summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/lib/libssl/s3_both.c11
-rw-r--r--src/lib/libssl/s3_clnt.c10
-rw-r--r--src/lib/libssl/s3_lib.c4
-rw-r--r--src/lib/libssl/s3_srvr.c18
-rw-r--r--src/lib/libssl/src/ssl/s3_both.c11
-rw-r--r--src/lib/libssl/src/ssl/s3_clnt.c10
-rw-r--r--src/lib/libssl/src/ssl/s3_lib.c4
-rw-r--r--src/lib/libssl/src/ssl/s3_srvr.c18
-rw-r--r--src/lib/libssl/src/ssl/ssl_lib.c10
-rw-r--r--src/lib/libssl/src/ssl/t1_lib.c18
-rw-r--r--src/lib/libssl/ssl_lib.c10
-rw-r--r--src/lib/libssl/t1_lib.c18
12 files changed, 12 insertions, 130 deletions
diff --git a/src/lib/libssl/s3_both.c b/src/lib/libssl/s3_both.c
index ffc10774d8..297665430a 100644
--- a/src/lib/libssl/s3_both.c
+++ b/src/lib/libssl/s3_both.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: s3_both.c,v 1.34 2014/12/10 15:43:31 jsing Exp $ */ 1/* $OpenBSD: s3_both.c,v 1.35 2014/12/14 14:34:43 jsing Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved. 3 * All rights reserved.
4 * 4 *
@@ -194,7 +194,6 @@ ssl3_send_finished(SSL *s, int a, int b, const char *sender, int slen)
194 return (ssl3_do_write(s, SSL3_RT_HANDSHAKE)); 194 return (ssl3_do_write(s, SSL3_RT_HANDSHAKE));
195} 195}
196 196
197#ifndef OPENSSL_NO_NEXTPROTONEG
198/* ssl3_take_mac calculates the Finished MAC for the handshakes messages seen to far. */ 197/* ssl3_take_mac calculates the Finished MAC for the handshakes messages seen to far. */
199static void 198static void
200ssl3_take_mac(SSL *s) 199ssl3_take_mac(SSL *s)
@@ -217,7 +216,6 @@ ssl3_take_mac(SSL *s)
217 s->s3->tmp.peer_finish_md_len = s->method->ssl3_enc->final_finish_mac(s, 216 s->s3->tmp.peer_finish_md_len = s->method->ssl3_enc->final_finish_mac(s,
218 sender, slen, s->s3->tmp.peer_finish_md); 217 sender, slen, s->s3->tmp.peer_finish_md);
219} 218}
220#endif
221 219
222int 220int
223ssl3_get_finished(SSL *s, int a, int b) 221ssl3_get_finished(SSL *s, int a, int b)
@@ -226,11 +224,6 @@ ssl3_get_finished(SSL *s, int a, int b)
226 long n; 224 long n;
227 unsigned char *p; 225 unsigned char *p;
228 226
229#ifdef OPENSSL_NO_NEXTPROTONEG
230 /* the mac has already been generated when we received the
231 * change cipher spec message and is in s->s3->tmp.peer_finish_md.
232 */
233#endif
234 227
235 n = s->method->ssl_get_message(s, a, b, SSL3_MT_FINISHED, 228 n = s->method->ssl_get_message(s, a, b, SSL3_MT_FINISHED,
236 64, /* should actually be 36+4 :-) */ &ok); 229 64, /* should actually be 36+4 :-) */ &ok);
@@ -505,12 +498,10 @@ ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)
505 n -= i; 498 n -= i;
506 } 499 }
507 500
508#ifndef OPENSSL_NO_NEXTPROTONEG
509 /* If receiving Finished, record MAC of prior handshake messages for 501 /* If receiving Finished, record MAC of prior handshake messages for
510 * Finished verification. */ 502 * Finished verification. */
511 if (*s->init_buf->data == SSL3_MT_FINISHED) 503 if (*s->init_buf->data == SSL3_MT_FINISHED)
512 ssl3_take_mac(s); 504 ssl3_take_mac(s);
513#endif
514 505
515 /* Feed this message into MAC computation. */ 506 /* Feed this message into MAC computation. */
516 ssl3_finish_mac(s, (unsigned char *)s->init_buf->data, s->init_num + 4); 507 ssl3_finish_mac(s, (unsigned char *)s->init_buf->data, s->init_num + 4);
diff --git a/src/lib/libssl/s3_clnt.c b/src/lib/libssl/s3_clnt.c
index e7741826ae..260154a097 100644
--- a/src/lib/libssl/s3_clnt.c
+++ b/src/lib/libssl/s3_clnt.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: s3_clnt.c,v 1.99 2014/12/10 15:43:31 jsing Exp $ */ 1/* $OpenBSD: s3_clnt.c,v 1.100 2014/12/14 14:34:43 jsing Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved. 3 * All rights reserved.
4 * 4 *
@@ -465,14 +465,10 @@ ssl3_connect(SSL *s)
465 if (ret <= 0) 465 if (ret <= 0)
466 goto end; 466 goto end;
467 467
468#ifdef OPENSSL_NO_NEXTPROTONEG
469 s->state = SSL3_ST_CW_FINISHED_A;
470#else
471 if (s->s3->next_proto_neg_seen) 468 if (s->s3->next_proto_neg_seen)
472 s->state = SSL3_ST_CW_NEXT_PROTO_A; 469 s->state = SSL3_ST_CW_NEXT_PROTO_A;
473 else 470 else
474 s->state = SSL3_ST_CW_FINISHED_A; 471 s->state = SSL3_ST_CW_FINISHED_A;
475#endif
476 s->init_num = 0; 472 s->init_num = 0;
477 473
478 s->session->cipher = s->s3->tmp.new_cipher; 474 s->session->cipher = s->s3->tmp.new_cipher;
@@ -489,7 +485,6 @@ ssl3_connect(SSL *s)
489 485
490 break; 486 break;
491 487
492#ifndef OPENSSL_NO_NEXTPROTONEG
493 case SSL3_ST_CW_NEXT_PROTO_A: 488 case SSL3_ST_CW_NEXT_PROTO_A:
494 case SSL3_ST_CW_NEXT_PROTO_B: 489 case SSL3_ST_CW_NEXT_PROTO_B:
495 ret = ssl3_send_next_proto(s); 490 ret = ssl3_send_next_proto(s);
@@ -497,7 +492,6 @@ ssl3_connect(SSL *s)
497 goto end; 492 goto end;
498 s->state = SSL3_ST_CW_FINISHED_A; 493 s->state = SSL3_ST_CW_FINISHED_A;
499 break; 494 break;
500#endif
501 495
502 case SSL3_ST_CW_FINISHED_A: 496 case SSL3_ST_CW_FINISHED_A:
503 case SSL3_ST_CW_FINISHED_B: 497 case SSL3_ST_CW_FINISHED_B:
@@ -2634,7 +2628,6 @@ err:
2634 return (0); 2628 return (0);
2635} 2629}
2636 2630
2637#ifndef OPENSSL_NO_NEXTPROTONEG
2638int 2631int
2639ssl3_send_next_proto(SSL *s) 2632ssl3_send_next_proto(SSL *s)
2640{ 2633{
@@ -2658,7 +2651,6 @@ ssl3_send_next_proto(SSL *s)
2658 2651
2659 return (ssl3_do_write(s, SSL3_RT_HANDSHAKE)); 2652 return (ssl3_do_write(s, SSL3_RT_HANDSHAKE));
2660} 2653}
2661#endif /* !OPENSSL_NO_NEXTPROTONEG */
2662 2654
2663/* 2655/*
2664 * Check to see if handshake is full or resumed. Usually this is just a 2656 * Check to see if handshake is full or resumed. Usually this is just a
diff --git a/src/lib/libssl/s3_lib.c b/src/lib/libssl/s3_lib.c
index 4beee2d53c..21e339525c 100644
--- a/src/lib/libssl/s3_lib.c
+++ b/src/lib/libssl/s3_lib.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: s3_lib.c,v 1.87 2014/12/10 15:36:47 jsing Exp $ */ 1/* $OpenBSD: s3_lib.c,v 1.88 2014/12/14 14:34:43 jsing Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved. 3 * All rights reserved.
4 * 4 *
@@ -1927,11 +1927,9 @@ ssl3_clear(SSL *s)
1927 s->s3->in_read_app_data = 0; 1927 s->s3->in_read_app_data = 0;
1928 s->version = SSL3_VERSION; 1928 s->version = SSL3_VERSION;
1929 1929
1930#ifndef OPENSSL_NO_NEXTPROTONEG
1931 free(s->next_proto_negotiated); 1930 free(s->next_proto_negotiated);
1932 s->next_proto_negotiated = NULL; 1931 s->next_proto_negotiated = NULL;
1933 s->next_proto_negotiated_len = 0; 1932 s->next_proto_negotiated_len = 0;
1934#endif
1935} 1933}
1936 1934
1937 1935
diff --git a/src/lib/libssl/s3_srvr.c b/src/lib/libssl/s3_srvr.c
index 645caf4bc9..783b1df782 100644
--- a/src/lib/libssl/s3_srvr.c
+++ b/src/lib/libssl/s3_srvr.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: s3_srvr.c,v 1.93 2014/12/10 15:43:31 jsing Exp $ */ 1/* $OpenBSD: s3_srvr.c,v 1.94 2014/12/14 14:34:43 jsing Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved. 3 * All rights reserved.
4 * 4 *
@@ -537,14 +537,10 @@ ssl3_accept(SSL *s)
537 * the client uses its key from the certificate 537 * the client uses its key from the certificate
538 * for key exchange. 538 * for key exchange.
539 */ 539 */
540#ifdef OPENSSL_NO_NEXTPROTONEG
541 s->state = SSL3_ST_SR_FINISHED_A;
542#else
543 if (s->s3->next_proto_neg_seen) 540 if (s->s3->next_proto_neg_seen)
544 s->state = SSL3_ST_SR_NEXT_PROTO_A; 541 s->state = SSL3_ST_SR_NEXT_PROTO_A;
545 else 542 else
546 s->state = SSL3_ST_SR_FINISHED_A; 543 s->state = SSL3_ST_SR_FINISHED_A;
547#endif
548 s->init_num = 0; 544 s->init_num = 0;
549 } else if (SSL_USE_SIGALGS(s) || (alg_k & SSL_kGOST)) { 545 } else if (SSL_USE_SIGALGS(s) || (alg_k & SSL_kGOST)) {
550 s->state = SSL3_ST_SR_CERT_VRFY_A; 546 s->state = SSL3_ST_SR_CERT_VRFY_A;
@@ -609,18 +605,13 @@ ssl3_accept(SSL *s)
609 if (ret <= 0) 605 if (ret <= 0)
610 goto end; 606 goto end;
611 607
612#ifdef OPENSSL_NO_NEXTPROTONEG
613 s->state = SSL3_ST_SR_FINISHED_A;
614#else
615 if (s->s3->next_proto_neg_seen) 608 if (s->s3->next_proto_neg_seen)
616 s->state = SSL3_ST_SR_NEXT_PROTO_A; 609 s->state = SSL3_ST_SR_NEXT_PROTO_A;
617 else 610 else
618 s->state = SSL3_ST_SR_FINISHED_A; 611 s->state = SSL3_ST_SR_FINISHED_A;
619#endif
620 s->init_num = 0; 612 s->init_num = 0;
621 break; 613 break;
622 614
623#ifndef OPENSSL_NO_NEXTPROTONEG
624 case SSL3_ST_SR_NEXT_PROTO_A: 615 case SSL3_ST_SR_NEXT_PROTO_A:
625 case SSL3_ST_SR_NEXT_PROTO_B: 616 case SSL3_ST_SR_NEXT_PROTO_B:
626 ret = ssl3_get_next_proto(s); 617 ret = ssl3_get_next_proto(s);
@@ -629,7 +620,6 @@ ssl3_accept(SSL *s)
629 s->init_num = 0; 620 s->init_num = 0;
630 s->state = SSL3_ST_SR_FINISHED_A; 621 s->state = SSL3_ST_SR_FINISHED_A;
631 break; 622 break;
632#endif
633 623
634 case SSL3_ST_SR_FINISHED_A: 624 case SSL3_ST_SR_FINISHED_A:
635 case SSL3_ST_SR_FINISHED_B: 625 case SSL3_ST_SR_FINISHED_B:
@@ -701,9 +691,6 @@ ssl3_accept(SSL *s)
701 goto end; 691 goto end;
702 s->state = SSL3_ST_SW_FLUSH; 692 s->state = SSL3_ST_SW_FLUSH;
703 if (s->hit) { 693 if (s->hit) {
704#ifdef OPENSSL_NO_NEXTPROTONEG
705 s->s3->tmp.next_state = SSL3_ST_SR_FINISHED_A;
706#else
707 if (s->s3->next_proto_neg_seen) { 694 if (s->s3->next_proto_neg_seen) {
708 s->s3->flags |= SSL3_FLAGS_CCS_OK; 695 s->s3->flags |= SSL3_FLAGS_CCS_OK;
709 s->s3->tmp.next_state = 696 s->s3->tmp.next_state =
@@ -711,7 +698,6 @@ ssl3_accept(SSL *s)
711 } else 698 } else
712 s->s3->tmp.next_state = 699 s->s3->tmp.next_state =
713 SSL3_ST_SR_FINISHED_A; 700 SSL3_ST_SR_FINISHED_A;
714#endif
715 } else 701 } else
716 s->s3->tmp.next_state = SSL_ST_OK; 702 s->s3->tmp.next_state = SSL_ST_OK;
717 s->init_num = 0; 703 s->init_num = 0;
@@ -2850,7 +2836,6 @@ ssl3_send_cert_status(SSL *s)
2850 return (ssl3_do_write(s, SSL3_RT_HANDSHAKE)); 2836 return (ssl3_do_write(s, SSL3_RT_HANDSHAKE));
2851} 2837}
2852 2838
2853# ifndef OPENSSL_NO_NEXTPROTONEG
2854/* 2839/*
2855 * ssl3_get_next_proto reads a Next Protocol Negotiation handshake message. 2840 * ssl3_get_next_proto reads a Next Protocol Negotiation handshake message.
2856 * It sets the next_proto member in s if found 2841 * It sets the next_proto member in s if found
@@ -2921,4 +2906,3 @@ ssl3_get_next_proto(SSL *s)
2921 2906
2922 return (1); 2907 return (1);
2923} 2908}
2924# endif
diff --git a/src/lib/libssl/src/ssl/s3_both.c b/src/lib/libssl/src/ssl/s3_both.c
index ffc10774d8..297665430a 100644
--- a/src/lib/libssl/src/ssl/s3_both.c
+++ b/src/lib/libssl/src/ssl/s3_both.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: s3_both.c,v 1.34 2014/12/10 15:43:31 jsing Exp $ */ 1/* $OpenBSD: s3_both.c,v 1.35 2014/12/14 14:34:43 jsing Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved. 3 * All rights reserved.
4 * 4 *
@@ -194,7 +194,6 @@ ssl3_send_finished(SSL *s, int a, int b, const char *sender, int slen)
194 return (ssl3_do_write(s, SSL3_RT_HANDSHAKE)); 194 return (ssl3_do_write(s, SSL3_RT_HANDSHAKE));
195} 195}
196 196
197#ifndef OPENSSL_NO_NEXTPROTONEG
198/* ssl3_take_mac calculates the Finished MAC for the handshakes messages seen to far. */ 197/* ssl3_take_mac calculates the Finished MAC for the handshakes messages seen to far. */
199static void 198static void
200ssl3_take_mac(SSL *s) 199ssl3_take_mac(SSL *s)
@@ -217,7 +216,6 @@ ssl3_take_mac(SSL *s)
217 s->s3->tmp.peer_finish_md_len = s->method->ssl3_enc->final_finish_mac(s, 216 s->s3->tmp.peer_finish_md_len = s->method->ssl3_enc->final_finish_mac(s,
218 sender, slen, s->s3->tmp.peer_finish_md); 217 sender, slen, s->s3->tmp.peer_finish_md);
219} 218}
220#endif
221 219
222int 220int
223ssl3_get_finished(SSL *s, int a, int b) 221ssl3_get_finished(SSL *s, int a, int b)
@@ -226,11 +224,6 @@ ssl3_get_finished(SSL *s, int a, int b)
226 long n; 224 long n;
227 unsigned char *p; 225 unsigned char *p;
228 226
229#ifdef OPENSSL_NO_NEXTPROTONEG
230 /* the mac has already been generated when we received the
231 * change cipher spec message and is in s->s3->tmp.peer_finish_md.
232 */
233#endif
234 227
235 n = s->method->ssl_get_message(s, a, b, SSL3_MT_FINISHED, 228 n = s->method->ssl_get_message(s, a, b, SSL3_MT_FINISHED,
236 64, /* should actually be 36+4 :-) */ &ok); 229 64, /* should actually be 36+4 :-) */ &ok);
@@ -505,12 +498,10 @@ ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)
505 n -= i; 498 n -= i;
506 } 499 }
507 500
508#ifndef OPENSSL_NO_NEXTPROTONEG
509 /* If receiving Finished, record MAC of prior handshake messages for 501 /* If receiving Finished, record MAC of prior handshake messages for
510 * Finished verification. */ 502 * Finished verification. */
511 if (*s->init_buf->data == SSL3_MT_FINISHED) 503 if (*s->init_buf->data == SSL3_MT_FINISHED)
512 ssl3_take_mac(s); 504 ssl3_take_mac(s);
513#endif
514 505
515 /* Feed this message into MAC computation. */ 506 /* Feed this message into MAC computation. */
516 ssl3_finish_mac(s, (unsigned char *)s->init_buf->data, s->init_num + 4); 507 ssl3_finish_mac(s, (unsigned char *)s->init_buf->data, s->init_num + 4);
diff --git a/src/lib/libssl/src/ssl/s3_clnt.c b/src/lib/libssl/src/ssl/s3_clnt.c
index e7741826ae..260154a097 100644
--- a/src/lib/libssl/src/ssl/s3_clnt.c
+++ b/src/lib/libssl/src/ssl/s3_clnt.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: s3_clnt.c,v 1.99 2014/12/10 15:43:31 jsing Exp $ */ 1/* $OpenBSD: s3_clnt.c,v 1.100 2014/12/14 14:34:43 jsing Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved. 3 * All rights reserved.
4 * 4 *
@@ -465,14 +465,10 @@ ssl3_connect(SSL *s)
465 if (ret <= 0) 465 if (ret <= 0)
466 goto end; 466 goto end;
467 467
468#ifdef OPENSSL_NO_NEXTPROTONEG
469 s->state = SSL3_ST_CW_FINISHED_A;
470#else
471 if (s->s3->next_proto_neg_seen) 468 if (s->s3->next_proto_neg_seen)
472 s->state = SSL3_ST_CW_NEXT_PROTO_A; 469 s->state = SSL3_ST_CW_NEXT_PROTO_A;
473 else 470 else
474 s->state = SSL3_ST_CW_FINISHED_A; 471 s->state = SSL3_ST_CW_FINISHED_A;
475#endif
476 s->init_num = 0; 472 s->init_num = 0;
477 473
478 s->session->cipher = s->s3->tmp.new_cipher; 474 s->session->cipher = s->s3->tmp.new_cipher;
@@ -489,7 +485,6 @@ ssl3_connect(SSL *s)
489 485
490 break; 486 break;
491 487
492#ifndef OPENSSL_NO_NEXTPROTONEG
493 case SSL3_ST_CW_NEXT_PROTO_A: 488 case SSL3_ST_CW_NEXT_PROTO_A:
494 case SSL3_ST_CW_NEXT_PROTO_B: 489 case SSL3_ST_CW_NEXT_PROTO_B:
495 ret = ssl3_send_next_proto(s); 490 ret = ssl3_send_next_proto(s);
@@ -497,7 +492,6 @@ ssl3_connect(SSL *s)
497 goto end; 492 goto end;
498 s->state = SSL3_ST_CW_FINISHED_A; 493 s->state = SSL3_ST_CW_FINISHED_A;
499 break; 494 break;
500#endif
501 495
502 case SSL3_ST_CW_FINISHED_A: 496 case SSL3_ST_CW_FINISHED_A:
503 case SSL3_ST_CW_FINISHED_B: 497 case SSL3_ST_CW_FINISHED_B:
@@ -2634,7 +2628,6 @@ err:
2634 return (0); 2628 return (0);
2635} 2629}
2636 2630
2637#ifndef OPENSSL_NO_NEXTPROTONEG
2638int 2631int
2639ssl3_send_next_proto(SSL *s) 2632ssl3_send_next_proto(SSL *s)
2640{ 2633{
@@ -2658,7 +2651,6 @@ ssl3_send_next_proto(SSL *s)
2658 2651
2659 return (ssl3_do_write(s, SSL3_RT_HANDSHAKE)); 2652 return (ssl3_do_write(s, SSL3_RT_HANDSHAKE));
2660} 2653}
2661#endif /* !OPENSSL_NO_NEXTPROTONEG */
2662 2654
2663/* 2655/*
2664 * Check to see if handshake is full or resumed. Usually this is just a 2656 * Check to see if handshake is full or resumed. Usually this is just a
diff --git a/src/lib/libssl/src/ssl/s3_lib.c b/src/lib/libssl/src/ssl/s3_lib.c
index 4beee2d53c..21e339525c 100644
--- a/src/lib/libssl/src/ssl/s3_lib.c
+++ b/src/lib/libssl/src/ssl/s3_lib.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: s3_lib.c,v 1.87 2014/12/10 15:36:47 jsing Exp $ */ 1/* $OpenBSD: s3_lib.c,v 1.88 2014/12/14 14:34:43 jsing Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved. 3 * All rights reserved.
4 * 4 *
@@ -1927,11 +1927,9 @@ ssl3_clear(SSL *s)
1927 s->s3->in_read_app_data = 0; 1927 s->s3->in_read_app_data = 0;
1928 s->version = SSL3_VERSION; 1928 s->version = SSL3_VERSION;
1929 1929
1930#ifndef OPENSSL_NO_NEXTPROTONEG
1931 free(s->next_proto_negotiated); 1930 free(s->next_proto_negotiated);
1932 s->next_proto_negotiated = NULL; 1931 s->next_proto_negotiated = NULL;
1933 s->next_proto_negotiated_len = 0; 1932 s->next_proto_negotiated_len = 0;
1934#endif
1935} 1933}
1936 1934
1937 1935
diff --git a/src/lib/libssl/src/ssl/s3_srvr.c b/src/lib/libssl/src/ssl/s3_srvr.c
index 645caf4bc9..783b1df782 100644
--- a/src/lib/libssl/src/ssl/s3_srvr.c
+++ b/src/lib/libssl/src/ssl/s3_srvr.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: s3_srvr.c,v 1.93 2014/12/10 15:43:31 jsing Exp $ */ 1/* $OpenBSD: s3_srvr.c,v 1.94 2014/12/14 14:34:43 jsing Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved. 3 * All rights reserved.
4 * 4 *
@@ -537,14 +537,10 @@ ssl3_accept(SSL *s)
537 * the client uses its key from the certificate 537 * the client uses its key from the certificate
538 * for key exchange. 538 * for key exchange.
539 */ 539 */
540#ifdef OPENSSL_NO_NEXTPROTONEG
541 s->state = SSL3_ST_SR_FINISHED_A;
542#else
543 if (s->s3->next_proto_neg_seen) 540 if (s->s3->next_proto_neg_seen)
544 s->state = SSL3_ST_SR_NEXT_PROTO_A; 541 s->state = SSL3_ST_SR_NEXT_PROTO_A;
545 else 542 else
546 s->state = SSL3_ST_SR_FINISHED_A; 543 s->state = SSL3_ST_SR_FINISHED_A;
547#endif
548 s->init_num = 0; 544 s->init_num = 0;
549 } else if (SSL_USE_SIGALGS(s) || (alg_k & SSL_kGOST)) { 545 } else if (SSL_USE_SIGALGS(s) || (alg_k & SSL_kGOST)) {
550 s->state = SSL3_ST_SR_CERT_VRFY_A; 546 s->state = SSL3_ST_SR_CERT_VRFY_A;
@@ -609,18 +605,13 @@ ssl3_accept(SSL *s)
609 if (ret <= 0) 605 if (ret <= 0)
610 goto end; 606 goto end;
611 607
612#ifdef OPENSSL_NO_NEXTPROTONEG
613 s->state = SSL3_ST_SR_FINISHED_A;
614#else
615 if (s->s3->next_proto_neg_seen) 608 if (s->s3->next_proto_neg_seen)
616 s->state = SSL3_ST_SR_NEXT_PROTO_A; 609 s->state = SSL3_ST_SR_NEXT_PROTO_A;
617 else 610 else
618 s->state = SSL3_ST_SR_FINISHED_A; 611 s->state = SSL3_ST_SR_FINISHED_A;
619#endif
620 s->init_num = 0; 612 s->init_num = 0;
621 break; 613 break;
622 614
623#ifndef OPENSSL_NO_NEXTPROTONEG
624 case SSL3_ST_SR_NEXT_PROTO_A: 615 case SSL3_ST_SR_NEXT_PROTO_A:
625 case SSL3_ST_SR_NEXT_PROTO_B: 616 case SSL3_ST_SR_NEXT_PROTO_B:
626 ret = ssl3_get_next_proto(s); 617 ret = ssl3_get_next_proto(s);
@@ -629,7 +620,6 @@ ssl3_accept(SSL *s)
629 s->init_num = 0; 620 s->init_num = 0;
630 s->state = SSL3_ST_SR_FINISHED_A; 621 s->state = SSL3_ST_SR_FINISHED_A;
631 break; 622 break;
632#endif
633 623
634 case SSL3_ST_SR_FINISHED_A: 624 case SSL3_ST_SR_FINISHED_A:
635 case SSL3_ST_SR_FINISHED_B: 625 case SSL3_ST_SR_FINISHED_B:
@@ -701,9 +691,6 @@ ssl3_accept(SSL *s)
701 goto end; 691 goto end;
702 s->state = SSL3_ST_SW_FLUSH; 692 s->state = SSL3_ST_SW_FLUSH;
703 if (s->hit) { 693 if (s->hit) {
704#ifdef OPENSSL_NO_NEXTPROTONEG
705 s->s3->tmp.next_state = SSL3_ST_SR_FINISHED_A;
706#else
707 if (s->s3->next_proto_neg_seen) { 694 if (s->s3->next_proto_neg_seen) {
708 s->s3->flags |= SSL3_FLAGS_CCS_OK; 695 s->s3->flags |= SSL3_FLAGS_CCS_OK;
709 s->s3->tmp.next_state = 696 s->s3->tmp.next_state =
@@ -711,7 +698,6 @@ ssl3_accept(SSL *s)
711 } else 698 } else
712 s->s3->tmp.next_state = 699 s->s3->tmp.next_state =
713 SSL3_ST_SR_FINISHED_A; 700 SSL3_ST_SR_FINISHED_A;
714#endif
715 } else 701 } else
716 s->s3->tmp.next_state = SSL_ST_OK; 702 s->s3->tmp.next_state = SSL_ST_OK;
717 s->init_num = 0; 703 s->init_num = 0;
@@ -2850,7 +2836,6 @@ ssl3_send_cert_status(SSL *s)
2850 return (ssl3_do_write(s, SSL3_RT_HANDSHAKE)); 2836 return (ssl3_do_write(s, SSL3_RT_HANDSHAKE));
2851} 2837}
2852 2838
2853# ifndef OPENSSL_NO_NEXTPROTONEG
2854/* 2839/*
2855 * ssl3_get_next_proto reads a Next Protocol Negotiation handshake message. 2840 * ssl3_get_next_proto reads a Next Protocol Negotiation handshake message.
2856 * It sets the next_proto member in s if found 2841 * It sets the next_proto member in s if found
@@ -2921,4 +2906,3 @@ ssl3_get_next_proto(SSL *s)
2921 2906
2922 return (1); 2907 return (1);
2923} 2908}
2924# endif
diff --git a/src/lib/libssl/src/ssl/ssl_lib.c b/src/lib/libssl/src/ssl/ssl_lib.c
index 4369ba587a..e809ff0bc0 100644
--- a/src/lib/libssl/src/ssl/ssl_lib.c
+++ b/src/lib/libssl/src/ssl/ssl_lib.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ssl_lib.c,v 1.92 2014/12/10 15:36:47 jsing Exp $ */ 1/* $OpenBSD: ssl_lib.c,v 1.93 2014/12/14 14:34:43 jsing Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved. 3 * All rights reserved.
4 * 4 *
@@ -333,9 +333,7 @@ SSL_new(SSL_CTX *ctx)
333 s->tlsext_ocsp_resplen = -1; 333 s->tlsext_ocsp_resplen = -1;
334 CRYPTO_add(&ctx->references, 1, CRYPTO_LOCK_SSL_CTX); 334 CRYPTO_add(&ctx->references, 1, CRYPTO_LOCK_SSL_CTX);
335 s->initial_ctx = ctx; 335 s->initial_ctx = ctx;
336# ifndef OPENSSL_NO_NEXTPROTONEG
337 s->next_proto_negotiated = NULL; 336 s->next_proto_negotiated = NULL;
338# endif
339 337
340 if (s->ctx->alpn_client_proto_list != NULL) { 338 if (s->ctx->alpn_client_proto_list != NULL) {
341 s->alpn_client_proto_list = 339 s->alpn_client_proto_list =
@@ -560,9 +558,7 @@ SSL_free(SSL *s)
560 SSL_CTX_free(s->ctx); 558 SSL_CTX_free(s->ctx);
561 559
562 560
563#ifndef OPENSSL_NO_NEXTPROTONEG
564 free(s->next_proto_negotiated); 561 free(s->next_proto_negotiated);
565#endif
566 free(s->alpn_client_proto_list); 562 free(s->alpn_client_proto_list);
567 563
568#ifndef OPENSSL_NO_SRTP 564#ifndef OPENSSL_NO_SRTP
@@ -1509,7 +1505,6 @@ SSL_get_servername_type(const SSL *s)
1509 return (-1); 1505 return (-1);
1510} 1506}
1511 1507
1512# ifndef OPENSSL_NO_NEXTPROTONEG
1513/* 1508/*
1514 * SSL_select_next_proto implements the standard protocol selection. It is 1509 * SSL_select_next_proto implements the standard protocol selection. It is
1515 * expected that this function is called from the callback set by 1510 * expected that this function is called from the callback set by
@@ -1640,7 +1635,6 @@ SSL_CTX_set_next_proto_select_cb(SSL_CTX *ctx, int (*cb) (SSL *s,
1640 ctx->next_proto_select_cb = cb; 1635 ctx->next_proto_select_cb = cb;
1641 ctx->next_proto_select_cb_arg = arg; 1636 ctx->next_proto_select_cb_arg = arg;
1642} 1637}
1643# endif
1644 1638
1645/* 1639/*
1646 * SSL_CTX_set_alpn_protos sets the ALPN protocol list to the specified 1640 * SSL_CTX_set_alpn_protos sets the ALPN protocol list to the specified
@@ -1879,10 +1873,8 @@ SSL_CTX_new(const SSL_METHOD *meth)
1879 ret->tlsext_status_cb = 0; 1873 ret->tlsext_status_cb = 0;
1880 ret->tlsext_status_arg = NULL; 1874 ret->tlsext_status_arg = NULL;
1881 1875
1882# ifndef OPENSSL_NO_NEXTPROTONEG
1883 ret->next_protos_advertised_cb = 0; 1876 ret->next_protos_advertised_cb = 0;
1884 ret->next_proto_select_cb = 0; 1877 ret->next_proto_select_cb = 0;
1885# endif
1886#ifndef OPENSSL_NO_ENGINE 1878#ifndef OPENSSL_NO_ENGINE
1887 ret->client_cert_engine = NULL; 1879 ret->client_cert_engine = NULL;
1888#ifdef OPENSSL_SSL_CLIENT_ENGINE_AUTO 1880#ifdef OPENSSL_SSL_CLIENT_ENGINE_AUTO
diff --git a/src/lib/libssl/src/ssl/t1_lib.c b/src/lib/libssl/src/ssl/t1_lib.c
index 3b87d958cb..60cef857b5 100644
--- a/src/lib/libssl/src/ssl/t1_lib.c
+++ b/src/lib/libssl/src/ssl/t1_lib.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: t1_lib.c,v 1.73 2014/12/10 15:36:47 jsing Exp $ */ 1/* $OpenBSD: t1_lib.c,v 1.74 2014/12/14 14:34:43 jsing Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved. 3 * All rights reserved.
4 * 4 *
@@ -867,7 +867,6 @@ skip_ext:
867 i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret); 867 i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);
868 } 868 }
869 869
870#ifndef OPENSSL_NO_NEXTPROTONEG
871 if (s->ctx->next_proto_select_cb && !s->s3->tmp.finish_md_len) { 870 if (s->ctx->next_proto_select_cb && !s->s3->tmp.finish_md_len) {
872 /* The client advertises an emtpy extension to indicate its 871 /* The client advertises an emtpy extension to indicate its
873 * support for Next Protocol Negotiation */ 872 * support for Next Protocol Negotiation */
@@ -876,7 +875,6 @@ skip_ext:
876 s2n(TLSEXT_TYPE_next_proto_neg, ret); 875 s2n(TLSEXT_TYPE_next_proto_neg, ret);
877 s2n(0, ret); 876 s2n(0, ret);
878 } 877 }
879#endif
880 878
881 if (s->alpn_client_proto_list != NULL && 879 if (s->alpn_client_proto_list != NULL &&
882 s->s3->tmp.finish_md_len == 0) { 880 s->s3->tmp.finish_md_len == 0) {
@@ -958,9 +956,7 @@ ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
958 int using_ecc, extdatalen = 0; 956 int using_ecc, extdatalen = 0;
959 unsigned long alg_a, alg_k; 957 unsigned long alg_a, alg_k;
960 unsigned char *ret = p; 958 unsigned char *ret = p;
961#ifndef OPENSSL_NO_NEXTPROTONEG
962 int next_proto_neg_seen; 959 int next_proto_neg_seen;
963#endif
964 960
965 alg_a = s->s3->tmp.new_cipher->algorithm_auth; 961 alg_a = s->s3->tmp.new_cipher->algorithm_auth;
966 alg_k = s->s3->tmp.new_cipher->algorithm_mkey; 962 alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
@@ -1097,7 +1093,6 @@ ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
1097 ret += sizeof(cryptopro_ext); 1093 ret += sizeof(cryptopro_ext);
1098 } 1094 }
1099 1095
1100#ifndef OPENSSL_NO_NEXTPROTONEG
1101 next_proto_neg_seen = s->s3->next_proto_neg_seen; 1096 next_proto_neg_seen = s->s3->next_proto_neg_seen;
1102 s->s3->next_proto_neg_seen = 0; 1097 s->s3->next_proto_neg_seen = 0;
1103 if (next_proto_neg_seen && s->ctx->next_protos_advertised_cb) { 1098 if (next_proto_neg_seen && s->ctx->next_protos_advertised_cb) {
@@ -1117,7 +1112,6 @@ ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
1117 s->s3->next_proto_neg_seen = 1; 1112 s->s3->next_proto_neg_seen = 1;
1118 } 1113 }
1119 } 1114 }
1120#endif
1121 1115
1122 if (s->s3->alpn_selected != NULL) { 1116 if (s->s3->alpn_selected != NULL) {
1123 const unsigned char *selected = s->s3->alpn_selected; 1117 const unsigned char *selected = s->s3->alpn_selected;
@@ -1304,9 +1298,7 @@ ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
1304 1298
1305 s->servername_done = 0; 1299 s->servername_done = 0;
1306 s->tlsext_status_type = -1; 1300 s->tlsext_status_type = -1;
1307#ifndef OPENSSL_NO_NEXTPROTONEG
1308 s->s3->next_proto_neg_seen = 0; 1301 s->s3->next_proto_neg_seen = 0;
1309#endif
1310 free(s->s3->alpn_selected); 1302 free(s->s3->alpn_selected);
1311 s->s3->alpn_selected = NULL; 1303 s->s3->alpn_selected = NULL;
1312 1304
@@ -1616,7 +1608,6 @@ ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
1616 s->tlsext_status_type = -1; 1608 s->tlsext_status_type = -1;
1617 } 1609 }
1618 } 1610 }
1619#ifndef OPENSSL_NO_NEXTPROTONEG
1620 else if (type == TLSEXT_TYPE_next_proto_neg && 1611 else if (type == TLSEXT_TYPE_next_proto_neg &&
1621 s->s3->tmp.finish_md_len == 0 && 1612 s->s3->tmp.finish_md_len == 0 &&
1622 s->s3->alpn_selected == NULL) { 1613 s->s3->alpn_selected == NULL) {
@@ -1637,7 +1628,6 @@ ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
1637 * Finished message could have been computed.) */ 1628 * Finished message could have been computed.) */
1638 s->s3->next_proto_neg_seen = 1; 1629 s->s3->next_proto_neg_seen = 1;
1639 } 1630 }
1640#endif
1641 else if (type == 1631 else if (type ==
1642 TLSEXT_TYPE_application_layer_protocol_negotiation && 1632 TLSEXT_TYPE_application_layer_protocol_negotiation &&
1643 s->ctx->alpn_select_cb != NULL && 1633 s->ctx->alpn_select_cb != NULL &&
@@ -1676,7 +1666,6 @@ ri_check:
1676 return 1; 1666 return 1;
1677} 1667}
1678 1668
1679#ifndef OPENSSL_NO_NEXTPROTONEG
1680/* ssl_next_proto_validate validates a Next Protocol Negotiation block. No 1669/* ssl_next_proto_validate validates a Next Protocol Negotiation block. No
1681 * elements of zero length are allowed and the set of elements must exactly fill 1670 * elements of zero length are allowed and the set of elements must exactly fill
1682 * the length of the block. */ 1671 * the length of the block. */
@@ -1694,7 +1683,6 @@ ssl_next_proto_validate(unsigned char *d, unsigned len)
1694 1683
1695 return off == len; 1684 return off == len;
1696} 1685}
1697#endif
1698 1686
1699int 1687int
1700ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, 1688ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
@@ -1707,9 +1695,7 @@ ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
1707 int tlsext_servername = 0; 1695 int tlsext_servername = 0;
1708 int renegotiate_seen = 0; 1696 int renegotiate_seen = 0;
1709 1697
1710#ifndef OPENSSL_NO_NEXTPROTONEG
1711 s->s3->next_proto_neg_seen = 0; 1698 s->s3->next_proto_neg_seen = 0;
1712#endif
1713 free(s->s3->alpn_selected); 1699 free(s->s3->alpn_selected);
1714 s->s3->alpn_selected = NULL; 1700 s->s3->alpn_selected = NULL;
1715 1701
@@ -1797,7 +1783,6 @@ ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
1797 /* Set flag to expect CertificateStatus message */ 1783 /* Set flag to expect CertificateStatus message */
1798 s->tlsext_status_expected = 1; 1784 s->tlsext_status_expected = 1;
1799 } 1785 }
1800#ifndef OPENSSL_NO_NEXTPROTONEG
1801 else if (type == TLSEXT_TYPE_next_proto_neg && 1786 else if (type == TLSEXT_TYPE_next_proto_neg &&
1802 s->s3->tmp.finish_md_len == 0) { 1787 s->s3->tmp.finish_md_len == 0) {
1803 unsigned char *selected; 1788 unsigned char *selected;
@@ -1826,7 +1811,6 @@ ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
1826 s->next_proto_negotiated_len = selected_len; 1811 s->next_proto_negotiated_len = selected_len;
1827 s->s3->next_proto_neg_seen = 1; 1812 s->s3->next_proto_neg_seen = 1;
1828 } 1813 }
1829#endif
1830 else if (type == 1814 else if (type ==
1831 TLSEXT_TYPE_application_layer_protocol_negotiation) { 1815 TLSEXT_TYPE_application_layer_protocol_negotiation) {
1832 unsigned int len; 1816 unsigned int len;
diff --git a/src/lib/libssl/ssl_lib.c b/src/lib/libssl/ssl_lib.c
index 4369ba587a..e809ff0bc0 100644
--- a/src/lib/libssl/ssl_lib.c
+++ b/src/lib/libssl/ssl_lib.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ssl_lib.c,v 1.92 2014/12/10 15:36:47 jsing Exp $ */ 1/* $OpenBSD: ssl_lib.c,v 1.93 2014/12/14 14:34:43 jsing Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved. 3 * All rights reserved.
4 * 4 *
@@ -333,9 +333,7 @@ SSL_new(SSL_CTX *ctx)
333 s->tlsext_ocsp_resplen = -1; 333 s->tlsext_ocsp_resplen = -1;
334 CRYPTO_add(&ctx->references, 1, CRYPTO_LOCK_SSL_CTX); 334 CRYPTO_add(&ctx->references, 1, CRYPTO_LOCK_SSL_CTX);
335 s->initial_ctx = ctx; 335 s->initial_ctx = ctx;
336# ifndef OPENSSL_NO_NEXTPROTONEG
337 s->next_proto_negotiated = NULL; 336 s->next_proto_negotiated = NULL;
338# endif
339 337
340 if (s->ctx->alpn_client_proto_list != NULL) { 338 if (s->ctx->alpn_client_proto_list != NULL) {
341 s->alpn_client_proto_list = 339 s->alpn_client_proto_list =
@@ -560,9 +558,7 @@ SSL_free(SSL *s)
560 SSL_CTX_free(s->ctx); 558 SSL_CTX_free(s->ctx);
561 559
562 560
563#ifndef OPENSSL_NO_NEXTPROTONEG
564 free(s->next_proto_negotiated); 561 free(s->next_proto_negotiated);
565#endif
566 free(s->alpn_client_proto_list); 562 free(s->alpn_client_proto_list);
567 563
568#ifndef OPENSSL_NO_SRTP 564#ifndef OPENSSL_NO_SRTP
@@ -1509,7 +1505,6 @@ SSL_get_servername_type(const SSL *s)
1509 return (-1); 1505 return (-1);
1510} 1506}
1511 1507
1512# ifndef OPENSSL_NO_NEXTPROTONEG
1513/* 1508/*
1514 * SSL_select_next_proto implements the standard protocol selection. It is 1509 * SSL_select_next_proto implements the standard protocol selection. It is
1515 * expected that this function is called from the callback set by 1510 * expected that this function is called from the callback set by
@@ -1640,7 +1635,6 @@ SSL_CTX_set_next_proto_select_cb(SSL_CTX *ctx, int (*cb) (SSL *s,
1640 ctx->next_proto_select_cb = cb; 1635 ctx->next_proto_select_cb = cb;
1641 ctx->next_proto_select_cb_arg = arg; 1636 ctx->next_proto_select_cb_arg = arg;
1642} 1637}
1643# endif
1644 1638
1645/* 1639/*
1646 * SSL_CTX_set_alpn_protos sets the ALPN protocol list to the specified 1640 * SSL_CTX_set_alpn_protos sets the ALPN protocol list to the specified
@@ -1879,10 +1873,8 @@ SSL_CTX_new(const SSL_METHOD *meth)
1879 ret->tlsext_status_cb = 0; 1873 ret->tlsext_status_cb = 0;
1880 ret->tlsext_status_arg = NULL; 1874 ret->tlsext_status_arg = NULL;
1881 1875
1882# ifndef OPENSSL_NO_NEXTPROTONEG
1883 ret->next_protos_advertised_cb = 0; 1876 ret->next_protos_advertised_cb = 0;
1884 ret->next_proto_select_cb = 0; 1877 ret->next_proto_select_cb = 0;
1885# endif
1886#ifndef OPENSSL_NO_ENGINE 1878#ifndef OPENSSL_NO_ENGINE
1887 ret->client_cert_engine = NULL; 1879 ret->client_cert_engine = NULL;
1888#ifdef OPENSSL_SSL_CLIENT_ENGINE_AUTO 1880#ifdef OPENSSL_SSL_CLIENT_ENGINE_AUTO
diff --git a/src/lib/libssl/t1_lib.c b/src/lib/libssl/t1_lib.c
index 3b87d958cb..60cef857b5 100644
--- a/src/lib/libssl/t1_lib.c
+++ b/src/lib/libssl/t1_lib.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: t1_lib.c,v 1.73 2014/12/10 15:36:47 jsing Exp $ */ 1/* $OpenBSD: t1_lib.c,v 1.74 2014/12/14 14:34:43 jsing Exp $ */
2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved. 3 * All rights reserved.
4 * 4 *
@@ -867,7 +867,6 @@ skip_ext:
867 i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret); 867 i2d_X509_EXTENSIONS(s->tlsext_ocsp_exts, &ret);
868 } 868 }
869 869
870#ifndef OPENSSL_NO_NEXTPROTONEG
871 if (s->ctx->next_proto_select_cb && !s->s3->tmp.finish_md_len) { 870 if (s->ctx->next_proto_select_cb && !s->s3->tmp.finish_md_len) {
872 /* The client advertises an emtpy extension to indicate its 871 /* The client advertises an emtpy extension to indicate its
873 * support for Next Protocol Negotiation */ 872 * support for Next Protocol Negotiation */
@@ -876,7 +875,6 @@ skip_ext:
876 s2n(TLSEXT_TYPE_next_proto_neg, ret); 875 s2n(TLSEXT_TYPE_next_proto_neg, ret);
877 s2n(0, ret); 876 s2n(0, ret);
878 } 877 }
879#endif
880 878
881 if (s->alpn_client_proto_list != NULL && 879 if (s->alpn_client_proto_list != NULL &&
882 s->s3->tmp.finish_md_len == 0) { 880 s->s3->tmp.finish_md_len == 0) {
@@ -958,9 +956,7 @@ ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
958 int using_ecc, extdatalen = 0; 956 int using_ecc, extdatalen = 0;
959 unsigned long alg_a, alg_k; 957 unsigned long alg_a, alg_k;
960 unsigned char *ret = p; 958 unsigned char *ret = p;
961#ifndef OPENSSL_NO_NEXTPROTONEG
962 int next_proto_neg_seen; 959 int next_proto_neg_seen;
963#endif
964 960
965 alg_a = s->s3->tmp.new_cipher->algorithm_auth; 961 alg_a = s->s3->tmp.new_cipher->algorithm_auth;
966 alg_k = s->s3->tmp.new_cipher->algorithm_mkey; 962 alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
@@ -1097,7 +1093,6 @@ ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
1097 ret += sizeof(cryptopro_ext); 1093 ret += sizeof(cryptopro_ext);
1098 } 1094 }
1099 1095
1100#ifndef OPENSSL_NO_NEXTPROTONEG
1101 next_proto_neg_seen = s->s3->next_proto_neg_seen; 1096 next_proto_neg_seen = s->s3->next_proto_neg_seen;
1102 s->s3->next_proto_neg_seen = 0; 1097 s->s3->next_proto_neg_seen = 0;
1103 if (next_proto_neg_seen && s->ctx->next_protos_advertised_cb) { 1098 if (next_proto_neg_seen && s->ctx->next_protos_advertised_cb) {
@@ -1117,7 +1112,6 @@ ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
1117 s->s3->next_proto_neg_seen = 1; 1112 s->s3->next_proto_neg_seen = 1;
1118 } 1113 }
1119 } 1114 }
1120#endif
1121 1115
1122 if (s->s3->alpn_selected != NULL) { 1116 if (s->s3->alpn_selected != NULL) {
1123 const unsigned char *selected = s->s3->alpn_selected; 1117 const unsigned char *selected = s->s3->alpn_selected;
@@ -1304,9 +1298,7 @@ ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
1304 1298
1305 s->servername_done = 0; 1299 s->servername_done = 0;
1306 s->tlsext_status_type = -1; 1300 s->tlsext_status_type = -1;
1307#ifndef OPENSSL_NO_NEXTPROTONEG
1308 s->s3->next_proto_neg_seen = 0; 1301 s->s3->next_proto_neg_seen = 0;
1309#endif
1310 free(s->s3->alpn_selected); 1302 free(s->s3->alpn_selected);
1311 s->s3->alpn_selected = NULL; 1303 s->s3->alpn_selected = NULL;
1312 1304
@@ -1616,7 +1608,6 @@ ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
1616 s->tlsext_status_type = -1; 1608 s->tlsext_status_type = -1;
1617 } 1609 }
1618 } 1610 }
1619#ifndef OPENSSL_NO_NEXTPROTONEG
1620 else if (type == TLSEXT_TYPE_next_proto_neg && 1611 else if (type == TLSEXT_TYPE_next_proto_neg &&
1621 s->s3->tmp.finish_md_len == 0 && 1612 s->s3->tmp.finish_md_len == 0 &&
1622 s->s3->alpn_selected == NULL) { 1613 s->s3->alpn_selected == NULL) {
@@ -1637,7 +1628,6 @@ ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
1637 * Finished message could have been computed.) */ 1628 * Finished message could have been computed.) */
1638 s->s3->next_proto_neg_seen = 1; 1629 s->s3->next_proto_neg_seen = 1;
1639 } 1630 }
1640#endif
1641 else if (type == 1631 else if (type ==
1642 TLSEXT_TYPE_application_layer_protocol_negotiation && 1632 TLSEXT_TYPE_application_layer_protocol_negotiation &&
1643 s->ctx->alpn_select_cb != NULL && 1633 s->ctx->alpn_select_cb != NULL &&
@@ -1676,7 +1666,6 @@ ri_check:
1676 return 1; 1666 return 1;
1677} 1667}
1678 1668
1679#ifndef OPENSSL_NO_NEXTPROTONEG
1680/* ssl_next_proto_validate validates a Next Protocol Negotiation block. No 1669/* ssl_next_proto_validate validates a Next Protocol Negotiation block. No
1681 * elements of zero length are allowed and the set of elements must exactly fill 1670 * elements of zero length are allowed and the set of elements must exactly fill
1682 * the length of the block. */ 1671 * the length of the block. */
@@ -1694,7 +1683,6 @@ ssl_next_proto_validate(unsigned char *d, unsigned len)
1694 1683
1695 return off == len; 1684 return off == len;
1696} 1685}
1697#endif
1698 1686
1699int 1687int
1700ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, 1688ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
@@ -1707,9 +1695,7 @@ ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
1707 int tlsext_servername = 0; 1695 int tlsext_servername = 0;
1708 int renegotiate_seen = 0; 1696 int renegotiate_seen = 0;
1709 1697
1710#ifndef OPENSSL_NO_NEXTPROTONEG
1711 s->s3->next_proto_neg_seen = 0; 1698 s->s3->next_proto_neg_seen = 0;
1712#endif
1713 free(s->s3->alpn_selected); 1699 free(s->s3->alpn_selected);
1714 s->s3->alpn_selected = NULL; 1700 s->s3->alpn_selected = NULL;
1715 1701
@@ -1797,7 +1783,6 @@ ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
1797 /* Set flag to expect CertificateStatus message */ 1783 /* Set flag to expect CertificateStatus message */
1798 s->tlsext_status_expected = 1; 1784 s->tlsext_status_expected = 1;
1799 } 1785 }
1800#ifndef OPENSSL_NO_NEXTPROTONEG
1801 else if (type == TLSEXT_TYPE_next_proto_neg && 1786 else if (type == TLSEXT_TYPE_next_proto_neg &&
1802 s->s3->tmp.finish_md_len == 0) { 1787 s->s3->tmp.finish_md_len == 0) {
1803 unsigned char *selected; 1788 unsigned char *selected;
@@ -1826,7 +1811,6 @@ ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
1826 s->next_proto_negotiated_len = selected_len; 1811 s->next_proto_negotiated_len = selected_len;
1827 s->s3->next_proto_neg_seen = 1; 1812 s->s3->next_proto_neg_seen = 1;
1828 } 1813 }
1829#endif
1830 else if (type == 1814 else if (type ==
1831 TLSEXT_TYPE_application_layer_protocol_negotiation) { 1815 TLSEXT_TYPE_application_layer_protocol_negotiation) {
1832 unsigned int len; 1816 unsigned int len;
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-10-27 12:45:58 +0000