1 files changed, 6 insertions, 97 deletions

diff --git a/src/lib/libssl/ssl_pkt.c b/src/lib/libssl/ssl_pkt.c
index 5c9b3be2ff..c9c86471d3 100644
--- a/src/lib/libssl/ssl_pkt.c
+++ b/src/lib/libssl/ssl_pkt.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_pkt.c,v 1.30 2020/08/09 16:54:16 jsing Exp $ */
+/* $OpenBSD: ssl_pkt.c,v 1.31 2020/08/30 15:40:20 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -617,100 +617,6 @@ ssl3_write_bytes(SSL *s, int type, const void *buf_, int len)
 }
 
 static int
-ssl3_create_record(SSL *s, CBB *cbb, uint16_t version, uint8_t type,
-    const unsigned char *buf, unsigned int len)
-{
-        SSL3_RECORD_INTERNAL *wr = &(S3I(s)->wrec);
-        SSL_SESSION *sess = s->session;
-        int block_size = 0, eivlen = 0, mac_size = 0;
-        size_t pad_len, record_len;
-        CBB fragment;
-        uint8_t *p;
-
-        if (sess != NULL && s->internal->enc_write_ctx != NULL &&
-            EVP_MD_CTX_md(s->internal->write_hash) != NULL) {
-                if ((mac_size = EVP_MD_CTX_size(s->internal->write_hash)) < 0)
-                        goto err;
-        }
-
-        /* Explicit IV length. */
-        if (s->internal->enc_write_ctx && SSL_USE_EXPLICIT_IV(s)) {
-                int mode = EVP_CIPHER_CTX_mode(s->internal->enc_write_ctx);
-                if (mode == EVP_CIPH_CBC_MODE) {
-                        eivlen = EVP_CIPHER_CTX_iv_length(s->internal->enc_write_ctx);
-                        if (eivlen <= 1)
-                                eivlen = 0;
-                }
-        } else if (s->internal->aead_write_ctx != NULL &&
-            s->internal->aead_write_ctx->variable_nonce_in_record) {
-                eivlen = s->internal->aead_write_ctx->variable_nonce_len;
-        }
-
-        /* Determine length of record fragment. */
-        record_len = eivlen + len + mac_size;
-        if (s->internal->enc_write_ctx != NULL) {
-                block_size = EVP_CIPHER_CTX_block_size(s->internal->enc_write_ctx);
-                if (block_size <= 0 || block_size > EVP_MAX_BLOCK_LENGTH)
-                        goto err;
-                if (block_size > 1) {
-                        pad_len = block_size - (record_len % block_size);
-                        record_len += pad_len;
-                }
-        } else if (s->internal->aead_write_ctx != NULL) {
-                record_len += s->internal->aead_write_ctx->tag_len;
-        }
-
-        /* Write the header. */
-        if (!CBB_add_u8(cbb, type))
-                goto err;
-        if (!CBB_add_u16(cbb, version))
-                goto err;
-        if (!CBB_add_u16_length_prefixed(cbb, &fragment))
-                goto err;
-        if (!CBB_add_space(&fragment, &p, record_len))
-                goto err;
-
-        /* Set up the record. */
-        wr->type = type;
-        wr->data = p + eivlen;
-        wr->length = (int)len;
-        wr->input = wr->data;
-
-        memcpy(wr->data, buf, len);
-
-        if (mac_size != 0) {
-                if (tls1_mac(s, &(p[wr->length + eivlen]), 1) < 0)
-                        goto err;
-                wr->length += mac_size;
-        }
-
-        wr->data = p;
-        wr->input = p;
-        wr->length += eivlen;
-
-        if (tls1_enc(s, 1) != 1)
-                goto err;
-
-        if (wr->length != record_len)
-                goto err;
-
-        if (!CBB_flush(cbb))
-                goto err;
-
-        /*
-         * We should now have wr->data pointing to the encrypted data,
-         * which is wr->length long.
-         */
-        wr->type = type; /* not needed but helps for debugging */
-        wr->length += SSL3_RT_HEADER_LENGTH;
-
-        return 1;
-
- err:
-        return 0;
-}
-
-static int
 do_ssl3_write(SSL *s, int type, const unsigned char *buf, unsigned int len)
 {
         SSL3_BUFFER_INTERNAL *wb = &(S3I(s)->wbuf);
@@ -785,13 +691,16 @@ do_ssl3_write(SSL *s, int type, const unsigned char *buf, unsigned int len)
         if (!CBB_init_fixed(&cbb, wb->buf + align, wb->len - align))
                 goto err;
 
+        tls12_record_layer_set_version(s->internal->rl, version);
+
         if (need_empty_fragment) {
-                if (!ssl3_create_record(s, &cbb, version, type, buf, 0))
+                if (!tls12_record_layer_seal_record(s->internal->rl, type,
+                    buf, 0, &cbb))
                         goto err;
                 S3I(s)->empty_fragment_done = 1;
         }
 
-        if (!ssl3_create_record(s, &cbb, version, type, buf, len))
+        if (!tls12_record_layer_seal_record(s->internal->rl, type, buf, len, &cbb))
                 goto err;
 
         if (!CBB_finish(&cbb, NULL, &out_len))