-/* $OpenBSD: bio_ssl.c,v 1.33 2022/01/14 09:12:53 tb Exp $ */
+/* $OpenBSD: bio_ssl.c,v 1.34 2022/10/02 16:36:41 jsing Exp $ */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
* All rights reserved.
*
case BIO_CTRL_RESET:
SSL_shutdown(ssl);
- if (ssl->internal->handshake_func ==
+ if (ssl->handshake_func ==
ssl->method->ssl_connect)
SSL_set_connect_state(ssl);
- else if (ssl->internal->handshake_func ==
+ else if (ssl->handshake_func ==
ssl->method->ssl_accept)
SSL_set_accept_state(ssl);
-/* $OpenBSD: d1_both.c,v 1.81 2022/02/05 14:54:10 jsing Exp $ */
+/* $OpenBSD: d1_both.c,v 1.82 2022/10/02 16:36:41 jsing Exp $ */
/*
* DTLS implementation written by Nagendra Modadugu
* (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
free(frag);
}
-/* send s->internal->init_buf in records of type 'type' (SSL3_RT_HANDSHAKE or SSL3_RT_CHANGE_CIPHER_SPEC) */
+/* send s->init_buf in records of type 'type' (SSL3_RT_HANDSHAKE or SSL3_RT_CHANGE_CIPHER_SPEC) */
int
dtls1_do_write(SSL *s, int type)
{
OPENSSL_assert(s->d1->mtu >= dtls1_min_mtu());
/* should have something reasonable now */
- if (s->internal->init_off == 0 && type == SSL3_RT_HANDSHAKE)
- OPENSSL_assert(s->internal->init_num ==
+ if (s->init_off == 0 && type == SSL3_RT_HANDSHAKE)
+ OPENSSL_assert(s->init_num ==
(int)s->d1->w_msg_hdr.msg_len + DTLS1_HM_HEADER_LENGTH);
- if (!tls12_record_layer_write_overhead(s->internal->rl, &overhead))
+ if (!tls12_record_layer_write_overhead(s->rl, &overhead))
return -1;
frag_off = 0;
- while (s->internal->init_num) {
+ while (s->init_num) {
curr_mtu = s->d1->mtu - BIO_wpending(SSL_get_wbio(s)) -
DTLS1_RT_HEADER_LENGTH - overhead;
overhead;
}
- if (s->internal->init_num > curr_mtu)
+ if (s->init_num > curr_mtu)
len = curr_mtu;
else
- len = s->internal->init_num;
+ len = s->init_num;
/* XDTLS: this function is too long. split out the CCS part */
if (type == SSL3_RT_HANDSHAKE) {
- if (s->internal->init_off != 0) {
- OPENSSL_assert(s->internal->init_off > DTLS1_HM_HEADER_LENGTH);
- s->internal->init_off -= DTLS1_HM_HEADER_LENGTH;
- s->internal->init_num += DTLS1_HM_HEADER_LENGTH;
+ if (s->init_off != 0) {
+ OPENSSL_assert(s->init_off > DTLS1_HM_HEADER_LENGTH);
+ s->init_off -= DTLS1_HM_HEADER_LENGTH;
+ s->init_num += DTLS1_HM_HEADER_LENGTH;
- if (s->internal->init_num > curr_mtu)
+ if (s->init_num > curr_mtu)
len = curr_mtu;
else
- len = s->internal->init_num;
+ len = s->init_num;
}
dtls1_fix_message_header(s, frag_off,
if (!dtls1_write_message_header(&s->d1->w_msg_hdr,
s->d1->w_msg_hdr.frag_off, s->d1->w_msg_hdr.frag_len,
- (unsigned char *)&s->internal->init_buf->data[s->internal->init_off]))
+ (unsigned char *)&s->init_buf->data[s->init_off]))
return -1;
OPENSSL_assert(len >= DTLS1_HM_HEADER_LENGTH);
}
ret = dtls1_write_bytes(s, type,
- &s->internal->init_buf->data[s->internal->init_off], len);
+ &s->init_buf->data[s->init_off], len);
if (ret < 0) {
/*
* Might need to update MTU here, but we don't know
* but in that case we'll ignore the result
* anyway
*/
- unsigned char *p = (unsigned char *)&s->internal->init_buf->data[s->internal->init_off];
+ unsigned char *p = (unsigned char *)&s->init_buf->data[s->init_off];
const struct hm_header_st *msg_hdr = &s->d1->w_msg_hdr;
int xlen;
tls1_transcript_record(s, p, xlen);
}
- if (ret == s->internal->init_num) {
- if (s->internal->msg_callback)
- s->internal->msg_callback(1, s->version, type,
- s->internal->init_buf->data,
- (size_t)(s->internal->init_off + s->internal->init_num),
- s, s->internal->msg_callback_arg);
+ if (ret == s->init_num) {
+ if (s->msg_callback)
+ s->msg_callback(1, s->version, type,
+ s->init_buf->data,
+ (size_t)(s->init_off + s->init_num),
+ s, s->msg_callback_arg);
- s->internal->init_off = 0;
+ s->init_off = 0;
/* done writing this message */
- s->internal->init_num = 0;
+ s->init_num = 0;
return (1);
}
- s->internal->init_off += ret;
- s->internal->init_num -= ret;
+ s->init_off += ret;
+ s->init_num -= ret;
frag_off += (ret -= DTLS1_HM_HEADER_LENGTH);
}
}
int i, al, ok;
/*
- * s3->internal->tmp is used to store messages that are unexpected, caused
+ * s3->tmp is used to store messages that are unexpected, caused
* by the absence of an optional handshake message
*/
if (s->s3->hs.tls12.reuse_message) {
SSLerror(s, SSL_R_UNEXPECTED_MESSAGE);
goto fatal_err;
}
- s->internal->init_msg = s->internal->init_buf->data + DTLS1_HM_HEADER_LENGTH;
- s->internal->init_num = (int)s->s3->hs.tls12.message_size;
+ s->init_msg = s->init_buf->data + DTLS1_HM_HEADER_LENGTH;
+ s->init_num = (int)s->s3->hs.tls12.message_size;
return 1;
}
else if (i <= 0 && !ok)
return i;
- p = (unsigned char *)s->internal->init_buf->data;
+ p = (unsigned char *)s->init_buf->data;
msg_len = msg_hdr->msg_len;
/* reconstruct message header */
msg_len += DTLS1_HM_HEADER_LENGTH;
tls1_transcript_record(s, p, msg_len);
- if (s->internal->msg_callback)
- s->internal->msg_callback(0, s->version, SSL3_RT_HANDSHAKE, p, msg_len,
- s, s->internal->msg_callback_arg);
+ if (s->msg_callback)
+ s->msg_callback(0, s->version, SSL3_RT_HANDSHAKE, p, msg_len,
+ s, s->msg_callback_arg);
memset(msg_hdr, 0, sizeof(struct hm_header_st));
if (!s->d1->listen)
s->d1->handshake_read_seq++;
- s->internal->init_msg = s->internal->init_buf->data + DTLS1_HM_HEADER_LENGTH;
+ s->init_msg = s->init_buf->data + DTLS1_HM_HEADER_LENGTH;
return 1;
fatal_err:
* msg_len is limited to 2^24, but is effectively checked
* against max above
*/
- if (!BUF_MEM_grow_clean(s->internal->init_buf,
+ if (!BUF_MEM_grow_clean(s->init_buf,
msg_len + DTLS1_HM_HEADER_LENGTH)) {
SSLerror(s, ERR_R_BUF_LIB);
return SSL_AD_INTERNAL_ERROR;
/*
* (0) check whether the desired fragment is available
* if so:
- * (1) copy over the fragment to s->internal->init_buf->data[]
- * (2) update s->internal->init_num
+ * (1) copy over the fragment to s->init_buf->data[]
+ * (2) update s->init_num
*/
pitem *item;
hm_fragment *frag;
if (al == 0) /* no alert */
{
- unsigned char *p = (unsigned char *)s->internal->init_buf->data + DTLS1_HM_HEADER_LENGTH;
+ unsigned char *p = (unsigned char *)s->init_buf->data + DTLS1_HM_HEADER_LENGTH;
memcpy(&p[frag->msg_header.frag_off],
frag->fragment, frag->msg_header.frag_len);
}
}
ssl3_send_alert(s, SSL3_AL_FATAL, al);
- s->internal->init_num = 0;
+ s->init_num = 0;
*ok = 0;
return -1;
} else
unsigned long max_len;
max_len = DTLS1_HM_HEADER_LENGTH + SSL3_RT_MAX_ENCRYPTED_LENGTH;
- if (max_len < (unsigned long)s->internal->max_cert_list)
- return s->internal->max_cert_list;
+ if (max_len < (unsigned long)s->max_cert_list)
+ return s->max_cert_list;
return max_len;
}
/* see if we have the required fragment already */
if ((frag_len = dtls1_retrieve_buffered_fragment(s, max, ok)) || *ok) {
if (*ok)
- s->internal->init_num = frag_len;
+ s->init_num = frag_len;
return frag_len;
}
DTLS1_HM_HEADER_LENGTH, 0);
if (i <= 0) {
/* nbio, or an error */
- s->internal->rwstate = SSL_READING;
+ s->rwstate = SSL_READING;
*ok = 0;
return i;
}
* 'Finished' MAC.
*/
if (wire[1] == 0 && wire[2] == 0 && wire[3] == 0) {
- if (s->internal->msg_callback)
- s->internal->msg_callback(0, s->version,
+ if (s->msg_callback)
+ s->msg_callback(0, s->version,
SSL3_RT_HANDSHAKE, wire,
DTLS1_HM_HEADER_LENGTH, s,
- s->internal->msg_callback_arg);
+ s->msg_callback_arg);
- s->internal->init_num = 0;
+ s->init_num = 0;
goto again;
}
else /* Incorrectly formated Hello request */
s->s3->hs.state = stn;
if (frag_len > 0) {
- unsigned char *p = (unsigned char *)s->internal->init_buf->data + DTLS1_HM_HEADER_LENGTH;
+ unsigned char *p = (unsigned char *)s->init_buf->data + DTLS1_HM_HEADER_LENGTH;
i = s->method->ssl_read_bytes(s, SSL3_RT_HANDSHAKE,
&p[frag_off], frag_len, 0);
/* XDTLS: fix this--message fragments cannot span multiple packets */
if (i <= 0) {
- s->internal->rwstate = SSL_READING;
+ s->rwstate = SSL_READING;
*ok = 0;
return i;
}
}
/*
- * Note that s->internal->init_num is *not* used as current offset in
- * s->internal->init_buf->data, but as a counter summing up fragments'
+ * Note that s->init_num is *not* used as current offset in
+ * s->init_buf->data, but as a counter summing up fragments'
* lengths: as soon as they sum up to handshake packet
* length, we assume we have got all the fragments.
*/
- s->internal->init_num = frag_len;
+ s->init_num = frag_len;
*ok = 1;
return frag_len;
fatal_err:
ssl3_send_alert(s, SSL3_AL_FATAL, al);
- s->internal->init_num = 0;
+ s->init_num = 0;
*ok = 0;
return (-1);
* This function is called immediately after a message has
* been serialized
*/
- OPENSSL_assert(s->internal->init_off == 0);
+ OPENSSL_assert(s->init_off == 0);
- frag = dtls1_hm_fragment_new(s->internal->init_num, 0);
+ frag = dtls1_hm_fragment_new(s->init_num, 0);
if (frag == NULL)
return 0;
- memcpy(frag->fragment, s->internal->init_buf->data, s->internal->init_num);
+ memcpy(frag->fragment, s->init_buf->data, s->init_num);
OPENSSL_assert(s->d1->w_msg_hdr.msg_len +
(is_ccs ? DTLS1_CCS_HEADER_LENGTH : DTLS1_HM_HEADER_LENGTH) ==
- (unsigned int)s->internal->init_num);
+ (unsigned int)s->init_num);
frag->msg_header.msg_len = s->d1->w_msg_hdr.msg_len;
frag->msg_header.seq = s->d1->w_msg_hdr.seq;
/* save current state*/
frag->msg_header.saved_retransmit_state.session = s->session;
frag->msg_header.saved_retransmit_state.epoch =
- tls12_record_layer_write_epoch(s->internal->rl);
+ tls12_record_layer_write_epoch(s->rl);
memset(seq64be, 0, sizeof(seq64be));
seq64be[6] = (unsigned char)(dtls1_get_queue_priority(
struct dtls1_retransmit_state saved_state;
/*
- OPENSSL_assert(s->internal->init_num == 0);
- OPENSSL_assert(s->internal->init_off == 0);
+ OPENSSL_assert(s->init_num == 0);
+ OPENSSL_assert(s->init_off == 0);
*/
/* XDTLS: the requested message ought to be found, otherwise error */
else
header_length = DTLS1_HM_HEADER_LENGTH;
- memcpy(s->internal->init_buf->data, frag->fragment,
+ memcpy(s->init_buf->data, frag->fragment,
frag->msg_header.msg_len + header_length);
- s->internal->init_num = frag->msg_header.msg_len + header_length;
+ s->init_num = frag->msg_header.msg_len + header_length;
dtls1_set_message_header_int(s, frag->msg_header.type,
frag->msg_header.msg_len, frag->msg_header.seq, 0,
/* save current state */
saved_state.session = s->session;
- saved_state.epoch = tls12_record_layer_write_epoch(s->internal->rl);
+ saved_state.epoch = tls12_record_layer_write_epoch(s->rl);
s->d1->retransmitting = 1;
/* restore state in which the message was originally sent */
s->session = frag->msg_header.saved_retransmit_state.session;
- if (!tls12_record_layer_use_write_epoch(s->internal->rl,
+ if (!tls12_record_layer_use_write_epoch(s->rl,
frag->msg_header.saved_retransmit_state.epoch))
return 0;
/* restore current state */
s->session = saved_state.session;
- if (!tls12_record_layer_use_write_epoch(s->internal->rl,
+ if (!tls12_record_layer_use_write_epoch(s->rl,
saved_state.epoch))
return 0;
item = pqueue_pop(s->d1->sent_messages)) {
frag = item->data;
if (frag->msg_header.is_ccs)
- tls12_record_layer_write_epoch_done(s->internal->rl,
+ tls12_record_layer_write_epoch_done(s->rl,
frag->msg_header.saved_retransmit_state.epoch);
dtls1_hm_fragment_free(frag);
pitem_free(item);
-/* $OpenBSD: d1_lib.c,v 1.61 2021/10/23 13:36:03 jsing Exp $ */
+/* $OpenBSD: d1_lib.c,v 1.62 2022/10/02 16:36:41 jsing Exp $ */
/*
* DTLS implementation written by Nagendra Modadugu
* (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
memset(s->d1, 0, sizeof(*s->d1));
s->d1->unprocessed_rcds.epoch =
- tls12_record_layer_read_epoch(s->internal->rl) + 1;
+ tls12_record_layer_read_epoch(s->rl) + 1;
if (s->server) {
s->d1->cookie_len = sizeof(s->d1->cookie);
-/* $OpenBSD: d1_pkt.c,v 1.123 2022/03/26 15:05:53 jsing Exp $ */
+/* $OpenBSD: d1_pkt.c,v 1.124 2022/10/02 16:36:41 jsing Exp $ */
/*
* DTLS implementation written by Nagendra Modadugu
* (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
{
ssl3_release_buffer(&s->s3->rbuf);
- s->internal->packet = rdata->packet;
- s->internal->packet_length = rdata->packet_length;
+ s->packet = rdata->packet;
+ s->packet_length = rdata->packet_length;
memcpy(&(s->s3->rbuf), &(rdata->rbuf), sizeof(SSL3_BUFFER_INTERNAL));
memcpy(&(s->s3->rrec), &(rdata->rrec), sizeof(SSL3_RECORD_INTERNAL));
if (rdata == NULL || item == NULL)
goto init_err;
- rdata->packet = s->internal->packet;
- rdata->packet_length = s->internal->packet_length;
+ rdata->packet = s->packet;
+ rdata->packet_length = s->packet_length;
memcpy(&(rdata->rbuf), &(s->s3->rbuf), sizeof(SSL3_BUFFER_INTERNAL));
memcpy(&(rdata->rrec), &(s->s3->rrec), sizeof(SSL3_RECORD_INTERNAL));
item->data = rdata;
- s->internal->packet = NULL;
- s->internal->packet_length = 0;
+ s->packet = NULL;
+ s->packet_length = 0;
memset(&(s->s3->rbuf), 0, sizeof(SSL3_BUFFER_INTERNAL));
memset(&(s->s3->rrec), 0, sizeof(SSL3_RECORD_INTERNAL));
{
/* Check if epoch is current. */
if (s->d1->unprocessed_rcds.epoch !=
- tls12_record_layer_read_epoch(s->internal->rl))
+ tls12_record_layer_read_epoch(s->rl))
return (0);
/* Update epoch once all unprocessed records have been processed. */
if (pqueue_peek(s->d1->unprocessed_rcds.q) == NULL) {
s->d1->unprocessed_rcds.epoch =
- tls12_record_layer_read_epoch(s->internal->rl) + 1;
+ tls12_record_layer_read_epoch(s->rl) + 1;
return (0);
}
uint8_t *out;
size_t out_len;
- tls12_record_layer_set_version(s->internal->rl, s->version);
+ tls12_record_layer_set_version(s->rl, s->version);
- if (!tls12_record_layer_open_record(s->internal->rl, s->internal->packet,
- s->internal->packet_length, &out, &out_len)) {
- tls12_record_layer_alert(s->internal->rl, &alert_desc);
+ if (!tls12_record_layer_open_record(s->rl, s->packet,
+ s->packet_length, &out, &out_len)) {
+ tls12_record_layer_alert(s->rl, &alert_desc);
if (alert_desc == 0)
goto err;
rr->length = out_len;
rr->off = 0;
- s->internal->packet_length = 0;
+ s->packet_length = 0;
return (1);
* It will return <= 0 if more data is needed, normally due to an error
* or non-blocking IO.
* When it finishes, one packet has been decoded and can be found in
- * ssl->s3->internal->rrec.type - is the type of record
- * ssl->s3->internal->rrec.data, - data
- * ssl->s3->internal->rrec.length, - number of bytes
+ * ssl->s3->rrec.type - is the type of record
+ * ssl->s3->rrec.data, - data
+ * ssl->s3->rrec.length, - number of bytes
*/
/* used only by dtls1_read_bytes */
int
again:
/* dump this record on all retries */
rr->length = 0;
- s->internal->packet_length = 0;
+ s->packet_length = 0;
}
/* check if we have the header */
- if ((s->internal->rstate != SSL_ST_READ_BODY) ||
- (s->internal->packet_length < DTLS1_RT_HEADER_LENGTH)) {
+ if ((s->rstate != SSL_ST_READ_BODY) ||
+ (s->packet_length < DTLS1_RT_HEADER_LENGTH)) {
CBS header, seq_no;
uint16_t epoch, len, ssl_version;
uint8_t type;
if (n != DTLS1_RT_HEADER_LENGTH)
goto again;
- s->internal->rstate = SSL_ST_READ_BODY;
+ s->rstate = SSL_ST_READ_BODY;
- CBS_init(&header, s->internal->packet, s->internal->packet_length);
+ CBS_init(&header, s->packet, s->packet_length);
/* Pull apart the header into the DTLS1_RECORD */
if (!CBS_get_u8(&header, &type))
rr->length = len;
/* unexpected version, silently discard */
- if (!s->internal->first_packet && ssl_version != s->version)
+ if (!s->first_packet && ssl_version != s->version)
goto again;
/* wrong version, silently discard record */
if (rr->length > SSL3_RT_MAX_ENCRYPTED_LENGTH)
goto again;
- /* now s->internal->rstate == SSL_ST_READ_BODY */
+ /* now s->rstate == SSL_ST_READ_BODY */
p = (unsigned char *)CBS_data(&header);
}
- /* s->internal->rstate == SSL_ST_READ_BODY, get and decode the data */
+ /* s->rstate == SSL_ST_READ_BODY, get and decode the data */
n = ssl3_packet_extend(s, DTLS1_RT_HEADER_LENGTH + rr->length);
if (n <= 0)
if (n != DTLS1_RT_HEADER_LENGTH + rr->length)
goto again;
- s->internal->rstate = SSL_ST_READ_HEADER; /* set state for later operations */
+ s->rstate = SSL_ST_READ_HEADER; /* set state for later operations */
/* match epochs. NULL means the packet is dropped on the floor */
bitmap = dtls1_get_bitmap(s, rr, &is_next_epoch);
* anything while listening.
*/
if (is_next_epoch) {
- if ((SSL_in_init(s) || s->internal->in_handshake) && !s->d1->listen) {
+ if ((SSL_in_init(s) || s->in_handshake) && !s->d1->listen) {
if (dtls1_buffer_record(s, &(s->d1->unprocessed_rcds),
rr->seq_num) < 0)
return (-1);
CBS cbs;
int ret;
- if (s->internal->in_handshake) {
+ if (s->in_handshake) {
SSLerror(s, ERR_R_INTERNAL_ERROR);
return -1;
}
return -1; /* XXX - probably should drop/continue. */
/* This may just be a stale retransmit. */
- if (rr->epoch != tls12_record_layer_read_epoch(s->internal->rl)) {
+ if (rr->epoch != tls12_record_layer_read_epoch(s->rl)) {
rr->length = 0;
return 1;
}
s->d1->handshake_read_seq++;
/* XXX - why is this set here but not in ssl3? */
- s->internal->new_session = 1;
+ s->new_session = 1;
if (!ssl3_renegotiate(s))
return 1;
return -1;
}
- if ((s->internal->options & SSL_OP_NO_CLIENT_RENEGOTIATION) != 0) {
+ if ((s->options & SSL_OP_NO_CLIENT_RENEGOTIATION) != 0) {
ssl3_send_alert(s, SSL3_AL_FATAL,
SSL_AD_NO_RENEGOTIATION);
return -1;
}
s->s3->hs.state = SSL_ST_ACCEPT;
- s->internal->renegotiate = 1;
- s->internal->new_session = 1;
+ s->renegotiate = 1;
+ s->new_session = 1;
} else if (hs_msg_hdr.type == SSL3_MT_FINISHED && s->server) {
/*
return -1;
}
- if ((ret = s->internal->handshake_func(s)) < 0)
+ if ((ret = s->handshake_func(s)) < 0)
return ret;
if (ret == 0) {
SSLerror(s, SSL_R_SSL_HANDSHAKE_FAILURE);
return -1;
}
- if (!(s->internal->mode & SSL_MODE_AUTO_RETRY)) {
+ if (!(s->mode & SSL_MODE_AUTO_RETRY)) {
if (s->s3->rbuf.left == 0) {
ssl_force_want_read(s);
return -1;
return -1;
}
- if (SSL_in_init(s) && !s->internal->in_handshake) {
- if ((ret = s->internal->handshake_func(s)) < 0)
+ if (SSL_in_init(s) && !s->in_handshake) {
+ if ((ret = s->handshake_func(s)) < 0)
return ret;
if (ret == 0) {
SSLerror(s, SSL_R_SSL_HANDSHAKE_FAILURE);
return -1;
}
- s->internal->rwstate = SSL_NOTHING;
+ s->rwstate = SSL_NOTHING;
rr = &s->s3->rrec;
if (dtls1_handle_timeout(s) > 0)
goto start;
- if (rr->length == 0 || s->internal->rstate == SSL_ST_READ_BODY) {
+ if (rr->length == 0 || s->rstate == SSL_ST_READ_BODY) {
if ((ret = dtls1_get_record(s)) <= 0) {
/* Anything other than a timeout is an error. */
if ((ret = dtls1_read_failed(s, ret)) <= 0)
* If the other end has shut down, throw anything we read away (even in
* 'peek' mode).
*/
- if (s->internal->shutdown & SSL_RECEIVED_SHUTDOWN) {
- s->internal->rwstate = SSL_NOTHING;
+ if (s->shutdown & SSL_RECEIVED_SHUTDOWN) {
+ s->rwstate = SSL_NOTHING;
rr->length = 0;
return 0;
}
* are doing a handshake for the first time.
*/
if (SSL_in_init(s) && type == SSL3_RT_APPLICATION_DATA &&
- !tls12_record_layer_read_protected(s->internal->rl)) {
+ !tls12_record_layer_read_protected(s->rl)) {
SSLerror(s, SSL_R_APP_DATA_IN_HANDSHAKE);
ssl3_send_alert(s, SSL3_AL_FATAL,
SSL_AD_UNEXPECTED_MESSAGE);
rr->length -= n;
rr->off += n;
if (rr->length == 0) {
- s->internal->rstate = SSL_ST_READ_HEADER;
+ s->rstate = SSL_ST_READ_HEADER;
rr->off = 0;
}
}
goto start;
}
- if (s->internal->shutdown & SSL_SENT_SHUTDOWN) {
- s->internal->rwstate = SSL_NOTHING;
+ if (s->shutdown & SSL_SENT_SHUTDOWN) {
+ s->rwstate = SSL_NOTHING;
rr->length = 0;
return (0);
}
{
int i;
- if (SSL_in_init(s) && !s->internal->in_handshake)
+ if (SSL_in_init(s) && !s->in_handshake)
{
- i = s->internal->handshake_func(s);
+ i = s->handshake_func(s);
if (i < 0)
return (i);
if (i == 0) {
int i;
OPENSSL_assert(len <= SSL3_RT_MAX_PLAIN_LENGTH);
- s->internal->rwstate = SSL_NOTHING;
+ s->rwstate = SSL_NOTHING;
i = do_dtls1_write(s, type, buf, len);
return i;
}
if (!CBB_init_fixed(&cbb, wb->buf, wb->len))
goto err;
- tls12_record_layer_set_version(s->internal->rl, s->version);
+ tls12_record_layer_set_version(s->rl, s->version);
- if (!tls12_record_layer_seal_record(s->internal->rl, type, buf, len, &cbb))
+ if (!tls12_record_layer_seal_record(s->rl, type, buf, len, &cbb))
goto err;
if (!CBB_finish(&cbb, NULL, &out_len))
*is_next_epoch = 0;
- read_epoch = tls12_record_layer_read_epoch(s->internal->rl);
+ read_epoch = tls12_record_layer_read_epoch(s->rl);
read_epoch_next = read_epoch + 1;
/* In current epoch, accept HM, CCS, DATA, & ALERT */
-/* $OpenBSD: d1_srtp.c,v 1.30 2022/01/28 13:11:56 inoguchi Exp $ */
+/* $OpenBSD: d1_srtp.c,v 1.31 2022/10/02 16:36:41 jsing Exp $ */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
* All rights reserved.
*
int
SSL_CTX_set_tlsext_use_srtp(SSL_CTX *ctx, const char *profiles)
{
- return ssl_ctx_make_profiles(profiles, &ctx->internal->srtp_profiles);
+ return ssl_ctx_make_profiles(profiles, &ctx->srtp_profiles);
}
int
SSL_set_tlsext_use_srtp(SSL *s, const char *profiles)
{
- return ssl_ctx_make_profiles(profiles, &s->internal->srtp_profiles);
+ return ssl_ctx_make_profiles(profiles, &s->srtp_profiles);
}
SSL_get_srtp_profiles(SSL *s)
{
if (s != NULL) {
- if (s->internal->srtp_profiles != NULL) {
- return s->internal->srtp_profiles;
+ if (s->srtp_profiles != NULL) {
+ return s->srtp_profiles;
} else if ((s->ctx != NULL) &&
- (s->ctx->internal->srtp_profiles != NULL)) {
- return s->ctx->internal->srtp_profiles;
+ (s->ctx->srtp_profiles != NULL)) {
+ return s->ctx->srtp_profiles;
}
}
SSL_get_selected_srtp_profile(SSL *s)
{
/* XXX cast away the const */
- return (SRTP_PROTECTION_PROFILE *)s->internal->srtp_profile;
+ return (SRTP_PROTECTION_PROFILE *)s->srtp_profile;
}
#endif
-/* $OpenBSD: s3_lib.c,v 1.238 2022/08/21 19:39:44 jsing Exp $ */
+/* $OpenBSD: s3_lib.c,v 1.239 2022/10/02 16:36:41 jsing Exp $ */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
* All rights reserved.
*
int
ssl3_pending(const SSL *s)
{
- if (s->internal->rstate == SSL_ST_READ_BODY)
+ if (s->rstate == SSL_ST_READ_BODY)
return 0;
return (s->s3->rrec.type == SSL3_RT_APPLICATION_DATA) ?
if (outlen > INT_MAX)
goto err;
- if (!BUF_MEM_grow_clean(s->internal->init_buf, outlen))
+ if (!BUF_MEM_grow_clean(s->init_buf, outlen))
goto err;
- memcpy(s->internal->init_buf->data, data, outlen);
+ memcpy(s->init_buf->data, data, outlen);
- s->internal->init_num = (int)outlen;
- s->internal->init_off = 0;
+ s->init_num = (int)outlen;
+ s->init_off = 0;
if (SSL_is_dtls(s)) {
unsigned long len;
tls_buffer_free(s->s3->hs.tls13.quic_read_buffer);
sk_X509_NAME_pop_free(s->s3->hs.tls12.ca_names, X509_NAME_free);
- sk_X509_pop_free(s->internal->verified_chain, X509_free);
+ sk_X509_pop_free(s->verified_chain, X509_free);
tls1_transcript_free(s);
tls1_transcript_hash_free(s);
tls1_cleanup_key_block(s);
sk_X509_NAME_pop_free(s->s3->hs.tls12.ca_names, X509_NAME_free);
- sk_X509_pop_free(s->internal->verified_chain, X509_free);
- s->internal->verified_chain = NULL;
+ sk_X509_pop_free(s->verified_chain, X509_free);
+ s->verified_chain = NULL;
freezero(s->s3->hs.sigalgs, s->s3->hs.sigalgs_len);
s->s3->hs.sigalgs = NULL;
s->s3->num_renegotiations = 0;
s->s3->in_read_app_data = 0;
- s->internal->packet_length = 0;
+ s->packet_length = 0;
s->version = TLS1_VERSION;
s->s3->hs.state = SSL_ST_BEFORE|((s->server) ? SSL_ST_ACCEPT : SSL_ST_CONNECT);
static int
_SSL_session_reused(SSL *s)
{
- return s->internal->hit;
+ return s->hit;
}
static int
static int
_SSL_set_tlsext_debug_arg(SSL *s, void *arg)
{
- s->internal->tlsext_debug_arg = arg;
+ s->tlsext_debug_arg = arg;
return 1;
}
static int
_SSL_get_tlsext_status_exts(SSL *s, STACK_OF(X509_EXTENSION) **exts)
{
- *exts = s->internal->tlsext_ocsp_exts;
+ *exts = s->tlsext_ocsp_exts;
return 1;
}
_SSL_set_tlsext_status_exts(SSL *s, STACK_OF(X509_EXTENSION) *exts)
{
/* XXX - leak... */
- s->internal->tlsext_ocsp_exts = exts;
+ s->tlsext_ocsp_exts = exts;
return 1;
}
static int
_SSL_get_tlsext_status_ids(SSL *s, STACK_OF(OCSP_RESPID) **ids)
{
- *ids = s->internal->tlsext_ocsp_ids;
+ *ids = s->tlsext_ocsp_ids;
return 1;
}
_SSL_set_tlsext_status_ids(SSL *s, STACK_OF(OCSP_RESPID) *ids)
{
/* XXX - leak... */
- s->internal->tlsext_ocsp_ids = ids;
+ s->tlsext_ocsp_ids = ids;
return 1;
}
static int
_SSL_get_tlsext_status_ocsp_resp(SSL *s, unsigned char **resp)
{
- if (s->internal->tlsext_ocsp_resp != NULL &&
- s->internal->tlsext_ocsp_resp_len < INT_MAX) {
- *resp = s->internal->tlsext_ocsp_resp;
- return (int)s->internal->tlsext_ocsp_resp_len;
+ if (s->tlsext_ocsp_resp != NULL &&
+ s->tlsext_ocsp_resp_len < INT_MAX) {
+ *resp = s->tlsext_ocsp_resp;
+ return (int)s->tlsext_ocsp_resp_len;
}
*resp = NULL;
static int
_SSL_set_tlsext_status_ocsp_resp(SSL *s, unsigned char *resp, int resp_len)
{
- free(s->internal->tlsext_ocsp_resp);
- s->internal->tlsext_ocsp_resp = NULL;
- s->internal->tlsext_ocsp_resp_len = 0;
+ free(s->tlsext_ocsp_resp);
+ s->tlsext_ocsp_resp = NULL;
+ s->tlsext_ocsp_resp_len = 0;
if (resp_len < 0)
return 0;
- s->internal->tlsext_ocsp_resp = resp;
- s->internal->tlsext_ocsp_resp_len = (size_t)resp_len;
+ s->tlsext_ocsp_resp = resp;
+ s->tlsext_ocsp_resp_len = (size_t)resp_len;
return 1;
}
int
SSL_set1_groups(SSL *s, const int *groups, size_t groups_len)
{
- return tls1_set_groups(&s->internal->tlsext_supportedgroups,
- &s->internal->tlsext_supportedgroups_length, groups, groups_len);
+ return tls1_set_groups(&s->tlsext_supportedgroups,
+ &s->tlsext_supportedgroups_length, groups, groups_len);
}
int
SSL_set1_groups_list(SSL *s, const char *groups)
{
- return tls1_set_group_list(&s->internal->tlsext_supportedgroups,
- &s->internal->tlsext_supportedgroups_length, groups);
+ return tls1_set_group_list(&s->tlsext_supportedgroups,
+ &s->tlsext_supportedgroups_length, groups);
}
static int
return 1;
case SSL_CTRL_SET_TLSEXT_DEBUG_CB:
- s->internal->tlsext_debug_cb = (void (*)(SSL *, int , int,
+ s->tlsext_debug_cb = (void (*)(SSL *, int , int,
unsigned char *, int, void *))fp;
return 1;
}
return 0;
}
- DH_free(ctx->internal->cert->dhe_params);
- ctx->internal->cert->dhe_params = dhe_params;
+ DH_free(ctx->cert->dhe_params);
+ ctx->cert->dhe_params = dhe_params;
return 1;
}
static int
_SSL_CTX_set_dh_auto(SSL_CTX *ctx, int state)
{
- ctx->internal->cert->dhe_params_auto = state;
+ ctx->cert->dhe_params_auto = state;
return 1;
}
static int
_SSL_CTX_set_tlsext_servername_arg(SSL_CTX *ctx, void *arg)
{
- ctx->internal->tlsext_servername_arg = arg;
+ ctx->tlsext_servername_arg = arg;
return 1;
}
return 0;
}
- memcpy(keys, ctx->internal->tlsext_tick_key_name, 16);
- memcpy(keys + 16, ctx->internal->tlsext_tick_hmac_key, 16);
- memcpy(keys + 32, ctx->internal->tlsext_tick_aes_key, 16);
+ memcpy(keys, ctx->tlsext_tick_key_name, 16);
+ memcpy(keys + 16, ctx->tlsext_tick_hmac_key, 16);
+ memcpy(keys + 32, ctx->tlsext_tick_aes_key, 16);
return 1;
}
return 0;
}
- memcpy(ctx->internal->tlsext_tick_key_name, keys, 16);
- memcpy(ctx->internal->tlsext_tick_hmac_key, keys + 16, 16);
- memcpy(ctx->internal->tlsext_tick_aes_key, keys + 32, 16);
+ memcpy(ctx->tlsext_tick_key_name, keys, 16);
+ memcpy(ctx->tlsext_tick_hmac_key, keys + 16, 16);
+ memcpy(ctx->tlsext_tick_aes_key, keys + 32, 16);
return 1;
}
static int
_SSL_CTX_get_tlsext_status_arg(SSL_CTX *ctx, void **arg)
{
- *arg = ctx->internal->tlsext_status_arg;
+ *arg = ctx->tlsext_status_arg;
return 1;
}
static int
_SSL_CTX_set_tlsext_status_arg(SSL_CTX *ctx, void *arg)
{
- ctx->internal->tlsext_status_arg = arg;
+ ctx->tlsext_status_arg = arg;
return 1;
}
{
*out_chain = NULL;
- if (ctx->internal->cert->key != NULL)
- *out_chain = ctx->internal->cert->key->chain;
+ if (ctx->cert->key != NULL)
+ *out_chain = ctx->cert->key->chain;
return 1;
}
{
*certs = ctx->extra_certs;
if (*certs == NULL)
- *certs = ctx->internal->cert->key->chain;
+ *certs = ctx->cert->key->chain;
return 1;
}
int
SSL_CTX_set1_groups(SSL_CTX *ctx, const int *groups, size_t groups_len)
{
- return tls1_set_groups(&ctx->internal->tlsext_supportedgroups,
- &ctx->internal->tlsext_supportedgroups_length, groups, groups_len);
+ return tls1_set_groups(&ctx->tlsext_supportedgroups,
+ &ctx->tlsext_supportedgroups_length, groups, groups_len);
}
int
SSL_CTX_set1_groups_list(SSL_CTX *ctx, const char *groups)
{
- return tls1_set_group_list(&ctx->internal->tlsext_supportedgroups,
- &ctx->internal->tlsext_supportedgroups_length, groups);
+ return tls1_set_group_list(&ctx->tlsext_supportedgroups,
+ &ctx->tlsext_supportedgroups_length, groups);
}
long
return 0;
case SSL_CTRL_SET_TMP_DH_CB:
- ctx->internal->cert->dhe_params_cb =
+ ctx->cert->dhe_params_cb =
(DH *(*)(SSL *, int, int))fp;
return 1;
return 1;
case SSL_CTRL_SET_TLSEXT_SERVERNAME_CB:
- ctx->internal->tlsext_servername_callback =
+ ctx->tlsext_servername_callback =
(int (*)(SSL *, int *, void *))fp;
return 1;
case SSL_CTRL_GET_TLSEXT_STATUS_REQ_CB:
- *(int (**)(SSL *, void *))fp = ctx->internal->tlsext_status_cb;
+ *(int (**)(SSL *, void *))fp = ctx->tlsext_status_cb;
return 1;
case SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB:
- ctx->internal->tlsext_status_cb = (int (*)(SSL *, void *))fp;
+ ctx->tlsext_status_cb = (int (*)(SSL *, void *))fp;
return 1;
case SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB:
- ctx->internal->tlsext_ticket_key_cb = (int (*)(SSL *, unsigned char *,
+ ctx->tlsext_ticket_key_cb = (int (*)(SSL *, unsigned char *,
unsigned char *, EVP_CIPHER_CTX *, HMAC_CTX *, int))fp;
return 1;
}
* but would have to pay with the price of sk_SSL_CIPHER_dup().
*/
- if (s->internal->options & SSL_OP_CIPHER_SERVER_PREFERENCE) {
+ if (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE) {
prio = srvr;
allow = clnt;
} else {
* Don't do anything much if we have not done the handshake or
* we don't want to send messages :-)
*/
- if ((s->internal->quiet_shutdown) || (s->s3->hs.state == SSL_ST_BEFORE)) {
- s->internal->shutdown = (SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);
+ if ((s->quiet_shutdown) || (s->s3->hs.state == SSL_ST_BEFORE)) {
+ s->shutdown = (SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);
return (1);
}
- if (!(s->internal->shutdown & SSL_SENT_SHUTDOWN)) {
- s->internal->shutdown|=SSL_SENT_SHUTDOWN;
+ if (!(s->shutdown & SSL_SENT_SHUTDOWN)) {
+ s->shutdown|=SSL_SENT_SHUTDOWN;
ssl3_send_alert(s, SSL3_AL_WARNING, SSL_AD_CLOSE_NOTIFY);
/*
* Our shutdown alert has been sent now, and if it still needs
*/
return (ret);
}
- } else if (!(s->internal->shutdown & SSL_RECEIVED_SHUTDOWN)) {
+ } else if (!(s->shutdown & SSL_RECEIVED_SHUTDOWN)) {
/* If we are waiting for a close from our peer, we are closed */
s->method->ssl_read_bytes(s, 0, NULL, 0, 0);
- if (!(s->internal->shutdown & SSL_RECEIVED_SHUTDOWN)) {
+ if (!(s->shutdown & SSL_RECEIVED_SHUTDOWN)) {
return (-1); /* return WANT_READ */
}
}
- if ((s->internal->shutdown == (SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN)) &&
+ if ((s->shutdown == (SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN)) &&
!s->s3->alert_dispatch)
return (1);
else
peek);
if ((ret == -1) && (s->s3->in_read_app_data == 2)) {
/*
- * ssl3_read_bytes decided to call s->internal->handshake_func,
+ * ssl3_read_bytes decided to call s->handshake_func,
* which called ssl3_read_bytes to read handshake data.
* However, ssl3_read_bytes actually found application data
* and thinks that application data makes sense here; so disable
* handshake processing and try to read application data again.
*/
- s->internal->in_handshake++;
+ s->in_handshake++;
ret = s->method->ssl_read_bytes(s, SSL3_RT_APPLICATION_DATA,
buf, len, peek);
- s->internal->in_handshake--;
+ s->in_handshake--;
} else
s->s3->in_read_app_data = 0;
int
ssl3_renegotiate(SSL *s)
{
- if (s->internal->handshake_func == NULL)
+ if (s->handshake_func == NULL)
return 1;
if (s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS)
-/* $OpenBSD: ssl_both.c,v 1.43 2022/10/01 16:23:15 jsing Exp $ */
+/* $OpenBSD: ssl_both.c,v 1.44 2022/10/02 16:36:41 jsing Exp $ */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
* All rights reserved.
*
#include "ssl_locl.h"
/*
- * Send s->internal->init_buf in records of type 'type' (SSL3_RT_HANDSHAKE or
+ * Send s->init_buf in records of type 'type' (SSL3_RT_HANDSHAKE or
* SSL3_RT_CHANGE_CIPHER_SPEC).
*/
int
{
int ret;
- ret = ssl3_write_bytes(s, type, &s->internal->init_buf->data[s->internal->init_off],
- s->internal->init_num);
+ ret = ssl3_write_bytes(s, type, &s->init_buf->data[s->init_off],
+ s->init_num);
if (ret < 0)
return (-1);
* we'll ignore the result anyway.
*/
tls1_transcript_record(s,
- (unsigned char *)&s->internal->init_buf->data[s->internal->init_off], ret);
+ (unsigned char *)&s->init_buf->data[s->init_off], ret);
- if (ret == s->internal->init_num) {
- ssl_msg_callback(s, 1, type, s->internal->init_buf->data,
- (size_t)(s->internal->init_off + s->internal->init_num));
+ if (ret == s->init_num) {
+ ssl_msg_callback(s, 1, type, s->init_buf->data,
+ (size_t)(s->init_off + s->init_num));
return (1);
}
- s->internal->init_off += ret;
- s->internal->init_num -= ret;
+ s->init_off += ret;
+ s->init_num -= ret;
return (0);
}
if ((chain = cpk->chain) == NULL)
chain = s->ctx->extra_certs;
- if (chain != NULL || (s->internal->mode & SSL_MODE_NO_AUTO_CHAIN)) {
+ if (chain != NULL || (s->mode & SSL_MODE_NO_AUTO_CHAIN)) {
if (!ssl3_add_cert(&cert_list, cpk->x509))
goto err;
} else {
SSLerror(s, SSL_R_UNEXPECTED_MESSAGE);
goto fatal_err;
}
- s->internal->init_msg = s->internal->init_buf->data +
+ s->init_msg = s->init_buf->data +
SSL3_HM_HEADER_LENGTH;
- s->internal->init_num = (int)s->s3->hs.tls12.message_size;
+ s->init_num = (int)s->s3->hs.tls12.message_size;
return 1;
}
- p = (unsigned char *)s->internal->init_buf->data;
+ p = (unsigned char *)s->init_buf->data;
if (s->s3->hs.state == st1) {
int skip_message;
do {
- while (s->internal->init_num < SSL3_HM_HEADER_LENGTH) {
+ while (s->init_num < SSL3_HM_HEADER_LENGTH) {
i = s->method->ssl_read_bytes(s,
- SSL3_RT_HANDSHAKE, &p[s->internal->init_num],
- SSL3_HM_HEADER_LENGTH - s->internal->init_num, 0);
+ SSL3_RT_HANDSHAKE, &p[s->init_num],
+ SSL3_HM_HEADER_LENGTH - s->init_num, 0);
if (i <= 0) {
- s->internal->rwstate = SSL_READING;
+ s->rwstate = SSL_READING;
return i;
}
- s->internal->init_num += i;
+ s->init_num += i;
}
skip_message = 0;
* correct. Does not count for 'Finished' MAC.
*/
if (p[1] == 0 && p[2] == 0 &&p[3] == 0) {
- s->internal->init_num = 0;
+ s->init_num = 0;
skip_message = 1;
ssl_msg_callback(s, 0,
SSLerror(s, SSL_R_EXCESSIVE_MESSAGE_SIZE);
goto fatal_err;
}
- if (l && !BUF_MEM_grow_clean(s->internal->init_buf,
+ if (l && !BUF_MEM_grow_clean(s->init_buf,
l + SSL3_HM_HEADER_LENGTH)) {
SSLerror(s, ERR_R_BUF_LIB);
goto err;
s->s3->hs.tls12.message_size = l;
s->s3->hs.state = stn;
- s->internal->init_msg = s->internal->init_buf->data +
+ s->init_msg = s->init_buf->data +
SSL3_HM_HEADER_LENGTH;
- s->internal->init_num = 0;
+ s->init_num = 0;
}
/* next state (stn) */
- p = s->internal->init_msg;
- n = s->s3->hs.tls12.message_size - s->internal->init_num;
+ p = s->init_msg;
+ n = s->s3->hs.tls12.message_size - s->init_num;
while (n > 0) {
i = s->method->ssl_read_bytes(s, SSL3_RT_HANDSHAKE,
- &p[s->internal->init_num], n, 0);
+ &p[s->init_num], n, 0);
if (i <= 0) {
- s->internal->rwstate = SSL_READING;
+ s->rwstate = SSL_READING;
return i;
}
- s->internal->init_num += i;
+ s->init_num += i;
n -= i;
}
/* Feed this message into MAC computation. */
- if (s->internal->mac_packet) {
- tls1_transcript_record(s, (unsigned char *)s->internal->init_buf->data,
- s->internal->init_num + SSL3_HM_HEADER_LENGTH);
+ if (s->mac_packet) {
+ tls1_transcript_record(s, (unsigned char *)s->init_buf->data,
+ s->init_num + SSL3_HM_HEADER_LENGTH);
ssl_msg_callback(s, 0, SSL3_RT_HANDSHAKE,
- s->internal->init_buf->data,
- (size_t)s->internal->init_num + SSL3_HM_HEADER_LENGTH);
+ s->init_buf->data,
+ (size_t)s->init_num + SSL3_HM_HEADER_LENGTH);
}
return 1;
{
BUF_MEM *buf = NULL;
- if (s->internal->init_buf != NULL)
+ if (s->init_buf != NULL)
return (1);
if ((buf = BUF_MEM_new()) == NULL)
if (!BUF_MEM_grow(buf, SSL3_RT_MAX_PLAIN_LENGTH))
goto err;
- s->internal->init_buf = buf;
+ s->init_buf = buf;
return (1);
err:
void
ssl3_release_init_buffer(SSL *s)
{
- BUF_MEM_free(s->internal->init_buf);
- s->internal->init_buf = NULL;
- s->internal->init_msg = NULL;
- s->internal->init_num = 0;
- s->internal->init_off = 0;
+ BUF_MEM_free(s->init_buf);
+ s->init_buf = NULL;
+ s->init_msg = NULL;
+ s->init_num = 0;
+ s->init_off = 0;
}
int
s->s3->rbuf.len = len;
}
- s->internal->packet = s->s3->rbuf.buf;
+ s->packet = s->s3->rbuf.buf;
return 1;
err:
if (s->s3->wbuf.buf == NULL) {
len = s->max_send_fragment +
SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD + headerlen + align;
- if (!(s->internal->options & SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS))
+ if (!(s->options & SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS))
len += headerlen + align +
SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD;
-/* $OpenBSD: ssl_cert.c,v 1.103 2022/07/07 13:04:39 tb Exp $ */
+/* $OpenBSD: ssl_cert.c,v 1.104 2022/10/02 16:36:41 jsing Exp $ */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
* All rights reserved.
*
if (ssl != NULL)
return ssl->cert;
- return ctx->internal->cert;
+ return ctx->cert;
}
int
*/
X509_VERIFY_PARAM_set1(param, s->param);
- if (s->internal->verify_callback)
- X509_STORE_CTX_set_verify_cb(ctx, s->internal->verify_callback);
+ if (s->verify_callback)
+ X509_STORE_CTX_set_verify_cb(ctx, s->verify_callback);
- if (s->ctx->internal->app_verify_callback != NULL)
- ret = s->ctx->internal->app_verify_callback(ctx,
- s->ctx->internal->app_verify_arg);
+ if (s->ctx->app_verify_callback != NULL)
+ ret = s->ctx->app_verify_callback(ctx,
+ s->ctx->app_verify_arg);
else
ret = X509_verify_cert(ctx);
s->verify_result = X509_STORE_CTX_get_error(ctx);
- sk_X509_pop_free(s->internal->verified_chain, X509_free);
- s->internal->verified_chain = NULL;
+ sk_X509_pop_free(s->verified_chain, X509_free);
+ s->verified_chain = NULL;
if (X509_STORE_CTX_get0_chain(ctx) != NULL) {
- s->internal->verified_chain = X509_STORE_CTX_get1_chain(ctx);
- if (s->internal->verified_chain == NULL) {
+ s->verified_chain = X509_STORE_CTX_get1_chain(ctx);
+ if (s->verified_chain == NULL) {
SSLerrorx(ERR_R_MALLOC_FAILURE);
ret = 0;
}
void
SSL_set_client_CA_list(SSL *s, STACK_OF(X509_NAME) *name_list)
{
- set_client_CA_list(&(s->internal->client_CA), name_list);
+ set_client_CA_list(&(s->client_CA), name_list);
}
void
SSL_CTX_set_client_CA_list(SSL_CTX *ctx, STACK_OF(X509_NAME) *name_list)
{
- set_client_CA_list(&(ctx->internal->client_CA), name_list);
+ set_client_CA_list(&(ctx->client_CA), name_list);
}
STACK_OF(X509_NAME) *
SSL_CTX_get_client_CA_list(const SSL_CTX *ctx)
{
- return (ctx->internal->client_CA);
+ return (ctx->client_CA);
}
STACK_OF(X509_NAME) *
else
return (NULL);
} else {
- if (s->internal->client_CA != NULL)
- return (s->internal->client_CA);
+ if (s->client_CA != NULL)
+ return (s->client_CA);
else
- return (s->ctx->internal->client_CA);
+ return (s->ctx->client_CA);
}
}
int
SSL_add_client_CA(SSL *ssl, X509 *x)
{
- return (add_client_CA(&(ssl->internal->client_CA), x));
+ return (add_client_CA(&(ssl->client_CA), x));
}
int
SSL_CTX_add_client_CA(SSL_CTX *ctx, X509 *x)
{
- return (add_client_CA(&(ctx->internal->client_CA), x));
+ return (add_client_CA(&(ctx->client_CA), x));
}
static int
-/* $OpenBSD: ssl_ciphers.c,v 1.15 2022/07/02 16:31:04 tb Exp $ */
+/* $OpenBSD: ssl_ciphers.c,v 1.16 2022/10/02 16:36:41 jsing Exp $ */
/*
* Copyright (c) 2015-2017 Doug Hogan <doug@openbsd.org>
* Copyright (c) 2015-2018, 2020 Joel Sing <jsing@openbsd.org>
}
/* Add SCSV if there are other ciphers and we're not renegotiating. */
- if (num_ciphers > 0 && !s->internal->renegotiate) {
+ if (num_ciphers > 0 && !s->renegotiate) {
if (!CBB_add_u16(cbb, SSL3_CK_SCSV & SSL3_CK_VALUE_MASK))
return 0;
}
* TLS_EMPTY_RENEGOTIATION_INFO_SCSV is fatal if
* renegotiating.
*/
- if (s->internal->renegotiate) {
+ if (s->renegotiate) {
SSLerror(s, SSL_R_SCSV_RECEIVED_WHEN_RENEGOTIATING);
ssl3_send_alert(s, SSL3_AL_FATAL,
SSL_AD_HANDSHAKE_FAILURE);
-/* $OpenBSD: ssl_clnt.c,v 1.154 2022/10/01 16:23:15 jsing Exp $ */
+/* $OpenBSD: ssl_clnt.c,v 1.155 2022/10/02 16:36:41 jsing Exp $ */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
* All rights reserved.
