From e970cdfbc0d42a0cbdac36c76e65d0bfd94600cc Mon Sep 17 00:00:00 2001
From: toddouska <todd@yassl.com>
Date: Wed, 3 Oct 2012 11:57:20 -0700
Subject: [PATCH] init cipher specs, check client key exchange state b4 process

---
 cyassl/error.h    |  2 ++
 cyassl/internal.h |  2 ++
 src/internal.c    | 33 +++++++++++++++++++++++++++++++++
 3 files changed, 37 insertions(+)

diff --git a/cyassl/error.h b/cyassl/error.h
index acc269db6..1c3909fe7 100644
--- a/cyassl/error.h
+++ b/cyassl/error.h
@@ -105,6 +105,8 @@ enum CyaSSL_ErrorCodes {
     SEQUENCE_ERROR         = -270,            /* dtls sequence error */
     SUITES_ERROR           = -271,            /* suites pointer error */
     SSL_NO_PEM_HEADER      = -272,            /* no PEM header found */
+    OUT_OF_ORDER_E         = -273,            /* out of order message */
+    BAD_KEA_TYPE_E         = -274,            /* bad KEA type found */
     /* add strings to SetErrorString !!!!! */
 
     /* begin negotiation parameter errors */
diff --git a/cyassl/internal.h b/cyassl/internal.h
index 53c96c612..e6e276e8f 100644
--- a/cyassl/internal.h
+++ b/cyassl/internal.h
@@ -872,6 +872,8 @@ typedef struct CipherSpecs {
 } CipherSpecs;
 
 
+void InitCipherSpecs(CipherSpecs* cs);
+
 
 /* Supported Ciphers from page 43  */
 enum BulkCipherAlgorithm { 
diff --git a/src/internal.c b/src/internal.c
index 9b6101bcb..0b4ad9c1a 100644
--- a/src/internal.c
+++ b/src/internal.c
@@ -489,6 +489,22 @@ void FreeCiphers(CYASSL* ssl)
 }
 
 
+void InitCipherSpecs(CipherSpecs* cs)
+{
+    cs->bulk_cipher_algorithm = -1;
+    cs->cipher_type           = -1;
+    cs->mac_algorithm         = -1;
+    cs->kea                   = -1;
+    cs->sig_algo              = -1;
+
+    cs->hash_size   = 0;
+    cs->static_ecdh = 0;
+    cs->key_size    = 0;
+    cs->iv_size     = 0;
+    cs->block_size  = 0;
+}
+
+
 void InitSuites(Suites* suites, ProtocolVersion pv, byte haveDH, byte havePSK,
                 byte haveNTRU, byte haveECDSAsig, byte haveStaticECC, int side)
 {
@@ -4317,6 +4333,14 @@ void SetErrorString(int error, char* str)
         XSTRNCPY(str, "No PEM Header Error", max);
         break;
 
+    case OUT_OF_ORDER_E:
+        XSTRNCPY(str, "Out of order message, fatal", max);
+        break;
+
+    case BAD_KEA_TYPE_E:
+        XSTRNCPY(str, "Bad KEA type found", max);
+        break;
+
     default :
         XSTRNCPY(str, "unknown error number", max);
     }
@@ -7301,6 +7325,11 @@ int SetCipherList(Suites* s, const char* list)
         word32 length = 0;
         byte*  out;
 
+        if (ssl->options.clientState < CLIENT_HELLO_COMPLETE) {
+            CYASSL_MSG("Client sending keyexchange at wrong time");
+            return OUT_OF_ORDER_E;
+        }
+
         if (ssl->options.verifyPeer && ssl->options.failNoCert)
             if (!ssl->options.havePeerCert) {
                 CYASSL_MSG("client didn't present peer cert");
@@ -7471,6 +7500,10 @@ int SetCipherList(Suites* s, const char* list)
                 ret = MakeMasterSecret(ssl);
 #endif /* OPENSSL_EXTRA */
         }
+        else {
+            CYASSL_MSG("Bad kea type");
+            return BAD_KEA_TYPE_E; 
+        }
 
         if (ret == 0) {
             ssl->options.clientState = CLIENT_KEYEXCHANGE_COMPLETE;