modulusLen = PK11_GetPrivateModulusLen(sc->serverKey);
modulusLen = PK11_GetPrivateModulusLen(sc->SERVERKEY);
ssl2_ServerSetupSessionCypher(sslSocket *ss, int cipher, unsigned int keyBits,			 PRUint8 *ck, unsigned int ckLen,			 PRUint8 *ek, unsigned int ekLen,			 PRUint8 *ca, unsigned int caLen){    PRUint8           *kk = NULL;    sslSessionID *    sid;    PRUint8       *   kbuf = 0;	/* buffer for RSA decrypted data. */    unsigned int      el1;	/* length of RSA decrypted data in kbuf */    unsigned int      keySize;    unsigned int      modulusLen;    SECStatus         rv;    PRUint8           mkbuf[SSL_MAX_MASTER_KEY_BYTES];    sslServerCerts  * sc = ss->serverCerts + kt_rsa;    PORT_Assert( ssl_Have1stHandshakeLock(ss) );    PORT_Assert( ssl_HaveRecvBufLock(ss)   );    PORT_Assert((sc->serverKey != 0));    PORT_Assert((ss->sec.ci.sid != 0));    sid = ss->sec.ci.sid;    keySize = (keyBits + 7) >> 3;    /* Is the message just way too big? */    if (keySize > SSL_MAX_MASTER_KEY_BYTES) {	/* bummer */	SSL_DBG(("%d: SSL[%d]: keySize=%d ckLen=%d max session key size=%d",		 SSL_GETPID(), ss->fd, keySize, ckLen,		 SSL_MAX_MASTER_KEY_BYTES));	PORT_SetError(SSL_ERROR_BAD_CLIENT);	goto loser;    }    /* Trying to cut down on all these switch statements that should be tables.     * So, test cipherType once, here, and then use tables below.      */    switch (cipher) {    case SSL_CK_RC4_128_EXPORT40_WITH_MD5:    case SSL_CK_RC4_128_WITH_MD5:    case SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5:    case SSL_CK_RC2_128_CBC_WITH_MD5:    case SSL_CK_DES_64_CBC_WITH_MD5:    case SSL_CK_DES_192_EDE3_CBC_WITH_MD5:	break;    default:	SSL_DBG(("%d: SSL[%d]: ssl2_ServerSetupSessionCypher: unknown cipher=%d",		 SSL_GETPID(), ss->fd, cipher));	PORT_SetError(SSL_ERROR_BAD_CLIENT);	goto loser;    }    /* For export ciphers, make sure they didn't send too much key data. */    if (ckLen != ssl_Specs[cipher].pubLen) {	SSL_DBG(("%d: SSL[%d]: odd secret key size, keySize=%d ckLen=%d!",		 SSL_GETPID(), ss->fd, keySize, ckLen));	/* Somebody tried to sneak by a strange secret key */	PORT_SetError(SSL_ERROR_BAD_CLIENT);	goto loser;    }    /* allocate the buffer to hold the decrypted portion of the key. */    /* XXX Haven't done any range check on ekLen. */    kbuf = (PRUint8*) PORT_Alloc(ekLen);    if (!kbuf) {	goto loser;    }    /*    ** Decrypt encrypted half of the key. Note that encrypted half has    ** been made to match the modulus size of our public key using    ** PKCS#1. keySize is the real size of the data that is interesting.    ** NOTE: PK11_PubDecryptRaw will barf on a non-RSA key. This is    ** desired behavior here.    */    rv = PK11_PubDecryptRaw(sc->serverKey, kbuf, &el1, ekLen, ek, ekLen);    if (rv != SECSuccess) 	goto hide_loser;    modulusLen = PK11_GetPrivateModulusLen(sc->serverKey);    if (modulusLen == -1) {	/* If the key was really bad, then PK11_pubDecryptRaw	 * would have failed, therefore the we must assume that the card	 * is just being a pain and not giving us the modulus... but it	 * should be the same size as the encrypted key length, so use it	 * and keep cranking */	modulusLen = ekLen;    }    /* Is the length of the decrypted data (el1) the expected value? */    if (modulusLen != el1) 	goto hide_loser;    /* Cheaply verify that PKCS#1 was used to format the encryption block */    kk = kbuf + modulusLen - (keySize - ckLen);    if ((kbuf[0] != 0x00) || (kbuf[1] != 0x02) || (kk[-1] != 0x00)) {	/* Tsk tsk. */	SSL_DBG(("%d: SSL[%d]: strange encryption block",		 SSL_GETPID(), ss->fd));	PORT_SetError(SSL_ERROR_BAD_CLIENT);	goto hide_loser;    }    /* Make sure we're not subject to a version rollback attack. */    if (ss->enableSSL3 || ss->enableTLS) {	PRUint8 threes[8] = { 0x03, 0x03, 0x03, 0x03,			      0x03, 0x03, 0x03, 0x03 };		if (PORT_Memcmp(kk - 8 - 1, threes, 8) == 0) {	    PORT_SetError(SSL_ERROR_BAD_CLIENT);	    goto hide_loser;	}    }    if (0) {hide_loser:	/* Defense against the Bleichenbacher attack.	 * Provide the client with NO CLUES that the decrypted master key	 * was erroneous.  Don't send any error messages.	 * Instead, Generate a completely bogus master key .	 */	PK11_GenerateRandom(kbuf, ekLen);	if (!kk) {	    kk = kbuf + ekLen - (keySize-ckLen);	}    }    /*    ** Construct master key out of the pieces.    */    if (ckLen) {	PORT_Memcpy(mkbuf, ck, ckLen);    }    PORT_Memcpy(mkbuf+ckLen, kk, keySize-ckLen);    /* Fill in session-id */    rv = ssl2_FillInSID(sid, cipher, mkbuf, keySize, ca, caLen,		   keyBits, keyBits - (ckLen<<3),		   ss->sec.authAlgorithm, ss->sec.authKeyBits,		   ss->sec.keaType,       ss->sec.keaKeyBits);    if (rv != SECSuccess) {	goto loser;    }    /* Create session ciphers */    rv = ssl2_CreateSessionCypher(ss, sid, PR_FALSE);    if (rv != SECSuccess) {	goto loser;    }    SSL_TRC(1, ("%d: SSL[%d]: server, using %s cipher, clear=%d total=%d",		SSL_GETPID(), ss->fd, ssl_cipherName[cipher],		ckLen<<3, keySize<<3));    rv = SECSuccess;    goto done;  loser:    rv = SECFailure;  done:    PORT_Free(kbuf);    return rv;}