• M
    Separate ca_names handling for client and server · 98732979
    Matt Caswell 提交于
    SSL(_CTX)?_set_client_CA_list() was a server side only function in 1.1.0.
    If it was called on the client side then it was ignored. In 1.1.1 it now
    makes sense to have a CA list defined for both client and server (the
    client now sends it the the TLSv1.3 certificate_authorities extension).
    Unfortunately some applications were using the same SSL_CTX for both
    clients and servers and this resulted in some client ClientHellos being
    excessively large due to the number of certificate authorities being sent.
    
    This commit seperates out the CA list updated by
    SSL(_CTX)?_set_client_CA_list() and the more generic
    SSL(_CTX)?_set0_CA_list(). This means that SSL(_CTX)?_set_client_CA_list()
    still has no effect on the client side. If both CA lists are set then
    SSL(_CTX)?_set_client_CA_list() takes priority.
    
    Fixes #7411
    Reviewed-by: NViktor Dukhovni <viktor@openssl.org>
    (Merged from https://github.com/openssl/openssl/pull/7503)
    98732979
extensions.c 59.1 KB