diff options
| author | Steffen Nurpmeso <steffen@sdaoden.eu> | 2023-01-19 22:04:46 +0100 |
|---|---|---|
| committer | Tomas Mraz <tomas@openssl.org> | 2023-01-30 09:37:00 +0100 |
| commit | 51cf034433d528876f3c235c5150c5acfe88f24d (patch) | |
| tree | 4c1abcd6851981ca4d93518f92cea46a740425d2 | |
| parent | d79bb5316e1318bd776d6b2d6723a36778e07f9d (diff) | |
| download | openssl-new-51cf034433d528876f3c235c5150c5acfe88f24d.tar.gz | |
SSL_conf_cmd: add support for IgnoreUnexpectedEOF
CLA: trivial
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20089)
| -rw-r--r-- | doc/man3/SSL_CONF_cmd.pod | 5 | ||||
| -rw-r--r-- | ssl/ssl_conf.c | 1 |
2 files changed, 6 insertions, 0 deletions
diff --git a/doc/man3/SSL_CONF_cmd.pod b/doc/man3/SSL_CONF_cmd.pod index 3717c202bd..b7555b54bf 100644 --- a/doc/man3/SSL_CONF_cmd.pod +++ b/doc/man3/SSL_CONF_cmd.pod @@ -569,6 +569,11 @@ B<SSL_OP_ENABLE_KTLS_TX_ZEROCOPY_SENDFILE>. This option only applies to Linux. KTLS sendfile on FreeBSD doesn't offer an option to disable zerocopy and always runs in this mode. +B<IgnoreUnexpectedEOF>: Equivalent to B<SSL_OP_IGNORE_UNEXPECTED_EOF>. +You should only enable this option if the protocol running over TLS can detect +a truncation attack itself, and that the application is checking for that +truncation attack. + =item B<VerifyMode> The B<value> argument is a comma separated list of flags to set. diff --git a/ssl/ssl_conf.c b/ssl/ssl_conf.c index b46b5f15d9..45c7411907 100644 --- a/ssl/ssl_conf.c +++ b/ssl/ssl_conf.c @@ -401,6 +401,7 @@ static int cmd_Options(SSL_CONF_CTX *cctx, const char *value) SSL_FLAG_TBL_INV("TxCertificateCompression", SSL_OP_NO_TX_CERTIFICATE_COMPRESSION), SSL_FLAG_TBL_INV("RxCertificateCompression", SSL_OP_NO_RX_CERTIFICATE_COMPRESSION), SSL_FLAG_TBL("KTLSTxZerocopySendfile", SSL_OP_ENABLE_KTLS_TX_ZEROCOPY_SENDFILE), + SSL_FLAG_TBL("IgnoreUnexpectedEOF", SSL_OP_IGNORE_UNEXPECTED_EOF), }; if (value == NULL) return -3; |