summaryrefslogtreecommitdiffstats
path: root/ssl/ssl_sess.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Add the SSL_METHOD for TLSv1.3 and all other base changes requiredMatt Caswell2016-11-021-0/+3
| | | | | | | | | | | Includes addition of the various options to s_server/s_client. Also adds one of the new TLS1.3 ciphersuites. This isn't "real" TLS1.3!! It's identical to TLS1.2 apart from the protocol and the ciphersuite...and the ciphersuite is just a renamed TLS1.2 one (not a "real" TLS1.3 ciphersuite). Reviewed-by: Rich Salz <rsalz@openssl.org>
* Indent ssl/Emilia Kasper2016-08-181-21/+18
| | | | | | | | | Run util/openssl-format-source on ssl/ Some comments and hand-formatted tables were fixed up manually by disabling auto-formatting. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Add missing session id and tlsext_status accessorsRemi Gacogne2016-08-171-0/+20
| | | | | | | | | | * SSL_SESSION_set1_id() * SSL_SESSION_get0_id_context() * SSL_CTX_get_tlsext_status_cb() * SSL_CTX_get_tlsext_status_arg() Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* Convert SSL_SESSION* functions to use const gettersMatt Caswell2016-08-171-1/+1
| | | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Stephen Henson <steve@openssl.org>
* GH1446: Add SSL_SESSION_get0_cipherRich Salz2016-08-121-0/+5
| | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1451)
* Fix a few if(, for(, while( inside code.FdaSilvaYY2016-07-201-2/+2
| | | | | | | Fix some indentation at the same time Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1292)
* Remove sessions from external cache, even if internal cache not used.Matt Caswell2016-07-191-5/+5
| | | | | | | | If the SSL_SESS_CACHE_NO_INTERNAL_STORE cache mode is used then we weren't removing sessions from the external cache, e.g. if an alert occurs the session is supposed to be automatically removed. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Initialize the session_idKurt Roeckx2016-06-141-0/+2
| | | | | | | | | | | | | ssl_session_hash() always looks at the first 4 bytes, regardless of the length. A client can send a session id that's shorter, and the callback could also generate one that's shorter. So we make sure that the rest of the buffer is initliazed to 0 so that we always calculate the same hash. Found by tis-interpreter, also previously reported as RT #2871 Reviewed-by: Rich Salz <rsalz@openssl.org> MR: #2911
* Ensure SSL_set_session clears the old session from cache if it is badMatt Caswell2016-06-131-19/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | SSL_clear() and SSL_free() will remove a session from the cache if it is considered "bad". However SSL_set_session() does not do this for the session it is replacing. SSL_clear() clears an SSL object ready for reuse. It does not clear the session though. This means that: SSL_clear(s) SSL_set_session(s, sess); and SSL_set_session(s, sess); SSL_clear(s); do not do the same thing, although logically you would expect that they would. The failure of SSL_set_session() to remove bad sessions from the cache should be considered a bug, so this commit fixes it. RT#597 Reviewed-by: Rich Salz <rsalz@openssl.org>
* Always use session_ctx when removing a sessionTodd Short2016-06-081-1/+1
| | | | | | | | Sessions are stored on the session_ctx, which doesn't change after SSL_set_SSL_CTX(). Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* Remove null check, per review feedback. Note this in the docs.TJ Saunders2016-05-311-2/+0
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1135)
* Add an SSL_SESSION accessor for obtaining the protocol version number, withTJ Saunders2016-05-311-0/+7
| | | | | | | accompanying documentation. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1135)
* Rename lh_xxx,sk_xxx tp OPENSSL_{LH,SK}_xxxRich Salz2016-05-201-3/+3
| | | | | | | | | | | | Rename sk_xxx to OPENSSL_sk_xxx and _STACK to OPENSSL_STACK Rename lh_xxx API to OPENSSL_LH_xxx and LHASH_NODE to OPENSSL_LH_NODE Make lhash stuff opaque. Use typedefs for function pointers; makes the code simpler. Remove CHECKED_xxx macros. Add documentation; remove old X509-oriented doc. Add API-compat names for entire old API Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* Copyright consolidation 01/10Rich Salz2016-05-171-107/+7
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Fix some out of date commentsMatt Caswell2016-05-171-3/+3
| | | | | | | | | Fix various references to s3_clnt.c and s3_srvr.c which don't exist any more. GitHub Issue #765 Reviewed-by: Richard Levitte <levitte@openssl.org>
* Add checks on CRYPTO_new_ex_data return valueFdaSilvaYY2016-04-281-2/+5
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/996)
* Add SSL_SESSION_get0_hostname()Lyon Chen2016-04-141-0/+5
