grpc 1.84.1 → 1.85.0.pre1

data/third_party/boringssl-with-bazel/ssl/handoff.cc

@@ -17,6 +17,9 @@
 #include <openssl/bytestring.h>
 #include <openssl/err.h>
 
+#include <algorithm>
+#include <optional>
+
 #include "../crypto/internal.h"
 #include "internal.h"
 
@@ -40,7 +43,7 @@ enum early_data_t {
 };
 
 // serialize_features adds a description of features supported by this binary to
-// |out|.  Returns true on success and false on error.
+// `out`.  Returns true on success and false on error.
 static bool serialize_features(CBB *out) {
   CBB ciphers;
   if (!CBB_add_asn1(out, &ciphers, CBS_ASN1_OCTETSTRING)) {
@@ -48,7 +51,7 @@ static bool serialize_features(CBB *out) {
   }
   Span<const SSL_CIPHER> all_ciphers = AllCiphers();
   for (const SSL_CIPHER &cipher : all_ciphers) {
-    if (!CBB_add_u16(&ciphers, static_cast<uint16_t>(cipher.id))) {
+    if (!CBB_add_u16(&ciphers, cipher.protocol_id)) {
       return false;
     }
   }
@@ -114,8 +117,8 @@ bool SSL_decline_handoff(SSL *ssl) {
   return true;
 }
 
-// apply_remote_features reads a list of supported features from |in| and
-// (possibly) reconfigures |ssl| to disallow the negotation of features whose
+// apply_remote_features reads a list of supported features from `in` and
+// (possibly) reconfigures `ssl` to disallow the negotiation of features whose
 // support has not been indicated.  (This prevents the the handshake from
 // committing to features that are not supported on the handoff/handback side.)
 static bool apply_remote_features(SSL *ssl, CBS *in) {
@@ -186,29 +189,52 @@ static bool apply_remote_features(SSL *ssl, CBS *in) {
     supported_groups[idx++] = group;
   }
   Span<const uint16_t> configured_groups =
-      tls1_get_grouplist(ssl->s3->hs.get());
+      ssl->s3->hs->config->supported_group_list;
+  Span<const uint32_t> configured_groups_flags =
+      ssl->s3->hs->config->supported_group_list_flags;
   Array<uint16_t> new_configured_groups;
-  if (!new_configured_groups.InitForOverwrite(configured_groups.size())) {
+  // Temporary scratch space to keep track of consecutive runs of groups of
+  // equal preference, so they can be relabeled after filtering for groups
+  // present in the remote features and copying to the new configuration.
+  Array<size_t> new_groups_preference_ranks;
+  Array<uint32_t> new_groups_flags;
+  if (!new_configured_groups.InitForOverwrite(configured_groups.size()) ||
+      !new_groups_preference_ranks.Init(configured_groups.size()) ||
+      !new_groups_flags.Init(configured_groups.size())) {
     return false;
   }
+  // Populate temporary array containing "preference rank" of each group.
+  for (size_t i = 1; i < configured_groups.size(); ++i) {
+    new_groups_preference_ranks[i] = new_groups_preference_ranks[i - 1];
+    if ((configured_groups_flags[i - 1] &
+         SSL_GROUP_FLAG_EQUAL_PREFERENCE_WITH_NEXT) == 0) {
+      ++new_groups_preference_ranks[i];
+    }
+  }
   idx = 0;
-  for (uint16_t configured_group : configured_groups) {
-    bool ok = false;
-    for (uint16_t supported_group : supported_groups) {
-      if (supported_group == configured_group) {
-        ok = true;
-        break;
-      }
+  std::optional<size_t> last_rank;
+  for (size_t i = 0u; i < configured_groups.size(); ++i) {
+    uint16_t configured_group = configured_groups[i];
+    if (std::find(supported_groups.begin(), supported_groups.end(),
+                  configured_group) == supported_groups.end()) {
+      continue;
     }
-    if (ok) {
-      new_configured_groups[idx++] = configured_group;
+    new_configured_groups[idx] = configured_group;
+    // Set the "equal preference with next" flag on the previous group, if
+    // appropriate.
+    if (last_rank.has_value() && new_groups_preference_ranks[i] == *last_rank) {
+      new_groups_flags[idx - 1] |= SSL_GROUP_FLAG_EQUAL_PREFERENCE_WITH_NEXT;
     }
+    last_rank = new_groups_preference_ranks[i];
+    ++idx;
   }
   if (idx == 0) {
     return false;
   }
   new_configured_groups.Shrink(idx);
+  new_groups_flags.Shrink(idx);
   ssl->config->supported_group_list = std::move(new_configured_groups);
+  ssl->config->supported_group_list_flags = std::move(new_groups_flags);
 
   CBS alps;
   CBS_init(&alps, nullptr, 0);
@@ -239,7 +265,7 @@ static bool apply_remote_features(SSL *ssl, CBS *in) {
   return true;
 }
 
-// uses_disallowed_feature returns true iff |ssl| enables a feature that
+// uses_disallowed_feature returns true iff `ssl` enables a feature that
 // disqualifies it for split handshakes.
 static bool uses_disallowed_feature(const SSL *ssl) {
   return ssl->method->is_dtls || !ssl->config->cert->credentials.empty() ||
@@ -377,8 +403,8 @@ bool SSL_serialize_handback(const SSL *ssl, CBB *out) {
           hostname_len) ||
       !CBB_add_asn1_octet_string(&seq, kUnusedChannelID,
                                  sizeof(kUnusedChannelID)) ||
-      // These two fields were historically |token_binding_negotiated| and
-      // |negotiated_token_binding_param|.
+      // These two fields were historically `token_binding_negotiated` and
+      // `negotiated_token_binding_param`.
       !CBB_add_asn1_bool(&seq, 0) ||  //
       !CBB_add_asn1_uint64(&seq, 0) ||
       !CBB_add_asn1_bool(&seq, s3->hs->next_proto_neg_seen) ||
@@ -520,14 +546,20 @@ bool SSL_apply_handback(SSL *ssl, Span<const uint8_t> handback) {
   SSL_HANDSHAKE *const hs = s3->hs.get();
   if (!session_reused || type == handback_tls13) {
     hs->new_session =
-        SSL_SESSION_parse(&seq, ssl->ctx->x509_method, ssl->ctx->pool);
+        SSL_SESSION_parse(&seq, ssl->ctx->x509_method, ssl->ctx->pool.get());
     session = hs->new_session.get();
   } else {
     ssl->session =
-        SSL_SESSION_parse(&seq, ssl->ctx->x509_method, ssl->ctx->pool);
+        SSL_SESSION_parse(&seq, ssl->ctx->x509_method, ssl->ctx->pool.get());
     session = ssl->session.get();
   }
 
+  // Split handshakes only support X.509 certificates.
+  if (session != nullptr && session->peer_cert_type != kDefaultCertType) {
+    OPENSSL_PUT_ERROR(SSL, SSL_R_UNSUPPORTED_CERTIFICATE);
+    return false;
+  }
+
   if (!session || !CBS_get_asn1(&seq, &next_proto, CBS_ASN1_OCTETSTRING) ||
       !CBS_get_asn1(&seq, &alpn, CBS_ASN1_OCTETSTRING) ||
       !CBS_get_asn1(&seq, &hostname, CBS_ASN1_OCTETSTRING) ||
@@ -760,9 +792,10 @@ bool SSL_apply_handback(SSL *ssl, Span<const uint8_t> handback) {
         !CBS_get_asn1(&key_share, &private_key, CBS_ASN1_OCTETSTRING)) {
       return false;
     }
-    hs->key_shares[0] = SSLKeyShare::Create(group_id);
-    if (!hs->key_shares[0] ||
-        !hs->key_shares[0]->DeserializePrivateKey(&private_key)) {
+    UniquePtr<SSLKeyShare> ssl_key_share = SSLKeyShare::Create(group_id);
+    if (ssl_key_share == nullptr ||
+        !ssl_key_share->DeserializePrivateKey(&private_key) ||
+        !hs->key_shares.TryPushBack(std::move(ssl_key_share))) {
       return false;
     }
   }
@@ -828,7 +861,7 @@ int SSL_request_handshake_hints(SSL *ssl, const uint8_t *client_hello,
   return 1;
 }
 
-// |SSL_HANDSHAKE_HINTS| is serialized as the following ASN.1 structure. We use
+// `SSL_HANDSHAKE_HINTS` is serialized as the following ASN.1 structure. We use
 // implicit tagging to make it a little more compact.
 //
 // HandshakeHints ::= SEQUENCE {
@@ -841,18 +874,24 @@ int SSL_request_handshake_hints(SSL *ssl, const uint8_t *client_hello,
 //     -- hint to the wrong field.
 //     decryptedPSKHint        [3] IMPLICIT OCTET STRING OPTIONAL,
 //     ignorePSKHint           [4] IMPLICIT NULL OPTIONAL,
-//     compressCertificateHint [5] IMPLICIT CompressCertificateHint OPTIONAL,
+//     -- Due to a historical typo, compressCertificateHint's tag is primitive
+//     -- instead of constructed.
+//     compressCertificateHint [5 PRIMITIVE] IMPLICIT CompressCertificateHint
+//                                 OPTIONAL,
 //     -- TLS 1.2 and 1.3 use different server random hints because one contains
 //     -- a timestamp while the other doesn't. If the hint was generated
 //     -- assuming TLS 1.3 but we actually negotiate TLS 1.2, mixing the two
 //     -- will break this.
 //     serverRandomTLS12       [6] IMPLICIT OCTET STRING OPTIONAL,
-//     ecdheHint               [7] IMPLICIT ECDHEHint OPTIONAL
+//     -- Due to a historical typo, ecdheHint tag has universal class instead of
+//     -- context-specific.
+//     ecdheHint               [UNIVERSAL 7] IMPLICIT ECDHEHint OPTIONAL
 //     -- At most one of decryptedTicketHint or ignoreTicketHint may be present.
 //     -- renewTicketHint requires decryptedTicketHint.
 //     decryptedTicketHint     [8] IMPLICIT OCTET STRING OPTIONAL,
 //     renewTicketHint         [9] IMPLICIT NULL OPTIONAL,
 //     ignoreTicketHint       [10] IMPLICIT NULL OPTIONAL,
+//     -- Unlike a usual ASN.1 structure, trailing data is ignored.
 // }
 //
 // KeyShareHint ::= SEQUENCE {
@@ -910,9 +949,9 @@ int SSL_serialize_handshake_hints(const SSL *ssl, CBB *out) {
   }
 
   if (!hints->server_random_tls13.empty()) {
-    if (!CBB_add_asn1(&seq, &child, kServerRandomTLS13Tag) ||
-        !CBB_add_bytes(&child, hints->server_random_tls13.data(),
-                       hints->server_random_tls13.size())) {
+    if (!CBB_add_asn1_element(&seq, kServerRandomTLS13Tag,
+                              hints->server_random_tls13.data(),
+                              hints->server_random_tls13.size())) {
       return 0;
     }
   }
@@ -944,9 +983,9 @@ int SSL_serialize_handshake_hints(const SSL *ssl, CBB *out) {
   }
 
   if (!hints->decrypted_psk.empty()) {
-    if (!CBB_add_asn1(&seq, &child, kDecryptedPSKTag) ||
-        !CBB_add_bytes(&child, hints->decrypted_psk.data(),
-                       hints->decrypted_psk.size())) {
+    if (!CBB_add_asn1_element(&seq, kDecryptedPSKTag,
+                              hints->decrypted_psk.data(),
+                              hints->decrypted_psk.size())) {
       return 0;
     }
   }
@@ -971,9 +1010,9 @@ int SSL_serialize_handshake_hints(const SSL *ssl, CBB *out) {
   }
 
   if (!hints->server_random_tls12.empty()) {
-    if (!CBB_add_asn1(&seq, &child, kServerRandomTLS12Tag) ||
-        !CBB_add_bytes(&child, hints->server_random_tls12.data(),
-                       hints->server_random_tls12.size())) {
+    if (!CBB_add_asn1_element(&seq, kServerRandomTLS12Tag,
+                              hints->server_random_tls12.data(),
+                              hints->server_random_tls12.size())) {
       return 0;
     }
   }
@@ -992,9 +1031,9 @@ int SSL_serialize_handshake_hints(const SSL *ssl, CBB *out) {
 
 
   if (!hints->decrypted_ticket.empty()) {
-    if (!CBB_add_asn1(&seq, &child, kDecryptedTicketTag) ||
-        !CBB_add_bytes(&child, hints->decrypted_ticket.data(),
-                       hints->decrypted_ticket.size())) {
+    if (!CBB_add_asn1_element(&seq, kDecryptedTicketTag,
+                              hints->decrypted_ticket.data(),
+                              hints->decrypted_ticket.size())) {
       return 0;
     }
   }

data/third_party/boringssl-with-bazel/ssl/handshake.cc

@@ -17,8 +17,12 @@
 
 #include <assert.h>
 
+#include <algorithm>
 #include <utility>
 
+#include <openssl/err.h>
+#include <openssl/evp.h>
+#include <openssl/pool.h>
 #include <openssl/rand.h>
 
 #include "../crypto/internal.h"
@@ -62,7 +66,7 @@ SSL_HANDSHAKE::SSL_HANDSHAKE(SSL *ssl_arg)
   assert(ssl);
 
   // Draw entropy for all GREASE values at once. This avoids calling
-  // |RAND_bytes| repeatedly and makes the values consistent within a
+  // `RAND_bytes` repeatedly and makes the values consistent within a
   // connection. The latter is so the second ClientHello matches after
   // HelloRetryRequest and so supported_groups and key_shares are consistent.
   RAND_bytes(grease_seed, sizeof(grease_seed));
@@ -156,8 +160,9 @@ size_t ssl_max_handshake_message_len(const SSL *ssl) {
     return 1;
   }
 
-  // Clients must accept NewSessionTicket, so allow the default size.
-  return kMaxMessageLen;
+  // Clients must accept NewSessionTicket, so allow the default size or
+  // max_cert_list, whichever is greater.
+  return std::max(kMaxMessageLen, size_t{ssl->max_cert_list});
 }
 
 bool ssl_hash_message(SSL_HANDSHAKE *hs, const SSLMessage &msg) {
@@ -224,36 +229,57 @@ bool ssl_parse_extensions(const CBS *cbs, uint8_t *out_alert,
   return true;
 }
 
+static bool peer_certificates_equal(const SSL_SESSION *session,
+                                    const SSL_SESSION *prev_session) {
+  const uint8_t prev_cert_type = prev_session->peer_cert_type;
+  if (session->peer_cert_type != prev_cert_type) {
+    return false;
+  }
+  if (ssl_session_has_peer_cred(session) !=
+      ssl_session_has_peer_cred(prev_session)) {
+    return false;
+  }
+  if (prev_cert_type == TLSEXT_cert_type_x509) {
+    if (sk_CRYPTO_BUFFER_num(prev_session->certs.get()) !=
+        sk_CRYPTO_BUFFER_num(session->certs.get())) {
+      return false;
+    }
+    for (size_t i = 0; i < sk_CRYPTO_BUFFER_num(session->certs.get());
+          i++) {
+      const CRYPTO_BUFFER *old_cert =
+          sk_CRYPTO_BUFFER_value(prev_session->certs.get(), i);
+      const CRYPTO_BUFFER *new_cert =
+          sk_CRYPTO_BUFFER_value(session->certs.get(), i);
+      if (Span(CRYPTO_BUFFER_data(old_cert), CRYPTO_BUFFER_len(old_cert)) !=
+          Span(CRYPTO_BUFFER_data(new_cert), CRYPTO_BUFFER_len(new_cert))) {
+        return false;
+      }
+    }
+  } else {
+    assert(prev_cert_type == TLSEXT_cert_type_rpk);
+    if (EVP_PKEY_eq(prev_session->peer_raw_public_key.get(),
+                    session->peer_raw_public_key.get()) != 1) {
+      return false;
+    }
+  }
+  return true;
+}
+
 enum ssl_verify_result_t ssl_verify_peer_cert(SSL_HANDSHAKE *hs) {
   SSL *const ssl = hs->ssl;
   const SSL_SESSION *prev_session = ssl->s3->established_session.get();
-  if (prev_session != NULL) {
+  if (prev_session != nullptr) {
     // If renegotiating, the server must not change the server certificate. See
     // https://mitls.org/pages/attacks/3SHAKE. We never resume on renegotiation,
     // so this check is sufficient to ensure the reported peer certificate never
     // changes on renegotiation.
     assert(!ssl->server);
-    if (sk_CRYPTO_BUFFER_num(prev_session->certs.get()) !=
-        sk_CRYPTO_BUFFER_num(hs->new_session->certs.get())) {
+    if (!peer_certificates_equal(hs->new_session.get(), prev_session)) {
       OPENSSL_PUT_ERROR(SSL, SSL_R_SERVER_CERT_CHANGED);
       ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER);
       return ssl_verify_invalid;
     }
 
-    for (size_t i = 0; i < sk_CRYPTO_BUFFER_num(hs->new_session->certs.get());
-         i++) {
-      const CRYPTO_BUFFER *old_cert =
-          sk_CRYPTO_BUFFER_value(prev_session->certs.get(), i);
-      const CRYPTO_BUFFER *new_cert =
-          sk_CRYPTO_BUFFER_value(hs->new_session->certs.get(), i);
-      if (Span(CRYPTO_BUFFER_data(old_cert), CRYPTO_BUFFER_len(old_cert)) !=
-          Span(CRYPTO_BUFFER_data(new_cert), CRYPTO_BUFFER_len(new_cert))) {
-        OPENSSL_PUT_ERROR(SSL, SSL_R_SERVER_CERT_CHANGED);
-        ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER);
-        return ssl_verify_invalid;
-      }
-    }
-
     // The certificate is identical, so we may skip re-verifying the
     // certificate. Since we only authenticated the previous one, copy other
     // authentication from the established session and ignore what was newly
@@ -274,7 +300,7 @@ enum ssl_verify_result_t ssl_verify_peer_cert(SSL_HANDSHAKE *hs) {
         hs->new_session->verify_result = X509_V_OK;
         break;
       case ssl_verify_invalid:
-        // If |SSL_VERIFY_NONE|, the error is non-fatal, but we keep the result.
+        // If `SSL_VERIFY_NONE`, the error is non-fatal, but we keep the result.
         if (hs->config->verify_mode == SSL_VERIFY_NONE) {
           ERR_clear_error();
           ret = ssl_verify_ok;
@@ -468,6 +494,14 @@ bool ssl_send_tls12_certificate(SSL_HANDSHAKE *hs) {
   }
 
   if (hs->credential != nullptr) {
+    // Write the Certificate format for a RawPublicKey (RFC 7250).
+    if (hs->credential->type == SSLCredentialType::kRawPublicKey) {
+      if (!EVP_marshal_public_key(&certs, hs->credential->pubkey.get())) {
+        return false;
+      }
+      return ssl_add_message_cbb(hs->ssl, cbb.get());
+    }
+
     assert(hs->credential->type == SSLCredentialType::kX509);
     STACK_OF(CRYPTO_BUFFER) *chain = hs->credential->chain.get();
     for (size_t i = 0; i < sk_CRYPTO_BUFFER_num(chain); i++) {
@@ -494,7 +528,7 @@ int ssl_run_handshake(SSL_HANDSHAKE *hs, bool *out_early_return) {
   SSL *const ssl = hs->ssl;
   for (;;) {
     // If a timeout during the handshake triggered a DTLS ACK or retransmit, we
-    // resolve that first. E.g., if |ssl_hs_private_key_operation| is slow, the
+    // resolve that first. E.g., if `ssl_hs_private_key_operation` is slow, the
     // ACK timer may fire.
     if (hs->wait != ssl_hs_error && SSL_is_dtls(ssl)) {
       int ret = ssl->method->flush(ssl);
@@ -506,7 +540,7 @@ int ssl_run_handshake(SSL_HANDSHAKE *hs, bool *out_early_return) {
     // Resolve the operation the handshake was waiting on. Each condition may
     // halt the handshake by returning, or continue executing if the handshake
     // may immediately proceed. Cases which halt the handshake can clear
-    // |hs->wait| to re-enter the state machine on the next iteration, or leave
+    // `hs->wait` to re-enter the state machine on the next iteration, or leave
     // it set to keep the condition sticky.
     switch (hs->wait) {
       case ssl_hs_error:
@@ -527,7 +561,7 @@ int ssl_run_handshake(SSL_HANDSHAKE *hs, bool *out_early_return) {
         if (SSL_is_quic(ssl)) {
           // QUIC has no ChangeCipherSpec messages.
           assert(hs->wait != ssl_hs_read_change_cipher_spec);
-          // The caller should call |SSL_provide_quic_data|. Clear |hs->wait| so
+          // The caller should call `SSL_provide_quic_data`. Clear `hs->wait` so
           // the handshake can check if there is sufficient data next iteration.
           ssl->s3->rwstate = SSL_ERROR_WANT_READ;
           hs->wait = ssl_hs_ok;
@@ -546,9 +580,8 @@ int ssl_run_handshake(SSL_HANDSHAKE *hs, bool *out_early_return) {
         }
         if (ret == ssl_open_record_error &&
             hs->wait == ssl_hs_read_server_hello) {
-          uint32_t err = ERR_peek_error();
-          if (ERR_GET_LIB(err) == ERR_LIB_SSL &&
-              ERR_GET_REASON(err) == SSL_R_SSLV3_ALERT_HANDSHAKE_FAILURE) {
+          if (ERR_equals(ERR_peek_error(), ERR_LIB_SSL,
+                         SSL_R_SSLV3_ALERT_HANDSHAKE_FAILURE)) {
             // Add a dedicated error code to the queue for a handshake_failure
             // alert in response to ClientHello. This matches NSS's client
             // behavior and gives a better error on a (probable) failure to
@@ -602,8 +635,8 @@ int ssl_run_handshake(SSL_HANDSHAKE *hs, bool *out_early_return) {
       }
 
         // The following cases are associated with callback APIs which expect to
-        // be called each time the state machine runs. Thus they set |hs->wait|
-        // to |ssl_hs_ok| so that, next time, we re-enter the state machine and
+        // be called each time the state machine runs. Thus they set `hs->wait`
+        // to `ssl_hs_ok` so that, next time, we re-enter the state machine and
         // call the callback again.
       case ssl_hs_x509_lookup:
         ssl->s3->rwstate = SSL_ERROR_WANT_X509_LOOKUP;
@@ -664,7 +697,7 @@ int ssl_run_handshake(SSL_HANDSHAKE *hs, bool *out_early_return) {
       *out_early_return = false;
       return 1;
     }
-    // If the handshake returns |ssl_hs_flush|, implicitly finish the flight.
+    // If the handshake returns `ssl_hs_flush`, implicitly finish the flight.
     // This is a convenience so we do not need to manually insert this
     // throughout the handshake.
     if (hs->wait == ssl_hs_flush) {