OERV-RUNTIME/boringssl
2
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

update master-with-bazel from master branch

Browse Source
This commit is contained in:
BoringSSL Robot
2024-12-06 22:48:47 +00:00
parent 281f77c8be bbf03ea966
commit 40c8bb421b
7 changed files with 25 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/include/openssl/ssl.h
+1 -11
View File
@@ -672,17 +672,7 @@ OPENSSL_EXPORT int DTLSv1_handle_timeout(SSL *ssl);
#define DTLS1_VERSION 0xfeff
#define DTLS1_2_VERSION 0xfefd
// DTLS1_3_EXPERIMENTAL_VERSION gates experimental, in-progress code for DTLS
// 1.3.
//
// WARNING: Do not use this value. BoringSSL's DTLS 1.3 implementation is still
// under development. The code enabled by this value is neither stable nor
// secure. It does not correspond to any real protocol. It is also incompatible
// with other DTLS implementations, and it is not compatible with future or past
// versions of BoringSSL.
//
// When the DTLS 1.3 implementation is complete, this symbol will be replaced.
#define DTLS1_3_EXPERIMENTAL_VERSION 0xfc25
#define DTLS1_3_VERSION 0xfefc
// SSL_CTX_set_min_proto_version sets the minimum protocol version for |ctx| to
// |version|. If |version| is zero, the default minimum version is used. It
src/ssl/ssl_test.cc
+10 -15
View File
@@ -92,7 +92,7 @@ static const VersionParam kAllVersions[] = {
{TLS1_3_VERSION, VersionParam::is_tls, "TLS1_3"},
{DTLS1_VERSION, VersionParam::is_dtls, "DTLS1"},
{DTLS1_2_VERSION, VersionParam::is_dtls, "DTLS1_2"},
{DTLS1_3_EXPERIMENTAL_VERSION, VersionParam::is_dtls, "DTLS1_3"},
{DTLS1_3_VERSION, VersionParam::is_dtls, "DTLS1_3"},
};
struct ExpectedCipher {
@@ -2765,8 +2765,7 @@ class SSLVersionTest : public ::testing::TestWithParam<VersionParam> {
uint16_t version() const { return GetParam().version; }
bool is_tls13() const {
return version() == TLS1_3_VERSION ||
version() == DTLS1_3_EXPERIMENTAL_VERSION;
return version() == TLS1_3_VERSION || version() == DTLS1_3_VERSION;
}
bool is_dtls() const {
@@ -2799,7 +2798,7 @@ TEST_P(SSLVersionTest, SequenceNumber) {
uint64_t server_write_seq = SSL_get_write_sequence(server_.get());
if (is_dtls()) {
if (version() == DTLS1_3_EXPERIMENTAL_VERSION) {
if (version() == DTLS1_3_VERSION) {
// Both client and server must be at epoch 3 (application data).
EXPECT_EQ(EpochFromSequence(client_write_seq), 3);
EXPECT_EQ(EpochFromSequence(server_write_seq), 3);
@@ -2830,7 +2829,7 @@ TEST_P(SSLVersionTest, SequenceNumber) {
EXPECT_EQ(SSL_write(client_.get(), &byte, 1), 1);
EXPECT_EQ(SSL_read(server_.get(), &byte, 1), 1);
if (version() == DTLS1_3_EXPERIMENTAL_VERSION) {
if (version() == DTLS1_3_VERSION) {
// TODO(crbug.com/42290608): Write an appropriate test for incrementing both
// sequence number and epoch in the following test. The server read seq was
// in epoch 2, but after the write it's in epoch 3, so adding 1 doesn't work
@@ -3985,7 +3984,7 @@ static const char *GetVersionName(uint16_t version) {
return "DTLSv1";
case DTLS1_2_VERSION:
return "DTLSv1.2";
case DTLS1_3_EXPERIMENTAL_VERSION:
case DTLS1_3_VERSION:
return "DTLSv1.3";
default:
return "???";
@@ -4376,7 +4375,7 @@ TEST_P(SSLVersionTest, SSLWriteRetry) {
}
TEST_P(SSLVersionTest, RecordCallback) {
if (version() == DTLS1_3_EXPERIMENTAL_VERSION) {
if (version() == DTLS1_3_VERSION) {
// The DTLS 1.3 record header is vastly different than the TLS or DTLS < 1.3
// header format. Instead of checking that the record header is formatted as
// expected here, the runner implementation in dtls.go is strict about what
@@ -9749,14 +9748,10 @@ TEST(SSLTest, EarlyDataDisabledInDTLS13) {
SSL_CTX_set_early_data_enabled(server_ctx.get(), true);
SSL_CTX_set_session_cache_mode(client_ctx.get(), SSL_SESS_CACHE_BOTH);
SSL_CTX_set_session_cache_mode(server_ctx.get(), SSL_SESS_CACHE_BOTH);
