Line data Source code
1 : /* ssl/ssl_sess.c */
2 : /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 : * All rights reserved.
4 : *
5 : * This package is an SSL implementation written
6 : * by Eric Young (eay@cryptsoft.com).
7 : * The implementation was written so as to conform with Netscapes SSL.
8 : *
9 : * This library is free for commercial and non-commercial use as long as
10 : * the following conditions are aheared to. The following conditions
11 : * apply to all code found in this distribution, be it the RC4, RSA,
12 : * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 : * included with this distribution is covered by the same copyright terms
14 : * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 : *
16 : * Copyright remains Eric Young's, and as such any Copyright notices in
17 : * the code are not to be removed.
18 : * If this package is used in a product, Eric Young should be given attribution
19 : * as the author of the parts of the library used.
20 : * This can be in the form of a textual message at program startup or
21 : * in documentation (online or textual) provided with the package.
22 : *
23 : * Redistribution and use in source and binary forms, with or without
24 : * modification, are permitted provided that the following conditions
25 : * are met:
26 : * 1. Redistributions of source code must retain the copyright
27 : * notice, this list of conditions and the following disclaimer.
28 : * 2. Redistributions in binary form must reproduce the above copyright
29 : * notice, this list of conditions and the following disclaimer in the
30 : * documentation and/or other materials provided with the distribution.
31 : * 3. All advertising materials mentioning features or use of this software
32 : * must display the following acknowledgement:
33 : * "This product includes cryptographic software written by
34 : * Eric Young (eay@cryptsoft.com)"
35 : * The word 'cryptographic' can be left out if the rouines from the library
36 : * being used are not cryptographic related :-).
37 : * 4. If you include any Windows specific code (or a derivative thereof) from
38 : * the apps directory (application code) you must include an acknowledgement:
39 : * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 : *
41 : * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 : * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 : * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 : * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 : * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 : * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 : * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 : * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 : * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 : * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 : * SUCH DAMAGE.
52 : *
53 : * The licence and distribution terms for any publically available version or
54 : * derivative of this code cannot be changed. i.e. this code cannot simply be
55 : * copied and put under another distribution licence
56 : * [including the GNU Public Licence.]
57 : */
58 : /* ====================================================================
59 : * Copyright (c) 1998-2006 The OpenSSL Project. All rights reserved.
60 : *
61 : * Redistribution and use in source and binary forms, with or without
62 : * modification, are permitted provided that the following conditions
63 : * are met:
64 : *
65 : * 1. Redistributions of source code must retain the above copyright
66 : * notice, this list of conditions and the following disclaimer.
67 : *
68 : * 2. Redistributions in binary form must reproduce the above copyright
69 : * notice, this list of conditions and the following disclaimer in
70 : * the documentation and/or other materials provided with the
71 : * distribution.
72 : *
73 : * 3. All advertising materials mentioning features or use of this
74 : * software must display the following acknowledgment:
75 : * "This product includes software developed by the OpenSSL Project
76 : * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
77 : *
78 : * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
79 : * endorse or promote products derived from this software without
80 : * prior written permission. For written permission, please contact
81 : * openssl-core@openssl.org.
82 : *
83 : * 5. Products derived from this software may not be called "OpenSSL"
84 : * nor may "OpenSSL" appear in their names without prior written
85 : * permission of the OpenSSL Project.
86 : *
87 : * 6. Redistributions of any form whatsoever must retain the following
88 : * acknowledgment:
89 : * "This product includes software developed by the OpenSSL Project
90 : * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
91 : *
92 : * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
93 : * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
94 : * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
95 : * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
96 : * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
97 : * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
98 : * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
99 : * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
100 : * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
101 : * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
102 : * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
103 : * OF THE POSSIBILITY OF SUCH DAMAGE.
104 : * ====================================================================
105 : *
106 : * This product includes cryptographic software written by Eric Young
107 : * (eay@cryptsoft.com). This product includes software written by Tim
108 : * Hudson (tjh@cryptsoft.com).
109 : *
110 : */
111 : /* ====================================================================
112 : * Copyright 2005 Nokia. All rights reserved.
113 : *
114 : * The portions of the attached software ("Contribution") is developed by
115 : * Nokia Corporation and is licensed pursuant to the OpenSSL open source
116 : * license.
117 : *
118 : * The Contribution, originally written by Mika Kousa and Pasi Eronen of
119 : * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites
120 : * support (see RFC 4279) to OpenSSL.
121 : *
122 : * No patent licenses or other rights except those expressly stated in
123 : * the OpenSSL open source license shall be deemed granted or received
124 : * expressly, by implication, estoppel, or otherwise.
125 : *
126 : * No assurances are provided by Nokia that the Contribution does not
127 : * infringe the patent or other intellectual property rights of any third
128 : * party or that the license provides you with all the necessary rights
129 : * to make use of the Contribution.
130 : *
131 : * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN
132 : * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA
133 : * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY
134 : * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR
135 : * OTHERWISE.
136 : */
137 :
138 : #include <stdio.h>
139 : #include <openssl/lhash.h>
140 : #include <openssl/rand.h>
141 : #ifndef OPENSSL_NO_ENGINE
142 : # include <openssl/engine.h>
143 : #endif
144 : #include "ssl_locl.h"
145 :
146 : static void SSL_SESSION_list_remove(SSL_CTX *ctx, SSL_SESSION *s);
147 : static void SSL_SESSION_list_add(SSL_CTX *ctx, SSL_SESSION *s);
148 : static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck);
149 :
150 0 : SSL_SESSION *SSL_get_session(const SSL *ssl)
151 : /* aka SSL_get0_session; gets 0 objects, just returns a copy of the pointer */
152 : {
153 0 : return (ssl->session);
154 : }
155 :
156 0 : SSL_SESSION *SSL_get1_session(SSL *ssl)
157 : /* variant of SSL_get_session: caller really gets something */
158 : {
159 : SSL_SESSION *sess;
160 : /*
161 : * Need to lock this all up rather than just use CRYPTO_add so that
162 : * somebody doesn't free ssl->session between when we check it's non-null
163 : * and when we up the reference count.
164 : */
165 0 : CRYPTO_w_lock(CRYPTO_LOCK_SSL_SESSION);
166 0 : sess = ssl->session;
167 0 : if (sess)
168 0 : sess->references++;
169 0 : CRYPTO_w_unlock(CRYPTO_LOCK_SSL_SESSION);
170 0 : return (sess);
171 : }
172 :
173 0 : int SSL_SESSION_get_ex_new_index(long argl, void *argp,
174 : CRYPTO_EX_new *new_func,
175 : CRYPTO_EX_dup *dup_func,
176 : CRYPTO_EX_free *free_func)
177 : {
178 0 : return CRYPTO_get_ex_new_index(CRYPTO_EX_INDEX_SSL_SESSION, argl, argp,
179 : new_func, dup_func, free_func);
180 : }
181 :
182 0 : int SSL_SESSION_set_ex_data(SSL_SESSION *s, int idx, void *arg)
183 : {
184 0 : return (CRYPTO_set_ex_data(&s->ex_data, idx, arg));
185 : }
186 :
187 0 : void *SSL_SESSION_get_ex_data(const SSL_SESSION *s, int idx)
188 : {
189 0 : return (CRYPTO_get_ex_data(&s->ex_data, idx));
190 : }
191 :
192 1113 : SSL_SESSION *SSL_SESSION_new(void)
193 : {
194 : SSL_SESSION *ss;
195 :
196 1113 : ss = (SSL_SESSION *)OPENSSL_malloc(sizeof(SSL_SESSION));
197 1113 : if (ss == NULL) {
198 0 : SSLerr(SSL_F_SSL_SESSION_NEW, ERR_R_MALLOC_FAILURE);
199 0 : return (0);
200 : }
201 : memset(ss, 0, sizeof(SSL_SESSION));
202 :
203 1113 : ss->verify_result = 1; /* avoid 0 (= X509_V_OK) just in case */
204 1113 : ss->references = 1;
205 1113 : ss->timeout = 60 * 5 + 4; /* 5 minute timeout by default */
206 1113 : ss->time = (unsigned long)time(NULL);
207 1113 : ss->prev = NULL;
208 1113 : ss->next = NULL;
209 1113 : ss->compress_meth = 0;
210 : #ifndef OPENSSL_NO_TLSEXT
211 1113 : ss->tlsext_hostname = NULL;
212 : # ifndef OPENSSL_NO_EC
213 1113 : ss->tlsext_ecpointformatlist_length = 0;
214 1113 : ss->tlsext_ecpointformatlist = NULL;
215 1113 : ss->tlsext_ellipticcurvelist_length = 0;
216 1113 : ss->tlsext_ellipticcurvelist = NULL;
217 : # endif
218 : #endif
219 1113 : CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL_SESSION, ss, &ss->ex_data);
220 : #ifndef OPENSSL_NO_PSK
221 1113 : ss->psk_identity_hint = NULL;
222 1113 : ss->psk_identity = NULL;
223 : #endif
224 : #ifndef OPENSSL_NO_SRP
225 1113 : ss->srp_username = NULL;
226 : #endif
227 1113 : return (ss);
228 : }
229 :
230 : /*
231 : * Create a new SSL_SESSION and duplicate the contents of |src| into it. If
232 : * ticket == 0 then no ticket information is duplicated, otherwise it is.
233 : */
234 0 : SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket)
235 : {
236 : SSL_SESSION *dest;
237 :
238 0 : dest = OPENSSL_malloc(sizeof(*src));
239 0 : if (dest == NULL) {
240 : goto err;
241 : }
242 : memcpy(dest, src, sizeof(*dest));
243 :
244 : /*
245 : * Set the various pointers to NULL so that we can call SSL_SESSION_free in
246 : * the case of an error whilst halfway through constructing dest
247 : */
248 : #ifndef OPENSSL_NO_PSK
249 0 : dest->psk_identity_hint = NULL;
250 0 : dest->psk_identity = NULL;
251 : #endif
252 0 : dest->ciphers = NULL;
253 : #ifndef OPENSSL_NO_TLSEXT
254 0 : dest->tlsext_hostname = NULL;
255 : # ifndef OPENSSL_NO_EC
256 0 : dest->tlsext_ecpointformatlist = NULL;
257 0 : dest->tlsext_ellipticcurvelist = NULL;
258 : # endif
259 : #endif
260 0 : dest->tlsext_tick = NULL;
261 : #ifndef OPENSSL_NO_SRP
262 0 : dest->srp_username = NULL;
263 : #endif
264 0 : memset(&dest->ex_data, 0, sizeof(dest->ex_data));
265 :
266 : /* We deliberately don't copy the prev and next pointers */
267 0 : dest->prev = NULL;
268 0 : dest->next = NULL;
269 :
270 0 : dest->references = 1;
271 :
272 0 : if (src->sess_cert != NULL)
273 0 : CRYPTO_add(&src->sess_cert->references, 1, CRYPTO_LOCK_SSL_SESS_CERT);
274 :
275 0 : if (src->peer != NULL)
276 0 : CRYPTO_add(&src->peer->references, 1, CRYPTO_LOCK_X509);
277 :
278 : #ifndef OPENSSL_NO_PSK
279 0 : if (src->psk_identity_hint) {
280 0 : dest->psk_identity_hint = BUF_strdup(src->psk_identity_hint);
281 0 : if (dest->psk_identity_hint == NULL) {
282 : goto err;
283 : }
284 : }
285 0 : if (src->psk_identity) {
286 0 : dest->psk_identity = BUF_strdup(src->psk_identity);
287 0 : if (dest->psk_identity == NULL) {
288 : goto err;
289 : }
290 : }
291 : #endif
292 :
293 0 : if(src->ciphers != NULL) {
294 0 : dest->ciphers = sk_SSL_CIPHER_dup(src->ciphers);
295 0 : if (dest->ciphers == NULL)
296 : goto err;
297 : }
298 :
299 0 : if (!CRYPTO_dup_ex_data(CRYPTO_EX_INDEX_SSL_SESSION,
300 : &dest->ex_data, &src->ex_data)) {
301 : goto err;
302 : }
303 :
304 : #ifndef OPENSSL_NO_TLSEXT
305 0 : if (src->tlsext_hostname) {
306 0 : dest->tlsext_hostname = BUF_strdup(src->tlsext_hostname);
307 0 : if (dest->tlsext_hostname == NULL) {
308 : goto err;
309 : }
310 : }
311 : # ifndef OPENSSL_NO_EC
312 0 : if (src->tlsext_ecpointformatlist) {
313 0 : dest->tlsext_ecpointformatlist =
314 0 : BUF_memdup(src->tlsext_ecpointformatlist,
315 : src->tlsext_ecpointformatlist_length);
316 0 : if (dest->tlsext_ecpointformatlist == NULL)
317 : goto err;
318 : }
319 0 : if (src->tlsext_ellipticcurvelist) {
320 0 : dest->tlsext_ellipticcurvelist =
321 0 : BUF_memdup(src->tlsext_ellipticcurvelist,
322 : src->tlsext_ellipticcurvelist_length);
323 0 : if (dest->tlsext_ellipticcurvelist == NULL)
324 : goto err;
325 : }
326 : # endif
327 : #endif
328 :
329 0 : if (ticket != 0) {
330 0 : dest->tlsext_tick = BUF_memdup(src->tlsext_tick, src->tlsext_ticklen);
331 0 : if(dest->tlsext_tick == NULL)
332 : goto err;
333 : } else {
334 0 : dest->tlsext_tick_lifetime_hint = 0;
335 0 : dest->tlsext_ticklen = 0;
336 : }
337 :
338 : #ifndef OPENSSL_NO_SRP
339 0 : if (src->srp_username) {
340 0 : dest->srp_username = BUF_strdup(src->srp_username);
341 0 : if (dest->srp_username == NULL) {
342 : goto err;
343 : }
344 : }
345 : #endif
346 :
347 0 : return dest;
348 : err:
349 0 : SSLerr(SSL_F_SSL_SESSION_DUP, ERR_R_MALLOC_FAILURE);
350 0 : SSL_SESSION_free(dest);
351 0 : return NULL;
352 : }
353 :
354 0 : const unsigned char *SSL_SESSION_get_id(const SSL_SESSION *s,
355 : unsigned int *len)
356 : {
357 0 : if (len)
358 0 : *len = s->session_id_length;
359 0 : return s->session_id;
360 : }
361 :
362 0 : unsigned int SSL_SESSION_get_compress_id(const SSL_SESSION *s)
363 : {
364 0 : return s->compress_meth;
365 : }
366 :
367 : /*
368 : * Even with SSLv2, we have 16 bytes (128 bits) of session ID space.
