grpc 1.41.0 → 1.41.1

data/third_party/boringssl-with-bazel/src/ssl/tls13_enc.cc

@@ -489,8 +489,8 @@ bool tls13_write_psk_binder(const SSL_HANDSHAKE *hs,
     return false;
   }
 
-  OPENSSL_memcpy(msg.data() + msg.size() - verify_data_len, verify_data,
-                 verify_data_len);
+  auto msg_binder = msg.last(verify_data_len);
+  OPENSSL_memcpy(msg_binder.data(), verify_data, verify_data_len);
   if (out_binder_len != nullptr) {
     *out_binder_len = verify_data_len;
   }
@@ -537,57 +537,46 @@ size_t ssl_ech_confirmation_signal_hello_offset(const SSL *ssl) {
          ECH_CONFIRMATION_SIGNAL_LEN;
 }
 
-bool ssl_ech_accept_confirmation(
-    const SSL_HANDSHAKE *hs, bssl::Span<uint8_t> out,
-    const SSLTranscript &transcript,
-    bssl::Span<const uint8_t> server_hello) {
-  // We hash |server_hello|, with the last |ECH_CONFIRMATION_SIGNAL_LEN| bytes
-  // of the random value zeroed.
-  static const uint8_t kZeroes[ECH_CONFIRMATION_SIGNAL_LEN] = {0};
-  const size_t offset = ssl_ech_confirmation_signal_hello_offset(hs->ssl);
-  if (server_hello.size() < offset + ECH_CONFIRMATION_SIGNAL_LEN) {
+bool ssl_ech_accept_confirmation(const SSL_HANDSHAKE *hs, Span<uint8_t> out,
+                                 Span<const uint8_t> client_random,
+                                 const SSLTranscript &transcript, bool is_hrr,
+                                 Span<const uint8_t> msg, size_t offset) {
+  // See draft-ietf-tls-esni-13, sections 7.2 and 7.2.1.
+  static const uint8_t kZeros[EVP_MAX_MD_SIZE] = {0};
+
+  // We hash |msg|, with bytes from |offset| zeroed.
+  if (msg.size() < offset + ECH_CONFIRMATION_SIGNAL_LEN) {
     OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
     return false;
   }
 
-  auto before_zeroes = server_hello.subspan(0, offset);
-  auto after_zeroes =
-      server_hello.subspan(offset + ECH_CONFIRMATION_SIGNAL_LEN);
-  uint8_t context_hash[EVP_MAX_MD_SIZE];
-  unsigned context_hash_len;
+  auto before_zeros = msg.subspan(0, offset);
+  auto after_zeros = msg.subspan(offset + ECH_CONFIRMATION_SIGNAL_LEN);
+  uint8_t context[EVP_MAX_MD_SIZE];
+  unsigned context_len;
   ScopedEVP_MD_CTX ctx;
   if (!transcript.CopyToHashContext(ctx.get(), transcript.Digest()) ||
-      !EVP_DigestUpdate(ctx.get(), before_zeroes.data(),
-                        before_zeroes.size()) ||
-      !EVP_DigestUpdate(ctx.get(), kZeroes, sizeof(kZeroes)) ||
-      !EVP_DigestUpdate(ctx.get(), after_zeroes.data(), after_zeroes.size()) ||
-      !EVP_DigestFinal_ex(ctx.get(), context_hash, &context_hash_len)) {
+      !EVP_DigestUpdate(ctx.get(), before_zeros.data(), before_zeros.size()) ||
+      !EVP_DigestUpdate(ctx.get(), kZeros, ECH_CONFIRMATION_SIGNAL_LEN) ||
+      !EVP_DigestUpdate(ctx.get(), after_zeros.data(), after_zeros.size()) ||
+      !EVP_DigestFinal_ex(ctx.get(), context, &context_len)) {
     return false;
   }
 
-  // Per draft-ietf-tls-esni-10, accept_confirmation is computed with
-  // Derive-Secret, which derives a secret of size Hash.length. That value is
-  // then truncated to the first 8 bytes. Note this differs from deriving an
-  // 8-byte secret because the target length is included in the derivation.
-  //
-  // TODO(https://crbug.com/boringssl/275): draft-11 will avoid this.
-  uint8_t accept_confirmation_buf[EVP_MAX_MD_SIZE];
-  bssl::Span<uint8_t> accept_confirmation =
-      MakeSpan(accept_confirmation_buf, transcript.DigestLen());
-  if (!hkdf_expand_label(accept_confirmation, transcript.Digest(),
-                         hs->secret(), label_to_span("ech accept confirmation"),
-                         MakeConstSpan(context_hash, context_hash_len))) {
+  uint8_t secret[EVP_MAX_MD_SIZE];
+  size_t secret_len;
+  if (!HKDF_extract(secret, &secret_len, transcript.Digest(),
+                    client_random.data(), client_random.size(), kZeros,
+                    transcript.DigestLen())) {
     return false;
   }
 
-  static_assert(ECH_CONFIRMATION_SIGNAL_LEN < EVP_MAX_MD_SIZE,
-                "ECH confirmation signal too big");
-  if (out.size() != ECH_CONFIRMATION_SIGNAL_LEN) {
-    OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
-    return false;
-  }
-  OPENSSL_memcpy(out.data(), accept_confirmation.data(), out.size());
-  return true;
+  assert(out.size() == ECH_CONFIRMATION_SIGNAL_LEN);
+  return hkdf_expand_label(out, transcript.Digest(),
+                           MakeConstSpan(secret, secret_len),
+                           is_hrr ? label_to_span("hrr ech accept confirmation")
+                                  : label_to_span("ech accept confirmation"),
+                           MakeConstSpan(context, context_len));
 }
 
 BSSL_NAMESPACE_END

data/third_party/boringssl-with-bazel/src/ssl/tls13_server.cc

@@ -246,8 +246,7 @@ static enum ssl_hs_wait_t do_select_parameters(SSL_HANDSHAKE *hs) {
     return ssl_hs_error;
   }
 
-  // The PRF hash is now known. Set up the key schedule and hash the
-  // ClientHello.
+  // The PRF hash is now known.
   if (!hs->transcript.InitHash(ssl_protocol_version(ssl), hs->new_cipher)) {
     return ssl_hs_error;
   }
@@ -270,7 +269,7 @@ static enum ssl_ticket_aead_result_t select_session(
     return ssl_ticket_aead_ignore_ticket;
   }
 
-  // Per RFC8446, section 4.2.9, servers MUST abort the handshake if the client
+  // Per RFC 8446, section 4.2.9, servers MUST abort the handshake if the client
   // sends pre_shared_key without psk_key_exchange_modes.
   CBS unused;
   if (!ssl_client_hello_get_extension(client_hello, &unused,
@@ -571,12 +570,34 @@ static enum ssl_hs_wait_t do_send_hello_retry_request(SSL_HANDSHAKE *hs) {
       !CBB_add_u16(&extensions, ssl->version) ||
       !CBB_add_u16(&extensions, TLSEXT_TYPE_key_share) ||
       !CBB_add_u16(&extensions, 2 /* length */) ||
-      !CBB_add_u16(&extensions, group_id) ||
-      !ssl_add_message_cbb(ssl, cbb.get())) {
+      !CBB_add_u16(&extensions, group_id)) {
     return ssl_hs_error;
   }
+  if (hs->ech_is_inner) {
+    // Fill a placeholder for the ECH confirmation value.
+    if (!CBB_add_u16(&extensions, TLSEXT_TYPE_encrypted_client_hello) ||
+        !CBB_add_u16(&extensions, ECH_CONFIRMATION_SIGNAL_LEN) ||
+        !CBB_add_zeros(&extensions, ECH_CONFIRMATION_SIGNAL_LEN)) {
+      return ssl_hs_error;
+    }
+  }
+  Array<uint8_t> hrr;
+  if (!ssl->method->finish_message(ssl, cbb.get(), &hrr)) {
+    return ssl_hs_error;
+  }
+  if (hs->ech_is_inner) {
+    // Now that the message is encoded, fill in the whole value.
+    size_t offset = hrr.size() - ECH_CONFIRMATION_SIGNAL_LEN;
+    if (!ssl_ech_accept_confirmation(
+            hs, MakeSpan(hrr).last(ECH_CONFIRMATION_SIGNAL_LEN),
+            ssl->s3->client_random, hs->transcript, /*is_hrr=*/true, hrr,
+            offset)) {
+      return ssl_hs_error;
+    }
+  }
 
-  if (!ssl->method->add_change_cipher_spec(ssl)) {
+  if (!ssl->method->add_message(ssl, std::move(hrr)) ||
+      !ssl->method->add_change_cipher_spec(ssl)) {
     return ssl_hs_error;
   }
 
