diff options
| author |   deraadt <deraadt@openbsd.org> | 2014-06-07 22:23:12 +0000 |
|---|---|---|
| committer | deraadt <deraadt@openbsd.org> | 2014-06-07 22:23:12 +0000 |
| commit | fae232511e9ac3b0227f88af4baa2ea26c975e9b (patch) | |
| tree | 9065c948cef2a9e4d5574085a3cf5b4f72c1e9c2 /lib/libssl/ssl.h | |
| parent | Add missing NULL check after calling EVP_PKEY_new_mac_key(). (diff) | |
| download | wireguard-openbsd-fae232511e9ac3b0227f88af4baa2ea26c975e9b.tar.xz wireguard-openbsd-fae232511e9ac3b0227f88af4baa2ea26c975e9b.zip | |
http://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2016265dfbab162ec30718b5e7480add42598158
Don't know the full story, but it looks like a "can't do random
perfectly, so do it god awful" problem was found in 2013, and
replaced with "only do it badly if a flag is set". New flags
(SSL_MODE_SEND_SERVERHELLO_TIME and SSL_MODE_SEND_SERVERHELLO_TIME)
were added [Ben Laurie?] to support the old scheme of "use time_t
for first 4 bytes of the random buffer".
Nothing uses these flags [ecosystem scan by sthen]
Fully discourage use of these flags in the future by removing
support & definition of them. The buflen < 4 check is also interesting,
because no entropy would be returned. No callers passed such small
buffers.
ok miod sthen
Diffstat (limited to 'lib/libssl/ssl.h')
| -rw-r--r-- | lib/libssl/ssl.h | 6 |
1 files changed, 0 insertions, 6 deletions
diff --git a/lib/libssl/ssl.h b/lib/libssl/ssl.h index fd01ac98064..0c5d76bc238 100644 --- a/lib/libssl/ssl.h +++ b/lib/libssl/ssl.h @@ -611,12 +611,6 @@ struct ssl_session_st { * TLS only.) "Released" buffers are put onto a free-list in the context * or just freed (depending on the context's setting for freelist_max_len). */ #define SSL_MODE_RELEASE_BUFFERS 0x00000010L -/* Send the current time in the Random fields of the ClientHello and - * ServerHello records for compatibility with hypothetical implementations - * that require it. - */ -#define SSL_MODE_SEND_CLIENTHELLO_TIME 0x00000020L -#define SSL_MODE_SEND_SERVERHELLO_TIME 0x00000040L /* Note: SSL[_CTX]_set_{options,mode} use |= op on the previous value, * they cannot be used to clear bits. */ |