Cite an RFC over 9000 (draft-ietf-quic-tls is now RFC 9001). Also now that it's finalized, flip the default for SSL_set_quic_use_legacy_codepoint. Update-Note: QUIC APIs now default to the standard code point rather than the draft one. QUICHE has already been calling SSL_set_quic_use_legacy_codepoint, so this should not affect them. Once callers implementing the draft versions cycle out, we can then drop SSL_set_quic_use_legacy_codepoint altogether. I've also bumped BORINGSSL_API_VERSION in case we end up needing an ifdef. Change-Id: Id2cab66215f4ad4c1e31503d329c0febfdb4603e Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/47864 Reviewed-by: David Schinazi <dschinazi@google.com> Reviewed-by: Adam Langley <agl@google.com>
diff --git a/include/openssl/base.h b/include/openssl/base.h index e52fd09..66d0493 100644 --- a/include/openssl/base.h +++ b/include/openssl/base.h
@@ -195,7 +195,7 @@ // A consumer may use this symbol in the preprocessor to temporarily build // against multiple revisions of BoringSSL at the same time. It is not // recommended to do so for longer than is necessary. -#define BORINGSSL_API_VERSION 14 +#define BORINGSSL_API_VERSION 15 #if defined(BORINGSSL_SHARED_LIBRARY)
diff --git a/include/openssl/ssl.h b/include/openssl/ssl.h index 998dbbb..0981f15 100644 --- a/include/openssl/ssl.h +++ b/include/openssl/ssl.h
@@ -3186,7 +3186,7 @@ // // QUIC acts as an underlying transport for the TLS 1.3 handshake. The following // functions allow a QUIC implementation to serve as the underlying transport as -// described in draft-ietf-quic-tls. +// described in RFC 9001. // // When configured for QUIC, |SSL_do_handshake| will drive the handshake as // before, but it will not use the configured |BIO|. It will call functions on @@ -3206,8 +3206,7 @@ // confirm the handshake. As a client, |SSL_ERROR_EARLY_DATA_REJECTED| and // |SSL_reset_early_data_reject| behave as usual. // -// See https://tools.ietf.org/html/draft-ietf-quic-tls-15#section-4.1 for more -// details. +// See https://www.rfc-editor.org/rfc/rfc9001.html#section-4.1 for more details. // // To avoid DoS attacks, the QUIC implementation must limit the amount of data // being queued up. The implementation can call @@ -3218,7 +3217,8 @@ // |SSL_set_quic_transport_params|. |SSL_get_peer_quic_transport_params| may be // used to query the value received from the peer. BoringSSL handles this // extension as an opaque byte string. The caller is responsible for serializing -// and parsing them. See draft-ietf-quic-transport (section 7.3) for details. +// and parsing them. See https://www.rfc-editor.org/rfc/rfc9000#section-7.4 for +// details. // // QUIC additionally imposes restrictions on 0-RTT. In particular, the QUIC // transport layer requires that if a server accepts 0-RTT data, then the @@ -3330,7 +3330,7 @@ // that may be received at the given encryption level. This function should be // used to limit buffering in the QUIC implementation. // -// See https://tools.ietf.org/html/draft-ietf-quic-transport-16#section-4.4. +// See https://www.rfc-editor.org/rfc/rfc9000#section-7.5 OPENSSL_EXPORT size_t SSL_quic_max_handshake_flight_len( const SSL *ssl, enum ssl_encryption_level_t level); @@ -3393,8 +3393,8 @@ // SSL_set_quic_use_legacy_codepoint configures whether to use the legacy QUIC // extension codepoint 0xffa5 as opposed to the official value 57. Call with -// |use_legacy| set to 1 to use 0xffa5 and call with 0 to use 57. The default -// value for this is currently 1 but it will change to 0 at a later date. +// |use_legacy| set to 1 to use 0xffa5 and call with 0 to use 57. By default, +// the standard code point is used. OPENSSL_EXPORT void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy); // SSL_set_quic_early_data_context configures a context string in QUIC servers
diff --git a/include/openssl/tls1.h b/include/openssl/tls1.h index 75dea96..c41eba2 100644 --- a/include/openssl/tls1.h +++ b/include/openssl/tls1.h
