Why doesn't libcurl set SNI for IPs?

Question

I just noticed libcurl does not set SNI field when I use an IP for an HTTPS call. I found this:

https://github.com/curl/curl/blame/master/lib/vtls/openssl.c

#ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME
  if((0 == Curl_inet_pton(AF_INET, hostname, &addr)) &&
#ifdef ENABLE_IPV6
     (0 == Curl_inet_pton(AF_INET6, hostname, &addr)) &&
#endif
     sni &&
     !SSL_set_tlsext_host_name(BACKEND->handle, hostname))
    infof(data, "WARNING: failed to configure server name indication (SNI) "
          "TLS extension\n");
#endif

According to Curl_inet_pton documentation:

 * inet_pton(af, src, dst)
 *      convert from presentation format (which usually means ASCII printable)
 *      to network format (which is usually some kind of binary format).
 * return:
 *      1 if the address was valid for the specified address family
 *      0 if the address wasn't valid (`dst' is untouched in this case)
 *      -1 if some other error occurred (`dst' is untouched in this case, too)

As expected, it returns 1 for IP addresses (e.g. 192.160.0.1) and thus does not call SSL_set_tlsext_host_name.

Why?

Answer 1

Because it's not allowed.

RFC 3546 "Transport Layer Security (TLS) Extensions" section 3.1 spells it out quite clearly:

Literal IPv4 and IPv6 addresses are not permitted in "HostName".