grpc 1.69.0 → 1.70.1

data/third_party/boringssl-with-bazel/src/ssl/tls_record.cc

@@ -115,8 +115,8 @@
 #include <openssl/err.h>
 #include <openssl/mem.h>
 
-#include "internal.h"
 #include "../crypto/internal.h"
+#include "internal.h"
 
 
 BSSL_NAMESPACE_BEGIN
@@ -143,7 +143,7 @@ static const uint8_t kMaxWarningAlerts = 4;
 bool ssl_needs_record_splitting(const SSL *ssl) {
 #if !defined(BORINGSSL_UNSAFE_FUZZER_MODE)
   return !ssl->s3->aead_write_ctx->is_null_cipher() &&
-         ssl->s3->aead_write_ctx->ProtocolVersion() < TLS1_1_VERSION &&
+         ssl_protocol_version(ssl) < TLS1_1_VERSION &&
          (ssl->mode & SSL_MODE_CBC_RECORD_SPLITTING) != 0 &&
          SSL_CIPHER_is_block_cipher(ssl->s3->aead_write_ctx->cipher());
 #else
@@ -172,6 +172,19 @@ static ssl_open_record_t skip_early_data(SSL *ssl, uint8_t *out_alert,
   return ssl_open_record_discard;
 }
 
+static uint16_t tls_record_version(const SSL *ssl) {
+  if (ssl->s3->version == 0) {
+    // Before the version is determined, outgoing records use TLS 1.0 for
+    // historical compatibility requirements.
+    return TLS1_VERSION;
+  }
+
+  // TLS 1.3 freezes the record version at TLS 1.2. Previous ones use the
+  // version itself.
+  return ssl_protocol_version(ssl) >= TLS1_3_VERSION ? TLS1_2_VERSION
+                                                     : ssl->s3->version;
+}
+
 ssl_open_record_t tls_open_record(SSL *ssl, uint8_t *out_type,
                                   Span<uint8_t> *out, size_t *out_consumed,
                                   uint8_t *out_alert, Span<uint8_t> in) {
@@ -191,8 +204,8 @@ ssl_open_record_t tls_open_record(SSL *ssl, uint8_t *out_type,
   // Decode the record header.
   uint8_t type;
   uint16_t version, ciphertext_len;
-  if (!CBS_get_u8(&cbs, &type) ||
-      !CBS_get_u16(&cbs, &version) ||
+  if (!CBS_get_u8(&cbs, &type) ||      //
+      !CBS_get_u16(&cbs, &version) ||  //
       !CBS_get_u16(&cbs, &ciphertext_len)) {
     *out_consumed = SSL3_RT_HEADER_LENGTH;
     return ssl_open_record_partial;
@@ -204,7 +217,7 @@ ssl_open_record_t tls_open_record(SSL *ssl, uint8_t *out_type,
     // version negotiation failure alerts.
     version_ok = (version >> 8) == SSL3_VERSION_MAJOR;
   } else {
-    version_ok = version == ssl->s3->aead_read_ctx->RecordVersion();
+    version_ok = version == tls_record_version(ssl);
   }
 
   if (!version_ok) {
@@ -232,12 +245,12 @@ ssl_open_record_t tls_open_record(SSL *ssl, uint8_t *out_type,
 
   *out_consumed = in.size() - CBS_len(&cbs);
 
-  if (ssl->s3->have_version &&
-      ssl_protocol_version(ssl) >= TLS1_3_VERSION &&
-      SSL_in_init(ssl) &&
+  // In TLS 1.3, during the handshake, skip ChangeCipherSpec records.
+  static const uint8_t kChangeCipherSpec[] = {SSL3_MT_CCS};
+  if (ssl_has_final_version(ssl) &&
+      ssl_protocol_version(ssl) >= TLS1_3_VERSION && SSL_in_init(ssl) &&
       type == SSL3_RT_CHANGE_CIPHER_SPEC &&
-      ciphertext_len == 1 &&
-      CBS_data(&body)[0] == 1) {
+      Span<const uint8_t>(body) == kChangeCipherSpec) {
     ssl->s3->empty_record_count++;
     if (ssl->s3->empty_record_count > kMaxEmptyRecords) {
       OPENSSL_PUT_ERROR(SSL, SSL_R_TOO_MANY_EMPTY_FRAGMENTS);
@@ -249,8 +262,8 @@ ssl_open_record_t tls_open_record(SSL *ssl, uint8_t *out_type,
 
   // Skip early data received when expecting a second ClientHello if we rejected
   // 0RTT.
-  if (ssl->s3->skip_early_data &&
-      ssl->s3->aead_read_ctx->is_null_cipher() &&
+  if (ssl->s3->skip_early_data &&                  //
+      ssl->s3->aead_read_ctx->is_null_cipher() &&  //
       type == SSL3_RT_APPLICATION_DATA) {
     return skip_early_data(ssl, out_alert, *out_consumed);
   }
@@ -280,9 +293,8 @@ ssl_open_record_t tls_open_record(SSL *ssl, uint8_t *out_type,
   ssl->s3->read_sequence++;
 
