grpc 1.84.0 → 1.85.0.pre1

data/third_party/boringssl-with-bazel/crypto/x509/x_all.cc

@@ -17,59 +17,93 @@
 #include <limits.h>
 
 #include <openssl/asn1.h>
+#include <openssl/bytestring.h>
 #include <openssl/digest.h>
 #include <openssl/dsa.h>
 #include <openssl/evp.h>
 #include <openssl/mem.h>
+#include <openssl/pool.h>
 #include <openssl/rsa.h>
+#include <openssl/span.h>
 #include <openssl/stack.h>
 
 #include "../asn1/internal.h"
+#include "../bytestring/internal.h"
+#include "../internal.h"
 #include "internal.h"
 
 
-int X509_verify(X509 *x509, EVP_PKEY *pkey) {
-  if (X509_ALGOR_cmp(x509->sig_alg, x509->cert_info->signature)) {
+using namespace bssl;
+
+int X509_verify(const X509 *x509, EVP_PKEY *pkey) {
+  auto *impl = FromOpaque(x509);
+  if (X509_ALGOR_cmp(&impl->sig_alg, &impl->tbs_sig_alg)) {
     OPENSSL_PUT_ERROR(X509, X509_R_SIGNATURE_ALGORITHM_MISMATCH);
     return 0;
   }
-  return ASN1_item_verify(ASN1_ITEM_rptr(X509_CINF), x509->sig_alg,
-                          x509->signature, x509->cert_info, pkey);
+  // This uses the cached TBSCertificate encoding, if any.
+  ScopedCBB cbb;
+  if (!CBB_init(cbb.get(), 128) || !x509_marshal_tbs_cert(cbb.get(), x509)) {
+    return 0;
+  }
+  return x509_verify_signature(&impl->sig_alg, &impl->signature,
+                               CBBAsSpan(cbb.get()), pkey);
 }
 
-int X509_REQ_verify(X509_REQ *req, EVP_PKEY *pkey) {
+int X509_REQ_verify(const X509_REQ *req, EVP_PKEY *pkey) {
   return ASN1_item_verify(ASN1_ITEM_rptr(X509_REQ_INFO), req->sig_alg,
                           req->signature, req->req_info, pkey);
 }
 
 int X509_sign(X509 *x, EVP_PKEY *pkey, const EVP_MD *md) {
-  asn1_encoding_clear(&x->cert_info->enc);
-  return (ASN1_item_sign(ASN1_ITEM_rptr(X509_CINF), x->cert_info->signature,
-                         x->sig_alg, x->signature, x->cert_info, pkey, md));
+  ScopedEVP_MD_CTX ctx;
+  if (!EVP_DigestSignInit(ctx.get(), nullptr, md, nullptr, pkey)) {
+    return 0;
+  }
+  return X509_sign_ctx(x, ctx.get());
 }
 
 int X509_sign_ctx(X509 *x, EVP_MD_CTX *ctx) {
-  asn1_encoding_clear(&x->cert_info->enc);
-  return ASN1_item_sign_ctx(ASN1_ITEM_rptr(X509_CINF), x->cert_info->signature,
-                            x->sig_alg, x->signature, x->cert_info, ctx);
+  // Historically, this function called `EVP_MD_CTX_cleanup` on return. Some
+  // callers rely on this to avoid memory leaks.
+  Cleanup cleanup = [&] { EVP_MD_CTX_cleanup(ctx); };
+
+  auto *impl = FromOpaque(x);
+
+  // Fill in the two copies of AlgorithmIdentifier. Note one of these modifies
+  // the TBSCertificate.
+  if (!x509_digest_sign_algorithm(ctx, &impl->tbs_sig_alg) ||
+      !x509_digest_sign_algorithm(ctx, &impl->sig_alg)) {
+    return 0;
+  }
+
+  // Discard the cached encoding. (We just modified it.)
+  CRYPTO_BUFFER_free(impl->buf);
+  impl->buf = nullptr;
+
+  ScopedCBB cbb;
+  if (!CBB_init(cbb.get(), 128) || !x509_marshal_tbs_cert(cbb.get(), x)) {
+    return 0;
+  }
+  return x509_sign_to_bit_string(ctx, &impl->signature, CBBAsSpan(cbb.get()));
 }
 
 int X509_REQ_sign(X509_REQ *x, EVP_PKEY *pkey, const EVP_MD *md) {
   asn1_encoding_clear(&x->req_info->enc);
-  return (ASN1_item_sign(ASN1_ITEM_rptr(X509_REQ_INFO), x->sig_alg, NULL,
-                         x->signature, x->req_info, pkey, md));
+  return ASN1_item_sign(ASN1_ITEM_rptr(X509_REQ_INFO), x->sig_alg, nullptr,
+                        x->signature, x->req_info, pkey, md);
 }
 
 int X509_REQ_sign_ctx(X509_REQ *x, EVP_MD_CTX *ctx) {
   asn1_encoding_clear(&x->req_info->enc);
-  return ASN1_item_sign_ctx(ASN1_ITEM_rptr(X509_REQ_INFO), x->sig_alg, NULL,
+  return ASN1_item_sign_ctx(ASN1_ITEM_rptr(X509_REQ_INFO), x->sig_alg, nullptr,
                             x->signature, x->req_info, ctx);
 }
 
 int X509_CRL_sign(X509_CRL *x, EVP_PKEY *pkey, const EVP_MD *md) {
   asn1_encoding_clear(&x->crl->enc);
-  return (ASN1_item_sign(ASN1_ITEM_rptr(X509_CRL_INFO), x->crl->sig_alg,
-                         x->sig_alg, x->signature, x->crl, pkey, md));
+  return ASN1_item_sign(ASN1_ITEM_rptr(X509_CRL_INFO), x->crl->sig_alg,
+                        x->sig_alg, x->signature, x->crl, pkey, md);
 }
 
 int X509_CRL_sign_ctx(X509_CRL *x, EVP_MD_CTX *ctx) {
@@ -79,13 +113,13 @@ int X509_CRL_sign_ctx(X509_CRL *x, EVP_MD_CTX *ctx) {
 }
 
 int NETSCAPE_SPKI_sign(NETSCAPE_SPKI *x, EVP_PKEY *pkey, const EVP_MD *md) {
-  return (ASN1_item_sign(ASN1_ITEM_rptr(NETSCAPE_SPKAC), x->sig_algor, NULL,
-                         x->signature, x->spkac, pkey, md));
+  return ASN1_item_sign(ASN1_ITEM_rptr(NETSCAPE_SPKAC), x->sig_algor, nullptr,
+                        x->signature, x->spkac, pkey, md);
 }
 
 int NETSCAPE_SPKI_verify(NETSCAPE_SPKI *spki, EVP_PKEY *pkey) {
-  return (ASN1_item_verify(ASN1_ITEM_rptr(NETSCAPE_SPKAC), spki->sig_algor,
-                           spki->signature, spki->spkac, pkey));
+  return ASN1_item_verify(ASN1_ITEM_rptr(NETSCAPE_SPKAC), spki->sig_algor,
+                          spki->signature, spki->spkac, pkey);
 }
 
 X509_CRL *d2i_X509_CRL_fp(FILE *fp, X509_CRL **crl) {
@@ -93,7 +127,7 @@ X509_CRL *d2i_X509_CRL_fp(FILE *fp, X509_CRL **crl) {
       ASN1_item_d2i_fp(ASN1_ITEM_rptr(X509_CRL), fp, crl));
 }
 
-int i2d_X509_CRL_fp(FILE *fp, X509_CRL *crl) {
+int i2d_X509_CRL_fp(FILE *fp, const X509_CRL *crl) {
   return ASN1_item_i2d_fp(ASN1_ITEM_rptr(X509_CRL), fp, crl);
 }
 
@@ -102,7 +136,7 @@ X509_CRL *d2i_X509_CRL_bio(BIO *bp, X509_CRL **crl) {
       ASN1_item_d2i_bio(ASN1_ITEM_rptr(X509_CRL), bp, crl));
 }
 
-int i2d_X509_CRL_bio(BIO *bp, X509_CRL *crl) {
+int i2d_X509_CRL_bio(BIO *bp, const X509_CRL *crl) {
   return ASN1_item_i2d_bio(ASN1_ITEM_rptr(X509_CRL), bp, crl);
 }
 
@@ -111,7 +145,7 @@ X509_REQ *d2i_X509_REQ_fp(FILE *fp, X509_REQ **req) {
       ASN1_item_d2i_fp(ASN1_ITEM_rptr(X509_REQ), fp, req));
 }
 
-int i2d_X509_REQ_fp(FILE *fp, X509_REQ *req) {
+int i2d_X509_REQ_fp(FILE *fp, const X509_REQ *req) {
   return ASN1_item_i2d_fp(ASN1_ITEM_rptr(X509_REQ), fp, req);
 }
 
@@ -120,7 +154,7 @@ X509_REQ *d2i_X509_REQ_bio(BIO *bp, X509_REQ **req) {
       ASN1_item_d2i_bio(ASN1_ITEM_rptr(X509_REQ), bp, req));
 }
 
-int i2d_X509_REQ_bio(BIO *bp, X509_REQ *req) {
+int i2d_X509_REQ_bio(BIO *bp, const X509_REQ *req) {
   return ASN1_item_i2d_bio(ASN1_ITEM_rptr(X509_REQ), bp, req);
 }
 
@@ -128,8 +162,8 @@ int i2d_X509_REQ_bio(BIO *bp, X509_REQ *req) {
 #define IMPLEMENT_D2I_FP(type, name, bio_func) \
   type *name(FILE *fp, type **obj) {           \
     BIO *bio = BIO_new_fp(fp, BIO_NOCLOSE);    \
-    if (bio == NULL) {                         \
-      return NULL;                             \
+    if (bio == nullptr) {                      \
+      return nullptr;                          \
     }                                          \
     type *ret = bio_func(bio, obj);            \
     BIO_free(bio);                             \
@@ -137,9 +171,9 @@ int i2d_X509_REQ_bio(BIO *bp, X509_REQ *req) {
   }
 
 #define IMPLEMENT_I2D_FP(type, name, bio_func) \
-  int name(FILE *fp, type *obj) {              \
+  int name(FILE *fp, const type *obj) {        \
     BIO *bio = BIO_new_fp(fp, BIO_NOCLOSE);    \
-    if (bio == NULL) {                         \
+    if (bio == nullptr) {                      \
       return 0;                                \
     }                                          \
     int ret = bio_func(bio, obj);              \
@@ -164,7 +198,7 @@ IMPLEMENT_I2D_FP(RSA, i2d_RSA_PUBKEY_fp, i2d_RSA_PUBKEY_bio)
     uint8_t *data;                                      \
     size_t len;                                         \
     if (!BIO_read_asn1(bio, &data, &len, 100 * 1024)) { \
-      return NULL;                                      \
+      return nullptr;                                   \
     }                                                   \
     const uint8_t *ptr = data;                          \
     type *ret = d2i_func(obj, &ptr, (long)len);         \
@@ -173,8 +207,8 @@ IMPLEMENT_I2D_FP(RSA, i2d_RSA_PUBKEY_fp, i2d_RSA_PUBKEY_bio)
   }
 
 #define IMPLEMENT_I2D_BIO(type, name, i2d_func) \
-  int name(BIO *bio, type *obj) {               \
-    uint8_t *data = NULL;                       \
+  int name(BIO *bio, const type *obj) {         \
+    uint8_t *data = nullptr;                    \
     int len = i2d_func(obj, &data);             \
     if (len < 0) {                              \
       return 0;                                 \
@@ -227,19 +261,18 @@ int X509_pubkey_digest(const X509 *data, const EVP_MD *type, unsigned char *md,
   if (!key) {
     return 0;
   }
-  return EVP_Digest(key->data, key->length, md, len, type, NULL);
+  return EVP_Digest(key->data, key->length, md, len, type, nullptr);
 }
 
 int X509_digest(const X509 *x509, const EVP_MD *md, uint8_t *out,
                 unsigned *out_len) {
-  uint8_t *der = NULL;
-  // TODO(https://crbug.com/boringssl/407): This function is not const-correct.
-  int der_len = i2d_X509((X509 *)x509, &der);
+  uint8_t *der = nullptr;
+  int der_len = i2d_X509(x509, &der);
   if (der_len < 0) {
     return 0;
   }
 
-  int ret = EVP_Digest(der, der_len, out, out_len, md, NULL);
+  int ret = EVP_Digest(der, der_len, out, out_len, md, nullptr);
   OPENSSL_free(der);
   return ret;
 }
@@ -273,7 +306,7 @@ IMPLEMENT_D2I_FP(PKCS8_PRIV_KEY_INFO, d2i_PKCS8_PRIV_KEY_INFO_fp,
 IMPLEMENT_I2D_FP(PKCS8_PRIV_KEY_INFO, i2d_PKCS8_PRIV_KEY_INFO_fp,
                  i2d_PKCS8_PRIV_KEY_INFO_bio)
 
-int i2d_PKCS8PrivateKeyInfo_fp(FILE *fp, EVP_PKEY *key) {
+int i2d_PKCS8PrivateKeyInfo_fp(FILE *fp, const EVP_PKEY *key) {
   PKCS8_PRIV_KEY_INFO *p8inf;
   int ret;
   p8inf = EVP_PKEY2PKCS8(key);
@@ -296,7 +329,7 @@ IMPLEMENT_D2I_BIO(PKCS8_PRIV_KEY_INFO, d2i_PKCS8_PRIV_KEY_INFO_bio,
 IMPLEMENT_I2D_BIO(PKCS8_PRIV_KEY_INFO, i2d_PKCS8_PRIV_KEY_INFO_bio,
                   i2d_PKCS8_PRIV_KEY_INFO)
 
-int i2d_PKCS8PrivateKeyInfo_bio(BIO *bp, EVP_PKEY *key) {
+int i2d_PKCS8PrivateKeyInfo_bio(BIO *bp, const EVP_PKEY *key) {
   PKCS8_PRIV_KEY_INFO *p8inf;
   int ret;
   p8inf = EVP_PKEY2PKCS8(key);
@@ -315,4 +348,4 @@ IMPLEMENT_D2I_BIO(EVP_PKEY, d2i_PUBKEY_bio, d2i_PUBKEY)
 IMPLEMENT_I2D_BIO(EVP_PKEY, i2d_PUBKEY_bio, i2d_PUBKEY)
 
 IMPLEMENT_D2I_BIO(DH, d2i_DHparams_bio, d2i_DHparams)
-IMPLEMENT_I2D_BIO(const DH, i2d_DHparams_bio, i2d_DHparams)
+IMPLEMENT_I2D_BIO(DH, i2d_DHparams_bio, i2d_DHparams)

data/third_party/boringssl-with-bazel/crypto/x509/x_attrib.cc

@@ -20,23 +20,29 @@
 #include "internal.h"
 
 
+using namespace bssl;
+
+BSSL_NAMESPACE_BEGIN
+
 ASN1_SEQUENCE(X509_ATTRIBUTE) = {
     ASN1_SIMPLE(X509_ATTRIBUTE, object, ASN1_OBJECT),
     ASN1_SET_OF(X509_ATTRIBUTE, set, ASN1_ANY),
 } ASN1_SEQUENCE_END(X509_ATTRIBUTE)
 
+BSSL_NAMESPACE_END
+
 IMPLEMENT_ASN1_FUNCTIONS_const(X509_ATTRIBUTE)
 IMPLEMENT_ASN1_DUP_FUNCTION_const(X509_ATTRIBUTE)
 
 X509_ATTRIBUTE *X509_ATTRIBUTE_create(int nid, int attrtype, void *value) {
   ASN1_OBJECT *obj = OBJ_nid2obj(nid);
-  if (obj == NULL) {
-    return NULL;
+  if (obj == nullptr) {
+    return nullptr;
   }
 
   X509_ATTRIBUTE *ret = X509_ATTRIBUTE_new();
   ASN1_TYPE *val = ASN1_TYPE_new();
-  if (ret == NULL || val == NULL) {
+  if (ret == nullptr || val == nullptr) {
     goto err;
   }
 
@@ -51,5 +57,5 @@ X509_ATTRIBUTE *X509_ATTRIBUTE_create(int nid, int attrtype, void *value) {
 err:
   X509_ATTRIBUTE_free(ret);
   ASN1_TYPE_free(val);
-  return NULL;
+  return nullptr;
 }

data/third_party/boringssl-with-bazel/crypto/x509/x_crl.cc

@@ -19,7 +19,6 @@
 #include <openssl/mem.h>
 #include <openssl/obj.h>
 #include <openssl/stack.h>
-#include <openssl/thread.h>
 #include <openssl/x509.h>
 #include <openssl/x509v3.h>
 
@@ -29,21 +28,28 @@
 #include "../internal.h"
 #include "internal.h"
 
+
+using namespace bssl;
+
 static int X509_REVOKED_cmp(const X509_REVOKED *const *a,
                             const X509_REVOKED *const *b);
 static int setup_idp(X509_CRL *crl, ISSUING_DIST_POINT *idp);
 
+BSSL_NAMESPACE_BEGIN
+
 ASN1_SEQUENCE(X509_REVOKED) = {
     ASN1_SIMPLE(X509_REVOKED, serialNumber, ASN1_INTEGER),
     ASN1_SIMPLE(X509_REVOKED, revocationDate, ASN1_TIME),
     ASN1_SEQUENCE_OF_OPT(X509_REVOKED, extensions, X509_EXTENSION),
 } ASN1_SEQUENCE_END(X509_REVOKED)
 
+BSSL_NAMESPACE_END
+
 static int crl_lookup(X509_CRL *crl, X509_REVOKED **ret,
-                      const ASN1_INTEGER *serial, X509_NAME *issuer);
+                      const ASN1_INTEGER *serial, const X509_NAME *issuer);
 
 // The X509_CRL_INFO structure needs a bit of customisation. Since we cache
-// the original encoding the signature wont be affected by reordering of the
+// the original encoding the signature won't be affected by reordering of the
 // revoked field.
 static int crl_inf_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,
                       void *exarg) {
@@ -62,6 +68,7 @@ static int crl_inf_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,
   return 1;
 }
 
+BSSL_NAMESPACE_BEGIN
 
 ASN1_SEQUENCE_enc(X509_CRL_INFO, enc, crl_inf_cb) = {
     ASN1_OPT(X509_CRL_INFO, version, ASN1_INTEGER),
@@ -73,14 +80,31 @@ ASN1_SEQUENCE_enc(X509_CRL_INFO, enc, crl_inf_cb) = {
     ASN1_EXP_SEQUENCE_OF_OPT(X509_CRL_INFO, extensions, X509_EXTENSION, 0),
 } ASN1_SEQUENCE_END_enc(X509_CRL_INFO, X509_CRL_INFO)
 
+BSSL_NAMESPACE_END
+
 static int crl_parse_entry_extensions(X509_CRL *crl) {
+  long version = ASN1_INTEGER_get(crl->crl->version);
   STACK_OF(X509_REVOKED) *revoked = X509_CRL_get_REVOKED(crl);
   for (size_t i = 0; i < sk_X509_REVOKED_num(revoked); i++) {
     X509_REVOKED *rev = sk_X509_REVOKED_value(revoked, i);
 
+    // Per RFC 5280, section 5.1, CRL entry extensions require v2.
+    const STACK_OF(X509_EXTENSION) *exts = rev->extensions;
+    if (version == X509_CRL_VERSION_1 && exts != nullptr) {
+      OPENSSL_PUT_ERROR(X509, X509_R_INVALID_VERSION);
+      return 0;
+    }
+
+    // Extensions is a SEQUENCE SIZE (1..MAX), so it cannot be empty. An empty
+    // extensions list is encoded by omitting the OPTIONAL field.
+    if (exts != nullptr && sk_X509_EXTENSION_num(exts) == 0) {
+      OPENSSL_PUT_ERROR(ASN1, ASN1_R_DECODE_ERROR);
+      return 0;
+    }
+
     int crit;
     ASN1_ENUMERATED *reason = reinterpret_cast<ASN1_ENUMERATED *>(
-        X509_REVOKED_get_ext_d2i(rev, NID_crl_reason, &crit, NULL));
+        X509_REVOKED_get_ext_d2i(rev, NID_crl_reason, &crit, nullptr));
     if (!reason && crit != -1) {
       crl->flags |= EXFLAG_INVALID;
       return 1;
@@ -94,7 +118,6 @@ static int crl_parse_entry_extensions(X509_CRL *crl) {
     }
 
     // We do not support any critical CRL entry extensions.
-    const STACK_OF(X509_EXTENSION) *exts = rev->extensions;
     for (size_t j = 0; j < sk_X509_EXTENSION_num(exts); j++) {
       const X509_EXTENSION *ext = sk_X509_EXTENSION_value(exts, j);
       if (X509_EXTENSION_get_critical(ext)) {
@@ -116,8 +139,8 @@ static int crl_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,
 
   switch (operation) {
     case ASN1_OP_NEW_POST:
-      crl->idp = NULL;
-      crl->akid = NULL;
+      crl->idp = nullptr;
+      crl->akid = nullptr;
       crl->flags = 0;
       crl->idp_flags = 0;
       break;
@@ -125,30 +148,36 @@ static int crl_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,
     case ASN1_OP_D2I_POST: {
       // The version must be one of v1(0) or v2(1).
       long version = X509_CRL_VERSION_1;
-      if (crl->crl->version != NULL) {
+      if (crl->crl->version != nullptr) {
         version = ASN1_INTEGER_get(crl->crl->version);
-        // TODO(https://crbug.com/boringssl/364): |X509_CRL_VERSION_1|
-        // should also be rejected. This means an explicitly-encoded X.509v1
-        // version. v1 is DEFAULT, so DER requires it be omitted.
-        if (version < X509_CRL_VERSION_1 || version > X509_CRL_VERSION_2) {
+        // Versions v1 and v2. v1 is DEFAULT, so cannot be encoded explicitly.
+        if (version != X509_CRL_VERSION_2) {
           OPENSSL_PUT_ERROR(X509, X509_R_INVALID_VERSION);
           return 0;
         }
       }
 
       // Per RFC 5280, section 5.1.2.1, extensions require v2.
-      if (version != X509_CRL_VERSION_2 && crl->crl->extensions != NULL) {
+      if (version != X509_CRL_VERSION_2 && crl->crl->extensions != nullptr) {
         OPENSSL_PUT_ERROR(X509, X509_R_INVALID_FIELD_FOR_VERSION);
         return 0;
       }
 
-      if (!X509_CRL_digest(crl, EVP_sha256(), crl->crl_hash, NULL)) {
+      // Extensions is a SEQUENCE SIZE (1..MAX), so it cannot be empty. An empty
+      // extensions list is encoded by omitting the OPTIONAL field.
+      if (crl->crl->extensions != nullptr &&
+          sk_X509_EXTENSION_num(crl->crl->extensions) == 0) {
+        OPENSSL_PUT_ERROR(ASN1, ASN1_R_DECODE_ERROR);
+        return 0;
+      }
+
+      if (!X509_CRL_digest(crl, EVP_sha256(), crl->crl_hash, nullptr)) {
         return 0;
       }
 
-      crl->idp = reinterpret_cast<ISSUING_DIST_POINT *>(
-          X509_CRL_get_ext_d2i(crl, NID_issuing_distribution_point, &i, NULL));
-      if (crl->idp != NULL) {
+      crl->idp = reinterpret_cast<ISSUING_DIST_POINT *>(X509_CRL_get_ext_d2i(
+          crl, NID_issuing_distribution_point, &i, nullptr));
+      if (crl->idp != nullptr) {
         if (!setup_idp(crl, crl->idp)) {
           return 0;
         }
@@ -157,8 +186,8 @@ static int crl_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,
       }
 
       crl->akid = reinterpret_cast<AUTHORITY_KEYID *>(
-          X509_CRL_get_ext_d2i(crl, NID_authority_key_identifier, &i, NULL));
-      if (crl->akid == NULL && i != -1) {
+          X509_CRL_get_ext_d2i(crl, NID_authority_key_identifier, &i, nullptr));
+      if (crl->akid == nullptr && i != -1) {
         return 0;
       }
 
