Mirrors/proxytunnel
1
0
Fork 0
mirror of https://github.com/proxytunnel/proxytunnel.git synced 2026-01-23 02:34:59 +00:00
Code Issues Projects Releases Wiki Activity

set proper SNI name in all use cases

Browse source
This commit is contained in:
Dirk Stoecker 2018-03-06 11:52:30 +01:00
parent 11f8b18ead
commit 02896a593a
1 changed files with 16 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

32
ptstream.c
View file

@ -290,14 +290,25 @@ int stream_enable_ssl(PTSTREAM *pts, const char *proxy_arg) {
SSL_set_rfd (ssl, stream_get_incoming_fd(pts));
SSL_set_wfd (ssl, stream_get_outgoing_fd(pts));
/* Determine the host name we are connecting to */
proxy_arg_len = strlen(proxy_arg);
if ((peer_host = malloc(proxy_arg_len + 1)) == NULL) {
message("Out of memory\n");
goto fail;
}
snprintf( proxy_arg_fmt, sizeof(proxy_arg_fmt), proxy_arg[0] == '[' ? "[%%%zu[^]]]" : "%%%zu[^:]", proxy_arg_len - 1 );
if ( sscanf( proxy_arg, proxy_arg_fmt, peer_host ) != 1 ) {
goto fail;
}
/* SNI support */
if ( args_info.verbose_flag ) {
message( "Set SNI hostname to %s\n", args_info.proxyhost_arg );
}
res = SSL_set_tlsext_host_name(ssl,args_info.proxyhost_arg);
message( "Set SNI hostname to %s\n", peer_host);
}
res = SSL_set_tlsext_host_name(ssl, peer_host);
if (res < 0) {
message( "TLS SNI error, giving up: SSL_set_tlsext_host_name returned error message:\n %u\n", res );
exit( 1 );
message( "TLS SNI error, giving up: SSL_set_tlsext_host_name returned error message:\n %u\n", res );
exit( 1 );
}
SSL_connect (ssl);
@ -318,17 +329,6 @@ int stream_enable_ssl(PTSTREAM *pts, const char *proxy_arg) {
goto fail;
}
/* Determine the host name we are connecting to */
proxy_arg_len = strlen(proxy_arg);
if ((peer_host = malloc(proxy_arg_len + 1)) == NULL) {
message("Out of memory\n");
goto fail;
}
snprintf( proxy_arg_fmt, sizeof(proxy_arg_fmt), proxy_arg[0] == '[' ? "[%%%zu[^]]]" : "%%%zu[^:]", proxy_arg_len - 1 );
if ( sscanf( proxy_arg, proxy_arg_fmt, peer_host ) != 1 ) {
goto fail;
}
/* Verify the certificate name matches the host we are connecting to */
if (!check_cert_names(cert, peer_host)) {
goto fail;