grpc 1.38.0 → 1.39.0.pre1

Sign up to get free protection for your applications and to get access to all the features.

Potentially problematic release.


This version of grpc might be problematic. Click here for more details.

Files changed (199) hide show
  1. checksums.yaml +4 -4
  2. data/Makefile +50 -19
  3. data/include/grpc/event_engine/endpoint_config.h +48 -0
  4. data/include/grpc/event_engine/event_engine.h +13 -15
  5. data/include/grpc/event_engine/port.h +2 -0
  6. data/include/grpc/event_engine/slice_allocator.h +17 -7
  7. data/include/grpc/grpc.h +9 -2
  8. data/include/grpc/grpc_security.h +32 -0
  9. data/include/grpc/grpc_security_constants.h +1 -0
  10. data/include/grpc/impl/codegen/grpc_types.h +17 -13
  11. data/include/grpc/impl/codegen/port_platform.h +17 -0
  12. data/src/core/ext/filters/client_channel/client_channel.cc +2 -2
  13. data/src/core/ext/filters/client_channel/health/health_check_client.cc +2 -0
  14. data/src/core/ext/filters/client_channel/health/health_check_client.h +3 -3
  15. data/src/core/ext/filters/client_channel/http_proxy.cc +16 -1
  16. data/src/core/ext/filters/client_channel/lb_policy/ring_hash/ring_hash.cc +755 -0
  17. data/src/core/ext/filters/client_channel/lb_policy/ring_hash/ring_hash.h +10 -0
  18. data/src/core/ext/filters/client_channel/lb_policy/xds/cds.cc +10 -24
  19. data/src/core/ext/filters/client_channel/lb_policy/xds/xds_cluster_resolver.cc +63 -95
  20. data/src/core/ext/filters/client_channel/resolver/dns/c_ares/dns_resolver_ares.cc +1 -3
  21. data/src/core/ext/filters/client_channel/resolver/dns/c_ares/grpc_ares_ev_driver_event_engine.cc +31 -0
  22. data/src/core/ext/filters/client_channel/resolver/dns/c_ares/grpc_ares_wrapper_event_engine.cc +28 -0
  23. data/src/core/ext/filters/client_channel/resolver/dns/native/dns_resolver.cc +1 -3
  24. data/src/core/ext/filters/client_channel/resolver/google_c2p/google_c2p_resolver.cc +7 -2
  25. data/src/core/ext/filters/client_channel/resolver/xds/xds_resolver.cc +15 -3
  26. data/src/core/ext/filters/client_channel/retry_filter.cc +665 -404
  27. data/src/core/ext/filters/client_channel/retry_service_config.cc +43 -24
  28. data/src/core/ext/filters/client_channel/retry_service_config.h +8 -2
  29. data/src/core/ext/filters/client_idle/client_idle_filter.cc +1 -1
  30. data/src/core/ext/filters/fault_injection/fault_injection_filter.cc +6 -0
  31. data/src/core/ext/transport/chttp2/client/insecure/channel_create_posix.cc +2 -1
  32. data/src/core/ext/transport/chttp2/server/insecure/server_chttp2_posix.cc +3 -2
  33. data/src/core/ext/transport/chttp2/transport/chttp2_transport.cc +10 -4
  34. data/src/core/ext/transport/chttp2/transport/internal.h +1 -0
  35. data/src/core/ext/transport/chttp2/transport/parsing.cc +2 -2
  36. data/src/core/ext/transport/inproc/inproc_transport.cc +42 -31
  37. data/src/core/ext/xds/xds_api.cc +247 -106
  38. data/src/core/ext/xds/xds_api.h +15 -6
  39. data/src/core/lib/address_utils/sockaddr_utils.cc +13 -0
  40. data/src/core/lib/address_utils/sockaddr_utils.h +10 -0
  41. data/src/core/lib/channel/channelz.h +3 -0
  42. data/src/core/lib/event_engine/endpoint_config.cc +46 -0
  43. data/src/core/lib/event_engine/endpoint_config_internal.h +42 -0
  44. data/src/core/lib/event_engine/event_engine.cc +50 -0
  45. data/src/core/lib/event_engine/slice_allocator.cc +33 -3
  46. data/src/core/lib/event_engine/sockaddr.cc +14 -12
  47. data/src/core/lib/event_engine/sockaddr.h +44 -0
  48. data/src/core/lib/gpr/wrap_memcpy.cc +2 -1
  49. data/src/core/lib/gprpp/status_helper.h +3 -0
  50. data/src/core/lib/iomgr/endpoint_pair_event_engine.cc +33 -0
  51. data/src/core/lib/iomgr/error.cc +5 -4
  52. data/src/core/lib/iomgr/error.h +1 -1
  53. data/src/core/lib/iomgr/event_engine/closure.cc +54 -0
  54. data/src/core/lib/iomgr/event_engine/closure.h +33 -0
  55. data/src/core/lib/iomgr/event_engine/endpoint.cc +194 -0
  56. data/src/core/lib/iomgr/event_engine/endpoint.h +53 -0
  57. data/src/core/lib/iomgr/event_engine/iomgr.cc +105 -0
  58. data/src/core/lib/iomgr/event_engine/iomgr.h +24 -0
  59. data/src/core/lib/iomgr/event_engine/pollset.cc +87 -0
  60. data/{include/grpc/event_engine/channel_args.h → src/core/lib/iomgr/event_engine/pollset.h} +7 -10
  61. data/src/core/lib/iomgr/event_engine/promise.h +51 -0
  62. data/src/core/lib/iomgr/event_engine/resolved_address_internal.cc +41 -0
  63. data/src/core/lib/iomgr/event_engine/resolved_address_internal.h +35 -0
  64. data/src/core/lib/iomgr/event_engine/resolver.cc +110 -0
  65. data/src/core/lib/iomgr/event_engine/tcp.cc +243 -0
  66. data/src/core/lib/iomgr/event_engine/timer.cc +57 -0
  67. data/src/core/lib/iomgr/exec_ctx.cc +8 -0
  68. data/src/core/lib/iomgr/exec_ctx.h +3 -4
  69. data/src/core/lib/iomgr/executor/threadpool.cc +2 -3
  70. data/src/core/lib/iomgr/executor/threadpool.h +2 -2
  71. data/src/core/lib/iomgr/iomgr.cc +1 -1
  72. data/src/core/lib/iomgr/iomgr_posix.cc +2 -0
  73. data/src/core/lib/iomgr/iomgr_posix_cfstream.cc +40 -10
  74. data/src/core/lib/iomgr/pollset_custom.cc +2 -2
  75. data/src/core/lib/iomgr/pollset_custom.h +3 -1
  76. data/src/core/lib/iomgr/pollset_uv.cc +3 -1
  77. data/src/core/lib/iomgr/pollset_uv.h +5 -1
  78. data/src/core/lib/iomgr/port.h +7 -5
  79. data/src/core/lib/iomgr/resolve_address.cc +5 -1
  80. data/src/core/lib/iomgr/resolve_address.h +6 -0
  81. data/src/core/lib/iomgr/sockaddr.h +1 -0
  82. data/src/core/lib/iomgr/socket_mutator.cc +15 -2
  83. data/src/core/lib/iomgr/socket_mutator.h +26 -2
  84. data/src/core/lib/iomgr/socket_utils_common_posix.cc +4 -4
  85. data/src/core/lib/iomgr/socket_utils_posix.h +2 -2
  86. data/src/core/lib/iomgr/tcp_client_posix.cc +7 -2
  87. data/src/core/lib/iomgr/tcp_posix.cc +42 -39
  88. data/src/core/lib/iomgr/tcp_posix.h +8 -0
  89. data/src/core/lib/iomgr/tcp_server_custom.cc +3 -4
  90. data/src/core/lib/iomgr/tcp_server_posix.cc +6 -0
  91. data/src/core/lib/iomgr/tcp_server_utils_posix_common.cc +2 -1
  92. data/src/core/lib/iomgr/timer.h +6 -1
  93. data/src/core/lib/security/authorization/authorization_engine.h +44 -0
  94. data/src/core/lib/security/authorization/authorization_policy_provider.h +32 -0
  95. data/src/core/lib/security/authorization/authorization_policy_provider_vtable.cc +46 -0
  96. data/src/core/lib/security/authorization/evaluate_args.cc +209 -0
  97. data/src/core/lib/security/authorization/evaluate_args.h +91 -0
  98. data/src/core/lib/security/credentials/google_default/google_default_credentials.cc +3 -1
  99. data/src/core/lib/security/credentials/tls/tls_utils.cc +32 -0
  100. data/src/core/lib/security/credentials/tls/tls_utils.h +13 -0
  101. data/src/core/lib/security/security_connector/local/local_security_connector.cc +9 -6
  102. data/src/core/lib/security/security_connector/ssl_utils.cc +5 -0
  103. data/src/core/lib/surface/call.cc +21 -1
  104. data/src/core/lib/surface/call.h +11 -0
  105. data/src/core/lib/surface/completion_queue.cc +22 -22
  106. data/src/core/lib/surface/completion_queue.h +1 -1
  107. data/src/core/lib/surface/completion_queue_factory.cc +1 -2
  108. data/src/core/lib/surface/init.cc +1 -3
  109. data/src/core/lib/surface/init.h +10 -1
  110. data/src/core/lib/surface/version.cc +1 -1
  111. data/src/core/lib/transport/error_utils.cc +2 -2
  112. data/src/core/lib/transport/transport.h +2 -0
  113. data/src/core/lib/transport/transport_op_string.cc +1 -1
  114. data/src/core/plugin_registry/grpc_plugin_registry.cc +4 -0
  115. data/src/core/tsi/alts/crypt/gsec.h +2 -0
  116. data/src/ruby/ext/grpc/extconf.rb +2 -0
  117. data/src/ruby/ext/grpc/rb_grpc_imports.generated.c +6 -0
  118. data/src/ruby/ext/grpc/rb_grpc_imports.generated.h +10 -1
  119. data/src/ruby/lib/grpc/version.rb +1 -1
  120. data/third_party/boringssl-with-bazel/err_data.c +269 -263
  121. data/third_party/boringssl-with-bazel/src/crypto/asn1/a_object.c +8 -6
  122. data/third_party/boringssl-with-bazel/src/crypto/cipher_extra/cipher_extra.c +4 -0
  123. data/third_party/boringssl-with-bazel/src/crypto/curve25519/curve25519.c +1 -1
  124. data/third_party/boringssl-with-bazel/src/crypto/curve25519/internal.h +1 -1
  125. data/third_party/boringssl-with-bazel/src/crypto/evp/evp.c +9 -0
  126. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/bn/prime.c +0 -4
  127. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/digest/digest.c +7 -0
  128. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/digest/md32_common.h +87 -121
  129. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/md4/md4.c +20 -30
  130. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/md5/md5.c +19 -30
  131. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/rand/internal.h +1 -4
  132. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/rand/rand.c +0 -13
  133. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/rsa/rsa.c +26 -24
  134. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/rsa/rsa_impl.c +10 -7
  135. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/sha/sha1.c +28 -39
  136. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/sha/sha256.c +48 -66
  137. data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/sha/sha512.c +4 -5
  138. data/third_party/boringssl-with-bazel/src/crypto/hpke/hpke.c +362 -371
  139. data/third_party/boringssl-with-bazel/src/crypto/pkcs7/pkcs7_x509.c +4 -2
  140. data/third_party/boringssl-with-bazel/src/crypto/rand_extra/passive.c +2 -2
  141. data/third_party/boringssl-with-bazel/src/crypto/rsa_extra/rsa_asn1.c +1 -2
  142. data/third_party/boringssl-with-bazel/src/crypto/x509/internal.h +101 -11
  143. data/third_party/boringssl-with-bazel/src/crypto/x509/t_x509a.c +3 -0
  144. data/third_party/boringssl-with-bazel/src/crypto/x509/x509_cmp.c +2 -2
  145. data/third_party/boringssl-with-bazel/src/crypto/x509/x509_req.c +3 -0
  146. data/third_party/boringssl-with-bazel/src/crypto/x509/x509_set.c +1 -1
  147. data/third_party/boringssl-with-bazel/src/crypto/x509/x509_trs.c +2 -0
  148. data/third_party/boringssl-with-bazel/src/crypto/x509/x509_vfy.c +14 -15
  149. data/third_party/boringssl-with-bazel/src/crypto/x509/x509_vpm.c +53 -73
  150. data/third_party/boringssl-with-bazel/src/crypto/x509/x509cset.c +31 -0
  151. data/third_party/boringssl-with-bazel/src/crypto/x509/x509rset.c +3 -0
  152. data/third_party/boringssl-with-bazel/src/crypto/x509/x_all.c +3 -0
  153. data/third_party/boringssl-with-bazel/src/crypto/x509/x_req.c +5 -8
  154. data/third_party/boringssl-with-bazel/src/crypto/x509/x_sig.c +5 -0
  155. data/third_party/boringssl-with-bazel/src/crypto/x509/x_x509a.c +3 -0
  156. data/third_party/boringssl-with-bazel/src/crypto/x509v3/internal.h +7 -0
  157. data/third_party/boringssl-with-bazel/src/crypto/x509v3/v3_purp.c +1 -1
  158. data/third_party/boringssl-with-bazel/src/crypto/x509v3/v3_utl.c +5 -8
  159. data/third_party/boringssl-with-bazel/src/include/openssl/aead.h +1 -1
  160. data/third_party/boringssl-with-bazel/src/include/openssl/arm_arch.h +66 -1
  161. data/third_party/boringssl-with-bazel/src/include/openssl/base.h +40 -9
  162. data/third_party/boringssl-with-bazel/src/include/openssl/bytestring.h +1 -0
  163. data/third_party/boringssl-with-bazel/src/include/openssl/chacha.h +1 -1
  164. data/third_party/boringssl-with-bazel/src/include/openssl/digest.h +6 -2
  165. data/third_party/boringssl-with-bazel/src/include/openssl/ecdsa.h +14 -0
  166. data/third_party/boringssl-with-bazel/src/include/openssl/evp.h +19 -11
  167. data/third_party/boringssl-with-bazel/src/include/openssl/hpke.h +325 -0
  168. data/third_party/boringssl-with-bazel/src/include/openssl/pkcs7.h +23 -7
  169. data/third_party/boringssl-with-bazel/src/include/openssl/rsa.h +99 -63
  170. data/third_party/boringssl-with-bazel/src/include/openssl/ssl.h +139 -109
  171. data/third_party/boringssl-with-bazel/src/include/openssl/tls1.h +12 -19
  172. data/third_party/boringssl-with-bazel/src/include/openssl/x509.h +48 -50
  173. data/third_party/boringssl-with-bazel/src/include/openssl/x509_vfy.h +451 -435
  174. data/third_party/boringssl-with-bazel/src/include/openssl/x509v3.h +0 -1
  175. data/third_party/boringssl-with-bazel/src/ssl/d1_both.cc +2 -2
  176. data/third_party/boringssl-with-bazel/src/ssl/d1_srtp.cc +1 -1
  177. data/third_party/boringssl-with-bazel/src/ssl/encrypted_client_hello.cc +773 -84
  178. data/third_party/boringssl-with-bazel/src/ssl/handoff.cc +80 -47
  179. data/third_party/boringssl-with-bazel/src/ssl/handshake.cc +24 -19
  180. data/third_party/boringssl-with-bazel/src/ssl/handshake_client.cc +189 -86
  181. data/third_party/boringssl-with-bazel/src/ssl/handshake_server.cc +45 -56
  182. data/third_party/boringssl-with-bazel/src/ssl/internal.h +272 -167
  183. data/third_party/boringssl-with-bazel/src/ssl/s3_both.cc +2 -2
  184. data/third_party/boringssl-with-bazel/src/ssl/s3_lib.cc +2 -2
  185. data/third_party/boringssl-with-bazel/src/ssl/s3_pkt.cc +14 -19
  186. data/third_party/boringssl-with-bazel/src/ssl/ssl_lib.cc +34 -102
  187. data/third_party/boringssl-with-bazel/src/ssl/ssl_privkey.cc +2 -0
  188. data/third_party/boringssl-with-bazel/src/ssl/ssl_session.cc +8 -31
  189. data/third_party/boringssl-with-bazel/src/ssl/ssl_stat.cc +3 -0
  190. data/third_party/boringssl-with-bazel/src/ssl/ssl_transcript.cc +4 -3
  191. data/third_party/boringssl-with-bazel/src/ssl/ssl_versions.cc +7 -3
  192. data/third_party/boringssl-with-bazel/src/ssl/t1_lib.cc +576 -648
  193. data/third_party/boringssl-with-bazel/src/ssl/tls13_both.cc +31 -3
  194. data/third_party/boringssl-with-bazel/src/ssl/tls13_client.cc +98 -39
  195. data/third_party/boringssl-with-bazel/src/ssl/tls13_enc.cc +141 -94
  196. data/third_party/boringssl-with-bazel/src/ssl/tls13_server.cc +58 -68
  197. metadata +65 -40
  198. data/third_party/boringssl-with-bazel/src/crypto/hpke/internal.h +0 -267
  199. data/third_party/boringssl-with-bazel/src/crypto/x509/vpm_int.h +0 -71
@@ -23,12 +23,12 @@
23
23
  #include <openssl/bytestring.h>
24
24
  #include <openssl/digest.h>
25
25
  #include <openssl/err.h>
26
+ #include <openssl/hpke.h>
26
27
  #include <openssl/mem.h>
27
28
  #include <openssl/rand.h>
28
29
  #include <openssl/stack.h>
29
30
 
30
31
  #include "../crypto/internal.h"
31
- #include "../crypto/hpke/internal.h"
32
32
  #include "internal.h"
33
33
 
34
34
 
@@ -155,7 +155,7 @@ static bool add_new_session_tickets(SSL_HANDSHAKE *hs, bool *out_sent_tickets) {
155
155
  (!ssl->quic_method || !ssl->config->quic_early_data_context.empty());
156
156
  if (enable_early_data) {
157
157
  // QUIC does not use the max_early_data_size parameter and always sets it
158
- // to a fixed value. See draft-ietf-quic-tls-22, section 4.5.
158
+ // to a fixed value. See RFC 9001, section 4.6.1.
159
159
  session->ticket_max_early_data =
160
160
  ssl->quic_method != nullptr ? 0xffffffff : kMaxEarlyDataAccepted;
161
161
  }
@@ -188,7 +188,7 @@ static bool add_new_session_tickets(SSL_HANDSHAKE *hs, bool *out_sent_tickets) {
188
188
  }
189
189
  }
190
190
 
191
- // Add a fake extension. See draft-davidben-tls-grease-01.
191
+ // Add a fake extension. See RFC 8701.
192
192
  if (!CBB_add_u16(&extensions,
193
193
  ssl_get_grease_value(hs, ssl_grease_ticket_extension)) ||
194
194
  !CBB_add_u16(&extensions, 0 /* empty */)) {
@@ -377,7 +377,7 @@ static enum ssl_hs_wait_t do_select_session(SSL_HANDSHAKE *hs) {
377
377
  &offered_ticket, msg, &client_hello)) {
378
378
  case ssl_ticket_aead_ignore_ticket:
379
379
  assert(!session);
380
- if (!ssl_get_new_session(hs, 1 /* server */)) {
380
+ if (!ssl_get_new_session(hs)) {
381
381
  ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
382
382
  return ssl_hs_error;
383
383
  }
@@ -394,6 +394,7 @@ static enum ssl_hs_wait_t do_select_session(SSL_HANDSHAKE *hs) {
394
394
  }
395
395
 
396
396
  ssl->s3->session_reused = true;
397
+ hs->can_release_private_key = true;
397
398
 
398
399
  // Resumption incorporates fresh key material, so refresh the timeout.
399
400
  ssl_session_renew_timeout(ssl, hs->new_session.get(),
@@ -444,12 +445,9 @@ static enum ssl_hs_wait_t do_select_session(SSL_HANDSHAKE *hs) {
444
445
  ssl->s3->early_data_reason = ssl_early_data_unsupported_for_session;
445
446
  } else if (!hs->early_data_offered) {
446
447
  ssl->s3->early_data_reason = ssl_early_data_peer_declined;
447
- } else if (ssl->s3->channel_id_valid) {
448
+ } else if (hs->channel_id_negotiated) {
448
449
  // Channel ID is incompatible with 0-RTT.
449
450
  ssl->s3->early_data_reason = ssl_early_data_channel_id;
450
- } else if (ssl->s3->token_binding_negotiated) {
451
- // Token Binding is incompatible with 0-RTT.
452
- ssl->s3->early_data_reason = ssl_early_data_token_binding;
453
451
  } else if (MakeConstSpan(ssl->s3->alpn_selected) != session->early_alpn) {
454
452
  // The negotiated ALPN must match the one in the ticket.
455
453
  ssl->s3->early_data_reason = ssl_early_data_alpn_mismatch;
@@ -514,17 +512,12 @@ static enum ssl_hs_wait_t do_select_session(SSL_HANDSHAKE *hs) {
514
512
  ssl_get_handshake_digest(ssl_protocol_version(ssl), hs->new_cipher));
515
513
 
516
514
  // Set up the key schedule and incorporate the PSK into the running secret.
517
- if (ssl->s3->session_reused) {
518
- if (!tls13_init_key_schedule(
519
- hs, MakeConstSpan(hs->new_session->secret,
520
- hs->new_session->secret_length))) {
521
- return ssl_hs_error;
522
- }
523
- } else if (!tls13_init_key_schedule(hs, MakeConstSpan(kZeroes, hash_len))) {
524
- return ssl_hs_error;
525
- }
526
-
527
- if (!ssl_hash_message(hs, msg)) {
515
+ if (!tls13_init_key_schedule(
516
+ hs, ssl->s3->session_reused
517
+ ? MakeConstSpan(hs->new_session->secret,
518
+ hs->new_session->secret_length)
519
+ : MakeConstSpan(kZeroes, hash_len)) ||
520
+ !ssl_hash_message(hs, msg)) {
528
521
  return ssl_hs_error;
529
522
  }
530
523
 
@@ -608,7 +601,7 @@ static enum ssl_hs_wait_t do_read_second_client_hello(SSL_HANDSHAKE *hs) {
608
601
  return ssl_hs_error;
609
602
  }
610
603
 
611
- if (hs->ech_accept) {
604
+ if (ssl->s3->ech_accept) {
612
605
  // If we previously accepted the ClientHelloInner, check that the second
613
606
  // ClientHello contains an encrypted_client_hello extension.
614
607
  CBS ech_body;
@@ -621,10 +614,11 @@ static enum ssl_hs_wait_t do_read_second_client_hello(SSL_HANDSHAKE *hs) {
621
614
 
622
615
  // Parse a ClientECH out of the extension body.
623
616
  uint16_t kdf_id, aead_id;
624
- CBS config_id, enc, payload;
617
+ uint8_t config_id;
618
+ CBS enc, payload;
625
619
  if (!CBS_get_u16(&ech_body, &kdf_id) || //
626
620
  !CBS_get_u16(&ech_body, &aead_id) ||
627
- !CBS_get_u8_length_prefixed(&ech_body, &config_id) ||
621
+ !CBS_get_u8(&ech_body, &config_id) ||
628
622
  !CBS_get_u16_length_prefixed(&ech_body, &enc) ||
629
623
  !CBS_get_u16_length_prefixed(&ech_body, &payload) ||
630
624
  CBS_len(&ech_body) != 0) {
@@ -634,10 +628,11 @@ static enum ssl_hs_wait_t do_read_second_client_hello(SSL_HANDSHAKE *hs) {
634
628
  }
635
629
 
636
630
  // Check that ClientECH.cipher_suite is unchanged and that
637
- // ClientECH.config_id and ClientECH.enc are empty.
638
- if (kdf_id != EVP_HPKE_CTX_get_kdf_id(hs->ech_hpke_ctx.get()) ||
639
- aead_id != EVP_HPKE_CTX_get_aead_id(hs->ech_hpke_ctx.get()) ||
640
- CBS_len(&config_id) > 0 || CBS_len(&enc) > 0) {
631
+ // ClientECH.enc is empty.
632
+ if (kdf_id != EVP_HPKE_KDF_id(EVP_HPKE_CTX_kdf(hs->ech_hpke_ctx.get())) ||
633
+ aead_id !=
634
+ EVP_HPKE_AEAD_id(EVP_HPKE_CTX_aead(hs->ech_hpke_ctx.get())) ||
635
+ config_id != hs->ech_config_id || CBS_len(&enc) > 0) {
641
636
  OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
642
637
  ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER);
643
638
  return ssl_hs_error;
@@ -730,28 +725,6 @@ static enum ssl_hs_wait_t do_read_second_client_hello(SSL_HANDSHAKE *hs) {
730
725
  return ssl_hs_ok;
731
726
  }
732
727
 
733
- static bool make_server_hello(SSL_HANDSHAKE *hs, Array<uint8_t> *out) {
734
- SSL *const ssl = hs->ssl;
735
- ScopedCBB cbb;
736
- CBB body, extensions, session_id;
737
- if (!ssl->method->init_message(ssl, cbb.get(), &body, SSL3_MT_SERVER_HELLO) ||
738
- !CBB_add_u16(&body, TLS1_2_VERSION) ||
739
- !CBB_add_bytes(&body, ssl->s3->server_random,
740
- sizeof(ssl->s3->server_random)) ||
741
- !CBB_add_u8_length_prefixed(&body, &session_id) ||
742
- !CBB_add_bytes(&session_id, hs->session_id, hs->session_id_len) ||
743
- !CBB_add_u16(&body, SSL_CIPHER_get_protocol_id(hs->new_cipher)) ||
744
- !CBB_add_u8(&body, 0) ||
745
- !CBB_add_u16_length_prefixed(&body, &extensions) ||
746
- !ssl_ext_pre_shared_key_add_serverhello(hs, &extensions) ||
747
- !ssl_ext_key_share_add_serverhello(hs, &extensions) ||
748
- !ssl_ext_supported_versions_add_serverhello(hs, &extensions) ||
749
- !ssl->method->finish_message(ssl, cbb.get(), out)) {
750
- return false;
751
- }
752
- return true;
753
- }
754
-
755
728
  static enum ssl_hs_wait_t do_send_server_hello(SSL_HANDSHAKE *hs) {
756
729
  SSL *const ssl = hs->ssl;
757
730
 
@@ -769,25 +742,44 @@ static enum ssl_hs_wait_t do_send_server_hello(SSL_HANDSHAKE *hs) {
769
742
  }
770
743
  }
771
744
 
772
- assert(!hs->ech_accept || hs->ech_is_inner_present);
745
+ Array<uint8_t> server_hello;
746
+ ScopedCBB cbb;
747
+ CBB body, extensions, session_id;
748
+ if (!ssl->method->init_message(ssl, cbb.get(), &body, SSL3_MT_SERVER_HELLO) ||
749
+ !CBB_add_u16(&body, TLS1_2_VERSION) ||
750
+ !CBB_add_bytes(&body, ssl->s3->server_random,
751
+ sizeof(ssl->s3->server_random)) ||
752
+ !CBB_add_u8_length_prefixed(&body, &session_id) ||
753
+ !CBB_add_bytes(&session_id, hs->session_id, hs->session_id_len) ||
754
+ !CBB_add_u16(&body, SSL_CIPHER_get_protocol_id(hs->new_cipher)) ||
755
+ !CBB_add_u8(&body, 0) ||
756
+ !CBB_add_u16_length_prefixed(&body, &extensions) ||
757
+ !ssl_ext_pre_shared_key_add_serverhello(hs, &extensions) ||
758
+ !ssl_ext_key_share_add_serverhello(hs, &extensions) ||
759
+ !ssl_ext_supported_versions_add_serverhello(hs, &extensions) ||
760
+ !ssl->method->finish_message(ssl, cbb.get(), &server_hello)) {
761
+ return ssl_hs_error;
762
+ }
773
763
 
764
+ assert(!ssl->s3->ech_accept || hs->ech_is_inner_present);
774
765
  if (hs->ech_is_inner_present) {
775
- // Construct the ServerHelloECHConf message, which is the same as
776
- // ServerHello, except the last 8 bytes of its random field are zeroed out.
777
- Span<uint8_t> random_suffix = random.subspan(24);
778
- OPENSSL_memset(random_suffix.data(), 0, random_suffix.size());
779
-
780
- Array<uint8_t> server_hello_ech_conf;
781
- if (!make_server_hello(hs, &server_hello_ech_conf) ||
782
- !tls13_ech_accept_confirmation(hs, random_suffix,
783
- server_hello_ech_conf)) {
766
+ // Fill in the ECH confirmation signal.
767
+ Span<uint8_t> random_suffix =
768
+ random.subspan(SSL3_RANDOM_SIZE - ECH_CONFIRMATION_SIGNAL_LEN);
769
+ if (!ssl_ech_accept_confirmation(hs, random_suffix, hs->transcript,
770
+ server_hello)) {
784
771
  return ssl_hs_error;
785
772
  }
773
+
774
+ // Update |server_hello|.
775
+ const size_t offset = ssl_ech_confirmation_signal_hello_offset(ssl);
776
+ Span<uint8_t> server_hello_out =
777
+ MakeSpan(server_hello).subspan(offset, ECH_CONFIRMATION_SIGNAL_LEN);
778
+ OPENSSL_memcpy(server_hello_out.data(), random_suffix.data(),
779
+ ECH_CONFIRMATION_SIGNAL_LEN);
786
780
  }
787
781
 
788
- Array<uint8_t> server_hello;
789
- if (!make_server_hello(hs, &server_hello) ||
790
- !ssl->method->add_message(ssl, std::move(server_hello))) {
782
+ if (!ssl->method->add_message(ssl, std::move(server_hello))) {
791
783
  return ssl_hs_error;
792
784
  }
793
785
 
@@ -806,8 +798,6 @@ static enum ssl_hs_wait_t do_send_server_hello(SSL_HANDSHAKE *hs) {
806
798
  }
807
799
 
808
800
  // Send EncryptedExtensions.
809
- ScopedCBB cbb;
810
- CBB body;
811
801
  if (!ssl->method->init_message(ssl, cbb.get(), &body,
812
802
  SSL3_MT_ENCRYPTED_EXTENSIONS) ||
813
803
  !ssl_add_serverhello_tlsext(hs, &body) ||
@@ -820,7 +810,7 @@ static enum ssl_hs_wait_t do_send_server_hello(SSL_HANDSHAKE *hs) {
820
810
  hs->cert_request = !!(hs->config->verify_mode & SSL_VERIFY_PEER);
821
811
  // Only request a certificate if Channel ID isn't negotiated.
822
812
  if ((hs->config->verify_mode & SSL_VERIFY_PEER_IF_NO_OBC) &&
823
- ssl->s3->channel_id_valid) {
813
+ hs->channel_id_negotiated) {
824
814
  hs->cert_request = false;
825
815
  }
826
816
  }
@@ -901,6 +891,7 @@ static enum ssl_hs_wait_t do_send_server_finished(SSL_HANDSHAKE *hs) {
901
891
  return ssl_hs_hints_ready;
902
892
  }
903
893
 
894
+ hs->can_release_private_key = true;
904
895
  if (!tls13_add_finished(hs) ||
905
896
  // Update the secret to the master secret and derive traffic keys.
906
897
  !tls13_advance_key_schedule(
@@ -978,9 +969,8 @@ static enum ssl_hs_wait_t do_read_second_client_flight(SSL_HANDSHAKE *hs) {
978
969
  hs->in_early_data = true;
979
970
  }
980
971
 
981
- // QUIC doesn't use an EndOfEarlyData message (draft-ietf-quic-tls-22,
982
- // section 8.3), so we switch to client_handshake_secret before the early
983
- // return.
972
+ // QUIC doesn't use an EndOfEarlyData message (RFC 9001, section 8.3), so we
973
+ // switch to client_handshake_secret before the early return.
984
974
  if (ssl->quic_method != nullptr) {
985
975
  if (!tls13_set_traffic_key(ssl, ssl_encryption_handshake, evp_aead_open,
986
976
  hs->new_session.get(),
@@ -1156,7 +1146,7 @@ static enum ssl_hs_wait_t do_read_client_certificate_verify(SSL_HANDSHAKE *hs) {
1156
1146
 
