New tls channel id version for OpenSSL

openssl/ssl/ssl.h

 /* ssl/ssl.h */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
  * This package is an SSL implementation written
  * by Eric Young (eay@cryptsoft.com).
  * The implementation was written so as to conform with Netscapes SSL.
  * 
  * This library is free for commercial and non-commercial use as long as
  * the following conditions are aheared to.  The following conditions
@@ skipping 529 matching lines @@
         unsigned char *tlsext_ellipticcurvelist; /* peer's list */
 #endif /* OPENSSL_NO_EC */
         /* RFC4507 info */
         unsigned char *tlsext_tick;     /* Session ticket */
         size_t tlsext_ticklen;          /* Session ticket length */
         long tlsext_tick_lifetime_hint; /* Session lifetime hint in seconds */
 #endif
 #ifndef OPENSSL_NO_SRP
         char *srp_username;
 #endif
+
+        /* original_handshake_hash contains the handshake hash (either
+         * SHA-1+MD5 or SHA-2, depending on TLS version) for the original, full
+         * handshake that created a session. This is used by Channel IDs during
+         * resumption. */
+        unsigned char original_handshake_hash[EVP_MAX_MD_SIZE];
+        unsigned int original_handshake_hash_len;

[wtc, 2014/04/30 14:11:50]

Do we need to initialize original_handshake_hash_len to 0 explicitly, or is the
entire ssl_session_st struct zeroed at5 creation time?

[haavardm, 2014/04/30 17:18:50]

memset(ss,0,sizeof(SSL_SESSION)) happens in SSL_SESSION_new()

         };
 
 #endif
 
 #define SSL_OP_MICROSOFT_SESS_ID_BUG                    0x00000001L
 #define SSL_OP_NETSCAPE_CHALLENGE_BUG                   0x00000002L
 /* Allow initial connection to servers that don't support RI */
 #define SSL_OP_LEGACY_SERVER_CONNECT                    0x00000004L
 #define SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG         0x00000008L
 #define SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG              0x00000010L
@@ skipping 2102 matching lines @@
 #define SSL_R_WRONG_SIGNATURE_TYPE                       370
 #define SSL_R_WRONG_SSL_VERSION                          266
 #define SSL_R_WRONG_VERSION_NUMBER                       267
 #define SSL_R_X509_LIB                                   268
 #define SSL_R_X509_VERIFICATION_SETUP_PROBLEMS           269
 
 #ifdef  __cplusplus
 }
 #endif
 #endif