Changeset 04753db8 in mod_gnutls

Timestamp:

Oct 26, 2018, 3:02:54 PM (2 years ago)

Author:

Fiona Klute <fiona.klute@…>

Branches:

asyncio, debian/master, master, proxy-ticket

Children:

849b87e

Parents:

a14cf5c

Message:

Require Host header to match SNI hostname (if any)

This is a conformance check on top of requiring virtual hosts of
connection and request to match.

File:

• src/gnutls_hooks.c (modified) (1 diff)

src/gnutls_hooks.c

@@ -1242 +1242 @@
     }
 
+    if (!ctxt->sni_name)
+        return DECLINED;
+
+    /* Got an SNI name, so verify it matches. */
+    ap_log_cerror(APLOG_MARK, APLOG_TRACE1, APR_SUCCESS, ctxt->c,
+                  "%s: Checking request hostname against SNI name '%s'.",
+                  __func__, ctxt->sni_name);
+
+    if (!r->hostname)
+    {
+        ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, r->connection,
+                      "Client requested '%s' via SNI, but provided "
+                      "no hostname in HTTP request!", ctxt->sni_name);
+        return HTTP_MISDIRECTED_REQUEST;
+    }
+
+    if (strcasecmp(r->hostname, ctxt->sni_name) != 0)
+    {
+        ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, r->connection,
+                      "Client requested '%s' via SNI, but '%s' in "
+                      "the HTTP request!", ctxt->sni_name, r->hostname);
+        return HTTP_MISDIRECTED_REQUEST;
+    }
+
     return DECLINED;
 }