diff options
Diffstat (limited to 'src/lib')
| -rw-r--r-- | src/lib/libcrypto/opensslfeatures.h | 2 | ||||
| -rw-r--r-- | src/lib/libssl/s23_clnt.c | 18 | ||||
| -rw-r--r-- | src/lib/libssl/s23_srvr.c | 25 | ||||
| -rw-r--r-- | src/lib/libssl/s3_clnt.c | 16 | ||||
| -rw-r--r-- | src/lib/libssl/s3_lib.c | 4 | ||||
| -rw-r--r-- | src/lib/libssl/s3_srvr.c | 16 | ||||
| -rw-r--r-- | src/lib/libssl/src/crypto/opensslfeatures.h | 2 | ||||
| -rw-r--r-- | src/lib/libssl/src/ssl/s23_clnt.c | 18 | ||||
| -rw-r--r-- | src/lib/libssl/src/ssl/s23_meth.c | 4 | ||||
| -rw-r--r-- | src/lib/libssl/src/ssl/s23_srvr.c | 25 | ||||
| -rw-r--r-- | src/lib/libssl/src/ssl/s3_clnt.c | 16 | ||||
| -rw-r--r-- | src/lib/libssl/src/ssl/s3_lib.c | 4 | ||||
| -rw-r--r-- | src/lib/libssl/src/ssl/s3_meth.c | 16 | ||||
| -rw-r--r-- | src/lib/libssl/src/ssl/s3_srvr.c | 16 | ||||
| -rw-r--r-- | src/lib/libssl/src/ssl/ssl.h | 6 | ||||
| -rw-r--r-- | src/lib/libssl/src/ssl/ssl_lib.c | 7 | ||||
| -rw-r--r-- | src/lib/libssl/src/ssl/ssl_sess.c | 3 | ||||
| -rw-r--r-- | src/lib/libssl/ssl.h | 6 | ||||
| -rw-r--r-- | src/lib/libssl/ssl_lib.c | 7 | ||||
| -rw-r--r-- | src/lib/libssl/ssl_sess.c | 3 |
20 files changed, 36 insertions, 178 deletions
diff --git a/src/lib/libcrypto/opensslfeatures.h b/src/lib/libcrypto/opensslfeatures.h index 45848c5a35..6b6784754d 100644 --- a/src/lib/libcrypto/opensslfeatures.h +++ b/src/lib/libcrypto/opensslfeatures.h | |||
| @@ -15,6 +15,8 @@ | |||
| 15 | # define OPENSSL_NO_SEED | 15 | # define OPENSSL_NO_SEED |
| 16 | # define OPENSSL_NO_SRP | 16 | # define OPENSSL_NO_SRP |
| 17 | # define OPENSSL_NO_SSL2 | 17 | # define OPENSSL_NO_SSL2 |
| 18 | # define OPENSSL_NO_SSL3 | ||
| 19 | # define OPENSSL_NO_SSL3_METHOD | ||
| 18 | # define OPENSSL_NO_STORE | 20 | # define OPENSSL_NO_STORE |
| 19 | # define OPENSSL_NO_BUF_FREELISTS | 21 | # define OPENSSL_NO_BUF_FREELISTS |
| 20 | # define OPENSSL_NO_HEARTBEATS | 22 | # define OPENSSL_NO_HEARTBEATS |
diff --git a/src/lib/libssl/s23_clnt.c b/src/lib/libssl/s23_clnt.c index 458eb37d5f..a99a7691bd 100644 --- a/src/lib/libssl/s23_clnt.c +++ b/src/lib/libssl/s23_clnt.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: s23_clnt.c,v 1.40 2015/07/19 07:30:06 doug Exp $ */ | 1 | /* $OpenBSD: s23_clnt.c,v 1.41 2015/08/27 06:21:15 doug Exp $ */ |
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) |
| 3 | * All rights reserved. | 3 | * All rights reserved. |
| 4 | * | 4 | * |
| @@ -196,8 +196,6 @@ SSLv23_client_method(void) | |||
| 196 | static const SSL_METHOD * | 196 | static const SSL_METHOD * |
| 197 | ssl23_get_client_method(int ver) | 197 | ssl23_get_client_method(int ver) |
| 198 | { | 198 | { |
| 199 | if (ver == SSL3_VERSION) | ||
| 200 | return (SSLv3_client_method()); | ||
| 201 | if (ver == TLS1_VERSION) | 199 | if (ver == TLS1_VERSION) |
| 202 | return (TLSv1_client_method()); | 200 | return (TLSv1_client_method()); |
| 203 | if (ver == TLS1_1_VERSION) | 201 | if (ver == TLS1_1_VERSION) |
| @@ -331,7 +329,7 @@ ssl23_client_hello(SSL *s) | |||
| 331 | * TLS1>=1, it would be insufficient to pass SSL_NO_TLSv1, the | 329 | * TLS1>=1, it would be insufficient to pass SSL_NO_TLSv1, the |
| 332 | * answer is SSL_OP_NO_TLSv1|SSL_OP_NO_SSLv3|SSL_OP_NO_SSLv2. | 330 | * answer is SSL_OP_NO_TLSv1|SSL_OP_NO_SSLv3|SSL_OP_NO_SSLv2. |
| 333 | */ | 331 | */ |
| 334 | mask = SSL_OP_NO_TLSv1_1|SSL_OP_NO_TLSv1|SSL_OP_NO_SSLv3; | 332 | mask = SSL_OP_NO_TLSv1_1|SSL_OP_NO_TLSv1; |
| 335 | version = TLS1_2_VERSION; | 333 | version = TLS1_2_VERSION; |
| 336 | 334 | ||
| 337 | if ((options & SSL_OP_NO_TLSv1_2) && (options & mask) != mask) | 335 | if ((options & SSL_OP_NO_TLSv1_2) && (options & mask) != mask) |
| @@ -340,9 +338,6 @@ ssl23_client_hello(SSL *s) | |||
| 340 | if ((options & SSL_OP_NO_TLSv1_1) && (options & mask) != mask) | 338 | if ((options & SSL_OP_NO_TLSv1_1) && (options & mask) != mask) |
| 341 | version = TLS1_VERSION; | 339 | version = TLS1_VERSION; |
| 342 | mask &= ~SSL_OP_NO_TLSv1; | 340 | mask &= ~SSL_OP_NO_TLSv1; |
| 343 | if ((options & SSL_OP_NO_TLSv1) && (options & mask) != mask) | ||
| 344 | version = SSL3_VERSION; | ||
| 345 | mask &= ~SSL_OP_NO_SSLv3; | ||
| 346 | 341 | ||
| 347 | buf = (unsigned char *)s->init_buf->data; | 342 | buf = (unsigned char *)s->init_buf->data; |
| 348 | if (s->state == SSL23_ST_CW_CLNT_HELLO_A) { | 343 | if (s->state == SSL23_ST_CW_CLNT_HELLO_A) { |
| @@ -357,9 +352,6 @@ ssl23_client_hello(SSL *s) | |||
| 357 | } else if (version == TLS1_VERSION) { | 352 | } else if (version == TLS1_VERSION) { |
| 358 | version_major = TLS1_VERSION_MAJOR; | 353 | version_major = TLS1_VERSION_MAJOR; |
| 359 | version_minor = TLS1_VERSION_MINOR; | 354 | version_minor = TLS1_VERSION_MINOR; |
| 360 | } else if (version == SSL3_VERSION) { | ||
| 361 | version_major = SSL3_VERSION_MAJOR; | ||
| 362 | version_minor = SSL3_VERSION_MINOR; | ||
| 363 | } else { | 355 | } else { |
| 364 | SSLerr(SSL_F_SSL23_CLIENT_HELLO, SSL_R_NO_PROTOCOLS_AVAILABLE); | 356 | SSLerr(SSL_F_SSL23_CLIENT_HELLO, SSL_R_NO_PROTOCOLS_AVAILABLE); |
| 365 | return (-1); | 357 | return (-1); |
| @@ -494,11 +486,7 @@ ssl23_get_server_hello(SSL *s) | |||
| 494 | (p[0] == SSL3_RT_ALERT && p[3] == 0 && p[4] == 2))) { | 486 | (p[0] == SSL3_RT_ALERT && p[3] == 0 && p[4] == 2))) { |
| 495 | /* we have sslv3 or tls1 (server hello or alert) */ | 487 | /* we have sslv3 or tls1 (server hello or alert) */ |
| 496 | 488 | ||
| 497 | if ((p[2] == SSL3_VERSION_MINOR) && | 489 | if ((p[2] == TLS1_VERSION_MINOR) && |
| 498 | !(s->options & SSL_OP_NO_SSLv3)) { | ||
| 499 | s->version = SSL3_VERSION; | ||
| 500 | s->method = SSLv3_client_method(); | ||
| 501 | } else if ((p[2] == TLS1_VERSION_MINOR) && | ||
| 502 | !(s->options & SSL_OP_NO_TLSv1)) { | 490 | !(s->options & SSL_OP_NO_TLSv1)) { |
| 503 | s->version = TLS1_VERSION; | 491 | s->version = TLS1_VERSION; |
| 504 | s->method = TLSv1_client_method(); | 492 | s->method = TLSv1_client_method(); |
diff --git a/src/lib/libssl/s23_srvr.c b/src/lib/libssl/s23_srvr.c index b524124681..7b2107680e 100644 --- a/src/lib/libssl/s23_srvr.c +++ b/src/lib/libssl/s23_srvr.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: s23_srvr.c,v 1.41 2015/07/19 07:30:06 doug Exp $ */ | 1 | /* $OpenBSD: s23_srvr.c,v 1.42 2015/08/27 06:21:15 doug Exp $ */ |
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) |
| 3 | * All rights reserved. | 3 | * All rights reserved. |
| 4 | * | 4 | * |
| @@ -194,8 +194,6 @@ SSLv23_server_method(void) | |||
| 194 | static const SSL_METHOD * | 194 | static const SSL_METHOD * |
| 195 | ssl23_get_server_method(int ver) | 195 | ssl23_get_server_method(int ver) |
| 196 | { | 196 | { |
| 197 | if (ver == SSL3_VERSION) | ||
| 198 | return (SSLv3_server_method()); | ||
| 199 | if (ver == TLS1_VERSION) | 197 | if (ver == TLS1_VERSION) |
| 200 | return (TLSv1_server_method()); | 198 | return (TLSv1_server_method()); |
| 201 | if (ver == TLS1_1_VERSION) | 199 | if (ver == TLS1_1_VERSION) |
| @@ -357,16 +355,12 @@ ssl23_get_client_hello(SSL *s) | |||
| 357 | /* type=2; */ /* done later to survive restarts */ | 355 | /* type=2; */ /* done later to survive restarts */ |
| 358 | s->state = SSL23_ST_SR_CLNT_HELLO_B; | 356 | s->state = SSL23_ST_SR_CLNT_HELLO_B; |
| 359 | } else if (!(s->options & SSL_OP_NO_SSLv3)) { | 357 | } else if (!(s->options & SSL_OP_NO_SSLv3)) { |
| 360 | s->version = SSL3_VERSION; | 358 | type = 1; |
| 361 | /* type=2; */ | ||
| 362 | s->state = SSL23_ST_SR_CLNT_HELLO_B; | ||
| 363 | } else if (!(s->options & SSL_OP_NO_SSLv2)) { | 359 | } else if (!(s->options & SSL_OP_NO_SSLv2)) { |
| 364 | type = 1; | 360 | type = 1; |
| 365 | } | 361 | } |
| 366 | } else if (!(s->options & SSL_OP_NO_SSLv3)) { | 362 | } else if (!(s->options & SSL_OP_NO_SSLv3)) { |
| 367 | s->version = SSL3_VERSION; | 363 | type = 1; |
| 368 | /* type=2; */ | ||
| 369 | s->state = SSL23_ST_SR_CLNT_HELLO_B; | ||
| 370 | } else if (!(s->options & SSL_OP_NO_SSLv2)) | 364 | } else if (!(s->options & SSL_OP_NO_SSLv2)) |
| 371 | type = 1; | 365 | type = 1; |
| 372 | 366 | ||
| @@ -415,16 +409,9 @@ ssl23_get_client_hello(SSL *s) | |||
| 415 | } else if (!(s->options & SSL_OP_NO_TLSv1)) { | 409 | } else if (!(s->options & SSL_OP_NO_TLSv1)) { |
| 416 | s->version = TLS1_VERSION; | 410 | s->version = TLS1_VERSION; |
| 417 | type = 3; | 411 | type = 3; |
| 418 | } else if (!(s->options & SSL_OP_NO_SSLv3)) { | ||
| 419 | s->version = SSL3_VERSION; | ||
| 420 | type = 3; | ||
| 421 | } | 412 | } |
| 422 | } else { | 413 | } else { |
| 423 | /* client requests SSL 3.0 */ | 414 | if (!(s->options & SSL_OP_NO_TLSv1)) { |
| 424 | if (!(s->options & SSL_OP_NO_SSLv3)) { | ||
| 425 | s->version = SSL3_VERSION; | ||
| 426 | type = 3; | ||
| 427 | } else if (!(s->options & SSL_OP_NO_TLSv1)) { | ||
| 428 | /* we won't be able to use TLS of course, | 415 | /* we won't be able to use TLS of course, |
| 429 | * but this will send an appropriate alert */ | 416 | * but this will send an appropriate alert */ |
| 430 | s->version = TLS1_VERSION; | 417 | s->version = TLS1_VERSION; |
| @@ -587,10 +574,8 @@ ssl23_get_client_hello(SSL *s) | |||
| 587 | s->method = TLSv1_2_server_method(); | 574 | s->method = TLSv1_2_server_method(); |
| 588 | else if (s->version == TLS1_1_VERSION) | 575 | else if (s->version == TLS1_1_VERSION) |
| 589 | s->method = TLSv1_1_server_method(); | 576 | s->method = TLSv1_1_server_method(); |
| 590 | else if (s->version == TLS1_VERSION) | ||
| 591 | s->method = TLSv1_server_method(); | ||
| 592 | else | 577 | else |
| 593 | s->method = SSLv3_server_method(); | 578 | s->method = TLSv1_server_method(); |
| 594 | s->handshake_func = s->method->ssl_accept; | 579 | s->handshake_func = s->method->ssl_accept; |
