bugGNU Wget - Bugs: bug #47408, Wget sends malformed SNI host names

 
 

bug #47408: Wget sends malformed SNI host names

Submitter:  Yst Dawson <yst>
Submitted:  Mon 14 Mar 2016 05:21:14 PM UTC
   
 
Category:  Program Logic Severity:  3 - Normal
Priority:  5 - Normal Status:  None
Privacy:  Public Assigned to:  None
Originator Name:  Open/Closed:  Open
Release:  1.16 Operating System:  GNU/Linux
Reproducibility:  Every Time Fixed Release:  None
Planned Release:  None Regression:  None
Work Required:  None Patch Included:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Wed 16 Mar 2016 06:46:37 AM UTC, comment #1: 

I tried this in Firefox, Chrome and IE and all send the trailing dot for SNI. curl doesn't though, it strips the trailing dot and also it won't appear in the host header.

Jay Satiro <raysatiro>
Mon 14 Mar 2016 05:21:14 PM UTC, original submission:  

To quote a couple specifications:
<https://tools.ietf.org/html/rfc6066#section-3> (SNI)
"HostName" contains the fully qualified DNS hostname of the server,
as understood by the client.  The hostname is represented as a byte
string using ASCII encoding without a trailing dot.

<https://tools.ietf.org/html/rfc7230#section-5.4> (HTTP)
A client MUST send a Host header field in all HTTP/1.1 request
messages.  If the target URI includes an authority component, then a
client MUST send a field-value for Host that is identical to that
authority component, excluding any userinfo subcomponent and its "@"
delimiter (Section 2.7.1).

That means that the SNI host name and HTTP Host header do not always match. The SNI host name must never have a trailing dot, but the HTTP Host header must reflect a host name that is identical to the host name of the URI, so if the URI's host has a trailing dot, the HTTP Host header must include that trailing dot.

For example, if the URI of a page is <https://alice.sni.velox.ch./>, the following values should be sent by the Web browser:
SNI host: alice.sni.velox.ch
HTTP host: alice.sni.velox.ch.

However, Wget sends "alice.sni.velox.ch." as the SNI host name. In some cases, malformed SNI host names can cause the server to throw an error, an example of which can be seen at <https://sni.velox.ch./> or <https://www.apache.org./>.

Other information:

  • version: 1.16
  • invoked by running "wget --no-check-certificate https://alice.sni.velox.ch./"
  • expected result: Wget should send an SNI host name that conforms to RFC 6066 or no SNI host name, while still sending an HTTP Host header that includes the trailing dot, as per RFC 7230.
  • actual result: Wget sent a malformed SNI host name
  • The output, in case relevant, has been attached as a file upload.
Yst Dawson <yst>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #36634:  index.html added by yst (5KiB - text/html)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by raysatiro (Posted a comment)
  • -email is unavailable- added by raysatiro
  • -email is unavailable- added by yst (Submitted the item)
  •  

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2016-03-16 raysatiro Carbon-Copy- Added raysatiro
    2016-03-14 yst Attached File- Added index.html, #36634

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code