diff options
| -rw-r--r-- | doc/s6-tlsd-io.html | 11 | ||||
| -rw-r--r-- | src/sbearssl/sbearssl_sni_policy_vtable.c | 32 |
2 files changed, 38 insertions, 5 deletions
diff --git a/doc/s6-tlsd-io.html b/doc/s6-tlsd-io.html index b2a4a1e..f21d487 100644 --- a/doc/s6-tlsd-io.html +++ b/doc/s6-tlsd-io.html @@ -129,6 +129,17 @@ entirely ignored. </p> <p> + You can wildcard the first level of a SNI domain: you can point +to a valid certificate for <tt><em>foo</em>.example.com</tt> for all +values of <em>foo</em> via a variable called <tt>CERTFILE:*.example.com</tt> +(and have the corresponding <tt>KEYFILE:*.example.com</tt>). Only the +first level can be wildcarded, and this does not work for top-level +domains (you cannot hold a certificate for <tt>*.com</tt>). Note: if you are +using a shell to handle your environment variables, be careful to +properly quote them so that it does not attempt to expand the asterisks. +</p> + +<p> If you are using client certificates, <tt>s6-tlsd-io</tt> also requires either one of the following variables to be set: </p> diff --git a/src/sbearssl/sbearssl_sni_policy_vtable.c b/src/sbearssl/sbearssl_sni_policy_vtable.c index 0f3de6e..a1d878a 100644 --- a/src/sbearssl/sbearssl_sni_policy_vtable.c +++ b/src/sbearssl/sbearssl_sni_policy_vtable.c @@ -49,14 +49,36 @@ static int choose (br_ssl_server_policy_class const **pctx, br_ssl_server_contex sbearssl_sni_policy_node *node ; char const *servername = br_ssl_engine_get_server_name(&sc->eng) ; - /* Get the node corresponding to the ServerName sent by the client. "" for no SNI. */ + /* + Get the node corresponding to the ServerName sent by the client. + If servername is foo.bar.baz, try: + 1. foo.bar.baz + 2. *.bar.baz (don't do this for TLDs, we don't want *.com) + 3. empty string (i.e. default certificate) + If no SNI, only try the empty string. + */ { - uint32_t n ; - if (!avltree_search(&pol->map, servername, &n)) + uint32_t n = avltree_totalsize(&pol->map) ; + if (servername) { - if (!servername[0]) return 0 ; - if (!avltree_search(&pol->map, "", &n)) return 0 ; + if (!avltree_search(&pol->map, servername, &n)) + { + char const *sub1 = strchr(servername, '.') ; + if (sub1 && sub1[1]) + { + char const *sub2 = strchr(sub1 + 1, '.') ; + if (sub2 && sub2[1]) + { + size_t len = strlen(sub1) ; + char tmp[len + 2] ; + tmp[0] = '*' ; + memcpy(tmp + 1, sub1, len + 1) ; + avltree_search(&pol->map, tmp, &n) ; + } + } + } } + if (n == avltree_totalsize(&pol->map) && !avltree_search(&pol->map, "", &n)) return 0 ; avltree_free(&pol->map) ; node = genalloc_s(sbearssl_sni_policy_node, &pol->mapga) + n ; } |