mirror/openssl
2
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2025-03-31 20:10:45 +08:00
Code Issues Packages Projects Releases Wiki Activity

Clarify serverinfo usage with Certificate messages

Browse Source 
Ensure that serverinfo only gets added for the first Certificate in a list.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3298)
This commit is contained in:
Matt Caswell 2017-04-25 12:42:17 +01:00
parent fb29c0f070
commit f233a9d181
2 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
doc/man3/SSL_CTX_use_serverinfo.pod
View File

@ -33,7 +33,9 @@ byte array provided in B<*serverinfo> which is of length B<serverinfo_length>.
If B<version> is B<SSL_SERVERINFOV2> then the extensions in the array must
consist of a 4-byte context, a 2-byte Extension Type, a 2-byte length, and then
length bytes of extension_data. The context and type values have the same
meaning as for L<SSL_CTX_add_custom_ext(3)>.
meaning as for L<SSL_CTX_add_custom_ext(3)>. If serverinfo is being loaded for
extensions to be added to a Certificate message, then the extension will only
be added for the first Certificate in the message.
If B<version> is B<SSL_SERVERINFOV1> then the extensions in the array must
consist of a 2-byte Extension Type, a 2-byte length, and then length bytes of

4
ssl/ssl_rsa.c
View File

@ -758,6 +758,10 @@ static int serverinfoex_srv_add_cb(SSL *s, unsigned int ext_type,
const unsigned char *serverinfo = NULL;
size_t serverinfo_length = 0;
/* We only support extensions for the first Certificate */
if ((context & SSL_EXT_TLS1_3_CERTIFICATE) != 0 && chainidx > 0)
return 0;
/* Is there serverinfo data for the chosen server cert? */
if ((ssl_get_server_cert_serverinfo(s, &serverinfo,
&serverinfo_length)) != 0) {