS8_PRIV_KEY_INFO_free(p8inf);
     if (isder) {
@@ -152,7 +153,7 @@ EVP_PKEY *d2i_PKCS8PrivateKey_bio(BIO *bp, EVP_PKEY **x, pem_password_cb *cb,
                                   void *u) {
   PKCS8_PRIV_KEY_INFO *p8inf = NULL;
   X509_SIG *p8 = NULL;
-  int klen;
+  int pass_len;
   EVP_PKEY *ret;
   char psbuf[PEM_BUFSIZE];
   p8 = d2i_PKCS8_bio(bp, NULL);
@@ -160,19 +161,19 @@ EVP_PKEY *d2i_PKCS8PrivateKey_bio(BIO *bp, EVP_PKEY **x, pem_password_cb *cb,
     return NULL;
   }
 
-  klen = 0;
+  pass_len = 0;
   if (!cb) {
     cb = PEM_def_callback;
   }
-  klen = cb(psbuf, PEM_BUFSIZE, 0, u);
-  if (klen <= 0) {
+  pass_len = cb(psbuf, PEM_BUFSIZE, 0, u);
+  if (pass_len <= 0) {
     OPENSSL_PUT_ERROR(PEM, PEM_R_BAD_PASSWORD_READ);
     X509_SIG_free(p8);
     return NULL;
   }
-  p8inf = PKCS8_decrypt(p8, psbuf, klen);
+  p8inf = PKCS8_decrypt(p8, psbuf, pass_len);
   X509_SIG_free(p8);
-  OPENSSL_cleanse(psbuf, klen);
+  OPENSSL_cleanse(psbuf, pass_len);
   if (!p8inf) {
     return NULL;
   }
@@ -192,29 +193,31 @@ EVP_PKEY *d2i_PKCS8PrivateKey_bio(BIO *bp, EVP_PKEY **x, pem_password_cb *cb,
 
 
 int i2d_PKCS8PrivateKey_fp(FILE *fp, const EVP_PKEY *x, const EVP_CIPHER *enc,
-                           char *kstr, int klen, pem_password_cb *cb, void *u) {
-  return do_pk8pkey_fp(fp, x, 1, -1, enc, kstr, klen, cb, u);
+                           const char *pass, int pass_len, pem_password_cb *cb,
+                           void *u) {
+  return do_pk8pkey_fp(fp, x, 1, -1, enc, pass, pass_len, cb, u);
 }
 
-int i2d_PKCS8PrivateKey_nid_fp(FILE *fp, const EVP_PKEY *x, int nid, char *kstr,
-                               int klen, pem_password_cb *cb, void *u) {
-  return do_pk8pkey_fp(fp, x, 1, nid, NULL, kstr, klen, cb, u);
+int i2d_PKCS8PrivateKey_nid_fp(FILE *fp, const EVP_PKEY *x, int nid,
+                               const char *pass, int pass_len,
+                               pem_password_cb *cb, void *u) {
+  return do_pk8pkey_fp(fp, x, 1, nid, NULL, pass, pass_len, cb, u);
 }
 
 int PEM_write_PKCS8PrivateKey_nid(FILE *fp, const EVP_PKEY *x, int nid,
-                                  char *kstr, int klen, pem_password_cb *cb,
-                                  void *u) {
-  return do_pk8pkey_fp(fp, x, 0, nid, NULL, kstr, klen, cb, u);
+                                  const char *pass, int pass_len,
+                                  pem_password_cb *cb, void *u) {
+  return do_pk8pkey_fp(fp, x, 0, nid, NULL, pass, pass_len, cb, u);
 }
 
 int PEM_write_PKCS8PrivateKey(FILE *fp, const EVP_PKEY *x,
-                              const EVP_CIPHER *enc, char *kstr, int klen,
-                              pem_password_cb *cb, void *u) {
-  return do_pk8pkey_fp(fp, x, 0, -1, enc, kstr, klen, cb, u);
+                              const EVP_CIPHER *enc, const char *pass,
+                              int pass_len, pem_password_cb *cb, void *u) {
+  return do_pk8pkey_fp(fp, x, 0, -1, enc, pass, pass_len, cb, u);
 }
 
