Unverified Commit 049f5d87 authored by CatboxParadox's avatar CatboxParadox Committed by GitHub
Browse files

Use SNI on outgoing TLS connections (#11458)

When establishing an outgoing TLS connection using a hostname as a target, use TLS SNI extensions to include the hostname in use.
parent c0267b3f
...@@ -44,6 +44,7 @@ ...@@ -44,6 +44,7 @@
#include <openssl/decoder.h> #include <openssl/decoder.h>
#endif #endif
#include <sys/uio.h> #include <sys/uio.h>
#include <arpa/inet.h>
#define REDIS_TLS_PROTO_TLSv1 (1<<0) #define REDIS_TLS_PROTO_TLSv1 (1<<0)
#define REDIS_TLS_PROTO_TLSv1_1 (1<<1) #define REDIS_TLS_PROTO_TLSv1_1 (1<<1)
...@@ -857,10 +858,16 @@ static int connTLSAccept(connection *_conn, ConnectionCallbackFunc accept_handle ...@@ -857,10 +858,16 @@ static int connTLSAccept(connection *_conn, ConnectionCallbackFunc accept_handle
static int connTLSConnect(connection *conn_, const char *addr, int port, const char *src_addr, ConnectionCallbackFunc connect_handler) { static int connTLSConnect(connection *conn_, const char *addr, int port, const char *src_addr, ConnectionCallbackFunc connect_handler) {
tls_connection *conn = (tls_connection *) conn_; tls_connection *conn = (tls_connection *) conn_;
unsigned char addr_buf[sizeof(struct in6_addr)];
if (conn->c.state != CONN_STATE_NONE) return C_ERR; if (conn->c.state != CONN_STATE_NONE) return C_ERR;
ERR_clear_error(); ERR_clear_error();
/* Check whether addr is an IP address, if not, use the value for Server Name Indication */
if (inet_pton(AF_INET, addr, addr_buf) != 1 && inet_pton(AF_INET6, addr, addr_buf) != 1) {
SSL_set_tlsext_host_name(conn->ssl, addr);
}
/* Initiate Socket connection first */ /* Initiate Socket connection first */
if (connectionTypeTcp()->connect(conn_, addr, port, src_addr, connect_handler) == C_ERR) return C_ERR; if (connectionTypeTcp()->connect(conn_, addr, port, src_addr, connect_handler) == C_ERR) return C_ERR;
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment