ssl_sess.c 15.0 KB
Newer Older
1
/* ssl/ssl_sess.c */
2
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59
 * All rights reserved.
 *
 * This package is an SSL implementation written
 * by Eric Young (eay@cryptsoft.com).
 * The implementation was written so as to conform with Netscapes SSL.
 * 
 * This library is free for commercial and non-commercial use as long as
 * the following conditions are aheared to.  The following conditions
 * apply to all code found in this distribution, be it the RC4, RSA,
 * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
 * included with this distribution is covered by the same copyright terms
 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
 * 
 * Copyright remains Eric Young's, and as such any Copyright notices in
 * the code are not to be removed.
 * If this package is used in a product, Eric Young should be given attribution
 * as the author of the parts of the library used.
 * This can be in the form of a textual message at program startup or
 * in documentation (online or textual) provided with the package.
 * 
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. All advertising materials mentioning features or use of this software
 *    must display the following acknowledgement:
 *    "This product includes cryptographic software written by
 *     Eric Young (eay@cryptsoft.com)"
 *    The word 'cryptographic' can be left out if the rouines from the library
 *    being used are not cryptographic related :-).
 * 4. If you include any Windows specific code (or a derivative thereof) from 
 *    the apps directory (application code) you must include an acknowledgement:
 *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
 * 
 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 * 
 * The licence and distribution terms for any publically available version or
 * derivative of this code cannot be changed.  i.e. this code cannot simply be
 * copied and put under another distribution licence
 * [including the GNU Public Licence.]
 */

#include <stdio.h>
60 61
#include <openssl/lhash.h>
#include <openssl/rand.h>
62 63
#include "ssl_locl.h"

64 65
static void SSL_SESSION_list_remove(SSL_CTX *ctx, SSL_SESSION *s);
static void SSL_SESSION_list_add(SSL_CTX *ctx,SSL_SESSION *s);
66
static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck);
67
static int ssl_session_num=0;
68 69
static STACK *ssl_session_meth=NULL;

U
Ulf Möller 已提交
70
SSL_SESSION *SSL_get_session(SSL *ssl)
71 72 73 74
	{
	return(ssl->session);
	}

U
Ulf Möller 已提交
75 76
int SSL_SESSION_get_ex_new_index(long argl, char *argp, int (*new_func)(),
	     int (*dup_func)(), void (*free_func)())
77 78 79 80 81 82 83
        {
        ssl_session_num++;
        return(CRYPTO_get_ex_new_index(ssl_session_num-1,
		&ssl_session_meth,
                argl,argp,new_func,dup_func,free_func));
        }

U
Ulf Möller 已提交
84
int SSL_SESSION_set_ex_data(SSL_SESSION *s, int idx, void *arg)
85 86 87 88
	{
	return(CRYPTO_set_ex_data(&s->ex_data,idx,arg));
	}

U
Ulf Möller 已提交
89
void *SSL_SESSION_get_ex_data(SSL_SESSION *s, int idx)
90 91 92 93
	{
	return(CRYPTO_get_ex_data(&s->ex_data,idx));
	}

U
Ulf Möller 已提交
94
SSL_SESSION *SSL_SESSION_new(void)
95 96 97 98 99 100 101 102 103 104 105 106 107 108
	{
	SSL_SESSION *ss;

	ss=(SSL_SESSION *)Malloc(sizeof(SSL_SESSION));
	if (ss == NULL)
		{
		SSLerr(SSL_F_SSL_SESSION_NEW,ERR_R_MALLOC_FAILURE);
		return(0);
		}
	memset(ss,0,sizeof(SSL_SESSION));

	ss->references=1;
	ss->timeout=60*5+4; /* 5 minute timeout by default */
	ss->time=time(NULL);
109 110
	ss->prev=NULL;
	ss->next=NULL;
111
	ss->compress_meth=0;
112
	CRYPTO_new_ex_data(ssl_session_meth,(char *)ss,&ss->ex_data);
113 114 115
	return(ss);
	}

U
Ulf Möller 已提交
116
int ssl_get_new_session(SSL *s, int session)
117
	{
118 119
	/* This gets used by clients and servers. */

120 121 122 123 124
	SSL_SESSION *ss=NULL;

	if ((ss=SSL_SESSION_new()) == NULL) return(0);

