diff mbox series

[Openvpn-devel,v1] ssl_mbedtls: remove empty tls_ctx_personalise_random()

Message ID 20261104105531.7096-1-gert@greenie.muc.de
State New
Headers
Series [Openvpn-devel,v1] ssl_mbedtls: remove empty tls_ctx_personalise_random() |

Commit Message

Gert Doering Nov. 4, 2026, 10:55 a.m. UTC 
  From: Razvan Cojocaru <razvanc@mailbox.org>

Mbed TLS 4 has no application-owned CTR_DRBG to personalise, so
494fb718 ("Add support for Mbed TLS 4") limited the function body to
older versions, and 77a04d48 ("Remove Mbed TLS 3 compatibility")
removed that body but kept the empty function and its call.

Change-Id: I23c6480967d4785beada3879667d50d60d7d8df4
Signed-off-by: Razvan Cojocaru <razvanc@mailbox.org>
Acked-by: Gert Doering <gert@greenie.muc.de>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2122
---

This change was reviewed on Gerrit and approved by at least one
developer. I request to merge it to master.

Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2122
This mail reflects revision 1 of this Change.

Acked-by according to Gerrit (reflected above):
Gert Doering <gert@greenie.muc.de>
diff mbox series

Patch

diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c
index 12b6119..b701c0a 100644
--- a/src/openvpn/ssl.c
+++ b/src/openvpn/ssl.c
@@ -672,11 +672,6 @@ 
         tls_ctx_load_ecdh_params(new_ctx, options->ecdh_curve);
     }
 
-#ifdef ENABLE_CRYPTO_MBEDTLS
-    /* Personalise the random by mixing in the certificate */
-    tls_ctx_personalise_random(new_ctx);
-#endif
-
     tls_clear_error();
     return new_ctx;
 
diff --git a/src/openvpn/ssl_backend.h b/src/openvpn/ssl_backend.h
index 2150d81..b4604ea 100644
--- a/src/openvpn/ssl_backend.h
+++ b/src/openvpn/ssl_backend.h
@@ -327,17 +327,6 @@ 
 void tls_ctx_load_extra_certs(struct tls_root_ctx *ctx, const char *extra_certs_file,
                               bool extra_certs_file_inline);
 
-#ifdef ENABLE_CRYPTO_MBEDTLS
-/**
- * Add a personalisation string to the mbed TLS RNG, based on the certificate
- * loaded into the given context.
- *
- * @param ctx                   TLS context to use
- */
-void tls_ctx_personalise_random(struct tls_root_ctx *ctx);
-
-#endif
-
 /* **************************************
  *
  * Key-state specific functions
diff --git a/src/openvpn/ssl_mbedtls.c b/src/openvpn/ssl_mbedtls.c
index 8aaca96..45d7715 100644
--- a/src/openvpn/ssl_mbedtls.c
+++ b/src/openvpn/ssl_mbedtls.c
@@ -767,14 +767,6 @@ 
     msg(my_loglevel, "mbed TLS msg (%s:%d): %s", file, line, str);
 }
 
-/*
- * Further personalise the RNG using a hash of the public key
- */
-void
-tls_ctx_personalise_random(struct tls_root_ctx *ctx)
-{
-}
-
 int
 tls_version_max(void)
 {