ASSERT_TRUE(SSL_CTX_set_min_proto_version(client_ctx.get(),
DTLS1_3_EXPERIMENTAL_VERSION));
ASSERT_TRUE(SSL_CTX_set_max_proto_version(client_ctx.get(),
DTLS1_3_EXPERIMENTAL_VERSION));
ASSERT_TRUE(SSL_CTX_set_min_proto_version(server_ctx.get(),
DTLS1_3_EXPERIMENTAL_VERSION));
ASSERT_TRUE(SSL_CTX_set_max_proto_version(server_ctx.get(),
DTLS1_3_EXPERIMENTAL_VERSION));
ASSERT_TRUE(SSL_CTX_set_min_proto_version(client_ctx.get(), DTLS1_3_VERSION));
ASSERT_TRUE(SSL_CTX_set_max_proto_version(client_ctx.get(), DTLS1_3_VERSION));
ASSERT_TRUE(SSL_CTX_set_min_proto_version(server_ctx.get(), DTLS1_3_VERSION));
ASSERT_TRUE(SSL_CTX_set_max_proto_version(server_ctx.get(), DTLS1_3_VERSION));
bssl::UniquePtr<SSL_SESSION> session =
CreateClientSession(client_ctx.get(), server_ctx.get());
src/ssl/ssl_versions.cc
+5 -3
View File
@@ -46,7 +46,7 @@ bool ssl_protocol_version_from_wire(uint16_t *out, uint16_t version) {
*out = TLS1_2_VERSION;
return true;
case DTLS1_3_EXPERIMENTAL_VERSION:
case DTLS1_3_VERSION:
*out = TLS1_3_VERSION;
return true;
@@ -66,7 +66,7 @@ static const uint16_t kTLSVersions[] = {
};
static const uint16_t kDTLSVersions[] = {
DTLS1_3_EXPERIMENTAL_VERSION,
DTLS1_3_VERSION,
DTLS1_2_VERSION,
DTLS1_VERSION,
};
@@ -104,7 +104,7 @@ static const VersionInfo kVersionNames[] = {
{TLS1_VERSION, "TLSv1"},
{DTLS1_VERSION, "DTLSv1"},
{DTLS1_2_VERSION, "DTLSv1.2"},
{DTLS1_3_EXPERIMENTAL_VERSION, "DTLSv1.3"},
{DTLS1_3_VERSION, "DTLSv1.3"},
};
static const char *ssl_version_to_string(uint16_t version) {
@@ -156,6 +156,8 @@ static bool set_min_version(const SSL_PROTOCOL_METHOD *method, uint16_t *out,
static bool set_max_version(const SSL_PROTOCOL_METHOD *method, uint16_t *out,
uint16_t version) {
// Zero is interpreted as the default maximum version.
// TODO(crbug.com/42290594): Enable DTLS 1.3 by default, after it's
// successfully shipped in WebRTC.
if (version == 0) {
*out = method->is_dtls ? DTLS1_2_VERSION : TLS1_3_VERSION;
return true;
src/ssl/test/runner/common.go
+5 -5
View File
@@ -31,9 +31,9 @@ const (
)
const (
VersionDTLS10 = 0xfeff
VersionDTLS12 = 0xfefd
VersionDTLS125Experimental = 0xfc25
VersionDTLS10 = 0xfeff
VersionDTLS12 = 0xfefd
VersionDTLS13 = 0xfefc
)
var allTLSWireVersions = []uint16{
@@ -45,7 +45,7 @@ var allTLSWireVersions = []uint16{
}
var allDTLSWireVersions = []uint16{
VersionDTLS125Experimental,
VersionDTLS13,
VersionDTLS12,
VersionDTLS10,
}
@@ -2126,7 +2126,7 @@ func (c *Config) echCipherSuitePreferences() []HPKECipherSuite {
func wireToVersion(vers uint16, isDTLS bool) (uint16, bool) {
if isDTLS {
switch vers {
case VersionDTLS125Experimental:
case VersionDTLS13:
return VersionTLS13, true
case VersionDTLS12:
return VersionTLS12, true
src/ssl/test/runner/handshake_client.go
+1 -1
View File
@@ -848,7 +848,7 @@ func (hs *clientHandshakeState) createClientHello(innerHello *clientHelloMsg, ec
if session.vers < VersionTLS13 {
version = VersionTLS13
if c.isDTLS {
version = VersionDTLS125Experimental
version = VersionDTLS13
}
}
generatePSKBinders(version, c.isDTLS, hello, session, nil, nil, c.config)
src/ssl/test/runner/runner.go
+1 -1
View File
@@ -1903,7 +1903,7 @@ var tlsVersions = []tlsVersion{
excludeFlag: "-no-tls13",
hasQUIC: true,
hasDTLS: true,
versionDTLS: VersionDTLS125Experimental,
versionDTLS: VersionDTLS13,
versionWire: VersionTLS13,
},
}
src/ssl/test/test_config.cc
+2 -1
View File
@@ -2316,8 +2316,9 @@ bssl::UniquePtr<SSL> TestConfig::NewSSL(
!SSL_set_min_proto_version(ssl.get(), min_version)) {
return nullptr;
}
// TODO(crbug.com/42290594): Remove this once DTLS 1.3 is enabled by default.
if (is_dtls && max_version == 0 &&
!SSL_set_max_proto_version(ssl.get(), DTLS1_3_EXPERIMENTAL_VERSION)) {
!SSL_set_max_proto_version(ssl.get(), DTLS1_3_VERSION)) {
return nullptr;
}
if (max_version != 0 &&