Modified the OpenSSL patch to use session ticket -specific function

This is the first step in replacing SSL_set_hello_extension() with a new
SSL_set_session_ticket_ext() function that can only be used to override the
session ticket extension, not any arbitrary TLS extension.

SSL_set_hello_extension() is still present as a simple wrapper in this
version to avoid changing the API and to make testing with wpa_supplicant
and hostapd easier. It can be eventually removed when the patch is going in
into OpenSSL distribution.

1 files changed, 51 insertions, 41 deletions

diff --git a/patches/openssl-0.9.9-session-ticket.patch b/patches/openssl-0.9.9-session-ticket.patch
index ab4fe7b..8fac16b 100644
--- a/patches/openssl-0.9.9-session-ticket.patch
+++ b/patches/openssl-0.9.9-session-ticket.patch
@@ -144,7 +144,7 @@ Index: openssl-SNAP-20081111/ssl/ssl_err.c
  {ERR_FUNC(SSL_F_TLS1_PRF),	"tls1_prf"},
  {ERR_FUNC(SSL_F_TLS1_SETUP_KEY_BLOCK),	"TLS1_SETUP_KEY_BLOCK"},
  {ERR_FUNC(SSL_F_WRITE_PENDING),	"WRITE_PENDING"},
-+{ERR_FUNC(SSL_F_SSL_SET_HELLO_EXTENSION), "SSL_set_hello_extension"},
++{ERR_FUNC(SSL_F_SSL_SET_SESSION_TICKET_EXT), "SSL_set_session_ticket_ext"},
  {0,NULL}
  	};
  
@@ -156,7 +156,7 @@ Index: openssl-SNAP-20081111/ssl/ssl.h
   * 'struct ssl_st *' function parameters used to prototype callbacks
   * in SSL_CTX. */
  typedef struct ssl_st *ssl_crock_st;
-+typedef struct tls_extension_st TLS_EXTENSION;
++typedef struct tls_session_ticket_ext_st TLS_SESSION_TICKET_EXT;
  
  /* used to hold info on the particular ciphers used */
  typedef struct ssl_cipher_st
@@ -173,8 +173,8 @@ Index: openssl-SNAP-20081111/ssl/ssl.h
  	void *tlsext_opaque_prf_input;
  	size_t tlsext_opaque_prf_input_len;
  
-+	/* TLS extensions */
-+	TLS_EXTENSION *tls_extension;
++	/* TLS Session Ticket extension override */
++	TLS_SESSION_TICKET_EXT *tlsext_session_ticket;
 +
 +	/* TLS pre-shared secret session resumption */
 +	tls_session_secret_cb_fn tls_session_secret_cb;
@@ -183,24 +183,28 @@ Index: openssl-SNAP-20081111/ssl/ssl.h
  	SSL_CTX * initial_ctx; /* initial ctx, used to store sessions */
  #define session_ctx initial_ctx
  #else
-@@ -1746,6 +1756,12 @@ void *SSL_COMP_get_compression_methods(v
+@@ -1746,6 +1756,16 @@ void *SSL_COMP_get_compression_methods(v
  int SSL_COMP_add_compression_method(int id,void *cm);
  #endif
  
-+/* TLS extensions functions */
++/* NOTE: This function will be removed; it is only here for backwards
++ * compatibility for the API during testing. */
 +int SSL_set_hello_extension(SSL *s, int ext_type, void *ext_data, int ext_len);
 +
++/* TLS extensions functions */
++int SSL_set_session_ticket_ext(SSL *s, void *ext_data, int ext_len);
++
 +/* Pre-shared secret session resumption functions */
 +int SSL_set_session_secret_cb(SSL *s, tls_session_secret_cb_fn tls_session_secret_cb, void *arg);
 +
  /* BEGIN ERROR CODES */
  /* The following lines are auto generated by the script mkerr.pl. Any changes
   * made after this point may be overwritten when the script is next run.
-@@ -1948,6 +1964,7 @@ void ERR_load_SSL_strings(void);
+@@ -1948,6 +1968,7 @@ void ERR_load_SSL_strings(void);
  #define SSL_F_TLS1_PRF					 284
  #define SSL_F_TLS1_SETUP_KEY_BLOCK			 211
  #define SSL_F_WRITE_PENDING				 212
-+#define SSL_F_SSL_SET_HELLO_EXTENSION			 213
++#define SSL_F_SSL_SET_SESSION_TICKET_EXT		 213
  
