From de48c77a08514ed654e05e710444452ffab6d0aa Mon Sep 17 00:00:00 2001
From: deraadt <>
Date: Sat, 7 Jun 2014 22:23:12 +0000
Subject: 
 http://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2016265dfbab162ec30718b5e7480add42598158
 Don't know the full story, but it looks like a "can't do random perfectly, so
 do it god awful" problem was found in 2013, and replaced with "only do it
 badly if a flag is set".  New flags (SSL_MODE_SEND_SERVERHELLO_TIME and
 SSL_MODE_SEND_SERVERHELLO_TIME) were added [Ben Laurie?] to support the old
 scheme of "use time_t for first 4 bytes of the random buffer".

Nothing uses these flags [ecosystem scan by sthen]

Fully discourage use of these flags in the future by removing
support & definition of them.  The buflen < 4 check is also interesting,
because no entropy would be returned.  No callers passed such small
buffers.
ok miod sthen
---
 src/lib/libssl/ssl.h | 6 ------
 1 file changed, 6 deletions(-)

(limited to 'src/lib/libssl/ssl.h')

diff --git a/src/lib/libssl/ssl.h b/src/lib/libssl/ssl.h
index fd01ac9806..0c5d76bc23 100644
--- a/src/lib/libssl/ssl.h
+++ b/src/lib/libssl/ssl.h
@@ -611,12 +611,6 @@ struct ssl_session_st {
  * TLS only.)  "Released" buffers are put onto a free-list in the context
  * or just freed (depending on the context's setting for freelist_max_len). */
 #define SSL_MODE_RELEASE_BUFFERS 0x00000010L
-/* Send the current time in the Random fields of the ClientHello and
- * ServerHello records for compatibility with hypothetical implementations
- * that require it.
- */
-#define SSL_MODE_SEND_CLIENTHELLO_TIME 0x00000020L
-#define SSL_MODE_SEND_SERVERHELLO_TIME 0x00000040L
 
 /* Note: SSL[_CTX]_set_{options,mode} use |= op on the previous value,
  * they cannot be used to clear bits. */
-- 
cgit v1.2.3-55-g6feb