Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

tls: refactoring SNI ctx usage for libressl support #1136

Merged
merged 9 commits into from
Jun 6, 2024
Merged

tls: refactoring SNI ctx usage for libressl support #1136

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
4a2ca4e
tls: refactoring sni ctx usage for libressl support
sreimers Jun 3, 2024
78ea67d
fix load verify locations
sreimers Jun 3, 2024
01576d9
fix cleanup
sreimers Jun 3, 2024
acaa2f3
fix ctx uninitialized goto
sreimers Jun 3, 2024
a53cde0
improve sni callback error handling
sreimers Jun 3, 2024
7e6d526
cleanup tls.h
sreimers Jun 3, 2024
b1f3961
refactor cert_store verify
sreimers Jun 5, 2024
325aaa4
check cert_store pointer
sreimers Jun 5, 2024
67630eb
refactor goto error handling
sreimers Jun 5, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
51 changes: 16 additions & 35 deletions src/tls/openssl/sni.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,12 +19,10 @@
#include "tls.h"


#define DEBUG_MODULE "tls"
#define DEBUG_MODULE "tls/sni"
#define DEBUG_LEVEL 5
#include <re_dbg.h>

#if !defined(LIBRESSL_VERSION_NUMBER)

struct tls_conn;


Expand Down Expand Up @@ -161,48 +159,33 @@ static int ssl_set_verify_client(SSL *ssl, const char *host)
}


static int ssl_use_cert(SSL *ssl, struct tls_cert *uc)
{
int err;
long r;

SSL_certs_clear(ssl);
r = SSL_clear_chain_certs(ssl);
if (r != 1)
return EINVAL;

r = SSL_use_cert_and_key(ssl, tls_cert_x509(uc), tls_cert_pkey(uc),
tls_cert_chain(uc), 1);
if (r != 1) {
ERR_clear_error();
return EINVAL;
}

err = ssl_set_verify_client(ssl, tls_cert_host(uc));
return err;
}


static int ssl_servername_handler(SSL *ssl, int *al, void *arg)
{
struct tls *tls = arg;
struct tls *tls = arg;
struct tls_cert *uc = NULL;
const char *sni;
(void)al;

sni = SSL_get_servername(ssl, TLSEXT_NAMETYPE_host_name);
if (!str_isset(sni))
goto out;
if (!str_isset(sni)) {
*al = SSL_AD_UNRECOGNIZED_NAME;
return SSL_TLSEXT_ERR_ALERT_FATAL;
}

/* find and apply matching certificate */
uc = tls_cert_for_sni(tls, sni);
if (!uc)
goto out;
if (!uc) {
*al = SSL_AD_UNRECOGNIZED_NAME;
return SSL_TLSEXT_ERR_ALERT_FATAL;
}

DEBUG_INFO("found cert for sni %s\n", sni);
(void)ssl_use_cert(ssl, uc);
if (SSL_set_SSL_CTX(ssl, tls_cert_ctx(uc)) == NULL) {
*al = SSL_AD_INTERNAL_ERROR;
return SSL_TLSEXT_ERR_ALERT_FATAL;
}

(void)ssl_set_verify_client(ssl, tls_cert_host(uc));

out:
return SSL_TLSEXT_ERR_OK;
}

Expand All @@ -218,5 +201,3 @@ void tls_enable_sni(struct tls *tls)
ssl_servername_handler);
SSL_CTX_set_tlsext_servername_arg(tls_ssl_ctx(tls), tls);
}

#endif /* !defined(LIBRESSL_VERSION_NUMBER) */
Loading
Loading