@@ -209,19 +209,15 @@ // hasn't been a problem in practice since it's QUIC-only). Drafts 33 onward // use the value 57 which was officially registered with IANA. #define TLSEXT_TYPE_quic_transport_parameters_legacy 0xffa5 -#define TLSEXT_TYPE_quic_transport_parameters_standard 57 -// TLSEXT_TYPE_quic_transport_parameters is an alias for -// |TLSEXT_TYPE_quic_transport_parameters_legacy|. It will switch to -// |TLSEXT_TYPE_quic_transport_parameters_standard| at a later date. -// -// Callers using |SSL_set_quic_use_legacy_codepoint| should use -// |TLSEXT_TYPE_quic_transport_parameters_legacy| or -// |TLSEXT_TYPE_quic_transport_parameters_standard| rather than this constant. -// When the default code point is switched to the standard one, this value will -// be updated and we will transition callers back to the unsuffixed constant. -#define TLSEXT_TYPE_quic_transport_parameters \ - TLSEXT_TYPE_quic_transport_parameters_legacy +// ExtensionType value from RFC9000 +#define TLSEXT_TYPE_quic_transport_parameters 57 + +// TLSEXT_TYPE_quic_transport_parameters_standard is an alias for +// |TLSEXT_TYPE_quic_transport_parameters|. Use +// |TLSEXT_TYPE_quic_transport_parameters| instead. +#define TLSEXT_TYPE_quic_transport_parameters_standard \ + TLSEXT_TYPE_quic_transport_parameters // ExtensionType value from RFC8879 #define TLSEXT_TYPE_cert_compression 27
diff --git a/ssl/ssl_lib.cc b/ssl/ssl_lib.cc index 5b06005..a05b9b1 100644 --- a/ssl/ssl_lib.cc +++ b/ssl/ssl_lib.cc
@@ -730,7 +730,7 @@ handoff(false), shed_handshake_config(false), jdk11_workaround(false), - quic_use_legacy_codepoint(true) { + quic_use_legacy_codepoint(false) { assert(ssl); }
diff --git a/ssl/t1_lib.cc b/ssl/t1_lib.cc index 67f18fd..420b6ee 100644 --- a/ssl/t1_lib.cc +++ b/ssl/t1_lib.cc
@@ -2646,7 +2646,7 @@ return true; } - uint16_t extension_type = TLSEXT_TYPE_quic_transport_parameters_standard; + uint16_t extension_type = TLSEXT_TYPE_quic_transport_parameters; if (hs->config->quic_use_legacy_codepoint) { extension_type = TLSEXT_TYPE_quic_transport_parameters_legacy; } @@ -2782,7 +2782,7 @@ return true; } - uint16_t extension_type = TLSEXT_TYPE_quic_transport_parameters_standard; + uint16_t extension_type = TLSEXT_TYPE_quic_transport_parameters; if (hs->config->quic_use_legacy_codepoint) { extension_type = TLSEXT_TYPE_quic_transport_parameters_legacy; } @@ -3251,7 +3251,7 @@ dont_add_serverhello, }, { - TLSEXT_TYPE_quic_transport_parameters_standard, + TLSEXT_TYPE_quic_transport_parameters, NULL, ext_quic_transport_params_add_clienthello, ext_quic_transport_params_parse_serverhello,
diff --git a/ssl/test/runner/common.go b/ssl/test/runner/common.go index fa2ba6c..4e84a0e 100644 --- a/ssl/test/runner/common.go +++ b/ssl/test/runner/common.go
@@ -119,7 +119,7 @@ extensionCertificateAuthorities uint16 = 47 extensionSignatureAlgorithmsCert uint16 = 50 extensionKeyShare uint16 = 51 - extensionQUICTransportParams uint16 = 57 // draft-ietf-quic-tls-33 and later + extensionQUICTransportParams uint16 = 57 extensionCustom uint16 = 1234 // not IANA assigned extensionNextProtoNeg uint16 = 13172 // not IANA assigned extensionApplicationSettings uint16 = 17513 // not IANA assigned
diff --git a/ssl/tls13_client.cc b/ssl/tls13_client.cc index d23cf6c..8ba6b4d 100644 --- a/ssl/tls13_client.cc +++ b/ssl/tls13_client.cc
@@ -713,8 +713,7 @@ SSL *const ssl = hs->ssl; if (ssl->s3->early_data_accepted) { - // QUIC omits the EndOfEarlyData message. See draft-ietf-quic-tls-22, - // section 8.3. + // QUIC omits the EndOfEarlyData message. See RFC 9001, section 8.3. if (ssl->quic_method == nullptr) { ScopedCBB cbb; CBB body; @@ -1044,7 +1043,7 @@ } // QUIC does not use the max_early_data_size parameter and always sets it to - // a fixed value. See draft-ietf-quic-tls-22, section 4.5. + // a fixed value. See RFC 9001, section 4.6.1. if (ssl->quic_method != nullptr && session->ticket_max_early_data != 0xffffffff) { ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER);
diff --git a/ssl/tls13_server.cc b/ssl/tls13_server.cc index cb14e7e..c2a66a8 100644 --- a/ssl/tls13_server.cc +++ b/ssl/tls13_server.cc
@@ -155,7 +155,7 @@ (!ssl->quic_method || !ssl->config->quic_early_data_context.empty()); if (enable_early_data) { // QUIC does not use the max_early_data_size parameter and always sets it - // to a fixed value. See draft-ietf-quic-tls-22, section 4.5. + // to a fixed value. See RFC 9001, section 4.6.1. session->ticket_max_early_data = ssl->quic_method != nullptr ? 0xffffffff : kMaxEarlyDataAccepted; } @@ -979,9 +979,8 @@ hs->in_early_data = true; } - // QUIC doesn't use an EndOfEarlyData message (draft-ietf-quic-tls-22, - // section 8.3), so we switch to client_handshake_secret before the early - // return. + // QUIC doesn't use an EndOfEarlyData message (RFC 9001, section 8.3), so we + // switch to client_handshake_secret before the early return. if (ssl->quic_method != nullptr) { if (!tls13_set_traffic_key(ssl, ssl_encryption_handshake, evp_aead_open, hs->new_session.get(),