Make use of SSL_IS_DTLS, SSL_USE_EXPLICIT_IV, SSL_USE_SIGALGS and

SSL_USE_TLS1_2_CIPHERS.

Largely based on OpenSSL head.

1 files changed, 13 insertions, 15 deletions

diff --git a/src/lib/libssl/s3_pkt.c b/src/lib/libssl/s3_pkt.c
index 3a167f058c..b8be8b5255 100644
--- a/src/lib/libssl/s3_pkt.c
+++ b/src/lib/libssl/s3_pkt.c
@@ -178,7 +178,7 @@ ssl3_read_n(SSL *s, int n, int max, int extend)
         /* For DTLS/UDP reads should not span multiple packets
          * because the read operation returns the whole packet
          * at once (as long as it fits into the buffer). */
-        if (SSL_version(s) == DTLS1_VERSION || SSL_version(s) == DTLS1_BAD_VER) {
+        if (SSL_IS_DTLS(s)) {
                 if (left > 0 && n > left)
                         n = left;
         }
@@ -238,18 +238,17 @@ ssl3_read_n(SSL *s, int n, int max, int extend)
                 if (i <= 0) {
                         rb->left = left;
                         if (s->mode & SSL_MODE_RELEASE_BUFFERS &&
-                            SSL_version(s) != DTLS1_VERSION &&
-                            SSL_version(s) != DTLS1_BAD_VER)
+                            !SSL_IS_DTLS(s)) {
                                 if (len + left == 0)
                                         ssl3_release_read_buffer(s);
+                        }
                         return (i);
                 }
                 left += i;
                 /* reads should *never* span multiple packets for DTLS because
                  * the underlying transport protocol is message oriented as opposed
                  * to byte oriented as in the TLS case. */
-                if (SSL_version(s) == DTLS1_VERSION ||
-                    SSL_version(s) == DTLS1_BAD_VER) {
+                if (SSL_IS_DTLS(s)) {
                         if (n > left)
                                 n = left; /* makes the while condition false */
                 }
@@ -722,10 +721,10 @@ do_ssl3_write(SSL *s, int type, const unsigned char *buf,
 
         /* field where we are to write out packet length */
         plen = p;
-
         p += 2;
-        /* Explicit IV length, block ciphers and TLS version 1.1 or later */
-        if (s->enc_write_ctx && s->version >= TLS1_1_VERSION) {
+
+        /* Explicit IV length. */
+        if (s->enc_write_ctx && SSL_USE_EXPLICIT_IV(s)) {
                 int mode = EVP_CIPHER_CTX_mode(s->enc_write_ctx);
                 if (mode == EVP_CIPH_CBC_MODE) {
                         eivlen = EVP_CIPHER_CTX_iv_length(s->enc_write_ctx);
@@ -844,18 +843,17 @@ ssl3_write_pending(SSL *s, int type, const unsigned char *buf,
                         wb->left = 0;
                         wb->offset += i;
                         if (s->mode & SSL_MODE_RELEASE_BUFFERS &&
-                            SSL_version(s) != DTLS1_VERSION &&
-                            SSL_version(s) != DTLS1_BAD_VER)
+                            !SSL_IS_DTLS(s))
                                 ssl3_release_write_buffer(s);
                         s->rwstate = SSL_NOTHING;
                         return (s->s3->wpend_ret);
                 } else if (i <= 0) {
-                        if (s->version == DTLS1_VERSION ||
-                            s->version == DTLS1_BAD_VER) {
-                                /* For DTLS, just drop it. That's kind of the whole
-                                   point in using a datagram service */
+                        /*
+                         * For DTLS, just drop it. That's kind of the
+                         * whole point in using a datagram service.
+                         */
+                        if (SSL_IS_DTLS(s))
                                 wb->left = 0;
-                        }
                         return (i);
                 }
                 wb->offset += i;