grpc 1.81.1 → 1.85.0

data/third_party/boringssl-with-bazel/ssl/ssl_session.cc

@@ -21,10 +21,12 @@
 
 #include <utility>
 
+#include <openssl/cipher.h>
 #include <openssl/err.h>
+#include <openssl/evp.h>
 #include <openssl/hmac.h>
-#include <openssl/lhash.h>
 #include <openssl/mem.h>
+#include <openssl/pool.h>
 #include <openssl/rand.h>
 
 #include "../crypto/internal.h"
@@ -38,18 +40,17 @@ BSSL_NAMESPACE_BEGIN
 // that it needs to asynchronously fetch session information.
 static const char g_pending_session_magic = 0;
 
-static CRYPTO_EX_DATA_CLASS g_ex_data_class =
-    CRYPTO_EX_DATA_CLASS_INIT_WITH_APP_DATA;
+static ExDataClass g_ex_data_class(/*with_app_data=*/true);
 
-static void SSL_SESSION_list_remove(SSL_CTX *ctx, SSL_SESSION *session);
-static void SSL_SESSION_list_add(SSL_CTX *ctx, SSL_SESSION *session);
+static void SSL_SESSION_list_remove(SSLContext *ctx, SSL_SESSION *session);
+static void SSL_SESSION_list_add(SSLContext *ctx, SSL_SESSION *session);
 
 UniquePtr<SSL_SESSION> ssl_session_new(const SSL_X509_METHOD *x509_method) {
   return MakeUnique<SSL_SESSION>(x509_method);
 }
 
 uint32_t ssl_hash_session_id(Span<const uint8_t> session_id) {
-  // Take the first four bytes of |session_id|. Session IDs are generated by the
+  // Take the first four bytes of `session_id`. Session IDs are generated by the
   // server randomly, so we can assume even using the first four bytes results
   // in a good distribution.
   uint8_t tmp_storage[sizeof(uint32_t)];
@@ -66,7 +67,8 @@ uint32_t ssl_hash_session_id(Span<const uint8_t> session_id) {
   return hash;
 }
 
-UniquePtr<SSL_SESSION> SSL_SESSION_dup(SSL_SESSION *session, int dup_flags) {
+UniquePtr<SSL_SESSION> SSL_SESSION_dup(const SSL_SESSION *session,
+                                       int dup_flags) {
   UniquePtr<SSL_SESSION> new_session = ssl_session_new(session->x509_method);
   if (!new_session) {
     return nullptr;
@@ -89,17 +91,17 @@ UniquePtr<SSL_SESSION> SSL_SESSION_dup(SSL_SESSION *session, int dup_flags) {
       return nullptr;
     }
   }
+  new_session->peer_cert_type = session->peer_cert_type;
   if (session->certs != nullptr) {
-    auto buf_up_ref = [](const CRYPTO_BUFFER *buf) {
-      CRYPTO_BUFFER_up_ref(const_cast<CRYPTO_BUFFER *>(buf));
-      return const_cast<CRYPTO_BUFFER *>(buf);
-    };
     new_session->certs.reset(sk_CRYPTO_BUFFER_deep_copy(
-        session->certs.get(), buf_up_ref, CRYPTO_BUFFER_free));
+        session->certs.get(), CRYPTO_BUFFER_dup_ref, CRYPTO_BUFFER_free));
     if (new_session->certs == nullptr) {
       return nullptr;
     }
   }
+  if (session->peer_raw_public_key != nullptr) {
+    new_session->peer_raw_public_key = UpRef(session->peer_raw_public_key);
+  }
 
   if (!session->x509_method->session_dup(new_session.get(), session)) {
     return nullptr;
@@ -185,7 +187,7 @@ void ssl_session_rebase_time(SSL *ssl, SSL_SESSION *session) {
 
 void ssl_session_renew_timeout(SSL *ssl, SSL_SESSION *session,
                                uint32_t timeout) {
-  // Rebase the timestamp relative to the current time so |timeout| is measured
+  // Rebase the timestamp relative to the current time so `timeout` is measured
   // correctly.
   ssl_session_rebase_time(ssl, session);
 
@@ -202,7 +204,7 @@ void ssl_session_renew_timeout(SSL *ssl, SSL_SESSION *session,
 uint16_t ssl_session_protocol_version(const SSL_SESSION *session) {
   uint16_t ret;
   if (!ssl_protocol_version_from_wire(&ret, session->ssl_version)) {
-    // An |SSL_SESSION| will never have an invalid version. This is enforced by
+    // An `SSL_SESSION` will never have an invalid version. This is enforced by
     // the parser.
     assert(0);
     return 0;
@@ -224,7 +226,7 @@ bool ssl_get_new_session(SSL_HANDSHAKE *hs) {
   }
 
   UniquePtr<SSL_SESSION> session = ssl_session_new(ssl->ctx->x509_method);
-  if (session == NULL) {
+  if (session == nullptr) {
     return false;
   }
 
@@ -232,7 +234,7 @@ bool ssl_get_new_session(SSL_HANDSHAKE *hs) {
   session->ssl_version = ssl->s3->version;
   session->is_quic = SSL_is_quic(ssl);
 
-  // Fill in the time from the |SSL_CTX|'s clock.
+  // Fill in the time from the `SSL_CTX`'s clock.
   OPENSSL_timeval now = ssl_ctx_get_current_time(ssl->ctx.get());
   session->time = now.tv_sec;
 
@@ -259,11 +261,11 @@ bool ssl_get_new_session(SSL_HANDSHAKE *hs) {
   session->verify_result = X509_V_ERR_INVALID_CALL;
 
   hs->new_session = std::move(session);
-  ssl_set_session(ssl, NULL);
+  ssl_set_session(ssl, nullptr);
   return true;
 }
 
-bool ssl_ctx_rotate_ticket_encryption_key(SSL_CTX *ctx) {
+bool ssl_ctx_rotate_ticket_encryption_key(SSLContext *ctx) {
   OPENSSL_timeval now = ssl_ctx_get_current_time(ctx);
   {
     // Avoid acquiring a write lock in the common case (i.e. a non-default key
@@ -327,17 +329,17 @@ static int ssl_encrypt_ticket_with_cipher_ctx(SSL_HANDSHAKE *hs, CBB *out,
 
   // Initialize HMAC and cipher contexts. If callback present it does all the
   // work otherwise use generated values from parent ctx.
-  SSL_CTX *tctx = hs->ssl->session_ctx.get();
+  SSLContext *tctx = hs->ssl->session_ctx.get();
   uint8_t iv[EVP_MAX_IV_LENGTH];
   uint8_t key_name[16];
-  if (tctx->ticket_key_cb != NULL) {
+  if (tctx->ticket_key_cb != nullptr) {
     int ret = tctx->ticket_key_cb(hs->ssl, key_name, iv, ctx.get(), hctx.get(),
                                   1 /* encrypt */);
     if (ret < 0) {
       return 0;
     }
     if (ret == 0) {
-      // The caller requested to send no ticket, so write nothing to |out|.
+      // The caller requested to send no ticket, so write nothing to `out`.
       return 1;
     }
   } else {
@@ -347,10 +349,10 @@ static int ssl_encrypt_ticket_with_cipher_ctx(SSL_HANDSHAKE *hs, CBB *out,
     }
     MutexReadLock lock(&tctx->lock);
     if (!RAND_bytes(iv, 16) ||
-        !EVP_EncryptInit_ex(ctx.get(), EVP_aes_128_cbc(), NULL,
+        !EVP_EncryptInit_ex(ctx.get(), EVP_aes_128_cbc(), nullptr,
                             tctx->ticket_key_current->aes_key, iv) ||
         !HMAC_Init_ex(hctx.get(), tctx->ticket_key_current->hmac_key, 16,
-                      tlsext_tick_md(), NULL)) {
+                      tlsext_tick_md(), nullptr)) {
       return 0;
     }
     OPENSSL_memcpy(key_name, tctx->ticket_key_current->name, 16);
@@ -368,13 +370,15 @@ static int ssl_encrypt_ticket_with_cipher_ctx(SSL_HANDSHAKE *hs, CBB *out,
     OPENSSL_memcpy(ptr, session_buf, session_len);
     total = session_len;
   } else {
-    int len;
-    if (!EVP_EncryptUpdate(ctx.get(), ptr + total, &len, session_buf,
-                           session_len)) {
+    size_t len;
+    if (!EVP_EncryptUpdate_ex(ctx.get(), ptr + total, &len,
+                              session_len + EVP_MAX_BLOCK_LENGTH - total,
+                              session_buf, session_len)) {
       return 0;
     }
     total += len;
-    if (!EVP_EncryptFinal_ex(ctx.get(), ptr + total, &len)) {
+    if (!EVP_EncryptFinal_ex2(ctx.get(), ptr + total, &len,
+                              session_len + EVP_MAX_BLOCK_LENGTH - total)) {
       return 0;
     }
     total += len;
@@ -466,7 +470,7 @@ bool ssl_session_is_context_valid(const SSL_HANDSHAKE *hs,
 }
 
 bool ssl_session_is_time_valid(const SSL *ssl, const SSL_SESSION *session) {
-  if (session == NULL) {
+  if (session == nullptr) {
     return false;
   }
 
@@ -498,11 +502,10 @@ bool ssl_session_is_resumable(const SSL_HANDSHAKE *hs,
          // simplicity. If loosening this, the 0-RTT accept logic must be
          // updated to check the cipher.
          hs->new_cipher == session->cipher &&
-         // If the session contains a client certificate (either the full
-         // certificate or just the hash) then require that the form of the
-         // certificate matches the current configuration.
-         ((sk_CRYPTO_BUFFER_num(session->certs.get()) == 0 &&
-           !session->peer_sha256_valid) ||
+         // If the session contains a client certificate/RPK (either the full
+         // certificate/RPK or just the hash) then require that the form of the
+         // certificate/RPK matches the current configuration.
+         (!ssl_session_has_peer_cred(session) ||
           session->peer_sha256_valid ==
               hs->config->retain_only_sha256_of_client_certs) &&
          // Only resume if the underlying transport protocol hasn't changed.
@@ -510,8 +513,8 @@ bool ssl_session_is_resumable(const SSL_HANDSHAKE *hs,
          SSL_is_quic(ssl) == int{session->is_quic};
 }
 
-// ssl_lookup_session looks up |session_id| in the session cache and sets
-// |*out_session| to an |SSL_SESSION| object if found.
+// ssl_lookup_session looks up `session_id` in the session cache and sets
+// `*out_session` to an `SSL_SESSION` object if found.
 static enum ssl_hs_wait_t ssl_lookup_session(
     SSL_HANDSHAKE *hs, UniquePtr<SSL_SESSION> *out_session,
     Span<const uint8_t> session_id) {
@@ -533,7 +536,7 @@ static enum ssl_hs_wait_t ssl_lookup_session(
       return key_id == sess->session_id ? 0 : 1;
     };
     MutexReadLock lock(&ssl->session_ctx->lock);
-    // |lh_SSL_SESSION_retrieve_key| returns a non-owning pointer.
+    // `lh_SSL_SESSION_retrieve_key` returns a non-owning pointer.
     session = UpRef(lh_SSL_SESSION_retrieve_key(ssl->session_ctx->sessions,
                                                 &session_id, hash, cmp));
     // TODO(davidben): This should probably move it to the front of the list.
@@ -597,7 +600,8 @@ enum ssl_hs_wait_t ssl_get_prev_session(SSL_HANDSHAKE *hs,
   if (tickets_supported && CBS_len(&ticket) != 0) {
     switch (ssl_process_ticket(
         hs, &session, &renew_ticket, ticket,
-        Span(client_hello->session_id, client_hello->session_id_len))) {
+        Span(client_hello->session_id, client_hello->session_id_len),
+        /*save_ticket=*/false)) {
       case ssl_ticket_aead_success:
         break;
       case ssl_ticket_aead_ignore_ticket:
@@ -624,13 +628,13 @@ enum ssl_hs_wait_t ssl_get_prev_session(SSL_HANDSHAKE *hs,
   return ssl_hs_ok;
 }
 
