)]}' { "commit": "91a3f26a2e5a0b8dab61b72ba6ae044372af3891", "tree": "87118ebdf8527ae7e1eddc4dad78078373bc6d21", "parents": [ "1a118bbf76ab52698961a1c7ec717ab0080b037d" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Sat Feb 10 11:08:08 2024 -0500" }, "committer": { "name": "Boringssl LUCI CQ", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Mar 07 22:19:26 2024 +0000" }, "message": "Add an SSL_CREDENTIAL API for ECDSA/RSA and delegated credentials\n\nThis adds a notion of \"credentials\" to BoringSSL\u0027s API, to support\ncertificate selection by key type (typically ECDSA vs RSA), though the\naim is for it to be generalizable to other certificate types and other\nkinds of selection criteria, such as Trust Expressions, or Merkle Tree\nCertificates. Since we already had some nascent delegated credentials\nI\u0027ve reworked that feature with SSL_CREDENTIALs as well.\n\nThe model is that you create an SSL_CREDENTIAL object containing all the\nconfiguration for what you are authenticating as. An X.509\nSSL_CREDENTIAL has a certificate chain, private key, optionally an OCSP\nresponse and SCT list. Delegated credentials are similar. In the future,\nwe might use this for raw public keys, other certificate types, etc.\nOnce you set those up, you configure those on the SSL or SSL_CTX in\npreference order, and BoringSSL will internally pick the first one that\nis usable.\n\nThe current implementation ends up redundantly selecting the signature\nalgorithm a couple of times. This works but is a little goofy. A\nfollow-up change will remove this redundancy. The protocol between the\nrunner and shim for tests is also a little weird, but it was the easiest\nway I could think of for injecting that. Long-term, I think we should\njust replace that protocol with a JSON structure. (See\nhttps://crbug.com/boringssl/704.)\n\nAs split handshakes are in the process of being replaced with handshake\nhints, this won\u0027t work with split handshakes. It works with handshake\nhints without any extra work.\n\nUpdate-Note: The delegated credentials API has been revamped.\nPreviously, it worked by configuring an optional delegated credential\nand key with your normal certificate chain. This has the side effect of\nforcing your DC issuer and your fallback certificate to be the same. The\nSSL_CREDENTIAL API lifts this restriction.\n\nA delegated credential is now just a different kind of credential. It\nmay use the same certificate chain as an X.509 credential or be\ncompletely separate. All the SSL_CREDENTIAL APIs take CRYPTO_BUFFERs,\nso, if common, the buffers may be shared to reduce memory.\n\nThe SSL_delegated_credential_used API is also removed, in favor of the\nmore general SSL_get0_selected_credential API. Callers can use ex_data\nor pointer equality to identify the credential.\n\nBug: 249\nChange-Id: Ibc290df3b7b95f148df12625e41cf55c50566602\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/66690\nReviewed-by: Bob Beck \u003cbbe@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\n", "tree_diff": [ { "type": "modify", "old_id": "70f9f520c7e2bdba2fcc28a0f79602b633b2f4ee", "old_mode": 33188, "old_path": "include/openssl/base.h", "new_id": "57095d053f794f033f3acc642b751e86c99c7864", "new_mode": 33188, "new_path": "include/openssl/base.h" }, { "type": "modify", "old_id": "f8fd947192422bb282570b929a4e1cf8a1eee499", "old_mode": 33188, "old_path": "include/openssl/ssl.h", "new_id": "d10bb02b983bacbace2ad5b8b932cff99da4f4a2", "new_mode": 33188, "new_path": "include/openssl/ssl.h" }, { "type": "modify", "old_id": "314ea4f8f3c55e5be892d1310b4f85958a3d306b", "old_mode": 33188, "old_path": "ssl/CMakeLists.txt", "new_id": "c0093172aadfd559c6e754441db0dbed06b3e642", "new_mode": 33188, "new_path": "ssl/CMakeLists.txt" }, { "type": "modify", "old_id": "e9c38a64999b6041ba49780fa2aba4b130b4783d", "old_mode": 33188, "old_path": "ssl/extensions.cc", "new_id": "a5e4ec8886fe72e5ca689a531010b4fa6e2c1f14", "new_mode": 33188, "new_path": "ssl/extensions.cc" }, { "type": "modify", "old_id": "7f78a1a5bda80957888d9a167a4243bed3d50ee6", "old_mode": 33188, "old_path": "ssl/handoff.cc", "new_id": "9417eb9a11cc08da7f43370475c3c61dfb79c992", "new_mode": 33188, "new_path": "ssl/handoff.cc" }, { "type": "modify", "old_id": "2a4fb1169c56e857f22e6e21efa5d1cb3fb300b2", "old_mode": 33188, "old_path": "ssl/handshake.cc", "new_id": "165614fc9455138d802f9b57723cd12b69e3208c", "new_mode": 33188, "new_path": "ssl/handshake.cc" }, { "type": "modify", "old_id": "226299910857b894c84490e8f5b8e31e3d4ee320", "old_mode": 33188, "old_path": "ssl/handshake_client.cc", "new_id": "b10a27b4d33f13651a22eab8647149ed12bf3560", "new_mode": 33188, "new_path": "ssl/handshake_client.cc" }, { "type": "modify", "old_id": "510062a7cdf544f69e5a542aebf262788f323c92", "old_mode": 33188, "old_path": "ssl/handshake_server.cc", "new_id": "fc5202a5fd0be0d66d660edd98e7f73268023e9b", "new_mode": 33188, "new_path": "ssl/handshake_server.cc" }, { "type": "modify", "old_id": "9f615361a80ca10dd1f49361576eb22130c5a1fd", "old_mode": 33188, "old_path": "ssl/internal.h", "new_id": "cc985384c285b5d768cf3c27a015474ad0da05a4", "new_mode": 33188, "new_path": "ssl/internal.h" }, { "type": "modify", "old_id": "8e8a034eb54b80a1df0452ca6a890153154e365d", "old_mode": 33188, "old_path": "ssl/s3_lib.cc", "new_id": "b8b37b4d52c41fb6abb586b0a55cfc7051a959c9", "new_mode": 33188, "new_path": "ssl/s3_lib.cc" }, { "type": "modify", "old_id": "3cc9baec8e7d8a56b7695aa2b1cad422ef1459e0", "old_mode": 33188, "old_path": "ssl/ssl_cert.cc", "new_id": "39798ba7e7463ffd08ddf62e992169c88d40d75e", "new_mode": 33188, "new_path": "ssl/ssl_cert.cc" }, { "type": "add", "old_id": "0000000000000000000000000000000000000000", "old_mode": 0, "old_path": "/dev/null", "new_id": "f787098688e20719cb0eb579c11ffe54d2120dbc", "new_mode": 33188, "new_path": "ssl/ssl_credential.cc" }, { "type": "modify", "old_id": "3531624532176593934ec4b6e43cf01ac55d6ce2", "old_mode": 33188, "old_path": "ssl/ssl_lib.cc", "new_id": "98f97ebb28a06dfde00082922a1aff24f8aa154c", "new_mode": 33188, "new_path": "ssl/ssl_lib.cc" }, { "type": "modify", "old_id": "b3bb2c802fa2e46e394b2e4e4311590462a62842", "old_mode": 33188, "old_path": "ssl/ssl_privkey.cc", "new_id": "9cf2c8f92cbab5b2b416b0c1ef1d103dd812b7b6", "new_mode": 33188, "new_path": "ssl/ssl_privkey.cc" }, { "type": "modify", "old_id": "bc0c842f4ebf3f74a272cf49cfba634533a07a80", "old_mode": 33188, "old_path": "ssl/ssl_test.cc", "new_id": "9247dc33a3dd0932d4ddf67db5de414ab6869ab1", "new_mode": 33188, "new_path": "ssl/ssl_test.cc" }, { "type": "modify", "old_id": "06baf88fc3e056488e64bf8ee7ad43d5ece3c0eb", "old_mode": 