Merge remote-tracking branch 'upstream/master'

Author: 0x676e67

.github/workflows/ci.yml

@@ -65,6 +65,10 @@ jobs:
           key: clippy-target-${{ runner.os }}-${{ steps.rust-version.outputs.version }}-${{ hashFiles('Cargo.lock') }}
       - name: Run clippy
         run: cargo clippy --all --all-targets
+      - name: Check docs
+        run: cargo doc --no-deps -p boring -p boring-sys --features rpk,pq-experimental,underscore-wildcards
+        env:
+          DOCS_RS: 1
   test:
     name: Test
     runs-on: ${{ matrix.os }}

RELEASE_NOTES

@@ -1,3 +1,21 @@
+4.18.0
+- 2025-05-29 Add set_verify_param
+- 2025-05-28 Add support for X509_STORE_CTX_get0_untrusted
+- 2025-06-02 Add X509VerifyParamRef::copy_from (#361)
+- 2025-06-02 Fix X509VerifyContextRef::set_verify_param (#358)
+- 2025-06-02 Ensure we call X509_STORE_CTX_cleanup on error path too (#360)
+- 2025-06-02 Add mutable ex_data APIs for X509StoreContext
+- 2025-06-02 Add X509StoreContextRef::init_without_cleanup
+- 2025-06-04 Rename to reset_with_context_data
+- 2025-06-05 Avoid panicking in error handling
+- 2025-06-05 Don't unwrap when Result can be returned instead
+- 2025-06-04 Make X509Store shareable between contexts
+- 2025-06-05 Sprinkle #[must_use] (#368)
+- 2025-06-05 Expose SSL_set1_groups to Efficiently Set Curves on SSL Session (#346)
+- 2025-06-09 Upgrade bindgen to v0.72.0
+- 2025-06-13 Expose PKey::raw_{private,public}_key (#364)
+- 2025-06-10 Don't link binaries on docs.rs
+- 2025-06-11 Use cargo:warning for warnings
 
 4.17.0
 - 2025-05-27 Revert "feat(x509): Implement `Clone` for `X509Store` (#339)" (#353)

boring-sys/build/main.rs

@@ -468,6 +468,24 @@ fn get_extra_clang_args_for_bindgen(config: &Config) -> Vec<String> {
 }
 
 fn ensure_patches_applied(config: &Config) -> io::Result<()> {
+    if config.env.assume_patched || config.env.path.is_some() {
+        println!(
+            "cargo:warning=skipping git patches application, provided\
+            native BoringSSL is expected to have the patches included"
+        );
+        return Ok(());
+    } else if config.env.source_path.is_some()
+        && (config.features.rpk
+            || config.features.pq_experimental
+            || config.features.underscore_wildcards)
+    {
+        panic!(
+            "BORING_BSSL_ASSUME_PATCHED must be set when setting
+               BORING_BSSL_SOURCE_PATH and using any of the following
+               features: rpk, pq-experimental, underscore-wildcards"
+        );
+    }
+
     let mut lock_file = LockFile::open(&config.out_dir.join(".patch_lock"))?;
     let src_path = get_boringssl_source_path(config);
     let has_git = src_path.join(".git").exists();
@@ -551,25 +569,6 @@ fn built_boring_source_path(config: &Config) -> &PathBuf {
     static BUILD_SOURCE_PATH: OnceLock<PathBuf> = OnceLock::new();
 
     BUILD_SOURCE_PATH.get_or_init(|| {
-        if config.env.assume_patched {
-            println!(
-                "cargo:warning=skipping git patches application, provided\
-                native BoringSSL is expected to have the patches included"
-            );
-        } else if config.env.source_path.is_some()
-            && (config.features.rpk
-                || config.features.pq_experimental
-                || config.features.underscore_wildcards)
-        {
-            panic!(
-                "BORING_BSSL_ASSUME_PATCHED must be set when setting
-                   BORING_BSSL_SOURCE_PATH and using any of the following
-                   features: rpk, pq-experimental, underscore-wildcards"
-            );
-        } else {
-            ensure_patches_applied(config).unwrap();
-        }
-
         let mut cfg = get_boringssl_cmake_config(config);
 
         let num_jobs = std::env::var("NUM_JOBS").ok().or_else(|| {
@@ -660,6 +659,7 @@ fn get_cpp_runtime_lib(config: &Config) -> Option<String> {
 
 fn main() {
     let config = Config::from_env();
+    ensure_patches_applied(&config).unwrap();
     if !config.env.docs_rs {
         emit_link_directives(&config);
     }

boring-sys/src/lib.rs

@@ -20,6 +20,7 @@ use std::os::raw::{c_char, c_int, c_uint, c_ulong};
     clippy::useless_transmute,
     clippy::derive_partial_eq_without_eq,
     clippy::ptr_offset_with_cast,
+    unpredictable_function_pointer_comparisons, // TODO: remove Eq/PartialEq in v5
     dead_code
 )]
 mod generated {

boring/src/derive.rs

@@ -51,7 +51,6 @@ impl<'a> Deriver<'a> {
     ///
     /// It can be used to size the buffer passed to [`Deriver::derive`].
     #[corresponds(EVP_PKEY_derive)]
-    /// [`EVP_PKEY_derive`]: https://www.openssl.org/docs/man1.0.2/crypto/EVP_PKEY_derive_init.html
     pub fn len(&mut self) -> Result<usize, ErrorStack> {
         unsafe {
             let mut len = 0;

boring/src/error.rs

@@ -15,7 +15,8 @@
 //!     Err(e) => println!("Parsing Error: {:?}", e),
 //! }
 //! ```
-use libc::{c_char, c_uint};
+use libc::{c_char, c_int, c_uint};
+use openssl_macros::corresponds;
 use std::borrow::Cow;
 use std::error;
 use std::ffi::CStr;
@@ -34,7 +35,8 @@ pub struct ErrorStack(Vec<Error>);
 
 impl ErrorStack {
     /// Pops the contents of the OpenSSL error stack, and returns it.
-    #[allow(clippy::must_use_candidate)]
+    #[corresponds(ERR_get_error_line_data)]
+    #[must_use = "Use ErrorStack::clear() to drop the error stack"]
     pub fn get() -> ErrorStack {
         let mut vec = vec![];
         while let Some(err) = Error::get() {
@@ -44,6 +46,7 @@ impl ErrorStack {
     }
 
     /// Pushes the errors back onto the OpenSSL error stack.
+    #[corresponds(ERR_put_error)]
     pub fn put(&self) {
         for error in self.errors() {
             error.put();
@@ -55,6 +58,14 @@ impl ErrorStack {
     pub(crate) fn internal_error(err: impl error::Error) -> Self {
         Self(vec![Error::new_internal(err.to_string())])
     }
+
+    /// Empties the current thread's error queue.
+    #[corresponds(ERR_clear_error)]
+    pub(crate) fn clear() {
+        unsafe {
+            ffi::ERR_clear_error();
+        }
+    }
 }
 
 impl ErrorStack {
@@ -80,7 +91,9 @@ impl fmt::Display for ErrorStack {
             write!(
                 fmt,
                 "[{}]",
-                err.reason_internal().unwrap_or("unknown reason")
+                err.reason_internal()
+                    .or_else(|| err.library())
+                    .unwrap_or("unknown reason")
             )?;
         }
         Ok(())
@@ -101,7 +114,7 @@ impl From<ErrorStack> for fmt::Error {
     }
 }
 
-/// An error reported from OpenSSL.
+/// A detailed error reported as part of an [`ErrorStack`].
 #[derive(Clone)]
 pub struct Error {
     code: c_uint,
@@ -117,7 +130,8 @@ static BORING_INTERNAL: &CStr = c"boring-rust";
 
 impl Error {
     /// Pops the first error off the OpenSSL error stack.
-    #[allow(clippy::must_use_candidate)]
+    #[must_use = "Use ErrorStack::clear() to drop the error stack"]
+    #[corresponds(ERR_get_error_line_data)]
     pub fn get() -> Option<Error> {
         unsafe {
             ffi::init();
@@ -150,6 +164,7 @@ impl Error {
     }
 
     /// Pushes the error back onto the OpenSSL error stack.
+    #[corresponds(ERR_put_error)]
     pub fn put(&self) {
         unsafe {
             ffi::ERR_put_error(
@@ -179,7 +194,10 @@ impl Error {
         }
     }
 
-    /// Returns the raw OpenSSL error code for this error.
+    /// Returns a raw OpenSSL **packed** error code for this error, which **can't be reliably compared to any error constant**.
+    ///
+    /// Use [`Error::library_code()`] and [`Error::reason_code()`] instead.
+    /// Packed error codes are different than [SSL error codes](crate::ssl::ErrorCode).
     #[must_use]
     pub fn code(&self) -> c_uint {
         self.code
@@ -201,27 +219,17 @@ impl Error {
         }
     }
 
-    /// Returns the raw OpenSSL error constant for the library reporting the
-    /// error.
+    /// Returns the raw OpenSSL error constant for the library reporting the error (`ERR_LIB_{name}`).
+    ///
+    /// Error [reason codes](Error::reason_code) are not globally unique, but scoped to each library.
     #[must_use]
-    pub fn library_code(&self) -> libc::c_int {
+    pub fn library_code(&self) -> c_int {
         ffi::ERR_GET_LIB(self.code)
     }
 
-    /// Returns the name of the function reporting the error.
-    #[must_use]
+    /// Returns `None`. Boring doesn't use function codes.
     pub fn function(&self) -> Option<&'static str> {
-        if self.is_internal() {
-            return None;
-        }
-        unsafe {
-            let cstr = ffi::ERR_func_error_string(self.code);
-            if cstr.is_null() {
-                return None;
-            }
-            let bytes = CStr::from_ptr(cstr as *const _).to_bytes();
-            str::from_utf8(bytes).ok()
-        }
+        None
     }
 
     /// Returns the reason for the error.
@@ -237,9 +245,14 @@ impl Error {
         }
     }
 
-    /// Returns the raw OpenSSL error constant for the reason for the error.
+    /// Returns [library-specific](Error::library_code) reason code corresponding to some of the `{lib}_R_{reason}` constants.
+    ///
+    /// Reason codes are ambiguous, and different libraries reuse the same numeric values for different errors.
+    ///
+    /// For `ERR_LIB_SYS` the reason code is `errno`. `ERR_LIB_USER` can use any values.
+    /// Other libraries may use [`ERR_R_*`](ffi::ERR_R_FATAL) or their own codes.
     #[must_use]
-    pub fn reason_code(&self) -> libc::c_int {
+    pub fn reason_code(&self) -> c_int {
         ffi::ERR_GET_REASON(self.code)
     }
 
@@ -256,6 +269,8 @@ impl Error {
     }
 
     /// Returns the line in the source file which encountered the error.
+    ///
+    /// 0 if unknown
     #[allow(clippy::unnecessary_cast)]
     #[must_use]
     pub fn line(&self) -> u32 {
@@ -294,20 +309,19 @@ impl Error {
 impl fmt::Debug for Error {
     fn fmt(&self, fmt: &mut fmt::Formatter) -> fmt::Result {
         let mut builder = fmt.debug_struct("Error");
-        builder.field("code", &self.code());
-        if let Some(library) = self.library() {
-            builder.field("library", &library);
-        }
-        builder.field("library_code", &self.library_code());
-        if let Some(function) = self.function() {
-            builder.field("function", &function);
-        }
-        if let Some(reason) = self.reason() {
-            builder.field("reason", &reason);
+        builder.field("code", &self.code);
+        if !self.is_internal() {
+            if let Some(library) = self.library() {
+                builder.field("library", &library);
+            }
+            builder.field("library_code", &self.library_code());
+            if let Some(reason) = self.reason() {
+                builder.field("reason", &reason);
+            }
+            builder.field("reason_code", &self.reason_code());
+            builder.field("file", &self.file());
+            builder.field("line", &self.line());
         }
-        builder.field("reason_code", &self.reason_code());
-        builder.field("file", &self.file());
-        builder.field("line", &self.line());
         if let Some(data) = self.data() {
             builder.field("data", &data);
         }
@@ -321,7 +335,7 @@ impl fmt::Display for Error {
             fmt,
             "{}\n\nCode: {:08X}\nLoc: {}:{}",
             self.reason_internal().unwrap_or("unknown TLS error"),
-            self.code(),
+            &self.code,
             self.file(),
             self.line()
         )

boring/src/rsa.rs

@@ -413,7 +413,6 @@ impl Rsa<Public> {
     /// `n` is the modulus common to both public and private key.
     /// `e` is the public exponent.
     #[corresponds(RSA_new)]
-    /// [`RSA_set0_key`]: https://www.openssl.org/docs/man1.1.0/crypto/RSA_set0_key.html
     pub fn from_public_components(n: BigNum, e: BigNum) -> Result<Rsa<Public>, ErrorStack> {
         unsafe {
             let rsa = cvt_p(ffi::RSA_new())?;
@@ -472,7 +471,6 @@ impl RsaPrivateKeyBuilder {
     /// `n` is the modulus common to both public and private key.
     /// `e` is the public exponent and `d` is the private exponent.
     #[corresponds(RSA_new)]
-    /// [`RSA_set0_key`]: https://www.openssl.org/docs/man1.1.0/crypto/RSA_set0_key.html
     pub fn new(n: BigNum, e: BigNum, d: BigNum) -> Result<RsaPrivateKeyBuilder, ErrorStack> {
         unsafe {
             let rsa = cvt_p(ffi::RSA_new())?;

boring/src/sign.rs

@@ -478,7 +478,7 @@ impl<'a> Verifier<'a> {
             match r {
                 1 => Ok(true),
                 0 => {
-                    ErrorStack::get(); // discard error stack
+                    ErrorStack::clear(); // discard error stack
                     Ok(false)
                 }
                 _ => Err(ErrorStack::get()),
@@ -500,7 +500,7 @@ impl<'a> Verifier<'a> {
             match r {
                 1 => Ok(true),
                 0 => {
-                    ErrorStack::get();
+                    ErrorStack::clear();
                     Ok(false)
                 }
                 _ => Err(ErrorStack::get()),

boring/src/ssl/async_callbacks.rs

@@ -11,7 +11,7 @@ use std::pin::Pin;
 use std::sync::LazyLock;
 use std::task::{ready, Context, Poll, Waker};
 
-/// The type of futures to pass to [`SslContextBuilderExt::set_async_select_certificate_callback`].
+/// The type of futures to pass to [`SslContextBuilder::set_async_select_certificate_callback`].
 pub type BoxSelectCertFuture = ExDataFuture<Result<BoxSelectCertFinish, AsyncSelectCertError>>;
 
 /// The type of callbacks returned by [`BoxSelectCertFuture`] methods.
@@ -25,19 +25,19 @@ pub type BoxPrivateKeyMethodFuture =
 pub type BoxPrivateKeyMethodFinish =
     Box<dyn FnOnce(&mut SslRef, &mut [u8]) -> Result<usize, AsyncPrivateKeyMethodError>>;
 
-/// The type of futures to pass to [`SslContextBuilderExt::set_async_get_session_callback`].
+/// The type of futures to pass to [`SslContextBuilder::set_async_get_session_callback`].
 pub type BoxGetSessionFuture = ExDataFuture<Option<BoxGetSessionFinish>>;
 
 /// The type of callbacks returned by [`BoxSelectCertFuture`] methods.
 pub type BoxGetSessionFinish = Box<dyn FnOnce(&mut SslRef, &[u8]) -> Option<SslSession>>;
 
-/// The type of futures to pass to [`SslContextBuilderExt::set_async_custom_verify_callback`].
+/// The type of futures to pass to [`SslContextBuilder::set_async_custom_verify_callback`].
 pub type BoxCustomVerifyFuture = ExDataFuture<Result<BoxCustomVerifyFinish, SslAlert>>;
 
 /// The type of callbacks returned by [`BoxCustomVerifyFuture`] methods.
 pub type BoxCustomVerifyFinish = Box<dyn FnOnce(&mut SslRef) -> Result<(), SslAlert>>;
 
-/// Convenience alias for futures stored in [`Ssl`] ex data by [`SslContextBuilderExt`] methods.
+/// Convenience alias for futures stored in [`Ssl`] ex data by [`SslContextBuilder`] methods.
 ///
 /// Public for documentation purposes.
 pub type ExDataFuture<T> = Pin<Box<dyn Future<Output = T> + Send>>;
@@ -123,7 +123,7 @@ impl SslContextBuilder {
     ///
     /// # Safety
     ///
-    /// The returned [`SslSession`] must not be associated with a different [`SslContext`].
+    /// The returned [`SslSession`] must not be associated with a different [`SslContextBuilder`].
     pub unsafe fn set_async_get_session_callback<F>(&mut self, callback: F)
     where
         F: Fn(&mut SslRef, &[u8]) -> Option<BoxGetSessionFuture> + Send + Sync + 'static,