-static bool remove_session(SSL_CTX *ctx, SSL_SESSION *session, bool lock) {
+static bool remove_session(SSLContext *ctx, SSL_SESSION *session, bool lock) {
   if (session == nullptr || session->session_id.empty()) {
     return false;
   }
 
   if (lock) {
-    CRYPTO_MUTEX_lock_write(&ctx->lock);
+    ctx->lock.LockWrite();
   }
 
   SSL_SESSION *found_session = lh_SSL_SESSION_retrieve(ctx->sessions, session);
@@ -641,7 +645,7 @@ static bool remove_session(SSL_CTX *ctx, SSL_SESSION *session, bool lock) {
   }
 
   if (lock) {
-    CRYPTO_MUTEX_unlock_write(&ctx->lock);
+    ctx->lock.UnlockWrite();
   }
 
   if (found) {
@@ -665,8 +669,8 @@ void ssl_set_session(SSL *ssl, SSL_SESSION *session) {
 }
 
 // locked by SSL_CTX in the calling function
-static void SSL_SESSION_list_remove(SSL_CTX *ctx, SSL_SESSION *session) {
-  if (session->next == NULL || session->prev == NULL) {
+static void SSL_SESSION_list_remove(SSLContext *ctx, SSL_SESSION *session) {
+  if (session->next == nullptr || session->prev == nullptr) {
     return;
   }
 
@@ -674,8 +678,8 @@ static void SSL_SESSION_list_remove(SSL_CTX *ctx, SSL_SESSION *session) {
     // last element in list
     if (session->prev == (SSL_SESSION *)&ctx->session_cache_head) {
       // only one element in list
-      ctx->session_cache_head = NULL;
-      ctx->session_cache_tail = NULL;
+      ctx->session_cache_head = nullptr;
+      ctx->session_cache_tail = nullptr;
     } else {
       ctx->session_cache_tail = session->prev;
       session->prev->next = (SSL_SESSION *)&(ctx->session_cache_tail);
@@ -690,15 +694,15 @@ static void SSL_SESSION_list_remove(SSL_CTX *ctx, SSL_SESSION *session) {
       session->prev->next = session->next;
     }
   }
-  session->prev = session->next = NULL;
+  session->prev = session->next = nullptr;
 }
 
-static void SSL_SESSION_list_add(SSL_CTX *ctx, SSL_SESSION *session) {
-  if (session->next != NULL && session->prev != NULL) {
+static void SSL_SESSION_list_add(SSLContext *ctx, SSL_SESSION *session) {
+  if (session->next != nullptr && session->prev != nullptr) {
     SSL_SESSION_list_remove(ctx, session);
   }
 
-  if (ctx->session_cache_head == NULL) {
+  if (ctx->session_cache_head == nullptr) {
     ctx->session_cache_head = session;
     ctx->session_cache_tail = session;
     session->prev = (SSL_SESSION *)&(ctx->session_cache_head);
@@ -711,34 +715,35 @@ static void SSL_SESSION_list_add(SSL_CTX *ctx, SSL_SESSION *session) {
   }
 }
 
-static bool add_session_locked(SSL_CTX *ctx, UniquePtr<SSL_SESSION> session) {
+static bool add_session_locked(SSLContext *ctx,
+                               UniquePtr<SSL_SESSION> session) {
   SSL_SESSION *new_session = session.get();
   SSL_SESSION *old_session;
   if (!lh_SSL_SESSION_insert(ctx->sessions, &old_session, new_session)) {
     return false;
   }
-  // |ctx->sessions| took ownership of |new_session| and gave us back a
-  // reference to |old_session|. (|old_session| may be the same as
-  // |new_session|, in which case we traded identical references with
-  // |ctx->sessions|.)
+  // `ctx->sessions` took ownership of `new_session` and gave us back a
+  // reference to `old_session`. (`old_session` may be the same as
+  // `new_session`, in which case we traded identical references with
+  // `ctx->sessions`.)
   session.release();
   session.reset(old_session);
 
   if (old_session != nullptr) {
     if (old_session == new_session) {
-      // |session| was already in the cache. There are no linked list pointers
+      // `session` was already in the cache. There are no linked list pointers
       // to update.
       return false;
     }
 
-    // There was a session ID collision. |old_session| was replaced with
-    // |session| in the hash table, so |old_session| must be removed from the
+    // There was a session ID collision. `old_session` was replaced with
+    // `session` in the hash table, so `old_session` must be removed from the
     // linked list to match.
     SSL_SESSION_list_remove(ctx, old_session);
   }
 
-  // This does not increment the reference count. Although |session| is inserted
-  // into two structures (a doubly-linked list and the hash table), |ctx| only
+  // This does not increment the reference count. Although `session` is inserted
+  // into two structures (a doubly-linked list and the hash table), `ctx` only
   // takes one reference.
   SSL_SESSION_list_add(ctx, new_session);
 
@@ -757,7 +762,7 @@ static bool add_session_locked(SSL_CTX *ctx, UniquePtr<SSL_SESSION> session) {
 }
 
 void ssl_update_cache(SSL *ssl) {
-  SSL_CTX *ctx = ssl->session_ctx.get();
+  SSLContext *ctx = ssl->session_ctx.get();
   SSL_SESSION *session = ssl->s3->established_session.get();
   int mode = SSL_is_server(ssl) ? SSL_SESS_CACHE_SERVER : SSL_SESS_CACHE_CLIENT;
   if (!SSL_SESSION_is_resumable(session) ||
@@ -785,9 +790,9 @@ void ssl_update_cache(SSL *ssl) {
     }
 
     if (remove_expired_sessions) {
-      // |SSL_CTX_flush_sessions| takes the lock we just released. We could
+      // `SSL_CTX_flush_sessions` takes the lock we just released. We could
       // merge the critical sections, but we'd then call user code under a
-      // lock, or compute |now| earlier, even when not flushing.
+      // lock, or compute `now` earlier, even when not flushing.
       OPENSSL_timeval now = ssl_ctx_get_current_time(ssl->ctx.get());
       SSL_CTX_flush_sessions(ctx, now.tv_sec);
     }
@@ -796,12 +801,19 @@ void ssl_update_cache(SSL *ssl) {
   if (ctx->new_session_cb != nullptr) {
     UniquePtr<SSL_SESSION> ref = UpRef(session);
     if (ctx->new_session_cb(ssl, ref.get())) {
-      // |new_session_cb|'s return value signals whether it took ownership.
+      // `new_session_cb`'s return value signals whether it took ownership.
       ref.release();
     }
   }
 }
 
+bool ssl_session_has_peer_cred(const SSL_SESSION *session) {
+  return sk_CRYPTO_BUFFER_num(SSL_SESSION_get0_peer_certificates(session)) >
+             0 ||
+         SSL_SESSION_get0_peer_rpk(session) != nullptr ||
+         session->peer_sha256_valid;
+}
+
 BSSL_NAMESPACE_END
 
 using namespace bssl;
@@ -822,12 +834,12 @@ ssl_session_st::ssl_session_st(const SSL_X509_METHOD *method)
 }
 
 ssl_session_st::~ssl_session_st() {
-  CRYPTO_free_ex_data(&g_ex_data_class, this, &ex_data);
+  CRYPTO_free_ex_data(&g_ex_data_class, &ex_data);
   x509_method->session_clear(this);
 }
 
 SSL_SESSION *SSL_SESSION_new(const SSL_CTX *ctx) {
-  return ssl_session_new(ctx->x509_method).release();
+  return ssl_session_new(FromOpaque(ctx)->x509_method).release();
 }
 
 int SSL_SESSION_up_ref(SSL_SESSION *session) {
@@ -844,7 +856,7 @@ void SSL_SESSION_free(SSL_SESSION *session) {
 
 const uint8_t *SSL_SESSION_get_id(const SSL_SESSION *session,
                                   unsigned *out_len) {
-  if (out_len != NULL) {
+  if (out_len != nullptr) {
     *out_len = session->session_id.size();
   }
   return session->session_id.data();
@@ -865,7 +877,7 @@ uint32_t SSL_SESSION_get_timeout(const SSL_SESSION *session) {
 }
 
 uint64_t SSL_SESSION_get_time(const SSL_SESSION *session) {
-  if (session == NULL) {
+  if (session == nullptr) {
     // NULL should crash, but silently accept it here for compatibility.
     return 0;
   }
@@ -881,6 +893,10 @@ const STACK_OF(CRYPTO_BUFFER) *SSL_SESSION_get0_peer_certificates(
   return session->certs.get();
 }
 
+EVP_PKEY *SSL_SESSION_get0_peer_rpk(const SSL_SESSION *session) {
+  return session->peer_raw_public_key.get();
+}
+
 void SSL_SESSION_get0_signed_cert_timestamp_list(const SSL_SESSION *session,
                                                  const uint8_t **out,
                                                  size_t *out_len) {
@@ -917,7 +933,7 @@ size_t SSL_SESSION_get_master_key(const SSL_SESSION *session, uint8_t *out,
 }
 
 uint64_t SSL_SESSION_set_time(SSL_SESSION *session, uint64_t time) {
-  if (session == NULL) {
+  if (session == nullptr) {
     return 0;
   }
 
@@ -926,7 +942,7 @@ uint64_t SSL_SESSION_set_time(SSL_SESSION *session, uint64_t time) {
 }
 
 uint32_t SSL_SESSION_set_timeout(SSL_SESSION *session, uint32_t timeout) {
-  if (session == NULL) {
+  if (session == nullptr) {
     return 0;
   }
 
@@ -937,7 +953,7 @@ uint32_t SSL_SESSION_set_timeout(SSL_SESSION *session, uint32_t timeout) {
 
 const uint8_t *SSL_SESSION_get0_id_context(const SSL_SESSION *session,
                                            unsigned *out_len) {
-  if (out_len != NULL) {
+  if (out_len != nullptr) {
     *out_len = session->sid_ctx.size();
   }
   return session->sid_ctx.data();
@@ -1028,7 +1044,7 @@ SSL_SESSION *SSL_SESSION_copy_without_early_data(SSL_SESSION *session) {
   return copy.release();
 }
 
-SSL_SESSION *SSL_magic_pending_session_ptr(void) {
+SSL_SESSION *SSL_magic_pending_session_ptr() {
   return (SSL_SESSION *)&g_pending_session_magic;
 }
 
@@ -1037,8 +1053,8 @@ SSL_SESSION *SSL_get_session(const SSL *ssl) {
   // established session. In particular, if there is a pending renegotiation, we
   // do not return information about it until it completes.
   //
-  // Code in the handshake must either use |hs->new_session| (if updating a
-  // partial session) or |ssl_handshake_session| (if trying to query properties
+  // Code in the handshake must either use `hs->new_session` (if updating a
+  // partial session) or `ssl_handshake_session` (if trying to query properties
   // consistently across TLS 1.2 resumption and other handshakes).
   if (ssl->s3->established_session != nullptr) {
     return ssl->s3->established_session.get();
@@ -1062,7 +1078,7 @@ SSL_SESSION *SSL_get_session(const SSL *ssl) {
 
 SSL_SESSION *SSL_get1_session(SSL *ssl) {
   SSL_SESSION *ret = SSL_get_session(ssl);
-  if (ret != NULL) {
+  if (ret != nullptr) {
     SSL_SESSION_up_ref(ret);
   }
   return ret;
@@ -1084,19 +1100,20 @@ void *SSL_SESSION_get_ex_data(const SSL_SESSION *session, int idx) {
 }
 
 int SSL_CTX_add_session(SSL_CTX *ctx, SSL_SESSION *session) {
+  auto *ctx_impl = FromOpaque(ctx);
   UniquePtr<SSL_SESSION> owned_session = UpRef(session);
-  MutexWriteLock lock(&ctx->lock);
-  return add_session_locked(ctx, std::move(owned_session));
+  MutexWriteLock lock(&ctx_impl->lock);
+  return add_session_locked(ctx_impl, std::move(owned_session));
 }
 
 int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *session) {
-  return remove_session(ctx, session, /*lock=*/true);
+  return remove_session(FromOpaque(ctx), session, /*lock=*/true);
 }
 
 int SSL_set_session(SSL *ssl, SSL_SESSION *session) {
   // SSL_set_session may only be called before the handshake has started.
   if (ssl->s3->initial_handshake_complete ||  //
-      ssl->s3->hs == NULL ||                  //
+      ssl->s3->hs == nullptr ||               //
       ssl->s3->hs->state != 0) {
     abort();
   }
@@ -1106,34 +1123,32 @@ int SSL_set_session(SSL *ssl, SSL_SESSION *session) {
 }
 
 uint32_t SSL_CTX_set_timeout(SSL_CTX *ctx, uint32_t timeout) {
-  if (ctx == NULL) {
+  if (ctx == nullptr) {
     return 0;
   }
 
-  // Historically, zero was treated as |SSL_DEFAULT_SESSION_TIMEOUT|.
+  // Historically, zero was treated as `SSL_DEFAULT_SESSION_TIMEOUT`.
   if (timeout == 0) {
     timeout = SSL_DEFAULT_SESSION_TIMEOUT;
   }
 
-  uint32_t old_timeout = ctx->session_timeout;
-  ctx->session_timeout = timeout;
-  return old_timeout;
+  return std::exchange(FromOpaque(ctx)->session_timeout, timeout);
 }
 
 uint32_t SSL_CTX_get_timeout(const SSL_CTX *ctx) {
-  if (ctx == NULL) {
+  if (ctx == nullptr) {
     return 0;
   }
 
-  return ctx->session_timeout;
+  return FromOpaque(ctx)->session_timeout;
 }
 
 void SSL_CTX_set_session_psk_dhe_timeout(SSL_CTX *ctx, uint32_t timeout) {
-  ctx->session_psk_dhe_timeout = timeout;
+  FromOpaque(ctx)->session_psk_dhe_timeout = timeout;
 }
 
 typedef struct timeout_param_st {
-  SSL_CTX *ctx;
+  SSLContext *ctx;
   uint64_t time;
   LHASH_OF(SSL_SESSION) *cache;
 } TIMEOUT_PARAM;
@@ -1144,12 +1159,12 @@ static void timeout_doall_arg(SSL_SESSION *session, void *void_param) {
   if (param->time == 0 ||                                  //
       session->time + session->timeout < session->time ||  //
       param->time > (session->time + session->timeout)) {
-    // TODO(davidben): This can probably just call |remove_session|.
+    // TODO(davidben): This can probably just call `remove_session`.
     (void)lh_SSL_SESSION_delete(param->cache, session);
     SSL_SESSION_list_remove(param->ctx, session);
     // TODO(https://crbug.com/boringssl/251): Callbacks should not be called
     // under a lock.
-    if (param->ctx->remove_session_cb != NULL) {
+    if (param->ctx->remove_session_cb != nullptr) {
       param->ctx->remove_session_cb(param->ctx, session);
     }
     SSL_SESSION_free(session);
@@ -1157,53 +1172,53 @@ static void timeout_doall_arg(SSL_SESSION *session, void *void_param) {
 }
 
 void SSL_CTX_flush_sessions(SSL_CTX *ctx, uint64_t time) {
+  auto *ctx_impl = FromOpaque(ctx);
   TIMEOUT_PARAM tp;
-
-  tp.ctx = ctx;
-  tp.cache = ctx->sessions;
-  if (tp.cache == NULL) {
+  tp.ctx = ctx_impl;
+  tp.cache = ctx_impl->sessions;
+  if (tp.cache == nullptr) {
     return;
   }
   tp.time = time;
-  MutexWriteLock lock(&ctx->lock);
+  MutexWriteLock lock(&ctx_impl->lock);
   lh_SSL_SESSION_doall_arg(tp.cache, timeout_doall_arg, &tp);
 }
 
 void SSL_CTX_sess_set_new_cb(SSL_CTX *ctx,
                              int (*cb)(SSL *ssl, SSL_SESSION *session)) {
-  ctx->new_session_cb = cb;
+  FromOpaque(ctx)->new_session_cb = cb;
 }
 
 int (*SSL_CTX_sess_get_new_cb(SSL_CTX *ctx))(SSL *ssl, SSL_SESSION *session) {
-  return ctx->new_session_cb;
+  return FromOpaque(ctx)->new_session_cb;
 }
 
 void SSL_CTX_sess_set_remove_cb(SSL_CTX *ctx,
                                 void (*cb)(SSL_CTX *ctx,
                                            SSL_SESSION *session)) {
-  ctx->remove_session_cb = cb;
+  FromOpaque(ctx)->remove_session_cb = cb;
 }
 
 void (*SSL_CTX_sess_get_remove_cb(SSL_CTX *ctx))(SSL_CTX *ctx,
                                                  SSL_SESSION *session) {
-  return ctx->remove_session_cb;
+  return FromOpaque(ctx)->remove_session_cb;
 }
 
 void SSL_CTX_sess_set_get_cb(SSL_CTX *ctx,
                              SSL_SESSION *(*cb)(SSL *ssl, const uint8_t *id,
                                                 int id_len, int *out_copy)) {
-  ctx->get_session_cb = cb;
+  FromOpaque(ctx)->get_session_cb = cb;
 }
 
 SSL_SESSION *(*SSL_CTX_sess_get_get_cb(SSL_CTX *ctx))(SSL *ssl,
                                                       const uint8_t *id,
                                                       int id_len,
                                                       int *out_copy) {
-  return ctx->get_session_cb;
+  return FromOpaque(ctx)->get_session_cb;
 }
 
 void SSL_CTX_set_resumption_across_names_enabled(SSL_CTX *ctx, int enabled) {
-  ctx->resumption_across_names_enabled = !!enabled;
+  FromOpaque(ctx)->resumption_across_names_enabled = !!enabled;
 }
 
 void SSL_set_resumption_across_names_enabled(SSL *ssl, int enabled) {
@@ -1212,10 +1227,10 @@ void SSL_set_resumption_across_names_enabled(SSL *ssl, int enabled) {
 
 void SSL_CTX_set_info_callback(SSL_CTX *ctx, void (*cb)(const SSL *ssl,
                                                         int type, int value)) {
-  ctx->info_callback = cb;
+  FromOpaque(ctx)->info_callback = cb;
 }
 
 void (*SSL_CTX_get_info_callback(SSL_CTX *ctx))(const SSL *ssl, int type,
                                                 int value) {
-  return ctx->info_callback;
+  return FromOpaque(ctx)->info_callback;
 }

data/third_party/boringssl-with-bazel/ssl/ssl_transcript.cc

@@ -168,8 +168,8 @@ bool SSLTranscript::Update(Span<const uint8_t> in) {
   // transcript format as TLS 1.3 is used. This means we write the 1-byte
   // msg_type, 3-byte length, then skip 2+3+3 bytes for the DTLS-specific
   // fields that get omitted.
-  if (!AddToBufferOrHash(in.subspan(0, 4)) ||
-      !AddToBufferOrHash(in.subspan(12))) {
+  if (!AddToBufferOrHash(in.first<4>()) ||
+      !AddToBufferOrHash(in.subspan<12>())) {
     return false;
   }
   return true;
@@ -183,7 +183,7 @@ bool SSLTranscript::AddToBufferOrHash(Span<const uint8_t> in) {
     return false;
   }
 
-  if (EVP_MD_CTX_md(hash_.get()) != NULL) {
+  if (EVP_MD_CTX_md(hash_.get()) != nullptr) {
     EVP_DigestUpdate(hash_.get(), in.data(), in.size());
   }