aes-ppc.pl: 10% performance improvement on Power6 [from HEAD].

[openssl.git] / ssl / d1_pkt.c

diff --git a/ssl/d1_pkt.c b/ssl/d1_pkt.c
index 355d5ed9cdcbeedc59bbe83855cb02a77cbccecf..20d24b6fd8da186f911a8bec9b7b94f740ef78ed 100644 (file)
--- a/ssl/d1_pkt.c
+++ b/ssl/d1_pkt.c
@@ -534,7 +534,7 @@ int dtls1_get_record(SSL *s)
        int i,n;
        SSL3_RECORD *rr;
        SSL_SESSION *sess;
-       unsigned char *p;
+       unsigned char *p = NULL;
        unsigned short version;
        DTLS1_BITMAP *bitmap;
        unsigned int is_next_epoch;
@@ -648,8 +648,15 @@ again:
                goto again;   /* get another record */
                }
 
-       /* check whether this is a repeat, or aged record */
-       if ( ! dtls1_record_replay_check(s, bitmap))
+       /* Check whether this is a repeat, or aged record.
+        * Don't check if we're listening and this message is
+        * a ClientHello. They can look as if they're replayed,
+        * since they arrive from different connections and
+        * would be dropped unnecessarily.
+        */
+       if (!(s->d1->listen && rr->type == SSL3_RT_HANDSHAKE &&
+               *p == SSL3_MT_CLIENT_HELLO) &&
+               !dtls1_record_replay_check(s, bitmap))
                {
                rr->length = 0;
                s->packet_length=0; /* dump this record */
@@ -660,14 +667,14 @@ again:
        if (rr->length == 0) goto again;
 
        /* If this record is from the next epoch (either HM or ALERT),
-        * buffer it since it cannot be processed at this time. Records
-        * from the next epoch are marked as received even though they
-        * are not processed, so as to prevent any potential resource
-        * DoS attack */
+        * and a handshake is currently in progress, buffer it since it
+        * cannot be processed at this time. */
        if (is_next_epoch)
                {
-               dtls1_record_bitmap_update(s, bitmap);
-               dtls1_buffer_record(s, &(s->d1->unprocessed_rcds), rr->seq_num);
+               if (SSL_in_init(s) || s->in_handshake)
+                       {
+                       dtls1_buffer_record(s, &(s->d1->unprocessed_rcds), rr->seq_num);
+                       }
                rr->length = 0;
                s->packet_length = 0;
                goto again;
@@ -802,7 +809,7 @@ start:
                 * buffer the application data for later processing rather
                 * than dropping the connection.
                 */
-               dtls1_buffer_record(s, &(s->d1->buffered_app_data), 0);
+               dtls1_buffer_record(s, &(s->d1->buffered_app_data), rr->seq_num);
                rr->length = 0;
                goto start;
                }