28 files changed, 762 insertions, 395 deletions

diff --git a/src/lib/libssl/d1_both.c b/src/lib/libssl/d1_both.c
index de8bab873f..2e8cf681ed 100644
--- a/src/lib/libssl/d1_both.c
+++ b/src/lib/libssl/d1_both.c
@@ -214,6 +214,12 @@ dtls1_hm_fragment_new(unsigned long frag_len, int reassembly)
 static void
 dtls1_hm_fragment_free(hm_fragment *frag)
         {
+
+        if (frag->msg_header.is_ccs)
+                {
+                EVP_CIPHER_CTX_free(frag->msg_header.saved_retransmit_state.enc_write_ctx);
+                EVP_MD_CTX_destroy(frag->msg_header.saved_retransmit_state.write_hash);
+                }
         if (frag->fragment) OPENSSL_free(frag->fragment);
         if (frag->reassembly) OPENSSL_free(frag->reassembly);
         OPENSSL_free(frag);
@@ -313,9 +319,10 @@ int dtls1_do_write(SSL *s, int type)
                                 s->init_off -= DTLS1_HM_HEADER_LENGTH;
                                 s->init_num += DTLS1_HM_HEADER_LENGTH;
 
-                                /* write atleast DTLS1_HM_HEADER_LENGTH bytes */
-                                if ( len <= DTLS1_HM_HEADER_LENGTH)  
-                                        len += DTLS1_HM_HEADER_LENGTH;
+                                if ( s->init_num > curr_mtu)
+                                        len = curr_mtu;
+                                else
+                                        len = s->init_num;
                                 }
 
                         dtls1_fix_message_header(s, frag_off, 
@@ -1452,26 +1459,36 @@ dtls1_process_heartbeat(SSL *s)
         unsigned int payload;
         unsigned int padding = 16; /* Use minimum padding */
 
-        /* Read type and payload length first */
-        hbtype = *p++;
-        n2s(p, payload);
-        pl = p;
-
         if (s->msg_callback)
                 s->msg_callback(0, s->version, TLS1_RT_HEARTBEAT,
                         &s->s3->rrec.data[0], s->s3->rrec.length,
                         s, s->msg_callback_arg);
 
+        /* Read type and payload length first */
+        if (1 + 2 + 16 > s->s3->rrec.length)
+                return 0; /* silently discard */
+        hbtype = *p++;
+        n2s(p, payload);
+        if (1 + 2 + payload + 16 > s->s3->rrec.length)
+                return 0; /* silently discard per RFC 6520 sec. 4 */
+        pl = p;
+
         if (hbtype == TLS1_HB_REQUEST)
                 {
                 unsigned char *buffer, *bp;
+                unsigned int write_length = 1 /* heartbeat type */ +
+                                            2 /* heartbeat length */ +
+                                            payload + padding;
                 int r;
 
+                if (write_length > SSL3_RT_MAX_PLAIN_LENGTH)
+                        return 0;
+
                 /* Allocate memory for the response, size is 1 byte
                  * message type, plus 2 bytes payload length, plus
                  * payload, plus padding
                  */
-                buffer = OPENSSL_malloc(1 + 2 + payload + padding);
+                buffer = OPENSSL_malloc(write_length);
                 bp = buffer;
 
                 /* Enter response type, length and copy payload */
@@ -1482,11 +1499,11 @@ dtls1_process_heartbeat(SSL *s)
                 /* Random padding */
                 RAND_pseudo_bytes(bp, padding);
 
-                r = dtls1_write_bytes(s, TLS1_RT_HEARTBEAT, buffer, 3 + payload + padding);
+                r = dtls1_write_bytes(s, TLS1_RT_HEARTBEAT, buffer, write_length);
 
                 if (r >= 0 && s->msg_callback)
                         s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
-                                buffer, 3 + payload + padding,
+                                buffer, write_length,
                                 s, s->msg_callback_arg);
 
                 OPENSSL_free(buffer);
diff --git a/src/lib/libssl/d1_clnt.c b/src/lib/libssl/d1_clnt.c
index a6ed09c51d..48e5e06bde 100644
--- a/src/lib/libssl/d1_clnt.c
+++ b/src/lib/libssl/d1_clnt.c
@@ -538,13 +538,6 @@ int dtls1_connect(SSL *s)
                                 SSL3_ST_CW_CHANGE_A,SSL3_ST_CW_CHANGE_B);
                         if (ret <= 0) goto end;
 
-#ifndef OPENSSL_NO_SCTP
-                        /* Change to new shared key of SCTP-Auth,
-                         * will be ignored if no SCTP used.
-                         */
-                        BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY, 0, NULL);
-#endif
-
                         s->state=SSL3_ST_CW_FINISHED_A;
                         s->init_num=0;
 
@@ -571,6 +564,16 @@ int dtls1_connect(SSL *s)
                                 goto end;
                                 }
                         
+#ifndef OPENSSL_NO_SCTP
+                                if (s->hit)
+                                        {
+                                        /* Change to new shared key of SCTP-Auth,
+                                         * will be ignored if no SCTP used.
+                                         */
+                                        BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY, 0, NULL);
+                                        }
+#endif
+
                         dtls1_reset_seq_numbers(s, SSL3_CC_WRITE);
                         break;
 
@@ -613,6 +616,13 @@ int dtls1_connect(SSL *s)
                                 }
                         else
                                 {
+#ifndef OPENSSL_NO_SCTP
+                                /* Change to new shared key of SCTP-Auth,
+                                 * will be ignored if no SCTP used.
+                                 */
+                                BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY, 0, NULL);
+#endif
+
 #ifndef OPENSSL_NO_TLSEXT
                                 /* Allow NewSessionTicket if ticket expected */
                                 if (s->tlsext_ticket_expected)
@@ -773,7 +783,7 @@ int dtls1_client_hello(SSL *s)
         unsigned char *buf;
         unsigned char *p,*d;
         unsigned int i,j;
-        unsigned long Time,l;
+        unsigned long l;
         SSL_COMP *comp;
 
         buf=(unsigned char *)s->init_buf->data;
@@ -798,13 +808,11 @@ int dtls1_client_hello(SSL *s)
 
                 /* if client_random is initialized, reuse it, we are
                  * required to use same upon reply to HelloVerify */
-                for (i=0;p[i]=='\0' && i<sizeof(s->s3->client_random);i++) ;
+                for (i=0;p[i]=='\0' && i<sizeof(s->s3->client_random);i++)
+                        ;
                 if (i==sizeof(s->s3->client_random))
-                        {
-                        Time=(unsigned long)time(NULL); /* Time */
-                        l2n(Time,p);
-                        RAND_pseudo_bytes(p,sizeof(s->s3->client_random)-4);
-                        }
+                        ssl_fill_hello_random(s, 0, p,
+                                              sizeof(s->s3->client_random));
 
                 /* Do the message type and length last */
                 d=p= &(buf[DTLS1_HM_HEADER_LENGTH]);
diff --git a/src/lib/libssl/d1_enc.c b/src/lib/libssl/d1_enc.c
index 07a5e97ce5..712c4647f2 100644
--- a/src/lib/libssl/d1_enc.c
+++ b/src/lib/libssl/d1_enc.c
@@ -126,20 +126,28 @@
 #include <openssl/des.h>
 #endif
 
+/* dtls1_enc encrypts/decrypts the record in |s->wrec| / |s->rrec|, respectively.
+ *
+ * Returns:
+ *   0: (in non-constant time) if the record is publically invalid (i.e. too
+ *       short etc).
+ *   1: if the record's padding is valid / the encryption was successful.
+ *   -1: if the record's padding/AEAD-authenticator is invalid or, if sending,
+ *       an internal error occured. */
 int dtls1_enc(SSL *s, int send)
         {
         SSL3_RECORD *rec;
         EVP_CIPHER_CTX *ds;
         unsigned long l;
-        int bs,i,ii,j,k,n=0;
+        int bs,i,j,k,mac_size=0;
         const EVP_CIPHER *enc;
 
         if (send)
                 {
                 if (EVP_MD_CTX_md(s->write_hash))
                         {
-                        n=EVP_MD_CTX_size(s->write_hash);
-                        if (n < 0)
+                        mac_size=EVP_MD_CTX_size(s->write_hash);
+                        if (mac_size < 0)
                                 return -1;
                         }
                 ds=s->enc_write_ctx;
@@ -164,9 +172,8 @@ int dtls1_enc(SSL *s, int send)
                 {
                 if (EVP_MD_CTX_md(s->read_hash))
                         {
-                        n=EVP_MD_CTX_size(s->read_hash);
-                        if (n < 0)
-                                return -1;
+                        mac_size=EVP_MD_CTX_size(s->read_hash);
+                        OPENSSL_assert(mac_size >= 0);
                         }
                 ds=s->enc_read_ctx;
                 rec= &(s->s3->rrec);
@@ -231,7 +238,7 @@ int dtls1_enc(SSL *s, int send)
                 if (!send)
                         {
                         if (l == 0 || l%bs != 0)
-                                return -1;
+                                return 0;
                         }
                 
                 EVP_Cipher(ds,rec->data,rec->input,l);
@@ -246,43 +253,7 @@ int dtls1_enc(SSL *s, int send)
 #endif  /* KSSL_DEBUG */
 
                 if ((bs != 1) && !send)
-                        {
-                        ii=i=rec->data[l-1]; /* padding_length */
-                        i++;
-                        if (s->options&SSL_OP_TLS_BLOCK_PADDING_BUG)
-                                {
-                                /* First packet is even in size, so check */
-                                if ((memcmp(s->s3->read_sequence,
-                                        "\0\0\0\0\0\0\0\0",8) == 0) && !(ii & 1))
-                                        s->s3->flags|=TLS1_FLAGS_TLS_PADDING_BUG;
-                                if (s->s3->flags & TLS1_FLAGS_TLS_PADDING_BUG)
-                                        i--;
-                                }
-                        /* TLS 1.0 does not bound the number of padding bytes by the block size.
-                         * All of them must have value 'padding_length'. */
-                        if (i + bs > (int)rec->length)
-                                {
-                                /* Incorrect padding. SSLerr() and ssl3_alert are done
-                                 * by caller: we don't want to reveal whether this is
-                                 * a decryption error or a MAC verification failure
-                                 * (see http://www.openssl.org/~bodo/tls-cbc.txt) 
-                                 */
-                                return -1;
-                                }
-                        for (j=(int)(l-i); j<(int)l; j++)
-                                {
-                                if (rec->data[j] != ii)
-                                        {
-                                        /* Incorrect padding */
-                                        return -1;
-                                        }
-                                }
-                        rec->length-=i;
-
-                        rec->data += bs;    /* skip the implicit IV */
-                        rec->input += bs;
-                        rec->length -= bs;
-                        }
+                        return tls1_cbc_remove_padding(s, rec, bs, mac_size);
                 }
         return(1);
         }
diff --git a/src/lib/libssl/d1_lib.c b/src/lib/libssl/d1_lib.c
index f61f718183..106939f241 100644
--- a/src/lib/libssl/d1_lib.c
+++ b/src/lib/libssl/d1_lib.c
@@ -196,6 +196,7 @@ void dtls1_free(SSL *s)
         pqueue_free(s->d1->buffered_app_data.q);
 
         OPENSSL_free(s->d1);
+        s->d1 = NULL;
         }
 
 void dtls1_clear(SSL *s)
diff --git a/src/lib/libssl/d1_pkt.c b/src/lib/libssl/d1_pkt.c
index 987af60835..8186462d4a 100644
--- a/src/lib/libssl/d1_pkt.c
+++ b/src/lib/libssl/d1_pkt.c
@@ -376,15 +376,11 @@ static int
 dtls1_process_record(SSL *s)
 {
         int i,al;
-        int clear=0;
         int enc_err;
         SSL_SESSION *sess;
         SSL3_RECORD *rr;
-        unsigned int mac_size;
+        unsigned int mac_size, orig_len;
         unsigned char md[EVP_MAX_MD_SIZE];
-        int decryption_failed_or_bad_record_mac = 0;
-        unsigned char *mac = NULL;
-
 
         rr= &(s->s3->rrec);
         sess = s->session;
@@ -416,12 +412,16 @@ dtls1_process_record(SSL *s)
         rr->data=rr->input;
 
         enc_err = s->method->ssl3_enc->enc(s,0);
-        if (enc_err <= 0)
+        /* enc_err is:
+         *    0: (in non-constant time) if the record is publically invalid.
+         *    1: if the padding is valid
+         *    -1: if the padding is invalid */
+        if (enc_err == 0)
                 {
-                /* To minimize information leaked via timing, we will always
-                 * perform all computations before discarding the message.
-                 */
-                decryption_failed_or_bad_record_mac = 1;
+                /* For DTLS we simply ignore bad packets. */
+                rr->length = 0;
+                s->packet_length = 0;
+                goto err;
                 }
 
 #ifdef TLS_DEBUG
@@ -431,45 +431,62 @@ printf("\n");
 #endif
 
         /* r->length is now the compressed data plus mac */
-        if (    (sess == NULL) ||
-                (s->enc_read_ctx == NULL) ||
-                (s->read_hash == NULL))
-                clear=1;
-
-        if (!clear)
+        if ((sess != NULL) &&
+            (s->enc_read_ctx != NULL) &&
+            (EVP_MD_CTX_md(s->read_hash) != NULL))
                 {
-                /* !clear => s->read_hash != NULL => mac_size != -1 */
-                int t;
-                t=EVP_MD_CTX_size(s->read_hash);
-                OPENSSL_assert(t >= 0);
-                mac_size=t;
-
-                if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH+mac_size)
+                /* s->read_hash != NULL => mac_size != -1 */
+                unsigned char *mac = NULL;
+                unsigned char mac_tmp[EVP_MAX_MD_SIZE];
+                mac_size=EVP_MD_CTX_size(s->read_hash);
+                OPENSSL_assert(mac_size <= EVP_MAX_MD_SIZE);
+
+                /* kludge: *_cbc_remove_padding passes padding length in rr->type */
+                orig_len = rr->length+((unsigned int)rr->type>>8);
+
+                /* orig_len is the length of the record before any padding was
+                 * removed. This is public information, as is the MAC in use,
+                 * therefore we can safely process the record in a different
+                 * amount of time if it's too short to possibly contain a MAC.
+                 */
+                if (orig_len < mac_size ||
+                    /* CBC records must have a padding length byte too. */
+                    (EVP_CIPHER_CTX_mode(s->enc_read_ctx) == EVP_CIPH_CBC_MODE &&
+                     orig_len < mac_size+1))
                         {
-#if 0 /* OK only for stream ciphers (then rr->length is visible from ciphertext anyway) */
-                        al=SSL_AD_RECORD_OVERFLOW;
-                        SSLerr(SSL_F_DTLS1_PROCESS_RECORD,SSL_R_PRE_MAC_LENGTH_TOO_LONG);
+                        al=SSL_AD_DECODE_ERROR;
+                        SSLerr(SSL_F_DTLS1_PROCESS_RECORD,SSL_R_LENGTH_TOO_SHORT);
                         goto f_err;
-#else
-                        decryption_failed_or_bad_record_mac = 1;
-#endif                  
                         }
-                /* check the MAC for rr->input (it's in mac_size bytes at the tail) */
-                if (rr->length >= mac_size)
+
+                if (EVP_CIPHER_CTX_mode(s->enc_read_ctx) == EVP_CIPH_CBC_MODE)
                         {
+                        /* We update the length so that the TLS header bytes
+                         * can be constructed correctly but we need to extract
+                         * the MAC in constant time from within the record,
+                         * without leaking the contents of the padding bytes.
+                         * */
+                        mac = mac_tmp;
+                        ssl3_cbc_copy_mac(mac_tmp, rr, mac_size, orig_len);
                         rr->length -= mac_size;
-                        mac = &rr->data[rr->length];
                         }
                 else
-                        rr->length = 0;
-                i=s->method->ssl3_enc->mac(s,md,0);
-                if (i < 0 || mac == NULL || memcmp(md, mac, mac_size) != 0)
                         {
-                        decryption_failed_or_bad_record_mac = 1;
+                        /* In this case there's no padding, so |orig_len|
+                         * equals |rec->length| and we checked that there's
+                         * enough bytes for |mac_size| above. */
+                        rr->length -= mac_size;
+                        mac = &rr->data[rr->length];
                         }
+
+                i=s->method->ssl3_enc->mac(s,md,0 /* not send */);
+                if (i < 0 || mac == NULL || CRYPTO_memcmp(md, mac, (size_t)mac_size) != 0)
+                        enc_err = -1;
+                if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH+mac_size)
+                        enc_err = -1;
                 }
 
-        if (decryption_failed_or_bad_record_mac)
+        if (enc_err < 0)
                 {
                 /* decryption failed, silently discard message */
                 rr->length = 0;
@@ -830,6 +847,12 @@ start:
                         }
                 }
 
+        if (s->d1->listen && rr->type != SSL3_RT_HANDSHAKE)
+                {
+                rr->length = 0;
+                goto start;
+                }
+
         /* we now have a packet which can be read and processed */
 
         if (s->s3->change_cipher_spec /* set when we receive ChangeCipherSpec,
@@ -1034,6 +1057,7 @@ start:
                         !(s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS) &&
                         !s->s3->renegotiate)
                         {
+                        s->d1->handshake_read_seq++;
                         s->new_session = 1;
                         ssl3_renegotiate(s);
                         if (ssl3_renegotiate_check(s))
diff --git a/src/lib/libssl/d1_srtp.c b/src/lib/libssl/d1_srtp.c
index 928935bd8b..ab9c41922c 100644
--- a/src/lib/libssl/d1_srtp.c
+++ b/src/lib/libssl/d1_srtp.c
@@ -115,11 +115,12 @@
   Copyright (C) 2011, RTFM, Inc.
 */
 
-#ifndef OPENSSL_NO_SRTP
-
 #include <stdio.h>
 #include <openssl/objects.h>
 #include "ssl_locl.h"
+
+#ifndef OPENSSL_NO_SRTP
+
 #include "srtp.h"
 
 
diff --git a/src/lib/libssl/d1_srvr.c b/src/lib/libssl/d1_srvr.c
index 29421da9aa..9975e20873 100644
--- a/src/lib/libssl/d1_srvr.c
+++ b/src/lib/libssl/d1_srvr.c
@@ -276,10 +276,11 @@ int dtls1_accept(SSL *s)
                 case SSL3_ST_SW_HELLO_REQ_B:
 
                         s->shutdown=0;
+                        dtls1_clear_record_buffer(s);
                         dtls1_start_timer(s);
                         ret=dtls1_send_hello_request(s);
                         if (ret <= 0) goto end;
-                        s->s3->tmp.next_state=SSL3_ST_SW_HELLO_REQ_C;
+                        s->s3->tmp.next_state=SSL3_ST_SR_CLNT_HELLO_A;
                         s->state=SSL3_ST_SW_FLUSH;
                         s->init_num=0;
 
@@ -721,10 +722,13 @@ int dtls1_accept(SSL *s)
                         if (ret <= 0) goto end;
 
 #ifndef OPENSSL_NO_SCTP
-                        /* Change to new shared key of SCTP-Auth,
-                         * will be ignored if no SCTP used.
-                         */
-                        BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY, 0, NULL);
+                        if (!s->hit)
+                                {
+                                /* Change to new shared key of SCTP-Auth,
+                                 * will be ignored if no SCTP used.
+                                 */
+                                BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY, 0, NULL);
+                                }
 #endif
 
                         s->state=SSL3_ST_SW_FINISHED_A;
@@ -749,7 +753,16 @@ int dtls1_accept(SSL *s)
                         if (ret <= 0) goto end;
                         s->state=SSL3_ST_SW_FLUSH;
                         if (s->hit)
+                                {
                                 s->s3->tmp.next_state=SSL3_ST_SR_FINISHED_A;
+
+#ifndef OPENSSL_NO_SCTP
+                                /* Change to new shared key of SCTP-Auth,
+                                 * will be ignored if no SCTP used.
+                                 */
+                                BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY, 0, NULL);
+#endif
+                                }
                         else
                                 {
                                 s->s3->tmp.next_state=SSL_ST_OK;
@@ -912,15 +925,13 @@ int dtls1_send_server_hello(SSL *s)
         unsigned char *p,*d;
         int i;
         unsigned int sl;
-        unsigned long l,Time;
+        unsigned long l;
 
         if (s->state == SSL3_ST_SW_SRVR_HELLO_A)
                 {
                 buf=(unsigned char *)s->init_buf->data;
                 p=s->s3->server_random;
-                Time=(unsigned long)time(NULL);                 /* Time */
-                l2n(Time,p);
-                RAND_pseudo_bytes(p,SSL3_RANDOM_SIZE-4);
+                ssl_fill_hello_random(s, 1, p, SSL3_RANDOM_SIZE);
                 /* Do the message type and length last */
                 d=p= &(buf[DTLS1_HM_HEADER_LENGTH]);
 
diff --git a/src/lib/libssl/dtls1.h b/src/lib/libssl/dtls1.h
index 5008bf6081..e65d501191 100644
--- a/src/lib/libssl/dtls1.h
+++ b/src/lib/libssl/dtls1.h
@@ -57,8 +57,8 @@
  *
  */
 
-#ifndef HEADER_DTLS1_H 
-#define HEADER_DTLS1_H 
+#ifndef HEADER_DTLS1_H
+#define HEADER_DTLS1_H
 
 #include <openssl/buffer.h>
 #include <openssl/pqueue.h>
@@ -72,8 +72,12 @@
 #elif defined(OPENSSL_SYS_NETWARE) && !defined(_WINSOCK2API_)
 #include <sys/timeval.h>
 #else
+#if defined(OPENSSL_SYS_VXWORKS)
+#include <sys/times.h>
+#else
 #include <sys/time.h>
 #endif
+#endif
 
 #ifdef  __cplusplus
 extern "C" {
diff --git a/src/lib/libssl/s23_clnt.c b/src/lib/libssl/s23_clnt.c
index 47673e740a..2b93c639dd 100644
--- a/src/lib/libssl/s23_clnt.c
+++ b/src/lib/libssl/s23_clnt.c
@@ -269,12 +269,35 @@ static int ssl23_no_ssl2_ciphers(SSL *s)
         return 1;
         }
 
+/* Fill a ClientRandom or ServerRandom field of length len. Returns <= 0
+ * on failure, 1 on success. */
+int ssl_fill_hello_random(SSL *s, int server, unsigned char *result, int len)
+        {
+        int send_time = 0;
+
+        if (len < 4)
+                return 0;
+        if (server)
+                send_time = (s->mode & SSL_MODE_SEND_SERVERHELLO_TIME) != 0;
+        else
+                send_time = (s->mode & SSL_MODE_SEND_CLIENTHELLO_TIME) != 0;
+        if (send_time)
+                {
+                unsigned long Time = (unsigned long)time(NULL);
+                unsigned char *p = result;
+                l2n(Time, p);
+                return RAND_pseudo_bytes(p, len-4);
+                }
+        else
+                return RAND_pseudo_bytes(result, len);
+        }
+
 static int ssl23_client_hello(SSL *s)
         {
         unsigned char *buf;
         unsigned char *p,*d;
         int i,ch_len;
-        unsigned long Time,l;
+        unsigned long l;
         int ssl2_compat;
         int version = 0, version_major, version_minor;
 #ifndef OPENSSL_NO_COMP
@@ -355,9 +378,7 @@ static int ssl23_client_hello(SSL *s)
 #endif
 
                 p=s->s3->client_random;
-                Time=(unsigned long)time(NULL);         /* Time */
-                l2n(Time,p);
-                if (RAND_pseudo_bytes(p,SSL3_RANDOM_SIZE-4) <= 0)
+                if (ssl_fill_hello_random(s, 0, p, SSL3_RANDOM_SIZE) <= 0)
                         return -1;
 
                 if (version == TLS1_2_VERSION)
diff --git a/src/lib/libssl/s3_both.c b/src/lib/libssl/s3_both.c
index b63460a56d..53b9390fdd 100644
--- a/src/lib/libssl/s3_both.c
+++ b/src/lib/libssl/s3_both.c
@@ -161,6 +161,8 @@ int ssl3_send_finished(SSL *s, int a, int b, const char *sender, int slen)
 
                 i=s->method->ssl3_enc->final_finish_mac(s,
                         sender,slen,s->s3->tmp.finish_md);
+                if (i == 0)
+                        return 0;
                 s->s3->tmp.finish_md_len = i;
                 memcpy(p, s->s3->tmp.finish_md, i);
                 p+=i;
@@ -204,10 +206,15 @@ int ssl3_send_finished(SSL *s, int a, int b, const char *sender, int slen)
 
 #ifndef OPENSSL_NO_NEXTPROTONEG
 /* ssl3_take_mac calculates the Finished MAC for the handshakes messages seen to far. */
-static void ssl3_take_mac(SSL *s) {
+static void ssl3_take_mac(SSL *s)
+        {
         const char *sender;
         int slen;
-
+        /* If no new cipher setup return immediately: other functions will
+         * set the appropriate error.
+         */
+        if (s->s3->tmp.new_cipher == NULL)
+                return;
         if (s->state & SSL_ST_CONNECT)
                 {
                 sender=s->method->ssl3_enc->server_finished_label;
@@ -221,7 +228,7 @@ static void ssl3_take_mac(SSL *s) {
 
         s->s3->tmp.peer_finish_md_len = s->method->ssl3_enc->final_finish_mac(s,
                 sender,slen,s->s3->tmp.peer_finish_md);
-}
+        }
 #endif
 
 int ssl3_get_finished(SSL *s, int a, int b)
@@ -231,8 +238,9 @@ int ssl3_get_finished(SSL *s, int a, int b)
         unsigned char *p;
 
 #ifdef OPENSSL_NO_NEXTPROTONEG
-        /* the mac has already been generated when we received the change
-         * cipher spec message and is in s->s3->tmp.peer_finish_md. */
+        /* the mac has already been generated when we received the
+         * change cipher spec message and is in s->s3->tmp.peer_finish_md.
+         */ 
 #endif
 
         n=s->method->ssl_get_message(s,
@@ -263,7 +271,7 @@ int ssl3_get_finished(SSL *s, int a, int b)
                 goto f_err;
                 }
 
-        if (memcmp(p, s->s3->tmp.peer_finish_md, i) != 0)
+        if (CRYPTO_memcmp(p, s->s3->tmp.peer_finish_md, i) != 0)
                 {
                 al=SSL_AD_DECRYPT_ERROR;
                 SSLerr(SSL_F_SSL3_GET_FINISHED,SSL_R_DIGEST_CHECK_FAILED);
@@ -537,12 +545,14 @@ long ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)
                 s->init_num += i;
                 n -= i;
                 }
+
 #ifndef OPENSSL_NO_NEXTPROTONEG
         /* If receiving Finished, record MAC of prior handshake messages for
          * Finished verification. */
         if (*s->init_buf->data == SSL3_MT_FINISHED)
                 ssl3_take_mac(s);
 #endif
+
         /* Feed this message into MAC computation. */
         ssl3_finish_mac(s, (unsigned char *)s->init_buf->data, s->init_num + 4);
         if (s->msg_callback)
diff --git a/src/lib/libssl/s3_clnt.c b/src/lib/libssl/s3_clnt.c
index b80d052e1f..a6b3c01afa 100644
--- a/src/lib/libssl/s3_clnt.c
+++ b/src/lib/libssl/s3_clnt.c
@@ -459,7 +459,6 @@ int ssl3_connect(SSL *s)
                                 SSL3_ST_CW_CHANGE_A,SSL3_ST_CW_CHANGE_B);
                         if (ret <= 0) goto end;
 
-
 #if defined(OPENSSL_NO_TLSEXT) || defined(OPENSSL_NO_NEXTPROTONEG)
                         s->state=SSL3_ST_CW_FINISHED_A;
 #else
@@ -656,7 +655,7 @@ int ssl3_client_hello(SSL *s)
         unsigned char *buf;
         unsigned char *p,*d;
         int i;
-        unsigned long Time,l;
+        unsigned long l;
 #ifndef OPENSSL_NO_COMP
         int j;
         SSL_COMP *comp;
@@ -681,9 +680,8 @@ int ssl3_client_hello(SSL *s)
                 /* else use the pre-loaded session */
 
                 p=s->s3->client_random;
-                Time=(unsigned long)time(NULL);                 /* Time */
-                l2n(Time,p);
-                if (RAND_pseudo_bytes(p,SSL3_RANDOM_SIZE-4) <= 0)
+
+                if (ssl_fill_hello_random(s, 0, p, SSL3_RANDOM_SIZE) <= 0)
                         goto err;
 
                 /* Do the message type and length last */
@@ -987,7 +985,10 @@ int ssl3_get_server_hello(SSL *s)
          * client authentication.
          */
         if (TLS1_get_version(s) < TLS1_2_VERSION && !ssl3_digest_cached_records(s))
+                {
+                al = SSL_AD_INTERNAL_ERROR;
                 goto f_err;
+                }
         /* lets get the compression algorithm */
         /* COMPRESSION */
 #ifdef OPENSSL_NO_COMP
diff --git a/src/lib/libssl/s3_lib.c b/src/lib/libssl/s3_lib.c
index fb60cde8ee..c4ef2738d7 100644
--- a/src/lib/libssl/s3_lib.c
+++ b/src/lib/libssl/s3_lib.c
@@ -1125,7 +1125,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         0, /* not implemented (non-ephemeral DH) */
         TLS1_TXT_DH_DSS_WITH_AES_128_SHA256,
         TLS1_CK_DH_DSS_WITH_AES_128_SHA256,
-        SSL_kDHr,
+        SSL_kDHd,
         SSL_aDH,
         SSL_AES128,
         SSL_SHA256,
@@ -1407,7 +1407,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         0, /* not implemented (non-ephemeral DH) */
         TLS1_TXT_DH_DSS_WITH_AES_256_SHA256,
         TLS1_CK_DH_DSS_WITH_AES_256_SHA256,
-        SSL_kDHr,
+        SSL_kDHd,
         SSL_aDH,
         SSL_AES256,
         SSL_SHA256,
@@ -1683,7 +1683,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL_3DES,
         SSL_SHA1,
         SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
+        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
         168,
         168,
@@ -1699,7 +1699,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL_AES128,
         SSL_SHA1,
         SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
+        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
         128,
         128,
@@ -1715,7 +1715,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL_AES256,
         SSL_SHA1,
         SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
+        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
         SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
         256,
         256,
@@ -1958,7 +1958,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         0,
         TLS1_TXT_DH_DSS_WITH_AES_128_GCM_SHA256,
         TLS1_CK_DH_DSS_WITH_AES_128_GCM_SHA256,
-        SSL_kDHr,
+        SSL_kDHd,
         SSL_aDH,
         SSL_AES128GCM,
         SSL_AEAD,
@@ -1974,7 +1974,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         0,
         TLS1_TXT_DH_DSS_WITH_AES_256_GCM_SHA384,
         TLS1_CK_DH_DSS_WITH_AES_256_GCM_SHA384,
-        SSL_kDHr,
+        SSL_kDHd,
         SSL_aDH,
         SSL_AES256GCM,
         SSL_AEAD,
@@ -2669,7 +2669,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         1,
         TLS1_TXT_ECDH_RSA_WITH_AES_128_SHA256,
         TLS1_CK_ECDH_RSA_WITH_AES_128_SHA256,
-        SSL_kECDHe,
+        SSL_kECDHr,
         SSL_aECDH,
         SSL_AES128,
         SSL_SHA256,
@@ -2685,7 +2685,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         1,
         TLS1_TXT_ECDH_RSA_WITH_AES_256_SHA384,
         TLS1_CK_ECDH_RSA_WITH_AES_256_SHA384,
-        SSL_kECDHe,
+        SSL_kECDHr,
         SSL_aECDH,
         SSL_AES256,
         SSL_SHA384,
@@ -2799,7 +2799,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         1,
         TLS1_TXT_ECDH_RSA_WITH_AES_128_GCM_SHA256,
         TLS1_CK_ECDH_RSA_WITH_AES_128_GCM_SHA256,
-        SSL_kECDHe,
+        SSL_kECDHr,
         SSL_aECDH,
         SSL_AES128GCM,
         SSL_AEAD,
@@ -2815,7 +2815,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         1,
         TLS1_TXT_ECDH_RSA_WITH_AES_256_GCM_SHA384,
         TLS1_CK_ECDH_RSA_WITH_AES_256_GCM_SHA384,
-        SSL_kECDHe,
+        SSL_kECDHr,
         SSL_aECDH,
         SSL_AES256GCM,
         SSL_AEAD,
@@ -3037,6 +3037,11 @@ void ssl3_clear(SSL *s)
                 s->s3->tmp.ecdh = NULL;
                 }
 #endif
+#ifndef OPENSSL_NO_TLSEXT
+#ifndef OPENSSL_NO_EC
+        s->s3->is_probably_safari = 0;
+#endif /* !OPENSSL_NO_EC */
+#endif /* !OPENSSL_NO_TLSEXT */
 
         rp = s->s3->rbuf.buf;
         wp = s->s3->wbuf.buf;
@@ -4016,6 +4021,13 @@ SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
                 ii=sk_SSL_CIPHER_find(allow,c);
                 if (ii >= 0)
                         {
+#if !defined(OPENSSL_NO_EC) && !defined(OPENSSL_NO_TLSEXT)
+                        if ((alg_k & SSL_kEECDH) && (alg_a & SSL_aECDSA) && s->s3->is_probably_safari)
+                                {
+                                if (!ret) ret=sk_SSL_CIPHER_value(allow,ii);
+                                continue;
+                                }
+#endif
                         ret=sk_SSL_CIPHER_value(allow,ii);
                         break;
                         }
@@ -4274,7 +4286,7 @@ need to go to SSL_ST_ACCEPT.
 long ssl_get_algorithm2(SSL *s)
         {
         long alg2 = s->s3->tmp.new_cipher->algorithm2;
-        if (TLS1_get_version(s) >= TLS1_2_VERSION &&
+        if (s->method->version == TLS1_2_VERSION &&
             alg2 == (SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF))
                 return SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256;
         return alg2;
diff --git a/src/lib/libssl/s3_pkt.c b/src/lib/libssl/s3_pkt.c
index adf8c387cc..96ba63262e 100644
--- a/src/lib/libssl/s3_pkt.c
+++ b/src/lib/libssl/s3_pkt.c
@@ -290,11 +290,8 @@ static int ssl3_get_record(SSL *s)
         unsigned char *p;
         unsigned char md[EVP_MAX_MD_SIZE];
         short version;
-        int mac_size;
-        int clear=0;
+        unsigned mac_size, orig_len;
         size_t extra;
-        int decryption_failed_or_bad_record_mac = 0;
-        unsigned char *mac = NULL;
 
         rr= &(s->s3->rrec);
         sess=s->session;
@@ -338,7 +335,7 @@ fprintf(stderr, "Record type=%d, Length=%d\n", rr->type, rr->length);
                         if (version != s->version)
                                 {
                                 SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_WRONG_VERSION_NUMBER);
-                                if ((s->version & 0xFF00) == (version & 0xFF00))
+                                if ((s->version & 0xFF00) == (version & 0xFF00) && !s->enc_write_ctx && !s->write_hash)
                                         /* Send back error using their minor version number :-) */
                                         s->version = (unsigned short)version;
                                 al=SSL_AD_PROTOCOL_VERSION;
@@ -403,17 +400,15 @@ fprintf(stderr, "Record type=%d, Length=%d\n", rr->type, rr->length);
         rr->data=rr->input;
 
         enc_err = s->method->ssl3_enc->enc(s,0);
-        if (enc_err <= 0)
+        /* enc_err is:
+         *    0: (in non-constant time) if the record is publically invalid.
+         *    1: if the padding is valid
+         *    -1: if the padding is invalid */
+        if (enc_err == 0)
                 {
-                if (enc_err == 0)
-                        /* SSLerr() and ssl3_send_alert() have been called */
-                        goto err;
-
-                /* Otherwise enc_err == -1, which indicates bad padding
-                 * (rec->length has not been changed in this case).
-                 * To minimize information leaked via timing, we will perform
-                 * the MAC computation anyway. */
-                decryption_failed_or_bad_record_mac = 1;
+                al=SSL_AD_DECRYPTION_FAILED;
+                SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_BLOCK_CIPHER_PAD_IS_WRONG);
+                goto f_err;
                 }
 
 #ifdef TLS_DEBUG
@@ -423,53 +418,62 @@ printf("\n");
 #endif
 
         /* r->length is now the compressed data plus mac */
-        if (    (sess == NULL) ||
-                (s->enc_read_ctx == NULL) ||
-                (EVP_MD_CTX_md(s->read_hash) == NULL))
-                clear=1;
-
-        if (!clear)
+        if ((sess != NULL) &&
+            (s->enc_read_ctx != NULL) &&
+            (EVP_MD_CTX_md(s->read_hash) != NULL))
                 {
-                /* !clear => s->read_hash != NULL => mac_size != -1 */
+                /* s->read_hash != NULL => mac_size != -1 */
+                unsigned char *mac = NULL;
+                unsigned char mac_tmp[EVP_MAX_MD_SIZE];
                 mac_size=EVP_MD_CTX_size(s->read_hash);
-                OPENSSL_assert(mac_size >= 0);
+                OPENSSL_assert(mac_size <= EVP_MAX_MD_SIZE);
 
-                if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH+extra+mac_size)
+                /* kludge: *_cbc_remove_padding passes padding length in rr->type */
+                orig_len = rr->length+((unsigned int)rr->type>>8);
+
+                /* orig_len is the length of the record before any padding was
+                 * removed. This is public information, as is the MAC in use,
+                 * therefore we can safely process the record in a different
+                 * amount of time if it's too short to possibly contain a MAC.
+                 */
+                if (orig_len < mac_size ||
+                    /* CBC records must have a padding length byte too. */
+                    (EVP_CIPHER_CTX_mode(s->enc_read_ctx) == EVP_CIPH_CBC_MODE &&
+                     orig_len < mac_size+1))
                         {
-#if 0 /* OK only for stream ciphers (then rr->length is visible from ciphertext anyway) */
-                        al=SSL_AD_RECORD_OVERFLOW;
-                        SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_PRE_MAC_LENGTH_TOO_LONG);
+                        al=SSL_AD_DECODE_ERROR;
+                        SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_LENGTH_TOO_SHORT);
                         goto f_err;
-#else
-                        decryption_failed_or_bad_record_mac = 1;
-#endif                  
                         }
-                /* check the MAC for rr->input (it's in mac_size bytes at the tail) */
-                if (rr->length >= (unsigned int)mac_size)
+
+                if (EVP_CIPHER_CTX_mode(s->enc_read_ctx) == EVP_CIPH_CBC_MODE)
                         {
+                        /* We update the length so that the TLS header bytes
+                         * can be constructed correctly but we need to extract
+                         * the MAC in constant time from within the record,
+                         * without leaking the contents of the padding bytes.
+                         * */
+                        mac = mac_tmp;
+                        ssl3_cbc_copy_mac(mac_tmp, rr, mac_size, orig_len);
                         rr->length -= mac_size;
-                        mac = &rr->data[rr->length];
                         }
                 else
                         {
-                        /* record (minus padding) is too short to contain a MAC */
-#if 0 /* OK only for stream ciphers */
-                        al=SSL_AD_DECODE_ERROR;
-                        SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_LENGTH_TOO_SHORT);
-                        goto f_err;
-#else
-                        decryption_failed_or_bad_record_mac = 1;
-                        rr->length = 0;
-#endif
-                        }
-                i=s->method->ssl3_enc->mac(s,md,0);
-                if (i < 0 || mac == NULL || memcmp(md, mac, (size_t)mac_size) != 0)
-                        {
-                        decryption_failed_or_bad_record_mac = 1;
+                        /* In this case there's no padding, so |orig_len|
+                         * equals |rec->length| and we checked that there's
+                         * enough bytes for |mac_size| above. */
+                        rr->length -= mac_size;
+                        mac = &rr->data[rr->length];
                         }
+
+                i=s->method->ssl3_enc->mac(s,md,0 /* not send */);
+                if (i < 0 || mac == NULL || CRYPTO_memcmp(md, mac, (size_t)mac_size) != 0)
+                        enc_err = -1;
+                if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH+extra+mac_size)
+                        enc_err = -1;
                 }
 
