X-Git-Url: https://git.openssl.org/?p=openssl.git;a=blobdiff_plain;f=ssl%2Fssl_lib.c;h=445907d6172b8c5e0900575e4108780f5bdfdb2c;hp=c84ea15ed1e011fe8662b1bf5f5cf02e584de9ec;hb=a71a4966a31b31df72db42c130544462fd6ad624;hpb=a8d8e06b0ac06c421fd11cc1772126dcb98f79ae diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c index c84ea15ed1..445907d617 100644 --- a/ssl/ssl_lib.c +++ b/ssl/ssl_lib.c @@ -159,7 +159,7 @@ # include #endif -const char *SSL_version_str = OPENSSL_VERSION_TEXT; +const char SSL_version_str[] = OPENSSL_VERSION_TEXT; SSL3_ENC_METHOD ssl3_undef_enc_method = { /* @@ -215,9 +215,7 @@ int SSL_clear(SSL *s) return 0; } - s->type = 0; - - s->state = SSL_ST_BEFORE | ((s->server) ? SSL_ST_ACCEPT : SSL_ST_CONNECT); + ossl_statem_clear(s); s->version = s->method->version; s->client_version = s->version; @@ -286,6 +284,7 @@ SSL *SSL_new(SSL_CTX *ctx) s->options = ctx->options; s->mode = ctx->mode; s->max_cert_list = ctx->max_cert_list; + s->references = 1; /* * Earlier library versions used to copy the pointer to the CERT, not @@ -372,7 +371,6 @@ SSL *SSL_new(SSL_CTX *ctx) if (!s->method->ssl_new(s)) goto err; - s->references = 1; s->server = (ctx->method->ssl_accept == ssl_undefined_function) ? 0 : 1; if (!SSL_clear(s)) @@ -1078,8 +1076,9 @@ long SSL_ctrl(SSL *s, int cmd, long larg, void *parg) return 0; *(unsigned char **)parg = s->s3->tmp.ciphers_raw; return (int)s->s3->tmp.ciphers_rawlen; - } else - return ssl_put_cipher_by_char(s, NULL, NULL); + } else { + return TLS_CIPHER_LEN; + } case SSL_CTRL_GET_EXTMS_SUPPORT: if (!s->session || SSL_in_init(s) || s->in_handshake) return -1; @@ -1825,9 +1824,6 @@ void SSL_CTX_free(SSL_CTX *a) #ifndef OPENSSL_NO_SRTP sk_SRTP_PROTECTION_PROFILE_free(a->srtp_profiles); #endif -#ifndef OPENSSL_NO_PSK - OPENSSL_free(a->psk_identity_hint); -#endif #ifndef OPENSSL_NO_SRP SSL_CTX_SRP_CTX_free(a); #endif @@ -2399,7 +2395,7 @@ void SSL_set_accept_state(SSL *s) { s->server = 1; s->shutdown = 0; - s->state = SSL_ST_ACCEPT | SSL_ST_BEFORE; + ossl_statem_clear(s); s->handshake_func = s->method->ssl_accept; clear_ciphers(s); } @@ -2408,7 +2404,7 @@ void SSL_set_connect_state(SSL *s) { s->server = 0; s->shutdown = 0; - s->state = SSL_ST_CONNECT | SSL_ST_BEFORE; + ossl_statem_clear(s); s->handshake_func = s->method->ssl_connect; clear_ciphers(s); } @@ -2470,7 +2466,6 @@ SSL *SSL_dup(SSL *s) return (NULL); ret->version = s->version; - ret->type = s->type; ret->method = s->method; if (s->session != NULL) { @@ -2538,8 +2533,8 @@ SSL *SSL_dup(SSL *s) ret->new_session = s->new_session; ret->quiet_shutdown = s->quiet_shutdown; ret->shutdown = s->shutdown; - ret->state = s->state; /* SSL_dup does not really work at any state, - * though */ + ret->statem = s->statem; /* SSL_dup does not really work at any state, + * though */ RECORD_LAYER_dup(&ret->rlayer, &s->rlayer); ret->init_num = 0; /* would have to copy