| 595 | } | 580 | } |
| 596 | 581 | ||
diff --git a/src/lib/libssl/s3_clnt.c b/src/lib/libssl/s3_clnt.c index b739711732..30f679eac3 100644 --- a/src/lib/libssl/s3_clnt.c +++ b/src/lib/libssl/s3_clnt.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: s3_clnt.c,v 1.121 2015/07/29 19:16:09 miod Exp $ */ | 1 | /* $OpenBSD: s3_clnt.c,v 1.122 2015/08/27 06:21:15 doug Exp $ */ |
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) |
| 3 | * All rights reserved. | 3 | * All rights reserved. |
| 4 | * | 4 | * |
| @@ -170,12 +170,6 @@ | |||
| 170 | 170 | ||
| 171 | #include "bytestring.h" | 171 | #include "bytestring.h" |
| 172 | 172 | ||
| 173 | #ifdef __OpenBSD__ | ||
| 174 | #include <sys/cdefs.h> | ||
| 175 | __warn_references(SSLv3_client_method, | ||
| 176 | "SSLv3_client_method() enables the use of insecure protocols"); | ||
| 177 | #endif | ||
| 178 | |||
| 179 | static const SSL_METHOD *ssl3_get_client_method(int ver); | 173 | static const SSL_METHOD *ssl3_get_client_method(int ver); |
| 180 | static int ca_dn_cmp(const X509_NAME * const *a, const X509_NAME * const *b); | 174 | static int ca_dn_cmp(const X509_NAME * const *a, const X509_NAME * const *b); |
| 181 | 175 | ||
| @@ -211,17 +205,9 @@ const SSL_METHOD SSLv3_client_method_data = { | |||
| 211 | .ssl_ctx_callback_ctrl = ssl3_ctx_callback_ctrl, | 205 | .ssl_ctx_callback_ctrl = ssl3_ctx_callback_ctrl, |
| 212 | }; | 206 | }; |
| 213 | 207 | ||
| 214 | const SSL_METHOD * | ||
| 215 | SSLv3_client_method(void) | ||
| 216 | { | ||
| 217 | return &SSLv3_client_method_data; | ||
| 218 | } | ||
| 219 | |||
| 220 | static const SSL_METHOD * | 208 | static const SSL_METHOD * |
| 221 | ssl3_get_client_method(int ver) | 209 | ssl3_get_client_method(int ver) |
| 222 | { | 210 | { |
| 223 | if (ver == SSL3_VERSION) | ||
| 224 | return (SSLv3_client_method()); | ||
| 225 | return (NULL); | 211 | return (NULL); |
| 226 | } | 212 | } |
| 227 | 213 | ||
diff --git a/src/lib/libssl/s3_lib.c b/src/lib/libssl/s3_lib.c index c8bdac0214..42396a21e9 100644 --- a/src/lib/libssl/s3_lib.c +++ b/src/lib/libssl/s3_lib.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: s3_lib.c,v 1.99 2015/07/19 06:23:51 doug Exp $ */ | 1 | /* $OpenBSD: s3_lib.c,v 1.100 2015/08/27 06:21:15 doug Exp $ */ |
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) |
| 3 | * All rights reserved. | 3 | * All rights reserved. |
| 4 | * | 4 | * |
| @@ -2112,7 +2112,7 @@ ssl3_clear(SSL *s) | |||
| 2112 | s->s3->total_renegotiations = 0; | 2112 | s->s3->total_renegotiations = 0; |
| 2113 | s->s3->num_renegotiations = 0; | 2113 | s->s3->num_renegotiations = 0; |
| 2114 | s->s3->in_read_app_data = 0; | 2114 | s->s3->in_read_app_data = 0; |
| 2115 | s->version = SSL3_VERSION; | 2115 | s->version = TLS1_VERSION; |
| 2116 | 2116 | ||
| 2117 | free(s->next_proto_negotiated); | 2117 | free(s->next_proto_negotiated); |
| 2118 | s->next_proto_negotiated = NULL; | 2118 | s->next_proto_negotiated = NULL; |
diff --git a/src/lib/libssl/s3_srvr.c b/src/lib/libssl/s3_srvr.c index 7d2ec4d132..5574884b89 100644 --- a/src/lib/libssl/s3_srvr.c +++ b/src/lib/libssl/s3_srvr.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: s3_srvr.c,v 1.112 2015/07/29 19:16:09 miod Exp $ */ | 1 | /* $OpenBSD: s3_srvr.c,v 1.113 2015/08/27 06:21:15 doug Exp $ */ |
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) |
| 3 | * All rights reserved. | 3 | * All rights reserved. |
| 4 | * | 4 | * |
| @@ -166,12 +166,6 @@ | |||
| 166 | 166 | ||
| 167 | #include "bytestring.h" | 167 | #include "bytestring.h" |
| 168 | 168 | ||
| 169 | #ifdef __OpenBSD__ | ||
| 170 | #include <sys/cdefs.h> | ||
| 171 | __warn_references(SSLv3_server_method, | ||
| 172 | "SSLv3_server_method() enables the use of insecure protocols"); | ||
| 173 | #endif | ||
| 174 | |||
| 175 | static const SSL_METHOD *ssl3_get_server_method(int ver); | 169 | static const SSL_METHOD *ssl3_get_server_method(int ver); |
| 176 | 170 | ||
| 177 | const SSL_METHOD SSLv3_server_method_data = { | 171 | const SSL_METHOD SSLv3_server_method_data = { |
| @@ -206,17 +200,9 @@ const SSL_METHOD SSLv3_server_method_data = { | |||
| 206 | .ssl_ctx_callback_ctrl = ssl3_ctx_callback_ctrl, | 200 | .ssl_ctx_callback_ctrl = ssl3_ctx_callback_ctrl, |
| 207 | }; | 201 | }; |
| 208 | 202 | ||
| 209 | const SSL_METHOD * | ||
| 210 | SSLv3_server_method(void) | ||
| 211 | { | ||
| 212 | return &SSLv3_server_method_data; | ||
| 213 | } | ||
| 214 | |||
| 215 | static const SSL_METHOD * | 203 | static const SSL_METHOD * |
| 216 | ssl3_get_server_method(int ver) | 204 | ssl3_get_server_method(int ver) |
| 217 | { | 205 | { |
| 218 | if (ver == SSL3_VERSION) | ||
| 219 | return (SSLv3_server_method()); | ||
| 220 | return (NULL); | 206 | return (NULL); |
| 221 | } | 207 | } |
| 222 | 208 | ||
