Logo Search packages:      
Sourcecode: firefox-3.1 version File versions

ssl3con.c

/*
 * SSL3 Protocol
 *
 * ***** BEGIN LICENSE BLOCK *****
 * Version: MPL 1.1/GPL 2.0/LGPL 2.1
 *
 * The contents of this file are subject to the Mozilla Public License Version
 * 1.1 (the "License"); you may not use this file except in compliance with
 * the License. You may obtain a copy of the License at
 * http://www.mozilla.org/MPL/
 *
 * Software distributed under the License is distributed on an "AS IS" basis,
 * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
 * for the specific language governing rights and limitations under the
 * License.
 *
 * The Original Code is the Netscape security libraries.
 *
 * The Initial Developer of the Original Code is
 * Netscape Communications Corporation.
 * Portions created by the Initial Developer are Copyright (C) 1994-2000
 * the Initial Developer. All Rights Reserved.
 *
 * Contributor(s):
 *   Dr Stephen Henson <stephen.henson@gemplus.com>
 *   Dr Vipul Gupta <vipul.gupta@sun.com> and
 *   Douglas Stebila <douglas@stebila.ca>, Sun Microsystems Laboratories
 *
 * Alternatively, the contents of this file may be used under the terms of
 * either the GNU General Public License Version 2 or later (the "GPL"), or
 * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
 * in which case the provisions of the GPL or the LGPL are applicable instead
 * of those above. If you wish to allow use of your version of this file only
 * under the terms of either the GPL or the LGPL, and not to allow others to
 * use your version of this file under the terms of the MPL, indicate your
 * decision by deleting the provisions above and replace them with the notice
 * and other provisions required by the GPL or the LGPL. If you do not delete
 * the provisions above, a recipient may use your version of this file under
 * the terms of any one of the MPL, the GPL or the LGPL.
 *
 * ***** END LICENSE BLOCK ***** */
/* $Id: ssl3con.c,v 1.113 2008/09/22 23:47:00 wtc%google.com Exp $ */

#include "cert.h"
#include "ssl.h"
#include "cryptohi.h"   /* for DSAU_ stuff */
#include "keyhi.h"
#include "secder.h"
#include "secitem.h"

#include "sslimpl.h"
#include "sslproto.h"
#include "sslerr.h"
#include "prtime.h"
#include "prinrval.h"
#include "prerror.h"
#include "pratom.h"
#include "prthread.h"

#include "pk11func.h"
#include "secmod.h"
#include "blapi.h"

#include <stdio.h>

#ifndef PK11_SETATTRS
#define PK11_SETATTRS(x,id,v,l) (x)->type = (id); \
            (x)->pValue=(v); (x)->ulValueLen = (l);
#endif

static void      ssl3_CleanupPeerCerts(sslSocket *ss);
static PK11SymKey *ssl3_GenerateRSAPMS(sslSocket *ss, ssl3CipherSpec *spec,
                                       PK11SlotInfo * serverKeySlot);
static SECStatus ssl3_DeriveMasterSecret(sslSocket *ss, PK11SymKey *pms);
static SECStatus ssl3_DeriveConnectionKeysPKCS11(sslSocket *ss);
static SECStatus ssl3_HandshakeFailure(      sslSocket *ss);
static SECStatus ssl3_InitState(             sslSocket *ss);
static SECStatus ssl3_SendCertificate(       sslSocket *ss);
static SECStatus ssl3_SendEmptyCertificate(  sslSocket *ss);
static SECStatus ssl3_SendCertificateRequest(sslSocket *ss);
static SECStatus ssl3_SendFinished(          sslSocket *ss, PRInt32 flags);
static SECStatus ssl3_SendServerHello(       sslSocket *ss);
static SECStatus ssl3_SendServerHelloDone(   sslSocket *ss);
static SECStatus ssl3_SendServerKeyExchange( sslSocket *ss);
static SECStatus ssl3_NewHandshakeHashes(    sslSocket *ss);
static SECStatus ssl3_UpdateHandshakeHashes( sslSocket *ss, unsigned char *b, 
                                             unsigned int l);

static SECStatus Null_Cipher(void *ctx, unsigned char *output, int *outputLen,
                       int maxOutputLen, const unsigned char *input,
                       int inputLen);

#define MAX_SEND_BUF_LENGTH 32000 /* watch for 16-bit integer overflow */
#define MIN_SEND_BUF_LENGTH  4000

#define MAX_CIPHER_SUITES 20

/* This list of SSL3 cipher suites is sorted in descending order of
 * precedence (desirability).  It only includes cipher suites we implement.
 * This table is modified by SSL3_SetPolicy(). The ordering of cipher suites
 * in this table must match the ordering in SSL_ImplementedCiphers (sslenum.c)
 */
static ssl3CipherSuiteCfg cipherSuites[ssl_V3_SUITES_IMPLEMENTED] = {
   /*      cipher_suite                         policy      enabled is_present*/
#ifdef NSS_ENABLE_ECC
 { TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,   SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},
 { TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,     SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},
#endif /* NSS_ENABLE_ECC */
 { TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA,  SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},
 { TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA,  SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},
 { TLS_DHE_RSA_WITH_AES_256_CBC_SHA,         SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},
 { TLS_DHE_DSS_WITH_AES_256_CBC_SHA,         SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},
#ifdef NSS_ENABLE_ECC
 { TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,      SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},
 { TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,    SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},
#endif /* NSS_ENABLE_ECC */
 { TLS_RSA_WITH_CAMELLIA_256_CBC_SHA,        SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},
 { TLS_RSA_WITH_AES_256_CBC_SHA,             SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},

#ifdef NSS_ENABLE_ECC
 { TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,       SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},
 { TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,   SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},
 { TLS_ECDHE_RSA_WITH_RC4_128_SHA,         SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},
 { TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,     SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},
#endif /* NSS_ENABLE_ECC */
 { TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA,  SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},
 { TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA,  SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},
 { TLS_DHE_DSS_WITH_RC4_128_SHA,           SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},
 { TLS_DHE_RSA_WITH_AES_128_CBC_SHA,       SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},
 { TLS_DHE_DSS_WITH_AES_128_CBC_SHA,         SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},
#ifdef NSS_ENABLE_ECC
 { TLS_ECDH_RSA_WITH_RC4_128_SHA,          SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},
 { TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,      SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},
 { TLS_ECDH_ECDSA_WITH_RC4_128_SHA,        SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},
 { TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,    SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},
#endif /* NSS_ENABLE_ECC */
 { TLS_RSA_WITH_CAMELLIA_128_CBC_SHA,        SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},
 { SSL_RSA_WITH_RC4_128_MD5,               SSL_NOT_ALLOWED, PR_TRUE, PR_FALSE},
 { SSL_RSA_WITH_RC4_128_SHA,               SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},
 { TLS_RSA_WITH_AES_128_CBC_SHA,             SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},

#ifdef NSS_ENABLE_ECC
 { TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,  SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},
 { TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,    SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},
#endif /* NSS_ENABLE_ECC */
 { SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA,      SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},
 { SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA,      SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},
#ifdef NSS_ENABLE_ECC
 { TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,     SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},
 { TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,   SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},
#endif /* NSS_ENABLE_ECC */
 { SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA,     SSL_NOT_ALLOWED, PR_TRUE, PR_FALSE},
 { SSL_RSA_WITH_3DES_EDE_CBC_SHA,          SSL_NOT_ALLOWED, PR_TRUE, PR_FALSE},


 { SSL_DHE_RSA_WITH_DES_CBC_SHA,           SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},
 { SSL_DHE_DSS_WITH_DES_CBC_SHA,           SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},
 { SSL_RSA_FIPS_WITH_DES_CBC_SHA,          SSL_NOT_ALLOWED, PR_TRUE, PR_FALSE},
 { SSL_RSA_WITH_DES_CBC_SHA,               SSL_NOT_ALLOWED, PR_TRUE, PR_FALSE},
 { TLS_RSA_EXPORT1024_WITH_RC4_56_SHA,     SSL_NOT_ALLOWED, PR_TRUE, PR_FALSE},
 { TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA,    SSL_NOT_ALLOWED, PR_TRUE, PR_FALSE},

 { SSL_RSA_EXPORT_WITH_RC4_40_MD5,         SSL_NOT_ALLOWED, PR_TRUE, PR_FALSE},
 { SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5,     SSL_NOT_ALLOWED, PR_TRUE, PR_FALSE},

#ifdef NSS_ENABLE_ECC
 { TLS_ECDHE_ECDSA_WITH_NULL_SHA,          SSL_NOT_ALLOWED, PR_FALSE, PR_FALSE},
 { TLS_ECDHE_RSA_WITH_NULL_SHA,            SSL_NOT_ALLOWED, PR_FALSE, PR_FALSE},
 { TLS_ECDH_RSA_WITH_NULL_SHA,             SSL_NOT_ALLOWED, PR_FALSE, PR_FALSE},
 { TLS_ECDH_ECDSA_WITH_NULL_SHA,           SSL_NOT_ALLOWED, PR_FALSE, PR_FALSE},
#endif /* NSS_ENABLE_ECC */
 { SSL_RSA_WITH_NULL_SHA,                  SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},
 { SSL_RSA_WITH_NULL_MD5,                  SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE},

};

static const /*SSL3CompressionMethod*/ uint8 compressions [] = {
    compression_null
};

static const int compressionMethodsCount =
            sizeof(compressions) / sizeof(compressions[0]);

static const /*SSL3ClientCertificateType */ uint8 certificate_types [] = {
    ct_RSA_sign,
    ct_DSS_sign,
#ifdef NSS_ENABLE_ECC
    ct_ECDSA_sign,
#endif /* NSS_ENABLE_ECC */
};


/*
 * make sure there is room in the write buffer for padding and
 * other compression and cryptographic expansions
 */
#define SSL3_BUFFER_FUDGE     100

#define EXPORT_RSA_KEY_LENGTH 64    /* bytes */


/* This is a hack to make sure we don't do double handshakes for US policy */
PRBool ssl3_global_policy_some_restricted = PR_FALSE;

/* This global item is used only in servers.  It is is initialized by
** SSL_ConfigSecureServer(), and is used in ssl3_SendCertificateRequest().
*/
CERTDistNames *ssl3_server_ca_list = NULL;
static SSL3Statistics ssl3stats;

/* indexed by SSL3BulkCipher */
static const ssl3BulkCipherDef bulk_cipher_defs[] = {
    /* cipher          calg        keySz secretSz  type  ivSz BlkSz keygen */
    {cipher_null,      calg_null,      0,  0, type_stream,  0, 0, kg_null},
    {cipher_rc4,       calg_rc4,      16, 16, type_stream,  0, 0, kg_strong},
    {cipher_rc4_40,    calg_rc4,      16,  5, type_stream,  0, 0, kg_export},
    {cipher_rc4_56,    calg_rc4,      16,  7, type_stream,  0, 0, kg_export},
    {cipher_rc2,       calg_rc2,      16, 16, type_block,   8, 8, kg_strong},
    {cipher_rc2_40,    calg_rc2,      16,  5, type_block,   8, 8, kg_export},
    {cipher_des,       calg_des,       8,  8, type_block,   8, 8, kg_strong},
    {cipher_3des,      calg_3des,     24, 24, type_block,   8, 8, kg_strong},
    {cipher_des40,     calg_des,       8,  5, type_block,   8, 8, kg_export},
    {cipher_idea,      calg_idea,     16, 16, type_block,   8, 8, kg_strong},
    {cipher_aes_128,   calg_aes,      16, 16, type_block,  16,16, kg_strong},
    {cipher_aes_256,   calg_aes,      32, 32, type_block,  16,16, kg_strong},
    {cipher_camellia_128, calg_camellia,16, 16, type_block,  16,16, kg_strong},
    {cipher_camellia_256, calg_camellia,32, 32, type_block,  16,16, kg_strong},
    {cipher_missing,   calg_null,      0,  0, type_stream,  0, 0, kg_null},
};

static const ssl3KEADef kea_defs[] = 
{ /* indexed by SSL3KeyExchangeAlgorithm */
    /* kea              exchKeyType signKeyType is_limited limit  tls_keygen */
    {kea_null,           kt_null,     sign_null, PR_FALSE,   0, PR_FALSE},
    {kea_rsa,            kt_rsa,      sign_rsa,  PR_FALSE,   0, PR_FALSE},
    {kea_rsa_export,     kt_rsa,      sign_rsa,  PR_TRUE,  512, PR_FALSE},
    {kea_rsa_export_1024,kt_rsa,      sign_rsa,  PR_TRUE, 1024, PR_FALSE},
    {kea_dh_dss,         kt_dh,       sign_dsa,  PR_FALSE,   0, PR_FALSE},
    {kea_dh_dss_export,  kt_dh,       sign_dsa,  PR_TRUE,  512, PR_FALSE},
    {kea_dh_rsa,         kt_dh,       sign_rsa,  PR_FALSE,   0, PR_FALSE},
    {kea_dh_rsa_export,  kt_dh,       sign_rsa,  PR_TRUE,  512, PR_FALSE},
    {kea_dhe_dss,        kt_dh,       sign_dsa,  PR_FALSE,   0, PR_FALSE},
    {kea_dhe_dss_export, kt_dh,       sign_dsa,  PR_TRUE,  512, PR_FALSE},
    {kea_dhe_rsa,        kt_dh,       sign_rsa,  PR_FALSE,   0, PR_FALSE},
    {kea_dhe_rsa_export, kt_dh,       sign_rsa,  PR_TRUE,  512, PR_FALSE},
    {kea_dh_anon,        kt_dh,       sign_null, PR_FALSE,   0, PR_FALSE},
    {kea_dh_anon_export, kt_dh,       sign_null, PR_TRUE,  512, PR_FALSE},
    {kea_rsa_fips,       kt_rsa,      sign_rsa,  PR_FALSE,   0, PR_TRUE },
#ifdef NSS_ENABLE_ECC
    {kea_ecdh_ecdsa,     kt_ecdh,     sign_ecdsa,  PR_FALSE, 0, PR_FALSE},
    {kea_ecdhe_ecdsa,    kt_ecdh,     sign_ecdsa,  PR_FALSE,   0, PR_FALSE},
    {kea_ecdh_rsa,       kt_ecdh,     sign_rsa,  PR_FALSE,   0, PR_FALSE},
    {kea_ecdhe_rsa,      kt_ecdh,     sign_rsa,  PR_FALSE,   0, PR_FALSE},
    {kea_ecdh_anon,      kt_ecdh,     sign_null,  PR_FALSE,   0, PR_FALSE},
#endif /* NSS_ENABLE_ECC */
};

/* must use ssl_LookupCipherSuiteDef to access */
static const ssl3CipherSuiteDef cipher_suite_defs[] = 
{
/*  cipher_suite                    bulk_cipher_alg mac_alg key_exchange_alg */

    {SSL_NULL_WITH_NULL_NULL,       cipher_null,   mac_null, kea_null},
    {SSL_RSA_WITH_NULL_MD5,         cipher_null,   mac_md5, kea_rsa},
    {SSL_RSA_WITH_NULL_SHA,         cipher_null,   mac_sha, kea_rsa},
    {SSL_RSA_EXPORT_WITH_RC4_40_MD5,cipher_rc4_40, mac_md5, kea_rsa_export},
    {SSL_RSA_WITH_RC4_128_MD5,      cipher_rc4,    mac_md5, kea_rsa},
    {SSL_RSA_WITH_RC4_128_SHA,      cipher_rc4,    mac_sha, kea_rsa},
    {SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5,
                                    cipher_rc2_40, mac_md5, kea_rsa_export},
#if 0 /* not implemented */
    {SSL_RSA_WITH_IDEA_CBC_SHA,     cipher_idea,   mac_sha, kea_rsa},
    {SSL_RSA_EXPORT_WITH_DES40_CBC_SHA,
                                    cipher_des40,  mac_sha, kea_rsa_export},
#endif
    {SSL_RSA_WITH_DES_CBC_SHA,      cipher_des,    mac_sha, kea_rsa},
    {SSL_RSA_WITH_3DES_EDE_CBC_SHA, cipher_3des,   mac_sha, kea_rsa},
    {SSL_DHE_DSS_WITH_DES_CBC_SHA,  cipher_des,    mac_sha, kea_dhe_dss},
    {SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA,
                                    cipher_3des,   mac_sha, kea_dhe_dss},
    {TLS_DHE_DSS_WITH_RC4_128_SHA,  cipher_rc4,    mac_sha, kea_dhe_dss},
#if 0 /* not implemented */
    {SSL_DH_DSS_EXPORT_WITH_DES40_CBC_SHA,
                                    cipher_des40,  mac_sha, kea_dh_dss_export},
    {SSL_DH_DSS_DES_CBC_SHA,        cipher_des,    mac_sha, kea_dh_dss},
    {SSL_DH_DSS_3DES_CBC_SHA,       cipher_3des,   mac_sha, kea_dh_dss},
    {SSL_DH_RSA_EXPORT_WITH_DES40_CBC_SHA,
                                    cipher_des40,  mac_sha, kea_dh_rsa_export},
    {SSL_DH_RSA_DES_CBC_SHA,        cipher_des,    mac_sha, kea_dh_rsa},
    {SSL_DH_RSA_3DES_CBC_SHA,       cipher_3des,   mac_sha, kea_dh_rsa},
    {SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA,
                                    cipher_des40,  mac_sha, kea_dh_dss_export},
    {SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA,
                                    cipher_des40,  mac_sha, kea_dh_rsa_export},
#endif
    {SSL_DHE_RSA_WITH_DES_CBC_SHA,  cipher_des,    mac_sha, kea_dhe_rsa},
    {SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA,
                                    cipher_3des,   mac_sha, kea_dhe_rsa},
#if 0
    {SSL_DH_ANON_EXPORT_RC4_40_MD5, cipher_rc4_40, mac_md5, kea_dh_anon_export},
    {SSL_DH_ANON_EXPORT_RC4_40_MD5, cipher_rc4,    mac_md5, kea_dh_anon_export},
    {SSL_DH_ANON_EXPORT_WITH_DES40_CBC_SHA,
                                    cipher_des40,  mac_sha, kea_dh_anon_export},
    {SSL_DH_ANON_DES_CBC_SHA,       cipher_des,    mac_sha, kea_dh_anon},
    {SSL_DH_ANON_3DES_CBC_SHA,      cipher_3des,   mac_sha, kea_dh_anon},
#endif


/* New TLS cipher suites */
    {TLS_RSA_WITH_AES_128_CBC_SHA,        cipher_aes_128, mac_sha, kea_rsa},
    {TLS_DHE_DSS_WITH_AES_128_CBC_SHA,    cipher_aes_128, mac_sha, kea_dhe_dss},
    {TLS_DHE_RSA_WITH_AES_128_CBC_SHA,    cipher_aes_128, mac_sha, kea_dhe_rsa},
    {TLS_RSA_WITH_AES_256_CBC_SHA,        cipher_aes_256, mac_sha, kea_rsa},
    {TLS_DHE_DSS_WITH_AES_256_CBC_SHA,    cipher_aes_256, mac_sha, kea_dhe_dss},
    {TLS_DHE_RSA_WITH_AES_256_CBC_SHA,    cipher_aes_256, mac_sha, kea_dhe_rsa},
#if 0
    {TLS_DH_DSS_WITH_AES_128_CBC_SHA,     cipher_aes_128, mac_sha, kea_dh_dss},
    {TLS_DH_RSA_WITH_AES_128_CBC_SHA,     cipher_aes_128, mac_sha, kea_dh_rsa},
    {TLS_DH_ANON_WITH_AES_128_CBC_SHA,    cipher_aes_128, mac_sha, kea_dh_anon},
    {TLS_DH_DSS_WITH_AES_256_CBC_SHA,     cipher_aes_256, mac_sha, kea_dh_dss},
    {TLS_DH_RSA_WITH_AES_256_CBC_SHA,     cipher_aes_256, mac_sha, kea_dh_rsa},
    {TLS_DH_ANON_WITH_AES_256_CBC_SHA,    cipher_aes_256, mac_sha, kea_dh_anon},
#endif

    {TLS_RSA_WITH_CAMELLIA_128_CBC_SHA, cipher_camellia_128, mac_sha, kea_rsa},
    {TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA,
     cipher_camellia_128, mac_sha, kea_dhe_dss},
    {TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA,
     cipher_camellia_128, mac_sha, kea_dhe_rsa},
    {TLS_RSA_WITH_CAMELLIA_256_CBC_SHA,   cipher_camellia_256, mac_sha, kea_rsa},
    {TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA,
     cipher_camellia_256, mac_sha, kea_dhe_dss},
    {TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA,
     cipher_camellia_256, mac_sha, kea_dhe_rsa},

    {TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA,
                                    cipher_des,    mac_sha,kea_rsa_export_1024},
    {TLS_RSA_EXPORT1024_WITH_RC4_56_SHA,
                                    cipher_rc4_56, mac_sha,kea_rsa_export_1024},

    {SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA, cipher_3des, mac_sha, kea_rsa_fips},
    {SSL_RSA_FIPS_WITH_DES_CBC_SHA, cipher_des,    mac_sha, kea_rsa_fips},

#ifdef NSS_ENABLE_ECC
    {TLS_ECDH_ECDSA_WITH_NULL_SHA,        cipher_null, mac_sha, kea_ecdh_ecdsa},
    {TLS_ECDH_ECDSA_WITH_RC4_128_SHA,      cipher_rc4, mac_sha, kea_ecdh_ecdsa},
    {TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, cipher_3des, mac_sha, kea_ecdh_ecdsa},
    {TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, cipher_aes_128, mac_sha, kea_ecdh_ecdsa},
    {TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, cipher_aes_256, mac_sha, kea_ecdh_ecdsa},

    {TLS_ECDHE_ECDSA_WITH_NULL_SHA,        cipher_null, mac_sha, kea_ecdhe_ecdsa},
    {TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,      cipher_rc4, mac_sha, kea_ecdhe_ecdsa},
    {TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, cipher_3des, mac_sha, kea_ecdhe_ecdsa},
    {TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, cipher_aes_128, mac_sha, kea_ecdhe_ecdsa},
    {TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, cipher_aes_256, mac_sha, kea_ecdhe_ecdsa},

    {TLS_ECDH_RSA_WITH_NULL_SHA,         cipher_null,    mac_sha, kea_ecdh_rsa},
    {TLS_ECDH_RSA_WITH_RC4_128_SHA,      cipher_rc4,     mac_sha, kea_ecdh_rsa},
    {TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, cipher_3des,    mac_sha, kea_ecdh_rsa},
    {TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,  cipher_aes_128, mac_sha, kea_ecdh_rsa},
    {TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,  cipher_aes_256, mac_sha, kea_ecdh_rsa},

    {TLS_ECDHE_RSA_WITH_NULL_SHA,         cipher_null,    mac_sha, kea_ecdhe_rsa},
    {TLS_ECDHE_RSA_WITH_RC4_128_SHA,      cipher_rc4,     mac_sha, kea_ecdhe_rsa},
    {TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, cipher_3des,    mac_sha, kea_ecdhe_rsa},
    {TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,  cipher_aes_128, mac_sha, kea_ecdhe_rsa},
    {TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,  cipher_aes_256, mac_sha, kea_ecdhe_rsa},

#if 0
    {TLS_ECDH_anon_WITH_NULL_SHA,         cipher_null,    mac_sha, kea_ecdh_anon},
    {TLS_ECDH_anon_WITH_RC4_128_SHA,      cipher_rc4,     mac_sha, kea_ecdh_anon},
    {TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA, cipher_3des,    mac_sha, kea_ecdh_anon},
    {TLS_ECDH_anon_WITH_AES_128_CBC_SHA,  cipher_aes_128, mac_sha, kea_ecdh_anon},
    {TLS_ECDH_anon_WITH_AES_256_CBC_SHA,  cipher_aes_256, mac_sha, kea_ecdh_anon},
#endif
#endif /* NSS_ENABLE_ECC */
};

static const CK_MECHANISM_TYPE kea_alg_defs[] = {
    0x80000000L,
    CKM_RSA_PKCS,
    CKM_DH_PKCS_DERIVE,
    CKM_KEA_KEY_DERIVE,
    CKM_ECDH1_DERIVE
};

typedef struct SSLCipher2MechStr {
    SSLCipherAlgorithm  calg;
    CK_MECHANISM_TYPE   cmech;
} SSLCipher2Mech;

/* indexed by type SSLCipherAlgorithm */
static const SSLCipher2Mech alg2Mech[] = {
    /* calg,          cmech  */
    { calg_null     , (CK_MECHANISM_TYPE)0x80000000L  },
    { calg_rc4      , CKM_RC4                   },
    { calg_rc2      , CKM_RC2_CBC               },
    { calg_des      , CKM_DES_CBC               },
    { calg_3des     , CKM_DES3_CBC              },
    { calg_idea     , CKM_IDEA_CBC              },
    { calg_fortezza , CKM_SKIPJACK_CBC64                },
    { calg_aes      , CKM_AES_CBC               },
    { calg_camellia , CKM_CAMELLIA_CBC                },
/*  { calg_init     , (CK_MECHANISM_TYPE)0x7fffffffL    }  */
};

#define mmech_null     (CK_MECHANISM_TYPE)0x80000000L
#define mmech_md5      CKM_SSL3_MD5_MAC
#define mmech_sha      CKM_SSL3_SHA1_MAC
#define mmech_md5_hmac CKM_MD5_HMAC
#define mmech_sha_hmac CKM_SHA_1_HMAC

static const ssl3MACDef mac_defs[] = { /* indexed by SSL3MACAlgorithm */
    /* mac      mmech       pad_size  mac_size                       */
    { mac_null, mmech_null,       0,  0          },
    { mac_md5,  mmech_md5,       48,  MD5_LENGTH },
    { mac_sha,  mmech_sha,       40,  SHA1_LENGTH},
    {hmac_md5,  mmech_md5_hmac,  48,  MD5_LENGTH },
    {hmac_sha,  mmech_sha_hmac,  40,  SHA1_LENGTH},
};

/* indexed by SSL3BulkCipher */
const char * const ssl3_cipherName[] = {
    "NULL",
    "RC4",
    "RC4-40",
    "RC4-56",
    "RC2-CBC",
    "RC2-CBC-40",
    "DES-CBC",
    "3DES-EDE-CBC",
    "DES-CBC-40",
    "IDEA-CBC",
    "AES-128",
    "AES-256",
    "Camellia-128",
    "Camellia-256",
    "missing"
};

#ifdef NSS_ENABLE_ECC
/* The ECCWrappedKeyInfo structure defines how various pieces of 
 * information are laid out within wrappedSymmetricWrappingkey 
 * for ECDH key exchange. Since wrappedSymmetricWrappingkey is 
 * a 512-byte buffer (see sslimpl.h), the variable length field 
 * in ECCWrappedKeyInfo can be at most (512 - 8) = 504 bytes.
 *
 * XXX For now, NSS only supports named elliptic curves of size 571 bits 
 * or smaller. The public value will fit within 145 bytes and EC params
 * will fit within 12 bytes. We'll need to revisit this when NSS
 * supports arbitrary curves.
 */
#define MAX_EC_WRAPPED_KEY_BUFLEN  504

typedef struct ECCWrappedKeyInfoStr {
    PRUint16 size;            /* EC public key size in bits */
    PRUint16 encodedParamLen; /* length (in bytes) of DER encoded EC params */
    PRUint16 pubValueLen;     /* length (in bytes) of EC public value */
    PRUint16 wrappedKeyLen;   /* length (in bytes) of the wrapped key */
    PRUint8 var[MAX_EC_WRAPPED_KEY_BUFLEN]; /* this buffer contains the */
    /* EC public-key params, the EC public value and the wrapped key  */
} ECCWrappedKeyInfo;
#endif /* NSS_ENABLE_ECC */

#if defined(TRACE)

static char *
ssl3_DecodeHandshakeType(int msgType)
{
    char * rv;
    static char line[40];

    switch(msgType) {
    case hello_request:         rv = "hello_request (0)";               break;
    case client_hello:          rv = "client_hello  (1)";               break;
    case server_hello:          rv = "server_hello  (2)";               break;
    case certificate:           rv = "certificate  (11)";               break;
    case server_key_exchange: rv = "server_key_exchange (12)";        break;
    case certificate_request: rv = "certificate_request (13)";        break;
    case server_hello_done:   rv = "server_hello_done   (14)";        break;
    case certificate_verify:  rv = "certificate_verify  (15)";        break;
    case client_key_exchange: rv = "client_key_exchange (16)";        break;
    case finished:              rv = "finished     (20)";               break;
    default:
        sprintf(line, "*UNKNOWN* handshake type! (%d)", msgType);
      rv = line;
    }
    return rv;
}

static char *
ssl3_DecodeContentType(int msgType)
{
    char * rv;
    static char line[40];

    switch(msgType) {
    case content_change_cipher_spec:
                                rv = "change_cipher_spec (20)";         break;
    case content_alert:         rv = "alert      (21)";                 break;
    case content_handshake:   rv = "handshake  (22)";                 break;
    case content_application_data:
                                rv = "application_data (23)";           break;
    default:
        sprintf(line, "*UNKNOWN* record type! (%d)", msgType);
      rv = line;
    }
    return rv;
}

#endif

SSL3Statistics * 
SSL_GetStatistics(void)
{
    return &ssl3stats;
}

typedef struct tooLongStr {
#if defined(IS_LITTLE_ENDIAN)
    PRInt32 low;
    PRInt32 high;
#else
    PRInt32 high;
    PRInt32 low;
#endif
} tooLong;

void SSL_AtomicIncrementLong(long * x)
{
    if ((sizeof *x) == sizeof(PRInt32)) {
        PR_AtomicIncrement((PRInt32 *)x);
    } else {
      tooLong * tl = (tooLong *)x;
      if (PR_AtomicIncrement(&tl->low) == 0)
          PR_AtomicIncrement(&tl->high);
    }
}

/* return pointer to ssl3CipherSuiteDef for suite, or NULL */
/* XXX This does a linear search.  A binary search would be better. */
static const ssl3CipherSuiteDef *
ssl_LookupCipherSuiteDef(ssl3CipherSuite suite)
{
    int cipher_suite_def_len =
      sizeof(cipher_suite_defs) / sizeof(cipher_suite_defs[0]);
    int i;

    for (i = 0; i < cipher_suite_def_len; i++) {
      if (cipher_suite_defs[i].cipher_suite == suite)
          return &cipher_suite_defs[i];
    }
    PORT_Assert(PR_FALSE);  /* We should never get here. */
    PORT_SetError(SSL_ERROR_UNKNOWN_CIPHER_SUITE);
    return NULL;
}

/* Find the cipher configuration struct associate with suite */
/* XXX This does a linear search.  A binary search would be better. */
static ssl3CipherSuiteCfg *
ssl_LookupCipherSuiteCfg(ssl3CipherSuite suite, ssl3CipherSuiteCfg *suites)
{
    int i;

    for (i = 0; i < ssl_V3_SUITES_IMPLEMENTED; i++) {
      if (suites[i].cipher_suite == suite)
          return &suites[i];
    }
    /* return NULL and let the caller handle it.  */
    PORT_SetError(SSL_ERROR_UNKNOWN_CIPHER_SUITE);
    return NULL;
}


/* Initialize the suite->isPresent value for config_match
 * Returns count of enabled ciphers supported by extant tokens,
 * regardless of policy or user preference.
 * If this returns zero, the user cannot do SSL v3.
 */
int
ssl3_config_match_init(sslSocket *ss)
{
    ssl3CipherSuiteCfg *      suite;
    const ssl3CipherSuiteDef *cipher_def;
    SSLCipherAlgorithm        cipher_alg;
    CK_MECHANISM_TYPE         cipher_mech;
    SSL3KEAType               exchKeyType;
    int                       i;
    int                       numPresent        = 0;
    int                       numEnabled        = 0;
    PRBool                    isServer;
    sslServerCerts           *svrAuth;

    PORT_Assert(ss);
    if (!ss) {
      PORT_SetError(SEC_ERROR_INVALID_ARGS);
      return 0;
    }
    if (!ss->opt.enableSSL3 && !ss->opt.enableTLS) {
      return 0;
    }
    isServer = (PRBool)(ss->sec.isServer != 0);

    for (i = 0; i < ssl_V3_SUITES_IMPLEMENTED; i++) {
      suite = &ss->cipherSuites[i];
      if (suite->enabled) {
          ++numEnabled;
          /* We need the cipher defs to see if we have a token that can handle
           * this cipher.  It isn't part of the static definition.
           */
          cipher_def = ssl_LookupCipherSuiteDef(suite->cipher_suite);
          if (!cipher_def) {
            suite->isPresent = PR_FALSE;
            continue;
          }
          cipher_alg=bulk_cipher_defs[cipher_def->bulk_cipher_alg ].calg;
          PORT_Assert(  alg2Mech[cipher_alg].calg == cipher_alg);
          cipher_mech = alg2Mech[cipher_alg].cmech;
          exchKeyType =
                kea_defs[cipher_def->key_exchange_alg].exchKeyType;
#ifndef NSS_ENABLE_ECC
          svrAuth = ss->serverCerts + exchKeyType;
#else
          /* XXX SSLKEAType isn't really a good choice for 
           * indexing certificates. It doesn't work for
           * (EC)DHE-* ciphers. Here we use a hack to ensure
           * that the server uses an RSA cert for (EC)DHE-RSA.
           */
          switch (cipher_def->key_exchange_alg) {
          case kea_ecdhe_rsa:
#if NSS_SERVER_DHE_IMPLEMENTED
          /* XXX NSS does not yet implement the server side of _DHE_
           * cipher suites.  Correcting the computation for svrAuth,
           * as the case below does, causes NSS SSL servers to begin to
           * negotiate cipher suites they do not implement.  So, until
           * server side _DHE_ is implemented, keep this disabled.
           */
          case kea_dhe_rsa:
#endif
            svrAuth = ss->serverCerts + kt_rsa;
            break;
          case kea_ecdh_ecdsa:
          case kea_ecdh_rsa:
              /* 
             * XXX We ought to have different indices for 
             * ECDSA- and RSA-signed EC certificates so
             * we could support both key exchange mechanisms
             * simultaneously. For now, both of them use
             * whatever is in the certificate slot for kt_ecdh
             */
          default:
            svrAuth = ss->serverCerts + exchKeyType;
            break;
          }
#endif /* NSS_ENABLE_ECC */

          /* Mark the suites that are backed by real tokens, certs and keys */
          suite->isPresent = (PRBool)
            (((exchKeyType == kt_null) ||
               ((!isServer || (svrAuth->serverKeyPair &&
                               svrAuth->SERVERKEY &&
                           svrAuth->serverCertChain)) &&
                PK11_TokenExists(kea_alg_defs[exchKeyType]))) &&
            ((cipher_alg == calg_null) || PK11_TokenExists(cipher_mech)));
          if (suite->isPresent)
            ++numPresent;
      }
    }
    PORT_Assert(numPresent > 0 || numEnabled == 0);
    if (numPresent <= 0) {
      PORT_SetError(SSL_ERROR_NO_CIPHERS_SUPPORTED);
    }
    return numPresent;
}


/* return PR_TRUE if suite matches policy and enabled state */
/* It would be a REALLY BAD THING (tm) if we ever permitted the use
** of a cipher that was NOT_ALLOWED.  So, if this is ever called with
** policy == SSL_NOT_ALLOWED, report no match.
*/
/* adjust suite enabled to the availability of a token that can do the
 * cipher suite. */
static PRBool
config_match(ssl3CipherSuiteCfg *suite, int policy, PRBool enabled)
{
    PORT_Assert(policy != SSL_NOT_ALLOWED && enabled != PR_FALSE);
    if (policy == SSL_NOT_ALLOWED || !enabled)
      return PR_FALSE;
    return (PRBool)(suite->enabled &&
                    suite->isPresent &&
                  suite->policy != SSL_NOT_ALLOWED &&
                suite->policy <= policy);
}

/* return number of cipher suites that match policy and enabled state */
/* called from ssl3_SendClientHello and ssl3_ConstructV2CipherSpecsHack */
static int
count_cipher_suites(sslSocket *ss, int policy, PRBool enabled)
{
    int i, count = 0;

    if (!ss->opt.enableSSL3 && !ss->opt.enableTLS) {
      return 0;
    }
    for (i = 0; i < ssl_V3_SUITES_IMPLEMENTED; i++) {
      if (config_match(&ss->cipherSuites[i], policy, enabled))
          count++;
    }
    if (count <= 0) {
      PORT_SetError(SSL_ERROR_SSL_DISABLED);
    }
    return count;
}

static PRBool
anyRestrictedEnabled(sslSocket *ss)
{
    int i;

    if (!ss->opt.enableSSL3 && !ss->opt.enableTLS) {
      return PR_FALSE;
    }
    for (i = 0; i < ssl_V3_SUITES_IMPLEMENTED; i++) {
      ssl3CipherSuiteCfg *suite = &ss->cipherSuites[i];
      if (suite->policy == SSL_RESTRICTED &&
          suite->enabled &&
          suite->isPresent)
          return PR_TRUE;
    }
    return PR_FALSE;
}

/*
 * Null compression, mac and encryption functions
 */

static SECStatus
Null_Cipher(void *ctx, unsigned char *output, int *outputLen, int maxOutputLen,
          const unsigned char *input, int inputLen)
{
    *outputLen = inputLen;
    if (input != output)
      PORT_Memcpy(output, input, inputLen);
    return SECSuccess;
}

/*
 * SSL3 Utility functions
 */

SECStatus
ssl3_NegotiateVersion(sslSocket *ss, SSL3ProtocolVersion peerVersion)
{
    SSL3ProtocolVersion version;
    SSL3ProtocolVersion maxVersion;

    if (ss->opt.enableTLS) {
      maxVersion = SSL_LIBRARY_VERSION_3_1_TLS;
    } else if (ss->opt.enableSSL3) {
      maxVersion = SSL_LIBRARY_VERSION_3_0;
    } else {
      /* what are we doing here? */
      PORT_Assert(ss->opt.enableSSL3 || ss->opt.enableTLS);
      PORT_SetError(SSL_ERROR_SSL_DISABLED);
      return SECFailure;
    }

    ss->version = version = PR_MIN(maxVersion, peerVersion);

    if ((version == SSL_LIBRARY_VERSION_3_1_TLS && ss->opt.enableTLS) ||
      (version == SSL_LIBRARY_VERSION_3_0     && ss->opt.enableSSL3)) {
      return SECSuccess;
    }

    PORT_SetError(SSL_ERROR_NO_CYPHER_OVERLAP);
    return SECFailure;

}

static SECStatus
ssl3_GetNewRandom(SSL3Random *random)
{
    PRUint32 gmt = ssl_Time();
    SECStatus rv;

    random->rand[0] = (unsigned char)(gmt >> 24);
    random->rand[1] = (unsigned char)(gmt >> 16);
    random->rand[2] = (unsigned char)(gmt >>  8);
    random->rand[3] = (unsigned char)(gmt);

    /* first 4 bytes are reserverd for time */
    rv = PK11_GenerateRandom(&random->rand[4], SSL3_RANDOM_LENGTH - 4);
    if (rv != SECSuccess) {
      ssl_MapLowLevelError(SSL_ERROR_GENERATE_RANDOM_FAILURE);
    }
    return rv;
}

/* Called by ssl3_SendServerKeyExchange and ssl3_SendCertificateVerify */
SECStatus
ssl3_SignHashes(SSL3Hashes *hash, SECKEYPrivateKey *key, SECItem *buf, 
                PRBool isTLS)
{
    SECStatus rv        = SECFailure;
    PRBool    doDerEncode       = PR_FALSE;
    int       signatureLen;
    SECItem   hashItem;

    buf->data    = NULL;
    signatureLen = PK11_SignatureLen(key);
    if (signatureLen <= 0) {
      PORT_SetError(SEC_ERROR_INVALID_KEY);
        goto done;
    }

    buf->len  = (unsigned)signatureLen;
    buf->data = (unsigned char *)PORT_Alloc(signatureLen);
    if (!buf->data)
        goto done;      /* error code was set. */

    switch (key->keyType) {
    case rsaKey:
      hashItem.data = hash->md5;
      hashItem.len = sizeof(SSL3Hashes);
      break;
    case dsaKey:
      doDerEncode = isTLS;
      hashItem.data = hash->sha;
      hashItem.len = sizeof(hash->sha);
      break;
#ifdef NSS_ENABLE_ECC
    case ecKey:
      doDerEncode = PR_TRUE;
      hashItem.data = hash->sha;
      hashItem.len = sizeof(hash->sha);
      break;
#endif /* NSS_ENABLE_ECC */
    default:
      PORT_SetError(SEC_ERROR_INVALID_KEY);
      goto done;
    }
    PRINT_BUF(60, (NULL, "hash(es) to be signed", hashItem.data, hashItem.len));

    rv = PK11_Sign(key, buf, &hashItem);
    if (rv != SECSuccess) {
      ssl_MapLowLevelError(SSL_ERROR_SIGN_HASHES_FAILURE);
    } else if (doDerEncode) {
      SECItem   derSig  = {siBuffer, NULL, 0};

      /* This also works for an ECDSA signature */
      rv = DSAU_EncodeDerSigWithLen(&derSig, buf, buf->len);
      if (rv == SECSuccess) {
          PORT_Free(buf->data);     /* discard unencoded signature. */
          *buf = derSig;            /* give caller encoded signature. */
      } else if (derSig.data) {
          PORT_Free(derSig.data);
      }
    }

    PRINT_BUF(60, (NULL, "signed hashes", (unsigned char*)buf->data, buf->len));
done:
    if (rv != SECSuccess && buf->data) {
      PORT_Free(buf->data);
      buf->data = NULL;
    }
    return rv;
}

/* Called from ssl3_HandleServerKeyExchange, ssl3_HandleCertificateVerify */
SECStatus
ssl3_VerifySignedHashes(SSL3Hashes *hash, CERTCertificate *cert, 
                        SECItem *buf, PRBool isTLS, void *pwArg)
{
    SECKEYPublicKey * key;
    SECItem *         signature     = NULL;
    SECStatus         rv;
    SECItem           hashItem;
#ifdef NSS_ENABLE_ECC
    unsigned int      len;
#endif /* NSS_ENABLE_ECC */


    PRINT_BUF(60, (NULL, "check signed hashes",
                  buf->data, buf->len));

    key = CERT_ExtractPublicKey(cert);
    if (key == NULL) {
      /* CERT_ExtractPublicKey doesn't set error code */
      PORT_SetError(SSL_ERROR_EXTRACT_PUBLIC_KEY_FAILURE);
      return SECFailure;
    }

    switch (key->keyType) {
    case rsaKey:
      hashItem.data = hash->md5;
      hashItem.len = sizeof(SSL3Hashes);
      break;
    case dsaKey:
      hashItem.data = hash->sha;
      hashItem.len = sizeof(hash->sha);
      if (isTLS) {
          signature = DSAU_DecodeDerSig(buf);
          if (!signature) {
            PORT_SetError(SSL_ERROR_BAD_HANDSHAKE_HASH_VALUE);
            return SECFailure;
          }
          buf = signature;
      }
      break;

#ifdef NSS_ENABLE_ECC
    case ecKey:
      hashItem.data = hash->sha;
      hashItem.len = sizeof(hash->sha);
      /*
       * ECDSA signatures always encode the integers r and s 
       * using ASN (unlike DSA where ASN encoding is used
       * with TLS but not with SSL3)
       */
      len = SECKEY_SignatureLen(key);
      if (len == 0) {
          SECKEY_DestroyPublicKey(key);
          PORT_SetError(SEC_ERROR_UNSUPPORTED_ELLIPTIC_CURVE);
          return SECFailure;
      }
      signature = DSAU_DecodeDerSigToLen(buf, len);
      if (!signature) {
          PORT_SetError(SSL_ERROR_BAD_HANDSHAKE_HASH_VALUE);
          return SECFailure;
      }
      buf = signature;
      break;
#endif /* NSS_ENABLE_ECC */

    default:
      SECKEY_DestroyPublicKey(key);
      PORT_SetError(SEC_ERROR_UNSUPPORTED_KEYALG);
      return SECFailure;
    }

    PRINT_BUF(60, (NULL, "hash(es) to be verified",
                  hashItem.data, hashItem.len));

    rv = PK11_Verify(key, buf, &hashItem, pwArg);
    SECKEY_DestroyPublicKey(key);
    if (signature) {
      SECITEM_FreeItem(signature, PR_TRUE);
    }
    if (rv != SECSuccess) {
      ssl_MapLowLevelError(SSL_ERROR_BAD_HANDSHAKE_HASH_VALUE);
    }
    return rv;
}


/* Caller must set hiLevel error code. */
/* Called from ssl3_ComputeExportRSAKeyHash
 *             ssl3_ComputeDHKeyHash
 * which are called from ssl3_HandleServerKeyExchange. 
 */
SECStatus
ssl3_ComputeCommonKeyHash(PRUint8 * hashBuf, unsigned int bufLen,
                       SSL3Hashes *hashes, PRBool bypassPKCS11)
{
    SECStatus     rv          = SECSuccess;

    if (bypassPKCS11) {
      MD5_HashBuf (hashes->md5, hashBuf, bufLen);
      SHA1_HashBuf(hashes->sha, hashBuf, bufLen);
    } else {
      rv = PK11_HashBuf(SEC_OID_MD5, hashes->md5, hashBuf, bufLen);
      if (rv != SECSuccess) {
          ssl_MapLowLevelError(SSL_ERROR_MD5_DIGEST_FAILURE);
          rv = SECFailure;
          goto done;
      }

      rv = PK11_HashBuf(SEC_OID_SHA1, hashes->sha, hashBuf, bufLen);
      if (rv != SECSuccess) {
          ssl_MapLowLevelError(SSL_ERROR_SHA_DIGEST_FAILURE);
          rv = SECFailure;
      }
    }
done:
    return rv;
}

/* Caller must set hiLevel error code. 
** Called from ssl3_SendServerKeyExchange and 
**             ssl3_HandleServerKeyExchange.
*/
static SECStatus
ssl3_ComputeExportRSAKeyHash(SECItem modulus, SECItem publicExponent,
                       SSL3Random *client_rand, SSL3Random *server_rand,
                       SSL3Hashes *hashes, PRBool bypassPKCS11)
{
    PRUint8     * hashBuf;
    PRUint8     * pBuf;
    SECStatus     rv          = SECSuccess;
    unsigned int  bufLen;
    PRUint8       buf[2*SSL3_RANDOM_LENGTH + 2 + 4096/8 + 2 + 4096/8];

    bufLen = 2*SSL3_RANDOM_LENGTH + 2 + modulus.len + 2 + publicExponent.len;
    if (bufLen <= sizeof buf) {
      hashBuf = buf;
    } else {
      hashBuf = PORT_Alloc(bufLen);
      if (!hashBuf) {
          return SECFailure;
      }
    }

    memcpy(hashBuf, client_rand, SSL3_RANDOM_LENGTH); 
      pBuf = hashBuf + SSL3_RANDOM_LENGTH;
    memcpy(pBuf, server_rand, SSL3_RANDOM_LENGTH);
      pBuf += SSL3_RANDOM_LENGTH;
    pBuf[0]  = (PRUint8)(modulus.len >> 8);
    pBuf[1]  = (PRUint8)(modulus.len);
      pBuf += 2;
    memcpy(pBuf, modulus.data, modulus.len);
      pBuf += modulus.len;
    pBuf[0] = (PRUint8)(publicExponent.len >> 8);
    pBuf[1] = (PRUint8)(publicExponent.len);
      pBuf += 2;
    memcpy(pBuf, publicExponent.data, publicExponent.len);
      pBuf += publicExponent.len;
    PORT_Assert((unsigned int)(pBuf - hashBuf) == bufLen);

    rv = ssl3_ComputeCommonKeyHash(hashBuf, bufLen, hashes, bypassPKCS11);

    PRINT_BUF(95, (NULL, "RSAkey hash: ", hashBuf, bufLen));
    PRINT_BUF(95, (NULL, "RSAkey hash: MD5 result", hashes->md5, MD5_LENGTH));
    PRINT_BUF(95, (NULL, "RSAkey hash: SHA1 result", hashes->sha, SHA1_LENGTH));

    if (hashBuf != buf && hashBuf != NULL)
      PORT_Free(hashBuf);
    return rv;
}

/* Caller must set hiLevel error code. */
/* Called from ssl3_HandleServerKeyExchange. */
static SECStatus
ssl3_ComputeDHKeyHash(SECItem dh_p, SECItem dh_g, SECItem dh_Ys,
                       SSL3Random *client_rand, SSL3Random *server_rand,
                       SSL3Hashes *hashes, PRBool bypassPKCS11)
{
    PRUint8     * hashBuf;
    PRUint8     * pBuf;
    SECStatus     rv          = SECSuccess;
    unsigned int  bufLen;
    PRUint8       buf[2*SSL3_RANDOM_LENGTH + 2 + 4096/8 + 2 + 4096/8];

    bufLen = 2*SSL3_RANDOM_LENGTH + 2 + dh_p.len + 2 + dh_g.len + 2 + dh_Ys.len;
    if (bufLen <= sizeof buf) {
      hashBuf = buf;
    } else {
      hashBuf = PORT_Alloc(bufLen);
      if (!hashBuf) {
          return SECFailure;
      }
    }

    memcpy(hashBuf, client_rand, SSL3_RANDOM_LENGTH); 
      pBuf = hashBuf + SSL3_RANDOM_LENGTH;
    memcpy(pBuf, server_rand, SSL3_RANDOM_LENGTH);
      pBuf += SSL3_RANDOM_LENGTH;
    pBuf[0]  = (PRUint8)(dh_p.len >> 8);
    pBuf[1]  = (PRUint8)(dh_p.len);
      pBuf += 2;
    memcpy(pBuf, dh_p.data, dh_p.len);
      pBuf += dh_p.len;
    pBuf[0] = (PRUint8)(dh_g.len >> 8);
    pBuf[1] = (PRUint8)(dh_g.len);
      pBuf += 2;
    memcpy(pBuf, dh_g.data, dh_g.len);
      pBuf += dh_g.len;
    pBuf[0] = (PRUint8)(dh_Ys.len >> 8);
    pBuf[1] = (PRUint8)(dh_Ys.len);
      pBuf += 2;
    memcpy(pBuf, dh_Ys.data, dh_Ys.len);
      pBuf += dh_Ys.len;
    PORT_Assert((unsigned int)(pBuf - hashBuf) == bufLen);

    rv = ssl3_ComputeCommonKeyHash(hashBuf, bufLen, hashes, bypassPKCS11);

    PRINT_BUF(95, (NULL, "DHkey hash: ", hashBuf, bufLen));
    PRINT_BUF(95, (NULL, "DHkey hash: MD5 result", hashes->md5, MD5_LENGTH));
    PRINT_BUF(95, (NULL, "DHkey hash: SHA1 result", hashes->sha, SHA1_LENGTH));

    if (hashBuf != buf && hashBuf != NULL)
      PORT_Free(hashBuf);
    return rv;
}

static void
ssl3_BumpSequenceNumber(SSL3SequenceNumber *num)
{
    num->low++;
    if (num->low == 0)
      num->high++;
}

/* Called twice, only from ssl3_DestroyCipherSpec (immediately below). */
static void
ssl3_CleanupKeyMaterial(ssl3KeyMaterial *mat)
{
    if (mat->write_key != NULL) {
      PK11_FreeSymKey(mat->write_key);
      mat->write_key = NULL;
    }
    if (mat->write_mac_key != NULL) {
      PK11_FreeSymKey(mat->write_mac_key);
      mat->write_mac_key = NULL;
    }
    if (mat->write_mac_context != NULL) {
      PK11_DestroyContext(mat->write_mac_context, PR_TRUE);
      mat->write_mac_context = NULL;
    }
}

/* Called from ssl3_SendChangeCipherSpecs() and 
**           ssl3_HandleChangeCipherSpecs()
**             ssl3_DestroySSL3Info
** Caller must hold SpecWriteLock.
*/
static void
ssl3_DestroyCipherSpec(ssl3CipherSpec *spec)
{
    PRBool freeit = (PRBool)(!spec->bypassCiphers);
/*  PORT_Assert( ss->opt.noLocks || ssl_HaveSpecWriteLock(ss)); Don't have ss! */
    if (spec->destroy) {
      spec->destroy(spec->encodeContext, freeit);
      spec->destroy(spec->decodeContext, freeit);
      spec->encodeContext = NULL; /* paranoia */
      spec->decodeContext = NULL;
    }
    if (spec->master_secret != NULL) {
      PK11_FreeSymKey(spec->master_secret);
      spec->master_secret = NULL;
    }
    spec->msItem.data = NULL;
    spec->msItem.len  = 0;
    ssl3_CleanupKeyMaterial(&spec->client);
    ssl3_CleanupKeyMaterial(&spec->server);
    spec->bypassCiphers = PR_FALSE;
    spec->destroy=NULL;
}

/* Fill in the pending cipher spec with info from the selected ciphersuite.
** This is as much initialization as we can do without having key material.
** Called from ssl3_HandleServerHello(), ssl3_SendServerHello()
** Caller must hold the ssl3 handshake lock.
** Acquires & releases SpecWriteLock.
*/
static SECStatus
ssl3_SetupPendingCipherSpec(sslSocket *ss)
{
    ssl3CipherSpec *          pwSpec;
    ssl3CipherSpec *          cwSpec;
    ssl3CipherSuite           suite     = ss->ssl3.hs.cipher_suite;
    SSL3MACAlgorithm          mac;
    SSL3BulkCipher            cipher;
    SSL3KeyExchangeAlgorithm  kea;
    const ssl3CipherSuiteDef *suite_def;
    PRBool                    isTLS;

    PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss));

    ssl_GetSpecWriteLock(ss);  /*******************************/

    pwSpec = ss->ssl3.pwSpec;
    PORT_Assert(pwSpec == ss->ssl3.prSpec);

    /* This hack provides maximal interoperability with SSL 3 servers. */
    cwSpec = ss->ssl3.cwSpec;
    if (cwSpec->mac_def->mac == mac_null) {
      /* SSL records are not being MACed. */
      cwSpec->version = ss->version;
    }

    pwSpec->version  = ss->version;
    isTLS  = (PRBool)(pwSpec->version > SSL_LIBRARY_VERSION_3_0);

    SSL_TRC(3, ("%d: SSL3[%d]: Set XXX Pending Cipher Suite to 0x%04x",
            SSL_GETPID(), ss->fd, suite));

    suite_def = ssl_LookupCipherSuiteDef(suite);
    if (suite_def == NULL) {
      ssl_ReleaseSpecWriteLock(ss);
      return SECFailure;      /* error code set by ssl_LookupCipherSuiteDef */
    }


    cipher = suite_def->bulk_cipher_alg;
    kea    = suite_def->key_exchange_alg;
    mac    = suite_def->mac_alg;
    if (isTLS)
      mac += 2;

    ss->ssl3.hs.suite_def = suite_def;
    ss->ssl3.hs.kea_def   = &kea_defs[kea];
    PORT_Assert(ss->ssl3.hs.kea_def->kea == kea);

    pwSpec->cipher_def   = &bulk_cipher_defs[cipher];
    PORT_Assert(pwSpec->cipher_def->cipher == cipher);

    pwSpec->mac_def = &mac_defs[mac];
    PORT_Assert(pwSpec->mac_def->mac == mac);

    ss->sec.keyBits       = pwSpec->cipher_def->key_size        * BPB;
    ss->sec.secretKeyBits = pwSpec->cipher_def->secret_key_size * BPB;
    ss->sec.cipherType    = cipher;

    pwSpec->encodeContext = NULL;
    pwSpec->decodeContext = NULL;

    pwSpec->mac_size = pwSpec->mac_def->mac_size;

    ssl_ReleaseSpecWriteLock(ss);  /*******************************/
    return SECSuccess;
}

/* Initialize encryption and MAC contexts for pending spec.
 * Master Secret already is derived in spec->msItem
 * Caller holds Spec write lock.
 */
static SECStatus
ssl3_InitPendingContextsBypass(sslSocket *ss)
{
      ssl3CipherSpec  *  pwSpec;
const ssl3BulkCipherDef *cipher_def;
      void *             serverContext = NULL;
      void *             clientContext = NULL;
      BLapiInitContextFunc initFn = (BLapiInitContextFunc)NULL;
      int                mode     = 0;
      unsigned int       optArg1  = 0;
      unsigned int       optArg2  = 0;
      PRBool             server_encrypts = ss->sec.isServer;
      CK_ULONG           macLength;
      SSLCipherAlgorithm calg;
      SECStatus          rv;

    PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss));

    PORT_Assert(ss->ssl3.prSpec == ss->ssl3.pwSpec);

    pwSpec        = ss->ssl3.pwSpec;
    cipher_def    = pwSpec->cipher_def;
    macLength     = pwSpec->mac_size;

    /* MAC setup is done when computing the mac, not here.
     * Now setup the crypto contexts.
     */

    calg = cipher_def->calg;

    serverContext = pwSpec->server.cipher_context;
    clientContext = pwSpec->client.cipher_context;

    switch (calg) {
    case ssl_calg_null:
      pwSpec->encode  = Null_Cipher;
      pwSpec->decode  = Null_Cipher;
        pwSpec->destroy = NULL;
      goto success;

    case ssl_calg_rc4:
            initFn = (BLapiInitContextFunc)RC4_InitContext;
      pwSpec->encode  = (SSLCipher) RC4_Encrypt;
      pwSpec->decode  = (SSLCipher) RC4_Decrypt;
      pwSpec->destroy = (SSLDestroy) RC4_DestroyContext;
      break;
    case ssl_calg_rc2:
            initFn = (BLapiInitContextFunc)RC2_InitContext;
      mode = NSS_RC2_CBC;
      optArg1 = cipher_def->key_size;
      pwSpec->encode  = (SSLCipher) RC2_Encrypt;
      pwSpec->decode  = (SSLCipher) RC2_Decrypt;
      pwSpec->destroy = (SSLDestroy) RC2_DestroyContext;
      break;
    case ssl_calg_des:
            initFn = (BLapiInitContextFunc)DES_InitContext;
      mode = NSS_DES_CBC;
      optArg1 = server_encrypts;
      pwSpec->encode  = (SSLCipher) DES_Encrypt;
      pwSpec->decode  = (SSLCipher) DES_Decrypt;
      pwSpec->destroy = (SSLDestroy) DES_DestroyContext;
      break;
    case ssl_calg_3des:
            initFn = (BLapiInitContextFunc)DES_InitContext;
      mode = NSS_DES_EDE3_CBC;
      optArg1 = server_encrypts;
      pwSpec->encode  = (SSLCipher) DES_Encrypt;
      pwSpec->decode  = (SSLCipher) DES_Decrypt;
      pwSpec->destroy = (SSLDestroy) DES_DestroyContext;
      break;
    case ssl_calg_aes:
            initFn = (BLapiInitContextFunc)AES_InitContext;
      mode = NSS_AES_CBC;
      optArg1 = server_encrypts;
      optArg2 = AES_BLOCK_SIZE;
      pwSpec->encode  = (SSLCipher) AES_Encrypt;
      pwSpec->decode  = (SSLCipher) AES_Decrypt;
      pwSpec->destroy = (SSLDestroy) AES_DestroyContext;
      break;

    case ssl_calg_camellia:
            initFn = (BLapiInitContextFunc)Camellia_InitContext;
      mode = NSS_CAMELLIA_CBC;
      optArg1 = server_encrypts;
      optArg2 = CAMELLIA_BLOCK_SIZE;
      pwSpec->encode  = (SSLCipher) Camellia_Encrypt;
      pwSpec->decode  = (SSLCipher) Camellia_Decrypt;
      pwSpec->destroy = (SSLDestroy) Camellia_DestroyContext;
      break;

    case ssl_calg_idea:
    case ssl_calg_fortezza :
    default:
      PORT_Assert(0);
      PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
      goto bail_out;
    }
    rv = (*initFn)(serverContext,
               pwSpec->server.write_key_item.data,
               pwSpec->server.write_key_item.len,
               pwSpec->server.write_iv_item.data,
               mode, optArg1, optArg2);
    if (rv != SECSuccess) {
      PORT_Assert(0);
      PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
      goto bail_out;
    }

    if (calg == ssl_calg_des || calg == ssl_calg_3des || calg == ssl_calg_aes
      || calg == ssl_calg_camellia) {
      /* For block ciphers, if the server is encrypting, then the client
       * is decrypting, and vice versa.
       */
      optArg1 = !optArg1;
    }

    rv = (*initFn)(clientContext,
               pwSpec->client.write_key_item.data,
               pwSpec->client.write_key_item.len,
               pwSpec->client.write_iv_item.data,
               mode, optArg1, optArg2);
    if (rv != SECSuccess) {
      PORT_Assert(0);
      PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
      goto bail_out;
    }

    pwSpec->encodeContext = (ss->sec.isServer) ? serverContext : clientContext;
    pwSpec->decodeContext = (ss->sec.isServer) ? clientContext : serverContext;

success:
    return SECSuccess;

bail_out:
    return SECFailure;
}

/* This function should probably be moved to pk11wrap and be named 
 * PK11_ParamFromIVAndEffectiveKeyBits
 */
static SECItem *
ssl3_ParamFromIV(CK_MECHANISM_TYPE mtype, SECItem *iv, CK_ULONG ulEffectiveBits)
{
    SECItem * param = PK11_ParamFromIV(mtype, iv);
    if (param && param->data  && param->len >= sizeof(CK_RC2_PARAMS)) {
      switch (mtype) {
      case CKM_RC2_KEY_GEN:
      case CKM_RC2_ECB:
      case CKM_RC2_CBC:
      case CKM_RC2_MAC:
      case CKM_RC2_MAC_GENERAL:
      case CKM_RC2_CBC_PAD:
          *(CK_RC2_PARAMS *)param->data = ulEffectiveBits;
      default: break;
      }
    }
    return param;
}

/* Initialize encryption and MAC contexts for pending spec.
 * Master Secret already is derived.
 * Caller holds Spec write lock.
 */
static SECStatus
ssl3_InitPendingContextsPKCS11(sslSocket *ss)
{
      ssl3CipherSpec  *  pwSpec;
const ssl3BulkCipherDef *cipher_def;
      PK11Context *      serverContext = NULL;
      PK11Context *      clientContext = NULL;
      SECItem *          param;
      CK_MECHANISM_TYPE  mechanism;
      CK_MECHANISM_TYPE  mac_mech;
      CK_ULONG           macLength;
      CK_ULONG           effKeyBits;
      SECItem            iv;
      SECItem            mac_param;
      SSLCipherAlgorithm calg;

    PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss));

    PORT_Assert(ss->ssl3.prSpec == ss->ssl3.pwSpec);

    pwSpec        = ss->ssl3.pwSpec;
    cipher_def    = pwSpec->cipher_def;
    macLength     = pwSpec->mac_size;

    /* 
    ** Now setup the MAC contexts, 
    **   crypto contexts are setup below.
    */

    pwSpec->client.write_mac_context = NULL;
    pwSpec->server.write_mac_context = NULL;
    mac_mech       = pwSpec->mac_def->mmech;
    mac_param.data = (unsigned char *)&macLength;
    mac_param.len  = sizeof(macLength);
    mac_param.type = 0;

    pwSpec->client.write_mac_context = PK11_CreateContextBySymKey(
          mac_mech, CKA_SIGN, pwSpec->client.write_mac_key, &mac_param);
    if (pwSpec->client.write_mac_context == NULL)  {
      ssl_MapLowLevelError(SSL_ERROR_SYM_KEY_CONTEXT_FAILURE);
      goto fail;
    }
    pwSpec->server.write_mac_context = PK11_CreateContextBySymKey(
          mac_mech, CKA_SIGN, pwSpec->server.write_mac_key, &mac_param);
    if (pwSpec->server.write_mac_context == NULL) {
      ssl_MapLowLevelError(SSL_ERROR_SYM_KEY_CONTEXT_FAILURE);
      goto fail;
    }

    /* 
    ** Now setup the crypto contexts.
    */

    calg = cipher_def->calg;
    PORT_Assert(alg2Mech[calg].calg == calg);

    if (calg == calg_null) {
      pwSpec->encode  = Null_Cipher;
      pwSpec->decode  = Null_Cipher;
      pwSpec->destroy = NULL;
      return SECSuccess;
    }
    mechanism = alg2Mech[calg].cmech;
    effKeyBits = cipher_def->key_size * BPB;

    /*
     * build the server context
     */
    iv.data = pwSpec->server.write_iv;
    iv.len  = cipher_def->iv_size;
    param = ssl3_ParamFromIV(mechanism, &iv, effKeyBits);
    if (param == NULL) {
      ssl_MapLowLevelError(SSL_ERROR_IV_PARAM_FAILURE);
      goto fail;
    }
    serverContext = PK11_CreateContextBySymKey(mechanism,
                        (ss->sec.isServer ? CKA_ENCRYPT : CKA_DECRYPT),
                        pwSpec->server.write_key, param);
    iv.data = PK11_IVFromParam(mechanism, param, (int *)&iv.len);
    if (iv.data)
      PORT_Memcpy(pwSpec->server.write_iv, iv.data, iv.len);
    SECITEM_FreeItem(param, PR_TRUE);
    if (serverContext == NULL) {
      ssl_MapLowLevelError(SSL_ERROR_SYM_KEY_CONTEXT_FAILURE);
      goto fail;
    }

    /*
     * build the client context
     */
    iv.data = pwSpec->client.write_iv;
    iv.len  = cipher_def->iv_size;

    param = ssl3_ParamFromIV(mechanism, &iv, effKeyBits);
    if (param == NULL) {
      ssl_MapLowLevelError(SSL_ERROR_IV_PARAM_FAILURE);
      goto fail;
    }
    clientContext = PK11_CreateContextBySymKey(mechanism,
                        (ss->sec.isServer ? CKA_DECRYPT : CKA_ENCRYPT),
                        pwSpec->client.write_key, param);
    iv.data = PK11_IVFromParam(mechanism, param, (int *)&iv.len);
    if (iv.data)
      PORT_Memcpy(pwSpec->client.write_iv, iv.data, iv.len);
    SECITEM_FreeItem(param,PR_TRUE);
    if (clientContext == NULL) {
      ssl_MapLowLevelError(SSL_ERROR_SYM_KEY_CONTEXT_FAILURE);
      goto fail;
    }
    pwSpec->encode  = (SSLCipher) PK11_CipherOp;
    pwSpec->decode  = (SSLCipher) PK11_CipherOp;
    pwSpec->destroy = (SSLDestroy) PK11_DestroyContext;

    pwSpec->encodeContext = (ss->sec.isServer) ? serverContext : clientContext;
    pwSpec->decodeContext = (ss->sec.isServer) ? clientContext : serverContext;

    serverContext = NULL;
    clientContext = NULL;

    return SECSuccess;

fail:
    if (serverContext != NULL) PK11_DestroyContext(serverContext, PR_TRUE);
    if (clientContext != NULL) PK11_DestroyContext(clientContext, PR_TRUE);
    if (pwSpec->client.write_mac_context != NULL) {
      PK11_DestroyContext(pwSpec->client.write_mac_context,PR_TRUE);
      pwSpec->client.write_mac_context = NULL;
    }
    if (pwSpec->server.write_mac_context != NULL) {
      PK11_DestroyContext(pwSpec->server.write_mac_context,PR_TRUE);
      pwSpec->server.write_mac_context = NULL;
    }

    return SECFailure;
}

/* Complete the initialization of all keys, ciphers, MACs and their contexts
 * for the pending Cipher Spec.
 * Called from: ssl3_SendClientKeyExchange      (for Full handshake)
 *              ssl3_HandleRSAClientKeyExchange (for Full handshake)
 *              ssl3_HandleServerHello          (for session restart)
 *              ssl3_HandleClientHello          (for session restart)
 * Sets error code, but caller probably should override to disambiguate.
 * NULL pms means re-use old master_secret.
 *
 * This code is common to the bypass and PKCS11 execution paths.
 * For the bypass case,  pms is NULL.
 */
SECStatus
ssl3_InitPendingCipherSpec(sslSocket *ss, PK11SymKey *pms)
{
    ssl3CipherSpec  *  pwSpec;
    SECStatus          rv;

    PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss));

    ssl_GetSpecWriteLock(ss); /**************************************/

    PORT_Assert(ss->ssl3.prSpec == ss->ssl3.pwSpec);

    pwSpec        = ss->ssl3.pwSpec;

    if (pms || (!pwSpec->msItem.len && !pwSpec->master_secret)) {
      rv = ssl3_DeriveMasterSecret(ss, pms);
      if (rv != SECSuccess) {
          goto done;  /* err code set by ssl3_DeriveMasterSecret */
      }
    }
    if (ss->opt.bypassPKCS11 && pwSpec->msItem.len && pwSpec->msItem.data) {
      /* Double Bypass succeeded in extracting the master_secret */
      const ssl3KEADef * kea_def = ss->ssl3.hs.kea_def;
      PRBool             isTLS   = (PRBool)(kea_def->tls_keygen ||
                                (pwSpec->version > SSL_LIBRARY_VERSION_3_0));
      pwSpec->bypassCiphers = PR_TRUE;
      rv = ssl3_KeyAndMacDeriveBypass( pwSpec, 
                       (const unsigned char *)&ss->ssl3.hs.client_random,
                       (const unsigned char *)&ss->ssl3.hs.server_random,
                       isTLS, 
                       (PRBool)(kea_def->is_limited));
      if (rv == SECSuccess) {
          rv = ssl3_InitPendingContextsBypass(ss);
      }
    } else if (pwSpec->master_secret) {
      rv = ssl3_DeriveConnectionKeysPKCS11(ss);
      if (rv == SECSuccess) {
          rv = ssl3_InitPendingContextsPKCS11(ss);
      }
    } else {
      PORT_Assert(pwSpec->master_secret);
      PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
      rv = SECFailure;
    }

done:
    ssl_ReleaseSpecWriteLock(ss);   /******************************/
    if (rv != SECSuccess)
      ssl_MapLowLevelError(SSL_ERROR_SESSION_KEY_GEN_FAILURE);
    return rv;
}

/*
 * 60 bytes is 3 times the maximum length MAC size that is supported.
 */
static const unsigned char mac_pad_1 [60] = {
    0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
    0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
    0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
    0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
    0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
    0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
    0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
    0x36, 0x36, 0x36, 0x36
};
static const unsigned char mac_pad_2 [60] = {
    0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
    0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
    0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
    0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
    0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
    0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
    0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
    0x5c, 0x5c, 0x5c, 0x5c
};

/* Called from: ssl3_SendRecord()
**          ssl3_HandleRecord()
** Caller must already hold the SpecReadLock. (wish we could assert that!)
*/
static SECStatus
ssl3_ComputeRecordMAC(
    ssl3CipherSpec *   spec,
    PRBool             useServerMacKey,
    SSL3ContentType    type,
    SSL3ProtocolVersion version,
    SSL3SequenceNumber seq_num,
    const SSL3Opaque * input,
    int                inputLength,
    unsigned char *    outbuf,
    unsigned int *     outLength)
{
    const ssl3MACDef * mac_def;
    SECStatus          rv;
    PRBool             isTLS;
    unsigned int       tempLen;
    unsigned char      temp[MAX_MAC_LENGTH];

    temp[0] = (unsigned char)(seq_num.high >> 24);
    temp[1] = (unsigned char)(seq_num.high >> 16);
    temp[2] = (unsigned char)(seq_num.high >>  8);
    temp[3] = (unsigned char)(seq_num.high >>  0);
    temp[4] = (unsigned char)(seq_num.low  >> 24);
    temp[5] = (unsigned char)(seq_num.low  >> 16);
    temp[6] = (unsigned char)(seq_num.low  >>  8);
    temp[7] = (unsigned char)(seq_num.low  >>  0);
    temp[8] = type;

    /* TLS MAC includes the record's version field, SSL's doesn't.
    ** We decide which MAC defintiion to use based on the version of 
    ** the protocol that was negotiated when the spec became current,
    ** NOT based on the version value in the record itself.
    ** But, we use the record'v version value in the computation.
    */
    if (spec->version <= SSL_LIBRARY_VERSION_3_0) {
      temp[9]  = MSB(inputLength);
      temp[10] = LSB(inputLength);
      tempLen  = 11;
      isTLS    = PR_FALSE;
    } else {
      /* New TLS hash includes version. */
      temp[9]  = MSB(version);
      temp[10] = LSB(version);
      temp[11] = MSB(inputLength);
      temp[12] = LSB(inputLength);
      tempLen  = 13;
      isTLS    = PR_TRUE;
    }

    PRINT_BUF(95, (NULL, "frag hash1: temp", temp, tempLen));
    PRINT_BUF(95, (NULL, "frag hash1: input", input, inputLength));

    mac_def = spec->mac_def;
    if (mac_def->mac == mac_null) {
      *outLength = 0;
      return SECSuccess;
    }
    if (! spec->bypassCiphers) {
      PK11Context *mac_context = 
          (useServerMacKey ? spec->server.write_mac_context
                           : spec->client.write_mac_context);
      rv  = PK11_DigestBegin(mac_context);
      rv |= PK11_DigestOp(mac_context, temp, tempLen);
      rv |= PK11_DigestOp(mac_context, input, inputLength);
      rv |= PK11_DigestFinal(mac_context, outbuf, outLength, spec->mac_size);
    } else {
      /* bypass version */
      const SECHashObject *hashObj = NULL;
      unsigned int       pad_bytes = 0;
      PRUint64           write_mac_context[MAX_MAC_CONTEXT_LLONGS];

      switch (mac_def->mac) {
      case ssl_mac_null:
          *outLength = 0;
          return SECSuccess;
      case ssl_mac_md5:
          pad_bytes = 48;
          hashObj = HASH_GetRawHashObject(HASH_AlgMD5);
          break;
      case ssl_mac_sha:
          pad_bytes = 40;
          hashObj = HASH_GetRawHashObject(HASH_AlgSHA1);
          break;
      case ssl_hmac_md5: /* used with TLS */
          hashObj = HASH_GetRawHashObject(HASH_AlgMD5);
          break;
      case ssl_hmac_sha: /* used with TLS */
          hashObj = HASH_GetRawHashObject(HASH_AlgSHA1);
          break;
      default:
          break;
      }
      if (!hashObj) {
          PORT_Assert(0);
          PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
          return SECFailure;
      }

      if (!isTLS) {
          /* compute "inner" part of SSL3 MAC */
          hashObj->begin(write_mac_context);
          if (useServerMacKey)
            hashObj->update(write_mac_context, 
                        spec->server.write_mac_key_item.data,
                        spec->server.write_mac_key_item.len);
          else
            hashObj->update(write_mac_context, 
                        spec->client.write_mac_key_item.data,
                        spec->client.write_mac_key_item.len);
          hashObj->update(write_mac_context, mac_pad_1, pad_bytes);
          hashObj->update(write_mac_context, temp,  tempLen);
          hashObj->update(write_mac_context, input, inputLength);
          hashObj->end(write_mac_context,    temp, &tempLen, sizeof temp);

          /* compute "outer" part of SSL3 MAC */
          hashObj->begin(write_mac_context);
          if (useServerMacKey)
            hashObj->update(write_mac_context, 
                        spec->server.write_mac_key_item.data,
                        spec->server.write_mac_key_item.len);
          else
            hashObj->update(write_mac_context, 
                        spec->client.write_mac_key_item.data,
                        spec->client.write_mac_key_item.len);
          hashObj->update(write_mac_context, mac_pad_2, pad_bytes);
          hashObj->update(write_mac_context, temp, tempLen);
          hashObj->end(write_mac_context, outbuf, outLength, spec->mac_size);
          rv = SECSuccess;
      } else { /* is TLS */
#define cx ((HMACContext *)write_mac_context)
          if (useServerMacKey) {
            rv = HMAC_Init(cx, hashObj, 
                         spec->server.write_mac_key_item.data,
                         spec->server.write_mac_key_item.len, PR_FALSE);
          } else {
            rv = HMAC_Init(cx, hashObj, 
                         spec->client.write_mac_key_item.data,
                         spec->client.write_mac_key_item.len, PR_FALSE);
          }
          if (rv == SECSuccess) {
            HMAC_Begin(cx);
            HMAC_Update(cx, temp, tempLen);
            HMAC_Update(cx, input, inputLength);
            rv = HMAC_Finish(cx, outbuf, outLength, spec->mac_size);
            HMAC_Destroy(cx, PR_FALSE);
          }
#undef cx
      }
    }

    PORT_Assert(rv != SECSuccess || *outLength == (unsigned)spec->mac_size);

    PRINT_BUF(95, (NULL, "frag hash2: result", outbuf, *outLength));

    if (rv != SECSuccess) {
      rv = SECFailure;
      ssl_MapLowLevelError(SSL_ERROR_MAC_COMPUTATION_FAILURE);
    }
    return rv;
}

static PRBool
ssl3_ClientAuthTokenPresent(sslSessionID *sid) {
    PK11SlotInfo *slot = NULL;
    PRBool isPresent = PR_TRUE;

    /* we only care if we are doing client auth */
    if (!sid || !sid->u.ssl3.clAuthValid) {
      return PR_TRUE;
    }

    /* get the slot */
    slot = SECMOD_LookupSlot(sid->u.ssl3.clAuthModuleID,
                           sid->u.ssl3.clAuthSlotID);
    if (slot == NULL ||
      !PK11_IsPresent(slot) ||
      sid->u.ssl3.clAuthSeries     != PK11_GetSlotSeries(slot) ||
      sid->u.ssl3.clAuthSlotID     != PK11_GetSlotID(slot)     ||
      sid->u.ssl3.clAuthModuleID   != PK11_GetModuleID(slot)   ||
      (PK11_NeedLogin(slot) && !PK11_IsLoggedIn(slot, NULL))) {
      isPresent = PR_FALSE;
    } 
    if (slot) {
      PK11_FreeSlot(slot);
    }
    return isPresent;
}

static SECStatus
ssl3_CompressMACEncryptRecord(sslSocket *        ss,
                              SSL3ContentType    type,
                          const SSL3Opaque * pIn,
                          PRUint32           contentLen)
{
    ssl3CipherSpec *          cwSpec;
    const ssl3BulkCipherDef * cipher_def;
    sslBuffer      *          wrBuf         = &ss->sec.writeBuf;
    SECStatus                 rv;
    PRUint32                  macLen      = 0;
    PRUint32                  fragLen;
    PRUint32  p1Len, p2Len, oddLen = 0;
    PRInt32   cipherBytes =  0;

    /*
     * null compression is easy to do
    PORT_Memcpy(wrBuf->buf + SSL3_RECORD_HEADER_LENGTH, pIn, contentLen);
     */

    ssl_GetSpecReadLock(ss);  /********************************/

    cwSpec = ss->ssl3.cwSpec;
    cipher_def = cwSpec->cipher_def;
    /*
     * Add the MAC
     */
    rv = ssl3_ComputeRecordMAC( cwSpec, (PRBool)(ss->sec.isServer),
      type, cwSpec->version, cwSpec->write_seq_num, pIn, contentLen,
      wrBuf->buf + contentLen + SSL3_RECORD_HEADER_LENGTH, &macLen);
    if (rv != SECSuccess) {
      ssl_MapLowLevelError(SSL_ERROR_MAC_COMPUTATION_FAILURE);
      goto spec_locked_loser;
    }
    p1Len   = contentLen;
    p2Len   = macLen;
    fragLen = contentLen + macLen;  /* needs to be encrypted */
    PORT_Assert(fragLen <= MAX_FRAGMENT_LENGTH + 1024);

    /*
     * Pad the text (if we're doing a block cipher)
     * then Encrypt it
     */
    if (cipher_def->type == type_block) {
      unsigned char * pBuf;
      int             padding_length;
      int             i;

      oddLen = contentLen % cipher_def->block_size;
      /* Assume blockSize is a power of two */
      padding_length = cipher_def->block_size - 1 -
                  ((fragLen) & (cipher_def->block_size - 1));
      fragLen += padding_length + 1;
      PORT_Assert((fragLen % cipher_def->block_size) == 0);

      /* Pad according to TLS rules (also acceptable to SSL3). */
      pBuf = &wrBuf->buf[fragLen + SSL3_RECORD_HEADER_LENGTH - 1];
      for (i = padding_length + 1; i > 0; --i) {
          *pBuf-- = padding_length;
      }
      /* now, if contentLen is not a multiple of block size, fix it */
      p2Len = fragLen - p1Len;
    }
    if (p1Len < 256) {
      oddLen = p1Len;
      p1Len = 0;
    } else {
      p1Len -= oddLen;
    }
    if (oddLen) {
      p2Len += oddLen;
      PORT_Assert( (cipher_def->block_size < 2) || \
                 (p2Len % cipher_def->block_size) == 0);
      memcpy(wrBuf->buf + SSL3_RECORD_HEADER_LENGTH + p1Len,
             pIn + p1Len, oddLen);
    }
    if (p1Len > 0) {
      rv = cwSpec->encode( cwSpec->encodeContext, 
          wrBuf->buf + SSL3_RECORD_HEADER_LENGTH, /* output */
          &cipherBytes,                           /* actual outlen */
          p1Len,                                  /* max outlen */
          pIn, p1Len);                      /* input, and inputlen */
      PORT_Assert(rv == SECSuccess && cipherBytes == p1Len);
      if (rv != SECSuccess || cipherBytes != p1Len) {
          PORT_SetError(SSL_ERROR_ENCRYPTION_FAILURE);
          goto spec_locked_loser;
      }
    }
    if (p2Len > 0) {
      PRInt32 cipherBytesPart2 = -1;
      rv = cwSpec->encode( cwSpec->encodeContext, 
          wrBuf->buf + SSL3_RECORD_HEADER_LENGTH + p1Len,
          &cipherBytesPart2,          /* output and actual outLen */
          p2Len,                             /* max outlen */
          wrBuf->buf + SSL3_RECORD_HEADER_LENGTH + p1Len,
          p2Len);                            /* input and inputLen*/
      PORT_Assert(rv == SECSuccess && cipherBytesPart2 == p2Len);
      if (rv != SECSuccess || cipherBytesPart2 != p2Len) {
          PORT_SetError(SSL_ERROR_ENCRYPTION_FAILURE);
          goto spec_locked_loser;
      }
      cipherBytes += cipherBytesPart2;
    } 
    PORT_Assert(cipherBytes <= MAX_FRAGMENT_LENGTH + 1024);

    ssl3_BumpSequenceNumber(&cwSpec->write_seq_num);

    wrBuf->len    = cipherBytes + SSL3_RECORD_HEADER_LENGTH;
    wrBuf->buf[0] = type;
    wrBuf->buf[1] = MSB(cwSpec->version);
    wrBuf->buf[2] = LSB(cwSpec->version);
    wrBuf->buf[3] = MSB(cipherBytes);
    wrBuf->buf[4] = LSB(cipherBytes);

    ssl_ReleaseSpecReadLock(ss); /************************************/

    return SECSuccess;

spec_locked_loser:
    ssl_ReleaseSpecReadLock(ss);
    return SECFailure;
}

/* Process the plain text before sending it.
 * Returns the number of bytes of plaintext that were succesfully sent
 *    plus the number of bytes of plaintext that were copied into the
 *    output (write) buffer.
 * Returns SECFailure on a hard IO error, memory error, or crypto error.
 * Does NOT return SECWouldBlock.
 *
 * Notes on the use of the private ssl flags:
 * (no private SSL flags)
 *    Attempt to make and send SSL records for all plaintext
 *    If non-blocking and a send gets WOULD_BLOCK,
 *    or if the pending (ciphertext) buffer is not empty,
 *    then buffer remaining bytes of ciphertext into pending buf,
 *    and continue to do that for all succssive records until all
 *    bytes are used.
 * ssl_SEND_FLAG_FORCE_INTO_BUFFER
 *    As above, except this suppresses all write attempts, and forces
 *    all ciphertext into the pending ciphertext buffer.
 *
 */
static PRInt32
ssl3_SendRecord(   sslSocket *        ss,
                   SSL3ContentType    type,
               const SSL3Opaque * pIn,   /* input buffer */
               PRInt32            nIn,   /* bytes of input */
               PRInt32            flags)
{
    sslBuffer      *          wrBuf         = &ss->sec.writeBuf;
    SECStatus                 rv;
    PRInt32                   totalSent   = 0;

    SSL_TRC(3, ("%d: SSL3[%d] SendRecord type: %s nIn=%d",
            SSL_GETPID(), ss->fd, ssl3_DecodeContentType(type),
            nIn));
    PRINT_BUF(3, (ss, "Send record (plain text)", pIn, nIn));

    PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss) );

    if (ss->ssl3.initialized == PR_FALSE) {
      /* This can happen on a server if the very first incoming record
      ** looks like a defective ssl3 record (e.g. too long), and we're
      ** trying to send an alert.
      */
      PR_ASSERT(type == content_alert);
      rv = ssl3_InitState(ss);
      if (rv != SECSuccess) {
          return SECFailure;  /* ssl3_InitState has set the error code. */
      }
    }

    /* check for Token Presence */
    if (!ssl3_ClientAuthTokenPresent(ss->sec.ci.sid)) {
      PORT_SetError(SSL_ERROR_TOKEN_INSERTION_REMOVAL);
      return SECFailure;
    }

    while (nIn > 0) {
      PRUint32  contentLen = PR_MIN(nIn, MAX_FRAGMENT_LENGTH);

      if (wrBuf->space < contentLen + SSL3_BUFFER_FUDGE) {
          PRInt32 newSpace = PR_MAX(wrBuf->space * 2, contentLen);
          newSpace = PR_MIN(newSpace, MAX_FRAGMENT_LENGTH);
          newSpace += SSL3_BUFFER_FUDGE;
          rv = sslBuffer_Grow(wrBuf, newSpace);
          if (rv != SECSuccess) {
            SSL_DBG(("%d: SSL3[%d]: SendRecord, tried to get %d bytes",
                   SSL_GETPID(), ss->fd, newSpace));
            return SECFailure; /* sslBuffer_Grow set a memory error code. */
          }
      }

      rv = ssl3_CompressMACEncryptRecord( ss, type, pIn, contentLen);
      if (rv != SECSuccess)
          return SECFailure;

      pIn += contentLen;
      nIn -= contentLen;
      PORT_Assert( nIn >= 0 );

      PRINT_BUF(50, (ss, "send (encrypted) record data:", wrBuf->buf, wrBuf->len));

      /* If there's still some previously saved ciphertext,
       * or the caller doesn't want us to send the data yet,
       * then add all our new ciphertext to the amount previously saved.
       */
      if ((ss->pendingBuf.len > 0) ||
          (flags & ssl_SEND_FLAG_FORCE_INTO_BUFFER)) {

          rv = ssl_SaveWriteData(ss, wrBuf->buf, wrBuf->len);
          if (rv != SECSuccess) {
            /* presumably a memory error, SEC_ERROR_NO_MEMORY */
            return SECFailure;
          }
          wrBuf->len = 0;     /* All cipher text is saved away. */

          if (!(flags & ssl_SEND_FLAG_FORCE_INTO_BUFFER)) {
            PRInt32   sent;
            ss->handshakeBegun = 1;
            sent = ssl_SendSavedWriteData(ss);
            if (sent < 0 && PR_GetError() != PR_WOULD_BLOCK_ERROR) {
                ssl_MapLowLevelError(SSL_ERROR_SOCKET_WRITE_FAILURE);
                return SECFailure;
            }
            if (ss->pendingBuf.len) {
                flags |= ssl_SEND_FLAG_FORCE_INTO_BUFFER;
            }
          }
      } else if (wrBuf->len > 0) {
          PRInt32   sent;
          ss->handshakeBegun = 1;
          sent = ssl_DefSend(ss, wrBuf->buf, wrBuf->len,
                         flags & ~ssl_SEND_FLAG_MASK);
          if (sent < 0) {
            if (PR_GetError() != PR_WOULD_BLOCK_ERROR) {
                ssl_MapLowLevelError(SSL_ERROR_SOCKET_WRITE_FAILURE);
                return SECFailure;
            }
            /* we got PR_WOULD_BLOCK_ERROR, which means none was sent. */
            sent = 0;
          }
          wrBuf->len -= sent;
          if (wrBuf->len) {
            /* now take all the remaining unsent new ciphertext and 
             * append it to the buffer of previously unsent ciphertext.
             */
            rv = ssl_SaveWriteData(ss, wrBuf->buf + sent, wrBuf->len);
            if (rv != SECSuccess) {
                /* presumably a memory error, SEC_ERROR_NO_MEMORY */
                return SECFailure;
            }
          }
      }
      totalSent += contentLen;
    }
    return totalSent;
}

#define SSL3_PENDING_HIGH_WATER 1024

/* Attempt to send the content of "in" in an SSL application_data record.
 * Returns "len" or SECFailure,   never SECWouldBlock, nor SECSuccess.
 */
int
ssl3_SendApplicationData(sslSocket *ss, const unsigned char *in,
                   PRInt32 len, PRInt32 flags)
{
    PRInt32   totalSent = 0;
    PRInt32   discarded = 0;

    PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss) );
    if (len < 0 || !in) {
      PORT_SetError(PR_INVALID_ARGUMENT_ERROR);
      return SECFailure;
    }

    if (ss->pendingBuf.len > SSL3_PENDING_HIGH_WATER &&
        !ssl_SocketIsBlocking(ss)) {
      PORT_Assert(!ssl_SocketIsBlocking(ss));
      PORT_SetError(PR_WOULD_BLOCK_ERROR);
      return SECFailure;
    }

    if (ss->appDataBuffered && len) {
      PORT_Assert (in[0] == (unsigned char)(ss->appDataBuffered));
      if (in[0] != (unsigned char)(ss->appDataBuffered)) {
          PORT_SetError(PR_INVALID_ARGUMENT_ERROR);
          return SECFailure;
      }
      in++;
      len--;
      discarded = 1;
    }
    while (len > totalSent) {
      PRInt32   sent, toSend;

      if (totalSent > 0) {
          /*
           * The thread yield is intended to give the reader thread a
           * chance to get some cycles while the writer thread is in
           * the middle of a large application data write.  (See
           * Bugzilla bug 127740, comment #1.)
           */
          ssl_ReleaseXmitBufLock(ss);
          PR_Sleep(PR_INTERVAL_NO_WAIT);  /* PR_Yield(); */
          ssl_GetXmitBufLock(ss);
      }
      toSend = PR_MIN(len - totalSent, MAX_FRAGMENT_LENGTH);
      sent = ssl3_SendRecord(ss, content_application_data, 
                             in + totalSent, toSend, flags);
      if (sent < 0) {
          if (totalSent > 0 && PR_GetError() == PR_WOULD_BLOCK_ERROR) {
            PORT_Assert(ss->lastWriteBlocked);
            break;
          }
          return SECFailure; /* error code set by ssl3_SendRecord */
      }
      totalSent += sent;
      if (ss->pendingBuf.len) {
          /* must be a non-blocking socket */
          PORT_Assert(!ssl_SocketIsBlocking(ss));
          PORT_Assert(ss->lastWriteBlocked);
          break;  
      }
    }
    if (ss->pendingBuf.len) {
      /* Must be non-blocking. */
      PORT_Assert(!ssl_SocketIsBlocking(ss));
      if (totalSent > 0) {
          ss->appDataBuffered = 0x100 | in[totalSent - 1];
      }

      totalSent = totalSent + discarded - 1;
      if (totalSent <= 0) {
          PORT_SetError(PR_WOULD_BLOCK_ERROR);
          totalSent = SECFailure;
      }
      return totalSent;
    } 
    ss->appDataBuffered = 0;
    return totalSent + discarded;
}

/* Attempt to send the content of sendBuf buffer in an SSL handshake record.
 * This function returns SECSuccess or SECFailure, never SECWouldBlock.
 * Always set sendBuf.len to 0, even when returning SECFailure.
 *
 * Called from SSL3_SendAlert(), ssl3_SendChangeCipherSpecs(),
 *             ssl3_AppendHandshake(), ssl3_SendClientHello(),
 *             ssl3_SendHelloRequest(), ssl3_SendServerHelloDone(),
 *             ssl3_SendFinished(),
 */
static SECStatus
ssl3_FlushHandshake(sslSocket *ss, PRInt32 flags)
{
    PRInt32 rv = SECSuccess;

    PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss));
    PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss) );

    if (!ss->sec.ci.sendBuf.buf || !ss->sec.ci.sendBuf.len)
      return rv;

    /* only this flag is allowed */
    PORT_Assert(!(flags & ~ssl_SEND_FLAG_FORCE_INTO_BUFFER));
    if ((flags & ~ssl_SEND_FLAG_FORCE_INTO_BUFFER) != 0) {
      PORT_SetError(SEC_ERROR_INVALID_ARGS);
      rv = SECFailure;
    } else {
      rv = ssl3_SendRecord(ss, content_handshake, ss->sec.ci.sendBuf.buf,
                       ss->sec.ci.sendBuf.len, flags);
    }
    if (rv < 0) { 
      int err = PORT_GetError();
      PORT_Assert(err != PR_WOULD_BLOCK_ERROR);
      if (err == PR_WOULD_BLOCK_ERROR) {
          PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
      }
    } else if (rv < ss->sec.ci.sendBuf.len) {
      /* short write should never happen */
      PORT_Assert(rv >= ss->sec.ci.sendBuf.len);
      PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
      rv = SECFailure;
    } else {
      rv = SECSuccess;
    }

    /* Whether we succeeded or failed, toss the old handshake data. */
    ss->sec.ci.sendBuf.len = 0;
    return rv;
}

/*
 * Called from ssl3_HandleAlert and from ssl3_HandleCertificate when
 * the remote client sends a negative response to our certificate request.
 * Returns SECFailure if the application has required client auth.
 *         SECSuccess otherwise.
 */
static SECStatus
ssl3_HandleNoCertificate(sslSocket *ss)
{
    if (ss->sec.peerCert != NULL) {
      if (ss->sec.peerKey != NULL) {
          SECKEY_DestroyPublicKey(ss->sec.peerKey);
          ss->sec.peerKey = NULL;
      }
      CERT_DestroyCertificate(ss->sec.peerCert);
      ss->sec.peerCert = NULL;
    }
    ssl3_CleanupPeerCerts(ss);

    /* If the server has required client-auth blindly but doesn't
     * actually look at the certificate it won't know that no
     * certificate was presented so we shutdown the socket to ensure
     * an error.  We only do this if we haven't already completed the
     * first handshake because if we're redoing the handshake we 
     * know the server is paying attention to the certificate.
     */
    if ((ss->opt.requireCertificate == SSL_REQUIRE_ALWAYS) ||
      (!ss->firstHsDone && 
       (ss->opt.requireCertificate == SSL_REQUIRE_FIRST_HANDSHAKE))) {
      PRFileDesc * lower;

      ss->sec.uncache(ss->sec.ci.sid);
      SSL3_SendAlert(ss, alert_fatal, bad_certificate);

      lower = ss->fd->lower;
#ifdef _WIN32
      lower->methods->shutdown(lower, PR_SHUTDOWN_SEND);
#else
      lower->methods->shutdown(lower, PR_SHUTDOWN_BOTH);
#endif
      PORT_SetError(SSL_ERROR_NO_CERTIFICATE);
      return SECFailure;
    }
    return SECSuccess;
}

/************************************************************************
 * Alerts
 */

/*
** Acquires both handshake and XmitBuf locks.
** Called from: ssl3_IllegalParameter     <-
**              ssl3_HandshakeFailure     <-
**              ssl3_HandleAlert    <- ssl3_HandleRecord.
**              ssl3_HandleChangeCipherSpecs <- ssl3_HandleRecord
**              ssl3_ConsumeHandshakeVariable <-
**              ssl3_HandleHelloRequest   <-
**              ssl3_HandleServerHello    <-
**              ssl3_HandleServerKeyExchange <-
**              ssl3_HandleCertificateRequest <-
**              ssl3_HandleServerHelloDone <-
**              ssl3_HandleClientHello    <-
**              ssl3_HandleV2ClientHello <-
**              ssl3_HandleCertificateVerify <-
**              ssl3_HandleClientKeyExchange <-
**              ssl3_HandleCertificate    <-
**              ssl3_HandleFinished <-
**              ssl3_HandleHandshakeMessage <-
**              ssl3_HandleRecord   <-
**
*/
SECStatus
SSL3_SendAlert(sslSocket *ss, SSL3AlertLevel level, SSL3AlertDescription desc)
{
    uint8   bytes[2];
    SECStatus     rv;

    SSL_TRC(3, ("%d: SSL3[%d]: send alert record, level=%d desc=%d",
            SSL_GETPID(), ss->fd, level, desc));

    bytes[0] = level;
    bytes[1] = desc;

    ssl_GetSSL3HandshakeLock(ss);
    if (level == alert_fatal) {
      if (ss->sec.ci.sid) {
          ss->sec.uncache(ss->sec.ci.sid);
      }
    }
    ssl_GetXmitBufLock(ss);
    rv = ssl3_FlushHandshake(ss, ssl_SEND_FLAG_FORCE_INTO_BUFFER);
    if (rv == SECSuccess) {
      PRInt32 sent;
      sent = ssl3_SendRecord(ss, content_alert, bytes, 2, 
                         desc == no_certificate 
                         ? ssl_SEND_FLAG_FORCE_INTO_BUFFER : 0);
      rv = (sent >= 0) ? SECSuccess : (SECStatus)sent;
    }
    ssl_ReleaseXmitBufLock(ss);
    ssl_ReleaseSSL3HandshakeLock(ss);
    return rv;    /* error set by ssl3_FlushHandshake or ssl3_SendRecord */
}

/*
 * Send illegal_parameter alert.  Set generic error number.
 */
static SECStatus
ssl3_IllegalParameter(sslSocket *ss)
{
    PRBool isTLS;

    isTLS = (PRBool)(ss->ssl3.pwSpec->version > SSL_LIBRARY_VERSION_3_0);
    (void)SSL3_SendAlert(ss, alert_fatal, illegal_parameter);
    PORT_SetError(ss->sec.isServer ? SSL_ERROR_BAD_CLIENT
                                   : SSL_ERROR_BAD_SERVER );
    return SECFailure;
}

/*
 * Send handshake_Failure alert.  Set generic error number.
 */
static SECStatus
ssl3_HandshakeFailure(sslSocket *ss)
{
    (void)SSL3_SendAlert(ss, alert_fatal, handshake_failure);
    PORT_SetError( ss->sec.isServer ? SSL_ERROR_BAD_CLIENT
                                    : SSL_ERROR_BAD_SERVER );
    return SECFailure;
}

/*
 * Send handshake_Failure alert.  Set generic error number.
 */
static SECStatus
ssl3_DecodeError(sslSocket *ss)
{
    (void)SSL3_SendAlert(ss, alert_fatal, 
              ss->version > SSL_LIBRARY_VERSION_3_0 ? decode_error 
                                          : illegal_parameter);
    PORT_SetError( ss->sec.isServer ? SSL_ERROR_BAD_CLIENT
                                    : SSL_ERROR_BAD_SERVER );
    return SECFailure;
}

/* Called from ssl3_HandleRecord.
** Caller must hold both RecvBuf and Handshake locks.
*/
static SECStatus
ssl3_HandleAlert(sslSocket *ss, sslBuffer *buf)
{
    SSL3AlertLevel       level;
    SSL3AlertDescription desc;
    int                  error;

    PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) );
    PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) );

    SSL_TRC(3, ("%d: SSL3[%d]: handle alert record", SSL_GETPID(), ss->fd));

    if (buf->len != 2) {
      (void)ssl3_DecodeError(ss);
      PORT_SetError(SSL_ERROR_RX_MALFORMED_ALERT);
      return SECFailure;
    }
    level = (SSL3AlertLevel)buf->buf[0];
    desc  = (SSL3AlertDescription)buf->buf[1];
    buf->len = 0;
    SSL_TRC(5, ("%d: SSL3[%d] received alert, level = %d, description = %d",
        SSL_GETPID(), ss->fd, level, desc));

    switch (desc) {
    case close_notify:        ss->recvdCloseNotify = 1;
                        error = SSL_ERROR_CLOSE_NOTIFY_ALERT;     break;
    case unexpected_message:  error = SSL_ERROR_HANDSHAKE_UNEXPECTED_ALERT;
                                                        break;
    case bad_record_mac:      error = SSL_ERROR_BAD_MAC_ALERT;      break;
    case decryption_failed:   error = SSL_ERROR_DECRYPTION_FAILED_ALERT; 
                                                        break;
    case record_overflow:     error = SSL_ERROR_RECORD_OVERFLOW_ALERT;  break;
    case decompression_failure: error = SSL_ERROR_DECOMPRESSION_FAILURE_ALERT;
                                                        break;
    case handshake_failure:   error = SSL_ERROR_HANDSHAKE_FAILURE_ALERT;
                                                        break;
    case no_certificate:      error = SSL_ERROR_NO_CERTIFICATE;     break;
    case bad_certificate:     error = SSL_ERROR_BAD_CERT_ALERT;     break;
    case unsupported_certificate:error = SSL_ERROR_UNSUPPORTED_CERT_ALERT;break;
    case certificate_revoked:       error = SSL_ERROR_REVOKED_CERT_ALERT;       break;
    case certificate_expired:       error = SSL_ERROR_EXPIRED_CERT_ALERT;       break;
    case certificate_unknown:       error = SSL_ERROR_CERTIFICATE_UNKNOWN_ALERT;
                                                        break;
    case illegal_parameter:   error = SSL_ERROR_ILLEGAL_PARAMETER_ALERT;break;

    /* All alerts below are TLS only. */
    case unknown_ca:          error = SSL_ERROR_UNKNOWN_CA_ALERT;       break;
    case access_denied:       error = SSL_ERROR_ACCESS_DENIED_ALERT;    break;
    case decode_error:        error = SSL_ERROR_DECODE_ERROR_ALERT;     break;
    case decrypt_error:       error = SSL_ERROR_DECRYPT_ERROR_ALERT;    break;
    case export_restriction:  error = SSL_ERROR_EXPORT_RESTRICTION_ALERT; 
                                                        break;
    case protocol_version:    error = SSL_ERROR_PROTOCOL_VERSION_ALERT; break;
    case insufficient_security: error = SSL_ERROR_INSUFFICIENT_SECURITY_ALERT; 
                                                        break;
    case internal_error:      error = SSL_ERROR_INTERNAL_ERROR_ALERT;   break;
    case user_canceled:       error = SSL_ERROR_USER_CANCELED_ALERT;    break;
    case no_renegotiation:    error = SSL_ERROR_NO_RENEGOTIATION_ALERT; break;

    /* Alerts for TLS client hello extensions */
    case unsupported_extension: 
                  error = SSL_ERROR_UNSUPPORTED_EXTENSION_ALERT;    break;
    case certificate_unobtainable: 
                  error = SSL_ERROR_CERTIFICATE_UNOBTAINABLE_ALERT; break;
    case unrecognized_name: 
                  error = SSL_ERROR_UNRECOGNIZED_NAME_ALERT;        break;
    case bad_certificate_status_response: 
                  error = SSL_ERROR_BAD_CERT_STATUS_RESPONSE_ALERT; break;
    case bad_certificate_hash_value: 
                  error = SSL_ERROR_BAD_CERT_HASH_VALUE_ALERT;      break;
    default:            error = SSL_ERROR_RX_UNKNOWN_ALERT;               break;
    }
    if (level == alert_fatal) {
      ss->sec.uncache(ss->sec.ci.sid);
      if ((ss->ssl3.hs.ws == wait_server_hello) &&
          (desc == handshake_failure)) {
          /* XXX This is a hack.  We're assuming that any handshake failure
           * XXX on the client hello is a failure to match ciphers.
           */
          error = SSL_ERROR_NO_CYPHER_OVERLAP;
      }
      PORT_SetError(error);
      return SECFailure;
    }
    if ((desc == no_certificate) && (ss->ssl3.hs.ws == wait_client_cert)) {
      /* I'm a server. I've requested a client cert. He hasn't got one. */
      SECStatus rv;

      PORT_Assert(ss->sec.isServer);
      ss->ssl3.hs.ws = wait_client_key;
      rv = ssl3_HandleNoCertificate(ss);
      return rv;
    }
    return SECSuccess;
}

/*
 * Change Cipher Specs
 * Called from ssl3_HandleServerHelloDone,
 *             ssl3_HandleClientHello,
 * and         ssl3_HandleFinished
 *
 * Acquires and releases spec write lock, to protect switching the current
 * and pending write spec pointers.
 */

static SECStatus
ssl3_SendChangeCipherSpecs(sslSocket *ss)
{
    uint8             change = change_cipher_spec_choice;
    ssl3CipherSpec *  pwSpec;
    SECStatus         rv;
    PRInt32           sent;

    SSL_TRC(3, ("%d: SSL3[%d]: send change_cipher_spec record",
            SSL_GETPID(), ss->fd));

    PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss) );
    PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss));

    rv = ssl3_FlushHandshake(ss, ssl_SEND_FLAG_FORCE_INTO_BUFFER);
    if (rv != SECSuccess) {
      return rv;  /* error code set by ssl3_FlushHandshake */
    }
    sent = ssl3_SendRecord(ss, content_change_cipher_spec, &change, 1,
                              ssl_SEND_FLAG_FORCE_INTO_BUFFER);
    if (sent < 0) {
      return (SECStatus)sent; /* error code set by ssl3_SendRecord */
    }

    /* swap the pending and current write specs. */
    ssl_GetSpecWriteLock(ss); /**************************************/
    pwSpec                     = ss->ssl3.pwSpec;
    pwSpec->write_seq_num.high = 0;
    pwSpec->write_seq_num.low  = 0;

    ss->ssl3.pwSpec = ss->ssl3.cwSpec;
    ss->ssl3.cwSpec = pwSpec;

    SSL_TRC(3, ("%d: SSL3[%d] Set Current Write Cipher Suite to Pending",
            SSL_GETPID(), ss->fd ));

    /* We need to free up the contexts, keys and certs ! */
    /* If we are really through with the old cipher spec
     * (Both the read and write sides have changed) destroy it.
     */
    if (ss->ssl3.prSpec == ss->ssl3.pwSpec) {
      ssl3_DestroyCipherSpec(ss->ssl3.pwSpec);
    }
    ssl_ReleaseSpecWriteLock(ss); /**************************************/

    return SECSuccess;
}

/* Called from ssl3_HandleRecord.
** Caller must hold both RecvBuf and Handshake locks.
 *
 * Acquires and releases spec write lock, to protect switching the current
 * and pending write spec pointers.
*/
static SECStatus
ssl3_HandleChangeCipherSpecs(sslSocket *ss, sslBuffer *buf)
{
    ssl3CipherSpec *           prSpec;
    SSL3WaitState              ws      = ss->ssl3.hs.ws;
    SSL3ChangeCipherSpecChoice change;

    PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) );
    PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) );

    SSL_TRC(3, ("%d: SSL3[%d]: handle change_cipher_spec record",
            SSL_GETPID(), ss->fd));

    if (ws != wait_change_cipher) {
      (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message);
      PORT_SetError(SSL_ERROR_RX_UNEXPECTED_CHANGE_CIPHER);
      return SECFailure;
    }

    if(buf->len != 1) {
      (void)ssl3_DecodeError(ss);
      PORT_SetError(SSL_ERROR_RX_MALFORMED_CHANGE_CIPHER);
      return SECFailure;
    }
    change = (SSL3ChangeCipherSpecChoice)buf->buf[0];
    if (change != change_cipher_spec_choice) {
      /* illegal_parameter is correct here for both SSL3 and TLS. */
      (void)ssl3_IllegalParameter(ss);
      PORT_SetError(SSL_ERROR_RX_MALFORMED_CHANGE_CIPHER);
      return SECFailure;
    }
    buf->len = 0;

    /* Swap the pending and current read specs. */
    ssl_GetSpecWriteLock(ss);   /*************************************/
    prSpec                    = ss->ssl3.prSpec;
    prSpec->read_seq_num.high = prSpec->read_seq_num.low = 0;

    ss->ssl3.prSpec  = ss->ssl3.crSpec;
    ss->ssl3.crSpec  = prSpec;
    ss->ssl3.hs.ws   = wait_finished;

    SSL_TRC(3, ("%d: SSL3[%d] Set Current Read Cipher Suite to Pending",
            SSL_GETPID(), ss->fd ));

    /* If we are really through with the old cipher prSpec
     * (Both the read and write sides have changed) destroy it.
     */
    if (ss->ssl3.prSpec == ss->ssl3.pwSpec) {
      ssl3_DestroyCipherSpec(ss->ssl3.prSpec);
    }
    ssl_ReleaseSpecWriteLock(ss);   /*************************************/
    return SECSuccess;
}

/* This method uses PKCS11 to derive the MS from the PMS, where PMS 
** is a PKCS11 symkey. This is used in all cases except the 
** "triple bypass" with RSA key exchange.
** Called from ssl3_InitPendingCipherSpec.   prSpec is pwSpec.
*/
static SECStatus
ssl3_DeriveMasterSecret(sslSocket *ss, PK11SymKey *pms)
{
    ssl3CipherSpec *  pwSpec = ss->ssl3.pwSpec;
    const ssl3KEADef *kea_def= ss->ssl3.hs.kea_def;
    unsigned char *   cr     = (unsigned char *)&ss->ssl3.hs.client_random;
    unsigned char *   sr     = (unsigned char *)&ss->ssl3.hs.server_random;
    PRBool            isTLS  = (PRBool)(kea_def->tls_keygen ||
                                (pwSpec->version > SSL_LIBRARY_VERSION_3_0));
    /* 
     * Whenever isDH is true, we need to use CKM_TLS_MASTER_KEY_DERIVE_DH
     * which, unlike CKM_TLS_MASTER_KEY_DERIVE, converts arbitrary size
     * data into a 48-byte value. 
     */
    PRBool    isDH = (PRBool) ((ss->ssl3.hs.kea_def->exchKeyType == kt_dh) ||
                             (ss->ssl3.hs.kea_def->exchKeyType == kt_ecdh));
    SECStatus         rv = SECFailure;
    CK_MECHANISM_TYPE master_derive;
    CK_MECHANISM_TYPE key_derive;
    SECItem           params;
    CK_FLAGS          keyFlags;
    CK_VERSION        pms_version;
    CK_SSL3_MASTER_KEY_DERIVE_PARAMS master_params;

    PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss));
    PORT_Assert( ss->opt.noLocks || ssl_HaveSpecWriteLock(ss));
    PORT_Assert(ss->ssl3.prSpec == ss->ssl3.pwSpec);
    if (isTLS) {
      if(isDH) master_derive = CKM_TLS_MASTER_KEY_DERIVE_DH;
      else master_derive = CKM_TLS_MASTER_KEY_DERIVE;
      key_derive    = CKM_TLS_KEY_AND_MAC_DERIVE;
      keyFlags      = CKF_SIGN | CKF_VERIFY;
    } else {
      if (isDH) master_derive = CKM_SSL3_MASTER_KEY_DERIVE_DH;
      else master_derive = CKM_SSL3_MASTER_KEY_DERIVE;
      key_derive    = CKM_SSL3_KEY_AND_MAC_DERIVE;
      keyFlags      = 0;
    }

    if (pms || !pwSpec->master_secret) {
      master_params.pVersion                     = &pms_version;
      master_params.RandomInfo.pClientRandom     = cr;
      master_params.RandomInfo.ulClientRandomLen = SSL3_RANDOM_LENGTH;
      master_params.RandomInfo.pServerRandom     = sr;
      master_params.RandomInfo.ulServerRandomLen = SSL3_RANDOM_LENGTH;

      params.data = (unsigned char *) &master_params;
      params.len  = sizeof master_params;
    }

    if (pms != NULL) {
#if defined(TRACE)
      if (ssl_trace >= 100) {
          SECStatus extractRV = PK11_ExtractKeyValue(pms);
          if (extractRV == SECSuccess) {
            SECItem * keyData = PK11_GetKeyData(pms);
            if (keyData && keyData->data && keyData->len) {
                ssl_PrintBuf(ss, "Pre-Master Secret", 
                         keyData->data, keyData->len);
            }
          }
      }
#endif
      pwSpec->master_secret = PK11_DeriveWithFlags(pms, master_derive, 
                        &params, key_derive, CKA_DERIVE, 0, keyFlags);
      if (!isDH && pwSpec->master_secret && ss->opt.detectRollBack) {
          SSL3ProtocolVersion client_version;
          client_version = pms_version.major << 8 | pms_version.minor;
          if (client_version != ss->clientHelloVersion) {
            /* Destroy it.  Version roll-back detected. */
            PK11_FreeSymKey(pwSpec->master_secret);
            pwSpec->master_secret = NULL;
          }
      }
      if (pwSpec->master_secret == NULL) {
          /* Generate a faux master secret in the same slot as the old one. */
          PK11SlotInfo * slot = PK11_GetSlotFromKey((PK11SymKey *)pms);
          PK11SymKey *   fpms = ssl3_GenerateRSAPMS(ss, pwSpec, slot);

          PK11_FreeSlot(slot);
          if (fpms != NULL) {
            pwSpec->master_secret = PK11_DeriveWithFlags(fpms, 
                              master_derive, &params, key_derive, 
                              CKA_DERIVE, 0, keyFlags);
            PK11_FreeSymKey(fpms);
          }
      }
    }
    if (pwSpec->master_secret == NULL) {
      /* Generate a faux master secret from the internal slot. */
      PK11SlotInfo *  slot = PK11_GetInternalSlot();
      PK11SymKey *    fpms = ssl3_GenerateRSAPMS(ss, pwSpec, slot);

      PK11_FreeSlot(slot);
      if (fpms != NULL) {
          pwSpec->master_secret = PK11_DeriveWithFlags(fpms, 
                              master_derive, &params, key_derive, 
                              CKA_DERIVE, 0, keyFlags);
          if (pwSpec->master_secret == NULL) {
            pwSpec->master_secret = fpms; /* use the fpms as the master. */
            fpms = NULL;
          }
      }
      if (fpms) {
          PK11_FreeSymKey(fpms);
      }
    }
    if (pwSpec->master_secret == NULL) {
      ssl_MapLowLevelError(SSL_ERROR_SESSION_KEY_GEN_FAILURE);
      return rv;
    }
    if (ss->opt.bypassPKCS11) {
      SECItem * keydata;
      /* In hope of doing a "double bypass", 
       * need to extract the master secret's value from the key object 
       * and store it raw in the sslSocket struct.
       */
      rv = PK11_ExtractKeyValue(pwSpec->master_secret);
      if (rv != SECSuccess) {
#if defined(NSS_SURVIVE_DOUBLE_BYPASS_FAILURE)
          /* The double bypass failed.  
           * Attempt to revert to an all PKCS#11, non-bypass method.
           * Do we need any unacquired locks here?
           */
          ss->opt.bypassPKCS11 = 0;
          rv = ssl3_NewHandshakeHashes(ss);
          if (rv == SECSuccess) {
            rv = ssl3_UpdateHandshakeHashes(ss, ss->ssl3.hs.messages.buf, 
                                                ss->ssl3.hs.messages.len);
          }
#endif
          return rv;
      } 
      /* This returns the address of the secItem inside the key struct,
       * not a copy or a reference.  So, there's no need to free it.
       */
      keydata = PK11_GetKeyData(pwSpec->master_secret);
      if (keydata && keydata->len <= sizeof pwSpec->raw_master_secret) {
          memcpy(pwSpec->raw_master_secret, keydata->data, keydata->len);
          pwSpec->msItem.data = pwSpec->raw_master_secret;
          pwSpec->msItem.len  = keydata->len;
      } else {
          PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
          return SECFailure;
      }
    }
    return SECSuccess;
}


/* 
 * Derive encryption and MAC Keys (and IVs) from master secret
 * Sets a useful error code when returning SECFailure.
 *
 * Called only from ssl3_InitPendingCipherSpec(),
 * which in turn is called from
 *              sendRSAClientKeyExchange        (for Full handshake)
 *              sendDHClientKeyExchange         (for Full handshake)
 *              ssl3_HandleClientKeyExchange    (for Full handshake)
 *              ssl3_HandleServerHello          (for session restart)
 *              ssl3_HandleClientHello          (for session restart)
 * Caller MUST hold the specWriteLock, and SSL3HandshakeLock.
 * ssl3_InitPendingCipherSpec does that.
 *
 */
static SECStatus
ssl3_DeriveConnectionKeysPKCS11(sslSocket *ss)
{
    ssl3CipherSpec *         pwSpec     = ss->ssl3.pwSpec;
    const ssl3KEADef *       kea_def    = ss->ssl3.hs.kea_def;
    unsigned char *   cr     = (unsigned char *)&ss->ssl3.hs.client_random;
    unsigned char *   sr     = (unsigned char *)&ss->ssl3.hs.server_random;
    PRBool            isTLS  = (PRBool)(kea_def->tls_keygen ||
                                (pwSpec->version > SSL_LIBRARY_VERSION_3_0));
    /* following variables used in PKCS11 path */
    const ssl3BulkCipherDef *cipher_def = pwSpec->cipher_def;
    PK11SlotInfo *         slot   = NULL;
    PK11SymKey *           symKey = NULL;
    void *                 pwArg  = ss->pkcs11PinArg;
    int                    keySize;
    CK_SSL3_KEY_MAT_PARAMS key_material_params;
    CK_SSL3_KEY_MAT_OUT    returnedKeys;
    CK_MECHANISM_TYPE      key_derive;
    CK_MECHANISM_TYPE      bulk_mechanism;
    SSLCipherAlgorithm     calg;
    SECItem                params;
    PRBool         skipKeysAndIVs = (PRBool)(cipher_def->calg == calg_null);

    PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss));
    PORT_Assert( ss->opt.noLocks || ssl_HaveSpecWriteLock(ss));
    PORT_Assert(ss->ssl3.prSpec == ss->ssl3.pwSpec);

    if (!pwSpec->master_secret) {
      PORT_SetError(SSL_ERROR_SESSION_KEY_GEN_FAILURE);
      return SECFailure;
    }
    /*
     * generate the key material
     */
    key_material_params.ulMacSizeInBits = pwSpec->mac_size           * BPB;
    key_material_params.ulKeySizeInBits = cipher_def->secret_key_size* BPB;
    key_material_params.ulIVSizeInBits  = cipher_def->iv_size        * BPB;

    key_material_params.bIsExport = (CK_BBOOL)(kea_def->is_limited);
    /* was: (CK_BBOOL)(cipher_def->keygen_mode != kg_strong); */

    key_material_params.RandomInfo.pClientRandom     = cr;
    key_material_params.RandomInfo.ulClientRandomLen = SSL3_RANDOM_LENGTH;
    key_material_params.RandomInfo.pServerRandom     = sr;
    key_material_params.RandomInfo.ulServerRandomLen = SSL3_RANDOM_LENGTH;
    key_material_params.pReturnedKeyMaterial         = &returnedKeys;

    returnedKeys.pIVClient = pwSpec->client.write_iv;
    returnedKeys.pIVServer = pwSpec->server.write_iv;
    keySize                = cipher_def->key_size;

    if (skipKeysAndIVs) {
      keySize                             = 0;
        key_material_params.ulKeySizeInBits = 0;
        key_material_params.ulIVSizeInBits  = 0;
      returnedKeys.pIVClient              = NULL;
      returnedKeys.pIVServer              = NULL;
    }

    calg = cipher_def->calg;
    PORT_Assert(     alg2Mech[calg].calg == calg);
    bulk_mechanism = alg2Mech[calg].cmech;

    params.data    = (unsigned char *)&key_material_params;
    params.len     = sizeof(key_material_params);

    if (isTLS) {
      key_derive    = CKM_TLS_KEY_AND_MAC_DERIVE;
    } else {
      key_derive    = CKM_SSL3_KEY_AND_MAC_DERIVE;
    }

    /* CKM_SSL3_KEY_AND_MAC_DERIVE is defined to set ENCRYPT, DECRYPT, and
     * DERIVE by DEFAULT */
    symKey = PK11_Derive(pwSpec->master_secret, key_derive, &params,
                         bulk_mechanism, CKA_ENCRYPT, keySize);
    if (!symKey) {
      ssl_MapLowLevelError(SSL_ERROR_SESSION_KEY_GEN_FAILURE);
      return SECFailure;
    }
    /* we really should use the actual mac'ing mechanism here, but we
     * don't because these types are used to map keytype anyway and both
     * mac's map to the same keytype.
     */
    slot  = PK11_GetSlotFromKey(symKey);

    PK11_FreeSlot(slot); /* slot is held until the key is freed */
    pwSpec->client.write_mac_key =
      PK11_SymKeyFromHandle(slot, symKey, PK11_OriginDerive,
          CKM_SSL3_SHA1_MAC, returnedKeys.hClientMacSecret, PR_TRUE, pwArg);
    if (pwSpec->client.write_mac_key == NULL ) {
      goto loser; /* loser sets err */
    }
    pwSpec->server.write_mac_key =
      PK11_SymKeyFromHandle(slot, symKey, PK11_OriginDerive,
          CKM_SSL3_SHA1_MAC, returnedKeys.hServerMacSecret, PR_TRUE, pwArg);
    if (pwSpec->server.write_mac_key == NULL ) {
      goto loser; /* loser sets err */
    }
    if (!skipKeysAndIVs) {
      pwSpec->client.write_key =
            PK11_SymKeyFromHandle(slot, symKey, PK11_OriginDerive,
                 bulk_mechanism, returnedKeys.hClientKey, PR_TRUE, pwArg);
      if (pwSpec->client.write_key == NULL ) {
          goto loser;   /* loser sets err */
      }
      pwSpec->server.write_key =
            PK11_SymKeyFromHandle(slot, symKey, PK11_OriginDerive,
                 bulk_mechanism, returnedKeys.hServerKey, PR_TRUE, pwArg);
      if (pwSpec->server.write_key == NULL ) {
          goto loser;   /* loser sets err */
      }
    }
    PK11_FreeSymKey(symKey);
    return SECSuccess;


loser:
    if (symKey) PK11_FreeSymKey(symKey);
    ssl_MapLowLevelError(SSL_ERROR_SESSION_KEY_GEN_FAILURE);
    return SECFailure;
}

static SECStatus 
ssl3_RestartHandshakeHashes(sslSocket *ss)
{
    SECStatus rv = SECSuccess;

    if (ss->opt.bypassPKCS11) {
      ss->ssl3.hs.messages.len = 0;
      MD5_Begin((MD5Context *)ss->ssl3.hs.md5_cx);
      SHA1_Begin((SHA1Context *)ss->ssl3.hs.sha_cx);
    } else {
      rv = PK11_DigestBegin(ss->ssl3.hs.md5);
      if (rv != SECSuccess) {
          ssl_MapLowLevelError(SSL_ERROR_MD5_DIGEST_FAILURE);
          return rv;
      }
      rv = PK11_DigestBegin(ss->ssl3.hs.sha);
      if (rv != SECSuccess) {
          ssl_MapLowLevelError(SSL_ERROR_SHA_DIGEST_FAILURE);
          return rv;
      }
    }
    return rv;
}

static SECStatus
ssl3_NewHandshakeHashes(sslSocket *ss)
{
    PK11Context *md5  = NULL;
    PK11Context *sha  = NULL;

    /*
     * note: We should probably lookup an SSL3 slot for these
     * handshake hashes in hopes that we wind up with the same slots
     * that the master secret will wind up in ...
     */
    SSL_TRC(30,("%d: SSL3[%d]: start handshake hashes", SSL_GETPID(), ss->fd));
    if (ss->opt.bypassPKCS11) {
      PORT_Assert(!ss->ssl3.hs.messages.buf && !ss->ssl3.hs.messages.space);
      ss->ssl3.hs.messages.buf = NULL;
      ss->ssl3.hs.messages.space = 0;
    } else {
      ss->ssl3.hs.md5 = md5 = PK11_CreateDigestContext(SEC_OID_MD5);
      ss->ssl3.hs.sha = sha = PK11_CreateDigestContext(SEC_OID_SHA1);
      if (md5 == NULL) {
          ssl_MapLowLevelError(SSL_ERROR_MD5_DIGEST_FAILURE);
          goto loser;
      }
      if (sha == NULL) {
          ssl_MapLowLevelError(SSL_ERROR_SHA_DIGEST_FAILURE);
          goto loser;
      }
    }
    if (SECSuccess == ssl3_RestartHandshakeHashes(ss)) {
      return SECSuccess;
    }

loser:
    if (md5 != NULL) {
      PK11_DestroyContext(md5, PR_TRUE);
      ss->ssl3.hs.md5 = NULL;
    }
    if (sha != NULL) {
      PK11_DestroyContext(sha, PR_TRUE);
      ss->ssl3.hs.sha = NULL;
    }
    return SECFailure;

}

/*
 * Handshake messages
 */
/* Called from    ssl3_AppendHandshake()
**          ssl3_StartHandshakeHash()
**          ssl3_HandleV2ClientHello()
**          ssl3_HandleHandshakeMessage()
** Caller must hold the ssl3Handshake lock.
*/
static SECStatus
ssl3_UpdateHandshakeHashes(sslSocket *ss, unsigned char *b, unsigned int l)
{
    SECStatus  rv = SECSuccess;

    PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) );

    PRINT_BUF(90, (NULL, "MD5 & SHA handshake hash input:", b, l));

    if (ss->opt.bypassPKCS11) {
      MD5_Update((MD5Context *)ss->ssl3.hs.md5_cx, b, l);
      SHA1_Update((SHA1Context *)ss->ssl3.hs.sha_cx, b, l);
#if defined(NSS_SURVIVE_DOUBLE_BYPASS_FAILURE)
      rv = sslBuffer_Append(&ss->ssl3.hs.messages, b, l);
#endif
      return rv;
    }
    rv = PK11_DigestOp(ss->ssl3.hs.md5, b, l);
    if (rv != SECSuccess) {
      ssl_MapLowLevelError(SSL_ERROR_MD5_DIGEST_FAILURE);
      return rv;
    }
    rv = PK11_DigestOp(ss->ssl3.hs.sha, b, l);
    if (rv != SECSuccess) {
      ssl_MapLowLevelError(SSL_ERROR_SHA_DIGEST_FAILURE);
      return rv;
    }
    return rv;
}

/**************************************************************************
 * Append Handshake functions.
 * All these functions set appropriate error codes.
 * Most rely on ssl3_AppendHandshake to set the error code.
 **************************************************************************/
SECStatus
ssl3_AppendHandshake(sslSocket *ss, const void *void_src, PRInt32 bytes)
{
    unsigned char *  src  = (unsigned char *)void_src;
    int              room = ss->sec.ci.sendBuf.space - ss->sec.ci.sendBuf.len;
    SECStatus        rv;

    PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) ); /* protects sendBuf. */

    if (ss->sec.ci.sendBuf.space < MAX_SEND_BUF_LENGTH && room < bytes) {
      rv = sslBuffer_Grow(&ss->sec.ci.sendBuf, PR_MAX(MIN_SEND_BUF_LENGTH,
             PR_MIN(MAX_SEND_BUF_LENGTH, ss->sec.ci.sendBuf.len + bytes)));
      if (rv != SECSuccess)
          return rv;    /* sslBuffer_Grow has set a memory error code. */
      room = ss->sec.ci.sendBuf.space - ss->sec.ci.sendBuf.len;
    }

    PRINT_BUF(60, (ss, "Append to Handshake", (unsigned char*)void_src, bytes));
    rv = ssl3_UpdateHandshakeHashes(ss, src, bytes);
    if (rv != SECSuccess)
      return rv;  /* error code set by ssl3_UpdateHandshakeHashes */

    while (bytes > room) {
      if (room > 0)
          PORT_Memcpy(ss->sec.ci.sendBuf.buf + ss->sec.ci.sendBuf.len, src, 
                      room);
      ss->sec.ci.sendBuf.len += room;
      rv = ssl3_FlushHandshake(ss, ssl_SEND_FLAG_FORCE_INTO_BUFFER);
      if (rv != SECSuccess) {
          return rv;    /* error code set by ssl3_FlushHandshake */
      }
      bytes -= room;
      src += room;
      room = ss->sec.ci.sendBuf.space;
      PORT_Assert(ss->sec.ci.sendBuf.len == 0);
    }
    PORT_Memcpy(ss->sec.ci.sendBuf.buf + ss->sec.ci.sendBuf.len, src, bytes);
    ss->sec.ci.sendBuf.len += bytes;
    return SECSuccess;
}

SECStatus
ssl3_AppendHandshakeNumber(sslSocket *ss, PRInt32 num, PRInt32 lenSize)
{
    SECStatus rv;
    uint8     b[4];
    uint8 *   p = b;

    switch (lenSize) {
      case 4:
      *p++ = (num >> 24) & 0xff;
      case 3:
      *p++ = (num >> 16) & 0xff;
      case 2:
      *p++ = (num >> 8) & 0xff;
      case 1:
      *p = num & 0xff;
    }
    SSL_TRC(60, ("%d: number:", SSL_GETPID()));
    rv = ssl3_AppendHandshake(ss, &b[0], lenSize);
    return rv;    /* error code set by AppendHandshake, if applicable. */
}

SECStatus
ssl3_AppendHandshakeVariable(
    sslSocket *ss, const SSL3Opaque *src, PRInt32 bytes, PRInt32 lenSize)
{
    SECStatus rv;

    PORT_Assert((bytes < (1<<8) && lenSize == 1) ||
            (bytes < (1L<<16) && lenSize == 2) ||
            (bytes < (1L<<24) && lenSize == 3));

    SSL_TRC(60,("%d: append variable:", SSL_GETPID()));
    rv = ssl3_AppendHandshakeNumber(ss, bytes, lenSize);
    if (rv != SECSuccess) {
      return rv;  /* error code set by AppendHandshake, if applicable. */
    }
    SSL_TRC(60, ("data:"));
    rv = ssl3_AppendHandshake(ss, src, bytes);
    return rv;    /* error code set by AppendHandshake, if applicable. */
}

SECStatus
ssl3_AppendHandshakeHeader(sslSocket *ss, SSL3HandshakeType t, PRUint32 length)
{
    SECStatus rv;

    SSL_TRC(30,("%d: SSL3[%d]: append handshake header: type %s",
      SSL_GETPID(), ss->fd, ssl3_DecodeHandshakeType(t)));
    PRINT_BUF(60, (ss, "MD5 handshake hash:",
                (unsigned char*)ss->ssl3.hs.md5_cx, MD5_LENGTH));
    PRINT_BUF(95, (ss, "SHA handshake hash:",
                (unsigned char*)ss->ssl3.hs.sha_cx, SHA1_LENGTH));

    rv = ssl3_AppendHandshakeNumber(ss, t, 1);
    if (rv != SECSuccess) {
      return rv;  /* error code set by AppendHandshake, if applicable. */
    }
    rv = ssl3_AppendHandshakeNumber(ss, length, 3);
    return rv;          /* error code set by AppendHandshake, if applicable. */
}

/**************************************************************************
 * Consume Handshake functions.
 *
 * All data used in these functions is protected by two locks,
 * the RecvBufLock and the SSL3HandshakeLock
 **************************************************************************/

/* Read up the next "bytes" number of bytes from the (decrypted) input
 * stream "b" (which is *length bytes long). Copy them into buffer "v".
 * Reduces *length by bytes.  Advances *b by bytes.
 *
 * If this function returns SECFailure, it has already sent an alert,
 * and has set a generic error code.  The caller should probably
 * override the generic error code by setting another.
 */
SECStatus
ssl3_ConsumeHandshake(sslSocket *ss, void *v, PRInt32 bytes, SSL3Opaque **b,
                  PRUint32 *length)
{
    PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) );
    PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) );

    if ((PRUint32)bytes > *length) {
      return ssl3_DecodeError(ss);
    }
    PORT_Memcpy(v, *b, bytes);
    PRINT_BUF(60, (ss, "consume bytes:", *b, bytes));
    *b      += bytes;
    *length -= bytes;
    return SECSuccess;
}

/* Read up the next "bytes" number of bytes from the (decrypted) input
 * stream "b" (which is *length bytes long), and interpret them as an
 * integer in network byte order.  Returns the received value.
 * Reduces *length by bytes.  Advances *b by bytes.
 *
 * Returns SECFailure (-1) on failure.
 * This value is indistinguishable from the equivalent received value.
 * Only positive numbers are to be received this way.
 * Thus, the largest value that may be sent this way is 0x7fffffff.
 * On error, an alert has been sent, and a generic error code has been set.
 */
PRInt32
ssl3_ConsumeHandshakeNumber(sslSocket *ss, PRInt32 bytes, SSL3Opaque **b,
                      PRUint32 *length)
{
    uint8     *buf = *b;
    int       i;
    PRInt32   num = 0;

    PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) );
    PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) );
    PORT_Assert( bytes <= sizeof num);

    if ((PRUint32)bytes > *length) {
      return ssl3_DecodeError(ss);
    }
    PRINT_BUF(60, (ss, "consume bytes:", *b, bytes));

    for (i = 0; i < bytes; i++)
      num = (num << 8) + buf[i];
    *b      += bytes;
    *length -= bytes;
    return num;
}

/* Read in two values from the incoming decrypted byte stream "b", which is
 * *length bytes long.  The first value is a number whose size is "bytes"
 * bytes long.  The second value is a byte-string whose size is the value
 * of the first number received.  The latter byte-string, and its length,
 * is returned in the SECItem i.
 *
 * Returns SECFailure (-1) on failure.
 * On error, an alert has been sent, and a generic error code has been set.
 *
 * RADICAL CHANGE for NSS 3.11.  All callers of this function make copies 
 * of the data returned in the SECItem *i, so making a copy of it here
 * is simply wasteful.  So, This function now just sets SECItem *i to 
 * point to the values in the buffer **b.
 */
SECStatus
ssl3_ConsumeHandshakeVariable(sslSocket *ss, SECItem *i, PRInt32 bytes,
                        SSL3Opaque **b, PRUint32 *length)
{
    PRInt32   count;

    PORT_Assert(bytes <= 3);
    i->len  = 0;
    i->data = NULL;
    count = ssl3_ConsumeHandshakeNumber(ss, bytes, b, length);
    if (count < 0) {          /* Can't test for SECSuccess here. */
      return SECFailure;
    }
    if (count > 0) {
      if ((PRUint32)count > *length) {
          return ssl3_DecodeError(ss);
      }
      i->data = *b;
      i->len  = count;
      *b      += count;
      *length -= count;
    }
    return SECSuccess;
}

/**************************************************************************
 * end of Consume Handshake functions.
 **************************************************************************/

/* Extract the hashes of handshake messages to this point.
 * Called from ssl3_SendCertificateVerify
 *             ssl3_SendFinished
 *             ssl3_HandleHandshakeMessage
 *
 * Caller must hold the SSL3HandshakeLock.
 * Caller must hold a read or write lock on the Spec R/W lock.
 *    (There is presently no way to assert on a Read lock.)
 */
static SECStatus
ssl3_ComputeHandshakeHashes(sslSocket *     ss,
                            ssl3CipherSpec *spec,   /* uses ->master_secret */
                      SSL3Hashes *    hashes, /* output goes here. */
                      PRUint32        sender)
{
    SECStatus     rv        = SECSuccess;
    PRBool        isTLS     = (PRBool)(spec->version > SSL_LIBRARY_VERSION_3_0);
    unsigned int  outLength;
    SSL3Opaque    md5_inner[MAX_MAC_LENGTH];
    SSL3Opaque    sha_inner[MAX_MAC_LENGTH];

    PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) );

    if (ss->opt.bypassPKCS11) {
      /* compute them without PKCS11 */
      PRUint64      md5_cx[MAX_MAC_CONTEXT_LLONGS];
      PRUint64      sha_cx[MAX_MAC_CONTEXT_LLONGS];

#define md5cx ((MD5Context *)md5_cx)
#define shacx ((SHA1Context *)sha_cx)

      if (!spec->msItem.data) {
          PORT_SetError(SSL_ERROR_RX_UNEXPECTED_HANDSHAKE);
          return SECFailure;
      }

      MD5_Clone (md5cx,  (MD5Context *)ss->ssl3.hs.md5_cx);
      SHA1_Clone(shacx, (SHA1Context *)ss->ssl3.hs.sha_cx);

      if (!isTLS) {
          /* compute hashes for SSL3. */
          unsigned char s[4];

          s[0] = (unsigned char)(sender >> 24);
          s[1] = (unsigned char)(sender >> 16);
          s[2] = (unsigned char)(sender >> 8);
          s[3] = (unsigned char)sender;

          if (sender != 0) {
            MD5_Update(md5cx, s, 4);
            PRINT_BUF(95, (NULL, "MD5 inner: sender", s, 4));
          }

          PRINT_BUF(95, (NULL, "MD5 inner: MAC Pad 1", mac_pad_1, 
                      mac_defs[mac_md5].pad_size));

          MD5_Update(md5cx, spec->msItem.data, spec->msItem.len);
          MD5_Update(md5cx, mac_pad_1, mac_defs[mac_md5].pad_size);
          MD5_End(md5cx, md5_inner, &outLength, MD5_LENGTH);

          PRINT_BUF(95, (NULL, "MD5 inner: result", md5_inner, outLength));

          if (sender != 0) {
            SHA1_Update(shacx, s, 4);
            PRINT_BUF(95, (NULL, "SHA inner: sender", s, 4));
          }

          PRINT_BUF(95, (NULL, "SHA inner: MAC Pad 1", mac_pad_1, 
                      mac_defs[mac_sha].pad_size));

          SHA1_Update(shacx, spec->msItem.data, spec->msItem.len);
          SHA1_Update(shacx, mac_pad_1, mac_defs[mac_sha].pad_size);
          SHA1_End(shacx, sha_inner, &outLength, SHA1_LENGTH);

          PRINT_BUF(95, (NULL, "SHA inner: result", sha_inner, outLength));
          PRINT_BUF(95, (NULL, "MD5 outer: MAC Pad 2", mac_pad_2, 
                      mac_defs[mac_md5].pad_size));
          PRINT_BUF(95, (NULL, "MD5 outer: MD5 inner", md5_inner, MD5_LENGTH));

          MD5_Begin(md5cx);
          MD5_Update(md5cx, spec->msItem.data, spec->msItem.len);
          MD5_Update(md5cx, mac_pad_2, mac_defs[mac_md5].pad_size);
          MD5_Update(md5cx, md5_inner, MD5_LENGTH);
      }
      MD5_End(md5cx, hashes->md5, &outLength, MD5_LENGTH);

      PRINT_BUF(60, (NULL, "MD5 outer: result", hashes->md5, MD5_LENGTH));

      if (!isTLS) {
          PRINT_BUF(95, (NULL, "SHA outer: MAC Pad 2", mac_pad_2, 
                      mac_defs[mac_sha].pad_size));
          PRINT_BUF(95, (NULL, "SHA outer: SHA inner", sha_inner, SHA1_LENGTH));

          SHA1_Begin(shacx);
          SHA1_Update(shacx, spec->msItem.data, spec->msItem.len);
          SHA1_Update(shacx, mac_pad_2, mac_defs[mac_sha].pad_size);
          SHA1_Update(shacx, sha_inner, SHA1_LENGTH);
      }
      SHA1_End(shacx, hashes->sha, &outLength, SHA1_LENGTH);

      PRINT_BUF(60, (NULL, "SHA outer: result", hashes->sha, SHA1_LENGTH));

      rv = SECSuccess;
#undef md5cx
#undef shacx
    } else {
      /* compute hases with PKCS11 */
      PK11Context * md5;
      PK11Context * sha       = NULL;
      unsigned char *md5StateBuf = NULL;
      unsigned char *shaStateBuf = NULL;
      unsigned int  md5StateLen, shaStateLen;
      unsigned char md5StackBuf[256];
      unsigned char shaStackBuf[512];

      if (!spec->master_secret) {
          PORT_SetError(SSL_ERROR_RX_UNEXPECTED_HANDSHAKE);
          return SECFailure;
      }

      md5StateBuf = PK11_SaveContextAlloc(ss->ssl3.hs.md5, md5StackBuf,
                                  sizeof md5StackBuf, &md5StateLen);
      if (md5StateBuf == NULL) {
          ssl_MapLowLevelError(SSL_ERROR_MD5_DIGEST_FAILURE);
          goto loser;
      }
      md5 = ss->ssl3.hs.md5;

      shaStateBuf = PK11_SaveContextAlloc(ss->ssl3.hs.sha, shaStackBuf,
                                  sizeof shaStackBuf, &shaStateLen);
      if (shaStateBuf == NULL) {
          ssl_MapLowLevelError(SSL_ERROR_SHA_DIGEST_FAILURE);
          goto loser;
      }
      sha = ss->ssl3.hs.sha;

      if (!isTLS) {
          /* compute hashes for SSL3. */
          unsigned char s[4];

          s[0] = (unsigned char)(sender >> 24);
          s[1] = (unsigned char)(sender >> 16);
          s[2] = (unsigned char)(sender >> 8);
          s[3] = (unsigned char)sender;

          if (sender != 0) {
            rv |= PK11_DigestOp(md5, s, 4);
            PRINT_BUF(95, (NULL, "MD5 inner: sender", s, 4));
          }

          PRINT_BUF(95, (NULL, "MD5 inner: MAC Pad 1", mac_pad_1, 
                    mac_defs[mac_md5].pad_size));

          rv |= PK11_DigestKey(md5,spec->master_secret);
          rv |= PK11_DigestOp(md5, mac_pad_1, mac_defs[mac_md5].pad_size);
          rv |= PK11_DigestFinal(md5, md5_inner, &outLength, MD5_LENGTH);
          PORT_Assert(rv != SECSuccess || outLength == MD5_LENGTH);
          if (rv != SECSuccess) {
            ssl_MapLowLevelError(SSL_ERROR_MD5_DIGEST_FAILURE);
            rv = SECFailure;
            goto loser;
          }

          PRINT_BUF(95, (NULL, "MD5 inner: result", md5_inner, outLength));

          if (sender != 0) {
            rv |= PK11_DigestOp(sha, s, 4);
            PRINT_BUF(95, (NULL, "SHA inner: sender", s, 4));
          }

          PRINT_BUF(95, (NULL, "SHA inner: MAC Pad 1", mac_pad_1, 
                    mac_defs[mac_sha].pad_size));

          rv |= PK11_DigestKey(sha, spec->master_secret);
          rv |= PK11_DigestOp(sha, mac_pad_1, mac_defs[mac_sha].pad_size);
          rv |= PK11_DigestFinal(sha, sha_inner, &outLength, SHA1_LENGTH);
          PORT_Assert(rv != SECSuccess || outLength == SHA1_LENGTH);
          if (rv != SECSuccess) {
            ssl_MapLowLevelError(SSL_ERROR_SHA_DIGEST_FAILURE);
            rv = SECFailure;
            goto loser;
          }

          PRINT_BUF(95, (NULL, "SHA inner: result", sha_inner, outLength));

          PRINT_BUF(95, (NULL, "MD5 outer: MAC Pad 2", mac_pad_2, 
                    mac_defs[mac_md5].pad_size));
          PRINT_BUF(95, (NULL, "MD5 outer: MD5 inner", md5_inner, MD5_LENGTH));

          rv |= PK11_DigestBegin(md5);
          rv |= PK11_DigestKey(md5, spec->master_secret);
          rv |= PK11_DigestOp(md5, mac_pad_2, mac_defs[mac_md5].pad_size);
          rv |= PK11_DigestOp(md5, md5_inner, MD5_LENGTH);
      }
      rv |= PK11_DigestFinal(md5, hashes->md5, &outLength, MD5_LENGTH);
      PORT_Assert(rv != SECSuccess || outLength == MD5_LENGTH);
      if (rv != SECSuccess) {
          ssl_MapLowLevelError(SSL_ERROR_MD5_DIGEST_FAILURE);
          rv = SECFailure;
          goto loser;
      }

      PRINT_BUF(60, (NULL, "MD5 outer: result", hashes->md5, MD5_LENGTH));

      if (!isTLS) {
          PRINT_BUF(95, (NULL, "SHA outer: MAC Pad 2", mac_pad_2, 
                    mac_defs[mac_sha].pad_size));
          PRINT_BUF(95, (NULL, "SHA outer: SHA inner", sha_inner, SHA1_LENGTH));

          rv |= PK11_DigestBegin(sha);
          rv |= PK11_DigestKey(sha,spec->master_secret);
          rv |= PK11_DigestOp(sha, mac_pad_2, mac_defs[mac_sha].pad_size);
          rv |= PK11_DigestOp(sha, sha_inner, SHA1_LENGTH);
      }
      rv |= PK11_DigestFinal(sha, hashes->sha, &outLength, SHA1_LENGTH);
      PORT_Assert(rv != SECSuccess || outLength == SHA1_LENGTH);
      if (rv != SECSuccess) {
          ssl_MapLowLevelError(SSL_ERROR_SHA_DIGEST_FAILURE);
          rv = SECFailure;
          goto loser;
      }

      PRINT_BUF(60, (NULL, "SHA outer: result", hashes->sha, SHA1_LENGTH));

      rv = SECSuccess;

    loser:
      if (md5StateBuf) {
          if (PK11_RestoreContext(ss->ssl3.hs.md5, md5StateBuf, md5StateLen)
             != SECSuccess) 
          {
            ssl_MapLowLevelError(SSL_ERROR_MD5_DIGEST_FAILURE);
            rv = SECFailure;
          }
          if (md5StateBuf != md5StackBuf) {
            PORT_ZFree(md5StateBuf, md5StateLen);
          }
      }
      if (shaStateBuf) {
          if (PK11_RestoreContext(ss->ssl3.hs.sha, shaStateBuf, shaStateLen)
             != SECSuccess) 
          {
            ssl_MapLowLevelError(SSL_ERROR_SHA_DIGEST_FAILURE);
            rv = SECFailure;
          }
          if (shaStateBuf != shaStackBuf) {
            PORT_ZFree(shaStateBuf, shaStateLen);
          }
      }
    }
    return rv;
}

/*
 * SSL 2 based implementations pass in the initial outbound buffer
 * so that the handshake hash can contain the included information.
 *
 * Called from ssl2_BeginClientHandshake() in sslcon.c
 */
SECStatus
ssl3_StartHandshakeHash(sslSocket *ss, unsigned char * buf, int length)
{
    SECStatus rv;

    ssl_GetSSL3HandshakeLock(ss);  /**************************************/

    rv = ssl3_InitState(ss);
    if (rv != SECSuccess) {
      goto done;        /* ssl3_InitState has set the error code. */
    }

    PORT_Memset(&ss->ssl3.hs.client_random, 0, SSL3_RANDOM_LENGTH);
    PORT_Memcpy(
      &ss->ssl3.hs.client_random.rand[SSL3_RANDOM_LENGTH - SSL_CHALLENGE_BYTES],
      &ss->sec.ci.clientChallenge,
      SSL_CHALLENGE_BYTES);

    rv = ssl3_UpdateHandshakeHashes(ss, buf, length);
    /* if it failed, ssl3_UpdateHandshakeHashes has set the error code. */

done:
    ssl_ReleaseSSL3HandshakeLock(ss);  /**************************************/
    return rv;
}

/**************************************************************************
 * end of Handshake Hash functions.
 * Begin Send and Handle functions for handshakes.
 **************************************************************************/

/* Called from ssl3_HandleHelloRequest(),
 *             ssl3_HandleFinished() (for step-up)
 *             ssl3_RedoHandshake()
 *             ssl2_BeginClientHandshake (when resuming ssl3 session)
 */
SECStatus
ssl3_SendClientHello(sslSocket *ss)
{
    sslSessionID *   sid;
    ssl3CipherSpec * cwSpec;
    SECStatus        rv;
    int              i;
    int              length;
    int              num_suites;
    int              actual_count = 0;
    PRInt32          total_exten_len = 0;

    SSL_TRC(3, ("%d: SSL3[%d]: send client_hello handshake", SSL_GETPID(),
            ss->fd));

    PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) );
    PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss) );

    rv = ssl3_InitState(ss);
    if (rv != SECSuccess) {
      return rv;        /* ssl3_InitState has set the error code. */
    }

    /* We might be starting a session renegotiation in which case we should
     * clear previous state.
     */
    PORT_Memset(&ss->xtnData, 0, sizeof(TLSExtensionData));

    SSL_TRC(30,("%d: SSL3[%d]: reset handshake hashes",
          SSL_GETPID(), ss->fd ));
    rv = ssl3_RestartHandshakeHashes(ss);
    if (rv != SECSuccess) {
      return rv;
    }

    /* We ignore ss->sec.ci.sid here, and use ssl_Lookup because Lookup
     * handles expired entries and other details.
     * XXX If we've been called from ssl2_BeginClientHandshake, then
     * this lookup is duplicative and wasteful.
     */
    sid = (ss->opt.noCache) ? NULL
          : ssl_LookupSID(&ss->sec.ci.peer, ss->sec.ci.port, ss->peerID, ss->url);

    /* We can't resume based on a different token. If the sid exists,
     * make sure the token that holds the master secret still exists ...
     * If we previously did client-auth, make sure that the token that holds
     * the private key still exists, is logged in, hasn't been removed, etc.
     */
    if (sid) {
      PRBool sidOK = PR_TRUE;
      if (sid->u.ssl3.keys.msIsWrapped) {
          /* Session key was wrapped, which means it was using PKCS11, */
          PK11SlotInfo *slot = NULL;
          if (sid->u.ssl3.masterValid && !ss->opt.bypassPKCS11) {
            slot = SECMOD_LookupSlot(sid->u.ssl3.masterModuleID,
                               sid->u.ssl3.masterSlotID);
          }
          if (slot == NULL) {
             sidOK = PR_FALSE;
          } else {
            PK11SymKey *wrapKey = NULL;
            if (!PK11_IsPresent(slot) ||
                ((wrapKey = PK11_GetWrapKey(slot, 
                                    sid->u.ssl3.masterWrapIndex,
                                    sid->u.ssl3.masterWrapMech,
                                    sid->u.ssl3.masterWrapSeries,
                                    ss->pkcs11PinArg)) == NULL) ) {
                sidOK = PR_FALSE;
            }
            if (wrapKey) PK11_FreeSymKey(wrapKey);
            PK11_FreeSlot(slot);
            slot = NULL;
          }
      }
      /* If we previously did client-auth, make sure that the token that
      ** holds the private key still exists, is logged in, hasn't been
      ** removed, etc.
      */
      if (sidOK && !ssl3_ClientAuthTokenPresent(sid)) {
          sidOK = PR_FALSE;
      }

      if (!sidOK) {
          SSL_AtomicIncrementLong(& ssl3stats.sch_sid_cache_not_ok );
          (*ss->sec.uncache)(sid);
          ssl_FreeSID(sid);
          sid = NULL;
      }
    }

    if (sid) {
      SSL_AtomicIncrementLong(& ssl3stats.sch_sid_cache_hits );

      /* Are we attempting a stateless session resume? */
      if (sid->version > SSL_LIBRARY_VERSION_3_0 &&
          sid->u.ssl3.sessionTicket.ticket.data)
          SSL_AtomicIncrementLong(& ssl3stats.sch_sid_stateless_resumes );

      rv = ssl3_NegotiateVersion(ss, sid->version);
      if (rv != SECSuccess)
          return rv;    /* error code was set */

      PRINT_BUF(4, (ss, "client, found session-id:", sid->u.ssl3.sessionID,
                  sid->u.ssl3.sessionIDLength));

      ss->ssl3.policy = sid->u.ssl3.policy;
    } else {
      SSL_AtomicIncrementLong(& ssl3stats.sch_sid_cache_misses );

      rv = ssl3_NegotiateVersion(ss, SSL_LIBRARY_VERSION_3_1_TLS);
      if (rv != SECSuccess)
          return rv;    /* error code was set */

      sid = ssl3_NewSessionID(ss, PR_FALSE);
      if (!sid) {
          return SECFailure;  /* memory error is set */
        }
    }

    ssl_GetSpecWriteLock(ss);
    cwSpec = ss->ssl3.cwSpec;
    if (cwSpec->mac_def->mac == mac_null) {
      /* SSL records are not being MACed. */
      cwSpec->version = ss->version;
    }
    ssl_ReleaseSpecWriteLock(ss);

    if (ss->sec.ci.sid != NULL) {
      ssl_FreeSID(ss->sec.ci.sid);  /* decrement ref count, free if zero */
    }
    ss->sec.ci.sid = sid;

    ss->sec.send = ssl3_SendApplicationData;

    /* shouldn't get here if SSL3 is disabled, but ... */
    PORT_Assert(ss->opt.enableSSL3 || ss->opt.enableTLS);
    if (!ss->opt.enableSSL3 && !ss->opt.enableTLS) {
      PORT_SetError(SSL_ERROR_SSL_DISABLED);
      return SECFailure;
    }

    /* how many suites does our PKCS11 support (regardless of policy)? */
    num_suites = ssl3_config_match_init(ss);
    if (!num_suites)
      return SECFailure;      /* ssl3_config_match_init has set error code. */

    if (ss->opt.enableTLS && ss->version > SSL_LIBRARY_VERSION_3_0) {
      PRUint32 maxBytes = 65535; /* 2^16 - 1 */
      PRInt32  extLen;

      extLen = ssl3_CallHelloExtensionSenders(ss, PR_FALSE, maxBytes, NULL);
      if (extLen < 0) {
          return SECFailure;
      }
      maxBytes        -= extLen;
      total_exten_len += extLen;

      if (total_exten_len > 0)
          total_exten_len += 2;
    }
#if defined(NSS_ENABLE_ECC) && !defined(NSS_ECC_MORE_THAN_SUITE_B)
    else { /* SSL3 only */
      ssl3_DisableECCSuites(ss, NULL); /* disable all ECC suites */
    }
#endif

    /* how many suites are permitted by policy and user preference? */
    num_suites = count_cipher_suites(ss, ss->ssl3.policy, PR_TRUE);
    if (!num_suites)
      return SECFailure;      /* count_cipher_suites has set error code. */

    length = sizeof(SSL3ProtocolVersion) + SSL3_RANDOM_LENGTH +
      1 + ((sid == NULL) ? 0 : sid->u.ssl3.sessionIDLength) +
      2 + num_suites*sizeof(ssl3CipherSuite) +
      1 + compressionMethodsCount + total_exten_len;

    rv = ssl3_AppendHandshakeHeader(ss, client_hello, length);
    if (rv != SECSuccess) {
      return rv;  /* err set by ssl3_AppendHandshake* */
    }

    ss->clientHelloVersion = ss->version;
    rv = ssl3_AppendHandshakeNumber(ss, ss->clientHelloVersion, 2);
    if (rv != SECSuccess) {
      return rv;  /* err set by ssl3_AppendHandshake* */
    }
    rv = ssl3_GetNewRandom(&ss->ssl3.hs.client_random);
    if (rv != SECSuccess) {
      return rv;  /* err set by GetNewRandom. */
    }
    rv = ssl3_AppendHandshake(ss, &ss->ssl3.hs.client_random,
                              SSL3_RANDOM_LENGTH);
    if (rv != SECSuccess) {
      return rv;  /* err set by ssl3_AppendHandshake* */
    }

    if (sid)
      rv = ssl3_AppendHandshakeVariable(
          ss, sid->u.ssl3.sessionID, sid->u.ssl3.sessionIDLength, 1);
    else
      rv = ssl3_AppendHandshakeVariable(ss, NULL, 0, 1);
    if (rv != SECSuccess) {
      return rv;  /* err set by ssl3_AppendHandshake* */
    }

    rv = ssl3_AppendHandshakeNumber(ss, num_suites*sizeof(ssl3CipherSuite), 2);
    if (rv != SECSuccess) {
      return rv;  /* err set by ssl3_AppendHandshake* */
    }


    for (i = 0; i < ssl_V3_SUITES_IMPLEMENTED; i++) {
      ssl3CipherSuiteCfg *suite = &ss->cipherSuites[i];
      if (config_match(suite, ss->ssl3.policy, PR_TRUE)) {
          actual_count++;
          if (actual_count > num_suites) {
            /* set error card removal/insertion error */
            PORT_SetError(SSL_ERROR_TOKEN_INSERTION_REMOVAL);
            return SECFailure;
          }
          rv = ssl3_AppendHandshakeNumber(ss, suite->cipher_suite,
                                  sizeof(ssl3CipherSuite));
          if (rv != SECSuccess) {
            return rv;  /* err set by ssl3_AppendHandshake* */
          }
      }
    }

    /* if cards were removed or inserted between count_cipher_suites and
     * generating our list, detect the error here rather than send it off to
     * the server.. */
    if (actual_count != num_suites) {
      /* Card removal/insertion error */
      PORT_SetError(SSL_ERROR_TOKEN_INSERTION_REMOVAL);
      return SECFailure;
    }

    rv = ssl3_AppendHandshakeNumber(ss, compressionMethodsCount, 1);
    if (rv != SECSuccess) {
      return rv;  /* err set by ssl3_AppendHandshake* */
    }
    for (i = 0; i < compressionMethodsCount; i++) {
      rv = ssl3_AppendHandshakeNumber(ss, compressions[i], 1);
      if (rv != SECSuccess) {
          return rv;    /* err set by ssl3_AppendHandshake* */
      }
    }

    if (total_exten_len) {
      PRUint32 maxBytes = total_exten_len - 2;
      PRInt32  extLen;

      rv = ssl3_AppendHandshakeNumber(ss, maxBytes, 2);
      if (rv != SECSuccess) {
          return rv;    /* err set by AppendHandshake. */
      }

      extLen = ssl3_CallHelloExtensionSenders(ss, PR_TRUE, maxBytes, NULL);
      if (extLen < 0) {
          return SECFailure;
      }
      maxBytes -= extLen;
      PORT_Assert(!maxBytes);
    }


    rv = ssl3_FlushHandshake(ss, 0);
    if (rv != SECSuccess) {
      return rv;  /* error code set by ssl3_FlushHandshake */
    }

    ss->ssl3.hs.ws = wait_server_hello;
    return rv;
}


/* Called from ssl3_HandleHandshakeMessage() when it has deciphered a complete
 * ssl3 Hello Request.
 * Caller must hold Handshake and RecvBuf locks.
 */
static SECStatus
ssl3_HandleHelloRequest(sslSocket *ss)
{
    sslSessionID *sid = ss->sec.ci.sid;
    SECStatus     rv;

    SSL_TRC(3, ("%d: SSL3[%d]: handle hello_request handshake",
            SSL_GETPID(), ss->fd));

    PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) );
    PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) );

    if (ss->ssl3.hs.ws == wait_server_hello)
      return SECSuccess;
    if (ss->ssl3.hs.ws != idle_handshake || ss->sec.isServer) {
      (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message);
      PORT_SetError(SSL_ERROR_RX_UNEXPECTED_HELLO_REQUEST);
      return SECFailure;
    }
    if (sid) {
      ss->sec.uncache(sid);
      ssl_FreeSID(sid);
      ss->sec.ci.sid = NULL;
    }

    ssl_GetXmitBufLock(ss);
    rv = ssl3_SendClientHello(ss);
    ssl_ReleaseXmitBufLock(ss);

    return rv;
}

#define UNKNOWN_WRAP_MECHANISM 0x7fffffff

static const CK_MECHANISM_TYPE wrapMechanismList[SSL_NUM_WRAP_MECHS] = {
    CKM_DES3_ECB,
    CKM_CAST5_ECB,
    CKM_DES_ECB,
    CKM_KEY_WRAP_LYNKS,
    CKM_IDEA_ECB,
    CKM_CAST3_ECB,
    CKM_CAST_ECB,
    CKM_RC5_ECB,
    CKM_RC2_ECB,
    CKM_CDMF_ECB,
    CKM_SKIPJACK_WRAP,
    CKM_SKIPJACK_CBC64,
    CKM_AES_ECB,
    CKM_CAMELLIA_ECB,
    UNKNOWN_WRAP_MECHANISM
};

static int
ssl_FindIndexByWrapMechanism(CK_MECHANISM_TYPE mech)
{
    const CK_MECHANISM_TYPE *pMech = wrapMechanismList;

    while (mech != *pMech && *pMech != UNKNOWN_WRAP_MECHANISM) {
      ++pMech;
    }
    return (*pMech == UNKNOWN_WRAP_MECHANISM) ? -1
                                              : (pMech - wrapMechanismList);
}

static PK11SymKey *
ssl_UnwrapSymWrappingKey(
      SSLWrappedSymWrappingKey *pWswk,
      SECKEYPrivateKey *        svrPrivKey,
      SSL3KEAType               exchKeyType,
      CK_MECHANISM_TYPE         masterWrapMech,
      void *                    pwArg)
{
    PK11SymKey *             unwrappedWrappingKey  = NULL;
    SECItem                  wrappedKey;
#ifdef NSS_ENABLE_ECC
    PK11SymKey *             Ks;
    SECKEYPublicKey          pubWrapKey;
    ECCWrappedKeyInfo        *ecWrapped;
#endif /* NSS_ENABLE_ECC */

    /* found the wrapping key on disk. */
    PORT_Assert(pWswk->symWrapMechanism == masterWrapMech);
    PORT_Assert(pWswk->exchKeyType      == exchKeyType);
    if (pWswk->symWrapMechanism != masterWrapMech ||
      pWswk->exchKeyType      != exchKeyType) {
      goto loser;
    }
    wrappedKey.type = siBuffer;
    wrappedKey.data = pWswk->wrappedSymmetricWrappingkey;
    wrappedKey.len  = pWswk->wrappedSymKeyLen;
    PORT_Assert(wrappedKey.len <= sizeof pWswk->wrappedSymmetricWrappingkey);

    switch (exchKeyType) {

    case kt_rsa:
      unwrappedWrappingKey =
          PK11_PubUnwrapSymKey(svrPrivKey, &wrappedKey,
                         masterWrapMech, CKA_UNWRAP, 0);
      break;

#ifdef NSS_ENABLE_ECC
    case kt_ecdh:
        /* 
         * For kt_ecdh, we first create an EC public key based on
         * data stored with the wrappedSymmetricWrappingkey. Next,
         * we do an ECDH computation involving this public key and
         * the SSL server's (long-term) EC private key. The resulting
         * shared secret is treated the same way as Fortezza's Ks, i.e.,
         * it is used to recover the symmetric wrapping key.
         *
         * The data in wrappedSymmetricWrappingkey is laid out as defined
         * in the ECCWrappedKeyInfo structure.
         */
        ecWrapped = (ECCWrappedKeyInfo *) pWswk->wrappedSymmetricWrappingkey;

        PORT_Assert(ecWrapped->encodedParamLen + ecWrapped->pubValueLen + 
            ecWrapped->wrappedKeyLen <= MAX_EC_WRAPPED_KEY_BUFLEN);

        if (ecWrapped->encodedParamLen + ecWrapped->pubValueLen + 
            ecWrapped->wrappedKeyLen > MAX_EC_WRAPPED_KEY_BUFLEN) {
            PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
            goto loser;
        }

        pubWrapKey.keyType = ecKey;
        pubWrapKey.u.ec.size = ecWrapped->size;
        pubWrapKey.u.ec.DEREncodedParams.len = ecWrapped->encodedParamLen;
        pubWrapKey.u.ec.DEREncodedParams.data = ecWrapped->var;
        pubWrapKey.u.ec.publicValue.len = ecWrapped->pubValueLen;
        pubWrapKey.u.ec.publicValue.data = ecWrapped->var + 
            ecWrapped->encodedParamLen;

        wrappedKey.len  = ecWrapped->wrappedKeyLen;
        wrappedKey.data = ecWrapped->var + ecWrapped->encodedParamLen + 
            ecWrapped->pubValueLen;
        
        /* Derive Ks using ECDH */
        Ks = PK11_PubDeriveWithKDF(svrPrivKey, &pubWrapKey, PR_FALSE, NULL,
                           NULL, CKM_ECDH1_DERIVE, masterWrapMech, 
                           CKA_DERIVE, 0, CKD_NULL, NULL, NULL);
        if (Ks == NULL) {
            goto loser;
        }

        /*  Use Ks to unwrap the wrapping key */
        unwrappedWrappingKey = PK11_UnwrapSymKey(Ks, masterWrapMech, NULL, 
                                     &wrappedKey, masterWrapMech, 
                                     CKA_UNWRAP, 0);
        PK11_FreeSymKey(Ks);
        
        break;
#endif

    default:
      /* Assert? */
      SET_ERROR_CODE
      goto loser;
    }
loser:
    return unwrappedWrappingKey;
}

/* Each process sharing the server session ID cache has its own array of
 * SymKey pointers for the symmetric wrapping keys that are used to wrap
 * the master secrets.  There is one key for each KEA type.  These Symkeys
 * correspond to the wrapped SymKeys kept in the server session cache.
 */

typedef struct {
    PK11SymKey *      symWrapKey[kt_kea_size];
} ssl3SymWrapKey;

static PZLock *          symWrapKeysLock = NULL;
static ssl3SymWrapKey    symWrapKeys[SSL_NUM_WRAP_MECHS];

SECStatus ssl_FreeSymWrapKeysLock(void)
{
    if (symWrapKeysLock) {
        PZ_DestroyLock(symWrapKeysLock);
        symWrapKeysLock = NULL;
        return SECSuccess;
    }
    PORT_SetError(SEC_ERROR_NOT_INITIALIZED);
    return SECFailure;
}

SECStatus
SSL3_ShutdownServerCache(void)
{
    int             i, j;

    if (!symWrapKeysLock)
      return SECSuccess;      /* lock was never initialized */
    PZ_Lock(symWrapKeysLock);
    /* get rid of all symWrapKeys */
    for (i = 0; i < SSL_NUM_WRAP_MECHS; ++i) {
      for (j = 0; j < kt_kea_size; ++j) {
          PK11SymKey **   pSymWrapKey;
          pSymWrapKey = &symWrapKeys[i].symWrapKey[j];
          if (*pSymWrapKey) {
            PK11_FreeSymKey(*pSymWrapKey);
            *pSymWrapKey = NULL;
          }
      }
    }

    PZ_Unlock(symWrapKeysLock);
    ssl_FreeSessionCacheLocks();
    return SECSuccess;
}

SECStatus ssl_InitSymWrapKeysLock(void)
{
    symWrapKeysLock = PZ_NewLock(nssILockOther);
    return symWrapKeysLock ? SECSuccess : SECFailure;
}

/* Try to get wrapping key for mechanism from in-memory array.
 * If that fails, look for one on disk.
 * If that fails, generate a new one, put the new one on disk,
 * Put the new key in the in-memory array.
 */
static PK11SymKey *
getWrappingKey( sslSocket *       ss,
            PK11SlotInfo *    masterSecretSlot,
            SSL3KEAType       exchKeyType,
                CK_MECHANISM_TYPE masterWrapMech,
              void *            pwArg)
{
    SECKEYPrivateKey *       svrPrivKey;
    SECKEYPublicKey *        svrPubKey             = NULL;
    PK11SymKey *             unwrappedWrappingKey  = NULL;
    PK11SymKey **            pSymWrapKey;
    CK_MECHANISM_TYPE        asymWrapMechanism = CKM_INVALID_MECHANISM;
    int                      length;
    int                      symWrapMechIndex;
    SECStatus                rv;
    SECItem                  wrappedKey;
    SSLWrappedSymWrappingKey wswk;

    svrPrivKey  = ss->serverCerts[exchKeyType].SERVERKEY;
    PORT_Assert(svrPrivKey != NULL);
    if (!svrPrivKey) {
      return NULL;      /* why are we here?!? */
    }

    symWrapMechIndex = ssl_FindIndexByWrapMechanism(masterWrapMech);
    PORT_Assert(symWrapMechIndex >= 0);
    if (symWrapMechIndex < 0)
      return NULL;      /* invalid masterWrapMech. */

    pSymWrapKey = &symWrapKeys[symWrapMechIndex].symWrapKey[exchKeyType];

    ssl_InitSessionCacheLocks(PR_TRUE);

    PZ_Lock(symWrapKeysLock);

    unwrappedWrappingKey = *pSymWrapKey;
    if (unwrappedWrappingKey != NULL) {
      if (PK11_VerifyKeyOK(unwrappedWrappingKey)) {
          unwrappedWrappingKey = PK11_ReferenceSymKey(unwrappedWrappingKey);
          goto done;
      }
      /* slot series has changed, so this key is no good any more. */
      PK11_FreeSymKey(unwrappedWrappingKey);
      *pSymWrapKey = unwrappedWrappingKey = NULL;
    }

    /* Try to get wrapped SymWrapping key out of the (disk) cache. */
    /* Following call fills in wswk on success. */
    if (ssl_GetWrappingKey(symWrapMechIndex, exchKeyType, &wswk)) {
      /* found the wrapped sym wrapping key on disk. */
      unwrappedWrappingKey =
          ssl_UnwrapSymWrappingKey(&wswk, svrPrivKey, exchKeyType,
                                     masterWrapMech, pwArg);
      if (unwrappedWrappingKey) {
          goto install;
      }
    }

    if (!masterSecretSlot)    /* caller doesn't want to create a new one. */
      goto loser;

    length = PK11_GetBestKeyLength(masterSecretSlot, masterWrapMech);
    /* Zero length means fixed key length algorithm, or error.
     * It's ambiguous.
     */
    unwrappedWrappingKey = PK11_KeyGen(masterSecretSlot, masterWrapMech, NULL,
                                       length, pwArg);
    if (!unwrappedWrappingKey) {
      goto loser;
    }

    /* Prepare the buffer to receive the wrappedWrappingKey,
     * the symmetric wrapping key wrapped using the server's pub key.
     */
    PORT_Memset(&wswk, 0, sizeof wswk);   /* eliminate UMRs. */

    if (ss->serverCerts[exchKeyType].serverKeyPair) {
      svrPubKey = ss->serverCerts[exchKeyType].serverKeyPair->pubKey;
    }
    if (svrPubKey == NULL) {
      PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
      goto loser;
    }
    wrappedKey.type = siBuffer;
    wrappedKey.len  = SECKEY_PublicKeyStrength(svrPubKey);
    wrappedKey.data = wswk.wrappedSymmetricWrappingkey;

    PORT_Assert(wrappedKey.len <= sizeof wswk.wrappedSymmetricWrappingkey);
    if (wrappedKey.len > sizeof wswk.wrappedSymmetricWrappingkey)
      goto loser;

    /* wrap symmetric wrapping key in server's public key. */
    switch (exchKeyType) {
#ifdef NSS_ENABLE_ECC
    PK11SymKey *      Ks = NULL;
    SECKEYPublicKey   *pubWrapKey = NULL;
    SECKEYPrivateKey  *privWrapKey = NULL;
    ECCWrappedKeyInfo *ecWrapped;
#endif /* NSS_ENABLE_ECC */

    case kt_rsa:
      asymWrapMechanism = CKM_RSA_PKCS;
      rv = PK11_PubWrapSymKey(asymWrapMechanism, svrPubKey,
                              unwrappedWrappingKey, &wrappedKey);
      break;

#ifdef NSS_ENABLE_ECC
    case kt_ecdh:
      /*
       * We generate an ephemeral EC key pair. Perform an ECDH
       * computation involving this ephemeral EC public key and
       * the SSL server's (long-term) EC private key. The resulting
       * shared secret is treated in the same way as Fortezza's Ks, 
       * i.e., it is used to wrap the wrapping key. To facilitate
       * unwrapping in ssl_UnwrapWrappingKey, we also store all
       * relevant info about the ephemeral EC public key in
       * wswk.wrappedSymmetricWrappingkey and lay it out as 
       * described in the ECCWrappedKeyInfo structure.
       */
      PORT_Assert(svrPubKey->keyType == ecKey);
      if (svrPubKey->keyType != ecKey) {
          /* something is wrong in sslsecur.c if this isn't an ecKey */
          PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
          rv = SECFailure;
          goto ec_cleanup;
      }

      privWrapKey = SECKEY_CreateECPrivateKey(
          &svrPubKey->u.ec.DEREncodedParams, &pubWrapKey, NULL);
      if ((privWrapKey == NULL) || (pubWrapKey == NULL)) {
          rv = SECFailure;
          goto ec_cleanup;
      }
      
      /* Set the key size in bits */
      if (pubWrapKey->u.ec.size == 0) {
          pubWrapKey->u.ec.size = SECKEY_PublicKeyStrengthInBits(svrPubKey);
      }

      PORT_Assert(pubWrapKey->u.ec.DEREncodedParams.len + 
          pubWrapKey->u.ec.publicValue.len < MAX_EC_WRAPPED_KEY_BUFLEN);
      if (pubWrapKey->u.ec.DEREncodedParams.len + 
          pubWrapKey->u.ec.publicValue.len >= MAX_EC_WRAPPED_KEY_BUFLEN) {
          PORT_SetError(SEC_ERROR_INVALID_KEY);
          rv = SECFailure;
          goto ec_cleanup;
      }

      /* Derive Ks using ECDH */
      Ks = PK11_PubDeriveWithKDF(svrPrivKey, pubWrapKey, PR_FALSE, NULL,
                           NULL, CKM_ECDH1_DERIVE, masterWrapMech, 
                           CKA_DERIVE, 0, CKD_NULL, NULL, NULL);
      if (Ks == NULL) {
          rv = SECFailure;
          goto ec_cleanup;
      }

      ecWrapped = (ECCWrappedKeyInfo *) (wswk.wrappedSymmetricWrappingkey);
      ecWrapped->size = pubWrapKey->u.ec.size;
      ecWrapped->encodedParamLen = pubWrapKey->u.ec.DEREncodedParams.len;
      PORT_Memcpy(ecWrapped->var, pubWrapKey->u.ec.DEREncodedParams.data, 
          pubWrapKey->u.ec.DEREncodedParams.len);

      ecWrapped->pubValueLen = pubWrapKey->u.ec.publicValue.len;
      PORT_Memcpy(ecWrapped->var + ecWrapped->encodedParamLen, 
                pubWrapKey->u.ec.publicValue.data, 
                pubWrapKey->u.ec.publicValue.len);

      wrappedKey.len = MAX_EC_WRAPPED_KEY_BUFLEN - 
          (ecWrapped->encodedParamLen + ecWrapped->pubValueLen);
      wrappedKey.data = ecWrapped->var + ecWrapped->encodedParamLen +
          ecWrapped->pubValueLen;

      /* wrap symmetricWrapping key with the local Ks */
      rv = PK11_WrapSymKey(masterWrapMech, NULL, Ks,
                       unwrappedWrappingKey, &wrappedKey);

      if (rv != SECSuccess) {
          goto ec_cleanup;
      }

      /* Write down the length of wrapped key in the buffer
       * wswk.wrappedSymmetricWrappingkey at the appropriate offset
       */
      ecWrapped->wrappedKeyLen = wrappedKey.len;

ec_cleanup:
      if (privWrapKey) SECKEY_DestroyPrivateKey(privWrapKey);
      if (pubWrapKey) SECKEY_DestroyPublicKey(pubWrapKey);
      if (Ks) PK11_FreeSymKey(Ks);
      asymWrapMechanism = masterWrapMech;
      break;
#endif /* NSS_ENABLE_ECC */

    default:
      rv = SECFailure;
      break;
    }

    if (rv != SECSuccess) {
      ssl_MapLowLevelError(SSL_ERROR_CLIENT_KEY_EXCHANGE_FAILURE);
      goto loser;
    }

    PORT_Assert(asymWrapMechanism != CKM_INVALID_MECHANISM);

    wswk.symWrapMechanism  = masterWrapMech;
    wswk.symWrapMechIndex  = symWrapMechIndex;
    wswk.asymWrapMechanism = asymWrapMechanism;
    wswk.exchKeyType       = exchKeyType;
    wswk.wrappedSymKeyLen  = wrappedKey.len;

    /* put it on disk. */
    /* If the wrapping key for this KEA type has already been set, 
     * then abandon the value we just computed and 
     * use the one we got from the disk.
     */
    if (ssl_SetWrappingKey(&wswk)) {
      /* somebody beat us to it.  The original contents of our wswk
       * has been replaced with the content on disk.  Now, discard
       * the key we just created and unwrap this new one.
       */
      PK11_FreeSymKey(unwrappedWrappingKey);

      unwrappedWrappingKey =
          ssl_UnwrapSymWrappingKey(&wswk, svrPrivKey, exchKeyType,
                                     masterWrapMech, pwArg);
    }

install:
    if (unwrappedWrappingKey) {
      *pSymWrapKey = PK11_ReferenceSymKey(unwrappedWrappingKey);
    }

loser:
done:
    PZ_Unlock(symWrapKeysLock);
    return unwrappedWrappingKey;
}


/* Called from ssl3_SendClientKeyExchange(). */
/* Presently, this always uses PKCS11.  There is no bypass for this. */
static SECStatus
sendRSAClientKeyExchange(sslSocket * ss, SECKEYPublicKey * svrPubKey)
{
    PK11SymKey *  pms         = NULL;
    SECStatus           rv                = SECFailure;
    SECItem             enc_pms     = {siBuffer, NULL, 0};
    PRBool              isTLS;

    PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) );
    PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss));

    /* Generate the pre-master secret ...  */
    ssl_GetSpecWriteLock(ss);
    isTLS = (PRBool)(ss->ssl3.pwSpec->version > SSL_LIBRARY_VERSION_3_0);

    pms = ssl3_GenerateRSAPMS(ss, ss->ssl3.pwSpec, NULL);
    ssl_ReleaseSpecWriteLock(ss);
    if (pms == NULL) {
      ssl_MapLowLevelError(SSL_ERROR_CLIENT_KEY_EXCHANGE_FAILURE);
      goto loser;
    }

#if defined(TRACE)
    if (ssl_trace >= 100) {
      SECStatus extractRV = PK11_ExtractKeyValue(pms);
      if (extractRV == SECSuccess) {
          SECItem * keyData = PK11_GetKeyData(pms);
          if (keyData && keyData->data && keyData->len) {
            ssl_PrintBuf(ss, "Pre-Master Secret", 
                       keyData->data, keyData->len);
          }
      }
    }
#endif

    /* Get the wrapped (encrypted) pre-master secret, enc_pms */
    enc_pms.len  = SECKEY_PublicKeyStrength(svrPubKey);
    enc_pms.data = (unsigned char*)PORT_Alloc(enc_pms.len);
    if (enc_pms.data == NULL) {
      goto loser; /* err set by PORT_Alloc */
    }

    /* wrap pre-master secret in server's public key. */
    rv = PK11_PubWrapSymKey(CKM_RSA_PKCS, svrPubKey, pms, &enc_pms);
    if (rv != SECSuccess) {
      ssl_MapLowLevelError(SSL_ERROR_CLIENT_KEY_EXCHANGE_FAILURE);
      goto loser;
    }

    rv = ssl3_InitPendingCipherSpec(ss,  pms);
    PK11_FreeSymKey(pms); pms = NULL;

    if (rv != SECSuccess) {
      ssl_MapLowLevelError(SSL_ERROR_CLIENT_KEY_EXCHANGE_FAILURE);
      goto loser;
    }

    rv = ssl3_AppendHandshakeHeader(ss, client_key_exchange, 
                            isTLS ? enc_pms.len + 2 : enc_pms.len);
    if (rv != SECSuccess) {
      goto loser; /* err set by ssl3_AppendHandshake* */
    }
    if (isTLS) {
      rv = ssl3_AppendHandshakeVariable(ss, enc_pms.data, enc_pms.len, 2);
    } else {
      rv = ssl3_AppendHandshake(ss, enc_pms.data, enc_pms.len);
    }
    if (rv != SECSuccess) {
      goto loser; /* err set by ssl3_AppendHandshake* */
    }

    rv = SECSuccess;

loser:
    if (enc_pms.data != NULL) {
      PORT_Free(enc_pms.data);
    }
    if (pms != NULL) {
      PK11_FreeSymKey(pms);
    }
    return rv;
}

/* Called from ssl3_SendClientKeyExchange(). */
/* Presently, this always uses PKCS11.  There is no bypass for this. */
static SECStatus
sendDHClientKeyExchange(sslSocket * ss, SECKEYPublicKey * svrPubKey)
{
    PK11SymKey *  pms         = NULL;
    SECStatus           rv                = SECFailure;
    PRBool              isTLS;
    CK_MECHANISM_TYPE   target;

    SECKEYDHParams      dhParam;          /* DH parameters */
    SECKEYPublicKey     *pubKey = NULL;         /* Ephemeral DH key */
    SECKEYPrivateKey    *privKey = NULL;  /* Ephemeral DH key */

    PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) );
    PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss));

    isTLS = (PRBool)(ss->ssl3.pwSpec->version > SSL_LIBRARY_VERSION_3_0);

    /* Copy DH parameters from server key */

    if (svrPubKey->keyType != dhKey) {
      PORT_SetError(SEC_ERROR_BAD_KEY);
      goto loser;
    }
    dhParam.prime.data = svrPubKey->u.dh.prime.data;
    dhParam.prime.len = svrPubKey->u.dh.prime.len;
    dhParam.base.data = svrPubKey->u.dh.base.data;
    dhParam.base.len = svrPubKey->u.dh.base.len;

    /* Generate ephemeral DH keypair */
    privKey = SECKEY_CreateDHPrivateKey(&dhParam, &pubKey, NULL);
    if (!privKey || !pubKey) {
          ssl_MapLowLevelError(SEC_ERROR_KEYGEN_FAIL);
          rv = SECFailure;
          goto loser;
    }
    PRINT_BUF(50, (ss, "DH public value:",
                              pubKey->u.dh.publicValue.data,
                              pubKey->u.dh.publicValue.len));

    if (isTLS) target = CKM_TLS_MASTER_KEY_DERIVE_DH;
    else target = CKM_SSL3_MASTER_KEY_DERIVE_DH;

    /* Determine the PMS */

    pms = PK11_PubDerive(privKey, svrPubKey, PR_FALSE, NULL, NULL,
                      CKM_DH_PKCS_DERIVE, target, CKA_DERIVE, 0, NULL);

    if (pms == NULL) {
      ssl_MapLowLevelError(SSL_ERROR_CLIENT_KEY_EXCHANGE_FAILURE);
      goto loser;
    }

    SECKEY_DestroyPrivateKey(privKey);
    privKey = NULL;

    rv = ssl3_InitPendingCipherSpec(ss,  pms);
    PK11_FreeSymKey(pms); pms = NULL;

    if (rv != SECSuccess) {
      ssl_MapLowLevelError(SSL_ERROR_CLIENT_KEY_EXCHANGE_FAILURE);
      goto loser;
    }

    rv = ssl3_AppendHandshakeHeader(ss, client_key_exchange, 
                              pubKey->u.dh.publicValue.len + 2);
    if (rv != SECSuccess) {
      goto loser; /* err set by ssl3_AppendHandshake* */
    }
    rv = ssl3_AppendHandshakeVariable(ss, 
                              pubKey->u.dh.publicValue.data,
                              pubKey->u.dh.publicValue.len, 2);
    SECKEY_DestroyPublicKey(pubKey);
    pubKey = NULL;

    if (rv != SECSuccess) {
      goto loser; /* err set by ssl3_AppendHandshake* */
    }

    rv = SECSuccess;


loser:

    if(pms) PK11_FreeSymKey(pms);
    if(privKey) SECKEY_DestroyPrivateKey(privKey);
    if(pubKey) SECKEY_DestroyPublicKey(pubKey);
    return rv;
}





/* Called from ssl3_HandleServerHelloDone(). */
static SECStatus
ssl3_SendClientKeyExchange(sslSocket *ss)
{
    SECKEYPublicKey *   serverKey   = NULL;
    SECStatus           rv          = SECFailure;
    PRBool              isTLS;

    SSL_TRC(3, ("%d: SSL3[%d]: send client_key_exchange handshake",
            SSL_GETPID(), ss->fd));

    PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss));
    PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss));

    if (ss->sec.peerKey == NULL) {
      serverKey = CERT_ExtractPublicKey(ss->sec.peerCert);
      if (serverKey == NULL) {
          PORT_SetError(SSL_ERROR_EXTRACT_PUBLIC_KEY_FAILURE);
          return SECFailure;
      }
    } else {
      serverKey = ss->sec.peerKey;
      ss->sec.peerKey = NULL; /* we're done with it now */
    }

    isTLS = (PRBool)(ss->ssl3.pwSpec->version > SSL_LIBRARY_VERSION_3_0);
    /* enforce limits on kea key sizes. */
    if (ss->ssl3.hs.kea_def->is_limited) {
      int keyLen = SECKEY_PublicKeyStrength(serverKey);     /* bytes */

      if (keyLen * BPB > ss->ssl3.hs.kea_def->key_size_limit) {
          if (isTLS)
            (void)SSL3_SendAlert(ss, alert_fatal, export_restriction);
          else
            (void)ssl3_HandshakeFailure(ss);
          PORT_SetError(SSL_ERROR_PUB_KEY_SIZE_LIMIT_EXCEEDED);
          goto loser;
      }
    }

    ss->sec.keaType    = ss->ssl3.hs.kea_def->exchKeyType;
    ss->sec.keaKeyBits = SECKEY_PublicKeyStrengthInBits(serverKey);

    switch (ss->ssl3.hs.kea_def->exchKeyType) {
    case kt_rsa:
      rv = sendRSAClientKeyExchange(ss, serverKey);
      break;

    case kt_dh:
      rv = sendDHClientKeyExchange(ss, serverKey);
      break;

#ifdef NSS_ENABLE_ECC
    case kt_ecdh:
      rv = ssl3_SendECDHClientKeyExchange(ss, serverKey);
      break;
#endif /* NSS_ENABLE_ECC */

    default:
      /* got an unknown or unsupported Key Exchange Algorithm.  */
      SEND_ALERT
      PORT_SetError(SEC_ERROR_UNSUPPORTED_KEYALG);
      break;
    }

    SSL_TRC(3, ("%d: SSL3[%d]: DONE sending client_key_exchange",
            SSL_GETPID(), ss->fd));

loser:
    if (serverKey) 
      SECKEY_DestroyPublicKey(serverKey);
    return rv;    /* err code already set. */
}

/* Called from ssl3_HandleServerHelloDone(). */
static SECStatus
ssl3_SendCertificateVerify(sslSocket *ss)
{
    SECStatus     rv          = SECFailure;
    PRBool        isTLS;
    SECItem       buf           = {siBuffer, NULL, 0};
    SSL3Hashes    hashes;

    PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss));
    PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss));

    SSL_TRC(3, ("%d: SSL3[%d]: send certificate_verify handshake",
            SSL_GETPID(), ss->fd));

    ssl_GetSpecReadLock(ss);
    rv = ssl3_ComputeHandshakeHashes(ss, ss->ssl3.pwSpec, &hashes, 0);
    ssl_ReleaseSpecReadLock(ss);
    if (rv != SECSuccess) {
      goto done;  /* err code was set by ssl3_ComputeHandshakeHashes */
    }

    isTLS = (PRBool)(ss->ssl3.pwSpec->version > SSL_LIBRARY_VERSION_3_0);
    rv = ssl3_SignHashes(&hashes, ss->ssl3.clientPrivateKey, &buf, isTLS);
    if (rv == SECSuccess) {
      PK11SlotInfo * slot;
      sslSessionID * sid   = ss->sec.ci.sid;

      /* Remember the info about the slot that did the signing.
      ** Later, when doing an SSL restart handshake, verify this.
      ** These calls are mere accessors, and can't fail.
      */
      slot = PK11_GetSlotFromPrivateKey(ss->ssl3.clientPrivateKey);
      sid->u.ssl3.clAuthSeries     = PK11_GetSlotSeries(slot);
      sid->u.ssl3.clAuthSlotID     = PK11_GetSlotID(slot);
      sid->u.ssl3.clAuthModuleID   = PK11_GetModuleID(slot);
      sid->u.ssl3.clAuthValid      = PR_TRUE;
      PK11_FreeSlot(slot);
    }
    /* If we're doing RSA key exchange, we're all done with the private key
     * here.  Diffie-Hellman key exchanges need the client's
     * private key for the key exchange.
     */
    if (ss->ssl3.hs.kea_def->exchKeyType == kt_rsa) {
      SECKEY_DestroyPrivateKey(ss->ssl3.clientPrivateKey);
      ss->ssl3.clientPrivateKey = NULL;
    }
    if (rv != SECSuccess) {
      goto done;  /* err code was set by ssl3_SignHashes */
    }

    rv = ssl3_AppendHandshakeHeader(ss, certificate_verify, buf.len + 2);
    if (rv != SECSuccess) {
      goto done;  /* error code set by AppendHandshake */
    }
    rv = ssl3_AppendHandshakeVariable(ss, buf.data, buf.len, 2);
    if (rv != SECSuccess) {
      goto done;  /* error code set by AppendHandshake */
    }

done:
    if (buf.data)
      PORT_Free(buf.data);
    return rv;
}

/* Called from ssl3_HandleHandshakeMessage() when it has deciphered a complete
 * ssl3 ServerHello message.
 * Caller must hold Handshake and RecvBuf locks.
 */
static SECStatus
ssl3_HandleServerHello(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
{
    sslSessionID *sid         = ss->sec.ci.sid;
    PRInt32       temp;       /* allow for consume number failure */
    PRBool        suite_found   = PR_FALSE;
    int           i;
    int           errCode     = SSL_ERROR_RX_MALFORMED_SERVER_HELLO;
    SECStatus     rv;
    SECItem       sidBytes    = {siBuffer, NULL, 0};
    PRBool        sid_match;
    PRBool        isTLS       = PR_FALSE;
    SSL3AlertDescription desc   = illegal_parameter;
    SSL3ProtocolVersion version;

    SSL_TRC(3, ("%d: SSL3[%d]: handle server_hello handshake",
      SSL_GETPID(), ss->fd));
    PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) );
    PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) );

    rv = ssl3_InitState(ss);
    if (rv != SECSuccess) {
      errCode = PORT_GetError(); /* ssl3_InitState has set the error code. */
      goto alert_loser;
    }
    if (ss->ssl3.hs.ws != wait_server_hello) {
        errCode = SSL_ERROR_RX_UNEXPECTED_SERVER_HELLO;
      desc    = unexpected_message;
      goto alert_loser;
    }

    temp = ssl3_ConsumeHandshakeNumber(ss, 2, &b, &length);
    if (temp < 0) {
      goto loser;       /* alert has been sent */
    }
    version = (SSL3ProtocolVersion)temp;

    /* this is appropriate since the negotiation is complete, and we only
    ** know SSL 3.x.
    */
    if (MSB(version) != MSB(SSL_LIBRARY_VERSION_3_0)) {
      desc = (version > SSL_LIBRARY_VERSION_3_0) ? protocol_version 
                                       : handshake_failure;
      goto alert_loser;
    }

    rv = ssl3_NegotiateVersion(ss, version);
    if (rv != SECSuccess) {
      desc = (version > SSL_LIBRARY_VERSION_3_0) ? protocol_version 
                                       : handshake_failure;
      errCode = SSL_ERROR_NO_CYPHER_OVERLAP;
      goto alert_loser;
    }
    isTLS = (ss->version > SSL_LIBRARY_VERSION_3_0);

    rv = ssl3_ConsumeHandshake(
      ss, &ss->ssl3.hs.server_random, SSL3_RANDOM_LENGTH, &b, &length);
    if (rv != SECSuccess) {
      goto loser;       /* alert has been sent */
    }

    rv = ssl3_ConsumeHandshakeVariable(ss, &sidBytes, 1, &b, &length);
    if (rv != SECSuccess) {
      goto loser;       /* alert has been sent */
    }
    if (sidBytes.len > SSL3_SESSIONID_BYTES) {
      if (isTLS)
          desc = decode_error;
      goto alert_loser; /* malformed. */
    }

    /* find selected cipher suite in our list. */
    temp = ssl3_ConsumeHandshakeNumber(ss, 2, &b, &length);
    if (temp < 0) {
      goto loser;       /* alert has been sent */
    }
    ssl3_config_match_init(ss);
    for (i = 0; i < ssl_V3_SUITES_IMPLEMENTED; i++) {
      ssl3CipherSuiteCfg *suite = &ss->cipherSuites[i];
      if ((temp == suite->cipher_suite) &&
          (config_match(suite, ss->ssl3.policy, PR_TRUE))) {
          suite_found = PR_TRUE;
          break;  /* success */
      }
    }
    if (!suite_found) {
      desc    = handshake_failure;
      errCode = SSL_ERROR_NO_CYPHER_OVERLAP;
      goto alert_loser;
    }
    ss->ssl3.hs.cipher_suite = (ssl3CipherSuite)temp;
    ss->ssl3.hs.suite_def    = ssl_LookupCipherSuiteDef((ssl3CipherSuite)temp);
    PORT_Assert(ss->ssl3.hs.suite_def);
    if (!ss->ssl3.hs.suite_def) {
      PORT_SetError(errCode = SEC_ERROR_LIBRARY_FAILURE);
      goto loser; /* we don't send alerts for our screw-ups. */
    }

    /* find selected compression method in our list. */
    temp = ssl3_ConsumeHandshakeNumber(ss, 1, &b, &length);
    if (temp < 0) {
      goto loser;       /* alert has been sent */
    }
    suite_found = PR_FALSE;
    for (i = 0; i < compressionMethodsCount; i++) {
      if (temp == compressions[i])  {
          suite_found = PR_TRUE;
          break;  /* success */
      }
    }
    if (!suite_found) {
      desc    = handshake_failure;
      errCode = SSL_ERROR_NO_COMPRESSION_OVERLAP;
      goto alert_loser;
    }
    ss->ssl3.hs.compression = (SSL3CompressionMethod)temp;

    /* Note that if !isTLS && length != 0, we do NOT goto alert_loser.
     * There are some old SSL 3.0 implementations that do send stuff
     * after the end of the server hello, and we deliberately ignore
     * such stuff in the interest of maximal interoperability (being
     * "generous in what you accept").
     */
    if (isTLS && length != 0) {
      SECItem extensions;
      rv = ssl3_ConsumeHandshakeVariable(ss, &extensions, 2, &b, &length);
      if (rv != SECSuccess || length != 0)
          goto alert_loser;
      rv = ssl3_HandleHelloExtensions(ss, &extensions.data, &extensions.len);
      if (rv != SECSuccess)
          goto alert_loser;
    }

    /* Any errors after this point are not "malformed" errors. */
    desc    = handshake_failure;

    /* we need to call ssl3_SetupPendingCipherSpec here so we can check the
     * key exchange algorithm. */
    rv = ssl3_SetupPendingCipherSpec(ss);
    if (rv != SECSuccess) {
      goto alert_loser; /* error code is set. */
    }

    /* We may or may not have sent a session id, we may get one back or
     * not and if so it may match the one we sent.
     * Attempt to restore the master secret to see if this is so...
     * Don't consider failure to find a matching SID an error.
     */
    sid_match = (PRBool)(sidBytes.len > 0 &&
      sidBytes.len == sid->u.ssl3.sessionIDLength &&
      !PORT_Memcmp(sid->u.ssl3.sessionID, sidBytes.data, sidBytes.len));

    if (sid_match &&
      sid->version == ss->version &&
      sid->u.ssl3.cipherSuite == ss->ssl3.hs.cipher_suite) do {
      ssl3CipherSpec *pwSpec = ss->ssl3.pwSpec;

      SECItem       wrappedMS;   /* wrapped master secret. */

      ss->sec.authAlgorithm = sid->authAlgorithm;
      ss->sec.authKeyBits   = sid->authKeyBits;
      ss->sec.keaType       = sid->keaType;
      ss->sec.keaKeyBits    = sid->keaKeyBits;

      /* 3 cases here:
       * a) key is wrapped (implies using PKCS11)
       * b) key is unwrapped, but we're still using PKCS11
       * c) key is unwrapped, and we're bypassing PKCS11.
       */
      if (sid->u.ssl3.keys.msIsWrapped) {
          PK11SlotInfo *slot;
          PK11SymKey *  wrapKey;     /* wrapping key */
          CK_FLAGS      keyFlags      = 0;

          if (ss->opt.bypassPKCS11) {
            /* we cannot restart a non-bypass session in a 
            ** bypass socket.
            */
            break;  
          }
          /* unwrap master secret with PKCS11 */
          slot = SECMOD_LookupSlot(sid->u.ssl3.masterModuleID,
                             sid->u.ssl3.masterSlotID);
          if (slot == NULL) {
            break;            /* not considered an error. */
          }
          if (!PK11_IsPresent(slot)) {
            PK11_FreeSlot(slot);
            break;            /* not considered an error. */
          }
          wrapKey = PK11_GetWrapKey(slot, sid->u.ssl3.masterWrapIndex,
                              sid->u.ssl3.masterWrapMech,
                              sid->u.ssl3.masterWrapSeries,
                              ss->pkcs11PinArg);
          PK11_FreeSlot(slot);
          if (wrapKey == NULL) {
            break;            /* not considered an error. */
          }

          if (ss->version > SSL_LIBRARY_VERSION_3_0) {      /* isTLS */
            keyFlags = CKF_SIGN | CKF_VERIFY;
          }

          wrappedMS.data = sid->u.ssl3.keys.wrapped_master_secret;
          wrappedMS.len  = sid->u.ssl3.keys.wrapped_master_secret_len;
          pwSpec->master_secret =
            PK11_UnwrapSymKeyWithFlags(wrapKey, sid->u.ssl3.masterWrapMech, 
                      NULL, &wrappedMS, CKM_SSL3_MASTER_KEY_DERIVE,
                      CKA_DERIVE, sizeof(SSL3MasterSecret), keyFlags);
          errCode = PORT_GetError();
          PK11_FreeSymKey(wrapKey);
          if (pwSpec->master_secret == NULL) {
            break;      /* errorCode set just after call to UnwrapSymKey. */
          }
      } else if (ss->opt.bypassPKCS11) {
          /* MS is not wrapped */
          wrappedMS.data = sid->u.ssl3.keys.wrapped_master_secret;
          wrappedMS.len  = sid->u.ssl3.keys.wrapped_master_secret_len;
          memcpy(pwSpec->raw_master_secret, wrappedMS.data, wrappedMS.len);
          pwSpec->msItem.data = pwSpec->raw_master_secret;
          pwSpec->msItem.len  = wrappedMS.len;
      } else {
          /* We CAN restart a bypass session in a non-bypass socket. */
          /* need to import the raw master secret to session object */
          PK11SlotInfo *slot = PK11_GetInternalSlot();
          wrappedMS.data = sid->u.ssl3.keys.wrapped_master_secret;
          wrappedMS.len  = sid->u.ssl3.keys.wrapped_master_secret_len;
          pwSpec->master_secret =  
            PK11_ImportSymKey(slot, CKM_SSL3_MASTER_KEY_DERIVE, 
                          PK11_OriginUnwrap, CKA_ENCRYPT, 
                          &wrappedMS, NULL);
          PK11_FreeSlot(slot);
          if (pwSpec->master_secret == NULL) {
            break; 
          }
      }

      /* Got a Match */
      SSL_AtomicIncrementLong(& ssl3stats.hsh_sid_cache_hits );

      /* If we sent a session ticket, then this is a stateless resume. */
      if (sid->version > SSL_LIBRARY_VERSION_3_0 &&
          sid->u.ssl3.sessionTicket.ticket.data != NULL)
          SSL_AtomicIncrementLong(& ssl3stats.hsh_sid_stateless_resumes );

      if (ssl3_ExtensionNegotiated(ss, session_ticket_xtn))
          ss->ssl3.hs.ws = wait_new_session_ticket;
      else
          ss->ssl3.hs.ws = wait_change_cipher;

      ss->ssl3.hs.isResuming = PR_TRUE;

      /* copy the peer cert from the SID */
      if (sid->peerCert != NULL) {
          ss->sec.peerCert = CERT_DupCertificate(sid->peerCert);
      }


      /* NULL value for PMS signifies re-use of the old MS */
      rv = ssl3_InitPendingCipherSpec(ss,  NULL);
      if (rv != SECSuccess) {
          goto alert_loser;   /* err code was set */
      }
      return SECSuccess;
    } while (0);

    if (sid_match)
      SSL_AtomicIncrementLong(& ssl3stats.hsh_sid_cache_not_ok );
    else
      SSL_AtomicIncrementLong(& ssl3stats.hsh_sid_cache_misses );

    /* throw the old one away */
    sid->u.ssl3.keys.resumable = PR_FALSE;
    (*ss->sec.uncache)(sid);
    ssl_FreeSID(sid);

    /* get a new sid */
    ss->sec.ci.sid = sid = ssl3_NewSessionID(ss, PR_FALSE);
    if (sid == NULL) {
      goto alert_loser; /* memory error is set. */
    }

    sid->version = ss->version;
    sid->u.ssl3.sessionIDLength = sidBytes.len;
    PORT_Memcpy(sid->u.ssl3.sessionID, sidBytes.data, sidBytes.len);

    ss->ssl3.hs.isResuming = PR_FALSE;
    ss->ssl3.hs.ws         = wait_server_cert;
    return SECSuccess;

alert_loser:
    (void)SSL3_SendAlert(ss, alert_fatal, desc);

loser:
    errCode = ssl_MapLowLevelError(errCode);
    return SECFailure;
}

/* Called from ssl3_HandleHandshakeMessage() when it has deciphered a complete
 * ssl3 ServerKeyExchange message.
 * Caller must hold Handshake and RecvBuf locks.
 */
static SECStatus
ssl3_HandleServerKeyExchange(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
{
    PRArenaPool *    arena     = NULL;
    SECKEYPublicKey *peerKey   = NULL;
    PRBool           isTLS;
    SECStatus        rv;
    int              errCode   = SSL_ERROR_RX_MALFORMED_SERVER_KEY_EXCH;
    SSL3AlertDescription desc  = illegal_parameter;
    SSL3Hashes       hashes;
    SECItem          signature = {siBuffer, NULL, 0};

    SSL_TRC(3, ("%d: SSL3[%d]: handle server_key_exchange handshake",
            SSL_GETPID(), ss->fd));
    PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) );
    PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) );

    if (ss->ssl3.hs.ws != wait_server_key &&
      ss->ssl3.hs.ws != wait_server_cert) {
      errCode = SSL_ERROR_RX_UNEXPECTED_SERVER_KEY_EXCH;
      desc    = unexpected_message;
      goto alert_loser;
    }
    if (ss->sec.peerCert == NULL) {
      errCode = SSL_ERROR_RX_UNEXPECTED_SERVER_KEY_EXCH;
      desc    = unexpected_message;
      goto alert_loser;
    }

    isTLS = (PRBool)(ss->ssl3.prSpec->version > SSL_LIBRARY_VERSION_3_0);

    switch (ss->ssl3.hs.kea_def->exchKeyType) {

    case kt_rsa: {
      SECItem          modulus   = {siBuffer, NULL, 0};
      SECItem          exponent  = {siBuffer, NULL, 0};

      rv = ssl3_ConsumeHandshakeVariable(ss, &modulus, 2, &b, &length);
      if (rv != SECSuccess) {
          goto loser;         /* malformed. */
      }
      rv = ssl3_ConsumeHandshakeVariable(ss, &exponent, 2, &b, &length);
      if (rv != SECSuccess) {
          goto loser;         /* malformed. */
      }
      rv = ssl3_ConsumeHandshakeVariable(ss, &signature, 2, &b, &length);
      if (rv != SECSuccess) {
          goto loser;         /* malformed. */
      }
      if (length != 0) {
          if (isTLS)
            desc = decode_error;
          goto alert_loser;         /* malformed. */
      }

      /* failures after this point are not malformed handshakes. */
      /* TLS: send decrypt_error if signature failed. */
      desc = isTLS ? decrypt_error : handshake_failure;

      /*
       *  check to make sure the hash is signed by right guy
       */
      rv = ssl3_ComputeExportRSAKeyHash(modulus, exponent,
                                &ss->ssl3.hs.client_random,
                                &ss->ssl3.hs.server_random, 
                                &hashes, ss->opt.bypassPKCS11);
        if (rv != SECSuccess) {
          errCode =
            ssl_MapLowLevelError(SSL_ERROR_SERVER_KEY_EXCHANGE_FAILURE);
          goto alert_loser;
      }
        rv = ssl3_VerifySignedHashes(&hashes, ss->sec.peerCert, &signature,
                            isTLS, ss->pkcs11PinArg);
      if (rv != SECSuccess)  {
          errCode =
            ssl_MapLowLevelError(SSL_ERROR_SERVER_KEY_EXCHANGE_FAILURE);
          goto alert_loser;
      }

      /*
       * we really need to build a new key here because we can no longer
       * ignore calling SECKEY_DestroyPublicKey. Using the key may allocate
       * pkcs11 slots and ID's.
       */
      arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
      if (arena == NULL) {
          goto no_memory;
      }

      peerKey = PORT_ArenaZNew(arena, SECKEYPublicKey);
      if (peerKey == NULL) {
            PORT_FreeArena(arena, PR_FALSE);
          goto no_memory;
      }

      peerKey->arena              = arena;
      peerKey->keyType            = rsaKey;
      peerKey->pkcs11Slot         = NULL;
      peerKey->pkcs11ID           = CK_INVALID_HANDLE;
      if (SECITEM_CopyItem(arena, &peerKey->u.rsa.modulus,        &modulus) ||
          SECITEM_CopyItem(arena, &peerKey->u.rsa.publicExponent, &exponent))
      {
            PORT_FreeArena(arena, PR_FALSE);
          goto no_memory;
        }
      ss->sec.peerKey = peerKey;
      ss->ssl3.hs.ws = wait_cert_request;
      return SECSuccess;
    }

    case kt_dh: {
      SECItem          dh_p      = {siBuffer, NULL, 0};
      SECItem          dh_g      = {siBuffer, NULL, 0};
      SECItem          dh_Ys     = {siBuffer, NULL, 0};

      rv = ssl3_ConsumeHandshakeVariable(ss, &dh_p, 2, &b, &length);
      if (rv != SECSuccess) {
          goto loser;         /* malformed. */
      }
      rv = ssl3_ConsumeHandshakeVariable(ss, &dh_g, 2, &b, &length);
      if (rv != SECSuccess) {
          goto loser;         /* malformed. */
      }
      rv = ssl3_ConsumeHandshakeVariable(ss, &dh_Ys, 2, &b, &length);
      if (rv != SECSuccess) {
          goto loser;         /* malformed. */
      }
      rv = ssl3_ConsumeHandshakeVariable(ss, &signature, 2, &b, &length);
      if (rv != SECSuccess) {
          goto loser;         /* malformed. */
      }
      if (length != 0) {
          if (isTLS)
            desc = decode_error;
          goto alert_loser;         /* malformed. */
      }

      PRINT_BUF(60, (NULL, "Server DH p", dh_p.data, dh_p.len));
      PRINT_BUF(60, (NULL, "Server DH g", dh_g.data, dh_g.len));
      PRINT_BUF(60, (NULL, "Server DH Ys", dh_Ys.data, dh_Ys.len));

      /* failures after this point are not malformed handshakes. */
      /* TLS: send decrypt_error if signature failed. */
      desc = isTLS ? decrypt_error : handshake_failure;

      /*
       *  check to make sure the hash is signed by right guy
       */
      rv = ssl3_ComputeDHKeyHash(dh_p, dh_g, dh_Ys,
                                &ss->ssl3.hs.client_random,
                                &ss->ssl3.hs.server_random, 
                                &hashes, ss->opt.bypassPKCS11);
        if (rv != SECSuccess) {
          errCode =
            ssl_MapLowLevelError(SSL_ERROR_SERVER_KEY_EXCHANGE_FAILURE);
          goto alert_loser;
      }
        rv = ssl3_VerifySignedHashes(&hashes, ss->sec.peerCert, &signature,
                            isTLS, ss->pkcs11PinArg);
      if (rv != SECSuccess)  {
          errCode =
            ssl_MapLowLevelError(SSL_ERROR_SERVER_KEY_EXCHANGE_FAILURE);
          goto alert_loser;
      }

      /*
       * we really need to build a new key here because we can no longer
       * ignore calling SECKEY_DestroyPublicKey. Using the key may allocate
       * pkcs11 slots and ID's.
       */
      arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
      if (arena == NULL) {
          goto no_memory;
      }

      ss->sec.peerKey = peerKey = PORT_ArenaZNew(arena, SECKEYPublicKey);
      if (peerKey == NULL) {
          goto no_memory;
      }

      peerKey->arena              = arena;
      peerKey->keyType            = dhKey;
      peerKey->pkcs11Slot         = NULL;
      peerKey->pkcs11ID           = CK_INVALID_HANDLE;

      if (SECITEM_CopyItem(arena, &peerKey->u.dh.prime,        &dh_p) ||
          SECITEM_CopyItem(arena, &peerKey->u.dh.base,         &dh_g) ||
          SECITEM_CopyItem(arena, &peerKey->u.dh.publicValue,  &dh_Ys))
      {
            PORT_FreeArena(arena, PR_FALSE);
          goto no_memory;
        }
      ss->sec.peerKey = peerKey;
      ss->ssl3.hs.ws = wait_cert_request;
      return SECSuccess;
    }

#ifdef NSS_ENABLE_ECC
    case kt_ecdh:
      rv = ssl3_HandleECDHServerKeyExchange(ss, b, length);
      return rv;
#endif /* NSS_ENABLE_ECC */

    default:
      desc    = handshake_failure;
      errCode = SEC_ERROR_UNSUPPORTED_KEYALG;
      break;            /* goto alert_loser; */
    }

alert_loser:
    (void)SSL3_SendAlert(ss, alert_fatal, desc);
loser:
    PORT_SetError( errCode );
    return SECFailure;

no_memory:  /* no-memory error has already been set. */
    ssl_MapLowLevelError(SSL_ERROR_SERVER_KEY_EXCHANGE_FAILURE);
    return SECFailure;
}


typedef struct dnameNode {
    struct dnameNode *next;
    SECItem           name;
} dnameNode;

/* Called from ssl3_HandleHandshakeMessage() when it has deciphered a complete
 * ssl3 Certificate Request message.
 * Caller must hold Handshake and RecvBuf locks.
 */
static SECStatus
ssl3_HandleCertificateRequest(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
{
    PRArenaPool *        arena       = NULL;
    dnameNode *          node;
    PRInt32              remaining;
    PRBool               isTLS       = PR_FALSE;
    int                  i;
    int                  errCode     = SSL_ERROR_RX_MALFORMED_CERT_REQUEST;
    int                  nnames      = 0;
    SECStatus            rv;
    SSL3AlertDescription desc        = illegal_parameter;
    SECItem              cert_types  = {siBuffer, NULL, 0};
    CERTDistNames        ca_list;

    SSL_TRC(3, ("%d: SSL3[%d]: handle certificate_request handshake",
            SSL_GETPID(), ss->fd));
    PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) );
    PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) );

    if (ss->ssl3.hs.ws != wait_cert_request &&
      ss->ssl3.hs.ws != wait_server_key) {
      desc    = unexpected_message;
      errCode = SSL_ERROR_RX_UNEXPECTED_CERT_REQUEST;
      goto alert_loser;
    }

    /* clean up anything left from previous handshake. */
    if (ss->ssl3.clientCertChain != NULL) {
       CERT_DestroyCertificateList(ss->ssl3.clientCertChain);
       ss->ssl3.clientCertChain = NULL;
    }
    if (ss->ssl3.clientCertificate != NULL) {
       CERT_DestroyCertificate(ss->ssl3.clientCertificate);
       ss->ssl3.clientCertificate = NULL;
    }
    if (ss->ssl3.clientPrivateKey != NULL) {
       SECKEY_DestroyPrivateKey(ss->ssl3.clientPrivateKey);
       ss->ssl3.clientPrivateKey = NULL;
    }

    isTLS = (PRBool)(ss->ssl3.prSpec->version > SSL_LIBRARY_VERSION_3_0);
    rv = ssl3_ConsumeHandshakeVariable(ss, &cert_types, 1, &b, &length);
    if (rv != SECSuccess)
      goto loser;       /* malformed, alert has been sent */

    arena = ca_list.arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
    if (arena == NULL)
      goto no_mem;

    remaining = ssl3_ConsumeHandshakeNumber(ss, 2, &b, &length);
    if (remaining < 0)
      goto loser;       /* malformed, alert has been sent */

    if ((PRUint32)remaining > length)
      goto alert_loser;

    ca_list.head = node = PORT_ArenaZNew(arena, dnameNode);
    if (node == NULL)
      goto no_mem;

    while (remaining > 0) {
      PRInt32 len;

      if (remaining < 2)
          goto alert_loser;   /* malformed */

      node->name.len = len = ssl3_ConsumeHandshakeNumber(ss, 2, &b, &length);
      if (len <= 0)
          goto loser;         /* malformed, alert has been sent */

      remaining -= 2;
      if (remaining < len)
          goto alert_loser;   /* malformed */

      node->name.data = b;
      b         += len;
      length    -= len;
      remaining -= len;
      nnames++;
      if (remaining <= 0)
          break;        /* success */

      node->next = PORT_ArenaZNew(arena, dnameNode);
      node = node->next;
      if (node == NULL)
          goto no_mem;
    }

    ca_list.nnames = nnames;
    ca_list.names  = PORT_ArenaNewArray(arena, SECItem, nnames);
    if (nnames > 0 && ca_list.names == NULL)
        goto no_mem;

    for(i = 0, node = (dnameNode*)ca_list.head;
      i < nnames;
      i++, node = node->next) {
      ca_list.names[i] = node->name;
    }

    if (length != 0)
        goto alert_loser;     /* malformed */

    desc = no_certificate;
    ss->ssl3.hs.ws = wait_hello_done;

    if (ss->getClientAuthData == NULL) {
      rv = SECFailure; /* force it to send a no_certificate alert */
    } else {
      /* XXX Should pass cert_types in this call!! */
      rv = (SECStatus)(*ss->getClientAuthData)(ss->getClientAuthDataArg,
                                     ss->fd, &ca_list,
                                     &ss->ssl3.clientCertificate,
                                     &ss->ssl3.clientPrivateKey);
    }
    switch (rv) {
    case SECWouldBlock: /* getClientAuthData has put up a dialog box. */
      ssl_SetAlwaysBlock(ss);
      break;      /* not an error */

    case SECSuccess:
        /* check what the callback function returned */
        if ((!ss->ssl3.clientCertificate) || (!ss->ssl3.clientPrivateKey)) {
            /* we are missing either the key or cert */
            if (ss->ssl3.clientCertificate) {
                /* got a cert, but no key - free it */
                CERT_DestroyCertificate(ss->ssl3.clientCertificate);
                ss->ssl3.clientCertificate = NULL;
            }
            if (ss->ssl3.clientPrivateKey) {
                /* got a key, but no cert - free it */
                SECKEY_DestroyPrivateKey(ss->ssl3.clientPrivateKey);
                ss->ssl3.clientPrivateKey = NULL;
            }
            goto send_no_certificate;
        }
      /* Setting ssl3.clientCertChain non-NULL will cause
       * ssl3_HandleServerHelloDone to call SendCertificate.
       */
      ss->ssl3.clientCertChain = CERT_CertChainFromCert(
                              ss->ssl3.clientCertificate,
                              certUsageSSLClient, PR_FALSE);
      if (ss->ssl3.clientCertChain == NULL) {
          if (ss->ssl3.clientCertificate != NULL) {
            CERT_DestroyCertificate(ss->ssl3.clientCertificate);
            ss->ssl3.clientCertificate = NULL;
          }
          if (ss->ssl3.clientPrivateKey != NULL) {
            SECKEY_DestroyPrivateKey(ss->ssl3.clientPrivateKey);
            ss->ssl3.clientPrivateKey = NULL;
          }
          goto send_no_certificate;
      }
      break;      /* not an error */

    case SECFailure:
    default:
send_no_certificate:
      if (isTLS) {
          ss->ssl3.sendEmptyCert = PR_TRUE;
      } else {
          (void)SSL3_SendAlert(ss, alert_warning, no_certificate);
      }
      rv = SECSuccess;
      break;
    }
    goto done;

no_mem:
    rv = SECFailure;
    PORT_SetError(SEC_ERROR_NO_MEMORY);
    goto done;

alert_loser:
    if (isTLS && desc == illegal_parameter)
      desc = decode_error;
    (void)SSL3_SendAlert(ss, alert_fatal, desc);
loser:
    PORT_SetError(errCode);
    rv = SECFailure;
done:
    if (arena != NULL)
      PORT_FreeArena(arena, PR_FALSE);
    return rv;
}

/*
 * attempt to restart the handshake after asynchronously handling
 * a request for the client's certificate.
 *
 * inputs:
 *    cert  Client cert chosen by application.
 *          Note: ssl takes this reference, and does not bump the
 *          reference count.  The caller should drop its reference
 *          without calling CERT_DestroyCert after calling this function.
 *
 *    key   Private key associated with cert.  This function makes a
 *          copy of the private key, so the caller remains responsible
 *          for destroying its copy after this function returns.
 *
 *    certChain  DER-encoded certs, client cert and its signers.
 *          Note: ssl takes this reference, and does not copy the chain.
 *          The caller should drop its reference without destroying the
 *          chain.  SSL will free the chain when it is done with it.
 *
 * Return value: XXX
 *
 * XXX This code only works on the initial handshake on a connection, XXX
 *     It does not work on a subsequent handshake (redo).
 *
 * Caller holds 1stHandshakeLock.
 */
SECStatus
ssl3_RestartHandshakeAfterCertReq(sslSocket *         ss,
                        CERTCertificate *    cert,
                        SECKEYPrivateKey *   key,
                        CERTCertificateList *certChain)
{
    SECStatus        rv          = SECSuccess;

    if (MSB(ss->version) == MSB(SSL_LIBRARY_VERSION_3_0)) {
      /* XXX This code only works on the initial handshake on a connection,
      ** XXX It does not work on a subsequent handshake (redo).
      */
      if (ss->handshake != 0) {
          ss->handshake               = ssl_GatherRecord1stHandshake;
          ss->ssl3.clientCertificate = cert;
          ss->ssl3.clientCertChain   = certChain;
          if (key == NULL) {
            (void)SSL3_SendAlert(ss, alert_warning, no_certificate);
            ss->ssl3.clientPrivateKey = NULL;
          } else {
            ss->ssl3.clientPrivateKey = SECKEY_CopyPrivateKey(key);
          }
          ssl_GetRecvBufLock(ss);
          if (ss->ssl3.hs.msgState.buf != NULL) {
            rv = ssl3_HandleRecord(ss, NULL, &ss->gs.buf);
          }
          ssl_ReleaseRecvBufLock(ss);
      }
    }
    return rv;
}



/* Called from ssl3_HandleHandshakeMessage() when it has deciphered a complete
 * ssl3 Server Hello Done message.
 * Caller must hold Handshake and RecvBuf locks.
 */
static SECStatus
ssl3_HandleServerHelloDone(sslSocket *ss)
{
    SECStatus     rv;
    SSL3WaitState ws          = ss->ssl3.hs.ws;
    PRBool        send_verify = PR_FALSE;

    SSL_TRC(3, ("%d: SSL3[%d]: handle server_hello_done handshake",
            SSL_GETPID(), ss->fd));
    PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) );
    PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) );

    if (ws != wait_hello_done  &&
        ws != wait_server_cert &&
      ws != wait_server_key  &&
      ws != wait_cert_request) {
      SSL3_SendAlert(ss, alert_fatal, unexpected_message);
      PORT_SetError(SSL_ERROR_RX_UNEXPECTED_HELLO_DONE);
      return SECFailure;
    }

    ssl_GetXmitBufLock(ss);         /*******************************/

    if (ss->ssl3.sendEmptyCert) {
      ss->ssl3.sendEmptyCert = PR_FALSE;
      rv = ssl3_SendEmptyCertificate(ss);
      /* Don't send verify */
      if (rv != SECSuccess) {
          goto loser;   /* error code is set. */
      }
    } else
    if (ss->ssl3.clientCertChain  != NULL &&
      ss->ssl3.clientPrivateKey != NULL) {
      send_verify = PR_TRUE;
      rv = ssl3_SendCertificate(ss);
      if (rv != SECSuccess) {
          goto loser;   /* error code is set. */
      }
    }

    rv = ssl3_SendClientKeyExchange(ss);
    if (rv != SECSuccess) {
      goto loser; /* err is set. */
    }

    if (send_verify) {
      rv = ssl3_SendCertificateVerify(ss);
      if (rv != SECSuccess) {
          goto loser;   /* err is set. */
        }
    }
    rv = ssl3_SendChangeCipherSpecs(ss);
    if (rv != SECSuccess) {
      goto loser; /* err code was set. */
    }
    rv = ssl3_SendFinished(ss, 0);
    if (rv != SECSuccess) {
      goto loser; /* err code was set. */
    }

    ssl_ReleaseXmitBufLock(ss);           /*******************************/

    if (ssl3_ExtensionNegotiated(ss, session_ticket_xtn))
      ss->ssl3.hs.ws = wait_new_session_ticket;
    else
      ss->ssl3.hs.ws = wait_change_cipher;
    return SECSuccess;

loser:
    ssl_ReleaseXmitBufLock(ss);
    return rv;
}

/*
 * Routines used by servers
 */
static SECStatus
ssl3_SendHelloRequest(sslSocket *ss)
{
    SECStatus rv;

    SSL_TRC(3, ("%d: SSL3[%d]: send hello_request handshake", SSL_GETPID(),
            ss->fd));

    PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) );
    PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss) );

    rv = ssl3_AppendHandshakeHeader(ss, hello_request, 0);
    if (rv != SECSuccess) {
      return rv;  /* err set by AppendHandshake */
    }
    rv = ssl3_FlushHandshake(ss, 0);
    if (rv != SECSuccess) {
      return rv;  /* error code set by ssl3_FlushHandshake */
    }
    ss->ssl3.hs.ws = wait_client_hello;
    return SECSuccess;
}

/* Sets memory error when returning NULL.
 * Called from:
 *    ssl3_SendClientHello()
 *    ssl3_HandleServerHello()
 *    ssl3_HandleClientHello()
 *    ssl3_HandleV2ClientHello()
 */
sslSessionID *
ssl3_NewSessionID(sslSocket *ss, PRBool is_server)
{
    sslSessionID *sid;

    sid = PORT_ZNew(sslSessionID);
    if (sid == NULL)
      return sid;

    sid->peerID         = (ss->peerID == NULL) ? NULL : PORT_Strdup(ss->peerID);
    sid->urlSvrName     = (ss->url    == NULL) ? NULL : PORT_Strdup(ss->url);
    sid->addr           = ss->sec.ci.peer;
    sid->port           = ss->sec.ci.port;
    sid->references     = 1;
    sid->cached         = never_cached;
    sid->version        = ss->version;

    sid->u.ssl3.keys.resumable = PR_TRUE;
    sid->u.ssl3.policy         = SSL_ALLOWED;
    sid->u.ssl3.clientWriteKey = NULL;
    sid->u.ssl3.serverWriteKey = NULL;

    if (is_server) {
      SECStatus rv;
      int       pid = SSL_GETPID();

      sid->u.ssl3.sessionIDLength = SSL3_SESSIONID_BYTES;
      sid->u.ssl3.sessionID[0]    = (pid >> 8) & 0xff;
      sid->u.ssl3.sessionID[1]    =  pid       & 0xff;
      rv = PK11_GenerateRandom(sid->u.ssl3.sessionID + 2,
                               SSL3_SESSIONID_BYTES -2);
      if (rv != SECSuccess) {
          ssl_FreeSID(sid);
          ssl_MapLowLevelError(SSL_ERROR_GENERATE_RANDOM_FAILURE);
          return NULL;
      }
    }
    return sid;
}

/* Called from:  ssl3_HandleClientHello, ssl3_HandleV2ClientHello */
static SECStatus
ssl3_SendServerHelloSequence(sslSocket *ss)
{
    const ssl3KEADef *kea_def;
    SECStatus         rv;

    SSL_TRC(3, ("%d: SSL3[%d]: begin send server_hello sequence",
            SSL_GETPID(), ss->fd));

    PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) );
    PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss) );

    rv = ssl3_SendServerHello(ss);
    if (rv != SECSuccess) {
      return rv;  /* err code is set. */
    }
    rv = ssl3_SendCertificate(ss);
    if (rv != SECSuccess) {
      return rv;  /* error code is set. */
    }
    /* We have to do this after the call to ssl3_SendServerHello,
     * because kea_def is set up by ssl3_SendServerHello().
     */
    kea_def = ss->ssl3.hs.kea_def;
    ss->ssl3.hs.usedStepDownKey = PR_FALSE;

    if (kea_def->is_limited && kea_def->exchKeyType == kt_rsa) {
      /* see if we can legally use the key in the cert. */
      int keyLen;  /* bytes */

      keyLen = PK11_GetPrivateModulusLen(
                      ss->serverCerts[kea_def->exchKeyType].SERVERKEY);

      if (keyLen > 0 &&
          keyLen * BPB <= kea_def->key_size_limit ) {
          /* XXX AND cert is not signing only!! */
          /* just fall through and use it. */
      } else if (ss->stepDownKeyPair != NULL) {
          ss->ssl3.hs.usedStepDownKey = PR_TRUE;
          rv = ssl3_SendServerKeyExchange(ss);
          if (rv != SECSuccess) {
            return rv;  /* err code was set. */
          }
      } else {
#ifndef HACKED_EXPORT_SERVER
          PORT_SetError(SSL_ERROR_PUB_KEY_SIZE_LIMIT_EXCEEDED);
          return rv;
#endif
      }
#ifdef NSS_ENABLE_ECC
    } else if ((kea_def->kea == kea_ecdhe_rsa) ||
             (kea_def->kea == kea_ecdhe_ecdsa)) {
      rv = ssl3_SendServerKeyExchange(ss);
      if (rv != SECSuccess) {
          return rv;    /* err code was set. */
      }
#endif /* NSS_ENABLE_ECC */
    }

    if (ss->opt.requestCertificate) {
      rv = ssl3_SendCertificateRequest(ss);
      if (rv != SECSuccess) {
          return rv;          /* err code is set. */
      }
    }
    rv = ssl3_SendServerHelloDone(ss);
    if (rv != SECSuccess) {
      return rv;        /* err code is set. */
    }

    ss->ssl3.hs.ws = (ss->opt.requestCertificate) ? wait_client_cert
                                               : wait_client_key;
    return SECSuccess;
}

/* Called from ssl3_HandleHandshakeMessage() when it has deciphered a complete
 * ssl3 Client Hello message.
 * Caller must hold Handshake and RecvBuf locks.
 */
static SECStatus
ssl3_HandleClientHello(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
{
    sslSessionID *      sid      = NULL;
    PRInt32       tmp;
    unsigned int        i;
    int                 j;
    SECStatus           rv;
    int                 errCode  = SSL_ERROR_RX_MALFORMED_CLIENT_HELLO;
    SSL3AlertDescription desc    = illegal_parameter;
    SSL3ProtocolVersion version;
    SECItem             sidBytes = {siBuffer, NULL, 0};
    SECItem             suites   = {siBuffer, NULL, 0};
    SECItem             comps    = {siBuffer, NULL, 0};
    PRBool              haveSpecWriteLock = PR_FALSE;
    PRBool              haveXmitBufLock   = PR_FALSE;

    SSL_TRC(3, ("%d: SSL3[%d]: handle client_hello handshake",
      SSL_GETPID(), ss->fd));

    PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) );
    PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss));

    /* Get peer name of client */
    rv = ssl_GetPeerInfo(ss);
    if (rv != SECSuccess) {
      return rv;        /* error code is set. */
    }

    /* We might be starting session renegotiation in which case we should
     * clear previous state.
     */
    PORT_Memset(&ss->xtnData, 0, sizeof(TLSExtensionData));
    ss->statelessResume = PR_FALSE;

    rv = ssl3_InitState(ss);
    if (rv != SECSuccess) {
      return rv;        /* ssl3_InitState has set the error code. */
    }

    if ((ss->ssl3.hs.ws != wait_client_hello) &&
      (ss->ssl3.hs.ws != idle_handshake)) {
      desc    = unexpected_message;
      errCode = SSL_ERROR_RX_UNEXPECTED_CLIENT_HELLO;
      goto alert_loser;
    }

    tmp = ssl3_ConsumeHandshakeNumber(ss, 2, &b, &length);
    if (tmp < 0)
      goto loser;       /* malformed, alert already sent */
    ss->clientHelloVersion = version = (SSL3ProtocolVersion)tmp;
    rv = ssl3_NegotiateVersion(ss, version);
    if (rv != SECSuccess) {
      desc = (version > SSL_LIBRARY_VERSION_3_0) ? protocol_version : handshake_failure;
      errCode = SSL_ERROR_NO_CYPHER_OVERLAP;
      goto alert_loser;
    }

    /* grab the client random data. */
    rv = ssl3_ConsumeHandshake(
      ss, &ss->ssl3.hs.client_random, SSL3_RANDOM_LENGTH, &b, &length);
    if (rv != SECSuccess) {
      goto loser;       /* malformed */
    }

    /* grab the client's SID, if present. */
    rv = ssl3_ConsumeHandshakeVariable(ss, &sidBytes, 1, &b, &length);
    if (rv != SECSuccess) {
      goto loser;       /* malformed */
    }

    /* grab the list of cipher suites. */
    rv = ssl3_ConsumeHandshakeVariable(ss, &suites, 2, &b, &length);
    if (rv != SECSuccess) {
      goto loser;       /* malformed */
    }

    /* grab the list of compression methods. */
    rv = ssl3_ConsumeHandshakeVariable(ss, &comps, 1, &b, &length);
    if (rv != SECSuccess) {
      goto loser;       /* malformed */
    }

    desc = handshake_failure;

    /* Handle TLS hello extensions for SSL3 & TLS. We do not know if
     * we are restarting a previous session until extensions have been
     * parsed, since we might have received a SessionTicket extension.
     * Note: we allow extensions even when negotiating SSL3 for the sake
     * of interoperability (and backwards compatibility).
     */

    if (length) {
      /* Get length of hello extensions */
      PRInt32 extension_length;
      extension_length = ssl3_ConsumeHandshakeNumber(ss, 2, &b, &length);
      if (extension_length < 0) {
          goto loser;                     /* alert already sent */
      }
      if (extension_length != length) {
          ssl3_DecodeError(ss);           /* send alert */
          goto loser;
      }
      rv = ssl3_HandleHelloExtensions(ss, &b, &length);
      if (rv != SECSuccess) {
          goto loser;         /* malformed */
      }
    }

    /* We do stateful resumes only if either of the following
     * conditions are satisfied: (1) the client does not support the
     * session ticket extension, or (2) the client support the session
     * ticket extension, but sent an empty ticket.
     */
    if (!ssl3_ExtensionNegotiated(ss, session_ticket_xtn) ||
      ss->xtnData.emptySessionTicket) {
      if (sidBytes.len > 0 && !ss->opt.noCache) {
          SSL_TRC(7, ("%d: SSL3[%d]: server, lookup client session-id for 0x%08x%08x%08x%08x",
                  SSL_GETPID(), ss->fd, ss->sec.ci.peer.pr_s6_addr32[0],
                  ss->sec.ci.peer.pr_s6_addr32[1], 
                  ss->sec.ci.peer.pr_s6_addr32[2],
                  ss->sec.ci.peer.pr_s6_addr32[3]));
          if (ssl_sid_lookup) {
            sid = (*ssl_sid_lookup)(&ss->sec.ci.peer, sidBytes.data, 
                              sidBytes.len, ss->dbHandle);
          } else {
            errCode = SSL_ERROR_SERVER_CACHE_NOT_CONFIGURED;
            goto loser;
          }
      }
    } else if (ss->statelessResume) {
      /* Fill in the client's session ID if doing a stateless resume.
       * (When doing stateless resumes, server echos client's SessionID.)
       */
      sid = ss->sec.ci.sid;
      PORT_Assert(sid != NULL);  /* Should have already been filled in.*/

      if (sidBytes.len > 0 && sidBytes.len <= SSL3_SESSIONID_BYTES) {
          sid->u.ssl3.sessionIDLength = sidBytes.len;
          PORT_Memcpy(sid->u.ssl3.sessionID, sidBytes.data,
            sidBytes.len);
          sid->u.ssl3.sessionIDLength = sidBytes.len;
      } else {
          sid->u.ssl3.sessionIDLength = 0;
      }
      ss->sec.ci.sid = NULL;
    }

    /* We only send a session ticket extension if the client supports
     * the extension and we are unable to do either a stateful or
     * stateless resume.
     *
     * TODO: send a session ticket if performing a stateful
     * resumption.  (As per RFC4507, a server may issue a session
     * ticket while doing a (stateless or stateful) session resume,
     * but OpenSSL-0.9.8g does not accept session tickets while
     * resuming.)
     */
    if (ssl3_ExtensionNegotiated(ss, session_ticket_xtn) && sid == NULL) {
      ssl3_RegisterServerHelloExtensionSender(ss,
          session_ticket_xtn, ssl3_SendSessionTicketXtn);
    }

    if (sid != NULL) {
      /* We've found a session cache entry for this client.
       * Now, if we're going to require a client-auth cert,
       * and we don't already have this client's cert in the session cache,
       * and this is the first handshake on this connection (not a redo),
       * then drop this old cache entry and start a new session.
       */
      if ((sid->peerCert == NULL) && ss->opt.requestCertificate &&
          ((ss->opt.requireCertificate == SSL_REQUIRE_ALWAYS) ||
           (ss->opt.requireCertificate == SSL_REQUIRE_NO_ERROR) ||
           ((ss->opt.requireCertificate == SSL_REQUIRE_FIRST_HANDSHAKE) 
            && !ss->firstHsDone))) {

          SSL_AtomicIncrementLong(& ssl3stats.hch_sid_cache_not_ok );
          ss->sec.uncache(sid);
          ssl_FreeSID(sid);
          sid = NULL;
      }
    }

#ifdef NSS_ENABLE_ECC
    /* Disable any ECC cipher suites for which we have no cert. */
    ssl3_FilterECCipherSuitesByServerCerts(ss);
#endif

#ifdef PARANOID
    /* Look for a matching cipher suite. */
    j = ssl3_config_match_init(ss);
    if (j <= 0) {       /* no ciphers are working/supported by PK11 */
      errCode = PORT_GetError();    /* error code is already set. */
      goto alert_loser;
    }
#endif

    /* If we already have a session for this client, be sure to pick the
    ** same cipher suite we picked before.
    ** This is not a loop, despite appearances.
    */
    if (sid) do {
      ssl3CipherSuiteCfg *suite = ss->cipherSuites;
      /* Find the entry for the cipher suite used in the cached session. */
      for (j = ssl_V3_SUITES_IMPLEMENTED; j > 0; --j, ++suite) {
          if (suite->cipher_suite == sid->u.ssl3.cipherSuite)
            break;
      }
      PORT_Assert(j > 0);
      if (j <= 0)
          break;
#ifdef PARANOID
      /* Double check that the cached cipher suite is still enabled,
       * implemented, and allowed by policy.  Might have been disabled.
       * The product policy won't change during the process lifetime.  
       * Implemented ("isPresent") shouldn't change for servers.
       */
      if (!config_match(suite, ss->ssl3.policy, PR_TRUE))
          break;
#else
      if (!suite->enabled)
          break;
#endif
      /* Double check that the cached cipher suite is in the client's list */
      for (i = 0; i < suites.len; i += 2) {
          if ((suites.data[i]     == MSB(suite->cipher_suite)) &&
              (suites.data[i + 1] == LSB(suite->cipher_suite))) {

            ss->ssl3.hs.cipher_suite = suite->cipher_suite;
            ss->ssl3.hs.suite_def =
                ssl_LookupCipherSuiteDef(ss->ssl3.hs.cipher_suite);
            goto suite_found;
          }
      }
    } while (0);

    /* START A NEW SESSION */

#ifndef PARANOID
    /* Look for a matching cipher suite. */
    j = ssl3_config_match_init(ss);
    if (j <= 0) {       /* no ciphers are working/supported by PK11 */
      errCode = PORT_GetError();    /* error code is already set. */
      goto alert_loser;
    }
#endif

    /* Select a cipher suite.
    ** NOTE: This suite selection algorithm should be the same as the one in
    ** ssl3_HandleV2ClientHello().  
    */
    for (j = 0; j < ssl_V3_SUITES_IMPLEMENTED; j++) {
      ssl3CipherSuiteCfg *suite = &ss->cipherSuites[j];
      if (!config_match(suite, ss->ssl3.policy, PR_TRUE))
          continue;
      for (i = 0; i < suites.len; i += 2) {
          if ((suites.data[i]     == MSB(suite->cipher_suite)) &&
              (suites.data[i + 1] == LSB(suite->cipher_suite))) {

            ss->ssl3.hs.cipher_suite = suite->cipher_suite;
            ss->ssl3.hs.suite_def =
                ssl_LookupCipherSuiteDef(ss->ssl3.hs.cipher_suite);
            goto suite_found;
          }
      }
    }
    errCode = SSL_ERROR_NO_CYPHER_OVERLAP;
    goto alert_loser;

suite_found:
    /* Look for a matching compression algorithm. */
    for (i = 0; i < comps.len; i++) {
      for (j = 0; j < compressionMethodsCount; j++) {
          if (comps.data[i] == compressions[j]) {
            ss->ssl3.hs.compression = 
                              (SSL3CompressionMethod)compressions[j];
            goto compression_found;
          }
      }
    }
    errCode = SSL_ERROR_NO_COMPRESSION_OVERLAP;
                        /* null compression must be supported */
    goto alert_loser;

compression_found:
    suites.data = NULL;
    comps.data = NULL;

    ss->sec.send = ssl3_SendApplicationData;

    /* If there are any failures while processing the old sid,
     * we don't consider them to be errors.  Instead, We just behave
     * as if the client had sent us no sid to begin with, and make a new one.
     */
    if (sid != NULL) do {
      ssl3CipherSpec *pwSpec;
      SECItem         wrappedMS;    /* wrapped key */

      if (sid->version != ss->version  ||
          sid->u.ssl3.cipherSuite != ss->ssl3.hs.cipher_suite) {
          break;  /* not an error */
      }

      if (ss->sec.ci.sid) {
          ss->sec.uncache(ss->sec.ci.sid);
          PORT_Assert(ss->sec.ci.sid != sid);  /* should be impossible, but ... */
          if (ss->sec.ci.sid != sid) {
            ssl_FreeSID(ss->sec.ci.sid);
          }
          ss->sec.ci.sid = NULL;
      }
      /* we need to resurrect the master secret.... */

      ssl_GetSpecWriteLock(ss);  haveSpecWriteLock = PR_TRUE;
      pwSpec = ss->ssl3.pwSpec;
      if (sid->u.ssl3.keys.msIsWrapped) {
          PK11SymKey *    wrapKey;  /* wrapping key */
          CK_FLAGS        keyFlags      = 0;
          if (ss->opt.bypassPKCS11) {
            /* we cannot restart a non-bypass session in a 
            ** bypass socket.
            */
            break;  
          }

          wrapKey = getWrappingKey(ss, NULL, sid->u.ssl3.exchKeyType,
                             sid->u.ssl3.masterWrapMech, 
                             ss->pkcs11PinArg);
          if (!wrapKey) {
            /* we have a SID cache entry, but no wrapping key for it??? */
            break;
          }

          if (ss->version > SSL_LIBRARY_VERSION_3_0) {      /* isTLS */
            keyFlags = CKF_SIGN | CKF_VERIFY;
          }

          wrappedMS.data = sid->u.ssl3.keys.wrapped_master_secret;
          wrappedMS.len  = sid->u.ssl3.keys.wrapped_master_secret_len;

          /* unwrap the master secret. */
          pwSpec->master_secret =
            PK11_UnwrapSymKeyWithFlags(wrapKey, sid->u.ssl3.masterWrapMech, 
                      NULL, &wrappedMS, CKM_SSL3_MASTER_KEY_DERIVE,
                      CKA_DERIVE, sizeof(SSL3MasterSecret), keyFlags);
          PK11_FreeSymKey(wrapKey);
          if (pwSpec->master_secret == NULL) {
            break;      /* not an error */
          }
      } else if (ss->opt.bypassPKCS11) {
          wrappedMS.data = sid->u.ssl3.keys.wrapped_master_secret;
          wrappedMS.len  = sid->u.ssl3.keys.wrapped_master_secret_len;
          memcpy(pwSpec->raw_master_secret, wrappedMS.data, wrappedMS.len);
          pwSpec->msItem.data = pwSpec->raw_master_secret;
          pwSpec->msItem.len  = wrappedMS.len;
      } else {
          /* We CAN restart a bypass session in a non-bypass socket. */
          /* need to import the raw master secret to session object */
          PK11SlotInfo * slot;
          wrappedMS.data = sid->u.ssl3.keys.wrapped_master_secret;
          wrappedMS.len  = sid->u.ssl3.keys.wrapped_master_secret_len;
          slot = PK11_GetInternalSlot();
          pwSpec->master_secret =  
            PK11_ImportSymKey(slot, CKM_SSL3_MASTER_KEY_DERIVE, 
                          PK11_OriginUnwrap, CKA_ENCRYPT, &wrappedMS, 
                          NULL);
          PK11_FreeSlot(slot);
          if (pwSpec->master_secret == NULL) {
            break;      /* not an error */
          }
      }
      ss->sec.ci.sid = sid;
      if (sid->peerCert != NULL) {
          ss->sec.peerCert = CERT_DupCertificate(sid->peerCert);
      }

      /*
       * Old SID passed all tests, so resume this old session.
       *
       * XXX make sure compression still matches
       */
      SSL_AtomicIncrementLong(& ssl3stats.hch_sid_cache_hits );
      if (ss->statelessResume)
          SSL_AtomicIncrementLong(& ssl3stats.hch_sid_stateless_resumes );
      ss->ssl3.hs.isResuming = PR_TRUE;

        ss->sec.authAlgorithm = sid->authAlgorithm;
      ss->sec.authKeyBits   = sid->authKeyBits;
      ss->sec.keaType       = sid->keaType;
      ss->sec.keaKeyBits    = sid->keaKeyBits;

      /* server sids don't remember the server cert we previously sent,
      ** but they do remember the kea type we originally used, so we
      ** can locate it again, provided that the current ssl socket
      ** has had its server certs configured the same as the previous one.
      */
      ss->sec.localCert     = 
            CERT_DupCertificate(ss->serverCerts[sid->keaType].serverCert);

      ssl_GetXmitBufLock(ss); haveXmitBufLock = PR_TRUE;

      rv = ssl3_SendServerHello(ss);
      if (rv != SECSuccess) {
          errCode = PORT_GetError();
          goto loser;
      }

      if (haveSpecWriteLock) {
          ssl_ReleaseSpecWriteLock(ss);
          haveSpecWriteLock = PR_FALSE;
      }

      /* NULL value for PMS signifies re-use of the old MS */
      rv = ssl3_InitPendingCipherSpec(ss,  NULL);
      if (rv != SECSuccess) {
          errCode = PORT_GetError();
          goto loser;
      }

      rv = ssl3_SendChangeCipherSpecs(ss);
      if (rv != SECSuccess) {
          errCode = PORT_GetError();
          goto loser;
      }
      rv = ssl3_SendFinished(ss, 0);
      ss->ssl3.hs.ws = wait_change_cipher;
      if (rv != SECSuccess) {
          errCode = PORT_GetError();
          goto loser;
      }

      if (haveXmitBufLock) {
          ssl_ReleaseXmitBufLock(ss);
          haveXmitBufLock = PR_FALSE;
      }

        return SECSuccess;
    } while (0);

    if (haveSpecWriteLock) {
      ssl_ReleaseSpecWriteLock(ss);
      haveSpecWriteLock = PR_FALSE;
    }

    if (sid) {    /* we had a sid, but it's no longer valid, free it */
      SSL_AtomicIncrementLong(& ssl3stats.hch_sid_cache_not_ok );
      ss->sec.uncache(sid);
      ssl_FreeSID(sid);
      sid = NULL;
    }
    SSL_AtomicIncrementLong(& ssl3stats.hch_sid_cache_misses );

    sid = ssl3_NewSessionID(ss, PR_TRUE);
    if (sid == NULL) {
      errCode = PORT_GetError();
      goto loser; /* memory error is set. */
    }
    ss->sec.ci.sid = sid;

    ss->ssl3.hs.isResuming = PR_FALSE;
    ssl_GetXmitBufLock(ss);
    rv = ssl3_SendServerHelloSequence(ss);
    ssl_ReleaseXmitBufLock(ss);
    if (rv != SECSuccess) {
      errCode = PORT_GetError();
      goto loser;
    }

    if (haveXmitBufLock) {
      ssl_ReleaseXmitBufLock(ss);
      haveXmitBufLock = PR_FALSE;
    }

    return SECSuccess;

alert_loser:
    if (haveSpecWriteLock) {
      ssl_ReleaseSpecWriteLock(ss);
      haveSpecWriteLock = PR_FALSE;
    }
    (void)SSL3_SendAlert(ss, alert_fatal, desc);
    /* FALLTHRU */
loser:
    if (haveSpecWriteLock) {
      ssl_ReleaseSpecWriteLock(ss);
      haveSpecWriteLock = PR_FALSE;
    }

    if (haveXmitBufLock) {
      ssl_ReleaseXmitBufLock(ss);
      haveXmitBufLock = PR_FALSE;
    }

    PORT_SetError(errCode);
    return SECFailure;
}

/*
 * ssl3_HandleV2ClientHello is used when a V2 formatted hello comes
 * in asking to use the V3 handshake.
 * Called from ssl2_HandleClientHelloMessage() in sslcon.c
 */
SECStatus
ssl3_HandleV2ClientHello(sslSocket *ss, unsigned char *buffer, int length)
{
    sslSessionID *      sid         = NULL;
    unsigned char *     suites;
    unsigned char *     random;
    SSL3ProtocolVersion version;
    SECStatus           rv;
    int                 i;
    int                 j;
    int                 sid_length;
    int                 suite_length;
    int                 rand_length;
    int                 errCode  = SSL_ERROR_RX_MALFORMED_CLIENT_HELLO;
    SSL3AlertDescription desc    = handshake_failure;

    SSL_TRC(3, ("%d: SSL3[%d]: handle v2 client_hello", SSL_GETPID(), ss->fd));

    PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) );

    ssl_GetSSL3HandshakeLock(ss);

    PORT_Memset(&ss->xtnData, 0, sizeof(TLSExtensionData));

    rv = ssl3_InitState(ss);
    if (rv != SECSuccess) {
      ssl_ReleaseSSL3HandshakeLock(ss);
      return rv;        /* ssl3_InitState has set the error code. */
    }

    if (ss->ssl3.hs.ws != wait_client_hello) {
      desc    = unexpected_message;
      errCode = SSL_ERROR_RX_UNEXPECTED_CLIENT_HELLO;
      goto loser; /* alert_loser */
    }

    version      = (buffer[1] << 8) | buffer[2];
    suite_length = (buffer[3] << 8) | buffer[4];
    sid_length   = (buffer[5] << 8) | buffer[6];
    rand_length  = (buffer[7] << 8) | buffer[8];
    ss->clientHelloVersion = version;

    rv = ssl3_NegotiateVersion(ss, version);
    if (rv != SECSuccess) {
      /* send back which ever alert client will understand. */
      desc = (version > SSL_LIBRARY_VERSION_3_0) ? protocol_version : handshake_failure;
      errCode = SSL_ERROR_NO_CYPHER_OVERLAP;
      goto alert_loser;
    }

    /* if we get a non-zero SID, just ignore it. */
    if (length !=
        SSL_HL_CLIENT_HELLO_HBYTES + suite_length + sid_length + rand_length) {
      SSL_DBG(("%d: SSL3[%d]: bad v2 client hello message, len=%d should=%d",
             SSL_GETPID(), ss->fd, length,
             SSL_HL_CLIENT_HELLO_HBYTES + suite_length + sid_length +
             rand_length));
      goto loser; /* malformed */   /* alert_loser */
    }

    suites = buffer + SSL_HL_CLIENT_HELLO_HBYTES;
    random = suites + suite_length + sid_length;

    if (rand_length < SSL_MIN_CHALLENGE_BYTES ||
      rand_length > SSL_MAX_CHALLENGE_BYTES) {
      goto loser; /* malformed */   /* alert_loser */
    }

    PORT_Assert(SSL_MAX_CHALLENGE_BYTES == SSL3_RANDOM_LENGTH);

    PORT_Memset(&ss->ssl3.hs.client_random, 0, SSL3_RANDOM_LENGTH);
    PORT_Memcpy(
      &ss->ssl3.hs.client_random.rand[SSL3_RANDOM_LENGTH - rand_length],
      random, rand_length);

    PRINT_BUF(60, (ss, "client random:", &ss->ssl3.hs.client_random.rand[0],
               SSL3_RANDOM_LENGTH));
#ifdef NSS_ENABLE_ECC
    /* Disable any ECC cipher suites for which we have no cert. */
    ssl3_FilterECCipherSuitesByServerCerts(ss);
#endif
    i = ssl3_config_match_init(ss);
    if (i <= 0) {
      errCode = PORT_GetError();    /* error code is already set. */
      goto alert_loser;
    }

    /* Select a cipher suite.
    ** NOTE: This suite selection algorithm should be the same as the one in
    ** ssl3_HandleClientHello().  
    */
    for (j = 0; j < ssl_V3_SUITES_IMPLEMENTED; j++) {
      ssl3CipherSuiteCfg *suite = &ss->cipherSuites[j];
      if (!config_match(suite, ss->ssl3.policy, PR_TRUE))
          continue;
      for (i = 0; i < suite_length; i += 3) {
          if ((suites[i]   == 0) &&
            (suites[i+1] == MSB(suite->cipher_suite)) &&
            (suites[i+2] == LSB(suite->cipher_suite))) {

            ss->ssl3.hs.cipher_suite = suite->cipher_suite;
            ss->ssl3.hs.suite_def =
                ssl_LookupCipherSuiteDef(ss->ssl3.hs.cipher_suite);
            goto suite_found;
          }
      }
    }
    errCode = SSL_ERROR_NO_CYPHER_OVERLAP;
    goto alert_loser;

suite_found:

    ss->ssl3.hs.compression = compression_null;
    ss->sec.send            = ssl3_SendApplicationData;

    /* we don't even search for a cache hit here.  It's just a miss. */
    SSL_AtomicIncrementLong(& ssl3stats.hch_sid_cache_misses );
    sid = ssl3_NewSessionID(ss, PR_TRUE);
    if (sid == NULL) {
      errCode = PORT_GetError();
      goto loser; /* memory error is set. */
    }
    ss->sec.ci.sid = sid;
    /* do not worry about memory leak of sid since it now belongs to ci */

    /* We have to update the handshake hashes before we can send stuff */
    rv = ssl3_UpdateHandshakeHashes(ss, buffer, length);
    if (rv != SECSuccess) {
      errCode = PORT_GetError();
      goto loser;
    }

    ssl_GetXmitBufLock(ss);
    rv = ssl3_SendServerHelloSequence(ss);
    ssl_ReleaseXmitBufLock(ss);
    if (rv != SECSuccess) {
      errCode = PORT_GetError();
      goto loser;
    }

    /* XXX_1      The call stack to here is:
     * ssl_Do1stHandshake -> ssl2_HandleClientHelloMessage -> here.
     * ssl2_HandleClientHelloMessage returns whatever we return here.
     * ssl_Do1stHandshake will continue looping if it gets back either
     *            SECSuccess or SECWouldBlock.
     * SECSuccess is preferable here.  See XXX_1 in sslgathr.c.
     */
    ssl_ReleaseSSL3HandshakeLock(ss);
    return SECSuccess;

alert_loser:
    SSL3_SendAlert(ss, alert_fatal, desc);
loser:
    ssl_ReleaseSSL3HandshakeLock(ss);
    PORT_SetError(errCode);
    return SECFailure;
}

/* The negotiated version number has been already placed in ss->version.
**
** Called from:  ssl3_HandleClientHello                     (resuming session),
**    ssl3_SendServerHelloSequence <- ssl3_HandleClientHello   (new session),
**    ssl3_SendServerHelloSequence <- ssl3_HandleV2ClientHello (new session)
*/
static SECStatus
ssl3_SendServerHello(sslSocket *ss)
{
    sslSessionID *sid;
    SECStatus     rv;
    PRUint32      maxBytes = 65535;
    PRUint32      length;
    PRInt32       extensions_len = 0;

    SSL_TRC(3, ("%d: SSL3[%d]: send server_hello handshake", SSL_GETPID(),
            ss->fd));

    PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss));
    PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss));
    PORT_Assert( MSB(ss->version) == MSB(SSL_LIBRARY_VERSION_3_0));

    if (MSB(ss->version) != MSB(SSL_LIBRARY_VERSION_3_0)) {
      PORT_SetError(SSL_ERROR_NO_CYPHER_OVERLAP);
      return SECFailure;
    }

    sid = ss->sec.ci.sid;

    extensions_len = ssl3_CallHelloExtensionSenders(ss, PR_FALSE, maxBytes,
                                     &ss->xtnData.serverSenders[0]);
    if (extensions_len > 0)
      extensions_len += 2; /* Add sizeof total extension length */

    length = sizeof(SSL3ProtocolVersion) + SSL3_RANDOM_LENGTH + 1 +
             ((sid == NULL) ? 0: sid->u.ssl3.sessionIDLength) +
           sizeof(ssl3CipherSuite) + 1 + extensions_len;
    rv = ssl3_AppendHandshakeHeader(ss, server_hello, length);
    if (rv != SECSuccess) {
      return rv;  /* err set by AppendHandshake. */
    }

    rv = ssl3_AppendHandshakeNumber(ss, ss->version, 2);
    if (rv != SECSuccess) {
      return rv;  /* err set by AppendHandshake. */
    }
    rv = ssl3_GetNewRandom(&ss->ssl3.hs.server_random);
    if (rv != SECSuccess) {
      ssl_MapLowLevelError(SSL_ERROR_GENERATE_RANDOM_FAILURE);
      return rv;
    }
    rv = ssl3_AppendHandshake(
      ss, &ss->ssl3.hs.server_random, SSL3_RANDOM_LENGTH);
    if (rv != SECSuccess) {
      return rv;  /* err set by AppendHandshake. */
    }

    if (sid)
      rv = ssl3_AppendHandshakeVariable(
          ss, sid->u.ssl3.sessionID, sid->u.ssl3.sessionIDLength, 1);
    else
      rv = ssl3_AppendHandshakeVariable(ss, NULL, 0, 1);
    if (rv != SECSuccess) {
      return rv;  /* err set by AppendHandshake. */
    }

    rv = ssl3_AppendHandshakeNumber(ss, ss->ssl3.hs.cipher_suite, 2);
    if (rv != SECSuccess) {
      return rv;  /* err set by AppendHandshake. */
    }
    rv = ssl3_AppendHandshakeNumber(ss, ss->ssl3.hs.compression, 1);
    if (rv != SECSuccess) {
      return rv;  /* err set by AppendHandshake. */
    }
    if (extensions_len) {
      PRInt32 sent_len;

      extensions_len -= 2;
      rv = ssl3_AppendHandshakeNumber(ss, extensions_len, 2);
      if (rv != SECSuccess) 
          return rv;    /* err set by ssl3_SetupPendingCipherSpec */
      sent_len = ssl3_CallHelloExtensionSenders(ss, PR_TRUE, extensions_len,
                                 &ss->xtnData.serverSenders[0]);
        PORT_Assert(sent_len == extensions_len);
      if (sent_len != extensions_len) {
          if (sent_len >= 0)
            PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
          return SECFailure;
      }
    }
    rv = ssl3_SetupPendingCipherSpec(ss);
    if (rv != SECSuccess) {
      return rv;  /* err set by ssl3_SetupPendingCipherSpec */
    }

    return SECSuccess;
}


static SECStatus
ssl3_SendServerKeyExchange(sslSocket *ss)
{
const ssl3KEADef *     kea_def     = ss->ssl3.hs.kea_def;
    SECStatus          rv          = SECFailure;
    int                length;
    PRBool             isTLS;
    SECItem            signed_hash = {siBuffer, NULL, 0};
    SSL3Hashes         hashes;
    SECKEYPublicKey *  sdPub; /* public key for step-down */

    SSL_TRC(3, ("%d: SSL3[%d]: send server_key_exchange handshake",
            SSL_GETPID(), ss->fd));

    PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss));
    PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss));

    switch (kea_def->exchKeyType) {
    case kt_rsa:
      /* Perform SSL Step-Down here. */
      sdPub = ss->stepDownKeyPair->pubKey;
      PORT_Assert(sdPub != NULL);
      if (!sdPub) {
          PORT_SetError(SSL_ERROR_SERVER_KEY_EXCHANGE_FAILURE);
          return SECFailure;
      }
      rv = ssl3_ComputeExportRSAKeyHash(sdPub->u.rsa.modulus,
                                sdPub->u.rsa.publicExponent,
                                        &ss->ssl3.hs.client_random,
                                        &ss->ssl3.hs.server_random,
                                &hashes, ss->opt.bypassPKCS11);
        if (rv != SECSuccess) {
          ssl_MapLowLevelError(SSL_ERROR_SERVER_KEY_EXCHANGE_FAILURE);
          return rv;
      }

      isTLS = (PRBool)(ss->ssl3.pwSpec->version > SSL_LIBRARY_VERSION_3_0);
      rv = ssl3_SignHashes(&hashes, ss->serverCerts[kt_rsa].SERVERKEY, 
                           &signed_hash, isTLS);
        if (rv != SECSuccess) {
          goto loser;         /* ssl3_SignHashes has set err. */
      }
      if (signed_hash.data == NULL) {
          /* how can this happen and rv == SECSuccess ?? */
          PORT_SetError(SSL_ERROR_SERVER_KEY_EXCHANGE_FAILURE);
          goto loser;
      }
      length = 2 + sdPub->u.rsa.modulus.len +
               2 + sdPub->u.rsa.publicExponent.len +
               2 + signed_hash.len;

      rv = ssl3_AppendHandshakeHeader(ss, server_key_exchange, length);
      if (rv != SECSuccess) {
          goto loser;   /* err set by AppendHandshake. */
      }

      rv = ssl3_AppendHandshakeVariable(ss, sdPub->u.rsa.modulus.data,
                                sdPub->u.rsa.modulus.len, 2);
      if (rv != SECSuccess) {
          goto loser;   /* err set by AppendHandshake. */
      }

      rv = ssl3_AppendHandshakeVariable(
                        ss, sdPub->u.rsa.publicExponent.data,
                        sdPub->u.rsa.publicExponent.len, 2);
      if (rv != SECSuccess) {
          goto loser;   /* err set by AppendHandshake. */
      }

      rv = ssl3_AppendHandshakeVariable(ss, signed_hash.data,
                                        signed_hash.len, 2);
      if (rv != SECSuccess) {
          goto loser;   /* err set by AppendHandshake. */
      }
      PORT_Free(signed_hash.data);
      return SECSuccess;

#ifdef NSS_ENABLE_ECC
    case kt_ecdh: {
      rv = ssl3_SendECDHServerKeyExchange(ss);
      return rv;
    }
#endif /* NSS_ENABLE_ECC */

    case kt_dh:
    case kt_null:
    default:
      PORT_SetError(SEC_ERROR_UNSUPPORTED_KEYALG);
      break;
    }
loser:
    if (signed_hash.data != NULL) 
      PORT_Free(signed_hash.data);
    return SECFailure;
}


static SECStatus
ssl3_SendCertificateRequest(sslSocket *ss)
{
    SECItem *      name;
    CERTDistNames *ca_list;
const uint8 *      certTypes;
    SECItem *      names      = NULL;
    SECStatus      rv;
    int            length;
    int            i;
    int            calen      = 0;
    int            nnames     = 0;
    int            certTypesLength;

    SSL_TRC(3, ("%d: SSL3[%d]: send certificate_request handshake",
            SSL_GETPID(), ss->fd));

    PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss));
    PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss));

    /* ssl3.ca_list is initialized to NULL, and never changed. */
    ca_list = ss->ssl3.ca_list;
    if (!ca_list) {
      ca_list = ssl3_server_ca_list;
    }

    if (ca_list != NULL) {
      names = ca_list->names;
      nnames = ca_list->nnames;
    }

    if (!nnames) {
      PORT_SetError(SSL_ERROR_NO_TRUSTED_SSL_CLIENT_CA);
      return SECFailure;
    }

    for (i = 0, name = names; i < nnames; i++, name++) {
      calen += 2 + name->len;
    }

    certTypes       = certificate_types;
    certTypesLength = sizeof certificate_types;

    length = 1 + certTypesLength + 2 + calen;

    rv = ssl3_AppendHandshakeHeader(ss, certificate_request, length);
    if (rv != SECSuccess) {
      return rv;        /* err set by AppendHandshake. */
    }
    rv = ssl3_AppendHandshakeVariable(ss, certTypes, certTypesLength, 1);
    if (rv != SECSuccess) {
      return rv;        /* err set by AppendHandshake. */
    }
    rv = ssl3_AppendHandshakeNumber(ss, calen, 2);
    if (rv != SECSuccess) {
      return rv;        /* err set by AppendHandshake. */
    }
    for (i = 0, name = names; i < nnames; i++, name++) {
      rv = ssl3_AppendHandshakeVariable(ss, name->data, name->len, 2);
      if (rv != SECSuccess) {
          return rv;          /* err set by AppendHandshake. */
      }
    }

    return SECSuccess;
}

static SECStatus
ssl3_SendServerHelloDone(sslSocket *ss)
{
    SECStatus rv;

    SSL_TRC(3, ("%d: SSL3[%d]: send server_hello_done handshake",
            SSL_GETPID(), ss->fd));

    PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss));
    PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss));

    rv = ssl3_AppendHandshakeHeader(ss, server_hello_done, 0);
    if (rv != SECSuccess) {
      return rv;        /* err set by AppendHandshake. */
    }
    rv = ssl3_FlushHandshake(ss, 0);
    if (rv != SECSuccess) {
      return rv;  /* error code set by ssl3_FlushHandshake */
    }
    return SECSuccess;
}

/* Called from ssl3_HandleHandshakeMessage() when it has deciphered a complete
 * ssl3 Certificate Verify message
 * Caller must hold Handshake and RecvBuf locks.
 */
static SECStatus
ssl3_HandleCertificateVerify(sslSocket *ss, SSL3Opaque *b, PRUint32 length,
                       SSL3Hashes *hashes)
{
    SECItem              signed_hash = {siBuffer, NULL, 0};
    SECStatus            rv;
    int                  errCode     = SSL_ERROR_RX_MALFORMED_CERT_VERIFY;
    SSL3AlertDescription desc        = handshake_failure;
    PRBool               isTLS;

    SSL_TRC(3, ("%d: SSL3[%d]: handle certificate_verify handshake",
            SSL_GETPID(), ss->fd));
    PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) );
    PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) );

    if (ss->ssl3.hs.ws != wait_cert_verify || ss->sec.peerCert == NULL) {
      desc    = unexpected_message;
      errCode = SSL_ERROR_RX_UNEXPECTED_CERT_VERIFY;
      goto alert_loser;
    }

    rv = ssl3_ConsumeHandshakeVariable(ss, &signed_hash, 2, &b, &length);
    if (rv != SECSuccess) {
      goto loser;       /* malformed. */
    }

    isTLS = (PRBool)(ss->ssl3.prSpec->version > SSL_LIBRARY_VERSION_3_0);

    /* XXX verify that the key & kea match */
    rv = ssl3_VerifySignedHashes(hashes, ss->sec.peerCert, &signed_hash,
                         isTLS, ss->pkcs11PinArg);
    if (rv != SECSuccess) {
      errCode = PORT_GetError();
      desc = isTLS ? decrypt_error : handshake_failure;
      goto alert_loser;
    }

    signed_hash.data = NULL;

    if (length != 0) {
      desc    = isTLS ? decode_error : illegal_parameter;
      goto alert_loser; /* malformed */
    }
    ss->ssl3.hs.ws = wait_change_cipher;
    return SECSuccess;

alert_loser:
    SSL3_SendAlert(ss, alert_fatal, desc);
loser:
    PORT_SetError(errCode);
    return SECFailure;
}


/* find a slot that is able to generate a PMS and wrap it with RSA.
 * Then generate and return the PMS.
 * If the serverKeySlot parameter is non-null, this function will use
 * that slot to do the job, otherwise it will find a slot.
 *
 * Called from  ssl3_DeriveConnectionKeysPKCS11()  (above)
 *          sendRSAClientKeyExchange()         (above)
 *          ssl3_HandleRSAClientKeyExchange()  (below)
 * Caller must hold the SpecWriteLock, the SSL3HandshakeLock
 */
static PK11SymKey *
ssl3_GenerateRSAPMS(sslSocket *ss, ssl3CipherSpec *spec,
                    PK11SlotInfo * serverKeySlot)
{
    PK11SymKey *      pms           = NULL;
    PK11SlotInfo *    slot          = serverKeySlot;
    void *        pwArg             = ss->pkcs11PinArg;
    SECItem           param;
    CK_VERSION          version;
    CK_MECHANISM_TYPE mechanism_array[3];

    PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) );

    if (slot == NULL) {
      SSLCipherAlgorithm calg;
      /* The specReadLock would suffice here, but we cannot assert on
      ** read locks.  Also, all the callers who call with a non-null
      ** slot already hold the SpecWriteLock.
      */
      PORT_Assert( ss->opt.noLocks || ssl_HaveSpecWriteLock(ss));
      PORT_Assert(ss->ssl3.prSpec == ss->ssl3.pwSpec);

        calg = spec->cipher_def->calg;
      PORT_Assert(alg2Mech[calg].calg == calg);

      /* First get an appropriate slot.  */
      mechanism_array[0] = CKM_SSL3_PRE_MASTER_KEY_GEN;
      mechanism_array[1] = CKM_RSA_PKCS;
      mechanism_array[2] = alg2Mech[calg].cmech;

      slot = PK11_GetBestSlotMultiple(mechanism_array, 3, pwArg);
      if (slot == NULL) {
         /* can't find a slot with all three, find a slot with the minimum */
          slot = PK11_GetBestSlotMultiple(mechanism_array, 2, pwArg);
          if (slot == NULL) {
            PORT_SetError(SSL_ERROR_TOKEN_SLOT_NOT_FOUND);
            return pms; /* which is NULL */
          }
      }
    }

    /* Generate the pre-master secret ...  */
    version.major = MSB(ss->clientHelloVersion);
    version.minor = LSB(ss->clientHelloVersion);

    param.data = (unsigned char *)&version;
    param.len  = sizeof version;

    pms = PK11_KeyGen(slot, CKM_SSL3_PRE_MASTER_KEY_GEN, &param, 0, pwArg);
    if (!serverKeySlot)
      PK11_FreeSlot(slot);
    if (pms == NULL) {
      ssl_MapLowLevelError(SSL_ERROR_CLIENT_KEY_EXCHANGE_FAILURE);
    }
    return pms;
}

/* Note: The Bleichenbacher attack on PKCS#1 necessitates that we NEVER
 * return any indication of failure of the Client Key Exchange message,
 * where that failure is caused by the content of the client's message.
 * This function must not return SECFailure for any reason that is directly
 * or indirectly caused by the content of the client's encrypted PMS.
 * We must not send an alert and also not drop the connection.
 * Instead, we generate a random PMS.  This will cause a failure
 * in the processing the finished message, which is exactly where
 * the failure must occur.
 *
 * Called from ssl3_HandleClientKeyExchange
 */
static SECStatus
ssl3_HandleRSAClientKeyExchange(sslSocket *ss,
                                SSL3Opaque *b,
                        PRUint32 length,
                        SECKEYPrivateKey *serverKey)
{
    PK11SymKey *      pms;
    unsigned char *   cr     = (unsigned char *)&ss->ssl3.hs.client_random;
    unsigned char *   sr     = (unsigned char *)&ss->ssl3.hs.server_random;
    ssl3CipherSpec *  pwSpec = ss->ssl3.pwSpec;
    unsigned int      outLen = 0;
    PRBool            isTLS  = PR_FALSE;
    SECStatus         rv;
    SECItem           enc_pms;
    unsigned char     rsaPmsBuf[SSL3_RSA_PMS_LENGTH];
    SECItem           pmsItem = {siBuffer, NULL, 0};

    PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) );
    PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) );

    enc_pms.data = b;
    enc_pms.len  = length;
    pmsItem.data = rsaPmsBuf;
    pmsItem.len  = sizeof rsaPmsBuf;

    if (ss->ssl3.prSpec->version > SSL_LIBRARY_VERSION_3_0) { /* isTLS */
      PRInt32 kLen;
      kLen = ssl3_ConsumeHandshakeNumber(ss, 2, &enc_pms.data, &enc_pms.len);
      if (kLen < 0) {
          PORT_SetError(SSL_ERROR_CLIENT_KEY_EXCHANGE_FAILURE);
          return SECFailure;
      }
      if ((unsigned)kLen < enc_pms.len) {
          enc_pms.len = kLen;
      }
      isTLS = PR_TRUE;
    } else {
      isTLS = (PRBool)(ss->ssl3.hs.kea_def->tls_keygen != 0);
    }

    if (ss->opt.bypassPKCS11) {
      /* TRIPLE BYPASS, get PMS directly from RSA decryption.
       * Use PK11_PrivDecryptPKCS1 to decrypt the PMS to a buffer, 
       * then, check for version rollback attack, then 
       * do the equivalent of ssl3_DeriveMasterSecret, placing the MS in 
       * pwSpec->msItem.  Finally call ssl3_InitPendingCipherSpec with 
       * ss and NULL, so that it will use the MS we've already derived here. 
       */

      rv = PK11_PrivDecryptPKCS1(serverKey, rsaPmsBuf, &outLen, 
                           sizeof rsaPmsBuf, enc_pms.data, enc_pms.len);
      if (rv != SECSuccess) {
          /* triple bypass failed.  Let's try for a double bypass. */
          goto double_bypass;
      } else if (ss->opt.detectRollBack) {
          SSL3ProtocolVersion client_version = 
                               (rsaPmsBuf[0] << 8) | rsaPmsBuf[1];
          if (client_version != ss->clientHelloVersion) {
            /* Version roll-back detected. ensure failure.  */
            rv = PK11_GenerateRandom(rsaPmsBuf, sizeof rsaPmsBuf);
          }
      }
      /* have PMS, build MS without PKCS11 */
      rv = ssl3_MasterKeyDeriveBypass(pwSpec, cr, sr, &pmsItem, isTLS, 
                              PR_TRUE);
      if (rv != SECSuccess) {
          pwSpec->msItem.data = pwSpec->raw_master_secret;
          pwSpec->msItem.len  = SSL3_MASTER_SECRET_LENGTH;
          PK11_GenerateRandom(pwSpec->msItem.data, pwSpec->msItem.len);
      }
      rv = ssl3_InitPendingCipherSpec(ss,  NULL);
    } else {
double_bypass:
      /*
       * unwrap pms out of the incoming buffer
       * Note: CKM_SSL3_MASTER_KEY_DERIVE is NOT the mechanism used to do 
       *    the unwrap.  Rather, it is the mechanism with which the 
       *      unwrapped pms will be used.
       */
      pms = PK11_PubUnwrapSymKey(serverKey, &enc_pms,
                           CKM_SSL3_MASTER_KEY_DERIVE, CKA_DERIVE, 0);
      if (pms != NULL) {
          PRINT_BUF(60, (ss, "decrypted premaster secret:",
                     PK11_GetKeyData(pms)->data,
                     PK11_GetKeyData(pms)->len));
      } else {
          /* unwrap failed. Generate a bogus PMS and carry on. */
          PK11SlotInfo *  slot   = PK11_GetSlotFromPrivateKey(serverKey);

          ssl_GetSpecWriteLock(ss);
          pms = ssl3_GenerateRSAPMS(ss, ss->ssl3.prSpec, slot);
          ssl_ReleaseSpecWriteLock(ss);
          PK11_FreeSlot(slot);
      }

      if (pms == NULL) {
          /* last gasp.  */
          ssl_MapLowLevelError(SSL_ERROR_CLIENT_KEY_EXCHANGE_FAILURE);
          return SECFailure;
      }

      /* This step will derive the MS from the PMS, among other things. */
      rv = ssl3_InitPendingCipherSpec(ss,  pms);
      PK11_FreeSymKey(pms);
    }

    if (rv != SECSuccess) {
      SEND_ALERT
      return SECFailure; /* error code set by ssl3_InitPendingCipherSpec */
    }
    return SECSuccess;
}


/* Called from ssl3_HandleHandshakeMessage() when it has deciphered a complete
 * ssl3 ClientKeyExchange message from the remote client
 * Caller must hold Handshake and RecvBuf locks.
 */
static SECStatus
ssl3_HandleClientKeyExchange(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
{
    SECKEYPrivateKey *serverKey         = NULL;
    SECStatus         rv;
const ssl3KEADef *    kea_def;
    ssl3KeyPair     *serverKeyPair      = NULL;
#ifdef NSS_ENABLE_ECC
    SECKEYPublicKey *serverPubKey       = NULL;
#endif /* NSS_ENABLE_ECC */

    SSL_TRC(3, ("%d: SSL3[%d]: handle client_key_exchange handshake",
            SSL_GETPID(), ss->fd));

    PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) );
    PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) );

    if (ss->ssl3.hs.ws != wait_client_key) {
      SSL3_SendAlert(ss, alert_fatal, unexpected_message);
      PORT_SetError(SSL_ERROR_RX_UNEXPECTED_CLIENT_KEY_EXCH);
      return SECFailure;
    }

    kea_def   = ss->ssl3.hs.kea_def;

    if (ss->ssl3.hs.usedStepDownKey) {
       PORT_Assert(kea_def->is_limited /* XXX OR cert is signing only */
             && kea_def->exchKeyType == kt_rsa 
             && ss->stepDownKeyPair != NULL);
       if (!kea_def->is_limited  ||
            kea_def->exchKeyType != kt_rsa ||
            ss->stepDownKeyPair == NULL) {
            /* shouldn't happen, don't use step down if it does */
            goto skip;
       }
      serverKeyPair = ss->stepDownKeyPair;
      ss->sec.keaKeyBits = EXPORT_RSA_KEY_LENGTH * BPB;
    } else 
skip:
#ifdef NSS_ENABLE_ECC
    /* XXX Using SSLKEAType to index server certifiates
     * does not work for (EC)DHE ciphers. Until we have
     * an indexing mechanism general enough for all key
     * exchange algorithms, we'll need to deal with each
     * one seprately.
     */
    if ((kea_def->kea == kea_ecdhe_rsa) ||
               (kea_def->kea == kea_ecdhe_ecdsa)) {
      if (ss->ephemeralECDHKeyPair != NULL) {
         serverKeyPair = ss->ephemeralECDHKeyPair;
         if (serverKeyPair->pubKey) {
            ss->sec.keaKeyBits = 
                SECKEY_PublicKeyStrengthInBits(serverKeyPair->pubKey);
         }
      }
    } else 
#endif
    {
      sslServerCerts * sc = ss->serverCerts + kea_def->exchKeyType;
      serverKeyPair = sc->serverKeyPair;
      ss->sec.keaKeyBits = sc->serverKeyBits;
    }

    if (serverKeyPair) {
      serverKey = serverKeyPair->privKey;
    }

    if (serverKey == NULL) {
      SEND_ALERT
      PORT_SetError(SSL_ERROR_NO_SERVER_KEY_FOR_ALG);
      return SECFailure;
    }

    ss->sec.keaType    = kea_def->exchKeyType;

    switch (kea_def->exchKeyType) {
    case kt_rsa:
      rv = ssl3_HandleRSAClientKeyExchange(ss, b, length, serverKey);
      if (rv != SECSuccess) {
          SEND_ALERT
          return SECFailure;  /* error code set */
      }
      break;


#ifdef NSS_ENABLE_ECC
    case kt_ecdh:
      /* XXX We really ought to be able to store multiple
       * EC certs (a requirement if we wish to support both
       * ECDH-RSA and ECDH-ECDSA key exchanges concurrently).
       * When we make that change, we'll need an index other
       * than kt_ecdh to pick the right EC certificate.
       */
      if (serverKeyPair) {
          serverPubKey = serverKeyPair->pubKey;
        }
      if (serverPubKey == NULL) {
          /* XXX Is this the right error code? */
          PORT_SetError(SSL_ERROR_EXTRACT_PUBLIC_KEY_FAILURE);
          return SECFailure;
      }
      rv = ssl3_HandleECDHClientKeyExchange(ss, b, length, 
                                    serverPubKey, serverKey);
      if (rv != SECSuccess) {
          return SECFailure;  /* error code set */
      }
      break;
#endif /* NSS_ENABLE_ECC */

    default:
      (void) ssl3_HandshakeFailure(ss);
      PORT_SetError(SEC_ERROR_UNSUPPORTED_KEYALG);
      return SECFailure;
    }
    ss->ssl3.hs.ws = ss->sec.peerCert ? wait_cert_verify : wait_change_cipher;
    return SECSuccess;

}

/* This is TLS's equivalent of sending a no_certificate alert. */
static SECStatus
ssl3_SendEmptyCertificate(sslSocket *ss)
{
    SECStatus            rv;

    rv = ssl3_AppendHandshakeHeader(ss, certificate, 3);
    if (rv == SECSuccess) {
      rv = ssl3_AppendHandshakeNumber(ss, 0, 3);
    }
    return rv;    /* error, if any, set by functions called above. */
}

SECStatus
ssl3_HandleNewSessionTicket(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
{
    SECStatus         rv;
    NewSessionTicket  session_ticket;

    SSL_TRC(3, ("%d: SSL3[%d]: handle session_ticket handshake",
            SSL_GETPID(), ss->fd));

    PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) );
    PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) );

    if (ss->ssl3.hs.ws != wait_new_session_ticket) {
      SSL3_SendAlert(ss, alert_fatal, unexpected_message);
      PORT_SetError(SSL_ERROR_RX_UNEXPECTED_NEW_SESSION_TICKET);
      return SECFailure;
    }

    session_ticket.received_timestamp = ssl_Time();
    if (length < 4) {
      (void)SSL3_SendAlert(ss, alert_fatal, decode_error);
      PORT_SetError(SSL_ERROR_RX_MALFORMED_NEW_SESSION_TICKET);
      return SECFailure;
    }
    session_ticket.ticket_lifetime_hint =
      (PRUint32)ssl3_ConsumeHandshakeNumber(ss, 4, &b, &length);

    rv = ssl3_ConsumeHandshakeVariable(ss, &session_ticket.ticket, 2,
      &b, &length);
    if (length != 0 || rv != SECSuccess) {
      (void)SSL3_SendAlert(ss, alert_fatal, decode_error);
      PORT_SetError(SSL_ERROR_RX_MALFORMED_NEW_SESSION_TICKET);
      return SECFailure;  /* malformed */
    }

    rv = ssl3_SetSIDSessionTicket(ss->sec.ci.sid, &session_ticket);
    if (rv != SECSuccess) {
      (void)SSL3_SendAlert(ss, alert_fatal, handshake_failure);
      PORT_SetError(SSL_ERROR_INTERNAL_ERROR_ALERT);
      return SECFailure;
    }
    ss->ssl3.hs.ws = wait_change_cipher;
    return SECSuccess;
}

#ifdef NISCC_TEST
static PRInt32 connNum = 0;

static SECStatus 
get_fake_cert(SECItem *pCertItem, int *pIndex)
{
    PRFileDesc *cf;
    char *      testdir;
    char *      startat;
    char *      stopat;
    const char *extension;
    int         fileNum;
    PRInt32     numBytes   = 0;
    PRStatus    prStatus;
    PRFileInfo  info;
    char        cfn[100];

    pCertItem->data = 0;
    if ((testdir = PR_GetEnv("NISCC_TEST")) == NULL) {
      return SECSuccess;
    }
    *pIndex   = (NULL != strstr(testdir, "root"));
    extension = (strstr(testdir, "simple") ? "" : ".der");
    fileNum     = PR_AtomicIncrement(&connNum) - 1;
    if ((startat = PR_GetEnv("START_AT")) != NULL) {
      fileNum += atoi(startat);
    }
    if ((stopat = PR_GetEnv("STOP_AT")) != NULL && 
      fileNum >= atoi(stopat)) {
      *pIndex = -1;
      return SECSuccess;
    }
    sprintf(cfn, "%s/%08d%s", testdir, fileNum, extension);
    cf = PR_Open(cfn, PR_RDONLY, 0);
    if (!cf) {
      goto loser;
    }
    prStatus = PR_GetOpenFileInfo(cf, &info);
    if (prStatus != PR_SUCCESS) {
      PR_Close(cf);
      goto loser;
    }
    pCertItem = SECITEM_AllocItem(NULL, pCertItem, info.size);
    if (pCertItem) {
      numBytes = PR_Read(cf, pCertItem->data, info.size);
    }
    PR_Close(cf);
    if (numBytes != info.size) {
      SECITEM_FreeItem(pCertItem, PR_FALSE);
      PORT_SetError(SEC_ERROR_IO);
      goto loser;
    }
    fprintf(stderr, "using %s\n", cfn);
    return SECSuccess;

loser:
    fprintf(stderr, "failed to use %s\n", cfn);
    *pIndex = -1;
    return SECFailure;
}
#endif

/*
 * Used by both client and server.
 * Called from HandleServerHelloDone and from SendServerHelloSequence.
 */
static SECStatus
ssl3_SendCertificate(sslSocket *ss)
{
    SECStatus            rv;
    CERTCertificateList *certChain;
    int                  len        = 0;
    int                  i;
    SSL3KEAType          certIndex;
#ifdef NISCC_TEST
    SECItem              fakeCert;
    int                  ndex           = -1;
#endif

    SSL_TRC(3, ("%d: SSL3[%d]: send certificate handshake",
            SSL_GETPID(), ss->fd));

    PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss));
    PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss));

    if (ss->sec.localCert)
      CERT_DestroyCertificate(ss->sec.localCert);
    if (ss->sec.isServer) {
      sslServerCerts * sc = NULL;

      /* XXX SSLKEAType isn't really a good choice for 
       * indexing certificates (it breaks when we deal
       * with (EC)DHE-* cipher suites. This hack ensures
       * the RSA cert is picked for (EC)DHE-RSA.
       * Revisit this when we add server side support
       * for ECDHE-ECDSA or client-side authentication
       * using EC certificates.
       */
      if ((ss->ssl3.hs.kea_def->kea == kea_ecdhe_rsa) ||
          (ss->ssl3.hs.kea_def->kea == kea_dhe_rsa)) {
          certIndex = kt_rsa;
      } else {
          certIndex = ss->ssl3.hs.kea_def->exchKeyType;
      }
      sc                    = ss->serverCerts + certIndex;
      certChain             = sc->serverCertChain;
      ss->sec.authKeyBits   = sc->serverKeyBits;
      ss->sec.authAlgorithm = ss->ssl3.hs.kea_def->signKeyType;
      ss->sec.localCert     = CERT_DupCertificate(sc->serverCert);
    } else {
      certChain          = ss->ssl3.clientCertChain;
      ss->sec.localCert = CERT_DupCertificate(ss->ssl3.clientCertificate);
    }

#ifdef NISCC_TEST
    rv = get_fake_cert(&fakeCert, &ndex);
#endif

    if (certChain) {
      for (i = 0; i < certChain->len; i++) {
#ifdef NISCC_TEST
          if (fakeCert.len > 0 && i == ndex) {
            len += fakeCert.len + 3;
          } else {
            len += certChain->certs[i].len + 3;
          }
#else
          len += certChain->certs[i].len + 3;
#endif
      }
    }

    rv = ssl3_AppendHandshakeHeader(ss, certificate, len + 3);
    if (rv != SECSuccess) {
      return rv;        /* err set by AppendHandshake. */
    }
    rv = ssl3_AppendHandshakeNumber(ss, len, 3);
    if (rv != SECSuccess) {
      return rv;        /* err set by AppendHandshake. */
    }
    if (certChain) {
        for (i = 0; i < certChain->len; i++) {
#ifdef NISCC_TEST
            if (fakeCert.len > 0 && i == ndex) {
                rv = ssl3_AppendHandshakeVariable(ss, fakeCert.data,
                                                  fakeCert.len, 3);
                SECITEM_FreeItem(&fakeCert, PR_FALSE);
            } else {
                rv = ssl3_AppendHandshakeVariable(ss, certChain->certs[i].data,
                                                  certChain->certs[i].len, 3);
            }
#else
            rv = ssl3_AppendHandshakeVariable(ss, certChain->certs[i].data,
                                              certChain->certs[i].len, 3);
#endif
            if (rv != SECSuccess) {
                return rv;          /* err set by AppendHandshake. */
            }
        }
    }

    return SECSuccess;
}

/* This is used to delete the CA certificates in the peer certificate chain
 * from the cert database after they've been validated.
 */
static void
ssl3_CleanupPeerCerts(sslSocket *ss)
{
    PRArenaPool * arena = ss->ssl3.peerCertArena;
    ssl3CertNode *certs = (ssl3CertNode *)ss->ssl3.peerCertChain;

    for (; certs; certs = certs->next) {
      CERT_DestroyCertificate(certs->cert);
    }
    if (arena) PORT_FreeArena(arena, PR_FALSE);
    ss->ssl3.peerCertArena = NULL;
    ss->ssl3.peerCertChain = NULL;
}

/* Called from ssl3_HandleHandshakeMessage() when it has deciphered a complete
 * ssl3 Certificate message.
 * Caller must hold Handshake and RecvBuf locks.
 */
static SECStatus
ssl3_HandleCertificate(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
{
    ssl3CertNode *   c;
    ssl3CertNode *   certs    = NULL;
    PRArenaPool *    arena    = NULL;
    CERTCertificate *cert;
    PRInt32          remaining  = 0;
    PRInt32          size;
    SECStatus        rv;
    PRBool           isServer = (PRBool)(!!ss->sec.isServer);
    PRBool           trusted  = PR_FALSE;
    PRBool           isTLS;
    SSL3AlertDescription desc = bad_certificate;
    int              errCode    = SSL_ERROR_RX_MALFORMED_CERTIFICATE;
    SECItem          certItem;

    SSL_TRC(3, ("%d: SSL3[%d]: handle certificate handshake",
            SSL_GETPID(), ss->fd));
    PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) );
    PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) );

    if ((ss->ssl3.hs.ws != wait_server_cert) &&
      (ss->ssl3.hs.ws != wait_client_cert)) {
      desc    = unexpected_message;
      errCode = SSL_ERROR_RX_UNEXPECTED_CERTIFICATE;
      goto alert_loser;
    }

    if (ss->sec.peerCert != NULL) {
      if (ss->sec.peerKey) {
          SECKEY_DestroyPublicKey(ss->sec.peerKey);
          ss->sec.peerKey = NULL;
      }
      CERT_DestroyCertificate(ss->sec.peerCert);
      ss->sec.peerCert = NULL;
    }

    ssl3_CleanupPeerCerts(ss);
    isTLS = (PRBool)(ss->ssl3.prSpec->version > SSL_LIBRARY_VERSION_3_0);

    /* It is reported that some TLS client sends a Certificate message
    ** with a zero-length message body.  We'll treat that case like a
    ** normal no_certificates message to maximize interoperability.
    */
    if (length) {
      remaining = ssl3_ConsumeHandshakeNumber(ss, 3, &b, &length);
      if (remaining < 0)
          goto loser;   /* fatal alert already sent by ConsumeHandshake. */
      if ((PRUint32)remaining > length)
          goto decode_loser;
    }

    if (!remaining) {
      if (!(isTLS && isServer))
          goto alert_loser;
      /* This is TLS's version of a no_certificate alert. */
      /* I'm a server. I've requested a client cert. He hasn't got one. */
      rv = ssl3_HandleNoCertificate(ss);
      if (rv != SECSuccess) {
          errCode = PORT_GetError();
          goto loser;
      }
      goto cert_block;
    }

    ss->ssl3.peerCertArena = arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
    if ( arena == NULL ) {
      goto loser; /* don't send alerts on memory errors */
    }

    /* First get the peer cert. */
    remaining -= 3;
    if (remaining < 0)
      goto decode_loser;

    size = ssl3_ConsumeHandshakeNumber(ss, 3, &b, &length);
    if (size <= 0)
      goto loser; /* fatal alert already sent by ConsumeHandshake. */

    if (remaining < size)
      goto decode_loser;

    certItem.data = b;
    certItem.len = size;
    b      += size;
    length -= size;
    remaining -= size;

    ss->sec.peerCert = CERT_NewTempCertificate(ss->dbHandle, &certItem, NULL,
                                            PR_FALSE, PR_TRUE);
    if (ss->sec.peerCert == NULL) {
      /* We should report an alert if the cert was bad, but not if the
       * problem was just some local problem, like memory error.
       */
      goto ambiguous_err;
    }

    /* Now get all of the CA certs. */
    while (remaining > 0) {
      remaining -= 3;
      if (remaining < 0)
          goto decode_loser;

      size = ssl3_ConsumeHandshakeNumber(ss, 3, &b, &length);
      if (size <= 0)
          goto loser;   /* fatal alert already sent by ConsumeHandshake. */

      if (remaining < size)
          goto decode_loser;

      certItem.data = b;
      certItem.len = size;
      b      += size;
      length -= size;
      remaining -= size;

      c = PORT_ArenaNew(arena, ssl3CertNode);
      if (c == NULL) {
          goto loser;   /* don't send alerts on memory errors */
      }

      c->cert = CERT_NewTempCertificate(ss->dbHandle, &certItem, NULL,
                                        PR_FALSE, PR_TRUE);
      if (c->cert == NULL) {
          goto ambiguous_err;
      }

      if (c->cert->trust)
          trusted = PR_TRUE;

      c->next = certs;
      certs = c;
    }

    if (remaining != 0)
        goto decode_loser;

    SECKEY_UpdateCertPQG(ss->sec.peerCert);

    /*
     * Ask caller-supplied callback function to validate cert chain.
     */
    rv = (SECStatus)(*ss->authCertificate)(ss->authCertificateArg, ss->fd,
                                 PR_TRUE, isServer);
    if (rv) {
      errCode = PORT_GetError();
      if (!ss->handleBadCert) {
          goto bad_cert;
      }
      rv = (SECStatus)(*ss->handleBadCert)(ss->badCertArg, ss->fd);
      if ( rv ) {
          if ( rv == SECWouldBlock ) {
            /* someone will handle this connection asynchronously*/
            SSL_DBG(("%d: SSL3[%d]: go to async cert handler",
                   SSL_GETPID(), ss->fd));
            ss->ssl3.peerCertChain = certs;
            certs               = NULL;
            ssl_SetAlwaysBlock(ss);
            goto cert_block;
          }
          /* cert is bad */
          goto bad_cert;
      }
      /* cert is good */
    }

    /* start SSL Step Up, if appropriate */
    cert = ss->sec.peerCert;
    if (!isServer &&
      ssl3_global_policy_some_restricted &&
        ss->ssl3.policy == SSL_ALLOWED &&
      anyRestrictedEnabled(ss) &&
      SECSuccess == CERT_VerifyCertNow(cert->dbhandle, cert,
                                       PR_FALSE, /* checkSig */
                                 certUsageSSLServerWithStepUp,
/*XXX*/                                ss->authCertificateArg) ) {
      ss->ssl3.policy         = SSL_RESTRICTED;
      ss->ssl3.hs.rehandshake = PR_TRUE;
    }

    ss->sec.ci.sid->peerCert = CERT_DupCertificate(ss->sec.peerCert);

    if (!ss->sec.isServer) {
      /* set the server authentication and key exchange types and sizes
      ** from the value in the cert.  If the key exchange key is different,
      ** it will get fixed when we handle the server key exchange message.
      */
      SECKEYPublicKey * pubKey  = CERT_ExtractPublicKey(cert);
      ss->sec.authAlgorithm = ss->ssl3.hs.kea_def->signKeyType;
      ss->sec.keaType       = ss->ssl3.hs.kea_def->exchKeyType;
      if (pubKey) {
          ss->sec.keaKeyBits = ss->sec.authKeyBits =
            SECKEY_PublicKeyStrengthInBits(pubKey);
#ifdef NSS_ENABLE_ECC
          if (ss->sec.keaType == kt_ecdh) {
            /* Get authKeyBits from signing key.
             * XXX The code below uses a quick approximation of
             * key size based on cert->signatureWrap.signature.data
             * (which contains the DER encoded signature). The field
             * cert->signatureWrap.signature.len contains the
             * length of the encoded signature in bits.
             */
            if (ss->ssl3.hs.kea_def->kea == kea_ecdh_ecdsa) {
                ss->sec.authKeyBits = 
                  cert->signatureWrap.signature.data[3]*8;
                if (cert->signatureWrap.signature.data[4] == 0x00)
                      ss->sec.authKeyBits -= 8;
                /* 
                 * XXX: if cert is not signed by ecdsa we should
                 * destroy pubKey and goto bad_cert
                 */
            } else if (ss->ssl3.hs.kea_def->kea == kea_ecdh_rsa) {
                ss->sec.authKeyBits = cert->signatureWrap.signature.len;
                /* 
                 * XXX: if cert is not signed by rsa we should
                 * destroy pubKey and goto bad_cert
                 */
            }
          }
#endif /* NSS_ENABLE_ECC */
          SECKEY_DestroyPublicKey(pubKey); 
          pubKey = NULL;
      }
    }

    ss->ssl3.peerCertChain = certs;  certs = NULL;  arena = NULL;

cert_block:
    if (ss->sec.isServer) {
      ss->ssl3.hs.ws = wait_client_key;
    } else {
      ss->ssl3.hs.ws = wait_cert_request; /* disallow server_key_exchange */
      if (ss->ssl3.hs.kea_def->is_limited ||
          /* XXX OR server cert is signing only. */
#ifdef NSS_ENABLE_ECC
          ss->ssl3.hs.kea_def->kea == kea_ecdhe_ecdsa ||
          ss->ssl3.hs.kea_def->kea == kea_ecdhe_rsa ||
#endif /* NSS_ENABLE_ECC */
          ss->ssl3.hs.kea_def->exchKeyType == kt_dh) {
          ss->ssl3.hs.ws = wait_server_key; /* allow server_key_exchange */
      }
    }

    /* rv must normally be equal to SECSuccess here.  If we called
     * handleBadCert, it can also be SECWouldBlock.
     */
    return rv;

ambiguous_err:
    errCode = PORT_GetError();
    switch (errCode) {
    case PR_OUT_OF_MEMORY_ERROR:
    case SEC_ERROR_BAD_DATABASE:
    case SEC_ERROR_NO_MEMORY:
      if (isTLS) {
          desc = internal_error;
          goto alert_loser;
      }
      goto loser;
    }
    /* fall through to bad_cert. */

bad_cert:   /* caller has set errCode. */
    switch (errCode) {
    case SEC_ERROR_LIBRARY_FAILURE:     desc = unsupported_certificate; break;
    case SEC_ERROR_EXPIRED_CERTIFICATE: desc = certificate_expired;     break;
    case SEC_ERROR_REVOKED_CERTIFICATE: desc = certificate_revoked;     break;
    case SEC_ERROR_INADEQUATE_KEY_USAGE:
    case SEC_ERROR_INADEQUATE_CERT_TYPE:
                                    desc = certificate_unknown;     break;
    case SEC_ERROR_UNTRUSTED_CERT:
                desc = isTLS ? access_denied : certificate_unknown; break;
    case SEC_ERROR_UNKNOWN_ISSUER:      
    case SEC_ERROR_UNTRUSTED_ISSUER:    
                desc = isTLS ? unknown_ca : certificate_unknown; break;
    case SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE:
                desc = isTLS ? unknown_ca : certificate_expired; break;

    case SEC_ERROR_CERT_NOT_IN_NAME_SPACE:
    case SEC_ERROR_PATH_LEN_CONSTRAINT_INVALID:
    case SEC_ERROR_CA_CERT_INVALID:
    case SEC_ERROR_BAD_SIGNATURE:
    default:                            desc = bad_certificate;     break;
    }
    SSL_DBG(("%d: SSL3[%d]: peer certificate is no good: error=%d",
           SSL_GETPID(), ss->fd, errCode));

    goto alert_loser;

decode_loser:
    desc = isTLS ? decode_error : bad_certificate;

alert_loser:
    (void)SSL3_SendAlert(ss, alert_fatal, desc);

loser:
    ss->ssl3.peerCertChain = certs;  certs = NULL;  arena = NULL;
    ssl3_CleanupPeerCerts(ss);

    if (ss->sec.peerCert != NULL) {
      CERT_DestroyCertificate(ss->sec.peerCert);
      ss->sec.peerCert = NULL;
    }
    (void)ssl_MapLowLevelError(errCode);
    return SECFailure;
}


/* restart an SSL connection that we stopped to run certificate dialogs
** XXX      Need to document here how an application marks a cert to show that
**    the application has accepted it (overridden CERT_VerifyCert).
 *
 * XXX This code only works on the initial handshake on a connection, XXX
 *     It does not work on a subsequent handshake (redo).
 *
 * Return value: XXX
 *
 * Caller holds 1stHandshakeLock.
*/
int
ssl3_RestartHandshakeAfterServerCert(sslSocket *ss)
{
    CERTCertificate * cert;
    int               rv      = SECSuccess;

    if (MSB(ss->version) != MSB(SSL_LIBRARY_VERSION_3_0)) {
      SET_ERROR_CODE
      return SECFailure;
    }
    if (!ss->ssl3.initialized) {
      SET_ERROR_CODE
      return SECFailure;
    }

    cert = ss->sec.peerCert;

    /* Permit step up if user decided to accept the cert */
    if (!ss->sec.isServer &&
      ssl3_global_policy_some_restricted &&
        ss->ssl3.policy == SSL_ALLOWED &&
      anyRestrictedEnabled(ss) &&
      (SECSuccess == CERT_VerifyCertNow(cert->dbhandle, cert,
                                        PR_FALSE, /* checksig */
                                  certUsageSSLServerWithStepUp,
/*XXX*/                                 ss->authCertificateArg) )) {
      ss->ssl3.policy         = SSL_RESTRICTED;
      ss->ssl3.hs.rehandshake = PR_TRUE;
    }

    if (ss->handshake != NULL) {
      ss->handshake = ssl_GatherRecord1stHandshake;
      ss->sec.ci.sid->peerCert = CERT_DupCertificate(ss->sec.peerCert);

      ssl_GetRecvBufLock(ss);
      if (ss->ssl3.hs.msgState.buf != NULL) {
          rv = ssl3_HandleRecord(ss, NULL, &ss->gs.buf);
      }
      ssl_ReleaseRecvBufLock(ss);
    }

    return rv;
}

static SECStatus
ssl3_ComputeTLSFinished(ssl3CipherSpec *spec,
                  PRBool          isServer,
                const   SSL3Finished *  hashes,
                        TLSFinished  *  tlsFinished)
{
    const char * label;
    unsigned int len;
    SECStatus    rv;

    label = isServer ? "server finished" : "client finished";
    len   = 15;

    if (spec->master_secret && !spec->bypassCiphers) {
      SECItem      param       = {siBuffer, NULL, 0};
      PK11Context *prf_context =
          PK11_CreateContextBySymKey(CKM_TLS_PRF_GENERAL, CKA_SIGN, 
                               spec->master_secret, &param);
      if (!prf_context)
          return SECFailure;

      rv  = PK11_DigestBegin(prf_context);
      rv |= PK11_DigestOp(prf_context, (const unsigned char *) label, len);
      rv |= PK11_DigestOp(prf_context, hashes->md5, sizeof *hashes);
      rv |= PK11_DigestFinal(prf_context, tlsFinished->verify_data, 
                         &len, sizeof tlsFinished->verify_data);
      PORT_Assert(rv != SECSuccess || len == sizeof *tlsFinished);

      PK11_DestroyContext(prf_context, PR_TRUE);
    } else {
      /* bypass PKCS11 */
      SECItem inData  = { siBuffer, };
      SECItem outData = { siBuffer, };
      PRBool isFIPS   = PR_FALSE;

      inData.data  = (unsigned char *)hashes->md5;
      inData.len   = sizeof hashes[0];
      outData.data = tlsFinished->verify_data;
      outData.len  = sizeof tlsFinished->verify_data;
      rv = TLS_PRF(&spec->msItem, label, &inData, &outData, isFIPS);
      PORT_Assert(rv != SECSuccess || \
                outData.len == sizeof tlsFinished->verify_data);
    }
    return rv;
}

/* called from ssl3_HandleServerHelloDone
 *             ssl3_HandleClientHello
 *             ssl3_HandleFinished
 */
static SECStatus
ssl3_SendFinished(sslSocket *ss, PRInt32 flags)
{
    ssl3CipherSpec *cwSpec;
    PRBool          isTLS;
    PRBool          isServer = ss->sec.isServer;
    SECStatus       rv;
    SSL3Sender      sender = isServer ? sender_server : sender_client;
    SSL3Finished    hashes;
    TLSFinished     tlsFinished;

    SSL_TRC(3, ("%d: SSL3[%d]: send finished handshake", SSL_GETPID(), ss->fd));

    PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss));
    PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss));

    ssl_GetSpecReadLock(ss);
    cwSpec = ss->ssl3.cwSpec;
    isTLS = (PRBool)(cwSpec->version > SSL_LIBRARY_VERSION_3_0);
    rv = ssl3_ComputeHandshakeHashes(ss, cwSpec, &hashes, sender);
    if (isTLS && rv == SECSuccess) {
      rv = ssl3_ComputeTLSFinished(cwSpec, isServer, &hashes, &tlsFinished);
    }
    ssl_ReleaseSpecReadLock(ss);
    if (rv != SECSuccess) {
      goto fail;  /* err code was set by ssl3_ComputeHandshakeHashes */
    }

    if (isTLS) {
      rv = ssl3_AppendHandshakeHeader(ss, finished, sizeof tlsFinished);
      if (rv != SECSuccess) 
          goto fail;          /* err set by AppendHandshake. */
      rv = ssl3_AppendHandshake(ss, &tlsFinished, sizeof tlsFinished);
      if (rv != SECSuccess) 
          goto fail;          /* err set by AppendHandshake. */
    } else {
      rv = ssl3_AppendHandshakeHeader(ss, finished, sizeof hashes);
      if (rv != SECSuccess) 
          goto fail;          /* err set by AppendHandshake. */
      rv = ssl3_AppendHandshake(ss, &hashes, sizeof hashes);
      if (rv != SECSuccess) 
          goto fail;          /* err set by AppendHandshake. */
    }
    rv = ssl3_FlushHandshake(ss, flags);
    if (rv != SECSuccess) {
      goto fail;  /* error code set by ssl3_FlushHandshake */
    }
    return SECSuccess;

fail:
    return rv;
}

/* wrap the master secret, and put it into the SID.
 * Caller holds the Spec read lock.
 */
SECStatus
ssl3_CacheWrappedMasterSecret(sslSocket *ss, sslSessionID *sid,
    ssl3CipherSpec *spec, SSL3KEAType effectiveExchKeyType)
{
    PK11SymKey *      wrappingKey  = NULL;
    PK11SlotInfo *    symKeySlot;
    void *            pwArg        = ss->pkcs11PinArg;
    SECStatus         rv           = SECFailure;
    PRBool            isServer     = ss->sec.isServer;
    CK_MECHANISM_TYPE mechanism    = CKM_INVALID_MECHANISM;
    symKeySlot = PK11_GetSlotFromKey(spec->master_secret);
    if (!isServer) {
      int  wrapKeyIndex;
      int  incarnation;

      /* these next few functions are mere accessors and don't fail. */
      sid->u.ssl3.masterWrapIndex  = wrapKeyIndex =
                               PK11_GetCurrentWrapIndex(symKeySlot);
      PORT_Assert(wrapKeyIndex == 0);     /* array has only one entry! */

      sid->u.ssl3.masterWrapSeries = incarnation =
                               PK11_GetSlotSeries(symKeySlot);
      sid->u.ssl3.masterSlotID   = PK11_GetSlotID(symKeySlot);
      sid->u.ssl3.masterModuleID = PK11_GetModuleID(symKeySlot);
      sid->u.ssl3.masterValid    = PR_TRUE;
      /* Get the default wrapping key, for wrapping the master secret before
       * placing it in the SID cache entry. */
      wrappingKey = PK11_GetWrapKey(symKeySlot, wrapKeyIndex,
                              CKM_INVALID_MECHANISM, incarnation,
                              pwArg);
      if (wrappingKey) {
          mechanism = PK11_GetMechanism(wrappingKey); /* can't fail. */
      } else {
          int keyLength;
          /* if the wrappingKey doesn't exist, attempt to create it.
           * Note: we intentionally ignore errors here.  If we cannot
           * generate a wrapping key, it is not fatal to this SSL connection,
           * but we will not be able to restart this session.
           */
          mechanism = PK11_GetBestWrapMechanism(symKeySlot);
          keyLength = PK11_GetBestKeyLength(symKeySlot, mechanism);
          /* Zero length means fixed key length algorithm, or error.
           * It's ambiguous.
           */
          wrappingKey = PK11_KeyGen(symKeySlot, mechanism, NULL,
                              keyLength, pwArg);
          if (wrappingKey) {
            PK11_SetWrapKey(symKeySlot, wrapKeyIndex, wrappingKey);
          }
      }
    } else {
      /* server socket using session cache. */
      mechanism = PK11_GetBestWrapMechanism(symKeySlot);
      if (mechanism != CKM_INVALID_MECHANISM) {
          wrappingKey =
            getWrappingKey(ss, symKeySlot, effectiveExchKeyType,
                         mechanism, pwArg);
          if (wrappingKey) {
            mechanism = PK11_GetMechanism(wrappingKey); /* can't fail. */
          }
      }
    }

    sid->u.ssl3.masterWrapMech = mechanism;
    PK11_FreeSlot(symKeySlot);

    if (wrappingKey) {
      SECItem wmsItem;

      wmsItem.data = sid->u.ssl3.keys.wrapped_master_secret;
      wmsItem.len  = sizeof sid->u.ssl3.keys.wrapped_master_secret;
      rv = PK11_WrapSymKey(mechanism, NULL, wrappingKey,
                       spec->master_secret, &wmsItem);
      /* rv is examined below. */
      sid->u.ssl3.keys.wrapped_master_secret_len = wmsItem.len;
      PK11_FreeSymKey(wrappingKey);
    }
    return rv;
}

/* Called from ssl3_HandleHandshakeMessage() when it has deciphered a complete
 * ssl3 Finished message from the peer.
 * Caller must hold Handshake and RecvBuf locks.
 */
static SECStatus
ssl3_HandleFinished(sslSocket *ss, SSL3Opaque *b, PRUint32 length,
                const SSL3Hashes *hashes)
{
    sslSessionID *    sid        = ss->sec.ci.sid;
    SECStatus         rv           = SECSuccess;
    PRBool            isServer     = ss->sec.isServer;
    PRBool            isTLS;
    PRBool            doStepUp;
    SSL3KEAType       effectiveExchKeyType;

    PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) );
    PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) );

    SSL_TRC(3, ("%d: SSL3[%d]: handle finished handshake",
      SSL_GETPID(), ss->fd));

    if (ss->ssl3.hs.ws != wait_finished) {
      SSL3_SendAlert(ss, alert_fatal, unexpected_message);
      PORT_SetError(SSL_ERROR_RX_UNEXPECTED_FINISHED);
      return SECFailure;
    }

    isTLS = (PRBool)(ss->ssl3.crSpec->version > SSL_LIBRARY_VERSION_3_0);
    if (isTLS) {
      TLSFinished tlsFinished;

      if (length != sizeof tlsFinished) {
          (void)SSL3_SendAlert(ss, alert_fatal, decode_error);
          PORT_SetError(SSL_ERROR_RX_MALFORMED_FINISHED);
          return SECFailure;
      }
      rv = ssl3_ComputeTLSFinished(ss->ssl3.crSpec, !isServer, 
                                   hashes, &tlsFinished);
      if (rv != SECSuccess ||
          0 != PORT_Memcmp(&tlsFinished, b, length)) {
          (void)SSL3_SendAlert(ss, alert_fatal, decrypt_error);
          PORT_SetError(SSL_ERROR_BAD_HANDSHAKE_HASH_VALUE);
          return SECFailure;
      }
    } else {
      if (length != sizeof(SSL3Hashes)) {
          (void)ssl3_IllegalParameter(ss);
          PORT_SetError(SSL_ERROR_RX_MALFORMED_FINISHED);
          return SECFailure;
      }

      if (0 != PORT_Memcmp(hashes, b, length)) {
          (void)ssl3_HandshakeFailure(ss);
          PORT_SetError(SSL_ERROR_BAD_HANDSHAKE_HASH_VALUE);
          return SECFailure;
      }
    }

    doStepUp = (PRBool)(!isServer && ss->ssl3.hs.rehandshake);

    ssl_GetXmitBufLock(ss);   /*************************************/

    if ((isServer && !ss->ssl3.hs.isResuming) ||
      (!isServer && ss->ssl3.hs.isResuming)) {
      PRInt32 flags = 0;

      /* Send a NewSessionTicket message if the client sent us
       * either an empty session ticket, or one that did not verify.
       * (Note that if either of these conditions was met, then the
       * server has sent a SessionTicket extension in the
       * ServerHello message.)
       */
      if (isServer && !ss->ssl3.hs.isResuming &&
          ssl3_ExtensionNegotiated(ss, session_ticket_xtn)) {
          rv = ssl3_SendNewSessionTicket(ss);
          if (rv != SECSuccess) {
            goto xmit_loser;
          }
      }

      rv = ssl3_SendChangeCipherSpecs(ss);
      if (rv != SECSuccess) {
          goto xmit_loser;    /* err is set. */
      }
      /* If this thread is in SSL_SecureSend (trying to write some data) 
      ** or if it is going to step up, 
      ** then set the ssl_SEND_FLAG_FORCE_INTO_BUFFER flag, so that the 
      ** last two handshake messages (change cipher spec and finished) 
      ** will be sent in the same send/write call as the application data.
      */
      if (doStepUp || ss->writerThread == PR_GetCurrentThread()) {
          flags = ssl_SEND_FLAG_FORCE_INTO_BUFFER;
      }
      rv = ssl3_SendFinished(ss, flags);
      if (rv != SECSuccess) {
          goto xmit_loser;    /* err is set. */
      }
    }

    /* Optimization: don't cache this connection if we're going to step up. */
    if (doStepUp) {
      ssl_FreeSID(sid);
      ss->sec.ci.sid     = sid = NULL;
      ss->ssl3.hs.rehandshake = PR_FALSE;
      rv = ssl3_SendClientHello(ss);
xmit_loser:
      ssl_ReleaseXmitBufLock(ss);
      return rv;  /* err code is set if appropriate. */
    }

    ssl_ReleaseXmitBufLock(ss);     /*************************************/

    /* The first handshake is now completed. */
    ss->handshake           = NULL;
    ss->firstHsDone         = PR_TRUE;
    ss->gs.writeOffset = 0;
    ss->gs.readOffset  = 0;

    if (ss->ssl3.hs.kea_def->kea == kea_ecdhe_rsa) {
      effectiveExchKeyType = kt_rsa;
    } else {
      effectiveExchKeyType = ss->ssl3.hs.kea_def->exchKeyType;
    }

    if (sid->cached == never_cached && !ss->opt.noCache && ss->sec.cache) {
      /* fill in the sid */
      sid->u.ssl3.cipherSuite = ss->ssl3.hs.cipher_suite;
      sid->u.ssl3.compression = ss->ssl3.hs.compression;
      sid->u.ssl3.policy      = ss->ssl3.policy;
#ifdef NSS_ENABLE_ECC
      sid->u.ssl3.negotiatedECCurves = ss->ssl3.hs.negotiatedECCurves;
#endif
      sid->u.ssl3.exchKeyType = effectiveExchKeyType;
      sid->version            = ss->version;
      sid->authAlgorithm      = ss->sec.authAlgorithm;
      sid->authKeyBits        = ss->sec.authKeyBits;
      sid->keaType            = ss->sec.keaType;
      sid->keaKeyBits         = ss->sec.keaKeyBits;
      sid->lastAccessTime     = sid->creationTime = ssl_Time();
      sid->expirationTime     = sid->creationTime + ssl3_sid_timeout;
      sid->localCert          = CERT_DupCertificate(ss->sec.localCert);

      ssl_GetSpecReadLock(ss);      /*************************************/

      /* Copy the master secret (wrapped or unwrapped) into the sid */
      if (ss->ssl3.crSpec->msItem.len && ss->ssl3.crSpec->msItem.data) {
          sid->u.ssl3.keys.wrapped_master_secret_len = 
                      ss->ssl3.crSpec->msItem.len;
          memcpy(sid->u.ssl3.keys.wrapped_master_secret, 
               ss->ssl3.crSpec->msItem.data, ss->ssl3.crSpec->msItem.len);
          sid->u.ssl3.masterValid    = PR_TRUE;
          sid->u.ssl3.keys.msIsWrapped = PR_FALSE;
          rv = SECSuccess;
      } else {
          rv = ssl3_CacheWrappedMasterSecret(ss, ss->sec.ci.sid,
                                     ss->ssl3.crSpec,
                                     effectiveExchKeyType);
          sid->u.ssl3.keys.msIsWrapped = PR_TRUE;
      }
      ssl_ReleaseSpecReadLock(ss);  /*************************************/

      /* If the wrap failed, we don't cache the sid.
       * The connection continues normally however.
       */
      if (rv == SECSuccess) {
          (*ss->sec.cache)(sid);
      }
    }
    ss->ssl3.hs.ws = idle_handshake;

    /* Do the handshake callback for sslv3 here. */
    if (ss->handshakeCallback != NULL) {
      (ss->handshakeCallback)(ss->fd, ss->handshakeCallbackData);
    }

    return SECSuccess;
}

/* Called from ssl3_HandleHandshake() when it has gathered a complete ssl3
 * hanshake message.
 * Caller must hold Handshake and RecvBuf locks.
 */
static SECStatus
ssl3_HandleHandshakeMessage(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
{
    SECStatus         rv      = SECSuccess;
    SSL3HandshakeType type    = ss->ssl3.hs.msg_type;
    SSL3Hashes        hashes; /* computed hashes are put here. */
    PRUint8           hdr[4];

    PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) );
    PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) );
    /*
     * We have to compute the hashes before we update them with the
     * current message.
     */
    ssl_GetSpecReadLock(ss);  /************************************/
    if((type == finished) || (type == certificate_verify)) {
      SSL3Sender      sender = (SSL3Sender)0;
      ssl3CipherSpec *rSpec  = ss->ssl3.prSpec;

      if (type == finished) {
          sender = ss->sec.isServer ? sender_client : sender_server;
          rSpec  = ss->ssl3.crSpec;
      }
      rv = ssl3_ComputeHandshakeHashes(ss, rSpec, &hashes, sender);
    }
    ssl_ReleaseSpecReadLock(ss); /************************************/
    if (rv != SECSuccess) {
      return rv;  /* error code was set by ssl3_ComputeHandshakeHashes*/
    }
    SSL_TRC(30,("%d: SSL3[%d]: handle handshake message: %s", SSL_GETPID(),
            ss->fd, ssl3_DecodeHandshakeType(ss->ssl3.hs.msg_type)));
    PRINT_BUF(60, (ss, "MD5 handshake hash:",
            (unsigned char*)ss->ssl3.hs.md5_cx, MD5_LENGTH));
    PRINT_BUF(95, (ss, "SHA handshake hash:",
            (unsigned char*)ss->ssl3.hs.sha_cx, SHA1_LENGTH));

    hdr[0] = (PRUint8)ss->ssl3.hs.msg_type;
    hdr[1] = (PRUint8)(length >> 16);
    hdr[2] = (PRUint8)(length >>  8);
    hdr[3] = (PRUint8)(length      );

    /* Start new handshake hashes when we start a new handshake */
    if (ss->ssl3.hs.msg_type == client_hello) {
      SSL_TRC(30,("%d: SSL3[%d]: reset handshake hashes",
            SSL_GETPID(), ss->fd ));
      rv = ssl3_RestartHandshakeHashes(ss);
      if (rv != SECSuccess) {
          return rv;
      }
    }
    /* We should not include hello_request messages in the handshake hashes */
    if (ss->ssl3.hs.msg_type != hello_request) {
      rv = ssl3_UpdateHandshakeHashes(ss, (unsigned char*) hdr, 4);
      if (rv != SECSuccess) return rv;    /* err code already set. */
      rv = ssl3_UpdateHandshakeHashes(ss, b, length);
      if (rv != SECSuccess) return rv;    /* err code already set. */
    }

    PORT_SetError(0);   /* each message starts with no error. */
    switch (ss->ssl3.hs.msg_type) {
    case hello_request:
      if (length != 0) {
          (void)ssl3_DecodeError(ss);
          PORT_SetError(SSL_ERROR_RX_MALFORMED_HELLO_REQUEST);
          return SECFailure;
      }
      if (ss->sec.isServer) {
          (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message);
          PORT_SetError(SSL_ERROR_RX_UNEXPECTED_HELLO_REQUEST);
          return SECFailure;
      }
      rv = ssl3_HandleHelloRequest(ss);
      break;
    case client_hello:
      if (!ss->sec.isServer) {
          (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message);
          PORT_SetError(SSL_ERROR_RX_UNEXPECTED_CLIENT_HELLO);
          return SECFailure;
      }
      rv = ssl3_HandleClientHello(ss, b, length);
      break;
    case server_hello:
      if (ss->sec.isServer) {
          (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message);
          PORT_SetError(SSL_ERROR_RX_UNEXPECTED_SERVER_HELLO);
          return SECFailure;
      }
      rv = ssl3_HandleServerHello(ss, b, length);
      break;
    case certificate:
      rv = ssl3_HandleCertificate(ss, b, length);
      break;
    case server_key_exchange:
      if (ss->sec.isServer) {
          (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message);
          PORT_SetError(SSL_ERROR_RX_UNEXPECTED_SERVER_KEY_EXCH);
          return SECFailure;
      }
      rv = ssl3_HandleServerKeyExchange(ss, b, length);
      break;
    case certificate_request:
      if (ss->sec.isServer) {
          (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message);
          PORT_SetError(SSL_ERROR_RX_UNEXPECTED_CERT_REQUEST);
          return SECFailure;
      }
      rv = ssl3_HandleCertificateRequest(ss, b, length);
      break;
    case server_hello_done:
      if (length != 0) {
          (void)ssl3_DecodeError(ss);
          PORT_SetError(SSL_ERROR_RX_MALFORMED_HELLO_DONE);
          return SECFailure;
      }
      if (ss->sec.isServer) {
          (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message);
          PORT_SetError(SSL_ERROR_RX_UNEXPECTED_HELLO_DONE);
          return SECFailure;
      }
      rv = ssl3_HandleServerHelloDone(ss);
      break;
    case certificate_verify:
      if (!ss->sec.isServer) {
          (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message);
          PORT_SetError(SSL_ERROR_RX_UNEXPECTED_CERT_VERIFY);
          return SECFailure;
      }
      rv = ssl3_HandleCertificateVerify(ss, b, length, &hashes);
      break;
    case client_key_exchange:
      if (!ss->sec.isServer) {
          (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message);
          PORT_SetError(SSL_ERROR_RX_UNEXPECTED_CLIENT_KEY_EXCH);
          return SECFailure;
      }
      rv = ssl3_HandleClientKeyExchange(ss, b, length);
      break;
    case new_session_ticket:
      if (ss->sec.isServer) {
          (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message);
          PORT_SetError(SSL_ERROR_RX_UNEXPECTED_NEW_SESSION_TICKET);
          return SECFailure;
      }
      rv = ssl3_HandleNewSessionTicket(ss, b, length);
      break;
    case finished:
        rv = ssl3_HandleFinished(ss, b, length, &hashes);
      break;
    default:
      (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message);
      PORT_SetError(SSL_ERROR_RX_UNKNOWN_HANDSHAKE);
      rv = SECFailure;
    }
    return rv;
}

/* Called only from ssl3_HandleRecord, for each (deciphered) ssl3 record.
 * origBuf is the decrypted ssl record content.
 * Caller must hold the handshake and RecvBuf locks.
 */
static SECStatus
ssl3_HandleHandshake(sslSocket *ss, sslBuffer *origBuf)
{
    /*
     * There may be a partial handshake message already in the handshake
     * state. The incoming buffer may contain another portion, or a
     * complete message or several messages followed by another portion.
     *
     * Each message is made contiguous before being passed to the actual
     * message parser.
     */
    sslBuffer *buf = &ss->ssl3.hs.msgState; /* do not lose the original buffer pointer */
    SECStatus rv;

    PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) );
    PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) );

    if (buf->buf == NULL) {
      *buf = *origBuf;
    }
    while (buf->len > 0) {
      if (ss->ssl3.hs.header_bytes < 4) {
          uint8 t;
          t = *(buf->buf++);
          buf->len--;
          if (ss->ssl3.hs.header_bytes++ == 0)
            ss->ssl3.hs.msg_type = (SSL3HandshakeType)t;
          else
            ss->ssl3.hs.msg_len = (ss->ssl3.hs.msg_len << 8) + t;
          if (ss->ssl3.hs.header_bytes < 4)
            continue;

#define MAX_HANDSHAKE_MSG_LEN 0x1ffff     /* 128k - 1 */
          if (ss->ssl3.hs.msg_len > MAX_HANDSHAKE_MSG_LEN) {
            (void)ssl3_DecodeError(ss);
            PORT_SetError(SSL_ERROR_RX_RECORD_TOO_LONG);
            return SECFailure;
          }
#undef MAX_HANDSHAKE_MSG_LEN

          /* If msg_len is zero, be sure we fall through, 
          ** even if buf->len is zero. 
          */
          if (ss->ssl3.hs.msg_len > 0) 
            continue;
      }

      /*
       * Header has been gathered and there is at least one byte of new
       * data available for this message. If it can be done right out
       * of the original buffer, then use it from there.
       */
      if (ss->ssl3.hs.msg_body.len == 0 && buf->len >= ss->ssl3.hs.msg_len) {
          /* handle it from input buffer */
          rv = ssl3_HandleHandshakeMessage(ss, buf->buf, ss->ssl3.hs.msg_len);
          if (rv == SECFailure) {
            /* This test wants to fall through on either
             * SECSuccess or SECWouldBlock.
             * ssl3_HandleHandshakeMessage MUST set the error code.
             */
            return rv;
          }
          buf->buf += ss->ssl3.hs.msg_len;
          buf->len -= ss->ssl3.hs.msg_len;
          ss->ssl3.hs.msg_len = 0;
          ss->ssl3.hs.header_bytes = 0;
          if (rv != SECSuccess) { /* return if SECWouldBlock. */
            return rv;
          }
      } else {
          /* must be copied to msg_body and dealt with from there */
          unsigned int bytes;

          PORT_Assert(ss->ssl3.hs.msg_body.len <= ss->ssl3.hs.msg_len);
          bytes = PR_MIN(buf->len, ss->ssl3.hs.msg_len - ss->ssl3.hs.msg_body.len);

          /* Grow the buffer if needed */
          rv = sslBuffer_Grow(&ss->ssl3.hs.msg_body, ss->ssl3.hs.msg_len);
          if (rv != SECSuccess) {
            /* sslBuffer_Grow has set a memory error code. */
            return SECFailure;
          }

          PORT_Memcpy(ss->ssl3.hs.msg_body.buf + ss->ssl3.hs.msg_body.len,
                    buf->buf, bytes);
          ss->ssl3.hs.msg_body.len += bytes;
          buf->buf += bytes;
          buf->len -= bytes;

          PORT_Assert(ss->ssl3.hs.msg_body.len <= ss->ssl3.hs.msg_len);

          /* if we have a whole message, do it */
          if (ss->ssl3.hs.msg_body.len == ss->ssl3.hs.msg_len) {
            rv = ssl3_HandleHandshakeMessage(
                ss, ss->ssl3.hs.msg_body.buf, ss->ssl3.hs.msg_len);
            /*
             * XXX This appears to be wrong.  This error handling
             * should clean up after a SECWouldBlock return, like the
             * error handling used 40 lines before/above this one,
             */
            if (rv != SECSuccess) {
                /* ssl3_HandleHandshakeMessage MUST set error code. */
                return rv;
            }
            ss->ssl3.hs.msg_body.len = 0;
            ss->ssl3.hs.msg_len      = 0;
            ss->ssl3.hs.header_bytes = 0;
          } else {
            PORT_Assert(buf->len == 0);
            break;
          }
      }
    } /* end loop */

    origBuf->len = 0;   /* So ssl3_GatherAppDataRecord will keep looping. */
    buf->buf = NULL;    /* not a leak. */
    return SECSuccess;
}

/* if cText is non-null, then decipher, check MAC, and decompress the
 * SSL record from cText->buf (typically gs->inbuf)
 * into databuf (typically gs->buf), and any previous contents of databuf
 * is lost.  Then handle databuf according to its SSL record type,
 * unless it's an application record.
 *
 * If cText is NULL, then the ciphertext has previously been deciphered and
 * checked, and is already sitting in databuf.  It is processed as an SSL
 * Handshake message.
 *
 * DOES NOT process the decrypted/decompressed application data.
 * On return, databuf contains the decrypted/decompressed record.
 *
 * Called from ssl3_GatherCompleteHandshake
 *             ssl3_RestartHandshakeAfterCertReq
 *             ssl3_RestartHandshakeAfterServerCert
 *
 * Caller must hold the RecvBufLock.
 *
 * This function aquires and releases the SSL3Handshake Lock, holding the
 * lock around any calls to functions that handle records other than
 * Application Data records.
 */
SECStatus
ssl3_HandleRecord(sslSocket *ss, SSL3Ciphertext *cText, sslBuffer *databuf)
{
const ssl3BulkCipherDef *cipher_def;
    ssl3CipherSpec *     crSpec;
    SECStatus            rv;
    unsigned int         hashBytes        = MAX_MAC_LENGTH + 1;
    unsigned int         padding_length;
    PRBool               isTLS;
    PRBool               padIsBad               = PR_FALSE;
    SSL3ContentType      rType;
    SSL3Opaque           hash[MAX_MAC_LENGTH];

    PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) );

    if (!ss->ssl3.initialized) {
      ssl_GetSSL3HandshakeLock(ss);
      rv = ssl3_InitState(ss);
      ssl_ReleaseSSL3HandshakeLock(ss);
      if (rv != SECSuccess) {
          return rv;          /* ssl3_InitState has set the error code. */
      }
    }

    /* check for Token Presence */
    if (!ssl3_ClientAuthTokenPresent(ss->sec.ci.sid)) {
      PORT_SetError(SSL_ERROR_TOKEN_INSERTION_REMOVAL);
      return SECFailure;
    }

    /* cText is NULL when we're called from ssl3_RestartHandshakeAfterXXX().
     * This implies that databuf holds a previously deciphered SSL Handshake
     * message.
     */
    if (cText == NULL) {
      SSL_DBG(("%d: SSL3[%d]: HandleRecord, resuming handshake",
             SSL_GETPID(), ss->fd));
      rType = content_handshake;
      goto process_it;
    }

    databuf->len = 0; /* filled in by decode call below. */
    if (databuf->space < MAX_FRAGMENT_LENGTH) {
      rv = sslBuffer_Grow(databuf, MAX_FRAGMENT_LENGTH + 2048);
      if (rv != SECSuccess) {
          SSL_DBG(("%d: SSL3[%d]: HandleRecord, tried to get %d bytes",
                 SSL_GETPID(), ss->fd, MAX_FRAGMENT_LENGTH + 2048));
          /* sslBuffer_Grow has set a memory error code. */
          /* Perhaps we should send an alert. (but we have no memory!) */
          return SECFailure;
      }
    }

    PRINT_BUF(80, (ss, "ciphertext:", cText->buf->buf, cText->buf->len));

    ssl_GetSpecReadLock(ss); /******************************************/

    crSpec = ss->ssl3.crSpec;
    cipher_def = crSpec->cipher_def;
    isTLS = (PRBool)(crSpec->version > SSL_LIBRARY_VERSION_3_0);

    if (isTLS && cText->buf->len > (MAX_FRAGMENT_LENGTH + 2048)) {
      ssl_ReleaseSpecReadLock(ss);
      SSL3_SendAlert(ss, alert_fatal, record_overflow);
      PORT_SetError(SSL_ERROR_RX_RECORD_TOO_LONG);
      return SECFailure;
    }
    /* decrypt from cText buf to databuf. */
    rv = crSpec->decode(
      crSpec->decodeContext, databuf->buf, (int *)&databuf->len,
      databuf->space, cText->buf->buf, cText->buf->len);

    PRINT_BUF(80, (ss, "cleartext:", databuf->buf, databuf->len));
    if (rv != SECSuccess) {
      int err = ssl_MapLowLevelError(SSL_ERROR_DECRYPTION_FAILURE);
      ssl_ReleaseSpecReadLock(ss);
      SSL3_SendAlert(ss, alert_fatal,
                     isTLS ? decryption_failed : bad_record_mac);
      PORT_SetError(err);
      return SECFailure;
    }

    /* If it's a block cipher, check and strip the padding. */
    if (cipher_def->type == type_block) {
      padding_length = *(databuf->buf + databuf->len - 1);
      /* TLS permits padding to exceed the block size, up to 255 bytes. */
      if (padding_length + 1 + crSpec->mac_size > databuf->len)
          padIsBad = PR_TRUE;
      /* if TLS, check value of first padding byte. */
      else if (padding_length && isTLS && 
               padding_length != 
                       *(databuf->buf + databuf->len - (padding_length + 1)))
          padIsBad = PR_TRUE;
      else
          databuf->len -= padding_length + 1;
    }

    /* Remove the MAC. */
    if (databuf->len >= crSpec->mac_size)
      databuf->len -= crSpec->mac_size;
    else
      padIsBad = PR_TRUE;     /* really macIsBad */

    /* compute the MAC */
    rType = cText->type;
    rv = ssl3_ComputeRecordMAC( crSpec, (PRBool)(!ss->sec.isServer),
      rType, cText->version, crSpec->read_seq_num, 
      databuf->buf, databuf->len, hash, &hashBytes);
    if (rv != SECSuccess) {
      int err = ssl_MapLowLevelError(SSL_ERROR_MAC_COMPUTATION_FAILURE);
      ssl_ReleaseSpecReadLock(ss);
      SSL3_SendAlert(ss, alert_fatal, bad_record_mac);
      PORT_SetError(err);
      return rv;
    }

    /* Check the MAC */
    if (hashBytes != (unsigned)crSpec->mac_size || padIsBad || 
      PORT_Memcmp(databuf->buf + databuf->len, hash, crSpec->mac_size) != 0) {
      /* must not hold spec lock when calling SSL3_SendAlert. */
      ssl_ReleaseSpecReadLock(ss);
      SSL3_SendAlert(ss, alert_fatal, bad_record_mac);
      /* always log mac error, in case attacker can read server logs. */
      PORT_SetError(SSL_ERROR_BAD_MAC_READ);

      SSL_DBG(("%d: SSL3[%d]: mac check failed", SSL_GETPID(), ss->fd));

      return SECFailure;
    }

    ssl3_BumpSequenceNumber(&crSpec->read_seq_num);

    ssl_ReleaseSpecReadLock(ss); /*****************************************/

    /*
     * The decrypted data is now in databuf.
     *
     * the null decompression routine is right here
     */

    /*
    ** Having completed the decompression, check the length again. 
    */
    if (isTLS && databuf->len > (MAX_FRAGMENT_LENGTH + 1024)) {
      SSL3_SendAlert(ss, alert_fatal, record_overflow);
      PORT_SetError(SSL_ERROR_RX_RECORD_TOO_LONG);
      return SECFailure;
    }

    /* Application data records are processed by the caller of this
    ** function, not by this function.
    */
    if (rType == content_application_data) {
      return SECSuccess;
    }

    /* It's a record that must be handled by ssl itself, not the application.
    */
process_it:
    /* XXX  Get the xmit lock here.  Odds are very high that we'll be xmiting
     * data ang getting the xmit lock here prevents deadlocks.
     */
    ssl_GetSSL3HandshakeLock(ss);

    /* All the functions called in this switch MUST set error code if
    ** they return SECFailure or SECWouldBlock.
    */
    switch (rType) {
    case content_change_cipher_spec:
      rv = ssl3_HandleChangeCipherSpecs(ss, databuf);
      break;
    case content_alert:
      rv = ssl3_HandleAlert(ss, databuf);
      break;
    case content_handshake:
      rv = ssl3_HandleHandshake(ss, databuf);
      break;
    /*
    case content_application_data is handled before this switch
    */
    default:
      SSL_DBG(("%d: SSL3[%d]: bogus content type=%d",
             SSL_GETPID(), ss->fd, cText->type));
      /* XXX Send an alert ???  */
      PORT_SetError(SSL_ERROR_RX_UNKNOWN_RECORD_TYPE);
      rv = SECFailure;
      break;
    }

    ssl_ReleaseSSL3HandshakeLock(ss);
    return rv;

}

/*
 * Initialization functions
 */

/* Called from ssl3_InitState, immediately below. */
/* Caller must hold the SpecWriteLock. */
static void
ssl3_InitCipherSpec(sslSocket *ss, ssl3CipherSpec *spec)
{
    spec->cipher_def               = &bulk_cipher_defs[cipher_null];
    PORT_Assert(spec->cipher_def->cipher == cipher_null);
    spec->mac_def                  = &mac_defs[mac_null];
    PORT_Assert(spec->mac_def->mac == mac_null);
    spec->encode                   = Null_Cipher;
    spec->decode                   = Null_Cipher;
    spec->destroy                  = NULL;
    spec->mac_size                 = 0;
    spec->master_secret            = NULL;
    spec->bypassCiphers            = PR_FALSE;

    spec->msItem.data              = NULL;
    spec->msItem.len               = 0;

    spec->client.write_key         = NULL;
    spec->client.write_mac_key     = NULL;
    spec->client.write_mac_context = NULL;

    spec->server.write_key         = NULL;
    spec->server.write_mac_key     = NULL;
    spec->server.write_mac_context = NULL;

    spec->write_seq_num.high       = 0;
    spec->write_seq_num.low        = 0;

    spec->read_seq_num.high        = 0;
    spec->read_seq_num.low         = 0;

    spec->version                  = ss->opt.enableTLS
                                          ? SSL_LIBRARY_VERSION_3_1_TLS
                                          : SSL_LIBRARY_VERSION_3_0;
}

/* Called from:   ssl3_SendRecord
**          ssl3_StartHandshakeHash() <- ssl2_BeginClientHandshake()
**          ssl3_SendClientHello()
**          ssl3_HandleServerHello()
**          ssl3_HandleClientHello()
**          ssl3_HandleV2ClientHello()
**          ssl3_HandleRecord()
**
** This function should perhaps acquire and release the SpecWriteLock.
**
**
*/
static SECStatus
ssl3_InitState(sslSocket *ss)
{
    SECStatus    rv;
    PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss));

    if (ss->ssl3.initialized)
      return SECSuccess;      /* Function should be idempotent */

    ss->ssl3.policy = SSL_ALLOWED;

    ssl_GetSpecWriteLock(ss);
    ss->ssl3.crSpec = ss->ssl3.cwSpec = &ss->ssl3.specs[0];
    ss->ssl3.prSpec = ss->ssl3.pwSpec = &ss->ssl3.specs[1];
    ss->ssl3.hs.rehandshake = PR_FALSE;
    ssl3_InitCipherSpec(ss, ss->ssl3.crSpec);
    ssl3_InitCipherSpec(ss, ss->ssl3.prSpec);

    ss->ssl3.hs.ws = (ss->sec.isServer) ? wait_client_hello : wait_server_hello;
#ifdef NSS_ENABLE_ECC
    ss->ssl3.hs.negotiatedECCurves = SSL3_SUPPORTED_CURVES_MASK;
#endif
    ssl_ReleaseSpecWriteLock(ss);

    PORT_Memset(&ss->xtnData, 0, sizeof(TLSExtensionData));

    rv = ssl3_NewHandshakeHashes(ss);
    if (rv == SECSuccess) {
      ss->ssl3.initialized = PR_TRUE;
    }

    return rv;
}

/* Returns a reference counted object that contains a key pair.
 * Or NULL on failure.  Initial ref count is 1.
 * Uses the keys in the pair as input.
 */
ssl3KeyPair *
ssl3_NewKeyPair( SECKEYPrivateKey * privKey, SECKEYPublicKey * pubKey)
{
    ssl3KeyPair * pair;

    if (!privKey || !pubKey) {
      PORT_SetError(PR_INVALID_ARGUMENT_ERROR);
      return NULL;
    }
    pair = PORT_ZNew(ssl3KeyPair);
    if (!pair)
      return NULL;                  /* error code is set. */
    pair->refCount = 1;
    pair->privKey  = privKey;
    pair->pubKey   = pubKey;
    return pair;              /* success */
}

ssl3KeyPair *
ssl3_GetKeyPairRef(ssl3KeyPair * keyPair)
{
    PR_AtomicIncrement(&keyPair->refCount);
    return keyPair;
}

void
ssl3_FreeKeyPair(ssl3KeyPair * keyPair)
{
    PRInt32 newCount =  PR_AtomicDecrement(&keyPair->refCount);
    if (!newCount) {
      if (keyPair->privKey)
          SECKEY_DestroyPrivateKey(keyPair->privKey);
      if (keyPair->pubKey)
          SECKEY_DestroyPublicKey( keyPair->pubKey);
      PORT_Free(keyPair);
    }
}



/*
 * Creates the public and private RSA keys for SSL Step down.
 * Called from SSL_ConfigSecureServer in sslsecur.c
 */
SECStatus
ssl3_CreateRSAStepDownKeys(sslSocket *ss)
{
    SECStatus             rv         = SECSuccess;
    SECKEYPrivateKey *    privKey;        /* RSA step down key */
    SECKEYPublicKey *     pubKey;         /* RSA step down key */

    if (ss->stepDownKeyPair)
      ssl3_FreeKeyPair(ss->stepDownKeyPair);
    ss->stepDownKeyPair = NULL;
#ifndef HACKED_EXPORT_SERVER
    /* Sigh, should have a get key strength call for private keys */
    if (PK11_GetPrivateModulusLen(ss->serverCerts[kt_rsa].SERVERKEY) >
                                                     EXPORT_RSA_KEY_LENGTH) {
      /* need to ask for the key size in bits */
      privKey = SECKEY_CreateRSAPrivateKey(EXPORT_RSA_KEY_LENGTH * BPB,
                                   &pubKey, NULL);
      if (!privKey || !pubKey ||
          !(ss->stepDownKeyPair = ssl3_NewKeyPair(privKey, pubKey))) {
          ssl_MapLowLevelError(SEC_ERROR_KEYGEN_FAIL);
          rv = SECFailure;
      }
    }
#endif
    return rv;
}


/* record the export policy for this cipher suite */
SECStatus
ssl3_SetPolicy(ssl3CipherSuite which, int policy)
{
    ssl3CipherSuiteCfg *suite;

    suite = ssl_LookupCipherSuiteCfg(which, cipherSuites);
    if (suite == NULL) {
      return SECFailure; /* err code was set by ssl_LookupCipherSuiteCfg */
    }
    suite->policy = policy;

    if (policy == SSL_RESTRICTED) {
      ssl3_global_policy_some_restricted = PR_TRUE;
    }

    return SECSuccess;
}

SECStatus
ssl3_GetPolicy(ssl3CipherSuite which, PRInt32 *oPolicy)
{
    ssl3CipherSuiteCfg *suite;
    PRInt32             policy;
    SECStatus           rv;

    suite = ssl_LookupCipherSuiteCfg(which, cipherSuites);
    if (suite) {
      policy = suite->policy;
      rv     = SECSuccess;
    } else {
      policy = SSL_NOT_ALLOWED;
      rv     = SECFailure;    /* err code was set by Lookup. */
    }
    *oPolicy = policy;
    return rv;
}

/* record the user preference for this suite */
SECStatus
ssl3_CipherPrefSetDefault(ssl3CipherSuite which, PRBool enabled)
{
    ssl3CipherSuiteCfg *suite;

    suite = ssl_LookupCipherSuiteCfg(which, cipherSuites);
    if (suite == NULL) {
      return SECFailure; /* err code was set by ssl_LookupCipherSuiteCfg */
    }
    suite->enabled = enabled;
    return SECSuccess;
}

/* return the user preference for this suite */
SECStatus
ssl3_CipherPrefGetDefault(ssl3CipherSuite which, PRBool *enabled)
{
    ssl3CipherSuiteCfg *suite;
    PRBool              pref;
    SECStatus           rv;

    suite = ssl_LookupCipherSuiteCfg(which, cipherSuites);
    if (suite) {
      pref   = suite->enabled;
      rv     = SECSuccess;
    } else {
      pref   = SSL_NOT_ALLOWED;
      rv     = SECFailure;    /* err code was set by Lookup. */
    }
    *enabled = pref;
    return rv;
}

SECStatus
ssl3_CipherPrefSet(sslSocket *ss, ssl3CipherSuite which, PRBool enabled)
{
    ssl3CipherSuiteCfg *suite;

    suite = ssl_LookupCipherSuiteCfg(which, ss->cipherSuites);
    if (suite == NULL) {
      return SECFailure; /* err code was set by ssl_LookupCipherSuiteCfg */
    }
    suite->enabled = enabled;
    return SECSuccess;
}

SECStatus
ssl3_CipherPrefGet(sslSocket *ss, ssl3CipherSuite which, PRBool *enabled)
{
    ssl3CipherSuiteCfg *suite;
    PRBool              pref;
    SECStatus           rv;

    suite = ssl_LookupCipherSuiteCfg(which, ss->cipherSuites);
    if (suite) {
      pref   = suite->enabled;
      rv     = SECSuccess;
    } else {
      pref   = SSL_NOT_ALLOWED;
      rv     = SECFailure;    /* err code was set by Lookup. */
    }
    *enabled = pref;
    return rv;
}

/* copy global default policy into socket. */
void
ssl3_InitSocketPolicy(sslSocket *ss)
{
    PORT_Memcpy(ss->cipherSuites, cipherSuites, sizeof cipherSuites);
}

/* ssl3_config_match_init must have already been called by
 * the caller of this function.
 */
SECStatus
ssl3_ConstructV2CipherSpecsHack(sslSocket *ss, unsigned char *cs, int *size)
{
    int i, count = 0;

    PORT_Assert(ss != 0);
    if (!ss) {
      PORT_SetError(PR_INVALID_ARGUMENT_ERROR);
      return SECFailure;
    }
    if (!ss->opt.enableSSL3 && !ss->opt.enableTLS) {
      *size = 0;
      return SECSuccess;
    }
    if (cs == NULL) {
      *size = count_cipher_suites(ss, SSL_ALLOWED, PR_TRUE);
      return SECSuccess;
    }

    /* ssl3_config_match_init was called by the caller of this function. */
    for (i = 0; i < ssl_V3_SUITES_IMPLEMENTED; i++) {
      ssl3CipherSuiteCfg *suite = &ss->cipherSuites[i];
      if (config_match(suite, SSL_ALLOWED, PR_TRUE)) {
          if (cs != NULL) {
            *cs++ = 0x00;
            *cs++ = (suite->cipher_suite >> 8) & 0xFF;
            *cs++ =  suite->cipher_suite       & 0xFF;
          }
          count++;
      }
    }
    *size = count;
    return SECSuccess;
}

/*
** If ssl3 socket has completed the first handshake, and is in idle state, 
** then start a new handshake.
** If flushCache is true, the SID cache will be flushed first, forcing a
** "Full" handshake (not a session restart handshake), to be done.
**
** called from SSL_RedoHandshake(), which already holds the handshake locks.
*/
SECStatus
ssl3_RedoHandshake(sslSocket *ss, PRBool flushCache)
{
    sslSessionID *   sid = ss->sec.ci.sid;
    SECStatus        rv;

    PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) );

    if (!ss->firstHsDone ||
        ((ss->version >= SSL_LIBRARY_VERSION_3_0) &&
       ss->ssl3.initialized && 
       (ss->ssl3.hs.ws != idle_handshake))) {
      PORT_SetError(SSL_ERROR_HANDSHAKE_NOT_COMPLETED);
      return SECFailure;
    }
    if (sid && flushCache) {
      ss->sec.uncache(sid);   /* remove it from whichever cache it's in. */
      ssl_FreeSID(sid); /* dec ref count and free if zero. */
      ss->sec.ci.sid = NULL;
    }

    ssl_GetXmitBufLock(ss);   /**************************************/

    /* start off a new handshake. */
    rv = (ss->sec.isServer) ? ssl3_SendHelloRequest(ss)
                            : ssl3_SendClientHello(ss);

    ssl_ReleaseXmitBufLock(ss);     /**************************************/
    return rv;
}

/* Called from ssl_DestroySocketContents() in sslsock.c */
void
ssl3_DestroySSL3Info(sslSocket *ss)
{

    if (ss->ssl3.clientCertificate != NULL)
      CERT_DestroyCertificate(ss->ssl3.clientCertificate);

    if (ss->ssl3.clientPrivateKey != NULL)
      SECKEY_DestroyPrivateKey(ss->ssl3.clientPrivateKey);

    if (ss->ssl3.peerCertArena != NULL)
      ssl3_CleanupPeerCerts(ss);

    if (ss->ssl3.clientCertChain != NULL) {
       CERT_DestroyCertificateList(ss->ssl3.clientCertChain);
       ss->ssl3.clientCertChain = NULL;
    }

    /* clean up handshake */
    if (ss->opt.bypassPKCS11) {
      SHA1_DestroyContext((SHA1Context *)ss->ssl3.hs.sha_cx, PR_FALSE);
      MD5_DestroyContext((MD5Context *)ss->ssl3.hs.md5_cx, PR_FALSE);
    } 
    if (ss->ssl3.hs.md5) {
      PK11_DestroyContext(ss->ssl3.hs.md5,PR_TRUE);
    }
    if (ss->ssl3.hs.sha) {
      PK11_DestroyContext(ss->ssl3.hs.sha,PR_TRUE);
    }
    if (ss->ssl3.hs.messages.buf) {
      PORT_Free(ss->ssl3.hs.messages.buf);
      ss->ssl3.hs.messages.buf = NULL;
      ss->ssl3.hs.messages.len = 0;
      ss->ssl3.hs.messages.space = 0;
    }

    /* free the SSL3Buffer (msg_body) */
    PORT_Free(ss->ssl3.hs.msg_body.buf);

    /* free up the CipherSpecs */
    ssl3_DestroyCipherSpec(&ss->ssl3.specs[0]);
    ssl3_DestroyCipherSpec(&ss->ssl3.specs[1]);

    ss->ssl3.initialized = PR_FALSE;
}

/* End of ssl3con.c */

Generated by  Doxygen 1.6.0   Back to index