openbsd/src/lib/libssl/ssl_sess.c, branch OPENBSD_6_8_BASEA mirror of https://github.com/libressl/openbsd.git
https://git.lua4.win/openbsd/atom?h=OPENBSD_6_8_BASE2020-09-19T09:56:35+00:00Prepare to provide SSL_SESSION_{set,get}_max_early_data()2020-09-19T09:56:35+00:00tb2020-09-19T09:56:35+00:00urn:sha1:64d116f977e819c5c3ec5361ae30c2df9e5f9101
Since we do not support 0-RTT, these are noops. Some software expects
this API to be available if TLS1_3_VERSION is defined.
ok beck jsing
Simplify SSL method lookups.2020-09-17T15:23:29+00:00jsing2020-09-17T15:23:29+00:00urn:sha1:ac608c91af9de9141849165d1599e500cf7010cc
There are three places where we call tls1_get_{client,server}_method() and
if that returns NULL, call dtls1_get_{client,server}_method(). Simplify
this by combining the lookup into a single function. While here also use
uint16_t for version types.
ok inoguchi@ millert@
Cleanup and simplify SSL_set_session().2020-09-14T18:25:23+00:00jsing2020-09-14T18:25:23+00:00urn:sha1:b72413066987ff52cb0d9052cada638fe6ac8cc5
SSL_set_ssl_method() checks to see if the method is already the same, so
we do not need to do this check in three different places. Switch to
dtls1_get_client_method()/tls1_get_client_method() to find the method -
this is a slight change in behaviour, however there is not much point
trying to resume a session on something other than a client.
ok beck@
KNF and comment tweaks2020-09-02T08:04:06+00:00tb2020-09-02T08:04:06+00:00urn:sha1:38c83897dc3a083befa62b43562fc4ed310e2187Zero out data to avoid leaving stack garbage in the tail of2020-09-01T19:17:36+00:00tb2020-09-01T19:17:36+00:00urn:sha1:3f08edad7a2cfb5f503c7ea9d2088d473d31be66
the session id in case the copied session id is shorter than
SSL_MAX_SESSION_ID_LENGTH.
long standing bug pointed out by jsing
The bumping of sess_cb_hit stats can wait until handling of2020-09-01T17:45:17+00:00tb2020-09-01T17:45:17+00:00urn:sha1:6c6523128ae4439b92da4bc35351b5cb0a632f29
get_session_cb is completed.
In the explanatory comment of ssl_get_prev_session fix the spelling of2020-09-01T17:30:45+00:00tb2020-09-01T17:30:45+00:00urn:sha1:52dc2869b08fcdda05527a87a8149ab3f505f1b0
the function name, document alert and make it fit into 80 columns.
Split session retrieval out of ssl_get_prev_session()2020-09-01T17:25:17+00:00tb2020-09-01T17:25:17+00:00urn:sha1:a876570919607f69ce88f4445c88472ef9269f8d
In case the session ticket was empty or missing, an attempt is made to
retrieve the session from the internal cache or via a callback. This
code can easily be flattened a bit and factored into two functions. I
decided to wrap those into a third function to make the call from the
switch easier on the eye.
I could have kept the try_session_cache flag, but it now seems rather
pointless and awkwardly named anyway, so I took its negation and named
it ticket_decrypted.
To top things off, a little bit of polish in the exit path.
ok beck inoguchi jsing (with the usual healthy dose of nits)
copy session id directly in ssl_get_prev_session2020-09-01T12:40:53+00:00tb2020-09-01T12:40:53+00:00urn:sha1:9f988c795fd8a5ef1dcaff20a0704bca35366cfe
ssl_get_prev_session() hands the session id down to tls_decrypt_ticket()
which then copies it into the session pointer that it is about to return.
It's a lot simpler to retrieve the session pointer and copy the session id
inside ssl_get_prev_session().
Also, 'goto err' directly in TLS1_TICKET_NOT_DECRYPTED instead of skipping
a couple of long if clauses before doing so.
ok inoguchi jsing
indent the only other label in this file2020-09-01T06:05:09+00:00tb2020-09-01T06:05:09+00:00urn:sha1:ecef000b15e466f3aa09714234c6107f3bbe7524