diff --git a/src/lib/libssl/src/crypto/opensslfeatures.h b/src/lib/libssl/src/crypto/opensslfeatures.h index 45848c5a35..6b6784754d 100644 --- a/src/lib/libssl/src/crypto/opensslfeatures.h +++ b/src/lib/libssl/src/crypto/opensslfeatures.h | |||
| @@ -15,6 +15,8 @@ | |||
| 15 | # define OPENSSL_NO_SEED | 15 | # define OPENSSL_NO_SEED |
| 16 | # define OPENSSL_NO_SRP | 16 | # define OPENSSL_NO_SRP |
| 17 | # define OPENSSL_NO_SSL2 | 17 | # define OPENSSL_NO_SSL2 |
| 18 | # define OPENSSL_NO_SSL3 | ||
| 19 | # define OPENSSL_NO_SSL3_METHOD | ||
| 18 | # define OPENSSL_NO_STORE | 20 | # define OPENSSL_NO_STORE |
| 19 | # define OPENSSL_NO_BUF_FREELISTS | 21 | # define OPENSSL_NO_BUF_FREELISTS |
| 20 | # define OPENSSL_NO_HEARTBEATS | 22 | # define OPENSSL_NO_HEARTBEATS |
diff --git a/src/lib/libssl/src/ssl/s23_clnt.c b/src/lib/libssl/src/ssl/s23_clnt.c index 458eb37d5f..a99a7691bd 100644 --- a/src/lib/libssl/src/ssl/s23_clnt.c +++ b/src/lib/libssl/src/ssl/s23_clnt.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: s23_clnt.c,v 1.40 2015/07/19 07:30:06 doug Exp $ */ | 1 | /* $OpenBSD: s23_clnt.c,v 1.41 2015/08/27 06:21:15 doug Exp $ */ |
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) |
| 3 | * All rights reserved. | 3 | * All rights reserved. |
| 4 | * | 4 | * |
| @@ -196,8 +196,6 @@ SSLv23_client_method(void) | |||
| 196 | static const SSL_METHOD * | 196 | static const SSL_METHOD * |
| 197 | ssl23_get_client_method(int ver) | 197 | ssl23_get_client_method(int ver) |
| 198 | { | 198 | { |
| 199 | if (ver == SSL3_VERSION) | ||
| 200 | return (SSLv3_client_method()); | ||
| 201 | if (ver == TLS1_VERSION) | 199 | if (ver == TLS1_VERSION) |
| 202 | return (TLSv1_client_method()); | 200 | return (TLSv1_client_method()); |
| 203 | if (ver == TLS1_1_VERSION) | 201 | if (ver == TLS1_1_VERSION) |
| @@ -331,7 +329,7 @@ ssl23_client_hello(SSL *s) | |||
| 331 | * TLS1>=1, it would be insufficient to pass SSL_NO_TLSv1, the | 329 | * TLS1>=1, it would be insufficient to pass SSL_NO_TLSv1, the |
| 332 | * answer is SSL_OP_NO_TLSv1|SSL_OP_NO_SSLv3|SSL_OP_NO_SSLv2. | 330 | * answer is SSL_OP_NO_TLSv1|SSL_OP_NO_SSLv3|SSL_OP_NO_SSLv2. |
| 333 | */ | 331 | */ |
| 334 | mask = SSL_OP_NO_TLSv1_1|SSL_OP_NO_TLSv1|SSL_OP_NO_SSLv3; | 332 | mask = SSL_OP_NO_TLSv1_1|SSL_OP_NO_TLSv1; |
| 335 | version = TLS1_2_VERSION; | 333 | version = TLS1_2_VERSION; |
| 336 | 334 | ||
| 337 | if ((options & SSL_OP_NO_TLSv1_2) && (options & mask) != mask) | 335 | if ((options & SSL_OP_NO_TLSv1_2) && (options & mask) != mask) |
| @@ -340,9 +338,6 @@ ssl23_client_hello(SSL *s) | |||
| 340 | if ((options & SSL_OP_NO_TLSv1_1) && (options & mask) != mask) | 338 | if ((options & SSL_OP_NO_TLSv1_1) && (options & mask) != mask) |
| 341 | version = TLS1_VERSION; | 339 | version = TLS1_VERSION; |
| 342 | mask &= ~SSL_OP_NO_TLSv1; | 340 | mask &= ~SSL_OP_NO_TLSv1; |
| 343 | if ((options & SSL_OP_NO_TLSv1) && (options & mask) != mask) | ||
| 344 | version = SSL3_VERSION; | ||
| 345 | mask &= ~SSL_OP_NO_SSLv3; | ||
| 346 | 341 | ||
| 347 | buf = (unsigned char *)s->init_buf->data; | 342 | buf = (unsigned char *)s->init_buf->data; |
| 348 | if (s->state == SSL23_ST_CW_CLNT_HELLO_A) { | 343 | if (s->state == SSL23_ST_CW_CLNT_HELLO_A) { |
| @@ -357,9 +352,6 @@ ssl23_client_hello(SSL *s) | |||
| 357 | } else if (version == TLS1_VERSION) { | 352 | } else if (version == TLS1_VERSION) { |
| 358 | version_major = TLS1_VERSION_MAJOR; | 353 | version_major = TLS1_VERSION_MAJOR; |
| 359 | version_minor = TLS1_VERSION_MINOR; | 354 | version_minor = TLS1_VERSION_MINOR; |
| 360 | } else if (version == SSL3_VERSION) { | ||
| 361 | version_major = SSL3_VERSION_MAJOR; | ||
| 362 | version_minor = SSL3_VERSION_MINOR; | ||
| 363 | } else { | 355 | } else { |
| 364 | SSLerr(SSL_F_SSL23_CLIENT_HELLO, SSL_R_NO_PROTOCOLS_AVAILABLE); | 356 | SSLerr(SSL_F_SSL23_CLIENT_HELLO, SSL_R_NO_PROTOCOLS_AVAILABLE); |
| 365 | return (-1); | 357 | return (-1); |
| @@ -494,11 +486,7 @@ ssl23_get_server_hello(SSL *s) | |||
| 494 | (p[0] == SSL3_RT_ALERT && p[3] == 0 && p[4] == 2))) { | 486 | (p[0] == SSL3_RT_ALERT && p[3] == 0 && p[4] == 2))) { |
| 495 | /* we have sslv3 or tls1 (server hello or alert) */ | 487 | /* we have sslv3 or tls1 (server hello or alert) */ |
| 496 | 488 | ||
| 497 | if ((p[2] == SSL3_VERSION_MINOR) && | 489 | if ((p[2] == TLS1_VERSION_MINOR) && |
| 498 | !(s->options & SSL_OP_NO_SSLv3)) { | ||
| 499 | s->version = SSL3_VERSION; | ||
| 500 | s->method = SSLv3_client_method(); | ||
| 501 | } else if ((p[2] == TLS1_VERSION_MINOR) && | ||
| 502 | !(s->options & SSL_OP_NO_TLSv1)) { | 490 | !(s->options & SSL_OP_NO_TLSv1)) { |
| 503 | s->version = TLS1_VERSION; | 491 | s->version = TLS1_VERSION; |
| 504 | s->method = TLSv1_client_method(); | 492 | s->method = TLSv1_client_method(); |
