TLS 1.3 cipher suite preference with BoringSSL
- Dominant language
- C++
- Stars
- 2k
- Forks
- 874
- Avg merge
- 6d 15h
- Merged PRs (30d)
- 46
Description
TLS 1.3 cipher suite preference was not configurable if ATS is built with BoringSS because of BoringSSL API limitation. They added API for it recently.
Changes on BoringSSL:
https://boringssl.googlesource.com/boringssl/+/0fd9b5f3e425b0c9fa11a3ee3f860c8055f79d73
https://boringssl.googlesource.com/boringssl/+/281fb6d844f8ef70c95ce9d3d599652cc2448292
https://github.com/apache/trafficserver/pull/11918 added notes about the limitation.
Contributor guide
Research direction
Start by reading the two linked BoringSSL commits and PR #11918's notes about the limitation. Then locate ATS's TLS 1.3 cipher-suite configuration and BoringSSL integration, and identify the existing TLS tests for cipher preferences. Done means TLS 1.3 cipher-suite preference is configurable when ATS is built with BoringSSL.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100