SNI support

[arekm]

libetspan seems to not call SSL_set_tlsext_host_name() for indicating TLS SNI [1] which causes that it gets wrong certificate from (for example) imap server.

So this is feature request about adding SNI support.

openssl-*/apps/s_client.c does that in such way:

    if (servername != NULL) {
        if (!SSL_set_tlsext_host_name(con, servername)) {
            BIO_printf(bio_err, "Unable to set TLS servername extension.\n");
            ERR_print_errors(bio_err);
            goto end;
        }
    }

so I hope it is also easy for libetpan.

1. https://en.wikipedia.org/wiki/Server_Name_Indication

[mschwendt]

Indeed, this is also affecting a gnutls based build with TLS 1.3 enabled, such as Claws Mail on Fedora 29 when contacting Google Mail via IMAP.

[dinhvh]

Could you send a pull request? Thanks!

[mschwendt]

If I knew enough of the internals of libetpan, I would know where to access the server name of that would be needed. I've ended up in src/data-types/mailstream_ssl.c when I had a look, but didn't find it.

[MadAlexUK]

I'm wanting SNI support in Claws Mail as well.

It looks to me like it would be a huge pain to feed the server name (when there is one) all the way through from where the socket is opened to where the TLS configuration happens. At present only the file descriptor of the socket is passed through to the mailstream implementations and many functions would need to be modified to pass more information through.

On the other hand, it would be easy enough to add a new exported function for clients to call from within the optional callback (e.g. when using mailstream_ssl_open_with_callback_timeout), passing in the host name they want to be sent as the server name identification, much like the mechanism for setting a client certificate. That would also give the client the flexibility a) to choose whether to use SNI or not and b) to support odd corner cases like connecting using a known IP address to avoid a DNS lookup yet still supplying the host name for SNI.

I have seen a very experimental patch work against gnutls in conjunction with a very experimental patch to Claws Mail. If the approach is considered reasonable I will finish testing against openssl and submit a pull request, just as soon as I've figured out how to use GitHub sufficiently to do that!

[MadAlexUK]

Candidate pull request following the approach I suggested created, for consideration. Experimental patch for Claws Mail that utilises it attached to http://www.thewildbeast.co.uk/claws-mail/bugzilla/show_bug.cgi?id=4103 in case it helps anybody.