feat: Disable SNI for STARTTLS (#7499)

Many clients don't send it currently, so it is unlikely that servers depend on it:
https://mastodon.social/@cks/114690055923939576.

For "implicit TLS", do not turn it off yet, it will serve as a fallback in case of rare server that
needs it. If the server only supports STARTTLS and requires SNI then it is really weird, likely
should not happen.
This commit is contained in:
iequidoo
2025-12-02 16:24:53 -03:00
committed by iequidoo
parent 8bce137e06
commit 676132457f
6 changed files with 43 additions and 6 deletions

View File

@@ -228,6 +228,7 @@ async fn connect_secure_proxy(
strict_tls: bool,
proxy_config: ProxyConfig,
) -> Result<Box<dyn SessionBufStream>> {
let use_sni = true;
let proxy_stream = proxy_config
.connect(context, hostname, port, strict_tls)
.await?;
@@ -235,6 +236,7 @@ async fn connect_secure_proxy(
strict_tls,
hostname,
port,
use_sni,
alpn(port),
proxy_stream,
&context.tls_session_store,
@@ -253,6 +255,7 @@ async fn connect_starttls_proxy(
strict_tls: bool,
proxy_config: ProxyConfig,
) -> Result<Box<dyn SessionBufStream>> {
let use_sni = false;
let proxy_stream = proxy_config
.connect(context, hostname, port, strict_tls)
.await?;
@@ -266,6 +269,7 @@ async fn connect_starttls_proxy(
strict_tls,
hostname,
port,
use_sni,
"",
tcp_stream,
&context.tls_session_store,
@@ -316,6 +320,7 @@ async fn connect_starttls(
strict_tls: bool,
tls_session_store: &TlsSessionStore,
) -> Result<Box<dyn SessionBufStream>> {
let use_sni = false;
let tcp_stream = connect_tcp_inner(addr).await?;
// Run STARTTLS command and convert the client back into a stream.
@@ -327,6 +332,7 @@ async fn connect_starttls(
strict_tls,
host,
addr.port(),
use_sni,
"",
tcp_stream,
tls_session_store,