Disable SSLv2 in OpenSSL. No objections from djm.

Brad, jasper and naddy helped with test builds, fixing ports, etc.

20 files changed, 96 insertions, 8 deletions

diff --git a/src/lib/libssl/crypto/arch/alpha/opensslconf.h b/src/lib/libssl/crypto/arch/alpha/opensslconf.h
index a49bd23031..3dfec8c8b7 100644
--- a/src/lib/libssl/crypto/arch/alpha/opensslconf.h
+++ b/src/lib/libssl/crypto/arch/alpha/opensslconf.h
@@ -37,6 +37,9 @@
 #ifndef OPENSSL_NO_SEED
 # define OPENSSL_NO_SEED
 #endif
+#ifndef OPENSSL_NO_SSL2
+# define OPENSSL_NO_SSL2
+#endif
 #ifndef OPENSSL_NO_STORE
 # define OPENSSL_NO_STORE
 #endif
@@ -87,6 +90,9 @@
 # if defined(OPENSSL_NO_SEED) && !defined(NO_SEED)
 #  define NO_SEED
 # endif
+# if defined(OPENSSL_NO_SSL2) && !defined(NO_SSL2)
+#  define NO_SSL2
+# endif
 # if defined(OPENSSL_NO_STORE) && !defined(NO_STORE)
 #  define NO_STORE
 # endif
diff --git a/src/lib/libssl/crypto/arch/amd64/opensslconf.h b/src/lib/libssl/crypto/arch/amd64/opensslconf.h
index 16314dbc1e..6a6029013f 100644
--- a/src/lib/libssl/crypto/arch/amd64/opensslconf.h
+++ b/src/lib/libssl/crypto/arch/amd64/opensslconf.h
@@ -37,6 +37,9 @@
 #ifndef OPENSSL_NO_SEED
 # define OPENSSL_NO_SEED
 #endif
+#ifndef OPENSSL_NO_SSL2
+# define OPENSSL_NO_SSL2
+#endif
 #ifndef OPENSSL_NO_STORE
 # define OPENSSL_NO_STORE
 #endif
@@ -87,6 +90,9 @@
 # if defined(OPENSSL_NO_SEED) && !defined(NO_SEED)
 #  define NO_SEED
 # endif
+# if defined(OPENSSL_NO_SSL2) && !defined(NO_SSL2)
+#  define NO_SSL2
+# endif
 # if defined(OPENSSL_NO_STORE) && !defined(NO_STORE)
 #  define NO_STORE
 # endif
diff --git a/src/lib/libssl/crypto/arch/arm/opensslconf.h b/src/lib/libssl/crypto/arch/arm/opensslconf.h
index c1fc4e5d11..7c7015c9b7 100644
--- a/src/lib/libssl/crypto/arch/arm/opensslconf.h
+++ b/src/lib/libssl/crypto/arch/arm/opensslconf.h
@@ -37,6 +37,9 @@
 #ifndef OPENSSL_NO_SEED
 # define OPENSSL_NO_SEED
 #endif
+#ifndef OPENSSL_NO_SSL2
+# define OPENSSL_NO_SSL2
+#endif
 #ifndef OPENSSL_NO_STORE
 # define OPENSSL_NO_STORE
 #endif
@@ -87,6 +90,9 @@
 # if defined(OPENSSL_NO_SEED) && !defined(NO_SEED)
 #  define NO_SEED
 # endif
+# if defined(OPENSSL_NO_SSL2) && !defined(NO_SSL2)
+#  define NO_SSL2
+# endif
 # if defined(OPENSSL_NO_STORE) && !defined(NO_STORE)
 #  define NO_STORE
 # endif
diff --git a/src/lib/libssl/crypto/arch/hppa/opensslconf.h b/src/lib/libssl/crypto/arch/hppa/opensslconf.h
index c1fc4e5d11..7c7015c9b7 100644
--- a/src/lib/libssl/crypto/arch/hppa/opensslconf.h
+++ b/src/lib/libssl/crypto/arch/hppa/opensslconf.h
@@ -37,6 +37,9 @@
 #ifndef OPENSSL_NO_SEED
 # define OPENSSL_NO_SEED
 #endif
+#ifndef OPENSSL_NO_SSL2
+# define OPENSSL_NO_SSL2
+#endif
 #ifndef OPENSSL_NO_STORE
 # define OPENSSL_NO_STORE
 #endif
@@ -87,6 +90,9 @@
 # if defined(OPENSSL_NO_SEED) && !defined(NO_SEED)
 #  define NO_SEED
 # endif
+# if defined(OPENSSL_NO_SSL2) && !defined(NO_SSL2)
+#  define NO_SSL2
+# endif
 # if defined(OPENSSL_NO_STORE) && !defined(NO_STORE)
 #  define NO_STORE
 # endif
diff --git a/src/lib/libssl/crypto/arch/hppa64/opensslconf.h b/src/lib/libssl/crypto/arch/hppa64/opensslconf.h
index 38a4f1ca9f..7199268572 100644
--- a/src/lib/libssl/crypto/arch/hppa64/opensslconf.h
+++ b/src/lib/libssl/crypto/arch/hppa64/opensslconf.h
@@ -37,6 +37,9 @@
 #ifndef OPENSSL_NO_SEED
 # define OPENSSL_NO_SEED
 #endif
+#ifndef OPENSSL_NO_SSL2
+# define OPENSSL_NO_SSL2
+#endif
 #ifndef OPENSSL_NO_STORE
 # define OPENSSL_NO_STORE
 #endif
@@ -87,6 +90,9 @@
 # if defined(OPENSSL_NO_SEED) && !defined(NO_SEED)
 #  define NO_SEED
 # endif
+# if defined(OPENSSL_NO_SSL2) && !defined(NO_SSL2)
+#  define NO_SSL2
+# endif
 # if defined(OPENSSL_NO_STORE) && !defined(NO_STORE)
 #  define NO_STORE
 # endif
diff --git a/src/lib/libssl/crypto/arch/i386/opensslconf.h b/src/lib/libssl/crypto/arch/i386/opensslconf.h
index 91993d7a3f..b9e4249fed 100644
--- a/src/lib/libssl/crypto/arch/i386/opensslconf.h
+++ b/src/lib/libssl/crypto/arch/i386/opensslconf.h
@@ -37,6 +37,9 @@
 #ifndef OPENSSL_NO_SEED
 # define OPENSSL_NO_SEED
 #endif
+#ifndef OPENSSL_NO_SSL2
+# define OPENSSL_NO_SSL2
+#endif
 #ifndef OPENSSL_NO_STORE
 # define OPENSSL_NO_STORE
 #endif
@@ -87,6 +90,9 @@
 # if defined(OPENSSL_NO_SEED) && !defined(NO_SEED)
 #  define NO_SEED
 # endif
+# if defined(OPENSSL_NO_SSL2) && !defined(NO_SSL2)
+#  define NO_SSL2
+# endif
 # if defined(OPENSSL_NO_STORE) && !defined(NO_STORE)
 #  define NO_STORE
 # endif
diff --git a/src/lib/libssl/crypto/arch/m68k/opensslconf.h b/src/lib/libssl/crypto/arch/m68k/opensslconf.h
index c1fc4e5d11..7c7015c9b7 100644
--- a/src/lib/libssl/crypto/arch/m68k/opensslconf.h
+++ b/src/lib/libssl/crypto/arch/m68k/opensslconf.h
@@ -37,6 +37,9 @@
 #ifndef OPENSSL_NO_SEED
 # define OPENSSL_NO_SEED
 #endif
+#ifndef OPENSSL_NO_SSL2
+# define OPENSSL_NO_SSL2
+#endif
 #ifndef OPENSSL_NO_STORE
 # define OPENSSL_NO_STORE
 #endif
@@ -87,6 +90,9 @@
 # if defined(OPENSSL_NO_SEED) && !defined(NO_SEED)
 #  define NO_SEED
 # endif
+# if defined(OPENSSL_NO_SSL2) && !defined(NO_SSL2)
+#  define NO_SSL2
+# endif
 # if defined(OPENSSL_NO_STORE) && !defined(NO_STORE)
 #  define NO_STORE
 # endif
diff --git a/src/lib/libssl/crypto/arch/m88k/opensslconf.h b/src/lib/libssl/crypto/arch/m88k/opensslconf.h
index c1fc4e5d11..7c7015c9b7 100644
--- a/src/lib/libssl/crypto/arch/m88k/opensslconf.h
+++ b/src/lib/libssl/crypto/arch/m88k/opensslconf.h
@@ -37,6 +37,9 @@
 #ifndef OPENSSL_NO_SEED
 # define OPENSSL_NO_SEED
 #endif
+#ifndef OPENSSL_NO_SSL2
+# define OPENSSL_NO_SSL2
+#endif
 #ifndef OPENSSL_NO_STORE
 # define OPENSSL_NO_STORE
 #endif
@@ -87,6 +90,9 @@
 # if defined(OPENSSL_NO_SEED) && !defined(NO_SEED)
 #  define NO_SEED
 # endif
+# if defined(OPENSSL_NO_SSL2) && !defined(NO_SSL2)
+#  define NO_SSL2
+# endif
 # if defined(OPENSSL_NO_STORE) && !defined(NO_STORE)
 #  define NO_STORE
 # endif
diff --git a/src/lib/libssl/crypto/arch/mips64/opensslconf.h b/src/lib/libssl/crypto/arch/mips64/opensslconf.h
index 10cb4e721d..e481da68bf 100644
--- a/src/lib/libssl/crypto/arch/mips64/opensslconf.h
+++ b/src/lib/libssl/crypto/arch/mips64/opensslconf.h
@@ -37,6 +37,9 @@
 #ifndef OPENSSL_NO_SEED
 # define OPENSSL_NO_SEED
 #endif
+#ifndef OPENSSL_NO_SSL2
+# define OPENSSL_NO_SSL2
+#endif
 #ifndef OPENSSL_NO_STORE
 # define OPENSSL_NO_STORE
 #endif
@@ -87,6 +90,9 @@
 # if defined(OPENSSL_NO_SEED) && !defined(NO_SEED)
 #  define NO_SEED
 # endif
+# if defined(OPENSSL_NO_SSL2) && !defined(NO_SSL2)
+#  define NO_SSL2
+# endif
 # if defined(OPENSSL_NO_STORE) && !defined(NO_STORE)
 #  define NO_STORE
 # endif
diff --git a/src/lib/libssl/crypto/arch/powerpc/opensslconf.h b/src/lib/libssl/crypto/arch/powerpc/opensslconf.h
index c1fc4e5d11..7c7015c9b7 100644
--- a/src/lib/libssl/crypto/arch/powerpc/opensslconf.h
+++ b/src/lib/libssl/crypto/arch/powerpc/opensslconf.h
@@ -37,6 +37,9 @@
 #ifndef OPENSSL_NO_SEED
 # define OPENSSL_NO_SEED
 #endif
+#ifndef OPENSSL_NO_SSL2
+# define OPENSSL_NO_SSL2
+#endif
 #ifndef OPENSSL_NO_STORE
 # define OPENSSL_NO_STORE
 #endif
@@ -87,6 +90,9 @@
 # if defined(OPENSSL_NO_SEED) && !defined(NO_SEED)
 #  define NO_SEED
 # endif
+# if defined(OPENSSL_NO_SSL2) && !defined(NO_SSL2)
+#  define NO_SSL2
+# endif
 # if defined(OPENSSL_NO_STORE) && !defined(NO_STORE)
 #  define NO_STORE
 # endif
diff --git a/src/lib/libssl/crypto/arch/sh/opensslconf.h b/src/lib/libssl/crypto/arch/sh/opensslconf.h
index c1fc4e5d11..7c7015c9b7 100644
--- a/src/lib/libssl/crypto/arch/sh/opensslconf.h
+++ b/src/lib/libssl/crypto/arch/sh/opensslconf.h
@@ -37,6 +37,9 @@
 #ifndef OPENSSL_NO_SEED
 # define OPENSSL_NO_SEED
 #endif
+#ifndef OPENSSL_NO_SSL2
+# define OPENSSL_NO_SSL2
+#endif
 #ifndef OPENSSL_NO_STORE
 # define OPENSSL_NO_STORE
 #endif
@@ -87,6 +90,9 @@
 # if defined(OPENSSL_NO_SEED) && !defined(NO_SEED)
 #  define NO_SEED
 # endif
+# if defined(OPENSSL_NO_SSL2) && !defined(NO_SSL2)
+#  define NO_SSL2
+# endif
 # if defined(OPENSSL_NO_STORE) && !defined(NO_STORE)
 #  define NO_STORE
 # endif
diff --git a/src/lib/libssl/crypto/arch/sparc/opensslconf.h b/src/lib/libssl/crypto/arch/sparc/opensslconf.h
index c1fc4e5d11..7c7015c9b7 100644
--- a/src/lib/libssl/crypto/arch/sparc/opensslconf.h
+++ b/src/lib/libssl/crypto/arch/sparc/opensslconf.h
@@ -37,6 +37,9 @@
 #ifndef OPENSSL_NO_SEED
 # define OPENSSL_NO_SEED
 #endif
+#ifndef OPENSSL_NO_SSL2
+# define OPENSSL_NO_SSL2
+#endif
 #ifndef OPENSSL_NO_STORE
 # define OPENSSL_NO_STORE
 #endif
@@ -87,6 +90,9 @@
 # if defined(OPENSSL_NO_SEED) && !defined(NO_SEED)
 #  define NO_SEED
 # endif
+# if defined(OPENSSL_NO_SSL2) && !defined(NO_SSL2)
+#  define NO_SSL2
+# endif
 # if defined(OPENSSL_NO_STORE) && !defined(NO_STORE)
 #  define NO_STORE
 # endif
diff --git a/src/lib/libssl/crypto/arch/sparc64/opensslconf.h b/src/lib/libssl/crypto/arch/sparc64/opensslconf.h
index 10cb4e721d..e481da68bf 100644
--- a/src/lib/libssl/crypto/arch/sparc64/opensslconf.h
+++ b/src/lib/libssl/crypto/arch/sparc64/opensslconf.h
@@ -37,6 +37,9 @@
 #ifndef OPENSSL_NO_SEED
 # define OPENSSL_NO_SEED
 #endif
+#ifndef OPENSSL_NO_SSL2
+# define OPENSSL_NO_SSL2
+#endif
 #ifndef OPENSSL_NO_STORE
 # define OPENSSL_NO_STORE
 #endif
@@ -87,6 +90,9 @@
 # if defined(OPENSSL_NO_SEED) && !defined(NO_SEED)
 #  define NO_SEED
 # endif
+# if defined(OPENSSL_NO_SSL2) && !defined(NO_SSL2)
+#  define NO_SSL2
+# endif
 # if defined(OPENSSL_NO_STORE) && !defined(NO_STORE)
 #  define NO_STORE
 # endif
diff --git a/src/lib/libssl/crypto/arch/vax/opensslconf.h b/src/lib/libssl/crypto/arch/vax/opensslconf.h
index c1fc4e5d11..7c7015c9b7 100644
--- a/src/lib/libssl/crypto/arch/vax/opensslconf.h
+++ b/src/lib/libssl/crypto/arch/vax/opensslconf.h
@@ -37,6 +37,9 @@
 #ifndef OPENSSL_NO_SEED
 # define OPENSSL_NO_SEED
 #endif
+#ifndef OPENSSL_NO_SSL2
+# define OPENSSL_NO_SSL2
+#endif
 #ifndef OPENSSL_NO_STORE
 # define OPENSSL_NO_STORE
 #endif
@@ -87,6 +90,9 @@
 # if defined(OPENSSL_NO_SEED) && !defined(NO_SEED)
 #  define NO_SEED
 # endif
+# if defined(OPENSSL_NO_SSL2) && !defined(NO_SSL2)
+#  define NO_SSL2
+# endif
 # if defined(OPENSSL_NO_STORE) && !defined(NO_STORE)
 #  define NO_STORE
 # endif
diff --git a/src/lib/libssl/shlib_version b/src/lib/libssl/shlib_version
index 730231c38d..94727e17b3 100644
--- a/src/lib/libssl/shlib_version
+++ b/src/lib/libssl/shlib_version
@@ -1,2 +1,2 @@
-major=17
-minor=1
+major=18
+minor=0
diff --git a/src/lib/libssl/src/Makefile b/src/lib/libssl/src/Makefile
index 8fe888587e..aef28bea2c 100644
--- a/src/lib/libssl/src/Makefile
+++ b/src/lib/libssl/src/Makefile
@@ -13,7 +13,7 @@ SHLIB_MAJOR=1
 SHLIB_MINOR=0.0
 SHLIB_EXT=
 PLATFORM=dist
-OPTIONS= no-gmp no-jpake no-krb5 no-md2 no-rc5 no-rfc3779 no-shared no-store no-zlib no-zlib-dynamic static-engine
+OPTIONS= no-gmp no-jpake no-krb5 no-md2 no-rc5 no-rfc3779 no-shared no-ssl2 no-store no-zlib no-zlib-dynamic static-engine
 CONFIGURE_ARGS=dist
 SHLIB_TARGET=
 
@@ -61,7 +61,7 @@ OPENSSLDIR=/usr/local/ssl
 
 CC= cc
 CFLAG= -O
-DEPFLAG= -DOPENSSL_NO_GMP -DOPENSSL_NO_JPAKE -DOPENSSL_NO_MD2 -DOPENSSL_NO_RC5 -DOPENSSL_NO_RFC3779 -DOPENSSL_NO_STORE
+DEPFLAG= -DOPENSSL_NO_GMP -DOPENSSL_NO_JPAKE -DOPENSSL_NO_MD2 -DOPENSSL_NO_RC5 -DOPENSSL_NO_RFC3779 -DOPENSSL_NO_STORE -DOPENSSL_NO_SSL2
 PEX_LIBS= 
 EX_LIBS= 
 EXE_EXT= 
diff --git a/src/lib/libssl/src/apps/s_client.c b/src/lib/libssl/src/apps/s_client.c
index b0af5190d8..d9d060696f 100644
--- a/src/lib/libssl/src/apps/s_client.c
+++ b/src/lib/libssl/src/apps/s_client.c
@@ -320,7 +320,9 @@ static void sc_usage(void)
         BIO_printf(bio_err," -jpake arg    - JPAKE secret to use\n");
 # endif
 #endif
+#ifndef OPENSSL_NO_SSL2
         BIO_printf(bio_err," -ssl2         - just use SSLv2\n");
+#endif
         BIO_printf(bio_err," -ssl3         - just use SSLv3\n");
         BIO_printf(bio_err," -tls1         - just use TLSv1\n");
         BIO_printf(bio_err," -dtls1        - just use DTLSv1\n");    
diff --git a/src/lib/libssl/ssl/Makefile b/src/lib/libssl/ssl/Makefile
index 8926ce5423..3215b33574 100644
--- a/src/lib/libssl/ssl/Makefile
+++ b/src/lib/libssl/ssl/Makefile
@@ -1,4 +1,4 @@
-# $OpenBSD: Makefile,v 1.23 2010/10/01 23:02:02 djm Exp $
+# $OpenBSD: Makefile,v 1.24 2012/07/11 11:02:48 sthen Exp $
 
 LIB=    ssl
 WANTLINT=
@@ -10,6 +10,7 @@ LSSL_SRC= ${.CURDIR}/../${SSLEAYDIST}/ssl
 CFLAGS+= -DOPENSSL_NO_IDEA -DTERMIOS -DANSI_SOURCE
 CFLAGS+= -DOPENSSL_NO_MDC2
 CFLAGS+= -DOPENSSL_NO_RC5 -DOPENSSL_NO_KRB5
+CFLAGS+= -DOPENSSL_NO_SSL2
 CFLAGS+= -I${.CURDIR}/../${SSLEAYDIST} -I${.CURDIR}/../${SSLEAYDIST}/crypto
 
 SRCS=\
diff --git a/src/lib/libssl/ssl/shlib_version b/src/lib/libssl/ssl/shlib_version
index 730231c38d..94727e17b3 100644
--- a/src/lib/libssl/ssl/shlib_version
+++ b/src/lib/libssl/ssl/shlib_version
@@ -1,2 +1,2 @@
-major=17
-minor=1
+major=18
+minor=0
diff --git a/src/usr.sbin/openssl/Makefile b/src/usr.sbin/openssl/Makefile
index 20307fcbfc..a3948a7ae0 100644
--- a/src/usr.sbin/openssl/Makefile
+++ b/src/usr.sbin/openssl/Makefile
@@ -1,4 +1,4 @@
-#       $OpenBSD: Makefile,v 1.19 2010/10/01 23:04:33 djm Exp $
+#       $OpenBSD: Makefile,v 1.20 2012/07/11 11:02:48 sthen Exp $
 
 PROG=   openssl
 LDADD=  -lssl -lcrypto
@@ -11,6 +11,7 @@ SSLEAY_SRC_TOP= ${.CURDIR}/../../${SSLEAYDIST}
 
 CFLAGS+= -DMONOLITH -DOPENSSL_NO_IDEA -DTERMIOS -DANSI_SOURCE -DOPENSSL_NO_RC5
 CFLAGS+= -DOPENSSL_NO_MDC2
+CFLAGS+= -DOPENSSL_NO_SSL2
 CFLAGS+= -I${SSLEAY_SRC_TOP}
 
 SRCS=   verify.c asn1pars.c req.c dgst.c dh.c enc.c passwd.c gendh.c errstr.c \