自学教程：C++ ssl3_finish_mac函数代码示例

/* send s->init_buf in records of type 'type' (SSL3_RT_HANDSHAKE or SSL3_RT_CHANGE_CIPHER_SPEC) */int ssl3_do_write(SSL *s, int type)	{	int ret;	ret=ssl3_write_bytes(s,type,&s->init_buf->data[s->init_off],	                     s->init_num);	if (ret < 0) return(-1);	if (type == SSL3_RT_HANDSHAKE)		/* should not be done for 'Hello Request's, but in that case		 * we'll ignore the result anyway */		ssl3_finish_mac(s,(unsigned char *)&s->init_buf->data[s->init_off],ret);		if (ret == s->init_num)		{		if (s->msg_callback)			s->msg_callback(1, s->version, type, s->init_buf->data, (size_t)(s->init_off + s->init_num), s, s->msg_callback_arg);		return(1);		}	s->init_off+=ret;	s->init_num-=ret;	return(0);	}

//.........这里部分代码省略.........#endif			s2n(0,d);			if (s->options & SSL_OP_NETSCAPE_CHALLENGE_BUG)				ch_len=SSL2_CHALLENGE_LENGTH;			else				ch_len=SSL2_MAX_CHALLENGE_LENGTH;			/* write out sslv2 challenge */			/* Note that ch_len must be <= SSL3_RANDOM_SIZE (32),			   because it is one of SSL2_MAX_CHALLENGE_LENGTH (32)			   or SSL2_MAX_CHALLENGE_LENGTH (16), but leave the			   check in for futurproofing */			if (SSL3_RANDOM_SIZE < ch_len)				i=SSL3_RANDOM_SIZE;			else				i=ch_len;			s2n(i,d);			memset(&(s->s3->client_random[0]),0,SSL3_RANDOM_SIZE);			if (RAND_pseudo_bytes(&(s->s3->client_random[SSL3_RANDOM_SIZE-i]),i) <= 0)				return -1;			memcpy(p,&(s->s3->client_random[SSL3_RANDOM_SIZE-i]),i);			p+=i;			i= p- &(buf[2]);			buf[0]=((i>>8)&0xff)|0x80;			buf[1]=(i&0xff);			/* number of bytes to write */			s->init_num=i+2;			s->init_off=0;			ssl3_finish_mac(s,&(buf[2]),i);			}		else			{			/* create Client Hello in SSL 3.0/TLS 1.0 format */			/* do the record header (5 bytes) and handshake message			 * header (4 bytes) last. Note: the final argument to			 * ssl_add_clienthello_tlsext below depends on the size			 * of this prefix. */			d = p = &(buf[9]);						*(p++) = version_major;			*(p++) = version_minor;			/* Random stuff */			memcpy(p, s->s3->client_random, SSL3_RANDOM_SIZE);			p += SSL3_RANDOM_SIZE;			/* Session ID (zero since there is no reuse) */			*(p++) = 0;			/* Ciphers supported (using SSL 3.0/TLS 1.0 format) */			i=ssl_cipher_list_to_bytes(s,SSL_get_ciphers(s),&(p[2]),ssl3_put_cipher_by_char);			if (i == 0)				{				SSLerr(SSL_F_SSL23_CLIENT_HELLO,SSL_R_NO_CIPHERS_AVAILABLE);				return -1;				}#ifdef OPENSSL_MAX_TLS1_2_CIPHER_LENGTH			/* Some servers hang if client hello > 256 bytes			 * as hack workaround chop number of supported ciphers			 * to keep it well below this if we use TLS v1.2

//.........这里部分代码省略.........		v[0] = p[3]; /* == SSL3_VERSION_MAJOR */		v[1] = p[4];		/* An SSLv3/TLSv1 backwards-compatible CLIENT-HELLO in an SSLv2		 * header is sent directly on the wire, not wrapped as a TLS		 * record. It's format is:		 * Byte  Content		 * 0-1   msg_length		 * 2     msg_type		 * 3-4   version		 * 5-6   cipher_spec_length		 * 7-8   session_id_length		 * 9-10  challenge_length		 * ...   ...		 */		n=((p[0]&0x7f)<<8)|p[1];		if (n > (1024*4))			{			SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_RECORD_TOO_LARGE);			goto err;			}		if (n < 9)			{			SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_RECORD_LENGTH_MISMATCH);			goto err;			}		j=ssl23_read_bytes(s,n+2);		/* We previously read 11 bytes, so if j > 0, we must have		 * j == n+2 == s->packet_length. We have at least 11 valid		 * packet bytes. */		if (j <= 0) return(j);		ssl3_finish_mac(s, s->packet+2, s->packet_length-2);		if (s->msg_callback)			s->msg_callback(0, SSL2_VERSION, 0, s->packet+2, s->packet_length-2, s, s->msg_callback_arg); /* CLIENT-HELLO */		p=s->packet;		p+=5;		n2s(p,csl);		n2s(p,sil);		n2s(p,cl);		d=(unsigned char *)s->init_buf->data;		if ((csl+sil+cl+11) != s->packet_length) /* We can't have TLS extensions in SSL 2.0 format		                                          * Client Hello, can we? Error condition should be		                                          * '>' otherweise */			{			SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_RECORD_LENGTH_MISMATCH);			goto err;			}		/* record header: msg_type ... */		*(d++) = SSL3_MT_CLIENT_HELLO;		/* ... and length (actual value will be written later) */		d_len = d;		d += 3;		/* client_version */		*(d++) = SSL3_VERSION_MAJOR; /* == v[0] */		*(d++) = v[1];		/* lets populate the random area */		/* get the challenge_length */		i=(cl > SSL3_RANDOM_SIZE)?SSL3_RANDOM_SIZE:cl;		memset(d,0,SSL3_RANDOM_SIZE);		memcpy(&(d[SSL3_RANDOM_SIZE-i]),&(p[csl+sil]),i);