	/* If the context has a default timeout, use it */
125
	if (s->ctx->session_timeout == 0)
126
		ss->timeout=SSL_get_default_timeout(s);
127 128
	else
		ss->timeout=s->ctx->session_timeout;
129 130 131 132 133 134 135 136 137

	if (s->session != NULL)
		{
		SSL_SESSION_free(s->session);
		s->session=NULL;
		}

	if (session)
		{
138
		if (s->version == SSL2_VERSION)
139
			{
140
			ss->ssl_version=SSL2_VERSION;
141 142
			ss->session_id_length=SSL2_SSL_SESSION_ID_LENGTH;
			}
143
		else if (s->version == SSL3_VERSION)
144
			{
145 146 147 148 149 150
			ss->ssl_version=SSL3_VERSION;
			ss->session_id_length=SSL3_SSL_SESSION_ID_LENGTH;
			}
		else if (s->version == TLS1_VERSION)
			{
			ss->ssl_version=TLS1_VERSION;
151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177
			ss->session_id_length=SSL3_SSL_SESSION_ID_LENGTH;
			}
		else
			{
			SSLerr(SSL_F_SSL_GET_NEW_SESSION,SSL_R_UNSUPPORTED_SSL_VERSION);
			SSL_SESSION_free(ss);
			return(0);
			}

		for (;;)
			{
			SSL_SESSION *r;

			RAND_bytes(ss->session_id,ss->session_id_length);
			CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX);
			r=(SSL_SESSION *)lh_retrieve(s->ctx->sessions,
				(char *)ss);
			CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX);
			if (r == NULL) break;
			/* else - woops a session_id match */
			}
		}
	else
		{
		ss->session_id_length=0;
		}

B
Ben Laurie 已提交
178 179
	memcpy(ss->sid_ctx,s->sid_ctx,s->sid_ctx_length);
	ss->sid_ctx_length=s->sid_ctx_length;
180 181 182 183 184 185
	s->session=ss;
	ss->ssl_version=s->version;

	return(1);
	}

U
Ulf Möller 已提交
186
int ssl_get_prev_session(SSL *s, unsigned char *session_id, int len)
187
	{
188 189
	/* This is used only by servers. */

190
	SSL_SESSION *ret=NULL,data;
B
Ben Laurie 已提交
191
	int copy=1;
192 193 194 195 196 197

	/* conn_init();*/
	data.ssl_version=s->version;
	data.session_id_length=len;
	if (len > SSL_MAX_SSL_SESSION_ID_LENGTH)
		return(0);
B
Ben Laurie 已提交
198
	memcpy(data.session_id,session_id,len);
199

200 201 202 203 204 205
	if (!(s->ctx->session_cache_mode & SSL_SESS_CACHE_NO_INTERNAL_LOOKUP))
		{
		CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX);
		ret=(SSL_SESSION *)lh_retrieve(s->ctx->sessions,(char *)&data);
		CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX);
		}
206 207 208

	if (ret == NULL)
		{
209
		s->ctx->stats.sess_miss++;
210
		ret=NULL;
B
Ben Laurie 已提交
211 212 213
		if (s->ctx->get_session_cb != NULL
		    && (ret=s->ctx->get_session_cb(s,session_id,len,&copy))
		       != NULL)
214
			{
215
			s->ctx->stats.sess_cb_hit++;
216 217 218 219 220 221 222 223

			/* The following should not return 1, otherwise,
			 * things are very strange */
			SSL_CTX_add_session(s->ctx,ret);
			}
		if (ret == NULL) return(0);
		}

B
Ben Laurie 已提交
224 225 226 227
	if((s->verify_mode&SSL_VERIFY_PEER)
	   && (!s->sid_ctx_length || ret->sid_ctx_length != s->sid_ctx_length
	       || memcmp(ret->sid_ctx,s->sid_ctx,ret->sid_ctx_length)))
	    {
228 229 230 231 232
		if (s->sid_ctx_length)
			SSLerr(SSL_F_SSL_GET_PREV_SESSION,SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT);
		else
			/* application should have used SSL[_CTX]_set_session_id_context */
			SSLerr(SSL_F_SSL_GET_PREV_SESSION,SSL_R_SESSION_ID_CONTEXT_UNINITIALIZED);
B
Ben Laurie 已提交
233 234 235 236 237 238 239
	    return 0;
	    }

