boringssl/ssl/CMakeLists.txt

60 lines
894 B
CMake
Raw Normal View History

include_directories(../include)
add_library(
ssl
bio_ssl.cc
custom_extensions.cc
d1_both.cc
d1_lib.cc
d1_pkt.cc
d1_srtp.cc
dtls_method.cc
dtls_record.cc
handshake_client.cc
handshake_server.cc
s3_both.cc
s3_lib.cc
s3_pkt.cc
ssl_aead_ctx.c
ssl_asn1.cc
ssl_buffer.cc
ssl_cert.cc
ssl_cipher.cc
ssl_ecdh.cc
ssl_file.c
ssl_lib.c
ssl_privkey.c
ssl_privkey_cc.cc
ssl_session.c
ssl_stat.c
ssl_transcript.c
Revise version negotiation logic on the C side. This is in preparation for upcoming experiments which will require supporting multiple experimental versions of TLS 1.3 with, on the server, the ability to enable multiple variants at once. This means the version <-> wire bijection no longer exists, even when limiting to a single SSL*. Thus version_to_wire is removed and instead we treat the wire version as the canonical version value. There is a mapping from valid wire versions to protocol versions which describe the high-level handshake protocol in use. This mapping is not injective, so uses of version_from_wire are rewritten differently. All the version-munging logic is moved to ssl_versions.c with a master preference list of all TLS and DTLS versions. The legacy version negotiation is converted to the new scheme. The version lists and negotiation are driven by the preference lists and a ssl_supports_version API. To simplify the mess around SSL_SESSION and versions, version_from_wire is now DTLS/TLS-agnostic, with any filtering being done by ssl_supports_version. This is screwy but allows parsing SSL_SESSIONs to sanity-check it and reject all bogus versions in SSL_SESSION. This reduces a mess of error cases. As part of this, the weird logic where ssl->version is set early when sending the ClientHello is removed. The one place where we were relying on this behavior is tweaked to query hs->max_version instead. Change-Id: Ic91b348481ceba94d9ae06d6781187c11adc15b0 Reviewed-on: https://boringssl-review.googlesource.com/17524 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com>
2017-06-20 15:55:02 +01:00
ssl_versions.c
ssl_x509.cc
t1_enc.c
t1_lib.c
tls_method.c
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
tls_record.c
tls13_both.c
tls13_client.c
tls13_enc.c
tls13_server.c
)
target_link_libraries(ssl crypto)
add_executable(
ssl_test
ssl_test.cc
Do a cursory conversion of a few tests to GTest. For now, this is the laziest conversion possible. The intent is to just get the build setup ready so that we can get everything working in our consumers. The intended end state is: - The standalone build produces three test targets, one per library: {crypto,ssl,decrepit}_tests. - Each FOO_test is made up of: FOO/**/*_test.cc crypto/test/gtest_main.cc test_support - generate_build_files.py emits variables crypto_test_sources and ssl_test_sources. These variables are populated with FindCFiles, looking for *_test.cc. - The consuming file assembles those variables into the two test targets (plus decrepit) from there. This avoids having generate_build_files.py emit actual build rules. - Our standalone builders, Chromium, and Android just run the top-level test targets using whatever GTest-based reporting story they have. In transition, we start by converting one of two tests in each library to populate the three test targets. Those are added to all_tests.json and all_tests.go hacked to handle them transparently. This keeps our standalone builder working. generate_build_files.py, to start with, populates the new source lists manually and subtracts them out of the old machinery. We emit both for the time being. When this change rolls in, we'll write all the build glue needed to build the GTest-based tests and add it to consumers' continuous builders. Next, we'll subsume a file-based test and get the consumers working with that. (I.e. make sure the GTest targets can depend on a data file.) Once that's all done, we'll be sure all this will work. At that point, we start subsuming the remaining tests into the GTest targets and, asynchronously, rewriting tests to use GTest properly rather than cursory conversion here. When all non-GTest tests are gone, the old generate_build_files.py hooks will be removed, consumers updated to not depend on them, and standalone builders converted to not rely on all_tests.go, which can then be removed. (Unless bits end up being needed as a malloc test driver. I'm thinking we'll want to do something with --gtest_filter.) As part of this CL, I've bumped the CMake requirements (for target_include_directories) and added a few suppressions for warnings that GTest doesn't pass. BUG=129 Change-Id: I881b26b07a8739cc0b52dbb51a30956908e1b71a Reviewed-on: https://boringssl-review.googlesource.com/13232 Reviewed-by: Adam Langley <agl@google.com>
2017-01-20 00:05:47 +00:00
$<TARGET_OBJECTS:gtest_main>
$<TARGET_OBJECTS:test_support>
)
Do a cursory conversion of a few tests to GTest. For now, this is the laziest conversion possible. The intent is to just get the build setup ready so that we can get everything working in our consumers. The intended end state is: - The standalone build produces three test targets, one per library: {crypto,ssl,decrepit}_tests. - Each FOO_test is made up of: FOO/**/*_test.cc crypto/test/gtest_main.cc test_support - generate_build_files.py emits variables crypto_test_sources and ssl_test_sources. These variables are populated with FindCFiles, looking for *_test.cc. - The consuming file assembles those variables into the two test targets (plus decrepit) from there. This avoids having generate_build_files.py emit actual build rules. - Our standalone builders, Chromium, and Android just run the top-level test targets using whatever GTest-based reporting story they have. In transition, we start by converting one of two tests in each library to populate the three test targets. Those are added to all_tests.json and all_tests.go hacked to handle them transparently. This keeps our standalone builder working. generate_build_files.py, to start with, populates the new source lists manually and subtracts them out of the old machinery. We emit both for the time being. When this change rolls in, we'll write all the build glue needed to build the GTest-based tests and add it to consumers' continuous builders. Next, we'll subsume a file-based test and get the consumers working with that. (I.e. make sure the GTest targets can depend on a data file.) Once that's all done, we'll be sure all this will work. At that point, we start subsuming the remaining tests into the GTest targets and, asynchronously, rewriting tests to use GTest properly rather than cursory conversion here. When all non-GTest tests are gone, the old generate_build_files.py hooks will be removed, consumers updated to not depend on them, and standalone builders converted to not rely on all_tests.go, which can then be removed. (Unless bits end up being needed as a malloc test driver. I'm thinking we'll want to do something with --gtest_filter.) As part of this CL, I've bumped the CMake requirements (for target_include_directories) and added a few suppressions for warnings that GTest doesn't pass. BUG=129 Change-Id: I881b26b07a8739cc0b52dbb51a30956908e1b71a Reviewed-on: https://boringssl-review.googlesource.com/13232 Reviewed-by: Adam Langley <agl@google.com>
2017-01-20 00:05:47 +00:00
target_link_libraries(ssl_test ssl crypto gtest)
if (WIN32)
target_link_libraries(ssl_test ws2_32)
endif()
add_dependencies(all_tests ssl_test)