grpc 1.71.0 → 1.73.0

data/third_party/boringssl-with-bazel/src/crypto/pem/pem_lib.cc

@@ -239,7 +239,7 @@ int PEM_ASN1_write(i2d_of_void *i2d, const char *name, FILE *fp, void *x,
 int PEM_ASN1_write_bio(i2d_of_void *i2d, const char *name, BIO *bp, void *x,
                        const EVP_CIPHER *enc, const unsigned char *pass,
                        int pass_len, pem_password_cb *callback, void *u) {
-  EVP_CIPHER_CTX ctx;
+  bssl::ScopedEVP_CIPHER_CTX ctx;
   int dsize = 0, i, j, ret = 0;
   unsigned char *p, *data = NULL;
   const char *objstr = NULL;
@@ -305,16 +305,14 @@ int PEM_ASN1_write_bio(i2d_of_void *i2d, const char *name, BIO *bp, void *x,
     PEM_dek_info(buf, objstr, iv_len, (char *)iv);
     // k=strlen(buf);
 
-    EVP_CIPHER_CTX_init(&ctx);
     ret = 1;
-    if (!EVP_EncryptInit_ex(&ctx, enc, NULL, key, iv) ||
-        !EVP_EncryptUpdate(&ctx, data, &j, data, i) ||
-        !EVP_EncryptFinal_ex(&ctx, &(data[j]), &i)) {
+    if (!EVP_EncryptInit_ex(ctx.get(), enc, NULL, key, iv) ||
+        !EVP_EncryptUpdate(ctx.get(), data, &j, data, i) ||
+        !EVP_EncryptFinal_ex(ctx.get(), &(data[j]), &i)) {
       ret = 0;
     } else {
       i += j;
     }
-    EVP_CIPHER_CTX_cleanup(&ctx);
     if (ret == 0) {
       goto err;
     }
@@ -329,7 +327,6 @@ int PEM_ASN1_write_bio(i2d_of_void *i2d, const char *name, BIO *bp, void *x,
 err:
   OPENSSL_cleanse(key, sizeof(key));
   OPENSSL_cleanse(iv, sizeof(iv));
-  OPENSSL_cleanse((char *)&ctx, sizeof(ctx));
   OPENSSL_cleanse(buf, PEM_BUFSIZE);
   OPENSSL_free(data);
   return ret;
@@ -339,7 +336,7 @@ int PEM_do_header(const EVP_CIPHER_INFO *cipher, unsigned char *data,
                   long *plen, pem_password_cb *callback, void *u) {
   int i = 0, j, o, pass_len;
   long len;
-  EVP_CIPHER_CTX ctx;
+  bssl::ScopedEVP_CIPHER_CTX ctx;
   unsigned char key[EVP_MAX_KEY_LENGTH];
   char buf[PEM_BUFSIZE];
 
@@ -365,15 +362,13 @@ int PEM_do_header(const EVP_CIPHER_INFO *cipher, unsigned char *data,
   }
 
   j = (int)len;
-  EVP_CIPHER_CTX_init(&ctx);
-  o = EVP_DecryptInit_ex(&ctx, cipher->cipher, NULL, key, cipher->iv);
+  o = EVP_DecryptInit_ex(ctx.get(), cipher->cipher, NULL, key, cipher->iv);
   if (o) {
-    o = EVP_DecryptUpdate(&ctx, data, &i, data, j);
+    o = EVP_DecryptUpdate(ctx.get(), data, &i, data, j);
   }
   if (o) {
-    o = EVP_DecryptFinal_ex(&ctx, &(data[i]), &j);
+    o = EVP_DecryptFinal_ex(ctx.get(), &(data[i]), &j);
   }
-  EVP_CIPHER_CTX_cleanup(&ctx);
   OPENSSL_cleanse((char *)buf, sizeof(buf));
   OPENSSL_cleanse((char *)key, sizeof(key));
   if (!o) {

data/third_party/boringssl-with-bazel/src/crypto/pkcs7/internal.h

@@ -12,8 +12,8 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-#ifndef OPENSSL_HEADER_PKCS7_INTERNAL_H
-#define OPENSSL_HEADER_PKCS7_INTERNAL_H
+#ifndef OPENSSL_HEADER_CRYPTO_PKCS7_INTERNAL_H
+#define OPENSSL_HEADER_CRYPTO_PKCS7_INTERNAL_H
 
 #include <openssl/base.h>
 
@@ -36,6 +36,8 @@ int pkcs7_parse_header(uint8_t **der_bytes, CBS *out, CBS *cbs);
 // doing so it makes callbacks to let the caller fill in parts of the structure.
 // All callbacks are ignored if NULL and return one on success or zero on error.
 //
+//   signed_data_version: version number of the SignedData structure. In PKCS#7,
+//       it is always 1. In CMS, it depends on the features used.
 //   digest_algos_cb: may write AlgorithmIdentifiers into the given CBB, which
 //       is a SET of digest algorithms.
 //   cert_crl_cb: may write the |certificates| or |crls| fields.
@@ -44,15 +46,27 @@ int pkcs7_parse_header(uint8_t **der_bytes, CBS *out, CBS *cbs);
 //       (See https://datatracker.ietf.org/doc/html/rfc2315#section-9.1)
 //
 // pkcs7_add_signed_data returns one on success or zero on error.
-int pkcs7_add_signed_data(CBB *out,
-                          int (*digest_algos_cb)(CBB *out, const void *arg),
-                          int (*cert_crl_cb)(CBB *out, const void *arg),
-                          int (*signer_infos_cb)(CBB *out, const void *arg),
-                          const void *arg);
+int pkcs7_add_signed_data(CBB *out, uint64_t signed_data_version,
+                          int (*digest_algos_cb)(CBB *out, void *arg),
+                          int (*cert_crl_cb)(CBB *out, void *arg),
+                          int (*signer_infos_cb)(CBB *out, void *arg),
+                          void *arg);
+
+// pkcs7_add_external_signature writes a PKCS#7 or CMS SignedData structure to
+// |out|, containing an external (i.e. the contents are not included) signature,
+// using |sign_cert| and |key| to sign the contents of |data| with |md|. If
+// |use_key_id| is true (CMS-only), the SignerInfo specifies the signer with key
+// identifier. Otherwise, it uses issuer and serial number (PKCS#7 or CMS v1).
+// The SignedData will have no embedded certificates and no attributes.
+//
+// Note: CMS v1 and PKCS#7 v1.5 are not completely compatible, but they overlap
+// in all cases implemented by this function.
+int pkcs7_add_external_signature(CBB *out, X509 *sign_cert, EVP_PKEY *key,
+                                 const EVP_MD *md, BIO *data, bool use_key_id);
 
 
 #if defined(__cplusplus)
 }  // extern C
 #endif
 
-#endif  // OPENSSL_HEADER_PKCS7_INTERNAL_H
+#endif  // OPENSSL_HEADER_CRYPTO_PKCS7_INTERNAL_H

data/third_party/boringssl-with-bazel/src/crypto/pkcs7/pkcs7.cc

@@ -130,7 +130,7 @@ err:
   return ret;
 }
 
-static int pkcs7_bundle_raw_certificates_cb(CBB *out, const void *arg) {
+static int pkcs7_bundle_raw_certificates_cb(CBB *out, void *arg) {
   const STACK_OF(CRYPTO_BUFFER) *certs =
       reinterpret_cast<const STACK_OF(CRYPTO_BUFFER) *>(arg);
   CBB certificates;
@@ -155,37 +155,39 @@ static int pkcs7_bundle_raw_certificates_cb(CBB *out, const void *arg) {
 
 int PKCS7_bundle_raw_certificates(CBB *out,
                                   const STACK_OF(CRYPTO_BUFFER) *certs) {
-  return pkcs7_add_signed_data(out, /*digest_algos_cb=*/NULL,
+  return pkcs7_add_signed_data(out, /*signed_data_version=*/1,
+                               /*digest_algos_cb=*/nullptr,
                                pkcs7_bundle_raw_certificates_cb,
-                               /*signer_infos_cb=*/NULL, certs);
+                               /*signer_infos_cb=*/nullptr,
+                               const_cast<STACK_OF(CRYPTO_BUFFER) *>(certs));
 }
 
-int pkcs7_add_signed_data(CBB *out,
-                          int (*digest_algos_cb)(CBB *out, const void *arg),
-                          int (*cert_crl_cb)(CBB *out, const void *arg),
-                          int (*signer_infos_cb)(CBB *out, const void *arg),
-                          const void *arg) {
-  CBB outer_seq, oid, wrapped_seq, seq, version_bytes, digest_algos_set,
-      content_info, signer_infos;
+int pkcs7_add_signed_data(CBB *out, uint64_t signed_data_version,
+                          int (*digest_algos_cb)(CBB *out, void *arg),
+                          int (*cert_crl_cb)(CBB *out, void *arg),
+                          int (*signer_infos_cb)(CBB *out, void *arg),
+                          void *arg) {
+  CBB outer_seq, wrapped_seq, seq, digest_algos_set, content_info, signer_infos;
 
   // See https://tools.ietf.org/html/rfc2315#section-7
   if (!CBB_add_asn1(out, &outer_seq, CBS_ASN1_SEQUENCE) ||
-      !CBB_add_asn1(&outer_seq, &oid, CBS_ASN1_OBJECT) ||
-      !CBB_add_bytes(&oid, kPKCS7SignedData, sizeof(kPKCS7SignedData)) ||
+      !CBB_add_asn1_element(&outer_seq, CBS_ASN1_OBJECT, kPKCS7SignedData,
+                            sizeof(kPKCS7SignedData)) ||
       !CBB_add_asn1(&outer_seq, &wrapped_seq,
                     CBS_ASN1_CONTEXT_SPECIFIC | CBS_ASN1_CONSTRUCTED | 0) ||
       // See https://tools.ietf.org/html/rfc2315#section-9.1
       !CBB_add_asn1(&wrapped_seq, &seq, CBS_ASN1_SEQUENCE) ||
-      !CBB_add_asn1(&seq, &version_bytes, CBS_ASN1_INTEGER) ||
-      !CBB_add_u8(&version_bytes, 1) ||
+      !CBB_add_asn1_uint64(&seq, signed_data_version) ||
       !CBB_add_asn1(&seq, &digest_algos_set, CBS_ASN1_SET) ||
       (digest_algos_cb != NULL && !digest_algos_cb(&digest_algos_set, arg)) ||
+      !CBB_flush_asn1_set_of(&digest_algos_set) ||
       !CBB_add_asn1(&seq, &content_info, CBS_ASN1_SEQUENCE) ||
-      !CBB_add_asn1(&content_info, &oid, CBS_ASN1_OBJECT) ||
-      !CBB_add_bytes(&oid, kPKCS7Data, sizeof(kPKCS7Data)) ||
+      !CBB_add_asn1_element(&content_info, CBS_ASN1_OBJECT, kPKCS7Data,
+                            sizeof(kPKCS7Data)) ||
       (cert_crl_cb != NULL && !cert_crl_cb(&seq, arg)) ||
       !CBB_add_asn1(&seq, &signer_infos, CBS_ASN1_SET) ||
-      (signer_infos_cb != NULL && !signer_infos_cb(&signer_infos, arg))) {
+      (signer_infos_cb != NULL && !signer_infos_cb(&signer_infos, arg)) ||
+      !CBB_flush_asn1_set_of(&signer_infos)) {
     return 0;
   }
 

data/third_party/boringssl-with-bazel/src/crypto/pkcs7/pkcs7_x509.cc

@@ -17,8 +17,12 @@
 #include <assert.h>
 #include <limits.h>
 
+#include <openssl/asn1.h>
 #include <openssl/bytestring.h>
+#include <openssl/cms.h>
+#include <openssl/digest.h>
 #include <openssl/err.h>
+#include <openssl/evp.h>
 #include <openssl/mem.h>
 #include <openssl/obj.h>
 #include <openssl/pem.h>
@@ -26,6 +30,8 @@
 #include <openssl/stack.h>
 #include <openssl/x509.h>
 
+#include "../asn1/internal.h"
+#include "../x509/internal.h"
 #include "../internal.h"
 #include "internal.h"
 
@@ -168,8 +174,8 @@ int PKCS7_get_PEM_CRLs(STACK_OF(X509_CRL) *out_crls, BIO *pem_bio) {
   return ret;
 }
 
-static int pkcs7_bundle_certificates_cb(CBB *out, const void *arg) {
-  const STACK_OF(X509) *certs = reinterpret_cast<const STACK_OF(X509) *>(arg);
+static int pkcs7_bundle_certificates_cb(CBB *out, void *arg) {
+  auto *certs = static_cast<const STACK_OF(X509) *>(arg);
   size_t i;
   CBB certificates;
 
@@ -195,14 +201,14 @@ static int pkcs7_bundle_certificates_cb(CBB *out, const void *arg) {
 }
 
 int PKCS7_bundle_certificates(CBB *out, const STACK_OF(X509) *certs) {
-  return pkcs7_add_signed_data(out, /*digest_algos_cb=*/NULL,
-                               pkcs7_bundle_certificates_cb,
-                               /*signer_infos_cb=*/NULL, certs);
+  return pkcs7_add_signed_data(
+      out, /*signed_data_version=*/1,
+      /*digest_algos_cb=*/nullptr, pkcs7_bundle_certificates_cb,
+      /*signer_infos_cb=*/nullptr, const_cast<STACK_OF(X509) *>(certs));
 }
 
-static int pkcs7_bundle_crls_cb(CBB *out, const void *arg) {
-  const STACK_OF(X509_CRL) *crls =
-      reinterpret_cast<const STACK_OF(X509_CRL) *>(arg);
+static int pkcs7_bundle_crls_cb(CBB *out, void *arg) {
+  auto *crls = static_cast<const STACK_OF(X509_CRL) *>(arg);
   size_t i;
   CBB crl_data;
 
@@ -228,9 +234,10 @@ static int pkcs7_bundle_crls_cb(CBB *out, const void *arg) {
 }
 
 int PKCS7_bundle_CRLs(CBB *out, const STACK_OF(X509_CRL) *crls) {
-  return pkcs7_add_signed_data(out, /*digest_algos_cb=*/NULL,
-                               pkcs7_bundle_crls_cb,
-                               /*signer_infos_cb=*/NULL, crls);
+  return pkcs7_add_signed_data(
+      out, /*signed_data_version=*/1,
+      /*digest_algos_cb=*/nullptr, pkcs7_bundle_crls_cb,
+      /*signer_infos_cb=*/nullptr, const_cast<STACK_OF(X509_CRL) *>(crls));
 }
 
 static PKCS7 *pkcs7_new(CBS *cbs) {
@@ -363,164 +370,155 @@ int PKCS7_type_is_enveloped(const PKCS7 *p7) { return 0; }
 int PKCS7_type_is_signed(const PKCS7 *p7) { return 1; }
 int PKCS7_type_is_signedAndEnveloped(const PKCS7 *p7) { return 0; }
 
-// write_sha256_ai writes an AlgorithmIdentifier for SHA-256 to
-// |digest_algos_set|.
-static int write_sha256_ai(CBB *digest_algos_set, const void *arg) {
-  CBB seq;
-  return CBB_add_asn1(digest_algos_set, &seq, CBS_ASN1_SEQUENCE) &&
-         OBJ_nid2cbb(&seq, NID_sha256) &&  //
-         // https://datatracker.ietf.org/doc/html/rfc5754#section-2
-         // "Implementations MUST generate SHA2 AlgorithmIdentifiers with absent
-         //  parameters."
-         CBB_flush(digest_algos_set);
-}
-
-// sign_sha256 writes at most |max_out_sig| bytes of the signature of |data| by
-// |pkey| to |out_sig| and sets |*out_sig_len| to the number of bytes written.
-// It returns one on success or zero on error.
-static int sign_sha256(uint8_t *out_sig, size_t *out_sig_len,
-                       size_t max_out_sig, EVP_PKEY *pkey, BIO *data) {
-  static const size_t kBufSize = 4096;
-  uint8_t *buffer = reinterpret_cast<uint8_t *>(OPENSSL_malloc(kBufSize));
-  if (!buffer) {
-    return 0;
-  }
-
-  EVP_MD_CTX ctx;
-  EVP_MD_CTX_init(&ctx);
-
-  int ret = 0;
-  if (!EVP_DigestSignInit(&ctx, NULL, EVP_sha256(), NULL, pkey)) {
-    goto out;
-  }
-
+static bool digest_sign_update(EVP_MD_CTX *ctx, BIO *data) {
   for (;;) {
-    const int n = BIO_read(data, buffer, kBufSize);
+    uint8_t buf[4096];
+    const int n = BIO_read(data, buf, sizeof(buf));
     if (n == 0) {
-      break;
-    } else if (n < 0 || !EVP_DigestSignUpdate(&ctx, buffer, n)) {
-      goto out;
+      return true;
+    } else if (n < 0 || !EVP_DigestSignUpdate(ctx, buf, n)) {
+      return false;
     }
   }
-
-  *out_sig_len = max_out_sig;
-  if (!EVP_DigestSignFinal(&ctx, out_sig, out_sig_len)) {
-    goto out;
-  }
-
-  ret = 1;
-
-out:
-  EVP_MD_CTX_cleanup(&ctx);
-  OPENSSL_free(buffer);
-  return ret;
 }
 
 namespace {
 struct signer_info_data {
-  const X509 *sign_cert;
-  uint8_t *signature;
-  size_t signature_len;
+  X509 *sign_cert = nullptr;
+  bssl::ScopedEVP_MD_CTX sign_ctx;
+  bool use_key_id = false;
 };
 }  // namespace
 
+static int write_signer_digest_algos(CBB *digest_algos_set, void *arg) {
+  auto *si_data = static_cast<struct signer_info_data *>(arg);
+  // https://www.rfc-editor.org/rfc/rfc5754.html#section-2
+  // "Implementations MUST generate SHA2 AlgorithmIdentifiers with absent
+  //  parameters."
+  return EVP_marshal_digest_algorithm_no_params(
+      digest_algos_set, EVP_MD_CTX_get0_md(si_data->sign_ctx.get()));
+}
+
 // write_signer_info writes the SignerInfo structure from
-// https://datatracker.ietf.org/doc/html/rfc2315#section-9.2 to |out|. It
-// returns one on success or zero on error.
-static int write_signer_info(CBB *out, const void *arg) {
-  const struct signer_info_data *const si_data =
-      reinterpret_cast<const struct signer_info_data *>(arg);
+// https://www.rfc-editor.org/rfc/rfc2315.html#section-9.2 and
+// https://www.rfc-editor.org/rfc/rfc5652.html#section-5.3 to |out|. It returns
+// one on success or zero on error.
+static int write_signer_info(CBB *out, void *arg) {
+  auto *si_data = static_cast<struct signer_info_data *>(arg);
+
+  uint64_t version = si_data->use_key_id ? 3u : 1u;
+  CBB seq, child, signing_algo, null, signature;
+  if (!CBB_add_asn1(out, &seq, CBS_ASN1_SEQUENCE) ||
+      !CBB_add_asn1_uint64(&seq, version)) {
+    return 0;
+  }
 
-  int ret = 0;
-  uint8_t *subject_bytes = NULL;
-  uint8_t *serial_bytes = NULL;
-
-  const int subject_len =
-      i2d_X509_NAME(X509_get_subject_name(si_data->sign_cert), &subject_bytes);
-  const int serial_len = i2d_ASN1_INTEGER(
-      (ASN1_INTEGER *)X509_get0_serialNumber(si_data->sign_cert),
-      &serial_bytes);
-
-  CBB seq, issuer_and_serial, signing_algo, null, signature;
-  if (subject_len < 0 || serial_len < 0 ||
-      !CBB_add_asn1(out, &seq, CBS_ASN1_SEQUENCE) ||
-      // version
-      !CBB_add_asn1_uint64(&seq, 1) ||
-      !CBB_add_asn1(&seq, &issuer_and_serial, CBS_ASN1_SEQUENCE) ||
-      !CBB_add_bytes(&issuer_and_serial, subject_bytes, subject_len) ||
-      !CBB_add_bytes(&issuer_and_serial, serial_bytes, serial_len) ||
-      !write_sha256_ai(&seq, NULL) ||
+  // Output the SignerIdentifier.
+  if (si_data->use_key_id) {
+    const ASN1_OCTET_STRING *skid =
+        X509_get0_subject_key_id(si_data->sign_cert);
+    if (skid == nullptr) {
+      OPENSSL_PUT_ERROR(CMS, CMS_R_CERTIFICATE_HAS_NO_KEYID);
+      return 0;
+    }
+    // subjectKeyIdentifier is implicitly-tagged.
+    if (!CBB_add_asn1_element(&seq, CBS_ASN1_CONTEXT_SPECIFIC | 0,
+                              ASN1_STRING_get0_data(skid),
+                              ASN1_STRING_length(skid))) {
+      return 0;
+    }
+  } else {
+    if (!CBB_add_asn1(&seq, &child, CBS_ASN1_SEQUENCE) ||
+        !x509_marshal_name(&child, X509_get_subject_name(si_data->sign_cert)) ||
+        !asn1_marshal_integer(&child,
+                              X509_get0_serialNumber(si_data->sign_cert),
+                              /*tag=*/0)) {
+      return 0;
+    }
+  }
+
+  // Output the digest and signature algorithm. This cannot use X.509 signature
+  // algorithms because CMS incorrectly decomposes signature algorithms into a
+  // combination of digesting and "encrypting" the digest, then uses the plain
+  // rsaEncryption OID instead of the hash-specific RSA OIDs. For now, we only
+  // support RSA.
+  EVP_PKEY *pkey = EVP_PKEY_CTX_get0_pkey(si_data->sign_ctx->pctx);
+  if (EVP_PKEY_id(pkey) != EVP_PKEY_RSA) {
+    OPENSSL_PUT_ERROR(PKCS7, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+    return 0;
+  }
+  if (!EVP_marshal_digest_algorithm_no_params(
+          &seq, EVP_MD_CTX_get0_md(si_data->sign_ctx.get())) ||
       !CBB_add_asn1(&seq, &signing_algo, CBS_ASN1_SEQUENCE) ||
       !OBJ_nid2cbb(&signing_algo, NID_rsaEncryption) ||
-      !CBB_add_asn1(&signing_algo, &null, CBS_ASN1_NULL) ||
+      !CBB_add_asn1(&signing_algo, &null, CBS_ASN1_NULL)) {
+    return 0;
+  }
+
+  // Output the signature.
+  uint8_t *ptr;
+  size_t sig_len;
+  if (!EVP_DigestSignFinal(si_data->sign_ctx.get(), nullptr, &sig_len) ||
       !CBB_add_asn1(&seq, &signature, CBS_ASN1_OCTETSTRING) ||
-      !CBB_add_bytes(&signature, si_data->signature, si_data->signature_len) ||
+      !CBB_reserve(&signature, &ptr, sig_len) ||
+      !EVP_DigestSignFinal(si_data->sign_ctx.get(), ptr, &sig_len) ||
+      !CBB_did_write(&signature, sig_len) ||  //
       !CBB_flush(out)) {
-    goto out;
+    return 0;
   }
 
-  ret = 1;
+  return 1;
+}
 
-out:
-  OPENSSL_free(subject_bytes);
-  OPENSSL_free(serial_bytes);
-  return ret;
+int pkcs7_add_external_signature(CBB *out, X509 *sign_cert, EVP_PKEY *key,
+                                 const EVP_MD *md, BIO *data, bool use_key_id) {
+  signer_info_data si_data;
+  si_data.use_key_id = use_key_id;
+  si_data.sign_cert = sign_cert;
+
+  // Set up the signature.
+  if (!EVP_DigestSignInit(si_data.sign_ctx.get(), nullptr, md, nullptr, key) ||
+      !digest_sign_update(si_data.sign_ctx.get(), data)) {
+    return 0;
+  }
+
+  // See RFC 5652, Section 5.1. When no certificates are present, the version
+  // comes from the highest SignerInfo version, which will be 3 (CMS) for a key
+  // ID, and 1 (CMS or PKCS#7) for issuer and serial.
+  uint64_t signed_data_version = use_key_id ? 3u : 1u;
+  return pkcs7_add_signed_data(
+      out, signed_data_version, write_signer_digest_algos,
+      /*cert_crl_cb=*/nullptr, write_signer_info, &si_data);
 }
 
 PKCS7 *PKCS7_sign(X509 *sign_cert, EVP_PKEY *pkey, STACK_OF(X509) *certs,
                   BIO *data, int flags) {
-  CBB cbb;
-  if (!CBB_init(&cbb, 2048)) {
-    return NULL;
+  bssl::ScopedCBB cbb;
+  if (!CBB_init(cbb.get(), 2048)) {
+    return nullptr;
   }
 
-  uint8_t *der = NULL;
-  size_t len;
-  PKCS7 *ret = NULL;
-
-  if (sign_cert == NULL && pkey == NULL && flags == PKCS7_DETACHED) {
+  if (sign_cert == nullptr && pkey == nullptr && flags == PKCS7_DETACHED) {
     // Caller just wants to bundle certificates.
-    if (!PKCS7_bundle_certificates(&cbb, certs)) {
-      goto out;
+    if (!PKCS7_bundle_certificates(cbb.get(), certs)) {
+      return nullptr;
     }
-  } else if (sign_cert != NULL && pkey != NULL && certs == NULL &&
-             data != NULL &&
+  } else if (sign_cert != nullptr && pkey != nullptr && certs == nullptr &&
+             data != nullptr &&
              flags == (PKCS7_NOATTR | PKCS7_BINARY | PKCS7_NOCERTS |
-                       PKCS7_DETACHED) &&
-             EVP_PKEY_id(pkey) == NID_rsaEncryption) {
-    // sign-file.c from the Linux kernel.
-    const size_t signature_max_len = EVP_PKEY_size(pkey);
-    struct signer_info_data si_data = {
-        /*sign_cert=*/sign_cert,
-        /*signature=*/
-        reinterpret_cast<uint8_t *>(OPENSSL_malloc(signature_max_len)),
-        /*signature_len=*/0,
-    };
-
-    if (!si_data.signature ||
-        !sign_sha256(si_data.signature, &si_data.signature_len,
-                     signature_max_len, pkey, data) ||
-        !pkcs7_add_signed_data(&cbb, write_sha256_ai, /*cert_crl_cb=*/NULL,
-                               write_signer_info, &si_data)) {
-      OPENSSL_free(si_data.signature);
-      goto out;
+                       PKCS7_DETACHED)) {
+    // In OpenSSL, this API signs with some default hash. That default has been
+    // SHA-256 since 2015.
+    if (!pkcs7_add_external_signature(cbb.get(), sign_cert, pkey, EVP_sha256(),
+                                      data, /*use_key_id=*/false)) {
+      return nullptr;
     }
-    OPENSSL_free(si_data.signature);
   } else {
     OPENSSL_PUT_ERROR(PKCS7, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
-    goto out;
-  }
-
-  if (!CBB_finish(&cbb, &der, &len)) {
-    goto out;
+    return nullptr;
   }
 
   CBS cbs;
-  CBS_init(&cbs, der, len);
-  ret = pkcs7_new(&cbs);
-
-out:
-  CBB_cleanup(&cbb);
-  OPENSSL_free(der);
-  return ret;
+  CBS_init(&cbs, CBB_data(cbb.get()), CBB_len(cbb.get()));
+  return pkcs7_new(&cbs);
 }

data/third_party/boringssl-with-bazel/src/crypto/pkcs8/internal.h

@@ -12,8 +12,8 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-#ifndef OPENSSL_HEADER_PKCS8_INTERNAL_H
-#define OPENSSL_HEADER_PKCS8_INTERNAL_H
+#ifndef OPENSSL_HEADER_CRYPTO_PKCS8_INTERNAL_H
+#define OPENSSL_HEADER_CRYPTO_PKCS8_INTERNAL_H
 
 #include <openssl/base.h>
 #include <openssl/stack.h>
@@ -51,11 +51,13 @@ int pkcs12_key_gen(const char *pass, size_t pass_len, const uint8_t *salt,
                    size_t out_len, uint8_t *out, const EVP_MD *md);
 
 // pkcs12_pbe_encrypt_init configures |ctx| for encrypting with a PBES1 scheme
-// defined in PKCS#12. It writes the corresponding AlgorithmIdentifier to |out|.
-int pkcs12_pbe_encrypt_init(CBB *out, EVP_CIPHER_CTX *ctx, int alg,
-                            uint32_t iterations, const char *pass,
-                            size_t pass_len, const uint8_t *salt,
-                            size_t salt_len);
+// defined in PKCS#12, or a PBES2 scheme defined in PKCS#5. The algorithm is
+// determined as in |PKCS8_encrypt|. It writes the corresponding
+// AlgorithmIdentifier to |out|.
+int pkcs12_pbe_encrypt_init(CBB *out, EVP_CIPHER_CTX *ctx, int alg_nid,
+                            const EVP_CIPHER *alg_cipher, uint32_t iterations,
+                            const char *pass, size_t pass_len,
+                            const uint8_t *salt, size_t salt_len);
 
 struct pbe_suite {
   int pbe_nid;
@@ -74,6 +76,10 @@ struct pbe_suite {
 
 #define PKCS5_SALT_LEN 8
 
+// pkcs5_pbe2_nid_to_cipher returns the |EVP_CIPHER| for |nid| if |nid| is
+// supported with PKCS#5 PBES2, and nullptr otherwise.
+const EVP_CIPHER *pkcs5_pbe2_nid_to_cipher(int nid);
+
 int PKCS5_pbe2_decrypt_init(const struct pbe_suite *suite, EVP_CIPHER_CTX *ctx,
                             const char *pass, size_t pass_len, CBS *param);
 
@@ -94,4 +100,4 @@ int pkcs12_iterations_acceptable(uint64_t iterations);
 }  // extern C
 #endif
 
-#endif  // OPENSSL_HEADER_PKCS8_INTERNAL_H
+#endif  // OPENSSL_HEADER_CRYPTO_PKCS8_INTERNAL_H

data/third_party/boringssl-with-bazel/src/crypto/pkcs8/p5_pbev2.cc

@@ -78,23 +78,20 @@ static const struct {
 };
 
 static const EVP_CIPHER *cbs_to_cipher(const CBS *cbs) {
-  for (size_t i = 0; i < OPENSSL_ARRAY_SIZE(kCipherOIDs); i++) {
-    if (CBS_mem_equal(cbs, kCipherOIDs[i].oid, kCipherOIDs[i].oid_len)) {
-      return kCipherOIDs[i].cipher_func();
+  for (const auto &cipher : kCipherOIDs) {
+    if (CBS_mem_equal(cbs, cipher.oid, cipher.oid_len)) {
+      return cipher.cipher_func();
     }
   }
 
-  return NULL;
+  return nullptr;
 }
 
 static int add_cipher_oid(CBB *out, int nid) {
-  for (size_t i = 0; i < OPENSSL_ARRAY_SIZE(kCipherOIDs); i++) {
-    if (kCipherOIDs[i].nid == nid) {
-      CBB child;
-      return CBB_add_asn1(out, &child, CBS_ASN1_OBJECT) &&
-             CBB_add_bytes(&child, kCipherOIDs[i].oid,
-                           kCipherOIDs[i].oid_len) &&
-             CBB_flush(out);
+  for (const auto &cipher : kCipherOIDs) {
+    if (cipher.nid == nid) {
+      return CBB_add_asn1_element(out, CBS_ASN1_OBJECT, cipher.oid,
+                                  cipher.oid_len);
     }
   }
 
@@ -102,6 +99,15 @@ static int add_cipher_oid(CBB *out, int nid) {
   return 0;
 }
 
+const EVP_CIPHER *pkcs5_pbe2_nid_to_cipher(int nid) {
+  for (const auto &cipher : kCipherOIDs) {
+    if (cipher.nid == nid) {
+      return cipher.cipher_func();
+    }
+  }
+  return nullptr;
+}
+
 static int pkcs5_pbe2_cipher_init(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
                                   const EVP_MD *pbkdf2_md, uint32_t iterations,
                                   const char *pass, size_t pass_len,
@@ -137,29 +143,27 @@ int PKCS5_pbe2_encrypt_init(CBB *out, EVP_CIPHER_CTX *ctx,
   }
 
   // See RFC 2898, appendix A.
-  CBB algorithm, oid, param, kdf, kdf_oid, kdf_param, salt_cbb, cipher_cbb,
-      iv_cbb;
+  CBB algorithm, param, kdf, kdf_param, cipher_cbb;
   if (!CBB_add_asn1(out, &algorithm, CBS_ASN1_SEQUENCE) ||
-      !CBB_add_asn1(&algorithm, &oid, CBS_ASN1_OBJECT) ||
-      !CBB_add_bytes(&oid, kPBES2, sizeof(kPBES2)) ||
+      !CBB_add_asn1_element(&algorithm, CBS_ASN1_OBJECT, kPBES2,
+                            sizeof(kPBES2)) ||
       !CBB_add_asn1(&algorithm, &param, CBS_ASN1_SEQUENCE) ||
       !CBB_add_asn1(&param, &kdf, CBS_ASN1_SEQUENCE) ||
-      !CBB_add_asn1(&kdf, &kdf_oid, CBS_ASN1_OBJECT) ||
-      !CBB_add_bytes(&kdf_oid, kPBKDF2, sizeof(kPBKDF2)) ||
+      !CBB_add_asn1_element(&kdf, CBS_ASN1_OBJECT, kPBKDF2, sizeof(kPBKDF2)) ||
       !CBB_add_asn1(&kdf, &kdf_param, CBS_ASN1_SEQUENCE) ||
-      !CBB_add_asn1(&kdf_param, &salt_cbb, CBS_ASN1_OCTETSTRING) ||
-      !CBB_add_bytes(&salt_cbb, salt, salt_len) ||
+      !CBB_add_asn1_octet_string(&kdf_param, salt, salt_len) ||
       !CBB_add_asn1_uint64(&kdf_param, iterations) ||
       // Specify a key length for RC2.
       (cipher_nid == NID_rc2_cbc &&
        !CBB_add_asn1_uint64(&kdf_param, EVP_CIPHER_key_length(cipher))) ||
       // Omit the PRF. We use the default hmacWithSHA1.
+      // TODO(crbug.com/396434682): Improve this defaults.
       !CBB_add_asn1(&param, &cipher_cbb, CBS_ASN1_SEQUENCE) ||
       !add_cipher_oid(&cipher_cbb, cipher_nid) ||
       // RFC 2898 says RC2-CBC and RC5-CBC-Pad use a SEQUENCE with version and
       // IV, but OpenSSL always uses an OCTET STRING IV, so we do the same.
-      !CBB_add_asn1(&cipher_cbb, &iv_cbb, CBS_ASN1_OCTETSTRING) ||
-      !CBB_add_bytes(&iv_cbb, iv, EVP_CIPHER_iv_length(cipher)) ||
+      !CBB_add_asn1_octet_string(&cipher_cbb, iv,
+                                 EVP_CIPHER_iv_length(cipher)) ||
       !CBB_flush(out)) {
     return 0;
   }