| commit | 974ac218e7141132fa84a81dfe8142e71680da5c | [log] [tgz] |
|---|---|---|
| author | David Benjamin <davidben@google.com> | Tue Oct 06 16:12:09 2020 -0400 |
| committer | CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> | Thu Oct 08 14:37:08 2020 +0000 |
| tree | 1226e17d930526cbd4665b4afa641133c8f8f7aa | |
| parent | f2b2ef84072604ef6ecbbd10a38332b12acea82c [diff] |
runner: Implement a more complete ClientHello consistency check. The Go TLS implementation, at the time runner forked, had custom testing-only equal methods on all the handshake messages. We've since removed all of them except for ClientHello, where we repurposed the function to check ClientHello consistency on HelloVerifyRequest and HelloRetryRequest. These are tedious to update. Upstream has since replaced them with reflect.DeepEqual, but the comparison we want is even tighter. Even unknown extensions aren't allowed to change. Replace the check with a custom one that works on the byte serialization and remove clientHelloMsg.equal. Along the way, I've fixed the HRR PSK identity logic to match the spec a bit more and check binders more consistently. Change-Id: Ib39e8791201c42d37e304ae5110c7aeed62c8b3f Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/43364 Reviewed-by: Adam Langley <agl@google.com> Reviewed-by: Steven Valdez <svaldez@google.com> Commit-Queue: David Benjamin <davidben@google.com>
BoringSSL is a fork of OpenSSL that is designed to meet Google's needs.
Although BoringSSL is an open source project, it is not intended for general use, as OpenSSL is. We don't recommend that third parties depend upon it. Doing so is likely to be frustrating because there are no guarantees of API or ABI stability.
Programs ship their own copies of BoringSSL when they use it and we update everything as needed when deciding to make API changes. This allows us to mostly avoid compromises in the name of compatibility. It works for us, but it may not work for you.
BoringSSL arose because Google used OpenSSL for many years in various ways and, over time, built up a large number of patches that were maintained while tracking upstream OpenSSL. As Google's product portfolio became more complex, more copies of OpenSSL sprung up and the effort involved in maintaining all these patches in multiple places was growing steadily.
Currently BoringSSL is the SSL library in Chrome/Chromium, Android (but it's not part of the NDK) and a number of other apps/programs.
Project links:
There are other files in this directory which might be helpful: