From c982bc5d2443b7bdba62e86f16bbb7862376eecd Mon Sep 17 00:00:00 2001
From: beck <>
Date: Wed, 27 Jan 2016 02:11:36 +0000
Subject: deprecate SSL_OP_SINGLE_DH_USE ok jsing@

---
 src/lib/libssl/src/ssl/s3_lib.c  | 18 +-----------------
 src/lib/libssl/src/ssl/s3_srvr.c | 25 +++++--------------------
 2 files changed, 6 insertions(+), 37 deletions(-)

diff --git a/src/lib/libssl/src/ssl/s3_lib.c b/src/lib/libssl/src/ssl/s3_lib.c
index c6062934dc..c31486d477 100644
--- a/src/lib/libssl/src/ssl/s3_lib.c
+++ b/src/lib/libssl/src/ssl/s3_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: s3_lib.c,v 1.95 2015/02/08 22:06:49 miod Exp $ */
+/* $OpenBSD: s3_lib.c,v 1.95.4.1 2016/01/27 02:11:34 beck Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -2176,14 +2176,6 @@ ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
 				    ERR_R_DH_LIB);
 				return (ret);
 			}
-			if (!(s->options & SSL_OP_SINGLE_DH_USE)) {
-				if (!DH_generate_key(dh)) {
-					DH_free(dh);
-					SSLerr(SSL_F_SSL3_CTRL,
-					    ERR_R_DH_LIB);
-					return (ret);
-				}
-			}
 			DH_free(s->cert->dh_tmp);
 			s->cert->dh_tmp = dh;
 			ret = 1;
@@ -2367,14 +2359,6 @@ ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)
 				    ERR_R_DH_LIB);
 				return 0;
 			}
-			if (!(ctx->options & SSL_OP_SINGLE_DH_USE)) {
-				if (!DH_generate_key(new)) {
-					SSLerr(SSL_F_SSL3_CTX_CTRL,
-					    ERR_R_DH_LIB);
-					DH_free(new);
-					return 0;
-				}
-			}
 			DH_free(cert->dh_tmp);
 			cert->dh_tmp = new;
 			return 1;
diff --git a/src/lib/libssl/src/ssl/s3_srvr.c b/src/lib/libssl/src/ssl/s3_srvr.c
index 0bff0204d9..1b83711143 100644
--- a/src/lib/libssl/src/ssl/s3_srvr.c
+++ b/src/lib/libssl/src/ssl/s3_srvr.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: s3_srvr.c,v 1.100 2015/02/25 03:49:21 bcook Exp $ */
+/* $OpenBSD: s3_srvr.c,v 1.100.4.1 2016/01/27 02:11:34 beck Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -1367,25 +1367,10 @@ ssl3_send_server_key_exchange(SSL *s)
 				goto err;
 			}
 			s->s3->tmp.dh = dh;
-
-			if ((dhp->pub_key == NULL || dhp->priv_key == NULL ||
-			    (s->options & SSL_OP_SINGLE_DH_USE))) {
-				if (!DH_generate_key(dh)) {
-					SSLerr(
-					    SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,
-					    ERR_R_DH_LIB);
-					goto err;
-				}
-			} else {
-				dh->pub_key = BN_dup(dhp->pub_key);
-				dh->priv_key = BN_dup(dhp->priv_key);
-				if ((dh->pub_key == NULL) ||
-					(dh->priv_key == NULL)) {
-					SSLerr(
-					    SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,
-					    ERR_R_DH_LIB);
-					goto err;
-				}
+			if (!DH_generate_key(dh)) {
+				SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,
+				    ERR_R_DH_LIB);
+				goto err;
 			}
 			r[0] = dh->p;
 			r[1] = dh->g;
-- 
cgit v1.2.3-55-g6feb