Skip to content

Commit b948ee2

Browse files
snhensonsnhenson
committed
Remove all RFC5878 code.
Remove RFC5878 code. It is no longer needed for CT and has numerous bugs
1 parent a23a6e8 commit b948ee2

File tree

18 files changed

+8
-1054
lines changed

18 files changed

+8
-1054
lines changed

‎CHANGES‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -60,10 +60,6 @@
6060

6161
[Steve Henson]
6262

63-
*) Add callbacks supporting generation and retrieval of supplemental
64-
data entries.
65-
[Scott Deboy <[email protected]>, Trevor Perrin and Ben Laurie]
66-
6763
*) Add EVP support for key wrapping algorithms, to avoid problems with
6864
existing code the flag EVP_CIPHER_CTX_WRAP_ALLOW has to be set in
6965
the EVP_CIPHER_CTX or an error is returned. Add AES and DES3 wrap
@@ -528,9 +524,6 @@
528524
*) Support for linux-x32, ILP32 environment in x86_64 framework.
529525
[Andy Polyakov]
530526

531-
*) RFC 5878 (TLS Authorization Extensions) support.
532-
[Emilia Kasper, Adam Langley, Ben Laurie (Google)]
533-
534527
*) Experimental multi-implementation support for FIPS capable OpenSSL.
535528
When in FIPS mode the approved implementations are used as normal,
536529
when not in FIPS mode the internal unapproved versions are used instead.

‎apps/s_cb.c‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -881,9 +881,6 @@ void MS_CALLBACK msg_cb(int write_p, int version, int content_type, const void *
881881
case 20:
882882
str_details1 = ", Finished";
883883
break;
884-
case 23:
885-
str_details1 = ", SupplementalData";
886-
break;
887884
}
888885
}
889886
}

‎apps/s_client.c‎

Lines changed: 0 additions & 121 deletions
Original file line numberDiff line numberDiff line change
@@ -214,46 +214,13 @@ static void sc_usage(void);
214214
static void print_stuff(BIO *berr,SSL *con,int full);
215215
#ifndef OPENSSL_NO_TLSEXT
216216
static int ocsp_resp_cb(SSL *s, void *arg);
217-
static int c_auth = 0;
218-
static int c_auth_require_reneg = 0;
219217
#endif
220218
static BIO *bio_c_out=NULL;
221219
static BIO *bio_c_msg=NULL;
222220
static int c_quiet=0;
223221
static int c_ign_eof=0;
224222
static int c_brief=0;
225223

226-
#ifndef OPENSSL_NO_TLSEXT
227-
228-
static unsigned char *generated_supp_data = NULL;
229-
230-
static const unsigned char *most_recent_supplemental_data = NULL;
231-
static size_t most_recent_supplemental_data_length = 0;
232-
233-
static int server_provided_server_authz = 0;
234-
static int server_provided_client_authz = 0;
235-
236-
static const unsigned char auth_ext_data[]={TLSEXT_AUTHZDATAFORMAT_dtcp};
237-
238-
static int suppdata_cb(SSL *s, unsigned short supp_data_type,
239-
const unsigned char *in,
240-
unsigned short inlen, int *al,
241-
void *arg);
242-
243-
static int auth_suppdata_generate_cb(SSL *s, unsigned short supp_data_type,
244-
const unsigned char **out,
245-
unsigned short *outlen, int *al, void *arg);
246-
247-
static int authz_tlsext_generate_cb(SSL *s, unsigned short ext_type,
248-
const unsigned char **out, unsigned short *outlen,
249-
int *al, void *arg);
250-
251-
static int authz_tlsext_cb(SSL *s, unsigned short ext_type,
252-
const unsigned char *in,
253-
unsigned short inlen, int *al,
254-
void *arg);
255-
#endif
256-
257224
#ifndef OPENSSL_NO_PSK
258225
/* Default PSK identity and key */
259226
static char *psk_identity="Client_identity";
@@ -396,8 +363,6 @@ static void sc_usage(void)
396363
BIO_printf(bio_err," -status - request certificate status from server\n");
397364
BIO_printf(bio_err," -no_ticket - disable use of RFC4507bis session tickets\n");
398365
BIO_printf(bio_err," -serverinfo types - send empty ClientHello extensions (comma-separated numbers)\n");
399-
BIO_printf(bio_err," -auth - send and receive RFC 5878 TLS auth extensions and supplemental data\n");
400-
BIO_printf(bio_err," -auth_require_reneg - Do not send TLS auth extensions until renegotiation\n");
401366
# ifndef OPENSSL_NO_NEXTPROTONEG
402367
BIO_printf(bio_err," -nextprotoneg arg - enable NPN extension, considering named protocols supported (comma-separated list)\n");
403368
# endif
@@ -863,10 +828,6 @@ static char *jpake_secret = NULL;
863828
c_tlsextdebug=1;
864829
else if (strcmp(*argv,"-status") == 0)
865830
c_status_req=1;
866-
else if (strcmp(*argv,"-auth") == 0)
867-
c_auth = 1;
868-
else if (strcmp(*argv,"-auth_require_reneg") == 0)
869-
c_auth_require_reneg = 1;
870831
#endif
871832
#ifdef WATT32
872833
else if (strcmp(*argv,"-wdebug") == 0)
@@ -1453,12 +1414,6 @@ static char *jpake_secret = NULL;
14531414
}
14541415

