summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authortedu <>2014-04-17 23:35:40 +0000
committertedu <>2014-04-17 23:35:40 +0000
commit288a9e368d9d4a72792b12a00ad69e3592d94073 (patch)
treeef2f2b69483c17a9b88284fba5c8f09ea14b3362
parent934b5ddbd810d7a899481637c58455698974e7e8 (diff)
downloadopenbsd-288a9e368d9d4a72792b12a00ad69e3592d94073.tar.gz
openbsd-288a9e368d9d4a72792b12a00ad69e3592d94073.tar.bz2
openbsd-288a9e368d9d4a72792b12a00ad69e3592d94073.zip
whack a bunch of disabled code. ok beck lteo
Diffstat
-rw-r--r--src/lib/libssl/d1_pkt.c7
-rw-r--r--src/lib/libssl/s23_srvr.c5
-rw-r--r--src/lib/libssl/s3_clnt.c20
-rw-r--r--src/lib/libssl/s3_lib.c169
-rw-r--r--src/lib/libssl/s3_pkt.c14
-rw-r--r--src/lib/libssl/s3_srvr.c18
-rw-r--r--src/lib/libssl/src/ssl/d1_pkt.c7
-rw-r--r--src/lib/libssl/src/ssl/s23_srvr.c5
-rw-r--r--src/lib/libssl/src/ssl/s3_clnt.c20
-rw-r--r--src/lib/libssl/src/ssl/s3_lib.c169
-rw-r--r--src/lib/libssl/src/ssl/s3_pkt.c14
-rw-r--r--src/lib/libssl/src/ssl/s3_srvr.c18
-rw-r--r--src/lib/libssl/src/ssl/ssl_algs.c5
-rw-r--r--src/lib/libssl/src/ssl/ssl_lib.c8
-rw-r--r--src/lib/libssl/ssl_algs.c5
-rw-r--r--src/lib/libssl/ssl_lib.c8
16 files changed, 6 insertions, 486 deletions
diff --git a/src/lib/libssl/d1_pkt.c b/src/lib/libssl/d1_pkt.c
index 69f3d45734..80a4c076bf 100644
--- a/src/lib/libssl/d1_pkt.c
+++ b/src/lib/libssl/d1_pkt.c
@@ -1220,14 +1220,7 @@ start:
1220 1220
1221 if (((s->state&SSL_ST_MASK) == SSL_ST_OK) && 1221 if (((s->state&SSL_ST_MASK) == SSL_ST_OK) &&
1222 !(s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS)) { 1222 !(s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS)) {
1223#if 0 /* worked only because C operator preferences are not as expected (and
1224 * because this is not really needed for clients except for detecting
1225 * protocol violations): */
1226 s->state = SSL_ST_BEFORE |
1227 (s->server) ? SSL_ST_ACCEPT : SSL_ST_CONNECT;
1228#else
1229 s->state = s->server ? SSL_ST_ACCEPT : SSL_ST_CONNECT; 1223 s->state = s->server ? SSL_ST_ACCEPT : SSL_ST_CONNECT;
1230#endif
1231 s->renegotiate = 1; 1224 s->renegotiate = 1;
1232 s->new_session = 1; 1225 s->new_session = 1;
1233 } 1226 }
diff --git a/src/lib/libssl/s23_srvr.c b/src/lib/libssl/s23_srvr.c
index 8010d72fa7..c63ede8680 100644
--- a/src/lib/libssl/s23_srvr.c
+++ b/src/lib/libssl/s23_srvr.c
@@ -324,12 +324,7 @@ ssl23_get_client_hello(SSL *s)
324 * so we simply assume TLS 1.0 to avoid protocol version downgrade 324 * so we simply assume TLS 1.0 to avoid protocol version downgrade
325 * attacks. */ 325 * attacks. */
326 if (p[3] == 0 && p[4] < 6) { 326 if (p[3] == 0 && p[4] < 6) {
327#if 0
328 SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO, SSL_R_RECORD_TOO_SMALL);
329 goto err;
330#else
331 v[1] = TLS1_VERSION_MINOR; 327 v[1] = TLS1_VERSION_MINOR;
332#endif
333 } 328 }
334 /* if major version number > 3 set minor to a value 329 /* if major version number > 3 set minor to a value
335 * which will use the highest version 3 we support. 330 * which will use the highest version 3 we support.
