commit e6fd1cf8d62270478827895c56f5427844e19f15
author wub <wub@google.com> Thu Nov 19 15:26:25 2020 -0800
committer Copybara-Service <copybara-worker@google.com> Thu Nov 19 15:27:32 2020 -0800
tree 237edec0ddf2c871df79ea464a8a373bb51f281a
parent 89b32a677a7eaf224b43e32215b8b070b5ed7df7

Add a TlsServerHandshaker::ValidateHostname method to validate SNI.

PiperOrigin-RevId: 343381779
Change-Id: I2c449c1fc2769297d5b730cdf4b6eff7b6eb389f

quic/core/tls_server_handshaker.cc

diff --git a/quic/core/tls_server_handshaker.cc b/quic/core/tls_server_handshaker.cc
index e0fe84d..01b5df6 100644
--- a/quic/core/tls_server_handshaker.cc
+++ b/quic/core/tls_server_handshaker.cc
@@ -506,16 +506,23 @@
   return ssl_ticket_aead_success;
 }
 
+bool TlsServerHandshaker::ValidateHostname(const std::string& hostname) const {
+  if (!QuicHostnameUtils::IsValidSNI(hostname)) {
+    // TODO(b/151676147): Include this error string in the CONNECTION_CLOSE
+    // frame.
+    QUIC_LOG(ERROR) << "Invalid SNI provided: \"" << hostname << "\"";
+    return false;
+  }
+  return true;
+}
+
 int TlsServerHandshaker::SelectCertificate(int* out_alert) {
   const char* hostname = SSL_get_servername(ssl(), TLSEXT_NAMETYPE_host_name);
   if (hostname) {
     hostname_ = hostname;
     crypto_negotiated_params_->sni =
         QuicHostnameUtils::NormalizeHostname(hostname_);
-    if (!QuicHostnameUtils::IsValidSNI(hostname_)) {
-      // TODO(b/151676147): Include this error string in the CONNECTION_CLOSE
-      // frame.
-      QUIC_LOG(ERROR) << "Invalid SNI provided: \"" << hostname_ << "\"";
+    if (!ValidateHostname(hostname_)) {
       return SSL_TLSEXT_ERR_ALERT_FATAL;
     }
   } else {

quic/core/tls_server_handshaker.h

diff --git a/quic/core/tls_server_handshaker.h b/quic/core/tls_server_handshaker.h
index 4d12bf3..c6426ce 100644
--- a/quic/core/tls_server_handshaker.h
+++ b/quic/core/tls_server_handshaker.h
@@ -156,6 +156,7 @@
     TlsServerHandshaker* handshaker_;
   };
 
+  virtual bool ValidateHostname(const std::string& hostname) const;
   bool SetTransportParameters();
   bool ProcessTransportParameters(std::string* error_details);