Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

SNI Server Name Missing in ClientHello for Domain with Trailing Dot #6044

Closed
yzfeng2020 opened this issue Dec 20, 2024 · 0 comments · Fixed by #6046
Closed

SNI Server Name Missing in ClientHello for Domain with Trailing Dot #6044

yzfeng2020 opened this issue Dec 20, 2024 · 0 comments · Fixed by #6046

Comments

@yzfeng2020
Copy link
Contributor

We noticed that when a request is made to a domain with a trailing dot, the SNI server name is not included in the ClientHello message.

Upon investigation, it seems the peerHost needs to be valid for the SNI server name to be generated in the SSL engine. However, the host passed in the pipeline configurator includes the trailing dot, making it invalid.

I came across #4875 that allows trailing dots, that may be related.

Code Ref:

https://github.com/netty/netty/blame/4.1/handler/src/main/java/io/netty/handler/ssl/ReferenceCountedOpenSslEngine.java#L345

armeria/core/src/main/java/com/linecorp/armeria/client/HttpClientPipelineConfigurator.java

Lines 232 to 234 in 82a1f94

sslEngine = sslCtx.newEngine(ch.alloc(),
raddr.getHostString(),
raddr.getPort());

ikhoon added a commit to ikhoon/armeria that referenced this issue Dec 23, 2024
@ikhoon
Fix a bug where a tailing dot is not stripped for SNI
21c26dc 
Motivation:

A trailing dot specified in an hostname can be used to make DNS queries
to avoid using search domains. However, the trailing dot should be
removed for SNI.

https://datatracker.ietf.org/doc/html/rfc6066#section-3
> The hostname is represented as a byte string using ASCII encoding
> without a trailing dot.

Modifications:

- Add `Endpoint.withTrailingDot()` to remove a trailing dot if exists.
- Use an `Endpoint` without a trailing dot create an remote address
  which is used for SNI.

Result:

- Fixed a bug where a trailing dot was included in the hostname used by SNI.
- Closes line#6044
@ikhoon ikhoon mentioned this issue Dec 23, 2024
Merged
@ikhoon ikhoon closed this as completed in 88fbb32 Jan 2, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Fix a bug where a tailing dot is not stripped for SNI ikhoon/armeria
1 participant
@yzfeng2020