Unexport i2d, d2i, and ASN1_ITEM for X.509 interior types Many of the extension types are not the extensions themselves, but the interious types used in various subfields. In preparation for when we rewrite these parsers with <openssl/bytestring.h>, having fewer of these means fewer compatibility functions to bridge the calling conventions. We do still need new/free functions, so that callers can construct extensions themselves. While I'm here, go ahead and expand the macros and document. (Top-level extension types need ASN1_ITEMs for X509V3_METHOD, and d2i/i2d functions for callers that wish to parse and serialize. But there's no real need to do this for the individual fields.) Update-Note: Some interior ASN.1 types no longer have d2i and i2d functions or ASN1_ITEMs. I checked code search and no one was using any of these. We can restore them as needed. Bug: 547 Change-Id: I0b2840bf4aea2212a757ce39b4918c8742043725 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/66389 Reviewed-by: Bob Beck <bbe@google.com> Commit-Queue: David Benjamin <davidben@google.com>
diff --git a/crypto/x509/v3_cpols.c b/crypto/x509/v3_cpols.c index d43c170..3459fcb 100644 --- a/crypto/x509/v3_cpols.c +++ b/crypto/x509/v3_cpols.c
@@ -105,6 +105,11 @@ NULL, }; +DECLARE_ASN1_ITEM(POLICYINFO) +DECLARE_ASN1_ITEM(POLICYQUALINFO) +DECLARE_ASN1_ITEM(USERNOTICE) +DECLARE_ASN1_ITEM(NOTICEREF) + ASN1_ITEM_TEMPLATE(CERTIFICATEPOLICIES) = ASN1_EX_TEMPLATE_TYPE( ASN1_TFLG_SEQUENCE_OF, 0, CERTIFICATEPOLICIES, POLICYINFO) ASN1_ITEM_TEMPLATE_END(CERTIFICATEPOLICIES) @@ -116,7 +121,7 @@ ASN1_SEQUENCE_OF_OPT(POLICYINFO, qualifiers, POLICYQUALINFO), } ASN1_SEQUENCE_END(POLICYINFO) -IMPLEMENT_ASN1_FUNCTIONS_const(POLICYINFO) +IMPLEMENT_ASN1_ALLOC_FUNCTIONS(POLICYINFO) ASN1_ADB_TEMPLATE(policydefault) = ASN1_SIMPLE(POLICYQUALINFO, d.other, ASN1_ANY); @@ -133,21 +138,21 @@ ASN1_ADB_OBJECT(POLICYQUALINFO), } ASN1_SEQUENCE_END(POLICYQUALINFO) -IMPLEMENT_ASN1_FUNCTIONS_const(POLICYQUALINFO) +IMPLEMENT_ASN1_ALLOC_FUNCTIONS(POLICYQUALINFO) ASN1_SEQUENCE(USERNOTICE) = { ASN1_OPT(USERNOTICE, noticeref, NOTICEREF), ASN1_OPT(USERNOTICE, exptext, DISPLAYTEXT), } ASN1_SEQUENCE_END(USERNOTICE) -IMPLEMENT_ASN1_FUNCTIONS_const(USERNOTICE) +IMPLEMENT_ASN1_ALLOC_FUNCTIONS(USERNOTICE) ASN1_SEQUENCE(NOTICEREF) = { ASN1_SIMPLE(NOTICEREF, organization, DISPLAYTEXT), ASN1_SEQUENCE_OF(NOTICEREF, noticenos, ASN1_INTEGER), } ASN1_SEQUENCE_END(NOTICEREF) -IMPLEMENT_ASN1_FUNCTIONS_const(NOTICEREF) +IMPLEMENT_ASN1_ALLOC_FUNCTIONS(NOTICEREF) static void *r2i_certpol(const X509V3_EXT_METHOD *method, const X509V3_CTX *ctx, const char *value) {
diff --git a/crypto/x509/v3_crld.c b/crypto/x509/v3_crld.c index 371fa8d..27e8125 100644 --- a/crypto/x509/v3_crld.c +++ b/crypto/x509/v3_crld.c
@@ -393,7 +393,7 @@ ASN1_IMP_SET_OF(DIST_POINT_NAME, name.relativename, X509_NAME_ENTRY, 1), } ASN1_CHOICE_END_cb(DIST_POINT_NAME, DIST_POINT_NAME, type) -IMPLEMENT_ASN1_FUNCTIONS(DIST_POINT_NAME) +IMPLEMENT_ASN1_ALLOC_FUNCTIONS(DIST_POINT_NAME) ASN1_SEQUENCE(DIST_POINT) = { ASN1_EXP_OPT(DIST_POINT, distpoint, DIST_POINT_NAME, 0), @@ -401,7 +401,7 @@ ASN1_IMP_SEQUENCE_OF_OPT(DIST_POINT, CRLissuer, GENERAL_NAME, 2), } ASN1_SEQUENCE_END(DIST_POINT) -IMPLEMENT_ASN1_FUNCTIONS(DIST_POINT) +IMPLEMENT_ASN1_ALLOC_FUNCTIONS(DIST_POINT) ASN1_ITEM_TEMPLATE(CRL_DIST_POINTS) = ASN1_EX_TEMPLATE_TYPE( ASN1_TFLG_SEQUENCE_OF, 0, CRLDistributionPoints, DIST_POINT)
diff --git a/crypto/x509/v3_info.c b/crypto/x509/v3_info.c index ce7e523..c3a93ff 100644 --- a/crypto/x509/v3_info.c +++ b/crypto/x509/v3_info.c
@@ -115,7 +115,7 @@ ASN1_SIMPLE(ACCESS_DESCRIPTION, location, GENERAL_NAME), } ASN1_SEQUENCE_END(ACCESS_DESCRIPTION) -IMPLEMENT_ASN1_FUNCTIONS(ACCESS_DESCRIPTION) +IMPLEMENT_ASN1_ALLOC_FUNCTIONS(ACCESS_DESCRIPTION) ASN1_ITEM_TEMPLATE(AUTHORITY_INFO_ACCESS) = ASN1_EX_TEMPLATE_TYPE( ASN1_TFLG_SEQUENCE_OF, 0, GeneralNames, ACCESS_DESCRIPTION)
diff --git a/include/openssl/x509.h b/include/openssl/x509.h index 9e66321..10cdd70 100644 --- a/include/openssl/x509.h +++ b/include/openssl/x509.h
@@ -5058,37 +5058,83 @@ DECLARE_ASN1_FUNCTIONS_const(EXTENDED_KEY_USAGE) DECLARE_ASN1_FUNCTIONS_const(CERTIFICATEPOLICIES) -DECLARE_ASN1_FUNCTIONS_const(POLICYINFO) -DECLARE_ASN1_FUNCTIONS_const(POLICYQUALINFO) -DECLARE_ASN1_FUNCTIONS_const(USERNOTICE) -DECLARE_ASN1_FUNCTIONS_const(NOTICEREF) + +// POLICYINFO_new returns a newly-allocated, empty |POLICYINFO| object, or NULL +// on error. +OPENSSL_EXPORT POLICYINFO *POLICYINFO_new(void); + +// POLICYINFO_free releases memory associated with |info|. +OPENSSL_EXPORT void POLICYINFO_free(POLICYINFO *info); + +// POLICYQUALINFO_new returns a newly-allocated, empty |POLICYQUALINFO| object, +// or NULL on error. +OPENSSL_EXPORT POLICYQUALINFO *POLICYQUALINFO_new(void); + +// POLICYQUALINFO_free releases memory associated with |info|. +OPENSSL_EXPORT void POLICYQUALINFO_free(POLICYQUALINFO *info); + +// USERNOTICE_new returns a newly-allocated, empty |USERNOTICE| object, or NULL +// on error. +OPENSSL_EXPORT USERNOTICE *USERNOTICE_new(void); + +// USERNOTICE_free releases memory associated with |notice|. +OPENSSL_EXPORT void USERNOTICE_free(USERNOTICE *notice); + +// NOTICEREF_new returns a newly-allocated, empty |NOTICEREF| object, or NULL +// on error. +OPENSSL_EXPORT NOTICEREF *NOTICEREF_new(void); + +// NOTICEREF_free releases memory associated with |ref|. +OPENSSL_EXPORT void NOTICEREF_free(NOTICEREF *ref); // TODO(https://crbug.com/boringssl/407): This is not const because it contains // an |X509_NAME|. DECLARE_ASN1_FUNCTIONS(CRL_DIST_POINTS) -// TODO(https://crbug.com/boringssl/407): This is not const because it contains -// an |X509_NAME|. -DECLARE_ASN1_FUNCTIONS(DIST_POINT) -// TODO(https://crbug.com/boringssl/407): This is not const because it contains -// an |X509_NAME|. -DECLARE_ASN1_FUNCTIONS(DIST_POINT_NAME) + +// DIST_POINT_new returns a newly-allocated, empty |DIST_POINT| object, or NULL +// on error. +OPENSSL_EXPORT DIST_POINT *DIST_POINT_new(void); + +// DIST_POINT_free releases memory associated with |dp|. +OPENSSL_EXPORT void DIST_POINT_free(DIST_POINT *dp); + +// DIST_POINT_NAME_new returns a newly-allocated, empty |DIST_POINT_NAME| +// object, or NULL on error. +OPENSSL_EXPORT DIST_POINT_NAME *DIST_POINT_NAME_new(void); + +// DIST_POINT_NAME_free releases memory associated with |name|. +OPENSSL_EXPORT void DIST_POINT_NAME_free(DIST_POINT_NAME *name); + // TODO(https://crbug.com/boringssl/407): This is not const because it contains // an |X509_NAME|. DECLARE_ASN1_FUNCTIONS(ISSUING_DIST_POINT) -// TODO(https://crbug.com/boringssl/407): This is not const because it contains -// an |X509_NAME|. -DECLARE_ASN1_FUNCTIONS(ACCESS_DESCRIPTION) +// ACCESS_DESCRIPTION_new returns a newly-allocated, empty |ACCESS_DESCRIPTION| +// object, or NULL on error. +OPENSSL_EXPORT ACCESS_DESCRIPTION *ACCESS_DESCRIPTION_new(void); + +// ACCESS_DESCRIPTION_free releases memory associated with |desc|. +OPENSSL_EXPORT void ACCESS_DESCRIPTION_free(ACCESS_DESCRIPTION *desc); + // TODO(https://crbug.com/boringssl/407): This is not const because it contains // an |X509_NAME|. DECLARE_ASN1_FUNCTIONS(AUTHORITY_INFO_ACCESS) -DECLARE_ASN1_ITEM(POLICY_MAPPING) -DECLARE_ASN1_ALLOC_FUNCTIONS(POLICY_MAPPING) +// POLICY_MAPPING_new returns a newly-allocated, empty |POLICY_MAPPING| object, +// or NULL on error. +OPENSSL_EXPORT POLICY_MAPPING *POLICY_MAPPING_new(void); + +// POLICY_MAPPING_free releases memory associated with |mapping|. +OPENSSL_EXPORT void POLICY_MAPPING_free(POLICY_MAPPING *mapping); + DECLARE_ASN1_ITEM(POLICY_MAPPINGS) -DECLARE_ASN1_ITEM(GENERAL_SUBTREE) -DECLARE_ASN1_ALLOC_FUNCTIONS(GENERAL_SUBTREE) +// GENERAL_SUBTREE_new returns a newly-allocated, empty |GENERAL_SUBTREE| +// object, or NULL on error. +OPENSSL_EXPORT GENERAL_SUBTREE *GENERAL_SUBTREE_new(void); + +// GENERAL_SUBTREE_free releases memory associated with |subtree|. +OPENSSL_EXPORT void GENERAL_SUBTREE_free(GENERAL_SUBTREE *subtree); DECLARE_ASN1_ITEM(NAME_CONSTRAINTS) DECLARE_ASN1_ALLOC_FUNCTIONS(NAME_CONSTRAINTS)