tree 5c46ef08688f9f98c35a13125503a836473c699b
parent 40dd94116ba03678226443ba20c5887459c9bf16
author David Benjamin <davidben@google.com> 1727216930 -0400
committer Boringssl LUCI CQ <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com> 1727472071 +0000

Do not implement SSL_get_traffic_secrets for QUIC and DTLS

This is implemented by looking at the saved current read and write
secrets. That state is used by KeyUpdate and this logic.

As part of tidying up the epoch state for DTLS 1.3, I ran into that
state because DTLS does not have a single current read/write secret. But
it also isn't ideal for QUIC. For QUIC, the problem is that QUIC drives
KeyUpdates outside of TLS, but that means we'll just hold on to the
initial traffic secrets in memory, which can derive all the rotated
ones.

So let's for now, just limit this API to TLS. We can decide later
whether to also allow it for DTLS (after very carefully defining what
the "current" epoch means). I don't think we'd ever allow it for QUIC
given how QUIC is intended to work.

(This change doesn't actually fix any of the internal storage, just
breaks the API that would leak it. Changing the internal storage will be
in later CLs.)

Bug: 42290608
Change-Id: I5d4b170a5a80a7cc0657a957ae20135d742891d2
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/71647
Reviewed-by: Bob Beck <bbe@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
Auto-Submit: David Benjamin <davidben@google.com>