| commit | 580c04109e8a63d08582b3d948cf54849371a73e | [log] [tgz] |
|---|---|---|
| author | David Benjamin <davidben@google.com> | Sun Nov 12 14:28:51 2023 -0500 |
| committer | Boringssl LUCI CQ <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com> | Mon Nov 20 20:38:21 2023 +0000 |
| tree | 5bf0125149aa5893196dbc3b5a9361c8e867af00 | |
| parent | 39cc892c73d6c3faf2e604c44509f132c232f24c [diff] |
Don't process DistributionPoints with a reasons field This isn't *quite* a no-op, but it's the other half of removing support for partitioned CRLs. The distribution point's reasons field and the CRL's onlySomeReasons field are masked together to determine which reasons we have covered so far. This is used in some complex logic from RFC 5280, section 6.3.3 to loop through a bunch of CRLs before determining that we've covered evertything. OpenSSL's "extended CRL" feature skipped all CRLs with an onlySomeReasons field, but did not condition on the distribution point, so the loop was still active in some cases. The new verifier from Chromium doesn't support either. If the distribution point has a reasons field, we ignore it. Align with Chromium. Now the reasons field is always the special all-reasons value. As part of this, this removed the dp_reasons field from DIST_POINT. This is a public struct, but was unused outside of cl/581761514, so we can stop computing it. Update-Note: See above. Bug: 601 Change-Id: I9b0a9766b281d3486874e1b6d4d415a51e50ba59 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/63935 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Bob Beck <bbe@google.com>
BoringSSL is a fork of OpenSSL that is designed to meet Google's needs.
Although BoringSSL is an open source project, it is not intended for general use, as OpenSSL is. We don't recommend that third parties depend upon it. Doing so is likely to be frustrating because there are no guarantees of API or ABI stability.
Programs ship their own copies of BoringSSL when they use it and we update everything as needed when deciding to make API changes. This allows us to mostly avoid compromises in the name of compatibility. It works for us, but it may not work for you.
BoringSSL arose because Google used OpenSSL for many years in various ways and, over time, built up a large number of patches that were maintained while tracking upstream OpenSSL. As Google's product portfolio became more complex, more copies of OpenSSL sprung up and the effort involved in maintaining all these patches in multiple places was growing steadily.
Currently BoringSSL is the SSL library in Chrome/Chromium, Android (but it's not part of the NDK) and a number of other apps/programs.
Project links:
There are other files in this directory which might be helpful: