From: Nikos Mavrogiannopoulos <nmav@gnutls.org>
Date: Wed, 1 Nov 2000 12:38:20 +0000 (+0000)
Subject: added some preliminary support for DHE_DSS and DHE_RSA algorithms... of course
X-Git-Tag: gnutls0-0-4~33
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=848da38b80f7c8ce8e3bdb684adff1ea7ec38ad5;p=thirdparty%2Fgnutls.git

added some preliminary support for DHE_DSS and DHE_RSA algorithms... of course
not certificates are used
---

diff --git a/lib/defines.h b/lib/defines.h
index ac4e6e7e87..31f0fd8b26 100644
--- a/lib/defines.h
+++ b/lib/defines.h
@@ -1,5 +1,4 @@
 #include <config.h>
-#include <assert.h>
 
 #ifdef STDC_HEADERS
 # include <string.h>
diff --git a/lib/gnutls.c b/lib/gnutls.c
index 46e0fc29e9..36b0520765 100644
--- a/lib/gnutls.c
+++ b/lib/gnutls.c
@@ -338,7 +338,7 @@ ssize_t gnutls_send_int(int cd, GNUTLS_STATE state, ContentType type, char *data
 	if (sizeofdata == 0)
 		return 0;
 	if (state->gnutls_internals.valid_connection == VALID_FALSE) {
-		assert(0);
+		gnutls_assert();
 		return GNUTLS_E_INVALID_SESSION;
 	}
 
@@ -376,21 +376,21 @@ ssize_t gnutls_send_int(int cd, GNUTLS_STATE state, ContentType type, char *data
 		if (Write(cd, &gcipher->type, 1) != 1) {
 			state->gnutls_internals.valid_connection = VALID_FALSE;
 			state->gnutls_internals.resumable = RESUME_FALSE;
-			assert(0);
+			gnutls_assert();
 			return GNUTLS_E_UNABLE_SEND_DATA;
 		}
 
 		if (Write(cd, &gcipher->version.major, 1) != 1) {
 			state->gnutls_internals.valid_connection = VALID_FALSE;
 			state->gnutls_internals.resumable = RESUME_FALSE;
-			assert(0);
+			gnutls_assert();
 			return GNUTLS_E_UNABLE_SEND_DATA;
 		}
 
 		if (Write(cd, &gcipher->version.minor, 1) != 1) {
 			state->gnutls_internals.valid_connection = VALID_FALSE;
 			state->gnutls_internals.resumable = RESUME_FALSE;
-			assert(0);
+			gnutls_assert();
 			return GNUTLS_E_UNABLE_SEND_DATA;
 		}
 #ifdef HARD_DEBUG
@@ -405,14 +405,14 @@ ssize_t gnutls_send_int(int cd, GNUTLS_STATE state, ContentType type, char *data
 		if (Write(cd, &length, sizeof(uint16)) != sizeof(uint16)) {
 			state->gnutls_internals.valid_connection = VALID_FALSE;
 			state->gnutls_internals.resumable = RESUME_FALSE;
-			assert(0);
+			gnutls_assert();
 			return GNUTLS_E_UNABLE_SEND_DATA;
 		}
 
 		if (Write(cd, gcipher->fragment, gcipher->length) != gcipher->length) {
 			state->gnutls_internals.valid_connection = VALID_FALSE;
 			state->gnutls_internals.resumable = RESUME_FALSE;
-			assert(0);
+			gnutls_assert();
 			return GNUTLS_E_UNABLE_SEND_DATA;
 		}
 		state->connection_state.write_sequence_number++;
@@ -451,31 +451,31 @@ ssize_t gnutls_send_int(int cd, GNUTLS_STATE state, ContentType type, char *data
 		if (Write(cd, &gcipher->type, 1) != 1) {
 			state->gnutls_internals.valid_connection = VALID_FALSE;
 			state->gnutls_internals.resumable = RESUME_FALSE;
-			assert(0);
+			gnutls_assert();
 			return GNUTLS_E_UNABLE_SEND_DATA;
 		}
 		if (Write(cd, &gcipher->version.major, 1) != 1) {
 			state->gnutls_internals.valid_connection = VALID_FALSE;
 			state->gnutls_internals.resumable = RESUME_FALSE;
-			assert(0);
+			gnutls_assert();
 			return GNUTLS_E_UNABLE_SEND_DATA;
 		}
 		if (Write(cd, &gcipher->version.minor, 1) != 1) {
 			state->gnutls_internals.valid_connection = VALID_FALSE;
 			state->gnutls_internals.resumable = RESUME_FALSE;
-			assert(0);
+			gnutls_assert();
 			return GNUTLS_E_UNABLE_SEND_DATA;
 		}
 		if (Write(cd, &length, sizeof(uint16)) != sizeof(uint16)) {
 			state->gnutls_internals.valid_connection = VALID_FALSE;
 			state->gnutls_internals.resumable = RESUME_FALSE;
-			assert(0);
+			gnutls_assert();
 			return GNUTLS_E_UNABLE_SEND_DATA;
 		}
 		if (Write(cd, gcipher->fragment, gcipher->length) != gcipher->length) {
 			state->gnutls_internals.valid_connection = VALID_FALSE;
 			state->gnutls_internals.resumable = RESUME_FALSE;
-			assert(0);
+			gnutls_assert();
 			return GNUTLS_E_UNABLE_SEND_DATA;
 		}
 		state->connection_state.write_sequence_number++;
@@ -510,28 +510,28 @@ ssize_t gnutls_recv_int(int cd, GNUTLS_STATE state, ContentType type, char *data
 	}
 
 	if (state->gnutls_internals.valid_connection == VALID_FALSE) {
-		assert(0);
+		gnutls_assert();
 		return GNUTLS_E_INVALID_SESSION;
 	}
 
 	if (Read(cd, &gcipher.type, 1) != 1) {
 		state->gnutls_internals.valid_connection = VALID_FALSE;
 		state->gnutls_internals.resumable = RESUME_FALSE;
-		assert(0);
+		gnutls_assert();
 		return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
 	}
 
 	if (Read(cd, &gcipher.version.major, 1) != 1) {
 		state->gnutls_internals.valid_connection = VALID_FALSE;
 		state->gnutls_internals.resumable = RESUME_FALSE;
-		assert(0);
+		gnutls_assert();
 		return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
 	}
 
 	if (Read(cd, &gcipher.version.minor, 1) != 1) {
 		state->gnutls_internals.valid_connection = VALID_FALSE;
 		state->gnutls_internals.resumable = RESUME_FALSE;
-		assert(0);
+		gnutls_assert();
 		return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
 	}
 
@@ -541,14 +541,14 @@ ssize_t gnutls_recv_int(int cd, GNUTLS_STATE state, ContentType type, char *data
 #endif
 		_gnutls_send_alert(cd, state, GNUTLS_FATAL, GNUTLS_PROTOCOL_VERSION);
 		state->gnutls_internals.resumable = RESUME_FALSE;
-		assert(0);
+		gnutls_assert();
 		return GNUTLS_E_UNSUPPORTED_VERSION_PACKET;
 	}
 
 	if (Read(cd, &gcipher.length, 2) != 2) {
 		state->gnutls_internals.valid_connection = VALID_FALSE;
 		state->gnutls_internals.resumable = RESUME_FALSE;
-		assert(0);
+		gnutls_assert();
 		return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
 	}
 #ifndef WORDS_BIGENDIAN
@@ -569,7 +569,7 @@ ssize_t gnutls_recv_int(int cd, GNUTLS_STATE state, ContentType type, char *data
 		_gnutls_send_alert(cd, state, GNUTLS_FATAL, GNUTLS_RECORD_OVERFLOW);
 		state->gnutls_internals.valid_connection = VALID_FALSE;
 		state->gnutls_internals.resumable = RESUME_FALSE;
-		assert(0);
+		gnutls_assert();
 		return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
 	}
 	gcipher.fragment = gnutls_malloc(gcipher.length);
@@ -586,7 +586,7 @@ ssize_t gnutls_recv_int(int cd, GNUTLS_STATE state, ContentType type, char *data
 		gnutls_free(gcipher.fragment);
 		state->gnutls_internals.valid_connection = VALID_FALSE;
 		state->gnutls_internals.resumable = RESUME_FALSE;
-		assert(0);
+		gnutls_assert();
 		return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
 	}
 
@@ -658,7 +658,7 @@ ssize_t gnutls_recv_int(int cd, GNUTLS_STATE state, ContentType type, char *data
 		case GNUTLS_CHANGE_CIPHER_SPEC:
 
 			if (type != GNUTLS_CHANGE_CIPHER_SPEC) {
-				assert(0);
+				gnutls_assert();
 				return GNUTLS_E_UNEXPECTED_PACKET;
 			}
 			if (((ChangeCipherSpecType)
@@ -668,14 +668,14 @@ ssize_t gnutls_recv_int(int cd, GNUTLS_STATE state, ContentType type, char *data
 			} else {
 				state->gnutls_internals.valid_connection = VALID_FALSE;
 				state->gnutls_internals.resumable = RESUME_FALSE;
-				assert(0);
+				gnutls_assert();
 				ret = GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
 			}
 			state->connection_state.read_sequence_number++;
 			return ret;
 
 		default:
-			assert(0);
+			gnutls_assert();
 			return GNUTLS_E_UNKNOWN_ERROR;
 		}
 	}
@@ -693,7 +693,7 @@ ssize_t gnutls_recv_int(int cd, GNUTLS_STATE state, ContentType type, char *data
 		gnutls_free(tmpdata);
 	} else {
 		if (gcipher.type != type) {
-			assert(0);
+			gnutls_assert();
 			return GNUTLS_E_RECEIVED_BAD_MESSAGE;
 		}
 		/* this is an error because we have messages of fixed
diff --git a/lib/gnutls_algorithms.c b/lib/gnutls_algorithms.c
index bc40d06875..c97ada1db3 100644
--- a/lib/gnutls_algorithms.c
+++ b/lib/gnutls_algorithms.c
@@ -38,7 +38,7 @@ typedef struct gnutls_cipher_entry gnutls_cipher_entry;
 
 static gnutls_cipher_entry algorithms[] = {
 	GNUTLS_CIPHER_ENTRY(GNUTLS_3DES, 8, 24, 1, 8, -1),
-	GNUTLS_CIPHER_ENTRY(GNUTLS_ARCFOUR, 1, 16, 0, 0, -1),
+	GNUTLS_CIPHER_ENTRY(GNUTLS_ARCFOUR, 1, 16, 0, 0, -2),
 	GNUTLS_CIPHER_ENTRY(GNUTLS_NULL, 1, 0, 0, 0, -1),
 	{0}
 };
@@ -96,11 +96,11 @@ typedef struct gnutls_kx_algo_entry gnutls_kx_algo_entry;
 
 static gnutls_kx_algo_entry kx_algorithms[] = {
 	GNUTLS_KX_ALGO_ENTRY(GNUTLS_KX_ANON_DH, 0, 1, 0, 0, 1, -1),
-	GNUTLS_KX_ALGO_ENTRY(GNUTLS_KX_RSA, 1, 0, 1, 1, 0, -1),
+	GNUTLS_KX_ALGO_ENTRY(GNUTLS_KX_RSA, 1, 0, 1, 1, 0, -2),
 	GNUTLS_KX_ALGO_ENTRY(GNUTLS_KX_DHE_DSS, 1, 1, 1, 0, 0, -1),
-	GNUTLS_KX_ALGO_ENTRY(GNUTLS_KX_DHE_RSA, 1, 1, 1, 0, 0, -1),
-	GNUTLS_KX_ALGO_ENTRY(GNUTLS_KX_DH_DSS, 1, 0, 1, 0, 0, -1),
-	GNUTLS_KX_ALGO_ENTRY(GNUTLS_KX_DH_RSA, 1, 0, 1, 0, 0, -1),
+	GNUTLS_KX_ALGO_ENTRY(GNUTLS_KX_DHE_RSA, 1, 1, 1, 0, 0, -2),
+	GNUTLS_KX_ALGO_ENTRY(GNUTLS_KX_DH_DSS, 1, 0, 1, 0, 0, -2),
+	GNUTLS_KX_ALGO_ENTRY(GNUTLS_KX_DH_RSA, 1, 0, 1, 0, 0, -2),
 	{0}
 };
 
@@ -183,7 +183,7 @@ int _gnutls_mac_get_digest_size(MACAlgorithm algorithm)
 
 void _gnutls_mac_set_priority(MACAlgorithm algorithm, int prio)
 {
-	GNUTLS_HASH_ALG_LOOP(p->priority=prio);
+	GNUTLS_HASH_ALG_LOOP( if (p->priority >= -1) p->priority=prio);
 }
 
 int _gnutls_mac_priority(MACAlgorithm algorithm) /* actually returns the priority */
@@ -259,7 +259,7 @@ int _gnutls_cipher_get_block_size(BulkCipherAlgorithm algorithm)
 
 void _gnutls_cipher_set_priority(BulkCipherAlgorithm algorithm, int prio)
 {
-	GNUTLS_ALG_LOOP(p->priority=prio);
+	GNUTLS_ALG_LOOP(if (p->priority >= -1) p->priority=prio);
 }
 
  /* returns the priority */
@@ -360,7 +360,7 @@ int _gnutls_kx_server_certificate(KXAlgorithm algorithm)
 
 void _gnutls_kx_set_priority(KXAlgorithm algorithm, int prio)
 {
-	GNUTLS_KX_ALG_LOOP(p->priority=prio);
+	GNUTLS_KX_ALG_LOOP(if (p->priority >= -1) p->priority=prio);
 }
 
 
diff --git a/lib/gnutls_buffers.c b/lib/gnutls_buffers.c
index 08f5f92c98..78bad50eba 100644
--- a/lib/gnutls_buffers.c
+++ b/lib/gnutls_buffers.c
@@ -113,6 +113,10 @@ ssize_t Read(int fd, void *iptr, size_t sizeOfPtr)
 	size_t left;
 	ssize_t i=0;
 	char *ptr = iptr;
+#ifdef DEBUG
+	int j,x, sum=0;
+#endif
+
 
 	left = sizeOfPtr;
 	while (left > 0) {
@@ -128,6 +132,21 @@ ssize_t Read(int fd, void *iptr, size_t sizeOfPtr)
 
 	}
 
+#ifdef DEBUG
+	fprintf(stderr, "read %d bytes from %d\n", (sizeOfPtr-left), fd);
+	for (x=0;x<((sizeOfPtr-left)/16)+1;x++) {
+		fprintf(stderr, "%.4x - ",x);
+		for (j=0;j<16;j++) {
+			if (sum<(sizeOfPtr-left)) {
+				fprintf(stderr, "%.2x ", ((unsigned char*)ptr)[sum++]);
+			}
+		}
+		fprintf(stderr, "\n");
+	
+	}
+#endif
+
+
 	return (sizeOfPtr - left);
 }
 
@@ -135,9 +154,25 @@ ssize_t Read(int fd, void *iptr, size_t sizeOfPtr)
 ssize_t Write(int fd, const void *iptr, size_t n)
 {
 	size_t left;
+#ifdef DEBUG
+	int j,x, sum=0;
+#endif
 	ssize_t i = 0;
 	const char *ptr = iptr;
 
+#ifdef DEBUG
+	fprintf(stderr, "wrote %d bytes to %d\n", n, fd);
+	for (x=0;x<(n/16)+1;x++) {
+		fprintf(stderr, "%.4x - ",x);
+		for (j=0;j<16;j++) {
+			if (sum<n) {
+				fprintf(stderr, "%.2x ", ((unsigned char*)ptr)[sum++]);
+			}
+		}
+		fprintf(stderr, "\n");
+	
+	}
+#endif
 	left = n;
 	while (left > 0) {
 		i = write(fd, &ptr[i], left);
diff --git a/lib/gnutls_cipher.c b/lib/gnutls_cipher.c
index 43295c8a2d..10b4d142ad 100644
--- a/lib/gnutls_cipher.c
+++ b/lib/gnutls_cipher.c
@@ -44,7 +44,10 @@ int _gnutls_set_cipher(GNUTLS_STATE state, BulkCipherAlgorithm algo)
 {
 
 	if (_gnutls_cipher_is_ok(algo) == 0) {
-		if (_gnutls_cipher_priority(algo) < 0) return GNUTLS_E_UNWANTED_ALGORITHM;
+		if (_gnutls_cipher_priority(algo) < 0) {
+			gnutls_assert();
+			return GNUTLS_E_UNWANTED_ALGORITHM;
+		}
 
 		state->security_parameters.bulk_cipher_algorithm = algo;
 		if (_gnutls_cipher_is_block(algo) == 1) {
@@ -61,6 +64,7 @@ int _gnutls_set_cipher(GNUTLS_STATE state, BulkCipherAlgorithm algo)
 		state->security_parameters.IV_size =
 		    _gnutls_cipher_get_iv_size(algo);
 	} else {
+		gnutls_assert();
 		return GNUTLS_E_UNKNOWN_CIPHER;
 	}
 
@@ -77,6 +81,7 @@ int _gnutls_set_compression(GNUTLS_STATE state, CompressionMethod algo)
 		break;
 
 	default:
+		gnutls_assert();
 		return GNUTLS_E_UNKNOWN_COMPRESSION_ALGORITHM;
 	}
 	return 0;
@@ -90,9 +95,13 @@ int _gnutls_set_mac(GNUTLS_STATE state, MACAlgorithm algo)
 	if (_gnutls_mac_is_ok(algo) == 0) {
 		state->security_parameters.mac_algorithm = algo;
 	} else {
+		gnutls_assert();
 		return GNUTLS_E_UNKNOWN_MAC_ALGORITHM;
 	}
-	if (_gnutls_mac_priority(algo) < 0) return GNUTLS_E_UNWANTED_ALGORITHM;
+	if (_gnutls_mac_priority(algo) < 0) {
+		gnutls_assert();
+		return GNUTLS_E_UNWANTED_ALGORITHM;
+	}
 	state->security_parameters.hash_size = _gnutls_mac_get_digest_size(algo);
 	
 	return 0;
@@ -161,6 +170,7 @@ int _gnutls_connection_state_init(GNUTLS_STATE state)
 		state->connection_state.write_compression_state = NULL;
 		break;
 	default:
+		gnutls_assert();
 		return GNUTLS_E_UNKNOWN_COMPRESSION_ALGORITHM;
 	}
 
@@ -175,6 +185,7 @@ int _gnutls_connection_state_init(GNUTLS_STATE state)
 			state->connection_state.write_mac_secret = gnutls_malloc(mac_size);
 		}
 	} else {
+		gnutls_assert();
 		return GNUTLS_E_UNKNOWN_MAC_ALGORITHM;
 	}
 
@@ -187,6 +198,7 @@ int _gnutls_connection_state_init(GNUTLS_STATE state)
   			  state->cipher_specs.server_write_IV,
 			  state->security_parameters.IV_size);
 		if (state->connection_state.write_cipher_state==GNUTLS_CIPHER_FAILED && state->security_parameters.bulk_cipher_algorithm!=GNUTLS_NULL) {
+			gnutls_assert();
 			return GNUTLS_E_UNKNOWN_CIPHER;
 		}
 
@@ -208,6 +220,7 @@ int _gnutls_connection_state_init(GNUTLS_STATE state)
   			  state->cipher_specs.client_write_IV,
 			  state->security_parameters.IV_size);
 		if (state->connection_state.read_cipher_state==GNUTLS_CIPHER_FAILED && state->security_parameters.bulk_cipher_algorithm!=GNUTLS_NULL) {
+			gnutls_assert();
 			return GNUTLS_E_UNKNOWN_CIPHER;
 		}
 	
@@ -221,6 +234,7 @@ int _gnutls_connection_state_init(GNUTLS_STATE state)
   			  state->cipher_specs.server_write_IV,
 			  state->security_parameters.IV_size);
 		if (state->connection_state.read_cipher_state==GNUTLS_CIPHER_FAILED && state->security_parameters.bulk_cipher_algorithm!=GNUTLS_NULL) {
+			gnutls_assert();
 			return GNUTLS_E_UNKNOWN_CIPHER;
 		}
 
@@ -242,11 +256,13 @@ int _gnutls_connection_state_init(GNUTLS_STATE state)
   			  state->cipher_specs.client_write_IV,
 			  state->security_parameters.IV_size);
 		if (state->connection_state.write_cipher_state==GNUTLS_CIPHER_FAILED && state->security_parameters.bulk_cipher_algorithm!=GNUTLS_NULL) {
+			gnutls_assert();
 			return GNUTLS_E_UNKNOWN_CIPHER;
 		}
 		break;
 
 	default:
+		gnutls_assert();
 		return GNUTLS_E_UNKNOWN_ERROR;
 	}
 
@@ -286,6 +302,7 @@ int _gnutls_TLSCompressed2TLSCiphertext(GNUTLS_STATE state,
 	if (td == GNUTLS_MAC_FAILED && state->security_parameters.mac_algorithm!=GNUTLS_MAC_NULL) {
 		gnutls_free(*cipher);
 		gnutls_free(content);
+		gnutls_assert();
 		return GNUTLS_E_UNKNOWN_MAC_ALGORITHM;
 	}
 
@@ -381,6 +398,7 @@ int _gnutls_TLSCompressed2TLSCiphertext(GNUTLS_STATE state,
 	default:
 		gnutls_free(*cipher);
 		gnutls_free(content);
+		gnutls_assert();
 		return GNUTLS_E_UNKNOWN_CIPHER_TYPE;
 	}
 
@@ -423,6 +441,7 @@ int _gnutls_TLSCiphertext2TLSCompressed(GNUTLS_STATE state,
 	if (td==GNUTLS_MAC_FAILED && state->security_parameters.mac_algorithm!=GNUTLS_MAC_NULL) {
 		gnutls_free(*compress);
 		gnutls_free(content);
+		gnutls_assert();
 		return GNUTLS_E_UNKNOWN_MAC_ALGORITHM;
 	}
 
@@ -454,8 +473,10 @@ int _gnutls_TLSCiphertext2TLSCompressed(GNUTLS_STATE state,
 			    state->connection_state.mac_secret_size - pad -
 			    1;
 
-			if (pad > ciphertext->length - state->connection_state.mac_secret_size)
+			if (pad > ciphertext->length - state->connection_state.mac_secret_size) {
+				gnutls_assert();
 				return GNUTLS_E_RECEIVED_BAD_MESSAGE;
+			}
 			data = gnutls_malloc(length);
 			memmove(data, content, length);
 
@@ -470,6 +491,7 @@ int _gnutls_TLSCiphertext2TLSCompressed(GNUTLS_STATE state,
 	default:
 		gnutls_free(*compress);
 		gnutls_free(content);
+		gnutls_assert();
 		return GNUTLS_E_UNKNOWN_CIPHER_TYPE;
 	}
 
@@ -498,6 +520,7 @@ int _gnutls_TLSCiphertext2TLSCompressed(GNUTLS_STATE state,
 #ifdef DEBUG
 		fprintf(stderr, "MAC FAILED\n");
 #endif
+		gnutls_assert();
 		return GNUTLS_E_MAC_FAILED;
 	}
 
diff --git a/lib/gnutls_errors.c b/lib/gnutls_errors.c
index f75a8bb786..3955b9d279 100644
--- a/lib/gnutls_errors.c
+++ b/lib/gnutls_errors.c
@@ -99,3 +99,26 @@ void gnutls_perror(int error)
 	
 	free( ret);
 }
+
+char* gnutls_strerror(int error)
+{
+	char *ret = NULL;
+	char *pointerTo_;
+
+	/* avoid prefix */
+	GNUTLS_ERROR_ALG_LOOP(ret =
+			      strdup(p->name + sizeof("GNUTLS_E_") - 1));
+
+
+	if (ret != NULL) {
+		tolow(ret, strlen(ret));
+		pointerTo_ = strchr(ret, '_');
+
+		while (pointerTo_ != NULL) {
+			*pointerTo_ = ' ';
+			pointerTo_ = strchr(ret, '_');
+		}
+	}
+	
+	return ret;
+}
diff --git a/lib/gnutls_errors.h b/lib/gnutls_errors.h
index 47ecde5133..be1d46301d 100644
--- a/lib/gnutls_errors.h
+++ b/lib/gnutls_errors.h
@@ -1,3 +1,5 @@
+#include "gnutls_int.h"
+
 #define	GNUTLS_E_MAC_FAILED  -1
 #define	GNUTLS_E_UNKNOWN_CIPHER -2
 #define	GNUTLS_E_UNKNOWN_COMPRESSION_ALGORITHM -3
@@ -23,7 +25,20 @@
 #define GNUTLS_E_UNIMPLEMENTED_FEATURE -50
 
 
+#ifdef DEBUG
+# ifdef __FILE__
+#  ifdef __LINE__
+#   define gnutls_assert() fprintf(stderr, "GNUTLS_ASSERT: %s:%d\n", __FILE__,__LINE__);
+#  else
+#   define gnutls_assert() 1
+#  endif
+# else /* __FILE__ defined */
+#  define gnutls_assert() 1
+# endif
+#else /* no debug */
+# define gnutls_assert() 1
+#endif
 
-
+char* gnutls_strerror(int error);
 void gnutls_perror(int error);
 int gnutls_is_fatal_error( int error);
diff --git a/lib/gnutls_handshake.c b/lib/gnutls_handshake.c
index d9e37d4f19..054b59e009 100644
--- a/lib/gnutls_handshake.c
+++ b/lib/gnutls_handshake.c
@@ -101,7 +101,7 @@ int _gnutls_recv_finished(int cd, GNUTLS_STATE state)
 		return ret;
 	}
 	if (vrfysize != 12) {
-		assert(0);
+		gnutls_assert();
 		return GNUTLS_E_ERROR_IN_FINISHED_PACKET;
 	}
 
@@ -126,7 +126,7 @@ int _gnutls_recv_finished(int cd, GNUTLS_STATE state)
 	}
 
 	if (memcmp(vrfy, data, 12) != 0) {
-		assert(0);
+		gnutls_assert();
 		ret = GNUTLS_E_ERROR_IN_FINISHED_PACKET;
 	}
 
@@ -137,7 +137,7 @@ int _gnutls_recv_finished(int cd, GNUTLS_STATE state)
 }
 
 
-
+/* This selects the best supported ciphersuite from the ones provided */
 int SelectSuite(opaque ret[2], char *data, int datalen)
 {
 	int x, i, j;
@@ -169,10 +169,12 @@ int SelectSuite(opaque ret[2], char *data, int datalen)
 
 
 	gnutls_free(ciphers);
+	gnutls_assert();
 	return GNUTLS_E_UNKNOWN_CIPHER_SUITE;
 
 }
 
+/* This selects the best supported compression method from the ones provided */
 int SelectCompMethod(CompressionMethod * ret, char *data, int datalen)
 {
 	int x, i, j;
@@ -180,9 +182,11 @@ int SelectCompMethod(CompressionMethod * ret, char *data, int datalen)
 
 	x = _gnutls_supported_compression_methods(&ciphers);
 	memset(ret, '\0', sizeof(CompressionMethod));
-
+fprintf(stderr, "datalen: %d\n",datalen);
 	for (j = 0; j < datalen; j++) {
 		for (i = 0; i < x; i++) {
+			fprintf(stderr, "cipher[%d] = %u\n", i, ciphers[i]);
+			fprintf(stderr, "data[%d] = %u\n", j, data[j]);
 			if (memcmp(&ciphers[i], &data[j], 1) == 0) {
 				memmove(ret, &ciphers[i], 1);
 				gnutls_free(ciphers);
@@ -193,6 +197,7 @@ int SelectCompMethod(CompressionMethod * ret, char *data, int datalen)
 
 
 	gnutls_free(ciphers);
+	gnutls_assert();
 	return GNUTLS_E_UNKNOWN_COMPRESSION_ALGORITHM;
 
 }
@@ -296,7 +301,7 @@ int _gnutls_recv_handshake(int cd, GNUTLS_STATE state, uint8 **data,
 	ret = _gnutls_Recv_int(cd, state, GNUTLS_HANDSHAKE, dataptr, 4);
 	if (ret < 0) return ret;
 	if (ret!=4) {
-		assert(0);
+		gnutls_assert();
 		return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
 	}
 
@@ -305,7 +310,7 @@ int _gnutls_recv_handshake(int cd, GNUTLS_STATE state, uint8 **data,
 #endif
 
 	if (dataptr[0]!=type) {
-		assert(0);
+		gnutls_assert();
 		return GNUTLS_E_UNEXPECTED_HANDSHAKE_PACKET;
 	}
 	
@@ -407,6 +412,9 @@ int _gnutls_send_hello(int cd, GNUTLS_STATE state, opaque * SessionID,
 	if (state->security_parameters.entity == GNUTLS_CLIENT) {
 
 		datalen = 2 + 4 + (session_id_len + 1) + 28 + 3;
+		/* 2 for version, 4 for unix time, 28 for random bytes 2 for cipher suite's
+		 * size and 1 for compression method's size 
+		 */
 		data = gnutls_malloc(datalen);
 
 		data[pos++] = state->connection_state.version.major;
@@ -433,8 +441,7 @@ int _gnutls_send_hello(int cd, GNUTLS_STATE state, opaque * SessionID,
 		}
 		pos += session_id_len;
 
-		x = _gnutls_supported_ciphersuites(&cipher_suites);
-
+		x = _gnutls_supported_ciphersuites(&cipher_suites)*sizeof(uint16);
 #ifdef WORDS_BIGENDIAN
 		memmove(&data[pos], &x, sizeof(uint16));
 #else
@@ -453,16 +460,13 @@ int _gnutls_send_hello(int cd, GNUTLS_STATE state, opaque * SessionID,
 			pos += 2;
 		}
 
-		z =
-		    _gnutls_supported_compression_methods
+		z = _gnutls_supported_compression_methods
 		    (&compression_methods);
-		memmove(&data[pos++], &z, sizeof(uint8));
-		datalen += z;
+		memmove(&data[pos++], &z, 1); /* put the number of compression methods */
+		datalen += z; 
 		data = gnutls_realloc(data, datalen);
-
 		for (i = 0; i < z; i++) {
-			memmove(&data[pos], &compression_methods[i], 1);
-			pos++;
+			memmove(&data[pos++], &compression_methods[i], 1);
 		}
 
 		gcry_free(rand);
@@ -542,7 +546,7 @@ int _gnutls_recv_hello(int cd, GNUTLS_STATE state, char *data, int datalen,
 
 	if (state->security_parameters.entity == GNUTLS_CLIENT) {
 		if (datalen < 38) {
-			assert(0);
+			gnutls_assert();
 			return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
 		}
 
@@ -561,7 +565,7 @@ int _gnutls_recv_hello(int cd, GNUTLS_STATE state, char *data, int datalen,
 		memmove(&session_id_len, &data[pos++], 1);
 
 		if (datalen < 38 + session_id_len) {
-			assert(0);
+			gnutls_assert();
 			return GNUTLS_E_UNSUPPORTED_VERSION_PACKET;
 		}
 #ifdef HARD_DEBUG
@@ -618,7 +622,7 @@ int _gnutls_recv_hello(int cd, GNUTLS_STATE state, char *data, int datalen,
 
 	} else {		/* Server side reading a client hello */
 		if (datalen < 35) {
-			assert(0);
+			gnutls_assert();
 			return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
 		}
 
@@ -627,7 +631,7 @@ int _gnutls_recv_hello(int cd, GNUTLS_STATE state, char *data, int datalen,
 #endif
 
 		if ( _gnutls_valid_version( state, data[pos], data[pos+1]) != 0) {
-			assert(0);
+			gnutls_assert();
 			return GNUTLS_E_UNSUPPORTED_VERSION_PACKET;
 		}
 		pos+=2;
@@ -652,16 +656,18 @@ int _gnutls_recv_hello(int cd, GNUTLS_STATE state, char *data, int datalen,
 #endif
 		ret = SelectSuite(state->gnutls_internals.
 			    current_cipher_suite.CipherSuite, &data[pos],
-			    sizeOfSuites);
+			    sizeOfSuites); /* *2 because it's 2 bytes each */
 
 		if (ret<0) return ret;
 		
 		pos += sizeOfSuites;
 
-		memmove(&z, &data[pos++], 1);
+		memmove(&z, &data[pos++], 1); /* z is the number of compression methods */
 		ret = SelectCompMethod(&state->
 				 gnutls_internals.compression_method,
 				 &data[pos], z);
+		pos+=z;
+		
 		if (ret<0) return ret;
 	}
 
@@ -680,7 +686,7 @@ int _gnutls_recv_certificate(int cd, GNUTLS_STATE state, char *data, int datalen
 	
 	if (state->security_parameters.entity == GNUTLS_CLIENT) {
 		if (datalen < 2) {
-			assert(0);
+			gnutls_assert();
 			return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
 		}
 
@@ -694,7 +700,7 @@ int _gnutls_recv_certificate(int cd, GNUTLS_STATE state, char *data, int datalen
 		sizeOfCert=byteswap32(sizeOfCert);
 #endif
 		if (sizeOfCert > MAX24) {
-			assert(0);
+			gnutls_assert();
 			return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
 		}
 		certificate_list = gnutls_malloc(sizeOfCert);
@@ -708,7 +714,7 @@ int _gnutls_recv_certificate(int cd, GNUTLS_STATE state, char *data, int datalen
 	} else {		/* Server side reading a client certificate */
 		/* actually this is not complete */
 		if (datalen < 1) {
-			assert(0);
+			gnutls_assert();
 			return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
 		}
 
diff --git a/lib/gnutls_int.h b/lib/gnutls_int.h
index 4236b95099..ea46943a44 100644
--- a/lib/gnutls_int.h
+++ b/lib/gnutls_int.h
@@ -1,6 +1,9 @@
+#ifndef GNUTLS_INT_H
+
 #include <gcrypt.h>
 
-#undef NDEBUG
+#define GNUTLS_INT_H
+
 #define HARD_DEBUG
 #define DEBUG
 
@@ -292,3 +295,5 @@ int _gnutls_set_keys(GNUTLS_STATE state);
 ssize_t gnutls_send_int(int cd, GNUTLS_STATE state, ContentType type, char* data, size_t sizeofdata);
 ssize_t gnutls_recv_int(int cd, GNUTLS_STATE state, ContentType type, char* data, size_t sizeofdata);
 int _gnutls_send_change_cipher_spec(int cd, GNUTLS_STATE state);
+
+#endif /* GNUTLS_INT_H */
diff --git a/lib/gnutls_kx.c b/lib/gnutls_kx.c
index 800b7963af..db2fa89632 100644
--- a/lib/gnutls_kx.c
+++ b/lib/gnutls_kx.c
@@ -39,11 +39,11 @@ int _gnutls_send_server_kx_message(int cd, GNUTLS_STATE state)
 	GNUTLS_MPI x, X, g, p;
 	int n_X, n_g, n_p;
 	uint16 _n_X, _n_g, _n_p;
-	uint8 *data=NULL;
+	uint8 *data = NULL;
 	uint8 *data_p;
 	uint8 *data_g;
 	uint8 *data_X;
-	int ret=0;
+	int ret = 0;
 
 #ifdef HARD_DEBUG
 	fprintf(stderr, "Sending server KX message\n");
@@ -55,54 +55,44 @@ int _gnutls_send_server_kx_message(int cd, GNUTLS_STATE state)
 
 	/* Do key exchange only if the algorithm permits it */
 	if (_gnutls_kx_server_key_exchange(algorithm) != 0) {
-
-		if ( _gnutls_cipher_suite_get_kx_algo(state->gnutls_internals.current_cipher_suite) == GNUTLS_KX_ANON_DH) {
+		switch (_gnutls_cipher_suite_get_kx_algo
+			(state->gnutls_internals.current_cipher_suite)) {
+		case GNUTLS_KX_ANON_DH:
+		case GNUTLS_KX_DHE_DSS:
+		case GNUTLS_KX_DHE_RSA:
 			X = gnutls_calc_dh_secret(&x);
-
 			state->gnutls_internals.dh_secret = x;
-
 			g = gnutls_get_dh_params(&p);
-
-			gcry_mpi_print(GCRYMPI_FMT_STD, NULL,
-				       &n_g, g);
-			gcry_mpi_print(GCRYMPI_FMT_STD, NULL,
-				       &n_p, p);
-			gcry_mpi_print(GCRYMPI_FMT_STD, NULL,
-				       &n_X, X);
-			data = gnutls_malloc( n_g+n_p+n_X+6);
-
+			gcry_mpi_print(GCRYMPI_FMT_STD, NULL, &n_g, g);
+			gcry_mpi_print(GCRYMPI_FMT_STD, NULL, &n_p, p);
+			gcry_mpi_print(GCRYMPI_FMT_STD, NULL, &n_X, X);
+			data = gnutls_malloc(n_g + n_p + n_X + 6);
 			data_p = &data[0];
 			gcry_mpi_print(GCRYMPI_FMT_STD, &data_p[2],
 				       &n_p, p);
 			gnutls_mpi_release(p);
-
 			_n_p = n_p;
-
 #ifndef WORDS_BIGENDIAN
 			_n_p = byteswap16(_n_p);
 			memmove(data_p, &_n_p, 2);
 #else
 			memmove(data_p, &_n_p, 2);
 #endif
-
-			data_g = &data_p[2+n_p];
+			data_g = &data_p[2 + n_p];
 			gcry_mpi_print(GCRYMPI_FMT_STD, &data_g[2],
 				       &n_g, g);
 			gnutls_mpi_release(g);
 			_n_g = n_g;
 #ifndef WORDS_BIGENDIAN
-
 			_n_g = byteswap16(_n_g);
 			memmove(data_g, &_n_g, 2);
 #else
 			memmove(data_g, &_n_g, 2);
 #endif
-
-			data_X = &data_g[2+n_g];
+			data_X = &data_g[2 + n_g];
 			gcry_mpi_print(GCRYMPI_FMT_STD, &data_X[2],
 				       &n_X, X);
 			gnutls_mpi_release(X);
-			
 			_n_X = n_X;
 #ifndef WORDS_BIGENDIAN
 			_n_X = byteswap16(_n_X);
@@ -110,19 +100,19 @@ int _gnutls_send_server_kx_message(int cd, GNUTLS_STATE state)
 #else
 			memmove(data_X, &_n_X, 2);
 #endif
-
 			ret =
 			    _gnutls_send_handshake(cd, state, data,
 						   n_p + n_g + n_X + 6,
 						   GNUTLS_SERVER_KEY_EXCHANGE);
 			gnutls_free(data);
-		} else {
+			break;
+		default:
+			gnutls_assert();
 			ret = GNUTLS_E_UNKNOWN_KX_ALGORITHM;
 		}
 	}
 
 	return ret;
-
 }
 
 /* This is the function for the client to send the key
@@ -135,92 +125,88 @@ int _gnutls_send_client_kx_message(int cd, GNUTLS_STATE state)
 	int n_X;
 	uint16 _n_X;
 	uint8 *data;
-	int ret=0;
-	uint8 *premaster=NULL;
-	int premaster_size=0;
-	svoid* master;
-	char* random = gnutls_malloc(64);
-	
+	int ret = 0;
+	uint8 *premaster = NULL;
+	int premaster_size = 0;
+	svoid *master;
+	char *random = gnutls_malloc(64);
 #ifdef HARD_DEBUG
 	fprintf(stderr, "Sending client KX message\n");
 #endif
-	memmove( random, state->security_parameters.client_random, 32);
-	memmove( &random[32], state->security_parameters.server_random, 32);
-
+	memmove(random, state->security_parameters.client_random, 32);
+	memmove(&random[32], state->security_parameters.server_random, 32);
 	algorithm =
-	    _gnutls_cipher_suite_get_kx_algo(state->
-					     gnutls_internals.current_cipher_suite);
-
-	if ( _gnutls_cipher_suite_get_kx_algo(state->gnutls_internals.current_cipher_suite) == GNUTLS_KX_ANON_DH) {
-
-
-			X = _gnutls_calc_dh_secret(&x, state->gnutls_internals.client_g, state->gnutls_internals.client_p);
-
-			gcry_mpi_print(GCRYMPI_FMT_STD, NULL,
-				       &n_X, X);
-			data = gnutls_malloc(n_X+3);
-			
-			gcry_mpi_print(GCRYMPI_FMT_STD, &data[3],
-				       &n_X, X);
-
-			data[0] = 1; /* extern */
-
-			gnutls_mpi_release(X);
-			
-			_n_X = n_X;
+	    _gnutls_cipher_suite_get_kx_algo
+	    (state->gnutls_internals.current_cipher_suite);
+
+	switch (_gnutls_cipher_suite_get_kx_algo
+		(state->gnutls_internals.current_cipher_suite)) {
+	case GNUTLS_KX_ANON_DH:
+	case GNUTLS_KX_DHE_DSS:
+	case GNUTLS_KX_DHE_RSA:
+		X =
+		    _gnutls_calc_dh_secret(&x,
+					   state->
+					   gnutls_internals.client_g,
+					   state->
+					   gnutls_internals.client_p);
+		gcry_mpi_print(GCRYMPI_FMT_STD, NULL, &n_X, X);
+		data = gnutls_malloc(n_X + 3);
+		gcry_mpi_print(GCRYMPI_FMT_STD, &data[3], &n_X, X);
+		data[0] = 1;	/* extern */
+		gnutls_mpi_release(X);
+		_n_X = n_X;
 #ifndef WORDS_BIGENDIAN
-			_n_X = byteswap16(_n_X);
-			memmove(&data[1], &_n_X, 2);
+		_n_X = byteswap16(_n_X);
+		memmove(&data[1], &_n_X, 2);
 #else
-			memmove(&data[1], &_n_X, 2);
+		memmove(&data[1], &_n_X, 2);
 #endif
-
-			ret =
-			    _gnutls_send_handshake(cd, state, data,
-						   n_X + 3,
-						   GNUTLS_CLIENT_KEY_EXCHANGE);
-			gnutls_free(data);
-			
-			/* calculate the key after sending the message */
-			state->gnutls_internals.KEY = _gnutls_calc_dh_key( state->gnutls_internals.client_Y, x, state->gnutls_internals.client_p);
-			gcry_mpi_print(GCRYMPI_FMT_STD, NULL,
-				       &premaster_size, state->gnutls_internals.KEY);
-
-			premaster = secure_malloc( premaster_size);
-			gcry_mpi_print(GCRYMPI_FMT_STD, premaster,
-				       &premaster_size, state->gnutls_internals.KEY);
-
-			/* THIS SHOULD BE DISCARDED */
-			gnutls_mpi_release(state->gnutls_internals.KEY);
-			gnutls_mpi_release(state->gnutls_internals.client_Y);
-			gnutls_mpi_release(state->gnutls_internals.client_p);
-			gnutls_mpi_release(state->gnutls_internals.client_g);
-			state->gnutls_internals.KEY=NULL;
-			state->gnutls_internals.client_Y=NULL;
-			state->gnutls_internals.client_p=NULL;
-			state->gnutls_internals.client_g=NULL;
-		} else {
-			ret = GNUTLS_E_UNKNOWN_KX_ALGORITHM;
+		ret =
+		    _gnutls_send_handshake(cd, state, data,
+					   n_X + 3,
+					   GNUTLS_CLIENT_KEY_EXCHANGE);
+		gnutls_free(data);
+		/* calculate the key after sending the message */
+		state->gnutls_internals.KEY =
+		    _gnutls_calc_dh_key(state->gnutls_internals.client_Y,
+					x,
+					state->gnutls_internals.client_p);
+		gcry_mpi_print(GCRYMPI_FMT_STD, NULL, &premaster_size,
+			       state->gnutls_internals.KEY);
+		premaster = secure_malloc(premaster_size);
+		gcry_mpi_print(GCRYMPI_FMT_STD, premaster,
+			       &premaster_size,
+			       state->gnutls_internals.KEY);
+		/* THIS SHOULD BE DISCARDED */
+		gnutls_mpi_release(state->gnutls_internals.KEY);
+		gnutls_mpi_release(state->gnutls_internals.client_Y);
+		gnutls_mpi_release(state->gnutls_internals.client_p);
+		gnutls_mpi_release(state->gnutls_internals.client_g);
+		state->gnutls_internals.KEY = NULL;
+		state->gnutls_internals.client_Y = NULL;
+		state->gnutls_internals.client_p = NULL;
+		state->gnutls_internals.client_g = NULL;
+		break;
+	default:
+		gnutls_assert();
+		ret = GNUTLS_E_UNKNOWN_KX_ALGORITHM;
 	}
 
-	master = gnutls_PRF( premaster, premaster_size, MASTER_SECRET, strlen(MASTER_SECRET),
-						random, 64 ,48);
+	master =
+	    gnutls_PRF(premaster, premaster_size,
+		       MASTER_SECRET, strlen(MASTER_SECRET), random, 64,
+		       48);
 	secure_free(premaster);
-
 #ifdef HARD_DEBUG
 	fprintf(stderr, "master secret: %s\n", bin2hex(master, 48));
 #endif
-	memmove( state->security_parameters.master_secret, master, 48);
-
+	memmove(state->security_parameters.master_secret, master, 48);
 	secure_free(master);
 	gnutls_free(random);
-	
 	return ret;
-
 }
 
-/* We have this as an upper limit, since the record layer defines this
- * as a maximum packet length */
 
 int _gnutls_recv_server_kx_message(int cd, GNUTLS_STATE state)
 {
@@ -232,68 +218,79 @@ int _gnutls_recv_server_kx_message(int cd, GNUTLS_STATE state)
 	uint8 *data_p;
 	uint8 *data_g;
 	uint8 *data_Y;
-	int ret=0, i;
-
+	int ret = 0, i;
 #ifdef HARD_DEBUG
 	fprintf(stderr, "Receiving Server KX message\n");
 #endif
 	algorithm =
-	    _gnutls_cipher_suite_get_kx_algo(state->
-					     gnutls_internals.current_cipher_suite);
-
+	    _gnutls_cipher_suite_get_kx_algo
+	    (state->gnutls_internals.current_cipher_suite);
 	/* Do key exchange only if the algorithm permits it */
 	if (_gnutls_kx_server_key_exchange(algorithm) != 0) {
 
-		if ( _gnutls_cipher_suite_get_kx_algo(state->gnutls_internals.current_cipher_suite) == GNUTLS_KX_ANON_DH) {
-
-			ret = _gnutls_recv_handshake(cd, state, &data, &datasize, GNUTLS_SERVER_KEY_EXCHANGE);
-
-			if (ret < 0) return ret;
-			
-			i=0;
-			memmove( &n_p, &data[i], 2);
-			i+=2;
-
+		switch (_gnutls_cipher_suite_get_kx_algo
+			(state->gnutls_internals.current_cipher_suite)) {
+		case GNUTLS_KX_ANON_DH:
+		case GNUTLS_KX_DHE_DSS:
+		case GNUTLS_KX_DHE_RSA:
+			ret =
+			    _gnutls_recv_handshake(cd, state, &data,
+						   &datasize,
+						   GNUTLS_SERVER_KEY_EXCHANGE);
+			if (ret < 0)
+				return ret;
+			i = 0;
+			memmove(&n_p, &data[i], 2);
+			i += 2;
 #ifndef WORDS_BIGENDIAN
 			n_p = byteswap16(n_p);
 #endif
 			data_p = &data[i];
-			i+=n_p;	
-			if (i>datasize) return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
-			
-			memmove( &n_g, &data[i], 2);
+			i += n_p;
+			if (i > datasize) {
+				gnutls_assert();
+				return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
+			}
+			memmove(&n_g, &data[i], 2);
 #ifndef WORDS_BIGENDIAN
 			n_g = byteswap16(n_g);
 #endif
-			i+=2;
+			i += 2;
 			data_g = &data[i];
-			i+=n_g;
-			if (i>datasize) return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
-			
-			memmove( &n_Y, &data[i], 2);
-			i+=2;
+			i += n_g;
+			if (i > datasize) {
+				gnutls_assert();
+				return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
+			}
+			memmove(&n_Y, &data[i], 2);
+			i += 2;
 #ifndef WORDS_BIGENDIAN
 			n_Y = byteswap16(n_Y);
 #endif
 			data_Y = &data[i];
-			i+=n_Y;
-			if (i>datasize) return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
-			
+			i += n_Y;
+			if (i > datasize) {
+				gnutls_assert();
+				return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
+			}
 			_n_Y = n_Y;
 			_n_g = n_g;
 			_n_p = n_p;
-			
-			gcry_mpi_scan( &state->gnutls_internals.client_Y, GCRYMPI_FMT_STD, data_Y, &_n_Y);
-			gcry_mpi_scan( &state->gnutls_internals.client_g, GCRYMPI_FMT_STD, data_g, &_n_g);
-			gcry_mpi_scan( &state->gnutls_internals.client_p, GCRYMPI_FMT_STD, data_p, &_n_p);
+			gcry_mpi_scan(&state->gnutls_internals.client_Y,
+				      GCRYMPI_FMT_STD, data_Y, &_n_Y);
+			gcry_mpi_scan(&state->gnutls_internals.client_g,
+				      GCRYMPI_FMT_STD, data_g, &_n_g);
+			gcry_mpi_scan(&state->gnutls_internals.client_p,
+				      GCRYMPI_FMT_STD, data_p, &_n_p);
 			gnutls_free(data);
-		} else {
+			break;
+		default:
+			gnutls_assert();
 			ret = GNUTLS_E_UNKNOWN_KX_ALGORITHM;
 		}
 	}
 
 	return ret;
-
 }
 
 int _gnutls_recv_client_kx_message(int cd, GNUTLS_STATE state)
@@ -303,76 +300,82 @@ int _gnutls_recv_client_kx_message(int cd, GNUTLS_STATE state)
 	int _n_Y;
 	uint8 *data;
 	int datasize;
-	int ret=0;
-	uint8 *premaster=NULL;
-	int premaster_size=0;
-	svoid* master;
-	uint8* random = gnutls_malloc(64);
-
+	int ret = 0;
+	uint8 *premaster = NULL;
+	int premaster_size = 0;
+	svoid *master;
+	uint8 *random = gnutls_malloc(64);
 #ifdef HARD_DEBUG
 	fprintf(stderr, "Receiving client KX message\n");
-#endif	
-	memmove( random, state->security_parameters.client_random, 32);
-	memmove( &random[32], state->security_parameters.server_random, 32);
-
+#endif
+	memmove(random, state->security_parameters.client_random, 32);
+	memmove(&random[32], state->security_parameters.server_random, 32);
 	algorithm =
-	    _gnutls_cipher_suite_get_kx_algo(state->
-					     gnutls_internals.current_cipher_suite);
-
+	    _gnutls_cipher_suite_get_kx_algo
+	    (state->gnutls_internals.current_cipher_suite);
 	/* Do key exchange only if the algorithm permits it */
 	if (_gnutls_kx_server_key_exchange(algorithm) != 0) {
 
-		if ( _gnutls_cipher_suite_get_kx_algo(state->gnutls_internals.current_cipher_suite) == GNUTLS_KX_ANON_DH) {
-
-			ret = _gnutls_recv_handshake(cd, state, &data, &datasize, GNUTLS_CLIENT_KEY_EXCHANGE);
-			if (ret < 0) return ret;
-			
-			if ( data[0] != 1) return GNUTLS_E_UNIMPLEMENTED_FEATURE;
-
-			memmove( &n_Y, &data[1], 2);
+		switch (_gnutls_cipher_suite_get_kx_algo
+			(state->gnutls_internals.current_cipher_suite)) {
+		case GNUTLS_KX_ANON_DH:
+		case GNUTLS_KX_DHE_DSS:
+		case GNUTLS_KX_DHE_RSA:
+			ret =
+			    _gnutls_recv_handshake(cd, state, &data,
+						   &datasize,
+						   GNUTLS_CLIENT_KEY_EXCHANGE);
+			if (ret < 0)
+				return ret;
+			if (data[0] != 1) {
+				gnutls_assert();
+				return GNUTLS_E_UNIMPLEMENTED_FEATURE;
+			}
+			memmove(&n_Y, &data[1], 2);
 #ifndef WORDS_BIGENDIAN
 			n_Y = byteswap16(n_Y);
 #endif
-
 			_n_Y = n_Y;
-			
-			gcry_mpi_scan( &state->gnutls_internals.client_Y, GCRYMPI_FMT_STD, &data[3], &_n_Y);
-			state->gnutls_internals.KEY = gnutls_calc_dh_key( state->gnutls_internals.client_Y, state->gnutls_internals.dh_secret);
-
+			gcry_mpi_scan(&state->gnutls_internals.client_Y,
+				      GCRYMPI_FMT_STD, &data[3], &_n_Y);
+			state->gnutls_internals.KEY =
+			    gnutls_calc_dh_key(state->
+					       gnutls_internals.client_Y,
+					       state->
+					       gnutls_internals.dh_secret);
 			gcry_mpi_print(GCRYMPI_FMT_STD, NULL,
-				       &premaster_size, state->gnutls_internals.KEY);
-
+				       &premaster_size,
+				       state->gnutls_internals.KEY);
 			premaster = secure_malloc(premaster_size);
 			gcry_mpi_print(GCRYMPI_FMT_STD, premaster,
-				       &premaster_size, state->gnutls_internals.KEY);
-
+				       &premaster_size,
+				       state->gnutls_internals.KEY);
 			/* THESE SHOULD BE DISCARDED */
 			gnutls_mpi_release(state->gnutls_internals.KEY);
-			gnutls_mpi_release(state->gnutls_internals.client_Y);
-			gnutls_mpi_release(state->gnutls_internals.dh_secret);
-			state->gnutls_internals.KEY=NULL;
-			state->gnutls_internals.client_Y=NULL;
-			state->gnutls_internals.dh_secret=NULL;
+			gnutls_mpi_release(state->
+					   gnutls_internals.client_Y);
+			gnutls_mpi_release(state->
+					   gnutls_internals.dh_secret);
+			state->gnutls_internals.KEY = NULL;
+			state->gnutls_internals.client_Y = NULL;
+			state->gnutls_internals.dh_secret = NULL;
 			gnutls_free(data);
-		} else {
+			break;
+		default:
+			gnutls_assert();
 			ret = GNUTLS_E_UNKNOWN_KX_ALGORITHM;
 		}
 	}
 
-	master = gnutls_PRF( premaster, premaster_size, MASTER_SECRET, strlen(MASTER_SECRET),
-						random, 64 ,48);
-	secure_free(premaster);
-
+	master =
+	    gnutls_PRF(premaster, premaster_size,
+		       MASTER_SECRET, strlen(MASTER_SECRET),
+		       random, 64, 48); secure_free(premaster);
 #ifdef HARD_DEBUG
 	fprintf(stderr, "master secret: %s\n", bin2hex(master, 48));
 #endif
-	memmove( state->security_parameters.master_secret, master, 48);
-
+	memmove(state->security_parameters.master_secret, master, 48);
 	secure_free(master);
 	gnutls_free(random);
-
 	return ret;
-
 }
-
-