*
ERR_clear_error();
errno = 0;
- s->internal->in_handshake++;
+ s->in_handshake++;
if (!SSL_in_init(s) || SSL_in_before(s))
SSL_clear(s);
switch (s->s3->hs.state) {
case SSL_ST_RENEGOTIATE:
- s->internal->renegotiate = 1;
+ s->renegotiate = 1;
s->s3->hs.state = SSL_ST_CONNECT;
- s->ctx->internal->stats.sess_connect_renegotiate++;
+ s->ctx->stats.sess_connect_renegotiate++;
/* break */
case SSL_ST_BEFORE:
case SSL_ST_CONNECT:
}
s->s3->hs.state = SSL3_ST_CW_CLNT_HELLO_A;
- s->ctx->internal->stats.sess_connect++;
- s->internal->init_num = 0;
+ s->ctx->stats.sess_connect++;
+ s->init_num = 0;
if (SSL_is_dtls(s)) {
/* mark client_random uninitialized */
memset(s->s3->client_random, 0,
sizeof(s->s3->client_random));
s->d1->send_cookie = 0;
- s->internal->hit = 0;
+ s->hit = 0;
}
break;
case SSL3_ST_CW_CLNT_HELLO_A:
case SSL3_ST_CW_CLNT_HELLO_B:
- s->internal->shutdown = 0;
+ s->shutdown = 0;
if (SSL_is_dtls(s)) {
/* every DTLS ClientHello resets Finished MAC */
} else
s->s3->hs.state = SSL3_ST_CR_SRVR_HELLO_A;
- s->internal->init_num = 0;
+ s->init_num = 0;
/* turn on buffering for the next lot of output */
if (s->bbio != s->wbio)
if (ret <= 0)
goto end;
- if (s->internal->hit) {
+ if (s->hit) {
s->s3->hs.state = SSL3_ST_CR_FINISHED_A;
if (!SSL_is_dtls(s)) {
- if (s->internal->tlsext_ticket_expected) {
+ if (s->tlsext_ticket_expected) {
/* receive renewed session ticket */
s->s3->hs.state = SSL3_ST_CR_SESSION_TICKET_A;
}
} else {
s->s3->hs.state = SSL3_ST_CR_CERT_A;
}
- s->internal->init_num = 0;
+ s->init_num = 0;
break;
case DTLS1_ST_CR_HELLO_VERIFY_REQUEST_A:
s->s3->hs.state = SSL3_ST_CW_CLNT_HELLO_A;
else
s->s3->hs.state = SSL3_ST_CR_CERT_A;
- s->internal->init_num = 0;
+ s->init_num = 0;
break;
case SSL3_ST_CR_CERT_A:
if (ret <= 0)
goto end;
if (ret == 2) {
- s->internal->hit = 1;
- if (s->internal->tlsext_ticket_expected)
+ s->hit = 1;
+ if (s->tlsext_ticket_expected)
s->s3->hs.state = SSL3_ST_CR_SESSION_TICKET_A;
else
s->s3->hs.state = SSL3_ST_CR_FINISHED_A;
- s->internal->init_num = 0;
+ s->init_num = 0;
break;
}
/* Check if it is anon DH/ECDH. */
ret = ssl3_get_server_certificate(s);
if (ret <= 0)
goto end;
- if (s->internal->tlsext_status_expected)
+ if (s->tlsext_status_expected)
s->s3->hs.state = SSL3_ST_CR_CERT_STATUS_A;
else
s->s3->hs.state = SSL3_ST_CR_KEY_EXCH_A;
skip = 1;
s->s3->hs.state = SSL3_ST_CR_KEY_EXCH_A;
}
- s->internal->init_num = 0;
+ s->init_num = 0;
break;
case SSL3_ST_CR_KEY_EXCH_A:
if (ret <= 0)
goto end;
s->s3->hs.state = SSL3_ST_CR_CERT_REQ_A;
- s->internal->init_num = 0;
+ s->init_num = 0;
/*
* At this point we check that we have the
if (ret <= 0)
goto end;
s->s3->hs.state = SSL3_ST_CR_SRVR_DONE_A;
- s->internal->init_num = 0;
+ s->init_num = 0;
break;
case SSL3_ST_CR_SRVR_DONE_A:
s->s3->hs.state = SSL3_ST_CW_CERT_A;
else
s->s3->hs.state = SSL3_ST_CW_KEY_EXCH_A;
- s->internal->init_num = 0;
+ s->init_num = 0;
break;
if (ret <= 0)
goto end;
s->s3->hs.state = SSL3_ST_CW_KEY_EXCH_A;
- s->internal->init_num = 0;
+ s->init_num = 0;
break;
case SSL3_ST_CW_KEY_EXCH_A:
}
}
- s->internal->init_num = 0;
+ s->init_num = 0;
break;
case SSL3_ST_CW_CERT_VRFY_A:
if (ret <= 0)
goto end;
s->s3->hs.state = SSL3_ST_CW_CHANGE_A;
- s->internal->init_num = 0;
+ s->init_num = 0;
s->s3->change_cipher_spec = 0;
break;
case SSL3_ST_CW_CHANGE_A:
case SSL3_ST_CW_CHANGE_B:
- if (SSL_is_dtls(s) && !s->internal->hit)
+ if (SSL_is_dtls(s) && !s->hit)
dtls1_start_timer(s);
ret = ssl3_send_client_change_cipher_spec(s);
if (ret <= 0)
goto end;
s->s3->hs.state = SSL3_ST_CW_FINISHED_A;
- s->internal->init_num = 0;
+ s->init_num = 0;
s->session->cipher = s->s3->hs.cipher;
if (!tls1_setup_key_block(s)) {
case SSL3_ST_CW_FINISHED_A:
case SSL3_ST_CW_FINISHED_B:
- if (SSL_is_dtls(s) && !s->internal->hit)
+ if (SSL_is_dtls(s) && !s->hit)
dtls1_start_timer(s);
ret = ssl3_send_client_finished(s);
if (ret <= 0)
s->s3->hs.state = SSL3_ST_CW_FLUSH;
/* clear flags */
- if (s->internal->hit) {
+ if (s->hit) {
s->s3->hs.tls12.next_state = SSL_ST_OK;
} else {
/* Allow NewSessionTicket if ticket expected */
- if (s->internal->tlsext_ticket_expected)
+ if (s->tlsext_ticket_expected)
s->s3->hs.tls12.next_state =
SSL3_ST_CR_SESSION_TICKET_A;
else
s->s3->hs.tls12.next_state =
SSL3_ST_CR_FINISHED_A;
}
- s->internal->init_num = 0;
+ s->init_num = 0;
break;
case SSL3_ST_CR_SESSION_TICKET_A:
if (ret <= 0)
goto end;
s->s3->hs.state = SSL3_ST_CR_FINISHED_A;
- s->internal->init_num = 0;
+ s->init_num = 0;
break;
case SSL3_ST_CR_CERT_STATUS_A:
if (ret <= 0)
goto end;
s->s3->hs.state = SSL3_ST_CR_KEY_EXCH_A;
- s->internal->init_num = 0;
+ s->init_num = 0;
break;
case SSL3_ST_CR_FINISHED_A:
if (SSL_is_dtls(s))
dtls1_stop_timer(s);
- if (s->internal->hit)
+ if (s->hit)
s->s3->hs.state = SSL3_ST_CW_CHANGE_A;
else
s->s3->hs.state = SSL_ST_OK;
- s->internal->init_num = 0;
+ s->init_num = 0;
break;
case SSL3_ST_CW_FLUSH:
- s->internal->rwstate = SSL_WRITING;
+ s->rwstate = SSL_WRITING;
if (BIO_flush(s->wbio) <= 0) {
if (SSL_is_dtls(s)) {
/* If the write error was fatal, stop trying */
if (!BIO_should_retry(s->wbio)) {
- s->internal->rwstate = SSL_NOTHING;
+ s->rwstate = SSL_NOTHING;
s->s3->hs.state = s->s3->hs.tls12.next_state;
}
}
ret = -1;
goto end;
}
- s->internal->rwstate = SSL_NOTHING;
+ s->rwstate = SSL_NOTHING;
s->s3->hs.state = s->s3->hs.tls12.next_state;
break;
ssl_free_wbio_buffer(s);
- s->internal->init_num = 0;
- s->internal->renegotiate = 0;
- s->internal->new_session = 0;
+ s->init_num = 0;
+ s->renegotiate = 0;
+ s->new_session = 0;
ssl_update_cache(s, SSL_SESS_CACHE_CLIENT);
- if (s->internal->hit)
- s->ctx->internal->stats.sess_hit++;
+ if (s->hit)
+ s->ctx->stats.sess_hit++;
ret = 1;
/* s->server=0; */
- s->internal->handshake_func = ssl3_connect;
- s->ctx->internal->stats.sess_connect_good++;
+ s->handshake_func = ssl3_connect;
+ s->ctx->stats.sess_connect_good++;
ssl_info_callback(s, SSL_CB_HANDSHAKE_DONE, 1);
/* did we do anything */
if (!s->s3->hs.tls12.reuse_message && !skip) {
- if (s->internal->debug) {
+ if (s->debug) {
if ((ret = BIO_flush(s->wbio)) <= 0)
goto end;
}
}
end:
- s->internal->in_handshake--;
+ s->in_handshake--;
ssl_info_callback(s, SSL_CB_CONNECT_EXIT, ret);
return (ret);
/* Session ID */
if (!CBB_add_u8_length_prefixed(&client_hello, &session_id))
goto err;
- if (!s->internal->new_session &&
+ if (!s->new_session &&
s->session->session_id_length > 0) {
sl = s->session->session_id_length;
if (sl > sizeof(s->session->session_id)) {
int al, ret;
if ((ret = ssl3_get_message(s, DTLS1_ST_CR_HELLO_VERIFY_REQUEST_A,
- DTLS1_ST_CR_HELLO_VERIFY_REQUEST_B, -1, s->internal->max_cert_list)) <= 0)
+ DTLS1_ST_CR_HELLO_VERIFY_REQUEST_B, -1, s->max_cert_list)) <= 0)
return ret;
if (s->s3->hs.tls12.message_type != DTLS1_MT_HELLO_VERIFY_REQUEST) {
return (1);
}
- if (s->internal->init_num < 0)
+ if (s->init_num < 0)
goto decode_err;
- CBS_init(&hello_verify_request, s->internal->init_msg,
- s->internal->init_num);
+ CBS_init(&hello_verify_request, s->init_msg,
+ s->init_num);
if (!CBS_get_u16(&hello_verify_request, &ssl_version))
goto decode_err;
unsigned long alg_k;
int al, ret;
- s->internal->first_packet = 1;
+ s->first_packet = 1;
if ((ret = ssl3_get_message(s, SSL3_ST_CR_SRVR_HELLO_A,
SSL3_ST_CR_SRVR_HELLO_B, -1, 20000 /* ?? */)) <= 0)
return ret;
- s->internal->first_packet = 0;
+ s->first_packet = 0;
- if (s->internal->init_num < 0)
+ if (s->init_num < 0)
goto decode_err;
- CBS_init(&cbs, s->internal->init_msg, s->internal->init_num);
+ CBS_init(&cbs, s->init_msg, s->init_num);
if (SSL_is_dtls(s)) {
if (s->s3->hs.tls12.message_type == DTLS1_MT_HELLO_VERIFY_REQUEST) {
* Check if we want to resume the session based on external
* pre-shared secret.
*/
- if (s->internal->tls_session_secret_cb != NULL) {
+ if (s->tls_session_secret_cb != NULL) {
SSL_CIPHER *pref_cipher = NULL;
int master_key_length = sizeof(s->session->master_key);
- if (!s->internal->tls_session_secret_cb(s,
+ if (!s->tls_session_secret_cb(s,
s->session->master_key, &master_key_length, NULL,
- &pref_cipher, s->internal->tls_session_secret_cb_arg)) {
+ &pref_cipher, s->tls_session_secret_cb_arg)) {
SSLerror(s, ERR_R_INTERNAL_ERROR);
goto err;
}
goto fatal_err;
}
s->s3->flags |= SSL3_FLAGS_CCS_OK;
- s->internal->hit = 1;
+ s->hit = 1;
} else {
/* a miss or crap from the other end */
/* If we were trying for session-id reuse, make a new
* SSL_SESSION so we don't stuff up other people */
- s->internal->hit = 0;
+ s->hit = 0;
if (s->session->session_id_length > 0) {
if (!ssl_get_new_session(s, 0)) {
al = SSL_AD_INTERNAL_ERROR;
*/
if (s->session->cipher)
s->session->cipher_id = s->session->cipher->id;
- if (s->internal->hit && (s->session->cipher_id != cipher->id)) {
+ if (s->hit && (s->session->cipher_id != cipher->id)) {
al = SSL_AD_ILLEGAL_PARAMETER;
SSLerror(s, SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED);
goto fatal_err;
* absence on initial connect only.
*/
if (!s->s3->renegotiate_seen &&
- !(s->internal->options & SSL_OP_LEGACY_SERVER_CONNECT)) {
+ !(s->options & SSL_OP_LEGACY_SERVER_CONNECT)) {
al = SSL_AD_HANDSHAKE_FAILURE;
SSLerror(s, SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
goto fatal_err;
int al, ret;
if ((ret = ssl3_get_message(s, SSL3_ST_CR_CERT_A,
- SSL3_ST_CR_CERT_B, -1, s->internal->max_cert_list)) <= 0)
+ SSL3_ST_CR_CERT_B, -1, s->max_cert_list)) <= 0)
return ret;
ret = -1;
goto err;
}
- if (s->internal->init_num < 0)
+ if (s->init_num < 0)
goto decode_err;
- CBS_init(&cbs, s->internal->init_msg, s->internal->init_num);
+ CBS_init(&cbs, s->init_msg, s->init_num);
if (!CBS_get_u24_length_prefixed(&cbs, &cert_list))
goto decode_err;
* as ServerKeyExchange message may be skipped.
*/
if ((ret = ssl3_get_message(s, SSL3_ST_CR_KEY_EXCH_A,
- SSL3_ST_CR_KEY_EXCH_B, -1, s->internal->max_cert_list)) <= 0)
+ SSL3_ST_CR_KEY_EXCH_B, -1, s->max_cert_list)) <= 0)
return ret;
if ((md_ctx = EVP_MD_CTX_new()) == NULL)
goto err;
- if (s->internal->init_num < 0)
+ if (s->init_num < 0)
goto err;
- CBS_init(&cbs, s->internal->init_msg, s->internal->init_num);
+ CBS_init(&cbs, s->init_msg, s->init_num);
if (s->s3->hs.tls12.message_type != SSL3_MT_SERVER_KEY_EXCHANGE) {
/*
int ret;
if ((ret = ssl3_get_message(s, SSL3_ST_CR_CERT_REQ_A,
- SSL3_ST_CR_CERT_REQ_B, -1, s->internal->max_cert_list)) <= 0)
+ SSL3_ST_CR_CERT_REQ_B, -1, s->max_cert_list)) <= 0)
return ret;
ret = 0;
goto err;
}
- if (s->internal->init_num < 0)
+ if (s->init_num < 0)
goto decode_err;
- CBS_init(&cert_request, s->internal->init_msg, s->internal->init_num);
+ CBS_init(&cert_request, s->init_msg, s->init_num);
if ((ca_sk = sk_X509_NAME_new(ca_dn_cmp)) == NULL) {
SSLerror(s, ERR_R_MALLOC_FAILURE);
goto fatal_err;
}
- if (s->internal->init_num < 0) {
+ if (s->init_num < 0) {
al = SSL_AD_DECODE_ERROR;
SSLerror(s, SSL_R_LENGTH_MISMATCH);
goto fatal_err;
}
- CBS_init(&cbs, s->internal->init_msg, s->internal->init_num);
+ CBS_init(&cbs, s->init_msg, s->init_num);
if (!CBS_get_u32(&cbs, &lifetime_hint) ||
!CBS_get_u16_length_prefixed(&cbs, &session_ticket) ||
CBS_len(&cbs) != 0) {
* Tell the callback the server did not send us an OSCP
* response, and has decided to head directly to key exchange.
*/
- if (s->ctx->internal->tlsext_status_cb) {
- free(s->internal->tlsext_ocsp_resp);
- s->internal->tlsext_ocsp_resp = NULL;
- s->internal->tlsext_ocsp_resp_len = 0;
+ if (s->ctx->tlsext_status_cb) {
+ free(s->tlsext_ocsp_resp);
+ s->tlsext_ocsp_resp = NULL;
+ s->tlsext_ocsp_resp_len = 0;
- ret = s->ctx->internal->tlsext_status_cb(s,
- s->ctx->internal->tlsext_status_arg);
+ ret = s->ctx->tlsext_status_cb(s,
+ s->ctx->tlsext_status_arg);
if (ret == 0) {
al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
SSLerror(s, SSL_R_INVALID_STATUS_RESPONSE);
goto fatal_err;
}
- if (s->internal->init_num < 0) {
+ if (s->init_num < 0) {
/* need at least status type + length */
al = SSL_AD_DECODE_ERROR;
SSLerror(s, SSL_R_LENGTH_MISMATCH);
goto fatal_err;
}
- CBS_init(&cert_status, s->internal->init_msg, s->internal->init_num);
+ CBS_init(&cert_status, s->init_msg, s->init_num);
if (!CBS_get_u8(&cert_status, &status_type) ||
CBS_len(&cert_status) < 3) {
/* need at least status type + length */
goto fatal_err;
}
- if (!CBS_stow(&response, &s->internal->tlsext_ocsp_resp,
- &s->internal->tlsext_ocsp_resp_len)) {
+ if (!CBS_stow(&response, &s->tlsext_ocsp_resp,
+ &s->tlsext_ocsp_resp_len)) {
al = SSL_AD_INTERNAL_ERROR;
SSLerror(s, ERR_R_MALLOC_FAILURE);
goto fatal_err;
}
- if (s->ctx->internal->tlsext_status_cb) {
- ret = s->ctx->internal->tlsext_status_cb(s,
- s->ctx->internal->tlsext_status_arg);
+ if (s->ctx->tlsext_status_cb) {
+ ret = s->ctx->tlsext_status_cb(s,
+ s->ctx->tlsext_status_arg);
if (ret == 0) {
al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
SSLerror(s, SSL_R_INVALID_STATUS_RESPONSE);
30 /* should be very small, like 0 :-) */)) <= 0)
return ret;
- if (s->internal->init_num != 0) {
+ if (s->init_num != 0) {
/* should contain no data */
ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
SSLerror(s, SSL_R_LENGTH_MISMATCH);
if (s->s3->hs.state == SSL3_ST_CW_CERT_B) {
/*
* If we get an error, we need to
- * ssl->internal->rwstate = SSL_X509_LOOKUP; return(-1);
+ * ssl->rwstate = SSL_X509_LOOKUP; return(-1);
* We then get retried later.
*/
i = ssl_do_client_cert_cb(s, &x509, &pkey);
if (i < 0) {
- s->internal->rwstate = SSL_X509_LOOKUP;
+ s->rwstate = SSL_X509_LOOKUP;
return (-1);
}
- s->internal->rwstate = SSL_NOTHING;
+ s->rwstate = SSL_NOTHING;
if ((i == 1) && (pkey != NULL) && (x509 != NULL)) {
s->s3->hs.state = SSL3_ST_CW_CERT_B;
if (!SSL_use_certificate(s, x509) ||
/* this function is called when we really expect a Certificate
* message, so permit appropriate message length */
if ((ret = ssl3_get_message(s, SSL3_ST_CR_CERT_A,
- SSL3_ST_CR_CERT_B, -1, s->internal->max_cert_list)) <= 0)
+ SSL3_ST_CR_CERT_B, -1, s->max_cert_list)) <= 0)
return ret;
s->s3->hs.tls12.reuse_message = 1;
int i = 0;
#ifndef OPENSSL_NO_ENGINE
- if (s->ctx->internal->client_cert_engine) {
+ if (s->ctx->client_cert_engine) {
i = ENGINE_load_ssl_client_cert(
- s->ctx->internal->client_cert_engine, s,
+ s->ctx->client_cert_engine, s,
SSL_get_client_CA_list(s), px509, ppkey, NULL, NULL, NULL);
if (i != 0)
return (i);
}
#endif
- if (s->ctx->internal->client_cert_cb)
- i = s->ctx->internal->client_cert_cb(s, px509, ppkey);
+ if (s->ctx->client_cert_cb)
+ i = s->ctx->client_cert_cb(s, px509, ppkey);
return (i);
}
memset(&cbb, 0, sizeof(cbb));
if (s->s3->hs.state == SSL3_ST_CW_CHANGE_A) {
- if (!CBB_init_fixed(&cbb, s->internal->init_buf->data,
- s->internal->init_buf->length))
+ if (!CBB_init_fixed(&cbb, s->init_buf->data,
+ s->init_buf->length))
goto err;
if (!CBB_add_u8(&cbb, SSL3_MT_CCS))
goto err;
if (outlen > INT_MAX)
goto err;
- s->internal->init_num = (int)outlen;
- s->internal->init_off = 0;
+ s->init_num = (int)outlen;
+ s->init_off = 0;
if (SSL_is_dtls(s)) {
s->d1->handshake_write_seq =
md_len = TLS1_FINISH_MAC_LENGTH;
- if (s->internal->init_num < 0) {
+ if (s->init_num < 0) {
al = SSL_AD_DECODE_ERROR;
SSLerror(s, SSL_R_BAD_DIGEST_LENGTH);
goto fatal_err;
}
- CBS_init(&cbs, s->internal->init_msg, s->internal->init_num);
+ CBS_init(&cbs, s->init_msg, s->init_num);
if (s->s3->hs.peer_finished_len != md_len ||
CBS_len(&cbs) != md_len) {
-/* $OpenBSD: ssl_lib.c,v 1.305 2022/09/10 15:29:33 jsing Exp $ */
+/* $OpenBSD: ssl_lib.c,v 1.306 2022/10/02 16:36:41 jsing Exp $ */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
* All rights reserved.
*
}
s->error = 0;
- s->internal->hit = 0;
- s->internal->shutdown = 0;
+ s->hit = 0;
+ s->shutdown = 0;
- if (s->internal->renegotiate) {
+ if (s->renegotiate) {
SSLerror(s, ERR_R_INTERNAL_ERROR);
return (0);
}
s->version = s->method->version;
s->client_version = s->version;
- s->internal->rwstate = SSL_NOTHING;
- s->internal->rstate = SSL_ST_READ_HEADER;
+ s->rwstate = SSL_NOTHING;
+ s->rstate = SSL_ST_READ_HEADER;
- tls13_ctx_free(s->internal->tls13);
- s->internal->tls13 = NULL;
+ tls13_ctx_free(s->tls13);
+ s->tls13 = NULL;
ssl3_release_init_buffer(s);
ssl_clear_cipher_state(s);
- s->internal->first_packet = 0;
+ s->first_packet = 0;
/*
* Check to see if we were changed into a different method, if
* so, revert back if we are not doing session-id reuse.
*/
- if (!s->internal->in_handshake && (s->session == NULL) &&
+ if (!s->in_handshake && (s->session == NULL) &&
(s->method != s->ctx->method)) {
s->method->ssl_free(s);
s->method = s->ctx->method;
ctx->method = meth;
ciphers = ssl_create_cipher_list(ctx->method, &ctx->cipher_list,
- ctx->internal->cipher_list_tls13, SSL_DEFAULT_CIPHER_LIST,
- ctx->internal->cert);
+ ctx->cipher_list_tls13, SSL_DEFAULT_CIPHER_LIST,
+ ctx->cert);
if (ciphers == NULL || sk_SSL_CIPHER_num(ciphers) <= 0) {
SSLerrorx(SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS);
return (0);
if ((s = calloc(1, sizeof(*s))) == NULL)
goto err;
- if ((s->internal = calloc(1, sizeof(*s->internal))) == NULL)
- goto err;
- if ((s->internal->rl = tls12_record_layer_new()) == NULL)
+ if ((s->rl = tls12_record_layer_new()) == NULL)
goto err;
- s->internal->min_tls_version = ctx->internal->min_tls_version;
- s->internal->max_tls_version = ctx->internal->max_tls_version;
- s->internal->min_proto_version = ctx->internal->min_proto_version;
- s->internal->max_proto_version = ctx->internal->max_proto_version;
+ s->min_tls_version = ctx->min_tls_version;
+ s->max_tls_version = ctx->max_tls_version;
+ s->min_proto_version = ctx->min_proto_version;
+ s->max_proto_version = ctx->max_proto_version;
- s->internal->options = ctx->internal->options;
- s->internal->mode = ctx->internal->mode;
- s->internal->max_cert_list = ctx->internal->max_cert_list;
- s->internal->num_tickets = ctx->internal->num_tickets;
+ s->options = ctx->options;
+ s->mode = ctx->mode;
+ s->max_cert_list = ctx->max_cert_list;
+ s->num_tickets = ctx->num_tickets;
- if ((s->cert = ssl_cert_dup(ctx->internal->cert)) == NULL)
+ if ((s->cert = ssl_cert_dup(ctx->cert)) == NULL)
goto err;
- s->internal->read_ahead = ctx->internal->read_ahead;
- s->internal->msg_callback = ctx->internal->msg_callback;
- s->internal->msg_callback_arg = ctx->internal->msg_callback_arg;
+ s->read_ahead = ctx->read_ahead;
+ s->msg_callback = ctx->msg_callback;
+ s->msg_callback_arg = ctx->msg_callback_arg;
s->verify_mode = ctx->verify_mode;
s->sid_ctx_length = ctx->sid_ctx_length;
OPENSSL_assert(s->sid_ctx_length <= sizeof s->sid_ctx);
memcpy(&s->sid_ctx, &ctx->sid_ctx, sizeof(s->sid_ctx));
- s->internal->verify_callback = ctx->internal->default_verify_callback;
- s->internal->generate_session_id = ctx->internal->generate_session_id;
+ s->verify_callback = ctx->default_verify_callback;
+ s->generate_session_id = ctx->generate_session_id;
s->param = X509_VERIFY_PARAM_new();
if (!s->param)
goto err;
X509_VERIFY_PARAM_inherit(s->param, ctx->param);
- s->internal->quiet_shutdown = ctx->internal->quiet_shutdown;
- s->max_send_fragment = ctx->internal->max_send_fragment;
+ s->quiet_shutdown = ctx->quiet_shutdown;
+ s->max_send_fragment = ctx->max_send_fragment;
CRYPTO_add(&ctx->references, 1, CRYPTO_LOCK_SSL_CTX);
s->ctx = ctx;
- s->internal->tlsext_debug_cb = 0;
- s->internal->tlsext_debug_arg = NULL;
- s->internal->tlsext_ticket_expected = 0;
+ s->tlsext_debug_cb = 0;
+ s->tlsext_debug_arg = NULL;
+ s->tlsext_ticket_expected = 0;
s->tlsext_status_type = -1;
- s->internal->tlsext_status_expected = 0;
- s->internal->tlsext_ocsp_ids = NULL;
- s->internal->tlsext_ocsp_exts = NULL;
- s->internal->tlsext_ocsp_resp = NULL;
- s->internal->tlsext_ocsp_resp_len = 0;
+ s->tlsext_status_expected = 0;
+ s->tlsext_ocsp_ids = NULL;
+ s->tlsext_ocsp_exts = NULL;
+ s->tlsext_ocsp_resp = NULL;
+ s->tlsext_ocsp_resp_len = 0;
CRYPTO_add(&ctx->references, 1, CRYPTO_LOCK_SSL_CTX);
s->initial_ctx = ctx;
- if (ctx->internal->tlsext_ecpointformatlist != NULL) {
- s->internal->tlsext_ecpointformatlist =
- calloc(ctx->internal->tlsext_ecpointformatlist_length,
- sizeof(ctx->internal->tlsext_ecpointformatlist[0]));
- if (s->internal->tlsext_ecpointformatlist == NULL)
+ if (ctx->tlsext_ecpointformatlist != NULL) {
+ s->tlsext_ecpointformatlist =
+ calloc(ctx->tlsext_ecpointformatlist_length,
+ sizeof(ctx->tlsext_ecpointformatlist[0]));
+ if (s->tlsext_ecpointformatlist == NULL)
goto err;
- memcpy(s->internal->tlsext_ecpointformatlist,
- ctx->internal->tlsext_ecpointformatlist,
- ctx->internal->tlsext_ecpointformatlist_length *
- sizeof(ctx->internal->tlsext_ecpointformatlist[0]));
- s->internal->tlsext_ecpointformatlist_length =
- ctx->internal->tlsext_ecpointformatlist_length;
- }
- if (ctx->internal->tlsext_supportedgroups != NULL) {
- s->internal->tlsext_supportedgroups =
- calloc(ctx->internal->tlsext_supportedgroups_length,
- sizeof(ctx->internal->tlsext_supportedgroups[0]));
- if (s->internal->tlsext_supportedgroups == NULL)
+ memcpy(s->tlsext_ecpointformatlist,
+ ctx->tlsext_ecpointformatlist,
+ ctx->tlsext_ecpointformatlist_length *
+ sizeof(ctx->tlsext_ecpointformatlist[0]));
+ s->tlsext_ecpointformatlist_length =
+ ctx->tlsext_ecpointformatlist_length;
+ }
+ if (ctx->tlsext_supportedgroups != NULL) {
+ s->tlsext_supportedgroups =
+ calloc(ctx->tlsext_supportedgroups_length,
+ sizeof(ctx->tlsext_supportedgroups[0]));
+ if (s->tlsext_supportedgroups == NULL)
goto err;
- memcpy(s->internal->tlsext_supportedgroups,
- ctx->internal->tlsext_supportedgroups,
- ctx->internal->tlsext_supportedgroups_length *
- sizeof(ctx->internal->tlsext_supportedgroups[0]));
- s->internal->tlsext_supportedgroups_length =
- ctx->internal->tlsext_supportedgroups_length;
- }
-
- CBS_init(&cbs, ctx->internal->alpn_client_proto_list,
- ctx->internal->alpn_client_proto_list_len);
- if (!CBS_stow(&cbs, &s->internal->alpn_client_proto_list,
- &s->internal->alpn_client_proto_list_len))
+ memcpy(s->tlsext_supportedgroups,
+ ctx->tlsext_supportedgroups,
+ ctx->tlsext_supportedgroups_length *
+ sizeof(ctx->tlsext_supportedgroups[0]));
+ s->tlsext_supportedgroups_length =
+ ctx->tlsext_supportedgroups_length;
+ }
+
+ CBS_init(&cbs, ctx->alpn_client_proto_list,
+ ctx->alpn_client_proto_list_len);
+ if (!CBS_stow(&cbs, &s->alpn_client_proto_list,
+ &s->alpn_client_proto_list_len))
goto err;
s->verify_result = X509_V_OK;
SSL_clear(s);
- CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL, s, &s->internal->ex_data);
+ CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL, s, &s->ex_data);
return (s);
SSL_CTX_set_generate_session_id(SSL_CTX *ctx, GEN_SESSION_CB cb)
{
CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
- ctx->internal->generate_session_id = cb;
+ ctx->generate_session_id = cb;
CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
return (1);
}
SSL_set_generate_session_id(SSL *ssl, GEN_SESSION_CB cb)
{
CRYPTO_w_lock(CRYPTO_LOCK_SSL);
- ssl->internal->generate_session_id = cb;
+ ssl->generate_session_id = cb;
CRYPTO_w_unlock(CRYPTO_LOCK_SSL);
return (1);
}
memcpy(r.session_id, id, id_len);
CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX);
- p = lh_SSL_SESSION_retrieve(ssl->ctx->internal->sessions, &r);
+ p = lh_SSL_SESSION_retrieve(ssl->ctx->sessions, &r);
CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX);
return (p != NULL);
}
X509_VERIFY_PARAM_free(s->param);
- CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL, s, &s->internal->ex_data);
+ CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL, s, &s->ex_data);
if (s->bbio != NULL) {
/* If the buffering BIO is in place, pop it off */
BIO_free_all(s->rbio);
BIO_free_all(s->wbio);
- tls13_ctx_free(s->internal->tls13);
+ tls13_ctx_free(s->tls13);
ssl3_release_init_buffer(s);
sk_SSL_CIPHER_free(s->cipher_list);
- sk_SSL_CIPHER_free(s->internal->cipher_list_tls13);
+ sk_SSL_CIPHER_free(s->cipher_list_tls13);
/* Make the next call work :-) */
if (s->session != NULL) {
free(s->tlsext_hostname);
SSL_CTX_free(s->initial_ctx);
- free(s->internal->tlsext_ecpointformatlist);
- free(s->internal->tlsext_supportedgroups);
+ free(s->tlsext_ecpointformatlist);
+ free(s->tlsext_supportedgroups);
- sk_X509_EXTENSION_pop_free(s->internal->tlsext_ocsp_exts,
+ sk_X509_EXTENSION_pop_free(s->tlsext_ocsp_exts,
X509_EXTENSION_free);
- sk_OCSP_RESPID_pop_free(s->internal->tlsext_ocsp_ids, OCSP_RESPID_free);
- free(s->internal->tlsext_ocsp_resp);
+ sk_OCSP_RESPID_pop_free(s->tlsext_ocsp_ids, OCSP_RESPID_free);
+ free(s->tlsext_ocsp_resp);
- sk_X509_NAME_pop_free(s->internal->client_CA, X509_NAME_free);
+ sk_X509_NAME_pop_free(s->client_CA, X509_NAME_free);
if (s->method != NULL)
s->method->ssl_free(s);
SSL_CTX_free(s->ctx);
- free(s->internal->alpn_client_proto_list);
+ free(s->alpn_client_proto_list);
- free(s->internal->quic_transport_params);
+ free(s->quic_transport_params);
#ifndef OPENSSL_NO_SRTP
- sk_SRTP_PROTECTION_PROFILE_free(s->internal->srtp_profiles);
+ sk_SRTP_PROTECTION_PROFILE_free(s->srtp_profiles);
#endif
- tls12_record_layer_free(s->internal->rl);
+ tls12_record_layer_free(s->rl);
- free(s->internal);
free(s);
}
int
(*SSL_get_verify_callback(const SSL *s))(int, X509_STORE_CTX *)
{
- return (s->internal->verify_callback);
+ return (s->verify_callback);
}
void
SSL_CTX_set_keylog_callback(SSL_CTX *ctx, SSL_CTX_keylog_cb_func cb)
{
- ctx->internal->keylog_callback = cb;
+ ctx->keylog_callback = cb;
}
SSL_CTX_keylog_cb_func
SSL_CTX_get_keylog_callback(const SSL_CTX *ctx)
{
- return (ctx->internal->keylog_callback);
+ return (ctx->keylog_callback);
}
int
SSL_set_num_tickets(SSL *s, size_t num_tickets)
{
- s->internal->num_tickets = num_tickets;
+ s->num_tickets = num_tickets;
return 1;
}
size_t
SSL_get_num_tickets(const SSL *s)
{
- return s->internal->num_tickets;
+ return s->num_tickets;
}
int
SSL_CTX_set_num_tickets(SSL_CTX *ctx, size_t num_tickets)
{
- ctx->internal->num_tickets = num_tickets;
+ ctx->num_tickets = num_tickets;
return 1;
}
size_t
SSL_CTX_get_num_tickets(const SSL_CTX *ctx)
{
- return ctx->internal->num_tickets;
+ return ctx->num_tickets;
}
int
int
(*SSL_CTX_get_verify_callback(const SSL_CTX *ctx))(int, X509_STORE_CTX *)
{
- return (ctx->internal->default_verify_callback);
+ return (ctx->default_verify_callback);
}
void
{
s->verify_mode = mode;
if (callback != NULL)
- s->internal->verify_callback = callback;
+ s->verify_callback = callback;
}
void
void
SSL_set_read_ahead(SSL *s, int yes)
{
- s->internal->read_ahead = yes;
+ s->read_ahead = yes;
}
int
SSL_get_read_ahead(const SSL *s)
{
- return (s->internal->read_ahead);
+ return (s->read_ahead);
}
int
STACK_OF(X509) *
SSL_get0_verified_chain(const SSL *s)
{
- return s->internal->verified_chain;
+ return s->verified_chain;
}
/*
int
SSL_CTX_check_private_key(const SSL_CTX *ctx)
{
- if ((ctx == NULL) || (ctx->internal->cert == NULL) ||
- (ctx->internal->cert->key->x509 == NULL)) {
+ if ((ctx == NULL) || (ctx->cert == NULL) ||
+ (ctx->cert->key->x509 == NULL)) {
SSLerrorx(SSL_R_NO_CERTIFICATE_ASSIGNED);
return (0);
}
- if (ctx->internal->cert->key->privatekey == NULL) {
+ if (ctx->cert->key->privatekey == NULL) {
SSLerrorx(SSL_R_NO_PRIVATE_KEY_ASSIGNED);
return (0);
}
- return (X509_check_private_key(ctx->internal->cert->key->x509,
- ctx->internal->cert->key->privatekey));
+ return (X509_check_private_key(ctx->cert->key->x509,
+ ctx->cert->key->privatekey));
}
/* Fix this function so that it takes an optional type parameter */
int
SSL_accept(SSL *s)
{
- if (s->internal->handshake_func == NULL)
+ if (s->handshake_func == NULL)
SSL_set_accept_state(s); /* Not properly initialized yet */
return (s->method->ssl_accept(s));
int
SSL_connect(SSL *s)
{
- if (s->internal->handshake_func == NULL)
+ if (s->handshake_func == NULL)
SSL_set_connect_state(s); /* Not properly initialized yet */
return (s->method->ssl_connect(s));
return (-1);
}
- if (s->internal->handshake_func == NULL) {
+ if (s->handshake_func == NULL) {
SSLerror(s, SSL_R_UNINITIALIZED);
return (-1);
}
- if (s->internal->shutdown & SSL_RECEIVED_SHUTDOWN) {
- s->internal->rwstate = SSL_NOTHING;
+ if (s->shutdown & SSL_RECEIVED_SHUTDOWN) {
+ s->rwstate = SSL_NOTHING;
return (0);
}
return ssl3_read(s, buf, num);
return (-1);
}
- if (s->internal->handshake_func == NULL) {
+ if (s->handshake_func == NULL) {
SSLerror(s, SSL_R_UNINITIALIZED);
return (-1);
}
- if (s->internal->shutdown & SSL_RECEIVED_SHUTDOWN) {
+ if (s->shutdown & SSL_RECEIVED_SHUTDOWN) {
return (0);
}
return ssl3_peek(s, buf, num);
return (-1);
}
- if (s->internal->handshake_func == NULL) {
+ if (s->handshake_func == NULL) {
SSLerror(s, SSL_R_UNINITIALIZED);
return (-1);
}
- if (s->internal->shutdown & SSL_SENT_SHUTDOWN) {
- s->internal->rwstate = SSL_NOTHING;
+ if (s->shutdown & SSL_SENT_SHUTDOWN) {
+ s->rwstate = SSL_NOTHING;
SSLerror(s, SSL_R_PROTOCOL_IS_SHUTDOWN);
return (-1);
}
* even if blocking I/O is used (see ssl3_shutdown).
