summaryrefslogtreecommitdiff
path: root/imap-send.c
diff options
context:
space:
mode:
authorJunio C Hamano <gitster@pobox.com>2013-03-21 14:02:39 -0700
committerJunio C Hamano <gitster@pobox.com>2013-03-21 14:02:40 -0700
commite3b3b73c6e8d2f667ec7a083d2c44bc2a342f212 (patch)
treedc9289ea81c8840d12c37d9c6689508e9130bb21 /imap-send.c
parent54797b98b85cfe7e0e6ea1cbf314981456bd047e (diff)
parent698a1ec4d52e90d611c233a12147daf261168bc6 (diff)
downloadgit-e3b3b73c6e8d2f667ec7a083d2c44bc2a342f212.tar.gz
Merge branch 'ob/imap-send-ssl-verify'
Correctly connect to SSL/TLS sites that serve multiple hostnames on a single IP by including Server Name Indication in the client-hello. * ob/imap-send-ssl-verify: imap-send: support Server Name Indication (RFC4366)
Diffstat (limited to 'imap-send.c')
-rw-r--r--imap-send.c11
1 files changed, 11 insertions, 0 deletions
diff --git a/imap-send.c b/imap-send.c
index 43ac4e0bdf..d9bcfb44dc 100644
--- a/imap-send.c
+++ b/imap-send.c
@@ -304,6 +304,17 @@ static int ssl_socket_connect(struct imap_socket *sock, int use_tls_only, int ve
return -1;
}
+#ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME
+ /*
+ * SNI (RFC4366)
+ * OpenSSL does not document this function, but the implementation
+ * returns 1 on success, 0 on failure after calling SSLerr().
+ */
+ ret = SSL_set_tlsext_host_name(sock->ssl, server.host);
+ if (ret != 1)
+ warning("SSL_set_tlsext_host_name(%s) failed.", server.host);
+#endif
+
ret = SSL_connect(sock->ssl);
if (ret <= 0) {
socket_perror("SSL_connect", sock, ret);