diff options
| author | Dr. Stephen Henson <steve@openssl.org> | 2012-12-26 14:26:53 +0000 |
|---|---|---|
| committer | Dr. Stephen Henson <steve@openssl.org> | 2012-12-26 14:26:53 +0000 |
| commit | 484f8762352351598ffab55be6e6612891c291b7 (patch) | |
| tree | 1f7fe7b1b30e2296b25c5cddacf2787568b86ad5 /apps/s_server.c | |
| parent | c70a1fee71119a9005b1f304a3bf47694b4a53ac (diff) | |
Add new "valid_flags" field to CERT_PKEY structure which determines what
the certificate can be used for (if anything). Set valid_flags field
in new tls1_check_chain function. Simplify ssl_set_cert_masks which used
to have similar checks in it.
Add new "cert_flags" field to CERT structure and include a "strict mode".
This enforces some TLS certificate requirements (such as only permitting
certificate signature algorithms contained in the supported algorithms
extension) which some implementations ignore: this option should be used
with caution as it could cause interoperability issues.
(backport from HEAD)
Diffstat (limited to 'apps/s_server.c')
| -rw-r--r-- | apps/s_server.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/apps/s_server.c b/apps/s_server.c index 002f45399a..b9751bc10e 100644 --- a/apps/s_server.c +++ b/apps/s_server.c @@ -949,6 +949,7 @@ int MAIN(int argc, char *argv[]) int badop=0,bugs=0; int ret=1; int off=0; + int cert_flags = 0; int no_tmp_rsa=0,no_dhe=0,no_ecdhe=0,nocert=0; int state=0; const SSL_METHOD *meth=NULL; @@ -1373,6 +1374,8 @@ int MAIN(int argc, char *argv[]) keymatexportlen=atoi(*(++argv)); if (keymatexportlen == 0) goto bad; } + else if (strcmp(*argv, "-cert_strict") == 0) + cert_flags |= SSL_CERT_FLAG_TLS_STRICT; else { BIO_printf(bio_err,"unknown option %s\n",*argv); @@ -1590,6 +1593,7 @@ bad: if (bugs) SSL_CTX_set_options(ctx,SSL_OP_ALL); if (hack) SSL_CTX_set_options(ctx,SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG); SSL_CTX_set_options(ctx,off); + if (cert_flags) SSL_CTX_set_cert_flags(ctx, cert_flags); /* DTLS: partial reads end up discarding unread UDP bytes :-( * Setting read ahead solves this problem. */ @@ -1661,6 +1665,7 @@ bad: if (bugs) SSL_CTX_set_options(ctx2,SSL_OP_ALL); if (hack) SSL_CTX_set_options(ctx2,SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG); SSL_CTX_set_options(ctx2,off); + if (cert_flags) SSL_CTX_set_cert_flags(ctx2, cert_flags); /* DTLS: partial reads end up discarding unread UDP bytes :-( * Setting read ahead solves this problem. */ |