#include <openssl/objects.h>
#include <openssl/lhash.h>
#include <openssl/x509v3.h>
+#include <openssl/dh.h>
const char *SSL_version_str=OPENSSL_VERSION_TEXT;
s->msg_callback=ctx->msg_callback;
s->msg_callback_arg=ctx->msg_callback_arg;
s->verify_mode=ctx->verify_mode;
+#if 0
s->verify_depth=ctx->verify_depth;
+#endif
s->sid_ctx_length=ctx->sid_ctx_length;
+ OPENSSL_assert(s->sid_ctx_length <= sizeof s->sid_ctx);
memcpy(&s->sid_ctx,&ctx->sid_ctx,sizeof(s->sid_ctx));
s->verify_callback=ctx->default_verify_callback;
s->generate_session_id=ctx->generate_session_id;
+
+ s->param = X509_VERIFY_PARAM_new();
+ if (!s->param)
+ goto err;
+ X509_VERIFY_PARAM_inherit(s->param, ctx->param);
+#if 0
s->purpose = ctx->purpose;
s->trust = ctx->trust;
+#endif
s->quiet_shutdown=ctx->quiet_shutdown;
CRYPTO_add(&ctx->references,1,CRYPTO_LOCK_SSL_CTX);
int SSL_CTX_set_session_id_context(SSL_CTX *ctx,const unsigned char *sid_ctx,
unsigned int sid_ctx_len)
{
- if(sid_ctx_len > SSL_MAX_SID_CTX_LENGTH)
+ if(sid_ctx_len > sizeof ctx->sid_ctx)
{
SSLerr(SSL_F_SSL_CTX_SET_SESSION_ID_CONTEXT,SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG);
return 0;
* any new session built out of this id/id_len and the ssl_version in
* use by this SSL. */
SSL_SESSION r, *p;
+
+ if(id_len > sizeof r.session_id)
+ return 0;
+
r.ssl_version = ssl->version;
r.session_id_length = id_len;
memcpy(r.session_id, id, id_len);
int SSL_CTX_set_purpose(SSL_CTX *s, int purpose)
{
- return X509_PURPOSE_set(&s->purpose, purpose);
+ return X509_VERIFY_PARAM_set_purpose(s->param, purpose);
}
int SSL_set_purpose(SSL *s, int purpose)
{
- return X509_PURPOSE_set(&s->purpose, purpose);
+ return X509_VERIFY_PARAM_set_purpose(s->param, purpose);
}
int SSL_CTX_set_trust(SSL_CTX *s, int trust)
{
- return X509_TRUST_set(&s->trust, trust);
+ return X509_VERIFY_PARAM_set_trust(s->param, trust);
}
int SSL_set_trust(SSL *s, int trust)
{
- return X509_TRUST_set(&s->trust, trust);
+ return X509_VERIFY_PARAM_set_trust(s->param, trust);
}
void SSL_free(SSL *s)
}
#endif
+ if (s->param)
+ X509_VERIFY_PARAM_free(s->param);
+
CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL, s, &s->ex_data);
if (s->bbio != NULL)
if (s->method != NULL) s->method->ssl_free(s);
+#ifndef OPENSSL_NO_KRB5
+ if (s->kssl_ctx != NULL)
+ kssl_ctx_free(s->kssl_ctx);
+#endif /* OPENSSL_NO_KRB5 */
+
OPENSSL_free(s);
}
int SSL_get_verify_depth(SSL *s)
{
- return(s->verify_depth);
+ return X509_VERIFY_PARAM_get_depth(s->param);
}
int (*SSL_get_verify_callback(SSL *s))(int,X509_STORE_CTX *)
int SSL_CTX_get_verify_depth(SSL_CTX *ctx)
{
- return(ctx->verify_depth);
+ return X509_VERIFY_PARAM_get_depth(ctx->param);
}
int (*SSL_CTX_get_verify_callback(SSL_CTX *ctx))(int,X509_STORE_CTX *)
void SSL_set_verify_depth(SSL *s,int depth)
{
- s->verify_depth=depth;
+ X509_VERIFY_PARAM_set_depth(s->param, depth);
}
void SSL_set_read_ahead(SSL *s,int yes)
* preference */
STACK_OF(SSL_CIPHER) *SSL_get_ciphers(SSL *s)
{
- if ((s != NULL) && (s->cipher_list != NULL))
- {
- return(s->cipher_list);
- }
- else if ((s->ctx != NULL) &&
- (s->ctx->cipher_list != NULL))
+ if (s != NULL)
{
- return(s->ctx->cipher_list);
+ if (s->cipher_list != NULL)
+ {
+ return(s->cipher_list);
+ }
+ else if ((s->ctx != NULL) &&
+ (s->ctx->cipher_list != NULL))
+ {
+ return(s->ctx->cipher_list);
+ }
}
return(NULL);
}
* algorithm id */
STACK_OF(SSL_CIPHER) *ssl_get_ciphers_by_id(SSL *s)
{
- if ((s != NULL) && (s->cipher_list_by_id != NULL))
- {
- return(s->cipher_list_by_id);
- }
- else if ((s != NULL) && (s->ctx != NULL) &&
- (s->ctx->cipher_list_by_id != NULL))
+ if (s != NULL)
{