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Allow different protocol version when trying to reuse a sessionFedor Indutny2016-03-271-15/+4
| | | | | | | | | | | | | | | | | We now send the highest supported version by the client, even if the session uses an older version. This fixes 2 problems: - When you try to reuse a session but the other side doesn't reuse it and uses a different protocol version the connection will fail. - When you're trying to reuse a session with an old version you might be stuck trying to reuse the old version while both sides support a newer version Signed-off-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> GH: #852, MR: #2452
* Remove #error from include files.Rich Salz2016-03-211-3/+1
| | | | | | | | Don't have #error statements in header files, but instead wrap the contents of that file in #ifndef OPENSSL_NO_xxx This means it is now always safe to include the header file. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Convert CRYPTO_LOCK_SSL_* to new multi-threading APIAlessandro Ghedini2016-03-091-24/+49
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Move to REF_DEBUG, for consistency.Rich Salz2016-02-111-9/+2
| | | | | | | Add utility macros REF_ASSERT_NOT and REF_PRINT_COUNT This is also RT 4181 Reviewed-by: Richard Levitte <levitte@openssl.org>
* constify PACKETEmilia Kasper2016-02-011-10/+6
| | | | | | | | PACKET contents should be read-only. To achieve this, also - constify two user callbacks - constify BUF_reverse. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Remove /* foo.c */ commentsRich Salz2016-01-261-1/+0
| | | | | | | | | | | | This was done by the following find . -name '*.[ch]' | /tmp/pl where /tmp/pl is the following three-line script: print unless $. == 1 && m@/\* .*\.[ch] \*/@; close ARGV if eof; # Close file to reset $. And then some hand-editing of other files. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Validate ClientHello session_id field length and send alert on failureAlessandro Ghedini2016-01-191-5/+1
| | | | | | | RT#4080 Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* Add lh_doall_arg inliningDr. Stephen Henson2016-01-111-4/+3
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Fix declarations and constification for inline stack.Dr. Stephen Henson2016-01-071-1/+1
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Rename some BUF_xxx to OPENSSL_xxxRich Salz2015-12-161-8/+8
| | | | | | | | | Rename BUF_{strdup,strlcat,strlcpy,memdup,strndup,strnlen} to OPENSSL_{strdup,strlcat,strlcpy,memdup,strndup,strnlen} Add #define's for the old names. Add CRYPTO_{memdup,strndup}, called by OPENSSL_{memdup,strndup} macros. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Extended master secret fixes and checks.Dr. Stephen Henson2015-12-081-2/+20
| | | | | | | | | | | | Add new flag TLS1_FLAGS_RECEIVED_EXTMS which is set when the peer sends the extended master secret extension. Server now sends extms if and only if the client sent extms. Check consistency of extms extension when resuming sessions following (where practical) RFC7627. Reviewed-by: Matt Caswell <matt@openssl.org>
* ex_data part 2: doc fixes and CRYPTO_free_ex_index.Rich Salz2015-12-011-9/+0
| | | | | | | | | | Add CRYPTO_free_ex_index (for shared libraries) Unify and complete the documentation for all "ex_data" API's and objects. Replace xxx_get_ex_new_index functions with a macro. Added an exdata test. Renamed the ex_data internal datatypes. Reviewed-by: Matt Caswell <matt@openssl.org>
* Fix a few missed "if (!ptr)" cleanupsRich Salz2015-11-231-1/+1
| | | | | And a scalar !x --> x==0 test Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Standardise our style for checking malloc failuresMatt Caswell2015-11-091-1/+1
| | | | | | | | if we have a malloc |x = OPENSSL_malloc(...)| sometimes we check |x| for NULL and sometimes we treat it as a boolean |if(!x) ...|. Standardise the approach in libssl. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* DTLS: remove unused cookie fieldEmilia Kasper2015-10-091-1/+1
| | | | | | | | Note that this commit constifies a user callback parameter and therefore will break compilation for applications using this callback. But unless they are abusing write access to the buffer, the fix is trivial. Reviewed-by: Andy Polyakov <appro@openssl.org>
* Add PACKET_copy_allEmilia Kasper2015-10-051-4/+7
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* ssl_sess.c: grab a copy of the session IDEmilia Kasper2015-10-051-6/+8
| | | | | | | The user callback takes a non-const pointer, so don't pass PACKET data to it directly; rather, grab a local copy. Reviewed-by: Matt Caswell <matt@openssl.org>
* ssl3_get_client_hello: rearrange logicEmilia Kasper2015-10-051-11/+13
| | | | | | | | | | | | | | | | Move all packet parsing to the beginning of the method. This limits the SSLv2 compatibility soup to the parsing, and makes the rest of the processing uniform. This is also needed for simpler EMS support: EMS servers need to do an early scan for EMS to make resumption decisions. This'll be easier when the entire ClientHello is parsed in the beginning. As a side effect, 1) PACKETize ssl_get_prev_session and tls1_process_ticket; and 2) Delete dead code for SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG. Reviewed-by: Matt Caswell <matt@openssl.org>
* remove 0 assignments.Rich Salz2015-09-031-18/+1
| | | | | | | After openssl_zalloc, cleanup more "set to 0/NULL" assignments. Many are from github feedback. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Add and use OPENSSL_zallocRich Salz2015-09-031-2/+1
| | | | | | | | | There are many places (nearly 50) where we malloc and then memset. Add an OPENSSL_zalloc routine to encapsulate that. (Missed one conversion; thanks Richard) Also fixes GH328 Reviewed-by: Richard Levitte <levitte@openssl.org>
* Add X509_up_ref function.Dr. Stephen Henson2015-09-011-1/+1
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* PACKETise ClientHello processingMatt Caswell2015-08-031-8/+3
| | | | | | | Uses the new PACKET code to process the incoming ClientHello including all extensions etc. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Dup peer_chain properly in SSL_SESSIONDr. Stephen Henson2015-06-301-0/+6
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Remove SESS_CERT entirely.Dr. Stephen Henson2015-06-221-4/+0
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Move peer chain to SSL_SESSION structure.Dr. Stephen Henson2015-06-221-0/+1
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* More ssl_session_dup fixesMatt Caswell2015-06-111-34/+38
| | | | | | | | | Fix error handling in ssl_session_dup, as well as incorrect setting up of the session ticket. Follow on from CVE-2015-1791. Thanks to LibreSSL project for reporting these issues. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Fix race condition in NewSessionTicketMatt Caswell2015-06-021-0/+116
| | | | | | | | | | | | | | | | | If a NewSessionTicket is received by a multi-threaded client when attempting to reuse a previous ticket then a race condition can occur potentially leading to a double free of the ticket data. CVE-2015-1791 This also fixes RT#3808 where a session ID is changed for a session already in the client session cache. Since the session ID is the key to the cache this breaks the cache access. Parts of this patch were inspired by this Akamai change: https://github.com/akamai/openssl/commit/c0bf69a791239ceec64509f9f19fcafb2461b0d3 Reviewed-by: Rich Salz <rsalz@openssl.org>
* Remove support for OPENSSL_NO_TLSEXTMatt Caswell2015-05-231-19/+7
| | | | | | | | | | Given the pervasive nature of TLS extensions it is inadvisable to run OpenSSL without support for them. It also means that maintaining the OPENSSL_NO_TLSEXT option within the code is very invasive (and probably not well tested). Therefore it is being removed. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Remove Kerberos support from libsslMatt Caswell2015-05-131-14/+0
| | | | | | | Remove RFC2712 Kerberos support from libssl. This code and the associated standard is no longer considered fit-for-purpose. Reviewed-by: Rich Salz <rsalz@openssl.org>
* memset, memcpy, sizeof consistency fixesRich Salz2015-05-061-1/+1
| | | | | | | | Just as with the OPENSSL_malloc calls, consistently use sizeof(*ptr) for memset and memcpy. Remove needless casts for those functions. For memset, replace alternative forms of zero with 0. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Use safer sizeof variant in mallocRich Salz2015-05-041-1/+1
| | | | | | | | | | | | | For a local variable: TYPE *p; Allocations like this are "risky": p = OPENSSL_malloc(sizeof(TYPE)); if the type of p changes, and the malloc call isn't updated, you could get memory corruption. Instead do this: p = OPENSSL_malloc(sizeof(*p)); Also fixed a few memset() calls that I noticed while doing this. Reviewed-by: Richard Levitte <levitte@openssl.org>
* free NULL cleanup -- codaRich Salz2015-05-011-16/+8
| | | | | | | | After the finale, the "real" final part. :) Do a recursive grep with "-B1 -w [a-zA-Z0-9_]*_free" to see if any of the preceeding lines are an "if NULL" check that can be removed. Reviewed-by: Tim Hudson <tjh@openssl.org>
* free null cleanup finaleRich Salz2015-05-011-5/+2
| | | | | | Don't check for NULL before calling OPENSSL_free Reviewed-by: Richard Levitte <levitte@openssl.org>
generated by cgit v1.2.3 (git 2.39.1) at 2025-02-01 15:35:40 +0100