 static int do_pk8pkey_fp(FILE *fp, const EVP_PKEY *x, int isder, int nid,
-                         const EVP_CIPHER *enc, char *kstr, int klen,
+                         const EVP_CIPHER *enc, const char *pass, int pass_len,
                          pem_password_cb *cb, void *u) {
   BIO *bp;
   int ret;
@@ -222,7 +225,7 @@ static int do_pk8pkey_fp(FILE *fp, const EVP_PKEY *x, int isder, int nid,
     OPENSSL_PUT_ERROR(PEM, ERR_R_BUF_LIB);
     return 0;
   }
-  ret = do_pk8pkey(bp, x, isder, nid, enc, kstr, klen, cb, u);
+  ret = do_pk8pkey(bp, x, isder, nid, enc, pass, pass_len, cb, u);
   BIO_free(bp);
   return ret;
 }

data/third_party/boringssl-with-bazel/src/crypto/pem/pem_pkey.c

@@ -98,26 +98,26 @@ EVP_PKEY *PEM_read_bio_PrivateKey(BIO *bp, EVP_PKEY **x, pem_password_cb *cb,
   } else if (strcmp(nm, PEM_STRING_PKCS8) == 0) {
     PKCS8_PRIV_KEY_INFO *p8inf;
     X509_SIG *p8;
-    int klen;
+    int pass_len;
     char psbuf[PEM_BUFSIZE];
     p8 = d2i_X509_SIG(NULL, &p, len);
     if (!p8) {
       goto p8err;
     }
 
-    klen = 0;
+    pass_len = 0;
     if (!cb) {
       cb = PEM_def_callback;
     }
-    klen = cb(psbuf, PEM_BUFSIZE, 0, u);
-    if (klen <= 0) {
+    pass_len = cb(psbuf, PEM_BUFSIZE, 0, u);
+    if (pass_len <= 0) {
       OPENSSL_PUT_ERROR(PEM, PEM_R_BAD_PASSWORD_READ);
       X509_SIG_free(p8);
       goto err;
     }
-    p8inf = PKCS8_decrypt(p8, psbuf, klen);
+    p8inf = PKCS8_decrypt(p8, psbuf, pass_len);
     X509_SIG_free(p8);
-    OPENSSL_cleanse(psbuf, klen);
+    OPENSSL_cleanse(psbuf, pass_len);
     if (!p8inf) {
       goto p8err;
     }
@@ -151,9 +151,10 @@ err:
 }
 
 int PEM_write_bio_PrivateKey(BIO *bp, EVP_PKEY *x, const EVP_CIPHER *enc,
-                             unsigned char *kstr, int klen, pem_password_cb *cb,
-                             void *u) {
-  return PEM_write_bio_PKCS8PrivateKey(bp, x, enc, (char *)kstr, klen, cb, u);
+                             const unsigned char *pass, int pass_len,
+                             pem_password_cb *cb, void *u) {
+  return PEM_write_bio_PKCS8PrivateKey(bp, x, enc, (const char *)pass, pass_len,
+                                       cb, u);
 }
 
 EVP_PKEY *PEM_read_PrivateKey(FILE *fp, EVP_PKEY **x, pem_password_cb *cb,
@@ -169,14 +170,14 @@ EVP_PKEY *PEM_read_PrivateKey(FILE *fp, EVP_PKEY **x, pem_password_cb *cb,
 }
 
 int PEM_write_PrivateKey(FILE *fp, EVP_PKEY *x, const EVP_CIPHER *enc,
-                         unsigned char *kstr, int klen, pem_password_cb *cb,
-                         void *u) {
+                         const unsigned char *pass, int pass_len,
+                         pem_password_cb *cb, void *u) {
   BIO *b = BIO_new_fp(fp, BIO_NOCLOSE);
   if (b == NULL) {
     OPENSSL_PUT_ERROR(PEM, ERR_R_BUF_LIB);
     return 0;
   }
-  int ret = PEM_write_bio_PrivateKey(b, x, enc, kstr, klen, cb, u);
+  int ret = PEM_write_bio_PrivateKey(b, x, enc, pass, pass_len, cb, u);
   BIO_free(b);
   return ret;
 }

data/third_party/boringssl-with-bazel/src/crypto/spx/spx.c

@@ -16,24 +16,25 @@
 
 #include <string.h>
 
+#define OPENSSL_UNSTABLE_EXPERIMENTAL_SPX
+#include <openssl/experimental/spx.h>
 #include <openssl/rand.h>
 
