Support the TLS SNI extension

Add support for sending the TLS Server Name Indicator extension
during TLS connection negotiation.

diff --git a/docs/pending-release-notes b/docs/pending-release-notes
index a5b0f223bc089750ef9467fb6500e9d02bd2febb..980ee83eb8e96f3cbaf317551e295086c5532aa6 100644 (file)
--- a/docs/pending-release-notes
+++ b/docs/pending-release-notes
@@ -8,6 +8,8 @@ NEW FEATURES
   historical practice and reduce packaging dependencies on external programs.
 - A new -checkbase64 switch to mhfixmsg(1).
 - inc(1)/msgchk(1) now support STARTTLS for the POP protocol.
   historical practice and reduce packaging dependencies on external programs.
 - A new -checkbase64 switch to mhfixmsg(1).
 - inc(1)/msgchk(1) now support STARTTLS for the POP protocol.

+- All TLS-supported protocols now will send the SNI (server name indicator)
+  TLS extension.

 
 -----------------
 OBSOLETE FEATURES
 
 -----------------
 OBSOLETE FEATURES

diff --git a/h/netsec.h b/h/netsec.h
index 3e7975b417f742b78cfa3312dc06924d24893394..6c69c82c06c1af8ef801b9f01b021432dba116ac 100644 (file)
--- a/h/netsec.h
+++ b/h/netsec.h
@@ -52,7 +52,7 @@ void netsec_set_userid(netsec_context *ns_context, const char *userid);
 /*
  * Set the hostname of the server we're connecting to.  This is used
  * by the Cyrus-SASL library and by the TLS code.  This must be called
 /*
  * Set the hostname of the server we're connecting to.  This is used
  * by the Cyrus-SASL library and by the TLS code.  This must be called

- * before netsec_negotiate_tls() or netsec_set_sasl_params().
+ * before netsec_set_tls() or netsec_set_sasl_params().

  *
  * Arguments:
  *
  *
  * Arguments:
  *


@@ -399,9 +399,8 @@ int netsec_set_oauth_service(netsec_context *ns_context, const char *service);
  *
  * Note: callers still have to call netsec_tls_negotiate() to start
  * TLS negotiation at the appropriate point in the protocol.  The
  *
  * Note: callers still have to call netsec_tls_negotiate() to start
  * TLS negotiation at the appropriate point in the protocol.  The

- * remote hostname (controlled by netsec_set_hostname()) should have
- * already been set before this function is called unless certificate
- * verification is disabled.
+ * remote hostname (controlled by netsec_set_hostname()) is required
+ * to be set before calling this function.

  *
  * Arguments
  *
  *
  * Arguments
  *


@@ -418,7 +417,7 @@ int netsec_set_tls(netsec_context *context, int tls, int noverify,
 
 /*
  * Start TLS negotiation on this protocol.  This connection should have
 
 /*
  * Start TLS negotiation on this protocol.  This connection should have

- * netsec_set_tls() called on it.
+ * netsec_set_tls() already called on it.

  *
  * Arguments:
  *
  *
  * Arguments:
  *

diff --git a/sbr/netsec.c b/sbr/netsec.c
index a4ede21042f184297975e81b7659c47365480a64..2d70b37947c2392541c2c38dcc0f23d4d4524989 100644 (file)
--- a/sbr/netsec.c
+++ b/sbr/netsec.c
@@ -1624,6 +1624,11 @@ netsec_set_tls(netsec_context *nsc, int tls, int noverify, char **errstr)
            return NOTOK;
        }
 
            return NOTOK;
        }
 

+       if (!nsc->ns_hostname) {
+           netsec_err(errstr, "Internal error: hostname not set");
+           return NOTOK;
+       }
+

        /*
         * Create the SSL structure which holds the data for a single
         * TLS connection.
        /*
         * Create the SSL structure which holds the data for a single
         * TLS connection.


@@ -1680,6 +1685,12 @@ netsec_set_tls(netsec_context *nsc, int tls, int noverify, char **errstr)
        SSL_set_bio(ssl, rbio, wbio);
        SSL_set_connect_state(ssl);
 
        SSL_set_bio(ssl, rbio, wbio);
        SSL_set_connect_state(ssl);
 

+       /*
+        * Use the hostname to set the Server Name Indicator extension
+        */
+
+       SSL_set_tlsext_host_name(ssl, nsc->ns_hostname);
+

        /*
         * If noverify is NOT set, then do certificate validation.
         * Turning on SSL_VERIFY_PEER will verify the certificate chain
        /*
         * If noverify is NOT set, then do certificate validation.
         * Turning on SSL_VERIFY_PEER will verify the certificate chain


@@ -1696,12 +1707,6 @@ netsec_set_tls(netsec_context *nsc, int tls, int noverify, char **errstr)
 #endif /* HAVE_X509_VERIFY_PARAM_SET1_HOST */
 
            SSL_set_verify(ssl, SSL_VERIFY_PEER, NULL);
 #endif /* HAVE_X509_VERIFY_PARAM_SET1_HOST */
 
            SSL_set_verify(ssl, SSL_VERIFY_PEER, NULL);

-           if (! nsc->ns_hostname) {
-               netsec_err(errstr, "Internal error: hostname not set and "
-                          "certification verification enabled");
-               SSL_free(ssl);
-               return NOTOK;
-           }

 
 #ifdef HAVE_X509_VERIFY_PARAM_SET1_HOST
            param = SSL_get0_param(ssl);
 
 #ifdef HAVE_X509_VERIFY_PARAM_SET1_HOST
            param = SSL_get0_param(ssl);