Free generated supp data after handshake completion, add comment regarding use of num_renegotiations in TLS and supp data generation callbacks
diff --git a/apps/s_server.c b/apps/s_server.c
index 29189fd..44acb1e 100644
--- a/apps/s_server.c
+++ b/apps/s_server.c
@@ -229,8 +229,10 @@
static const unsigned char auth_ext_data[]={TLSEXT_AUTHZDATAFORMAT_dtcp};
-static const unsigned char *most_recent_supplemental_data;
-static size_t most_recent_supplemental_data_length;
+static unsigned char *generated_supp_data = NULL;
+
+static unsigned char *most_recent_supplemental_data = NULL;
+static size_t most_recent_supplemental_data_length = 0;
static int client_provided_server_authz = 0;
static int client_provided_client_authz = 0;
@@ -2673,6 +2675,13 @@
i=SSL_accept(con);
}
#endif
+ /*handshake is complete - free the generated supp data allocated in the callback */
+ if (generated_supp_data)
+ {
+ OPENSSL_free(generated_supp_data);
+ generated_supp_data = NULL;
+ }
+
if (i <= 0)
{
if (BIO_sock_should_retry(i))
@@ -3583,6 +3592,8 @@
{
if (c_auth && client_provided_client_authz && client_provided_server_authz)
{
+ /*if auth_require_reneg flag is set, only send extensions if
+ renegotiation has occurred */
if (!c_auth_require_reneg
|| (c_auth_require_reneg && SSL_num_renegotiations(s)))
{
@@ -3612,15 +3623,16 @@
const unsigned char **out,
unsigned short *outlen, void *arg)
{
- unsigned char *result;
if (c_auth && client_provided_client_authz && client_provided_server_authz)
{
+ /*if auth_require_reneg flag is set, only send supplemental data if
+ renegotiation has occurred */
if (!c_auth_require_reneg
|| (c_auth_require_reneg && SSL_num_renegotiations(s)))
{
- result = OPENSSL_malloc(10);
- memcpy(result, "1234512345", 10);
- *out = result;
+ generated_supp_data = OPENSSL_malloc(10);
+ memcpy(generated_supp_data, "1234512345", 10);
+ *out = generated_supp_data;
*outlen = 10;
return 1;
}
