grpc 1.69.0 → 1.71.0

data/third_party/boringssl-with-bazel/src/ssl/tls_method.cc

@@ -1,58 +1,16 @@
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.] */
+// Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
 
 #include <openssl/ssl.h>
 
@@ -84,7 +42,7 @@ static void tls_on_handshake_complete(SSL *ssl) {
 
 static bool tls_set_read_state(SSL *ssl, ssl_encryption_level_t level,
                                UniquePtr<SSLAEADContext> aead_ctx,
-                               Span<const uint8_t> secret_for_quic) {
+                               Span<const uint8_t> traffic_secret) {
   // Cipher changes are forbidden if the current epoch has leftover data.
   if (tls_has_unprocessed_handshake_data(ssl)) {
     OPENSSL_PUT_ERROR(SSL, SSL_R_EXCESS_HANDSHAKE_DATA);
@@ -92,11 +50,11 @@ static bool tls_set_read_state(SSL *ssl, ssl_encryption_level_t level,
     return false;
   }
 
-  if (ssl->quic_method != nullptr) {
+  if (SSL_is_quic(ssl)) {
     if ((ssl->s3->hs == nullptr || !ssl->s3->hs->hints_requested) &&
         !ssl->quic_method->set_read_secret(ssl, level, aead_ctx->cipher(),
-                                           secret_for_quic.data(),
-                                           secret_for_quic.size())) {
+                                           traffic_secret.data(),
+                                           traffic_secret.size())) {
       return false;
     }
 
@@ -106,26 +64,26 @@ static bool tls_set_read_state(SSL *ssl, ssl_encryption_level_t level,
     if (level == ssl_encryption_early_data) {
       return true;
     }
+    ssl->s3->quic_read_level = level;
   }
 
   ssl->s3->read_sequence = 0;
   ssl->s3->aead_read_ctx = std::move(aead_ctx);
-  ssl->s3->read_level = level;
   return true;
 }
 
 static bool tls_set_write_state(SSL *ssl, ssl_encryption_level_t level,
                                 UniquePtr<SSLAEADContext> aead_ctx,
-                                Span<const uint8_t> secret_for_quic) {
+                                Span<const uint8_t> traffic_secret) {
   if (!tls_flush_pending_hs_data(ssl)) {
     return false;
   }
 
-  if (ssl->quic_method != nullptr) {
+  if (SSL_is_quic(ssl)) {
     if ((ssl->s3->hs == nullptr || !ssl->s3->hs->hints_requested) &&
         !ssl->quic_method->set_write_secret(ssl, level, aead_ctx->cipher(),
-                                            secret_for_quic.data(),
-                                            secret_for_quic.size())) {
+                                            traffic_secret.data(),
+                                            traffic_secret.size())) {
       return false;
     }
 
@@ -135,14 +93,23 @@ static bool tls_set_write_state(SSL *ssl, ssl_encryption_level_t level,
     if (level == ssl_encryption_early_data) {
       return true;
     }
+    ssl->s3->quic_write_level = level;
   }
 
   ssl->s3->write_sequence = 0;
   ssl->s3->aead_write_ctx = std::move(aead_ctx);
-  ssl->s3->write_level = level;
   return true;
 }
 
+static void tls_finish_flight(SSL *ssl) {
+  // We don't track whether a flight is complete in TLS and instead always flush
+  // every queued message in |tls_flush|, whether the flight is complete or not.
+}
+
+static void tls_schedule_ack(SSL *ssl) {
+  // TLS does not use ACKs.
+}
+
 static const SSL_PROTOCOL_METHOD kTLSProtocolMethod = {
     false /* is_dtls */,
     tls_new,
@@ -159,7 +126,9 @@ static const SSL_PROTOCOL_METHOD kTLSProtocolMethod = {
     tls_finish_message,
     tls_add_message,
     tls_add_change_cipher_spec,
-    tls_flush_flight,
+    tls_finish_flight,
+    tls_schedule_ack,
+    tls_flush,
     tls_on_handshake_complete,
     tls_set_read_state,
     tls_set_write_state,
@@ -201,24 +170,24 @@ static void ssl_noop_x509_ssl_ctx_free(SSL_CTX *ctx) {}
 static void ssl_noop_x509_ssl_ctx_flush_cached_client_CA(SSL_CTX *ctx) {}
 
