bugGNU Wget - Bugs: bug #47408, Wget sends malformed SNI host names

 
 

bug #47408: Wget sends malformed SNI host names

Submitted by:  Yst Dawson <yst>
Submitted on:  Mon 14 Mar 2016 05:21:14 PM UTC  
 
Category: Program LogicSeverity: 3 - Normal
Priority: 5 - NormalStatus: None
Privacy: PublicAssigned to: None
Originator Name: Open/Closed: Open
Release: 1.16Operating System: GNU/Linux
Reproducibility: Every TimeFixed Release: None
Planned Release: NoneRegression: None
Work Required: NonePatch Included: None

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Wed 16 Mar 2016 06:46:37 AM UTC, comment #1:

I tried this in Firefox, Chrome and IE and all send the trailing dot for SNI. curl doesn't though, it strips the trailing dot and also it won't appear in the host header.

Jay Satiro <raysatiro>
Mon 14 Mar 2016 05:21:14 PM UTC, original submission:

To quote a couple specifications:
<https://tools.ietf.org/html/rfc6066#section-3> (SNI)
"HostName" contains the fully qualified DNS hostname of the server,
as understood by the client. The hostname is represented as a byte
string using ASCII encoding without a trailing dot.

<https://tools.ietf.org/html/rfc7230#section-5.4> (HTTP)
A client MUST send a Host header field in all HTTP/1.1 request
messages. If the target URI includes an authority component, then a
client MUST send a field-value for Host that is identical to that
authority component, excluding any userinfo subcomponent and its "@"
delimiter (Section 2.7.1).

That means that the SNI host name and HTTP Host header do not always match. The SNI host name must never have a trailing dot, but the HTTP Host header must reflect a host name that is identical to the host name of the URI, so if the URI's host has a trailing dot, the HTTP Host header must include that trailing dot.

For example, if the URI of a page is <https://alice.sni.velox.ch./>, the following values should be sent by the Web browser:
SNI host: alice.sni.velox.ch
HTTP host: alice.sni.velox.ch.

However, Wget sends "alice.sni.velox.ch." as the SNI host name. In some cases, malformed SNI host names can cause the server to throw an error, an example of which can be seen at <https://sni.velox.ch./> or <https://www.apache.org./>.

Other information:

  • version: 1.16
  • invoked by running "wget --no-check-certificate https://alice.sni.velox.ch./"
  • expected result: Wget should send an SNI host name that conforms to RFC 6066 or no SNI host name, while still sending an HTTP Host header that includes the trailing dot, as per RFC 7230.
  • actual result: Wget sent a malformed SNI host name
  • The output, in case relevant, has been attached as a file upload.
Yst Dawson <yst>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #36634:  index.html added by yst (5KiB - text/html)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by raysatiro (Posted a comment)
  • -unavailable- added by raysatiro
  • -unavailable- added by yst (Submitted the item)
  •  

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 2 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Wed 16 Mar 2016 06:46:37 AM UTCraysatiroCarbon-Copy-=>Added raysatiro
    Mon 14 Mar 2016 05:21:14 PM UTCystAttached File-=>Added index.html, #36634

    Back to the top


    Powered by Savane 3.1-cleanup1