min
/
boring2
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Expose SSL_CTX_set1_ech_keys from SslContextRef 

We currently expose this method on `SslContextBuilder`, which is fine
for bootstrapping an `SSL_CTX`, but subsequent attempts to set ECH keys
(like during key rotation) can only happen via `SslContextRef`. Also
update the method on the builder to take an immutable reference to self
because the API is thread safe.
This commit is contained in:
Rushil Mehra 2025-02-18 21:33:39 -08:00 committed by Rushil Mehra
parent e6833b0074
commit 3b5fa65860
1 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
boring/src/ssl/mod.rs
View File

@ -1960,7 +1960,7 @@ impl SslContextBuilder {
/// threads. /// threads.
#[cfg(not(feature = "fips"))] #[cfg(not(feature = "fips"))]
#[corresponds(SSL_CTX_set1_ech_keys)] #[corresponds(SSL_CTX_set1_ech_keys)]
pub fn set_ech_keys(&mut self, keys: SslEchKeys) -> Result<(), ErrorStack> { pub fn set_ech_keys(&self, keys: SslEchKeys) -> Result<(), ErrorStack> {
unsafe { cvt(ffi::SSL_CTX_set1_ech_keys(self.as_ptr(), keys.as_ptr())).map(|_| ()) } unsafe { cvt(ffi::SSL_CTX_set1_ech_keys(self.as_ptr(), keys.as_ptr())).map(|_| ()) }
} }
@ -2210,6 +2210,16 @@ impl SslContextRef {
pub fn is_rpk(&self) -> bool { pub fn is_rpk(&self) -> bool {
self.ex_data(*RPK_FLAG_INDEX).copied().unwrap_or_default() self.ex_data(*RPK_FLAG_INDEX).copied().unwrap_or_default()
} }
/// Registers a list of ECH keys on the context. This list should contain new and old
/// ECHConfigs to allow stale DNS caches to update. Unlike most `SSL_CTX` APIs, this function
/// is safe to call even after the `SSL_CTX` has been associated with connections on various
/// threads.
#[cfg(not(feature = "fips"))]
#[corresponds(SSL_CTX_set1_ech_keys)]
pub fn set_ech_keys(&self, keys: SslEchKeys) -> Result<(), ErrorStack> {
unsafe { cvt(ffi::SSL_CTX_set1_ech_keys(self.as_ptr(), keys.as_ptr())).map(|_| ()) }
}
} }
/// Error returned by the callback to get a session when operation /// Error returned by the callback to get a session when operation