New option no-ssl3-method which removes SSLv3_*method

When no-ssl3 is set only make SSLv3 disabled by default. Retain -ssl3
options for s_client/s_server/ssltest.

When no-ssl3-method is set SSLv3_*method() is removed and all -ssl3
options.

We should document this somewhere, e.g. wiki, FAQ or manual page.
Reviewed-by: Emilia Käsper <emilia@openssl.org>
(cherry picked from commit 3881d8106df732fc433d30446625dfa2396da42d)

Conflicts:
	util/mkdef.pl

diff --git a/Configure b/Configure
index 6f0da761b6664430040c2c4b386ef99da3c8296f..541be9ec57d865f2b78253cde4737f1653fe33e9 100755 (executable)
--- a/Configure
+++ b/Configure
@@ -804,6 +804,11 @@ PROCESS_ARGS:
                                        {
                                        $disabled{"tls1"} = "option(tls)"
                                        }
+                               elsif ($1 eq "ssl3-method")
+                                       {
+                                       $disabled{"ssl3-method"} = "option(ssl)";
+                                       $disabled{"ssl3"} = "option(ssl)";
+                                       }
                                else
                                        {
                                        $disabled{$1} = "option";

diff --git a/apps/s_client.c b/apps/s_client.c
index c2e160ca7a1e66442025c2aa4c7306deee60666b..a156e2f9ff77cdfdd3b849b8ecb37eee19a0d2f5 100644 (file)
--- a/apps/s_client.c
+++ b/apps/s_client.c
@@ -332,7 +332,9 @@ static void sc_usage(void)
        BIO_printf(bio_err," -srp_strength int - minimal mength in bits for N (default %d).\n",SRP_MINIMAL_N);
 #endif
        BIO_printf(bio_err," -ssl2         - just use SSLv2\n");
+#ifndef OPENSSL_NO_SSL3_METHOD
        BIO_printf(bio_err," -ssl3         - just use SSLv3\n");
+#endif
        BIO_printf(bio_err," -tls1_2       - just use TLSv1.2\n");
        BIO_printf(bio_err," -tls1_1       - just use TLSv1.1\n");
        BIO_printf(bio_err," -tls1         - just use TLSv1\n");
@@ -807,7 +809,7 @@ int MAIN(int argc, char **argv)
                else if (strcmp(*argv,"-ssl2") == 0)
                        meth=SSLv2_client_method();
 #endif
-#ifndef OPENSSL_NO_SSL3
+#ifndef OPENSSL_NO_SSL3_METHOD
                else if (strcmp(*argv,"-ssl3") == 0)
                        meth=SSLv3_client_method();
 #endif

diff --git a/apps/s_server.c b/apps/s_server.c
index fe7ad8823207c911470e2a00bac3e254cedf6843..4ff30d862e7e9a38fd2781474a48d7d54c8ce176 100644 (file)
--- a/apps/s_server.c
+++ b/apps/s_server.c
@@ -515,7 +515,9 @@ static void sv_usage(void)
        BIO_printf(bio_err," -srpuserseed string - A seed string for a default user salt.\n");
 #endif
        BIO_printf(bio_err," -ssl2         - Just talk SSLv2\n");
+#ifndef OPENSSL_NO_SSL3_METHOD
        BIO_printf(bio_err," -ssl3         - Just talk SSLv3\n");
+#endif
        BIO_printf(bio_err," -tls1_2       - Just talk TLSv1.2\n");
        BIO_printf(bio_err," -tls1_1       - Just talk TLSv1.1\n");
        BIO_printf(bio_err," -tls1         - Just talk TLSv1\n");
@@ -1251,7 +1253,7 @@ int MAIN(int argc, char *argv[])
                else if (strcmp(*argv,"-ssl2") == 0)
                        { meth=SSLv2_server_method(); }
 #endif
-#ifndef OPENSSL_NO_SSL3
+#ifndef OPENSSL_NO_SSL3_METHOD
                else if (strcmp(*argv,"-ssl3") == 0)
                        { meth=SSLv3_server_method(); }
 #endif

diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
index 1e691b9a63d4c392d963f8fbdadf1b05dcd8cf61..403b68420510dea7479d172c2b0e3a058e82208b 100644 (file)
--- a/ssl/s3_clnt.c
+++ b/ssl/s3_clnt.c
@@ -167,9 +167,9 @@
 #include <openssl/engine.h>
 #endif
 
-static const SSL_METHOD *ssl3_get_client_method(int ver);
 static int ca_dn_cmp(const X509_NAME * const *a,const X509_NAME * const *b);
 
+#ifndef OPENSSL_NO_SSL3_METHOD
 static const SSL_METHOD *ssl3_get_client_method(int ver)
        {
        if (ver == SSL3_VERSION)
@@ -182,6 +182,7 @@ IMPLEMENT_ssl3_meth_func(SSLv3_client_method,
                        ssl_undefined_function,
                        ssl3_connect,
                        ssl3_get_client_method)
+#endif
 
 int ssl3_connect(SSL *s)
        {

diff --git a/ssl/s3_meth.c b/ssl/s3_meth.c
index cdddb17b627d775dc65f6e5f77810d9f36ecf628..4dec7033d6c90ae309d5845beff53f865eed1e60 100644 (file)
--- a/ssl/s3_meth.c
+++ b/ssl/s3_meth.c
@@ -60,7 +60,7 @@
 #include <openssl/objects.h>
 #include "ssl_locl.h"
 
-static const SSL_METHOD *ssl3_get_method(int ver);
+#ifndef OPENSSL_NO_SSL3_METHOD
 static const SSL_METHOD *ssl3_get_method(int ver)
        {
        if (ver == SSL3_VERSION)
@@ -73,5 +73,4 @@ IMPLEMENT_ssl3_meth_func(SSLv3_method,
                         ssl3_accept,
                         ssl3_connect,
                         ssl3_get_method)
-
-
+#endif

diff --git a/ssl/s3_srvr.c b/ssl/s3_srvr.c
index c23d98708029238bb06672acc7aaceddbcc7a0df..9ac7e8ad31be816edf9e58fe73e8dcbbdc307607 100644 (file)
--- a/ssl/s3_srvr.c
+++ b/ssl/s3_srvr.c
@@ -170,6 +170,7 @@
 #endif
 #include <openssl/md5.h>
 
+#ifndef OPENSSL_NO_SSL3_METHOD
 static const SSL_METHOD *ssl3_get_server_method(int ver);
 
 static const SSL_METHOD *ssl3_get_server_method(int ver)
@@ -180,6 +181,12 @@ static const SSL_METHOD *ssl3_get_server_method(int ver)
                return(NULL);
        }
 
+IMPLEMENT_ssl3_meth_func(SSLv3_server_method,
+                       ssl3_accept,
+                       ssl_undefined_function,
+                       ssl3_get_server_method)
+#endif
+
 #ifndef OPENSSL_NO_SRP
 static int ssl_check_srp_ext_ClientHello(SSL *s, int *al)
        {
@@ -206,11 +213,6 @@ static int ssl_check_srp_ext_ClientHello(SSL *s, int *al)
        }
 #endif
 
-IMPLEMENT_ssl3_meth_func(SSLv3_server_method,
-                       ssl3_accept,
-                       ssl_undefined_function,
-                       ssl3_get_server_method)
-
 int ssl3_accept(SSL *s)
        {
        BUF_MEM *buf;

diff --git a/ssl/ssl.h b/ssl/ssl.h
index e61413c0437c588ba129fa2e2e532dc675b1b30e..da6b2eb67a3a271b5186650c904afaecbb6953be 100644 (file)
--- a/ssl/ssl.h
+++ b/ssl/ssl.h
@@ -1883,9 +1883,11 @@ const SSL_METHOD *SSLv2_server_method(void);     /* SSLv2 */
 const SSL_METHOD *SSLv2_client_method(void);   /* SSLv2 */
 #endif
 
+#ifndef OPENSSL_NO_SSL3_METHOD
 const SSL_METHOD *SSLv3_method(void);          /* SSLv3 */
 const SSL_METHOD *SSLv3_server_method(void);   /* SSLv3 */
 const SSL_METHOD *SSLv3_client_method(void);   /* SSLv3 */
+#endif
 
 const SSL_METHOD *SSLv23_method(void); /* SSLv3 but can rollback to v2 */
 const SSL_METHOD *SSLv23_server_method(void);  /* SSLv3 but can rollback to v2 */

diff --git a/ssl/ssltest.c b/ssl/ssltest.c
index 7f2e1ae246468693174b7486bb64e9687fd755b4..08889569f4effc662f5dc3dd84bb6e162b747216 100644 (file)
--- a/ssl/ssltest.c
+++ b/ssl/ssltest.c
@@ -345,7 +345,7 @@ static void sv_usage(void)
 #ifndef OPENSSL_NO_SSL2
        fprintf(stderr," -ssl2         - use SSLv2\n");
 #endif
-#ifndef OPENSSL_NO_SSL3
+#ifndef OPENSSL_NO_SSL3_METHOD
        fprintf(stderr," -ssl3         - use SSLv3\n");
 #endif
 #ifndef OPENSSL_NO_TLS1
@@ -676,7 +676,7 @@ int main(int argc, char *argv[])
                        }
                else if (strcmp(*argv,"-ssl3") == 0)
                        {
-#ifdef OPENSSL_NO_SSL3
+#ifdef OPENSSL_NO_SSL3_METHOD
                        no_protocol = 1;
 #endif
                        ssl3 = 1;

diff --git a/util/mk1mf.pl b/util/mk1mf.pl
index 559a683b8d9bfde3c0710f53fd915b961344e832..d3f5424ff30def9b4da0c2fcaae104c5615f0afa 100755 (executable)
--- a/util/mk1mf.pl
+++ b/util/mk1mf.pl
@@ -1071,12 +1071,17 @@ sub do_copy_rule
        return($ret);
        }
 
+# Options picked up from the OPTIONS line in the top level Makefile
+# generated by Configure.
+
 sub read_options
        {
        # Many options are handled in a similar way. In particular
        # no-xxx sets zero or more scalars to 1.
-       # Process these using a hash containing the option name and
-       # reference to the scalars to set.
+       # Process these using the %valid_options hash containing the option
+       # name and reference to the scalars to set. In some cases the option
+       # needs no special handling and can be ignored: this is done by
+       # setting the value to 0.
 
        my %valid_options = (
                "no-rc2" => \$no_rc2,
@@ -1110,6 +1115,7 @@ sub read_options
                "gaswin" => \$gaswin,
                "no-ssl2" => \$no_ssl2,
                "no-ssl3" => \$no_ssl3,
+               "no-ssl3-method" => 0,
                "no-tlsext" => \$no_tlsext,
                "no-srp" => \$no_srp,
                "no-cms" => \$no_cms,

diff --git a/util/mkdef.pl b/util/mkdef.pl
index 1eaa7b8acd290c77192ac6a4944ba6416744c9bd..894f0529fc475e83bf3168b4e970c7c605bbe65c 100755 (executable)
--- a/util/mkdef.pl
+++ b/util/mkdef.pl
@@ -107,6 +107,8 @@ my @known_algorithms = ( "RC2", "RC4", "RC5", "IDEA", "DES", "BF",
                         "CAPIENG",
                         # SSL v2
                         "SSL2",
+                        # SSL v3 method
+                        "SSL3_METHOD",
                         # JPAKE
                         "JPAKE",
                         # NEXTPROTONEG
@@ -141,7 +143,7 @@ my $no_fp_api; my $no_static_engine=1; my $no_gmp; my $no_deprecated;
 my $no_rfc3779; my $no_psk; my $no_tlsext; my $no_cms; my $no_capieng;
 my $no_jpake; my $no_srp; my $no_ssl2; my $no_ec2m; my $no_nistp_gcc; 
 my $no_nextprotoneg; my $no_sctp; my $no_srtp;
-my $no_unit_test;
+my $no_unit_test; my $no_ssl3_method;
 
 my $fips;
 
@@ -236,6 +238,7 @@ foreach (@ARGV, split(/ /, $options))
        elsif (/^no-ec_nistp_64_gcc_128$/)      { $no_nistp_gcc=1; }
        elsif (/^no-nextprotoneg$/)     { $no_nextprotoneg=1; }
        elsif (/^no-ssl2$/)     { $no_ssl2=1; }
+       elsif (/^no-ssl3-method$/) { $no_ssl3_method=1; }
        elsif (/^no-capieng$/)  { $no_capieng=1; }
        elsif (/^no-jpake$/)    { $no_jpake=1; }
        elsif (/^no-srp$/)      { $no_srp=1; }
@@ -1208,6 +1211,7 @@ sub is_valid
                        if ($keyword eq "EC_NISTP_64_GCC_128" && $no_nistp_gcc)
                                        { return 0; }
                        if ($keyword eq "SSL2" && $no_ssl2) { return 0; }
+                       if ($keyword eq "SSL3_METHOD" && $no_ssl3_method) { return 0; }
                        if ($keyword eq "CAPIENG" && $no_capieng) { return 0; }
                        if ($keyword eq "JPAKE" && $no_jpake) { return 0; }
                        if ($keyword eq "SRP" && $no_srp) { return 0; }

diff --git a/util/ssleay.num b/util/ssleay.num
index dd21e95779d3d82847ef1e0ca0948d5051420394..dd1c5e88239e3a734e44f2b115d394f76c9fdeec 100755 (executable)
--- a/util/ssleay.num
+++ b/util/ssleay.num
@@ -101,9 +101,9 @@ SSLv23_server_method                    112 EXIST::FUNCTION:RSA
 SSLv2_client_method                     113    EXIST::FUNCTION:RSA,SSL2
 SSLv2_method                            114    EXIST::FUNCTION:RSA,SSL2
 SSLv2_server_method                     115    EXIST::FUNCTION:RSA,SSL2
-SSLv3_client_method                     116    EXIST::FUNCTION:
-SSLv3_method                            117    EXIST::FUNCTION:
-SSLv3_server_method                     118    EXIST::FUNCTION:
+SSLv3_client_method                     116    EXIST::FUNCTION:SSL3_METHOD
+SSLv3_method                            117    EXIST::FUNCTION:SSL3_METHOD
+SSLv3_server_method                     118    EXIST::FUNCTION:SSL3_METHOD
 d2i_SSL_SESSION                         119    EXIST::FUNCTION:
 i2d_SSL_SESSION                         120    EXIST::FUNCTION:
 BIO_f_ssl                               121    EXIST::FUNCTION:BIO