Metrowerks for Motorola tune-up.

[openssl.git] / ssl / s3_clnt.c

diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
index de07ac76c98f5b80c10f1c3abf82d521dc1804ef..af4bd15194f2abad19e2a36f9bc65179bb06c65e 100644 (file)
--- a/ssl/s3_clnt.c
+++ b/ssl/s3_clnt.c
@@ -254,6 +254,7 @@ int ssl3_connect(SSL *s)
                case SSL3_ST_CW_CERT_A:
                case SSL3_ST_CW_CERT_B:
                case SSL3_ST_CW_CERT_C:
+               case SSL3_ST_CW_CERT_D:
                        ret=ssl3_send_client_certificate(s);
                        if (ret <= 0) goto end;
                        s->state=SSL3_ST_CW_KEY_EXCH_A;
@@ -757,7 +758,7 @@ static int ssl3_get_server_certificate(SSL *s)
                }
 
        i=ssl_verify_cert_chain(s,sk);
-        if ((s->verify_mode != SSL_VERIFY_NONE) && (!i))
+       if ((s->verify_mode != SSL_VERIFY_NONE) && (!i))
                {
                al=ssl_verify_alarm_type(s->verify_result);
                SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,SSL_R_CERTIFICATE_VERIFY_FAILED);
@@ -929,6 +930,7 @@ static int ssl3_get_key_exchange(SSL *s)
                        goto err;
                        }
                s->session->sess_cert->peer_rsa_tmp=rsa;
+               rsa=NULL;
                }
        else
 #endif
@@ -1051,15 +1053,15 @@ static int ssl3_get_key_exchange(SSL *s)
                                q+=i;
                                j+=i;
                                }
-                       i=RSA_public_decrypt((int)n,p,p,pkey->pkey.rsa,
-                               RSA_PKCS1_PADDING);
-                       if (i <= 0)
+                       i=RSA_verify(NID_md5_sha1, md_buf, j, p, n,
+                                                               pkey->pkey.rsa);
+                       if (i < 0)
                                {
                                al=SSL_AD_DECRYPT_ERROR;
                                SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_RSA_DECRYPT);
                                goto f_err;
                                }
-                       if ((j != i) || (memcmp(p,md_buf,i) != 0))
+                       if (i == 0)
                                {
                                /* bad signature */
                                al=SSL_AD_DECRYPT_ERROR;
@@ -1113,6 +1115,14 @@ f_err:
        ssl3_send_alert(s,SSL3_AL_FATAL,al);
 err:
        EVP_PKEY_free(pkey);
+#ifndef NO_RSA
+       if (rsa != NULL)
+               RSA_free(rsa);
+#endif
+#ifndef NO_DH
+       if (dh != NULL)
+               DH_free(dh);
+#endif
        return(-1);
        }
 
@@ -1326,6 +1336,7 @@ static int ssl3_send_client_key_exchange(SSL *s)
                                        goto err;
                                        }
                                rsa=pkey->pkey.rsa;
+                               EVP_PKEY_free(pkey);
                                }
                                
                        tmp_buf[0]=s->client_version>>8;
@@ -1449,7 +1460,7 @@ static int ssl3_send_client_verify(SSL *s)
        unsigned char data[MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH];
        EVP_PKEY *pkey;
 #ifndef NO_RSA
-       int i=0;
+       unsigned u=0;
 #endif
        unsigned long n;
 #ifndef NO_DSA
@@ -1470,17 +1481,15 @@ static int ssl3_send_client_verify(SSL *s)
                        {
                        s->method->ssl3_enc->cert_verify_mac(s,
                                &(s->s3->finish_dgst1),&(data[0]));
-                       i=RSA_private_encrypt(
-                               MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH,
-                               data,&(p[2]),pkey->pkey.rsa,
-                               RSA_PKCS1_PADDING);
-                       if (i <= 0)
+                       if (RSA_sign(NID_md5_sha1, data,
+                                        MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH,
+                                       &(p[2]), &u, pkey->pkey.rsa) <= 0 )
                                {
                                SSLerr(SSL_F_SSL3_SEND_CLIENT_VERIFY,ERR_R_RSA_LIB);
                                goto err;
                                }
-                       s2n(i,p);
-                       n=i+2;
+                       s2n(u,p);
+                       n=u+2;
                        }
                else
 #endif