grpc 1.84.1 → 1.85.0.pre1

data/third_party/boringssl-with-bazel/ssl/s3_both.cc

@@ -19,6 +19,7 @@
 #include <limits.h>
 #include <string.h>
 
+#include <algorithm>
 #include <tuple>
 
 #include <openssl/buf.h>
@@ -29,8 +30,9 @@
 #include <openssl/mem.h>
 #include <openssl/nid.h>
 #include <openssl/rand.h>
-#include <openssl/sha.h>
+#include <openssl/sha2.h>
 
+#include "../crypto/bytestring/internal.h"
 #include "../crypto/internal.h"
 #include "internal.h"
 
@@ -39,7 +41,7 @@ BSSL_NAMESPACE_BEGIN
 
 static bool add_record_to_flight(SSL *ssl, uint8_t type,
                                  Span<const uint8_t> in) {
-  // The caller should have flushed |pending_hs_data| first.
+  // The caller should have flushed `pending_hs_data` first.
   assert(!ssl->s3->pending_hs_data);
   // We'll never add a flight while in the process of writing it out.
   assert(ssl->s3->pending_flight_offset == 0);
@@ -72,7 +74,7 @@ static bool add_record_to_flight(SSL *ssl, uint8_t type,
 }
 
 bool tls_init_message(const SSL *ssl, CBB *cbb, CBB *body, uint8_t type) {
-  // Pick a modest size hint to save most of the |realloc| calls.
+  // Pick a modest size hint to save most of the `realloc` calls.
   if (!CBB_init(cbb, 64) ||      //
       !CBB_add_u8(cbb, type) ||  //
       !CBB_add_u24_length_prefixed(cbb, body)) {
@@ -99,7 +101,8 @@ bool tls_add_message(SSL *ssl, Array<uint8_t> msg) {
   Span<const uint8_t> rest = msg;
   if (!SSL_is_quic(ssl) && ssl->s3->aead_write_ctx->is_null_cipher()) {
     while (!rest.empty()) {
-      Span<const uint8_t> chunk = rest.subspan(0, ssl->max_send_fragment);
+      Span<const uint8_t> chunk =
+          rest.first(std::min(size_t{ssl->max_send_fragment}, rest.size()));
       rest = rest.subspan(chunk.size());
 
       if (!add_record_to_flight(ssl, SSL3_RT_HANDSHAKE, chunk)) {
@@ -108,7 +111,7 @@ bool tls_add_message(SSL *ssl, Array<uint8_t> msg) {
     }
   } else {
     while (!rest.empty()) {
-      // Flush if |pending_hs_data| is full.
+      // Flush if `pending_hs_data` is full.
       if (ssl->s3->pending_hs_data &&
           ssl->s3->pending_hs_data->length >= ssl->max_send_fragment &&
           !tls_flush_pending_hs_data(ssl)) {
@@ -117,8 +120,8 @@ bool tls_add_message(SSL *ssl, Array<uint8_t> msg) {
 
       size_t pending_len =
           ssl->s3->pending_hs_data ? ssl->s3->pending_hs_data->length : 0;
-      Span<const uint8_t> chunk =
-          rest.subspan(0, ssl->max_send_fragment - pending_len);
+      Span<const uint8_t> chunk = rest.first(
+          std::min(ssl->max_send_fragment - pending_len, rest.size()));
       assert(!chunk.empty());
       rest = rest.subspan(chunk.size());
 
@@ -136,7 +139,7 @@ bool tls_add_message(SSL *ssl, Array<uint8_t> msg) {
   ssl_do_msg_callback(ssl, 1 /* write */, SSL3_RT_HANDSHAKE, msg);
   // TODO(svaldez): Move this up a layer to fix abstraction for SSLTranscript on
   // hs.
-  if (ssl->s3->hs != NULL &&  //
+  if (ssl->s3->hs != nullptr &&  //
       !ssl->s3->hs->transcript.Update(msg)) {
     return false;
   }
@@ -207,8 +210,7 @@ int tls_flush(SSL *ssl) {
     return -1;
   }
 
-  static_assert(INT_MAX <= 0xffffffff, "int is larger than 32 bits");
-  if (ssl->s3->pending_flight->length > INT_MAX) {
+  if (ssl->s3->pending_flight->length > UINT32_MAX) {
     OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
     return -1;
   }
@@ -230,16 +232,17 @@ int tls_flush(SSL *ssl) {
 
   // Write the pending flight.
   while (ssl->s3->pending_flight_offset < ssl->s3->pending_flight->length) {
-    int ret = BIO_write(
-        ssl->wbio.get(),
-        ssl->s3->pending_flight->data + ssl->s3->pending_flight_offset,
-        ssl->s3->pending_flight->length - ssl->s3->pending_flight_offset);
-    if (ret <= 0) {
+    size_t written;
+    if (!BIO_write_ex(
+            ssl->wbio.get(),
+            ssl->s3->pending_flight->data + ssl->s3->pending_flight_offset,
+            ssl->s3->pending_flight->length - ssl->s3->pending_flight_offset,
+            &written)) {
       ssl->s3->rwstate = SSL_ERROR_WANT_WRITE;
-      return ret;
+      return -1;
     }
 
-    ssl->s3->pending_flight_offset += ret;
+    ssl->s3->pending_flight_offset += static_cast<uint32_t>(written);
   }
 
   if (BIO_flush(ssl->wbio.get()) <= 0) {
@@ -264,7 +267,7 @@ static ssl_open_record_t read_v2_client_hello(SSL *ssl, size_t *out_consumed,
   }
   if (msg_length < SSL3_RT_HEADER_LENGTH - 2) {
     // Reject lengths that are too short early. We have already read
-    // |SSL3_RT_HEADER_LENGTH| bytes, so we should not attempt to process an
+    // `SSL3_RT_HEADER_LENGTH` bytes, so we should not attempt to process an
     // (invalid) V2ClientHello which would be shorter than that.
     OPENSSL_PUT_ERROR(SSL, SSL_R_RECORD_LENGTH_MISMATCH);
     return ssl_open_record_error;
@@ -363,7 +366,7 @@ static ssl_open_record_t read_v2_client_hello(SSL *ssl, size_t *out_consumed,
   // Add the null compression scheme and finish.
   if (!CBB_add_u8(&hello_body, 1) ||  //
       !CBB_add_u8(&hello_body, 0) ||  //
-      !CBB_finish(client_hello.get(), NULL, &ssl->s3->hs_buf->length)) {
+      !CBB_finish(client_hello.get(), nullptr, &ssl->s3->hs_buf->length)) {
     OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
     return ssl_open_record_error;
   }
@@ -542,7 +545,7 @@ void tls_next_message(SSL *ssl) {
   ssl->s3->has_message = false;
 
   // Post-handshake messages are rare, so release the buffer after every
-  // message. During the handshake, |on_handshake_complete| will release it.
+  // message. During the handshake, `on_handshake_complete` will release it.
   if (!SSL_in_init(ssl) && ssl->s3->hs_buf->length == 0) {
     ssl->s3->hs_buf.reset();
   }
@@ -586,9 +589,9 @@ class CNsaCipherScorer : public CipherScorer {
   virtual ~CNsaCipherScorer() override = default;
 
   Score Evaluate(const SSL_CIPHER *a) const override {
-    if (a->id == TLS1_3_CK_AES_256_GCM_SHA384) {
+    if (a->protocol_id == SSL_CIPHER_AES_256_GCM_SHA384) {
       return 3;
-    } else if (a->id == TLS1_3_CK_AES_128_GCM_SHA256) {
+    } else if (a->protocol_id == SSL_CIPHER_AES_128_GCM_SHA256) {
       return 2;
     }
     return 1;
@@ -606,10 +609,10 @@ bool ssl_tls13_cipher_meets_policy(uint16_t cipher_id,
 
     case ssl_compliance_policy_fips_202205:
       switch (cipher_id) {
-        case TLS1_3_CK_AES_128_GCM_SHA256 & 0xffff:
-        case TLS1_3_CK_AES_256_GCM_SHA384 & 0xffff:
+        case SSL_CIPHER_AES_128_GCM_SHA256:
+        case SSL_CIPHER_AES_256_GCM_SHA384:
           return true;
-        case TLS1_3_CK_CHACHA20_POLY1305_SHA256 & 0xffff:
+        case SSL_CIPHER_CHACHA20_POLY1305_SHA256:
           return false;
         default:
           assert(false);
@@ -617,11 +620,13 @@ bool ssl_tls13_cipher_meets_policy(uint16_t cipher_id,
       }
 
     case ssl_compliance_policy_wpa3_192_202304:
+    case ssl_compliance_policy_cnsa1_202603:
+    case ssl_compliance_policy_cnsa2_202603:
       switch (cipher_id) {
-        case TLS1_3_CK_AES_256_GCM_SHA384 & 0xffff:
+        case SSL_CIPHER_AES_256_GCM_SHA384:
           return true;
-        case TLS1_3_CK_AES_128_GCM_SHA256 & 0xffff:
-        case TLS1_3_CK_CHACHA20_POLY1305_SHA256 & 0xffff:
+        case SSL_CIPHER_AES_128_GCM_SHA256:
+        case SSL_CIPHER_CHACHA20_POLY1305_SHA256:
           return false;
         default:
           assert(false);
@@ -669,7 +674,7 @@ const SSL_CIPHER *ssl_choose_tls13_cipher(CBS cipher_suites, bool has_aes_hw,
     }
 
     const CipherScorer::Score candidate_score = scorer->Evaluate(candidate);
-    // |candidate_score| must be larger to displace the current choice. That way
+    // `candidate_score` must be larger to displace the current choice. That way
     // the client's order controls between ciphers with an equal score.
     if (candidate_score > best_score) {
       best = candidate;

data/third_party/boringssl-with-bazel/ssl/s3_lib.cc

@@ -45,7 +45,8 @@ SSL3_STATE::SSL3_STATE()
       alert_dispatch(false),
       renegotiate_pending(false),
       used_hello_retry_request(false),
-      was_key_usage_invalid(false) {}
+      was_key_usage_invalid(false),
+      server_sent_requested_padding(false) {}
 
 SSL3_STATE::~SSL3_STATE() {}
 
@@ -77,12 +78,12 @@ bool tls_new(SSL *ssl) {
 }
 
 void tls_free(SSL *ssl) {
-  if (ssl->s3 == NULL) {
+  if (ssl->s3 == nullptr) {
     return;
   }
 
   Delete(ssl->s3);
-  ssl->s3 = NULL;
+  ssl->s3 = nullptr;
 }
 
 BSSL_NAMESPACE_END

data/third_party/boringssl-with-bazel/ssl/s3_pkt.cc

@@ -49,10 +49,10 @@ int tls_write_app_data(SSL *ssl, bool *out_needs_handshake,
 
   size_t total_bytes_written = ssl->s3->unreported_bytes_written;
   if (in.size() < total_bytes_written) {
-    // This can happen if the caller disables |SSL_MODE_ENABLE_PARTIAL_WRITE|,
+    // This can happen if the caller disables `SSL_MODE_ENABLE_PARTIAL_WRITE`,
     // asks us to write some input of length N, we successfully encrypt M bytes
     // and write it, but fail to write the rest. We will report
-    // |SSL_ERROR_WANT_WRITE|. If the caller then retries with fewer than M
+    // `SSL_ERROR_WANT_WRITE`. If the caller then retries with fewer than M
     // bytes, we cannot satisfy that request. The caller is required to always
     // retry with at least as many bytes as the previous attempt.
     OPENSSL_PUT_ERROR(SSL, SSL_R_BAD_LENGTH);
@@ -87,7 +87,7 @@ int tls_write_app_data(SSL *ssl, bool *out_needs_handshake,
       return ret;
     }
 
-    // Note |bytes_written| may be less than |to_write| if there was a pending
+    // Note `bytes_written` may be less than `to_write` if there was a pending
     // record from a smaller write attempt.
     assert(bytes_written <= to_write);
     total_bytes_written += bytes_written;
@@ -105,7 +105,7 @@ int tls_write_app_data(SSL *ssl, bool *out_needs_handshake,
 }
 
 // tls_seal_align_prefix_len returns the length of the prefix before the start
-// of the bulk of the ciphertext when sealing a record with |ssl|. Callers may
+// of the bulk of the ciphertext when sealing a record with `ssl`. Callers may
 // use this to align buffers.
 //
 // Note when TLS 1.0 CBC record-splitting is enabled, this includes the one byte
@@ -125,8 +125,8 @@ static size_t tls_seal_align_prefix_len(const SSL *ssl) {
 }
 
 // do_tls_write writes an SSL record of the given type. On success, it sets
-// |*out_bytes_written| to number of bytes successfully written and returns one.
-// On error, it returns a value <= 0 from the underlying |BIO|.
+// `*out_bytes_written` to number of bytes successfully written and returns one.
+// On error, it returns a value <= 0 from the underlying `BIO`.
 static int do_tls_write(SSL *ssl, size_t *out_bytes_written, uint8_t type,
                         Span<const uint8_t> in) {
   // If there is a pending write, the retry must be consistent.
@@ -140,7 +140,7 @@ static int do_tls_write(SSL *ssl, size_t *out_bytes_written, uint8_t type,
   }
 
   // Flush any unwritten data to the transport. There may be data to flush even
-  // if |wpend_tot| is zero.
+  // if `wpend_tot` is zero.
   int ret = ssl_write_buffer_flush(ssl);
   if (ret <= 0) {
     return ret;
@@ -163,7 +163,7 @@ static int do_tls_write(SSL *ssl, size_t *out_bytes_written, uint8_t type,
     return -1;
   }
 
-  // We may have unflushed handshake data that must be written before |in|. This
+  // We may have unflushed handshake data that must be written before `in`. This
   // may be a KeyUpdate acknowledgment, 0-RTT key change messages, or a
   // NewSessionTicket.
   Span<const uint8_t> pending_flight;
@@ -196,7 +196,7 @@ static int do_tls_write(SSL *ssl, size_t *out_bytes_written, uint8_t type,
     return -1;
   }
 
-  // Copy |pending_flight| to the output.
+  // Copy `pending_flight` to the output.
   if (!pending_flight.empty()) {
     OPENSSL_memcpy(buf->remaining().data(), pending_flight.data(),
                    pending_flight.size());
@@ -250,8 +250,8 @@ ssl_open_record_t tls_open_app_data(SSL *ssl, Span<uint8_t> *out,
 
   if (type == SSL3_RT_HANDSHAKE) {
     // Post-handshake data prior to TLS 1.3 is always renegotiation, which we
-    // never accept as a server. Otherwise |tls_get_message| will send
-    // |SSL_R_EXCESSIVE_MESSAGE_SIZE|.
+    // never accept as a server. Otherwise `tls_get_message` will send
+    // `SSL_R_EXCESSIVE_MESSAGE_SIZE`.
     if (ssl->server && ssl_protocol_version(ssl) < TLS1_3_VERSION) {
       OPENSSL_PUT_ERROR(SSL, SSL_R_NO_RENEGOTIATION);
       *out_alert = SSL_AD_NO_RENEGOTIATION;
@@ -318,7 +318,7 @@ ssl_open_record_t tls_open_change_cipher_spec(SSL *ssl, size_t *out_consumed,
 void ssl_send_alert(SSL *ssl, int level, int desc) {
   // This function is called in response to a fatal error from the peer. Ignore
   // any failures writing the alert and report only the original error. In
-  // particular, if the transport uses |SSL_write|, our existing error will be
+  // particular, if the transport uses `SSL_write`, our existing error will be
   // clobbered so we must save and restore the error queue. See
   // https://crbug.com/959305.
   //

data/third_party/boringssl-with-bazel/ssl/ssl_aead_ctx.cc

@@ -93,8 +93,8 @@ UniquePtr<SSLAEADContext> SSLAEADContext::Create(
       aead_ctx->ad_is_header_ = true;
     }
   } else {
-    // This is a CBC cipher suite that implements the |EVP_AEAD| interface. The
-    // |EVP_AEAD| takes the MAC key, encryption key, and fixed IV concatenated
+    // This is a CBC cipher suite that implements the `EVP_AEAD` interface. The
+    // `EVP_AEAD` takes the MAC key, encryption key, and fixed IV concatenated
     // as its input key.
     assert(protocol_version < TLS1_3_VERSION);
     BSSL_CHECK(mac_key.size() + enc_key.size() + fixed_iv.size() <=
@@ -106,7 +106,7 @@ UniquePtr<SSLAEADContext> SSLAEADContext::Create(
     enc_key =
         Span(merged_key, enc_key.size() + mac_key.size() + fixed_iv.size());
 