 #include "./address.h"
 #include "./fors.h"
-#include "./internal.h"
 #include "./merkle.h"
 #include "./params.h"
 #include "./spx_util.h"
 #include "./thash.h"
 
-void spx_generate_key(uint8_t out_public_key[SPX_PUBLIC_KEY_BYTES],
+void SPX_generate_key(uint8_t out_public_key[SPX_PUBLIC_KEY_BYTES],
                       uint8_t out_secret_key[SPX_SECRET_KEY_BYTES]) {
   uint8_t seed[3 * SPX_N];
   RAND_bytes(seed, 3 * SPX_N);
-  spx_generate_key_from_seed(out_public_key, out_secret_key, seed);
+  SPX_generate_key_from_seed(out_public_key, out_secret_key, seed);
 }
 
-void spx_generate_key_from_seed(uint8_t out_public_key[SPX_PUBLIC_KEY_BYTES],
+void SPX_generate_key_from_seed(uint8_t out_public_key[SPX_PUBLIC_KEY_BYTES],
                                 uint8_t out_secret_key[SPX_SECRET_KEY_BYTES],
                                 const uint8_t seed[3 * SPX_N]) {
   // Initialize SK.seed || SK.prf || PK.seed from seed.
@@ -51,7 +52,7 @@ void spx_generate_key_from_seed(uint8_t out_public_key[SPX_PUBLIC_KEY_BYTES],
   memcpy(out_secret_key + 3 * SPX_N, out_public_key + SPX_N, SPX_N);
 }
 
-void spx_sign(uint8_t out_signature[SPX_SIGNATURE_BYTES],
+void SPX_sign(uint8_t out_signature[SPX_SIGNATURE_BYTES],
               const uint8_t secret_key[SPX_SECRET_KEY_BYTES],
               const uint8_t *msg, size_t msg_len, int randomized) {
   uint8_t addr[32] = {0};
@@ -102,7 +103,7 @@ void spx_sign(uint8_t out_signature[SPX_SIGNATURE_BYTES],
               idx_leaf, sk_seed, pk_seed);
 }
 
-int spx_verify(const uint8_t signature[SPX_SIGNATURE_BYTES],
+int SPX_verify(const uint8_t signature[SPX_SIGNATURE_BYTES],
                const uint8_t public_key[SPX_SECRET_KEY_BYTES],
                const uint8_t *msg, size_t msg_len) {
   uint8_t addr[32] = {0};

data/third_party/boringssl-with-bazel/src/crypto/x509/by_dir.c

@@ -56,8 +56,6 @@
 
 #include <inttypes.h>
 #include <string.h>
-#include <sys/stat.h>
-#include <sys/types.h>
 
 #include <openssl/buf.h>
 #include <openssl/err.h>
@@ -74,6 +72,7 @@ typedef struct lookup_dir_hashes_st {
 } BY_DIR_HASH;
 
 typedef struct lookup_dir_entry_st {
+  CRYPTO_MUTEX lock;
   char *dir;
   int dir_type;
   STACK_OF(BY_DIR_HASH) *hashes;
@@ -158,6 +157,7 @@ static int by_dir_hash_cmp(const BY_DIR_HASH *const *a,
 
 static void by_dir_entry_free(BY_DIR_ENTRY *ent) {
   if (ent != NULL) {
+    CRYPTO_MUTEX_cleanup(&ent->lock);
     OPENSSL_free(ent->dir);
     sk_BY_DIR_HASH_pop_free(ent->hashes, by_dir_hash_free);
     OPENSSL_free(ent);
@@ -172,6 +172,12 @@ static void free_dir(X509_LOOKUP *lu) {
   }
 }
 