 const SSL_X509_METHOD ssl_noop_x509_method = {
-  ssl_noop_x509_check_client_CA_names,
-  ssl_noop_x509_clear,
-  ssl_noop_x509_free,
-  ssl_noop_x509_dup,
-  ssl_noop_x509_flush_cached_chain,
-  ssl_noop_x509_flush_cached_leaf,
-  ssl_noop_x509_session_cache_objects,
-  ssl_noop_x509_session_dup,
-  ssl_noop_x509_session_clear,
-  ssl_noop_x509_session_verify_cert_chain,
-  ssl_noop_x509_hs_flush_cached_ca_names,
-  ssl_noop_x509_ssl_new,
-  ssl_noop_x509_ssl_config_free,
-  ssl_noop_x509_ssl_flush_cached_client_CA,
-  ssl_noop_x509_ssl_auto_chain_if_needed,
-  ssl_noop_x509_ssl_ctx_new,
-  ssl_noop_x509_ssl_ctx_free,
-  ssl_noop_x509_ssl_ctx_flush_cached_client_CA,
+    ssl_noop_x509_check_client_CA_names,
+    ssl_noop_x509_clear,
+    ssl_noop_x509_free,
+    ssl_noop_x509_dup,
+    ssl_noop_x509_flush_cached_chain,
+    ssl_noop_x509_flush_cached_leaf,
+    ssl_noop_x509_session_cache_objects,
+    ssl_noop_x509_session_dup,
+    ssl_noop_x509_session_clear,
+    ssl_noop_x509_session_verify_cert_chain,
+    ssl_noop_x509_hs_flush_cached_ca_names,
+    ssl_noop_x509_ssl_new,
+    ssl_noop_x509_ssl_config_free,
+    ssl_noop_x509_ssl_flush_cached_client_CA,
+    ssl_noop_x509_ssl_auto_chain_if_needed,
+    ssl_noop_x509_ssl_ctx_new,
+    ssl_noop_x509_ssl_ctx_free,
+    ssl_noop_x509_ssl_ctx_flush_cached_client_CA,
 };
 
 BSSL_NAMESPACE_END
@@ -234,9 +203,7 @@ const SSL_METHOD *TLS_method(void) {
   return &kMethod;
 }
 
-const SSL_METHOD *SSLv23_method(void) {
-  return TLS_method();
-}
+const SSL_METHOD *SSLv23_method(void) { return TLS_method(); }
 
 const SSL_METHOD *TLS_with_buffers_method(void) {
   static const SSL_METHOD kMethod = {
@@ -278,42 +245,22 @@ const SSL_METHOD *TLSv1_method(void) {
 
 // Legacy side-specific methods.
 
-const SSL_METHOD *TLSv1_2_server_method(void) {
-  return TLSv1_2_method();
-}
+const SSL_METHOD *TLSv1_2_server_method(void) { return TLSv1_2_method(); }
 
-const SSL_METHOD *TLSv1_1_server_method(void) {
-  return TLSv1_1_method();
-}
+const SSL_METHOD *TLSv1_1_server_method(void) { return TLSv1_1_method(); }
 
-const SSL_METHOD *TLSv1_server_method(void) {
-  return TLSv1_method();
-}
+const SSL_METHOD *TLSv1_server_method(void) { return TLSv1_method(); }
 
-const SSL_METHOD *TLSv1_2_client_method(void) {
-  return TLSv1_2_method();
-}
+const SSL_METHOD *TLSv1_2_client_method(void) { return TLSv1_2_method(); }
 
-const SSL_METHOD *TLSv1_1_client_method(void) {
-  return TLSv1_1_method();
-}
+const SSL_METHOD *TLSv1_1_client_method(void) { return TLSv1_1_method(); }
 
-const SSL_METHOD *TLSv1_client_method(void) {
-  return TLSv1_method();
-}
+const SSL_METHOD *TLSv1_client_method(void) { return TLSv1_method(); }
 
-const SSL_METHOD *SSLv23_server_method(void) {
-  return SSLv23_method();
-}
+const SSL_METHOD *SSLv23_server_method(void) { return SSLv23_method(); }
 
-const SSL_METHOD *SSLv23_client_method(void) {
-  return SSLv23_method();
-}
+const SSL_METHOD *SSLv23_client_method(void) { return SSLv23_method(); }
 
-const SSL_METHOD *TLS_server_method(void) {
-  return TLS_method();
-}
+const SSL_METHOD *TLS_server_method(void) { return TLS_method(); }
 
-const SSL_METHOD *TLS_client_method(void) {
-  return TLS_method();
-}
+const SSL_METHOD *TLS_client_method(void) { return TLS_method(); }

data/third_party/boringssl-with-bazel/src/ssl/tls_record.cc

@@ -1,110 +1,16 @@
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-/* ====================================================================
- * Copyright (c) 1998-2002 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    openssl-core@openssl.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com). */
+// Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
 
 #include <openssl/ssl.h>
 
@@ -115,8 +21,8 @@
 #include <openssl/err.h>
 #include <openssl/mem.h>
 
-#include "internal.h"
 #include "../crypto/internal.h"
+#include "internal.h"
 
 
 BSSL_NAMESPACE_BEGIN
@@ -143,7 +49,7 @@ static const uint8_t kMaxWarningAlerts = 4;
 bool ssl_needs_record_splitting(const SSL *ssl) {
 #if !defined(BORINGSSL_UNSAFE_FUZZER_MODE)
   return !ssl->s3->aead_write_ctx->is_null_cipher() &&
-         ssl->s3->aead_write_ctx->ProtocolVersion() < TLS1_1_VERSION &&
+         ssl_protocol_version(ssl) < TLS1_1_VERSION &&
          (ssl->mode & SSL_MODE_CBC_RECORD_SPLITTING) != 0 &&
          SSL_CIPHER_is_block_cipher(ssl->s3->aead_write_ctx->cipher());
 #else
@@ -172,6 +78,19 @@ static ssl_open_record_t skip_early_data(SSL *ssl, uint8_t *out_alert,
   return ssl_open_record_discard;
 }
 
+static uint16_t tls_record_version(const SSL *ssl) {
+  if (ssl->s3->version == 0) {
+    // Before the version is determined, outgoing records use TLS 1.0 for
+    // historical compatibility requirements.
+    return TLS1_VERSION;
+  }
+
+  // TLS 1.3 freezes the record version at TLS 1.2. Previous ones use the
+  // version itself.
+  return ssl_protocol_version(ssl) >= TLS1_3_VERSION ? TLS1_2_VERSION
+                                                     : ssl->s3->version;
+}
+
 ssl_open_record_t tls_open_record(SSL *ssl, uint8_t *out_type,
                                   Span<uint8_t> *out, size_t *out_consumed,
                                   uint8_t *out_alert, Span<uint8_t> in) {
@@ -191,8 +110,8 @@ ssl_open_record_t tls_open_record(SSL *ssl, uint8_t *out_type,
   // Decode the record header.
   uint8_t type;
   uint16_t version, ciphertext_len;
-  if (!CBS_get_u8(&cbs, &type) ||
-      !CBS_get_u16(&cbs, &version) ||
+  if (!CBS_get_u8(&cbs, &type) ||      //
+      !CBS_get_u16(&cbs, &version) ||  //
       !CBS_get_u16(&cbs, &ciphertext_len)) {
     *out_consumed = SSL3_RT_HEADER_LENGTH;
     return ssl_open_record_partial;
@@ -204,7 +123,7 @@ ssl_open_record_t tls_open_record(SSL *ssl, uint8_t *out_type,
     // version negotiation failure alerts.
     version_ok = (version >> 8) == SSL3_VERSION_MAJOR;
   } else {
-    version_ok = version == ssl->s3->aead_read_ctx->RecordVersion();
+    version_ok = version == tls_record_version(ssl);
   }
 
   if (!version_ok) {
@@ -232,12 +151,12 @@ ssl_open_record_t tls_open_record(SSL *ssl, uint8_t *out_type,
 
   *out_consumed = in.size() - CBS_len(&cbs);
 
-  if (ssl->s3->have_version &&
-      ssl_protocol_version(ssl) >= TLS1_3_VERSION &&
-      SSL_in_init(ssl) &&
+  // In TLS 1.3, during the handshake, skip ChangeCipherSpec records.
+  static const uint8_t kChangeCipherSpec[] = {SSL3_MT_CCS};
+  if (ssl_has_final_version(ssl) &&
+      ssl_protocol_version(ssl) >= TLS1_3_VERSION && SSL_in_init(ssl) &&
       type == SSL3_RT_CHANGE_CIPHER_SPEC &&
-      ciphertext_len == 1 &&
-      CBS_data(&body)[0] == 1) {
+      Span<const uint8_t>(body) == kChangeCipherSpec) {
     ssl->s3->empty_record_count++;
     if (ssl->s3->empty_record_count > kMaxEmptyRecords) {
       OPENSSL_PUT_ERROR(SSL, SSL_R_TOO_MANY_EMPTY_FRAGMENTS);
@@ -249,8 +168,8 @@ ssl_open_record_t tls_open_record(SSL *ssl, uint8_t *out_type,
 
   // Skip early data received when expecting a second ClientHello if we rejected
   // 0RTT.
-  if (ssl->s3->skip_early_data &&
-      ssl->s3->aead_read_ctx->is_null_cipher() &&
+  if (ssl->s3->skip_early_data &&                  //
+      ssl->s3->aead_read_ctx->is_null_cipher() &&  //
       type == SSL3_RT_APPLICATION_DATA) {
     return skip_early_data(ssl, out_alert, *out_consumed);
   }
@@ -265,7 +184,7 @@ ssl_open_record_t tls_open_record(SSL *ssl, uint8_t *out_type,
   // Decrypt the body in-place.
   if (!ssl->s3->aead_read_ctx->Open(
           out, type, version, ssl->s3->read_sequence, header,
-          MakeSpan(const_cast<uint8_t *>(CBS_data(&body)), CBS_len(&body)))) {
+          Span(const_cast<uint8_t *>(CBS_data(&body)), CBS_len(&body)))) {
     if (ssl->s3->skip_early_data && !ssl->s3->aead_read_ctx->is_null_cipher()) {
       ERR_clear_error();
       return skip_early_data(ssl, out_alert, *out_consumed);
@@ -280,9 +199,8 @@ ssl_open_record_t tls_open_record(SSL *ssl, uint8_t *out_type,
   ssl->s3->read_sequence++;
 
   // TLS 1.3 hides the record type inside the encrypted data.
-  bool has_padding =
-      !ssl->s3->aead_read_ctx->is_null_cipher() &&
-      ssl->s3->aead_read_ctx->ProtocolVersion() >= TLS1_3_VERSION;
+  bool has_padding = !ssl->s3->aead_read_ctx->is_null_cipher() &&
+                     ssl_protocol_version(ssl) >= TLS1_3_VERSION;
 
   // If there is padding, the plaintext limit includes the padding, but includes
   // extra room for the inner content type.
@@ -332,7 +250,7 @@ ssl_open_record_t tls_open_record(SSL *ssl, uint8_t *out_type,
   }
 
   // Handshake messages may not interleave with any other record type.
-  if (type != SSL3_RT_HANDSHAKE &&
+  if (type != SSL3_RT_HANDSHAKE &&  //
       tls_has_unprocessed_handshake_data(ssl)) {
     OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_RECORD);
     *out_alert = SSL_AD_UNEXPECTED_MESSAGE;
@@ -351,8 +269,7 @@ static bool do_seal_record(SSL *ssl, uint8_t *out_prefix, uint8_t *out,
   SSLAEADContext *aead = ssl->s3->aead_write_ctx.get();
   uint8_t *extra_in = NULL;
   size_t extra_in_len = 0;
-  if (!aead->is_null_cipher() &&
-      aead->ProtocolVersion() >= TLS1_3_VERSION) {
+  if (!aead->is_null_cipher() && ssl_protocol_version(ssl) >= TLS1_3_VERSION) {
     // TLS 1.3 hides the actual record type inside the encrypted data.
     extra_in = &type;
     extra_in_len = 1;
@@ -375,13 +292,12 @@ static bool do_seal_record(SSL *ssl, uint8_t *out_prefix, uint8_t *out,
     out_prefix[0] = type;
   }
 
