From: Scott Deboy <sdeboy@secondstryke.com>
Date: Thu, 1 Aug 2013 18:54:09 +0000 (-0700)
Subject: Free generated supp data after handshake completion, add comment regarding use of... 
X-Git-Tag: OpenSSL_1_0_2-beta1~41^2~11
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=40632f6b770ea79358cabacef8160065c30fd77c;p=oweals%2Fopenssl.git

Free generated supp data after handshake completion, add comment regarding use of num_renegotiations in TLS and supp data generation callbacks

(cherry picked from commit 67c408cee9b01a7c8c7ca002d36b4f8c0612b08c)
Conflicts:
	apps/s_client.c
	apps/s_server.c
---

diff --git a/apps/s_client.c b/apps/s_client.c
index 715e063a65..e06c9486e0 100644
--- a/apps/s_client.c
+++ b/apps/s_client.c
@@ -225,8 +225,10 @@ static int c_brief=0;
 
 #ifndef OPENSSL_NO_TLSEXT
 
-static const unsigned char *most_recent_supplemental_data;
-static size_t most_recent_supplemental_data_length;
+static unsigned char *generated_supp_data = NULL;
+
+static unsigned char *most_recent_supplemental_data = NULL;
+static size_t most_recent_supplemental_data_length = 0;
 
 static int server_provided_server_authz = 0;
 static int server_provided_client_authz = 0;
@@ -1776,6 +1778,13 @@ SSL_set_tlsext_status_ids(con, ids);
 						"CONNECTION ESTABLISHED\n");
 					print_ssl_summary(bio_err, con);
 					}
+				/*handshake is complete - free the generated supp data allocated in the callback */
+				if (generated_supp_data)
+					{
+					OPENSSL_free(generated_supp_data);
+					generated_supp_data = NULL;
+					}
+
 				print_stuff(bio_c_out,con,full_log);
 				if (full_log > 0) full_log--;
 
@@ -2453,6 +2462,8 @@ static int authz_tlsext_generate_cb(SSL *s, unsigned short ext_type,
 	{
 	if (c_auth)
 		{
+		/*if auth_require_reneg flag is set, only send extensions if
+		  renegotiation has occurred */
 		if (!c_auth_require_reneg || (c_auth_require_reneg && SSL_num_renegotiations(s)))
 			{
 			*out = auth_ext_data;
@@ -2481,14 +2492,16 @@ static int auth_suppdata_generate_cb(SSL *s, unsigned short supp_data_type,
 				     const unsigned char **out,
 				     unsigned short *outlen, void *arg)
 	{
-	unsigned char *result;
 	if (c_auth && server_provided_client_authz && server_provided_server_authz)
 		{
-		if (!c_auth_require_reneg || (c_auth_require_reneg && SSL_num_renegotiations(s)))
-			{
-			result = OPENSSL_malloc(10);
-			memcpy(result, "5432154321", 10);
-			*out = result;
+		/*if auth_require_reneg flag is set, only send supplemental data if
+		  renegotiation has occurred */
+		if (!c_auth_require_reneg
+		    || (c_auth_require_reneg && SSL_num_renegotiations(s)))
+			{
+			generated_supp_data = OPENSSL_malloc(10);
+			memcpy(generated_supp_data, "5432154321", 10);
+			*out = generated_supp_data;
 			*outlen = 10;
 			return 1;
 			}
diff --git a/apps/s_server.c b/apps/s_server.c
index 42e2133308..576daac696 100644
--- a/apps/s_server.c
+++ b/apps/s_server.c
@@ -228,8 +228,10 @@ static void s_server_init(void);
 
 static const unsigned char auth_ext_data[]={TLSEXT_AUTHZDATAFORMAT_dtcp};
 
-static const unsigned char *most_recent_supplemental_data;
-static size_t most_recent_supplemental_data_length;
+static unsigned char *generated_supp_data = NULL;
+
+static unsigned char *most_recent_supplemental_data = NULL;
+static size_t most_recent_supplemental_data_length = 0;
 
 static int client_provided_server_authz = 0;
 static int client_provided_client_authz = 0;
@@ -2678,6 +2680,13 @@ static int init_ssl_connection(SSL *con)
 			i=SSL_accept(con);
 		}
 #endif
+	/*handshake is complete - free the generated supp data allocated in the callback */
+	if (generated_supp_data)
+		{
+        OPENSSL_free(generated_supp_data);
+		generated_supp_data = NULL;
+		}
+
 	if (i <= 0)
 		{
 		if (BIO_sock_should_retry(i))
@@ -3571,7 +3580,10 @@ static int authz_tlsext_generate_cb(SSL *s, unsigned short ext_type,
 	{
 	if (c_auth && client_provided_client_authz && client_provided_server_authz)
 		{
-		if (!c_auth_require_reneg || (c_auth_require_reneg && SSL_num_renegotiations(s)))
+		/*if auth_require_reneg flag is set, only send extensions if
+		  renegotiation has occurred */
+		if (!c_auth_require_reneg
+		    || (c_auth_require_reneg && SSL_num_renegotiations(s)))
 			{
 			*out = auth_ext_data;
 			*outlen = 1;
@@ -3599,14 +3611,16 @@ static int auth_suppdata_generate_cb(SSL *s, unsigned short supp_data_type,
 				     const unsigned char **out,
 				     unsigned short *outlen, void *arg)
 	{
-	unsigned char *result;
 	if (c_auth && client_provided_client_authz && client_provided_server_authz)
 		{
-		if (!c_auth_require_reneg || (c_auth_require_reneg && SSL_num_renegotiations(s)))
+		/*if auth_require_reneg flag is set, only send supplemental data if
+		  renegotiation has occurred */
+		if (!c_auth_require_reneg
+		    || (c_auth_require_reneg && SSL_num_renegotiations(s)))
 			{
-			result = OPENSSL_malloc(10);
-			memcpy(result, "1234512345", 10);
-			*out = result;
+			generated_supp_data = OPENSSL_malloc(10);
+			memcpy(generated_supp_data, "1234512345", 10);
+			*out = generated_supp_data;
 			*outlen = 10;
 			return 1;
 			}