tls_mgm: fix require_cert and verify_cert enforcement for virtual domains#4115
Open
ipoddubny wants to merge 1 commit into
Open
tls_mgm: fix require_cert and verify_cert enforcement for virtual domains#4115ipoddubny wants to merge 1 commit into
ipoddubny wants to merge 1 commit into
Conversation
…ains Multiple virtual TLS domains can be defined on a single socket via match_sip_domain (SNI), each with distinct require_cert and verify_cert settings. However, these domain-specific verification rules were never applied to the connection during the TLS handshake, leaving only the socket's default settings enforced. This commit adds SSL_set_verify to the SNI callbacks for both OpenSSL and WolfSSL to ensure the correct domain-specific rules are applied.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes the enforcement of require_cert and verify_cert settings for virtual TLS domains sharing a single socket.
Details
This is a generic bug fix.
Multiple virtual TLS domains can be defined on a single socket via match_sip_domain (using SNI), each with distinct require_cert and verify_cert settings.
However, these domain-specific verification rules are never applied to the connection during the TLS handshake, leaving only the socket's default settings enforced.
Solution
Adding SSL_set_verify to the SNI callbacks for both OpenSSL and WolfSSL to ensure the correct domain-specific rules are applied.
Compatibility
There should be no issues. The change may affect invalid configurations with mixed verify/require values for domains on the same socket.
Closing issues
I don't see any previous issues reporting this bug, submitting PR directly.