1 files changed, 9 insertions, 68 deletions

diff --git a/src/lib/libssl/s3_pkt.c b/src/lib/libssl/s3_pkt.c
index adf8c387cc..f9b3629cf7 100644
--- a/src/lib/libssl/s3_pkt.c
+++ b/src/lib/libssl/s3_pkt.c
@@ -115,7 +115,6 @@
 #include "ssl_locl.h"
 #include <openssl/evp.h>
 #include <openssl/buffer.h>
-#include <openssl/rand.h>
 
 static int do_ssl3_write(SSL *s, int type, const unsigned char *buf,
                          unsigned int len, int create_empty_fragment);
@@ -631,7 +630,6 @@ static int do_ssl3_write(SSL *s, int type, const unsigned char *buf,
         unsigned char *p,*plen;
         int i,mac_size,clear=0;
         int prefix_len=0;
-        int eivlen;
         long align=0;
         SSL3_RECORD *wr;
         SSL3_BUFFER *wb=&(s->s3->wbuf);
@@ -664,14 +662,10 @@ static int do_ssl3_write(SSL *s, int type, const unsigned char *buf,
         if (    (sess == NULL) ||
                 (s->enc_write_ctx == NULL) ||
                 (EVP_MD_CTX_md(s->write_hash) == NULL))
-                {
-#if 1
-                clear=s->enc_write_ctx?0:1;     /* must be AEAD cipher */
-#else
                 clear=1;
-#endif
+
+        if (clear)
                 mac_size=0;
-                }
         else
                 {
                 mac_size=EVP_MD_CTX_size(s->write_hash);
@@ -740,39 +734,14 @@ static int do_ssl3_write(SSL *s, int type, const unsigned char *buf,
         wr->type=type;
 
         *(p++)=(s->version>>8);
-        /* Some servers hang if iniatial client hello is larger than 256
-         * bytes and record version number > TLS 1.0
-         */
-        if (s->state == SSL3_ST_CW_CLNT_HELLO_B
-                                && TLS1_get_version(s) > TLS1_VERSION)
-                *(p++) = 0x1;
-        else
-                *(p++)=s->version&0xff;
+        *(p++)=s->version&0xff;
 
         /* field where we are to write out packet length */
         plen=p; 
         p+=2;
-        /* Explicit IV length, block ciphers and TLS version 1.1 or later */
-        if (s->enc_write_ctx && s->version >= TLS1_1_VERSION)
-                {
-                int mode = EVP_CIPHER_CTX_mode(s->enc_write_ctx);
-                if (mode == EVP_CIPH_CBC_MODE)
-                        {
-                        eivlen = EVP_CIPHER_CTX_iv_length(s->enc_write_ctx);
-                        if (eivlen <= 1)
-                                eivlen = 0;
-                        }
-                /* Need explicit part of IV for GCM mode */
-                else if (mode == EVP_CIPH_GCM_MODE)
-                        eivlen = EVP_GCM_TLS_EXPLICIT_IV_LEN;
-                else
-                        eivlen = 0;
-                }
-        else 
-                eivlen = 0;
 
         /* lets setup the record stuff. */
-        wr->data=p + eivlen;
+        wr->data=p;
         wr->length=(int)len;
         wr->input=(unsigned char *)buf;
 
@@ -800,19 +769,11 @@ static int do_ssl3_write(SSL *s, int type, const unsigned char *buf,
 
         if (mac_size != 0)
                 {
-                if (s->method->ssl3_enc->mac(s,&(p[wr->length + eivlen]),1) < 0)
+                if (s->method->ssl3_enc->mac(s,&(p[wr->length]),1) < 0)
                         goto err;
                 wr->length+=mac_size;
-                }
-
-        wr->input=p;
-        wr->data=p;
-
-        if (eivlen)
-                {
-        /*      if (RAND_pseudo_bytes(p, eivlen) <= 0)
-                        goto err; */
-                wr->length += eivlen;
+                wr->input=p;
+                wr->data=p;
                 }
 
         /* ssl3_enc can only have an error on read */
@@ -1081,19 +1042,6 @@ start:
                         dest = s->s3->alert_fragment;
                         dest_len = &s->s3->alert_fragment_len;
                         }
-#ifndef OPENSSL_NO_HEARTBEATS
-                else if (rr->type == TLS1_RT_HEARTBEAT)
-                        {
-                        tls1_process_heartbeat(s);
-
-                        /* Exit and notify application to read again */
-                        rr->length = 0;
-                        s->rwstate=SSL_READING;
-                        BIO_clear_retry_flags(SSL_get_rbio(s));
-                        BIO_set_retry_read(SSL_get_rbio(s));
-                        return(-1);
-                        }
-#endif
 
                 if (dest_maxlen > 0)
                         {
@@ -1237,10 +1185,6 @@ start:
                                 SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_NO_RENEGOTIATION);
                                 goto f_err;
                                 }
-#ifdef SSL_AD_MISSING_SRP_USERNAME
-                        if (alert_descr == SSL_AD_MISSING_SRP_USERNAME)
-                                return(0);
-#endif
                         }
                 else if (alert_level == 2) /* fatal */
                         {
@@ -1319,7 +1263,6 @@ start:
 #else
                         s->state = s->server ? SSL_ST_ACCEPT : SSL_ST_CONNECT;
 #endif
-                        s->renegotiate=1;
                         s->new_session=1;
                         }
                 i=s->handshake_func(s);
@@ -1353,10 +1296,8 @@ start:
                 {
         default:
 #ifndef OPENSSL_NO_TLS
-                /* TLS up to v1.1 just ignores unknown message types:
-                 * TLS v1.2 give an unexpected message alert.
-                 */
-                if (s->version >= TLS1_VERSION && s->version <= TLS1_1_VERSION)
+                /* TLS just ignores unknown message types */
+                if (s->version == TLS1_VERSION)
                         {
                         rr->length = 0;
                         goto start;