commit f2f4a4eee5a3979e8093bc6ffe713baa663a6437
author Frédéric Lécaille <flecaille@haproxy.com> Tue Apr 05 12:18:46 2022 +0200
committer Amaury Denoyelle <adenoyelle@haproxy.com> Fri Apr 08 15:38:29 2022 +0200
tree d846c914403ae4af586f0f0a86b0386fb8fd099e
parent f4605748f44dac766e910138813b76a0be9f3635

MINOR: quic_tls: Stop hardcoding cipher IV lengths

For QUIC AEAD usage, the number of bytes for the IVs is always 12.

src/quic_tls.c

diff --git a/src/quic_tls.c b/src/quic_tls.c
index cff461c..f8d11a3 100644
--- a/src/quic_tls.c
+++ b/src/quic_tls.c
@@ -317,7 +317,7 @@
 		return 0;
 
 	if (!EVP_DecryptInit_ex(ctx, aead, NULL, NULL, NULL) ||
-	    !EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_IVLEN, 12, NULL) ||
+	    !EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_IVLEN, QUIC_TLS_IV_LEN, NULL) ||
 	    (aead_nid == NID_aes_128_ccm &&
 	     !EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, QUIC_TLS_TAG_LEN, NULL)) ||
 	    !EVP_DecryptInit_ex(ctx, NULL, NULL, key, NULL))
@@ -346,7 +346,7 @@
 		return 0;
 
 	if (!EVP_EncryptInit_ex(ctx, aead, NULL, NULL, NULL) ||
-	    !EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_IVLEN, 12, NULL) ||
+	    !EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_IVLEN, QUIC_TLS_IV_LEN, NULL) ||
 	    (aead_nid == NID_aes_128_ccm &&
 	     !EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, QUIC_TLS_TAG_LEN, NULL)) ||
 	    !EVP_EncryptInit_ex(ctx, NULL, NULL, key, NULL))

src/xprt_quic.c

diff --git a/src/xprt_quic.c b/src/xprt_quic.c
index 01bf9e0..d120efc 100644
--- a/src/xprt_quic.c
+++ b/src/xprt_quic.c
@@ -1334,7 +1334,7 @@
                                unsigned char *aad, size_t aad_len, uint64_t pn,
                                struct quic_tls_ctx *tls_ctx, struct quic_conn *qc)
 {
-	unsigned char iv[12];
+	unsigned char iv[QUIC_TLS_IV_LEN];
 	unsigned char *tx_iv = tls_ctx->tx.iv;
 	size_t tx_iv_sz = tls_ctx->tx.ivlen;
 	struct enc_debug_info edi;
@@ -1364,7 +1364,7 @@
 static int qc_pkt_decrypt(struct quic_rx_packet *pkt, struct quic_enc_level *qel)
 {
 	int ret, kp_changed;
-	unsigned char iv[12];
+	unsigned char iv[QUIC_TLS_IV_LEN];
 	struct quic_tls_ctx *tls_ctx = &qel->tls_ctx;
 	unsigned char *rx_iv = tls_ctx->rx.iv;
 	size_t rx_iv_sz = tls_ctx->rx.ivlen;