- return(s->ctx->cipher_list_by_id);
+ if (s->cipher_list_by_id != NULL)
+ {
+ return(s->cipher_list_by_id);
+ }
+ else if ((s->ctx != NULL) &&
+ (s->ctx->cipher_list_by_id != NULL))
+ {
+ return(s->ctx->cipher_list_by_id);
+ }
}
return(NULL);
}
ret->msg_callback=0;
ret->msg_callback_arg=NULL;
ret->verify_mode=SSL_VERIFY_NONE;
+#if 0
ret->verify_depth=-1; /* Don't impose a limit (but x509_lu.c does) */
+#endif
ret->sid_ctx_length=0;
ret->default_verify_callback=NULL;
if ((ret->cert=ssl_cert_new()) == NULL)
goto err2;
}
+ ret->param = X509_VERIFY_PARAM_new();
+ if (!ret->param)
+ goto err;
+
if ((ret->rsa_md5=EVP_get_digestbyname("ssl2-md5")) == NULL)
{
SSLerr(SSL_F_SSL_CTX_NEW,SSL_R_UNABLE_TO_LOAD_SSL2_MD5_ROUTINES);
abort(); /* ok */
}
#endif
- CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_CTX, a, &a->ex_data);
+ if (a->param)
+ X509_VERIFY_PARAM_free(a->param);
+
+ /*
+ * Free internal session cache. However: the remove_cb() may reference
+ * the ex_data of SSL_CTX, thus the ex_data store can only be removed
+ * after the sessions were flushed.
+ * As the ex_data handling routines might also touch the session cache,
+ * the most secure solution seems to be: empty (flush) the cache, then
+ * free ex_data, then finally free the cache.
+ * (See ticket [openssl.org #212].)
+ */
if (a->sessions != NULL)
- {
SSL_CTX_flush_sessions(a,0);
+
+ CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_CTX, a, &a->ex_data);
+
+ if (a->sessions != NULL)
lh_free(a->sessions);
- }
+
if (a->cert_store != NULL)
X509_STORE_free(a->cert_store);
if (a->cipher_list != NULL)
void SSL_CTX_set_verify_depth(SSL_CTX *ctx,int depth)
{
- ctx->verify_depth=depth;
+ X509_VERIFY_PARAM_set_depth(ctx->param, depth);
}
void ssl_set_cert_masks(CERT *c, SSL_CIPHER *cipher)
if (rsa_enc || rsa_sign)
{
mask|=SSL_aRSA;
- mask|=SSL_aRSA;
+ emask|=SSL_aRSA;
}
if (dsa_sign)
/* key usage, if present, must allow key agreement */
if (ku_reject(x, X509v3_KU_KEY_AGREEMENT))
{
- printf("ECC cert not authorized for key agreement\n");
return 0;
}
if (alg & SSL_aECDSA)
/* signature alg must be ECDSA */
if (signature_nid != NID_ecdsa_with_SHA1)
{
- printf("ECC cert not signed w/ ECDSA\n");
return 0;
}
}
(signature_nid != NID_md4WithRSAEncryption) &&
(signature_nid != NID_md2WithRSAEncryption))
{
- printf("ECC cert not signed w/ RSA\n");
return 0;
}
}
/* key usage, if present, must allow signing */
if (ku_reject(x, X509v3_KU_DIGITAL_SIGNATURE))
{
- printf("ECC cert not authorized for signature\n");
return 0;
}
}
i=s->ctx->session_cache_mode;
if ((i & mode) && (!s->hit)
- && ((i & SSL_SESS_CACHE_NO_INTERNAL_LOOKUP)
+ && ((i & SSL_SESS_CACHE_NO_INTERNAL_STORE)
|| SSL_CTX_add_session(s->ctx,s->session))
&& (s->ctx->new_session_cb != NULL))
{
* they should not both point to the same object,
* and thus we can't use SSL_copy_session_id. */
+ ret->method->ssl_free(ret);
ret->method = s->method;
ret->method->ssl_new(ret);
ret->rstate=s->rstate;
ret->init_num = 0; /* would have to copy ret->init_buf, ret->init_msg, ret->init_num, ret->init_off */
ret->hit=s->hit;
- ret->purpose=s->purpose;
- ret->trust=s->trust;
+
+ X509_VERIFY_PARAM_inherit(ret->param, s->param);
/* dup the cipher_list and cipher_list_by_id stacks */
if (s->cipher_list != NULL)
return(NULL);
}
+const COMP_METHOD *SSL_get_current_compression(SSL *s)
+ {
+ if (s->compress != NULL)
+ return(s->compress->meth);
+ return(NULL);
+ }
+
+const COMP_METHOD *SSL_get_current_expansion(SSL *s)
+ {
+ if (s->expand != NULL)
+ return(s->expand->meth);
+ return(NULL);
+ }
+
int ssl_init_wbio_buffer(SSL *s,int push)
{
BIO *bbio;
projects / openssl.git / blobdiff