Don't buffer in the record writer at all - we immediately process and

send out inputs as they are available. Thus, flushing is never
required, and we avoid some unnecessary copying.

If we are using a CBC mode cipher in SSLv3/TLSv1.0, send a 1-byte
fragment to start to prevent the adaptive plaintext attack.

1 files changed, 0 insertions, 2 deletions

diff --git a/src/tls/tls_server.cpp b/src/tls/tls_server.cpp
index a22e6854e..16bf554d3 100644
--- a/src/tls/tls_server.cpp
+++ b/src/tls/tls_server.cpp
@@ -184,7 +184,6 @@ void TLS_Server::process_handshake_msg(Handshake_Type type,
                                    true);
 
          writer.send(CHANGE_CIPHER_SPEC, 1);
-         writer.flush();
 
          writer.set_keys(state->suite, state->keys, SERVER);
 
@@ -337,7 +336,6 @@ void TLS_Server::process_handshake_msg(Handshake_Type type,
          state->hash.update(type, contents);
 
          writer.send(CHANGE_CIPHER_SPEC, 1);
-         writer.flush();
 
          writer.set_keys(state->suite, state->keys, SERVER);