grpc 1.84.0 → 1.85.0.pre1

data/third_party/boringssl-with-bazel/crypto/rsa/rsa_asn1.cc

@@ -20,25 +20,32 @@
 
 #include <openssl/bn.h>
 #include <openssl/bytestring.h>
+#include <openssl/digest.h>
 #include <openssl/err.h>
 #include <openssl/mem.h>
+#include <openssl/nid.h>
+#include <openssl/span.h>
+#include <openssl/x509.h>
 
-#include "../fipsmodule/rsa/internal.h"
 #include "../bytestring/internal.h"
+#include "../fipsmodule/rsa/internal.h"
 #include "../internal.h"
+#include "internal.h"
 
 
-static int parse_integer(CBS *cbs, BIGNUM **out) {
-  assert(*out == NULL);
-  *out = BN_new();
-  if (*out == NULL) {
+using namespace bssl;
+
+static int parse_integer(CBS *cbs, UniquePtr<BIGNUM> *out) {
+  assert(*out == nullptr);
+  out->reset(BN_new());
+  if (*out == nullptr) {
     return 0;
   }
-  return BN_parse_asn1_unsigned(cbs, *out);
+  return BN_parse_asn1_unsigned(cbs, out->get());
 }
 
-static int marshal_integer(CBB *cbb, BIGNUM *bn) {
-  if (bn == NULL) {
+static int marshal_integer(CBB *cbb, const BIGNUM *bn) {
+  if (bn == nullptr) {
     // An RSA object may be missing some components.
     OPENSSL_PUT_ERROR(RSA, RSA_R_VALUE_MISSING);
     return 0;
@@ -47,9 +54,9 @@ static int marshal_integer(CBB *cbb, BIGNUM *bn) {
 }
 
 RSA *RSA_parse_public_key(CBS *cbs) {
-  RSA *ret = RSA_new();
-  if (ret == NULL) {
-    return NULL;
+  RSAImpl *ret = FromOpaque(RSA_new());
+  if (ret == nullptr) {
+    return nullptr;
   }
   CBS child;
   if (!CBS_get_asn1(cbs, &child, CBS_ASN1_SEQUENCE) ||
@@ -58,13 +65,13 @@ RSA *RSA_parse_public_key(CBS *cbs) {
       CBS_len(&child) != 0) {
     OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_ENCODING);
     RSA_free(ret);
-    return NULL;
+    return nullptr;
   }
 
   if (!RSA_check_key(ret)) {
     OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_RSA_PARAMETERS);
     RSA_free(ret);
-    return NULL;
+    return nullptr;
   }
 
   return ret;
@@ -74,19 +81,20 @@ RSA *RSA_public_key_from_bytes(const uint8_t *in, size_t in_len) {
   CBS cbs;
   CBS_init(&cbs, in, in_len);
   RSA *ret = RSA_parse_public_key(&cbs);
-  if (ret == NULL || CBS_len(&cbs) != 0) {
+  if (ret == nullptr || CBS_len(&cbs) != 0) {
     OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_ENCODING);
     RSA_free(ret);
-    return NULL;
+    return nullptr;
   }
   return ret;
 }
 
 int RSA_marshal_public_key(CBB *cbb, const RSA *rsa) {
   CBB child;
+  const RSAImpl *impl = FromOpaque(rsa);
   if (!CBB_add_asn1(cbb, &child, CBS_ASN1_SEQUENCE) ||
-      !marshal_integer(&child, rsa->n) ||
-      !marshal_integer(&child, rsa->e) ||
+      !marshal_integer(&child, impl->n.get()) ||
+      !marshal_integer(&child, impl->e.get()) ||  //
       !CBB_flush(cbb)) {
     OPENSSL_PUT_ERROR(RSA, RSA_R_ENCODE_ERROR);
     return 0;
@@ -109,13 +117,13 @@ int RSA_public_key_to_bytes(uint8_t **out_bytes, size_t *out_len,
 }
 
 // kVersionTwoPrime is the value of the version field for a two-prime
-// RSAPrivateKey structure (RFC 3447).
+// RSAPrivateKey structure (RFC 8017).
 static const uint64_t kVersionTwoPrime = 0;
 
 RSA *RSA_parse_private_key(CBS *cbs) {
-  RSA *ret = RSA_new();
-  if (ret == NULL) {
-    return NULL;
+  RSAImpl *ret = FromOpaque(RSA_new());
+  if (ret == nullptr) {
+    return nullptr;
   }
 
   CBS child;
@@ -156,33 +164,34 @@ RSA *RSA_parse_private_key(CBS *cbs) {
 
 err:
   RSA_free(ret);
-  return NULL;
+  return nullptr;
 }
 
 RSA *RSA_private_key_from_bytes(const uint8_t *in, size_t in_len) {
   CBS cbs;
   CBS_init(&cbs, in, in_len);
   RSA *ret = RSA_parse_private_key(&cbs);
-  if (ret == NULL || CBS_len(&cbs) != 0) {
+  if (ret == nullptr || CBS_len(&cbs) != 0) {
     OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_ENCODING);
     RSA_free(ret);
-    return NULL;
+    return nullptr;
   }
   return ret;
 }
 
 int RSA_marshal_private_key(CBB *cbb, const RSA *rsa) {
+  const RSAImpl *impl = FromOpaque(rsa);
   CBB child;
   if (!CBB_add_asn1(cbb, &child, CBS_ASN1_SEQUENCE) ||
       !CBB_add_asn1_uint64(&child, kVersionTwoPrime) ||
-      !marshal_integer(&child, rsa->n) ||
-      !marshal_integer(&child, rsa->e) ||
-      !marshal_integer(&child, rsa->d) ||
-      !marshal_integer(&child, rsa->p) ||
-      !marshal_integer(&child, rsa->q) ||
-      !marshal_integer(&child, rsa->dmp1) ||
-      !marshal_integer(&child, rsa->dmq1) ||
-      !marshal_integer(&child, rsa->iqmp) ||
+      !marshal_integer(&child, impl->n.get()) ||
+      !marshal_integer(&child, impl->e.get()) ||
+      !marshal_integer(&child, impl->d.get()) ||
+      !marshal_integer(&child, impl->p.get()) ||
+      !marshal_integer(&child, impl->q.get()) ||
+      !marshal_integer(&child, impl->dmp1.get()) ||
+      !marshal_integer(&child, impl->dmq1.get()) ||
+      !marshal_integer(&child, impl->iqmp.get()) ||  //
       !CBB_flush(cbb)) {
     OPENSSL_PUT_ERROR(RSA, RSA_R_ENCODE_ERROR);
     return 0;
@@ -205,66 +214,30 @@ int RSA_private_key_to_bytes(uint8_t **out_bytes, size_t *out_len,
 }
 
 RSA *d2i_RSAPublicKey(RSA **out, const uint8_t **inp, long len) {
-  if (len < 0) {
-    return NULL;
-  }
-  CBS cbs;
-  CBS_init(&cbs, *inp, (size_t)len);
-  RSA *ret = RSA_parse_public_key(&cbs);
-  if (ret == NULL) {
-    return NULL;
-  }
-  if (out != NULL) {
-    RSA_free(*out);
-    *out = ret;
-  }
-  *inp = CBS_data(&cbs);
-  return ret;
+  return D2IFromCBS(out, inp, len, RSA_parse_public_key);
 }
 
 int i2d_RSAPublicKey(const RSA *in, uint8_t **outp) {
-  CBB cbb;
-  if (!CBB_init(&cbb, 0) ||
-      !RSA_marshal_public_key(&cbb, in)) {
-    CBB_cleanup(&cbb);
-    return -1;
-  }
-  return CBB_finish_i2d(&cbb, outp);
+  return I2DFromCBB(
+      /*initial_capacity=*/256, outp,
+      [&](CBB *cbb) -> bool { return RSA_marshal_public_key(cbb, in); });
 }
 
 RSA *d2i_RSAPrivateKey(RSA **out, const uint8_t **inp, long len) {
-  if (len < 0) {
-    return NULL;
-  }
-  CBS cbs;
-  CBS_init(&cbs, *inp, (size_t)len);
-  RSA *ret = RSA_parse_private_key(&cbs);
-  if (ret == NULL) {
-    return NULL;
-  }
-  if (out != NULL) {
-    RSA_free(*out);
-    *out = ret;
-  }
-  *inp = CBS_data(&cbs);
-  return ret;
+  return D2IFromCBS(out, inp, len, RSA_parse_private_key);
 }
 
 int i2d_RSAPrivateKey(const RSA *in, uint8_t **outp) {
-  CBB cbb;
-  if (!CBB_init(&cbb, 0) ||
-      !RSA_marshal_private_key(&cbb, in)) {
-    CBB_cleanup(&cbb);
-    return -1;
-  }
-  return CBB_finish_i2d(&cbb, outp);
+  return I2DFromCBB(
+      /*initial_capacity=*/512, outp,
+      [&](CBB *cbb) -> bool { return RSA_marshal_private_key(cbb, in); });
 }
 
 RSA *RSAPublicKey_dup(const RSA *rsa) {
   uint8_t *der;
   size_t der_len;
   if (!RSA_public_key_to_bytes(&der, &der_len, rsa)) {
-    return NULL;
+    return nullptr;
   }
   RSA *ret = RSA_public_key_from_bytes(der, der_len);
   OPENSSL_free(der);
@@ -275,9 +248,157 @@ RSA *RSAPrivateKey_dup(const RSA *rsa) {
   uint8_t *der;
   size_t der_len;
   if (!RSA_private_key_to_bytes(&der, &der_len, rsa)) {
-    return NULL;
+    return nullptr;
   }
   RSA *ret = RSA_private_key_from_bytes(der, der_len);
   OPENSSL_free(der);
   return ret;
 }
+
+static const uint8_t kPSSParamsSHA256[] = {
+    0x30, 0x34, 0xa0, 0x0f, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48,
+    0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x05, 0x00, 0xa1, 0x1c, 0x30,
+    0x1a, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01,
+    0x08, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03,
+    0x04, 0x02, 0x01, 0x05, 0x00, 0xa2, 0x03, 0x02, 0x01, 0x20};
+
+static const uint8_t kPSSParamsSHA384[] = {
+    0x30, 0x34, 0xa0, 0x0f, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48,
+    0x01, 0x65, 0x03, 0x04, 0x02, 0x02, 0x05, 0x00, 0xa1, 0x1c, 0x30,
+    0x1a, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01,
+    0x08, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03,
+    0x04, 0x02, 0x02, 0x05, 0x00, 0xa2, 0x03, 0x02, 0x01, 0x30};
+
+static const uint8_t kPSSParamsSHA512[] = {
+    0x30, 0x34, 0xa0, 0x0f, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48,
+    0x01, 0x65, 0x03, 0x04, 0x02, 0x03, 0x05, 0x00, 0xa1, 0x1c, 0x30,
+    0x1a, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01,
+    0x08, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03,
+    0x04, 0x02, 0x03, 0x05, 0x00, 0xa2, 0x03, 0x02, 0x01, 0x40};
+
+const EVP_MD *bssl::rsa_pss_params_get_md(rsa_pss_params_t params) {
+  switch (params) {
+    case rsa_pss_none:
+      return nullptr;
+    case rsa_pss_sha256:
+      return EVP_sha256();
+    case rsa_pss_sha384:
+      return EVP_sha384();
+    case rsa_pss_sha512:
+      return EVP_sha512();
+  }
+  abort();
+}
+
+int bssl::rsa_marshal_pss_params(CBB *cbb, rsa_pss_params_t params) {
+  Span<const uint8_t> bytes;
+  switch (params) {
+    case rsa_pss_none:
+      OPENSSL_PUT_ERROR(RSA, ERR_R_INTERNAL_ERROR);
+      return 0;
+    case rsa_pss_sha256:
+      bytes = kPSSParamsSHA256;
+      break;
+    case rsa_pss_sha384:
+      bytes = kPSSParamsSHA384;
+      break;
+    case rsa_pss_sha512:
+      bytes = kPSSParamsSHA512;
+      break;
+  }
+
+  return CBB_add_bytes(cbb, bytes.data(), bytes.size());
+}
+
+// 1.2.840.113549.1.1.8
+static const uint8_t kMGF1OID[] = {0x2a, 0x86, 0x48, 0x86, 0xf7,
+                                   0x0d, 0x01, 0x01, 0x08};
+
+int bssl::rsa_parse_pss_params(CBS *cbs, rsa_pss_params_t *out,
+                               int allow_explicit_trailer) {
+  // See RFC 4055, section 3.1.
+  //
+  // hashAlgorithm, maskGenAlgorithm, and saltLength all have DEFAULTs
+  // corresponding to SHA-1. We do not support SHA-1 with PSS, so we do not
+  // bother recognizing the omitted versions.
+  CBS params, hash_wrapper, mask_wrapper, mask_alg, mask_oid, salt_wrapper;
+  uint64_t salt_len;
+  if (!CBS_get_asn1(cbs, &params, CBS_ASN1_SEQUENCE) ||
+      !CBS_get_asn1(&params, &hash_wrapper,
+                    CBS_ASN1_CONSTRUCTED | CBS_ASN1_CONTEXT_SPECIFIC | 0) ||
+      // `hash_wrapper` will be parsed below.
+      !CBS_get_asn1(&params, &mask_wrapper,
+                    CBS_ASN1_CONSTRUCTED | CBS_ASN1_CONTEXT_SPECIFIC | 1) ||
+      !CBS_get_asn1(&mask_wrapper, &mask_alg, CBS_ASN1_SEQUENCE) ||
+      !CBS_get_asn1(&mask_alg, &mask_oid, CBS_ASN1_OBJECT) ||
+      // We only support MGF-1.
+      Span<const uint8_t>(mask_oid) != kMGF1OID ||
+      // The remainder of `mask_alg` will be parsed below.
+      CBS_len(&mask_wrapper) != 0 ||
+      !CBS_get_asn1(&params, &salt_wrapper,
+                    CBS_ASN1_CONSTRUCTED | CBS_ASN1_CONTEXT_SPECIFIC | 2) ||
+      !CBS_get_asn1_uint64(&salt_wrapper, &salt_len) ||
+      CBS_len(&salt_wrapper) != 0) {
+    OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_ENCODING);
+    return 0;
+  }
+
+  // The trailer field must be 1 (0xbc). This value is DEFAULT, so the structure
+  // is required to omit it in DER.
+  if (CBS_len(&params) != 0 && allow_explicit_trailer) {
+    CBS trailer_wrapper;
+    uint64_t trailer;
+    if (!CBS_get_asn1(&params, &trailer_wrapper,
+                      CBS_ASN1_CONSTRUCTED | CBS_ASN1_CONTEXT_SPECIFIC | 3) ||
+        !CBS_get_asn1_uint64(&trailer_wrapper, &trailer) ||  //
+        trailer != 1) {
+      OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_ENCODING);
+      return 0;
+    }
+  }
+  if (CBS_len(&params) != 0) {
+    OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_ENCODING);
+    return 0;
+  }
+
+  int hash_nid = EVP_parse_digest_algorithm_nid(&hash_wrapper);
+  if (hash_nid == NID_undef || CBS_len(&hash_wrapper) != 0) {
+    OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_ENCODING);
+    return 0;
+  }
+
+  // We only support combinations where the MGF-1 hash matches the overall hash.
+  int mgf1_hash_nid = EVP_parse_digest_algorithm_nid(&mask_alg);
+  if (mgf1_hash_nid != hash_nid || CBS_len(&mask_alg) != 0) {
+    OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_ENCODING);
+    return 0;
+  }
+
+  // We only support salt lengths that match the hash length.
+  rsa_pss_params_t ret;
+  uint64_t hash_len;
+  switch (hash_nid) {
+    case NID_sha256:
+      ret = rsa_pss_sha256;
+      hash_len = 32;
+      break;
+    case NID_sha384:
+      ret = rsa_pss_sha384;
+      hash_len = 48;
+      break;
+    case NID_sha512:
+      ret = rsa_pss_sha512;
+      hash_len = 64;
+      break;
+    default:
+      OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_ENCODING);
+      return 0;
+  }
+  if (salt_len != hash_len) {
+    OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_ENCODING);
+    return 0;
+  }
+
+  *out = ret;
+  return 1;
+}