33188, "old_path": "ssl/ssl_x509.cc", "new_id": "d7f10834d2f53d694f72e4a51c1771c93e9e2da1", "new_mode": 33188, "new_path": "ssl/ssl_x509.cc" }, { "type": "modify", "old_id": "508b192c066bcea504b87077005e7b3b60127728", "old_mode": 33188, "old_path": "ssl/test/bssl_shim.cc", "new_id": "38ab01ce9fc59c13da3e5e766846478a6c694f9d", "new_mode": 33188, "new_path": "ssl/test/bssl_shim.cc" }, { "type": "modify", "old_id": "71f9c868ae8ce42cf4187f7f6ce77cceca0f7dd9", "old_mode": 33188, "old_path": "ssl/test/runner/common.go", "new_id": "f85a81a893bb1cf956a4e0e51b6541aa1f9d9383", "new_mode": 33188, "new_path": "ssl/test/runner/common.go" }, { "type": "modify", "old_id": "a3251dc100079fadd844468681656cf75c987293", "old_mode": 33188, "old_path": "ssl/test/runner/conn.go", "new_id": "bda9b92f370b1f00c2be715e826a61fbe8455a1c", "new_mode": 33188, "new_path": "ssl/test/runner/conn.go" }, { "type": "modify", "old_id": "bba721e11f52991ec9c57c4fcf6b658ed9eadda2", "old_mode": 33188, "old_path": "ssl/test/runner/handshake_client.go", "new_id": "eecb114241de02857bb145c7a58d9c4b6245ca91", "new_mode": 33188, "new_path": "ssl/test/runner/handshake_client.go" }, { "type": "modify", "old_id": "c3d9dd3b24145c5b59d36f0d50e3f744b23a4e7d", "old_mode": 33188, "old_path": "ssl/test/runner/handshake_messages.go", "new_id": "6d2f902f1fb93b418707a1f729324d7d09d6ec1f", "new_mode": 33188, "new_path": "ssl/test/runner/handshake_messages.go" }, { "type": "modify", "old_id": "d059d725d8f9653810ccce8e6323764866c6acb0", "old_mode": 33188, "old_path": "ssl/test/runner/handshake_server.go", "new_id": "ceaf02931a3ecdaadd7265b1b7a752da4a9ac2ea", "new_mode": 33188, "new_path": "ssl/test/runner/handshake_server.go" }, { "type": "modify", "old_id": "24e4ac72275431c0151a59fa60b83a35c9c8edad", "old_mode": 33188, "old_path": "ssl/test/runner/runner.go", "new_id": "cd7fbca48c4ac833be82347b66e7d72112a34707", "new_mode": 33188, "new_path": "ssl/test/runner/runner.go" }, { "type": "modify", "old_id": "c0b435e7af899f82ff9ca406bf0695906f9126a9", "old_mode": 33188, "old_path": "ssl/test/test_config.cc", "new_id": "c48d81ed6f696ba520afd4df49ce58ca85b5c76a", "new_mode": 33188, "new_path": "ssl/test/test_config.cc" }, { "type": "modify", "old_id": "26a11bca4f5676c09a5d6ec57989eed1e098a805", "old_mode": 33188, "old_path": "ssl/test/test_config.h", "new_id": "e4de861aaef87f7a8bf3e02d263be448ffd2b7ea", "new_mode": 33188, "new_path": "ssl/test/test_config.h" }, { "type": "modify", "old_id": "4199d4ae03166a7b99da33406e6c69815f26cd26", "old_mode": 33188, "old_path": "ssl/test/test_state.h", "new_id": "14b4e055d31a8324ca6f0cadc1effb0a898c1c8b", "new_mode": 33188, "new_path": "ssl/test/test_state.h" }, { "type": "modify", "old_id": "5ab5a1c934391458b868452bc3faa5f0f18f0f3c", "old_mode": 33188, "old_path": "ssl/tls13_both.cc", "new_id": "8058057c947260a9a81fb17f224fdc01b4ed0839", "new_mode": 33188, "new_path": "ssl/tls13_both.cc" }, { "type": "modify", "old_id": "82ed7a84b9e1c62c38005e11a28acb84cdaff111", "old_mode": 33188, "old_path": "ssl/tls13_client.cc", "new_id": "cdb46c6e71a81e540623ed566b820ca0748222d6", "new_mode": 33188, "new_path": "ssl/tls13_client.cc" }, { "type": "modify", "old_id": "588d09dd5a2035c8047b8c5cc1515eee7392fd9b", "old_mode": 33188, "old_path": "ssl/tls13_server.cc", "new_id": "ebe0cb41c1a7bb6840f07fc38147866efd44d0be", "new_mode": 33188, "new_path": "ssl/tls13_server.cc" } ] }