Skip to content

Commit

Permalink
[nrf fromlist] net: sockets: tls: Allow SNI extension for DTLS
Browse files Browse the repository at this point in the history
DTLS systems can accept the Server Name Indication extension
without using X509 certificates.  Allow this for either
MBEDTLS_X509_CRT_PARSE_C or CONFIG_MBEDTLS_DTLS.

Upstream PR: zephyrproject-rtos/zephyr#44914

Signed-off-by: Pete Skeggs <peter.skeggs@nordicsemi.no>
  • Loading branch information
plskeggs committed Apr 28, 2023
1 parent 230c339 commit 07ae9a4
Showing 1 changed file with 3 additions and 3 deletions.
6 changes: 3 additions & 3 deletions subsys/net/lib/sockets/sockets_tls.c
Original file line number Diff line number Diff line change
Expand Up @@ -459,7 +459,7 @@ static struct tls_context *tls_clone(struct tls_context *source_tls)
memcpy(&target_tls->options, &source_tls->options,
sizeof(target_tls->options));

#if defined(MBEDTLS_X509_CRT_PARSE_C)
#if defined(MBEDTLS_X509_CRT_PARSE_C) || defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
if (target_tls->options.is_hostname_set) {
mbedtls_ssl_set_hostname(&target_tls->ssl,
source_tls->ssl.hostname);
Expand Down Expand Up @@ -1262,7 +1262,7 @@ static int tls_mbedtls_init(struct tls_context *context, bool is_server)
}
#endif /* CONFIG_NET_SOCKETS_ENABLE_DTLS */

#if defined(MBEDTLS_X509_CRT_PARSE_C)
#if defined(MBEDTLS_X509_CRT_PARSE_C) || defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
/* For TLS clients, set hostname to empty string to enforce it's
* verification - only if hostname option was not set. Otherwise
* depend on user configuration.
Expand Down Expand Up @@ -1403,7 +1403,7 @@ static int tls_opt_hostname_set(struct tls_context *context,
{
ARG_UNUSED(optlen);

#if defined(MBEDTLS_X509_CRT_PARSE_C)
#if defined(MBEDTLS_X509_CRT_PARSE_C) || defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
if (mbedtls_ssl_set_hostname(&context->ssl, optval) != 0) {
return -EINVAL;
}
Expand Down

0 comments on commit 07ae9a4

Please sign in to comment.