1 files changed, 14 insertions, 22 deletions

diff --git a/src/lib/libssl/d1_clnt.c b/src/lib/libssl/d1_clnt.c
index 48e5e06bde..a6ed09c51d 100644
--- a/src/lib/libssl/d1_clnt.c
+++ b/src/lib/libssl/d1_clnt.c
@@ -538,6 +538,13 @@ int dtls1_connect(SSL *s)
                                 SSL3_ST_CW_CHANGE_A,SSL3_ST_CW_CHANGE_B);
                         if (ret <= 0) goto end;
 
+#ifndef OPENSSL_NO_SCTP
+                        /* Change to new shared key of SCTP-Auth,
+                         * will be ignored if no SCTP used.
+                         */
+                        BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY, 0, NULL);
+#endif
+
                         s->state=SSL3_ST_CW_FINISHED_A;
                         s->init_num=0;
 
@@ -564,16 +571,6 @@ int dtls1_connect(SSL *s)
                                 goto end;
                                 }
                         
-#ifndef OPENSSL_NO_SCTP
-                                if (s->hit)
-                                        {
-                                        /* Change to new shared key of SCTP-Auth,
-                                         * will be ignored if no SCTP used.
-                                         */
-                                        BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY, 0, NULL);
-                                        }
-#endif
-
                         dtls1_reset_seq_numbers(s, SSL3_CC_WRITE);
                         break;
 
@@ -616,13 +613,6 @@ int dtls1_connect(SSL *s)
                                 }
                         else
                                 {
-#ifndef OPENSSL_NO_SCTP
-                                /* Change to new shared key of SCTP-Auth,
-                                 * will be ignored if no SCTP used.
-                                 */
-                                BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY, 0, NULL);
-#endif
-
 #ifndef OPENSSL_NO_TLSEXT
                                 /* Allow NewSessionTicket if ticket expected */
                                 if (s->tlsext_ticket_expected)
@@ -783,7 +773,7 @@ int dtls1_client_hello(SSL *s)
         unsigned char *buf;
         unsigned char *p,*d;
         unsigned int i,j;
-        unsigned long l;
+        unsigned long Time,l;
         SSL_COMP *comp;
 
         buf=(unsigned char *)s->init_buf->data;
@@ -808,11 +798,13 @@ int dtls1_client_hello(SSL *s)
 
                 /* if client_random is initialized, reuse it, we are
                  * required to use same upon reply to HelloVerify */
-                for (i=0;p[i]=='\0' && i<sizeof(s->s3->client_random);i++)
-                        ;
+                for (i=0;p[i]=='\0' && i<sizeof(s->s3->client_random);i++) ;
                 if (i==sizeof(s->s3->client_random))
-                        ssl_fill_hello_random(s, 0, p,
-                                              sizeof(s->s3->client_random));
+                        {
+                        Time=(unsigned long)time(NULL); /* Time */
+                        l2n(Time,p);
+                        RAND_pseudo_bytes(p,sizeof(s->s3->client_random)-4);
+                        }
 
                 /* Do the message type and length last */
                 d=p= &(buf[DTLS1_HM_HEADER_LENGTH]);