369 : * SSLv3/TLSv1 has 32 bytes (256 bits). As such, filling the ID with random
370 : * gunk repeatedly until we have no conflict is going to complete in one
371 : * iteration pretty much "most" of the time (btw: understatement). So, if it
372 : * takes us 10 iterations and we still can't avoid a conflict - well that's a
373 : * reasonable point to call it quits. Either the RAND code is broken or
374 : * someone is trying to open roughly very close to 2^128 (or 2^256) SSL
375 : * sessions to our server. How you might store that many sessions is perhaps
376 : * a more interesting question ...
377 : */
378 :
379 : #define MAX_SESS_ID_ATTEMPTS 10
380 0 : static int def_generate_session_id(const SSL *ssl, unsigned char *id,
381 : unsigned int *id_len)
382 : {
383 : unsigned int retry = 0;
384 : do
385 0 : if (RAND_pseudo_bytes(id, *id_len) <= 0)
386 : return 0;
387 0 : while (SSL_has_matching_session_id(ssl, id, *id_len) &&
388 0 : (++retry < MAX_SESS_ID_ATTEMPTS)) ;
389 0 : if (retry < MAX_SESS_ID_ATTEMPTS)
390 : return 1;
391 : /* else - woops a session_id match */
392 : /*
393 : * XXX We should also check the external cache -- but the probability of
394 : * a collision is negligible, and we could not prevent the concurrent
395 : * creation of sessions with identical IDs since we currently don't have
396 : * means to atomically check whether a session ID already exists and make
397 : * a reservation for it if it does not (this problem applies to the
398 : * internal cache as well).
399 : */
400 0 : return 0;
401 : }
402 :
403 746 : int ssl_get_new_session(SSL *s, int session)
404 : {
405 : /* This gets used by clients and servers. */
406 :
407 : unsigned int tmp;
408 : SSL_SESSION *ss = NULL;
409 : GEN_SESSION_CB cb = def_generate_session_id;
410 :
411 746 : if ((ss = SSL_SESSION_new()) == NULL)
412 : return (0);
413 :
414 : /* If the context has a default timeout, use it */
415 746 : if (s->session_ctx->session_timeout == 0)
416 0 : ss->timeout = SSL_get_default_timeout(s);
417 : else
418 746 : ss->timeout = s->session_ctx->session_timeout;
419 :
420 746 : if (s->session != NULL) {
421 0 : SSL_SESSION_free(s->session);
422 0 : s->session = NULL;
423 : }
424 :
425 746 : if (session) {
426 373 : if (s->version == SSL2_VERSION) {
427 0 : ss->ssl_version = SSL2_VERSION;
428 0 : ss->session_id_length = SSL2_SSL_SESSION_ID_LENGTH;
429 373 : } else if (s->version == SSL3_VERSION) {
430 0 : ss->ssl_version = SSL3_VERSION;
431 0 : ss->session_id_length = SSL3_SSL_SESSION_ID_LENGTH;
432 373 : } else if (s->version == TLS1_VERSION) {
433 0 : ss->ssl_version = TLS1_VERSION;
434 0 : ss->session_id_length = SSL3_SSL_SESSION_ID_LENGTH;
435 373 : } else if (s->version == TLS1_1_VERSION) {
436 0 : ss->ssl_version = TLS1_1_VERSION;
437 0 : ss->session_id_length = SSL3_SSL_SESSION_ID_LENGTH;
438 373 : } else if (s->version == TLS1_2_VERSION) {
439 373 : ss->ssl_version = TLS1_2_VERSION;
440 373 : ss->session_id_length = SSL3_SSL_SESSION_ID_LENGTH;
441 0 : } else if (s->version == DTLS1_BAD_VER) {
442 0 : ss->ssl_version = DTLS1_BAD_VER;
443 0 : ss->session_id_length = SSL3_SSL_SESSION_ID_LENGTH;
444 0 : } else if (s->version == DTLS1_VERSION) {
445 0 : ss->ssl_version = DTLS1_VERSION;
446 0 : ss->session_id_length = SSL3_SSL_SESSION_ID_LENGTH;
447 0 : } else if (s->version == DTLS1_2_VERSION) {
448 0 : ss->ssl_version = DTLS1_2_VERSION;
449 0 : ss->session_id_length = SSL3_SSL_SESSION_ID_LENGTH;
450 : } else {
451 0 : SSLerr(SSL_F_SSL_GET_NEW_SESSION, SSL_R_UNSUPPORTED_SSL_VERSION);
452 0 : SSL_SESSION_free(ss);
453 0 : return (0);
454 : }
455 : #ifndef OPENSSL_NO_TLSEXT
456 : /*-
457 : * If RFC5077 ticket, use empty session ID (as server).
458 : * Note that:
459 : * (a) ssl_get_prev_session() does lookahead into the
460 : * ClientHello extensions to find the session ticket.
461 : * When ssl_get_prev_session() fails, s3_srvr.c calls
462 : * ssl_get_new_session() in ssl3_get_client_hello().
463 : * At that point, it has not yet parsed the extensions,
464 : * however, because of the lookahead, it already knows
465 : * whether a ticket is expected or not.
466 : *
467 : * (b) s3_clnt.c calls ssl_get_new_session() before parsing
468 : * ServerHello extensions, and before recording the session
469 : * ID received from the server, so this block is a noop.
470 : */
471 373 : if (s->tlsext_ticket_expected) {
472 373 : ss->session_id_length = 0;
473 373 : goto sess_id_done;
474 : }
475 : #endif
476 : /* Choose which callback will set the session ID */
477 0 : CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX);
478 0 : if (s->generate_session_id)
479 : cb = s->generate_session_id;
480 0 : else if (s->session_ctx->generate_session_id)
481 : cb = s->session_ctx->generate_session_id;
482 0 : CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX);
483 : /* Choose a session ID */
484 0 : tmp = ss->session_id_length;
485 0 : if (!cb(s, ss->session_id, &tmp)) {
486 : /* The callback failed */
487 0 : SSLerr(SSL_F_SSL_GET_NEW_SESSION,
488 : SSL_R_SSL_SESSION_ID_CALLBACK_FAILED);
489 0 : SSL_SESSION_free(ss);
490 0 : return (0);
491 : }
492 : /*
493 : * Don't allow the callback to set the session length to zero. nor
494 : * set it higher than it was.
495 : */
496 0 : if (!tmp || (tmp > ss->session_id_length)) {
497 : /* The callback set an illegal length */
498 0 : SSLerr(SSL_F_SSL_GET_NEW_SESSION,
499 : SSL_R_SSL_SESSION_ID_HAS_BAD_LENGTH);
500 0 : SSL_SESSION_free(ss);
501 0 : return (0);
502 : }
503 : /* If the session length was shrunk and we're SSLv2, pad it */
504 0 : if ((tmp < ss->session_id_length) && (s->version == SSL2_VERSION))
505 0 : memset(ss->session_id + tmp, 0, ss->session_id_length - tmp);
506 : else
507 0 : ss->session_id_length = tmp;
508 : /* Finally, check for a conflict */
509 0 : if (SSL_has_matching_session_id(s, ss->session_id,
510 : ss->session_id_length)) {
511 0 : SSLerr(SSL_F_SSL_GET_NEW_SESSION, SSL_R_SSL_SESSION_ID_CONFLICT);
512 0 : SSL_SESSION_free(ss);
513 0 : return (0);
514 : }
515 : #ifndef OPENSSL_NO_TLSEXT
516 : sess_id_done:
517 373 : if (s->tlsext_hostname) {
518 0 : ss->tlsext_hostname = BUF_strdup(s->tlsext_hostname);
519 0 : if (ss->tlsext_hostname == NULL) {
520 0 : SSLerr(SSL_F_SSL_GET_NEW_SESSION, ERR_R_INTERNAL_ERROR);
521 0 : SSL_SESSION_free(ss);
522 0 : return 0;
523 : }
524 : }
525 : #endif
526 : } else {
527 373 : ss->session_id_length = 0;
528 : }
529 :
530 746 : if (s->sid_ctx_length > sizeof ss->sid_ctx) {
531 0 : SSLerr(SSL_F_SSL_GET_NEW_SESSION, ERR_R_INTERNAL_ERROR);
532 0 : SSL_SESSION_free(ss);
533 0 : return 0;
534 : }
535 746 : memcpy(ss->sid_ctx, s->sid_ctx, s->sid_ctx_length);
536 746 : ss->sid_ctx_length = s->sid_ctx_length;
537 746 : s->session = ss;
538 746 : ss->ssl_version = s->version;
539 746 : ss->verify_result = X509_V_OK;
540 :
541 746 : return (1);
542 : }
543 :
544 : /*-
545 : * ssl_get_prev attempts to find an SSL_SESSION to be used to resume this
546 : * connection. It is only called by servers.
547 : *
548 : * session_id: points at the session ID in the ClientHello. This code will
549 : * read past the end of this in order to parse out the session ticket
550 : * extension, if any.
551 : * len: the length of the session ID.
552 : * limit: a pointer to the first byte after the ClientHello.
553 : *
554 : * Returns:
555 : * -1: error
556 : * 0: a session may have been found.
557 : *
558 : * Side effects:
559 : * - If a session is found then s->session is pointed at it (after freeing an
560 : * existing session if need be) and s->verify_result is set from the session.
561 : * - Both for new and resumed sessions, s->tlsext_ticket_expected is set to 1
562 : * if the server should issue a new session ticket (to 0 otherwise).
563 : */
564 373 : int ssl_get_prev_session(SSL *s, unsigned char *session_id, int len,
565 : const unsigned char *limit)
566 : {
567 : /* This is used only by servers. */
568 :
569 373 : SSL_SESSION *ret = NULL;
570 : int fatal = 0;
571 : int try_session_cache = 1;
572 : #ifndef OPENSSL_NO_TLSEXT
573 : int r;
574 : #endif
575 :
576 373 : if (len < 0 || len > SSL_MAX_SSL_SESSION_ID_LENGTH)
577 : goto err;
578 :
579 373 : if (session_id + len > limit) {
580 : fatal = 1;
581 : goto err;
582 : }
583 :
584 373 : if (len == 0)
585 : try_session_cache = 0;
586 :
587 : #ifndef OPENSSL_NO_TLSEXT
588 : /* sets s->tlsext_ticket_expected */
589 373 : r = tls1_process_ticket(s, session_id, len, limit, &ret);
590 373 : switch (r) {
591 : case -1: /* Error during processing */
592 : fatal = 1;
593 : goto err;
594 : case 0: /* No ticket found */
595 : case 1: /* Zero length ticket found */
596 : break; /* Ok to carry on processing session id. */
597 : case 2: /* Ticket found but not decrypted. */
598 : case 3: /* Ticket decrypted, *ret has been set. */
599 : try_session_cache = 0;
600 0 : break;
601 : default:
602 0 : abort();
603 : }
604 : #endif
605 :
606 373 : if (try_session_cache &&
607 0 : ret == NULL &&
608 0 : !(s->session_ctx->session_cache_mode &
609 : SSL_SESS_CACHE_NO_INTERNAL_LOOKUP)) {
610 : SSL_SESSION data;
611 0 : data.ssl_version = s->version;
612 0 : data.session_id_length = len;
613 0 : if (len == 0)
614 0 : return 0;
615 : memcpy(data.session_id, session_id, len);
616 0 : CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX);
617 0 : ret = lh_SSL_SESSION_retrieve(s->session_ctx->sessions, &data);
618 0 : if (ret != NULL) {
619 : /* don't allow other threads to steal it: */
620 0 : CRYPTO_add(&ret->references, 1, CRYPTO_LOCK_SSL_SESSION);
621 : }
622 0 : CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX);
623 0 : if (ret == NULL)
624 0 : s->session_ctx->stats.sess_miss++;
625 : }
626 :
627 373 : if (try_session_cache &&
628 0 : ret == NULL && s->session_ctx->get_session_cb != NULL) {
629 0 : int copy = 1;
630 :
631 0 : if ((ret = s->session_ctx->get_session_cb(s, session_id, len, ©))) {
632 0 : s->session_ctx->stats.sess_cb_hit++;
633 :
634 : /*
635 : * Increment reference count now if the session callback asks us
636 : * to do so (note that if the session structures returned by the
637 : * callback are shared between threads, it must handle the
638 : * reference count itself [i.e. copy == 0], or things won't be
639 : * thread-safe).
640 : */
641 0 : if (copy)
642 0 : CRYPTO_add(&ret->references, 1, CRYPTO_LOCK_SSL_SESSION);
643 :
644 : /*
645 : * Add the externally cached session to the internal cache as
646 : * well if and only if we are supposed to.
647 : */
648 0 : if (!
649 0 : (s->session_ctx->session_cache_mode &
650 : SSL_SESS_CACHE_NO_INTERNAL_STORE))
651 : /*
652 : * The following should not return 1, otherwise, things are
653 : * very strange
654 : */
655 0 : SSL_CTX_add_session(s->session_ctx, ret);
656 : }
657 : }
658 :
659 373 : if (ret == NULL)
660 : goto err;
661 :
662 : /* Now ret is non-NULL and we own one of its reference counts. */
663 :
664 0 : if (ret->sid_ctx_length != s->sid_ctx_length
665 0 : || memcmp(ret->sid_ctx, s->sid_ctx, ret->sid_ctx_length)) {
666 : /*
667 : * We have the session requested by the client, but we don't want to
668 : * use it in this context.
669 : */
670 : goto err; /* treat like cache miss */
671 : }
672 :
673 0 : if ((s->verify_mode & SSL_VERIFY_PEER) && s->sid_ctx_length == 0) {
674 : /*
675 : * We can't be sure if this session is being used out of context,
676 : * which is especially important for SSL_VERIFY_PEER. The application
677 : * should have used SSL[_CTX]_set_session_id_context. For this error
678 : * case, we generate an error instead of treating the event like a
679 : * cache miss (otherwise it would be easy for applications to
680 : * effectively disable the session cache by accident without anyone
681 : * noticing).
682 : */
683 :
684 0 : SSLerr(SSL_F_SSL_GET_PREV_SESSION,
685 : SSL_R_SESSION_ID_CONTEXT_UNINITIALIZED);
686 : fatal = 1;
687 0 : goto err;
688 : }
689 :
690 0 : if (ret->cipher == NULL) {
691 : unsigned char buf[5], *p;
692 : unsigned long l;
693 :
694 : p = buf;
695 0 : l = ret->cipher_id;
696 0 : l2n(l, p);
697 0 : if ((ret->ssl_version >> 8) >= SSL3_VERSION_MAJOR)
698 0 : ret->cipher = ssl_get_cipher_by_char(s, &(buf[2]));
699 : else
700 0 : ret->cipher = ssl_get_cipher_by_char(s, &(buf[1]));
701 0 : if (ret->cipher == NULL)
702 : goto err;
703 : }
704 :
705 0 : if (ret->timeout < (long)(time(NULL) - ret->time)) { /* timeout */
706 0 : s->session_ctx->stats.sess_timeout++;
707 0 : if (try_session_cache) {
708 : /* session was from the cache, so remove it */
709 : SSL_CTX_remove_session(s->session_ctx, ret);
710 : }
711 : goto err;
712 : }
713 :
714 0 : s->session_ctx->stats.sess_hit++;
715 :
716 0 : if (s->session != NULL)
717 0 : SSL_SESSION_free(s->session);
718 0 : s->session = ret;
719 0 : s->verify_result = s->session->verify_result;
720 0 : return 1;
721 :
722 : err:
723 373 : if (ret != NULL) {
724 0 : SSL_SESSION_free(ret);
725 : #ifndef OPENSSL_NO_TLSEXT
726 0 : if (!try_session_cache) {
727 : /*
728 : * The session was from a ticket, so we should issue a ticket for
729 : * the new session
730 : */
731 0 : s->tlsext_ticket_expected = 1;
732 : }
733 : #endif
734 : }
735 373 : if (fatal)
736 : return -1;
737 : else
738 373 : return 0;
739 : }
740 :
741 0 : int SSL_CTX_add_session(SSL_CTX *ctx, SSL_SESSION *c)
742 : {
743 : int ret = 0;
744 : SSL_SESSION *s;
745 :
746 : /*
747 : * add just 1 reference count for the SSL_CTX's session cache even though
748 : * it has two ways of access: each session is in a doubly linked list and
749 : * an lhash
750 : */
751 0 : CRYPTO_add(&c->references, 1, CRYPTO_LOCK_SSL_SESSION);
752 : /*
753 : * if session c is in already in cache, we take back the increment later
754 : */
755 :
756 0 : CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
757 0 : s = lh_SSL_SESSION_insert(ctx->sessions, c);
758 :
759 : /*
760 : * s != NULL iff we already had a session with the given PID. In this
761 : * case, s == c should hold (then we did not really modify
762 : * ctx->sessions), or we're in trouble.
763 : */
764 0 : if (s != NULL && s != c) {
765 : /* We *are* in trouble ... */
766 0 : SSL_SESSION_list_remove(ctx, s);
767 0 : SSL_SESSION_free(s);
768 : /*
769 : * ... so pretend the other session did not exist in cache (we cannot
770 : * handle two SSL_SESSION structures with identical session ID in the
771 : * same cache, which could happen e.g. when two threads concurrently
772 : * obtain the same session from an external cache)
773 : */
774 : s = NULL;
775 : }
776 :
777 : /* Put at the head of the queue unless it is already in the cache */
778 0 : if (s == NULL)
779 0 : SSL_SESSION_list_add(ctx, c);
780 :
781 0 : if (s != NULL) {
782 : /*
783 : * existing cache entry -- decrement previously incremented reference
784 : * count because it already takes into account the cache
785 : */
786 :
787 0 : SSL_SESSION_free(s); /* s == c */
788 : ret = 0;
789 : } else {
790 : /*
791 : * new cache entry -- remove old ones if cache has become too large
792 : */
793 :
794 : ret = 1;
795 :
796 0 : if (SSL_CTX_sess_get_cache_size(ctx) > 0) {
797 0 : while (SSL_CTX_sess_number(ctx) >
798 0 : SSL_CTX_sess_get_cache_size(ctx)) {
799 0 : if (!remove_session_lock(ctx, ctx->session_cache_tail, 0))
800 : break;
801 : else
802 0 : ctx->stats.sess_cache_full++;
803 : }
804 : }
805 : }
806 0 : CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
807 0 : return (ret);
808 : }
809 :
810 0 : int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)
811 : {
812 732 : return remove_session_lock(ctx, c, 1);
813 : }
814 :
815 732 : static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck)
816 : {
817 : SSL_SESSION *r;
818 : int ret = 0;
819 :
820 732 : if ((c != NULL) && (c->session_id_length != 0)) {
821 365 : if (lck)
822 365 : CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
823 365 : if ((r = lh_SSL_SESSION_retrieve(ctx->sessions, c)) == c) {
824 : ret = 1;
825 0 : r = lh_SSL_SESSION_delete(ctx->sessions, c);
826 0 : SSL_SESSION_list_remove(ctx, c);
827 : }
828 :
829 365 : if (lck)
830 365 : CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
831 :
832 365 : if (ret) {
833 0 : r->not_resumable = 1;
834 0 : if (ctx->remove_session_cb != NULL)
835 0 : ctx->remove_session_cb(ctx, r);
836 0 : SSL_SESSION_free(r);
837 : }
838 : } else
839 : ret = 0;
840 732 : return (ret);
841 : }
842 :
843 1113 : void SSL_SESSION_free(SSL_SESSION *ss)
844 : {
845 : int i;
846 :
847 1113 : if (ss == NULL)
848 : return;
849 :
850 1113 : i = CRYPTO_add(&ss->references, -1, CRYPTO_LOCK_SSL_SESSION);
851 : #ifdef REF_PRINT
852 : REF_PRINT("SSL_SESSION", ss);
853 : #endif
854 1113 : if (i > 0)
855 : return;
856 : #ifdef REF_CHECK
857 : if (i < 0) {
858 : fprintf(stderr, "SSL_SESSION_free, bad reference count\n");
859 : abort(); /* ok */
860 : }
861 : #endif
862 :
863 1113 : CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_SESSION, ss, &ss->ex_data);
864 :
865 1113 : OPENSSL_cleanse(ss->key_arg, sizeof ss->key_arg);
866 1113 : OPENSSL_cleanse(ss->master_key, sizeof ss->master_key);
867 1113 : OPENSSL_cleanse(ss->session_id, sizeof ss->session_id);
868 1113 : if (ss->sess_cert != NULL)
869 370 : ssl_sess_cert_free(ss->sess_cert);
870 1113 : if (ss->peer != NULL)
871 370 : X509_free(ss->peer);
872 1113 : if (ss->ciphers != NULL)
873 373 : sk_SSL_CIPHER_free(ss->ciphers);
874 : #ifndef OPENSSL_NO_TLSEXT
875 1113 : if (ss->tlsext_hostname != NULL)
876 1110 : OPENSSL_free(ss->tlsext_hostname);
877 1113 : if (ss->tlsext_tick != NULL)
878 365 : OPENSSL_free(ss->tlsext_tick);
879 : # ifndef OPENSSL_NO_EC
880 1113 : ss->tlsext_ecpointformatlist_length = 0;
881 1113 : if (ss->tlsext_ecpointformatlist != NULL)
882 743 : OPENSSL_free(ss->tlsext_ecpointformatlist);
883 1113 : ss->tlsext_ellipticcurvelist_length = 0;
884 1113 : if (ss->tlsext_ellipticcurvelist != NULL)
885 373 : OPENSSL_free(ss->tlsext_ellipticcurvelist);
886 : # endif /* OPENSSL_NO_EC */
887 : #endif
888 : #ifndef OPENSSL_NO_PSK
889 1113 : if (ss->psk_identity_hint != NULL)
890 0 : OPENSSL_free(ss->psk_identity_hint);
891 1113 : if (ss->psk_identity != NULL)
892 0 : OPENSSL_free(ss->psk_identity);
893 : #endif
894 : #ifndef OPENSSL_NO_SRP
895 1113 : if (ss->srp_username != NULL)
896 0 : OPENSSL_free(ss->srp_username);
897 : #endif
898 1113 : OPENSSL_cleanse(ss, sizeof(*ss));
899 1113 : OPENSSL_free(ss);
900 : }
901 :
902 0 : int SSL_set_session(SSL *s, SSL_SESSION *session)
903 : {
904 : int ret = 0;
905 : const SSL_METHOD *meth;
906 :
907 0 : if (session != NULL) {
908 0 : meth = s->ctx->method->get_ssl_method(session->ssl_version);
909 0 : if (meth == NULL)
910 0 : meth = s->method->get_ssl_method(session->ssl_version);
911 0 : if (meth == NULL) {
912 0 : SSLerr(SSL_F_SSL_SET_SESSION, SSL_R_UNABLE_TO_FIND_SSL_METHOD);
913 0 : return (0);
914 : }
915 :
916 0 : if (meth != s->method) {
917 0 : if (!SSL_set_ssl_method(s, meth))
918 : return (0);
919 : }
920 : #ifndef OPENSSL_NO_KRB5
921 : if (s->kssl_ctx && !s->kssl_ctx->client_princ &&
922 : session->krb5_client_princ_len > 0) {
923 : s->kssl_ctx->client_princ =
924 : (char *)OPENSSL_malloc(session->krb5_client_princ_len + 1);
925 : memcpy(s->kssl_ctx->client_princ, session->krb5_client_princ,
926 : session->krb5_client_princ_len);
927 : s->kssl_ctx->client_princ[session->krb5_client_princ_len] = '\0';
928 : }
929 : #endif /* OPENSSL_NO_KRB5 */
930 :
931 : /* CRYPTO_w_lock(CRYPTO_LOCK_SSL); */
932 0 : CRYPTO_add(&session->references, 1, CRYPTO_LOCK_SSL_SESSION);
933 0 : if (s->session != NULL)
934 0 : SSL_SESSION_free(s->session);
935 0 : s->session = session;
936 0 : s->verify_result = s->session->verify_result;
937 : /* CRYPTO_w_unlock(CRYPTO_LOCK_SSL); */
938 : ret = 1;
939 : } else {
940 0 : if (s->session != NULL) {
941 0 : SSL_SESSION_free(s->session);
942 0 : s->session = NULL;
943 : }
944 :
945 0 : meth = s->ctx->method;
946 0 : if (meth != s->method) {
947 0 : if (!SSL_set_ssl_method(s, meth))
948 : return (0);
949 : }
950 : ret = 1;
951 : }
952 : return (ret);
953 : }
954 :
955 0 : long SSL_SESSION_set_timeout(SSL_SESSION *s, long t)
956 : {
957 0 : if (s == NULL)
958 : return (0);
959 0 : s->timeout = t;
960 0 : return (1);
961 : }
962 :
963 0 : long SSL_SESSION_get_timeout(const SSL_SESSION *s)
964 : {
965 0 : if (s == NULL)
966 : return (0);
967 0 : return (s->timeout);
968 : }
969 :
970 0 : long SSL_SESSION_get_time(const SSL_SESSION *s)
971 : {
972 0 : if (s == NULL)
973 : return (0);
974 0 : return (s->time);
975 : }
976 :
977 0 : long SSL_SESSION_set_time(SSL_SESSION *s, long t)
978 : {
979 0 : if (s == NULL)
980 : return (0);
981 0 : s->time = t;
982 0 : return (t);
983 : }
984 :
985 0 : X509 *SSL_SESSION_get0_peer(SSL_SESSION *s)
986 : {
987 0 : return s->peer;
988 : }
989 :
990 0 : int SSL_SESSION_set1_id_context(SSL_SESSION *s, const unsigned char *sid_ctx,
991 : unsigned int sid_ctx_len)
992 : {
993 0 : if (sid_ctx_len > SSL_MAX_SID_CTX_LENGTH) {
994 0 : SSLerr(SSL_F_SSL_SESSION_SET1_ID_CONTEXT,
995 : SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG);
996 0 : return 0;
997 : }
998 0 : s->sid_ctx_length = sid_ctx_len;
999 0 : memcpy(s->sid_ctx, sid_ctx, sid_ctx_len);
1000 :
1001 0 : return 1;
1002 : }
1003 :
1004 0 : long SSL_CTX_set_timeout(SSL_CTX *s, long t)
1005 : {
1006 : long l;
1007 0 : if (s == NULL)
1008 : return (0);
1009 0 : l = s->session_timeout;
1010 0 : s->session_timeout = t;
1011 0 : return (l);
1012 : }
1013 :
1014 0 : long SSL_CTX_get_timeout(const SSL_CTX *s)
1015 : {
1016 0 : if (s == NULL)
1017 : return (0);
1018 0 : return (s->session_timeout);
1019 : }
1020 :
1021 : #ifndef OPENSSL_NO_TLSEXT
1022 0 : int SSL_set_session_secret_cb(SSL *s,
1023 : int (*tls_session_secret_cb) (SSL *s,
1024 : void *secret,
1025 : int *secret_len,
1026 : STACK_OF(SSL_CIPHER)
1027 : *peer_ciphers,
1028 : SSL_CIPHER
1029 : **cipher,
1030 : void *arg),
1031 : void *arg)
1032 : {
1033 0 : if (s == NULL)
1034 : return (0);
1035 0 : s->tls_session_secret_cb = tls_session_secret_cb;
1036 0 : s->tls_session_secret_cb_arg = arg;
1037 0 : return (1);
1038 : }
1039 :
1040 0 : int SSL_set_session_ticket_ext_cb(SSL *s, tls_session_ticket_ext_cb_fn cb,
1041 : void *arg)
1042 : {
1043 0 : if (s == NULL)
1044 : return (0);
1045 0 : s->tls_session_ticket_ext_cb = cb;
1046 0 : s->tls_session_ticket_ext_cb_arg = arg;
1047 0 : return (1);
1048 : }
1049 :
1050 0 : int SSL_set_session_ticket_ext(SSL *s, void *ext_data, int ext_len)
1051 : {
1052 0 : if (s->version >= TLS1_VERSION) {
1053 0 : if (s->tlsext_session_ticket) {
1054 0 : OPENSSL_free(s->tlsext_session_ticket);
1055 0 : s->tlsext_session_ticket = NULL;
1056 : }
1057 :
1058 0 : s->tlsext_session_ticket =
1059 0 : OPENSSL_malloc(sizeof(TLS_SESSION_TICKET_EXT) + ext_len);
1060 0 : if (!s->tlsext_session_ticket) {
1061 0 : SSLerr(SSL_F_SSL_SET_SESSION_TICKET_EXT, ERR_R_MALLOC_FAILURE);
1062 0 : return 0;
1063 : }
1064 :
1065 0 : if (ext_data) {
1066 0 : s->tlsext_session_ticket->length = ext_len;
1067 0 : s->tlsext_session_ticket->data = s->tlsext_session_ticket + 1;
1068 0 : memcpy(s->tlsext_session_ticket->data, ext_data, ext_len);
1069 : } else {
1070 0 : s->tlsext_session_ticket->length = 0;
1071 0 : s->tlsext_session_ticket->data = NULL;
1072 : }
1073 :
1074 : return 1;
1075 : }
1076 :
1077 : return 0;
1078 : }
1079 : #endif /* OPENSSL_NO_TLSEXT */
1080 :
1081 : typedef struct timeout_param_st {
1082 : SSL_CTX *ctx;
1083 : long time;
1084 : LHASH_OF(SSL_SESSION) *cache;
1085 : } TIMEOUT_PARAM;
1086 :
1087 0 : static void timeout_doall_arg(SSL_SESSION *s, TIMEOUT_PARAM *p)
1088 : {
1089 0 : if ((p->time == 0) || (p->time > (s->time + s->timeout))) { /* timeout */
1090 : /*
1091 : * The reason we don't call SSL_CTX_remove_session() is to save on
1092 : * locking overhead
1093 : */
1094 0 : (void)lh_SSL_SESSION_delete(p->cache, s);
1095 0 : SSL_SESSION_list_remove(p->ctx, s);
1096 0 : s->not_resumable = 1;
1097 0 : if (p->ctx->remove_session_cb != NULL)
1098 0 : p->ctx->remove_session_cb(p->ctx, s);
1099 0 : SSL_SESSION_free(s);
1100 : }
1101 0 : }
1102 :
1103 0 : static IMPLEMENT_LHASH_DOALL_ARG_FN(timeout, SSL_SESSION, TIMEOUT_PARAM)
1104 :
1105 872 : void SSL_CTX_flush_sessions(SSL_CTX *s, long t)
1106 : {
1107 : unsigned long i;
1108 : TIMEOUT_PARAM tp;
1109 :
1110 872 : tp.ctx = s;
1111 872 : tp.cache = s->sessions;
1112 872 : if (tp.cache == NULL)
1113 0 : return;
1114 872 : tp.time = t;
1115 872 : CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
