grpc 1.84.0 → 1.85.0.pre1

data/third_party/boringssl-with-bazel/crypto/x509/x509_obj.cc

@@ -25,10 +25,12 @@
 
 
 // Limit to ensure we don't overflow: much greater than
-// anything enountered in practice.
+// anything encountered in practice.
 
 #define NAME_ONELINE_MAX (1024 * 1024)
 
+using namespace bssl;
+
 char *X509_NAME_oneline(const X509_NAME *a, char *buf, int len) {
   X509_NAME_ENTRY *ne;
   size_t i;
@@ -36,13 +38,15 @@ char *X509_NAME_oneline(const X509_NAME *a, char *buf, int len) {
   const char *s;
   char *p;
   unsigned char *q;
-  BUF_MEM *b = NULL;
+  BUF_MEM *b = nullptr;
   static const char hex[17] = "0123456789ABCDEF";
   int gs_doit[4];
   char tmp_buf[80];
 
-  if (buf == NULL) {
-    if ((b = BUF_MEM_new()) == NULL) {
+  const auto *name = a ? FromOpaque(a) : nullptr;
+
+  if (buf == nullptr) {
+    if ((b = BUF_MEM_new()) == nullptr) {
       goto err;
     }
     if (!BUF_MEM_grow(b, 200)) {
@@ -51,9 +55,9 @@ char *X509_NAME_oneline(const X509_NAME *a, char *buf, int len) {
     b->data[0] = '\0';
     len = 200;
   } else if (len <= 0) {
-    return NULL;
+    return nullptr;
   }
-  if (a == NULL) {
+  if (a == nullptr) {
     if (b) {
       buf = b->data;
       OPENSSL_free(b);
@@ -64,22 +68,22 @@ char *X509_NAME_oneline(const X509_NAME *a, char *buf, int len) {
 
   len--;  // space for '\0'
   l = 0;
-  for (i = 0; i < sk_X509_NAME_ENTRY_num(a->entries); i++) {
-    ne = sk_X509_NAME_ENTRY_value(a->entries, i);
+  for (i = 0; i < sk_X509_NAME_ENTRY_num(name->entries); i++) {
+    ne = sk_X509_NAME_ENTRY_value(name->entries, i);
     n = OBJ_obj2nid(ne->object);
-    if ((n == NID_undef) || ((s = OBJ_nid2sn(n)) == NULL)) {
+    if ((n == NID_undef) || ((s = OBJ_nid2sn(n)) == nullptr)) {
       i2t_ASN1_OBJECT(tmp_buf, sizeof(tmp_buf), ne->object);
       s = tmp_buf;
     }
     l1 = strlen(s);
 
-    type = ne->value->type;
-    num = ne->value->length;
+    type = ne->value.type;
+    num = ne->value.length;
     if (num > NAME_ONELINE_MAX) {
       OPENSSL_PUT_ERROR(X509, X509_R_NAME_TOO_LONG);
       goto err;
     }
-    q = ne->value->data;
+    q = ne->value.data;
 
     if ((type == V_ASN1_GENERALSTRING) && ((num % 4) == 0)) {
       gs_doit[0] = gs_doit[1] = gs_doit[2] = gs_doit[3] = 0;
@@ -115,7 +119,7 @@ char *X509_NAME_oneline(const X509_NAME *a, char *buf, int len) {
       OPENSSL_PUT_ERROR(X509, X509_R_NAME_TOO_LONG);
       goto err;
     }
-    if (b != NULL) {
+    if (b != nullptr) {
       if (!BUF_MEM_grow(b, l + 1)) {
         goto err;
       }
@@ -130,7 +134,7 @@ char *X509_NAME_oneline(const X509_NAME *a, char *buf, int len) {
     p += l1;
     *(p++) = '=';
 
-    q = ne->value->data;
+    q = ne->value.data;
 
     for (j = 0; j < num; j++) {
       if (!gs_doit[j & 3]) {
@@ -148,7 +152,7 @@ char *X509_NAME_oneline(const X509_NAME *a, char *buf, int len) {
     }
     *p = '\0';
   }
-  if (b != NULL) {
+  if (b != nullptr) {
     p = b->data;
     OPENSSL_free(b);
   } else {
@@ -160,5 +164,5 @@ char *X509_NAME_oneline(const X509_NAME *a, char *buf, int len) {
   return p;
 err:
   BUF_MEM_free(b);
-  return NULL;
+  return nullptr;
 }

data/third_party/boringssl-with-bazel/crypto/x509/x509_req.cc

@@ -26,6 +26,8 @@
 #include "internal.h"
 
 
+using namespace bssl;
+
 long X509_REQ_get_version(const X509_REQ *req) {
   return ASN1_INTEGER_get(req->req_info->version);
 }
@@ -35,46 +37,34 @@ X509_NAME *X509_REQ_get_subject_name(const X509_REQ *req) {
 }
 
 EVP_PKEY *X509_REQ_get_pubkey(const X509_REQ *req) {
-  if (req == NULL) {
-    return NULL;
+  if (req == nullptr) {
+    return nullptr;
   }
   return X509_PUBKEY_get(req->req_info->pubkey);
 }
 
 EVP_PKEY *X509_REQ_get0_pubkey(const X509_REQ *req) {
-  if (req == NULL) {
-    return NULL;
+  if (req == nullptr) {
+    return nullptr;
   }
   return X509_PUBKEY_get0(req->req_info->pubkey);
 }
 
 int X509_REQ_check_private_key(const X509_REQ *x, const EVP_PKEY *k) {
   const EVP_PKEY *xk = X509_REQ_get0_pubkey(x);
-  if (xk == NULL) {
+  if (xk == nullptr) {
     return 0;
   }
 
-  int ret = EVP_PKEY_cmp(xk, k);
-  if (ret > 0) {
+  if (EVP_PKEY_eq(xk, k) == 1) {
     return 1;
   }
 
-  switch (ret) {
-    case 0:
-      OPENSSL_PUT_ERROR(X509, X509_R_KEY_VALUES_MISMATCH);
-      return 0;
-    case -1:
-      OPENSSL_PUT_ERROR(X509, X509_R_KEY_TYPE_MISMATCH);
-      return 0;
-    case -2:
-      if (EVP_PKEY_id(k) == EVP_PKEY_EC) {
-        OPENSSL_PUT_ERROR(X509, ERR_R_EC_LIB);
-      } else {
-        OPENSSL_PUT_ERROR(X509, X509_R_UNKNOWN_KEY_TYPE);
-      }
-      return 0;
+  if (EVP_PKEY_id(xk) != EVP_PKEY_id(k)) {
+    OPENSSL_PUT_ERROR(X509, X509_R_KEY_TYPE_MISMATCH);
+  } else {
+    OPENSSL_PUT_ERROR(X509, X509_R_KEY_VALUES_MISMATCH);
   }
-
   return 0;
 }
 
@@ -83,8 +73,8 @@ int X509_REQ_extension_nid(int req_nid) {
 }
 
 STACK_OF(X509_EXTENSION) *X509_REQ_get_extensions(const X509_REQ *req) {
-  if (req == NULL || req->req_info == NULL) {
-    return NULL;
+  if (req == nullptr || req->req_info == nullptr) {
+    return nullptr;
   }
 
   int idx = X509_REQ_get_attr_by_NID(req, NID_ext_req, -1);
@@ -92,19 +82,20 @@ STACK_OF(X509_EXTENSION) *X509_REQ_get_extensions(const X509_REQ *req) {
     idx = X509_REQ_get_attr_by_NID(req, NID_ms_ext_req, -1);
   }
   if (idx == -1) {
-    return NULL;
+    return nullptr;
   }
 
   const X509_ATTRIBUTE *attr = X509_REQ_get_attr(req, idx);
-  // TODO(davidben): |X509_ATTRIBUTE_get0_type| is not const-correct. It should
+  // TODO(davidben): `X509_ATTRIBUTE_get0_type` is not const-correct. It should
   // take and return a const pointer.
   const ASN1_TYPE *ext = X509_ATTRIBUTE_get0_type((X509_ATTRIBUTE *)attr, 0);
   if (!ext || ext->type != V_ASN1_SEQUENCE) {
-    return NULL;
+    return nullptr;
   }
   const unsigned char *p = ext->value.sequence->data;
   return (STACK_OF(X509_EXTENSION) *)ASN1_item_d2i(
-      NULL, &p, ext->value.sequence->length, ASN1_ITEM_rptr(X509_EXTENSIONS));
+      nullptr, &p, ext->value.sequence->length,
+      ASN1_ITEM_rptr(X509_EXTENSIONS));
 }
 
 // Add a STACK_OF extensions to a certificate request: allow alternative OIDs
@@ -113,7 +104,7 @@ STACK_OF(X509_EXTENSION) *X509_REQ_get_extensions(const X509_REQ *req) {
 int X509_REQ_add_extensions_nid(X509_REQ *req,
                                 const STACK_OF(X509_EXTENSION) *exts, int nid) {
   // Generate encoding of extensions
-  unsigned char *ext = NULL;
+  unsigned char *ext = nullptr;
   int ext_len =
       ASN1_item_i2d((ASN1_VALUE *)exts, &ext, ASN1_ITEM_rptr(X509_EXTENSIONS));
   if (ext_len <= 0) {
@@ -136,7 +127,7 @@ int X509_REQ_get_attr_count(const X509_REQ *req) {
 
 int X509_REQ_get_attr_by_NID(const X509_REQ *req, int nid, int lastpos) {
   const ASN1_OBJECT *obj = OBJ_nid2obj(nid);
-  if (obj == NULL) {
+  if (obj == nullptr) {
     return -1;
   }
   return X509_REQ_get_attr_by_OBJ(req, obj, lastpos);
@@ -144,7 +135,7 @@ int X509_REQ_get_attr_by_NID(const X509_REQ *req, int nid, int lastpos) {
 
 int X509_REQ_get_attr_by_OBJ(const X509_REQ *req, const ASN1_OBJECT *obj,
                              int lastpos) {
-  if (req->req_info->attributes == NULL) {
+  if (req->req_info->attributes == nullptr) {
     return -1;
   }
   lastpos++;
@@ -163,26 +154,26 @@ int X509_REQ_get_attr_by_OBJ(const X509_REQ *req, const ASN1_OBJECT *obj,
 }
 
 X509_ATTRIBUTE *X509_REQ_get_attr(const X509_REQ *req, int loc) {
-  if (req->req_info->attributes == NULL || loc < 0 ||
+  if (req->req_info->attributes == nullptr || loc < 0 ||
       sk_X509_ATTRIBUTE_num(req->req_info->attributes) <= (size_t)loc) {
-    return NULL;
+    return nullptr;
   }
   return sk_X509_ATTRIBUTE_value(req->req_info->attributes, loc);
 }
 
 X509_ATTRIBUTE *X509_REQ_delete_attr(X509_REQ *req, int loc) {
-  if (req->req_info->attributes == NULL || loc < 0 ||
+  if (req->req_info->attributes == nullptr || loc < 0 ||
       sk_X509_ATTRIBUTE_num(req->req_info->attributes) <= (size_t)loc) {
-    return NULL;
+    return nullptr;
   }
   return sk_X509_ATTRIBUTE_delete(req->req_info->attributes, loc);
 }
 
 static int X509_REQ_add0_attr(X509_REQ *req, X509_ATTRIBUTE *attr) {
-  if (req->req_info->attributes == NULL) {
+  if (req->req_info->attributes == nullptr) {
     req->req_info->attributes = sk_X509_ATTRIBUTE_new_null();
   }
-  if (req->req_info->attributes == NULL ||
+  if (req->req_info->attributes == nullptr ||
       !sk_X509_ATTRIBUTE_push(req->req_info->attributes, attr)) {
     return 0;
   }
@@ -192,7 +183,7 @@ static int X509_REQ_add0_attr(X509_REQ *req, X509_ATTRIBUTE *attr) {
 
 int X509_REQ_add1_attr(X509_REQ *req, const X509_ATTRIBUTE *attr) {
   X509_ATTRIBUTE *new_attr = X509_ATTRIBUTE_dup(attr);
-  if (new_attr == NULL || !X509_REQ_add0_attr(req, new_attr)) {
+  if (new_attr == nullptr || !X509_REQ_add0_attr(req, new_attr)) {
     X509_ATTRIBUTE_free(new_attr);
     return 0;
   }
@@ -204,8 +195,8 @@ int X509_REQ_add1_attr_by_OBJ(X509_REQ *req, const ASN1_OBJECT *obj,
                               int attrtype, const unsigned char *data,
                               int len) {
   X509_ATTRIBUTE *attr =
-      X509_ATTRIBUTE_create_by_OBJ(NULL, obj, attrtype, data, len);
-  if (attr == NULL || !X509_REQ_add0_attr(req, attr)) {
+      X509_ATTRIBUTE_create_by_OBJ(nullptr, obj, attrtype, data, len);
+  if (attr == nullptr || !X509_REQ_add0_attr(req, attr)) {
     X509_ATTRIBUTE_free(attr);
     return 0;
   }
@@ -216,8 +207,8 @@ int X509_REQ_add1_attr_by_OBJ(X509_REQ *req, const ASN1_OBJECT *obj,
 int X509_REQ_add1_attr_by_NID(X509_REQ *req, int nid, int attrtype,
                               const unsigned char *data, int len) {
   X509_ATTRIBUTE *attr =
-      X509_ATTRIBUTE_create_by_NID(NULL, nid, attrtype, data, len);
-  if (attr == NULL || !X509_REQ_add0_attr(req, attr)) {
+      X509_ATTRIBUTE_create_by_NID(nullptr, nid, attrtype, data, len);
+  if (attr == nullptr || !X509_REQ_add0_attr(req, attr)) {
     X509_ATTRIBUTE_free(attr);
     return 0;
   }
@@ -228,8 +219,8 @@ int X509_REQ_add1_attr_by_NID(X509_REQ *req, int nid, int attrtype,
 int X509_REQ_add1_attr_by_txt(X509_REQ *req, const char *attrname, int attrtype,
                               const unsigned char *data, int len) {
   X509_ATTRIBUTE *attr =
-      X509_ATTRIBUTE_create_by_txt(NULL, attrname, attrtype, data, len);
-  if (attr == NULL || !X509_REQ_add0_attr(req, attr)) {
+      X509_ATTRIBUTE_create_by_txt(nullptr, attrname, attrtype, data, len);
+  if (attr == nullptr || !X509_REQ_add0_attr(req, attr)) {
     X509_ATTRIBUTE_free(attr);
     return 0;
   }
@@ -239,10 +230,10 @@ int X509_REQ_add1_attr_by_txt(X509_REQ *req, const char *attrname, int attrtype,
 
 void X509_REQ_get0_signature(const X509_REQ *req, const ASN1_BIT_STRING **psig,
                              const X509_ALGOR **palg) {
-  if (psig != NULL) {
+  if (psig != nullptr) {
     *psig = req->signature;
   }
-  if (palg != NULL) {
+  if (palg != nullptr) {
     *palg = req->sig_alg;
   }
 }

data/third_party/boringssl-with-bazel/crypto/x509/x509_set.cc

@@ -12,25 +12,27 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+#include <stdint.h>
+
 #include <openssl/asn1.h>
 #include <openssl/cipher.h>
 #include <openssl/evp.h>
 #include <openssl/obj.h>
 #include <openssl/x509.h>
 
+#include "../internal.h"
 #include "internal.h"
 
 
+using namespace bssl;
+
 long X509_get_version(const X509 *x509) {
-  // The default version is v1(0).
-  if (x509->cert_info->version == NULL) {
-    return X509_VERSION_1;
-  }
-  return ASN1_INTEGER_get(x509->cert_info->version);
+  const auto *impl = FromOpaque(x509);
+  return impl->version;
 }
 
 int X509_set_version(X509 *x, long version) {
-  if (x == NULL) {
+  if (x == nullptr) {
     return 0;
   }
 
@@ -39,20 +41,9 @@ int X509_set_version(X509 *x, long version) {
     return 0;
   }
 
-  // v1(0) is default and is represented by omitting the version.
-  if (version == X509_VERSION_1) {
-    ASN1_INTEGER_free(x->cert_info->version);
-    x->cert_info->version = NULL;
-    return 1;
-  }
-
-  if (x->cert_info->version == NULL) {
-    x->cert_info->version = ASN1_INTEGER_new();
-    if (x->cert_info->version == NULL) {
-      return 0;
-    }
-  }
-  return ASN1_INTEGER_set_int64(x->cert_info->version, version);
+  auto *impl = FromOpaque(x);
+  impl->version = static_cast<uint8_t>(version);
+  return 1;
 }
 
 int X509_set_serialNumber(X509 *x, const ASN1_INTEGER *serial) {
@@ -61,50 +52,30 @@ int X509_set_serialNumber(X509 *x, const ASN1_INTEGER *serial) {
     return 0;
   }
 
-  ASN1_INTEGER *in;
-  if (x == NULL) {
-    return 0;
-  }
-  in = x->cert_info->serialNumber;
-  if (in != serial) {
-    in = ASN1_INTEGER_dup(serial);
-    if (in != NULL) {
-      ASN1_INTEGER_free(x->cert_info->serialNumber);
-      x->cert_info->serialNumber = in;
-    }
-  }
-  return in != NULL;
+  auto *impl = FromOpaque(x);
+  return ASN1_STRING_copy(&impl->serialNumber, serial);
 }
 
-int X509_set_issuer_name(X509 *x, X509_NAME *name) {
-  if ((x == NULL) || (x->cert_info == NULL)) {
+int X509_set_issuer_name(X509 *x, const X509_NAME *name) {
+  if (x == nullptr) {
     return 0;
   }
-  return (X509_NAME_set(&x->cert_info->issuer, name));
+  auto *impl = FromOpaque(x);
+  return x509_name_copy(&impl->issuer, name);
 }
 
-int X509_set_subject_name(X509 *x, X509_NAME *name) {
-  if ((x == NULL) || (x->cert_info == NULL)) {
+int X509_set_subject_name(X509 *x, const X509_NAME *name) {
+  if (x == nullptr) {
     return 0;
   }
-  return (X509_NAME_set(&x->cert_info->subject, name));
+  auto *impl = FromOpaque(x);
+  return x509_name_copy(&impl->subject, name);
 }
 
 int X509_set1_notBefore(X509 *x, const ASN1_TIME *tm) {
-  ASN1_TIME *in;
-
-  if ((x == NULL) || (x->cert_info->validity == NULL)) {
-    return 0;
-  }
-  in = x->cert_info->validity->notBefore;
-  if (in != tm) {
-    in = ASN1_STRING_dup(tm);
-    if (in != NULL) {
-      ASN1_TIME_free(x->cert_info->validity->notBefore);
-      x->cert_info->validity->notBefore = in;
-    }
-  }
-  return in != NULL;
+  // TODO(crbug.com/42290309): Check that `tm->type` is correct.
+  auto *impl = FromOpaque(x);
+  return ASN1_STRING_copy(&impl->notBefore, tm);
 }
 
 int X509_set_notBefore(X509 *x, const ASN1_TIME *tm) {
@@ -112,38 +83,30 @@ int X509_set_notBefore(X509 *x, const ASN1_TIME *tm) {
 }
 
 const ASN1_TIME *X509_get0_notBefore(const X509 *x) {
-  return x->cert_info->validity->notBefore;
+  auto *impl = FromOpaque(x);
+  return &impl->notBefore;
 }
 
 ASN1_TIME *X509_getm_notBefore(X509 *x) {
-  // Note this function takes a const |X509| pointer in OpenSSL. We require
-  // non-const as this allows mutating |x|. If it comes up for compatibility,
+  // Note this function takes a const `X509` pointer in OpenSSL. We require
+  // non-const as this allows mutating `x`. If it comes up for compatibility,
   // we can relax this.
-  return x->cert_info->validity->notBefore;
+  auto *impl = FromOpaque(x);
+  return &impl->notBefore;
 }
 
 ASN1_TIME *X509_get_notBefore(const X509 *x509) {
-  // In OpenSSL, this function is an alias for |X509_getm_notBefore|, but our
-  // |X509_getm_notBefore| is const-correct. |X509_get_notBefore| was
+  // In OpenSSL, this function is an alias for `X509_getm_notBefore`, but our
+  // `X509_getm_notBefore` is const-correct. `X509_get_notBefore` was
   // originally a macro, so it needs to capture both get0 and getm use cases.
-  return x509->cert_info->validity->notBefore;
+  const auto *impl = FromOpaque(x509);
+  return const_cast<ASN1_TIME *>(&impl->notBefore);
 }
 
 int X509_set1_notAfter(X509 *x, const ASN1_TIME *tm) {
-  ASN1_TIME *in;
-
-  if ((x == NULL) || (x->cert_info->validity == NULL)) {
-    return 0;
-  }
-  in = x->cert_info->validity->notAfter;
-  if (in != tm) {
-    in = ASN1_STRING_dup(tm);
-    if (in != NULL) {
-      ASN1_TIME_free(x->cert_info->validity->notAfter);
-      x->cert_info->validity->notAfter = in;
-    }
-  }
-  return in != NULL;
+  // TODO(crbug.com/42290309): Check that `tm->type` is correct.
+  auto *impl = FromOpaque(x);
+  return ASN1_STRING_copy(&impl->notAfter, tm);
 }
 
 int X509_set_notAfter(X509 *x, const ASN1_TIME *tm) {
@@ -151,48 +114,57 @@ int X509_set_notAfter(X509 *x, const ASN1_TIME *tm) {
 }
 
 const ASN1_TIME *X509_get0_notAfter(const X509 *x) {
-  return x->cert_info->validity->notAfter;
+  auto *impl = FromOpaque(x);
+  return &impl->notAfter;
 }
 
 ASN1_TIME *X509_getm_notAfter(X509 *x) {
-  // Note this function takes a const |X509| pointer in OpenSSL. We require
-  // non-const as this allows mutating |x|. If it comes up for compatibility,
+  // Note this function takes a const `X509` pointer in OpenSSL. We require
+  // non-const as this allows mutating `x`. If it comes up for compatibility,
   // we can relax this.
-  return x->cert_info->validity->notAfter;
+  auto *impl = FromOpaque(x);
+  return &impl->notAfter;
 }
 
 ASN1_TIME *X509_get_notAfter(const X509 *x509) {
-  // In OpenSSL, this function is an alias for |X509_getm_notAfter|, but our
-  // |X509_getm_notAfter| is const-correct. |X509_get_notAfter| was
+  // In OpenSSL, this function is an alias for `X509_getm_notAfter`, but our
+  // `X509_getm_notAfter` is const-correct. `X509_get_notAfter` was
   // originally a macro, so it needs to capture both get0 and getm use cases.
-  return x509->cert_info->validity->notAfter;
+  const auto *impl = FromOpaque(x509);
+  return const_cast<ASN1_TIME *>(&impl->notAfter);
 }
 
 void X509_get0_uids(const X509 *x509, const ASN1_BIT_STRING **out_issuer_uid,
                     const ASN1_BIT_STRING **out_subject_uid) {
-  if (out_issuer_uid != NULL) {
-    *out_issuer_uid = x509->cert_info->issuerUID;
+  const auto *impl = FromOpaque(x509);
+  if (out_issuer_uid != nullptr) {
+    *out_issuer_uid = impl->issuerUID;
   }
-  if (out_subject_uid != NULL) {
-    *out_subject_uid = x509->cert_info->subjectUID;
+  if (out_subject_uid != nullptr) {
+    *out_subject_uid = impl->subjectUID;
   }
 }
 
 int X509_set_pubkey(X509 *x, EVP_PKEY *pkey) {
-  if ((x == NULL) || (x->cert_info == NULL)) {
+  if (x == nullptr) {
     return 0;
   }
-  return (X509_PUBKEY_set(&(x->cert_info->key), pkey));
+  auto *impl = FromOpaque(x);
+  return x509_pubkey_set1(&impl->key, pkey);
 }
 
 const STACK_OF(X509_EXTENSION) *X509_get0_extensions(const X509 *x) {
-  return x->cert_info->extensions;
+  auto *impl = FromOpaque(x);
+  return impl->extensions;
 }
 
 const X509_ALGOR *X509_get0_tbs_sigalg(const X509 *x) {
-  return x->cert_info->signature;
+  auto *impl = FromOpaque(x);
+  return &impl->tbs_sig_alg;
 }
 
 X509_PUBKEY *X509_get_X509_PUBKEY(const X509 *x509) {
-  return x509->cert_info->key;
+  // This function is not const-correct for OpenSSL compatibility.
+  const auto *impl = FromOpaque(x509);
+  return const_cast<X509_PUBKEY *>(&impl->key);
 }

data/third_party/boringssl-with-bazel/crypto/x509/x509_trs.cc

@@ -21,6 +21,8 @@
 #include "internal.h"
 
 
+using namespace bssl;
+
 typedef struct x509_trust_st X509_TRUST;
 
 struct x509_trust_st {
@@ -43,12 +45,12 @@ static const X509_TRUST trstandard[] = {
     {X509_TRUST_TSA, trust_1oidany, NID_time_stamp}};
 
 static const X509_TRUST *X509_TRUST_get0(int id) {
-  for (size_t i = 0; i < OPENSSL_ARRAY_SIZE(trstandard); i++) {
-    if (trstandard[i].trust == id) {
-      return &trstandard[i];
+  for (const auto &t : trstandard) {
+    if (t.trust == id) {
+      return &t;
     }
   }
-  return NULL;
+  return nullptr;
 }
 
 int X509_check_trust(X509 *x, int id, int flags) {
@@ -61,10 +63,10 @@ int X509_check_trust(X509 *x, int id, int flags) {
     if (rv != X509_TRUST_UNTRUSTED) {
       return rv;
     }
-    return trust_compat(NULL, x);
+    return trust_compat(nullptr, x);
   }
   const X509_TRUST *pt = X509_TRUST_get0(id);
-  if (pt == NULL) {
+  if (pt == nullptr) {
     // Unknown trust IDs are silently reintrepreted as NIDs. This is unreachable
     // from the certificate verifier itself, but wpa_supplicant relies on it.
     // Note this relies on commonly-used NIDs and trust IDs not colliding.
@@ -73,24 +75,26 @@ int X509_check_trust(X509 *x, int id, int flags) {
   return pt->check_trust(pt, x);
 }
 
-int X509_is_valid_trust_id(int trust) {
-  return X509_TRUST_get0(trust) != NULL;
+int bssl::X509_is_valid_trust_id(int trust) {
+  return X509_TRUST_get0(trust) != nullptr;
 }
 
 static int trust_1oidany(const X509_TRUST *trust, X509 *x) {
-  if (x->aux && (x->aux->trust || x->aux->reject)) {
-    return obj_trust(trust->nid, x);
+  auto *impl = FromOpaque(x);
+  if (impl->aux && (impl->aux->trust || impl->aux->reject)) {
+    return obj_trust(trust->nid, impl);
   }
   // we don't have any trust settings: for compatibility we return trusted
   // if it is self signed
-  return trust_compat(trust, x);
+  return trust_compat(trust, impl);
 }
 
 static int trust_compat(const X509_TRUST *trust, X509 *x) {
+  auto *impl = FromOpaque(x);
   if (!x509v3_cache_extensions(x)) {
     return X509_TRUST_UNTRUSTED;
   }
-  if (x->ex_flags & EXFLAG_SS) {
+  if (impl->ex_flags & EXFLAG_SS) {
     return X509_TRUST_TRUSTED;
   } else {
     return X509_TRUST_UNTRUSTED;
@@ -98,7 +102,8 @@ static int trust_compat(const X509_TRUST *trust, X509 *x) {
 }
 
 static int obj_trust(int id, X509 *x) {
-  X509_CERT_AUX *ax = x->aux;
+  auto *impl = FromOpaque(x);
+  X509_CERT_AUX *ax = impl->aux;
   if (!ax) {
     return X509_TRUST_UNTRUSTED;
   }