Support TLS extensions (specifically, HostName)

[openssl.git] / ssl / ssl_lib.c

diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c
index 25efa29a57a34e0d88ce38c296138c24d5755bf9..afe7162ab71e2cd13c5b7603e60c2f1245792dac 100644 (file)
--- a/ssl/ssl_lib.c
+++ b/ssl/ssl_lib.c
@@ -125,7 +125,9 @@
 #include <openssl/objects.h>
 #include <openssl/lhash.h>
 #include <openssl/x509v3.h>
+#ifndef OPENSSL_NO_DH
 #include <openssl/dh.h>
+#endif
 
 const char *SSL_version_str=OPENSSL_VERSION_TEXT;
 
@@ -136,7 +138,14 @@ SSL3_ENC_METHOD ssl3_undef_enc_method={
        ssl_undefined_function,
        (int (*)(SSL *, unsigned char *, unsigned char *, int))ssl_undefined_function,
        (int (*)(SSL*, int))ssl_undefined_function,
-       (int (*)(SSL *, EVP_MD_CTX *, EVP_MD_CTX *, const char*, int, unsigned char *))ssl_undefined_function
+       (int (*)(SSL *, EVP_MD_CTX *, EVP_MD_CTX *, const char*, int, unsigned char *))ssl_undefined_function,
+       0,      /* finish_mac_length */
+       (int (*)(SSL *, EVP_MD_CTX *, unsigned char *))ssl_undefined_function,
+       NULL,   /* client_finished_label */
+       0,      /* client_finished_label_len */
+       NULL,   /* server_finished_label */
+       0,      /* server_finished_label_len */
+       (int (*)(int))ssl_undefined_function
        };
 
 int SSL_clear(SSL *s)
@@ -210,7 +219,7 @@ int SSL_clear(SSL *s)
        }
 
 /** Used to change an SSL_CTXs default SSL method type */
-int SSL_CTX_set_ssl_version(SSL_CTX *ctx,SSL_METHOD *meth)
+int SSL_CTX_set_ssl_version(SSL_CTX *ctx,const SSL_METHOD *meth)
        {
        STACK_OF(SSL_CIPHER) *sk;
 
@@ -294,6 +303,7 @@ SSL *SSL_new(SSL_CTX *ctx)
        s->trust = ctx->trust;
 #endif
        s->quiet_shutdown=ctx->quiet_shutdown;
+       s->max_send_fragment = ctx->max_send_fragment;
 
        CRYPTO_add(&ctx->references,1,CRYPTO_LOCK_SSL_CTX);
        s->ctx=ctx;
@@ -964,6 +974,11 @@ long SSL_ctrl(SSL *s,int cmd,long larg,void *parg)
                        return larg;
                        }
                return 0;
+       case SSL_CTRL_SET_MAX_SEND_FRAGMENT:
+               if (larg < 512 || larg > SSL3_RT_MAX_PLAIN_LENGTH)
+                       return 0;
+               s->max_send_fragment = larg;
+               return 1;
        default:
                return(s->method->ssl_ctrl(s,cmd,larg,parg));
                }
@@ -1052,6 +1067,11 @@ long SSL_CTX_ctrl(SSL_CTX *ctx,int cmd,long larg,void *parg)
                return(ctx->options|=larg);
        case SSL_CTRL_MODE:
                return(ctx->mode|=larg);
+       case SSL_CTRL_SET_MAX_SEND_FRAGMENT:
+               if (larg < 512 || larg > SSL3_RT_MAX_PLAIN_LENGTH)
+                       return 0;
+               ctx->max_send_fragment = larg;
+               return 1;
        default:
                return(ctx->method->ssl_ctx_ctrl(ctx,cmd,larg,parg));
                }
@@ -1295,6 +1315,27 @@ err:
        return(NULL);
        }
 
+#ifndef OPENSSL_TLSEXT
+/** return a servername extension value if provided in CLIENT HELLO
+ * or NULL. 
+ * For the moment, only hostname types are supported. 
+ */
+
+const char *SSL_get_servername(const SSL *s, const int type) {
+
+       if (type != TLSEXT_TYPE_SERVER_host) 
+               return NULL;
+       return s->session /*&&s->session->tlsext_hostname*/?s->session->tlsext_hostname:s->tlsext_hostname;
+}
+
+int SSL_get_servername_type(const SSL *s) {
+
+       if (s->session &&s->session->tlsext_hostname ?s->session->tlsext_hostname:s->tlsext_hostname) 
+               return TLSEXT_TYPE_SERVER_host;
+       return -1;
+}
+
+#endif
 unsigned long SSL_SESSION_hash(const SSL_SESSION *a)
        {
        unsigned long l;
@@ -1328,7 +1369,7 @@ int SSL_SESSION_cmp(const SSL_SESSION *a,const SSL_SESSION *b)
 static IMPLEMENT_LHASH_HASH_FN(SSL_SESSION_hash, SSL_SESSION *)
 static IMPLEMENT_LHASH_COMP_FN(SSL_SESSION_cmp, SSL_SESSION *)
 
-SSL_CTX *SSL_CTX_new(SSL_METHOD *meth)
+SSL_CTX *SSL_CTX_new(const SSL_METHOD *meth)
        {
        SSL_CTX *ret=NULL;
        
@@ -1444,6 +1485,12 @@ SSL_CTX *SSL_CTX_new(SSL_METHOD *meth)
        ret->extra_certs=NULL;
        ret->comp_methods=SSL_COMP_get_compression_methods();
 
+       ret->max_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH;
+
+#ifndef OPENSSL_NO_TLSEXT
+       ret->tlsext_servername_callback = NULL;
+       ret->tlsext_servername_arg = NULL;
+#endif
        return(ret);
 err:
        SSLerr(SSL_F_SSL_CTX_NEW,ERR_R_MALLOC_FAILURE);
@@ -1551,7 +1598,10 @@ void ssl_set_cert_masks(CERT *c, SSL_CIPHER *cipher)
        int rsa_enc_export,dh_rsa_export,dh_dsa_export;
        int rsa_tmp_export,dh_tmp_export,kl;
        unsigned long mask,emask;
-       int have_ecc_cert, have_ecdh_tmp, ecdh_ok, ecdsa_ok, ecc_pkey_size;
+       int have_ecc_cert, ecdh_ok, ecdsa_ok, ecc_pkey_size;
+#ifndef OPENSSL_NO_ECDH
+       int have_ecdh_tmp;
+#endif
        X509 *x = NULL;
        EVP_PKEY *ecc_pkey = NULL;
        int signature_nid = 0;
@@ -1889,17 +1939,17 @@ void ssl_update_cache(SSL *s,int mode)
                        ?s->ctx->stats.sess_connect_good
                        :s->ctx->stats.sess_accept_good) & 0xff) == 0xff)
                        {
-                       SSL_CTX_flush_sessions(s->ctx,time(NULL));
+                       SSL_CTX_flush_sessions(s->ctx,(unsigned long)time(NULL));
                        }
                }
        }
 
-SSL_METHOD *SSL_get_ssl_method(SSL *s)
+const SSL_METHOD *SSL_get_ssl_method(SSL *s)
        {
        return(s->method);
        }
 
-int SSL_set_ssl_method(SSL *s,SSL_METHOD *meth)
+int SSL_set_ssl_method(SSL *s, const SSL_METHOD *meth)
        {
        int conn= -1;
        int ret=1;
@@ -2234,6 +2284,7 @@ void ssl_clear_cipher_ctx(SSL *s)
                OPENSSL_free(s->enc_write_ctx);
                s->enc_write_ctx=NULL;
                }
+#ifndef OPENSSL_NO_COMP
        if (s->expand != NULL)
                {
                COMP_CTX_free(s->expand);
@@ -2244,6 +2295,7 @@ void ssl_clear_cipher_ctx(SSL *s)
                COMP_CTX_free(s->compress);
                s->compress=NULL;
                }
+#endif
        }
 
 /* Fix this function so that it takes an optional type parameter */
@@ -2270,6 +2322,16 @@ SSL_CIPHER *SSL_get_current_cipher(const SSL *s)
                return(s->session->cipher);
        return(NULL);
        }
+#ifdef OPENSSL_NO_COMP
+const void *SSL_get_current_compression(SSL *s)
+       {
+       return NULL;
+       }
+const void *SSL_get_current_expansion(SSL *s)
+       {
+       return NULL;
+       }
+#else
 
 const COMP_METHOD *SSL_get_current_compression(SSL *s)
        {
@@ -2284,6 +2346,7 @@ const COMP_METHOD *SSL_get_current_expansion(SSL *s)
                return(s->expand->meth);
        return(NULL);
        }
+#endif
 
 int ssl_init_wbio_buffer(SSL *s,int push)
        {
@@ -2377,6 +2440,19 @@ SSL_CTX *SSL_get_SSL_CTX(const SSL *ssl)
        return(ssl->ctx);
        }
 
+SSL_CTX *SSL_set_SSL_CTX(SSL *ssl, SSL_CTX* ctx)
+       {
+
+       if (ssl->cert != NULL)
+               ssl_cert_free(ssl->cert);
+       ssl->cert = ssl_cert_dup(ctx->cert);
+       CRYPTO_add(&ctx->references,1,CRYPTO_LOCK_SSL_CTX);
+       if (ssl->ctx != NULL)
+               SSL_CTX_free(ssl->ctx); /* decrement reference count */
+       ssl->ctx = ctx;
+       return(ssl->ctx);
+       }
+
 #ifndef OPENSSL_NO_STDIO
 int SSL_CTX_set_default_verify_paths(SSL_CTX *ctx)
        {
@@ -2396,7 +2472,9 @@ void SSL_set_info_callback(SSL *ssl,
        ssl->info_callback=cb;
        }
 
-void (*SSL_get_info_callback(const SSL *ssl))(const SSL *ssl,int type,int val)
+/* One compiler (Diab DCC) doesn't like argument names in returned
+   function pointer.  */
+void (*SSL_get_info_callback(const SSL *ssl))(const SSL * /*ssl*/,int /*type*/,int /*val*/)
        {
        return ssl->info_callback;
        }