Skip to content

Commit 93f1324

Browse files
rmacnak-googlecommit-bot@chromium.org
rmacnak-google
authored and
[email protected]
committed
Update BoringSSL to 4dfd5af70191b068aebe567b8e29ce108cee85ce.
Update usage of PKCS12_parse to PKCS12_get_key_and_certs, since the former changed behavior when the PKCS12 has no private key. Change-Id: I040c1a17e2994ac66cf03ad1efa80e423136cdbd Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/116828 Reviewed-by: Jonas Termansen <[email protected]> Reviewed-by: Zach Anderson <[email protected]> Commit-Queue: Ryan Macnak <[email protected]>
1 parent 0ad30fa commit 93f1324

File tree

3 files changed

+34
-56
lines changed

3 files changed

+34
-56
lines changed

‎DEPS

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -59,8 +59,8 @@ vars = {
5959
"bazel_worker_tag": "bazel_worker-v0.1.20",
6060
"benchmark_harness_tag": "81641290dea44c34138a109a37e215482f405f81",
6161
"boolean_selector_tag" : "1.0.4",
62-
"boringssl_gen_rev": "bbf52f18f425e29b1185f2f6753bec02ed8c5880",
63-
"boringssl_rev" : "702e2b6d3831486535e958f262a05c75a5cb312e",
62+
"boringssl_gen_rev": "b9e27cff1ff0803e97ab1f88764a83be4aa94a6d",
63+
"boringssl_rev" : "4dfd5af70191b068aebe567b8e29ce108cee85ce",
6464
"charcode_tag": "v1.1.2",
6565
"chrome_rev" : "19997",
6666
"cli_util_rev" : "4ad7ccbe3195fd2583b30f86a86697ef61e80f41",

‎runtime/bin/secure_socket_utils.h

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -102,6 +102,9 @@ class ScopedMemBIO {
102102
return bio_;
103103
}
104104

105+
uint8_t* data() { return bytes_; }
106+
intptr_t length() { return bytes_len_; }
107+
105108
private:
106109
Dart_Handle object_;
107110
uint8_t* bytes_;

‎runtime/bin/security_context.cc

Lines changed: 29 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -165,30 +165,19 @@ Dart_Handle X509Helper::WrappedX509Certificate(X509* certificate) {
165165
}
166166

167167
static int SetTrustedCertificatesBytesPKCS12(SSL_CTX* context,
168-
BIO* bio,
168+
ScopedMemBIO* bio,
169169
const char* password) {
170-
ScopedPKCS12 p12(d2i_PKCS12_bio(bio, NULL));
171-
if (p12.get() == NULL) {
172-
return 0;
173-
}
170+
CBS cbs;
171+
CBS_init(&cbs, bio->data(), bio->length());
174172

175173
EVP_PKEY* key = NULL;
176-
X509* cert = NULL;
177-
STACK_OF(X509)* ca_certs = NULL;
178-
int status = PKCS12_parse(p12.get(), password, &key, &cert, &ca_certs);
174+
ScopedX509Stack cert_stack(sk_X509_new_null());
175+
int status = PKCS12_get_key_and_certs(&key, cert_stack.get(), &cbs, password);
179176
if (status == 0) {
180177
return status;
181178
}
182179

183-
ScopedX509Stack cert_stack(ca_certs);
184180
X509_STORE* store = SSL_CTX_get_cert_store(context);
185-
status = X509_STORE_add_cert(store, cert);
186-
// X509_STORE_add_cert increments the reference count of cert on success.
187-
X509_free(cert);
188-
if (status == 0) {
189-
return status;
190-
}
191-
192181
X509* ca;
193182
while ((ca = sk_X509_shift(cert_stack.get())) != NULL) {
194183
status = X509_STORE_add_cert(store, ca);
@@ -234,8 +223,7 @@ void SSLCertContext::SetTrustedCertificatesBytes(Dart_Handle cert_bytes,
234223
if (SecureSocketUtils::NoPEMStartLine()) {
235224
ERR_clear_error();
236225
BIO_reset(bio.bio());
237-
status =
238-
SetTrustedCertificatesBytesPKCS12(context(), bio.bio(), password);
226+
status = SetTrustedCertificatesBytesPKCS12(context(), &bio, password);
239227
}
240228
} else {
241229
// The PEM file was successfully parsed.
@@ -247,25 +235,14 @@ void SSLCertContext::SetTrustedCertificatesBytes(Dart_Handle cert_bytes,
247235
}
248236

249237
static int SetClientAuthoritiesPKCS12(SSL_CTX* context,
250-
BIO* bio,
238+
ScopedMemBIO* bio,
251239
const char* password) {
252-
ScopedPKCS12 p12(d2i_PKCS12_bio(bio, NULL));
253-
if (p12.get() == NULL) {
254-
return 0;
255-
}
240+
CBS cbs;
241+
CBS_init(&cbs, bio->data(), bio->length());
256242