+#if defined(OPENSSL_WINDOWS)
+#define DIR_HASH_SEPARATOR ';'
+#else
+#define DIR_HASH_SEPARATOR ':'
+#endif
+
 static int add_cert_dir(BY_DIR *ctx, const char *dir, int type) {
   size_t j, len;
   const char *s, *ss, *p;
@@ -184,7 +190,7 @@ static int add_cert_dir(BY_DIR *ctx, const char *dir, int type) {
   s = dir;
   p = s;
   do {
-    if ((*p == ':') || (*p == '\0')) {
+    if (*p == DIR_HASH_SEPARATOR || *p == '\0') {
       BY_DIR_ENTRY *ent;
       ss = s;
       s = p + 1;
@@ -211,15 +217,12 @@ static int add_cert_dir(BY_DIR *ctx, const char *dir, int type) {
       if (!ent) {
         return 0;
       }
+      CRYPTO_MUTEX_init(&ent->lock);
       ent->dir_type = type;
       ent->hashes = sk_BY_DIR_HASH_new(by_dir_hash_cmp);
-      ent->dir = OPENSSL_malloc(len + 1);
-      if (!ent->dir || !ent->hashes) {
-        by_dir_entry_free(ent);
-        return 0;
-      }
-      OPENSSL_strlcpy(ent->dir, ss, len + 1);
-      if (!sk_BY_DIR_ENTRY_push(ctx->dirs, ent)) {
+      ent->dir = OPENSSL_strndup(ss, len);
+      if (ent->dir == NULL || ent->hashes == NULL ||
+          !sk_BY_DIR_ENTRY_push(ctx->dirs, ent)) {
         by_dir_entry_free(ent);
         return 0;
       }
@@ -228,10 +231,6 @@ static int add_cert_dir(BY_DIR *ctx, const char *dir, int type) {
   return 1;
 }
 
-// g_ent_hashes_lock protects the |hashes| member of all |BY_DIR_ENTRY|
-// objects.
-static CRYPTO_MUTEX g_ent_hashes_lock = CRYPTO_MUTEX_INIT;
-
 static int get_cert_by_subject(X509_LOOKUP *xl, int type, X509_NAME *name,
                                X509_OBJECT *ret) {
   union {
@@ -296,7 +295,7 @@ static int get_cert_by_subject(X509_LOOKUP *xl, int type, X509_NAME *name,
       }
       if (type == X509_LU_CRL && ent->hashes) {
         htmp.hash = h;
-        CRYPTO_MUTEX_lock_read(&g_ent_hashes_lock);
+        CRYPTO_MUTEX_lock_read(&ent->lock);
         if (sk_BY_DIR_HASH_find(ent->hashes, &idx, &htmp)) {
           hent = sk_BY_DIR_HASH_value(ent->hashes, idx);
           k = hent->suffix;
@@ -304,7 +303,7 @@ static int get_cert_by_subject(X509_LOOKUP *xl, int type, X509_NAME *name,
           hent = NULL;
           k = 0;
         }
-        CRYPTO_MUTEX_unlock_read(&g_ent_hashes_lock);
+        CRYPTO_MUTEX_unlock_read(&ent->lock);
       } else {
         k = 0;
         hent = NULL;
@@ -312,28 +311,22 @@ static int get_cert_by_subject(X509_LOOKUP *xl, int type, X509_NAME *name,
       for (;;) {
         snprintf(b->data, b->max, "%s/%08" PRIx32 ".%s%d", ent->dir, h, postfix,
                  k);
-#ifndef OPENSSL_NO_POSIX_IO
-#if defined(_WIN32) && !defined(stat)
-#define stat _stat
-#endif
-        {
-          struct stat st;
-          if (stat(b->data, &st) < 0) {
-            break;
-          }
-        }
-#endif
-        // found one.
         if (type == X509_LU_X509) {
           if ((X509_load_cert_file(xl, b->data, ent->dir_type)) == 0) {
+            // Don't expose the lower level error, All of these boil
+            // down to "we could not find a CA".
+            ERR_clear_error();
             break;
           }
         } else if (type == X509_LU_CRL) {
           if ((X509_load_crl_file(xl, b->data, ent->dir_type)) == 0) {
+            // Don't expose the lower level error, All of these boil
+            // down to "we could not find a CRL".
+            ERR_clear_error();
             break;
           }
         }
-        // else case will caught higher up
+        // The lack of a CA or CRL will be caught higher up
         k++;
       }
 
@@ -349,7 +342,7 @@ static int get_cert_by_subject(X509_LOOKUP *xl, int type, X509_NAME *name,
       // If a CRL, update the last file suffix added for this
 