   // TLS 1.3 hides the record type inside the encrypted data.
-  bool has_padding =
-      !ssl->s3->aead_read_ctx->is_null_cipher() &&
-      ssl->s3->aead_read_ctx->ProtocolVersion() >= TLS1_3_VERSION;
+  bool has_padding = !ssl->s3->aead_read_ctx->is_null_cipher() &&
+                     ssl_protocol_version(ssl) >= TLS1_3_VERSION;
 
   // If there is padding, the plaintext limit includes the padding, but includes
   // extra room for the inner content type.
@@ -332,7 +344,7 @@ ssl_open_record_t tls_open_record(SSL *ssl, uint8_t *out_type,
   }
 
   // Handshake messages may not interleave with any other record type.
-  if (type != SSL3_RT_HANDSHAKE &&
+  if (type != SSL3_RT_HANDSHAKE &&  //
       tls_has_unprocessed_handshake_data(ssl)) {
     OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_RECORD);
     *out_alert = SSL_AD_UNEXPECTED_MESSAGE;
@@ -351,8 +363,7 @@ static bool do_seal_record(SSL *ssl, uint8_t *out_prefix, uint8_t *out,
   SSLAEADContext *aead = ssl->s3->aead_write_ctx.get();
   uint8_t *extra_in = NULL;
   size_t extra_in_len = 0;
-  if (!aead->is_null_cipher() &&
-      aead->ProtocolVersion() >= TLS1_3_VERSION) {
+  if (!aead->is_null_cipher() && ssl_protocol_version(ssl) >= TLS1_3_VERSION) {
     // TLS 1.3 hides the actual record type inside the encrypted data.
     extra_in = &type;
     extra_in_len = 1;
@@ -375,8 +386,7 @@ static bool do_seal_record(SSL *ssl, uint8_t *out_prefix, uint8_t *out,
     out_prefix[0] = type;
   }
 
-  uint16_t record_version = aead->RecordVersion();
-
+  uint16_t record_version = tls_record_version(ssl);
   out_prefix[1] = record_version >> 8;
   out_prefix[2] = record_version & 0xff;
   out_prefix[3] = ciphertext_len >> 8;
@@ -421,7 +431,7 @@ static bool tls_seal_scatter_suffix_len(const SSL *ssl, size_t *out_suffix_len,
                                         uint8_t type, size_t in_len) {
   size_t extra_in_len = 0;
   if (!ssl->s3->aead_write_ctx->is_null_cipher() &&
-      ssl->s3->aead_write_ctx->ProtocolVersion() >= TLS1_3_VERSION) {
+      ssl_protocol_version(ssl) >= TLS1_3_VERSION) {
     // TLS 1.3 adds an extra byte for encrypted record type.
     extra_in_len = 1;
   }
@@ -434,7 +444,8 @@ static bool tls_seal_scatter_suffix_len(const SSL *ssl, size_t *out_suffix_len,
     in_len -= 1;
   }
   // clang-format on
-  return ssl->s3->aead_write_ctx->SuffixLen(out_suffix_len, in_len, extra_in_len);
+  return ssl->s3->aead_write_ctx->SuffixLen(out_suffix_len, in_len,
+                                            extra_in_len);
 }
 
 // tls_seal_scatter_record seals a new record of type |type| and body |in| and
@@ -551,7 +562,7 @@ enum ssl_open_record_t ssl_process_alert(SSL *ssl, uint8_t *out_alert,
     // without specifying how to handle it. JDK11 misuses it to signal
     // full-duplex connection close after the handshake. As a workaround, skip
     // user_canceled as in TLS 1.2. This matches NSS and OpenSSL.
-    if (ssl->s3->have_version &&
+    if (ssl_has_final_version(ssl) &&
         ssl_protocol_version(ssl) >= TLS1_3_VERSION &&
         alert_descr != SSL_AD_USER_CANCELLED) {
       *out_alert = SSL_AD_DECODE_ERROR;
@@ -586,14 +597,15 @@ using namespace bssl;
 
 size_t SSL_max_seal_overhead(const SSL *ssl) {
   if (SSL_is_dtls(ssl)) {
-    return dtls_max_seal_overhead(ssl, ssl->d1->w_epoch);
+    // TODO(crbug.com/381113363): Use the 0-RTT epoch if writing 0-RTT.
+    return dtls_max_seal_overhead(ssl, ssl->d1->write_epoch.epoch());
   }
 
   size_t ret = SSL3_RT_HEADER_LENGTH;
   ret += ssl->s3->aead_write_ctx->MaxOverhead();
   // TLS 1.3 needs an extra byte for the encrypted record type.
   if (!ssl->s3->aead_write_ctx->is_null_cipher() &&
-      ssl->s3->aead_write_ctx->ProtocolVersion() >= TLS1_3_VERSION) {
+      ssl_protocol_version(ssl) >= TLS1_3_VERSION) {
     ret += 1;
   }
   if (ssl_needs_record_splitting(ssl)) {

data/third_party/boringssl-with-bazel/src/third_party/fiat/curve25519_32.h

@@ -928,6 +928,8 @@ static FIAT_25519_FIAT_INLINE void fiat_25519_opp(fiat_25519_loose_field_element
   out1[9] = x10;
 }
 
+/* Not used in BoringSSL. */
+#if 0
 /*
  * The function fiat_25519_selectznz is a multi-limb conditional select.
  *
@@ -973,6 +975,7 @@ static FIAT_25519_FIAT_INLINE void fiat_25519_selectznz(uint32_t out1[10], fiat_
   out1[8] = x9;
   out1[9] = x10;
 }
+#endif
 
 /*
  * The function fiat_25519_to_bytes serializes a field element to bytes in little-endian order.
@@ -1410,6 +1413,8 @@ static FIAT_25519_FIAT_INLINE void fiat_25519_from_bytes(fiat_25519_tight_field_
   out1[9] = x78;
 }
 
+/* Not used in BoringSSL. */
+#if 0
 /*
  * The function fiat_25519_relax is the identity function converting from tight field elements to loose field elements.
  *
@@ -1449,6 +1454,7 @@ static FIAT_25519_FIAT_INLINE void fiat_25519_relax(fiat_25519_loose_field_eleme
   out1[8] = x9;
   out1[9] = x10;
 }
+#endif
 
 /*
  * The function fiat_25519_carry_scmul_121666 multiplies a field element by 121666 and reduces the result.

data/third_party/boringssl-with-bazel/src/third_party/fiat/curve25519_64.h

@@ -471,6 +471,8 @@ static FIAT_25519_FIAT_INLINE void fiat_25519_opp(fiat_25519_loose_field_element
   out1[4] = x5;
 }
 
+/* Not used in BoringSSL. */
+#if 0
 /*
  * The function fiat_25519_selectznz is a multi-limb conditional select.
  *
@@ -501,6 +503,7 @@ static FIAT_25519_FIAT_INLINE void fiat_25519_selectznz(uint64_t out1[5], fiat_2
   out1[3] = x4;
   out1[4] = x5;
 }
+#endif
 
 /*
  * The function fiat_25519_to_bytes serializes a field element to bytes in little-endian order.
@@ -877,6 +880,8 @@ static FIAT_25519_FIAT_INLINE void fiat_25519_from_bytes(fiat_25519_tight_field_
   out1[4] = x71;
 }
 
+/* Not used in BoringSSL. */
+#if 0
 /*
  * The function fiat_25519_relax is the identity function converting from tight field elements to loose field elements.
  *
@@ -901,6 +906,7 @@ static FIAT_25519_FIAT_INLINE void fiat_25519_relax(fiat_25519_loose_field_eleme
   out1[3] = x4;
   out1[4] = x5;
 }
+#endif
 
 /*
  * The function fiat_25519_carry_scmul_121666 multiplies a field element by 121666 and reduces the result.

data/third_party/boringssl-with-bazel/src/third_party/fiat/curve25519_64_adx.h

@@ -611,7 +611,10 @@ static inline void table_select_4(ge_precomp_4 *t, const int pos,
   uint8_t babs = b - ((bnegative & b) << 1);
 
   uint8_t t_bytes[3][32] = {
-      {constant_time_is_zero_w(b) & 1}, {constant_time_is_zero_w(b) & 1}, {0}};
+    {static_cast<uint8_t>(constant_time_is_zero_w(b) & 1)},
+    {static_cast<uint8_t>(constant_time_is_zero_w(b) & 1)},
+    {0},
+  };
 #if defined(__clang__)
   __asm__("" : "+m" (t_bytes) : /*no inputs*/);
 #endif

data/third_party/boringssl-with-bazel/src/third_party/fiat/p256_32.h

@@ -23,7 +23,7 @@ typedef signed char fiat_p256_int1;
 #if defined(__GNUC__) || defined(__clang__)
 #  define FIAT_P256_FIAT_INLINE __inline__
 #else
-#  define FIAT_P256_FIAT_INLINE
+#  define FIAT_P256_FIAT_INLINE inline
 #endif
 
 /* The type fiat_p256_montgomery_domain_field_element is a field element in the Montgomery domain. */

data/third_party/boringssl-with-bazel/src/third_party/fiat/p256_64.h

@@ -1,8 +1,11 @@
 #include <openssl/base.h>
 #include "../../crypto/internal.h"
+
 #if !defined(OPENSSL_NO_ASM) && defined(__GNUC__) && defined(__x86_64__)
+extern "C" {
 void fiat_p256_adx_mul(uint64_t*, const uint64_t*, const uint64_t*);
 void fiat_p256_adx_sqr(uint64_t*, const uint64_t*);
+}
 #endif
 
 /* Autogenerated: 'src/ExtractionOCaml/word_by_word_montgomery' --inline --static --use-value-barrier p256 64 '2^256 - 2^224 + 2^192 + 2^96 - 1' mul square add sub opp from_montgomery to_montgomery nonzero selectznz to_bytes from_bytes one msat divstep divstep_precomp */