grpc 1.53.2 → 1.54.0

data/third_party/boringssl-with-bazel/src/ssl/s3_pkt.cc

@@ -126,10 +126,11 @@
 
 BSSL_NAMESPACE_BEGIN
 
-static int do_tls_write(SSL *ssl, int type, const uint8_t *in, unsigned len);
+static int do_tls_write(SSL *ssl, size_t *out_bytes_written, uint8_t type,
+                        Span<const uint8_t> in);
 
-int tls_write_app_data(SSL *ssl, bool *out_needs_handshake, const uint8_t *in,
-                       int len) {
+int tls_write_app_data(SSL *ssl, bool *out_needs_handshake,
+                       size_t *out_bytes_written, Span<const uint8_t> in) {
   assert(ssl_can_write(ssl));
   assert(!ssl->s3->aead_write_ctx->is_null_cipher());
 
@@ -140,33 +141,28 @@ int tls_write_app_data(SSL *ssl, bool *out_needs_handshake, const uint8_t *in,
     return -1;
   }
 
-  // TODO(davidben): Switch this logic to |size_t| and |bssl::Span|.
-  assert(ssl->s3->wnum <= INT_MAX);
-  unsigned tot = ssl->s3->wnum;
-  ssl->s3->wnum = 0;
-
-  // Ensure that if we end up with a smaller value of data to write out than
-  // the the original len from a write which didn't complete for non-blocking
-  // I/O and also somehow ended up avoiding the check for this in
-  // tls_write_pending/SSL_R_BAD_WRITE_RETRY as it must never be possible to
-  // end up with (len-tot) as a large number that will then promptly send
-  // beyond the end of the users buffer ... so we trap and report the error in
-  // a way the user will notice.
-  if (len < 0 || (size_t)len < tot) {
+  size_t total_bytes_written = ssl->s3->unreported_bytes_written;
+  if (in.size() < total_bytes_written) {
+    // This can happen if the caller disables |SSL_MODE_ENABLE_PARTIAL_WRITE|,
+    // asks us to write some input of length N, we successfully encrypt M bytes
+    // and write it, but fail to write the rest. We will report
+    // |SSL_ERROR_WANT_WRITE|. If the caller then retries with fewer than M
+    // bytes, we cannot satisfy that request. The caller is required to always
+    // retry with at least as many bytes as the previous attempt.
     OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_LENGTH);
     return -1;
   }
 
-  const int is_early_data_write =
-      !ssl->server && SSL_in_early_data(ssl) && ssl->s3->hs->can_early_write;
+  in = in.subspan(total_bytes_written);
 
-  unsigned n = len - tot;
+  const bool is_early_data_write =
+      !ssl->server && SSL_in_early_data(ssl) && ssl->s3->hs->can_early_write;
   for (;;) {
     size_t max_send_fragment = ssl->max_send_fragment;
     if (is_early_data_write) {
       SSL_HANDSHAKE *hs = ssl->s3->hs.get();
       if (hs->early_data_written >= hs->early_session->ticket_max_early_data) {
-        ssl->s3->wnum = tot;
+        ssl->s3->unreported_bytes_written = total_bytes_written;
         hs->can_early_write = false;
         *out_needs_handshake = true;
         return -1;
@@ -176,53 +172,63 @@ int tls_write_app_data(SSL *ssl, bool *out_needs_handshake, const uint8_t *in,
                                     hs->early_data_written});
     }
 
-    const size_t nw = std::min(max_send_fragment, size_t{n});
-    int ret = do_tls_write(ssl, SSL3_RT_APPLICATION_DATA, &in[tot], nw);
+    const size_t to_write = std::min(max_send_fragment, in.size());
+    size_t bytes_written;
+    int ret = do_tls_write(ssl, &bytes_written, SSL3_RT_APPLICATION_DATA,
+                           in.subspan(0, to_write));
     if (ret <= 0) {
-      ssl->s3->wnum = tot;
+      ssl->s3->unreported_bytes_written = total_bytes_written;
       return ret;
     }
 
+    // Note |bytes_written| may be less than |to_write| if there was a pending
+    // record from a smaller write attempt.
+    assert(bytes_written <= to_write);
+    total_bytes_written += bytes_written;
+    in = in.subspan(bytes_written);
     if (is_early_data_write) {
-      ssl->s3->hs->early_data_written += ret;
+      ssl->s3->hs->early_data_written += bytes_written;
     }
 
-    if (ret == (int)n || (ssl->mode & SSL_MODE_ENABLE_PARTIAL_WRITE)) {
-      return tot + ret;
+    if (in.empty() || (ssl->mode & SSL_MODE_ENABLE_PARTIAL_WRITE)) {
+      ssl->s3->unreported_bytes_written = 0;
+      *out_bytes_written = total_bytes_written;
+      return 1;
     }
-
-    n -= ret;
-    tot += ret;
   }
 }
 
-static int tls_write_pending(SSL *ssl, int type, const uint8_t *in,
-                             unsigned int len) {
-  if (ssl->s3->wpend_tot > (int)len ||
-      (!(ssl->mode & SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER) &&
-       ssl->s3->wpend_buf != in) ||
-      ssl->s3->wpend_type != type) {
+// do_tls_write writes an SSL record of the given type. On success, it sets
+// |*out_bytes_written| to number of bytes successfully written and returns one.
+// On error, it returns a value <= 0 from the underlying |BIO|.
+static int do_tls_write(SSL *ssl, size_t *out_bytes_written, uint8_t type,
+                        Span<const uint8_t> in) {
+  // If there is a pending write, the retry must be consistent.
+  if (!ssl->s3->pending_write.empty() &&
+      (ssl->s3->pending_write.size() > in.size() ||
+       (!(ssl->mode & SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER) &&
+        ssl->s3->pending_write.data() != in.data()) ||
+       ssl->s3->pending_write_type != type)) {
     OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_WRITE_RETRY);
     return -1;
   }
 
+  // Flush any unwritten data to the transport. There may be data to flush even
+  // if |wpend_tot| is zero.
   int ret = ssl_write_buffer_flush(ssl);
   if (ret <= 0) {
     return ret;
   }
-  ssl->s3->wpend_pending = false;
-  return ssl->s3->wpend_ret;
-}
 
-// do_tls_write writes an SSL record of the given type.
-static int do_tls_write(SSL *ssl, int type, const uint8_t *in, unsigned len) {
-  // If there is still data from the previous record, flush it.
-  if (ssl->s3->wpend_pending) {
-    return tls_write_pending(ssl, type, in, len);
+  // If there is a pending write, we just completed it. Report it to the caller.
+  if (!ssl->s3->pending_write.empty()) {
+    *out_bytes_written = ssl->s3->pending_write.size();
+    ssl->s3->pending_write = {};
+    return 1;
   }
 
   SSLBuffer *buf = &ssl->s3->write_buffer;
-  if (len > SSL3_RT_MAX_PLAIN_LENGTH || buf->size() > 0) {
+  if (in.size() > SSL3_RT_MAX_PLAIN_LENGTH || buf->size() > 0) {
     OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
     return -1;
   }
@@ -231,16 +237,22 @@ static int do_tls_write(SSL *ssl, int type, const uint8_t *in, unsigned len) {
     return -1;
   }
 
-  size_t flight_len = 0;
+  // We may have unflushed handshake data that must be written before |in|. This
+  // may be a KeyUpdate acknowledgment, 0-RTT key change messages, or a
+  // NewSessionTicket.
+  Span<const uint8_t> pending_flight;
   if (ssl->s3->pending_flight != nullptr) {
-    flight_len =
-        ssl->s3->pending_flight->length - ssl->s3->pending_flight_offset;
+    pending_flight = MakeConstSpan(
+        reinterpret_cast<const uint8_t *>(ssl->s3->pending_flight->data),
+        ssl->s3->pending_flight->length);
+    pending_flight = pending_flight.subspan(ssl->s3->pending_flight_offset);
   }
 
