Added priority string %DISABLE_WILDCARDS.

This will disable any wildcard matching when comparing hostnames
in certificates.

diff --git a/NEWS b/NEWS
index 0b0ba4850b3133eddd510d5107b28f392e28f30c..58090a26d0db2c89861e6e5fe52933bfeed549d1 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -71,6 +71,8 @@ distribution.
 
 ** libgnutls: Reduced the number of gnulib modules used.
 
+** libgnutls: Added priority string %DISABLE_WILDCARDS.
+
 ** certtool: Timestamps for serial numbers were increased to 8 bytes,
 and in batch mode to 12 (appended with 4 random bytes).
 

diff --git a/doc/cha-gtls-app.texi b/doc/cha-gtls-app.texi
index 053784babf6f650f7502c0f31d92aebbe2e75715..0aad35fbe99edffa7eed5d397e1ff7bc28c9e27c 100644 (file)
--- a/doc/cha-gtls-app.texi
+++ b/doc/cha-gtls-app.texi
@@ -1105,6 +1105,10 @@ is in control of input data. This has to be used only when the
 data that are possibly controlled by an attacker are placed in
 separate records.
 
+@item %DISABLE_WILDCARDS @tab
+will disable matching wildcards when comparing hostnames
+in certificates.
+
 @item %DISABLE_SAFE_RENEGOTIATION @tab
 will completely disable safe renegotiation
 completely.  Do not use unless you know what you are doing.

diff --git a/lib/gnutls_priority.c b/lib/gnutls_priority.c
index 8ff2b481636313a1103908ecd34fc294c85d65ab..bd142a07399305423c839c9bd46f0a0d3bb3052f 100644 (file)
--- a/lib/gnutls_priority.c
+++ b/lib/gnutls_priority.c
@@ -786,6 +786,10 @@ static void enable_stateless_compression(gnutls_priority_t c)
 {
        c->stateless_compression = 1;
 }
+static void disable_wildcards(gnutls_priority_t c)
+{
+       c->additional_verify_flags |= GNUTLS_VERIFY_DO_NOT_ALLOW_WILDCARDS;
+}
 static void enable_profile_low(gnutls_priority_t c)
 {
        c->additional_verify_flags &= 0x00ffffff;

diff --git a/lib/priority_options.gperf b/lib/priority_options.gperf
index 683d37e4f640171acf00235894331c5ef4a269c9..fd081c5083915bd921540192d90d18519974ff6b 100644 (file)
--- a/lib/priority_options.gperf
+++ b/lib/priority_options.gperf
@@ -19,6 +19,7 @@ UNSAFE_RENEGOTIATION, enable_unsafe_renegotiation
 SAFE_RENEGOTIATION, enable_safe_renegotiation
 PARTIAL_RENEGOTIATION, enable_partial_safe_renegotiation
 DISABLE_SAFE_RENEGOTIATION, disable_safe_renegotiation
+DISABLE_WILDCARDS, disable_wildcards
 SERVER_PRECEDENCE, enable_server_precedence
 PROFILE_LOW, enable_profile_low
 PROFILE_LEGACY, enable_profile_legacy