14551416
#endif
1456-
if (c_auth)
1457-
{
1458-
SSL_CTX_set_custom_cli_ext(ctx, TLSEXT_TYPE_client_authz, authz_tlsext_generate_cb, authz_tlsext_cb, bio_err);
1459-
SSL_CTX_set_custom_cli_ext(ctx, TLSEXT_TYPE_server_authz, authz_tlsext_generate_cb, authz_tlsext_cb, bio_err);
1460-
SSL_CTX_set_cli_supp_data(ctx, TLSEXT_SUPPLEMENTALDATATYPE_authz_data, suppdata_cb, auth_suppdata_generate_cb, bio_err);
1461-
}
14621417
#endif
14631418

14641419
con=SSL_new(ctx);
@@ -1807,12 +1762,6 @@ SSL_set_tlsext_status_ids(con, ids);
18071762
"CONNECTION ESTABLISHED\n");
18081763
print_ssl_summary(bio_err, con);
18091764
}
1810-
/*handshake is complete - free the generated supp data allocated in the callback */
1811-
if (generated_supp_data)
1812-
{
1813-
OPENSSL_free(generated_supp_data);
1814-
generated_supp_data = NULL;
1815-
}
18161765

18171766
print_stuff(bio_c_out,con,full_log);
18181767
if (full_log > 0) full_log--;
@@ -2463,74 +2412,4 @@ static int ocsp_resp_cb(SSL *s, void *arg)
24632412
return 1;
24642413
}
24652414

2466-
static int authz_tlsext_cb(SSL *s, unsigned short ext_type,
2467-
const unsigned char *in,
2468-
unsigned short inlen, int *al,
2469-
void *arg)
2470-
{
2471-
if (TLSEXT_TYPE_server_authz == ext_type)
2472-
server_provided_server_authz
2473-
= (memchr(in, TLSEXT_AUTHZDATAFORMAT_dtcp, inlen) != NULL);
2474-
2475-
if (TLSEXT_TYPE_client_authz == ext_type)
2476-
server_provided_client_authz
2477-
= (memchr(in, TLSEXT_AUTHZDATAFORMAT_dtcp, inlen) != NULL);
2478-
2479-
return 1;
2480-
}
2481-
2482-
static int authz_tlsext_generate_cb(SSL *s, unsigned short ext_type,
2483-
const unsigned char **out, unsigned short *outlen,
2484-
int *al, void *arg)
2485-
{
2486-
if (c_auth)
2487-
{
2488-
/*if auth_require_reneg flag is set, only send extensions if
2489-
renegotiation has occurred */
2490-
if (!c_auth_require_reneg || (c_auth_require_reneg && SSL_num_renegotiations(s)))
2491-
{
2492-
*out = auth_ext_data;
2493-
*outlen = 1;
2494-
return 1;
2495-
}
2496-
}
2497-
/* no auth extension to send */
2498-
return -1;
2499-
}
2500-
2501-
static int suppdata_cb(SSL *s, unsigned short supp_data_type,
2502-
const unsigned char *in,
2503-
unsigned short inlen, int *al,
2504-
void *arg)
2505-
{
2506-
if (supp_data_type == TLSEXT_SUPPLEMENTALDATATYPE_authz_data)
2507-
{
2508-
most_recent_supplemental_data = in;
2509-
most_recent_supplemental_data_length = inlen;
2510-
}
2511-
return 1;
2512-
}
2513-
2514-
static int auth_suppdata_generate_cb(SSL *s, unsigned short supp_data_type,
2515-
const unsigned char **out,
2516-
unsigned short *outlen, int *al, void *arg)
2517-
{
2518-
if (c_auth && server_provided_client_authz && server_provided_server_authz)
2519-
{
2520-
/*if auth_require_reneg flag is set, only send supplemental data if
2521-
renegotiation has occurred */
2522-
if (!c_auth_require_reneg
2523-
|| (c_auth_require_reneg && SSL_num_renegotiations(s)))
2524-
{
2525-
generated_supp_data = OPENSSL_malloc(10);
2526-
memcpy(generated_supp_data, "5432154321", 10);
2527-
*out = generated_supp_data;
2528-
*outlen = 10;
2529-
return 1;
2530-
}
2531-
}
2532-
/* no supplemental data to send */
2533-
return -1;
2534-
}
2535-
25362415
#endif

