Re: SNI on STARTTLS in mailfront

Hi John,

On 2019-02-11 02:36, John R. Levine wrote:
>> Sorry, forgot to str_free for snicertfile and snikeyfile so attached 
>> is the updated file.
> 
> I tried it, works fine.  I see you also fixed a few minor bugs in my 
> code.

Thanks for taking time to review and test.

> 
> I don't know why the callback you're using works better than the one I
> was using, but I don't see any reason not to use yours if you say it
> works better on your system.

Glad to know it works on FreeBSD as well. I gave up on trying 
gnutls_certificate_set_retrieve_function2 as all my related modification 
failed (due to my lack of knowledge) and in the end using 
gnutls_handshake_set_post_client_hello_function that works on my system. 
Anyway, the callback code is a modified code from exim/tls-gnu.c related 
to exim_sni_handling_cb function. Sorry, I am not a programmer just know 
very little in C so any errors please kindly bear with me and let me 
know.

Once again, thanks and appreciate your prompt replies.

Kindest regards,
Giam Teck Choon


> 
> R's,
> John
> 
>> On 2019-02-10 21:03, Giam Teck Choon wrote:
>>>  Hi John,
>>> 
>>>  Many thanks for your kind assistance and precious time.
>>> 
>>>  I have made the SNI work by using
>>>  gnutls_handshake_set_post_client_hello_function() instead.  Attached
>>>  is my modified starttls-gnutls.c for your review and comments (if
>>>  any).
>>> 
>>>  Greatly appreciated!
>>> 
>>>  Once again, thanks.
>>> 
>>>  Kindest regards,
>>>  Giam Teck Choon
>>> 
>>> 
>>>  On 2019-02-08 09:27, Giam Teck Choon wrote:
>>>>  Hi John,
>>>> 
>>>>  Thanks a lot for taking time to reply.
>>>> 
>>>>  On 2019-02-08 09:08, John R. Levine wrote:
>>>>>  Hard to say.  It works fine on my FreeBSD system, and I can't 
>>>>> think of
>>>>>  any obvious differences between BSD and Centos.  I assume you've
>>>>>  checked the directory and file permissions, and your mailfront 
>>>>> daemon
>>>>>  can read both the .crt and the .key files?
>>>> 
>>>>  There is no permission and/or ownership issues related to those
>>>>  .crt/.key files as one of my testing is to set
>>>>  TLS_CERTFILE/TLS_KEYFILE to the same SNI cert/keyfile.
>>>> 
>>>>  Once again, thanks.
>>>> 
>>>>  Kindest regards,
>>>>  Giam Teck Choon
>>>> 
>>>>> 
>>>>>>  I used your starttls-gnutls.c and encountered problems when 
>>>>>> TLS_CERTDIR
>>>>>>  is set and regardless SNI cert/key file exists will show the 
>>>>>> following
>>>>>>  errors:
>>>>>> 
>>>>>>  The below error suppose to use the default TLS_CERTFILE and 
>>>>>> TLS_KEYFILE
>>>>>>  when SNI cert/key files not found:
>>>>>> 
>>>>>> @  400000005c5bdf89185de07c mailfront[20072]: Starting TLS 
>>>>>> handshake
>>>>>> @  400000005c5bdf89185df7ec mailfront[20072]: No SNI in request,
>>>>>>  using default certificate
>>>>>> @  400000005c5bdf89185dffbc mailfront[20072]: TLS handshake 
>>>>>> failed:
>>>>>>  Could not negotiate a supported cipher suite.
>>>>>> 
>>>>>>  The below error suppose to use the SNI cert/key files (when 
>>>>>> exists)
>>>>>>  when TLS_CERTDIR is set. I patched your starttls-gnutls.c to show 
>>>>>> the
>>>>>>  SNI key/cert files:
>>>>>> 
>>>>>> @  400000005c5bdf91377adf8c mailfront[20075]: Starting TLS 
>>>>>> handshake
>>>>>> @  400000005c5bdf9137d23ad4 mailfront[20075]: Using SNI cert/key 
>>>>>> file
>>>>>>  for rat.choon.net
>>>>>> @  400000005c5bdf9137d24a74 mailfront[20075]: SNI certfile
>>>>>>  /var/qmail/ssl/rat.choon.net/rat.choon.net.crt for rat.choon.net
>>>>>> @  400000005c5bdf9137d25244 mailfront[20075]: SNI keyfile
>>>>>>  /var/qmail/ssl/rat.choon.net/rat.choon.net.key for rat.choon.net
>>>>>> @  400000005c5bdf9137d25a14 mailfront[20075]: TLS handshake 
>>>>>> failed:
>>>>>>  Could not negotiate a supported cipher suite.
>>>>>> 
>>>>>>  If TLS_CERTDIR not set then everything working to use 
>>>>>> TLS_CERTFILE and
>>>>>>  TLS_KEYFILE.
>>>>>> 
>>>>>>  System is CentOS 7. openssl version/release is 1.0.2k-16.el7 and 
>>>>>> gnutls
>>>>>>  version/release is 3.3.29-8.el7.
>>>>>> 
>>>>>>  Thanks for file and any suggestions I can get to make SNI work in 
>>>>>> my
>>>>>>  system.
>>>>>> 
>>>>>>  Kindest regards,
>>>>>>  Giam Teck Choon
>>>>>> 
>>>>>>  
>>>>>> ---------------------------------------------------------------------
>>>>>>  To unsubscribe, e-mail: [email protected]
>>>>>>  For additional commands, e-mail: [email protected]
>>>>>> 
>>>>>> 
>>>>>> 
>>>>> 
>>>>>  Regards,
>>>>>  John Levine, [email protected], Primary Perpetrator of "The Internet 
>>>>> for
>>>>>  Dummies",
>>>>>  Please consider the environment before reading this e-mail.
>>>>>  https://jl.ly
>>>>> 
>>>>>  
>>>>> ---------------------------------------------------------------------
>>>>>  To unsubscribe, e-mail: [email protected]
>>>>>  For additional commands, e-mail: [email protected]
>>>> 
>>>>  
>>>> ---------------------------------------------------------------------
>>>>  To unsubscribe, e-mail: [email protected]
>>>>  For additional commands, e-mail: [email protected]
>>> 
>>> 
>>>  
>>> ---------------------------------------------------------------------
>>>  To unsubscribe, e-mail: [email protected]
>>>  For additional commands, e-mail: [email protected]
>> 
> 
> Regards,
> John Levine, [email protected], Primary Perpetrator of "The Internet for 
> Dummies",
> Please consider the environment before reading this e-mail. 
> https://jl.ly
> 
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [email protected]
> For additional commands, e-mail: [email protected]