Menu

#27 W3m sends malformed SNI host names

open
nobody
None
5
2016-03-14
2016-03-14
Yst Dawson
No

To quote a couple specifications:
https://tools.ietf.org/html/rfc6066#section-3 (SNI)
"HostName" contains the fully qualified DNS hostname of the server,
as understood by the client. The hostname is represented as a byte
string using ASCII encoding without a trailing dot.

https://tools.ietf.org/html/rfc7230#section-5.4 (HTTP)
A client MUST send a Host header field in all HTTP/1.1 request
messages. If the target URI includes an authority component, then a
client MUST send a field-value for Host that is identical to that
authority component, excluding any userinfo subcomponent and its "@"
delimiter (Section 2.7.1).

That means that the SNI host name and HTTP Host header do not always match. The SNI host name must never have a trailing dot, but the HTTP Host header must reflect a host name that is identical to the host name of the URI, so if the URI's host has a trailing dot, the HTTP Host header must include that trailing dot.

For example, if the URI of a page is https://alice.sni.velox.ch./, the following values should be sent by the Web browser:
SNI host: alice.sni.velox.ch
HTTP host: alice.sni.velox.ch.

However, w3m sends "alice.sni.velox.ch." as the SNI host name. In some cases, malformed SNI host names can cause the server to throw an error, an example of which can be seen at https://sni.velox.ch./ or https://www.apache.org./.

Discussion


Log in to post a comment.

Want the latest updates on software, tech news, and AI?
Get latest updates about software, tech news, and AI from SourceForge directly in your inbox once a month.