TLS is pretty boring without TLS extensions... unifdef OPENSSL_NO_TLSEXT,

which was already done for libssl some time back.

2 files changed, 2 insertions, 76 deletions

diff --git a/usr.bin/openssl/s_client.c b/usr.bin/openssl/s_client.c
index 25d4c0c5dd2..12c9bd2c2d8 100644
--- a/usr.bin/openssl/s_client.c
+++ b/usr.bin/openssl/s_client.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: s_client.c,v 1.5 2014/10/22 13:51:31 jsing Exp $ */
+/* $OpenBSD: s_client.c,v 1.6 2014/11/06 14:50:12 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -179,10 +179,8 @@ extern int verify_return_error;
 static int c_nbio = 0;
 static int c_Pause = 0;
 static int c_debug = 0;
-#ifndef OPENSSL_NO_TLSEXT
 static int c_tlsextdebug = 0;
 static int c_status_req = 0;
-#endif
 static int c_msg = 0;
 static int c_showcerts = 0;
 
@@ -191,9 +189,7 @@ static int keymatexportlen = 20;
 
 static void sc_usage(void);
 static void print_stuff(BIO * berr, SSL * con, int full);
-#ifndef OPENSSL_NO_TLSEXT
 static int ocsp_resp_cb(SSL * s, void *arg);
-#endif
 static BIO *bio_c_out = NULL;
 static int c_quiet = 0;
 static int c_ign_eof = 0;
@@ -251,7 +247,6 @@ sc_usage(void)
 #endif
 	BIO_printf(bio_err, " -sess_out arg - file to write SSL session to\n");
 	BIO_printf(bio_err, " -sess_in arg  - file to read SSL session from\n");
-#ifndef OPENSSL_NO_TLSEXT
 	BIO_printf(bio_err, " -servername host  - Set TLS extension servername in ClientHello\n");
 	BIO_printf(bio_err, " -tlsextdebug      - hex dump of all TLS extensions received\n");
 	BIO_printf(bio_err, " -status           - request certificate status from server\n");
@@ -259,7 +254,6 @@ sc_usage(void)
 #ifndef OPENSSL_NO_NEXTPROTONEG
 	BIO_printf(bio_err, " -nextprotoneg arg - enable NPN extension, considering named protocols supported (comma-separated list)\n");
 #endif
-#endif
 #ifndef OPENSSL_NO_SRTP
 	BIO_printf(bio_err, " -use_srtp profiles - Offer SRTP key management with a colon-separated profile list\n");
 #endif
@@ -267,7 +261,6 @@ sc_usage(void)
 	BIO_printf(bio_err, " -keymatexportlen len  - Export len bytes of keying material (default 20)\n");
 }
 
-#ifndef OPENSSL_NO_TLSEXT
 
 /* This is a context that we pass to callbacks */
 typedef struct tlsextctx_st {
@@ -324,7 +317,6 @@ next_proto_cb(SSL * s, unsigned char **out, unsigned char *outlen, const unsigne
 	return SSL_TLSEXT_ERR_OK;
 }
 #endif				/* ndef OPENSSL_NO_NEXTPROTONEG */
-#endif
 
 enum {
 	PROTO_OFF = 0,
@@ -378,14 +370,12 @@ s_client_main(int argc, char **argv)
 	ENGINE *ssl_client_engine = NULL;
 #endif
 	ENGINE *e = NULL;
-#ifndef OPENSSL_NO_TLSEXT
 	char *servername = NULL;
 	tlsextctx tlsextcbp =
 	{NULL, 0};
 #ifndef OPENSSL_NO_NEXTPROTONEG
 	const char *next_proto_neg_in = NULL;
 #endif
-#endif
 	char *sess_in = NULL;
 	char *sess_out = NULL;
 	struct sockaddr peer;
@@ -475,12 +465,10 @@ s_client_main(int argc, char **argv)
 			c_Pause = 1;
 		else if (strcmp(*argv, "-debug") == 0)
 			c_debug = 1;
-#ifndef OPENSSL_NO_TLSEXT
 		else if (strcmp(*argv, "-tlsextdebug") == 0)
 			c_tlsextdebug = 1;
 		else if (strcmp(*argv, "-status") == 0)
 			c_status_req = 1;
-#endif
 		else if (strcmp(*argv, "-msg") == 0)
 			c_msg = 1;
 		else if (strcmp(*argv, "-showcerts") == 0)
@@ -548,7 +536,6 @@ s_client_main(int argc, char **argv)
 		else if (strcmp(*argv, "-no_comp") == 0) {
 			off |= SSL_OP_NO_COMPRESSION;
 		}
-#ifndef OPENSSL_NO_TLSEXT
 		else if (strcmp(*argv, "-no_ticket") == 0) {
 			off |= SSL_OP_NO_TICKET;
 		}
@@ -559,7 +546,6 @@ s_client_main(int argc, char **argv)
 			next_proto_neg_in = *(++argv);
 		}
 #endif
-#endif
 		else if (strcmp(*argv, "-serverpref") == 0)
 			off |= SSL_OP_CIPHER_SERVER_PREFERENCE;
 		else if (strcmp(*argv, "-legacy_renegotiation") == 0)
@@ -611,14 +597,12 @@ s_client_main(int argc, char **argv)
 		} else if (strcmp(*argv, "-6") == 0) {
 			af = AF_INET6;
 		}
-#ifndef OPENSSL_NO_TLSEXT
 		else if (strcmp(*argv, "-servername") == 0) {
 			if (--argc < 1)
 				goto bad;
 			servername = *(++argv);
 			/* meth=TLSv1_client_method(); */
 		}
-#endif
 #ifndef OPENSSL_NO_SRTP
 		else if (strcmp(*argv, "-use_srtp") == 0) {
 			if (--argc < 1)
@@ -777,13 +761,11 @@ bad:
 		ERR_print_errors(bio_err);
 		/* goto end; */
 	}
-#ifndef OPENSSL_NO_TLSEXT
 	if (servername != NULL) {
 		tlsextcbp.biodebug = bio_err;
 		SSL_CTX_set_tlsext_servername_callback(ctx, ssl_servername_cb);
 		SSL_CTX_set_tlsext_servername_arg(ctx, &tlsextcbp);
 	}
-#endif
 
 	con = SSL_new(ctx);
 	if (sess_in) {
@@ -806,7 +788,6 @@ bad:
 		SSL_set_session(con, sess);
 		SSL_SESSION_free(sess);
 	}
-#ifndef OPENSSL_NO_TLSEXT
 	if (servername != NULL) {
 		if (!SSL_set_tlsext_host_name(con, servername)) {
 			BIO_printf(bio_err, "Unable to set TLS servername extension.\n");
@@ -814,7 +795,6 @@ bad:
 			goto end;
 		}
 	}
-#endif
 /*	SSL_set_cipher_list(con,"RC4-MD5"); */
 
 re_start:
@@ -881,7 +861,6 @@ re_start:
 		SSL_set_msg_callback(con, msg_cb);
 		SSL_set_msg_callback_arg(con, bio_c_out);
 	}
-#ifndef OPENSSL_NO_TLSEXT
 	if (c_tlsextdebug) {
 		SSL_set_tlsext_debug_callback(con, tlsext_cb);
 		SSL_set_tlsext_debug_arg(con, bio_c_out);
@@ -891,7 +870,6 @@ re_start:
 		SSL_CTX_set_tlsext_status_cb(ctx, ocsp_resp_cb);
 		SSL_CTX_set_tlsext_status_arg(ctx, bio_c_out);
 	}
-#endif
 
 	SSL_set_bio(con, sbio, sbio);
 	SSL_set_connect_state(con);
@@ -1472,7 +1450,6 @@ print_stuff(BIO * bio, SSL * s, int full)
 	(void) BIO_flush(bio);
 }
 
-#ifndef OPENSSL_NO_TLSEXT
 
 static int
 ocsp_resp_cb(SSL * s, void *arg)
@@ -1499,4 +1476,3 @@ ocsp_resp_cb(SSL * s, void *arg)
 	return 1;
 }
 
-#endif
diff --git a/usr.bin/openssl/s_server.c b/usr.bin/openssl/s_server.c
index 30a926c4111..1e6f85f9fbb 100644
--- a/usr.bin/openssl/s_server.c
+++ b/usr.bin/openssl/s_server.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: s_server.c,v 1.5 2014/10/31 16:59:00 jsing Exp $ */
+/* $OpenBSD: s_server.c,v 1.6 2014/11/06 14:50:12 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -200,9 +200,7 @@ static int bufsize = BUFSIZZ;
 static int accept_socket = -1;
 
 #define TEST_CERT	"server.pem"
-#ifndef OPENSSL_NO_TLSEXT
 #define TEST_CERT2	"server2.pem"
-#endif
 
 extern int verify_depth, verify_return_error;
 
@@ -210,26 +208,20 @@ static char *cipher = NULL;
 static int s_server_verify = SSL_VERIFY_NONE;
 static int s_server_session_id_context = 1;	/* anything will do */
 static const char *s_cert_file = TEST_CERT, *s_key_file = NULL;
-#ifndef OPENSSL_NO_TLSEXT
 static const char *s_cert_file2 = TEST_CERT2, *s_key_file2 = NULL;
-#endif
 static char *s_dcert_file = NULL, *s_dkey_file = NULL;
 static int s_nbio = 0;
 static int s_nbio_test = 0;
 int s_crlf = 0;
 static SSL_CTX *ctx = NULL;
-#ifndef OPENSSL_NO_TLSEXT
 static SSL_CTX *ctx2 = NULL;
-#endif
 static int www = 0;
 
 static BIO *bio_s_out = NULL;
 static int s_debug = 0;
-#ifndef OPENSSL_NO_TLSEXT
 static int s_tlsextdebug = 0;
 static int s_tlsextstatus = 0;
 static int cert_status_cb(SSL * s, void *arg);
-#endif
 static int s_msg = 0;
 static int s_quiet = 0;
 
@@ -261,11 +253,9 @@ s_server_init(void)
 	s_dkey_file = NULL;
 	s_cert_file = TEST_CERT;
 	s_key_file = NULL;
-#ifndef OPENSSL_NO_TLSEXT
 	s_cert_file2 = TEST_CERT2;
 	s_key_file2 = NULL;
 	ctx2 = NULL;
-#endif
 	s_nbio = 0;
 	s_nbio_test = 0;
 	ctx = NULL;
@@ -350,7 +340,6 @@ sv_usage(void)
 	BIO_printf(bio_err, " -engine id    - Initialise and use the specified engine\n");
 #endif
 	BIO_printf(bio_err, " -id_prefix arg - Generate SSL/TLS session IDs prefixed by 'arg'\n");
-#ifndef OPENSSL_NO_TLSEXT
 	BIO_printf(bio_err, " -servername host - servername for HostName TLS extension\n");
 	BIO_printf(bio_err, " -servername_fatal - on mismatch send fatal alert (default warning alert)\n");
 	BIO_printf(bio_err, " -cert2 arg    - certificate file to use for servername\n");
@@ -365,7 +354,6 @@ sv_usage(void)
 #ifndef OPENSSL_NO_SRTP
 	BIO_printf(bio_err, " -use_srtp profiles - Offer SRTP key management with a colon-separated profile list\n");
 #endif
-#endif
 	BIO_printf(bio_err, " -keymatexport label   - Export keying material using label\n");
 	BIO_printf(bio_err, " -keymatexportlen len  - Export len bytes of keying material (default 20)\n");
 }
@@ -373,7 +361,6 @@ sv_usage(void)
 static int local_argc = 0;
 static char **local_argv;
 
-#ifndef OPENSSL_NO_TLSEXT
 
 /* This is a context that we pass to callbacks */
 typedef struct tlsextctx_st {
@@ -558,7 +545,6 @@ next_proto_cb(SSL * s, const unsigned char **data, unsigned int *len, void *arg)
 #endif				/* ndef OPENSSL_NO_NEXTPROTONEG */
 
 
-#endif
 
 int s_server_main(int, char **);
 
@@ -592,7 +578,6 @@ s_server_main(int argc, char *argv[])
 	EVP_PKEY *s_key = NULL, *s_dkey = NULL;
 	int no_cache = 0;
 	const char *errstr = NULL;
-#ifndef OPENSSL_NO_TLSEXT
 	EVP_PKEY *s_key2 = NULL;
 	X509 *s_cert2 = NULL;
 	tlsextctx tlsextcbp = {NULL, NULL, SSL_TLSEXT_ERR_ALERT_WARNING};
@@ -600,7 +585,6 @@ s_server_main(int argc, char *argv[])
 	const char *next_proto_neg_in = NULL;
 	tlsextnextprotoctx next_proto;
 #endif
-#endif
 	meth = SSLv23_server_method();
 
 	local_argc = argc;
@@ -729,7 +713,6 @@ s_server_main(int argc, char *argv[])
 		} else if (strcmp(*argv, "-debug") == 0) {
 			s_debug = 1;
 		}
-#ifndef OPENSSL_NO_TLSEXT
 		else if (strcmp(*argv, "-tlsextdebug") == 0)
 			s_tlsextdebug = 1;
 		else if (strcmp(*argv, "-status") == 0)
@@ -757,7 +740,6 @@ s_server_main(int argc, char *argv[])
 				goto bad;
 			}
 		}
-#endif
 		else if (strcmp(*argv, "-msg") == 0) {
 			s_msg = 1;
 		} else if (strcmp(*argv, "-hack") == 0) {
@@ -795,11 +777,9 @@ s_server_main(int argc, char *argv[])
 		} else if (strcmp(*argv, "-no_comp") == 0) {
 			off |= SSL_OP_NO_COMPRESSION;
 		}
-#ifndef OPENSSL_NO_TLSEXT
 		else if (strcmp(*argv, "-no_ticket") == 0) {
 			off |= SSL_OP_NO_TICKET;
 		}
-#endif
 		else if (strcmp(*argv, "-ssl3") == 0) {
 			meth = SSLv3_server_method();
 		} else if (strcmp(*argv, "-tls1") == 0) {
@@ -836,7 +816,6 @@ s_server_main(int argc, char *argv[])
 			engine_id = *(++argv);
 		}
 #endif
-#ifndef OPENSSL_NO_TLSEXT
 		else if (strcmp(*argv, "-servername") == 0) {
 			if (--argc < 1)
 				goto bad;
@@ -859,7 +838,6 @@ s_server_main(int argc, char *argv[])
 			next_proto_neg_in = *(++argv);
 		}
 #endif
-#endif
 #ifndef OPENSSL_NO_SRTP
 		else if (strcmp(*argv, "-use_srtp") == 0) {
 			if (--argc < 1)
@@ -905,10 +883,8 @@ bad:
 	}
 	if (s_key_file == NULL)
 		s_key_file = s_cert_file;
-#ifndef OPENSSL_NO_TLSEXT
 	if (s_key_file2 == NULL)
 		s_key_file2 = s_cert_file2;
-#endif
 
 	if (nocert == 0) {
 		s_key = load_key(bio_err, s_key_file, s_key_format, 0, pass, e,
@@ -924,7 +900,6 @@ bad:
 			ERR_print_errors(bio_err);
 			goto end;
 		}
-#ifndef OPENSSL_NO_TLSEXT
 		if (tlsextcbp.servername) {
 			s_key2 = load_key(bio_err, s_key_file2, s_key_format, 0, pass, e,
 			    "second server certificate private key file");
@@ -940,7 +915,6 @@ bad:
 				goto end;
 			}
 		}
-#endif
 	}
 #if !defined(OPENSSL_NO_TLSEXT) && !defined(OPENSSL_NO_NEXTPROTONEG)
 	if (next_proto_neg_in) {
@@ -989,10 +963,8 @@ bad:
 		s_key_file = NULL;
 		s_dcert_file = NULL;
 		s_dkey_file = NULL;
-#ifndef OPENSSL_NO_TLSEXT
 		s_cert_file2 = NULL;
 		s_key_file2 = NULL;
-#endif
 	}
 	ctx = SSL_CTX_new(meth);
 	if (ctx == NULL) {
@@ -1048,7 +1020,6 @@ bad:
 	if (vpm)
 		SSL_CTX_set1_param(ctx, vpm);
 
-#ifndef OPENSSL_NO_TLSEXT
 	if (s_cert2) {
 		ctx2 = SSL_CTX_new(meth);
 		if (ctx2 == NULL) {
@@ -1105,7 +1076,6 @@ bad:
 	if (next_proto.data)
 		SSL_CTX_set_next_protos_advertised_cb(ctx, next_proto_cb, &next_proto);
 #endif
-#endif
 
 #ifndef OPENSSL_NO_DH
 	if (!no_dhe) {
@@ -1132,7 +1102,6 @@ bad:
 			goto end;
 		}
 
-#ifndef OPENSSL_NO_TLSEXT
 		if (ctx2) {
 			if (!dhfile) {
 				DH *dh2 = load_dh_param(s_cert_file2);
@@ -1154,7 +1123,6 @@ bad:
 				goto end;
 			}
 		}
-#endif
 		DH_free(dh);
 	}
 #endif
@@ -1190,19 +1158,15 @@ bad:
 		(void) BIO_flush(bio_s_out);
 
 		SSL_CTX_set_tmp_ecdh(ctx, ecdh);
-#ifndef OPENSSL_NO_TLSEXT
 		if (ctx2)
 			SSL_CTX_set_tmp_ecdh(ctx2, ecdh);
-#endif
 		EC_KEY_free(ecdh);
 	}
 
 	if (!set_cert_key_stuff(ctx, s_cert, s_key))
 		goto end;
-#ifndef OPENSSL_NO_TLSEXT
 	if (ctx2 && !set_cert_key_stuff(ctx2, s_cert2, s_key2))
 		goto end;
-#endif
 	if (s_dcert != NULL) {
 		if (!set_cert_key_stuff(ctx, s_dcert, s_dkey))
 			goto end;
@@ -1214,13 +1178,11 @@ bad:
 			ERR_print_errors(bio_err);
 			goto end;
 		}
-#ifndef OPENSSL_NO_TLSEXT
 		if (ctx2 && !SSL_CTX_set_cipher_list(ctx2, cipher)) {
 			BIO_printf(bio_err, "error setting cipher list\n");
 			ERR_print_errors(bio_err);
 			goto end;
 		}
-#endif
 	}
 	SSL_CTX_set_verify(ctx, s_server_verify, verify_callback);
 	SSL_CTX_set_session_id_context(ctx, (void *) &s_server_session_id_context,
@@ -1230,7 +1192,6 @@ bad:
 	SSL_CTX_set_cookie_generate_cb(ctx, generate_cookie_callback);
 	SSL_CTX_set_cookie_verify_cb(ctx, verify_cookie_callback);
 
-#ifndef OPENSSL_NO_TLSEXT
 	if (ctx2) {
 		SSL_CTX_set_verify(ctx2, s_server_verify, verify_callback);
 		SSL_CTX_set_session_id_context(ctx2, (void *) &s_server_session_id_context,
@@ -1242,14 +1203,11 @@ bad:
 		SSL_CTX_set_tlsext_servername_callback(ctx, ssl_servername_cb);
 		SSL_CTX_set_tlsext_servername_arg(ctx, &tlsextcbp);
 	}
-#endif
 
 	if (CAfile != NULL) {
 		SSL_CTX_set_client_CA_list(ctx, SSL_load_client_CA_file(CAfile));
-#ifndef OPENSSL_NO_TLSEXT
 		if (ctx2)
 			SSL_CTX_set_client_CA_list(ctx2, SSL_load_client_CA_file(CAfile));
-#endif
 	}
 	BIO_printf(bio_s_out, "ACCEPT\n");
 	(void) BIO_flush(bio_s_out);
@@ -1274,7 +1232,6 @@ end:
 	free(dpass);
 	if (vpm)
 		X509_VERIFY_PARAM_free(vpm);
-#ifndef OPENSSL_NO_TLSEXT
 	free(tlscstatp.host);
 	free(tlscstatp.port);
 	free(tlscstatp.path);
@@ -1284,7 +1241,6 @@ end:
 		X509_free(s_cert2);
 	if (s_key2)
 		EVP_PKEY_free(s_key2);
-#endif
 	if (bio_s_out != NULL) {
 		BIO_free(bio_s_out);
 		bio_s_out = NULL;
@@ -1345,7 +1301,6 @@ sv_body(char *hostname, int s, unsigned char *context)
 
 	if (con == NULL) {
 		con = SSL_new(ctx);
-#ifndef OPENSSL_NO_TLSEXT
 		if (s_tlsextdebug) {
 			SSL_set_tlsext_debug_callback(con, tlsext_cb);
 			SSL_set_tlsext_debug_arg(con, bio_s_out);
@@ -1355,7 +1310,6 @@ sv_body(char *hostname, int s, unsigned char *context)
 			tlscstatp.err = bio_err;
 			SSL_CTX_set_tlsext_status_arg(ctx, &tlscstatp);
 		}
-#endif
 		if (context)
 			SSL_set_session_id_context(con, context,
 			    strlen((char *) context));
@@ -1407,12 +1361,10 @@ sv_body(char *hostname, int s, unsigned char *context)
 		SSL_set_msg_callback(con, msg_cb);
 		SSL_set_msg_callback_arg(con, bio_s_out);
 	}
-#ifndef OPENSSL_NO_TLSEXT
 	if (s_tlsextdebug) {
 		SSL_set_tlsext_debug_callback(con, tlsext_cb);
 		SSL_set_tlsext_debug_arg(con, bio_s_out);
 	}
-#endif
 
 	width = s + 1;
 	for (;;) {
@@ -1781,12 +1733,10 @@ www_body(char *hostname, int s, unsigned char *context)
 
 	if ((con = SSL_new(ctx)) == NULL)
 		goto err;
-#ifndef OPENSSL_NO_TLSEXT
 	if (s_tlsextdebug) {
 		SSL_set_tlsext_debug_callback(con, tlsext_cb);
 		SSL_set_tlsext_debug_arg(con, bio_s_out);
 	}
-#endif
 	if (context)
 		SSL_set_session_id_context(con, context,
 		    strlen((char *) context));