Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix TLS behavior #17

Merged
merged 4 commits into from
Sep 8, 2022
Merged

Fix TLS behavior #17

merged 4 commits into from
Sep 8, 2022

Conversation

wrouesnel
Copy link
Owner

  • Fix the behavior of TLS SNI name sending with sensible defaults.
  • Add status fail if TLS certificate does not verify, with overrides for ignoring the status and pinning an upstream certificate identity
  • Fix some spelling mistakes including the http_response_received_bool spelling

TLS SNI was not being sent by default. The `tls_sni_name` option has been
added to allow explicit control and common sense defaults added.

When a hostname is specified and `tls_enabled` is true, the system will
default to sending a TLS SNI name of the hostname.

If a URL is specified with a valid hostname, then the system will send
an SNI name matching the Hostname portion (without the port
specification).

All SNI handling can be overridden by specifying a fixed `tls_sni_name`,
but the default behavior should be unsurprising.
tlsConfig := &tls.Config{InsecureSkipVerify: true} //nolint:gosec
tlsConfig := &tls.Config{
ServerName: s.tlsSniName,
InsecureSkipVerify: true, //nolint:gosec

Check failure

Code scanning / CodeQL

Disabled TLS certificate check

InsecureSkipVerify should not be used in production code.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

1 participant