| commit | 123db570097d6373ed501cf693452dc33fc532cb | [log] [tgz] |
|---|---|---|
| author | David Benjamin <davidben@google.com> | Thu Nov 03 16:59:25 2016 -0400 |
| committer | CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> | Tue Nov 08 23:51:10 2016 +0000 |
| tree | 9264269086f9b1fb21a42228eed4f2ee27ffdb78 | |
| parent | e75cc2766ca8e6d8a9378171f56d2d71882d7da9 [diff] |
Measure session->timeout from ticket issuance. The distinction for full handshakes is not meaningful (the timestamp is currently the start of the handshake), but for renewed sessions, we currently retain the timestamp of the original issuance. Instead, when minting or receiving tickets, adjust session->time and session->timeout so that session->time is the ticket issuance time. This is still not our final TLS 1.3 behavior (which will need a both renewable and non-renewable times to honor the server ticket lifetime), but it gets us closer and unblocks handling ticket_age_add from TLS 1.3 draft 18 and sends the correct NewSessionTicket lifetime. This fixes the ticket lifetime hint which we emit on the server to mirror the true ticket lifetime. It also fixes the TLS 1.3 server code to not set the ticket lifetime hint. There is no need to waste ticket size with it, it is no longer a "hint" in TLS 1.3, and even in the TLS 1.3 code we didn't fill it in on the server. Change-Id: I140541f1005a24e53e1b1eaa90996d6dada1c3a1 Reviewed-on: https://boringssl-review.googlesource.com/12105 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
BoringSSL is a fork of OpenSSL that is designed to meet Google's needs.
Although BoringSSL is an open source project, it is not intended for general use, as OpenSSL is. We don't recommend that third parties depend upon it. Doing so is likely to be frustrating because there are no guarantees of API or ABI stability.
Programs ship their own copies of BoringSSL when they use it and we update everything as needed when deciding to make API changes. This allows us to mostly avoid compromises in the name of compatibility. It works for us, but it may not work for you.
BoringSSL arose because Google used OpenSSL for many years in various ways and, over time, built up a large number of patches that were maintained while tracking upstream OpenSSL. As Google's product portfolio became more complex, more copies of OpenSSL sprung up and the effort involved in maintaining all these patches in multiple places was growing steadily.
Currently BoringSSL is the SSL library in Chrome/Chromium, Android (but it's not part of the NDK) and a number of other apps/programs.
There are other files in this directory which might be helpful: