Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[http_client_asio] rfc2818_verification and "trailing dot" FQDN URIs #1113

Open
garethsb opened this issue Apr 16, 2019 · 0 comments
Open

[http_client_asio] rfc2818_verification and "trailing dot" FQDN URIs #1113

garethsb opened this issue Apr 16, 2019 · 0 comments

Comments

@garethsb
Copy link
Contributor

garethsb commented Apr 16, 2019

Related to #832.

Given a web::http::http_client constructed with "https://www.example.com/foo/bar", PR #832 means that in http_client_asio.cpp, the handle_cert_verification function applies RFC 2818 matching to "www.example.com" as expected.

However, with a URL of "https://www.example.com./foo/bar", the trailing dot is not discarded and thus fails to match a cert with a SAN or CN that doesn't have the trailing dot. Most issued certificates seem not include the trailing dot in these fields.

My feeling is that the explanation in https://bugzilla.mozilla.org/show_bug.cgi?id=134402#c36 is about right...

Yes, it's ok to match "www.example.com." (trailing) to the cert with "www.example.com" (no trailing)
It's also OK to match "www.example.com" (no trailing) to the cert with "www.example.com." (trailing)

It's NOT OK to match "mybank.com" (as entered in the URL bar) to "mybank.com.mycompany.com" (as resolved by DNS).

This could be worked around in the application layer, i.e. by setting the Host header, but it feels like it can only be solved in the name-matching code, i.e. either in the way boost::asio::ssl::rfc2818_verification is called by the C++ REST SDK layer or possibly in the way it's implemented by the ASIO/SSL layer?

More commentary on this issue (for other implementation stacks) is at:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant