| 85 | } |
| 86 | |
| 87 | bool |
| 88 | ServerSessionPool::validate_host_sni(HttpSM *sm, NetVConnection *netvc) |
| 89 | { |
| 90 | bool retval = true; |
| 91 | if (sm->t_state.scheme == URL_WKSIDX_HTTPS) { |
| 92 | // The sni_servername of the connection was set on HttpSM::do_http_server_open |
| 93 | // by fetching the hostname from the server request. So the connection should only |
| 94 | // be reused if the hostname in the new request is the same as the host name in the |
| 95 | // original request |
| 96 | if (auto snis = netvc->get_service<TLSSNISupport>(); snis) { |
| 97 | const char *session_sni = snis->get_sni_server_name(); |
| 98 | if (session_sni && session_sni[0] != '\0') { |
| 99 | // TS-4468: If the connection matches, make sure the SNI server |
| 100 | // name (if present) matches the request hostname |
| 101 | int len = 0; |
| 102 | const char *req_host = sm->t_state.hdr_info.server_request.host_get(&len); |
| 103 | retval = strncasecmp(session_sni, req_host, len) == 0; |
| 104 | Dbg(dbg_ctl_http_ss, "validate_host_sni host=%*.s, sni=%s", len, req_host, session_sni); |
| 105 | } |
| 106 | } else { |
| 107 | retval = false; |
| 108 | } |
| 109 | } |
| 110 | return retval; |
| 111 | } |
| 112 | |
| 113 | bool |
| 114 | ServerSessionPool::validate_sni(HttpSM *sm, NetVConnection *netvc) |
nothing calls this directly
no test coverage detected