Separated cipherspec checking and switching, allowing us to defer the second

diff --git a/src/libtls/tls_fragmentation.c b/src/libtls/tls_fragmentation.c
index c42c16fb81f200a860c39882694d817e4e5172c5..0c3da71ad7b83f6b21992bf3838adfcf6f7da49f 100644 (file)
--- a/src/libtls/tls_fragmentation.c
+++ b/src/libtls/tls_fragmentation.c
@@ -251,8 +251,9 @@ METHOD(tls_fragmentation_t, process, status_t,
        switch (type)
        {
                case TLS_CHANGE_CIPHER_SPEC:
-                       if (this->handshake->change_cipherspec(this->handshake))
+                       if (this->handshake->cipherspec_changed(this->handshake, TRUE))
                        {
+                               this->handshake->change_cipherspec(this->handshake, TRUE);
                                status = NEED_MORE;
                                break;
                        }
@@ -397,8 +398,9 @@ METHOD(tls_fragmentation_t, build, status_t,
        }
        if (!this->output.len)
        {
-               if (this->handshake->cipherspec_changed(this->handshake))
+               if (this->handshake->cipherspec_changed(this->handshake, FALSE))
                {
+                       this->handshake->change_cipherspec(this->handshake, FALSE);
                        *type = TLS_CHANGE_CIPHER_SPEC;
                        *data = chunk_clone(chunk_from_chars(0x01));
                        return NEED_MORE;

diff --git a/src/libtls/tls_handshake.h b/src/libtls/tls_handshake.h
index 4f6af2a543b1a3958f45e28d5522f01efd2d042f..bea0024eb759f3b10c25eb4628f02570c5b6f9f2 100644 (file)
--- a/src/libtls/tls_handshake.h
+++ b/src/libtls/tls_handshake.h
@@ -62,18 +62,19 @@ struct tls_handshake_t {
                                          tls_handshake_type_t *type, bio_writer_t *writer);
 
        /**
-        * Check if the cipher spec for outgoing messages has changed.
+        * Check if the cipher spec should be changed for outgoing messages.
         *
-        * @return                      TRUE if cipher spec changed
+        * @param inbound       TRUE to check for inbound cipherspec change
+        * @return                      TRUE if cipher spec should be changed
         */
-       bool (*cipherspec_changed)(tls_handshake_t *this);
+       bool (*cipherspec_changed)(tls_handshake_t *this, bool inbound);
 
        /**
-        * Change the cipher spec for incoming messages.
+        * Change the cipher for a direction.
         *
-        * @return                      TRUE if cipher spec changed
+        * @param inbound       TRUE to change inbound cipherspec, FALSE for outbound
         */
-       bool (*change_cipherspec)(tls_handshake_t *this);
+       void (*change_cipherspec)(tls_handshake_t *this, bool inbound);
 
        /**
         * Check if the finished message was decoded successfully.

diff --git a/src/libtls/tls_peer.c b/src/libtls/tls_peer.c
index d3b5ff0aac5c3e6719c8857be494a5dc593d4523..de878c0a5a0fd052f5c7ec5c797900207e691666 100644 (file)
--- a/src/libtls/tls_peer.c
+++ b/src/libtls/tls_peer.c
@@ -1042,28 +1042,34 @@ METHOD(tls_handshake_t, build, status_t,
 }
 
 METHOD(tls_handshake_t, cipherspec_changed, bool,
-       private_tls_peer_t *this)
+       private_tls_peer_t *this, bool inbound)
 {
-       if ((this->peer && this->state == STATE_VERIFY_SENT) ||
-          (!this->peer && this->state == STATE_KEY_EXCHANGE_SENT))
+       if (inbound)
        {
-               this->crypto->change_cipher(this->crypto, FALSE);
-               this->state = STATE_CIPHERSPEC_CHANGED_OUT;
-               return TRUE;
+               return this->state == STATE_FINISHED_SENT;
+       }
+       else
+       {
+               if (this->peer)
+               {
+                       return this->state == STATE_VERIFY_SENT;
+               }
+               return this->state == STATE_KEY_EXCHANGE_SENT;
        }
-       return FALSE;
 }
 
-METHOD(tls_handshake_t, change_cipherspec, bool,
-       private_tls_peer_t *this)
+METHOD(tls_handshake_t, change_cipherspec, void,
+       private_tls_peer_t *this, bool inbound)
 {
-       if (this->state == STATE_FINISHED_SENT)
+       this->crypto->change_cipher(this->crypto, inbound);
+       if (inbound)
        {
-               this->crypto->change_cipher(this->crypto, TRUE);
                this->state = STATE_CIPHERSPEC_CHANGED_IN;
-               return TRUE;
        }
-       return FALSE;
+       else
+       {
+               this->state = STATE_CIPHERSPEC_CHANGED_OUT;
+       }
 }
 
 METHOD(tls_handshake_t, finished, bool,

diff --git a/src/libtls/tls_server.c b/src/libtls/tls_server.c
index d69ada85945ab7c7cb6f43126a7e06380ea370bc..e446a96222c6f5a8c82d1ec1a12730f3fd08a9b6 100644 (file)
--- a/src/libtls/tls_server.c
+++ b/src/libtls/tls_server.c
@@ -956,28 +956,35 @@ METHOD(tls_handshake_t, build, status_t,
 }
 
 METHOD(tls_handshake_t, cipherspec_changed, bool,
-       private_tls_server_t *this)
+       private_tls_server_t *this, bool inbound)
 {
-       if (this->state == STATE_FINISHED_RECEIVED)
+       if (inbound)
        {
-               this->crypto->change_cipher(this->crypto, FALSE);
-               this->state = STATE_CIPHERSPEC_CHANGED_OUT;
-               return TRUE;
+               if (this->peer)
+               {
+                       return this->state == STATE_CERT_VERIFY_RECEIVED;
+               }
+               return this->state == STATE_KEY_EXCHANGE_RECEIVED;
+       }
+       else
+       {
+               return this->state == STATE_FINISHED_RECEIVED;
        }
        return FALSE;
 }
 
-METHOD(tls_handshake_t, change_cipherspec, bool,
-       private_tls_server_t *this)
+METHOD(tls_handshake_t, change_cipherspec, void,
+       private_tls_server_t *this, bool inbound)
 {
-       if ((this->peer && this->state == STATE_CERT_VERIFY_RECEIVED) ||
-          (!this->peer && this->state == STATE_KEY_EXCHANGE_RECEIVED))
+       this->crypto->change_cipher(this->crypto, inbound);
+       if (inbound)
        {
-               this->crypto->change_cipher(this->crypto, TRUE);
                this->state = STATE_CIPHERSPEC_CHANGED_IN;
-               return TRUE;
        }
-       return FALSE;
+       else
+       {
+               this->state = STATE_CIPHERSPEC_CHANGED_OUT;
+       }
 }
 
 METHOD(tls_handshake_t, finished, bool,