-    // The |EVP_AEAD|'s per-encryption nonce, if any, is actually the CBC IV. It
+    // The `EVP_AEAD`'s per-encryption nonce, if any, is actually the CBC IV. It
     // must be generated randomly and prepended to the record.
     aead_ctx->variable_nonce_included_in_record_ = true;
     aead_ctx->random_variable_nonce_ = true;
@@ -176,7 +176,7 @@ size_t SSLAEADContext::MaxSealInputLen(size_t max_out) const {
   if (is_null_cipher() || CRYPTO_fuzzer_mode_enabled()) {
     return max_out;
   }
-  // TODO(crbug.com/42290602): This should be part of |EVP_AEAD_CTX|.
+  // TODO(crbug.com/42290602): This should be part of `EVP_AEAD_CTX`.
   size_t overhead = EVP_AEAD_max_overhead(EVP_AEAD_CTX_aead(ctx_.get()));
   if (SSL_CIPHER_is_block_cipher(cipher())) {
     size_t block_size;
@@ -401,7 +401,7 @@ bool SSLAEADContext::Seal(uint8_t *out, size_t *out_len, size_t max_out_len,
   }
 
   if (!SealScatter(out, out + prefix_len, out + prefix_len + in_len, type,
-                   record_version, seqnum, header, in, in_len, 0, 0)) {
+                   record_version, seqnum, header, in, in_len, nullptr, 0)) {
     return false;
   }
   *out_len = prefix_len + in_len + suffix_len;

data/third_party/boringssl-with-bazel/ssl/ssl_asn1.cc

@@ -15,16 +15,22 @@
 
 #include <openssl/ssl.h>
 
+#include <assert.h>
 #include <limits.h>
 #include <string.h>
 
+#include <algorithm>
+#include <iterator>
 #include <utility>
 
 #include <openssl/bytestring.h>
 #include <openssl/err.h>
+#include <openssl/evp.h>
 #include <openssl/mem.h>
+#include <openssl/span.h>
 #include <openssl/x509.h>
 
+#include "../crypto/bytestring/internal.h"
 #include "../crypto/internal.h"
 #include "internal.h"
 
@@ -69,6 +75,8 @@ BSSL_NAMESPACE_BEGIN
 //     -- Either both or none of localALPS and peerALPS must be present. If both
 //     -- are present, earlyALPN must be present and non-empty.
 //     resumableAcrossNames    [31] BOOLEAN OPTIONAL,
+//     peerCertType            [32] INTEGER DEFAULT 0,  -- defaults to X509(0)
+//     peerRawPublicKey        [33] SubjectPublicKeyInfo OPTIONAL,
 // }
 //
 // Note: historically this serialization has included other optional
@@ -138,11 +146,15 @@ static const CBS_ASN1_TAG kPeerALPSTag =
     CBS_ASN1_CONSTRUCTED | CBS_ASN1_CONTEXT_SPECIFIC | 30;
 static const CBS_ASN1_TAG kResumableAcrossNamesTag =
     CBS_ASN1_CONSTRUCTED | CBS_ASN1_CONTEXT_SPECIFIC | 31;
+static const CBS_ASN1_TAG kPeerCertTypeTag =
+    CBS_ASN1_CONSTRUCTED | CBS_ASN1_CONTEXT_SPECIFIC | 32;
+static const CBS_ASN1_TAG kPeerRawPublicKeyTag =
+    CBS_ASN1_CONSTRUCTED | CBS_ASN1_CONTEXT_SPECIFIC | 33;
 
 
 static int SSL_SESSION_to_bytes_full(const SSL_SESSION *in, CBB *cbb,
                                      int for_ticket) {
-  if (in == NULL || in->cipher == NULL) {
+  if (in == nullptr || in->cipher == nullptr) {
     return 0;
   }
 
@@ -151,7 +163,7 @@ static int SSL_SESSION_to_bytes_full(const SSL_SESSION *in, CBB *cbb,
       !CBB_add_asn1_uint64(&session, kVersion) ||
       !CBB_add_asn1_uint64(&session, in->ssl_version) ||
       !CBB_add_asn1(&session, &child, CBS_ASN1_OCTETSTRING) ||
-      !CBB_add_u16(&child, (uint16_t)(in->cipher->id & 0xffff)) ||
+      !CBB_add_u16(&child, in->cipher->protocol_id) ||
       // The session ID is irrelevant for a session ticket.
       !CBB_add_asn1_octet_string(&session, in->session_id.data(),
                                  for_ticket ? 0 : in->session_id.size()) ||
@@ -167,10 +179,10 @@ static int SSL_SESSION_to_bytes_full(const SSL_SESSION *in, CBB *cbb,
   // The peer certificate is only serialized if the SHA-256 isn't
   // serialized instead.
   if (sk_CRYPTO_BUFFER_num(in->certs.get()) > 0 && !in->peer_sha256_valid) {
+    assert(in->peer_cert_type == TLSEXT_cert_type_x509);
     const CRYPTO_BUFFER *buffer = sk_CRYPTO_BUFFER_value(in->certs.get(), 0);
-    if (!CBB_add_asn1(&session, &child, kPeerTag) ||
-        !CBB_add_bytes(&child, CRYPTO_BUFFER_data(buffer),
-                       CRYPTO_BUFFER_len(buffer))) {
+    if (!CBB_add_asn1_element(&session, kPeerTag, CRYPTO_BUFFER_data(buffer),
+                              CRYPTO_BUFFER_len(buffer))) {
       return 0;
     }
   }
@@ -263,9 +275,10 @@ static int SSL_SESSION_to_bytes_full(const SSL_SESSION *in, CBB *cbb,
 
