rv = PK11_DigestBegin(ss->ssl3->hs.md5); if (rv != SECSuccess) { ssl_MapLowLevelError(SSL_ERROR_MD5_DIGEST_FAILURE); return rv; } rv = PK11_DigestBegin(ss->ssl3->hs.sha); if (rv != SECSuccess) { ssl_MapLowLevelError(SSL_ERROR_SHA_DIGEST_FAILURE); return rv;
if (ss->opt.bypassPKCS11) { MD5_Begin((MD5Context *)ss->ssl3.hs.md5_cx); SHA1_Begin((SHA1Context *)ss->ssl3.hs.sha_cx); } else { rv = PK11_DigestBegin(ss->ssl3.hs.md5); if (rv != SECSuccess) { ssl_MapLowLevelError(SSL_ERROR_MD5_DIGEST_FAILURE); return rv; } rv = PK11_DigestBegin(ss->ssl3.hs.sha); if (rv != SECSuccess) { ssl_MapLowLevelError(SSL_ERROR_SHA_DIGEST_FAILURE); return rv; }
ssl3_HandleHandshakeMessage(sslSocket *ss, SSL3Opaque *b, PRUint32 length){    SECStatus         rv 	= SECSuccess;    SSL3HandshakeType type 	= ss->ssl3->hs.msg_type;    SSL3Hashes        hashes;	/* computed hashes are put here. */    PRUint8           hdr[4];    PORT_Assert( ssl_HaveRecvBufLock(ss) );    PORT_Assert( ssl_HaveSSL3HandshakeLock(ss) );    /*     * We have to compute the hashes before we update them with the     * current message.     */    ssl_GetSpecReadLock(ss);	/************************************/    if((type == finished) || (type == certificate_verify)) {	SSL3Sender      sender = (SSL3Sender)0;	ssl3CipherSpec *rSpec  = ss->ssl3->prSpec;	if (type == finished) {	    sender = ss->sec.isServer ? sender_client : sender_server;	    rSpec  = ss->ssl3->crSpec;	}	rv = ssl3_ComputeHandshakeHashes(ss, rSpec, &hashes, sender);    }    ssl_ReleaseSpecReadLock(ss); /************************************/    if (rv != SECSuccess) {	return rv;	/* error code was set by ssl3_ComputeHandshakeHashes*/    }    SSL_TRC(30,("%d: SSL3[%d]: handle handshake message: %s", SSL_GETPID(),		ss->fd, ssl3_DecodeHandshakeType(ss->ssl3->hs.msg_type)));    PRINT_BUF(60, (ss, "MD5 handshake hash:",    	      (unsigned char*)ss->ssl3->hs.md5, MD5_LENGTH));    PRINT_BUF(95, (ss, "SHA handshake hash:",    	      (unsigned char*)ss->ssl3->hs.sha, SHA1_LENGTH));    hdr[0] = (PRUint8)ss->ssl3->hs.msg_type;    hdr[1] = (PRUint8)(length >> 16);    hdr[2] = (PRUint8)(length >>  8);    hdr[3] = (PRUint8)(length      );    /* Start new handshake hashes when we start a new handshake */    if (ss->ssl3->hs.msg_type == client_hello) {	SSL_TRC(30,("%d: SSL3[%d]: reset handshake hashes",		SSL_GETPID(), ss->fd ));	rv = PK11_DigestBegin(ss->ssl3->hs.md5);	if (rv != SECSuccess) {	    ssl_MapLowLevelError(SSL_ERROR_MD5_DIGEST_FAILURE);	    return rv;	}	rv = PK11_DigestBegin(ss->ssl3->hs.sha);	if (rv != SECSuccess) {	    ssl_MapLowLevelError(SSL_ERROR_SHA_DIGEST_FAILURE);	    return rv;	}    }    /* We should not include hello_request messages in the handshake hashes */    if (ss->ssl3->hs.msg_type != hello_request) {	rv = ssl3_UpdateHandshakeHashes(ss, (unsigned char*) hdr, 4);	if (rv != SECSuccess) return rv;	/* err code already set. */	rv = ssl3_UpdateHandshakeHashes(ss, b, length);	if (rv != SECSuccess) return rv;	/* err code already set. */    }    PORT_SetError(0);	/* each message starts with no error. */    switch (ss->ssl3->hs.msg_type) {    case hello_request:	if (length != 0) {	    (void)ssl3_DecodeError(ss);	    PORT_SetError(SSL_ERROR_RX_MALFORMED_HELLO_REQUEST);	    return SECFailure;	}	if (ss->sec.isServer) {	    (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message);	    PORT_SetError(SSL_ERROR_RX_UNEXPECTED_HELLO_REQUEST);	    return SECFailure;	}	rv = ssl3_HandleHelloRequest(ss);	break;    case client_hello:	if (!ss->sec.isServer) {	    (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message);	    PORT_SetError(SSL_ERROR_RX_UNEXPECTED_CLIENT_HELLO);	    return SECFailure;	}	rv = ssl3_HandleClientHello(ss, b, length);	break;    case server_hello:	if (ss->sec.isServer) {	    (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message);	    PORT_SetError(SSL_ERROR_RX_UNEXPECTED_SERVER_HELLO);	    return SECFailure;	}	rv = ssl3_HandleServerHello(ss, b, length);	break;    case certificate:	rv = ssl3_HandleCertificate(ss, b, length);	break;    case server_key_exchange:	if (ss->sec.isServer) {	    (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message);	    PORT_SetError(SSL_ERROR_RX_UNEXPECTED_SERVER_KEY_EXCH);	    return SECFailure;	}	rv = ssl3_HandleServerKeyExchange(ss, b, length);	break;    case certificate_request:	if (ss->sec.isServer) {	    (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message);	    PORT_SetError(SSL_ERROR_RX_UNEXPECTED_CERT_REQUEST);	    return SECFailure;	}	rv = ssl3_HandleCertificateRequest(ss, b, length);	break;    case server_hello_done:	if (length != 0) {	    (void)ssl3_DecodeError(ss);	    PORT_SetError(SSL_ERROR_RX_MALFORMED_HELLO_DONE);	    return SECFailure;	}	if (ss->sec.isServer) {	    (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message);	    PORT_SetError(SSL_ERROR_RX_UNEXPECTED_HELLO_DONE);	    return SECFailure;	}	rv = ssl3_HandleServerHelloDone(ss);	break;    case certificate_verify:	if (!ss->sec.isServer) {	    (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message);	    PORT_SetError(SSL_ERROR_RX_UNEXPECTED_CERT_VERIFY);	    return SECFailure;	}	rv = ssl3_HandleCertificateVerify(ss, b, length, &hashes);	break;    case client_key_exchange:	if (!ss->sec.isServer) {	    (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message);	    PORT_SetError(SSL_ERROR_RX_UNEXPECTED_CLIENT_KEY_EXCH);	    return SECFailure;	}	rv = ssl3_HandleClientKeyExchange(ss, b, length);	break;    case finished:        rv = ssl3_HandleFinished(ss, b, length, &hashes);	break;    default:	(void)SSL3_SendAlert(ss, alert_fatal, unexpected_message);	PORT_SetError(SSL_ERROR_RX_UNKNOWN_HANDSHAKE);	rv = SECFailure;    }    return rv;}