CDRIVER-2153 Add SNI support for the mock server

Author: bjori

src/mongoc/mongoc-stream-tls-openssl.c

@@ -557,12 +557,6 @@ mongoc_stream_tls_openssl_handshake (mongoc_stream_t *stream,
 
    BIO_get_ssl (openssl->bio, &ssl);
 
-/* Added in OpenSSL 0.9.8f, as a build time option */
-#ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME
-   /* Set the SNI hostname we are expecting certificate for */
-   SSL_set_tlsext_host_name (ssl, host);
-#endif
-
    if (BIO_do_handshake (openssl->bio) == 1) {
       if (_mongoc_openssl_check_cert (
              ssl, host, tls->ssl_opts.allow_invalid_hostname)) {
@@ -602,6 +596,25 @@ mongoc_stream_tls_openssl_handshake (mongoc_stream_t *stream,
    RETURN (false);
 }
 
+/* Callback to get the client provided SNI, if any
+ * It is only called in SSL "server mode" (e.g. when using the Mock Server),
+ * and we don't actually use the hostname for anything, just debug print it
+ */
+static int
+_mongoc_stream_tls_openssl_sni (SSL *ssl, int *ad, void *arg)
+{
+   const char *hostname;
+
+   if (ssl == NULL) {
+      MONGOC_DEBUG ("No SNI hostname provided");
+      return SSL_TLSEXT_ERR_NOACK;
+   }
+
+   hostname = SSL_get_servername (ssl, TLSEXT_NAMETYPE_host_name);
+   MONGOC_DEBUG ("Got SNI: '%s'", hostname);
+
+   return SSL_TLSEXT_ERR_OK;
+}
 
 /*
  *--------------------------------------------------------------------------
@@ -667,6 +680,13 @@ mongoc_stream_tls_openssl_new (mongoc_stream_t *base_stream,
    }
 #endif
 
+   if (!client) {
+      /* Only usd by the Mock Server.
+       * Set a callback to get the SNI, if provided */
+      SSL_CTX_set_tlsext_servername_callback (ssl_ctx,
+                                              _mongoc_stream_tls_openssl_sni);
+   }
+
    if (opt->weak_cert_validation) {
       SSL_CTX_set_verify (ssl_ctx, SSL_VERIFY_NONE, NULL);
    } else {
@@ -686,6 +706,16 @@ mongoc_stream_tls_openssl_new (mongoc_stream_t *base_stream,
       RETURN (NULL);
    }
 
+/* Added in OpenSSL 0.9.8f, as a build time option */
+#ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME
+   if (client) {
+      SSL *ssl;
+      /* Set the SNI hostname we are expecting certificate for */
+      BIO_get_ssl (bio_ssl, &ssl);
+      SSL_set_tlsext_host_name (ssl, host);
+#endif
+   }
+
 
    BIO_push (bio_ssl, bio_mongoc_shim);