Remove SSL_TLS_SNI_SERVERNAME (instead of defined but empty) if no SNI

6 files changed, 31 insertions, 21 deletions

diff --git a/doc/s6-tlsc-io.html b/doc/s6-tlsc-io.html
index 9999d4f..f432f1e 100644
--- a/doc/s6-tlsc-io.html
+++ b/doc/s6-tlsc-io.html
@@ -205,11 +205,9 @@ TLS handshake has completed, some data (terminated by two null
 characters) will be sent to file descriptor <em>notif</em>. The
 data contains information about the TLS parameters of the connection;
 its exact contents are left unspecified, but there's at least
-a <tt>SSL_PROTOCOL=<em>protocol</em></tt> string,
-a <tt>SSL_CIPHER=<em>cipher</em></tt> string,
-and a <tt>SSL_TLS_SNI_SERVERNAME=<em>servername</em></tt> string
- all null-terminated. (<em>servername</em> is the empty string if
-no SNI has been required.)
+a <tt>SSL_PROTOCOL=<em>protocol</em></tt> string and
+a <tt>SSL_CIPHER=<em>cipher</em></tt> string, both
+null-terminated.
 Sending this data serves a dual purpose: telling the <em>notif</em>
 reader that the handshake has completed, and providing it with some
 basic information about the connection. If this option is not given,
diff --git a/doc/s6-tlsc.html b/doc/s6-tlsc.html
index 32070c0..6f644c4 100644
--- a/doc/s6-tlsc.html
+++ b/doc/s6-tlsc.html
@@ -95,8 +95,9 @@ environment variables:
 TLSv1, TLSv1.1, TLSv1.2... </li>
  <li> <tt>SSL_CIPHER</tt> contains the name of the cipher
 used. </li>
- <li> <tt>SSL_TLS_SNI_SERVERNAME</tt> contains the required SNI
-server name, if any, or is empty otherwise. </li>
+ <li> <tt>SSL_TLS_SNI_SERVERNAME</tt> contains <em>servername</em>,
+if the <tt>-k</tt> option has been given; otherwise it is removed
+from the environment. </li>
  <li> More similar environment variables containing information
 about the connection may be added in the future. </li>
 </ul>
diff --git a/doc/s6-tlsd-io.html b/doc/s6-tlsd-io.html
index 53b1282..7e38885 100644
--- a/doc/s6-tlsd-io.html
+++ b/doc/s6-tlsd-io.html
@@ -200,11 +200,9 @@ TLS handshake has completed, some data (terminated by two null
 characters) will be sent to file descriptor <em>notif</em>. The
 data contains information about the TLS parameters of the connection;
 its exact contents are left unspecified, but there's at least
-a <tt>SSL_PROTOCOL=<em>protocol</em></tt> string,
-a <tt>SSL_CIPHER=<em>cipher</em></tt> string,
-and a <tt>SSL_TLS_SNI_SERVERNAME=<em>servername</em></tt> string
- all null-terminated. (<em>servername</em> is the empty string if
-no SNI has been required.)
+a <tt>SSL_PROTOCOL=<em>protocol</em></tt> string and
+a <tt>SSL_CIPHER=<em>cipher</em></tt> string, both
+null-terminated.
 Sending this data serves a dual purpose: telling the <em>notif</em>
 reader that the handshake has completed, and providing it with some
 basic information about the connection. If this option is not given,
diff --git a/doc/s6-tlsd.html b/doc/s6-tlsd.html
index 83b70c1..011a20f 100644
--- a/doc/s6-tlsd.html
+++ b/doc/s6-tlsd.html
@@ -105,7 +105,8 @@ TLSv1, TLSv1.1, TLSv1.2... </li>
  <li> <tt>SSL_CIPHER</tt> contains the name of the cipher
 used. </li>
  <li> <tt>SSL_TLS_SNI_SERVERNAME</tt> contains the required SNI
-server name, if any, or is empty otherwise. </li>
+server name, if any. It is removed from the environment if no SNI
+has been sent by the client. </li>
  <li> More similar environment variables containing information
 about the connection may be added in the future. </li>
 </ul>
diff --git a/src/sbearssl/sbearssl_send_environment.c b/src/sbearssl/sbearssl_send_environment.c
index 2439351..bb0fb35 100644
--- a/src/sbearssl/sbearssl_send_environment.c
+++ b/src/sbearssl/sbearssl_send_environment.c
@@ -12,6 +12,7 @@ int sbearssl_send_environment (br_ssl_engine_context *ctx, int fd)
   char buf[4096] ;
   buffer b = BUFFER_INIT(&buffer_write, fd, buf, 4096) ;
   unsigned int v = br_ssl_engine_get_version(ctx) ;
+  char const *name = br_ssl_engine_get_server_name(ctx) ;
   char const *suite ;
   br_ssl_session_parameters params ;
 
@@ -26,9 +27,15 @@ int sbearssl_send_environment (br_ssl_engine_context *ctx, int fd)
    || buffer_puts(&b, "SSL_CIPHER=") < 0
    || buffer_puts(&b, suite) < 0
    || buffer_put(&b, "", 1) < 0
-   || buffer_puts(&b, "SSL_TLS_SNI_SERVERNAME=") < 0
-   || buffer_puts(&b, br_ssl_engine_get_server_name(ctx)) < 0
-   || buffer_putflush(&b, "\0", 2) < 0)
+   || buffer_puts(&b, "SSL_TLS_SNI_SERVERNAME") < 0)
+    return 0 ;
+  if (name[0])
+  {
+    if (buffer_put(&b, "=", 1) < 0
+     || buffer_puts(&b, name) < 0)
+      return 0 ;
+  }
+  if (buffer_putflush(&b, "\0", 2) < 0)
     return 0 ;
   return 1 ;
 }
diff --git a/src/stls/stls_send_environment.c b/src/stls/stls_send_environment.c
index af0eeb6..c7cb9c7 100644
--- a/src/stls/stls_send_environment.c
+++ b/src/stls/stls_send_environment.c
@@ -11,18 +11,23 @@
 
 int stls_send_environment (struct tls *ctx, int fd)
 {
-  char const *servername = tls_conn_servername(ctx) ;
+  char const *name = tls_conn_servername(ctx) ;
   char buf[4096] ;
   buffer b = BUFFER_INIT(&buffer_write, fd, buf, 4096) ;
-  if (!servername) servername = "" ;
   if (buffer_puts(&b, "SSL_PROTOCOL=") < 0
    || buffer_puts(&b, tls_conn_version(ctx)) < 0
    || buffer_put(&b, "", 1) < 0
    || buffer_puts(&b, "SSL_CIPHER=") < 0
    || buffer_puts(&b, tls_conn_cipher(ctx)) < 0
    || buffer_put(&b, "", 1) < 0
-   || buffer_puts(&b, "SSL_TLS_SNI_SERVERNAME=") < 0
-   || buffer_puts(&b, servername) < 0
-   || buffer_putflush(&b, "\0", 2) < 0) return 0 ;
+   || buffer_puts(&b, "SSL_TLS_SNI_SERVERNAME") < 0)
+    return 0 ;
+  if (name && name[0])
+  {
+    if (buffer_put(&b, "=", 1) < 0
+     || buffer_puts(&b, name) < 0)
+      return 0 ;
+  }
+  if (buffer_putflush(&b, "\0", 2) < 0) return 0 ;
   return 1 ;
 }