   // The certificate chain is only serialized if the leaf's SHA-256 isn't
   // serialized instead.
-  if (in->certs != NULL &&       //
+  if (in->certs != nullptr &&    //
       !in->peer_sha256_valid &&  //
       sk_CRYPTO_BUFFER_num(in->certs.get()) >= 2) {
+    assert(in->peer_cert_type == TLSEXT_cert_type_x509);
     if (!CBB_add_asn1(&session, &child, kCertChainTag)) {
       return 0;
     }
@@ -353,12 +366,41 @@ static int SSL_SESSION_to_bytes_full(const SSL_SESSION *in, CBB *cbb,
     }
   }
 
+  if (in->peer_cert_type != kDefaultCertType) {
+    if (!CBB_add_asn1(&session, &child, kPeerCertTypeTag) ||
+        !CBB_add_asn1_uint64(&child, in->peer_cert_type)) {
+      return 0;
+    }
+  }
+  // The peer RPK is only serialized if the SHA-256 isn't serialized instead.
+  if (in->peer_raw_public_key != nullptr && !in->peer_sha256_valid) {
+    assert(in->peer_cert_type == TLSEXT_cert_type_rpk);
+    if (!CBB_add_asn1(&session, &child, kPeerRawPublicKeyTag) ||
+        !EVP_marshal_public_key(&child, in->peer_raw_public_key.get())) {
+      return 0;
+    }
+  }
+
   return CBB_flush(cbb);
 }
 
+static int SSL_SESSION_to_bytes_if_not_resumable(const SSL_SESSION *in,
+                                                 CBB *out, int for_ticket) {
+  if (in->not_resumable) {
+    // If the caller has an unresumable session, e.g. if `SSL_get_session`
+    // were called on a TLS 1.3 or False Started connection, serialize with
+    // a placeholder value so it is not accidentally deserialized into a
+    // resumable one.
+    const auto kNotResumableSession = StringAsBytes("NOT RESUMABLE");
+    return CBB_add_bytes(out, kNotResumableSession.data(),
+                         kNotResumableSession.size());
+  }
+  return SSL_SESSION_to_bytes_full(in, out, for_ticket);
+}
+
 // SSL_SESSION_parse_string gets an optional ASN.1 OCTET STRING explicitly
-// tagged with |tag| from |cbs| and saves it in |*out|. If the element was not
-// found, it sets |*out| to NULL. It returns one on success, whether or not the
+// tagged with `tag` from `cbs` and saves it in `*out`. If the element was not
+// found, it sets `*out` to NULL. It returns one on success, whether or not the
 // element was found, and zero on decode error.
 static int SSL_SESSION_parse_string(CBS *cbs, UniquePtr<char> *out,
                                     CBS_ASN1_TAG tag) {
@@ -385,12 +427,12 @@ static int SSL_SESSION_parse_string(CBS *cbs, UniquePtr<char> *out,
 }
 
 // SSL_SESSION_parse_octet_string gets an optional ASN.1 OCTET STRING explicitly
-// tagged with |tag| from |cbs| and stows it in |*out|. It returns one on
+// tagged with `tag` from `cbs` and stows it in `*out`. It returns one on
 // success, whether or not the element was found, and zero on decode error.
 static bool SSL_SESSION_parse_octet_string(CBS *cbs, Array<uint8_t> *out,
                                            CBS_ASN1_TAG tag) {
   CBS value;
-  if (!CBS_get_optional_asn1_octet_string(cbs, &value, NULL, tag)) {
+  if (!CBS_get_optional_asn1_octet_string(cbs, &value, nullptr, tag)) {
     OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_SSL_SESSION);
     return false;
   }
@@ -476,7 +518,7 @@ UniquePtr<SSL_SESSION> SSL_SESSION_parse(CBS *cbs,
       // Require sessions have versions valid in either TLS or DTLS. The session
       // will not be used by the handshake if not applicable, but, for
       // simplicity, never parse a session that does not pass
-      // |ssl_protocol_version_from_wire|.
+      // `ssl_protocol_version_from_wire`.
       ssl_version > UINT16_MAX ||  //
       !ssl_protocol_version_from_wire(&unused, ssl_version)) {
     OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_SSL_SESSION);
@@ -493,7 +535,7 @@ UniquePtr<SSL_SESSION> SSL_SESSION_parse(CBS *cbs,
     return nullptr;
   }
   ret->cipher = SSL_get_cipher_by_value(cipher_value);
-  if (ret->cipher == NULL) {
+  if (ret->cipher == nullptr) {
     OPENSSL_PUT_ERROR(SSL, SSL_R_UNSUPPORTED_CIPHER);
     return nullptr;
   }
@@ -522,7 +564,7 @@ UniquePtr<SSL_SESSION> SSL_SESSION_parse(CBS *cbs,
     OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_SSL_SESSION);
     return nullptr;
   }
-  // |peer| is processed with the certificate chain.
+  // `peer` is processed with the certificate chain.
 
   CBS sid_ctx;
   if (!CBS_get_optional_asn1_octet_string(
@@ -593,7 +635,7 @@ UniquePtr<SSL_SESSION> SSL_SESSION_parse(CBS *cbs,
   }
 
   CBS cert_chain;
-  CBS_init(&cert_chain, NULL, 0);
+  CBS_init(&cert_chain, nullptr, 0);
   int has_cert_chain;
   if (!CBS_get_optional_asn1(&session, &cert_chain, &has_cert_chain,
                              kCertChainTag) ||
@@ -621,7 +663,7 @@ UniquePtr<SSL_SESSION> SSL_SESSION_parse(CBS *cbs,
 
     while (CBS_len(&cert_chain) > 0) {
       CBS cert;
-      if (!CBS_get_any_asn1_element(&cert_chain, &cert, NULL, NULL) ||
+      if (!CBS_get_any_asn1_element(&cert_chain, &cert, nullptr, nullptr) ||
           CBS_len(&cert) == 0) {
         OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_SSL_SESSION);
         return nullptr;
@@ -652,7 +694,7 @@ UniquePtr<SSL_SESSION> SSL_SESSION_parse(CBS *cbs,
     OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_SSL_SESSION);
     return nullptr;
   }
-  /* TODO: in time we can include |is_server| for servers too, then we can
+  /* TODO: in time we can include `is_server` for servers too, then we can
      enforce that client and server sessions are never mixed up. */
 
   ret->is_server = is_server;
@@ -684,14 +726,58 @@ UniquePtr<SSL_SESSION> SSL_SESSION_parse(CBS *cbs,
       !ret->peer_application_settings.CopyFrom(settings) ||
       !CBS_get_optional_asn1_bool(&session, &is_resumable_across_names,
                                   kResumableAcrossNamesTag,
-                                  /*default_value=*/false) ||
-      CBS_len(&session) != 0) {
+                                  /*default_value=*/false)) {
     OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_SSL_SESSION);
     return nullptr;
   }
   ret->is_quic = is_quic;
   ret->is_resumable_across_names = is_resumable_across_names;
 
