Remove SSL_USE_EXPLICT_IV() from the record layer methods

Instead we introduce RLAYER_USE_EXPLICIT_IV(). This removes a dependency
on the SSL object.

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18132)

diff --git a/ssl/record/methods/recmethod_local.h b/ssl/record/methods/recmethod_local.h
index 8cad4b39794f4b345fa0a8ab98c14aa474ac54dc..6e3f3ee20cca83f5e2e428ceb5177ce6c868dc66 100644 (file)
--- a/ssl/record/methods/recmethod_local.h
+++ b/ssl/record/methods/recmethod_local.h
@@ -171,6 +171,9 @@ void ossl_rlayer_fatal(OSSL_RECORD_LAYER *rl, int al, int reason,
      ERR_set_debug(OPENSSL_FILE, OPENSSL_LINE, OPENSSL_FUNC),      \
      ossl_rlayer_fatal)
 
+# define RLAYER_USE_EXPLICIT_IV(rl) ((rl)->version == TLS1_1_VERSION \
+                                     || (rl)->version == TLS1_2_VERSION)
+
 int ossl_set_tls_provider_parameters(OSSL_RECORD_LAYER *rl,
                                      EVP_CIPHER_CTX *ctx,
                                      const EVP_CIPHER *ciph,

diff --git a/ssl/record/methods/tls1_meth.c b/ssl/record/methods/tls1_meth.c
index 2e60778b72ee14e2c20cf48f13168ac193c1d7fd..0b972e975ced5e5b9a03d13b54982b0c0eb7006d 100644 (file)
--- a/ssl/record/methods/tls1_meth.c
+++ b/ssl/record/methods/tls1_meth.c
@@ -198,7 +198,7 @@ static int tls1_cipher(OSSL_RECORD_LAYER *rl, SSL3_RECORD *recs, size_t n_recs,
 
         enc = EVP_CIPHER_CTX_get0_cipher(s->enc_write_ctx);
         /* For TLSv1.1 and later explicit IV */
-        if (SSL_USE_EXPLICIT_IV(s)
+        if (RLAYER_USE_EXPLICIT_IV(s)
             && EVP_CIPHER_get_mode(enc) == EVP_CIPH_CBC_MODE)
             ivlen = EVP_CIPHER_get_iv_length(enc);
         else
@@ -399,7 +399,7 @@ static int tls1_cipher(OSSL_RECORD_LAYER *rl, SSL3_RECORD *recs, size_t n_recs,
             } else if (EVP_CIPHER_get_mode(enc) == EVP_CIPH_CCM_MODE) {
                     recs[0].data += EVP_CCM_TLS_EXPLICIT_IV_LEN;
                     recs[0].input += EVP_CCM_TLS_EXPLICIT_IV_LEN;
-            } else if (bs != 1 && SSL_USE_EXPLICIT_IV(s)) {
+            } else if (bs != 1 && RLAYER_USE_EXPLICIT_IV(rl)) {
                 recs[0].data += bs;
                 recs[0].input += bs;
                 recs[0].orig_len -= bs;
@@ -449,7 +449,7 @@ static int tls1_cipher(OSSL_RECORD_LAYER *rl, SSL3_RECORD *recs, size_t n_recs,
                     recs[ctr].data += EVP_CCM_TLS_EXPLICIT_IV_LEN;
                     recs[ctr].input += EVP_CCM_TLS_EXPLICIT_IV_LEN;
                     recs[ctr].length -= EVP_CCM_TLS_EXPLICIT_IV_LEN;
-                } else if (bs != 1 && SSL_USE_EXPLICIT_IV(s)) {
+                } else if (bs != 1 && RLAYER_USE_EXPLICIT_IV(rl)) {
                     if (recs[ctr].length < bs)
                         return 0;
                     recs[ctr].data += bs;

diff --git a/ssl/record/methods/tls_common.c b/ssl/record/methods/tls_common.c
index 681a830eb9f955a78bbbb38adf6ea4f279abd8d2..accb5b112091327a264d6be35c2564d5ab50af95 100644 (file)
--- a/ssl/record/methods/tls_common.c
+++ b/ssl/record/methods/tls_common.c
@@ -608,7 +608,7 @@ static int tls_get_more_records(OSSL_RECORD_LAYER *rl,
         rl->is_first_record = 0;
     } while (num_recs < max_recs
              && thisrr->type == SSL3_RT_APPLICATION_DATA
-             && SSL_USE_EXPLICIT_IV(s)
+             && RLAYER_USE_EXPLICIT_IV(rl)
              && rl->enc_read_ctx != NULL
              && (EVP_CIPHER_get_flags(EVP_CIPHER_CTX_get0_cipher(rl->enc_read_ctx))
                  & EVP_CIPH_FLAG_PIPELINE) != 0