@@ -181,6 +181,8 @@ int quic_set_encryption_secrets(SSL *ssl, OSSL_ENCRYPTION_LEVEL level)
181
181
{
182
182
uint8_t * read_secret = NULL ;
183
183
uint8_t * write_secret = NULL ;
184
+ size_t len ;
185
+ const EVP_MD * md ;
184
186
static const unsigned char zeros [EVP_MAX_MD_SIZE ];
185
187
186
188
if (!SSL_IS_QUIC (ssl ))
@@ -202,22 +204,43 @@ int quic_set_encryption_secrets(SSL *ssl, OSSL_ENCRYPTION_LEVEL level)
202
204
default :
203
205
return 1 ;
204
206
}
207
+
208
+ md = ssl_handshake_md (ssl );
209
+ if (md == NULL ) {
210
+ /* May not have selected cipher, yet */
211
+ const SSL_CIPHER * c = NULL ;
212
+
213
+ if (ssl -> session != NULL )
214
+ c = SSL_SESSION_get0_cipher (ssl -> session );
215
+ else if (ssl -> psksession != NULL )
216
+ c = SSL_SESSION_get0_cipher (ssl -> psksession );
217
+
218
+ if (c != NULL )
219
+ md = SSL_CIPHER_get_handshake_digest (c );
220
+ }
221
+
222
+ if ((len = EVP_MD_size (md )) <= 0 ) {
223
+ SSLfatal (ssl , SSL_AD_INTERNAL_ERROR , SSL_F_QUIC_SET_ENCRYPTION_SECRETS ,
224
+ ERR_R_INTERNAL_ERROR );
225
+ return 0 ;
226
+ }
227
+
205
228
/* In some cases, we want to set the secret only when BOTH are non-zero */
206
229
if (read_secret != NULL && write_secret != NULL
207
- && !memcmp (read_secret , zeros , ssl -> quic_len )
208
- && !memcmp (write_secret , zeros , ssl -> quic_len ))
230
+ && !memcmp (read_secret , zeros , len )
231
+ && !memcmp (write_secret , zeros , len ))
209
232
return 1 ;
210
233
211
234
if (ssl -> server ) {
212
235
if (!ssl -> quic_method -> set_encryption_secrets (ssl , level , read_secret ,
213
- write_secret , ssl -> quic_len )) {
236
+ write_secret , len )) {
214
237
SSLfatal (ssl , SSL_AD_INTERNAL_ERROR , SSL_F_QUIC_SET_ENCRYPTION_SECRETS ,
215
238
ERR_R_INTERNAL_ERROR );
216
239
return 0 ;
217
240
}
218
241
} else {
219
242
if (!ssl -> quic_method -> set_encryption_secrets (ssl , level , write_secret ,
220
- read_secret , ssl -> quic_len )) {
243
+ read_secret , len )) {
221
244
SSLfatal (ssl , SSL_AD_INTERNAL_ERROR , SSL_F_QUIC_SET_ENCRYPTION_SECRETS ,
222
245
ERR_R_INTERNAL_ERROR );
223
246
return 0 ;
0 commit comments