+  if (CBS_peek_asn1_tag(&session, kPeerCertTypeTag)) {
+    uint64_t peer_cert_type_value;
+    if (!CBS_get_optional_asn1_uint64(&session, &peer_cert_type_value,
+                                      kPeerCertTypeTag, kDefaultCertType)) {
+      OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_SSL_SESSION);
+      return nullptr;
+    }
+    // The default value was erroneously serialized, or an unknown value was
+    // present.
+    if (peer_cert_type_value == kDefaultCertType ||
+        std::find(std::begin(kAllCertTypes), std::end(kAllCertTypes),
+                  peer_cert_type_value) == std::end(kAllCertTypes)) {
+      OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_SSL_SESSION);
+      return nullptr;
+    }
+    ret->peer_cert_type = static_cast<uint8_t>(peer_cert_type_value);
+    int has_peer_rpk;
+    if (!CBS_get_optional_asn1(&session, &child, &has_peer_rpk,
+                               kPeerRawPublicKeyTag)) {
+      OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_SSL_SESSION);
+      return nullptr;
+    }
+    if (has_peer_rpk) {
+      ret->peer_raw_public_key = ssl_parse_peer_subject_public_key_info(child);
+      if (ret->peer_raw_public_key == nullptr ||
+          ret->peer_cert_type != TLSEXT_cert_type_rpk ||  //
+          has_peer || has_cert_chain) {
+        OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_SSL_SESSION);
+        return nullptr;
+      }
+    }
+  }
+
+  // End of fields. There should be no trailing data.
+  if (CBS_len(&session) != 0) {
+    OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_SSL_SESSION);
+    return nullptr;
+  }
+
+  if (ret->peer_cert_type != TLSEXT_cert_type_x509 &&
+      (has_peer || has_cert_chain)) {
+    OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_SSL_SESSION);
+    return nullptr;
+  }
+
   // The two ALPS values and ALPN must be consistent.
   if (has_local_alps != has_peer_alps ||
       (has_local_alps && ret->early_alpn.empty())) {
@@ -718,29 +804,12 @@ using namespace bssl;
 
 int SSL_SESSION_to_bytes(const SSL_SESSION *in, uint8_t **out_data,
                          size_t *out_len) {
-  if (in->not_resumable) {
-    // If the caller has an unresumable session, e.g. if |SSL_get_session| were
-    // called on a TLS 1.3 or False Started connection, serialize with a
-    // placeholder value so it is not accidentally deserialized into a resumable
-    // one.
-    static const char kNotResumableSession[] = "NOT RESUMABLE";
-
-    *out_len = strlen(kNotResumableSession);
-    *out_data = (uint8_t *)OPENSSL_memdup(kNotResumableSession, *out_len);
-    if (*out_data == NULL) {
-      return 0;
-    }
-
-    return 1;
-  }
-
   ScopedCBB cbb;
   if (!CBB_init(cbb.get(), 256) ||
-      !SSL_SESSION_to_bytes_full(in, cbb.get(), 0) ||
+      !SSL_SESSION_to_bytes_if_not_resumable(in, cbb.get(), 0) ||
       !CBB_finish(cbb.get(), out_data, out_len)) {
     return 0;
   }
-
   return 1;
 }
 
@@ -752,45 +821,31 @@ int SSL_SESSION_to_bytes_for_ticket(const SSL_SESSION *in, uint8_t **out_data,
       !CBB_finish(cbb.get(), out_data, out_len)) {
     return 0;
   }
-
   return 1;
 }
 
 int i2d_SSL_SESSION(SSL_SESSION *in, uint8_t **pp) {
-  uint8_t *out;
-  size_t len;
-
-  if (!SSL_SESSION_to_bytes(in, &out, &len)) {
-    return -1;
-  }
-
-  if (len > INT_MAX) {
-    OPENSSL_free(out);
-    OPENSSL_PUT_ERROR(SSL, ERR_R_OVERFLOW);
-    return -1;
-  }
-
-  if (pp) {
-    OPENSSL_memcpy(*pp, out, len);
-    *pp += len;
+  ScopedCBB cbb;
+  if (!CBB_init(cbb.get(), 256) ||
+      !SSL_SESSION_to_bytes_if_not_resumable(in, cbb.get(), 0)) {
+    return 0;
   }
-  OPENSSL_free(out);
-
-  return len;
+  return CBB_finish_i2d(cbb.get(), pp);
 }
 
 SSL_SESSION *SSL_SESSION_from_bytes(const uint8_t *in, size_t in_len,
                                     const SSL_CTX *ctx) {
+  auto *ctx_impl = FromOpaque(ctx);
   CBS cbs;
   CBS_init(&cbs, in, in_len);
   UniquePtr<SSL_SESSION> ret =
-      SSL_SESSION_parse(&cbs, ctx->x509_method, ctx->pool);
+      SSL_SESSION_parse(&cbs, ctx_impl->x509_method, ctx_impl->pool.get());
   if (!ret) {
-    return NULL;
+    return nullptr;
   }
   if (CBS_len(&cbs) != 0) {
     OPENSSL_PUT_ERROR(SSL, SSL_R_INVALID_SSL_SESSION);
-    return NULL;
+    return nullptr;
   }
   return ret.release();
 }