#926332 socat: please support SNI

Package:
socat
Source:
socat
Description:
multipurpose relay for bidirectional data transfer
Submitter:
Benjamin Barenblat
Date:
2021-02-02 03:00:03 UTC
Severity:
wishlist
Tags:
#926332#5
Date:
2019-04-03 15:59:03 UTC
From:
To:
socat does not support the TLS Server Name Indication extension. This
extension has become pretty widely deployed at this point, and socat’s
TLS support could be substantially more useful if it sent SNI.

A patch against 1.7.3.0 is available [1]; I’ve also attached it here for
convenience. I haven’t tested or reviewed it, though, so its inclusion
should not be treated as an endorsement. :)

[1] https://github.com/moparisthebest/socat/commit/268432bf4220502535dbd373344b60b8fd10e3ce
#926332#10
Date:
2021-02-02 02:57:02 UTC
From:
To:
I believe this is supported in version 1.7.4, according to the man page:

   snihost=<string>

      Set the client side Server Name Indication (SNI) host name
      different from the addressed server name or common name. This
      might be useful when the server certificate has multiple host
      names or wildcard names because the SNI host name is passed in
      cleartext to the server and might be eavesdropped; with this
      option a mock name of the desired certificate may be transferred.


live well,
  vagrant