PR: 1997

[openssl.git] / ssl / d1_both.c

diff --git a/ssl/d1_both.c b/ssl/d1_both.c
index a56586f4e938ceb26a8312335feed663d6a7e1f5..5bb0a4ff6ce1f02e2b54c0f4b638dee97ff5602a 100644 (file)
--- a/ssl/d1_both.c
+++ b/ssl/d1_both.c
@@ -813,14 +813,30 @@ int dtls1_send_change_cipher_spec(SSL *s, int a, int b)
        return(dtls1_do_write(s,SSL3_RT_CHANGE_CIPHER_SPEC));
        }
 
+static int dtls1_add_cert_to_buf(BUF_MEM *buf, unsigned long *l, X509 *x)
+       {
+       int n;
+       unsigned char *p;
+
+       n=i2d_X509(x,NULL);
+       if (!BUF_MEM_grow_clean(buf,(int)(n+(*l)+3)))
+               {
+               SSLerr(SSL_F_DTLS1_ADD_CERT_TO_BUF,ERR_R_BUF_LIB);
+               return 0;
+               }
+       p=(unsigned char *)&(buf->data[*l]);
+       l2n3(n,p);
+       i2d_X509(x,&p);
+       *l+=n+3;
+
+       return 1;
+       }
 unsigned long dtls1_output_cert_chain(SSL *s, X509 *x)
        {
        unsigned char *p;
-       int n,i;
+       int i;
        unsigned long l= 3 + DTLS1_HM_HEADER_LENGTH;
        BUF_MEM *buf;
-       X509_STORE_CTX xs_ctx;
-       X509_OBJECT obj;
 
        /* TLSv1 sends a chain with nothing in it, instead of an alert */
        buf=s->init_buf;
@@ -831,54 +847,33 @@ unsigned long dtls1_output_cert_chain(SSL *s, X509 *x)
                }
        if (x != NULL)
                {
-               if(!X509_STORE_CTX_init(&xs_ctx,s->ctx->cert_store,NULL,NULL))
-                       {
-                       SSLerr(SSL_F_DTLS1_OUTPUT_CERT_CHAIN,ERR_R_X509_LIB);
-                       return(0);
-                       }
-
-               for (;;)
-                       {
-                       n=i2d_X509(x,NULL);
-                       if (!BUF_MEM_grow_clean(buf,(n+l+3)))
-                               {
-                               SSLerr(SSL_F_DTLS1_OUTPUT_CERT_CHAIN,ERR_R_BUF_LIB);
-                               return(0);
-                               }
-                       p=(unsigned char *)&(buf->data[l]);
-                       l2n3(n,p);
-                       i2d_X509(x,&p);
-                       l+=n+3;
-                       if (X509_NAME_cmp(X509_get_subject_name(x),
-                               X509_get_issuer_name(x)) == 0) break;
-
-                       i=X509_STORE_get_by_subject(&xs_ctx,X509_LU_X509,
-                               X509_get_issuer_name(x),&obj);
-                       if (i <= 0) break;
-                       x=obj.data.x509;
-                       /* Count is one too high since the X509_STORE_get uped the
-                        * ref count */
-                       X509_free(x);
-                       }
-
-               X509_STORE_CTX_cleanup(&xs_ctx);
-               }
-
-       /* Thawte special :-) */
-       if (s->ctx->extra_certs != NULL)
+               X509_STORE_CTX xs_ctx;
+
+               if (!X509_STORE_CTX_init(&xs_ctx,s->ctx->cert_store,x,NULL))
+                       {
+                       SSLerr(SSL_F_DTLS1_OUTPUT_CERT_CHAIN,ERR_R_X509_LIB);
+                       return(0);
+                       }
+  
+               X509_verify_cert(&xs_ctx);
+               for (i=0; i < sk_X509_num(xs_ctx.chain); i++)
+                       {
+                       x = sk_X509_value(xs_ctx.chain, i);
+
+                       if (!dtls1_add_cert_to_buf(buf, &l, x))
+                               {
+                               X509_STORE_CTX_cleanup(&xs_ctx);
+                               return 0;
+                               }
+                       }
+               X509_STORE_CTX_cleanup(&xs_ctx);
+               }
+       /* Thawte special :-) */
        for (i=0; i<sk_X509_num(s->ctx->extra_certs); i++)
                {
                x=sk_X509_value(s->ctx->extra_certs,i);
-               n=i2d_X509(x,NULL);
-               if (!BUF_MEM_grow_clean(buf,(n+l+3)))
-                       {
-                       SSLerr(SSL_F_DTLS1_OUTPUT_CERT_CHAIN,ERR_R_BUF_LIB);
-                       return(0);
-                       }
-               p=(unsigned char *)&(buf->data[l]);
-               l2n3(n,p);
-               i2d_X509(x,&p);
-               l+=n+3;
+               if (!dtls1_add_cert_to_buf(buf, &l, x))
+                       return 0;
                }
 
        l-= (3 + DTLS1_HM_HEADER_LENGTH);
@@ -895,9 +890,6 @@ unsigned long dtls1_output_cert_chain(SSL *s, X509 *x)
 
 int dtls1_read_failed(SSL *s, int code)
        {
-       DTLS1_STATE *state;
-       int send_alert = 0;
-
        if ( code > 0)
                {
                fprintf( stderr, "invalid state reached %s:%d", __FILE__, __LINE__);
@@ -917,24 +909,6 @@ int dtls1_read_failed(SSL *s, int code)
                return code;
                }
 
-       dtls1_double_timeout(s);
-       state = s->d1;
-       state->timeout.num_alerts++;
-       if ( state->timeout.num_alerts > DTLS1_TMO_ALERT_COUNT)
-               {
-               /* fail the connection, enough alerts have been sent */
-               SSLerr(SSL_F_DTLS1_READ_FAILED,SSL_R_READ_TIMEOUT_EXPIRED);
-               return 0;
-               }
-
-       state->timeout.read_timeouts++;
-       if ( state->timeout.read_timeouts > DTLS1_TMO_READ_COUNT)
-               {
-               send_alert = 1;
-               state->timeout.read_timeouts = 1;
-               }
-
-
 #if 0 /* for now, each alert contains only one record number */
        item = pqueue_peek(state->rcvd_records);
        if ( item )
@@ -945,12 +919,12 @@ int dtls1_read_failed(SSL *s, int code)
 #endif
 
 #if 0  /* no more alert sending, just retransmit the last set of messages */
-               if ( send_alert)
-                       ssl3_send_alert(s,SSL3_AL_WARNING,
-                               DTLS1_AD_MISSING_HANDSHAKE_MESSAGE);
+       if ( state->timeout.read_timeouts >= DTLS1_TMO_READ_COUNT)
+               ssl3_send_alert(s,SSL3_AL_WARNING,
+                       DTLS1_AD_MISSING_HANDSHAKE_MESSAGE);
 #endif
 
-       return dtls1_retransmit_buffered_messages(s) ;
+       return dtls1_handle_timeout(s);
        }
 
 int