diff --git a/src/lib/libssl/src/ssl/s23_meth.c b/src/lib/libssl/src/ssl/s23_meth.c index 04152eda41..acc8315b91 100644 --- a/src/lib/libssl/src/ssl/s23_meth.c +++ b/src/lib/libssl/src/ssl/s23_meth.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: s23_meth.c,v 1.19 2015/07/19 07:30:06 doug Exp $ */ | 1 | /* $OpenBSD: s23_meth.c,v 1.20 2015/08/27 06:21:15 doug Exp $ */ |
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) |
| 3 | * All rights reserved. | 3 | * All rights reserved. |
| 4 | * | 4 | * |
| @@ -106,8 +106,6 @@ SSLv23_method(void) | |||
| 106 | static const SSL_METHOD * | 106 | static const SSL_METHOD * |
| 107 | ssl23_get_method(int ver) | 107 | ssl23_get_method(int ver) |
| 108 | { | 108 | { |
| 109 | if (ver == SSL3_VERSION) | ||
| 110 | return (SSLv3_method()); | ||
| 111 | if (ver == TLS1_VERSION) | 109 | if (ver == TLS1_VERSION) |
| 112 | return (TLSv1_method()); | 110 | return (TLSv1_method()); |
| 113 | if (ver == TLS1_1_VERSION) | 111 | if (ver == TLS1_1_VERSION) |
diff --git a/src/lib/libssl/src/ssl/s23_srvr.c b/src/lib/libssl/src/ssl/s23_srvr.c index b524124681..7b2107680e 100644 --- a/src/lib/libssl/src/ssl/s23_srvr.c +++ b/src/lib/libssl/src/ssl/s23_srvr.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: s23_srvr.c,v 1.41 2015/07/19 07:30:06 doug Exp $ */ | 1 | /* $OpenBSD: s23_srvr.c,v 1.42 2015/08/27 06:21:15 doug Exp $ */ |
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) |
| 3 | * All rights reserved. | 3 | * All rights reserved. |
| 4 | * | 4 | * |
| @@ -194,8 +194,6 @@ SSLv23_server_method(void) | |||
| 194 | static const SSL_METHOD * | 194 | static const SSL_METHOD * |
| 195 | ssl23_get_server_method(int ver) | 195 | ssl23_get_server_method(int ver) |
| 196 | { | 196 | { |
| 197 | if (ver == SSL3_VERSION) | ||
| 198 | return (SSLv3_server_method()); | ||
| 199 | if (ver == TLS1_VERSION) | 197 | if (ver == TLS1_VERSION) |
| 200 | return (TLSv1_server_method()); | 198 | return (TLSv1_server_method()); |
| 201 | if (ver == TLS1_1_VERSION) | 199 | if (ver == TLS1_1_VERSION) |
| @@ -357,16 +355,12 @@ ssl23_get_client_hello(SSL *s) | |||
| 357 | /* type=2; */ /* done later to survive restarts */ | 355 | /* type=2; */ /* done later to survive restarts */ |
| 358 | s->state = SSL23_ST_SR_CLNT_HELLO_B; | 356 | s->state = SSL23_ST_SR_CLNT_HELLO_B; |
| 359 | } else if (!(s->options & SSL_OP_NO_SSLv3)) { | 357 | } else if (!(s->options & SSL_OP_NO_SSLv3)) { |
| 360 | s->version = SSL3_VERSION; | 358 | type = 1; |
| 361 | /* type=2; */ | ||
| 362 | s->state = SSL23_ST_SR_CLNT_HELLO_B; | ||
| 363 | } else if (!(s->options & SSL_OP_NO_SSLv2)) { | 359 | } else if (!(s->options & SSL_OP_NO_SSLv2)) { |
| 364 | type = 1; | 360 | type = 1; |
| 365 | } | 361 | } |
| 366 | } else if (!(s->options & SSL_OP_NO_SSLv3)) { | 362 | } else if (!(s->options & SSL_OP_NO_SSLv3)) { |
| 367 | s->version = SSL3_VERSION; | 363 | type = 1; |
| 368 | /* type=2; */ | ||
| 369 | s->state = SSL23_ST_SR_CLNT_HELLO_B; | ||
| 370 | } else if (!(s->options & SSL_OP_NO_SSLv2)) | 364 | } else if (!(s->options & SSL_OP_NO_SSLv2)) |
| 371 | type = 1; | 365 | type = 1; |
| 372 | 366 | ||
| @@ -415,16 +409,9 @@ ssl23_get_client_hello(SSL *s) | |||
| 415 | } else if (!(s->options & SSL_OP_NO_TLSv1)) { | 409 | } else if (!(s->options & SSL_OP_NO_TLSv1)) { |
| 416 | s->version = TLS1_VERSION; | 410 | s->version = TLS1_VERSION; |
| 417 | type = 3; | 411 | type = 3; |
| 418 | } else if (!(s->options & SSL_OP_NO_SSLv3)) { | ||
| 419 | s->version = SSL3_VERSION; | ||
| 420 | type = 3; | ||
| 421 | } | 412 | } |
| 422 | } else { | 413 | } else { |
| 423 | /* client requests SSL 3.0 */ | 414 | if (!(s->options & SSL_OP_NO_TLSv1)) { |
| 424 | if (!(s->options & SSL_OP_NO_SSLv3)) { | ||
| 425 | s->version = SSL3_VERSION; | ||
| 426 | type = 3; | ||
| 427 | } else if (!(s->options & SSL_OP_NO_TLSv1)) { | ||
| 428 | /* we won't be able to use TLS of course, | 415 | /* we won't be able to use TLS of course, |
| 429 | * but this will send an appropriate alert */ | 416 | * but this will send an appropriate alert */ |
| 430 | s->version = TLS1_VERSION; | 417 | s->version = TLS1_VERSION; |
| @@ -587,10 +574,8 @@ ssl23_get_client_hello(SSL *s) | |||
| 587 | s->method = TLSv1_2_server_method(); | 574 | s->method = TLSv1_2_server_method(); |
| 588 | else if (s->version == TLS1_1_VERSION) | 575 | else if (s->version == TLS1_1_VERSION) |
| 589 | s->method = TLSv1_1_server_method(); | 576 | s->method = TLSv1_1_server_method(); |
| 590 | else if (s->version == TLS1_VERSION) | ||
| 591 | s->method = TLSv1_server_method(); | ||
| 592 | else | 577 | else |
| 593 | s->method = SSLv3_server_method(); | 578 | s->method = TLSv1_server_method(); |
| 594 | s->handshake_func = s->method->ssl_accept; | 579 | s->handshake_func = s->method->ssl_accept; |
| 595 | } | 580 | } |
| 596 | 581 | ||
