Add HMAC ECC ciphersuites from RFC5289. Include SHA384 PRF support and

[openssl.git] / ssl / d1_both.c

diff --git a/ssl/d1_both.c b/ssl/d1_both.c
index 0855de352aeeed7bc8d1bed3eb2cf0951bcf7f6e..2180c6d4da7d4774cd6af0dc8924a79fb5ee8aa9 100644 (file)
--- a/ssl/d1_both.c
+++ b/ssl/d1_both.c
@@ -127,32 +127,33 @@
 
 #define RSMBLY_BITMASK_MARK(bitmask, start, end) { \
                        if ((end) - (start) <= 8) { \
-                               int ii; \
+                               long ii; \
                                for (ii = (start); ii < (end); ii++) bitmask[((ii) >> 3)] |= (1 << ((ii) & 7)); \
                        } else { \
-                               int ii; \
+                               long ii; \
                                bitmask[((start) >> 3)] |= bitmask_start_values[((start) & 7)]; \
-                               for (ii = (((start) >> 3) + 1); ii < ((end) >> 3); ii++) bitmask[ii] = 0xff; \
-                               bitmask[((end) >> 3)] |= bitmask_end_values[((end) & 7)]; \
+                               for (ii = (((start) >> 3) + 1); ii < ((((end) - 1)) >> 3); ii++) bitmask[ii] = 0xff; \
+                               bitmask[(((end) - 1) >> 3)] |= bitmask_end_values[((end) & 7)]; \
                        } }
 
 #define RSMBLY_BITMASK_IS_COMPLETE(bitmask, msg_len, is_complete) { \
-                       int ii; \
+                       long ii; \
+                       OPENSSL_assert((msg_len) > 0); \
                        is_complete = 1; \
-                       if (bitmask[((msg_len) >> 3)] != bitmask_end_values[((msg_len) & 7)]) is_complete = 0; \
-                       if (is_complete) for (ii = 0; ii < ((msg_len) >> 3); ii++) \
-                       if (bitmask[ii] != 0xff) { is_complete = 0; break; } }
+                       if (bitmask[(((msg_len) - 1) >> 3)] != bitmask_end_values[((msg_len) & 7)]) is_complete = 0; \
+                       if (is_complete) for (ii = (((msg_len) - 1) >> 3) - 1; ii >= 0 ; ii--) \
+                               if (bitmask[ii] != 0xff) { is_complete = 0; break; } }
 
 #if 0
 #define RSMBLY_BITMASK_PRINT(bitmask, msg_len) { \
-                       int ii; \
+                       long ii; \
                        printf("bitmask: "); for (ii = 0; ii < (msg_len); ii++) \
                        printf("%d ", (bitmask[ii >> 3] & (1 << (ii & 7))) >> (ii & 7)); \
                        printf("\n"); }
 #endif
 
 static unsigned char bitmask_start_values[] = {0xff, 0xfe, 0xfc, 0xf8, 0xf0, 0xe0, 0xc0, 0x80};
-static unsigned char bitmask_end_values[]   = {0x00, 0x01, 0x03, 0x07, 0x0f, 0x1f, 0x3f, 0x7f};
+static unsigned char bitmask_end_values[]   = {0xff, 0x01, 0x03, 0x07, 0x0f, 0x1f, 0x3f, 0x7f};
 
 /* XDTLS:  figure out the right values */
 static unsigned int g_probable_mtu[] = {1500 - 28, 512 - 28, 256 - 28};
@@ -463,20 +464,9 @@ again:
 
        memset(msg_hdr, 0x00, sizeof(struct hm_header_st));
 
-       s->d1->handshake_read_seq++;
-       /* we just read a handshake message from the other side:
-        * this means that we don't need to retransmit of the
-        * buffered messages.  
-        * XDTLS: may be able clear out this
-        * buffer a little sooner (i.e if an out-of-order
-        * handshake message/record is received at the record
-        * layer.  
-        * XDTLS: exception is that the server needs to
-        * know that change cipher spec and finished messages
-        * have been received by the client before clearing this
-        * buffer.  this can simply be done by waiting for the
-        * first data  segment, but is there a better way?  */
-       dtls1_clear_record_buffer(s);
+       /* Don't change sequence numbers while listening */
+       if (!s->d1->listen)
+               s->d1->handshake_read_seq++;
 
        s->init_msg = s->init_buf->data + DTLS1_HM_HEADER_LENGTH;
        return s->init_num;
@@ -658,11 +648,11 @@ dtls1_reassemble_fragment(SSL *s, struct hm_header_st* msg_hdr, int *ok)
        if (i<=0 || (unsigned long)i!=frag_len)
                goto err;
 
-       RSMBLY_BITMASK_MARK(frag->reassembly, msg_hdr->frag_off,
-                           msg_hdr->frag_off + frag_len);
+       RSMBLY_BITMASK_MARK(frag->reassembly, (long)msg_hdr->frag_off,
+                           (long)(msg_hdr->frag_off + frag_len));
 
-       RSMBLY_BITMASK_IS_COMPLETE(frag->reassembly, msg_hdr->msg_len,
-                                  is_complete)
+       RSMBLY_BITMASK_IS_COMPLETE(frag->reassembly, (long)msg_hdr->msg_len,
+                                  is_complete);
 
        if (is_complete)
                {
@@ -812,9 +802,11 @@ dtls1_get_message_fragment(SSL *s, int st1, int stn, long max, int *ok)
 
        /* 
         * if this is a future (or stale) message it gets buffered
-        * (or dropped)--no further processing at this time 
+        * (or dropped)--no further processing at this time
+        * While listening, we accept seq 1 (ClientHello with cookie)
+        * although we're still expecting seq 0 (ClientHello)
         */
-       if ( msg_hdr.seq != s->d1->handshake_read_seq)
+       if (msg_hdr.seq != s->d1->handshake_read_seq && !(s->d1->listen && msg_hdr.seq == 1))
                return dtls1_process_out_of_seq_message(s, &msg_hdr, ok);
 
        len = msg_hdr.msg_len;
@@ -1321,7 +1313,8 @@ unsigned char *
 dtls1_set_message_header(SSL *s, unsigned char *p, unsigned char mt,
                        unsigned long len, unsigned long frag_off, unsigned long frag_len)
        {
-       if ( frag_off == 0)
+       /* Don't change sequence numbers while listening */
+       if (frag_off == 0 && !s->d1->listen)
                {
                s->d1->handshake_write_seq = s->d1->next_handshake_write_seq;
                s->d1->next_handshake_write_seq++;