diff options
| author | Dr. David von Oheimb <David.von.Oheimb@siemens.com> | 2023-01-12 10:54:50 +0100 |
|---|---|---|
| committer | Hugo Landau <hlandau@openssl.org> | 2023-05-10 18:36:50 +0100 |
| commit | deb7be7f1c9ca77fdc3ea1ebfc0229496eeb2a35 (patch) | |
| tree | 7fe5802f00a869b7e9c48b57dce2afeb097ccce4 /apps/lib/apps.c | |
| parent | 2b1ee2b28fffd1d284be12aeb65f2e186b51b068 (diff) | |
CMP app and app_http_tls_cb(): pick the right TLS hostname (also without port)
Fixes #20031
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20034)
(cherry picked from commit 30b9a6ec89d97152b5a564b3acf3a94ee57185a7)
Diffstat (limited to 'apps/lib/apps.c')
| -rw-r--r-- | apps/lib/apps.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/apps/lib/apps.c b/apps/lib/apps.c index 9a53a10932..e083634492 100644 --- a/apps/lib/apps.c +++ b/apps/lib/apps.c @@ -2466,6 +2466,10 @@ BIO *app_http_tls_cb(BIO *bio, void *arg, int connect, int detail) if (connect) { SSL *ssl; BIO *sbio = NULL; + X509_STORE *ts = SSL_CTX_get_cert_store(ssl_ctx); + X509_VERIFY_PARAM *vpm = X509_STORE_get0_param(ts); + const char *host = vpm == NULL ? NULL : + X509_VERIFY_PARAM_get0_host(vpm, 0 /* first hostname */); /* adapt after fixing callback design flaw, see #17088 */ if ((info->use_proxy @@ -2480,8 +2484,8 @@ BIO *app_http_tls_cb(BIO *bio, void *arg, int connect, int detail) return NULL; } - /* adapt after fixing callback design flaw, see #17088 */ - SSL_set_tlsext_host_name(ssl, info->server); /* not critical to do */ + if (vpm != NULL) + SSL_set_tlsext_host_name(ssl, host /* may be NULL */); SSL_set_connect_state(ssl); BIO_set_ssl(sbio, ssl, BIO_CLOSE); |