diff --git a/src/lib/libssl/src/ssl/s3_clnt.c b/src/lib/libssl/src/ssl/s3_clnt.c index b739711732..30f679eac3 100644 --- a/src/lib/libssl/src/ssl/s3_clnt.c +++ b/src/lib/libssl/src/ssl/s3_clnt.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: s3_clnt.c,v 1.121 2015/07/29 19:16:09 miod Exp $ */ | 1 | /* $OpenBSD: s3_clnt.c,v 1.122 2015/08/27 06:21:15 doug Exp $ */ |
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) |
| 3 | * All rights reserved. | 3 | * All rights reserved. |
| 4 | * | 4 | * |
| @@ -170,12 +170,6 @@ | |||
| 170 | 170 | ||
| 171 | #include "bytestring.h" | 171 | #include "bytestring.h" |
| 172 | 172 | ||
| 173 | #ifdef __OpenBSD__ | ||
| 174 | #include <sys/cdefs.h> | ||
| 175 | __warn_references(SSLv3_client_method, | ||
| 176 | "SSLv3_client_method() enables the use of insecure protocols"); | ||
| 177 | #endif | ||
| 178 | |||
| 179 | static const SSL_METHOD *ssl3_get_client_method(int ver); | 173 | static const SSL_METHOD *ssl3_get_client_method(int ver); |
| 180 | static int ca_dn_cmp(const X509_NAME * const *a, const X509_NAME * const *b); | 174 | static int ca_dn_cmp(const X509_NAME * const *a, const X509_NAME * const *b); |
| 181 | 175 | ||
| @@ -211,17 +205,9 @@ const SSL_METHOD SSLv3_client_method_data = { | |||
| 211 | .ssl_ctx_callback_ctrl = ssl3_ctx_callback_ctrl, | 205 | .ssl_ctx_callback_ctrl = ssl3_ctx_callback_ctrl, |
| 212 | }; | 206 | }; |
| 213 | 207 | ||
| 214 | const SSL_METHOD * | ||
| 215 | SSLv3_client_method(void) | ||
| 216 | { | ||
| 217 | return &SSLv3_client_method_data; | ||
| 218 | } | ||
| 219 | |||
| 220 | static const SSL_METHOD * | 208 | static const SSL_METHOD * |
| 221 | ssl3_get_client_method(int ver) | 209 | ssl3_get_client_method(int ver) |
| 222 | { | 210 | { |
| 223 | if (ver == SSL3_VERSION) | ||
| 224 | return (SSLv3_client_method()); | ||
| 225 | return (NULL); | 211 | return (NULL); |
| 226 | } | 212 | } |
| 227 | 213 | ||
diff --git a/src/lib/libssl/src/ssl/s3_lib.c b/src/lib/libssl/src/ssl/s3_lib.c index c8bdac0214..42396a21e9 100644 --- a/src/lib/libssl/src/ssl/s3_lib.c +++ b/src/lib/libssl/src/ssl/s3_lib.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: s3_lib.c,v 1.99 2015/07/19 06:23:51 doug Exp $ */ | 1 | /* $OpenBSD: s3_lib.c,v 1.100 2015/08/27 06:21:15 doug Exp $ */ |
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) |
| 3 | * All rights reserved. | 3 | * All rights reserved. |
| 4 | * | 4 | * |
| @@ -2112,7 +2112,7 @@ ssl3_clear(SSL *s) | |||
| 2112 | s->s3->total_renegotiations = 0; | 2112 | s->s3->total_renegotiations = 0; |
| 2113 | s->s3->num_renegotiations = 0; | 2113 | s->s3->num_renegotiations = 0; |
| 2114 | s->s3->in_read_app_data = 0; | 2114 | s->s3->in_read_app_data = 0; |
| 2115 | s->version = SSL3_VERSION; | 2115 | s->version = TLS1_VERSION; |
| 2116 | 2116 | ||
| 2117 | free(s->next_proto_negotiated); | 2117 | free(s->next_proto_negotiated); |
| 2118 | s->next_proto_negotiated = NULL; | 2118 | s->next_proto_negotiated = NULL; |
diff --git a/src/lib/libssl/src/ssl/s3_meth.c b/src/lib/libssl/src/ssl/s3_meth.c index c5f043e944..43fcbd4ade 100644 --- a/src/lib/libssl/src/ssl/s3_meth.c +++ b/src/lib/libssl/src/ssl/s3_meth.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: s3_meth.c,v 1.14 2015/07/29 19:16:09 miod Exp $ */ | 1 | /* $OpenBSD: s3_meth.c,v 1.15 2015/08/27 06:21:15 doug Exp $ */ |
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) |
| 3 | * All rights reserved. | 3 | * All rights reserved. |
| 4 | * | 4 | * |
| @@ -62,12 +62,6 @@ | |||
| 62 | 62 | ||
| 63 | #include "ssl_locl.h" | 63 | #include "ssl_locl.h" |
| 64 | 64 | ||
| 65 | #ifdef __OpenBSD__ | ||
| 66 | #include <sys/cdefs.h> | ||
| 67 | __warn_references(SSLv3_method, | ||
| 68 | "SSLv3_method() enables the use of insecure protocols"); | ||
| 69 | #endif | ||
| 70 | |||
| 71 | static const SSL_METHOD *ssl3_get_method(int ver); | 65 | static const SSL_METHOD *ssl3_get_method(int ver); |
| 72 | 66 | ||
| 73 | const SSL_METHOD SSLv3_method_data = { | 67 | const SSL_METHOD SSLv3_method_data = { |
| @@ -102,16 +96,8 @@ const SSL_METHOD SSLv3_method_data = { | |||
| 102 | .ssl_ctx_callback_ctrl = ssl3_ctx_callback_ctrl, | 96 | .ssl_ctx_callback_ctrl = ssl3_ctx_callback_ctrl, |
| 103 | }; | 97 | }; |
| 104 | 98 | ||
| 105 | const SSL_METHOD * | ||
| 106 | SSLv3_method(void) | ||
| 107 | { | ||
| 108 | return &SSLv3_method_data; | ||
| 109 | } | ||
| 110 | |||
| 111 | static const SSL_METHOD * | 99 | static const SSL_METHOD * |
| 112 | ssl3_get_method(int ver) | 100 | ssl3_get_method(int ver) |
| 113 | { | 101 | { |
| 114 | if (ver == SSL3_VERSION) | ||
| 115 | return (SSLv3_method()); | ||
| 116 | return (NULL); | 102 | return (NULL); |
| 117 | } | 103 | } |