data/third_party/boringssl-with-bazel/crypto/rsa/rsa_crypt.cc

@@ -29,6 +29,8 @@
 #include "internal.h"
 
 
+using namespace bssl;
+
 static void rand_nonzero(uint8_t *out, size_t len) {
   RAND_bytes(out, len);
 
@@ -45,10 +47,10 @@ int RSA_padding_add_PKCS1_OAEP_mgf1(uint8_t *to, size_t to_len,
                                     const uint8_t *from, size_t from_len,
                                     const uint8_t *param, size_t param_len,
                                     const EVP_MD *md, const EVP_MD *mgf1md) {
-  if (md == NULL) {
+  if (md == nullptr) {
     md = EVP_sha1();
   }
-  if (mgf1md == NULL) {
+  if (mgf1md == nullptr) {
     mgf1md = md;
   }
 
@@ -74,9 +76,9 @@ int RSA_padding_add_PKCS1_OAEP_mgf1(uint8_t *to, size_t to_len,
   uint8_t *seed = to + 1;
   uint8_t *db = to + mdlen + 1;
 
-  uint8_t *dbmask = NULL;
+  uint8_t *dbmask = nullptr;
   int ret = 0;
-  if (!EVP_Digest(param, param_len, db, NULL, md, NULL)) {
+  if (!EVP_Digest(param, param_len, db, nullptr, md, nullptr)) {
     goto out;
   }
   OPENSSL_memset(db + mdlen, 0, emlen - from_len - 2 * mdlen - 1);
@@ -87,7 +89,7 @@ int RSA_padding_add_PKCS1_OAEP_mgf1(uint8_t *to, size_t to_len,
   }
 
   dbmask = reinterpret_cast<uint8_t *>(OPENSSL_malloc(emlen - mdlen));
-  if (dbmask == NULL) {
+  if (dbmask == nullptr) {
     goto out;
   }
 
@@ -112,18 +114,19 @@ out:
   return ret;
 }
 
-int RSA_padding_check_PKCS1_OAEP_mgf1(uint8_t *out, size_t *out_len,
-                                      size_t max_out, const uint8_t *from,
-                                      size_t from_len, const uint8_t *param,
-                                      size_t param_len, const EVP_MD *md,
-                                      const EVP_MD *mgf1md) {
-  uint8_t *db = NULL;
+int bssl::RSA_padding_check_PKCS1_OAEP_mgf1(uint8_t *out, size_t *out_len,
+                                            size_t max_out, const uint8_t *from,
+                                            size_t from_len,
+                                            const uint8_t *param,
+                                            size_t param_len, const EVP_MD *md,
+                                            const EVP_MD *mgf1md) {
+  uint8_t *db = nullptr;
 
   {
-    if (md == NULL) {
+    if (md == nullptr) {
       md = EVP_sha1();
     }
-    if (mgf1md == NULL) {
+    if (mgf1md == nullptr) {
       mgf1md = md;
     }
 
@@ -140,7 +143,7 @@ int RSA_padding_check_PKCS1_OAEP_mgf1(uint8_t *out, size_t *out_len,
 
     size_t dblen = from_len - mdlen - 1;
     db = reinterpret_cast<uint8_t *>(OPENSSL_malloc(dblen));
-    if (db == NULL) {
+    if (db == nullptr) {
       goto err;
     }
 
@@ -163,7 +166,7 @@ int RSA_padding_check_PKCS1_OAEP_mgf1(uint8_t *out, size_t *out_len,
     }
 
     uint8_t phash[EVP_MAX_MD_SIZE];
-    if (!EVP_Digest(param, param_len, phash, NULL, md, NULL)) {
+    if (!EVP_Digest(param, param_len, phash, nullptr, md, nullptr)) {
       goto err;
     }
 
@@ -251,7 +254,7 @@ static int rsa_padding_check_PKCS1_type_2(uint8_t *out, size_t *out_len,
   // PKCS#1 v1.5 decryption. See "PKCS #1 v2.2: RSA Cryptography
   // Standard", section 7.2.2.
   if (from_len < RSA_PKCS1_PADDING_SIZE) {
-    // |from| is zero-padded to the size of the RSA modulus, a public value, so
+    // `from` is zero-padded to the size of the RSA modulus, a public value, so
     // this can be rejected in non-constant time.
     OPENSSL_PUT_ERROR(RSA, RSA_R_KEY_SIZE_TOO_SMALL);
     return 0;
@@ -275,16 +278,16 @@ static int rsa_padding_check_PKCS1_type_2(uint8_t *out, size_t *out_len,
   // We must have found the end of PS.
   valid_index &= ~looking_for_index;
 
-  // PS must be at least 8 bytes long, and it starts two bytes into |from|.
+  // PS must be at least 8 bytes long, and it starts two bytes into `from`.
   valid_index &= constant_time_ge_w(zero_index, 2 + 8);
 
   // Skip the zero byte.
   zero_index++;
 
   // NOTE: Although this logic attempts to be constant time, the API contracts
-  // of this function and |RSA_decrypt| with |RSA_PKCS1_PADDING| make it
+  // of this function and `RSA_decrypt` with `RSA_PKCS1_PADDING` make it
   // impossible to completely avoid Bleichenbacher's attack. Consumers should
-  // use |RSA_PADDING_NONE| and perform the padding check in constant-time
+  // use `RSA_PADDING_NONE` and perform the padding check in constant-time
   // combined with a swap to a random session key or other mitigation.
   CONSTTIME_DECLASSIFY(&valid_index, sizeof(valid_index));
   CONSTTIME_DECLASSIFY(&zero_index, sizeof(zero_index));
@@ -297,7 +300,7 @@ static int rsa_padding_check_PKCS1_type_2(uint8_t *out, size_t *out_len,
   const size_t msg_len = from_len - zero_index;
   if (msg_len > max_out) {
     // This shouldn't happen because this function is always called with
-    // |max_out| as the key size and |from_len| is bounded by the key size.
+    // `max_out` as the key size and `from_len` is bounded by the key size.
     OPENSSL_PUT_ERROR(RSA, RSA_R_PKCS_DECODING_ERROR);
     return 0;
   }
@@ -339,7 +342,9 @@ int RSA_private_encrypt(size_t flen, const uint8_t *from, uint8_t *to, RSA *rsa,
 
 int RSA_encrypt(RSA *rsa, size_t *out_len, uint8_t *out, size_t max_out,
                 const uint8_t *in, size_t in_len, int padding) {
-  if (rsa->n == NULL || rsa->e == NULL) {
+  auto *impl = FromOpaque(rsa);
+
+  if (impl->n == nullptr || impl->e == nullptr) {
     OPENSSL_PUT_ERROR(RSA, RSA_R_VALUE_MISSING);
     return 0;
   }
@@ -349,25 +354,21 @@ int RSA_encrypt(RSA *rsa, size_t *out_len, uint8_t *out, size_t max_out,
   }
 
   const unsigned rsa_size = RSA_size(rsa);
-  BIGNUM *f, *result;
-  uint8_t *buf = NULL;
-  BN_CTX *ctx = NULL;
-  int i, ret = 0;
-
   if (max_out < rsa_size) {
     OPENSSL_PUT_ERROR(RSA, RSA_R_OUTPUT_BUFFER_TOO_SMALL);
     return 0;
   }
 
-  ctx = BN_CTX_new();
-  if (ctx == NULL) {
-    goto err;
+  UniquePtr<BN_CTX> ctx(BN_CTX_new());
+  if (ctx == nullptr) {
+    return 0;
   }
 
-  BN_CTX_start(ctx);
-  f = BN_CTX_get(ctx);
-  result = BN_CTX_get(ctx);
-  buf = reinterpret_cast<uint8_t *>(OPENSSL_malloc(rsa_size));
+  BN_CTXScope scope(ctx.get());
+  BIGNUM *f = BN_CTX_get(ctx.get());
+  BIGNUM *result = BN_CTX_get(ctx.get());
+  uint8_t *buf = reinterpret_cast<uint8_t *>(OPENSSL_malloc(rsa_size));
+  int i, ret = 0;
   if (!f || !result || !buf) {
     goto err;
   }
@@ -378,8 +379,8 @@ int RSA_encrypt(RSA *rsa, size_t *out_len, uint8_t *out, size_t max_out,
       break;
     case RSA_PKCS1_OAEP_PADDING:
       // Use the default parameters: SHA-1 for both hashes and no label.
-      i = RSA_padding_add_PKCS1_OAEP_mgf1(buf, rsa_size, in, in_len, NULL, 0,
-                                          NULL, NULL);
+      i = RSA_padding_add_PKCS1_OAEP_mgf1(buf, rsa_size, in, in_len, nullptr, 0,
+                                          nullptr, nullptr);
       break;
     case RSA_NO_PADDING:
       i = RSA_padding_add_none(buf, rsa_size, in, in_len);
@@ -393,18 +394,20 @@ int RSA_encrypt(RSA *rsa, size_t *out_len, uint8_t *out, size_t max_out,
     goto err;
   }
 
-  if (BN_bin2bn(buf, rsa_size, f) == NULL) {
+  if (BN_bin2bn(buf, rsa_size, f) == nullptr) {
     goto err;
   }
 
-  if (BN_ucmp(f, rsa->n) >= 0) {
+  if (BN_ucmp(f, impl->n.get()) >= 0) {
     // usually the padding functions would catch this
     OPENSSL_PUT_ERROR(RSA, RSA_R_DATA_TOO_LARGE_FOR_MODULUS);
     goto err;
   }
 
-  if (!BN_MONT_CTX_set_locked(&rsa->mont_n, &rsa->lock, rsa->n, ctx) ||
-      !BN_mod_exp_mont(result, f, rsa->e, &rsa->mont_n->N, ctx, rsa->mont_n)) {
+  if (!BN_MONT_CTX_set_locked(&impl->mont_n, &impl->lock, impl->n.get(),
+                              ctx.get()) ||
+      !BN_mod_exp_mont(result, f, impl->e.get(), &impl->mont_n->N, ctx.get(),
+                       impl->mont_n.get())) {
     goto err;
   }
 
@@ -419,12 +422,7 @@ int RSA_encrypt(RSA *rsa, size_t *out_len, uint8_t *out, size_t max_out,
   ret = 1;
 
 err:
-  if (ctx != NULL) {
-    BN_CTX_end(ctx);
-    BN_CTX_free(ctx);
-  }
   OPENSSL_free(buf);
-
   return ret;
 }
 
