加密与序列号

pub(crate) struct RecordLayer {
    message_encrypter: Box<dyn MessageEncrypter>,
    message_decrypter: Box<dyn MessageDecrypter>,
    write_seq_max: u64,
    write_seq: u64,
    read_seq: u64,
    has_decrypted: bool,
    encrypt_state: DirectionState,
    decrypt_state: DirectionState,

    // Message encrypted with other keys may be encountered, so failures
    // should be swallowed by the caller.  This struct tracks the amount
    // of message size this is allowed for.
    trial_decryption_len: Option<usize>,
}

pub trait MessageDecrypter: Send + Sync {
    fn decrypt<'a>(
        &mut self,
        msg: InboundOpaqueMessage<'a>,
        seq: u64,
    ) -> Result<InboundPlainMessage<'a>, Error>;
}

pub trait MessageEncrypter: Send + Sync {
    fn encrypt(
        &mut self,
        msg: OutboundPlainMessage<'_>,
        seq: u64,
    ) -> Result<OutboundOpaqueMessage, Error>;

    fn encrypted_payload_len(&self, payload_len: usize) -> usize;
}

    pub(crate) fn encrypt_outgoing(
        &mut self,
        plain: OutboundPlainMessage<'_>,
    ) -> OutboundOpaqueMessage {
        debug_assert!(self.encrypt_state == DirectionState::Active);
        assert!(self.next_pre_encrypt_action() != PreEncryptAction::Refuse);
        let seq = self.write_seq;
        self.write_seq += 1;
        self.message_encrypter
            .encrypt(plain, seq)
            .unwrap()
    }

    pub fn new(iv: &Iv, seq: u64) -> Self {
        let mut seq_bytes = [0u8; NONCE_LEN];
        codec::put_u64(seq, &mut seq_bytes[4..]);
        Self::new_from_seq(iv, seq_bytes)
    }

client_application_traffic_secret_0: 32 bytes
write iv = ad907eba0b83f726c2b0173b
3 writes -> 72 bytes on the wire, 3 records
  seq 0: header 17 0303 len  18  nonce ad907eba0b83f726c2b0173b  inner plaintext 6117
  seq 1: header 17 0303 len  19  nonce ad907eba0b83f726c2b0173a  inner plaintext 626217
  seq 2: header 17 0303 len  20  nonce ad907eba0b83f726c2b01739  inner plaintext 63636317
  record seq 1 opened with seq 0's nonce: Err(Unspecified)
server read "abbccc"

record 0: type 23 version 0303 len 25 explicit nonce 1c430885b97d5a2d
record 1: type 23 version 0303 len 25 explicit nonce 1c430885b97d5a2e
record 2: type 23 version 0303 len 25 explicit nonce 1c430885b97d5a2f
record 3: type 23 version 0303 len 25 explicit nonce 1c430885b97d5a28

        let nonce = aead::Nonce::assume_unique_for_key(Nonce::new(&self.iv, seq).0);
        let aad = aead::Aad::from(make_tls13_aad(total_len));
        payload.extend_from_chunks(&msg.payload);
        payload.extend_from_slice(&msg.typ.to_array());

        self.enc_key
            .seal_in_place_append_tag(nonce, aad, &mut payload)
            .map_err(|_| Error::EncryptError)?;

padded record: 125 bytes on the wire
  server: Ok(3), read "pad"
all-zero inner plaintext: Some(PeerMisbehaved(IllegalTlsInnerPlaintext))
  server queued 0 bytes: []

    pub(crate) fn pre_encrypt_action(&self, add: u64) -> PreEncryptAction {
        match self.write_seq.saturating_add(add) {
            SEQ_HARD_LIMIT.. => PreEncryptAction::Refuse,
            v if v >= self.write_seq_max => PreEncryptAction::RefreshOrClose,
            _ => PreEncryptAction::Nothing,
        }
    }

        for m in iter {
            // The key update takes the last sequence number allowed by the current keys,
            // unless they have not been used yet (as updating them would not help then).
            if stop_for_key_update
                && self.negotiated_version == Some(ProtocolVersion::TLSv1_3)
                && self.record_layer.write_seq() > 0
                && self.record_layer.pre_encrypt_action(1) != PreEncryptAction::Nothing
            {
                // driven by caller, as we don't have the `State` here
                self.refresh_traffic_keys_pending = true;
                return sent;
            }

            sent += m.payload.len();
            self.send_single_fragment(m);
        }

        fn send_plaintext(&mut self, payload: OutboundChunks<'_>) -> usize {
            let mut len = 0;
            loop {
                len += self
                    .core
                    .common_state
                    .buffer_plaintext(payload.split_at(len).1, &mut self.sendable_plaintext);
                if !self.core.maybe_refresh_traffic_keys() || len == payload.len() {
                    return len;
                }
            }
        }

mode tls13-aes: suite TLS13_AES_128_GCM_SHA256, version TLSv1_3
16777220 writes of 1 byte in 4.4s: accepted 16777220 bytes, 0 writes returned 0
records after the handshake: 16777221, of which one-byte appdata (23 B on the wire): 16777220
  odd record: index 16777215 (seq 16777215 if no earlier rekey), type 23, 27 bytes on the wire, after 16777215 appdata records
...
server: received 16777220 plaintext bytes, error None, peer_has_closed Ok(false)
...
mode tls12-aes: suite TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, version TLSv1_2
...
records after the handshake: 16777216, of which one-byte appdata (30 B on the wire): 16777215
  odd record: index 16777215 (seq 16777215 if no earlier rekey), type 21, 31 bytes on the wire, after 16777215 appdata records
...
server: received 16777215 plaintext bytes, error None, peer_has_closed Ok(true)
...
mode tls13-chacha: suite TLS13_CHACHA20_POLY1305_SHA256, version TLSv1_3
16777220 writes of 1 byte in 9.4s: accepted 16777220 bytes, 0 writes returned 0
records after the handshake: 16777220, of which one-byte appdata (23 B on the wire): 16777220
...
server: received 16777220 plaintext bytes, error None, peer_has_closed Ok(false)