       if (type == X509_LU_CRL) {
-        CRYPTO_MUTEX_lock_write(&g_ent_hashes_lock);
+        CRYPTO_MUTEX_lock_write(&ent->lock);
         // Look for entry again in case another thread added an entry
         // first.
         if (!hent) {
@@ -362,14 +355,14 @@ static int get_cert_by_subject(X509_LOOKUP *xl, int type, X509_NAME *name,
         if (!hent) {
           hent = OPENSSL_malloc(sizeof(BY_DIR_HASH));
           if (hent == NULL) {
-            CRYPTO_MUTEX_unlock_write(&g_ent_hashes_lock);
+            CRYPTO_MUTEX_unlock_write(&ent->lock);
             ok = 0;
             goto finish;
           }
           hent->hash = h;
           hent->suffix = k;
           if (!sk_BY_DIR_HASH_push(ent->hashes, hent)) {
-            CRYPTO_MUTEX_unlock_write(&g_ent_hashes_lock);
+            CRYPTO_MUTEX_unlock_write(&ent->lock);
             OPENSSL_free(hent);
             ok = 0;
             goto finish;
@@ -379,7 +372,7 @@ static int get_cert_by_subject(X509_LOOKUP *xl, int type, X509_NAME *name,
           hent->suffix = k;
         }
 
-        CRYPTO_MUTEX_unlock_write(&g_ent_hashes_lock);
+        CRYPTO_MUTEX_unlock_write(&ent->lock);
       }
 
       if (tmp != NULL) {

data/third_party/boringssl-with-bazel/src/crypto/x509/by_file.c

@@ -228,7 +228,7 @@ int X509_load_cert_crl_file(X509_LOOKUP *ctx, const char *file, int type) {
   if (type != X509_FILETYPE_PEM) {
     return X509_load_cert_file(ctx, file, type);
   }
-  in = BIO_new_file(file, "r");
+  in = BIO_new_file(file, "rb");
   if (!in) {
     OPENSSL_PUT_ERROR(X509, ERR_R_SYS_LIB);
     return 0;

data/third_party/boringssl-with-bazel/src/crypto/x509/internal.h

@@ -341,8 +341,6 @@ struct x509_store_st {
 
   // Callbacks for various operations
   X509_STORE_CTX_verify_cb verify_cb;       // error callback
-  X509_STORE_CTX_get_crl_fn get_crl;        // retrieve CRL
-  X509_STORE_CTX_check_crl_fn check_crl;    // Check CRL validity
 
   CRYPTO_refcount_t references;
 } /* X509_STORE */;
@@ -374,8 +372,6 @@ struct x509_store_ctx_st {
 
   // Callbacks for various operations
   X509_STORE_CTX_verify_cb verify_cb;       // error callback
-  X509_STORE_CTX_get_crl_fn get_crl;        // retrieve CRL
-  X509_STORE_CTX_check_crl_fn check_crl;    // Check CRL validity
 
   // The following is built up
   int last_untrusted;     // index of last untrusted cert
@@ -422,7 +418,7 @@ int x509_print_rsa_pss_params(BIO *bp, const X509_ALGOR *sigalg, int indent,
 // Signature algorithm functions.
 
 // x509_digest_sign_algorithm encodes the signing parameters of |ctx| as an
-// AlgorithmIdentifer and saves the result in |algor|. It returns one on
+// AlgorithmIdentifier and saves the result in |algor|. It returns one on
 // success, or zero on error.
 int x509_digest_sign_algorithm(EVP_MD_CTX *ctx, X509_ALGOR *algor);
 
@@ -592,6 +588,9 @@ int X509_is_valid_trust_id(int trust);
 
 int X509_PURPOSE_get_trust(const X509_PURPOSE *xp);
 
+// TODO(https://crbug.com/boringssl/695): Remove this.
+int DIST_POINT_set_dpname(DIST_POINT_NAME *dpn, X509_NAME *iname);
+
 
 #if defined(__cplusplus)
 }  // extern C

data/third_party/boringssl-with-bazel/src/crypto/x509/rsa_pss.c

@@ -125,7 +125,11 @@ static int rsa_md_to_algor(X509_ALGOR **palg, const EVP_MD *md) {
   if (*palg == NULL) {
     return 0;
   }
-  X509_ALGOR_set_md(*palg, md);
+  if (!X509_ALGOR_set_md(*palg, md)) {
+    X509_ALGOR_free(*palg);
+    *palg = NULL;
+    return 0;
+  }
   return 1;
 }
 

data/third_party/boringssl-with-bazel/src/crypto/x509/v3_cpols.c

@@ -105,6 +105,11 @@ const X509V3_EXT_METHOD v3_cpols = {
     NULL,
 };
 
