Namespace SSL_X509_METHOD. Change-Id: I19296822354acea9956b9606d2209675151f511d Reviewed-on: https://boringssl-review.googlesource.com/29524 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
diff --git a/ssl/internal.h b/ssl/internal.h index c6b849c..05b967d 100644 --- a/ssl/internal.h +++ b/ssl/internal.h
@@ -173,15 +173,12 @@ #endif -// TODO(davidben): This is unnamespaced because |SSL_SESSION| was historically -// public. After 2018-06-13, move it into the namespace. -typedef struct ssl_x509_method_st SSL_X509_METHOD; - namespace bssl { struct SSL_CONFIG; struct SSL_HANDSHAKE; struct SSL_PROTOCOL_METHOD; +struct SSL_X509_METHOD; // C++ utilities. @@ -1971,6 +1968,62 @@ size_t *out_consumed, uint8_t *out_alert, Span<uint8_t> in); +struct SSL_X509_METHOD { + // check_client_CA_list returns one if |names| is a good list of X.509 + // distinguished names and zero otherwise. This is used to ensure that we can + // reject unparsable values at handshake time when using crypto/x509. + int (*check_client_CA_list)(STACK_OF(CRYPTO_BUFFER) *names); + + // cert_clear frees and NULLs all X509 certificate-related state. + void (*cert_clear)(CERT *cert); + // cert_free frees all X509-related state. + void (*cert_free)(CERT *cert); + // cert_flush_cached_chain drops any cached |X509|-based certificate chain + // from |cert|. + // cert_dup duplicates any needed fields from |cert| to |new_cert|. + void (*cert_dup)(CERT *new_cert, const CERT *cert); + void (*cert_flush_cached_chain)(CERT *cert); + // cert_flush_cached_chain drops any cached |X509|-based leaf certificate + // from |cert|. + void (*cert_flush_cached_leaf)(CERT *cert); + + // session_cache_objects fills out |sess->x509_peer| and |sess->x509_chain| + // from |sess->certs| and erases |sess->x509_chain_without_leaf|. It returns + // one on success or zero on error. + int (*session_cache_objects)(SSL_SESSION *session); + // session_dup duplicates any needed fields from |session| to |new_session|. + // It returns one on success or zero on error. + int (*session_dup)(SSL_SESSION *new_session, const SSL_SESSION *session); + // session_clear frees any X509-related state from |session|. + void (*session_clear)(SSL_SESSION *session); + // session_verify_cert_chain verifies the certificate chain in |session|, + // sets |session->verify_result| and returns one on success or zero on + // error. + int (*session_verify_cert_chain)(SSL_SESSION *session, SSL_HANDSHAKE *ssl, + uint8_t *out_alert); + + // hs_flush_cached_ca_names drops any cached |X509_NAME|s from |hs|. + void (*hs_flush_cached_ca_names)(SSL_HANDSHAKE *hs); + // ssl_new does any neccessary initialisation of |hs|. It returns one on + // success or zero on error. + int (*ssl_new)(SSL_HANDSHAKE *hs); + // ssl_free frees anything created by |ssl_new|. + void (*ssl_config_free)(SSL_CONFIG *cfg); + // ssl_flush_cached_client_CA drops any cached |X509_NAME|s from |ssl|. + void (*ssl_flush_cached_client_CA)(SSL_CONFIG *cfg); + // ssl_auto_chain_if_needed runs the deprecated auto-chaining logic if + // necessary. On success, it updates |ssl|'s certificate configuration as + // needed and returns one. Otherwise, it returns zero. + int (*ssl_auto_chain_if_needed)(SSL_HANDSHAKE *hs); + // ssl_ctx_new does any neccessary initialisation of |ctx|. It returns one on + // success or zero on error. + int (*ssl_ctx_new)(SSL_CTX *ctx); + // ssl_ctx_free frees anything created by |ssl_ctx_new|. + void (*ssl_ctx_free)(SSL_CTX *ctx); + // ssl_ctx_flush_cached_client_CA drops any cached |X509_NAME|s from |ctx|. + void (*ssl_ctx_flush_cached_client_CA)(SSL_CTX *ssl); +}; + // ssl_crypto_x509_method provides the |SSL_X509_METHOD| functions using // crypto/x509. extern const SSL_X509_METHOD ssl_crypto_x509_method; @@ -3129,64 +3182,7 @@ const bssl::SSL_PROTOCOL_METHOD *method; // x509_method contains pointers to functions that might deal with |X509| // compatibility, or might be a no-op, depending on the application. - const SSL_X509_METHOD *x509_method; -}; - -struct ssl_x509_method_st { - // check_client_CA_list returns one if |names| is a good list of X.509 - // distinguished names and zero otherwise. This is used to ensure that we can - // reject unparsable values at handshake time when using crypto/x509. - int (*check_client_CA_list)(STACK_OF(CRYPTO_BUFFER) *names); - - // cert_clear frees and NULLs all X509 certificate-related state. - void (*cert_clear)(bssl::CERT *cert); - // cert_free frees all X509-related state. - void (*cert_free)(bssl::CERT *cert); - // cert_flush_cached_chain drops any cached |X509|-based certificate chain - // from |cert|. - // cert_dup duplicates any needed fields from |cert| to |new_cert|. - void (*cert_dup)(bssl::CERT *new_cert, const bssl::CERT *cert); - void (*cert_flush_cached_chain)(bssl::CERT *cert); - // cert_flush_cached_chain drops any cached |X509|-based leaf certificate - // from |cert|. - void (*cert_flush_cached_leaf)(bssl::CERT *cert); - - // session_cache_objects fills out |sess->x509_peer| and |sess->x509_chain| - // from |sess->certs| and erases |sess->x509_chain_without_leaf|. It returns - // one on success or zero on error. - int (*session_cache_objects)(SSL_SESSION *session); - // session_dup duplicates any needed fields from |session| to |new_session|. - // It returns one on success or zero on error. - int (*session_dup)(SSL_SESSION *new_session, const SSL_SESSION *session); - // session_clear frees any X509-related state from |session|. - void (*session_clear)(SSL_SESSION *session); - // session_verify_cert_chain verifies the certificate chain in |session|, - // sets |session->verify_result| and returns one on success or zero on - // error. - int (*session_verify_cert_chain)(SSL_SESSION *session, - bssl::SSL_HANDSHAKE *ssl, - uint8_t *out_alert); - - // hs_flush_cached_ca_names drops any cached |X509_NAME|s from |hs|. - void (*hs_flush_cached_ca_names)(bssl::SSL_HANDSHAKE *hs); - // ssl_new does any neccessary initialisation of |hs|. It returns one on - // success or zero on error. - int (*ssl_new)(bssl::SSL_HANDSHAKE *hs); - // ssl_free frees anything created by |ssl_new|. - void (*ssl_config_free)(bssl::SSL_CONFIG *cfg); - // ssl_flush_cached_client_CA drops any cached |X509_NAME|s from |ssl|. - void (*ssl_flush_cached_client_CA)(bssl::SSL_CONFIG *cfg); - // ssl_auto_chain_if_needed runs the deprecated auto-chaining logic if - // necessary. On success, it updates |ssl|'s certificate configuration as - // needed and returns one. Otherwise, it returns zero. - int (*ssl_auto_chain_if_needed)(bssl::SSL_HANDSHAKE *hs); - // ssl_ctx_new does any neccessary initialisation of |ctx|. It returns one on - // success or zero on error. - int (*ssl_ctx_new)(SSL_CTX *ctx); - // ssl_ctx_free frees anything created by |ssl_ctx_new|. - void (*ssl_ctx_free)(SSL_CTX *ctx); - // ssl_ctx_flush_cached_client_CA drops any cached |X509_NAME|s from |ctx|. - void (*ssl_ctx_flush_cached_client_CA)(SSL_CTX *ssl); + const bssl::SSL_X509_METHOD *x509_method; }; // The following types back public C-exposed types which must live in the global @@ -3229,7 +3225,7 @@ // certificate. STACK_OF(CRYPTO_BUFFER) *certs; - const SSL_X509_METHOD *x509_method; + const bssl::SSL_X509_METHOD *x509_method; // x509_peer is the peer's certificate. X509 *x509_peer;