grpc 1.84.0 → 1.85.0.pre1

data/third_party/boringssl-with-bazel/crypto/cipher/tls_cbc.cc

@@ -18,15 +18,19 @@
 #include <openssl/digest.h>
 #include <openssl/nid.h>
 #include <openssl/sha.h>
+#include <openssl/span.h>
 
+#include "../fipsmodule/cipher/internal.h"
 #include "../internal.h"
 #include "internal.h"
-#include "../fipsmodule/cipher/internal.h"
 
 
-int EVP_tls_cbc_remove_padding(crypto_word_t *out_padding_ok, size_t *out_len,
-                               const uint8_t *in, size_t in_len,
-                               size_t block_size, size_t mac_size) {
+using namespace bssl;
+
+int bssl::EVP_tls_cbc_remove_padding(crypto_word_t *out_padding_ok,
+                                     size_t *out_len, const uint8_t *in,
+                                     size_t in_len, size_t block_size,
+                                     size_t mac_size) {
   const size_t overhead = 1 /* padding length byte */ + mac_size;
 
   // These lengths are all public so we can test them in non-constant time.
@@ -42,7 +46,7 @@ int EVP_tls_cbc_remove_padding(crypto_word_t *out_padding_ok, size_t *out_len,
   // length byte. Thus, with the length byte included, there are i+1
   // bytes of padding.
   //
-  // We can't check just |padding_length+1| bytes because that leaks
+  // We can't check just `padding_length+1` bytes because that leaks
   // decrypted information. Therefore we always have to check the maximum
   // amount of padding possible. (Again, the length of the record is
   // public information so we can use it.)
@@ -53,18 +57,21 @@ int EVP_tls_cbc_remove_padding(crypto_word_t *out_padding_ok, size_t *out_len,
 
   for (size_t i = 0; i < to_check; i++) {
     uint8_t mask = constant_time_ge_8(padding_length, i);
-    uint8_t b = in[in_len - 1 - i];
-    // The final |padding_length+1| bytes should all have the value
-    // |padding_length|. Therefore the XOR should be zero.
+    // The value barrier on `(in_len - 1 - i)` isn't needed to enforce
+    // constant-time. It is just there to prevent a false positive in
+    // constant-time checks by valgrind.
+    uint8_t b = in[value_barrier_w(in_len - 1 - i)];
+    // The final `padding_length+1` bytes should all have the value
+    // `padding_length`. Therefore the XOR should be zero.
     good &= ~(mask & (padding_length ^ b));
   }
 
-  // If any of the final |padding_length+1| bytes had the wrong value,
-  // one or more of the lower eight bits of |good| will be cleared.
+  // If any of the final `padding_length+1` bytes had the wrong value,
+  // one or more of the lower eight bits of `good` will be cleared.
   good = constant_time_eq_w(0xff, good & 0xff);
 
-  // Always treat |padding_length| as zero on error. If, assuming block size of
-  // 16, a padding of [<15 arbitrary bytes> 15] treated |padding_length| as 16
+  // Always treat `padding_length` as zero on error. If, assuming block size of
+  // 16, a padding of [<15 arbitrary bytes> 15] treated `padding_length` as 16
   // and returned -1, distinguishing good MAC and bad padding from bad MAC and
   // bad padding would give POODLE's padding oracle.
   padding_length = good & (padding_length + 1);
@@ -73,13 +80,13 @@ int EVP_tls_cbc_remove_padding(crypto_word_t *out_padding_ok, size_t *out_len,
   return 1;
 }
 
-void EVP_tls_cbc_copy_mac(uint8_t *out, size_t md_size, const uint8_t *in,
-                          size_t in_len, size_t orig_len) {
+void bssl::EVP_tls_cbc_copy_mac(uint8_t *out, size_t md_size, const uint8_t *in,
+                                size_t in_len, size_t orig_len) {
   uint8_t rotated_mac1[EVP_MAX_MD_SIZE], rotated_mac2[EVP_MAX_MD_SIZE];
   uint8_t *rotated_mac = rotated_mac1;
   uint8_t *rotated_mac_tmp = rotated_mac2;
 
