SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_INTERNAL_ERROR);
SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,ERR_R_INTERNAL_ERROR);
static int ssl3_get_cert_verify(SSL *s)	{	EVP_PKEY *pkey=NULL;	unsigned char *p;	int al,ok,ret=0;	long n;	int type=0,i,j;	X509 *peer;	n=ssl3_get_message(s,		SSL3_ST_SR_CERT_VRFY_A,		SSL3_ST_SR_CERT_VRFY_B,		-1,		512, /* 512? */		&ok);	if (!ok) return((int)n);	if (s->session->peer != NULL)		{		peer=s->session->peer;		pkey=X509_get_pubkey(peer);		type=X509_certificate_type(peer,pkey);		}	else		{		peer=NULL;		pkey=NULL;		}	if (s->s3->tmp.message_type != SSL3_MT_CERTIFICATE_VERIFY)		{		s->s3->tmp.reuse_message=1;		if ((peer != NULL) && (type | EVP_PKT_SIGN))			{			al=SSL_AD_UNEXPECTED_MESSAGE;			SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_MISSING_VERIFY_MESSAGE);			goto f_err;			}		ret=1;		goto end;		}	if (peer == NULL)		{		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_NO_CLIENT_CERT_RECEIVED);		al=SSL_AD_UNEXPECTED_MESSAGE;		goto f_err;		}	if (!(type & EVP_PKT_SIGN))		{		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE);		al=SSL_AD_ILLEGAL_PARAMETER;		goto f_err;		}	if (s->s3->change_cipher_spec)		{		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_CCS_RECEIVED_EARLY);		al=SSL_AD_UNEXPECTED_MESSAGE;		goto f_err;		}	/* we now have a signature that we need to verify */	p=(unsigned char *)s->init_buf->data;	n2s(p,i);	n-=2;	if (i > n)		{		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_LENGTH_MISMATCH);		al=SSL_AD_DECODE_ERROR;		goto f_err;		}	j=EVP_PKEY_size(pkey);	if ((i > j) || (n > j) || (n <= 0))		{		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_WRONG_SIGNATURE_SIZE);		al=SSL_AD_DECODE_ERROR;		goto f_err;		}#ifndef OPENSSL_NO_RSA 	if (pkey->type == EVP_PKEY_RSA)		{		i=RSA_verify(NID_md5_sha1, s->s3->tmp.cert_verify_md,			MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH, p, i, 							pkey->pkey.rsa);		if (i < 0)			{			al=SSL_AD_DECRYPT_ERROR;			SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_BAD_RSA_DECRYPT);			goto f_err;			}		if (i == 0)			{			al=SSL_AD_DECRYPT_ERROR;			SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_BAD_RSA_SIGNATURE);			goto f_err;			}		}	else#endif#ifndef OPENSSL_NO_DSA		if (pkey->type == EVP_PKEY_DSA)		{		j=DSA_verify(pkey->save_type,			&(s->s3->tmp.cert_verify_md[MD5_DIGEST_LENGTH]),			SHA_DIGEST_LENGTH,p,i,pkey->pkey.dsa);		if (j <= 0)			{			/* bad signature */			al=SSL_AD_DECRYPT_ERROR;			SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_BAD_DSA_SIGNATURE);			goto f_err;			}		}	else#endif		{		SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_INTERNAL_ERROR);		al=SSL_AD_UNSUPPORTED_CERTIFICATE;		goto f_err;		}	ret=1;	if (0)		{f_err:		ssl3_send_alert(s,SSL3_AL_FATAL,al);		}end:	EVP_PKEY_free(pkey);	return(ret);	}