diff --git a/RELEASE_NOTES b/RELEASE_NOTES index bb0372b92..235d64691 100644 --- a/RELEASE_NOTES +++ b/RELEASE_NOTES @@ -1,3 +1,16 @@ +5.3.0 +- 2026-10-14 Add action-aware certificate selection callbacks +- 2026-10-14 Back-compat shims for v4 +- 2026-10-14 Add X509Ref::check_host_with_flags (fixes #530) +- 2026-10-09 boring-sys: exclude non-BoringSSL symbols from bindings +- 2026-09-30 Fix tests failures related to upstream X509_V_FLAG_TRUSTED_FIRST change +- 2026-09-30 Update to boringssl 0.20260929.0 +- 2026-08-28 RTG-5132 Enable X25519MLKEM768 in FIPS compliance profile +- 2026-08-20 RTG-5132 Bump BoringSSL +- 2026-09-22 Add native HKDF bindings +- 2026-08-14 Semver compat for nonce mutability issue +- 2026-06-25 aead: require &mut self for seal/open and add TLS AEAD variants + 5.2.0 - 2026-10-14 Add action-aware certificate selection callbacks, including ECH fallback - 2026-05-21 Export `DEP_BORINGSSL_VERSION_MAJOR` var diff --git a/boring/src/asn1.rs b/boring/src/asn1.rs index 8acc2c40e..8e432e831 100644 --- a/boring/src/asn1.rs +++ b/boring/src/asn1.rs @@ -62,7 +62,7 @@ foreign_type_and_impl_send_sync! { } impl fmt::Display for Asn1GeneralizedTimeRef { - fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result { + fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { let bio = MemBio::new().ok(); let msg = bio .as_ref() @@ -261,7 +261,7 @@ impl PartialOrd for &Asn1TimeRef { } impl fmt::Display for Asn1TimeRef { - fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result { + fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { unsafe { let mem_bio = match MemBio::new() { Err(_) => return f.write_str("error"), @@ -270,14 +270,14 @@ impl fmt::Display for Asn1TimeRef { let print_result = cvt(ffi::ASN1_TIME_print(mem_bio.as_ptr(), self.as_ptr())); match print_result { Err(_) => f.write_str("error"), - Ok(_) => f.write_str(str::from_utf8_unchecked(mem_bio.get_buf())), + Ok(()) => f.write_str(str::from_utf8_unchecked(mem_bio.get_buf())), } } } } impl fmt::Debug for Asn1TimeRef { - fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result { + fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { fmt::Display::fmt(self, f) } } @@ -439,7 +439,7 @@ impl Asn1StringRef { } impl fmt::Debug for Asn1StringRef { - fn fmt(&self, fmt: &mut fmt::Formatter) -> fmt::Result { + fn fmt(&self, fmt: &mut fmt::Formatter<'_>) -> fmt::Result { match self.as_utf8() { Ok(openssl_string) => openssl_string.fmt(fmt), Err(_) => fmt.write_str("error"), @@ -606,7 +606,7 @@ impl Asn1ObjectRef { } impl fmt::Display for Asn1ObjectRef { - fn fmt(&self, fmt: &mut fmt::Formatter) -> fmt::Result { + fn fmt(&self, fmt: &mut fmt::Formatter<'_>) -> fmt::Result { unsafe { let mut buf = [0u8; 80]; let len = ffi::OBJ_obj2txt( @@ -625,7 +625,7 @@ impl fmt::Display for Asn1ObjectRef { } impl fmt::Debug for Asn1ObjectRef { - fn fmt(&self, fmt: &mut fmt::Formatter) -> fmt::Result { + fn fmt(&self, fmt: &mut fmt::Formatter<'_>) -> fmt::Result { fmt::Display::fmt(self, fmt) } } diff --git a/boring/src/ssl/mod.rs b/boring/src/ssl/mod.rs index 62eee9f90..e0f358d6e 100644 --- a/boring/src/ssl/mod.rs +++ b/boring/src/ssl/mod.rs @@ -1199,7 +1199,7 @@ impl SslContextBuilder { self.ctx.replace_ex_data(callback_index, callback); let callback = self.ctx.ex_data(callback_index).unwrap(); - let arg = std::ptr::from_ref(callback).cast_mut().cast(); + let arg = ptr::from_ref(callback).cast_mut().cast(); ffi::SSL_CTX_set_tlsext_servername_arg(self.as_ptr(), arg); ffi::SSL_CTX_set_tlsext_servername_callback(self.as_ptr(), Some(raw_sni::)); } @@ -4763,20 +4763,20 @@ pub trait CertificateCompressor: Send + Sync + 'static { /// Perform compression of `input` buffer and write compressed data to `output`. #[allow(unused_variables)] - fn compress(&self, input: &[u8], output: &mut W) -> std::io::Result<()> + fn compress(&self, input: &[u8], output: &mut W) -> io::Result<()> where - W: std::io::Write, + W: Write, { - Err(std::io::Error::other("not implemented")) + Err(io::Error::other("not implemented")) } /// Perform decompression of `input` buffer and write compressed data to `output`. #[allow(unused_variables)] - fn decompress(&self, input: &[u8], output: &mut W) -> std::io::Result<()> + fn decompress(&self, input: &[u8], output: &mut W) -> io::Result<()> where - W: std::io::Write, + W: Write, { - Err(std::io::Error::other("not implemented")) + Err(io::Error::other("not implemented")) } } diff --git a/boring/src/ssl/test/mod.rs b/boring/src/ssl/test/mod.rs index 3e5fed9e4..4ee5d0aef 100644 --- a/boring/src/ssl/test/mod.rs +++ b/boring/src/ssl/test/mod.rs @@ -467,7 +467,7 @@ fn test_select_cert_disable_ech_without_ech_fails() { #[test] fn test_select_cert_unknown_extension() { let mut server = Server::builder(); - let unknown_extension = std::sync::Arc::new(std::sync::Mutex::new(Some(vec![]))); + let unknown_extension = Arc::new(std::sync::Mutex::new(Some(vec![]))); server.ctx().set_select_certificate_callback({ let unknown = unknown_extension.clone(); @@ -491,7 +491,7 @@ fn test_select_cert_unknown_extension() { #[test] fn test_select_cert_alpn_extension() { let mut server = Server::builder(); - let alpn_extension = std::sync::Arc::new(std::sync::Mutex::new(None)); + let alpn_extension = Arc::new(std::sync::Mutex::new(None)); server.ctx().set_select_certificate_callback({ let alpn = alpn_extension.clone(); move |client_hello| { @@ -1390,7 +1390,7 @@ fn peer_signature_algorithm_mtls_server_sees_client() { // Observe from a server-side HANDSHAKE_DONE info callback so the capture // happens synchronously during the server's accept, before the client's // connect() returns. - let captured = std::sync::Arc::new(AtomicBool::new(false)); + let captured = Arc::new(AtomicBool::new(false)); let mut server_builder = Server::builder(); { @@ -1401,7 +1401,7 @@ fn peer_signature_algorithm_mtls_server_sees_client() { .set_verify_cert_store(store.build()) .unwrap(); server_builder.ctx().set_verify(SslVerifyMode::PEER); - let captured_cb = std::sync::Arc::clone(&captured); + let captured_cb = Arc::clone(&captured); server_builder .ctx() .set_info_callback(move |ssl, mode, _value| { @@ -1436,11 +1436,11 @@ fn peer_signature_algorithm_mtls_server_sees_client() { fn signature_algorithm_used_server_default() { // BoringSSL only retains signature_algorithm_used during the handshake, so we // capture it from a HANDSHAKE_DONE info callback. - let captured = std::sync::Arc::new(AtomicBool::new(false)); + let captured = Arc::new(AtomicBool::new(false)); let mut server_builder = Server::builder(); { - let captured_cb = std::sync::Arc::clone(&captured); + let captured_cb = Arc::clone(&captured); server_builder .ctx() .set_info_callback(move |ssl, mode, _value| { @@ -1489,8 +1489,8 @@ fn signature_algorithm_used_mtls_client() { } let server = server_builder.build(); - let captured = std::sync::Arc::new(AtomicBool::new(false)); - let captured_cb = std::sync::Arc::clone(&captured); + let captured = Arc::new(AtomicBool::new(false)); + let captured_cb = Arc::clone(&captured); let mut client_builder = server.client_with_root_ca(); client_builder diff --git a/hyper-boring/src/lib.rs b/hyper-boring/src/lib.rs index c43d48456..fa262a3d2 100644 --- a/hyper-boring/src/lib.rs +++ b/hyper-boring/src/lib.rs @@ -15,8 +15,9 @@ mod v1; pub use self::v1::*; fn key_index() -> Result, ErrorStack> { - static IDX: LazyLock> = LazyLock::new(|| Ssl::new_ex_index().unwrap()); - Ok(*IDX) + static IDX: LazyLock, ErrorStack>> = + LazyLock::new(Ssl::new_ex_index); + IDX.clone() } /// Settings for [`HttpsLayer`] diff --git a/tokio-boring/examples/simple-async.rs b/tokio-boring/examples/simple-async.rs index c51368bd1..d75fcedab 100644 --- a/tokio-boring/examples/simple-async.rs +++ b/tokio-boring/examples/simple-async.rs @@ -7,7 +7,7 @@ async fn main() -> anyhow::Result<()> { let (tcp_stream, _addr) = listener.accept().await?; let server = ssl::SslMethod::tls(); - let mut ssl_builder = boring::ssl::SslAcceptor::mozilla_modern(server)?; + let mut ssl_builder = ssl::SslAcceptor::mozilla_modern(server)?; ssl_builder.set_default_verify_paths()?; ssl_builder.set_verify(ssl::SslVerifyMode::PEER); let acceptor = ssl_builder.build(); diff --git a/tokio-boring/src/lib.rs b/tokio-boring/src/lib.rs index b5ebe0c2b..42ca7588c 100644 --- a/tokio-boring/src/lib.rs +++ b/tokio-boring/src/lib.rs @@ -203,7 +203,7 @@ where fn poll_read( mut self: Pin<&mut Self>, ctx: &mut Context<'_>, - buf: &mut ReadBuf, + buf: &mut ReadBuf<'_>, ) -> Poll> { self.run_in_context(ctx, |s| { // SAFETY: read_uninit does not de-initialize the buffer. @@ -227,17 +227,17 @@ where { fn poll_write( mut self: Pin<&mut Self>, - ctx: &mut Context, + ctx: &mut Context<'_>, buf: &[u8], ) -> Poll> { self.run_in_context(ctx, |s| cvt(s.write(buf))) } - fn poll_flush(mut self: Pin<&mut Self>, ctx: &mut Context) -> Poll> { + fn poll_flush(mut self: Pin<&mut Self>, ctx: &mut Context<'_>) -> Poll> { self.run_in_context(ctx, |s| cvt(s.flush())) } - fn poll_shutdown(mut self: Pin<&mut Self>, ctx: &mut Context) -> Poll> { + fn poll_shutdown(mut self: Pin<&mut Self>, ctx: &mut Context<'_>) -> Poll> { match self.run_in_context(ctx, |s| s.shutdown()) { Ok(ShutdownResult::Sent | ShutdownResult::Received) => {} Err(ref e) if e.code() == ErrorCode::ZERO_RETURN => {}