‎apps/s_server.c‎

Lines changed: 0 additions & 130 deletions
Original file line numberDiff line numberDiff line change
@@ -224,20 +224,6 @@ static DH *load_dh_param(const char *dhfile);
224224
static void s_server_init(void);
225225
#endif
226226

227-
#ifndef OPENSSL_NO_TLSEXT
228-
229-
static const unsigned char auth_ext_data[]={TLSEXT_AUTHZDATAFORMAT_dtcp};
230-
231-
static unsigned char *generated_supp_data = NULL;
232-
233-
static const unsigned char *most_recent_supplemental_data = NULL;
234-
static size_t most_recent_supplemental_data_length = 0;
235-
236-
static int client_provided_server_authz = 0;
237-
static int client_provided_client_authz = 0;
238-
239-
#endif
240-
241227
/* static int load_CA(SSL_CTX *ctx, char *file);*/
242228

243229
#undef BUFSIZZ
@@ -302,29 +288,9 @@ static int cert_chain = 0;
302288
#endif
303289

304290
#ifndef OPENSSL_NO_TLSEXT
305-
static int suppdata_cb(SSL *s, unsigned short supp_data_type,
306-
const unsigned char *in,
307-
unsigned short inlen, int *al,
308-
void *arg);
309-
310-
static int auth_suppdata_generate_cb(SSL *s, unsigned short supp_data_type,
311-
const unsigned char **out,
312-
unsigned short *outlen, int *al, void *arg);
313-
314-
static int authz_tlsext_generate_cb(SSL *s, unsigned short ext_type,
315-
const unsigned char **out, unsigned short *outlen,
316-
int *al, void *arg);
317-
318-
static int authz_tlsext_cb(SSL *s, unsigned short ext_type,
319-
const unsigned char *in,
320-
unsigned short inlen, int *al,
321-
void *arg);
322-
323291
static BIO *serverinfo_in = NULL;
324292
static const char *s_serverinfo_file = NULL;
325293

326-
static int c_auth = 0;
327-
static int c_auth_require_reneg = 0;
328294
#endif
329295

330296
#ifndef OPENSSL_NO_PSK
@@ -490,8 +456,6 @@ static void sv_usage(void)
490456
BIO_printf(bio_err," -naccept arg - terminate after 'arg' connections\n");
491457
#ifndef OPENSSL_NO_TLSEXT
492458
BIO_printf(bio_err," -serverinfo arg - PEM serverinfo file for certificate\n");
493-
BIO_printf(bio_err," -auth - send and receive RFC 5878 TLS auth extensions and supplemental data\n");
494-
BIO_printf(bio_err," -auth_require_reneg - Do not send TLS auth extensions until renegotiation\n");
495459
#endif
496460
BIO_printf(bio_err," -no_resumption_on_reneg - set SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION flag\n");
497461
BIO_printf(bio_err," -crl_check - check the peer certificate has not been revoked by its CA.\n" \
@@ -1178,15 +1142,7 @@ int MAIN(int argc, char *argv[])
11781142
if (--argc < 1) goto bad;
11791143
s_serverinfo_file = *(++argv);
11801144
}
1181-
else if (strcmp(*argv,"-auth") == 0)
1182-
{
1183-
c_auth = 1;
1184-
}
11851145
#endif
1186-
else if (strcmp(*argv,"-auth_require_reneg") == 0)
1187-
{
1188-
c_auth_require_reneg = 1;
1189-
}
11901146
else if (strcmp(*argv,"-certform") == 0)
11911147
{
11921148
if (--argc < 1) goto bad;
@@ -1997,12 +1953,6 @@ int MAIN(int argc, char *argv[])
19971953
ERR_print_errors(bio_err);
19981954
goto end;
19991955
}
2000-
if (c_auth)
2001-
{
2002-
SSL_CTX_set_custom_srv_ext(ctx, TLSEXT_TYPE_client_authz, authz_tlsext_cb, authz_tlsext_generate_cb, bio_err);
2003-
SSL_CTX_set_custom_srv_ext(ctx, TLSEXT_TYPE_server_authz, authz_tlsext_cb, authz_tlsext_generate_cb, bio_err);
2004-
SSL_CTX_set_srv_supp_data(ctx, TLSEXT_SUPPLEMENTALDATATYPE_authz_data, auth_suppdata_generate_cb, suppdata_cb, bio_err);
2005-
}
20061956
#endif
20071957
#ifndef OPENSSL_NO_TLSEXT
20081958
if (ctx2 && !set_cert_key_stuff(ctx2,s_cert2,s_key2, NULL, build_chain))
@@ -2722,12 +2672,6 @@ static int init_ssl_connection(SSL *con)
27222672
i=SSL_accept(con);
27232673
}
27242674
#endif
2725-
/*handshake is complete - free the generated supp data allocated in the callback */
2726-
if (generated_supp_data)
2727-
{
2728-
OPENSSL_free(generated_supp_data);
2729-
generated_supp_data = NULL;
2730-
}
27312675