	/* auto free it */
	if (!copy)
	    SSL_SESSION_free(ret);

240 241
	if (ret->cipher == NULL)
		{
242
		unsigned char buf[5],*p;
243 244 245 246 247
		unsigned long l;

		p=buf;
		l=ret->cipher_id;
		l2n(l,p);
248
		if ((ret->ssl_version>>8) == SSL3_VERSION_MAJOR)
249 250 251 252 253 254 255 256 257 258 259 260 261 262 263
			ret->cipher=ssl_get_cipher_by_char(s,&(buf[2]));
		else 
			ret->cipher=ssl_get_cipher_by_char(s,&(buf[1]));
		if (ret->cipher == NULL)
			return(0);
		}

	/* If a thread got the session, then 'swaped', and another got
	 * it and then due to a time-out decided to 'Free' it we could
	 * be in trouble.  So I'll increment it now, then double decrement
	 * later - am I speaking rubbish?. */
	CRYPTO_add(&ret->references,1,CRYPTO_LOCK_SSL_SESSION);

	if ((long)(ret->time+ret->timeout) < (long)time(NULL)) /* timeout */
		{
264
		s->ctx->stats.sess_timeout++;
265 266 267 268 269 270
		/* remove it from the cache */
		SSL_CTX_remove_session(s->ctx,ret);
		SSL_SESSION_free(ret);		/* again to actually Free it */
		return(0);
		}

271
	s->ctx->stats.sess_hit++;
272 273 274 275 276 277 278 279 280 281 282

	/* ret->time=time(NULL); */ /* rezero timeout? */
	/* again, just leave the session 
	 * if it is the same session, we have just incremented and
	 * then decremented the reference count :-) */
	if (s->session != NULL)
		SSL_SESSION_free(s->session);
	s->session=ret;
	return(1);
	}

U
Ulf Möller 已提交
283
int SSL_CTX_add_session(SSL_CTX *ctx, SSL_SESSION *c)
284
	{
285
	int ret=0;
286 287 288 289 290 291 292
	SSL_SESSION *s;

	/* conn_init(); */
	CRYPTO_add(&c->references,1,CRYPTO_LOCK_SSL_SESSION);

	CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
	s=(SSL_SESSION *)lh_insert(ctx->sessions,(char *)c);
293 294 295 296
	
	/* Put on the end of the queue unless it is already in the cache */
	if (s == NULL)
		SSL_SESSION_list_add(ctx,c);
297 298 299 300 301 302 303 304

	/* If the same session if is being 're-added', Free the old
	 * one when the last person stops using it.
	 * This will also work if it is alread in the cache.
	 * The references will go up and then down :-) */
	if (s != NULL)
		{
		SSL_SESSION_free(s);
305
		ret=0;
306 307
		}
	else
308 309 310 311 312 313 314 315
		{
		ret=1;

		if (SSL_CTX_sess_get_cache_size(ctx) > 0)
			{
			while (SSL_CTX_sess_number(ctx) >
				SSL_CTX_sess_get_cache_size(ctx))
				{
316 317
				if (!remove_session_lock(ctx,
					ctx->session_cache_tail, 0))
318 319
					break;
				else
320
					ctx->stats.sess_cache_full++;
321 322 323 324 325
				}
			}
		}
	CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
	return(ret);
326 327
	}

U
Ulf Möller 已提交
328
int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)
329 330 331 332
{
	return remove_session_lock(ctx, c, 1);
}

333
static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck)
334 335 336 337
	{
	SSL_SESSION *r;
	int ret=0;

338
	if ((c != NULL) && (c->session_id_length != 0))
339
		{
340
		if(lck) CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
341
		r=(SSL_SESSION *)lh_delete(ctx->sessions,(char *)c);
342 343 344 345 346
		if (r != NULL)
			{
			ret=1;
			SSL_SESSION_list_remove(ctx,c);
			}
347

348
		if(lck) CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
349 350 351 352 353

		if (ret)
			{
			r->not_resumable=1;
			if (ctx->remove_session_cb != NULL)
354
				ctx->remove_session_cb(ctx,r);
355 356 357 358 359 360 361 362
			SSL_SESSION_free(r);
			}
		}
	else
		ret=0;
	return(ret);
	}

U
Ulf Möller 已提交
363
void SSL_SESSION_free(SSL_SESSION *ss)
364 365 366
	{
	int i;

B
Ben Laurie 已提交
367 368 369
	if(ss == NULL)
	    return;

370
	i=CRYPTO_add(&ss->references,-1,CRYPTO_LOCK_SSL_SESSION);
371 372 373
#ifdef REF_PRINT
	REF_PRINT("SSL_SESSION",ss);
#endif
374 375 376 377 378 379 380 381 382
	if (i > 0) return;
#ifdef REF_CHECK
	if (i < 0)
		{
		fprintf(stderr,"SSL_SESSION_free, bad reference count\n");
		abort(); /* ok */
		}
#endif

383 384
	CRYPTO_free_ex_data(ssl_session_meth,(char *)ss,&ss->ex_data);

385 386 387
	memset(ss->key_arg,0,SSL_MAX_KEY_ARG_LENGTH);
	memset(ss->master_key,0,SSL_MAX_MASTER_KEY_LENGTH);
	memset(ss->session_id,0,SSL_MAX_SSL_SESSION_ID_LENGTH);
388
	if (ss->sess_cert != NULL) ssl_sess_cert_free(ss->sess_cert);
389
	if (ss->peer != NULL) X509_free(ss->peer);
B
Ben Laurie 已提交
390
	if (ss->ciphers != NULL) sk_SSL_CIPHER_free(ss->ciphers);
391 392 393 394
	memset(ss,0,sizeof(*ss));
	Free(ss);
	}

U
Ulf Möller 已提交
395
int SSL_set_session(SSL *s, SSL_SESSION *session)
396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414
	{
	int ret=0;
	SSL_METHOD *meth;

	if (session != NULL)
		{
		meth=s->ctx->method->get_ssl_method(session->ssl_version);
		if (meth == NULL)
			meth=s->method->get_ssl_method(session->ssl_version);
		if (meth == NULL)
			{
			SSLerr(SSL_F_SSL_SET_SESSION,SSL_R_UNABLE_TO_FIND_SSL_METHOD);
			return(0);
			}

		if (meth != s->method)
			{
			if (!SSL_set_ssl_method(s,meth))
				return(0);
415 416 417 418
			if (s->ctx->session_timeout == 0)
				session->timeout=SSL_get_default_timeout(s);
			else
				session->timeout=s->ctx->session_timeout;
419 420 421 422 423 424 425 426 427 428
			}

		/* CRYPTO_w_lock(CRYPTO_LOCK_SSL);*/
		CRYPTO_add(&session->references,1,CRYPTO_LOCK_SSL_SESSION);
		if (s->session != NULL)
			SSL_SESSION_free(s->session);
		s->session=session;
		/* CRYPTO_w_unlock(CRYPTO_LOCK_SSL);*/
		ret=1;
		}
429 430 431 432 433 434 435
	else
		{
		if (s->session != NULL)
			{
			SSL_SESSION_free(s->session);
			s->session=NULL;
			}
436 437 438 439 440 441 442 443

		meth=s->ctx->method;
		if (meth != s->method)
			{
			if (!SSL_set_ssl_method(s,meth))
				return(0);
			}
		ret=1;
444
		}
445 446 447
	return(ret);
	}

U
Ulf Möller 已提交
448
long SSL_SESSION_set_timeout(SSL_SESSION *s, long t)
449 450 451 452 453 454
	{
	if (s == NULL) return(0);
	s->timeout=t;
	return(1);
	}

U
Ulf Möller 已提交
455
long SSL_SESSION_get_timeout(SSL_SESSION *s)
456 457 458 459 460
	{
	if (s == NULL) return(0);
	return(s->timeout);
	}

U
Ulf Möller 已提交
461
long SSL_SESSION_get_time(SSL_SESSION *s)
462 463 464 465 466
	{
	if (s == NULL) return(0);
	return(s->time);
	}

U
Ulf Möller 已提交
467
long SSL_SESSION_set_time(SSL_SESSION *s, long t)
468 469 470 471 472 473
	{
	if (s == NULL) return(0);
	s->time=t;
	return(t);
	}

U
Ulf Möller 已提交
474
long SSL_CTX_set_timeout(SSL_CTX *s, long t)
475 476 477 478 479 480 481 482
	{
	long l;
	if (s == NULL) return(0);
	l=s->session_timeout;
	s->session_timeout=t;
	return(l);
	}

