1 files changed, 43 insertions, 20 deletions

diff --git a/src/lib/libssl/src/apps/s_server.c b/src/lib/libssl/src/apps/s_server.c
index 3f9b3704c6..8198d7f065 100644
--- a/src/lib/libssl/src/apps/s_server.c
+++ b/src/lib/libssl/src/apps/s_server.c
@@ -556,7 +556,9 @@ static void sv_usage(void)
 # ifndef OPENSSL_NO_NEXTPROTONEG
         BIO_printf(bio_err," -nextprotoneg arg - set the advertised protocols for the NPN extension (comma-separated list)\n");
 # endif
+# ifndef OPENSSL_NO_SRTP
         BIO_printf(bio_err," -use_srtp profiles - Offer SRTP key management with a colon-separated profile list\n");
+# endif
 #endif
         BIO_printf(bio_err," -keymatexport label   - Export keying material using label\n");
         BIO_printf(bio_err," -keymatexportlen len  - Export len bytes of keying material (default 20)\n");
@@ -923,7 +925,9 @@ static char *jpake_secret = NULL;
 #ifndef OPENSSL_NO_SRP
         static srpsrvparm srp_callback_parm;
 #endif
+#ifndef OPENSSL_NO_SRTP
 static char *srtp_profiles = NULL;
+#endif
 
 int MAIN(int argc, char *argv[])
         {
@@ -1206,13 +1210,13 @@ int MAIN(int argc, char *argv[])
                         {
                         if (--argc < 1) goto bad;
                         srp_verifier_file = *(++argv);
-                        meth=TLSv1_server_method();
+                        meth = TLSv1_server_method();
                         }
                 else if (strcmp(*argv, "-srpuserseed") == 0)
                         {
                         if (--argc < 1) goto bad;
                         srpuserseed = *(++argv);
-                        meth=TLSv1_server_method();
+                        meth = TLSv1_server_method();
                         }
 #endif
                 else if (strcmp(*argv,"-www") == 0)
@@ -1319,11 +1323,13 @@ int MAIN(int argc, char *argv[])
                         jpake_secret = *(++argv);
                         }
 #endif
+#ifndef OPENSSL_NO_SRTP
                 else if (strcmp(*argv,"-use_srtp") == 0)
                         {
                         if (--argc < 1) goto bad;
                         srtp_profiles = *(++argv);
                         }
+#endif
                 else if (strcmp(*argv,"-keymatexport") == 0)
                         {
                         if (--argc < 1) goto bad;
@@ -1431,25 +1437,24 @@ bad:
                                 goto end;
                                 }
                         }
-
-# ifndef OPENSSL_NO_NEXTPROTONEG
-                if (next_proto_neg_in)
-                        {
-                        unsigned short len;
-                        next_proto.data = next_protos_parse(&len,
-                                next_proto_neg_in);
-                        if (next_proto.data == NULL)
-                                goto end;
-                        next_proto.len = len;
-                        }
-                else
-                        {
-                        next_proto.data = NULL;
-                        }
-# endif
 #endif
                 }
 
+#if !defined(OPENSSL_NO_TLSEXT) && !defined(OPENSSL_NO_NEXTPROTONEG) 
+        if (next_proto_neg_in)
+                {
+                unsigned short len;
+                next_proto.data = next_protos_parse(&len, next_proto_neg_in);
+                if (next_proto.data == NULL)
+                        goto end;
+                next_proto.len = len;
+                }
+        else
+                {
+                next_proto.data = NULL;
+                }
+#endif
+
 
         if (s_dcert_file)
                 {
@@ -1550,8 +1555,10 @@ bad:
         else
                 SSL_CTX_sess_set_cache_size(ctx,128);
 
+#ifndef OPENSSL_NO_SRTP
         if (srtp_profiles != NULL)
                 SSL_CTX_set_tlsext_use_srtp(ctx, srtp_profiles);
+#endif
 
 #if 0
         if (cipher == NULL) cipher=getenv("SSL_CIPHER");
@@ -1730,7 +1737,7 @@ bad:
                 }
 #endif
         
-        if (!set_cert_key_stuff(ctx,s_cert,s_key))
+        if (!set_cert_key_stuff(ctx, s_cert, s_key))
                 goto end;
 #ifndef OPENSSL_NO_TLSEXT
         if (ctx2 && !set_cert_key_stuff(ctx2,s_cert2,s_key2))
@@ -1738,7 +1745,7 @@ bad:
 #endif
         if (s_dcert != NULL)
                 {
-                if (!set_cert_key_stuff(ctx,s_dcert,s_dkey))
+                if (!set_cert_key_stuff(ctx, s_dcert, s_dkey))
                         goto end;
                 }
 
@@ -1893,7 +1900,15 @@ end:
                 OPENSSL_free(pass);
         if (dpass)
                 OPENSSL_free(dpass);
+        if (vpm)
+                X509_VERIFY_PARAM_free(vpm);
 #ifndef OPENSSL_NO_TLSEXT
+        if (tlscstatp.host)
+                OPENSSL_free(tlscstatp.host);
+        if (tlscstatp.port)
+                OPENSSL_free(tlscstatp.port);
+        if (tlscstatp.path)
+                OPENSSL_free(tlscstatp.path);
         if (ctx2 != NULL) SSL_CTX_free(ctx2);
         if (s_cert2)
                 X509_free(s_cert2);
@@ -2433,6 +2448,7 @@ static int init_ssl_connection(SSL *con)
                 BIO_printf(bio_s_out,"Shared ciphers:%s\n",buf);
         str=SSL_CIPHER_get_name(SSL_get_current_cipher(con));
         BIO_printf(bio_s_out,"CIPHER is %s\n",(str != NULL)?str:"(NONE)");
+
 #if !defined(OPENSSL_NO_TLSEXT) && !defined(OPENSSL_NO_NEXTPROTONEG)
         SSL_get0_next_proto_negotiated(con, &next_proto_neg, &next_proto_neg_len);
         if (next_proto_neg)
@@ -2442,6 +2458,7 @@ static int init_ssl_connection(SSL *con)
                 BIO_printf(bio_s_out, "\n");
                 }
 #endif
+#ifndef OPENSSL_NO_SRTP
         {
         SRTP_PROTECTION_PROFILE *srtp_profile
           = SSL_get_selected_srtp_profile(con);
@@ -2450,6 +2467,7 @@ static int init_ssl_connection(SSL *con)
                 BIO_printf(bio_s_out,"SRTP Extension negotiated, profile=%s\n",
                            srtp_profile->name);
         }
+#endif
         if (SSL_cache_hit(con)) BIO_printf(bio_s_out,"Reused session-id\n");
         if (SSL_ctrl(con,SSL_CTRL_GET_FLAGS,0,NULL) &
                 TLS1_FLAGS_TLS_PADDING_BUG)
@@ -2701,6 +2719,11 @@ static int www_body(char *hostname, int s, unsigned char *context)
                                 }
                         BIO_puts(io,"\n");
 
+                        BIO_printf(io,
+                                "Secure Renegotiation IS%s supported\n",
+                                SSL_get_secure_renegotiation_support(con) ?
+                                                        "" : " NOT");
+
                         /* The following is evil and should not really
                          * be done */
                         BIO_printf(io,"Ciphers supported in s_server binary\n");