grpc 1.66.0 → 1.67.0.pre1

data/third_party/boringssl-with-bazel/src/ssl/ssl_buffer.cc

@@ -172,14 +172,17 @@ int ssl_read_buffer_extend_to(SSL *ssl, size_t len) {
 
   if (SSL_is_dtls(ssl)) {
     static_assert(
-        DTLS1_RT_HEADER_LENGTH + SSL3_RT_MAX_ENCRYPTED_LENGTH <= 0xffff,
+        DTLS1_RT_MAX_HEADER_LENGTH + SSL3_RT_MAX_ENCRYPTED_LENGTH <= 0xffff,
         "DTLS read buffer is too large");
 
     // The |len| parameter is ignored in DTLS.
-    len = DTLS1_RT_HEADER_LENGTH + SSL3_RT_MAX_ENCRYPTED_LENGTH;
+    len = DTLS1_RT_MAX_HEADER_LENGTH + SSL3_RT_MAX_ENCRYPTED_LENGTH;
   }
 
-  if (!ssl->s3->read_buffer.EnsureCap(ssl_record_prefix_len(ssl), len)) {
+  // The DTLS record header can have a variable length, so the |header_len|
+  // value provided for buffer alignment only works if the header is the maximum
+  // length.
+  if (!ssl->s3->read_buffer.EnsureCap(DTLS1_RT_MAX_HEADER_LENGTH, len)) {
     return -1;
   }
 
@@ -252,7 +255,7 @@ static_assert(SSL3_RT_HEADER_LENGTH * 2 +
                   0xffff,
               "maximum TLS write buffer is too large");
 
-static_assert(DTLS1_RT_HEADER_LENGTH + SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD +
+static_assert(DTLS1_RT_MAX_HEADER_LENGTH + SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD +
                       SSL3_RT_MAX_PLAIN_LENGTH <=
                   0xffff,
               "maximum DTLS write buffer is too large");

data/third_party/boringssl-with-bazel/src/ssl/ssl_key_share.cc

@@ -28,6 +28,7 @@
 #include <openssl/experimental/kyber.h>
 #include <openssl/hrss.h>
 #include <openssl/mem.h>
+#include <openssl/mlkem.h>
 #include <openssl/nid.h>
 #include <openssl/rand.h>
 #include <openssl/span.h>
@@ -192,6 +193,7 @@ class X25519KeyShare : public SSLKeyShare {
   uint8_t private_key_[32];
 };
 
+// draft-tls-westerbaan-xyber768d00-03
 class X25519Kyber768KeyShare : public SSLKeyShare {
  public:
   X25519Kyber768KeyShare() {}
@@ -225,9 +227,7 @@ class X25519Kyber768KeyShare : public SSLKeyShare {
     uint8_t x25519_public_key[32];
     X25519_keypair(x25519_public_key, x25519_private_key_);
     KYBER_public_key peer_kyber_pub;
-    CBS peer_key_cbs;
-    CBS peer_x25519_cbs;
-    CBS peer_kyber_cbs;
+    CBS peer_key_cbs, peer_x25519_cbs, peer_kyber_cbs;
     CBS_init(&peer_key_cbs, peer_key.data(), peer_key.size());
     if (!CBS_get_bytes(&peer_key_cbs, &peer_x25519_cbs, 32) ||
         !CBS_get_bytes(&peer_key_cbs, &peer_kyber_cbs,
@@ -282,6 +282,97 @@ class X25519Kyber768KeyShare : public SSLKeyShare {
   KYBER_private_key kyber_private_key_;
 };
 
