BoringSSL Main Console
| Legend: | Passed | Failed | Running | Exception |
Add two compatibility headers for code written against current OpenSSL.
Just reduces the load of conditional includes a little for a total of 4
projects.
No other OpenSSL includes exist that could be reasonably made a
forwarding include and that are actually in use.
Bug: 497675628
Change-Id: I2cf195bdc5546c4a8953dfcec88bb43a6a6a6964
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101547
Auto-Submit: Rudolf Polzer <rpolzer@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
Presubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com>
Commit-Queue: David Benjamin <davidben@google.com>
rust: bssl-tls: Session attachment should only be possible in builder
Signed-off-by: Xiangfei Ding <xfding@google.com>
Change-Id: Idaf6edb154cded0fab3764d0aef1578c6a6a6964
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101410
Reviewed-by: David Benjamin <davidben@google.com>
Reviewed-by: Rudolf Polzer <rpolzer@google.com>
Reviewed-by: Adam Langley <agl@google.com>
rust: bssl-tls: Drop the async private key task
... as soon as it is resolved.
For `async` private key delegate users there is no observable effect,
but the destructor is unnecessarily delayed even when the task is
resolved to some result.
Signed-off-by: Xiangfei Ding <xfding@google.com>
Change-Id: Ia06e14cced35d66dac3892ecf37acc836a6a6964
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101409
Reviewed-by: Adam Langley <agl@google.com>
Reviewed-by: Rudolf Polzer <rpolzer@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
Reland "crypto/x509: Verify standalone Merkle Tree Certs (MTCs)"
This reverts commit 96a007fb323e49e5637e018f7f4927addd851d6f,
thus relanding commit f89068d3030374395c4b070838d1f4d9bbef5465.
The build failure in Chromium's component build was because accessing
impl->tbs_sig_alg.get() instantiates the StackAllocated<X509_ALGOR, ...>
template, which emits relocations for internal symbols (x509_algor_init
and x509_algor_cleanup), and these are not pruned in unoptimized mode.
The fix (diff from patchset 1) is to avoid reaching into X509Impl
internals to construct the test cert. Instead, all the desired
(intentionally invalid) test certs were generated by the MTC demo tool,
and checked in as testdata and parsed directly.
Original change's description:
> Revert "crypto/x509: Verify standalone Merkle Tree Certs (MTCs)"
>
> This reverts commit f89068d3030374395c4b070838d1f4d9bbef5465.
>
> Reason for revert: build failure crbug.com/549361069
>
> Failure Link: https://ci.chromium.org/ui/p/chrome/builders/try/linux-chrome-dbg-cog-cache-warmer/79105/overview
>
> Original change's description:
> > crypto/x509: Verify standalone Merkle Tree Certs (MTCs)
> >
> > This implements verification of "standalone" Merkle Tree Certs (see
> > draft-ietf-plants-merkle-tree-certs-05, section 6.3) as part of the
> > X509_STORE_CTX API, if the flag X509_V_FLAG_USE_MTC_DRAFT_PLANTS_05
> > is specified.
> >
> > Bug: 503746594
> > Change-Id: Ie5abd17eb34c37139d3be1261e1914976a6a6964
> > Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100707
> > Reviewed-by: David Benjamin <davidben@google.com>
> > Commit-Queue: Lily Chen <chlily@google.com>
> > Presubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com>
>
> TBR=davidben@google.com,boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com,chlily@google.com
>
> No-Presubmit: true
> No-Tree-Checks: true
> No-Try: true
> Bug: 503746594, 549361069
> Change-Id: If43293ba7c2199a463a98dcf848fcc60bdd1e9bb
> Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101307
> Presubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com>
> Auto-Submit: Lily Chen <chlily@google.com>
> Reviewed-by: David Benjamin <davidben@google.com>
> Commit-Queue: David Benjamin <davidben@google.com>
# Not skipping CQ checks because this is a reland.
Bug: 503746594
Cq-Include-Trybots: luci.boringssl.try:linux_clang_shared_compile,linux_clang_shared_rel_compile
Change-Id: I2376b492ecc0e6bfcfc0acb36cc0f1511dd29db7
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101467
Commit-Queue: Lily Chen <chlily@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
CI/CQ: Test clang shared library builds on Linux
To catch compile issues that may occur in e.g. Chromium's
component build.
Bug: 549361069
Change-Id: I137310219922a6db07b401d3167d78fe6a6a6964
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101487
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: Lily Chen <chlily@google.com>
ACVP: test non-canonical ML-KEM keys.
The existing ML-KEM ACVP fixture only covers valid encapsulation
keys. Older NIST-generated invalid keys had unintended lengths, so
they did not exercise rejection of non-canonical polynomial
coefficients.
Add a focused NIST demo fixture for ML-KEM-768 and ML-KEM-1024.
Each parameter set includes a valid key and a correctly sized invalid
key whose first coefficient is 3330, outside the canonical range 0
through 3328.
The full response was accepted by the NIST demo server before
trimming. Keep these cases separate from ML-KEM.bz2 so the regression
stays explicit without replacing unrelated ML-KEM coverage.
Change-Id: Ic31b4a843b53d8749a3cf3d6a6a56f777152a8de
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101367
Reviewed-by: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
SLSA-Policy-Verified: SLSA Policy Verification Service <devtools-gerritcodereview-exitgate@google.com>
rust: bssl-tls: Eliminate ambiguity on transport state
... when transport is not set yet.
Signed-off-by: Xiangfei Ding <xfding@google.com>
Change-Id: I2d1274bdc31bc250e3f95316c119b9686a6a6964
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101408
Reviewed-by: Rudolf Polzer <rpolzer@google.com>
rust: bssl-tls: Fix flush protocol
There are two problems with the current BIO flush implementation.
- We did not signal retry correctly during flushing
- We did not test the retry reason correctly per specification
Signed-off-by: Xiangfei Ding <xfding@google.com>
Change-Id: Iff3a922dec08579740edfe9882fd74a36a6a6964
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101407
Reviewed-by: Rudolf Polzer <rpolzer@google.com>
CQ: enable `ios64_prefixed_compile` by default.
It's not actually redundant with `mac_arm64_prefixed_compile`, because
they seem to run vastly different Clang versions:
- `ios64_prefixed_compile` seems to be Clang 13 and Clang 15, depending
on builder.
- `mac_arm64_prefixed_compile` seems to be Clang 17 right now.
Change-Id: Ic2e62d88c35a29100cf7c590e292d8876a6a6964
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101347
Reviewed-by: Xiangfei Ding <xfding@google.com>
Presubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Rudolf Polzer <rpolzer@google.com>
Commit-Queue: Xiangfei Ding <xfding@google.com>
Revert "crypto/x509: Verify standalone Merkle Tree Certs (MTCs)"
This reverts commit f89068d3030374395c4b070838d1f4d9bbef5465.
Reason for revert: build failure crbug.com/549361069
Failure Link: https://ci.chromium.org/ui/p/chrome/builders/try/linux-chrome-dbg-cog-cache-warmer/79105/overview
Original change's description:
> crypto/x509: Verify standalone Merkle Tree Certs (MTCs)
>
> This implements verification of "standalone" Merkle Tree Certs (see
> draft-ietf-plants-merkle-tree-certs-05, section 6.3) as part of the
> X509_STORE_CTX API, if the flag X509_V_FLAG_USE_MTC_DRAFT_PLANTS_05
> is specified.
>
> Bug: 503746594
> Change-Id: Ie5abd17eb34c37139d3be1261e1914976a6a6964
> Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100707
> Reviewed-by: David Benjamin <davidben@google.com>
> Commit-Queue: Lily Chen <chlily@google.com>
> Presubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com>
TBR=davidben@google.com,boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com,chlily@google.com
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: 503746594, 549361069
Change-Id: If43293ba7c2199a463a98dcf848fcc60bdd1e9bb
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101307
Presubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Lily Chen <chlily@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
[MTCs] add debug logs in VerifyMTC
Bug: 548629159
Change-Id: Id3f21d1f6a6dfca3cc89c25f4cf38bb2acf51de2
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101287
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: Matt Mueller <mattm@google.com>
crypto/x509: Verify standalone Merkle Tree Certs (MTCs)
This implements verification of "standalone" Merkle Tree Certs (see
draft-ietf-plants-merkle-tree-certs-05, section 6.3) as part of the
X509_STORE_CTX API, if the flag X509_V_FLAG_USE_MTC_DRAFT_PLANTS_05
is specified.
Bug: 503746594
Change-Id: Ie5abd17eb34c37139d3be1261e1914976a6a6964
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100707
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: Lily Chen <chlily@google.com>
Presubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com>
Silence a false positive from audit_symbols.go
MSVC is not the only one that uses ceil in std::unordered_map and
sometimes the symbol is C++-mangled. It seems this was not caught due to
a mishap where a fragile check was added to CI but not CQ.
Bug: 544576498
Change-Id: Id9072a60a82ca3a2bc9297bbf857913e0e673e04
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101267
Commit-Queue: Lily Chen <chlily@google.com>
Auto-Submit: David Benjamin <davidben@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Lily Chen <chlily@google.com>
[MTCs] remove draft-davidben-08 support
Change-Id: Ic579f39bc37251ee7df7d50fcaf35f5c730aba86
Bug: 520071497
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101128
Commit-Queue: Matt Mueller <mattm@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
Add `X509_V_FLAG_ALLOW_TIMEZONE_OFFSET`.
This relaxes X.509 comparisons to allow for a time zone offset in
`notBefore` and `notAfter` fields.
Bug: 537625888
Change-Id: I1f51b59816ed4ceaff6ac9e9411d8cf86a6a6964
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101247
Auto-Submit: Rudolf Polzer <rpolzer@google.com>
Commit-Queue: Rudolf Polzer <rpolzer@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
Document ML-KEM key check wrapper commands
The module wrapper implements ML-KEM encapsulation and
decapsulation key checks, but the ACVP protocol command table does
not list them.
Add both commands and document the validity flag encoding for wrapper
implementations.
Change-Id: Ifcf21967d91158b15da94a3272b7bccc19e41dfe
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101207
Reviewed-by: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
compare_benchmark: fix ops/sec output.
The proper formula for a µs benchmark is not:
`time.Microsecond / cpuTimeUS`
but:
`time.Second / (cpuTimeUS * time.Microsecond)`
which simplifies to:
`(time.Second / time.Microsecond) / cpuTimeUS`
Change-Id: Ibec07cd968e44ea296175a4028f97a2b6a6a6964
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101227
Commit-Queue: Rudolf Polzer <rpolzer@google.com>
Reviewed-by: Xiangfei Ding <xfding@google.com>
Commit-Queue: Xiangfei Ding <xfding@google.com>
Auto-Submit: Rudolf Polzer <rpolzer@google.com>
Fix symbol prefixing audit for libdecrepit and libpki.
libssl still to be done.
Bug: 544576498
Change-Id: I8f0e3c8e22bb155e1893be6c7723f2646a6a6964
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100553
Reviewed-by: Xiangfei Ding <xfding@google.com>
Commit-Queue: Xiangfei Ding <xfding@google.com>
Presubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com>
rust: bssl-tls-tokio: Hyper I/O traits
Signed-off-by: Xiangfei Ding <xfding@google.com>
Change-Id: Ib35fe2e377ddbbed2837d480e44066906a6a6964
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100687
Reviewed-by: Adam Langley <agl@google.com>
[MTCs] update some tests to draft-plants-04
There were some tests that only tested the draft-davidben-08 path.
Update them to plants-04. Since this CL is in preparation for removing
support for the old draft entirely, it just updates the tests in-place
rather than adding tests for both drafts.
Change-Id: I94688573b989d4cefb524ef05c585decc731f6bc
Bug: 520071497
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101127
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: Matt Mueller <mattm@google.com>
rust: bssl-tls: Async polling I/Os and Datagrams
As we prepare `bssl-tls-tokio`, we are ready to publish the functions
for performing `async` I/O as public APIs.
Update-Note: DTLS I/O APIs have been not functional fully, but if it
has worked so far, please migrate to the new {a,}sync_{send, recv} APIs
for they are semantically different from stream sockets.