*/
- if (s->internal->handshake_func == NULL) {
+ if (s->handshake_func == NULL) {
SSLerror(s, SSL_R_UNINITIALIZED);
return (-1);
}
int
SSL_renegotiate(SSL *s)
{
- if (s->internal->renegotiate == 0)
- s->internal->renegotiate = 1;
+ if (s->renegotiate == 0)
+ s->renegotiate = 1;
- s->internal->new_session = 1;
+ s->new_session = 1;
return (s->method->ssl_renegotiate(s));
}
int
SSL_renegotiate_abbreviated(SSL *s)
{
- if (s->internal->renegotiate == 0)
- s->internal->renegotiate = 1;
+ if (s->renegotiate == 0)
+ s->renegotiate = 1;
- s->internal->new_session = 0;
+ s->new_session = 0;
return (s->method->ssl_renegotiate(s));
}
* Becomes true when negotiation is requested;
* false again once a handshake has finished.
*/
- return (s->internal->renegotiate != 0);
+ return (s->renegotiate != 0);
}
long
switch (cmd) {
case SSL_CTRL_GET_READ_AHEAD:
- return (s->internal->read_ahead);
+ return (s->read_ahead);
case SSL_CTRL_SET_READ_AHEAD:
- l = s->internal->read_ahead;
- s->internal->read_ahead = larg;
+ l = s->read_ahead;
+ s->read_ahead = larg;
return (l);
case SSL_CTRL_SET_MSG_CALLBACK_ARG:
- s->internal->msg_callback_arg = parg;
+ s->msg_callback_arg = parg;
return (1);
case SSL_CTRL_OPTIONS:
- return (s->internal->options|=larg);
+ return (s->options|=larg);
case SSL_CTRL_CLEAR_OPTIONS:
- return (s->internal->options&=~larg);
+ return (s->options&=~larg);
case SSL_CTRL_MODE:
- return (s->internal->mode|=larg);
+ return (s->mode|=larg);
case SSL_CTRL_CLEAR_MODE:
- return (s->internal->mode &=~larg);
+ return (s->mode &=~larg);
case SSL_CTRL_GET_MAX_CERT_LIST:
- return (s->internal->max_cert_list);
+ return (s->max_cert_list);
case SSL_CTRL_SET_MAX_CERT_LIST:
- l = s->internal->max_cert_list;
- s->internal->max_cert_list = larg;
+ l = s->max_cert_list;
+ s->max_cert_list = larg;
return (l);
case SSL_CTRL_SET_MTU:
#ifndef OPENSSL_NO_DTLS1
{
switch (cmd) {
case SSL_CTRL_SET_MSG_CALLBACK:
- s->internal->msg_callback = (ssl_msg_callback_fn *)(fp);
+ s->msg_callback = (ssl_msg_callback_fn *)(fp);
return (1);
default:
struct lhash_st_SSL_SESSION *
SSL_CTX_sessions(SSL_CTX *ctx)
{
- return (ctx->internal->sessions);
+ return (ctx->sessions);
}
long
switch (cmd) {
case SSL_CTRL_GET_READ_AHEAD:
- return (ctx->internal->read_ahead);
+ return (ctx->read_ahead);
case SSL_CTRL_SET_READ_AHEAD:
- l = ctx->internal->read_ahead;
- ctx->internal->read_ahead = larg;
+ l = ctx->read_ahead;
+ ctx->read_ahead = larg;
return (l);
case SSL_CTRL_SET_MSG_CALLBACK_ARG:
- ctx->internal->msg_callback_arg = parg;
+ ctx->msg_callback_arg = parg;
return (1);
case SSL_CTRL_GET_MAX_CERT_LIST:
- return (ctx->internal->max_cert_list);
+ return (ctx->max_cert_list);
case SSL_CTRL_SET_MAX_CERT_LIST:
- l = ctx->internal->max_cert_list;
- ctx->internal->max_cert_list = larg;
+ l = ctx->max_cert_list;
+ ctx->max_cert_list = larg;
return (l);
case SSL_CTRL_SET_SESS_CACHE_SIZE:
- l = ctx->internal->session_cache_size;
- ctx->internal->session_cache_size = larg;
+ l = ctx->session_cache_size;
+ ctx->session_cache_size = larg;
return (l);
case SSL_CTRL_GET_SESS_CACHE_SIZE:
- return (ctx->internal->session_cache_size);
+ return (ctx->session_cache_size);
case SSL_CTRL_SET_SESS_CACHE_MODE:
- l = ctx->internal->session_cache_mode;
- ctx->internal->session_cache_mode = larg;
+ l = ctx->session_cache_mode;
+ ctx->session_cache_mode = larg;
return (l);
case SSL_CTRL_GET_SESS_CACHE_MODE:
- return (ctx->internal->session_cache_mode);
+ return (ctx->session_cache_mode);
case SSL_CTRL_SESS_NUMBER:
- return (lh_SSL_SESSION_num_items(ctx->internal->sessions));
+ return (lh_SSL_SESSION_num_items(ctx->sessions));
case SSL_CTRL_SESS_CONNECT:
- return (ctx->internal->stats.sess_connect);
+ return (ctx->stats.sess_connect);
case SSL_CTRL_SESS_CONNECT_GOOD:
- return (ctx->internal->stats.sess_connect_good);
+ return (ctx->stats.sess_connect_good);
case SSL_CTRL_SESS_CONNECT_RENEGOTIATE:
- return (ctx->internal->stats.sess_connect_renegotiate);
+ return (ctx->stats.sess_connect_renegotiate);
case SSL_CTRL_SESS_ACCEPT:
- return (ctx->internal->stats.sess_accept);
+ return (ctx->stats.sess_accept);
case SSL_CTRL_SESS_ACCEPT_GOOD:
- return (ctx->internal->stats.sess_accept_good);
+ return (ctx->stats.sess_accept_good);
case SSL_CTRL_SESS_ACCEPT_RENEGOTIATE:
- return (ctx->internal->stats.sess_accept_renegotiate);
+ return (ctx->stats.sess_accept_renegotiate);
case SSL_CTRL_SESS_HIT:
- return (ctx->internal->stats.sess_hit);
+ return (ctx->stats.sess_hit);
case SSL_CTRL_SESS_CB_HIT:
- return (ctx->internal->stats.sess_cb_hit);
+ return (ctx->stats.sess_cb_hit);
case SSL_CTRL_SESS_MISSES:
- return (ctx->internal->stats.sess_miss);
+ return (ctx->stats.sess_miss);
case SSL_CTRL_SESS_TIMEOUTS:
- return (ctx->internal->stats.sess_timeout);
+ return (ctx->stats.sess_timeout);
case SSL_CTRL_SESS_CACHE_FULL:
- return (ctx->internal->stats.sess_cache_full);
+ return (ctx->stats.sess_cache_full);
case SSL_CTRL_OPTIONS:
- return (ctx->internal->options|=larg);
+ return (ctx->options|=larg);
case SSL_CTRL_CLEAR_OPTIONS:
- return (ctx->internal->options&=~larg);
+ return (ctx->options&=~larg);
case SSL_CTRL_MODE:
- return (ctx->internal->mode|=larg);
+ return (ctx->mode|=larg);
case SSL_CTRL_CLEAR_MODE:
- return (ctx->internal->mode&=~larg);
+ return (ctx->mode&=~larg);
case SSL_CTRL_SET_MAX_SEND_FRAGMENT:
if (larg < 512 || larg > SSL3_RT_MAX_PLAIN_LENGTH)
return (0);
- ctx->internal->max_send_fragment = larg;
+ ctx->max_send_fragment = larg;
return (1);
default:
return (ssl3_ctx_ctrl(ctx, cmd, larg, parg));
{
switch (cmd) {
case SSL_CTRL_SET_MSG_CALLBACK:
- ctx->internal->msg_callback = (ssl_msg_callback_fn *)fp;
+ ctx->msg_callback = (ssl_msg_callback_fn *)fp;
return (1);
default:
* ctx->cipher_list has been updated.
*/
ciphers = ssl_create_cipher_list(ctx->method, &ctx->cipher_list,
- ctx->internal->cipher_list_tls13, str, ctx->internal->cert);
+ ctx->cipher_list_tls13, str, ctx->cert);
if (ciphers == NULL) {
return (0);
} else if (sk_SSL_CIPHER_num(ciphers) == 0) {
int
SSL_CTX_set_ciphersuites(SSL_CTX *ctx, const char *str)
{
- if (!ssl_parse_ciphersuites(&ctx->internal->cipher_list_tls13, str)) {
+ if (!ssl_parse_ciphersuites(&ctx->cipher_list_tls13, str)) {
SSLerrorx(SSL_R_NO_CIPHER_MATCH);
return 0;
}
if (!ssl_merge_cipherlists(ctx->cipher_list,
- ctx->internal->cipher_list_tls13, &ctx->cipher_list))
+ ctx->cipher_list_tls13, &ctx->cipher_list))
return 0;
return 1;
{
STACK_OF(SSL_CIPHER) *ciphers, *ciphers_tls13;
- if ((ciphers_tls13 = s->internal->cipher_list_tls13) == NULL)
- ciphers_tls13 = s->ctx->internal->cipher_list_tls13;
+ if ((ciphers_tls13 = s->cipher_list_tls13) == NULL)
+ ciphers_tls13 = s->ctx->cipher_list_tls13;
/* See comment in SSL_CTX_set_cipher_list. */
ciphers = ssl_create_cipher_list(s->ctx->method, &s->cipher_list,
if ((ciphers = s->cipher_list) == NULL)
ciphers = s->ctx->cipher_list;
- if (!ssl_parse_ciphersuites(&s->internal->cipher_list_tls13, str)) {
+ if (!ssl_parse_ciphersuites(&s->cipher_list_tls13, str)) {
SSLerrorx(SSL_R_NO_CIPHER_MATCH);
return (0);
}
- if (!ssl_merge_cipherlists(ciphers, s->internal->cipher_list_tls13,
+ if (!ssl_merge_cipherlists(ciphers, s->cipher_list_tls13,
&s->cipher_list))
return 0;
goto err;
}
- if (!CBS_stow(&cbs, &ctx->internal->alpn_client_proto_list,
- &ctx->internal->alpn_client_proto_list_len))
+ if (!CBS_stow(&cbs, &ctx->alpn_client_proto_list,
+ &ctx->alpn_client_proto_list_len))
goto err;
failed = 0;
goto err;
}
- if (!CBS_stow(&cbs, &ssl->internal->alpn_client_proto_list,
- &ssl->internal->alpn_client_proto_list_len))
+ if (!CBS_stow(&cbs, &ssl->alpn_client_proto_list,
+ &ssl->alpn_client_proto_list_len))
goto err;
failed = 0;
int (*cb) (SSL *ssl, const unsigned char **out, unsigned char *outlen,
const unsigned char *in, unsigned int inlen, void *arg), void *arg)
{
- ctx->internal->alpn_select_cb = cb;
- ctx->internal->alpn_select_cb_arg = arg;
+ ctx->alpn_select_cb = cb;
+ ctx->alpn_select_cb_arg = arg;
}
/*
const char *label, size_t llen, const unsigned char *p, size_t plen,
int use_context)
{
- if (s->internal->tls13 != NULL && s->version == TLS1_3_VERSION) {
+ if (s->tls13 != NULL && s->version == TLS1_3_VERSION) {
if (!use_context) {
p = NULL;
plen = 0;
}
- return tls13_exporter(s->internal->tls13, label, llen, p, plen,
+ return tls13_exporter(s->tls13, label, llen, p, plen,
out, olen);
}
SSLerrorx(ERR_R_MALLOC_FAILURE);
return (NULL);
}
- if ((ret->internal = calloc(1, sizeof(*ret->internal))) == NULL) {
- free(ret);
- SSLerrorx(ERR_R_MALLOC_FAILURE);
- return (NULL);
- }
if (SSL_get_ex_data_X509_STORE_CTX_idx() < 0) {
SSLerrorx(SSL_R_X509_VERIFICATION_SETUP_PROBLEMS);
}
ret->method = meth;
- ret->internal->min_tls_version = meth->min_tls_version;
- ret->internal->max_tls_version = meth->max_tls_version;
- ret->internal->min_proto_version = 0;
- ret->internal->max_proto_version = 0;
- ret->internal->mode = SSL_MODE_AUTO_RETRY;
+ ret->min_tls_version = meth->min_tls_version;
+ ret->max_tls_version = meth->max_tls_version;
+ ret->min_proto_version = 0;
+ ret->max_proto_version = 0;
+ ret->mode = SSL_MODE_AUTO_RETRY;
ret->cert_store = NULL;
- ret->internal->session_cache_mode = SSL_SESS_CACHE_SERVER;
- ret->internal->session_cache_size = SSL_SESSION_CACHE_MAX_SIZE_DEFAULT;
- ret->internal->session_cache_head = NULL;
- ret->internal->session_cache_tail = NULL;
+ ret->session_cache_mode = SSL_SESS_CACHE_SERVER;
+ ret->session_cache_size = SSL_SESSION_CACHE_MAX_SIZE_DEFAULT;
+ ret->session_cache_head = NULL;
+ ret->session_cache_tail = NULL;
/* We take the system default */
ret->session_timeout = ssl_get_default_timeout();
- ret->internal->new_session_cb = 0;
- ret->internal->remove_session_cb = 0;
- ret->internal->get_session_cb = 0;
- ret->internal->generate_session_id = 0;
+ ret->new_session_cb = 0;
+ ret->remove_session_cb = 0;
+ ret->get_session_cb = 0;
+ ret->generate_session_id = 0;
- memset((char *)&ret->internal->stats, 0, sizeof(ret->internal->stats));
+ memset((char *)&ret->stats, 0, sizeof(ret->stats));
ret->references = 1;
- ret->internal->quiet_shutdown = 0;
+ ret->quiet_shutdown = 0;
- ret->internal->info_callback = NULL;
+ ret->info_callback = NULL;
- ret->internal->app_verify_callback = 0;
- ret->internal->app_verify_arg = NULL;
+ ret->app_verify_callback = 0;
+ ret->app_verify_arg = NULL;
- ret->internal->max_cert_list = SSL_MAX_CERT_LIST_DEFAULT;
- ret->internal->read_ahead = 0;
- ret->internal->msg_callback = 0;
- ret->internal->msg_callback_arg = NULL;
+ ret->max_cert_list = SSL_MAX_CERT_LIST_DEFAULT;
+ ret->read_ahead = 0;
+ ret->msg_callback = 0;
+ ret->msg_callback_arg = NULL;
ret->verify_mode = SSL_VERIFY_NONE;
ret->sid_ctx_length = 0;
- ret->internal->default_verify_callback = NULL;
+ ret->default_verify_callback = NULL;
- if ((ret->internal->cert = ssl_cert_new()) == NULL)
+ if ((ret->cert = ssl_cert_new()) == NULL)
goto err;
ret->default_passwd_callback = 0;
ret->default_passwd_callback_userdata = NULL;
- ret->internal->client_cert_cb = 0;
- ret->internal->app_gen_cookie_cb = 0;
- ret->internal->app_verify_cookie_cb = 0;
+ ret->client_cert_cb = 0;
+ ret->app_gen_cookie_cb = 0;
+ ret->app_verify_cookie_cb = 0;
- ret->internal->sessions = lh_SSL_SESSION_new();
- if (ret->internal->sessions == NULL)
+ ret->sessions = lh_SSL_SESSION_new();
+ if (ret->sessions == NULL)
goto err;
ret->cert_store = X509_STORE_new();
if (ret->cert_store == NULL)
goto err;
ssl_create_cipher_list(ret->method, &ret->cipher_list,
- NULL, SSL_DEFAULT_CIPHER_LIST, ret->internal->cert);
+ NULL, SSL_DEFAULT_CIPHER_LIST, ret->cert);
if (ret->cipher_list == NULL ||
sk_SSL_CIPHER_num(ret->cipher_list) <= 0) {
SSLerrorx(SSL_R_LIBRARY_HAS_NO_CIPHERS);
if (!ret->param)
goto err;
- if ((ret->internal->client_CA = sk_X509_NAME_new_null()) == NULL)
+ if ((ret->client_CA = sk_X509_NAME_new_null()) == NULL)
goto err;
- CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL_CTX, ret, &ret->internal->ex_data);
+ CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL_CTX, ret, &ret->ex_data);
ret->extra_certs = NULL;
- ret->internal->max_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH;
+ ret->max_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH;
- ret->internal->tlsext_servername_callback = 0;
- ret->internal->tlsext_servername_arg = NULL;
+ ret->tlsext_servername_callback = 0;
+ ret->tlsext_servername_arg = NULL;
/* Setup RFC4507 ticket keys */
- arc4random_buf(ret->internal->tlsext_tick_key_name, 16);
- arc4random_buf(ret->internal->tlsext_tick_hmac_key, 16);
- arc4random_buf(ret->internal->tlsext_tick_aes_key, 16);
+ arc4random_buf(ret->tlsext_tick_key_name, 16);
+ arc4random_buf(ret->tlsext_tick_hmac_key, 16);
+ arc4random_buf(ret->tlsext_tick_aes_key, 16);
- ret->internal->tlsext_status_cb = 0;
- ret->internal->tlsext_status_arg = NULL;
+ ret->tlsext_status_cb = 0;
+ ret->tlsext_status_arg = NULL;
#ifndef OPENSSL_NO_ENGINE
- ret->internal->client_cert_engine = NULL;
+ ret->client_cert_engine = NULL;
#ifdef OPENSSL_SSL_CLIENT_ENGINE_AUTO
#define eng_strx(x) #x
#define eng_str(x) eng_strx(x)
* Default is to connect to non-RI servers. When RI is more widely
* deployed might change this.
*/
- ret->internal->options |= SSL_OP_LEGACY_SERVER_CONNECT;
+ ret->options |= SSL_OP_LEGACY_SERVER_CONNECT;
return (ret);
err:
* free ex_data, then finally free the cache.
* (See ticket [openssl.org #212].)
*/
- if (ctx->internal->sessions != NULL)
+ if (ctx->sessions != NULL)
SSL_CTX_flush_sessions(ctx, 0);
- CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_CTX, ctx, &ctx->internal->ex_data);
+ CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_CTX, ctx, &ctx->ex_data);
- lh_SSL_SESSION_free(ctx->internal->sessions);
+ lh_SSL_SESSION_free(ctx->sessions);
X509_STORE_free(ctx->cert_store);
sk_SSL_CIPHER_free(ctx->cipher_list);
- sk_SSL_CIPHER_free(ctx->internal->cipher_list_tls13);
- ssl_cert_free(ctx->internal->cert);
- sk_X509_NAME_pop_free(ctx->internal->client_CA, X509_NAME_free);
+ sk_SSL_CIPHER_free(ctx->cipher_list_tls13);
+ ssl_cert_free(ctx->cert);
+ sk_X509_NAME_pop_free(ctx->client_CA, X509_NAME_free);
sk_X509_pop_free(ctx->extra_certs, X509_free);
#ifndef OPENSSL_NO_SRTP
- if (ctx->internal->srtp_profiles)
- sk_SRTP_PROTECTION_PROFILE_free(ctx->internal->srtp_profiles);
+ if (ctx->srtp_profiles)
+ sk_SRTP_PROTECTION_PROFILE_free(ctx->srtp_profiles);
#endif
#ifndef OPENSSL_NO_ENGINE
- ENGINE_finish(ctx->internal->client_cert_engine);
+ ENGINE_finish(ctx->client_cert_engine);
#endif
- free(ctx->internal->tlsext_ecpointformatlist);
- free(ctx->internal->tlsext_supportedgroups);
+ free(ctx->tlsext_ecpointformatlist);
+ free(ctx->tlsext_supportedgroups);
- free(ctx->internal->alpn_client_proto_list);
+ free(ctx->alpn_client_proto_list);
- free(ctx->internal);
free(ctx);
}
SSL_CTX_set_cert_verify_callback(SSL_CTX *ctx,
int (*cb)(X509_STORE_CTX *, void *), void *arg)
{
- ctx->internal->app_verify_callback = cb;
- ctx->internal->app_verify_arg = arg;
+ ctx->app_verify_callback = cb;
+ ctx->app_verify_arg = arg;
}
void
SSL_CTX_set_verify(SSL_CTX *ctx, int mode, int (*cb)(int, X509_STORE_CTX *))
{
ctx->verify_mode = mode;
- ctx->internal->default_verify_callback = cb;
+ ctx->default_verify_callback = cb;
}
void
{
int cache_mode;
- cache_mode = s->session_ctx->internal->session_cache_mode;
+ cache_mode = s->session_ctx->session_cache_mode;
/* Don't cache if mode says not to */
if ((cache_mode & mode) == 0)
return 0;
/* if it is not already cached, cache it */
- if (!s->internal->hit)
+ if (!s->hit)
return 1;
/* If it's TLS 1.3, do it to match OpenSSL */
{
int cache_mode;
- cache_mode = s->session_ctx->internal->session_cache_mode;
+ cache_mode = s->session_ctx->session_cache_mode;
/* Don't cache if mode says not to */
if ((cache_mode & mode) == 0)
return 0;
/* If it is already cached, don't cache it again */
- if (s->internal->hit)
+ if (s->hit)
return 0;
if ((cache_mode & SSL_SESS_CACHE_NO_INTERNAL_STORE) != 0)
* to know about this even if it's a stateless ticket
* from 1.3 so we can know when it is removed.
*/
- if (s->session_ctx->internal->remove_session_cb != NULL)
+ if (s->session_ctx->remove_session_cb != NULL)
return 1;
/* If we have set OP_NO_TICKET, cache it. */
- if ((s->internal->options & SSL_OP_NO_TICKET) != 0)
+ if ((s->options & SSL_OP_NO_TICKET) != 0)
return 1;
/* Otherwise do not cache */
if (s->session->session_id_length == 0)
return;
- cache_mode = s->session_ctx->internal->session_cache_mode;
+ cache_mode = s->session_ctx->session_cache_mode;
do_callback = ssl_should_update_external_cache(s, mode);
if (ssl_should_update_internal_cache(s, mode)) {
* same glorious experience they expect from OpenSSL which
* does it this way.
*/
- if (do_callback && s->session_ctx->internal->new_session_cb != NULL) {
+ if (do_callback && s->session_ctx->new_session_cb != NULL) {
CRYPTO_add(&s->session->references, 1, CRYPTO_LOCK_SSL_SESSION);
- if (!s->session_ctx->internal->new_session_cb(s, s->session))
+ if (!s->session_ctx->new_session_cb(s, s->session))
SSL_SESSION_free(s->session);
}
(cache_mode & mode) != 0) {
int connections;
if (mode & SSL_SESS_CACHE_CLIENT)
- connections = s->session_ctx->internal->stats.sess_connect_good;
+ connections = s->session_ctx->stats.sess_connect_good;
else
- connections = s->session_ctx->internal->stats.sess_accept_good;
+ connections = s->session_ctx->stats.sess_accept_good;
if ((connections & 0xff) == 0xff)
SSL_CTX_flush_sessions(s->session_ctx, time(NULL));
}
if (s->method == method)
return (ret);
- if (s->internal->handshake_func == s->method->ssl_connect)
+ if (s->handshake_func == s->method->ssl_connect)
handshake_func = method->ssl_connect;
- else if (s->internal->handshake_func == s->method->ssl_accept)
+ else if (s->handshake_func == s->method->ssl_accept)
handshake_func = method->ssl_accept;
if (s->method->version == method->version) {
s->method = method;
ret = s->method->ssl_new(s);
}
- s->internal->handshake_func = handshake_func;
+ s->handshake_func = handshake_func;
return (ret);
}
* try to write to the rbio, and an application
* program where rbio and wbio are separate couldn't
* even know what it should wait for. However if we
- * ever set s->internal->rwstate incorrectly (so that we have
+ * ever set s->rwstate incorrectly (so that we have
* SSL_want_read(s) instead of SSL_want_write(s))
* and rbio and wbio *are* the same, this test works
* around that bug; so it might be safer to keep it.
if (SSL_want_x509_lookup(s))
return (SSL_ERROR_WANT_X509_LOOKUP);
- if ((s->internal->shutdown & SSL_RECEIVED_SHUTDOWN) &&
+ if ((s->shutdown & SSL_RECEIVED_SHUTDOWN) &&
(s->s3->warn_alert == SSL_AD_CLOSE_NOTIFY))
return (SSL_ERROR_ZERO_RETURN);
* to request client certificates.
