grpc 1.84.1 → 1.85.0.pre1

data/third_party/boringssl-with-bazel/include/openssl/x509v3.h

@@ -46,7 +46,7 @@
 
 // Deprecated constants.
 
-// The following constants are legacy aliases for |X509v3_KU_*|. They are
+// The following constants are legacy aliases for `X509v3_KU_*`. They are
 // defined here instead of in <openssl/x509.h> because NSS's public headers use
 // the same symbols. Some callers have inadvertently relied on the conflicts
 // only being defined in this header.

data/third_party/boringssl-with-bazel/include/openssl/xwing.h

@@ -0,0 +1,115 @@
+// Copyright 2025 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef OPENSSL_HEADER_XWING_H
+#define OPENSSL_HEADER_XWING_H
+
+#include <openssl/base.h>  // IWYU pragma: export
+
+#if defined(__cplusplus)
+extern "C" {
+#endif
+
+
+// MLKEM768-X25519 (X-Wing).
+//
+// This implements the hybrid key encapsulation mechanism "MLKEM768-X25519" from
+// https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-concrete-hybrid-kems-02
+// which is also known as "X-Wing".
+
+
+// XWING_private_key contains an X-Wing private key. The contents of this object
+// should never leave the address space since the format is unstable.
+struct XWING_private_key {
+  union {
+    uint8_t bytes[512 * (3 + 3 + 9) + 32 + 32 + 32 + 32 + 32];
+    uint16_t alignment;
+  } opaque;
+};
+
+// XWING_PUBLIC_KEY_BYTES is the number of bytes in an encoded X-Wing public
+// key.
+#define XWING_PUBLIC_KEY_BYTES 1216
+
+// XWING_PRIVATE_KEY_BYTES is the number of bytes in an encoded X-Wing private
+// key.
+#define XWING_PRIVATE_KEY_BYTES 32
+
+// XWING_CIPHERTEXT_BYTES is the number of bytes in the X-Wing ciphertext.
+#define XWING_CIPHERTEXT_BYTES 1120
+
+// XWING_SHARED_SECRET_BYTES is the number of bytes in an X-Wing shared secret.
+#define XWING_SHARED_SECRET_BYTES 32
+
+
+// XWING_generate_key generates a random public/private key pair, writes the
+// encoded public key to `out_encoded_public_key` and the private key to
+// `out_private_key`. Returns one on success and zero on error.
+OPENSSL_EXPORT int XWING_generate_key(
+    uint8_t out_encoded_public_key[XWING_PUBLIC_KEY_BYTES],
+    struct XWING_private_key *out_private_key);
+
+// XWING_public_from_private sets `out_encoded_public_key` to the public key
+// that corresponds to `private_key`. Returns one on success and zero on error.
+OPENSSL_EXPORT int XWING_public_from_private(
+    uint8_t out_encoded_public_key[XWING_PUBLIC_KEY_BYTES],
+    const struct XWING_private_key *private_key);
+
+// XWING_encap encapsulates a random shared secret for `encoded_public_key`,
+// writes the ciphertext to `out_ciphertext`, and writes the random shared
+// secret to `out_shared_secret`. Returns one on success and zero on error.
+OPENSSL_EXPORT int XWING_encap(
+    uint8_t out_ciphertext[XWING_CIPHERTEXT_BYTES],
+    uint8_t out_shared_secret[XWING_SHARED_SECRET_BYTES],
+    const uint8_t encoded_public_key[XWING_PUBLIC_KEY_BYTES]);
+
+// XWING_encap_external_entropy encapsulates the shared secret for the given
+// `eseed` entropy using `encoded_public_key`, writes the ciphertext to
+// `out_ciphertext`, and writes the random shared secret to `out_shared_secret`.
+// Returns one on success and zero on error.
+OPENSSL_EXPORT int XWING_encap_external_entropy(
+    uint8_t out_ciphertext[XWING_CIPHERTEXT_BYTES],
+    uint8_t out_shared_secret[XWING_SHARED_SECRET_BYTES],
+    const uint8_t encoded_public_key[XWING_PUBLIC_KEY_BYTES],
+    const uint8_t eseed[64]);
+
+// XWING_decap decapsulates a shared secret from `ciphertext` using
+// `private_key` and writes it to `out_shared_secret`. Returns one on success
+// and zero on error.
+OPENSSL_EXPORT int XWING_decap(
+    uint8_t out_shared_secret[XWING_SHARED_SECRET_BYTES],
+    const uint8_t ciphertext[XWING_CIPHERTEXT_BYTES],
+    const struct XWING_private_key *private_key);
+
+// Serialisation of keys.
+
+// XWING_marshal_private_key serializes `private_key` to `out` in the standard
+// format for X-Wing private keys. It returns one on success or zero on
+// allocation error.
+OPENSSL_EXPORT int XWING_marshal_private_key(
+    CBB *out, const struct XWING_private_key *private_key);
+
+// XWING_parse_private_key parses a private key in the standard format for
+// X-Wing private keys from `in` and writes the result to `out_public_key`. It
+// returns one on success or zero on parse error or if there are trailing bytes
+// in `in`.
+OPENSSL_EXPORT int XWING_parse_private_key(
+    struct XWING_private_key *out_private_key, CBS *in);
+
+
+#if defined(__cplusplus)
+}  // extern C
+#endif
+
+#endif  // OPENSSL_HEADER_XWING_H

data/third_party/boringssl-with-bazel/ssl/bio_ssl.cc

@@ -16,12 +16,14 @@
 
 #include <openssl/bio.h>
 
+#include "../crypto/bio/internal.h"
 
-static SSL *get_ssl(BIO *bio) { return reinterpret_cast<SSL *>(bio->ptr); }
+
+static SSL *get_ssl(BIO *bio) { return reinterpret_cast<SSL *>(BIO_get_data(bio)); }
 
 static int ssl_read(BIO *bio, char *out, int outl) {
   SSL *ssl = get_ssl(bio);
-  if (ssl == NULL) {
+  if (ssl == nullptr) {
     return 0;
   }
 
@@ -61,7 +63,7 @@ static int ssl_read(BIO *bio, char *out, int outl) {
 
 static int ssl_write(BIO *bio, const char *out, int outl) {
   SSL *ssl = get_ssl(bio);
-  if (ssl == NULL) {
+  if (ssl == nullptr) {
     return 0;
   }
 
@@ -95,13 +97,13 @@ static int ssl_write(BIO *bio, const char *out, int outl) {
 
 static long ssl_ctrl(BIO *bio, int cmd, long num, void *ptr) {
   SSL *ssl = get_ssl(bio);
-  if (ssl == NULL && cmd != BIO_C_SET_SSL) {
+  if (ssl == nullptr && cmd != BIO_C_SET_SSL) {
     return 0;
   }
 
   switch (cmd) {
     case BIO_C_SET_SSL:
-      if (ssl != NULL) {
+      if (ssl != nullptr) {
         // OpenSSL allows reusing an SSL BIO with a different SSL object. We do
         // not support this.
         OPENSSL_PUT_ERROR(SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
@@ -109,19 +111,19 @@ static long ssl_ctrl(BIO *bio, int cmd, long num, void *ptr) {
       }
 
       // Note this differs from upstream OpenSSL, which synchronizes
-      // |bio->next_bio| with |ssl|'s rbio here, and on |BIO_CTRL_PUSH|. We call
-      // into the corresponding |BIO| directly. (We can implement the upstream
+      // `BIO_next(bio)` with `ssl`'s rbio here, and on `BIO_CTRL_PUSH`. We call
+      // into the corresponding `BIO` directly. (We can implement the upstream
       // behavior if it ends up necessary.)
-      bio->shutdown = static_cast<int>(num);
-      bio->ptr = ptr;
-      bio->init = 1;
+      BIO_set_shutdown(bio, static_cast<int>(num));
+      BIO_set_data(bio, ptr);
+      BIO_set_init(bio, 1);
       return 1;
 
     case BIO_CTRL_GET_CLOSE:
-      return bio->shutdown;
+      return BIO_get_shutdown(bio);
 
     case BIO_CTRL_SET_CLOSE:
-      bio->shutdown = static_cast<int>(num);
+      BIO_set_shutdown(bio, static_cast<int>(num));
       return 1;
 
     case BIO_CTRL_WPENDING:
@@ -154,21 +156,21 @@ static int ssl_new(BIO *bio) { return 1; }
 static int ssl_free(BIO *bio) {
   SSL *ssl = get_ssl(bio);
 
-  if (ssl == NULL) {
+  if (ssl == nullptr) {
     return 1;
   }
 
   SSL_shutdown(ssl);
-  if (bio->shutdown) {
+  if (BIO_get_shutdown(bio)) {
     SSL_free(ssl);
   }
 
   return 1;
 }
 
-static long ssl_callback_ctrl(BIO *bio, int cmd, bio_info_cb fp) {
+static long ssl_callback_ctrl(BIO *bio, int cmd, BIO_info_cb *fp) {
   SSL *ssl = get_ssl(bio);
-  if (ssl == NULL) {
+  if (ssl == nullptr) {
     return 0;
   }
 
@@ -182,11 +184,14 @@ static long ssl_callback_ctrl(BIO *bio, int cmd, bio_info_cb fp) {
 }
 
 static const BIO_METHOD ssl_method = {
-    BIO_TYPE_SSL, "SSL",    ssl_write, ssl_read, NULL,
-    NULL,         ssl_ctrl, ssl_new,   ssl_free, ssl_callback_ctrl,
+    BIO_TYPE_SSL, "SSL",
+    ssl_write,    /*bwrite_ex=*/nullptr,
+    ssl_read,     /*bgets=*/nullptr,
+    ssl_ctrl,     ssl_new,
+    ssl_free,     ssl_callback_ctrl,
 };
 
-const BIO_METHOD *BIO_f_ssl(void) { return &ssl_method; }
+const BIO_METHOD *BIO_f_ssl() { return &ssl_method; }
 
 long BIO_set_ssl(BIO *bio, SSL *ssl, int take_owership) {
   return BIO_ctrl(bio, BIO_C_SET_SSL, take_owership, ssl);

data/third_party/boringssl-with-bazel/ssl/d1_both.cc

@@ -25,7 +25,9 @@
 #include <openssl/mem.h>
 #include <openssl/rand.h>
 
+#include "../crypto/bytestring/internal.h"
 #include "../crypto/internal.h"
+#include "../crypto/bytestring/internal.h"
 #include "internal.h"
 
 
@@ -43,14 +45,14 @@ static const unsigned int kMinMTU = 256 - 28;
 // the underlying BIO supplies one.
 static const unsigned int kDefaultMTU = 1500 - 28;
 
-// BitRange returns a |uint8_t| with bits |start|, inclusive, to |end|,
+// BitRange returns a `uint8_t` with bits `start`, inclusive, to `end`,
 // exclusive, set.
 static uint8_t BitRange(size_t start, size_t end) {
   assert(start <= end && end <= 8);
   return static_cast<uint8_t>(~((1u << start) - 1) & ((1u << end) - 1));
 }
 
-// FirstUnmarkedRangeInByte returns the first unmarked range in bits |b|.
+// FirstUnmarkedRangeInByte returns the first unmarked range in bits `b`.
 static DTLSMessageBitmap::Range FirstUnmarkedRangeInByte(uint8_t b) {
   size_t start, end;
   for (start = 0; start < 8; start++) {
@@ -104,8 +106,8 @@ void DTLSMessageBitmap::MarkRange(size_t start, size_t end) {
     }
   }
 
-  // Maintain the |first_unmarked_byte_| invariant. This work is amortized
-  // across all |MarkRange| calls.
+  // Maintain the `first_unmarked_byte_` invariant. This work is amortized
+  // across all `MarkRange` calls.
   while (first_unmarked_byte_ < bytes_.size() &&
          bytes_[first_unmarked_byte_] == 0xff) {
     first_unmarked_byte_++;
@@ -128,7 +130,7 @@ DTLSMessageBitmap::Range DTLSMessageBitmap::NextUnmarkedRange(
     return Range{0, 0};
   }
 
-  // Look at the bits from |start| up to a byte boundary.
+  // Look at the bits from `start` up to a byte boundary.
   uint8_t byte = bytes_[idx] | BitRange(0, start & 7);
   if (byte == 0xff) {
     // Nothing unmarked at this byte. Keep searching for an unmarked bit.
@@ -195,7 +197,7 @@ static UniquePtr<DTLSIncomingMessage> dtls_new_incoming_message(
       !CBB_add_u16(cbb.get(), msg_hdr->seq) ||
       !CBB_add_u24(cbb.get(), 0 /* frag_off */) ||
       !CBB_add_u24(cbb.get(), msg_hdr->msg_len) ||
-      !CBB_finish(cbb.get(), NULL, NULL)) {
+      !CBB_finish(cbb.get(), nullptr, nullptr)) {
     return nullptr;
   }
 
@@ -215,20 +217,20 @@ static bool dtls1_is_current_message_complete(const SSL *ssl) {
 }
 
 // dtls1_get_incoming_message returns the incoming message corresponding to
-// |msg_hdr|. If none exists, it creates a new one and inserts it in the
-// queue. Otherwise, it checks |msg_hdr| is consistent with the existing one. It
+// `msg_hdr`. If none exists, it creates a new one and inserts it in the
+// queue. Otherwise, it checks `msg_hdr` is consistent with the existing one. It
 // returns NULL on failure. The caller does not take ownership of the result.
 static DTLSIncomingMessage *dtls1_get_incoming_message(
     SSL *ssl, uint8_t *out_alert, const struct hm_header_st *msg_hdr) {
   if (msg_hdr->seq < ssl->d1->handshake_read_seq ||
       msg_hdr->seq - ssl->d1->handshake_read_seq >= SSL_MAX_HANDSHAKE_FLIGHT) {
     *out_alert = SSL_AD_INTERNAL_ERROR;
-    return NULL;
+    return nullptr;
   }
 
   size_t idx = msg_hdr->seq % SSL_MAX_HANDSHAKE_FLIGHT;
   DTLSIncomingMessage *frag = ssl->d1->incoming_messages[idx].get();
-  if (frag != NULL) {
+  if (frag != nullptr) {
     assert(frag->seq == msg_hdr->seq);
     // The new fragment must be compatible with the previous fragments from this
     // message.
@@ -236,7 +238,7 @@ static DTLSIncomingMessage *dtls1_get_incoming_message(
         frag->msg_len() != msg_hdr->msg_len) {
       OPENSSL_PUT_ERROR(SSL, SSL_R_FRAGMENT_MISMATCH);
       *out_alert = SSL_AD_ILLEGAL_PARAMETER;
-      return NULL;
+      return nullptr;
     }
     return frag;
   }
@@ -245,7 +247,7 @@ static DTLSIncomingMessage *dtls1_get_incoming_message(
   ssl->d1->incoming_messages[idx] = dtls_new_incoming_message(msg_hdr);
   if (!ssl->d1->incoming_messages[idx]) {
     *out_alert = SSL_AD_INTERNAL_ERROR;
-    return NULL;
+    return nullptr;
   }
   return ssl->d1->incoming_messages[idx].get();
 }
@@ -280,16 +282,16 @@ bool dtls1_process_handshake_fragments(SSL *ssl, uint8_t *out_alert,
       // Ignore fragments from the past. This is a retransmit of data we already
       // received.
       //
-      // TODO(crbug.com/42290594): Use this to drive retransmits.
+      // TODO(crbug.com/383016430): Use this to drive retransmits.
       continue;
     }
 
     if (record_number.epoch() != ssl->d1->read_epoch.epoch ||
         ssl->d1->next_read_epoch != nullptr) {
       // New messages can only arrive in the latest epoch. This can fail if the
-      // record came from |prev_read_epoch|, or if it came from |read_epoch| but
-      // |next_read_epoch| exists. (It cannot come from |next_read_epoch|
-      // because |next_read_epoch| becomes |read_epoch| once it receives a
+      // record came from `prev_read_epoch`, or if it came from `read_epoch` but
+      // `next_read_epoch` exists. (It cannot come from `next_read_epoch`
+      // because `next_read_epoch` becomes `read_epoch` once it receives a
       // record.)
       OPENSSL_PUT_ERROR(SSL, SSL_R_EXCESS_HANDSHAKE_DATA);
       *out_alert = SSL_AD_UNEXPECTED_MESSAGE;
@@ -316,7 +318,7 @@ bool dtls1_process_handshake_fragments(SSL *ssl, uint8_t *out_alert,
       implicit_ack = true;
     }
 
-    if (msg_hdr.seq - ssl->d1->handshake_read_seq > SSL_MAX_HANDSHAKE_FLIGHT) {
+    if (msg_hdr.seq - ssl->d1->handshake_read_seq >= SSL_MAX_HANDSHAKE_FLIGHT) {
       // Ignore fragments too far in the future.
       skipped_fragments = true;
       continue;
@@ -337,6 +339,7 @@ bool dtls1_process_handshake_fragments(SSL *ssl, uint8_t *out_alert,
 
     // Copy the body into the fragment.
     Span<uint8_t> dest = frag->msg().subspan(frag_off, CBS_len(&body));
+    assert(dest.size() == CBS_len(&body));
     OPENSSL_memcpy(dest.data(), CBS_data(&body), CBS_len(&body));
     frag->reassembly.MarkRange(frag_off, frag_off + frag_len);
   }
@@ -407,7 +410,7 @@ ssl_open_record_t dtls1_open_handshake(SSL *ssl, size_t *out_consumed,
       }
 
       // Flag the ChangeCipherSpec for later.
-      // TODO(crbug.com/42290594): Should we reject this in DTLS 1.3?
+      // TODO(crbug.com/383078468): Should we reject this in DTLS 1.3?
       ssl->d1->has_change_cipher_spec = true;
       ssl_do_msg_callback(ssl, 0 /* read */, SSL3_RT_CHANGE_CIPHER_SPEC,
                           record);
@@ -459,7 +462,7 @@ void dtls1_next_message(SSL *ssl) {
   }
   ssl->s3->has_message = false;
   // If we previously sent a flight, mark it as having a reply, so
-  // |on_handshake_complete| can manage post-handshake retransmission.
+  // `on_handshake_complete` can manage post-handshake retransmission.
   if (ssl->d1->outgoing_messages_complete) {
     ssl->d1->flight_has_reply = true;
   }
@@ -533,7 +536,7 @@ void dtls_clear_unused_write_epochs(SSL *ssl) {
         // Non-current epochs may be discarded once there are no incomplete
         // outgoing messages that reference them.
         //
-        // TODO(crbug.com/42290594): Epoch 1 (0-RTT) should be retained until
+        // TODO(crbug.com/381113363): Epoch 1 (0-RTT) should be retained until
         // epoch 3 (app data) is available.
         for (const auto &msg : ssl->d1->outgoing_messages) {
           if (msg.epoch == write_epoch->epoch() && !msg.IsFullyAcked()) {
@@ -545,7 +548,7 @@ void dtls_clear_unused_write_epochs(SSL *ssl) {
 }
 
 bool dtls1_init_message(const SSL *ssl, CBB *cbb, CBB *body, uint8_t type) {
-  // Pick a modest size hint to save most of the |realloc| calls.
+  // Pick a modest size hint to save most of the `realloc` calls.
   if (!CBB_init(cbb, 64) ||                                   //
       !CBB_add_u8(cbb, type) ||                               //
       !CBB_add_u24(cbb, 0 /* length (filled in later) */) ||  //
@@ -589,7 +592,7 @@ static bool add_outgoing(SSL *ssl, bool is_ccs, Array<uint8_t> data) {
     }
     // TODO(svaldez): Move this up a layer to fix abstraction for SSLTranscript
     // on hs.
-    if (ssl->s3->hs != NULL && !ssl->s3->hs->transcript.Update(data)) {
+    if (ssl->s3->hs != nullptr && !ssl->s3->hs->transcript.Update(data)) {
       OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
       return false;
     }
@@ -610,7 +613,7 @@ static bool add_outgoing(SSL *ssl, bool is_ccs, Array<uint8_t> data) {
     return false;
   }
 
-  // This should not fail if |SSL_MAX_HANDSHAKE_FLIGHT| was sized correctly.
+  // This should not fail if `SSL_MAX_HANDSHAKE_FLIGHT` was sized correctly.
   //
   // TODO(crbug.com/42290594): This can currently fail in DTLS 1.3. The caller
   // can configure how many tickets to send, up to kMaxTickets. Additionally, if
@@ -641,17 +644,17 @@ bool dtls1_add_change_cipher_spec(SSL *ssl) {
 // dtls1_update_mtu updates the current MTU from the BIO, ensuring it is above
 // the minimum.
 static void dtls1_update_mtu(SSL *ssl) {
-  // TODO(davidben): No consumer implements |BIO_CTRL_DGRAM_SET_MTU| and the
-  // only |BIO_CTRL_DGRAM_QUERY_MTU| implementation could use
-  // |SSL_set_mtu|. Does this need to be so complex?
+  // TODO(davidben): No consumer implements `BIO_CTRL_DGRAM_SET_MTU` and the
+  // only `BIO_CTRL_DGRAM_QUERY_MTU` implementation could use
+  // `SSL_set_mtu`. Does this need to be so complex?
   if (ssl->d1->mtu < dtls1_min_mtu() &&
       !(SSL_get_options(ssl) & SSL_OP_NO_QUERY_MTU)) {
-    long mtu = BIO_ctrl(ssl->wbio.get(), BIO_CTRL_DGRAM_QUERY_MTU, 0, NULL);
+    long mtu = BIO_ctrl(ssl->wbio.get(), BIO_CTRL_DGRAM_QUERY_MTU, 0, nullptr);
     if (mtu >= 0 && mtu <= (1 << 30) && (unsigned)mtu >= dtls1_min_mtu()) {
       ssl->d1->mtu = (unsigned)mtu;
     } else {
       ssl->d1->mtu = kDefaultMTU;
-      BIO_ctrl(ssl->wbio.get(), BIO_CTRL_DGRAM_SET_MTU, ssl->d1->mtu, NULL);
+      BIO_ctrl(ssl->wbio.get(), BIO_CTRL_DGRAM_SET_MTU, ssl->d1->mtu, nullptr);
     }
   }
 
@@ -665,14 +668,14 @@ enum seal_result_t {
   seal_flush,
 };
 
-// seal_next_record seals one record's worth of messages to |out| and advances
-// |ssl|'s internal state past the data that was sealed. If progress was made,
-// it returns |seal_flush| or |seal_continue| and sets
-// |*out_len| to the number of bytes written.
+// seal_next_record seals one record's worth of messages to `out` and advances
+// `ssl`'s internal state past the data that was sealed. If progress was made,
+// it returns `seal_flush` or `seal_continue` and sets
+// `*out_len` to the number of bytes written.
 //
 // If the function stopped because the next message could not be combined into
-// this record, it returns |seal_continue| and the caller should loop again.
-// Otherwise, it returns |seal_flush| and the packet is complete (either because
+// this record, it returns `seal_continue` and the caller should loop again.
+// Otherwise, it returns `seal_flush` and the packet is complete (either because
 // there are no more messages or the packet is full).
 static seal_result_t seal_next_record(SSL *ssl, Span<uint8_t> out,
                                       size_t *out_len) {
@@ -722,7 +725,8 @@ static seal_result_t seal_next_record(SSL *ssl, Span<uint8_t> out,
   // Pack as many handshake fragments into one record as we can. We stage the
   // fragments in the output buffer, to be sealed in-place.
   bool should_continue = false;
-  Span<uint8_t> fragments = out.subspan(prefix_len, max_in_len);
+  Span<uint8_t> fragments =
+      out.subspan(prefix_len, std::min(max_in_len, out.size() - prefix_len));
   CBB cbb;
   CBB_init_fixed(&cbb, fragments.data(), fragments.size());
   DTLSSentRecord sent_record;
@@ -737,7 +741,7 @@ static seal_result_t seal_next_record(SSL *ssl, Span<uint8_t> out,
       break;
     }
 
-    // Decode |msg|'s header.
+    // Decode `msg`'s header.
     CBS cbs(msg.data), body_cbs;
     struct hm_header_st hdr;
     if (!dtls1_parse_fragment(&cbs, &hdr, &body_cbs) ||  //
@@ -840,8 +844,8 @@ packet_full:
   return should_continue ? seal_continue : seal_flush;
 }
 
-// seal_next_packet writes as much of the next flight as possible to |out| and
-// advances |ssl->d1->outgoing_written| and |ssl->d1->outgoing_offset| as
+// seal_next_packet writes as much of the next flight as possible to `out` and
+// advances `ssl->d1->outgoing_written` and `ssl->d1->outgoing_offset` as
 // appropriate.
 static bool seal_next_packet(SSL *ssl, Span<uint8_t> out, size_t *out_len) {
   size_t total = 0;
@@ -909,22 +913,18 @@ static int send_flight(SSL *ssl) {
     }
 
     if (packet_len != 0) {
-      int bio_ret = BIO_write(ssl->wbio.get(), packet.data(), packet_len);
-      if (bio_ret <= 0) {
+      if (!BIO_write_ex(ssl->wbio.get(), packet.data(), packet_len,
+                        /*out_written=*/nullptr)) {
         // Retry this packet the next time around.
         ssl->d1->outgoing_written = old_written;
         ssl->d1->outgoing_offset = old_offset;
         ssl->s3->rwstate = SSL_ERROR_WANT_WRITE;
-        return bio_ret;
+        return -1;
       }
     }
   }
 
-  if (BIO_flush(ssl->wbio.get()) <= 0) {
-    ssl->s3->rwstate = SSL_ERROR_WANT_WRITE;
-    return -1;
-  }
-
+  ssl->d1->pending_flush = true;
   return 1;
 }
 
@@ -1005,21 +1005,15 @@ static int send_ack(SSL *ssl) {
     return -1;
   }
 
-  ssl_do_msg_callback(ssl, /*is_write=*/1, SSL3_RT_ACK,
-                      Span(CBB_data(&cbb), CBB_len(&cbb)));
+  ssl_do_msg_callback(ssl, /*is_write=*/1, SSL3_RT_ACK, CBBAsSpan(&cbb));
 
-  int bio_ret =
-      BIO_write(ssl->wbio.get(), record, static_cast<int>(record_len));
-  if (bio_ret <= 0) {
-    ssl->s3->rwstate = SSL_ERROR_WANT_WRITE;
-    return bio_ret;
-  }
-
-  if (BIO_flush(ssl->wbio.get()) <= 0) {
+  if (!BIO_write_ex(ssl->wbio.get(), record, record_len,
+                    /*out_written=*/nullptr)) {
     ssl->s3->rwstate = SSL_ERROR_WANT_WRITE;
     return -1;
   }
 
+  ssl->d1->pending_flush = true;
   return 1;
 }
 
@@ -1062,9 +1056,17 @@ int dtls1_flush(SSL *ssl) {
     }
   }
 
+  if (ssl->d1->pending_flush) {
+    if (BIO_flush(ssl->wbio.get()) <= 0) {
+      ssl->s3->rwstate = SSL_ERROR_WANT_WRITE;
+      return -1;
+    }
+    ssl->d1->pending_flush = false;
+  }
+
   return 1;
 }
 
-unsigned int dtls1_min_mtu(void) { return kMinMTU; }
+unsigned int dtls1_min_mtu() { return kMinMTU; }
 
 BSSL_NAMESPACE_END