| blob | 295e19b30c9d53e21ec38b2ff6c24be0e9072b22 |
1 #
2 # This was developed in house. Not applicable to the upstream.
3 #
4 --- openssl-1.0.1/ssl/ssl.h Tue May 26 11:13:15 2015
5 +++ openssl-1.0.1/ssl/ssl.h.new Tue May 26 11:32:09 2015
6 @@ -2345,10 +2345,23 @@
7 /* This sets the 'default' SSL version that SSL_new() will create */
8 int SSL_CTX_set_ssl_version(SSL_CTX *ctx, const SSL_METHOD *meth);
10 +#ifndef __has_attribute
11 +# define __has_attribute(x) 0
12 +#endif
13 +
14 +/* Mark SSLv2_* functions deprecated */
15 +#if __has_attribute(deprecated) \
16 + || (defined(__GNUC__) && ((__GNUC__ * 100 + __GNUC_MINOR__) >= 301)) \
17 + || (defined(__SUNPRO_C) && (__SUNPRO_C >= 0x5130))
18 +# define DEPRECATED __attribute__((deprecated))
19 +#else
20 +# define DEPRECATED
21 +#endif
22 +
23 # ifndef OPENSSL_NO_SSL2_METHOD
24 -const SSL_METHOD *SSLv2_method(void); /* SSLv2 */
25 -const SSL_METHOD *SSLv2_server_method(void); /* SSLv2 */
26 -const SSL_METHOD *SSLv2_client_method(void); /* SSLv2 */
27 +DEPRECATED const SSL_METHOD *SSLv2_method(void); /* SSLv2 */
28 +DEPRECATED const SSL_METHOD *SSLv2_server_method(void); /* SSLv2 */
29 +DEPRECATED const SSL_METHOD *SSLv2_client_method(void); /* SSLv2 */
30 # endif
32 # ifndef OPENSSL_NO_SSL3_METHOD
33 --- openssl/ssl/s3_meth.c.orig Fri Sep 11 12:19:54 2015
34 +++ openssl/ssl/s3_meth.c Fri Sep 11 12:22:24 2015
35 @@ -71,4 +71,13 @@
37 IMPLEMENT_ssl3_meth_func(SSLv3_method,
38 ssl3_accept, ssl3_connect, ssl3_get_method)
39 +#else /* !OPENSSL_NO_SSL3_METHOD */
40 +
41 +/* stub function */
42 +const SSL_METHOD *
43 +SSLv3_method(void)
44 +{
45 + return (NULL);
46 +}
47 +
48 #endif
49 --- openssl/ssl/s3_clnt.c.orig Fri Sep 11 12:21:09 2015
50 +++ openssl/ssl/s3_clnt.c Fri Sep 11 12:24:31 2015
51 @@ -184,6 +184,15 @@
52 IMPLEMENT_ssl3_meth_func(SSLv3_client_method,
53 ssl_undefined_function,
54 ssl3_connect, ssl3_get_client_method)
55 +#else /* !OPENSSL_NO_SSL3_METHOD */
56 +
57 +/* stub function */
58 +const SSL_METHOD *
59 +SSLv3_client_method(void)
60 +{
61 + return (NULL);
62 +}
63 +
64 #endif
65 int ssl3_connect(SSL *s)
66 {
67 --- openssl/ssl/s3_srvr.c.orig Fri Sep 11 12:21:18 2015
68 +++ openssl/ssl/s3_srvr.c Fri Sep 11 12:24:15 2015
69 @@ -184,6 +184,15 @@
70 IMPLEMENT_ssl3_meth_func(SSLv3_server_method,
71 ssl3_accept,
72 ssl_undefined_function, ssl3_get_server_method)
73 +#else /* !OPENSSL_NO_SSL3_METHOD */
74 +
75 +/* stub function */
76 +const SSL_METHOD *
77 +SSLv3_server_method(void)
78 +{
79 + return (NULL);
80 +}
81 +
82 #endif
83 #ifndef OPENSSL_NO_SRP
84 static int ssl_check_srp_ext_ClientHello(SSL *s, int *al)
85 --- openssl-1.0.1/doc/ssl/SSL_CIPHER_get_name.pod Tue May 26 11:13:15 2015
86 +++ openssl-1.0.1/doc/ssl/SSL_CIPHER_get_name.pod.new Tue May 26 11:32:09 2015
87 @@ -25,7 +25,7 @@
89 SSL_CIPHER_get_version() returns string which indicates the SSL/TLS protocol
90 version that first defined the cipher.
91 -This is currently B<SSLv2> or B<TLSv1/SSLv3>.
92 +This is currently B<TLSv1/SSLv3>.
93 In some cases it should possibly return "TLSv1.2" but does not;
94 use SSL_CIPHER_description() instead.
95 If B<cipher> is NULL, "(NONE)" is returned.
96 @@ -56,7 +56,7 @@
98 =item <protocol version>
100 -Protocol version: B<SSLv2>, B<SSLv3>, B<TLSv1.2>. The TLSv1.0 ciphers are
101 +Protocol version: B<SSLv3>, B<TLSv1.2>. The TLSv1.0 ciphers are
102 flagged with SSLv3. No new ciphers were added by TLSv1.1.
104 =item Kx=<key exchange>
105 --- openssl-1.x/doc/ssl/SSL_CTX_new.pod Tue Jan 20 04:33:36 2015
106 +++ openssl-1.x/doc/ssl/SSL_CTX_new.pod.new Tue May 26 11:37:24 2015
107 @@ -8,7 +8,6 @@
108 TLSv1_1_method, TLSv1_1_server_method, TLSv1_1_client_method,
109 TLSv1_method, TLSv1_server_method, TLSv1_client_method,
110 SSLv3_method, SSLv3_server_method, SSLv3_client_method,
111 -SSLv2_method, SSLv2_server_method, SSLv2_client_method,
112 DTLS_method, DTLS_server_method, DTLS_client_method,
113 DTLSv1_2_method, DTLSv1_2_server_method, DTLSv1_2_client_method,
114 DTLSv1_method, DTLSv1_server_method, DTLSv1_client_method -
115 @@ -70,7 +69,7 @@
116 These are the general-purpose I<version-flexible> SSL/TLS methods.
117 The actual protocol version used will be negotiated to the highest version
118 mutually supported by the client and the server.
119 -The supported protocols are SSLv2, SSLv3, TLSv1, TLSv1.1 and TLSv1.2.
120 +The supported protocols are TLSv1, TLSv1.1 and TLSv1.2.
121 Most applications should use these method, and avoid the version specific
122 methods described below.
124 @@ -116,20 +115,11 @@
125 =item SSLv3_method(), SSLv3_server_method(), SSLv3_client_method()
127 A TLS/SSL connection established with these methods will only understand the
128 -SSLv3 protocol. A client will send out SSLv3 client hello messages and will
129 -indicate that it only understands SSLv3. A server will only understand SSLv3
130 -client hello messages. The SSLv3 protocol is deprecated and should not be
131 -used.
132 +SSLv3 protocol. However, SSLv3 is not supported by this relese of OpenSSL.
134 =item SSLv2_method(), SSLv2_server_method(), SSLv2_client_method()
136 -A TLS/SSL connection established with these methods will only understand the
137 -SSLv2 protocol. A client will send out SSLv2 client hello messages and will
138 -also indicate that it only understand SSLv2. A server will only understand
139 -SSLv2 client hello messages. The SSLv2 protocol offers little to no security
140 -and should not be used.
141 -As of OpenSSL 1.0.2g, EXPORT ciphers and 56-bit DES are no longer available
142 -with SSLv2.
143 +These functions are deprecated.
145 =item DTLS_method(), DTLS_server_method(), DTLS_client_method()
147 --- openssl-1.0.1/doc/ssl/SSL_CTX_set_cipher_list.pod Thu Mar 19 06:37:10 2015
148 +++ openssl-1.0.1/doc/ssl/SSL_CTX_set_cipher_list.pod.new Tue May 26 11:38:09 2015
149 @@ -54,10 +54,6 @@
150 keys), the "no shared cipher" (SSL_R_NO_SHARED_CIPHER) error is generated
151 and the handshake will fail.
153 -If the cipher list does not contain any SSLv2 cipher suites (this is the
154 -default) then SSLv2 is effectively disabled and neither clients nor servers
155 -will attempt to use SSLv2.
156 -
157 =head1 RETURN VALUES
159 SSL_CTX_set_cipher_list() and SSL_set_cipher_list() return 1 if any cipher
160 --- openssl-1.0.1/doc/ssl/SSL_CTX_set_generate_session_id.pod Thu Jan 15 06:43:49 2015
161 +++ openssl-1.0.1/doc/ssl/SSL_CTX_set_generate_session_id.pod.new Tue May 26 11:40:47 2015
162 @@ -32,9 +32,8 @@
164 When a new session is established between client and server, the server
165 generates a session id. The session id is an arbitrary sequence of bytes.
166 -The length of the session id is 16 bytes for SSLv2 sessions and between
167 -1 and 32 bytes for SSLv3/TLSv1. The session id is not security critical
168 -but must be unique for the server. Additionally, the session id is
169 +The length of the session id is between 1 and 32 bytes for TLSv1. The session id is not
170 +security critical but must be unique for the server. Additionally, the session id is
171 transmitted in the clear when reusing the session so it must not contain
172 sensitive information.
174 @@ -51,12 +50,6 @@
175 the callback B<must never> increase B<id_len> or write to the location
176 B<id> exceeding the given limit.
178 -If a SSLv2 session id is generated and B<id_len> is reduced, it will be
179 -restored after the callback has finished and the session id will be padded
180 -with 0x00. It is not recommended to change the B<id_len> for SSLv2 sessions.
181 -The callback can use the L<SSL_get_version(3)|SSL_get_version(3)> function
182 -to check, whether the session is of type SSLv2.
183 -
184 The location B<id> is filled with 0x00 before the callback is called, so the
185 callback may only fill part of the possible length and leave B<id_len>
186 untouched while maintaining reproducibility.
187 @@ -63,9 +56,8 @@
189 Since the sessions must be distinguished, session ids must be unique.
190 Without the callback a random number is used, so that the probability
191 -of generating the same session id is extremely small (2^128 possible ids
192 -for an SSLv2 session, 2^256 for SSLv3/TLSv1). In order to assure the
193 -uniqueness of the generated session id, the callback must call
194 +of generating the same session id is extremely small (2^256 for TLSv1).
195 +In order to assure the uniqueness of the generated session id, the callback must call
196 SSL_has_matching_session_id() and generate another id if a conflict occurs.
197 If an id conflict is not resolved, the handshake will fail.
198 If the application codes e.g. a unique host id, a unique process number, and
199 @@ -85,10 +77,6 @@
200 the external cache is not tested with SSL_has_matching_session_id()
201 and the same race condition applies.
203 -When calling SSL_has_matching_session_id() for an SSLv2 session with
204 -reduced B<id_len>, the match operation will be performed using the
205 -fixed length required and with a 0x00 padded id.
206 -
207 The callback must return 0 if it cannot generate a session id for whatever
208 reason and return 1 on success.
210 @@ -104,12 +92,7 @@
211 unsigned int *id_len)
212 {
213 unsigned int count = 0;
214 - const char *version;
216 - version = SSL_get_version(ssl);
217 - if (!strcmp(version, "SSLv2"))
218 - /* we must not change id_len */;
219 -
220 do {
221 RAND_pseudo_bytes(id, *id_len);
222 /* Prefix the session_id with the required prefix. NB: If our
223 --- openssl-1.0.1/doc/ssl/SSL_CTX_set_options.pod Tue Jan 20 04:33:36 2015
224 +++ openssl-1.0.1/doc/ssl/SSL_CTX_set_options.pod.new Tue May 26 11:41:47 2015
225 @@ -63,18 +63,11 @@
227 =item SSL_OP_MICROSOFT_SESS_ID_BUG
229 -www.microsoft.com - when talking SSLv2, if session-id reuse is
230 -performed, the session-id passed back in the server-finished message
231 -is different from the one decided upon.
232 +As of OpenSSL 1.0.0 this option has no effect.
234 =item SSL_OP_NETSCAPE_CHALLENGE_BUG
236 -Netscape-Commerce/1.12, when talking SSLv2, accepts a 32 byte
237 -challenge but then appears to only use 16 bytes when generating the
238 -encryption keys. Using 16 bytes is ok but it should be ok to use 32.
239 -According to the SSLv3 spec, one should use 32 bytes for the challenge
240 -when operating in SSLv2/v3 compatibility mode, but as mentioned above,
241 -this breaks this server so 16 bytes is the way to go.
242 +As of OpenSSL 1.0.0 this option has no effect.
244 =item SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
246 --- openssl-1.0.1/doc/ssl/SSL_get_default_timeout.pod Thu Jan 15 06:43:49 2015
247 +++ openssl-1.0.1/doc/ssl/SSL_get_default_timeout.pod.new Tue May 26 11:42:15 2015
248 @@ -24,7 +24,7 @@
249 timeout for the protocol will be used.
251 SSL_get_default_timeout() return this hardcoded value, which is 300 seconds
252 -for all currently supported protocols (SSLv2, SSLv3, and TLSv1).
253 +for all currently supported protocols.
255 =head1 RETURN VALUES
257 --- openssl-1.0.1/doc/ssl/SSL_get_version.pod Thu Jan 15 06:43:49 2015
258 +++ openssl-1.0.1/doc/ssl/SSL_get_version.pod.new Tue May 26 11:42:45 2015
259 @@ -21,14 +21,6 @@
261 =over 4
263 -=item SSLv2
264 -
265 -The connection uses the SSLv2 protocol.
266 -
267 -=item SSLv3
268 -
269 -The connection uses the SSLv3 protocol.
270 -
271 =item TLSv1
273 The connection uses the TLSv1.0 protocol.
274 --- openssl-1.0.1/doc/ssl/SSL_new.pod Thu Jan 15 06:43:49 2015
275 +++ openssl-1.0.1/doc/ssl/SSL_new.pod.new Tue May 26 11:43:12 2015
276 @@ -14,7 +14,7 @@
278 SSL_new() creates a new B<SSL> structure which is needed to hold the
279 data for a TLS/SSL connection. The new structure inherits the settings
280 -of the underlying context B<ctx>: connection method (SSLv2/v3/TLSv1),
281 +of the underlying context B<ctx>: connection method,
282 options, verification settings, timeout settings.
284 =head1 RETURN VALUES
285 --- openssl-1.0.1/doc/ssl/SSL_shutdown.pod Thu Mar 19 06:37:10 2015
286 +++ openssl-1.0.1/doc/ssl/SSL_shutdown.pod.new Tue May 26 11:43:56 2015
287 @@ -60,9 +60,7 @@
289 It is therefore recommended, to check the return value of SSL_shutdown()
290 and call SSL_shutdown() again, if the bidirectional shutdown is not yet
291 -complete (return value of the first call is 0). As the shutdown is not
292 -specially handled in the SSLv2 protocol, SSL_shutdown() will succeed on
293 -the first call.
294 +complete (return value of the first call is 0).
296 The behaviour of SSL_shutdown() additionally depends on the underlying BIO.
298 --- openssl-1.0.1/doc/ssl/ssl.pod Thu Mar 19 06:37:10 2015
299 +++ openssl-1.0.1/doc/ssl/ssl.pod.new Tue May 26 11:47:38 2015
300 @@ -9,9 +9,8 @@
302 =head1 DESCRIPTION
304 -The OpenSSL B<ssl> library implements the Secure Sockets Layer (SSL v2/v3) and
305 -Transport Layer Security (TLS v1) protocols. It provides a rich API which is
306 -documented here.
307 +The OpenSSL B<ssl> library implements the Transport Layer Security (TLS v1)
308 +protocols. It provides a rich API which is documented here.
310 At first the library must be initialized; see
311 L<SSL_library_init(3)|SSL_library_init(3)>.
312 @@ -45,8 +44,8 @@
313 =item B<SSL_METHOD> (SSL Method)
315 That's a dispatch structure describing the internal B<ssl> library
316 -methods/functions which implement the various protocol versions (SSLv1, SSLv2
317 -and TLSv1). It's needed to create an B<SSL_CTX>.
318 +methods/functions which implement the various protocol versions (TLSv1, ...).
319 +It's needed to create an B<SSL_CTX>.
321 =item B<SSL_CIPHER> (SSL Cipher)
323 @@ -105,8 +104,8 @@
325 =item B<ssl23.h>
327 -That's the sub header file dealing with the combined use of the SSLv2 and
328 -SSLv3 protocols.
329 +That's the sub header file dealing with the combined use of different
330 +protocol version.
331 I<Usually you don't have to include it explicitly because
332 it's already included by ssl.h>.
334 @@ -201,15 +200,15 @@
335 =item const SSL_METHOD *B<SSLv2_method>(void);
337 Constructor for the SSLv2 SSL_METHOD structure for clients, servers
338 -or both.
339 +or both. (deprecated)
341 =item const SSL_METHOD *B<SSLv2_client_method>(void);
343 -Constructor for the SSLv2 SSL_METHOD structure for clients.
344 +Constructor for the SSLv2 SSL_METHOD structure for clients. (deprecated)
346 =item const SSL_METHOD *B<SSLv2_server_method>(void);
348 -Constructor for the SSLv2 SSL_METHOD structure for servers.
349 +Constructor for the SSLv2 SSL_METHOD structure for servers. (deprecated)
351 =back
353 @@ -234,12 +233,12 @@
354 =item const char *B<SSL_CIPHER_get_name>(SSL_CIPHER *cipher);
356 Return the internal name of I<cipher> as a string. These are the various
357 -strings defined by the I<SSL2_TXT_xxx>, I<SSL3_TXT_xxx> and I<TLS1_TXT_xxx>
358 +strings defined by the I<SSL3_TXT_xxx> and I<TLS1_TXT_xxx>
359 definitions in the header files.
361 =item char *B<SSL_CIPHER_get_version>(SSL_CIPHER *cipher);
363 -Returns a string like "C<TLSv1/SSLv3>" or "C<SSLv2>" which indicates the
364 +Returns a string like "C<TLSv1/SSLv3>" which indicates the
365 SSL/TLS protocol version to which I<cipher> belongs (i.e. where it was defined
366 in the specification the first time).
368 --- openssl-1.0.1/doc/apps/ciphers.pod Thu Mar 19 06:37:10 2015
369 +++ openssl-1.0.1/doc/apps/ciphers.pod.new Tue May 26 12:07:35 2015
370 @@ -26,26 +24,18 @@
372 =item B<-v>
374 -Verbose option. List ciphers with a complete description of
375 -protocol version (SSLv2 or SSLv3; the latter includes TLS), key exchange,
376 -authentication, encryption and mac algorithms used along with any key size
377 -restrictions and whether the algorithm is classed as an "export" cipher.
378 -Note that without the B<-v> option, ciphers may seem to appear twice
379 -in a cipher list; this is when similar ciphers are available for
380 -SSL v2 and for SSL v3/TLS v1.
381 +Verbose option. List ciphers with a complete description of protocol version,
382 +key exchange, authentication, encryption and mac algorithms used along with any
383 +key size restrictions and whether the algorithm is classed as an "export" cipher.
385 =item B<-V>
387 Like B<-v>, but include cipher suite codes in output (hex format).
389 -=item B<-ssl3>, B<-tls1>
390 +=item B<-tls1>
392 -This lists ciphers compatible with any of SSLv3, TLSv1, TLSv1.1 or TLSv1.2.
393 +This lists ciphers compatible with any of TLSv1, TLSv1.1 or TLSv1.2.
395 -=item B<-ssl2>
396 -
397 -Only include SSLv2 ciphers.
398 -
399 =item B<-h>, B<-?>
401 Print a brief usage message.
402 @@ -588,16 +580,6 @@
403 TLS_PSK_WITH_AES_128_CBC_SHA PSK-AES128-CBC-SHA
404 TLS_PSK_WITH_AES_256_CBC_SHA PSK-AES256-CBC-SHA
406 -=head2 Deprecated SSL v2.0 cipher suites.
407 -
408 - SSL_CK_RC4_128_WITH_MD5 RC4-MD5
409 - SSL_CK_RC4_128_EXPORT40_WITH_MD5 Not implemented.
410 - SSL_CK_RC2_128_CBC_WITH_MD5 RC2-CBC-MD5
411 - SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5 Not implemented.
412 - SSL_CK_IDEA_128_CBC_WITH_MD5 IDEA-CBC-MD5
413 - SSL_CK_DES_64_CBC_WITH_MD5 Not implemented.
414 - SSL_CK_DES_192_EDE3_CBC_WITH_MD5 DES-CBC3-MD5
415 -
416 =head1 NOTES
418 Some compiled versions of OpenSSL may not include all the ciphers
419 --- openssl-1.0.1/doc/apps/s_client.pod Thu Mar 19 06:37:10 2015
420 +++ openssl-1.0.1/doc/apps/s_client.pod.new Tue May 26 12:15:40 2015
421 @@ -32,11 +32,9 @@
422 [B<-ign_eof>]
423 [B<-no_ign_eof>]
424 [B<-quiet>]
425 -[B<-ssl2>]
426 -[B<-ssl3>]
427 [B<-tls1>]
428 +[B<-tls1_1>]
429 +[B<-tls1_2>]
430 -[B<-no_ssl2>]
431 -[B<-no_ssl3>]
432 [B<-no_tls1>]
433 [B<-no_tls1_1>]
434 [B<-no_tls1_2>]
435 @@ -201,9 +199,9 @@
436 given as a hexadecimal number without leading 0x, for example -psk
437 1a2b3c4d.
439 -=item B<-ssl2>, B<-ssl3>, B<-tls1>, B<-tls1_1>, B<-tls1_2>, B<-no_ssl2>, B<-no_ssl3>, B<-no_tls1>, B<-no_tls1_1>, B<-no_tls1_2>
440 +=item B<-tls1>, B<-tls1_1>, B<-tls1_2>, B<-no_tls1>, B<-no_tls1_1>, B<-no_tls1_2>
442 -These options require or disable the use of the specified SSL or TLS protocols.
443 +These options require or disable the use of the specified TLS protocols.
444 By default the initial handshake uses a I<version-flexible> method which will
445 negotiate the highest mutually supported protocol version.
447 @@ -227,10 +225,6 @@
448 supported cipher in the list sent by the client. See the B<ciphers>
449 command for more information.
451 -=item B<-serverpref>
452 -
453 -use the server's cipher preferences; only used for SSLV2.
454 -
455 =item B<-starttls protocol>
457 send the protocol-specific message(s) to switch to TLS for communication.
458 @@ -314,8 +308,8 @@
459 then an HTTP command can be given such as "GET /" to retrieve a web page.
461 If the handshake fails then there are several possible causes, if it is
462 -nothing obvious like no client certificate then the B<-bugs>, B<-ssl2>,
463 -B<-ssl3>, B<-tls1>, B<-no_ssl2>, B<-no_ssl3>, B<-no_tls1> options can be tried
464 +nothing obvious like no client certificate then the B<-bugs>, B<-tls1>, B<-tls1_1>,
465 +B<-tls1_2>, B<-no_tls1>, B<-no_tls1_1>, B<-no_tls1_2> options can be tried
466 in case it is a buggy server. In particular you should play with these
467 options B<before> submitting a bug report to an OpenSSL mailing list.
469 @@ -337,10 +331,6 @@
470 If there are problems verifying a server certificate then the
471 B<-showcerts> option can be used to show the whole chain.
473 -Since the SSLv23 client hello cannot include compression methods or extensions
474 -these will only be supported if its use is disabled, for example by using the
475 -B<-no_sslv2> option.