Bug: 532601068
Signed-off-by: Xiangfei Ding <xfding@google.com>
Change-Id: I3f2d7b21f513acbb6f09c4167997058c6a6a6964
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100847
Presubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Adam Langley <agl@google.com>
Rename ECDH benchmark -> ECDHComputeKey and add ECDHKeyGen.
This makes clearer what the benchmarks measure, and also allows tracking
keygen performance separately as well.
This is a follow-up to commit ed2f7e8c26006ff9284279702708797b46d590d6.
Overview:
```
--------------------------------------------------------------------------------
Benchmark Time CPU Iterations
--------------------------------------------------------------------------------
BM_SpeedECDHKeyGen/p224/threads:1 86029 ns 86029 ns 8127
BM_SpeedECDHKeyGen/p256/threads:1 7060 ns 7058 ns 98374
BM_SpeedECDHKeyGen/p384/threads:1 309585 ns 309301 ns 2267
BM_SpeedECDHKeyGen/p521/threads:1 776386 ns 775704 ns 899
BM_SpeedECDHComputeKey/p224/threads:1 91222 ns 91195 ns 7664
BM_SpeedECDHComputeKey/p256/threads:1 39382 ns 39329 ns 17586
BM_SpeedECDHComputeKey/p384/threads:1 333345 ns 333123 ns 2092
BM_SpeedECDHComputeKey/p521/threads:1 848211 ns 846023 ns 828
BM_SpeedECDHEphemeral/p224/threads:1 183712 ns 183670 ns 3809
BM_SpeedECDHEphemeral/p256/threads:1 50315 ns 50290 ns 13886
BM_SpeedECDHEphemeral/p384/threads:1 666594 ns 666588 ns 1046
BM_SpeedECDHEphemeral/p521/threads:1 1692489 ns 1692147 ns 414
```
Change-Id: I562a6b51dd4d75dc559a70375b437f416a6a6964
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101087
Auto-Submit: Rudolf Polzer <rpolzer@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
Remove CRYPTO_IOVEC_MAX.
Instead, allocate on the heap when it is exceeded.
There should already be no more code using the constant in the wild.
Bug: 544930636
Change-Id: I9a84c791e3aae2e451d8b806220cfb636a6a6964
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100727
Reviewed-by: David Benjamin <davidben@google.com>
Presubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com>
Commit-Queue: Rudolf Polzer <rpolzer@google.com>
crypto: format curve25519 internal header
Signed-off-by: Xiangfei Ding <xfding@google.com>
Change-Id: I179bf6e99ae261df9c6e5d397a0b16b26a6a6964
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101147
Presubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: David Benjamin <davidben@google.com>
CMake: move symbol prefixing check to the run_tests stage.
Bug: 543471701
Change-Id: Ib36d1ee3549b8bc832b221e44694124e6a6a6964
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100552
Presubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Xiangfei Ding <xfding@google.com>
Commit-Queue: Rudolf Polzer <rpolzer@google.com>
Always enable X509_V_FLAG_TRUSTED_FIRST
No one seems to ever disable it. This means we can unwind the alt-chains
logic, as it's never used as a result.
As discussed in
https://boringssl-review.googlesource.com/c/boringssl/+/49746, neither
mode is really correct. An ideal implementation would be a backtracking
path builder. But the particular implementation of backtracking in
alt-chains is both insufficient and particularly messy. Simplify this
for now and go from there.
Update-Note: X509_V_FLAG_TRUSTED_FIRST is now always enabled. (It was
previously a default.) Passing it to X509_VERIFY_PARAM_clear_flags now
does nothing. Running tests suggests no one is relying on this. This
means X509_V_FLAG_NO_ALT_CHAINS is now also a no-op because it does
nothing when X509_V_FLAG_TRUSTED_FIRST is enabled.
Bug: 544895602
Change-Id: I0b6519f705de2abacea2b6041ae855d59286b631
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100787
Auto-Submit: David Benjamin <davidben@google.com>
Reviewed-by: Rudolf Polzer <rpolzer@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
Fix symbol prefixing issues on Windows.
