shithub: tlssrv.sni

Info  •  Files  •  Log

Check for client extensions before dealing with certificate.

--- a/tlshand.c

+++ b/tlshand.c

@@ -744,6 +744,12 @@

 		c->sec->psk = psk;

 		c->sec->psklen = psklen;

 	}

+	if(checkClientExtensions(c, m.u.clientHello.extensions) < 0)

+		goto Err;

+	if(trace)

+		trace("ClientHello server name indicator %s\n", c->serverName);

+    // TODO: implement function that selects the right certificate

+    // from an array of certificate names given the SNI

 	if(certlen > 0){

 		/* server certificate */

 		c->sec->rsapub = X509toRSApub(cert, certlen, nil, 0);

@@ -757,10 +763,6 @@

 			goto Err;

 		}

 	}

-	if(checkClientExtensions(c, m.u.clientHello.extensions) < 0)

-		goto Err;

-	if(trace)

-		trace("ClientHello server name indicator %s\n", c->serverName);

 	cipher = okCipher(m.u.clientHello.ciphers, psklen > 0, c->sec->nc != nil);

 	if(cipher < 0 || !setAlgs(c, cipher)) {

 		tlsError(c, EHandshakeFailure, "no matching cipher suite");