https: handshake failure alert

Hello.

i'm using dillo (3.0.5) as the default web-browser, and often this seems
to be just the right choice. However, when accessing certain sites with
https, i was confronted with an empty window with apparently no errors.
Had to ressort to Lynx or Firefox in these cases.
Eventually the only related error-message showed up (on stderr), it was
from SSL23_get_server_hello, which got a "handshake failure alert".
Comparing TCP-packets and playing around with "openssl s_client..."
revealed, that these servers demanded a 'Server Name Indication' to be
included in the ClientHello. Now, this could be easily fixed... (patch
attached).

kind regards

peter

PS:

By the way, i just submitted a patch for the FileChooser in FLTK 1.3/1.4
to fltk.org. It ensures, that the name of a file to be saved is kept,
when changing directories. (You certainly noticed, that in Dillo the
name of a downloaded file is erased, when you try to save it to another
directory than the initially presented).
I had submitted the essentially same patch for FLTK 2.0 on October 2010,
when using Dillo 2.x. It seems to be incorporated some time later, but i
don't know if it was already available to any Dillo 2.x build.

And: Dillo 3.0.5 can be built and run with FLTK 1.4 without any other
changes than to allow the use of 1.4 in configure[.ac]

_______________________________________________
Dillo-dev mailing list
[email protected]
http://lists.dillo.org/cgi-bin/mailman/listinfo/dillo-dev

--- dillo-3.0.5/dpi/https.c	2015/06/30 14:06:08	1.1
+++ dillo-3.0.5/dpi/https.c	2019/04/15 13:02:34
@@ -118,6 +118,36 @@ static int dialog_get_answer_number(void
    return response_number;
 }
 
+/*
+ *  Prepare the 'Server Name Indication' Extension for the ClientHello.
+ *  Without this some servers reject the connection with a 'handshake
+ *  failure' alert.
+ */
+static int set_tlsext_host_name(SSL *ssl, const char *url)
+{
+   if (url && ssl){
+      char buf[TLSEXT_MAXLEN_host_name+1];
+      const char *p, *s;
+      size_t l;
+
+      if ((p = strstr(url,"://")))
+         url = p+3;
+      p = strchr(url, '/');
+      s = strchr(url, ':');
+      if (s && s < p)
+         p = s;
+      if (!p)
+         p = strchr(url, 0);
+
+      if ((l = p-url) < sizeof(buf)){
+         memcpy(buf, url, l);
+         buf[l] = 0;
+         return SSL_set_tlsext_host_name(ssl, buf); /* 0,1 */
+      }
+   }
+   return 0;
+}
+
 
 /*
  *  This function does all of the work with SSL
@@ -296,6 +326,12 @@ static void yes_ssl_support(void)
    }
 
    if (exit_error == 0){
+      if (!set_tlsext_host_name(ssl_connection, url)){
+         MSG("Cannot set hostname for SNI extension.\n");
+      }
+   }
+
+   if (exit_error == 0){
       /*Actually do SSL connection handshake*/
       if (SSL_connect(ssl_connection) != 1){
          MSG("SSL_connect failed\n");