diff options
| author |   jsing <jsing@openbsd.org> | 2021-01-19 18:57:09 +0000 |
|---|---|---|
| committer | jsing <jsing@openbsd.org> | 2021-01-19 18:57:09 +0000 |
| commit | 1365e68c83704aebdea192474b3f2c00ac46542b (patch) | |
| tree | 8dc0085980e8a38633c36dc8556cd9b3ebfdf46d /lib/libssl/tls12_record_layer.c | |
| parent | Provide record layer overhead for DTLS. (diff) | |
| download | wireguard-openbsd-1365e68c83704aebdea192474b3f2c00ac46542b.tar.xz wireguard-openbsd-1365e68c83704aebdea192474b3f2c00ac46542b.zip | |
Provide functions to determine if TLSv1.2 record protection is engaged.
Call these functions from code that needs to know if we've changed cipher
state and enabled record protection, rather than inconsistently checking
various pointers from other places in the code base. This also fixes a
minor bug where the wrong pointers are checked if we're operating with
AEAD.
ok inoguchi@ tb@
Diffstat (limited to 'lib/libssl/tls12_record_layer.c')
| -rw-r--r-- | lib/libssl/tls12_record_layer.c | 20 |
1 files changed, 19 insertions, 1 deletions
diff --git a/lib/libssl/tls12_record_layer.c b/lib/libssl/tls12_record_layer.c index 7fa31707d3b..affc5375a2e 100644 --- a/lib/libssl/tls12_record_layer.c +++ b/lib/libssl/tls12_record_layer.c @@ -1,4 +1,4 @@ -/* $OpenBSD: tls12_record_layer.c,v 1.11 2021/01/19 18:51:08 jsing Exp $ */ +/* $OpenBSD: tls12_record_layer.c,v 1.12 2021/01/19 18:57:09 jsing Exp $ */ /* * Copyright (c) 2020 Joel Sing <jsing@openbsd.org> * @@ -59,6 +59,12 @@ tls12_record_protection_free(struct tls12_record_protection *rp) } static int +tls12_record_protection_engaged(struct tls12_record_protection *rp) +{ + return rp->aead_ctx != NULL || rp->cipher_ctx != NULL; +} + +static int tls12_record_protection_eiv_len(struct tls12_record_protection *rp, size_t *out_eiv_len) { @@ -195,6 +201,18 @@ tls12_record_layer_write_overhead(struct tls12_record_layer *rl, return 1; } +int +tls12_record_layer_read_protected(struct tls12_record_layer *rl) +{ + return tls12_record_protection_engaged(rl->read); +} + +int +tls12_record_layer_write_protected(struct tls12_record_layer *rl) +{ + return tls12_record_protection_engaged(rl->write); +} + void tls12_record_layer_set_version(struct tls12_record_layer *rl, uint16_t version) { |