Upgrade chrome's OpenSSL to same version Android ships with.

openssl/ssl/d1_pkt.c

 /* ssl/d1_pkt.c */
 /* 
  * DTLS implementation written by Nagendra Modadugu
  * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.  
  */
 /* ====================================================================
  * Copyright (c) 1998-2005 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ skipping 104 matching lines @@
 
 #include <stdio.h>
 #include <errno.h>
 #define USE_SOCKETS
 #include "ssl_locl.h"
 #include <openssl/evp.h>
 #include <openssl/buffer.h>
 #include <openssl/pqueue.h>
 #include <openssl/rand.h>
 
+/* mod 128 saturating subtract of two 64-bit values in big-endian order */
+static int satsub64be(const unsigned char *v1,const unsigned char *v2)
+{       int ret,sat,brw,i;
+
+        if (sizeof(long) == 8) do
+        {       const union { long one; char little; } is_endian = {1};
+                long l;
+
+                if (is_endian.little)                   break;
+                /* not reached on little-endians */
+                /* following test is redundant, because input is
+                 * always aligned, but I take no chances... */
+                if (((size_t)v1|(size_t)v2)&0x7)        break;
+
+                l  = *((long *)v1);
+                l -= *((long *)v2);
+                if (l>128)              return 128;
+                else if (l<-128)        return -128;
+                else                    return (int)l;
+        } while (0);
+
+        ret = (int)v1[7]-(int)v2[7];
+        sat = 0;
+        brw = ret>>8;   /* brw is either 0 or -1 */
+        if (ret & 0x80)
+        {       for (i=6;i>=0;i--)
+                {       brw += (int)v1[i]-(int)v2[i];
+                        sat |= ~brw;
+                        brw >>= 8;
+                }
+        }
+        else
+        {       for (i=6;i>=0;i--)
+                {       brw += (int)v1[i]-(int)v2[i];
+                        sat |= brw;
+                        brw >>= 8;
+                }
+        }
+        brw <<= 8;      /* brw is either 0 or -256 */
+
+        if (sat&0xff)   return brw | 0x80;
+        else            return brw + (ret&0xFF);
+}
+
 static int have_handshake_fragment(SSL *s, int type, unsigned char *buf, 
         int len, int peek);
-static int dtls1_record_replay_check(SSL *s, DTLS1_BITMAP *bitmap,
-        PQ_64BIT *seq_num);
+static int dtls1_record_replay_check(SSL *s, DTLS1_BITMAP *bitmap);
 static void dtls1_record_bitmap_update(SSL *s, DTLS1_BITMAP *bitmap);
 static DTLS1_BITMAP *dtls1_get_bitmap(SSL *s, SSL3_RECORD *rr, 
     unsigned int *is_next_epoch);
 #if 0
 static int dtls1_record_needs_buffering(SSL *s, SSL3_RECORD *rr,
         unsigned short *priority, unsigned long *offset);
 #endif
 static int dtls1_buffer_record(SSL *s, record_pqueue *q,
-        PQ_64BIT *priority);
+        unsigned char *priority);
 static int dtls1_process_record(SSL *s);
-#if PQ_64BIT_IS_INTEGER
-static PQ_64BIT bytes_to_long_long(unsigned char *bytes, PQ_64BIT *num);
-#endif
 static void dtls1_clear_timeouts(SSL *s);
 
 /* copy buffered record into SSL structure */
 static int
 dtls1_copy_record(SSL *s, pitem *item)
     {
     DTLS1_RECORD_DATA *rdata;
 
     rdata = (DTLS1_RECORD_DATA *)item->data;
     
     if (s->s3->rbuf.buf != NULL)
         OPENSSL_free(s->s3->rbuf.buf);
     
     s->packet = rdata->packet;
     s->packet_length = rdata->packet_length;
     memcpy(&(s->s3->rbuf), &(rdata->rbuf), sizeof(SSL3_BUFFER));
     memcpy(&(s->s3->rrec), &(rdata->rrec), sizeof(SSL3_RECORD));
         
         /* Set proper sequence number for mac calculation */
         memcpy(&(s->s3->read_sequence[2]), &(rdata->packet[5]), 6);
     
     return(1);
     }
 
 
 static int
-dtls1_buffer_record(SSL *s, record_pqueue *queue, PQ_64BIT *priority)
-{
-    DTLS1_RECORD_DATA *rdata;
+dtls1_buffer_record(SSL *s, record_pqueue *queue, unsigned char *priority)
+        {
+        DTLS1_RECORD_DATA *rdata;
         pitem *item;
 
         /* Limit the size of the queue to prevent DOS attacks */
         if (pqueue_size(queue->q) >= 100)
                 return 0;
                 
         rdata = OPENSSL_malloc(sizeof(DTLS1_RECORD_DATA));
-        item = pitem_new(*priority, rdata);
+        item = pitem_new(priority, rdata);
         if (rdata == NULL || item == NULL)
                 {
                 if (rdata != NULL) OPENSSL_free(rdata);
                 if (item != NULL) pitem_free(item);
                 
                 SSLerr(SSL_F_DTLS1_BUFFER_RECORD, ERR_R_INTERNAL_ERROR);
                 return(0);
                 }
         
         rdata->packet = s->packet;
@@ skipping 18 matching lines @@
         
         if (!ssl3_setup_buffers(s))
                 {
                 SSLerr(SSL_F_DTLS1_BUFFER_RECORD, ERR_R_INTERNAL_ERROR);
                 OPENSSL_free(rdata);
                 pitem_free(item);
                 return(0);
                 }
         
         return(1);
-    }
+        }
 
 
 static int
 dtls1_retrieve_buffered_record(SSL *s, record_pqueue *queue)
     {
     pitem *item;
 
     item = pqueue_pop(queue->q);
     if (item)
         {
@@ skipping 21 matching lines @@
                    &((s)->d1->processed_rcds))
 
 static int
 dtls1_process_buffered_records(SSL *s)
     {
     pitem *item;
     
     item = pqueue_peek(s->d1->unprocessed_rcds.q);
     if (item)
         {
-        DTLS1_RECORD_DATA *rdata;
-        rdata = (DTLS1_RECORD_DATA *)item->data;
-        
         /* Check if epoch is current. */
         if (s->d1->unprocessed_rcds.epoch != s->d1->r_epoch)
             return(1);  /* Nothing to do. */
         
         /* Process all the records. */
         while (pqueue_peek(s->d1->unprocessed_rcds.q))
             {
             dtls1_get_unprocessed_record(s);
             if ( ! dtls1_process_record(s))
                 return(0);
             dtls1_buffer_record(s, &(s->d1->processed_rcds), 
-                &s->s3->rrec.seq_num);
+                s->s3->rrec.seq_num);
             }
         }
 
     /* sync epoch numbers once all the unprocessed records 
      * have been processed */
     s->d1->processed_rcds.epoch = s->d1->r_epoch;
     s->d1->unprocessed_rcds.epoch = s->d1->r_epoch + 1;
 
     return(1);
     }
@@ skipping 40 matching lines @@
                 }
         
         return 0;
         }
 
 #endif
 
 static int
 dtls1_process_record(SSL *s)
 {
-    int i,al;
+        int i,al;
         int clear=0;
-    int enc_err;
+        int enc_err;
         SSL_SESSION *sess;
-    SSL3_RECORD *rr;
+        SSL3_RECORD *rr;
         unsigned int mac_size;
         unsigned char md[EVP_MAX_MD_SIZE];
+        int decryption_failed_or_bad_record_mac = 0;
 
 
         rr= &(s->s3->rrec);
-    sess = s->session;
+        sess = s->session;
 
         /* At this point, s->packet_length == SSL3_RT_HEADER_LNGTH + rr->length,
          * and we have that many bytes in s->packet
          */
         rr->input= &(s->packet[DTLS1_RT_HEADER_LENGTH]);
 
         /* ok, we can now read from 's->packet' data into 'rr'
          * rr->input points at rr->length bytes, which
          * need to be copied into rr->data by either
          * the decryption or by the decompression
@@ skipping 10 matching lines @@
                 SSLerr(SSL_F_DTLS1_PROCESS_RECORD,SSL_R_ENCRYPTED_LENGTH_TOO_LONG);
                 goto f_err;
                 }
 
         /* decrypt in place in 'rr->input' */
         rr->data=rr->input;
 
         enc_err = s->method->ssl3_enc->enc(s,0);
         if (enc_err <= 0)
                 {
-                if (enc_err == 0)
-                        /* SSLerr() and ssl3_send_alert() have been called */
-                        goto err;
-
-                /* otherwise enc_err == -1 */
-                goto err;
+                /* To minimize information leaked via timing, we will always
+                 * perform all computations before discarding the message.
+                 */
+                decryption_failed_or_bad_record_mac = 1;
                 }
 
 #ifdef TLS_DEBUG
 printf("dec %d\n",rr->length);
 { unsigned int z; for (z=0; z<rr->length; z++) printf("%02X%c",rr->data[z],((z+1)%16)?' ':'\n'); }
 printf("\n");
 #endif
 
         /* r->length is now the compressed data plus mac */
-if (    (sess == NULL) ||
+        if (    (sess == NULL) ||
                 (s->enc_read_ctx == NULL) ||
                 (s->read_hash == NULL))
-    clear=1;
+                clear=1;
 
         if (!clear)
                 {
-                mac_size=EVP_MD_size(s->read_hash);
+                /* !clear => s->read_hash != NULL => mac_size != -1 */
+                int t;
+                t=EVP_MD_CTX_size(s->read_hash);
+                OPENSSL_assert(t >= 0);
+                mac_size=t;
 
                 if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH+mac_size)
                         {
 #if 0 /* OK only for stream ciphers (then rr->length is visible from ciphertext anyway) */
                         al=SSL_AD_RECORD_OVERFLOW;
                         SSLerr(SSL_F_DTLS1_PROCESS_RECORD,SSL_R_PRE_MAC_LENGTH_TOO_LONG);
                         goto f_err;
 #else
-                        goto err;
+                        decryption_failed_or_bad_record_mac = 1;
 #endif                  
                         }
                 /* check the MAC for rr->input (it's in mac_size bytes at the tail) */
                 if (rr->length < mac_size)
                         {
 #if 0 /* OK only for stream ciphers */
                         al=SSL_AD_DECODE_ERROR;
                         SSLerr(SSL_F_DTLS1_PROCESS_RECORD,SSL_R_LENGTH_TOO_SHORT);
                         goto f_err;
 #else
-                        goto err;
+                        decryption_failed_or_bad_record_mac = 1;
 #endif
                         }
                 rr->length-=mac_size;
                 i=s->method->ssl3_enc->mac(s,md,0);
-                if (memcmp(md,&(rr->data[rr->length]),mac_size) != 0)
+                if (i < 0 || memcmp(md,&(rr->data[rr->length]),mac_size) != 0)
                         {
-                        goto err;
+                        decryption_failed_or_bad_record_mac = 1;
                         }
                 }
 
+        if (decryption_failed_or_bad_record_mac)
+                {
+                /* decryption failed, silently discard message */
+                rr->length = 0;
+                s->packet_length = 0;
+                goto err;
+                }
+
         /* r->length is now just compressed */
         if (s->expand != NULL)
                 {
                 if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH)
                         {
                         al=SSL_AD_RECORD_OVERFLOW;
                         SSLerr(SSL_F_DTLS1_PROCESS_RECORD,SSL_R_COMPRESSED_LENGTH_TOO_LONG);
                         goto f_err;
                         }
                 if (!ssl3_do_uncompress(s))
@@ skipping 15 matching lines @@
         /* So at this point the following is true
          * ssl->s3->rrec.type   is the type of record
          * ssl->s3->rrec.length == number of bytes in record
          * ssl->s3->rrec.off    == offset to first valid byte
          * ssl->s3->rrec.data   == where to take bytes from, increment
          *                         after use :-).
          */
 
         /* we have pulled in a full packet so zero things */
         s->packet_length=0;
-    dtls1_record_bitmap_update(s, &(s->d1->bitmap));/* Mark receipt of record. */
-    return(1);
+        dtls1_record_bitmap_update(s, &(s->d1->bitmap));/* Mark receipt of record. */
+        return(1);
 
 f_err:
         ssl3_send_alert(s,SSL3_AL_FATAL,al);
 err:
         return(0);
 }
 
 
 /* Call this to get a new input record.
  * It will return <= 0 if more data is needed, normally due to an error
  * or non-blocking IO.
  * When it finishes, one packet has been decoded and can be found in
  * ssl->s3->rrec.type    - is the type of record
  * ssl->s3->rrec.data,   - data
  * ssl->s3->rrec.length, - number of bytes
  */
 /* used only by dtls1_read_bytes */
 int dtls1_get_record(SSL *s)
         {
         int ssl_major,ssl_minor;
         int i,n;
         SSL3_RECORD *rr;
-        SSL_SESSION *sess;
         unsigned char *p = NULL;
         unsigned short version;
         DTLS1_BITMAP *bitmap;
         unsigned int is_next_epoch;
 
         rr= &(s->s3->rrec);
-        sess=s->session;
 
-    /* The epoch may have changed.  If so, process all the
-     * pending records.  This is a non-blocking operation. */
-    dtls1_process_buffered_records(s);
+        /* The epoch may have changed.  If so, process all the
+         * pending records.  This is a non-blocking operation. */
+        dtls1_process_buffered_records(s);
 
         /* if we're renegotiating, then there may be buffered records */
         if (dtls1_get_processed_record(s))
                 return 1;
 