-  uint16_t record_version = aead->RecordVersion();
-
+  uint16_t record_version = tls_record_version(ssl);
   out_prefix[1] = record_version >> 8;
   out_prefix[2] = record_version & 0xff;
   out_prefix[3] = ciphertext_len >> 8;
   out_prefix[4] = ciphertext_len & 0xff;
-  Span<const uint8_t> header = MakeSpan(out_prefix, SSL3_RT_HEADER_LENGTH);
+  Span<const uint8_t> header = Span(out_prefix, SSL3_RT_HEADER_LENGTH);
 
   // Ensure the sequence number update does not overflow.
   if (ssl->s3->write_sequence + 1 == 0) {
@@ -421,7 +337,7 @@ static bool tls_seal_scatter_suffix_len(const SSL *ssl, size_t *out_suffix_len,
                                         uint8_t type, size_t in_len) {
   size_t extra_in_len = 0;
   if (!ssl->s3->aead_write_ctx->is_null_cipher() &&
-      ssl->s3->aead_write_ctx->ProtocolVersion() >= TLS1_3_VERSION) {
+      ssl_protocol_version(ssl) >= TLS1_3_VERSION) {
     // TLS 1.3 adds an extra byte for encrypted record type.
     extra_in_len = 1;
   }
@@ -434,7 +350,8 @@ static bool tls_seal_scatter_suffix_len(const SSL *ssl, size_t *out_suffix_len,
     in_len -= 1;
   }
   // clang-format on
-  return ssl->s3->aead_write_ctx->SuffixLen(out_suffix_len, in_len, extra_in_len);
+  return ssl->s3->aead_write_ctx->SuffixLen(out_suffix_len, in_len,
+                                            extra_in_len);
 }
 
 // tls_seal_scatter_record seals a new record of type |type| and body |in| and
@@ -551,7 +468,7 @@ enum ssl_open_record_t ssl_process_alert(SSL *ssl, uint8_t *out_alert,
     // without specifying how to handle it. JDK11 misuses it to signal
     // full-duplex connection close after the handshake. As a workaround, skip
     // user_canceled as in TLS 1.2. This matches NSS and OpenSSL.
-    if (ssl->s3->have_version &&
+    if (ssl_has_final_version(ssl) &&
         ssl_protocol_version(ssl) >= TLS1_3_VERSION &&
         alert_descr != SSL_AD_USER_CANCELLED) {
       *out_alert = SSL_AD_DECODE_ERROR;
@@ -586,14 +503,15 @@ using namespace bssl;
 
 size_t SSL_max_seal_overhead(const SSL *ssl) {
   if (SSL_is_dtls(ssl)) {
-    return dtls_max_seal_overhead(ssl, ssl->d1->w_epoch);
+    // TODO(crbug.com/381113363): Use the 0-RTT epoch if writing 0-RTT.
+    return dtls_max_seal_overhead(ssl, ssl->d1->write_epoch.epoch());
   }
 
   size_t ret = SSL3_RT_HEADER_LENGTH;
   ret += ssl->s3->aead_write_ctx->MaxOverhead();
   // TLS 1.3 needs an extra byte for the encrypted record type.
   if (!ssl->s3->aead_write_ctx->is_null_cipher() &&
-      ssl->s3->aead_write_ctx->ProtocolVersion() >= TLS1_3_VERSION) {
+      ssl_protocol_version(ssl) >= TLS1_3_VERSION) {
     ret += 1;
   }
   if (ssl_needs_record_splitting(ssl)) {

data/third_party/boringssl-with-bazel/src/third_party/fiat/curve25519_32.h

@@ -928,6 +928,8 @@ static FIAT_25519_FIAT_INLINE void fiat_25519_opp(fiat_25519_loose_field_element
   out1[9] = x10;
 }
 
+/* Not used in BoringSSL. */
+#if 0
 /*
  * The function fiat_25519_selectznz is a multi-limb conditional select.
  *
@@ -973,6 +975,7 @@ static FIAT_25519_FIAT_INLINE void fiat_25519_selectznz(uint32_t out1[10], fiat_
   out1[8] = x9;
   out1[9] = x10;
 }
+#endif
 
 /*
  * The function fiat_25519_to_bytes serializes a field element to bytes in little-endian order.
@@ -1410,6 +1413,8 @@ static FIAT_25519_FIAT_INLINE void fiat_25519_from_bytes(fiat_25519_tight_field_
   out1[9] = x78;
 }
 
+/* Not used in BoringSSL. */
+#if 0
 /*
  * The function fiat_25519_relax is the identity function converting from tight field elements to loose field elements.
  *
@@ -1449,6 +1454,7 @@ static FIAT_25519_FIAT_INLINE void fiat_25519_relax(fiat_25519_loose_field_eleme
   out1[8] = x9;
   out1[9] = x10;
 }
+#endif
 
 /*
  * The function fiat_25519_carry_scmul_121666 multiplies a field element by 121666 and reduces the result.

data/third_party/boringssl-with-bazel/src/third_party/fiat/curve25519_64.h

@@ -471,6 +471,8 @@ static FIAT_25519_FIAT_INLINE void fiat_25519_opp(fiat_25519_loose_field_element
   out1[4] = x5;
 }
 
+/* Not used in BoringSSL. */
+#if 0
 /*
  * The function fiat_25519_selectznz is a multi-limb conditional select.
  *
@@ -501,6 +503,7 @@ static FIAT_25519_FIAT_INLINE void fiat_25519_selectznz(uint64_t out1[5], fiat_2
   out1[3] = x4;
   out1[4] = x5;
 }
+#endif
 
 /*
  * The function fiat_25519_to_bytes serializes a field element to bytes in little-endian order.
@@ -877,6 +880,8 @@ static FIAT_25519_FIAT_INLINE void fiat_25519_from_bytes(fiat_25519_tight_field_
   out1[4] = x71;
 }
 
+/* Not used in BoringSSL. */
+#if 0
 /*
  * The function fiat_25519_relax is the identity function converting from tight field elements to loose field elements.
  *
@@ -901,6 +906,7 @@ static FIAT_25519_FIAT_INLINE void fiat_25519_relax(fiat_25519_loose_field_eleme
   out1[3] = x4;
   out1[4] = x5;
 }
+#endif
 
 /*
  * The function fiat_25519_carry_scmul_121666 multiplies a field element by 121666 and reduces the result.

data/third_party/boringssl-with-bazel/src/third_party/fiat/curve25519_64_adx.h

@@ -611,7 +611,10 @@ static inline void table_select_4(ge_precomp_4 *t, const int pos,
   uint8_t babs = b - ((bnegative & b) << 1);
 
   uint8_t t_bytes[3][32] = {
-      {constant_time_is_zero_w(b) & 1}, {constant_time_is_zero_w(b) & 1}, {0}};
+    {static_cast<uint8_t>(constant_time_is_zero_w(b) & 1)},
+    {static_cast<uint8_t>(constant_time_is_zero_w(b) & 1)},
+    {0},
+  };
 #if defined(__clang__)
   __asm__("" : "+m" (t_bytes) : /*no inputs*/);
 #endif

data/third_party/boringssl-with-bazel/src/third_party/fiat/p256_32.h

@@ -23,7 +23,7 @@ typedef signed char fiat_p256_int1;
 #if defined(__GNUC__) || defined(__clang__)
 #  define FIAT_P256_FIAT_INLINE __inline__
 #else
-#  define FIAT_P256_FIAT_INLINE
+#  define FIAT_P256_FIAT_INLINE inline
 #endif
 
 /* The type fiat_p256_montgomery_domain_field_element is a field element in the Montgomery domain. */