From owner-svn-src-head@FreeBSD.ORG  Thu Aug  8 22:29:36 2013
Return-Path: <owner-svn-src-head@FreeBSD.ORG>
Delivered-To: svn-src-head@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTP id 00E4EF27;
 Thu,  8 Aug 2013 22:29:35 +0000 (UTC)
 (envelope-from delphij@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org
 [IPv6:2001:1900:2254:2068::e6a:0])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (No client certificate requested)
 by mx1.freebsd.org (Postfix) with ESMTPS id E2E8B27DD;
 Thu,  8 Aug 2013 22:29:35 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
 by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id r78MTZlE084913;
 Thu, 8 Aug 2013 22:29:35 GMT (envelope-from delphij@svn.freebsd.org)
Received: (from delphij@localhost)
 by svn.freebsd.org (8.14.7/8.14.5/Submit) id r78MTZrJ084912;
 Thu, 8 Aug 2013 22:29:35 GMT (envelope-from delphij@svn.freebsd.org)
Message-Id: <201308082229.r78MTZrJ084912@svn.freebsd.org>
From: Xin LI <delphij@FreeBSD.org>
Date: Thu, 8 Aug 2013 22:29:35 +0000 (UTC)
To: src-committers@freebsd.org, svn-src-all@freebsd.org,
 svn-src-head@freebsd.org
Subject: svn commit: r254107 - head/crypto/openssl/ssl
X-SVN-Group: head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-src-head@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for the src tree for head/-current
 <svn-src-head.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/svn-src-head>,
 <mailto:svn-src-head-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-src-head>
List-Post: <mailto:svn-src-head@freebsd.org>
List-Help: <mailto:svn-src-head-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/svn-src-head>,
 <mailto:svn-src-head-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 08 Aug 2013 22:29:36 -0000

Author: delphij
Date: Thu Aug  8 22:29:35 2013
New Revision: 254107
URL: http://svnweb.freebsd.org/changeset/base/254107

Log:
  MFV r254106 (OpenSSL bugfix for RT #2984):
  
  Check DTLS_BAD_VER for version number.
  
  The version check for DTLS1_VERSION was redundant as
  DTLS1_VERSION > TLS1_1_VERSION, however we do need to
  check for DTLS1_BAD_VER for compatibility.
  
  Requested by:	zi
  Approved by:	benl

Modified:
  head/crypto/openssl/ssl/s3_cbc.c
Directory Properties:
  head/crypto/openssl/   (props changed)

Modified: head/crypto/openssl/ssl/s3_cbc.c
==============================================================================
--- head/crypto/openssl/ssl/s3_cbc.c	Thu Aug  8 22:26:03 2013	(r254106)
+++ head/crypto/openssl/ssl/s3_cbc.c	Thu Aug  8 22:29:35 2013	(r254107)
@@ -148,7 +148,7 @@ int tls1_cbc_remove_padding(const SSL* s
 	unsigned padding_length, good, to_check, i;
 	const unsigned overhead = 1 /* padding length byte */ + mac_size;
 	/* Check if version requires explicit IV */
-	if (s->version >= TLS1_1_VERSION || s->version == DTLS1_VERSION)
+	if (s->version >= TLS1_1_VERSION || s->version == DTLS1_BAD_VER)
 		{
 		/* These lengths are all public so we can test them in
 		 * non-constant time.