#include <openssl/x509v3.h>
#include <openssl/rand.h>
#include <openssl/ocsp.h>
-#ifndef OPENSSL_NO_DH
-# include <openssl/dh.h>
-#endif
-#ifndef OPENSSL_NO_ENGINE
-# include <openssl/engine.h>
-#endif
+#include <openssl/dh.h>
+#include <openssl/engine.h>
#include <openssl/async.h>
-#ifndef OPENSSL_NO_CT
-# include <openssl/ct.h>
-#endif
+#include <openssl/ct.h>
const char SSL_version_str[] = OPENSSL_VERSION_TEXT;
if (s == NULL)
goto err;
+ s->lock = CRYPTO_THREAD_lock_new();
+ if (s->lock == NULL) {
+ SSLerr(SSL_F_SSL_NEW, ERR_R_MALLOC_FAILURE);
+ OPENSSL_free(s);
+ return NULL;
+ }
+
RECORD_LAYER_init(&s->rlayer, s);
s->options = ctx->options;
s->max_send_fragment = ctx->max_send_fragment;
s->split_send_fragment = ctx->split_send_fragment;
s->max_pipelines = ctx->max_pipelines;
+ if (s->max_pipelines > 1)
+ RECORD_LAYER_set_read_ahead(&s->rlayer, 1);
+ if (ctx->default_read_buf_len > 0)
+ SSL_set_default_read_buffer_len(s, ctx->default_read_buf_len);
- CRYPTO_add(&ctx->references, 1, CRYPTO_LOCK_SSL_CTX);
+ SSL_CTX_up_ref(ctx);
s->ctx = ctx;
s->tlsext_debug_cb = 0;
s->tlsext_debug_arg = NULL;
s->tlsext_ocsp_exts = NULL;
s->tlsext_ocsp_resp = NULL;
s->tlsext_ocsp_resplen = -1;
- CRYPTO_add(&ctx->references, 1, CRYPTO_LOCK_SSL_CTX);
+ SSL_CTX_up_ref(ctx);
s->initial_ctx = ctx;
# ifndef OPENSSL_NO_EC
if (ctx->tlsext_ecpointformatlist) {
goto err;
#endif
- return (s);
+ return s;
err:
SSL_free(s);
SSLerr(SSL_F_SSL_NEW, ERR_R_MALLOC_FAILURE);
- return (NULL);
+ return NULL;
}
void SSL_up_ref(SSL *s)
{
- CRYPTO_add(&s->references, 1, CRYPTO_LOCK_SSL);
+ int i;
+ CRYPTO_atomic_add(&s->references, 1, &i, s->lock);
}
int SSL_CTX_set_session_id_context(SSL_CTX *ctx, const unsigned char *sid_ctx,
int SSL_CTX_set_generate_session_id(SSL_CTX *ctx, GEN_SESSION_CB cb)
{
- CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
+ CRYPTO_THREAD_write_lock(ctx->lock);
ctx->generate_session_id = cb;
- CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
+ CRYPTO_THREAD_unlock(ctx->lock);
return 1;
}
int SSL_set_generate_session_id(SSL *ssl, GEN_SESSION_CB cb)
{
- CRYPTO_w_lock(CRYPTO_LOCK_SSL);
+ CRYPTO_THREAD_write_lock(ssl->lock);
ssl->generate_session_id = cb;
- CRYPTO_w_unlock(CRYPTO_LOCK_SSL);
+ CRYPTO_THREAD_unlock(ssl->lock);
return 1;
}
r.session_id_length = id_len;
memcpy(r.session_id, id, id_len);
- CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX);
+ CRYPTO_THREAD_read_lock(ssl->ctx->lock);
p = lh_SSL_SESSION_retrieve(ssl->ctx->sessions, &r);
- CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX);
+ CRYPTO_THREAD_unlock(ssl->ctx->lock);
return (p != NULL);
}
if (s == NULL)
return;
- i = CRYPTO_add(&s->references, -1, CRYPTO_LOCK_SSL);
+ CRYPTO_atomic_add(&s->references, -1, &i, s->lock);
REF_PRINT_COUNT("SSL", s);
if (i > 0)
return;
sk_SRTP_PROTECTION_PROFILE_free(s->srtp_profiles);
#endif
+ CRYPTO_THREAD_lock_free(s->lock);
+
OPENSSL_free(s);
}
*/
if (s->bbio != NULL) {
if (s->wbio == s->bbio) {
- s->wbio = s->wbio->next_bio;
- s->bbio->next_bio = NULL;
+ s->wbio = BIO_next(s->wbio);
+ BIO_set_next(s->bbio, NULL);
}
}
if (s->wbio != wbio && s->rbio != s->wbio)
return (s->method->ssl_pending(s));
}
+int SSL_has_pending(const SSL *s)
+{
+ /*
+ * Similar to SSL_pending() but returns a 1 to indicate that we have
+ * unprocessed data available or 0 otherwise (as opposed to the number of
+ * bytes available). Unlike SSL_pending() this will take into account
+ * read_ahead data. A 1 return simply indicates that we have unprocessed
+ * data. That data may not result in any application data, or we may fail
+ * to parse the records for some reason.
+ */
+ if (SSL_pending(s))
+ return 1;
+
+ return RECORD_LAYER_read_pending(&s->rlayer);
+}
+
X509 *SSL_get_peer_certificate(const SSL *s)
{
X509 *r;
*/
int SSL_copy_session_id(SSL *t, const SSL *f)
{
+ int i;
/* Do we need to to SSL locking? */
if (!SSL_set_session(t, SSL_get_session(f))) {
return 0;
return 0;
}
- CRYPTO_add(&f->cert->references, 1, CRYPTO_LOCK_SSL_CERT);
+ CRYPTO_atomic_add(&f->cert->references, 1, &i, f->cert->lock);
ssl_cert_free(t->cert);
t->cert = f->cert;
if (!SSL_set_session_id_context(t, f->sid_ctx, f->sid_ctx_length)) {
s->split_send_fragment = s->max_send_fragment;
return 1;
case SSL_CTRL_SET_SPLIT_SEND_FRAGMENT:
- if (larg > s->max_send_fragment || larg == 0)
+ if ((unsigned int)larg > s->max_send_fragment || larg == 0)
return 0;
s->split_send_fragment = larg;
return 1;
if (larg < 1 || larg > SSL_MAX_PIPELINES)
return 0;
s->max_pipelines = larg;
+ if (larg > 1)
+ RECORD_LAYER_set_read_ahead(&s->rlayer, 1);
+ return 1;
case SSL_CTRL_GET_RI_SUPPORT:
if (s->s3)
return s->s3->send_connection_binding;
ctx->split_send_fragment = ctx->split_send_fragment;
return 1;
case SSL_CTRL_SET_SPLIT_SEND_FRAGMENT:
- if (larg > ctx->max_send_fragment || larg == 0)
+ if ((unsigned int)larg > ctx->max_send_fragment || larg == 0)
return 0;
ctx->split_send_fragment = larg;
return 1;
if (larg < 1 || larg > SSL_MAX_PIPELINES)
return 0;
ctx->max_pipelines = larg;
+ return 1;
case SSL_CTRL_CERT_FLAGS:
return (ctx->cert->cert_flags |= larg);
case SSL_CTRL_CLEAR_CERT_FLAGS:
* length-prefixed strings). Returns 0 on success.
*/
int SSL_CTX_set_alpn_protos(SSL_CTX *ctx, const unsigned char *protos,
- unsigned protos_len)
+ unsigned int protos_len)
{
OPENSSL_free(ctx->alpn_client_proto_list);
- ctx->alpn_client_proto_list = OPENSSL_malloc(protos_len);
+ ctx->alpn_client_proto_list = OPENSSL_memdup(protos, protos_len);
if (ctx->alpn_client_proto_list == NULL) {
SSLerr(SSL_F_SSL_CTX_SET_ALPN_PROTOS, ERR_R_MALLOC_FAILURE);
return 1;
}
- memcpy(ctx->alpn_client_proto_list, protos, protos_len);
ctx->alpn_client_proto_list_len = protos_len;
return 0;
* length-prefixed strings). Returns 0 on success.
*/
int SSL_set_alpn_protos(SSL *ssl, const unsigned char *protos,
- unsigned protos_len)
+ unsigned int protos_len)
{
OPENSSL_free(ssl->alpn_client_proto_list);
- ssl->alpn_client_proto_list = OPENSSL_malloc(protos_len);
+ ssl->alpn_client_proto_list = OPENSSL_memdup(protos, protos_len);
if (ssl->alpn_client_proto_list == NULL) {
SSLerr(SSL_F_SSL_SET_ALPN_PROTOS, ERR_R_MALLOC_FAILURE);
return 1;
}
- memcpy(ssl->alpn_client_proto_list, protos, protos_len);
ssl->alpn_client_proto_list_len = protos_len;
return 0;
* respond with a negotiated protocol then |*len| will be zero.
*/
void SSL_get0_alpn_selected(const SSL *ssl, const unsigned char **data,
- unsigned *len)
+ unsigned int *len)
{
*data = NULL;
if (ssl->s3)
/* We take the system default. */
ret->session_timeout = meth->get_timeout();
ret->references = 1;
+ ret->lock = CRYPTO_THREAD_lock_new();
+ if (ret->lock == NULL) {
+ SSLerr(SSL_F_SSL_CTX_NEW, ERR_R_MALLOC_FAILURE);
+ OPENSSL_free(ret);
+ return NULL;
+ }
ret->max_cert_list = SSL_MAX_CERT_LIST_DEFAULT;
ret->verify_mode = SSL_VERIFY_NONE;
if ((ret->cert = ssl_cert_new()) == NULL)
*/
ret->options |= SSL_OP_NO_COMPRESSION;
- return (ret);
+ return ret;
err:
SSLerr(SSL_F_SSL_CTX_NEW, ERR_R_MALLOC_FAILURE);
err2:
SSL_CTX_free(ret);
- return (NULL);
+ return NULL;
}
void SSL_CTX_up_ref(SSL_CTX *ctx)
{
- CRYPTO_add(&ctx->references, 1, CRYPTO_LOCK_SSL_CTX);
+ int i;
+ CRYPTO_atomic_add(&ctx->references, 1, &i, ctx->lock);
}
void SSL_CTX_free(SSL_CTX *a)
if (a == NULL)
return;
- i = CRYPTO_add(&a->references, -1, CRYPTO_LOCK_SSL_CTX);
+ CRYPTO_atomic_add(&a->references, -1, &i, a->lock);
REF_PRINT_COUNT("SSL_CTX", a);
if (i > 0)
return;
#endif
OPENSSL_free(a->alpn_client_proto_list);
+ CRYPTO_THREAD_lock_free(a->lock);
+
OPENSSL_free(a);
}
&& ((i & SSL_SESS_CACHE_NO_INTERNAL_STORE)
|| SSL_CTX_add_session(s->session_ctx, s->session))
&& (s->session_ctx->new_session_cb != NULL)) {
- CRYPTO_add(&s->session->references, 1, CRYPTO_LOCK_SSL_SESSION);
+ SSL_SESSION_up_ref(s->session);
if (!s->session_ctx->new_session_cb(s, s->session))
SSL_SESSION_free(s->session);
}
return (0);
}
-SSL_METHOD *ssl_bad_method(int ver)
+const SSL_METHOD *ssl_bad_method(int ver)
{
SSLerr(SSL_F_SSL_BAD_METHOD, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
return (NULL);
}
-const char *SSL_get_version(const SSL *s)
-{
- if (s->version == TLS1_2_VERSION)
- return ("TLSv1.2");
- else if (s->version == TLS1_1_VERSION)
- return ("TLSv1.1");
- else if (s->version == TLS1_VERSION)
- return ("TLSv1");
- else if (s->version == SSL3_VERSION)
- return ("SSLv3");
- else if (s->version == DTLS1_BAD_VER)
- return ("DTLSv0.9");
- else if (s->version == DTLS1_VERSION)
- return ("DTLSv1");
- else if (s->version == DTLS1_2_VERSION)
- return ("DTLSv1.2");
+const char *ssl_protocol_to_string(int version)
+{
+ if (version == TLS1_2_VERSION)
+ return "TLSv1.2";
+ else if (version == TLS1_1_VERSION)
+ return "TLSv1.1";
+ else if (version == TLS1_VERSION)
+ return "TLSv1";
+ else if (version == SSL3_VERSION)
+ return "SSLv3";
+ else if (version == DTLS1_BAD_VER)
+ return "DTLSv0.9";
+ else if (version == DTLS1_VERSION)
+ return "DTLSv1";
+ else if (version == DTLS1_2_VERSION)
+ return "DTLSv1.2";
else
return ("unknown");
}
+const char *SSL_get_version(const SSL *s)
+{
+ return ssl_protocol_to_string(s->version);
+}
+
SSL *SSL_dup(SSL *s)
{
STACK_OF(X509_NAME) *sk;
/* If we're not quiescent, just up_ref! */
if (!SSL_in_init(s) || !SSL_in_before(s)) {
- CRYPTO_add(&s->references, 1, CRYPTO_LOCK_SSL);
+ CRYPTO_atomic_add(&s->references, 1, &i, s->lock);
return s;
}
memcpy(&ssl->sid_ctx, &ctx->sid_ctx, sizeof(ssl->sid_ctx));
}
- CRYPTO_add(&ctx->references, 1, CRYPTO_LOCK_SSL_CTX);
+ SSL_CTX_up_ref(ctx);
SSL_CTX_free(ssl->ctx); /* decrement reference count */
ssl->ctx = ctx;
- return (ssl->ctx);
+ return ssl->ctx;
}
int SSL_CTX_set_default_verify_paths(SSL_CTX *ctx)
}
void SSL_set_security_callback(SSL *s,
- int (*cb) (SSL *s, SSL_CTX *ctx, int op,
+ int (*cb) (const SSL *s, const SSL_CTX *ctx, int op,
int bits, int nid, void *other,
void *ex))
{
s->cert->sec_cb = cb;
}
-int (*SSL_get_security_callback(const SSL *s)) (SSL *s, SSL_CTX *ctx, int op,
+int (*SSL_get_security_callback(const SSL *s)) (const SSL *s, const SSL_CTX *ctx, int op,
int bits, int nid,
void *other, void *ex) {
return s->cert->sec_cb;
}
void SSL_CTX_set_security_callback(SSL_CTX *ctx,
- int (*cb) (SSL *s, SSL_CTX *ctx, int op,
+ int (*cb) (const SSL *s, const SSL_CTX *ctx, int op,
int bits, int nid, void *other,
void *ex))
{
ctx->cert->sec_cb = cb;
}
-int (*SSL_CTX_get_security_callback(const SSL_CTX *ctx)) (SSL *s,
- SSL_CTX *ctx,
+int (*SSL_CTX_get_security_callback(const SSL_CTX *ctx)) (const SSL *s,
+ const SSL_CTX *ctx,
int op, int bits,
int nid,
void *other,
int SSL_CTX_set_default_ctlog_list_file(SSL_CTX *ctx)
{
- int ret = CTLOG_STORE_load_default_file(ctx->ctlog_store);
-
- /* Clear any errors if the default file does not exist */
- ERR_clear_error();
- return ret;
+ return CTLOG_STORE_load_default_file(ctx->ctlog_store);
}
int SSL_CTX_set_ctlog_list_file(SSL_CTX *ctx, const char *path)
return CTLOG_STORE_load_file(ctx->ctlog_store, path);
}
+void SSL_CTX_set0_ctlog_store(SSL_CTX *ctx, CTLOG_STORE *logs)
+{
+ CTLOG_STORE_free(ctx->ctlog_store);
+ ctx->ctlog_store = logs;
+}
+
+const CTLOG_STORE *SSL_CTX_get0_ctlog_store(const SSL_CTX *ctx)
+{
+ return ctx->ctlog_store;
+}
+
#endif