From b510b740fb4e3cb35e6f297c232c0e776dbcbc71 Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Tue, 14 Nov 2017 13:43:42 +0000 Subject: [PATCH] Ignore the session when setting SNI in s_client As per this comment: https://github.com/openssl/openssl/issues/4496#issuecomment-337767145 Since the server is entitled to reject our session our ClientHello should include everything that we would want if a full handshake were to happen. Therefore we shouldn't use the session as a source of information for setting SNI. Reviewed-by: Ben Kaduk (Merged from https://github.com/openssl/openssl/pull/4738) --- apps/s_client.c | 11 ----------- test/recipes/70-test_sslmessages.t | 3 +-- test/recipes/70-test_tls13messages.t | 6 ++---- 3 files changed, 3 insertions(+), 17 deletions(-) diff --git a/apps/s_client.c b/apps/s_client.c index 7c0639faad..fcab44cb56 100644 --- a/apps/s_client.c +++ b/apps/s_client.c @@ -1923,18 +1923,7 @@ int s_client_main(int argc, char **argv) ERR_print_errors(bio_err); goto end; } - /* By default the SNI should be the same as was set in the session */ - if (!noservername && servername == NULL) { - servername = SSL_SESSION_get0_hostname(sess); - if (servername == NULL) { - /* - * Force no SNI to be sent so we are consistent with the - * session. - */ - noservername = 1; - } - } SSL_SESSION_free(sess); } diff --git a/test/recipes/70-test_sslmessages.t b/test/recipes/70-test_sslmessages.t index 5ddf384fe2..e3eadfa107 100644 --- a/test/recipes/70-test_sslmessages.t +++ b/test/recipes/70-test_sslmessages.t @@ -164,8 +164,7 @@ $proxy->clientflags("-no_tls1_3 -sess_in ".$session); $proxy->clientstart(); checkhandshake($proxy, checkhandshake::RESUME_HANDSHAKE, checkhandshake::DEFAULT_EXTENSIONS - & ~checkhandshake::SESSION_TICKET_SRV_EXTENSION - & ~checkhandshake::SERVER_NAME_CLI_EXTENSION, + & ~checkhandshake::SESSION_TICKET_SRV_EXTENSION, "Resumption handshake test"); unlink $session; diff --git a/test/recipes/70-test_tls13messages.t b/test/recipes/70-test_tls13messages.t index 239eabfd5e..aaecbd3cca 100644 --- a/test/recipes/70-test_tls13messages.t +++ b/test/recipes/70-test_tls13messages.t @@ -167,8 +167,7 @@ $proxy->clientstart(); checkhandshake($proxy, checkhandshake::RESUME_HANDSHAKE, (checkhandshake::DEFAULT_EXTENSIONS | checkhandshake::PSK_CLI_EXTENSION - | checkhandshake::PSK_SRV_EXTENSION) - & ~checkhandshake::SERVER_NAME_CLI_EXTENSION, + | checkhandshake::PSK_SRV_EXTENSION), "Resumption handshake test"); #Test 3: A status_request handshake (client request only) @@ -312,8 +311,7 @@ checkhandshake($proxy, checkhandshake::HRR_RESUME_HANDSHAKE, (checkhandshake::DEFAULT_EXTENSIONS | checkhandshake::KEY_SHARE_HRR_EXTENSION | checkhandshake::PSK_CLI_EXTENSION - | checkhandshake::PSK_SRV_EXTENSION) - & ~checkhandshake::SERVER_NAME_CLI_EXTENSION, + | checkhandshake::PSK_SRV_EXTENSION), "Resumption handshake with HRR test"); #Test 16: Acceptable but non preferred key_share -- 2.25.1