mirror of
https://github.com/obgm/libcoap.git
synced 2026-11-09 02:32:53 +03:00
coap_mbedtls.c: Fix SNI hostname definition if not provided
MbedTLS based PKI clients may report SSL - Attempt to verify a certificate without an expected hostname. This is usually insecure. In TLS clients, when a client authenticates a server through its certificate, the client normally checks three things: .... The application provided client_sni may have been removed as per https://datatracker.ietf.org/doc/html/rfc6066#section-3 Literal IPv4 and IPv6 addresses are not permitted in "HostName". and so MbedTLS is now explicitly told that therw is no hostname.
This commit is contained in:
1 parent
7889db616a
commit
e6883c3d67
1 file changed
+1
-3
+1
-3
@@ -1435,9 +1435,7 @@ setup_client_ssl_session(coap_session_t *c_session,
|
||||
}
|
||||
}
|
||||
#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_ALPN */
|
||||
if (m_context->setup_data.client_sni) {
|
||||
mbedtls_ssl_set_hostname(&m_env->ssl, m_context->setup_data.client_sni);
|
||||
}
|
||||
mbedtls_ssl_set_hostname(&m_env->ssl, m_context->setup_data.client_sni);
|
||||
#if defined(MBEDTLS_SSL_PROTO_DTLS)
|
||||
#if MBEDTLS_VERSION_NUMBER >= 0x02100100
|
||||
mbedtls_ssl_set_mtu(&m_env->ssl, (uint16_t)c_session->mtu);
|
||||
|
||||
Reference in new issue
Block a user