1252190SrpauloThis patch adds support for TLS SessionTicket extension (RFC 5077) for 2252190Srpaulothe parts used by EAP-FAST (RFC 4851). 3252190Srpaulo 4252190SrpauloThis is based on the patch from Alexey Kobozev <akobozev@cisco.com> 5252190Srpaulo(sent to openssl-dev mailing list on Tue, 07 Jun 2005 15:40:58 +0300). 6252190Srpaulo 7252190SrpauloOpenSSL 0.9.8x does not enable TLS extension support by default, so it 8252190Srpaulowill need to be enabled by adding enable-tlsext to config script 9252190Srpaulocommand line. 10252190Srpaulo 11252190Srpaulo 12252190Srpaulodiff -upr openssl-0.9.8x.orig/ssl/s3_clnt.c openssl-0.9.8x/ssl/s3_clnt.c 13252190Srpaulo--- openssl-0.9.8x.orig/ssl/s3_clnt.c 2011-12-26 21:38:28.000000000 +0200 14252190Srpaulo+++ openssl-0.9.8x/ssl/s3_clnt.c 2012-07-07 10:46:31.501140621 +0300 15252190Srpaulo@@ -757,6 +757,21 @@ int ssl3_get_server_hello(SSL *s) 16252190Srpaulo goto f_err; 17252190Srpaulo } 18252190Srpaulo 19252190Srpaulo+#ifndef OPENSSL_NO_TLSEXT 20252190Srpaulo+ /* check if we want to resume the session based on external pre-shared secret */ 21252190Srpaulo+ if (s->version >= TLS1_VERSION && s->tls_session_secret_cb) 22252190Srpaulo+ { 23252190Srpaulo+ SSL_CIPHER *pref_cipher=NULL; 24252190Srpaulo+ s->session->master_key_length=sizeof(s->session->master_key); 25252190Srpaulo+ if (s->tls_session_secret_cb(s, s->session->master_key, &s->session->master_key_length, 26252190Srpaulo+ NULL, &pref_cipher, s->tls_session_secret_cb_arg)) 27252190Srpaulo+ { 28252190Srpaulo+ s->session->cipher=pref_cipher ? 29252190Srpaulo+ pref_cipher : ssl_get_cipher_by_char(s,p+j); 30252190Srpaulo+ } 31252190Srpaulo+ } 32252190Srpaulo+#endif /* OPENSSL_NO_TLSEXT */ 33252190Srpaulo+ 34252190Srpaulo if (j != 0 && j == s->session->session_id_length 35252190Srpaulo && memcmp(p,s->session->session_id,j) == 0) 36252190Srpaulo { 37252190Srpaulo@@ -2725,11 +2740,8 @@ int ssl3_check_finished(SSL *s) 38252190Srpaulo { 39252190Srpaulo int ok; 40252190Srpaulo long n; 41252190Srpaulo- /* If we have no ticket or session ID is non-zero length (a match of 42252190Srpaulo- * a non-zero session length would never reach here) it cannot be a 43252190Srpaulo- * resumed session. 44252190Srpaulo- */ 45252190Srpaulo- if (!s->session->tlsext_tick || s->session->session_id_length) 46252190Srpaulo+ /* If we have no ticket it cannot be a resumed session. */ 47252190Srpaulo+ if (!s->session->tlsext_tick) 48252190Srpaulo return 1; 49252190Srpaulo /* this function is called when we really expect a Certificate 50252190Srpaulo * message, so permit appropriate message length */ 51252190Srpaulodiff -upr openssl-0.9.8x.orig/ssl/s3_srvr.c openssl-0.9.8x/ssl/s3_srvr.c 52252190Srpaulo--- openssl-0.9.8x.orig/ssl/s3_srvr.c 2012-02-16 17:21:17.000000000 +0200 53252190Srpaulo+++ openssl-0.9.8x/ssl/s3_srvr.c 2012-07-07 10:46:31.501140621 +0300 54252190Srpaulo@@ -1009,6 +1009,59 @@ int ssl3_get_client_hello(SSL *s) 55252190Srpaulo SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_CLIENTHELLO_TLSEXT); 56252190Srpaulo goto err; 57252190Srpaulo } 58252190Srpaulo+ 59252190Srpaulo+ /* Check if we want to use external pre-shared secret for this 60252190Srpaulo+ * handshake for not reused session only. We need to generate 61252190Srpaulo+ * server_random before calling tls_session_secret_cb in order to allow 62252190Srpaulo+ * SessionTicket processing to use it in key derivation. */ 63252190Srpaulo+ { 64252190Srpaulo+ unsigned long Time; 65252190Srpaulo+ unsigned char *pos; 66252190Srpaulo+ Time=(unsigned long)time(NULL); /* Time */ 67252190Srpaulo+ pos=s->s3->server_random; 68252190Srpaulo+ l2n(Time,pos); 69252190Srpaulo+ if (RAND_pseudo_bytes(pos,SSL3_RANDOM_SIZE-4) <= 0) 70252190Srpaulo+ { 71252190Srpaulo+ al=SSL_AD_INTERNAL_ERROR; 72252190Srpaulo+ goto f_err; 73252190Srpaulo+ } 74252190Srpaulo+ } 75252190Srpaulo+ 76252190Srpaulo+ if (!s->hit && s->version >= TLS1_VERSION && s->tls_session_secret_cb) 77252190Srpaulo+ { 78252190Srpaulo+ SSL_CIPHER *pref_cipher=NULL; 79252190Srpaulo+ 80252190Srpaulo+ s->session->master_key_length=sizeof(s->session->master_key); 81252190Srpaulo+ if(s->tls_session_secret_cb(s, s->session->master_key, &s->session->master_key_length, 82252190Srpaulo+ ciphers, &pref_cipher, s->tls_session_secret_cb_arg)) 83252190Srpaulo+ { 84252190Srpaulo+ s->hit=1; 85252190Srpaulo+ s->session->ciphers=ciphers; 86252190Srpaulo+ s->session->verify_result=X509_V_OK; 87252190Srpaulo+ 88252190Srpaulo+ ciphers=NULL; 89252190Srpaulo+ 90252190Srpaulo+ /* check if some cipher was preferred by call back */ 91252190Srpaulo+ pref_cipher=pref_cipher ? pref_cipher : ssl3_choose_cipher(s, s->session->ciphers, SSL_get_ciphers(s)); 92252190Srpaulo+ if (pref_cipher == NULL) 93252190Srpaulo+ { 94252190Srpaulo+ al=SSL_AD_HANDSHAKE_FAILURE; 95252190Srpaulo+ SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_NO_SHARED_CIPHER); 96252190Srpaulo+ goto f_err; 97252190Srpaulo+ } 98252190Srpaulo+ 99252190Srpaulo+ s->session->cipher=pref_cipher; 100252190Srpaulo+ 101252190Srpaulo+ if (s->cipher_list) 102252190Srpaulo+ sk_SSL_CIPHER_free(s->cipher_list); 103252190Srpaulo+ 104252190Srpaulo+ if (s->cipher_list_by_id) 105252190Srpaulo+ sk_SSL_CIPHER_free(s->cipher_list_by_id); 106252190Srpaulo+ 107252190Srpaulo+ s->cipher_list = sk_SSL_CIPHER_dup(s->session->ciphers); 108252190Srpaulo+ s->cipher_list_by_id = sk_SSL_CIPHER_dup(s->session->ciphers); 109252190Srpaulo+ } 110252190Srpaulo+ } 111252190Srpaulo #endif 