@@ -432,7 +430,7 @@ static int rsa_default_decrypt(RSA *rsa, size_t *out_len, uint8_t *out,
                                size_t max_out, const uint8_t *in, size_t in_len,
                                int padding) {
   const unsigned rsa_size = RSA_size(rsa);
-  uint8_t *buf = NULL;
+  uint8_t *buf = nullptr;
   int ret = 0;
 
   if (max_out < rsa_size) {
@@ -445,7 +443,7 @@ static int rsa_default_decrypt(RSA *rsa, size_t *out_len, uint8_t *out,
   } else {
     // Allocate a temporary buffer to hold the padded plaintext.
     buf = reinterpret_cast<uint8_t *>(OPENSSL_malloc(rsa_size));
-    if (buf == NULL) {
+    if (buf == nullptr) {
       goto err;
     }
   }
@@ -466,8 +464,8 @@ static int rsa_default_decrypt(RSA *rsa, size_t *out_len, uint8_t *out,
       break;
     case RSA_PKCS1_OAEP_PADDING:
       // Use the default parameters: SHA-1 for both hashes and no label.
-      ret = RSA_padding_check_PKCS1_OAEP_mgf1(out, out_len, rsa_size, buf,
-                                              rsa_size, NULL, 0, NULL, NULL);
+      ret = RSA_padding_check_PKCS1_OAEP_mgf1(
+          out, out_len, rsa_size, buf, rsa_size, nullptr, 0, nullptr, nullptr);
       break;
     case RSA_NO_PADDING:
       *out_len = rsa_size;
@@ -495,8 +493,9 @@ err:
 
 int RSA_decrypt(RSA *rsa, size_t *out_len, uint8_t *out, size_t max_out,
                 const uint8_t *in, size_t in_len, int padding) {
-  if (rsa->meth->decrypt) {
-    return rsa->meth->decrypt(rsa, out_len, out, max_out, in, in_len, padding);
+  auto *impl = FromOpaque(rsa);
+  if (impl->meth->decrypt) {
+    return impl->meth->decrypt(rsa, out_len, out, max_out, in, in_len, padding);
   }
 
   return rsa_default_decrypt(rsa, out_len, out, max_out, in, in_len, padding);

data/third_party/boringssl-with-bazel/crypto/rsa/rsa_extra.cc

@@ -17,3 +17,14 @@
 int RSA_blinding_on(RSA *rsa, BN_CTX *ctx) { return 1; }
 
 void RSA_blinding_off(RSA *rsa) {}
+
+const RSA_PSS_PARAMS *RSA_get0_pss_params(const RSA *rsa) {
+  // We do not currently implement this function. By default, we will not parse
+  // `EVP_PKEY_RSA_PSS`. Callers that opt in with a BoringSSL-specific API are
+  // currently assumed to not need this function. Callers that need that opt-in
+  // and this functionality should contact the BoringSSL team.
+  //
+  // If we do add support later, the `maskHash` field should be filled in for
+  // OpenSSL compatibility.
+  return nullptr;
+}

data/third_party/boringssl-with-bazel/crypto/rsa/rsa_print.cc

@@ -18,10 +18,8 @@
 
 
 int RSA_print(BIO *bio, const RSA *rsa, int indent) {
-  EVP_PKEY *pkey = EVP_PKEY_new();
-  int ret = pkey != NULL &&
-            EVP_PKEY_set1_RSA(pkey, (RSA *)rsa) &&
-            EVP_PKEY_print_private(bio, pkey, indent, NULL);
-  EVP_PKEY_free(pkey);
-  return ret;
+  bssl::UniquePtr<EVP_PKEY> pkey(EVP_PKEY_new());
+  return pkey != nullptr &&
+         EVP_PKEY_set1_RSA(pkey.get(), const_cast<RSA *>(rsa)) &&
+         EVP_PKEY_print_private(bio, pkey.get(), indent, nullptr);
 }

data/third_party/boringssl-with-bazel/crypto/sha/sha1.cc

@@ -18,6 +18,9 @@
 
 #include "../fipsmodule/bcm_interface.h"
 
+
+using namespace bssl;
+
 int SHA1_Init(SHA_CTX *sha) {
   BCM_sha1_init(sha);
   return 1;