diff options
| author | Nikolay Morozov <nmorozoff77@yandex.ru> | 2020-05-02 11:22:43 +0200 |
|---|---|---|
| committer | Dmitry Belyavskiy <beldmit@gmail.com> | 2020-05-07 15:14:47 +0200 |
| commit | 90fc2c26df23811be080093772b2161850385863 (patch) | |
| tree | a372be0919b9ba64d7606b50a1297b8dabbc5371 /ssl | |
| parent | Add documentation for CMS_EnvelopedData_create() (diff) | |
| download | openssl-90fc2c26df23811be080093772b2161850385863.tar.xz openssl-90fc2c26df23811be080093772b2161850385863.zip | |
SSL_OP_DISABLE_TLSEXT_CA_NAMES option implementation
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/11709)
Diffstat (limited to 'ssl')
| -rw-r--r-- | ssl/ssl_conf.c | 5 | ||||
| -rw-r--r-- | ssl/statem/statem_lib.c | 2 |
2 files changed, 4 insertions, 3 deletions
diff --git a/ssl/ssl_conf.c b/ssl/ssl_conf.c index 9408acc89e..aefe8ad203 100644 --- a/ssl/ssl_conf.c +++ b/ssl/ssl_conf.c @@ -1,5 +1,5 @@ /* - * Copyright 2012-2018 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2012-2020 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -383,7 +383,8 @@ static int cmd_Options(SSL_CONF_CTX *cctx, const char *value) SSL_FLAG_TBL("PrioritizeChaCha", SSL_OP_PRIORITIZE_CHACHA), SSL_FLAG_TBL("MiddleboxCompat", SSL_OP_ENABLE_MIDDLEBOX_COMPAT), SSL_FLAG_TBL_INV("AntiReplay", SSL_OP_NO_ANTI_REPLAY), - SSL_FLAG_TBL_INV("ExtendedMasterSecret", SSL_OP_NO_EXTENDED_MASTER_SECRET) + SSL_FLAG_TBL_INV("ExtendedMasterSecret", SSL_OP_NO_EXTENDED_MASTER_SECRET), + SSL_FLAG_TBL_INV("CANames", SSL_OP_DISABLE_TLSEXT_CA_NAMES) }; if (value == NULL) return -3; diff --git a/ssl/statem/statem_lib.c b/ssl/statem/statem_lib.c index 262fe355f3..36cdc1be58 100644 --- a/ssl/statem/statem_lib.c +++ b/ssl/statem/statem_lib.c @@ -2342,7 +2342,7 @@ int construct_ca_names(SSL *s, const STACK_OF(X509_NAME) *ca_sk, WPACKET *pkt) return 0; } - if (ca_sk != NULL) { + if ((ca_sk != NULL) && !(s->options & SSL_OP_DISABLE_TLSEXT_CA_NAMES)) { int i; for (i = 0; i < sk_X509_NAME_num(ca_sk); i++) { |