grpc 1.84.0 → 1.85.0.pre1

data/third_party/boringssl-with-bazel/ssl/ssl_file.cc

@@ -14,7 +14,6 @@
 
 #include <openssl/ssl.h>
 
-#include <errno.h>
 #include <string.h>
 
 #include <openssl/asn1.h>
@@ -28,22 +27,24 @@
 #include "internal.h"
 
 
+using namespace bssl;
+
 static int xname_cmp(const X509_NAME *const *a, const X509_NAME *const *b) {
   return X509_NAME_cmp(*a, *b);
 }
 
 static int add_bio_cert_subjects_to_stack(STACK_OF(X509_NAME) *out, BIO *bio,
                                           bool allow_empty) {
-  // This function historically sorted |out| after every addition and skipped
+  // This function historically sorted `out` after every addition and skipped
   // duplicates. This implementation preserves that behavior, but only sorts at
-  // the end, to avoid a quadratic running time. Existing duplicates in |out|
+  // the end, to avoid a quadratic running time. Existing duplicates in `out`
   // are preserved, but do not introduce new duplicates.
-  bssl::UniquePtr<STACK_OF(X509_NAME)> to_append(sk_X509_NAME_new(xname_cmp));
+  UniquePtr<STACK_OF(X509_NAME)> to_append(sk_X509_NAME_new(xname_cmp));
   if (to_append == nullptr) {
     return 0;
   }
 
-  // Temporarily switch the comparison function for |out|.
+  // Temporarily switch the comparison function for `out`.
   struct RestoreCmpFunc {
     ~RestoreCmpFunc() { sk_X509_NAME_set_cmp_func(stack, old_cmp); }
     STACK_OF(X509_NAME) *stack;
@@ -54,50 +55,48 @@ static int add_bio_cert_subjects_to_stack(STACK_OF(X509_NAME) *out, BIO *bio,
   sk_X509_NAME_sort(out);
   bool first = true;
   for (;;) {
-    bssl::UniquePtr<X509> x509(
-        PEM_read_bio_X509(bio, nullptr, nullptr, nullptr));
+    UniquePtr<X509> x509(PEM_read_bio_X509(bio, nullptr, nullptr, nullptr));
     if (x509 == nullptr) {
       if (first && !allow_empty) {
         return 0;
       }
       // TODO(davidben): This ignores PEM syntax errors. It should only succeed
-      // on |PEM_R_NO_START_LINE|.
+      // on `PEM_R_NO_START_LINE`.
       ERR_clear_error();
       break;
     }
     first = false;
 
     X509_NAME *subject = X509_get_subject_name(x509.get());
-    // Skip if already present in |out|. Duplicates in |to_append| will be
+    // Skip if already present in `out`. Duplicates in `to_append` will be
     // handled separately.
-    if (sk_X509_NAME_find(out, /*out_index=*/NULL, subject)) {
+    if (sk_X509_NAME_find(out, /*out_index=*/nullptr, subject)) {
       continue;
     }
 
-    bssl::UniquePtr<X509_NAME> copy(X509_NAME_dup(subject));
-    if (copy == nullptr ||
-        !bssl::PushToStack(to_append.get(), std::move(copy))) {
+    UniquePtr<X509_NAME> copy(X509_NAME_dup(subject));
+    if (copy == nullptr || !PushToStack(to_append.get(), std::move(copy))) {
       return 0;
     }
   }
 
-  // Append |to_append| to |stack|, skipping any duplicates.
+  // Append `to_append` to `stack`, skipping any duplicates.
   sk_X509_NAME_sort(to_append.get());
   size_t num = sk_X509_NAME_num(to_append.get());
   for (size_t i = 0; i < num; i++) {
-    bssl::UniquePtr<X509_NAME> name(sk_X509_NAME_value(to_append.get(), i));
+    UniquePtr<X509_NAME> name(sk_X509_NAME_value(to_append.get(), i));
     sk_X509_NAME_set(to_append.get(), i, nullptr);
     if (i + 1 < num &&
         X509_NAME_cmp(name.get(), sk_X509_NAME_value(to_append.get(), i + 1)) ==
             0) {
       continue;
     }
-    if (!bssl::PushToStack(out, std::move(name))) {
+    if (!PushToStack(out, std::move(name))) {
       return 0;
     }
   }
 