-  // mac_end is the index of |in| just after the end of the MAC.
+  // mac_end is the index of `in` just after the end of the MAC.
   size_t mac_end = in_len;
   size_t mac_start = mac_end - md_size;
 
@@ -107,15 +114,15 @@ void EVP_tls_cbc_copy_mac(uint8_t *out, size_t md_size, const uint8_t *in,
     mac_started |= is_mac_start;
     uint8_t mac_ended = constant_time_ge_8(i, mac_end);
     rotated_mac[j] |= in[i] & mac_started & ~mac_ended;
-    // Save the offset that |mac_start| is mapped to.
+    // Save the offset that `mac_start` is mapped to.
     rotate_offset |= j & is_mac_start;
   }
 
   // Now rotate the MAC. We rotate in log(md_size) steps, one for each bit
   // position.
   for (size_t offset = 1; offset < md_size; offset <<= 1, rotate_offset >>= 1) {
-    // Rotate by |offset| iff the corresponding bit is set in
-    // |rotate_offset|, placing the result in |rotated_mac_tmp|.
+    // Rotate by `offset` iff the corresponding bit is set in
+    // `rotate_offset`, placing the result in `rotated_mac_tmp`.
     const uint8_t skip_rotate = (rotate_offset & 1) - 1;
     for (size_t i = 0, j = offset; i < md_size; i++, j++) {
       if (j >= md_size) {
@@ -125,7 +132,7 @@ void EVP_tls_cbc_copy_mac(uint8_t *out, size_t md_size, const uint8_t *in,
           constant_time_select_8(skip_rotate, rotated_mac[i], rotated_mac[j]);
     }
 
-    // Swap pointers so |rotated_mac| contains the (possibly) rotated value.
+    // Swap pointers so `rotated_mac` contains the (possibly) rotated value.
     // Note the number of iterations and thus the identity of these pointers is
     // public information.
     uint8_t *tmp = rotated_mac;
@@ -136,12 +143,12 @@ void EVP_tls_cbc_copy_mac(uint8_t *out, size_t md_size, const uint8_t *in,
   OPENSSL_memcpy(out, rotated_mac, md_size);
 }
 
-int EVP_sha1_final_with_secret_suffix(SHA_CTX *ctx,
-                                      uint8_t out[SHA_DIGEST_LENGTH],
-                                      const uint8_t *in, size_t len,
-                                      size_t max_len) {
-  // Bound the input length so |total_bits| below fits in four bytes. This is
-  // redundant with TLS record size limits. This also ensures |input_idx| below
+int bssl::EVP_sha1_final_with_secret_suffix(SHA_CTX *ctx,
+                                            uint8_t out[SHA_DIGEST_LENGTH],
+                                            const uint8_t *in, size_t len,
+                                            size_t max_len) {
+  // Bound the input length so `total_bits` below fits in four bytes. This is
+  // redundant with TLS record size limits. This also ensures `input_idx` below
   // does not overflow.
   size_t max_len_bits = max_len << 3;
   if (ctx->Nh != 0 ||
@@ -151,7 +158,7 @@ int EVP_sha1_final_with_secret_suffix(SHA_CTX *ctx,
     return 0;
   }
 
-  // We need to hash the following into |ctx|:
+  // We need to hash the following into `ctx`:
   //
   // - ctx->data[:ctx->num]
   // - in[:len]
@@ -162,24 +169,21 @@ int EVP_sha1_final_with_secret_suffix(SHA_CTX *ctx,
   size_t last_block = num_blocks - 1;
   size_t max_blocks = (ctx->num + max_len + 1 + 8 + SHA_CBLOCK - 1) >> 6;
 
-  // The bounds above imply |total_bits| fits in four bytes.
+  // The bounds above imply `total_bits` fits in four bytes.
   size_t total_bits = ctx->Nl + (len << 3);
   uint8_t length_bytes[4];
-  length_bytes[0] = (uint8_t)(total_bits >> 24);
-  length_bytes[1] = (uint8_t)(total_bits >> 16);
-  length_bytes[2] = (uint8_t)(total_bits >> 8);
-  length_bytes[3] = (uint8_t)total_bits;
+  CRYPTO_store_u32_be(length_bytes, total_bits);
 
   // We now construct and process each expected block in constant-time.
   uint8_t block[SHA_CBLOCK] = {0};
   uint32_t result[5] = {0};
-  // input_idx is the index into |in| corresponding to the current block.
-  // However, we allow this index to overflow beyond |max_len|, to simplify the
+  // input_idx is the index into `in` corresponding to the current block.
+  // However, we allow this index to overflow beyond `max_len`, to simplify the
   // 0x80 byte.
   size_t input_idx = 0;
   for (size_t i = 0; i < max_blocks; i++) {
-    // Fill |block| with data from the partial block in |ctx| and |in|. We copy
-    // as if we were hashing up to |max_len| and then zero the excess later.
+    // Fill `block` with data from the partial block in `ctx` and `in`. We copy
+    // as if we were hashing up to `max_len` and then zero the excess later.
     size_t block_start = 0;
     if (i == 0) {
       OPENSSL_memcpy(block, ctx->data, ctx->num);
@@ -193,12 +197,12 @@ int EVP_sha1_final_with_secret_suffix(SHA_CTX *ctx,
       OPENSSL_memcpy(block + block_start, in + input_idx, to_copy);
     }
 
-    // Zero any bytes beyond |len| and add the 0x80 byte.
+    // Zero any bytes beyond `len` and add the 0x80 byte.
     for (size_t j = block_start; j < SHA_CBLOCK; j++) {
       // input[idx] corresponds to block[j].
       size_t idx = input_idx + j - block_start;
-      // The barriers on |len| are not strictly necessary. However, without
-      // them, GCC compiles this code by incorporating |len| into the loop
+      // The barriers on `len` are not strictly necessary. However, without
+      // them, GCC compiles this code by incorporating `len` into the loop
       // counter and subtracting it out later. This is still constant-time, but
       // it frustrates attempts to validate this.
       uint8_t is_in_bounds = constant_time_lt_8(idx, value_barrier_w(len));
@@ -209,8 +213,10 @@ int EVP_sha1_final_with_secret_suffix(SHA_CTX *ctx,
 
     input_idx += SHA_CBLOCK - block_start;
 
-    // Fill in the length if this is the last block.
-    crypto_word_t is_last_block = constant_time_eq_w(i, last_block);
+    // Fill in the length if this is the last block. Use a value barrier to
+    // prevent Clang from compiling the conditional select as a jump.
+    crypto_word_t is_last_block =
+        value_barrier_w(constant_time_eq_w(i, last_block));
     for (size_t j = 0; j < 4; j++) {
       block[SHA_CBLOCK - 4 + j] |= is_last_block & length_bytes[j];
     }
@@ -229,12 +235,12 @@ int EVP_sha1_final_with_secret_suffix(SHA_CTX *ctx,
   return 1;
 }
 
-int EVP_sha256_final_with_secret_suffix(SHA256_CTX *ctx,
-                                        uint8_t out[SHA256_DIGEST_LENGTH],
-                                        const uint8_t *in, size_t len,
-                                        size_t max_len) {
-  // Bound the input length so |total_bits| below fits in four bytes. This is
-  // redundant with TLS record size limits. This also ensures |input_idx| below
+int bssl::EVP_sha256_final_with_secret_suffix(SHA256_CTX *ctx,
+                                              uint8_t out[SHA256_DIGEST_LENGTH],
+                                              const uint8_t *in, size_t len,
+                                              size_t max_len) {
+  // Bound the input length so `total_bits` below fits in four bytes. This is
+  // redundant with TLS record size limits. This also ensures `input_idx` below
   // does not overflow.
   size_t max_len_bits = max_len << 3;
   if (ctx->Nh != 0 ||
@@ -244,7 +250,7 @@ int EVP_sha256_final_with_secret_suffix(SHA256_CTX *ctx,
     return 0;
   }
 
-  // We need to hash the following into |ctx|:
+  // We need to hash the following into `ctx`:
   //
   // - ctx->data[:ctx->num]
   // - in[:len]
@@ -255,24 +261,21 @@ int EVP_sha256_final_with_secret_suffix(SHA256_CTX *ctx,
   size_t last_block = num_blocks - 1;
   size_t max_blocks = (ctx->num + max_len + 1 + 8 + SHA256_CBLOCK - 1) >> 6;
 
-  // The bounds above imply |total_bits| fits in four bytes.
+  // The bounds above imply `total_bits` fits in four bytes.
   size_t total_bits = ctx->Nl + (len << 3);
   uint8_t length_bytes[4];
-  length_bytes[0] = (uint8_t)(total_bits >> 24);
-  length_bytes[1] = (uint8_t)(total_bits >> 16);
-  length_bytes[2] = (uint8_t)(total_bits >> 8);
-  length_bytes[3] = (uint8_t)total_bits;
+  CRYPTO_store_u32_be(length_bytes, total_bits);
 
   // We now construct and process each expected block in constant-time.
   uint8_t block[SHA256_CBLOCK] = {0};
   uint32_t result[8] = {0};
-  // input_idx is the index into |in| corresponding to the current block.
-  // However, we allow this index to overflow beyond |max_len|, to simplify the
+  // input_idx is the index into `in` corresponding to the current block.
+  // However, we allow this index to overflow beyond `max_len`, to simplify the
   // 0x80 byte.
   size_t input_idx = 0;
   for (size_t i = 0; i < max_blocks; i++) {
-    // Fill |block| with data from the partial block in |ctx| and |in|. We copy
-    // as if we were hashing up to |max_len| and then zero the excess later.
+    // Fill `block` with data from the partial block in `ctx` and `in`. We copy
+    // as if we were hashing up to `max_len` and then zero the excess later.
     size_t block_start = 0;
     if (i == 0) {
       OPENSSL_memcpy(block, ctx->data, ctx->num);
@@ -286,12 +289,12 @@ int EVP_sha256_final_with_secret_suffix(SHA256_CTX *ctx,
       OPENSSL_memcpy(block + block_start, in + input_idx, to_copy);
     }
 
-    // Zero any bytes beyond |len| and add the 0x80 byte.
+    // Zero any bytes beyond `len` and add the 0x80 byte.
     for (size_t j = block_start; j < SHA256_CBLOCK; j++) {
       // input[idx] corresponds to block[j].
       size_t idx = input_idx + j - block_start;
-      // The barriers on |len| are not strictly necessary. However, without
-      // them, GCC compiles this code by incorporating |len| into the loop
+      // The barriers on `len` are not strictly necessary. However, without
+      // them, GCC compiles this code by incorporating `len` into the loop
       // counter and subtracting it out later. This is still constant-time, but
       // it frustrates attempts to validate this.
       uint8_t is_in_bounds = constant_time_lt_8(idx, value_barrier_w(len));
@@ -302,8 +305,10 @@ int EVP_sha256_final_with_secret_suffix(SHA256_CTX *ctx,
 
     input_idx += SHA256_CBLOCK - block_start;
 
-    // Fill in the length if this is the last block.
-    crypto_word_t is_last_block = constant_time_eq_w(i, last_block);
+    // Fill in the length if this is the last block. Use a value barrier to
+    // prevent Clang from compiling the conditional select as a jump.
+    crypto_word_t is_last_block =
+        value_barrier_w(constant_time_eq_w(i, last_block));
     for (size_t j = 0; j < 4; j++) {
       block[SHA256_CBLOCK - 4 + j] |= is_last_block & length_bytes[j];
     }
@@ -322,7 +327,7 @@ int EVP_sha256_final_with_secret_suffix(SHA256_CTX *ctx,
   return 1;
 }
 
-int EVP_tls_cbc_record_digest_supported(const EVP_MD *md) {
+int bssl::EVP_tls_cbc_record_digest_supported(const EVP_MD *md) {
   switch (EVP_MD_type(md)) {
     case NID_sha1:
     case NID_sha256:
@@ -332,12 +337,12 @@ int EVP_tls_cbc_record_digest_supported(const EVP_MD *md) {
   }
 }
 
-static int tls_cbc_digest_record_sha1(uint8_t *md_out, size_t *md_out_size,
-                                      const uint8_t header[13],
-                                      const uint8_t *data, size_t data_size,
-                                      size_t data_plus_mac_plus_padding_size,
-                                      const uint8_t *mac_secret,
-                                      unsigned mac_secret_length) {
+static int tls_cbc_digest_record_sha1(
+    uint8_t *md_out, size_t *md_out_size, const uint8_t len_header[2],
+    Span<const CRYPTO_IVEC> aadvecs,
+    Span<const CRYPTO_IOVEC> iovecs_without_trailer,
+    Span<const uint8_t> trailer, size_t data_in_trailer_size,
+    const uint8_t *mac_secret, unsigned mac_secret_length) {
   if (mac_secret_length > SHA_CBLOCK) {
     // HMAC pads small keys with zeros and hashes large keys down. This function
     // should never reach the large key case.
@@ -356,24 +361,22 @@ static int tls_cbc_digest_record_sha1(uint8_t *md_out, size_t *md_out_size,
   SHA_CTX ctx;
   SHA1_Init(&ctx);
   SHA1_Update(&ctx, hmac_pad, SHA_CBLOCK);
-  SHA1_Update(&ctx, header, 13);
-
-  // There are at most 256 bytes of padding, so we can compute the public
-  // minimum length for |data_size|.
-  size_t min_data_size = 0;
-  if (data_plus_mac_plus_padding_size > SHA_DIGEST_LENGTH + 256) {
-    min_data_size = data_plus_mac_plus_padding_size - SHA_DIGEST_LENGTH - 256;
+  for (const CRYPTO_IVEC &aadvec : aadvecs) {
+    SHA1_Update(&ctx, aadvec.in, aadvec.len);
   }
+  SHA1_Update(&ctx, len_header, 2);
 
   // Hash the public minimum length directly. This reduces the number of blocks
   // that must be computed in constant-time.
-  SHA1_Update(&ctx, data, min_data_size);
+  for (const CRYPTO_IOVEC &iovec : iovecs_without_trailer) {
+    SHA1_Update(&ctx, iovec.out, iovec.len);
+  }
 
-  // Hash the remaining data without leaking |data_size|.
+  // Hash the remaining data without leaking `data_in_trailer_size`.
   uint8_t mac_out[SHA_DIGEST_LENGTH];
-  if (!EVP_sha1_final_with_secret_suffix(
-          &ctx, mac_out, data + min_data_size, data_size - min_data_size,
-          data_plus_mac_plus_padding_size - min_data_size)) {
+  if (!EVP_sha1_final_with_secret_suffix(&ctx, mac_out, trailer.data(),
+                                         data_in_trailer_size,
+                                         trailer.size())) {
     return 0;
   }
 
@@ -390,12 +393,12 @@ static int tls_cbc_digest_record_sha1(uint8_t *md_out, size_t *md_out_size,
   return 1;
 }
 
