diff options
author | yangyangtiantianlonglong <yangtianlong1224@163.com> | 2022-01-26 22:08:05 +0800 |
---|---|---|
committer | Tomas Mraz <tomas@openssl.org> | 2022-01-28 15:32:58 +0100 |
commit | a829d53a14eeae2b0bc783b7952b4212cf31d918 (patch) | |
tree | 031a1987bab62a037ab90cb39c21e36a253be9d4 | |
parent | a414fd6765bbc9bb0d630dbb4d780f44f825c8a2 (diff) |
apps: Add option -no_ems to s_client/s_server apps
The option SSL_OP_NO_EXTENDED_MASTER_SECRET was added in #3910.
And it is valid for versions below (D)TLS 1.2.
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/17597)
-rw-r--r-- | apps/include/opt.h | 10 | ||||
-rw-r--r-- | doc/man1/openssl-s_client.pod.in | 5 | ||||
-rw-r--r-- | doc/man1/openssl-s_server.pod.in | 5 | ||||
-rw-r--r-- | ssl/ssl_conf.c | 3 |
4 files changed, 20 insertions, 3 deletions
diff --git a/apps/include/opt.h b/apps/include/opt.h index 365eae5bc8..dc88bd3818 100644 --- a/apps/include/opt.h +++ b/apps/include/opt.h @@ -163,7 +163,8 @@ OPT_S_CURVES, OPT_S_NAMEDCURVE, OPT_S_CIPHER, OPT_S_CIPHERSUITES, \ OPT_S_RECORD_PADDING, OPT_S_DEBUGBROKE, OPT_S_COMP, \ OPT_S_MINPROTO, OPT_S_MAXPROTO, \ - OPT_S_NO_RENEGOTIATION, OPT_S_NO_MIDDLEBOX, OPT_S_NO_ETM, OPT_S__LAST + OPT_S_NO_RENEGOTIATION, OPT_S_NO_MIDDLEBOX, OPT_S_NO_ETM, \ + OPT_S_NO_EMS, OPT_S__LAST # define OPT_S_OPTIONS \ OPT_SECTION("TLS/SSL"), \ @@ -218,7 +219,9 @@ {"no_middlebox", OPT_S_NO_MIDDLEBOX, '-', \ "Disable TLSv1.3 middlebox compat mode" }, \ {"no_etm", OPT_S_NO_ETM, '-', \ - "Disable Encrypt-then-Mac extension"} + "Disable Encrypt-then-Mac extension"}, \ + {"no_ems", OPT_S_NO_EMS, '-', \ + "Disable Extended master secret extension"} # define OPT_S_CASES \ OPT_S__FIRST: case OPT_S__LAST: break; \ @@ -253,7 +256,8 @@ case OPT_S_MAXPROTO: \ case OPT_S_DEBUGBROKE: \ case OPT_S_NO_MIDDLEBOX: \ - case OPT_S_NO_ETM + case OPT_S_NO_ETM: \ + case OPT_S_NO_EMS #define IS_NO_PROT_FLAG(o) \ (o == OPT_S_NOSSL3 || o == OPT_S_NOTLS1 || o == OPT_S_NOTLS1_1 \ diff --git a/doc/man1/openssl-s_client.pod.in b/doc/man1/openssl-s_client.pod.in index bc6af981dc..be0f5040ff 100644 --- a/doc/man1/openssl-s_client.pod.in +++ b/doc/man1/openssl-s_client.pod.in @@ -57,6 +57,7 @@ B<openssl> B<s_client> [B<-timeout>] [B<-mtu> I<size>] [B<-no_etm>] +[B<-no_ems>] [B<-keymatexport> I<label>] [B<-keymatexportlen> I<len>] [B<-msgfile> I<filename>] @@ -454,6 +455,10 @@ Set MTU of the link layer to the specified size. Disable Encrypt-then-MAC negotiation. +=item B<-no_ems> + +Disable Extended master secret negotiation. + =item B<-keymatexport> I<label> Export keying material using the specified label. diff --git a/doc/man1/openssl-s_server.pod.in b/doc/man1/openssl-s_server.pod.in index c461a0cd73..f61ff3bc09 100644 --- a/doc/man1/openssl-s_server.pod.in +++ b/doc/man1/openssl-s_server.pod.in @@ -71,6 +71,7 @@ B<openssl> B<s_server> [B<-ign_eof>] [B<-no_ign_eof>] [B<-no_etm>] +[B<-no_ems>] [B<-status>] [B<-status_verbose>] [B<-status_timeout> I<int>] @@ -493,6 +494,10 @@ Do not ignore input EOF. Disable Encrypt-then-MAC negotiation. +=item B<-no_ems> + +Disable Extended master secret negotiation. + =item B<-status> Enables certificate status request support (aka OCSP stapling). diff --git a/ssl/ssl_conf.c b/ssl/ssl_conf.c index c0cbbe5e2c..9a5fe7171c 100644 --- a/ssl/ssl_conf.c +++ b/ssl/ssl_conf.c @@ -703,6 +703,7 @@ static const ssl_conf_cmd_tbl ssl_conf_cmds[] = { SSL_CONF_CMD_SWITCH("anti_replay", SSL_CONF_FLAG_SERVER), SSL_CONF_CMD_SWITCH("no_anti_replay", SSL_CONF_FLAG_SERVER), SSL_CONF_CMD_SWITCH("no_etm", 0), + SSL_CONF_CMD_SWITCH("no_ems", 0), SSL_CONF_CMD_STRING(SignatureAlgorithms, "sigalgs", 0), SSL_CONF_CMD_STRING(ClientSignatureAlgorithms, "client_sigalgs", 0), SSL_CONF_CMD_STRING(Curves, "curves", 0), @@ -794,6 +795,8 @@ static const ssl_switch_tbl ssl_cmd_switches[] = { {SSL_OP_NO_ANTI_REPLAY, 0}, /* no Encrypt-then-Mac */ {SSL_OP_NO_ENCRYPT_THEN_MAC, 0}, + /* no Extended master secret */ + {SSL_OP_NO_EXTENDED_MASTER_SECRET, 0}, }; static int ssl_conf_cmd_skip_prefix(SSL_CONF_CTX *cctx, const char **pcmd) |