| 44 | std::map<std::string, int> bad_names; |
| 45 | |
| 46 | int |
| 47 | CB_server_verify(TSCont cont, TSEvent event, void *edata) |
| 48 | { |
| 49 | TSVConn ssl_vc = reinterpret_cast<TSVConn>(edata); |
| 50 | |
| 51 | int count = reinterpret_cast<intptr_t>(TSContDataGet(cont)); |
| 52 | |
| 53 | // Is this a good name or not? |
| 54 | TSEvent reenable_event = TS_EVENT_CONTINUE; |
| 55 | TSSslConnection const sslobj = TSVConnSslConnectionGet(ssl_vc); |
| 56 | SSL const *const ssl = reinterpret_cast<SSL *>(sslobj); |
| 57 | char const *const sni_name = SSL_get_servername(ssl, TLSEXT_NAMETYPE_host_name); |
| 58 | if (sni_name) { |
| 59 | std::string sni_string(sni_name); |
| 60 | if (bad_names.find(sni_string) != bad_names.end()) { |
| 61 | reenable_event = TS_EVENT_ERROR; |
| 62 | } |
| 63 | |
| 64 | Dbg(dbg_ctl, "Server verify callback %d %p - event is %s SNI=%s %s", count, ssl_vc, |
| 65 | event == TS_EVENT_SSL_VERIFY_SERVER ? "good" : "bad", sni_name, reenable_event == TS_EVENT_ERROR ? "error HS" : "good HS"); |
| 66 | |
| 67 | int len; |
| 68 | char const *const method2_name = TSVConnSslSniGet(ssl_vc, &len); |
| 69 | Dbg(dbg_ctl, "Server verify callback SNI APIs match=%s", 0 == strncmp(method2_name, sni_name, len) ? "true" : "false"); |
| 70 | } else { |
| 71 | Dbg(dbg_ctl, "SSL_get_servername failed"); |
| 72 | reenable_event = TS_EVENT_ERROR; |
| 73 | } |
| 74 | |
| 75 | // All done, reactivate things |
| 76 | TSVConnReenableEx(ssl_vc, reenable_event); |
| 77 | return TS_SUCCESS; |
| 78 | } |
| 79 | |
| 80 | void |
| 81 | parse_callbacks(int argc, const char *argv[], int &count) |
nothing calls this directly
no test coverage detected