technocloud-public/nginx-unit
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Changing SNI callback return code if a client sends no SNI.

Browse Source 
When a client sends no SNI is a common situation.  But currently the server
processes it as an error and returns SSL_TLSEXT_ERR_ALERT_FATAL causing
termination of a current TLS session.  The problem occurs if configuration has
more than one certificate bundle in a listener.

This fix changes the return code to SSL_TLSEXT_ERR_OK and the log level of a
message.
This commit is contained in:
Andrey Suvorov
2021-07-22 11:23:48 -07:00
parent c37ff7ed0e
commit f965e358b6
2 changed files with 13 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
docs/changes.xml
View File

@@ -43,6 +43,14 @@ process and thread lifecycle hooks in Ruby.
</para>
</change>
<change type="bugfix">
<para>
TLS connection was rejected for configuration with more than one
certificate bundle in a listener if a client did not use SNI.
</para>
</change>
<change type="bugfix">
<para>
the router process could crash on TLS connection open when multiple listeners