make OPENSSL_NO_HEARTBLEED the default and only option. ok deraadt miod

1 files changed, 0 insertions, 153 deletions

diff --git a/src/lib/libssl/d1_both.c b/src/lib/libssl/d1_both.c
index c051e84874..6e51aa7f69 100644
--- a/src/lib/libssl/d1_both.c
+++ b/src/lib/libssl/d1_both.c
@@ -1041,11 +1041,7 @@ dtls1_read_failed(SSL *s, int code)
                 return code;
         }
 
-#ifndef OPENSSL_NO_HEARTBEATS
-        if (!SSL_in_init(s) && !s->tlsext_hb_pending)  /* done, no need to send a retransmit */
-#else
         if (!SSL_in_init(s))  /* done, no need to send a retransmit */
-#endif
         {
                 BIO_set_flags(SSL_get_rbio(s), BIO_FLAGS_READ);
                 return code;
@@ -1386,152 +1382,3 @@ dtls1_shutdown(SSL *s)
 #endif
         return ret;
 }
-
-#ifndef OPENSSL_NO_HEARTBEATS
-int
-dtls1_process_heartbeat(SSL *s)
-{
-        unsigned char *p = &s->s3->rrec.data[0], *pl;
-        unsigned short hbtype;
-        unsigned int payload;
-        unsigned int padding = 16; /* Use minimum padding */
-
-        if (s->msg_callback)
-                s->msg_callback(0, s->version, TLS1_RT_HEARTBEAT,
-                    &s->s3->rrec.data[0], s->s3->rrec.length,
-                    s, s->msg_callback_arg);
-
-        /* Read type and payload length first */
-        if (1 + 2 + 16 > s->s3->rrec.length)
-                return 0; /* silently discard */
-        hbtype = *p++;
-        n2s(p, payload);
-        if (1 + 2 + payload + 16 > s->s3->rrec.length)
-                return 0; /* silently discard per RFC 6520 sec. 4 */
-        pl = p;
-
-        if (hbtype == TLS1_HB_REQUEST) {
-                unsigned char *buffer, *bp;
-                unsigned int write_length = 1 /* heartbeat type */ +
-                    2 /* heartbeat length */ +
-                    payload + padding;
-                int r;
-
-                if (write_length > SSL3_RT_MAX_PLAIN_LENGTH)
-                        return 0;
-
-                /* Allocate memory for the response, size is 1 byte
-                 * message type, plus 2 bytes payload length, plus
-                 * payload, plus padding
-                 */
-                buffer = OPENSSL_malloc(write_length);
-                bp = buffer;
-
-                /* Enter response type, length and copy payload */
-                *bp++ = TLS1_HB_RESPONSE;
-                s2n(payload, bp);
-                memcpy(bp, pl, payload);
-                bp += payload;
-                /* Random padding */
-                RAND_pseudo_bytes(bp, padding);
-
-                r = dtls1_write_bytes(s, TLS1_RT_HEARTBEAT, buffer, write_length);
-
-                if (r >= 0 && s->msg_callback)
-                        s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
-                            buffer, write_length,
-                            s, s->msg_callback_arg);
-
-                OPENSSL_free(buffer);
-
-                if (r < 0)
-                        return r;
-        } else if (hbtype == TLS1_HB_RESPONSE) {
-                unsigned int seq;
-
-                /* We only send sequence numbers (2 bytes unsigned int),
-                 * and 16 random bytes, so we just try to read the
-                 * sequence number */
-                n2s(pl, seq);
-
-                if (payload == 18 && seq == s->tlsext_hb_seq) {
-                        dtls1_stop_timer(s);
-                        s->tlsext_hb_seq++;
-                        s->tlsext_hb_pending = 0;
-                }
-        }
-
-        return 0;
-}
-
-int
-dtls1_heartbeat(SSL *s)
-{
-        unsigned char *buf, *p;
-        int ret;
-        unsigned int payload = 18; /* Sequence number + random bytes */
-        unsigned int padding = 16; /* Use minimum padding */
-
-        /* Only send if peer supports and accepts HB requests... */
-        if (!(s->tlsext_heartbeat & SSL_TLSEXT_HB_ENABLED) ||
-                s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_SEND_REQUESTS) {
-                SSLerr(SSL_F_DTLS1_HEARTBEAT, SSL_R_TLS_HEARTBEAT_PEER_DOESNT_ACCEPT);
-                return -1;
-        }
-
-        /* ...and there is none in flight yet... */
-        if (s->tlsext_hb_pending) {
-                SSLerr(SSL_F_DTLS1_HEARTBEAT, SSL_R_TLS_HEARTBEAT_PENDING);
-                return -1;
-        }
-
-        /* ...and no handshake in progress. */
-        if (SSL_in_init(s) || s->in_handshake) {
-                SSLerr(SSL_F_DTLS1_HEARTBEAT, SSL_R_UNEXPECTED_MESSAGE);
-                return -1;
-        }
-
-        /* Check if padding is too long, payload and padding
-         * must not exceed 2^14 - 3 = 16381 bytes in total.
-         */
-        OPENSSL_assert(payload + padding <= 16381);
-
-        /* Create HeartBeat message, we just use a sequence number
-         * as payload to distuingish different messages and add
-         * some random stuff.
-         *  - Message Type, 1 byte
-         *  - Payload Length, 2 bytes (unsigned int)
-         *  - Payload, the sequence number (2 bytes uint)
-         *  - Payload, random bytes (16 bytes uint)
-         *  - Padding
-         */
-        buf = OPENSSL_malloc(1 + 2 + payload + padding);
-        p = buf;
-        /* Message Type */
-        *p++ = TLS1_HB_REQUEST;
-        /* Payload length (18 bytes here) */
-        s2n(payload, p);
-        /* Sequence number */
-        s2n(s->tlsext_hb_seq, p);
-        /* 16 random bytes */
-        RAND_pseudo_bytes(p, 16);
-        p += 16;
-        /* Random padding */
-        RAND_pseudo_bytes(p, padding);
-
-        ret = dtls1_write_bytes(s, TLS1_RT_HEARTBEAT, buf, 3 + payload + padding);
-        if (ret >= 0) {
-                if (s->msg_callback)
-                        s->msg_callback(1, s->version, TLS1_RT_HEARTBEAT,
-                buf, 3 + payload + padding,
-                s, s->msg_callback_arg);
-
-                dtls1_start_timer(s);
-                s->tlsext_hb_pending = 1;
-        }
-
-        OPENSSL_free(buf);
-
-        return ret;
-}
-#endif