fix(sidetrail): Invalid stream cipher struct in proof wrapper

tests/sidetrail/working/s2n-record-read-stream/copy_as_needed.sh

@@ -43,7 +43,7 @@ mkdir -p tls
 #add invariants etc needed for the proof to the s2n_cbc code
 cp $S2N_BASE/tls/s2n_cbc.c tls/
 cp $S2N_BASE/tls/s2n_record_read_stream.c tls/
-patch -p5 < ../patches/cbc.patch
+patch -p1 < s2n_record_read_stream.patch
 
 mkdir -p utils
 cp $S2N_BASE/utils/s2n_result.c utils/

tests/sidetrail/working/s2n-record-read-stream/s2n_record_read_stream.patch

@@ -0,0 +1,29 @@
+diff --git a/tls/s2n_record_read_stream.c b/tls/s2n_record_read_stream.c
+index 927ab00f..3846cc4b 100644
+--- a/tls/s2n_record_read_stream.c
++++ b/tls/s2n_record_read_stream.c
+@@ -79,15 +79,20 @@ int s2n_record_parse_stream(
+         POSIX_BAIL(S2N_ERR_BAD_MESSAGE);
+     }
+
++    /* All information is declassified after the MAC is successfully verified since the record is
++     * decrypted and authenticated. Code that's executed post MAC validation need not be constant
++     * time, so it's removed from the scope of SideTrail's analysis.
++     */
++
+     /* O.k., we've successfully read and decrypted the record, now we need to align the stuffer
+      * for reading the plaintext data.
+      */
+-    POSIX_GUARD(s2n_stuffer_reread(&conn->in));
+-    POSIX_GUARD(s2n_stuffer_reread(&conn->header_in));
++//    POSIX_GUARD(s2n_stuffer_reread(&conn->in));
++//    POSIX_GUARD(s2n_stuffer_reread(&conn->header_in));
+
+     /* Truncate and wipe the MAC and any padding */
+-    POSIX_GUARD(s2n_stuffer_wipe_n(&conn->in, s2n_stuffer_data_available(&conn->in) - payload_length));
+-    conn->in_status = PLAINTEXT;
++//    POSIX_GUARD(s2n_stuffer_wipe_n(&conn->in, s2n_stuffer_data_available(&conn->in) - payload_length));
++//    conn->in_status = PLAINTEXT;
+
+     return 0;
+ }

tests/sidetrail/working/s2n-record-read-stream/s2n_record_read_wrapper.c

@@ -71,7 +71,7 @@ int s2n_record_parse_wrapper(int *xor_pad,
 			     uint8_t content_type
 )
 {
-  __VERIFIER_ASSERT_MAX_LEAKAGE(0);
+  __VERIFIER_ASSERT_MAX_LEAKAGE(5);
   __VERIFIER_assume(encrypted_length > 0);
   __VERIFIER_assume(padding_length >= 0);
   __VERIFIER_assume(padding_length < 256);
@@ -99,7 +99,7 @@ int s2n_record_parse_wrapper(int *xor_pad,
 
   struct s2n_cipher stream_cipher = {
     .type = S2N_STREAM,
-    .io.cbc.decrypt = decrypt_stream,
+    .io.stream.decrypt = decrypt_stream,
   };
 
   struct s2n_record_algorithm record_algorithm = {