Changeset 265159d in mod_gnutls

Timestamp:

Oct 17, 2017, 2:49:17 PM (8 months ago)

Author:

Thomas Klute <thomas2.klute@…>

Branches:

debian/master, debian/stretch-backports, master, upstream

Children:

54d07a1

Parents:

321912b

Message:

Send SNI for proxy connections

Files:

• include/mod_gnutls.h.in (modified) (1 diff)
• src/gnutls_hooks.c (modified) (1 diff)
• src/gnutls_io.c (modified) (1 diff)

include/mod_gnutls.h.in

@@ -285 +285 @@
 apr_status_t apr_signal_block(int signum);
 
- /* Proxy Support */
+/* Proxy Support */
+/** mod_proxy adds a note with this key to the connection->notes table
+ * for client connections */
+#define PROXY_SNI_NOTE "proxy-request-hostname"
 /* An optional function which returns non-zero if the given connection
 is using SSL/TLS. */

src/gnutls_hooks.c

@@ -1966 +1966 @@
     /* Get peer hostname from a note left by mod_proxy */
     const char *peer_hostname =
-        apr_table_get(ctxt->c->notes, "proxy-request-hostname");
+        apr_table_get(ctxt->c->notes, PROXY_SNI_NOTE);
     if (peer_hostname == NULL)
         ap_log_cerror(APLOG_MARK, APLOG_WARNING, 0, ctxt->c,
-                      "%s: proxy-request-hostname is NULL, cannot check "
+                      "%s: " PROXY_SNI_NOTE " NULL, cannot check "
                       "peer's hostname", __func__);
 

src/gnutls_io.c

@@ -395 +395 @@
     }
 
+    /* Enable SNI for proxy connections */
+    if (ctxt->is_proxy == GNUTLS_ENABLED_TRUE)
+    {
+        /* Get peer hostname from note left by mod_proxy */
+        const char *peer_hostname =
+            apr_table_get(ctxt->c->notes, PROXY_SNI_NOTE);
+        /* Used only as target for apr_ipsubnet_create() */
+        apr_ipsubnet_t *probe;
+        /* Check if the note is present (!= NULL) and NOT an IP
+         * address */
+        if ((peer_hostname) != NULL
+            && (apr_ipsubnet_create(&probe, peer_hostname, NULL, ctxt->c->pool)
+                != APR_SUCCESS))
+        {
+            ret = gnutls_server_name_set(ctxt->session, GNUTLS_NAME_DNS,
+                                         peer_hostname, strlen(peer_hostname));
+            if (ret != GNUTLS_E_SUCCESS)
+                ap_log_cerror(APLOG_MARK, APLOG_ERR, ret, ctxt->c,
+                              "Could not set SNI '%s' for proxy connection: "
+                              "%s (%d)",
+                              peer_hostname, gnutls_strerror(ret), ret);
+        }
+    }
+
 tryagain:
     do {