From: Dr. Stephen Henson <steve@openssl.org>
Date: Tue, 4 Jan 2011 19:39:27 +0000 (+0000)
Subject: Don't use decryption_failed alert for TLS v1.1 or later.
X-Git-Tag: OpenSSL-fips-2_0-rc1~885
X-Git-Url: https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff_plain;h=722521594cfec2d972f0773f6d82c69cda4a621c

Don't use decryption_failed alert for TLS v1.1 or later.
---

diff --git a/ssl/t1_enc.c b/ssl/t1_enc.c
index 2b3fd30e42..c418d3217a 100644
--- a/ssl/t1_enc.c
+++ b/ssl/t1_enc.c
@@ -757,6 +757,8 @@ int tls1_enc(SSL *s, int send)
 			{
 			if (l == 0 || l%bs != 0)
 				{
+				if (s->version >= TLS1_1_VERSION)
+					return -1;
 				SSLerr(SSL_F_TLS1_ENC,SSL_R_BLOCK_CIPHER_PAD_IS_WRONG);
 				ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECRYPTION_FAILED);
 				return 0;