U
Ulf Möller 已提交
483
long SSL_CTX_get_timeout(SSL_CTX *s)
484 485 486 487 488
	{
	if (s == NULL) return(0);
	return(s->session_timeout);
	}

489 490 491 492 493 494 495
typedef struct timeout_param_st
	{
	SSL_CTX *ctx;
	long time;
	LHASH *cache;
	} TIMEOUT_PARAM;

U
Ulf Möller 已提交
496
static void timeout(SSL_SESSION *s, TIMEOUT_PARAM *p)
497 498 499
	{
	if ((p->time == 0) || (p->time > (s->time+s->timeout))) /* timeout */
		{
500 501
		/* The reason we don't call SSL_CTX_remove_session() is to
		 * save on locking overhead */
502
		lh_delete(p->cache,(char *)s);
503
		SSL_SESSION_list_remove(p->ctx,s);
504 505 506 507 508 509 510
		s->not_resumable=1;
		if (p->ctx->remove_session_cb != NULL)
			p->ctx->remove_session_cb(p->ctx,s);
		SSL_SESSION_free(s);
		}
	}

U
Ulf Möller 已提交
511
void SSL_CTX_flush_sessions(SSL_CTX *s, long t)
512 513 514 515 516
	{
	unsigned long i;
	TIMEOUT_PARAM tp;

	tp.ctx=s;
517
	tp.cache=s->sessions;
518 519 520 521 522 523 524 525 526 527
	if (tp.cache == NULL) return;
	tp.time=t;
	CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
	i=tp.cache->down_load;
	tp.cache->down_load=0;
	lh_doall_arg(tp.cache,(void (*)())timeout,(char *)&tp);
	tp.cache->down_load=i;
	CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
	}

U
Ulf Möller 已提交
528
int ssl_clear_bad_session(SSL *s)
529 530 531 532 533 534 535 536 537 538 539
	{
	if (	(s->session != NULL) &&
		!(s->shutdown & SSL_SENT_SHUTDOWN) &&
		!(SSL_in_init(s) || SSL_in_before(s)))
		{
		SSL_CTX_remove_session(s->ctx,s->session);
		return(1);
		}
	else
		return(0);
	}
540 541

/* locked by SSL_CTX in the calling function */
U
Ulf Möller 已提交
542
static void SSL_SESSION_list_remove(SSL_CTX *ctx, SSL_SESSION *s)
543 544 545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563 564 565 566 567 568 569 570 571 572 573 574
	{
	if ((s->next == NULL) || (s->prev == NULL)) return;

	if (s->next == (SSL_SESSION *)&(ctx->session_cache_tail))
		{ /* last element in list */
		if (s->prev == (SSL_SESSION *)&(ctx->session_cache_head))
			{ /* only one element in list */
			ctx->session_cache_head=NULL;
			ctx->session_cache_tail=NULL;
			}
		else
			{
			ctx->session_cache_tail=s->prev;
			s->prev->next=(SSL_SESSION *)&(ctx->session_cache_tail);
			}
		}
	else
		{
		if (s->prev == (SSL_SESSION *)&(ctx->session_cache_head))
			{ /* first element in list */
			ctx->session_cache_head=s->next;
			s->next->prev=(SSL_SESSION *)&(ctx->session_cache_head);
			}
		else
			{ /* middle of list */
			s->next->prev=s->prev;
			s->prev->next=s->next;
			}
		}
	s->prev=s->next=NULL;
	}

U
Ulf Möller 已提交
575
static void SSL_SESSION_list_add(SSL_CTX *ctx, SSL_SESSION *s)
576 577 578 579 580 581 582 583 584 585 586 587 588 589 590 591 592 593 594 595
	{
	if ((s->next != NULL) && (s->prev != NULL))
		SSL_SESSION_list_remove(ctx,s);

	if (ctx->session_cache_head == NULL)
		{
		ctx->session_cache_head=s;
		ctx->session_cache_tail=s;
		s->prev=(SSL_SESSION *)&(ctx->session_cache_head);
		s->next=(SSL_SESSION *)&(ctx->session_cache_tail);
		}
	else
		{
		s->next=ctx->session_cache_head;
		s->next->prev=s;
		s->prev=(SSL_SESSION *)&(ctx->session_cache_head);
		ctx->session_cache_head=s;
		}
	}