@@ -198,7 +227,7 @@ static int crl_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,
 // Convert IDP into a more convenient form
 //
 // TODO(davidben): Each of these flags are already booleans, so this is not
-// really more convenient. We can probably remove |idp_flags|.
+// really more convenient. We can probably remove `idp_flags`.
 static int setup_idp(X509_CRL *crl, ISSUING_DIST_POINT *idp) {
   int idp_only = 0;
   // Set various flags according to IDP
@@ -219,7 +248,7 @@ static int setup_idp(X509_CRL *crl, ISSUING_DIST_POINT *idp) {
   // Per RFC 5280, section 5.2.5, at most one of onlyContainsUserCerts,
   // onlyContainsCACerts, and onlyContainsAttributeCerts may be true.
   //
-  // TODO(crbug.com/boringssl/443): Move this check to the |ISSUING_DIST_POINT|
+  // TODO(crbug.com/boringssl/443): Move this check to the `ISSUING_DIST_POINT`
   // parser.
   if (idp_only > 1) {
     crl->idp_flags |= IDP_INVALID;
@@ -238,21 +267,27 @@ static int setup_idp(X509_CRL *crl, ISSUING_DIST_POINT *idp) {
   return DIST_POINT_set_dpname(idp->distpoint, X509_CRL_get_issuer(crl));
 }
 
+BSSL_NAMESPACE_BEGIN
+
 ASN1_SEQUENCE_ref(X509_CRL, crl_cb) = {
     ASN1_SIMPLE(X509_CRL, crl, X509_CRL_INFO),
     ASN1_SIMPLE(X509_CRL, sig_alg, X509_ALGOR),
     ASN1_SIMPLE(X509_CRL, signature, ASN1_BIT_STRING),
 } ASN1_SEQUENCE_END_ref(X509_CRL, X509_CRL)
 
-// Although |X509_REVOKED| contains an |X509_NAME|, it can be const. It is not
-// affected by https://crbug.com/boringssl/407 because the  |X509_NAME| does
-// not participate in serialization.
+BSSL_NAMESPACE_END
+
 IMPLEMENT_ASN1_FUNCTIONS_const(X509_REVOKED)
 IMPLEMENT_ASN1_DUP_FUNCTION_const(X509_REVOKED)
 
-IMPLEMENT_ASN1_FUNCTIONS(X509_CRL_INFO)
-IMPLEMENT_ASN1_FUNCTIONS(X509_CRL)
-IMPLEMENT_ASN1_DUP_FUNCTION(X509_CRL)
+BSSL_NAMESPACE_BEGIN
+
+IMPLEMENT_ASN1_FUNCTIONS_const(X509_CRL_INFO)
+
+BSSL_NAMESPACE_END
+
+IMPLEMENT_ASN1_FUNCTIONS_const(X509_CRL)
+IMPLEMENT_ASN1_DUP_FUNCTION_const(X509_CRL)
 
 static int X509_REVOKED_cmp(const X509_REVOKED *const *a,
                             const X509_REVOKED *const *b) {
@@ -260,8 +295,7 @@ static int X509_REVOKED_cmp(const X509_REVOKED *const *a,
 }
 
 int X509_CRL_add0_revoked(X509_CRL *crl, X509_REVOKED *rev) {
-  X509_CRL_INFO *inf;
-  inf = crl->crl;
+  X509_CRL_INFO *inf = crl->crl;
   if (!inf->revoked) {
     inf->revoked = sk_X509_REVOKED_new(X509_REVOKED_cmp);
   }
@@ -272,7 +306,7 @@ int X509_CRL_add0_revoked(X509_CRL *crl, X509_REVOKED *rev) {
   return 1;
 }
 
-int X509_CRL_verify(X509_CRL *crl, EVP_PKEY *pkey) {
+int X509_CRL_verify(const X509_CRL *crl, EVP_PKEY *pkey) {
   if (X509_ALGOR_cmp(crl->sig_alg, crl->crl->sig_alg) != 0) {
     OPENSSL_PUT_ERROR(X509, X509_R_SIGNATURE_ALGORITHM_MISMATCH);
     return 0;
@@ -284,42 +318,41 @@ int X509_CRL_verify(X509_CRL *crl, EVP_PKEY *pkey) {
 
 int X509_CRL_get0_by_serial(X509_CRL *crl, X509_REVOKED **ret,
                             const ASN1_INTEGER *serial) {
-  return crl_lookup(crl, ret, serial, NULL);
+  return crl_lookup(crl, ret, serial, nullptr);
 }
 
-int X509_CRL_get0_by_cert(X509_CRL *crl, X509_REVOKED **ret, X509 *x) {
-  return crl_lookup(crl, ret, X509_get_serialNumber(x),
+int X509_CRL_get0_by_cert(X509_CRL *crl, X509_REVOKED **ret, const X509 *x) {
+  return crl_lookup(crl, ret, X509_get0_serialNumber(x),
                     X509_get_issuer_name(x));
 }
 
-static int crl_revoked_issuer_match(X509_CRL *crl, X509_NAME *nm,
-                                    X509_REVOKED *rev) {
-  return nm == NULL || X509_NAME_cmp(nm, X509_CRL_get_issuer(crl)) == 0;
+static int crl_revoked_issuer_match(const X509_CRL *crl, const X509_NAME *nm,
+                                    const X509_REVOKED *rev) {
+  return nm == nullptr || X509_NAME_cmp(nm, X509_CRL_get_issuer(crl)) == 0;
 }
 
-static CRYPTO_MUTEX g_crl_sort_lock = CRYPTO_MUTEX_INIT;
+static StaticMutex g_crl_sort_lock;
 
 static int crl_lookup(X509_CRL *crl, X509_REVOKED **ret,
-                      const ASN1_INTEGER *serial, X509_NAME *issuer) {
+                      const ASN1_INTEGER *serial, const X509_NAME *issuer) {
   // Use an assert, rather than a runtime error, because returning nothing for a
   // CRL is arguably failing open, rather than closed.
   assert(serial->type == V_ASN1_INTEGER || serial->type == V_ASN1_NEG_INTEGER);
-  X509_REVOKED rtmp, *rev;
+  X509_REVOKED rtmp;
   size_t idx;
   rtmp.serialNumber = (ASN1_INTEGER *)serial;
   // Sort revoked into serial number order if not already sorted. Do this
   // under a lock to avoid race condition.
 
-  CRYPTO_MUTEX_lock_read(&g_crl_sort_lock);
+  g_crl_sort_lock.LockRead();
   const int is_sorted = sk_X509_REVOKED_is_sorted(crl->crl->revoked);
-  CRYPTO_MUTEX_unlock_read(&g_crl_sort_lock);
+  g_crl_sort_lock.UnlockRead();
 
   if (!is_sorted) {
-    CRYPTO_MUTEX_lock_write(&g_crl_sort_lock);
+    MutexWriteLock lock(&g_crl_sort_lock);
     if (!sk_X509_REVOKED_is_sorted(crl->crl->revoked)) {
       sk_X509_REVOKED_sort(crl->crl->revoked);
     }
-    CRYPTO_MUTEX_unlock_write(&g_crl_sort_lock);
   }
 
   if (!sk_X509_REVOKED_find(crl->crl->revoked, &idx, &rtmp)) {
@@ -327,7 +360,7 @@ static int crl_lookup(X509_CRL *crl, X509_REVOKED **ret,
   }
   // Need to look for matching name
   for (; idx < sk_X509_REVOKED_num(crl->crl->revoked); idx++) {
-    rev = sk_X509_REVOKED_value(crl->crl->revoked, idx);
+    X509_REVOKED *rev = sk_X509_REVOKED_value(crl->crl->revoked, idx);
     if (ASN1_INTEGER_cmp(rev->serialNumber, serial)) {
       return 0;
     }

data/third_party/boringssl-with-bazel/crypto/x509/x_exten.cc

@@ -20,16 +20,22 @@
 #include "internal.h"
 
 
+using namespace bssl;
+
 ASN1_SEQUENCE(X509_EXTENSION) = {
     ASN1_SIMPLE(X509_EXTENSION, object, ASN1_OBJECT),
     ASN1_OPT(X509_EXTENSION, critical, ASN1_BOOLEAN),
     ASN1_SIMPLE(X509_EXTENSION, value, ASN1_OCTET_STRING),
 } ASN1_SEQUENCE_END(X509_EXTENSION)
 
+BSSL_NAMESPACE_BEGIN
+
 ASN1_ITEM_TEMPLATE(X509_EXTENSIONS) =
     ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, Extension, X509_EXTENSION)
 ASN1_ITEM_TEMPLATE_END(X509_EXTENSIONS)
 
+BSSL_NAMESPACE_END
+
 IMPLEMENT_ASN1_FUNCTIONS_const(X509_EXTENSION)
 IMPLEMENT_ASN1_ENCODE_FUNCTIONS_const_fname(X509_EXTENSIONS, X509_EXTENSIONS,
                                             X509_EXTENSIONS)