@@ -602,8 +623,8 @@ static enum ssl_hs_wait_t do_read_second_client_hello(SSL_HANDSHAKE *hs) {
   }
 
   if (ssl->s3->ech_status == ssl_ech_accepted) {
-    // If we previously accepted the ClientHelloInner, check that the second
-    // ClientHello contains an encrypted_client_hello extension.
+    // If we previously accepted the ClientHelloInner, the second ClientHello
+    // must contain an outer encrypted_client_hello extension.
     CBS ech_body;
     if (!ssl_client_hello_get_extension(&client_hello, &ech_body,
                                         TLSEXT_TYPE_encrypted_client_hello)) {
@@ -611,12 +632,12 @@ static enum ssl_hs_wait_t do_read_second_client_hello(SSL_HANDSHAKE *hs) {
       ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_MISSING_EXTENSION);
       return ssl_hs_error;
     }
-
-    // Parse a ClientECH out of the extension body.
     uint16_t kdf_id, aead_id;
-    uint8_t config_id;
+    uint8_t type, config_id;
     CBS enc, payload;
-    if (!CBS_get_u16(&ech_body, &kdf_id) ||  //
+    if (!CBS_get_u8(&ech_body, &type) ||     //
+        type != ECH_CLIENT_OUTER ||          //
+        !CBS_get_u16(&ech_body, &kdf_id) ||  //
         !CBS_get_u16(&ech_body, &aead_id) ||
         !CBS_get_u8(&ech_body, &config_id) ||
         !CBS_get_u16_length_prefixed(&ech_body, &enc) ||
@@ -627,8 +648,6 @@ static enum ssl_hs_wait_t do_read_second_client_hello(SSL_HANDSHAKE *hs) {
       return ssl_hs_error;
     }
 
-    // Check that ClientECH.cipher_suite is unchanged and that
-    // ClientECH.enc is empty.
     if (kdf_id != EVP_HPKE_KDF_id(EVP_HPKE_CTX_kdf(hs->ech_hpke_ctx.get())) ||
         aead_id !=
             EVP_HPKE_AEAD_id(EVP_HPKE_CTX_aead(hs->ech_hpke_ctx.get())) ||
@@ -641,9 +660,9 @@ static enum ssl_hs_wait_t do_read_second_client_hello(SSL_HANDSHAKE *hs) {
     // Decrypt the payload with the HPKE context from the first ClientHello.
     Array<uint8_t> encoded_client_hello_inner;
     bool unused;
-    if (!ssl_client_hello_decrypt(
-            hs->ech_hpke_ctx.get(), &encoded_client_hello_inner, &unused,
-            &client_hello, kdf_id, aead_id, config_id, enc, payload)) {
+    if (!ssl_client_hello_decrypt(hs->ech_hpke_ctx.get(),
+                                  &encoded_client_hello_inner, &unused,
+                                  &client_hello, payload)) {
       // Decryption failure is fatal in the second ClientHello.
       OPENSSL_PUT_ERROR(SSL, SSL_R_DECRYPTION_FAILED);
       ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECRYPT_ERROR);
@@ -761,18 +780,18 @@ static enum ssl_hs_wait_t do_send_server_hello(SSL_HANDSHAKE *hs) {
     return ssl_hs_error;
   }
 
-  assert(ssl->s3->ech_status != ssl_ech_accepted || hs->ech_is_inner_present);
-  if (hs->ech_is_inner_present) {
+  assert(ssl->s3->ech_status != ssl_ech_accepted || hs->ech_is_inner);
+  if (hs->ech_is_inner) {
     // Fill in the ECH confirmation signal.
-    Span<uint8_t> random_suffix =
-        random.subspan(SSL3_RANDOM_SIZE - ECH_CONFIRMATION_SIGNAL_LEN);
-    if (!ssl_ech_accept_confirmation(hs, random_suffix, hs->transcript,
-                                     server_hello)) {
+    const size_t offset = ssl_ech_confirmation_signal_hello_offset(ssl);
+    Span<uint8_t> random_suffix = random.last(ECH_CONFIRMATION_SIGNAL_LEN);
+    if (!ssl_ech_accept_confirmation(hs, random_suffix, ssl->s3->client_random,
+                                     hs->transcript,
+                                     /*is_hrr=*/false, server_hello, offset)) {
       return ssl_hs_error;
     }
 
     // Update |server_hello|.
-    const size_t offset = ssl_ech_confirmation_signal_hello_offset(ssl);
     Span<uint8_t> server_hello_out =
         MakeSpan(server_hello).subspan(offset, ECH_CONFIRMATION_SIGNAL_LEN);
     OPENSSL_memcpy(server_hello_out.data(), random_suffix.data(),
@@ -1041,20 +1060,15 @@ static enum ssl_hs_wait_t do_read_client_encrypted_extensions(
       return ssl_hs_error;
     }
 
