Add SNI support for the mock server
@@ -557,12 +557,6 @@ mongoc_stream_tls_openssl_handshake (mongoc_stream_t *stream,
BIO_get_ssl (openssl->bio, &ssl);
-/* Added in OpenSSL 0.9.8f, as a build time option */
-#ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME
- /* Set the SNI hostname we are expecting certificate for */
- SSL_set_tlsext_host_name (ssl, host);
-#endif
-
if (BIO_do_handshake (openssl->bio) == 1) {
if (_mongoc_openssl_check_cert (
ssl, host, tls->ssl_opts.allow_invalid_hostname)) {
@@ -602,6 +596,25 @@ mongoc_stream_tls_openssl_handshake (mongoc_stream_t *stream,
RETURN (false);
}
+/* Callback to get the client provided SNI, if any
+ * It is only called in SSL "server mode" (e.g. when using the Mock Server),
+ * and we don't actually use the hostname for anything, just debug print it
+ */
+static int
+_mongoc_stream_tls_openssl_sni (SSL *ssl, int *ad, void *arg)
+{
+ const char *hostname;
+
+ if (ssl == NULL) {
+ MONGOC_DEBUG ("No SNI hostname provided");
+ return SSL_TLSEXT_ERR_NOACK;
+ }
+
+ hostname = SSL_get_servername (ssl, TLSEXT_NAMETYPE_host_name);
+ MONGOC_DEBUG ("Got SNI: '%s'", hostname);
+
+ return SSL_TLSEXT_ERR_OK;
+}
/*
*--------------------------------------------------------------------------
@@ -667,6 +680,13 @@ mongoc_stream_tls_openssl_new (mongoc_stream_t *base_stream,
}
#endif
+ if (!client) {
+ /* Only usd by the Mock Server.
+ * Set a callback to get the SNI, if provided */
+ SSL_CTX_set_tlsext_servername_callback (ssl_ctx,
+ _mongoc_stream_tls_openssl_sni);
+ }
+
if (opt->weak_cert_validation) {
SSL_CTX_set_verify (ssl_ctx, SSL_VERIFY_NONE, NULL);
} else {
@@ -686,6 +706,16 @@ mongoc_stream_tls_openssl_new (mongoc_stream_t *base_stream,
RETURN (NULL);
}
+/* Added in OpenSSL 0.9.8f, as a build time option */
+#ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME
+ if (client) {
+ SSL *ssl;
+ /* Set the SNI hostname we are expecting certificate for */
+ BIO_get_ssl (bio_ssl, &ssl);
+ SSL_set_tlsext_host_name (ssl, host);
+#endif
+ }
+
BIO_push (bio_ssl, bio_mongoc_shim);
