kris/boringssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
c5aa8414da
boringssl/ssl/CMakeLists.txt

52 lines
704 B
CMake
Raw Normal View History

Move arm_arch.h and fix up lots of include paths. arm_arch.h is included from ARM asm files, but lives in crypto/, not openssl/include/. Since the asm files are often built from a different location than their position in the source tree, relative include paths are unlikely to work so, rather than having crypto/ be a de-facto, second global include path, this change moves arm_arch.h to include/openssl/. It also removes entries from many include paths because they should be needed as relative includes are always based on the locations of the source file. Change-Id: I638ff43d641ca043a4fc06c0d901b11c6ff73542 Reviewed-on: https://boringssl-review.googlesource.com/5746 Reviewed-by: Adam Langley <agl@google.com>
2015-08-25 02:03:17 +01:00
include_directories(../include)
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
add_library(
Change CMakeLists.txt to two-space indent. find -name CMakeLists.txt -type f | xargs sed -e 's/\t/ /g' -i Change-Id: I01636b1849c00ba918f48828252492d99b0403ac
2015-01-29 00:37:10 +00:00
ssl
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
Implement custom extensions. This change mirrors upstream's custom extension API because we have some internal users that depend on it. Change-Id: I408e442de0a55df7b05c872c953ff048cd406513 Reviewed-on: https://boringssl-review.googlesource.com/5471 Reviewed-by: Adam Langley <agl@google.com>
2015-07-31 02:10:13 +01:00
custom_extensions.c
Rename s3_{clnt,srvr}.c Give them much more reasonable names. Change-Id: Id14d983ab3231da21a4f987e662c2e01af7a2cd6 Reviewed-on: https://boringssl-review.googlesource.com/8185 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-06-07 22:05:07 +01:00
handshake_server.c
handshake_client.c
Change CMakeLists.txt to two-space indent. find -name CMakeLists.txt -type f | xargs sed -e 's/\t/ /g' -i Change-Id: I01636b1849c00ba918f48828252492d99b0403ac
2015-01-29 00:37:10 +00:00
d1_both.c
d1_lib.c
d1_pkt.c
d1_srtp.c
Rename (s3,d1)_meth.c. These are where the DTLS- and TLS-specific transport layer hooks will be defined. Later we can probably move much of the implementations of these hooks into these files so those functions can be static. While I'm here, fix up the naming of some constants. Change-Id: I1009dd9fdc3cc4fd49fbff0802f6289931abec3d Reviewed-on: https://boringssl-review.googlesource.com/8665 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-07-08 17:05:45 +01:00
dtls_method.c
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
dtls_record.c
Change CMakeLists.txt to two-space indent. find -name CMakeLists.txt -type f | xargs sed -e 's/\t/ /g' -i Change-Id: I01636b1849c00ba918f48828252492d99b0403ac
2015-01-29 00:37:10 +00:00
s3_both.c
s3_enc.c
s3_lib.c
s3_pkt.c
Factor SSL_AEAD_CTX into a dedicated type. tls1_enc is now SSL_AEAD_CTX_{open,seal}. This starts tidying up a bit of the record-layer logic. This removes rr->input, as encrypting and decrypting records no longer refers to various globals. It also removes wrec altogether. SSL3_RECORD is now only used to maintain state about the current incoming record. Outgoing records go straight to the write buffer. This also removes the outgoing alignment memcpy and simply calls SSL_AEAD_CTX_seal with the parameters as appropriate. From bssl speed tests, this seems to be faster on non-ARM and a bit of a wash on ARM. Later it may be worth recasting these open/seal functions to write into a CBB (tweaked so it can be malloc-averse), but for now they take an out/out_len/max_out trio like their EVP_AEAD counterparts. BUG=468889 Change-Id: Ie9266a818cc053f695d35ef611fd74c5d4def6c3 Reviewed-on: https://boringssl-review.googlesource.com/4792 Reviewed-by: Adam Langley <agl@google.com>
