SSL SNI varies when host contains port number

[HexF]

BPO	45423
Nosy	@tiran, @HexF
Files	test.py: Example script bpo45423.pcapng keylog

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = None
created_at = <Date 2021-10-10.13:41:48.510>
labels = ['type-bug', 'library', '3.9', '3.10']
title = 'SSL SNI varies when host contains port number'
updated_at = <Date 2021-10-10.14:42:14.740>
user = 'https://github.com/HexF'

bugs.python.org fields:

activity = <Date 2021-10-10.14:42:14.740>
actor = 'christian.heimes'
assignee = 'none'
closed = False
closed_date = None
closer = None
components = ['Library (Lib)']
creation = <Date 2021-10-10.13:41:48.510>
creator = 'hexf'
dependencies = []
files = ['50338', '50339', '50340']
hgrepos = []
issue_num = 45423
keywords = []
message_count = 2.0
messages = ['403586', '403591']
nosy_count = 2.0
nosy_names = ['christian.heimes', 'hexf']
pr_nums = []
priority = 'normal'
resolution = None
stage = None
status = 'open'
superseder = None
type = 'behavior'
url = 'https://bugs.python.org/issue45423'
versions = ['Python 3.9', 'Python 3.10']

[HexF]

Not entirely sure if this is intended.

When using urllib.request.urlopen, with a hostname and a varying port the SNI information sent differs.
To my undersnding, the SNI info shouldn't include the port and should only include the actual host.

Attached is an example script demonstrating the issue, where the only difference between the URLs is adding a port number.
The server it points to is configured to only match "ci.hexf.me".

[tiran]

I have tested your assumption with wireshark. It's not the TLS SNI extension. In both cases ssl module sends SNI "ci.hexf.me". The issue is likely caused by HTTP Host header. The host header contains the port.

I'm attaching the capture and keylog file.