@amritk/nish-x86_64-linux 0.17.0 → 0.20.0

package/std/net/tls/record-server.ts

@@ -32,26 +32,42 @@
  * are refused. A stream that ends without `close_notify` is truncation, but
  * only once the records still waiting for the caller have been read.
  *
- * **Fixed buffers.** The record being read, the bytes to send and the
- * application data waiting for the caller each live in an array allocated
- * once, in the constructor, so a connection that has finished its handshake
- * allocates nothing that outlives a record, and a slot can be handed the
- * next connection with `start`. The handshake's messages are sealed straight
- * out of `TlsServer`'s own buffers, and the application secrets are copied
- * into arrays of this slot's, so a slot that hands its `TlsServer` the next
- * connection with `restart` runs every handshake after the first without
- * moving the arena, whichever suite it negotiates; a KeyUpdate's key
- * install leaves nothing either (TLS-3 in `docs/security/tls.md`). When the caller leaves application data unread
+ * **Borrowed buffers.** The record being read, the record being opened, the
+ * bytes to send and the application data waiting for the caller each live in
+ * an array borrowed from a `TlsRecordPools` when the connection first needs
+ * it, kept while the connection lasts, and given back zeroed with
+ * `BufferPool.giveSecret` when it ends (`start`, `wipe`, `release`), so a
+ * slot with no connection holds none of them, a connection that has finished
+ * its handshake allocates nothing that outlives a record, and a slot can be
+ * handed the next connection with `start`. Each give-back zeroes the whole
+ * buffer, so it happens once a connection rather than once a record. The handshake's messages are
+ * sealed straight out of `TlsServer`'s own buffers, and the application
+ * secrets are copied into this slot's fields, so a slot that hands its
+ * `TlsServer` the next connection with `restart` runs every handshake after
+ * the first without moving the arena, whichever suite it negotiates; a
+ * KeyUpdate's key install leaves nothing either (TLS-3 in
+ * `docs/security/tls.md`). When the caller leaves application data unread
  * for long enough to fill its buffer, records stay in the reader and
  * `interest` stops asking for reads, which is how the peer is made to wait.
  *
- * **Secrets.** Each traffic secret is copied out of `TlsServer` as it is
- * installed and the server's copy is wiped with `secureZero`, as are the
- * handshake secret once the flight is signed and the caller's ephemeral key
- * once the ServerHello is written, or the handshake fails. The two application traffic secrets live
- * on here, for KeyUpdate: each is overwritten in place by the next, and both
- * are wiped, with both directions' keys, by `wipeKeys` when the carrier
- * closes the slot and by `start`. What stays unwiped is TLS-1's and TLS-2's.
+ * **Secrets.** Each traffic secret is a `Secret<u8[]>` (`nish:secret`):
+ * `TlsServer` holds the handshake's in its `TlsSecretPool`s, and this slot
+ * holds the two application traffic secrets in four readonly fields, one per
+ * direction and hash length, with `readHash` and `writeHash` saying which of
+ * each pair is live (0 when neither is). A secret is copied out of
+ * `TlsServer` as it is installed and the server's copy is zeroed, as are the
+ * handshake secret once the flight is signed and the ephemeral key once the
+ * ServerHello is written, or the handshake fails; a KeyUpdate overwrites the
+ * live field in place with the next secret. Every way the connection ends
+ * wipes what it holds: a failure of any kind (`fail`, the client's error
+ * alert, a truncated stream, `abort`) wipes both directions' keys, both
+ * secrets and everything `TlsServer` still holds once the last alert is
+ * sealed; the server's `close_notify`, once sealed, wipes the write
+ * direction, the client's the read direction, and `close` the resumption
+ * master secret; and `wipe` (which `wipeKeys` calls when the carrier closes
+ * the slot) and `start` wipe the rest. No secret leaves either object but
+ * through `expose`, so a secret cannot be logged or kept outside
+ * this module and `nish/net/tls` (TLS-1 in `docs/security/tls.md`).
  *
  * Refusals are alerts, never panics. Written from RFC 8446 §4.6.3, §5, §6
  * and §D.4, not ported from another implementation.
@@ -65,8 +81,20 @@ import {
   TLS_STATE_WAIT_CLIENT_HELLO,
   TLS_STATE_WAIT_FINISHED,
   TLS_STATE_WAIT_SIGNATURE,
+  TLS_STATE_WAIT_TICKET,
+  TLS_SECRET_CLIENT_APPLICATION,
+  TLS_SECRET_CLIENT_HANDSHAKE,
+  TLS_SECRET_HANDSHAKE,
+  TLS_SECRET_SERVER_APPLICATION,
+  TLS_SECRET_SERVER_HANDSHAKE,
   TlsServer,
+  TlsSecretPool,
+  tlsHeldClone,
+  tlsHeldCopyIn,
+  tlsHeldCopyOver,
 } from "nish/net/tls"
+import { TlsTicketKeyInfo, TlsTicketStrikes } from "nish/net/tls/ticket"
+import { Secret, expose, exposeWith, secret, wipe } from "nish:secret"
 import { SHA256_SIZE } from "nish/crypto/sha256"
 import { SHA384_SIZE } from "nish/crypto/sha512"
 import {
@@ -93,6 +121,7 @@ import {
   TlsRecordReader,
   tlsRecordWindowFits,
 } from "nish/net/tls/record"
+import { BufferPool } from "nish/net/buffer-pool"
 
 // ---- States ----------------------------------------------------------------------
 
@@ -117,6 +146,12 @@ export const TLS_RECORD_DATA: i32 = 4
 export const TLS_RECORD_SIGN: i32 = 8
 /** Nothing more will happen: the connection failed or closed, and everything to send is sent. */
 export const TLS_RECORD_DONE: i32 = 16
+/**
+ * A ticket is the carrier's to handle, with the keys and strike register it
+ * lends: during the handshake the ClientHello offers one, so `resume` reads
+ * it; once the connection is open the client may be issued one, so `issue`.
+ */
+export const TLS_RECORD_TICKET: i32 = 32
 
 /** What `read` and `write` answer once the connection has failed: Linux's ECONNRESET, as `nish:net` spells it. */
 export const TLS_RECORD_RESET: i32 = -104
@@ -133,6 +168,41 @@ const TLS_RECORD_OUTPUT_SIZE: i32 = 2 * TLS_MAX_RECORD
 const TLS_RECORD_PLAIN_SIZE: i32 = 2 * TLS_MAX_PLAINTEXT
 /** Where a record's content is opened to before it is handed on: the most content a record carries. */
 const TLS_RECORD_SCRATCH_SIZE: i32 = TLS_MAX_PLAINTEXT
+/**
+ * The four pools a connection's record buffers are borrowed from: `output`,
+ * `plain` and `scratch` for `TlsRecordServer`'s fields of those names, and
+ * `reader` for its `TlsRecordReader`. A carrier with many slots makes one set
+ * with a ceiling of its slot count and points every slot at it with
+ * `TlsRecordServer.borrowFrom`, so a full server holds what preallocating
+ * every slot would have held and an idle one holds only what earlier
+ * connections left on the free lists. Each buffer goes back zeroed
+ * (`BufferPool.giveSecret`): it held plaintext, or handshake bytes.
+ */
+export class TlsRecordPools {
+  output: BufferPool
+  plain: BufferPool
+  scratch: BufferPool
+  reader: BufferPool
+
+  /** Four empty pools of `ceiling` buffers each; nothing is made until a slot needs it. */
+  constructor(ceiling: i32) {
+    this.output = new BufferPool("TlsRecordServer.output", TLS_RECORD_OUTPUT_SIZE, ceiling)
+    this.plain = new BufferPool("TlsRecordServer.plain", TLS_RECORD_PLAIN_SIZE, ceiling)
+    this.scratch = new BufferPool("TlsRecordServer.scratch", TLS_RECORD_SCRATCH_SIZE, ceiling)
+    this.reader = new BufferPool("TlsRecordReader.buffer", TLS_MAX_RECORD, ceiling)
+  }
+
+  /** How many buffers of the four pools are lent now: 0 once every connection has given its back. */
+  lent(): i32 {
+    return this.output.lent() + this.plain.lent() + this.scratch.lent() + this.reader.lent()
+  }
+
+  /** How many buffers the four pools have made: their high-water mark together. */
+  made(): i32 {
+    return this.output.made + this.plain.made + this.scratch.made + this.reader.made
+  }
+}
+
 /** A KeyUpdate message: type, a 24-bit length of 1, and `request_update`. */
 const TLS_KEY_UPDATE_SIZE: i32 = 5
 /** Where ServerHello and HelloRetryRequest hold `legacy_session_id_echo`'s length: past the header, version and random. */
@@ -164,22 +234,42 @@ export const TLS_RECORD_MAX_KEY_UPDATES: i32 = 64
 /** A typed zero for the offsets below: a bare literal is an `f64` under `--number-mode f64`. */
 const TLS_RECORD_SERVER_FROM: i32 = 0
 
+/** Zeroes the bytes a traffic secret field holds, for `exposeWith`; answers 0. */
+const tlsTrafficZero = (held: u8[], answer: i32): i32 => {
+  wipe(held)
+  return answer
+}
+
 /**
- * Copies a traffic secret out of `TlsServer` into `long` when it is that
- * array's length and into `short` otherwise, so the server's own can be wiped
- * while this one lives on, and answers the array; `none` when there is no
- * secret.
+ * Installs `protection` under `suite` from the traffic secret `held`. The
+ * keys are derived from a plain copy that dies with the arena block and is
+ * zeroed before it ends; false, as `install` answers, when they do not
+ * install. Not `TlsRecordProtection.installHeld`: the `*Held` derivations
+ * under it cannot open an arena block (`nish/crypto/hkdf`), so each install
+ * would leave its HKDF temporaries in the arena, and a slot that restarts a
+ * thousand times must leave `Arena.mark()` where it was.
  */
-const tlsKeepSecret = (secret: u8[] | null, short: u8[], long: u8[], none: u8[]): u8[] => {
-  if (secret === null) {
-    return none
-  }
-  const length: i32 = toI32(secret.length)
-  const out: u8[] = length === toI32(long.length) ? long : short
-  for (let k: i32 = 0; k < toI32(out.length) && k < length; k++) {
-    out[k] = secret[k]
-  }
-  return out
+const tlsInstallHeld = (protection: TlsRecordProtection, suite: i32, held: Secret<u8[]>): boolean => {
+  using _scope = arena()
+  const plain: u8[] = expose(held, tlsHeldClone)
+  const installed: boolean = protection.install(suite, plain)
+  secureZero(plain)
+  return installed
+}
+
+/**
+ * Moves `protection` to the next traffic secret (§7.2) and writes it over
+ * `held`'s bytes in place, the KeyUpdate step: the plain copy it is derived
+ * on dies with the arena block, zeroed. False, as `advance` answers, when
+ * the keys do not install.
+ */
+const tlsAdvanceHeld = (protection: TlsRecordProtection, held: Secret<u8[]>): boolean => {
+  using _scope = arena()
+  const plain: u8[] = expose(held, tlsHeldClone)
+  const installed: boolean = protection.advance(plain)
+  exposeWith(held, plain, tlsHeldCopyIn)
+  secureZero(plain)
+  return installed
 }
 
 /**
@@ -200,20 +290,27 @@ export class TlsRecordServer {
   reader: TlsRecordReader
   readProtection: TlsRecordProtection
   writeProtection: TlsRecordProtection
-  /** Bytes to send are `output[outputStart .. outputEnd)`. */
+  /** Bytes to send are `output[outputStart .. outputEnd)`; `empty` until a record is sealed. */
   output: u8[]
-  /** Application data the caller has not read is `plain[plainStart .. plainEnd)`. */
+  /** Application data the caller has not read is `plain[plainStart .. plainEnd)`; `empty` until a record brings some. */
   plain: u8[]
+  /** Where a record is opened to; `empty` until the first protected record. */
   scratch: u8[]
-  /** The client's and the server's current application traffic secrets, for KeyUpdate. */
-  readSecret: u8[]
-  writeSecret: u8[]
-  /** The arrays those two point into, one of each hash's length, and the empty one they point at before. */
-  readSecret256: u8[]
-  readSecret384: u8[]
-  writeSecret256: u8[]
-  writeSecret384: u8[]
-  none: u8[]
+  /** The zero-length array a buffer field is while it holds no borrowed buffer. */
+  empty: u8[]
+  /** Where `output`, `plain`, `scratch` and the reader's buffer are borrowed from. */
+  pools: TlsRecordPools
+  /**
+   * The client's and the server's current application traffic secrets, for
+   * KeyUpdate, each held at both hash lengths: `readHash` and `writeHash`
+   * say which of a pair holds the secret, and are 0 before it is known.
+   */
+  readonly readTraffic256: Secret<u8[]>
+  readonly readTraffic384: Secret<u8[]>
+  readonly writeTraffic256: Secret<u8[]>
+  readonly writeTraffic384: Secret<u8[]>
+  readHash: i32 = 0
+  writeHash: i32 = 0
   /** A post-handshake message the client has sent part of. */
   postHandshake: u8[]
   state: i32 = 0
@@ -226,19 +323,25 @@ export class TlsRecordServer {
   writeLevel: i32 = 0
   outputStart: i32 = 0
   outputEnd: i32 = 0
+  /** How far into `output` this borrowing has written, which says whether its give-back zeroes. */
+  outputUsed: i32 = 0
   plainStart: i32 = 0
   plainEnd: i32 = 0
+  /** How far into `plain` this borrowing has written. */
+  plainUsed: i32 = 0
   /** How much of `TlsServer`'s Initial-level output is already in records. */
   pendingInitialAt: i32 = 0
   /** How much of `TlsServer`'s Handshake-level output is already in records. */
   pendingHandshakeAt: i32 = 0
-  /** The server's flight is signed and finished, so its Handshake-level output may be sealed. */
-  flightReady: boolean = false
+  /** How much of `TlsServer`'s Application-level output, a NewSessionTicket, is already in records. */
+  pendingApplicationAt: i32 = 0
   postHandshakeLength: i32 = 0
   /** Records in a row that carried nothing for the caller, against `TLS_RECORD_IDLE_LIMIT`. */
   idleRecords: i32 = 0
   /** KeyUpdates taken from the client, against `TLS_RECORD_MAX_KEY_UPDATES`. */
   keyUpdates: i32 = 0
+  /** The server's flight is signed and finished, so its Handshake-level output may be sealed. */
+  flightReady: boolean = false
   peerClosed: boolean = false
   /** The client's TCP stream ended. Without a `close_notify` before it, that is truncation and the connection failed. */
   ended: boolean = false
@@ -258,16 +361,17 @@ export class TlsRecordServer {
     this.reader = new TlsRecordReader()
     this.readProtection = new TlsRecordProtection()
     this.writeProtection = new TlsRecordProtection()
-    this.output = new Array<u8>(TLS_RECORD_OUTPUT_SIZE)
-    this.plain = new Array<u8>(TLS_RECORD_PLAIN_SIZE)
-    this.scratch = new Array<u8>(TLS_RECORD_SCRATCH_SIZE)
-    this.none = []
-    this.readSecret256 = new Array<u8>(SHA256_SIZE)
-    this.readSecret384 = new Array<u8>(SHA384_SIZE)
-    this.writeSecret256 = new Array<u8>(SHA256_SIZE)
-    this.writeSecret384 = new Array<u8>(SHA384_SIZE)
-    this.readSecret = this.none
-    this.writeSecret = this.none
+    this.empty = []
+    this.output = this.empty
+    this.plain = this.empty
+    this.scratch = this.empty
+    // A slot of its own: one buffer of each, until a carrier shares its pools.
+    this.pools = new TlsRecordPools(1)
+    this.reader.borrowFrom(this.pools.reader)
+    this.readTraffic256 = secret(new Array<u8>(SHA256_SIZE))
+    this.readTraffic384 = secret(new Array<u8>(SHA384_SIZE))
+    this.writeTraffic256 = secret(new Array<u8>(SHA256_SIZE))
+    this.writeTraffic384 = secret(new Array<u8>(SHA384_SIZE))
     this.postHandshake = new Array<u8>(TLS_KEY_UPDATE_SIZE)
     this.start(tls)
   }
@@ -275,8 +379,8 @@ export class TlsRecordServer {
   /**
    * Starts a new connection in this slot with `tls`, which should be fresh
    * or just restarted (`TlsServer.restart`, which reuses its buffers):
-   * every buffer is emptied and the keys of the last connection are wiped;
-   * the buffers are reused, and nothing is allocated. A
+   * every buffer is emptied and given back, zeroed, and the keys of the last
+   * connection are wiped; nothing is allocated. A
    * `tls` that has already failed — a configuration
    * or randomness `TlsServer` refused — fails this connection at once, with
    * its alert queued in the clear.
@@ -286,8 +390,6 @@ export class TlsRecordServer {
     // was used, when it failed or when its slot was closed, and is not
     // touched here: the array may already hold the next connection's.
     this.wipeTraffic()
-    this.readSecret = this.none
-    this.writeSecret = this.none
     this.tls = tls
     this.state = TLS_RECORD_STATE_HANDSHAKE
     this.alert = 0
@@ -298,8 +400,8 @@ export class TlsRecordServer {
     this.readLevel = TLS_LEVEL_INITIAL
     this.writeLevel = TLS_LEVEL_INITIAL
     this.dropOutput()
-    this.plainStart = 0
-    this.plainEnd = 0
+    this.dropPlain()
+    this.giveBackIdle()
     this.firstMessageSeen = false
     this.started = false
     this.postHandshakeLength = 0
@@ -310,46 +412,172 @@ export class TlsRecordServer {
     }
   }
 
+  /**
+   * Borrows the record buffers from `pools` from now on, a carrier's set its
+   * slots share. Whatever is held from the old pools is given back first,
+   * zeroed, and dropped with it, so call it on a slot with nothing in flight:
+   * the carrier does, right after the constructor.
+   */
+  borrowFrom(pools: TlsRecordPools): void {
+    this.release()
+    this.pools = pools
+    this.reader.borrowFrom(pools.reader)
+  }
+
+  /**
+   * Gives back every record buffer this slot holds, zeroed, and drops what
+   * was in them: unsent output, unread application data and a partial
+   * record. The carrier calls it when it closes the slot, after the last
+   * flush and `wipeKeys`, so a free slot holds no buffer of the pools'.
+   */
+  release(): void {
+    this.outputStart = 0
+    this.outputEnd = 0
+    this.dropPlain()
+    this.reader.reset()
+    this.giveBackIdle()
+  }
+
+  /**
+   * Gives back each record buffer that holds nothing still needed, as a
+   * connection ends: `output` once everything in it is sent, `plain` once the
+   * caller has read it all, and `scratch`. Zeroed with `giveSecret`: every one
+   * held plaintext or handshake bytes, and the next connection to borrow it
+   * reads zeros. Not called between records, since `giveSecret` zeroes the
+   * whole buffer however little of it a record used.
+   */
+  giveBackIdle(): void {
+    if (this.output.length > 0 && this.outputStart === this.outputEnd) {
+      this.pools.output.giveSecret(this.output, this.outputUsed)
+      this.output = this.empty
+      this.outputUsed = 0
+    }
+    if (this.plain.length > 0 && this.plainStart === this.plainEnd) {
+      this.pools.plain.giveSecret(this.plain, this.plainUsed)
+      this.plain = this.empty
+      this.plainUsed = 0
+    }
+    if (this.scratch.length > 0) {
+      // `open` may write as far as the record's ciphertext: zero all of it.
+      this.pools.scratch.giveSecret(this.scratch, TLS_RECORD_SCRATCH_SIZE)
+      this.scratch = this.empty
+    }
+  }
+
+  /** Forgets the application data the caller has not read. */
+  dropPlain(): void {
+    this.plainStart = 0
+    this.plainEnd = 0
+  }
+
   /**
    * Wipes every key this connection holds: the two application traffic
    * secrets it keeps for KeyUpdate, both directions' keys, and what is left
-   * in `TlsServer` (`wipeHandshake`). The carrier calls it when a slot is
+   * in `TlsServer` (`TlsServer.wipe`). The carrier calls it when a slot is
    * closed, so a free slot holds no key.
    */
   wipeKeys(): void {
-    this.wipeTraffic()
-    this.wipeHandshake()
+    this.wipe()
+  }
+
+  /**
+   * Wipes everything this slot holds, which is what `wipeKeys` does: both
+   * traffic secrets at both hash lengths, both directions' keys, and
+   * everything `TlsServer` holds. The record buffers that hold nothing still
+   * needed go back too; a failure's alert waiting in `output` stays until it
+   * is sent or `release` drops it.
+   */
+  wipe(): void {
+    this.giveBackIdle()
+    wipe(this.readTraffic256)
+    wipe(this.readTraffic384)
+    wipe(this.writeTraffic256)
+    wipe(this.writeTraffic384)
+    this.readHash = 0
+    this.writeHash = 0
+    this.readProtection.clear()
+    this.writeProtection.clear()
+    this.tls.wipe()
   }
 
   /** Wipes the two application traffic secrets and both directions' keys. */
   wipeTraffic(): void {
-    // The two secret fields point into these four arrays, or at nothing.
-    secureZero(this.readSecret256)
-    secureZero(this.readSecret384)
-    secureZero(this.writeSecret256)
-    secureZero(this.writeSecret384)
+    this.wipeRead()
+    this.wipeWrite()
+  }
+
+  /** Wipes the client's application traffic secret and the read keys. */
+  wipeRead(): void {
+    // Whichever of the pair held the secret, both are zeroed.
+    this.wipeReadSecret()
+    this.readHash = 0
     this.readProtection.clear()
+  }
+
+  /** Wipes the server's application traffic secret and its write keys. */
+  wipeWrite(): void {
+    this.wipeWriteSecret()
+    this.writeHash = 0
     this.writeProtection.clear()
   }
 
