Restore -no_comp switch for backwards compatible behaviour

Reviewed-by: Emilia Käsper <emilia@openssl.org>

diff --git a/apps/apps.h b/apps/apps.h
index 52e57f83217d4032dde46185a71f47cbc87b9264..15a044e678aa1a4ab19bf5a6f26f005af430c991 100644 (file)
--- a/apps/apps.h
+++ b/apps/apps.h
@@ -285,11 +285,11 @@ void wait_for_async(SSL *s);
 # define OPT_S_ENUM \
         OPT_S__FIRST=3000, \
         OPT_S_NOSSL3, OPT_S_NOTLS1, OPT_S_NOTLS1_1, OPT_S_NOTLS1_2, \
-        OPT_S_BUGS, OPT_S_COMP, OPT_S_ECDHSINGLE, OPT_S_NOTICKET, \
+        OPT_S_BUGS, OPT_S_NO_COMP, OPT_S_ECDHSINGLE, OPT_S_NOTICKET, \
         OPT_S_SERVERPREF, OPT_S_LEGACYRENEG, OPT_S_LEGACYCONN, \
         OPT_S_ONRESUMP, OPT_S_NOLEGACYCONN, OPT_S_STRICT, OPT_S_SIGALGS, \
         OPT_S_CLIENTSIGALGS, OPT_S_CURVES, OPT_S_NAMEDCURVE, OPT_S_CIPHER, \
-        OPT_S_DHPARAM, OPT_S_DEBUGBROKE, \
+        OPT_S_DHPARAM, OPT_S_DEBUGBROKE, OPT_S_COMP, \
         OPT_S__LAST
 
 # define OPT_S_OPTIONS \
@@ -298,6 +298,7 @@ void wait_for_async(SSL *s);
         {"no_tls1_1", OPT_S_NOTLS1_1, '-' }, \
         {"no_tls1_2", OPT_S_NOTLS1_2, '-' }, \
         {"bugs", OPT_S_BUGS, '-' }, \
+        {"no_comp", OPT_S_NO_COMP, '-', "Disable SSL/TLS compression (default)" }, \
         {"comp", OPT_S_COMP, '-', "Use SSL/TLS-level compression" }, \
         {"ecdh_single", OPT_S_ECDHSINGLE, '-' }, \
         {"no_ticket", OPT_S_NOTICKET, '-' }, \
@@ -327,6 +328,7 @@ void wait_for_async(SSL *s);
         case OPT_S_NOTLS1_1: \
         case OPT_S_NOTLS1_2: \
         case OPT_S_BUGS: \
+        case OPT_S_NO_COMP: \
         case OPT_S_COMP: \
         case OPT_S_ECDHSINGLE: \
         case OPT_S_NOTICKET: \

diff --git a/doc/apps/s_client.pod b/doc/apps/s_client.pod
index 2d5ef4154bbb82804b4ed77abf2b1903f47de914..e9f3280e3ee542ead108ea69cb7e2dc39cdb30c4 100644 (file)
--- a/doc/apps/s_client.pod
+++ b/doc/apps/s_client.pod
@@ -71,6 +71,8 @@ B<openssl> B<s_client>
 [B<-fallback_scsv>]
 [B<-async>]
 [B<-bugs>]
+[B<-comp>]
+[B<-no_comp>]
 [B<-cipher cipherlist>]
 [B<-serverpref>]
 [B<-starttls protocol>]
@@ -326,6 +328,19 @@ is also used via the B<-engine> option. For test purposes the dummy async engine
 there are several known bug in SSL and TLS implementations. Adding this
 option enables various workarounds.
 
+=item B<-comp>
+
+Enables support for SSL/TLS compression.
+This option was introduced in OpenSSL 1.1.0.
+TLS compression is not recommended and is off by default as of
+OpenSSL 1.1.0.
+
+=item B<-no_comp>
+
+Disables support for SSL/TLS compression.
+TLS compression is not recommended and is off by default as of
+OpenSSL 1.1.0.
+
 =item B<-brief>
 
 only provide a brief summary of connection parameters instead of the

diff --git a/doc/apps/s_server.pod b/doc/apps/s_server.pod
index 59d600d99c7e69eb3d768609e2b4934c8b6a7c02..b9ef5e686407c10f051aa45fd172a6ca93458f1a 100644 (file)
--- a/doc/apps/s_server.pod
+++ b/doc/apps/s_server.pod
@@ -77,6 +77,8 @@ B<openssl> B<s_server>
 [B<-no_tls1>]
 [B<-no_dhe>]
 [B<-bugs>]
+[B<-comp>]
+[B<-no_comp>]
 [B<-brief>]
 [B<-www>]
 [B<-WWW>]
@@ -313,6 +315,19 @@ is also used via the B<-engine> option. For test purposes the dummy async engine
 there are several known bug in SSL and TLS implementations. Adding this
 option enables various workarounds.
 
+=item B<-comp>
+
+Enable negotiation of TLS compression.
+This option was introduced in OpenSSL 1.1.0.
+TLS compression is not recommended and is off by default as of
+OpenSSL 1.1.0.
+
+=item B<-no_comp>
+
+Disable negotiation of TLS compression.
+TLS compression is not recommended and is off by default as of
+OpenSSL 1.1.0.
+
 =item B<-brief>
 
 only provide a brief summary of connection parameters instead of the

diff --git a/doc/ssl/SSL_CONF_cmd.pod b/doc/ssl/SSL_CONF_cmd.pod
index 6947865318f15589a3181221899806a513774886..b3c9df9cde92651ef8505454f93ea84819b9a5c3 100644 (file)
--- a/doc/ssl/SSL_CONF_cmd.pod
+++ b/doc/ssl/SSL_CONF_cmd.pod
@@ -133,7 +133,16 @@ Various bug workarounds are set, same as setting B<SSL_OP_ALL>.
 
 =item B<-comp>
 
-Enables support for SSL/TLS compression, same as clearing B<SSL_OP_NO_COMPRESSION>.
+Enables support for SSL/TLS compression, same as clearing
+B<SSL_OP_NO_COMPRESSION>.
+This command was introduced in OpenSSL 1.1.0.
+As of OpenSSL 1.1.0, compression is off by default.
+
+=item B<-no_comp>
+
+Disables support for SSL/TLS compression, same as setting
+B<SSL_OP_NO_COMPRESSION>.
+As of OpenSSL 1.1.0, compression is off by default.
 
 =item B<-no_ticket>
 

diff --git a/ssl/ssl_conf.c b/ssl/ssl_conf.c
index d0935cf0e571056d4f1e8406f604598681cd9a83..1846155424b81ba9a029f985177f87ca7f955933 100644 (file)
--- a/ssl/ssl_conf.c
+++ b/ssl/ssl_conf.c
@@ -581,6 +581,7 @@ static const ssl_conf_cmd_tbl ssl_conf_cmds[] = {
     SSL_CONF_CMD_SWITCH("no_tls1_1", 0),
     SSL_CONF_CMD_SWITCH("no_tls1_2", 0),
     SSL_CONF_CMD_SWITCH("bugs", 0),
+    SSL_CONF_CMD_SWITCH("no_comp", 0),
     SSL_CONF_CMD_SWITCH("comp", 0),
     SSL_CONF_CMD_SWITCH("ecdh_single", SSL_CONF_FLAG_SERVER),
     SSL_CONF_CMD_SWITCH("no_ticket", 0),
@@ -640,7 +641,8 @@ static const ssl_switch_tbl ssl_cmd_switches[] = {
     {SSL_OP_NO_TLSv1_1, 0},     /* no_tls1_1 */
     {SSL_OP_NO_TLSv1_2, 0},     /* no_tls1_2 */
     {SSL_OP_ALL, 0},            /* bugs */
-    {SSL_OP_NO_COMPRESSION, 1}, /* comp */
+    {SSL_OP_NO_COMPRESSION, 0}, /* no_comp */
+    {SSL_OP_NO_COMPRESSION, SSL_TFLAG_INV}, /* comp */
     {SSL_OP_SINGLE_ECDH_USE, 0}, /* ecdh_single */
     {SSL_OP_NO_TICKET, 0},      /* no_ticket */
     {SSL_OP_CIPHER_SERVER_PREFERENCE, 0}, /* serverpref */

diff --git a/util/TLSProxy/Proxy.pm b/util/TLSProxy/Proxy.pm
index 283c76564f8b79f828dfb774356dde0b512abceb..45871b87488aa7227dc54bac9defa1d5dbd0ecda 100644 (file)
--- a/util/TLSProxy/Proxy.pm
+++ b/util/TLSProxy/Proxy.pm
@@ -183,7 +183,7 @@ sub start
             or die "Failed to redirect stdout: $!";
         open(STDERR, ">&STDOUT");
         my $execcmd = $self->execute
-            ." s_server -rev -engine ossltest -accept "
+            ." s_server -no_comp -rev -engine ossltest -accept "
             .($self->server_port)
             ." -cert ".$self->cert." -naccept ".$self->serverconnects;
         if ($self->ciphers ne "") {