Remove the TLS Snap Start code from NSS.

net/third_party/nss/ssl/ssl3con.c

 /*
  * SSL3 Protocol
  *
  * ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
  * The contents of this file are subject to the Mozilla Public License Version
  * 1.1 (the "License"); you may not use this file except in compliance with
  * the License. You may obtain a copy of the License at
  * http://www.mozilla.org/MPL/
@@ skipping 54 matching lines @@
 #ifdef NSS_ENABLE_ZLIB
 #include "zlib.h"
 #endif
 
 #ifndef PK11_SETATTRS
 #define PK11_SETATTRS(x,id,v,l) (x)->type = (id); \
                 (x)->pValue=(v); (x)->ulValueLen = (l);
 #endif
 
 static void      ssl3_CleanupPeerCerts(sslSocket *ss);
-static void      ssl3_CopyPeerCertsToSID(ssl3CertNode *certs,
-                                         sslSessionID *sid);
+static void      ssl3_CopyPeerCertsFromSID(sslSocket *ss, sslSessionID *sid);
 static PK11SymKey *ssl3_GenerateRSAPMS(sslSocket *ss, ssl3CipherSpec *spec,
                                        PK11SlotInfo * serverKeySlot);
 static SECStatus ssl3_DeriveMasterSecret(sslSocket *ss, PK11SymKey *pms);
 static SECStatus ssl3_DeriveConnectionKeysPKCS11(sslSocket *ss);
 static SECStatus ssl3_HandshakeFailure(      sslSocket *ss);
 static SECStatus ssl3_InitState(             sslSocket *ss);
 static SECStatus ssl3_SendCertificate(       sslSocket *ss);
 static SECStatus ssl3_SendEmptyCertificate(  sslSocket *ss);
 static SECStatus ssl3_SendCertificateRequest(sslSocket *ss);
+static SECStatus ssl3_SendNextProto(         sslSocket *ss);
+static SECStatus ssl3_SendFinished(          sslSocket *ss, PRInt32 flags);
 static SECStatus ssl3_SendServerHello(       sslSocket *ss);
 static SECStatus ssl3_SendServerHelloDone(   sslSocket *ss);
 static SECStatus ssl3_SendServerKeyExchange( sslSocket *ss);
 static SECStatus ssl3_NewHandshakeHashes(    sslSocket *ss);
+static SECStatus ssl3_UpdateHandshakeHashes( sslSocket *ss, unsigned char *b, 
+                                             unsigned int l);
 
 static SECStatus Null_Cipher(void *ctx, unsigned char *output, int *outputLen,
                              int maxOutputLen, const unsigned char *input,
                              int inputLen);
 
 #define MAX_SEND_BUF_LENGTH 32000 /* watch for 16-bit integer overflow */
 #define MIN_SEND_BUF_LENGTH  4000
 
 #define MAX_CIPHER_SUITES 20
 
@@ skipping 473 matching lines @@
         PR_ATOMIC_INCREMENT((PRInt32 *)x);
     } else {
         tooLong * tl = (tooLong *)x;
         if (PR_ATOMIC_INCREMENT(&tl->low) == 0)
             PR_ATOMIC_INCREMENT(&tl->high);
     }
 }
 
 /* return pointer to ssl3CipherSuiteDef for suite, or NULL */
 /* XXX This does a linear search.  A binary search would be better. */
-const ssl3CipherSuiteDef *
+static const ssl3CipherSuiteDef *
 ssl_LookupCipherSuiteDef(ssl3CipherSuite suite)
 {
     int cipher_suite_def_len =
         sizeof(cipher_suite_defs) / sizeof(cipher_suite_defs[0]);
     int i;
 
     for (i = 0; i < cipher_suite_def_len; i++) {
         if (cipher_suite_defs[i].cipher_suite == suite)
             return &cipher_suite_defs[i];
     }
@@ skipping 565 matching lines @@
         PK11_DestroyContext(mat->write_mac_context, PR_TRUE);
         mat->write_mac_context = NULL;
     }
 }
 
 /* Called from ssl3_SendChangeCipherSpecs() and 
 **             ssl3_HandleChangeCipherSpecs()
 **             ssl3_DestroySSL3Info
 ** Caller must hold SpecWriteLock.
 */
-void
+static void
 ssl3_DestroyCipherSpec(ssl3CipherSpec *spec, PRBool freeSrvName)
 {
     PRBool freeit = (PRBool)(!spec->bypassCiphers);
 /*  PORT_Assert( ss->opt.noLocks || ssl_HaveSpecWriteLock(ss)); Don't have ss! */
     if (spec->destroy) {
         spec->destroy(spec->encodeContext, freeit);
         spec->destroy(spec->decodeContext, freeit);
         spec->encodeContext = NULL; /* paranoia */
         spec->decodeContext = NULL;
     }
@@ skipping 21 matching lines @@
     spec->destroyCompressContext = NULL;
     spec->destroyDecompressContext = NULL;
 }
 
 /* Fill in the pending cipher spec with info from the selected ciphersuite.
 ** This is as much initialization as we can do without having key material.
 ** Called from ssl3_HandleServerHello(), ssl3_SendServerHello()
 ** Caller must hold the ssl3 handshake lock.
 ** Acquires & releases SpecWriteLock.
 */
-SECStatus
+static SECStatus
 ssl3_SetupPendingCipherSpec(sslSocket *ss)
 {
     ssl3CipherSpec *          pwSpec;
     ssl3CipherSpec *          cwSpec;
     ssl3CipherSuite           suite     = ss->ssl3.hs.cipher_suite;
     SSL3MACAlgorithm          mac;
     SSL3BulkCipher            cipher;
     SSL3KeyExchangeAlgorithm  kea;
     const ssl3CipherSuiteDef *suite_def;
     PRBool                    isTLS;
@@ skipping 811 matching lines @@
         (PK11_NeedLogin(slot) && !PK11_IsLoggedIn(slot, NULL))) {
         isPresent = PR_FALSE;
     } 
     if (slot) {
         PK11_FreeSlot(slot);
     }
     return isPresent;
 #endif /* NSS_PLATFORM_CLIENT_AUTH */
 }
 
-SECStatus
+static SECStatus
 ssl3_CompressMACEncryptRecord(sslSocket *        ss,
                               SSL3ContentType    type,
                               const SSL3Opaque * pIn,
                               PRUint32           contentLen)
 {
     ssl3CipherSpec *          cwSpec;
     const ssl3BulkCipherDef * cipher_def;
     sslBuffer      *          wrBuf       = &ss->sec.writeBuf;
     SECStatus                 rv;
     PRUint32                  macLen      = 0;
@@ skipping 1041 matching lines @@
     PK11_FreeSymKey(symKey);
     return SECSuccess;
 
 
 loser:
     if (symKey) PK11_FreeSymKey(symKey);
     ssl_MapLowLevelError(SSL_ERROR_SESSION_KEY_GEN_FAILURE);
     return SECFailure;
 }
 
-SECStatus
+static SECStatus 
 ssl3_RestartHandshakeHashes(sslSocket *ss)
 {
     SECStatus rv = SECSuccess;
 
     if (ss->opt.bypassPKCS11) {
         ss->ssl3.hs.messages.len = 0;
         MD5_Begin((MD5Context *)ss->ssl3.hs.md5_cx);
         SHA1_Begin((SHA1Context *)ss->ssl3.hs.sha_cx);
     } else {
         rv = PK11_DigestBegin(ss->ssl3.hs.md5);
@@ skipping 57 matching lines @@
 
 /*
  * Handshake messages
  */
 /* Called from  ssl3_AppendHandshake()
 **              ssl3_StartHandshakeHash()
 **              ssl3_HandleV2ClientHello()
 **              ssl3_HandleHandshakeMessage()
 ** Caller must hold the ssl3Handshake lock.
 */
-SECStatus
+static SECStatus
 ssl3_UpdateHandshakeHashes(sslSocket *ss, unsigned char *b, unsigned int l)
 {
     SECStatus  rv = SECSuccess;
 
     PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) );
 
     PRINT_BUF(90, (NULL, "MD5 & SHA handshake hash input:", b, l));
 
     if (ss->opt.bypassPKCS11) {
         MD5_Update((MD5Context *)ss->ssl3.hs.md5_cx, b, l);
@@ skipping 238 matching lines @@
 
 /* Extract the hashes of handshake messages to this point.
  * Called from ssl3_SendCertificateVerify
  *             ssl3_SendFinished
  *             ssl3_HandleHandshakeMessage
  *
  * Caller must hold the SSL3HandshakeLock.
  * Caller must hold a read or write lock on the Spec R/W lock.
  *      (There is presently no way to assert on a Read lock.)
  */
-SECStatus
+static SECStatus
 ssl3_ComputeHandshakeHashes(sslSocket *     ss,
                             ssl3CipherSpec *spec,   /* uses ->master_secret */
                             SSL3Hashes *    hashes, /* output goes here. */
                             PRUint32        sender)
 {
     SECStatus     rv        = SECSuccess;
     PRBool        isTLS     = (PRBool)(spec->version > SSL_LIBRARY_VERSION_3_0);
     unsigned int  outLength;
     SSL3Opaque    md5_inner[MAX_MAC_LENGTH];
     SSL3Opaque    sha_inner[MAX_MAC_LENGTH];
@@ skipping 577 matching lines @@
         TLSExtensionData *xtnData = &ss->xtnData;
         xtnData->advertised[xtnData->numAdvertised++] = 
             ssl_renegotiation_info_xtn;
     }
 
     rv = ssl3_FlushHandshake(ss, 0);
     if (rv != SECSuccess) {
         return rv;      /* error code set by ssl3_FlushHandshake */
     }
 
-    switch (ss->ssl3.hs.snapStartType) {
-    case snap_start_full:
-        ss->ssl3.hs.ws = wait_new_session_ticket;
-        break;
-    case snap_start_resume:
-        ss->ssl3.hs.ws = wait_change_cipher;
-        break;
-    default:
-        ss->ssl3.hs.ws = wait_server_hello;
-        break;
-    }
-
+    ss->ssl3.hs.ws = wait_server_hello;
     return rv;
 }
 
 
 /* Called from ssl3_HandleHandshakeMessage() when it has deciphered a complete
  * ssl3 Hello Request.
  * Caller must hold Handshake and RecvBuf locks.
  */
 static SECStatus
 ssl3_HandleHelloRequest(sslSocket *ss)
@@ skipping 670 matching lines @@
     if(privKey) SECKEY_DestroyPrivateKey(privKey);
     if(pubKey) SECKEY_DestroyPublicKey(pubKey);
     return rv;
 }
 
 
 
 
 
 /* Called from ssl3_HandleServerHelloDone(). */
-SECStatus
+static SECStatus
 ssl3_SendClientKeyExchange(sslSocket *ss)
 {
     SECKEYPublicKey *   serverKey       = NULL;
     SECStatus           rv              = SECFailure;
     PRBool              isTLS;
 
     SSL_TRC(3, ("%d: SSL3[%d]: send client_key_exchange handshake",
                 SSL_GETPID(), ss->fd));
 
     PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss));
@@ skipping 119 matching lines @@
     if (rv != SECSuccess) {
         goto done;      /* error code set by AppendHandshake */
     }
 
 done:
     if (buf.data)
         PORT_Free(buf.data);
     return rv;
 }
 
-/* Called from ssl3_HandleServerHello to set up the master secret in
- * ss->ssl3.pwSpec and the auth algorithm and kea type in ss->sec in the case
- * of a successful session resumption. */
-SECStatus ssl3_SetupMasterSecretFromSessionID(sslSocket* ss) {
-    sslSessionID *sid = ss->sec.ci.sid;
-    ssl3CipherSpec *pwSpec = ss->ssl3.pwSpec;
-    SECItem wrappedMS;   /* wrapped master secret. */
-
-    ss->sec.authAlgorithm = sid->authAlgorithm;
-    ss->sec.authKeyBits   = sid->authKeyBits;
-    ss->sec.keaType       = sid->keaType;
-    ss->sec.keaKeyBits    = sid->keaKeyBits;
-
-    /* 3 cases here:
-     * a) key is wrapped (implies using PKCS11)
-     * b) key is unwrapped, but we're still using PKCS11
-     * c) key is unwrapped, and we're bypassing PKCS11.
-     */
-    if (sid->u.ssl3.keys.msIsWrapped) {
-        PK11SlotInfo *slot;
-        PK11SymKey *  wrapKey;     /* wrapping key */
-        CK_FLAGS      keyFlags      = 0;
-
-        if (ss->opt.bypassPKCS11) {
-            /* we cannot restart a non-bypass session in a
-            ** bypass socket.
-            */
-            return SECFailure;
-        }
-        /* unwrap master secret with PKCS11 */
-        slot = SECMOD_LookupSlot(sid->u.ssl3.masterModuleID,
-                                 sid->u.ssl3.masterSlotID);
-        if (slot == NULL) {
-            return SECFailure;
-        }
-        if (!PK11_IsPresent(slot)) {
-            PK11_FreeSlot(slot);
-            return SECFailure;
-        }
-        wrapKey = PK11_GetWrapKey(slot, sid->u.ssl3.masterWrapIndex,
-                                  sid->u.ssl3.masterWrapMech,
-                                  sid->u.ssl3.masterWrapSeries,
-                                  ss->pkcs11PinArg);
-        PK11_FreeSlot(slot);
-        if (wrapKey == NULL) {
-            return SECFailure;
-        }
-
-        if (ss->version > SSL_LIBRARY_VERSION_3_0) {    /* isTLS */
-            keyFlags = CKF_SIGN | CKF_VERIFY;
-        }
-
-        wrappedMS.data = sid->u.ssl3.keys.wrapped_master_secret;
-        wrappedMS.len  = sid->u.ssl3.keys.wrapped_master_secret_len;
-        pwSpec->master_secret =
-            PK11_UnwrapSymKeyWithFlags(wrapKey, sid->u.ssl3.masterWrapMech,
-                        NULL, &wrappedMS, CKM_SSL3_MASTER_KEY_DERIVE,
-                        CKA_DERIVE, sizeof(SSL3MasterSecret), keyFlags);
-        PK11_FreeSymKey(wrapKey);
-        if (pwSpec->master_secret == NULL) {
-            return SECFailure;
-        }
-    } else if (ss->opt.bypassPKCS11) {
-        /* MS is not wrapped */
-        wrappedMS.data = sid->u.ssl3.keys.wrapped_master_secret;
-        wrappedMS.len  = sid->u.ssl3.keys.wrapped_master_secret_len;
-        memcpy(pwSpec->raw_master_secret, wrappedMS.data, wrappedMS.len);
-        pwSpec->msItem.data = pwSpec->raw_master_secret;
-        pwSpec->msItem.len  = wrappedMS.len;
-    } else {
-        /* We CAN restart a bypass session in a non-bypass socket. */
-        /* need to import the raw master secret to session object */
-        PK11SlotInfo *slot = PK11_GetInternalSlot();
-        wrappedMS.data = sid->u.ssl3.keys.wrapped_master_secret;
-        wrappedMS.len  = sid->u.ssl3.keys.wrapped_master_secret_len;
-        pwSpec->master_secret =
-            PK11_ImportSymKey(slot, CKM_SSL3_MASTER_KEY_DERIVE,
-                              PK11_OriginUnwrap, CKA_ENCRYPT,
-                              &wrappedMS, NULL);
-        PK11_FreeSlot(slot);
-        if (pwSpec->master_secret == NULL) {
-            return SECFailure;
-        }
-    }
-
-    return SECSuccess;
-}
-
 /* Called from ssl3_HandleHandshakeMessage() when it has deciphered a complete
  * ssl3 ServerHello message.
  * Caller must hold Handshake and RecvBuf locks.
  */
 static SECStatus
 ssl3_HandleServerHello(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
 {
     sslSessionID *sid           = ss->sec.ci.sid;
     PRInt32       temp;         /* allow for consume number failure */
     PRBool        suite_found   = PR_FALSE;
     int           i;
     int           errCode       = SSL_ERROR_RX_MALFORMED_SERVER_HELLO;
     SECStatus     rv;
     SECItem       sidBytes      = {siBuffer, NULL, 0};
     PRBool        sid_match;
     PRBool        isTLS         = PR_FALSE;
     SSL3AlertDescription desc   = illegal_parameter;
     SSL3ProtocolVersion version;
 
     SSL_TRC(3, ("%d: SSL3[%d]: handle server_hello handshake",
         SSL_GETPID(), ss->fd));
     PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) );
     PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) );
 
-    if (ss->ssl3.hs.snapStartType == snap_start_full ||
-        ss->ssl3.hs.snapStartType == snap_start_resume) {
-        /* Snap Start handshake was rejected. */
-        rv = ssl3_ResetForSnapStartRecovery(ss, b, length);
-        if (rv != SECSuccess)
-            return rv;
-    }
-
     rv = ssl3_InitState(ss);
     if (rv != SECSuccess) {
         errCode = PORT_GetError(); /* ssl3_InitState has set the error code. */
         goto alert_loser;
     }
     if (ss->ssl3.hs.ws != wait_server_hello) {
         errCode = SSL_ERROR_RX_UNEXPECTED_SERVER_HELLO;
         desc    = unexpected_message;
         goto alert_loser;
     }
@@ skipping 11 matching lines @@
        SECKEY_DestroyPrivateKey(ss->ssl3.clientPrivateKey);
        ss->ssl3.clientPrivateKey = NULL;
     }
 #ifdef NSS_PLATFORM_CLIENT_AUTH
     if (ss->ssl3.platformClientKey) {
        ssl_FreePlatformKey(ss->ssl3.platformClientKey);
        ss->ssl3.platformClientKey = (PlatformKey)NULL;
     }
 #endif  /* NSS_PLATFORM_CLIENT_AUTH */
 
-    if (ss->ssl3.serverHelloPredictionData.data)
-        SECITEM_FreeItem(&ss->ssl3.serverHelloPredictionData, PR_FALSE);
-
-    /* If this allocation fails it will only stop the application from
-     * recording the ServerHello information and performing future Snap
-     * Starts. */
-    if (SECITEM_AllocItem(NULL, &ss->ssl3.serverHelloPredictionData, length))
-        memcpy(ss->ssl3.serverHelloPredictionData.data, b, length);
-    /* ss->ssl3.serverHelloPredictionDataValid is still false at this
-     * point. We have to record the contents of the ServerHello here
-     * because we don't have a pointer to the whole message when handling
-     * the extensions. However, we wait until the Snap Start extension
-     * handler to recognise that the server supports Snap Start and to set
-     * serverHelloPredictionDataValid. */
-
     temp = ssl3_ConsumeHandshakeNumber(ss, 2, &b, &length);
     if (temp < 0) {
         goto loser;     /* alert has been sent */
     }
     version = (SSL3ProtocolVersion)temp;
 
     /* this is appropriate since the negotiation is complete, and we only
     ** know SSL 3.x.
     */
     if (MSB(version) != MSB(SSL_LIBRARY_VERSION_3_0)) {
@@ skipping 120 matching lines @@
      * not and if so it may match the one we sent.
      * Attempt to restore the master secret to see if this is so...
      * Don't consider failure to find a matching SID an error.
      */
     sid_match = (PRBool)(sidBytes.len > 0 &&
         sidBytes.len == sid->u.ssl3.sessionIDLength &&
         !PORT_Memcmp(sid->u.ssl3.sessionID, sidBytes.data, sidBytes.len));
 
     if (sid_match &&
         sid->version == ss->version &&
-        sid->u.ssl3.cipherSuite == ss->ssl3.hs.cipher_suite) {
-        rv = ssl3_SetupMasterSecretFromSessionID(ss);
-        /* Failure of ssl3_SetupMasterSecretFromSessionID not considered an
-         * error.  Continue with a full handshake. */
-        if (rv == SECSuccess) {
-            /* Got a Match */
-            SSL_AtomicIncrementLong(& ssl3stats.hsh_sid_cache_hits );
+        sid->u.ssl3.cipherSuite == ss->ssl3.hs.cipher_suite) do {
+        ssl3CipherSpec *pwSpec = ss->ssl3.pwSpec;
 
-            /* If we sent a session ticket, then this is a stateless resume. */
-            if (sid->version > SSL_LIBRARY_VERSION_3_0 &&
-                sid->u.ssl3.sessionTicket.ticket.data != NULL)
-                SSL_AtomicIncrementLong(& ssl3stats.hsh_sid_stateless_resumes );
+        SECItem       wrappedMS;   /* wrapped master secret. */
 
-            if (ssl3_ExtensionNegotiated(ss, ssl_session_ticket_xtn))
-                ss->ssl3.hs.ws = wait_new_session_ticket;
-            else
-                ss->ssl3.hs.ws = wait_change_cipher;
+        ss->sec.authAlgorithm = sid->authAlgorithm;
+        ss->sec.authKeyBits   = sid->authKeyBits;
+        ss->sec.keaType       = sid->keaType;
+        ss->sec.keaKeyBits    = sid->keaKeyBits;
 
-            ss->ssl3.hs.isResuming = PR_TRUE;
+        /* 3 cases here:
+         * a) key is wrapped (implies using PKCS11)
+         * b) key is unwrapped, but we're still using PKCS11
+         * c) key is unwrapped, and we're bypassing PKCS11.
+         */
+        if (sid->u.ssl3.keys.msIsWrapped) {
+            PK11SlotInfo *slot;
+            PK11SymKey *  wrapKey;     /* wrapping key */
+            CK_FLAGS      keyFlags      = 0;
 
-            /* copy the peer cert from the SID */
-            if (sid->peerCert != NULL) {
-                ss->sec.peerCert = CERT_DupCertificate(sid->peerCert);
-                ssl3_CopyPeerCertsFromSID(ss, sid);
+            if (ss->opt.bypassPKCS11) {
+                /* we cannot restart a non-bypass session in a 
+                ** bypass socket.
+                */
+                break;  
+            }
+            /* unwrap master secret with PKCS11 */
+            slot = SECMOD_LookupSlot(sid->u.ssl3.masterModuleID,
+                                     sid->u.ssl3.masterSlotID);
+            if (slot == NULL) {
+                break;          /* not considered an error. */
+            }
+            if (!PK11_IsPresent(slot)) {
+                PK11_FreeSlot(slot);
+                break;          /* not considered an error. */
+            }
+            wrapKey = PK11_GetWrapKey(slot, sid->u.ssl3.masterWrapIndex,
+                                      sid->u.ssl3.masterWrapMech,
+                                      sid->u.ssl3.masterWrapSeries,
+                                      ss->pkcs11PinArg);
+            PK11_FreeSlot(slot);
+            if (wrapKey == NULL) {
+                break;          /* not considered an error. */
             }
 
-            /* NULL value for PMS signifies re-use of the old MS */
-            rv = ssl3_InitPendingCipherSpec(ss,  NULL);
-            if (rv != SECSuccess) {
-                goto alert_loser;
+            if (ss->version > SSL_LIBRARY_VERSION_3_0) {        /* isTLS */
+                keyFlags = CKF_SIGN | CKF_VERIFY;
             }
-            return SECSuccess;
+
+            wrappedMS.data = sid->u.ssl3.keys.wrapped_master_secret;
+            wrappedMS.len  = sid->u.ssl3.keys.wrapped_master_secret_len;
+            pwSpec->master_secret =
+                PK11_UnwrapSymKeyWithFlags(wrapKey, sid->u.ssl3.masterWrapMech, 
+                            NULL, &wrappedMS, CKM_SSL3_MASTER_KEY_DERIVE,
+                            CKA_DERIVE, sizeof(SSL3MasterSecret), keyFlags);
+            errCode = PORT_GetError();
+            PK11_FreeSymKey(wrapKey);
+            if (pwSpec->master_secret == NULL) {
+                break;  /* errorCode set just after call to UnwrapSymKey. */
+            }
+        } else if (ss->opt.bypassPKCS11) {
+            /* MS is not wrapped */
+            wrappedMS.data = sid->u.ssl3.keys.wrapped_master_secret;
+            wrappedMS.len  = sid->u.ssl3.keys.wrapped_master_secret_len;
+            memcpy(pwSpec->raw_master_secret, wrappedMS.data, wrappedMS.len);
+            pwSpec->msItem.data = pwSpec->raw_master_secret;
+            pwSpec->msItem.len  = wrappedMS.len;
+        } else {
+            /* We CAN restart a bypass session in a non-bypass socket. */
+            /* need to import the raw master secret to session object */
+            PK11SlotInfo *slot = PK11_GetInternalSlot();
+            wrappedMS.data = sid->u.ssl3.keys.wrapped_master_secret;
+            wrappedMS.len  = sid->u.ssl3.keys.wrapped_master_secret_len;
+            pwSpec->master_secret =  
+                PK11_ImportSymKey(slot, CKM_SSL3_MASTER_KEY_DERIVE, 
+                                  PK11_OriginUnwrap, CKA_ENCRYPT, 
+                                  &wrappedMS, NULL);
+            PK11_FreeSlot(slot);
+            if (pwSpec->master_secret == NULL) {
+                break; 
+            }
         }
-    }
+
+        /* Got a Match */
+        SSL_AtomicIncrementLong(& ssl3stats.hsh_sid_cache_hits );
+
+        /* If we sent a session ticket, then this is a stateless resume. */
+        if (sid->version > SSL_LIBRARY_VERSION_3_0 &&
+            sid->u.ssl3.sessionTicket.ticket.data != NULL)
+            SSL_AtomicIncrementLong(& ssl3stats.hsh_sid_stateless_resumes );
+
+        if (ssl3_ExtensionNegotiated(ss, ssl_session_ticket_xtn))
+            ss->ssl3.hs.ws = wait_new_session_ticket;
+        else
+            ss->ssl3.hs.ws = wait_change_cipher;
+
+        ss->ssl3.hs.isResuming = PR_TRUE;
+
+        /* copy the peer cert from the SID */
+        if (sid->peerCert != NULL) {
+            ss->sec.peerCert = CERT_DupCertificate(sid->peerCert);
+            ssl3_CopyPeerCertsFromSID(ss, sid);
+        }
+
+
+        /* NULL value for PMS signifies re-use of the old MS */
+        rv = ssl3_InitPendingCipherSpec(ss,  NULL);
+        if (rv != SECSuccess) {
+            goto alert_loser;   /* err code was set */
+        }
+        return SECSuccess;
+    } while (0);
 
     if (sid_match)
         SSL_AtomicIncrementLong(& ssl3stats.hsh_sid_cache_not_ok );
     else
         SSL_AtomicIncrementLong(& ssl3stats.hsh_sid_cache_misses );
 
     /* throw the old one away */
     sid->u.ssl3.keys.resumable = PR_FALSE;
     (*ss->sec.uncache)(sid);
     ssl_FreeSID(sid);
@@ skipping 1011 matching lines @@
         errCode = SSL_ERROR_UNSAFE_NEGOTIATION;
         goto alert_loser;
     }
 
     /* We do stateful resumes only if either of the following
      * conditions are satisfied: (1) the client does not support the
      * session ticket extension, or (2) the client support the session
      * ticket extension, but sent an empty ticket.
      */
     if (!ssl3_ExtensionNegotiated(ss, ssl_session_ticket_xtn) ||
-        ss->xtnData.serverReceivedEmptySessionTicket) {
+        ss->xtnData.emptySessionTicket) {
         if (sidBytes.len > 0 && !ss->opt.noCache) {
             SSL_TRC(7, ("%d: SSL3[%d]: server, lookup client session-id for 0x%08x%08x%08x%08x",
                         SSL_GETPID(), ss->fd, ss->sec.ci.peer.pr_s6_addr32[0],
                         ss->sec.ci.peer.pr_s6_addr32[1], 
                         ss->sec.ci.peer.pr_s6_addr32[2],
                         ss->sec.ci.peer.pr_s6_addr32[3]));
             if (ssl_sid_lookup) {
                 sid = (*ssl_sid_lookup)(&ss->sec.ci.peer, sidBytes.data, 
                                         sidBytes.len, ss->dbHandle);
             } else {
@@ skipping 1432 matching lines @@
         (PRUint32)ssl3_ConsumeHandshakeNumber(ss, 4, &b, &length);
 
     rv = ssl3_ConsumeHandshakeVariable(ss, &session_ticket.ticket, 2,
         &b, &length);
     if (length != 0 || rv != SECSuccess) {
         (void)SSL3_SendAlert(ss, alert_fatal, decode_error);
         PORT_SetError(SSL_ERROR_RX_MALFORMED_NEW_SESSION_TICKET);
         return SECFailure;  /* malformed */
     }
 
-    if (ss->sec.ci.sid->peerCert == NULL) {
-        ss->sec.ci.sid->peerCert = CERT_DupCertificate(ss->sec.peerCert);
-        ssl3_CopyPeerCertsToSID((ssl3CertNode *)ss->ssl3.peerCertChain,
-                                ss->sec.ci.sid);
-    }
-
     rv = ssl3_SetSIDSessionTicket(ss->sec.ci.sid, &session_ticket);
     if (rv != SECSuccess) {
         (void)SSL3_SendAlert(ss, alert_fatal, handshake_failure);
         PORT_SetError(SSL_ERROR_INTERNAL_ERROR_ALERT);
         return SECFailure;
     }
     ss->ssl3.hs.ws = wait_change_cipher;
     return SECSuccess;
 }
 
@@ skipping 171 matching lines @@
     ssl3CertNode *certs = (ssl3CertNode *)ss->ssl3.peerCertChain;
 
     for (; certs; certs = certs->next) {
         CERT_DestroyCertificate(certs->cert);
     }
     if (arena) PORT_FreeArena(arena, PR_FALSE);
     ss->ssl3.peerCertArena = NULL;
     ss->ssl3.peerCertChain = NULL;
 }
 
-void
+static void
 ssl3_CopyPeerCertsFromSID(sslSocket *ss, sslSessionID *sid)
 {
     PRArenaPool *arena;
     ssl3CertNode *lastCert = NULL;
     ssl3CertNode *certs = NULL;
     int i;
 
     if (!sid->peerCertChain[0])
         return;
     PORT_Assert(!ss->ssl3.peerCertArena);
@@ skipping 445 matching lines @@
         ssl_GetRecvBufLock(ss);
         if (ss->ssl3.hs.msgState.buf != NULL) {
             rv = ssl3_HandleRecord(ss, NULL, &ss->gs.buf);
         }
         ssl_ReleaseRecvBufLock(ss);
     }
 
     return rv;
 }
 
-SECStatus
+static SECStatus
 ssl3_ComputeTLSFinished(ssl3CipherSpec *spec,
                         PRBool          isServer,
                 const   SSL3Finished *  hashes,
                         TLSFinished  *  tlsFinished)
 {
     const char * label;
     unsigned int len;
     SECStatus    rv;
 
     label = isServer ? "server finished" : "client finished";
@@ skipping 27 matching lines @@
         outData.len  = sizeof tlsFinished->verify_data;
         rv = TLS_PRF(&spec->msItem, label, &inData, &outData, isFIPS);
         PORT_Assert(rv != SECSuccess || \
                     outData.len == sizeof tlsFinished->verify_data);
     }
     return rv;
 }
 
 /* called from ssl3_HandleServerHelloDone
  */
-SECStatus
+static SECStatus
 ssl3_SendNextProto(sslSocket *ss)
 {
     SECStatus rv;
     int padding_len;
     static const unsigned char padding[32] = {0};
 
     if (ss->ssl3.nextProtoState == SSL_NEXT_PROTO_NO_SUPPORT)
         return SECSuccess;
 
     PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss));
@@ skipping 15 matching lines @@
     if (rv != SECSuccess) {
         return rv;      /* error code set by AppendHandshake */
     }
     return rv;
 }
 
 /* called from ssl3_HandleServerHelloDone
  *             ssl3_HandleClientHello
  *             ssl3_HandleFinished
  */
-SECStatus
+static SECStatus
 ssl3_SendFinished(sslSocket *ss, PRInt32 flags)
 {
     ssl3CipherSpec *cwSpec;
     PRBool          isTLS;
     PRBool          isServer = ss->sec.isServer;
     SECStatus       rv;
     SSL3Sender      sender = isServer ? sender_server : sender_client;
     SSL3Finished    hashes;
     TLSFinished     tlsFinished;
 
@@ skipping 32 matching lines @@
         else
             ss->ssl3.hs.finishedMsgs.sFinished[0] = hashes;
         ss->ssl3.hs.finishedBytes = sizeof hashes;
         rv = ssl3_AppendHandshakeHeader(ss, finished, sizeof hashes);
         if (rv != SECSuccess) 
             goto fail;          /* err set by AppendHandshake. */
         rv = ssl3_AppendHandshake(ss, &hashes, sizeof hashes);
         if (rv != SECSuccess) 
             goto fail;          /* err set by AppendHandshake. */
     }
-    if ((flags & ssl_SEND_FLAG_NO_FLUSH) == 0) {
-        rv = ssl3_FlushHandshake(ss, flags);
-        if (rv != SECSuccess) {
-            goto fail;  /* error code set by ssl3_FlushHandshake */
-        }
+    rv = ssl3_FlushHandshake(ss, flags);
+    if (rv != SECSuccess) {
+        goto fail;      /* error code set by ssl3_FlushHandshake */
     }
-
     return SECSuccess;
 
 fail:
     return rv;
 }
 
 /* wrap the master secret, and put it into the SID.
  * Caller holds the Spec read lock.
  */
 SECStatus
@@ skipping 96 matching lines @@
 
     SSL_TRC(3, ("%d: SSL3[%d]: handle finished handshake",
         SSL_GETPID(), ss->fd));
 
     if (ss->ssl3.hs.ws != wait_finished) {
         SSL3_SendAlert(ss, alert_fatal, unexpected_message);
         PORT_SetError(SSL_ERROR_RX_UNEXPECTED_FINISHED);
         return SECFailure;
     }
 
-    if (ss->ssl3.hs.snapStartType == snap_start_full ||
-        ss->ssl3.hs.snapStartType == snap_start_resume) {
-        /* Snap Start handshake was successful. Switch the cipher spec. */
-        ssl_GetSpecWriteLock(ss);
-        ssl3_DestroyCipherSpec(ss->ssl3.cwSpec, PR_TRUE/*freeSrvName*/);
-        ss->ssl3.cwSpec = ss->ssl3.pwSpec;
-        ss->ssl3.pwSpec = NULL;
-        ssl_ReleaseSpecWriteLock(ss);
-    }
-
     isTLS = (PRBool)(ss->ssl3.crSpec->version > SSL_LIBRARY_VERSION_3_0);
     if (isTLS) {
         TLSFinished tlsFinished;
 
         if (length != sizeof tlsFinished) {
             (void)SSL3_SendAlert(ss, alert_fatal, decode_error);
             PORT_SetError(SSL_ERROR_RX_MALFORMED_FINISHED);
             return SECFailure;
         }
-
-        if (ss->ssl3.hs.snapStartType == snap_start_resume) {
-            /* In this case we have already advanced the Finished hash past the
-             * server's verify_data because we needed to predict the server's
-             * Finished message in order to compute our own (which includes
-             * it). When we did this, we stored a copy in tFinished[1]. */
-            tlsFinished = ss->ssl3.hs.finishedMsgs.tFinished[1];
-        } else {
-            rv = ssl3_ComputeTLSFinished(ss->ssl3.crSpec, !isServer,
-                                         hashes, &tlsFinished);
-            if (!isServer)
-                ss->ssl3.hs.finishedMsgs.tFinished[1] = tlsFinished;
-            else
-                ss->ssl3.hs.finishedMsgs.tFinished[0] = tlsFinished;
-        }
+        rv = ssl3_ComputeTLSFinished(ss->ssl3.crSpec, !isServer, 
+                                     hashes, &tlsFinished);
+        if (!isServer)
+            ss->ssl3.hs.finishedMsgs.tFinished[1] = tlsFinished;
+        else
+            ss->ssl3.hs.finishedMsgs.tFinished[0] = tlsFinished;
         ss->ssl3.hs.finishedBytes = sizeof tlsFinished;
         if (rv != SECSuccess ||
             0 != NSS_SecureMemcmp(&tlsFinished, b, length)) {
             (void)SSL3_SendAlert(ss, alert_fatal, decrypt_error);
             PORT_SetError(SSL_ERROR_BAD_HANDSHAKE_HASH_VALUE);
             return SECFailure;
         }
     } else {
         if (length != sizeof(SSL3Hashes)) {
             (void)ssl3_IllegalParameter(ss);
@@ skipping 10 matching lines @@
             (void)ssl3_HandshakeFailure(ss);
             PORT_SetError(SSL_ERROR_BAD_HANDSHAKE_HASH_VALUE);
             return SECFailure;
         }
     }
 
     doStepUp = (PRBool)(!isServer && ss->ssl3.hs.rehandshake);
 
     ssl_GetXmitBufLock(ss);     /*************************************/
 
-    if (ss->ssl3.hs.snapStartType != snap_start_resume &&
-        ((isServer && !ss->ssl3.hs.isResuming) ||
-         (!isServer && ss->ssl3.hs.isResuming))) {
+    if ((isServer && !ss->ssl3.hs.isResuming) ||
+        (!isServer && ss->ssl3.hs.isResuming)) {
         PRInt32 flags = 0;
 
         /* Send a NewSessionTicket message if the client sent us
          * either an empty session ticket, or one that did not verify.
          * (Note that if either of these conditions was met, then the
          * server has sent a SessionTicket extension in the
          * ServerHello message.)
          */
         if (isServer && !ss->ssl3.hs.isResuming &&
             ssl3_ExtensionNegotiated(ss, ssl_session_ticket_xtn)) {
@@ skipping 95 matching lines @@
         /* If the wrap failed, we don't cache the sid.
          * The connection continues normally however.
          */
         if (rv == SECSuccess) {
             (*ss->sec.cache)(sid);
         }
     }
     ss->ssl3.hs.ws = idle_handshake;
 
     /* Do the handshake callback for sslv3 here, if we cannot false start. */
-    if (ss->handshakeCallback != NULL &&
-        (!ssl3_CanFalseStart(ss) ||
-         ss->ssl3.hs.snapStartType == snap_start_full ||
-         ss->ssl3.hs.snapStartType == snap_start_resume)) {
+    if (ss->handshakeCallback != NULL && !ssl3_CanFalseStart(ss)) {
         (ss->handshakeCallback)(ss->fd, ss->handshakeCallbackData);
     }
 
     return SECSuccess;
 }
 
 /* This function handles any pending Certificate messages. Certificate messages
  * can be pending if we expect a possible CertificateStatus message to follow.
  *
  * This function must be called immediately after handling the
@@ skipping 60 matching lines @@
 
     /* Start new handshake hashes when we start a new handshake */
     if (ss->ssl3.hs.msg_type == client_hello) {
         SSL_TRC(30,("%d: SSL3[%d]: reset handshake hashes",
                 SSL_GETPID(), ss->fd ));
         rv = ssl3_RestartHandshakeHashes(ss);
         if (rv != SECSuccess) {
             return rv;
         }
     }
-    /* We should not include hello_request messages in the handshake hashes.
-     * Likewise, for Finished messages from the server during a Snap Start
-     * resume, we have already predicted and included the message in our
-     * Finished hash. */
-    if (ss->ssl3.hs.msg_type != hello_request &&
-        !(ss->ssl3.hs.msg_type == finished &&
-         ss->ssl3.hs.snapStartType == snap_start_resume)) {
+    /* We should not include hello_request messages in the handshake hashes */
+    if (ss->ssl3.hs.msg_type != hello_request) {
         rv = ssl3_UpdateHandshakeHashes(ss, (unsigned char*) hdr, 4);
         if (rv != SECSuccess) return rv;        /* err code already set. */
         rv = ssl3_UpdateHandshakeHashes(ss, b, length);
         if (rv != SECSuccess) return rv;        /* err code already set. */
     }
 
     PORT_SetError(0);   /* each message starts with no error. */
     switch (ss->ssl3.hs.msg_type) {
     case hello_request:
         if (length != 0) {
@@ skipping 918 matching lines @@
 #endif /* NSS_PLATFORM_CLIENT_AUTH */
 
     if (ss->ssl3.peerCertArena != NULL)
         ssl3_CleanupPeerCerts(ss);
 
     if (ss->ssl3.clientCertChain != NULL) {
        CERT_DestroyCertificateList(ss->ssl3.clientCertChain);
        ss->ssl3.clientCertChain = NULL;
     }
 
-    if (ss->ssl3.predictedCertChain != NULL)
-        ssl3_CleanupPredictedPeerCertificates(ss);
-
-    if (ss->ssl3.serverHelloPredictionData.data)
-        SECITEM_FreeItem(&ss->ssl3.serverHelloPredictionData, PR_FALSE);
-
-    if (ss->ssl3.snapStartApplicationData.data)
-        SECITEM_FreeItem(&ss->ssl3.snapStartApplicationData, PR_FALSE);
-
     /* clean up handshake */
     if (ss->opt.bypassPKCS11) {
         SHA1_DestroyContext((SHA1Context *)ss->ssl3.hs.sha_cx, PR_FALSE);
         MD5_DestroyContext((MD5Context *)ss->ssl3.hs.md5_cx, PR_FALSE);
     } 
     if (ss->ssl3.hs.md5) {
         PK11_DestroyContext(ss->ssl3.hs.md5,PR_TRUE);
     }
     if (ss->ssl3.hs.sha) {
         PK11_DestroyContext(ss->ssl3.hs.sha,PR_TRUE);
     }
     if (ss->ssl3.hs.messages.buf) {
         PORT_Free(ss->ssl3.hs.messages.buf);
         ss->ssl3.hs.messages.buf = NULL;
         ss->ssl3.hs.messages.len = 0;
         ss->ssl3.hs.messages.space = 0;
     }
-    if (ss->ssl3.hs.origClientHello.data) {
-        SECITEM_FreeItem(&ss->ssl3.hs.origClientHello, PR_FALSE);
-    }
     if (ss->ssl3.hs.pending_cert_msg.data) {
         SECITEM_FreeItem(&ss->ssl3.hs.pending_cert_msg, PR_FALSE);
     }
     if (ss->ssl3.hs.cert_status.data) {
         SECITEM_FreeItem(&ss->ssl3.hs.cert_status, PR_FALSE);
     }
 
     /* free the SSL3Buffer (msg_body) */
     PORT_Free(ss->ssl3.hs.msg_body.buf);
 
     /* free up the CipherSpecs */
     ssl3_DestroyCipherSpec(&ss->ssl3.specs[0], PR_TRUE/*freeSrvName*/);
     ssl3_DestroyCipherSpec(&ss->ssl3.specs[1], PR_TRUE/*freeSrvName*/);
 
     ss->ssl3.initialized = PR_FALSE;
 
     if (ss->ssl3.nextProto.data) {
         PORT_Free(ss->ssl3.nextProto.data);
         ss->ssl3.nextProto.data = NULL;
     }
 }
 
 /* End of ssl3con.c */