Skip to content

Commit 68fd6dc

Browse files
author
Rich Salz
committed
Remove support for opaque-prf
An expired IETF Internet-Draft (seven years old) that nobody implements, and probably just as good as NSA DRBG work. Reviewed-by: Richard Levitte <levitte@openssl.org>
1 parent 31b446e commit 68fd6dc

File tree

13 files changed

+3
-399
lines changed

13 files changed

+3
-399
lines changed

‎apps/s_cb.c‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -907,11 +907,6 @@ void tlsext_cb(SSL *s, int client_server, int type,
907907
extname = "renegotiation info";
908908
break;
909909

910-
#ifdef TLSEXT_TYPE_opaque_prf_input
911-
case TLSEXT_TYPE_opaque_prf_input:
912-
extname = "opaque PRF input";
913-
break;
914-
#endif
915910
#ifdef TLSEXT_TYPE_next_proto_neg
916911
case TLSEXT_TYPE_next_proto_neg:
917912
extname = "next protocol";

‎apps/s_client.c‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1409,12 +1409,6 @@ int MAIN(int argc, char **argv)
14091409
kssl_ctx_setstring(kctx, KSSL_SERVER, host);
14101410
}
14111411
#endif /* OPENSSL_NO_KRB5 */
1412-
/* SSL_set_cipher_list(con,"RC4-MD5"); */
1413-
#if 0
1414-
# ifdef TLSEXT_TYPE_opaque_prf_input
1415-
SSL_set_tlsext_opaque_prf_input(con, "Test client", 11);
1416-
# endif
1417-
#endif
14181412
14191413
re_start:
14201414
#ifdef NO_SYS_UN_H

‎apps/s_server.c‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2183,11 +2183,6 @@ static int sv_body(char *hostname, int s, int stype, unsigned char *context)
21832183
SSL_set_session_id_context(con, context, strlen((char *)context));
21842184
}
21852185
SSL_clear(con);
2186-
#if 0
2187-
# ifdef TLSEXT_TYPE_opaque_prf_input
2188-
SSL_set_tlsext_opaque_prf_input(con, "Test server", 11);
2189-
# endif
2190-
#endif
21912186

21922187
if (stype == SOCK_DGRAM) {
21932188

‎ssl/s3_lib.c‎

Lines changed: 0 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -3244,13 +3244,6 @@ void ssl3_free(SSL *s)
32443244
if (s == NULL)
32453245
return;
32463246

3247-
#ifdef TLSEXT_TYPE_opaque_prf_input
3248-
if (s->s3->client_opaque_prf_input != NULL)
3249-
OPENSSL_free(s->s3->client_opaque_prf_input);
3250-
if (s->s3->server_opaque_prf_input != NULL)
3251-
OPENSSL_free(s->s3->server_opaque_prf_input);
3252-
#endif
3253-
32543247
ssl3_cleanup_key_block(s);
32553248
if (s->s3->rbuf.buf != NULL)
32563249
ssl3_release_read_buffer(s);
@@ -3293,15 +3286,6 @@ void ssl3_clear(SSL *s)
32933286
size_t rlen, wlen;
32943287
int init_extra;
32953288

3296-
#ifdef TLSEXT_TYPE_opaque_prf_input
3297-
if (s->s3->client_opaque_prf_input != NULL)
3298-
OPENSSL_free(s->s3->client_opaque_prf_input);
3299-
s->s3->client_opaque_prf_input = NULL;
3300-
if (s->s3->server_opaque_prf_input != NULL)
3301-
OPENSSL_free(s->s3->server_opaque_prf_input);
3302-
s->s3->server_opaque_prf_input = NULL;
3303-
#endif
3304-
33053289
ssl3_cleanup_key_block(s);
33063290
if (s->s3->tmp.ca_names != NULL)
33073291
sk_X509_NAME_pop_free(s->s3->tmp.ca_names, X509_NAME_free);
@@ -3554,30 +3538,6 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
35543538
ret = 1;
35553539
break;
35563540

3557-
# ifdef TLSEXT_TYPE_opaque_prf_input
3558-
case SSL_CTRL_SET_TLSEXT_OPAQUE_PRF_INPUT:
3559-
if (larg > 12288) { /* actual internal limit is 2^16 for the
3560-
* complete hello message * (including the
3561-
* cert chain and everything) */
3562-
SSLerr(SSL_F_SSL3_CTRL, SSL_R_OPAQUE_PRF_INPUT_TOO_LONG);
3563-
break;
3564-
}
3565-
if (s->tlsext_opaque_prf_input != NULL)
3566-
OPENSSL_free(s->tlsext_opaque_prf_input);
3567-
if ((size_t)larg == 0)
3568-
s->tlsext_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte
3569-
* just to get
3570-
* non-NULL */
3571-
else
3572-
s->tlsext_opaque_prf_input = BUF_memdup(parg, (size_t)larg);
3573-
if (s->tlsext_opaque_prf_input != NULL) {
3574-
s->tlsext_opaque_prf_input_len = (size_t)larg;
3575-
ret = 1;
3576-
} else
3577-
s->tlsext_opaque_prf_input_len = 0;
3578-
break;
3579-
# endif
3580-
35813541
case SSL_CTRL_SET_TLSEXT_STATUS_REQ_TYPE:
35823542
s->tlsext_status_type = larg;
35833543
ret = 1;
@@ -4071,12 +4031,6 @@ long ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)
40714031
return 1;
40724032
}
40734033

4074-
# ifdef TLSEXT_TYPE_opaque_prf_input
4075-
case SSL_CTRL_SET_TLSEXT_OPAQUE_PRF_INPUT_CB_ARG:
4076-
ctx->tlsext_opaque_prf_input_callback_arg = parg;
4077-
return 1;
4078-
# endif
4079-
40804034
case SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB_ARG:
40814035
ctx->tlsext_status_arg = parg;
40824036
return 1;
@@ -4241,13 +4195,6 @@ long ssl3_ctx_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp) (void))
42414195
ctx->tlsext_servername_callback = (int (*)(SSL *, int *, void *))fp;
42424196
break;
42434197

4244-
# ifdef TLSEXT_TYPE_opaque_prf_input
4245-
case SSL_CTRL_SET_TLSEXT_OPAQUE_PRF_INPUT_CB:
4246-
ctx->tlsext_opaque_prf_input_callback =
4247-
(int (*)(SSL *, void *, size_t, void *))fp;
4248-
break;
4249-
# endif
4250-
42514198
case SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB:
42524199
ctx->tlsext_status_cb = (int (*)(SSL *, void *))fp;
42534200
break;

‎ssl/ssl.h‎

Lines changed: 3 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1054,11 +1054,6 @@ struct ssl_ctx_st {
10541054
/* Callback for status request */
10551055
int (*tlsext_status_cb) (SSL *ssl, void *arg);
10561056
void *tlsext_status_arg;
1057-
1058-
/* draft-rescorla-tls-opaque-prf-input-00.txt information */
1059-
int (*tlsext_opaque_prf_input_callback) (SSL *, void *peerinput,
1060-
size_t len, void *arg);
1061-
void *tlsext_opaque_prf_input_callback_arg;
10621057
# endif
10631058

10641059
# ifndef OPENSSL_NO_PSK
@@ -1573,12 +1568,6 @@ struct ssl_st {
15731568
/* our list */
15741569
unsigned char *tlsext_ellipticcurvelist;
15751570
# endif /* OPENSSL_NO_EC */
1576-
/*
1577-
* draft-rescorla-tls-opaque-prf-input-00.txt information to be used for
1578-
* handshakes
1579-
*/
1580-
void *tlsext_opaque_prf_input;
1581-
size_t tlsext_opaque_prf_input_len;
15821571
/* TLS Session Ticket extension override */
15831572
TLS_SESSION_TICKET_EXT *tlsext_session_ticket;
15841573
/* TLS Session Ticket extension callback */
@@ -1861,9 +1850,9 @@ DECLARE_PEM_rw(SSL_SESSION, SSL_SESSION)
18611850
# define SSL_CTRL_SET_TLSEXT_DEBUG_ARG 57
18621851
# define SSL_CTRL_GET_TLSEXT_TICKET_KEYS 58
18631852
# define SSL_CTRL_SET_TLSEXT_TICKET_KEYS 59
1864-
# define SSL_CTRL_SET_TLSEXT_OPAQUE_PRF_INPUT 60
1865-
# define SSL_CTRL_SET_TLSEXT_OPAQUE_PRF_INPUT_CB 61
1866-
# define SSL_CTRL_SET_TLSEXT_OPAQUE_PRF_INPUT_CB_ARG 62
1853+
/*# define SSL_CTRL_SET_TLSEXT_OPAQUE_PRF_INPUT 60 */
1854+
/*# define SSL_CTRL_SET_TLSEXT_OPAQUE_PRF_INPUT_CB 61 */
1855+
/*# define SSL_CTRL_SET_TLSEXT_OPAQUE_PRF_INPUT_CB_ARG 62 */
18671856
# define SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB 63
18681857
# define SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB_ARG 64
18691858
# define SSL_CTRL_SET_TLSEXT_STATUS_REQ_TYPE 65

‎ssl/ssl3.h‎

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -530,15 +530,6 @@ typedef struct ssl3_state_st {
530530
int total_renegotiations;
531531
int num_renegotiations;
532532
int in_read_app_data;
533-
/*
534-
* Opaque PRF input as used for the current handshake. These fields are
535-
* used only if TLSEXT_TYPE_opaque_prf_input is defined (otherwise, they
536-
* are merely present to improve binary compatibility)
537-
*/
538-
void *client_opaque_prf_input;
539-
size_t client_opaque_prf_input_len;
540-
void *server_opaque_prf_input;
541-
size_t server_opaque_prf_input_len;
542533
struct {
543534
/* actually only needs to be 16+20 */
544535
unsigned char cert_verify_md[EVP_MAX_MD_SIZE * 2];

‎ssl/ssl_lib.c‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -610,8 +610,6 @@ void SSL_free(SSL *s)
610610
if (s->tlsext_ellipticcurvelist)
611611
OPENSSL_free(s->tlsext_ellipticcurvelist);
612612
# endif /* OPENSSL_NO_EC */
613-
if (s->tlsext_opaque_prf_input)
614-
OPENSSL_free(s->tlsext_opaque_prf_input);
615613
if (s->tlsext_ocsp_exts)
616614
sk_X509_EXTENSION_pop_free(s->tlsext_ocsp_exts, X509_EXTENSION_free);
617615
if (s->tlsext_ocsp_ids)

‎ssl/ssltest.c‎

Lines changed: 0 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -956,30 +956,6 @@ static void lock_dbg_cb(int mode, int type, const char *file, int line)
956956
}
957957
}
958958

959-
#ifdef TLSEXT_TYPE_opaque_prf_input
960-
struct cb_info_st {
961-
void *input;
962-
size_t len;
963-
int ret;
964-
};
965-
struct cb_info_st co1 = { "C", 1, 1 }; /* try to negotiate oqaque PRF input */
966-
struct cb_info_st co2 = { "C", 1, 2 }; /* insist on oqaque PRF input */
967-
struct cb_info_st so1 = { "S", 1, 1 }; /* try to negotiate oqaque PRF input */
968-
struct cb_info_st so2 = { "S", 1, 2 }; /* insist on oqaque PRF input */
969-
970-
int opaque_prf_input_cb(SSL *ssl, void *peerinput, size_t len, void *arg_)
971-
{
972-
struct cb_info_st *arg = arg_;
973-
974-
if (arg == NULL)
975-
return 1;
976-
977-
if (!SSL_set_tlsext_opaque_prf_input(ssl, arg->input, arg->len))
978-
return 0;
979-
return arg->ret;
980-
}
981-
#endif
982-
983959
int main(int argc, char *argv[])
984960
{
985961
char *CApath = NULL, *CAfile = NULL;
@@ -1534,15 +1510,6 @@ int main(int argc, char *argv[])
15341510
SSL_CTX_set_tmp_rsa_callback(s_ctx, tmp_rsa_cb);
15351511
#endif
15361512

1537-
#ifdef TLSEXT_TYPE_opaque_prf_input
1538-
SSL_CTX_set_tlsext_opaque_prf_input_callback(c_ctx, opaque_prf_input_cb);
1539-
SSL_CTX_set_tlsext_opaque_prf_input_callback(s_ctx, opaque_prf_input_cb);
1540-
/* or &co2 or NULL */
1541-
SSL_CTX_set_tlsext_opaque_prf_input_callback_arg(c_ctx, &co1);
1542-
/* or &so2 or NULL */
1543-
SSL_CTX_set_tlsext_opaque_prf_input_callback_arg(s_ctx, &so1);
1544-
#endif
1545-
15461513
if (!SSL_CTX_use_certificate_file(s_ctx, server_cert, SSL_FILETYPE_PEM)) {
15471514
ERR_print_errors(bio_err);
15481515
} else if (!SSL_CTX_use_PrivateKey_file(s_ctx,

‎ssl/t1_enc.c‎

Lines changed: 0 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1099,22 +1099,6 @@ int tls1_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p,
10991099
len);
11001100
#endif /* KSSL_DEBUG */
11011101

1102-
#ifdef TLSEXT_TYPE_opaque_prf_input
1103-
if (s->s3->client_opaque_prf_input != NULL
1104-
&& s->s3->server_opaque_prf_input != NULL
1105-
&& s->s3->client_opaque_prf_input_len > 0
1106-
&& s->s3->client_opaque_prf_input_len ==
1107-
s->s3->server_opaque_prf_input_len) {
1108-
co = s->s3->client_opaque_prf_input;
1109-
col = s->s3->server_opaque_prf_input_len;
1110-
so = s->s3->server_opaque_prf_input;
1111-
/*
1112-
* must be same as col (see
1113-
* draft-resc-00.txts-opaque-prf-input-00.txt, section 3.1)
1114-
*/
1115-
sol = s->s3->client_opaque_prf_input_len;
1116-
}
1117-
#endif
11181102

11191103
tls1_PRF(ssl_get_algorithm2(s),
11201104
TLS_MD_MASTER_SECRET_CONST, TLS_MD_MASTER_SECRET_CONST_SIZE,

‎ssl/t1_ext.c‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -284,9 +284,6 @@ int SSL_extension_supported(unsigned int ext_type)
284284
case TLSEXT_TYPE_srp:
285285
case TLSEXT_TYPE_status_request:
286286
case TLSEXT_TYPE_use_srtp:
287-
# ifdef TLSEXT_TYPE_opaque_prf_input
288-
case TLSEXT_TYPE_opaque_prf_input:
289-
# endif
290287
# ifdef TLSEXT_TYPE_encrypt_then_mac
291288
case TLSEXT_TYPE_encrypt_then_mac:
292289
# endif

0 commit comments

Comments
 (0)