TLS 1.3レコード層のフレーミング実装と、TCPストリームからのレコード境界復元

// tcp-tls13/include/tcptls13/tls_record.hpp
enum class ContentType : std::uint8_t
{
    ChangeCipherSpec = 20,
    Alert = 21,
    Handshake = 22,
    ApplicationData = 23,
};

// RFC 8446 §5.1: TLSPlaintext.length MUST NOT exceed 2^14 bytes.
inline constexpr std::size_t MaxFragmentLength = 16384;
inline constexpr std::size_t TlsRecordHeaderSize = 5;

struct TlsPlaintext
{
    ContentType type;
    std::span<const std::byte> fragment;
};

// tcp-tls13/src/tls_record.cpp（parse抜粋）
std::expected<TlsRecordHeader, TlsRecordParseError>
parse_tls_record_header(std::span<const std::byte> bytes)
{
    if (bytes.size() < TlsRecordHeaderSize)
    {
        return std::unexpected(TlsRecordParseError::HeaderTooShort);
    }

    const auto raw_type = std::to_integer<std::uint8_t>(bytes[0]);
    if (!is_known_content_type(raw_type))
    {
        return std::unexpected(TlsRecordParseError::InvalidContentType);
    }

    const auto length = detail::read_uint16(bytes.subspan<3, 2>());
    if (length > MaxFragmentLength)
    {
        return std::unexpected(TlsRecordParseError::FragmentTooLarge);
    }

    return TlsRecordHeader{
        .type = static_cast<ContentType>(raw_type),
        .length = length,
    };
}

// tcp-tls13/include/tcptls13/record_layer.hpp
class RecordLayer
{
public:
    explicit RecordLayer(TcpConnection& connection);

    std::expected<void, RecordLayerError> send_record(
        ContentType type, std::span<const std::byte> fragment
    );

    struct Incoming
    {
        ContentType type;
        std::vector<std::byte> fragment;
    };

    std::expected<Incoming, RecordLayerError> receive_record();

private:
    std::expected<void, RecordLayerError> fill_buffer(std::size_t at_least);

    TcpConnection* connection_;
    std::vector<std::byte> buffer_;
};

// tcp-tls13/src/record_layer.cpp（receive_record抜粋）
std::expected<RecordLayer::Incoming, RecordLayerError>
RecordLayer::receive_record()
{
    if (auto filled = fill_buffer(TlsRecordHeaderSize); !filled)
    {
        return std::unexpected(filled.error());
    }

    auto header = parse_tls_record_header(buffer_);
    if (!header)
    {
        return std::unexpected(RecordLayerError::ProtocolError);
    }

    const auto record_size = TlsRecordHeaderSize + header->length;
    if (auto filled = fill_buffer(record_size); !filled)
    {
        return std::unexpected(filled.error());
    }

    Incoming incoming{
        .type = header->type,
        .fragment = std::vector<std::byte>(
            buffer_.begin() + TlsRecordHeaderSize,
            buffer_.begin() + record_size
        ),
    };

    buffer_.erase(buffer_.begin(), buffer_.begin() + record_size);

    return incoming;
}

// tcp-tls13/src/record_layer.cpp（send_record抜粋）
std::expected<void, RecordLayerError> RecordLayer::send_record(
    ContentType type, std::span<const std::byte> fragment
)
{
    std::size_t sent = 0;

    do
    {
        const auto chunk_size = std::min(MaxFragmentLength, fragment.size() - sent);
        const auto chunk = fragment.subspan(sent, chunk_size);

        if (auto result = connection_->send(build_tls_record(type, chunk)); !result)
        {
            return std::unexpected(map_connection_error(result.error()));
        }

        sent += chunk_size;
    } while (sent < fragment.size());

    return {};
}

// 修正前: recv_next_より小さいシーケンス番号にだけACKを返す
if (segment->header.sequence_number < recv_next_)
{
    send_segment(TcpFlags{.ack = true}, {});
    continue;
}

if (segment->header.sequence_number != recv_next_ || segment->payload.empty())
{
    continue;  // recv_next_より大きい(順序が飛んだ)場合は何も返さず無視
}

// tcp-tls13/src/tcp_connection.cpp（receive、修正後）
std::expected<std::vector<std::byte>, ConnectionError>
TcpConnection::receive()
{
    while (true)
    {
        auto segment = receive_segment(NoTimeout);
        if (!segment)
        {
            return std::unexpected(segment.error());
        }

        if (segment->header.sequence_number != recv_next_)
        {
            send_segment(TcpFlags{.ack = true}, {});
            continue;
        }

        if (segment->payload.empty())
        {
            continue;
        }

        recv_next_ += segment->payload.size();

        if (!send_segment(TcpFlags{.ack = true}, {}))
        {
            return std::unexpected(ConnectionError::SendFailed);
        }

        return segment->payload;
    }
}