Flense out dead code, we don't do ecdhe_clnt_cert.

coverity ID's 21691 21698
ok miod@, "Fry it" jsing@

1 files changed, 35 insertions, 89 deletions

diff --git a/src/lib/libssl/d1_clnt.c b/src/lib/libssl/d1_clnt.c
index 261e4e996f..b087535ce1 100644
--- a/src/lib/libssl/d1_clnt.c
+++ b/src/lib/libssl/d1_clnt.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: d1_clnt.c,v 1.46 2015/07/14 05:26:32 doug Exp $ */
+/* $OpenBSD: d1_clnt.c,v 1.47 2015/07/15 18:35:34 beck Exp $ */
 /*
  * DTLS implementation written by Nagendra Modadugu
  * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
@@ -881,37 +881,8 @@ dtls1_send_client_key_exchange(SSL *s)
                 } else if (alg_k & (SSL_kECDHE|SSL_kECDHr|SSL_kECDHe)) {
                         const EC_GROUP *srvr_group = NULL;
                         EC_KEY *tkey;
-                        int ecdh_clnt_cert = 0;
                         int field_size = 0;
 
-                        /* Did we send out the client's
-                         * ECDH share for use in premaster
-                         * computation as part of client certificate?
-                         * If so, set ecdh_clnt_cert to 1.
-                         */
-                        if ((alg_k & (SSL_kECDHr|SSL_kECDHe)) &&
-                            (s->cert != NULL)) {
-                                /* XXX: For now, we do not support client
-                                 * authentication using ECDH certificates.
-                                 * To add such support, one needs to add
-                                 * code that checks for appropriate
-                                 * conditions and sets ecdh_clnt_cert to 1.
-                                 * For example, the cert have an ECC
-                                 * key on the same curve as the server's
-                                 * and the key should be authorized for
-                                 * key agreement.
-                                 *
-                                 * One also needs to add code in ssl3_connect
-                                 * to skip sending the certificate verify
-                                 * message.
-                                 *
-                                 * if ((s->cert->key->privatekey != NULL) &&
-                                 *     (s->cert->key->privatekey->type ==
-                                 *      EVP_PKEY_EC) && ...)
-                                 * ecdh_clnt_cert = 1;
-                                 */
-                        }
-
                         if (s->session->sess_cert->peer_ecdh_tmp != NULL) {
                                 tkey = s->session->sess_cert->peer_ecdh_tmp;
                         } else {
@@ -949,31 +920,12 @@ dtls1_send_client_key_exchange(SSL *s)
                                     ERR_R_EC_LIB);
                                 goto err;
                         }
-                        if (ecdh_clnt_cert) {
-                                /* Reuse key info from our certificate
-                                 * We only need our private key to perform
-                                 * the ECDH computation.
-                                 */
-                                const BIGNUM *priv_key;
-                                tkey = s->cert->key->privatekey->pkey.ec;
-                                priv_key = EC_KEY_get0_private_key(tkey);
-                                if (priv_key == NULL) {
-                                        SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
-                                            ERR_R_MALLOC_FAILURE);
-                                        goto err;
-                                }
-                                if (!EC_KEY_set_private_key(clnt_ecdh, priv_key)) {
-                                        SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
-                                            ERR_R_EC_LIB);
-                                        goto err;
-                                }
-                        } else {
-                                /* Generate a new ECDH key pair */
-                                if (!(EC_KEY_generate_key(clnt_ecdh))) {
-                                        SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
-                                            ERR_R_ECDH_LIB);
-                                        goto err;
-                                }
+
+                        /* Generate a new ECDH key pair */
+                        if (!(EC_KEY_generate_key(clnt_ecdh))) {
+                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+                                    ERR_R_ECDH_LIB);
+                                goto err;
                         }
 
                         /* use the 'p' output buffer for the ECDH key, but
@@ -999,44 +951,38 @@ dtls1_send_client_key_exchange(SSL *s)
                                 s, s->session->master_key, p, n);
                         memset(p, 0, n); /* clean up */
 
-                        if (ecdh_clnt_cert) {
-                                /* Send empty client key exch message */
-                                n = 0;
-                        } else {
-                                /* First check the size of encoding and
-                                 * allocate memory accordingly.
-                                 */
-                                encoded_pt_len = EC_POINT_point2oct(srvr_group,
-                                    EC_KEY_get0_public_key(clnt_ecdh),
-                                    POINT_CONVERSION_UNCOMPRESSED,
-                                    NULL, 0, NULL);
-
-                                encodedPoint = malloc(encoded_pt_len);
-
-                                bn_ctx = BN_CTX_new();
-                                if ((encodedPoint == NULL) ||
-                                    (bn_ctx == NULL)) {
-                                        SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
-                                            ERR_R_MALLOC_FAILURE);
-                                        goto err;
-                                }
+                        /* First check the size of encoding and
+                         * allocate memory accordingly.
+                         */
+                        encoded_pt_len = EC_POINT_point2oct(srvr_group,
+                            EC_KEY_get0_public_key(clnt_ecdh),
+                            POINT_CONVERSION_UNCOMPRESSED,
+                            NULL, 0, NULL);
 
-                                /* Encode the public key */
-                                n = EC_POINT_point2oct(srvr_group,
-                                    EC_KEY_get0_public_key(clnt_ecdh),
-                                    POINT_CONVERSION_UNCOMPRESSED,
-                                    encodedPoint, encoded_pt_len, bn_ctx);
+                        encodedPoint = malloc(encoded_pt_len);
 
-                                *p = n; /* length of encoded point */
-                                /* Encoded point will be copied here */
-                                p += 1;
+                        bn_ctx = BN_CTX_new();
+                        if ((encodedPoint == NULL) ||
+                            (bn_ctx == NULL)) {
+                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+                                    ERR_R_MALLOC_FAILURE);
+                                goto err;
+                        }
 
-                                /* copy the point */
-                                memcpy((unsigned char *)p, encodedPoint, n);
-                                /* increment n to account for length field */
-                                n += 1;
+                        /* Encode the public key */
+                        n = EC_POINT_point2oct(srvr_group,
+                            EC_KEY_get0_public_key(clnt_ecdh),
+                            POINT_CONVERSION_UNCOMPRESSED,
+                            encodedPoint, encoded_pt_len, bn_ctx);
 
-                        }
+                        *p = n; /* length of encoded point */
+                        /* Encoded point will be copied here */
+                        p += 1;
+
+                        /* copy the point */
+                        memcpy((unsigned char *)p, encodedPoint, n);
+                        /* increment n to account for length field */
+                        n += 1;
 
                         /* Free allocated memory */
                         BN_CTX_free(bn_ctx);