Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

strip square brackets to parse ipv6 in setup_verify_hostname #2320

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

mzr
Copy link

@mzr mzr commented Oct 17, 2024

I have a use case where I need to use TLS (well, HTTPS), to speak to a server that doesn't have a proper hostname in CN, although it has a IPv6 address in Subject Alternative Name.

However IPv6, unlike IPv4 is often specified with square brackets, so libraries can differentiate between different segments of it and a port. Both are delimited with :, so IPv6 in the authority part of a url can be used like [2a01:cc00:bbbb:aaaa:1864:842:abcd:5fd2]:443.

I've had some difficulties making cert verification work and in the end I found this function calling set_host with [2a01:cc00:bbbb:aaaa:1864:842:abcd:5fd2] because it couldn't parse the IP so it was assuming it must be a hostname.

RFC3986 Uniform Resource Identifier (URI): Generic Syntax says:

A host identified by an Internet Protocol literal address, version 6
[RFC3513] or later, is distinguished by enclosing the IP literal
within square brackets ("[" and "]"). This is the only place where
square bracket characters are allowed in the URI syntax.

It means [ and ] aren't even valid hostname characters so existence of this strip might exist here.
TBH it's hard to say which layer of typical library "stack" should be responsible for this. It seems like a grey area a bit to me. Perhaps could be handled by all libraries using rust-openssl, but sometimes this is buried deep down in code, or straight up not possible to be done by users of such libraries because limited APIs, so why not just have it here?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant