| commit | e33257fa6702d3a4c539c7666cb7678e05ab68ee | [log] [tgz] |
|---|---|---|
| author | David Benjamin <davidben@google.com> | Thu Jun 15 13:12:42 2023 -0400 |
| committer | Boringssl LUCI CQ <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com> | Mon Jun 19 18:54:09 2023 +0000 |
| tree | 88bd9023f941f060645381d2009fe6e54fbcba24 | |
| parent | 8ead3f531445004f1122d11fa7083e8d1bcc5200 [diff] |
Pass IPv6 vs IPv4 down to the shim The runner currently tries to listen on IPv6 and then falls back to IPv4 on error. The shim does the same. If they pick different ones, this breaks down. Normally, fallback happens because the system doesn't have IPv6, and both sides will make the same decision. But if binding to IPv6 fails for other reasons, they may mismatch. We're observing them fail due to what seems to port exhaustion. When this happens, shim and runner don't agree on the same address family. Instead, just tell the shim which address to connect to. This doesn't fix the underlying port exhaustion problem, but it does seem to fix the flakes. Although given we are still exhausting ports and falling back to IPv4, it doesn't truly fix it. Later CLs will address port exhaustion by using a single server port. This changes the runner <-> shim protocol, but hopefully in a fairly obvious way that others using BoGo can easily follow. It shouldn't break our cross-version tests because we keep runner and shim at the same versio there. To avoid needing to make an incompatible change to the shim <-> handshaker protocol, which would impact our cross-version tests, this introduces a mechanism for the shim omit flags when talking to the handshaker. The handshaker doesn't need to know how to connect to the runner. Also print the error string on Windows. Sadly this is a bit tedious. Change-Id: Ic8bda9a854a115c206c05a659a2e34f544b844a6 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/60885 Auto-Submit: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com>
BoringSSL is a fork of OpenSSL that is designed to meet Google's needs.
Although BoringSSL is an open source project, it is not intended for general use, as OpenSSL is. We don't recommend that third parties depend upon it. Doing so is likely to be frustrating because there are no guarantees of API or ABI stability.
Programs ship their own copies of BoringSSL when they use it and we update everything as needed when deciding to make API changes. This allows us to mostly avoid compromises in the name of compatibility. It works for us, but it may not work for you.
BoringSSL arose because Google used OpenSSL for many years in various ways and, over time, built up a large number of patches that were maintained while tracking upstream OpenSSL. As Google's product portfolio became more complex, more copies of OpenSSL sprung up and the effort involved in maintaining all these patches in multiple places was growing steadily.
Currently BoringSSL is the SSL library in Chrome/Chromium, Android (but it's not part of the NDK) and a number of other apps/programs.
Project links:
There are other files in this directory which might be helpful: