From: Hugo Landau Date: Mon, 16 Jan 2023 15:21:57 +0000 (+0000) Subject: QUIC: Prohibit post-handshake auth X-Git-Tag: openssl-3.2.0-alpha1~527 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7163617f3310a2d8579388866a156df62b78bd69;p=thirdparty%2Fopenssl.git QUIC: Prohibit post-handshake auth Reviewed-by: Tomas Mraz Reviewed-by: Matt Caswell Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/20061) --- diff --git a/doc/man3/SSL_CTX_set_verify.pod b/doc/man3/SSL_CTX_set_verify.pod index 9d4abac30eb..3af04038543 100644 --- a/doc/man3/SSL_CTX_set_verify.pod +++ b/doc/man3/SSL_CTX_set_verify.pod @@ -215,6 +215,8 @@ Only one certificate request may be outstanding at any time. When post-handshake authentication occurs, a refreshed NewSessionTicket message is sent to the client. +Post-handshake authentication cannot be used with QUIC. + =head1 BUGS In client mode, it is not checked whether the SSL_VERIFY_PEER flag diff --git a/ssl/quic/quic_impl.c b/ssl/quic/quic_impl.c index 68f3c21cd50..3374045c37e 100644 --- a/ssl/quic/quic_impl.c +++ b/ssl/quic/quic_impl.c @@ -331,7 +331,8 @@ SSL *ossl_quic_new(SSL_CTX *ctx) sc->s3.flags |= TLS1_FLAGS_QUIC; /* Restrict options derived from the SSL_CTX. */ - sc->options &= OSSL_QUIC_PERMITTED_OPTIONS; + sc->options &= OSSL_QUIC_PERMITTED_OPTIONS; + sc->pha_enabled = 0; #if defined(OPENSSL_THREADS) if ((qc->mutex = ossl_crypto_mutex_new()) == NULL)