//.........这里部分代码省略.........			skip_message = 0;			if (!s->server)				if (p[0] == SSL3_MT_HELLO_REQUEST)					/* The server may always send 'Hello Request' messages --					 * we are doing a handshake anyway now, so ignore them					 * if their format is correct. Does not count for					 * 'Finished' MAC. */					if (p[1] == 0 && p[2] == 0 &&p[3] == 0)						{						s->init_num = 0;						skip_message = 1;						if (s->msg_callback)							s->msg_callback(0, s->version, SSL3_RT_HANDSHAKE, p, 4, s, s->msg_callback_arg);						}			}		while (skip_message);		/* s->init_num == 4 */		if ((mt >= 0) && (*p != mt))			{			al=SSL_AD_UNEXPECTED_MESSAGE;			SSLerr(SSL_F_SSL3_GET_MESSAGE,SSL_R_UNEXPECTED_MESSAGE);			goto f_err;			}		if ((mt < 0) && (*p == SSL3_MT_CLIENT_HELLO) &&					(st1 == SSL3_ST_SR_CERT_A) &&					(stn == SSL3_ST_SR_CERT_B))			{			/* At this point we have got an MS SGC second client			 * hello (maybe we should always allow the client to			 * start a new handshake?). We need to restart the mac.			 * Don't increment {num,total}_renegotiations because			 * we have not completed the handshake. */			ssl3_init_finished_mac(s);			}		s->s3->tmp.message_type= *(p++);		n2l3(p,l);		if (l > (unsigned long)max)			{			al=SSL_AD_ILLEGAL_PARAMETER;			SSLerr(SSL_F_SSL3_GET_MESSAGE,SSL_R_EXCESSIVE_MESSAGE_SIZE);			goto f_err;			}		if (l > (INT_MAX-4)) /* BUF_MEM_grow takes an 'int' parameter */			{			al=SSL_AD_ILLEGAL_PARAMETER;			SSLerr(SSL_F_SSL3_GET_MESSAGE,SSL_R_EXCESSIVE_MESSAGE_SIZE);			goto f_err;			}		if (l && !BUF_MEM_grow_clean(s->init_buf,(int)l+4))			{			SSLerr(SSL_F_SSL3_GET_MESSAGE,ERR_R_BUF_LIB);			goto err;			}		s->s3->tmp.message_size=l;		s->state=stn;		s->init_msg = s->init_buf->data + 4;		s->init_num = 0;		}	/* next state (stn) */	p = s->init_msg;	n = s->s3->tmp.message_size - s->init_num;	while (n > 0)		{		i=s->method->ssl_read_bytes(s,SSL3_RT_HANDSHAKE,&p[s->init_num],n,0);		if (i <= 0)			{			s->rwstate=SSL_READING;			*ok = 0;			return i;			}		s->init_num += i;		n -= i;		}#ifndef OPENSSL_NO_NEXTPROTONEG	/* If receiving Finished, record MAC of prior handshake messages for	 * Finished verification. */	if (*s->init_buf->data == SSL3_MT_FINISHED)		ssl3_take_mac(s);#endif	/* Feed this message into MAC computation. */	ssl3_finish_mac(s, (unsigned char *)s->init_buf->data, s->init_num + 4);	if (s->msg_callback)		s->msg_callback(0, s->version, SSL3_RT_HANDSHAKE, s->init_buf->data, (size_t)s->init_num + 4, s, s->msg_callback_arg);	*ok=1;	return s->init_num;f_err:	ssl3_send_alert(s,SSL3_AL_FATAL,al);err:	*ok=0;	return(-1);	}

//.........这里部分代码省略.........#endif			s2n(0,d);			if (s->options & SSL_OP_NETSCAPE_CHALLENGE_BUG)				ch_len=SSL2_CHALLENGE_LENGTH;			else				ch_len=SSL2_MAX_CHALLENGE_LENGTH;			/* write out sslv2 challenge */			/* Note that ch_len must be <= SSL3_RANDOM_SIZE (32),			   because it is one of SSL2_MAX_CHALLENGE_LENGTH (32)			   or SSL2_MAX_CHALLENGE_LENGTH (16), but leave the			   check in for futurproofing */			if (SSL3_RANDOM_SIZE < ch_len)				i=SSL3_RANDOM_SIZE;			else				i=ch_len;			s2n(i,d);			memset(&(s->s3->client_random[0]),0,SSL3_RANDOM_SIZE);			if (RAND_pseudo_bytes(&(s->s3->client_random[SSL3_RANDOM_SIZE-i]),i) <= 0)				return -1;			memcpy(p,&(s->s3->client_random[SSL3_RANDOM_SIZE-i]),i);			p+=i;			i= p- &(buf[2]);			buf[0]=((i>>8)&0xff)|0x80;			buf[1]=(i&0xff);			/* number of bytes to write */			s->init_num=i+2;			s->init_off=0;			ssl3_finish_mac(s,&(buf[2]),i);			}		else			{			/* create Client Hello in SSL 3.0/TLS 1.0 format */			/* do the record header (5 bytes) and handshake message header (4 bytes) last */			d = p = &(buf[9]);						*(p++) = version_major;			*(p++) = version_minor;			/* Random stuff */			memcpy(p, s->s3->client_random, SSL3_RANDOM_SIZE);			p += SSL3_RANDOM_SIZE;			/* Session ID (zero since there is no reuse) */			*(p++) = 0;			/* Ciphers supported (using SSL 3.0/TLS 1.0 format) */			i=ssl_cipher_list_to_bytes(s,SSL_get_ciphers(s),&(p[2]),ssl3_put_cipher_by_char);			if (i == 0)				{				SSLerr(SSL_F_SSL23_CLIENT_HELLO,SSL_R_NO_CIPHERS_AVAILABLE);				return -1;				}			s2n(i,p);			p+=i;			/* COMPRESSION */#ifdef OPENSSL_NO_COMP			*(p++)=1;#else

/* Obtain handshake message of message type 'mt' (any if mt == -1), * maximum acceptable body length 'max'. * Read an entire handshake message.  Handshake messages arrive in * fragments. */long dtls1_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)	{	int i, al;	struct hm_header_st *msg_hdr;	unsigned char *p;	unsigned long msg_len;	/* s3->tmp is used to store messages that are unexpected, caused	 * by the absence of an optional handshake message */	if (s->s3->tmp.reuse_message)		{		s->s3->tmp.reuse_message=0;		if ((mt >= 0) && (s->s3->tmp.message_type != mt))			{			al=SSL_AD_UNEXPECTED_MESSAGE;			SSLerr(SSL_F_DTLS1_GET_MESSAGE,SSL_R_UNEXPECTED_MESSAGE);			goto f_err;			}		*ok=1;		s->init_msg = s->init_buf->data + DTLS1_HM_HEADER_LENGTH;		s->init_num = (int)s->s3->tmp.message_size;		return s->init_num;		}	msg_hdr = &s->d1->r_msg_hdr;	memset(msg_hdr, 0x00, sizeof(struct hm_header_st));again:	i = dtls1_get_message_fragment(s, st1, stn, max, ok);	if ( i == DTLS1_HM_BAD_FRAGMENT ||		i == DTLS1_HM_FRAGMENT_RETRY)  /* bad fragment received */		goto again;	else if ( i <= 0 && !*ok)		return i;	p = (unsigned char *)s->init_buf->data;	msg_len = msg_hdr->msg_len;	/* reconstruct message header */	*(p++) = msg_hdr->type;	l2n3(msg_len,p);	s2n (msg_hdr->seq,p);	l2n3(0,p);	l2n3(msg_len,p);	if (s->version != DTLS1_BAD_VER) {		p       -= DTLS1_HM_HEADER_LENGTH;		msg_len += DTLS1_HM_HEADER_LENGTH;	}	ssl3_finish_mac(s, p, msg_len);	if (s->msg_callback)		s->msg_callback(0, s->version, SSL3_RT_HANDSHAKE,			p, msg_len,			s, s->msg_callback_arg);	memset(msg_hdr, 0x00, sizeof(struct hm_header_st));	/* Don't change sequence numbers while listening */	if (!s->d1->listen)		s->d1->handshake_read_seq++;	s->init_msg = s->init_buf->data + DTLS1_HM_HEADER_LENGTH;	return s->init_num;f_err:	ssl3_send_alert(s,SSL3_AL_FATAL,al);	*ok = 0;	return -1;	}

//.........这里部分代码省略.........			len = curr_mtu;		else			len = s->init_num;		/* XDTLS: this function is too long.  split out the CCS part */		if ( type == SSL3_RT_HANDSHAKE)			{			if ( s->init_off != 0)				{				OPENSSL_assert(s->init_off > DTLS1_HM_HEADER_LENGTH);				s->init_off -= DTLS1_HM_HEADER_LENGTH;				s->init_num += DTLS1_HM_HEADER_LENGTH;				if ( s->init_num > curr_mtu)					len = curr_mtu;				else					len = s->init_num;				}			dtls1_fix_message_header(s, frag_off, 				len - DTLS1_HM_HEADER_LENGTH);			dtls1_write_message_header(s, (unsigned char *)&s->init_buf->data[s->init_off]);			OPENSSL_assert(len >= DTLS1_HM_HEADER_LENGTH);			}		ret=dtls1_write_bytes(s,type,&s->init_buf->data[s->init_off],			len);		if (ret < 0)			{			/* might need to update MTU here, but we don't know			 * which previous packet caused the failure -- so can't			 * really retransmit anything.  continue as if everything			 * is fine and wait for an alert to handle the			 * retransmit 			 */			if ( BIO_ctrl(SSL_get_wbio(s),				BIO_CTRL_DGRAM_MTU_EXCEEDED, 0, NULL) > 0 )				s->d1->mtu = BIO_ctrl(SSL_get_wbio(s),					BIO_CTRL_DGRAM_QUERY_MTU, 0, NULL);			else				return(-1);			}		else			{			/* bad if this assert fails, only part of the handshake			 * message got sent.  but why would this happen? */			OPENSSL_assert(len == (unsigned int)ret);			if (type == SSL3_RT_HANDSHAKE && ! s->d1->retransmitting)				{				/* should not be done for 'Hello Request's, but in that case				 * we'll ignore the result anyway */				unsigned char *p = (unsigned char *)&s->init_buf->data[s->init_off];				const struct hm_header_st *msg_hdr = &s->d1->w_msg_hdr;				int xlen;				if (frag_off == 0 && s->client_version != DTLS1_BAD_VER)					{					/* reconstruct message header is if it					 * is being sent in single fragment */					*p++ = msg_hdr->type;					l2n3(msg_hdr->msg_len,p);					s2n (msg_hdr->seq,p);					l2n3(0,p);					l2n3(msg_hdr->msg_len,p);					p  -= DTLS1_HM_HEADER_LENGTH;					xlen = ret;					}				else					{					p  += DTLS1_HM_HEADER_LENGTH;					xlen = ret - DTLS1_HM_HEADER_LENGTH;					}				ssl3_finish_mac(s, p, xlen);				}			if (ret == s->init_num)				{				if (s->msg_callback)					s->msg_callback(1, s->version, type, s->init_buf->data, 						(size_t)(s->init_off + s->init_num), s, 						s->msg_callback_arg);				s->init_off = 0;  /* done writing this message */				s->init_num = 0;				return(1);				}			s->init_off+=ret;			s->init_num-=ret;			frag_off += (ret -= DTLS1_HM_HEADER_LENGTH);			}		}	return(0);	}

//.........这里部分代码省略.........	if (FIPS_mode() && (s->version < TLS1_VERSION))		{		SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,					SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE);		goto err;		}#endif	if (s->state == SSL23_ST_SR_CLNT_HELLO_B)		{		/* we have SSLv3/TLSv1 in an SSLv2 header		 * (other cases skip this state) */		type=2;		p=s->packet;		v[0] = p[3]; /* == SSL3_VERSION_MAJOR */		v[1] = p[4];/* The SSL2 protocol allows n to be larger, just pick * a reasonable buffer size. */#if SSL3_RT_DEFAULT_PACKET_SIZE < 1024*4 - SSL3_RT_DEFAULT_WRITE_OVERHEAD#error "SSL3_RT_DEFAULT_PACKET_SIZE is too small."#endif		n=((p[0]&0x7f)<<8)|p[1];		if (n > SSL3_RT_DEFAULT_PACKET_SIZE - 2)			{			SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_RECORD_TOO_LARGE);			goto err;			}		j=ssl23_read_bytes(s,n+2);		if (j <= 0) return(j);		ssl3_finish_mac(s, s->packet+2, s->packet_length-2);		if (s->msg_callback)			s->msg_callback(0, SSL2_VERSION, 0, s->packet+2, s->packet_length-2, s, s->msg_callback_arg); /* CLIENT-HELLO */		p=s->packet;		p+=5;		n2s(p,csl);		n2s(p,sil);		n2s(p,cl);		d=(unsigned char *)s->init_buf->data;		if ((csl+sil+cl+11) != s->packet_length)			{			SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_RECORD_LENGTH_MISMATCH);			goto err;			}		/* record header: msg_type ... */		*(d++) = SSL3_MT_CLIENT_HELLO;		/* ... and length (actual value will be written later) */		d_len = d;		d += 3;		/* client_version */		*(d++) = SSL3_VERSION_MAJOR; /* == v[0] */		*(d++) = v[1];		/* lets populate the random area */		/* get the challenge_length */		i=(cl > SSL3_RANDOM_SIZE)?SSL3_RANDOM_SIZE:cl;		memset(d,0,SSL3_RANDOM_SIZE);		memcpy(&(d[SSL3_RANDOM_SIZE-i]),&(p[csl+sil]),i);		d+=SSL3_RANDOM_SIZE;

//.........这里部分代码省略.........		p += SSL3_RANDOM_SIZE;		/* Session ID */		if (s->new_session || s->session == NULL)			i=0;		else			i=s->session->session_id_length;		*(p++)=i;		if (i != 0)			{			if (i > (int)sizeof(s->session->session_id))				{				OPENSSL_PUT_ERROR(SSL, ssl23_client_hello, ERR_R_INTERNAL_ERROR);				return -1;				}			memcpy(p,s->session->session_id,i);			p+=i;			}		/* Ciphers supported (using SSL 3.0/TLS 1.0 format) */		i = ssl_cipher_list_to_bytes(s, SSL_get_ciphers(s), &p[2]);		if (i == 0)			{			OPENSSL_PUT_ERROR(SSL, ssl23_client_hello, SSL_R_NO_CIPHERS_AVAILABLE);			return -1;			}		s2n(i,p);		p+=i;		/* COMPRESSION */		*(p++)=1;		*(p++)=0; /* Add the NULL method */		/* TLS extensions*/		if (ssl_prepare_clienthello_tlsext(s) <= 0)			{			OPENSSL_PUT_ERROR(SSL, ssl23_client_hello, SSL_R_CLIENTHELLO_TLSEXT);			return -1;			}		/* The buffer includes the 5 byte record header, so		 * subtract it to compute hlen for		 * ssl_add_clienthello_tlsext. */		if ((p = ssl_add_clienthello_tlsext(s, p, buf+SSL3_RT_MAX_PLAIN_LENGTH, p-buf-5)) == NULL)			{			OPENSSL_PUT_ERROR(SSL, ssl23_client_hello, ERR_R_INTERNAL_ERROR);			return -1;			}					l = p-d;		/* fill in 4-byte handshake header */		d=&(buf[5]);		*(d++)=SSL3_MT_CLIENT_HELLO;		l2n3(l,d);		l += 4;		if (l > SSL3_RT_MAX_PLAIN_LENGTH)			{			OPENSSL_PUT_ERROR(SSL, ssl23_client_hello, ERR_R_INTERNAL_ERROR);			return -1;			}		/* fill in 5-byte record header */		d=buf;		*(d++) = SSL3_RT_HANDSHAKE;		*(d++) = version_major;		/* Some servers hang if we use long client hellos		 * and a record number > TLS 1.0.		 */		if (TLS1_get_client_version(s) > TLS1_VERSION)			*(d++) = 1;		else			*(d++) = version_minor;		s2n((int)l,d);		/* number of bytes to write */		s->init_num=p-buf;		s->init_off=0;		ssl3_finish_mac(s,&(buf[5]), s->init_num - 5);		s->state=SSL23_ST_CW_CLNT_HELLO_B;		s->init_off=0;		}	/* SSL3_ST_CW_CLNT_HELLO_B */	ret = ssl23_write_bytes(s);	if ((ret >= 2) && s->msg_callback)		{		/* Client Hello has been sent; tell msg_callback */		s->msg_callback(1, version, SSL3_RT_HEADER, s->init_buf->data, 5, s, s->msg_callback_arg);		s->msg_callback(1, version, SSL3_RT_HANDSHAKE, s->init_buf->data+5, ret-5, s, s->msg_callback_arg);		}	return ret;	}

/* Obtain handshake message of message type 'mt' (any if mt == -1), * maximum acceptable body length 'max'. * Read an entire handshake message.  Handshake messages arrive in * fragments. */long dtls1_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)	{	int i, al;	struct hm_header_st *msg_hdr;	/* s3->tmp is used to store messages that are unexpected, caused	 * by the absence of an optional handshake message */	if (s->s3->tmp.reuse_message)		{		s->s3->tmp.reuse_message=0;		if ((mt >= 0) && (s->s3->tmp.message_type != mt))			{			al=SSL_AD_UNEXPECTED_MESSAGE;			SSLerr(SSL_F_DTLS1_GET_MESSAGE,SSL_R_UNEXPECTED_MESSAGE);			goto f_err;			}		*ok=1;		s->init_msg = s->init_buf->data + DTLS1_HM_HEADER_LENGTH;		s->init_num = (int)s->s3->tmp.message_size;		return s->init_num;		}	msg_hdr = &s->d1->r_msg_hdr;	do		{		if ( msg_hdr->frag_off == 0)			{			/* s->d1->r_message_header.msg_len = 0; */			memset(msg_hdr, 0x00, sizeof(struct hm_header_st));			}		i = dtls1_get_message_fragment(s, st1, stn, max, ok);		if ( i == DTLS1_HM_BAD_FRAGMENT ||			i == DTLS1_HM_FRAGMENT_RETRY)  /* bad fragment received */			continue;		else if ( i <= 0 && !*ok)			return i;		/* Note that s->init_sum is used as a counter summing		 * up fragments' lengths: as soon as they sum up to		 * handshake packet length, we assume we have got all		 * the fragments. Overlapping fragments would cause		 * premature termination, so we don't expect overlaps.		 * Well, handling overlaps would require something more		 * drastic. Indeed, as it is now there is no way to		 * tell if out-of-order fragment from the middle was		 * the last. '>=' is the best/least we can do to control		 * the potential damage caused by malformed overlaps. */		if ((unsigned int)s->init_num >= msg_hdr->msg_len)			{			unsigned char *p = (unsigned char *)s->init_buf->data;			unsigned long msg_len = msg_hdr->msg_len;			/* reconstruct message header as if it was			 * sent in single fragment */			*(p++) = msg_hdr->type;			l2n3(msg_len,p);			s2n (msg_hdr->seq,p);			l2n3(0,p);			l2n3(msg_len,p);			if (s->client_version != DTLS1_BAD_VER)				p       -= DTLS1_HM_HEADER_LENGTH,				msg_len += DTLS1_HM_HEADER_LENGTH;			ssl3_finish_mac(s, p, msg_len);			if (s->msg_callback)				s->msg_callback(0, s->version, SSL3_RT_HANDSHAKE,					p, msg_len,					s, s->msg_callback_arg);			memset(msg_hdr, 0x00, sizeof(struct hm_header_st));			s->d1->handshake_read_seq++;			/* we just read a handshake message from the other side:			 * this means that we don't need to retransmit of the			 * buffered messages.  			 * XDTLS: may be able clear out this			 * buffer a little sooner (i.e if an out-of-order			 * handshake message/record is received at the record			 * layer.  			 * XDTLS: exception is that the server needs to			 * know that change cipher spec and finished messages			 * have been received by the client before clearing this			 * buffer.  this can simply be done by waiting for the			 * first data  segment, but is there a better way?  */			dtls1_clear_record_buffer(s);			s->init_msg = s->init_buf->data + DTLS1_HM_HEADER_LENGTH;			return s->init_num;			}		else			msg_hdr->frag_off = i;		} while(1) ;f_err://.........这里部分代码省略.........

//.........这里部分代码省略.........		*(p++) = version_major;		*(p++) = version_minor;		/* Random stuff */		memcpy(p, s->s3->client_random, SSL3_RANDOM_SIZE);		p += SSL3_RANDOM_SIZE;		/* Session ID (zero since there is no reuse) */		*(p++) = 0;		/* Ciphers supported (using SSL 3.0/TLS 1.0 format) */		i = ssl_cipher_list_to_bytes(s, SSL_get_ciphers(s), &(p[2]),		    ssl3_put_cipher_by_char);		if (i == 0) {			SSLerr(SSL_F_SSL23_CLIENT_HELLO,			    SSL_R_NO_CIPHERS_AVAILABLE);			return -1;		}#ifdef OPENSSL_MAX_TLS1_2_CIPHER_LENGTH		/*		 * Some servers hang if client hello > 256 bytes		 * as hack workaround chop number of supported ciphers		 * to keep it well below this if we use TLS v1.2		 */		if (TLS1_get_version(s) >= TLS1_2_VERSION &&		    i > OPENSSL_MAX_TLS1_2_CIPHER_LENGTH)			i = OPENSSL_MAX_TLS1_2_CIPHER_LENGTH & ~1;#endif		s2n(i, p);		p += i;		/* add in (no) COMPRESSION */		*(p++) = 1;		/* Add the NULL method */		*(p++) = 0;		/* TLS extensions*/		if (ssl_prepare_clienthello_tlsext(s) <= 0) {			SSLerr(SSL_F_SSL23_CLIENT_HELLO,			    SSL_R_CLIENTHELLO_TLSEXT);			return -1;		}		if ((p = ssl_add_clienthello_tlsext(s, p,		    buf + SSL3_RT_MAX_PLAIN_LENGTH)) == NULL) {			SSLerr(SSL_F_SSL23_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);			return -1;		}		l = p - d;		/* fill in 4-byte handshake header */		d = &(buf[5]);		*(d++) = SSL3_MT_CLIENT_HELLO;		l2n3(l, d);		l += 4;		if (l > SSL3_RT_MAX_PLAIN_LENGTH) {			SSLerr(SSL_F_SSL23_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);			return -1;		}		/* fill in 5-byte record header */		d = buf;		*(d++) = SSL3_RT_HANDSHAKE;		*(d++) = version_major;		/*		 * Some servers hang if we use long client hellos		 * and a record number > TLS 1.0.		 */		if (TLS1_get_client_version(s) > TLS1_VERSION)			*(d++) = 1;		else			*(d++) = version_minor;		s2n((int)l, d);		/* number of bytes to write */		s->init_num = p - buf;		s->init_off = 0;		ssl3_finish_mac(s, &(buf[5]), s->init_num - 5);		s->state = SSL23_ST_CW_CLNT_HELLO_B;		s->init_off = 0;	}	/* SSL3_ST_CW_CLNT_HELLO_B */	ret = ssl23_write_bytes(s);	if ((ret >= 2) && s->msg_callback) {		/* Client Hello has been sent; tell msg_callback */		s->msg_callback(1, version, SSL3_RT_HANDSHAKE,		    s->init_buf->data + 5, ret - 5, s, s->msg_callback_arg);	}	return ret;}

/* Obtain handshake message of message type 'mt' (any if mt == -1), * maximum acceptable body length 'max'. * Read an entire handshake message.  Handshake messages arrive in * fragments. */long dtls1_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)	{	int i, al;	struct hm_header_st *msg_hdr;	unsigned char *p;	unsigned long msg_len;	/* s3->tmp is used to store messages that are unexpected, caused	 * by the absence of an optional handshake message */	if (s->s3->tmp.reuse_message)		{		s->s3->tmp.reuse_message=0;		if ((mt >= 0) && (s->s3->tmp.message_type != mt))			{			al=SSL_AD_UNEXPECTED_MESSAGE;			SSLerr(SSL_F_DTLS1_GET_MESSAGE,SSL_R_UNEXPECTED_MESSAGE);			goto f_err;			}		*ok=1;		s->init_msg = s->init_buf->data + DTLS1_HM_HEADER_LENGTH;		s->init_num = (int)s->s3->tmp.message_size;		return s->init_num;		}	msg_hdr = &s->d1->r_msg_hdr;	memset(msg_hdr, 0x00, sizeof(struct hm_header_st));again:	i = dtls1_get_message_fragment(s, st1, stn, max, ok);	if ( i == DTLS1_HM_BAD_FRAGMENT ||		i == DTLS1_HM_FRAGMENT_RETRY)  /* bad fragment received */		goto again;	else if ( i <= 0 && !*ok)		return i;	p = (unsigned char *)s->init_buf->data;	msg_len = msg_hdr->msg_len;	/* reconstruct message header */	*(p++) = msg_hdr->type;	l2n3(msg_len,p);	s2n (msg_hdr->seq,p);	l2n3(0,p);	l2n3(msg_len,p);	if (s->version != DTLS1_BAD_VER) {		p       -= DTLS1_HM_HEADER_LENGTH;		msg_len += DTLS1_HM_HEADER_LENGTH;	}	ssl3_finish_mac(s, p, msg_len);	if (s->msg_callback)		s->msg_callback(0, s->version, SSL3_RT_HANDSHAKE,			p, msg_len,			s, s->msg_callback_arg);	memset(msg_hdr, 0x00, sizeof(struct hm_header_st));	s->d1->handshake_read_seq++;	/* we just read a handshake message from the other side:	 * this means that we don't need to retransmit of the	 * buffered messages.  	 * XDTLS: may be able clear out this	 * buffer a little sooner (i.e if an out-of-order	 * handshake message/record is received at the record	 * layer.  	 * XDTLS: exception is that the server needs to	 * know that change cipher spec and finished messages	 * have been received by the client before clearing this	 * buffer.  this can simply be done by waiting for the	 * first data  segment, but is there a better way?  */	dtls1_clear_record_buffer(s);	s->init_msg = s->init_buf->data + DTLS1_HM_HEADER_LENGTH;	return s->init_num;f_err:	ssl3_send_alert(s,SSL3_AL_FATAL,al);	*ok = 0;	return -1;	}

//.........这里部分代码省略.........#endif	if ( s->init_off == 0  && type == SSL3_RT_HANDSHAKE)		OPENSSL_assert(s->init_num == 			(int)s->d1->w_msg_hdr.msg_len + DTLS1_HM_HEADER_LENGTH);	frag_off = 0;	while( s->init_num)		{		curr_mtu = s->d1->mtu - BIO_wpending(SSL_get_wbio(s)) - 			DTLS1_RT_HEADER_LENGTH;		if ( curr_mtu <= DTLS1_HM_HEADER_LENGTH)			{			/* grr.. we could get an error if MTU picked was wrong */			ret = BIO_flush(SSL_get_wbio(s));			if ( ret <= 0)				return ret;			curr_mtu = s->d1->mtu - DTLS1_RT_HEADER_LENGTH;			}		if ( s->init_num > curr_mtu)			len = curr_mtu;		else			len = s->init_num;		/* XDTLS: this function is too long.  split out the CCS part */		if ( type == SSL3_RT_HANDSHAKE)			{			if ( s->init_off != 0)				{				OPENSSL_assert(s->init_off > DTLS1_HM_HEADER_LENGTH);				s->init_off -= DTLS1_HM_HEADER_LENGTH;				s->init_num += DTLS1_HM_HEADER_LENGTH;                /* write atleast DTLS1_HM_HEADER_LENGTH bytes */				if ( len <= DTLS1_HM_HEADER_LENGTH)  					len += DTLS1_HM_HEADER_LENGTH;				}						dtls1_fix_message_header(s, frag_off, 				len - DTLS1_HM_HEADER_LENGTH);			dtls1_write_message_header(s, (unsigned char *)&s->init_buf->data[s->init_off]);			OPENSSL_assert(len >= DTLS1_HM_HEADER_LENGTH);			}		ret=dtls1_write_bytes(s,type,&s->init_buf->data[s->init_off],			len);		if (ret < 0)			{			/* might need to update MTU here, but we don't know			 * which previous packet caused the failure -- so can't			 * really retransmit anything.  continue as if everything			 * is fine and wait for an alert to handle the			 * retransmit 			 */			if ( BIO_ctrl(SSL_get_wbio(s),				BIO_CTRL_DGRAM_MTU_EXCEEDED, 0, NULL))				s->d1->mtu = BIO_ctrl(SSL_get_wbio(s),					BIO_CTRL_DGRAM_QUERY_MTU, 0, NULL);			else				return(-1);			}		else			{						/* bad if this assert fails, only part of the handshake			 * message got sent.  but why would this happen? */			OPENSSL_assert(len == (unsigned int)ret); 						if (type == SSL3_RT_HANDSHAKE && ! s->d1->retransmitting)				/* should not be done for 'Hello Request's, but in that case				 * we'll ignore the result anyway */				ssl3_finish_mac(s, 					(unsigned char *)&s->init_buf->data[s->init_off + 						DTLS1_HM_HEADER_LENGTH], ret - DTLS1_HM_HEADER_LENGTH);						if (ret == s->init_num)				{				if (s->msg_callback)					s->msg_callback(1, s->version, type, s->init_buf->data, 						(size_t)(s->init_off + s->init_num), s, 						s->msg_callback_arg);				s->init_off = 0;  /* done writing this message */				s->init_num = 0;								return(1);				}			s->init_off+=ret;			s->init_num-=ret;			frag_off += (ret -= DTLS1_HM_HEADER_LENGTH);			}		}	return(0);	}

/* Obtain handshake message of message type 'mt' (any if mt == -1), * maximum acceptable body length 'max'. * The first four bytes (msg_type and length) are read in state 'st1', * the body is read in state 'stn'. */long ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)	{	unsigned char *p;	unsigned long l;	long n;	int i,al;	if (s->s3->tmp.reuse_message)		{		s->s3->tmp.reuse_message=0;		if ((mt >= 0) && (s->s3->tmp.message_type != mt))			{			al=SSL_AD_UNEXPECTED_MESSAGE;			SSLerr(SSL_F_SSL3_GET_MESSAGE,SSL_R_UNEXPECTED_MESSAGE);			goto f_err;			}		*ok=1;		return((int)s->s3->tmp.message_size);		}	p=(unsigned char *)s->init_buf->data;	if (s->state == st1) /* s->init_num < 4 */		{		int skip_message;		do			{			while (s->init_num < 4)				{				i=ssl3_read_bytes(s,SSL3_RT_HANDSHAKE,&p[s->init_num],					4 - s->init_num, 0);				if (i <= 0)					{					s->rwstate=SSL_READING;					*ok = 0;					return i;					}				s->init_num+=i;				}						skip_message = 0;			if (!s->server)				if (p[0] == SSL3_MT_HELLO_REQUEST)					/* The server may always send 'Hello Request' messages --					 * we are doing a handshake anyway now, so ignore them					 * if their format is correct. Does not count for					 * 'Finished' MAC. */					if (p[1] == 0 && p[2] == 0 &&p[3] == 0)						skip_message = 1;			}		while (skip_message);		/* s->init_num == 4 */		if ((mt >= 0) && (*p != mt))			{			al=SSL_AD_UNEXPECTED_MESSAGE;			SSLerr(SSL_F_SSL3_GET_MESSAGE,SSL_R_UNEXPECTED_MESSAGE);			goto f_err;			}		if ((mt < 0) && (*p == SSL3_MT_CLIENT_HELLO) &&					(st1 == SSL3_ST_SR_CERT_A) &&					(stn == SSL3_ST_SR_CERT_B))			{			/* At this point we have got an MS SGC second client			 * hello (maybe we should always allow the client to			 * start a new handshake?). We need to restart the mac.			 * Don't increment {num,total}_renegotiations because			 * we have not completed the handshake. */			ssl3_init_finished_mac(s);			}		ssl3_finish_mac(s, (unsigned char *)s->init_buf->data, 4);					s->s3->tmp.message_type= *(p++);		n2l3(p,l);		if (l > (unsigned long)max)			{			al=SSL_AD_ILLEGAL_PARAMETER;			SSLerr(SSL_F_SSL3_GET_MESSAGE,SSL_R_EXCESSIVE_MESSAGE_SIZE);			goto f_err;			}		if (l && !BUF_MEM_grow(s->init_buf,(int)l))			{			SSLerr(SSL_F_SSL3_GET_MESSAGE,ERR_R_BUF_LIB);			goto err;			}		s->s3->tmp.message_size=l;		s->state=stn;		s->init_num=0;		}//.........这里部分代码省略.........

//.........这里部分代码省略.........            al = SSL_AD_UNEXPECTED_MESSAGE;            SSLerr(SSL_F_SSL3_GET_MESSAGE, SSL_R_UNEXPECTED_MESSAGE);            goto f_err;        }        s->s3->tmp.message_type = *(p++);        if(RECORD_LAYER_is_sslv2_record(&s->rlayer)) {            /*             * Only happens with SSLv3+ in an SSLv2 backward compatible             * ClientHello             */             /*              * Total message size is the remaining record bytes to read              * plus the SSL3_HM_HEADER_LENGTH bytes that we already read              */            l = RECORD_LAYER_get_rrec_length(&s->rlayer)                + SSL3_HM_HEADER_LENGTH;            if (l && !BUF_MEM_grow_clean(s->init_buf, (int)l)) {                SSLerr(SSL_F_SSL3_GET_MESSAGE, ERR_R_BUF_LIB);                goto err;            }            s->s3->tmp.message_size = l;            s->state = stn;            s->init_msg = s->init_buf->data;            s->init_num = SSL3_HM_HEADER_LENGTH;        } else {            n2l3(p, l);            if (l > (unsigned long)max) {                al = SSL_AD_ILLEGAL_PARAMETER;                SSLerr(SSL_F_SSL3_GET_MESSAGE, SSL_R_EXCESSIVE_MESSAGE_SIZE);                goto f_err;            }            /* BUF_MEM_grow takes an 'int' parameter */            if (l > (INT_MAX - SSL3_HM_HEADER_LENGTH)) {                al = SSL_AD_ILLEGAL_PARAMETER;                SSLerr(SSL_F_SSL3_GET_MESSAGE, SSL_R_EXCESSIVE_MESSAGE_SIZE);                goto f_err;            }            if (l && !BUF_MEM_grow_clean(s->init_buf,                                        (int)l + SSL3_HM_HEADER_LENGTH)) {                SSLerr(SSL_F_SSL3_GET_MESSAGE, ERR_R_BUF_LIB);                goto err;            }            s->s3->tmp.message_size = l;            s->state = stn;            s->init_msg = s->init_buf->data + SSL3_HM_HEADER_LENGTH;            s->init_num = 0;        }    }    /* next state (stn) */    p = s->init_msg;    n = s->s3->tmp.message_size - s->init_num;    while (n > 0) {        i = s->method->ssl_read_bytes(s, SSL3_RT_HANDSHAKE, NULL,                                      &p[s->init_num], n, 0);        if (i <= 0) {            s->rwstate = SSL_READING;            *ok = 0;            return i;        }        s->init_num += i;        n -= i;    }#ifndef OPENSSL_NO_NEXTPROTONEG    /*     * If receiving Finished, record MAC of prior handshake messages for     * Finished verification.     */    if (*s->init_buf->data == SSL3_MT_FINISHED)        ssl3_take_mac(s);#endif    /* Feed this message into MAC computation. */    if(RECORD_LAYER_is_sslv2_record(&s->rlayer)) {        ssl3_finish_mac(s, (unsigned char *)s->init_buf->data, s->init_num);        if (s->msg_callback)            s->msg_callback(0, SSL2_VERSION, 0,  s->init_buf->data,                            (size_t)s->init_num, s, s->msg_callback_arg);    } else {        ssl3_finish_mac(s, (unsigned char *)s->init_buf->data,            s->init_num + SSL3_HM_HEADER_LENGTH);        if (s->msg_callback)            s->msg_callback(0, s->version, SSL3_RT_HANDSHAKE, s->init_buf->data,                            (size_t)s->init_num + SSL3_HM_HEADER_LENGTH, s,                            s->msg_callback_arg);    }    *ok = 1;    return s->init_num; f_err:    ssl3_send_alert(s, SSL3_AL_FATAL, al); err:    *ok = 0;    return (-1);}