CryptoPkg: Add SNI extension to TLS ClientHello

Webservers hosting multiple websites require the TLS SNI
(Server Name Indication) in the ClientHello to know which certificate
to return.
The current TLS code does not include the server name in the
ClientHello handshake, which leads to failed HTTPS boots when the
server does not return the correct certificate.

This sets the host name for SNI in TlsSetVerifyHost which receives the
host name also for verification against the certificates.

Signed-off-by: Sebastian Witt <sebastian.witt@siemens.com>

1 files changed, 18 insertions, 0 deletions

diff --git a/CryptoPkg/Library/TlsLib/TlsConfig.c b/CryptoPkg/Library/TlsLib/TlsConfig.c
index 29d24abdca..afbc583daf 100644
--- a/CryptoPkg/Library/TlsLib/TlsConfig.c
+++ b/CryptoPkg/Library/TlsLib/TlsConfig.c
@@ -500,6 +500,24 @@ TlsSetVerifyHost (
     return EFI_INVALID_PARAMETER;

   }

 

+  DEBUG ((

+    DEBUG_VERBOSE,

+    "%a:%a: SNI hostname: %a\n",

+    gEfiCallerBaseName,

+    __func__,

+    HostName

+    ));

+

+  if (!SSL_set_tlsext_host_name (TlsConn->Ssl, HostName)) {

+    DEBUG ((

+      DEBUG_ERROR,

+      "%a:%a: Could not set hostname %a for SNI\n",

+      gEfiCallerBaseName,

+      __func__,

+      HostName

+      ));

+  }

+

   SSL_set_hostflags (TlsConn->Ssl, Flags);

 

   VerifyParam = SSL_get0_param (TlsConn->Ssl);