Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] tunnel/tls/server.go:acceptLoop 里 sni mismatch 错误消息有错误 #531

Open
lgxz opened this issue Jul 14, 2024 · 2 comments
Open

Comments

@lgxz
Copy link

lgxz commented Jul 14, 2024

if s.verifySNI && !matched { return nil, common.NewError("sni mismatched: " + hello.ServerName + ", expected: " + s.sni) }

说 expected s.sni,实际上,上面的检查匹配逻辑是:

  1. 如果用户配置了 sni,则检查用户配置的,否则检查证书 CN。
  2. 检查证书里的 dnsNames

所以,这个错误消息里的应该是:
expected := sni + " or " + strings.Join(dnsNames, "/")

当然,这是简化处理。没有考虑 dnsNames 包含 sni。

@Potterli20
Copy link

来个pr嘛

@lgxz
Copy link
Author

lgxz commented Jul 14, 2024

来个pr嘛

Ok. done.

不过感觉代码逻辑似乎还是有点问题。

似乎用户可以设置一个和证书里的 CommonName 以及 DNS Names 都不同的 sni,只要客户端/服务端配置一致就行。
因为代码逻辑里只要 s.sni 匹配就算匹配通过。

那么证书的意义是什么呢?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants