Const-correct the i2d/dup functions we can.

Types which do not contain an X509_NAME can be const. X509_NAME still
requires some thought. (i2d_X509_NAME can mutate the object and isn't
even thread-safe when modified.)

Bug: 407
Change-Id: Iceafa2b4ea9c4194cfcc3044d90393b5d91f7c11
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/53305
Reviewed-by: Bob Beck <[email protected]>
Commit-Queue: Bob Beck <[email protected]>
(cherry picked from commit dc112e7ffc9bf95d01f08478ac9be90d6a695cdd)

Author: davidben

.clang-format

@@ -38,6 +38,7 @@ StatementMacros:
   - "IMPLEMENT_ASN1_ALLOC_FUNCTIONS_fname"
   - "IMPLEMENT_ASN1_ALLOC_FUNCTIONS_pfname"
   - "IMPLEMENT_ASN1_DUP_FUNCTION"
+  - "IMPLEMENT_ASN1_DUP_FUNCTION_const"
   - "IMPLEMENT_ASN1_ENCODE_FUNCTIONS_const_fname"
   - "IMPLEMENT_ASN1_ENCODE_FUNCTIONS_fname"
   - "IMPLEMENT_ASN1_FUNCTIONS"

crypto/pkcs8/pkcs8_x509.c

@@ -110,7 +110,7 @@ ASN1_SEQUENCE_cb(PKCS8_PRIV_KEY_INFO, pkey_cb) = {
     ASN1_IMP_SET_OF_OPT(PKCS8_PRIV_KEY_INFO, attributes, X509_ATTRIBUTE, 0),
 } ASN1_SEQUENCE_END_cb(PKCS8_PRIV_KEY_INFO, PKCS8_PRIV_KEY_INFO)
 
-IMPLEMENT_ASN1_FUNCTIONS(PKCS8_PRIV_KEY_INFO)
+IMPLEMENT_ASN1_FUNCTIONS_const(PKCS8_PRIV_KEY_INFO)
 
 int PKCS8_pkey_set0(PKCS8_PRIV_KEY_INFO *priv, ASN1_OBJECT *aobj, int version,
                     int ptype, void *pval, uint8_t *penc, int penclen) {

crypto/x509/internal.h

@@ -77,7 +77,7 @@ typedef struct X509_val_st {
   ASN1_TIME *notAfter;
 } X509_VAL;
 
-DECLARE_ASN1_FUNCTIONS(X509_VAL)
+DECLARE_ASN1_FUNCTIONS_const(X509_VAL)
 
 struct X509_pubkey_st {
   X509_ALGOR *algor;
@@ -113,7 +113,7 @@ typedef struct x509_cert_aux_st {
   ASN1_OCTET_STRING *keyid;       // key id of private key
 } X509_CERT_AUX;
 
-DECLARE_ASN1_FUNCTIONS(X509_CERT_AUX)
+DECLARE_ASN1_FUNCTIONS_const(X509_CERT_AUX)
 
 struct X509_extension_st {
   ASN1_OBJECT *object;
@@ -135,6 +135,8 @@ typedef struct {
   ASN1_ENCODING enc;
 } X509_CINF;
 
+// TODO(https://crbug.com/boringssl/407): This is not const because it contains
+// an |X509_NAME|.
 DECLARE_ASN1_FUNCTIONS(X509_CINF)
 
 struct x509_st {
@@ -171,6 +173,8 @@ typedef struct {
   STACK_OF(X509_ATTRIBUTE) *attributes;  // [ 0 ]
 } X509_REQ_INFO;
 
+// TODO(https://crbug.com/boringssl/407): This is not const because it contains
+// an |X509_NAME|.
 DECLARE_ASN1_FUNCTIONS(X509_REQ_INFO)
 
 struct X509_req_st {
@@ -201,6 +205,8 @@ typedef struct {
   ASN1_ENCODING enc;
 } X509_CRL_INFO;
 
