Avoid including cryptlib.h, it's not really needed.

[openssl.git] / ssl / ssl_lib.c

diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c
index eda3cfd11631854399b85f41dbf3e13108b08080..b7b2e4086a250fc65da73476600035d14c92e6a0 100644 (file)
--- a/ssl/ssl_lib.c
+++ b/ssl/ssl_lib.c
@@ -277,6 +277,7 @@ SSL *SSL_new(SSL_CTX *ctx)
        s->verify_mode=ctx->verify_mode;
        s->verify_depth=ctx->verify_depth;
        s->sid_ctx_length=ctx->sid_ctx_length;
+       OPENSSL_assert(s->sid_ctx_length <= sizeof s->sid_ctx);
        memcpy(&s->sid_ctx,&ctx->sid_ctx,sizeof(s->sid_ctx));
        s->verify_callback=ctx->default_verify_callback;
        s->generate_session_id=ctx->generate_session_id;
@@ -318,7 +319,7 @@ err:
 int SSL_CTX_set_session_id_context(SSL_CTX *ctx,const unsigned char *sid_ctx,
                                   unsigned int sid_ctx_len)
     {
-    if(sid_ctx_len > SSL_MAX_SID_CTX_LENGTH)
+    if(sid_ctx_len > sizeof ctx->sid_ctx)
        {
        SSLerr(SSL_F_SSL_CTX_SET_SESSION_ID_CONTEXT,SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG);
        return 0;
@@ -368,6 +369,10 @@ int SSL_has_matching_session_id(const SSL *ssl, const unsigned char *id,
         * any new session built out of this id/id_len and the ssl_version in
         * use by this SSL. */
        SSL_SESSION r, *p;
+
+       if(id_len > sizeof r.session_id)
+               return 0;
+
        r.ssl_version = ssl->version;
        r.session_id_length = id_len;
        memcpy(r.session_id, id, id_len);
@@ -471,6 +476,11 @@ void SSL_free(SSL *s)
 
        if (s->method != NULL) s->method->ssl_free(s);
 
+#ifndef        OPENSSL_NO_KRB5
+       if (s->kssl_ctx != NULL)
+               kssl_ctx_free(s->kssl_ctx);
+#endif /* OPENSSL_NO_KRB5 */
+
        OPENSSL_free(s);
        }
 
@@ -1067,14 +1077,17 @@ int ssl_cipher_ptr_id_cmp(const SSL_CIPHER * const *ap,
  * preference */
 STACK_OF(SSL_CIPHER) *SSL_get_ciphers(SSL *s)
        {
-       if ((s != NULL) && (s->cipher_list != NULL))
-               {
-               return(s->cipher_list);
-               }
-       else if ((s->ctx != NULL) &&
-               (s->ctx->cipher_list != NULL))
+       if (s != NULL)
                {
-               return(s->ctx->cipher_list);
+               if (s->cipher_list != NULL)
+                       {
+                       return(s->cipher_list);
+                       }
+               else if ((s->ctx != NULL) &&
+                       (s->ctx->cipher_list != NULL))
+                       {
+                       return(s->ctx->cipher_list);
+                       }
                }
        return(NULL);
        }
@@ -1083,14 +1096,17 @@ STACK_OF(SSL_CIPHER) *SSL_get_ciphers(SSL *s)
  * algorithm id */
 STACK_OF(SSL_CIPHER) *ssl_get_ciphers_by_id(SSL *s)
        {
-       if ((s != NULL) && (s->cipher_list_by_id != NULL))
-               {
-               return(s->cipher_list_by_id);
-               }
-       else if ((s != NULL) && (s->ctx != NULL) &&
-               (s->ctx->cipher_list_by_id != NULL))
+       if (s != NULL)
                {
-               return(s->ctx->cipher_list_by_id);
+               if (s->cipher_list_by_id != NULL)
+                       {
+                       return(s->cipher_list_by_id);
+                       }
+               else if ((s->ctx != NULL) &&
+                       (s->ctx->cipher_list_by_id != NULL))
+                       {
+                       return(s->ctx->cipher_list_by_id);
+                       }
                }
        return(NULL);
        }
@@ -1409,13 +1425,24 @@ void SSL_CTX_free(SSL_CTX *a)
                abort(); /* ok */
                }
 #endif
-       CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_CTX, a, &a->ex_data);
 
+       /*
+        * Free internal session cache. However: the remove_cb() may reference
+        * the ex_data of SSL_CTX, thus the ex_data store can only be removed
+        * after the sessions were flushed.
+        * As the ex_data handling routines might also touch the session cache,
+        * the most secure solution seems to be: empty (flush) the cache, then
+        * free ex_data, then finally free the cache.
+        * (See ticket [openssl.org #212].)
+        */
        if (a->sessions != NULL)
-               {
                SSL_CTX_flush_sessions(a,0);
+
+       CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_CTX, a, &a->ex_data);
+
+       if (a->sessions != NULL)
                lh_free(a->sessions);
-               }
+
        if (a->cert_store != NULL)
                X509_STORE_free(a->cert_store);
        if (a->cipher_list != NULL)
@@ -1792,7 +1819,7 @@ void ssl_update_cache(SSL *s,int mode)
 
        i=s->ctx->session_cache_mode;
        if ((i & mode) && (!s->hit)
-               && ((i & SSL_SESS_CACHE_NO_INTERNAL_LOOKUP)
+               && ((i & SSL_SESS_CACHE_NO_INTERNAL_STORE)
                    || SSL_CTX_add_session(s->ctx,s->session))
                && (s->ctx->new_session_cb != NULL))
                {
@@ -2024,6 +2051,7 @@ SSL *SSL_dup(SSL *s)
                 * they should not both point to the same object,
                 * and thus we can't use SSL_copy_session_id. */
 
+               ret->method->ssl_free(ret);
                ret->method = s->method;
                ret->method->ssl_new(ret);
 
@@ -2178,6 +2206,20 @@ SSL_CIPHER *SSL_get_current_cipher(SSL *s)
        return(NULL);
        }
 
+const COMP_METHOD *SSL_get_current_compression(SSL *s)
+       {
+       if (s->compress != NULL)
+               return(s->compress->meth);
+       return(NULL);
+       }
+
+const COMP_METHOD *SSL_get_current_expansion(SSL *s)
+       {
+       if (s->expand != NULL)
+               return(s->expand->meth);
+       return(NULL);
+       }
+
 int ssl_init_wbio_buffer(SSL *s,int push)
        {
        BIO *bbio;