1116 872 : i = CHECKED_LHASH_OF(SSL_SESSION, tp.cache)->down_load;
1117 872 : CHECKED_LHASH_OF(SSL_SESSION, tp.cache)->down_load = 0;
1118 872 : lh_SSL_SESSION_doall_arg(tp.cache, LHASH_DOALL_ARG_FN(timeout),
1119 : TIMEOUT_PARAM, &tp);
1120 872 : CHECKED_LHASH_OF(SSL_SESSION, tp.cache)->down_load = i;
1121 872 : CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
1122 : }
1123 :
1124 2242 : int ssl_clear_bad_session(SSL *s)
1125 : {
1126 2988 : if ((s->session != NULL) &&
1127 1492 : !(s->shutdown & SSL_SENT_SHUTDOWN) &&
1128 1478 : !(SSL_in_init(s) || SSL_in_before(s))) {
1129 732 : SSL_CTX_remove_session(s->ctx, s->session);
1130 732 : return (1);
1131 : } else
1132 : return (0);
1133 : }
1134 :
1135 : /* locked by SSL_CTX in the calling function */
1136 0 : static void SSL_SESSION_list_remove(SSL_CTX *ctx, SSL_SESSION *s)
1137 : {
1138 0 : if ((s->next == NULL) || (s->prev == NULL))
1139 0 : return;
1140 :
1141 0 : if (s->next == (SSL_SESSION *)&(ctx->session_cache_tail)) {
1142 : /* last element in list */
1143 0 : if (s->prev == (SSL_SESSION *)&(ctx->session_cache_head)) {
1144 : /* only one element in list */
1145 0 : ctx->session_cache_head = NULL;
1146 0 : ctx->session_cache_tail = NULL;
1147 : } else {
1148 0 : ctx->session_cache_tail = s->prev;
1149 0 : s->prev->next = (SSL_SESSION *)&(ctx->session_cache_tail);
1150 : }
1151 : } else {
1152 0 : if (s->prev == (SSL_SESSION *)&(ctx->session_cache_head)) {
1153 : /* first element in list */
1154 0 : ctx->session_cache_head = s->next;
1155 0 : s->next->prev = (SSL_SESSION *)&(ctx->session_cache_head);
1156 : } else {
1157 : /* middle of list */
1158 0 : s->next->prev = s->prev;
1159 0 : s->prev->next = s->next;
1160 : }
1161 : }
1162 0 : s->prev = s->next = NULL;
1163 : }
1164 :
1165 0 : static void SSL_SESSION_list_add(SSL_CTX *ctx, SSL_SESSION *s)
1166 : {
1167 0 : if ((s->next != NULL) && (s->prev != NULL))
1168 0 : SSL_SESSION_list_remove(ctx, s);
1169 :
1170 0 : if (ctx->session_cache_head == NULL) {
1171 0 : ctx->session_cache_head = s;
1172 0 : ctx->session_cache_tail = s;
1173 0 : s->prev = (SSL_SESSION *)&(ctx->session_cache_head);
1174 0 : s->next = (SSL_SESSION *)&(ctx->session_cache_tail);
1175 : } else {
1176 0 : s->next = ctx->session_cache_head;
1177 0 : s->next->prev = s;
1178 0 : s->prev = (SSL_SESSION *)&(ctx->session_cache_head);
1179 0 : ctx->session_cache_head = s;
1180 : }
1181 0 : }
1182 :
1183 0 : void SSL_CTX_sess_set_new_cb(SSL_CTX *ctx,
1184 : int (*cb) (struct ssl_st *ssl,
1185 : SSL_SESSION *sess))
1186 : {
1187 0 : ctx->new_session_cb = cb;
1188 0 : }
1189 :
1190 0 : int (*SSL_CTX_sess_get_new_cb(SSL_CTX *ctx)) (SSL *ssl, SSL_SESSION *sess) {
1191 0 : return ctx->new_session_cb;
1192 : }
1193 :
1194 0 : void SSL_CTX_sess_set_remove_cb(SSL_CTX *ctx,
1195 : void (*cb) (SSL_CTX *ctx, SSL_SESSION *sess))
1196 : {
1197 0 : ctx->remove_session_cb = cb;
1198 0 : }
1199 :
1200 0 : void (*SSL_CTX_sess_get_remove_cb(SSL_CTX *ctx)) (SSL_CTX *ctx,
1201 : SSL_SESSION *sess) {
1202 0 : return ctx->remove_session_cb;
1203 : }
1204 :
1205 0 : void SSL_CTX_sess_set_get_cb(SSL_CTX *ctx,
1206 : SSL_SESSION *(*cb) (struct ssl_st *ssl,
1207 : unsigned char *data, int len,
1208 : int *copy))
1209 : {
1210 0 : ctx->get_session_cb = cb;
1211 0 : }
1212 :
1213 0 : SSL_SESSION *(*SSL_CTX_sess_get_get_cb(SSL_CTX *ctx)) (SSL *ssl,
1214 : unsigned char *data,
1215 : int len, int *copy) {
1216 0 : return ctx->get_session_cb;
1217 : }
1218 :
1219 0 : void SSL_CTX_set_info_callback(SSL_CTX *ctx,
1220 : void (*cb) (const SSL *ssl, int type, int val))
1221 : {
1222 0 : ctx->info_callback = cb;
1223 0 : }
1224 :
1225 0 : void (*SSL_CTX_get_info_callback(SSL_CTX *ctx)) (const SSL *ssl, int type,
1226 : int val) {
1227 0 : return ctx->info_callback;
1228 : }
1229 :
1230 0 : void SSL_CTX_set_client_cert_cb(SSL_CTX *ctx,
1231 : int (*cb) (SSL *ssl, X509 **x509,
1232 : EVP_PKEY **pkey))
1233 : {
1234 0 : ctx->client_cert_cb = cb;
1235 0 : }
1236 :
1237 0 : int (*SSL_CTX_get_client_cert_cb(SSL_CTX *ctx)) (SSL *ssl, X509 **x509,
1238 : EVP_PKEY **pkey) {
1239 0 : return ctx->client_cert_cb;
1240 : }
1241 :
1242 : #ifndef OPENSSL_NO_ENGINE
1243 0 : int SSL_CTX_set_client_cert_engine(SSL_CTX *ctx, ENGINE *e)
1244 : {
1245 0 : if (!ENGINE_init(e)) {
1246 0 : SSLerr(SSL_F_SSL_CTX_SET_CLIENT_CERT_ENGINE, ERR_R_ENGINE_LIB);
1247 0 : return 0;
1248 : }
1249 0 : if (!ENGINE_get_ssl_client_cert_function(e)) {
1250 0 : SSLerr(SSL_F_SSL_CTX_SET_CLIENT_CERT_ENGINE,
1251 : SSL_R_NO_CLIENT_CERT_METHOD);
1252 0 : ENGINE_finish(e);
1253 0 : return 0;
1254 : }
1255 0 : ctx->client_cert_engine = e;
1256 0 : return 1;
1257 : }
1258 : #endif
1259 :
1260 0 : void SSL_CTX_set_cookie_generate_cb(SSL_CTX *ctx,
1261 : int (*cb) (SSL *ssl,
1262 : unsigned char *cookie,
1263 : unsigned int *cookie_len))
1264 : {
1265 0 : ctx->app_gen_cookie_cb = cb;
1266 0 : }
1267 :
1268 0 : void SSL_CTX_set_cookie_verify_cb(SSL_CTX *ctx,
1269 : int (*cb) (SSL *ssl, unsigned char *cookie,
1270 : unsigned int cookie_len))
1271 : {
1272 0 : ctx->app_verify_cookie_cb = cb;
1273 0 : }
1274 :
1275 0 : IMPLEMENT_PEM_rw(SSL_SESSION, SSL_SESSION, PEM_STRING_SSL_SESSION,
1276 : SSL_SESSION)
|