-static int tls_cbc_digest_record_sha256(uint8_t *md_out, size_t *md_out_size,
-                                        const uint8_t header[13],
-                                        const uint8_t *data, size_t data_size,
-                                        size_t data_plus_mac_plus_padding_size,
-                                        const uint8_t *mac_secret,
-                                        unsigned mac_secret_length) {
+static int tls_cbc_digest_record_sha256(
+    uint8_t *md_out, size_t *md_out_size, const uint8_t len_header[2],
+    Span<const CRYPTO_IVEC> aadvecs,
+    Span<const CRYPTO_IOVEC> iovecs_without_trailer,
+    Span<const uint8_t> trailer, size_t data_in_trailer_size,
+    const uint8_t *mac_secret, unsigned mac_secret_length) {
   if (mac_secret_length > SHA256_CBLOCK) {
     // HMAC pads small keys with zeros and hashes large keys down. This function
     // should never reach the large key case.
@@ -414,25 +417,22 @@ static int tls_cbc_digest_record_sha256(uint8_t *md_out, size_t *md_out_size,
   SHA256_CTX ctx;
   SHA256_Init(&ctx);
   SHA256_Update(&ctx, hmac_pad, SHA256_CBLOCK);
-  SHA256_Update(&ctx, header, 13);
-
-  // There are at most 256 bytes of padding, so we can compute the public
-  // minimum length for |data_size|.
-  size_t min_data_size = 0;
-  if (data_plus_mac_plus_padding_size > SHA256_DIGEST_LENGTH + 256) {
-    min_data_size =
-        data_plus_mac_plus_padding_size - SHA256_DIGEST_LENGTH - 256;
+  for (const CRYPTO_IVEC &aadvec : aadvecs) {
+    SHA256_Update(&ctx, aadvec.in, aadvec.len);
   }
+  SHA256_Update(&ctx, len_header, 2);
 
   // Hash the public minimum length directly. This reduces the number of blocks
   // that must be computed in constant-time.
-  SHA256_Update(&ctx, data, min_data_size);
+  for (const CRYPTO_IOVEC &iovec : iovecs_without_trailer) {
+    SHA256_Update(&ctx, iovec.out, iovec.len);
+  }
 
-  // Hash the remaining data without leaking |data_size|.
+  // Hash the remaining data without leaking `data_in_trailer_size`.
   uint8_t mac_out[SHA256_DIGEST_LENGTH];
-  if (!EVP_sha256_final_with_secret_suffix(
-          &ctx, mac_out, data + min_data_size, data_size - min_data_size,
-          data_plus_mac_plus_padding_size - min_data_size)) {
+  if (!EVP_sha256_final_with_secret_suffix(&ctx, mac_out, trailer.data(),
+                                           data_in_trailer_size,
+                                           trailer.size())) {
     return 0;
   }
 
@@ -449,22 +449,22 @@ static int tls_cbc_digest_record_sha256(uint8_t *md_out, size_t *md_out_size,
   return 1;
 }
 
-int EVP_tls_cbc_digest_record(const EVP_MD *md, uint8_t *md_out,
-                              size_t *md_out_size, const uint8_t header[13],
-                              const uint8_t *data, size_t data_size,
-                              size_t data_plus_mac_plus_padding_size,
-                              const uint8_t *mac_secret,
-                              unsigned mac_secret_length) {
+int bssl::EVP_tls_cbc_digest_record(
+    const EVP_MD *md, uint8_t *md_out, size_t *md_out_size,
+    const uint8_t len_header[2], Span<const CRYPTO_IVEC> aadvecs,
+    Span<const CRYPTO_IOVEC> iovecs_without_trailer,
+    Span<const uint8_t> trailer, size_t data_in_trailer_size,
+    const uint8_t *mac_secret, unsigned mac_secret_length) {
   switch (EVP_MD_type(md)) {
     case NID_sha1:
-      return tls_cbc_digest_record_sha1(
-          md_out, md_out_size, header, data, data_size,
-          data_plus_mac_plus_padding_size, mac_secret, mac_secret_length);
+      return tls_cbc_digest_record_sha1(  //
+          md_out, md_out_size, len_header, aadvecs, iovecs_without_trailer,
+          trailer, data_in_trailer_size, mac_secret, mac_secret_length);
 
     case NID_sha256:
-      return tls_cbc_digest_record_sha256(
-          md_out, md_out_size, header, data, data_size,
-          data_plus_mac_plus_padding_size, mac_secret, mac_secret_length);
+      return tls_cbc_digest_record_sha256(  //
+          md_out, md_out_size, len_header, aadvecs, iovecs_without_trailer,
+          trailer, data_in_trailer_size, mac_secret, mac_secret_length);
 
     default:
       // EVP_tls_cbc_record_digest_supported should have been called first to

data/third_party/boringssl-with-bazel/crypto/cms/cms.cc

@@ -20,28 +20,42 @@
 #include <openssl/mem.h>
 #include <openssl/x509.h>
 
+#include "../bytestring/internal.h"
+#include "../internal.h"
+#include "../mem_internal.h"
 #include "../pkcs7/internal.h"
 
