It seems odd that I haven't seen a full state diagram (including send/receive packet details) for SSL, unlike e.g. TCP, since I think that having one, either as part of the spec (which only contains a brief one for the handshake sequence) or created from it before writing any code, would've made it much more difficult to cause bugs like this. At least I've found state diagrams very useful when working with protocols like this.
Agreed. The sheer brilliance of clarity in the classic TCP/IP Illustrated: Volume 1 - The Protocols only becomes visible in hindsight. Anyone know if the the LaTeX source for its diagrams are available? I have been able to emulate them for the most part in graphviz using shape=record when required, but wonder if that was the technique used.
(PS. Reading the above tome ~1999, I actually discovered numerous specification flaws in the RFCs ... eg. for ARP and ICMP, that could be used for remote OS detection.)
