grpc 1.84.0 → 1.85.0.pre1

data/third_party/boringssl-with-bazel/ssl/tls13_server.cc

@@ -29,6 +29,7 @@
 #include <openssl/rand.h>
 #include <openssl/stack.h>
 
+#include "../crypto/bytestring/internal.h"
 #include "../crypto/internal.h"
 #include "internal.h"
 
@@ -256,12 +257,15 @@ static bool add_new_session_tickets(SSL_HANDSHAKE *hs, bool *out_sent_tickets) {
   return true;
 }
 
-static bool check_signature_credential(SSL_HANDSHAKE *hs,
-                                       const SSL_CREDENTIAL *cred,
-                                       uint16_t *out_sigalg) {
+bool ssl_check_tls13_credential_ignoring_issuer(
+    SSL_HANDSHAKE *hs, Span<const uint8_t> allowed_cert_types,
+    const SSLCredential *cred, uint16_t *out_sigalg) {
+  assert(!allowed_cert_types.empty());
+  const auto is_cert_type_allowed = [&](uint8_t cert_type) {
+    return std::find(allowed_cert_types.begin(), allowed_cert_types.end(),
+                     cert_type) != allowed_cert_types.end();
+  };
   switch (cred->type) {
-    case SSLCredentialType::kX509:
-      break;
     case SSLCredentialType::kDelegated:
       // Check that the peer supports the signature over the delegated
       // credential.
@@ -270,27 +274,41 @@ static bool check_signature_credential(SSL_HANDSHAKE *hs,
         OPENSSL_PUT_ERROR(SSL, SSL_R_NO_COMMON_SIGNATURE_ALGORITHMS);
         return false;
       }
+      [[fallthrough]];
+    case SSLCredentialType::kX509:
+    case SSLCredentialType::kRawPublicKey:
+      if (!is_cert_type_allowed(
+              *ssl_credential_type_to_cert_type(cred->type))) {
+        OPENSSL_PUT_ERROR(SSL, SSL_R_UNKNOWN_CERTIFICATE_TYPE);
+        return false;
+      }
       break;
     default:
       OPENSSL_PUT_ERROR(SSL, SSL_R_UNKNOWN_CERTIFICATE_TYPE);
       return false;
   }
 
-  // If we reach here then the credential requires a signature. If |cred| is a
+  // If we reach here then the credential requires a signature. If `cred` is a
   // delegated credential, this also checks that the peer supports delegated
-  // credentials and matched |dc_cert_verify_algorithm|.
-  if (!tls1_choose_signature_algorithm(hs, cred, out_sigalg)) {
-    return false;
-  }
-  // Use this credential if it either matches a requested issuer,
-  // or does not require issuer matching.
-  return ssl_credential_matches_requested_issuers(hs, cred);
+  // credentials and matched `dc_cert_verify_algorithm`.
+  return tls1_choose_signature_algorithm(hs, cred, out_sigalg);
+}
+
+static bool check_signature_credential(SSL_HANDSHAKE *hs,
+                                       Span<const uint8_t> allowed_cert_types,
+                                       const SSLCredential *cred,
+                                       uint16_t *out_sigalg) {
+  return ssl_check_tls13_credential_ignoring_issuer(hs, allowed_cert_types,
+                                                    cred, out_sigalg) &&
+         // Use this credential if it either matches a requested issuer,
+         // or does not require issuer matching.
+         ssl_credential_matches_requested_issuers(hs, cred);
 }
 
 static bool check_pake_credential(SSL_HANDSHAKE *hs,
-                                  const SSL_CREDENTIAL *cred) {
+                                  const SSLCredential *cred) {
   assert(cred->type == SSLCredentialType::kSPAKE2PlusV1Server);
-  // Look for a client PAKE share that matches |cred|.
+  // Look for a client PAKE share that matches `cred`.
   if (hs->pake_share == nullptr ||
       hs->pake_share->named_pake != SSL_PAKE_SPAKE2PLUSV1 ||
       hs->pake_share->client_identity != Span(cred->client_identity) ||
@@ -302,15 +320,59 @@ static bool check_pake_credential(SSL_HANDSHAKE *hs,
   return true;
 }
 
+static bool check_psk_credential(SSL_HANDSHAKE *hs, const SSLCredential *cred,
+                                 const std::optional<SSLOfferedPSKs> &psks) {
+  assert(cred->type == SSLCredentialType::kPreSharedKey);
+  SSL *const ssl = hs->ssl;
+  if (!psks) {
+    OPENSSL_PUT_ERROR(SSL, SSL_R_MISSING_EXTENSION);
+    return false;
+  }
+  if (!hs->accept_psk_mode) {
+    OPENSSL_PUT_ERROR(SSL, SSL_R_NO_SUPPORTED_PSK_MODE);
+    return false;
+  }
+
+  // Look for a matching PSK.
+  const EVP_MD *md =
+      ssl_get_handshake_digest(ssl_protocol_version(ssl), hs->new_cipher);
+  SSLOfferedPSKs copy = *psks;
+  for (;;) {
+    std::optional<SSLOfferedPSK> psk = copy.Next();
+    if (!psk) {
+      OPENSSL_PUT_ERROR(SSL, SSL_R_PSK_IDENTITY_NOT_FOUND);
+      return false;
+    }
+    if (tls13_compare_imported_psk_identity(psk->identity, cred,
+                                            ssl->s3->version, md)) {
+      return true;
+    }
+  }
+}
+
 static enum ssl_hs_wait_t do_select_parameters(SSL_HANDSHAKE *hs) {
   // At this point, most ClientHello extensions have already been processed by
-  // the common handshake logic. Resolve the remaining non-PSK parameters.
+  // the common handshake logic. Resolve the remaining non-resumption
+  // parameters. First, parse out another copy of the ClientHello and important
+  // extensions.
   SSL *const ssl = hs->ssl;
   SSLMessage msg;
   SSL_CLIENT_HELLO client_hello;
   if (!hs->GetClientHello(&msg, &client_hello)) {
     return ssl_hs_error;
   }
+  std::optional<SSLOfferedPSKs> psks;
+  CBS psk_ext;
+  uint8_t alert = SSL_AD_DECODE_ERROR;
+  if (ssl_client_hello_get_extension(&client_hello, &psk_ext,
+                                     TLSEXT_TYPE_pre_shared_key)) {
+    psks = ssl_ext_pre_shared_key_parse_clienthello(hs, &alert, &client_hello,
+                                                    &psk_ext);
+    if (!psks) {
+      ssl_send_alert(ssl, SSL3_AL_FATAL, alert);
+      return ssl_hs_error;
+    }
+  }
 
   if (SSL_is_quic(ssl) && client_hello.session_id_len > 0) {
     OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_COMPATIBILITY_MODE);
@@ -326,7 +388,16 @@ static enum ssl_hs_wait_t do_select_parameters(SSL_HANDSHAKE *hs) {
         Span(client_hello.session_id, client_hello.session_id_len));
   }
 
-  Array<SSL_CREDENTIAL *> creds;
+  // Negotiate the cipher suite. This must happen before negotiating PSKs.
+  hs->new_cipher = choose_tls13_cipher(ssl, &client_hello);
+  if (hs->new_cipher == nullptr) {
+    OPENSSL_PUT_ERROR(SSL, SSL_R_NO_SHARED_CIPHER);
+    ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE);
+    return ssl_hs_error;
+  }
+
+  // Select the credential to use.
+  Array<SSLCredential *> creds;
   if (!ssl_get_full_credential_list(hs, &creds)) {
     return ssl_hs_error;
   }
@@ -335,9 +406,13 @@ static enum ssl_hs_wait_t do_select_parameters(SSL_HANDSHAKE *hs) {
     ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
     return ssl_hs_error;
   }
-
-  // Select the credential to use.
-  for (SSL_CREDENTIAL *cred : creds) {
+  std::optional<Span<const uint8_t>> allowed_cert_types =
+      ssl_get_allowed_server_cert_types(hs, &client_hello, &alert);
+  if (!allowed_cert_types.has_value()) {
+    ssl_send_alert(ssl, SSL3_AL_FATAL, alert);
+    return ssl_hs_error;
+  }
+  for (SSLCredential *cred : creds) {
     ERR_clear_error();
     if (cred->type == SSLCredentialType::kSPAKE2PlusV1Server) {
       if (check_pake_credential(hs, cred)) {
@@ -353,9 +428,25 @@ static enum ssl_hs_wait_t do_select_parameters(SSL_HANDSHAKE *hs) {
         }
         break;
       }
+    } else if (cred->type == SSLCredentialType::kPreSharedKey) {
+      if (check_psk_credential(hs, cred, psks)) {
+        const EVP_MD *md =
+            ssl_get_handshake_digest(ssl_protocol_version(ssl), hs->new_cipher);
+        std::optional<SSLImportedPSK> imported =
+            tls13_derive_imported_psk(hs, cred, ssl->s3->version, md);
+        if (!imported) {
+          return ssl_hs_error;
+        }
+        hs->credential = UpRef(cred);
+        hs->pre_shared_key = MakeUnique<SSLPreSharedKey>(*std::move(imported));
+        if (hs->pre_shared_key == nullptr) {
+          return ssl_hs_error;
+        }
+        break;
+      }
     } else {
       uint16_t sigalg;
-      if (check_signature_credential(hs, cred, &sigalg)) {
+      if (check_signature_credential(hs, *allowed_cert_types, cred, &sigalg)) {
         hs->credential = UpRef(cred);
         hs->signature_algorithm = sigalg;
         break;
@@ -369,17 +460,8 @@ static enum ssl_hs_wait_t do_select_parameters(SSL_HANDSHAKE *hs) {
     return ssl_hs_error;
   }
 
-  // Negotiate the cipher suite.
-  hs->new_cipher = choose_tls13_cipher(ssl, &client_hello);
-  if (hs->new_cipher == NULL) {
-    OPENSSL_PUT_ERROR(SSL, SSL_R_NO_SHARED_CIPHER);
-    ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE);
-    return ssl_hs_error;
-  }
-
   // HTTP/2 negotiation depends on the cipher suite, so ALPN negotiation was
   // deferred. Complete it now.
-  uint8_t alert = SSL_AD_DECODE_ERROR;
   if (!ssl_negotiate_alpn(hs, &alert, &client_hello)) {
     ssl_send_alert(ssl, SSL3_AL_FATAL, alert);
     return ssl_hs_error;
@@ -418,11 +500,9 @@ static enum ssl_ticket_aead_result_t select_session(
     return ssl_ticket_aead_error;
   }
 
-  CBS ticket, binders;
-  uint32_t client_ticket_age;
-  if (!ssl_ext_pre_shared_key_parse_clienthello(
-          hs, &ticket, &binders, &client_ticket_age, out_alert, client_hello,
-          &pre_shared_key)) {
+  std::optional<SSLOfferedPSKs> psks = ssl_ext_pre_shared_key_parse_clienthello(
+      hs, out_alert, client_hello, &pre_shared_key);
+  if (!psks) {
     return ssl_ticket_aead_error;
   }
 
@@ -437,12 +517,21 @@ static enum ssl_ticket_aead_result_t select_session(
     return ssl_ticket_aead_ignore_ticket;
   }
 
-  // TLS 1.3 session tickets are renewed separately as part of the
-  // NewSessionTicket.
+  // We only consider the first PSK for session resumption.
+  std::optional<SSLOfferedPSK> psk = psks->Next();
+  if (!psk) {
+    OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
+    return ssl_ticket_aead_error;
+  }
+
+  // Ignore whether the caller asked for TLS 1.2 ticket renewal. TLS 1.3 session
+  // tickets are renewed separately as part of the NewSessionTicket. Also save
+  // the ticket so we can find the PSK again on the second ClientHello.
   bool unused_renew;
   UniquePtr<SSL_SESSION> session;
   enum ssl_ticket_aead_result_t ret =
-      ssl_process_ticket(hs, &session, &unused_renew, ticket, {});
+      ssl_process_ticket(hs, &session, &unused_renew, psk->identity,
+                         /*session_id=*/{}, /*save_ticket=*/true);
   switch (ret) {
     case ssl_ticket_aead_success:
       break;
@@ -460,7 +549,8 @@ static enum ssl_ticket_aead_result_t select_session(
   }
 
   // Recover the client ticket age and convert to seconds.
-  client_ticket_age -= session->ticket_age_add;
+  uint32_t client_ticket_age =
+      psk->obfuscated_ticket_age - session->ticket_age_add;
   client_ticket_age /= 1000;
 
   OPENSSL_timeval now = ssl_ctx_get_current_time(ssl->ctx.get());
@@ -469,7 +559,7 @@ static enum ssl_ticket_aead_result_t select_session(
   assert(now.tv_sec >= session->time);
   uint64_t server_ticket_age = now.tv_sec - session->time;
 
-  // To avoid overflowing |hs->ticket_age_skew|, we will not resume
+  // To avoid overflowing `hs->ticket_age_skew`, we will not resume
   // 68-year-old sessions.
   if (server_ticket_age > INT32_MAX) {
     return ssl_ticket_aead_ignore_ticket;
@@ -477,13 +567,6 @@ static enum ssl_ticket_aead_result_t select_session(
 
   *out_ticket_age_skew = static_cast<int32_t>(client_ticket_age) -
                          static_cast<int32_t>(server_ticket_age);
-
-  // Check the PSK binder.
-  if (!tls13_verify_psk_binder(hs, session.get(), msg, &binders)) {
-    *out_alert = SSL_AD_DECRYPT_ERROR;
-    return ssl_ticket_aead_error;
-  }
-
   *out_session = std::move(session);
   return ssl_ticket_aead_success;
 }
@@ -505,6 +588,10 @@ static bool quic_ticket_compatible(const SSL_SESSION *session,
   return true;
 }
 
+static bool using_certificate(const SSL_HANDSHAKE *hs) {
+  return !hs->pre_shared_key && !hs->pake_verifier;
+}
+
 static enum ssl_hs_wait_t do_select_session(SSL_HANDSHAKE *hs) {
   SSL *const ssl = hs->ssl;
   SSLMessage msg;
@@ -536,12 +623,15 @@ static enum ssl_hs_wait_t do_select_session(SSL_HANDSHAKE *hs) {
         return ssl_hs_error;
       }
 
-      ssl->s3->session_reused = true;
-      hs->can_release_private_key = true;
-
       // Resumption incorporates fresh key material, so refresh the timeout.
       ssl_session_renew_timeout(ssl, hs->new_session.get(),
                                 ssl->session_ctx->session_psk_dhe_timeout);
+
+      ssl->s3->session_reused = true;
+      hs->pre_shared_key = MakeUnique<SSLPreSharedKey>(UpRef(session));
+      if (hs->pre_shared_key == nullptr) {
+        return ssl_hs_error;
+      }
       break;
 
     case ssl_ticket_aead_error:
@@ -553,13 +643,24 @@ static enum ssl_hs_wait_t do_select_session(SSL_HANDSHAKE *hs) {
       return ssl_hs_pending_ticket;
   }
 
-  // Negotiate ALPS now, after ALPN is negotiated and |hs->new_session| is
+  hs->can_release_private_key = !using_certificate(hs);
+
+  // Negotiate ALPS now, after ALPN is negotiated and `hs->new_session` is
   // initialized.
   if (!ssl_negotiate_alps(hs, &alert, &client_hello)) {
     ssl_send_alert(ssl, SSL3_AL_FATAL, alert);
     return ssl_hs_error;
   }
 
+  if (using_certificate(hs)) {
+    // Determine whether to request a client certificate.
+    hs->cert_request = !!(hs->config->verify_mode & SSL_VERIFY_PEER);
+    if (!ssl_negotiate_client_certificate_type(hs, &alert, &client_hello)) {
+      ssl_send_alert(ssl, SSL3_AL_FATAL, alert);
+      return ssl_hs_error;
+    }
+  }
+
   // Record connection properties in the new session.
   hs->new_session->cipher = hs->new_cipher;
 
@@ -569,7 +670,13 @@ static enum ssl_hs_wait_t do_select_session(SSL_HANDSHAKE *hs) {
   if (hs->pake_verifier == nullptr) {
     if (!tls1_get_shared_group(hs, &hs->new_session->group_id)) {
       OPENSSL_PUT_ERROR(SSL, SSL_R_NO_SHARED_GROUP);
-      ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE);
+      // RFC 8446, section 9.2 specifies that the "missing extension" alert
+      // should be sent if the ClientHello does not have both or neither of
+      // "key_share" and "supported_groups".
+      ssl_send_alert(ssl, SSL3_AL_FATAL,
+                     hs->peer_supported_group_list.empty()
+                         ? SSL_AD_MISSING_EXTENSION
+                         : SSL_AD_HANDSHAKE_FAILURE);
       return ssl_hs_error;
     }
     bool found_key_share;
@@ -612,7 +719,7 @@ static enum ssl_hs_wait_t do_select_session(SSL_HANDSHAKE *hs) {
   } else if (need_hrr) {
     ssl->s3->early_data_reason = ssl_early_data_hello_retry_request;
   } else {
-    // |ssl_session_is_resumable| forbids cross-cipher resumptions even if the
+    // `ssl_session_is_resumable` forbids cross-cipher resumptions even if the
     // PRF hashes match.
     assert(hs->new_cipher == session->cipher);
 
@@ -630,7 +737,7 @@ static enum ssl_hs_wait_t do_select_session(SSL_HANDSHAKE *hs) {
 
   // The peer applications settings are usually received later, in
   // EncryptedExtensions. But, in 0-RTT handshakes, we carry over the
-  // values from |session|. Do this now, before |session| is discarded.
+  // values from `session`. Do this now, before `session` is discarded.
   if (ssl->s3->early_data_accepted &&
       hs->new_session->has_application_settings &&
       !hs->new_session->peer_application_settings.CopyFrom(
@@ -648,7 +755,7 @@ static enum ssl_hs_wait_t do_select_session(SSL_HANDSHAKE *hs) {
     }
   }
 
-  if (ssl->ctx->dos_protection_cb != NULL &&
+  if (ssl->ctx->dos_protection_cb != nullptr &&
       ssl->ctx->dos_protection_cb(&client_hello) == 0) {
     // Connection rejected for DOS reasons.
     OPENSSL_PUT_ERROR(SSL, SSL_R_CONNECTION_REJECTED);
@@ -656,13 +763,20 @@ static enum ssl_hs_wait_t do_select_session(SSL_HANDSHAKE *hs) {
     return ssl_hs_error;
   }
 
+  if (hs->pre_shared_key &&
+      !ssl_verify_psk_binder(hs, &alert, *hs->pre_shared_key, client_hello)) {
+    ssl_send_alert(ssl, SSL3_AL_FATAL, alert);
+    return ssl_hs_error;
+  }
+
   size_t hash_len = EVP_MD_size(
       ssl_get_handshake_digest(ssl_protocol_version(ssl), hs->new_cipher));
 
   // Set up the key schedule and incorporate the PSK into the running secret.
-  if (!tls13_init_key_schedule(hs, ssl->s3->session_reused
-                                       ? Span(hs->new_session->secret)
-                                       : Span(kZeroes, hash_len)) ||
+  Span<const uint8_t> psk = hs->pre_shared_key
+                                ? ssl_pre_shared_key_secret(*hs->pre_shared_key)
+                                : Span(kZeroes, hash_len);
+  if (!tls13_init_key_schedule(hs, psk) ||  //
       !ssl_hash_message(hs, msg)) {
     return ssl_hs_error;
   }
@@ -753,7 +867,7 @@ static enum ssl_hs_wait_t do_send_hello_retry_request(SSL_HANDSHAKE *hs) {
     // Now that the message is encoded, fill in the whole value.
     size_t offset = hrr.size() - ECH_CONFIRMATION_SIGNAL_LEN;
     if (!ssl_ech_accept_confirmation(
-            hs, Span(hrr).last(ECH_CONFIRMATION_SIGNAL_LEN),
+            hs, Span(hrr).last<ECH_CONFIRMATION_SIGNAL_LEN>(),
             ssl->s3->client_random, hs->transcript, /*is_hrr=*/true, hrr,
             offset)) {
       return ssl_hs_error;
@@ -833,7 +947,7 @@ static enum ssl_hs_wait_t do_read_second_client_hello(SSL_HANDSHAKE *hs) {
       return ssl_hs_error;
     }
 
-    // Reparse |client_hello| from the buffer owned by |hs|.
+    // Reparse `client_hello` from the buffer owned by `hs`.
     if (!hs->GetClientHello(&msg, &client_hello)) {
       OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
       return ssl_hs_error;
@@ -841,38 +955,20 @@ static enum ssl_hs_wait_t do_read_second_client_hello(SSL_HANDSHAKE *hs) {
   }
 
   // We perform all our negotiation based on the first ClientHello (for
-  // consistency with what |select_certificate_cb| observed), which is in the
+  // consistency with what `select_certificate_cb` observed), which is in the
   // transcript, so we can ignore most of this second one.
   //
   // We do, however, check the second PSK binder. This covers the client key
   // share, in case we ever send half-RTT data (we currently do not). It is also
-  // a tricky computation, so we enforce the peer handled it correctly.
-  if (ssl->s3->session_reused) {
-    CBS pre_shared_key;
-    if (!ssl_client_hello_get_extension(&client_hello, &pre_shared_key,
-                                        TLSEXT_TYPE_pre_shared_key)) {
-      OPENSSL_PUT_ERROR(SSL, SSL_R_INCONSISTENT_CLIENT_HELLO);
-      ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER);
-      return ssl_hs_error;
-    }
-
-    CBS ticket, binders;
-    uint32_t client_ticket_age;
+  // a tricky computation, so we enforce the peer handled it correctly. It is
+  // also necessary to search the PSK list from the second ClientHello because
+  // PSK indices may have changed (RFC 8446 section 4.1.4).
+  if (hs->pre_shared_key) {
     uint8_t alert = SSL_AD_DECODE_ERROR;
-    if (!ssl_ext_pre_shared_key_parse_clienthello(
-            hs, &ticket, &binders, &client_ticket_age, &alert, &client_hello,
-            &pre_shared_key)) {
+    if (!ssl_verify_psk_binder(hs, &alert, *hs->pre_shared_key, client_hello)) {
       ssl_send_alert(ssl, SSL3_AL_FATAL, alert);
       return ssl_hs_error;
     }
-
-    // Note it is important that we do not obtain a new |SSL_SESSION| from
-    // |ticket|. We have already selected parameters based on the first
-    // ClientHello (in the transcript) and must not switch partway through.
-    if (!tls13_verify_psk_binder(hs, hs->new_session.get(), msg, &binders)) {
-      ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECRYPT_ERROR);
-      return ssl_hs_error;
-    }
   }
 
   // Although a server could HelloRetryRequest with PAKEs to request a cookie,
@@ -943,16 +1039,16 @@ static enum ssl_hs_wait_t do_send_server_hello(SSL_HANDSHAKE *hs) {
   if (hs->ech_is_inner) {
     // Fill in the ECH confirmation signal.
     const size_t offset = ssl_ech_confirmation_signal_hello_offset(ssl);
-    Span<uint8_t> random_suffix = random.last(ECH_CONFIRMATION_SIGNAL_LEN);
+    auto random_suffix = random.last<ECH_CONFIRMATION_SIGNAL_LEN>();
     if (!ssl_ech_accept_confirmation(hs, random_suffix, ssl->s3->client_random,
                                      hs->transcript,
                                      /*is_hrr=*/false, server_hello, offset)) {
       return ssl_hs_error;
     }
 
-    // Update |server_hello|.
-    Span<uint8_t> server_hello_out =
-        Span(server_hello).subspan(offset, ECH_CONFIRMATION_SIGNAL_LEN);
+    // Update `server_hello`.
+    auto server_hello_out =
+        Span(server_hello).subspan(offset).first<ECH_CONFIRMATION_SIGNAL_LEN>();
     OPENSSL_memcpy(server_hello_out.data(), random_suffix.data(),
                    ECH_CONFIRMATION_SIGNAL_LEN);
   }
@@ -983,11 +1079,6 @@ static enum ssl_hs_wait_t do_send_server_hello(SSL_HANDSHAKE *hs) {
     return ssl_hs_error;
   }
 
-  if (!ssl->s3->session_reused && !hs->pake_verifier) {
-    // Determine whether to request a client certificate.
-    hs->cert_request = !!(hs->config->verify_mode & SSL_VERIFY_PEER);
-  }
-
   // Send a CertificateRequest, if necessary.
   if (hs->cert_request) {
     CBB cert_request_extensions, sigalg_contents, sigalgs_cbb;
@@ -1022,7 +1113,7 @@ static enum ssl_hs_wait_t do_send_server_hello(SSL_HANDSHAKE *hs) {
   }
 
   // Send the server Certificate message, if necessary.
-  if (!ssl->s3->session_reused && !hs->pake_verifier) {
+  if (using_certificate(hs)) {
     if (!tls13_add_certificate(hs)) {
       return ssl_hs_error;
     }
@@ -1080,7 +1171,7 @@ static enum ssl_hs_wait_t do_send_half_rtt_ticket(SSL_HANDSHAKE *hs) {
 
   if (ssl->s3->early_data_accepted) {
     // If accepting 0-RTT, we send tickets half-RTT. This gets the tickets on
-    // the wire sooner and also avoids triggering a write on |SSL_read| when
+    // the wire sooner and also avoids triggering a write on `SSL_read` when
     // processing the client Finished. This requires computing the client
     // Finished early. See RFC 8446, section 4.6.1.
     static const uint8_t kEndOfEarlyData[4] = {SSL3_MT_END_OF_EARLY_DATA, 0, 0,
@@ -1257,7 +1348,7 @@ static enum ssl_hs_wait_t do_read_client_certificate(SSL_HANDSHAKE *hs) {
       // OpenSSL returns X509_V_OK when no certificates are requested. This is
       // classed by them as a bug, but it's assumed by at least NGINX. (Only do
       // this in full handshakes as resumptions should carry over the previous
-      // |verify_result|, though this is a no-op because servers do not
+      // `verify_result`, though this is a no-op because servers do not
       // implement the client's odd soft-fail mode.)
       hs->new_session->verify_result = X509_V_OK;
     }
@@ -1286,7 +1377,7 @@ static enum ssl_hs_wait_t do_read_client_certificate(SSL_HANDSHAKE *hs) {
 
 static enum ssl_hs_wait_t do_read_client_certificate_verify(SSL_HANDSHAKE *hs) {
   SSL *const ssl = hs->ssl;
-  if (sk_CRYPTO_BUFFER_num(hs->new_session->certs.get()) == 0) {
+  if (!ssl_session_has_peer_cred(hs->new_session.get())) {
     // Skip this state.
     hs->tls13_state = state13_read_channel_id;
     return ssl_hs_ok;

data/third_party/boringssl-with-bazel/ssl/tls_method.cc

@@ -29,7 +29,7 @@ static void tls_on_handshake_complete(SSL *ssl) {
   // The handshake should have released its final message.
   assert(!ssl->s3->has_message);
 
-  // During the handshake, |hs_buf| is retained. Release if it there is no
+  // During the handshake, `hs_buf` is retained. Release if it there is no
   // excess in it. There should not be any excess because the handshake logic
   // rejects unprocessed data after each Finished message. Note this means we do
   // not allow a TLS 1.2 HelloRequest to be packed into the same record as
@@ -58,7 +58,7 @@ static bool tls_set_read_state(SSL *ssl, ssl_encryption_level_t level,
       return false;
     }
 
-    // QUIC only uses |ssl| for handshake messages, which never use early data
+    // QUIC only uses `ssl` for handshake messages, which never use early data
     // keys, so we return without installing anything. This avoids needing to
     // have two secrets active at once in 0-RTT.
     if (level == ssl_encryption_early_data) {
@@ -87,7 +87,7 @@ static bool tls_set_write_state(SSL *ssl, ssl_encryption_level_t level,
       return false;
     }
 
-    // QUIC only uses |ssl| for handshake messages, which never use early data
+    // QUIC only uses `ssl` for handshake messages, which never use early data
     // keys, so we return without installing anything. This avoids needing to
     // have two secrets active at once in 0-RTT.
     if (level == ssl_encryption_early_data) {
@@ -103,7 +103,7 @@ static bool tls_set_write_state(SSL *ssl, ssl_encryption_level_t level,
 
 static void tls_finish_flight(SSL *ssl) {
   // We don't track whether a flight is complete in TLS and instead always flush
-  // every queued message in |tls_flush|, whether the flight is complete or not.
+  // every queued message in `tls_flush`, whether the flight is complete or not.
 }
 
 static void tls_schedule_ack(SSL *ssl) {
@@ -165,9 +165,9 @@ static void ssl_noop_x509_ssl_flush_cached_client_CA(SSL_CONFIG *cfg) {}
 static bool ssl_noop_x509_ssl_auto_chain_if_needed(SSL_HANDSHAKE *hs) {
   return true;
 }
-static bool ssl_noop_x509_ssl_ctx_new(SSL_CTX *ctx) { return true; }
-static void ssl_noop_x509_ssl_ctx_free(SSL_CTX *ctx) {}
-static void ssl_noop_x509_ssl_ctx_flush_cached_client_CA(SSL_CTX *ctx) {}
+static bool ssl_noop_x509_ssl_ctx_new(SSLContext *ctx) { return true; }
+static void ssl_noop_x509_ssl_ctx_free(SSLContext *ctx) {}
+static void ssl_noop_x509_ssl_ctx_flush_cached_client_CA(SSLContext *ctx) {}
 
 const SSL_X509_METHOD ssl_noop_x509_method = {
     ssl_noop_x509_check_client_CA_names,
@@ -194,7 +194,7 @@ BSSL_NAMESPACE_END
 
 using namespace bssl;
 
-const SSL_METHOD *TLS_method(void) {
+const SSL_METHOD *TLS_method() {
   static const SSL_METHOD kMethod = {
       0,
       &kTLSProtocolMethod,
@@ -203,9 +203,9 @@ const SSL_METHOD *TLS_method(void) {
   return &kMethod;
 }
 
-const SSL_METHOD *SSLv23_method(void) { return TLS_method(); }
+const SSL_METHOD *SSLv23_method() { return TLS_method(); }
 
-const SSL_METHOD *TLS_with_buffers_method(void) {
+const SSL_METHOD *TLS_with_buffers_method() {
   static const SSL_METHOD kMethod = {
       0,
       &kTLSProtocolMethod,
@@ -216,7 +216,7 @@ const SSL_METHOD *TLS_with_buffers_method(void) {
 
 // Legacy version-locked methods.
 
-const SSL_METHOD *TLSv1_2_method(void) {
+const SSL_METHOD *TLSv1_2_method() {
   static const SSL_METHOD kMethod = {
       TLS1_2_VERSION,
       &kTLSProtocolMethod,
@@ -225,7 +225,7 @@ const SSL_METHOD *TLSv1_2_method(void) {
   return &kMethod;
 }
 
-const SSL_METHOD *TLSv1_1_method(void) {
+const SSL_METHOD *TLSv1_1_method() {
   static const SSL_METHOD kMethod = {
       TLS1_1_VERSION,
       &kTLSProtocolMethod,
@@ -234,7 +234,7 @@ const SSL_METHOD *TLSv1_1_method(void) {
   return &kMethod;
 }
 
-const SSL_METHOD *TLSv1_method(void) {
+const SSL_METHOD *TLSv1_method() {
   static const SSL_METHOD kMethod = {
       TLS1_VERSION,
       &kTLSProtocolMethod,
@@ -245,22 +245,22 @@ const SSL_METHOD *TLSv1_method(void) {
 
 // Legacy side-specific methods.
 
-const SSL_METHOD *TLSv1_2_server_method(void) { return TLSv1_2_method(); }
+const SSL_METHOD *TLSv1_2_server_method() { return TLSv1_2_method(); }
 
-const SSL_METHOD *TLSv1_1_server_method(void) { return TLSv1_1_method(); }
+const SSL_METHOD *TLSv1_1_server_method() { return TLSv1_1_method(); }
 
-const SSL_METHOD *TLSv1_server_method(void) { return TLSv1_method(); }
+const SSL_METHOD *TLSv1_server_method() { return TLSv1_method(); }
 
-const SSL_METHOD *TLSv1_2_client_method(void) { return TLSv1_2_method(); }
+const SSL_METHOD *TLSv1_2_client_method() { return TLSv1_2_method(); }
 
-const SSL_METHOD *TLSv1_1_client_method(void) { return TLSv1_1_method(); }
+const SSL_METHOD *TLSv1_1_client_method() { return TLSv1_1_method(); }
 
-const SSL_METHOD *TLSv1_client_method(void) { return TLSv1_method(); }
+const SSL_METHOD *TLSv1_client_method() { return TLSv1_method(); }
 
-const SSL_METHOD *SSLv23_server_method(void) { return SSLv23_method(); }
+const SSL_METHOD *SSLv23_server_method() { return SSLv23_method(); }
 
-const SSL_METHOD *SSLv23_client_method(void) { return SSLv23_method(); }
+const SSL_METHOD *SSLv23_client_method() { return SSLv23_method(); }
 
-const SSL_METHOD *TLS_server_method(void) { return TLS_method(); }
+const SSL_METHOD *TLS_server_method() { return TLS_method(); }
 
-const SSL_METHOD *TLS_client_method(void) { return TLS_method(); }
+const SSL_METHOD *TLS_client_method() { return TLS_method(); }