GitLab

am: 132c311d

* commit '132c311d':
  Revert "Add ExtendedSSLSession, et al."

This reverts commit 38d12ed4.

This breaks the unbundled build because of OpenSSLExtendedSessionImpl.

Change-Id: I73951a6f1d5cb14c70cd807c2c895bbbdc4c8e40

am: 38d12ed4

* commit '38d12ed4':
  Add ExtendedSSLSession, et al.

In order to support SNI certificate selection of the server-side and
enhanced certificate verification on the client side, we add
ExtendedSSLSession and the getHandshakeSession support.

This is just to set up for future implementations of SNI and
ExtendedX509TrustManager and doesn't actually implement the logic needed
to fully support the new features.

Change-Id: I300d3134d8ab9c184d6473183612dc53658a8221

am: 6f9dffd8

* commit '6f9dffd8':
  Add ChaCha20-Poly1305 as an enabled cipher suite

Change-Id: Idc143d37c63cf3436ccdddc22abcb11802fc6615

am: e06e7423

* commit 'e06e7423':
  Compare keys using encoded form as a fallback

PublicKey.equals is not required to return true on the same public key
but from different providers, this causes incorrect lookup failures when
the key comes from keystore.

Change-Id: Iaedaa91c64eeede1d5021430c015aac746afbc97

am: 45fad1a9

* commit '45fad1a9':
  Make OpenSSLX509Certificate.hashCode match the RI

Use super.hashCode to make sure that hashCode matches the RI. Since the
underlying certificate (and therefore the hashcode) is immutable the
value is cached after the first call to avoid needlessly recomputing the
hash.

Bug:26386620
Change-Id: Ic480b48e57144ac730a33dcc313cdff57fe71157

am: 4ddae91b

* commit '4ddae91b':

am: 7dc2b75e

* commit '7dc2b75e':

am: 87b44e33  -s ours

* commit '87b44e33':

am: d31ede7b

* commit 'd31ede7b':
  Get rid of AlgNameMapper

This was only a hack to support old Harmony code, so we don't need it
anymore. Remove the direct references to AlgNameMapper and use
reflection for compatibility in unbundled code.

Change-Id: I7ec14f19e5098ffe12592b79b2b163b41031b6e6

Prevent duplicate certificates in TrustedCertificateIndex am: 4c9f9c22 am: 1a86d309 am: 825390d5 am: 360cc576 am: 95de98f0
am: b84145b3

* commit 'b84145b3':
  Prevent duplicate certificates in TrustedCertificateIndex

Cache intermediate CA separately am: c4ab1b95 am: 2138a380 am: edac1314 am: 7e3bc71b am: b65bd711
am: e03c349a

* commit 'e03c349a':
  Cache intermediate CA separately

Prevent duplicate certificates in TrustedCertificateIndex am: 4c9f9c22 am: 1a86d309 am: 825390d5 am: 360cc576
am: 95de98f0

* commit '95de98f0':
  Prevent duplicate certificates in TrustedCertificateIndex

am: b65bd711

* commit 'b65bd711':
  Cache intermediate CA separately

Prevent duplicate certificates in TrustedCertificateIndex am: 4c9f9c22 am: 1a86d309 am: 825390d5
am: 360cc576

* commit '360cc576':
  Prevent duplicate certificates in TrustedCertificateIndex

am: 7e3bc71b

* commit '7e3bc71b':
  Cache intermediate CA separately

am: 825390d5

* commit '825390d5':
  Prevent duplicate certificates in TrustedCertificateIndex

am: edac1314

* commit 'edac1314':
  Cache intermediate CA separately

am: 1a86d309

* commit '1a86d309':
  Prevent duplicate certificates in TrustedCertificateIndex

am: 2138a380

* commit '2138a380':
  Cache intermediate CA separately

am: 4c9f9c22

* commit '4c9f9c22':
  Prevent duplicate certificates in TrustedCertificateIndex

am: c4ab1b95

* commit 'c4ab1b95':
  Cache intermediate CA separately

With the separate caching of intermediate certificates in
TrustManagerImpl a given intermediate may be passed into .index multiple
times. Avoid adding the certificate to the list each time.

(cherry-picked from commit d080e064)
Bug: 26232830
Change-Id: I6bed2c65d9e42e052b9b1b129200a997e7dca745

Intermediate CAs are cached in order to support servers that fail to
sent a complete chain to a root. These certificates should be cached to
support these servers but these certificates must not be trusted as
trust anchors. Store them separately to prevent confusion between
trusted roots and cached intermediates.

(cherry-picked from commit 198aca1f)
Bug: 26232830
Change-Id: I520f50729b55fc7412c7d133335bc9e3c190bbf6

The TrustManagerFactory is returning a RootTrustManager now instead of a TrustManagerImpl,
thus breaking the test.

Bug: 25992791
Change-Id: I5924b684a9c3f8c49818ceefb038886035a17f68

Note the null check was in fromEncoding(InputStream, String)
already.

Bug: 25926066
Change-Id: Ic4a0d514c6b8e6d8af349a8202f26854f6975cd6

This change sorts the list using sort(1).

Change-Id: Ief0c407969c92405464b9b2e9ebc694f98260263

In preparation for a new BoringSSL import, this change adds the strings
for the ChaCha20-Poly1305-based cipher suites, as specified in
draft-ietf-tls-chacha20-poly1305-04.

This change will cause the ciphers to be advertised via
|getSupportedCipherSuites| even though BoringSSL hasn't been
updated yet. This will be a transient flaw.

Change-Id: If633ebb10f74d9f5706ad87d49b40ee5183dae8f

get_SSL_CIPHER_algorithm_mkey and get_SSL_CIPHER_algorithm_auth are never used.
There are also some struct accesses that have public API variants. Finally,
requiring ssl->server be set to 0 before SSL_set1_tls_channel_id was a bug that
has been fixed in BoringSSL. (See
https://boringssl.googlesource.com/boringssl/+/a3d9de05fb6df2c0dffab83717139e6c71d3d329/ssl/s3_lib.c#337)

Change-Id: If68efce2901f3ef89bdf5bb47cbc7d5fddaa6ef6