27322676
if (i <= 0)
27332677
{
@@ -3615,77 +3559,3 @@ static void free_sessions(void)
36153559
}
36163560
first = NULL;
36173561
}
3618-
3619-
#ifndef OPENSSL_NO_TLSEXT
3620-
static int authz_tlsext_cb(SSL *s, unsigned short ext_type,
3621-
const unsigned char *in,
3622-
unsigned short inlen, int *al,
3623-
void *arg)
3624-
{
3625-
if (TLSEXT_TYPE_server_authz == ext_type)
3626-
client_provided_server_authz
3627-
= memchr(in, TLSEXT_AUTHZDATAFORMAT_dtcp, inlen) != NULL;
3628-
3629-
if (TLSEXT_TYPE_client_authz == ext_type)
3630-
client_provided_client_authz
3631-
= memchr(in, TLSEXT_AUTHZDATAFORMAT_dtcp, inlen) != NULL;
3632-
3633-
return 1;
3634-
}
3635-
3636-
static int authz_tlsext_generate_cb(SSL *s, unsigned short ext_type,
3637-
const unsigned char **out, unsigned short *outlen,
3638-
int *al, void *arg)
3639-
{
3640-
if (c_auth && client_provided_client_authz && client_provided_server_authz)
3641-
{
3642-
/*if auth_require_reneg flag is set, only send extensions if
3643-
renegotiation has occurred */
3644-
if (!c_auth_require_reneg
3645-
|| (c_auth_require_reneg && SSL_num_renegotiations(s)))
3646-
{
3647-
*out = auth_ext_data;
3648-
*outlen = 1;
3649-
return 1;
3650-
}
3651-
}
3652-
/* no auth extension to send */
3653-
return -1;
3654-
}
3655-
3656-
static int suppdata_cb(SSL *s, unsigned short supp_data_type,
3657-
const unsigned char *in,
3658-
unsigned short inlen, int *al,
3659-
void *arg)
3660-
{
3661-
if (supp_data_type == TLSEXT_SUPPLEMENTALDATATYPE_authz_data)
3662-
{
3663-
most_recent_supplemental_data = in;
3664-
most_recent_supplemental_data_length = inlen;
3665-
}
3666-
return 1;
3667-
}
3668-
3669-
static int auth_suppdata_generate_cb(SSL *s, unsigned short supp_data_type,
3670-
const unsigned char **out,
3671-
unsigned short *outlen, int *al, void *arg)
3672-
{
3673-
if (c_auth && client_provided_client_authz && client_provided_server_authz)
3674-
{
3675-
/*if auth_require_reneg flag is set, only send supplemental data if
3676-
renegotiation has occurred */
3677-
if (!c_auth_require_reneg
3678-
|| (c_auth_require_reneg && SSL_num_renegotiations(s)))
3679-
{
3680-
generated_supp_data = OPENSSL_malloc(10);
3681-
memcpy(generated_supp_data, "1234512345", 10);
3682-
*out = generated_supp_data;
3683-
*outlen = 10;
3684-
return 1;
3685-
}
3686-
}
3687-
/* no supplemental data to send */
3688-
return -1;
3689-
}
3690-
#endif
3691-

‎crypto/symhacks.h‎

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -210,15 +210,6 @@
210210
#undef SSL_set_not_resumable_session_callback
211211
#define SSL_set_not_resumable_session_callback SSL_set_not_resumbl_sess_cb
212212

213-
#undef tls1_send_server_supplemental_data
214-
#define tls1_send_server_supplemental_data tls1_send_server_suppl_data
215-
#undef tls1_send_client_supplemental_data
216-
#define tls1_send_client_supplemental_data tls1_send_client_suppl_data
217-
#undef tls1_get_server_supplemental_data
218-
#define tls1_get_server_supplemental_data tls1_get_server_suppl_data
219-
#undef tls1_get_client_supplemental_data
220-
#define tls1_get_client_supplemental_data tls1_get_client_suppl_data
221-
222213
/* Hack some long ENGINE names */
223214
#undef ENGINE_get_default_BN_mod_exp_crt
224215
#define ENGINE_get_default_BN_mod_exp_crt ENGINE_get_def_BN_mod_exp_crt

0 commit comments

Comments
 (0)