+// TODO(https://crbug.com/boringssl/407): This is not const because it contains
+// an |X509_NAME|.
 DECLARE_ASN1_FUNCTIONS(X509_CRL_INFO)
 
 struct X509_crl_st {

crypto/x509/rsa_pss.c

@@ -83,7 +83,7 @@ ASN1_SEQUENCE_cb(RSA_PSS_PARAMS, rsa_pss_cb) = {
     ASN1_EXP_OPT(RSA_PSS_PARAMS, trailerField, ASN1_INTEGER, 3),
 } ASN1_SEQUENCE_END_cb(RSA_PSS_PARAMS, RSA_PSS_PARAMS)
 
-IMPLEMENT_ASN1_FUNCTIONS(RSA_PSS_PARAMS)
+IMPLEMENT_ASN1_FUNCTIONS_const(RSA_PSS_PARAMS)
 
 
 // Given an MGF1 Algorithm ID decode to an Algorithm Identifier

crypto/x509/x509cset.c

@@ -245,11 +245,8 @@ int i2d_X509_CRL_tbs(X509_CRL *crl, unsigned char **outp) {
 }
 
 int X509_CRL_set1_signature_algo(X509_CRL *crl, const X509_ALGOR *algo) {
-  // TODO(https://crbug.com/boringssl/407): Generated ASN.1 dup functions
-  // should be const. Alternatively, when we can embed required fields
-  // directly in structs, import |X509_ALGOR_copy| from upstream.
-  X509_ALGOR *copy1 = X509_ALGOR_dup((X509_ALGOR *)algo);
-  X509_ALGOR *copy2 = X509_ALGOR_dup((X509_ALGOR *)algo);
+  X509_ALGOR *copy1 = X509_ALGOR_dup(algo);
+  X509_ALGOR *copy2 = X509_ALGOR_dup(algo);
   if (copy1 == NULL || copy2 == NULL) {
     X509_ALGOR_free(copy1);
     X509_ALGOR_free(copy2);

crypto/x509/x509rset.c

@@ -88,10 +88,7 @@ int X509_REQ_set_pubkey(X509_REQ *x, EVP_PKEY *pkey) {
 }
 
 int X509_REQ_set1_signature_algo(X509_REQ *req, const X509_ALGOR *algo) {
-  // TODO(https://crbug.com/boringssl/407): Generated ASN.1 dup functions
-  // should be const. Alternatively, when we can embed required fields
-  // directly in structs, import |X509_ALGOR_copy| from upstream.
-  X509_ALGOR *copy = X509_ALGOR_dup((X509_ALGOR *)algo);
+  X509_ALGOR *copy = X509_ALGOR_dup(algo);
   if (copy == NULL) {
     return 0;
   }

crypto/x509/x_algor.c

@@ -74,9 +74,10 @@ ASN1_ITEM_TEMPLATE(X509_ALGORS) = ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF,
                                                         X509_ALGOR)
 ASN1_ITEM_TEMPLATE_END(X509_ALGORS)
 
-IMPLEMENT_ASN1_FUNCTIONS(X509_ALGOR)
-IMPLEMENT_ASN1_ENCODE_FUNCTIONS_fname(X509_ALGORS, X509_ALGORS, X509_ALGORS)
-IMPLEMENT_ASN1_DUP_FUNCTION(X509_ALGOR)
+IMPLEMENT_ASN1_FUNCTIONS_const(X509_ALGOR)
+IMPLEMENT_ASN1_ENCODE_FUNCTIONS_const_fname(X509_ALGORS, X509_ALGORS,
+                                            X509_ALGORS)
+IMPLEMENT_ASN1_DUP_FUNCTION_const(X509_ALGOR)
 
 int X509_ALGOR_set0(X509_ALGOR *alg, ASN1_OBJECT *aobj, int ptype, void *pval) {
   if (!alg) {

crypto/x509/x_attrib.c

@@ -67,8 +67,8 @@ ASN1_SEQUENCE(X509_ATTRIBUTE) = {
     ASN1_SET_OF(X509_ATTRIBUTE, set, ASN1_ANY),
 } ASN1_SEQUENCE_END(X509_ATTRIBUTE)
 
-IMPLEMENT_ASN1_FUNCTIONS(X509_ATTRIBUTE)
-IMPLEMENT_ASN1_DUP_FUNCTION(X509_ATTRIBUTE)
+IMPLEMENT_ASN1_FUNCTIONS_const(X509_ATTRIBUTE)
+IMPLEMENT_ASN1_DUP_FUNCTION_const(X509_ATTRIBUTE)
 
 X509_ATTRIBUTE *X509_ATTRIBUTE_create(int nid, int attrtype, void *value) {
   ASN1_OBJECT *obj = OBJ_nid2obj(nid);

crypto/x509/x_exten.c

@@ -72,7 +72,7 @@ ASN1_ITEM_TEMPLATE(X509_EXTENSIONS) =
     ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, Extension, X509_EXTENSION)
 ASN1_ITEM_TEMPLATE_END(X509_EXTENSIONS)
 
-IMPLEMENT_ASN1_FUNCTIONS(X509_EXTENSION)
-IMPLEMENT_ASN1_ENCODE_FUNCTIONS_fname(X509_EXTENSIONS, X509_EXTENSIONS,
-                                      X509_EXTENSIONS)
-IMPLEMENT_ASN1_DUP_FUNCTION(X509_EXTENSION)
+IMPLEMENT_ASN1_FUNCTIONS_const(X509_EXTENSION)
+IMPLEMENT_ASN1_ENCODE_FUNCTIONS_const_fname(X509_EXTENSIONS, X509_EXTENSIONS,
+                                            X509_EXTENSIONS)
+IMPLEMENT_ASN1_DUP_FUNCTION_const(X509_EXTENSION)

crypto/x509/x_name.c

@@ -99,8 +99,8 @@ ASN1_SEQUENCE(X509_NAME_ENTRY) = {
     ASN1_SIMPLE(X509_NAME_ENTRY, value, ASN1_PRINTABLE),
 } ASN1_SEQUENCE_END(X509_NAME_ENTRY)
 
-IMPLEMENT_ASN1_FUNCTIONS(X509_NAME_ENTRY)
-IMPLEMENT_ASN1_DUP_FUNCTION(X509_NAME_ENTRY)
+IMPLEMENT_ASN1_FUNCTIONS_const(X509_NAME_ENTRY)
+IMPLEMENT_ASN1_DUP_FUNCTION_const(X509_NAME_ENTRY)
 
 // For the "Name" type we need a SEQUENCE OF { SET OF X509_NAME_ENTRY } so
 // declare two template wrappers for this

crypto/x509/x_pubkey.c

@@ -85,7 +85,7 @@ ASN1_SEQUENCE_cb(X509_PUBKEY, pubkey_cb) = {
     ASN1_SIMPLE(X509_PUBKEY, public_key, ASN1_BIT_STRING),
 } ASN1_SEQUENCE_END_cb(X509_PUBKEY, X509_PUBKEY)
 
-IMPLEMENT_ASN1_FUNCTIONS(X509_PUBKEY)
+IMPLEMENT_ASN1_FUNCTIONS_const(X509_PUBKEY)
 
 int X509_PUBKEY_set(X509_PUBKEY **x, EVP_PKEY *pkey) {
   X509_PUBKEY *pk = NULL;

crypto/x509/x_sig.c

@@ -71,7 +71,7 @@ ASN1_SEQUENCE(X509_SIG) = {
     ASN1_SIMPLE(X509_SIG, digest, ASN1_OCTET_STRING),
 } ASN1_SEQUENCE_END(X509_SIG)
 
-IMPLEMENT_ASN1_FUNCTIONS(X509_SIG)
+IMPLEMENT_ASN1_FUNCTIONS_const(X509_SIG)
 
 void X509_SIG_get0(const X509_SIG *sig, const X509_ALGOR **out_alg,
                    const ASN1_OCTET_STRING **out_digest) {

crypto/x509/x_spki.c

@@ -67,12 +67,12 @@ ASN1_SEQUENCE(NETSCAPE_SPKAC) = {
     ASN1_SIMPLE(NETSCAPE_SPKAC, challenge, ASN1_IA5STRING),
 } ASN1_SEQUENCE_END(NETSCAPE_SPKAC)
 
-IMPLEMENT_ASN1_FUNCTIONS(NETSCAPE_SPKAC)
+IMPLEMENT_ASN1_FUNCTIONS_const(NETSCAPE_SPKAC)
 
 ASN1_SEQUENCE(NETSCAPE_SPKI) = {
     ASN1_SIMPLE(NETSCAPE_SPKI, spkac, NETSCAPE_SPKAC),
     ASN1_SIMPLE(NETSCAPE_SPKI, sig_algor, X509_ALGOR),
     ASN1_SIMPLE(NETSCAPE_SPKI, signature, ASN1_BIT_STRING),
 } ASN1_SEQUENCE_END(NETSCAPE_SPKI)
 
-IMPLEMENT_ASN1_FUNCTIONS(NETSCAPE_SPKI)
+IMPLEMENT_ASN1_FUNCTIONS_const(NETSCAPE_SPKI)

crypto/x509/x_val.c

@@ -68,4 +68,4 @@ ASN1_SEQUENCE(X509_VAL) = {
     ASN1_SIMPLE(X509_VAL, notAfter, ASN1_TIME),
 } ASN1_SEQUENCE_END(X509_VAL)
 
-IMPLEMENT_ASN1_FUNCTIONS(X509_VAL)
+IMPLEMENT_ASN1_FUNCTIONS_const(X509_VAL)

crypto/x509/x_x509.c

@@ -338,11 +338,8 @@ int i2d_X509_tbs(X509 *x509, unsigned char **outp) {
 }
 
 int X509_set1_signature_algo(X509 *x509, const X509_ALGOR *algo) {
-  // TODO(https://crbug.com/boringssl/407): Generated ASN.1 dup functions
-  // should be const. Alternatively, when we can embed required fields
-  // directly in structs, import |X509_ALGOR_copy| from upstream.
-  X509_ALGOR *copy1 = X509_ALGOR_dup((X509_ALGOR *)algo);
-  X509_ALGOR *copy2 = X509_ALGOR_dup((X509_ALGOR *)algo);
+  X509_ALGOR *copy1 = X509_ALGOR_dup(algo);
+  X509_ALGOR *copy2 = X509_ALGOR_dup(algo);
   if (copy1 == NULL || copy2 == NULL) {
     X509_ALGOR_free(copy1);
     X509_ALGOR_free(copy2);

crypto/x509/x_x509a.c

@@ -78,7 +78,7 @@ ASN1_SEQUENCE(X509_CERT_AUX) = {
     ASN1_OPT(X509_CERT_AUX, keyid, ASN1_OCTET_STRING),
 } ASN1_SEQUENCE_END(X509_CERT_AUX)
 
-IMPLEMENT_ASN1_FUNCTIONS(X509_CERT_AUX)
+IMPLEMENT_ASN1_FUNCTIONS_const(X509_CERT_AUX)
 
 static X509_CERT_AUX *aux_get(X509 *x) {
   if (!x) {

crypto/x509v3/v3_bcons.c

@@ -93,7 +93,7 @@ ASN1_SEQUENCE(BASIC_CONSTRAINTS) = {
     ASN1_OPT(BASIC_CONSTRAINTS, pathlen, ASN1_INTEGER),
 } ASN1_SEQUENCE_END(BASIC_CONSTRAINTS)
 
-IMPLEMENT_ASN1_FUNCTIONS(BASIC_CONSTRAINTS)
+IMPLEMENT_ASN1_FUNCTIONS_const(BASIC_CONSTRAINTS)
 
 static STACK_OF(CONF_VALUE) *i2v_BASIC_CONSTRAINTS(
     const X509V3_EXT_METHOD *method, void *ext, STACK_OF(CONF_VALUE) *extlist) {

crypto/x509v3/v3_cpols.c

@@ -107,14 +107,14 @@ ASN1_ITEM_TEMPLATE(CERTIFICATEPOLICIES) = ASN1_EX_TEMPLATE_TYPE(
     ASN1_TFLG_SEQUENCE_OF, 0, CERTIFICATEPOLICIES, POLICYINFO)
 ASN1_ITEM_TEMPLATE_END(CERTIFICATEPOLICIES)
 
-IMPLEMENT_ASN1_FUNCTIONS(CERTIFICATEPOLICIES)
+IMPLEMENT_ASN1_FUNCTIONS_const(CERTIFICATEPOLICIES)
 
 ASN1_SEQUENCE(POLICYINFO) = {
     ASN1_SIMPLE(POLICYINFO, policyid, ASN1_OBJECT),
     ASN1_SEQUENCE_OF_OPT(POLICYINFO, qualifiers, POLICYQUALINFO),
 } ASN1_SEQUENCE_END(POLICYINFO)
 
-IMPLEMENT_ASN1_FUNCTIONS(POLICYINFO)
+IMPLEMENT_ASN1_FUNCTIONS_const(POLICYINFO)
 
 ASN1_ADB_TEMPLATE(policydefault) = ASN1_SIMPLE(POLICYQUALINFO, d.other,
                                                ASN1_ANY);
@@ -131,21 +131,21 @@ ASN1_SEQUENCE(POLICYQUALINFO) = {
     ASN1_ADB_OBJECT(POLICYQUALINFO),
 } ASN1_SEQUENCE_END(POLICYQUALINFO)
 
-IMPLEMENT_ASN1_FUNCTIONS(POLICYQUALINFO)
+IMPLEMENT_ASN1_FUNCTIONS_const(POLICYQUALINFO)
 
 ASN1_SEQUENCE(USERNOTICE) = {
     ASN1_OPT(USERNOTICE, noticeref, NOTICEREF),
     ASN1_OPT(USERNOTICE, exptext, DISPLAYTEXT),
 } ASN1_SEQUENCE_END(USERNOTICE)
 
-IMPLEMENT_ASN1_FUNCTIONS(USERNOTICE)
+IMPLEMENT_ASN1_FUNCTIONS_const(USERNOTICE)
 
 ASN1_SEQUENCE(NOTICEREF) = {
     ASN1_SIMPLE(NOTICEREF, organization, DISPLAYTEXT),
     ASN1_SEQUENCE_OF(NOTICEREF, noticenos, ASN1_INTEGER),
 } ASN1_SEQUENCE_END(NOTICEREF)
 
-IMPLEMENT_ASN1_FUNCTIONS(NOTICEREF)
+IMPLEMENT_ASN1_FUNCTIONS_const(NOTICEREF)
 
 static void *r2i_certpol(const X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
                          const char *value) {

crypto/x509v3/v3_extku.c

@@ -108,7 +108,7 @@ ASN1_ITEM_TEMPLATE(EXTENDED_KEY_USAGE) = ASN1_EX_TEMPLATE_TYPE(
     ASN1_TFLG_SEQUENCE_OF, 0, EXTENDED_KEY_USAGE, ASN1_OBJECT)
 ASN1_ITEM_TEMPLATE_END(EXTENDED_KEY_USAGE)
 