+  /** Zeroes both of the client's traffic secret fields. */
+  wipeReadSecret(): void {
+    exposeWith(this.readTraffic256, TLS_RECORD_SERVER_FROM, tlsTrafficZero)
+    exposeWith(this.readTraffic384, TLS_RECORD_SERVER_FROM, tlsTrafficZero)
+  }
+
+  /** Zeroes both of the server's traffic secret fields. */
+  wipeWriteSecret(): void {
+    exposeWith(this.writeTraffic256, TLS_RECORD_SERVER_FROM, tlsTrafficZero)
+    exposeWith(this.writeTraffic384, TLS_RECORD_SERVER_FROM, tlsTrafficZero)
+  }
+
   /**
-   * Wipes every secret `TlsServer` still holds — the ephemeral key it was
-   * handed, the handshake, traffic and exporter secrets and the expected
-   * Finished — for a connection that has failed or is closed. On the way to
-   * an open connection each is wiped as soon as it has been used; this is
-   * for the ways that end early, and for the exporter secret, which a caller
-   * may read until the connection ends.
+   * Copies the client's application traffic secret out of `TlsServer` into
+   * the field of its hash's length, wipes the server's copy, and installs the
+   * read keys from it. False when the secret is not known or the keys do not
+   * install.
    */
-  wipeHandshake(): void {
+  keepRead(): boolean {
     const tls: TlsServer = this.tls
-    secureZero(tls.ephemeralPrivate)
-    secureZero(tls.handshakeSecret)
-    secureZero(tls.clientHandshakeSecret)
-    secureZero(tls.serverHandshakeSecret)
-    secureZero(tls.clientApplicationSecret)
-    secureZero(tls.serverApplicationSecret)
-    secureZero(tls.exporterSecret)
-    secureZero(tls.expectedClientFinished)
+    if (!tls.readKnown(TLS_LEVEL_APPLICATION)) {
+      return false
+    }
+    const pool: TlsSecretPool = tls.secrets()
+    this.readHash = tls.hashLength
+    let installed: boolean = false
+    if (this.readHash === SHA384_SIZE) {
+      exposeWith(pool.clientApplication, this.readTraffic384, tlsHeldCopyOver)
+      tls.wipeSecret(TLS_SECRET_CLIENT_APPLICATION)
+      installed = tlsInstallHeld(this.readProtection, tls.suite, this.readTraffic384)
+    } else {
+      exposeWith(pool.clientApplication, this.readTraffic256, tlsHeldCopyOver)
+      tls.wipeSecret(TLS_SECRET_CLIENT_APPLICATION)
+      installed = tlsInstallHeld(this.readProtection, tls.suite, this.readTraffic256)
+    }
+    return installed
+  }
+
+  /** `keepRead` for the server's application traffic secret and the write keys. */
+  keepWrite(): boolean {
+    const tls: TlsServer = this.tls
+    if (!tls.writeKnown(TLS_LEVEL_APPLICATION)) {
+      return false
+    }
+    const pool: TlsSecretPool = tls.secrets()
+    this.writeHash = tls.hashLength
+    let installed: boolean = false
+    if (this.writeHash === SHA384_SIZE) {
+      exposeWith(pool.serverApplication, this.writeTraffic384, tlsHeldCopyOver)
+      tls.wipeSecret(TLS_SECRET_SERVER_APPLICATION)
+      installed = tlsInstallHeld(this.writeProtection, tls.suite, this.writeTraffic384)
+    } else {
+      exposeWith(pool.serverApplication, this.writeTraffic256, tlsHeldCopyOver)
+      tls.wipeSecret(TLS_SECRET_SERVER_APPLICATION)
+      installed = tlsInstallHeld(this.writeProtection, tls.suite, this.writeTraffic256)
+    }
+    return installed
   }
 
   /** How many bytes `receive` would take now: what the socket should read at most. */
@@ -394,19 +622,21 @@ export class TlsRecordServer {
    * fails, with nothing more sent, though what is already on `output` may
    * still go out. Records still waiting for the caller to read, or for the
    * signature, are handled first, so a `close_notify` among them counts.
+   * Every key the connection holds is wiped, as `fail` wipes them.
    */
   checkTruncation(): void {
     if (this.ended && !this.peerClosed && this.state !== TLS_RECORD_STATE_FAILED && this.reader.next() <= 0) {
       this.state = TLS_RECORD_STATE_FAILED
       this.dropPending()
-      this.wipeHandshake()
+      this.wipeKeys()
     }
   }
 
-  /** The socket failed under the connection: it ends with nothing more sent. */
+  /** The socket failed under the connection: it ends with nothing more sent, and every key it holds wiped. */
   abort(): void {
     this.state = TLS_RECORD_STATE_FAILED
     this.dropOutput()
+    this.wipeKeys()
   }
 
   /** Forgets everything waiting to be sent. */
@@ -416,12 +646,17 @@ export class TlsRecordServer {
     this.dropPending()
   }
 
-  /** Forgets what is owed but not yet sealed: the handshake queues, the compatibility record, a KeyUpdate and a close. */
+  /**
+   * Forgets what is owed but not yet sealed: the handshake queues, a
+   * NewSessionTicket, the compatibility record, a KeyUpdate and a close.
+   */
   dropPending(): void {
     this.tls.clearOutput(TLS_LEVEL_INITIAL)
     this.tls.clearOutput(TLS_LEVEL_HANDSHAKE)
+    this.tls.clearOutput(TLS_LEVEL_APPLICATION)
     this.pendingInitialAt = 0
     this.pendingHandshakeAt = 0
+    this.pendingApplicationAt = 0
     this.flightReady = false
     this.ccsDue = false
     this.keyUpdateDue = false
@@ -437,7 +672,7 @@ export class TlsRecordServer {
    */
   process(): void {
     while (this.state !== TLS_RECORD_STATE_FAILED && !this.peerClosed) {
-      if (this.tls.state === TLS_STATE_WAIT_SIGNATURE) {
+      if (this.tls.state === TLS_STATE_WAIT_SIGNATURE || this.tls.state === TLS_STATE_WAIT_TICKET) {
         break
       }
       const n: i32 = this.reader.next()
@@ -468,7 +703,7 @@ export class TlsRecordServer {
    * a caller reading a byte at a time does not move the buffer each time.
    */
   plainHasRoom(): boolean {
-    const capacity: i32 = toI32(this.plain.length)
+    const capacity: i32 = TLS_RECORD_PLAIN_SIZE
     if (capacity - (this.plainEnd - this.plainStart) < TLS_MAX_PLAINTEXT) {
       return false
     }
@@ -480,6 +715,9 @@ export class TlsRecordServer {
       this.plainStart = 0
       this.plainEnd = held
     }
+    if (this.plain.length === 0) {
+      this.plain = this.pools.plain.take()
+    }
     return true
   }
 
@@ -499,6 +737,9 @@ export class TlsRecordServer {
     if (toI32(buf[off]) === TLS_CONTENT_CHANGE_CIPHER_SPEC) {
       return this.handleChangeCipherSpec(buf, off, n - TLS_RECORD_HEADER_SIZE)
     }
+    if (this.scratch.length === 0) {
+      this.scratch = this.pools.scratch.take()
+    }
     const length: i32 = this.readProtection.open(buf, off, n, this.scratch, TLS_RECORD_SERVER_FROM)
     if (length < 0) {
       return -length
@@ -575,6 +816,9 @@ export class TlsRecordServer {
           this.plain[this.plainEnd + k] = this.scratch[k]
         }
         this.plainEnd = this.plainEnd + length
+        if (this.plainEnd > this.plainUsed) {
+          this.plainUsed = this.plainEnd
+        }
         this.idleRecords = 0
         return 0
       }
@@ -600,7 +844,10 @@ export class TlsRecordServer {
     }
     const description: i32 = toI32(this.scratch[1])
     if (description === TLS_ALERT_CLOSE_NOTIFY) {
+      // The client writes nothing after it (§6.1), and nothing after it is
+      // read, so the read keys have opened their last record.
       this.peerClosed = true
+      this.wipeRead()
       return 0
     }
     if (description === TLS_ALERT_USER_CANCELED) {
@@ -609,6 +856,9 @@ export class TlsRecordServer {
     this.peerAlert = description
     this.state = TLS_RECORD_STATE_FAILED
     this.dropOutput()
+    // The client's error alert ends the connection as `fail` does, with
+    // nothing sent back, so every key it held is wiped now.
+    this.wipeKeys()
     return 0
   }
 
@@ -667,11 +917,15 @@ export class TlsRecordServer {
    * The client's KeyUpdate: its next records are under the next secret
    * (§7.2), the old one wiped. When it asked for an update the server owes
    * one of its own before its next application data, which `pump` sends.
-   * Answers 0, or `internal_error` when the keys do not install, which only
-   * a secret of the wrong length could cause.
+   * Answers 0, or `internal_error` when no read secret is kept (`readHash`
+   * 0) or the keys do not install.
    */
   updateReadKeys(requested: boolean): i32 {
-    if (!this.readProtection.advance(this.readSecret)) {
+    const advanced: boolean =
+      this.readHash === SHA384_SIZE
+        ? tlsAdvanceHeld(this.readProtection, this.readTraffic384)
+        : this.readHash !== 0 && tlsAdvanceHeld(this.readProtection, this.readTraffic256)
+    if (!advanced) {
       return TLS_ALERT_INTERNAL_ERROR
     }
     if (requested) {
@@ -700,34 +954,28 @@ export class TlsRecordServer {
         toI32(tls.outputInitial[TLS_SESSION_ID_ECHO_AT]) > 0
     }
     if (this.readLevel === TLS_LEVEL_INITIAL) {
-      const handshake: u8[] | null = tls.readSecret(TLS_LEVEL_HANDSHAKE)
-      if (handshake !== null) {
-        this.readProtection.install(tls.suite, handshake)
+      if (tls.readKnown(TLS_LEVEL_HANDSHAKE)) {
+        tlsInstallHeld(this.readProtection, tls.suite, tls.secrets().clientHandshake)
         this.readLevel = TLS_LEVEL_HANDSHAKE
       }
     }
-    if (tls.state !== TLS_STATE_WAIT_CLIENT_HELLO) {
-      // The ServerHello is written, so the exchange is done with the key.
-      secureZero(tls.ephemeralPrivate)
+    if (tls.state !== TLS_STATE_WAIT_CLIENT_HELLO && tls.state !== TLS_STATE_WAIT_TICKET) {
+      // The ServerHello is written, so the exchange is done with the key. A
+      // hello that offers a ticket waits for `resume` before any ServerHello,
+      // and the exchange still needs the key there.
+      tls.wipeEphemeral()
     }
     if (tls.state === TLS_STATE_WAIT_FINISHED || tls.state === TLS_STATE_CONNECTED) {
       this.flightReady = true
       // The flight is signed and finished: the handshake secret and the
       // client's handshake secret have done their work in `TlsServer`, and
       // the read keys made from the latter are installed.
-      secureZero(tls.handshakeSecret)
-      secureZero(tls.clientHandshakeSecret)
+      tls.wipeSecret(TLS_SECRET_HANDSHAKE)
+      tls.wipeSecret(TLS_SECRET_CLIENT_HANDSHAKE)
     }
     if (tls.state === TLS_STATE_CONNECTED && this.readLevel === TLS_LEVEL_HANDSHAKE) {
-      this.readSecret = tlsKeepSecret(
-        tls.readSecret(TLS_LEVEL_APPLICATION),
-        this.readSecret256,
-        this.readSecret384,
-        this.none
-      )
-      secureZero(tls.clientApplicationSecret)
       // A direction whose keys did not install would read in the clear.
-      if (!this.readProtection.install(tls.suite, this.readSecret)) {
+      if (!this.keepRead()) {
         this.fail(TLS_ALERT_INTERNAL_ERROR)
         return
       }
@@ -735,13 +983,25 @@ export class TlsRecordServer {
       if (this.state === TLS_RECORD_STATE_HANDSHAKE) {
         this.state = TLS_RECORD_STATE_OPEN
       }
+      // With tickets on, a connection no ticket will be issued to has no use
+      // for the resumption master secret: wiped at once, not at close.
+      if (tls.tickets && !tls.ticketWanted) {
+        tls.wipeResumption()
+      }
     }
     this.pump()
   }
 
-  /** Whether `need` more bytes fit in `output`, moving what is unsent to the front first. */
+  /**
+   * Whether `need` more bytes fit in `output`, moving what is unsent to the
+   * front first. Borrows `output` when none is held, since a record is about
+   * to be sealed into it.
+   */
   outputHasRoom(need: i32): boolean {
-    const capacity: i32 = toI32(this.output.length)
+    if (this.output.length === 0) {
+      this.output = this.pools.output.take()
+    }
+    const capacity: i32 = TLS_RECORD_OUTPUT_SIZE
     if (this.outputEnd + need > capacity && this.outputStart > 0) {
       const held: i32 = this.outputEnd - this.outputStart
       for (let k: i32 = 0; k < held; k++) {
@@ -783,9 +1043,14 @@ export class TlsRecordServer {
    * mistake here could cause, fails the connection.
    */
   sealRecord(type: i32, data: u8[], off: i32, len: i32): boolean {
-    if (!this.outputHasRoom(this.recordRoom(len))) {
+    const room: i32 = this.recordRoom(len)
+    if (!this.outputHasRoom(room)) {
       return false
     }
+    // Counted before the seal, so a refused seal's partial write is wiped when the buffer goes back.
+    if (this.outputEnd + room > this.outputUsed) {
+      this.outputUsed = this.outputEnd + room
+    }
     const n: i32 = this.writeProtection.seal(
       type,
       data,
@@ -840,9 +1105,7 @@ export class TlsRecordServer {
     }
     // After its close_notify the server sends nothing more (§6.1).
     if (this.state === TLS_RECORD_STATE_CLOSED) {
-      if (this.closeDue && this.sendAlert(TLS_ALERT_LEVEL_WARNING, TLS_ALERT_CLOSE_NOTIFY)) {
-        this.closeDue = false
-      }
+      this.sealClose()
       return
     }
     const tls: TlsServer = this.tls
@@ -873,9 +1136,8 @@ export class TlsRecordServer {
     // in as soon as the ServerHello is sealed. `install` refuses only a suite
     // or a secret `TlsServer` never hands over; the check keeps the flight
     // from ever being sealed in the clear.
-    const handshake: u8[] | null = tls.writeSecret(TLS_LEVEL_HANDSHAKE)
-    if (this.writeLevel === TLS_LEVEL_INITIAL && handshake !== null) {
-      if (!this.writeProtection.install(tls.suite, handshake)) {
+    if (this.writeLevel === TLS_LEVEL_INITIAL && tls.writeKnown(TLS_LEVEL_HANDSHAKE)) {
+      if (!tlsInstallHeld(this.writeProtection, tls.suite, tls.secrets().serverHandshake)) {
         this.fail(TLS_ALERT_INTERNAL_ERROR)
         return
       }
@@ -897,21 +1159,28 @@ export class TlsRecordServer {
       this.writeLevel === TLS_LEVEL_HANDSHAKE &&
       (tls.state === TLS_STATE_WAIT_FINISHED || tls.state === TLS_STATE_CONNECTED)
     ) {
-      this.writeSecret = tlsKeepSecret(
-        tls.writeSecret(TLS_LEVEL_APPLICATION),
-        this.writeSecret256,
-        this.writeSecret384,
-        this.none
-      )
-      secureZero(tls.serverApplicationSecret)
-      secureZero(tls.serverHandshakeSecret)
+      tls.wipeSecret(TLS_SECRET_SERVER_HANDSHAKE)
       // A direction whose keys did not install would write in the clear.
-      if (!this.writeProtection.install(tls.suite, this.writeSecret)) {
+      if (!this.keepWrite()) {
         this.fail(TLS_ALERT_INTERNAL_ERROR)
         return
       }
       this.writeLevel = TLS_LEVEL_APPLICATION
     }
+    // A NewSessionTicket is a post-handshake message, under the application
+    // keys (§4.6.1).
+    if (this.writeLevel === TLS_LEVEL_APPLICATION && tls.outputApplicationLength > 0) {
+      this.pendingApplicationAt = this.sealQueue(
+        tls.outputApplication,
+        this.pendingApplicationAt,
+        tls.outputApplicationLength
+      )
+      if (this.pendingApplicationAt < tls.outputApplicationLength) {
+        return
+      }
+      tls.clearOutput(TLS_LEVEL_APPLICATION)
+      this.pendingApplicationAt = 0
+    }
     if (this.keyUpdateDue && this.writeLevel === TLS_LEVEL_APPLICATION && this.sendKeyUpdate(false)) {
       this.keyUpdateDue = false
     }
@@ -927,7 +1196,11 @@ export class TlsRecordServer {
     if (!this.sealRecord(TLS_CONTENT_HANDSHAKE, message, TLS_RECORD_SERVER_FROM, TLS_KEY_UPDATE_SIZE)) {
       return false
     }
-    if (!this.writeProtection.advance(this.writeSecret)) {
+    const advanced: boolean =
+      this.writeHash === SHA384_SIZE
+        ? tlsAdvanceHeld(this.writeProtection, this.writeTraffic384)
+        : this.writeHash !== 0 && tlsAdvanceHeld(this.writeProtection, this.writeTraffic256)
+    if (!advanced) {
       this.fail(TLS_ALERT_INTERNAL_ERROR)
       return false
     }
@@ -958,7 +1231,9 @@ export class TlsRecordServer {
   /**
    * Fails the connection with `alert`, sent as a fatal alert under whatever
    * the server writes with now, in the clear before its first keys. What
-   * was still owed is dropped: the alert is the last thing the server sends.
+   * was still owed is dropped: the alert is the last thing the server sends,
+   * so once it is sealed every key the connection holds is wiped, the
+   * traffic keys and secrets as well as what `TlsServer` holds.
    */
   fail(alert: i32): void {
     if (this.state === TLS_RECORD_STATE_FAILED) {
@@ -966,7 +1241,6 @@ export class TlsRecordServer {
     }
     const closed: boolean = this.state === TLS_RECORD_STATE_CLOSED
     this.dropPending()
-    this.wipeHandshake()
     // Failed first, so a seal that refuses the alert cannot come back here.
     this.state = TLS_RECORD_STATE_FAILED
     this.alert = alert
@@ -974,6 +1248,9 @@ export class TlsRecordServer {
     if (!closed) {
       this.sendAlert(TLS_ALERT_LEVEL_FATAL, alert)
     }
+    // After the branch, so that the alert is sealed under the write keys
+    // before they go, and so that `opt` keeps one wipe rather than merging two.
+    this.wipeKeys()
   }
 
   /** Seals an alert record of `level` and `description`; false, sending nothing, when `output` has no room for it. */
@@ -1039,7 +1316,7 @@ export class TlsRecordServer {
       let chunk: i32 = left < most ? left : most
       // A record shortened to the room there is, rather than none at all.
       this.outputHasRoom(this.recordRoom(chunk))
-      const room: i32 = toI32(this.output.length) - this.outputEnd - this.recordRoom(TLS_RECORD_SERVER_FROM)
+      const room: i32 = TLS_RECORD_OUTPUT_SIZE - this.outputEnd - this.recordRoom(TLS_RECORD_SERVER_FROM)
       if (room < chunk) {
         chunk = room
       }
@@ -1094,6 +1371,8 @@ export class TlsRecordServer {
    * answers `TLS_RECORD_PIPE` and nothing more is sent. What was still owed
    * of the handshake is dropped; application data already written stays
    * ahead of the alert, which waits for room in `output` when there is none.
+   * The resumption master secret is wiped, since nothing issues a ticket
+   * from it, and the write keys once the `close_notify` is sealed (`sealClose`).
    * Nothing happens once the connection has failed or closed.
    */
   close(): void {
@@ -1101,9 +1380,23 @@ export class TlsRecordServer {
       return
     }
     this.dropPending()
+    this.tls.wipeResumption()
     this.state = TLS_RECORD_STATE_CLOSED
     this.closeDue = true
-    this.pump()
+    this.sealClose()
+  }
+
+  /**
+   * Seals the `close_notify` `close` owes, once `output` has room for it. It
+   * is the last record the server writes (§6.1), so the write keys and the
+   * server's traffic secret are wiped as soon as it is sealed. The read keys
+   * stay: the client may still send until its own `close_notify`.
+   */
+  sealClose(): void {
+    if (this.closeDue && this.sendAlert(TLS_ALERT_LEVEL_WARNING, TLS_ALERT_CLOSE_NOTIFY)) {
+      this.closeDue = false
+      this.wipeWrite()
+    }
   }
 
   /** What the CertificateVerify signs, while `interest` says `TLS_RECORD_SIGN`; `null` otherwise. */
@@ -1134,12 +1427,55 @@ export class TlsRecordServer {
     return this.state === TLS_RECORD_STATE_FAILED ? this.alert : 0
   }
 
+  /**
+   * While `interest` says `TLS_RECORD_TICKET` in the handshake: reads the
+   * ClientHello's tickets under the keys the carrier lends (`TlsServer.resume`)
+   * and seals the flight that answers it, resumed or in full. Answers 0, or
+   * the alert the connection failed with — `internal_error` when no ticket
+   * waits.
+   */
+  resume(
+    current: Secret<u8[]>,
+    currentInfo: TlsTicketKeyInfo,
+    previous: Secret<u8[]>,
+    previousInfo: TlsTicketKeyInfo,
+    strikes: TlsTicketStrikes,
+    now: i64
+  ): i32 {
+    if (this.state !== TLS_RECORD_STATE_HANDSHAKE) {
+      return this.state === TLS_RECORD_STATE_FAILED ? this.alert : TLS_ALERT_INTERNAL_ERROR
+    }
+    const alert: i32 = this.tls.resume(current, currentInfo, previous, previousInfo, strikes, now)
+    if (alert !== 0) {
+      this.fail(alert)
+      return alert
+    }
+    this.advance()
+    this.process()
+    return this.state === TLS_RECORD_STATE_FAILED ? this.alert : 0
+  }
+
+  /**
+   * While `interest` says `TLS_RECORD_TICKET` on an open connection: seals a
+   * ticket under `key` (`TlsServer.issue`) and queues its NewSessionTicket.
+   * Whether one was queued; either way the resumption master secret is
+   * wiped, and no second ticket is issued.
+   */
+  issue(key: Secret<u8[]>, info: TlsTicketKeyInfo, now: i64): boolean {
+    if (this.state !== TLS_RECORD_STATE_OPEN) {
+      return false
+    }
+    const written: boolean = this.tls.issue(key, info, now)
+    this.pump()
+    return written
+  }
+
   /**
    * What the connection wants next, as `TLS_RECORD_*` bits: read the socket
    * (there is room, and the stream has not ended), write it (`output` holds
    * bytes), `read` (application data, or the end of the client's stream),
-   * sign, or nothing more ever (`TLS_RECORD_DONE`: failed or closed, and
-   * everything is sent).
+   * sign, handle a ticket, or nothing more ever (`TLS_RECORD_DONE`: failed
+   * or closed, and everything is sent).
    */
   interest(): i32 {
     let bits: i32 = 0
@@ -1168,6 +1504,16 @@ export class TlsRecordServer {
     if (this.state === TLS_RECORD_STATE_HANDSHAKE && this.tls.state === TLS_STATE_WAIT_SIGNATURE) {
       bits = bits | TLS_RECORD_SIGN
     }
+    const ticketHello: boolean =
+      this.state === TLS_RECORD_STATE_HANDSHAKE && this.tls.state === TLS_STATE_WAIT_TICKET
+    const ticketOwed: boolean =
+      this.state === TLS_RECORD_STATE_OPEN &&
+      this.tls.state === TLS_STATE_CONNECTED &&
+      this.tls.ticketWanted &&
+      !this.tls.issued
+    if (ticketHello || ticketOwed) {
+      bits = bits | TLS_RECORD_TICKET
+    }
     return bits
   }
 }