Commit 28566b49 authored by Dr. Stephen Henson's avatar Dr. Stephen Henson
Browse files

no need for empty fragments with TLS 1.1 and later due to explicit IV

parent b4b15f68

ssl/t1_enc.c

+2 −1
Changes for ssl/t1_enc.c: 2 added lines, 1 removed line.
Original line number Diff line number Diff line
@@ -607,7 +607,8 @@ printf("\nkey block\n"); 
{ int z; for (z=0; z<num; z++) printf("%02X%c",p1[z],((z+1)%16)?' ':'\n'); }

#endif



	if (!(s->options & SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS))

	if (!(s->options & SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS)

		&& s->method->version <= TLS1_VERSION)

		{

		/* enable vulnerability countermeasure for CBC ciphers with

		 * known-IV problem (http://www.openssl.org/~bodo/tls-cbc.txt)