net/handshake: Enable the SNI extension to work properly
authorChuck Lever <chuck.lever@oracle.com>
Thu, 11 May 2023 15:49:50 +0000 (11:49 -0400)
committerJakub Kicinski <kuba@kernel.org>
Thu, 25 May 2023 05:05:24 +0000 (22:05 -0700)
commit26fb5480a27d34975cc2b680b77af189620dd740
tree6e14b559ee327c9fde86287f3ba99f47731308dc
parent1ce77c998f0415d7d9d91cb9bd7665e25c8f75f1
net/handshake: Enable the SNI extension to work properly

Enable the upper layer protocol to specify the SNI peername. This
avoids the need for tlshd to use a DNS lookup, which can return a
hostname that doesn't match the incoming certificate's SubjectName.

Fixes: 2fd5532044a8 ("net/handshake: Add a kernel API for requesting a TLSv1.3 handshake")
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Documentation/netlink/specs/handshake.yaml
Documentation/networking/tls-handshake.rst
include/net/handshake.h
include/uapi/linux/handshake.h
net/handshake/tlshd.c