SSL_add_dir_cert_subjects_to_stack for Win32 finally implemented.

[openssl.git] / ssl / s2_pkt.c

diff --git a/ssl/s2_pkt.c b/ssl/s2_pkt.c
index 2866d61fa40c1c5c371da3e5373bcf1c36d34adc..1bb0ef1e8f6acb8bfeae3b113df5f99d4d7fec31 100644 (file)
--- a/ssl/s2_pkt.c
+++ b/ssl/s2_pkt.c
@@ -110,7 +110,7 @@
  */
 
 #include "ssl_locl.h"
-#ifndef NO_SSL2
+#ifndef OPENSSL_NO_SSL2
 #include <stdio.h>
 #include <errno.h>
 #define USE_SOCKETS
@@ -130,15 +130,9 @@ static int ssl2_read_internal(SSL *s, void *buf, int len, int peek)
        unsigned char mac[MAX_MAC_SIZE];
        unsigned char *p;
        int i;
-       unsigned int mac_size=0;
+       unsigned int mac_size;
 
-       if (peek)
-               {
-               SSLerr(SSL_F_SSL2_READ_INTERNAL, SSL_R_FIXME); /* proper implementation not yet completed */
-               return -1;
-               }
-
-ssl2_read_again:
+ ssl2_read_again:
        if (SSL_in_init(s) && !s->in_handshake)
                {
                n=s->handshake_func(s);
@@ -162,13 +156,22 @@ ssl2_read_again:
                        n=len;
 
                memcpy(buf,s->s2->ract_data,(unsigned int)n);
-               s->s2->ract_data_length-=n;
-               s->s2->ract_data+=n;
-               if (s->s2->ract_data_length == 0)
-                       s->rstate=SSL_ST_READ_HEADER;
+               if (!peek)
+                       {
+                       s->s2->ract_data_length-=n;
+                       s->s2->ract_data+=n;
+                       if (s->s2->ract_data_length == 0)
+                               s->rstate=SSL_ST_READ_HEADER;
+                       }
+
                return(n);
                }
 
+       /* s->s2->ract_data_length == 0
+        * 
+        * Fill the buffer, then goto ssl2_read_again.
+        */
+
        if (s->rstate == SSL_ST_READ_HEADER)
                {
                if (s->first_packet)
@@ -232,17 +235,25 @@ ssl2_read_again:
                /* Data portion */
                if (s->s2->clear_text)
                        {
+                       mac_size = 0;
                        s->s2->mac_data=p;
                        s->s2->ract_data=p;
-                       s->s2->pad_data=NULL;
+                       if (s->s2->padding)
+                               {
+                               SSLerr(SSL_F_SSL2_READ_INTERNAL,SSL_R_ILLEGAL_PADDING);
+                               return(-1);
+                               }
                        }
                else
                        {
                        mac_size=EVP_MD_size(s->read_hash);
                        s->s2->mac_data=p;
                        s->s2->ract_data= &p[mac_size];
-                       s->s2->pad_data= &p[mac_size+
-                               s->s2->rlength-s->s2->padding];
+                       if (s->s2->padding + mac_size > s->s2->rlength)
+                               {
+                               SSLerr(SSL_F_SSL2_READ_INTERNAL,SSL_R_ILLEGAL_PADDING);
+                               return(-1);
+                               }
                        }
 
                s->s2->ract_data_length=s->s2->rlength;
@@ -266,33 +277,24 @@ ssl2_read_again:
                INC32(s->s2->read_sequence); /* expect next number */
                /* s->s2->ract_data is now available for processing */
 
-#if 1
-               /* How should we react when a packet containing 0
-                * bytes is received?  (Note that SSLeay/OpenSSL itself
-                * never sends such packets; see ssl2_write.)
-                * Returning 0 would be interpreted by the caller as
-                * indicating EOF, so it's not a good idea.
-                * Instead, we just continue reading.  Note that using
-                * select() for blocking sockets *never* guarantees
+               /* Possibly the packet that we just read had 0 actual data bytes.
+                * (SSLeay/OpenSSL itself never sends such packets; see ssl2_write.)
+                * In this case, returning 0 would be interpreted by the caller
+                * as indicating EOF, so it's not a good idea.  Instead, we just
+                * continue reading; thus ssl2_read_internal may have to process
+                * multiple packets before it can return.
+                *
+                * [Note that using select() for blocking sockets *never* guarantees
                 * that the next SSL_read will not block -- the available
-                * data may contain incomplete packets, and except for SSL 2
-                * renegotiation can confuse things even more. */
+                * data may contain incomplete packets, and except for SSL 2,
+                * renegotiation can confuse things even more.] */
 
                goto ssl2_read_again; /* This should really be
-                                      * "return ssl2_read(s,buf,len)",
-                                      * but that would allow for
-                                      * denial-of-service attacks if a
-                                      * C compiler is used that does not
-                                      * recognize end-recursion. */
-#else
-               /* If a 0 byte packet was sent, return 0, otherwise
-                * we play havoc with people using select with
-                * blocking sockets.  Let them handle a packet at a time,
-                * they should really be using non-blocking sockets. */
-               if (s->s2->ract_data_length == 0)
-                       return(0);
-               return(ssl2_read(s,buf,len));
-#endif
+                                      * "return ssl2_read(s,buf,len)",
+                                      * but that would allow for
+                                      * denial-of-service attacks if a
+                                      * C compiler is used that does not
+                                      * recognize end-recursion. */
                }
        else
                {
@@ -306,7 +308,7 @@ int ssl2_read(SSL *s, void *buf, int len)
        return ssl2_read_internal(s, buf, len, 0);
        }
 
-int ssl2_peek(SSL *s, char *buf, int len)
+int ssl2_peek(SSL *s, void *buf, int len)
        {
        return ssl2_read_internal(s, buf, len, 1);
        }
@@ -599,10 +601,8 @@ static int do_ssl_write(SSL *s, const unsigned char *buf, unsigned int len)
        s->s2->wact_data= &(s->s2->wbuf[3+mac_size]);
        /* we copy the data into s->s2->wbuf */
        memcpy(s->s2->wact_data,buf,len);
-#ifdef PURIFY
        if (p)
-               memset(&(s->s2->wact_data[len]),0,p);
-#endif
+               memset(&(s->s2->wact_data[len]),0,p); /* arbitrary padding */
 
        if (!s->s2->clear_text)
                {
@@ -714,7 +714,7 @@ static int ssl_mt_error(int n)
                }
        return(ret);
        }
-#else /* !NO_SSL2 */
+#else /* !OPENSSL_NO_SSL2 */
 
 # if PEDANTIC
 static void *dummy=&dummy;