Make sure to remove bad sessions in SSL_clear() (found by Yoram Zahavi).

[openssl.git] / ssl / ssl_lib.c

diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c
index 72821a1fce6a138067eaed4e48b8a020cb33dfd4..2b60d7288feb7f0c2607ea6b68c9eeb947a5383e 100644 (file)
--- a/ssl/ssl_lib.c
+++ b/ssl/ssl_lib.c
@@ -136,7 +136,6 @@ OPENSSL_GLOBAL SSL3_ENC_METHOD ssl3_undef_enc_method={
 
 int SSL_clear(SSL *s)
        {
-       int state;
 
        if (s->method == NULL)
                {
@@ -161,9 +160,14 @@ int SSL_clear(SSL *s)
                }
 #endif
 
-       state=s->state; /* Keep to check if we throw away the session-id */
        s->type=0;
 
+       if (ssl_clear_bad_session(s))
+               {
+               SSL_SESSION_free(s->session);
+               s->session=NULL;
+               }
+
        s->state=SSL_ST_BEFORE|((s->server)?SSL_ST_ACCEPT:SSL_ST_CONNECT);
 
        s->version=s->method->version;
@@ -182,12 +186,6 @@ int SSL_clear(SSL *s)
 
        ssl_clear_cipher_ctx(s);
 
-       if (ssl_clear_bad_session(s))
-               {
-               SSL_SESSION_free(s->session);
-               s->session=NULL;
-               }
-
        s->first_packet=0;
 
 #if 1
@@ -891,7 +889,10 @@ int SSL_shutdown(SSL *s)
 
 int SSL_renegotiate(SSL *s)
        {
-       s->new_session=1;
+       if (s->new_session == 0)
+               {
+               s->new_session=1;
+               }
        return(s->method->ssl_renegotiate(s));
        }
 
@@ -1313,7 +1314,7 @@ SSL_CTX *SSL_CTX_new(SSL_METHOD *meth)
        ret->key_arg=NULL;
        ret->s2->conn_id=NULL; */
 
-       ret->info_callback=0;
+       ret->info_callback=NULL;
 
        ret->app_verify_callback=0;
        ret->app_verify_arg=NULL;
@@ -1643,9 +1644,10 @@ void ssl_update_cache(SSL *s,int mode)
         * and it would be rather hard to do anyway :-) */
        if (s->session->session_id_length == 0) return;
 
-       if ((s->ctx->session_cache_mode & mode)
-               && (!s->hit)
-               && SSL_CTX_add_session(s->ctx,s->session)
+       i=s->ctx->session_cache_mode;
+       if ((i & mode) && (!s->hit)
+               && ((i & SSL_SESS_CACHE_NO_INTERNAL_LOOKUP)
+                   || SSL_CTX_add_session(s->ctx,s->session))
                && (s->ctx->new_session_cb != NULL))
                {
                CRYPTO_add(&s->session->references,1,CRYPTO_LOCK_SSL_SESSION);
@@ -1654,7 +1656,6 @@ void ssl_update_cache(SSL *s,int mode)
                }
 
        /* auto flush every 255 connections */
-       i=s->ctx->session_cache_mode;
        if ((!(i & SSL_SESS_CACHE_NO_AUTO_CLEAR)) &&
                ((i & mode) == mode))
                {
@@ -2136,14 +2137,15 @@ int SSL_CTX_load_verify_locations(SSL_CTX *ctx, const char *CAfile,
        }
 #endif
 
-void SSL_set_info_callback(SSL *ssl,void (*cb)())
+void SSL_set_info_callback(SSL *ssl,
+                          void (*cb)(const SSL *ssl,int type,int val))
        {
        ssl->info_callback=cb;
        }
 
-void (*SSL_get_info_callback(SSL *ssl))(void)
+void (*SSL_get_info_callback(SSL *ssl))(const SSL *ssl,int type,int val)
        {
-       return((void (*)())ssl->info_callback);
+       return ssl->info_callback;
        }
 
 int SSL_state(SSL *ssl)