You are viewing a plain text version of this content. The canonical link for it is here.
Posted to bugs@httpd.apache.org by bu...@apache.org on 2014/03/10 15:29:28 UTC
[Bug 56241] New: SNI sends warning upon name not found, RFC 6066
discourages this
https://issues.apache.org/bugzilla/show_bug.cgi?id=56241
Bug ID: 56241
Summary: SNI sends warning upon name not found, RFC 6066
discourages this
Product: Apache httpd-2
Version: 2.4.7
Hardware: PC
OS: Linux
Status: NEW
Severity: minor
Priority: P2
Component: mod_ssl
Assignee: bugs@httpd.apache.org
Reporter: nuxi@vault24.org
The current TLS SNI spec (RFC 6066) no longer recommends sending back a TLS
warning if the name couldn't be found because this is being interpreted as a
fatal error by many older SSL libraries with semi-broken SNI support.
"It is NOT RECOMMENDED to send a warning-level unrecognized_name(112) alert,
because the client's behavior in response to warning-level alerts is
unpredictable."
I assume this is as simple as changing line 1943 of ssl_engine_kernel.c to say
NOACK instead of WARNING:
http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ssl/ssl_engine_kernel.c?view=markup#l1918
This is particularly noticeable if for some reason someone is using a short DNS
name (eg https://issues/ instead of https://issues.apache.org/) with one of the
broken SSL libraries that has semi-functional SNI support.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 56241] SNI sends warning upon name not found, RFC 6066
discourages this
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=56241
--- Comment #5 from Kaspar Brand <as...@velox.ch> ---
Committed to 2.4.x with r1588424. To appear in 2.4.10.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 56241] SNI sends warning upon name not found, RFC 6066
discourages this
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=56241
Kaspar Brand <as...@velox.ch> changed:
What |Removed |Added
----------------------------------------------------------------------------
Version|2.4-HEAD |2.4.1
--- Comment #4 from Kaspar Brand <as...@velox.ch> ---
(In reply to Kaspar Brand from comment #3)
> Will propose for backport
Done with r1585922.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 56241] SNI sends warning upon name not found, RFC 6066
discourages this
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=56241
Kaspar Brand <as...@velox.ch> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |NEEDINFO
Hardware|PC |All
Version|2.4.7 |2.4-HEAD
OS|Linux |All
--- Comment #1 from Kaspar Brand <as...@velox.ch> ---
(In reply to Jon from comment #0)
> The current TLS SNI spec (RFC 6066) no longer recommends sending back a TLS
> warning if the name couldn't be found because this is being interpreted as a
> fatal error by many older SSL libraries with semi-broken SNI support.
I agree that mod_ssl's current behavior still reflects RFC 4366. Specifically:
If the server understood the client hello extension but does not
recognize the server name, it SHOULD send an "unrecognized_name"
alert (which MAY be fatal).
RFC 6066 has changed this to
If the server understood the ClientHello extension but
does not recognize the server name, the server SHOULD take one of two
actions: either abort the handshake by sending a fatal-level
unrecognized_name(112) alert or continue the handshake. It is NOT
RECOMMENDED to send a warning-level unrecognized_name(112) alert,
because the client's behavior in response to warning-level alerts is
unpredictable.
For backward compatibility, I think we should take the second action ("continue
the handshake"), i.e. return SSL_TLSEXT_ERR_NOACK as suggested.
> I assume this is as simple as changing line 1943 of ssl_engine_kernel.c to
> say NOACK instead of WARNING:
We can just drop line 1943, essentially, and fall through. Did you already test
this with the SSL library which is causing problems for you?
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 56241] SNI sends warning upon name not found, RFC 6066
discourages this
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=56241
--- Comment #6 from Steven Bush <sb...@accelrys.com> ---
What is the status of the backport to the 2.2 release? We are using 2.2.27
with openssl 0.9.8za which is affected by this. In particular, .NET and Java 7
clients fail to connect to recently updated servers.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 56241] SNI sends warning upon name not found, RFC 6066
discourages this
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=56241
Mark Nottingham <mn...@mnot.net> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |mnot@mnot.net
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 56241] SNI sends warning upon name not found, RFC 6066
discourages this
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=56241
Kaspar Brand <as...@velox.ch> changed:
What |Removed |Added
----------------------------------------------------------------------------
Keywords| |FixedInTrunk
Status|NEEDINFO |NEW
--- Comment #3 from Kaspar Brand <as...@velox.ch> ---
Thanks for the feedback. I have just committed this change to trunk, as part of
r1585090. Will propose for backport unless there are objections on
dev@httpd.apache.org.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 56241] SNI sends warning upon name not found, RFC 6066
discourages this
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=56241
Steven Bush <sb...@accelrys.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |sbush@accelrys.com
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 56241] SNI sends warning upon name not found, RFC 6066
discourages this
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=56241
--- Comment #2 from Jon <nu...@vault24.org> ---
(In reply to Kaspar Brand from comment #1)
> > I assume this is as simple as changing line 1943 of ssl_engine_kernel.c to
> > say NOACK instead of WARNING:
>
> We can just drop line 1943, essentially, and fall through. Did you already
> test this with the SSL library which is causing problems for you?
I've been running with the patch I described for about 2 weeks. It seems to fix
interaction with openssl 0.9.8 (which OSX 10.9 has, wtf apple) and older
versions of gnutls
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 56241] SNI sends warning upon name not found, RFC 6066
discourages this
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=56241
Brett Randall <ja...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |javabrett@gmail.com
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org