Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update boringssl-fips to fips-20220613 tag #214

Draft
wants to merge 24 commits into
base: master
Choose a base branch
from
Draft
Changes from 1 commit
Commits
Show all changes
24 commits
Select commit Hold shift + click to select a range
bf8a7f6
Add dependency-review CI action
jentfoo Jan 2, 2024
2ed46c1
Introduce X509CheckFlags::UNDERSCORE_WILDCARDS
nox Dec 18, 2023
c886929
Don't use self-signed certs in hyper-boring tests
nox Dec 20, 2023
ae37df7
Introduce HttpsLayer::set_ssl_callback
nox Dec 20, 2023
1245154
Rearrange imports in x509 module
nox Jan 2, 2024
dfd5474
Move x509 tests to a subdirectory
nox Jan 3, 2024
8e2597b
Introduce X509Flags
nox Jan 3, 2024
c9f071d
Release 4.3.0
nox Jan 3, 2024
ae65a3f
Fix support for fips-link-precompiled
nox Dec 20, 2023
5dbf0a5
Expose SSL_get_error
evanrittenhouse Jan 8, 2024
e963358
Merge pull request #5 from gravitational/reed/merge-in-upstream
reedloden Jan 16, 2024
f82f783
Use Ninja to build BoringSSL
reedloden Jan 16, 2024
6559c29
Merge pull request #4 from gravitational/reed/use-ninja-for-building
reedloden Jan 16, 2024
37836c4
Expose `set_compliance_policy` and `get_ciphers`
jhoyla Jan 16, 2024
2c70857
Release 4.4.0
nox Jan 17, 2024
04af912
Updates boringssl-fips to fips-20220613
Jan 2, 2024
5e4c9a6
Updates required clang version to 14.0.0
Jan 2, 2024
199bebd
updates to 14.0.6
Jan 3, 2024
79a2bc6
force cmake generator to Ninja
Jan 10, 2024
402c116
Require Clang 14.0.x, install Ninja, only require Ninja for FIPS
reedloden Jan 22, 2024
28b12c1
Enable compliance policy when in FIPS mode
reedloden Jan 22, 2024
048c8ec
removes duplicate Ninja setting, comply with formatting
Jan 23, 2024
69d4083
Gate compliance policy apis:
Jan 24, 2024
83055ff
Adds BORING_BSSL_CPLUS_INCLUDE_PATH env variable handling
Jan 24, 2024
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Fix support for fips-link-precompiled
This feature expects a recent boringssl checkout (such as the one
found in boring-sys/deps/boringssl), so it should not be using
the same bindings as the fips feature, which are based on
boring-sys/deps/boringssl-fips, which is older and with a different
API.
nox authored and reedloden committed Jan 16, 2024
commit ae65a3f9f82104857e7a09b48e7bf8dfafe24e8a
4 changes: 2 additions & 2 deletions boring/src/bio.rs
Original file line number Diff line number Diff line change
@@ -19,9 +19,9 @@ impl<'a> Drop for MemBioSlice<'a> {

impl<'a> MemBioSlice<'a> {
pub fn new(buf: &'a [u8]) -> Result<MemBioSlice<'a>, ErrorStack> {
#[cfg(not(any(feature = "fips", feature = "fips-link-precompiled")))]
#[cfg(not(feature = "fips"))]
type BufLen = isize;
#[cfg(any(feature = "fips", feature = "fips-link-precompiled"))]
#[cfg(feature = "fips")]
type BufLen = libc::c_int;

ffi::init();
16 changes: 5 additions & 11 deletions boring/src/ssl/mod.rs
Original file line number Diff line number Diff line change
@@ -688,7 +688,7 @@ impl SslCurve {

pub const X25519: SslCurve = SslCurve(ffi::NID_X25519);

#[cfg(not(any(feature = "fips", feature = "fips-link-precompiled")))]
#[cfg(not(feature = "fips"))]
pub const X25519_KYBER768_DRAFT00: SslCurve = SslCurve(ffi::NID_X25519Kyber768Draft00);

#[cfg(feature = "pq-experimental")]
@@ -1402,10 +1402,7 @@ impl SslContextBuilder {
/// [`SSL_CTX_set_alpn_protos`]: https://www.openssl.org/docs/man1.1.0/ssl/SSL_CTX_set_alpn_protos.html
pub fn set_alpn_protos(&mut self, protocols: &[u8]) -> Result<(), ErrorStack> {
unsafe {
#[cfg_attr(
not(any(feature = "fips", feature = "fips-link-precompiled")),
allow(clippy::unnecessary_cast)
)]
#[cfg_attr(not(feature = "fips"), allow(clippy::unnecessary_cast))]
{
assert!(protocols.len() <= ProtosLen::max_value() as usize);
}
@@ -2121,9 +2118,9 @@ impl SslContextRef {
#[derive(Debug)]
pub struct GetSessionPendingError;

#[cfg(not(any(feature = "fips", feature = "fips-link-precompiled")))]
#[cfg(not(feature = "fips"))]
type ProtosLen = usize;
#[cfg(any(feature = "fips", feature = "fips-link-precompiled"))]
#[cfg(feature = "fips")]
type ProtosLen = libc::c_uint;

/// Information about the state of a cipher.
@@ -2814,10 +2811,7 @@ impl SslRef {
/// [`SSL_set_alpn_protos`]: https://www.openssl.org/docs/man1.1.0/ssl/SSL_set_alpn_protos.html
pub fn set_alpn_protos(&mut self, protocols: &[u8]) -> Result<(), ErrorStack> {
unsafe {
#[cfg_attr(
not(any(feature = "fips", feature = "fips-link-precompiled")),
allow(clippy::unnecessary_cast)
)]
#[cfg_attr(not(feature = "fips"), allow(clippy::unnecessary_cast))]
{
assert!(protocols.len() <= ProtosLen::max_value() as usize);
}
4 changes: 2 additions & 2 deletions boring/src/x509/mod.rs
Original file line number Diff line number Diff line change
@@ -982,9 +982,9 @@ impl X509NameBuilder {
}
}

#[cfg(not(any(feature = "fips", feature = "fips-link-precompiled")))]
#[cfg(not(feature = "fips"))]
type ValueLen = isize;
#[cfg(any(feature = "fips", feature = "fips-link-precompiled"))]
#[cfg(feature = "fips")]
type ValueLen = i32;

foreign_type_and_impl_send_sync! {