Explicitly disable server name indication #12
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
nalundgaard
reviewed
Sep 25, 2017
src/lhttpc_sock.erl
Outdated
| %% We want the previous behavior which ignored the server name | ||
| %% indicator, so disable this. I believe this option has existed | ||
| %% since R16. | ||
| ssl:connect(Host, Port, Options ++ [{server_name_indication, disable}], Timeout); |
There was a problem hiding this comment.
should this be [{server_name_indication, disable} | Options ]? Meaning, is any other value basically incompatible with lhttpc?
There was a problem hiding this comment.
Probably would be better than what I have. I guess this way you could explicitly pass it and override the behavior though. But yes, any other option as of OTP 20 will fail the pattern matches in lhttpc_client at line 222.
There was a problem hiding this comment.
it should be first param anyway to make proplists:get work nicely if smb has actually passed smth
Server name indication is a way for a server to present multiple TLS certificates from a single IP address. As of OTP 20 the SSL application passed back the SNI information to the client so that it can be validated. We restore the previous behavior by disabling this functionality explicitly. The SNI disable option has existed since at least OTP 17 so it ought to be safe for several previous OTP releases.
motobob
approved these changes
Sep 25, 2017
nalundgaard
approved these changes
Sep 25, 2017
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Server name indication is a way for a server to present multiple TLS certificates from a single IP address. As of OTP 20 the SSL application passed back the SNI information to the client so that it can be validated.
We restore the previous behavior by disabling this functionality explicitly.
The SNI disable option has existed since at least OTP 17 so it ought to be safe for several previous OTP releases.
Closes #11