major cleanups

diff --git a/lib/gnutls.c b/lib/gnutls.c
index 5e56a191ea1694fd06f818a6dd97a1d685684443..ee4f5e82f61edeb11fc023529f9319ba87d6d601 100644 (file)
--- a/lib/gnutls.c
+++ b/lib/gnutls.c
@@ -77,16 +77,9 @@ int gnutls_init(GNUTLS_STATE * state, ConnectionEnd con_end)
 
        (*state)->gnutls_internals.buffer = NULL;
        /* SSL3 stuff */
-       (*state)->gnutls_internals.client_hash_buffer = NULL;
-       (*state)->gnutls_internals.server_hash_buffer = NULL;
+       (*state)->gnutls_internals.hash_buffer = NULL;
        
        (*state)->gnutls_internals.buffer_handshake = NULL;
-       (*state)->gnutls_internals.client_md_md5 = NULL;
-       (*state)->gnutls_internals.client_md_sha1 = NULL;
-       (*state)->gnutls_internals.server_md_md5 = NULL;
-       (*state)->gnutls_internals.server_md_sha1 = NULL;
-       (*state)->gnutls_internals.server_hash = 0;
-       (*state)->gnutls_internals.client_hash = 0;
        (*state)->gnutls_internals.resumable = RESUME_TRUE;
 
        gnutls_set_current_version ( (*state), GNUTLS_TLS1); /* default */

diff --git a/lib/gnutls_buffers.c b/lib/gnutls_buffers.c
index 689d2ed03f3a87d87b1f17412be7e1237513fad3..a8bd6db00723ee48b1902045f6d2ec7f7c1598d5 100644 (file)
--- a/lib/gnutls_buffers.c
+++ b/lib/gnutls_buffers.c
@@ -227,130 +227,75 @@ ssize_t _gnutls_Recv_int(int fd, GNUTLS_STATE state, ContentType type, void *ipt
        return (sizeOfPtr - left);
 }
 
-int gnutls_insertHashDataBuffer( int type, GNUTLS_STATE state, char *data, int length)
+int gnutls_insertHashDataBuffer( GNUTLS_STATE state, char *data, int length)
 {
        int old_buffer;
        
-       if (type==GNUTLS_SERVER) {
-               old_buffer = state->gnutls_internals.server_hash_bufferSize;
+       old_buffer = state->gnutls_internals.hash_bufferSize;
 
-               state->gnutls_internals.server_hash_bufferSize += length;
-#ifdef HARD_DEBUG
-       fprintf(stderr, "Inserted %d bytes of SSL3 Server Hash Data(%d) into buffer\n", length, type);
+       state->gnutls_internals.hash_bufferSize += length;
+#ifdef HANDSHAKE_DEBUG
+       fprintf(stderr, "Inserted %d bytes of Hash Data into buffer\n", length);
 #endif
-               state->gnutls_internals.server_hash_buffer =
-                           gnutls_realloc(state->gnutls_internals.server_hash_buffer,
-                                  state->gnutls_internals.server_hash_bufferSize);
-                       memmove(&state->gnutls_internals.server_hash_buffer[old_buffer], data, length);
-
-       } else { /* GNUTLS_CLIENT */
-               old_buffer = state->gnutls_internals.client_hash_bufferSize;
+       state->gnutls_internals.hash_buffer =
+                   gnutls_realloc(state->gnutls_internals.hash_buffer,
+                          state->gnutls_internals.hash_bufferSize);
+               memmove(&state->gnutls_internals.hash_buffer[old_buffer], data, length);
 
-               state->gnutls_internals.client_hash_bufferSize += length;
-#ifdef HARD_DEBUG
-       fprintf(stderr, "Inserted %d bytes of SSL3 Client Hash Data(%d) into buffer\n", length, type);
-#endif
-               state->gnutls_internals.client_hash_buffer =
-                           gnutls_realloc(state->gnutls_internals.client_hash_buffer,
-                                  state->gnutls_internals.client_hash_bufferSize);
-                       memmove(&state->gnutls_internals.client_hash_buffer[old_buffer], data, length);
-       }
        return 0;
 }
 
-int gnutls_getHashDataBufferSize( int type, GNUTLS_STATE state)
+int gnutls_getHashDataBufferSize( GNUTLS_STATE state)
 {
-       if (type==GNUTLS_SERVER) {
-               return state->gnutls_internals.server_hash_bufferSize;
-       } else {
-               return state->gnutls_internals.client_hash_bufferSize;
-       }
+
+       return state->gnutls_internals.hash_bufferSize;
 }
 
