Split most of SSL_METHOD out into an internal variant, which is opaque.

Discussed with beck@

1 files changed, 19 insertions, 15 deletions

diff --git a/src/lib/libssl/d1_srvr.c b/src/lib/libssl/d1_srvr.c
index 2a68483169..1787412bf5 100644
--- a/src/lib/libssl/d1_srvr.c
+++ b/src/lib/libssl/d1_srvr.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: d1_srvr.c,v 1.78 2017/01/23 10:22:06 jsing Exp $ */
+/* $OpenBSD: d1_srvr.c,v 1.79 2017/01/23 13:36:13 jsing Exp $ */
 /*
  * DTLS implementation written by Nagendra Modadugu
  * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
@@ -128,7 +128,7 @@
 static const SSL_METHOD *dtls1_get_server_method(int ver);
 static int dtls1_send_hello_verify_request(SSL *s);
 
-static const SSL_METHOD DTLSv1_server_method_data = {
+static const SSL_METHOD_INTERNAL DTLSv1_server_method_internal_data = {
         .version = DTLS1_VERSION,
         .min_version = DTLS1_VERSION,
         .max_version = DTLS1_VERSION,
@@ -141,21 +141,25 @@ static const SSL_METHOD DTLSv1_server_method_data = {
         .ssl_peek = ssl3_peek,
         .ssl_write = ssl3_write,
         .ssl_shutdown = dtls1_shutdown,
+        .ssl_pending = ssl3_pending,
+        .get_ssl_method = dtls1_get_server_method,
+        .get_timeout = dtls1_default_timeout,
+        .ssl_version = ssl_undefined_void_function,
         .ssl_renegotiate = ssl3_renegotiate,
         .ssl_renegotiate_check = ssl3_renegotiate_check,
         .ssl_get_message = dtls1_get_message,
         .ssl_read_bytes = dtls1_read_bytes,
         .ssl_write_bytes = dtls1_write_app_data_bytes,
+        .ssl3_enc = &DTLSv1_enc_data,
+};
+
+static const SSL_METHOD DTLSv1_server_method_data = {
         .ssl_dispatch_alert = dtls1_dispatch_alert,
-        .get_cipher_by_char = ssl3_get_cipher_by_char,
-        .put_cipher_by_char = ssl3_put_cipher_by_char,
-        .ssl_pending = ssl3_pending,
         .num_ciphers = ssl3_num_ciphers,
         .get_cipher = dtls1_get_cipher,
-        .get_ssl_method = dtls1_get_server_method,
-        .get_timeout = dtls1_default_timeout,
-        .ssl3_enc = &DTLSv1_enc_data,
-        .ssl_version = ssl_undefined_void_function,
+        .get_cipher_by_char = ssl3_get_cipher_by_char,
+        .put_cipher_by_char = ssl3_put_cipher_by_char,
+        .internal = &DTLSv1_server_method_internal_data,
 };
 
 const SSL_METHOD *
@@ -519,9 +523,9 @@ dtls1_accept(SSL *s)
 
                                 /* We need to get hashes here so if there is
                                  * a client cert, it can be verified */
-                                s->method->ssl3_enc->cert_verify_mac(s,
+                                s->method->internal->ssl3_enc->cert_verify_mac(s,
                                     NID_md5, &(S3I(s)->tmp.cert_verify_md[0]));
-                                s->method->ssl3_enc->cert_verify_mac(s,
+                                s->method->internal->ssl3_enc->cert_verify_mac(s,
                                     NID_sha1,
                                     &(S3I(s)->tmp.cert_verify_md[MD5_DIGEST_LENGTH]));
                         }
@@ -579,7 +583,7 @@ dtls1_accept(SSL *s)
                 case SSL3_ST_SW_CHANGE_B:
 
                         s->session->cipher = S3I(s)->tmp.new_cipher;
-                        if (!s->method->ssl3_enc->setup_key_block(s)) {
+                        if (!s->method->internal->ssl3_enc->setup_key_block(s)) {
                                 ret = -1;
                                 goto end;
                         }
@@ -594,7 +598,7 @@ dtls1_accept(SSL *s)
                         s->internal->state = SSL3_ST_SW_FINISHED_A;
                         s->internal->init_num = 0;
 
-                        if (!s->method->ssl3_enc->change_cipher_state(s,
+                        if (!s->method->internal->ssl3_enc->change_cipher_state(s,
                                 SSL3_CHANGE_CIPHER_SERVER_WRITE)) {
                                 ret = -1;
                                 goto end;
@@ -607,8 +611,8 @@ dtls1_accept(SSL *s)
                 case SSL3_ST_SW_FINISHED_B:
                         ret = ssl3_send_finished(s,
                             SSL3_ST_SW_FINISHED_A, SSL3_ST_SW_FINISHED_B,
-                            s->method->ssl3_enc->server_finished_label,
-                            s->method->ssl3_enc->server_finished_label_len);
+                            s->method->internal->ssl3_enc->server_finished_label,
+                            s->method->internal->ssl3_enc->server_finished_label_len);
                         if (ret <= 0)
                                 goto end;
                         s->internal->state = SSL3_ST_SW_FLUSH;