-  // Sort |out| one last time, to preserve the historical behavior of
+  // Sort `out` one last time, to preserve the historical behavior of
   // maintaining the sorted list.
   sk_X509_NAME_sort(out);
   return 1;
@@ -108,11 +107,11 @@ int SSL_add_bio_cert_subjects_to_stack(STACK_OF(X509_NAME) *out, BIO *bio) {
 }
 
 STACK_OF(X509_NAME) *SSL_load_client_CA_file(const char *file) {
-  bssl::UniquePtr<BIO> in(BIO_new_file(file, "rb"));
+  UniquePtr<BIO> in(BIO_new_file(file, "rb"));
   if (in == nullptr) {
     return nullptr;
   }
-  bssl::UniquePtr<STACK_OF(X509_NAME)> ret(sk_X509_NAME_new_null());
+  UniquePtr<STACK_OF(X509_NAME)> ret(sk_X509_NAME_new_null());
   if (ret == nullptr ||  //
       !add_bio_cert_subjects_to_stack(ret.get(), in.get(),
                                       /*allow_empty=*/false)) {
@@ -123,7 +122,7 @@ STACK_OF(X509_NAME) *SSL_load_client_CA_file(const char *file) {
 
 int SSL_add_file_cert_subjects_to_stack(STACK_OF(X509_NAME) *out,
                                         const char *file) {
-  bssl::UniquePtr<BIO> in(BIO_new_file(file, "rb"));
+  UniquePtr<BIO> in(BIO_new_file(file, "rb"));
   if (in == nullptr) {
     return 0;
   }
@@ -131,336 +130,244 @@ int SSL_add_file_cert_subjects_to_stack(STACK_OF(X509_NAME) *out,
 }
 
 int SSL_use_certificate_file(SSL *ssl, const char *file, int type) {
-  int reason_code;
-  BIO *in;
-  int ret = 0;
-  X509 *x = NULL;
-
-  in = BIO_new(BIO_s_file());
-  if (in == NULL) {
+  UniquePtr<BIO> in(BIO_new_file(file, "rb"));
+  if (in == nullptr) {
     OPENSSL_PUT_ERROR(SSL, ERR_R_BUF_LIB);
-    goto end;
-  }
-
-  if (BIO_read_filename(in, file) <= 0) {
-    OPENSSL_PUT_ERROR(SSL, ERR_R_SYS_LIB);
-    goto end;
+    return 0;
   }
 
+  int reason_code;
+  UniquePtr<X509> x;
   if (type == SSL_FILETYPE_ASN1) {
     reason_code = ERR_R_ASN1_LIB;
-    x = d2i_X509_bio(in, NULL);
+    x.reset(d2i_X509_bio(in.get(), nullptr));
   } else if (type == SSL_FILETYPE_PEM) {
     reason_code = ERR_R_PEM_LIB;
-    x = PEM_read_bio_X509(in, NULL, ssl->ctx->default_passwd_callback,
-                          ssl->ctx->default_passwd_callback_userdata);
+    x.reset(PEM_read_bio_X509(in.get(), nullptr,
+                              ssl->ctx->default_passwd_callback,
+                              ssl->ctx->default_passwd_callback_userdata));
   } else {
     OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_SSL_FILETYPE);
-    goto end;
+    return 0;
   }
 
-  if (x == NULL) {
+  if (x == nullptr) {
     OPENSSL_PUT_ERROR(SSL, reason_code);
-    goto end;
+    return 0;
   }
 
-  ret = SSL_use_certificate(ssl, x);
-
-end:
-  X509_free(x);
-  BIO_free(in);
-
-  return ret;
+  return SSL_use_certificate(ssl, x.get());
 }
 
 int SSL_use_RSAPrivateKey_file(SSL *ssl, const char *file, int type) {
-  int reason_code, ret = 0;
-  BIO *in;
-  RSA *rsa = NULL;
-
-  in = BIO_new(BIO_s_file());
-  if (in == NULL) {
+  UniquePtr<BIO> in(BIO_new_file(file, "rb"));
+  if (in == nullptr) {
     OPENSSL_PUT_ERROR(SSL, ERR_R_BUF_LIB);
-    goto end;
-  }
-
-  if (BIO_read_filename(in, file) <= 0) {
-    OPENSSL_PUT_ERROR(SSL, ERR_R_SYS_LIB);
-    goto end;
+    return 0;
   }
 
+  int reason_code;
+  UniquePtr<RSA> rsa;
   if (type == SSL_FILETYPE_ASN1) {
     reason_code = ERR_R_ASN1_LIB;
-    rsa = d2i_RSAPrivateKey_bio(in, NULL);
+    rsa.reset(d2i_RSAPrivateKey_bio(in.get(), nullptr));
   } else if (type == SSL_FILETYPE_PEM) {
     reason_code = ERR_R_PEM_LIB;
-    rsa =
-        PEM_read_bio_RSAPrivateKey(in, NULL, ssl->ctx->default_passwd_callback,
-                                   ssl->ctx->default_passwd_callback_userdata);
+    rsa.reset(PEM_read_bio_RSAPrivateKey(
+        in.get(), nullptr, ssl->ctx->default_passwd_callback,
+        ssl->ctx->default_passwd_callback_userdata));
   } else {
     OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_SSL_FILETYPE);
-    goto end;
+    return 0;
   }
 
-  if (rsa == NULL) {
+  if (rsa == nullptr) {
     OPENSSL_PUT_ERROR(SSL, reason_code);
-    goto end;
+    return 0;
   }
-  ret = SSL_use_RSAPrivateKey(ssl, rsa);
-  RSA_free(rsa);
-
-end:
-  BIO_free(in);
-  return ret;
+  return SSL_use_RSAPrivateKey(ssl, rsa.get());
 }
 
 int SSL_use_PrivateKey_file(SSL *ssl, const char *file, int type) {
-  int reason_code, ret = 0;
-  BIO *in;
-  EVP_PKEY *pkey = NULL;
-
-  in = BIO_new(BIO_s_file());
-  if (in == NULL) {
+  UniquePtr<BIO> in(BIO_new_file(file, "rb"));
+  if (in == nullptr) {
     OPENSSL_PUT_ERROR(SSL, ERR_R_BUF_LIB);
-    goto end;
-  }
-
-  if (BIO_read_filename(in, file) <= 0) {
-    OPENSSL_PUT_ERROR(SSL, ERR_R_SYS_LIB);
-    goto end;
+    return 0;
   }
 
+  int reason_code;
+  UniquePtr<EVP_PKEY> pkey;
   if (type == SSL_FILETYPE_PEM) {
     reason_code = ERR_R_PEM_LIB;
-    pkey = PEM_read_bio_PrivateKey(in, NULL, ssl->ctx->default_passwd_callback,
-                                   ssl->ctx->default_passwd_callback_userdata);
+    pkey.reset(PEM_read_bio_PrivateKey(
+        in.get(), nullptr, ssl->ctx->default_passwd_callback,
+        ssl->ctx->default_passwd_callback_userdata));
   } else if (type == SSL_FILETYPE_ASN1) {
     reason_code = ERR_R_ASN1_LIB;
-    pkey = d2i_PrivateKey_bio(in, NULL);
+    pkey.reset(d2i_PrivateKey_bio(in.get(), nullptr));
   } else {
     OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_SSL_FILETYPE);
-    goto end;
+    return 0;
   }
 
-  if (pkey == NULL) {
+  if (pkey == nullptr) {
     OPENSSL_PUT_ERROR(SSL, reason_code);
-    goto end;
+    return 0;
   }
-  ret = SSL_use_PrivateKey(ssl, pkey);
-  EVP_PKEY_free(pkey);
 
-end:
-  BIO_free(in);
-  return ret;
+  return SSL_use_PrivateKey(ssl, pkey.get());
 }
 
 int SSL_CTX_use_certificate_file(SSL_CTX *ctx, const char *file, int type) {
-  int reason_code;
-  BIO *in;
-  int ret = 0;
-  X509 *x = NULL;
-
-  in = BIO_new(BIO_s_file());
-  if (in == NULL) {
+  auto *ctx_impl = FromOpaque(ctx);
+  UniquePtr<BIO> in(BIO_new_file(file, "rb"));
+  if (in == nullptr) {
     OPENSSL_PUT_ERROR(SSL, ERR_R_BUF_LIB);
-    goto end;
-  }
-
-  if (BIO_read_filename(in, file) <= 0) {
-    OPENSSL_PUT_ERROR(SSL, ERR_R_SYS_LIB);
-    goto end;
+    return 0;
   }
 
+  int reason_code;
+  UniquePtr<X509> x;
   if (type == SSL_FILETYPE_ASN1) {
     reason_code = ERR_R_ASN1_LIB;
-    x = d2i_X509_bio(in, NULL);
+    x.reset(d2i_X509_bio(in.get(), nullptr));
   } else if (type == SSL_FILETYPE_PEM) {
     reason_code = ERR_R_PEM_LIB;
-    x = PEM_read_bio_X509(in, NULL, ctx->default_passwd_callback,
-                          ctx->default_passwd_callback_userdata);
+    x.reset(PEM_read_bio_X509(in.get(), nullptr,
+                              ctx_impl->default_passwd_callback,
+                              ctx_impl->default_passwd_callback_userdata));
   } else {
     OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_SSL_FILETYPE);
-    goto end;
+    return 0;
   }
 
-  if (x == NULL) {
+  if (x == nullptr) {
     OPENSSL_PUT_ERROR(SSL, reason_code);
-    goto end;
+    return 0;
   }
 
-  ret = SSL_CTX_use_certificate(ctx, x);
-
-end:
-  X509_free(x);
-  BIO_free(in);
-  return ret;
+  return SSL_CTX_use_certificate(ctx, x.get());
 }
 
 int SSL_CTX_use_RSAPrivateKey_file(SSL_CTX *ctx, const char *file, int type) {
-  int reason_code, ret = 0;
-  BIO *in;
-  RSA *rsa = NULL;
-
-  in = BIO_new(BIO_s_file());
-  if (in == NULL) {
+  auto *ctx_impl = FromOpaque(ctx);
+  UniquePtr<BIO> in(BIO_new_file(file, "rb"));
+  if (in == nullptr) {
     OPENSSL_PUT_ERROR(SSL, ERR_R_BUF_LIB);
-    goto end;
-  }
-
-  if (BIO_read_filename(in, file) <= 0) {
-    OPENSSL_PUT_ERROR(SSL, ERR_R_SYS_LIB);
-    goto end;
+    return 0;
   }
 
+  int reason_code;
+  UniquePtr<RSA> rsa;
   if (type == SSL_FILETYPE_ASN1) {
     reason_code = ERR_R_ASN1_LIB;
-    rsa = d2i_RSAPrivateKey_bio(in, NULL);
+    rsa.reset(d2i_RSAPrivateKey_bio(in.get(), nullptr));
   } else if (type == SSL_FILETYPE_PEM) {
     reason_code = ERR_R_PEM_LIB;
-    rsa = PEM_read_bio_RSAPrivateKey(in, NULL, ctx->default_passwd_callback,
-                                     ctx->default_passwd_callback_userdata);
+    rsa.reset(PEM_read_bio_RSAPrivateKey(
+        in.get(), nullptr, ctx_impl->default_passwd_callback,
+        ctx_impl->default_passwd_callback_userdata));
   } else {
     OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_SSL_FILETYPE);
-    goto end;
+    return 0;
   }
 
-  if (rsa == NULL) {
+  if (rsa == nullptr) {
     OPENSSL_PUT_ERROR(SSL, reason_code);
-    goto end;
+    return 0;
   }
-  ret = SSL_CTX_use_RSAPrivateKey(ctx, rsa);
-  RSA_free(rsa);
-
-end:
-  BIO_free(in);
-  return ret;
+  return SSL_CTX_use_RSAPrivateKey(ctx, rsa.get());
 }
 
 int SSL_CTX_use_PrivateKey_file(SSL_CTX *ctx, const char *file, int type) {
-  int reason_code, ret = 0;
-  BIO *in;
-  EVP_PKEY *pkey = NULL;
-
-  in = BIO_new(BIO_s_file());
-  if (in == NULL) {
+  auto *ctx_impl = FromOpaque(ctx);
+  UniquePtr<BIO> in(BIO_new_file(file, "rb"));
+  if (in == nullptr) {
     OPENSSL_PUT_ERROR(SSL, ERR_R_BUF_LIB);
-    goto end;
-  }
-
-  if (BIO_read_filename(in, file) <= 0) {
-    OPENSSL_PUT_ERROR(SSL, ERR_R_SYS_LIB);
-    goto end;
+    return 0;
   }
 
+  int reason_code;
+  UniquePtr<EVP_PKEY> pkey;
   if (type == SSL_FILETYPE_PEM) {
     reason_code = ERR_R_PEM_LIB;
-    pkey = PEM_read_bio_PrivateKey(in, NULL, ctx->default_passwd_callback,
-                                   ctx->default_passwd_callback_userdata);
+    pkey.reset(PEM_read_bio_PrivateKey(
+        in.get(), nullptr, ctx_impl->default_passwd_callback,
+        ctx_impl->default_passwd_callback_userdata));
   } else if (type == SSL_FILETYPE_ASN1) {
     reason_code = ERR_R_ASN1_LIB;
-    pkey = d2i_PrivateKey_bio(in, NULL);
+    pkey.reset(d2i_PrivateKey_bio(in.get(), nullptr));
   } else {
     OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_SSL_FILETYPE);
-    goto end;
+    return 0;
   }
 
-  if (pkey == NULL) {
+  if (pkey == nullptr) {
     OPENSSL_PUT_ERROR(SSL, reason_code);
-    goto end;
+    return 0;
   }
-  ret = SSL_CTX_use_PrivateKey(ctx, pkey);
-  EVP_PKEY_free(pkey);
 
-end:
-  BIO_free(in);
-  return ret;
+  return SSL_CTX_use_PrivateKey(ctx, pkey.get());
 }
 
 // Read a file that contains our certificate in "PEM" format, possibly followed
 // by a sequence of CA certificates that should be sent to the peer in the
 // Certificate message.
 int SSL_CTX_use_certificate_chain_file(SSL_CTX *ctx, const char *file) {
-  BIO *in;
-  int ret = 0;
-  X509 *x = NULL;
-
-  ERR_clear_error();  // clear error stack for SSL_CTX_use_certificate()
-
-  in = BIO_new(BIO_s_file());
-  if (in == NULL) {
+  auto *ctx_impl = FromOpaque(ctx);
+  UniquePtr<BIO> in(BIO_new_file(file, "rb"));
+  if (in == nullptr) {
     OPENSSL_PUT_ERROR(SSL, ERR_R_BUF_LIB);
-    goto end;
-  }
-
-  if (BIO_read_filename(in, file) <= 0) {
-    OPENSSL_PUT_ERROR(SSL, ERR_R_SYS_LIB);
-    goto end;
+    return 0;
   }
 
