libp2p/go-openssl
1
0
Fork 0
mirror of https://github.com/libp2p/go-openssl.git synced 2025-01-30 05:20:08 +08:00
Code Issues Projects Releases Wiki Activity

openssl: add sni to dial helper

Browse Source 
Change-Id: Ibfa19f720987a7ba39e3a02c47d8e9f3fff925be
This commit is contained in:
JT Olds 2014-04-29 03:00:44 -06:00 committed by JT Olds
parent cd4183cd7c
commit 3c41e85fc4
2 changed files with 15 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
conn.go
View File

@ -99,6 +99,8 @@ func newConn(conn net.Conn, ctx *Ctx) (*Conn, error) {
// connection, you are responsible for verifying the peer's hostname. // connection, you are responsible for verifying the peer's hostname.
// Otherwise, you are vulnerable to MITM attacks. // Otherwise, you are vulnerable to MITM attacks.
// //
// Client also does not set up SNI for you like Dial does.
//
// Client connections probably won't work for you unless you set a verify // Client connections probably won't work for you unless you set a verify
// location or add some certs to the certificate store of the client context // location or add some certs to the certificate store of the client context
// you're using. This library is not nice enough to use the system certificate // you're using. This library is not nice enough to use the system certificate

19
net.go
View File

@ -50,7 +50,8 @@ func Listen(network, laddr string, ctx *Ctx) (net.Listener, error) {
type DialFlags int type DialFlags int
const ( const (
InsecureSkipHostVerification DialFlags = 0x01 InsecureSkipHostVerification DialFlags = 1 << iota
DisableSNI
) )
// Dial will connect to network/address and then wrap the corresponding // Dial will connect to network/address and then wrap the corresponding
@ -64,6 +65,10 @@ const (
// This library is not nice enough to use the system certificate store by // This library is not nice enough to use the system certificate store by
// default for you yet. // default for you yet.
func Dial(network, addr string, ctx *Ctx, flags DialFlags) (*Conn, error) { func Dial(network, addr string, ctx *Ctx, flags DialFlags) (*Conn, error) {
host, _, err := net.SplitHostPort(addr)
if err != nil {
return nil, err
}
if ctx == nil { if ctx == nil {
var err error var err error
ctx, err = NewCtx() ctx, err = NewCtx()
@ -81,17 +86,19 @@ func Dial(network, addr string, ctx *Ctx, flags DialFlags) (*Conn, error) {
c.Close() c.Close()
return nil, err return nil, err
} }
if flags&DisableSNI == 0 {
err = conn.SetTlsExtHostName(host)
if err != nil {
conn.Close()
return nil, err
}
}
err = conn.Handshake() err = conn.Handshake()
if err != nil { if err != nil {
c.Close() c.Close()
return nil, err return nil, err
} }
if flags&InsecureSkipHostVerification == 0 { if flags&InsecureSkipHostVerification == 0 {
host, _, err := net.SplitHostPort(addr)
if err != nil {
conn.Close()
return nil, err
}
err = conn.VerifyHostname(host) err = conn.VerifyHostname(host)
if err != nil { if err != nil {
conn.Close() conn.Close()