This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat-native.git
The following commit(s) were added to refs/heads/main by this push:
new 5cb404f72 Remove unused code
5cb404f72 is described below
commit 5cb404f72b2025d73d9bfc3373cd3e521eb7d11f
Author: Mark Thomas <[email protected]>
AuthorDate: Thu Aug 27 10:40:54 2026 +0100
Remove unused code
---
native/include/ssl_private.h | 17 -----------------
native/src/sslcontext.c | 1 -
native/src/sslutils.c | 42 ------------------------------------------
3 files changed, 60 deletions(-)
diff --git a/native/include/ssl_private.h b/native/include/ssl_private.h
index 9286c5644..63fe4905e 100644
--- a/native/include/ssl_private.h
+++ b/native/include/ssl_private.h
@@ -307,22 +307,6 @@ struct tcn_ssl_conf_ctxt_t {
typedef struct {
apr_pool_t *pool;
tcn_ssl_ctxt_t *ctx;
- /* Track the handshake/renegotiation state for the connection so
- * that all client-initiated renegotiations can be rejected, as a
- * partial fix for CVE-2009-3555.
- */
- enum {
- RENEG_INIT = 0, /* Before initial handshake */
- RENEG_REJECT, /* After initial handshake; any client-initiated
- * renegotiation should be rejected
- */
- RENEG_ALLOW, /* A server-initated renegotiation is taking
- * place (as dictated by configuration)
- */
- RENEG_ABORT /* Renegotiation initiated by client, abort the
- * connection
- */
- } reneg_state;
enum {
PHA_NONE = 0, /* Before PHA */
PHA_STARTED, /* PHA req sent to client but no response */
@@ -356,7 +340,6 @@ EVP_PKEY *SSL_dh_GetParamFromFile(const char *);
int SSL_ec_GetParamFromFile(const char *);
#endif
DH *SSL_callback_tmp_DH(SSL *, int, int);
-void SSL_callback_handshake(const SSL *, int, int);
int SSL_CTX_use_certificate_chain(SSL_CTX *, const char *, int);
int SSL_callback_SSL_verify(int, X509_STORE_CTX *);
int SSL_rand_seed(const char *file);
diff --git a/native/src/sslcontext.c b/native/src/sslcontext.c
index b50690587..d0806d61a 100644
--- a/native/src/sslcontext.c
+++ b/native/src/sslcontext.c
@@ -203,7 +203,6 @@ TCN_IMPLEMENT_CALL(jlong, SSLContext, make)(TCN_STDARGS,
jlong pool,
/* Set default password callback */
SSL_CTX_set_default_passwd_cb(c->ctx, (pem_password_cb
*)SSL_password_callback);
SSL_CTX_set_default_passwd_cb_userdata(c->ctx, (void
*)(&tcn_password_callback));
- SSL_CTX_set_info_callback(c->ctx, SSL_callback_handshake);
/*
* Let us cleanup the ssl context when the pool is destroyed
diff --git a/native/src/sslutils.c b/native/src/sslutils.c
index a6ec8846f..8f9ad3f92 100644
--- a/native/src/sslutils.c
+++ b/native/src/sslutils.c
@@ -386,48 +386,6 @@ int SSL_callback_SSL_verify(int ok, X509_STORE_CTX *ctx)
return ok;
}
-/*
- * This callback function is executed while OpenSSL processes the SSL
- * handshake and does SSL record layer stuff. It's used to trap
- * client-initiated renegotiations, and for dumping everything to the
- * log.
- */
-void SSL_callback_handshake(const SSL *ssl, int where, int rc)
-{
- tcn_ssl_conn_t *con = (tcn_ssl_conn_t *)SSL_get_app_data(ssl);
-#ifdef HAVE_TLSV1_3
- const SSL_SESSION *session = SSL_get_session(ssl);
-#endif
-
- /* Retrieve the conn_rec and the associated SSLConnRec. */
- if (con == NULL) {
- return;
- }
-
-#ifdef HAVE_TLSV1_3
- /* TLS 1.3 does not use renegotiation so do not update the renegotiation
- * state once we know we are using TLS 1.3. */
- if (session != NULL) {
- if (SSL_SESSION_get_protocol_version(session) == TLS1_3_VERSION) {
- return;
- }
- }
-#endif
-
- /* If the reneg state is to reject renegotiations, check the SSL
- * state machine and move to ABORT if a Client Hello is being
- * read. */
- if ((where & SSL_CB_HANDSHAKE_START) &&
- con->reneg_state == RENEG_REJECT) {
- con->reneg_state = RENEG_ABORT;
- }
- /* If the first handshake is complete, change state to reject any
- * subsequent client-initated renegotiation. */
- else if ((where & SSL_CB_HANDSHAKE_DONE) && con->reneg_state ==
RENEG_INIT) {
- con->reneg_state = RENEG_REJECT;
- }
-}
-
/* The code here is inspired by nghttp2
*
* See
https://github.com/tatsuhiro-t/nghttp2/blob/ae0100a9abfcf3149b8d9e62aae216e946b517fb/src/shrpx_ssl.cc#L244
*/
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
