mirror of
https://github.com/rsyslog/rsyslog.git
synced 2026-04-23 13:48:12 +02:00
9d404af9d3
Non-technical: users want SNI support so outbound TLS can target virtual hosts and interoperate with common TLS gateways and CDNs. Impact: user-visible behavior change and new config knob; ABI of internal netstream interfaces incremented (modules must rebuild). Before/After: previously SNI was never set; now SNI is set to the target hostname (not for literal IPs), or to a configured value. This change plumbs a new "remote SNI" through the netstream stack and omfwd. New API hooks SetRemoteSNI are added to nsd, netstrm, and netstrms, with IF versions bumped. nsd_ossl and nsd_gtls honor an explicit remoteSNI first; otherwise they auto-set SNI when the target is a hostname (skip for IPv4/IPv6 literals). nsd_ptcp rejects SNI with RS_RET_VALUE_NOT_SUPPORTED. omfwd gains - StreamDriverRemoteSNI / StreamDriver.RemoteSNI (aliases), and passes it during TCPSendInitTarget. Destructors in gtls/ossl and netstrms free the new remoteSNI field. Tests add helper SNI servers (OpenSSL and GnuTLS) and cover three cases per TLS lib: no SNI for IP targets, auto SNI for hostnames, and configured SNI override. Build glue and diag helpers are included. In 2026 rebase and some fixup with the help of AI Agents: ChatGPT Codex Co-authored-by: Rainer Gerhards <rgerhards@adiscon.com> Signed-off-by: Rainer Gerhards <rgerhards@adiscon.com>
31 lines
653 B
Bash
Executable File
31 lines
653 B
Bash
Executable File
#!/usr/bin/env bash
|
|
# Author: John Cantu
|
|
# Test that no TLS SNI is sent by omfwd when connecting to an IP address
|
|
|
|
. ${srcdir:=.}/diag.sh init
|
|
|
|
port=$(get_free_port)
|
|
|
|
generate_conf
|
|
add_conf '
|
|
global(DefaultNetstreamDriverCAFile="'$srcdir/tls-certs/ca.pem'" \
|
|
net.ipprotocol="ipv4-only")
|
|
|
|
action(type="omfwd"
|
|
target="127.0.0.1"
|
|
protocol="tcp"
|
|
port="'$port'"
|
|
StreamDriver="gtls"
|
|
StreamDriverMode="1"
|
|
StreamDriverAuthMode="anon"
|
|
)
|
|
'
|
|
|
|
omfwd_sni_server "gnutls" "$port"
|
|
startup
|
|
omfwd_sni_check "(NULL)"
|
|
shutdown_immediate
|
|
wait_shutdown
|
|
kill -9 $(cat "$RSYSLOG_DYNNAME.sni-server.pid")
|
|
exit_test
|