2015-03-03 19:20:26 +00:00
ssl_aead_ctx.c
Change CMakeLists.txt to two-space indent. find -name CMakeLists.txt -type f | xargs sed -e 's/\t/ /g' -i Change-Id: I01636b1849c00ba918f48828252492d99b0403ac
2015-01-29 00:37:10 +00:00
ssl_asn1.c
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
ssl_buffer.c
Change CMakeLists.txt to two-space indent. find -name CMakeLists.txt -type f | xargs sed -e 's/\t/ /g' -i Change-Id: I01636b1849c00ba918f48828252492d99b0403ac
2015-01-29 00:37:10 +00:00
ssl_cert.c
Document everything in ssl_ciph.c, now ssl_cipher.c. Just about everything depends on SSL_CIPHER. Move it to the top as the first section in ssl.h. Match the header order and the source file order and document everything. Also make a couple of minor style guide tweaks. Change-Id: I6a810dbe79238278ac480e5ced1447055715a79f Reviewed-on: https://boringssl-review.googlesource.com/4290 Reviewed-by: Adam Langley <agl@google.com>
2015-04-08 07:36:59 +01:00
ssl_cipher.c
Implement draft-ietf-tls-curve25519-01 in C. The new curve is not enabled by default. As EC_GROUP/EC_POINT is a bit too complex for X25519, this introduces an SSL_ECDH_METHOD abstraction which wraps just the raw ECDH operation. It also tidies up some of the curve code which kept converting back and force between NIDs and curve IDs. Now everything transits as curve IDs except for API entry points (SSL_set1_curves) which take NIDs. Those convert immediately and act on curve IDs from then on. Note that, like the Go implementation, this slightly tweaks the order of operations. The client sees the server public key before sending its own. To keep the abstraction simple, SSL_ECDH_METHOD expects to generate a keypair before consuming the peer's public key. Instead, the client handshake stashes the serialized peer public value and defers parsing it until it comes time to send ClientKeyExchange. (This is analogous to what it was doing before where it stashed the parsed peer public value instead.) It still uses TLS 1.2 terminology everywhere, but this abstraction should also be compatible with TLS 1.3 which unifies (EC)DH-style key exchanges. (Accordingly, this abstraction intentionally does not handle parsing the ClientKeyExchange/ServerKeyExchange framing or attempt to handle asynchronous plain RSA or the authentication bits.) BUG=571231 Change-Id: Iba09dddee5bcdfeb2b70185308e8ab0632717932 Reviewed-on: https://boringssl-review.googlesource.com/6780 Reviewed-by: Adam Langley <agl@google.com>
2015-12-19 05:18:25 +00:00
ssl_ecdh.c
Toss file-related convenience bits of ssl/ into a corner. Quite a lot of consumers of the SSL stack will never need to touch files from the SSL stack, but enough do that we can't just ditch them. Toss that all into their own file so a static linker can drop it. Change-Id: Ia07de939889eb09e3ab16aebcc1b6869ca8b75a0 Reviewed-on: https://boringssl-review.googlesource.com/5820 Reviewed-by: Adam Langley <agl@google.com>
2015-09-04 20:05:05 +01:00
ssl_file.c
Change CMakeLists.txt to two-space indent. find -name CMakeLists.txt -type f | xargs sed -e 's/\t/ /g' -i Change-Id: I01636b1849c00ba918f48828252492d99b0403ac
2015-01-29 00:37:10 +00:00
ssl_lib.c
ssl_rsa.c
Rename ssl_sess.c to ssl_session.c. Change-Id: Ib730ffe49b30c79b3f30acae4070f6055081a0a3 Reviewed-on: https://boringssl-review.googlesource.com/5878 Reviewed-by: Adam Langley <agl@google.com>
2015-09-13 19:16:39 +01:00
ssl_session.c
Change CMakeLists.txt to two-space indent. find -name CMakeLists.txt -type f | xargs sed -e 's/\t/ /g' -i Change-Id: I01636b1849c00ba918f48828252492d99b0403ac
2015-01-29 00:37:10 +00:00
ssl_stat.c
t1_enc.c
t1_lib.c
Rename (s3,d1)_meth.c. These are where the DTLS- and TLS-specific transport layer hooks will be defined. Later we can probably move much of the implementations of these hooks into these files so those functions can be static. While I'm here, fix up the naming of some constants. Change-Id: I1009dd9fdc3cc4fd49fbff0802f6289931abec3d Reviewed-on: https://boringssl-review.googlesource.com/8665 Reviewed-by: Steven Valdez <svaldez@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2016-07-08 17:05:45 +01:00
tls_method.c
Factor out the buffering and low-level record code. This begins decoupling the transport from the SSL state machine. The buffering logic is hidden behind an opaque API. Fields like ssl->packet and ssl->packet_length are gone. ssl3_get_record and dtls1_get_record now call low-level tls_open_record and dtls_open_record functions that unpack a single record independent of who owns the buffer. Both may be called in-place. This removes ssl->rstate which was redundant with the buffer length. Future work will push the buffer up the stack until it is above the handshake. Then we can expose SSL_open and SSL_seal APIs which act like *_open_record but return a slightly larger enum due to other events being possible. Likewise the handshake state machine will be detached from its buffer. The existing SSL_read, SSL_write, etc., APIs will be implemented on top of SSL_open, etc., combined with ssl_read_buffer_* and ssl_write_buffer_*. (Which is why ssl_read_buffer_extend still tries to abstract between TLS's and DTLS's fairly different needs.) The new buffering logic does not support read-ahead (removed previously) since it lacks a memmove on ssl_read_buffer_discard for TLS, but this could be added if desired. The old buffering logic wasn't quite right anyway; it tried to avoid the memmove in some cases and could get stuck too far into the buffer and not accept records. (The only time the memmove is optional is in DTLS or if enough of the record header is available to know that the entire next record would fit in the buffer.) The new logic also now actually decrypts the ciphertext in-place again, rather than almost in-place when there's an explicit nonce/IV. (That accidentally switched in https://boringssl-review.googlesource.com/#/c/4792/; see 3d59e04bce96474099ba76786a2337e99ae14505.) BUG=468889 Change-Id: I403c1626253c46897f47c7ae93aeab1064b767b2 Reviewed-on: https://boringssl-review.googlesource.com/5715 Reviewed-by: Adam Langley <agl@google.com>
2015-07-29 02:34:45 +01:00
tls_record.c
Add TLS 1.3 1-RTT. This adds the machinery for doing TLS 1.3 1RTT. Change-Id: I736921ffe9dc6f6e64a08a836df6bb166d20f504 Reviewed-on: https://boringssl-review.googlesource.com/8720 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-07-11 18:19:03 +01:00
tls13_both.c
tls13_client.c
tls13_enc.c
tls13_server.c
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
)
Fix magic SSL reason codes. SSL reason codes corresponding to alerts have special values. Teach make_errors.go that values above 1000 are reserved (otherwise it will assign new values in that namespace). Also fix all the existing reason codes which corresponded to alerts. Change-Id: Ieabdf8fd59f4802938616934e1d84e659227cf84 Reviewed-on: https://boringssl-review.googlesource.com/1212 Reviewed-by: Adam Langley <agl@google.com>
2014-07-16 19:37:51 +01:00
Fix shared library build on OS X. It seems OS X actually cares about symbol resolution and dependencies when you create a dylib. Probably because they do two-level name resolution. (Obligatory disclaimer: BoringSSL does not have a stable ABI and is thus not suitable for a traditional system-wide library.) BUG=539603 Change-Id: Ic26c4ad23840fe6c1f4825c44671e74dd2e33870 Reviewed-on: https://boringssl-review.googlesource.com/6131 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-10-06 02:32:10 +01:00
target_link_libraries(ssl crypto)
Fix magic SSL reason codes. SSL reason codes corresponding to alerts have special values. Teach make_errors.go that values above 1000 are reserved (otherwise it will assign new values in that namespace). Also fix all the existing reason codes which corresponded to alerts. Change-Id: Ieabdf8fd59f4802938616934e1d84e659227cf84 Reviewed-on: https://boringssl-review.googlesource.com/1212 Reviewed-by: Adam Langley <agl@google.com>
2014-07-16 19:37:51 +01:00
add_executable(
Change CMakeLists.txt to two-space indent. find -name CMakeLists.txt -type f | xargs sed -e 's/\t/ /g' -i Change-Id: I01636b1849c00ba918f48828252492d99b0403ac
2015-01-29 00:37:10 +00:00
ssl_test
Fix magic SSL reason codes. SSL reason codes corresponding to alerts have special values. Teach make_errors.go that values above 1000 are reserved (otherwise it will assign new values in that namespace). Also fix all the existing reason codes which corresponded to alerts. Change-Id: Ieabdf8fd59f4802938616934e1d84e659227cf84 Reviewed-on: https://boringssl-review.googlesource.com/1212 Reviewed-by: Adam Langley <agl@google.com>
2014-07-16 19:37:51 +01:00
Convert ssl_test to C++. Change-Id: Ic8f3cd5c6a89e07bbae43b1599a01fedf119b081 Reviewed-on: https://boringssl-review.googlesource.com/4121 Reviewed-by: Adam Langley <agl@google.com>
2015-03-22 21:22:08 +00:00
ssl_test.cc
Add malloc test support to unit tests. Currently far from passing and I haven't even tried with a leak checker yet. Also bn_test is slow. Change-Id: I4fe2783aa5f7897839ca846062ae7e4a367d2469 Reviewed-on: https://boringssl-review.googlesource.com/4794 Reviewed-by: Adam Langley <agl@google.com>
2015-05-16 00:08:49 +01:00
$<TARGET_OBJECTS:test_support>
Fix magic SSL reason codes. SSL reason codes corresponding to alerts have special values. Teach make_errors.go that values above 1000 are reserved (otherwise it will assign new values in that namespace). Also fix all the existing reason codes which corresponded to alerts. Change-Id: Ieabdf8fd59f4802938616934e1d84e659227cf84 Reviewed-on: https://boringssl-review.googlesource.com/1212 Reviewed-by: Adam Langley <agl@google.com>
2014-07-16 19:37:51 +01:00
)
Add a set of tests for cipher string parsing. Change-Id: I4f9cdfa443bc5916f1899a7fc90aca2bf3c6027c Reviewed-on: https://boringssl-review.googlesource.com/1801 Reviewed-by: Adam Langley <agl@google.com>
2014-09-20 20:35:39 +01:00
target_link_libraries(ssl_test ssl crypto)
Add a run_tests target to run all tests. It's very annoying having to remember the right incant every time I want to switch around between my build, build-release, build-asan, etc., output directories. Unfortunately, this target is pretty unfriendly without CMake 3.2+ (and Ninja 1.5+). This combination gives a USES_TERMINAL flag to add_custom_target which uses Ninja's "console" pool, otherwise the output buffering gets in the way. Ubuntu LTS is still on an older CMake, so do a version check in the meantime. CMake also has its own test mechanism (CTest), but this doesn't use it. It seems to prefer knowing what all the tests are and then tries to do its own output management and parallelizing and such. We already have our own runners. all_tests.go could actually be converted tidily, but generate_build_files.py also needs to read it, and runner.go has very specific needs. Naming the target ninja -C build test would be nice, but CTest squats that name and CMake grumps when you use a reserved name, so I've gone with run_tests. Change-Id: Ibd20ebd50febe1b4e91bb19921f3bbbd9fbcf66c Reviewed-on: https://boringssl-review.googlesource.com/6270 Reviewed-by: Adam Langley <alangley@gmail.com>
2015-10-15 02:34:40 +01:00
add_dependencies(all_tests ssl_test)
Reference in New Issue Copy Permalink