libtls: Check for CHANGE_CIPHER_SPEC type only if upper layer returns NEED_MORE
authorMartin Willi <martin@revosec.ch>
Thu, 8 Jan 2015 10:06:45 +0000 (11:06 +0100)
committerMartin Willi <martin@revosec.ch>
Mon, 12 Jan 2015 13:18:24 +0000 (14:18 +0100)
A type is returned only if upper layers successfully created a record, that is
returns NEED_MORE. If we do not check for the return value, we might check a
previous record or the uninitialized type variable and falsely reset the
sequence number.

src/libtls/tls_protection.c

index b016db2..e73fedc 100644 (file)
@@ -101,14 +101,13 @@ METHOD(tls_protection_t, build, status_t,
        status_t status;
 
        status = this->compression->build(this->compression, type, data);
-       if (*type == TLS_CHANGE_CIPHER_SPEC)
-       {
-               this->seq_out = 0;
-               return status;
-       }
-
        if (status == NEED_MORE)
        {
+               if (*type == TLS_CHANGE_CIPHER_SPEC)
+               {
+                       this->seq_out = 0;
+                       return status;
+               }
                if (this->aead_out)
                {
                        if (!this->aead_out->encrypt(this->aead_out, this->version,