visaljs 0.0.1 → 0.0.3

package/runtime/third_party/boringssl/crypto/x509/x509.cc

@@ -0,0 +1,47 @@
+// Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <openssl/x509.h>
+
+#include <openssl/bio.h>
+#include <openssl/err.h>
+#include <openssl/mem.h>
+
+
+// `X509_R_UNSUPPORTED_ALGORITHM` is no longer emitted, but continue to define
+// it to avoid downstream churn.
+OPENSSL_DECLARE_ERROR_REASON(X509, UNSUPPORTED_ALGORITHM)
+
+int X509_signature_dump(BIO *bp, const ASN1_STRING *sig, int indent) {
+  const uint8_t *s;
+  int i, n;
+
+  n = sig->length;
+  s = sig->data;
+  for (i = 0; i < n; i++) {
+    if ((i % 18) == 0) {
+      if (BIO_write(bp, "\n", 1) <= 0 || BIO_indent(bp, indent, indent) <= 0) {
+        return 0;
+      }
+    }
+    if (BIO_printf(bp, "%02x%s", s[i], ((i + 1) == n) ? "" : ":") <= 0) {
+      return 0;
+    }
+  }
+  if (BIO_write(bp, "\n", 1) != 1) {
+    return 0;
+  }
+
+  return 1;
+}

package/runtime/third_party/boringssl/crypto/x509/x509_att.cc

@@ -0,0 +1,188 @@
+// Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <openssl/asn1.h>
+#include <openssl/err.h>
+#include <openssl/obj.h>
+#include <openssl/x509.h>
+
+#include "../asn1/internal.h"
+#include "internal.h"
+
+
+using namespace bssl;
+
+X509_ATTRIBUTE *X509_ATTRIBUTE_create_by_NID(X509_ATTRIBUTE **attr, int nid,
+                                             int attrtype, const void *data,
+                                             int len) {
+  const ASN1_OBJECT *obj;
+
+  obj = OBJ_nid2obj(nid);
+  if (obj == nullptr) {
+    OPENSSL_PUT_ERROR(X509, X509_R_UNKNOWN_NID);
+    return nullptr;
+  }
+  return X509_ATTRIBUTE_create_by_OBJ(attr, obj, attrtype, data, len);
+}
+
+X509_ATTRIBUTE *X509_ATTRIBUTE_create_by_OBJ(X509_ATTRIBUTE **attr,
+                                             const ASN1_OBJECT *obj,
+                                             int attrtype, const void *data,
+                                             int len) {
+  X509_ATTRIBUTE *ret;
+
+  if ((attr == nullptr) || (*attr == nullptr)) {
+    if ((ret = X509_ATTRIBUTE_new()) == nullptr) {
+      return nullptr;
+    }
+  } else {
+    ret = *attr;
+  }
+
+  if (!X509_ATTRIBUTE_set1_object(ret, obj)) {
+    goto err;
+  }
+  if (!X509_ATTRIBUTE_set1_data(ret, attrtype, data, len)) {
+    goto err;
+  }
+
+  if ((attr != nullptr) && (*attr == nullptr)) {
+    *attr = ret;
+  }
+  return ret;
+err:
+  if ((attr == nullptr) || (ret != *attr)) {
+    X509_ATTRIBUTE_free(ret);
+  }
+  return nullptr;
+}
+
+X509_ATTRIBUTE *X509_ATTRIBUTE_create_by_txt(X509_ATTRIBUTE **attr,
+                                             const char *attrname, int type,
+                                             const unsigned char *bytes,
+                                             int len) {
+  ASN1_OBJECT *obj;
+  X509_ATTRIBUTE *nattr;
+
+  obj = OBJ_txt2obj(attrname, 0);
+  if (obj == nullptr) {
+    OPENSSL_PUT_ERROR(X509, X509_R_INVALID_FIELD_NAME);
+    ERR_add_error_data(2, "name=", attrname);
+    return nullptr;
+  }
+  nattr = X509_ATTRIBUTE_create_by_OBJ(attr, obj, type, bytes, len);
+  ASN1_OBJECT_free(obj);
+  return nattr;
+}
+
+int X509_ATTRIBUTE_set1_object(X509_ATTRIBUTE *attr, const ASN1_OBJECT *obj) {
+  if ((attr == nullptr) || (obj == nullptr)) {
+    return 0;
+  }
+  ASN1_OBJECT_free(attr->object);
+  attr->object = OBJ_dup(obj);
+  return attr->object != nullptr;
+}
+
+int X509_ATTRIBUTE_set1_data(X509_ATTRIBUTE *attr, int attrtype,
+                             const void *data, int len) {
+  if (!attr) {
+    return 0;
+  }
+
+  if (attrtype == 0) {
+    // Do nothing. This is used to create an empty value set in
+    // `X509_ATTRIBUTE_create_by_*`. This is invalid, but supported by OpenSSL.
+    return 1;
+  }
+
+  ASN1_TYPE *typ = ASN1_TYPE_new();
+  if (typ == nullptr) {
+    return 0;
+  }
+
+  // This function is several functions in one.
+  if (attrtype & MBSTRING_FLAG) {
+    // `data` is an encoded string. We must decode and re-encode it to `attr`'s
+    // preferred ASN.1 type. Note `len` may be -1, in which case
+    // `ASN1_STRING_set_by_NID` calls `strlen` automatically.
+    ASN1_STRING *str =
+        ASN1_STRING_set_by_NID(nullptr, reinterpret_cast<const uint8_t *>(data),
+                               len, attrtype, OBJ_obj2nid(attr->object));
+    if (str == nullptr) {
+      OPENSSL_PUT_ERROR(X509, ERR_R_ASN1_LIB);
+      goto err;
+    }
+    asn1_type_set0_string(typ, str);
+  } else if (len != -1) {
+    // `attrtype` must be a valid `ASN1_STRING` type. `data` and `len` is a
+    // value in the corresponding `ASN1_STRING` representation.
+    ASN1_STRING *str = ASN1_STRING_type_new(attrtype);
+    if (str == nullptr || !ASN1_STRING_set(str, data, len)) {
+      ASN1_STRING_free(str);
+      goto err;
+    }
+    asn1_type_set0_string(typ, str);
+  } else {
+    // `attrtype` must be a valid `ASN1_TYPE` type. `data` is a pointer to an
+    // object of the corresponding type.
+    if (!ASN1_TYPE_set1(typ, attrtype, data)) {
+      goto err;
+    }
+  }
+
+  if (!sk_ASN1_TYPE_push(attr->set, typ)) {
+    goto err;
+  }
+  return 1;
+
+err:
+  ASN1_TYPE_free(typ);
+  return 0;
+}
+
+int X509_ATTRIBUTE_count(const X509_ATTRIBUTE *attr) {
+  return (int)sk_ASN1_TYPE_num(attr->set);
+}
+
+ASN1_OBJECT *X509_ATTRIBUTE_get0_object(X509_ATTRIBUTE *attr) {
+  if (attr == nullptr) {
+    return nullptr;
+  }
+  return attr->object;
+}
+
+void *X509_ATTRIBUTE_get0_data(X509_ATTRIBUTE *attr, int idx, int attrtype,
+                               void *unused) {
+  ASN1_TYPE *ttmp;
+  ttmp = X509_ATTRIBUTE_get0_type(attr, idx);
+  if (!ttmp) {
+    return nullptr;
+  }
+  if (attrtype != ASN1_TYPE_get(ttmp)) {
+    OPENSSL_PUT_ERROR(X509, X509_R_WRONG_TYPE);
+    return nullptr;
+  }
+  return (void *)asn1_type_value_as_pointer(ttmp);
+}
+
+ASN1_TYPE *X509_ATTRIBUTE_get0_type(X509_ATTRIBUTE *attr, int idx) {
+  if (attr == nullptr) {
+    return nullptr;
+  }
+  if (idx >= X509_ATTRIBUTE_count(attr)) {
+    return nullptr;
+  }
+  return sk_ASN1_TYPE_value(attr->set, idx);
+}

package/runtime/third_party/boringssl/crypto/x509/x509_cmp.cc

@@ -0,0 +1,243 @@
+// Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <string.h>
+
+#include <openssl/asn1.h>
+#include <openssl/digest.h>
+#include <openssl/err.h>
+#include <openssl/md5.h>
+#include <openssl/mem.h>
+#include <openssl/obj.h>
+#include <openssl/sha.h>
+#include <openssl/stack.h>
+#include <openssl/x509.h>
+
+#include "../internal.h"
+#include "internal.h"
+
+
+using namespace bssl;
+
+int X509_issuer_name_cmp(const X509 *a, const X509 *b) {
+  const auto *a_impl = FromOpaque(a);
+  const auto *b_impl = FromOpaque(b);
+  return X509_NAME_cmp(&a_impl->issuer, &b_impl->issuer);
+}
+
+int X509_subject_name_cmp(const X509 *a, const X509 *b) {
+  const auto *a_impl = FromOpaque(a);
+  const auto *b_impl = FromOpaque(b);
+  return X509_NAME_cmp(&a_impl->subject, &b_impl->subject);
+}
+
+int X509_CRL_cmp(const X509_CRL *a, const X509_CRL *b) {
+  return X509_NAME_cmp(a->crl->issuer, b->crl->issuer);
+}
+
+int X509_CRL_match(const X509_CRL *a, const X509_CRL *b) {
+  return OPENSSL_memcmp(a->crl_hash, b->crl_hash, SHA256_DIGEST_LENGTH);
+}
+
+X509_NAME *X509_get_issuer_name(const X509 *a) {
+  // This function is not const-correct for OpenSSL compatibility.
+  const auto *impl = FromOpaque(a);
+  return const_cast<X509Name *>(&impl->issuer);
+}
+
+uint32_t X509_issuer_name_hash(const X509 *x) {
+  const auto *impl = FromOpaque(x);
+  return X509_NAME_hash(&impl->issuer);
+}
+
+uint32_t X509_issuer_name_hash_old(const X509 *x) {
+  const auto *impl = FromOpaque(x);
+  return X509_NAME_hash_old(&impl->issuer);
+}
+
+X509_NAME *X509_get_subject_name(const X509 *a) {
+  // This function is not const-correct for OpenSSL compatibility.
+  const auto *impl = FromOpaque(a);
+  return const_cast<X509Name *>(&impl->subject);
+}
+
+ASN1_INTEGER *X509_get_serialNumber(X509 *x509) {
+  return FromOpaque(x509)->serialNumber.get();
+}
+
+const ASN1_INTEGER *X509_get0_serialNumber(const X509 *x509) {
+  return FromOpaque(x509)->serialNumber.get();
+}
+
+uint32_t X509_subject_name_hash(const X509 *x) {
+  const auto *impl = FromOpaque(x);
+  return X509_NAME_hash(&impl->subject);
+}
+
+uint32_t X509_subject_name_hash_old(const X509 *x) {
+  const auto *impl = FromOpaque(x);
+  return X509_NAME_hash_old(&impl->subject);
+}
+
+// Compare two certificates: they must be identical for this to work. NB:
+// Although "cmp" operations are generally prototyped to take "const"
+// arguments (eg. for use in STACKs), the way X509 handling is - these
+// operations may involve ensuring the hashes are up-to-date and ensuring
+// certain cert information is cached. So this is the point where the
+// "depth-first" constification tree has to halt with an evil cast.
+int X509_cmp(const X509 *a, const X509 *b) {
+  const auto *a_impl = FromOpaque(a);
+  const auto *b_impl = FromOpaque(b);
+  // Fill in the `cert_hash` fields.
+  //
+  // TODO(davidben): This may fail, in which case the hash will be all
+  // zeros. This produces a consistent comparison (failures are sticky), but
+  // not a good one. OpenSSL now returns -2, but this is not a consistent
+  // comparison and may cause misbehaving sorts by transitivity. For now, we
+  // retain the old OpenSSL behavior, which was to ignore the error. See
+  // https://crbug.com/boringssl/355.
+  x509v3_cache_extensions((X509Impl *)a_impl);
+  x509v3_cache_extensions((X509Impl *)b_impl);
+
+  return OPENSSL_memcmp(a_impl->cert_hash, b_impl->cert_hash,
+                        SHA256_DIGEST_LENGTH);
+}
+
+int X509_NAME_cmp(const X509_NAME *a, const X509_NAME *b) {
+  const X509NameCache *a_cache = x509_name_get_cache(a);
+  if (a_cache == nullptr) {
+    return -2;
+  }
+  const X509NameCache *b_cache = x509_name_get_cache(b);
+  if (b_cache == nullptr) {
+    return -2;
+  }
+  if (a_cache->canon.size() < b_cache->canon.size()) {
+    return -1;
+  }
+  if (a_cache->canon.size() > b_cache->canon.size()) {
+    return 1;
+  }
+  int ret = OPENSSL_memcmp(a_cache->canon.data(), b_cache->canon.data(),
+                           a_cache->canon.size());
+  // Canonicalize the return value so it is even possible to distinguish the
+  // error case from a < b, though ideally we would not have an error case.
+  if (ret < 0) {
+    return -1;
+  }
+  if (ret > 0) {
+    return 1;
+  }
+  return 0;
+}
+
+uint32_t X509_NAME_hash(const X509_NAME *x) {
+  const X509NameCache *cache = x509_name_get_cache(x);
+  if (cache == nullptr) {
+    return 0;
+  }
+  uint8_t md[SHA_DIGEST_LENGTH];
+  SHA1(cache->canon.data(), cache->canon.size(), md);
+  return CRYPTO_load_u32_le(md);
+}
+
+// I now DER encode the name and hash it.  Since I cache the DER encoding,
+// this is reasonably efficient.
+
+uint32_t X509_NAME_hash_old(const X509_NAME *x) {
+  const X509NameCache *cache = x509_name_get_cache(x);
+  if (cache == nullptr) {
+    return 0;
+  }
+  uint8_t md[MD5_DIGEST_LENGTH];
+  MD5(cache->der.data(), cache->der.size(), md);
+  return CRYPTO_load_u32_le(md);
+}
+
+X509 *X509_find_by_issuer_and_serial(const STACK_OF(X509) *sk,
+                                     const X509_NAME *name,
+                                     const ASN1_INTEGER *serial) {
+  if (serial->type != V_ASN1_INTEGER && serial->type != V_ASN1_NEG_INTEGER) {
+    return nullptr;
+  }
+
+  for (size_t i = 0; i < sk_X509_num(sk); i++) {
+    X509 *x509 = sk_X509_value(sk, i);
+    if (ASN1_INTEGER_cmp(X509_get0_serialNumber(x509), serial) == 0 &&
+        X509_NAME_cmp(X509_get_issuer_name(x509), name) == 0) {
+      return x509;
+    }
+  }
+  return nullptr;
+}
+
+X509 *X509_find_by_subject(const STACK_OF(X509) *sk, const X509_NAME *name) {
+  for (size_t i = 0; i < sk_X509_num(sk); i++) {
+    X509 *x509 = sk_X509_value(sk, i);
+    if (X509_NAME_cmp(X509_get_subject_name(x509), name) == 0) {
+      return x509;
+    }
+  }
+  return nullptr;
+}
+
+EVP_PKEY *X509_get0_pubkey(const X509 *x) {
+  if (x == nullptr) {
+    return nullptr;
+  }
+  auto *impl = FromOpaque(x);
+  return X509_PUBKEY_get0(&impl->key);
+}
+
+EVP_PKEY *X509_get_pubkey(const X509 *x) {
+  if (x == nullptr) {
+    return nullptr;
+  }
+  auto *impl = FromOpaque(x);
+  return X509_PUBKEY_get(&impl->key);
+}
+
+ASN1_BIT_STRING *X509_get0_pubkey_bitstr(const X509 *x) {
+  if (!x) {
+    return nullptr;
+  }
+  // This function is not const-correct for OpenSSL compatibility.
+  auto *impl = FromOpaque(x);
+  return const_cast<ASN1_BIT_STRING *>(impl->key.public_key.get());
+}
+
+int X509_check_private_key(const X509 *x, const EVP_PKEY *k) {
+  const EVP_PKEY *xk = X509_get0_pubkey(x);
+  if (xk == nullptr) {
+    return 0;
+  }
+
+  if (EVP_PKEY_eq(xk, k) == 1) {
+    return 1;
+  }
+
+  if (EVP_PKEY_id(xk) != EVP_PKEY_id(k)) {
+    OPENSSL_PUT_ERROR(X509, X509_R_KEY_TYPE_MISMATCH);
+  } else {
+    OPENSSL_PUT_ERROR(X509, X509_R_KEY_VALUES_MISMATCH);
+  }
+  return 0;
+}
+
+// Not strictly speaking an "up_ref" as a STACK doesn't have a reference
+// count but it has the same effect by duping the STACK and upping the ref of
+// each X509 structure.
+STACK_OF(X509) *X509_chain_up_ref(STACK_OF(X509) *chain) {
+  return sk_X509_deep_copy(chain, X509_dup_ref, X509_free);
+}

