Repository navigation
impl(rest): use SSL_get_all_group_names() with BoringSSL - #16566
Merged
Merged
Conversation
Use BoringSSL's SSL_get_all_group_names() API directly to query supported TLS groups instead of probing candidate curves via SSL_CTX_set1_curves_list() and filtering EC_get_builtin_curves(). SSL_get_all_group_names() was added in the same BoringSSL commit (335523a2c456) as the SSL_GROUP_* macros, so we guard on defined(SSL_GROUP_SECP256R1). Older versions of BoringSSL predate X25519MLKEM768 support and return an empty list so default groups remain unchanged.
There was a problem hiding this comment.
Code Review
This pull request refactors the AvailableCryptoGroups function in ssl_ec_curves.cc to use SSL_get_all_group_names for newer BoringSSL versions, replacing the previous approach of probing candidate curves with a temporary SSL_CTX. It also simplifies preprocessor checks and removes the unused <array> header. The feedback suggests caching the retrieved crypto groups in static variables to avoid repeated heap allocations and library queries on every function call.
scotthart
approved these changes
Oct 14, 2026
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #16566 +/- ##
==========================================
+ Coverage 92.37% 92.39% +0.01%
==========================================
Files 2265 2265
Lines 219470 219457 -13
==========================================
+ Hits 202745 202770 +25
+ Misses 16725 16687 -38 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Simplifies how
AvailableCryptoGroups()queries supported TLS key-exchange groups when built with BoringSSL:SSL_get_all_group_names()function to get the list of supported TLS groups directly, replacing the previous workaround that combinedEC_get_builtin_curves()with trial-and-error calls toSSL_CTX_set1_curves_list().#if defined(SSL_GROUP_SECP256R1)to verify that the installed BoringSSL version is new enough to haveSSL_get_all_group_names()(both were added in the same BoringSSL commit).SSL_get_all_group_names(), returns an empty list so BoringSSL keeps its default TLS groups (those older versions predateX25519MLKEM768support anyway).