grpc 1.84.0 → 1.85.0.pre1

data/third_party/boringssl-with-bazel/crypto/x509/a_verify.cc

@@ -17,58 +17,54 @@
 #include <stdio.h>
 #include <sys/types.h>
 
+#include <openssl/asn1.h>
 #include <openssl/bn.h>
 #include <openssl/digest.h>
 #include <openssl/err.h>
 #include <openssl/evp.h>
 #include <openssl/mem.h>
 #include <openssl/obj.h>
+#include <openssl/span.h>
 
 #include "internal.h"
 
-int ASN1_item_verify(const ASN1_ITEM *it, const X509_ALGOR *a,
-                     const ASN1_BIT_STRING *signature, void *asn,
-                     EVP_PKEY *pkey) {
+
+using namespace bssl;
+
+int bssl::x509_verify_signature(const X509_ALGOR *sigalg,
+                                const ASN1_BIT_STRING *signature,
+                                Span<const uint8_t> in, EVP_PKEY *pkey) {
   if (!pkey) {
     OPENSSL_PUT_ERROR(X509, ERR_R_PASSED_NULL_PARAMETER);
     return 0;
   }
 
-  size_t sig_len;
-  if (signature->type == V_ASN1_BIT_STRING) {
-    if (!ASN1_BIT_STRING_num_bytes(signature, &sig_len)) {
-      OPENSSL_PUT_ERROR(X509, X509_R_INVALID_BIT_STRING_BITS_LEFT);
-      return 0;
-    }
-  } else {
-    sig_len = (size_t)ASN1_STRING_length(signature);
-  }
-
-  EVP_MD_CTX ctx;
-  uint8_t *buf_in = NULL;
-  int ret = 0, inl = 0;
-  EVP_MD_CTX_init(&ctx);
-
-  if (!x509_digest_verify_init(&ctx, a, pkey)) {
-    goto err;
+  if (signature->type == V_ASN1_BIT_STRING &&
+      ASN1_BIT_STRING_unused_bits(signature) != 0) {
+    OPENSSL_PUT_ERROR(X509, X509_R_INVALID_BIT_STRING_BITS_LEFT);
+    return 0;
   }
 
-  inl = ASN1_item_i2d(reinterpret_cast<ASN1_VALUE *>(asn), &buf_in, it);
-
-  if (buf_in == NULL) {
-    goto err;
+  ScopedEVP_MD_CTX ctx;
+  if (!x509_digest_verify_init(ctx.get(), sigalg, pkey)) {
+    return 0;
   }
-
-  if (!EVP_DigestVerify(&ctx, ASN1_STRING_get0_data(signature), sig_len, buf_in,
-                        inl)) {
+  if (!EVP_DigestVerify(ctx.get(), ASN1_STRING_get0_data(signature),
+                        ASN1_STRING_length(signature), in.data(), in.size())) {
     OPENSSL_PUT_ERROR(X509, ERR_R_EVP_LIB);
-    goto err;
+    return 0;
   }
+  return 1;
+}
 
-  ret = 1;
-
-err:
-  OPENSSL_free(buf_in);
-  EVP_MD_CTX_cleanup(&ctx);
-  return ret;
+int ASN1_item_verify(const ASN1_ITEM *it, const X509_ALGOR *sigalg,
+                     const ASN1_BIT_STRING *signature, void *asn,
+                     EVP_PKEY *pkey) {
+  uint8_t *in = nullptr;
+  int in_len = ASN1_item_i2d(reinterpret_cast<ASN1_VALUE *>(asn), &in, it);
+  if (in_len < 0) {
+    return 0;
+  }
+  UniquePtr<uint8_t> free_in(in);
+  return x509_verify_signature(sigalg, signature, Span(in, in_len), pkey);
 }

data/third_party/boringssl-with-bazel/crypto/x509/algorithm.cc

@@ -22,6 +22,14 @@
 
 #include "internal.h"
 
+
+using namespace bssl;
+
+// TODO(crbug.com/42290422): Rewrite this logic to recognize signature
+// algorithms without pulling in the OID table. We can enumerate every supported
+// signature algorithm into a small enum and convert them to/from `EVP_PKEY_CTX`
+// and `X509_ALGOR`.
+
 // Restrict the digests that are allowed in X509 certificates
 static int x509_digest_nid_ok(const int digest_nid) {
   switch (digest_nid) {
@@ -32,14 +40,15 @@ static int x509_digest_nid_ok(const int digest_nid) {
   return 1;
 }
 
-int x509_digest_sign_algorithm(EVP_MD_CTX *ctx, X509_ALGOR *algor) {
+int bssl::x509_digest_sign_algorithm(EVP_MD_CTX *ctx, X509_ALGOR *algor) {
   EVP_PKEY *pkey = EVP_PKEY_CTX_get0_pkey(ctx->pctx);
-  if (pkey == NULL) {
+  if (pkey == nullptr) {
     OPENSSL_PUT_ERROR(ASN1, ASN1_R_CONTEXT_NOT_INITIALISED);
     return 0;
   }
 
-  if (EVP_PKEY_id(pkey) == EVP_PKEY_RSA) {
+  if (EVP_PKEY_id(pkey) == EVP_PKEY_RSA ||
+      EVP_PKEY_id(pkey) == EVP_PKEY_RSA_PSS) {
     int pad_mode;
     if (!EVP_PKEY_CTX_get_rsa_padding(ctx->pctx, &pad_mode)) {
       return 0;
@@ -50,14 +59,30 @@ int x509_digest_sign_algorithm(EVP_MD_CTX *ctx, X509_ALGOR *algor) {
     }
   }
 
-  if (EVP_PKEY_id(pkey) == EVP_PKEY_ED25519) {
-    return X509_ALGOR_set0(algor, OBJ_nid2obj(NID_ED25519), V_ASN1_UNDEF, NULL);
+  // Check for signing algorithms with an internal hash.
+  ASN1_OBJECT *algo_obj = nullptr;
+  switch (EVP_PKEY_id(pkey)) {
+    case EVP_PKEY_ED25519:
+      algo_obj = OBJ_nid2obj(NID_ED25519);
+      break;
+    case EVP_PKEY_ML_DSA_44:
+      algo_obj = OBJ_nid2obj(NID_ML_DSA_44);
+      break;
+    case EVP_PKEY_ML_DSA_65:
+      algo_obj = OBJ_nid2obj(NID_ML_DSA_65);
+      break;
+    case EVP_PKEY_ML_DSA_87:
+      algo_obj = OBJ_nid2obj(NID_ML_DSA_87);
+      break;
+  }
+  if (algo_obj != nullptr) {
+    return X509_ALGOR_set0(algor, algo_obj, V_ASN1_UNDEF, nullptr);
   }
 
   // Default behavior: look up the OID for the algorithm/hash pair and encode
   // that.
   const EVP_MD *digest = EVP_MD_CTX_get0_md(ctx);
-  if (digest == NULL) {
+  if (digest == nullptr) {
     OPENSSL_PUT_ERROR(ASN1, ASN1_R_CONTEXT_NOT_INITIALISED);
     return 0;
   }
@@ -74,11 +99,11 @@ int x509_digest_sign_algorithm(EVP_MD_CTX *ctx, X509_ALGOR *algor) {
   // it.
   int paramtype =
       (EVP_PKEY_id(pkey) == EVP_PKEY_RSA) ? V_ASN1_NULL : V_ASN1_UNDEF;
-  return X509_ALGOR_set0(algor, OBJ_nid2obj(sign_nid), paramtype, NULL);
+  return X509_ALGOR_set0(algor, OBJ_nid2obj(sign_nid), paramtype, nullptr);
 }
 
-int x509_digest_verify_init(EVP_MD_CTX *ctx, const X509_ALGOR *sigalg,
-                            EVP_PKEY *pkey) {
+int bssl::x509_digest_verify_init(EVP_MD_CTX *ctx, const X509_ALGOR *sigalg,
+                                  EVP_PKEY *pkey) {
   // Convert the signature OID into digest and public key OIDs.
   int sigalg_nid = OBJ_obj2nid(sigalg->algorithm);
   int digest_nid, pkey_nid;
@@ -88,7 +113,10 @@ int x509_digest_verify_init(EVP_MD_CTX *ctx, const X509_ALGOR *sigalg,
   }
 
   // Check the public key OID matches the public key type.
-  if (pkey_nid != EVP_PKEY_id(pkey)) {
+  const bool pkey_matches =
+      pkey_nid == EVP_PKEY_id(pkey) ||
+      (sigalg_nid == NID_rsassaPss && EVP_PKEY_id(pkey) == EVP_PKEY_RSA_PSS);
+  if (!pkey_matches) {
     OPENSSL_PUT_ERROR(ASN1, ASN1_R_WRONG_PUBLIC_KEY_TYPE);
     return 0;
   }
@@ -104,12 +132,15 @@ int x509_digest_verify_init(EVP_MD_CTX *ctx, const X509_ALGOR *sigalg,
     if (sigalg_nid == NID_rsassaPss) {
       return x509_rsa_pss_to_ctx(ctx, sigalg, pkey);
     }
-    if (sigalg_nid == NID_ED25519) {
-      if (sigalg->parameter != NULL) {
+    if (sigalg_nid == NID_ED25519 || sigalg_nid == NID_ML_DSA_44 ||
+        sigalg_nid == NID_ML_DSA_65 || sigalg_nid == NID_ML_DSA_87) {
+      // These algorithms require that parameters be absent (Ed25519: RFC 8410
+      // section 3, ML-DSA: RFC 9881 section 2).
+      if (sigalg->parameter != nullptr) {
         OPENSSL_PUT_ERROR(X509, X509_R_INVALID_PARAMETER);
         return 0;
       }
-      return EVP_DigestVerifyInit(ctx, NULL, NULL, NULL, pkey);
+      return EVP_DigestVerifyInit(ctx, nullptr, nullptr, nullptr, pkey);
     }
     OPENSSL_PUT_ERROR(ASN1, ASN1_R_UNKNOWN_SIGNATURE_ALGORITHM);
     return 0;
@@ -120,17 +151,17 @@ int x509_digest_verify_init(EVP_MD_CTX *ctx, const X509_ALGOR *sigalg,
   //
   // TODO(davidben): Chromium's verifier allows both forms for RSA, but enforces
   // ECDSA more strictly. Align with Chromium and add a flag for b/167375496.
-  if (sigalg->parameter != NULL && sigalg->parameter->type != V_ASN1_NULL) {
+  if (sigalg->parameter != nullptr && sigalg->parameter->type != V_ASN1_NULL) {
     OPENSSL_PUT_ERROR(X509, X509_R_INVALID_PARAMETER);
     return 0;
   }
 
   // Otherwise, initialize with the digest from the OID.
   const EVP_MD *digest = EVP_get_digestbynid(digest_nid);
-  if (digest == NULL) {
+  if (digest == nullptr) {
     OPENSSL_PUT_ERROR(ASN1, ASN1_R_UNKNOWN_MESSAGE_DIGEST_ALGORITHM);
     return 0;
   }
 
-  return EVP_DigestVerifyInit(ctx, NULL, digest, NULL, pkey);
+  return EVP_DigestVerifyInit(ctx, nullptr, digest, nullptr, pkey);
 }

data/third_party/boringssl-with-bazel/crypto/x509/asn1_gen.cc

@@ -29,6 +29,8 @@
 #include "internal.h"
 
 
+using namespace bssl;
+
 // Although this file is in crypto/x509 for layering purposes, it emits
 // errors from the ASN.1 module for OpenSSL compatibility.
 
@@ -46,39 +48,35 @@
 #define ASN1_GEN_FORMAT_HEX 3
 #define ASN1_GEN_FORMAT_BITLIST 4
 
-// generate_v3 converts |str| into an ASN.1 structure and writes the result to
-// |cbb|. It returns one on success and zero on error. |depth| bounds recursion,
-// and |format| specifies the current format modifier.
+// generate_v3 converts `str` into an ASN.1 structure and writes the result to
+// `cbb`. It returns one on success and zero on error. `depth` bounds recursion,
+// and `format` specifies the current format modifier.
 //
-// If |tag| is non-zero, the structure is implicitly tagged with |tag|. |tag|
+// If `tag` is non-zero, the structure is implicitly tagged with `tag`. `tag`
 // must not have the constructed bit set.
 static int generate_v3(CBB *cbb, const char *str, const X509V3_CTX *cnf,
                        CBS_ASN1_TAG tag, int format, int depth);
 
 static int bitstr_cb(const char *elem, size_t len, void *bitstr);
 
-ASN1_TYPE *ASN1_generate_v3(const char *str, const X509V3_CTX *cnf) {
-  CBB cbb;
-  if (!CBB_init(&cbb, 0) ||  //
-      !generate_v3(&cbb, str, cnf, /*tag=*/0, ASN1_GEN_FORMAT_ASCII,
+ASN1_TYPE *bssl::ASN1_generate_v3(const char *str, const X509V3_CTX *cnf) {
+  ScopedCBB cbb;
+  if (!CBB_init(cbb.get(), 0) ||  //
+      !generate_v3(cbb.get(), str, cnf, /*tag=*/0, ASN1_GEN_FORMAT_ASCII,
                    /*depth=*/0)) {
-    CBB_cleanup(&cbb);
-    return NULL;
+    return nullptr;
   }
 
   // While not strictly necessary to avoid a DoS (we rely on any super-linear
   // checks being performed internally), cap the overall output to
-  // |ASN1_GEN_MAX_OUTPUT| so the externally-visible behavior is consistent.
-  if (CBB_len(&cbb) > ASN1_GEN_MAX_OUTPUT) {
+  // `ASN1_GEN_MAX_OUTPUT` so the externally-visible behavior is consistent.
+  if (CBB_len(cbb.get()) > ASN1_GEN_MAX_OUTPUT) {
     OPENSSL_PUT_ERROR(ASN1, ASN1_R_TOO_LONG);
-    CBB_cleanup(&cbb);
-    return NULL;
+    return nullptr;
   }
 
-  const uint8_t *der = CBB_data(&cbb);
-  ASN1_TYPE *ret = d2i_ASN1_TYPE(NULL, &der, CBB_len(&cbb));
-  CBB_cleanup(&cbb);
-  return ret;
+  const uint8_t *der = CBB_data(cbb.get());
+  return d2i_ASN1_TYPE(nullptr, &der, CBB_len(cbb.get()));
 }
 
 static int cbs_str_equal(const CBS *cbs, const char *str) {
@@ -86,7 +84,7 @@ static int cbs_str_equal(const CBS *cbs, const char *str) {
          OPENSSL_memcmp(CBS_data(cbs), str, strlen(str)) == 0;
 }
 
-// parse_tag decodes a tag specifier in |cbs|. It returns the tag on success or
+// parse_tag decodes a tag specifier in `cbs`. It returns the tag on success or
 // zero on error.
 static CBS_ASN1_TAG parse_tag(const CBS *cbs) {
   CBS copy = *cbs;
@@ -153,7 +151,7 @@ static int generate_v3(CBB *cbb, const char *str, const X509V3_CTX *cnf,
   }
 
   // Process modifiers. This function uses a mix of NUL-terminated strings and
-  // |CBS|. Several functions only work with NUL-terminated strings, so we need
+  // `CBS`. Several functions only work with NUL-terminated strings, so we need
   // to keep track of when a slice spans the whole buffer.
   for (;;) {
     // Skip whitespace.
@@ -163,7 +161,7 @@ static int generate_v3(CBB *cbb, const char *str, const X509V3_CTX *cnf,
 
     // Modifiers end at commas.
     const char *comma = strchr(str, ',');
-    if (comma == NULL) {
+    if (comma == nullptr) {
       break;
     }
 
@@ -191,7 +189,7 @@ static int generate_v3(CBB *cbb, const char *str, const X509V3_CTX *cnf,
       CBS_skip(&modifier, 1);  // Skip the colon.
     } else {
       name = modifier;
-      CBS_init(&modifier, NULL, 0);
+      CBS_init(&modifier, nullptr, 0);
     }
 
     if (cbs_str_equal(&name, "FORMAT") || cbs_str_equal(&name, "FORM")) {
@@ -243,7 +241,7 @@ static int generate_v3(CBB *cbb, const char *str, const X509V3_CTX *cnf,
       tag = tag == 0 ? CBS_ASN1_SET : (tag | CBS_ASN1_CONSTRUCTED);
       return generate_wrapped(cbb, str, cnf, tag, /*padding=*/0, format, depth);
     } else {
-      // If this was not a recognized modifier, rewind |str| to before splitting
+      // If this was not a recognized modifier, rewind `str` to before splitting
       // on the comma. The type itself consumes all remaining input.
       str = str_old;
       break;
@@ -255,7 +253,7 @@ static int generate_v3(CBB *cbb, const char *str, const X509V3_CTX *cnf,
   const char *colon = strchr(str, ':');
   CBS name;
   const char *value;
-  int has_value = colon != NULL;
+  int has_value = colon != nullptr;
   if (has_value) {
     CBS_init(&name, (const uint8_t *)str, colon - str);
     value = colon + 1;
@@ -303,9 +301,9 @@ static int generate_v3(CBB *cbb, const char *str, const X509V3_CTX *cnf,
       {"SET", CBS_ASN1_SET},
   };
   CBS_ASN1_TAG type = 0;
-  for (size_t i = 0; i < OPENSSL_ARRAY_SIZE(kTypes); i++) {
-    if (cbs_str_equal(&name, kTypes[i].name)) {
-      type = kTypes[i].type;
+  for (const auto &t : kTypes) {
+    if (cbs_str_equal(&name, t.name)) {
+      type = t.type;
       break;
     }
   }
@@ -348,12 +346,12 @@ static int generate_v3(CBB *cbb, const char *str, const X509V3_CTX *cnf,
         OPENSSL_PUT_ERROR(ASN1, ASN1_R_INTEGER_NOT_ASCII_FORMAT);
         return 0;
       }
-      ASN1_INTEGER *obj = s2i_ASN1_INTEGER(NULL, value);
-      if (obj == NULL) {
+      ASN1_INTEGER *obj = s2i_ASN1_INTEGER(nullptr, value);
+      if (obj == nullptr) {
         OPENSSL_PUT_ERROR(ASN1, ASN1_R_ILLEGAL_INTEGER);
         return 0;
       }
-      int len = i2c_ASN1_INTEGER(obj, NULL);
+      int len = i2c_ASN1_INTEGER(obj, nullptr);
       uint8_t *out;
       int ok = len > 0 &&  //
                CBB_add_space(&child, &out, len) &&
@@ -368,7 +366,7 @@ static int generate_v3(CBB *cbb, const char *str, const X509V3_CTX *cnf,
         return 0;
       }
       ASN1_OBJECT *obj = OBJ_txt2obj(value, /*dont_search_names=*/0);
-      if (obj == NULL || obj->length == 0) {
+      if (obj == nullptr || obj->length == 0) {
         OPENSSL_PUT_ERROR(ASN1, ASN1_R_ILLEGAL_OBJECT);
         return 0;
       }
@@ -386,9 +384,9 @@ static int generate_v3(CBB *cbb, const char *str, const X509V3_CTX *cnf,
       CBS value_cbs;
       CBS_init(&value_cbs, (const uint8_t *)value, strlen(value));
       int ok = type == CBS_ASN1_UTCTIME
-                   ? CBS_parse_utc_time(&value_cbs, NULL,
+                   ? CBS_parse_utc_time(&value_cbs, nullptr,
                                         /*allow_timezone_offset=*/0)
-                   : CBS_parse_generalized_time(&value_cbs, NULL,
+                   : CBS_parse_generalized_time(&value_cbs, nullptr,
                                                 /*allow_timezone_offset=*/0);
       if (!ok) {
         OPENSSL_PUT_ERROR(ASN1, ASN1_R_ILLEGAL_TIME_VALUE);
@@ -414,11 +412,11 @@ static int generate_v3(CBB *cbb, const char *str, const X509V3_CTX *cnf,
         return 0;
       }
 
-      // |maxsize| is measured in code points, rather than bytes, but pass it in
+      // `maxsize` is measured in code points, rather than bytes, but pass it in
       // as a loose cap so fuzzers can exit from excessively long inputs
-      // earlier. This limit is not load-bearing because |ASN1_mbstring_ncopy|'s
+      // earlier. This limit is not load-bearing because `ASN1_mbstring_ncopy`'s
       // output is already linear in the input.
-      ASN1_STRING *obj = NULL;
+      ASN1_STRING *obj = nullptr;
       if (ASN1_mbstring_ncopy(&obj, (const uint8_t *)value, -1, encoding,
                               ASN1_tag2bit(type), /*minsize=*/0,
                               /*maxsize=*/ASN1_GEN_MAX_OUTPUT) <= 0) {
@@ -432,7 +430,7 @@ static int generate_v3(CBB *cbb, const char *str, const X509V3_CTX *cnf,
     case CBS_ASN1_BITSTRING:
       if (format == ASN1_GEN_FORMAT_BITLIST) {
         ASN1_BIT_STRING *obj = ASN1_BIT_STRING_new();
-        if (obj == NULL) {
+        if (obj == nullptr) {
           return 0;
         }
         if (!CONF_parse_list(value, ',', 1, bitstr_cb, obj)) {
@@ -440,7 +438,7 @@ static int generate_v3(CBB *cbb, const char *str, const X509V3_CTX *cnf,
           ASN1_BIT_STRING_free(obj);
           return 0;
         }
-        int len = i2c_ASN1_BIT_STRING(obj, NULL);
+        int len = i2c_ASN1_BIT_STRING(obj, nullptr);
         uint8_t *out;
         int ok = len > 0 &&  //
                  CBB_add_space(&child, &out, len) &&
@@ -465,7 +463,7 @@ static int generate_v3(CBB *cbb, const char *str, const X509V3_CTX *cnf,
       if (format == ASN1_GEN_FORMAT_HEX) {
         size_t len;
         uint8_t *data = x509v3_hex_to_bytes(value, &len);
-        if (data == NULL) {
+        if (data == nullptr) {
           OPENSSL_PUT_ERROR(ASN1, ASN1_R_ILLEGAL_HEX);
           return 0;
         }
@@ -480,12 +478,12 @@ static int generate_v3(CBB *cbb, const char *str, const X509V3_CTX *cnf,
     case CBS_ASN1_SEQUENCE:
     case CBS_ASN1_SET:
       if (has_value) {
-        if (cnf == NULL) {
+        if (cnf == nullptr) {
           OPENSSL_PUT_ERROR(ASN1, ASN1_R_SEQUENCE_OR_SET_NEEDS_CONFIG);
           return 0;
         }
         const STACK_OF(CONF_VALUE) *section = X509V3_get_section(cnf, value);
-        if (section == NULL) {
+        if (section == nullptr) {
           OPENSSL_PUT_ERROR(ASN1, ASN1_R_SEQUENCE_OR_SET_NEEDS_CONFIG);
           return 0;
         }
@@ -495,8 +493,8 @@ static int generate_v3(CBB *cbb, const char *str, const X509V3_CTX *cnf,
                            ASN1_GEN_FORMAT_ASCII, depth + 1)) {
             return 0;
           }
-          // This recursive call, by referencing |section|, is the one place
-          // where |generate_v3|'s output can be super-linear in the input.
+          // This recursive call, by referencing `section`, is the one place
+          // where `generate_v3`'s output can be super-linear in the input.
           // Check bounds here.
           if (CBB_len(&child) > ASN1_GEN_MAX_OUTPUT) {
             OPENSSL_PUT_ERROR(ASN1, ASN1_R_TOO_LONG);