decompress libssl. ok beck jsing

25 files changed, 39 insertions, 758 deletions

diff --git a/lib/libssl/src/ssl/d1_both.c b/lib/libssl/src/ssl/d1_both.c
index f27588fcff8..e25f69dbb64 100644
--- a/lib/libssl/src/ssl/d1_both.c
+++ b/lib/libssl/src/ssl/d1_both.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: d1_both.c,v 1.23 2014/07/10 08:25:00 guenther Exp $ */
+/* $OpenBSD: d1_both.c,v 1.24 2014/07/10 08:51:14 tedu Exp $ */
 /*
  * DTLS implementation written by Nagendra Modadugu
  * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
@@ -944,7 +944,6 @@ dtls1_send_finished(SSL *s, int a, int b, const char *sender, int slen)
  * ssl->s3->read_sequence		zero
  * ssl->s3->read_mac_secret		re-init
  * ssl->session->read_sym_enc		assign
- * ssl->session->read_compression	assign
  * ssl->session->read_hash		assign
  */
 int
@@ -1160,7 +1159,6 @@ dtls1_buffer_message(SSL *s, int is_ccs)
 	/* save current state*/
 	frag->msg_header.saved_retransmit_state.enc_write_ctx = s->enc_write_ctx;
 	frag->msg_header.saved_retransmit_state.write_hash = s->write_hash;
-	frag->msg_header.saved_retransmit_state.compress = s->compress;
 	frag->msg_header.saved_retransmit_state.session = s->session;
 	frag->msg_header.saved_retransmit_state.epoch = s->d1->w_epoch;
 
@@ -1229,7 +1227,6 @@ dtls1_retransmit_message(SSL *s, unsigned short seq, unsigned long frag_off,
 	/* save current state */
 	saved_state.enc_write_ctx = s->enc_write_ctx;
 	saved_state.write_hash = s->write_hash;
-	saved_state.compress = s->compress;
 	saved_state.session = s->session;
 	saved_state.epoch = s->d1->w_epoch;
 
@@ -1238,7 +1235,6 @@ dtls1_retransmit_message(SSL *s, unsigned short seq, unsigned long frag_off,
 	/* restore state in which the message was originally sent */
 	s->enc_write_ctx = frag->msg_header.saved_retransmit_state.enc_write_ctx;
 	s->write_hash = frag->msg_header.saved_retransmit_state.write_hash;
-	s->compress = frag->msg_header.saved_retransmit_state.compress;
 	s->session = frag->msg_header.saved_retransmit_state.session;
 	s->d1->w_epoch = frag->msg_header.saved_retransmit_state.epoch;
 
@@ -1256,7 +1252,6 @@ dtls1_retransmit_message(SSL *s, unsigned short seq, unsigned long frag_off,
 	/* restore current state */
 	s->enc_write_ctx = saved_state.enc_write_ctx;
 	s->write_hash = saved_state.write_hash;
-	s->compress = saved_state.compress;
 	s->session = saved_state.session;
 	s->d1->w_epoch = saved_state.epoch;
 
diff --git a/lib/libssl/src/ssl/d1_clnt.c b/lib/libssl/src/ssl/d1_clnt.c
index 65b59f79874..04ae11d7bc3 100644
--- a/lib/libssl/src/ssl/d1_clnt.c
+++ b/lib/libssl/src/ssl/d1_clnt.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: d1_clnt.c,v 1.26 2014/06/12 15:49:31 deraadt Exp $ */
+/* $OpenBSD: d1_clnt.c,v 1.27 2014/07/10 08:51:14 tedu Exp $ */
 /*
  * DTLS implementation written by Nagendra Modadugu
  * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
@@ -544,15 +544,6 @@ dtls1_connect(SSL *s)
 			s->init_num = 0;
 
 			s->session->cipher = s->s3->tmp.new_cipher;
-#ifdef OPENSSL_NO_COMP
-			s->session->compress_meth = 0;
-#else
-			if (s->s3->tmp.new_compression == NULL)
-				s->session->compress_meth = 0;
-			else
-				s->session->compress_meth =
-				    s->s3->tmp.new_compression->id;
-#endif
 			if (!s->method->ssl3_enc->setup_key_block(s)) {
 				ret = -1;
 				goto end;
@@ -768,9 +759,8 @@ dtls1_client_hello(SSL *s)
 {
 	unsigned char *buf;
 	unsigned char *p, *d;
-	unsigned int i, j;
+	unsigned int i;
 	unsigned long l;
-	SSL_COMP *comp;
 
 	buf = (unsigned char *)s->init_buf->data;
 	if (s->state == SSL3_ST_CW_CLNT_HELLO_A) {
@@ -839,16 +829,8 @@ dtls1_client_hello(SSL *s)
 		s2n(i, p);
 		p += i;
 
-		/* COMPRESSION */
-		if (s->ctx->comp_methods == NULL)
-			j = 0;
-		else
-			j = sk_SSL_COMP_num(s->ctx->comp_methods);
-		*(p++) = 1 + j;
-		for (i = 0; i < j; i++) {
-			comp = sk_SSL_COMP_value(s->ctx->comp_methods, i);
-			*(p++) = comp->id;
-		}
+		/* add in (no) COMPRESSION */
+		*(p++) = 1;
 		*(p++) = 0; /* Add the NULL method */
 
 		if ((p = ssl_add_clienthello_tlsext(s, p,
diff --git a/lib/libssl/src/ssl/d1_enc.c b/lib/libssl/src/ssl/d1_enc.c
index 104f233937d..fe8df15a94b 100644
--- a/lib/libssl/src/ssl/d1_enc.c
+++ b/lib/libssl/src/ssl/d1_enc.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: d1_enc.c,v 1.5 2014/06/12 15:49:31 deraadt Exp $ */
+/* $OpenBSD: d1_enc.c,v 1.6 2014/07/10 08:51:14 tedu Exp $ */
 /* 
  * DTLS implementation written by Nagendra Modadugu
  * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.  
@@ -115,9 +115,6 @@
 
 #include <stdio.h>
 #include "ssl_locl.h"
-#ifndef OPENSSL_NO_COMP
-#include <openssl/comp.h>
-#endif
 #include <openssl/evp.h>
 #include <openssl/hmac.h>
 #include <openssl/md5.h>
diff --git a/lib/libssl/src/ssl/d1_pkt.c b/lib/libssl/src/ssl/d1_pkt.c
index 56e6939aedc..c9ffab1f3c2 100644
--- a/lib/libssl/src/ssl/d1_pkt.c
+++ b/lib/libssl/src/ssl/d1_pkt.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: d1_pkt.c,v 1.31 2014/07/09 16:06:14 miod Exp $ */
+/* $OpenBSD: d1_pkt.c,v 1.32 2014/07/10 08:51:14 tedu Exp $ */
 /* 
  * DTLS implementation written by Nagendra Modadugu
  * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.  
@@ -427,20 +427,6 @@ dtls1_process_record(SSL *s)
 		goto err;
 	}
 
-	/* r->length is now just compressed */
-	if (s->expand != NULL) {
-		if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH) {
-			al = SSL_AD_RECORD_OVERFLOW;
-			SSLerr(SSL_F_DTLS1_PROCESS_RECORD, SSL_R_COMPRESSED_LENGTH_TOO_LONG);
-			goto f_err;
-		}
-		if (!ssl3_do_uncompress(s)) {
-			al = SSL_AD_DECOMPRESSION_FAILURE;
-			SSLerr(SSL_F_DTLS1_PROCESS_RECORD, SSL_R_BAD_DECOMPRESSION);
-			goto f_err;
-		}
-	}
-
 	if (rr->length > SSL3_RT_MAX_PLAIN_LENGTH) {
 		al = SSL_AD_RECORD_OVERFLOW;
 		SSLerr(SSL_F_DTLS1_PROCESS_RECORD, SSL_R_DATA_LENGTH_TOO_LONG);
@@ -1373,16 +1359,8 @@ do_dtls1_write(SSL *s, int type, const unsigned char *buf, unsigned int len)
 	/* we now 'read' from wr->input, wr->length bytes into
 	 * wr->data */
 
-	/* first we compress */
-	if (s->compress != NULL) {
-		if (!ssl3_do_compress(s)) {
-			SSLerr(SSL_F_DO_DTLS1_WRITE, SSL_R_COMPRESSION_FAILURE);
-			goto err;
-		}
-	} else {
-		memcpy(wr->data, wr->input, wr->length);
-		wr->input = wr->data;
-	}
+	memcpy(wr->data, wr->input, wr->length);
+	wr->input = wr->data;
 
 	/* we should still have the output to wr->data and the input
 	 * from wr->input.  Length should be wr->length.
diff --git a/lib/libssl/src/ssl/d1_srvr.c b/lib/libssl/src/ssl/d1_srvr.c
index c01dc77254e..9fdb6c290b1 100644
--- a/lib/libssl/src/ssl/d1_srvr.c
+++ b/lib/libssl/src/ssl/d1_srvr.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: d1_srvr.c,v 1.28 2014/07/09 11:25:42 jsing Exp $ */
+/* $OpenBSD: d1_srvr.c,v 1.29 2014/07/10 08:51:14 tedu Exp $ */
 /* 
  * DTLS implementation written by Nagendra Modadugu
  * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.  
@@ -946,14 +946,7 @@ dtls1_send_server_hello(SSL *s)
 		p += i;
 
 		/* put the compression method */
-#ifdef OPENSSL_NO_COMP
 		*(p++) = 0;
-#else
-		if (s->s3->tmp.new_compression == NULL)
-			*(p++) = 0;
-		else
-			*(p++) = s->s3->tmp.new_compression->id;
-#endif
 
 		if ((p = ssl_add_serverhello_tlsext(s, p, buf + SSL3_RT_MAX_PLAIN_LENGTH)) == NULL) {
 			SSLerr(SSL_F_DTLS1_SEND_SERVER_HELLO, ERR_R_INTERNAL_ERROR);
diff --git a/lib/libssl/src/ssl/dtls1.h b/lib/libssl/src/ssl/dtls1.h
index c6e302faf4f..e7229fb56be 100644
--- a/lib/libssl/src/ssl/dtls1.h
+++ b/lib/libssl/src/ssl/dtls1.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: dtls1.h,v 1.13 2014/06/12 15:49:31 deraadt Exp $ */
+/* $OpenBSD: dtls1.h,v 1.14 2014/07/10 08:51:14 tedu Exp $ */
 /* 
  * DTLS implementation written by Nagendra Modadugu
  * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.  
@@ -108,11 +108,6 @@ typedef struct dtls1_bitmap_st {
 struct dtls1_retransmit_state {
 	EVP_CIPHER_CTX *enc_write_ctx;	/* cryptographic state */
 	EVP_MD_CTX *write_hash;		/* used for mac generation */
-#ifndef OPENSSL_NO_COMP
-	COMP_CTX *compress;		/* compression */
-#else
-	char *compress;
-#endif
 	SSL_SESSION *session;
 	unsigned short epoch;
 };
diff --git a/lib/libssl/src/ssl/s23_clnt.c b/lib/libssl/src/ssl/s23_clnt.c
index 510e729d554..e2f1544486b 100644
--- a/lib/libssl/src/ssl/s23_clnt.c
+++ b/lib/libssl/src/ssl/s23_clnt.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: s23_clnt.c,v 1.29 2014/06/12 15:49:31 deraadt Exp $ */
+/* $OpenBSD: s23_clnt.c,v 1.30 2014/07/10 08:51:14 tedu Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -293,10 +293,6 @@ ssl23_client_hello(SSL *s)
 	int i;
 	unsigned long l;
 	int version = 0, version_major, version_minor;
-#ifndef OPENSSL_NO_COMP
-	int j;
-	SSL_COMP *comp;
-#endif
 	int ret;
 	unsigned long mask, options = s->options;
 
@@ -384,21 +380,8 @@ ssl23_client_hello(SSL *s)
 		s2n(i, p);
 		p += i;
 
-		/* COMPRESSION */
-#ifdef OPENSSL_NO_COMP
+		/* add in (no) COMPRESSION */
 		*(p++) = 1;
-#else
-		if ((s->options & SSL_OP_NO_COMPRESSION) ||
-		    !s->ctx->comp_methods)
-			j = 0;
-		else
-			j = sk_SSL_COMP_num(s->ctx->comp_methods);
-		*(p++) = 1 + j;
-		for (i = 0; i < j; i++) {
-			comp = sk_SSL_COMP_value(s->ctx->comp_methods, i);
-			*(p++) = comp->id;
-		}
-#endif
 		/* Add the NULL method */
 		*(p++) = 0;
 
diff --git a/lib/libssl/src/ssl/s23_srvr.c b/lib/libssl/src/ssl/s23_srvr.c
index cd1a5174a70..caeb34b78e9 100644
--- a/lib/libssl/src/ssl/s23_srvr.c
+++ b/lib/libssl/src/ssl/s23_srvr.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: s23_srvr.c,v 1.29 2014/06/30 14:13:27 tedu Exp $ */
+/* $OpenBSD: s23_srvr.c,v 1.30 2014/07/10 08:51:14 tedu Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -487,7 +487,7 @@ ssl23_get_client_hello(SSL *s)
 		}
 		s2n(j, dd);
 
-		/* COMPRESSION */
+		/* add in (no) COMPRESSION */
 		*(d++) = 1;
 		*(d++) = 0;
 
diff --git a/lib/libssl/src/ssl/s3_both.c b/lib/libssl/src/ssl/s3_both.c
index 2da6b527e11..500387e3720 100644
--- a/lib/libssl/src/ssl/s3_both.c
+++ b/lib/libssl/src/ssl/s3_both.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: s3_both.c,v 1.25 2014/06/19 21:29:51 tedu Exp $ */
+/* $OpenBSD: s3_both.c,v 1.26 2014/07/10 08:51:14 tedu Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -287,7 +287,6 @@ f_err:
  * ssl->s3->read_sequence		zero
  * ssl->s3->read_mac_secret		re-init
  * ssl->session->read_sym_enc		assign
- * ssl->session->read_compression	assign
  * ssl->session->read_hash		assign
  */
 int
@@ -640,10 +639,6 @@ ssl3_setup_read_buffer(SSL *s)
 			s->s3->init_extra = 1;
 			len += SSL3_RT_MAX_EXTRA;
 		}
-#ifndef OPENSSL_NO_COMP
-		if (!(s->options & SSL_OP_NO_COMPRESSION))
-			len += SSL3_RT_MAX_COMPRESSED_OVERHEAD;
-#endif
 		if ((p = malloc(len)) == NULL)
 			goto err;
 		s->s3->rbuf.buf = p;
@@ -676,10 +671,6 @@ ssl3_setup_write_buffer(SSL *s)
 	if (s->s3->wbuf.buf == NULL) {
 		len = s->max_send_fragment +
 		    SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD + headerlen + align;
-#ifndef OPENSSL_NO_COMP
-		if (!(s->options & SSL_OP_NO_COMPRESSION))
-			len += SSL3_RT_MAX_COMPRESSED_OVERHEAD;
-#endif
 		if (!(s->options & SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS))
 			len += headerlen + align +
 			    SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD;
diff --git a/lib/libssl/src/ssl/s3_cbc.c b/lib/libssl/src/ssl/s3_cbc.c
index 24f0a22d073..74bd4b47c8a 100644
--- a/lib/libssl/src/ssl/s3_cbc.c
+++ b/lib/libssl/src/ssl/s3_cbc.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: s3_cbc.c,v 1.7 2014/06/12 15:49:31 deraadt Exp $ */
+/* $OpenBSD: s3_cbc.c,v 1.8 2014/07/10 08:51:14 tedu Exp $ */
 /* ====================================================================
  * Copyright (c) 2012 The OpenSSL Project.  All rights reserved.
  *
@@ -169,8 +169,9 @@ tls1_cbc_remove_padding(const SSL* s, SSL3_RECORD *rec, unsigned block_size,
 	 * even length so the padding bug check cannot be performed. This bug
 	 * workaround has been around since SSLeay so hopefully it is either
 	 * fixed now or no buggy implementation supports compression [steve]
+	 * (We don't support compression either, so it's not in operation.)
 	 */
-	if ((s->options & SSL_OP_TLS_BLOCK_PADDING_BUG) && !s->expand) {
+	if ((s->options & SSL_OP_TLS_BLOCK_PADDING_BUG)) {
 		/* First packet is even in size, so check */
 		if ((memcmp(s->s3->read_sequence, "\0\0\0\0\0\0\0\0",
 		    SSL3_SEQUENCE_SIZE) == 0) && !(padding_length & 1)) {
diff --git a/lib/libssl/src/ssl/s3_clnt.c b/lib/libssl/src/ssl/s3_clnt.c
index 61de494244e..079544da846 100644
--- a/lib/libssl/src/ssl/s3_clnt.c
+++ b/lib/libssl/src/ssl/s3_clnt.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: s3_clnt.c,v 1.73 2014/07/09 11:25:42 jsing Exp $ */
+/* $OpenBSD: s3_clnt.c,v 1.74 2014/07/10 08:51:14 tedu Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -472,15 +472,6 @@ ssl3_connect(SSL *s)
 			s->init_num = 0;
 
 			s->session->cipher = s->s3->tmp.new_cipher;
-#ifdef OPENSSL_NO_COMP
-			s->session->compress_meth = 0;
-#else
-			if (s->s3->tmp.new_compression == NULL)
-				s->session->compress_meth = 0;
-			else
-				s->session->compress_meth =
-				    s->s3->tmp.new_compression->id;
-#endif
 			if (!s->method->ssl3_enc->setup_key_block(s)) {
 				ret = -1;
 				goto end;
@@ -656,10 +647,6 @@ ssl3_client_hello(SSL *s)
 	unsigned char	*p, *d;
 	int		 i;
 	unsigned long	 l;
-#ifndef OPENSSL_NO_COMP
-	int		 j;
-	SSL_COMP	 *comp;
-#endif
 
 	buf = (unsigned char *)s->init_buf->data;
 	if (s->state == SSL3_ST_CW_CLNT_HELLO_A) {
@@ -752,22 +739,8 @@ ssl3_client_hello(SSL *s)
 		s2n(i, p);
 		p += i;
 
-		/* COMPRESSION */
-#ifdef OPENSSL_NO_COMP
+		/* add in (no) COMPRESSION */
 		*(p++) = 1;
-#else
-
-		if ((s->options & SSL_OP_NO_COMPRESSION) ||
-		    !s->ctx->comp_methods)
-			j = 0;
-		else
-			j = sk_SSL_COMP_num(s->ctx->comp_methods);
-		*(p++) = 1 + j;
-		for (i = 0; i < j; i++) {
-			comp = sk_SSL_COMP_value(s->ctx->comp_methods, i);
-			*(p++) = comp->id;
-		}
-#endif
 		*(p++) = 0; /* Add the NULL method */
 
 		/* TLS extensions*/
@@ -809,9 +782,6 @@ ssl3_get_server_hello(SSL *s)
 	int			 i, al, ok;
 	unsigned int		 j;
 	long			 n;
-#ifndef OPENSSL_NO_COMP
-	SSL_COMP		*comp;
-#endif
 
 	n = s->method->ssl_get_message(s, SSL3_ST_CR_SRVR_HELLO_A,
 	    SSL3_ST_CR_SRVR_HELLO_B, -1, 20000, /* ?? */ &ok);
@@ -963,50 +933,12 @@ ssl3_get_server_hello(SSL *s)
 	}
 	/* lets get the compression algorithm */
 	/* COMPRESSION */
-#ifdef OPENSSL_NO_COMP
 	if (*(p++) != 0) {
 		al = SSL_AD_ILLEGAL_PARAMETER;
 		SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,
 		    SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM);
 		goto f_err;
 	}
-	/*
-	 * If compression is disabled we'd better not try to resume a session
-	 * using compression.
-	 */
-	if (s->session->compress_meth != 0) {
-		al = SSL_AD_INTERNAL_ERROR;
-		SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,
-		    SSL_R_INCONSISTENT_COMPRESSION);
-		goto f_err;
-	}
-#else
-	j= *(p++);
-	if (s->hit && j != s->session->compress_meth) {
-		al = SSL_AD_ILLEGAL_PARAMETER;
-		SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,
-		    SSL_R_OLD_SESSION_COMPRESSION_ALGORITHM_NOT_RETURNED);
-		goto f_err;
-	}
-	if (j == 0)
-		comp = NULL;
-	else if (s->options & SSL_OP_NO_COMPRESSION) {
-		al = SSL_AD_ILLEGAL_PARAMETER;
-		SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,
-		    SSL_R_COMPRESSION_DISABLED);
-		goto f_err;
-	} else
-		comp = ssl3_comp_find(s->ctx->comp_methods, j);
-
-	if ((j != 0) && (comp == NULL)) {
-		al = SSL_AD_ILLEGAL_PARAMETER;
-		SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,
-		    SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM);
-		goto f_err;
-	} else {
-		s->s3->tmp.new_compression = comp;
-	}
-#endif
 
 	/* TLS extensions*/
 	if (s->version >= SSL3_VERSION) {
diff --git a/lib/libssl/src/ssl/s3_enc.c b/lib/libssl/src/ssl/s3_enc.c
index 5111e0e4fa7..d9fedfbb1a2 100644
--- a/lib/libssl/src/ssl/s3_enc.c
+++ b/lib/libssl/src/ssl/s3_enc.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: s3_enc.c,v 1.51 2014/07/09 11:25:42 jsing Exp $ */
+/* $OpenBSD: s3_enc.c,v 1.52 2014/07/10 08:51:14 tedu Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -225,9 +225,6 @@ ssl3_change_cipher_state(SSL *s, int which)
 	const EVP_CIPHER *cipher;
 	const EVP_MD *mac;
 
-#ifndef OPENSSL_NO_COMP
-	const SSL_COMP *comp;
-#endif
 
 	cipher = s->s3->tmp.new_sym_enc;
 	mac = s->s3->tmp.new_hash;
@@ -250,41 +247,6 @@ ssl3_change_cipher_state(SSL *s, int which)
 	use_client_keys = ((which == SSL3_CHANGE_CIPHER_CLIENT_WRITE) ||
 	    (which == SSL3_CHANGE_CIPHER_SERVER_READ));
 
-#ifndef OPENSSL_NO_COMP
-	comp = s->s3->tmp.new_compression;
-	if (is_read) {
-		if (s->expand != NULL) {
-			COMP_CTX_free(s->expand);
-			s->expand = NULL;
-		}
-		if (comp != NULL) {
-			s->expand = COMP_CTX_new(comp->method);
-			if (s->expand == NULL) {
-				SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE,
-				    SSL_R_COMPRESSION_LIBRARY_ERROR);
-				goto err2;
-			}
-			if (s->s3->rrec.comp == NULL)
-				s->s3->rrec.comp =
-				    malloc(SSL3_RT_MAX_PLAIN_LENGTH);
-			if (s->s3->rrec.comp == NULL)
-				goto err;
-		}
-	} else {
-		if (s->compress != NULL) {
-			COMP_CTX_free(s->compress);
-			s->compress = NULL;
-		}
-		if (comp != NULL) {
-			s->compress = COMP_CTX_new(comp->method);
-			if (s->compress == NULL) {
-				SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE,
-				    SSL_R_COMPRESSION_LIBRARY_ERROR);
-				goto err2;
-			}
-		}
-	}
-#endif
 
 	if (is_read) {
 		EVP_CIPHER_CTX_free(s->enc_read_ctx);
@@ -365,17 +327,10 @@ ssl3_setup_key_block(SSL *s)
 	const EVP_CIPHER *cipher;
 	const EVP_MD *mac;
 	int ret = 0;
-	SSL_COMP *comp;
 
 	if (s->s3->tmp.key_block_length != 0)
 		return (1);
 
-	if (!ssl_cipher_get_comp(s->session, &comp)) {
-		SSLerr(SSL_F_SSL3_SETUP_KEY_BLOCK,
-		    SSL_R_CIPHER_COMPRESSION_UNAVAILABLE);
-		return (0);
-	}
-
 	if (!ssl_cipher_get_evp(s->session, &cipher, &mac, NULL, NULL)) {
 		SSLerr(SSL_F_SSL3_SETUP_KEY_BLOCK,
 		    SSL_R_CIPHER_OR_HASH_UNAVAILABLE);
@@ -384,7 +339,6 @@ ssl3_setup_key_block(SSL *s)
 
 	s->s3->tmp.new_sym_enc = cipher;
 	s->s3->tmp.new_hash = mac;
-	s->s3->tmp.new_compression = comp;
 
 	mac_len = EVP_MD_size(mac);
 	key_len = EVP_CIPHER_key_length(cipher);
diff --git a/lib/libssl/src/ssl/s3_lib.c b/lib/libssl/src/ssl/s3_lib.c
index 5c4e530d34e..400c1b87e0d 100644
--- a/lib/libssl/src/ssl/s3_lib.c
+++ b/lib/libssl/src/ssl/s3_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: s3_lib.c,v 1.67 2014/07/09 11:25:42 jsing Exp $ */
+/* $OpenBSD: s3_lib.c,v 1.68 2014/07/10 08:51:14 tedu Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -2420,7 +2420,6 @@ ssl3_free(SSL *s)
 	ssl3_release_read_buffer(s);
 	ssl3_release_write_buffer(s);
 
-	free(s->s3->rrec.comp);
 	DH_free(s->s3->tmp.dh);
 	EC_KEY_free(s->s3->tmp.ecdh);
 
@@ -2444,9 +2443,6 @@ ssl3_clear(SSL *s)
 	if (s->s3->tmp.ca_names != NULL)
 		sk_X509_NAME_pop_free(s->s3->tmp.ca_names, X509_NAME_free);
 
-	free(s->s3->rrec.comp);
-	s->s3->rrec.comp = NULL;
-
 	DH_free(s->s3->tmp.dh);
 	s->s3->tmp.dh = NULL;
 	EC_KEY_free(s->s3->tmp.ecdh);
diff --git a/lib/libssl/src/ssl/s3_pkt.c b/lib/libssl/src/ssl/s3_pkt.c
index a508d5ee495..237d90c5812 100644
--- a/lib/libssl/src/ssl/s3_pkt.c
+++ b/lib/libssl/src/ssl/s3_pkt.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: s3_pkt.c,v 1.48 2014/06/19 21:29:51 tedu Exp $ */
+/* $OpenBSD: s3_pkt.c,v 1.49 2014/07/10 08:51:14 tedu Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -469,21 +469,6 @@ again:
 		goto f_err;
 	}
 
-	/* r->length is now just compressed */
-	if (s->expand != NULL) {
-		if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH + extra) {
-			al = SSL_AD_RECORD_OVERFLOW;
-			SSLerr(SSL_F_SSL3_GET_RECORD,
-			    SSL_R_COMPRESSED_LENGTH_TOO_LONG);
-			goto f_err;
-		}
-		if (!ssl3_do_uncompress(s)) {
-			al = SSL_AD_DECOMPRESSION_FAILURE;
-			SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_BAD_DECOMPRESSION);
-			goto f_err;
-		}
-	}
-
 	if (rr->length > SSL3_RT_MAX_PLAIN_LENGTH + extra) {
 		al = SSL_AD_RECORD_OVERFLOW;
 		SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_DATA_LENGTH_TOO_LONG);
@@ -516,46 +501,6 @@ err:
 	return (ret);
 }
 
-int
-ssl3_do_uncompress(SSL *ssl)
-{
-#ifndef OPENSSL_NO_COMP
-	int i;
-	SSL3_RECORD *rr;
-
-	rr = &(ssl->s3->rrec);
-	i = COMP_expand_block(ssl->expand, rr->comp,
-	SSL3_RT_MAX_PLAIN_LENGTH, rr->data, (int)rr->length);
-	if (i < 0)
-		return (0);
-	else
-		rr->length = i;
-	rr->data = rr->comp;
-#endif
-	return (1);
-}
-
-int
-ssl3_do_compress(SSL *ssl)
-{
-#ifndef OPENSSL_NO_COMP
-	int i;
-	SSL3_RECORD *wr;
-
-	wr = &(ssl->s3->wrec);
-	i = COMP_compress_block(ssl->compress, wr->data,
-	    SSL3_RT_MAX_COMPRESSED_LENGTH,
-	    wr->input, (int)wr->length);
-	if (i < 0)
-		return (0);
-	else
-		wr->length = i;
-
-	wr->input = wr->data;
-#endif
-	return (1);
-}
-
 /* Call this to write data in records of type 'type'
  * It will return <= 0 if not all data has been sent or non-blocking IO.
  */
@@ -766,16 +711,8 @@ do_ssl3_write(SSL *s, int type, const unsigned char *buf,
 
 	/* we now 'read' from wr->input, wr->length bytes into wr->data */
 
-	/* first we compress */
-	if (s->compress != NULL) {
-		if (!ssl3_do_compress(s)) {
-			SSLerr(SSL_F_DO_SSL3_WRITE, SSL_R_COMPRESSION_FAILURE);
-			goto err;
-		}
-	} else {
-		memcpy(wr->data, wr->input, wr->length);
-		wr->input = wr->data;
-	}
+	memcpy(wr->data, wr->input, wr->length);
+	wr->input = wr->data;
 
 	/* we should still have the output to wr->data and the input
 	 * from wr->input.  Length should be wr->length.
diff --git a/lib/libssl/src/ssl/s3_srvr.c b/lib/libssl/src/ssl/s3_srvr.c
index a3e62ea3239..200b3b6bf2e 100644
--- a/lib/libssl/src/ssl/s3_srvr.c
+++ b/lib/libssl/src/ssl/s3_srvr.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: s3_srvr.c,v 1.69 2014/07/10 08:25:00 guenther Exp $ */
+/* $OpenBSD: s3_srvr.c,v 1.70 2014/07/10 08:51:14 tedu Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -884,9 +884,6 @@ ssl3_get_client_hello(SSL *s)
 	unsigned long id;
 	unsigned char *p, *d, *q;
 	SSL_CIPHER *c;
-#ifndef OPENSSL_NO_COMP
-	SSL_COMP *comp = NULL;
-#endif
 	STACK_OF(SSL_CIPHER) *ciphers = NULL;
 
 	/*
@@ -1173,96 +1170,11 @@ ssl3_get_client_hello(SSL *s)
 	}
 
 	/*
-	 * Worst case, we will use the NULL compression, but if we have other
-	 * options, we will now look for them.  We have i-1 compression
-	 * algorithms from the client, starting at q.
-	 */
-	s->s3->tmp.new_compression = NULL;
-#ifndef OPENSSL_NO_COMP
-	/* This only happens if we have a cache hit */
-	if (s->session->compress_meth != 0) {
-		int m, comp_id = s->session->compress_meth;
-		/* Perform sanity checks on resumed compression algorithm */
-		/* Can't disable compression */
-		if (s->options & SSL_OP_NO_COMPRESSION) {
-			al = SSL_AD_INTERNAL_ERROR;
-			SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,
-			    SSL_R_INCONSISTENT_COMPRESSION);
-			goto f_err;
-		}
-		/* Look for resumed compression method */
-		for (m = 0; m < sk_SSL_COMP_num(s->ctx->comp_methods); m++) {
-			comp = sk_SSL_COMP_value(s->ctx->comp_methods, m);
-			if (comp_id == comp->id) {
-				s->s3->tmp.new_compression = comp;
-				break;
-			}
-		}
-		if (s->s3->tmp.new_compression == NULL) {
-			al = SSL_AD_INTERNAL_ERROR;
-			SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,
-			    SSL_R_INVALID_COMPRESSION_ALGORITHM);
-			goto f_err;
-		}
-		/* Look for resumed method in compression list */
-		for (m = 0; m < i; m++) {
-			if (q[m] == comp_id)
-				break;
-		}
-		if (m >= i) {
-			al = SSL_AD_ILLEGAL_PARAMETER;
-			SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,
-			    SSL_R_REQUIRED_COMPRESSSION_ALGORITHM_MISSING);
-			goto f_err;
-		}
-	} else if (s->hit)
-		comp = NULL;
-	else if (!(s->options & SSL_OP_NO_COMPRESSION) && s->ctx->comp_methods)
-	{ /* See if we have a match */
-		int m, nn, o, v, done = 0;
-
-		nn = sk_SSL_COMP_num(s->ctx->comp_methods);
-		for (m = 0; m < nn; m++) {
-			comp = sk_SSL_COMP_value(s->ctx->comp_methods, m);
-			v = comp->id;
-			for (o = 0; o < i; o++) {
-				if (v == q[o]) {
-					done = 1;
-					break;
-				}
-			}
-			if (done)
-				break;
-		}
-		if (done)
-			s->s3->tmp.new_compression = comp;
-		else
-			comp = NULL;
-	}
-#else
-	/*
-	 * If compression is disabled we'd better not try to resume a session
-	 * using compression.
-	 */
-	if (s->session->compress_meth != 0) {
-		al = SSL_AD_INTERNAL_ERROR;
-		SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,
-		    SSL_R_INCONSISTENT_COMPRESSION);
-		goto f_err;
-	}
-#endif
-
-	/*
 	 * Given s->session->ciphers and SSL_get_ciphers, we must
 	 * pick a cipher
 	 */
 
 	if (!s->hit) {
-#ifdef OPENSSL_NO_COMP
-		s->session->compress_meth = 0;
-#else
-		s->session->compress_meth = (comp == NULL) ? 0 : comp->id;
-#endif
 		if (s->session->ciphers != NULL)
 			sk_SSL_CIPHER_free(s->session->ciphers);
 		s->session->ciphers = ciphers;
@@ -1405,14 +1317,7 @@ ssl3_send_server_hello(SSL *s)
 		p += i;
 
 		/* put the compression method */
-#ifdef OPENSSL_NO_COMP
 		*(p++) = 0;
-#else
-		if (s->s3->tmp.new_compression == NULL)
-			*(p++) = 0;
-		else
-			*(p++) = s->s3->tmp.new_compression->id;
-#endif
 		if (ssl_prepare_serverhello_tlsext(s) <= 0) {
 			SSLerr(SSL_F_SSL3_SEND_SERVER_HELLO,
 			    SSL_R_SERVERHELLO_TLSEXT);
diff --git a/lib/libssl/src/ssl/ssl.h b/lib/libssl/src/ssl/ssl.h
index b1eeb85c649..18218f4c611 100644
--- a/lib/libssl/src/ssl/ssl.h
+++ b/lib/libssl/src/ssl/ssl.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl.h,v 1.57 2014/07/09 11:25:42 jsing Exp $ */
+/* $OpenBSD: ssl.h,v 1.58 2014/07/10 08:51:15 tedu Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -145,9 +145,6 @@
 
 #include <openssl/opensslconf.h>
 
-#ifndef OPENSSL_NO_COMP
-#include <openssl/comp.h>
-#endif
 #ifndef OPENSSL_NO_BIO
 #include <openssl/bio.h>
 #endif
@@ -488,8 +485,6 @@ struct ssl_session_st {
 	time_t time;
 	int references;
 
-	unsigned int compress_meth;	/* Need to lookup the method */
-
 	const SSL_CIPHER *cipher;
 	unsigned long cipher_id;	/* when ASN.1 loaded, this
 					 * needs to be used to load
@@ -682,11 +677,6 @@ typedef struct ssl_comp_st SSL_COMP;
 struct ssl_comp_st {
 	int id;
 	const char *name;
-#ifndef OPENSSL_NO_COMP
-	COMP_METHOD *method;
-#else
-	char *method;
-#endif
 };
 
 DECLARE_STACK_OF(SSL_COMP)
@@ -1099,11 +1089,6 @@ struct ssl_st {
 
 	EVP_CIPHER_CTX *enc_read_ctx;		/* cryptographic state */
 	EVP_MD_CTX *read_hash;			/* used for mac generation */
-#ifndef OPENSSL_NO_COMP
-	COMP_CTX *expand;			/* uncompress */
-#else
-	char *expand;
-#endif
 
 	SSL_AEAD_CTX *aead_write_ctx;	/* AEAD context. If non-NULL, then
 					   enc_write_ctx and write_hash are
@@ -1111,12 +1096,6 @@ struct ssl_st {
 
 	EVP_CIPHER_CTX *enc_write_ctx;		/* cryptographic state */
 	EVP_MD_CTX *write_hash;			/* used for mac generation */
-#ifndef OPENSSL_NO_COMP
-	COMP_CTX *compress;			/* compression */
-#else
-	char *compress;
-
-#endif
 
 	/* session info */
 
@@ -1836,20 +1815,6 @@ void SSL_CTX_set_tmp_ecdh_callback(SSL_CTX *ctx,
 void SSL_set_tmp_ecdh_callback(SSL *ssl,
     EC_KEY *(*ecdh)(SSL *ssl, int is_export, int keylength));
 
-#ifndef OPENSSL_NO_COMP
-const COMP_METHOD *SSL_get_current_compression(SSL *s);
-const COMP_METHOD *SSL_get_current_expansion(SSL *s);
-const char *SSL_COMP_get_name(const COMP_METHOD *comp);
-STACK_OF(SSL_COMP) *SSL_COMP_get_compression_methods(void);
-int SSL_COMP_add_compression_method(int id, COMP_METHOD *cm);
-#else
-const void *SSL_get_current_compression(SSL *s);
-const void *SSL_get_current_expansion(SSL *s);
-const char *SSL_COMP_get_name(const void *comp);
-void *SSL_COMP_get_compression_methods(void);
-int SSL_COMP_add_compression_method(int id, void *cm);
-#endif
-
 /* TLS extensions functions */
 int SSL_set_session_ticket_ext(SSL *s, void *ext_data, int ext_len);
 
diff --git a/lib/libssl/src/ssl/ssl3.h b/lib/libssl/src/ssl/ssl3.h
index 235c359af28..f956c50987c 100644
--- a/lib/libssl/src/ssl/ssl3.h
+++ b/lib/libssl/src/ssl/ssl3.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl3.h,v 1.23 2014/06/13 11:52:03 jsing Exp $ */
+/* $OpenBSD: ssl3.h,v 1.24 2014/07/10 08:51:15 tedu Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -117,9 +117,6 @@
 #ifndef HEADER_SSL3_H 
 #define HEADER_SSL3_H 
 
-#ifndef OPENSSL_NO_COMP
-#include <openssl/comp.h>
-#endif
 #include <openssl/buffer.h>
 #include <openssl/evp.h>
 #include <openssl/ssl.h>
@@ -285,12 +282,7 @@ extern "C" {
 
 /* If compression isn't used don't include the compression overhead */
 
-#ifdef OPENSSL_NO_COMP
 #define SSL3_RT_MAX_COMPRESSED_LENGTH		SSL3_RT_MAX_PLAIN_LENGTH
-#else
-#define SSL3_RT_MAX_COMPRESSED_LENGTH	\
-		(SSL3_RT_MAX_PLAIN_LENGTH+SSL3_RT_MAX_COMPRESSED_OVERHEAD)
-#endif
 #define SSL3_RT_MAX_ENCRYPTED_LENGTH	\
 		(SSL3_RT_MAX_ENCRYPTED_OVERHEAD+SSL3_RT_MAX_COMPRESSED_LENGTH)
 #define SSL3_RT_MAX_PACKET_SIZE		\
@@ -336,7 +328,6 @@ typedef struct ssl3_record_st {
 /*r */	unsigned int off;       /* read/write offset into 'buf' */
 /*rw*/	unsigned char *data;    /* pointer to the record data */
 /*rw*/	unsigned char *input;   /* where the decode bytes are */
-/*r */	unsigned char *comp;    /* only used with decompression - malloc()ed */
 /*r */  unsigned long epoch;    /* epoch number, needed by DTLS1 */
 /*r */  unsigned char seq_num[8]; /* sequence number, needed by DTLS1 */
 } SSL3_RECORD;
@@ -492,11 +483,6 @@ typedef struct ssl3_state_st {
 		const EVP_MD *new_hash;
 		int new_mac_pkey_type;
 		int new_mac_secret_size;
-#ifndef OPENSSL_NO_COMP
-		const SSL_COMP *new_compression;
-#else
-		char *new_compression;
-#endif
 		int cert_request;
 	} tmp;
 
diff --git a/lib/libssl/src/ssl/ssl_algs.c b/lib/libssl/src/ssl/ssl_algs.c
index 0518876ab4f..ce051252f6c 100644
--- a/lib/libssl/src/ssl/ssl_algs.c
+++ b/lib/libssl/src/ssl/ssl_algs.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_algs.c,v 1.18 2014/06/12 15:49:31 deraadt Exp $ */
+/* $OpenBSD: ssl_algs.c,v 1.19 2014/07/10 08:51:15 tedu Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -112,12 +112,6 @@ SSL_library_init(void)
 	EVP_add_digest_alias(SN_dsaWithSHA1, "DSS1");
 	EVP_add_digest_alias(SN_dsaWithSHA1, "dss1");
 	EVP_add_digest(EVP_ecdsa());
-#ifndef OPENSSL_NO_COMP
-	/* This will initialise the built-in compression algorithms.
-	   The value returned is a STACK_OF(SSL_COMP), but that can
-	   be discarded safely */
-	(void)SSL_COMP_get_compression_methods();
-#endif
 	/* initialize cipher/digest methods table */
 	ssl_load_ciphers();
 	return (1);
diff --git a/lib/libssl/src/ssl/ssl_asn1.c b/lib/libssl/src/ssl/ssl_asn1.c
index 85944088989..43366b33b8d 100644
--- a/lib/libssl/src/ssl/ssl_asn1.c
+++ b/lib/libssl/src/ssl/ssl_asn1.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_asn1.c,v 1.26 2014/06/12 15:49:31 deraadt Exp $ */
+/* $OpenBSD: ssl_asn1.c,v 1.27 2014/07/10 08:51:15 tedu Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -118,10 +118,6 @@ i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp)
 	unsigned char ibuf3[LSIZE2], ibuf4[LSIZE2], ibuf5[LSIZE2];
 	int v6 = 0, v9 = 0, v10 = 0;
 	unsigned char ibuf6[LSIZE2];
-#ifndef OPENSSL_NO_COMP
-	unsigned char cbuf;
-	int v11 = 0;
-#endif
 	long l;
 	SSL_SESSION_ASN1 a;
 	M_ASN1_I2D_vars(in);
@@ -155,14 +151,6 @@ i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp)
 	buf[0] = ((unsigned char)(l >> 8L))&0xff;
 	buf[1] = ((unsigned char)(l    ))&0xff;
 
-#ifndef OPENSSL_NO_COMP
-	if (in->compress_meth) {
-		cbuf = (unsigned char)in->compress_meth;
-		a.comp_id.length = 1;
-		a.comp_id.type = V_ASN1_OCTET_STRING;
-		a.comp_id.data = &cbuf;
-	}
-#endif
 
 	a.master_key.length = in->master_key_length;
 	a.master_key.type = V_ASN1_OCTET_STRING;
@@ -248,10 +236,6 @@ i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp)
 		M_ASN1_I2D_len_EXP_opt(&(a.tlsext_tick), i2d_ASN1_OCTET_STRING, 10, v10);
 	if (in->tlsext_hostname)
 		M_ASN1_I2D_len_EXP_opt(&(a.tlsext_hostname), i2d_ASN1_OCTET_STRING, 6, v6);
-#ifndef OPENSSL_NO_COMP
-	if (in->compress_meth)
-		M_ASN1_I2D_len_EXP_opt(&(a.comp_id), i2d_ASN1_OCTET_STRING, 11, v11);
-#endif
 #ifndef OPENSSL_NO_PSK
 	if (in->psk_identity_hint)
 		M_ASN1_I2D_len_EXP_opt(&(a.psk_identity_hint), i2d_ASN1_OCTET_STRING, 7, v7);
@@ -288,10 +272,6 @@ i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp)
 		M_ASN1_I2D_put_EXP_opt(&a.tlsext_tick_lifetime, i2d_ASN1_INTEGER, 9, v9);
 	if (in->tlsext_tick)
 		M_ASN1_I2D_put_EXP_opt(&(a.tlsext_tick), i2d_ASN1_OCTET_STRING, 10, v10);
-#ifndef OPENSSL_NO_COMP
-	if (in->compress_meth)
-		M_ASN1_I2D_put_EXP_opt(&(a.comp_id), i2d_ASN1_OCTET_STRING, 11, v11);
-#endif
 	M_ASN1_I2D_finish();
 }
 
@@ -480,16 +460,6 @@ d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp, long length)
 		os.length = 0;
 	} else
 		ret->tlsext_tick = NULL;
-#ifndef OPENSSL_NO_COMP
-	os.length = 0;
-	os.data = NULL;
-	M_ASN1_D2I_get_EXP_opt(osp, d2i_ASN1_OCTET_STRING, 11);
-	if (os.data) {
-		ret->compress_meth = os.data[0];
-		free(os.data);
-		os.data = NULL;
-	}
-#endif
 
 
 	M_ASN1_D2I_Finish(a, SSL_SESSION_free, SSL_F_D2I_SSL_SESSION);
diff --git a/lib/libssl/src/ssl/ssl_ciph.c b/lib/libssl/src/ssl/ssl_ciph.c
index d84e45764ed..0ba66cc89fb 100644
--- a/lib/libssl/src/ssl/ssl_ciph.c
+++ b/lib/libssl/src/ssl/ssl_ciph.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_ciph.c,v 1.58 2014/07/09 14:20:55 jsing Exp $ */
+/* $OpenBSD: ssl_ciph.c,v 1.59 2014/07/10 08:51:15 tedu Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -142,9 +142,6 @@
 
 #include <stdio.h>
 #include <openssl/objects.h>
-#ifndef OPENSSL_NO_COMP
-#include <openssl/comp.h>
-#endif
 #ifndef OPENSSL_NO_ENGINE
 #include <openssl/engine.h>
 #endif
@@ -175,8 +172,6 @@ static const EVP_CIPHER *ssl_cipher_methods[SSL_ENC_NUM_IDX] = {
 #define SSL_COMP_ZLIB_IDX	1
 #define SSL_COMP_NUM_IDX	2
 
-static STACK_OF(SSL_COMP) *ssl_comp_methods = NULL;
-
 #define SSL_MD_MD5_IDX	0
 #define SSL_MD_SHA1_IDX	1
 #define SSL_MD_GOST94_IDX 2
@@ -645,81 +640,14 @@ ssl_load_ciphers(void)
 	ssl_mac_secret_size[SSL_MD_SHA384_IDX]=
 	EVP_MD_size(ssl_digest_methods[SSL_MD_SHA384_IDX]);
 }
-#ifndef OPENSSL_NO_COMP
-
-static int
-sk_comp_cmp(const SSL_COMP * const *a,
-    const SSL_COMP * const *b)
-{
-	return ((*a)->id - (*b)->id);
-}
-
-static void
-load_builtin_compressions(void)
-{
-	int got_write_lock = 0;
-
-	CRYPTO_r_lock(CRYPTO_LOCK_SSL);
-	if (ssl_comp_methods == NULL) {
-		CRYPTO_r_unlock(CRYPTO_LOCK_SSL);
-		CRYPTO_w_lock(CRYPTO_LOCK_SSL);
-		got_write_lock = 1;
-
-		if (ssl_comp_methods == NULL) {
-			SSL_COMP *comp = NULL;
-
-			ssl_comp_methods = sk_SSL_COMP_new(sk_comp_cmp);
-			if (ssl_comp_methods != NULL) {
-				comp = malloc(sizeof(SSL_COMP));
-				if (comp != NULL) {
-					comp->method = COMP_zlib();
-					if (comp->method &&
-					    comp->method->type == NID_undef)
-						free(comp);
-					else {
-						comp->id = SSL_COMP_ZLIB_IDX;
-						comp->name = comp->method->name;
-						sk_SSL_COMP_push(ssl_comp_methods, comp);
-					}
-				}
-				sk_SSL_COMP_sort(ssl_comp_methods);
-			}
-		}
-	}
-
-	if (got_write_lock)
-		CRYPTO_w_unlock(CRYPTO_LOCK_SSL);
-	else
-		CRYPTO_r_unlock(CRYPTO_LOCK_SSL);
-}
-#endif
 
 /* ssl_cipher_get_comp sets comp to the correct SSL_COMP for the given
  * session and returns 1. On error it returns 0. */
 int
 ssl_cipher_get_comp(const SSL_SESSION *s, SSL_COMP **comp)
 {
-	SSL_COMP ctmp;
-	int i;
-
-#ifndef OPENSSL_NO_COMP
-	load_builtin_compressions();
-#endif
-
 	*comp = NULL;
-	if (s->compress_meth == 0)
-		return 1;
-	if (ssl_comp_methods == NULL)
-		return 0;
-
-	ctmp.id = s->compress_meth;
-	i = sk_SSL_COMP_find(ssl_comp_methods, &ctmp);
-	if (i >= 0) {
-		*comp = sk_SSL_COMP_value(ssl_comp_methods, i);
-		return 1;
-	}
-
-	return 0;
+	return 1;
 }
 
 int
@@ -1919,102 +1847,3 @@ SSL_CIPHER_get_id(const SSL_CIPHER *c)
 {
 	return c->id;
 }
-
-SSL_COMP *
-ssl3_comp_find(STACK_OF(SSL_COMP) *sk, int n)
-{
-	SSL_COMP *ctmp;
-	int i, nn;
-
-	if ((n == 0) || (sk == NULL))
-		return (NULL);
-	nn = sk_SSL_COMP_num(sk);
-	for (i = 0; i < nn; i++) {
-		ctmp = sk_SSL_COMP_value(sk, i);
-		if (ctmp->id == n)
-			return (ctmp);
-	}
-	return (NULL);
-}
-
-#ifdef OPENSSL_NO_COMP
-void *
-SSL_COMP_get_compression_methods(void)
-{
-	return NULL;
-}
-
-int
-SSL_COMP_add_compression_method(int id, void *cm)
-{
-	return 1;
-}
-
-const char *
-SSL_COMP_get_name(const void *comp)
-{
-	return NULL;
-}
-#else
-STACK_OF(SSL_COMP) *
-SSL_COMP_get_compression_methods(void)
-{
-	load_builtin_compressions();
-	return (ssl_comp_methods);
-}
-
-int
-SSL_COMP_add_compression_method(int id, COMP_METHOD *cm)
-{
-	SSL_COMP *comp;
-
-	if (cm == NULL || cm->type == NID_undef)
-		return 1;
-
-	/* According to draft-ietf-tls-compression-04.txt, the
-	   compression number ranges should be the following:
-
-	   0 to 63:    methods defined by the IETF
-	   64 to 192:  external party methods assigned by IANA
-	   193 to 255: reserved for private use */
-	if (id < 193 || id > 255) {
-		SSLerr(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD,
-		    SSL_R_COMPRESSION_ID_NOT_WITHIN_PRIVATE_RANGE);
-		return 1;
-	}
-
-	comp = malloc(sizeof(SSL_COMP));
-	if (comp == NULL) {
-		SSLerr(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD,
-		    ERR_R_MALLOC_FAILURE);
-		return (1);
-	}
-	comp->id = id;
-	comp->method = cm;
-	load_builtin_compressions();
-	if (ssl_comp_methods &&
-	    sk_SSL_COMP_find(ssl_comp_methods, comp) >= 0) {
-		free(comp);
-		SSLerr(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD,
-		    SSL_R_DUPLICATE_COMPRESSION_ID);
-		return (1);
-	} else if ((ssl_comp_methods == NULL) ||
-	    !sk_SSL_COMP_push(ssl_comp_methods, comp)) {
-		free(comp);
-		SSLerr(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD,
-		    ERR_R_MALLOC_FAILURE);
-		return (1);
-	} else {
-		return (0);
-	}
-}
-
-const char *
-SSL_COMP_get_name(const COMP_METHOD *comp)
-{
-	if (comp)
-		return comp->name;
-	return NULL;
-}
-
-#endif
diff --git a/lib/libssl/src/ssl/ssl_lib.c b/lib/libssl/src/ssl/ssl_lib.c
index a5f2f3f7515..765012e861e 100644
--- a/lib/libssl/src/ssl/ssl_lib.c
+++ b/lib/libssl/src/ssl/ssl_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_lib.c,v 1.71 2014/07/10 08:18:55 bcook Exp $ */
+/* $OpenBSD: ssl_lib.c,v 1.72 2014/07/10 08:51:15 tedu Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -1793,9 +1793,6 @@ SSL_CTX_new(const SSL_METHOD *meth)
 	CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL_CTX, ret, &ret->ex_data);
 
 	ret->extra_certs = NULL;
-	/* No compression for DTLS */
-	if (meth->version != DTLS1_VERSION)
-		ret->comp_methods = SSL_COMP_get_compression_methods();
 
 	ret->max_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH;
 
@@ -2610,12 +2607,6 @@ ssl_clear_cipher_ctx(SSL *s)
 		s->aead_write_ctx = NULL;
 	}
 
-#ifndef OPENSSL_NO_COMP
-	COMP_CTX_free(s->expand);
-	s->expand = NULL;
-	COMP_CTX_free(s->compress);
-	s->compress = NULL;
-#endif
 }
 
 /* Fix this function so that it takes an optional type parameter */
@@ -2645,7 +2636,6 @@ SSL_get_current_cipher(const SSL *s)
 		return (s->session->cipher);
 	return (NULL);
 }
-#ifdef OPENSSL_NO_COMP
 const void *
 SSL_get_current_compression(SSL *s)
 {
@@ -2657,24 +2647,6 @@ SSL_get_current_expansion(SSL *s)
 {
 	return (NULL);
 }
-#else
-
-const COMP_METHOD *
-SSL_get_current_compression(SSL *s)
-{
-	if (s->compress != NULL)
-		return (s->compress->meth);
-	return (NULL);
-}
-
-const COMP_METHOD *
-SSL_get_current_expansion(SSL *s)
-{
-	if (s->expand != NULL)
-		return (s->expand->meth);
-	return (NULL);
-}
-#endif
 
 int
 ssl_init_wbio_buffer(SSL *s, int push)
diff --git a/lib/libssl/src/ssl/ssl_locl.h b/lib/libssl/src/ssl/ssl_locl.h
index 2b3d1b8e444..b3bc4f4ae4a 100644
--- a/lib/libssl/src/ssl/ssl_locl.h
+++ b/lib/libssl/src/ssl/ssl_locl.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_locl.h,v 1.56 2014/07/09 11:25:42 jsing Exp $ */
+/* $OpenBSD: ssl_locl.h,v 1.57 2014/07/10 08:51:15 tedu Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -153,9 +153,6 @@
 
 #include <openssl/opensslconf.h>
 #include <openssl/buffer.h>
-#ifndef OPENSSL_NO_COMP
-#include <openssl/comp.h>
-#endif
 #include <openssl/bio.h>
 #include <openssl/stack.h>
 #include <openssl/rsa.h>
@@ -547,15 +544,6 @@ struct ssl_aead_ctx_st {
 	char variable_nonce_in_record;
 };
 
-#ifndef OPENSSL_NO_COMP
-/* Used for holding the relevant compression methods loaded into SSL_CTX */
-typedef struct ssl3_comp_st {
-	int comp_id;	/* The identifier byte for this compression type */
-	char *name;	/* Text name used for the compression type */
-	COMP_METHOD *method; /* The method :-) */
-} SSL3_COMP;
-#endif
-
 extern SSL3_ENC_METHOD ssl3_undef_enc_method;
 extern SSL_CIPHER ssl3_ciphers[];
 
@@ -685,8 +673,6 @@ long tls1_default_timeout(void);
 int dtls1_do_write(SSL *s, int type);
 int ssl3_read_n(SSL *s, int n, int max, int extend);
 int dtls1_read_bytes(SSL *s, int type, unsigned char *buf, int len, int peek);
-int ssl3_do_compress(SSL *ssl);
-int ssl3_do_uncompress(SSL *ssl);
 int ssl3_write_pending(SSL *s, int type, const unsigned char *buf,
     unsigned int len);
 unsigned char *dtls1_set_message_header(SSL *s, unsigned char *p,
diff --git a/lib/libssl/src/ssl/ssl_sess.c b/lib/libssl/src/ssl/ssl_sess.c
index 7932f201512..b3dd3e61173 100644
--- a/lib/libssl/src/ssl/ssl_sess.c
+++ b/lib/libssl/src/ssl/ssl_sess.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_sess.c,v 1.34 2014/06/21 20:27:25 tedu Exp $ */
+/* $OpenBSD: ssl_sess.c,v 1.35 2014/07/10 08:51:15 tedu Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -207,7 +207,6 @@ SSL_SESSION_new(void)
 	ss->time = time(NULL);
 	ss->prev = NULL;
 	ss->next = NULL;
-	ss->compress_meth = 0;
 	ss->tlsext_hostname = NULL;
 
 	ss->tlsext_ecpointformatlist_length = 0;
@@ -233,7 +232,7 @@ SSL_SESSION_get_id(const SSL_SESSION *s, unsigned int *len)
 unsigned int
 SSL_SESSION_get_compress_id(const SSL_SESSION *s)
 {
-	return s->compress_meth;
+	return 0;
 }
 
 /* Even with SSLv2, we have 16 bytes (128 bits) of session ID space. SSLv3/TLSv1
diff --git a/lib/libssl/src/ssl/ssl_txt.c b/lib/libssl/src/ssl/ssl_txt.c
index c06e2d23b7f..25f22902904 100644
--- a/lib/libssl/src/ssl/ssl_txt.c
+++ b/lib/libssl/src/ssl/ssl_txt.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_txt.c,v 1.21 2014/06/12 15:49:31 deraadt Exp $ */
+/* $OpenBSD: ssl_txt.c,v 1.22 2014/07/10 08:51:15 tedu Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -182,22 +182,6 @@ SSL_SESSION_print(BIO *bp, const SSL_SESSION *x)
 			goto err;
 	}
 
-#ifndef OPENSSL_NO_COMP
-	if (x->compress_meth != 0) {
-		SSL_COMP *comp = NULL;
-
-		if (!ssl_cipher_get_comp(x, &comp))
-			goto err;
-
-		if (comp == NULL) {
-			if (BIO_printf(bp, "\n    Compression: %d", x->compress_meth) <= 0)
-				goto err;
-		} else {
-			if (BIO_printf(bp, "\n    Compression: %d (%s)", comp->id, comp->method->name) <= 0)
-				goto err;
-		}
-	}
-#endif
 	if (x->time != 0) {
 		if (BIO_printf(bp, "\n    Start Time: %lld", (long long)x->time) <= 0)
 			goto err;
diff --git a/lib/libssl/src/ssl/t1_enc.c b/lib/libssl/src/ssl/t1_enc.c
index 26d98522d0a..cccf17eab5f 100644
--- a/lib/libssl/src/ssl/t1_enc.c
+++ b/lib/libssl/src/ssl/t1_enc.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: t1_enc.c,v 1.65 2014/07/09 11:25:42 jsing Exp $ */
+/* $OpenBSD: t1_enc.c,v 1.66 2014/07/10 08:51:15 tedu Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -137,9 +137,6 @@
 
 #include <stdio.h>
 #include "ssl_locl.h"
-#ifndef OPENSSL_NO_COMP
-#include <openssl/comp.h>
-#endif
 #include <openssl/evp.h>
 #include <openssl/hmac.h>
 #include <openssl/md5.h>
@@ -470,9 +467,6 @@ tls1_change_cipher_state(SSL *s, int which)
 	const EVP_AEAD *aead;
 	char is_read, use_client_keys;
 
-#ifndef OPENSSL_NO_COMP
-	const SSL_COMP *comp;
-#endif
 
 	cipher = s->s3->tmp.new_sym_enc;
 	aead = s->s3->tmp.new_aead;
@@ -492,41 +486,6 @@ tls1_change_cipher_state(SSL *s, int which)
 	use_client_keys = ((which == SSL3_CHANGE_CIPHER_CLIENT_WRITE) ||
 	    (which == SSL3_CHANGE_CIPHER_SERVER_READ));
 
-#ifndef OPENSSL_NO_COMP
-	comp = s->s3->tmp.new_compression;
-	if (is_read) {
-		if (s->expand != NULL) {
-			COMP_CTX_free(s->expand);
-			s->expand = NULL;
-		}
-		if (comp != NULL) {
-			s->expand = COMP_CTX_new(comp->method);
-			if (s->expand == NULL) {
-				SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE,
-				    SSL_R_COMPRESSION_LIBRARY_ERROR);
-				goto err2;
-			}
-			if (s->s3->rrec.comp == NULL)
-				s->s3->rrec.comp =
-				    malloc(SSL3_RT_MAX_ENCRYPTED_LENGTH);
-			if (s->s3->rrec.comp == NULL)
-				goto err;
-		}
-	} else {
-		if (s->compress != NULL) {
-			COMP_CTX_free(s->compress);
-			s->compress = NULL;
-		}
-		if (comp != NULL) {
-			s->compress = COMP_CTX_new(comp->method);
-			if (s->compress == NULL) {
-				SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE,
-				    SSL_R_COMPRESSION_LIBRARY_ERROR);
-				goto err2;
-			}
-		}
-	}
-#endif
 
 	/*
 	 * Reset sequence number to zero - for DTLS this is handled in
@@ -596,8 +555,6 @@ tls1_change_cipher_state(SSL *s, int which)
 	return tls1_change_cipher_state_cipher(s, is_read, use_client_keys,
 	    mac_secret, mac_secret_size, key, key_len, iv, iv_len);
 
-err:
-	SSLerr(SSL_F_TLS1_CHANGE_CIPHER_STATE, ERR_R_MALLOC_FAILURE);
 err2:
 	return (0);
 }