476 -
477 The B<s_client> utility is a test tool and is designed to continue the
478 handshake after any certificate verification errors. As a result it will
479 accept any certificate chain (trusted or not) sent by the peer. None test
480 --- openssl-1.0.1/doc/apps/s_server.pod Thu Mar 19 06:37:10 2015
481 +++ openssl-1.0.1/doc/apps/s_server.pod.new Tue May 26 12:15:02 2015
482 @@ -39,12 +39,12 @@
483 [B<-serverpref>]
484 [B<-quiet>]
485 [B<-no_tmp_rsa>]
486 -[B<-ssl2>]
487 -[B<-ssl3>]
488 [B<-tls1>]
489 -[B<-no_ssl2>]
490 -[B<-no_ssl3>]
491 +[B<-tls1_1>]
492 +[B<-tls1_2>]
493 [B<-no_tls1>]
494 +[B<-no_tls1_1>]
495 +[B<-no_tls1_2>]
496 [B<-no_dhe>]
497 [B<-bugs>]
498 [B<-hack>]
499 @@ -217,9 +217,9 @@
500 given as a hexadecimal number without leading 0x, for example -psk
501 1a2b3c4d.
503 -=item B<-ssl2>, B<-ssl3>, B<-tls1>, B<-tls1_1>, B<-tls1_2>, B<-no_ssl2>, B<-no_ssl3>, B<-no_tls1>, B<-no_tls1_1>, B<-no_tls1_2>
504 +=item B<-tls1>, B<-tls1_1>, B<-tls1_2>, B<-no_tls1>, B<-no_tls1_1>, B<-no_tls1_2>
506 -These options require or disable the use of the specified SSL or TLS protocols.
507 +These options require or disable the use of the specified TLS protocols.
508 By default the initial handshake uses a I<version-flexible> method which will
509 negotiate the highest mutually supported protocol version.
511 --- openssl-1.0.1/doc/apps/s_time.pod Thu Jan 15 06:43:49 2015
512 +++ openssl-1.0.1/doc/apps/s_time.pod.new Tue May 26 12:20:09 2015
513 @@ -19,8 +19,6 @@
514 [B<-verify depth>]
515 [B<-nbio>]
516 [B<-time seconds>]
517 -[B<-ssl2>]
518 -[B<-ssl3>]
519 [B<-bugs>]
520 [B<-cipher cipherlist>]
522 @@ -92,19 +90,6 @@
524 turns on non-blocking I/O.
526 -=item B<-ssl2>, B<-ssl3>
527 -
528 -these options disable the use of certain SSL or TLS protocols. By default
529 -the initial handshake uses a method which should be compatible with all
530 -servers and permit them to use SSL v3, SSL v2 or TLS as appropriate.
531 -The timing program is not as rich in options to turn protocols on and off as
532 -the L<s_client(1)|s_client(1)> program and may not connect to all servers.
533 -
534 -Unfortunately there are a lot of ancient and broken servers in use which
535 -cannot handle this technique and will fail to connect. Some servers only
536 -work if TLS is turned off with the B<-ssl3> option; others
537 -will only support SSL v2 and may need the B<-ssl2> option.
538 -
539 =item B<-bugs>
541 there are several known bug in SSL and TLS implementations. Adding this
542 @@ -137,8 +122,7 @@
543 for details.
545 If the handshake fails then there are several possible causes, if it is
546 -nothing obvious like no client certificate then the B<-bugs>, B<-ssl2>,
547 -B<-ssl3> options can be tried
548 +nothing obvious like no client certificate then the B<-bugs> option can be tried
549 in case it is a buggy server. In particular you should play with these
550 options B<before> submitting a bug report to an OpenSSL mailing list.
552 --- openssl-1.0.1/doc/apps/sess_id.pod Thu Jan 15 06:43:49 2015
553 +++ openssl-1.0.1/doc/apps/sess_id.pod.new Tue May 26 12:21:07 2015
554 @@ -91,7 +91,7 @@
556 =item B<Protocol>
558 -this is the protocol in use TLSv1, SSLv3 or SSLv2.
559 +this is the protocol in use.
561 =item B<Cipher>
563 @@ -110,10 +110,6 @@
565 this is the SSL session master key.
567 -=item B<Key-Arg>
568 -
569 -the key argument, this is only used in SSL v2.
570 -
571 =item B<Start Time>
573 this is the session start time represented as an integer in standard Unix format.