💾 Archived View for bbs.geminispace.org › u › alexlehm › 5583 captured on 2024-03-21 at 20:23:05. Gemini links have been rewritten to link to archived content
⬅️ Previous capture (2024-02-05)
-=-=-=-=-=-=-
Re: "SNI for misfin: I am getting a "you didn't provide SNI"..."
@filipperzero I think that means that the receiving address is not available as a local interface, the dns resolves to something else than your local machine
2023-09-26 · 6 months ago
🤖 alexlehm [OP] · Sep 26 at 15:38:
@flipperzero i don't think I got any msgs from you
🤖 alexlehm [OP] · Sep 26 at 15:45:
I currently only log the messages to the java log, so if you want to send me test messages, no problem. a typical message looks like this: https://p.lehmann.cx/eE_4.txt
— https://p.lehmann.cx/eE_4.txt
📷 billsmugs · Sep 26 at 16:52:
My server is the one rejecting incoming messages due to lack of SNI. My misfin server code is essentially just my gemini server code with a few branches, so I didn't explicitly add this behaviour and only now realised that it's not actually part of the Misfin spec, sorry!
I feel like it would be worth adding to the spec though, like it is in the Gemini spec. Without SNI a server that hosts multiple domains doesn't know which certificate to present to an incoming connection.
🤖 alexlehm [OP] · Sep 26 at 17:18:
I guess SNI can be used but should be optional, i.e. if there is no SNI it should present a default cert and then use that domain
📷 billsmugs · Sep 26 at 18:05:
For now I've put in a hacky fix to default to misfin.billsmugs.com for incoming connections on port 1958 that don't have SNI.
I do think the spec should explictly require SNI in future though, not make it optional.
@clseibold When you use "make-cert", the 3rd argument is the "hostname", and it's written in the certificate as the "X509v3 Subject Alternative Name" in the certificate, here's what it shows for a "localhost" cert:
X509v3 extensions:
X509v3 Subject Alternative Name:
DNS:localhost
When you run a server with "receive-as", misfin opens the certificate and reads that value (the "DNS"), the code is in misfin/identity.py (LocalIdentity, in the __init__):
I plan to rewrite this part because when you run a server for an infinite number of identities (recipients), you'd most definitely want to have more control over which IP you listen on.
@clseibold So yeah, right now, the hostname value that you pass when you create the certificate is the hostname that misfin will bind the socket to.
But note that you can also pass an IP address, i just did that and it works
misfin make-cert ip "IP" 192.168.1.28 28.pem misfin receive-as 28.pem Receiving for: IP (ip@192.168.1.28) Listening on: 192.168.1.28
@clseibold You're right. I'm working on a service command that will let you serve multiple identities and store messages, it's not too much work.
SNI for misfin: I am getting a "you didn't provide SNI" error in one misfin server when I try to access it via the Python client, apparently that uses a different ssl library. I wonder if that is intended, to work it has to be active in both the client and the server