ret->init_buf, * ret->init_msg, ret->init_num, @@ -2783,18 +2778,47 @@ SSL_CTX *SSL_set_SSL_CTX(SSL *ssl, SSL_CTX *ctx) return (ssl->ctx); } -#ifndef OPENSSL_NO_STDIO int SSL_CTX_set_default_verify_paths(SSL_CTX *ctx) { return (X509_STORE_set_default_paths(ctx->cert_store)); } +int SSL_CTX_set_default_verify_dir(SSL_CTX *ctx) +{ + X509_LOOKUP *lookup; + + lookup = X509_STORE_add_lookup(ctx->cert_store, X509_LOOKUP_hash_dir()); + if (lookup == NULL) + return 0; + X509_LOOKUP_add_dir(lookup, NULL, X509_FILETYPE_DEFAULT); + + /* Clear any errors if the default directory does not exist */ + ERR_clear_error(); + + return 1; +} + +int SSL_CTX_set_default_verify_file(SSL_CTX *ctx) +{ + X509_LOOKUP *lookup; + + lookup = X509_STORE_add_lookup(ctx->cert_store, X509_LOOKUP_file()); + if (lookup == NULL) + return 0; + + X509_LOOKUP_load_file(lookup, NULL, X509_FILETYPE_DEFAULT); + + /* Clear any errors if the default file does not exist */ + ERR_clear_error(); + + return 1; +} + int SSL_CTX_load_verify_locations(SSL_CTX *ctx, const char *CAfile, const char *CApath) { return (X509_STORE_load_locations(ctx->cert_store, CAfile, CApath)); } -#endif void SSL_set_info_callback(SSL *ssl, void (*cb) (const SSL *ssl, int type, int val)) @@ -2812,16 +2836,6 @@ void (*SSL_get_info_callback(const SSL *ssl)) (const SSL * /* ssl */ , return ssl->info_callback; } -int SSL_state(const SSL *ssl) -{ - return (ssl->state); -} - -void SSL_set_state(SSL *ssl, int state) -{ - ssl->state = state; -} - void SSL_set_verify_result(SSL *ssl, long arg) { ssl->verify_result = arg; @@ -3007,13 +3021,13 @@ int SSL_CTX_use_psk_identity_hint(SSL_CTX *ctx, const char *identity_hint) SSL_R_DATA_LENGTH_TOO_LONG); return 0; } - OPENSSL_free(ctx->psk_identity_hint); + OPENSSL_free(ctx->cert->psk_identity_hint); if (identity_hint != NULL) { - ctx->psk_identity_hint = BUF_strdup(identity_hint); - if (ctx->psk_identity_hint == NULL) + ctx->cert->psk_identity_hint = BUF_strdup(identity_hint); + if (ctx->cert->psk_identity_hint == NULL) return 0; } else - ctx->psk_identity_hint = NULL; + ctx->cert->psk_identity_hint = NULL; return 1; } @@ -3022,20 +3036,17 @@ int SSL_use_psk_identity_hint(SSL *s, const char *identity_hint) if (s == NULL) return 0; - if (s->session == NULL) - return 1; /* session not created yet, ignored */ - if (identity_hint != NULL && strlen(identity_hint) > PSK_MAX_IDENTITY_LEN) { SSLerr(SSL_F_SSL_USE_PSK_IDENTITY_HINT, SSL_R_DATA_LENGTH_TOO_LONG); return 0; } - OPENSSL_free(s->session->psk_identity_hint); + OPENSSL_free(s->cert->psk_identity_hint); if (identity_hint != NULL) { - s->session->psk_identity_hint = BUF_strdup(identity_hint); - if (s->session->psk_identity_hint == NULL) + s->cert->psk_identity_hint = BUF_strdup(identity_hint); + if (s->cert->psk_identity_hint == NULL) return 0; } else - s->session->psk_identity_hint = NULL; + s->cert->psk_identity_hint = NULL; return 1; }