Some comments added, and slight code clean-ups.

diff --git a/ssl/s3_both.c b/ssl/s3_both.c
index bbe9aa74236e9d500fcbff842da1be208f164c1d..9b6766322e2151e5745dbb0c277471df833ea5ec 100644 (file)
--- a/ssl/s3_both.c
+++ b/ssl/s3_both.c
@@ -256,6 +256,11 @@ unsigned long ssl3_output_cert_chain(SSL *s, X509 *x)
        return(l);
        }
 
+/* Obtain handshake message of message type 'mt' (any if mt == -1),
+ * maximum acceptable body length 'max'.
+ * The first four bytes (msg_type and length) are read in state 'st1',
+ * the body is read in state 'stn'.
+ */
 long ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)
        {
        unsigned char *p;

diff --git a/ssl/s3_pkt.c b/ssl/s3_pkt.c
index cac7953e3159bcfc15ee9b9cdda187a245ec9db2..a1a701458527fd5b3da13fc357875580df7342e4 100644 (file)
--- a/ssl/s3_pkt.c
+++ b/ssl/s3_pkt.c
@@ -299,26 +299,26 @@ again:
                        goto f_err;
                        }
 
-               /* now s->rstate == SSL_ST_READ_BODY; */
+               /* now s->rstate == SSL_ST_READ_BODY */
                }
 
-       /* get and decode the data */
-       if (s->rstate == SSL_ST_READ_BODY)
+       /* s->rstate == SSL_ST_READ_BODY, get and decode the data */
+
+       if (rr->length > (s->packet_length-SSL3_RT_HEADER_LENGTH))
                {
-               if (rr->length > (s->packet_length-SSL3_RT_HEADER_LENGTH))
-                       {
-                       i=rr->length;
-                       n=ssl3_read_n(s,i,i,1);
-                       if (n <= 0) return(n); /* error or non-blocking io */
-                       }
-               s->rstate=SSL_ST_READ_HEADER;
+               /* now s->packet_length == SSL3_RT_HEADER_LENGTH */
+               i=rr->length;
+               n=ssl3_read_n(s,i,i,1);
+               if (n <= 0) return(n); /* error or non-blocking io */
+               /* now n == rr->length,
+                * and s->packet_length == SSL3_RT_HEADER_LENGTH + rr->length */
                }
 
-       /* At this point, we have the data in s->packet and there should be
-        * s->packet_length bytes, we must not 'overrun' this buffer :-)
-        * One of the following functions will copy the data from the
-        * s->packet buffer */
+       s->rstate=SSL_ST_READ_HEADER; /* set state for later operations */
 
+       /* At this point, s->packet_length == SSL3_RT_HEADER_LNGTH + rr->length,
+        * and we have that many bytes in s->packet
+        */
        rr->input= &(s->packet[SSL3_RT_HEADER_LENGTH]);
 
        /* ok, we can now read from 's->packet' data into 'rr'
@@ -328,9 +328,6 @@ again:
         * When the data is 'copied' into the rr->data buffer,
         * rr->input will be pointed at the new buffer */ 
 
-       /* Set the state for the following operations */
-       s->rstate=SSL_ST_READ_HEADER;
-
        /* We now have - encrypted [ MAC [ compressed [ plain ] ] ]
         * rr->length bytes of encrypted compressed stuff. */
 
@@ -371,7 +368,7 @@ printf("\n");
                        SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_PRE_MAC_LENGTH_TOO_LONG);
                        goto f_err;
                        }
-               /* check MAC for rr->input' */
+               /* check the MAC for rr->input (it's in mac_size bytes at the tail) */
                if (rr->length < mac_size)
                        {
                        al=SSL_AD_DECODE_ERROR;
@@ -471,12 +468,12 @@ static int do_compress(SSL *ssl)
        return(1);
        }
 
-/* Call this to write data
+/* Call this to write data in records of type 'type'
  * It will return <= 0 if not all data has been sent or non-blocking IO.
  */
-int ssl3_write_bytes(SSL *s, int type, const void *_buf, int len)
+int ssl3_write_bytes(SSL *s, int type, const void *buf_, int len)
        {
-       const unsigned char *buf=_buf;
+       const unsigned char *buf=buf_;
        unsigned int tot,n,nw;
        int i;
 
@@ -800,7 +797,7 @@ start:
                                cb(s,SSL_CB_READ_ALERT,j);
                                }
 
-                       if (i == 1)
+                       if (i == 1) /* warning */
                                {
                                s->s3->warn_alert=n;
                                if (n == SSL_AD_CLOSE_NOTIFY)
@@ -809,7 +806,7 @@ start:
                                        return(0);
                                        }
                                }
-                       else if (i == 2)
+                       else if (i == 2) /* fatal */
                                {
                                char tmp[16];
 
@@ -940,8 +937,11 @@ start:
                                goto f_err;
                                }
                        }
+               /* not reached */
                }
 
+       /* rr->type == type */
+
        /* make sure that we are not getting application data when we
         * are doing a handshake for the first time */
        if (SSL_in_init(s) && (type == SSL3_RT_APPLICATION_DATA) &&
@@ -1019,6 +1019,7 @@ static int do_change_cipher_spec(SSL *s)
        return(1);
        }
 
+/* send s->init_buf in records of type 'type' */
 int ssl3_do_write(SSL *s, int type)
        {
        int ret;

diff --git a/ssl/ssl.h b/ssl/ssl.h
index 55f3ab4de81c941e99ca8bedb06c7065f33b9d1b..3ada66d9ab99e3914c4f024ec843af44052e9829 100644 (file)
--- a/ssl/ssl.h
+++ b/ssl/ssl.h
@@ -595,7 +595,7 @@ struct ssl_st
        STACK_OF(SSL_CIPHER) *cipher_list;
        STACK_OF(SSL_CIPHER) *cipher_list_by_id;
 
-       /* These are the ones being used, the ones is SSL_SESSION are
+       /* These are the ones being used, the ones in SSL_SESSION are
         * the ones to be 'copied' into these ones */
 
        EVP_CIPHER_CTX *enc_read_ctx;           /* cryptographic state */
@@ -1108,7 +1108,9 @@ int SSL_version(SSL *ssl);
 int SSL_CTX_set_default_verify_paths(SSL_CTX *ctx);
 int SSL_CTX_load_verify_locations(SSL_CTX *ctx, const char *CAfile,
        const char *CApath);
+#define SSL_get0_session SSL_get_session /* just peek at pointer */
 SSL_SESSION *SSL_get_session(SSL *ssl);
+SSL_SESSION *SSL_get1_session(SSL *ssl); /* obtain a reference count */
 SSL_CTX *SSL_get_SSL_CTX(SSL *ssl);
 void SSL_set_info_callback(SSL *ssl,void (*cb)());
 void (*SSL_get_info_callback(SSL *ssl))();

diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c
index 849908141d76e43a01ef53d10d81b7ad290338d4..cab50d107fd8b8a832301beff4d12e905413b974 100644 (file)
--- a/ssl/ssl_sess.c
+++ b/ssl/ssl_sess.c
@@ -67,19 +67,14 @@ static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck);
 static int ssl_session_num=0;
 static STACK_OF(CRYPTO_EX_DATA_FUNCS) *ssl_session_meth=NULL;
 
-#if 1 /* traditional SSLeay behaviour */
 SSL_SESSION *SSL_get_session(SSL *ssl)
+/* aka SSL_get0_session; gets 0 objects, just returns a copy of the pointer */
        {
        return(ssl->session);
        }
-#else /* suggested change: increase reference counter so that a session
-       * can later be set in a new SSL object.
-       * Objections:
-       *   -- the modified function should have a new name (or old
-       *      applications, including s_client, leak memory);
-       *   -- the locking seems unnecessary given that SSL structures
-       *      usually cannot be safely shared between threads anyway. */
-SSL_SESSION *SSL_get_session(SSL *ssl)
+
+SSL_SESSION *SSL_get1_session(SSL *ssl)
+/* variant of SSL_get_session: caller really gets something */
        {
        SSL_SESSION *sess;
        /* Need to lock this all up rather than just use CRYPTO_add so that
@@ -92,7 +87,6 @@ SSL_SESSION *SSL_get_session(SSL *ssl)
        CRYPTO_r_unlock(CRYPTO_LOCK_SSL_SESSION);
        return(sess);
        }
-#endif
 
 int SSL_SESSION_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
             CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func)

diff --git a/util/ssleay.num b/util/ssleay.num
index 5417fbbeffff11c6e6203d128880810a63cbe045..f35094a761a50dd52ddb8d43ce4c6a714a76e26d 100755 (executable)
--- a/util/ssleay.num
+++ b/util/ssleay.num
@@ -221,3 +221,4 @@ SSL_CTX_set_purpose                     238
 SSL_set_trust                           239
 SSL_get_finished                        240
 SSL_get_peer_finished                   241
+SSL_get1_session                        242