Bug: 543471701
Change-Id: Ia5613245b0409bcfc3ce123801ebbf2f6a6a6964
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101107
Reviewed-by: Xiangfei Ding <xfding@google.com>
Commit-Queue: Xiangfei Ding <xfding@google.com>
Enable CI/CQ-based symbol prefixing verification on all Win shared builds.
Bug: 543471701
Change-Id: I9c5b01ca45161b241d119ceed01451ed6a6a6964
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100551
Auto-Submit: Rudolf Polzer <rpolzer@google.com>
Reviewed-by: Xiangfei Ding <xfding@google.com>
Presubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com>
Commit-Queue: Xiangfei Ding <xfding@google.com>
Enable CI/CQ-based symbol prefixing verification on all Win static builds.
Bug: 543471701
Change-Id: I11293c070b353875994c954a5ca487c16a6a6964
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100550
Auto-Submit: Rudolf Polzer <rpolzer@google.com>
Presubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com>
Commit-Queue: Xiangfei Ding <xfding@google.com>
Reviewed-by: Xiangfei Ding <xfding@google.com>
audit_symbols.go: show the origin (library filename) of offending symbols.
This is nice when having checked multiple libraries.
Bug: 544576498
Change-Id: I7e363e5d8132f316e358b89232cddd1c6a6a6964
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100667
Reviewed-by: Xiangfei Ding <xfding@google.com>
Commit-Queue: Xiangfei Ding <xfding@google.com>
Auto-Submit: Rudolf Polzer <rpolzer@google.com>
Enable CI/CQ-based symbol prefixing verification on all Mac static builds.
Bug: 543471701
Change-Id: Icbcf4a747bf7dfb1c6c35f960e937b006a6a6964
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100549
Commit-Queue: Xiangfei Ding <xfding@google.com>
Auto-Submit: Rudolf Polzer <rpolzer@google.com>
Commit-Queue: Rudolf Polzer <rpolzer@google.com>
Reviewed-by: Xiangfei Ding <xfding@google.com>
Enable CI/CQ-based symbol prefixing verification on all Linux static builds.
Bug: 543471701
Change-Id: Ib2515f5b8c4311edd7b9e109b32955cc6a6a6964
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100548
Reviewed-by: Xiangfei Ding <xfding@google.com>
Auto-Submit: Rudolf Polzer <rpolzer@google.com>
Commit-Queue: Xiangfei Ding <xfding@google.com>
Commit-Queue: Rudolf Polzer <rpolzer@google.com>
crypto/bytestring: Add helper for relative OID from DER to text into CBB
It is similar to the existing CBS_asn1_relative_oid_to_text, except it
writes directly into a CBB rather than allocating a new string.
Change-Id: I2b7d7e1149d49d38ccacd37df4ff3bae6a6a6964
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101047
Presubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: Lily Chen <chlily@google.com>
Add ephemeral ECDH benchmark
The existing ECDH benchmark only measures raw scalar multiplication
with pre-generated keys. Add BM_SpeedECDHEphemeral to mirror the full
TLS ECDHE key exchange (generating an ephemeral keypair, serializing
the public point, parsing the peer's point, and deriving the padded
shared secret). This allows direct comparisons against ML-KEM
benchmarks.
Change-Id: I0057c1dffb7209891e64c07e20e9570493d8d45a
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100908
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
Suppress X509{,_REQ}_get1_email fallback to subject for malformed SAN
This has no impact on cert validation (a malformed SAN would already
cause validation to fail), but we might as well suppress the incorrect
result.
Bug: 491158075
Change-Id: I51fe41775d61e1143a553530c630c1646a6a6964
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101027
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: Lily Chen <chlily@google.com>
Fix some IWYU from clang-tidy
Change-Id: I6fac30ad00cb2040b34a70cdf28a1fc46a6a6964
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100987
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: Xiangfei Ding <xfding@google.com>
Auto-Submit: Lily Chen <chlily@google.com>
Remove the old F5 padding workaround
Many, many, many eons ago, SSL 2.0 was born.
Many, many eons ago, SSL 3.0 was born. SSL 3.0 was a completely
different record layer from SSL 3.0. Since then, all versions of TLS
kept continuity with SSL 3.0 in the record layer and ClientHello.
Many eons ago, F5 shipped a TLS load balancer that supported SSL 2.0 and
SSL 3.0. As part of that, they had to detect SSL 2.0 and SSL 3.0.
Eons ago, ClientHellos started hanging when talking to F5 servers. It
turned out that, once we made the TLS ClientHello exceed 256 bytes for
ALPN, F5 misinterpeted it as an incomplete SSL 2.0 CLIENT-HELLO and
hung.
https://mailarchive.ietf.org/arch/msg/tls/8wXwhM1d5WSmROHFSgrTyFmWN2o/
https://www.imperialviolet.org/2013/10/07/f5update.html
It turned out bumping the size up to 512 bytes would dodge the bug, so
the padding extension was born:
https://www.rfc-editor.org/info/rfc7685/
It has now been almost 10 years. In that time, ClientHellos have gotten
larger. With X25519MLKEM768 enabled by default, every ClientHello over
well over 1 KiB and the padding is a no-op. Also the F5s have hopefully
gotten updated.
Remove the padding, which requires some somewhat subtle bookkeeping. In
particular, we usually qualify changes with Chromium but as Chromium has
long enabled ML-KEM, we have gotten all the signal we ever will get
about F5.
Update-Note: If there are still unupdated F5s out there, a TLS client
application may hang when connecting to them. This would only happen if
your application:
1. Bypasses BoringSSL's default of enabling TLS 1.3, or
2. Bypasses BoringSSL's default of enabling X25519MLKEM768
Impacted applications should enable TLS 1.3 and X25519MLKEM768 for
better compatibility and security. Applications using BoringSSLs
defaults are not impacted by this change.
Fixed: 532111493
Change-Id: I78fd1d65d9fa7c25347fb56803acd6137f038eae
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101007
Auto-Submit: David Benjamin <davidben@google.com>
Reviewed-by: Lily Chen <chlily@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
Presubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com>
Document the per-encoder method for fixing OpenSSL's broken defaults
OpenSSL has chosen non-interoperable and unsafe defaults for ML-KEM and
ML-DSA private key serialization. Their only programmatic workaround
sets options globally.
https://github.com/openssl/openssl/pull/29206 added a per-encoder
option. Document that too.
Change-Id: I266e6c0829d0e0eec6167a0aba1ddae26e5d213b
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/99229
Reviewed-by: Adam Langley <agl@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
Presubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: David Benjamin <davidben@google.com>
crypto/x509: Add a helper to get cached TBS cert or else marshal it
As a convenience, to avoid making a copy when possible.
Migrates X509_verify() from the previous helper, which always makes a
copy, to the new helper which sometimes avoids a copy.
Change-Id: I76f771e4f0a591fe615fd0162038db866a6a6964
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100450
Commit-Queue: Lily Chen <chlily@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
Auto-Submit: Lily Chen <chlily@google.com>
OpenSSL Advisory: August 13th, 2026 (BoringSSL Not Affected)
BoringSSL counterpart to
https://openssl-library.org/news/secadv/20260813.txt and a discussion on
https://openssl-library.org/post/2026-07-21-hollowbyte/
Change-Id: I67d009e05c74b8112bc336322e8969a597d2df73
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100967
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>
Auto-Submit: David Benjamin <davidben@google.com>
Update version for Bazel Central Repository to 0.20260813.0
Change-Id: I3abc78a1df1e226bc905e87e927e18dcf50bbe7f
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100927
Commit-Queue: David Benjamin <davidben@google.com>
Auto-Submit: Lily Chen <chlily@google.com>
Commit-Queue: Lily Chen <chlily@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
Bump BORINGSSL_API_VERSION
We forgot to do this in
https://boringssl-review.googlesource.com/c/boringssl/+/99327, when
SSL_set_reject_unusable_ech_config was introduced.
Bug: 542983348, b:450001346
Change-Id: I98fab742617e58ced47d1d3e7f418e05a0e3f883
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100907
Commit-Queue: David Benjamin <davidben@google.com>
Presubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: David Benjamin <davidben@google.com>
Fix ACVP RSA PSS.
