From fe559b5156519c2b03ad8b64b4e9b5c52d9be121 Mon Sep 17 00:00:00 2001
From: Martin Willi <martin@revosec.ch>
Date: Mon, 6 Sep 2010 17:04:59 +0200
Subject: [PATCH] Accept TLS records with zero-length plaintext

---
 src/libtls/tls_protection.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/libtls/tls_protection.c b/src/libtls/tls_protection.c
index 574e69167..d823bae04 100644
--- a/src/libtls/tls_protection.c
+++ b/src/libtls/tls_protection.c
@@ -168,7 +168,7 @@ METHOD(tls_protection_t, process, status_t,
 		u_int8_t bs;
 
 		bs = this->signer_in->get_block_size(this->signer_in);
-		if (data.len <= bs)
+		if (data.len < bs)
 		{
 			DBG1(DBG_TLS, "TLS record too short to verify MAC");
 			this->alert->add(this->alert, TLS_FATAL, TLS_BAD_RECORD_MAC);