112252190Srpaulo /* Worst case, we will use the NULL compression, but if we have other 113252190Srpaulo * options, we will now look for them. We have i-1 compression 114252190Srpaulo@@ -1147,16 +1200,22 @@ int ssl3_send_server_hello(SSL *s) 115252190Srpaulo unsigned char *buf; 116252190Srpaulo unsigned char *p,*d; 117252190Srpaulo int i,sl; 118252190Srpaulo- unsigned long l,Time; 119252190Srpaulo+ unsigned long l; 120252190Srpaulo+#ifdef OPENSSL_NO_TLSEXT 121252190Srpaulo+ unsigned long Time; 122252190Srpaulo+#endif 123252190Srpaulo 124252190Srpaulo if (s->state == SSL3_ST_SW_SRVR_HELLO_A) 125252190Srpaulo { 126252190Srpaulo buf=(unsigned char *)s->init_buf->data; 127252190Srpaulo+#ifdef OPENSSL_NO_TLSEXT 128252190Srpaulo p=s->s3->server_random; 129252190Srpaulo+ /* Generate server_random if it was not needed previously */ 130252190Srpaulo Time=(unsigned long)time(NULL); /* Time */ 131252190Srpaulo l2n(Time,p); 132252190Srpaulo if (RAND_pseudo_bytes(p,SSL3_RANDOM_SIZE-4) <= 0) 133252190Srpaulo return -1; 134252190Srpaulo+#endif 135252190Srpaulo /* Do the message type and length last */ 136252190Srpaulo d=p= &(buf[4]); 137252190Srpaulo 138252190Srpaulodiff -upr openssl-0.9.8x.orig/ssl/ssl_err.c openssl-0.9.8x/ssl/ssl_err.c 139252190Srpaulo--- openssl-0.9.8x.orig/ssl/ssl_err.c 2012-03-12 16:50:55.000000000 +0200 140252190Srpaulo+++ openssl-0.9.8x/ssl/ssl_err.c 2012-07-07 10:46:31.501140621 +0300 141252190Srpaulo@@ -264,6 +264,7 @@ static ERR_STRING_DATA SSL_str_functs[]= 142252190Srpaulo {ERR_FUNC(SSL_F_TLS1_ENC), "TLS1_ENC"}, 143252190Srpaulo {ERR_FUNC(SSL_F_TLS1_SETUP_KEY_BLOCK), "TLS1_SETUP_KEY_BLOCK"}, 144252190Srpaulo {ERR_FUNC(SSL_F_WRITE_PENDING), "WRITE_PENDING"}, 145252190Srpaulo+{ERR_FUNC(SSL_F_SSL_SET_SESSION_TICKET_EXT), "SSL_set_session_ticket_ext"}, 146252190Srpaulo {0,NULL} 147252190Srpaulo }; 148252190Srpaulo 149252190Srpaulodiff -upr openssl-0.9.8x.orig/ssl/ssl.h openssl-0.9.8x/ssl/ssl.h 150252190Srpaulo--- openssl-0.9.8x.orig/ssl/ssl.h 2012-03-12 16:50:55.000000000 +0200 151252190Srpaulo+++ openssl-0.9.8x/ssl/ssl.h 2012-07-07 10:46:31.501140621 +0300 152252190Srpaulo@@ -344,6 +344,7 @@ extern "C" { 153252190Srpaulo * 'struct ssl_st *' function parameters used to prototype callbacks 154252190Srpaulo * in SSL_CTX. */ 155252190Srpaulo typedef struct ssl_st *ssl_crock_st; 156252190Srpaulo+typedef struct tls_session_ticket_ext_st TLS_SESSION_TICKET_EXT; 157252190Srpaulo 158252190Srpaulo /* used to hold info on the particular ciphers used */ 159252190Srpaulo typedef struct ssl_cipher_st 160252190Srpaulo@@ -362,6 +363,9 @@ typedef struct ssl_cipher_st 161252190Srpaulo 162252190Srpaulo DECLARE_STACK_OF(SSL_CIPHER) 163252190Srpaulo 164252190Srpaulo+typedef int (*tls_session_ticket_ext_cb_fn)(SSL *s, const unsigned char *data, int len, void *arg); 165252190Srpaulo+typedef int (*tls_session_secret_cb_fn)(SSL *s, void *secret, int *secret_len, STACK_OF(SSL_CIPHER) *peer_ciphers, SSL_CIPHER **cipher, void *arg); 166252190Srpaulo+ 167252190Srpaulo /* Used to hold functions for SSLv2 or SSLv3/TLSv1 functions */ 168252190Srpaulo typedef struct ssl_method_st 169252190Srpaulo { 170252190Srpaulo@@ -1050,6 +1054,18 @@ struct ssl_st 171252190Srpaulo 172252190Srpaulo /* RFC4507 session ticket expected to be received or sent */ 173252190Srpaulo int tlsext_ticket_expected; 174252190Srpaulo+ 175252190Srpaulo+ /* TLS Session Ticket extension override */ 176252190Srpaulo+ TLS_SESSION_TICKET_EXT *tlsext_session_ticket; 177252190Srpaulo+ 178252190Srpaulo+ /* TLS Session Ticket extension callback */ 179252190Srpaulo+ tls_session_ticket_ext_cb_fn tls_session_ticket_ext_cb; 180252190Srpaulo+ void *tls_session_ticket_ext_cb_arg; 181252190Srpaulo+ 182252190Srpaulo+ /* TLS pre-shared secret session resumption */ 183252190Srpaulo+ tls_session_secret_cb_fn tls_session_secret_cb; 184252190Srpaulo+ void *tls_session_secret_cb_arg; 185252190Srpaulo+ 186252190Srpaulo SSL_CTX * initial_ctx; /* initial ctx, used to store sessions */ 187252190Srpaulo #define session_ctx initial_ctx 188252190Srpaulo #else 189252190Srpaulo@@ -1663,6 +1679,15 @@ void *SSL_COMP_get_compression_methods(v 190252190Srpaulo int SSL_COMP_add_compression_method(int id,void *cm); 191252190Srpaulo #endif 192252190Srpaulo 193252190Srpaulo+/* TLS extensions functions */ 194252190Srpaulo+int SSL_set_session_ticket_ext(SSL *s, void *ext_data, int ext_len); 195252190Srpaulo+ 196252190Srpaulo+int SSL_set_session_ticket_ext_cb(SSL *s, tls_session_ticket_ext_cb_fn cb, 197252190Srpaulo+ void *arg); 198252190Srpaulo+ 199252190Srpaulo+/* Pre-shared secret session resumption functions */ 200252190Srpaulo+int SSL_set_session_secret_cb(SSL *s, tls_session_secret_cb_fn tls_session_secret_cb, void *arg); 201252190Srpaulo+ 202252190Srpaulo /* BEGIN ERROR CODES */ 203252190Srpaulo /* The following lines are auto generated by the script mkerr.pl. Any changes 204252190Srpaulo * made after this point may be overwritten when the script is next run. 205252190Srpaulo@@ -1866,6 +1891,7 @@ void ERR_load_SSL_strings(void); 206252190Srpaulo #define SSL_F_TLS1_ENC 210 207252190Srpaulo #define SSL_F_TLS1_SETUP_KEY_BLOCK 211 208252190Srpaulo #define SSL_F_WRITE_PENDING 212 209252190Srpaulo+#define SSL_F_SSL_SET_SESSION_TICKET_EXT 213 210252190Srpaulo 211252190Srpaulo /* Reason codes. */ 212252190Srpaulo #define SSL_R_APP_DATA_IN_HANDSHAKE 100 213252190Srpaulodiff -upr openssl-0.9.8x.orig/ssl/ssl_sess.c openssl-0.9.8x/ssl/ssl_sess.c 214252190Srpaulo--- openssl-0.9.8x.orig/ssl/ssl_sess.c 2010-02-01 18:48:40.000000000 +0200 215252190Srpaulo+++ openssl-0.9.8x/ssl/ssl_sess.c 2012-07-07 10:46:31.501140621 +0300 216252190Srpaulo@@ -712,6 +712,61 @@ long SSL_CTX_get_timeout(const SSL_CTX * 217252190Srpaulo return(s->session_timeout); 218252190Srpaulo } 219252190Srpaulo 220252190Srpaulo+#ifndef OPENSSL_NO_TLSEXT 221252190Srpaulo+int SSL_set_session_secret_cb(SSL *s, int (*tls_session_secret_cb)(SSL *s, void *secret, int *secret_len, 222252190Srpaulo+ STACK_OF(SSL_CIPHER) *peer_ciphers, SSL_CIPHER **cipher, void *arg), void *arg) 223252190Srpaulo+ { 224252190Srpaulo+ if (s == NULL) return(0); 225252190Srpaulo+ s->tls_session_secret_cb = tls_session_secret_cb; 226252190Srpaulo+ s->tls_session_secret_cb_arg = arg; 227252190Srpaulo+ return(1); 228252190Srpaulo+ } 229252190Srpaulo+ 230252190Srpaulo+int SSL_set_session_ticket_ext_cb(SSL *s, tls_session_ticket_ext_cb_fn cb, 231252190Srpaulo+ void *arg) 232252190Srpaulo+ { 233252190Srpaulo+ if (s == NULL) return(0); 234252190Srpaulo+ s->tls_session_ticket_ext_cb = cb; 235252190Srpaulo+ s->tls_session_ticket_ext_cb_arg = arg; 236252190Srpaulo+ return(1); 237252190Srpaulo+ } 238252190Srpaulo+ 239252190Srpaulo+int SSL_set_session_ticket_ext(SSL *s, void *ext_data, int ext_len) 240252190Srpaulo+ { 241252190Srpaulo+ if (s->version >= TLS1_VERSION) 242252190Srpaulo+ { 243252190Srpaulo+ if (s->tlsext_session_ticket) 244252190Srpaulo+ { 245252190Srpaulo+ OPENSSL_free(s->tlsext_session_ticket); 246252190Srpaulo+ s->tlsext_session_ticket = NULL; 247252190Srpaulo+ } 248252190Srpaulo+ 249252190Srpaulo+ s->tlsext_session_ticket = OPENSSL_malloc(sizeof(TLS_SESSION_TICKET_EXT) + ext_len); 250252190Srpaulo+ if (!s->tlsext_session_ticket) 251252190Srpaulo+ { 252252190Srpaulo+ SSLerr(SSL_F_SSL_SET_SESSION_TICKET_EXT, ERR_R_MALLOC_FAILURE); 253252190Srpaulo+ return 0; 254252190Srpaulo+ } 255252190Srpaulo+ 256252190Srpaulo+ if (ext_data) 257252190Srpaulo+ { 258252190Srpaulo+ s->tlsext_session_ticket->length = ext_len; 259252190Srpaulo+ s->tlsext_session_ticket->data = s->tlsext_session_ticket + 1; 260252190Srpaulo+ memcpy(s->tlsext_session_ticket->data, ext_data, ext_len); 261252190Srpaulo+ } 262252190Srpaulo+ else 263252190Srpaulo+ { 264252190Srpaulo+ s->tlsext_session_ticket->length = 0; 265252190Srpaulo+ s->tlsext_session_ticket->data = NULL; 266252190Srpaulo+ } 267252190Srpaulo+ 268252190Srpaulo+ return 1; 269252190Srpaulo+ } 270252190Srpaulo+ 271252190Srpaulo+ return 0; 272252190Srpaulo+ } 273252190Srpaulo+#endif /* OPENSSL_NO_TLSEXT */ 274252190Srpaulo+ 275252190Srpaulo typedef struct timeout_param_st 276252190Srpaulo { 277252190Srpaulo SSL_CTX *ctx; 278252190Srpaulodiff -upr openssl-0.9.8x.orig/ssl/t1_lib.c openssl-0.9.8x/ssl/t1_lib.c 279252190Srpaulo--- openssl-0.9.8x.orig/ssl/t1_lib.c 2012-01-04 16:25:10.000000000 +0200 280252190Srpaulo+++ openssl-0.9.8x/ssl/t1_lib.c 2012-07-07 10:47:31.153140501 +0300 281252190Srpaulo@@ -106,6 +106,12 @@ int tls1_new(SSL *s) 282252190Srpaulo 283252190Srpaulo void tls1_free(SSL *s) 284252190Srpaulo { 285252190Srpaulo+#ifndef OPENSSL_NO_TLSEXT 286252190Srpaulo+ if (s->tlsext_session_ticket) 287252190Srpaulo+ { 288252190Srpaulo+ OPENSSL_free(s->tlsext_session_ticket); 289252190Srpaulo+ } 290252190Srpaulo+#endif 291252190Srpaulo ssl3_free(s); 292252190Srpaulo } 293252190Srpaulo 294252190Srpaulo@@ -206,8 +212,23 @@ unsigned char *ssl_add_clienthello_tlsex 295252190Srpaulo int ticklen; 296252190Srpaulo if (!s->new_session && s->session && s->session->tlsext_tick) 297252190Srpaulo ticklen = s->session->tlsext_ticklen; 298252190Srpaulo+ else if (s->session && s->tlsext_session_ticket && 299252190Srpaulo+ s->tlsext_session_ticket->data) 300252190Srpaulo+ { 301252190Srpaulo+ ticklen = s->tlsext_session_ticket->length; 302252190Srpaulo+ s->session->tlsext_tick = OPENSSL_malloc(ticklen); 303252190Srpaulo+ if (!s->session->tlsext_tick) 304252190Srpaulo+ return NULL; 305252190Srpaulo+ memcpy(s->session->tlsext_tick, 306252190Srpaulo+ s->tlsext_session_ticket->data, 307252190Srpaulo+ ticklen); 308252190Srpaulo+ s->session->tlsext_ticklen = ticklen; 309252190Srpaulo+ } 310252190Srpaulo else 311252190Srpaulo ticklen = 0; 312252190Srpaulo+ if (ticklen == 0 && s->tlsext_session_ticket && 313252190Srpaulo+ s->tlsext_session_ticket->data == NULL) 314252190Srpaulo+ goto skip_ext; 315252190Srpaulo /* Check for enough room 2 for extension type, 2 for len 316252190Srpaulo * rest for ticket 317252190Srpaulo */ 318252190Srpaulo@@ -221,6 +242,7 @@ unsigned char *ssl_add_clienthello_tlsex 319252190Srpaulo ret += ticklen; 320252190Srpaulo } 321252190Srpaulo } 322252190Srpaulo+ skip_ext: 323252190Srpaulo 324252190Srpaulo if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp && 325252190Srpaulo s->version != DTLS1_VERSION) 326252190Srpaulo@@ -486,6 +508,15 @@ int ssl_parse_clienthello_tlsext(SSL *s, 327252190Srpaulo return 0; 328252190Srpaulo renegotiate_seen = 1; 329252190Srpaulo } 330252190Srpaulo+ else if (type == TLSEXT_TYPE_session_ticket) 331252190Srpaulo+ { 332252190Srpaulo+ if (s->tls_session_ticket_ext_cb && 333252190Srpaulo+ !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg)) 334252190Srpaulo+ { 335252190Srpaulo+ *al = TLS1_AD_INTERNAL_ERROR; 336252190Srpaulo+ return 0; 337252190Srpaulo+ } 338252190Srpaulo+ } 339252190Srpaulo else if (type == TLSEXT_TYPE_status_request && 340252190Srpaulo s->version != DTLS1_VERSION && s->ctx->tlsext_status_cb) 341252190Srpaulo { 342252190Srpaulo@@ -663,6 +694,12 @@ int ssl_parse_serverhello_tlsext(SSL *s, 343252190Srpaulo } 344252190Srpaulo else if (type == TLSEXT_TYPE_session_ticket) 345252190Srpaulo { 346252190Srpaulo+ if (s->tls_session_ticket_ext_cb && 347252190Srpaulo+ !s->tls_session_ticket_ext_cb(s, data, size, s->tls_session_ticket_ext_cb_arg)) 348252190Srpaulo+ { 349252190Srpaulo+ *al = TLS1_AD_INTERNAL_ERROR; 350252190Srpaulo+ return 0; 351252190Srpaulo+ } 352252190Srpaulo if ((SSL_get_options(s) & SSL_OP_NO_TICKET) 353252190Srpaulo || (size > 0)) 354252190Srpaulo { 355252190Srpaulo@@ -920,6 +957,15 @@ int tls1_process_ticket(SSL *s, unsigned 356252190Srpaulo s->tlsext_ticket_expected = 1; 357252190Srpaulo return 0; /* Cache miss */ 358252190Srpaulo } 359252190Srpaulo+ if (s->tls_session_secret_cb) 360252190Srpaulo+ { 361252190Srpaulo+ /* Indicate cache miss here and instead of 362252190Srpaulo+ * generating the session from ticket now, 363252190Srpaulo+ * trigger abbreviated handshake based on 364252190Srpaulo+ * external mechanism to calculate the master 365252190Srpaulo+ * secret later. */ 366252190Srpaulo+ return 0; 367252190Srpaulo+ } 368252190Srpaulo return tls_decrypt_ticket(s, p, size, session_id, len, 369252190Srpaulo ret); 370252190Srpaulo } 371252190Srpaulodiff -upr openssl-0.9.8x.orig/ssl/tls1.h openssl-0.9.8x/ssl/tls1.h 372252190Srpaulo--- openssl-0.9.8x.orig/ssl/tls1.h 2009-11-08 16:51:54.000000000 +0200 373252190Srpaulo+++ openssl-0.9.8x/ssl/tls1.h 2012-07-07 10:46:31.501140621 +0300 374252190Srpaulo@@ -401,6 +401,13 @@ SSL_CTX_callback_ctrl(ssl,SSL_CTRL_SET_T 375252190Srpaulo #define TLS_MD_MASTER_SECRET_CONST "\x6d\x61\x73\x74\x65\x72\x20\x73\x65\x63\x72\x65\x74" /*master secret*/ 376252190Srpaulo #endif 377252190Srpaulo 378252190Srpaulo+/* TLS extension struct */ 379252190Srpaulo+struct tls_session_ticket_ext_st 380252190Srpaulo+ { 381252190Srpaulo+ unsigned short length; 382252190Srpaulo+ void *data; 383252190Srpaulo+ }; 384252190Srpaulo+ 385252190Srpaulo #ifdef __cplusplus 386252190Srpaulo } 387252190Srpaulo #endif 388252190Srpaulodiff -upr openssl-0.9.8x.orig/util/ssleay.num openssl-0.9.8x/util/ssleay.num 389252190Srpaulo--- openssl-0.9.8x.orig/util/ssleay.num 2008-06-05 13:57:21.000000000 +0300 390252190Srpaulo+++ openssl-0.9.8x/util/ssleay.num 2012-07-07 10:46:31.505140623 +0300 391252190Srpaulo@@ -242,3 +242,5 @@ SSL_set_SSL_CTX 392252190Srpaulo SSL_get_servername 291 EXIST::FUNCTION:TLSEXT 393252190Srpaulo SSL_get_servername_type 292 EXIST::FUNCTION:TLSEXT 394252190Srpaulo SSL_CTX_set_client_cert_engine 293 EXIST::FUNCTION:ENGINE 395252190Srpaulo+SSL_set_session_ticket_ext 306 EXIST::FUNCTION:TLSEXT 396252190Srpaulo+SSL_set_session_secret_cb 307 EXIST::FUNCTION:TLSEXT 397