Skip to content

Commit 7d6cf3a

Browse files
author
nnposter
committed
Implementation of TLS SNI override in Ncat
Closes #2087, closes #1928, fixes #1927, fixes #1974
1 parent f4b0872 commit 7d6cf3a

7 files changed

Lines changed: 36 additions & 5 deletions

File tree

‎CHANGELOG‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
#Nmap Changelog ($Id$); -*-text-*-
22

3+
o [Ncat][GH#2087][GH#1927][GH#1928][GH#1974] It is now possible to override
4+
the value of TLS SNI via --ssl-servername [Hank Leininger, nnposter]
5+
36
o [GH#2104] Fixed parsing of TCP options which would hang (infinite loop) if an
47
option had an explicit length of 0. Affects Nmap 7.80 only.
58
[Daniel Miller, Imed Mnif]

‎ncat/docs/ncat.usage.txt‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,8 @@ Options taking a time assume seconds. Append 'ms' for milliseconds,
5050
--ssl-verify Verify trust and domain name of certificates
5151
--ssl-trustfile PEM file containing trusted SSL certificates
5252
--ssl-ciphers Cipherlist containing SSL ciphers to use
53-
--ssl-alpn ALPN protocol list to use.
53+
--ssl-servername Request distinct server name (SNI)
54+
--ssl-alpn ALPN protocol list to use
5455
--version Display Ncat's version information and exit
5556

5657
See the ncat(1) manpage for full options, descriptions and usage examples

‎ncat/docs/ncat.xml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -411,6 +411,21 @@
411411
</listitem>
412412
</varlistentry>
413413

414+
<varlistentry>
415+
<term>
416+
<option>--ssl-servername <replaceable>name</replaceable></option> (Request distinct server name)
417+
<indexterm><primary><option>--ssl-servername</option> (Ncat option)</primary></indexterm>
418+
</term>
419+
<listitem>
420+
<para>In client mode, this option sets the TLS SNI (Server Name
421+
Indication) extension, which tells the server the name of the
422+
logical server Ncat is contacting. This is important when the
423+
target server hosts multiple virtual servers at a single underlying
424+
network address. If the option is not provided, the TLS SNI
425+
extension will be populated with the target server hostname.</para>
426+
</listitem>
427+
</varlistentry>
428+
414429
<varlistentry>
415430
<term>
416431
<option>--ssl-alpn <replaceable>ALPN list</replaceable></option> (Specify ALPN protocol list)

‎ncat/ncat_connect.c‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -972,7 +972,7 @@ static nsock_iod new_iod(nsock_pool mypool) {
972972
nsock_iod nsi = nsock_iod_new(mypool, NULL);
973973
if (nsi == NULL)
974974
bye("Failed to create nsock_iod.");
975-
if (nsock_iod_set_hostname(nsi, o.target) == -1)
975+
if (nsock_iod_set_hostname(nsi, o.sslservername) == -1)
976976
bye("Failed to set hostname on iod.");
977977

978978
switch (srcaddr.storage.ss_family) {
@@ -1128,7 +1128,8 @@ int ncat_connect(void)
11281128
/* Once the proxy negotiation is done, Nsock takes control of the
11291129
socket. */
11301130
cs.sock_nsi = nsock_iod_new2(mypool, connect_socket, NULL);
1131-
nsock_iod_set_hostname(cs.sock_nsi, o.target);
1131+
if (nsock_iod_set_hostname(cs.sock_nsi, o.sslservername) == -1)
1132+
bye("Failed to set hostname on iod.");
11321133
if (o.ssl)
11331134
{
11341135
nsock_reconnect_ssl(mypool, cs.sock_nsi, connect_handler, o.conntimeout, NULL, NULL);
@@ -1267,7 +1268,7 @@ static void connect_handler(nsock_pool nsp, nsock_event evt, void *data)
12671268
if (nsock_iod_check_ssl(cs.sock_nsi)) {
12681269
/* Check the domain name. ssl_post_connect_check prints an
12691270
error message if appropriate. */
1270-
if (!ssl_post_connect_check((SSL *)nsock_iod_get_ssl(cs.sock_nsi), o.target))
1271+
if (!ssl_post_connect_check((SSL *)nsock_iod_get_ssl(cs.sock_nsi), o.sslservername))
12711272
bye("Certificate verification error.");
12721273
}
12731274
#endif

‎ncat/ncat_core.c‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -217,6 +217,7 @@ void options_init(void)
217217
o.sslverify = 0;
218218
o.ssltrustfile = NULL;
219219
o.sslciphers = NULL;
220+
o.sslservername = NULL;
220221
o.sslalpn = NULL;
221222
#endif
222223
}

‎ncat/ncat_core.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -223,6 +223,7 @@ struct options {
223223
int sslverify;
224224
char *ssltrustfile;
225225
char *sslciphers;
226+
char* sslservername;
226227
char *sslalpn;
227228
int zerobyte;
228229
};

‎ncat/ncat_main.c‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -358,6 +358,7 @@ int main(int argc, char *argv[])
358358
{"ssl-verify", no_argument, NULL, 0},
359359
{"ssl-trustfile", required_argument, NULL, 0},
360360
{"ssl-ciphers", required_argument, NULL, 0},
361+
{"ssl-servername", required_argument, NULL, 0},
361362
{"ssl-alpn", required_argument, NULL, 0},
362363
#else
363364
{"ssl-cert", optional_argument, NULL, 0},
@@ -573,6 +574,9 @@ int main(int argc, char *argv[])
573574
} else if (strcmp(long_options[option_index].name, "ssl-ciphers") == 0) {
574575
o.ssl = 1;
575576
o.sslciphers = Strdup(optarg);
577+
} else if (strcmp(long_options[option_index].name, "ssl-servername") == 0) {
578+
o.ssl = 1;
579+
o.sslservername = Strdup(optarg);
576580
#ifdef HAVE_ALPN_SUPPORT
577581
} else if (strcmp(long_options[option_index].name, "ssl-alpn") == 0) {
578582
o.ssl = 1;
@@ -594,6 +598,8 @@ int main(int argc, char *argv[])
594598
bye("OpenSSL isn't compiled in. The --ssl-trustfile option cannot be chosen.");
595599
} else if (strcmp(long_options[option_index].name, "ssl-ciphers") == 0) {
596600
bye("OpenSSL isn't compiled in. The --ssl-ciphers option cannot be chosen.");
601+
} else if (strcmp(long_options[option_index].name, "ssl-servername") == 0) {
602+
bye("OpenSSL isn't compiled in. The --ssl-servername option cannot be chosen.");
597603
} else if (strcmp(long_options[option_index].name, "ssl-alpn") == 0) {
598604
bye("OpenSSL isn't compiled in. The --ssl-alpn option cannot be chosen.");
599605
}
@@ -695,7 +701,8 @@ int main(int argc, char *argv[])
695701
" --ssl-verify Verify trust and domain name of certificates\n"
696702
" --ssl-trustfile PEM file containing trusted SSL certificates\n"
697703
" --ssl-ciphers Cipherlist containing SSL ciphers to use\n"
698-
" --ssl-alpn ALPN protocol list to use.\n"
704+
" --ssl-servername Request distinct server name (SNI)\n"
705+
" --ssl-alpn ALPN protocol list to use\n"
699706
#endif
700707
" --version Display Ncat's version information and exit\n"
701708
"\n"
@@ -943,6 +950,8 @@ int main(int argc, char *argv[])
943950
&& (rc = resolve_multi(o.target, 0, targetaddrs, o.af)) != 0)
944951

945952
bye("Could not resolve hostname \"%s\": %s.", o.target, gai_strerror(rc));
953+
if (!o.sslservername)
954+
o.sslservername = o.target;
946955
optind++;
947956
} else {
948957
if (!o.listen)

0 commit comments

Comments
 (0)