+DECLARE_ASN1_ITEM(POLICYINFO)
+DECLARE_ASN1_ITEM(POLICYQUALINFO)
+DECLARE_ASN1_ITEM(USERNOTICE)
+DECLARE_ASN1_ITEM(NOTICEREF)
+
 ASN1_ITEM_TEMPLATE(CERTIFICATEPOLICIES) = ASN1_EX_TEMPLATE_TYPE(
     ASN1_TFLG_SEQUENCE_OF, 0, CERTIFICATEPOLICIES, POLICYINFO)
 ASN1_ITEM_TEMPLATE_END(CERTIFICATEPOLICIES)
@@ -116,7 +121,7 @@ ASN1_SEQUENCE(POLICYINFO) = {
     ASN1_SEQUENCE_OF_OPT(POLICYINFO, qualifiers, POLICYQUALINFO),
 } ASN1_SEQUENCE_END(POLICYINFO)
 
-IMPLEMENT_ASN1_FUNCTIONS_const(POLICYINFO)
+IMPLEMENT_ASN1_ALLOC_FUNCTIONS(POLICYINFO)
 
 ASN1_ADB_TEMPLATE(policydefault) = ASN1_SIMPLE(POLICYQUALINFO, d.other,
                                                ASN1_ANY);
@@ -133,21 +138,21 @@ ASN1_SEQUENCE(POLICYQUALINFO) = {
     ASN1_ADB_OBJECT(POLICYQUALINFO),
 } ASN1_SEQUENCE_END(POLICYQUALINFO)
 
-IMPLEMENT_ASN1_FUNCTIONS_const(POLICYQUALINFO)
+IMPLEMENT_ASN1_ALLOC_FUNCTIONS(POLICYQUALINFO)
 
 ASN1_SEQUENCE(USERNOTICE) = {
     ASN1_OPT(USERNOTICE, noticeref, NOTICEREF),
     ASN1_OPT(USERNOTICE, exptext, DISPLAYTEXT),
 } ASN1_SEQUENCE_END(USERNOTICE)
 
-IMPLEMENT_ASN1_FUNCTIONS_const(USERNOTICE)
+IMPLEMENT_ASN1_ALLOC_FUNCTIONS(USERNOTICE)
 
 ASN1_SEQUENCE(NOTICEREF) = {
     ASN1_SIMPLE(NOTICEREF, organization, DISPLAYTEXT),
     ASN1_SEQUENCE_OF(NOTICEREF, noticenos, ASN1_INTEGER),
 } ASN1_SEQUENCE_END(NOTICEREF)
 
-IMPLEMENT_ASN1_FUNCTIONS_const(NOTICEREF)
+IMPLEMENT_ASN1_ALLOC_FUNCTIONS(NOTICEREF)
 
 static void *r2i_certpol(const X509V3_EXT_METHOD *method, const X509V3_CTX *ctx,
                          const char *value) {

data/third_party/boringssl-with-bazel/src/crypto/x509/v3_crld.c

@@ -393,7 +393,7 @@ ASN1_CHOICE_cb(DIST_POINT_NAME, dpn_cb) = {
     ASN1_IMP_SET_OF(DIST_POINT_NAME, name.relativename, X509_NAME_ENTRY, 1),
 } ASN1_CHOICE_END_cb(DIST_POINT_NAME, DIST_POINT_NAME, type)
 
-IMPLEMENT_ASN1_FUNCTIONS(DIST_POINT_NAME)
+IMPLEMENT_ASN1_ALLOC_FUNCTIONS(DIST_POINT_NAME)
 
 ASN1_SEQUENCE(DIST_POINT) = {
     ASN1_EXP_OPT(DIST_POINT, distpoint, DIST_POINT_NAME, 0),
@@ -401,7 +401,7 @@ ASN1_SEQUENCE(DIST_POINT) = {
     ASN1_IMP_SEQUENCE_OF_OPT(DIST_POINT, CRLissuer, GENERAL_NAME, 2),
 } ASN1_SEQUENCE_END(DIST_POINT)
 
-IMPLEMENT_ASN1_FUNCTIONS(DIST_POINT)
+IMPLEMENT_ASN1_ALLOC_FUNCTIONS(DIST_POINT)
 
 ASN1_ITEM_TEMPLATE(CRL_DIST_POINTS) = ASN1_EX_TEMPLATE_TYPE(
     ASN1_TFLG_SEQUENCE_OF, 0, CRLDistributionPoints, DIST_POINT)