Skip to content

Commit 68d3f18

Browse files
0x676e670x676e67
committed
test: fix ech test
1 parent 851c6bc commit 68d3f18

File tree

1 file changed

+10
-147
lines changed

1 file changed

+10
-147
lines changed

‎boring-sys/patches/boringssl-44b3df6f03d85c901767250329c571db405122d5.patch‎

Lines changed: 10 additions & 147 deletions
Original file line numberDiff line numberDiff line change
@@ -4983,7 +4983,7 @@ index 6e5cc2da1..b1b31f3a7 100644
49834983
ticket_age_skew < std::numeric_limits<int32_t>::min()) {
49844984
return false;
49854985
diff --git a/src/ssl/handshake_client.cc b/src/ssl/handshake_client.cc
4986-
index 971ebd0b1..348fb93dc 100644
4986+
index 971ebd0b1..27a8abfae 100644
49874987
--- a/src/ssl/handshake_client.cc
49884988
+++ b/src/ssl/handshake_client.cc
49894989
@@ -158,6 +158,8 @@
@@ -4995,79 +4995,7 @@ index 971ebd0b1..348fb93dc 100644
49954995
#include <openssl/ec_key.h>
49964996
#include <openssl/ecdsa.h>
49974997
#include <openssl/err.h>
4998-
@@ -215,13 +217,15 @@ static void ssl_get_client_disabled(const SSL_HANDSHAKE *hs,
4999-
}
5000-
}
5001-
5002-
-static bool ssl_add_tls13_cipher(CBB *cbb, uint16_t cipher_id,
5003-
- ssl_compliance_policy_t policy) {
5004-
- if (ssl_tls13_cipher_meets_policy(cipher_id, policy)) {
5005-
- return CBB_add_u16(cbb, cipher_id);
5006-
- }
5007-
- return true;
5008-
-}
5009-
+// Comment this part of the code to cancel the device AES encryption cipher sequence priority, which may affect performance.
5010-
+// Compatible with some Firefox cipher sequence order
5011-
+// static bool ssl_add_tls13_cipher(CBB *cbb, uint16_t cipher_id,
5012-
+// ssl_compliance_policy_t policy) {
5013-
+// if (ssl_tls13_cipher_meets_policy(cipher_id, policy)) {
5014-
+// return CBB_add_u16(cbb, cipher_id);
5015-
+// }
5016-
+// return true;
5017-
+// }
5018-
5019-
static bool ssl_write_client_cipher_list(const SSL_HANDSHAKE *hs, CBB *out,
5020-
ssl_client_hello_type_t type) {
5021-
@@ -242,26 +246,28 @@ static bool ssl_write_client_cipher_list(const SSL_HANDSHAKE *hs, CBB *out,
5022-
5023-
// Add TLS 1.3 ciphers. Order ChaCha20-Poly1305 relative to AES-GCM based on
5024-
// hardware support.
5025-
- if (hs->max_version >= TLS1_3_VERSION) {
5026-
- const bool has_aes_hw = ssl->config->aes_hw_override
5027-
- ? ssl->config->aes_hw_override_value
5028-
- : EVP_has_aes_hardware();
5029-
-
5030-
- if ((!has_aes_hw && //
5031-
- !ssl_add_tls13_cipher(&child,
5032-
- TLS1_3_CK_CHACHA20_POLY1305_SHA256 & 0xffff,
5033-
- ssl->config->tls13_cipher_policy)) ||
5034-
- !ssl_add_tls13_cipher(&child, TLS1_3_CK_AES_128_GCM_SHA256 & 0xffff,
5035-
- ssl->config->tls13_cipher_policy) ||
5036-
- !ssl_add_tls13_cipher(&child, TLS1_3_CK_AES_256_GCM_SHA384 & 0xffff,
5037-
- ssl->config->tls13_cipher_policy) ||
5038-
- (has_aes_hw && //
5039-
- !ssl_add_tls13_cipher(&child,
5040-
- TLS1_3_CK_CHACHA20_POLY1305_SHA256 & 0xffff,
5041-
- ssl->config->tls13_cipher_policy))) {
5042-
- return false;
5043-
- }
5044-
- }
5045-
+ // Comment this part of the code to cancel the device AES encryption cipher sequence priority, which may affect performance.
5046-
+ // Compatible with some Firefox cipher sequence order
5047-
+ // if (hs->max_version >= TLS1_3_VERSION) {
5048-
+ // const bool has_aes_hw = ssl->config->aes_hw_override
5049-
+ // ? ssl->config->aes_hw_override_value
5050-
+ // : EVP_has_aes_hardware();
5051-
+
5052-
+ // if ((!has_aes_hw && //
5053-
+ // !ssl_add_tls13_cipher(&child,
5054-
+ // TLS1_3_CK_CHACHA20_POLY1305_SHA256 & 0xffff,
5055-
+ // ssl->config->tls13_cipher_policy)) ||
5056-
+ // !ssl_add_tls13_cipher(&child, TLS1_3_CK_AES_128_GCM_SHA256 & 0xffff,
5057-
+ // ssl->config->tls13_cipher_policy) ||
5058-
+ // !ssl_add_tls13_cipher(&child, TLS1_3_CK_AES_256_GCM_SHA384 & 0xffff,
5059-
+ // ssl->config->tls13_cipher_policy) ||
5060-
+ // (has_aes_hw && //
5061-
+ // !ssl_add_tls13_cipher(&child,
5062-
+ // TLS1_3_CK_CHACHA20_POLY1305_SHA256 & 0xffff,
5063-
+ // ssl->config->tls13_cipher_policy))) {
5064-
+ // return false;
5065-
+ // }
5066-
+ // }
5067-
5068-
if (hs->min_version < TLS1_3_VERSION && type != ssl_client_hello_inner) {
5069-
bool any_enabled = false;
5070-
@@ -1119,7 +1125,26 @@ static enum ssl_hs_wait_t do_read_server_key_exchange(SSL_HANDSHAKE *hs) {
4998+
@@ -1119,7 +1121,26 @@ static enum ssl_hs_wait_t do_read_server_key_exchange(SSL_HANDSHAKE *hs) {
50714999
hs->peer_psk_identity_hint.reset(raw);
50725000
}
50735001

@@ -5095,7 +5023,7 @@ index 971ebd0b1..348fb93dc 100644
50955023
// Parse the server parameters.
50965024
uint8_t group_type;
50975025
uint16_t group_id;
5098-
@@ -1477,6 +1502,58 @@ static enum ssl_hs_wait_t do_send_client_key_exchange(SSL_HANDSHAKE *hs) {
5026+
@@ -1477,6 +1498,58 @@ static enum ssl_hs_wait_t do_send_client_key_exchange(SSL_HANDSHAKE *hs) {
50995027
!CBB_flush(&body)) {
51005028
return ssl_hs_error;
51015029
}
@@ -5311,7 +5239,7 @@ index 1e6da2153..2a342d768 100644
53115239
~ssl_ctx_st();
53125240
friend OPENSSL_EXPORT void SSL_CTX_free(SSL_CTX *);
53135241
diff --git a/src/ssl/ssl_cipher.cc b/src/ssl/ssl_cipher.cc
5314-
index ebb075351..44febcb50 100644
5242+
index ebb075351..e272c4fed 100644
53155243
--- a/src/ssl/ssl_cipher.cc
53165244
+++ b/src/ssl/ssl_cipher.cc
53175245
@@ -175,26 +175,106 @@ static constexpr SSL_CIPHER kCiphers[] = {
@@ -5567,34 +5495,7 @@ index ebb075351..44febcb50 100644
55675495
// GCM based TLS v1.2 ciphersuites from RFC 5289
55685496

55695497
// Cipher C02B
5570-
@@ -467,15 +647,17 @@ Span<const SSL_CIPHER> AllCiphers() {
5571-
return MakeConstSpan(kCiphers, OPENSSL_ARRAY_SIZE(kCiphers));
5572-
}
5573-
5574-
-static constexpr size_t NumTLS13Ciphers() {
5575-
- size_t num = 0;
5576-
- for (const auto &cipher : kCiphers) {
5577-
- if (cipher.algorithm_mkey == SSL_kGENERIC) {
5578-
- num++;
5579-
- }
5580-
- }
5581-
- return num;
5582-
-}
5583-
+// Comment this part of the code to cancel the device AES encryption cipher sequence priority, which may affect performance.
5584-
+// Compatible with some Firefox cipher sequence order
5585-
+// static constexpr size_t NumTLS13Ciphers() {
5586-
+// size_t num = 0;
5587-
+// for (const auto &cipher : kCiphers) {
5588-
+// if (cipher.algorithm_mkey == SSL_kGENERIC) {
5589-
+// num++;
5590-
+// }
5591-
+// }
5592-
+// return num;
5593-
+// }
5594-
5595-
#define CIPHER_ADD 1
5596-
#define CIPHER_KILL 2
5597-
@@ -550,6 +732,10 @@ static const CIPHER_ALIAS kCipherAliases[] = {
5498+
@@ -550,6 +730,10 @@ static const CIPHER_ALIAS kCipherAliases[] = {
55985499
// MAC aliases
55995500
{"SHA1", ~0u, ~0u, ~0u, SSL_SHA1, 0},
56005501
{"SHA", ~0u, ~0u, ~0u, SSL_SHA1, 0},
@@ -5605,7 +5506,7 @@ index ebb075351..44febcb50 100644
56055506

56065507
// Legacy protocol minimum version aliases. "TLSv1" is intentionally the
56075508
// same as "SSLv3".
5608-
@@ -641,11 +827,19 @@ bool ssl_cipher_get_evp_aead(const EVP_AEAD **out_aead,
5509+
@@ -641,11 +825,19 @@ bool ssl_cipher_get_evp_aead(const EVP_AEAD **out_aead,
56095510
} else if (cipher->algorithm_mac == SSL_SHA256) {
56105511
if (cipher->algorithm_enc == SSL_AES128) {
56115512
*out_aead = EVP_aead_aes_128_cbc_sha256_tls();
@@ -5625,7 +5526,7 @@ index ebb075351..44febcb50 100644
56255526
} else {
56265527
return false;
56275528
}
5628-
@@ -1152,13 +1346,20 @@ bool ssl_create_cipher_list(UniquePtr<SSLCipherPreferenceList> *out_cipher_list,
5529+
@@ -1152,13 +1344,20 @@ bool ssl_create_cipher_list(UniquePtr<SSLCipherPreferenceList> *out_cipher_list,
56295530
TLS1_CK_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256 & 0xffff,
56305531
};
56315532
static const uint16_t kLegacyCiphers[] = {
@@ -5646,7 +5547,7 @@ index ebb075351..44febcb50 100644
56465547
TLS1_CK_RSA_WITH_AES_128_GCM_SHA256 & 0xffff,
56475548
TLS1_CK_RSA_WITH_AES_256_GCM_SHA384 & 0xffff,
56485549
TLS1_CK_RSA_WITH_AES_128_SHA & 0xffff,
5649-
@@ -1166,12 +1367,28 @@ bool ssl_create_cipher_list(UniquePtr<SSLCipherPreferenceList> *out_cipher_list,
5550+
@@ -1166,6 +1365,12 @@ bool ssl_create_cipher_list(UniquePtr<SSLCipherPreferenceList> *out_cipher_list,
56505551
TLS1_CK_RSA_WITH_AES_256_SHA & 0xffff,
56515552
TLS1_CK_PSK_WITH_AES_256_CBC_SHA & 0xffff,
56525553
SSL3_CK_RSA_DES_192_CBC3_SHA & 0xffff,
@@ -5656,48 +5557,10 @@ index ebb075351..44febcb50 100644
56565557
+ TLS1_CK_DHE_RSA_WITH_AES_256_SHA256 & 0xffff,
56575558
+ TLS1_CK_DHE_RSA_WITH_AES_128_GCM_SHA256 & 0xffff,
56585559
+ TLS1_CK_DHE_RSA_WITH_AES_256_GCM_SHA384 & 0xffff,
5659-
+ };
5660-
+ // Comment this part of the code to cancel the device AES encryption cipher sequence priority, which may affect performance.
5661-
+ // Compatible with some Firefox cipher sequence order
5662-
+ static const uint16_t kTLS13Ciphers[] = {
5663-
+ TLS1_3_CK_AES_128_GCM_SHA256 & 0xffff,
5664-
+ TLS1_3_CK_AES_256_GCM_SHA384 & 0xffff,
5665-
+ TLS1_3_CK_CHACHA20_POLY1305_SHA256 & 0xffff,
56665560
};
56675561

56685562
// Set up a linked list of ciphers.
5669-
- CIPHER_ORDER co_list[OPENSSL_ARRAY_SIZE(kAESCiphers) +
5670-
- OPENSSL_ARRAY_SIZE(kChaChaCiphers) +
5671-
- OPENSSL_ARRAY_SIZE(kLegacyCiphers)];
5672-
+ // Comment this part of the code to cancel the device AES encryption cipher sequence priority, which may affect performance.
5673-
+ // Compatible with some Firefox cipher sequence order
5674-
+ // CIPHER_ORDER co_list[OPENSSL_ARRAY_SIZE(kAESCiphers) +
5675-
+ // OPENSSL_ARRAY_SIZE(kChaChaCiphers) +
5676-
+ // OPENSSL_ARRAY_SIZE(kLegacyCiphers)];
5677-
+ CIPHER_ORDER co_list[OPENSSL_ARRAY_SIZE(kCiphers)];
5678-
for (size_t i = 0; i < OPENSSL_ARRAY_SIZE(co_list); i++) {
5679-
co_list[i].next =
5680-
i + 1 < OPENSSL_ARRAY_SIZE(co_list) ? &co_list[i + 1] : nullptr;
5681-
@@ -1207,8 +1424,17 @@ bool ssl_create_cipher_list(UniquePtr<SSLCipherPreferenceList> *out_cipher_list,
5682-
co_list[num++].cipher = SSL_get_cipher_by_value(id);
5683-
assert(co_list[num - 1].cipher != nullptr);
5684-
}
5685-
+ for (uint16_t id: kTLS13Ciphers) {
5686-
+ co_list[num++].cipher = SSL_get_cipher_by_value(id);
5687-
+ assert(co_list[num - 1].cipher != nullptr);
5688-
+ }
5689-
assert(num == OPENSSL_ARRAY_SIZE(co_list));
5690-
- static_assert(OPENSSL_ARRAY_SIZE(co_list) + NumTLS13Ciphers() ==
5691-
+ // Comment this part of the code to cancel the device AES encryption cipher sequence priority, which may affect performance.
5692-
+ // Compatible with some Firefox cipher sequence order
5693-
+ // static_assert(OPENSSL_ARRAY_SIZE(co_list) + NumTLS13Ciphers() ==
5694-
+ // OPENSSL_ARRAY_SIZE(kCiphers),
5695-
+ // "Not all ciphers are included in the cipher order");
5696-
+ static_assert(OPENSSL_ARRAY_SIZE(co_list) ==
5697-
OPENSSL_ARRAY_SIZE(kCiphers),
5698-
"Not all ciphers are included in the cipher order");
5699-
5700-
@@ -1403,6 +1629,8 @@ int SSL_CIPHER_get_digest_nid(const SSL_CIPHER *cipher) {
5563+
@@ -1403,6 +1608,8 @@ int SSL_CIPHER_get_digest_nid(const SSL_CIPHER *cipher) {
57015564
return NID_sha1;
57025565
case SSL_SHA256:
57035566
return NID_sha256;
@@ -5706,7 +5569,7 @@ index ebb075351..44febcb50 100644
57065569
}
57075570
assert(0);
57085571
return NID_undef;
5709-
@@ -1655,6 +1883,10 @@ const char *SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf,
5572+
@@ -1655,6 +1862,10 @@ const char *SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf,
57105573
mac = "SHA256";
57115574
break;
57125575

0 commit comments

Comments
 (0)