HTTP SNI check

[cspiel1]

• The function tls_set_verify_server() should be extended by SNI (hostname verification).
• Currently only used for rtmp. But this doesn't hurt because IP-addresses are excepted from this change. And for domains it makes sense to check the hostname.
• The function tls_set_verify_server() now also is used for HTTP clients.
• The function tls_set_verify_client() only activates certificate verification that accepts all certificates. It is used only in baresip module dtls_srtp. We do not touch this here, but want to rename the verify-handler to "verify_trust_all()".

TODO (but in another PR):

• For SIP/TLS this function should be called for each TLS connection once. Maybe then it should be renamed to tls_set_verify_peer().

[cspiel1]

test_tls and test_dtls are failing.

error_string = self signed certificate

Reason: Per default the verify mode is set to SSL_VERIFY_NONE. Now we set it to SSL_VERIFY_PEER.
It seems that self signed certificate is not possible. I have to clarify this.

[cspiel1]

The tests test_tls and test_dtls are green now

@sreimers Had to fix test_https_loop in retools. How can trigger travis for this PR without pushing an update?

[cspiel1]

Ok, I had to push updates already.

Anyway, I think that manual triggers are not possible until we have such "workflow_dispatch" mentioned here: https://github.blog/changelog/2020-07-06-github-actions-manual-triggers-with-workflow_dispatch/

But maybe manual triggers are not needed very often.

[alfredh]

I am not sure if it is a good practice to remove public functions.

it is probably best to keep it...

[cspiel1]

Yes, maybe we should keep it. But on the other side:

• tls_peer_set_verify_host()
• tls_set_servername()
• tls_set_verify_server()

is very confusing. Our TLS expert told me that SSL_set1_host() and SSL_set_tlsext_host_name() should be used together. Also setting TLS method to SSL_VERIFY_PEER. Here is a good article: https://quuxplusone.github.io/blog/2020/01/27/openssl-part-4/
If we have only one function which does this for the TLS client makes the re API simpler.

Should we keep the functions anyway? If yes, I would add more details to the doxygen of these functions.

[alfredh]

@robdyck can you please test this patch?

you should verify that SNI is not present in TLS Hello.

[alfredh]

should be ok to merge now