1157
1147
  static enum ssl_hs_wait_t do_read_channel_id(SSL_HANDSHAKE *hs) {
1158
1148
  SSL *const ssl = hs->ssl;
1159
- if (!ssl->s3->channel_id_valid) {
1149
+ if (!hs->channel_id_negotiated) {
1160
1150
  hs->tls13_state = state13_read_client_finished;
1161
1151
  return ssl_hs_ok;
1162
1152
  }
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: grpc
3
3
  version: !ruby/object:Gem::Version
4
- version: 1.38.0
4
+ version: 1.39.0.pre1
5
5
  platform: ruby
6
6
  authors:
7
7
  - gRPC Authors
8
8
  autorequire:
9
9
  bindir: src/ruby/bin
10
10
  cert_chain: []
11
- date: 2021-05-20 00:00:00.000000000 Z
11
+ date: 2021-07-02 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: google-protobuf
@@ -213,7 +213,7 @@ files:
213
213
  - include/grpc/census.h
214
214
  - include/grpc/compression.h
215
215
  - include/grpc/event_engine/README.md
216
- - include/grpc/event_engine/channel_args.h
216
+ - include/grpc/event_engine/endpoint_config.h
217
217
  - include/grpc/event_engine/event_engine.h
218
218
  - include/grpc/event_engine/port.h
219
219
  - include/grpc/event_engine/slice_allocator.h
@@ -340,11 +340,13 @@ files:
340
340
  - src/core/ext/filters/client_channel/resolver.h
341
341
  - src/core/ext/filters/client_channel/resolver/dns/c_ares/dns_resolver_ares.cc
342
342
  - src/core/ext/filters/client_channel/resolver/dns/c_ares/grpc_ares_ev_driver.h
343
+ - src/core/ext/filters/client_channel/resolver/dns/c_ares/grpc_ares_ev_driver_event_engine.cc
343
344
  - src/core/ext/filters/client_channel/resolver/dns/c_ares/grpc_ares_ev_driver_libuv.cc
344
345
  - src/core/ext/filters/client_channel/resolver/dns/c_ares/grpc_ares_ev_driver_posix.cc
345
346
  - src/core/ext/filters/client_channel/resolver/dns/c_ares/grpc_ares_ev_driver_windows.cc
346
347
  - src/core/ext/filters/client_channel/resolver/dns/c_ares/grpc_ares_wrapper.cc
347
348
  - src/core/ext/filters/client_channel/resolver/dns/c_ares/grpc_ares_wrapper.h
349
+ - src/core/ext/filters/client_channel/resolver/dns/c_ares/grpc_ares_wrapper_event_engine.cc
348
350
  - src/core/ext/filters/client_channel/resolver/dns/c_ares/grpc_ares_wrapper_libuv.cc
349
351
  - src/core/ext/filters/client_channel/resolver/dns/c_ares/grpc_ares_wrapper_posix.cc
350
352
  - src/core/ext/filters/client_channel/resolver/dns/c_ares/grpc_ares_wrapper_windows.cc
@@ -919,8 +921,12 @@ files:
919
921
  - src/core/lib/debug/stats_data.h
920
922
  - src/core/lib/debug/trace.cc
921
923
  - src/core/lib/debug/trace.h
924
+ - src/core/lib/event_engine/endpoint_config.cc
925
+ - src/core/lib/event_engine/endpoint_config_internal.h
926
+ - src/core/lib/event_engine/event_engine.cc
922
927
  - src/core/lib/event_engine/slice_allocator.cc
923
928
  - src/core/lib/event_engine/sockaddr.cc
929
+ - src/core/lib/event_engine/sockaddr.h
924
930
  - src/core/lib/gpr/alloc.cc
925
931
  - src/core/lib/gpr/alloc.h
926
932
  - src/core/lib/gpr/arena.h
@@ -1026,6 +1032,7 @@ files:
1026
1032
  - src/core/lib/iomgr/endpoint_cfstream.cc
1027
1033
  - src/core/lib/iomgr/endpoint_cfstream.h
1028
1034
  - src/core/lib/iomgr/endpoint_pair.h
1035
+ - src/core/lib/iomgr/endpoint_pair_event_engine.cc
1029
1036
  - src/core/lib/iomgr/endpoint_pair_posix.cc
1030
1037
  - src/core/lib/iomgr/endpoint_pair_uv.cc
1031
1038
  - src/core/lib/iomgr/endpoint_pair_windows.cc
@@ -1045,6 +1052,20 @@ files:
1045
1052
  - src/core/lib/iomgr/ev_posix.cc
1046
1053
  - src/core/lib/iomgr/ev_posix.h
1047
1054
  - src/core/lib/iomgr/ev_windows.cc
1055
+ - src/core/lib/iomgr/event_engine/closure.cc
1056
+ - src/core/lib/iomgr/event_engine/closure.h
1057
+ - src/core/lib/iomgr/event_engine/endpoint.cc
1058
+ - src/core/lib/iomgr/event_engine/endpoint.h
1059
+ - src/core/lib/iomgr/event_engine/iomgr.cc
1060
+ - src/core/lib/iomgr/event_engine/iomgr.h
1061
+ - src/core/lib/iomgr/event_engine/pollset.cc
1062
+ - src/core/lib/iomgr/event_engine/pollset.h
1063
+ - src/core/lib/iomgr/event_engine/promise.h
1064
+ - src/core/lib/iomgr/event_engine/resolved_address_internal.cc
1065
+ - src/core/lib/iomgr/event_engine/resolved_address_internal.h
1066
+ - src/core/lib/iomgr/event_engine/resolver.cc
1067
+ - src/core/lib/iomgr/event_engine/tcp.cc
1068
+ - src/core/lib/iomgr/event_engine/timer.cc
1048
1069
  - src/core/lib/iomgr/exec_ctx.cc
1049
1070
  - src/core/lib/iomgr/exec_ctx.h
1050
1071
  - src/core/lib/iomgr/executor.cc
@@ -1186,6 +1207,11 @@ files:
1186
1207
  - src/core/lib/profiling/basic_timers.cc
1187
1208
  - src/core/lib/profiling/stap_timers.cc
1188
1209
  - src/core/lib/profiling/timers.h
1210
+ - src/core/lib/security/authorization/authorization_engine.h
1211
+ - src/core/lib/security/authorization/authorization_policy_provider.h
1212
+ - src/core/lib/security/authorization/authorization_policy_provider_vtable.cc
1213
+ - src/core/lib/security/authorization/evaluate_args.cc
1214
+ - src/core/lib/security/authorization/evaluate_args.h
1189
1215
  - src/core/lib/security/context/security_context.cc
1190
1216
  - src/core/lib/security/context/security_context.h
1191
1217
  - src/core/lib/security/credentials/alts/alts_credentials.cc
@@ -1997,7 +2023,6 @@ files:
1997
2023
  - third_party/boringssl-with-bazel/src/crypto/fipsmodule/tls/kdf.c
1998
2024
  - third_party/boringssl-with-bazel/src/crypto/hkdf/hkdf.c
1999
2025
  - third_party/boringssl-with-bazel/src/crypto/hpke/hpke.c
2000
- - third_party/boringssl-with-bazel/src/crypto/hpke/internal.h
2001
2026
  - third_party/boringssl-with-bazel/src/crypto/hrss/hrss.c
2002
2027
