Re: ncat ssl client doesn't support Server Name Indication extension (SNI)

[David Fifield <david () bamsoftware com>]

On Fri, Jul 16, 2010 at 11:33:10AM -0600, David Fifield wrote:
> On Fri, Jul 16, 2010 at 05:37:18PM +0100, Nuno Gonçalves wrote:
> > http://www.openssl.org/news/changelog.html:
> > *) Add initial support for TLS extensions, specifically for the server_name
> >      extension so far.  The SSL_SESSION, SSL_CTX, and SSL data structures now
> >      have new members for a host name.  The SSL data structure has an
> >      additional member SSL_CTX *initial_ctx so that new sessions can be
> >      stored in that context to allow for session resumption, even after the
> >      SSL has been switched to a new SSL_CTX in reaction to a client's
> >      server_name extension.
> >
> >      New functions (subject to change):
> >
> >          SSL_get_servername()
> >          SSL_get_servername_type()
> >          SSL_set_SSL_CTX()
> >
> >      New CTRL codes and macros (subject to change):
> >
> >          SSL_CTRL_SET_TLSEXT_SERVERNAME_CB
> >                                  - SSL_CTX_set_tlsext_servername_callback()
> >          SSL_CTRL_SET_TLSEXT_SERVERNAME_ARG
> >                                       - SSL_CTX_set_tlsext_servername_arg()
> >          SSL_CTRL_SET_TLSEXT_HOSTNAME           - SSL_set_tlsext_host_name()
> >
> >      openssl s_client has a new '-servername ...' option.
> >
> >      openssl s_server has new options '-servername_host ...', '-cert2 ...',
> >      '-key2 ...', '-servername_fatal' (subject to change).  This allows
> >      testing the HostName extension for a specific single host name ('-cert'
> >      and '-key' remain fallbacks for handshakes without HostName
> >      negotiation).  If the unrecogninzed_name alert has to be sent, this by
> >      default is a warning; it becomes fatal with the '-servername_fatal'
> >      option.
>
> Thanks, that's the information I was asking for.

I just added a new function to Nsock, nsi_set_hostname, that allows you
to set the name that will be used for SNI. This is called in Ncat and in
Nmap service scan using the user-supplied command-line name. It's harder
to make it pervasive in NSE; I'll post a followup about that.

David Fifield
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/