diff --git a/src/lib/libssl/s3_clnt.c b/src/lib/libssl/s3_clnt.c
index abae12a8d1..8aef4b4f3d 100644
--- a/src/lib/libssl/s3_clnt.c
+++ b/src/lib/libssl/s3_clnt.c
@@ -920,15 +920,9 @@ ssl3_get_server_hello(SSL *s)
920 if (s->session->cipher) 920 if (s->session->cipher)
921 s->session->cipher_id = s->session->cipher->id; 921 s->session->cipher_id = s->session->cipher->id;
922 if (s->hit && (s->session->cipher_id != c->id)) { 922 if (s->hit && (s->session->cipher_id != c->id)) {
923/* Workaround is now obsolete */ 923 al = SSL_AD_ILLEGAL_PARAMETER;
924#if 0 924 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED);
925 if (!(s->options & SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG)) 925 goto f_err;
926#endif
927 {
928 al = SSL_AD_ILLEGAL_PARAMETER;
929 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED);
930 goto f_err;
931 }
932 } 926 }
933 s->s3->tmp.new_cipher = c; 927 s->s3->tmp.new_cipher = c;
934 /* Don't digest cached records if TLS v1.2: we may need them for 928 /* Don't digest cached records if TLS v1.2: we may need them for
@@ -1763,14 +1757,6 @@ ssl3_get_certificate_request(SSL *s)
1763 1757
1764 /* get the CA RDNs */ 1758 /* get the CA RDNs */
1765 n2s(p, llen); 1759 n2s(p, llen);
1766#if 0
1767 {
1768 FILE *out;
1769 out = fopen("/tmp/vsign.der", "w");
1770 fwrite(p, 1, llen, out);
1771 fclose(out);
1772 }
1773#endif
1774 1760
1775 if ((unsigned long)(p - d + llen) != n) { 1761 if ((unsigned long)(p - d + llen) != n) {
1776 ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); 1762 ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
diff --git a/src/lib/libssl/s3_lib.c b/src/lib/libssl/s3_lib.c
index 288d885d9e..7833779f6b 100644
--- a/src/lib/libssl/s3_lib.c
+++ b/src/lib/libssl/s3_lib.c
@@ -605,58 +605,6 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
605 168, 605 168,
606 168, 606 168,
607 }, 607 },
608
609/* Fortezza ciphersuite from SSL 3.0 spec */
610#if 0
611/* Cipher 1C */
612 {
613 0,
614 SSL3_TXT_FZA_DMS_NULL_SHA,
615 SSL3_CK_FZA_DMS_NULL_SHA,
616 SSL_kFZA,
617 SSL_aFZA,
618 SSL_eNULL,
619 SSL_SHA1,
620 SSL_SSLV3,
621 SSL_NOT_EXP|SSL_STRONG_NONE,
622 SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
623 0,
624 0,
625 },
626
627/* Cipher 1D */
628 {
629 0,
630 SSL3_TXT_FZA_DMS_FZA_SHA,
631 SSL3_CK_FZA_DMS_FZA_SHA,
632 SSL_kFZA,
633 SSL_aFZA,
634 SSL_eFZA,
635 SSL_SHA1,
636 SSL_SSLV3,
637 SSL_NOT_EXP|SSL_STRONG_NONE,
638 SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
639 0,
640 0,
641 },
642
643/* Cipher 1E */
644 {
645 0,
646 SSL3_TXT_FZA_DMS_RC4_SHA,
647 SSL3_CK_FZA_DMS_RC4_SHA,
648 SSL_kFZA,
649 SSL_aFZA,
650 SSL_RC4,
651 SSL_SHA1,
652 SSL_SSLV3,
653 SSL_NOT_EXP|SSL_MEDIUM,
654 SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
655 128,
656 128,
657 },
658#endif
659
660#ifndef OPENSSL_NO_KRB5 608#ifndef OPENSSL_NO_KRB5
661/* The Kerberos ciphers*/ 609/* The Kerberos ciphers*/
662/* Cipher 1E */ 610/* Cipher 1E */
@@ -1268,123 +1216,6 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
1268 }, 1216 },
1269#endif /* OPENSSL_NO_CAMELLIA */ 1217#endif /* OPENSSL_NO_CAMELLIA */
1270 1218
1271#if TLS1_ALLOW_EXPERIMENTAL_CIPHERSUITES
1272 /* New TLS Export CipherSuites from expired ID */
1273#if 0
1274 /* Cipher 60 */
1275 {
1276 1,
1277 TLS1_TXT_RSA_EXPORT1024_WITH_RC4_56_MD5,
1278 TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_MD5,
1279 SSL_kRSA,
1280 SSL_aRSA,
1281 SSL_RC4,
1282 SSL_MD5,
1283 SSL_TLSV1,
1284 SSL_EXPORT|SSL_EXP56,
1285 SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1286 56,
1287 128,
1288 },
1289
1290 /* Cipher 61 */
1291 {
1292 1,
1293 TLS1_TXT_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5,
1294 TLS1_CK_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5,
1295 SSL_kRSA,
1296 SSL_aRSA,
1297 SSL_RC2,
1298 SSL_MD5,
1299 SSL_TLSV1,
1300 SSL_EXPORT|SSL_EXP56,
1301 SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1302 56,
1303 128,
1304 },
1305#endif
1306
1307 /* Cipher 62 */
1308 {
1309 1,
1310 TLS1_TXT_RSA_EXPORT1024_WITH_DES_CBC_SHA,
1311 TLS1_CK_RSA_EXPORT1024_WITH_DES_CBC_SHA,
1312 SSL_kRSA,
1313 SSL_aRSA,
1314 SSL_DES,
1315 SSL_SHA1,
1316 SSL_TLSV1,
1317 SSL_EXPORT|SSL_EXP56,
1318 SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1319 56,
1320 56,
1321 },
1322
1323 /* Cipher 63 */
1324 {
1325 1,
1326 TLS1_TXT_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA,
1327 TLS1_CK_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA,
1328 SSL_kEDH,
1329 SSL_aDSS,
1330 SSL_DES,
1331 SSL_SHA1,
1332 SSL_TLSV1,
1333 SSL_EXPORT|SSL_EXP56,
1334 SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1335 56,
1336 56,
1337 },
1338
1339 /* Cipher 64 */
1340 {
1341 1,
1342 TLS1_TXT_RSA_EXPORT1024_WITH_RC4_56_SHA,
1343 TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_SHA,
1344 SSL_kRSA,
1345 SSL_aRSA,
1346 SSL_RC4,
1347 SSL_SHA1,
1348 SSL_TLSV1,
1349 SSL_EXPORT|SSL_EXP56,
1350 SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1351 56,
1352 128,
1353 },
1354
1355 /* Cipher 65 */
1356 {
1357 1,
1358 TLS1_TXT_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA,
1359 TLS1_CK_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA,
1360 SSL_kEDH,
1361 SSL_aDSS,
1362 SSL_RC4,
1363 SSL_SHA1,
1364 SSL_TLSV1,
1365 SSL_EXPORT|SSL_EXP56,
1366 SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1367 56,
1368 128,
1369 },
1370
1371 /* Cipher 66 */
1372 {
1373 1,
1374 TLS1_TXT_DHE_DSS_WITH_RC4_128_SHA,
1375 TLS1_CK_DHE_DSS_WITH_RC4_128_SHA,
1376 SSL_kEDH,
1377 SSL_aDSS,
1378 SSL_RC4,
1379 SSL_SHA1,
1380 SSL_TLSV1,
1381 SSL_NOT_EXP|SSL_MEDIUM,
1382 SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1383 128,
1384 128,
1385 },
1386#endif
1387
1388 /* TLS v1.2 ciphersuites */ 1219 /* TLS v1.2 ciphersuites */
1389 /* Cipher 67 */ 1220 /* Cipher 67 */
1390 { 1221 {
diff --git a/src/lib/libssl/s3_pkt.c b/src/lib/libssl/s3_pkt.c
index d6c8756a1a..e901268a34 100644
--- a/src/lib/libssl/s3_pkt.c
+++ b/src/lib/libssl/s3_pkt.c
@@ -313,9 +313,6 @@ again:
313 ssl_minor= *(p++); 313 ssl_minor= *(p++);
314 version = (ssl_major << 8)|ssl_minor; 314 version = (ssl_major << 8)|ssl_minor;
315 n2s(p, rr->length); 315 n2s(p, rr->length);
316#if 0
317 fprintf(stderr, "Record type=%d, Length=%d\n", rr->type, rr->length);
318#endif
319 316
320 /* Lets check version */ 317 /* Lets check version */
321 if (!s->first_packet) { 318 if (!s->first_packet) {
@@ -495,10 +492,6 @@ again:
495 if (rr->length == 0) 492 if (rr->length == 0)
496 goto again; 493 goto again;
497 494
498#if 0
499 fprintf(stderr, "Ultimate Record type=%d, Length=%d\n", rr->type, rr->length);
500#endif
501
502 return (1); 495 return (1);
503 496
504f_err: 497f_err:
@@ -1214,14 +1207,7 @@ start:
1214 if ((s->s3->handshake_fragment_len >= 4) && !s->in_handshake) { 1207 if ((s->s3->handshake_fragment_len >= 4) && !s->in_handshake) {
1215 if (((s->state&SSL_ST_MASK) == SSL_ST_OK) && 1208 if (((s->state&SSL_ST_MASK) == SSL_ST_OK) &&
1216 !(s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS)) { 1209 !(s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS)) {
1217#if 0 /* worked only because C operator preferences are not as expected (and
1218 * because this is not really needed for clients except for detecting
1219 * protocol violations): */
1220 s->state = SSL_ST_BEFORE |
1221 (s->server) ? SSL_ST_ACCEPT : SSL_ST_CONNECT;
1222#else
1223 s->state = s->server ? SSL_ST_ACCEPT : SSL_ST_CONNECT; 1210 s->state = s->server ? SSL_ST_ACCEPT : SSL_ST_CONNECT;
1224#endif
1225 s->renegotiate = 1; 1211 s->renegotiate = 1;
1226 s->new_session = 1; 1212 s->new_session = 1;
1227 } 1213 }
diff --git a/src/lib/libssl/s3_srvr.c b/src/lib/libssl/s3_srvr.c
index 19e0495fe6..79b89d7e95 100644
--- a/src/lib/libssl/s3_srvr.c
+++ b/src/lib/libssl/s3_srvr.c
@@ -1129,24 +1129,6 @@ ssl3_get_client_hello(SSL *s)
1129 break; 1129 break;
1130 } 1130 }
1131 } 1131 }
1132/*
1133 * Disabled because it can be used in a ciphersuite downgrade
1134 * attack: CVE-2010-4180.
1135 */
1136#if 0
1137 if (j == 0 && (s->options & SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG) && (sk_SSL_CIPHER_num(ciphers) == 1)) {
1138 /* Special case as client bug workaround: the previously used cipher may
1139 * not be in the current list, the client instead might be trying to
1140 * continue using a cipher that before wasn't chosen due to server
1141 * preferences. We'll have to reject the connection if the cipher is not
1142 * enabled, though. */
1143 c = sk_SSL_CIPHER_value(ciphers, 0);
1144 if (sk_SSL_CIPHER_find(SSL_get_ciphers(s), c) >= 0) {
1145 s->session->cipher = c;
1146 j = 1;
1147 }
1148 }
1149#endif
1150 if (j == 0) { 1132 if (j == 0) {
1151 /* we need to have the cipher in the cipher 1133 /* we need to have the cipher in the cipher
1152 * list if we are asked to reuse it */ 1134 * list if we are asked to reuse it */
diff --git a/src/lib/libssl/src/ssl/d1_pkt.c b/src/lib/libssl/src/ssl/d1_pkt.c
index 69f3d45734..80a4c076bf 100644
--- a/src/lib/libssl/src/ssl/d1_pkt.c
+++ b/src/lib/libssl/src/ssl/d1_pkt.c
@@ -1220,14 +1220,7 @@ start:
1220 1220
1221 if (((s->state&SSL_ST_MASK) == SSL_ST_OK) && 1221 if (((s->state&SSL_ST_MASK) == SSL_ST_OK) &&
1222 !(s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS)) { 1222 !(s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS)) {
1223#if 0 /* worked only because C operator preferences are not as expected (and
1224 * because this is not really needed for clients except for detecting
1225 * protocol violations): */
1226 s->state = SSL_ST_BEFORE |
1227 (s->server) ? SSL_ST_ACCEPT : SSL_ST_CONNECT;
1228#else
1229 s->state = s->server ? SSL_ST_ACCEPT : SSL_ST_CONNECT; 1223 s->state = s->server ? SSL_ST_ACCEPT : SSL_ST_CONNECT;
1230#endif
1231 s->renegotiate = 1; 1224 s->renegotiate = 1;
1232 s->new_session = 1; 1225 s->new_session = 1;
1233 } 1226 }
diff --git a/src/lib/libssl/src/ssl/s23_srvr.c b/src/lib/libssl/src/ssl/s23_srvr.c
index 8010d72fa7..c63ede8680 100644
--- a/src/lib/libssl/src/ssl/s23_srvr.c
+++ b/src/lib/libssl/src/ssl/s23_srvr.c
@@ -324,12 +324,7 @@ ssl23_get_client_hello(SSL *s)
324 * so we simply assume TLS 1.0 to avoid protocol version downgrade 324 * so we simply assume TLS 1.0 to avoid protocol version downgrade
325 * attacks. */ 325 * attacks. */
326 if (p[3] == 0 && p[4] < 6) { 326 if (p[3] == 0 && p[4] < 6) {
327#if 0
328 SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO, SSL_R_RECORD_TOO_SMALL);
329 goto err;
330#else
331 v[1] = TLS1_VERSION_MINOR; 327 v[1] = TLS1_VERSION_MINOR;
332#endif
333 } 328 }
334 /* if major version number > 3 set minor to a value 329 /* if major version number > 3 set minor to a value
335 * which will use the highest version 3 we support. 330 * which will use the highest version 3 we support.
diff --git a/src/lib/libssl/src/ssl/s3_clnt.c b/src/lib/libssl/src/ssl/s3_clnt.c
index abae12a8d1..8aef4b4f3d 100644
--- a/src/lib/libssl/src/ssl/s3_clnt.c
+++ b/src/lib/libssl/src/ssl/s3_clnt.c
@@ -920,15 +920,9 @@ ssl3_get_server_hello(SSL *s)
920 if (s->session->cipher) 920 if (s->session->cipher)
921 s->session->cipher_id = s->session->cipher->id; 921 s->session->cipher_id = s->session->cipher->id;
922 if (s->hit && (s->session->cipher_id != c->id)) { 922 if (s->hit && (s->session->cipher_id != c->id)) {
923/* Workaround is now obsolete */ 923 al = SSL_AD_ILLEGAL_PARAMETER;
924#if 0 924 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED);
925 if (!(s->options & SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG)) 925 goto f_err;
926#endif
927 {
928 al = SSL_AD_ILLEGAL_PARAMETER;
929 SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED);
930 goto f_err;
931 }
932 } 926 }
933 s->s3->tmp.new_cipher = c; 927 s->s3->tmp.new_cipher = c;
934 /* Don't digest cached records if TLS v1.2: we may need them for 928 /* Don't digest cached records if TLS v1.2: we may need them for
@@ -1763,14 +1757,6 @@ ssl3_get_certificate_request(SSL *s)
1763 1757
1764 /* get the CA RDNs */ 1758 /* get the CA RDNs */
1765 n2s(p, llen); 1759 n2s(p, llen);
1766#if 0
1767 {
1768 FILE *out;
1769 out = fopen("/tmp/vsign.der", "w");
1770 fwrite(p, 1, llen, out);
1771 fclose(out);
1772 }
1773#endif
1774 1760
1775 if ((unsigned long)(p - d + llen) != n) { 1761 if ((unsigned long)(p - d + llen) != n) {
1776 ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR); 1762 ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
diff --git a/src/lib/libssl/src/ssl/s3_lib.c b/src/lib/libssl/src/ssl/s3_lib.c
index 288d885d9e..7833779f6b 100644
--- a/src/lib/libssl/src/ssl/s3_lib.c
+++ b/src/lib/libssl/src/ssl/s3_lib.c
@@ -605,58 +605,6 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
605 168, 605 168,
606 168, 606 168,
607 }, 607 },
608
609/* Fortezza ciphersuite from SSL 3.0 spec */
610#if 0
611/* Cipher 1C */
612 {
613 0,
614 SSL3_TXT_FZA_DMS_NULL_SHA,
615 SSL3_CK_FZA_DMS_NULL_SHA,
616 SSL_kFZA,
617 SSL_aFZA,
618 SSL_eNULL,
619 SSL_SHA1,
620 SSL_SSLV3,
621 SSL_NOT_EXP|SSL_STRONG_NONE,
622 SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
623 0,
624 0,
625 },
626
627/* Cipher 1D */
628 {
629 0,
630 SSL3_TXT_FZA_DMS_FZA_SHA,
631 SSL3_CK_FZA_DMS_FZA_SHA,
632 SSL_kFZA,
633 SSL_aFZA,
634 SSL_eFZA,
635 SSL_SHA1,
636 SSL_SSLV3,
637 SSL_NOT_EXP|SSL_STRONG_NONE,
638 SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
639 0,
640 0,
641 },
642
643/* Cipher 1E */
644 {
645 0,
646 SSL3_TXT_FZA_DMS_RC4_SHA,
647 SSL3_CK_FZA_DMS_RC4_SHA,
648 SSL_kFZA,
649 SSL_aFZA,
650 SSL_RC4,
651 SSL_SHA1,
652 SSL_SSLV3,
653 SSL_NOT_EXP|SSL_MEDIUM,
654 SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
655 128,
656 128,
657 },
658#endif
659
660#ifndef OPENSSL_NO_KRB5 608#ifndef OPENSSL_NO_KRB5
661/* The Kerberos ciphers*/ 609/* The Kerberos ciphers*/
662/* Cipher 1E */ 610/* Cipher 1E */
@@ -1268,123 +1216,6 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
1268 }, 1216 },
1269#endif /* OPENSSL_NO_CAMELLIA */ 1217#endif /* OPENSSL_NO_CAMELLIA */
1270 1218
1271#if TLS1_ALLOW_EXPERIMENTAL_CIPHERSUITES
1272 /* New TLS Export CipherSuites from expired ID */
1273#if 0
1274 /* Cipher 60 */
1275 {
1276 1,
1277 TLS1_TXT_RSA_EXPORT1024_WITH_RC4_56_MD5,
1278 TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_MD5,
1279 SSL_kRSA,
1280 SSL_aRSA,
1281 SSL_RC4,
1282 SSL_MD5,
1283 SSL_TLSV1,
1284 SSL_EXPORT|SSL_EXP56,
1285 SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1286 56,
1287 128,
1288 },
1289
1290 /* Cipher 61 */
1291 {
1292 1,
1293 TLS1_TXT_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5,
1294 TLS1_CK_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5,
1295 SSL_kRSA,
1296 SSL_aRSA,
1297 SSL_RC2,
1298 SSL_MD5,
1299 SSL_TLSV1,
1300 SSL_EXPORT|SSL_EXP56,
1301 SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1302 56,
1303 128,
1304 },
1305#endif
1306
1307 /* Cipher 62 */
1308 {
1309 1,
1310 TLS1_TXT_RSA_EXPORT1024_WITH_DES_CBC_SHA,
1311 TLS1_CK_RSA_EXPORT1024_WITH_DES_CBC_SHA,
1312 SSL_kRSA,
1313 SSL_aRSA,
1314 SSL_DES,
1315 SSL_SHA1,
1316 SSL_TLSV1,
1317 SSL_EXPORT|SSL_EXP56,
1318 SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1319 56,
1320 56,
1321 },
1322
1323 /* Cipher 63 */
1324 {
1325 1,
1326 TLS1_TXT_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA,
1327 TLS1_CK_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA,
1328 SSL_kEDH,
1329 SSL_aDSS,
1330 SSL_DES,
1331 SSL_SHA1,
1332 SSL_TLSV1,
1333 SSL_EXPORT|SSL_EXP56,
1334 SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1335 56,
1336 56,
1337 },
1338
1339 /* Cipher 64 */
1340 {
1341 1,
1342 TLS1_TXT_RSA_EXPORT1024_WITH_RC4_56_SHA,
1343 TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_SHA,
1344 SSL_kRSA,
1345 SSL_aRSA,
1346 SSL_RC4,
1347 SSL_SHA1,
1348 SSL_TLSV1,
1349 SSL_EXPORT|SSL_EXP56,
1350 SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1351 56,
1352 128,
1353 },
1354
1355 /* Cipher 65 */
1356 {
1357 1,
1358 TLS1_TXT_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA,
1359 TLS1_CK_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA,
1360 SSL_kEDH,
1361 SSL_aDSS,
1362 SSL_RC4,
1363 SSL_SHA1,
1364 SSL_TLSV1,
1365 SSL_EXPORT|SSL_EXP56,
1366 SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1367 56,
1368 128,
1369 },
1370
1371 /* Cipher 66 */
1372 {
1373 1,
1374 TLS1_TXT_DHE_DSS_WITH_RC4_128_SHA,
1375 TLS1_CK_DHE_DSS_WITH_RC4_128_SHA,
1376 SSL_kEDH,
1377 SSL_aDSS,
1378 SSL_RC4,
1379 SSL_SHA1,
1380 SSL_TLSV1,
1381 SSL_NOT_EXP|SSL_MEDIUM,
1382 SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
1383 128,
1384 128,
1385 },
1386#endif
1387
1388 /* TLS v1.2 ciphersuites */ 1219 /* TLS v1.2 ciphersuites */
1389 /* Cipher 67 */ 1220 /* Cipher 67 */
1390 { 1221 {
diff --git a/src/lib/libssl/src/ssl/s3_pkt.c b/src/lib/libssl/src/ssl/s3_pkt.c
index d6c8756a1a..e901268a34 100644
--- a/src/lib/libssl/src/ssl/s3_pkt.c
+++ b/src/lib/libssl/src/ssl/s3_pkt.c
@@ -313,9 +313,6 @@ again:
313 ssl_minor= *(p++); 313 ssl_minor= *(p++);
314 version = (ssl_major << 8)|ssl_minor; 314 version = (ssl_major << 8)|ssl_minor;
315 n2s(p, rr->length); 315 n2s(p, rr->length);
316#if 0
317 fprintf(stderr, "Record type=%d, Length=%d\n", rr->type, rr->length);
318#endif
319 316
320 /* Lets check version */ 317 /* Lets check version */
321 if (!s->first_packet) { 318 if (!s->first_packet) {
@@ -495,10 +492,6 @@ again:
495 if (rr->length == 0) 492 if (rr->length == 0)
496 goto again; 493 goto again;
497 494
498#if 0
499 fprintf(stderr, "Ultimate Record type=%d, Length=%d\n", rr->type, rr->length);
500#endif
501
502 return (1); 495 return (1);
503 496
504f_err: 497f_err:
@@ -1214,14 +1207,7 @@ start:
1214 if ((s->s3->handshake_fragment_len >= 4) && !s->in_handshake) { 1207 if ((s->s3->handshake_fragment_len >= 4) && !s->in_handshake) {
1215 if (((s->state&SSL_ST_MASK) == SSL_ST_OK) && 1208 if (((s->state&SSL_ST_MASK) == SSL_ST_OK) &&
1216 !(s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS)) { 1209 !(s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS)) {
1217#if 0 /* worked only because C operator preferences are not as expected (and
1218 * because this is not really needed for clients except for detecting
1219 * protocol violations): */
1220 s->state = SSL_ST_BEFORE |
1221 (s->server) ? SSL_ST_ACCEPT : SSL_ST_CONNECT;
1222#else
1223 s->state = s->server ? SSL_ST_ACCEPT : SSL_ST_CONNECT; 1210 s->state = s->server ? SSL_ST_ACCEPT : SSL_ST_CONNECT;
1224#endif
1225 s->renegotiate = 1; 1211 s->renegotiate = 1;
1226 s->new_session = 1; 1212 s->new_session = 1;
1227 } 1213 }
diff --git a/src/lib/libssl/src/ssl/s3_srvr.c b/src/lib/libssl/src/ssl/s3_srvr.c
index 19e0495fe6..79b89d7e95 100644
--- a/src/lib/libssl/src/ssl/s3_srvr.c
+++ b/src/lib/libssl/src/ssl/s3_srvr.c
@@ -1129,24 +1129,6 @@ ssl3_get_client_hello(SSL *s)
1129 break; 1129 break;
1130 } 1130 }
1131 } 1131 }
1132/*
1133 * Disabled because it can be used in a ciphersuite downgrade
1134 * attack: CVE-2010-4180.
1135 */
1136#if 0
1137 if (j == 0 && (s->options & SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG) && (sk_SSL_CIPHER_num(ciphers) == 1)) {
1138 /* Special case as client bug workaround: the previously used cipher may
1139 * not be in the current list, the client instead might be trying to
1140 * continue using a cipher that before wasn't chosen due to server
1141 * preferences. We'll have to reject the connection if the cipher is not
1142 * enabled, though. */
1143 c = sk_SSL_CIPHER_value(ciphers, 0);
1144 if (sk_SSL_CIPHER_find(SSL_get_ciphers(s), c) >= 0) {
1145 s->session->cipher = c;
1146 j = 1;
1147 }
1148 }
1149#endif
1150 if (j == 0) { 1132 if (j == 0) {
1151 /* we need to have the cipher in the cipher 1133 /* we need to have the cipher in the cipher
1152 * list if we are asked to reuse it */ 1134 * list if we are asked to reuse it */
diff --git a/src/lib/libssl/src/ssl/ssl_algs.c b/src/lib/libssl/src/ssl/ssl_algs.c
index aaecb2da0f..3c7006ed91 100644
--- a/src/lib/libssl/src/ssl/ssl_algs.c
+++ b/src/lib/libssl/src/ssl/ssl_algs.c
@@ -118,11 +118,6 @@ SSL_library_init(void)
118#ifndef OPENSSL_NO_ECDSA 118#ifndef OPENSSL_NO_ECDSA
119 EVP_add_digest(EVP_ecdsa()); 119 EVP_add_digest(EVP_ecdsa());
120#endif 120#endif
121 /* If you want support for phased out ciphers, add the following */
122#if 0
123 EVP_add_digest(EVP_sha());
124 EVP_add_digest(EVP_dss());
125#endif
126#ifndef OPENSSL_NO_COMP 121#ifndef OPENSSL_NO_COMP
127 /* This will initialise the built-in compression algorithms. 122 /* This will initialise the built-in compression algorithms.
128 The value returned is a STACK_OF(SSL_COMP), but that can 123 The value returned is a STACK_OF(SSL_COMP), but that can
diff --git a/src/lib/libssl/src/ssl/ssl_lib.c b/src/lib/libssl/src/ssl/ssl_lib.c
index 37fff3a38f..dc36747833 100644
--- a/src/lib/libssl/src/ssl/ssl_lib.c
+++ b/src/lib/libssl/src/ssl/ssl_lib.c
@@ -197,18 +197,10 @@ SSL_clear(SSL *s)
197 s->hit = 0; 197 s->hit = 0;
198 s->shutdown = 0; 198 s->shutdown = 0;
199 199
200#if 0 /* Disabled since version 1.10 of this file (early return not
201 * needed because SSL_clear is not called when doing renegotiation) */
202 /* This is set if we are doing dynamic renegotiation so keep
203 * the old cipher. It is sort of a SSL_clear_lite :-) */
204 if (s->renegotiate)
205 return (1);
206#else
207 if (s->renegotiate) { 200 if (s->renegotiate) {
208 SSLerr(SSL_F_SSL_CLEAR, ERR_R_INTERNAL_ERROR); 201 SSLerr(SSL_F_SSL_CLEAR, ERR_R_INTERNAL_ERROR);
209 return 0; 202 return 0;
210 } 203 }
211#endif
212 204
213 s->type = 0; 205 s->type = 0;
214 206
diff --git a/src/lib/libssl/ssl_algs.c b/src/lib/libssl/ssl_algs.c
index aaecb2da0f..3c7006ed91 100644
--- a/src/lib/libssl/ssl_algs.c
+++ b/src/lib/libssl/ssl_algs.c
@@ -118,11 +118,6 @@ SSL_library_init(void)
118#ifndef OPENSSL_NO_ECDSA 118#ifndef OPENSSL_NO_ECDSA
119 EVP_add_digest(EVP_ecdsa()); 119 EVP_add_digest(EVP_ecdsa());
120#endif 120#endif
121 /* If you want support for phased out ciphers, add the following */
122#if 0
123 EVP_add_digest(EVP_sha());
124 EVP_add_digest(EVP_dss());
125#endif
126#ifndef OPENSSL_NO_COMP 121#ifndef OPENSSL_NO_COMP
127 /* This will initialise the built-in compression algorithms. 122 /* This will initialise the built-in compression algorithms.
128 The value returned is a STACK_OF(SSL_COMP), but that can 123 The value returned is a STACK_OF(SSL_COMP), but that can
diff --git a/src/lib/libssl/ssl_lib.c b/src/lib/libssl/ssl_lib.c
index 37fff3a38f..dc36747833 100644
--- a/src/lib/libssl/ssl_lib.c
+++ b/src/lib/libssl/ssl_lib.c
@@ -197,18 +197,10 @@ SSL_clear(SSL *s)
197 s->hit = 0; 197 s->hit = 0;
198 s->shutdown = 0; 198 s->shutdown = 0;
199 199
200#if 0 /* Disabled since version 1.10 of this file (early return not
201 * needed because SSL_clear is not called when doing renegotiation) */
202 /* This is set if we are doing dynamic renegotiation so keep
203 * the old cipher. It is sort of a SSL_clear_lite :-) */
204 if (s->renegotiate)
205 return (1);
206#else
207 if (s->renegotiate) { 200 if (s->renegotiate) {
208 SSLerr(SSL_F_SSL_CLEAR, ERR_R_INTERNAL_ERROR); 201 SSLerr(SSL_F_SSL_CLEAR, ERR_R_INTERNAL_ERROR);
209 return 0; 202 return 0;
210 } 203 }
211#endif
212 204
213 s->type = 0; 205 s->type = 0;
214 206
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-20 16:00:37 +0000