path: root/www-servers/lighttpd/files/1.4.20/04_all_1.4.x_tls_server_name_indication.diff

Index: src/configfile-glue.c
===================================================================
--- src/configfile-glue.c	(revision 2402)
+++ src/configfile-glue.c	(working copy)
@@ -289,6 +289,10 @@
 			default:
 				break;
 			}
+#if defined USE_OPENSSL && ! defined OPENSSL_NO_TLSEXT
+		} else if (!buffer_is_empty(con->tlsext_server_name)) {
+			l = con->tlsext_server_name;
+#endif
 		} else {
 			l = srv->empty_string;
 		}
Index: src/base.h
===================================================================
--- src/base.h	(revision 2402)
+++ src/base.h	(working copy)
@@ -31,6 +31,9 @@
 #if defined HAVE_LIBSSL && defined HAVE_OPENSSL_SSL_H
 # define USE_OPENSSL
 # include <openssl/ssl.h>
+# if ! defined OPENSSL_NO_TLSEXT && ! defined SSL_CTRL_SET_TLSEXT_HOSTNAME
+#  define OPENSSL_NO_TLSEXT
+# endif
 #endif
 
 #ifdef HAVE_FAM_H
@@ -417,7 +420,10 @@
 #ifdef USE_OPENSSL
 	SSL *ssl;
 	buffer *ssl_error_want_reuse_buffer;
+#ifndef OPENSSL_NO_TLSEXT
+	buffer *tlsext_server_name;
 #endif
+#endif
 	/* etag handling */
 	etag_flags_t etag_flags;
 
Index: src/connections.c
===================================================================
--- src/connections.c	(revision 2402)
+++ src/connections.c	(working copy)
@@ -664,6 +664,9 @@
 	CLEAN(server_name);
 	CLEAN(error_handler);
 	CLEAN(dst_addr_buf);
+#if defined USE_OPENSSL && ! defined OPENSSL_NO_TLSEXT
+	CLEAN(tlsext_server_name);
+#endif
 
 #undef CLEAN
 	con->write_queue = chunkqueue_init();
@@ -728,6 +731,9 @@
 		CLEAN(server_name);
 		CLEAN(error_handler);
 		CLEAN(dst_addr_buf);
+#if defined USE_OPENSSL && ! defined OPENSSL_NO_TLSEXT
+		CLEAN(tlsext_server_name);
+#endif
 #undef CLEAN
 		free(con->plugin_ctx);
 		free(con->cond_cache);
@@ -1338,6 +1344,9 @@
 				return NULL;
 			}
 
+#ifndef OPENSSL_NO_TLSEXT
+			SSL_set_app_data(con->ssl, con);
+#endif
 			SSL_set_accept_state(con->ssl);
 			con->conf.is_ssl=1;
 
Index: src/network.c
===================================================================
--- src/network.c	(revision 2402)
+++ src/network.c	(working copy)
@@ -62,6 +62,45 @@
 	return HANDLER_GO_ON;
 }
 
+#if defined USE_OPENSSL && ! defined OPENSSL_NO_TLSEXT
+int network_ssl_servername_callback(SSL *ssl, int *al, server *srv) {
+	const char *servername;
+	connection *con = (connection *) SSL_get_app_data(ssl);
+
+	buffer_copy_string(con->uri.scheme, "https");
+
+	if (NULL == (servername = SSL_get_servername(ssl, TLSEXT_NAMETYPE_host_name))) {
+		log_error_write(srv, __FILE__, __LINE__, "ss", "SSL:",
+				"failed to get TLS server name");
+		return SSL_TLSEXT_ERR_NOACK;
+	}
+	buffer_copy_string(con->tlsext_server_name, servername);
+	buffer_to_lower(con->tlsext_server_name);
+
+	config_cond_cache_reset(srv, con);
+	config_setup_connection(srv, con);
+
+	config_patch_connection(srv, con, COMP_SERVER_SOCKET);
+	config_patch_connection(srv, con, COMP_HTTP_SCHEME);
+	config_patch_connection(srv, con, COMP_HTTP_HOST);
+
+	if (NULL == con->conf.ssl_ctx) {
+		log_error_write(srv, __FILE__, __LINE__, "ssb", "SSL:",
+				"null SSL_CTX for TLS server name", con->tlsext_server_name);
+		return SSL_TLSEXT_ERR_ALERT_FATAL;
+	}
+
+	/* switch to new SSL_CTX in reaction to a client's server_name extension */
+	if (con->conf.ssl_ctx != SSL_set_SSL_CTX(ssl, con->conf.ssl_ctx)) {
+		log_error_write(srv, __FILE__, __LINE__, "ssb", "SSL:",
+				"failed to set SSL_CTX for TLS server name", con->tlsext_server_name);
+		return SSL_TLSEXT_ERR_ALERT_FATAL;
+	}
+
+	return SSL_TLSEXT_ERR_OK;
+}
+#endif
+
 int network_server_init(server *srv, buffer *host_token, specific_config *s) {
 	int val;
 	socklen_t addr_len;
@@ -312,78 +351,10 @@
 
 	if (s->is_ssl) {
 #ifdef USE_OPENSSL
-		if (srv->ssl_is_init == 0) {
-			SSL_load_error_strings();
-			SSL_library_init();
-			srv->ssl_is_init = 1;
-
-			if (0 == RAND_status()) {
-				log_error_write(srv, __FILE__, __LINE__, "ss", "SSL:",
-						"not enough entropy in the pool");
-				return -1;
-			}
-		}
-
-		if (NULL == (s->ssl_ctx = SSL_CTX_new(SSLv23_server_method()))) {
-			log_error_write(srv, __FILE__, __LINE__, "ss", "SSL:",
-					ERR_error_string(ERR_get_error(), NULL));
-			return -1;
-		}
-
-		if (!s->ssl_use_sslv2) {
-			/* disable SSLv2 */
-			if (SSL_OP_NO_SSLv2 != SSL_CTX_set_options(s->ssl_ctx, SSL_OP_NO_SSLv2)) {
-				log_error_write(srv, __FILE__, __LINE__, "ss", "SSL:",
-						ERR_error_string(ERR_get_error(), NULL));
-				return -1;
-			}
-		}
-
-		if (!buffer_is_empty(s->ssl_cipher_list)) {
-			/* Disable support for low encryption ciphers */
-			if (SSL_CTX_set_cipher_list(s->ssl_ctx, s->ssl_cipher_list->ptr) != 1) {
-				log_error_write(srv, __FILE__, __LINE__, "ss", "SSL:",
-						ERR_error_string(ERR_get_error(), NULL));
-				return -1;
-			}
-		}
-
-		if (buffer_is_empty(s->ssl_pemfile)) {
+		if (NULL == (srv_socket->ssl_ctx = s->ssl_ctx)) {
 			log_error_write(srv, __FILE__, __LINE__, "s", "ssl.pemfile has to be set");
 			return -1;
 		}
-
-		if (!buffer_is_empty(s->ssl_ca_file)) {
-			if (1 != SSL_CTX_load_verify_locations(s->ssl_ctx, s->ssl_ca_file->ptr, NULL)) {
-				log_error_write(srv, __FILE__, __LINE__, "ssb", "SSL:",
-						ERR_error_string(ERR_get_error(), NULL), s->ssl_ca_file);
-				return -1;
-			}
-		}
-
-		if (SSL_CTX_use_certificate_file(s->ssl_ctx, s->ssl_pemfile->ptr, SSL_FILETYPE_PEM) < 0) {
-			log_error_write(srv, __FILE__, __LINE__, "ssb", "SSL:",
-					ERR_error_string(ERR_get_error(), NULL), s->ssl_pemfile);
-			return -1;
-		}
-
-		if (SSL_CTX_use_PrivateKey_file (s->ssl_ctx, s->ssl_pemfile->ptr, SSL_FILETYPE_PEM) < 0) {
-			log_error_write(srv, __FILE__, __LINE__, "ssb", "SSL:",
-					ERR_error_string(ERR_get_error(), NULL), s->ssl_pemfile);
-			return -1;
-		}
-
-		if (SSL_CTX_check_private_key(s->ssl_ctx) != 1) {
-			log_error_write(srv, __FILE__, __LINE__, "sssb", "SSL:",
-					"Private key does not match the certificate public key, reason:",
-					ERR_error_string(ERR_get_error(), NULL),
-					s->ssl_pemfile);
-			return -1;
-		}
-		SSL_CTX_set_default_read_ahead(s->ssl_ctx, 1);
-		SSL_CTX_set_mode(s->ssl_ctx, SSL_CTX_get_mode(s->ssl_ctx) | SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
-
-		srv_socket->ssl_ctx = s->ssl_ctx;
 #else
 
 		buffer_free(srv_socket->srv_token);
@@ -491,6 +462,99 @@
 		{ NETWORK_BACKEND_UNSET,        	NULL }
 	};
 
+#ifdef USE_OPENSSL
+	/* load SSL certificates */
+	for (i = 0; i < srv->config_context->used; i++) {
+		data_config *dc = (data_config *)srv->config_context->data[i];
+		specific_config *s = srv->config_storage[i];
+
+		if (buffer_is_empty(s->ssl_pemfile)) continue;
+
+#ifdef OPENSSL_NO_TLSEXT
+		if (COMP_HTTP_HOST == dc->comp) {
+		    log_error_write(srv, __FILE__, __LINE__, "ss", "SSL:",
+				    "can't use ssl.pemfile with $HTTP[\"host\"], openssl version does not support TLS extensions");
+		    return -1;
+		}
+#endif
+
+		if (srv->ssl_is_init == 0) {
+			SSL_load_error_strings();
+			SSL_library_init();
+			srv->ssl_is_init = 1;
+
+			if (0 == RAND_status()) {
+				log_error_write(srv, __FILE__, __LINE__, "ss", "SSL:",
+						"not enough entropy in the pool");
+				return -1;
+			}
+		}
+
+		if (NULL == (s->ssl_ctx = SSL_CTX_new(SSLv23_server_method()))) {
+			log_error_write(srv, __FILE__, __LINE__, "ss", "SSL:",
+					ERR_error_string(ERR_get_error(), NULL));
+			return -1;
+		}
+
+		if (!s->ssl_use_sslv2) {
+			/* disable SSLv2 */
+			if (SSL_OP_NO_SSLv2 != SSL_CTX_set_options(s->ssl_ctx, SSL_OP_NO_SSLv2)) {
+				log_error_write(srv, __FILE__, __LINE__, "ss", "SSL:",
+						ERR_error_string(ERR_get_error(), NULL));
+				return -1;
+			}
+		}
+
+		if (!buffer_is_empty(s->ssl_cipher_list)) {
+			/* Disable support for low encryption ciphers */
+			if (SSL_CTX_set_cipher_list(s->ssl_ctx, s->ssl_cipher_list->ptr) != 1) {
+				log_error_write(srv, __FILE__, __LINE__, "ss", "SSL:",
+						ERR_error_string(ERR_get_error(), NULL));
+				return -1;
+			}
+		}
+
+		if (!buffer_is_empty(s->ssl_ca_file)) {
+			if (1 != SSL_CTX_load_verify_locations(s->ssl_ctx, s->ssl_ca_file->ptr, NULL)) {
+				log_error_write(srv, __FILE__, __LINE__, "ssb", "SSL:",
+						ERR_error_string(ERR_get_error(), NULL), s->ssl_ca_file);
+				return -1;
+			}
+		}
+
+		if (SSL_CTX_use_certificate_file(s->ssl_ctx, s->ssl_pemfile->ptr, SSL_FILETYPE_PEM) < 0) {
+			log_error_write(srv, __FILE__, __LINE__, "ssb", "SSL:",
+					ERR_error_string(ERR_get_error(), NULL), s->ssl_pemfile);
+			return -1;
+		}
+
+		if (SSL_CTX_use_PrivateKey_file (s->ssl_ctx, s->ssl_pemfile->ptr, SSL_FILETYPE_PEM) < 0) {
+			log_error_write(srv, __FILE__, __LINE__, "ssb", "SSL:",
+					ERR_error_string(ERR_get_error(), NULL), s->ssl_pemfile);
+			return -1;
+		}
+
+		if (SSL_CTX_check_private_key(s->ssl_ctx) != 1) {
+			log_error_write(srv, __FILE__, __LINE__, "sssb", "SSL:",
+					"Private key does not match the certificate public key, reason:",
+					ERR_error_string(ERR_get_error(), NULL),
+					s->ssl_pemfile);
+			return -1;
+		}
+		SSL_CTX_set_default_read_ahead(s->ssl_ctx, 1);
+		SSL_CTX_set_mode(s->ssl_ctx, SSL_CTX_get_mode(s->ssl_ctx) | SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
+
+#ifndef OPENSSL_NO_TLSEXT
+		if (!SSL_CTX_set_tlsext_servername_callback(s->ssl_ctx, network_ssl_servername_callback) ||
+		    !SSL_CTX_set_tlsext_servername_arg(s->ssl_ctx, srv)) {
+			log_error_write(srv, __FILE__, __LINE__, "ss", "SSL:",
+					"failed to initialize TLS servername callback, openssl library does not support TLS servername extension");
+			return -1;
+		}
+#endif
+	}
+#endif
+
 	b = buffer_init();
 
 	buffer_copy_string_buffer(b, srv->srvconf.bindhost);
Index: src/configfile.c
===================================================================
--- src/configfile.c	(revision 2402)
+++ src/configfile.c	(working copy)
@@ -293,6 +293,7 @@
 	PATCH(is_ssl);
 
 	PATCH(ssl_pemfile);
+	PATCH(ssl_ctx);
 	PATCH(ssl_ca_file);
 	PATCH(ssl_cipher_list);
 	PATCH(ssl_use_sslv2);
@@ -348,6 +349,7 @@
 				PATCH(etag_use_size);
 			} else if (buffer_is_equal_string(du->key, CONST_STR_LEN("ssl.pemfile"))) {
 				PATCH(ssl_pemfile);
+				PATCH(ssl_ctx);
 			} else if (buffer_is_equal_string(du->key, CONST_STR_LEN("ssl.ca-file"))) {
 				PATCH(ssl_ca_file);
 			} else if (buffer_is_equal_string(du->key, CONST_STR_LEN("ssl.use-sslv2"))) {