  /* Reason codes. */
  #define SSL_R_APP_DATA_IN_HANDSHAKE			 100
@@ -208,7 +212,7 @@ Index: openssl-SNAP-20081111/ssl/ssl_sess.c
 ===================================================================
 --- openssl-SNAP-20081111.orig/ssl/ssl_sess.c
 +++ openssl-SNAP-20081111/ssl/ssl_sess.c
-@@ -834,6 +834,54 @@ long SSL_CTX_get_timeout(const SSL_CTX *
+@@ -834,6 +834,62 @@ long SSL_CTX_get_timeout(const SSL_CTX *
  	return(s->session_timeout);
  	}
  
@@ -222,35 +226,33 @@ Index: openssl-SNAP-20081111/ssl/ssl_sess.c
 +	return(1);
 +	}
 +
-+int SSL_set_hello_extension(SSL *s, int ext_type, void *ext_data, int ext_len)
++int SSL_set_session_ticket_ext(SSL *s, void *ext_data, int ext_len)
 +	{
 +	if (s->version >= TLS1_VERSION)
 +		{
-+		if (s->tls_extension)
++		if (s->tlsext_session_ticket)
 +			{
-+			OPENSSL_free(s->tls_extension);
-+			s->tls_extension = NULL;
++			OPENSSL_free(s->tlsext_session_ticket);
++			s->tlsext_session_ticket = NULL;
 +			}
 +
-+		s->tls_extension = OPENSSL_malloc(sizeof(TLS_EXTENSION) + ext_len);
-+		if (!s->tls_extension)
++		s->tlsext_session_ticket = OPENSSL_malloc(sizeof(TLS_SESSION_TICKET_EXT) + ext_len);
++		if (!s->tlsext_session_ticket)
 +			{
-+			SSLerr(SSL_F_SSL_SET_HELLO_EXTENSION, ERR_R_MALLOC_FAILURE);
++			SSLerr(SSL_F_SSL_SET_SESSION_TICKET_EXT, ERR_R_MALLOC_FAILURE);
 +			return 0;
 +			}
 +
-+		s->tls_extension->type = ext_type;
-+
 +		if (ext_data)
 +			{
-+			s->tls_extension->length = ext_len;
-+			s->tls_extension->data = s->tls_extension + 1;
-+			memcpy(s->tls_extension->data, ext_data, ext_len);
++			s->tlsext_session_ticket->length = ext_len;
++			s->tlsext_session_ticket->data = s->tlsext_session_ticket + 1;
++			memcpy(s->tlsext_session_ticket->data, ext_data, ext_len);
 +			}
 +		else
 +			{
-+			s->tls_extension->length = 0;
-+			s->tls_extension->data = NULL;
++			s->tlsext_session_ticket->length = 0;
++			s->tlsext_session_ticket->data = NULL;
 +			}
 +
 +		return 1;
@@ -258,6 +260,16 @@ Index: openssl-SNAP-20081111/ssl/ssl_sess.c
 +
 +	return 0;
 +	}
++
++/* NOTE: This function will be removed; it is only here for backwards
++ * compatibility for the API during testing. */
++int SSL_set_hello_extension(SSL *s, int ext_type, void *ext_data, int ext_len)
++	{
++	if (ext_type != TLSEXT_TYPE_session_ticket)
++		return 0;
++
++	return SSL_set_session_ticket_ext(s, ext_data, ext_len);
++	}
 +#endif /* OPENSSL_NO_TLSEXT */
 +
  typedef struct timeout_param_st
@@ -272,40 +284,39 @@ Index: openssl-SNAP-20081111/ssl/t1_lib.c
  void tls1_free(SSL *s)
  	{
 +#ifndef OPENSSL_NO_TLSEXT
-+	if (s->tls_extension)
++	if (s->tlsext_session_ticket)
 +		{
-+		OPENSSL_free(s->tls_extension);
++		OPENSSL_free(s->tlsext_session_ticket);
 +		}
 +#endif /* OPENSSL_NO_TLSEXT */
  	ssl3_free(s);
  	}
  
-@@ -357,8 +363,24 @@ unsigned char *ssl_add_clienthello_tlsex
+@@ -357,8 +363,23 @@ unsigned char *ssl_add_clienthello_tlsex
  		int ticklen;
  		if (s->session && s->session->tlsext_tick)
  			ticklen = s->session->tlsext_ticklen;
-+		else if (s->session && s->tls_extension &&
-+			 s->tls_extension->type == TLSEXT_TYPE_session_ticket &&
-+			 s->tls_extension->data)
++		else if (s->session && s->tlsext_session_ticket &&
++			 s->tlsext_session_ticket->data)
 +			{
-+			ticklen = s->tls_extension->length;
++			ticklen = s->tlsext_session_ticket->length;
 +			s->session->tlsext_tick = OPENSSL_malloc(ticklen);
 +			if (!s->session->tlsext_tick)
 +				return NULL;
-+			memcpy(s->session->tlsext_tick, s->tls_extension->data,
++			memcpy(s->session->tlsext_tick,
++			       s->tlsext_session_ticket->data,
 +			       ticklen);
 +			s->session->tlsext_ticklen = ticklen;
 +			}
  		else
  			ticklen = 0;
-+		if (ticklen == 0 && s->tls_extension &&
-+		    s->tls_extension->type == TLSEXT_TYPE_session_ticket &&
-+		    s->tls_extension->data == NULL)
++		if (ticklen == 0 && s->tlsext_session_ticket &&
++		    s->tlsext_session_ticket->data == NULL)
 +			goto skip_ext;
  		/* Check for enough room 2 for extension type, 2 for len
   		 * rest for ticket
    		 */
-@@ -371,6 +393,7 @@ unsigned char *ssl_add_clienthello_tlsex
+@@ -371,6 +392,7 @@ unsigned char *ssl_add_clienthello_tlsex
  			ret += ticklen;
  			}
  		}
@@ -313,7 +324,7 @@ Index: openssl-SNAP-20081111/ssl/t1_lib.c
  
  #ifdef TLSEXT_TYPE_opaque_prf_input
  	if (s->s3->client_opaque_prf_input != NULL)
-@@ -1435,6 +1458,15 @@ int tls1_process_ticket(SSL *s, unsigned
+@@ -1435,6 +1457,15 @@ int tls1_process_ticket(SSL *s, unsigned
  				s->tlsext_ticket_expected = 1;
  				return 0;	/* Cache miss */
  				}
@@ -333,14 +344,13 @@ Index: openssl-SNAP-20081111/ssl/tls1.h
 ===================================================================
 --- openssl-SNAP-20081111.orig/ssl/tls1.h
 +++ openssl-SNAP-20081111/ssl/tls1.h
-@@ -512,6 +512,14 @@ SSL_CTX_callback_ctrl(ssl,SSL_CTRL_SET_T
+@@ -512,6 +512,13 @@ SSL_CTX_callback_ctrl(ssl,SSL_CTRL_SET_T
  #define TLS_MD_MASTER_SECRET_CONST    "\x6d\x61\x73\x74\x65\x72\x20\x73\x65\x63\x72\x65\x74"  /*master secret*/
  #endif
  
-+/* TLS extension struct */
-+struct tls_extension_st
++/* TLS Session Ticket extension struct */
++struct tls_session_ticket_ext_st
 +	{
-+	unsigned short type;
 +	unsigned short length;
 +	void *data;
 +	};
@@ -356,5 +366,5 @@ Index: openssl-SNAP-20081111/util/ssleay.num
  SSL_CTX_set_psk_server_callback         303	EXIST::FUNCTION:PSK
  SSL_get_psk_identity                    304	EXIST::FUNCTION:PSK
  PEM_write_SSL_SESSION                   305	EXIST:!WIN16:FUNCTION:
-+SSL_set_hello_extension			306	EXIST::FUNCTION:TLSEXT
++SSL_set_session_ticket_ext		306	EXIST::FUNCTION:TLSEXT
 +SSL_set_session_secret_cb		307	EXIST::FUNCTION:TLSEXT