set FIPS permitted flag before initalising digest

[openssl.git] / ssl / ssl_sess.c

diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c
index 33d302aa410fd637a16fc8d825d993e624e4e672..cbb7e7035210f1112e83445197c00ef51ee7e6e6 100644 (file)
--- a/ssl/ssl_sess.c
+++ b/ssl/ssl_sess.c
@@ -138,6 +138,9 @@
 #include <stdio.h>
 #include <openssl/lhash.h>
 #include <openssl/rand.h>
+#ifndef OPENSSL_NO_ENGINE
+#include <openssl/engine.h>
+#endif
 #include "ssl_locl.h"
 
 static void SSL_SESSION_list_remove(SSL_CTX *ctx, SSL_SESSION *s);
@@ -214,6 +217,9 @@ SSL_SESSION *SSL_SESSION_new(void)
 #ifndef OPENSSL_NO_PSK
        ss->psk_identity_hint=NULL;
        ss->psk_identity=NULL;
+#endif
+#ifndef OPENSSL_NO_SRP
+       ss->srp_username=NULL;
 #endif
        return(ss);
        }
@@ -297,6 +303,21 @@ int ssl_get_new_session(SSL *s, int session)
                        ss->ssl_version=TLS1_VERSION;
                        ss->session_id_length=SSL3_SSL_SESSION_ID_LENGTH;
                        }
+               else if (s->version == TLS1_1_VERSION)
+                       {
+                       ss->ssl_version=TLS1_1_VERSION;
+                       ss->session_id_length=SSL3_SSL_SESSION_ID_LENGTH;
+                       }
+               else if (s->version == TLS1_2_VERSION)
+                       {
+                       ss->ssl_version=TLS1_2_VERSION;
+                       ss->session_id_length=SSL3_SSL_SESSION_ID_LENGTH;
+                       }
+               else if (s->version == DTLS1_BAD_VER)
+                       {
+                       ss->ssl_version=DTLS1_BAD_VER;
+                       ss->session_id_length=SSL3_SSL_SESSION_ID_LENGTH;
+                       }
                else if (s->version == DTLS1_VERSION)
                        {
                        ss->ssl_version=DTLS1_VERSION;
@@ -435,7 +456,7 @@ int ssl_get_prev_session(SSL *s, unsigned char *session_id, int len,
                fatal = 1;
                goto err;
                }
-       else if (r == 0 || (!ret || !len))
+       else if (r == 0 || (!ret && !len))
                goto err;
        else if (!ret && !(s->session_ctx->session_cache_mode & SSL_SESS_CACHE_NO_INTERNAL_LOOKUP))
 #else
@@ -530,7 +551,7 @@ int ssl_get_prev_session(SSL *s, unsigned char *session_id, int len,
                p=buf;
                l=ret->cipher_id;
                l2n(l,p);
-               if ((ret->ssl_version>>8) == SSL3_VERSION_MAJOR)
+               if ((ret->ssl_version>>8) >= SSL3_VERSION_MAJOR)
                        ret->cipher=ssl_get_cipher_by_char(s,&(buf[2]));
                else 
                        ret->cipher=ssl_get_cipher_by_char(s,&(buf[1]));
@@ -720,6 +741,10 @@ void SSL_SESSION_free(SSL_SESSION *ss)
                OPENSSL_free(ss->psk_identity_hint);
        if (ss->psk_identity != NULL)
                OPENSSL_free(ss->psk_identity);
+#endif
+#ifndef OPENSSL_NO_SRP
+       if (ss->srp_username != NULL)
+               OPENSSL_free(ss->srp_username);
 #endif
        OPENSSL_cleanse(ss,sizeof(*ss));
        OPENSSL_free(ss);
@@ -816,6 +841,35 @@ long SSL_SESSION_set_time(SSL_SESSION *s, long t)
        return(t);
        }
 
+unsigned int SSL_SESSION_get_id_len(SSL_SESSION *s)
+       {
+       return s->session_id_length;
+       }
+
+const unsigned char *SSL_SESSION_get0_id(SSL_SESSION *s)
+       {
+       return s->session_id;
+       }
+
+X509 *SSL_SESSION_get0_peer(SSL_SESSION *s)
+       {
+       return s->peer;
+       }
+
+int SSL_SESSION_set1_id_context(SSL_SESSION *s,const unsigned char *sid_ctx,
+                              unsigned int sid_ctx_len)
+    {
+    if(sid_ctx_len > SSL_MAX_SID_CTX_LENGTH)
+       {
+       SSLerr(SSL_F_SSL_SESSION_SET1_ID_CONTEXT,SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG);
+       return 0;
+       }
+    s->sid_ctx_length=sid_ctx_len;
+    memcpy(s->sid_ctx,sid_ctx,sid_ctx_len);
+
+    return 1;
+    }
+
 long SSL_CTX_set_timeout(SSL_CTX *s, long t)
        {
        long l;
@@ -831,6 +885,61 @@ long SSL_CTX_get_timeout(const SSL_CTX *s)
        return(s->session_timeout);
        }
 
+#ifndef OPENSSL_NO_TLSEXT
+int SSL_set_session_secret_cb(SSL *s, int (*tls_session_secret_cb)(SSL *s, void *secret, int *secret_len,
+       STACK_OF(SSL_CIPHER) *peer_ciphers, SSL_CIPHER **cipher, void *arg), void *arg)
+       {
+       if (s == NULL) return(0);
+       s->tls_session_secret_cb = tls_session_secret_cb;
+       s->tls_session_secret_cb_arg = arg;
+       return(1);
+       }
+
+int SSL_set_session_ticket_ext_cb(SSL *s, tls_session_ticket_ext_cb_fn cb,
+                                 void *arg)
+       {
+       if (s == NULL) return(0);
+       s->tls_session_ticket_ext_cb = cb;
+       s->tls_session_ticket_ext_cb_arg = arg;
+       return(1);
+       }
+
+int SSL_set_session_ticket_ext(SSL *s, void *ext_data, int ext_len)
+       {
+       if (s->version >= TLS1_VERSION)
+               {
+               if (s->tlsext_session_ticket)
+                       {
+                       OPENSSL_free(s->tlsext_session_ticket);
+                       s->tlsext_session_ticket = NULL;
+                       }
+
+               s->tlsext_session_ticket = OPENSSL_malloc(sizeof(TLS_SESSION_TICKET_EXT) + ext_len);
+               if (!s->tlsext_session_ticket)
+                       {
+                       SSLerr(SSL_F_SSL_SET_SESSION_TICKET_EXT, ERR_R_MALLOC_FAILURE);
+                       return 0;
+                       }
+
+               if (ext_data)
+                       {
+                       s->tlsext_session_ticket->length = ext_len;
+                       s->tlsext_session_ticket->data = s->tlsext_session_ticket + 1;
+                       memcpy(s->tlsext_session_ticket->data, ext_data, ext_len);
+                       }
+               else
+                       {
+                       s->tlsext_session_ticket->length = 0;
+                       s->tlsext_session_ticket->data = NULL;
+                       }
+
+               return 1;
+               }
+
+       return 0;
+       }
+#endif /* OPENSSL_NO_TLSEXT */
+
 typedef struct timeout_param_st
        {
        SSL_CTX *ctx;
@@ -844,7 +953,7 @@ static void timeout_doall_arg(SSL_SESSION *s, TIMEOUT_PARAM *p)
                {
                /* The reason we don't call SSL_CTX_remove_session() is to
                 * save on locking overhead */
-               lh_SSL_SESSION_delete(p->cache,s);
+               (void)lh_SSL_SESSION_delete(p->cache,s);
                SSL_SESSION_list_remove(p->ctx,s);
                s->not_resumable=1;
                if (p->ctx->remove_session_cb != NULL)
@@ -998,6 +1107,25 @@ int (*SSL_CTX_get_client_cert_cb(SSL_CTX *ctx))(SSL * ssl, X509 ** x509 , EVP_PK
        return ctx->client_cert_cb;
        }
 
+#ifndef OPENSSL_NO_ENGINE
+int SSL_CTX_set_client_cert_engine(SSL_CTX *ctx, ENGINE *e)
+       {
+       if (!ENGINE_init(e))
+               {
+               SSLerr(SSL_F_SSL_CTX_SET_CLIENT_CERT_ENGINE, ERR_R_ENGINE_LIB);
+               return 0;
+               }
+       if(!ENGINE_get_ssl_client_cert_function(e))
+               {
+               SSLerr(SSL_F_SSL_CTX_SET_CLIENT_CERT_ENGINE, SSL_R_NO_CLIENT_CERT_METHOD);
+               ENGINE_finish(e);
+               return 0;
+               }
+       ctx->client_cert_engine = e;
+       return 1;
+       }
+#endif
+
 void SSL_CTX_set_cookie_generate_cb(SSL_CTX *ctx,
        int (*cb)(SSL *ssl, unsigned char *cookie, unsigned int *cookie_len))
        {