-    // Parse out the extensions.
-    bool have_application_settings = false;
-    CBS application_settings;
-    SSL_EXTENSION_TYPE ext_types[] = {{TLSEXT_TYPE_application_settings,
-                                       &have_application_settings,
-                                       &application_settings}};
+    SSLExtension application_settings(TLSEXT_TYPE_application_settings);
     uint8_t alert = SSL_AD_DECODE_ERROR;
-    if (!ssl_parse_extensions(&extensions, &alert, ext_types,
+    if (!ssl_parse_extensions(&extensions, &alert, {&application_settings},
                               /*ignore_unknown=*/false)) {
       ssl_send_alert(ssl, SSL3_AL_FATAL, alert);
       return ssl_hs_error;
     }
 
-    if (!have_application_settings) {
+    if (!application_settings.present) {
       OPENSSL_PUT_ERROR(SSL, SSL_R_MISSING_EXTENSION);
       ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_MISSING_EXTENSION);
       return ssl_hs_error;
@@ -1063,7 +1077,7 @@ static enum ssl_hs_wait_t do_read_client_encrypted_extensions(
     // Note that, if 0-RTT was accepted, these values will already have been
     // initialized earlier.
     if (!hs->new_session->peer_application_settings.CopyFrom(
-            application_settings) ||
+            application_settings.data) ||
         !ssl_hash_message(hs, msg)) {
       ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
       return ssl_hs_error;

