Re: [PATCH v3 3/3] imap-send: prepare for OpenSSL 4.0

[Patrick Steinhardt <ps@pks.im>]

On Sat, Oct 17, 2026 at 12:09:56PM +0200, Beat Bolli wrote:
> OpenSSL 4.0 deprecated the SSL_set1_host function if favor of the new
> function SSL_set1_dnsname, which fortunately takes the same parameters.
> 
> Add compatibility #defines for the function and its string variant for
> the error message.

This patch does not make any sense -- the only site where we call the
deprecated function is the one you have introduced yourself in the
preceding commit. Consequently, this should already be part of that
commit.

> diff --git a/imap-send.c b/imap-send.c
> index ec4e28e423..526bde2f55 100644
> --- a/imap-send.c
> +++ b/imap-send.c
> @@ -248,6 +248,13 @@ static int verify_peer(const SSL *ssl, int did_connect)
>  	return 0;
>  }
>  
> +#if (OPENSSL_VERSION_NUMBER < 0x40000000L)
> +#define SSL_set1_dnsname(ssl, host) SSL_set1_host((ssl), (host))
> +#define SSL_SET_DNSNAME_FN "SSL_set1_host"
> +#else
> +#define SSL_SET_DNSNAME_FN "SSL_set1_dnsname"
> +#endif
> +
>  static int ssl_socket_connect(struct imap_socket *sock,
>  			      const struct imap_server_conf *cfg,
>  			      int use_tls_only)
> @@ -290,8 +297,8 @@ static int ssl_socket_connect(struct imap_socket *sock,
>  	if (cfg->ssl_verify) {
>  		/* follow RFC 9525 section 6.3: no partial wildcards */
>  		SSL_set_hostflags(sock->ssl, X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS);
> -		if (!SSL_set1_host(sock->ssl, cfg->host)) {
> -			ssl_socket_perror("SSL_set1_host");
> +		if (!SSL_set1_dnsname(sock->ssl, cfg->host)) {

So according to [1], `SSL_set1_host` was replaced by `SSL_set1_dnsname`
and `SSL_set1_ipaddr`. So do we know that `cfg->host` really always is a
DNS name and never an IP address?

> +			ssl_socket_perror(SSL_SET_DNSNAME_FN);
>  			return -1;
>  		}

I wonder whether it's really all that helpful to also change the error
message accordingly. Shouldn't it be sufficient to unconditionally print
the new error message here?

Patrick

[1]: https://docs.openssl.org/master/man3/SSL_set1_host/#description