Fold SSL_CTX_set_grease_sigalgs_enabled into SSL_CTX_set_grease_enabled Absorbs grease_sigalgs_enabled into the general grease_enabled toggle. Increments BORINGSSL_API_VERSION to 44. Update-Note: GREASE for signature_algorithms extensions in ClientHello messages can no longer be controlled independently of other uses of GREASE. Callers of SSL_CTX_set_grease_sigalgs_enabled should now call SSL_CTX_set_grease_enabled. Bug: 526597789 Change-Id: Ia6b354db4d58d2a94d6c9c4dab7acc176a6a6964 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/104128 Presubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com> Commit-Queue: David Benjamin <davidben@google.com> Auto-Submit: Lily Chen <chlily@google.com> Reviewed-by: David Benjamin <davidben@google.com>
diff --git a/include/openssl/base.h b/include/openssl/base.h index cb63423..4e075b3 100644 --- a/include/openssl/base.h +++ b/include/openssl/base.h
@@ -73,7 +73,7 @@ // A consumer may use this symbol in the preprocessor to temporarily build // against multiple revisions of BoringSSL at the same time. It is not // recommended to do so for longer than is necessary. -#define BORINGSSL_API_VERSION 43 +#define BORINGSSL_API_VERSION 44 #if defined(BORINGSSL_SHARED_LIBRARY)
diff --git a/include/openssl/prefix_symbols.h b/include/openssl/prefix_symbols.h index 58f1fa8..4da5031 100644 --- a/include/openssl/prefix_symbols.h +++ b/include/openssl/prefix_symbols.h
@@ -2055,7 +2055,6 @@ #pragma redefine_extname SSL_CTX_set_ex_data BORINGSSL_ADD_USER_LABEL_AND_PREFIX(SSL_CTX_set_ex_data) #pragma redefine_extname SSL_CTX_set_false_start_allowed_without_alpn BORINGSSL_ADD_USER_LABEL_AND_PREFIX(SSL_CTX_set_false_start_allowed_without_alpn) #pragma redefine_extname SSL_CTX_set_grease_enabled BORINGSSL_ADD_USER_LABEL_AND_PREFIX(SSL_CTX_set_grease_enabled) -#pragma redefine_extname SSL_CTX_set_grease_sigalgs_enabled BORINGSSL_ADD_USER_LABEL_AND_PREFIX(SSL_CTX_set_grease_sigalgs_enabled) #pragma redefine_extname SSL_CTX_set_info_callback BORINGSSL_ADD_USER_LABEL_AND_PREFIX(SSL_CTX_set_info_callback) #pragma redefine_extname SSL_CTX_set_keylog_callback BORINGSSL_ADD_USER_LABEL_AND_PREFIX(SSL_CTX_set_keylog_callback) #pragma redefine_extname SSL_CTX_set_max_cert_list BORINGSSL_ADD_USER_LABEL_AND_PREFIX(SSL_CTX_set_max_cert_list) @@ -5219,7 +5218,6 @@ #define SSL_CTX_set_ex_data BORINGSSL_ADD_PREFIX(SSL_CTX_set_ex_data) #define SSL_CTX_set_false_start_allowed_without_alpn BORINGSSL_ADD_PREFIX(SSL_CTX_set_false_start_allowed_without_alpn) #define SSL_CTX_set_grease_enabled BORINGSSL_ADD_PREFIX(SSL_CTX_set_grease_enabled) -#define SSL_CTX_set_grease_sigalgs_enabled BORINGSSL_ADD_PREFIX(SSL_CTX_set_grease_sigalgs_enabled) #define SSL_CTX_set_info_callback BORINGSSL_ADD_PREFIX(SSL_CTX_set_info_callback) #define SSL_CTX_set_keylog_callback BORINGSSL_ADD_PREFIX(SSL_CTX_set_keylog_callback) #define SSL_CTX_set_max_cert_list BORINGSSL_ADD_PREFIX(SSL_CTX_set_max_cert_list)
diff --git a/include/openssl/ssl.h b/include/openssl/ssl.h index 334997d..06f01db 100644 --- a/include/openssl/ssl.h +++ b/include/openssl/ssl.h
@@ -5672,17 +5672,9 @@ // SSL_CTX_set_grease_enabled configures whether sockets on `ctx` should enable // GREASE. See RFC 8701. -OPENSSL_EXPORT void SSL_CTX_set_grease_enabled(SSL_CTX *ctx, int enabled); - -// SSL_CTX_set_grease_sigalgs_enabled configures whether sockets on `ctx` should -// send a GREASE value in signature_algorithms extensions in ClientHello -// messages. See RFC 8701. -// TODO(crbug.com/526597789): Fold this functionality into -// `SSL_CTX_set_grease_enabled` once deployed safely. // TODO(crbug.com/529360100): signature_algorithms extensions in // CertificateRequest messages should also be GREASE'd. -OPENSSL_EXPORT void SSL_CTX_set_grease_sigalgs_enabled(SSL_CTX *ctx, - int enabled); +OPENSSL_EXPORT void SSL_CTX_set_grease_enabled(SSL_CTX *ctx, int enabled); // SSL_CTX_set_permute_extensions configures whether sockets on `ctx` should // permute extensions. For now, this is only implemented for the ClientHello.
diff --git a/ssl/extensions.cc b/ssl/extensions.cc index ce21cce..8bb3925 100644 --- a/ssl/extensions.cc +++ b/ssl/extensions.cc
@@ -1029,7 +1029,7 @@ return false; } // Add a fake signature algorithm. See RFC 8701. - if (hs->ssl->ctx->grease_sigalgs_enabled && + if (hs->ssl->ctx->grease_enabled && !CBB_add_u16(&sigalgs_cbb, ssl_get_grease_value(hs, ssl_grease_signature_algorithm))) { return false;
diff --git a/ssl/internal.h b/ssl/internal.h index 2405d44..e125e1d 100644 --- a/ssl/internal.h +++ b/ssl/internal.h
@@ -4189,11 +4189,6 @@ // grease_enabled is whether GREASE (RFC 8701) is enabled. bool grease_enabled : 1; - // grease_sigalgs_enabled controls whether GREASE signature algorithms may be - // sent. - // TODO(crbug.com/526597789): Fold into `grease_enabled` once deployed safely. - bool grease_sigalgs_enabled : 1; - // permute_extensions is whether to permute extensions when sending messages. bool permute_extensions : 1;
diff --git a/ssl/ssl_lib.cc b/ssl/ssl_lib.cc index 8b3d85a..a6c9842 100644 --- a/ssl/ssl_lib.cc +++ b/ssl/ssl_lib.cc
@@ -369,7 +369,6 @@ signed_cert_timestamps_enabled(false), channel_id_enabled(false), grease_enabled(false), - grease_sigalgs_enabled(false), permute_extensions(false), allow_unknown_alpn_protos(false), false_start_allowed_without_alpn(false), @@ -3312,10 +3311,6 @@ FromOpaque(ctx)->grease_enabled = !!enabled; } -void SSL_CTX_set_grease_sigalgs_enabled(SSL_CTX *ctx, int enabled) { - FromOpaque(ctx)->grease_sigalgs_enabled = !!enabled; -} - void SSL_CTX_set_permute_extensions(SSL_CTX *ctx, int enabled) { FromOpaque(ctx)->permute_extensions = !!enabled; }
diff --git a/ssl/test/runner/common.go b/ssl/test/runner/common.go index 0bd3d17..514dd7c 100644 --- a/ssl/test/runner/common.go +++ b/ssl/test/runner/common.go
@@ -2778,13 +2778,11 @@ downgradeJDK11 = []byte{0xed, 0xbf, 0xb4, 0xa8, 0xc2, 0x47, 0x10, 0xff} ) -func containsGREASE(values []uint16) bool { - return slices.ContainsFunc(values, isGREASEValue) -} +type GREASEable interface{ ~uint16 } -func containsSigAlgsGREASE(values []signatureAlgorithm) bool { - return slices.ContainsFunc(values, func(s signatureAlgorithm) bool { - return isGREASEValue(uint16(s)) +func containsGREASE[T GREASEable](values []T) bool { + return slices.ContainsFunc(values, func(val T) bool { + return isGREASEValue(uint16(val)) }) }
diff --git a/ssl/test/runner/handshake_server.go b/ssl/test/runner/handshake_server.go index 2d6335b..c4ef197 100644 --- a/ssl/test/runner/handshake_server.go +++ b/ssl/test/runner/handshake_server.go
@@ -373,7 +373,7 @@ return fmt.Errorf("tls: client included signature_algorithms before TLS 1.2") } - if config.Bugs.ExpectGREASE && !containsSigAlgsGREASE(hs.clientHello.signatureAlgorithms) { + if config.Bugs.ExpectGREASE && !containsGREASE(hs.clientHello.signatureAlgorithms) { return fmt.Errorf("tls: no GREASE signature_algorithms value found") }
diff --git a/ssl/test/test_config.cc b/ssl/test/test_config.cc index 354501a..8d6e28a 100644 --- a/ssl/test/test_config.cc +++ b/ssl/test/test_config.cc
@@ -2140,7 +2140,6 @@ if (enable_grease) { SSL_CTX_set_grease_enabled(ssl_ctx.get(), 1); - SSL_CTX_set_grease_sigalgs_enabled(ssl_ctx.get(), 1); } if (permute_extensions) {