*/
if ((SSL_get_verify_mode(ssl) & SSL_VERIFY_PEER) != 0 &&
- ssl->internal->max_cert_list > flight_len)
- flight_len = ssl->internal->max_cert_list;
+ ssl->max_cert_list > flight_len)
+ flight_len = ssl->max_cert_list;
} else {
/*
* Clients may receive both Certificate message and a
* CertificateRequest message.
*/
- if (ssl->internal->max_cert_list * 2 > flight_len)
- flight_len = ssl->internal->max_cert_list * 2;
+ if (ssl->max_cert_list * 2 > flight_len)
+ flight_len = ssl->max_cert_list * 2;
}
return flight_len;
case ssl_encryption_application:
int
SSL_do_handshake(SSL *s)
{
- if (s->internal->handshake_func == NULL) {
+ if (s->handshake_func == NULL) {
SSLerror(s, SSL_R_CONNECTION_TYPE_NOT_SET);
return (-1);
}
if (!SSL_in_init(s) && !SSL_in_before(s))
return 1;
- return s->internal->handshake_func(s);
+ return s->handshake_func(s);
}
/*
SSL_set_accept_state(SSL *s)
{
s->server = 1;
- s->internal->shutdown = 0;
+ s->shutdown = 0;
s->s3->hs.state = SSL_ST_ACCEPT|SSL_ST_BEFORE;
- s->internal->handshake_func = s->method->ssl_accept;
+ s->handshake_func = s->method->ssl_accept;
ssl_clear_cipher_state(s);
}
SSL_set_connect_state(SSL *s)
{
s->server = 0;
- s->internal->shutdown = 0;
+ s->shutdown = 0;
s->s3->hs.state = SSL_ST_CONNECT|SSL_ST_BEFORE;
- s->internal->handshake_func = s->method->ssl_connect;
+ s->handshake_func = s->method->ssl_connect;
ssl_clear_cipher_state(s);
}
goto err;
}
- ret->internal->options = s->internal->options;
- ret->internal->mode = s->internal->mode;
+ ret->options = s->options;
+ ret->mode = s->mode;
SSL_set_max_cert_list(ret, SSL_get_max_cert_list(s));
SSL_set_read_ahead(ret, SSL_get_read_ahead(s));
- ret->internal->msg_callback = s->internal->msg_callback;
- ret->internal->msg_callback_arg = s->internal->msg_callback_arg;
+ ret->msg_callback = s->msg_callback;
+ ret->msg_callback_arg = s->msg_callback_arg;
SSL_set_verify(ret, SSL_get_verify_mode(s),
SSL_get_verify_callback(s));
SSL_set_verify_depth(ret, SSL_get_verify_depth(s));
- ret->internal->generate_session_id = s->internal->generate_session_id;
+ ret->generate_session_id = s->generate_session_id;
SSL_set_info_callback(ret, SSL_get_info_callback(s));
- ret->internal->debug = s->internal->debug;
+ ret->debug = s->debug;
/* copy app data, a little dangerous perhaps */
if (!CRYPTO_dup_ex_data(CRYPTO_EX_INDEX_SSL,
- &ret->internal->ex_data, &s->internal->ex_data))
+ &ret->ex_data, &s->ex_data))
goto err;
/* setup rbio, and wbio */
} else
ret->wbio = ret->rbio;
}
- ret->internal->rwstate = s->internal->rwstate;
- ret->internal->in_handshake = s->internal->in_handshake;
- ret->internal->handshake_func = s->internal->handshake_func;
+ ret->rwstate = s->rwstate;
+ ret->in_handshake = s->in_handshake;
+ ret->handshake_func = s->handshake_func;
ret->server = s->server;
- ret->internal->renegotiate = s->internal->renegotiate;
- ret->internal->new_session = s->internal->new_session;
- ret->internal->quiet_shutdown = s->internal->quiet_shutdown;
- ret->internal->shutdown = s->internal->shutdown;
+ ret->renegotiate = s->renegotiate;
+ ret->new_session = s->new_session;
+ ret->quiet_shutdown = s->quiet_shutdown;
+ ret->shutdown = s->shutdown;
/* SSL_dup does not really work at any state, though */
ret->s3->hs.state = s->s3->hs.state;
- ret->internal->rstate = s->internal->rstate;
+ ret->rstate = s->rstate;
/*
* Would have to copy ret->init_buf, ret->init_msg, ret->init_num,
* ret->init_off
*/
- ret->internal->init_num = 0;
+ ret->init_num = 0;
- ret->internal->hit = s->internal->hit;
+ ret->hit = s->hit;
X509_VERIFY_PARAM_inherit(ret->param, s->param);
sk_SSL_CIPHER_dup(s->cipher_list)) == NULL)
goto err;
}
- if (s->internal->cipher_list_tls13 != NULL) {
- if ((ret->internal->cipher_list_tls13 =
- sk_SSL_CIPHER_dup(s->internal->cipher_list_tls13)) == NULL)
+ if (s->cipher_list_tls13 != NULL) {
+ if ((ret->cipher_list_tls13 =
+ sk_SSL_CIPHER_dup(s->cipher_list_tls13)) == NULL)
goto err;
}
/* Dup the client_CA list */
- if (s->internal->client_CA != NULL) {
- if ((sk = sk_X509_NAME_dup(s->internal->client_CA)) == NULL) goto err;
- ret->internal->client_CA = sk;
+ if (s->client_CA != NULL) {
+ if ((sk = sk_X509_NAME_dup(s->client_CA)) == NULL) goto err;
+ ret->client_CA = sk;
for (i = 0; i < sk_X509_NAME_num(sk); i++) {
xn = sk_X509_NAME_value(sk, i);
if (sk_X509_NAME_set(sk, i,
void
ssl_clear_cipher_state(SSL *s)
{
- tls12_record_layer_clear_read_state(s->internal->rl);
- tls12_record_layer_clear_write_state(s->internal->rl);
+ tls12_record_layer_clear_read_state(s->rl);
+ tls12_record_layer_clear_write_state(s->rl);
}
void
{
ssl_info_callback_fn *cb;
- if ((cb = s->internal->info_callback) == NULL)
- cb = s->ctx->internal->info_callback;
+ if ((cb = s->info_callback) == NULL)
+ cb = s->ctx->info_callback;
if (cb != NULL)
cb(s, type, value);
}
ssl_msg_callback(SSL *s, int is_write, int content_type,
const void *msg_buf, size_t msg_len)
{
- if (s->internal->msg_callback == NULL)
+ if (s->msg_callback == NULL)
return;
- s->internal->msg_callback(is_write, s->version, content_type,
- msg_buf, msg_len, s, s->internal->msg_callback_arg);
+ s->msg_callback(is_write, s->version, content_type,
+ msg_buf, msg_len, s, s->msg_callback_arg);
}
void
void
SSL_CTX_set_quiet_shutdown(SSL_CTX *ctx, int mode)
{
- ctx->internal->quiet_shutdown = mode;
+ ctx->quiet_shutdown = mode;
}
int
SSL_CTX_get_quiet_shutdown(const SSL_CTX *ctx)
{
- return (ctx->internal->quiet_shutdown);
+ return (ctx->quiet_shutdown);
}
void
SSL_set_quiet_shutdown(SSL *s, int mode)
{
- s->internal->quiet_shutdown = mode;
+ s->quiet_shutdown = mode;
}
int
SSL_get_quiet_shutdown(const SSL *s)
{
- return (s->internal->quiet_shutdown);
+ return (s->quiet_shutdown);
}
void
SSL_set_shutdown(SSL *s, int mode)
{
- s->internal->shutdown = mode;
+ s->shutdown = mode;
}
int
SSL_get_shutdown(const SSL *s)
{
- return (s->internal->shutdown);
+ return (s->shutdown);
}
int
if (ssl->ctx == ctx)
return (ssl->ctx);
- if ((new_cert = ssl_cert_dup(ctx->internal->cert)) == NULL)
+ if ((new_cert = ssl_cert_dup(ctx->cert)) == NULL)
return NULL;
ssl_cert_free(ssl->cert);
ssl->cert = new_cert;
void
SSL_set_info_callback(SSL *ssl, void (*cb)(const SSL *ssl, int type, int val))
{
- ssl->internal->info_callback = cb;
+ ssl->info_callback = cb;
}
void (*SSL_get_info_callback(const SSL *ssl))(const SSL *ssl, int type, int val)
{
- return (ssl->internal->info_callback);
+ return (ssl->info_callback);
}
int
int
SSL_set_ex_data(SSL *s, int idx, void *arg)
{
- return (CRYPTO_set_ex_data(&s->internal->ex_data, idx, arg));
+ return (CRYPTO_set_ex_data(&s->ex_data, idx, arg));
}
void *
SSL_get_ex_data(const SSL *s, int idx)
{
- return (CRYPTO_get_ex_data(&s->internal->ex_data, idx));
+ return (CRYPTO_get_ex_data(&s->ex_data, idx));
}
int
int
SSL_CTX_set_ex_data(SSL_CTX *s, int idx, void *arg)
{
- return (CRYPTO_set_ex_data(&s->internal->ex_data, idx, arg));
+ return (CRYPTO_set_ex_data(&s->ex_data, idx, arg));
}
void *
SSL_CTX_get_ex_data(const SSL_CTX *s, int idx)
{
- return (CRYPTO_get_ex_data(&s->internal->ex_data, idx));
+ return (CRYPTO_get_ex_data(&s->ex_data, idx));
}
int
X509 *
SSL_CTX_get0_certificate(const SSL_CTX *ctx)
{
- if (ctx->internal->cert == NULL)
+ if (ctx->cert == NULL)
return NULL;
- return ctx->internal->cert->key->x509;
+ return ctx->cert->key->x509;
}
EVP_PKEY *
SSL_CTX_get0_privatekey(const SSL_CTX *ctx)
{
- if (ctx->internal->cert == NULL)
+ if (ctx->cert == NULL)
return NULL;
- return ctx->internal->cert->key->privatekey;
+ return ctx->cert->key->privatekey;
}
int
SSL_want(const SSL *s)
{
- return (s->internal->rwstate);
+ return (s->rwstate);
}
void
void
SSL_set_debug(SSL *s, int debug)
{
- s->internal->debug = debug;
+ s->debug = debug;
}
int
SSL_cache_hit(SSL *s)
{
- return (s->internal->hit);
+ return (s->hit);
}
int
SSL_CTX_get_min_proto_version(SSL_CTX *ctx)
{
- return ctx->internal->min_proto_version;
+ return ctx->min_proto_version;
}
int
SSL_CTX_set_min_proto_version(SSL_CTX *ctx, uint16_t version)
{
return ssl_version_set_min(ctx->method, version,
- ctx->internal->max_tls_version, &ctx->internal->min_tls_version,
- &ctx->internal->min_proto_version);
+ ctx->max_tls_version, &ctx->min_tls_version,
+ &ctx->min_proto_version);
}
int
SSL_CTX_get_max_proto_version(SSL_CTX *ctx)
{
- return ctx->internal->max_proto_version;
+ return ctx->max_proto_version;
}
int
SSL_CTX_set_max_proto_version(SSL_CTX *ctx, uint16_t version)
{
return ssl_version_set_max(ctx->method, version,
- ctx->internal->min_tls_version, &ctx->internal->max_tls_version,
- &ctx->internal->max_proto_version);
+ ctx->min_tls_version, &ctx->max_tls_version,
+ &ctx->max_proto_version);
}
int
SSL_get_min_proto_version(SSL *ssl)
{
- return ssl->internal->min_proto_version;
+ return ssl->min_proto_version;
}
int
SSL_set_min_proto_version(SSL *ssl, uint16_t version)
{
return ssl_version_set_min(ssl->method, version,
- ssl->internal->max_tls_version, &ssl->internal->min_tls_version,
- &ssl->internal->min_proto_version);
+ ssl->max_tls_version, &ssl->min_tls_version,
+ &ssl->min_proto_version);
}
int
SSL_get_max_proto_version(SSL *ssl)
{
- return ssl->internal->max_proto_version;
+ return ssl->max_proto_version;
}
int
SSL_set_max_proto_version(SSL *ssl, uint16_t version)
{
return ssl_version_set_max(ssl->method, version,
- ssl->internal->min_tls_version, &ssl->internal->max_tls_version,
- &ssl->internal->max_proto_version);
+ ssl->min_tls_version, &ssl->max_tls_version,
+ &ssl->max_proto_version);
}
const SSL_METHOD *
int
SSL_CTX_get_security_level(const SSL_CTX *ctx)
{
- return ctx->internal->cert->security_level;
+ return ctx->cert->security_level;
}
void
SSL_CTX_set_security_level(SSL_CTX *ctx, int level)
{
- ctx->internal->cert->security_level = level;
+ ctx->cert->security_level = level;
}
int
SSL_set_quic_transport_params(SSL *ssl, const uint8_t *params,
size_t params_len)
{
- freezero(ssl->internal->quic_transport_params,
- ssl->internal->quic_transport_params_len);
- ssl->internal->quic_transport_params = NULL;
- ssl->internal->quic_transport_params_len = 0;
+ freezero(ssl->quic_transport_params,
+ ssl->quic_transport_params_len);
+ ssl->quic_transport_params = NULL;
+ ssl->quic_transport_params_len = 0;
- if ((ssl->internal->quic_transport_params = malloc(params_len)) == NULL)
+ if ((ssl->quic_transport_params = malloc(params_len)) == NULL)
return 0;
- memcpy(ssl->internal->quic_transport_params, params, params_len);
- ssl->internal->quic_transport_params_len = params_len;
+ memcpy(ssl->quic_transport_params, params, params_len);
+ ssl->quic_transport_params_len = params_len;
return 1;
}
-/* $OpenBSD: ssl_locl.h,v 1.426 2022/10/01 16:23:15 jsing Exp $ */
+/* $OpenBSD: ssl_locl.h,v 1.427 2022/10/02 16:36:41 jsing Exp $ */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
* All rights reserved.
*
typedef void (ssl_msg_callback_fn)(int is_write, int version, int content_type,
const void *buf, size_t len, SSL *ssl, void *arg);
-typedef struct ssl_ctx_internal_st {
+struct ssl_ctx_st {
+ const SSL_METHOD *method;
+ const SSL_QUIC_METHOD *quic_method;
+
+ STACK_OF(SSL_CIPHER) *cipher_list;
+
+ struct x509_store_st /* X509_STORE */ *cert_store;
+
+ /* If timeout is not 0, it is the default timeout value set
+ * when SSL_new() is called. This has been put in to make
+ * life easier to set things up */
+ long session_timeout;
+
+ int references;
+
+ /* Default values to use in SSL structures follow (these are copied by SSL_new) */
+
+ STACK_OF(X509) *extra_certs;
+
+ int verify_mode;
+ size_t sid_ctx_length;
+ unsigned char sid_ctx[SSL_MAX_SID_CTX_LENGTH];
+
+ X509_VERIFY_PARAM *param;
+
+ /*
+ * XXX
+ * default_passwd_cb used by python and openvpn, need to keep it until we
+ * add an accessor
+ */
+ /* Default password callback. */
+ pem_password_cb *default_passwd_callback;
+
+ /* Default password callback user data. */
+ void *default_passwd_callback_userdata;
+
uint16_t min_tls_version;
uint16_t max_tls_version;
uint16_t *tlsext_supportedgroups; /* our list */
SSL_CTX_keylog_cb_func keylog_callback; /* Unused. For OpenSSL compatibility. */
size_t num_tickets; /* Unused, for OpenSSL compatibility */
-} SSL_CTX_INTERNAL;
+};
+
+struct ssl_st {
+ /* protocol version
+ * (one of SSL2_VERSION, SSL3_VERSION, TLS1_VERSION, DTLS1_VERSION)
+ */
+ int version;
-struct ssl_ctx_st {
const SSL_METHOD *method;
const SSL_QUIC_METHOD *quic_method;
- STACK_OF(SSL_CIPHER) *cipher_list;
+ /* There are 2 BIO's even though they are normally both the
+ * same. This is so data can be read and written to different
+ * handlers */
- struct x509_store_st /* X509_STORE */ *cert_store;
+ BIO *rbio; /* used by SSL_read */
+ BIO *wbio; /* used by SSL_write */
+ BIO *bbio; /* used during session-id reuse to concatenate
+ * messages */
+ int server; /* are we the server side? - mostly used by SSL_clear*/
- /* If timeout is not 0, it is the default timeout value set
- * when SSL_new() is called. This has been put in to make
- * life easier to set things up */
- long session_timeout;
+ struct ssl3_state_st *s3; /* SSLv3 variables */
+ struct dtls1_state_st *d1; /* DTLSv1 variables */
- int references;
+ X509_VERIFY_PARAM *param;
- /* Default values to use in SSL structures follow (these are copied by SSL_new) */
+ /* crypto */
+ STACK_OF(SSL_CIPHER) *cipher_list;
- STACK_OF(X509) *extra_certs;
+ /* This is used to hold the server certificate used */
+ SSL_CERT *cert;
- int verify_mode;
+ /* the session_id_context is used to ensure sessions are only reused
+ * in the appropriate context */
size_t sid_ctx_length;
unsigned char sid_ctx[SSL_MAX_SID_CTX_LENGTH];
- X509_VERIFY_PARAM *param;
+ /* This can also be in the session once a session is established */
+ SSL_SESSION *session;
- /*
- * XXX
- * default_passwd_cb used by python and openvpn, need to keep it until we
- * add an accessor
- */
- /* Default password callback. */
- pem_password_cb *default_passwd_callback;
+ /* Used in SSL2 and SSL3 */
+ int verify_mode; /* 0 don't care about verify failure.
+ * 1 fail if verify fails */
+ int error; /* error bytes to be written */
+ int error_code; /* actual code */
- /* Default password callback user data. */
- void *default_passwd_callback_userdata;
+ SSL_CTX *ctx;
- struct ssl_ctx_internal_st *internal;
-};
+ long verify_result;
+
+ int references;
+
+ int client_version; /* what was passed, used for
+ * SSLv3/TLS rollback check */
+
+ unsigned int max_send_fragment;
+
+ char *tlsext_hostname;
+
+ /* certificate status request info */
+ /* Status type or -1 if no status type */
+ int tlsext_status_type;
+
+ SSL_CTX * initial_ctx; /* initial ctx, used to store sessions */
+#define session_ctx initial_ctx
-typedef struct ssl_internal_st {
struct tls13_ctx *tls13;
uint16_t min_tls_version;
size_t num_tickets; /* Unused, for OpenSSL compatibility */
STACK_OF(X509) *verified_chain;
-} SSL_INTERNAL;
-
-struct ssl_st {
- /* protocol version
- * (one of SSL2_VERSION, SSL3_VERSION, TLS1_VERSION, DTLS1_VERSION)
- */
- int version;
-
- const SSL_METHOD *method;
- const SSL_QUIC_METHOD *quic_method;
-
- /* There are 2 BIO's even though they are normally both the
- * same. This is so data can be read and written to different
- * handlers */
-
- BIO *rbio; /* used by SSL_read */
- BIO *wbio; /* used by SSL_write */
- BIO *bbio; /* used during session-id reuse to concatenate
- * messages */
- int server; /* are we the server side? - mostly used by SSL_clear*/
-
- struct ssl3_state_st *s3; /* SSLv3 variables */
- struct dtls1_state_st *d1; /* DTLSv1 variables */
-
- X509_VERIFY_PARAM *param;
-
- /* crypto */
- STACK_OF(SSL_CIPHER) *cipher_list;
-
- /* This is used to hold the server certificate used */
- SSL_CERT *cert;
-
- /* the session_id_context is used to ensure sessions are only reused
- * in the appropriate context */
- size_t sid_ctx_length;
- unsigned char sid_ctx[SSL_MAX_SID_CTX_LENGTH];
-
- /* This can also be in the session once a session is established */
- SSL_SESSION *session;
-
- /* Used in SSL2 and SSL3 */
- int verify_mode; /* 0 don't care about verify failure.
- * 1 fail if verify fails */
- int error; /* error bytes to be written */
- int error_code; /* actual code */
-
- SSL_CTX *ctx;
-
- long verify_result;
-
- int references;
-
- int client_version; /* what was passed, used for
- * SSLv3/TLS rollback check */
-
- unsigned int max_send_fragment;
-
- char *tlsext_hostname;
-
- /* certificate status request info */
- /* Status type or -1 if no status type */
- int tlsext_status_type;
-
- SSL_CTX * initial_ctx; /* initial ctx, used to store sessions */
-#define session_ctx initial_ctx
-
- struct ssl_internal_st *internal;
};
typedef struct ssl3_record_internal_st {
-/* $OpenBSD: ssl_packet.c,v 1.13 2022/02/05 14:54:10 jsing Exp $ */
+/* $OpenBSD: ssl_packet.c,v 1.14 2022/10/02 16:36:41 jsing Exp $ */
/*
* Copyright (c) 2016, 2017 Joel Sing <jsing@openbsd.org>
*
memset(&cbb, 0, sizeof(cbb));
- CBS_init(&cbs, s->internal->packet, SSL3_RT_HEADER_LENGTH);
+ CBS_init(&cbs, s->packet, SSL3_RT_HEADER_LENGTH);
if (!CBS_get_u16(&cbs, &record_length) ||
!CBS_get_u8(&cbs, &message_type) ||
if (n != record_length + 2)
return n;
- tls1_transcript_record(s, s->internal->packet + 2,
- s->internal->packet_length - 2);
- s->internal->mac_packet = 0;
+ tls1_transcript_record(s, s->packet + 2,
+ s->packet_length - 2);
+ s->mac_packet = 0;
- if (s->internal->msg_callback)
- s->internal->msg_callback(0, SSL2_VERSION, 0,
- s->internal->packet + 2, s->internal->packet_length - 2, s,
- s->internal->msg_callback_arg);
+ if (s->msg_callback)
+ s->msg_callback(0, SSL2_VERSION, 0,
+ s->packet + 2, s->packet_length - 2, s,
+ s->msg_callback_arg);
/* Decode the SSLv2 record containing the client hello. */
- CBS_init(&cbs, s->internal->packet, s->internal->packet_length);
+ CBS_init(&cbs, s->packet, s->packet_length);
if (!CBS_get_u16(&cbs, &record_length))
return -1;
if (data_len > s->s3->rbuf.len)
goto err;
- s->internal->packet = s->s3->rbuf.buf;
- s->internal->packet_length = data_len;
- memcpy(s->internal->packet, data, data_len);
+ s->packet = s->s3->rbuf.buf;
+ s->packet_length = data_len;
+ memcpy(s->packet, data, data_len);
ret = 1;
err:
if (SSL_is_dtls(s))
return 1;
- CBS_init(&header, s->internal->packet, SSL3_RT_HEADER_LENGTH);
+ CBS_init(&header, s->packet, SSL3_RT_HEADER_LENGTH);
if (ssl_is_sslv3_handshake(&header) == 1)
return 1;
-/* $OpenBSD: ssl_pkt.c,v 1.60 2022/09/11 13:51:25 jsing Exp $ */
+/* $OpenBSD: ssl_pkt.c,v 1.61 2022/10/02 16:36:41 jsing Exp $ */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
* All rights reserved.
*
BIO_clear_retry_flags(bio);
BIO_set_retry_read(bio);
- s->internal->rwstate = SSL_READING;
+ s->rwstate = SSL_READING;
}
/*
* If extend == 0, obtain new n-byte packet; if extend == 1, increase
* packet by another n bytes.
* The packet will be in the sub-array of s->s3->rbuf.buf specified
- * by s->internal->packet and s->internal->packet_length.
- * (If s->internal->read_ahead is set, 'max' bytes may be stored in rbuf
- * [plus s->internal->packet_length bytes if extend == 1].)
+ * by s->packet and s->packet_length.
+ * (If s->read_ahead is set, 'max' bytes may be stored in rbuf
+ * [plus s->packet_length bytes if extend == 1].)
*/
static int
ssl3_read_n(SSL *s, int n, int max, int extend)
rb->offset = align;
}
}
- s->internal->packet = rb->buf + rb->offset;
- s->internal->packet_length = 0;
+ s->packet = rb->buf + rb->offset;
+ s->packet_length = 0;
/* ... now we can act as if 'extend' was set */
}
/* if there is enough in the buffer from a previous read, take some */
if (left >= n) {
- s->internal->packet_length += n;
+ s->packet_length += n;
rb->left = left - n;
rb->offset += n;
return (n);
/* else we need to read more data */
- len = s->internal->packet_length;
+ len = s->packet_length;
pkt = rb->buf + align;
/* Move any available bytes to front of buffer:
* 'len' bytes already pointed to by 'packet',
* 'left' extra ones at the end */
- if (s->internal->packet != pkt) {
+ if (s->packet != pkt) {
/* len > 0 */
- memmove(pkt, s->internal->packet, len + left);
- s->internal->packet = pkt;
+ memmove(pkt, s->packet, len + left);
+ s->packet = pkt;
rb->offset = len + align;
}
return -1;
}
- if (s->internal->read_ahead || SSL_is_dtls(s)) {
+ if (s->read_ahead || SSL_is_dtls(s)) {
if (max < n)
max = n;
if (max > (int)(rb->len - rb->offset))
errno = 0;
if (s->rbio != NULL) {
- s->internal->rwstate = SSL_READING;
+ s->rwstate = SSL_READING;
i = BIO_read(s->rbio, pkt + len + left, max - left);
} else {
SSLerror(s, SSL_R_READ_BIO_NOT_SET);
if (i <= 0) {
rb->left = left;
- if (s->internal->mode & SSL_MODE_RELEASE_BUFFERS &&
+ if (s->mode & SSL_MODE_RELEASE_BUFFERS &&
!SSL_is_dtls(s)) {
if (len + left == 0)
ssl3_release_read_buffer(s);
/* done reading, now the book-keeping */
rb->offset += n;
rb->left = left - n;
- s->internal->packet_length += n;
- s->internal->rwstate = SSL_NOTHING;
+ s->packet_length += n;
+ s->rwstate = SSL_NOTHING;
return (n);
}
n = ssl3_read_n(s, plen, s->s3->rbuf.len, 0);
if (n <= 0)
return n;
- if (s->internal->packet_length < plen)
- return s->internal->packet_length;
+ if (s->packet_length < plen)
+ return s->packet_length;
return plen;
}
{
int rlen, n;
- if (s->internal->packet_length >= plen)
+ if (s->packet_length >= plen)
return plen;
- rlen = plen - s->internal->packet_length;
+ rlen = plen - s->packet_length;
n = ssl3_read_n(s, rlen, rlen, 1);
if (n <= 0)
return n;
- if (s->internal->packet_length < plen)
- return s->internal->packet_length;
+ if (s->packet_length < plen)
+ return s->packet_length;
return plen;
}
* It will return <= 0 if more data is needed, normally due to an error
* or non-blocking IO.
* When it finishes, one packet has been decoded and can be found in
- * ssl->s3->internal->rrec.type - is the type of record
- * ssl->s3->internal->rrec.data, - data
- * ssl->s3->internal->rrec.length, - number of bytes
+ * ssl->s3->rrec.type - is the type of record
+ * ssl->s3->rrec.data, - data
+ * ssl->s3->rrec.length, - number of bytes
*/
/* used only by ssl3_read_bytes */
static int
again:
/* check if we have the header */
- if ((s->internal->rstate != SSL_ST_READ_BODY) ||
- (s->internal->packet_length < SSL3_RT_HEADER_LENGTH)) {
+ if ((s->rstate != SSL_ST_READ_BODY) ||
+ (s->packet_length < SSL3_RT_HEADER_LENGTH)) {
CBS header;
uint16_t len, ssl_version;
uint8_t type;
if (n <= 0)
return (n);
- s->internal->mac_packet = 1;
- s->internal->rstate = SSL_ST_READ_BODY;
+ s->mac_packet = 1;
+ s->rstate = SSL_ST_READ_BODY;
- if (s->server && s->internal->first_packet) {
+ if (s->server && s->first_packet) {
if ((ret = ssl_server_legacy_first_packet(s)) != 1)
return (ret);
ret = -1;
}
- CBS_init(&header, s->internal->packet, SSL3_RT_HEADER_LENGTH);
+ CBS_init(&header, s->packet, SSL3_RT_HEADER_LENGTH);
/* Pull apart the header into the SSL3_RECORD_INTERNAL */
if (!CBS_get_u8(&header, &type) ||
rr->length = len;
/* Lets check version */
- if (!s->internal->first_packet && ssl_version != s->version) {
+ if (!s->first_packet && ssl_version != s->version) {
if ((s->version & 0xFF00) == (ssl_version & 0xFF00) &&
- !tls12_record_layer_write_protected(s->internal->rl)) {
+ !tls12_record_layer_write_protected(s->rl)) {
/* Send back error using their minor version number :-) */
s->version = ssl_version;
}
if (n != SSL3_RT_HEADER_LENGTH + rr->length)
return (n);
- s->internal->rstate = SSL_ST_READ_HEADER; /* set state for later operations */
+ s->rstate = SSL_ST_READ_HEADER; /* set state for later operations */
/*
* A full record has now been read from the wire, which now needs
* to be processed.
*/
- tls12_record_layer_set_version(s->internal->rl, s->version);
+ tls12_record_layer_set_version(s->rl, s->version);
- if (!tls12_record_layer_open_record(s->internal->rl, s->internal->packet,
- s->internal->packet_length, &out, &out_len)) {
- tls12_record_layer_alert(s->internal->rl, &alert_desc);
+ if (!tls12_record_layer_open_record(s->rl, s->packet,
+ s->packet_length, &out, &out_len)) {
+ tls12_record_layer_alert(s->rl, &alert_desc);
if (alert_desc == 0)
goto err;
rr->off = 0;
/* we have pulled in a full packet so zero things */
- s->internal->packet_length = 0;
+ s->packet_length = 0;
if (rr->length == 0) {
/*
* insert a single empty record, so we allow ourselves to read
* once past a single empty record without forcing want_read.
*/
- if (s->internal->empty_record_count++ > SSL_MAX_EMPTY_RECORDS) {
+ if (s->empty_record_count++ > SSL_MAX_EMPTY_RECORDS) {
SSLerror(s, SSL_R_PEER_BEHAVING_BADLY);
return -1;
}
- if (s->internal->empty_record_count > 1) {
+ if (s->empty_record_count > 1) {
ssl_force_want_read(s);
return -1;
}
goto again;
}
- s->internal->empty_record_count = 0;
+ s->empty_record_count = 0;
return (1);
return -1;
}
- s->internal->rwstate = SSL_NOTHING;
+ s->rwstate = SSL_NOTHING;
tot = s->s3->wnum;
s->s3->wnum = 0;
- if (SSL_in_init(s) && !s->internal->in_handshake) {
- i = s->internal->handshake_func(s);
+ if (SSL_in_init(s) && !s->in_handshake) {
+ i = s->handshake_func(s);
if (i < 0)
return (i);
if (i == 0) {
}
if ((i == (int)n) || (type == SSL3_RT_APPLICATION_DATA &&
- (s->internal->mode & SSL_MODE_ENABLE_PARTIAL_WRITE))) {
+ (s->mode & SSL_MODE_ENABLE_PARTIAL_WRITE))) {
/*
* Next chunk of data should get another prepended
* empty fragment in ciphersuites with known-IV
*/
version = s->version;
if (s->s3->hs.state == SSL3_ST_CW_CLNT_HELLO_B &&
- !s->internal->renegotiate &&
+ !s->renegotiate &&
s->s3->hs.our_max_tls_version > TLS1_VERSION)
version = TLS1_VERSION;
* (see http://www.openssl.org/~bodo/tls-cbc.txt). Note that this
* is unnecessary for AEAD.
*/
- if (sess != NULL && tls12_record_layer_write_protected(s->internal->rl)) {
+ if (sess != NULL && tls12_record_layer_write_protected(s->rl)) {
if (s->s3->need_empty_fragments &&
!s->s3->empty_fragment_done &&
type == SSL3_RT_APPLICATION_DATA)
if (!CBB_init_fixed(&cbb, wb->buf + align, wb->len - align))
goto err;
- tls12_record_layer_set_version(s->internal->rl, version);
+ tls12_record_layer_set_version(s->rl, version);
if (need_empty_fragment) {
- if (!tls12_record_layer_seal_record(s->internal->rl, type,
+ if (!tls12_record_layer_seal_record(s->rl, type,
buf, 0, &cbb))
goto err;
s->s3->empty_fragment_done = 1;
}
- if (!tls12_record_layer_seal_record(s->internal->rl, type, buf, len, &cbb))
+ if (!tls12_record_layer_seal_record(s->rl, type, buf, len, &cbb))
goto err;
if (!CBB_finish(&cbb, NULL, &out_len))
/* XXXX */
if ((s->s3->wpend_tot > (int)len) || ((s->s3->wpend_buf != buf) &&
- !(s->internal->mode & SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER)) ||
+ !(s->mode & SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER)) ||
(s->s3->wpend_type != type)) {
SSLerror(s, SSL_R_BAD_WRITE_RETRY);
return (-1);
for (;;) {
errno = 0;
if (s->wbio != NULL) {
- s->internal->rwstate = SSL_WRITING;
+ s->rwstate = SSL_WRITING;
i = BIO_write(s->wbio, (char *)&(wb->buf[wb->offset]),
(unsigned int)wb->left);
} else {
if (i == wb->left) {
wb->left = 0;
wb->offset += i;
- if (s->internal->mode & SSL_MODE_RELEASE_BUFFERS &&
+ if (s->mode & SSL_MODE_RELEASE_BUFFERS &&
!SSL_is_dtls(s))
ssl3_release_write_buffer(s);
- s->internal->rwstate = SSL_NOTHING;
+ s->rwstate = SSL_NOTHING;
return (s->s3->wpend_ret);
} else if (i <= 0) {
/*
if (alert_level == SSL3_AL_WARNING) {
s->s3->warn_alert = alert_descr;
if (alert_descr == SSL_AD_CLOSE_NOTIFY) {
- s->internal->shutdown |= SSL_RECEIVED_SHUTDOWN;
+ s->shutdown |= SSL_RECEIVED_SHUTDOWN;
return 0;
}
/* We requested renegotiation and the peer rejected it. */
return -1;
}
} else if (alert_level == SSL3_AL_FATAL) {
- s->internal->rwstate = SSL_NOTHING;
+ s->rwstate = SSL_NOTHING;
s->s3->fatal_alert = alert_descr;
SSLerror(s, SSL_AD_REASON_OFFSET + alert_descr);
ERR_asprintf_error_data("SSL alert number %d", alert_descr);
- s->internal->shutdown |= SSL_RECEIVED_SHUTDOWN;
+ s->shutdown |= SSL_RECEIVED_SHUTDOWN;
SSL_CTX_remove_session(s->ctx, s->session);
return 0;
} else {
if (s->s3->handshake_fragment_len < sizeof(s->s3->handshake_fragment))
return 1;
- if (s->internal->in_handshake) {
+ if (s->in_handshake) {
SSLerror(s, ERR_R_INTERNAL_ERROR);
return -1;
}
return -1;
}
- if ((s->internal->options & SSL_OP_NO_CLIENT_RENEGOTIATION) != 0) {
+ if ((s->options & SSL_OP_NO_CLIENT_RENEGOTIATION) != 0) {
ssl3_send_alert(s, SSL3_AL_FATAL,
SSL_AD_NO_RENEGOTIATION);
return -1;
}
s->s3->hs.state = SSL_ST_ACCEPT;
- s->internal->renegotiate = 1;
- s->internal->new_session = 1;
+ s->renegotiate = 1;
+ s->new_session = 1;
} else {
SSLerror(s, SSL_R_UNEXPECTED_MESSAGE);
return -1;
}
- if ((ret = s->internal->handshake_func(s)) < 0)
+ if ((ret = s->handshake_func(s)) < 0)
return ret;
if (ret == 0) {
SSLerror(s, SSL_R_SSL_HANDSHAKE_FAILURE);
return -1;
}
- if (!(s->internal->mode & SSL_MODE_AUTO_RETRY)) {
+ if (!(s->mode & SSL_MODE_AUTO_RETRY)) {
if (s->s3->rbuf.left == 0) {
ssl_force_want_read(s);
return -1;
return n;
}
- if (SSL_in_init(s) && !s->internal->in_handshake) {
- if ((ret = s->internal->handshake_func(s)) < 0)
+ if (SSL_in_init(s) && !s->in_handshake) {
+ if ((ret = s->handshake_func(s)) < 0)
return ret;
if (ret == 0) {
SSLerror(s, SSL_R_SSL_HANDSHAKE_FAILURE);
return -1;
}
- s->internal->rwstate = SSL_NOTHING;
+ s->rwstate = SSL_NOTHING;
rr = &s->s3->rrec;
- if (rr->length == 0 || s->internal->rstate == SSL_ST_READ_BODY) {
+ if (rr->length == 0 || s->rstate == SSL_ST_READ_BODY) {
if ((ret = ssl3_get_record(s)) <= 0)
return ret;
}
* If the other end has shut down, throw anything we read away (even in
* 'peek' mode).
*/
- if (s->internal->shutdown & SSL_RECEIVED_SHUTDOWN) {
- s->internal->rwstate = SSL_NOTHING;
+ if (s->shutdown & SSL_RECEIVED_SHUTDOWN) {
+ s->rwstate = SSL_NOTHING;
rr->length = 0;
return 0;
}
* are doing a handshake for the first time.
*/
if (SSL_in_init(s) && type == SSL3_RT_APPLICATION_DATA &&
- !tls12_record_layer_read_protected(s->internal->rl)) {
+ !tls12_record_layer_read_protected(s->rl)) {
SSLerror(s, SSL_R_APP_DATA_IN_HANDSHAKE);
ssl3_send_alert(s, SSL3_AL_FATAL,
SSL_AD_UNEXPECTED_MESSAGE);
rr->length -= n;
rr->off += n;
if (rr->length == 0) {
- s->internal->rstate = SSL_ST_READ_HEADER;
+ s->rstate = SSL_ST_READ_HEADER;
rr->off = 0;
- if (s->internal->mode & SSL_MODE_RELEASE_BUFFERS &&
+ if (s->mode & SSL_MODE_RELEASE_BUFFERS &&
s->s3->rbuf.left == 0)
ssl3_release_read_buffer(s);
}
goto start;
}
- if (s->internal->shutdown & SSL_SENT_SHUTDOWN) {
- s->internal->rwstate = SSL_NOTHING;
+ if (s->shutdown & SSL_SENT_SHUTDOWN) {
+ s->rwstate = SSL_NOTHING;
rr->length = 0;
return 0;
}
-/* $OpenBSD: ssl_seclevel.c,v 1.25 2022/08/17 18:41:17 tb Exp $ */
+/* $OpenBSD: ssl_seclevel.c,v 1.26 2022/10/02 16:36:41 jsing Exp $ */
/*
* Copyright (c) 2020-2022 Theo Buehler <tb@openbsd.org>
*
static int
ssl_ctx_security(const SSL_CTX *ctx, int secop, int bits, int nid, void *other)
{
- return ctx->internal->cert->security_cb(NULL, ctx, secop, bits, nid,
- other, ctx->internal->cert->security_ex_data);
+ return ctx->cert->security_cb(NULL, ctx, secop, bits, nid,
+ other, ctx->cert->security_ex_data);
}
static int
-/* $OpenBSD: ssl_sess.c,v 1.117 2022/08/17 07:39:19 jsing Exp $ */
+/* $OpenBSD: ssl_sess.c,v 1.118 2022/10/02 16:36:41 jsing Exp $ */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
* All rights reserved.
*
}
/* If RFC4507 ticket use empty session ID. */
- if (s->internal->tlsext_ticket_expected) {
+ if (s->tlsext_ticket_expected) {
ss->session_id_length = 0;
goto sess_id_done;
}
/* Choose which callback will set the session ID. */
CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX);
- if (s->internal->generate_session_id)
- cb = s->internal->generate_session_id;
- else if (s->session_ctx->internal->generate_session_id)
- cb = s->session_ctx->internal->generate_session_id;
+ if (s->generate_session_id)
+ cb = s->generate_session_id;
+ else if (s->session_ctx->generate_session_id)
+ cb = s->session_ctx->generate_session_id;
CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX);
/* Choose a session ID. */
SSL_SESSION *sess;
SSL_SESSION data;
- if ((s->session_ctx->internal->session_cache_mode &
+ if ((s->session_ctx->session_cache_mode &
SSL_SESS_CACHE_NO_INTERNAL_LOOKUP))
return NULL;
return NULL;
CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX);
- sess = lh_SSL_SESSION_retrieve(s->session_ctx->internal->sessions, &data);
+ sess = lh_SSL_SESSION_retrieve(s->session_ctx->sessions, &data);
if (sess != NULL)
CRYPTO_add(&sess->references, 1, CRYPTO_LOCK_SSL_SESSION);
CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX);
if (sess == NULL)
- s->session_ctx->internal->stats.sess_miss++;
+ s->session_ctx->stats.sess_miss++;
return sess;
}
SSL_SESSION *sess;
int copy;
- if (s->session_ctx->internal->get_session_cb == NULL)
+ if (s->session_ctx->get_session_cb == NULL)
return NULL;
copy = 1;
- if ((sess = s->session_ctx->internal->get_session_cb(s,
+ if ((sess = s->session_ctx->get_session_cb(s,
CBS_data(session_id), CBS_len(session_id), ©)) == NULL)
return NULL;
/*
if (copy)
CRYPTO_add(&sess->references, 1, CRYPTO_LOCK_SSL_SESSION);
- s->session_ctx->internal->stats.sess_cb_hit++;
+ s->session_ctx->stats.sess_cb_hit++;
/* Add the externally cached session to the internal cache as well. */
- if (!(s->session_ctx->internal->session_cache_mode &
+ if (!(s->session_ctx->session_cache_mode &
SSL_SESS_CACHE_NO_INTERNAL_STORE)) {
/*
* The following should not return 1,
* - If a session is found then s->session is pointed at it (after freeing
* an existing session if need be) and s->verify_result is set from the
* session.
- * - For both new and resumed sessions, s->internal->tlsext_ticket_expected
+ * - For both new and resumed sessions, s->tlsext_ticket_expected
* indicates whether the server should issue a new session ticket or not.
*/
int
if (CBS_len(session_id) > SSL_MAX_SSL_SESSION_ID_LENGTH)
goto err;
- /* Sets s->internal->tlsext_ticket_expected. */
+ /* Sets s->tlsext_ticket_expected. */
switch (tls1_process_ticket(s, ext_block, &alert_desc, &sess)) {
case TLS1_TICKET_FATAL_ERROR:
fatal = 1;
}
if (sess->timeout < (time(NULL) - sess->time)) {
- s->session_ctx->internal->stats.sess_timeout++;
+ s->session_ctx->stats.sess_timeout++;
if (!ticket_decrypted) {
/* The session was from the cache, so remove it. */
SSL_CTX_remove_session(s->session_ctx, sess);
goto err;
}
- s->session_ctx->internal->stats.sess_hit++;
+ s->session_ctx->stats.sess_hit++;
SSL_SESSION_free(s->session);
s->session = sess;
* The session was from a ticket. Issue a ticket for the new
* session.
*/
- s->internal->tlsext_ticket_expected = 1;
+ s->tlsext_ticket_expected = 1;
}
if (fatal) {
*alert = alert_desc;
* later.
*/
CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
- s = lh_SSL_SESSION_insert(ctx->internal->sessions, c);
+ s = lh_SSL_SESSION_insert(ctx->sessions, c);
/*
* s != NULL iff we already had a session with the given PID.
* In this case, s == c should hold (then we did not really modify
- * ctx->internal->sessions), or we're in trouble.
+ * ctx->sessions), or we're in trouble.
*/
if (s != NULL && s != c) {
/* We *are* in trouble ... */
while (SSL_CTX_sess_number(ctx) >
SSL_CTX_sess_get_cache_size(ctx)) {
if (!remove_session_lock(ctx,
- ctx->internal->session_cache_tail, 0))
+ ctx->session_cache_tail, 0))
break;
else
- ctx->internal->stats.sess_cache_full++;
+ ctx->stats.sess_cache_full++;
}
}
}
if (lck)
CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
- if ((r = lh_SSL_SESSION_retrieve(ctx->internal->sessions, c)) == c) {
+ if ((r = lh_SSL_SESSION_retrieve(ctx->sessions, c)) == c) {
ret = 1;
- r = lh_SSL_SESSION_delete(ctx->internal->sessions, c);
+ r = lh_SSL_SESSION_delete(ctx->sessions, c);
SSL_SESSION_list_remove(ctx, c);
}
if (lck)
if (ret) {
r->not_resumable = 1;
- if (ctx->internal->remove_session_cb != NULL)
- ctx->internal->remove_session_cb(ctx, r);
+ if (ctx->remove_session_cb != NULL)
+ ctx->remove_session_cb(ctx, r);
SSL_SESSION_free(r);
}
{
if (s == NULL)
return (0);
- s->internal->tls_session_secret_cb = tls_session_secret_cb;
- s->internal->tls_session_secret_cb_arg = arg;
+ s->tls_session_secret_cb = tls_session_secret_cb;
+ s->tls_session_secret_cb_arg = arg;
return (1);
}
{
if (s == NULL)
return (0);
- s->internal->tls_session_ticket_ext_cb = cb;
- s->internal->tls_session_ticket_ext_cb_arg = arg;
+ s->tls_session_ticket_ext_cb = cb;
+ s->tls_session_ticket_ext_cb_arg = arg;
return (1);
}
SSL_set_session_ticket_ext(SSL *s, void *ext_data, int ext_len)
{
if (s->version >= TLS1_VERSION) {
- free(s->internal->tlsext_session_ticket);
- s->internal->tlsext_session_ticket =
+ free(s->tlsext_session_ticket);
+ s->tlsext_session_ticket =
malloc(sizeof(TLS_SESSION_TICKET_EXT) + ext_len);
- if (!s->internal->tlsext_session_ticket) {
+ if (!s->tlsext_session_ticket) {
SSLerror(s, ERR_R_MALLOC_FAILURE);
return 0;
}
if (ext_data) {
- s->internal->tlsext_session_ticket->length = ext_len;
- s->internal->tlsext_session_ticket->data =
- s->internal->tlsext_session_ticket + 1;
- memcpy(s->internal->tlsext_session_ticket->data,
+ s->tlsext_session_ticket->length = ext_len;
+ s->tlsext_session_ticket->data =
+ s->tlsext_session_ticket + 1;
+ memcpy(s->tlsext_session_ticket->data,
ext_data, ext_len);
} else {
- s->internal->tlsext_session_ticket->length = 0;
- s->internal->tlsext_session_ticket->data = NULL;
+ s->tlsext_session_ticket->length = 0;
+ s->tlsext_session_ticket->data = NULL;
}
return 1;
(void)lh_SSL_SESSION_delete(p->cache, s);
SSL_SESSION_list_remove(p->ctx, s);
s->not_resumable = 1;
- if (p->ctx->internal->remove_session_cb != NULL)
- p->ctx->internal->remove_session_cb(p->ctx, s);
+ if (p->ctx->remove_session_cb != NULL)
+ p->ctx->remove_session_cb(p->ctx, s);
SSL_SESSION_free(s);
}
}
TIMEOUT_PARAM tp;
tp.ctx = s;
- tp.cache = s->internal->sessions;
+ tp.cache = s->sessions;
if (tp.cache == NULL)
return;
tp.time = t;
int
ssl_clear_bad_session(SSL *s)
{
- if ((s->session != NULL) && !(s->internal->shutdown & SSL_SENT_SHUTDOWN) &&
+ if ((s->session != NULL) && !(s->shutdown & SSL_SENT_SHUTDOWN) &&
!(SSL_in_init(s) || SSL_in_before(s))) {
SSL_CTX_remove_session(s->ctx, s->session);
return (1);
if (s->next == NULL || s->prev == NULL)
return;
- if (s->next == (SSL_SESSION *)&(ctx->internal->session_cache_tail)) {
+ if (s->next == (SSL_SESSION *)&(ctx->session_cache_tail)) {
/* last element in list */
- if (s->prev == (SSL_SESSION *)&(ctx->internal->session_cache_head)) {
+ if (s->prev == (SSL_SESSION *)&(ctx->session_cache_head)) {
/* only one element in list */
- ctx->internal->session_cache_head = NULL;
- ctx->internal->session_cache_tail = NULL;
+ ctx->session_cache_head = NULL;
+ ctx->session_cache_tail = NULL;
} else {
- ctx->internal->session_cache_tail = s->prev;
+ ctx->session_cache_tail = s->prev;
s->prev->next =
- (SSL_SESSION *)&(ctx->internal->session_cache_tail);
+ (SSL_SESSION *)&(ctx->session_cache_tail);
}
} else {
- if (s->prev == (SSL_SESSION *)&(ctx->internal->session_cache_head)) {
+ if (s->prev == (SSL_SESSION *)&(ctx->session_cache_head)) {
/* first element in list */
- ctx->internal->session_cache_head = s->next;
+ ctx->session_cache_head = s->next;
s->next->prev =
- (SSL_SESSION *)&(ctx->internal->session_cache_head);
+ (SSL_SESSION *)&(ctx->session_cache_head);
} else {
/* middle of list */
s->next->prev = s->prev;
if (s->next != NULL && s->prev != NULL)
SSL_SESSION_list_remove(ctx, s);
- if (ctx->internal->session_cache_head == NULL) {
- ctx->internal->session_cache_head = s;
- ctx->internal->session_cache_tail = s;
- s->prev = (SSL_SESSION *)&(ctx->internal->session_cache_head);
- s->next = (SSL_SESSION *)&(ctx->internal->session_cache_tail);
+ if (ctx->session_cache_head == NULL) {
+ ctx->session_cache_head = s;
+ ctx->session_cache_tail = s;
+ s->prev = (SSL_SESSION *)&(ctx->session_cache_head);
+ s->next = (SSL_SESSION *)&(ctx->session_cache_tail);
} else {
- s->next = ctx->internal->session_cache_head;
+ s->next = ctx->session_cache_head;
s->next->prev = s;
- s->prev = (SSL_SESSION *)&(ctx->internal->session_cache_head);
- ctx->internal->session_cache_head = s;
+ s->prev = (SSL_SESSION *)&(ctx->session_cache_head);
+ ctx->session_cache_head = s;
}
}
void
SSL_CTX_sess_set_new_cb(SSL_CTX *ctx,
int (*cb)(struct ssl_st *ssl, SSL_SESSION *sess)) {
- ctx->internal->new_session_cb = cb;
+ ctx->new_session_cb = cb;
}
int
(*SSL_CTX_sess_get_new_cb(SSL_CTX *ctx))(SSL *ssl, SSL_SESSION *sess)
{
- return ctx->internal->new_session_cb;
+ return ctx->new_session_cb;
}
void
SSL_CTX_sess_set_remove_cb(SSL_CTX *ctx,
void (*cb)(SSL_CTX *ctx, SSL_SESSION *sess))
{
- ctx->internal->remove_session_cb = cb;
+ ctx->remove_session_cb = cb;
}
void
(*SSL_CTX_sess_get_remove_cb(SSL_CTX *ctx))(SSL_CTX * ctx, SSL_SESSION *sess)
{
- return ctx->internal->remove_session_cb;
+ return ctx->remove_session_cb;
}
void
SSL_CTX_sess_set_get_cb(SSL_CTX *ctx, SSL_SESSION *(*cb)(struct ssl_st *ssl,
const unsigned char *data, int len, int *copy))
{
- ctx->internal->get_session_cb = cb;
+ ctx->get_session_cb = cb;
}
SSL_SESSION *
(*SSL_CTX_sess_get_get_cb(SSL_CTX *ctx))(SSL *ssl, const unsigned char *data,
int len, int *copy)
{
- return ctx->internal->get_session_cb;
+ return ctx->get_session_cb;
}
void
SSL_CTX_set_info_callback(SSL_CTX *ctx,
void (*cb)(const SSL *ssl, int type, int val))
{
- ctx->internal->info_callback = cb;
+ ctx->info_callback = cb;
}
void
(*SSL_CTX_get_info_callback(SSL_CTX *ctx))(const SSL *ssl, int type, int val)
{
- return ctx->internal->info_callback;
+ return ctx->info_callback;
}
void
SSL_CTX_set_client_cert_cb(SSL_CTX *ctx,
int (*cb)(SSL *ssl, X509 **x509, EVP_PKEY **pkey))
{
- ctx->internal->client_cert_cb = cb;
+ ctx->client_cert_cb = cb;
}
int
(*SSL_CTX_get_client_cert_cb(SSL_CTX *ctx))(SSL * ssl, X509 ** x509,
EVP_PKEY **pkey)
{
- return ctx->internal->client_cert_cb;
+ return ctx->client_cert_cb;
}
#ifndef OPENSSL_NO_ENGINE
ENGINE_finish(e);
return 0;
}
- ctx->internal->client_cert_engine = e;
+ ctx->client_cert_engine = e;
return 1;
}
#endif
SSL_CTX_set_cookie_generate_cb(SSL_CTX *ctx,
int (*cb)(SSL *ssl, unsigned char *cookie, unsigned int *cookie_len))
{
- ctx->internal->app_gen_cookie_cb = cb;
+ ctx->app_gen_cookie_cb = cb;
}
void
SSL_CTX_set_cookie_verify_cb(SSL_CTX *ctx,
int (*cb)(SSL *ssl, const unsigned char *cookie, unsigned int cookie_len))
{
- ctx->internal->app_verify_cookie_cb = cb;
+ ctx->app_verify_cookie_cb = cb;
}
int
-/* $OpenBSD: ssl_srvr.c,v 1.150 2022/10/01 16:23:15 jsing Exp $ */
+/* $OpenBSD: ssl_srvr.c,v 1.151 2022/10/02 16:36:41 jsing Exp $ */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
* All rights reserved.
*
listen = s->d1->listen;
/* init things to blank */
- s->internal->in_handshake++;
+ s->in_handshake++;
if (!SSL_in_init(s) || SSL_in_before(s))
SSL_clear(s);
switch (s->s3->hs.state) {
case SSL_ST_RENEGOTIATE:
- s->internal->renegotiate = 1;
+ s->renegotiate = 1;
/* s->s3->hs.state=SSL_ST_ACCEPT; */
case SSL_ST_BEFORE:
goto end;
}
- s->internal->init_num = 0;
+ s->init_num = 0;
if (s->s3->hs.state != SSL_ST_RENEGOTIATE) {
/*
}
s->s3->hs.state = SSL3_ST_SR_CLNT_HELLO_A;
- s->ctx->internal->stats.sess_accept++;
+ s->ctx->stats.sess_accept++;
} else if (!SSL_is_dtls(s) && !s->s3->send_connection_binding) {
/*
* Server attempting to renegotiate with
* s->s3->hs.state == SSL_ST_RENEGOTIATE,
* we will just send a HelloRequest.
*/
- s->ctx->internal->stats.sess_accept_renegotiate++;
+ s->ctx->stats.sess_accept_renegotiate++;
s->s3->hs.state = SSL3_ST_SW_HELLO_REQ_A;
}
break;
case SSL3_ST_SW_HELLO_REQ_A:
case SSL3_ST_SW_HELLO_REQ_B:
- s->internal->shutdown = 0;
+ s->shutdown = 0;
if (SSL_is_dtls(s)) {
dtls1_clear_record_buffer(s);
dtls1_start_timer(s);
else
s->s3->hs.tls12.next_state = SSL3_ST_SW_HELLO_REQ_C;
s->s3->hs.state = SSL3_ST_SW_FLUSH;
- s->internal->init_num = 0;
+ s->init_num = 0;
if (SSL_is_dtls(s)) {
if (!tls1_transcript_init(s)) {
case SSL3_ST_SR_CLNT_HELLO_A:
case SSL3_ST_SR_CLNT_HELLO_B:
case SSL3_ST_SR_CLNT_HELLO_C:
- s->internal->shutdown = 0;
+ s->shutdown = 0;
if (SSL_is_dtls(s)) {
ret = ssl3_get_client_hello(s);
if (ret <= 0)
else
s->s3->hs.state = SSL3_ST_SW_SRVR_HELLO_A;
- s->internal->init_num = 0;
+ s->init_num = 0;
/*
* Reflect ClientHello sequence to remain
*/
if (listen) {
tls12_record_layer_reflect_seq_num(
- s->internal->rl);
+ s->rl);
}
/* If we're just listening, stop here */
goto end;
}
} else {
- if (s->internal->rwstate != SSL_X509_LOOKUP) {
+ if (s->rwstate != SSL_X509_LOOKUP) {
ret = ssl3_get_client_hello(s);
if (ret <= 0)
goto end;
}
- s->internal->renegotiate = 2;
+ s->renegotiate = 2;
s->s3->hs.state = SSL3_ST_SW_SRVR_HELLO_A;
- s->internal->init_num = 0;
+ s->init_num = 0;
}
break;
case SSL3_ST_SW_SRVR_HELLO_A:
case SSL3_ST_SW_SRVR_HELLO_B:
if (SSL_is_dtls(s)) {
- s->internal->renegotiate = 2;
+ s->renegotiate = 2;
dtls1_start_timer(s);
}
ret = ssl3_send_server_hello(s);
if (ret <= 0)
goto end;
- if (s->internal->hit) {
- if (s->internal->tlsext_ticket_expected)
+ if (s->hit) {
+ if (s->tlsext_ticket_expected)
s->s3->hs.state = SSL3_ST_SW_SESSION_TICKET_A;
else
s->s3->hs.state = SSL3_ST_SW_CHANGE_A;
} else {
s->s3->hs.state = SSL3_ST_SW_CERT_A;
}
- s->internal->init_num = 0;
+ s->init_num = 0;
break;
case SSL3_ST_SW_CERT_A:
ret = ssl3_send_server_certificate(s);
if (ret <= 0)
goto end;
- if (s->internal->tlsext_status_expected)
+ if (s->tlsext_status_expected)
s->s3->hs.state = SSL3_ST_SW_CERT_STATUS_A;
else
s->s3->hs.state = SSL3_ST_SW_KEY_EXCH_A;
skip = 1;
s->s3->hs.state = SSL3_ST_SW_KEY_EXCH_A;
}
- s->internal->init_num = 0;
+ s->init_num = 0;
break;
case SSL3_ST_SW_KEY_EXCH_A:
skip = 1;
s->s3->hs.state = SSL3_ST_SW_CERT_REQ_A;
- s->internal->init_num = 0;
+ s->init_num = 0;
break;
case SSL3_ST_SW_CERT_REQ_A:
if (ret <= 0)
goto end;
s->s3->hs.state = SSL3_ST_SW_SRVR_DONE_A;
- s->internal->init_num = 0;
+ s->init_num = 0;
}
break;
goto end;
s->s3->hs.tls12.next_state = SSL3_ST_SR_CERT_A;
s->s3->hs.state = SSL3_ST_SW_FLUSH;
- s->internal->init_num = 0;
+ s->init_num = 0;
break;
case SSL3_ST_SW_FLUSH:
* still exist. So instead we just flush
* unconditionally.
*/
- s->internal->rwstate = SSL_WRITING;
+ s->rwstate = SSL_WRITING;
if (BIO_flush(s->wbio) <= 0) {
if (SSL_is_dtls(s)) {
/* If the write error was fatal, stop trying. */
if (!BIO_should_retry(s->wbio)) {
- s->internal->rwstate = SSL_NOTHING;
+ s->rwstate = SSL_NOTHING;
s->s3->hs.state = s->s3->hs.tls12.next_state;
}
}
ret = -1;
goto end;
}
- s->internal->rwstate = SSL_NOTHING;
+ s->rwstate = SSL_NOTHING;
s->s3->hs.state = s->s3->hs.tls12.next_state;
break;
if (ret <= 0)
goto end;
}
- s->internal->init_num = 0;
+ s->init_num = 0;
s->s3->hs.state = SSL3_ST_SR_KEY_EXCH_A;
break;
if (SSL_is_dtls(s)) {
s->s3->hs.state = SSL3_ST_SR_CERT_VRFY_A;
- s->internal->init_num = 0;
+ s->init_num = 0;
}
alg_k = s->s3->hs.cipher->algorithm_mkey;
* the CertificateVerify message is not sent.
*/
s->s3->hs.state = SSL3_ST_SR_FINISHED_A;
- s->internal->init_num = 0;
+ s->init_num = 0;
} else if (SSL_USE_SIGALGS(s) || (alg_k & SSL_kGOST)) {
s->s3->hs.state = SSL3_ST_SR_CERT_VRFY_A;
- s->internal->init_num = 0;
+ s->init_num = 0;
if (!s->session->peer_cert)
break;
/*
tls1_transcript_freeze(s);
} else {
s->s3->hs.state = SSL3_ST_SR_CERT_VRFY_A;
- s->internal->init_num = 0;
+ s->init_num = 0;
tls1_transcript_free(s);
if (ret <= 0)
goto end;
s->s3->hs.state = SSL3_ST_SR_FINISHED_A;
- s->internal->init_num = 0;
+ s->init_num = 0;
break;
case SSL3_ST_SR_FINISHED_A:
goto end;
if (SSL_is_dtls(s))
dtls1_stop_timer(s);
- if (s->internal->hit)
+ if (s->hit)
s->s3->hs.state = SSL_ST_OK;
- else if (s->internal->tlsext_ticket_expected)
+ else if (s->tlsext_ticket_expected)
s->s3->hs.state = SSL3_ST_SW_SESSION_TICKET_A;
else
s->s3->hs.state = SSL3_ST_SW_CHANGE_A;
- s->internal->init_num = 0;
+ s->init_num = 0;
break;
case SSL3_ST_SW_SESSION_TICKET_A:
if (ret <= 0)
goto end;
s->s3->hs.state = SSL3_ST_SW_CHANGE_A;
- s->internal->init_num = 0;
+ s->init_num = 0;
break;
case SSL3_ST_SW_CERT_STATUS_A:
if (ret <= 0)
goto end;
s->s3->hs.state = SSL3_ST_SW_KEY_EXCH_A;
- s->internal->init_num = 0;
+ s->init_num = 0;
break;
case SSL3_ST_SW_CHANGE_A:
if (ret <= 0)
goto end;
s->s3->hs.state = SSL3_ST_SW_FINISHED_A;
- s->internal->init_num = 0;
+ s->init_num = 0;
s->session->cipher = s->s3->hs.cipher;
if (!tls1_setup_key_block(s)) {
if (ret <= 0)
goto end;
s->s3->hs.state = SSL3_ST_SW_FLUSH;
- if (s->internal->hit) {
+ if (s->hit) {
s->s3->hs.tls12.next_state = SSL3_ST_SR_FINISHED_A;
tls1_transcript_free(s);
} else
s->s3->hs.tls12.next_state = SSL_ST_OK;
- s->internal->init_num = 0;
+ s->init_num = 0;
break;
case SSL_ST_OK:
/* remove buffering on output */
ssl_free_wbio_buffer(s);
- s->internal->init_num = 0;
+ s->init_num = 0;
/* Skipped if we just sent a HelloRequest. */
- if (s->internal->renegotiate == 2) {
- s->internal->renegotiate = 0;
- s->internal->new_session = 0;
+ if (s->renegotiate == 2) {
+ s->renegotiate = 0;
+ s->new_session = 0;
ssl_update_cache(s, SSL_SESS_CACHE_SERVER);
- s->ctx->internal->stats.sess_accept_good++;
+ s->ctx->stats.sess_accept_good++;
/* s->server=1; */
- s->internal->handshake_func = ssl3_accept;
+ s->handshake_func = ssl3_accept;
ssl_info_callback(s, SSL_CB_HANDSHAKE_DONE, 1);
}
}
if (!s->s3->hs.tls12.reuse_message && !skip) {
- if (s->internal->debug) {
+ if (s->debug) {
if ((ret = BIO_flush(s->wbio)) <= 0)
goto end;
}
}
end:
/* BIO_flush(s->wbio); */
- s->internal->in_handshake--;
+ s->in_handshake--;
ssl_info_callback(s, SSL_CB_ACCEPT_EXIT, ret);
return (ret);
if (s->s3->hs.state == SSL3_ST_SR_CLNT_HELLO_A)
s->s3->hs.state = SSL3_ST_SR_CLNT_HELLO_B;
- s->internal->first_packet = 1;
+ s->first_packet = 1;
if ((ret = ssl3_get_message(s, SSL3_ST_SR_CLNT_HELLO_B,
SSL3_ST_SR_CLNT_HELLO_C, SSL3_MT_CLIENT_HELLO,
SSL3_RT_MAX_PLAIN_LENGTH)) <= 0)
return ret;
- s->internal->first_packet = 0;
+ s->first_packet = 0;
ret = -1;
- if (s->internal->init_num < 0)
+ if (s->init_num < 0)
goto err;
- CBS_init(&cbs, s->internal->init_msg, s->internal->init_num);
+ CBS_init(&cbs, s->init_msg, s->init_num);
/* Parse client hello up until the extensions (if any). */
if (!CBS_get_u16(&cbs, &client_version))
*/
if (!ssl_max_shared_version(s, client_version, &shared_version)) {
if ((client_version >> 8) == SSL3_VERSION_MAJOR &&
- !tls12_record_layer_write_protected(s->internal->rl)) {
+ !tls12_record_layer_write_protected(s->rl)) {
/*
* Similar to ssl3_get_record, send alert using remote
* version number.
sizeof(s->s3->client_random), NULL))
goto err;
- s->internal->hit = 0;
+ s->hit = 0;
/*
* Versions before 0.9.7 always allow clients to resume sessions in
* library versions).
*
* 1.0.1 and later also have a function SSL_renegotiate_abbreviated()
- * to request renegotiation but not a new session (s->internal->new_session
+ * to request renegotiation but not a new session (s->new_session
* remains unset): for servers, this essentially just means that the
* SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION setting will be
* ignored.
*/
- if ((s->internal->new_session && (s->internal->options &
+ if ((s->new_session && (s->options &
SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION))) {
if (!ssl_get_new_session(s, 1))
goto err;
i = ssl_get_prev_session(s, &session_id, &ext_block, &al);
if (i == 1) { /* previous session */
- s->internal->hit = 1;
+ s->hit = 1;
} else if (i == -1)
goto fatal_err;
else {
sizeof(s->d1->rcvd_cookie), &cookie_len))
goto err;
- if (s->ctx->internal->app_verify_cookie_cb != NULL) {
- if (s->ctx->internal->app_verify_cookie_cb(s,
+ if (s->ctx->app_verify_cookie_cb != NULL) {
+ if (s->ctx->app_verify_cookie_cb(s,
s->d1->rcvd_cookie, cookie_len) == 0) {
al = SSL_AD_HANDSHAKE_FAILURE;
SSLerror(s, SSL_R_COOKIE_MISMATCH);
/* If it is a hit, check that the cipher is in the list */
/* XXX - CBS_len(&cipher_suites) will always be zero here... */
- if (s->internal->hit && CBS_len(&cipher_suites) > 0) {
+ if (s->hit && CBS_len(&cipher_suites) > 0) {
j = 0;
id = s->session->cipher->id;
if (CBS_len(&cbs) != 0)
goto decode_err;
- if (!s->s3->renegotiate_seen && s->internal->renegotiate) {
+ if (!s->s3->renegotiate_seen && s->renegotiate) {
al = SSL_AD_HANDSHAKE_FAILURE;
SSLerror(s, SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
goto fatal_err;
}
}
- if (!s->internal->hit && s->internal->tls_session_secret_cb != NULL) {
+ if (!s->hit && s->tls_session_secret_cb != NULL) {
SSL_CIPHER *pref_cipher = NULL;
int master_key_length = sizeof(s->session->master_key);
- if (!s->internal->tls_session_secret_cb(s,
+ if (!s->tls_session_secret_cb(s,
s->session->master_key, &master_key_length, ciphers,
- &pref_cipher, s->internal->tls_session_secret_cb_arg)) {
+ &pref_cipher, s->tls_session_secret_cb_arg)) {
SSLerror(s, ERR_R_INTERNAL_ERROR);
goto err;
}
}
s->session->master_key_length = master_key_length;
- s->internal->hit = 1;
+ s->hit = 1;
s->session->verify_result = X509_V_OK;
sk_SSL_CIPHER_free(s->session->ciphers);
* pick a cipher
*/
- if (!s->internal->hit) {
+ if (!s->hit) {
if (ciphers == NULL) {
al = SSL_AD_ILLEGAL_PARAMETER;
SSLerror(s, SSL_R_NO_CIPHERS_PASSED);
* compression - basically ignored right now
* ssl version is set - sslv3
* s->session - The ssl session has been setup.
- * s->internal->hit - session reuse flag
+ * s->hit - session reuse flag
* s->hs.cipher - the new cipher to use.
*/
memset(&cbb, 0, sizeof(cbb));
if (s->s3->hs.state == DTLS1_ST_SW_HELLO_VERIFY_REQUEST_A) {
- if (s->ctx->internal->app_gen_cookie_cb == NULL ||
- s->ctx->internal->app_gen_cookie_cb(s, s->d1->cookie,
+ if (s->ctx->app_gen_cookie_cb == NULL ||
+ s->ctx->app_gen_cookie_cb(s, s->d1->cookie,
&(s->d1->cookie_len)) == 0) {
SSLerror(s, ERR_R_INTERNAL_ERROR);
return 0;
* - However, if we want the new session to be single-use,
* we send back a 0-length session ID.
*
- * s->internal->hit is non-zero in either case of session reuse,
+ * s->hit is non-zero in either case of session reuse,
* so the following won't overwrite an ID that we're supposed
* to send back.
*/
- if (!(s->ctx->internal->session_cache_mode & SSL_SESS_CACHE_SERVER)
- && !s->internal->hit)
+ if (!(s->ctx->session_cache_mode & SSL_SESS_CACHE_SERVER)
+ && !s->hit)
s->session->session_id_length = 0;
sl = s->session->session_id_length;
SSL3_ST_SR_KEY_EXCH_B, SSL3_MT_CLIENT_KEY_EXCHANGE, 2048)) <= 0)
return ret;
- if (s->internal->init_num < 0)
+ if (s->init_num < 0)
goto err;
- CBS_init(&cbs, s->internal->init_msg, s->internal->init_num);
+ CBS_init(&cbs, s->init_msg, s->init_num);
alg_k = s->s3->hs.cipher->algorithm_mkey;
ret = 0;
- if (s->internal->init_num < 0)
+ if (s->init_num < 0)
goto err;
if ((mctx = EVP_MD_CTX_new()) == NULL)
goto err;
- CBS_init(&cbs, s->internal->init_msg, s->internal->init_num);
+ CBS_init(&cbs, s->init_msg, s->init_num);
peer_cert = s->session->peer_cert;
pkey = X509_get0_pubkey(peer_cert);
int al, ret;
if ((ret = ssl3_get_message(s, SSL3_ST_SR_CERT_A, SSL3_ST_SR_CERT_B,
- -1, s->internal->max_cert_list)) <= 0)
+ -1, s->max_cert_list)) <= 0)
return ret;
ret = -1;
goto fatal_err;
}
- if (s->internal->init_num < 0)
+ if (s->init_num < 0)
goto decode_err;
- CBS_init(&cbs, s->internal->init_msg, s->internal->init_num);
+ CBS_init(&cbs, s->init_msg, s->init_num);
if (!CBS_get_u24_length_prefixed(&cbs, &cert_list))
goto decode_err;
* it does all the work, otherwise use generated values from
* parent context.
*/
- if (tctx->internal->tlsext_ticket_key_cb != NULL) {
- if (tctx->internal->tlsext_ticket_key_cb(s,
+ if (tctx->tlsext_ticket_key_cb != NULL) {
+ if (tctx->tlsext_ticket_key_cb(s,
key_name, iv, ctx, hctx, 1) < 0)
goto err;
} else {
arc4random_buf(iv, 16);
EVP_EncryptInit_ex(ctx, EVP_aes_128_cbc(), NULL,
- tctx->internal->tlsext_tick_aes_key, iv);
- HMAC_Init_ex(hctx, tctx->internal->tlsext_tick_hmac_key,
+ tctx->tlsext_tick_aes_key, iv);
+ HMAC_Init_ex(hctx, tctx->tlsext_tick_hmac_key,
16, EVP_sha256(), NULL);
- memcpy(key_name, tctx->internal->tlsext_tick_key_name, 16);
+ memcpy(key_name, tctx->tlsext_tick_key_name, 16);
}
/* Encrypt the session state. */
* sessions will live as long as their sessions.
*/
if (!CBB_add_u32(&session_ticket,
- s->internal->hit ? 0 : s->session->timeout))
+ s->hit ? 0 : s->session->timeout))
goto err;
if (!CBB_add_u16_length_prefixed(&session_ticket, &ticket))
goto err;
if (!CBB_add_u24_length_prefixed(&certstatus, &ocspresp))
goto err;
- if (!CBB_add_bytes(&ocspresp, s->internal->tlsext_ocsp_resp,
- s->internal->tlsext_ocsp_resp_len))
+ if (!CBB_add_bytes(&ocspresp, s->tlsext_ocsp_resp,
+ s->tlsext_ocsp_resp_len))
goto err;
if (!ssl3_handshake_msg_finish(s, &cbb))
goto err;
memset(&cbb, 0, sizeof(cbb));
if (s->s3->hs.state == SSL3_ST_SW_CHANGE_A) {
- if (!CBB_init_fixed(&cbb, s->internal->init_buf->data,
- s->internal->init_buf->length))
+ if (!CBB_init_fixed(&cbb, s->init_buf->data,
+ s->init_buf->length))
goto err;
if (!CBB_add_u8(&cbb, SSL3_MT_CCS))
goto err;
if (outlen > INT_MAX)
goto err;
- s->internal->init_num = (int)outlen;
- s->internal->init_off = 0;
+ s->init_num = (int)outlen;
+ s->init_off = 0;
if (SSL_is_dtls(s)) {
s->d1->handshake_write_seq =
md_len = TLS1_FINISH_MAC_LENGTH;
- if (s->internal->init_num < 0) {
+ if (s->init_num < 0) {
al = SSL_AD_DECODE_ERROR;
SSLerror(s, SSL_R_BAD_DIGEST_LENGTH);
goto fatal_err;
}
- CBS_init(&cbs, s->internal->init_msg, s->internal->init_num);
+ CBS_init(&cbs, s->init_msg, s->init_num);
if (s->s3->hs.peer_finished_len != md_len ||
CBS_len(&cbs) != md_len) {
-/* $OpenBSD: ssl_stat.c,v 1.18 2022/02/05 14:54:10 jsing Exp $ */
+/* $OpenBSD: ssl_stat.c,v 1.19 2022/10/02 16:36:41 jsing Exp $ */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
* All rights reserved.
*
{
const char *str;
- switch (s->internal->rstate) {
+ switch (s->rstate) {
case SSL_ST_READ_HEADER:
str = "read header";
break;
{
const char *str;
- switch (s->internal->rstate) {
+ switch (s->rstate) {
case SSL_ST_READ_HEADER:
str = "RH";
break;
-/* $OpenBSD: ssl_tlsext.c,v 1.129 2022/08/15 10:46:53 tb Exp $ */
+/* $OpenBSD: ssl_tlsext.c,v 1.130 2022/10/02 16:36:41 jsing Exp $ */
/*
* Copyright (c) 2016, 2017, 2019 Joel Sing <jsing@openbsd.org>
* Copyright (c) 2017 Doug Hogan <doug@openbsd.org>
tlsext_alpn_client_needs(SSL *s, uint16_t msg_type)
{
/* ALPN protos have been specified and this is the initial handshake */
- return s->internal->alpn_client_proto_list != NULL &&
+ return s->alpn_client_proto_list != NULL &&
s->s3->hs.finished_len == 0;
}
if (!CBB_add_u16_length_prefixed(cbb, &protolist))
return 0;
- if (!CBB_add_bytes(&protolist, s->internal->alpn_client_proto_list,
- s->internal->alpn_client_proto_list_len))
+ if (!CBB_add_bytes(&protolist, s->alpn_client_proto_list,
+ s->alpn_client_proto_list_len))
return 0;
if (!CBB_flush(cbb))
if (!tlsext_alpn_check_format(&alpn))
return 0;
- if (s->ctx->internal->alpn_select_cb == NULL)
+ if (s->ctx->alpn_select_cb == NULL)
return 1;
/*
* 2. Should the callback be called even if no ALPN extension was sent?
* 3. TLSv1.2 and earlier: ensure that SNI has already been processed.
*/
- r = s->ctx->internal->alpn_select_cb(s, &selected, &selected_len,
+ r = s->ctx->alpn_select_cb(s, &selected, &selected_len,
CBS_data(&alpn), CBS_len(&alpn),
- s->ctx->internal->alpn_select_cb_arg);
+ s->ctx->alpn_select_cb_arg);
if (r == SSL_TLSEXT_ERR_OK) {
CBS_init(&selected_cbs, selected, selected_len);
{
CBS list, proto;
- if (s->internal->alpn_client_proto_list == NULL) {
+ if (s->alpn_client_proto_list == NULL) {
*alert = SSL_AD_UNSUPPORTED_EXTENSION;
return 0;
}
return 0;
groups_len /= 2;
- if (s->internal->hit)
+ if (s->hit)
return 1;
if (s->s3->hs.tls13.hrr) {
return 0;
}
- if (!s->internal->hit) {
+ if (!s->hit) {
if (!CBS_stow(&ecpf, &(s->session->tlsext_ecpointformatlist),
&(s->session->tlsext_ecpointformatlist_length))) {
*alert = SSL_AD_INTERNAL_ERROR;
static int
tlsext_ri_client_needs(SSL *s, uint16_t msg_type)
{
- return (s->internal->renegotiate);
+ return (s->renegotiate);
}
static int
goto err;
}
- if (s->internal->hit || s->s3->hs.tls13.hrr) {
+ if (s->hit || s->s3->hs.tls13.hrr) {
if (s->session->tlsext_hostname == NULL) {
*alert = SSL_AD_UNRECOGNIZED_NAME;
goto err;
static int
tlsext_sni_server_needs(SSL *s, uint16_t msg_type)
{
- if (s->internal->hit)
+ if (s->hit)
return 0;
return (s->session->tlsext_hostname != NULL);
return 0;
}
- if (s->internal->hit) {
+ if (s->hit) {
if (s->session->tlsext_hostname == NULL) {
*alert = SSL_AD_UNRECOGNIZED_NAME;
return 0;
return 0;
if (!CBB_add_u16_length_prefixed(cbb, &respid_list))
return 0;
- for (i = 0; i < sk_OCSP_RESPID_num(s->internal->tlsext_ocsp_ids); i++) {
+ for (i = 0; i < sk_OCSP_RESPID_num(s->tlsext_ocsp_ids); i++) {
unsigned char *respid_data;
OCSP_RESPID *id;
size_t id_len;
- if ((id = sk_OCSP_RESPID_value(s->internal->tlsext_ocsp_ids,
+ if ((id = sk_OCSP_RESPID_value(s->tlsext_ocsp_ids,
i)) == NULL)
return 0;
if ((id_len = i2d_OCSP_RESPID(id, NULL)) == -1)
}
if (!CBB_add_u16_length_prefixed(cbb, &exts))
return 0;
- if ((ext_len = i2d_X509_EXTENSIONS(s->internal->tlsext_ocsp_exts,
+ if ((ext_len = i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts,
NULL)) == -1)
return 0;
if (!CBB_add_space(&exts, &ext_data, ext_len))
return 0;
- if ((i2d_X509_EXTENSIONS(s->internal->tlsext_ocsp_exts, &ext_data) !=
+ if ((i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ext_data) !=
ext_len))
return 0;
if (!CBB_flush(cbb))
goto err;
/* XXX */
- sk_OCSP_RESPID_pop_free(s->internal->tlsext_ocsp_ids, OCSP_RESPID_free);
- s->internal->tlsext_ocsp_ids = NULL;
+ sk_OCSP_RESPID_pop_free(s->tlsext_ocsp_ids, OCSP_RESPID_free);
+ s->tlsext_ocsp_ids = NULL;
if (CBS_len(&respid_list) > 0) {
- s->internal->tlsext_ocsp_ids = sk_OCSP_RESPID_new_null();
- if (s->internal->tlsext_ocsp_ids == NULL) {
+ s->tlsext_ocsp_ids = sk_OCSP_RESPID_new_null();
+ if (s->tlsext_ocsp_ids == NULL) {
alert_desc = SSL_AD_INTERNAL_ERROR;
goto err;
}
p = CBS_data(&respid);
if ((id = d2i_OCSP_RESPID(NULL, &p, CBS_len(&respid))) == NULL)
goto err;
- if (!sk_OCSP_RESPID_push(s->internal->tlsext_ocsp_ids, id)) {
+ if (!sk_OCSP_RESPID_push(s->tlsext_ocsp_ids, id)) {
alert_desc = SSL_AD_INTERNAL_ERROR;
OCSP_RESPID_free(id);
goto err;
if (!CBS_get_u16_length_prefixed(cbs, &exts))
goto err;
if (CBS_len(&exts) > 0) {
- sk_X509_EXTENSION_pop_free(s->internal->tlsext_ocsp_exts,
+ sk_X509_EXTENSION_pop_free(s->tlsext_ocsp_exts,
X509_EXTENSION_free);
p = CBS_data(&exts);
- if ((s->internal->tlsext_ocsp_exts = d2i_X509_EXTENSIONS(NULL,
+ if ((s->tlsext_ocsp_exts = d2i_X509_EXTENSIONS(NULL,
&p, CBS_len(&exts))) == NULL)
goto err;
}
{
if (s->s3->hs.negotiated_tls_version >= TLS1_3_VERSION &&
s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp &&
- s->ctx->internal->tlsext_status_cb != NULL) {
- s->internal->tlsext_status_expected = 0;
- if (s->ctx->internal->tlsext_status_cb(s,
- s->ctx->internal->tlsext_status_arg) == SSL_TLSEXT_ERR_OK &&
- s->internal->tlsext_ocsp_resp_len > 0)
- s->internal->tlsext_status_expected = 1;
+ s->ctx->tlsext_status_cb != NULL) {
+ s->tlsext_status_expected = 0;
+ if (s->ctx->tlsext_status_cb(s,
+ s->ctx->tlsext_status_arg) == SSL_TLSEXT_ERR_OK &&
+ s->tlsext_ocsp_resp_len > 0)
+ s->tlsext_status_expected = 1;
}
- return s->internal->tlsext_status_expected;
+ return s->tlsext_status_expected;
}
static int
if (!CBB_add_u24_length_prefixed(cbb, &ocsp_response))
return 0;
if (!CBB_add_bytes(&ocsp_response,
- s->internal->tlsext_ocsp_resp,
- s->internal->tlsext_ocsp_resp_len))
+ s->tlsext_ocsp_resp,
+ s->tlsext_ocsp_resp_len))
return 0;
if (!CBB_flush(cbb))
return 0;
SSLerror(s, SSL_R_DATA_LENGTH_TOO_LONG);
return 0;
}
- if (!CBS_stow(&response, &s->internal->tlsext_ocsp_resp,
- &s->internal->tlsext_ocsp_resp_len)) {
+ if (!CBS_stow(&response, &s->tlsext_ocsp_resp,
+ &s->tlsext_ocsp_resp_len)) {
*alert = SSL_AD_INTERNAL_ERROR;
return 0;
}
return 0;
}
/* Set flag to expect CertificateStatus message */
- s->internal->tlsext_status_expected = 1;
+ s->tlsext_status_expected = 1;
}
return 1;
}
if (!ssl_security_tickets(s))
return 0;
- if (s->internal->new_session)
+ if (s->new_session)
return 1;
- if (s->internal->tlsext_session_ticket != NULL &&
- s->internal->tlsext_session_ticket->data == NULL)
+ if (s->tlsext_session_ticket != NULL &&
+ s->tlsext_session_ticket->data == NULL)
return 0;
return 1;
* Signal that we support session tickets by sending an empty
* extension when renegotiating or no session found.
*/
- if (s->internal->new_session || s->session == NULL)
+ if (s->new_session || s->session == NULL)
return 1;
if (s->session->tlsext_tick != NULL) {
s->session->tlsext_ticklen))
return 0;
- } else if (s->internal->tlsext_session_ticket != NULL) {
+ } else if (s->tlsext_session_ticket != NULL) {
/*
* Attempt to resume with a custom provided session ticket set
* by SSL_set_session_ticket_ext().