+// draft-kwiatkowski-tls-ecdhe-mlkem-01
+class X25519MLKEM768KeyShare : public SSLKeyShare {
+ public:
+  X25519MLKEM768KeyShare() {}
+
+  uint16_t GroupID() const override { return SSL_GROUP_X25519_MLKEM768; }
+
+  bool Generate(CBB *out) override {
+    uint8_t mlkem_public_key[MLKEM768_PUBLIC_KEY_BYTES];
+    MLKEM768_generate_key(mlkem_public_key, /*optional_out_seed=*/nullptr,
+                          &mlkem_private_key_);
+
+    uint8_t x25519_public_key[X25519_PUBLIC_VALUE_LEN];
+    X25519_keypair(x25519_public_key, x25519_private_key_);
+
+    if (!CBB_add_bytes(out, mlkem_public_key, sizeof(mlkem_public_key)) ||
+        !CBB_add_bytes(out, x25519_public_key, sizeof(x25519_public_key))) {
+      return false;
+    }
+
+    return true;
+  }
+
+  bool Encap(CBB *out_ciphertext, Array<uint8_t> *out_secret,
+             uint8_t *out_alert, Span<const uint8_t> peer_key) override {
+    Array<uint8_t> secret;
+    if (!secret.Init(MLKEM_SHARED_SECRET_BYTES + X25519_SHARED_KEY_LEN)) {
+      return false;
+    }
+
+    MLKEM768_public_key peer_mlkem_pub;
+    uint8_t x25519_public_key[X25519_PUBLIC_VALUE_LEN];
+    X25519_keypair(x25519_public_key, x25519_private_key_);
+    CBS peer_key_cbs, peer_mlkem_cbs, peer_x25519_cbs;
+    CBS_init(&peer_key_cbs, peer_key.data(), peer_key.size());
+    if (!CBS_get_bytes(&peer_key_cbs, &peer_mlkem_cbs,
+                       MLKEM768_PUBLIC_KEY_BYTES) ||
+        !MLKEM768_parse_public_key(&peer_mlkem_pub, &peer_mlkem_cbs) ||
+        !CBS_get_bytes(&peer_key_cbs, &peer_x25519_cbs,
+                       X25519_PUBLIC_VALUE_LEN) ||
+        CBS_len(&peer_key_cbs) != 0 ||
+        !X25519(secret.data() + MLKEM_SHARED_SECRET_BYTES, x25519_private_key_,
+                CBS_data(&peer_x25519_cbs))) {
+      *out_alert = SSL_AD_DECODE_ERROR;
+      OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_ECPOINT);
+      return false;
+    }
+
+    uint8_t mlkem_ciphertext[MLKEM768_CIPHERTEXT_BYTES];
+    MLKEM768_encap(mlkem_ciphertext, secret.data(), &peer_mlkem_pub);
+
+    if (!CBB_add_bytes(out_ciphertext, mlkem_ciphertext,
+                       sizeof(mlkem_ciphertext)) ||
+        !CBB_add_bytes(out_ciphertext, x25519_public_key,
+                       sizeof(x25519_public_key))) {
+      return false;
+    }
+
+    *out_secret = std::move(secret);
+    return true;
+  }
+
+  bool Decap(Array<uint8_t> *out_secret, uint8_t *out_alert,
+             Span<const uint8_t> ciphertext) override {
+    *out_alert = SSL_AD_INTERNAL_ERROR;
+
+    Array<uint8_t> secret;
+    if (!secret.Init(MLKEM_SHARED_SECRET_BYTES + X25519_SHARED_KEY_LEN)) {
+      return false;
+    }
+
+    if (ciphertext.size() !=
+            MLKEM768_CIPHERTEXT_BYTES + X25519_PUBLIC_VALUE_LEN ||
+        !MLKEM768_decap(secret.data(), ciphertext.data(),
+                        MLKEM768_CIPHERTEXT_BYTES, &mlkem_private_key_) ||
+        !X25519(secret.data() + MLKEM_SHARED_SECRET_BYTES, x25519_private_key_,
+                ciphertext.data() + MLKEM768_CIPHERTEXT_BYTES)) {
+      *out_alert = SSL_AD_DECODE_ERROR;
+      OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_ECPOINT);
+      return false;
+    }
+
+    *out_secret = std::move(secret);
+    return true;
+  }
+
+ private:
+  uint8_t x25519_private_key_[32];
+  MLKEM768_private_key mlkem_private_key_;
+};
+
 constexpr NamedGroup kNamedGroups[] = {
     {NID_secp224r1, SSL_GROUP_SECP224R1, "P-224", "secp224r1"},
     {NID_X9_62_prime256v1, SSL_GROUP_SECP256R1, "P-256", "prime256v1"},
@@ -290,6 +381,7 @@ constexpr NamedGroup kNamedGroups[] = {
     {NID_X25519, SSL_GROUP_X25519, "X25519", "x25519"},
     {NID_X25519Kyber768Draft00, SSL_GROUP_X25519_KYBER768_DRAFT00,
      "X25519Kyber768Draft00", ""},
+    {NID_X25519MLKEM768, SSL_GROUP_X25519_MLKEM768, "X25519MLKEM768", ""},
 };
 