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: grpc
 version: !ruby/object:Gem::Version
-  version: 1.41.0
+  version: 1.41.1
 platform: ruby
 authors:
 - gRPC Authors
 autorequire: 
 bindir: src/ruby/bin
 cert_chain: []
-date: 2021-09-25 00:00:00.000000000 Z
+date: 2021-10-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: google-protobuf
@@ -1835,6 +1835,7 @@ files:
 - third_party/boringssl-with-bazel/src/crypto/asn1/a_object.c
 - third_party/boringssl-with-bazel/src/crypto/asn1/a_octet.c
 - third_party/boringssl-with-bazel/src/crypto/asn1/a_print.c
+- third_party/boringssl-with-bazel/src/crypto/asn1/a_strex.c
 - third_party/boringssl-with-bazel/src/crypto/asn1/a_strnid.c
 - third_party/boringssl-with-bazel/src/crypto/asn1/a_time.c
 - third_party/boringssl-with-bazel/src/crypto/asn1/a_type.c
@@ -1843,6 +1844,7 @@ files:
 - third_party/boringssl-with-bazel/src/crypto/asn1/asn1_lib.c
 - third_party/boringssl-with-bazel/src/crypto/asn1/asn1_par.c
 - third_party/boringssl-with-bazel/src/crypto/asn1/asn_pack.c
+- third_party/boringssl-with-bazel/src/crypto/asn1/charmap.h
 - third_party/boringssl-with-bazel/src/crypto/asn1/f_enum.c
 - third_party/boringssl-with-bazel/src/crypto/asn1/f_int.c
 - third_party/boringssl-with-bazel/src/crypto/asn1/f_string.c
@@ -2093,15 +2095,14 @@ files:
 - third_party/boringssl-with-bazel/src/crypto/trust_token/voprf.c
 - third_party/boringssl-with-bazel/src/crypto/x509/a_digest.c
 - third_party/boringssl-with-bazel/src/crypto/x509/a_sign.c
-- third_party/boringssl-with-bazel/src/crypto/x509/a_strex.c
 - third_party/boringssl-with-bazel/src/crypto/x509/a_verify.c
 - third_party/boringssl-with-bazel/src/crypto/x509/algorithm.c
 - third_party/boringssl-with-bazel/src/crypto/x509/asn1_gen.c
 - third_party/boringssl-with-bazel/src/crypto/x509/by_dir.c
 - third_party/boringssl-with-bazel/src/crypto/x509/by_file.c
-- third_party/boringssl-with-bazel/src/crypto/x509/charmap.h
 - third_party/boringssl-with-bazel/src/crypto/x509/i2d_pr.c
 - third_party/boringssl-with-bazel/src/crypto/x509/internal.h
+- third_party/boringssl-with-bazel/src/crypto/x509/name_print.c
 - third_party/boringssl-with-bazel/src/crypto/x509/rsa_pss.c
 - third_party/boringssl-with-bazel/src/crypto/x509/t_crl.c
 - third_party/boringssl-with-bazel/src/crypto/x509/t_req.c
@@ -2496,51 +2497,51 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.28
+rubygems_version: 3.2.29
 signing_key: 
 specification_version: 4
 summary: GRPC system in Ruby
 test_files:
+- src/ruby/spec/client_server_spec.rb
+- src/ruby/spec/errors_spec.rb
+- src/ruby/spec/support/services.rb
+- src/ruby/spec/support/helpers.rb
+- src/ruby/spec/compression_options_spec.rb
+- src/ruby/spec/time_consts_spec.rb
+- src/ruby/spec/spec_helper.rb
+- src/ruby/spec/channel_connection_spec.rb
+- src/ruby/spec/debug_message_spec.rb
+- src/ruby/spec/call_credentials_spec.rb
+- src/ruby/spec/generic/interceptor_registry_spec.rb
+- src/ruby/spec/generic/rpc_desc_spec.rb
+- src/ruby/spec/generic/service_spec.rb
+- src/ruby/spec/generic/server_interceptors_spec.rb
+- src/ruby/spec/generic/client_stub_spec.rb
+- src/ruby/spec/generic/rpc_server_pool_spec.rb
+- src/ruby/spec/generic/active_call_spec.rb
+- src/ruby/spec/generic/rpc_server_spec.rb
+- src/ruby/spec/generic/client_interceptors_spec.rb
+- src/ruby/spec/google_rpc_status_utils_spec.rb
 - src/ruby/spec/pb/duplicate/codegen_spec.rb
-- src/ruby/spec/pb/codegen/grpc/testing/package_options_import.proto
+- src/ruby/spec/pb/codegen/package_option_spec.rb
 - src/ruby/spec/pb/codegen/grpc/testing/same_ruby_package_service_name.proto
-- src/ruby/spec/pb/codegen/grpc/testing/package_options_ruby_style.proto
-- src/ruby/spec/pb/codegen/grpc/testing/same_package_service_name.proto
+- src/ruby/spec/pb/codegen/grpc/testing/package_options_import.proto
 - src/ruby/spec/pb/codegen/grpc/testing/package_options_import2.proto
+- src/ruby/spec/pb/codegen/grpc/testing/same_package_service_name.proto
+- src/ruby/spec/pb/codegen/grpc/testing/package_options_ruby_style.proto
 - src/ruby/spec/pb/codegen/grpc/testing/package_options.proto
-- src/ruby/spec/pb/codegen/package_option_spec.rb
 - src/ruby/spec/pb/health/checker_spec.rb
-- src/ruby/spec/call_spec.rb
-- src/ruby/spec/call_credentials_spec.rb
-- src/ruby/spec/channel_connection_spec.rb
+- src/ruby/spec/channel_spec.rb
 - src/ruby/spec/user_agent_spec.rb
-- src/ruby/spec/server_spec.rb
-- src/ruby/spec/time_consts_spec.rb
-- src/ruby/spec/support/helpers.rb
-- src/ruby/spec/support/services.rb
+- src/ruby/spec/server_credentials_spec.rb
+- src/ruby/spec/error_sanity_spec.rb
 - src/ruby/spec/channel_credentials_spec.rb
-- src/ruby/spec/google_rpc_status_utils_spec.rb
-- src/ruby/spec/channel_spec.rb
-- src/ruby/spec/errors_spec.rb
-- src/ruby/spec/generic/active_call_spec.rb
-- src/ruby/spec/generic/rpc_server_spec.rb
-- src/ruby/spec/generic/server_interceptors_spec.rb
-- src/ruby/spec/generic/rpc_desc_spec.rb
-- src/ruby/spec/generic/interceptor_registry_spec.rb
-- src/ruby/spec/generic/service_spec.rb
-- src/ruby/spec/generic/client_interceptors_spec.rb
-- src/ruby/spec/generic/rpc_server_pool_spec.rb
-- src/ruby/spec/generic/client_stub_spec.rb
-- src/ruby/spec/spec_helper.rb
-- src/ruby/spec/testdata/server1.key
-- src/ruby/spec/testdata/client.pem
+- src/ruby/spec/client_auth_spec.rb
+- src/ruby/spec/server_spec.rb
+- src/ruby/spec/call_spec.rb
 - src/ruby/spec/testdata/README
 - src/ruby/spec/testdata/server1.pem
-- src/ruby/spec/testdata/client.key
+- src/ruby/spec/testdata/server1.key
+- src/ruby/spec/testdata/client.pem
 - src/ruby/spec/testdata/ca.pem
-- src/ruby/spec/client_server_spec.rb
-- src/ruby/spec/error_sanity_spec.rb
-- src/ruby/spec/server_credentials_spec.rb
-- src/ruby/spec/client_auth_spec.rb
-- src/ruby/spec/compression_options_spec.rb
-- src/ruby/spec/debug_message_spec.rb
+- src/ruby/spec/testdata/client.key