grpc 1.69.0 → 1.70.1

data/third_party/boringssl-with-bazel/src/ssl/ssl_asn1.cc

@@ -216,9 +216,10 @@ static int SSL_SESSION_to_bytes_full(const SSL_SESSION *in, CBB *cbb,
       !CBB_add_asn1(&session, &child, CBS_ASN1_OCTETSTRING) ||
       !CBB_add_u16(&child, (uint16_t)(in->cipher->id & 0xffff)) ||
       // The session ID is irrelevant for a session ticket.
-      !CBB_add_asn1_octet_string(&session, in->session_id,
-                                 for_ticket ? 0 : in->session_id_length) ||
-      !CBB_add_asn1_octet_string(&session, in->secret, in->secret_length) ||
+      !CBB_add_asn1_octet_string(&session, in->session_id.data(),
+                                 for_ticket ? 0 : in->session_id.size()) ||
+      !CBB_add_asn1_octet_string(&session, in->secret.data(),
+                                 in->secret.size()) ||
       !CBB_add_asn1(&session, &child, kTimeTag) ||
       !CBB_add_asn1_uint64(&child, in->time) ||
       !CBB_add_asn1(&session, &child, kTimeoutTag) ||
@@ -240,7 +241,8 @@ static int SSL_SESSION_to_bytes_full(const SSL_SESSION *in, CBB *cbb,
   // Although it is OPTIONAL and usually empty, OpenSSL has
   // historically always encoded the sid_ctx.
   if (!CBB_add_asn1(&session, &child, kSessionIDContextTag) ||
-      !CBB_add_asn1_octet_string(&child, in->sid_ctx, in->sid_ctx_length)) {
+      !CBB_add_asn1_octet_string(&child, in->sid_ctx.data(),
+                                 in->sid_ctx.size())) {
     return 0;
   }
 
@@ -283,10 +285,10 @@ static int SSL_SESSION_to_bytes_full(const SSL_SESSION *in, CBB *cbb,
     }
   }
 
-  if (in->original_handshake_hash_len > 0) {
+  if (!in->original_handshake_hash.empty()) {
     if (!CBB_add_asn1(&session, &child, kOriginalHandshakeHashTag) ||
-        !CBB_add_asn1_octet_string(&child, in->original_handshake_hash,
-                                   in->original_handshake_hash_len)) {
+        !CBB_add_asn1_octet_string(&child, in->original_handshake_hash.data(),
+                                   in->original_handshake_hash.size())) {
       return 0;
     }
   }
@@ -316,16 +318,16 @@ static int SSL_SESSION_to_bytes_full(const SSL_SESSION *in, CBB *cbb,
     }
   }
 
-  if (in->group_id > 0 &&
-      (!CBB_add_asn1(&session, &child, kGroupIDTag) ||
+  if (in->group_id > 0 &&                               //
+      (!CBB_add_asn1(&session, &child, kGroupIDTag) ||  //
        !CBB_add_asn1_uint64(&child, in->group_id))) {
     return 0;
   }
 
   // The certificate chain is only serialized if the leaf's SHA-256 isn't
   // serialized instead.
-  if (in->certs != NULL &&
-      !in->peer_sha256_valid &&
+  if (in->certs != NULL &&       //
+      !in->peer_sha256_valid &&  //
       sk_CRYPTO_BUFFER_num(in->certs.get()) >= 2) {
     if (!CBB_add_asn1(&session, &child, kCertChainTag)) {
       return 0;
@@ -473,23 +475,6 @@ static int SSL_SESSION_parse_crypto_buffer(CBS *cbs,
   return 1;
 }
 
-// SSL_SESSION_parse_bounded_octet_string parses an optional ASN.1 OCTET STRING
-// explicitly tagged with |tag| of size at most |max_out|.
-static int SSL_SESSION_parse_bounded_octet_string(CBS *cbs, uint8_t *out,
-                                                  uint8_t *out_len,
-                                                  uint8_t max_out,
-                                                  CBS_ASN1_TAG tag) {
-  CBS value;
-  if (!CBS_get_optional_asn1_octet_string(cbs, &value, NULL, tag) ||
-      CBS_len(&value) > max_out) {
-    OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_SSL_SESSION);
-    return 0;
-  }
-  OPENSSL_memcpy(out, CBS_data(&value), CBS_len(&value));
-  *out_len = static_cast<uint8_t>(CBS_len(&value));
-  return 1;
-}
-
 static int SSL_SESSION_parse_long(CBS *cbs, long *out, CBS_ASN1_TAG tag,
                                   long default_value) {
   uint64_t value;
@@ -540,15 +525,15 @@ UniquePtr<SSL_SESSION> SSL_SESSION_parse(CBS *cbs,
   CBS session;
   uint64_t version, ssl_version;
   uint16_t unused;
-  if (!CBS_get_asn1(cbs, &session, CBS_ASN1_SEQUENCE) ||
-      !CBS_get_asn1_uint64(&session, &version) ||
-      version != kVersion ||
-      !CBS_get_asn1_uint64(&session, &ssl_version) ||
+  if (!CBS_get_asn1(cbs, &session, CBS_ASN1_SEQUENCE) ||  //
+      !CBS_get_asn1_uint64(&session, &version) ||         //
+      version != kVersion ||                              //
+      !CBS_get_asn1_uint64(&session, &ssl_version) ||     //
       // Require sessions have versions valid in either TLS or DTLS. The session
       // will not be used by the handshake if not applicable, but, for
       // simplicity, never parse a session that does not pass
       // |ssl_protocol_version_from_wire|.
-      ssl_version > UINT16_MAX ||
+      ssl_version > UINT16_MAX ||  //
       !ssl_protocol_version_from_wire(&unused, ssl_version)) {
     OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_SSL_SESSION);
     return nullptr;
@@ -557,8 +542,8 @@ UniquePtr<SSL_SESSION> SSL_SESSION_parse(CBS *cbs,
 
   CBS cipher;
   uint16_t cipher_value;
-  if (!CBS_get_asn1(&session, &cipher, CBS_ASN1_OCTETSTRING) ||
-      !CBS_get_u16(&cipher, &cipher_value) ||
+  if (!CBS_get_asn1(&session, &cipher, CBS_ASN1_OCTETSTRING) ||  //
+      !CBS_get_u16(&cipher, &cipher_value) ||                    //
       CBS_len(&cipher) != 0) {
     OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_SSL_SESSION);
     return nullptr;
@@ -569,29 +554,16 @@ UniquePtr<SSL_SESSION> SSL_SESSION_parse(CBS *cbs,
     return nullptr;
   }
 
-  CBS session_id, secret;
+  CBS session_id, secret, child;
+  uint64_t timeout;
   if (!CBS_get_asn1(&session, &session_id, CBS_ASN1_OCTETSTRING) ||
-      CBS_len(&session_id) > SSL3_MAX_SSL_SESSION_ID_LENGTH ||
+      !ret->session_id.TryCopyFrom(session_id) ||
       !CBS_get_asn1(&session, &secret, CBS_ASN1_OCTETSTRING) ||
-      CBS_len(&secret) > SSL_MAX_MASTER_KEY_LENGTH) {
-    OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_SSL_SESSION);
-    return nullptr;
-  }
-  OPENSSL_memcpy(ret->session_id, CBS_data(&session_id), CBS_len(&session_id));
-  static_assert(SSL3_MAX_SSL_SESSION_ID_LENGTH <= UINT8_MAX,
-                "max session ID is too large");
-  ret->session_id_length = static_cast<uint8_t>(CBS_len(&session_id));
-  OPENSSL_memcpy(ret->secret, CBS_data(&secret), CBS_len(&secret));
-  static_assert(SSL_MAX_MASTER_KEY_LENGTH <= UINT8_MAX,
-                "max secret is too large");
-  ret->secret_length = static_cast<uint8_t>(CBS_len(&secret));
-
-  CBS child;
-  uint64_t timeout;
-  if (!CBS_get_asn1(&session, &child, kTimeTag) ||
+      !ret->secret.TryCopyFrom(secret) ||
+      !CBS_get_asn1(&session, &child, kTimeTag) ||
       !CBS_get_asn1_uint64(&child, &ret->time) ||
       !CBS_get_asn1(&session, &child, kTimeoutTag) ||
-      !CBS_get_asn1_uint64(&child, &timeout) ||
+      !CBS_get_asn1_uint64(&child, &timeout) ||  //
       timeout > UINT32_MAX) {
     OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_SSL_SESSION);
     return nullptr;
@@ -608,9 +580,10 @@ UniquePtr<SSL_SESSION> SSL_SESSION_parse(CBS *cbs,
   }
   // |peer| is processed with the certificate chain.
 
-  if (!SSL_SESSION_parse_bounded_octet_string(
-          &session, ret->sid_ctx, &ret->sid_ctx_length, sizeof(ret->sid_ctx),
-          kSessionIDContextTag) ||
+  CBS sid_ctx;
+  if (!CBS_get_optional_asn1_octet_string(
+          &session, &sid_ctx, /*out_present=*/nullptr, kSessionIDContextTag) ||
+      !ret->sid_ctx.TryCopyFrom(sid_ctx) ||
       !SSL_SESSION_parse_long(&session, &ret->verify_result, kVerifyResultTag,
                               X509_V_OK)) {
     return nullptr;
@@ -648,10 +621,11 @@ UniquePtr<SSL_SESSION> SSL_SESSION_parse(CBS *cbs,
     ret->peer_sha256_valid = false;
   }
 
-  if (!SSL_SESSION_parse_bounded_octet_string(
-          &session, ret->original_handshake_hash,
-          &ret->original_handshake_hash_len,
-          sizeof(ret->original_handshake_hash), kOriginalHandshakeHashTag) ||
+  CBS original_handshake_hash;
+  if (!CBS_get_optional_asn1_octet_string(&session, &original_handshake_hash,
+                                          /*out_present=*/nullptr,
+                                          kOriginalHandshakeHashTag) ||
+      !ret->original_handshake_hash.TryCopyFrom(original_handshake_hash) ||
       !SSL_SESSION_parse_crypto_buffer(&session,
                                        &ret->signed_cert_timestamp_list,
                                        kSignedCertTimestampListTag, pool) ||
@@ -695,7 +669,7 @@ UniquePtr<SSL_SESSION> SSL_SESSION_parse(CBS *cbs,
 
     if (has_peer) {
       UniquePtr<CRYPTO_BUFFER> buffer(CRYPTO_BUFFER_new_from_CBS(&peer, pool));
-      if (!buffer ||
+      if (!buffer ||  //
           !PushToStack(ret->certs.get(), std::move(buffer))) {
         return nullptr;
       }
@@ -721,8 +695,8 @@ UniquePtr<SSL_SESSION> SSL_SESSION_parse(CBS *cbs,
   int age_add_present;
   if (!CBS_get_optional_asn1_octet_string(&session, &age_add, &age_add_present,
                                           kTicketAgeAddTag) ||
-      (age_add_present &&
-       !CBS_get_u32(&age_add, &ret->ticket_age_add)) ||
+      (age_add_present &&                                //
+       !CBS_get_u32(&age_add, &ret->ticket_age_add)) ||  //
       CBS_len(&age_add) != 0) {
     return nullptr;
   }

data/third_party/boringssl-with-bazel/src/ssl/ssl_buffer.cc

@@ -1,4 +1,4 @@
-/* Copyright (c) 2015, Google Inc.
+/* Copyright 2015 The BoringSSL Authors
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above

data/third_party/boringssl-with-bazel/src/ssl/ssl_cert.cc

@@ -135,7 +135,7 @@
 BSSL_NAMESPACE_BEGIN
 
 CERT::CERT(const SSL_X509_METHOD *x509_method_arg)
-    : default_credential(MakeUnique<SSL_CREDENTIAL>(SSLCredentialType::kX509)),
+    : legacy_credential(MakeUnique<SSL_CREDENTIAL>(SSLCredentialType::kX509)),
       x509_method(x509_method_arg) {}
 
 CERT::~CERT() { x509_method->cert_free(this); }
@@ -153,10 +153,10 @@ UniquePtr<CERT> ssl_cert_dup(CERT *cert) {
     }
   }
 
-  // |default_credential| is mutable, so it must be copied. We cannot simply
+  // |legacy_credential| is mutable, so it must be copied. We cannot simply
   // bump the reference count.
-  ret->default_credential = cert->default_credential->Dup();
-  if (ret->default_credential == nullptr) {
+  ret->legacy_credential = cert->legacy_credential->Dup();
+  if (ret->legacy_credential == nullptr) {
     return nullptr;
   }
 
@@ -165,9 +165,7 @@ UniquePtr<CERT> ssl_cert_dup(CERT *cert) {
 
   ret->x509_method->cert_dup(ret.get(), cert);
 
-  ret->sid_ctx_length = cert->sid_ctx_length;
-  OPENSSL_memcpy(ret->sid_ctx, cert->sid_ctx, sizeof(ret->sid_ctx));
-
+  ret->sid_ctx = cert->sid_ctx;
   return ret;
 }
 
@@ -180,7 +178,7 @@ static void ssl_cert_set_cert_cb(CERT *cert, int (*cb)(SSL *ssl, void *arg),
 static int cert_set_chain_and_key(
     CERT *cert, CRYPTO_BUFFER *const *certs, size_t num_certs,
     EVP_PKEY *privkey, const SSL_PRIVATE_KEY_METHOD *privkey_method) {
-  if (num_certs == 0 ||
+  if (num_certs == 0 ||  //
       (privkey == NULL && privkey_method == NULL)) {
     OPENSSL_PUT_ERROR(SSL, ERR_R_PASSED_NULL_PARAMETER);
     return 0;
@@ -191,8 +189,8 @@ static int cert_set_chain_and_key(
     return 0;
   }
 
-  cert->default_credential->ClearCertAndKey();
-  if (!SSL_CREDENTIAL_set1_cert_chain(cert->default_credential.get(), certs,
+  cert->legacy_credential->ClearCertAndKey();
+  if (!SSL_CREDENTIAL_set1_cert_chain(cert->legacy_credential.get(), certs,
                                       num_certs)) {
     return 0;
   }
@@ -201,18 +199,18 @@ static int cert_set_chain_and_key(
   cert->x509_method->cert_flush_cached_chain(cert);
 
   return privkey != nullptr
-             ? SSL_CREDENTIAL_set1_private_key(cert->default_credential.get(),
+             ? SSL_CREDENTIAL_set1_private_key(cert->legacy_credential.get(),
                                                privkey)
              : SSL_CREDENTIAL_set_private_key_method(
-                   cert->default_credential.get(), privkey_method);
+                   cert->legacy_credential.get(), privkey_method);
 }
 
 bool ssl_set_cert(CERT *cert, UniquePtr<CRYPTO_BUFFER> buffer) {
   // Don't fail for a cert/key mismatch, just free the current private key.
   // (When switching to a different keypair, the caller should switch the
   // certificate, then the key.)
-  if (!cert->default_credential->SetLeafCert(
-          std::move(buffer), /*discard_key_on_mismatch=*/true)) {
+  if (!cert->legacy_credential->SetLeafCert(std::move(buffer),
+                                            /*discard_key_on_mismatch=*/true)) {
     return false;
   }
 
@@ -270,7 +268,7 @@ bool ssl_parse_cert_chain(uint8_t *out_alert,
 
     UniquePtr<CRYPTO_BUFFER> buf(
         CRYPTO_BUFFER_new_from_CBS(&certificate, pool));
-    if (!buf ||
+    if (!buf ||  //
         !PushToStack(chain.get(), std::move(buf))) {
       *out_alert = SSL_AD_INTERNAL_ERROR;
       return false;
@@ -304,13 +302,14 @@ static bool ssl_cert_skip_to_spki(const CBS *in, CBS *out_tbs_cert) {
   CBS buf = *in;
 
   CBS toplevel;
-  if (!CBS_get_asn1(&buf, &toplevel, CBS_ASN1_SEQUENCE) ||
-      CBS_len(&buf) != 0 ||
-      !CBS_get_asn1(&toplevel, out_tbs_cert, CBS_ASN1_SEQUENCE) ||
+  if (!CBS_get_asn1(&buf, &toplevel, CBS_ASN1_SEQUENCE) ||          //
+      CBS_len(&buf) != 0 ||                                         //
+      !CBS_get_asn1(&toplevel, out_tbs_cert, CBS_ASN1_SEQUENCE) ||  //
       // version
       !CBS_get_optional_asn1(
           out_tbs_cert, NULL, NULL,
-          CBS_ASN1_CONSTRUCTED | CBS_ASN1_CONTEXT_SPECIFIC | 0) ||
+          CBS_ASN1_CONSTRUCTED | CBS_ASN1_CONTEXT_SPECIFIC | 0) ||  //
+
       // serialNumber
       !CBS_get_asn1(out_tbs_cert, NULL, CBS_ASN1_INTEGER) ||
       // signature algorithm
@@ -327,6 +326,38 @@ static bool ssl_cert_skip_to_spki(const CBS *in, CBS *out_tbs_cert) {
   return true;
 }
 
+bool ssl_cert_extract_issuer(const CBS *in, CBS *out_dn) {
+  CBS buf = *in;
+
+  CBS toplevel;
+  CBS cert;
+  if (!CBS_get_asn1(&buf, &toplevel, CBS_ASN1_SEQUENCE) ||   //
+      CBS_len(&buf) != 0 ||                                  //
+      !CBS_get_asn1(&toplevel, &cert, CBS_ASN1_SEQUENCE) ||  //
+      // version
+      !CBS_get_optional_asn1(
+          &cert, NULL, NULL,
+          CBS_ASN1_CONSTRUCTED | CBS_ASN1_CONTEXT_SPECIFIC | 0) ||  //
+      // serialNumber
+      !CBS_get_asn1(&cert, NULL, CBS_ASN1_INTEGER) ||  //
+      // signature algorithm
+      !CBS_get_asn1(&cert, NULL, CBS_ASN1_SEQUENCE) ||  //
+      // issuer
+      !CBS_get_asn1_element(&cert, out_dn, CBS_ASN1_SEQUENCE)) {
+    return false;
+  }
+  return true;
+}
+
+bool ssl_cert_matches_issuer(const CBS *in, const CBS *dn) {
+  CBS issuer;
+
+  if (!ssl_cert_extract_issuer(in, &issuer)) {
+    return false;
+  }
+  return CBS_mem_equal(&issuer, CBS_data(dn), CBS_len(dn));
+}
+
 UniquePtr<EVP_PKEY> ssl_cert_parse_pubkey(const CBS *in) {
   CBS buf = *in, tbs_cert;
   if (!ssl_cert_skip_to_spki(&buf, &tbs_cert)) {
@@ -439,9 +470,9 @@ bool ssl_cert_check_key_usage(const CBS *in, enum ssl_key_usage_t bit) {
   return true;
 }
 
-UniquePtr<STACK_OF(CRYPTO_BUFFER)> ssl_parse_client_CA_list(SSL *ssl,
-                                                            uint8_t *out_alert,
-                                                            CBS *cbs) {
+UniquePtr<STACK_OF(CRYPTO_BUFFER)> SSL_parse_CA_list(SSL *ssl,
+                                                     uint8_t *out_alert,
+                                                     CBS *cbs) {
   CRYPTO_BUFFER_POOL *const pool = ssl->ctx->pool;
 
   UniquePtr<STACK_OF(CRYPTO_BUFFER)> ret(sk_CRYPTO_BUFFER_new_null());
@@ -467,14 +498,14 @@ UniquePtr<STACK_OF(CRYPTO_BUFFER)> ssl_parse_client_CA_list(SSL *ssl,
 
