From patchwork Wed Nov 4 10:55:26 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gert Doering X-Patchwork-Id: 5589 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:6022:30a9:b0:118:2077:975e with SMTP id f41csp184252laa; Wed, 4 Nov 2026 02:56:15 -0800 (PST) X-Forwarded-Encrypted: i=2; AKwUvBz5ej7DlW8SvTkjI5B0Ehgkpr11LARB4sUwPyCeFVO0uoMqeDhFLeBubUuGS3c+nvYxX0aybOwx2UE=@openvpn.net X-Received: by 2002:a05:7022:7e0c:b0:192:fd91:c567 with SMTP id a92af1059eb24-1ac5d88cb60mr24691406c88.11.1793789774873; Wed, 04 Nov 2026 02:56:14 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1793789774; cv=none; d=google.com; s=arc-20260327; b=SwpyVYbSrSkKmhEoRmuvmqcMaWDgdBazYNv6/FYWEnAW+at4HBCs7f7J0SgwIp3VRj E9XfQS311mwJjFUepPba9/RBrA8okqgMkhj3q503PSJW/pegzHFahfyE5+L0tBikhsaE fnsPGkoWK4VDPCjBzqWrOw6gu6mGONO06cRbczVTCoY747YF0lRM/is+Q059u5bHP9yH rZqhAx9mJ3u5G6OgUb+z0n7kNOVyQumV0EMo2hNpYBFumyiw8mW/fnty/veRUsckXbr/ 16gjXMARpj1ZmvEGj9LnXVx6ErWWm/L/NkQ3ZZj9vj9aUC2fnV1eYAQtMbVwPovFb6MV I2lA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature; bh=7b6coYREGBFAoVbvBaJkIKc374tiYKoSmZaZx788exQ=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=HZw+vwmi97dD5B+EY5ty3B68RHCm57gurAOe5mpGHIZRDpnwlcp/mpf8va2eNgN046 NqBO+L7GQmginZuxOFitNTwR9Dhn+mN56XmLjkVe0GHfYhXo5YOYoD2mjPWMW7c7jbiy GF0/HJgRyQU0gYxozEKR0tq7mHskkolvaCNHKVqI8dIaZ5OE8ww0K0mHK01q7zBfi7H1 a1J22++jjEn3PoSUqtxGo1d3Bvl/jEd6pX84666hCiLp2CYJlgI20dtLC9bJvLt4M3/e ANS+V9+uKzwogjZQ0D+eEx834V7JLIRyjbTiXXyn1vlc3dptyJQsOoWk6Kyh1qz/3xjh +GFQ==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=QzxWNtG8; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=GX3KLnbC; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=AlXyvF17; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id a92af1059eb24-1b245c3fd3bsi5983602c88.44.2026.11.04.02.56.13 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 04 Nov 2026 02:56:14 -0800 (PST) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=QzxWNtG8; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=GX3KLnbC; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=AlXyvF17; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Unsubscribe-Post: List-Owner; bh=7b6coYREGBFAoVbvBaJkIKc374tiYKoSmZaZx788exQ=; b=QzxWNtG8woF8qd aGwqMSsy5jyQBHHWcGqCZkfCmNFjQ4Qg5NH9eQmNDkaLMR+MdOwOWNNdT+5HzekEyX3Ej6GQDE7AS 0WUfqq2tKFlDFcAD6ZM4eW2HsQ8XKEzh32ZCt6egaG/sjExh1iE2XQGmJZu0KmeNCrBe7k9hEZHHP fj4=; Received: from [127.0.0.1] (helo=sfs-ml-4.v29.lw.sourceforge.com) by sfs-ml-4.v29.lw.sourceforge.com with esmtp (Exim 4.100.1) (envelope-from ) id 1xOYf7-0000000061f-0NuI; Wed, 04 Nov 2026 10:56:13 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-4.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.100.1) (envelope-from ) id 1xOYf3-00000000616-3d6A for openvpn-devel@lists.sourceforge.net; Wed, 04 Nov 2026 10:56:09 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Unsubscribe-Post:List-Subscribe:List-Post:List-Owner:List-Archive; bh=sT1zWDAz+AnVdtV4rBk3PRWikG921VuRBcABV6hVRg4=; b=GX3KLnbCv78PWnoK8meB3snY/L MvD0stobYRwwHMYmv87jV5Ynw0pNSnwJM4MQlnqQHY2MyAU5Hp2Y6h6C2BnPVqhqMsz7jRO2LuwIZ kgmlUeADeKNsQFx/8owKoI0VO7GWr/2v30Uq0bxOrNVQxBx2P5mKnHHNjg8zBq4U2nu0=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Unsubscribe-Post: List-Subscribe:List-Post:List-Owner:List-Archive; bh=sT1zWDAz+AnVdtV4rBk3PRWikG921VuRBcABV6hVRg4=; b=AlXyvF17hU8EJGKZ/omtsg8mXj 8xrFmT+1iRCHM2lRJv2HvdUwHomFRSROQQ7ND1fCrzEIrHxBVSHuKVUnzOBy1PvYT9Pj05C/MQesv Yx2JojQsmekr5IGRCy6Fe7jI2MpNU6NCdbcsWxlh0Jgv4E/MBfv9TJsYsqdD6zvZ9WZU=; Received: from [193.149.48.129] (helo=blue.greenie.muc.de) by sfi-mx-1.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.100.1) id 1xOYeZ-0000000064c-0bHk for openvpn-devel@lists.sourceforge.net; Wed, 04 Nov 2026 10:55:40 +0000 Received: from blue.greenie.muc.de (localhost [127.0.0.1]) by blue.greenie.muc.de (8.18.1/8.18.1) with ESMTP id 6A4AtVp2007116 for ; Wed, 4 Nov 2026 11:55:31 +0100 Received: (from gert@localhost) by blue.greenie.muc.de (8.18.2/8.18.1/Submit) id 6A4AtVki007115 for openvpn-devel@lists.sourceforge.net; Wed, 4 Nov 2026 11:55:31 +0100 From: Gert Doering To: openvpn-devel@lists.sourceforge.net Date: Wed, 4 Nov 2026 11:55:26 +0100 Message-ID: <20261104105531.7096-1-gert@greenie.muc.de> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Score: 1.3 (+) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-2.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: Razvan Cojocaru Mbed TLS 4 has no application-owned CTR_DRBG to personalise, so 494fb718 ("Add support for Mbed TLS 4") limited the function body to older versions, and 77a04d48 ("Remove Mbed TLS 3 compatibility") re [...] Content analysis details: (1.3 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 1.3 RDNS_NONE Delivered to internal network by a host with no rDNS X-Headers-End: 1xOYeZ-0000000064c-0bHk Subject: [Openvpn-devel] [PATCH v1] ssl_mbedtls: remove empty tls_ctx_personalise_random() X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1880924907368595230 X-GMAIL-MSGID: 1880924907368595230 From: Razvan Cojocaru Mbed TLS 4 has no application-owned CTR_DRBG to personalise, so 494fb718 ("Add support for Mbed TLS 4") limited the function body to older versions, and 77a04d48 ("Remove Mbed TLS 3 compatibility") removed that body but kept the empty function and its call. Change-Id: I23c6480967d4785beada3879667d50d60d7d8df4 Signed-off-by: Razvan Cojocaru Acked-by: Gert Doering Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2122 --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2122 This mail reflects revision 1 of this Change. Acked-by according to Gerrit (reflected above): Gert Doering diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c index 12b6119..b701c0a 100644 --- a/src/openvpn/ssl.c +++ b/src/openvpn/ssl.c @@ -672,11 +672,6 @@ tls_ctx_load_ecdh_params(new_ctx, options->ecdh_curve); } -#ifdef ENABLE_CRYPTO_MBEDTLS - /* Personalise the random by mixing in the certificate */ - tls_ctx_personalise_random(new_ctx); -#endif - tls_clear_error(); return new_ctx; diff --git a/src/openvpn/ssl_backend.h b/src/openvpn/ssl_backend.h index 2150d81..b4604ea 100644 --- a/src/openvpn/ssl_backend.h +++ b/src/openvpn/ssl_backend.h @@ -327,17 +327,6 @@ void tls_ctx_load_extra_certs(struct tls_root_ctx *ctx, const char *extra_certs_file, bool extra_certs_file_inline); -#ifdef ENABLE_CRYPTO_MBEDTLS -/** - * Add a personalisation string to the mbed TLS RNG, based on the certificate - * loaded into the given context. - * - * @param ctx TLS context to use - */ -void tls_ctx_personalise_random(struct tls_root_ctx *ctx); - -#endif - /* ************************************** * * Key-state specific functions diff --git a/src/openvpn/ssl_mbedtls.c b/src/openvpn/ssl_mbedtls.c index 8aaca96..45d7715 100644 --- a/src/openvpn/ssl_mbedtls.c +++ b/src/openvpn/ssl_mbedtls.c @@ -767,14 +767,6 @@ msg(my_loglevel, "mbed TLS msg (%s:%d): %s", file, line, str); } -/* - * Further personalise the RNG using a hash of the public key - */ -void -tls_ctx_personalise_random(struct tls_root_ctx *ctx) -{ -} - int tls_version_max(void) {