From 119e912a8340e1ca869c415bc3b374a0ceaecd81 Mon Sep 17 00:00:00 2001 From: "Dr. Stephen Henson" Date: Tue, 4 Jan 2011 19:33:01 +0000 Subject: [PATCH] Since DTLS 1.0 is based on TLS 1.1 we should never return a decryption_failed alert. --- ssl/d1_enc.c | 6 +----- ssl/d1_pkt.c | 3 ++- 2 files changed, 3 insertions(+), 6 deletions(-) diff --git a/ssl/d1_enc.c b/ssl/d1_enc.c index 4a6c909031..bb96c8a20c 100644 --- a/ssl/d1_enc.c +++ b/ssl/d1_enc.c @@ -220,11 +220,7 @@ int dtls1_enc(SSL *s, int send) if (!send) { if (l == 0 || l%bs != 0) - { - SSLerr(SSL_F_DTLS1_ENC,SSL_R_BLOCK_CIPHER_PAD_IS_WRONG); - ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_DECRYPTION_FAILED); - return 0; - } + return -1; } EVP_Cipher(ds,rec->data,rec->input,l); diff --git a/ssl/d1_pkt.c b/ssl/d1_pkt.c index 3f19077af1..b840a15a12 100644 --- a/ssl/d1_pkt.c +++ b/ssl/d1_pkt.c @@ -374,7 +374,8 @@ dtls1_process_record(SSL *s) goto err; /* otherwise enc_err == -1 */ - goto err; + al=SSL_AD_BAD_RECORD_MAC; + goto f_err; } #ifdef TLS_DEBUG -- 2.25.1