Flense out dead code, we don't do ecdhe_clnt_cert.

coverity ID's 21691 21698
ok miod@, "Fry it" jsing@

2 files changed, 75 insertions, 187 deletions

diff --git a/lib/libssl/src/ssl/d1_clnt.c b/lib/libssl/src/ssl/d1_clnt.c
index 261e4e996fd..b087535ce11 100644
--- a/lib/libssl/src/ssl/d1_clnt.c
+++ b/lib/libssl/src/ssl/d1_clnt.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: d1_clnt.c,v 1.46 2015/07/14 05:26:32 doug Exp $ */
+/* $OpenBSD: d1_clnt.c,v 1.47 2015/07/15 18:35:34 beck Exp $ */
 /*
  * DTLS implementation written by Nagendra Modadugu
  * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
@@ -881,37 +881,8 @@ dtls1_send_client_key_exchange(SSL *s)
 		} else if (alg_k & (SSL_kECDHE|SSL_kECDHr|SSL_kECDHe)) {
 			const EC_GROUP *srvr_group = NULL;
 			EC_KEY *tkey;
-			int ecdh_clnt_cert = 0;
 			int field_size = 0;
 
-			/* Did we send out the client's
-			 * ECDH share for use in premaster
-			 * computation as part of client certificate?
-			 * If so, set ecdh_clnt_cert to 1.
-			 */
-			if ((alg_k & (SSL_kECDHr|SSL_kECDHe)) &&
-			    (s->cert != NULL)) {
-				/* XXX: For now, we do not support client
-				 * authentication using ECDH certificates.
-				 * To add such support, one needs to add
-				 * code that checks for appropriate
-				 * conditions and sets ecdh_clnt_cert to 1.
-				 * For example, the cert have an ECC
-				 * key on the same curve as the server's
-				 * and the key should be authorized for
-				 * key agreement.
-				 *
-				 * One also needs to add code in ssl3_connect
-				 * to skip sending the certificate verify
-				 * message.
-				 *
-				 * if ((s->cert->key->privatekey != NULL) &&
-				 *     (s->cert->key->privatekey->type ==
-				 *      EVP_PKEY_EC) && ...)
-				 * ecdh_clnt_cert = 1;
-				 */
-			}
-
 			if (s->session->sess_cert->peer_ecdh_tmp != NULL) {
 				tkey = s->session->sess_cert->peer_ecdh_tmp;
 			} else {
@@ -949,31 +920,12 @@ dtls1_send_client_key_exchange(SSL *s)
 				    ERR_R_EC_LIB);
 				goto err;
 			}
-			if (ecdh_clnt_cert) {
-				/* Reuse key info from our certificate
-				 * We only need our private key to perform
-				 * the ECDH computation.
-				 */
-				const BIGNUM *priv_key;
-				tkey = s->cert->key->privatekey->pkey.ec;
-				priv_key = EC_KEY_get0_private_key(tkey);
-				if (priv_key == NULL) {
-					SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
-					    ERR_R_MALLOC_FAILURE);
-					goto err;
-				}
-				if (!EC_KEY_set_private_key(clnt_ecdh, priv_key)) {
-					SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
-					    ERR_R_EC_LIB);
-					goto err;
-				}
-			} else {
-				/* Generate a new ECDH key pair */
-				if (!(EC_KEY_generate_key(clnt_ecdh))) {
-					SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
-					    ERR_R_ECDH_LIB);
-					goto err;
-				}
+
+			/* Generate a new ECDH key pair */
+			if (!(EC_KEY_generate_key(clnt_ecdh))) {
+				SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+				    ERR_R_ECDH_LIB);
+				goto err;
 			}
 
 			/* use the 'p' output buffer for the ECDH key, but
@@ -999,44 +951,38 @@ dtls1_send_client_key_exchange(SSL *s)
 				s, s->session->master_key, p, n);
 			memset(p, 0, n); /* clean up */
 
-			if (ecdh_clnt_cert) {
-				/* Send empty client key exch message */
-				n = 0;
-			} else {
-				/* First check the size of encoding and
-				 * allocate memory accordingly.
-				 */
-				encoded_pt_len = EC_POINT_point2oct(srvr_group,
-				    EC_KEY_get0_public_key(clnt_ecdh),
-				    POINT_CONVERSION_UNCOMPRESSED,
-				    NULL, 0, NULL);
-
-				encodedPoint = malloc(encoded_pt_len);
-
-				bn_ctx = BN_CTX_new();
-				if ((encodedPoint == NULL) ||
-				    (bn_ctx == NULL)) {
-					SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
-					    ERR_R_MALLOC_FAILURE);
-					goto err;
-				}
+			/* First check the size of encoding and
+			 * allocate memory accordingly.
+			 */
+			encoded_pt_len = EC_POINT_point2oct(srvr_group,
+			    EC_KEY_get0_public_key(clnt_ecdh),
+			    POINT_CONVERSION_UNCOMPRESSED,
+			    NULL, 0, NULL);
 
-				/* Encode the public key */
-				n = EC_POINT_point2oct(srvr_group,
-				    EC_KEY_get0_public_key(clnt_ecdh),
-				    POINT_CONVERSION_UNCOMPRESSED,
-				    encodedPoint, encoded_pt_len, bn_ctx);
+			encodedPoint = malloc(encoded_pt_len);
 
-				*p = n; /* length of encoded point */
-				/* Encoded point will be copied here */
-				p += 1;
+			bn_ctx = BN_CTX_new();
+			if ((encodedPoint == NULL) ||
+			    (bn_ctx == NULL)) {
+				SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+				    ERR_R_MALLOC_FAILURE);
+				goto err;
+			}
 
-				/* copy the point */
-				memcpy((unsigned char *)p, encodedPoint, n);
-				/* increment n to account for length field */
-				n += 1;
+			/* Encode the public key */
+			n = EC_POINT_point2oct(srvr_group,
+			    EC_KEY_get0_public_key(clnt_ecdh),
+			    POINT_CONVERSION_UNCOMPRESSED,
+			    encodedPoint, encoded_pt_len, bn_ctx);
 
-			}
+			*p = n; /* length of encoded point */
+			/* Encoded point will be copied here */
+			p += 1;
+
+			/* copy the point */
+			memcpy((unsigned char *)p, encodedPoint, n);
+			/* increment n to account for length field */
+			n += 1;
 
 			/* Free allocated memory */
 			BN_CTX_free(bn_ctx);
diff --git a/lib/libssl/src/ssl/s3_clnt.c b/lib/libssl/src/ssl/s3_clnt.c
index eed6cb5215c..6bc5a8b6221 100644
--- a/lib/libssl/src/ssl/s3_clnt.c
+++ b/lib/libssl/src/ssl/s3_clnt.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: s3_clnt.c,v 1.116 2015/07/14 03:33:16 doug Exp $ */
+/* $OpenBSD: s3_clnt.c,v 1.117 2015/07/15 18:35:34 beck Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -2009,37 +2009,8 @@ ssl3_send_client_key_exchange(SSL *s)
 		} else if (alg_k & (SSL_kECDHE|SSL_kECDHr|SSL_kECDHe)) {
 			const EC_GROUP *srvr_group = NULL;
 			EC_KEY *tkey;
-			int ecdh_clnt_cert = 0;
 			int field_size = 0;
 
-			/*
-			 * Did we send out the client's ECDH share for use
-			 * in premaster computation as part of client
-			 * certificate? If so, set ecdh_clnt_cert to 1.
-			 */
-			if ((alg_k & (SSL_kECDHr|SSL_kECDHe)) &&
-			    (s->cert != NULL)) {
-				/*
-				 * XXX: For now, we do not support client
-				 * authentication using ECDH certificates.
-				 * To add such support, one needs to add
-				 * code that checks for appropriate
-				 * conditions and sets ecdh_clnt_cert to 1.
-				 * For example, the cert have an ECC
-				 * key on the same curve as the server's
-				 * and the key should be authorized for
-				 * key agreement.
-				 *
-				 * One also needs to add code in ssl3_connect
-				 * to skip sending the certificate verify
-				 * message.
-				 *
-				 * if ((s->cert->key->privatekey != NULL) &&
-				 *     (s->cert->key->privatekey->type ==
-				 *      EVP_PKEY_EC) && ...)
-				 * ecdh_clnt_cert = 1;
-				 */
-			}
 
 			/* Ensure that we have an ephemeral key for ECDHE. */
 			if ((alg_k & SSL_kECDHE) &&
@@ -2087,36 +2058,13 @@ ssl3_send_client_key_exchange(SSL *s)
 				    ERR_R_EC_LIB);
 				goto err;
 			}
-			if (ecdh_clnt_cert) {
-				/*
-				 * Reuse key info from our certificate
-				 * We only need our private key to perform
-				 * the ECDH computation.
-				 */
-				const BIGNUM *priv_key;
-				tkey = s->cert->key->privatekey->pkey.ec;
-				priv_key = EC_KEY_get0_private_key(tkey);
-				if (priv_key == NULL) {
-					SSLerr(
-					    SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
-					    ERR_R_MALLOC_FAILURE);
-					goto err;
-				}
-				if (!EC_KEY_set_private_key(clnt_ecdh,
-				    priv_key)) {
-					SSLerr(
-					    SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
-					    ERR_R_EC_LIB);
-					goto err;
-				}
-			} else {
-				/* Generate a new ECDH key pair */
-				if (!(EC_KEY_generate_key(clnt_ecdh))) {
-					SSLerr(
-					    SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
-					    ERR_R_ECDH_LIB);
-					goto err;
-				}
+
+			/* Generate a new ECDH key pair */
+			if (!(EC_KEY_generate_key(clnt_ecdh))) {
+				SSLerr(
+				    SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
+				    ERR_R_ECDH_LIB);
+				goto err;
 			}
 
 			/*
@@ -2144,47 +2092,41 @@ ssl3_send_client_key_exchange(SSL *s)
 
 			memset(p, 0, n); /* clean up */
 
-			if (ecdh_clnt_cert) {
-				/* Send empty client key exch message. */
-				n = 0;
-			} else {
-				/*
-				 * First check the size of encoding and
-				 * allocate memory accordingly.
-				 */
-				encoded_pt_len = EC_POINT_point2oct(
-				    srvr_group,
-				    EC_KEY_get0_public_key(clnt_ecdh),
-				    POINT_CONVERSION_UNCOMPRESSED,
-				    NULL, 0, NULL);
-
-				encodedPoint = malloc(encoded_pt_len);
-
-				bn_ctx = BN_CTX_new();
-				if ((encodedPoint == NULL) ||
-				    (bn_ctx == NULL)) {
-					SSLerr(
-					    SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
-					    ERR_R_MALLOC_FAILURE);
-					goto err;
-				}
-
-				/* Encode the public key */
-				n = EC_POINT_point2oct(srvr_group,
-				    EC_KEY_get0_public_key(clnt_ecdh),
-				    POINT_CONVERSION_UNCOMPRESSED,
-				    encodedPoint, encoded_pt_len, bn_ctx);
+			/*
+			 * First check the size of encoding and
+			 * allocate memory accordingly.
+			 */
+			encoded_pt_len = EC_POINT_point2oct(
+				srvr_group,
+				EC_KEY_get0_public_key(clnt_ecdh),
+				POINT_CONVERSION_UNCOMPRESSED,
+				NULL, 0, NULL);
+
+			encodedPoint = malloc(encoded_pt_len);
+
+			bn_ctx = BN_CTX_new();
+			if ((encodedPoint == NULL) ||
+			    (bn_ctx == NULL)) {
+				SSLerr(
+				    SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
+				    ERR_R_MALLOC_FAILURE);
+				goto err;
+			}
 
-				*p = n; /* length of encoded point */
-				/* Encoded point will be copied here */
-				p += 1;
+			/* Encode the public key */
+			n = EC_POINT_point2oct(srvr_group,
+			    EC_KEY_get0_public_key(clnt_ecdh),
+			    POINT_CONVERSION_UNCOMPRESSED,
+			    encodedPoint, encoded_pt_len, bn_ctx);
 
-				/* copy the point */
-				memcpy((unsigned char *)p, encodedPoint, n);
-				/* increment n to account for length field */
-				n += 1;
+			*p = n; /* length of encoded point */
+			/* Encoded point will be copied here */
+			p += 1;
 
-			}
+			/* copy the point */
+			memcpy((unsigned char *)p, encodedPoint, n);
+			/* increment n to account for length field */
+			n += 1;
 
 			/* Free allocated memory */
 			BN_CTX_free(bn_ctx);