 }  // namespace
@@ -312,6 +404,8 @@ UniquePtr<SSLKeyShare> SSLKeyShare::Create(uint16_t group_id) {
       return MakeUnique<X25519KeyShare>();
     case SSL_GROUP_X25519_KYBER768_DRAFT00:
       return MakeUnique<X25519Kyber768KeyShare>();
+    case SSL_GROUP_X25519_MLKEM768:
+      return MakeUnique<X25519MLKEM768KeyShare>();
     default:
       return nullptr;
   }

data/third_party/boringssl-with-bazel/src/ssl/ssl_lib.cc

@@ -2954,8 +2954,18 @@ int SSL_get_ivs(const SSL *ssl, const uint8_t **out_read_iv,
 
 uint64_t SSL_get_read_sequence(const SSL *ssl) {
   if (SSL_is_dtls(ssl)) {
-    // max_seq_num already includes the epoch.
-    assert(ssl->d1->r_epoch == (ssl->d1->bitmap.max_seq_num >> 48));
+    // TODO(crbug.com/42290608): The API for read sequences in DTLS 1.3 needs to
+    // reworked. In DTLS 1.3, the read epoch is updated once new keys are
+    // derived (before we receive a message encrypted with those keys), which
+    // results in the read epoch being ahead of the highest record received.
+    // Additionally, when we process a KeyUpdate, we will install new read keys
+    // for the new epoch, but we may receive messages from the old epoch for
+    // some time if the ACK gets lost or there is reordering.
+
+    // max_seq_num already includes the epoch. However, the current epoch may
+    // be one ahead of the highest record received, immediately after a key
+    // change.
+    assert(ssl->d1->r_epoch >= ssl->d1->bitmap.max_seq_num >> 48);
     return ssl->d1->bitmap.max_seq_num;
   }
   return ssl->s3->read_sequence;
@@ -3393,6 +3403,21 @@ static int Configure(SSL *ssl) {
 
 }  // namespace wpa202304
 
+namespace cnsa202407 {
+
+static int Configure(SSL_CTX *ctx) {
+  ctx->tls13_cipher_policy = ssl_compliance_policy_cnsa_202407;
+  return 1;
+}
+
+static int Configure(SSL *ssl) {
+  ssl->config->tls13_cipher_policy =
+      ssl_compliance_policy_cnsa_202407;
+  return 1;
+}
+
+}
+
 int SSL_CTX_set_compliance_policy(SSL_CTX *ctx,
                                   enum ssl_compliance_policy_t policy) {
   switch (policy) {
@@ -3400,6 +3425,8 @@ int SSL_CTX_set_compliance_policy(SSL_CTX *ctx,
       return fips202205::Configure(ctx);
     case ssl_compliance_policy_wpa3_192_202304:
       return wpa202304::Configure(ctx);
+    case ssl_compliance_policy_cnsa_202407:
+      return cnsa202407::Configure(ctx);
     default:
       return 0;
   }
@@ -3411,6 +3438,8 @@ int SSL_set_compliance_policy(SSL *ssl, enum ssl_compliance_policy_t policy) {
       return fips202205::Configure(ssl);
     case ssl_compliance_policy_wpa3_192_202304:
       return wpa202304::Configure(ssl);
+    case ssl_compliance_policy_cnsa_202407:
+      return cnsa202407::Configure(ssl);
     default:
       return 0;
   }

data/third_party/boringssl-with-bazel/src/ssl/ssl_versions.cc

@@ -46,6 +46,10 @@ bool ssl_protocol_version_from_wire(uint16_t *out, uint16_t version) {
       *out = TLS1_2_VERSION;
       return true;
 
+    case DTLS1_3_EXPERIMENTAL_VERSION:
+      *out = TLS1_3_VERSION;
+      return true;
+
     default:
       return false;
   }
@@ -62,6 +66,7 @@ static const uint16_t kTLSVersions[] = {
 };
 
 static const uint16_t kDTLSVersions[] = {
+    DTLS1_3_EXPERIMENTAL_VERSION,
     DTLS1_2_VERSION,
     DTLS1_VERSION,
 };
@@ -99,6 +104,7 @@ static const VersionInfo kVersionNames[] = {
     {TLS1_VERSION, "TLSv1"},
     {DTLS1_VERSION, "DTLSv1"},
     {DTLS1_2_VERSION, "DTLSv1.2"},
+    {DTLS1_3_EXPERIMENTAL_VERSION, "DTLSv1.3"},
 };
 
