Using SNI switching does not work if client verification is used in one of the "virtual" servers
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 35/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- c
- Domain
- networking, security
Research direction
Start by locating the addServerName handling and compare it with PR #224, which is referenced as adding the needed SSL_set_verify call. Trace how the server2.example.com configuration is selected during SNI handling. Done means client verification works for the virtual server without breaking the default server configuration.
Written by the indexing model from the issue text.
Description
This issue is most easily described from uWebSockets point of view. When using addServerName like:
auto app = uWS::SSLApp({
.key_file_name = "srv1.key",
.cert_file_name = "srv1.crt"
}).addServerName("server2.example.com", {
.key_file_name = "srv2.key",
.cert_file_name = "srv2.crt",
.ca_file_name = "client-ca.crt"
})
//snip
.domain("server2.example.com")
//snip
client verification for server2 is not set up correctly. PR #224 adds the necessary SSL_set_verify() for this to work. This is also how it is done (-ish) in httpds equivalent function in mod_ssl: https://github.com/apache/httpd/blob/4a9cd1fccf8e79eda2132d65166af6e87e4f5fe9/modules/ssl/ssl_engine_kernel.c#L2591.
- Dominant language
- C
- Stars
- 1.5k
- Forks
- 307
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from uNetworking/uSockets
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
uNetworking/uSockets#259 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
uNetworking/uSockets#258 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
uNetworking/uSockets#256 · 1 reaction ·
-
enhancement help wanted
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
uNetworking/uSockets#252 · 5 comments ·
-
Difficulty 3/5 1-2 days Newbie friendliness 45/100
uNetworking/uSockets#255 · 2 comments · 1 reaction ·
All issues in uNetworking/uSockets
Similar issues
-
[adam] AdamNet network read doesn't cap to MAX_ADAM_PACKET_LEN, overflows client receive buffers Open
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
FujiNetWIFI/fujinet-firmware#1649 · 2 comments ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
HarbourMasters/Shipwright#7229 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
riscv-software-src/riscv-isa-sim#2435 · 1 comment ·
-
bug Self Built Image SNAPSHOT Supported Device target/ramips
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100