257243
EVP_PKEY* key = NULL;
258-
X509* cert = NULL;
259-
STACK_OF(X509)* ca_certs = NULL;
260-
int status = PKCS12_parse(p12.get(), password, &key, &cert, &ca_certs);
261-
if (status == 0) {
262-
return status;
263-
}
264-
265-
ScopedX509Stack cert_stack(ca_certs);
266-
status = SSL_CTX_add_client_CA(context, cert);
267-
// SSL_CTX_add_client_CA increments the reference count of cert on success.
268-
X509_free(cert);
244+
ScopedX509Stack cert_stack(sk_X509_new_null());
245+
int status = PKCS12_get_key_and_certs(&key, cert_stack.get(), &cbs, password);
269246
if (status == 0) {
270247
return status;
271248
}
@@ -297,13 +274,13 @@ static int SetClientAuthoritiesPEM(SSL_CTX* context, BIO* bio) {
297274
}
298275

299276
static int SetClientAuthorities(SSL_CTX* context,
300-
BIO* bio,
277+
ScopedMemBIO* bio,
301278
const char* password) {
302-
int status = SetClientAuthoritiesPEM(context, bio);
279+
int status = SetClientAuthoritiesPEM(context, bio->bio());
303280
if (status == 0) {
304281
if (SecureSocketUtils::NoPEMStartLine()) {
305282
ERR_clear_error();
306-
BIO_reset(bio);
283+
BIO_reset(bio->bio());
307284
status = SetClientAuthoritiesPKCS12(context, bio, password);
308285
}
309286
} else {
@@ -319,7 +296,7 @@ void SSLCertContext::SetClientAuthoritiesBytes(
319296
int status;
320297
{
321298
ScopedMemBIO bio(client_authorities_bytes);
322-
status = SetClientAuthorities(context(), bio.bio(), password);
299+
status = SetClientAuthorities(context(), &bio, password);
323300
}
324301

325302
SecureSocketUtils::CheckStatus(status, "TlsException",
@@ -543,35 +520,31 @@ void SSLCertContext::SetAlpnProtocolList(Dart_Handle protocols_handle,
543520
}
544521

545522
static int UseChainBytesPKCS12(SSL_CTX* context,
546-
BIO* bio,
523+
ScopedMemBIO* bio,
547524
const char* password) {
548-
ScopedPKCS12 p12(d2i_PKCS12_bio(bio, NULL));
549-
if (p12.get() == NULL) {
550-
return 0;
551-
}
525+
CBS cbs;
526+
CBS_init(&cbs, bio->data(), bio->length());
552527

553528
EVP_PKEY* key = NULL;
554-
X509* cert = NULL;
555-
STACK_OF(X509)* ca_certs = NULL;
556-
int status = PKCS12_parse(p12.get(), password, &key, &cert, &ca_certs);
529+
ScopedX509Stack certs(sk_X509_new_null());
530+
int status = PKCS12_get_key_and_certs(&key, certs.get(), &cbs, password);
557531
if (status == 0) {
558532
return status;
559533
}
560534

561-
ScopedX509 x509(cert);
562-
ScopedX509Stack certs(ca_certs);
563-
status = SSL_CTX_use_certificate(context, x509.get());
535+
X509* ca = sk_X509_shift(certs.get());
536+
status = SSL_CTX_use_certificate(context, ca);
564537
if (ERR_peek_error() != 0) {
565538
// Key/certificate mismatch doesn't imply status is 0.
566539
status = 0;
567540
}
541+
X509_free(ca);
568542
if (status == 0) {
569543
return status;
570544
}
571545

572546
SSL_CTX_clear_chain_certs(context);
573547

574-
X509* ca;
575548
while ((ca = sk_X509_shift(certs.get())) != NULL) {
576549
status = SSL_CTX_add0_chain_cert(context, ca);
577550
// SSL_CTX_add0_chain_cert does not inc ref count, so don't free unless the
@@ -620,12 +593,14 @@ static int UseChainBytesPEM(SSL_CTX* context, BIO* bio) {
620593
return SecureSocketUtils::NoPEMStartLine() ? status : 0;
621594
}
622595

623-
static int UseChainBytes(SSL_CTX* context, BIO* bio, const char* password) {
624-
int status = UseChainBytesPEM(context, bio);
596+
static int UseChainBytes(SSL_CTX* context,
597+
ScopedMemBIO* bio,
598+
const char* password) {
599+
int status = UseChainBytesPEM(context, bio->bio());
625600
if (status == 0) {
626601
if (SecureSocketUtils::NoPEMStartLine()) {
627602
ERR_clear_error();
628-
BIO_reset(bio);
603+
BIO_reset(bio->bio());
629604
status = UseChainBytesPKCS12(context, bio, password);
630605
}
631606
} else {
@@ -638,7 +613,7 @@ static int UseChainBytes(SSL_CTX* context, BIO* bio, const char* password) {
638613
int SSLCertContext::UseCertificateChainBytes(Dart_Handle cert_chain_bytes,
639614
const char* password) {
640615
ScopedMemBIO bio(cert_chain_bytes);
641-
return UseChainBytes(context(), bio.bio(), password);
616+
return UseChainBytes(context(), &bio, password);
642617
}
643618

644619
static X509* GetX509Certificate(Dart_NativeArguments args) {

0 commit comments

Comments
 (0)