26 files changed, 191 insertions, 86 deletions
diff --git a/src/lib/libcrypto/bio/bf_buff.c b/src/lib/libcrypto/bio/bf_buff.c
index c1fd75aaad..4b5a132d8a 100644
--- a/src/lib/libcrypto/bio/bf_buff.c
+++ b/src/lib/libcrypto/bio/bf_buff.c
@@ -209,7 +209,7 @@ start:
        /* add to buffer and return */
        if (i >= inl)
                {
-                memcpy(&(ctx->obuf[ctx->obuf_len]),in,inl);
+                memcpy(&(ctx->obuf[ctx->obuf_off+ctx->obuf_len]),in,inl);
                ctx->obuf_len+=inl;
                return(num+inl);
                }
@@ -219,7 +219,7 @@ start:
                {
                if (i > 0) /* lets fill it up if we can */
                        {
-                        memcpy(&(ctx->obuf[ctx->obuf_len]),in,i);
+                        memcpy(&(ctx->obuf[ctx->obuf_off+ctx->obuf_len]),in,i);
                        in+=i;
                        inl-=i;
                        num+=i;
@@ -294,9 +294,9 @@ static long buffer_ctrl(BIO *b, int cmd, long num, void *ptr)
        case BIO_C_GET_BUFF_NUM_LINES:
                ret=0;
                p1=ctx->ibuf;
-                for (i=ctx->ibuf_off; i<ctx->ibuf_len; i++)
+                for (i=0; i<ctx->ibuf_len; i++)
                        {
-                        if (p1[i] == '\n') ret++;
+                        if (p1[ctx->ibuf_off + i] == '\n') ret++;
                        }
                break;
        case BIO_CTRL_WPENDING:
@@ -399,17 +399,18 @@ static long buffer_ctrl(BIO *b, int cmd, long num, void *ptr)
                for (;;)
                        {
                        BIO_clear_retry_flags(b);
-                        if (ctx->obuf_len > ctx->obuf_off)
+                        if (ctx->obuf_len > 0)
                                {
                                r=BIO_write(b->next_bio,
                                        &(ctx->obuf[ctx->obuf_off]),
-                                        ctx->obuf_len-ctx->obuf_off);
+                                        ctx->obuf_len);
 #if 0
-fprintf(stderr,"FLUSH [%3d] %3d -> %3d\n",ctx->obuf_off,ctx->obuf_len-ctx->obuf_off,r);
+fprintf(stderr,"FLUSH [%3d] %3d -> %3d\n",ctx->obuf_off,ctx->obuf_len,r);
 #endif
                                BIO_copy_next_retry(b);
                                if (r <= 0) return((long)r);
                                ctx->obuf_off+=r;
+                                ctx->obuf_len-=r;
                                }
                        else
                                {
diff --git a/src/lib/libcrypto/bio/bio.h b/src/lib/libcrypto/bio/bio.h
index 152802fbdf..ab47abcf14 100644
--- a/src/lib/libcrypto/bio/bio.h
+++ b/src/lib/libcrypto/bio/bio.h
@@ -306,6 +306,15 @@ DECLARE_STACK_OF(BIO)
 typedef struct bio_f_buffer_ctx_struct
        {
+        /* Buffers are setup like this:
+         *
+         * <---------------------- size ----------------------->
+         * +---------------------------------------------------+
+         * | consumed | remaining          | free space        |
+         * +---------------------------------------------------+
+         * <-- off --><------- len ------->
+         */
        /* BIO *bio; */ /* this is now in the BIO struct */
        int ibuf_size;  /* how big is the input buffer */
        int obuf_size;  /* how big is the output buffer */
diff --git a/src/lib/libcrypto/bn/asm/ppc.pl b/src/lib/libcrypto/bn/asm/ppc.pl
index 37c65d3511..f4093177e6 100644
--- a/src/lib/libcrypto/bn/asm/ppc.pl
+++ b/src/lib/libcrypto/bn/asm/ppc.pl
@@ -949,7 +949,7 @@ $data=<<EOF;
        addze   r11,r0
                                        #mul_add_c(a[3],b[2],c3,c1,c2);
        $LD     r6,`3*$BNSZ`(r4)
-        $LD     r7,`2*$BNSZ`(r4)
+        $LD     r7,`2*$BNSZ`(r5)
        $UMULL  r8,r6,r7
        $UMULH  r9,r6,r7
        addc    r12,r8,r12
diff --git a/src/lib/libcrypto/bn/asm/x86-mont.pl b/src/lib/libcrypto/bn/asm/x86-mont.pl
index 5cd3cd2ed5..e8f6b05084 100755
--- a/src/lib/libcrypto/bn/asm/x86-mont.pl
+++ b/src/lib/libcrypto/bn/asm/x86-mont.pl
@@ -527,8 +527,10 @@ $sbit=$num;
        &jle    (&label("sqradd"));
        &mov    ($carry,"edx");
-        &lea    ("edx",&DWP(0,$sbit,"edx",2));
+        &add    ("edx","edx");
        &shr    ($carry,31);
+        &add    ("edx",$sbit);
+        &adc    ($carry,0);
 &set_label("sqrlast");
        &mov    ($word,$_n0);
        &mov    ($inp,$_np);
diff --git a/src/lib/libcrypto/bn/bn_blind.c b/src/lib/libcrypto/bn/bn_blind.c
index e060592fdc..9ed8bc2b40 100644
--- a/src/lib/libcrypto/bn/bn_blind.c
+++ b/src/lib/libcrypto/bn/bn_blind.c
@@ -126,7 +126,7 @@ struct bn_blinding_st
                                  * used only by crypto/rsa/rsa_eay.c, rsa_lib.c */
 #endif
        CRYPTO_THREADID tid;
-        unsigned int  counter;
+        int counter;
        unsigned long flags;
        BN_MONT_CTX *m_ctx;
        int (*bn_mod_exp)(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
@@ -160,7 +160,10 @@ BN_BLINDING *BN_BLINDING_new(const BIGNUM *A, const BIGNUM *Ai, BIGNUM *mod)
        if (BN_get_flags(mod, BN_FLG_CONSTTIME) != 0)
                BN_set_flags(ret->mod, BN_FLG_CONSTTIME);
-        ret->counter = BN_BLINDING_COUNTER;
+        /* Set the counter to the special value -1
+         * to indicate that this is never-used fresh blinding
+         * that does not need updating before first use. */
+        ret->counter = -1;
        CRYPTO_THREADID_current(&ret->tid);
        return(ret);
 err:
@@ -190,7 +193,10 @@ int BN_BLINDING_update(BN_BLINDING *b, BN_CTX *ctx)
                goto err;
                }
-        if (--(b->counter) == 0 && b->e != NULL &&
+        if (b->counter == -1)
+                b->counter = 0;
+        if (++b->counter == BN_BLINDING_COUNTER && b->e != NULL &&
                !(b->flags & BN_BLINDING_NO_RECREATE))
                {
                /* re-create blinding parameters */
@@ -205,8 +211,8 @@ int BN_BLINDING_update(BN_BLINDING *b, BN_CTX *ctx)
        ret=1;
 err:
-        if (b->counter == 0)
+        if (b->counter == BN_BLINDING_COUNTER)
-                b->counter = BN_BLINDING_COUNTER;
+                b->counter = 0;
        return(ret);
        }
@@ -227,6 +233,12 @@ int BN_BLINDING_convert_ex(BIGNUM *n, BIGNUM *r, BN_BLINDING *b, BN_CTX *ctx)
                return(0);
                }
+        if (b->counter == -1)
+                /* Fresh blinding, doesn't need updating. */
+                b->counter = 0;
+        else if (!BN_BLINDING_update(b,ctx))
+                return(0);
        if (r != NULL)
                {
                if (!BN_copy(r, b->Ai)) ret=0;
@@ -247,22 +259,19 @@ int BN_BLINDING_invert_ex(BIGNUM *n, const BIGNUM *r, BN_BLINDING *b, BN_CTX *ct
        int ret;
        bn_check_top(n);
-        if ((b->A == NULL) || (b->Ai == NULL))
-                {
-                BNerr(BN_F_BN_BLINDING_INVERT_EX,BN_R_NOT_INITIALIZED);
-                return(0);
-                }
        if (r != NULL)
                ret = BN_mod_mul(n, n, r, b->mod, ctx);
        else
-                ret = BN_mod_mul(n, n, b->Ai, b->mod, ctx);
-        if (ret >= 0)
                {
-                if (!BN_BLINDING_update(b,ctx))
+                if (b->Ai == NULL)
+                        {
+                        BNerr(BN_F_BN_BLINDING_INVERT_EX,BN_R_NOT_INITIALIZED);
                        return(0);
+                        }
+                ret = BN_mod_mul(n, n, b->Ai, b->mod, ctx);
                }
        bn_check_top(n);
        return(ret);
        }
diff --git a/src/lib/libcrypto/ec/ec2_smpl.c b/src/lib/libcrypto/ec/ec2_smpl.c
index af94458ca7..03deae6674 100644
--- a/src/lib/libcrypto/ec/ec2_smpl.c
+++ b/src/lib/libcrypto/ec/ec2_smpl.c
@@ -887,7 +887,7 @@ int ec_GF2m_simple_is_on_curve(const EC_GROUP *group, const EC_POINT *point, BN_
        field_sqr = group->meth->field_sqr;     
        /* only support affine coordinates */
-        if (!point->Z_is_one) goto err;
+        if (!point->Z_is_one) return -1;
        if (ctx == NULL)
                {
diff --git a/src/lib/libcrypto/opensslv.h b/src/lib/libcrypto/opensslv.h
index 310a3387be..d6d61a0c7d 100644
--- a/src/lib/libcrypto/opensslv.h
+++ b/src/lib/libcrypto/opensslv.h
@@ -25,11 +25,11 @@
 * (Prior to 0.9.5a beta1, a different scheme was used: MMNNFFRBB for
 *  major minor fix final patch/beta)
 */
-#define OPENSSL_VERSION_NUMBER  0x1000005fL
+#define OPENSSL_VERSION_NUMBER  0x1000006fL
 #ifdef OPENSSL_FIPS
-#define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.0e-fips 6 Sep 2011"
+#define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.0f-fips 4 Jan 2012"
 #else
-#define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.0e 6 Sep 2011"
+#define OPENSSL_VERSION_TEXT    "OpenSSL 1.0.0f 4 Jan 2012"
 #endif
 #define OPENSSL_VERSION_PTEXT   " part of " OPENSSL_VERSION_TEXT
diff --git a/src/lib/libcrypto/rsa/rsa_eay.c b/src/lib/libcrypto/rsa/rsa_eay.c
index 7c941885f0..2e1ddd48d3 100644
--- a/src/lib/libcrypto/rsa/rsa_eay.c
+++ b/src/lib/libcrypto/rsa/rsa_eay.c
@@ -314,51 +314,56 @@ static BN_BLINDING *rsa_get_blinding(RSA *rsa, int *local, BN_CTX *ctx)
        return ret;
 }
-static int rsa_blinding_convert(BN_BLINDING *b, int local, BIGNUM *f,
+static int rsa_blinding_convert(BN_BLINDING *b, BIGNUM *f, BIGNUM *unblind,
-        BIGNUM *r, BN_CTX *ctx)
+        BN_CTX *ctx)
-{
+        {
-        if (local)
+        if (unblind == NULL)
+                /* Local blinding: store the unblinding factor
+                 * in BN_BLINDING. */
                return BN_BLINDING_convert_ex(f, NULL, b, ctx);
        else
                {
-                int ret;
+                /* Shared blinding: store the unblinding factor
-                CRYPTO_r_lock(CRYPTO_LOCK_RSA_BLINDING);
+                 * outside BN_BLINDING. */
-                ret = BN_BLINDING_convert_ex(f, r, b, ctx);
-                CRYPTO_r_unlock(CRYPTO_LOCK_RSA_BLINDING);
-                return ret;
-                }
-}
-static int rsa_blinding_invert(BN_BLINDING *b, int local, BIGNUM *f,
-        BIGNUM *r, BN_CTX *ctx)
-{
-        if (local)
-                return BN_BLINDING_invert_ex(f, NULL, b, ctx);
-        else
-                {
                int ret;
                CRYPTO_w_lock(CRYPTO_LOCK_RSA_BLINDING);
-                ret = BN_BLINDING_invert_ex(f, r, b, ctx);
+                ret = BN_BLINDING_convert_ex(f, unblind, b, ctx);
                CRYPTO_w_unlock(CRYPTO_LOCK_RSA_BLINDING);
                return ret;
                }
-}
+        }
+static int rsa_blinding_invert(BN_BLINDING *b, BIGNUM *f, BIGNUM *unblind,
+        BN_CTX *ctx)
+        {
+        /* For local blinding, unblind is set to NULL, and BN_BLINDING_invert_ex
+         * will use the unblinding factor stored in BN_BLINDING.
+         * If BN_BLINDING is shared between threads, unblind must be non-null:
+         * BN_BLINDING_invert_ex will then use the local unblinding factor,
+         * and will only read the modulus from BN_BLINDING.
+         * In both cases it's safe to access the blinding without a lock.
+         */
+        return BN_BLINDING_invert_ex(f, unblind, b, ctx);
+        }
 /* signing */
 static int RSA_eay_private_encrypt(int flen, const unsigned char *from,
             unsigned char *to, RSA *rsa, int padding)
        {
-        BIGNUM *f, *ret, *br, *res;
+        BIGNUM *f, *ret, *res;
        int i,j,k,num=0,r= -1;
        unsigned char *buf=NULL;
        BN_CTX *ctx=NULL;
        int local_blinding = 0;
+        /* Used only if the blinding structure is shared. A non-NULL unblind
+         * instructs rsa_blinding_convert() and rsa_blinding_invert() to store
+         * the unblinding factor outside the blinding structure. */
+        BIGNUM *unblind = NULL;
        BN_BLINDING *blinding = NULL;
        if ((ctx=BN_CTX_new()) == NULL) goto err;
        BN_CTX_start(ctx);
        f   = BN_CTX_get(ctx);
-        br  = BN_CTX_get(ctx);
        ret = BN_CTX_get(ctx);
        num = BN_num_bytes(rsa->n);
        buf = OPENSSL_malloc(num);
@@ -406,8 +411,15 @@ static int RSA_eay_private_encrypt(int flen, const unsigned char *from,
                }
        
        if (blinding != NULL)
-                if (!rsa_blinding_convert(blinding, local_blinding, f, br, ctx))
+                {
+                if (!local_blinding && ((unblind = BN_CTX_get(ctx)) == NULL))
+                        {
+                        RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,ERR_R_MALLOC_FAILURE);
+                        goto err;
+                        }
+                if (!rsa_blinding_convert(blinding, f, unblind, ctx))
                        goto err;
+                }
        if ( (rsa->flags & RSA_FLAG_EXT_PKEY) ||
                ((rsa->p != NULL) &&
@@ -441,7 +453,7 @@ static int RSA_eay_private_encrypt(int flen, const unsigned char *from,
                }
        if (blinding)
-                if (!rsa_blinding_invert(blinding, local_blinding, ret, br, ctx))
+                if (!rsa_blinding_invert(blinding, ret, unblind, ctx))
                        goto err;
        if (padding == RSA_X931_PADDING)
@@ -480,18 +492,21 @@ err:
 static int RSA_eay_private_decrypt(int flen, const unsigned char *from,
             unsigned char *to, RSA *rsa, int padding)
        {
-        BIGNUM *f, *ret, *br;
+        BIGNUM *f, *ret;
        int j,num=0,r= -1;
        unsigned char *p;
        unsigned char *buf=NULL;
        BN_CTX *ctx=NULL;
        int local_blinding = 0;
+        /* Used only if the blinding structure is shared. A non-NULL unblind
+         * instructs rsa_blinding_convert() and rsa_blinding_invert() to store
+         * the unblinding factor outside the blinding structure. */
+        BIGNUM *unblind = NULL;
        BN_BLINDING *blinding = NULL;
        if((ctx = BN_CTX_new()) == NULL) goto err;
        BN_CTX_start(ctx);
        f   = BN_CTX_get(ctx);
-        br  = BN_CTX_get(ctx);
        ret = BN_CTX_get(ctx);
        num = BN_num_bytes(rsa->n);
        buf = OPENSSL_malloc(num);
@@ -529,8 +544,15 @@ static int RSA_eay_private_decrypt(int flen, const unsigned char *from,
                }
        
        if (blinding != NULL)
-                if (!rsa_blinding_convert(blinding, local_blinding, f, br, ctx))
+                {
+                if (!local_blinding && ((unblind = BN_CTX_get(ctx)) == NULL))
+                        {
+                        RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,ERR_R_MALLOC_FAILURE);
                        goto err;
+                        }
+                if (!rsa_blinding_convert(blinding, f, unblind, ctx))
+                        goto err;
+                }
        /* do the decrypt */
        if ( (rsa->flags & RSA_FLAG_EXT_PKEY) ||
@@ -564,7 +586,7 @@ static int RSA_eay_private_decrypt(int flen, const unsigned char *from,
                }
        if (blinding)
-                if (!rsa_blinding_invert(blinding, local_blinding, ret, br, ctx))
+                if (!rsa_blinding_invert(blinding, ret, unblind, ctx))
                        goto err;
        p=buf;
diff --git a/src/lib/libcrypto/util/mkerr.pl b/src/lib/libcrypto/util/mkerr.pl
index 2c99467d34..aec401c773 100644
--- a/src/lib/libcrypto/util/mkerr.pl
+++ b/src/lib/libcrypto/util/mkerr.pl
@@ -769,7 +769,7 @@ EOF
        undef %err_reason_strings;
 }
-if($debug && defined(%notrans)) {
+if($debug && %notrans) {
        print STDERR "The following function codes were not translated:\n";
        foreach(sort keys %notrans)
        {
diff --git a/src/lib/libcrypto/x509/x509_vfy.c b/src/lib/libcrypto/x509/x509_vfy.c
index 5a0b0249b4..701ec565e9 100644
--- a/src/lib/libcrypto/x509/x509_vfy.c
+++ b/src/lib/libcrypto/x509/x509_vfy.c
@@ -1732,7 +1732,7 @@ int X509_cmp_time(const ASN1_TIME *ctm, time_t *cmp_time)
        atm.length=sizeof(buff2);
        atm.data=(unsigned char *)buff2;
-        if (X509_time_adj(&atm,-offset*60, cmp_time) == NULL)
+        if (X509_time_adj(&atm, offset*60, cmp_time) == NULL)
                return 0;
        if (ctm->type == V_ASN1_UTCTIME)
diff --git a/src/lib/libssl/d1_both.c b/src/lib/libssl/d1_both.c
index 2180c6d4da..9f898d6997 100644
--- a/src/lib/libssl/d1_both.c
+++ b/src/lib/libssl/d1_both.c
@@ -158,7 +158,6 @@ static unsigned char bitmask_end_values[]   = {0xff, 0x01, 0x03, 0x07, 0x0f, 0x1
 /* XDTLS:  figure out the right values */
 static unsigned int g_probable_mtu[] = {1500 - 28, 512 - 28, 256 - 28};
-static unsigned int dtls1_min_mtu(void);
 static unsigned int dtls1_guess_mtu(unsigned int curr_mtu);
 static void dtls1_fix_message_header(SSL *s, unsigned long frag_off, 
        unsigned long frag_len);
@@ -264,11 +263,10 @@ int dtls1_do_write(SSL *s, int type)
                        return ret;
                mtu = s->d1->mtu - (DTLS1_HM_HEADER_LENGTH + DTLS1_RT_HEADER_LENGTH);
                }
-        OPENSSL_assert(mtu > 0);  /* should have something reasonable now */
 #endif
+        OPENSSL_assert(s->d1->mtu >= dtls1_min_mtu());  /* should have something reasonable now */
        if ( s->init_off == 0  && type == SSL3_RT_HANDSHAKE)
                OPENSSL_assert(s->init_num == 
                        (int)s->d1->w_msg_hdr.msg_len + DTLS1_HM_HEADER_LENGTH);
@@ -795,7 +793,13 @@ dtls1_get_message_fragment(SSL *s, int st1, int stn, long max, int *ok)
                *ok = 0;
                return i;
                }
-        OPENSSL_assert(i == DTLS1_HM_HEADER_LENGTH);
+        /* Handshake fails if message header is incomplete */
+        if (i != DTLS1_HM_HEADER_LENGTH)
+                {
+                al=SSL_AD_UNEXPECTED_MESSAGE;
+                SSLerr(SSL_F_DTLS1_GET_MESSAGE_FRAGMENT,SSL_R_UNEXPECTED_MESSAGE);
+                goto f_err;
+                }
        /* parse the message fragment header */
        dtls1_get_message_header(wire, &msg_hdr);
@@ -867,7 +871,12 @@ dtls1_get_message_fragment(SSL *s, int st1, int stn, long max, int *ok)
        /* XDTLS:  an incorrectly formatted fragment should cause the 
         * handshake to fail */
-        OPENSSL_assert(i == (int)frag_len);
+        if (i != (int)frag_len)
+                {
+                al=SSL3_AD_ILLEGAL_PARAMETER;
+                SSLerr(SSL_F_DTLS1_GET_MESSAGE_FRAGMENT,SSL3_AD_ILLEGAL_PARAMETER);
+                goto f_err;
+                }
        *ok = 1;
@@ -1367,7 +1376,7 @@ dtls1_write_message_header(SSL *s, unsigned char *p)
        return p;
        }
-static unsigned int 
+unsigned int 
 dtls1_min_mtu(void)
        {
        return (g_probable_mtu[(sizeof(g_probable_mtu) / 
diff --git a/src/lib/libssl/d1_lib.c b/src/lib/libssl/d1_lib.c
index 48e8b6ffbb..c3b77c889b 100644
--- a/src/lib/libssl/d1_lib.c
+++ b/src/lib/libssl/d1_lib.c
@@ -204,7 +204,8 @@ void dtls1_clear(SSL *s)
    pqueue buffered_messages;
        pqueue sent_messages;
        pqueue buffered_app_data;
-        
+        unsigned int mtu;
        if (s->d1)
                {
                unprocessed_rcds = s->d1->unprocessed_rcds.q;
@@ -212,6 +213,7 @@ void dtls1_clear(SSL *s)
                buffered_messages = s->d1->buffered_messages;
                sent_messages = s->d1->sent_messages;
                buffered_app_data = s->d1->buffered_app_data.q;
+                mtu = s->d1->mtu;
                dtls1_clear_queues(s);
@@ -222,6 +224,11 @@ void dtls1_clear(SSL *s)
                        s->d1->cookie_len = sizeof(s->d1->cookie);
                        }
+                if (SSL_get_options(s) & SSL_OP_NO_QUERY_MTU)
+                        {
+                        s->d1->mtu = mtu;
+                        }
                s->d1->unprocessed_rcds.q = unprocessed_rcds;
                s->d1->processed_rcds.q = processed_rcds;
                s->d1->buffered_messages = buffered_messages;
diff --git a/src/lib/libssl/d1_pkt.c b/src/lib/libssl/d1_pkt.c
index 39aac73e10..e0c0f0cc9a 100644
--- a/src/lib/libssl/d1_pkt.c
+++ b/src/lib/libssl/d1_pkt.c
@@ -375,6 +375,7 @@ dtls1_process_record(SSL *s)
        SSL3_RECORD *rr;
        unsigned int mac_size;
        unsigned char md[EVP_MAX_MD_SIZE];
+        int decryption_failed_or_bad_record_mac = 0;
        rr= &(s->s3->rrec);
@@ -409,13 +410,10 @@ dtls1_process_record(SSL *s)
        enc_err = s->method->ssl3_enc->enc(s,0);
        if (enc_err <= 0)
                {
-                /* decryption failed, silently discard message */
+                /* To minimize information leaked via timing, we will always
-                if (enc_err < 0)
+                 * perform all computations before discarding the message.
-                        {
+                 */
-                        rr->length = 0;
+                decryption_failed_or_bad_record_mac = 1;
-                        s->packet_length = 0;
-                        }
-                goto err;
                }
 #ifdef TLS_DEBUG
@@ -445,7 +443,7 @@ printf("\n");
                        SSLerr(SSL_F_DTLS1_PROCESS_RECORD,SSL_R_PRE_MAC_LENGTH_TOO_LONG);
                        goto f_err;
 #else
-                        goto err;
+                        decryption_failed_or_bad_record_mac = 1;
 #endif                  
                        }
                /* check the MAC for rr->input (it's in mac_size bytes at the tail) */
@@ -456,17 +454,25 @@ printf("\n");
                        SSLerr(SSL_F_DTLS1_PROCESS_RECORD,SSL_R_LENGTH_TOO_SHORT);
                        goto f_err;
 #else
-                        goto err;
+                        decryption_failed_or_bad_record_mac = 1;
 #endif
                        }
                rr->length-=mac_size;
                i=s->method->ssl3_enc->mac(s,md,0);
                if (i < 0 || memcmp(md,&(rr->data[rr->length]),mac_size) != 0)
                        {
-                        goto err;
+                        decryption_failed_or_bad_record_mac = 1;
                        }
                }
+        if (decryption_failed_or_bad_record_mac)
+                {
+                /* decryption failed, silently discard message */
+                rr->length = 0;
+                s->packet_length = 0;
+                goto err;
+                }
        /* r->length is now just compressed */
        if (s->expand != NULL)
                {
diff --git a/src/lib/libssl/d1_srvr.c b/src/lib/libssl/d1_srvr.c
index a6a4c87ea6..149983be30 100644
--- a/src/lib/libssl/d1_srvr.c
+++ b/src/lib/libssl/d1_srvr.c
@@ -1271,7 +1271,7 @@ int dtls1_send_server_key_exchange(SSL *s)
                                EVP_SignInit_ex(&md_ctx,EVP_ecdsa(), NULL);
                                EVP_SignUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
                                EVP_SignUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);
-                                EVP_SignUpdate(&md_ctx,&(d[4]),n);
+                                EVP_SignUpdate(&md_ctx,&(d[DTLS1_HM_HEADER_LENGTH]),n);
                                if (!EVP_SignFinal(&md_ctx,&(p[2]),
                                        (unsigned int *)&i,pkey))
                                        {
diff --git a/src/lib/libssl/doc/openssl.cnf b/src/lib/libssl/doc/openssl.cnf
index 9d2cd5bfa5..18760c6e67 100644
--- a/src/lib/libssl/doc/openssl.cnf
+++ b/src/lib/libssl/doc/openssl.cnf
@@ -145,7 +145,7 @@ localityName			= Locality Name (eg, city)
 organizationalUnitName          = Organizational Unit Name (eg, section)
 #organizationalUnitName_default =
-commonName                      = Common Name (eg, YOUR name)
+commonName                      = Common Name (e.g. server FQDN or YOUR name)
 commonName_max                  = 64
 emailAddress                    = Email Address
diff --git a/src/lib/libssl/s3_clnt.c b/src/lib/libssl/s3_clnt.c
index 50bd415b56..53223bd38d 100644
--- a/src/lib/libssl/s3_clnt.c
+++ b/src/lib/libssl/s3_clnt.c
@@ -953,7 +953,7 @@ int ssl3_get_server_hello(SSL *s)
                /* wrong packet length */
                al=SSL_AD_DECODE_ERROR;
                SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_BAD_PACKET_LENGTH);
-                goto err;
+                goto f_err;
                }
        return(1);
@@ -1837,7 +1837,7 @@ int ssl3_get_new_session_ticket(SSL *s)
        if (n < 6)
                {
                /* need at least ticket_lifetime_hint + ticket length */
-                al = SSL3_AL_FATAL,SSL_AD_DECODE_ERROR;
+                al = SSL_AD_DECODE_ERROR;
                SSLerr(SSL_F_SSL3_GET_NEW_SESSION_TICKET,SSL_R_LENGTH_MISMATCH);
                goto f_err;
                }
@@ -1848,7 +1848,7 @@ int ssl3_get_new_session_ticket(SSL *s)
        /* ticket_lifetime_hint + ticket_length + ticket */
        if (ticklen + 6 != n)
                {
-                al = SSL3_AL_FATAL,SSL_AD_DECODE_ERROR;
+                al = SSL_AD_DECODE_ERROR;
                SSLerr(SSL_F_SSL3_GET_NEW_SESSION_TICKET,SSL_R_LENGTH_MISMATCH);
                goto f_err;
                }
diff --git a/src/lib/libssl/s3_lib.c b/src/lib/libssl/s3_lib.c
index 62c791cb72..1130244aeb 100644
--- a/src/lib/libssl/s3_lib.c
+++ b/src/lib/libssl/s3_lib.c
@@ -2177,6 +2177,7 @@ void ssl3_clear(SSL *s)
        {
        unsigned char *rp,*wp;
        size_t rlen, wlen;
+        int init_extra;
 #ifdef TLSEXT_TYPE_opaque_prf_input
        if (s->s3->client_opaque_prf_input != NULL)
@@ -2215,6 +2216,7 @@ void ssl3_clear(SSL *s)
        wp = s->s3->wbuf.buf;
        rlen = s->s3->rbuf.len;
        wlen = s->s3->wbuf.len;
+        init_extra = s->s3->init_extra;
        if (s->s3->handshake_buffer) {
                BIO_free(s->s3->handshake_buffer);
                s->s3->handshake_buffer = NULL;
@@ -2227,6 +2229,7 @@ void ssl3_clear(SSL *s)
        s->s3->wbuf.buf = wp;
        s->s3->rbuf.len = rlen;
        s->s3->wbuf.len = wlen;
+        s->s3->init_extra = init_extra;
        ssl_free_wbio_buffer(s);
diff --git a/src/lib/libssl/s3_srvr.c b/src/lib/libssl/s3_srvr.c
index c3b5ff33ff..d734c359fb 100644
--- a/src/lib/libssl/s3_srvr.c
+++ b/src/lib/libssl/s3_srvr.c
@@ -258,6 +258,7 @@ int ssl3_accept(SSL *s)
                                }
                        s->init_num=0;
+                        s->s3->flags &= ~SSL3_FLAGS_SGC_RESTART_DONE;
                        if (s->state != SSL_ST_RENEGOTIATE)
                                {
@@ -755,6 +756,14 @@ int ssl3_check_client_hello(SSL *s)
        int ok;
        long n;
+        /* We only allow the client to restart the handshake once per
+         * negotiation. */
+        if (s->s3->flags & SSL3_FLAGS_SGC_RESTART_DONE)
+                {
+                SSLerr(SSL_F_SSL3_CHECK_CLIENT_HELLO, SSL_R_MULTIPLE_SGC_RESTARTS);
+                return -1;
+                }
        /* this function is called when we really expect a Certificate message,
         * so permit appropriate message length */
        n=s->method->ssl_get_message(s,
@@ -783,6 +792,7 @@ int ssl3_check_client_hello(SSL *s)
                        s->s3->tmp.ecdh = NULL;
                        }
 #endif
+                s->s3->flags |= SSL3_FLAGS_SGC_RESTART_DONE;
                return 2;
                }
        return 1;
@@ -2130,6 +2140,7 @@ int ssl3_get_client_key_exchange(SSL *s)
                if (i <= 0)
                        {
                        SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,ERR_R_DH_LIB);
+                        BN_clear_free(pub);
                        goto err;
                        }
diff --git a/src/lib/libssl/ssl.h b/src/lib/libssl/ssl.h
index e4c3f65010..8f922eea72 100644
--- a/src/lib/libssl/ssl.h
+++ b/src/lib/libssl/ssl.h
@@ -1882,6 +1882,7 @@ void ERR_load_SSL_strings(void);
 #define SSL_F_SSL3_CALLBACK_CTRL                         233
 #define SSL_F_SSL3_CHANGE_CIPHER_STATE                   129
 #define SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM              130
+#define SSL_F_SSL3_CHECK_CLIENT_HELLO                    304
 #define SSL_F_SSL3_CLIENT_HELLO                          131
 #define SSL_F_SSL3_CONNECT                               132
 #define SSL_F_SSL3_CTRL                                  213
@@ -2139,6 +2140,7 @@ void ERR_load_SSL_strings(void);
 #define SSL_R_MISSING_TMP_RSA_KEY                        172
 #define SSL_R_MISSING_TMP_RSA_PKEY                       173
 #define SSL_R_MISSING_VERIFY_MESSAGE                     174
+#define SSL_R_MULTIPLE_SGC_RESTARTS                      346
 #define SSL_R_NON_SSLV2_INITIAL_PACKET                   175
 #define SSL_R_NO_CERTIFICATES_RETURNED                   176
 #define SSL_R_NO_CERTIFICATE_ASSIGNED                    177
diff --git a/src/lib/libssl/ssl3.h b/src/lib/libssl/ssl3.h
index baaa89e717..9c2c41287a 100644
--- a/src/lib/libssl/ssl3.h
+++ b/src/lib/libssl/ssl3.h
@@ -379,6 +379,17 @@ typedef struct ssl3_buffer_st
 #define SSL3_FLAGS_POP_BUFFER                   0x0004
 #define TLS1_FLAGS_TLS_PADDING_BUG              0x0008
 #define TLS1_FLAGS_SKIP_CERT_VERIFY             0x0010
+ 
+/* SSL3_FLAGS_SGC_RESTART_DONE is set when we
+ * restart a handshake because of MS SGC and so prevents us
+ * from restarting the handshake in a loop. It's reset on a
+ * renegotiation, so effectively limits the client to one restart
+ * per negotiation. This limits the possibility of a DDoS
+ * attack where the client handshakes in a loop using SGC to
+ * restart. Servers which permit renegotiation can still be
+ * effected, but we can't prevent that.
+ */
+#define SSL3_FLAGS_SGC_RESTART_DONE             0x0040
 typedef struct ssl3_state_st
        {
diff --git a/src/lib/libssl/ssl_ciph.c b/src/lib/libssl/ssl_ciph.c
index a8ce186b78..54ba7ef5b4 100644
--- a/src/lib/libssl/ssl_ciph.c
+++ b/src/lib/libssl/ssl_ciph.c
@@ -446,6 +446,7 @@ static void load_builtin_compressions(void)
                                                sk_SSL_COMP_push(ssl_comp_methods,comp);
                                                }
                                        }
+                                        sk_SSL_COMP_sort(ssl_comp_methods);
                                }
                        MemCheck_on();
                        }
diff --git a/src/lib/libssl/ssl_err.c b/src/lib/libssl/ssl_err.c
index 0eed464749..e9be77109f 100644
--- a/src/lib/libssl/ssl_err.c
+++ b/src/lib/libssl/ssl_err.c
@@ -1,6 +1,6 @@
 /* ssl/ssl_err.c */
 /* ====================================================================
- * Copyright (c) 1999-2009 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2011 The OpenSSL Project.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
@@ -137,6 +137,7 @@ static ERR_STRING_DATA SSL_str_functs[]=
 {ERR_FUNC(SSL_F_SSL3_CALLBACK_CTRL),    "SSL3_CALLBACK_CTRL"},
 {ERR_FUNC(SSL_F_SSL3_CHANGE_CIPHER_STATE),      "SSL3_CHANGE_CIPHER_STATE"},
 {ERR_FUNC(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM), "SSL3_CHECK_CERT_AND_ALGORITHM"},
+{ERR_FUNC(SSL_F_SSL3_CHECK_CLIENT_HELLO),       "SSL3_CHECK_CLIENT_HELLO"},
 {ERR_FUNC(SSL_F_SSL3_CLIENT_HELLO),     "SSL3_CLIENT_HELLO"},
 {ERR_FUNC(SSL_F_SSL3_CONNECT),  "SSL3_CONNECT"},
 {ERR_FUNC(SSL_F_SSL3_CTRL),     "SSL3_CTRL"},
@@ -397,6 +398,7 @@ static ERR_STRING_DATA SSL_str_reasons[]=
 {ERR_REASON(SSL_R_MISSING_TMP_RSA_KEY)   ,"missing tmp rsa key"},
 {ERR_REASON(SSL_R_MISSING_TMP_RSA_PKEY)  ,"missing tmp rsa pkey"},
 {ERR_REASON(SSL_R_MISSING_VERIFY_MESSAGE),"missing verify message"},
+{ERR_REASON(SSL_R_MULTIPLE_SGC_RESTARTS) ,"multiple sgc restarts"},
 {ERR_REASON(SSL_R_NON_SSLV2_INITIAL_PACKET),"non sslv2 initial packet"},
 {ERR_REASON(SSL_R_NO_CERTIFICATES_RETURNED),"no certificates returned"},
 {ERR_REASON(SSL_R_NO_CERTIFICATE_ASSIGNED),"no certificate assigned"},
diff --git a/src/lib/libssl/ssl_lib.c b/src/lib/libssl/ssl_lib.c
index 46732791fd..8e89911f48 100644
--- a/src/lib/libssl/ssl_lib.c
+++ b/src/lib/libssl/ssl_lib.c
@@ -1054,6 +1054,9 @@ long SSL_ctrl(SSL *s,int cmd,long larg,void *parg)
                s->max_cert_list=larg;
                return(l);
        case SSL_CTRL_SET_MTU:
+                if (larg < (long)dtls1_min_mtu())
+                        return 0;
                if (SSL_version(s) == DTLS1_VERSION ||
                    SSL_version(s) == DTLS1_BAD_VER)
                        {
diff --git a/src/lib/libssl/ssl_locl.h b/src/lib/libssl/ssl_locl.h
index 4c78393f3f..cea622a2a6 100644
--- a/src/lib/libssl/ssl_locl.h
+++ b/src/lib/libssl/ssl_locl.h
@@ -950,6 +950,7 @@ void dtls1_stop_timer(SSL *s);
 int dtls1_is_timer_expired(SSL *s);
 void dtls1_double_timeout(SSL *s);
 int dtls1_send_newsession_ticket(SSL *s);
+unsigned int dtls1_min_mtu(void);
 /* some client-only functions */
 int ssl3_client_hello(SSL *s);
diff --git a/src/lib/libssl/t1_lib.c b/src/lib/libssl/t1_lib.c
index 85371c87b8..26cbae449e 100644
--- a/src/lib/libssl/t1_lib.c
+++ b/src/lib/libssl/t1_lib.c
@@ -971,6 +971,12 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
                                sdata = data;
                                if (dsize > 0)
                                        {
+                                        if (s->tlsext_ocsp_exts)
+                                                {
+                                                sk_X509_EXTENSION_pop_free(s->tlsext_ocsp_exts,
+                                                                           X509_EXTENSION_free);
+                                                }
                                        s->tlsext_ocsp_exts =
                                                d2i_X509_EXTENSIONS(NULL,
                                                        &sdata, dsize);
diff --git a/src/lib/libssl/test/testssl b/src/lib/libssl/test/testssl
index f9d7c5d65f..b55364ae88 100644
--- a/src/lib/libssl/test/testssl
+++ b/src/lib/libssl/test/testssl
@@ -100,8 +100,8 @@ echo test sslv2/sslv3 via BIO pair
 $ssltest $extra || exit 1
 if [ $dsa_cert = NO ]; then
-  echo test sslv2/sslv3 w/o DHE via BIO pair
+  echo 'test sslv2/sslv3 w/o (EC)DHE via BIO pair'
-  $ssltest -bio_pair -no_dhe $extra || exit 1
+  $ssltest -bio_pair -no_dhe -no_ecdhe $extra || exit 1
 fi
 echo test sslv2/sslv3 with 1024bit DHE via BIO pair
@@ -131,8 +131,8 @@ fi
 if ../util/shlib_wrap.sh ../apps/openssl no-rsa; then
  echo skipping RSA tests
 else
-  echo test tls1 with 1024bit RSA, no DHE, multiple handshakes
+  echo 'test tls1 with 1024bit RSA, no (EC)DHE, multiple handshakes'
-  ../util/shlib_wrap.sh ./ssltest -v -bio_pair -tls1 -cert ../apps/server2.pem -no_dhe -num 10 -f -time $extra || exit 1
+  ../util/shlib_wrap.sh ./ssltest -v -bio_pair -tls1 -cert ../apps/server2.pem -no_dhe -no_ecdhe -num 10 -f -time $extra || exit 1
  if ../util/shlib_wrap.sh ../apps/openssl no-dh; then
    echo skipping RSA+DHE tests