Remove client handling of RSA in ServerKeyExchange messages, along with

the associated peer_rsa_tmp goop.

This was only needed for export cipher handling and intentional RFC
violations. The export cipher suites have already been removed and
previous cleanup means that we will never send ServerKeyExchange messages
from the server side for RSA.

1 files changed, 10 insertions, 14 deletions

diff --git a/src/lib/libssl/d1_clnt.c b/src/lib/libssl/d1_clnt.c
index de5721851e..a73995ccda 100644
--- a/src/lib/libssl/d1_clnt.c
+++ b/src/lib/libssl/d1_clnt.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: d1_clnt.c,v 1.38 2014/11/27 16:03:03 jsing Exp $ */
+/* $OpenBSD: d1_clnt.c,v 1.39 2014/12/06 14:24:26 jsing Exp $ */
 /*
  * DTLS implementation written by Nagendra Modadugu
  * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
@@ -946,20 +946,16 @@ dtls1_send_client_key_exchange(SSL *s)
                         RSA *rsa;
                         unsigned char tmp_buf[SSL_MAX_MASTER_KEY_LENGTH];
 
-                        if (s->session->sess_cert->peer_rsa_tmp != NULL)
-                                rsa = s->session->sess_cert->peer_rsa_tmp;
-                        else {
-                                pkey = X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].x509);
-                                if ((pkey == NULL) ||
-                                    (pkey->type != EVP_PKEY_RSA) ||
-                                    (pkey->pkey.rsa == NULL)) {
-                                        SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
-                                            ERR_R_INTERNAL_ERROR);
-                                        goto err;
-                                }
-                                rsa = pkey->pkey.rsa;
-                                EVP_PKEY_free(pkey);
+                        pkey = X509_get_pubkey(s->session->sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].x509);
+                        if ((pkey == NULL) ||
+                            (pkey->type != EVP_PKEY_RSA) ||
+                            (pkey->pkey.rsa == NULL)) {
+                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+                                    ERR_R_INTERNAL_ERROR);
+                                goto err;
                         }
+                        rsa = pkey->pkey.rsa;
+                        EVP_PKEY_free(pkey);
 
                         tmp_buf[0] = s->client_version >> 8;
                         tmp_buf[1] = s->client_version&0xff;