diff options
| author | luigi1111 <luigi1111w@gmail.com> | 2023-07-06 21:33:57 -0500 |
|---|---|---|
| committer | luigi1111 <luigi1111w@gmail.com> | 2023-07-06 21:33:57 -0500 |
| commit | 953732996252e409b1a3143e3c8d83b62eccd917 (patch) | |
| tree | 92d19e677c7974a2871c01e8860afd95c6b8ffda | |
| parent | Merge pull request #8894 (diff) | |
| parent | Set SSL SNI even when server verification is disabled (diff) | |
| download | monero-953732996252e409b1a3143e3c8d83b62eccd917.tar.xz | |
Merge pull request #8899
0961c2a Set SSL SNI even when server verification is disabled (Lee *!* Clagett)
| -rw-r--r-- | contrib/epee/src/net_ssl.cpp | 13 |
1 files changed, 8 insertions, 5 deletions
diff --git a/contrib/epee/src/net_ssl.cpp b/contrib/epee/src/net_ssl.cpp index 3822eb16d..0ad71d9c0 100644 --- a/contrib/epee/src/net_ssl.cpp +++ b/contrib/epee/src/net_ssl.cpp @@ -497,6 +497,13 @@ void ssl_options_t::configure( const std::string& host) const { socket.next_layer().set_option(boost::asio::ip::tcp::no_delay(true)); + { + // in case server is doing "virtual" domains, set hostname + SSL* const ssl_ctx = socket.native_handle(); + if (type == boost::asio::ssl::stream_base::client && !host.empty() && ssl_ctx) + SSL_set_tlsext_host_name(ssl_ctx, host.c_str()); + } + /* Using system-wide CA store for client verification is funky - there is no expected hostname for server to verify against. If server doesn't have @@ -514,11 +521,7 @@ void ssl_options_t::configure( { socket.set_verify_mode(boost::asio::ssl::verify_peer | boost::asio::ssl::verify_fail_if_no_peer_cert); - // in case server is doing "virtual" domains, set hostname - SSL* const ssl_ctx = socket.native_handle(); - if (type == boost::asio::ssl::stream_base::client && !host.empty() && ssl_ctx) - SSL_set_tlsext_host_name(ssl_ctx, host.c_str()); - + socket.set_verify_callback([&](const bool preverified, boost::asio::ssl::verify_context &ctx) { // preverified means it passed system or user CA check. System CA is never loaded |