diff options
| -rw-r--r-- | doc/s6-tlsc-io.html | 8 | ||||
| -rw-r--r-- | doc/s6-tlsc.html | 5 | ||||
| -rw-r--r-- | doc/s6-tlsd-io.html | 8 | ||||
| -rw-r--r-- | doc/s6-tlsd.html | 3 | ||||
| -rw-r--r-- | src/sbearssl/sbearssl_send_environment.c | 13 | ||||
| -rw-r--r-- | src/stls/stls_send_environment.c | 15 |
6 files changed, 31 insertions, 21 deletions
diff --git a/doc/s6-tlsc-io.html b/doc/s6-tlsc-io.html index 9999d4f..f432f1e 100644 --- a/doc/s6-tlsc-io.html +++ b/doc/s6-tlsc-io.html @@ -205,11 +205,9 @@ TLS handshake has completed, some data (terminated by two null characters) will be sent to file descriptor <em>notif</em>. The data contains information about the TLS parameters of the connection; its exact contents are left unspecified, but there's at least -a <tt>SSL_PROTOCOL=<em>protocol</em></tt> string, -a <tt>SSL_CIPHER=<em>cipher</em></tt> string, -and a <tt>SSL_TLS_SNI_SERVERNAME=<em>servername</em></tt> string - all null-terminated. (<em>servername</em> is the empty string if -no SNI has been required.) +a <tt>SSL_PROTOCOL=<em>protocol</em></tt> string and +a <tt>SSL_CIPHER=<em>cipher</em></tt> string, both +null-terminated. Sending this data serves a dual purpose: telling the <em>notif</em> reader that the handshake has completed, and providing it with some basic information about the connection. If this option is not given, diff --git a/doc/s6-tlsc.html b/doc/s6-tlsc.html index 32070c0..6f644c4 100644 --- a/doc/s6-tlsc.html +++ b/doc/s6-tlsc.html @@ -95,8 +95,9 @@ environment variables: TLSv1, TLSv1.1, TLSv1.2... </li> <li> <tt>SSL_CIPHER</tt> contains the name of the cipher used. </li> - <li> <tt>SSL_TLS_SNI_SERVERNAME</tt> contains the required SNI -server name, if any, or is empty otherwise. </li> + <li> <tt>SSL_TLS_SNI_SERVERNAME</tt> contains <em>servername</em>, +if the <tt>-k</tt> option has been given; otherwise it is removed +from the environment. </li> <li> More similar environment variables containing information about the connection may be added in the future. </li> </ul> diff --git a/doc/s6-tlsd-io.html b/doc/s6-tlsd-io.html index 53b1282..7e38885 100644 --- a/doc/s6-tlsd-io.html +++ b/doc/s6-tlsd-io.html @@ -200,11 +200,9 @@ TLS handshake has completed, some data (terminated by two null characters) will be sent to file descriptor <em>notif</em>. The data contains information about the TLS parameters of the connection; its exact contents are left unspecified, but there's at least -a <tt>SSL_PROTOCOL=<em>protocol</em></tt> string, -a <tt>SSL_CIPHER=<em>cipher</em></tt> string, -and a <tt>SSL_TLS_SNI_SERVERNAME=<em>servername</em></tt> string - all null-terminated. (<em>servername</em> is the empty string if -no SNI has been required.) +a <tt>SSL_PROTOCOL=<em>protocol</em></tt> string and +a <tt>SSL_CIPHER=<em>cipher</em></tt> string, both +null-terminated. Sending this data serves a dual purpose: telling the <em>notif</em> reader that the handshake has completed, and providing it with some basic information about the connection. If this option is not given, diff --git a/doc/s6-tlsd.html b/doc/s6-tlsd.html index 83b70c1..011a20f 100644 --- a/doc/s6-tlsd.html +++ b/doc/s6-tlsd.html @@ -105,7 +105,8 @@ TLSv1, TLSv1.1, TLSv1.2... </li> <li> <tt>SSL_CIPHER</tt> contains the name of the cipher used. </li> <li> <tt>SSL_TLS_SNI_SERVERNAME</tt> contains the required SNI -server name, if any, or is empty otherwise. </li> +server name, if any. It is removed from the environment if no SNI +has been sent by the client. </li> <li> More similar environment variables containing information about the connection may be added in the future. </li> </ul> diff --git a/src/sbearssl/sbearssl_send_environment.c b/src/sbearssl/sbearssl_send_environment.c index 2439351..bb0fb35 100644 --- a/src/sbearssl/sbearssl_send_environment.c +++ b/src/sbearssl/sbearssl_send_environment.c @@ -12,6 +12,7 @@ int sbearssl_send_environment (br_ssl_engine_context *ctx, int fd) char buf[4096] ; buffer b = BUFFER_INIT(&buffer_write, fd, buf, 4096) ; unsigned int v = br_ssl_engine_get_version(ctx) ; + char const *name = br_ssl_engine_get_server_name(ctx) ; char const *suite ; br_ssl_session_parameters params ; @@ -26,9 +27,15 @@ int sbearssl_send_environment (br_ssl_engine_context *ctx, int fd) || buffer_puts(&b, "SSL_CIPHER=") < 0 || buffer_puts(&b, suite) < 0 || buffer_put(&b, "", 1) < 0 - || buffer_puts(&b, "SSL_TLS_SNI_SERVERNAME=") < 0 - || buffer_puts(&b, br_ssl_engine_get_server_name(ctx)) < 0 - || buffer_putflush(&b, "\0", 2) < 0) + || buffer_puts(&b, "SSL_TLS_SNI_SERVERNAME") < 0) + return 0 ; + if (name[0]) + { + if (buffer_put(&b, "=", 1) < 0 + || buffer_puts(&b, name) < 0) + return 0 ; + } + if (buffer_putflush(&b, "\0", 2) < 0) return 0 ; return 1 ; } diff --git a/src/stls/stls_send_environment.c b/src/stls/stls_send_environment.c index af0eeb6..c7cb9c7 100644 --- a/src/stls/stls_send_environment.c +++ b/src/stls/stls_send_environment.c @@ -11,18 +11,23 @@ int stls_send_environment (struct tls *ctx, int fd) { - char const *servername = tls_conn_servername(ctx) ; + char const *name = tls_conn_servername(ctx) ; char buf[4096] ; buffer b = BUFFER_INIT(&buffer_write, fd, buf, 4096) ; - if (!servername) servername = "" ; if (buffer_puts(&b, "SSL_PROTOCOL=") < 0 || buffer_puts(&b, tls_conn_version(ctx)) < 0 || buffer_put(&b, "", 1) < 0 || buffer_puts(&b, "SSL_CIPHER=") < 0 || buffer_puts(&b, tls_conn_cipher(ctx)) < 0 || buffer_put(&b, "", 1) < 0 - || buffer_puts(&b, "SSL_TLS_SNI_SERVERNAME=") < 0 - || buffer_puts(&b, servername) < 0 - || buffer_putflush(&b, "\0", 2) < 0) return 0 ; + || buffer_puts(&b, "SSL_TLS_SNI_SERVERNAME") < 0) + return 0 ; + if (name && name[0]) + { + if (buffer_put(&b, "=", 1) < 0 + || buffer_puts(&b, name) < 0) + return 0 ; + } + if (buffer_putflush(&b, "\0", 2) < 0) return 0 ; return 1 ; } |