| commit | 7fd831c44cdd328078081ae996fd33ca6b04adc4 | [log] [tgz] |
|---|---|---|
| author | David Benjamin <davidben@google.com> | Wed Apr 06 15:38:22 2022 -0400 |
| committer | Boringssl LUCI CQ <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com> | Thu May 19 21:14:20 2022 +0000 |
| tree | bd168444c283de5fcd3fc4d14261064535113b54 | |
| parent | 5a79788cb13b9af5e6ee42afec0e7716f6a1da89 [diff] |
Enforce X.509 version invariants more consistently. This aligns X509_REQ's and X509_CRL's parsers to the changes already made with X509; we reject invalid versions and check that extensions are only with the corresponding version. For now, we still allow X509v1 CRLs with an explicit version, matching certificates. (The DEFAULT question is moot for X509_REQ because CSRs always encode their version, see RFC 2986.) In addition to rejecting garbage, this allows for a more efficient representation once we stop using the table-based parser: X509 and X509_CRL can just store a small enum. X509_REQ doesn't need to store anything because the single version is information-less. Update-Note: Invalid CRL and CSR versions will no longer be accepted. X509_set_version, etc., no longer allow invalid versions. Fixed: 467 Change-Id: I33f3aec747d8060ab80e0cbb8ddf97672e07642c Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/52605 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com>
BoringSSL is a fork of OpenSSL that is designed to meet Google's needs.
Although BoringSSL is an open source project, it is not intended for general use, as OpenSSL is. We don't recommend that third parties depend upon it. Doing so is likely to be frustrating because there are no guarantees of API or ABI stability.
Programs ship their own copies of BoringSSL when they use it and we update everything as needed when deciding to make API changes. This allows us to mostly avoid compromises in the name of compatibility. It works for us, but it may not work for you.
BoringSSL arose because Google used OpenSSL for many years in various ways and, over time, built up a large number of patches that were maintained while tracking upstream OpenSSL. As Google's product portfolio became more complex, more copies of OpenSSL sprung up and the effort involved in maintaining all these patches in multiple places was growing steadily.
Currently BoringSSL is the SSL library in Chrome/Chromium, Android (but it's not part of the NDK) and a number of other apps/programs.
Project links:
There are other files in this directory which might be helpful: