提交 45a23530 编写于 作者: B Benjamin Kaduk 提交者: Benjamin Kaduk

Fix ossl_shim SNI handling

To start with, actually set an SNI callback (copied from bssl_shim); we
weren't actually testing much otherwise (and just happened to have been
passing due to buggy libssl behavior prior to
commit 1c4aa31d).

Also use proper C++ code for handling C strings -- when a C API
(SSL_get_servername()) returns NULL instead of a string, special-case
that instead of blindly trying to compare NULL against a std::string,
and perform the comparsion using the std::string operators instead of
falling back to pointer comparison.
Reviewed-by: NRichard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6792)
上级 9d91530d
...@@ -459,6 +459,20 @@ static int CustomExtensionParseCallback(SSL *ssl, unsigned extension_value, ...@@ -459,6 +459,20 @@ static int CustomExtensionParseCallback(SSL *ssl, unsigned extension_value,
return 1; return 1;
} }
static int ServerNameCallback(SSL *ssl, int *out_alert, void *arg) {
// SNI must be accessible from the SNI callback.
const TestConfig *config = GetTestConfig(ssl);
const char *server_name = SSL_get_servername(ssl, TLSEXT_NAMETYPE_host_name);
if (server_name == nullptr ||
std::string(server_name) != config->expected_server_name) {
fprintf(stderr, "servername mismatch (got %s; want %s)\n", server_name,
config->expected_server_name.c_str());
return SSL_TLSEXT_ERR_ALERT_FATAL;
}
return SSL_TLSEXT_ERR_OK;
}
// Connect returns a new socket connected to localhost on |port| or -1 on // Connect returns a new socket connected to localhost on |port| or -1 on
// error. // error.
static int Connect(uint16_t port) { static int Connect(uint16_t port) {
...@@ -645,6 +659,10 @@ static bssl::UniquePtr<SSL_CTX> SetupCtx(const TestConfig *config) { ...@@ -645,6 +659,10 @@ static bssl::UniquePtr<SSL_CTX> SetupCtx(const TestConfig *config) {
sizeof(sess_id_ctx) - 1)) sizeof(sess_id_ctx) - 1))
return nullptr; return nullptr;
if (!config->expected_server_name.empty()) {
SSL_CTX_set_tlsext_servername_callback(ssl_ctx.get(), ServerNameCallback);
}
return ssl_ctx; return ssl_ctx;
} }
...@@ -809,7 +827,8 @@ static bool CheckHandshakeProperties(SSL *ssl, bool is_resume) { ...@@ -809,7 +827,8 @@ static bool CheckHandshakeProperties(SSL *ssl, bool is_resume) {
if (!config->expected_server_name.empty()) { if (!config->expected_server_name.empty()) {
const char *server_name = const char *server_name =
SSL_get_servername(ssl, TLSEXT_NAMETYPE_host_name); SSL_get_servername(ssl, TLSEXT_NAMETYPE_host_name);
if (server_name != config->expected_server_name) { if (server_name == nullptr ||
std::string(server_name) != config->expected_server_name) {
fprintf(stderr, "servername mismatch (got %s; want %s)\n", fprintf(stderr, "servername mismatch (got %s; want %s)\n",
server_name, config->expected_server_name.c_str()); server_name, config->expected_server_name.c_str());
return false; return false;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册