Revert "1. Fix for memory leaks on interrupted handshake."

This reverts commit 15b31cfc7888aafb4135fb1bc92c710eeaebb4c0.
Let's not pull this into the next release, it wasn't in the
release candidate.

10 files changed, 139 insertions, 280 deletions

diff --git a/lib/gnutls_buffers.c b/lib/gnutls_buffers.c
index 099812379c..a8b68e36bd 100644
--- a/lib/gnutls_buffers.c
+++ b/lib/gnutls_buffers.c
@@ -1068,7 +1068,8 @@ _gnutls_handshake_buffer_put (gnutls_session_t session, opaque * data,
       return GNUTLS_E_HANDSHAKE_TOO_LARGE;
     }
 
-  _gnutls_buffers_log ("BUF[HSK]: Inserted %d bytes of Data\n", (int)length);
+  _gnutls_buffers_log ("BUF[HSK]: Inserted %d bytes of Data\n", length);
+
   if (_gnutls_buffer_append (&session->internals.handshake_hash_buffer,
 			     data, length) < 0)
     {
@@ -1090,6 +1091,24 @@ _gnutls_handshake_buffer_get_size (gnutls_session_t session)
  * and returns data from it (peek mode!)
  */
 int
+_gnutls_handshake_buffer_peek (gnutls_session_t session, opaque * data,
+			       size_t length)
+{
+  if (length > session->internals.handshake_hash_buffer.length)
+    {
+      length = session->internals.handshake_hash_buffer.length;
+    }
+
+  _gnutls_buffers_log ("BUF[HSK]: Peeked %d bytes of Data\n", length);
+
+  memcpy (data, session->internals.handshake_hash_buffer.data, length);
+  return length;
+}
+
+/* this function does not touch the buffer
+ * and returns data from it (peek mode!)
+ */
+int
 _gnutls_handshake_buffer_get_ptr (gnutls_session_t session,
 				  opaque ** data_ptr, size_t * length)
 {
@@ -1123,6 +1142,7 @@ _gnutls_handshake_buffer_clear (gnutls_session_t session)
 {
 
   _gnutls_buffers_log ("BUF[HSK]: Cleared Data from buffer\n");
+
   _gnutls_buffer_clear (&session->internals.handshake_hash_buffer);
 
   return 0;
diff --git a/lib/gnutls_buffers.h b/lib/gnutls_buffers.h
index a8ffa7d679..b21ac5be93 100644
--- a/lib/gnutls_buffers.h
+++ b/lib/gnutls_buffers.h
@@ -41,6 +41,8 @@ ssize_t _gnutls_io_write_buffered2 (gnutls_session_t, const void *iptr,
 				    size_t n, const void *iptr2, size_t n2);
 
 int _gnutls_handshake_buffer_get_size (gnutls_session_t session);
+int _gnutls_handshake_buffer_peek (gnutls_session_t session, opaque * data,
+				   size_t length);
 int _gnutls_handshake_buffer_put (gnutls_session_t session, opaque * data,
 				  size_t length);
 int _gnutls_handshake_buffer_clear (gnutls_session_t session);
diff --git a/lib/gnutls_cipher.c b/lib/gnutls_cipher.c
index 660d58b0fc..8defc2bff6 100644
--- a/lib/gnutls_cipher.c
+++ b/lib/gnutls_cipher.c
@@ -418,10 +418,6 @@ _gnutls_compressed2ciphertext (gnutls_session_t session,
   return length;
 }
 
-#define DEINIT_MAC(td, ver, algo) \
-          if (algo != GNUTLS_MAC_NULL) \
-            mac_deinit (&td, NULL, ver);
-
 /* Deciphers the ciphertext packet, and puts the result to compress_data, of compress_size.
  * Returns the actual compressed packet size.
  */
@@ -477,9 +473,6 @@ _gnutls_ciphertext2compressed (gnutls_session_t session,
 				   ciphertext.size)) < 0)
 	{
 	  gnutls_assert ();
-	  DEINIT_MAC(td, ver, session->security_parameters.write_mac_algorithm);
-
-
 	  return ret;
 	}
 
@@ -490,7 +483,6 @@ _gnutls_ciphertext2compressed (gnutls_session_t session,
       if ((ciphertext.size < blocksize) || (ciphertext.size % blocksize != 0))
 	{
 	  gnutls_assert ();
-	  DEINIT_MAC(td, ver, session->security_parameters.write_mac_algorithm);
 	  return GNUTLS_E_DECRYPTION_FAILED;
 	}
 
@@ -500,7 +492,6 @@ _gnutls_ciphertext2compressed (gnutls_session_t session,
 				   ciphertext.size)) < 0)
 	{
 	  gnutls_assert ();
-	  DEINIT_MAC(td, ver, session->security_parameters.write_mac_algorithm);
 	  return ret;
 	}
 
@@ -514,7 +505,6 @@ _gnutls_ciphertext2compressed (gnutls_session_t session,
 	  if (ciphertext.size == 0)
 	    {
 	      gnutls_assert ();
-              DEINIT_MAC(td, ver, session->security_parameters.write_mac_algorithm);
 	      return GNUTLS_E_DECRYPTION_FAILED;
 	    }
 	}
@@ -547,7 +537,6 @@ _gnutls_ciphertext2compressed (gnutls_session_t session,
       break;
     default:
       gnutls_assert ();
-      DEINIT_MAC(td, ver, session->security_parameters.write_mac_algorithm);
       return GNUTLS_E_INTERNAL_ERROR;
     }
 
diff --git a/lib/gnutls_handshake.c b/lib/gnutls_handshake.c
index 6f590a22e4..a90f2e3667 100644
--- a/lib/gnutls_handshake.c
+++ b/lib/gnutls_handshake.c
@@ -62,31 +62,17 @@
 #define TRUE 1
 #define FALSE 0
 
-static int _gnutls_handshake_hash_init (gnutls_session_t session);
-static int _gnutls_server_select_comp_method (gnutls_session_t session,
+int _gnutls_server_select_comp_method (gnutls_session_t session,
 				       opaque * data, int datalen);
-static int
-_gnutls_handshake_hash_add_recvd (gnutls_session_t session,
-				  gnutls_handshake_description_t recv_type,
-				  opaque * header, uint16_t header_size,
-				  opaque * dataptr, uint32_t datalen);
 
 
 /* Clears the handshake hash buffers and handles.
  */
-void
+static void
 _gnutls_handshake_hash_buffers_clear (gnutls_session_t session)
 {
-  if (session->security_parameters.handshake_mac_handle_type == HANDSHAKE_MAC_TYPE_10) 
-    {
-      _gnutls_hash_deinit (&session->internals.handshake_mac_handle.tls10.md5, NULL);
-      _gnutls_hash_deinit (&session->internals.handshake_mac_handle.tls10.sha, NULL);
-    }
-  else if (session->security_parameters.handshake_mac_handle_type == HANDSHAKE_MAC_TYPE_12)
-    {
-      _gnutls_hash_deinit (&session->internals.handshake_mac_handle.tls12.mac, NULL);
-    }
-  session->security_parameters.handshake_mac_handle_type = 0;
+  _gnutls_hash_deinit (&session->internals.handshake_mac_handle_md5, NULL);
+  _gnutls_hash_deinit (&session->internals.handshake_mac_handle_sha, NULL);
   session->internals.handshake_mac_handle_init = 0;
   _gnutls_handshake_buffer_clear (session);
 }
@@ -163,33 +149,23 @@ _gnutls_ssl3_finished (gnutls_session_t session, int type, opaque * ret)
   const char *mesg;
   int rc;
 
-  if (session->security_parameters.handshake_mac_handle_type == HANDSHAKE_MAC_TYPE_10) 
+  rc =
+    _gnutls_hash_copy (&td_md5, &session->internals.handshake_mac_handle_md5);
+  if (rc < 0)
     {
-      rc =
-        _gnutls_hash_copy (&td_md5, &session->internals.handshake_mac_handle.tls10.md5);
-      if (rc < 0)
-        {
-          gnutls_assert ();
-          return rc;
-        }
-
-      rc =
-        _gnutls_hash_copy (&td_sha, &session->internals.handshake_mac_handle.tls10.sha);
-      if (rc < 0)
-        {
-          gnutls_assert ();
-          _gnutls_hash_deinit (&td_md5, NULL);
-          return rc;
-        }
-
+      gnutls_assert ();
+      return rc;
     }
-  else
+
+  rc =
+    _gnutls_hash_copy (&td_sha, &session->internals.handshake_mac_handle_sha);
+  if (rc < 0)
     {
-      gnutls_assert();
-      return GNUTLS_E_INTERNAL_ERROR;
+      gnutls_assert ();
+      _gnutls_hash_deinit (&td_md5, NULL);
+      return rc;
     }
 
-
   if (type == GNUTLS_SERVER)
     {
       mesg = SSL3_SERVER_MSG;
@@ -221,7 +197,7 @@ static int
 _gnutls_finished (gnutls_session_t session, int type, void *ret)
 {
   const int siz = TLS_MSG_LEN;
-  opaque concat[MAX_HASH_SIZE+16/*MD5*/];
+  opaque concat[36];
   size_t len;
   const char *mesg;
   digest_hd_st td_md5;
@@ -229,45 +205,39 @@ _gnutls_finished (gnutls_session_t session, int type, void *ret)
   gnutls_protocol_t ver = gnutls_protocol_get_version (session);
   int rc;
 
-  if (session->security_parameters.handshake_mac_handle_type == HANDSHAKE_MAC_TYPE_10) 
+  if (ver < GNUTLS_TLS1_2)
     {
       rc =
 	_gnutls_hash_copy (&td_md5,
-			   &session->internals.handshake_mac_handle.tls10.md5);
+			   &session->internals.handshake_mac_handle_md5);
       if (rc < 0)
 	{
 	  gnutls_assert ();
 	  return rc;
 	}
+    }
 
-      rc =
-        _gnutls_hash_copy (&td_sha, &session->internals.handshake_mac_handle.tls10.sha);
-      if (rc < 0)
-        {
-          gnutls_assert ();
-          _gnutls_hash_deinit (&td_md5, NULL);
-          return rc;
-        }
+  rc =
+    _gnutls_hash_copy (&td_sha, &session->internals.handshake_mac_handle_sha);
+  if (rc < 0)
+    {
+      gnutls_assert ();
+      _gnutls_hash_deinit (&td_md5, NULL);
+      return rc;
+    }
 
-        _gnutls_hash_deinit (&td_md5, concat);
-        _gnutls_hash_deinit (&td_sha, &concat[16]);
-        len = 20 + 16;
+  if (ver < GNUTLS_TLS1_2)
+    {
+      _gnutls_hash_deinit (&td_md5, concat);
+      _gnutls_hash_deinit (&td_sha, &concat[16]);
+      len = 20 + 16;
     }
-  else if (session->security_parameters.handshake_mac_handle_type == HANDSHAKE_MAC_TYPE_12) 
+  else
     {
-      rc =
-        _gnutls_hash_copy (&td_sha, &session->internals.handshake_mac_handle.tls12.mac);
-      if (rc < 0)
-        {
-          gnutls_assert ();
-          return rc;
-        }
-
-        _gnutls_hash_deinit (&td_sha, concat);
-        len = _gnutls_hash_get_algo_len (td_sha.algorithm);
+      _gnutls_hash_deinit (&td_sha, concat);
+      len = 20;
     }
 
-
   if (type == GNUTLS_SERVER)
     {
       mesg = SERVER_MSG;
@@ -544,15 +514,8 @@ _gnutls_handshake_hash_pending (gnutls_session_t session)
 
   if (siz > 0)
     {
-      if (session->security_parameters.handshake_mac_handle_type == HANDSHAKE_MAC_TYPE_10) 
-        {
-          _gnutls_hash (&session->internals.handshake_mac_handle.tls10.sha, data, siz);
-          _gnutls_hash (&session->internals.handshake_mac_handle.tls10.md5, data, siz);
-        } 
-      else if (session->security_parameters.handshake_mac_handle_type == HANDSHAKE_MAC_TYPE_12)
-        {
-          _gnutls_hash (&session->internals.handshake_mac_handle.tls12.mac, data, siz);
-        }
+      _gnutls_hash (&session->internals.handshake_mac_handle_sha, data, siz);
+      _gnutls_hash (&session->internals.handshake_mac_handle_md5, data, siz);
     }
 
   _gnutls_handshake_buffer_empty (session);
@@ -853,7 +816,7 @@ finish:
 
 /* This selects the best supported compression method from the ones provided 
  */
-static int
+int
 _gnutls_server_select_comp_method (gnutls_session_t session,
 				   opaque * data, int datalen)
 {
@@ -932,18 +895,6 @@ _gnutls_handshake_hash_add_sent (gnutls_session_t session,
 {
   int ret;
 
-  if (session->security_parameters.entity == GNUTLS_CLIENT && type == GNUTLS_HANDSHAKE_CLIENT_HELLO)
-    {
-      /* do not hash immediatelly since the hash has not yet been initialized */
-      if ((ret =
-	   _gnutls_handshake_buffer_put (session, dataptr, datalen)) < 0)
-	{
-	  gnutls_assert ();
-	  return ret;
-	}
-      return 0;
-    }
-
   if ((ret = _gnutls_handshake_hash_pending (session)) < 0)
     {
       gnutls_assert ();
@@ -952,18 +903,10 @@ _gnutls_handshake_hash_add_sent (gnutls_session_t session,
 
   if (type != GNUTLS_HANDSHAKE_HELLO_REQUEST)
     {
-      if (session->security_parameters.handshake_mac_handle_type == HANDSHAKE_MAC_TYPE_10) 
-        {
-          _gnutls_hash (&session->internals.handshake_mac_handle.tls10.sha, dataptr,
+      _gnutls_hash (&session->internals.handshake_mac_handle_sha, dataptr,
 		    datalen);
-          _gnutls_hash (&session->internals.handshake_mac_handle.tls10.md5, dataptr,
+      _gnutls_hash (&session->internals.handshake_mac_handle_md5, dataptr,
 		    datalen);
-        }
-      else if (session->security_parameters.handshake_mac_handle_type == HANDSHAKE_MAC_TYPE_12) 
-        { 
-          _gnutls_hash (&session->internals.handshake_mac_handle.tls12.mac, dataptr,
-		    datalen);
-        }
     }
 
   return 0;
@@ -1202,14 +1145,11 @@ _gnutls_handshake_hash_add_recvd (gnutls_session_t session,
   /* The idea here is to hash the previous message we received,
    * and add the one we just received into the handshake_hash_buffer.
    */
-  if ((session->security_parameters.entity == GNUTLS_SERVER || recv_type != GNUTLS_HANDSHAKE_SERVER_HELLO) && 
-      (session->security_parameters.entity == GNUTLS_CLIENT || recv_type != GNUTLS_HANDSHAKE_CLIENT_HELLO))
+
+  if ((ret = _gnutls_handshake_hash_pending (session)) < 0)
     {
-      if ((ret = _gnutls_handshake_hash_pending (session)) < 0)
-        {
-          gnutls_assert ();
-          return ret;
-        }
+      gnutls_assert ();
+      return ret;
     }
 
   /* here we buffer the handshake messages - needed at Finished message */
@@ -1332,23 +1272,11 @@ _gnutls_recv_handshake (gnutls_session_t session, uint8_t ** data,
     case GNUTLS_HANDSHAKE_CLIENT_HELLO:
     case GNUTLS_HANDSHAKE_SERVER_HELLO:
       ret = _gnutls_recv_hello (session, dataptr, length32);
-      
       /* dataptr is freed because the caller does not
        * need it */
       gnutls_free (dataptr);
       if (data != NULL)
 	*data = NULL;
-      
-      if (ret < 0)
-        break;
-
-      /* initialize the hashes for both - (client will know server's version
-       * and server as well at this point) */
-      if ((ret = _gnutls_handshake_hash_init (session)) < 0) {
-        gnutls_assert();
-        return ret;
-      }
-
       break;
     case GNUTLS_HANDSHAKE_SERVER_HELLO_DONE:
       if (length32 == 0)
@@ -2218,60 +2146,30 @@ _gnutls_abort_handshake (gnutls_session_t session, int ret)
 /* This function initialized the handshake hash session.
  * required for finished messages.
  */
-static int
+inline static int
 _gnutls_handshake_hash_init (gnutls_session_t session)
 {
-  gnutls_protocol_t ver = gnutls_protocol_get_version (session);
 
   if (session->internals.handshake_mac_handle_init == 0)
     {
-      int ret;
-
-      /* set the hash type for handshake message hashing */
-      if (_gnutls_version_has_selectable_prf (ver))
-        session->security_parameters.handshake_mac_handle_type = HANDSHAKE_MAC_TYPE_12;
-      else
-        session->security_parameters.handshake_mac_handle_type = HANDSHAKE_MAC_TYPE_10;
-
-
-      if (session->security_parameters.handshake_mac_handle_type == HANDSHAKE_MAC_TYPE_10) 
-        {
-          ret =
-  	    _gnutls_hash_init (&session->internals.handshake_mac_handle.tls10.md5,
+      int ret =
+	_gnutls_hash_init (&session->internals.handshake_mac_handle_md5,
 			   GNUTLS_MAC_MD5);
 
-          if (ret < 0)
-  	    {
-	      gnutls_assert ();
-	      return ret;
-	    }
+      if (ret < 0)
+	{
+	  gnutls_assert ();
+	  return ret;
+	}
 
-          ret =
-            _gnutls_hash_init (&session->internals.handshake_mac_handle.tls10.sha,
+      ret =
+	_gnutls_hash_init (&session->internals.handshake_mac_handle_sha,
 			   GNUTLS_MAC_SHA1);
-          if (ret < 0)
-	    {
-	      gnutls_assert ();
-	      _gnutls_hash_deinit (&session->internals.handshake_mac_handle.tls10.md5, NULL);
-	      return GNUTLS_E_MEMORY_ERROR;
-	    }
-        }
-      else if (session->security_parameters.handshake_mac_handle_type == HANDSHAKE_MAC_TYPE_12)
-        {
-        /* The algorithm to compute hash over handshake messages must be
-  	   same as the one used as the basis for PRF.  By now we use
-	   SHA256. */
-          gnutls_digest_algorithm_t hash_algo = GNUTLS_MAC_SHA256;
-
-          ret =
-           _gnutls_hash_init (&session->internals.handshake_mac_handle.tls12.mac,
-			   hash_algo);
-           if (ret < 0)
-	     {
-	       gnutls_assert ();
-	       return GNUTLS_E_MEMORY_ERROR;
-  	     }
-        }
+      if (ret < 0)
+	{
+	  gnutls_assert ();
+	  return GNUTLS_E_MEMORY_ERROR;
+	}
 
       session->internals.handshake_mac_handle_init = 1;
     }
@@ -2371,6 +2269,12 @@ gnutls_handshake (gnutls_session_t session)
 {
   int ret;
 
+  if ((ret = _gnutls_handshake_hash_init (session)) < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
   if (session->security_parameters.entity == GNUTLS_CLIENT)
     {
       ret = _gnutls_handshake_client (session);
@@ -2408,9 +2312,9 @@ gnutls_handshake (gnutls_session_t session)
   return 0;
 }
 
-#define IMED_RET( str, ret, check_fatal) do { \
+#define IMED_RET( str, ret) do { \
 	if (ret < 0) { \
-		if (check_fatal != 0 && gnutls_error_is_fatal(ret)==0) return ret; \
+		if (gnutls_error_is_fatal(ret)==0) return ret; \
 		gnutls_assert(); \
 		ERR( str, ret); \
 		_gnutls_handshake_hash_buffers_clear(session); \
@@ -2448,7 +2352,7 @@ _gnutls_handshake_client (gnutls_session_t session)
     case STATE1:
       ret = _gnutls_send_hello (session, AGAIN (STATE1));
       STATE = STATE1;
-      IMED_RET ("send hello", ret, 0);
+      IMED_RET ("send hello", ret);
 
     case STATE2:
       /* receive the server hello */
@@ -2457,14 +2361,14 @@ _gnutls_handshake_client (gnutls_session_t session)
 				GNUTLS_HANDSHAKE_SERVER_HELLO,
 				MANDATORY_PACKET);
       STATE = STATE2;
-      IMED_RET ("recv hello", ret, 1);
+      IMED_RET ("recv hello", ret);
 
     case STATE70:
       if (session->security_parameters.extensions.do_recv_supplemental)
 	{
 	  ret = _gnutls_recv_supplemental (session);
 	  STATE = STATE70;
-	  IMED_RET ("recv supplemental", ret, 1);
+	  IMED_RET ("recv supplemental", ret);
 	}
 
     case STATE3:
@@ -2472,14 +2376,14 @@ _gnutls_handshake_client (gnutls_session_t session)
       if (session->internals.resumed == RESUME_FALSE)	/* if we are not resuming */
 	ret = _gnutls_recv_server_certificate (session);
       STATE = STATE3;
-      IMED_RET ("recv server certificate", ret, 1);
+      IMED_RET ("recv server certificate", ret);
 
     case STATE4:
       /* receive the server key exchange */
       if (session->internals.resumed == RESUME_FALSE)	/* if we are not resuming */
 	ret = _gnutls_recv_server_kx_message (session);
       STATE = STATE4;
-      IMED_RET ("recv server kx message", ret, 1);
+      IMED_RET ("recv server kx message", ret);
 
     case STATE5:
       /* receive the server certificate request - if any 
@@ -2488,7 +2392,7 @@ _gnutls_handshake_client (gnutls_session_t session)
       if (session->internals.resumed == RESUME_FALSE)	/* if we are not resuming */
 	ret = _gnutls_recv_server_certificate_request (session);
       STATE = STATE5;
-      IMED_RET ("recv server certificate request message", ret, 1);
+      IMED_RET ("recv server certificate request message", ret);
 
     case STATE6:
       /* receive the server hello done */
@@ -2498,14 +2402,14 @@ _gnutls_handshake_client (gnutls_session_t session)
 				  GNUTLS_HANDSHAKE_SERVER_HELLO_DONE,
 				  MANDATORY_PACKET);
       STATE = STATE6;
-      IMED_RET ("recv server hello done", ret, 1);
+      IMED_RET ("recv server hello done", ret);
 
     case STATE71:
       if (session->security_parameters.extensions.do_send_supplemental)
 	{
 	  ret = _gnutls_send_supplemental (session, AGAIN (STATE71));
 	  STATE = STATE71;
-	  IMED_RET ("send supplemental", ret, 0);
+	  IMED_RET ("send supplemental", ret);
 	}
 
     case STATE7:
@@ -2514,13 +2418,13 @@ _gnutls_handshake_client (gnutls_session_t session)
       if (session->internals.resumed == RESUME_FALSE)	/* if we are not resuming */
 	ret = _gnutls_send_client_certificate (session, AGAIN (STATE7));
       STATE = STATE7;
-      IMED_RET ("send client certificate", ret, 0);
+      IMED_RET ("send client certificate", ret);
 
     case STATE8:
       if (session->internals.resumed == RESUME_FALSE)	/* if we are not resuming */
 	ret = _gnutls_send_client_kx_message (session, AGAIN (STATE8));
       STATE = STATE8;
-      IMED_RET ("send client kx", ret, 0);
+      IMED_RET ("send client kx", ret);
 
     case STATE9:
       /* send client certificate verify */
@@ -2528,7 +2432,7 @@ _gnutls_handshake_client (gnutls_session_t session)
 	ret =
 	  _gnutls_send_client_certificate_verify (session, AGAIN (STATE9));
       STATE = STATE9;
-      IMED_RET ("send client certificate verify", ret, 0);
+      IMED_RET ("send client certificate verify", ret);
 
       STATE = STATE0;
     default:
@@ -2677,19 +2581,19 @@ _gnutls_handshake_server (gnutls_session_t session)
 				GNUTLS_HANDSHAKE_CLIENT_HELLO,
 				MANDATORY_PACKET);
       STATE = STATE1;
-      IMED_RET ("recv hello", ret, 1);
+      IMED_RET ("recv hello", ret);
 
     case STATE2:
       ret = _gnutls_send_hello (session, AGAIN (STATE2));
       STATE = STATE2;
-      IMED_RET ("send hello", ret, 0);
+      IMED_RET ("send hello", ret);
 
     case STATE70:
       if (session->security_parameters.extensions.do_send_supplemental)
 	{
 	  ret = _gnutls_send_supplemental (session, AGAIN (STATE70));
 	  STATE = STATE70;
-	  IMED_RET ("send supplemental data", ret, 0);
+	  IMED_RET ("send supplemental data", ret);
 	}
 
       /* SEND CERTIFICATE + KEYEXCHANGE + CERTIFICATE_REQUEST */
@@ -2699,14 +2603,14 @@ _gnutls_handshake_server (gnutls_session_t session)
       if (session->internals.resumed == RESUME_FALSE)
 	ret = _gnutls_send_server_certificate (session, AGAIN (STATE3));
       STATE = STATE3;
-      IMED_RET ("send server certificate", ret, 0);
+      IMED_RET ("send server certificate", ret);
 
     case STATE4:
       /* send server key exchange (A) */
       if (session->internals.resumed == RESUME_FALSE)
 	ret = _gnutls_send_server_kx_message (session, AGAIN (STATE4));
       STATE = STATE4;
-      IMED_RET ("send server kx", ret, 0);
+      IMED_RET ("send server kx", ret);
 
     case STATE5:
       /* Send certificate request - if requested to */
@@ -2714,7 +2618,7 @@ _gnutls_handshake_server (gnutls_session_t session)
 	ret =
 	  _gnutls_send_server_certificate_request (session, AGAIN (STATE5));
       STATE = STATE5;
-      IMED_RET ("send server cert request", ret, 0);
+      IMED_RET ("send server cert request", ret);
 
     case STATE6:
       /* send the server hello done */
@@ -2724,14 +2628,14 @@ _gnutls_handshake_server (gnutls_session_t session)
 					GNUTLS_HANDSHAKE_SERVER_HELLO_DONE,
 					AGAIN (STATE6));
       STATE = STATE6;
-      IMED_RET ("send server hello done", ret, 0);
+      IMED_RET ("send server hello done", ret);
 
     case STATE71:
       if (session->security_parameters.extensions.do_recv_supplemental)
 	{
 	  ret = _gnutls_recv_supplemental (session);
 	  STATE = STATE71;
-	  IMED_RET ("recv client supplemental", ret, 1);
+	  IMED_RET ("recv client supplemental", ret);
 	}
 
       /* RECV CERTIFICATE + KEYEXCHANGE + CERTIFICATE_VERIFY */
@@ -2740,21 +2644,21 @@ _gnutls_handshake_server (gnutls_session_t session)
       if (session->internals.resumed == RESUME_FALSE)	/* if we are not resuming */
 	ret = _gnutls_recv_client_certificate (session);
       STATE = STATE7;
-      IMED_RET ("recv client certificate", ret, 1);
+      IMED_RET ("recv client certificate", ret);
 
     case STATE8:
       /* receive the client key exchange message */
       if (session->internals.resumed == RESUME_FALSE)	/* if we are not resuming */
 	ret = _gnutls_recv_client_kx_message (session);
       STATE = STATE8;
-      IMED_RET ("recv client kx", ret, 1);
+      IMED_RET ("recv client kx", ret);
 
     case STATE9:
       /* receive the client certificate verify message */
       if (session->internals.resumed == RESUME_FALSE)	/* if we are not resuming */
 	ret = _gnutls_recv_client_certificate_verify_message (session);
       STATE = STATE9;
-      IMED_RET ("recv client certificate verify", ret, 1);
+      IMED_RET ("recv client certificate verify", ret);
 
       STATE = STATE0;		/* finished thus clear session */
     default:
@@ -2778,19 +2682,26 @@ _gnutls_handshake_common (gnutls_session_t session)
       /* if we are a client resuming - or we are a server not resuming */
 
       ret = _gnutls_recv_handshake_final (session, TRUE);
-      IMED_RET ("recv handshake final", ret, 1);
+      IMED_RET ("recv handshake final", ret);
 
       ret = _gnutls_send_handshake_final (session, FALSE);
-      IMED_RET ("send handshake final", ret, 0);
+      IMED_RET ("send handshake final", ret);
+
+      /* only store if we are not resuming */
+      if (session->security_parameters.entity == GNUTLS_SERVER)
+        {
+          /* in order to support session resuming */
+          _gnutls_server_register_current_session (session);
+        }
     }
   else
     {				/* if we are a client not resuming - or we are a server resuming */
 
       ret = _gnutls_send_handshake_final (session, TRUE);
-      IMED_RET ("send handshake final 2", ret, 0);
+      IMED_RET ("send handshake final 2", ret);
 
       ret = _gnutls_recv_handshake_final (session, FALSE);
-      IMED_RET ("recv handshake final 2", ret, 1);
+      IMED_RET ("recv handshake final 2", ret);
     }
 
   /* clear handshake buffer */
diff --git a/lib/gnutls_handshake.h b/lib/gnutls_handshake.h
index c6594bd3bf..5cff279add 100644
--- a/lib/gnutls_handshake.h
+++ b/lib/gnutls_handshake.h
@@ -53,8 +53,6 @@ int _gnutls_server_select_suite (gnutls_session_t session, opaque * data,
 int _gnutls_negotiate_version( gnutls_session_t session, gnutls_protocol_t adv_version);
 int _gnutls_user_hello_func( gnutls_session, gnutls_protocol_t adv_version);
 
-void _gnutls_handshake_hash_buffers_clear (gnutls_session_t session);
-
 #define STATE session->internals.handshake_state
 /* This returns true if we have got there
  * before (and not finished due to an interrupt).
diff --git a/lib/gnutls_hash_int.c b/lib/gnutls_hash_int.c
index 5e5b2aa6e1..e55ae541e2 100644
--- a/lib/gnutls_hash_int.c
+++ b/lib/gnutls_hash_int.c
@@ -77,7 +77,6 @@ _gnutls_hash_init (digest_hd_st * dig, gnutls_digest_algorithm_t algorithm)
 	  gnutls_assert ();
 	  return GNUTLS_E_HASH_FAILED;
 	}
-      dig->active = 1;
       return 0;
     }
 
@@ -90,7 +89,6 @@ _gnutls_hash_init (digest_hd_st * dig, gnutls_digest_algorithm_t algorithm)
       return result;
     }
 
-  dig->active = 1;
   return 0;
 }
 
@@ -121,10 +119,10 @@ _gnutls_hash_copy (digest_hd_st * dst, digest_hd_st * src)
 {
   int result;
 
-  memset(dst, 0, sizeof(*dst));
   dst->algorithm = src->algorithm;
+  dst->key = NULL;		/* it's a hash anyway */
+  dst->keysize = 0;
   dst->registered = src->registered;
-  dst->active = 1;
 
   if (src->registered)
     {
@@ -167,14 +165,7 @@ _gnutls_hash_output (digest_hd_st * handle, void *digest)
 void
 _gnutls_hash_deinit (digest_hd_st * handle, void *digest)
 {
-  if (handle->active != 1) {
-    return;
-  }
-
-  if (digest != NULL)
-    _gnutls_hash_output (handle, digest);
-
-  handle->active = 0;
+  _gnutls_hash_output (handle, digest);
 
   if (handle->registered && handle->hd.rh.ctx != NULL)
     {
@@ -278,7 +269,6 @@ _gnutls_hmac_init (digest_hd_st * dig, gnutls_mac_algorithm_t algorithm,
 	  return GNUTLS_E_HASH_FAILED;
 	}
 
-      dig->active = 1;
       return 0;
     }
 
@@ -293,7 +283,6 @@ _gnutls_hmac_init (digest_hd_st * dig, gnutls_mac_algorithm_t algorithm,
 
   _gnutls_mac_ops.setkey (dig->hd.gc, key, keylen);
 
-  dig->active = 1;
   return 0;
 }
 
@@ -334,14 +323,8 @@ _gnutls_hmac_output (digest_hd_st * handle, void *digest)
 void
 _gnutls_hmac_deinit (digest_hd_st * handle, void *digest)
 {
-  if (handle->active != 1) {
-    return;
-  }
-
-  if (digest)
-    _gnutls_hmac_output (handle, digest);
+  _gnutls_hmac_output (handle, digest);
 
-  handle->active = 0;
   if (handle->registered && handle->hd.rh.ctx != NULL)
     {
       handle->hd.rh.cc->deinit (handle->hd.rh.ctx);
@@ -415,7 +398,6 @@ _gnutls_mac_deinit_ssl3 (digest_hd_st * handle, void *digest)
   if (padsize == 0)
     {
       gnutls_assert ();
-      _gnutls_hash_deinit (handle, NULL);
       return;
     }
 
@@ -425,7 +407,6 @@ _gnutls_mac_deinit_ssl3 (digest_hd_st * handle, void *digest)
   if (rc < 0)
     {
       gnutls_assert ();
-      _gnutls_hash_deinit (handle, NULL);
       return;
     }
 
diff --git a/lib/gnutls_hash_int.h b/lib/gnutls_hash_int.h
index d915af587b..8017d12f9a 100644
--- a/lib/gnutls_hash_int.h
+++ b/lib/gnutls_hash_int.h
@@ -52,7 +52,6 @@ typedef struct
   gnutls_mac_algorithm_t algorithm;
   const void *key;
   int keysize;
-  int active;
 } digest_hd_st;
 
 int _gnutls_hmac_init (digest_hd_st*, gnutls_mac_algorithm_t algorithm,
diff --git a/lib/gnutls_int.h b/lib/gnutls_int.h
index a56cd26bce..6d6ab5d562 100644
--- a/lib/gnutls_int.h
+++ b/lib/gnutls_int.h
@@ -195,12 +195,6 @@ typedef enum content_type_t
 #define GNUTLS_PK_ANY (gnutls_pk_algorithm_t)-1
 #define GNUTLS_PK_NONE (gnutls_pk_algorithm_t)-2
 
-typedef enum
-{
-  HANDSHAKE_MAC_TYPE_10=1,
-  HANDSHAKE_MAC_TYPE_12
-} handshake_mac_type_t;
-
 /* Store & Retrieve functions defines: 
  */
 
@@ -214,6 +208,7 @@ typedef struct auth_cred_st
   struct auth_cred_st *next;
 } auth_cred_st;
 
+
 struct gnutls_key_st
 {
   /* For DH KX */
@@ -344,7 +339,6 @@ typedef struct
   gnutls_cipher_algorithm_t write_bulk_cipher_algorithm;
   gnutls_mac_algorithm_t write_mac_algorithm;
   gnutls_compression_method_t write_compression_algorithm;
-  handshake_mac_type_t handshake_mac_handle_type; /* one of HANDSHAKE_TYPE_10 and HANDSHAKE_TYPE_12 */
 
   /* this is the ciphersuite we are going to use 
    * moved here from internals in order to be restored
@@ -452,25 +446,14 @@ typedef struct
   gnutls_handshake_description_t recv_type;
 } handshake_header_buffer_st;
 
-
 typedef struct
 {
   gnutls_buffer application_data_buffer;	/* holds data to be delivered to application layer */
   gnutls_buffer handshake_hash_buffer;	/* used to keep the last received handshake 
 					 * message */
-  union
-    {
-      struct 
-        {
-          digest_hd_st sha;	/* hash of the handshake messages */
-          digest_hd_st md5;	/* hash of the handshake messages */
-        } tls10;
-      struct
-        {
-          digest_hd_st mac;	/* hash of the handshake messages for TLS 1.2+ */
-        } tls12;
-    } handshake_mac_handle;
-  int handshake_mac_handle_init; /* 1 when the previous union and type were initialized */
+  digest_hd_st handshake_mac_handle_sha;	/* hash of the handshake messages */
+  digest_hd_st handshake_mac_handle_md5;	/* hash of the handshake messages */
+  int handshake_mac_handle_init; /* 1 when the previous two were initialized */
 
   gnutls_buffer handshake_data_buffer;	/* this is a buffer that holds the current handshake message */
   gnutls_buffer ia_data_buffer;	/* holds inner application data (TLS/IA) */
diff --git a/lib/gnutls_sig.c b/lib/gnutls_sig.c
index aa0316e3db..81f5aa355b 100644
--- a/lib/gnutls_sig.c
+++ b/lib/gnutls_sig.c
@@ -58,17 +58,8 @@ _gnutls_tls_sign_hdata (gnutls_session_t session,
   digest_hd_st td_sha;
   gnutls_protocol_t ver = gnutls_protocol_get_version (session);
 
-  /* FIXME: This is not compliant to TLS 1.2. We should use an algorithm from the
-   * SignatureAndHashAlgorithm field of Certificate Request.
-   */
-  if (session->security_parameters.handshake_mac_handle_type != HANDSHAKE_MAC_TYPE_10)
-    {
-      gnutls_assert();
-      return GNUTLS_E_UNIMPLEMENTED_FEATURE;
-    }
-  
   ret =
-    _gnutls_hash_copy (&td_sha, &session->internals.handshake_mac_handle.tls10.sha);
+    _gnutls_hash_copy (&td_sha, &session->internals.handshake_mac_handle_sha);
   if (ret < 0)
     {
       gnutls_assert ();
@@ -96,7 +87,7 @@ _gnutls_tls_sign_hdata (gnutls_session_t session,
     case GNUTLS_PK_RSA:
       ret =
 	_gnutls_hash_copy (&td_md5,
-			   &session->internals.handshake_mac_handle.tls10.md5);
+			   &session->internals.handshake_mac_handle_md5);
       if (ret < 0)
 	{
 	  gnutls_assert ();
@@ -385,14 +376,8 @@ _gnutls_verify_sig_hdata (gnutls_session_t session, gnutls_cert * cert,
   gnutls_datum_t dconcat;
   gnutls_protocol_t ver = gnutls_protocol_get_version (session);
 
-  if (session->security_parameters.handshake_mac_handle_type != HANDSHAKE_MAC_TYPE_10)
-    {
-      gnutls_assert();
-      return GNUTLS_E_UNIMPLEMENTED_FEATURE;
-    }
-
   ret =
-    _gnutls_hash_copy (&td_md5, &session->internals.handshake_mac_handle.tls10.md5);
+    _gnutls_hash_copy (&td_md5, &session->internals.handshake_mac_handle_md5);
   if (ret < 0)
     {
       gnutls_assert ();
@@ -400,7 +385,7 @@ _gnutls_verify_sig_hdata (gnutls_session_t session, gnutls_cert * cert,
     }
 
   ret =
-    _gnutls_hash_copy (&td_sha, &session->internals.handshake_mac_handle.tls10.sha);
+    _gnutls_hash_copy (&td_sha, &session->internals.handshake_mac_handle_sha);
   if (ret < 0)
     {
       gnutls_assert ();
diff --git a/lib/gnutls_state.c b/lib/gnutls_state.c
index 78f7145b19..d9abd556c7 100644
--- a/lib/gnutls_state.c
+++ b/lib/gnutls_state.c
@@ -201,8 +201,6 @@ deinit_internal_params (gnutls_session_t session)
   if (session->internals.params.free_rsa_params)
     gnutls_rsa_params_deinit (session->internals.params.rsa_params);
 
-  _gnutls_handshake_hash_buffers_clear(session);
-
   memset (&session->internals.params, 0, sizeof (session->internals.params));
 }
 
@@ -210,8 +208,8 @@ deinit_internal_params (gnutls_session_t session)
  * structure within the session, which depend on the current handshake.
  * This is used to allow further handshakes.
  */
-static void
-_gnutls_handshake_internal_state_init (gnutls_session_t session)
+void
+_gnutls_handshake_internal_state_clear (gnutls_session_t session)
 {
   session->internals.extensions_sent_size = 0;
 
@@ -233,13 +231,6 @@ _gnutls_handshake_internal_state_init (gnutls_session_t session)
   session->internals.last_handshake_out = -1;
 
   session->internals.resumable = RESUME_TRUE;
-}
-
-void
-_gnutls_handshake_internal_state_clear (gnutls_session_t session)
-{
-  _gnutls_handshake_internal_state_init(session);
-
   _gnutls_free_datum (&session->internals.recv_buffer);
 
   deinit_internal_params (session);
@@ -345,7 +336,7 @@ gnutls_init (gnutls_session_t * session, gnutls_connection_end_t con_end)
    * as NULL or 0. This is why calloc is used.
    */
 
-  _gnutls_handshake_internal_state_init (*session);
+  _gnutls_handshake_internal_state_clear (*session);
 
   return 0;
 }