Make sure that exporting keying material is allowed
[openssl.git] / ssl / tls13_enc.c
index f555df5..05355fb 100644 (file)
@@ -666,7 +666,7 @@ int tls13_export_keying_material(SSL *s, unsigned char *out, size_t olen,
     unsigned int hashsize, datalen;
     int ret = 0;
 
-    if (ctx == NULL)
+    if (ctx == NULL || !ossl_statem_export_allowed(s))
         goto err;
 
     if (!use_context)