-</code></pre></div><h2 id=description>DESCRIPTION<a class=headerlink href=#description title="Permanent link">¶</a></h2><p>SSL_CTX_set_record_padding_callback() or SSL_set_record_padding_callback() can be used to assign a callback function <em>cb</em> to specify the padding for TLS 1.3 records. The value set in <strong>ctx</strong> is copied to a new SSL by SSL_new(). Kernel TLS is not possible if the record padding callback is set, and the callback function cannot be set if Kernel TLS is already configured for the current SSL object.</p><p>SSL_CTX_set_record_padding_callback_arg() and SSL_set_record_padding_callback_arg() assign a value <strong>arg</strong> that is passed to the callback when it is invoked. The value set in <strong>ctx</strong> is copied to a new SSL by SSL_new().</p><p>SSL_CTX_get_record_padding_callback_arg() and SSL_get_record_padding_callback_arg() retrieve the <strong>arg</strong> value that is passed to the callback.</p><p>SSL_CTX_set_block_padding() and SSL_set_block_padding() pads the record to a multiple of the <strong>block_size</strong>. A <strong>block_size</strong> of 0 or 1 disables block padding. The limit of <strong>block_size</strong> is SSL3_RT_MAX_PLAIN_LENGTH.</p><p>SSL_CTX_set_block_padding_ex() and SSL_set_block_padding_ex() do similarly but allow the caller to separately specify the padding block size to be applied to handshake and application data messages.</p><p>The callback is invoked for every record before encryption. The <strong>type</strong> parameter is the TLS record type that is being processed; may be one of SSL3_RT_APPLICATION_DATA, SSL3_RT_HANDSHAKE, or SSL3_RT_ALERT. The <strong>len</strong> parameter is the current plaintext length of the record before encryption. The <strong>arg</strong> parameter is the value set via SSL_CTX_set_record_padding_callback_arg() or SSL_set_record_padding_callback_arg().</p><p>These functions cannot be used with QUIC SSL objects. SSL_set_record_padding_callback() and SSL_set_block_padding() fail if called on a QUIC SSL object.</p><h2 id=return-values>RETURN VALUES<a class=headerlink href=#return-values title="Permanent link">¶</a></h2><p>The SSL_CTX_get_record_padding_callback_arg() and SSL_get_record_padding_callback_arg() functions return the <strong>arg</strong> value assigned in the corresponding set functions.</p><p>The SSL_CTX_set_block_padding() and SSL_set_block_padding() functions return 1 on success or 0 if <strong>block_size</strong> is too large.</p><p>The <strong>cb</strong> returns the number of padding bytes to add to the record. A return of 0 indicates no padding will be added. A return value that causes the record to exceed the maximum record size (SSL3_RT_MAX_PLAIN_LENGTH) will pad out to the maximum record size.</p><p>The SSL_CTX_get_record_padding_callback_arg() function returns 1 on success or 0 if the callback function is not set because Kernel TLS is configured for the SSL object.</p><h2 id=notes>NOTES<a class=headerlink href=#notes title="Permanent link">¶</a></h2><p>The default behavior is to add no padding to the record.</p><p>A user-supplied padding callback function will override the behavior set by SSL_set_block_padding() or SSL_CTX_set_block_padding(). Setting the user-supplied callback to NULL will restore the configured block padding behavior.</p><p>These functions only apply to TLS 1.3 records being written.</p><p>Padding bytes are not added in constant-time.</p><h2 id=see-also>SEE ALSO<a class=headerlink href=#see-also title="Permanent link">¶</a></h2><p><a href=../../man7/ossl-guide-libssl-introduction/ >ssl(7)</a>, <a href=../SSL_new/ >SSL_new(3)</a></p><h2 id=history>HISTORY<a class=headerlink href=#history title="Permanent link">¶</a></h2><p>The record padding API was added for TLS 1.3 support in OpenSSL 1.1.1.</p><p>The return type of SSL_CTX_set_record_padding_callback() function was changed to int in OpenSSL 3.0.</p><h2 id=copyright>COPYRIGHT<a class=headerlink href=#copyright title="Permanent link">¶</a></h2><p>Copyright 2017-2024 The OpenSSL Project Authors. All Rights Reserved.</p><p>Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <a href=https://www.openssl.org/source/license.html>https://www.openssl.org/source/license.html</a>.</p></article></div><script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script></div></main><footer class=md-footer><div class="md-footer-meta md-typeset"><div class="md-footer-meta__inner md-grid"><div class=md-copyright> Made with <a href=https://squidfunk.github.io/mkdocs-material/ target=_blank rel=noopener> Material for MkDocs </a></div></div></div></footer></div><div class=md-dialog data-md-component=dialog><div class="md-dialog__inner md-typeset"></div></div><script id=__config type=application/json>{"base": "../..", "features": ["navigation.indexes", "navigation.instant", "navigation.path", "navigation.prune", "navigation.tabs", "navigation.tabs.sticky", "navigation.tracking", "search.suggest", "toc.follow"], "search": "../../assets/javascripts/workers/search.b8dbb3d2.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}, "version": {"default": "master", "provider": "mike"}}</script><script src=../../assets/javascripts/bundle.ad660dcc.min.js></script></body></html>
0 commit comments