no need for empty fragments with TLS 1.1 and later due to explicit IV
authorDr. Stephen Henson <steve@openssl.org>
Sun, 27 Jun 2010 14:43:03 +0000 (14:43 +0000)
committerDr. Stephen Henson <steve@openssl.org>
Sun, 27 Jun 2010 14:43:03 +0000 (14:43 +0000)
ssl/t1_enc.c

index b5c3179..5446bb2 100644 (file)
@@ -607,7 +607,8 @@ printf("\nkey block\n");
 { int z; for (z=0; z<num; z++) printf("%02X%c",p1[z],((z+1)%16)?' ':'\n'); }
 #endif
 
-       if (!(s->options & SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS))
+       if (!(s->options & SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS)
+               && s->method->version <= TLS1_VERSION)
                {
                /* enable vulnerability countermeasure for CBC ciphers with
                 * known-IV problem (http://www.openssl.org/~bodo/tls-cbc.txt)