deprecate SSL_OP_SINGLE_DH_USElibressl-v2.1.10OPENBSD_5_7

ok jsing@

2 files changed, 6 insertions, 37 deletions

diff --git a/src/lib/libssl/src/ssl/s3_lib.c b/src/lib/libssl/src/ssl/s3_lib.c
index c6062934dc..c31486d477 100644
--- a/src/lib/libssl/src/ssl/s3_lib.c
+++ b/src/lib/libssl/src/ssl/s3_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: s3_lib.c,v 1.95 2015/02/08 22:06:49 miod Exp $ */
+/* $OpenBSD: s3_lib.c,v 1.95.4.1 2016/01/27 02:11:34 beck Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -2176,14 +2176,6 @@ ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
                                     ERR_R_DH_LIB);
                                 return (ret);
                         }
-                        if (!(s->options & SSL_OP_SINGLE_DH_USE)) {
-                                if (!DH_generate_key(dh)) {
-                                        DH_free(dh);
-                                        SSLerr(SSL_F_SSL3_CTRL,
-                                            ERR_R_DH_LIB);
-                                        return (ret);
-                                }
-                        }
                         DH_free(s->cert->dh_tmp);
                         s->cert->dh_tmp = dh;
                         ret = 1;
@@ -2367,14 +2359,6 @@ ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)
                                     ERR_R_DH_LIB);
                                 return 0;
                         }
-                        if (!(ctx->options & SSL_OP_SINGLE_DH_USE)) {
-                                if (!DH_generate_key(new)) {
-                                        SSLerr(SSL_F_SSL3_CTX_CTRL,
-                                            ERR_R_DH_LIB);
-                                        DH_free(new);
-                                        return 0;
-                                }
-                        }
                         DH_free(cert->dh_tmp);
                         cert->dh_tmp = new;
                         return 1;
diff --git a/src/lib/libssl/src/ssl/s3_srvr.c b/src/lib/libssl/src/ssl/s3_srvr.c
index 0bff0204d9..1b83711143 100644
--- a/src/lib/libssl/src/ssl/s3_srvr.c
+++ b/src/lib/libssl/src/ssl/s3_srvr.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: s3_srvr.c,v 1.100 2015/02/25 03:49:21 bcook Exp $ */
+/* $OpenBSD: s3_srvr.c,v 1.100.4.1 2016/01/27 02:11:34 beck Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -1367,25 +1367,10 @@ ssl3_send_server_key_exchange(SSL *s)
                                 goto err;
                         }
                         s->s3->tmp.dh = dh;
-
-                        if ((dhp->pub_key == NULL || dhp->priv_key == NULL ||
-                            (s->options & SSL_OP_SINGLE_DH_USE))) {
-                                if (!DH_generate_key(dh)) {
-                                        SSLerr(
-                                            SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,
-                                            ERR_R_DH_LIB);
-                                        goto err;
-                                }
-                        } else {
-                                dh->pub_key = BN_dup(dhp->pub_key);
-                                dh->priv_key = BN_dup(dhp->priv_key);
-                                if ((dh->pub_key == NULL) ||
-                                        (dh->priv_key == NULL)) {
-                                        SSLerr(
-                                            SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,
-                                            ERR_R_DH_LIB);
-                                        goto err;
-                                }
+                        if (!DH_generate_key(dh)) {
+                                SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,
+                                    ERR_R_DH_LIB);
+                                goto err;
                         }
                         r[0] = dh->p;
                         r[1] = dh->g;