code: function encrypt_aes_cbc_sha1(record, s) {
    var rval = false;
  
    // append MAC to fragment, update sequence number
    var mac = s.macFunction(s.macKey, s.sequenceNumber, record);
    record.fragment.putBytes(mac);
    s.updateSequenceNumber();
  
    // TLS 1.1+ use an explicit IV every time to protect against CBC attacks
    var iv;
    if(record.version.minor === tls.Versions.TLS_1_0.minor) {
      // use the pre-generated IV when initializing for TLS 1.0, otherwise use
      // the residue from the previous encryption
      iv = s.cipherState.init ? null : s.cipherState.iv;
    } else {
      iv = forge.random.getBytesSync(16);
    }
  
    s.cipherState.init = true;
  
    // start cipher
    var cipher = s.cipherState.cipher;
    cipher.start({iv: iv});
  
    // TLS 1.1+ write IV into output
    if(record.version.minor >= tls.Versions.TLS_1_1.minor) {
      cipher.output.putBytes(iv);
    }
  
    // do encryption (default padding is appropriate)
    cipher.update(record.fragment);
    if(cipher.finish(encrypt_aes_cbc_sha1_padding)) {
      // set record fragment to encrypted output
      record.fragment = cipher.output;
      record.length = record.fragment.length();
      rval = true;
    }
  
    return rval;
  }
docs: Encrypts the TLSCompressed record into a TLSCipherText record using AES
  in CBC mode.
  
  @param record the TLSCompressed record to encrypt.
  @param s the ConnectionState to use.
  
  @return true on success, false on failure.