grpc 1.69.0 → 1.70.1

data/third_party/boringssl-with-bazel/src/ssl/ssl_lib.cc

@@ -154,8 +154,8 @@
 #include <openssl/mem.h>
 #include <openssl/rand.h>
 
-#include "internal.h"
 #include "../crypto/internal.h"
+#include "internal.h"
 
 #if defined(OPENSSL_WINDOWS)
 #include <sys/timeb.h>
@@ -213,7 +213,7 @@ void ssl_reset_error_state(SSL *ssl) {
   ERR_clear_system_error();
 }
 
-void ssl_set_read_error(SSL* ssl) {
+void ssl_set_read_error(SSL *ssl) {
   ssl->s3->read_shutdown = ssl_shutdown_error;
   ssl->s3->read_error.reset(ERR_save_state());
 }
@@ -287,7 +287,7 @@ static uint8_t hex_char_consttime(uint8_t b) {
 
 static bool cbb_add_hex_consttime(CBB *cbb, Span<const uint8_t> in) {
   uint8_t *out;
-if (!CBB_add_space(cbb, &out, in.size() * 2)) {
+  if (!CBB_add_space(cbb, &out, in.size() * 2)) {
     return false;
   }
 
@@ -364,14 +364,7 @@ void ssl_do_msg_callback(const SSL *ssl, int is_write, int content_type,
                     const_cast<SSL *>(ssl), ssl->msg_callback_arg);
 }
 
-void ssl_get_current_time(const SSL *ssl, struct OPENSSL_timeval *out_clock) {
-  // TODO(martinkr): Change callers to |ssl_ctx_get_current_time| and drop the
-  // |ssl| arg from |current_time_cb| if possible.
-  ssl_ctx_get_current_time(ssl->ctx.get(), out_clock);
-}
-
-void ssl_ctx_get_current_time(const SSL_CTX *ctx,
-                              struct OPENSSL_timeval *out_clock) {
+OPENSSL_timeval ssl_ctx_get_current_time(const SSL_CTX *ctx) {
   if (ctx->current_time_cb != NULL) {
     // TODO(davidben): Update current_time_cb to use OPENSSL_timeval. See
     // https://crbug.com/boringssl/155.
@@ -379,54 +372,47 @@ void ssl_ctx_get_current_time(const SSL_CTX *ctx,
     ctx->current_time_cb(nullptr /* ssl */, &clock);
     if (clock.tv_sec < 0) {
       assert(0);
-      out_clock->tv_sec = 0;
-      out_clock->tv_usec = 0;
+      return {0, 0};
     } else {
-      out_clock->tv_sec = (uint64_t)clock.tv_sec;
-      out_clock->tv_usec = (uint32_t)clock.tv_usec;
+      return {static_cast<uint64_t>(clock.tv_sec),
+              static_cast<uint32_t>(clock.tv_usec)};
     }
-    return;
   }
 
 #if defined(BORINGSSL_UNSAFE_DETERMINISTIC_MODE)
-  out_clock->tv_sec = 1234;
-  out_clock->tv_usec = 1234;
+  return {1234, 1234};
 #elif defined(OPENSSL_WINDOWS)
   struct _timeb time;
   _ftime(&time);
   if (time.time < 0) {
     assert(0);
-    out_clock->tv_sec = 0;
-    out_clock->tv_usec = 0;
+    return {0, 0};
   } else {
-    out_clock->tv_sec = time.time;
-    out_clock->tv_usec = time.millitm * 1000;
+    return {static_cast<uint64_t>(time.time),
+            static_cast<uint32_t>(time.millitm * 1000)};
   }
 #else
   struct timeval clock;
   gettimeofday(&clock, NULL);
   if (clock.tv_sec < 0) {
     assert(0);
-    out_clock->tv_sec = 0;
-    out_clock->tv_usec = 0;
+    return {0, 0};
   } else {
-    out_clock->tv_sec = (uint64_t)clock.tv_sec;
-    out_clock->tv_usec = (uint32_t)clock.tv_usec;
+    return {static_cast<uint64_t>(clock.tv_sec),
+            static_cast<uint32_t>(clock.tv_usec)};
   }
 #endif
 }
 
-void SSL_CTX_set_handoff_mode(SSL_CTX *ctx, bool on) {
-  ctx->handoff = on;
-}
+void SSL_CTX_set_handoff_mode(SSL_CTX *ctx, bool on) { ctx->handoff = on; }
 
 static bool ssl_can_renegotiate(const SSL *ssl) {
   if (ssl->server || SSL_is_dtls(ssl)) {
     return false;
   }
 
-  if (ssl->s3->have_version &&
-      ssl_protocol_version(ssl) >= TLS1_3_VERSION) {
+  if (ssl->s3->version != 0  //
+      && ssl_protocol_version(ssl) >= TLS1_3_VERSION) {
     return false;
   }
 
@@ -452,9 +438,9 @@ static bool ssl_can_renegotiate(const SSL *ssl) {
 }
 
 static void ssl_maybe_shed_handshake_config(SSL *ssl) {
-  if (ssl->s3->hs != nullptr ||
-      ssl->config == nullptr ||
-      !ssl->config->shed_handshake_config ||
+  if (ssl->s3->hs != nullptr ||               //
+      ssl->config == nullptr ||               //
+      !ssl->config->shed_handshake_config ||  //
       ssl_can_renegotiate(ssl)) {
     return;
   }
@@ -472,8 +458,10 @@ void SSL_set_handoff_mode(SSL *ssl, bool on) {
 bool SSL_get_traffic_secrets(const SSL *ssl,
                              Span<const uint8_t> *out_read_traffic_secret,
                              Span<const uint8_t> *out_write_traffic_secret) {
-  if (SSL_version(ssl) < TLS1_3_VERSION) {
-    OPENSSL_PUT_ERROR(SSL, SSL_R_WRONG_SSL_VERSION);
+  // This API is not well-defined for DTLS 1.3 (see https://crbug.com/42290608)
+  // or QUIC, where multiple epochs may be alive at once.
+  if (SSL_is_dtls(ssl) || SSL_is_quic(ssl)) {
+    OPENSSL_PUT_ERROR(SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
     return false;
   }
 
@@ -482,11 +470,13 @@ bool SSL_get_traffic_secrets(const SSL *ssl,
     return false;
   }
 
-  *out_read_traffic_secret = Span<const uint8_t>(
-      ssl->s3->read_traffic_secret, ssl->s3->read_traffic_secret_len);
-  *out_write_traffic_secret = Span<const uint8_t>(
-      ssl->s3->write_traffic_secret, ssl->s3->write_traffic_secret_len);
+  if (SSL_version(ssl) < TLS1_3_VERSION) {
+    OPENSSL_PUT_ERROR(SSL, SSL_R_WRONG_SSL_VERSION);
+    return false;
+  }
 
+  *out_read_traffic_secret = ssl->s3->read_traffic_secret;
+  *out_write_traffic_secret = ssl->s3->write_traffic_secret;
   return true;
 }
 
@@ -512,16 +502,11 @@ int OPENSSL_init_ssl(uint64_t opts, const OPENSSL_INIT_SETTINGS *settings) {
 }
 
 static uint32_t ssl_session_hash(const SSL_SESSION *sess) {
-  return ssl_hash_session_id(
-      MakeConstSpan(sess->session_id, sess->session_id_length));
+  return ssl_hash_session_id(sess->session_id);
 }
 
 static int ssl_session_cmp(const SSL_SESSION *a, const SSL_SESSION *b) {
-  if (a->session_id_length != b->session_id_length) {
-    return 1;
-  }
-
-  return OPENSSL_memcmp(a->session_id, b->session_id, a->session_id_length);
+  return MakeConstSpan(a->session_id) == b->session_id ? 0 : 1;
 }
 
 ssl_ctx_st::ssl_ctx_st(const SSL_METHOD *ssl_method)
@@ -572,10 +557,12 @@ SSL_CTX *SSL_CTX_new(const SSL_METHOD *method) {
   ret->cert = MakeUnique<CERT>(method->x509_method);
   ret->sessions = lh_SSL_SESSION_new(ssl_session_hash, ssl_session_cmp);
   ret->client_CA.reset(sk_CRYPTO_BUFFER_new_null());
+  ret->CA_names.reset(sk_CRYPTO_BUFFER_new_null());
   if (ret->cert == nullptr ||       //
       !ret->cert->is_valid() ||     //
       ret->sessions == nullptr ||   //
       ret->client_CA == nullptr ||  //
+      ret->CA_names == nullptr ||   //
       !ret->x509_method->ssl_ctx_new(ret.get())) {
     return nullptr;
   }
@@ -720,9 +707,7 @@ SSL_CONFIG::~SSL_CONFIG() {
   }
 }
 
-void SSL_free(SSL *ssl) {
-  Delete(ssl);
-}
+void SSL_free(SSL *ssl) { Delete(ssl); }
 
 void SSL_set_connect_state(SSL *ssl) {
   ssl->server = false;
@@ -734,13 +719,9 @@ void SSL_set_accept_state(SSL *ssl) {
   ssl->do_handshake = ssl_server_handshake;
 }
 
-void SSL_set0_rbio(SSL *ssl, BIO *rbio) {
-  ssl->rbio.reset(rbio);
-}
+void SSL_set0_rbio(SSL *ssl, BIO *rbio) { ssl->rbio.reset(rbio); }
 
-void SSL_set0_wbio(SSL *ssl, BIO *wbio) {
-  ssl->wbio.reset(wbio);
-}
+void SSL_set0_wbio(SSL *ssl, BIO *wbio) { ssl->wbio.reset(wbio); }
 
 void SSL_set_bio(SSL *ssl, BIO *rbio, BIO *wbio) {
   // For historical reasons, this function has many different cases in ownership
@@ -803,8 +784,8 @@ size_t SSL_quic_max_handshake_flight_len(const SSL *ssl,
       } else {
         // Clients may receive both Certificate message and a CertificateRequest
         // message.
-        if (2*ssl->max_cert_list > kDefaultLimit) {
-          return 2*ssl->max_cert_list;
+        if (2 * ssl->max_cert_list > kDefaultLimit) {
+          return 2 * ssl->max_cert_list;
         }
       }
       return kDefaultLimit;
@@ -819,21 +800,23 @@ size_t SSL_quic_max_handshake_flight_len(const SSL *ssl,
 }
 
 enum ssl_encryption_level_t SSL_quic_read_level(const SSL *ssl) {
-  return ssl->s3->read_level;
+  assert(SSL_is_quic(ssl));
+  return ssl->s3->quic_read_level;
 }
 
 enum ssl_encryption_level_t SSL_quic_write_level(const SSL *ssl) {
-  return ssl->s3->write_level;
+  assert(SSL_is_quic(ssl));
+  return ssl->s3->quic_write_level;
 }
 
 int SSL_provide_quic_data(SSL *ssl, enum ssl_encryption_level_t level,
                           const uint8_t *data, size_t len) {
-  if (ssl->quic_method == nullptr) {
+  if (!SSL_is_quic(ssl)) {
     OPENSSL_PUT_ERROR(SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
     return 0;
   }
 
-  if (level != ssl->s3->read_level) {
+  if (level != ssl->s3->quic_read_level) {
     OPENSSL_PUT_ERROR(SSL, SSL_R_WRONG_ENCRYPTION_LEVEL_RECEIVED);
     return 0;
   }
@@ -937,7 +920,7 @@ static int ssl_do_post_handshake(SSL *ssl, const SSLMessage &msg) {
 int SSL_process_quic_post_handshake(SSL *ssl) {
   ssl_reset_error_state(ssl);
 
-  if (SSL_in_init(ssl)) {
+  if (!SSL_is_quic(ssl) || SSL_in_init(ssl)) {
     OPENSSL_PUT_ERROR(SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
     return 0;
   }
@@ -980,6 +963,15 @@ static int ssl_read_impl(SSL *ssl) {
       return -1;
     }
 
+    // If a read triggered a DTLS ACK or retransmit, resolve that before reading
+    // more.
+    if (SSL_is_dtls(ssl)) {
+      int ret = ssl->method->flush(ssl);
+      if (ret <= 0) {
+        return ret;
+      }
+    }
+
     // Complete the current handshake, if any. False Start will cause
     // |SSL_do_handshake| to return mid-handshake, so this may require multiple
     // iterations.
@@ -1047,7 +1039,7 @@ int SSL_read(SSL *ssl, void *buf, int num) {
 }
 
 int SSL_peek(SSL *ssl, void *buf, int num) {
-  if (ssl->quic_method != nullptr) {
+  if (SSL_is_quic(ssl)) {
     OPENSSL_PUT_ERROR(SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
     return -1;
   }
@@ -1068,7 +1060,7 @@ int SSL_peek(SSL *ssl, void *buf, int num) {
 int SSL_write(SSL *ssl, const void *buf, int num) {
   ssl_reset_error_state(ssl);
 
-  if (ssl->quic_method != nullptr) {
+  if (SSL_is_quic(ssl)) {
     OPENSSL_PUT_ERROR(SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
     return -1;
   }
@@ -1114,7 +1106,7 @@ int SSL_key_update(SSL *ssl, int request_type) {
     return 0;
   }
 
-  if (ssl->ctx->quic_method != nullptr) {
+  if (SSL_is_quic(ssl)) {
     OPENSSL_PUT_ERROR(SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
     return 0;
   }
@@ -1129,12 +1121,7 @@ int SSL_key_update(SSL *ssl, int request_type) {
     return 0;
   }
 
-  if (!ssl->s3->key_update_pending &&
-      !tls13_add_key_update(ssl, request_type)) {
-    return 0;
-  }
-
-  return 1;
+  return tls13_add_key_update(ssl, request_type);
 }
 
 int SSL_shutdown(SSL *ssl) {
@@ -1255,7 +1242,7 @@ int SSL_early_data_accepted(const SSL *ssl) {
 
 void SSL_reset_early_data_reject(SSL *ssl) {
   SSL_HANDSHAKE *hs = ssl->s3->hs.get();
-  if (hs == NULL ||
+  if (hs == NULL ||  //
       hs->wait != ssl_hs_early_data_rejected) {
     abort();
   }
@@ -1360,7 +1347,7 @@ int SSL_get_error(const SSL *ssl, int ret_code) {
       return ssl->s3->rwstate;
 
     case SSL_ERROR_WANT_READ: {
-      if (ssl->quic_method) {
+      if (SSL_is_quic(ssl)) {
         return SSL_ERROR_WANT_READ;
       }
       BIO *bio = SSL_get_rbio(ssl);
@@ -1515,36 +1502,31 @@ int SSL_get_tls_unique(const SSL *ssl, uint8_t *out, size_t *out_len,
   // The tls-unique value is the first Finished message in the handshake, which
   // is the client's in a full handshake and the server's for a resumption. See
   // https://tools.ietf.org/html/rfc5929#section-3.1.
-  const uint8_t *finished = ssl->s3->previous_client_finished;
-  size_t finished_len = ssl->s3->previous_client_finished_len;
+  Span<const uint8_t> finished = ssl->s3->previous_client_finished;
   if (ssl->session != NULL) {
     // tls-unique is broken for resumed sessions unless EMS is used.
     if (!ssl->session->extended_master_secret) {
       return 0;
     }
     finished = ssl->s3->previous_server_finished;
-    finished_len = ssl->s3->previous_server_finished_len;
   }
 
-  *out_len = finished_len;
-  if (finished_len > max_out) {
+  *out_len = finished.size();
+  if (finished.size() > max_out) {
     *out_len = max_out;
   }
 
-  OPENSSL_memcpy(out, finished, *out_len);
+  OPENSSL_memcpy(out, finished.data(), *out_len);
   return 1;
 }
 
 static int set_session_id_context(CERT *cert, const uint8_t *sid_ctx,
-                                   size_t sid_ctx_len) {
-  if (sid_ctx_len > sizeof(cert->sid_ctx)) {
+                                  size_t sid_ctx_len) {
+  if (!cert->sid_ctx.TryCopyFrom(MakeConstSpan(sid_ctx, sid_ctx_len))) {
     OPENSSL_PUT_ERROR(SSL, SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG);
     return 0;
   }
 
-  static_assert(sizeof(cert->sid_ctx) < 256, "sid_ctx too large");
-  cert->sid_ctx_length = (uint8_t)sid_ctx_len;
-  OPENSSL_memcpy(cert->sid_ctx, sid_ctx, sid_ctx_len);
   return 1;
 }
 
@@ -1567,8 +1549,8 @@ const uint8_t *SSL_get0_session_id_context(const SSL *ssl, size_t *out_len) {
     *out_len = 0;
     return NULL;
   }
-  *out_len = ssl->config->cert->sid_ctx_length;
-  return ssl->config->cert->sid_ctx;
+  *out_len = ssl->config->cert->sid_ctx.size();
+  return ssl->config->cert->sid_ctx.data();
 }
 
 int SSL_get_fd(const SSL *ssl) { return SSL_get_rfd(ssl); }
@@ -1643,13 +1625,12 @@ int SSL_set_rfd(SSL *ssl, int fd) {
 }
 #endif  // !OPENSSL_NO_SOCK
 
-static size_t copy_finished(void *out, size_t out_len, const uint8_t *in,
-                            size_t in_len) {
-  if (out_len > in_len) {
-    out_len = in_len;
+static size_t copy_finished(void *out, size_t out_len, Span<const uint8_t> in) {
+  if (out_len > in.size()) {
+    out_len = in.size();
   }
-  OPENSSL_memcpy(out, in, out_len);
-  return in_len;
+  OPENSSL_memcpy(out, in.data(), out_len);
+  return in.size();
 }
 
 size_t SSL_get_finished(const SSL *ssl, void *buf, size_t count) {
@@ -1659,12 +1640,10 @@ size_t SSL_get_finished(const SSL *ssl, void *buf, size_t count) {
   }
 
   if (ssl->server) {
-    return copy_finished(buf, count, ssl->s3->previous_server_finished,
-                         ssl->s3->previous_server_finished_len);
+    return copy_finished(buf, count, ssl->s3->previous_server_finished);
   }
 
-  return copy_finished(buf, count, ssl->s3->previous_client_finished,
-                       ssl->s3->previous_client_finished_len);
+  return copy_finished(buf, count, ssl->s3->previous_client_finished);
 }
 
 size_t SSL_get_peer_finished(const SSL *ssl, void *buf, size_t count) {
@@ -1674,12 +1653,10 @@ size_t SSL_get_peer_finished(const SSL *ssl, void *buf, size_t count) {
   }
 
   if (ssl->server) {
-    return copy_finished(buf, count, ssl->s3->previous_client_finished,
-                         ssl->s3->previous_client_finished_len);
+    return copy_finished(buf, count, ssl->s3->previous_client_finished);
   }
 
-  return copy_finished(buf, count, ssl->s3->previous_server_finished,
-                       ssl->s3->previous_server_finished_len);
+  return copy_finished(buf, count, ssl->s3->previous_server_finished);
 }
 
 int SSL_get_verify_mode(const SSL *ssl) {
@@ -1693,7 +1670,7 @@ int SSL_get_verify_mode(const SSL *ssl) {
 int SSL_get_extms_support(const SSL *ssl) {
   // TLS 1.3 does not require extended master secret and always reports as
   // supporting it.
-  if (!ssl->s3->have_version) {
+  if (ssl->s3->version == 0) {
     return 0;
   }
   if (ssl_protocol_version(ssl) >= TLS1_3_VERSION) {
@@ -1748,7 +1725,7 @@ static bool has_cert_and_key(const SSL_CREDENTIAL *cred) {
 int SSL_CTX_check_private_key(const SSL_CTX *ctx) {
   // There is no need to actually check consistency because inconsistent values
   // can never be configured.
-  return has_cert_and_key(ctx->cert->default_credential.get());
+  return has_cert_and_key(ctx->cert->legacy_credential.get());
 }
 
 int SSL_check_private_key(const SSL *ssl) {
@@ -1758,7 +1735,7 @@ int SSL_check_private_key(const SSL *ssl) {
 
   // There is no need to actually check consistency because inconsistent values
   // can never be configured.
-  return has_cert_and_key(ssl->config->cert->default_credential.get());
+  return has_cert_and_key(ssl->config->cert->legacy_credential.get());
 }
 
 long SSL_get_default_timeout(const SSL *ssl) {
@@ -1824,9 +1801,7 @@ void SSL_CTX_set_max_cert_list(SSL_CTX *ctx, size_t max_cert_list) {
   ctx->max_cert_list = (uint32_t)max_cert_list;
 }
 
-size_t SSL_get_max_cert_list(const SSL *ssl) {
-  return ssl->max_cert_list;
-}
+size_t SSL_get_max_cert_list(const SSL *ssl) { return ssl->max_cert_list; }
 
 void SSL_set_max_cert_list(SSL *ssl, size_t max_cert_list) {
   if (max_cert_list > kMaxHandshakeSize) {
@@ -1868,7 +1843,7 @@ int SSL_set_mtu(SSL *ssl, unsigned mtu) {
 }
 
 int SSL_get_secure_renegotiation_support(const SSL *ssl) {
-  if (!ssl->s3->have_version) {
+  if (ssl->s3->version == 0) {
     return 0;
   }
   return ssl_protocol_version(ssl) >= TLS1_3_VERSION ||
@@ -1949,9 +1924,9 @@ int SSL_CTX_set_tlsext_ticket_keys(SSL_CTX *ctx, const void *in, size_t len) {
 }
 
 int SSL_CTX_set_tlsext_ticket_key_cb(
-    SSL_CTX *ctx, int (*callback)(SSL *ssl, uint8_t *key_name, uint8_t *iv,
-                                  EVP_CIPHER_CTX *ctx, HMAC_CTX *hmac_ctx,
-                                  int encrypt)) {
+    SSL_CTX *ctx,
+    int (*callback)(SSL *ssl, uint8_t *key_name, uint8_t *iv,
+                    EVP_CIPHER_CTX *ctx, HMAC_CTX *hmac_ctx, int encrypt)) {
   ctx->ticket_key_cb = callback;
   return 1;
 }
@@ -1985,7 +1960,7 @@ int SSL_set1_group_ids(SSL *ssl, const uint16_t *group_ids,
 static bool ssl_nids_to_group_ids(Array<uint16_t> *out_group_ids,
                                   Span<const int> nids) {
   Array<uint16_t> group_ids;
-  if (!group_ids.Init(nids.size())) {
+  if (!group_ids.InitForOverwrite(nids.size())) {
     return false;
   }
 
@@ -2027,7 +2002,7 @@ static bool ssl_str_to_group_ids(Array<uint16_t> *out_group_ids,
   } while (col);
 
   Array<uint16_t> group_ids;
-  if (!group_ids.Init(count)) {
+  if (!group_ids.InitForOverwrite(count)) {
     return false;
   }
 
@@ -2078,13 +2053,9 @@ int SSL_get_negotiated_group(const SSL *ssl) {
   return ssl_group_id_to_nid(group_id);
 }
 
-int SSL_CTX_set_tmp_dh(SSL_CTX *ctx, const DH *dh) {
-  return 1;
-}
+int SSL_CTX_set_tmp_dh(SSL_CTX *ctx, const DH *dh) { return 1; }
 
-int SSL_set_tmp_dh(SSL *ssl, const DH *dh) {
-  return 1;
-}
+int SSL_set_tmp_dh(SSL *ssl, const DH *dh) { return 1; }
 
 STACK_OF(SSL_CIPHER) *SSL_CTX_get_ciphers(const SSL_CTX *ctx) {
   return ctx->cipher_list->ciphers.get();
@@ -2107,7 +2078,7 @@ STACK_OF(SSL_CIPHER) *SSL_get_ciphers(const SSL *ssl) {
   }
 
   return ssl->config->cipher_list ? ssl->config->cipher_list->ciphers.get()
-      : ssl->ctx->cipher_list->ciphers.get();
+                                  : ssl->ctx->cipher_list->ciphers.get();
 }
 
 const char *SSL_get_cipher_list(const SSL *ssl, int n) {
@@ -2343,10 +2314,12 @@ void SSL_CTX_set_next_protos_advertised_cb(
   ctx->next_protos_advertised_cb_arg = arg;
 }
 
-void SSL_CTX_set_next_proto_select_cb(
-    SSL_CTX *ctx, int (*cb)(SSL *ssl, uint8_t **out, uint8_t *out_len,
-                            const uint8_t *in, unsigned in_len, void *arg),
-    void *arg) {
+void SSL_CTX_set_next_proto_select_cb(SSL_CTX *ctx,
+                                      int (*cb)(SSL *ssl, uint8_t **out,
+                                                uint8_t *out_len,
+                                                const uint8_t *in,
+                                                unsigned in_len, void *arg),
+                                      void *arg) {
   ctx->next_proto_select_cb = cb;
   ctx->next_proto_select_cb_arg = arg;
 }
@@ -2480,9 +2453,8 @@ int SSL_enable_tls_channel_id(SSL *ssl) {
 
 static int is_p256_key(EVP_PKEY *private_key) {
   const EC_KEY *ec_key = EVP_PKEY_get0_EC_KEY(private_key);
-  return ec_key != NULL &&
-         EC_GROUP_get_curve_name(EC_KEY_get0_group(ec_key)) ==
-             NID_X9_62_prime256v1;
+  return ec_key != NULL && EC_GROUP_get_curve_name(EC_KEY_get0_group(ec_key)) ==
+                               NID_X9_62_prime256v1;
 }
 
 int SSL_CTX_set1_tls_channel_id(SSL_CTX *ctx, EVP_PKEY *private_key) {
@@ -2536,7 +2508,7 @@ size_t SSL_get0_peer_verify_algorithms(const SSL *ssl,
 }
 
 size_t SSL_get0_peer_delegation_algorithms(const SSL *ssl,
-                                           const uint16_t **out_sigalgs){
+                                           const uint16_t **out_sigalgs) {
   Span<const uint16_t> sigalgs;
   if (ssl->s3->hs != nullptr) {
     sigalgs = ssl->s3->hs->peer_delegated_credential_sigalgs;
@@ -2550,11 +2522,11 @@ EVP_PKEY *SSL_get_privatekey(const SSL *ssl) {
     assert(ssl->config);
     return nullptr;
   }
-  return ssl->config->cert->default_credential->privkey.get();
+  return ssl->config->cert->legacy_credential->privkey.get();
 }
 
 EVP_PKEY *SSL_CTX_get0_privatekey(const SSL_CTX *ctx) {
-  return ctx->cert->default_credential->privkey.get();
+  return ctx->cert->legacy_credential->privkey.get();
 }
 
 const SSL_CIPHER *SSL_get_current_cipher(const SSL *ssl) {
@@ -2658,7 +2630,7 @@ int SSL_state(const SSL *ssl) {
   return SSL_in_init(ssl) ? SSL_ST_INIT : SSL_ST_OK;
 }
 
-void SSL_set_state(SSL *ssl, int state) { }
+void SSL_set_state(SSL *ssl, int state) {}
 
 char *SSL_get_shared_ciphers(const SSL *ssl, char *buf, int len) {
   if (len <= 0) {
@@ -2707,7 +2679,7 @@ int SSL_CTX_get_ex_new_index(long argl, void *argp, CRYPTO_EX_unused *unused,
                              CRYPTO_EX_dup *dup_unused,
                              CRYPTO_EX_free *free_func) {
   return CRYPTO_get_ex_new_index_ex(&g_ex_data_class_ssl_ctx, argl, argp,
-                                 free_func);
+                                    free_func);
 }
 
 int SSL_CTX_set_ex_data(SSL_CTX *ctx, int idx, void *data) {
@@ -2814,9 +2786,10 @@ void SSL_CTX_set_psk_client_callback(
   ctx->psk_client_callback = cb;
 }
 
-void SSL_set_psk_server_callback(
-    SSL *ssl, unsigned (*cb)(SSL *ssl, const char *identity, uint8_t *psk,
-                             unsigned max_psk_len)) {
+void SSL_set_psk_server_callback(SSL *ssl,
+                                 unsigned (*cb)(SSL *ssl, const char *identity,
+                                                uint8_t *psk,
+                                                unsigned max_psk_len)) {
   if (!ssl->config) {
     return;
   }
@@ -2824,8 +2797,8 @@ void SSL_set_psk_server_callback(
 }
 
 void SSL_CTX_set_psk_server_callback(
-    SSL_CTX *ctx, unsigned (*cb)(SSL *ssl, const char *identity,
-                                 uint8_t *psk, unsigned max_psk_len)) {
+    SSL_CTX *ctx, unsigned (*cb)(SSL *ssl, const char *identity, uint8_t *psk,
+                                 unsigned max_psk_len)) {
   ctx->psk_server_callback = cb;
 }
 
@@ -2878,9 +2851,7 @@ int SSL_can_release_private_key(const SSL *ssl) {
   return !ssl->s3->hs || ssl->s3->hs->can_release_private_key;
 }
 
-int SSL_is_init_finished(const SSL *ssl) {
-  return !SSL_in_init(ssl);
-}
+int SSL_is_init_finished(const SSL *ssl) { return !SSL_in_init(ssl); }
 
 int SSL_in_init(const SSL *ssl) {
   // This returns false once all the handshake state has been finalized, to
@@ -2897,14 +2868,14 @@ int SSL_in_false_start(const SSL *ssl) {
   return ssl->s3->hs->in_false_start;
 }
 
-int SSL_cutthrough_complete(const SSL *ssl) {
-  return SSL_in_false_start(ssl);
-}
+int SSL_cutthrough_complete(const SSL *ssl) { return SSL_in_false_start(ssl); }
 
 int SSL_is_server(const SSL *ssl) { return ssl->server; }
 
 int SSL_is_dtls(const SSL *ssl) { return ssl->method->is_dtls; }
 
+int SSL_is_quic(const SSL *ssl) { return ssl->quic_method != nullptr; }
+
 void SSL_CTX_set_select_certificate_cb(
     SSL_CTX *ctx,
     enum ssl_select_cert_result_t (*cb)(const SSL_CLIENT_HELLO *)) {
@@ -2942,6 +2913,13 @@ void SSL_set_renegotiate_mode(SSL *ssl, enum ssl_renegotiate_mode_t mode) {
 
 int SSL_get_ivs(const SSL *ssl, const uint8_t **out_read_iv,
                 const uint8_t **out_write_iv, size_t *out_iv_len) {
+  // No cipher suites maintain stateful internal IVs in DTLS. It would not be
+  // compatible with reordering.
+  if (SSL_is_dtls(ssl)) {
+    OPENSSL_PUT_ERROR(SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+    return 0;
+  }
+
   size_t write_iv_len;
   if (!ssl->s3->aead_read_ctx->GetIV(out_read_iv, out_iv_len) ||
       !ssl->s3->aead_write_ctx->GetIV(out_write_iv, &write_iv_len) ||
@@ -2954,30 +2932,30 @@ int SSL_get_ivs(const SSL *ssl, const uint8_t **out_read_iv,
 
 uint64_t SSL_get_read_sequence(const SSL *ssl) {
   if (SSL_is_dtls(ssl)) {
-    // TODO(crbug.com/42290608): The API for read sequences in DTLS 1.3 needs to
-    // reworked. In DTLS 1.3, the read epoch is updated once new keys are
-    // derived (before we receive a message encrypted with those keys), which
-    // results in the read epoch being ahead of the highest record received.
-    // Additionally, when we process a KeyUpdate, we will install new read keys
-    // for the new epoch, but we may receive messages from the old epoch for
-    // some time if the ACK gets lost or there is reordering.
-
-    // max_seq_num already includes the epoch. However, the current epoch may
-    // be one ahead of the highest record received, immediately after a key
-    // change.
-    assert(ssl->d1->r_epoch >= ssl->d1->bitmap.max_seq_num >> 48);
-    return ssl->d1->bitmap.max_seq_num;
+    // TODO(crbug.com/42290608): This API needs to reworked.
+    //
+    // In DTLS 1.2, right at an epoch transition, |read_epoch| may not have
+    // received any records. We will then return that sequence 0 is the highest
+    // received, but it's really -1, which is not representable. This is mostly
+    // moot because, after the handshake, we will never be in the state.
+    //
+    // In DTLS 1.3, epochs do not transition until the first record comes in.
+    // This avoids the DTLS 1.2 problem but introduces a different problem:
+    // during a KeyUpdate (which may occur in the steady state), both epochs are
+    // live. We'll likely need a new API for DTLS offload.
+    const DTLSReadEpoch *read_epoch = &ssl->d1->read_epoch;
+    return DTLSRecordNumber(read_epoch->epoch, read_epoch->bitmap.max_seq_num())
+        .combined();
   }
   return ssl->s3->read_sequence;
 }
 
 uint64_t SSL_get_write_sequence(const SSL *ssl) {
-  uint64_t ret = ssl->s3->write_sequence;
   if (SSL_is_dtls(ssl)) {
-    assert((ret >> 48) == 0);
-    ret |= uint64_t{ssl->d1->w_epoch} << 48;
+    return ssl->d1->write_epoch.next_record.combined();
   }
-  return ret;
+
+  return ssl->s3->write_sequence;
 }
 
 uint16_t SSL_get_peer_signature_algorithm(const SSL *ssl) {
@@ -3179,8 +3157,8 @@ void SSL_CTX_set_ticket_aead_method(SSL_CTX *ctx,
 
 SSL_SESSION *SSL_process_tls13_new_session_ticket(SSL *ssl, const uint8_t *buf,
                                                   size_t buf_len) {
-  if (SSL_in_init(ssl) ||
-      ssl_protocol_version(ssl) != TLS1_3_VERSION ||
+  if (SSL_in_init(ssl) ||                             //
+      ssl_protocol_version(ssl) != TLS1_3_VERSION ||  //
       ssl->server) {
     // Only TLS 1.3 clients are supported.
     OPENSSL_PUT_ERROR(SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
@@ -3190,8 +3168,8 @@ SSL_SESSION *SSL_process_tls13_new_session_ticket(SSL *ssl, const uint8_t *buf,
   CBS cbs, body;
   CBS_init(&cbs, buf, buf_len);
   uint8_t type;
-  if (!CBS_get_u8(&cbs, &type) ||
-      !CBS_get_u24_length_prefixed(&cbs, &body) ||
+  if (!CBS_get_u8(&cbs, &type) ||                   //
+      !CBS_get_u24_length_prefixed(&cbs, &body) ||  //
       CBS_len(&cbs) != 0) {
     OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
     return nullptr;
@@ -3226,8 +3204,8 @@ int SSL_get_tlsext_status_type(const SSL *ssl) {
   if (ssl->server) {
     SSL_HANDSHAKE *hs = ssl->s3->hs.get();
     return hs != nullptr && hs->ocsp_stapling_requested
-        ? TLSEXT_STATUSTYPE_ocsp
-        : TLSEXT_STATUSTYPE_nothing;
+               ? TLSEXT_STATUSTYPE_ocsp
+               : TLSEXT_STATUSTYPE_nothing;
   }
 
   return ssl->config != nullptr && ssl->config->ocsp_stapling_enabled
@@ -3411,12 +3389,11 @@ static int Configure(SSL_CTX *ctx) {
 }
 
 static int Configure(SSL *ssl) {
-  ssl->config->tls13_cipher_policy =
-      ssl_compliance_policy_cnsa_202407;
+  ssl->config->tls13_cipher_policy = ssl_compliance_policy_cnsa_202407;
   return 1;
 }
 
-}
+}  // namespace cnsa202407
 
 int SSL_CTX_set_compliance_policy(SSL_CTX *ctx,
                                   enum ssl_compliance_policy_t policy) {