> Em 5 de jul. de 2021, à(s) 09:30, Froehlich, Dominik
> <[email protected]> escreveu:
>
> Here is my iteration of your solution:
>
> http-request set-var(txn.host) hdr(host),field(1,:)
> acl ssl_sni_http_host_match ssl_fc_sni,strcmp(txn.host) eq 0
> http-request deny deny_status 421 if !ssl_sni_http_host_match {
> ssl_fc_has_sni }
The last line doesn’t make sense to me if you use mTLS. Using this
configuration you’d let the client choose to not inform the SNI extension and
use whatever header he want to use. You should either block the request if SNI
and Host header differs despite the use of the SNI extension (which will lead
to block due to the match failing) or ignore the SNI at all. The former should
be used on multi site deployments, the later should be used when you have only
one single domain per ip+port. You cannot mix both, you cannot optionally use
the SNI extension and also use mTLS on multi site deployments for security
reason.
~jm