         /* get something from the wire */
 again:
         /* check if we have the header */
         if (    (s->rstate != SSL_ST_READ_BODY) ||
                 (s->packet_length < DTLS1_RT_HEADER_LENGTH)) 
@@ skipping 23 matching lines @@
                 n2s(p,rr->epoch);
 
                 memcpy(&(s->s3->read_sequence[2]), p, 6);
                 p+=6;
 
                 n2s(p,rr->length);
 
                 /* Lets check version */
                 if (!s->first_packet)
                         {
-                        if (version != s->version && version != DTLS1_BAD_VER)
+                        if (version != s->version)
                                 {
                                 /* unexpected version, silently discard */
                                 rr->length = 0;
                                 s->packet_length = 0;
                                 goto again;
                                 }
                         }
 
-                if ((version & 0xff00) != (DTLS1_VERSION & 0xff00) &&
-                    (version & 0xff00) != (DTLS1_BAD_VER & 0xff00))
+                if ((version & 0xff00) != (s->version & 0xff00))
                         {
                         /* wrong version, silently discard record */
                         rr->length = 0;
                         s->packet_length = 0;
                         goto again;
                         }
 
                 if (rr->length > SSL3_RT_MAX_ENCRYPTED_LENGTH)
                         {
                         /* record too long, silently discard it */
                         rr->length = 0;
                         s->packet_length = 0;
                         goto again;
                         }
 
-                s->client_version = version;
+                /* If we receive a valid record larger than the current buffer size,
+                 * allocate some memory for it.
+                 */
+                if (rr->length > s->s3->rbuf.len - DTLS1_RT_HEADER_LENGTH)
+                        {
+                        unsigned char *pp;
+                        unsigned int newlen = rr->length + DTLS1_RT_HEADER_LENGTH;
+                        if ((pp=OPENSSL_realloc(s->s3->rbuf.buf, newlen))==NULL)
+                                {
+                                SSLerr(SSL_F_DTLS1_GET_RECORD,ERR_R_MALLOC_FAILURE);
+                                return(-1);
+                                }
+                        p = pp + (p - s->s3->rbuf.buf);
+                        s->s3->rbuf.buf=pp;
+                        s->s3->rbuf.len=newlen;
+                        s->packet= &(s->s3->rbuf.buf[0]);
+                        }
+
                 /* now s->rstate == SSL_ST_READ_BODY */
                 }
 
         /* s->rstate == SSL_ST_READ_BODY, get and decode the data */
 
         if (rr->length > s->packet_length-DTLS1_RT_HEADER_LENGTH)
                 {
                 /* now s->packet_length == DTLS1_RT_HEADER_LENGTH */
                 i=rr->length;
                 n=ssl3_read_n(s,i,i,1);
                 if (n <= 0) return(n); /* error or non-blocking io */
 
                 /* this packet contained a partial record, dump it */
                 if ( n != i)
                         {
                         rr->length = 0;
                         s->packet_length = 0;
                         goto again;
                         }
 
                 /* now n == rr->length,
                  * and s->packet_length == DTLS1_RT_HEADER_LENGTH + rr->length */
                 }
         s->rstate=SSL_ST_READ_HEADER; /* set state for later operations */
 
         /* match epochs.  NULL means the packet is dropped on the floor */
         bitmap = dtls1_get_bitmap(s, rr, &is_next_epoch);
         if ( bitmap == NULL)
-        {
-        rr->length = 0;
-        s->packet_length = 0;  /* dump this record */
-        goto again;   /* get another record */
+                {
+                rr->length = 0;
+                s->packet_length = 0;  /* dump this record */
+                goto again;   /* get another record */
                 }
 
-        /* Check whether this is a repeat, or aged record.
+        /* Check whether this is a repeat, or aged record.
          * Don't check if we're listening and this message is
          * a ClientHello. They can look as if they're replayed,
          * since they arrive from different connections and
          * would be dropped unnecessarily.
          */
         if (!(s->d1->listen && rr->type == SSL3_RT_HANDSHAKE &&
                 *p == SSL3_MT_CLIENT_HELLO) &&
-                ! dtls1_record_replay_check(s, bitmap, &(rr->seq_num)))
+                !dtls1_record_replay_check(s, bitmap))
                 {
                 rr->length = 0;
                 s->packet_length=0; /* dump this record */
                 goto again;     /* get another record */
                 }
 
         /* just read a 0 length packet */
         if (rr->length == 0) goto again;
 
         /* If this record is from the next epoch (either HM or ALERT),
          * and a handshake is currently in progress, buffer it since it
-         * cannot be processed at this time. */
+         * cannot be processed at this time. However, do not buffer
+         * anything while listening.
+         */
         if (is_next_epoch)
                 {
-                if (SSL_in_init(s) || s->in_handshake)
+                if ((SSL_in_init(s) || s->in_handshake) && !s->d1->listen)
                         {
-                        dtls1_buffer_record(s, &(s->d1->unprocessed_rcds), &rr->seq_num);
+                        dtls1_buffer_record(s, &(s->d1->unprocessed_rcds), rr->seq_num);
                         }
                 rr->length = 0;
-        s->packet_length = 0;
-        goto again;
-        }
+                s->packet_length = 0;
+                goto again;
+                }
 
-    if (!dtls1_process_record(s))
+        if (!dtls1_process_record(s))
                 {
                 rr->length = 0;
-                s->packet_length=0; /* dump this record */
-                goto again;     /* get another record */
+                s->packet_length = 0;  /* dump this record */
+                goto again;   /* get another record */
                 }
 
         dtls1_clear_timeouts(s);  /* done waiting */
         return(1);
 
         }
 
 /* Return up to 'len' payload bytes received in 'type' records.
  * 'type' is one of the following:
  *
@@ skipping 108 matching lines @@
 
         if (s->s3->change_cipher_spec /* set when we receive ChangeCipherSpec,
                                        * reset by ssl3_get_finished */
                 && (rr->type != SSL3_RT_HANDSHAKE))
                 {
                 /* We now have application data between CCS and Finished.
                  * Most likely the packets were reordered on their way, so
                  * buffer the application data for later processing rather
                  * than dropping the connection.
                  */
-                dtls1_buffer_record(s, &(s->d1->buffered_app_data), &rr->seq_num);
+                dtls1_buffer_record(s, &(s->d1->buffered_app_data), rr->seq_num);
                 rr->length = 0;
                 goto start;
                 }
 
         /* If the other end has shut down, throw anything we read away
          * (even in 'peek' mode) */
         if (s->shutdown & SSL_RECEIVED_SHUTDOWN)
                 {
                 rr->length=0;
                 s->rwstate=SSL_NOTHING;
@@ skipping 261 matching lines @@
                 return(0);
                 }
 
         if (rr->type == SSL3_RT_CHANGE_CIPHER_SPEC)
                 {
                 struct ccs_header_st ccs_hdr;
                 unsigned int ccs_hdr_len = DTLS1_CCS_HEADER_LENGTH;
 
                 dtls1_get_ccs_header(rr->data, &ccs_hdr);
 
+                if (s->version == DTLS1_BAD_VER)
+                        ccs_hdr_len = 3;
+
                 /* 'Change Cipher Spec' is just a single byte, so we know
                  * exactly what the record payload has to look like */
                 /* XDTLS: check that epoch is consistent */
-                if (s->client_version == DTLS1_BAD_VER || s->version == DTLS1_BAD_VER)
-                        ccs_hdr_len = 3;
-
-                if ((rr->length != ccs_hdr_len) || (rr->off != 0) || (rr->data[0] != SSL3_MT_CCS))
+                if (    (rr->length != ccs_hdr_len) || 
+                        (rr->off != 0) || (rr->data[0] != SSL3_MT_CCS))
                         {
                         i=SSL_AD_ILLEGAL_PARAMETER;
                         SSLerr(SSL_F_DTLS1_READ_BYTES,SSL_R_BAD_CHANGE_CIPHER_SPEC);
                         goto err;
                         }
 
                 rr->length=0;
 
                 if (s->msg_callback)
                         s->msg_callback(0, s->version, SSL3_RT_CHANGE_CIPHER_SPEC, 
                                 rr->data, 1, s, s->msg_callback_arg);
 
                 /* We can't process a CCS now, because previous handshake
                  * messages are still missing, so just drop it.
                  */
                 if (!s->d1->change_cipher_spec_ok)
                         {
                         goto start;
                         }
 
                 s->d1->change_cipher_spec_ok = 0;
 
                 s->s3->change_cipher_spec=1;
                 if (!ssl3_do_change_cipher_spec(s))
                         goto err;
 
                 /* do this whenever CCS is processed */
                 dtls1_reset_seq_numbers(s, SSL3_CC_READ);
 
-                if (s->client_version == DTLS1_BAD_VER)
+                if (s->version == DTLS1_BAD_VER)
                         s->d1->handshake_read_seq++;
 
                 goto start;
                 }
 
         /* Unexpected handshake message (Client Hello, or protocol violation) */
         if ((s->d1->handshake_fragment_len >= DTLS1_HM_HEADER_LENGTH) && 
                 !s->in_handshake)
                 {
                 struct hm_header_st msg_hdr;
@@ skipping 195 matching lines @@
 
 int do_dtls1_write(SSL *s, int type, const unsigned char *buf, unsigned int len, int create_empty_fragment)
         {
         unsigned char *p,*pseq;
         int i,mac_size,clear=0;
         int prefix_len = 0;
         SSL3_RECORD *wr;
         SSL3_BUFFER *wb;
         SSL_SESSION *sess;
         int bs;
+        unsigned int len_with_overhead = len + SSL3_RT_DEFAULT_WRITE_OVERHEAD;
 
         /* first check if there is a SSL3_BUFFER still being written
          * out.  This will happen with non blocking IO */
         if (s->s3->wbuf.left != 0)
                 {
                 OPENSSL_assert(0); /* XDTLS:  want to see if we ever get here */
                 return(ssl3_write_pending(s,type,buf,len));
                 }
 
+        if (s->s3->wbuf.len < len_with_overhead)
+                {
+                if ((p=OPENSSL_realloc(s->s3->wbuf.buf, len_with_overhead)) == NULL) {
+                        SSLerr(SSL_F_DO_DTLS1_WRITE,ERR_R_MALLOC_FAILURE);
+                        goto err;
+                }
+                s->s3->wbuf.buf = p;
+                s->s3->wbuf.len = len_with_overhead;
+                }
+
         /* If we have an alert to send, lets send it */
         if (s->s3->alert_dispatch)
                 {
                 i=s->method->ssl_dispatch_alert(s);
                 if (i <= 0)
                         return(i);
                 /* if it went, fall through and send more stuff */
                 }
 
         if (len == 0 && !create_empty_fragment)
                 return 0;
 
         wr= &(s->s3->wrec);
         wb= &(s->s3->wbuf);
         sess=s->session;
 
         if (    (sess == NULL) ||
                 (s->enc_write_ctx == NULL) ||
-                (s->write_hash == NULL))
+                (EVP_MD_CTX_md(s->write_hash) == NULL))
                 clear=1;
 
         if (clear)
                 mac_size=0;
         else
-                mac_size=EVP_MD_size(s->write_hash);
+                {
+                mac_size=EVP_MD_CTX_size(s->write_hash);
+                if (mac_size < 0)
+                        goto err;
+                }
 
         /* DTLS implements explicit IV, so no need for empty fragments */
 #if 0
         /* 'create_empty_fragment' is true only when this function calls itself */
         if (!clear && !create_empty_fragment && !s->s3->empty_fragment_done
             && SSL_version(s) != DTLS1_VERSION && SSL_version(s) != DTLS1_BAD_VER)
                 {
                 /* countermeasure against known-IV weakness in CBC ciphersuites
                  * (see http://www.openssl.org/~bodo/tls-cbc.txt) 
                  */
@@ skipping 12 matching lines @@
                                 {
                                 /* insufficient space */
                                 SSLerr(SSL_F_DO_DTLS1_WRITE, ERR_R_INTERNAL_ERROR);
                                 goto err;
                                 }
                         }
                 
                 s->s3->empty_fragment_done = 1;
                 }
 #endif
-
         p = wb->buf + prefix_len;
 
         /* write the header */
 
         *(p++)=type&0xff;
         wr->type=type;
 
-        if (s->client_version == DTLS1_BAD_VER)
-                *(p++) = DTLS1_BAD_VER>>8,
-                *(p++) = DTLS1_BAD_VER&0xff;
-        else
-                *(p++)=(s->version>>8),
-                *(p++)=s->version&0xff;
+        *(p++)=(s->version>>8);
+        *(p++)=s->version&0xff;
 
         /* field where we are to write out packet epoch, seq num and len */
         pseq=p; 
         p+=10;
 
         /* lets setup the record stuff. */
 
         /* Make space for the explicit IV in case of CBC.
          * (this is a bit of a boundary violation, but what the heck).
          */
@@ skipping 24 matching lines @@
                 memcpy(wr->data,wr->input,wr->length);
                 wr->input=wr->data;
                 }
 
         /* we should still have the output to wr->data and the input
          * from wr->input.  Length should be wr->length.
          * wr->data still points in the wb->buf */
 
         if (mac_size != 0)
                 {
-                s->method->ssl3_enc->mac(s,&(p[wr->length + bs]),1);
+                if(s->method->ssl3_enc->mac(s,&(p[wr->length + bs]),1) < 0)
+                        goto err;
                 wr->length+=mac_size;
                 }
 
         /* this is true regardless of mac size */
         wr->input=p;
         wr->data=p;
 
 
         /* ssl3_enc can only have an error on read */
         if (bs) /* bs != 0 in case of CBC */
@@ skipping 56 matching lines @@
         s->s3->wpend_ret=len;
 
         /* we now just need to write the buffer */
         return ssl3_write_pending(s,type,buf,len);
 err:
         return -1;
         }
 
 
 
-static int dtls1_record_replay_check(SSL *s, DTLS1_BITMAP *bitmap,
-        PQ_64BIT *seq_num)
+static int dtls1_record_replay_check(SSL *s, DTLS1_BITMAP *bitmap)
         {
-#if PQ_64BIT_IS_INTEGER
-        PQ_64BIT mask = 0x0000000000000001L;
-#endif
-        PQ_64BIT rcd_num, tmp;
+        int cmp;
+        unsigned int shift;
+        const unsigned char *seq = s->s3->read_sequence;
 
-        pq_64bit_init(&rcd_num);
-        pq_64bit_init(&tmp);
+        cmp = satsub64be(seq,bitmap->max_seq_num);
+        if (cmp > 0)
+                {
+                memcpy (s->s3->rrec.seq_num,seq,8);
+                return 1; /* this record in new */
+                }
+        shift = -cmp;
+        if (shift >= sizeof(bitmap->map)*8)
+                return 0; /* stale, outside the window */
+        else if (bitmap->map & (1UL<<shift))
+                return 0; /* record previously received */
 
-        /* this is the sequence number for the record just read */
-        pq_64bit_bin2num(&rcd_num, s->s3->read_sequence, 8);
-
-        
-        if (pq_64bit_gt(&rcd_num, &(bitmap->max_seq_num)) ||
-                pq_64bit_eq(&rcd_num, &(bitmap->max_seq_num)))
-                {
-                pq_64bit_assign(seq_num, &rcd_num);
-                pq_64bit_free(&rcd_num);
-                pq_64bit_free(&tmp);
-                return 1;  /* this record is new */
-                }
-
-        pq_64bit_sub(&tmp, &(bitmap->max_seq_num), &rcd_num);
-
-        if ( pq_64bit_get_word(&tmp) > bitmap->length)
-                {
-                pq_64bit_free(&rcd_num);
-                pq_64bit_free(&tmp);
-                return 0;  /* stale, outside the window */
-                }
-
-#if PQ_64BIT_IS_BIGNUM
-        {
-        int offset;
-        pq_64bit_sub(&tmp, &(bitmap->max_seq_num), &rcd_num);
-        pq_64bit_sub_word(&tmp, 1);
-        offset = pq_64bit_get_word(&tmp);
-        if ( pq_64bit_is_bit_set(&(bitmap->map), offset))
-                {
-                pq_64bit_free(&rcd_num);
-                pq_64bit_free(&tmp);
-                return 0;
-                }
-        }
-#else
-        mask <<= (bitmap->max_seq_num - rcd_num - 1);
-        if (bitmap->map & mask)
-                return 0; /* record previously received */
-#endif
-        
-        pq_64bit_assign(seq_num, &rcd_num);
-        pq_64bit_free(&rcd_num);
-        pq_64bit_free(&tmp);
+        memcpy (s->s3->rrec.seq_num,seq,8);
         return 1;
         }
 
 
 static void dtls1_record_bitmap_update(SSL *s, DTLS1_BITMAP *bitmap)
         {
+        int cmp;
         unsigned int shift;
-        PQ_64BIT rcd_num;
-        PQ_64BIT tmp;
-        PQ_64BIT_CTX *ctx;
+        const unsigned char *seq = s->s3->read_sequence;
 
-        pq_64bit_init(&rcd_num);
-        pq_64bit_init(&tmp);
-
-        pq_64bit_bin2num(&rcd_num, s->s3->read_sequence, 8);
-
-        /* unfortunate code complexity due to 64-bit manipulation support
-         * on 32-bit machines */
-        if ( pq_64bit_gt(&rcd_num, &(bitmap->max_seq_num)) ||
-                pq_64bit_eq(&rcd_num, &(bitmap->max_seq_num)))
+        cmp = satsub64be(seq,bitmap->max_seq_num);
+        if (cmp > 0)
                 {
-                pq_64bit_sub(&tmp, &rcd_num, &(bitmap->max_seq_num));
-                pq_64bit_add_word(&tmp, 1);
-
-                shift = (unsigned int)pq_64bit_get_word(&tmp);
-
-                pq_64bit_lshift(&(tmp), &(bitmap->map), shift);
-                pq_64bit_assign(&(bitmap->map), &tmp);
-
-                pq_64bit_set_bit(&(bitmap->map), 0);
-                pq_64bit_add_word(&rcd_num, 1);
-                pq_64bit_assign(&(bitmap->max_seq_num), &rcd_num);
-
-                pq_64bit_assign_word(&tmp, 1);
-                pq_64bit_lshift(&tmp, &tmp, bitmap->length);
-                ctx = pq_64bit_ctx_new(&ctx);
-                pq_64bit_mod(&(bitmap->map), &(bitmap->map), &tmp, ctx);
-                pq_64bit_ctx_free(ctx);
+                shift = cmp;
+                if (shift < sizeof(bitmap->map)*8)
+                        bitmap->map <<= shift, bitmap->map |= 1UL;
+                else
+                        bitmap->map = 1UL;
+                memcpy(bitmap->max_seq_num,seq,8);
                 }
-        else
-                {
-                pq_64bit_sub(&tmp, &(bitmap->max_seq_num), &rcd_num);
-                pq_64bit_sub_word(&tmp, 1);
-                shift = (unsigned int)pq_64bit_get_word(&tmp);
-
-                pq_64bit_set_bit(&(bitmap->map), shift);
+        else    {
+                shift = -cmp;
+                if (shift < sizeof(bitmap->map)*8)
+                        bitmap->map |= 1UL<<shift;
                 }
-
-        pq_64bit_free(&rcd_num);
-        pq_64bit_free(&tmp);
         }
 
 
 int dtls1_dispatch_alert(SSL *s)
         {
         int i,j;
         void (*cb)(const SSL *ssl,int type,int val)=NULL;
         unsigned char buf[DTLS1_AL_HEADER_LENGTH];
         unsigned char *ptr = &buf[0];
 
@@ skipping 26 matching lines @@
                 {
                 s->s3->alert_dispatch=1;
                 /* fprintf( stderr, "not done with alert\n" ); */
                 }
         else
                 {
                 if (s->s3->send_alert[0] == SSL3_AL_FATAL
 #ifdef DTLS1_AD_MISSING_HANDSHAKE_MESSAGE
                     || s->s3->send_alert[1] == DTLS1_AD_MISSING_HANDSHAKE_MESSAGE
 #endif
-                   )
+                    )
                         (void)BIO_flush(s->wbio);
 
                 if (s->msg_callback)
                         s->msg_callback(1, s->version, SSL3_RT_ALERT, s->s3->send_alert, 
                                 2, s, s->msg_callback_arg);
 
                 if (s->info_callback != NULL)
                         cb=s->info_callback;
                 else if (s->ctx->info_callback != NULL)
                         cb=s->ctx->info_callback;
@@ skipping 98 matching lines @@
 void
 dtls1_reset_seq_numbers(SSL *s, int rw)
         {
         unsigned char *seq;
         unsigned int seq_bytes = sizeof(s->s3->read_sequence);
 
         if ( rw & SSL3_CC_READ)
                 {
                 seq = s->s3->read_sequence;
                 s->d1->r_epoch++;
-
-                pq_64bit_assign(&(s->d1->bitmap.map), &(s->d1->next_bitmap.map));
-                s->d1->bitmap.length = s->d1->next_bitmap.length;
-                pq_64bit_assign(&(s->d1->bitmap.max_seq_num), 
-                        &(s->d1->next_bitmap.max_seq_num));
-
-                pq_64bit_free(&(s->d1->next_bitmap.map));
-                pq_64bit_free(&(s->d1->next_bitmap.max_seq_num));
+                memcpy(&(s->d1->bitmap), &(s->d1->next_bitmap), sizeof(DTLS1_BITMAP));
                 memset(&(s->d1->next_bitmap), 0x00, sizeof(DTLS1_BITMAP));
-                pq_64bit_init(&(s->d1->next_bitmap.map));
-                pq_64bit_init(&(s->d1->next_bitmap.max_seq_num));
                 }
         else
                 {
                 seq = s->s3->write_sequence;
                 memcpy(s->d1->last_write_sequence, seq, sizeof(s->s3->write_sequence));
                 s->d1->w_epoch++;
                 }
 
         memset(seq, 0x00, seq_bytes);
         }
 
-#if PQ_64BIT_IS_INTEGER
-static PQ_64BIT
-bytes_to_long_long(unsigned char *bytes, PQ_64BIT *num)
-       {
-       PQ_64BIT _num;
-
-       _num = (((PQ_64BIT)bytes[0]) << 56) |
-               (((PQ_64BIT)bytes[1]) << 48) |
-               (((PQ_64BIT)bytes[2]) << 40) |
-               (((PQ_64BIT)bytes[3]) << 32) |
-               (((PQ_64BIT)bytes[4]) << 24) |
-               (((PQ_64BIT)bytes[5]) << 16) |
-               (((PQ_64BIT)bytes[6]) <<  8) |
-               (((PQ_64BIT)bytes[7])      );
-
-           *num = _num ;
-       return _num;
-       }
-#endif
-
 
 static void
 dtls1_clear_timeouts(SSL *s)
         {
         memset(&(s->d1->timeout), 0x00, sizeof(struct dtls1_timeout_st));
         }