Attention is currently required from: Arne Schwabe.
Hello Arne Schwabe,
I'd like you to do a code review.
Please visit
https://gerrit.openvpn.net/c/openvpn/+/2122?usp=email
to review the following change.
Change subject: ssl_mbedtls: remove empty tls_ctx_personalise_random()
......................................................................
ssl_mbedtls: remove empty tls_ctx_personalise_random()
Mbed TLS 4 has no application-owned CTR_DRBG to personalise, so
494fb718 ("Add support for Mbed TLS 4") limited the function body to
older versions, and 77a04d48 ("Remove Mbed TLS 3 compatibility")
removed that body but kept the empty function and its call.
Change-Id: I23c6480967d4785beada3879667d50d60d7d8df4
Signed-off-by: Razvan Cojocaru <[email protected]>
---
M src/openvpn/ssl.c
M src/openvpn/ssl_backend.h
M src/openvpn/ssl_mbedtls.c
3 files changed, 0 insertions(+), 24 deletions(-)
git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/22/2122/1
diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c
index 12b6119..b701c0a 100644
--- a/src/openvpn/ssl.c
+++ b/src/openvpn/ssl.c
@@ -672,11 +672,6 @@
tls_ctx_load_ecdh_params(new_ctx, options->ecdh_curve);
}
-#ifdef ENABLE_CRYPTO_MBEDTLS
- /* Personalise the random by mixing in the certificate */
- tls_ctx_personalise_random(new_ctx);
-#endif
-
tls_clear_error();
return new_ctx;
diff --git a/src/openvpn/ssl_backend.h b/src/openvpn/ssl_backend.h
index 2150d81..b4604ea 100644
--- a/src/openvpn/ssl_backend.h
+++ b/src/openvpn/ssl_backend.h
@@ -327,17 +327,6 @@
void tls_ctx_load_extra_certs(struct tls_root_ctx *ctx, const char
*extra_certs_file,
bool extra_certs_file_inline);
-#ifdef ENABLE_CRYPTO_MBEDTLS
-/**
- * Add a personalisation string to the mbed TLS RNG, based on the certificate
- * loaded into the given context.
- *
- * @param ctx TLS context to use
- */
-void tls_ctx_personalise_random(struct tls_root_ctx *ctx);
-
-#endif
-
/* **************************************
*
* Key-state specific functions
diff --git a/src/openvpn/ssl_mbedtls.c b/src/openvpn/ssl_mbedtls.c
index 8aaca96..45d7715 100644
--- a/src/openvpn/ssl_mbedtls.c
+++ b/src/openvpn/ssl_mbedtls.c
@@ -767,14 +767,6 @@
msg(my_loglevel, "mbed TLS msg (%s:%d): %s", file, line, str);
}
-/*
- * Further personalise the RNG using a hash of the public key
- */
-void
-tls_ctx_personalise_random(struct tls_root_ctx *ctx)
-{
-}
-
int
tls_version_max(void)
{
--
To view, visit https://gerrit.openvpn.net/c/openvpn/+/2122?usp=email
To unsubscribe, or for help writing mail filters, visit
https://gerrit.openvpn.net/settings?usp=email
Gerrit-MessageType: newchange
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: I23c6480967d4785beada3879667d50d60d7d8df4
Gerrit-Change-Number: 2122
Gerrit-PatchSet: 1
Gerrit-Owner: Răzvan Cojocaru <[email protected]>
Gerrit-Reviewer: Arne Schwabe <[email protected]>
Gerrit-CC: openvpn-devel <[email protected]>
Gerrit-Attention: Arne Schwabe <[email protected]>
_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
