From: Jeff King <peff@peff.net>
Date: Thu, 21 Feb 2013 05:48:03 GMT
Subject: Re: [RFH/PATCH] imap-send: support SNI (RFC4366)
Message-ID: <20130221054803.GB25943@sigill.intra.peff.net>
In-Reply-To: <7vr4kaw7or.fsf@alter.siamese.dyndns.org>

On Wed, Feb 20, 2013 at 09:35:16PM -0800, Junio C Hamano wrote:

>>  (2) I do not know if everybody has SSL_set_tslext_host_name() macro
>>      defined, so this patch may be breaking build for people with
>>      different versions of OpenSSL.
> [...]
>
> +#ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME
> +	/*
> +	 * SNI (RFC4366)
> +	 * OpenSSL does not document this function, but the implementation
> +	 * returns 1 on success, 0 on failure after calling SSLerr().
> +	 */
> +	ret = SSL_set_tlsext_host_name(sock->ssl, server.host);
> +	if (ret != 1)
> +		warning("SSL_set_tslext_host_name(%s) failed.\n", server.host);
> +#endif

Yes, I think this is the right macro to check. According to OpenSSL's
CHANGES file, it was introduced between 0.9.8n and 1.0.0 (Mar 2010). But
I note that the use of the same macro in libcurl dates to 2008. Curious.

Note that you have a typo in your warning text (tslext) and an
extra newline.

As far as testing goes, I don't have an SNI IMAP server handy, but I
think you can simulate one with "openssl s_server". It may be a good
long-term goal to test any ssl-specific code against that in our test
suite (on the other hand, most of the interesting stuff is https, where
the details are all handled by curl).

-Peff