*/
- if (s->internal->tlsext_session_ticket->length > 0) {
- size_t ticklen = s->internal->tlsext_session_ticket->length;
+ if (s->tlsext_session_ticket->length > 0) {
+ size_t ticklen = s->tlsext_session_ticket->length;
if ((s->session->tlsext_tick = malloc(ticklen)) == NULL)
return 0;
memcpy(s->session->tlsext_tick,
- s->internal->tlsext_session_ticket->data,
+ s->tlsext_session_ticket->data,
ticklen);
s->session->tlsext_ticklen = ticklen;
tlsext_sessionticket_server_parse(SSL *s, uint16_t msg_type, CBS *cbs,
int *alert)
{
- if (s->internal->tls_session_ticket_ext_cb) {
- if (!s->internal->tls_session_ticket_ext_cb(s, CBS_data(cbs),
+ if (s->tls_session_ticket_ext_cb) {
+ if (!s->tls_session_ticket_ext_cb(s, CBS_data(cbs),
(int)CBS_len(cbs),
- s->internal->tls_session_ticket_ext_cb_arg)) {
+ s->tls_session_ticket_ext_cb_arg)) {
*alert = SSL_AD_INTERNAL_ERROR;
return 0;
}
static int
tlsext_sessionticket_server_needs(SSL *s, uint16_t msg_type)
{
- return (s->internal->tlsext_ticket_expected &&
+ return (s->tlsext_ticket_expected &&
!(SSL_get_options(s) & SSL_OP_NO_TICKET) &&
ssl_security_tickets(s));
}
tlsext_sessionticket_client_parse(SSL *s, uint16_t msg_type, CBS *cbs,
int *alert)
{
- if (s->internal->tls_session_ticket_ext_cb) {
- if (!s->internal->tls_session_ticket_ext_cb(s, CBS_data(cbs),
+ if (s->tls_session_ticket_ext_cb) {
+ if (!s->tls_session_ticket_ext_cb(s, CBS_data(cbs),
(int)CBS_len(cbs),
- s->internal->tls_session_ticket_ext_cb_arg)) {
+ s->tls_session_ticket_ext_cb_arg)) {
*alert = SSL_AD_INTERNAL_ERROR;
return 0;
}
return 0;
}
- s->internal->tlsext_ticket_expected = 1;
+ s->tlsext_ticket_expected = 1;
return 1;
}
goto err;
if (cprof->id == sprof->id) {
- s->internal->srtp_profile = sprof;
+ s->srtp_profile = sprof;
ret = 1;
goto done;
}
}
if (prof->id == id) {
- s->internal->srtp_profile = prof;
+ s->srtp_profile = prof;
return 1;
}
}
static int
tlsext_quic_transport_parameters_client_needs(SSL *s, uint16_t msg_type)
{
- return SSL_is_quic(s) && s->internal->quic_transport_params_len > 0;
+ return SSL_is_quic(s) && s->quic_transport_params_len > 0;
}
static int
tlsext_quic_transport_parameters_client_build(SSL *s, uint16_t msg_type,
CBB *cbb)
{
- if (!CBB_add_bytes(cbb, s->internal->quic_transport_params,
- s->internal->quic_transport_params_len))
+ if (!CBB_add_bytes(cbb, s->quic_transport_params,
+ s->quic_transport_params_len))
return 0;
return 1;
static int
tlsext_quic_transport_parameters_server_needs(SSL *s, uint16_t msg_type)
{
- return SSL_is_quic(s) && s->internal->quic_transport_params_len > 0;
+ return SSL_is_quic(s) && s->quic_transport_params_len > 0;
}
static int
tlsext_quic_transport_parameters_server_build(SSL *s, uint16_t msg_type,
CBB *cbb)
{
- if (!CBB_add_bytes(cbb, s->internal->quic_transport_params,
- s->internal->quic_transport_params_len))
+ if (!CBB_add_bytes(cbb, s->quic_transport_params,
+ s->quic_transport_params_len))
return 0;
return 1;
* RFC 8446 4.1.2. For subsequent CH, early data will be removed,
* cookie may be added, padding may be removed.
*/
- struct tls13_ctx *ctx = s->internal->tls13;
+ struct tls13_ctx *ctx = s->tls13;
if (type == TLSEXT_TYPE_early_data || type == TLSEXT_TYPE_cookie ||
type == TLSEXT_TYPE_padding)
if (!CBS_get_u16_length_prefixed(&extensions, &extension_data))
goto err;
- if (s->internal->tlsext_debug_cb != NULL)
- s->internal->tlsext_debug_cb(s, !is_server, type,
+ if (s->tlsext_debug_cb != NULL)
+ s->tlsext_debug_cb(s, !is_server, type,
(unsigned char *)CBS_data(&extension_data),
CBS_len(&extension_data),
- s->internal->tlsext_debug_arg);
+ s->tlsext_debug_arg);
/* Unknown extensions are ignored. */
if ((tlsext = tls_extension_find(type, &idx)) == NULL)
free(s->s3->alpn_selected);
s->s3->alpn_selected = NULL;
s->s3->alpn_selected_len = 0;
- s->internal->srtp_profile = NULL;
+ s->srtp_profile = NULL;
}
int
-/* $OpenBSD: ssl_versions.c,v 1.24 2022/09/11 18:13:30 jsing Exp $ */
+/* $OpenBSD: ssl_versions.c,v 1.25 2022/10/02 16:36:41 jsing Exp $ */
/*
* Copyright (c) 2016, 2017 Joel Sing <jsing@openbsd.org>
*
min_version = 0;
max_version = TLS1_3_VERSION;
- options = s->internal->options;
+ options = s->options;
if (SSL_is_dtls(s)) {
options = 0;
- if (s->internal->options & SSL_OP_NO_DTLSv1)
+ if (s->options & SSL_OP_NO_DTLSv1)
options |= SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1;
- if (s->internal->options & SSL_OP_NO_DTLSv1_2)
+ if (s->options & SSL_OP_NO_DTLSv1_2)
options |= SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_2;
}
/* Limit to configured version range. */
if (!ssl_clamp_tls_version_range(&min_version, &max_version,
- s->internal->min_tls_version, s->internal->max_tls_version))
+ s->min_tls_version, s->max_tls_version))
return 0;
/* QUIC requires a minimum of TLSv1.3. */
-/* $OpenBSD: t1_enc.c,v 1.154 2022/02/05 14:54:10 jsing Exp $ */
+/* $OpenBSD: t1_enc.c,v 1.155 2022/10/02 16:36:41 jsing Exp $ */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
* All rights reserved.
*
}
if (!is_write) {
- if (!tls12_record_layer_change_read_cipher_state(s->internal->rl,
+ if (!tls12_record_layer_change_read_cipher_state(s->rl,
&mac_key, &key, &iv))
goto err;
if (SSL_is_dtls(s))
dtls1_reset_read_seq_numbers(s);
} else {
- if (!tls12_record_layer_change_write_cipher_state(s->internal->rl,
+ if (!tls12_record_layer_change_write_cipher_state(s->rl,
&mac_key, &key, &iv))
goto err;
}
if (!ssl_get_handshake_evp_md(s, &handshake_hash))
return (0);
- tls12_record_layer_set_aead(s->internal->rl, aead);
- tls12_record_layer_set_cipher_hash(s->internal->rl, cipher,
+ tls12_record_layer_set_aead(s->rl, aead);
+ tls12_record_layer_set_cipher_hash(s->rl, cipher,
handshake_hash, mac_hash);
if ((key_block = tls12_key_block_new()) == NULL)
s->s3->hs.tls12.key_block = key_block;
key_block = NULL;
- if (!(s->internal->options & SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS) &&
+ if (!(s->options & SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS) &&
s->method->version <= TLS1_VERSION) {
/*
* Enable vulnerability countermeasure for CBC ciphers with
-/* $OpenBSD: t1_lib.c,v 1.195 2022/08/17 18:45:25 tb Exp $ */
+/* $OpenBSD: t1_lib.c,v 1.196 2022/10/02 16:36:42 jsing Exp $ */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
* All rights reserved.
*
if (s == NULL)
return;
- free(s->internal->tlsext_session_ticket);
+ free(s->tlsext_session_ticket);
ssl3_free(s);
}
return;
}
- *pformats = s->internal->tlsext_ecpointformatlist;
- *pformatslen = s->internal->tlsext_ecpointformatlist_length;
+ *pformats = s->tlsext_ecpointformatlist;
+ *pformatslen = s->tlsext_ecpointformatlist_length;
if (*pformats == NULL) {
*pformats = ecformats_default;
*pformatslen = sizeof(ecformats_default);
return;
}
- *pgroups = s->internal->tlsext_supportedgroups;
- *pgroupslen = s->internal->tlsext_supportedgroups_length;
+ *pgroups = s->tlsext_supportedgroups;
+ *pgroupslen = s->tlsext_supportedgroups_length;
if (*pgroups != NULL)
return;
if (!ssl->server)
return 0;
- server_pref = (ssl->internal->options & SSL_OP_CIPHER_SERVER_PREFERENCE);
+ server_pref = (ssl->options & SSL_OP_CIPHER_SERVER_PREFERENCE);
tls1_get_group_list(ssl, (server_pref == 0), pref, preflen);
tls1_get_group_list(ssl, (server_pref != 0), supp, supplen);
* ssl3_choose_cipher in s3_lib.c.
*/
- if (s->ctx != NULL && s->ctx->internal->tlsext_servername_callback != 0)
- ret = s->ctx->internal->tlsext_servername_callback(s, &al,
- s->ctx->internal->tlsext_servername_arg);
- else if (s->initial_ctx != NULL && s->initial_ctx->internal->tlsext_servername_callback != 0)
- ret = s->initial_ctx->internal->tlsext_servername_callback(s, &al,
- s->initial_ctx->internal->tlsext_servername_arg);
+ if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
+ ret = s->ctx->tlsext_servername_callback(s, &al,
+ s->ctx->tlsext_servername_arg);
+ else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
+ ret = s->initial_ctx->tlsext_servername_callback(s, &al,
+ s->initial_ctx->tlsext_servername_arg);
switch (ret) {
case SSL_TLSEXT_ERR_ALERT_FATAL:
* has been chosen because this may influence which certificate is sent
*/
if ((s->tlsext_status_type != -1) &&
- s->ctx && s->ctx->internal->tlsext_status_cb) {
+ s->ctx && s->ctx->tlsext_status_cb) {
int r;
SSL_CERT_PKEY *certpkey;
certpkey = ssl_get_server_send_pkey(s);
/* If no certificate can't return certificate status */
if (certpkey == NULL) {
- s->internal->tlsext_status_expected = 0;
+ s->tlsext_status_expected = 0;
return 1;
}
/* Set current certificate to one we will use so
* SSL_get_certificate et al can pick it up.
*/
s->cert->key = certpkey;
- r = s->ctx->internal->tlsext_status_cb(s,
- s->ctx->internal->tlsext_status_arg);
+ r = s->ctx->tlsext_status_cb(s,
+ s->ctx->tlsext_status_arg);
switch (r) {
/* We don't want to send a status request response */
case SSL_TLSEXT_ERR_NOACK:
- s->internal->tlsext_status_expected = 0;
+ s->tlsext_status_expected = 0;
break;
/* status request response should be sent */
case SSL_TLSEXT_ERR_OK:
- if (s->internal->tlsext_ocsp_resp)
- s->internal->tlsext_status_expected = 1;
+ if (s->tlsext_ocsp_resp)
+ s->tlsext_status_expected = 1;
else
- s->internal->tlsext_status_expected = 0;
+ s->tlsext_status_expected = 0;
break;
/* something bad happened */
case SSL_TLSEXT_ERR_ALERT_FATAL:
goto err;
}
} else
- s->internal->tlsext_status_expected = 0;
+ s->tlsext_status_expected = 0;
err:
switch (ret) {
ret = SSL_TLSEXT_ERR_OK;
- if (s->ctx != NULL && s->ctx->internal->tlsext_servername_callback != 0)
- ret = s->ctx->internal->tlsext_servername_callback(s, &al,
- s->ctx->internal->tlsext_servername_arg);
- else if (s->initial_ctx != NULL && s->initial_ctx->internal->tlsext_servername_callback != 0)
- ret = s->initial_ctx->internal->tlsext_servername_callback(s, &al,
- s->initial_ctx->internal->tlsext_servername_arg);
+ if (s->ctx != NULL && s->ctx->tlsext_servername_callback != 0)
+ ret = s->ctx->tlsext_servername_callback(s, &al,
+ s->ctx->tlsext_servername_arg);
+ else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)
+ ret = s->initial_ctx->tlsext_servername_callback(s, &al,
+ s->initial_ctx->tlsext_servername_arg);
/* If we've requested certificate status and we wont get one
* tell the callback
*/
- if ((s->tlsext_status_type != -1) && !(s->internal->tlsext_status_expected) &&
- s->ctx && s->ctx->internal->tlsext_status_cb) {
+ if ((s->tlsext_status_type != -1) && !(s->tlsext_status_expected) &&
+ s->ctx && s->ctx->tlsext_status_cb) {
int r;
- free(s->internal->tlsext_ocsp_resp);
- s->internal->tlsext_ocsp_resp = NULL;
- s->internal->tlsext_ocsp_resp_len = 0;
+ free(s->tlsext_ocsp_resp);
+ s->tlsext_ocsp_resp = NULL;
+ s->tlsext_ocsp_resp_len = 0;
- r = s->ctx->internal->tlsext_status_cb(s,
- s->ctx->internal->tlsext_status_arg);
+ r = s->ctx->tlsext_status_cb(s,
+ s->ctx->tlsext_status_arg);
if (r == 0) {
al = SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE;
ret = SSL_TLSEXT_ERR_ALERT_FATAL;
* ret: (output) on return, if a ticket was decrypted, then this is set to
* point to the resulting session.
*
- * If s->internal->tls_session_secret_cb is set then we are expecting a pre-shared key
+ * If s->tls_session_secret_cb is set then we are expecting a pre-shared key
* ciphersuite, in which case we have no use for session tickets and one will
- * never be decrypted, nor will s->internal->tlsext_ticket_expected be set to 1.
+ * never be decrypted, nor will s->tlsext_ticket_expected be set to 1.
*
* Returns:
* TLS1_TICKET_FATAL_ERROR: error from parsing or decrypting the ticket.
* TLS1_TICKET_NONE: no ticket was found (or was ignored, based on settings).
* TLS1_TICKET_EMPTY: a zero length extension was found, indicating that the
* client supports session tickets but doesn't currently have one to offer.
- * TLS1_TICKET_NOT_DECRYPTED: either s->internal->tls_session_secret_cb was
+ * TLS1_TICKET_NOT_DECRYPTED: either s->tls_session_secret_cb was
* set, or a ticket was offered but couldn't be decrypted because of a
* non-fatal error.
* TLS1_TICKET_DECRYPTED: a ticket was successfully decrypted and *ret was set.
*
* Side effects:
- * Sets s->internal->tlsext_ticket_expected to 1 if the server will have to issue
+ * Sets s->tlsext_ticket_expected to 1 if the server will have to issue
* a new session ticket to the client because the client indicated support
- * (and s->internal->tls_session_secret_cb is NULL) but the client either doesn't have
+ * (and s->tls_session_secret_cb is NULL) but the client either doesn't have
* a session ticket or we couldn't use the one it gave us, or if
* s->ctx->tlsext_ticket_key_cb asked to renew the client's ticket.
- * Otherwise, s->internal->tlsext_ticket_expected is set to 0.
+ * Otherwise, s->tlsext_ticket_expected is set to 0.
*/
int
tls1_process_ticket(SSL *s, CBS *ext_block, int *alert, SSL_SESSION **ret)
CBS extensions, ext_data;
uint16_t ext_type = 0;
- s->internal->tlsext_ticket_expected = 0;
+ s->tlsext_ticket_expected = 0;
*ret = NULL;
/*
* The client will accept a ticket but does not currently
* have one.
*/
- s->internal->tlsext_ticket_expected = 1;
+ s->tlsext_ticket_expected = 1;
return TLS1_TICKET_EMPTY;
}
- if (s->internal->tls_session_secret_cb != NULL) {
+ if (s->tls_session_secret_cb != NULL) {
/*
* Indicate that the ticket could not be decrypted rather than
* generating the session from ticket now, trigger abbreviated
if ((hctx = HMAC_CTX_new()) == NULL)
goto err;
- if (tctx->internal->tlsext_ticket_key_cb != NULL) {
+ if (tctx->tlsext_ticket_key_cb != NULL) {
int rv;
/*
if (CBS_len(ticket) < EVP_MAX_IV_LENGTH)
goto derr;
- if ((rv = tctx->internal->tlsext_ticket_key_cb(s,
+ if ((rv = tctx->tlsext_ticket_key_cb(s,
(unsigned char *)CBS_data(&ticket_name),
(unsigned char *)CBS_data(ticket), cctx, hctx, 0)) < 0)
goto err;
goto derr;
if (rv == 2) {
/* Renew ticket. */
- s->internal->tlsext_ticket_expected = 1;
+ s->tlsext_ticket_expected = 1;
}
/*
} else {
/* Check that the key name matches. */
if (!CBS_mem_equal(&ticket_name,
- tctx->internal->tlsext_tick_key_name,
- sizeof(tctx->internal->tlsext_tick_key_name)))
+ tctx->tlsext_tick_key_name,
+ sizeof(tctx->tlsext_tick_key_name)))
goto derr;
if (!CBS_get_bytes(ticket, &ticket_iv,
EVP_CIPHER_iv_length(EVP_aes_128_cbc())))
goto derr;
if (!EVP_DecryptInit_ex(cctx, EVP_aes_128_cbc(), NULL,
- tctx->internal->tlsext_tick_aes_key, CBS_data(&ticket_iv)))
+ tctx->tlsext_tick_aes_key, CBS_data(&ticket_iv)))
goto err;
- if (!HMAC_Init_ex(hctx, tctx->internal->tlsext_tick_hmac_key,
- sizeof(tctx->internal->tlsext_tick_hmac_key), EVP_sha256(),
+ if (!HMAC_Init_ex(hctx, tctx->tlsext_tick_hmac_key,
+ sizeof(tctx->tlsext_tick_hmac_key), EVP_sha256(),
NULL))
goto err;
}
derr:
ERR_clear_error();
- s->internal->tlsext_ticket_expected = 1;
+ s->tlsext_ticket_expected = 1;
ret = TLS1_TICKET_NOT_DECRYPTED;
goto done;
-/* $OpenBSD: tls13_client.c,v 1.99 2022/09/11 14:33:07 jsing Exp $ */
+/* $OpenBSD: tls13_client.c,v 1.100 2022/10/02 16:36:42 jsing Exp $ */
/*
* Copyright (c) 2018, 2019 Joel Sing <jsing@openbsd.org>
*
s->version = ctx->hs->our_max_tls_version;
tls13_record_layer_set_retry_after_phh(ctx->rl,
- (s->internal->mode & SSL_MODE_AUTO_RETRY) != 0);
+ (s->mode & SSL_MODE_AUTO_RETRY) != 0);
if (!ssl_get_new_session(s, 0)) /* XXX */
return 0;
-/* $OpenBSD: tls13_legacy.c,v 1.38 2022/07/17 15:49:20 jsing Exp $ */
+/* $OpenBSD: tls13_legacy.c,v 1.39 2022/10/02 16:36:42 jsing Exp $ */
/*
* Copyright (c) 2018, 2019 Joel Sing <jsing@openbsd.org>
*
return TLS13_IO_FAILURE;
}
- ssl->internal->rwstate = SSL_READING;
+ ssl->rwstate = SSL_READING;
errno = 0;
if ((n = BIO_read(ssl->rbio, buf, len)) <= 0) {
}
if (n == len)
- ssl->internal->rwstate = SSL_NOTHING;
+ ssl->rwstate = SSL_NOTHING;
return n;
}
return TLS13_IO_FAILURE;
}
- ssl->internal->rwstate = SSL_WRITING;
+ ssl->rwstate = SSL_WRITING;
errno = 0;
if ((n = BIO_write(ssl->wbio, buf, len)) <= 0) {
}
if (n == len)
- ssl->internal->rwstate = SSL_NOTHING;
+ ssl->rwstate = SSL_NOTHING;
return n;
}
static void
tls13_legacy_error(SSL *ssl)
{
- struct tls13_ctx *ctx = ssl->internal->tls13;
+ struct tls13_ctx *ctx = ssl->tls13;
int reason = SSL_R_UNKNOWN;
/* If we received a fatal alert we already put an error on the stack. */
if (ret > 0)
return ret;
- ssl->internal->rwstate = SSL_NOTHING;
+ ssl->rwstate = SSL_NOTHING;
switch (ret) {
case TLS13_IO_EOF:
case TLS13_IO_WANT_POLLIN:
BIO_set_retry_read(ssl->rbio);
- ssl->internal->rwstate = SSL_READING;
+ ssl->rwstate = SSL_READING;
return -1;
case TLS13_IO_WANT_POLLOUT:
BIO_set_retry_write(ssl->wbio);
- ssl->internal->rwstate = SSL_WRITING;
+ ssl->rwstate = SSL_WRITING;
return -1;
case TLS13_IO_WANT_RETRY:
int
tls13_legacy_pending(const SSL *ssl)
{
- struct tls13_ctx *ctx = ssl->internal->tls13;
+ struct tls13_ctx *ctx = ssl->tls13;
ssize_t ret;
if (ctx == NULL)
int
tls13_legacy_read_bytes(SSL *ssl, int type, unsigned char *buf, int len, int peek)
{
- struct tls13_ctx *ctx = ssl->internal->tls13;
+ struct tls13_ctx *ctx = ssl->tls13;
ssize_t ret;
if (ctx == NULL || !ctx->handshake_completed) {
- if ((ret = ssl->internal->handshake_func(ssl)) <= 0)
+ if ((ret = ssl->handshake_func(ssl)) <= 0)
return ret;
if (len == 0)
return 0;
}
tls13_record_layer_set_retry_after_phh(ctx->rl,
- (ctx->ssl->internal->mode & SSL_MODE_AUTO_RETRY) != 0);
+ (ctx->ssl->mode & SSL_MODE_AUTO_RETRY) != 0);
if (type != SSL3_RT_APPLICATION_DATA) {
SSLerror(ssl, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
int
tls13_legacy_write_bytes(SSL *ssl, int type, const void *vbuf, int len)
{
- struct tls13_ctx *ctx = ssl->internal->tls13;
+ struct tls13_ctx *ctx = ssl->tls13;
const uint8_t *buf = vbuf;
size_t n, sent;
ssize_t ret;
if (ctx == NULL || !ctx->handshake_completed) {
- if ((ret = ssl->internal->handshake_func(ssl)) <= 0)
+ if ((ret = ssl->handshake_func(ssl)) <= 0)
return ret;
if (len == 0)
return 0;
* The TLSv1.3 record layer write behaviour is the same as
* SSL_MODE_ENABLE_PARTIAL_WRITE.
*/
- if (ssl->internal->mode & SSL_MODE_ENABLE_PARTIAL_WRITE) {
+ if (ssl->mode & SSL_MODE_ENABLE_PARTIAL_WRITE) {
ret = tls13_write_application_data(ctx->rl, buf, len);
return tls13_legacy_return_code(ssl, ret);
}
s->s3->rbuf.left = CBS_len(&cbs);
s->s3->rrec.type = SSL3_RT_HANDSHAKE;
s->s3->rrec.length = CBS_len(&cbs);
- s->internal->rstate = SSL_ST_READ_BODY;
- s->internal->packet = s->s3->rbuf.buf;
- s->internal->packet_length = SSL3_RT_HEADER_LENGTH;
- s->internal->mac_packet = 1;
+ s->rstate = SSL_ST_READ_BODY;
+ s->packet = s->s3->rbuf.buf;
+ s->packet_length = SSL3_RT_HEADER_LENGTH;
+ s->mac_packet = 1;
}
/* Stash the current handshake message. */
tls13_handshake_msg_data(ctx->hs_msg, &cbs);
- if (!BUF_MEM_grow_clean(s->internal->init_buf, CBS_len(&cbs)))
+ if (!BUF_MEM_grow_clean(s->init_buf, CBS_len(&cbs)))
goto err;
- if (!CBS_write_bytes(&cbs, s->internal->init_buf->data,
- s->internal->init_buf->length, NULL))
+ if (!CBS_write_bytes(&cbs, s->init_buf->data,
+ s->init_buf->length, NULL))
goto err;
s->s3->hs.tls12.reuse_message = 1;
if (!tls13_use_legacy_stack(ctx))
return 0;
- s->internal->handshake_func = s->method->ssl_connect;
+ s->handshake_func = s->method->ssl_connect;
s->version = s->method->max_tls_version;
return 1;
if (!tls13_use_legacy_stack(ctx))
return 0;
- s->internal->handshake_func = s->method->ssl_accept;
+ s->handshake_func = s->method->ssl_accept;
s->version = s->method->max_tls_version;
s->server = 1;
int
tls13_legacy_accept(SSL *ssl)
{
- struct tls13_ctx *ctx = ssl->internal->tls13;
+ struct tls13_ctx *ctx = ssl->tls13;
int ret;
if (ctx == NULL) {
int
tls13_legacy_connect(SSL *ssl)
{
- struct tls13_ctx *ctx = ssl->internal->tls13;
+ struct tls13_ctx *ctx = ssl->tls13;
int ret;
if (ctx == NULL) {
int
tls13_legacy_shutdown(SSL *ssl)
{
- struct tls13_ctx *ctx = ssl->internal->tls13;
+ struct tls13_ctx *ctx = ssl->tls13;
uint8_t buf[512]; /* XXX */
ssize_t ret;
* alerts. All other cases, including EOF, return -1 and set internal
* state appropriately.
*/
- if (ctx == NULL || ssl->internal->quiet_shutdown) {
- ssl->internal->shutdown = SSL_SENT_SHUTDOWN | SSL_RECEIVED_SHUTDOWN;
+ if (ctx == NULL || ssl->quiet_shutdown) {
+ ssl->shutdown = SSL_SENT_SHUTDOWN | SSL_RECEIVED_SHUTDOWN;
return 1;
}
if (!ctx->close_notify_sent) {
/* Enqueue and send close notify. */
- if (!(ssl->internal->shutdown & SSL_SENT_SHUTDOWN)) {
- ssl->internal->shutdown |= SSL_SENT_SHUTDOWN;
+ if (!(ssl->shutdown & SSL_SENT_SHUTDOWN)) {
+ ssl->shutdown |= SSL_SENT_SHUTDOWN;
if ((ret = tls13_send_alert(ctx->rl,
TLS13_ALERT_CLOSE_NOTIFY)) < 0)
return tls13_legacy_return_code(ssl, ret);
SSL_CTX *ssl_ctx = ctx->ssl->ctx;
SSL *s = ctx->ssl;
- if (ssl_ctx->internal->tlsext_servername_callback == NULL)
+ if (ssl_ctx->tlsext_servername_callback == NULL)
ssl_ctx = s->initial_ctx;
- if (ssl_ctx->internal->tlsext_servername_callback == NULL)
+ if (ssl_ctx->tlsext_servername_callback == NULL)
return 1;
- ret = ssl_ctx->internal->tlsext_servername_callback(s, &legacy_alert,
- ssl_ctx->internal->tlsext_servername_arg);
+ ret = ssl_ctx->tlsext_servername_callback(s, &legacy_alert,
+ ssl_ctx->tlsext_servername_arg);
/*
* Ignore SSL_TLSEXT_ERR_ALERT_WARNING returns to match OpenSSL's
-/* $OpenBSD: tls13_lib.c,v 1.71 2022/09/10 15:29:33 jsing Exp $ */
+/* $OpenBSD: tls13_lib.c,v 1.72 2022/10/02 16:36:42 jsing Exp $ */
/*
* Copyright (c) 2018, 2019 Joel Sing <jsing@openbsd.org>
* Copyright (c) 2019 Bob Beck <beck@openbsd.org>
if (alert_desc == TLS13_ALERT_CLOSE_NOTIFY) {
ctx->close_notify_recv = 1;
- ctx->ssl->internal->shutdown |= SSL_RECEIVED_SHUTDOWN;
+ ctx->ssl->shutdown |= SSL_RECEIVED_SHUTDOWN;
ctx->ssl->s3->warn_alert = alert_desc;
return;
}
SSL *s = ctx->ssl;
CBS cbs;
- if (s->internal->msg_callback == NULL)
+ if (s->msg_callback == NULL)
return;
tls13_handshake_msg_data(ctx->hs_msg, &cbs);
SSL *s = ctx->ssl;
CBS cbs;
- if (s->internal->msg_callback == NULL)
+ if (s->msg_callback == NULL)
return;
tls13_handshake_msg_data(ctx->hs_msg, &cbs);
SSL *s = ctx->ssl;
int ret;
- if (s->ctx->internal->tlsext_status_cb == NULL)
+ if (s->ctx->tlsext_status_cb == NULL)
return 1;
- ret = s->ctx->internal->tlsext_status_cb(s,
- s->ctx->internal->tlsext_status_arg);
+ ret = s->ctx->tlsext_status_cb(s,
+ s->ctx->tlsext_status_arg);
if (ret < 0) {
ctx->alert = TLS13_ALERT_INTERNAL_ERROR;
SSLerror(s, ERR_R_MALLOC_FAILURE);
ctx->middlebox_compat = 1;
- ssl->internal->tls13 = ctx;
+ ssl->tls13 = ctx;
if (SSL_is_quic(ssl)) {
if (!tls13_quic_init(ctx))
-/* $OpenBSD: tls13_server.c,v 1.103 2022/09/17 17:14:06 jsing Exp $ */
+/* $OpenBSD: tls13_server.c,v 1.104 2022/10/02 16:36:42 jsing Exp $ */
/*
* Copyright (c) 2019, 2020 Joel Sing <jsing@openbsd.org>
* Copyright (c) 2020 Bob Beck <beck@openbsd.org>
s->version = ctx->hs->our_max_tls_version;
tls13_record_layer_set_retry_after_phh(ctx->rl,
- (s->internal->mode & SSL_MODE_AUTO_RETRY) != 0);
+ (s->mode & SSL_MODE_AUTO_RETRY) != 0);
if (!ssl_get_new_session(s, 0)) /* XXX */
return 0;
if ((chain = cpk->chain) == NULL)
chain = s->ctx->extra_certs;
- if (chain == NULL && !(s->internal->mode & SSL_MODE_NO_AUTO_CHAIN)) {
+ if (chain == NULL && !(s->mode & SSL_MODE_NO_AUTO_CHAIN)) {
if ((xsc = X509_STORE_CTX_new()) == NULL)
goto err;
if (!X509_STORE_CTX_init(xsc, s->ctx->cert_store, cpk->x509, NULL))
projects / openbsd / commitdiff