Skip to content

Project import generated by Copybara. #1529

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
juergw merged 1 commit into from
Aug 20, 2026
Merged

Project import generated by Copybara. #1529

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 4 additions & 6 deletions common/src/jni/main/cpp/conscrypt/native_crypto.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9033,8 +9033,7 @@ static SSL_SESSION* server_session_requested_callback(SSL* ssl, const uint8_t* i
return ssl_session_ptr;
}

static jint NativeCrypto_EVP_has_aes_hardware(JNIEnv* env, jclass) {
CHECK_ERROR_QUEUE_ON_RETURN;
static jint NativeCrypto_EVP_has_aes_hardware(CRITICAL_JNI_PARAMS) {
int ret = 0;
ret = EVP_has_aes_hardware();
JNI_TRACE("EVP_has_aes_hardware => %d", ret);
Expand Down Expand Up @@ -10512,9 +10511,8 @@ static jlong NativeCrypto_SSL_get_timeout(JNIEnv* env, jclass, jlong ssl_address
return result;
}

static jint NativeCrypto_SSL_get_signature_algorithm_key_type(JNIEnv* env, jclass,
static jint NativeCrypto_SSL_get_signature_algorithm_key_type(CRITICAL_JNI_PARAMS_COMMA
jint signatureAlg) {
CHECK_ERROR_QUEUE_ON_RETURN;
return SSL_get_signature_algorithm_key_type(signatureAlg);
}

Expand Down Expand Up @@ -11000,7 +10998,7 @@ static jint NativeCrypto_SSL_get_error(JNIEnv* env, jclass, jlong ssl_address,
return SSL_get_error(ssl, ret);
}

static void NativeCrypto_SSL_clear_error(JNIEnv*, jclass) {
static void NativeCrypto_SSL_clear_error(CRITICAL_JNI_PARAMS) {
ERR_clear_error();
}

Expand Down Expand Up @@ -11556,7 +11554,7 @@ static int NativeCrypto_ENGINE_SSL_write_direct(JNIEnv* env, jclass, jlong ssl_a
/**
* public static native bool usesBoringSsl_FIPS_mode();
*/
static jboolean NativeCrypto_usesBoringSsl_FIPS_mode() {
static jboolean NativeCrypto_usesBoringSsl_FIPS_mode(CRITICAL_JNI_PARAMS) {
return FIPS_mode();
}

Expand Down
8 changes: 8 additions & 0 deletions common/src/jni/main/include/conscrypt/jniutil.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,14 @@
namespace conscrypt {
namespace jniutil {

#if defined __ANDROID__ && !defined(CONSCRYPT_UNBUNDLED)
#define CRITICAL_JNI_PARAMS
#define CRITICAL_JNI_PARAMS_COMMA
#else
#define CRITICAL_JNI_PARAMS JNIEnv*, jclass
#define CRITICAL_JNI_PARAMS_COMMA JNIEnv*, jclass,
#endif

extern JavaVM* gJavaVM;
extern jclass cryptoUpcallsClass;
extern jclass openSslInputStreamClass;
Expand Down
8 changes: 5 additions & 3 deletions common/src/main/java/org/conscrypt/metrics/TlsEncryptedClientHelloHandshake.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,7 +138,7 @@
}

public static final class Builder {
private Result result = Result.UNKNOWN;

Check warning on line 141 in common/src/main/java/org/conscrypt/metrics/TlsEncryptedClientHelloHandshake.java

View workflow job for this annotation

GitHub Actions / build (macos-latest) 

[UnusedVariable] The field 'result' is never read.

Check warning on line 141 in common/src/main/java/org/conscrypt/metrics/TlsEncryptedClientHelloHandshake.java

View workflow job for this annotation

GitHub Actions / build (ubuntu-22.04) 

[UnusedVariable] The field 'result' is never read.
private EchOptions opts;
private FailureReason failureReason = FailureReason.UNKNOWN;
private NetworkSecurityPolicy policy;
Expand Down Expand Up @@ -212,12 +212,14 @@
}

if (policy.getDomainEncryptionMode("") == DomainEncryptionMode.OPPORTUNISTIC ||
policy.getDomainEncryptionMode(hostname) == DomainEncryptionMode.OPPORTUNISTIC) {
policy.getDomainEncryptionMode(hostname) == DomainEncryptionMode.OPPORTUNISTIC ||
policy.getDomainEncryptionMode("") == DomainEncryptionMode.ENABLED ||
policy.getDomainEncryptionMode(hostname) == DomainEncryptionMode.ENABLED) {
// ECH mode was default opportunistic for 26Q2, and default enabled for 26Q4 onwards
return UsageReason.DEFAULT;
}

return (policy.getDomainEncryptionMode("") == DomainEncryptionMode.ENABLED ||
policy.getDomainEncryptionMode("") == DomainEncryptionMode.REQUIRED)
return policy.getDomainEncryptionMode("") == DomainEncryptionMode.REQUIRED
? UsageReason.NSC_APP_OPT_IN
: UsageReason.NSC_DOMAIN_OPT_IN;
}
Expand Down
14 changes: 10 additions & 4 deletions common/src/test/java/org/conscrypt/SlhDsaTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -312,23 +312,29 @@ public void testVectors() throws Exception {
List<TestVector> vectors = TestUtils.readTestVectors("crypto/slhdsa.txt");

for (TestVector vector : vectors) {
String errMsg = vector.getString("name");
String algorithm = vector.getString("algorithm");
byte[] privateKey = vector.getBytes("private_key");
byte[] publicKey = vector.getBytes("public_key");
byte[] message = vector.getBytes("message");
byte[] signature = vector.getBytes("signature");

assertEquals(errMsg + ", algorithm:", "SLH-DSA-SHA2-128S", algorithm);
if (!algorithm.equals("SLH-DSA-SHA2-128S") && !algorithm.equals("SLH-DSA-SHA2-128S-WITH-SHA384")) {
throw new IllegalArgumentException("Unexpected algorithm: " + algorithm);
}

if (algorithm.equals("SLH-DSA-SHA2-128S-WITH-SHA384")) {
// not yet implemented.
continue;
}

KeyFactory keyFactory = KeyFactory.getInstance("SLH-DSA-SHA2-128S", conscryptProvider);

Signature signer = Signature.getInstance("SLH-DSA-SHA2-128S", conscryptProvider);
Signature signer = Signature.getInstance(algorithm, conscryptProvider);
signer.initSign(keyFactory.generatePrivate(new RawKeySpec(privateKey)));
signer.update(message);
byte[] sig = signer.sign();

Signature verifier = Signature.getInstance("SLH-DSA-SHA2-128S", conscryptProvider);
Signature verifier = Signature.getInstance(algorithm, conscryptProvider);
verifier.initVerify(keyFactory.generatePublic(new RawKeySpec(publicKey)));
verifier.update(message);
assertTrue(verifier.verify(sig));
Expand Down
11 changes: 8 additions & 3 deletions common/src/test/java/org/conscrypt/java/security/KeyPairGeneratorTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,9 +27,7 @@
// android-add: import libcore.test.reasons.NonMtsReasons;

import org.conscrypt.TestUtils;
import org.junit.ClassRule;
import org.junit.Test;
import org.junit.rules.TestRule;
import org.junit.runner.RunWith;
import org.junit.runners.JUnit4;

Expand All @@ -46,7 +44,6 @@
import java.security.Provider;
import java.security.PublicKey;
import java.security.SecureRandom;
import java.security.Security;
import java.security.interfaces.DSAParams;
import java.security.interfaces.DSAPrivateKey;
import java.security.interfaces.DSAPublicKey;
Expand Down Expand Up @@ -94,6 +91,14 @@ public void test_getInstance() throws Exception {
// provider, which doesn't exist on OpenJDK 7, and thus totally fails. This appears
// to be a bug introduced into later revisions of OpenJDK 7.
.skipProvider("SunPKCS11-NSS")
// Skip all composite signature algorithms that include "RSA3072" and "RSA4096",
// because they are very slow. It's enough to just test the "RSA2048" variants only.
.skipAlgorithm("MLDSA65-RSA3072-PSS-SHA512")
.skipAlgorithm("MLDSA65-RSA3072-PKCS15-SHA512")
.skipAlgorithm("MLDSA87-RSA3072-PSS-SHA512")
.skipAlgorithm("MLDSA65-RSA4096-PSS-SHA512")
.skipAlgorithm("MLDSA65-RSA4096-PKCS15-SHA512")
.skipAlgorithm("MLDSA87-RSA4096-PSS-SHA512")
.run(new ServiceTester.Test() {
@Override
// g3-add: @SuppressWarnings("InsecureCryptoUsage")
Expand Down
Loading
Loading