• M
    Separate ca_names handling for client and server · b4970e8b
    Matt Caswell 提交于
    SSL(_CTX)?_set_client_CA_list() was a server side only function in 1.1.0.
    If it was called on the client side then it was ignored. In 1.1.1 it now
    makes sense to have a CA list defined for both client and server (the
    client now sends it the the TLSv1.3 certificate_authorities extension).
    Unfortunately some applications were using the same SSL_CTX for both
    clients and servers and this resulted in some client ClientHellos being
    excessively large due to the number of certificate authorities being sent.
    
    This commit seperates out the CA list updated by
    SSL(_CTX)?_set_client_CA_list() and the more generic
    SSL(_CTX)?_set0_CA_list(). This means that SSL(_CTX)?_set_client_CA_list()
    still has no effect on the client side. If both CA lists are set then
    SSL(_CTX)?_set_client_CA_list() takes priority.
    
    Fixes #7411
    Reviewed-by: NViktor Dukhovni <viktor@openssl.org>
    (Merged from https://github.com/openssl/openssl/pull/7503)
    
    (cherry picked from commit 98732979001dbb59320803713c4c91ba40234250)
    b4970e8b
extensions.c 59.1 KB