| commit | 958346a5e7942093ce629972adba95f64d2a51ee | [log] [tgz] |
|---|---|---|
| author | Alessandro Ghedini <alessandro@ghedini.me> | Tue Dec 20 19:42:15 2016 +0000 |
| committer | David Benjamin <davidben@google.com> | Fri Jan 20 23:55:50 2017 +0000 |
| tree | eff6641f481843b4e33787792bb93e7512e7b620 | |
| parent | 5c7a4b8c2f9ef0e1d0747ab3617ee7b6157c40b1 [diff] |
Run select_certificate_cb multiple times It's not completely clear to me why select_cetificate_cb behaves the way it does, however not only is it confusing, but it makes assumptions about the application using BoringSSL (it's not always possible to implement custom logic outside of the callbacks provided by libssl), that make this callback somewhat useless. Case in point, the callback can be used for changing min/max protocol versions based on per-site policies, and select_certificate_cb is the only place where SSL_set_min/max_proto_version() can be used (e.g. you can't call them in cert_cb because it's too late), but the decision on the specific versions to use might depend on configuration that needs retrieving asynchronously from over the network, which requires re-running the callback multiple times. Change-Id: Ia8e151b163628545373e7fd1f327e9af207478a6 Reviewed-on: https://boringssl-review.googlesource.com/13000 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com>
BoringSSL is a fork of OpenSSL that is designed to meet Google's needs.
Although BoringSSL is an open source project, it is not intended for general use, as OpenSSL is. We don't recommend that third parties depend upon it. Doing so is likely to be frustrating because there are no guarantees of API or ABI stability.
Programs ship their own copies of BoringSSL when they use it and we update everything as needed when deciding to make API changes. This allows us to mostly avoid compromises in the name of compatibility. It works for us, but it may not work for you.
BoringSSL arose because Google used OpenSSL for many years in various ways and, over time, built up a large number of patches that were maintained while tracking upstream OpenSSL. As Google's product portfolio became more complex, more copies of OpenSSL sprung up and the effort involved in maintaining all these patches in multiple places was growing steadily.
Currently BoringSSL is the SSL library in Chrome/Chromium, Android (but it's not part of the NDK) and a number of other apps/programs.
There are other files in this directory which might be helpful: