feat(tls)!: move hostname configuration to tls_stream#323
Merged
Conversation
The hostname used for SNI and peer certificate verification is per-connection state, not shared configuration. Remove tls_context::set_hostname and add tls_stream::set_hostname, which takes effect at the next handshake, persists across reset(), and disables SNI and hostname verification when given an empty name. A stream can now be reset and handshaked again against a different hostname. On the OpenSSL backend, reset() now also drops the cached TLS session so a post-reset handshake performs full certificate verification instead of silently resuming.
|
An automated preview of the documentation is available at https://323.corosio.prtest3.cppalliance.org/index.html If more commits are pushed to the pull request, the docs will rebuild at the same URL. 2026-07-22 13:09:02 UTC |
|
GCOVR code coverage report https://323.corosio.prtest3.cppalliance.org/gcovr/index.html Build time: 2026-07-22 13:26:46 UTC |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## develop #323 +/- ##
===========================================
- Coverage 77.53% 77.47% -0.06%
===========================================
Files 96 96
Lines 6899 6869 -30
Branches 1663 1652 -11
===========================================
- Hits 5349 5322 -27
Misses 1055 1055
+ Partials 495 492 -3
Continue to review full report in Codecov by Harness.
🚀 New features to boost your workflow:
|
sgerbino
force-pushed
the
pr/tls-hostname
branch
from
July 21, 2026 22:33
b0f7690 to
c65c874
Compare
The scoped tls_role enum moves from tls_context.hpp to tls_stream.hpp, where its only consumer lives, and handshake() takes it in place of the nested unscoped handshake_type, which is removed. Backend plumbing that degraded the role to int (do_handshake, init_ssl_for_role) now carries tls_role end to end.
set_hostname with an IP literal (IPv4 or IPv6) now matches the certificate's iPAddress subjectAltName entries instead of its DNS names, and sends no SNI, which RFC 6066 restricts to DNS names. On OpenSSL the literal is applied via X509_VERIFY_PARAM_set1_ip_asc, with the unused host/ip field cleared so a reset stream cannot carry the previous target's matching rule. On WolfSSL the literal goes through wolfSSL_check_ip_address; enforcement requires a build with both OPENSSL_EXTRA and WOLFSSL_IP_ALT_NAME, and on builds lacking either the call reports success while verification silently checks nothing, so the handshake fails closed with function_not_supported, reported by the new wolfssl_supports_ip_alt_name() probe.
A failed handshake attempt now consumes the stream: the next handshake() behaves as if reset() had been called first, so a hostname changed after a failure is applied instead of being silently ignored on a dead session. The hostname now applies to client handshakes only; a server-role handshake clears any name a prior client-role handshake left in the verify params, so client certificates are never hostname-matched. Failures installing the SNI name or the verify-param host fail the handshake rather than proceed without the requested check.
wolfSSL_check_ip_address reports success even on builds that compiled out enforcement, so its return check could never fail closed. Setting the literal through wolfSSL_get0_param and wolfSSL_X509_VERIFY_PARAM_set1_ip_asc installs it on the exact path the certificate check consults, returns a meaningful failure, and binds symbols exported only by OPENSSL_EXTRA builds — running against a WolfSSL downgraded below the build-time feature set now fails at load instead of silently skipping the name check.
sgerbino
force-pushed
the
pr/tls-hostname
branch
from
July 22, 2026 13:01
c65c874 to
6a401d6
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The hostname used for SNI and peer certificate verification is per-connection state, not shared configuration. Remove tls_context::set_hostname and add tls_stream::set_hostname, which takes effect at the next handshake, persists across reset(), and disables SNI and hostname verification when given an empty name. A stream can now be reset and handshaked again against a different hostname. On the OpenSSL backend, reset() now also drops the cached TLS session so a post-reset handshake performs full certificate verification instead of silently resuming.
Resolves #239.