set FIPS permitted flag before initalising digest

[openssl.git] / ssl / ssl_sess.c

diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c
index 1378f7600e8b6d31b8c54442bf82ee2e0381e1d4..cbb7e7035210f1112e83445197c00ef51ee7e6e6 100644 (file)
--- a/ssl/ssl_sess.c
+++ b/ssl/ssl_sess.c
@@ -217,6 +217,9 @@ SSL_SESSION *SSL_SESSION_new(void)
 #ifndef OPENSSL_NO_PSK
        ss->psk_identity_hint=NULL;
        ss->psk_identity=NULL;
+#endif
+#ifndef OPENSSL_NO_SRP
+       ss->srp_username=NULL;
 #endif
        return(ss);
        }
@@ -300,6 +303,21 @@ int ssl_get_new_session(SSL *s, int session)
                        ss->ssl_version=TLS1_VERSION;
                        ss->session_id_length=SSL3_SSL_SESSION_ID_LENGTH;
                        }
+               else if (s->version == TLS1_1_VERSION)
+                       {
+                       ss->ssl_version=TLS1_1_VERSION;
+                       ss->session_id_length=SSL3_SSL_SESSION_ID_LENGTH;
+                       }
+               else if (s->version == TLS1_2_VERSION)
+                       {
+                       ss->ssl_version=TLS1_2_VERSION;
+                       ss->session_id_length=SSL3_SSL_SESSION_ID_LENGTH;
+                       }
+               else if (s->version == DTLS1_BAD_VER)
+                       {
+                       ss->ssl_version=DTLS1_BAD_VER;
+                       ss->session_id_length=SSL3_SSL_SESSION_ID_LENGTH;
+                       }
                else if (s->version == DTLS1_VERSION)
                        {
                        ss->ssl_version=DTLS1_VERSION;
@@ -533,7 +551,7 @@ int ssl_get_prev_session(SSL *s, unsigned char *session_id, int len,
                p=buf;
                l=ret->cipher_id;
                l2n(l,p);
-               if ((ret->ssl_version>>8) == SSL3_VERSION_MAJOR)
+               if ((ret->ssl_version>>8) >= SSL3_VERSION_MAJOR)
                        ret->cipher=ssl_get_cipher_by_char(s,&(buf[2]));
                else 
                        ret->cipher=ssl_get_cipher_by_char(s,&(buf[1]));
@@ -723,6 +741,10 @@ void SSL_SESSION_free(SSL_SESSION *ss)
                OPENSSL_free(ss->psk_identity_hint);
        if (ss->psk_identity != NULL)
                OPENSSL_free(ss->psk_identity);
+#endif
+#ifndef OPENSSL_NO_SRP
+       if (ss->srp_username != NULL)
+               OPENSSL_free(ss->srp_username);
 #endif
        OPENSSL_cleanse(ss,sizeof(*ss));
        OPENSSL_free(ss);
@@ -819,6 +841,35 @@ long SSL_SESSION_set_time(SSL_SESSION *s, long t)
        return(t);
        }
 
+unsigned int SSL_SESSION_get_id_len(SSL_SESSION *s)
+       {
+       return s->session_id_length;
+       }
+
+const unsigned char *SSL_SESSION_get0_id(SSL_SESSION *s)
+       {
+       return s->session_id;
+       }
+
+X509 *SSL_SESSION_get0_peer(SSL_SESSION *s)
+       {
+       return s->peer;
+       }
+
+int SSL_SESSION_set1_id_context(SSL_SESSION *s,const unsigned char *sid_ctx,
+                              unsigned int sid_ctx_len)
+    {
+    if(sid_ctx_len > SSL_MAX_SID_CTX_LENGTH)
+       {
+       SSLerr(SSL_F_SSL_SESSION_SET1_ID_CONTEXT,SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG);
+       return 0;
+       }
+    s->sid_ctx_length=sid_ctx_len;
+    memcpy(s->sid_ctx,sid_ctx,sid_ctx_len);
+
+    return 1;
+    }
+
 long SSL_CTX_set_timeout(SSL_CTX *s, long t)
        {
        long l;
@@ -834,6 +885,61 @@ long SSL_CTX_get_timeout(const SSL_CTX *s)
        return(s->session_timeout);
        }
 
+#ifndef OPENSSL_NO_TLSEXT
+int SSL_set_session_secret_cb(SSL *s, int (*tls_session_secret_cb)(SSL *s, void *secret, int *secret_len,
+       STACK_OF(SSL_CIPHER) *peer_ciphers, SSL_CIPHER **cipher, void *arg), void *arg)
+       {
+       if (s == NULL) return(0);
+       s->tls_session_secret_cb = tls_session_secret_cb;
+       s->tls_session_secret_cb_arg = arg;
+       return(1);
+       }
+
+int SSL_set_session_ticket_ext_cb(SSL *s, tls_session_ticket_ext_cb_fn cb,
+                                 void *arg)
+       {
+       if (s == NULL) return(0);
+       s->tls_session_ticket_ext_cb = cb;
+       s->tls_session_ticket_ext_cb_arg = arg;
+       return(1);
+       }
+
+int SSL_set_session_ticket_ext(SSL *s, void *ext_data, int ext_len)
+       {
+       if (s->version >= TLS1_VERSION)
+               {
+               if (s->tlsext_session_ticket)
+                       {
+                       OPENSSL_free(s->tlsext_session_ticket);
+                       s->tlsext_session_ticket = NULL;
+                       }
+
+               s->tlsext_session_ticket = OPENSSL_malloc(sizeof(TLS_SESSION_TICKET_EXT) + ext_len);
+               if (!s->tlsext_session_ticket)
+                       {
+                       SSLerr(SSL_F_SSL_SET_SESSION_TICKET_EXT, ERR_R_MALLOC_FAILURE);
+                       return 0;
+                       }
+
+               if (ext_data)
+                       {
+                       s->tlsext_session_ticket->length = ext_len;
+                       s->tlsext_session_ticket->data = s->tlsext_session_ticket + 1;
+                       memcpy(s->tlsext_session_ticket->data, ext_data, ext_len);
+                       }
+               else
+                       {
+                       s->tlsext_session_ticket->length = 0;
+                       s->tlsext_session_ticket->data = NULL;
+                       }
+
+               return 1;
+               }
+
+       return 0;
+       }
+#endif /* OPENSSL_NO_TLSEXT */
+
 typedef struct timeout_param_st
        {
        SSL_CTX *ctx;