-        if (decryption_failed_or_bad_record_mac)
+        if (enc_err < 0)
                 {
                 /* A separate 'decryption_failed' alert was introduced with TLS 1.0,
                  * SSL 3.0 only has 'bad_record_mac'.  But unless a decryption
@@ -744,6 +748,7 @@ static int do_ssl3_write(SSL *s, int type, const unsigned char *buf,
          * bytes and record version number > TLS 1.0
          */
         if (s->state == SSL3_ST_CW_CLNT_HELLO_B
+                                && !s->renegotiate
                                 && TLS1_get_version(s) > TLS1_VERSION)
                 *(p++) = 0x1;
         else
@@ -1238,7 +1243,7 @@ start:
                                 goto f_err;
                                 }
 #ifdef SSL_AD_MISSING_SRP_USERNAME
-                        if (alert_descr == SSL_AD_MISSING_SRP_USERNAME)
+                        else if (alert_descr == SSL_AD_MISSING_SRP_USERNAME)
                                 return(0);
 #endif
                         }
@@ -1454,8 +1459,14 @@ int ssl3_do_change_cipher_spec(SSL *s)
                 slen=s->method->ssl3_enc->client_finished_label_len;
                 }
 
-        s->s3->tmp.peer_finish_md_len = s->method->ssl3_enc->final_finish_mac(s,
+        i = s->method->ssl3_enc->final_finish_mac(s,
                 sender,slen,s->s3->tmp.peer_finish_md);
+        if (i == 0)
+                {
+                SSLerr(SSL_F_SSL3_DO_CHANGE_CIPHER_SPEC, ERR_R_INTERNAL_ERROR);
+                return 0;
+                }
+        s->s3->tmp.peer_finish_md_len = i;
 
         return(1);
         }
diff --git a/src/lib/libssl/s3_srvr.c b/src/lib/libssl/s3_srvr.c
index 118939fabb..9ac19c05f2 100644
--- a/src/lib/libssl/s3_srvr.c
+++ b/src/lib/libssl/s3_srvr.c
@@ -191,7 +191,8 @@ static int ssl_check_srp_ext_ClientHello(SSL *s, int *al)
                 {
                 if(s->srp_ctx.login == NULL)
                         {
-                        /* There isn't any srp login extension !!! */
+                        /* RFC 5054 says SHOULD reject, 
+                           we do so if There is no srp login name */
                         ret = SSL3_AL_FATAL;
                         *al = SSL_AD_UNKNOWN_PSK_IDENTITY;
                         }
@@ -378,6 +379,7 @@ int ssl3_accept(SSL *s)
                                 }
                         }
 #endif          
+                        
                         s->renegotiate = 2;
                         s->state=SSL3_ST_SW_SRVR_HELLO_A;
                         s->init_num=0;
@@ -956,7 +958,8 @@ int ssl3_get_client_hello(SSL *s)
             (s->version != DTLS1_VERSION && s->client_version < s->version))
                 {
                 SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO, SSL_R_WRONG_VERSION_NUMBER);
-                if ((s->client_version>>8) == SSL3_VERSION_MAJOR)
+                if ((s->client_version>>8) == SSL3_VERSION_MAJOR && 
+                        !s->enc_write_ctx && !s->write_hash)
                         {
                         /* similar to ssl3_get_record, send alert using remote version number */
                         s->version = s->client_version;
@@ -1181,7 +1184,7 @@ int ssl3_get_client_hello(SSL *s)
                         goto f_err;
                         }
                 }
-                if (ssl_check_clienthello_tlsext(s) <= 0) {
+                if (ssl_check_clienthello_tlsext_early(s) <= 0) {
                         SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_CLIENTHELLO_TLSEXT);
                         goto err;
                 }
@@ -1191,12 +1194,9 @@ int ssl3_get_client_hello(SSL *s)
          * server_random before calling tls_session_secret_cb in order to allow
          * SessionTicket processing to use it in key derivation. */
         {
-                unsigned long Time;
                 unsigned char *pos;
-                Time=(unsigned long)time(NULL);                 /* Time */
                 pos=s->s3->server_random;
-                l2n(Time,pos);
-                if (RAND_pseudo_bytes(pos,SSL3_RANDOM_SIZE-4) <= 0)
+                if (ssl_fill_hello_random(s, 1, pos, SSL3_RANDOM_SIZE) <= 0)
                         {
                         al=SSL_AD_INTERNAL_ERROR;
                         goto f_err;
@@ -1389,7 +1389,10 @@ int ssl3_get_client_hello(SSL *s)
         if (TLS1_get_version(s) < TLS1_2_VERSION || !(s->verify_mode & SSL_VERIFY_PEER))
                 {
                 if (!ssl3_digest_cached_records(s))
+                        {
+                        al = SSL_AD_INTERNAL_ERROR;
                         goto f_err;
+                        }
                 }
         
         /* we now have the following setup. 
@@ -1403,6 +1406,16 @@ int ssl3_get_client_hello(SSL *s)
          * s->tmp.new_cipher    - the new cipher to use.
          */
 
+        /* Handles TLS extensions that we couldn't check earlier */
+        if (s->version >= SSL3_VERSION)
+                {
+                if (ssl_check_clienthello_tlsext_late(s) <= 0)
+                        {
+                        SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO, SSL_R_CLIENTHELLO_TLSEXT);
+                        goto err;
+                        }
+                }
+
         if (ret < 0) ret=1;
         if (0)
                 {
@@ -1420,19 +1433,13 @@ int ssl3_send_server_hello(SSL *s)
         unsigned char *p,*d;
         int i,sl;
         unsigned long l;
-#ifdef OPENSSL_NO_TLSEXT
-        unsigned long Time;
-#endif
 
         if (s->state == SSL3_ST_SW_SRVR_HELLO_A)
                 {
                 buf=(unsigned char *)s->init_buf->data;
 #ifdef OPENSSL_NO_TLSEXT
                 p=s->s3->server_random;
-                /* Generate server_random if it was not needed previously */
-                Time=(unsigned long)time(NULL);                 /* Time */
-                l2n(Time,p);
-                if (RAND_pseudo_bytes(p,SSL3_RANDOM_SIZE-4) <= 0)
+                if (ssl_fill_hello_random(s, 1, p, SSL3_RANDOM_SIZE) <= 0)
                         return -1;
 #endif
                 /* Do the message type and length last */
@@ -1823,7 +1830,7 @@ int ssl3_send_server_key_exchange(SSL *s)
                         SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE);
                         goto f_err;
                         }
-                for (i=0; r[i] != NULL && i<4; i++)
+                for (i=0; i < 4 && r[i] != NULL; i++)
                         {
                         nr[i]=BN_num_bytes(r[i]);
 #ifndef OPENSSL_NO_SRP
@@ -1859,7 +1866,7 @@ int ssl3_send_server_key_exchange(SSL *s)
                 d=(unsigned char *)s->init_buf->data;
                 p= &(d[4]);
 
-                for (i=0; r[i] != NULL && i<4; i++)
+                for (i=0; i < 4 && r[i] != NULL; i++)
                         {
 #ifndef OPENSSL_NO_SRP
                         if ((i == 2) && (type & SSL_kSRP))
diff --git a/src/lib/libssl/ssl.h b/src/lib/libssl/ssl.h
index 8b0c2a2dac..7219a0e64b 100644
--- a/src/lib/libssl/ssl.h
+++ b/src/lib/libssl/ssl.h
@@ -493,6 +493,9 @@ struct ssl_session_st
         char *psk_identity_hint;
         char *psk_identity;
 #endif
+        /* Used to indicate that session resumption is not allowed.
+         * Applications can also set this bit for a new session via
+         * not_resumable_session_cb to disable session caching and tickets. */
         int not_resumable;
 
         /* The cert is the certificate used to establish this connection */
@@ -535,7 +538,7 @@ struct ssl_session_st
 #endif /* OPENSSL_NO_EC */
         /* RFC4507 info */
         unsigned char *tlsext_tick;     /* Session ticket */
-        size_t  tlsext_ticklen;         /* Session ticket length */     
+        size_t tlsext_ticklen;          /* Session ticket length */
         long tlsext_tick_lifetime_hint; /* Session lifetime hint in seconds */
 #endif
 #ifndef OPENSSL_NO_SRP
@@ -552,11 +555,14 @@ struct ssl_session_st
 #define SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG         0x00000008L
 #define SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG              0x00000010L
 #define SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER               0x00000020L
-#define SSL_OP_MSIE_SSLV2_RSA_PADDING                   0x00000040L /* no effect since 0.9.7h and 0.9.8b */
+#define SSL_OP_SAFARI_ECDHE_ECDSA_BUG                   0x00000040L
 #define SSL_OP_SSLEAY_080_CLIENT_DH_BUG                 0x00000080L
 #define SSL_OP_TLS_D5_BUG                               0x00000100L
 #define SSL_OP_TLS_BLOCK_PADDING_BUG                    0x00000200L
 
+/* Hasn't done anything since OpenSSL 0.9.7h, retained for compatibility */
+#define SSL_OP_MSIE_SSLV2_RSA_PADDING                   0x0
+
 /* Disable SSL 3.0/TLS 1.0 CBC vulnerability workaround that was added
  * in OpenSSL 0.9.6d.  Usually (depending on the application protocol)
  * the workaround is not needed.  Unfortunately some broken SSL/TLS
@@ -638,6 +644,12 @@ struct ssl_session_st
  * TLS only.)  "Released" buffers are put onto a free-list in the context
  * or just freed (depending on the context's setting for freelist_max_len). */
 #define SSL_MODE_RELEASE_BUFFERS 0x00000010L
+/* Send the current time in the Random fields of the ClientHello and
+ * ServerHello records for compatibility with hypothetical implementations
+ * that require it.
+ */
+#define SSL_MODE_SEND_CLIENTHELLO_TIME 0x00000020L
+#define SSL_MODE_SEND_SERVERHELLO_TIME 0x00000040L
 
 /* Note: SSL[_CTX]_set_{options,mode} use |= op on the previous value,
  * they cannot be used to clear bits. */
@@ -903,7 +915,7 @@ struct ssl_ctx_st
          */
         unsigned int max_send_fragment;
 
-#ifndef OPENSSL_ENGINE
+#ifndef OPENSSL_NO_ENGINE
         /* Engine to pass requests for client certs to
          */
         ENGINE *client_cert_engine;
@@ -927,6 +939,7 @@ struct ssl_ctx_st
         /* Callback for status request */
         int (*tlsext_status_cb)(SSL *ssl, void *arg);
         void *tlsext_status_arg;
+
         /* draft-rescorla-tls-opaque-prf-input-00.txt information */
         int (*tlsext_opaque_prf_input_callback)(SSL *, void *peerinput, size_t len, void *arg);
         void *tlsext_opaque_prf_input_callback_arg;
@@ -952,6 +965,7 @@ struct ssl_ctx_st
 #endif
 
 #ifndef OPENSSL_NO_TLSEXT
+
 # ifndef OPENSSL_NO_NEXTPROTONEG
         /* Next protocol negotiation information */
         /* (for experimental NPN extension). */
@@ -2206,6 +2220,7 @@ void ERR_load_SSL_strings(void);
 #define SSL_F_SSL_GET_NEW_SESSION                        181
 #define SSL_F_SSL_GET_PREV_SESSION                       217
 #define SSL_F_SSL_GET_SERVER_SEND_CERT                   182
+#define SSL_F_SSL_GET_SERVER_SEND_PKEY                   317
 #define SSL_F_SSL_GET_SIGN_PKEY                          183
 #define SSL_F_SSL_INIT_WBIO_BUFFER                       184
 #define SSL_F_SSL_LOAD_CLIENT_CA_FILE                    185
diff --git a/src/lib/libssl/ssl3.h b/src/lib/libssl/ssl3.h
index 112e627de0..cb8b2492ec 100644
--- a/src/lib/libssl/ssl3.h
+++ b/src/lib/libssl/ssl3.h
@@ -539,6 +539,15 @@ typedef struct ssl3_state_st
         /* Set if we saw the Next Protocol Negotiation extension from our peer. */
         int next_proto_neg_seen;
 #endif
+
+#ifndef OPENSSL_NO_TLSEXT
+#ifndef OPENSSL_NO_EC
+        /* This is set to true if we believe that this is a version of Safari
+         * running on OS X 10.6 or newer. We wish to know this because Safari
+         * on 10.8 .. 10.8.3 has broken ECDHE-ECDSA support. */
+        char is_probably_safari;
+#endif /* !OPENSSL_NO_EC */
+#endif /* !OPENSSL_NO_TLSEXT */
         } SSL3_STATE;
 
 #endif
@@ -578,8 +587,10 @@ typedef struct ssl3_state_st
 #define SSL3_ST_CW_CERT_VRFY_B          (0x191|SSL_ST_CONNECT)
 #define SSL3_ST_CW_CHANGE_A             (0x1A0|SSL_ST_CONNECT)
 #define SSL3_ST_CW_CHANGE_B             (0x1A1|SSL_ST_CONNECT)
+#ifndef OPENSSL_NO_NEXTPROTONEG
 #define SSL3_ST_CW_NEXT_PROTO_A         (0x200|SSL_ST_CONNECT)
 #define SSL3_ST_CW_NEXT_PROTO_B         (0x201|SSL_ST_CONNECT)
+#endif
 #define SSL3_ST_CW_FINISHED_A           (0x1B0|SSL_ST_CONNECT)
 #define SSL3_ST_CW_FINISHED_B           (0x1B1|SSL_ST_CONNECT)
 /* read from server */
@@ -629,8 +640,10 @@ typedef struct ssl3_state_st
 #define SSL3_ST_SR_CERT_VRFY_B          (0x1A1|SSL_ST_ACCEPT)
 #define SSL3_ST_SR_CHANGE_A             (0x1B0|SSL_ST_ACCEPT)
 #define SSL3_ST_SR_CHANGE_B             (0x1B1|SSL_ST_ACCEPT)
+#ifndef OPENSSL_NO_NEXTPROTONEG
 #define SSL3_ST_SR_NEXT_PROTO_A         (0x210|SSL_ST_ACCEPT)
 #define SSL3_ST_SR_NEXT_PROTO_B         (0x211|SSL_ST_ACCEPT)
+#endif
 #define SSL3_ST_SR_FINISHED_A           (0x1C0|SSL_ST_ACCEPT)
 #define SSL3_ST_SR_FINISHED_B           (0x1C1|SSL_ST_ACCEPT)
 /* write to client */
@@ -655,7 +668,9 @@ typedef struct ssl3_state_st
 #define SSL3_MT_CLIENT_KEY_EXCHANGE             16
 #define SSL3_MT_FINISHED                        20
 #define SSL3_MT_CERTIFICATE_STATUS              22
+#ifndef OPENSSL_NO_NEXTPROTONEG
 #define SSL3_MT_NEXT_PROTO                      67
+#endif
 #define DTLS1_MT_HELLO_VERIFY_REQUEST    3
 
 
diff --git a/src/lib/libssl/ssl_algs.c b/src/lib/libssl/ssl_algs.c
index d443143c59..9c34d19725 100644
--- a/src/lib/libssl/ssl_algs.c
+++ b/src/lib/libssl/ssl_algs.c
@@ -94,6 +94,7 @@ int SSL_library_init(void)
         EVP_add_cipher(EVP_aes_128_cbc_hmac_sha1());
         EVP_add_cipher(EVP_aes_256_cbc_hmac_sha1());
 #endif
+
 #endif
 #ifndef OPENSSL_NO_CAMELLIA
         EVP_add_cipher(EVP_camellia_128_cbc());
diff --git a/src/lib/libssl/ssl_cert.c b/src/lib/libssl/ssl_cert.c
index 917be31876..5123a89182 100644
--- a/src/lib/libssl/ssl_cert.c
+++ b/src/lib/libssl/ssl_cert.c
@@ -164,14 +164,14 @@ static void ssl_cert_set_default_md(CERT *cert)
         {
         /* Set digest values to defaults */
 #ifndef OPENSSL_NO_DSA
-        cert->pkeys[SSL_PKEY_DSA_SIGN].digest = EVP_dss1();
+        cert->pkeys[SSL_PKEY_DSA_SIGN].digest = EVP_sha1();
 #endif
 #ifndef OPENSSL_NO_RSA
         cert->pkeys[SSL_PKEY_RSA_SIGN].digest = EVP_sha1();
         cert->pkeys[SSL_PKEY_RSA_ENC].digest = EVP_sha1();
 #endif
 #ifndef OPENSSL_NO_ECDSA
-        cert->pkeys[SSL_PKEY_ECC].digest = EVP_ecdsa();
+        cert->pkeys[SSL_PKEY_ECC].digest = EVP_sha1();
 #endif
         }
 
diff --git a/src/lib/libssl/ssl_ciph.c b/src/lib/libssl/ssl_ciph.c
index 92d1e94d6a..0aba8e048c 100644
--- a/src/lib/libssl/ssl_ciph.c
+++ b/src/lib/libssl/ssl_ciph.c
@@ -312,6 +312,7 @@ static const SSL_CIPHER cipher_aliases[]={
         {0,SSL_TXT_SSLV2,0,   0,0,0,0,SSL_SSLV2, 0,0,0,0},
         {0,SSL_TXT_SSLV3,0,   0,0,0,0,SSL_SSLV3, 0,0,0,0},
         {0,SSL_TXT_TLSV1,0,   0,0,0,0,SSL_TLSV1, 0,0,0,0},
+        {0,SSL_TXT_TLSV1_2,0, 0,0,0,0,SSL_TLSV1_2, 0,0,0,0},
 
         /* export flag */
         {0,SSL_TXT_EXP,0,     0,0,0,0,0,SSL_EXPORT,0,0,0},
@@ -1150,9 +1151,9 @@ static int ssl_cipher_process_rulestr(const char *rule_str,
                         while ( ((ch >= 'A') && (ch <= 'Z')) ||
                                 ((ch >= '0') && (ch <= '9')) ||
                                 ((ch >= 'a') && (ch <= 'z')) ||
-                                 (ch == '-'))
+                                 (ch == '-') || (ch == '.'))
 #else
-                        while ( isalnum(ch) || (ch == '-'))
+                        while ( isalnum(ch) || (ch == '-') || (ch == '.'))
 #endif
                                  {
                                  ch = *(++l);
diff --git a/src/lib/libssl/ssl_err.c b/src/lib/libssl/ssl_err.c
index 2577c6895a..370fb57e3b 100644
--- a/src/lib/libssl/ssl_err.c
+++ b/src/lib/libssl/ssl_err.c
@@ -228,6 +228,7 @@ static ERR_STRING_DATA SSL_str_functs[]=
 {ERR_FUNC(SSL_F_SSL_GET_NEW_SESSION),   "SSL_GET_NEW_SESSION"},
 {ERR_FUNC(SSL_F_SSL_GET_PREV_SESSION),  "SSL_GET_PREV_SESSION"},
 {ERR_FUNC(SSL_F_SSL_GET_SERVER_SEND_CERT),      "SSL_GET_SERVER_SEND_CERT"},
+{ERR_FUNC(SSL_F_SSL_GET_SERVER_SEND_PKEY),      "SSL_GET_SERVER_SEND_PKEY"},
 {ERR_FUNC(SSL_F_SSL_GET_SIGN_PKEY),     "SSL_GET_SIGN_PKEY"},
 {ERR_FUNC(SSL_F_SSL_INIT_WBIO_BUFFER),  "SSL_INIT_WBIO_BUFFER"},
 {ERR_FUNC(SSL_F_SSL_LOAD_CLIENT_CA_FILE),       "SSL_load_client_CA_file"},
diff --git a/src/lib/libssl/ssl_lib.c b/src/lib/libssl/ssl_lib.c
index f82d071d6e..6dbc3c1f7d 100644
--- a/src/lib/libssl/ssl_lib.c
+++ b/src/lib/libssl/ssl_lib.c
@@ -597,8 +597,10 @@ void SSL_free(SSL *s)
                 OPENSSL_free(s->next_proto_negotiated);
 #endif
 
+#ifndef OPENSSL_NO_SRTP
         if (s->srtp_profiles)
             sk_SRTP_PROTECTION_PROFILE_free(s->srtp_profiles);
+#endif
 
         OPENSSL_free(s);
         }
@@ -1795,7 +1797,9 @@ SSL_CTX *SSL_CTX_new(const SSL_METHOD *meth)
         CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL_CTX, ret, &ret->ex_data);
 
         ret->extra_certs=NULL;
-        ret->comp_methods=SSL_COMP_get_compression_methods();
+        /* No compression for DTLS */
+        if (meth->version != DTLS1_VERSION)
+                ret->comp_methods=SSL_COMP_get_compression_methods();
 
         ret->max_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH;
 
@@ -1952,8 +1956,10 @@ void SSL_CTX_free(SSL_CTX *a)
         a->comp_methods = NULL;
 #endif
 
+#ifndef OPENSSL_NO_SRTP
         if (a->srtp_profiles)
                 sk_SRTP_PROTECTION_PROFILE_free(a->srtp_profiles);
+#endif
 
 #ifndef OPENSSL_NO_PSK
         if (a->psk_identity_hint)
@@ -2287,7 +2293,7 @@ int ssl_check_srvr_ecc_cert_and_alg(X509 *x, SSL *s)
 #endif
 
 /* THIS NEEDS CLEANING UP */
-X509 *ssl_get_server_send_cert(SSL *s)
+CERT_PKEY *ssl_get_server_send_pkey(const SSL *s)
         {
         unsigned long alg_k,alg_a;
         CERT *c;
@@ -2342,12 +2348,20 @@ X509 *ssl_get_server_send_cert(SSL *s)
                 i=SSL_PKEY_GOST01;
         else /* if (alg_a & SSL_aNULL) */
                 {
-                SSLerr(SSL_F_SSL_GET_SERVER_SEND_CERT,ERR_R_INTERNAL_ERROR);
+                SSLerr(SSL_F_SSL_GET_SERVER_SEND_PKEY,ERR_R_INTERNAL_ERROR);
                 return(NULL);
                 }
-        if (c->pkeys[i].x509 == NULL) return(NULL);
 
-        return(c->pkeys[i].x509);
+        return c->pkeys + i;
+        }
+
+X509 *ssl_get_server_send_cert(const SSL *s)
+        {
+        CERT_PKEY *cpk;
+        cpk = ssl_get_server_send_pkey(s);
+        if (!cpk)
+                return NULL;
+        return cpk->x509;
         }
 
 EVP_PKEY *ssl_get_sign_pkey(SSL *s,const SSL_CIPHER *cipher, const EVP_MD **pmd)
@@ -2608,7 +2622,7 @@ const char *SSL_get_version(const SSL *s)
                 return("TLSv1.2");
         else if (s->version == TLS1_1_VERSION)
                 return("TLSv1.1");
-        if (s->version == TLS1_VERSION)
+        else if (s->version == TLS1_VERSION)
                 return("TLSv1");
         else if (s->version == SSL3_VERSION)
                 return("SSLv3");
diff --git a/src/lib/libssl/ssl_locl.h b/src/lib/libssl/ssl_locl.h
index d87fd51cfa..e485907748 100644
--- a/src/lib/libssl/ssl_locl.h
+++ b/src/lib/libssl/ssl_locl.h
@@ -215,6 +215,15 @@
                          *((c)++)=(unsigned char)(((l)>> 8)&0xff), \
                          *((c)++)=(unsigned char)(((l)    )&0xff))
 
+#define l2n8(l,c)       (*((c)++)=(unsigned char)(((l)>>56)&0xff), \
+                         *((c)++)=(unsigned char)(((l)>>48)&0xff), \
+                         *((c)++)=(unsigned char)(((l)>>40)&0xff), \
+                         *((c)++)=(unsigned char)(((l)>>32)&0xff), \
+                         *((c)++)=(unsigned char)(((l)>>24)&0xff), \
+                         *((c)++)=(unsigned char)(((l)>>16)&0xff), \
+                         *((c)++)=(unsigned char)(((l)>> 8)&0xff), \
+                         *((c)++)=(unsigned char)(((l)    )&0xff))
+
 #define n2l6(c,l)       (l =((BN_ULLONG)(*((c)++)))<<40, \
                          l|=((BN_ULLONG)(*((c)++)))<<32, \
                          l|=((BN_ULLONG)(*((c)++)))<<24, \
@@ -612,6 +621,8 @@ extern SSL3_ENC_METHOD TLSv1_enc_data;
 extern SSL3_ENC_METHOD SSLv3_enc_data;
 extern SSL3_ENC_METHOD DTLSv1_enc_data;
 
+#define SSL_IS_DTLS(s) (s->method->version == DTLS1_VERSION)
+
 #define IMPLEMENT_tls_meth_func(version, func_name, s_accept, s_connect, \
                                 s_get_meth) \
 const SSL_METHOD *func_name(void)  \
@@ -830,13 +841,15 @@ int ssl_verify_cert_chain(SSL *s,STACK_OF(X509) *sk);
 int ssl_undefined_function(SSL *s);
 int ssl_undefined_void_function(void);
 int ssl_undefined_const_function(const SSL *s);
-X509 *ssl_get_server_send_cert(SSL *);
+CERT_PKEY *ssl_get_server_send_pkey(const SSL *s);
+X509 *ssl_get_server_send_cert(const SSL *);
 EVP_PKEY *ssl_get_sign_pkey(SSL *s,const SSL_CIPHER *c, const EVP_MD **pmd);
 int ssl_cert_type(X509 *x,EVP_PKEY *pkey);
 void ssl_set_cert_masks(CERT *c, const SSL_CIPHER *cipher);
 STACK_OF(SSL_CIPHER) *ssl_get_ciphers_by_id(SSL *s);
 int ssl_verify_alarm_type(long type);
 void ssl_load_ciphers(void);
+int ssl_fill_hello_random(SSL *s, int server, unsigned char *field, int len);
 
 int ssl2_enc_init(SSL *s, int client);
 int ssl2_generate_key_material(SSL *s);
@@ -1088,7 +1101,8 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **data, unsigned char *d,
 int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **data, unsigned char *d, int n, int *al);
 int ssl_prepare_clienthello_tlsext(SSL *s);
 int ssl_prepare_serverhello_tlsext(SSL *s);
-int ssl_check_clienthello_tlsext(SSL *s);
+int ssl_check_clienthello_tlsext_early(SSL *s);
+int ssl_check_clienthello_tlsext_late(SSL *s);
 int ssl_check_serverhello_tlsext(SSL *s);
 
 #ifndef OPENSSL_NO_HEARTBEATS
@@ -1131,4 +1145,33 @@ int ssl_parse_clienthello_use_srtp_ext(SSL *s, unsigned char *d, int len,int *al
 int ssl_add_serverhello_use_srtp_ext(SSL *s, unsigned char *p, int *len, int maxlen);
 int ssl_parse_serverhello_use_srtp_ext(SSL *s, unsigned char *d, int len,int *al);
 
+/* s3_cbc.c */
+void ssl3_cbc_copy_mac(unsigned char* out,
+                       const SSL3_RECORD *rec,
+                       unsigned md_size,unsigned orig_len);
+int ssl3_cbc_remove_padding(const SSL* s,
+                            SSL3_RECORD *rec,
+                            unsigned block_size,
+                            unsigned mac_size);
+int tls1_cbc_remove_padding(const SSL* s,
+                            SSL3_RECORD *rec,
+                            unsigned block_size,
+                            unsigned mac_size);
+char ssl3_cbc_record_digest_supported(const EVP_MD_CTX *ctx);
+void ssl3_cbc_digest_record(
+        const EVP_MD_CTX *ctx,
+        unsigned char* md_out,
+        size_t* md_out_size,
+        const unsigned char header[13],
+        const unsigned char *data,
+        size_t data_plus_mac_size,
+        size_t data_plus_mac_plus_padding_size,
+        const unsigned char *mac_secret,
+        unsigned mac_secret_length,
+        char is_sslv3);
+
+void tls_fips_digest_extra(
+        const EVP_CIPHER_CTX *cipher_ctx, EVP_MD_CTX *mac_ctx,
+        const unsigned char *data, size_t data_len, size_t orig_len);
+
 #endif
diff --git a/src/lib/libssl/ssl_rsa.c b/src/lib/libssl/ssl_rsa.c
index c0960b5712..60e7b66859 100644
--- a/src/lib/libssl/ssl_rsa.c
+++ b/src/lib/libssl/ssl_rsa.c
@@ -710,7 +710,7 @@ int SSL_CTX_use_certificate_chain_file(SSL_CTX *ctx, const char *file)
 
         ERR_clear_error(); /* clear error stack for SSL_CTX_use_certificate() */
 
-        in=BIO_new(BIO_s_file_internal());
+        in = BIO_new(BIO_s_file_internal());
         if (in == NULL)
                 {
                 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE,ERR_R_BUF_LIB);
@@ -723,14 +723,16 @@ int SSL_CTX_use_certificate_chain_file(SSL_CTX *ctx, const char *file)
                 goto end;
                 }
 
-        x=PEM_read_bio_X509_AUX(in,NULL,ctx->default_passwd_callback,ctx->default_passwd_callback_userdata);
+        x=PEM_read_bio_X509_AUX(in,NULL,ctx->default_passwd_callback,
+                                ctx->default_passwd_callback_userdata);
         if (x == NULL)
                 {
                 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_CHAIN_FILE,ERR_R_PEM_LIB);
                 goto end;
                 }
 
-        ret=SSL_CTX_use_certificate(ctx,x);
+        ret = SSL_CTX_use_certificate(ctx, x);
+
         if (ERR_peek_error() != 0)
                 ret = 0;  /* Key/certificate mismatch doesn't imply ret==0 ... */
         if (ret)
@@ -742,13 +744,15 @@ int SSL_CTX_use_certificate_chain_file(SSL_CTX *ctx, const char *file)
                 int r;
                 unsigned long err;
                 
-                if (ctx->extra_certs != NULL) 
+                if (ctx->extra_certs != NULL)
                         {
                         sk_X509_pop_free(ctx->extra_certs, X509_free);
                         ctx->extra_certs = NULL;
                         }
 
-                while ((ca = PEM_read_bio_X509(in,NULL,ctx->default_passwd_callback,ctx->default_passwd_callback_userdata))
+                while ((ca = PEM_read_bio_X509(in, NULL,
+                                        ctx->default_passwd_callback,
+                                        ctx->default_passwd_callback_userdata))
                         != NULL)
                         {
                         r = SSL_CTX_add_extra_chain_cert(ctx, ca);
diff --git a/src/lib/libssl/t1_enc.c b/src/lib/libssl/t1_enc.c
index f7bdeb3b9d..0c4cddedf8 100644
--- a/src/lib/libssl/t1_enc.c
+++ b/src/lib/libssl/t1_enc.c
@@ -361,7 +361,7 @@ int tls1_change_cipher_state(SSL *s, int which)
         {
         int i;
         for (i=0; i<s->s3->tmp.key_block_length; i++)
-                printf("%02x", key_block[i]);  printf("\n");
+                printf("%02x", s->s3->tmp.key_block[i]);  printf("\n");
         }
 #endif  /* KSSL_DEBUG */
 
@@ -414,15 +414,20 @@ int tls1_change_cipher_state(SSL *s, int which)
                         s->mac_flags |= SSL_MAC_FLAG_WRITE_MAC_STREAM;
                         else
                         s->mac_flags &= ~SSL_MAC_FLAG_WRITE_MAC_STREAM;
-                if (s->enc_write_ctx != NULL)
+                if (s->enc_write_ctx != NULL && !SSL_IS_DTLS(s))
                         reuse_dd = 1;
-                else if ((s->enc_write_ctx=OPENSSL_malloc(sizeof(EVP_CIPHER_CTX))) == NULL)
+                else if ((s->enc_write_ctx=EVP_CIPHER_CTX_new()) == NULL)
                         goto err;
-                else
-                        /* make sure it's intialized in case we exit later with an error */
-                        EVP_CIPHER_CTX_init(s->enc_write_ctx);
                 dd= s->enc_write_ctx;
-                mac_ctx = ssl_replace_hash(&s->write_hash,NULL);
+                if (SSL_IS_DTLS(s))
+                        {
+                        mac_ctx = EVP_MD_CTX_create();
+                        if (!mac_ctx)
+                                goto err;
+                        s->write_hash = mac_ctx;
+                        }
+                else
+                        mac_ctx = ssl_replace_hash(&s->write_hash,NULL);
 #ifndef OPENSSL_NO_COMP
                 if (s->compress != NULL)
                         {
@@ -667,12 +672,21 @@ err:
         return(ret);
         }
 
+/* tls1_enc encrypts/decrypts the record in |s->wrec| / |s->rrec|, respectively.
+ *
+ * Returns:
+ *   0: (in non-constant time) if the record is publically invalid (i.e. too
+ *       short etc).
+ *   1: if the record's padding is valid / the encryption was successful.
+ *   -1: if the record's padding/AEAD-authenticator is invalid or, if sending,
+ *       an internal error occured.
+ */
 int tls1_enc(SSL *s, int send)
         {
         SSL3_RECORD *rec;
         EVP_CIPHER_CTX *ds;
         unsigned long l;
-        int bs,i,ii,j,k,pad=0;
+        int bs,i,j,k,pad=0,ret,mac_size=0;
         const EVP_CIPHER *enc;
 
         if (send)
@@ -729,11 +743,11 @@ int tls1_enc(SSL *s, int send)
         printf("tls1_enc(%d)\n", send);
 #endif    /* KSSL_DEBUG */
 
-        if ((s->session == NULL) || (ds == NULL) ||
-                (enc == NULL))
+        if ((s->session == NULL) || (ds == NULL) || (enc == NULL))
                 {
                 memmove(rec->data,rec->input,rec->length);
                 rec->input=rec->data;
+                ret = 1;
                 }
         else
                 {
@@ -797,13 +811,13 @@ int tls1_enc(SSL *s, int send)
 
 #ifdef KSSL_DEBUG
                 {
-                unsigned long ui;
+                unsigned long ui;
                 printf("EVP_Cipher(ds=%p,rec->data=%p,rec->input=%p,l=%ld) ==>\n",
-                        ds,rec->data,rec->input,l);
+                        ds,rec->data,rec->input,l);
                 printf("\tEVP_CIPHER_CTX: %d buf_len, %d key_len [%d %d], %d iv_len\n",
-                        ds->buf_len, ds->cipher->key_len,
-                        DES_KEY_SZ, DES_SCHEDULE_SZ,
-                        ds->cipher->iv_len);
+                        ds->buf_len, ds->cipher->key_len,
+                        DES_KEY_SZ, DES_SCHEDULE_SZ,
+                        ds->cipher->iv_len);
                 printf("\t\tIV: ");
                 for (i=0; i<ds->cipher->iv_len; i++) printf("%02X", ds->iv[i]);
                 printf("\n");
@@ -816,13 +830,7 @@ int tls1_enc(SSL *s, int send)
                 if (!send)
                         {
                         if (l == 0 || l%bs != 0)
-                                {
-                                if (s->version >= TLS1_1_VERSION)
-                                        return -1;
-                                SSLerr(SSL_F_TLS1_ENC,SSL_R_BLOCK_CIPHER_PAD_IS_WRONG);
-                                ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECRYPTION_FAILED);
                                 return 0;
-                                }
                         }
                 
                 i = EVP_Cipher(ds,rec->data,rec->input,l);
@@ -839,68 +847,24 @@ int tls1_enc(SSL *s, int send)
 
 #ifdef KSSL_DEBUG
                 {
-                unsigned long i;
-                printf("\trec->data=");
+                unsigned long i;
+                printf("\trec->data=");
                 for (i=0; i<l; i++)
-                        printf(" %02x", rec->data[i]);  printf("\n");
-                }
+                        printf(" %02x", rec->data[i]);  printf("\n");
+                }
 #endif  /* KSSL_DEBUG */
 
+                ret = 1;
+                if (EVP_MD_CTX_md(s->read_hash) != NULL)
+                        mac_size = EVP_MD_CTX_size(s->read_hash);
                 if ((bs != 1) && !send)
-                        {
-                        ii=i=rec->data[l-1]; /* padding_length */
-                        i++;
-                        /* NB: if compression is in operation the first packet
-                         * may not be of even length so the padding bug check
-                         * cannot be performed. This bug workaround has been
-                         * around since SSLeay so hopefully it is either fixed
-                         * now or no buggy implementation supports compression 
-                         * [steve]
-                         */
-                        if ( (s->options&SSL_OP_TLS_BLOCK_PADDING_BUG)
-                                && !s->expand)
-                                {
-                                /* First packet is even in size, so check */
-                                if ((memcmp(s->s3->read_sequence,
-                                        "\0\0\0\0\0\0\0\0",8) == 0) && !(ii & 1))
-                                        s->s3->flags|=TLS1_FLAGS_TLS_PADDING_BUG;
-                                if (s->s3->flags & TLS1_FLAGS_TLS_PADDING_BUG)
-                                        i--;
-                                }
-                        /* TLS 1.0 does not bound the number of padding bytes by the block size.
-                         * All of them must have value 'padding_length'. */
-                        if (i > (int)rec->length)
-                                {
-                                /* Incorrect padding. SSLerr() and ssl3_alert are done
-                                 * by caller: we don't want to reveal whether this is
-                                 * a decryption error or a MAC verification failure
-                                 * (see http://www.openssl.org/~bodo/tls-cbc.txt) */
-                                return -1;
-                                }
-                        for (j=(int)(l-i); j<(int)l; j++)
-                                {
-                                if (rec->data[j] != ii)
-                                        {
-                                        /* Incorrect padding */
-                                        return -1;
-                                        }
-                                }
-                        rec->length -=i;
-                        if (s->version >= TLS1_1_VERSION
-                                && EVP_CIPHER_CTX_mode(ds) == EVP_CIPH_CBC_MODE)
-                                {
-                                if (bs > (int)rec->length)
-                                        return -1;
-                                rec->data += bs;    /* skip the explicit IV */
-                                rec->input += bs;
-                                rec->length -= bs;
-                                }
-                        }
+                        ret = tls1_cbc_remove_padding(s, rec, bs, mac_size);
                 if (pad && !send)
                         rec->length -= pad;
                 }
-        return(1);
+        return ret;
         }
+
 int tls1_cert_verify_mac(SSL *s, int md_nid, unsigned char *out)
         {
         unsigned int ret;
@@ -956,18 +920,19 @@ int tls1_final_finish_mac(SSL *s,
                 if (mask & ssl_get_algorithm2(s))
                         {
                         int hashsize = EVP_MD_size(md);
-                        if (hashsize < 0 || hashsize > (int)(sizeof buf - (size_t)(q-buf)))
+                        EVP_MD_CTX *hdgst = s->s3->handshake_dgst[idx];
+                        if (!hdgst || hashsize < 0 || hashsize > (int)(sizeof buf - (size_t)(q-buf)))
                                 {
                                 /* internal error: 'buf' is too small for this cipersuite! */
                                 err = 1;
                                 }
                         else
                                 {
-                                EVP_MD_CTX_copy_ex(&ctx,s->s3->handshake_dgst[idx]);
-                                EVP_DigestFinal_ex(&ctx,q,&i);
-                                if (i != (unsigned int)hashsize) /* can't really happen */
+                                if (!EVP_MD_CTX_copy_ex(&ctx, hdgst) ||
+                                        !EVP_DigestFinal_ex(&ctx,q,&i) ||
+                                        (i != (unsigned int)hashsize))
                                         err = 1;
-                                q+=i;
+                                q+=hashsize;
                                 }
                         }
                 }
@@ -990,10 +955,10 @@ int tls1_mac(SSL *ssl, unsigned char *md, int send)
         SSL3_RECORD *rec;
         unsigned char *seq;
         EVP_MD_CTX *hash;
-        size_t md_size;
+        size_t md_size, orig_len;
         int i;
         EVP_MD_CTX hmac, *mac_ctx;
-        unsigned char buf[5]; 
+        unsigned char header[13];
         int stream_mac = (send?(ssl->mac_flags & SSL_MAC_FLAG_WRITE_MAC_STREAM):(ssl->mac_flags&SSL_MAC_FLAG_READ_MAC_STREAM));
         int t;
 
@@ -1014,12 +979,6 @@ int tls1_mac(SSL *ssl, unsigned char *md, int send)
         OPENSSL_assert(t >= 0);
         md_size=t;
 
-        buf[0]=rec->type;
-        buf[1]=(unsigned char)(ssl->version>>8);
-        buf[2]=(unsigned char)(ssl->version);
-        buf[3]=rec->length>>8;
-        buf[4]=rec->length&0xff;
-
         /* I should fix this up TLS TLS TLS TLS TLS XXXXXXXX */
         if (stream_mac) 
                 {
@@ -1027,7 +986,8 @@ int tls1_mac(SSL *ssl, unsigned char *md, int send)
                 }
                 else
                 {
-                        EVP_MD_CTX_copy(&hmac,hash);
+                        if (!EVP_MD_CTX_copy(&hmac,hash))
+                                return -1;
                         mac_ctx = &hmac;
                 }
 
@@ -1038,17 +998,55 @@ int tls1_mac(SSL *ssl, unsigned char *md, int send)
                 s2n(send?ssl->d1->w_epoch:ssl->d1->r_epoch, p);
                 memcpy (p,&seq[2],6);
 
-                EVP_DigestSignUpdate(mac_ctx,dtlsseq,8);
+                memcpy(header, dtlsseq, 8);
                 }
         else
-                EVP_DigestSignUpdate(mac_ctx,seq,8);
+                memcpy(header, seq, 8);
+
+        /* kludge: tls1_cbc_remove_padding passes padding length in rec->type */
+        orig_len = rec->length+md_size+((unsigned int)rec->type>>8);
+        rec->type &= 0xff;
 
-        EVP_DigestSignUpdate(mac_ctx,buf,5);
-        EVP_DigestSignUpdate(mac_ctx,rec->input,rec->length);
-        t=EVP_DigestSignFinal(mac_ctx,md,&md_size);
-        OPENSSL_assert(t > 0);
+        header[8]=rec->type;
+        header[9]=(unsigned char)(ssl->version>>8);
+        header[10]=(unsigned char)(ssl->version);
+        header[11]=(rec->length)>>8;
+        header[12]=(rec->length)&0xff;
+
+        if (!send &&
+            EVP_CIPHER_CTX_mode(ssl->enc_read_ctx) == EVP_CIPH_CBC_MODE &&
+            ssl3_cbc_record_digest_supported(mac_ctx))
+                {
+                /* This is a CBC-encrypted record. We must avoid leaking any
+                 * timing-side channel information about how many blocks of
+                 * data we are hashing because that gives an attacker a
+                 * timing-oracle. */
+                ssl3_cbc_digest_record(
+                        mac_ctx,
+                        md, &md_size,
+                        header, rec->input,
+                        rec->length + md_size, orig_len,
+                        ssl->s3->read_mac_secret,
+                        ssl->s3->read_mac_secret_size,
+                        0 /* not SSLv3 */);
+                }
+        else
+                {
+                EVP_DigestSignUpdate(mac_ctx,header,sizeof(header));
+                EVP_DigestSignUpdate(mac_ctx,rec->input,rec->length);
+                t=EVP_DigestSignFinal(mac_ctx,md,&md_size);
+                OPENSSL_assert(t > 0);
+#ifdef OPENSSL_FIPS
+                if (!send && FIPS_mode())
+                        tls_fips_digest_extra(
+                                        ssl->enc_read_ctx,
+                                        mac_ctx, rec->input,
+                                        rec->length, orig_len);
+#endif
+                }
                 
-        if (!stream_mac) EVP_MD_CTX_cleanup(&hmac);
+        if (!stream_mac)
+                EVP_MD_CTX_cleanup(&hmac);
 #ifdef TLS_DEBUG
 printf("sec=");
 {unsigned int z; for (z=0; z<md_size; z++) printf("%02X ",mac_sec[z]); printf("\n"); }
diff --git a/src/lib/libssl/t1_lib.c b/src/lib/libssl/t1_lib.c
index 27c8e3460d..bddffd92cc 100644
--- a/src/lib/libssl/t1_lib.c
+++ b/src/lib/libssl/t1_lib.c
@@ -342,19 +342,11 @@ static unsigned char tls12_sigalgs[] = {
 #ifndef OPENSSL_NO_SHA
         tlsext_sigalg(TLSEXT_hash_sha1)
 #endif
-#ifndef OPENSSL_NO_MD5
-        tlsext_sigalg_rsa(TLSEXT_hash_md5)
-#endif
 };
 
 int tls12_get_req_sig_algs(SSL *s, unsigned char *p)
         {
         size_t slen = sizeof(tls12_sigalgs);
-#ifdef OPENSSL_FIPS
-        /* If FIPS mode don't include MD5 which is last */
-        if (FIPS_mode())
-                slen -= 2;
-#endif
         if (p)
                 memcpy(p, tls12_sigalgs, slen);
         return (int)slen;
@@ -649,6 +641,7 @@ unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned cha
                 }
 #endif
 
+#ifndef OPENSSL_NO_SRTP
         if(SSL_get_srtp_profiles(s))
                 {
                 int el;
@@ -667,6 +660,37 @@ unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned cha
                         }
                 ret += el;
                 }
+#endif
+
+#ifdef TLSEXT_TYPE_padding
+        /* Add padding to workaround bugs in F5 terminators.
+         * See https://tools.ietf.org/html/draft-agl-tls-padding-03
+         *
+         * NB: because this code works out the length of all existing
+         * extensions it MUST always appear last.
+         */
+        {
+        int hlen = ret - (unsigned char *)s->init_buf->data;
+        /* The code in s23_clnt.c to build ClientHello messages includes the
+         * 5-byte record header in the buffer, while the code in s3_clnt.c does
+         * not. */
+        if (s->state == SSL23_ST_CW_CLNT_HELLO_A)
+                hlen -= 5;
+        if (hlen > 0xff && hlen < 0x200)
+                {
+                hlen = 0x200 - hlen;
+                if (hlen >= 4)
+                        hlen -= 4;
+                else
+                        hlen = 0;
+
+                s2n(TLSEXT_TYPE_padding, ret);
+                s2n(hlen, ret);
+                memset(ret, 0, hlen);
+                ret += hlen;
+                }
+        }
+#endif
 
         if ((extdatalen = ret-p-2)== 0) 
                 return p;
@@ -781,6 +805,7 @@ unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned cha
                 }
 #endif
 
+#ifndef OPENSSL_NO_SRTP
         if(s->srtp_profile)
                 {
                 int el;
@@ -799,6 +824,7 @@ unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned cha
                         }
                 ret+=el;
                 }
+#endif
 
         if (((s->s3->tmp.new_cipher->id & 0xFFFF)==0x80 || (s->s3->tmp.new_cipher->id & 0xFFFF)==0x81) 
                 && (SSL_get_options(s) & SSL_OP_CRYPTOPRO_TLSEXT_BUG))
@@ -862,6 +888,89 @@ unsigned char *ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned cha
         return ret;
         }
 
+#ifndef OPENSSL_NO_EC
+/* ssl_check_for_safari attempts to fingerprint Safari using OS X
+ * SecureTransport using the TLS extension block in |d|, of length |n|.
+ * Safari, since 10.6, sends exactly these extensions, in this order:
+ *   SNI,
+ *   elliptic_curves
+ *   ec_point_formats
+ *
+ * We wish to fingerprint Safari because they broke ECDHE-ECDSA support in 10.8,
+ * but they advertise support. So enabling ECDHE-ECDSA ciphers breaks them.
+ * Sadly we cannot differentiate 10.6, 10.7 and 10.8.4 (which work), from
+ * 10.8..10.8.3 (which don't work).
+ */
+static void ssl_check_for_safari(SSL *s, const unsigned char *data, const unsigned char *d, int n) {
+        unsigned short type, size;
+        static const unsigned char kSafariExtensionsBlock[] = {
+                0x00, 0x0a,  /* elliptic_curves extension */
+                0x00, 0x08,  /* 8 bytes */
+                0x00, 0x06,  /* 6 bytes of curve ids */
+                0x00, 0x17,  /* P-256 */
+                0x00, 0x18,  /* P-384 */
+                0x00, 0x19,  /* P-521 */
+
+                0x00, 0x0b,  /* ec_point_formats */
+                0x00, 0x02,  /* 2 bytes */
+                0x01,        /* 1 point format */
+                0x00,        /* uncompressed */
+        };
+
+        /* The following is only present in TLS 1.2 */
+        static const unsigned char kSafariTLS12ExtensionsBlock[] = {
+                0x00, 0x0d,  /* signature_algorithms */
+                0x00, 0x0c,  /* 12 bytes */
+                0x00, 0x0a,  /* 10 bytes */
+                0x05, 0x01,  /* SHA-384/RSA */
+                0x04, 0x01,  /* SHA-256/RSA */
+                0x02, 0x01,  /* SHA-1/RSA */
+                0x04, 0x03,  /* SHA-256/ECDSA */
+                0x02, 0x03,  /* SHA-1/ECDSA */
+        };
+
+        if (data >= (d+n-2))
+                return;
+        data += 2;
+
+        if (data > (d+n-4))
+                return;
+        n2s(data,type);
+        n2s(data,size);
+
+        if (type != TLSEXT_TYPE_server_name)
+                return;
+
+        if (data+size > d+n)
+                return;
+        data += size;
+
+        if (TLS1_get_client_version(s) >= TLS1_2_VERSION)
+                {
+                const size_t len1 = sizeof(kSafariExtensionsBlock);
+                const size_t len2 = sizeof(kSafariTLS12ExtensionsBlock);
+
+                if (data + len1 + len2 != d+n)
+                        return;
+                if (memcmp(data, kSafariExtensionsBlock, len1) != 0)
+                        return;
+                if (memcmp(data + len1, kSafariTLS12ExtensionsBlock, len2) != 0)
+                        return;
+                }
+        else
+                {
+                const size_t len = sizeof(kSafariExtensionsBlock);
+
+                if (data + len != d+n)
+                        return;
+                if (memcmp(data, kSafariExtensionsBlock, len) != 0)
+                        return;
+                }
+
+        s->s3->is_probably_safari = 1;
+}
+#endif /* !OPENSSL_NO_EC */
+
 int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al)
         {
         unsigned short type;
@@ -882,6 +991,11 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
                                SSL_TLSEXT_HB_DONT_SEND_REQUESTS);
 #endif
 
+#ifndef OPENSSL_NO_EC
+        if (s->options & SSL_OP_SAFARI_ECDHE_ECDSA_BUG)
+                ssl_check_for_safari(s, data, d, n);
+#endif /* !OPENSSL_NO_EC */
+
         if (data >= (d+n-2))
                 goto ri_check;
         n2s(data,len);
@@ -1077,7 +1191,8 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
                         int ellipticcurvelist_length = (*(sdata++) << 8);
                         ellipticcurvelist_length += (*(sdata++));
 
-                        if (ellipticcurvelist_length != size - 2)
+                        if (ellipticcurvelist_length != size - 2 ||
+                                ellipticcurvelist_length < 1)
                                 {
                                 *al = TLS1_AD_DECODE_ERROR;
                                 return 0;
@@ -1176,7 +1291,7 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
                                 }
                         }
                 else if (type == TLSEXT_TYPE_status_request &&
-                         s->version != DTLS1_VERSION && s->ctx->tlsext_status_cb)
+                         s->version != DTLS1_VERSION)
                         {
                 
                         if (size < 5) 
@@ -1328,12 +1443,14 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
 #endif
 
                 /* session ticket processed earlier */
+#ifndef OPENSSL_NO_SRTP
                 else if (type == TLSEXT_TYPE_use_srtp)
-                        {
+                        {
                         if(ssl_parse_clienthello_use_srtp_ext(s, data, size,
                                                               al))
                                 return 0;
-                        }
+                        }
+#endif
 
                 data+=size;
                 }
@@ -1433,7 +1550,8 @@ int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
                         unsigned char *sdata = data;
                         int ecpointformatlist_length = *(sdata++);
 
-                        if (ecpointformatlist_length != size - 1)
+                        if (ecpointformatlist_length != size - 1 || 
+                                ecpointformatlist_length < 1)
                                 {
                                 *al = TLS1_AD_DECODE_ERROR;
                                 return 0;
@@ -1527,7 +1645,7 @@ int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
                         unsigned char selected_len;
 
                         /* We must have requested it. */
-                        if ((s->ctx->next_proto_select_cb == NULL))
+                        if (s->ctx->next_proto_select_cb == NULL)
                                 {
                                 *al = TLS1_AD_UNSUPPORTED_EXTENSION;
                                 return 0;
@@ -1577,12 +1695,14 @@ int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
                                 }
                         }
 #endif
+#ifndef OPENSSL_NO_SRTP
                 else if (type == TLSEXT_TYPE_use_srtp)
-                        {
+                        {
                         if(ssl_parse_serverhello_use_srtp_ext(s, data, size,
                                                               al))
                                 return 0;
-                        }
+                        }
+#endif
 
                 data+=size;             
                 }
@@ -1763,7 +1883,7 @@ int ssl_prepare_serverhello_tlsext(SSL *s)
         return 1;
         }
 
-int ssl_check_clienthello_tlsext(SSL *s)
+int ssl_check_clienthello_tlsext_early(SSL *s)
         {
         int ret=SSL_TLSEXT_ERR_NOACK;
         int al = SSL_AD_UNRECOGNIZED_NAME;
@@ -1782,42 +1902,12 @@ int ssl_check_clienthello_tlsext(SSL *s)
         else if (s->initial_ctx != NULL && s->initial_ctx->tlsext_servername_callback != 0)             
                 ret = s->initial_ctx->tlsext_servername_callback(s, &al, s->initial_ctx->tlsext_servername_arg);
 
-        /* If status request then ask callback what to do.
-         * Note: this must be called after servername callbacks in case 
-         * the certificate has changed.
-         */
-        if ((s->tlsext_status_type != -1) && s->ctx && s->ctx->tlsext_status_cb)
-                {
-                int r;
-                r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
-                switch (r)
-                        {
-                        /* We don't want to send a status request response */
-                        case SSL_TLSEXT_ERR_NOACK:
-                                s->tlsext_status_expected = 0;
-                                break;
-                        /* status request response should be sent */
-                        case SSL_TLSEXT_ERR_OK:
-                                if (s->tlsext_ocsp_resp)
-                                        s->tlsext_status_expected = 1;
-                                else
-                                        s->tlsext_status_expected = 0;
-                                break;
-                        /* something bad happened */
-                        case SSL_TLSEXT_ERR_ALERT_FATAL:
-                                ret = SSL_TLSEXT_ERR_ALERT_FATAL;
-                                al = SSL_AD_INTERNAL_ERROR;
-                                goto err;
-                        }
-                }
-        else
-                s->tlsext_status_expected = 0;
-
 #ifdef TLSEXT_TYPE_opaque_prf_input
         {
                 /* This sort of belongs into ssl_prepare_serverhello_tlsext(),
                  * but we might be sending an alert in response to the client hello,
-                 * so this has to happen here in ssl_check_clienthello_tlsext(). */
+                 * so this has to happen here in
+                 * ssl_check_clienthello_tlsext_early(). */
 
                 int r = 1;
         
@@ -1869,8 +1959,8 @@ int ssl_check_clienthello_tlsext(SSL *s)
                         }
         }
 
-#endif
  err:
+#endif
         switch (ret)
                 {
                 case SSL_TLSEXT_ERR_ALERT_FATAL:
@@ -1888,6 +1978,71 @@ int ssl_check_clienthello_tlsext(SSL *s)
                 }
         }
 
+int ssl_check_clienthello_tlsext_late(SSL *s)
+        {
+        int ret = SSL_TLSEXT_ERR_OK;
+        int al;
+
+        /* If status request then ask callback what to do.
+         * Note: this must be called after servername callbacks in case 
+         * the certificate has changed, and must be called after the cipher
+         * has been chosen because this may influence which certificate is sent
+         */
+        if ((s->tlsext_status_type != -1) && s->ctx && s->ctx->tlsext_status_cb)
+                {
+                int r;
+                CERT_PKEY *certpkey;
+                certpkey = ssl_get_server_send_pkey(s);
+                /* If no certificate can't return certificate status */
+                if (certpkey == NULL)
+                        {
+                        s->tlsext_status_expected = 0;
+                        return 1;
+                        }
+                /* Set current certificate to one we will use so
+                 * SSL_get_certificate et al can pick it up.
+                 */
+                s->cert->key = certpkey;
+                r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
+                switch (r)
+                        {
+                        /* We don't want to send a status request response */
+                        case SSL_TLSEXT_ERR_NOACK:
+                                s->tlsext_status_expected = 0;
+                                break;
+                        /* status request response should be sent */
+                        case SSL_TLSEXT_ERR_OK:
+                                if (s->tlsext_ocsp_resp)
+                                        s->tlsext_status_expected = 1;
+                                else
+                                        s->tlsext_status_expected = 0;
+                                break;
+                        /* something bad happened */
+                        case SSL_TLSEXT_ERR_ALERT_FATAL:
+                                ret = SSL_TLSEXT_ERR_ALERT_FATAL;
+                                al = SSL_AD_INTERNAL_ERROR;
+                                goto err;
+                        }
+                }
+        else
+                s->tlsext_status_expected = 0;
+
+ err:
+        switch (ret)
+                {
+                case SSL_TLSEXT_ERR_ALERT_FATAL:
+                        ssl3_send_alert(s,SSL3_AL_FATAL,al); 
+                        return -1;
+
+                case SSL_TLSEXT_ERR_ALERT_WARNING:
+                        ssl3_send_alert(s,SSL3_AL_WARNING,al);
+                        return 1; 
+
+                default:
+                        return 1;
+                }
+        }
+
 int ssl_check_serverhello_tlsext(SSL *s)
         {
         int ret=SSL_TLSEXT_ERR_NOACK;
@@ -2189,7 +2344,7 @@ static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
         HMAC_Update(&hctx, etick, eticklen);
         HMAC_Final(&hctx, tick_hmac, NULL);
         HMAC_CTX_cleanup(&hctx);
-        if (memcmp(tick_hmac, etick + eticklen, mlen))
+        if (CRYPTO_memcmp(tick_hmac, etick + eticklen, mlen))
                 return 2;
         /* Attempt to decrypt session data */
         /* Move p after IV to start of encrypted ticket, update length */
@@ -2319,14 +2474,6 @@ const EVP_MD *tls12_get_hash(unsigned char hash_alg)
         {
         switch(hash_alg)
                 {
-#ifndef OPENSSL_NO_MD5
-                case TLSEXT_hash_md5:
-#ifdef OPENSSL_FIPS
-                if (FIPS_mode())
-                        return NULL;
-#endif
-                return EVP_md5();
-#endif
 #ifndef OPENSSL_NO_SHA
                 case TLSEXT_hash_sha1:
                 return EVP_sha1();
@@ -2414,7 +2561,7 @@ int tls1_process_sigalgs(SSL *s, const unsigned char *data, int dsize)
          */
 #ifndef OPENSSL_NO_DSA
         if (!c->pkeys[SSL_PKEY_DSA_SIGN].digest)
-                c->pkeys[SSL_PKEY_DSA_SIGN].digest = EVP_dss1();
+                c->pkeys[SSL_PKEY_DSA_SIGN].digest = EVP_sha1();
 #endif
 #ifndef OPENSSL_NO_RSA
         if (!c->pkeys[SSL_PKEY_RSA_SIGN].digest)
@@ -2425,7 +2572,7 @@ int tls1_process_sigalgs(SSL *s, const unsigned char *data, int dsize)
 #endif
 #ifndef OPENSSL_NO_ECDSA
         if (!c->pkeys[SSL_PKEY_ECC].digest)
-                c->pkeys[SSL_PKEY_ECC].digest = EVP_ecdsa();
+                c->pkeys[SSL_PKEY_ECC].digest = EVP_sha1();
 #endif
         return 1;
         }
@@ -2441,16 +2588,20 @@ tls1_process_heartbeat(SSL *s)
         unsigned int payload;
         unsigned int padding = 16; /* Use minimum padding */
 
-        /* Read type and payload length first */
-        hbtype = *p++;
-        n2s(p, payload);
-        pl = p;
-
         if (s->msg_callback)
                 s->msg_callback(0, s->version, TLS1_RT_HEARTBEAT,
                         &s->s3->rrec.data[0], s->s3->rrec.length,
                         s, s->msg_callback_arg);
 
+        /* Read type and payload length first */
+        if (1 + 2 + 16 > s->s3->rrec.length)
+                return 0; /* silently discard */
+        hbtype = *p++;
+        n2s(p, payload);
+        if (1 + 2 + payload + 16 > s->s3->rrec.length)
+                return 0; /* silently discard per RFC 6520 sec. 4 */
+        pl = p;
+
         if (hbtype == TLS1_HB_REQUEST)
                 {
                 unsigned char *buffer, *bp;
diff --git a/src/lib/libssl/test/cms-test.pl b/src/lib/libssl/test/cms-test.pl
index c938bcf00d..dfef799be2 100644
--- a/src/lib/libssl/test/cms-test.pl
+++ b/src/lib/libssl/test/cms-test.pl
@@ -415,8 +415,10 @@ sub run_smime_tests {
 }
 
 sub cmp_files {
+    use FileHandle;
     my ( $f1, $f2 ) = @_;
-    my ( $fp1, $fp2 );
+    my $fp1 = FileHandle->new();
+    my $fp2 = FileHandle->new();
 
     my ( $rd1, $rd2 );
 
diff --git a/src/lib/libssl/test/testssl b/src/lib/libssl/test/testssl
index 5ae4dc8720..4e8542b556 100644
--- a/src/lib/libssl/test/testssl
+++ b/src/lib/libssl/test/testssl
@@ -119,6 +119,23 @@ $ssltest -bio_pair -server_auth -client_auth $CA $extra || exit 1
 echo test sslv2/sslv3 with both client and server authentication via BIO pair and app verify
 $ssltest -bio_pair -server_auth -client_auth -app_verify $CA $extra || exit 1
 
+echo "Testing ciphersuites"
+for protocol in TLSv1.2 SSLv3; do
+  echo "Testing ciphersuites for $protocol"
+  for cipher in `../util/shlib_wrap.sh ../apps/openssl ciphers "RSA+$protocol" | tr ':' ' '`; do
+    echo "Testing $cipher"
+    prot=""
+    if [ $protocol = "SSLv3" ] ; then
+      prot="-ssl3"
+    fi
+    $ssltest -cipher $cipher $prot
+    if [ $? -ne 0 ] ; then
+          echo "Failed $cipher"
+          exit 1
+    fi
+  done
+done
+
 #############################################################################
 
 if ../util/shlib_wrap.sh ../apps/openssl no-dh; then
diff --git a/src/lib/libssl/tls1.h b/src/lib/libssl/tls1.h
index c39c267f0b..c992091e30 100644
--- a/src/lib/libssl/tls1.h
+++ b/src/lib/libssl/tls1.h
@@ -230,6 +230,12 @@ extern "C" {
 /* ExtensionType value from RFC5620 */
 #define TLSEXT_TYPE_heartbeat   15
 
+/* ExtensionType value for TLS padding extension.
+ * http://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml
+ * http://tools.ietf.org/html/draft-agl-tls-padding-03
+ */
+#define TLSEXT_TYPE_padding     21
+
 /* ExtensionType value from RFC4507 */
 #define TLSEXT_TYPE_session_ticket              35