wt/mongoose
1
0 Fork 0
mirror of https://github.com/cesanta/mongoose.git synced 2026-11-02 13:20:51 +00:00
Code Issues Packages Projects Releases Wiki Activity

Improve SNI

Browse Source
This commit is contained in:
cpq committed 2021-01-30 13:03:11 +00:00
1 parent 31cf6f8969
commit d327ee9834
8 files changed
+66 -40
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

src/tls.c
+12 -3
View File
@@ -105,6 +105,11 @@ int mg_tls_init(struct mg_connection *c, struct mg_tls_opts *opts) {
}
mbedtls_ssl_conf_ca_chain(&tls->conf, &tls->ca, NULL);
#endif
if (opts->srvname.len > 0) {
char buf[opts->srvname.len + 1];
sprintf(buf, "%.*s", (int) opts->srvname.len, opts->srvname.ptr);
mbedtls_ssl_set_hostname(&tls->ssl, buf);
}
mbedtls_ssl_conf_authmode(&tls->conf, MBEDTLS_SSL_VERIFY_REQUIRED);
}
if (opts->cert != NULL && opts->cert[0] != '\0') {
@@ -233,9 +238,9 @@ int mg_tls_init(struct mg_connection *c, struct mg_tls_opts *opts) {
SSL_set_options(tls->ssl, SSL_OP_CIPHER_SERVER_PREFERENCE);
#endif
SSL_set_verify(tls->ssl, SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
0);
if (opts->ca != NULL && opts->ca[0] != '\0') {
SSL_set_verify(tls->ssl, SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
NULL);
if ((rc = SSL_CTX_load_verify_locations(tls->ctx, opts->ca, NULL)) != 1) {
mg_error(c, "parse(%s): err %d", opts->ca, mg_tls_err(tls, rc));
goto fail;
@@ -264,7 +269,11 @@ int mg_tls_init(struct mg_connection *c, struct mg_tls_opts *opts) {
}
}
if (opts->ciphers != NULL) SSL_set_cipher_list(tls->ssl, opts->ciphers);
if (opts->srvname != NULL) SSL_set_tlsext_host_name(tls->ssl, opts->srvname);
if (opts->srvname.len > 0) {
char buf[opts->srvname.len + 1];
sprintf(buf, "%.*s", (int) opts->srvname.len, opts->srvname.ptr);
SSL_set_tlsext_host_name(tls->ssl, buf);
}
c->tls = tls;
c->is_tls = 1;
c->is_tls_hs = 1;
src/tls.h
+5 -5
View File
@@ -2,11 +2,11 @@
#include "net.h"
struct mg_tls_opts {
const char *ca; // CA certificate file. For both listeners and clients
const char *cert; // Certificate
const char *certkey; // Certificate key
const char *ciphers; // Cipher list
const char *srvname; // If not NULL, enables server name verification
const char *ca; // CA certificate file. For both listeners and clients
const char *cert; // Certificate
const char *certkey; // Certificate key
const char *ciphers; // Cipher list
struct mg_str srvname; // If not empty, enables server name verification
};
int mg_tls_init(struct mg_connection *, struct mg_tls_opts *);