Changeset 8985a6b in mod_gnutls for src

Timestamp:

Jan 29, 2013, 8:05:42 PM (8 years ago)

Author:

Daniel Kahn Gillmor <dkg@…>

Branches:

debian/master, debian/stretch-backports, jessie-backports, master, msva, proxy-ticket, upstream

Children:

c5bf40b

Parents:

a4006d3

git-author:

Daniel Kahn Gillmor <dkg@…> (01/29/13 00:32:49)

git-committer:

Daniel Kahn Gillmor <dkg@…> (01/29/13 20:05:42)

Message:

allow certificate use for clients without SNI

The test removed here causes certificate lookup to fail if the client
offers no SNI. Many TLS clients cannot (or do not wish to) offer SNI,
and most TLS clients refuse to proceed with the handshake if the
server does not offer a certificate.

This enables mod_gnutls to work for all such clients (and resolves
tests/04_basic_nosni)

File:

• src/gnutls_hooks.c (modified) (1 diff)

src/gnutls_hooks.c

@@ -113 +113 @@
     tsc = mgs_find_sni_server(session);
 
-    if (tsc == NULL) {
-        // No TLS vhost configured!
-                return GNUTLS_E_NO_CERTIFICATE_FOUND;
-        } else {
-        // Found a TLS vhost
+    if (tsc != NULL) {
+        // Found a TLS vhost based on the SNI from the client; use it instead.
         ctxt->sc = tsc;
         }