  - third_party/boringssl-with-bazel/src/crypto/hrss/internal.h
2003
2028
  - third_party/boringssl-with-bazel/src/crypto/internal.h
@@ -2064,7 +2089,6 @@ files:
2064
2089
  - third_party/boringssl-with-bazel/src/crypto/x509/t_req.c
2065
2090
  - third_party/boringssl-with-bazel/src/crypto/x509/t_x509.c
2066
2091
  - third_party/boringssl-with-bazel/src/crypto/x509/t_x509a.c
2067
- - third_party/boringssl-with-bazel/src/crypto/x509/vpm_int.h
2068
2092
  - third_party/boringssl-with-bazel/src/crypto/x509/x509.c
2069
2093
  - third_party/boringssl-with-bazel/src/crypto/x509/x509_att.c
2070
2094
  - third_party/boringssl-with-bazel/src/crypto/x509/x509_cmp.c
@@ -2173,6 +2197,7 @@ files:
2173
2197
  - third_party/boringssl-with-bazel/src/include/openssl/ex_data.h
2174
2198
  - third_party/boringssl-with-bazel/src/include/openssl/hkdf.h
2175
2199
  - third_party/boringssl-with-bazel/src/include/openssl/hmac.h
2200
+ - third_party/boringssl-with-bazel/src/include/openssl/hpke.h
2176
2201
  - third_party/boringssl-with-bazel/src/include/openssl/hrss.h
2177
2202
  - third_party/boringssl-with-bazel/src/include/openssl/is_boringssl.h
2178
2203
  - third_party/boringssl-with-bazel/src/include/openssl/lhash.h
@@ -2448,55 +2473,55 @@ required_ruby_version: !ruby/object:Gem::Requirement
2448
2473
  version: 2.4.0
2449
2474
  required_rubygems_version: !ruby/object:Gem::Requirement
2450
2475
  requirements:
2451
- - - ">="
2476
+ - - ">"
2452
2477
  - !ruby/object:Gem::Version
2453
- version: '0'
2478
+ version: 1.3.1
2454
2479
  requirements: []
2455
- rubygems_version: 3.2.17
2480
+ rubygems_version: 3.2.21
2456
2481
  signing_key:
2457
2482
  specification_version: 4
2458
2483
  summary: GRPC system in Ruby
2459
2484
  test_files:
2460
- - src/ruby/spec/testdata/server1.pem
2461
- - src/ruby/spec/testdata/client.key
2462
- - src/ruby/spec/testdata/ca.pem
2463
- - src/ruby/spec/testdata/README
2464
- - src/ruby/spec/testdata/client.pem
2465
- - src/ruby/spec/testdata/server1.key
2466
2485
  - src/ruby/spec/compression_options_spec.rb
2467
2486
  - src/ruby/spec/error_sanity_spec.rb
2487
+ - src/ruby/spec/debug_message_spec.rb
2488
+ - src/ruby/spec/testdata/server1.key
2489
+ - src/ruby/spec/testdata/README
2490
+ - src/ruby/spec/testdata/client.pem
2491
+ - src/ruby/spec/testdata/ca.pem
2492
+ - src/ruby/spec/testdata/server1.pem
2493
+ - src/ruby/spec/testdata/client.key
2494
+ - src/ruby/spec/time_consts_spec.rb
2495
+ - src/ruby/spec/server_credentials_spec.rb
2496
+ - src/ruby/spec/generic/rpc_desc_spec.rb
2497
+ - src/ruby/spec/generic/active_call_spec.rb
2498
+ - src/ruby/spec/generic/client_interceptors_spec.rb
2499
+ - src/ruby/spec/generic/client_stub_spec.rb
2500
+ - src/ruby/spec/generic/rpc_server_spec.rb
2501
+ - src/ruby/spec/generic/interceptor_registry_spec.rb
2502
+ - src/ruby/spec/generic/rpc_server_pool_spec.rb
2503
+ - src/ruby/spec/generic/service_spec.rb
2504
+ - src/ruby/spec/generic/server_interceptors_spec.rb
2505
+ - src/ruby/spec/google_rpc_status_utils_spec.rb
2506
+ - src/ruby/spec/channel_spec.rb
2468
2507
  - src/ruby/spec/user_agent_spec.rb
2508
+ - src/ruby/spec/channel_credentials_spec.rb
2509
+ - src/ruby/spec/call_credentials_spec.rb
2510
+ - src/ruby/spec/spec_helper.rb
2511
+ - src/ruby/spec/server_spec.rb
2469
2512
  - src/ruby/spec/call_spec.rb
2513
+ - src/ruby/spec/channel_connection_spec.rb
2514
+ - src/ruby/spec/client_server_spec.rb
2515
+ - src/ruby/spec/support/helpers.rb
2516
+ - src/ruby/spec/support/services.rb
2517
+ - src/ruby/spec/client_auth_spec.rb
2518
+ - src/ruby/spec/errors_spec.rb
2470
2519
  - src/ruby/spec/pb/health/checker_spec.rb
2471
2520
  - src/ruby/spec/pb/duplicate/codegen_spec.rb
2472
- - src/ruby/spec/pb/codegen/grpc/testing/package_options_import.proto
2473
- - src/ruby/spec/pb/codegen/grpc/testing/package_options_import2.proto
2474
2521
  - src/ruby/spec/pb/codegen/grpc/testing/package_options.proto
2475
2522
  - src/ruby/spec/pb/codegen/grpc/testing/package_options_ruby_style.proto
2476
2523
  - src/ruby/spec/pb/codegen/grpc/testing/same_package_service_name.proto
2524
+ - src/ruby/spec/pb/codegen/grpc/testing/package_options_import2.proto
2477
2525
  - src/ruby/spec/pb/codegen/grpc/testing/same_ruby_package_service_name.proto
2526
+ - src/ruby/spec/pb/codegen/grpc/testing/package_options_import.proto
2478
2527
  - src/ruby/spec/pb/codegen/package_option_spec.rb
2479
- - src/ruby/spec/call_credentials_spec.rb
2480
- - src/ruby/spec/channel_connection_spec.rb
2481
- - src/ruby/spec/channel_credentials_spec.rb
2482
- - src/ruby/spec/client_server_spec.rb
2483
- - src/ruby/spec/server_spec.rb
2484
- - src/ruby/spec/spec_helper.rb
2485
- - src/ruby/spec/support/helpers.rb
2486
- - src/ruby/spec/support/services.rb
2487
- - src/ruby/spec/errors_spec.rb
2488
- - src/ruby/spec/channel_spec.rb
2489
- - src/ruby/spec/server_credentials_spec.rb
2490
- - src/ruby/spec/client_auth_spec.rb
2491
- - src/ruby/spec/google_rpc_status_utils_spec.rb
2492
- - src/ruby/spec/debug_message_spec.rb
2493
- - src/ruby/spec/time_consts_spec.rb
2494
- - src/ruby/spec/generic/client_interceptors_spec.rb
2495
- - src/ruby/spec/generic/active_call_spec.rb
2496
- - src/ruby/spec/generic/rpc_server_pool_spec.rb
2497
- - src/ruby/spec/generic/rpc_server_spec.rb
2498
- - src/ruby/spec/generic/interceptor_registry_spec.rb
2499
- - src/ruby/spec/generic/rpc_desc_spec.rb
2500
- - src/ruby/spec/generic/client_stub_spec.rb
2501
- - src/ruby/spec/generic/service_spec.rb
2502
- - src/ruby/spec/generic/server_interceptors_spec.rb