bluedragonx at gmail
Sep 26, 2009, 3:07 PM
Post #7 of 12
(864 views)
Permalink
|
|
Re: Patch for SSL IP Vservers without SNI
[In reply to]
|
|
>> It happens during the TLS handshake immediately after the SNI
>> servername is read out. So after the connection is made, but before a
>> TLS session is established (or at least that's how I understand it),
>> and well before any HTTP request has been made.
>
> If there is a TLS connection. A certificate has been used. So what
> certificate is used if the certificate you want to select is based on a
> decision you can only make if you match it on IP?
I think we're getting mixed up on terminology here. The "connection"
as I'm referring to it is the TCP/IP connection. The TLS handshake
happens after the TCP/IP connection is established. The SNI
servername is read, certificates are swapped, and a TLS session
established during the TLS handshake. After the TLS session is
established the HTTP request is made.
Now, with that clarification...
The virtual server match occurs during the TLS handshake immediately
before the server certificate is sent. At this point in the chain we
have a client IP address and, depending on whether SNI is operable, a
hostname.
There are three problems that must be solved in the current code base
in order to make the above possible.
1) We have to pass the active cherokee_connection_t object into
cryptor->init_tls() so that we can pass it to the call to
cherokee_server_get_vserver(). Currently NULL is passed, so the
vserver match does not know what the IP address is.
2) Make the call to cherokee_server_get_vserver() even when SNI fails
to retrieve a servername. I pass the IP addess as the servername when
SNI fails.
3) Make the call to cherokee_server_get_vserver() even when TLSEXT is
not enabled in the underlying SSL library. This happens in the call
to socket_initialize() which is called by cryptor->init_tls() for
libssl.
So that's what I did, and it works. I know it works as I've tested it
- I would not have submitted the patch without doing functionality
testing on it. Try it =)
-Ryan
_______________________________________________
Cherokee-dev mailing list
Cherokee-dev [at] lists
http://lists.octality.com/listinfo/cherokee-dev
|
cherokee-ssl-ip-vserver.patch