     UniquePtr<CRYPTO_BUFFER> buffer(
         CRYPTO_BUFFER_new_from_CBS(&distinguished_name, pool));
-    if (!buffer ||
+    if (!buffer ||  //
         !PushToStack(ret.get(), std::move(buffer))) {
       *out_alert = SSL_AD_INTERNAL_ERROR;
       return nullptr;
     }
   }
 
-  if (!ssl->ctx->x509_method->check_client_CA_list(ret.get())) {
+  if (!ssl->ctx->x509_method->check_CA_list(ret.get())) {
     *out_alert = SSL_AD_DECODE_ERROR;
     OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
     return nullptr;
@@ -483,28 +514,30 @@ UniquePtr<STACK_OF(CRYPTO_BUFFER)> ssl_parse_client_CA_list(SSL *ssl,
   return ret;
 }
 
-bool ssl_has_client_CAs(const SSL_CONFIG *cfg) {
-  const STACK_OF(CRYPTO_BUFFER) *names = cfg->client_CA.get();
-  if (names == nullptr) {
-    names = cfg->ssl->ctx->client_CA.get();
+static bool CA_names_non_empty(const STACK_OF(CRYPTO_BUFFER) *config_names,
+                               const STACK_OF(CRYPTO_BUFFER) *ctx_names) {
+  if (config_names != nullptr) {
+    return sk_CRYPTO_BUFFER_num(config_names) > 0;
   }
-  if (names == nullptr) {
-    return false;
+  if (ctx_names != nullptr) {
+    return sk_CRYPTO_BUFFER_num(ctx_names) > 0;
   }
-  return sk_CRYPTO_BUFFER_num(names) > 0;
+  return false;
 }
 
-bool ssl_add_client_CA_list(SSL_HANDSHAKE *hs, CBB *cbb) {
+
+static bool marshal_CA_names(const STACK_OF(CRYPTO_BUFFER) *config_names,
+                             const STACK_OF(CRYPTO_BUFFER) *ctx_names,
+                             CBB *cbb) {
+  const STACK_OF(CRYPTO_BUFFER) *names =
+      config_names == nullptr ? ctx_names : config_names;
   CBB child, name_cbb;
+
   if (!CBB_add_u16_length_prefixed(cbb, &child)) {
     return false;
   }
 
-  const STACK_OF(CRYPTO_BUFFER) *names = hs->config->client_CA.get();
-  if (names == NULL) {
-    names = hs->ssl->ctx->client_CA.get();
-  }
-  if (names == NULL) {
+  if (names == nullptr) {
     return CBB_flush(cbb);
   }
 
@@ -519,6 +552,25 @@ bool ssl_add_client_CA_list(SSL_HANDSHAKE *hs, CBB *cbb) {
   return CBB_flush(cbb);
 }
 
+bool ssl_has_client_CAs(const SSL_CONFIG *cfg) {
+  return CA_names_non_empty(cfg->client_CA.get(),
+                            cfg->ssl->ctx->client_CA.get());
+}
+
+bool ssl_has_CA_names(const SSL_CONFIG *cfg) {
+  return CA_names_non_empty(cfg->CA_names.get(), cfg->ssl->ctx->CA_names.get());
+}
+
+bool ssl_add_client_CA_list(const SSL_HANDSHAKE *hs, CBB *cbb) {
+  return marshal_CA_names(hs->config->client_CA.get(),
+                          hs->ssl->ctx->client_CA.get(), cbb);
+}
+
+bool ssl_add_CA_names(const SSL_HANDSHAKE *hs, CBB *cbb) {
+  return marshal_CA_names(hs->config->CA_names.get(),
+                          hs->ssl->ctx->CA_names.get(), cbb);
+}
+
 bool ssl_check_leaf_certificate(SSL_HANDSHAKE *hs, EVP_PKEY *pkey,
                                 const CRYPTO_BUFFER *leaf) {
   assert(ssl_protocol_version(hs->ssl) < TLS1_3_VERSION);
@@ -578,18 +630,18 @@ void SSL_certs_clear(SSL *ssl) {
   CERT *cert = ssl->config->cert.get();
   cert->x509_method->cert_clear(cert);
   cert->credentials.clear();
-  cert->default_credential->ClearCertAndKey();
+  cert->legacy_credential->ClearCertAndKey();
 }
 
 const STACK_OF(CRYPTO_BUFFER) *SSL_CTX_get0_chain(const SSL_CTX *ctx) {
-  return ctx->cert->default_credential->chain.get();
+  return ctx->cert->legacy_credential->chain.get();
 }
 
 const STACK_OF(CRYPTO_BUFFER) *SSL_get0_chain(const SSL *ssl) {
   if (!ssl->config) {
     return nullptr;
   }
-  return ssl->config->cert->default_credential->chain.get();
+  return ssl->config->cert->legacy_credential->chain.get();
 }
 
 int SSL_CTX_use_certificate_ASN1(SSL_CTX *ctx, size_t der_len,
@@ -643,7 +695,7 @@ int SSL_CTX_set_signed_cert_timestamp_list(SSL_CTX *ctx, const uint8_t *list,
                                            size_t list_len) {
   UniquePtr<CRYPTO_BUFFER> buf(CRYPTO_BUFFER_new(list, list_len, nullptr));
   return buf != nullptr && SSL_CREDENTIAL_set1_signed_cert_timestamp_list(
-                               ctx->cert->default_credential.get(), buf.get());
+                               ctx->cert->legacy_credential.get(), buf.get());
 }
 
 int SSL_set_signed_cert_timestamp_list(SSL *ssl, const uint8_t *list,
@@ -654,7 +706,7 @@ int SSL_set_signed_cert_timestamp_list(SSL *ssl, const uint8_t *list,
   UniquePtr<CRYPTO_BUFFER> buf(CRYPTO_BUFFER_new(list, list_len, nullptr));
   return buf != nullptr &&
          SSL_CREDENTIAL_set1_signed_cert_timestamp_list(
-             ssl->config->cert->default_credential.get(), buf.get());
+             ssl->config->cert->legacy_credential.get(), buf.get());
 }
 
 int SSL_CTX_set_ocsp_response(SSL_CTX *ctx, const uint8_t *response,
@@ -662,7 +714,7 @@ int SSL_CTX_set_ocsp_response(SSL_CTX *ctx, const uint8_t *response,
   UniquePtr<CRYPTO_BUFFER> buf(
       CRYPTO_BUFFER_new(response, response_len, nullptr));
   return buf != nullptr && SSL_CREDENTIAL_set1_ocsp_response(
-                               ctx->cert->default_credential.get(), buf.get());
+                               ctx->cert->legacy_credential.get(), buf.get());
 }
 
 int SSL_set_ocsp_response(SSL *ssl, const uint8_t *response,
@@ -674,7 +726,7 @@ int SSL_set_ocsp_response(SSL *ssl, const uint8_t *response,
       CRYPTO_BUFFER_new(response, response_len, nullptr));
   return buf != nullptr &&
          SSL_CREDENTIAL_set1_ocsp_response(
-             ssl->config->cert->default_credential.get(), buf.get());
+             ssl->config->cert->legacy_credential.get(), buf.get());
 }
 
 void SSL_CTX_set0_client_CAs(SSL_CTX *ctx, STACK_OF(CRYPTO_BUFFER) *name_list) {
@@ -689,3 +741,10 @@ void SSL_set0_client_CAs(SSL *ssl, STACK_OF(CRYPTO_BUFFER) *name_list) {
   ssl->ctx->x509_method->ssl_flush_cached_client_CA(ssl->config.get());
   ssl->config->client_CA.reset(name_list);
 }
+
+void SSL_set0_CA_names(SSL *ssl, STACK_OF(CRYPTO_BUFFER) *name_list) {
+  if (!ssl->config) {
+    return;
+  }
+  ssl->config->CA_names.reset(name_list);
+}