-  x = PEM_read_bio_X509_AUX(in, NULL, ctx->default_passwd_callback,
-                            ctx->default_passwd_callback_userdata);
-  if (x == NULL) {
+  UniquePtr<X509> x(PEM_read_bio_X509_AUX(
+      in.get(), nullptr, ctx_impl->default_passwd_callback,
+      ctx_impl->default_passwd_callback_userdata));
+  if (x == nullptr) {
     OPENSSL_PUT_ERROR(SSL, ERR_R_PEM_LIB);
-    goto end;
+    return 0;
   }
 
-  ret = SSL_CTX_use_certificate(ctx, x);
-
-  if (ERR_peek_error() != 0) {
-    ret = 0;  // Key/certificate mismatch doesn't imply ret==0 ...
+  if (!SSL_CTX_use_certificate(ctx, x.get())) {
+    return 0;
   }
 
-  if (ret) {
-    // If we could set up our certificate, now proceed to the CA
-    // certificates.
-    X509 *ca;
-    int r;
-    uint32_t err;
-
-    SSL_CTX_clear_chain_certs(ctx);
-
-    while ((ca = PEM_read_bio_X509(in, NULL, ctx->default_passwd_callback,
-                                   ctx->default_passwd_callback_userdata)) !=
-           NULL) {
-      r = SSL_CTX_add0_chain_cert(ctx, ca);
-      if (!r) {
-        X509_free(ca);
-        ret = 0;
-        goto end;
-      }
-      // Note that we must not free r if it was successfully added to the chain
-      // (while we must free the main certificate, since its reference count is
-      // increased by SSL_CTX_use_certificate).
+  // If we could set up our certificate, now proceed to the CA certificates.
+  SSL_CTX_clear_chain_certs(ctx);
+  for (;;) {
+    UniquePtr<X509> ca(
+        PEM_read_bio_X509(in.get(), nullptr, ctx_impl->default_passwd_callback,
+                          ctx_impl->default_passwd_callback_userdata));
+    if (ca == nullptr) {
+      break;
     }
-
-    // When the while loop ends, it's usually just EOF.
-    err = ERR_peek_last_error();
-    if (ERR_GET_LIB(err) == ERR_LIB_PEM &&
-        ERR_GET_REASON(err) == PEM_R_NO_START_LINE) {
-      ERR_clear_error();
-    } else {
-      ret = 0;  // some real error
+    if (!SSL_CTX_add1_chain_cert(ctx, ca.get())) {
+      return 0;
     }
   }
 
-end:
-  X509_free(x);
-  BIO_free(in);
-  return ret;
+  // When the while loop ends, it's usually just EOF.
+  if (ERR_equals(ERR_peek_last_error(), ERR_LIB_PEM, PEM_R_NO_START_LINE)) {
+    ERR_clear_error();
+    return 1;
+  }
+
+  return 0;  // Some real error.
 }
 
 void SSL_CTX_set_default_passwd_cb(SSL_CTX *ctx, pem_password_cb *cb) {
-  ctx->default_passwd_callback = cb;
+  FromOpaque(ctx)->default_passwd_callback = cb;
 }
 
 pem_password_cb *SSL_CTX_get_default_passwd_cb(const SSL_CTX *ctx) {
-  return ctx->default_passwd_callback;
+  return FromOpaque(ctx)->default_passwd_callback;
 }
 
 void SSL_CTX_set_default_passwd_cb_userdata(SSL_CTX *ctx, void *data) {
-  ctx->default_passwd_callback_userdata = data;
+  FromOpaque(ctx)->default_passwd_callback_userdata = data;
 }
 
 void *SSL_CTX_get_default_passwd_cb_userdata(const SSL_CTX *ctx) {
-  return ctx->default_passwd_callback_userdata;
+  return FromOpaque(ctx)->default_passwd_callback_userdata;
 }