-  size_t max_out = flight_len;
-  if (len > 0) {
-    const size_t max_ciphertext_len = len + SSL_max_seal_overhead(ssl);
-    if (max_ciphertext_len < len || max_out + max_ciphertext_len < max_out) {
+  size_t max_out = pending_flight.size();
+  if (!in.empty()) {
+    const size_t max_ciphertext_len = in.size() + SSL_max_seal_overhead(ssl);
+    if (max_ciphertext_len < in.size() ||
+        max_out + max_ciphertext_len < max_out) {
       OPENSSL_PUT_ERROR(SSL, ERR_R_OVERFLOW);
       return -1;
     }
@@ -248,31 +260,29 @@ static int do_tls_write(SSL *ssl, int type, const uint8_t *in, unsigned len) {
   }
 
   if (max_out == 0) {
-    return 0;
+    // Nothing to write.
+    *out_bytes_written = 0;
+    return 1;
   }
 
-  if (!buf->EnsureCap(flight_len + ssl_seal_align_prefix_len(ssl), max_out)) {
+  if (!buf->EnsureCap(pending_flight.size() + ssl_seal_align_prefix_len(ssl),
+                      max_out)) {
     return -1;
   }
 
-  // Add any unflushed handshake data as a prefix. This may be a KeyUpdate
-  // acknowledgment or 0-RTT key change messages. |pending_flight| must be clear
-  // when data is added to |write_buffer| or it will be written in the wrong
-  // order.
-  if (ssl->s3->pending_flight != nullptr) {
-    OPENSSL_memcpy(
-        buf->remaining().data(),
-        ssl->s3->pending_flight->data + ssl->s3->pending_flight_offset,
-        flight_len);
+  // Copy |pending_flight| to the output.
+  if (!pending_flight.empty()) {
+    OPENSSL_memcpy(buf->remaining().data(), pending_flight.data(),
+                   pending_flight.size());
     ssl->s3->pending_flight.reset();
     ssl->s3->pending_flight_offset = 0;
-    buf->DidWrite(flight_len);
+    buf->DidWrite(pending_flight.size());
   }
 
-  if (len > 0) {
+  if (!in.empty()) {
     size_t ciphertext_len;
     if (!tls_seal_record(ssl, buf->remaining().data(), &ciphertext_len,
-                         buf->remaining().size(), type, in, len)) {
+                         buf->remaining().size(), type, in.data(), in.size())) {
       return -1;
     }
     buf->DidWrite(ciphertext_len);
@@ -282,16 +292,19 @@ static int do_tls_write(SSL *ssl, int type, const uint8_t *in, unsigned len) {
   // acknowledgments.
   ssl->s3->key_update_pending = false;
 
-  // Memorize arguments so that tls_write_pending can detect bad write retries
-  // later.
-  ssl->s3->wpend_tot = len;
-  ssl->s3->wpend_buf = in;
-  ssl->s3->wpend_type = type;
-  ssl->s3->wpend_ret = len;
-  ssl->s3->wpend_pending = true;
+  // Flush the write buffer.
+  ret = ssl_write_buffer_flush(ssl);
+  if (ret <= 0) {
+    // Track the unfinished write.
+    if (!in.empty()) {
+      ssl->s3->pending_write = in;
+      ssl->s3->pending_write_type = type;
+    }
+    return ret;
+  }
 
-  // We now just need to write the buffer.
-  return tls_write_pending(ssl, type, in, len);
+  *out_bytes_written = in.size();
+  return 1;
 }
 
 ssl_open_record_t tls_open_app_data(SSL *ssl, Span<uint8_t> *out,
@@ -429,10 +442,13 @@ int tls_dispatch_alert(SSL *ssl) {
       return 0;
     }
   } else {
-    int ret = do_tls_write(ssl, SSL3_RT_ALERT, &ssl->s3->send_alert[0], 2);
+    size_t bytes_written;
+    int ret =
+        do_tls_write(ssl, &bytes_written, SSL3_RT_ALERT, ssl->s3->send_alert);
     if (ret <= 0) {
       return ret;
     }
+    assert(bytes_written == 2);
   }
 
   ssl->s3->alert_dispatch = false;

data/third_party/boringssl-with-bazel/src/ssl/ssl_aead_ctx.cc

@@ -91,7 +91,6 @@ UniquePtr<SSLAEADContext> SSLAEADContext::Create(
   UniquePtr<SSLAEADContext> aead_ctx =
       MakeUnique<SSLAEADContext>(version, is_dtls, cipher);
   if (!aead_ctx) {
-    OPENSSL_PUT_ERROR(SSL, ERR_R_MALLOC_FAILURE);
     return nullptr;
   }
 
@@ -220,13 +219,13 @@ size_t SSLAEADContext::MaxOverhead() const {
 }
 
 Span<const uint8_t> SSLAEADContext::GetAdditionalData(
-    uint8_t storage[13], uint8_t type, uint16_t record_version,
-    const uint8_t seqnum[8], size_t plaintext_len, Span<const uint8_t> header) {
+    uint8_t storage[13], uint8_t type, uint16_t record_version, uint64_t seqnum,
+    size_t plaintext_len, Span<const uint8_t> header) {
   if (ad_is_header_) {
     return header;
   }
 
-  OPENSSL_memcpy(storage, seqnum, 8);
+  CRYPTO_store_u64_be(storage, seqnum);
   size_t len = 8;
   storage[len++] = type;
   storage[len++] = static_cast<uint8_t>((record_version >> 8));
@@ -239,7 +238,7 @@ Span<const uint8_t> SSLAEADContext::GetAdditionalData(
 }
 
 bool SSLAEADContext::Open(Span<uint8_t> *out, uint8_t type,
-                          uint16_t record_version, const uint8_t seqnum[8],
+                          uint16_t record_version, uint64_t seqnum,
                           Span<const uint8_t> header, Span<uint8_t> in) {
   if (is_null_cipher() || FUZZER_MODE) {
     // Handle the initial NULL cipher.
@@ -288,7 +287,7 @@ bool SSLAEADContext::Open(Span<uint8_t> *out, uint8_t type,
     in = in.subspan(variable_nonce_len_);
   } else {
     assert(variable_nonce_len_ == 8);
-    OPENSSL_memcpy(nonce + nonce_len, seqnum, variable_nonce_len_);
+    CRYPTO_store_u64_be(nonce + nonce_len, seqnum);
   }
   nonce_len += variable_nonce_len_;
 
@@ -313,8 +312,7 @@ bool SSLAEADContext::Open(Span<uint8_t> *out, uint8_t type,
 
 bool SSLAEADContext::SealScatter(uint8_t *out_prefix, uint8_t *out,
                                  uint8_t *out_suffix, uint8_t type,
-                                 uint16_t record_version,
-                                 const uint8_t seqnum[8],
+                                 uint16_t record_version, uint64_t seqnum,
                                  Span<const uint8_t> header, const uint8_t *in,
                                  size_t in_len, const uint8_t *extra_in,
                                  size_t extra_in_len) {
@@ -365,7 +363,7 @@ bool SSLAEADContext::SealScatter(uint8_t *out_prefix, uint8_t *out,
     // When sending we use the sequence number as the variable part of the
     // nonce.
     assert(variable_nonce_len_ == 8);
-    OPENSSL_memcpy(nonce + nonce_len, seqnum, variable_nonce_len_);
+    CRYPTO_store_u64_be(nonce + nonce_len, seqnum);
   }
   nonce_len += variable_nonce_len_;
 
@@ -398,7 +396,7 @@ bool SSLAEADContext::SealScatter(uint8_t *out_prefix, uint8_t *out,
 
 bool SSLAEADContext::Seal(uint8_t *out, size_t *out_len, size_t max_out_len,
                           uint8_t type, uint16_t record_version,
-                          const uint8_t seqnum[8], Span<const uint8_t> header,
+                          uint64_t seqnum, Span<const uint8_t> header,
                           const uint8_t *in, size_t in_len) {
   const size_t prefix_len = ExplicitNonceLen();
   size_t suffix_len;