]> git.ipfire.org Git - thirdparty/haproxy.git/commit
MINOR: ssl: support strict-sni in ssl-default-bind-options
authorWilly Tarreau <w@1wt.eu>
Sat, 17 May 2025 07:23:04 +0000 (09:23 +0200)
committerWilly Tarreau <w@1wt.eu>
Thu, 22 May 2025 13:31:54 +0000 (15:31 +0200)
commit3494775a1f4935a18a78360fcf9d5bee5d443d57
tree7ae0ac0d2eaa1047fccbe0558cceea458f9eb439
parent7244f16ac451fd796042b2184b5d90ed50f9d5af
MINOR: ssl: support strict-sni in ssl-default-bind-options

Several users already reported that it would be nice to support
strict-sni in ssl-default-bind-options. However, in order to support
it, we also need an option to disable it.

This patch moves the setting of the option from the strict_sni field
to a flag in the ssl_options field so that it can be inherited from
the default bind options, and adds a new "no-strict-sni" directive to
allow to disable it on a specific "bind" line.

The test file "del_ssl_crt-list.vtc" which already tests both options
was updated to make use of the default option and the no- variant to
confirm everything continues to work.
doc/configuration.txt
include/haproxy/listener-t.h
reg-tests/ssl/del_ssl_crt-list.vtc
src/cfgparse-ssl.c
src/ssl_clienthello.c
src/ssl_crtlist.c
src/ssl_sock.c