 static const char *ssl_version_to_string(uint16_t version) {

data/third_party/boringssl-with-bazel/src/ssl/tls13_client.cc

@@ -107,11 +107,24 @@ static bool parse_server_hello_tls13(const SSL_HANDSHAKE *hs,
   if (!ssl_parse_server_hello(out, out_alert, msg)) {
     return false;
   }
+  uint16_t server_hello_version = TLS1_2_VERSION;
+  if (SSL_is_dtls(hs->ssl)) {
+    server_hello_version = DTLS1_2_VERSION;
+  }
+  // DTLS 1.3 disables "compatibility mode" (RFC 8446, appendix D.4). When
+  // disabled, servers MUST NOT echo the legacy_session_id (RFC 9147, section
+  // 5). The client could have sent a session ID indicating its willingness to
+  // resume a DTLS 1.2 session, so just checking that the session IDs match is
+  // incorrect.
+  bool session_id_match =
+      (SSL_is_dtls(hs->ssl) && CBS_len(&out->session_id) == 0) ||
+      (!SSL_is_dtls(hs->ssl) &&
+       CBS_mem_equal(&out->session_id, hs->session_id, hs->session_id_len));
+
   // The RFC8446 version of the structure fixes some legacy values.
   // Additionally, the session ID must echo the original one.
-  if (out->legacy_version != TLS1_2_VERSION ||
-      out->compression_method != 0 ||
-      !CBS_mem_equal(&out->session_id, hs->session_id, hs->session_id_len) ||
+  if (out->legacy_version != server_hello_version ||
+      out->compression_method != 0 || !session_id_match ||
       CBS_len(&out->extensions) == 0) {
     OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
     *out_alert = SSL_AD_DECODE_ERROR;
@@ -1117,7 +1130,8 @@ UniquePtr<SSL_SESSION> tls13_create_session_with_ticket(SSL *ssl, CBS *body) {
     session->timeout = server_timeout;
   }
 
-  if (!tls13_derive_session_psk(session.get(), ticket_nonce)) {
+  if (!tls13_derive_session_psk(session.get(), ticket_nonce,
+                                SSL_is_dtls(ssl))) {
     return nullptr;
   }
 

data/third_party/boringssl-with-bazel/src/ssl/tls13_enc.cc

@@ -92,10 +92,50 @@ static Span<const char> label_to_span(const char *label) {
   return MakeConstSpan(label, strlen(label));
 }
 
+static bool hkdf_expand_label_with_prefix(Span<uint8_t> out,
+                                          const EVP_MD *digest,
+                                          Span<const uint8_t> secret,
+                                          Span<const uint8_t> label_prefix,
+                                          Span<const char> label,
+                                          Span<const uint8_t> hash) {
+  // This is a copy of CRYPTO_tls13_hkdf_expand_label, but modified to take an
+  // arbitrary prefix for the label instead of using the hardcoded "tls13 "
+  // prefix.
+  CBB cbb, child;
+  uint8_t *hkdf_label = NULL;
+  size_t hkdf_label_len;
+  CBB_zero(&cbb);
+  if (!CBB_init(&cbb,
+                2 + 1 + label_prefix.size() + label.size() + 1 + hash.size()) ||
+      !CBB_add_u16(&cbb, out.size()) ||
+      !CBB_add_u8_length_prefixed(&cbb, &child) ||
+      !CBB_add_bytes(&child, label_prefix.data(), label_prefix.size()) ||
+      !CBB_add_bytes(&child, reinterpret_cast<const uint8_t *>(label.data()),
+                     label.size()) ||
+      !CBB_add_u8_length_prefixed(&cbb, &child) ||
+      !CBB_add_bytes(&child, hash.data(), hash.size()) ||
+      !CBB_finish(&cbb, &hkdf_label, &hkdf_label_len)) {
+    CBB_cleanup(&cbb);
+    return false;
+  }
+
+  const int ret = HKDF_expand(out.data(), out.size(), digest, secret.data(),
+                              secret.size(), hkdf_label, hkdf_label_len);
+  OPENSSL_free(hkdf_label);
+  return ret == 1;
+}
+
 static bool hkdf_expand_label(Span<uint8_t> out, const EVP_MD *digest,
                               Span<const uint8_t> secret,
-                              Span<const char> label,
-                              Span<const uint8_t> hash) {
+                              Span<const char> label, Span<const uint8_t> hash,
+                              bool is_dtls) {
+  if (is_dtls) {
+    static const uint8_t kDTLS13LabelPrefix[] = "dtls13";
+    return hkdf_expand_label_with_prefix(
+        out, digest, secret,
+        MakeConstSpan(kDTLS13LabelPrefix, sizeof(kDTLS13LabelPrefix) - 1),
+        label, hash);
+  }
   return CRYPTO_tls13_hkdf_expand_label(
       out.data(), out.size(), digest, secret.data(), secret.size(),
       reinterpret_cast<const uint8_t *>(label.data()), label.size(),
@@ -111,7 +151,8 @@ bool tls13_advance_key_schedule(SSL_HANDSHAKE *hs, Span<const uint8_t> in) {
                     hs->transcript.Digest(), nullptr) &&
          hkdf_expand_label(hs->secret(), hs->transcript.Digest(), hs->secret(),
                            label_to_span(kTLS13LabelDerived),
-                           MakeConstSpan(derive_context, derive_context_len)) &&
+                           MakeConstSpan(derive_context, derive_context_len),
+                           SSL_is_dtls(hs->ssl)) &&
          hkdf_extract_to_secret(hs, hs->transcript, in);
 }
 
@@ -129,7 +170,8 @@ static bool derive_secret_with_transcript(const SSL_HANDSHAKE *hs,
   }
 
   return hkdf_expand_label(out, transcript.Digest(), hs->secret(), label,
-                           MakeConstSpan(context_hash, context_hash_len));
+                           MakeConstSpan(context_hash, context_hash_len),
+                           SSL_is_dtls(hs->ssl));
 }
 
 static bool derive_secret(SSL_HANDSHAKE *hs, Span<uint8_t> out,
@@ -142,6 +184,8 @@ bool tls13_set_traffic_key(SSL *ssl, enum ssl_encryption_level_t level,
                            const SSL_SESSION *session,
                            Span<const uint8_t> traffic_secret) {
   uint16_t version = ssl_session_protocol_version(session);
+  const EVP_MD *digest = ssl_session_get_digest(session);
+  bool is_dtls = SSL_is_dtls(ssl);
   UniquePtr<SSLAEADContext> traffic_aead;
   Span<const uint8_t> secret_for_quic;
   if (ssl->quic_method != nullptr) {
@@ -155,18 +199,16 @@ bool tls13_set_traffic_key(SSL *ssl, enum ssl_encryption_level_t level,
     const EVP_AEAD *aead;
     size_t discard;
     if (!ssl_cipher_get_evp_aead(&aead, &discard, &discard, session->cipher,
-                                 version, SSL_is_dtls(ssl))) {
+                                 version, is_dtls)) {
       return false;
     }
 
-    const EVP_MD *digest = ssl_session_get_digest(session);
-
     // Derive the key.
     size_t key_len = EVP_AEAD_key_length(aead);
     uint8_t key_buf[EVP_AEAD_MAX_KEY_LENGTH];
     auto key = MakeSpan(key_buf, key_len);
     if (!hkdf_expand_label(key, digest, traffic_secret, label_to_span("key"),
-                           {})) {
+                           {}, is_dtls)) {
       return false;
     }
 
@@ -174,20 +216,35 @@ bool tls13_set_traffic_key(SSL *ssl, enum ssl_encryption_level_t level,
     size_t iv_len = EVP_AEAD_nonce_length(aead);
     uint8_t iv_buf[EVP_AEAD_MAX_NONCE_LENGTH];
     auto iv = MakeSpan(iv_buf, iv_len);
-    if (!hkdf_expand_label(iv, digest, traffic_secret, label_to_span("iv"),
-                           {})) {
+    if (!hkdf_expand_label(iv, digest, traffic_secret, label_to_span("iv"), {},
+                           is_dtls)) {
       return false;
     }
 
-    traffic_aead = SSLAEADContext::Create(direction, session->ssl_version,
-                                          SSL_is_dtls(ssl), session->cipher,
-                                          key, Span<const uint8_t>(), iv);
+    traffic_aead =
+        SSLAEADContext::Create(direction, session->ssl_version, is_dtls,
+                               session->cipher, key, Span<const uint8_t>(), iv);
   }
 
   if (!traffic_aead) {
     return false;
   }
 
+  if (is_dtls) {
+    RecordNumberEncrypter *rn_encrypter =
+        traffic_aead->GetRecordNumberEncrypter();
+    if (!rn_encrypter) {
+      return false;
+    }
+    Array<uint8_t> rne_key;
+    if (!rne_key.Init(rn_encrypter->KeySize()) ||
+        !hkdf_expand_label(MakeSpan(rne_key), digest, traffic_secret,
+                           label_to_span("sn"), {}, is_dtls) ||
+        !rn_encrypter->SetKey(MakeSpan(rne_key))) {
+      return false;
+    }
+  }
+
   if (traffic_secret.size() >
           OPENSSL_ARRAY_SIZE(ssl->s3->read_traffic_secret) ||
       traffic_secret.size() >
@@ -297,7 +354,8 @@ bool tls13_rotate_traffic_key(SSL *ssl, enum evp_aead_direction_t direction) {
   const SSL_SESSION *session = SSL_get_session(ssl);
   const EVP_MD *digest = ssl_session_get_digest(session);
   return hkdf_expand_label(secret, digest, secret,
-                           label_to_span(kTLS13LabelApplicationTraffic), {}) &&
+                           label_to_span(kTLS13LabelApplicationTraffic), {},
+                           SSL_is_dtls(ssl)) &&
          tls13_set_traffic_key(ssl, ssl_encryption_application, direction,
                                session, secret);
 }
@@ -323,12 +381,12 @@ static const char kTLS13LabelFinished[] = "finished";
 static bool tls13_verify_data(uint8_t *out, size_t *out_len,
                               const EVP_MD *digest, uint16_t version,
                               Span<const uint8_t> secret,
-                              Span<const uint8_t> context) {
+                              Span<const uint8_t> context, bool is_dtls) {
   uint8_t key_buf[EVP_MAX_MD_SIZE];
   auto key = MakeSpan(key_buf, EVP_MD_size(digest));
   unsigned len;
   if (!hkdf_expand_label(key, digest, secret,
-                         label_to_span(kTLS13LabelFinished), {}) ||
+                         label_to_span(kTLS13LabelFinished), {}, is_dtls) ||
       HMAC(digest, key.data(), key.size(), context.data(), context.size(), out,
            &len) == nullptr) {
     return false;
@@ -347,7 +405,8 @@ bool tls13_finished_mac(SSL_HANDSHAKE *hs, uint8_t *out, size_t *out_len,
   if (!hs->transcript.GetHash(context_hash, &context_hash_len) ||
       !tls13_verify_data(out, out_len, hs->transcript.Digest(),
                          hs->ssl->version, traffic_secret,
-                         MakeConstSpan(context_hash, context_hash_len))) {
+                         MakeConstSpan(context_hash, context_hash_len),
+                         SSL_is_dtls(hs->ssl))) {
     return false;
   }
   return true;
@@ -355,13 +414,15 @@ bool tls13_finished_mac(SSL_HANDSHAKE *hs, uint8_t *out, size_t *out_len,
 
 static const char kTLS13LabelResumptionPSK[] = "resumption";
 
-bool tls13_derive_session_psk(SSL_SESSION *session, Span<const uint8_t> nonce) {
+bool tls13_derive_session_psk(SSL_SESSION *session, Span<const uint8_t> nonce,
+                              bool is_dtls) {
   const EVP_MD *digest = ssl_session_get_digest(session);
   // The session initially stores the resumption_master_secret, which we
   // override with the PSK.
   auto session_secret = MakeSpan(session->secret, session->secret_length);
   return hkdf_expand_label(session_secret, digest, session_secret,
-                           label_to_span(kTLS13LabelResumptionPSK), nonce);
+                           label_to_span(kTLS13LabelResumptionPSK), nonce,
+                           is_dtls);
 }
 
 static const char kTLS13LabelExportKeying[] = "exporter";
@@ -394,9 +455,10 @@ bool tls13_export_keying_material(SSL *ssl, Span<uint8_t> out,
   uint8_t derived_secret_buf[EVP_MAX_MD_SIZE];
   auto derived_secret = MakeSpan(derived_secret_buf, EVP_MD_size(digest));
   return hkdf_expand_label(derived_secret, digest, secret, label,
-                           export_context) &&
+                           export_context, SSL_is_dtls(ssl)) &&
          hkdf_expand_label(out, digest, derived_secret,
-                           label_to_span(kTLS13LabelExportKeying), hash);
+                           label_to_span(kTLS13LabelExportKeying), hash,
+                           SSL_is_dtls(ssl));
 }
 
 static const char kTLS13LabelPSKBinder[] = "res binder";
@@ -405,7 +467,7 @@ static bool tls13_psk_binder(uint8_t *out, size_t *out_len,
                              const SSL_SESSION *session,
                              const SSLTranscript &transcript,
                              Span<const uint8_t> client_hello,
-                             size_t binders_len) {
+                             size_t binders_len, bool is_dtls) {
   const EVP_MD *digest = ssl_session_get_digest(session);
 
   // Compute the binder key.
@@ -422,10 +484,10 @@ static bool tls13_psk_binder(uint8_t *out, size_t *out_len,
                   nullptr) ||
       !HKDF_extract(early_secret, &early_secret_len, digest, session->secret,
                     session->secret_length, nullptr, 0) ||
-      !hkdf_expand_label(binder_key, digest,
-                         MakeConstSpan(early_secret, early_secret_len),
-                         label_to_span(kTLS13LabelPSKBinder),
-                         MakeConstSpan(binder_context, binder_context_len))) {
+      !hkdf_expand_label(
+          binder_key, digest, MakeConstSpan(early_secret, early_secret_len),
+          label_to_span(kTLS13LabelPSKBinder),
+          MakeConstSpan(binder_context, binder_context_len), is_dtls)) {
     return false;
   }
 
@@ -446,7 +508,7 @@ static bool tls13_psk_binder(uint8_t *out, size_t *out_len,
   }
 
   if (!tls13_verify_data(out, out_len, digest, session->ssl_version, binder_key,
-                         MakeConstSpan(context, context_len))) {
+                         MakeConstSpan(context, context_len), is_dtls)) {
     return false;
   }
 
@@ -467,7 +529,7 @@ bool tls13_write_psk_binder(const SSL_HANDSHAKE *hs,
   uint8_t verify_data[EVP_MAX_MD_SIZE];
   size_t verify_data_len;
   if (!tls13_psk_binder(verify_data, &verify_data_len, ssl->session.get(),
-                        transcript, msg, binders_len) ||
+                        transcript, msg, binders_len, SSL_is_dtls(hs->ssl)) ||
       verify_data_len != hash_len) {
     OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
     return false;
@@ -491,7 +553,7 @@ bool tls13_verify_psk_binder(const SSL_HANDSHAKE *hs,
   // prefix removed. The caller is assumed to have parsed |msg|, extracted
   // |binders|, and verified the PSK extension is last.
   if (!tls13_psk_binder(verify_data, &verify_data_len, session, hs->transcript,
-                        msg.raw, 2 + CBS_len(binders)) ||
+                        msg.raw, 2 + CBS_len(binders), SSL_is_dtls(hs->ssl)) ||
       // We only consider the first PSK, so compare against the first binder.
       !CBS_get_u8_length_prefixed(binders, &binder)) {
     OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
@@ -556,11 +618,11 @@ bool ssl_ech_accept_confirmation(const SSL_HANDSHAKE *hs, Span<uint8_t> out,
   }
 
   assert(out.size() == ECH_CONFIRMATION_SIGNAL_LEN);
-  return hkdf_expand_label(out, transcript.Digest(),
-                           MakeConstSpan(secret, secret_len),
-                           is_hrr ? label_to_span("hrr ech accept confirmation")
-                                  : label_to_span("ech accept confirmation"),
-                           MakeConstSpan(context, context_len));
+  return hkdf_expand_label(
+      out, transcript.Digest(), MakeConstSpan(secret, secret_len),
+      is_hrr ? label_to_span("hrr ech accept confirmation")
+             : label_to_span("ech accept confirmation"),
+      MakeConstSpan(context, context_len), SSL_is_dtls(hs->ssl));
 }
 
 BSSL_NAMESPACE_END

data/third_party/boringssl-with-bazel/src/ssl/tls13_server.cc

@@ -175,7 +175,7 @@ static bool add_new_session_tickets(SSL_HANDSHAKE *hs, bool *out_sent_tickets) {
         !CBB_add_u8_length_prefixed(&body, &nonce_cbb) ||
         !CBB_add_bytes(&nonce_cbb, nonce, sizeof(nonce)) ||
         !CBB_add_u16_length_prefixed(&body, &ticket) ||
-        !tls13_derive_session_psk(session.get(), nonce) ||
+        !tls13_derive_session_psk(session.get(), nonce, SSL_is_dtls(ssl)) ||
         !ssl_encrypt_ticket(hs, &ticket, session.get()) ||
         !CBB_add_u16_length_prefixed(&body, &extensions)) {
       return false;
@@ -244,9 +244,15 @@ static enum ssl_hs_wait_t do_select_parameters(SSL_HANDSHAKE *hs) {
     ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER);
     return ssl_hs_error;
   }
-  OPENSSL_memcpy(hs->session_id, client_hello.session_id,
-                 client_hello.session_id_len);
-  hs->session_id_len = client_hello.session_id_len;
+  // DTLS 1.3 disables compatibility mode, and even if the client advertised a
+  // session ID (for resumption in DTLS 1.2), the server "MUST NOT echo the
+  // 'legacy_session_id' value from the client" (RFC 9147, section 5) as it
+  // would in a TLS 1.3 handshake.
+  if (!SSL_is_dtls(ssl)) {
+    OPENSSL_memcpy(hs->session_id, client_hello.session_id,
+                   client_hello.session_id_len);
+    hs->session_id_len = client_hello.session_id_len;
+  }
 
   Array<SSL_CREDENTIAL *> creds;
   if (!ssl_get_credential_list(hs, &creds)) {
@@ -792,11 +798,15 @@ static enum ssl_hs_wait_t do_send_server_hello(SSL_HANDSHAKE *hs) {
     }
   }
 
+  uint16_t server_hello_version = TLS1_2_VERSION;
+  if (SSL_is_dtls(ssl)) {
+    server_hello_version = DTLS1_2_VERSION;
+  }
   Array<uint8_t> server_hello;
   ScopedCBB cbb;
   CBB body, extensions, session_id;
   if (!ssl->method->init_message(ssl, cbb.get(), &body, SSL3_MT_SERVER_HELLO) ||
-      !CBB_add_u16(&body, TLS1_2_VERSION) ||
+      !CBB_add_u16(&body, server_hello_version) ||
       !CBB_add_bytes(&body, ssl->s3->server_random,
                      sizeof(ssl->s3->server_random)) ||
       !CBB_add_u8_length_prefixed(&body, &session_id) ||

data/third_party/boringssl-with-bazel/src/ssl/tls_record.cc

@@ -140,7 +140,7 @@ static const uint8_t kMaxWarningAlerts = 4;
 
 // ssl_needs_record_splitting returns one if |ssl|'s current outgoing cipher
 // state needs record-splitting and zero otherwise.
-static bool ssl_needs_record_splitting(const SSL *ssl) {
+bool ssl_needs_record_splitting(const SSL *ssl) {
 #if !defined(BORINGSSL_UNSAFE_FUZZER_MODE)
   return !ssl->s3->aead_write_ctx->is_null_cipher() &&
          ssl->s3->aead_write_ctx->ProtocolVersion() < TLS1_1_VERSION &&
@@ -152,28 +152,8 @@ static bool ssl_needs_record_splitting(const SSL *ssl) {
 }
 
 size_t ssl_record_prefix_len(const SSL *ssl) {
-  size_t header_len;
-  if (SSL_is_dtls(ssl)) {
-    header_len = DTLS1_RT_HEADER_LENGTH;
-  } else {
-    header_len = SSL3_RT_HEADER_LENGTH;
-  }
-
-  return header_len + ssl->s3->aead_read_ctx->ExplicitNonceLen();
-}
-
-size_t ssl_seal_align_prefix_len(const SSL *ssl) {
-  if (SSL_is_dtls(ssl)) {
-    return DTLS1_RT_HEADER_LENGTH + ssl->s3->aead_write_ctx->ExplicitNonceLen();
-  }
-
-  size_t ret =
-      SSL3_RT_HEADER_LENGTH + ssl->s3->aead_write_ctx->ExplicitNonceLen();
-  if (ssl_needs_record_splitting(ssl)) {
-    ret += SSL3_RT_HEADER_LENGTH;
-    ret += ssl_cipher_get_record_split_len(ssl->s3->aead_write_ctx->cipher());
-  }
-  return ret;
+  assert(!SSL_is_dtls(ssl));
+  return SSL3_RT_HEADER_LENGTH + ssl->s3->aead_read_ctx->ExplicitNonceLen();
 }
 
 static ssl_open_record_t skip_early_data(SSL *ssl, uint8_t *out_alert,