 
+using namespace bssl;
+
 // TODO(davidben): Should we move the core PKCS#7 / CMS implementation into
 // crypto/cms instead of crypto/pkcs7? CMS is getting new features while PKCS#7
 // is not.
 OPENSSL_DECLARE_ERROR_REASON(CMS, CERTIFICATE_HAS_NO_KEYID)
 
-struct CMS_SignerInfo_st {
-  X509 *signcert = nullptr;
-  EVP_PKEY *pkey = nullptr;
+DECLARE_OPAQUE_STRUCT(CMS_SignerInfo_st, CMSSignerInfo)
+DECLARE_OPAQUE_STRUCT(CMS_ContentInfo_st, CMSContentInfo)
+
+BSSL_NAMESPACE_BEGIN
+
+class CMSSignerInfo : public CMS_SignerInfo_st {
+ public:
+  UniquePtr<X509> signcert;
+  UniquePtr<EVP_PKEY> pkey;
   const EVP_MD *md = nullptr;
   bool use_key_id = false;
 };
 
-struct CMS_ContentInfo_st {
+class CMSContentInfo : public CMS_ContentInfo_st {
+ public:
+  static constexpr bool kAllowUniquePtr = true;
   bool has_signer_info = false;
-  CMS_SignerInfo signer_info;
-  uint8_t *der = nullptr;
-  size_t der_len = 0;
+  CMSSignerInfo signer_info;
+  Array<uint8_t> der;
 };
 
+BSSL_NAMESPACE_END
+
 CMS_ContentInfo *CMS_sign(X509 *signcert, EVP_PKEY *pkey, STACK_OF(X509) *certs,
                           BIO *data, uint32_t flags) {
   // We only support external signatures and do not support embedding
@@ -51,8 +65,7 @@ CMS_ContentInfo *CMS_sign(X509 *signcert, EVP_PKEY *pkey, STACK_OF(X509) *certs,
     return nullptr;
   }
 
-  bssl::UniquePtr<CMS_ContentInfo> cms(
-      static_cast<CMS_ContentInfo *>(OPENSSL_zalloc(sizeof(CMS_ContentInfo))));
+  UniquePtr<CMSContentInfo> cms = MakeUnique<CMSContentInfo>();
   if (cms == nullptr) {
     return nullptr;
   }
@@ -62,37 +75,27 @@ CMS_ContentInfo *CMS_sign(X509 *signcert, EVP_PKEY *pkey, STACK_OF(X509) *certs,
     return nullptr;
   }
 
-  // We don't actually use streaming mode, but Linux passes |CMS_STREAM| to
-  // |CMS_sign| and OpenSSL interprets it as an alias for |CMS_PARTIAL| in this
+  // We don't actually use streaming mode, but Linux passes `CMS_STREAM` to
+  // `CMS_sign` and OpenSSL interprets it as an alias for `CMS_PARTIAL` in this
   // context.
   if ((flags & (CMS_PARTIAL | CMS_STREAM)) == 0 &&
-      !CMS_final(cms.get(), data, NULL, flags)) {
+      !CMS_final(cms.get(), data, nullptr, flags)) {
     return nullptr;
   }
 
   return cms.release();
 }
 
-void CMS_ContentInfo_free(CMS_ContentInfo *cms) {
-  if (cms == nullptr) {
-    return;
-  }
-  X509_free(cms->signer_info.signcert);
-  EVP_PKEY_free(cms->signer_info.pkey);
-  OPENSSL_free(cms->der);
-  OPENSSL_free(cms);
-}
+void CMS_ContentInfo_free(CMS_ContentInfo *cms) { Delete(FromOpaque(cms)); }
 
 CMS_SignerInfo *CMS_add1_signer(CMS_ContentInfo *cms, X509 *signcert,
                                 EVP_PKEY *pkey, const EVP_MD *md,
                                 uint32_t flags) {
+  auto *impl = FromOpaque(cms);
   if (  // Already finalized.
-      cms->der_len != 0 ||
+      !impl->der.empty() ||
       // We only support one signer.
-      cms->has_signer_info ||
-      // We do not support configuring a signer in multiple steps. (In OpenSSL,
-      // this is used to configure attributes.
-      (flags & CMS_PARTIAL) != 0 ||
+      impl->has_signer_info ||
       // We do not support embedding certificates in SignedData.
       (flags & CMS_NOCERTS) == 0 ||
       // We do not support attributes in SignedData.
@@ -117,34 +120,36 @@ CMS_SignerInfo *CMS_add1_signer(CMS_ContentInfo *cms, X509 *signcert,
   }
 
   // Save information for later.
-  cms->has_signer_info = true;
-  cms->signer_info.signcert = bssl::UpRef(signcert).release();
-  cms->signer_info.pkey = bssl::UpRef(pkey).release();
-  cms->signer_info.md = md;
-  cms->signer_info.use_key_id = (flags & CMS_USE_KEYID) != 0;
-  return &cms->signer_info;
+  impl->has_signer_info = true;
+  impl->signer_info.signcert = UpRef(signcert);
+  impl->signer_info.pkey = UpRef(pkey);
+  impl->signer_info.md = md;
+  impl->signer_info.use_key_id = (flags & CMS_USE_KEYID) != 0;
+  return &impl->signer_info;
 }
 
 int CMS_final(CMS_ContentInfo *cms, BIO *data, BIO *dcont, uint32_t flags) {
+  auto *impl = FromOpaque(cms);
   if (  // Already finalized.
-      cms->der_len != 0 ||
+      !impl->der.empty() ||
       // Require a SignerInfo. We do not support signature-less SignedDatas.
-      !cms->has_signer_info ||
+      !impl->has_signer_info ||
       // We only support the straightforward passthrough mode, without S/MIME
       // translations.
       (flags & CMS_BINARY) == 0 ||
-      // We do not support |dcont|. It is unclear what it does.
+      // We do not support `dcont`. It is unclear what it does.
       dcont != nullptr) {
     OPENSSL_PUT_ERROR(CMS, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
     return 0;
   }
 
-  bssl::ScopedCBB cbb;
+  ScopedCBB cbb;
   if (!CBB_init(cbb.get(), 2048) ||
-      !pkcs7_add_external_signature(cbb.get(), cms->signer_info.signcert,
-                                    cms->signer_info.pkey, cms->signer_info.md,
-                                    data, cms->signer_info.use_key_id) ||
-      !CBB_finish(cbb.get(), &cms->der, &cms->der_len)) {
+      !pkcs7_add_external_signature(cbb.get(), impl->signer_info.signcert.get(),
+                                    impl->signer_info.pkey.get(),
+                                    impl->signer_info.md, data,
+                                    impl->signer_info.use_key_id) ||
+      !CBBFinishArray(cbb.get(), &impl->der)) {
     return 0;
   }
 
@@ -152,13 +157,14 @@ int CMS_final(CMS_ContentInfo *cms, BIO *data, BIO *dcont, uint32_t flags) {
 }
 
 int i2d_CMS_bio(BIO *out, CMS_ContentInfo *cms) {
-  if (cms->der_len == 0) {
+  auto *impl = FromOpaque(cms);
+  if (impl->der.empty()) {
     // Not yet finalized.
     OPENSSL_PUT_ERROR(CMS, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
     return 0;
   }
 
-  return BIO_write_all(out, cms->der, cms->der_len);
+  return BIO_write_all(out, impl->der.data(), impl->der.size());
 }
 
 int i2d_CMS_bio_stream(BIO *out, CMS_ContentInfo *cms, BIO *in, int flags) {