305bcfce0 broke ACVP PSS because it didn't update the expected number of
arguments for the operation in modulewrapper.cc. We didn't notice
because we didn't have ACVP tests for RSA signature generation. Fix both
things.
Change-Id: Idccd56f8480556c3aa77a8d4ddc856669e03b086
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100887
Reviewed-by: Xiangfei Ding <xfding@google.com>
Auto-Submit: Adam Langley <agl@google.com>
Commit-Queue: Xiangfei Ding <xfding@google.com>
SLSA-Policy-Verified: SLSA Policy Verification Service <devtools-gerritcodereview-exitgate@google.com>
Presubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com>
Separate serial number validity from serial number length
In practice it seems everyone ends up tolerating serials of the wrong
length, so having that flag seems questably worth it. But no one should
be tolerating inputs that aren't even INTEGERs (they cannot even
round-trip through crypto/asn1).
To help separate them, downgrade the 20-byte check to a warning. From
here, we'll histogram validity (and length while we're at it) in
Chromium just as a sanity check and, if all goes well, retire this flag.
I don't expect the length histograms to be fruitful, but we can check
that too.
Bug: 533048005
Change-Id: I11154dc759a8a8ccbeed8f658b1c8896d5ad0d52
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/98667
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Matt Mueller <mattm@google.com>
crypto/x509: Implement Merkle Tree inclusion proof evaluation
This implements evaluation of Merkle Tree inclusion proofs as described
in draft-ietf-plants-merkle-tree-certs, which will be used in
verification of Merkle Tree X.509 certificates.
Bug: 503746594
Change-Id: I3f8fc6bcda3acd1dfb2a4ad68f6850506a6a6964
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100448
Commit-Queue: Lily Chen <chlily@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
crypto/x509: Add convenience function to verify signature from byte span
Change-Id: I9e476670eeeaa74c42c194dad5914a9e6a6a6964
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100449
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: Lily Chen <chlily@google.com>
Defer allocating reassembly buffers in DTLS
When reassembling a DTLS message, we allocate:
- A buffer to hold the reassembled message
- A bitmap to track what portions of the message has been received
This means that once we receive a single fragment of the message, we
allocate this data. While bounded, it would be nice to wait until the
peer has sent us that much data first.
If we instead tracked the fragments individually, the memory would be
proportional to the total data received, but efficient reassembly
becomes tricky.
Square this circle by using both representations. While we've received
so few fragments that the message cannot possibly be complete, just
store the fragments separately. Once enough data is received, switch to
the reassembly buffer representation.
Fixed: 545614387
Change-Id: Idbf6637208b0e9fca5d9ea1349f5b6a5cc2e23a0
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100827
Presubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Lily Chen <chlily@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
Auto-Submit: David Benjamin <davidben@google.com>
Support cSHAKE and TurboSHAKE.
The amount of additional code is tiny and it seems like these will
probably be useful at some point. Still no public API.
Change-Id: I275124a5936337df9032e9b0b692d1f5739a8f5d
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100287
Auto-Submit: Adam Langley <agl@google.com>
Commit-Queue: Adam Langley <agl@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
runner: replace ptrTo with value-based new
Go has this built-in now.
Change-Id: I134a0cfbd6fb7ac3dee241e87913f90e178eaaee
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100767
Presubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: David Benjamin <davidben@google.com>
Commit-Queue: Rudolf Polzer <rpolzer@google.com>
Reviewed-by: Rudolf Polzer <rpolzer@google.com>
Enable `check_prefixed_symbols` on the CI-only prefixed symbols builders.
These are:
- android_aarch64_prefixed_compile
- ios64_prefixed_compile
- linux_clang_prefixed_compile
- mac_prefixed_compile
Not touching the CQ ones yet as that can break CL submission.
Bug: 543471701
Change-Id: I5c3137fdf58c71a60b2b152236ee1c886a6a6964
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100547
Reviewed-by: Xiangfei Ding <xfding@google.com>
Commit-Queue: Xiangfei Ding <xfding@google.com>
Auto-Submit: Rudolf Polzer <rpolzer@google.com>