Add SA-14:20 - SA-14:23.

6 files changed, 2167 insertions, 0 deletions

diff --git a/share/security/patches/SA-14:23/openssl-10.0.patch b/share/security/patches/SA-14:23/openssl-10.0.patch
new file mode 100644
index 0000000000..6beae49945
--- /dev/null
+++ b/share/security/patches/SA-14:23/openssl-10.0.patch
@@ -0,0 +1,717 @@
+Index: crypto/openssl/apps/s_client.c
+===================================================================
+--- crypto/openssl/apps/s_client.c	(revision 273303)
++++ crypto/openssl/apps/s_client.c	(working copy)
+@@ -335,6 +335,7 @@ static void sc_usage(void)
+ 	BIO_printf(bio_err," -tls1_1       - just use TLSv1.1\n");
+ 	BIO_printf(bio_err," -tls1         - just use TLSv1\n");
+ 	BIO_printf(bio_err," -dtls1        - just use DTLSv1\n");    
++	BIO_printf(bio_err," -fallback_scsv - send TLS_FALLBACK_SCSV\n");
+ 	BIO_printf(bio_err," -mtu          - set the link layer MTU\n");
+ 	BIO_printf(bio_err," -no_tls1_2/-no_tls1_1/-no_tls1/-no_ssl3/-no_ssl2 - turn off that protocol\n");
+ 	BIO_printf(bio_err," -bugs         - Switch on all SSL implementation bug workarounds\n");
+@@ -615,6 +616,7 @@ int MAIN(int argc, char **argv)
+ 	char *sess_out = NULL;
+ 	struct sockaddr peer;
+ 	int peerlen = sizeof(peer);
++	int fallback_scsv = 0;
+ 	int enable_timeouts = 0 ;
+ 	long socket_mtu = 0;
+ #ifndef OPENSSL_NO_JPAKE
+@@ -821,6 +823,10 @@ int MAIN(int argc, char **argv)
+ 			meth=DTLSv1_client_method();
+ 			socket_type=SOCK_DGRAM;
+ 			}
++		else if (strcmp(*argv,"-fallback_scsv") == 0)
++			{
++			fallback_scsv = 1;
++			}
+ 		else if (strcmp(*argv,"-timeout") == 0)
+ 			enable_timeouts=1;
+ 		else if (strcmp(*argv,"-mtu") == 0)
+@@ -1233,6 +1239,10 @@ bad:
+ 		SSL_set_session(con, sess);
+ 		SSL_SESSION_free(sess);
+ 		}
++
++	if (fallback_scsv)
++		SSL_set_mode(con, SSL_MODE_SEND_FALLBACK_SCSV);
++
+ #ifndef OPENSSL_NO_TLSEXT
+ 	if (servername != NULL)
+ 		{
+Index: crypto/openssl/ssl/d1_lib.c
+===================================================================
+--- crypto/openssl/ssl/d1_lib.c	(revision 273303)
++++ crypto/openssl/ssl/d1_lib.c	(working copy)
+@@ -262,6 +262,16 @@ long dtls1_ctrl(SSL *s, int cmd, long larg, void *
+ 	case DTLS_CTRL_LISTEN:
+ 		ret = dtls1_listen(s, parg);
+ 		break;
++	case SSL_CTRL_CHECK_PROTO_VERSION:
++		/* For library-internal use; checks that the current protocol
++		 * is the highest enabled version (according to s->ctx->method,
++		 * as version negotiation may have changed s->method). */
++#if DTLS_MAX_VERSION != DTLS1_VERSION
++#  error Code needs update for DTLS_method() support beyond DTLS1_VERSION.
++#endif
++		/* Just one protocol version is supported so far;
++		 * fail closed if the version is not as expected. */
++		return s->version == DTLS_MAX_VERSION;
+ 
+ 	default:
+ 		ret = ssl3_ctrl(s, cmd, larg, parg);
+Index: crypto/openssl/ssl/d1_srtp.c
+===================================================================
+--- crypto/openssl/ssl/d1_srtp.c	(revision 273303)
++++ crypto/openssl/ssl/d1_srtp.c	(working copy)
+@@ -168,25 +168,6 @@ static int find_profile_by_name(char *profile_name
+ 	return 1;
+ 	}
+ 
+-static int find_profile_by_num(unsigned profile_num,
+-			       SRTP_PROTECTION_PROFILE **pptr)
+-	{
+-	SRTP_PROTECTION_PROFILE *p;
+-
+-	p=srtp_known_profiles;
+-	while(p->name)
+-		{
+-		if(p->id == profile_num)
+-			{
+-			*pptr=p;
+-			return 0;
+-			}
+-		p++;
+-		}
+-
+-	return 1;
+-	}
+-
+ static int ssl_ctx_make_profiles(const char *profiles_string,STACK_OF(SRTP_PROTECTION_PROFILE) **out)
+ 	{
+ 	STACK_OF(SRTP_PROTECTION_PROFILE) *profiles;
+@@ -209,11 +190,19 @@ static int ssl_ctx_make_profiles(const char *profi
+ 		if(!find_profile_by_name(ptr,&p,
+ 					 col ? col-ptr : (int)strlen(ptr)))
+ 			{
++			if (sk_SRTP_PROTECTION_PROFILE_find(profiles,p) >= 0)
++				{
++				SSLerr(SSL_F_SSL_CTX_MAKE_PROFILES,SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST);
++				sk_SRTP_PROTECTION_PROFILE_free(profiles);
++				return 1;
++				}
++
+ 			sk_SRTP_PROTECTION_PROFILE_push(profiles,p);
+ 			}
+ 		else
+ 			{
+ 			SSLerr(SSL_F_SSL_CTX_MAKE_PROFILES,SSL_R_SRTP_UNKNOWN_PROTECTION_PROFILE);
++			sk_SRTP_PROTECTION_PROFILE_free(profiles);
+ 			return 1;
+ 			}
+ 
+@@ -305,13 +294,12 @@ int ssl_add_clienthello_use_srtp_ext(SSL *s, unsig
+ 
+ int ssl_parse_clienthello_use_srtp_ext(SSL *s, unsigned char *d, int len,int *al)
+ 	{
+-	SRTP_PROTECTION_PROFILE *cprof,*sprof;
+-	STACK_OF(SRTP_PROTECTION_PROFILE) *clnt=0,*srvr;
++	SRTP_PROTECTION_PROFILE *sprof;
++	STACK_OF(SRTP_PROTECTION_PROFILE) *srvr;
+         int ct;
+         int mki_len;
+-	int i,j;
+-	int id;
+-	int ret;
++	int i, srtp_pref;
++	unsigned int id;
+ 
+          /* Length value + the MKI length */
+         if(len < 3)
+@@ -341,9 +329,11 @@ int ssl_parse_clienthello_use_srtp_ext(SSL *s, uns
+ 		return 1;
+ 		}
+ 
++	srvr=SSL_get_srtp_profiles(s);
++	s->srtp_profile = NULL;
++	/* Search all profiles for a match initially */
++	srtp_pref = sk_SRTP_PROTECTION_PROFILE_num(srvr);
+         
+-	clnt=sk_SRTP_PROTECTION_PROFILE_new_null();
+-
+ 	while(ct)
+ 		{
+ 		n2s(d,id);
+@@ -350,14 +340,22 @@ int ssl_parse_clienthello_use_srtp_ext(SSL *s, uns
+ 		ct-=2;
+                 len-=2;
+ 
+-		if(!find_profile_by_num(id,&cprof))
++		/*
++		 * Only look for match in profiles of higher preference than
++		 * current match.
++		 * If no profiles have been have been configured then this
++		 * does nothing.
++		 */
++		for (i = 0; i < srtp_pref; i++)
+ 			{
+-			sk_SRTP_PROTECTION_PROFILE_push(clnt,cprof);
++			sprof = sk_SRTP_PROTECTION_PROFILE_value(srvr, i);
++			if (sprof->id == id)
++				{
++				s->srtp_profile = sprof;
++				srtp_pref = i;
++				break;
++				}
+ 			}
+-		else
+-			{
+-			; /* Ignore */
+-			}
+ 		}
+ 
+         /* Now extract the MKI value as a sanity check, but discard it for now */
+@@ -371,36 +369,7 @@ int ssl_parse_clienthello_use_srtp_ext(SSL *s, uns
+ 		return 1;
+ 		}
+ 
+-	srvr=SSL_get_srtp_profiles(s);
+-
+-	/* Pick our most preferred profile. If no profiles have been
+-	 configured then the outer loop doesn't run 
+-	 (sk_SRTP_PROTECTION_PROFILE_num() = -1)
+-	 and so we just return without doing anything */
+-	for(i=0;i<sk_SRTP_PROTECTION_PROFILE_num(srvr);i++)
+-		{
+-		sprof=sk_SRTP_PROTECTION_PROFILE_value(srvr,i);
+-
+-		for(j=0;j<sk_SRTP_PROTECTION_PROFILE_num(clnt);j++)
+-			{
+-			cprof=sk_SRTP_PROTECTION_PROFILE_value(clnt,j);
+-            
+-			if(cprof->id==sprof->id)
+-				{
+-				s->srtp_profile=sprof;
+-				*al=0;
+-				ret=0;
+-				goto done;
+-				}
+-			}
+-		}
+-
+-	ret=0;
+-    
+-done:
+-	if(clnt) sk_SRTP_PROTECTION_PROFILE_free(clnt);
+-
+-	return ret;
++	return 0;
+ 	}
+ 
+ int ssl_add_serverhello_use_srtp_ext(SSL *s, unsigned char *p, int *len, int maxlen)
+Index: crypto/openssl/ssl/dtls1.h
+===================================================================
+--- crypto/openssl/ssl/dtls1.h	(revision 273303)
++++ crypto/openssl/ssl/dtls1.h	(working copy)
+@@ -84,6 +84,8 @@ extern "C" {
+ #endif
+ 
+ #define DTLS1_VERSION			0xFEFF
++#define DTLS_MAX_VERSION		DTLS1_VERSION
++
+ #define DTLS1_BAD_VER			0x0100
+ 
+ #if 0
+@@ -284,4 +286,3 @@ typedef struct dtls1_record_data_st
+ }
+ #endif
+ #endif
+-
+Index: crypto/openssl/ssl/s23_clnt.c
+===================================================================
+--- crypto/openssl/ssl/s23_clnt.c	(revision 273303)
++++ crypto/openssl/ssl/s23_clnt.c	(working copy)
+@@ -125,9 +125,11 @@ static const SSL_METHOD *ssl23_get_client_method(i
+ 	if (ver == SSL2_VERSION)
+ 		return(SSLv2_client_method());
+ #endif
++#ifndef OPENSSL_NO_SSL3
+ 	if (ver == SSL3_VERSION)
+ 		return(SSLv3_client_method());
+-	else if (ver == TLS1_VERSION)
++#endif
++	if (ver == TLS1_VERSION)
+ 		return(TLSv1_client_method());
+ 	else if (ver == TLS1_1_VERSION)
+ 		return(TLSv1_1_client_method());
+@@ -677,6 +679,7 @@ static int ssl23_get_server_hello(SSL *s)
+ 		{
+ 		/* we have sslv3 or tls1 (server hello or alert) */
+ 
++#ifndef OPENSSL_NO_SSL3
+ 		if ((p[2] == SSL3_VERSION_MINOR) &&
+ 			!(s->options & SSL_OP_NO_SSLv3))
+ 			{
+@@ -691,7 +694,9 @@ static int ssl23_get_server_hello(SSL *s)
+ 			s->version=SSL3_VERSION;
+ 			s->method=SSLv3_client_method();
+ 			}
+-		else if ((p[2] == TLS1_VERSION_MINOR) &&
++		else
++#endif
++		if ((p[2] == TLS1_VERSION_MINOR) &&
+ 			!(s->options & SSL_OP_NO_TLSv1))
+ 			{
+ 			s->version=TLS1_VERSION;
+@@ -715,6 +720,9 @@ static int ssl23_get_server_hello(SSL *s)
+ 			goto err;
+ 			}
+ 
++		/* ensure that TLS_MAX_VERSION is up-to-date */
++		OPENSSL_assert(s->version <= TLS_MAX_VERSION);
++
+ 		if (p[0] == SSL3_RT_ALERT && p[5] != SSL3_AL_WARNING)
+ 			{
+ 			/* fatal alert */
+Index: crypto/openssl/ssl/s23_srvr.c
+===================================================================
+--- crypto/openssl/ssl/s23_srvr.c	(revision 273303)
++++ crypto/openssl/ssl/s23_srvr.c	(working copy)
+@@ -127,9 +127,11 @@ static const SSL_METHOD *ssl23_get_server_method(i
+ 	if (ver == SSL2_VERSION)
+ 		return(SSLv2_server_method());
+ #endif
++#ifndef OPENSSL_NO_SSL3
+ 	if (ver == SSL3_VERSION)
+ 		return(SSLv3_server_method());
+-	else if (ver == TLS1_VERSION)
++#endif
++	if (ver == TLS1_VERSION)
+ 		return(TLSv1_server_method());
+ 	else if (ver == TLS1_1_VERSION)
+ 		return(TLSv1_1_server_method());
+@@ -421,6 +423,9 @@ int ssl23_get_client_hello(SSL *s)
+ 			}
+ 		}
+ 
++	/* ensure that TLS_MAX_VERSION is up-to-date */
++	OPENSSL_assert(s->version <= TLS_MAX_VERSION);
++
+ #ifdef OPENSSL_FIPS
+ 	if (FIPS_mode() && (s->version < TLS1_VERSION))
+ 		{
+@@ -597,6 +602,12 @@ int ssl23_get_client_hello(SSL *s)
+ 	if ((type == 2) || (type == 3))
+ 		{
+ 		/* we have SSLv3/TLSv1 (type 2: SSL2 style, type 3: SSL3/TLS style) */
++                s->method = ssl23_get_server_method(s->version);
++		if (s->method == NULL)
++			{
++			SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_UNSUPPORTED_PROTOCOL);
++			goto err;
++			}
+ 
+ 		if (!ssl_init_wbio_buffer(s,1)) goto err;
+ 
+@@ -624,14 +635,6 @@ int ssl23_get_client_hello(SSL *s)
+ 			s->s3->rbuf.left=0;
+ 			s->s3->rbuf.offset=0;
+ 			}
+-		if (s->version == TLS1_2_VERSION)
+-			s->method = TLSv1_2_server_method();
+-		else if (s->version == TLS1_1_VERSION)
+-			s->method = TLSv1_1_server_method();
+-		else if (s->version == TLS1_VERSION)
+-			s->method = TLSv1_server_method();
+-		else
+-			s->method = SSLv3_server_method();
+ #if 0 /* ssl3_get_client_hello does this */
+ 		s->client_version=(v[0]<<8)|v[1];
+ #endif
+Index: crypto/openssl/ssl/s2_lib.c
+===================================================================
+--- crypto/openssl/ssl/s2_lib.c	(revision 273303)
++++ crypto/openssl/ssl/s2_lib.c	(working copy)
+@@ -391,6 +391,8 @@ long ssl2_ctrl(SSL *s, int cmd, long larg, void *p
+ 	case SSL_CTRL_GET_SESSION_REUSED:
+ 		ret=s->hit;
+ 		break;
++	case SSL_CTRL_CHECK_PROTO_VERSION:
++		return ssl3_ctrl(s, SSL_CTRL_CHECK_PROTO_VERSION, larg, parg);
+ 	default:
+ 		break;
+ 		}
+@@ -437,7 +439,7 @@ int ssl2_put_cipher_by_char(const SSL_CIPHER *c, u
+ 	if (p != NULL)
+ 		{
+ 		l=c->id;
+-		if ((l & 0xff000000) != 0x02000000) return(0);
++		if ((l & 0xff000000) != 0x02000000 && l != SSL3_CK_FALLBACK_SCSV) return(0);
+ 		p[0]=((unsigned char)(l>>16L))&0xFF;
+ 		p[1]=((unsigned char)(l>> 8L))&0xFF;
+ 		p[2]=((unsigned char)(l     ))&0xFF;
+Index: crypto/openssl/ssl/s3_enc.c
+===================================================================
+--- crypto/openssl/ssl/s3_enc.c	(revision 273303)
++++ crypto/openssl/ssl/s3_enc.c	(working copy)
+@@ -892,7 +892,7 @@ int ssl3_alert_code(int code)
+ 	case SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE: return(SSL3_AD_HANDSHAKE_FAILURE);
+ 	case SSL_AD_BAD_CERTIFICATE_HASH_VALUE: return(SSL3_AD_HANDSHAKE_FAILURE);
+ 	case SSL_AD_UNKNOWN_PSK_IDENTITY:return(TLS1_AD_UNKNOWN_PSK_IDENTITY);
++	case SSL_AD_INAPPROPRIATE_FALLBACK:return(TLS1_AD_INAPPROPRIATE_FALLBACK);
+ 	default:			return(-1);
+ 		}
+ 	}
+-
+Index: crypto/openssl/ssl/s3_lib.c
+===================================================================
+--- crypto/openssl/ssl/s3_lib.c	(revision 273303)
++++ crypto/openssl/ssl/s3_lib.c	(working copy)
+@@ -3350,6 +3350,33 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *p
+ #endif
+ 
+ #endif /* !OPENSSL_NO_TLSEXT */
++
++	case SSL_CTRL_CHECK_PROTO_VERSION:
++		/* For library-internal use; checks that the current protocol
++		 * is the highest enabled version (according to s->ctx->method,
++		 * as version negotiation may have changed s->method). */
++		if (s->version == s->ctx->method->version)
++			return 1;
++		/* Apparently we're using a version-flexible SSL_METHOD
++		 * (not at its highest protocol version). */
++		if (s->ctx->method->version == SSLv23_method()->version)
++			{
++#if TLS_MAX_VERSION != TLS1_2_VERSION
++#  error Code needs update for SSLv23_method() support beyond TLS1_2_VERSION.
++#endif
++			if (!(s->options & SSL_OP_NO_TLSv1_2))
++				return s->version == TLS1_2_VERSION;
++			if (!(s->options & SSL_OP_NO_TLSv1_1))
++				return s->version == TLS1_1_VERSION;
++			if (!(s->options & SSL_OP_NO_TLSv1))
++				return s->version == TLS1_VERSION;
++			if (!(s->options & SSL_OP_NO_SSLv3))
++				return s->version == SSL3_VERSION;
++			if (!(s->options & SSL_OP_NO_SSLv2))
++				return s->version == SSL2_VERSION;
++			}
++		return 0; /* Unexpected state; fail closed. */
++
+ 	default:
+ 		break;
+ 		}
+@@ -3709,6 +3736,7 @@ long ssl3_ctx_callback_ctrl(SSL_CTX *ctx, int cmd,
+ 		break;
+ #endif
+ #endif
++
+ 	default:
+ 		return(0);
+ 		}
+@@ -4279,4 +4307,3 @@ long ssl_get_algorithm2(SSL *s)
+ 		return SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256;
+ 	return alg2;
+ 	}
+-		
+Index: crypto/openssl/ssl/ssl.h
+===================================================================
+--- crypto/openssl/ssl/ssl.h	(revision 273303)
++++ crypto/openssl/ssl/ssl.h	(working copy)
+@@ -642,6 +642,10 @@ struct ssl_session_st
+  * TLS only.)  "Released" buffers are put onto a free-list in the context
+  * or just freed (depending on the context's setting for freelist_max_len). */
+ #define SSL_MODE_RELEASE_BUFFERS 0x00000010L
++/* Send TLS_FALLBACK_SCSV in the ClientHello.
++ * To be set by applications that reconnect with a downgraded protocol
++ * version; see draft-ietf-tls-downgrade-scsv-00 for details. */
++#define SSL_MODE_SEND_FALLBACK_SCSV 0x00000080L
+ 
+ /* Note: SSL[_CTX]_set_{options,mode} use |= op on the previous value,
+  * they cannot be used to clear bits. */
+@@ -1500,6 +1504,7 @@ DECLARE_PEM_rw(SSL_SESSION, SSL_SESSION)
+ #define SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE
+ #define SSL_AD_BAD_CERTIFICATE_HASH_VALUE TLS1_AD_BAD_CERTIFICATE_HASH_VALUE
+ #define SSL_AD_UNKNOWN_PSK_IDENTITY     TLS1_AD_UNKNOWN_PSK_IDENTITY /* fatal */
++#define SSL_AD_INAPPROPRIATE_FALLBACK	TLS1_AD_INAPPROPRIATE_FALLBACK /* fatal */
+ 
+ #define SSL_ERROR_NONE			0
+ #define SSL_ERROR_SSL			1
+@@ -1610,6 +1615,8 @@ DECLARE_PEM_rw(SSL_SESSION, SSL_SESSION)
+ #define SSL_CTRL_GET_EXTRA_CHAIN_CERTS		82
+ #define SSL_CTRL_CLEAR_EXTRA_CHAIN_CERTS	83
+ 
++#define SSL_CTRL_CHECK_PROTO_VERSION		119
++
+ #define DTLSv1_get_timeout(ssl, arg) \
+ 	SSL_ctrl(ssl,DTLS_CTRL_GET_TIMEOUT,0, (void *)arg)
+ #define DTLSv1_handle_timeout(ssl) \
+@@ -2364,6 +2371,7 @@ void ERR_load_SSL_strings(void);
+ #define SSL_R_HTTPS_PROXY_REQUEST			 155
+ #define SSL_R_HTTP_REQUEST				 156
+ #define SSL_R_ILLEGAL_PADDING				 283
++#define SSL_R_INAPPROPRIATE_FALLBACK			 373
+ #define SSL_R_INCONSISTENT_COMPRESSION			 340
+ #define SSL_R_INVALID_CHALLENGE_LENGTH			 158
+ #define SSL_R_INVALID_COMMAND				 280
+@@ -2510,6 +2518,7 @@ void ERR_load_SSL_strings(void);
+ #define SSL_R_TLSV1_ALERT_DECRYPTION_FAILED		 1021
+ #define SSL_R_TLSV1_ALERT_DECRYPT_ERROR			 1051
+ #define SSL_R_TLSV1_ALERT_EXPORT_RESTRICTION		 1060
++#define SSL_R_TLSV1_ALERT_INAPPROPRIATE_FALLBACK	 1086
+ #define SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY		 1071
+ #define SSL_R_TLSV1_ALERT_INTERNAL_ERROR		 1080
+ #define SSL_R_TLSV1_ALERT_NO_RENEGOTIATION		 1100
+Index: crypto/openssl/ssl/ssl3.h
+===================================================================
+--- crypto/openssl/ssl/ssl3.h	(revision 273303)
++++ crypto/openssl/ssl/ssl3.h	(working copy)
+@@ -128,9 +128,14 @@
+ extern "C" {
+ #endif
+ 
+-/* Signalling cipher suite value: from draft-ietf-tls-renegotiation-03.txt */
++/* Signalling cipher suite value from RFC 5746
++ * (TLS_EMPTY_RENEGOTIATION_INFO_SCSV) */
+ #define SSL3_CK_SCSV				0x030000FF
+ 
++/* Signalling cipher suite value from draft-ietf-tls-downgrade-scsv-00
++ * (TLS_FALLBACK_SCSV) */
++#define SSL3_CK_FALLBACK_SCSV			0x03005600
++
+ #define SSL3_CK_RSA_NULL_MD5			0x03000001
+ #define SSL3_CK_RSA_NULL_SHA			0x03000002
+ #define SSL3_CK_RSA_RC4_40_MD5 			0x03000003
+Index: crypto/openssl/ssl/ssl_err.c
+===================================================================
+--- crypto/openssl/ssl/ssl_err.c	(revision 273303)
++++ crypto/openssl/ssl/ssl_err.c	(working copy)
+@@ -383,6 +383,7 @@ static ERR_STRING_DATA SSL_str_reasons[]=
+ {ERR_REASON(SSL_R_HTTPS_PROXY_REQUEST)   ,"https proxy request"},
+ {ERR_REASON(SSL_R_HTTP_REQUEST)          ,"http request"},
+ {ERR_REASON(SSL_R_ILLEGAL_PADDING)       ,"illegal padding"},
++{ERR_REASON(SSL_R_INAPPROPRIATE_FALLBACK),"inappropriate fallback"},
+ {ERR_REASON(SSL_R_INCONSISTENT_COMPRESSION),"inconsistent compression"},
+ {ERR_REASON(SSL_R_INVALID_CHALLENGE_LENGTH),"invalid challenge length"},
+ {ERR_REASON(SSL_R_INVALID_COMMAND)       ,"invalid command"},
+@@ -529,6 +530,7 @@ static ERR_STRING_DATA SSL_str_reasons[]=
+ {ERR_REASON(SSL_R_TLSV1_ALERT_DECRYPTION_FAILED),"tlsv1 alert decryption failed"},
+ {ERR_REASON(SSL_R_TLSV1_ALERT_DECRYPT_ERROR),"tlsv1 alert decrypt error"},
+ {ERR_REASON(SSL_R_TLSV1_ALERT_EXPORT_RESTRICTION),"tlsv1 alert export restriction"},
++{ERR_REASON(SSL_R_TLSV1_ALERT_INAPPROPRIATE_FALLBACK),"tlsv1 alert inappropriate fallback"},
+ {ERR_REASON(SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY),"tlsv1 alert insufficient security"},
+ {ERR_REASON(SSL_R_TLSV1_ALERT_INTERNAL_ERROR),"tlsv1 alert internal error"},
+ {ERR_REASON(SSL_R_TLSV1_ALERT_NO_RENEGOTIATION),"tlsv1 alert no renegotiation"},
+Index: crypto/openssl/ssl/ssl_lib.c
+===================================================================
+--- crypto/openssl/ssl/ssl_lib.c	(revision 273303)
++++ crypto/openssl/ssl/ssl_lib.c	(working copy)
+@@ -1383,6 +1383,8 @@ int ssl_cipher_list_to_bytes(SSL *s,STACK_OF(SSL_C
+ 
+ 	if (sk == NULL) return(0);
+ 	q=p;
++	if (put_cb == NULL)
++		put_cb = s->method->put_cipher_by_char;
+ 
+ 	for (i=0; i<sk_SSL_CIPHER_num(sk); i++)
+ 		{
+@@ -1407,25 +1409,37 @@ int ssl_cipher_list_to_bytes(SSL *s,STACK_OF(SSL_C
+ 		    !(s->srp_ctx.srp_Mask & SSL_kSRP))
+ 		    continue;
+ #endif /* OPENSSL_NO_SRP */
+-		j = put_cb ? put_cb(c,p) : ssl_put_cipher_by_char(s,c,p);
++		j = put_cb(c,p);
+ 		p+=j;
+ 		}
+-	/* If p == q, no ciphers and caller indicates an error. Otherwise
+-	 * add SCSV if not renegotiating.
+-	 */
+-	if (p != q && !s->renegotiate)
++	/* If p == q, no ciphers; caller indicates an error.
++	 * Otherwise, add applicable SCSVs. */
++	if (p != q)
+ 		{
+-		static SSL_CIPHER scsv =
++		if (!s->renegotiate)
+ 			{
+-			0, NULL, SSL3_CK_SCSV, 0, 0, 0, 0, 0, 0, 0, 0, 0
+-			};
+-		j = put_cb ? put_cb(&scsv,p) : ssl_put_cipher_by_char(s,&scsv,p);
+-		p+=j;
++			static SSL_CIPHER scsv =
++				{
++				0, NULL, SSL3_CK_SCSV, 0, 0, 0, 0, 0, 0, 0, 0, 0
++				};
++			j = put_cb(&scsv,p);
++			p+=j;
+ #ifdef OPENSSL_RI_DEBUG
+-		fprintf(stderr, "SCSV sent by client\n");
++			fprintf(stderr, "TLS_EMPTY_RENEGOTIATION_INFO_SCSV sent by client\n");
+ #endif
+-		}
++			}
+ 
++		if (s->mode & SSL_MODE_SEND_FALLBACK_SCSV)
++			{
++			static SSL_CIPHER scsv =
++				{
++				0, NULL, SSL3_CK_FALLBACK_SCSV, 0, 0, 0, 0, 0, 0, 0, 0, 0
++				};
++			j = put_cb(&scsv,p);
++			p+=j;
++			}
++ 		}
++
+ 	return(p-q);
+ 	}
+ 
+@@ -1435,11 +1449,12 @@ STACK_OF(SSL_CIPHER) *ssl_bytes_to_cipher_list(SSL
+ 	const SSL_CIPHER *c;
+ 	STACK_OF(SSL_CIPHER) *sk;
+ 	int i,n;
++
+ 	if (s->s3)
+ 		s->s3->send_connection_binding = 0;
+ 
+ 	n=ssl_put_cipher_by_char(s,NULL,NULL);
+-	if ((num%n) != 0)
++	if (n == 0 || (num%n) != 0)
+ 		{
+ 		SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST,SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST);
+ 		return(NULL);
+@@ -1454,7 +1469,7 @@ STACK_OF(SSL_CIPHER) *ssl_bytes_to_cipher_list(SSL
+ 
+ 	for (i=0; i<num; i+=n)
+ 		{
+-		/* Check for SCSV */
++		/* Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV */
+ 		if (s->s3 && (n != 3 || !p[0]) &&
+ 			(p[n-2] == ((SSL3_CK_SCSV >> 8) & 0xff)) &&
+ 			(p[n-1] == (SSL3_CK_SCSV & 0xff)))
+@@ -1474,6 +1489,23 @@ STACK_OF(SSL_CIPHER) *ssl_bytes_to_cipher_list(SSL
+ 			continue;
+ 			}
+ 
++		/* Check for TLS_FALLBACK_SCSV */
++		if ((n != 3 || !p[0]) &&
++			(p[n-2] == ((SSL3_CK_FALLBACK_SCSV >> 8) & 0xff)) &&
++			(p[n-1] == (SSL3_CK_FALLBACK_SCSV & 0xff)))
++			{
++			/* The SCSV indicates that the client previously tried a higher version.
++			 * Fail if the current version is an unexpected downgrade. */
++			if (!SSL_ctrl(s, SSL_CTRL_CHECK_PROTO_VERSION, 0, NULL))
++				{
++				SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST,SSL_R_INAPPROPRIATE_FALLBACK);
++				if (s->s3)
++					ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_INAPPROPRIATE_FALLBACK);
++				goto err;
++				}
++			continue;
++			}
++
+ 		c=ssl_get_cipher_by_char(s,p);
+ 		p+=n;
+ 		if (c != NULL)
+Index: crypto/openssl/ssl/t1_enc.c
+===================================================================
+--- crypto/openssl/ssl/t1_enc.c	(revision 273303)
++++ crypto/openssl/ssl/t1_enc.c	(working copy)
+@@ -1243,6 +1243,7 @@ int tls1_alert_code(int code)
+ 	case SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE: return(TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE);
+ 	case SSL_AD_BAD_CERTIFICATE_HASH_VALUE: return(TLS1_AD_BAD_CERTIFICATE_HASH_VALUE);
+ 	case SSL_AD_UNKNOWN_PSK_IDENTITY:return(TLS1_AD_UNKNOWN_PSK_IDENTITY);
++	case SSL_AD_INAPPROPRIATE_FALLBACK:return(TLS1_AD_INAPPROPRIATE_FALLBACK);
+ #if 0 /* not appropriate for TLS, not used for DTLS */
+ 	case DTLS1_AD_MISSING_HANDSHAKE_MESSAGE: return 
+ 					  (DTLS1_AD_MISSING_HANDSHAKE_MESSAGE);
+Index: crypto/openssl/ssl/t1_lib.c
+===================================================================
+--- crypto/openssl/ssl/t1_lib.c	(revision 273303)
++++ crypto/openssl/ssl/t1_lib.c	(working copy)
+@@ -650,7 +650,7 @@ unsigned char *ssl_add_clienthello_tlsext(SSL *s,
+ #endif
+ 
+ #ifndef OPENSSL_NO_SRTP
+-        if(SSL_get_srtp_profiles(s))
++	if(SSL_IS_DTLS(s) && SSL_get_srtp_profiles(s))
+                 {
+                 int el;
+ 
+@@ -784,7 +784,7 @@ unsigned char *ssl_add_serverhello_tlsext(SSL *s,
+ #endif
+ 
+ #ifndef OPENSSL_NO_SRTP
+-        if(s->srtp_profile)
++	if(SSL_IS_DTLS(s) && s->srtp_profile)
+                 {
+                 int el;
+ 
+@@ -1334,7 +1334,8 @@ int ssl_parse_clienthello_tlsext(SSL *s, unsigned
+ 
+ 		/* session ticket processed earlier */
+ #ifndef OPENSSL_NO_SRTP
+-		else if (type == TLSEXT_TYPE_use_srtp)
++		else if (SSL_IS_DTLS(s) && SSL_get_srtp_profiles(s)
++			 && type == TLSEXT_TYPE_use_srtp)
+ 			{
+ 			if(ssl_parse_clienthello_use_srtp_ext(s, data, size,
+ 							      al))
+@@ -1589,7 +1590,7 @@ int ssl_parse_serverhello_tlsext(SSL *s, unsigned
+ 			}
+ #endif
+ #ifndef OPENSSL_NO_SRTP
+-		else if (type == TLSEXT_TYPE_use_srtp)
++		else if (SSL_IS_DTLS(s) && type == TLSEXT_TYPE_use_srtp)
+ 			{
+                         if(ssl_parse_serverhello_use_srtp_ext(s, data, size,
+ 							      al))
+@@ -2238,7 +2239,10 @@ static int tls_decrypt_ticket(SSL *s, const unsign
+ 	HMAC_Final(&hctx, tick_hmac, NULL);
+ 	HMAC_CTX_cleanup(&hctx);
+ 	if (CRYPTO_memcmp(tick_hmac, etick + eticklen, mlen))
++		{
++		EVP_CIPHER_CTX_cleanup(&ctx);
+ 		return 2;
++		}
+ 	/* Attempt to decrypt session data */
+ 	/* Move p after IV to start of encrypted ticket, update length */
+ 	p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
+Index: crypto/openssl/ssl/tls1.h
+===================================================================
+--- crypto/openssl/ssl/tls1.h	(revision 273303)
++++ crypto/openssl/ssl/tls1.h	(working copy)
+@@ -159,17 +159,19 @@ extern "C" {
+ 
+ #define TLS1_ALLOW_EXPERIMENTAL_CIPHERSUITES	0
+ 
++#define TLS1_VERSION			0x0301
++#define TLS1_1_VERSION			0x0302
+ #define TLS1_2_VERSION			0x0303
+-#define TLS1_2_VERSION_MAJOR		0x03
+-#define TLS1_2_VERSION_MINOR		0x03
++#define TLS_MAX_VERSION			TLS1_2_VERSION
+ 
+-#define TLS1_1_VERSION			0x0302
++#define TLS1_VERSION_MAJOR		0x03
++#define TLS1_VERSION_MINOR		0x01
++
+ #define TLS1_1_VERSION_MAJOR		0x03
+ #define TLS1_1_VERSION_MINOR		0x02
+ 
+-#define TLS1_VERSION			0x0301
+-#define TLS1_VERSION_MAJOR		0x03
+-#define TLS1_VERSION_MINOR		0x01
++#define TLS1_2_VERSION_MAJOR		0x03
++#define TLS1_2_VERSION_MINOR		0x03
+ 
+ #define TLS1_get_version(s) \
+ 		((s->version >> 8) == TLS1_VERSION_MAJOR ? s->version : 0)
+@@ -187,6 +189,7 @@ extern "C" {
+ #define TLS1_AD_PROTOCOL_VERSION	70	/* fatal */
+ #define TLS1_AD_INSUFFICIENT_SECURITY	71	/* fatal */
+ #define TLS1_AD_INTERNAL_ERROR		80	/* fatal */
++#define TLS1_AD_INAPPROPRIATE_FALLBACK	86	/* fatal */
+ #define TLS1_AD_USER_CANCELLED		90
+ #define TLS1_AD_NO_RENEGOTIATION	100
+ /* codes 110-114 are from RFC3546 */
diff --git a/share/security/patches/SA-14:23/openssl-10.0.patch.asc b/share/security/patches/SA-14:23/openssl-10.0.patch.asc
new file mode 100644
index 0000000000..19c2a89f5d
--- /dev/null
+++ b/share/security/patches/SA-14:23/openssl-10.0.patch.asc
@@ -0,0 +1,17 @@
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v1
+
+iQIcBAABAgAGBQJURsQeAAoJEO1n7NZdz2rnNmYP/i2vNILbMF0QctkF4QIXRSSX
+nOay3VHrLb/KLtVT7dha6TlkcmnqTNbPHr9V34DODeWHFk6ayPSB/BBD6gXoPVPH
+rEpUEXLvNpR4V7FoPdWuJ0G7Ywi5M4uthmYMKrZB3pW/WADgd6vllLgoNUZNNwa6
+68f12oH/gsCPC78A6OklDA79jabpnjIZUQOXGfet1JVLoAWCssgOvQrhrOWX3oTt
+EjvC1jX7maXn/FlWV02PKO0SAWoILiGmfoOcIXtmt2ts82oqaN1HFeLD62Iv4sZh
+2J9ka87YeJU02/rRlPXphm72j4kJylsPsBn2mEnRMvkuffjebbOUAJ7B954RQqvz
+99MJRJ4/VhJ0GHpKijNPak2TArIGJ4HFIsyXOGLaaqjS2FpbyfU2fz19nrJPR/uh
+WdAgA3cniL2kPAh2FSUVPhjg87fdthaV3ZTle97mETO2AQVLO+abm35bPdPmNllS
+OX8Ix+fat+QkIh0FZyyUv0XajgYY6pxAj6esRdQ/tUfFCgQsXAhNnBG0Ozc1UiKd
+I1ZTeiDiJNndG8pEUyHFJrzXXRGlZsYXydZZXhYIXXpOrVxwxp5Ies4XvrTVSOwC
+KUpvlTQwIEnDPi3lnrV/uYngvqOVeaphj3pXeMPjCoipFziOmsAfUHp30PLjB5sg
+AJO/ygz+leKzWF2Gi43w
+=WImS
+-----END PGP SIGNATURE-----
diff --git a/share/security/patches/SA-14:23/openssl-8.4.patch b/share/security/patches/SA-14:23/openssl-8.4.patch
new file mode 100644
index 0000000000..0e101e587b
--- /dev/null
+++ b/share/security/patches/SA-14:23/openssl-8.4.patch
@@ -0,0 +1,804 @@
+Index: crypto/openssl/apps/s_cb.c
+===================================================================
+--- crypto/openssl/apps/s_cb.c	(revision 273303)
++++ crypto/openssl/apps/s_cb.c	(working copy)
+@@ -518,6 +518,24 @@ void MS_CALLBACK msg_cb(int write_p, int version,
+ 				case 100:
+ 					str_details2 = " no_renegotiation";
+ 					break;
++				case 110:
++					str_details2 = " unsupported_extension";
++					break;
++				case 111:
++					str_details2 = " certificate_unobtainable";
++					break;
++				case 112:
++					str_details2 = " unrecognized_name";
++					break;
++				case 113:
++					str_details2 = " bad_certificate_status_response";
++					break;
++				case 114:
++					str_details2 = " bad_certificate_hash_value";
++					break;
++				case 115:
++					str_details2 = " unknown_psk_identity";
++					break;
+ 					}
+ 				}
+ 			}
+Index: crypto/openssl/apps/s_client.c
+===================================================================
+--- crypto/openssl/apps/s_client.c	(revision 273303)
++++ crypto/openssl/apps/s_client.c	(working copy)
+@@ -226,6 +226,7 @@ static void sc_usage(void)
+ 	BIO_printf(bio_err," -ssl3         - just use SSLv3\n");
+ 	BIO_printf(bio_err," -tls1         - just use TLSv1\n");
+ 	BIO_printf(bio_err," -dtls1        - just use DTLSv1\n");    
++	BIO_printf(bio_err," -fallback_scsv - send TLS_FALLBACK_SCSV\n");
+ 	BIO_printf(bio_err," -mtu          - set the link layer MTU\n");
+ 	BIO_printf(bio_err," -no_tls1/-no_ssl3/-no_ssl2 - turn off that protocol\n");
+ 	BIO_printf(bio_err," -bugs         - Switch on all SSL implementation bug workarounds\n");
+@@ -339,6 +340,7 @@ int MAIN(int argc, char **argv)
+ 	char *sess_out = NULL;
+ 	struct sockaddr peer;
+ 	int peerlen = sizeof(peer);
++	int fallback_scsv = 0;
+ 	int enable_timeouts = 0 ;
+ 	long socket_mtu = 0;
+ #ifndef OPENSSL_NO_JPAKE
+@@ -488,6 +490,10 @@ int MAIN(int argc, char **argv)
+ 			socket_mtu = atol(*(++argv));
+ 			}
+ #endif
++		else if (strcmp(*argv,"-fallback_scsv") == 0)
++			{
++			fallback_scsv = 1;
++			}
+ 		else if (strcmp(*argv,"-bugs") == 0)
+ 			bugs=1;
+ 		else if	(strcmp(*argv,"-keyform") == 0)
+@@ -778,6 +784,10 @@ bad:
+ 		SSL_set_session(con, sess);
+ 		SSL_SESSION_free(sess);
+ 		}
++
++	if (fallback_scsv)
++		SSL_set_mode(con, SSL_MODE_SEND_FALLBACK_SCSV);
++
+ #ifndef OPENSSL_NO_TLSEXT
+ 	if (servername != NULL)
+ 		{
+Index: crypto/openssl/crypto/err/openssl.ec
+===================================================================
+--- crypto/openssl/crypto/err/openssl.ec	(revision 273303)
++++ crypto/openssl/crypto/err/openssl.ec	(working copy)
+@@ -69,8 +69,14 @@ R SSL_R_TLSV1_ALERT_EXPORT_RESTRICTION		1060
+ R SSL_R_TLSV1_ALERT_PROTOCOL_VERSION		1070
+ R SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY	1071
+ R SSL_R_TLSV1_ALERT_INTERNAL_ERROR		1080
++R SSL_R_TLSV1_ALERT_INAPPROPRIATE_FALLBACK	1086
+ R SSL_R_TLSV1_ALERT_USER_CANCELLED		1090
+ R SSL_R_TLSV1_ALERT_NO_RENEGOTIATION		1100
++R SSL_R_TLSV1_UNSUPPORTED_EXTENSION		1110
++R SSL_R_TLSV1_CERTIFICATE_UNOBTAINABLE		1111
++R SSL_R_TLSV1_UNRECOGNIZED_NAME			1112
++R SSL_R_TLSV1_BAD_CERTIFICATE_STATUS_RESPONSE	1113
++R SSL_R_TLSV1_BAD_CERTIFICATE_HASH_VALUE	1114
+ 
+ R RSAREF_R_CONTENT_ENCODING			0x0400
+ R RSAREF_R_DATA					0x0401
+Index: crypto/openssl/doc/apps/s_client.pod
+===================================================================
+--- crypto/openssl/doc/apps/s_client.pod	(revision 273303)
++++ crypto/openssl/doc/apps/s_client.pod	(working copy)
+@@ -34,6 +34,7 @@ B<openssl> B<s_client>
+ [B<-no_ssl2>]
+ [B<-no_ssl3>]
+ [B<-no_tls1>]
++[B<-fallback_scsv>]
+ [B<-bugs>]
+ [B<-cipher cipherlist>]
+ [B<-starttls protocol>]
+@@ -167,11 +168,14 @@ these options disable the use of certain SSL or TL
+ the initial handshake uses a method which should be compatible with all
+ servers and permit them to use SSL v3, SSL v2 or TLS as appropriate.
+ 
+-Unfortunately there are a lot of ancient and broken servers in use which
++Unfortunately there are still ancient and broken servers in use which
+ cannot handle this technique and will fail to connect. Some servers only
+-work if TLS is turned off with the B<-no_tls> option others will only
+-support SSL v2 and may need the B<-ssl2> option.
++work if TLS is turned off.
+ 
++=item B<-fallback_scsv>
++
++Send TLS_FALLBACK_SCSV in the ClientHello.
++
+ =item B<-bugs>
+ 
+ there are several known bug in SSL and TLS implementations. Adding this
+Index: crypto/openssl/doc/ssl/SSL_CTX_set_mode.pod
+===================================================================
+--- crypto/openssl/doc/ssl/SSL_CTX_set_mode.pod	(revision 273303)
++++ crypto/openssl/doc/ssl/SSL_CTX_set_mode.pod	(working copy)
+@@ -61,6 +61,12 @@ deal with read/write operations returning without
+ flag SSL_MODE_AUTO_RETRY will cause read/write operations to only
+ return after the handshake and successful completion.
+ 
++=item SSL_MODE_FALLBACK_SCSV
++
++Send TLS_FALLBACK_SCSV in the ClientHello.
++To be set by applications that reconnect with a downgraded protocol
++version; see draft-ietf-tls-downgrade-scsv-00 for details.
++
+ =back
+ 
+ =head1 RETURN VALUES
+Index: crypto/openssl/ssl/d1_lib.c
+===================================================================
+--- crypto/openssl/ssl/d1_lib.c	(revision 273303)
++++ crypto/openssl/ssl/d1_lib.c	(working copy)
+@@ -301,6 +301,16 @@ long dtls1_ctrl(SSL *s, int cmd, long larg, void *
+ 	case DTLS_CTRL_LISTEN:
+ 		ret = dtls1_listen(s, parg);
+ 		break;
++	case SSL_CTRL_CHECK_PROTO_VERSION:
++		/* For library-internal use; checks that the current protocol
++		 * is the highest enabled version (according to s->ctx->method,
++		 * as version negotiation may have changed s->method). */
++#if DTLS_MAX_VERSION != DTLS1_VERSION
++#  error Code needs update for DTLS_method() support beyond DTLS1_VERSION.
++#endif
++		/* Just one protocol version is supported so far;
++		 * fail closed if the version is not as expected. */
++		return s->version == DTLS_MAX_VERSION;
+ 
+ 	default:
+ 		ret = ssl3_ctrl(s, cmd, larg, parg);
+Index: crypto/openssl/ssl/dtls1.h
+===================================================================
+--- crypto/openssl/ssl/dtls1.h	(revision 273303)
++++ crypto/openssl/ssl/dtls1.h	(working copy)
+@@ -80,6 +80,8 @@ extern "C" {
+ #endif
+ 
+ #define DTLS1_VERSION			0xFEFF
++#define DTLS_MAX_VERSION		DTLS1_VERSION
++
+ #define DTLS1_BAD_VER			0x0100
+ 
+ #if 0
+@@ -262,4 +264,3 @@ typedef struct dtls1_record_data_st
+ }
+ #endif
+ #endif
+-
+Index: crypto/openssl/ssl/s23_clnt.c
+===================================================================
+--- crypto/openssl/ssl/s23_clnt.c	(revision 273303)
++++ crypto/openssl/ssl/s23_clnt.c	(working copy)
+@@ -72,9 +72,11 @@ static SSL_METHOD *ssl23_get_client_method(int ver
+ 	if (ver == SSL2_VERSION)
+ 		return(SSLv2_client_method());
+ #endif
++#ifndef OPENSSL_NO_SSL3
+ 	if (ver == SSL3_VERSION)
+ 		return(SSLv3_client_method());
+-	else if (ver == TLS1_VERSION)
++#endif
++	if (ver == TLS1_VERSION)
+ 		return(TLSv1_client_method());
+ 	else
+ 		return(NULL);
+@@ -509,7 +511,7 @@ static int ssl23_get_server_hello(SSL *s)
+ 			/* use special padding (SSL 3.0 draft/RFC 2246, App. E.2) */
+ 			s->s2->ssl2_rollback=1;
+ 
+-		/* setup the 5 bytes we have read so we get them from
++		/* setup the 7 bytes we have read so we get them from
+ 		 * the sslv2 buffer */
+ 		s->rstate=SSL_ST_READ_HEADER;
+ 		s->packet_length=n;
+@@ -525,28 +527,15 @@ static int ssl23_get_server_hello(SSL *s)
+ 		s->handshake_func=s->method->ssl_connect;
+ #endif
+ 		}
+-	else if ((p[0] == SSL3_RT_HANDSHAKE) &&
+-		 (p[1] == SSL3_VERSION_MAJOR) &&
+-		 ((p[2] == SSL3_VERSION_MINOR) ||
+-		  (p[2] == TLS1_VERSION_MINOR)) &&
+-		 (p[5] == SSL3_MT_SERVER_HELLO))
++	else if (p[1] == SSL3_VERSION_MAJOR &&
++	         ((p[2] == SSL3_VERSION_MINOR) ||
++                  (p[2] == TLS1_VERSION_MINOR)) &&
++	         ((p[0] == SSL3_RT_HANDSHAKE && p[5] == SSL3_MT_SERVER_HELLO) ||
++	          (p[0] == SSL3_RT_ALERT && p[3] == 0 && p[4] == 2)))
+ 		{
+-		/* we have sslv3 or tls1 */
++		/* we have sslv3 or tls1 (server hello or alert) */
+ 
+-		if (!ssl_init_wbio_buffer(s,1)) goto err;
+-
+-		/* we are in this state */
+-		s->state=SSL3_ST_CR_SRVR_HELLO_A;
+-
+-		/* put the 5 bytes we have read into the input buffer
+-		 * for SSLv3 */
+-		s->rstate=SSL_ST_READ_HEADER;
+-		s->packet_length=n;
+-		s->packet= &(s->s3->rbuf.buf[0]);
+-		memcpy(s->packet,buf,n);
+-		s->s3->rbuf.left=n;
+-		s->s3->rbuf.offset=0;
+-
++#ifndef OPENSSL_NO_SSL3
+ 		if ((p[2] == SSL3_VERSION_MINOR) &&
+ 			!(s->options & SSL_OP_NO_SSLv3))
+ 			{
+@@ -561,7 +550,9 @@ static int ssl23_get_server_hello(SSL *s)
+ 			s->version=SSL3_VERSION;
+ 			s->method=SSLv3_client_method();
+ 			}
+-		else if ((p[2] == TLS1_VERSION_MINOR) &&
++		else
++#endif
++		if ((p[2] == TLS1_VERSION_MINOR) &&
+ 			!(s->options & SSL_OP_NO_TLSv1))
+ 			{
+ 			s->version=TLS1_VERSION;
+@@ -572,35 +563,55 @@ static int ssl23_get_server_hello(SSL *s)
+ 			SSLerr(SSL_F_SSL23_GET_SERVER_HELLO,SSL_R_UNSUPPORTED_PROTOCOL);
+ 			goto err;
+ 			}
++
++		/* ensure that TLS_MAX_VERSION is up-to-date */
++		OPENSSL_assert(s->version <= TLS_MAX_VERSION);
++
++		if (p[0] == SSL3_RT_ALERT && p[5] != SSL3_AL_WARNING)
++			{
++			/* fatal alert */
++
++			void (*cb)(const SSL *ssl,int type,int val)=NULL;
++			int j;
++
++			if (s->info_callback != NULL)
++				cb=s->info_callback;
++			else if (s->ctx->info_callback != NULL)
++				cb=s->ctx->info_callback;
++ 
++			i=p[5];
++			if (cb != NULL)
++				{
++				j=(i<<8)|p[6];
++				cb(s,SSL_CB_READ_ALERT,j);
++				}
+ 			
+-		s->handshake_func=s->method->ssl_connect;
+-		}
+-	else if ((p[0] == SSL3_RT_ALERT) &&
+-		 (p[1] == SSL3_VERSION_MAJOR) &&
+-		 ((p[2] == SSL3_VERSION_MINOR) ||
+-		  (p[2] == TLS1_VERSION_MINOR)) &&
+-		 (p[3] == 0) &&
+-		 (p[4] == 2))
+-		{
+-		void (*cb)(const SSL *ssl,int type,int val)=NULL;
+-		int j;
++			if (s->msg_callback)
++				s->msg_callback(0, s->version, SSL3_RT_ALERT, p+5, 2, s, s->msg_callback_arg);
+ 
+-		/* An alert */
+-		if (s->info_callback != NULL)
+-			cb=s->info_callback;
+-		else if (s->ctx->info_callback != NULL)
+-			cb=s->ctx->info_callback;
+- 
+-		i=p[5];
+-		if (cb != NULL)
+-			{
+-			j=(i<<8)|p[6];
+-			cb(s,SSL_CB_READ_ALERT,j);
++			s->rwstate=SSL_NOTHING;
++			SSLerr(SSL_F_SSL23_GET_SERVER_HELLO,SSL_AD_REASON_OFFSET+p[6]);
++			goto err;
+ 			}
+ 
+-		s->rwstate=SSL_NOTHING;
+-		SSLerr(SSL_F_SSL23_GET_SERVER_HELLO,SSL_AD_REASON_OFFSET+p[6]);
+-		goto err;
++		if (!ssl_init_wbio_buffer(s,1)) goto err;
++
++		/* we are in this state */
++		s->state=SSL3_ST_CR_SRVR_HELLO_A;
++
++		/* put the 7 bytes we have read into the input buffer
++		 * for SSLv3 */
++		s->rstate=SSL_ST_READ_HEADER;
++		s->packet_length=n;
++		if (s->s3->rbuf.buf == NULL)
++			if (!ssl3_setup_buffers(s))
++				goto err;
++		s->packet= &(s->s3->rbuf.buf[0]);
++		memcpy(s->packet,buf,n);
++		s->s3->rbuf.left=n;
++		s->s3->rbuf.offset=0;
++
++		s->handshake_func=s->method->ssl_connect;
+ 		}
+ 	else
+ 		{
+Index: crypto/openssl/ssl/s23_srvr.c
+===================================================================
+--- crypto/openssl/ssl/s23_srvr.c	(revision 273303)
++++ crypto/openssl/ssl/s23_srvr.c	(working copy)
+@@ -124,9 +124,11 @@ static SSL_METHOD *ssl23_get_server_method(int ver
+ 	if (ver == SSL2_VERSION)
+ 		return(SSLv2_server_method());
+ #endif
++#ifndef OPENSSL_NO_SSL3
+ 	if (ver == SSL3_VERSION)
+ 		return(SSLv3_server_method());
+-	else if (ver == TLS1_VERSION)
++#endif
++	if (ver == TLS1_VERSION)
+ 		return(TLSv1_server_method());
+ 	else
+ 		return(NULL);
+@@ -398,6 +400,9 @@ int ssl23_get_client_hello(SSL *s)
+ 		}
+ #endif
+ 
++	/* ensure that TLS_MAX_VERSION is up-to-date */
++	OPENSSL_assert(s->version <= TLS_MAX_VERSION);
++
+ 	if (s->state == SSL23_ST_SR_CLNT_HELLO_B)
+ 		{
+ 		/* we have SSLv3/TLSv1 in an SSLv2 header
+@@ -554,6 +559,12 @@ int ssl23_get_client_hello(SSL *s)
+ 	if ((type == 2) || (type == 3))
+ 		{
+ 		/* we have SSLv3/TLSv1 (type 2: SSL2 style, type 3: SSL3/TLS style) */
++                s->method = ssl23_get_server_method(s->version);
++		if (s->method == NULL)
++			{
++			SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_UNSUPPORTED_PROTOCOL);
++			goto err;
++			}
+ 
+ 		if (!ssl_init_wbio_buffer(s,1)) goto err;
+ 
+@@ -577,11 +588,6 @@ int ssl23_get_client_hello(SSL *s)
+ 			s->s3->rbuf.left=0;
+ 			s->s3->rbuf.offset=0;
+ 			}
+-
+-		if (s->version == TLS1_VERSION)
+-			s->method = TLSv1_server_method();
+-		else
+-			s->method = SSLv3_server_method();
+ #if 0 /* ssl3_get_client_hello does this */
+ 		s->client_version=(v[0]<<8)|v[1];
+ #endif
+Index: crypto/openssl/ssl/s2_lib.c
+===================================================================
+--- crypto/openssl/ssl/s2_lib.c	(revision 273303)
++++ crypto/openssl/ssl/s2_lib.c	(working copy)
+@@ -314,6 +314,8 @@ long ssl2_ctrl(SSL *s, int cmd, long larg, void *p
+ 	case SSL_CTRL_GET_SESSION_REUSED:
+ 		ret=s->hit;
+ 		break;
++	case SSL_CTRL_CHECK_PROTO_VERSION:
++		return ssl3_ctrl(s, SSL_CTRL_CHECK_PROTO_VERSION, larg, parg);
+ 	default:
+ 		break;
+ 		}
+@@ -362,7 +364,7 @@ int ssl2_put_cipher_by_char(const SSL_CIPHER *c, u
+ 	if (p != NULL)
+ 		{
+ 		l=c->id;
+-		if ((l & 0xff000000) != 0x02000000) return(0);
++		if ((l & 0xff000000) != 0x02000000 && l != SSL3_CK_FALLBACK_SCSV) return(0);
+ 		p[0]=((unsigned char)(l>>16L))&0xFF;
+ 		p[1]=((unsigned char)(l>> 8L))&0xFF;
+ 		p[2]=((unsigned char)(l     ))&0xFF;
+Index: crypto/openssl/ssl/s3_enc.c
+===================================================================
+--- crypto/openssl/ssl/s3_enc.c	(revision 273303)
++++ crypto/openssl/ssl/s3_enc.c	(working copy)
+@@ -758,7 +758,13 @@ int ssl3_alert_code(int code)
+ 	case SSL_AD_INTERNAL_ERROR:	return(SSL3_AD_HANDSHAKE_FAILURE);
+ 	case SSL_AD_USER_CANCELLED:	return(SSL3_AD_HANDSHAKE_FAILURE);
+ 	case SSL_AD_NO_RENEGOTIATION:	return(-1); /* Don't send it :-) */
++	case SSL_AD_UNSUPPORTED_EXTENSION: return(SSL3_AD_HANDSHAKE_FAILURE);
++	case SSL_AD_CERTIFICATE_UNOBTAINABLE: return(SSL3_AD_HANDSHAKE_FAILURE);
++	case SSL_AD_UNRECOGNIZED_NAME:	return(SSL3_AD_HANDSHAKE_FAILURE);
++	case SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE: return(SSL3_AD_HANDSHAKE_FAILURE);
++	case SSL_AD_BAD_CERTIFICATE_HASH_VALUE: return(SSL3_AD_HANDSHAKE_FAILURE);
++	case SSL_AD_UNKNOWN_PSK_IDENTITY:return(TLS1_AD_UNKNOWN_PSK_IDENTITY);
++	case SSL_AD_INAPPROPRIATE_FALLBACK:return(TLS1_AD_INAPPROPRIATE_FALLBACK);
+ 	default:			return(-1);
+ 		}
+ 	}
+-
+Index: crypto/openssl/ssl/s3_lib.c
+===================================================================
+--- crypto/openssl/ssl/s3_lib.c	(revision 273303)
++++ crypto/openssl/ssl/s3_lib.c	(working copy)
+@@ -1981,6 +1981,29 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *p
+ 		break;
+ 
+ #endif /* !OPENSSL_NO_TLSEXT */
++
++	case SSL_CTRL_CHECK_PROTO_VERSION:
++		/* For library-internal use; checks that the current protocol
++		 * is the highest enabled version (according to s->ctx->method,
++		 * as version negotiation may have changed s->method). */
++		if (s->version == s->ctx->method->version)
++			return 1;
++		/* Apparently we're using a version-flexible SSL_METHOD
++		 * (not at its highest protocol version). */
++		if (s->ctx->method->version == SSLv23_method()->version)
++			{
++#if TLS_MAX_VERSION != TLS1_VERSION
++#  error Code needs update for SSLv23_method() support beyond TLS1_VERSION.
++#endif
++			if (!(s->options & SSL_OP_NO_TLSv1))
++				return s->version == TLS1_VERSION;
++			if (!(s->options & SSL_OP_NO_SSLv3))
++				return s->version == SSL3_VERSION;
++			if (!(s->options & SSL_OP_NO_SSLv2))
++				return s->version == SSL2_VERSION;
++			}
++		return 0; /* Unexpected state; fail closed. */
++
+ 	default:
+ 		break;
+ 		}
+@@ -2269,6 +2292,7 @@ long ssl3_ctx_callback_ctrl(SSL_CTX *ctx, int cmd,
+ 		break;
+ 
+ #endif
++
+ 	default:
+ 		return(0);
+ 		}
+Index: crypto/openssl/ssl/ssl.h
+===================================================================
+--- crypto/openssl/ssl/ssl.h	(revision 273303)
++++ crypto/openssl/ssl/ssl.h	(working copy)
+@@ -560,6 +560,10 @@ typedef struct ssl_session_st
+ #define SSL_MODE_AUTO_RETRY 0x00000004L
+ /* Don't attempt to automatically build certificate chain */
+ #define SSL_MODE_NO_AUTO_CHAIN 0x00000008L
++/* Send TLS_FALLBACK_SCSV in the ClientHello.
++ * To be set by applications that reconnect with a downgraded protocol
++ * version; see draft-ietf-tls-downgrade-scsv-00 for details. */
++#define SSL_MODE_SEND_FALLBACK_SCSV 0x00000080L
+ 
+ 
+ /* Note: SSL[_CTX]_set_{options,mode} use |= op on the previous value,
+@@ -1204,6 +1208,9 @@ size_t SSL_get_peer_finished(const SSL *s, void *b
+ #define SSL_AD_CERTIFICATE_UNOBTAINABLE TLS1_AD_CERTIFICATE_UNOBTAINABLE
+ #define SSL_AD_UNRECOGNIZED_NAME	TLS1_AD_UNRECOGNIZED_NAME
+ #define SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE
++#define SSL_AD_BAD_CERTIFICATE_HASH_VALUE TLS1_AD_BAD_CERTIFICATE_HASH_VALUE
++#define SSL_AD_UNKNOWN_PSK_IDENTITY	TLS1_AD_UNKNOWN_PSK_IDENTITY /* fatal */
++#define SSL_AD_INAPPROPRIATE_FALLBACK	TLS1_AD_INAPPROPRIATE_FALLBACK /* fatal */
+ 
+ #define SSL_ERROR_NONE			0
+ #define SSL_ERROR_SSL			1
+@@ -1293,6 +1300,8 @@ size_t SSL_get_peer_finished(const SSL *s, void *b
+ #define SSL_CTRL_CLEAR_OPTIONS			77
+ #define SSL_CTRL_CLEAR_MODE			78
+ 
++#define SSL_CTRL_CHECK_PROTO_VERSION		119
++
+ #define DTLSv1_get_timeout(ssl, arg) \
+ 	SSL_ctrl(ssl,DTLS_CTRL_GET_TIMEOUT,0, (void *)arg)
+ #define DTLSv1_handle_timeout(ssl) \
+@@ -1940,6 +1949,7 @@ void ERR_load_SSL_strings(void);
+ #define SSL_R_HTTPS_PROXY_REQUEST			 155
+ #define SSL_R_HTTP_REQUEST				 156
+ #define SSL_R_ILLEGAL_PADDING				 283
++#define SSL_R_INAPPROPRIATE_FALLBACK			 373
+ #define SSL_R_INVALID_CHALLENGE_LENGTH			 158
+ #define SSL_R_INVALID_COMMAND				 280
+ #define SSL_R_INVALID_PURPOSE				 278
+@@ -2067,6 +2077,7 @@ void ERR_load_SSL_strings(void);
+ #define SSL_R_TLSV1_ALERT_DECRYPTION_FAILED		 1021
+ #define SSL_R_TLSV1_ALERT_DECRYPT_ERROR			 1051
+ #define SSL_R_TLSV1_ALERT_EXPORT_RESTRICTION		 1060
++#define SSL_R_TLSV1_ALERT_INAPPROPRIATE_FALLBACK	 1086
+ #define SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY		 1071
+ #define SSL_R_TLSV1_ALERT_INTERNAL_ERROR		 1080
+ #define SSL_R_TLSV1_ALERT_NO_RENEGOTIATION		 1100
+@@ -2074,6 +2085,11 @@ void ERR_load_SSL_strings(void);
+ #define SSL_R_TLSV1_ALERT_RECORD_OVERFLOW		 1022
+ #define SSL_R_TLSV1_ALERT_UNKNOWN_CA			 1048
+ #define SSL_R_TLSV1_ALERT_USER_CANCELLED		 1090
++#define SSL_R_TLSV1_BAD_CERTIFICATE_HASH_VALUE		 1114
++#define SSL_R_TLSV1_BAD_CERTIFICATE_STATUS_RESPONSE	 1113
++#define SSL_R_TLSV1_CERTIFICATE_UNOBTAINABLE		 1111
++#define SSL_R_TLSV1_UNRECOGNIZED_NAME			 1112
++#define SSL_R_TLSV1_UNSUPPORTED_EXTENSION		 1110
+ #define SSL_R_TLS_CLIENT_CERT_REQ_WITH_ANON_CIPHER	 232
+ #define SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST		 227
+ #define SSL_R_TLS_PEER_DID_NOT_RESPOND_WITH_CERTIFICATE_LIST 233
+Index: crypto/openssl/ssl/ssl3.h
+===================================================================
+--- crypto/openssl/ssl/ssl3.h	(revision 273303)
++++ crypto/openssl/ssl/ssl3.h	(working copy)
+@@ -129,9 +129,14 @@
+ extern "C" {
+ #endif
+ 
+-/* Signalling cipher suite value: from draft-ietf-tls-renegotiation-03.txt */
++/* Signalling cipher suite value from RFC 5746
++ * (TLS_EMPTY_RENEGOTIATION_INFO_SCSV) */
+ #define SSL3_CK_SCSV				0x030000FF
+ 
++/* Signalling cipher suite value from draft-ietf-tls-downgrade-scsv-00
++ * (TLS_FALLBACK_SCSV) */
++#define SSL3_CK_FALLBACK_SCSV			0x03005600
++
+ #define SSL3_CK_RSA_NULL_MD5			0x03000001
+ #define SSL3_CK_RSA_NULL_SHA			0x03000002
+ #define SSL3_CK_RSA_RC4_40_MD5 			0x03000003
+Index: crypto/openssl/ssl/ssl_err.c
+===================================================================
+--- crypto/openssl/ssl/ssl_err.c	(revision 273303)
++++ crypto/openssl/ssl/ssl_err.c	(working copy)
+@@ -341,6 +341,7 @@ static ERR_STRING_DATA SSL_str_reasons[]=
+ {ERR_REASON(SSL_R_HTTPS_PROXY_REQUEST)   ,"https proxy request"},
+ {ERR_REASON(SSL_R_HTTP_REQUEST)          ,"http request"},
+ {ERR_REASON(SSL_R_ILLEGAL_PADDING)       ,"illegal padding"},
++{ERR_REASON(SSL_R_INAPPROPRIATE_FALLBACK),"inappropriate fallback"},
+ {ERR_REASON(SSL_R_INVALID_CHALLENGE_LENGTH),"invalid challenge length"},
+ {ERR_REASON(SSL_R_INVALID_COMMAND)       ,"invalid command"},
+ {ERR_REASON(SSL_R_INVALID_PURPOSE)       ,"invalid purpose"},
+@@ -468,6 +469,7 @@ static ERR_STRING_DATA SSL_str_reasons[]=
+ {ERR_REASON(SSL_R_TLSV1_ALERT_DECRYPTION_FAILED),"tlsv1 alert decryption failed"},
+ {ERR_REASON(SSL_R_TLSV1_ALERT_DECRYPT_ERROR),"tlsv1 alert decrypt error"},
+ {ERR_REASON(SSL_R_TLSV1_ALERT_EXPORT_RESTRICTION),"tlsv1 alert export restriction"},
++{ERR_REASON(SSL_R_TLSV1_ALERT_INAPPROPRIATE_FALLBACK),"tlsv1 alert inappropriate fallback"},
+ {ERR_REASON(SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY),"tlsv1 alert insufficient security"},
+ {ERR_REASON(SSL_R_TLSV1_ALERT_INTERNAL_ERROR),"tlsv1 alert internal error"},
+ {ERR_REASON(SSL_R_TLSV1_ALERT_NO_RENEGOTIATION),"tlsv1 alert no renegotiation"},
+@@ -475,6 +477,11 @@ static ERR_STRING_DATA SSL_str_reasons[]=
+ {ERR_REASON(SSL_R_TLSV1_ALERT_RECORD_OVERFLOW),"tlsv1 alert record overflow"},
+ {ERR_REASON(SSL_R_TLSV1_ALERT_UNKNOWN_CA),"tlsv1 alert unknown ca"},
+ {ERR_REASON(SSL_R_TLSV1_ALERT_USER_CANCELLED),"tlsv1 alert user cancelled"},
++{ERR_REASON(SSL_R_TLSV1_BAD_CERTIFICATE_HASH_VALUE),"tlsv1 bad certificate hash value"},
++{ERR_REASON(SSL_R_TLSV1_BAD_CERTIFICATE_STATUS_RESPONSE),"tlsv1 bad certificate status response"},
++{ERR_REASON(SSL_R_TLSV1_CERTIFICATE_UNOBTAINABLE),"tlsv1 certificate unobtainable"},
++{ERR_REASON(SSL_R_TLSV1_UNRECOGNIZED_NAME),"tlsv1 unrecognized name"},
++{ERR_REASON(SSL_R_TLSV1_UNSUPPORTED_EXTENSION),"tlsv1 unsupported extension"},
+ {ERR_REASON(SSL_R_TLS_CLIENT_CERT_REQ_WITH_ANON_CIPHER),"tls client cert req with anon cipher"},
+ {ERR_REASON(SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST),"tls invalid ecpointformat list"},
+ {ERR_REASON(SSL_R_TLS_PEER_DID_NOT_RESPOND_WITH_CERTIFICATE_LIST),"tls peer did not respond with certificate list"},
+Index: crypto/openssl/ssl/ssl_lib.c
+===================================================================
+--- crypto/openssl/ssl/ssl_lib.c	(revision 273303)
++++ crypto/openssl/ssl/ssl_lib.c	(working copy)
+@@ -1292,6 +1292,8 @@ int ssl_cipher_list_to_bytes(SSL *s,STACK_OF(SSL_C
+ 
+ 	if (sk == NULL) return(0);
+ 	q=p;
++	if (put_cb == NULL)
++		put_cb = s->method->put_cipher_by_char;
+ 
+ 	for (i=0; i<sk_SSL_CIPHER_num(sk); i++)
+ 		{
+@@ -1301,25 +1303,37 @@ int ssl_cipher_list_to_bytes(SSL *s,STACK_OF(SSL_C
+                     continue;
+ #endif /* OPENSSL_NO_KRB5 */                    
+ 
+-		j = put_cb ? put_cb(c,p) : ssl_put_cipher_by_char(s,c,p);
++		j = put_cb(c,p);
+ 		p+=j;
+ 		}
+-	/* If p == q, no ciphers and caller indicates an error. Otherwise
+-	 * add SCSV if not renegotiating.
+-	 */
+-	if (p != q && !s->new_session)
++	/* If p == q, no ciphers; caller indicates an error.
++	 * Otherwise, add applicable SCSVs. */
++	if (p != q)
+ 		{
+-		static SSL_CIPHER scsv =
++		if (!s->new_session)
+ 			{
+-			0, NULL, SSL3_CK_SCSV, 0, 0, 0, 0, 0, 0, 0,
+-			};
+-		j = put_cb ? put_cb(&scsv,p) : ssl_put_cipher_by_char(s,&scsv,p);
+-		p+=j;
++			static SSL_CIPHER scsv =
++				{
++				0, NULL, SSL3_CK_SCSV, 0, 0, 0, 0, 0, 0, 0,
++				};
++			j = put_cb(&scsv,p);
++			p+=j;
+ #ifdef OPENSSL_RI_DEBUG
+-		fprintf(stderr, "SCSV sent by client\n");
++			fprintf(stderr, "TLS_EMPTY_RENEGOTIATION_INFO_SCSV sent by client\n");
+ #endif
+-		}
++			}
+ 
++		if (s->mode & SSL_MODE_SEND_FALLBACK_SCSV)
++			{
++			static SSL_CIPHER scsv =
++				{
++				0, NULL, SSL3_CK_FALLBACK_SCSV, 0, 0, 0, 0, 0, 0, 0,
++				};
++			j = put_cb(&scsv,p);
++			p+=j;
++			}
++ 		}
++
+ 	return(p-q);
+ 	}
+ 
+@@ -1329,11 +1343,12 @@ STACK_OF(SSL_CIPHER) *ssl_bytes_to_cipher_list(SSL
+ 	SSL_CIPHER *c;
+ 	STACK_OF(SSL_CIPHER) *sk;
+ 	int i,n;
++
+ 	if (s->s3)
+ 		s->s3->send_connection_binding = 0;
+ 
+ 	n=ssl_put_cipher_by_char(s,NULL,NULL);
+-	if ((num%n) != 0)
++	if (n == 0 || (num%n) != 0)
+ 		{
+ 		SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST,SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST);
+ 		return(NULL);
+@@ -1348,7 +1363,7 @@ STACK_OF(SSL_CIPHER) *ssl_bytes_to_cipher_list(SSL
+ 
+ 	for (i=0; i<num; i+=n)
+ 		{
+-		/* Check for SCSV */
++		/* Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV */
+ 		if (s->s3 && (n != 3 || !p[0]) &&
+ 			(p[n-2] == ((SSL3_CK_SCSV >> 8) & 0xff)) &&
+ 			(p[n-1] == (SSL3_CK_SCSV & 0xff)))
+@@ -1368,6 +1383,23 @@ STACK_OF(SSL_CIPHER) *ssl_bytes_to_cipher_list(SSL
+ 			continue;
+ 			}
+ 
++		/* Check for TLS_FALLBACK_SCSV */
++		if ((n != 3 || !p[0]) &&
++			(p[n-2] == ((SSL3_CK_FALLBACK_SCSV >> 8) & 0xff)) &&
++			(p[n-1] == (SSL3_CK_FALLBACK_SCSV & 0xff)))
++			{
++			/* The SCSV indicates that the client previously tried a higher version.
++			 * Fail if the current version is an unexpected downgrade. */
++			if (!SSL_ctrl(s, SSL_CTRL_CHECK_PROTO_VERSION, 0, NULL))
++				{
++				SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST,SSL_R_INAPPROPRIATE_FALLBACK);
++				if (s->s3)
++					ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_INAPPROPRIATE_FALLBACK);
++				goto err;
++				}
++			continue;
++			}
++
+ 		c=ssl_get_cipher_by_char(s,p);
+ 		p+=n;
+ 		if (c != NULL)
+Index: crypto/openssl/ssl/ssl_stat.c
+===================================================================
+--- crypto/openssl/ssl/ssl_stat.c	(revision 273303)
++++ crypto/openssl/ssl/ssl_stat.c	(working copy)
+@@ -414,6 +414,12 @@ const char *SSL_alert_desc_string(int value)
+ 	case TLS1_AD_INTERNAL_ERROR:		str="IE"; break;
+ 	case TLS1_AD_USER_CANCELLED:		str="US"; break;
+ 	case TLS1_AD_NO_RENEGOTIATION:		str="NR"; break;
++	case TLS1_AD_UNSUPPORTED_EXTENSION:	str="UE"; break;
++	case TLS1_AD_CERTIFICATE_UNOBTAINABLE:	str="CO"; break;
++	case TLS1_AD_UNRECOGNIZED_NAME:		str="UN"; break;
++	case TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE: str="BR"; break;
++	case TLS1_AD_BAD_CERTIFICATE_HASH_VALUE: str="BH"; break;
++	case TLS1_AD_UNKNOWN_PSK_IDENTITY:	str="UP"; break;
+ 	default:				str="UK"; break;
+ 		}
+ 	return(str);
+@@ -497,6 +503,24 @@ const char *SSL_alert_desc_string_long(int value)
+ 	case TLS1_AD_NO_RENEGOTIATION:
+ 		str="no renegotiation";
+ 		break;
++	case TLS1_AD_UNSUPPORTED_EXTENSION:
++		str="unsupported extension";
++		break;
++	case TLS1_AD_CERTIFICATE_UNOBTAINABLE:
++		str="certificate unobtainable";
++		break;
++	case TLS1_AD_UNRECOGNIZED_NAME:
++		str="unrecognized name";
++		break;
++	case TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE:
++		str="bad certificate status response";
++		break;
++	case TLS1_AD_BAD_CERTIFICATE_HASH_VALUE:
++		str="bad certificate hash value";
++		break;
++	case TLS1_AD_UNKNOWN_PSK_IDENTITY:
++		str="unknown PSK identity";
++		break;
+ 	default: str="unknown"; break;
+ 		}
+ 	return(str);
+Index: crypto/openssl/ssl/t1_enc.c
+===================================================================
+--- crypto/openssl/ssl/t1_enc.c	(revision 273303)
++++ crypto/openssl/ssl/t1_enc.c	(working copy)
+@@ -853,6 +853,13 @@ int tls1_alert_code(int code)
+ 	case SSL_AD_INTERNAL_ERROR:	return(TLS1_AD_INTERNAL_ERROR);
+ 	case SSL_AD_USER_CANCELLED:	return(TLS1_AD_USER_CANCELLED);
+ 	case SSL_AD_NO_RENEGOTIATION:	return(TLS1_AD_NO_RENEGOTIATION);
++	case SSL_AD_UNSUPPORTED_EXTENSION: return(TLS1_AD_UNSUPPORTED_EXTENSION);
++	case SSL_AD_CERTIFICATE_UNOBTAINABLE: return(TLS1_AD_CERTIFICATE_UNOBTAINABLE);
++	case SSL_AD_UNRECOGNIZED_NAME:	return(TLS1_AD_UNRECOGNIZED_NAME);
++	case SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE: return(TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE);
++	case SSL_AD_BAD_CERTIFICATE_HASH_VALUE: return(TLS1_AD_BAD_CERTIFICATE_HASH_VALUE);
++	case SSL_AD_UNKNOWN_PSK_IDENTITY:return(TLS1_AD_UNKNOWN_PSK_IDENTITY);
++	case SSL_AD_INAPPROPRIATE_FALLBACK:return(TLS1_AD_INAPPROPRIATE_FALLBACK);
+ #ifdef DTLS1_AD_MISSING_HANDSHAKE_MESSAGE
+ 	case DTLS1_AD_MISSING_HANDSHAKE_MESSAGE: return 
+ 					  (DTLS1_AD_MISSING_HANDSHAKE_MESSAGE);
+@@ -860,4 +867,3 @@ int tls1_alert_code(int code)
+ 	default:			return(-1);
+ 		}
+ 	}
+-
+Index: crypto/openssl/ssl/t1_lib.c
+===================================================================
+--- crypto/openssl/ssl/t1_lib.c	(revision 273303)
++++ crypto/openssl/ssl/t1_lib.c	(working copy)
+@@ -1013,7 +1013,10 @@ static int tls_decrypt_ticket(SSL *s, const unsign
+ 	HMAC_Final(&hctx, tick_hmac, NULL);
+ 	HMAC_CTX_cleanup(&hctx);
+ 	if (CRYPTO_memcmp(tick_hmac, etick + eticklen, mlen))
++		{
++		EVP_CIPHER_CTX_cleanup(&ctx);
+ 		goto tickerr;
++		}
+ 	/* Attempt to decrypt session data */
+ 	/* Move p after IV to start of encrypted ticket, update length */
+ 	p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
+Index: crypto/openssl/ssl/tls1.h
+===================================================================
+--- crypto/openssl/ssl/tls1.h	(revision 273303)
++++ crypto/openssl/ssl/tls1.h	(working copy)
+@@ -81,6 +81,15 @@ extern "C" {
+ #define TLS1_ALLOW_EXPERIMENTAL_CIPHERSUITES	0
+ 
+ #define TLS1_VERSION			0x0301
++#define TLS1_1_VERSION			0x0302
++#define TLS1_2_VERSION			0x0303
++/* TLS 1.1 and 1.2 are not supported by this version of OpenSSL, so
++ * TLS_MAX_VERSION indicates TLS 1.0 regardless of the above
++ * definitions. (s23_clnt.c and s23_srvr.c have an OPENSSL_assert()
++ * check that would catch the error if TLS_MAX_VERSION was too low.)
++ */
++#define TLS_MAX_VERSION			TLS1_VERSION
++
+ #define TLS1_VERSION_MAJOR		0x03
+ #define TLS1_VERSION_MINOR		0x01
+ 
+@@ -94,6 +103,7 @@ extern "C" {
+ #define TLS1_AD_PROTOCOL_VERSION	70	/* fatal */
+ #define TLS1_AD_INSUFFICIENT_SECURITY	71	/* fatal */
+ #define TLS1_AD_INTERNAL_ERROR		80	/* fatal */
++#define TLS1_AD_INAPPROPRIATE_FALLBACK	86	/* fatal */
+ #define TLS1_AD_USER_CANCELLED		90
+ #define TLS1_AD_NO_RENEGOTIATION	100
+ /* codes 110-114 are from RFC3546 */
+@@ -405,6 +415,3 @@ SSL_CTX_callback_ctrl(ssl,SSL_CTRL_SET_TLSEXT_TICK
+ }
+ #endif
+ #endif
+-
+-
+-
diff --git a/share/security/patches/SA-14:23/openssl-8.4.patch.asc b/share/security/patches/SA-14:23/openssl-8.4.patch.asc
new file mode 100644
index 0000000000..3413fe0e1d
--- /dev/null
+++ b/share/security/patches/SA-14:23/openssl-8.4.patch.asc
@@ -0,0 +1,17 @@
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v1
+
+iQIcBAABAgAGBQJURsQkAAoJEO1n7NZdz2rnRFoQAK7jBPWn7yxIyQGlqa4evqX9
+vRNh3m95mAeQQUKKRBpqR6RkP2a7VMcCQXbRvoJzm/Tpbe+8tfUG1RlmusqFjNse
+Obh/eYaVQrpl+LBfa/at2h1f+dKLe/pkDJc/2ZlHI4LXiM7Jvj1QCfsD+gnyJp3/
+KsGBt51LZWAxwO9h3+Ng7Gdf0xT8/0fJW4ZWTzyTahslgCRAEodiZTvXAzraDnVj
+h67c3KZfdmC5SxKkUl12ngd44naq0A3LSvxnAfktLFFxThgamhjdVawd/EN5Beyd
+1etR5HX3WIH4GjxGqEbZ6uXYN3E4xK2Zx00LPUBvonaI7pwS093Hp3HZeuWW289V
+feTS3r51s0y6sb78SzgKw1jQPDSw9friYxfYKBNGKNuzpLknX0fVNY6wRbeNc0yf
+R3cPan+QiSSLACOG+MhryStMQxvOI1WQORlbCwUo6Ye7ZVI/SK332YOM4q3kyGhU
+m22v3p9FpJ25vWaQoe2iwA6MYXBIbPj42rIKEk8xdCnGvXfmsE5fyYLYvbhzoxbz
+dBzpfhP6QyHXz/1g8Fc/oqpdYhXg7leLOsJVkCbuu9pnMsqtXXoFgeYiUIDFgfvE
+qLLfX1FAoLXQXlkMrDCpaQxtLLL9qDkt3zKkZG6H4kTULiaDH6mE+rhstFo8vURX
+hLvDhCioMwFmK4lWOBD1
+=1Ow8
+-----END PGP SIGNATURE-----
diff --git a/share/security/patches/SA-14:23/openssl-9.3.patch b/share/security/patches/SA-14:23/openssl-9.3.patch
new file mode 100644
index 0000000000..0eaa196719
--- /dev/null
+++ b/share/security/patches/SA-14:23/openssl-9.3.patch
@@ -0,0 +1,595 @@
+Index: crypto/openssl/apps/s_client.c
+===================================================================
+--- crypto/openssl/apps/s_client.c	(revision 273303)
++++ crypto/openssl/apps/s_client.c	(working copy)
+@@ -226,6 +226,7 @@ static void sc_usage(void)
+ 	BIO_printf(bio_err," -ssl3         - just use SSLv3\n");
+ 	BIO_printf(bio_err," -tls1         - just use TLSv1\n");
+ 	BIO_printf(bio_err," -dtls1        - just use DTLSv1\n");    
++	BIO_printf(bio_err," -fallback_scsv - send TLS_FALLBACK_SCSV\n");
+ 	BIO_printf(bio_err," -mtu          - set the link layer MTU\n");
+ 	BIO_printf(bio_err," -no_tls1/-no_ssl3/-no_ssl2 - turn off that protocol\n");
+ 	BIO_printf(bio_err," -bugs         - Switch on all SSL implementation bug workarounds\n");
+@@ -339,6 +340,7 @@ int MAIN(int argc, char **argv)
+ 	char *sess_out = NULL;
+ 	struct sockaddr peer;
+ 	int peerlen = sizeof(peer);
++	int fallback_scsv = 0;
+ 	int enable_timeouts = 0 ;
+ 	long socket_mtu = 0;
+ #ifndef OPENSSL_NO_JPAKE
+@@ -488,6 +490,10 @@ int MAIN(int argc, char **argv)
+ 			socket_mtu = atol(*(++argv));
+ 			}
+ #endif
++		else if (strcmp(*argv,"-fallback_scsv") == 0)
++			{
++			fallback_scsv = 1;
++			}
+ 		else if (strcmp(*argv,"-bugs") == 0)
+ 			bugs=1;
+ 		else if	(strcmp(*argv,"-keyform") == 0)
+@@ -778,6 +784,10 @@ bad:
+ 		SSL_set_session(con, sess);
+ 		SSL_SESSION_free(sess);
+ 		}
++
++	if (fallback_scsv)
++		SSL_set_mode(con, SSL_MODE_SEND_FALLBACK_SCSV);
++
+ #ifndef OPENSSL_NO_TLSEXT
+ 	if (servername != NULL)
+ 		{
+Index: crypto/openssl/crypto/err/openssl.ec
+===================================================================
+--- crypto/openssl/crypto/err/openssl.ec	(revision 273303)
++++ crypto/openssl/crypto/err/openssl.ec	(working copy)
+@@ -69,6 +69,7 @@ R SSL_R_TLSV1_ALERT_EXPORT_RESTRICTION		1060
+ R SSL_R_TLSV1_ALERT_PROTOCOL_VERSION		1070
+ R SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY	1071
+ R SSL_R_TLSV1_ALERT_INTERNAL_ERROR		1080
++R SSL_R_TLSV1_ALERT_INAPPROPRIATE_FALLBACK	1086
+ R SSL_R_TLSV1_ALERT_USER_CANCELLED		1090
+ R SSL_R_TLSV1_ALERT_NO_RENEGOTIATION		1100
+ R SSL_R_TLSV1_UNSUPPORTED_EXTENSION		1110
+Index: crypto/openssl/doc/apps/s_client.pod
+===================================================================
+--- crypto/openssl/doc/apps/s_client.pod	(revision 273303)
++++ crypto/openssl/doc/apps/s_client.pod	(working copy)
+@@ -34,6 +34,7 @@ B<openssl> B<s_client>
+ [B<-no_ssl2>]
+ [B<-no_ssl3>]
+ [B<-no_tls1>]
++[B<-fallback_scsv>]
+ [B<-bugs>]
+ [B<-cipher cipherlist>]
+ [B<-starttls protocol>]
+@@ -167,11 +168,14 @@ these options disable the use of certain SSL or TL
+ the initial handshake uses a method which should be compatible with all
+ servers and permit them to use SSL v3, SSL v2 or TLS as appropriate.
+ 
+-Unfortunately there are a lot of ancient and broken servers in use which
++Unfortunately there are still ancient and broken servers in use which
+ cannot handle this technique and will fail to connect. Some servers only
+-work if TLS is turned off with the B<-no_tls> option others will only
+-support SSL v2 and may need the B<-ssl2> option.
++work if TLS is turned off.
+ 
++=item B<-fallback_scsv>
++
++Send TLS_FALLBACK_SCSV in the ClientHello.
++
+ =item B<-bugs>
+ 
+ there are several known bug in SSL and TLS implementations. Adding this
+Index: crypto/openssl/doc/ssl/SSL_CTX_set_mode.pod
+===================================================================
+--- crypto/openssl/doc/ssl/SSL_CTX_set_mode.pod	(revision 273303)
++++ crypto/openssl/doc/ssl/SSL_CTX_set_mode.pod	(working copy)
+@@ -61,6 +61,12 @@ deal with read/write operations returning without
+ flag SSL_MODE_AUTO_RETRY will cause read/write operations to only
+ return after the handshake and successful completion.
+ 
++=item SSL_MODE_FALLBACK_SCSV
++
++Send TLS_FALLBACK_SCSV in the ClientHello.
++To be set by applications that reconnect with a downgraded protocol
++version; see draft-ietf-tls-downgrade-scsv-00 for details.
++
+ =back
+ 
+ =head1 RETURN VALUES
+Index: crypto/openssl/ssl/d1_lib.c
+===================================================================
+--- crypto/openssl/ssl/d1_lib.c	(revision 273303)
++++ crypto/openssl/ssl/d1_lib.c	(working copy)
+@@ -305,6 +305,16 @@ long dtls1_ctrl(SSL *s, int cmd, long larg, void *
+ 	case DTLS_CTRL_LISTEN:
+ 		ret = dtls1_listen(s, parg);
+ 		break;
++	case SSL_CTRL_CHECK_PROTO_VERSION:
++		/* For library-internal use; checks that the current protocol
++		 * is the highest enabled version (according to s->ctx->method,
++		 * as version negotiation may have changed s->method). */
++#if DTLS_MAX_VERSION != DTLS1_VERSION
++#  error Code needs update for DTLS_method() support beyond DTLS1_VERSION.
++#endif
++		/* Just one protocol version is supported so far;
++		 * fail closed if the version is not as expected. */
++		return s->version == DTLS_MAX_VERSION;
+ 
+ 	default:
+ 		ret = ssl3_ctrl(s, cmd, larg, parg);
+Index: crypto/openssl/ssl/dtls1.h
+===================================================================
+--- crypto/openssl/ssl/dtls1.h	(revision 273303)
++++ crypto/openssl/ssl/dtls1.h	(working copy)
+@@ -80,6 +80,8 @@ extern "C" {
+ #endif
+ 
+ #define DTLS1_VERSION			0xFEFF
++#define DTLS_MAX_VERSION		DTLS1_VERSION
++
+ #define DTLS1_BAD_VER			0x0100
+ 
+ #if 0
+@@ -262,4 +264,3 @@ typedef struct dtls1_record_data_st
+ }
+ #endif
+ #endif
+-
+Index: crypto/openssl/ssl/s23_clnt.c
+===================================================================
+--- crypto/openssl/ssl/s23_clnt.c	(revision 273303)
++++ crypto/openssl/ssl/s23_clnt.c	(working copy)
+@@ -72,9 +72,11 @@ static SSL_METHOD *ssl23_get_client_method(int ver
+ 	if (ver == SSL2_VERSION)
+ 		return(SSLv2_client_method());
+ #endif
++#ifndef OPENSSL_NO_SSL3
+ 	if (ver == SSL3_VERSION)
+ 		return(SSLv3_client_method());
+-	else if (ver == TLS1_VERSION)
++#endif
++	if (ver == TLS1_VERSION)
+ 		return(TLSv1_client_method());
+ 	else
+ 		return(NULL);
+@@ -533,6 +535,7 @@ static int ssl23_get_server_hello(SSL *s)
+ 		{
+ 		/* we have sslv3 or tls1 (server hello or alert) */
+ 
++#ifndef OPENSSL_NO_SSL3
+ 		if ((p[2] == SSL3_VERSION_MINOR) &&
+ 			!(s->options & SSL_OP_NO_SSLv3))
+ 			{
+@@ -547,7 +550,9 @@ static int ssl23_get_server_hello(SSL *s)
+ 			s->version=SSL3_VERSION;
+ 			s->method=SSLv3_client_method();
+ 			}
+-		else if ((p[2] == TLS1_VERSION_MINOR) &&
++		else
++#endif
++		if ((p[2] == TLS1_VERSION_MINOR) &&
+ 			!(s->options & SSL_OP_NO_TLSv1))
+ 			{
+ 			s->version=TLS1_VERSION;
+@@ -559,6 +564,9 @@ static int ssl23_get_server_hello(SSL *s)
+ 			goto err;
+ 			}
+ 
++		/* ensure that TLS_MAX_VERSION is up-to-date */
++		OPENSSL_assert(s->version <= TLS_MAX_VERSION);
++
+ 		if (p[0] == SSL3_RT_ALERT && p[5] != SSL3_AL_WARNING)
+ 			{
+ 			/* fatal alert */
+Index: crypto/openssl/ssl/s23_srvr.c
+===================================================================
+--- crypto/openssl/ssl/s23_srvr.c	(revision 273303)
++++ crypto/openssl/ssl/s23_srvr.c	(working copy)
+@@ -124,9 +124,11 @@ static SSL_METHOD *ssl23_get_server_method(int ver
+ 	if (ver == SSL2_VERSION)
+ 		return(SSLv2_server_method());
+ #endif
++#ifndef OPENSSL_NO_SSL3
+ 	if (ver == SSL3_VERSION)
+ 		return(SSLv3_server_method());
+-	else if (ver == TLS1_VERSION)
++#endif
++	if (ver == TLS1_VERSION)
+ 		return(TLSv1_server_method());
+ 	else
+ 		return(NULL);
+@@ -398,6 +400,9 @@ int ssl23_get_client_hello(SSL *s)
+ 		}
+ #endif
+ 
++	/* ensure that TLS_MAX_VERSION is up-to-date */
++	OPENSSL_assert(s->version <= TLS_MAX_VERSION);
++
+ 	if (s->state == SSL23_ST_SR_CLNT_HELLO_B)
+ 		{
+ 		/* we have SSLv3/TLSv1 in an SSLv2 header
+@@ -554,6 +559,12 @@ int ssl23_get_client_hello(SSL *s)
+ 	if ((type == 2) || (type == 3))
+ 		{
+ 		/* we have SSLv3/TLSv1 (type 2: SSL2 style, type 3: SSL3/TLS style) */
++                s->method = ssl23_get_server_method(s->version);
++		if (s->method == NULL)
++			{
++			SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_UNSUPPORTED_PROTOCOL);
++			goto err;
++			}
+ 
+ 		if (!ssl_init_wbio_buffer(s,1)) goto err;
+ 
+@@ -577,11 +588,6 @@ int ssl23_get_client_hello(SSL *s)
+ 			s->s3->rbuf.left=0;
+ 			s->s3->rbuf.offset=0;
+ 			}
+-
+-		if (s->version == TLS1_VERSION)
+-			s->method = TLSv1_server_method();
+-		else
+-			s->method = SSLv3_server_method();
+ #if 0 /* ssl3_get_client_hello does this */
+ 		s->client_version=(v[0]<<8)|v[1];
+ #endif
+Index: crypto/openssl/ssl/s2_lib.c
+===================================================================
+--- crypto/openssl/ssl/s2_lib.c	(revision 273303)
++++ crypto/openssl/ssl/s2_lib.c	(working copy)
+@@ -314,6 +314,8 @@ long ssl2_ctrl(SSL *s, int cmd, long larg, void *p
+ 	case SSL_CTRL_GET_SESSION_REUSED:
+ 		ret=s->hit;
+ 		break;
++	case SSL_CTRL_CHECK_PROTO_VERSION:
++		return ssl3_ctrl(s, SSL_CTRL_CHECK_PROTO_VERSION, larg, parg);
+ 	default:
+ 		break;
+ 		}
+@@ -362,7 +364,7 @@ int ssl2_put_cipher_by_char(const SSL_CIPHER *c, u
+ 	if (p != NULL)
+ 		{
+ 		l=c->id;
+-		if ((l & 0xff000000) != 0x02000000) return(0);
++		if ((l & 0xff000000) != 0x02000000 && l != SSL3_CK_FALLBACK_SCSV) return(0);
+ 		p[0]=((unsigned char)(l>>16L))&0xFF;
+ 		p[1]=((unsigned char)(l>> 8L))&0xFF;
+ 		p[2]=((unsigned char)(l     ))&0xFF;
+Index: crypto/openssl/ssl/s3_enc.c
+===================================================================
+--- crypto/openssl/ssl/s3_enc.c	(revision 273303)
++++ crypto/openssl/ssl/s3_enc.c	(working copy)
+@@ -764,7 +764,7 @@ int ssl3_alert_code(int code)
+ 	case SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE: return(SSL3_AD_HANDSHAKE_FAILURE);
+ 	case SSL_AD_BAD_CERTIFICATE_HASH_VALUE: return(SSL3_AD_HANDSHAKE_FAILURE);
+ 	case SSL_AD_UNKNOWN_PSK_IDENTITY:return(TLS1_AD_UNKNOWN_PSK_IDENTITY);
++	case SSL_AD_INAPPROPRIATE_FALLBACK:return(TLS1_AD_INAPPROPRIATE_FALLBACK);
+ 	default:			return(-1);
+ 		}
+ 	}
+-
+Index: crypto/openssl/ssl/s3_lib.c
+===================================================================
+--- crypto/openssl/ssl/s3_lib.c	(revision 273303)
++++ crypto/openssl/ssl/s3_lib.c	(working copy)
+@@ -1986,6 +1986,29 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *p
+ 		break;
+ 
+ #endif /* !OPENSSL_NO_TLSEXT */
++
++	case SSL_CTRL_CHECK_PROTO_VERSION:
++		/* For library-internal use; checks that the current protocol
++		 * is the highest enabled version (according to s->ctx->method,
++		 * as version negotiation may have changed s->method). */
++		if (s->version == s->ctx->method->version)
++			return 1;
++		/* Apparently we're using a version-flexible SSL_METHOD
++		 * (not at its highest protocol version). */
++		if (s->ctx->method->version == SSLv23_method()->version)
++			{
++#if TLS_MAX_VERSION != TLS1_VERSION
++#  error Code needs update for SSLv23_method() support beyond TLS1_VERSION.
++#endif
++			if (!(s->options & SSL_OP_NO_TLSv1))
++				return s->version == TLS1_VERSION;
++			if (!(s->options & SSL_OP_NO_SSLv3))
++				return s->version == SSL3_VERSION;
++			if (!(s->options & SSL_OP_NO_SSLv2))
++				return s->version == SSL2_VERSION;
++			}
++		return 0; /* Unexpected state; fail closed. */
++
+ 	default:
+ 		break;
+ 		}
+@@ -2274,6 +2297,7 @@ long ssl3_ctx_callback_ctrl(SSL_CTX *ctx, int cmd,
+ 		break;
+ 
+ #endif
++
+ 	default:
+ 		return(0);
+ 		}
+Index: crypto/openssl/ssl/ssl.h
+===================================================================
+--- crypto/openssl/ssl/ssl.h	(revision 273303)
++++ crypto/openssl/ssl/ssl.h	(working copy)
+@@ -563,6 +563,10 @@ typedef struct ssl_session_st
+ #define SSL_MODE_AUTO_RETRY 0x00000004L
+ /* Don't attempt to automatically build certificate chain */
+ #define SSL_MODE_NO_AUTO_CHAIN 0x00000008L
++/* Send TLS_FALLBACK_SCSV in the ClientHello.
++ * To be set by applications that reconnect with a downgraded protocol
++ * version; see draft-ietf-tls-downgrade-scsv-00 for details. */
++#define SSL_MODE_SEND_FALLBACK_SCSV 0x00000080L
+ 
+ 
+ /* Note: SSL[_CTX]_set_{options,mode} use |= op on the previous value,
+@@ -1209,6 +1213,7 @@ size_t SSL_get_peer_finished(const SSL *s, void *b
+ #define SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE
+ #define SSL_AD_BAD_CERTIFICATE_HASH_VALUE TLS1_AD_BAD_CERTIFICATE_HASH_VALUE
+ #define SSL_AD_UNKNOWN_PSK_IDENTITY	TLS1_AD_UNKNOWN_PSK_IDENTITY /* fatal */
++#define SSL_AD_INAPPROPRIATE_FALLBACK	TLS1_AD_INAPPROPRIATE_FALLBACK /* fatal */
+ 
+ #define SSL_ERROR_NONE			0
+ #define SSL_ERROR_SSL			1
+@@ -1298,6 +1303,8 @@ size_t SSL_get_peer_finished(const SSL *s, void *b
+ #define SSL_CTRL_CLEAR_OPTIONS			77
+ #define SSL_CTRL_CLEAR_MODE			78
+ 
++#define SSL_CTRL_CHECK_PROTO_VERSION		119
++
+ #define DTLSv1_get_timeout(ssl, arg) \
+ 	SSL_ctrl(ssl,DTLS_CTRL_GET_TIMEOUT,0, (void *)arg)
+ #define DTLSv1_handle_timeout(ssl) \
+@@ -1945,6 +1952,7 @@ void ERR_load_SSL_strings(void);
+ #define SSL_R_HTTPS_PROXY_REQUEST			 155
+ #define SSL_R_HTTP_REQUEST				 156
+ #define SSL_R_ILLEGAL_PADDING				 283
++#define SSL_R_INAPPROPRIATE_FALLBACK			 373
+ #define SSL_R_INVALID_CHALLENGE_LENGTH			 158
+ #define SSL_R_INVALID_COMMAND				 280
+ #define SSL_R_INVALID_PURPOSE				 278
+@@ -2072,6 +2080,7 @@ void ERR_load_SSL_strings(void);
+ #define SSL_R_TLSV1_ALERT_DECRYPTION_FAILED		 1021
+ #define SSL_R_TLSV1_ALERT_DECRYPT_ERROR			 1051
+ #define SSL_R_TLSV1_ALERT_EXPORT_RESTRICTION		 1060
++#define SSL_R_TLSV1_ALERT_INAPPROPRIATE_FALLBACK	 1086
+ #define SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY		 1071
+ #define SSL_R_TLSV1_ALERT_INTERNAL_ERROR		 1080
+ #define SSL_R_TLSV1_ALERT_NO_RENEGOTIATION		 1100
+Index: crypto/openssl/ssl/ssl3.h
+===================================================================
+--- crypto/openssl/ssl/ssl3.h	(revision 273303)
++++ crypto/openssl/ssl/ssl3.h	(working copy)
+@@ -129,9 +129,14 @@
+ extern "C" {
+ #endif
+ 
+-/* Signalling cipher suite value: from draft-ietf-tls-renegotiation-03.txt */
++/* Signalling cipher suite value from RFC 5746
++ * (TLS_EMPTY_RENEGOTIATION_INFO_SCSV) */
+ #define SSL3_CK_SCSV				0x030000FF
+ 
++/* Signalling cipher suite value from draft-ietf-tls-downgrade-scsv-00
++ * (TLS_FALLBACK_SCSV) */
++#define SSL3_CK_FALLBACK_SCSV			0x03005600
++
+ #define SSL3_CK_RSA_NULL_MD5			0x03000001
+ #define SSL3_CK_RSA_NULL_SHA			0x03000002
+ #define SSL3_CK_RSA_RC4_40_MD5 			0x03000003
+Index: crypto/openssl/ssl/ssl_err.c
+===================================================================
+--- crypto/openssl/ssl/ssl_err.c	(revision 273303)
++++ crypto/openssl/ssl/ssl_err.c	(working copy)
+@@ -341,6 +341,7 @@ static ERR_STRING_DATA SSL_str_reasons[]=
+ {ERR_REASON(SSL_R_HTTPS_PROXY_REQUEST)   ,"https proxy request"},
+ {ERR_REASON(SSL_R_HTTP_REQUEST)          ,"http request"},
+ {ERR_REASON(SSL_R_ILLEGAL_PADDING)       ,"illegal padding"},
++{ERR_REASON(SSL_R_INAPPROPRIATE_FALLBACK),"inappropriate fallback"},
+ {ERR_REASON(SSL_R_INVALID_CHALLENGE_LENGTH),"invalid challenge length"},
+ {ERR_REASON(SSL_R_INVALID_COMMAND)       ,"invalid command"},
+ {ERR_REASON(SSL_R_INVALID_PURPOSE)       ,"invalid purpose"},
+@@ -468,6 +469,7 @@ static ERR_STRING_DATA SSL_str_reasons[]=
+ {ERR_REASON(SSL_R_TLSV1_ALERT_DECRYPTION_FAILED),"tlsv1 alert decryption failed"},
+ {ERR_REASON(SSL_R_TLSV1_ALERT_DECRYPT_ERROR),"tlsv1 alert decrypt error"},
+ {ERR_REASON(SSL_R_TLSV1_ALERT_EXPORT_RESTRICTION),"tlsv1 alert export restriction"},
++{ERR_REASON(SSL_R_TLSV1_ALERT_INAPPROPRIATE_FALLBACK),"tlsv1 alert inappropriate fallback"},
+ {ERR_REASON(SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY),"tlsv1 alert insufficient security"},
+ {ERR_REASON(SSL_R_TLSV1_ALERT_INTERNAL_ERROR),"tlsv1 alert internal error"},
+ {ERR_REASON(SSL_R_TLSV1_ALERT_NO_RENEGOTIATION),"tlsv1 alert no renegotiation"},
+Index: crypto/openssl/ssl/ssl_lib.c
+===================================================================
+--- crypto/openssl/ssl/ssl_lib.c	(revision 273303)
++++ crypto/openssl/ssl/ssl_lib.c	(working copy)
+@@ -1296,6 +1296,8 @@ int ssl_cipher_list_to_bytes(SSL *s,STACK_OF(SSL_C
+ 
+ 	if (sk == NULL) return(0);
+ 	q=p;
++	if (put_cb == NULL)
++		put_cb = s->method->put_cipher_by_char;
+ 
+ 	for (i=0; i<sk_SSL_CIPHER_num(sk); i++)
+ 		{
+@@ -1305,25 +1307,37 @@ int ssl_cipher_list_to_bytes(SSL *s,STACK_OF(SSL_C
+                     continue;
+ #endif /* OPENSSL_NO_KRB5 */                    
+ 
+-		j = put_cb ? put_cb(c,p) : ssl_put_cipher_by_char(s,c,p);
++		j = put_cb(c,p);
+ 		p+=j;
+ 		}
+-	/* If p == q, no ciphers and caller indicates an error. Otherwise
+-	 * add SCSV if not renegotiating.
+-	 */
+-	if (p != q && !s->new_session)
++	/* If p == q, no ciphers; caller indicates an error.
++	 * Otherwise, add applicable SCSVs. */
++	if (p != q)
+ 		{
+-		static SSL_CIPHER scsv =
++		if (!s->new_session)
+ 			{
+-			0, NULL, SSL3_CK_SCSV, 0, 0, 0, 0, 0, 0, 0,
+-			};
+-		j = put_cb ? put_cb(&scsv,p) : ssl_put_cipher_by_char(s,&scsv,p);
+-		p+=j;
++			static SSL_CIPHER scsv =
++				{
++				0, NULL, SSL3_CK_SCSV, 0, 0, 0, 0, 0, 0, 0,
++				};
++			j = put_cb(&scsv,p);
++			p+=j;
+ #ifdef OPENSSL_RI_DEBUG
+-		fprintf(stderr, "SCSV sent by client\n");
++			fprintf(stderr, "TLS_EMPTY_RENEGOTIATION_INFO_SCSV sent by client\n");
+ #endif
+-		}
++			}
+ 
++		if (s->mode & SSL_MODE_SEND_FALLBACK_SCSV)
++			{
++			static SSL_CIPHER scsv =
++				{
++				0, NULL, SSL3_CK_FALLBACK_SCSV, 0, 0, 0, 0, 0, 0, 0,
++				};
++			j = put_cb(&scsv,p);
++			p+=j;
++			}
++ 		}
++
+ 	return(p-q);
+ 	}
+ 
+@@ -1333,11 +1347,12 @@ STACK_OF(SSL_CIPHER) *ssl_bytes_to_cipher_list(SSL
+ 	SSL_CIPHER *c;
+ 	STACK_OF(SSL_CIPHER) *sk;
+ 	int i,n;
++
+ 	if (s->s3)
+ 		s->s3->send_connection_binding = 0;
+ 
+ 	n=ssl_put_cipher_by_char(s,NULL,NULL);
+-	if ((num%n) != 0)
++	if (n == 0 || (num%n) != 0)
+ 		{
+ 		SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST,SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST);
+ 		return(NULL);
+@@ -1352,7 +1367,7 @@ STACK_OF(SSL_CIPHER) *ssl_bytes_to_cipher_list(SSL
+ 
+ 	for (i=0; i<num; i+=n)
+ 		{
+-		/* Check for SCSV */
++		/* Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV */
+ 		if (s->s3 && (n != 3 || !p[0]) &&
+ 			(p[n-2] == ((SSL3_CK_SCSV >> 8) & 0xff)) &&
+ 			(p[n-1] == (SSL3_CK_SCSV & 0xff)))
+@@ -1372,6 +1387,23 @@ STACK_OF(SSL_CIPHER) *ssl_bytes_to_cipher_list(SSL
+ 			continue;
+ 			}
+ 
++		/* Check for TLS_FALLBACK_SCSV */
++		if ((n != 3 || !p[0]) &&
++			(p[n-2] == ((SSL3_CK_FALLBACK_SCSV >> 8) & 0xff)) &&
++			(p[n-1] == (SSL3_CK_FALLBACK_SCSV & 0xff)))
++			{
++			/* The SCSV indicates that the client previously tried a higher version.
++			 * Fail if the current version is an unexpected downgrade. */
++			if (!SSL_ctrl(s, SSL_CTRL_CHECK_PROTO_VERSION, 0, NULL))
++				{
++				SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST,SSL_R_INAPPROPRIATE_FALLBACK);
++				if (s->s3)
++					ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_INAPPROPRIATE_FALLBACK);
++				goto err;
++				}
++			continue;
++			}
++
+ 		c=ssl_get_cipher_by_char(s,p);
+ 		p+=n;
+ 		if (c != NULL)
+Index: crypto/openssl/ssl/t1_enc.c
+===================================================================
+--- crypto/openssl/ssl/t1_enc.c	(revision 273303)
++++ crypto/openssl/ssl/t1_enc.c	(working copy)
+@@ -855,6 +855,7 @@ int tls1_alert_code(int code)
+ 	case SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE: return(TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE);
+ 	case SSL_AD_BAD_CERTIFICATE_HASH_VALUE: return(TLS1_AD_BAD_CERTIFICATE_HASH_VALUE);
+ 	case SSL_AD_UNKNOWN_PSK_IDENTITY:return(TLS1_AD_UNKNOWN_PSK_IDENTITY);
++	case SSL_AD_INAPPROPRIATE_FALLBACK:return(TLS1_AD_INAPPROPRIATE_FALLBACK);
+ #ifdef DTLS1_AD_MISSING_HANDSHAKE_MESSAGE
+ 	case DTLS1_AD_MISSING_HANDSHAKE_MESSAGE: return 
+ 					  (DTLS1_AD_MISSING_HANDSHAKE_MESSAGE);
+@@ -862,4 +863,3 @@ int tls1_alert_code(int code)
+ 	default:			return(-1);
+ 		}
+ 	}
+-
+Index: crypto/openssl/ssl/t1_lib.c
+===================================================================
+--- crypto/openssl/ssl/t1_lib.c	(revision 273303)
++++ crypto/openssl/ssl/t1_lib.c	(working copy)
+@@ -1101,7 +1101,10 @@ static int tls_decrypt_ticket(SSL *s, const unsign
+ 	HMAC_Final(&hctx, tick_hmac, NULL);
+ 	HMAC_CTX_cleanup(&hctx);
+ 	if (CRYPTO_memcmp(tick_hmac, etick + eticklen, mlen))
++		{
++		EVP_CIPHER_CTX_cleanup(&ctx);
+ 		goto tickerr;
++		}
+ 	/* Attempt to decrypt session data */
+ 	/* Move p after IV to start of encrypted ticket, update length */
+ 	p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
+Index: crypto/openssl/ssl/tls1.h
+===================================================================
+--- crypto/openssl/ssl/tls1.h	(revision 273303)
++++ crypto/openssl/ssl/tls1.h	(working copy)
+@@ -80,17 +80,24 @@ extern "C" {
+ 
+ #define TLS1_ALLOW_EXPERIMENTAL_CIPHERSUITES	0
+ 
++#define TLS1_VERSION			0x0301
++#define TLS1_1_VERSION			0x0302
+ #define TLS1_2_VERSION			0x0303
+-#define TLS1_2_VERSION_MAJOR		0x03
+-#define TLS1_2_VERSION_MINOR		0x03
++/* TLS 1.1 and 1.2 are not supported by this version of OpenSSL, so
++ * TLS_MAX_VERSION indicates TLS 1.0 regardless of the above
++ * definitions. (s23_clnt.c and s23_srvr.c have an OPENSSL_assert()
++ * check that would catch the error if TLS_MAX_VERSION was too low.)
++ */
++#define TLS_MAX_VERSION			TLS1_VERSION
+ 
+-#define TLS1_1_VERSION			0x0302
++#define TLS1_VERSION_MAJOR		0x03
++#define TLS1_VERSION_MINOR		0x01
++
+ #define TLS1_1_VERSION_MAJOR		0x03
+ #define TLS1_1_VERSION_MINOR		0x02
+ 
+-#define TLS1_VERSION			0x0301
+-#define TLS1_VERSION_MAJOR		0x03
+-#define TLS1_VERSION_MINOR		0x01
++#define TLS1_2_VERSION_MAJOR		0x03
++#define TLS1_2_VERSION_MINOR		0x03
+ 
+ #define TLS1_get_version(s) \
+ 		((s->version >> 8) == TLS1_VERSION_MAJOR ? s->version : 0)
+@@ -108,6 +115,7 @@ extern "C" {
+ #define TLS1_AD_PROTOCOL_VERSION	70	/* fatal */
+ #define TLS1_AD_INSUFFICIENT_SECURITY	71	/* fatal */
+ #define TLS1_AD_INTERNAL_ERROR		80	/* fatal */
++#define TLS1_AD_INAPPROPRIATE_FALLBACK	86	/* fatal */
+ #define TLS1_AD_USER_CANCELLED		90
+ #define TLS1_AD_NO_RENEGOTIATION	100
+ /* codes 110-114 are from RFC3546 */
+@@ -419,6 +427,3 @@ SSL_CTX_callback_ctrl(ssl,SSL_CTRL_SET_TLSEXT_TICK
+ }
+ #endif
+ #endif
+-
+-
+-
diff --git a/share/security/patches/SA-14:23/openssl-9.3.patch.asc b/share/security/patches/SA-14:23/openssl-9.3.patch.asc
new file mode 100644
index 0000000000..a24a6d2a74
--- /dev/null
+++ b/share/security/patches/SA-14:23/openssl-9.3.patch.asc
@@ -0,0 +1,17 @@
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v1
+
+iQIcBAABAgAGBQJURsQnAAoJEO1n7NZdz2rnX70P/22A3/E7ANHhWcYJldM/HgI7
+47WrEpNcZGEE2UmJdGZsOuFnpG8/mBVUms6mtgQ7YoKVrJUfiCmKA6rwAM+LbNjd
+druM27MDgg0QQZGEVKCvX0JXoWTJuQzBR/Amw62ccjFHlF9H5tINw1kWJp7yKMAp
+GOzKiSpX8EVlYq/0AP6VGx5GSUmg0ArBSEthdvZn3KPDCyXeK3yjUI5Ss+aaTIq1
+cV1dlxpmVstXoik/a7L0wVHX5fBoe4vvvMDvQioFPdklkNCka/h2L1YdmXBwii5P
+hn83+r+FYc8PL36u1QU4UOP4qVRHapygWhLgIPoNcH1Bo2o/nrBiGnljWdIga+Ge
+nvI2bf1qoX8VSqhx2UUVUYvzAMvpBkURNPHPzGxgExu9d0+/si0/HdPXTEUElhRd
+3b79w7P1PQuTVSIjA/++3IVVQsAa8+8NLlh7ZkSR0cCPnfbpw4wHsa0rWnllrdym
+49lRLS0L0tFUYugEVZCB6+wccT398OCM9NX2chNdIZ8ppN42xj4Al0X2T8w5HbwI
+R93SQJnCf4/B1Eab0TkbCpFeo+tLUnX+LB4t2PygSMtOnWQBF9yFBQSNkL7ZTvMs
+a9f5lEEJiCqjIkO8VJrwm8wZrq3jTKpGReS7cHezZsZ+/NxvEiAQ9k84BKGhSUz2
+Hp6Cl/i/0POI8jssDukG
+=h2PK
+-----END PGP SIGNATURE-----