Skip to content
Snippets Groups Projects

policy.TLS_FORWARD: send SNI on wire if configured

Merged policy.TLS_FORWARD: send SNI on wire if configured
tls-sni into master
Merged Vladimír Čunát requested to merge tls-sni into master
  1. Feb 25, 2019
  3. Feb 22, 2019
    • Vladimír Čunát's avatar
      daemon: rework handling of TLS authentication params · 81b1450e
      Vladimír Čunát authored and Petr Špaček's avatar Petr Špaček committed 
      It's mainly about the way we parse and validate them.

Almost all of the parts of validation that were being done
in modules/policy/policy.lua and daemon/tls.c got moved
to daemon/bindings/net.c, so it's easier to follow that.
Also more checks are being done now, e.g. contents of .pin_sha256
and .hostname strings.
      Verified
      81b1450e
    • Vladimír Čunát's avatar
      policy.TLS_FORWARD: send SNI on wire if configured · a4284580
      Vladimír Čunát authored and Petr Špaček's avatar Petr Špaček committed 
      In https world it's standard to do that, and it's relied on.
Real-life example: 8.8.8.8#853 over TLSv1.3 won't send a certificate
if we don't send SNI (no idea why; also they do send it with TLSv1.2).

As a consequence, we no longer allow multiple hostnames per
address-port tuple, but that didn't seem useful.
      Verified
      a4284580