diff options
| author | Dmitry Belyavskiy <beldmit@gmail.com> | 2021-06-14 11:40:31 +0200 |
|---|---|---|
| committer | Dmitry Belyavskiy <beldmit@gmail.com> | 2021-06-15 22:14:34 +0200 |
| commit | 4832560be3b2a709557497cd881f8c390ba7ec34 (patch) | |
| tree | 19277b7328dcc0c3b3365f6e7ec2cef242ded61c /ssl/ssl_conf.c | |
| parent | TEST: Make test/recipes/01-test_symbol_presence.t more platform agnostic (diff) | |
| download | openssl-4832560be3b2a709557497cd881f8c390ba7ec34.tar.xz openssl-4832560be3b2a709557497cd881f8c390ba7ec34.zip | |
Disabling Encrypt-then-MAC extension in s_client/s_server
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15735)
Diffstat (limited to 'ssl/ssl_conf.c')
| -rw-r--r-- | ssl/ssl_conf.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/ssl/ssl_conf.c b/ssl/ssl_conf.c index b15c847176..c0cbbe5e2c 100644 --- a/ssl/ssl_conf.c +++ b/ssl/ssl_conf.c @@ -676,7 +676,8 @@ typedef struct { #define SSL_CONF_CMD_SWITCH(name, flags) \ {0, NULL, name, flags, SSL_CONF_TYPE_NONE} -/* See apps/apps.h if you change this table. */ +/* See apps/include/opt.h if you change this table. */ +/* The SSL_CONF_CMD_SWITCH should be the same order as ssl_cmd_switches */ static const ssl_conf_cmd_tbl ssl_conf_cmds[] = { SSL_CONF_CMD_SWITCH("no_ssl3", 0), SSL_CONF_CMD_SWITCH("no_tls1", 0), @@ -701,6 +702,7 @@ static const ssl_conf_cmd_tbl ssl_conf_cmds[] = { SSL_CONF_CMD_SWITCH("no_middlebox", 0), SSL_CONF_CMD_SWITCH("anti_replay", SSL_CONF_FLAG_SERVER), SSL_CONF_CMD_SWITCH("no_anti_replay", SSL_CONF_FLAG_SERVER), + SSL_CONF_CMD_SWITCH("no_etm", 0), SSL_CONF_CMD_STRING(SignatureAlgorithms, "sigalgs", 0), SSL_CONF_CMD_STRING(ClientSignatureAlgorithms, "client_sigalgs", 0), SSL_CONF_CMD_STRING(Curves, "curves", 0), @@ -790,6 +792,8 @@ static const ssl_switch_tbl ssl_cmd_switches[] = { {SSL_OP_NO_ANTI_REPLAY, SSL_TFLAG_INV}, /* no_anti_replay */ {SSL_OP_NO_ANTI_REPLAY, 0}, + /* no Encrypt-then-Mac */ + {SSL_OP_NO_ENCRYPT_THEN_MAC, 0}, }; static int ssl_conf_cmd_skip_prefix(SSL_CONF_CTX *cctx, const char **pcmd) |