1# This Source Code Form is subject to the terms of the Mozilla Public 2# License, v. 2.0. If a copy of the MPL was not distributed with this 3# file, You can obtain one at http://mozilla.org/MPL/2.0/. 4 5SSL's Buffers: enumerated and explained. 6 7--------------------------------------------------------------------------- 8incoming: 9 10gs = ss->gather 11hs = ss->ssl3->hs 12 13gs->inbuf SSL3 only: incoming (encrypted) ssl records are placed here, 14 and then decrypted (or copied) to gs->buf. 15 16gs->buf SSL2: incoming SSL records are put here, and then decrypted 17 in place. 18 SSL3: ssl3_HandleHandshake puts decrypted ssl records here. 19 20hs.msg_body (SSL3 only) When an incoming handshake message spans more 21 than one ssl record, the first part(s) of it are accumulated 22 here until it all arrives. 23 24hs.msgState (SSL3 only) an alternative set of pointers/lengths for gs->buf. 25 Used only when a handleHandshake function returns SECWouldBlock. 26 ssl3_HandleHandshake remembers how far it previously got by 27 using these pointers instead of gs->buf when it is called 28 after a previous SECWouldBlock return. 29 30--------------------------------------------------------------------------- 31outgoing: 32 33sec = ss->sec 34ci = ss->sec->ci /* connect info */ 35 36ci->sendBuf Outgoing handshake messages are appended to this buffer. 37 This buffer will then be sent as a single SSL record. 38 39sec->writeBuf outgoing ssl records are constructed here and encrypted in 40 place before being written or copied to pendingBuf. 41 42ss->pendingBuf contains outgoing ciphertext that was saved after a write 43 attempt to the socket failed, e.g. EWouldBlock. 44 Generally empty with blocking sockets (should be no incomplete 45 writes). 46 47ss->saveBuf Used only by socks code. Intended to be used to buffer 48 outgoing data until a socks handshake completes. However, 49 this buffer is always empty. There is no code to put 50 anything into it. 51 52--------------------------------------------------------------------------- 53 54SECWouldBlock means that the function cannot make progress because it is 55waiting for some event OTHER THAN socket I/O completion (e.g. waiting for 56user dialog to finish). It is not the same as EWOULDBLOCK. 57 58--------------------------------------------------------------------------- 59 60Rank (order) of locks 61 62recvLock ->\ firstHandshake -> recvbuf -> ssl3Handshake -> xmitbuf -> "spec" 63sendLock ->/ 64 65crypto and hash Data that must be protected while turning plaintext into 66ciphertext: 67 68SSL2: (in ssl2_Send*) 69 sec->hash* 70 sec->hashcx (ptr and data) 71 sec->enc 72 sec->writecx* (ptr and content) 73 sec->sendSecret*(ptr and content) 74 sec->sendSequence locked by xmitBufLock 75 sec->blockSize 76 sec->writeBuf* (ptr & content) locked by xmitBufLock 77 "in" locked by xmitBufLock 78 79SSl3: (in ssl3_SendPlainText) 80 ss->ssl3 (the pointer) 81 ss->ssl3->current_write* (the pointer and the data in the spec 82 and any data referenced by the spec. 83 84 ss->sec->isServer 85 ss->sec->writebuf* (ptr & content) locked by xmitBufLock 86 "buf" locked by xmitBufLock 87 88crypto and hash data that must be protected while turning ciphertext into 89plaintext: 90 91SSL2: (in ssl2_GatherData) 92 gs->* (locked by recvBufLock ) 93 sec->dec 94 sec->readcx 95 sec->hash* (ptr and data) 96 sec->hashcx (ptr and data) 97 98SSL3: (in ssl3_HandleRecord ) 99 ssl3->current_read* (the pointer and all data refernced) 100 ss->sec->isServer 101 102 103Data that must be protected while being used by a "writer": 104 105ss->pendingBuf.* 106ss->saveBuf.* (which is dead) 107 108in ssl3_sendPlainText 109 110ss->ssl3->current_write-> (spec) 111ss->sec->writeBuf.* 112ss->sec->isServer 113 114in SendBlock 115 116ss->sec->hash->length 117ss->sec->blockSize 118ss->sec->writeBuf.* 119ss->sec->sendSecret 120ss->sec->sendSequence 121ss->sec->writecx * 122ss->pendingBuf 123 124-------------------------------------------------------------------------- 125 126Data variables (not const) protected by the "sslGlobalDataLock". 127Note, this really should be a reader/writer lock. 128 129allowedByPolicy sslcon.c 130maybeAllowedByPolicy sslcon.c 131chosenPreference sslcon.c 132policyWasSet sslcon.c 133 134cipherSuites[] ssl3con.c 135