1 files changed, 30 insertions, 159 deletions

diff --git a/src/lib/libssl/ssl_sess.c b/src/lib/libssl/ssl_sess.c
index ee88be2b88..2ba8b9612e 100644
--- a/src/lib/libssl/ssl_sess.c
+++ b/src/lib/libssl/ssl_sess.c
@@ -122,20 +122,10 @@ SSL_SESSION *SSL_SESSION_new(void)
         ss->prev=NULL;
         ss->next=NULL;
         ss->compress_meth=0;
-#ifndef OPENSSL_NO_TLSEXT
-        ss->tlsext_hostname = NULL; 
-#endif
         CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL_SESSION, ss, &ss->ex_data);
         return(ss);
         }
 
-const unsigned char *SSL_SESSION_get_id(const SSL_SESSION *s, unsigned int *len)
-        {
-        if(len)
-                *len = s->session_id_length;
-        return s->session_id;
-        }
-
 /* Even with SSLv2, we have 16 bytes (128 bits) of session ID space. SSLv3/TLSv1
  * has 32 bytes (256 bits). As such, filling the ID with random gunk repeatedly
  * until we have no conflict is going to complete in one iteration pretty much
@@ -151,7 +141,7 @@ static int def_generate_session_id(const SSL *ssl, unsigned char *id,
 {
         unsigned int retry = 0;
         do
-                if (RAND_pseudo_bytes(id, *id_len) <= 0)
+                if(RAND_pseudo_bytes(id, *id_len) <= 0)
                         return 0;
         while(SSL_has_matching_session_id(ssl, id, *id_len) &&
                 (++retry < MAX_SESS_ID_ATTEMPTS));
@@ -208,25 +198,12 @@ int ssl_get_new_session(SSL *s, int session)
                         ss->ssl_version=TLS1_VERSION;
                         ss->session_id_length=SSL3_SSL_SESSION_ID_LENGTH;
                         }
-                else if (s->version == DTLS1_VERSION)
-                        {
-                        ss->ssl_version=DTLS1_VERSION;
-                        ss->session_id_length=SSL3_SSL_SESSION_ID_LENGTH;
-                        }
                 else
                         {
                         SSLerr(SSL_F_SSL_GET_NEW_SESSION,SSL_R_UNSUPPORTED_SSL_VERSION);
                         SSL_SESSION_free(ss);
                         return(0);
                         }
-#ifndef OPENSSL_NO_TLSEXT
-                /* If RFC4507 ticket use empty session ID */
-                if (s->tlsext_ticket_expected)
-                        {
-                        ss->session_id_length = 0;
-                        goto sess_id_done;
-                        }
-#endif
                 /* Choose which callback will set the session ID */
                 CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX);
                 if(s->generate_session_id)
@@ -268,17 +245,6 @@ int ssl_get_new_session(SSL *s, int session)
                         SSL_SESSION_free(ss);
                         return(0);
                         }
-#ifndef OPENSSL_NO_TLSEXT
-                sess_id_done:
-                if (s->tlsext_hostname) {
-                        ss->tlsext_hostname = BUF_strdup(s->tlsext_hostname);
-                        if (ss->tlsext_hostname == NULL) {
-                                SSLerr(SSL_F_SSL_GET_NEW_SESSION, ERR_R_INTERNAL_ERROR);
-                                SSL_SESSION_free(ss);
-                                return 0;
-                                }
-                        }
-#endif
                 }
         else
                 {
@@ -300,41 +266,21 @@ int ssl_get_new_session(SSL *s, int session)
         return(1);
         }
 
-int ssl_get_prev_session(SSL *s, unsigned char *session_id, int len,
-                        const unsigned char *limit)
+int ssl_get_prev_session(SSL *s, unsigned char *session_id, int len)
         {
         /* This is used only by servers. */
 
-        SSL_SESSION *ret=NULL;
+        SSL_SESSION *ret=NULL,data;
         int fatal = 0;
-#ifndef OPENSSL_NO_TLSEXT
-        int r;
-#endif
-  
+
+        data.ssl_version=s->version;
+        data.session_id_length=len;
         if (len > SSL_MAX_SSL_SESSION_ID_LENGTH)
                 goto err;
-#ifndef OPENSSL_NO_TLSEXT
-        r = tls1_process_ticket(s, session_id, len, limit, &ret);
-        if (r == -1)
-                {
-                fatal = 1;
-                goto err;
-                }
-        else if (r == 0 || (!ret && !len))
-                goto err;
-        else if (!ret && !(s->session_ctx->session_cache_mode & SSL_SESS_CACHE_NO_INTERNAL_LOOKUP))
-#else
-        if (len == 0)
-                goto err;
+        memcpy(data.session_id,session_id,len);
+
         if (!(s->ctx->session_cache_mode & SSL_SESS_CACHE_NO_INTERNAL_LOOKUP))
-#endif
                 {
-                SSL_SESSION data;
-                data.ssl_version=s->version;
-                data.session_id_length=len;
-                if (len == 0)
-                        return 0;
-                memcpy(data.session_id,session_id,len);
                 CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX);
                 ret=(SSL_SESSION *)lh_retrieve(s->ctx->sessions,&data);
                 if (ret != NULL)
@@ -376,35 +322,33 @@ int ssl_get_prev_session(SSL *s, unsigned char *session_id, int len,
 
         /* Now ret is non-NULL, and we own one of its reference counts. */
 
-        if (ret->sid_ctx_length != s->sid_ctx_length
-            || memcmp(ret->sid_ctx,s->sid_ctx,ret->sid_ctx_length))
-                {
+        if((s->verify_mode&SSL_VERIFY_PEER)
+           && (!s->sid_ctx_length || ret->sid_ctx_length != s->sid_ctx_length
+               || memcmp(ret->sid_ctx,s->sid_ctx,ret->sid_ctx_length)))
+            {
                 /* We've found the session named by the client, but we don't
                  * want to use it in this context. */
+                
+                if (s->sid_ctx_length == 0)
+                        {
+                        /* application should have used SSL[_CTX]_set_session_id_context
+                         * -- we could tolerate this and just pretend we never heard
+                         * of this session, but then applications could effectively
+                         * disable the session cache by accident without anyone noticing */
 
+                        SSLerr(SSL_F_SSL_GET_PREV_SESSION,SSL_R_SESSION_ID_CONTEXT_UNINITIALIZED);
+                        fatal = 1;
+                        goto err;
+                        }
+                else
+                        {
 #if 0 /* The client cannot always know when a session is not appropriate,
-       * so we shouldn't generate an error message. */
+           * so we shouldn't generate an error message. */
 
-                SSLerr(SSL_F_SSL_GET_PREV_SESSION,SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT);
+                        SSLerr(SSL_F_SSL_GET_PREV_SESSION,SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT);
 #endif
-                goto err; /* treat like cache miss */
-                }
-        
-        if((s->verify_mode & SSL_VERIFY_PEER) && s->sid_ctx_length == 0)
-                {
-                /* We can't be sure if this session is being used out of
-                 * context, which is especially important for SSL_VERIFY_PEER.
-                 * The application should have used SSL[_CTX]_set_session_id_context.
-                 *
-                 * For this error case, we generate an error instead of treating
-                 * the event like a cache miss (otherwise it would be easy for
-                 * applications to effectively disable the session cache by
-                 * accident without anyone noticing).
-                 */
-                
-                SSLerr(SSL_F_SSL_GET_PREV_SESSION,SSL_R_SESSION_ID_CONTEXT_UNINITIALIZED);
-                fatal = 1;
-                goto err;
+                        goto err; /* treat like cache miss */
+                        }
                 }
 
         if (ret->cipher == NULL)
@@ -590,10 +534,6 @@ void SSL_SESSION_free(SSL_SESSION *ss)
         if (ss->sess_cert != NULL) ssl_sess_cert_free(ss->sess_cert);
         if (ss->peer != NULL) X509_free(ss->peer);
         if (ss->ciphers != NULL) sk_SSL_CIPHER_free(ss->ciphers);
-#ifndef OPENSSL_NO_TLSEXT
-        if (ss->tlsext_hostname != NULL) OPENSSL_free(ss->tlsext_hostname);
-        if (ss->tlsext_tick != NULL) OPENSSL_free(ss->tlsext_tick);
-#endif
         OPENSSL_cleanse(ss,sizeof(*ss));
         OPENSSL_free(ss);
         }
@@ -628,7 +568,7 @@ int SSL_set_session(SSL *s, SSL_SESSION *session)
                 if (s->kssl_ctx && !s->kssl_ctx->client_princ &&
                     session->krb5_client_princ_len > 0)
                 {
-                    s->kssl_ctx->client_princ = (char *)OPENSSL_malloc(session->krb5_client_princ_len + 1);
+                    s->kssl_ctx->client_princ = (char *)malloc(session->krb5_client_princ_len + 1);
                     memcpy(s->kssl_ctx->client_princ,session->krb5_client_princ,
                             session->krb5_client_princ_len);
                     s->kssl_ctx->client_princ[session->krb5_client_princ_len] = '\0';
@@ -813,72 +753,3 @@ static void SSL_SESSION_list_add(SSL_CTX *ctx, SSL_SESSION *s)
                 }
         }
 
-void SSL_CTX_sess_set_new_cb(SSL_CTX *ctx,
-        int (*cb)(struct ssl_st *ssl,SSL_SESSION *sess))
-        {
-        ctx->new_session_cb=cb;
-        }
-
-int (*SSL_CTX_sess_get_new_cb(SSL_CTX *ctx))(SSL *ssl, SSL_SESSION *sess)
-        {
-        return ctx->new_session_cb;
-        }
-
-void SSL_CTX_sess_set_remove_cb(SSL_CTX *ctx,
-        void (*cb)(SSL_CTX *ctx,SSL_SESSION *sess))
-        {
-        ctx->remove_session_cb=cb;
-        }
-
-void (*SSL_CTX_sess_get_remove_cb(SSL_CTX *ctx))(SSL_CTX * ctx,SSL_SESSION *sess)
-        {
-        return ctx->remove_session_cb;
-        }
-
-void SSL_CTX_sess_set_get_cb(SSL_CTX *ctx,
-        SSL_SESSION *(*cb)(struct ssl_st *ssl,
-                 unsigned char *data,int len,int *copy))
-        {
-        ctx->get_session_cb=cb;
-        }
-
-SSL_SESSION * (*SSL_CTX_sess_get_get_cb(SSL_CTX *ctx))(SSL *ssl,
-                 unsigned char *data,int len,int *copy)
-        {
-        return ctx->get_session_cb;
-        }
-
-void SSL_CTX_set_info_callback(SSL_CTX *ctx, 
-        void (*cb)(const SSL *ssl,int type,int val))
-        {
-        ctx->info_callback=cb;
-        }
-
-void (*SSL_CTX_get_info_callback(SSL_CTX *ctx))(const SSL *ssl,int type,int val)
-        {
-        return ctx->info_callback;
-        }
-
-void SSL_CTX_set_client_cert_cb(SSL_CTX *ctx,
-        int (*cb)(SSL *ssl, X509 **x509, EVP_PKEY **pkey))
-        {
-        ctx->client_cert_cb=cb;
-        }
-
-int (*SSL_CTX_get_client_cert_cb(SSL_CTX *ctx))(SSL * ssl, X509 ** x509 , EVP_PKEY **pkey)
-        {
-        return ctx->client_cert_cb;
-        }
-
-void SSL_CTX_set_cookie_generate_cb(SSL_CTX *ctx,
-        int (*cb)(SSL *ssl, unsigned char *cookie, unsigned int *cookie_len))
-        {
-        ctx->app_gen_cookie_cb=cb;
-        }
-
-void SSL_CTX_set_cookie_verify_cb(SSL_CTX *ctx,
-        int (*cb)(SSL *ssl, unsigned char *cookie, unsigned int cookie_len))
-        {
-        ctx->app_verify_cookie_cb=cb;
-        }
-