diff --git a/src/lib/libssl/src/ssl/s3_srvr.c b/src/lib/libssl/src/ssl/s3_srvr.c index 7d2ec4d132..5574884b89 100644 --- a/src/lib/libssl/src/ssl/s3_srvr.c +++ b/src/lib/libssl/src/ssl/s3_srvr.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: s3_srvr.c,v 1.112 2015/07/29 19:16:09 miod Exp $ */ | 1 | /* $OpenBSD: s3_srvr.c,v 1.113 2015/08/27 06:21:15 doug Exp $ */ |
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) |
| 3 | * All rights reserved. | 3 | * All rights reserved. |
| 4 | * | 4 | * |
| @@ -166,12 +166,6 @@ | |||
| 166 | 166 | ||
| 167 | #include "bytestring.h" | 167 | #include "bytestring.h" |
| 168 | 168 | ||
| 169 | #ifdef __OpenBSD__ | ||
| 170 | #include <sys/cdefs.h> | ||
| 171 | __warn_references(SSLv3_server_method, | ||
| 172 | "SSLv3_server_method() enables the use of insecure protocols"); | ||
| 173 | #endif | ||
| 174 | |||
| 175 | static const SSL_METHOD *ssl3_get_server_method(int ver); | 169 | static const SSL_METHOD *ssl3_get_server_method(int ver); |
| 176 | 170 | ||
| 177 | const SSL_METHOD SSLv3_server_method_data = { | 171 | const SSL_METHOD SSLv3_server_method_data = { |
| @@ -206,17 +200,9 @@ const SSL_METHOD SSLv3_server_method_data = { | |||
| 206 | .ssl_ctx_callback_ctrl = ssl3_ctx_callback_ctrl, | 200 | .ssl_ctx_callback_ctrl = ssl3_ctx_callback_ctrl, |
| 207 | }; | 201 | }; |
| 208 | 202 | ||
| 209 | const SSL_METHOD * | ||
| 210 | SSLv3_server_method(void) | ||
| 211 | { | ||
| 212 | return &SSLv3_server_method_data; | ||
| 213 | } | ||
| 214 | |||
| 215 | static const SSL_METHOD * | 203 | static const SSL_METHOD * |
| 216 | ssl3_get_server_method(int ver) | 204 | ssl3_get_server_method(int ver) |
| 217 | { | 205 | { |
| 218 | if (ver == SSL3_VERSION) | ||
| 219 | return (SSLv3_server_method()); | ||
| 220 | return (NULL); | 206 | return (NULL); |
| 221 | } | 207 | } |
| 222 | 208 | ||
diff --git a/src/lib/libssl/src/ssl/ssl.h b/src/lib/libssl/src/ssl/ssl.h index 0cd220778b..e7873f5ed4 100644 --- a/src/lib/libssl/src/ssl/ssl.h +++ b/src/lib/libssl/src/ssl/ssl.h | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: ssl.h,v 1.92 2015/07/19 06:31:32 doug Exp $ */ | 1 | /* $OpenBSD: ssl.h,v 1.93 2015/08/27 06:21:15 doug Exp $ */ |
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) |
| 3 | * All rights reserved. | 3 | * All rights reserved. |
| 4 | * | 4 | * |
| @@ -1676,10 +1676,6 @@ const char *SSL_get_version(const SSL *s); | |||
| 1676 | /* This sets the 'default' SSL version that SSL_new() will create */ | 1676 | /* This sets the 'default' SSL version that SSL_new() will create */ |
| 1677 | int SSL_CTX_set_ssl_version(SSL_CTX *ctx, const SSL_METHOD *meth); | 1677 | int SSL_CTX_set_ssl_version(SSL_CTX *ctx, const SSL_METHOD *meth); |
| 1678 | 1678 | ||
| 1679 | const SSL_METHOD *SSLv3_method(void); /* SSLv3 */ | ||
| 1680 | const SSL_METHOD *SSLv3_server_method(void); /* SSLv3 */ | ||
| 1681 | const SSL_METHOD *SSLv3_client_method(void); /* SSLv3 */ | ||
| 1682 | |||
| 1683 | const SSL_METHOD *SSLv23_method(void); /* SSLv3 or TLSv1.* */ | 1679 | const SSL_METHOD *SSLv23_method(void); /* SSLv3 or TLSv1.* */ |
| 1684 | const SSL_METHOD *SSLv23_server_method(void); /* SSLv3 or TLSv1.* */ | 1680 | const SSL_METHOD *SSLv23_server_method(void); /* SSLv3 or TLSv1.* */ |
| 1685 | const SSL_METHOD *SSLv23_client_method(void); /* SSLv3 or TLSv1.* */ | 1681 | const SSL_METHOD *SSLv23_client_method(void); /* SSLv3 or TLSv1.* */ |
diff --git a/src/lib/libssl/src/ssl/ssl_lib.c b/src/lib/libssl/src/ssl/ssl_lib.c index 629ad03554..a93c16de65 100644 --- a/src/lib/libssl/src/ssl/ssl_lib.c +++ b/src/lib/libssl/src/ssl/ssl_lib.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: ssl_lib.c,v 1.105 2015/07/19 20:32:18 doug Exp $ */ | 1 | /* $OpenBSD: ssl_lib.c,v 1.106 2015/08/27 06:21:15 doug Exp $ */ |
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) |
| 3 | * All rights reserved. | 3 | * All rights reserved. |
| 4 | * | 4 | * |
| @@ -2549,8 +2549,6 @@ ssl_version_string(int ver) | |||
| 2549 | return (SSL_TXT_DTLS1_BAD); | 2549 | return (SSL_TXT_DTLS1_BAD); |
| 2550 | case DTLS1_VERSION: | 2550 | case DTLS1_VERSION: |
| 2551 | return (SSL_TXT_DTLS1); | 2551 | return (SSL_TXT_DTLS1); |
| 2552 | case SSL3_VERSION: | ||
| 2553 | return (SSL_TXT_SSLV3); | ||
| 2554 | case TLS1_VERSION: | 2552 | case TLS1_VERSION: |
| 2555 | return (SSL_TXT_TLSV1); | 2553 | return (SSL_TXT_TLSV1); |
| 2556 | case TLS1_1_VERSION: | 2554 | case TLS1_1_VERSION: |
| @@ -2591,9 +2589,6 @@ ssl_max_server_version(SSL *s) | |||
| 2591 | if ((s->options & SSL_OP_NO_TLSv1) == 0 && | 2589 | if ((s->options & SSL_OP_NO_TLSv1) == 0 && |
| 2592 | max_version >= TLS1_VERSION) | 2590 | max_version >= TLS1_VERSION) |
| 2593 | return (TLS1_VERSION); | 2591 | return (TLS1_VERSION); |
| 2594 | if ((s->options & SSL_OP_NO_SSLv3) == 0 && | ||
| 2595 | max_version >= SSL3_VERSION) | ||
| 2596 | return (SSL3_VERSION); | ||
| 2597 | 2592 | ||
| 2598 | return (0); | 2593 | return (0); |
| 2599 | } | 2594 | } |
diff --git a/src/lib/libssl/src/ssl/ssl_sess.c b/src/lib/libssl/src/ssl/ssl_sess.c index ef5b9be56d..a688b9ef41 100644 --- a/src/lib/libssl/src/ssl/ssl_sess.c +++ b/src/lib/libssl/src/ssl/ssl_sess.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: ssl_sess.c,v 1.45 2015/07/21 03:34:38 doug Exp $ */ | 1 | /* $OpenBSD: ssl_sess.c,v 1.46 2015/08/27 06:21:15 doug Exp $ */ |
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) |
| 3 | * All rights reserved. | 3 | * All rights reserved. |
| 4 | * | 4 | * |
| @@ -300,7 +300,6 @@ ssl_get_new_session(SSL *s, int session) | |||
| 300 | 300 | ||
| 301 | if (session) { | 301 | if (session) { |
| 302 | switch (s->version) { | 302 | switch (s->version) { |
| 303 | case SSL3_VERSION: | ||
| 304 | case TLS1_VERSION: | 303 | case TLS1_VERSION: |
| 305 | case TLS1_1_VERSION: | 304 | case TLS1_1_VERSION: |
| 306 | case TLS1_2_VERSION: | 305 | case TLS1_2_VERSION: |
diff --git a/src/lib/libssl/ssl.h b/src/lib/libssl/ssl.h index 0cd220778b..e7873f5ed4 100644 --- a/src/lib/libssl/ssl.h +++ b/src/lib/libssl/ssl.h | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: ssl.h,v 1.92 2015/07/19 06:31:32 doug Exp $ */ | 1 | /* $OpenBSD: ssl.h,v 1.93 2015/08/27 06:21:15 doug Exp $ */ |
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) |
| 3 | * All rights reserved. | 3 | * All rights reserved. |
| 4 | * | 4 | * |
| @@ -1676,10 +1676,6 @@ const char *SSL_get_version(const SSL *s); | |||
| 1676 | /* This sets the 'default' SSL version that SSL_new() will create */ | 1676 | /* This sets the 'default' SSL version that SSL_new() will create */ |
| 1677 | int SSL_CTX_set_ssl_version(SSL_CTX *ctx, const SSL_METHOD *meth); | 1677 | int SSL_CTX_set_ssl_version(SSL_CTX *ctx, const SSL_METHOD *meth); |
| 1678 | 1678 | ||
| 1679 | const SSL_METHOD *SSLv3_method(void); /* SSLv3 */ | ||
| 1680 | const SSL_METHOD *SSLv3_server_method(void); /* SSLv3 */ | ||
| 1681 | const SSL_METHOD *SSLv3_client_method(void); /* SSLv3 */ | ||
| 1682 | |||
| 1683 | const SSL_METHOD *SSLv23_method(void); /* SSLv3 or TLSv1.* */ | 1679 | const SSL_METHOD *SSLv23_method(void); /* SSLv3 or TLSv1.* */ |
| 1684 | const SSL_METHOD *SSLv23_server_method(void); /* SSLv3 or TLSv1.* */ | 1680 | const SSL_METHOD *SSLv23_server_method(void); /* SSLv3 or TLSv1.* */ |
| 1685 | const SSL_METHOD *SSLv23_client_method(void); /* SSLv3 or TLSv1.* */ | 1681 | const SSL_METHOD *SSLv23_client_method(void); /* SSLv3 or TLSv1.* */ |
diff --git a/src/lib/libssl/ssl_lib.c b/src/lib/libssl/ssl_lib.c index 629ad03554..a93c16de65 100644 --- a/src/lib/libssl/ssl_lib.c +++ b/src/lib/libssl/ssl_lib.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: ssl_lib.c,v 1.105 2015/07/19 20:32:18 doug Exp $ */ | 1 | /* $OpenBSD: ssl_lib.c,v 1.106 2015/08/27 06:21:15 doug Exp $ */ |
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) |
| 3 | * All rights reserved. | 3 | * All rights reserved. |
| 4 | * | 4 | * |
| @@ -2549,8 +2549,6 @@ ssl_version_string(int ver) | |||
| 2549 | return (SSL_TXT_DTLS1_BAD); | 2549 | return (SSL_TXT_DTLS1_BAD); |
| 2550 | case DTLS1_VERSION: | 2550 | case DTLS1_VERSION: |
| 2551 | return (SSL_TXT_DTLS1); | 2551 | return (SSL_TXT_DTLS1); |
| 2552 | case SSL3_VERSION: | ||
| 2553 | return (SSL_TXT_SSLV3); | ||
| 2554 | case TLS1_VERSION: | 2552 | case TLS1_VERSION: |
| 2555 | return (SSL_TXT_TLSV1); | 2553 | return (SSL_TXT_TLSV1); |
| 2556 | case TLS1_1_VERSION: | 2554 | case TLS1_1_VERSION: |
| @@ -2591,9 +2589,6 @@ ssl_max_server_version(SSL *s) | |||
| 2591 | if ((s->options & SSL_OP_NO_TLSv1) == 0 && | 2589 | if ((s->options & SSL_OP_NO_TLSv1) == 0 && |
| 2592 | max_version >= TLS1_VERSION) | 2590 | max_version >= TLS1_VERSION) |
| 2593 | return (TLS1_VERSION); | 2591 | return (TLS1_VERSION); |
| 2594 | if ((s->options & SSL_OP_NO_SSLv3) == 0 && | ||
| 2595 | max_version >= SSL3_VERSION) | ||
| 2596 | return (SSL3_VERSION); | ||
| 2597 | 2592 | ||
| 2598 | return (0); | 2593 | return (0); |
| 2599 | } | 2594 | } |
diff --git a/src/lib/libssl/ssl_sess.c b/src/lib/libssl/ssl_sess.c index ef5b9be56d..a688b9ef41 100644 --- a/src/lib/libssl/ssl_sess.c +++ b/src/lib/libssl/ssl_sess.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: ssl_sess.c,v 1.45 2015/07/21 03:34:38 doug Exp $ */ | 1 | /* $OpenBSD: ssl_sess.c,v 1.46 2015/08/27 06:21:15 doug Exp $ */ |
| 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) |
| 3 | * All rights reserved. | 3 | * All rights reserved. |
| 4 | * | 4 | * |
| @@ -300,7 +300,6 @@ ssl_get_new_session(SSL *s, int session) | |||
| 300 | 300 | ||
| 301 | if (session) { | 301 | if (session) { |
| 302 | switch (s->version) { | 302 | switch (s->version) { |
| 303 | case SSL3_VERSION: | ||
| 304 | case TLS1_VERSION: | 303 | case TLS1_VERSION: |
| 305 | case TLS1_1_VERSION: | 304 | case TLS1_1_VERSION: |
| 306 | case TLS1_2_VERSION: | 305 | case TLS1_2_VERSION: |