From: Razvan Cojocaru <[email protected]> Mbed TLS 4 has no application-owned CTR_DRBG to personalise, so 494fb718 ("Add support for Mbed TLS 4") limited the function body to older versions, and 77a04d48 ("Remove Mbed TLS 3 compatibility") removed that body but kept the empty function and its call.
Change-Id: I23c6480967d4785beada3879667d50d60d7d8df4 Signed-off-by: Razvan Cojocaru <[email protected]> Acked-by: Gert Doering <[email protected]> Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2122 --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2122 This mail reflects revision 1 of this Change. Acked-by according to Gerrit (reflected above): Gert Doering <[email protected]> diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c index 12b6119..b701c0a 100644 --- a/src/openvpn/ssl.c +++ b/src/openvpn/ssl.c @@ -672,11 +672,6 @@ tls_ctx_load_ecdh_params(new_ctx, options->ecdh_curve); } -#ifdef ENABLE_CRYPTO_MBEDTLS - /* Personalise the random by mixing in the certificate */ - tls_ctx_personalise_random(new_ctx); -#endif - tls_clear_error(); return new_ctx; diff --git a/src/openvpn/ssl_backend.h b/src/openvpn/ssl_backend.h index 2150d81..b4604ea 100644 --- a/src/openvpn/ssl_backend.h +++ b/src/openvpn/ssl_backend.h @@ -327,17 +327,6 @@ void tls_ctx_load_extra_certs(struct tls_root_ctx *ctx, const char *extra_certs_file, bool extra_certs_file_inline); -#ifdef ENABLE_CRYPTO_MBEDTLS -/** - * Add a personalisation string to the mbed TLS RNG, based on the certificate - * loaded into the given context. - * - * @param ctx TLS context to use - */ -void tls_ctx_personalise_random(struct tls_root_ctx *ctx); - -#endif - /* ************************************** * * Key-state specific functions diff --git a/src/openvpn/ssl_mbedtls.c b/src/openvpn/ssl_mbedtls.c index 8aaca96..45d7715 100644 --- a/src/openvpn/ssl_mbedtls.c +++ b/src/openvpn/ssl_mbedtls.c @@ -767,14 +767,6 @@ msg(my_loglevel, "mbed TLS msg (%s:%d): %s", file, line, str); } -/* - * Further personalise the RNG using a hash of the public key - */ -void -tls_ctx_personalise_random(struct tls_root_ctx *ctx) -{ -} - int tls_version_max(void) { _______________________________________________ Openvpn-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-devel
