mirror of
https://blitiri.com.ar/repos/chasquid
synced 2026-10-29 15:02:30 +00:00
Alberto Bertogli
b3a500d9e4
Today, the client can give us any SNI, and still complete a valid negotiation, which means it can be attacker-controlled (including having problematic characters). We use that SNI as our hostname in a variety of places, including Received and Authentication-Results headers. This creates an opportunity for an attacker to manipulate those headers. To fix that problem, this patch only takes the SNI if it matches one of our certs' hostnames. Otherwise we use the configured hostname (same as if there was no SNI today). Once Go 1.27 is our minimum supported version, we can simplify this further by checking the SNI against ConnectionState.LocalCertificate.