From 02cabd0f26d2fc17a3967fab2afe52fb92080457 Mon Sep 17 00:00:00 2001
From: Martin Willi <martin@revosec.ch>
Date: Thu, 9 Aug 2012 12:10:41 +0200
Subject: [PATCH] Check if TLS handshake received Finished before processing
 application data

---
 src/libtls/tls_fragmentation.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/libtls/tls_fragmentation.c b/src/libtls/tls_fragmentation.c
index eb9976884..f2fa77cfd 100644
--- a/src/libtls/tls_fragmentation.c
+++ b/src/libtls/tls_fragmentation.c
@@ -197,6 +197,12 @@ static status_t process_handshake(private_tls_fragmentation_t *this,
 static status_t process_application(private_tls_fragmentation_t *this,
 									bio_reader_t *reader)
 {
+	if (!this->handshake->finished(this->handshake))
+	{
+		DBG1(DBG_TLS, "received TLS application data, "
+			 "but handshake not finished");
+		return FAILED;
+	}
 	while (reader->remaining(reader))
 	{
 		status_t status;