From 16a306687a2049dff0bb4139165fc22381905643 Mon Sep 17 00:00:00 2001 From: Artem Boldariev Date: Fri, 14 Mar 2025 21:35:39 +0200 Subject: [PATCH] Dig: carefully check if the server name for SNI is a hostname Previously the code would not check if the string intended to be used for SNI is a hostname. --- bin/dig/dighost.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c index d92c30a3f9..334ad2be8d 100644 --- a/bin/dig/dighost.c +++ b/bin/dig/dighost.c @@ -2780,8 +2780,19 @@ _cancel_lookup(dig_lookup_t *lookup, const char *file, unsigned int line) { static inline const char * get_tls_sni_hostname(dig_query_t *query) { - return query->lookup->tls_hostname_set ? query->lookup->tls_hostname - : query->userarg; + const char *hostname = query->lookup->tls_hostname_set + ? query->lookup->tls_hostname + : query->userarg; + + if (query->lookup->tls_hostname_set) { + return query->lookup->tls_hostname; + } + + if (isc_tls_valid_sni_hostname(hostname)) { + return hostname; + } + + return NULL; } static isc_tlsctx_t *