-IMPLEMENT_ASN1_FUNCTIONS(EXTENDED_KEY_USAGE)
+IMPLEMENT_ASN1_FUNCTIONS_const(EXTENDED_KEY_USAGE)
 
 static STACK_OF(CONF_VALUE) *i2v_EXTENDED_KEY_USAGE(
     const X509V3_EXT_METHOD *method, void *a, STACK_OF(CONF_VALUE) *ext_list) {

crypto/x509v3/v3_genn.c

@@ -69,15 +69,15 @@ ASN1_SEQUENCE(OTHERNAME) = {
     ASN1_EXP(OTHERNAME, value, ASN1_ANY, 0),
 } ASN1_SEQUENCE_END(OTHERNAME)
 
-IMPLEMENT_ASN1_FUNCTIONS(OTHERNAME)
+IMPLEMENT_ASN1_FUNCTIONS_const(OTHERNAME)
 
 ASN1_SEQUENCE(EDIPARTYNAME) = {
     // DirectoryString is a CHOICE type, so use explicit tagging.
     ASN1_EXP_OPT(EDIPARTYNAME, nameAssigner, DIRECTORYSTRING, 0),
     ASN1_EXP(EDIPARTYNAME, partyName, DIRECTORYSTRING, 1),
 } ASN1_SEQUENCE_END(EDIPARTYNAME)
 
-IMPLEMENT_ASN1_FUNCTIONS(EDIPARTYNAME)
+IMPLEMENT_ASN1_FUNCTIONS_const(EDIPARTYNAME)
 
 ASN1_CHOICE(GENERAL_NAME) = {
     ASN1_IMP(GENERAL_NAME, d.otherName, OTHERNAME, GEN_OTHERNAME),

crypto/x509v3/v3_pcia.c

@@ -45,11 +45,11 @@ ASN1_SEQUENCE(PROXY_POLICY) = {
     ASN1_OPT(PROXY_POLICY, policy, ASN1_OCTET_STRING),
 } ASN1_SEQUENCE_END(PROXY_POLICY)
 
-IMPLEMENT_ASN1_FUNCTIONS(PROXY_POLICY)
+IMPLEMENT_ASN1_FUNCTIONS_const(PROXY_POLICY)
 
 ASN1_SEQUENCE(PROXY_CERT_INFO_EXTENSION) = {
     ASN1_OPT(PROXY_CERT_INFO_EXTENSION, pcPathLengthConstraint, ASN1_INTEGER),
     ASN1_SIMPLE(PROXY_CERT_INFO_EXTENSION, proxyPolicy, PROXY_POLICY),
 } ASN1_SEQUENCE_END(PROXY_CERT_INFO_EXTENSION)
 
-IMPLEMENT_ASN1_FUNCTIONS(PROXY_CERT_INFO_EXTENSION)
+IMPLEMENT_ASN1_FUNCTIONS_const(PROXY_CERT_INFO_EXTENSION)

include/openssl/asn1t.h

@@ -677,13 +677,17 @@ typedef struct ASN1_AUX_st {
 	int i2d_##fname(const stname *a, unsigned char **out) \
 	{ \
 		return ASN1_item_i2d((ASN1_VALUE *)a, out, ASN1_ITEM_rptr(itname));\
-	} 
+	}
+
+#define IMPLEMENT_ASN1_DUP_FUNCTION(stname)          \
+  stname *stname##_dup(stname *x) {                  \
+    return ASN1_item_dup(ASN1_ITEM_rptr(stname), x); \
+  }
 
-#define IMPLEMENT_ASN1_DUP_FUNCTION(stname) \
-	stname * stname##_dup(stname *x) \
-        { \
-        return ASN1_item_dup(ASN1_ITEM_rptr(stname), x); \
-        }
+#define IMPLEMENT_ASN1_DUP_FUNCTION_const(stname)            \
+  stname *stname##_dup(const stname *x) {                    \
+    return ASN1_item_dup(ASN1_ITEM_rptr(stname), (void *)x); \
+  }
 
 #define IMPLEMENT_ASN1_FUNCTIONS_const(name) \
 		IMPLEMENT_ASN1_FUNCTIONS_const_fname(name, name, name)