package/runtime/third_party/boringssl/crypto/x509/x509_d2.cc

@@ -0,0 +1,66 @@
+// Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <openssl/err.h>
+#include <openssl/x509.h>
+
+
+int X509_STORE_set_default_paths(X509_STORE *ctx) {
+  X509_LOOKUP *lookup;
+
+  lookup = X509_STORE_add_lookup(ctx, X509_LOOKUP_file());
+  if (lookup == nullptr) {
+    return 0;
+  }
+  X509_LOOKUP_load_file(lookup, nullptr, X509_FILETYPE_DEFAULT);
+
+  lookup = X509_STORE_add_lookup(ctx, X509_LOOKUP_hash_dir());
+  if (lookup == nullptr) {
+    return 0;
+  }
+  X509_LOOKUP_add_dir(lookup, nullptr, X509_FILETYPE_DEFAULT);
+
+  // clear any errors
+  ERR_clear_error();
+
+  return 1;
+}
+
+int X509_STORE_load_locations(X509_STORE *ctx, const char *file,
+                              const char *path) {
+  X509_LOOKUP *lookup;
+
+  if (file != nullptr) {
+    lookup = X509_STORE_add_lookup(ctx, X509_LOOKUP_file());
+    if (lookup == nullptr) {
+      return 0;
+    }
+    if (X509_LOOKUP_load_file(lookup, file, X509_FILETYPE_PEM) != 1) {
+      return 0;
+    }
+  }
+  if (path != nullptr) {
+    lookup = X509_STORE_add_lookup(ctx, X509_LOOKUP_hash_dir());
+    if (lookup == nullptr) {
+      return 0;
+    }
+    if (X509_LOOKUP_add_dir(lookup, path, X509_FILETYPE_PEM) != 1) {
+      return 0;
+    }
+  }
+  if ((path == nullptr) && (file == nullptr)) {
+    return 0;
+  }
+  return 1;
+}

package/runtime/third_party/boringssl/crypto/x509/x509_def.cc

@@ -0,0 +1,42 @@
+// Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <openssl/x509.h>
+
+// TODO(fork): cleanup
+
+#if defined(OPENSSL_FUCHSIA)
+#define OPENSSLDIR "/config/ssl"
+#else
+#define OPENSSLDIR "/etc/ssl"
+#endif
+
+#define X509_CERT_AREA OPENSSLDIR
+#define X509_CERT_DIR OPENSSLDIR "/certs"
+#define X509_CERT_FILE OPENSSLDIR "/cert.pem"
+#define X509_PRIVATE_DIR OPENSSLDIR "/private"
+#define X509_CERT_DIR_EVP "SSL_CERT_DIR"
+#define X509_CERT_FILE_EVP "SSL_CERT_FILE"
+
+const char *X509_get_default_private_dir() { return X509_PRIVATE_DIR; }
+
+const char *X509_get_default_cert_area() { return X509_CERT_AREA; }
+
+const char *X509_get_default_cert_dir() { return X509_CERT_DIR; }
+
+const char *X509_get_default_cert_file() { return X509_CERT_FILE; }
+
+const char *X509_get_default_cert_dir_env() { return X509_CERT_DIR_EVP; }
+
+const char *X509_get_default_cert_file_env() { return X509_CERT_FILE_EVP; }