| commit | 18e2504acb5ce91da97bb6d992cd672b4424170c | [log] [tgz] |
|---|---|---|
| author | David Benjamin <davidben@google.com> | Mon Oct 28 15:57:10 2024 -0400 |
| committer | Boringssl LUCI CQ <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com> | Wed Oct 30 06:41:47 2024 +0000 |
| tree | 45d8e5c660fd485adfd22a8df794a4465c590618 | |
| parent | 4a653e082de47bd45fb9dcc730f71559c6d804a3 [diff] |
runner: Remove explicit seq parameter to encrypt and decrypt It was always derived from hc.seq. The only subtleties are: 1. The DTLS code relies on record header parsing zooming the sequence number forward. (It was already doing this.) 2. Outgoing records need to accomodate the goofy SequenceNumberMapping feature. 3. The funny sequence number business in DTLS 1.2 vs 1.3 was previously handled at the header parser for incoming records and at encrypt() for outgoing records. Unify everything on doing it at encrypt/decrypt. I added this parameter in https://boringssl-review.googlesource.com/c/boringssl/+/71407, but I think that was a mistake. We (mostly) always know the expected sequence number, and this is one more field we can derive from the epoch. Change-Id: I00124aee57618dfbde5e458d0f9572d16946c0bc Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/72648 Reviewed-by: Nick Harper <nharper@chromium.org> Commit-Queue: David Benjamin <davidben@google.com>
BoringSSL is a fork of OpenSSL that is designed to meet Google's needs.
Although BoringSSL is an open source project, it is not intended for general use, as OpenSSL is. We don't recommend that third parties depend upon it. Doing so is likely to be frustrating because there are no guarantees of API or ABI stability.
Programs ship their own copies of BoringSSL when they use it and we update everything as needed when deciding to make API changes. This allows us to mostly avoid compromises in the name of compatibility. It works for us, but it may not work for you.
BoringSSL arose because Google used OpenSSL for many years in various ways and, over time, built up a large number of patches that were maintained while tracking upstream OpenSSL. As Google's product portfolio became more complex, more copies of OpenSSL sprung up and the effort involved in maintaining all these patches in multiple places was growing steadily.
Currently BoringSSL is the SSL library in Chrome/Chromium, Android (but it's not part of the NDK) and a number of other apps/programs.
Project links:
To file a security issue, use the Chromium process and mention in the report this is for BoringSSL. You can ignore the parts of the process that are specific to Chromium/Chrome.
There are other files in this directory which might be helpful: