modes/gcm128.c: make it indent-friendly.

[openssl.git] / ssl / d1_pkt.c

diff --git a/ssl/d1_pkt.c b/ssl/d1_pkt.c
index ed246a007807c9c59e96664e28f9154254150377..ee2c0e0c534480f4026261a0eec9296752aedbb9 100644 (file)
--- a/ssl/d1_pkt.c
+++ b/ssl/d1_pkt.c
@@ -212,7 +212,7 @@ dtls1_buffer_record(SSL *s, record_pqueue *queue, unsigned char *priority)
        /* Limit the size of the queue to prevent DOS attacks */
        if (pqueue_size(queue->q) >= 100)
                return 0;
-               
+
        rdata = OPENSSL_malloc(sizeof(DTLS1_RECORD_DATA));
        item = pitem_new(priority, rdata);
        if (rdata == NULL || item == NULL)
@@ -247,18 +247,22 @@ dtls1_buffer_record(SSL *s, record_pqueue *queue, unsigned char *priority)
        if (!ssl3_setup_buffers(s))
                {
                SSLerr(SSL_F_DTLS1_BUFFER_RECORD, ERR_R_INTERNAL_ERROR);
+               if (rdata->rbuf.buf != NULL)
+                       OPENSSL_free(rdata->rbuf.buf);
                OPENSSL_free(rdata);
                pitem_free(item);
-               return(0);
+               return(-1);
                }
 
        /* insert should not fail, since duplicates are dropped */
        if (pqueue_insert(queue->q, item) == NULL)
                {
                SSLerr(SSL_F_DTLS1_BUFFER_RECORD, ERR_R_INTERNAL_ERROR);
+               if (rdata->rbuf.buf != NULL)
+                       OPENSSL_free(rdata->rbuf.buf);
                OPENSSL_free(rdata);
                pitem_free(item);
-               return(0);
+               return(-1);
                }
 
        return(1);
@@ -314,8 +318,9 @@ dtls1_process_buffered_records(SSL *s)
             dtls1_get_unprocessed_record(s);
             if ( ! dtls1_process_record(s))
                 return(0);
-            dtls1_buffer_record(s, &(s->d1->processed_rcds), 
-                s->s3->rrec.seq_num);
+            if(dtls1_buffer_record(s, &(s->d1->processed_rcds),
+                s->s3->rrec.seq_num)<0)
+                return -1;
             }
         }
 
@@ -414,10 +419,12 @@ dtls1_process_record(SSL *s)
        rr->orig_len=rr->length;
 
        enc_err = s->method->ssl3_enc->enc(s,0);
-       /* enc_err is:
+       /*-
+        * enc_err is:
         *    0: (in non-constant time) if the record is publically invalid.
         *    1: if the padding is valid
-        *    -1: if the padding is invalid */
+        *   -1: if the padding is invalid
+        */
        if (enc_err == 0)
                {
                /* For DTLS we simply ignore bad packets. */
@@ -518,7 +525,8 @@ printf("\n");
                }
 
        rr->off=0;
-       /* So at this point the following is true
+       /*-
+        * So at this point the following is true
         * ssl->s3->rrec.type   is the type of record
         * ssl->s3->rrec.length == number of bytes in record
         * ssl->s3->rrec.off    == offset to first valid byte
@@ -528,7 +536,6 @@ printf("\n");
 
        /* we have pulled in a full packet so zero things */
        s->packet_length=0;
-       dtls1_record_bitmap_update(s, &(s->d1->bitmap));/* Mark receipt of record. */
        return(1);
 
 f_err:
@@ -538,7 +545,8 @@ err:
 }
 
 
-/* Call this to get a new input record.
+/*-
+ * Call this to get a new input record.
  * It will return <= 0 if more data is needed, normally due to an error
  * or non-blocking IO.
  * When it finishes, one packet has been decoded and can be found in
@@ -561,7 +569,8 @@ int dtls1_get_record(SSL *s)
 
        /* The epoch may have changed.  If so, process all the
         * pending records.  This is a non-blocking operation. */
-       dtls1_process_buffered_records(s);
+       if(dtls1_process_buffered_records(s)<0)
+               return -1;
 
        /* if we're renegotiating, then there may be buffered records */
        if (dtls1_get_processed_record(s))
@@ -643,8 +652,6 @@ again:
                /* now s->packet_length == DTLS1_RT_HEADER_LENGTH */
                i=rr->length;
                n=ssl3_read_n(s,i,i,1);
-               if (n <= 0) return(n); /* error or non-blocking io */
-
                /* this packet contained a partial record, dump it */
                if ( n != i)
                        {
@@ -679,7 +686,8 @@ again:
                 * would be dropped unnecessarily.
                 */
                if (!(s->d1->listen && rr->type == SSL3_RT_HANDSHAKE &&
-                   *p == SSL3_MT_CLIENT_HELLO) &&
+                   s->packet_length > DTLS1_RT_HEADER_LENGTH &&
+                   s->packet[DTLS1_RT_HEADER_LENGTH] == SSL3_MT_CLIENT_HELLO) &&
                    !dtls1_record_replay_check(s, bitmap))
                        {
                        rr->length = 0;
@@ -702,7 +710,9 @@ again:
                {
                if ((SSL_in_init(s) || s->in_handshake) && !s->d1->listen)
                        {
-                       dtls1_buffer_record(s, &(s->d1->unprocessed_rcds), rr->seq_num);
+                       if(dtls1_buffer_record(s, &(s->d1->unprocessed_rcds), rr->seq_num)<0)
+                               return -1;
+                       dtls1_record_bitmap_update(s, bitmap);/* Mark receipt of record. */
                        }
                rr->length = 0;
                s->packet_length = 0;
@@ -715,12 +725,14 @@ again:
                s->packet_length = 0;  /* dump this record */
                goto again;   /* get another record */
                }
+       dtls1_record_bitmap_update(s, bitmap);/* Mark receipt of record. */
 
        return(1);
 
        }
 
-/* Return up to 'len' payload bytes received in 'type' records.
+/*-
+ * Return up to 'len' payload bytes received in 'type' records.
  * 'type' is one of the following:
  *
  *   -  SSL3_RT_HANDSHAKE (when ssl3_get_message calls us)
@@ -797,10 +809,12 @@ int dtls1_read_bytes(SSL *s, int type, unsigned char *buf, int len, int peek)
 start:
        s->rwstate=SSL_NOTHING;
 
-       /* s->s3->rrec.type         - is the type of record
+       /*-
+        * s->s3->rrec.type         - is the type of record
         * s->s3->rrec.data,    - data
         * s->s3->rrec.off,     - offset into 'data' for next read
-        * s->s3->rrec.length,  - number of bytes. */
+        * s->s3->rrec.length,  - number of bytes. 
+        */
        rr = &(s->s3->rrec);
 
        /* We are not handshaking and have no data yet,
@@ -865,7 +879,11 @@ start:
                 * buffer the application data for later processing rather
                 * than dropping the connection.
                 */
-               dtls1_buffer_record(s, &(s->d1->buffered_app_data), rr->seq_num);
+               if(dtls1_buffer_record(s, &(s->d1->buffered_app_data), rr->seq_num)<0)
+                       {
+                       SSLerr(SSL_F_DTLS1_READ_BYTES, ERR_R_INTERNAL_ERROR);
+                       return -1;
+                       }
                rr->length = 0;
                goto start;
                }
@@ -1027,9 +1045,11 @@ start:
                        }
                }
 
-       /* s->d1->handshake_fragment_len == 12  iff  rr->type == SSL3_RT_HANDSHAKE;
+       /*-
+        * s->d1->handshake_fragment_len == 12  iff  rr->type == SSL3_RT_HANDSHAKE;
         * s->d1->alert_fragment_len == 7      iff  rr->type == SSL3_RT_ALERT.
-        * (Possibly rr is 'empty' now, i.e. rr->length may be 0.) */
+        * (Possibly rr is 'empty' now, i.e. rr->length may be 0.)
+        */
 
        /* If we are a client, check for an incoming 'Hello Request': */
        if ((!s->server) &&
@@ -1632,7 +1652,7 @@ int do_dtls1_write(SSL *s, int type, const unsigned char *buf, unsigned int len,
        if (eivlen)
                wr->length += eivlen;
 
-       s->method->ssl3_enc->enc(s,1);
+       if(s->method->ssl3_enc->enc(s,1) < 1) goto err;
 
        /* record length after mac and block padding */
 /*     if (type == SSL3_RT_APPLICATION_DATA ||