-int gnutls_getHashDataFromBuffer(int type, GNUTLS_STATE state, char *data, int length)
+int gnutls_getHashDataFromBuffer( GNUTLS_STATE state, char *data, int length)
 {
-       if (type==GNUTLS_SERVER) {
-               if (length > state->gnutls_internals.server_hash_bufferSize) {
-                       length = state->gnutls_internals.server_hash_bufferSize;
-               }
-#ifdef HARD_DEBUG
-       fprintf(stderr, "Read %d bytes of SSL3 Server Hash Data(%d) from buffer\n", length, type);
-#endif
-               state->gnutls_internals.server_hash_bufferSize -= length;
-               memmove(data, state->gnutls_internals.server_hash_buffer, length);
-               /* overwrite buffer */
-               memmove(state->gnutls_internals.server_hash_buffer,
-                       &state->gnutls_internals.server_hash_buffer[length],
-                       state->gnutls_internals.server_hash_bufferSize);
-               state->gnutls_internals.server_hash_buffer =
-                   gnutls_realloc(state->gnutls_internals.server_hash_buffer,
-                                  state->gnutls_internals.server_hash_bufferSize);
-
-               return length;
-       } else { /* CLIENT */
-               if (length > state->gnutls_internals.client_hash_bufferSize) {
-                       length = state->gnutls_internals.client_hash_bufferSize;
-               }
-#ifdef HARD_DEBUG
-       fprintf(stderr, "Read %d bytes of SSL3 Client Hash Data(%d) from buffer\n", length, type);
-#endif
-               state->gnutls_internals.client_hash_bufferSize -= length;
-               memmove(data, state->gnutls_internals.client_hash_buffer, length);
-               /* overwrite buffer */
-               memmove(state->gnutls_internals.client_hash_buffer,
-                       &state->gnutls_internals.client_hash_buffer[length],
-                       state->gnutls_internals.client_hash_bufferSize);
-               state->gnutls_internals.client_hash_buffer =
-                   gnutls_realloc(state->gnutls_internals.client_hash_buffer,
-                                  state->gnutls_internals.client_hash_bufferSize);
-
-               return length;  
+       if (length > state->gnutls_internals.hash_bufferSize) {
+               length = state->gnutls_internals.hash_bufferSize;
        }
+#ifdef HANDSHAKE_DEBUG
+       fprintf(stderr, "Got %d bytes of Hash Data from buffer\n", length);
+#endif
+       state->gnutls_internals.hash_bufferSize -= length;
+       memmove(data, state->gnutls_internals.hash_buffer, length);
+       /* overwrite buffer */
+       memmove(state->gnutls_internals.hash_buffer,
+               &state->gnutls_internals.hash_buffer[length],
+               state->gnutls_internals.hash_bufferSize);
+       state->gnutls_internals.hash_buffer =
+           gnutls_realloc(state->gnutls_internals.hash_buffer,
+                          state->gnutls_internals.hash_bufferSize);
+
+       return length;  
+
 }
 
-int gnutls_readHashDataFromBuffer(int type, GNUTLS_STATE state, char *data, int length)
+int gnutls_readHashDataFromBuffer( GNUTLS_STATE state, char *data, int length)
 {
-       if (type==GNUTLS_SERVER) {
-               if (length > state->gnutls_internals.server_hash_bufferSize) {
-                       length = state->gnutls_internals.server_hash_bufferSize;
-               }
-#ifdef HARD_DEBUG
-       fprintf(stderr, "Read %d bytes of SSL3 Server Hash Data(%d) from buffer\n", length, type);
-#endif
-               memmove(data, state->gnutls_internals.server_hash_buffer, length);
-               return length;
-
-       } else { /* CLIENT */
-               if (length > state->gnutls_internals.client_hash_bufferSize) {
-                       length = state->gnutls_internals.client_hash_bufferSize;
-               }
-#ifdef HARD_DEBUG
-       fprintf(stderr, "Read %d bytes of SSL3 Client Hash Data(%d) from buffer\n", length, type);
-#endif
-               memmove(data, state->gnutls_internals.client_hash_buffer, length);
-               return length;  
+       if (length > state->gnutls_internals.hash_bufferSize) {
+               length = state->gnutls_internals.hash_bufferSize;
        }
+#ifdef HANDSHAKE_DEBUG
+       fprintf(stderr, "Read %d bytes of Hash Data from buffer\n", length);
+#endif
+       memmove(data, state->gnutls_internals.hash_buffer, length);
+       return length;  
 }
 
 
 
-int gnutls_clearHashDataBuffer(int type, GNUTLS_STATE state)
+int gnutls_clearHashDataBuffer( GNUTLS_STATE state)
 {
-       if (type==GNUTLS_SERVER) {
-#ifdef HARD_DEBUG
-       fprintf(stderr, "Cleared SSL3 Server Hash Data(%d) from buffer\n",type);
-#endif
-               state->gnutls_internals.server_hash_bufferSize = 0;
-               gnutls_free(state->gnutls_internals.server_hash_buffer);
-               state->gnutls_internals.server_hash_buffer = NULL;
-       } else { /* CLIENT */
-#ifdef HARD_DEBUG
-       fprintf(stderr, "Cleared SSL3 Client Hash Data(%d) from buffer\n", type);
+
+#ifdef HANDSHAKE_DEBUG
+       fprintf(stderr, "Cleared Hash Data from buffer\n");
 #endif
-               state->gnutls_internals.client_hash_bufferSize = 0;
-               gnutls_free(state->gnutls_internals.client_hash_buffer);
-               state->gnutls_internals.client_hash_buffer = NULL;
-       }
+       state->gnutls_internals.hash_bufferSize = 0;
+       gnutls_free(state->gnutls_internals.hash_buffer);
+       state->gnutls_internals.hash_buffer = NULL;
        
        return 0;
 }

diff --git a/lib/gnutls_buffers.h b/lib/gnutls_buffers.h
index 4a04dc69f1b7a40a9f9446e5e30198c1fd39c108..7baa97f9698851e4a26b443cb81ef068714dc3f5 100644 (file)
--- a/lib/gnutls_buffers.h
+++ b/lib/gnutls_buffers.h
@@ -5,8 +5,11 @@ ssize_t _gnutls_Read(int fd, void *iptr, size_t n);
 ssize_t _gnutls_Write(int fd, const void *iptr, size_t n);
 
 /* used in SSL3 */
-int gnutls_getHashDataFromBuffer(int type, GNUTLS_STATE state, char *data, int length);
-int gnutls_getHashDataBufferSize(int type, GNUTLS_STATE state);
-int gnutls_readHashDataFromBuffer(int type, GNUTLS_STATE state, char *data, int length);
-int gnutls_insertHashDataBuffer(int type, GNUTLS_STATE state, char *data, int length);
-int gnutls_clearHashDataBuffer(int type, GNUTLS_STATE state);
+int gnutls_getHashDataFromBuffer( GNUTLS_STATE state, char *data, int length);
+int gnutls_getHashDataBufferSize( GNUTLS_STATE state);
+int gnutls_readHashDataFromBuffer( GNUTLS_STATE state, char *data, int length);
+int gnutls_insertHashDataBuffer( GNUTLS_STATE state, char *data, int length);
+int gnutls_clearHashDataBuffer( GNUTLS_STATE state);
+
+ssize_t _gnutls_Recv_int(int fd, GNUTLS_STATE state, ContentType type, void *iptr, size_t sizeOfPtr);
+ssize_t _gnutls_Send_int(int fd, GNUTLS_STATE state, ContentType type, void *iptr, size_t n);

diff --git a/lib/gnutls_handshake.c b/lib/gnutls_handshake.c
index d2a23f0a78d453038341a1bfd6956897f94ed6d2..2cf93e1e38c153215bffc9d979f5c813aea795ab 100644 (file)
--- a/lib/gnutls_handshake.c
+++ b/lib/gnutls_handshake.c
@@ -39,13 +39,11 @@
 #define ERR(x, y)
 #endif
 
-#define HASH_TRUE 1
-#define HASH_FALSE 0
 
 /* Calculate The SSL3 Finished message */
 #define SSL3_CLIENT_MSG "CLNT"
 #define SSL3_SERVER_MSG "SRVR"
-void* _gnutls_ssl3_finished( GNUTLS_STATE state, int type) {
+void* _gnutls_ssl3_finished( GNUTLS_STATE state, int type, int skip) {
        int siz;
        GNUTLS_MAC_HANDLE td;
        GNUTLS_MAC_HANDLE td2;
@@ -56,10 +54,10 @@ void* _gnutls_ssl3_finished( GNUTLS_STATE state, int type) {
        td = gnutls_mac_init_ssl3( GNUTLS_MAC_MD5, state->security_parameters.master_secret, 48);
        td2 = gnutls_mac_init_ssl3( GNUTLS_MAC_SHA, state->security_parameters.master_secret, 48);
                        
-       siz = gnutls_getHashDataBufferSize( type, state);
+       siz = gnutls_getHashDataBufferSize( state) - skip;
        data = gnutls_malloc( siz);
 
-       gnutls_getHashDataFromBuffer( type, state, data, siz);
+       gnutls_readHashDataFromBuffer( state, data, siz);
 
        gnutls_mac_ssl3(td, data, siz);
        gnutls_mac_ssl3(td2, data, siz);
@@ -70,8 +68,8 @@ void* _gnutls_ssl3_finished( GNUTLS_STATE state, int type) {
        } else {
                mesg = SSL3_CLIENT_MSG;
        }
+
        siz = strlen(mesg);
-       
        gnutls_mac_ssl3(td, mesg, siz);
        gnutls_mac_ssl3(td2, mesg, siz);
        
@@ -87,52 +85,70 @@ void* _gnutls_ssl3_finished( GNUTLS_STATE state, int type) {
        return concat;
 }
 
+/* Hash the handshake messages as required by TLS 1.0 */
+#define SERVER_MSG "server finished"
+#define CLIENT_MSG "client finished"
+void* _gnutls_finished( GNUTLS_STATE state, int type, int skip) {
+       int siz;
+       GNUTLS_MAC_HANDLE td;
+       GNUTLS_MAC_HANDLE td2;
+       char* data;
+       char concat[36];
+       char *mesg;
+       
+       td = gnutls_hash_init( GNUTLS_MAC_MD5);
+       td2 = gnutls_hash_init( GNUTLS_MAC_SHA);
+       
+       siz = gnutls_getHashDataBufferSize( state) - skip;
+       data = gnutls_malloc( siz);
+
+       gnutls_readHashDataFromBuffer( state, data, siz);
+
+       gnutls_hash(td, data, siz);
+       gnutls_hash(td2, data, siz);
+                       
+       gnutls_free(data);
+       
+       data = gnutls_hash_deinit(td);
+       memcpy( concat, data, 16);
+       gnutls_free(data);
+                       
+       data = gnutls_hash_deinit(td2);
+
+       memcpy( &concat[16], data, 20);
+       gnutls_free(data);
+
+       if (type==GNUTLS_SERVER) {
+               mesg=SERVER_MSG;
+       } else {
+               mesg=CLIENT_MSG;
+       }
+       data =
+           gnutls_PRF( state->security_parameters.master_secret,
+              48, mesg, strlen(mesg), concat,
+              36, 12);                 
+       return data;
+}
+
 
 /* This is to be called after sending CHANGE CIPHER SPEC packet
  * and initializing encryption. This is the first encrypted message
  * we send.
  */
-#define SERVER_MSG "server finished"
-#define CLIENT_MSG "client finished"
 int _gnutls_send_finished(int cd, GNUTLS_STATE state)
 {
        uint8 *data;
-       uint8 concat[36];       /* md5+sha1 */
        int ret;
        int data_size;
 
-       if (state->security_parameters.entity == GNUTLS_CLIENT) { /* we are a CLIENT */
-               if (_gnutls_version_ssl3(state->connection_state.version) == 0) { /* SSL 3 */
-                       data = _gnutls_ssl3_finished( state, GNUTLS_CLIENT);
-                       data_size = 36;
-               } else {
-                       memmove(concat, state->gnutls_internals.client_md_md5, 16);
-                       memmove(&concat[16],
-                               state->gnutls_internals.client_md_sha1, 20);
-       
-                       data =
-                           gnutls_PRF( state->security_parameters.master_secret,
-                                      48, CLIENT_MSG, strlen(CLIENT_MSG), concat,
-                                      36, 12);
-                       data_size = 12;
-               }
-       } else {                /* SERVER SIDE */
-               if (_gnutls_version_ssl3(state->connection_state.version) == 0) {
-                       data = _gnutls_ssl3_finished( state, GNUTLS_SERVER);
-                       data_size = 36;
-               } else { /* TLS 1 - Using PRF */
-                       memmove(concat, state->gnutls_internals.server_md_md5, 16);
-                       memmove(&concat[16],
-                               state->gnutls_internals.server_md_sha1, 20);    
-
-                       data =
-                           gnutls_PRF( state->security_parameters.master_secret,
-                                      48, SERVER_MSG, strlen(SERVER_MSG), concat,
-                                      36, 12);
-                       data_size = 12;
-
-               }
+       if (_gnutls_version_ssl3(state->connection_state.version) == 0) {
+               data = _gnutls_ssl3_finished( state, state->security_parameters.entity, 0);
+               data_size = 36;
+       } else { /* TLS 1.0 */
+               data = _gnutls_finished( state, state->security_parameters.entity, 0);
+               data_size=12;
        }
+
 fprintf(stderr, "Finished: %s\n", _gnutls_bin2hex(data, data_size));
 
        ret = _gnutls_send_handshake(cd, state, data, data_size, GNUTLS_FINISHED);
@@ -144,11 +160,12 @@ fprintf(stderr, "Finished: %s\n", _gnutls_bin2hex(data, data_size));
 /* This is to be called after sending our finished message. If everything
  * went fine we have negotiated a secure connection 
  */
+#define HANDSHAKE_HEADERS_SIZE 4
 int _gnutls_recv_finished(int cd, GNUTLS_STATE state)
 {
        uint8 *data, *vrfy;
        int data_size;
-       uint8 concat[36];       /* md5+sha1 */
+       uint8* concat;  /* md5+sha1 */
        int ret;
        int vrfysize;
 
@@ -165,38 +182,17 @@ int _gnutls_recv_finished(int cd, GNUTLS_STATE state)
        } else {
                data_size=12;
        }
-
+       
        if (vrfysize != data_size) {
                gnutls_assert();
                return GNUTLS_E_ERROR_IN_FINISHED_PACKET;
        }
 
-       if (state->security_parameters.entity == GNUTLS_CLIENT) {
-               if (_gnutls_version_ssl3(state->connection_state.version) == 0) {
-                       data = _gnutls_ssl3_finished( state, GNUTLS_SERVER);
-               } else {
-                       memmove(concat, state->gnutls_internals.server_md_md5, 16);
-                       memmove(&concat[16],
-                               state->gnutls_internals.server_md_sha1, 20);
-
-                       data =
-                           gnutls_PRF( state->security_parameters.master_secret,
-                                      48, SERVER_MSG, strlen(SERVER_MSG), concat,
-                                      36, 12);
-               }
-       } else {                /* SERVER SIDE */
-               if (_gnutls_version_ssl3(state->connection_state.version) == 0) {
-                       data = _gnutls_ssl3_finished( state, GNUTLS_CLIENT);
-               } else { /* TLS 1.0 */
-                       memmove(concat, state->gnutls_internals.client_md_md5, 16);
-                       memmove(&concat[16],
-                       state->gnutls_internals.client_md_sha1, 20);
-
-                       data =
-                           gnutls_PRF( state->security_parameters.master_secret,
-                                      48, CLIENT_MSG, strlen(CLIENT_MSG), concat,
-                                      36, 12);
-               }
+       if (_gnutls_version_ssl3(state->connection_state.version) == 0) {
+               /* skip the bytes from the last message */
+               data = _gnutls_ssl3_finished( state, (state->security_parameters.entity+1)%2, vrfysize + HANDSHAKE_HEADERS_SIZE);
+       } else { /* TLS 1.0 */
+               data = _gnutls_finished( state, (state->security_parameters.entity+1)%2, vrfysize + HANDSHAKE_HEADERS_SIZE);
        }
 
        if (memcmp(vrfy, data, data_size) != 0) {
@@ -294,7 +290,7 @@ int _gnutls_send_handshake(int cd, GNUTLS_STATE state, void *i_data,
 
        length = uint32touint24(datasize);
 
-       i_datasize += 4;
+       i_datasize += HANDSHAKE_HEADERS_SIZE;
        data = gnutls_malloc(i_datasize);
 
        memmove(&data[pos++], &type, 1);
@@ -305,29 +301,15 @@ int _gnutls_send_handshake(int cd, GNUTLS_STATE state, void *i_data,
        if (i_datasize > 4)
                memmove(&data[pos], i_data, i_datasize - 4);
 
-       /* Here we hash - for TLS - or keep the message in a buffer - for SSL 3.0 - in order
-        * to calculate the MAC of the messages for finished message
+#ifdef HANDSHAKE_DEBUG
+       fprintf(stderr, "Send HANDSHAKE[%d] of %d bytes\n", type, i_datasize+4);
+#endif
+
+       /* Here we keep the handshake messages in order to hash them later!
         */
-       if (state->gnutls_internals.client_hash == HASH_TRUE) {
-               if (_gnutls_version_ssl3(state->connection_state.version) == 0) {
-                       gnutls_insertHashDataBuffer( GNUTLS_CLIENT, state, data, i_datasize);
-               } else { /* TLS 1 */
-                       gnutls_hash(state->gnutls_internals.client_td_md5, data, i_datasize);
-                       gnutls_hash(state->gnutls_internals.client_td_sha1, data, i_datasize);
-               }
-       }
-       if (state->gnutls_internals.server_hash == HASH_TRUE) {
-               if (_gnutls_version_ssl3(state->connection_state.version) == 0) {
-                       gnutls_insertHashDataBuffer( GNUTLS_SERVER, state, data, i_datasize);
-               } else { /* TLS 1 */
-                       gnutls_hash(state->gnutls_internals.server_td_md5, data, i_datasize);
-                       gnutls_hash(state->gnutls_internals.server_td_sha1, data, i_datasize);
-               }
-       }
+       if (type!=GNUTLS_HELLO_REQUEST)
+               gnutls_insertHashDataBuffer( state, data, i_datasize);
 
-#ifdef HARD_DEBUG
-       fprintf(stderr, "Send HANDSHAKE[%d]\n", type);
-#endif
        ret =
                _gnutls_Send_int(cd, state, GNUTLS_HANDSHAKE, data, i_datasize);
 
@@ -362,23 +344,19 @@ int _gnutls_recv_handshake(int cd, GNUTLS_STATE state, uint8 **data,
                }
        }
 
-       dataptr = gnutls_malloc(4);
+       dataptr = gnutls_malloc(HANDSHAKE_HEADERS_SIZE);
        
-       ret = _gnutls_Recv_int(cd, state, GNUTLS_HANDSHAKE, dataptr, 4);
+       ret = _gnutls_Recv_int(cd, state, GNUTLS_HANDSHAKE, dataptr, HANDSHAKE_HEADERS_SIZE);
        if (ret < 0) {
                gnutls_free(dataptr);
                return ret;
        }
-       if (ret!=4) {
+       if (ret!=HANDSHAKE_HEADERS_SIZE) {
                gnutls_assert();
                gnutls_free(dataptr);
                return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
        }
 
-#ifdef HARD_DEBUG
-       fprintf(stderr, "Received HANDSHAKE[%d]\n", dataptr[0]);
-#endif
-
        if (dataptr[0]!=type) {
                gnutls_assert();
                gnutls_free(dataptr);
@@ -393,18 +371,21 @@ int _gnutls_recv_handshake(int cd, GNUTLS_STATE state, uint8 **data,
 #ifndef WORDS_BIGENDIAN
        length32 = byteswap32(length32);
 #endif
+#ifdef HANDSHAKE_DEBUG
+       fprintf(stderr, "Received HANDSHAKE[%d] of %d bytes\n", dataptr[0], length32+4);
+#endif
 
-       dataptr = gnutls_realloc( dataptr, length32+4);
+       dataptr = gnutls_realloc( dataptr, length32+HANDSHAKE_HEADERS_SIZE);
        if (length32>0 && data!=NULL)
                *data = gnutls_malloc( length32);
 
        if (datalen!=NULL) *datalen = length32;
 
-       sum=4;
+       sum=HANDSHAKE_HEADERS_SIZE;
        do {
                ret = _gnutls_Recv_int(cd, state, GNUTLS_HANDSHAKE, &dataptr[sum], length32);
                sum += ret;
-       } while( ( (sum-4) < length32) && (ret > 0) );
+       } while( ( (sum-HANDSHAKE_HEADERS_SIZE) < length32) && (ret > 0) );
 
        if (ret < 0) {
                gnutls_assert();
@@ -414,38 +395,19 @@ int _gnutls_recv_handshake(int cd, GNUTLS_STATE state, uint8 **data,
        ret = GNUTLS_E_UNKNOWN_ERROR;
 
        if (length32 > 0 && data!=NULL)
-               memmove( *data, &dataptr[4], length32);
+               memmove( *data, &dataptr[HANDSHAKE_HEADERS_SIZE], length32);
 
        /* here we do the hashing work needed at Finished message */
-       if (state->gnutls_internals.server_hash == HASH_TRUE) {
-               if (_gnutls_version_ssl3(state->connection_state.version) == 0) {
-                       gnutls_insertHashDataBuffer( GNUTLS_SERVER, state, dataptr, length32+4);
-               } else { /* TLS 1 */
-                       gnutls_hash(state->gnutls_internals.server_td_md5, dataptr,
-                             length32 + 4);
-                       gnutls_hash(state->gnutls_internals.server_td_sha1, dataptr,
-                             length32 + 4);
-               }
-       }
-       if (state->gnutls_internals.client_hash == HASH_TRUE) {
-               if (_gnutls_version_ssl3(state->connection_state.version) == 0) {
-                       gnutls_insertHashDataBuffer( GNUTLS_CLIENT, state, dataptr, length32+4);
-               } else { /* TLS 1 */
-                       gnutls_hash(state->gnutls_internals.client_td_md5, dataptr,
-                             length32 + 4);
-                       gnutls_hash(state->gnutls_internals.client_td_sha1, dataptr,
-                             length32 + 4);
-               }
-       }
-       
+       gnutls_insertHashDataBuffer( state, dataptr, length32+HANDSHAKE_HEADERS_SIZE);
+
        switch (dataptr[0]) {
        case GNUTLS_CLIENT_HELLO:
        case GNUTLS_SERVER_HELLO:
-               ret = _gnutls_recv_hello(cd, state, &dataptr[4],
+               ret = _gnutls_recv_hello(cd, state, &dataptr[HANDSHAKE_HEADERS_SIZE],
                                               length32, NULL, 0);
                break;
        case GNUTLS_CERTIFICATE:
-               ret = _gnutls_recv_certificate(cd, state, &dataptr[4],
+               ret = _gnutls_recv_certificate(cd, state, &dataptr[HANDSHAKE_HEADERS_SIZE],
                                               length32);
                break;
        case GNUTLS_SERVER_HELLO_DONE:
@@ -864,113 +826,78 @@ int _gnutls_recv_certificate(int cd, GNUTLS_STATE state, char *data, int datalen
  * everything. (exchange hello messages etc).
  */
 
-#define HASH(x) state->gnutls_internals.x=HASH_TRUE
-#define NOT_HASH(x) state->gnutls_internals.x=HASH_FALSE
 int gnutls_handshake(int cd, GNUTLS_STATE state)
 {
        int ret;
        char *session_id;
        uint8 session_id_size;
 
-       /* These are in order to hash the messages transmitted and received.
-        * (needed by the protocol)
-        */
-//     if (_gnutls_version_ssl3(state->connection_state.version) != 0) { /* TLS */
-               state->gnutls_internals.client_td_md5 = gnutls_hash_init(GNUTLS_MAC_MD5);
-               state->gnutls_internals.client_td_sha1 = gnutls_hash_init(GNUTLS_MAC_SHA);
-               state->gnutls_internals.server_td_md5 = gnutls_hash_init(GNUTLS_MAC_MD5);
-               state->gnutls_internals.server_td_sha1 = gnutls_hash_init(GNUTLS_MAC_SHA);
-//     }
        if (state->security_parameters.entity == GNUTLS_CLIENT) {
-               HASH(client_hash);
-               HASH(server_hash);
                ret = _gnutls_send_hello(cd, state, NULL, 0);
-               NOT_HASH(client_hash);
-               NOT_HASH(server_hash);
                if (ret < 0) {
                        ERR("send hello", ret);
+                       gnutls_clearHashDataBuffer( state);
                        return ret;
                }
 
                /* receive the server hello */
-               HASH(client_hash);
-               HASH(server_hash);
                ret =
                    _gnutls_recv_handshake(cd, state, NULL, NULL, GNUTLS_SERVER_HELLO);
-               NOT_HASH(client_hash);
-               NOT_HASH(server_hash);
                if (ret < 0) {
                        ERR("recv hello", ret);
+                       gnutls_clearHashDataBuffer( state);
                        return ret;
                }
 
                /* RECV CERTIFICATE + KEYEXCHANGE + CERTIFICATE_REQUEST */
-               HASH(client_hash);
-               HASH(server_hash);
                ret =
                    _gnutls_recv_handshake(cd, state, NULL, NULL, GNUTLS_CERTIFICATE);
-               NOT_HASH(client_hash);
-               NOT_HASH(server_hash);
                if (ret < 0) {
                        ERR("recv server certificate", ret);
+                       gnutls_clearHashDataBuffer( state);
                        return ret;
                }
                
 
                /* receive the server key exchange */
-               HASH(client_hash);
-               HASH(server_hash);
                ret = _gnutls_recv_server_kx_message(cd, state);
-               NOT_HASH(client_hash);
-               NOT_HASH(server_hash);
                if (ret < 0) {
                        ERR("recv server kx message", ret);
+                       gnutls_clearHashDataBuffer( state);
                        return ret;
                }
 
 
                /* receive the server hello done */
-               HASH(client_hash);
-               HASH(server_hash);
                ret =
                    _gnutls_recv_handshake(cd, state, NULL, NULL,
                                           GNUTLS_SERVER_HELLO_DONE);
-               NOT_HASH(client_hash);
-               NOT_HASH(server_hash);
                if (ret < 0) {
                        ERR("recv server hello done", ret);
+                       gnutls_clearHashDataBuffer( state);
                        return ret;
                }
 
                /* SEND CERTIFICATE + KEYEXCHANGE + CERTIFICATE_VERIFY */
-               HASH(client_hash);
-               HASH(server_hash);
                ret = _gnutls_send_client_certificate(cd, state);
-               NOT_HASH(client_hash);
-               NOT_HASH(server_hash);
                if (ret < 0) {
                        ERR("send client certificate", ret);
+                       gnutls_clearHashDataBuffer( state);
                        return ret;
                }
 
 
-               HASH(client_hash);
-               HASH(server_hash);
                ret = _gnutls_send_client_kx_message(cd, state);
-               NOT_HASH(client_hash);
-               NOT_HASH(server_hash);
                if (ret < 0) {
                        ERR("send client kx", ret);
+                       gnutls_clearHashDataBuffer( state);
                        return ret;
                }
 
-               HASH(client_hash);
-               HASH(server_hash);
                ret = _gnutls_send_client_certificate_verify( cd, state);
-               NOT_HASH(client_hash);
-               NOT_HASH(server_hash);
                if (ret < 0) {
                        ERR("send client certificate verify", ret);
+                       gnutls_clearHashDataBuffer( state);
                        return ret;
                }
 
@@ -978,28 +905,24 @@ int gnutls_handshake(int cd, GNUTLS_STATE state)
                ret = _gnutls_send_change_cipher_spec(cd, state);
                if (ret < 0) {
                        ERR("send ChangeCipherSpec", ret);
+                       gnutls_clearHashDataBuffer( state);
                        return ret;
                }
-//             if (_gnutls_version_ssl3(state->connection_state.version) != 0) { /* TLS1 */
-                       state->gnutls_internals.client_md_md5 =
-                           gnutls_hash_deinit(state->gnutls_internals.client_td_md5);
-                       state->gnutls_internals.client_md_sha1 =
-                           gnutls_hash_deinit(state->gnutls_internals.client_td_sha1);
-//             }
+
 
                /* Initialize the connection state (start encryption) */
                ret = _gnutls_connection_state_init(state);
-               if (ret<0) return ret;
+               if (ret<0) {
+                       gnutls_clearHashDataBuffer( state);
+                       return ret;
+               }
 
                /* send the finished message */
 
-               NOT_HASH(client_hash);
-               HASH(server_hash);
                ret = _gnutls_send_finished(cd, state);
-               NOT_HASH(client_hash);
-               NOT_HASH(server_hash);
                if (ret < 0) {
                        ERR("send Finished", ret);
+                       gnutls_clearHashDataBuffer( state);
                        return ret;
                }
 
@@ -1009,89 +932,63 @@ int gnutls_handshake(int cd, GNUTLS_STATE state)
                                    NULL, 0);
                if (ret < 0) {
                        ERR("recv ChangeCipherSpec", ret);
+                       gnutls_clearHashDataBuffer( state);
                        return ret;
                }
 
-//             if (_gnutls_version_ssl3(state->connection_state.version) != 0) { /* TLS1 */
-                       state->gnutls_internals.server_md_md5 =
-                           gnutls_hash_deinit(state->gnutls_internals.server_td_md5);
-                       state->gnutls_internals.server_md_sha1 =
-                           gnutls_hash_deinit(state->gnutls_internals.server_td_sha1);
-//             }
-               NOT_HASH(client_hash);
-               NOT_HASH(server_hash);
                ret = _gnutls_recv_finished(cd, state);
                if (ret < 0) {
                        ERR("recv finished", ret);
+                       gnutls_clearHashDataBuffer( state);
                        return ret;
                }
 
-               gnutls_free(state->gnutls_internals.client_md_md5);
-               gnutls_free(state->gnutls_internals.client_md_sha1);
-               gnutls_free(state->gnutls_internals.server_md_md5);
-               gnutls_free(state->gnutls_internals.server_md_sha1);
-
        } else {                /* SERVER */
 
-               HASH(client_hash);
-               HASH(server_hash);
                ret =
                    _gnutls_recv_handshake(cd, state, NULL, NULL,
                                           GNUTLS_CLIENT_HELLO);
-               NOT_HASH(client_hash);
-               NOT_HASH(server_hash);
                if (ret < 0) {
                        ERR("recv hello", ret);
+                       gnutls_clearHashDataBuffer( state);
                        return ret;
                }
 
                _gnutls_generate_session_id(&session_id, &session_id_size);
-               HASH(client_hash);
-               HASH(server_hash);
                ret =
                    _gnutls_send_hello(cd, state, session_id,
                                       session_id_size);
-               NOT_HASH(client_hash);
-               NOT_HASH(server_hash);
                if (ret < 0) {
                        ERR("send hello", ret);
+                       gnutls_clearHashDataBuffer( state);
                        return ret;
                }
                gnutls_free(session_id);
 
                /* SEND CERTIFICATE + KEYEXCHANGE + CERTIFICATE_REQUEST */
-               HASH(client_hash);
-               HASH(server_hash);
                ret = _gnutls_send_server_kx_message(cd, state);
-               NOT_HASH(client_hash);
-               NOT_HASH(server_hash);
                if (ret < 0) {
                        ERR("send server kx", ret);
+                       gnutls_clearHashDataBuffer( state);
                        return ret;
                }
 
                /* send the server hello done */
-               HASH(client_hash);
-               HASH(server_hash);
                ret =
                    _gnutls_send_handshake(cd, state, NULL, 0,
                                           GNUTLS_SERVER_HELLO_DONE);
-               NOT_HASH(client_hash);
-               NOT_HASH(server_hash);
                if (ret < 0) {
                        ERR("send server hello done", ret);
+                       gnutls_clearHashDataBuffer( state);
                        return ret;
                }
 
                /* RECV CERTIFICATE + KEYEXCHANGE + CERTIFICATE_VERIFY */
                
-               HASH(client_hash);
-               HASH(server_hash);
                ret = _gnutls_recv_client_kx_message(cd, state);
-               NOT_HASH(client_hash);
-               NOT_HASH(server_hash);
                if (ret < 0) {
                        ERR("recv client kx", ret);
+                       gnutls_clearHashDataBuffer( state);
                        return ret;
                }
 
@@ -1105,51 +1002,35 @@ int gnutls_handshake(int cd, GNUTLS_STATE state)
 
                /* Initialize the connection state (start encryption) */
                ret = _gnutls_connection_state_init(state);
-               if (ret<0) return ret;
+               if (ret<0) {
+                       gnutls_clearHashDataBuffer( state);
+                       return ret;
+               }
 
-//             if (_gnutls_version_ssl3(state->connection_state.version) != 0) { /* TLS 1.0 */
-                       state->gnutls_internals.client_md_md5 =
-                           gnutls_hash_deinit(state->gnutls_internals.client_td_md5);
-                       state->gnutls_internals.client_md_sha1 =
-                           gnutls_hash_deinit(state->gnutls_internals.client_td_sha1);         
-//             }
-               NOT_HASH(client_hash);
-               HASH(server_hash);
                ret = _gnutls_recv_finished(cd, state);
-               NOT_HASH(client_hash);
-               NOT_HASH(server_hash);
                if (ret < 0) {
                        ERR("recv finished", ret);
+                       gnutls_clearHashDataBuffer( state);
                        return ret;
                }
 
                ret = _gnutls_send_change_cipher_spec(cd, state);
                if (ret < 0) {
                        ERR("send ChangeCipherSpec", ret);
+                       gnutls_clearHashDataBuffer( state);
                        return ret;
                }
 
-//             if (_gnutls_version_ssl3(state->connection_state.version) != 0) { /* TLS 1.0 */
-                       state->gnutls_internals.server_md_md5 =
-                           gnutls_hash_deinit(state->gnutls_internals.server_td_md5);
-                       state->gnutls_internals.server_md_sha1 =
-                           gnutls_hash_deinit(state->gnutls_internals.server_td_sha1);         
-//             }
-               NOT_HASH(client_hash);
-               NOT_HASH(server_hash);
                ret = _gnutls_send_finished(cd, state);
                if (ret < 0) {
                        ERR("send finished", ret);
+                       gnutls_clearHashDataBuffer( state);
                        return ret;
                }
 
-               gnutls_free(state->gnutls_internals.server_md_md5);
-               gnutls_free(state->gnutls_internals.server_md_sha1);
-               gnutls_free(state->gnutls_internals.client_md_md5);
-               gnutls_free(state->gnutls_internals.client_md_sha1);
-
        }
-
+       /* clear handshake buffer */
+       gnutls_clearHashDataBuffer( state);
        return ret;
 
 }

diff --git a/lib/gnutls_int.h b/lib/gnutls_int.h
index b4ba02943f5b42281f597df1db6f14e5155e925c..34313726b95dca90eaffa9ac88798e108de2e9c0 100644 (file)
--- a/lib/gnutls_int.h
+++ b/lib/gnutls_int.h
@@ -2,8 +2,9 @@
 
 #define GNUTLS_INT_H
 
-#define HARD_DEBUG
-#define READ_DEBUG
+#define HANDSHAKE_DEBUG
+//#define HARD_DEBUG
+//#define READ_DEBUG
 //#define WRITE_DEBUG
 #define DEBUG
 
@@ -177,10 +178,8 @@ typedef struct {
 typedef struct {
        char*                   buffer;
        uint32                  bufferSize;
-       char*                   client_hash_buffer; /* used in SSL3 */
-       uint32                  client_hash_bufferSize; /* used in SSL3 */
-       char*                   server_hash_buffer; /* used in SSL3 */
-       uint32                  server_hash_bufferSize; /* used in SSL3 */
+       char*                   hash_buffer; /* used in SSL3 */
+       uint32                  hash_bufferSize; /* used in SSL3 */
        char*                   buffer_handshake;
        uint32                  bufferSize_handshake;
        ResumableSession        resumable; /* TRUE or FALSE */
@@ -188,17 +187,6 @@ typedef struct {
        AlertDescription        last_alert; /* last alert received */
        GNUTLS_CipherSuite      current_cipher_suite;
        CompressionMethod       compression_method;
-       /* for the handshake protocol */
-       GNUTLS_MAC_HANDLE       client_td_md5;
-       GNUTLS_MAC_HANDLE       client_td_sha1;
-       void*                   client_md_md5;
-       void*                   client_md_sha1;
-       GNUTLS_MAC_HANDLE       server_td_md5;
-       GNUTLS_MAC_HANDLE       server_td_sha1;
-       void*                   server_md_md5;
-       void*                   server_md_sha1;
-       int                             server_hash;
-       int                             client_hash;
        /* For DH KX */
        MPI                             KEY;
        MPI                             client_Y;