aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--crypto/openssl/ssl/tls13_enc.c32
1 files changed, 21 insertions, 11 deletions
diff --git a/crypto/openssl/ssl/tls13_enc.c b/crypto/openssl/ssl/tls13_enc.c
index 861ecdf91701..39a27d926ce7 100644
--- a/crypto/openssl/ssl/tls13_enc.c
+++ b/crypto/openssl/ssl/tls13_enc.c
@@ -438,6 +438,7 @@ int tls13_change_cipher_state(SSL *s, int which)
const EVP_CIPHER *cipher = NULL;
#if !defined(OPENSSL_NO_KTLS) && defined(OPENSSL_KTLS_TLS13)
ktls_crypto_info_t crypto_info;
+ void *rl_sequence;
BIO *bio;
#endif
@@ -692,8 +693,7 @@ int tls13_change_cipher_state(SSL *s, int which)
s->statem.enc_write_state = ENC_WRITE_STATE_VALID;
#ifndef OPENSSL_NO_KTLS
# if defined(OPENSSL_KTLS_TLS13)
- if (!(which & SSL3_CC_WRITE)
- || !(which & SSL3_CC_APPLICATION)
+ if (!(which & SSL3_CC_APPLICATION)
|| (s->options & SSL_OP_ENABLE_KTLS) == 0)
goto skip_ktls;
@@ -709,7 +709,10 @@ int tls13_change_cipher_state(SSL *s, int which)
if (!ktls_check_supported_cipher(s, cipher, ciph_ctx))
goto skip_ktls;
- bio = s->wbio;
+ if (which & SSL3_CC_WRITE)
+ bio = s->wbio;
+ else
+ bio = s->rbio;
if (!ossl_assert(bio != NULL)) {
SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
@@ -717,19 +720,26 @@ int tls13_change_cipher_state(SSL *s, int which)
}
/* All future data will get encrypted by ktls. Flush the BIO or skip ktls */
- if (BIO_flush(bio) <= 0)
- goto skip_ktls;
+ if (which & SSL3_CC_WRITE) {
+ if (BIO_flush(bio) <= 0)
+ goto skip_ktls;
+ }
/* configure kernel crypto structure */
- if (!ktls_configure_crypto(s, cipher, ciph_ctx,
- RECORD_LAYER_get_write_sequence(&s->rlayer),
- &crypto_info, which & SSL3_CC_WRITE, iv, key,
- NULL, 0))
+ if (which & SSL3_CC_WRITE)
+ rl_sequence = RECORD_LAYER_get_write_sequence(&s->rlayer);
+ else
+ rl_sequence = RECORD_LAYER_get_read_sequence(&s->rlayer);
+
+ if (!ktls_configure_crypto(s, cipher, ciph_ctx, rl_sequence, &crypto_info,
+ which & SSL3_CC_WRITE, iv, key, NULL, 0))
goto skip_ktls;
/* ktls works with user provided buffers directly */
- if (BIO_set_ktls(bio, &crypto_info, which & SSL3_CC_WRITE))
- ssl3_release_write_buffer(s);
+ if (BIO_set_ktls(bio, &crypto_info, which & SSL3_CC_WRITE)) {
+ if (which & SSL3_CC_WRITE)
+ ssl3_release_write_buffer(s);
+ }
skip_ktls:
# endif
#endif