*** empty log message ***

diff --git a/lib/gnutls_handshake.c b/lib/gnutls_handshake.c
index 9106d3b0ef35557d86a08c41ba03083d15f18350..ab6dba515fb7d87780a92360b8f1fa31b21e35e7 100644 (file)
--- a/lib/gnutls_handshake.c
+++ b/lib/gnutls_handshake.c
@@ -124,7 +124,8 @@ void _gnutls_set_client_random(GNUTLS_STATE state, uint8 * random)
               TLS_RANDOM_SIZE);
 }
 
-/* Calculate The SSL3 Finished message */
+/* Calculate The SSL3 Finished message 
+ */
 #define SSL3_CLIENT_MSG "CLNT"
 #define SSL3_SERVER_MSG "SRVR"
 #define SSL_MSG_LEN 4
@@ -163,7 +164,8 @@ static int _gnutls_ssl3_finished(GNUTLS_STATE state, int type, opaque * ret)
        return 0;
 }
 
-/* Hash the handshake messages as required by TLS 1.0 */
+/* Hash the handshake messages as required by TLS 1.0 
+ */
 #define SERVER_MSG "server finished"
 #define CLIENT_MSG "client finished"
 #define TLS_MSG_LEN 15
@@ -226,12 +228,12 @@ int _gnutls_create_random(opaque * dst)
        return 0;
 }
 
-/* Read a client hello 
- * client hello must be a known version client hello
+
+/* Read a client hello packet. 
+ * A client hello must be a known version client hello
  * or version 2.0 client hello (only for compatibility
  * since SSL version 2.0 is not supported).
  */
-
 int _gnutls_read_client_hello(GNUTLS_STATE state, opaque * data,
                              int datalen)
 {
@@ -622,7 +624,8 @@ int _gnutls_server_select_suite(GNUTLS_STATE state, opaque *data, int datalen)
 }
 
 
-/* This selects the best supported compression method from the ones provided */
+/* This selects the best supported compression method from the ones provided 
+ */
 int _gnutls_server_select_comp_method(GNUTLS_STATE state, opaque * data,
                                    int datalen)
 {
@@ -1026,35 +1029,27 @@ int _gnutls_recv_handshake(GNUTLS_STATE state, uint8 ** data,
        case GNUTLS_CLIENT_HELLO:
        case GNUTLS_SERVER_HELLO:
                ret = _gnutls_recv_hello(state, dataptr, length32);
-               /* dataptr is freed because the called does not
+               /* dataptr is freed because the caller does not
                 * need it */
                gnutls_free(dataptr);
-               break;
-       case GNUTLS_CERTIFICATE_PKT:
-               ret = length32;
+               *data = NULL;
                break;
        case GNUTLS_SERVER_HELLO_DONE:
                if (length32==0) ret = 0;
                else ret = GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
                break;
+       case GNUTLS_CERTIFICATE_PKT:
        case GNUTLS_FINISHED:
-               ret = length32;
-               break;
        case GNUTLS_SERVER_KEY_EXCHANGE:
-               ret = length32;
-               break;
        case GNUTLS_CLIENT_KEY_EXCHANGE:
-               ret = length32;
-               break;
        case GNUTLS_CERTIFICATE_REQUEST:
-               ret = length32;
-               break;
        case GNUTLS_CERTIFICATE_VERIFY:
                ret = length32;
                break;
        default:
                gnutls_assert();
                gnutls_free(dataptr);
+               *data = NULL;
                ret = GNUTLS_E_UNEXPECTED_HANDSHAKE_PACKET;
        }
 

diff --git a/lib/gnutls_record.c b/lib/gnutls_record.c
index 7ef793f27c06066b62e3c5a5862b2e543555d23d..e7bf7c2d2018da9e1c9e8daa6902a0232d30f1da 100644 (file)
--- a/lib/gnutls_record.c
+++ b/lib/gnutls_record.c
@@ -766,13 +766,13 @@ ssize_t gnutls_recv_int( GNUTLS_STATE state, ContentType type, HandshakeType hty
                gnutls_afree(tmpdata);
 
                if (ret==GNUTLS_E_INT_RET_0) return 0;
-
                gnutls_assert();
                return ret;
        }
        gnutls_afree(tmpdata);
 
-       /* Get Application data from buffer */
+       /* Get Application data from buffer 
+        */
        if ((type == GNUTLS_APPLICATION_DATA || type == GNUTLS_HANDSHAKE) && (recv_type == type)) {
 
                ret = _gnutls_record_buffer_get(type, state, data, sizeofdata);
@@ -788,7 +788,6 @@ ssize_t gnutls_recv_int( GNUTLS_STATE state, ContentType type, HandshakeType hty
                                return ret2;
                        }
                }
-
        } else {
                gnutls_assert();
                ret = GNUTLS_E_UNEXPECTED_PACKET; 
@@ -796,7 +795,12 @@ ssize_t gnutls_recv_int( GNUTLS_STATE state, ContentType type, HandshakeType hty
                 */
        }
 
-       /* TLS 1.0 CBC protection. Read the next fragment.
+       /* TLS 1.0 CBC protection. 
+        * Actually this code is called if we just received
+        * an empty packet. An empty TLS packet is usually
+        * sent to protect some vulnerabilities in the CBC mode.
+        * In that case we go to the begining and start reading
+        * the next packet.
         */
        if (ret==0) {
                empty_packet++;
@@ -825,6 +829,8 @@ parse_version_number( const char *s, int *number )
 }
 
 
+/* The parse version functions were copied from libgcrypt.
+ */
 static const char *
 parse_version_string( const char *s, int *major, int *minor, int *micro )
 {